Improve pk_wrap calling convention and check for remaning ECP dependencies in PK files

[valeriosetti]

Following the comments in #7073 and discussion on slack, here is the to do list to be addressed before starting #7073 and #7074:

• Add missing USE_PSA_INIT()/DONE() in tests - actually while at it we could do this in a systematic way: according to our own documentation all PK, X.509 and SSL tests should have it (unless they already have MD_OR_USE_PSA_INIT()/DONE() of course, or a plain PSA_INIT()/PSA_DONE() for 1.3 tests). (Note: there's one in mbedtls_test_ssl_perform_handshake(), so test functions that are merely a wrapper around that don't need it.)
  • Fixing USE_PSA_INIT/DONE in SSL/X509/PK test suites #7461
• Change the calling convention to pass the full pk_context for existing wrappers - might be worth checking that the CI fully passes at this point (actually those two commits could even be a separate PR). See also this comment
  • Pass pk_context pointer to PK wrappers instead of void pointer #7463
• grep for remaining mbedtls_ecp functions in PK files and think about what's the plan for replacing/removing each one of them
  • Check remaning dependencies on ECP in PK module #7465

Note for reviewers/gatekeepers

All the points mentioned above will be addressed by separate PRs, so please wait for all of them to be addressed before closing this issue.

[tom-cosgrove-arm]

@valeriosetti Any chance of a title that gives some idea as to what the issue is about, please, so that everyone doesn't have to read the description (or two other issues) before they know if they need to look at this further or not?

[mpg]

grep for remaining mbedtls_ecp functions in PK files

Actually, on second thought, grepping the source is not going to be very helpful, as it will return a lot of calls from the !defined(MBEDTLS_USE_PSA_CRYPTO) path. Perhaps what we want to do instead is build with MBEDTLS_USE_PSA_CRYPTO and look for external dependencies on mbedtls_ecp_ functions in the object file, similarly to what docs/architecture/psa-migration/syms.sh instead we'd do it with pk.o, pkwrite.o, pkparse.o instead of libmbedx509.a and libmbedtls.a.

[gilles-peskine-arm]

grepping the source is not going to be very helpful, as it will return a lot of calls from the !defined(MBEDTLS_USE_PSA_CRYPTO) path

Run through cpp or unifdef?

[mpg]

I remember trying cpp, and IIRC the problem is we get many false positives from #include directives. I remember considering unifdef but I don't remember why I didn't end up using it and finally found it more convenient to just look for unresolved symbols in the object files.

[AndrzejKurek]

I believe that only one of three points has been addressed so far.

[valeriosetti]

I believe that only one of three points has been addressed so far.

Yes, I didn't notice this! Thanks!
Perhaps it's my fault that I already ticked the check-boxes after PRs' creation. Now I will select only the merged ones, to avoid confusion ;)

[AndrzejKurek]

I believe that only one of three points has been addressed so far.

Yes, I didn't notice this! Thanks! Perhaps it's my fault that I already ticked the check-boxes after PRs' creation. Now I will select only the merged ones, to avoid confusion ;)

I think that the problem was writing resolves xxx in the merged PR :) Even though there was "partially" before "resolves", github doesn't understand that and picks it up as a resolution for the issue :)