Accelerate legacy WSS elliptic-curve operations and time TLS phases

Enable mbedTLS NIST modular reduction and report per-phase handshake timings. Add handshake-loop regression tests and a certificate verification benchmark, and document the full kernel and APP package requirement.

tools/test_mbedtls_cert.py

@@ -2,13 +2,17 @@
 Run from a Visual Studio developer shell. Chain PEMs come from the WSS probe.
 """
 from pathlib import Path
+import argparse
 import subprocess
-import sys
 
 root = Path(__file__).resolve().parents[1]
-output = root / 'artifacts/wss/ecc-fix/host-cert'
+parser = argparse.ArgumentParser()
+parser.add_argument('chain', nargs='?', default=str(root / 'artifacts/wss/retest-443'))
+parser.add_argument('--compare-nist', action='store_true')
+args = parser.parse_args()
+output = root / 'artifacts/wss/tls-speed/host-cert'
 output.mkdir(parents=True, exist_ok=True)
-chain = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else root / 'artifacts/wss/retest-443'
+chain = Path(args.chain).resolve()
 sources = '''asn1parse asn1write bignum base64 pem oid pk pkparse pk_wrap rsa rsa_internal
 ecp ecp_curves ecdsa md md5 sha1 sha256 sha512 aes des gcm cipher cipher_wrap
 chacha20 chachapoly poly1305 constant_time ctr_drbg x509 x509_crt platform_util
@@ -21,7 +25,9 @@ command = ['cl', '/nologo', '/O2', '/Gy', '/TC', '/D_CRT_SECURE_NO_WARNINGS',
            str(root / 'tools/test_mbedtls_cert.c'),
            str(root / 'ql-application/threadx/interface/custom_app/talkingq_root_ca.c')]
 command += [str(root / ('ql-kernel/threadx/quec_mbedtls/' + name + '.c')) for name in sources]
-exe = output / 'test_mbedtls_cert.exe'
-command += ['/Fe' + str(exe), '/link', '/OPT:REF']
-subprocess.run(command, cwd=output, check=True)
-subprocess.run([str(exe), str(chain)], check=True)
+for variant in (['baseline', 'nist'] if args.compare_nist else ['nist']):
+    exe = output / ('test_mbedtls_cert_' + variant + '.exe')
+    flags = ['/DWSS_TEST_DISABLE_NIST_OPTIM'] if variant == 'baseline' else []
+    subprocess.run(command + flags + ['/Fe' + str(exe), '/link', '/OPT:REF'], cwd=output, check=True)
+    print('Certificate test variant:', variant, flush=True)
+    subprocess.run([str(exe), str(chain)], check=True)