From 7d374b2fc9d2212c979b69baa1a87167ec5565b8 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Thu, 26 Mar 2020 23:17:35 -0700
Subject: [PATCH 01/10] extmod/modussl: improve exception error messages

---
 extmod/modussl_axtls.c               | 55 ++++++++++++++++++++-
 extmod/modussl_mbedtls.c             | 44 +++++++++++++++--
 ports/esp32/Makefile                 |  5 +-
 ports/esp32/lwip_err.c               | 72 ++++++++++++++++++++++++++++
 ports/esp32/modsocket.c              |  8 ++++
 tests/extmod/ussl_basic.py           |  2 +-
 tests/extmod/ussl_basic.py.exp       |  3 +-
 tests/net_inet/tls_num_errors.py     | 44 +++++++++++++++++
 tests/net_inet/tls_num_errors.py.exp |  2 +
 tests/net_inet/tls_text_errors.py    | 29 +++++++++++
 10 files changed, 254 insertions(+), 10 deletions(-)
 create mode 100644 ports/esp32/lwip_err.c
 create mode 100644 tests/net_inet/tls_num_errors.py
 create mode 100644 tests/net_inet/tls_num_errors.py.exp
 create mode 100644 tests/net_inet/tls_text_errors.py

diff --git a/extmod/modussl_axtls.c b/extmod/modussl_axtls.c
index 7b0e3cbcbc327..c1a3d33296916 100644
--- a/extmod/modussl_axtls.c
+++ b/extmod/modussl_axtls.c
@@ -29,6 +29,7 @@
 
 #include "py/runtime.h"
 #include "py/stream.h"
+#include "py/objstr.h"
 
 #if MICROPY_PY_USSL && MICROPY_SSL_AXTLS
 
@@ -54,6 +55,57 @@ struct ssl_args {
 
 STATIC const mp_obj_type_t ussl_socket_type;
 
+// Table of errors
+struct ssl_errs {
+    int16_t errnum;
+    const char *errstr;
+};
+STATIC const struct ssl_errs ssl_error_tab[] = {
+    { SSL_NOT_OK, "NOT_OK" },
+    { SSL_ERROR_DEAD, "DEAD" },
+    { SSL_CLOSE_NOTIFY, "CLOSE_NOTIFY" },
+    { SSL_EAGAIN, "EAGAIN" },
+    { SSL_ERROR_CONN_LOST, "CONN_LOST" },
+    { SSL_ERROR_RECORD_OVERFLOW, "RECORD_OVERFLOW" },
+    { SSL_ERROR_SOCK_SETUP_FAILURE, "SOCK_SETUP_FAILURE" },
+    { SSL_ERROR_INVALID_HANDSHAKE, "INVALID_HANDSHAKE" },
+    { SSL_ERROR_INVALID_PROT_MSG, "INVALID_PROT_MSG" },
+    { SSL_ERROR_INVALID_HMAC, "INVALID_HMAC" },
+    { SSL_ERROR_INVALID_VERSION, "INVALID_VERSION" },
+    { SSL_ERROR_UNSUPPORTED_EXTENSION, "UNSUPPORTED_EXTENSION" },
+    { SSL_ERROR_INVALID_SESSION, "INVALID_SESSION" },
+    { SSL_ERROR_NO_CIPHER, "NO_CIPHER" },
+    { SSL_ERROR_INVALID_CERT_HASH_ALG, "INVALID_CERT_HASH_ALG" },
+    { SSL_ERROR_BAD_CERTIFICATE, "BAD_CERTIFICATE" },
+    { SSL_ERROR_INVALID_KEY, "INVALID_KEY" },
+    { SSL_ERROR_FINISHED_INVALID, "FINISHED_INVALID" },
+    { SSL_ERROR_NO_CERT_DEFINED, "NO_CERT_DEFINED" },
+    { SSL_ERROR_NO_CLIENT_RENOG, "NO_CLIENT_RENOG" },
+    { SSL_ERROR_NOT_SUPPORTED, "NOT_SUPPORTED" },
+    { 0, 0 },
+};
+
+STATIC NORETURN void ussl_raise_error(int err) {
+    for (int i = 0; ssl_error_tab[i].errnum != 0; i++) {
+        if (ssl_error_tab[i].errnum == err) {
+	    // construct string object
+	    mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
+	    if (o_str == NULL) {
+		break;
+	    }
+	    o_str->base.type = &mp_type_str;
+	    o_str->data = (const byte *)ssl_error_tab[i].errstr;
+	    o_str->len = strlen((char *)o_str->data);
+	    o_str->hash = qstr_compute_hash(o_str->data, o_str->len);
+	    // raise
+	    mp_obj_t args[2] = { MP_OBJ_NEW_SMALL_INT(err), MP_OBJ_FROM_PTR(o_str)};
+	    nlr_raise(mp_obj_exception_make_new(&mp_type_OSError, 2, 0, args));
+        }
+    }
+    mp_raise_OSError(err);
+}
+
+
 STATIC mp_obj_ssl_socket_t *ussl_socket_new(mp_obj_t sock, struct ssl_args *args) {
     #if MICROPY_PY_USSL_FINALISER
     mp_obj_ssl_socket_t *o = m_new_obj_with_finaliser(mp_obj_ssl_socket_t);
@@ -107,9 +159,8 @@ STATIC mp_obj_ssl_socket_t *ussl_socket_new(mp_obj_t sock, struct ssl_args *args
             int res = ssl_handshake_status(o->ssl_sock);
 
             if (res != SSL_OK) {
-                printf("ssl_handshake_status: %d\n", res);
                 ssl_display_error(res);
-                mp_raise_OSError(MP_EIO);
+                ussl_raise_error(res);
             }
         }
 
diff --git a/extmod/modussl_mbedtls.c b/extmod/modussl_mbedtls.c
index 9e117c82ccf34..de119ee9520e7 100644
--- a/extmod/modussl_mbedtls.c
+++ b/extmod/modussl_mbedtls.c
@@ -34,6 +34,7 @@
 
 #include "py/runtime.h"
 #include "py/stream.h"
+#include "py/objstr.h"
 
 // mbedtls_time_t
 #include "mbedtls/platform.h"
@@ -43,6 +44,8 @@
 #include "mbedtls/entropy.h"
 #include "mbedtls/ctr_drbg.h"
 #include "mbedtls/debug.h"
+#include "mbedtls/error.h"
+#include MBEDTLS_CONFIG_FILE
 
 typedef struct _mp_obj_ssl_socket_t {
     mp_obj_base_t base;
@@ -74,6 +77,42 @@ STATIC void mbedtls_debug(void *ctx, int level, const char *file, int line, cons
 }
 #endif
 
+STATIC NORETURN void mbedtls_raise_error(int err) {
+    #if defined(MBEDTLS_ERROR_C)
+    // Including mbedtls_strerror takes about 16KB on the esp32 due to all the strings.
+    // MBEDTLS_ERROR_C is the define used by mbedtls to conditionally include mbedtls_strerror.
+    // It is set/unset in the MBEDTLS_CONFIG_FILE which is defined in the Makefile.
+    // "small" negative integer error codes come from underlying stream/sockets, not mbedtls
+    if (err < 0 && err > -256) {
+        mp_raise_OSError(-err);
+    }
+
+    // Try to allocate memory for the message
+    #define ERR_STR_MAX 100  // mbedtls_strerror truncates if it doesn't fit
+    mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
+    byte *o_str_buf = m_new_maybe(byte, ERR_STR_MAX);
+    if (o_str == NULL || o_str_buf == NULL) {
+        mp_raise_OSError(err);
+    }
+
+    // print the error message into the allocated buffer
+    mbedtls_strerror(err, (char *)o_str_buf, ERR_STR_MAX);
+    size_t len = strnlen((char *)o_str_buf, ERR_STR_MAX);
+
+    // Put the exception object together
+    o_str->base.type = &mp_type_str;
+    o_str->data = o_str_buf;
+    o_str->len = len;
+    o_str->hash = qstr_compute_hash(o_str->data, o_str->len);
+    // raise
+    mp_obj_t args[2] = { MP_OBJ_NEW_SMALL_INT(err), MP_OBJ_FROM_PTR(o_str)};
+    nlr_raise(mp_obj_exception_make_new(&mp_type_OSError, 2, 0, args));
+    #else
+    // mbedtls is compiled without error strings so we simply return the err number
+    mp_raise_OSError(err); // typ. err is negative
+    #endif
+}
+
 STATIC int _mbedtls_ssl_send(void *ctx, const byte *buf, size_t len) {
     mp_obj_t sock = *(mp_obj_t *)ctx;
 
@@ -85,7 +124,7 @@ STATIC int _mbedtls_ssl_send(void *ctx, const byte *buf, size_t len) {
         if (mp_is_nonblocking_error(err)) {
             return MBEDTLS_ERR_SSL_WANT_WRITE;
         }
-        return -err;
+        return -err; // convert an MP_ERRNO to something mbedtls passes through as error
     } else {
         return out_sz;
     }
@@ -197,7 +236,6 @@ STATIC mp_obj_ssl_socket_t *socket_new(mp_obj_t sock, struct ssl_args *args) {
     if (args->do_handshake.u_bool) {
         while ((ret = mbedtls_ssl_handshake(&o->ssl)) != 0) {
             if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
-                printf("mbedtls_ssl_handshake error: -%x\n", -ret);
                 goto cleanup;
             }
         }
@@ -221,7 +259,7 @@ STATIC mp_obj_ssl_socket_t *socket_new(mp_obj_t sock, struct ssl_args *args) {
     } else if (ret == MBEDTLS_ERR_X509_BAD_INPUT_DATA) {
         mp_raise_ValueError(MP_ERROR_TEXT("invalid cert"));
     } else {
-        mp_raise_OSError(MP_EIO);
+        mbedtls_raise_error(ret);
     }
 }
 
diff --git a/ports/esp32/Makefile b/ports/esp32/Makefile
index 0f6a1969a6208..f609f0d0db8d6 100644
--- a/ports/esp32/Makefile
+++ b/ports/esp32/Makefile
@@ -354,6 +354,7 @@ SRC_C = \
 	mpthreadport.c \
 	machine_rtc.c \
 	machine_sdcard.c \
+	lwip_err.c \
 	$(wildcard $(BOARD_DIR)/*.c) \
 	$(SRC_MOD)
 
@@ -493,7 +494,7 @@ ESPIDF_SPI_FLASH_O = $(patsubst %.c,%.o,$(wildcard $(ESPCOMP)/spi_flash/*.c))
 ESPIDF_ULP_O = $(patsubst %.c,%.o,$(wildcard $(ESPCOMP)/ulp/*.c))
 
 $(BUILD)/$(ESPCOMP)/lwip/%.o: CFLAGS += -Wno-address -Wno-unused-variable -Wno-unused-but-set-variable
-ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
+ESPIDF_LWIP_O = $(patsubst %.c,%.o, $(filter-out %lwip/src/api/err.c, \
 	$(wildcard $(ESPCOMP)/lwip/apps/dhcpserver/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/api/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/apps/sntp/*.c) \
@@ -504,7 +505,7 @@ ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/netif/*/*/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*/*.c) \
-	)
+	))
 
 ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/mbedtls/mbedtls/library/*.c) \
diff --git a/ports/esp32/lwip_err.c b/ports/esp32/lwip_err.c
new file mode 100644
index 0000000000000..e8d35dfc6899a
--- /dev/null
+++ b/ports/esp32/lwip_err.c
@@ -0,0 +1,72 @@
+//
+// Micropython note: this is a copy of ESP-IDFv4.0's components/lwip/lwip/src/api/err.c with
+// the error EXXX constants replaced by MicroPython's to avoid getting the wrong values because
+// ESP-IDFv4.0 uses ones from newlib (in components/newlib) that have a bunch of different values.
+// It is assumed that ESP-IDFv4.1 fixes this discrepancy.
+
+/*
+ * Copyright (c) 2001-2004 Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+
+#include "lwip/def.h"
+#include "lwip/sys.h"
+#include "py/mperrno.h"
+
+/** Table to quickly map an lwIP error (err_t) to a socket error
+  * by using -err as an index */
+static const int err_to_errno_table[] = {
+    0,              /* ERR_OK          0      No error, everything OK. */
+    MP_ENOMEM,      /* ERR_MEM        -1      Out of memory error.     */
+    MP_ENOBUFS,     /* ERR_BUF        -2      Buffer error.            */
+    MP_EWOULDBLOCK, /* ERR_TIMEOUT    -3      Timeout                  */
+    MP_EHOSTUNREACH, /* ERR_RTE        -4      Routing problem.         */
+    MP_EINPROGRESS, /* ERR_INPROGRESS -5      Operation in progress    */
+    MP_EINVAL,      /* ERR_VAL        -6      Illegal value.           */
+    MP_EWOULDBLOCK, /* ERR_WOULDBLOCK -7      Operation would block.   */
+    MP_EADDRINUSE,  /* ERR_USE        -8      Address in use.          */
+    MP_EALREADY,    /* ERR_ALREADY    -9      Already connecting.      */
+    MP_EISCONN,     /* ERR_ISCONN     -10     Conn already established.*/
+    MP_ENOTCONN,    /* ERR_CONN       -11     Not connected.           */
+    -1,             /* ERR_IF         -12     Low-level netif error    */
+    MP_ECONNABORTED, /* ERR_ABRT       -13     Connection aborted.      */
+    MP_ECONNRESET,  /* ERR_RST        -14     Connection reset.        */
+    MP_ENOTCONN,    /* ERR_CLSD       -15     Connection closed.       */
+    MP_EIO          /* ERR_ARG        -16     Illegal argument.        */
+};
+
+int
+err_to_errno(err_t err) {
+    if ((err > 0) || (-err >= (err_t)LWIP_ARRAYSIZE(err_to_errno_table))) {
+        return EIO;
+    }
+    //printf("lwip err_to_errno %d->%d\n", err, err_to_errno_table[-err]);
+    return err_to_errno_table[-err];
+}
diff --git a/ports/esp32/modsocket.c b/ports/esp32/modsocket.c
index 85433e575fc51..c67ca6a7d3444 100644
--- a/ports/esp32/modsocket.c
+++ b/ports/esp32/modsocket.c
@@ -153,6 +153,13 @@ void usocket_events_handler(void) {
 
 #endif // MICROPY_PY_USOCKET_EVENTS
 
+// EXXX error constants in ESP-IDF v4.0 and prior come from a newlib errno.h which has some
+// non-posix values, i.e., different from mperrno.h. This used to get fixed incompletely in
+// exception_from_errno, but it turns out to be easier to fix in lwip's err.c which maps lwip's
+// netif error codes into EXXX. The old code is left in here until the whole problem really
+// goes away with ESP-IDF v4.1 (we hope).
+#define exception_from_errno(errno) mp_raise_OSError(errno)
+#if 0
 NORETURN static void exception_from_errno(int _errno) {
     // Here we need to convert from lwip errno values to MicroPython's standard ones
     if (_errno == EADDRINUSE) {
@@ -162,6 +169,7 @@ NORETURN static void exception_from_errno(int _errno) {
     }
     mp_raise_OSError(_errno);
 }
+#endif
 
 static inline void check_for_exceptions(void) {
     mp_handle_pending(true);
diff --git a/tests/extmod/ussl_basic.py b/tests/extmod/ussl_basic.py
index b4e21c7dce660..9e1821dca9981 100644
--- a/tests/extmod/ussl_basic.py
+++ b/tests/extmod/ussl_basic.py
@@ -9,7 +9,7 @@
 
 # create in client mode
 try:
-    ss = ssl.wrap_socket(io.BytesIO())
+    ss = ssl.wrap_socket(io.BytesIO(), server_hostname="test.example.com")
 except OSError as er:
     print("wrap_socket:", repr(er))
 
diff --git a/tests/extmod/ussl_basic.py.exp b/tests/extmod/ussl_basic.py.exp
index 5282338319efb..0cec309e5868d 100644
--- a/tests/extmod/ussl_basic.py.exp
+++ b/tests/extmod/ussl_basic.py.exp
@@ -1,5 +1,4 @@
-ssl_handshake_status: -256
-wrap_socket: OSError(5,)
+wrap_socket: OSError('AXTLS -256: CONN_LOST',)
 <_SSLSocket 
 4
 b''
diff --git a/tests/net_inet/tls_num_errors.py b/tests/net_inet/tls_num_errors.py
new file mode 100644
index 0000000000000..a04941e9155db
--- /dev/null
+++ b/tests/net_inet/tls_num_errors.py
@@ -0,0 +1,44 @@
+# test that modtls produces a text error message
+
+try:
+    import usocket as socket, ussl as ssl, sys
+except:
+    import socket, ssl, sys
+try:
+    from micropython import alloc_emergency_exception_buf, heap_lock, heap_unlock
+except:
+    print("SKIP")
+    raise SystemExit
+
+
+# test with heap locked to see it switch to number-only error message
+def test(addr):
+    alloc_emergency_exception_buf(256)
+    s = socket.socket()
+    s.connect(addr)
+    try:
+        s.setblocking(False)
+        s = ssl.wrap_socket(s, do_handshake=False)
+        heap_lock()
+        print("heap is locked")
+        while True:
+            ret = s.write('foo')
+            if ret:
+                break
+        heap_unlock()
+        print("wrap: no exception")
+    except OSError as e:
+        heap_unlock()
+        # mbedtls produces "-29184"
+        # axtls produces "RECORD_OVERFLOW"
+        ok = "-29184" in str(e) or "RECORD_OVERFLOW" in str(e)
+        print("wrap:", ok)
+        if not ok:
+            print("got exception:", e)
+    s.close()
+
+
+if __name__ == "__main__":
+    # connect to plain HTTP port, oops!
+    addr = socket.getaddrinfo("micropython.org", 80)[0][-1]
+    test(addr)
diff --git a/tests/net_inet/tls_num_errors.py.exp b/tests/net_inet/tls_num_errors.py.exp
new file mode 100644
index 0000000000000..e6a15634d00ae
--- /dev/null
+++ b/tests/net_inet/tls_num_errors.py.exp
@@ -0,0 +1,2 @@
+heap is locked
+wrap: True
diff --git a/tests/net_inet/tls_text_errors.py b/tests/net_inet/tls_text_errors.py
new file mode 100644
index 0000000000000..8a0ea824909fa
--- /dev/null
+++ b/tests/net_inet/tls_text_errors.py
@@ -0,0 +1,29 @@
+# test that modtls produces a text error message
+
+try:
+    import usocket as socket, ussl as ssl, sys
+except:
+    import socket, ssl, sys
+
+
+def test(addr):
+    s = socket.socket()
+    s.connect(addr)
+    try:
+        s = ssl.wrap_socket(s)
+        print("wrap: no exception")
+    except OSError as e:
+        # mbedtls produces "mbedtls -0x7200: SSL - An invalid SSL record was received"
+        # axtls produces "RECORD_OVERFLOW"
+        # CPython produces "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1108)"
+        ok = "invalid SSL record" in str(e) or "RECORD_OVERFLOW" in str(e) or \
+                "wrong version" in str(e)
+        print("wrap:", ok)
+        if not ok:
+            print("got exception:", e)
+    s.close()
+
+if __name__ == "__main__":
+    # connect to plain HTTP port, oops!
+    addr = socket.getaddrinfo("micropython.org", 80)[0][-1]
+    test(addr)

From e6ad6c4968e68c8fbe963b37a31c78f76717cb89 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Fri, 24 Apr 2020 11:29:49 -0700
Subject: [PATCH 02/10] codeformat

---
 extmod/modussl_axtls.c            | 24 ++++++++++++------------
 ports/esp32/lwip_err.c            |  2 +-
 tests/net_inet/tls_num_errors.py  |  2 +-
 tests/net_inet/tls_text_errors.py |  8 ++++++--
 4 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/extmod/modussl_axtls.c b/extmod/modussl_axtls.c
index c1a3d33296916..563ac3b5c1e71 100644
--- a/extmod/modussl_axtls.c
+++ b/extmod/modussl_axtls.c
@@ -88,18 +88,18 @@ STATIC const struct ssl_errs ssl_error_tab[] = {
 STATIC NORETURN void ussl_raise_error(int err) {
     for (int i = 0; ssl_error_tab[i].errnum != 0; i++) {
         if (ssl_error_tab[i].errnum == err) {
-	    // construct string object
-	    mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
-	    if (o_str == NULL) {
-		break;
-	    }
-	    o_str->base.type = &mp_type_str;
-	    o_str->data = (const byte *)ssl_error_tab[i].errstr;
-	    o_str->len = strlen((char *)o_str->data);
-	    o_str->hash = qstr_compute_hash(o_str->data, o_str->len);
-	    // raise
-	    mp_obj_t args[2] = { MP_OBJ_NEW_SMALL_INT(err), MP_OBJ_FROM_PTR(o_str)};
-	    nlr_raise(mp_obj_exception_make_new(&mp_type_OSError, 2, 0, args));
+            // construct string object
+            mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
+            if (o_str == NULL) {
+                break;
+            }
+            o_str->base.type = &mp_type_str;
+            o_str->data = (const byte *)ssl_error_tab[i].errstr;
+            o_str->len = strlen((char *)o_str->data);
+            o_str->hash = qstr_compute_hash(o_str->data, o_str->len);
+            // raise
+            mp_obj_t args[2] = { MP_OBJ_NEW_SMALL_INT(err), MP_OBJ_FROM_PTR(o_str)};
+            nlr_raise(mp_obj_exception_make_new(&mp_type_OSError, 2, 0, args));
         }
     }
     mp_raise_OSError(err);
diff --git a/ports/esp32/lwip_err.c b/ports/esp32/lwip_err.c
index e8d35dfc6899a..8836ba7ac12a5 100644
--- a/ports/esp32/lwip_err.c
+++ b/ports/esp32/lwip_err.c
@@ -67,6 +67,6 @@ err_to_errno(err_t err) {
     if ((err > 0) || (-err >= (err_t)LWIP_ARRAYSIZE(err_to_errno_table))) {
         return EIO;
     }
-    //printf("lwip err_to_errno %d->%d\n", err, err_to_errno_table[-err]);
+    // printf("lwip err_to_errno %d->%d\n", err, err_to_errno_table[-err]);
     return err_to_errno_table[-err];
 }
diff --git a/tests/net_inet/tls_num_errors.py b/tests/net_inet/tls_num_errors.py
index a04941e9155db..b57e7f03d1252 100644
--- a/tests/net_inet/tls_num_errors.py
+++ b/tests/net_inet/tls_num_errors.py
@@ -22,7 +22,7 @@ def test(addr):
         heap_lock()
         print("heap is locked")
         while True:
-            ret = s.write('foo')
+            ret = s.write("foo")
             if ret:
                 break
         heap_unlock()
diff --git a/tests/net_inet/tls_text_errors.py b/tests/net_inet/tls_text_errors.py
index 8a0ea824909fa..2ba167b868ef8 100644
--- a/tests/net_inet/tls_text_errors.py
+++ b/tests/net_inet/tls_text_errors.py
@@ -16,13 +16,17 @@ def test(addr):
         # mbedtls produces "mbedtls -0x7200: SSL - An invalid SSL record was received"
         # axtls produces "RECORD_OVERFLOW"
         # CPython produces "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1108)"
-        ok = "invalid SSL record" in str(e) or "RECORD_OVERFLOW" in str(e) or \
-                "wrong version" in str(e)
+        ok = (
+            "invalid SSL record" in str(e)
+            or "RECORD_OVERFLOW" in str(e)
+            or "wrong version" in str(e)
+        )
         print("wrap:", ok)
         if not ok:
             print("got exception:", e)
     s.close()
 
+
 if __name__ == "__main__":
     # connect to plain HTTP port, oops!
     addr = socket.getaddrinfo("micropython.org", 80)[0][-1]

From 2e94be959c13358e41b37e8ea55065f29d50e995 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Fri, 24 Apr 2020 12:15:32 -0700
Subject: [PATCH 03/10] fix ussl_basic test

---
 tests/extmod/ussl_basic.py.exp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/extmod/ussl_basic.py.exp b/tests/extmod/ussl_basic.py.exp
index 0cec309e5868d..eb7df855aa099 100644
--- a/tests/extmod/ussl_basic.py.exp
+++ b/tests/extmod/ussl_basic.py.exp
@@ -1,4 +1,4 @@
-wrap_socket: OSError('AXTLS -256: CONN_LOST',)
+wrap_socket: OSError(-256, 'CONN_LOST')
 <_SSLSocket 
 4
 b''

From cb6fe5750b69d30d61e31878e72310a817e24852 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Fri, 24 Apr 2020 13:34:01 -0700
Subject: [PATCH 04/10] remove unrelated change to err_to_errno

---
 ports/esp32/Makefile    |  5 ++-
 ports/esp32/lwip_err.c  | 72 -----------------------------------------
 ports/esp32/modsocket.c |  8 -----
 3 files changed, 2 insertions(+), 83 deletions(-)
 delete mode 100644 ports/esp32/lwip_err.c

diff --git a/ports/esp32/Makefile b/ports/esp32/Makefile
index f609f0d0db8d6..0f6a1969a6208 100644
--- a/ports/esp32/Makefile
+++ b/ports/esp32/Makefile
@@ -354,7 +354,6 @@ SRC_C = \
 	mpthreadport.c \
 	machine_rtc.c \
 	machine_sdcard.c \
-	lwip_err.c \
 	$(wildcard $(BOARD_DIR)/*.c) \
 	$(SRC_MOD)
 
@@ -494,7 +493,7 @@ ESPIDF_SPI_FLASH_O = $(patsubst %.c,%.o,$(wildcard $(ESPCOMP)/spi_flash/*.c))
 ESPIDF_ULP_O = $(patsubst %.c,%.o,$(wildcard $(ESPCOMP)/ulp/*.c))
 
 $(BUILD)/$(ESPCOMP)/lwip/%.o: CFLAGS += -Wno-address -Wno-unused-variable -Wno-unused-but-set-variable
-ESPIDF_LWIP_O = $(patsubst %.c,%.o, $(filter-out %lwip/src/api/err.c, \
+ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/lwip/apps/dhcpserver/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/api/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/apps/sntp/*.c) \
@@ -505,7 +504,7 @@ ESPIDF_LWIP_O = $(patsubst %.c,%.o, $(filter-out %lwip/src/api/err.c, \
 	$(wildcard $(ESPCOMP)/lwip/lwip/src/netif/*/*/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*.c) \
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*/*.c) \
-	))
+	)
 
 ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/mbedtls/mbedtls/library/*.c) \
diff --git a/ports/esp32/lwip_err.c b/ports/esp32/lwip_err.c
deleted file mode 100644
index 8836ba7ac12a5..0000000000000
--- a/ports/esp32/lwip_err.c
+++ /dev/null
@@ -1,72 +0,0 @@
-//
-// Micropython note: this is a copy of ESP-IDFv4.0's components/lwip/lwip/src/api/err.c with
-// the error EXXX constants replaced by MicroPython's to avoid getting the wrong values because
-// ESP-IDFv4.0 uses ones from newlib (in components/newlib) that have a bunch of different values.
-// It is assumed that ESP-IDFv4.1 fixes this discrepancy.
-
-/*
- * Copyright (c) 2001-2004 Swedish Institute of Computer Science.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without modification,
- * are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice,
- *    this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the documentation
- *    and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
- * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
- * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
- * OF SUCH DAMAGE.
- *
- * This file is part of the lwIP TCP/IP stack.
- *
- * Author: Adam Dunkels <adam@sics.se>
- *
- */
-
-#include "lwip/def.h"
-#include "lwip/sys.h"
-#include "py/mperrno.h"
-
-/** Table to quickly map an lwIP error (err_t) to a socket error
-  * by using -err as an index */
-static const int err_to_errno_table[] = {
-    0,              /* ERR_OK          0      No error, everything OK. */
-    MP_ENOMEM,      /* ERR_MEM        -1      Out of memory error.     */
-    MP_ENOBUFS,     /* ERR_BUF        -2      Buffer error.            */
-    MP_EWOULDBLOCK, /* ERR_TIMEOUT    -3      Timeout                  */
-    MP_EHOSTUNREACH, /* ERR_RTE        -4      Routing problem.         */
-    MP_EINPROGRESS, /* ERR_INPROGRESS -5      Operation in progress    */
-    MP_EINVAL,      /* ERR_VAL        -6      Illegal value.           */
-    MP_EWOULDBLOCK, /* ERR_WOULDBLOCK -7      Operation would block.   */
-    MP_EADDRINUSE,  /* ERR_USE        -8      Address in use.          */
-    MP_EALREADY,    /* ERR_ALREADY    -9      Already connecting.      */
-    MP_EISCONN,     /* ERR_ISCONN     -10     Conn already established.*/
-    MP_ENOTCONN,    /* ERR_CONN       -11     Not connected.           */
-    -1,             /* ERR_IF         -12     Low-level netif error    */
-    MP_ECONNABORTED, /* ERR_ABRT       -13     Connection aborted.      */
-    MP_ECONNRESET,  /* ERR_RST        -14     Connection reset.        */
-    MP_ENOTCONN,    /* ERR_CLSD       -15     Connection closed.       */
-    MP_EIO          /* ERR_ARG        -16     Illegal argument.        */
-};
-
-int
-err_to_errno(err_t err) {
-    if ((err > 0) || (-err >= (err_t)LWIP_ARRAYSIZE(err_to_errno_table))) {
-        return EIO;
-    }
-    // printf("lwip err_to_errno %d->%d\n", err, err_to_errno_table[-err]);
-    return err_to_errno_table[-err];
-}
diff --git a/ports/esp32/modsocket.c b/ports/esp32/modsocket.c
index c67ca6a7d3444..85433e575fc51 100644
--- a/ports/esp32/modsocket.c
+++ b/ports/esp32/modsocket.c
@@ -153,13 +153,6 @@ void usocket_events_handler(void) {
 
 #endif // MICROPY_PY_USOCKET_EVENTS
 
-// EXXX error constants in ESP-IDF v4.0 and prior come from a newlib errno.h which has some
-// non-posix values, i.e., different from mperrno.h. This used to get fixed incompletely in
-// exception_from_errno, but it turns out to be easier to fix in lwip's err.c which maps lwip's
-// netif error codes into EXXX. The old code is left in here until the whole problem really
-// goes away with ESP-IDF v4.1 (we hope).
-#define exception_from_errno(errno) mp_raise_OSError(errno)
-#if 0
 NORETURN static void exception_from_errno(int _errno) {
     // Here we need to convert from lwip errno values to MicroPython's standard ones
     if (_errno == EADDRINUSE) {
@@ -169,7 +162,6 @@ NORETURN static void exception_from_errno(int _errno) {
     }
     mp_raise_OSError(_errno);
 }
-#endif
 
 static inline void check_for_exceptions(void) {
     mp_handle_pending(true);

From 1ead21edd7eb74ca03ed645028f60990ba77559c Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Fri, 29 May 2020 13:05:47 -0700
Subject: [PATCH 05/10] mbedtls: produce shortened error strings

---
 extmod/mbedtls_errors/README.md               |  44 ++
 extmod/mbedtls_errors/do-esp32.sh             |   5 +
 extmod/mbedtls_errors/do-mp.sh                |   3 +
 extmod/mbedtls_errors/do-test.sh              |   4 +
 extmod/mbedtls_errors/error.fmt               | 165 ++++
 extmod/mbedtls_errors/error_orig.fmt          | 123 +++
 extmod/mbedtls_errors/esp32_mbedtls_errors.c  | 705 ++++++++++++++++++
 extmod/mbedtls_errors/generate_errors.pl      | 209 ++++++
 extmod/mbedtls_errors/generate_errors_orig.pl | 207 +++++
 extmod/mbedtls_errors/mp_mbedtls_errors.c     | 705 ++++++++++++++++++
 extmod/mbedtls_errors/tester.c                |  58 ++
 extmod/modussl_mbedtls.c                      |  20 +-
 lib/libc/string0.c                            |  17 +
 ports/esp32/Makefile                          |   6 +-
 ports/stm32/Makefile                          |   6 +
 ports/stm32/boards/PYBD_SF2/mpconfigboard.mk  |   1 +
 tests/net_inet/test_tls_sites.py              |   2 +-
 tests/net_inet/tls_text_errors.py             |   4 +-
 18 files changed, 2271 insertions(+), 13 deletions(-)
 create mode 100644 extmod/mbedtls_errors/README.md
 create mode 100755 extmod/mbedtls_errors/do-esp32.sh
 create mode 100755 extmod/mbedtls_errors/do-mp.sh
 create mode 100755 extmod/mbedtls_errors/do-test.sh
 create mode 100644 extmod/mbedtls_errors/error.fmt
 create mode 100644 extmod/mbedtls_errors/error_orig.fmt
 create mode 100644 extmod/mbedtls_errors/esp32_mbedtls_errors.c
 create mode 100755 extmod/mbedtls_errors/generate_errors.pl
 create mode 100755 extmod/mbedtls_errors/generate_errors_orig.pl
 create mode 100644 extmod/mbedtls_errors/mp_mbedtls_errors.c
 create mode 100644 extmod/mbedtls_errors/tester.c

diff --git a/extmod/mbedtls_errors/README.md b/extmod/mbedtls_errors/README.md
new file mode 100644
index 0000000000000..6772b2b10609b
--- /dev/null
+++ b/extmod/mbedtls_errors/README.md
@@ -0,0 +1,44 @@
+MBEDTLS Error Strings for MicroPython
+=====================================
+
+This directory contains source code and tools to rework the Mbedtls error strings for
+micropython to use less space. In short, instead of storing and printing something like
+"SSL - Our own certificate(s) is/are too large to send in an SSL message" it prints
+the name of the error #define, which would be `MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE` in
+this case, and only stores `SSL_CERTIFICATE_TOO_LARGE` in flash. The exact Mbedtls error
+defines are used because they're easy to search for to find more detailed information.
+
+Mbedtls defines a specific format for error values and
+includes a Perl script to gather all `MBEDTLS_ERR` defines from includes files together with
+english error text. From that the Perl script generates `mbedtls_strerror()`. The files in this
+directory modify this process to produce a more space efficient error lookup table with
+shorter error strings. The files are as follows:
+- `generate_errors_orig.pl` - original mbedtls perl script, copied here for reference
+- `error_orig.fmt` - original mbedtls code template input to perl script
+- `generate_errors.pl` - modified perl script for MicroPython
+- `error.fmt` - modified code template for MicroPython
+- `esp32_mbedtls_errors.c` - source file with `mbedtls_strerror` for Esp32, this is built
+  using the include files in ESP-IDF's version of mbedtls
+- `do-esp32.sh` - shell script to produce `esp32_mbedtls_errors.c` -- note that as of v4.0
+  and v3.3.2 ESP-IDF uses the same version of mbedtls
+- `mp_mbedtls_errors.c` - source file with `mbedtls_strerror` for ports using MicroPython's
+  version of mbedtls, this is built using the include files in `$MPY/lib/mbedtls`
+- `do-mp.sh` - shell script to produce `mp_mbedtls_errors.c`
+- `tester.c` - simple C main to test `mp_mbedtls_errors.c` locally on a dev box
+- `do-test.sh` - shell script to produce `mp_mbedtls_errors.c` and compile the `tester` app
+
+### How-to
+
+- To build MicroPython all that is needed is to include the `xx_mbedtls_errors.c` into the build
+  (the Makefiles do this automatically). Note that Perl is not needed for routine MicroPython
+  builds.
+- When a new version of Mbedtls is pulled-in the appropriate `do_` script(s) should be run and
+  a diff using the `_orig` files can show whether Mbedtls changed something in the error
+  formatting.
+- The `tester` app doesn't need to be run unless changes to the string handling in `error.fmt`
+  are made: it really just tests that there is not an off-by-one error in the string
+  copying/appending, etc.
+- To include/exclude `mbedtls_strerror` error strings in a specific MicroPython build use the
+  `??` macro. Excluding causes `mbedtls_strerror` to produce a string with the raw error code.
+  On the esp32, define/undefine `MBEDTLS_ERROR_C` in the ESP-IDF
+  `components/mbedtls/port/include/mbedtls/esp_config.h`.
diff --git a/extmod/mbedtls_errors/do-esp32.sh b/extmod/mbedtls_errors/do-esp32.sh
new file mode 100755
index 0000000000000..ad1eb618a45ec
--- /dev/null
+++ b/extmod/mbedtls_errors/do-esp32.sh
@@ -0,0 +1,5 @@
+#! /bin/bash -e
+# Generate esp32_mbedtls_errors.c for use in the Esp32 port, with the ESP-IDF version of mbedtls
+# The ESPIDF env var must be set to the top-level dir of ESPIDF
+echo "ESPIDF=$ESPIDF"
+./generate_errors.pl $ESPIDF/components/mbedtls/mbedtls/include/mbedtls . esp32_mbedtls_errors.c
diff --git a/extmod/mbedtls_errors/do-mp.sh b/extmod/mbedtls_errors/do-mp.sh
new file mode 100755
index 0000000000000..16b52848887d0
--- /dev/null
+++ b/extmod/mbedtls_errors/do-mp.sh
@@ -0,0 +1,3 @@
+#! /bin/bash -e
+# Generate mp_mbedtls_errors.c for inclusion in ports that use $MPY/lib/mbedtls
+./generate_errors.pl ../../lib/mbedtls/include/mbedtls . mp_mbedtls_errors.c
diff --git a/extmod/mbedtls_errors/do-test.sh b/extmod/mbedtls_errors/do-test.sh
new file mode 100755
index 0000000000000..d5b405b8e04f1
--- /dev/null
+++ b/extmod/mbedtls_errors/do-test.sh
@@ -0,0 +1,4 @@
+#! /bin/bash -e
+# Generate mp_mbedtls_errors.c and build the tester app
+./do-mp.sh
+cc -o tester -I../../lib/mbedtls/include/mbedtls/ mp_mbedtls_errors.c tester.c
diff --git a/extmod/mbedtls_errors/error.fmt b/extmod/mbedtls_errors/error.fmt
new file mode 100644
index 0000000000000..5beeb6e7c96b0
--- /dev/null
+++ b/extmod/mbedtls_errors/error.fmt
@@ -0,0 +1,165 @@
+/*
+ *  Error message information
+ *
+ *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if !defined(MBEDTLS_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include MBEDTLS_CONFIG_FILE
+#endif
+
+#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+#include "mbedtls/error.h"
+#include <string.h>
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define mbedtls_snprintf snprintf
+#define mbedtls_time_t   time_t
+#endif
+
+#if defined(MBEDTLS_ERROR_C)
+
+#include <stdio.h>
+
+HEADER_INCLUDED
+
+// Error code table type
+struct ssl_errs {
+    int16_t errnum;
+    const char *errstr;
+};
+
+// Table of high level error codes
+static const struct ssl_errs mbedtls_high_level_error_tab[] = {
+// BEGIN generated code
+HIGH_LEVEL_CODE_CHECKS
+// END generated code
+};
+
+static const struct ssl_errs mbedtls_low_level_error_tab[] = {
+// Low level error codes
+//
+// BEGIN generated code
+LOW_LEVEL_CODE_CHECKS
+// END generated code
+};
+
+static const char *mbedtls_err_prefix = "MBEDTLS_ERR_";
+#define MBEDTLS_ERR_PREFIX_LEN ( sizeof("MBEDTLS_ERR_")-1 )
+
+// copy error text into buffer, ensure null termination, return strlen of result
+static size_t mbedtls_err_to_str(int err, const struct ssl_errs tab[], int tab_len, char *buf, size_t buflen) {
+    if (buflen == 0) return 0;
+
+    // prefix for all error names
+    strncpy(buf, mbedtls_err_prefix, buflen);
+    if (buflen <= MBEDTLS_ERR_PREFIX_LEN+1) {
+        buf[buflen-1] = 0;
+        return buflen-1;
+    }
+
+    // append error name from table
+    for (int i = 0; i < tab_len; i++) {
+        if (tab[i].errnum == err) {
+            strncpy(buf+MBEDTLS_ERR_PREFIX_LEN, tab[i].errstr, buflen-MBEDTLS_ERR_PREFIX_LEN);
+            buf[buflen-1] = 0;
+            return strlen(buf);
+        }
+    }
+
+    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (0x%04X)",
+            err);
+    return strlen(buf);
+}
+
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+
+void mbedtls_strerror(int ret, char *buf, size_t buflen) {
+    int use_ret;
+
+    if (buflen == 0) return;
+
+    buf[buflen-1] = 0;
+
+    if (ret < 0) ret = -ret;
+
+    //
+    // High-level error codes
+    //
+    uint8_t got_hl = (ret & 0xFF80) != 0;
+    if (got_hl) {
+        use_ret = ret & 0xFF80;
+
+        // special case
+#if defined(MBEDTLS_SSL_TLS_C)
+        if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) {
+            strncpy(buf, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE", buflen);
+            buf[buflen-1] = 0;
+            return;
+        }
+#endif
+
+        size_t len = mbedtls_err_to_str(use_ret, mbedtls_high_level_error_tab,
+                ARRAY_SIZE(mbedtls_high_level_error_tab), buf, buflen);
+
+        buf += len;
+        buflen -= len;
+        if (buflen == 0) return;
+    }
+
+    //
+    // Low-level error codes
+    //
+    use_ret = ret & ~0xFF80;
+
+    if (use_ret == 0) return;
+
+    // If high level code is present, make a concatenation between both error strings.
+    if (got_hl) {
+        if (buflen < 2) return;
+        *buf++ = '+';
+        buflen--;
+    }
+
+    mbedtls_err_to_str(use_ret, mbedtls_low_level_error_tab,
+            ARRAY_SIZE(mbedtls_low_level_error_tab), buf, buflen);
+}
+
+#else /* MBEDTLS_ERROR_C */
+
+#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+
+/*
+ * Provide an non-function in case MBEDTLS_ERROR_C is not defined
+ */
+void mbedtls_strerror( int ret, char *buf, size_t buflen )
+{
+    ((void) ret);
+
+    if( buflen > 0 )
+        buf[0] = '\0';
+}
+
+#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
+
+#endif /* MBEDTLS_ERROR_C */
diff --git a/extmod/mbedtls_errors/error_orig.fmt b/extmod/mbedtls_errors/error_orig.fmt
new file mode 100644
index 0000000000000..a08742c83bb73
--- /dev/null
+++ b/extmod/mbedtls_errors/error_orig.fmt
@@ -0,0 +1,123 @@
+/*
+ *  Error message information
+ *
+ *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if !defined(MBEDTLS_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include MBEDTLS_CONFIG_FILE
+#endif
+
+#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+#include "mbedtls/error.h"
+#include <string.h>
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define mbedtls_snprintf snprintf
+#define mbedtls_time_t   time_t
+#endif
+
+#if defined(MBEDTLS_ERROR_C)
+
+#include <stdio.h>
+
+HEADER_INCLUDED
+
+void mbedtls_strerror( int ret, char *buf, size_t buflen )
+{
+    size_t len;
+    int use_ret;
+
+    if( buflen == 0 )
+        return;
+
+    memset( buf, 0x00, buflen );
+
+    if( ret < 0 )
+        ret = -ret;
+
+    if( ret & 0xFF80 )
+    {
+        use_ret = ret & 0xFF80;
+
+        // High level error codes
+        //
+        // BEGIN generated code
+HIGH_LEVEL_CODE_CHECKS
+        // END generated code
+
+        if( strlen( buf ) == 0 )
+            mbedtls_snprintf( buf, buflen, "UNKNOWN ERROR CODE (%04X)", use_ret );
+    }
+
+    use_ret = ret & ~0xFF80;
+
+    if( use_ret == 0 )
+        return;
+
+    // If high level code is present, make a concatenation between both
+    // error strings.
+    //
+    len = strlen( buf );
+
+    if( len > 0 )
+    {
+        if( buflen - len < 5 )
+            return;
+
+        mbedtls_snprintf( buf + len, buflen - len, " : " );
+
+        buf += len + 3;
+        buflen -= len + 3;
+    }
+
+    // Low level error codes
+    //
+    // BEGIN generated code
+LOW_LEVEL_CODE_CHECKS
+    // END generated code
+
+    if( strlen( buf ) != 0 )
+        return;
+
+    mbedtls_snprintf( buf, buflen, "UNKNOWN ERROR CODE (%04X)", use_ret );
+}
+
+#else /* MBEDTLS_ERROR_C */
+
+#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+
+/*
+ * Provide an non-function in case MBEDTLS_ERROR_C is not defined
+ */
+void mbedtls_strerror( int ret, char *buf, size_t buflen )
+{
+    ((void) ret);
+
+    if( buflen > 0 )
+        buf[0] = '\0';
+}
+
+#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
+
+#endif /* MBEDTLS_ERROR_C */
diff --git a/extmod/mbedtls_errors/esp32_mbedtls_errors.c b/extmod/mbedtls_errors/esp32_mbedtls_errors.c
new file mode 100644
index 0000000000000..386ca5fa28c21
--- /dev/null
+++ b/extmod/mbedtls_errors/esp32_mbedtls_errors.c
@@ -0,0 +1,705 @@
+/*
+ *  Error message information
+ *
+ *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if !defined(MBEDTLS_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include MBEDTLS_CONFIG_FILE
+#endif
+
+#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+#include "mbedtls/error.h"
+#include <string.h>
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define mbedtls_snprintf snprintf
+#define mbedtls_time_t   time_t
+#endif
+
+#if defined(MBEDTLS_ERROR_C)
+
+#include <stdio.h>
+
+#if defined(MBEDTLS_AES_C)
+#include "mbedtls/aes.h"
+#endif
+
+#if defined(MBEDTLS_ARC4_C)
+#include "mbedtls/arc4.h"
+#endif
+
+#if defined(MBEDTLS_ARIA_C)
+#include "mbedtls/aria.h"
+#endif
+
+#if defined(MBEDTLS_BASE64_C)
+#include "mbedtls/base64.h"
+#endif
+
+#if defined(MBEDTLS_BIGNUM_C)
+#include "mbedtls/bignum.h"
+#endif
+
+#if defined(MBEDTLS_BLOWFISH_C)
+#include "mbedtls/blowfish.h"
+#endif
+
+#if defined(MBEDTLS_CAMELLIA_C)
+#include "mbedtls/camellia.h"
+#endif
+
+#if defined(MBEDTLS_CCM_C)
+#include "mbedtls/ccm.h"
+#endif
+
+#if defined(MBEDTLS_CHACHA20_C)
+#include "mbedtls/chacha20.h"
+#endif
+
+#if defined(MBEDTLS_CHACHAPOLY_C)
+#include "mbedtls/chachapoly.h"
+#endif
+
+#if defined(MBEDTLS_CIPHER_C)
+#include "mbedtls/cipher.h"
+#endif
+
+#if defined(MBEDTLS_CMAC_C)
+#include "mbedtls/cmac.h"
+#endif
+
+#if defined(MBEDTLS_CTR_DRBG_C)
+#include "mbedtls/ctr_drbg.h"
+#endif
+
+#if defined(MBEDTLS_DES_C)
+#include "mbedtls/des.h"
+#endif
+
+#if defined(MBEDTLS_DHM_C)
+#include "mbedtls/dhm.h"
+#endif
+
+#if defined(MBEDTLS_ECP_C)
+#include "mbedtls/ecp.h"
+#endif
+
+#if defined(MBEDTLS_ENTROPY_C)
+#include "mbedtls/entropy.h"
+#endif
+
+#if defined(MBEDTLS_GCM_C)
+#include "mbedtls/gcm.h"
+#endif
+
+#if defined(MBEDTLS_HKDF_C)
+#include "mbedtls/hkdf.h"
+#endif
+
+#if defined(MBEDTLS_HMAC_DRBG_C)
+#include "mbedtls/hmac_drbg.h"
+#endif
+
+#if defined(MBEDTLS_MD_C)
+#include "mbedtls/md.h"
+#endif
+
+#if defined(MBEDTLS_MD2_C)
+#include "mbedtls/md2.h"
+#endif
+
+#if defined(MBEDTLS_MD4_C)
+#include "mbedtls/md4.h"
+#endif
+
+#if defined(MBEDTLS_MD5_C)
+#include "mbedtls/md5.h"
+#endif
+
+#if defined(MBEDTLS_NET_C)
+#include "mbedtls/net_sockets.h"
+#endif
+
+#if defined(MBEDTLS_OID_C)
+#include "mbedtls/oid.h"
+#endif
+
+#if defined(MBEDTLS_PADLOCK_C)
+#include "mbedtls/padlock.h"
+#endif
+
+#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
+#include "mbedtls/pem.h"
+#endif
+
+#if defined(MBEDTLS_PK_C)
+#include "mbedtls/pk.h"
+#endif
+
+#if defined(MBEDTLS_PKCS12_C)
+#include "mbedtls/pkcs12.h"
+#endif
+
+#if defined(MBEDTLS_PKCS5_C)
+#include "mbedtls/pkcs5.h"
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#endif
+
+#if defined(MBEDTLS_POLY1305_C)
+#include "mbedtls/poly1305.h"
+#endif
+
+#if defined(MBEDTLS_RIPEMD160_C)
+#include "mbedtls/ripemd160.h"
+#endif
+
+#if defined(MBEDTLS_RSA_C)
+#include "mbedtls/rsa.h"
+#endif
+
+#if defined(MBEDTLS_SHA1_C)
+#include "mbedtls/sha1.h"
+#endif
+
+#if defined(MBEDTLS_SHA256_C)
+#include "mbedtls/sha256.h"
+#endif
+
+#if defined(MBEDTLS_SHA512_C)
+#include "mbedtls/sha512.h"
+#endif
+
+#if defined(MBEDTLS_SSL_TLS_C)
+#include "mbedtls/ssl.h"
+#endif
+
+#if defined(MBEDTLS_THREADING_C)
+#include "mbedtls/threading.h"
+#endif
+
+#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
+#include "mbedtls/x509.h"
+#endif
+
+#if defined(MBEDTLS_XTEA_C)
+#include "mbedtls/xtea.h"
+#endif
+
+
+// Error code table type
+struct ssl_errs {
+    int16_t errnum;
+    const char *errstr;
+};
+
+// Table of high level error codes
+static const struct ssl_errs mbedtls_high_level_error_tab[] = {
+// BEGIN generated code
+#if defined(MBEDTLS_CIPHER_C)
+        { -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE), "CIPHER_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA), "CIPHER_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_CIPHER_ALLOC_FAILED), "CIPHER_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_CIPHER_INVALID_PADDING), "CIPHER_INVALID_PADDING" },
+        { -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED), "CIPHER_FULL_BLOCK_EXPECTED" },
+        { -(MBEDTLS_ERR_CIPHER_AUTH_FAILED), "CIPHER_AUTH_FAILED" },
+        { -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT), "CIPHER_INVALID_CONTEXT" },
+        { -(MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED), "CIPHER_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CIPHER_C */
+
+#if defined(MBEDTLS_DHM_C)
+        { -(MBEDTLS_ERR_DHM_BAD_INPUT_DATA), "DHM_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_DHM_READ_PARAMS_FAILED), "DHM_READ_PARAMS_FAILED" },
+        { -(MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED), "DHM_MAKE_PARAMS_FAILED" },
+        { -(MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED), "DHM_READ_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED), "DHM_MAKE_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_CALC_SECRET_FAILED), "DHM_CALC_SECRET_FAILED" },
+        { -(MBEDTLS_ERR_DHM_INVALID_FORMAT), "DHM_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_DHM_ALLOC_FAILED), "DHM_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_FILE_IO_ERROR), "DHM_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_DHM_HW_ACCEL_FAILED), "DHM_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_DHM_SET_GROUP_FAILED), "DHM_SET_GROUP_FAILED" },
+#endif /* MBEDTLS_DHM_C */
+
+#if defined(MBEDTLS_ECP_C)
+        { -(MBEDTLS_ERR_ECP_BAD_INPUT_DATA), "ECP_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL), "ECP_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE), "ECP_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_ECP_VERIFY_FAILED), "ECP_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_ECP_ALLOC_FAILED), "ECP_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_ECP_RANDOM_FAILED), "ECP_RANDOM_FAILED" },
+        { -(MBEDTLS_ERR_ECP_INVALID_KEY), "ECP_INVALID_KEY" },
+        { -(MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH), "ECP_SIG_LEN_MISMATCH" },
+        { -(MBEDTLS_ERR_ECP_HW_ACCEL_FAILED), "ECP_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_ECP_IN_PROGRESS), "ECP_IN_PROGRESS" },
+#endif /* MBEDTLS_ECP_C */
+
+#if defined(MBEDTLS_MD_C)
+        { -(MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE), "MD_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_MD_BAD_INPUT_DATA), "MD_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_MD_ALLOC_FAILED), "MD_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_MD_FILE_IO_ERROR), "MD_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_MD_HW_ACCEL_FAILED), "MD_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD_C */
+
+#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
+        { -(MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT), "PEM_NO_HEADER_FOOTER_PRESENT" },
+        { -(MBEDTLS_ERR_PEM_INVALID_DATA), "PEM_INVALID_DATA" },
+        { -(MBEDTLS_ERR_PEM_ALLOC_FAILED), "PEM_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_PEM_INVALID_ENC_IV), "PEM_INVALID_ENC_IV" },
+        { -(MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG), "PEM_UNKNOWN_ENC_ALG" },
+        { -(MBEDTLS_ERR_PEM_PASSWORD_REQUIRED), "PEM_PASSWORD_REQUIRED" },
+        { -(MBEDTLS_ERR_PEM_PASSWORD_MISMATCH), "PEM_PASSWORD_MISMATCH" },
+        { -(MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE), "PEM_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PEM_BAD_INPUT_DATA), "PEM_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
+
+#if defined(MBEDTLS_PK_C)
+        { -(MBEDTLS_ERR_PK_ALLOC_FAILED), "PK_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_PK_TYPE_MISMATCH), "PK_TYPE_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_BAD_INPUT_DATA), "PK_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PK_FILE_IO_ERROR), "PK_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_PK_KEY_INVALID_VERSION), "PK_KEY_INVALID_VERSION" },
+        { -(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT), "PK_KEY_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PK_UNKNOWN_PK_ALG), "PK_UNKNOWN_PK_ALG" },
+        { -(MBEDTLS_ERR_PK_PASSWORD_REQUIRED), "PK_PASSWORD_REQUIRED" },
+        { -(MBEDTLS_ERR_PK_PASSWORD_MISMATCH), "PK_PASSWORD_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_INVALID_PUBKEY), "PK_INVALID_PUBKEY" },
+        { -(MBEDTLS_ERR_PK_INVALID_ALG), "PK_INVALID_ALG" },
+        { -(MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE), "PK_UNKNOWN_NAMED_CURVE" },
+        { -(MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE), "PK_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PK_SIG_LEN_MISMATCH), "PK_SIG_LEN_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_HW_ACCEL_FAILED), "PK_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_PK_C */
+
+#if defined(MBEDTLS_PKCS12_C)
+        { -(MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA), "PKCS12_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE), "PKCS12_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT), "PKCS12_PBE_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH), "PKCS12_PASSWORD_MISMATCH" },
+#endif /* MBEDTLS_PKCS12_C */
+
+#if defined(MBEDTLS_PKCS5_C)
+        { -(MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA), "PKCS5_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT), "PKCS5_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE), "PKCS5_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH), "PKCS5_PASSWORD_MISMATCH" },
+#endif /* MBEDTLS_PKCS5_C */
+
+#if defined(MBEDTLS_RSA_C)
+        { -(MBEDTLS_ERR_RSA_BAD_INPUT_DATA), "RSA_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_RSA_INVALID_PADDING), "RSA_INVALID_PADDING" },
+        { -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED), "RSA_KEY_GEN_FAILED" },
+        { -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED), "RSA_KEY_CHECK_FAILED" },
+        { -(MBEDTLS_ERR_RSA_PUBLIC_FAILED), "RSA_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_RSA_PRIVATE_FAILED), "RSA_PRIVATE_FAILED" },
+        { -(MBEDTLS_ERR_RSA_VERIFY_FAILED), "RSA_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE), "RSA_OUTPUT_TOO_LARGE" },
+        { -(MBEDTLS_ERR_RSA_RNG_FAILED), "RSA_RNG_FAILED" },
+        { -(MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION), "RSA_UNSUPPORTED_OPERATION" },
+        { -(MBEDTLS_ERR_RSA_HW_ACCEL_FAILED), "RSA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_RSA_C */
+
+#if defined(MBEDTLS_SSL_TLS_C)
+        { -(MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE), "SSL_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_SSL_BAD_INPUT_DATA), "SSL_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_SSL_INVALID_MAC), "SSL_INVALID_MAC" },
+        { -(MBEDTLS_ERR_SSL_INVALID_RECORD), "SSL_INVALID_RECORD" },
+        { -(MBEDTLS_ERR_SSL_CONN_EOF), "SSL_CONN_EOF" },
+        { -(MBEDTLS_ERR_SSL_UNKNOWN_CIPHER), "SSL_UNKNOWN_CIPHER" },
+        { -(MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN), "SSL_NO_CIPHER_CHOSEN" },
+        { -(MBEDTLS_ERR_SSL_NO_RNG), "SSL_NO_RNG" },
+        { -(MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE), "SSL_NO_CLIENT_CERTIFICATE" },
+        { -(MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE), "SSL_CERTIFICATE_TOO_LARGE" },
+        { -(MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED), "SSL_CERTIFICATE_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED), "SSL_PRIVATE_KEY_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED), "SSL_CA_CHAIN_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE), "SSL_UNEXPECTED_MESSAGE" },
+        { -(MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED), "SSL_PEER_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY), "SSL_PEER_CLOSE_NOTIFY" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO), "SSL_BAD_HS_CLIENT_HELLO" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO), "SSL_BAD_HS_SERVER_HELLO" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE), "SSL_BAD_HS_CERTIFICATE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST), "SSL_BAD_HS_CERTIFICATE_REQUEST" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE), "SSL_BAD_HS_SERVER_KEY_EXCHANGE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE), "SSL_BAD_HS_SERVER_HELLO_DONE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY), "SSL_BAD_HS_CERTIFICATE_VERIFY" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC), "SSL_BAD_HS_CHANGE_CIPHER_SPEC" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_FINISHED), "SSL_BAD_HS_FINISHED" },
+        { -(MBEDTLS_ERR_SSL_ALLOC_FAILED), "SSL_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FAILED), "SSL_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH), "SSL_HW_ACCEL_FALLTHROUGH" },
+        { -(MBEDTLS_ERR_SSL_COMPRESSION_FAILED), "SSL_COMPRESSION_FAILED" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION), "SSL_BAD_HS_PROTOCOL_VERSION" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET), "SSL_BAD_HS_NEW_SESSION_TICKET" },
+        { -(MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED), "SSL_SESSION_TICKET_EXPIRED" },
+        { -(MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH), "SSL_PK_TYPE_MISMATCH" },
+        { -(MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY), "SSL_UNKNOWN_IDENTITY" },
+        { -(MBEDTLS_ERR_SSL_INTERNAL_ERROR), "SSL_INTERNAL_ERROR" },
+        { -(MBEDTLS_ERR_SSL_COUNTER_WRAPPING), "SSL_COUNTER_WRAPPING" },
+        { -(MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO), "SSL_WAITING_SERVER_HELLO_RENEGO" },
+        { -(MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED), "SSL_HELLO_VERIFY_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL), "SSL_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE), "SSL_NO_USABLE_CIPHERSUITE" },
+        { -(MBEDTLS_ERR_SSL_WANT_READ), "SSL_WANT_READ" },
+        { -(MBEDTLS_ERR_SSL_WANT_WRITE), "SSL_WANT_WRITE" },
+        { -(MBEDTLS_ERR_SSL_TIMEOUT), "SSL_TIMEOUT" },
+        { -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT), "SSL_CLIENT_RECONNECT" },
+        { -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD), "SSL_UNEXPECTED_RECORD" },
+        { -(MBEDTLS_ERR_SSL_NON_FATAL), "SSL_NON_FATAL" },
+        { -(MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH), "SSL_INVALID_VERIFY_HASH" },
+        { -(MBEDTLS_ERR_SSL_CONTINUE_PROCESSING), "SSL_CONTINUE_PROCESSING" },
+        { -(MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS), "SSL_ASYNC_IN_PROGRESS" },
+        { -(MBEDTLS_ERR_SSL_EARLY_MESSAGE), "SSL_EARLY_MESSAGE" },
+        { -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS), "SSL_CRYPTO_IN_PROGRESS" },
+#endif /* MBEDTLS_SSL_TLS_C */
+
+#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
+        { -(MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE), "X509_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_OID), "X509_UNKNOWN_OID" },
+        { -(MBEDTLS_ERR_X509_INVALID_FORMAT), "X509_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_X509_INVALID_VERSION), "X509_INVALID_VERSION" },
+        { -(MBEDTLS_ERR_X509_INVALID_SERIAL), "X509_INVALID_SERIAL" },
+        { -(MBEDTLS_ERR_X509_INVALID_ALG), "X509_INVALID_ALG" },
+        { -(MBEDTLS_ERR_X509_INVALID_NAME), "X509_INVALID_NAME" },
+        { -(MBEDTLS_ERR_X509_INVALID_DATE), "X509_INVALID_DATE" },
+        { -(MBEDTLS_ERR_X509_INVALID_SIGNATURE), "X509_INVALID_SIGNATURE" },
+        { -(MBEDTLS_ERR_X509_INVALID_EXTENSIONS), "X509_INVALID_EXTENSIONS" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_VERSION), "X509_UNKNOWN_VERSION" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG), "X509_UNKNOWN_SIG_ALG" },
+        { -(MBEDTLS_ERR_X509_SIG_MISMATCH), "X509_SIG_MISMATCH" },
+        { -(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED), "X509_CERT_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT), "X509_CERT_UNKNOWN_FORMAT" },
+        { -(MBEDTLS_ERR_X509_BAD_INPUT_DATA), "X509_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_X509_ALLOC_FAILED), "X509_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_X509_FILE_IO_ERROR), "X509_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_X509_BUFFER_TOO_SMALL), "X509_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_X509_FATAL_ERROR), "X509_FATAL_ERROR" },
+#endif /* MBEDTLS_X509_USE_C || MBEDTLS_X509_CREATE_C */
+// END generated code
+};
+
+static const struct ssl_errs mbedtls_low_level_error_tab[] = {
+// Low level error codes
+//
+// BEGIN generated code
+#if defined(MBEDTLS_AES_C)
+    { -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH), "AES_INVALID_KEY_LENGTH" },
+    { -(MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH), "AES_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_AES_BAD_INPUT_DATA), "AES_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE), "AES_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_AES_HW_ACCEL_FAILED), "AES_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_AES_C */
+
+#if defined(MBEDTLS_ARC4_C)
+    { -(MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED), "ARC4_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_ARC4_C */
+
+#if defined(MBEDTLS_ARIA_C)
+    { -(MBEDTLS_ERR_ARIA_BAD_INPUT_DATA), "ARIA_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH), "ARIA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE), "ARIA_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED), "ARIA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_ARIA_C */
+
+#if defined(MBEDTLS_ASN1_PARSE_C)
+    { -(MBEDTLS_ERR_ASN1_OUT_OF_DATA), "ASN1_OUT_OF_DATA" },
+    { -(MBEDTLS_ERR_ASN1_UNEXPECTED_TAG), "ASN1_UNEXPECTED_TAG" },
+    { -(MBEDTLS_ERR_ASN1_INVALID_LENGTH), "ASN1_INVALID_LENGTH" },
+    { -(MBEDTLS_ERR_ASN1_LENGTH_MISMATCH), "ASN1_LENGTH_MISMATCH" },
+    { -(MBEDTLS_ERR_ASN1_INVALID_DATA), "ASN1_INVALID_DATA" },
+    { -(MBEDTLS_ERR_ASN1_ALLOC_FAILED), "ASN1_ALLOC_FAILED" },
+    { -(MBEDTLS_ERR_ASN1_BUF_TOO_SMALL), "ASN1_BUF_TOO_SMALL" },
+#endif /* MBEDTLS_ASN1_PARSE_C */
+
+#if defined(MBEDTLS_BASE64_C)
+    { -(MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL), "BASE64_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_BASE64_INVALID_CHARACTER), "BASE64_INVALID_CHARACTER" },
+#endif /* MBEDTLS_BASE64_C */
+
+#if defined(MBEDTLS_BIGNUM_C)
+    { -(MBEDTLS_ERR_MPI_FILE_IO_ERROR), "MPI_FILE_IO_ERROR" },
+    { -(MBEDTLS_ERR_MPI_BAD_INPUT_DATA), "MPI_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_MPI_INVALID_CHARACTER), "MPI_INVALID_CHARACTER" },
+    { -(MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL), "MPI_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_MPI_NEGATIVE_VALUE), "MPI_NEGATIVE_VALUE" },
+    { -(MBEDTLS_ERR_MPI_DIVISION_BY_ZERO), "MPI_DIVISION_BY_ZERO" },
+    { -(MBEDTLS_ERR_MPI_NOT_ACCEPTABLE), "MPI_NOT_ACCEPTABLE" },
+    { -(MBEDTLS_ERR_MPI_ALLOC_FAILED), "MPI_ALLOC_FAILED" },
+#endif /* MBEDTLS_BIGNUM_C */
+
+#if defined(MBEDTLS_BLOWFISH_C)
+    { -(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA), "BLOWFISH_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH), "BLOWFISH_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED), "BLOWFISH_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_BLOWFISH_C */
+
+#if defined(MBEDTLS_CAMELLIA_C)
+    { -(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA), "CAMELLIA_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH), "CAMELLIA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED), "CAMELLIA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CAMELLIA_C */
+
+#if defined(MBEDTLS_CCM_C)
+    { -(MBEDTLS_ERR_CCM_BAD_INPUT), "CCM_BAD_INPUT" },
+    { -(MBEDTLS_ERR_CCM_AUTH_FAILED), "CCM_AUTH_FAILED" },
+    { -(MBEDTLS_ERR_CCM_HW_ACCEL_FAILED), "CCM_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CCM_C */
+
+#if defined(MBEDTLS_CHACHA20_C)
+    { -(MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA), "CHACHA20_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE), "CHACHA20_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED), "CHACHA20_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CHACHA20_C */
+
+#if defined(MBEDTLS_CHACHAPOLY_C)
+    { -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE), "CHACHAPOLY_BAD_STATE" },
+    { -(MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED), "CHACHAPOLY_AUTH_FAILED" },
+#endif /* MBEDTLS_CHACHAPOLY_C */
+
+#if defined(MBEDTLS_CMAC_C)
+    { -(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED), "CMAC_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CMAC_C */
+
+#if defined(MBEDTLS_CTR_DRBG_C)
+    { -(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED), "CTR_DRBG_ENTROPY_SOURCE_FAILED" },
+    { -(MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG), "CTR_DRBG_REQUEST_TOO_BIG" },
+    { -(MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG), "CTR_DRBG_INPUT_TOO_BIG" },
+    { -(MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR), "CTR_DRBG_FILE_IO_ERROR" },
+#endif /* MBEDTLS_CTR_DRBG_C */
+
+#if defined(MBEDTLS_DES_C)
+    { -(MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH), "DES_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_DES_HW_ACCEL_FAILED), "DES_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_DES_C */
+
+#if defined(MBEDTLS_ENTROPY_C)
+    { -(MBEDTLS_ERR_ENTROPY_SOURCE_FAILED), "ENTROPY_SOURCE_FAILED" },
+    { -(MBEDTLS_ERR_ENTROPY_MAX_SOURCES), "ENTROPY_MAX_SOURCES" },
+    { -(MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED), "ENTROPY_NO_SOURCES_DEFINED" },
+    { -(MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE), "ENTROPY_NO_STRONG_SOURCE" },
+    { -(MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR), "ENTROPY_FILE_IO_ERROR" },
+#endif /* MBEDTLS_ENTROPY_C */
+
+#if defined(MBEDTLS_GCM_C)
+    { -(MBEDTLS_ERR_GCM_AUTH_FAILED), "GCM_AUTH_FAILED" },
+    { -(MBEDTLS_ERR_GCM_HW_ACCEL_FAILED), "GCM_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_GCM_BAD_INPUT), "GCM_BAD_INPUT" },
+#endif /* MBEDTLS_GCM_C */
+
+#if defined(MBEDTLS_HKDF_C)
+    { -(MBEDTLS_ERR_HKDF_BAD_INPUT_DATA), "HKDF_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_HKDF_C */
+
+#if defined(MBEDTLS_HMAC_DRBG_C)
+    { -(MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG), "HMAC_DRBG_REQUEST_TOO_BIG" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG), "HMAC_DRBG_INPUT_TOO_BIG" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR), "HMAC_DRBG_FILE_IO_ERROR" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED), "HMAC_DRBG_ENTROPY_SOURCE_FAILED" },
+#endif /* MBEDTLS_HMAC_DRBG_C */
+
+#if defined(MBEDTLS_MD2_C)
+    { -(MBEDTLS_ERR_MD2_HW_ACCEL_FAILED), "MD2_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD2_C */
+
+#if defined(MBEDTLS_MD4_C)
+    { -(MBEDTLS_ERR_MD4_HW_ACCEL_FAILED), "MD4_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD4_C */
+
+#if defined(MBEDTLS_MD5_C)
+    { -(MBEDTLS_ERR_MD5_HW_ACCEL_FAILED), "MD5_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD5_C */
+
+#if defined(MBEDTLS_NET_C)
+    { -(MBEDTLS_ERR_NET_SOCKET_FAILED), "NET_SOCKET_FAILED" },
+    { -(MBEDTLS_ERR_NET_CONNECT_FAILED), "NET_CONNECT_FAILED" },
+    { -(MBEDTLS_ERR_NET_BIND_FAILED), "NET_BIND_FAILED" },
+    { -(MBEDTLS_ERR_NET_LISTEN_FAILED), "NET_LISTEN_FAILED" },
+    { -(MBEDTLS_ERR_NET_ACCEPT_FAILED), "NET_ACCEPT_FAILED" },
+    { -(MBEDTLS_ERR_NET_RECV_FAILED), "NET_RECV_FAILED" },
+    { -(MBEDTLS_ERR_NET_SEND_FAILED), "NET_SEND_FAILED" },
+    { -(MBEDTLS_ERR_NET_CONN_RESET), "NET_CONN_RESET" },
+    { -(MBEDTLS_ERR_NET_UNKNOWN_HOST), "NET_UNKNOWN_HOST" },
+    { -(MBEDTLS_ERR_NET_BUFFER_TOO_SMALL), "NET_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_NET_INVALID_CONTEXT), "NET_INVALID_CONTEXT" },
+    { -(MBEDTLS_ERR_NET_POLL_FAILED), "NET_POLL_FAILED" },
+    { -(MBEDTLS_ERR_NET_BAD_INPUT_DATA), "NET_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_NET_C */
+
+#if defined(MBEDTLS_OID_C)
+    { -(MBEDTLS_ERR_OID_NOT_FOUND), "OID_NOT_FOUND" },
+    { -(MBEDTLS_ERR_OID_BUF_TOO_SMALL), "OID_BUF_TOO_SMALL" },
+#endif /* MBEDTLS_OID_C */
+
+#if defined(MBEDTLS_PADLOCK_C)
+    { -(MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED), "PADLOCK_DATA_MISALIGNED" },
+#endif /* MBEDTLS_PADLOCK_C */
+
+#if defined(MBEDTLS_PLATFORM_C)
+    { -(MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED), "PLATFORM_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED), "PLATFORM_FEATURE_UNSUPPORTED" },
+#endif /* MBEDTLS_PLATFORM_C */
+
+#if defined(MBEDTLS_POLY1305_C)
+    { -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA), "POLY1305_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE), "POLY1305_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED), "POLY1305_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_POLY1305_C */
+
+#if defined(MBEDTLS_RIPEMD160_C)
+    { -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED), "RIPEMD160_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_RIPEMD160_C */
+
+#if defined(MBEDTLS_SHA1_C)
+    { -(MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED), "SHA1_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA1_BAD_INPUT_DATA), "SHA1_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA1_C */
+
+#if defined(MBEDTLS_SHA256_C)
+    { -(MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED), "SHA256_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA256_BAD_INPUT_DATA), "SHA256_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA256_C */
+
+#if defined(MBEDTLS_SHA512_C)
+    { -(MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED), "SHA512_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA512_BAD_INPUT_DATA), "SHA512_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA512_C */
+
+#if defined(MBEDTLS_THREADING_C)
+    { -(MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE), "THREADING_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA), "THREADING_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_THREADING_MUTEX_ERROR), "THREADING_MUTEX_ERROR" },
+#endif /* MBEDTLS_THREADING_C */
+
+#if defined(MBEDTLS_XTEA_C)
+    { -(MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH), "XTEA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED), "XTEA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_XTEA_C */
+// END generated code
+};
+
+static const char *mbedtls_err_prefix = "MBEDTLS_ERR_";
+#define MBEDTLS_ERR_PREFIX_LEN ( sizeof("MBEDTLS_ERR_")-1 )
+
+// copy error text into buffer, ensure null termination, return strlen of result
+static size_t mbedtls_err_to_str(int err, const struct ssl_errs tab[], int tab_len, char *buf, size_t buflen) {
+    if (buflen == 0) return 0;
+
+    // prefix for all error names
+    strncpy(buf, mbedtls_err_prefix, buflen);
+    if (buflen <= MBEDTLS_ERR_PREFIX_LEN+1) {
+        buf[buflen-1] = 0;
+        return buflen-1;
+    }
+
+    // append error name from table
+    for (int i = 0; i < tab_len; i++) {
+        if (tab[i].errnum == err) {
+            strncpy(buf+MBEDTLS_ERR_PREFIX_LEN, tab[i].errstr, buflen-MBEDTLS_ERR_PREFIX_LEN);
+            buf[buflen-1] = 0;
+            return strlen(buf);
+        }
+    }
+
+    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (%04X)",
+            err);
+    return strlen(buf);
+}
+
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+
+void mbedtls_strerror(int ret, char *buf, size_t buflen) {
+    int use_ret;
+
+    if (buflen == 0) return;
+
+    buf[buflen-1] = 0;
+
+    if (ret < 0) ret = -ret;
+
+    //
+    // High-level error codes
+    //
+    uint8_t got_hl = (ret & 0xFF80) != 0;
+    if (got_hl) {
+        use_ret = ret & 0xFF80;
+
+        // special case
+#if defined(MBEDTLS_SSL_TLS_C)
+        if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) {
+            strncpy(buf, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE", buflen);
+            buf[buflen-1] = 0;
+            return;
+        }
+#endif
+
+        size_t len = mbedtls_err_to_str(use_ret, mbedtls_high_level_error_tab,
+                ARRAY_SIZE(mbedtls_high_level_error_tab), buf, buflen);
+
+        buf += len;
+        buflen -= len;
+        if (buflen == 0) return;
+    }
+
+    //
+    // Low-level error codes
+    //
+    use_ret = ret & ~0xFF80;
+
+    if (use_ret == 0) return;
+
+    // If high level code is present, make a concatenation between both error strings.
+    if (got_hl) {
+        if (buflen < 2) return;
+        *buf++ = '+';
+        buflen--;
+    }
+
+    mbedtls_err_to_str(use_ret, mbedtls_low_level_error_tab,
+            ARRAY_SIZE(mbedtls_low_level_error_tab), buf, buflen);
+}
+
+#else /* MBEDTLS_ERROR_C */
+
+#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+
+/*
+ * Provide an non-function in case MBEDTLS_ERROR_C is not defined
+ */
+void mbedtls_strerror( int ret, char *buf, size_t buflen )
+{
+    ((void) ret);
+
+    if( buflen > 0 )
+        buf[0] = '\0';
+}
+
+#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
+
+#endif /* MBEDTLS_ERROR_C */
diff --git a/extmod/mbedtls_errors/generate_errors.pl b/extmod/mbedtls_errors/generate_errors.pl
new file mode 100755
index 0000000000000..88c1f97c85f9f
--- /dev/null
+++ b/extmod/mbedtls_errors/generate_errors.pl
@@ -0,0 +1,209 @@
+#!/usr/bin/env perl
+
+# Generate error.c
+#
+# Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
+# or generate_errors.pl include_dir data_dir error_file
+
+use strict;
+
+my ($include_dir, $data_dir, $error_file);
+
+if( @ARGV ) {
+    die "Invalid number of arguments" if scalar @ARGV != 3;
+    ($include_dir, $data_dir, $error_file) = @ARGV;
+
+    -d $include_dir or die "No such directory: $include_dir\n";
+    -d $data_dir or die "No such directory: $data_dir\n";
+} else {
+    $include_dir = 'include/mbedtls';
+    $data_dir = 'scripts/data_files';
+    $error_file = 'library/error.c';
+
+    unless( -d $include_dir && -d $data_dir ) {
+        chdir '..' or die;
+        -d $include_dir && -d $data_dir
+            or die "Without arguments, must be run from root or scripts\n"
+    }
+}
+
+my $error_format_file = $data_dir.'/error.fmt';
+
+my @low_level_modules = qw( AES ARC4 ARIA ASN1 BASE64 BIGNUM BLOWFISH
+                            CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
+                            ENTROPY GCM HKDF HMAC_DRBG MD2 MD4 MD5
+                            NET OID PADLOCK PBKDF2 PLATFORM POLY1305 RIPEMD160
+                            SHA1 SHA256 SHA512 THREADING XTEA );
+my @high_level_modules = qw( CIPHER DHM ECP MD
+                             PEM PK PKCS12 PKCS5
+                             RSA SSL X509 );
+
+my $line_separator = $/;
+undef $/;
+
+open(FORMAT_FILE, "$error_format_file") or die "Opening error format file '$error_format_file': $!";
+my $error_format = <FORMAT_FILE>;
+close(FORMAT_FILE);
+
+$/ = $line_separator;
+
+my @files = <$include_dir/*.h>;
+my @matches;
+foreach my $file (@files) {
+    open(FILE, "$file");
+    my @grep_res = grep(/^\s*#define\s+MBEDTLS_ERR_\w+\s+\-0x[0-9A-Fa-f]+/, <FILE>);
+    push(@matches, @grep_res);
+    close FILE;
+}
+
+my $ll_old_define = "";
+my $hl_old_define = "";
+
+my $ll_code_check = "";
+my $hl_code_check = "";
+
+my $headers = "";
+
+my %error_codes_seen;
+
+
+foreach my $line (@matches)
+{
+    next if ($line =~ /compat-1.2.h/);
+    my ($error_name, $error_code) = $line =~ /(MBEDTLS_ERR_\w+)\s+\-(0x\w+)/;
+    my ($description) = $line =~ /\/\*\*< (.*?)\.? \*\//;
+
+    die "Duplicated error code: $error_code ($error_name)\n"
+        if( $error_codes_seen{$error_code}++ );
+
+    $description =~ s/\\/\\\\/g;
+    if ($description eq "") {
+        $description = "DESCRIPTION MISSING";
+        warn "Missing description for $error_name\n";
+    }
+
+    my ($module_name) = $error_name =~ /^MBEDTLS_ERR_([^_]+)/;
+
+    # Fix faulty ones
+    $module_name = "BIGNUM" if ($module_name eq "MPI");
+    $module_name = "CTR_DRBG" if ($module_name eq "CTR");
+    $module_name = "HMAC_DRBG" if ($module_name eq "HMAC");
+
+    my $define_name = $module_name;
+    $define_name = "X509_USE,X509_CREATE" if ($define_name eq "X509");
+    $define_name = "ASN1_PARSE" if ($define_name eq "ASN1");
+    $define_name = "SSL_TLS" if ($define_name eq "SSL");
+    $define_name = "PEM_PARSE,PEM_WRITE" if ($define_name eq "PEM");
+
+    my $include_name = $module_name;
+    $include_name =~ tr/A-Z/a-z/;
+    $include_name = "" if ($include_name eq "asn1");
+
+    # Fix faulty ones
+    $include_name = "net_sockets" if ($module_name eq "NET");
+
+    my $found_ll = grep $_ eq $module_name, @low_level_modules;
+    my $found_hl = grep $_ eq $module_name, @high_level_modules;
+    if (!$found_ll && !$found_hl)
+    {
+        printf("Error: Do not know how to handle: $module_name\n");
+        exit 1;
+    }
+
+    my $code_check;
+    my $old_define;
+    my $white_space;
+    my $first;
+
+    if ($found_ll)
+    {
+        $code_check = \$ll_code_check;
+        $old_define = \$ll_old_define;
+        $white_space = '    ';
+    }
+    else
+    {
+        $code_check = \$hl_code_check;
+        $old_define = \$hl_old_define;
+        $white_space = '        ';
+    }
+
+    if ($define_name ne ${$old_define})
+    {
+        if (${$old_define} ne "")
+        {
+            ${$code_check} .= "#endif /* ";
+            $first = 0;
+            foreach my $dep (split(/,/, ${$old_define}))
+            {
+                ${$code_check} .= " || " if ($first++);
+                ${$code_check} .= "MBEDTLS_${dep}_C";
+            }
+            ${$code_check} .= " */\n\n";
+        }
+
+        ${$code_check} .= "#if ";
+        $headers .= "#if " if ($include_name ne "");
+        $first = 0;
+        foreach my $dep (split(/,/, ${define_name}))
+        {
+            ${$code_check} .= " || " if ($first);
+            $headers       .= " || " if ($first++);
+
+            ${$code_check} .= "defined(MBEDTLS_${dep}_C)";
+            $headers       .= "defined(MBEDTLS_${dep}_C)" if
+                                                    ($include_name ne "");
+        }
+        ${$code_check} .= "\n";
+        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
+                    "#endif\n\n" if ($include_name ne "");
+        ${$old_define} = $define_name;
+    }
+
+    if ($error_name eq "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE")
+    {
+#        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+#                          "${white_space}\{\n".
+#                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n".
+#                          "${white_space}    return;\n".
+#                          "${white_space}}\n"
+    }
+    else
+    {
+#        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+#                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n"
+         my $error_text = $error_name =~ s/^MBEDTLS_ERR_//r;
+         ${$code_check} .= "${white_space}{ -($error_name), \"$error_text\" },\n"
+    }
+};
+
+if ($ll_old_define ne "")
+{
+    $ll_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $ll_old_define))
+    {
+        $ll_code_check .= " || " if ($first++);
+        $ll_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $ll_code_check .= " */\n";
+}
+if ($hl_old_define ne "")
+{
+    $hl_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $hl_old_define))
+    {
+        $hl_code_check .= " || " if ($first++);
+        $hl_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $hl_code_check .= " */\n";
+}
+
+$error_format =~ s/HEADER_INCLUDED\n/$headers/g;
+$error_format =~ s/LOW_LEVEL_CODE_CHECKS\n/$ll_code_check/g;
+$error_format =~ s/HIGH_LEVEL_CODE_CHECKS\n/$hl_code_check/g;
+
+open(ERROR_FILE, ">$error_file") or die "Opening destination file '$error_file': $!";
+print ERROR_FILE $error_format;
+close(ERROR_FILE);
diff --git a/extmod/mbedtls_errors/generate_errors_orig.pl b/extmod/mbedtls_errors/generate_errors_orig.pl
new file mode 100755
index 0000000000000..0c1f7e16ece5d
--- /dev/null
+++ b/extmod/mbedtls_errors/generate_errors_orig.pl
@@ -0,0 +1,207 @@
+#!/usr/bin/env perl
+
+# Generate error.c
+#
+# Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
+# or generate_errors.pl include_dir data_dir error_file
+
+use strict;
+
+my ($include_dir, $data_dir, $error_file);
+
+if( @ARGV ) {
+    die "Invalid number of arguments" if scalar @ARGV != 3;
+    ($include_dir, $data_dir, $error_file) = @ARGV;
+
+    -d $include_dir or die "No such directory: $include_dir\n";
+    -d $data_dir or die "No such directory: $data_dir\n";
+} else {
+    $include_dir = 'include/mbedtls';
+    $data_dir = 'scripts/data_files';
+    $error_file = 'library/error.c';
+
+    unless( -d $include_dir && -d $data_dir ) {
+        chdir '..' or die;
+        -d $include_dir && -d $data_dir
+            or die "Without arguments, must be run from root or scripts\n"
+    }
+}
+
+my $error_format_file = $data_dir.'/error.fmt';
+
+my @low_level_modules = qw( AES ARC4 ARIA ASN1 BASE64 BIGNUM BLOWFISH
+                            CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
+                            ENTROPY GCM HKDF HMAC_DRBG MD2 MD4 MD5
+                            NET OID PADLOCK PBKDF2 PLATFORM POLY1305 RIPEMD160
+                            SHA1 SHA256 SHA512 THREADING XTEA );
+my @high_level_modules = qw( CIPHER DHM ECP MD
+                             PEM PK PKCS12 PKCS5
+                             RSA SSL X509 );
+
+my $line_separator = $/;
+undef $/;
+
+open(FORMAT_FILE, "$error_format_file") or die "Opening error format file '$error_format_file': $!";
+my $error_format = <FORMAT_FILE>;
+close(FORMAT_FILE);
+
+$/ = $line_separator;
+
+my @files = <$include_dir/*.h>;
+my @matches;
+foreach my $file (@files) {
+    open(FILE, "$file");
+    my @grep_res = grep(/^\s*#define\s+MBEDTLS_ERR_\w+\s+\-0x[0-9A-Fa-f]+/, <FILE>);
+    push(@matches, @grep_res);
+    close FILE;
+}
+
+my $ll_old_define = "";
+my $hl_old_define = "";
+
+my $ll_code_check = "";
+my $hl_code_check = "";
+
+my $headers = "";
+
+my %error_codes_seen;
+
+
+foreach my $line (@matches)
+{
+    next if ($line =~ /compat-1.2.h/);
+    my ($error_name, $error_code) = $line =~ /(MBEDTLS_ERR_\w+)\s+\-(0x\w+)/;
+    my ($description) = $line =~ /\/\*\*< (.*?)\.? \*\//;
+
+    die "Duplicated error code: $error_code ($error_name)\n"
+        if( $error_codes_seen{$error_code}++ );
+
+    $description =~ s/\\/\\\\/g;
+    if ($description eq "") {
+        $description = "DESCRIPTION MISSING";
+        warn "Missing description for $error_name\n";
+    }
+
+    my ($module_name) = $error_name =~ /^MBEDTLS_ERR_([^_]+)/;
+
+    # Fix faulty ones
+    $module_name = "BIGNUM" if ($module_name eq "MPI");
+    $module_name = "CTR_DRBG" if ($module_name eq "CTR");
+    $module_name = "HMAC_DRBG" if ($module_name eq "HMAC");
+
+    my $define_name = $module_name;
+    $define_name = "X509_USE,X509_CREATE" if ($define_name eq "X509");
+    $define_name = "ASN1_PARSE" if ($define_name eq "ASN1");
+    $define_name = "SSL_TLS" if ($define_name eq "SSL");
+    $define_name = "PEM_PARSE,PEM_WRITE" if ($define_name eq "PEM");
+
+    my $include_name = $module_name;
+    $include_name =~ tr/A-Z/a-z/;
+    $include_name = "" if ($include_name eq "asn1");
+
+    # Fix faulty ones
+    $include_name = "net_sockets" if ($module_name eq "NET");
+
+    my $found_ll = grep $_ eq $module_name, @low_level_modules;
+    my $found_hl = grep $_ eq $module_name, @high_level_modules;
+    if (!$found_ll && !$found_hl)
+    {
+        printf("Error: Do not know how to handle: $module_name\n");
+        exit 1;
+    }
+
+    my $code_check;
+    my $old_define;
+    my $white_space;
+    my $first;
+
+    if ($found_ll)
+    {
+        $code_check = \$ll_code_check;
+        $old_define = \$ll_old_define;
+        $white_space = '    ';
+    }
+    else
+    {
+        $code_check = \$hl_code_check;
+        $old_define = \$hl_old_define;
+        $white_space = '        ';
+    }
+
+    if ($define_name ne ${$old_define})
+    {
+        if (${$old_define} ne "")
+        {
+            ${$code_check} .= "#endif /* ";
+            $first = 0;
+            foreach my $dep (split(/,/, ${$old_define}))
+            {
+                ${$code_check} .= " || " if ($first++);
+                ${$code_check} .= "MBEDTLS_${dep}_C";
+            }
+            ${$code_check} .= " */\n\n";
+        }
+
+        ${$code_check} .= "#if ";
+        $headers .= "#if " if ($include_name ne "");
+        $first = 0;
+        foreach my $dep (split(/,/, ${define_name}))
+        {
+            ${$code_check} .= " || " if ($first);
+            $headers       .= " || " if ($first++);
+
+            ${$code_check} .= "defined(MBEDTLS_${dep}_C)";
+            $headers       .= "defined(MBEDTLS_${dep}_C)" if
+                                                    ($include_name ne "");
+        }
+        ${$code_check} .= "\n";
+        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
+                    "#endif\n\n" if ($include_name ne "");
+        ${$old_define} = $define_name;
+    }
+
+    if ($error_name eq "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE")
+    {
+        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+                          "${white_space}\{\n".
+                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n".
+                          "${white_space}    return;\n".
+                          "${white_space}}\n"
+    }
+    else
+    {
+        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n"
+    }
+};
+
+if ($ll_old_define ne "")
+{
+    $ll_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $ll_old_define))
+    {
+        $ll_code_check .= " || " if ($first++);
+        $ll_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $ll_code_check .= " */\n";
+}
+if ($hl_old_define ne "")
+{
+    $hl_code_check .= "#endif /* ";
+    my $first = 0;
+    foreach my $dep (split(/,/, $hl_old_define))
+    {
+        $hl_code_check .= " || " if ($first++);
+        $hl_code_check .= "MBEDTLS_${dep}_C";
+    }
+    $hl_code_check .= " */\n";
+}
+
+$error_format =~ s/HEADER_INCLUDED\n/$headers/g;
+$error_format =~ s/LOW_LEVEL_CODE_CHECKS\n/$ll_code_check/g;
+$error_format =~ s/HIGH_LEVEL_CODE_CHECKS\n/$hl_code_check/g;
+
+open(ERROR_FILE, ">$error_file") or die "Opening destination file '$error_file': $!";
+print ERROR_FILE $error_format;
+close(ERROR_FILE);
diff --git a/extmod/mbedtls_errors/mp_mbedtls_errors.c b/extmod/mbedtls_errors/mp_mbedtls_errors.c
new file mode 100644
index 0000000000000..03a91f0dc9495
--- /dev/null
+++ b/extmod/mbedtls_errors/mp_mbedtls_errors.c
@@ -0,0 +1,705 @@
+/*
+ *  Error message information
+ *
+ *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if !defined(MBEDTLS_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include MBEDTLS_CONFIG_FILE
+#endif
+
+#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+#include "mbedtls/error.h"
+#include <string.h>
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define mbedtls_snprintf snprintf
+#define mbedtls_time_t   time_t
+#endif
+
+#if defined(MBEDTLS_ERROR_C)
+
+#include <stdio.h>
+
+#if defined(MBEDTLS_AES_C)
+#include "mbedtls/aes.h"
+#endif
+
+#if defined(MBEDTLS_ARC4_C)
+#include "mbedtls/arc4.h"
+#endif
+
+#if defined(MBEDTLS_ARIA_C)
+#include "mbedtls/aria.h"
+#endif
+
+#if defined(MBEDTLS_BASE64_C)
+#include "mbedtls/base64.h"
+#endif
+
+#if defined(MBEDTLS_BIGNUM_C)
+#include "mbedtls/bignum.h"
+#endif
+
+#if defined(MBEDTLS_BLOWFISH_C)
+#include "mbedtls/blowfish.h"
+#endif
+
+#if defined(MBEDTLS_CAMELLIA_C)
+#include "mbedtls/camellia.h"
+#endif
+
+#if defined(MBEDTLS_CCM_C)
+#include "mbedtls/ccm.h"
+#endif
+
+#if defined(MBEDTLS_CHACHA20_C)
+#include "mbedtls/chacha20.h"
+#endif
+
+#if defined(MBEDTLS_CHACHAPOLY_C)
+#include "mbedtls/chachapoly.h"
+#endif
+
+#if defined(MBEDTLS_CIPHER_C)
+#include "mbedtls/cipher.h"
+#endif
+
+#if defined(MBEDTLS_CMAC_C)
+#include "mbedtls/cmac.h"
+#endif
+
+#if defined(MBEDTLS_CTR_DRBG_C)
+#include "mbedtls/ctr_drbg.h"
+#endif
+
+#if defined(MBEDTLS_DES_C)
+#include "mbedtls/des.h"
+#endif
+
+#if defined(MBEDTLS_DHM_C)
+#include "mbedtls/dhm.h"
+#endif
+
+#if defined(MBEDTLS_ECP_C)
+#include "mbedtls/ecp.h"
+#endif
+
+#if defined(MBEDTLS_ENTROPY_C)
+#include "mbedtls/entropy.h"
+#endif
+
+#if defined(MBEDTLS_GCM_C)
+#include "mbedtls/gcm.h"
+#endif
+
+#if defined(MBEDTLS_HKDF_C)
+#include "mbedtls/hkdf.h"
+#endif
+
+#if defined(MBEDTLS_HMAC_DRBG_C)
+#include "mbedtls/hmac_drbg.h"
+#endif
+
+#if defined(MBEDTLS_MD_C)
+#include "mbedtls/md.h"
+#endif
+
+#if defined(MBEDTLS_MD2_C)
+#include "mbedtls/md2.h"
+#endif
+
+#if defined(MBEDTLS_MD4_C)
+#include "mbedtls/md4.h"
+#endif
+
+#if defined(MBEDTLS_MD5_C)
+#include "mbedtls/md5.h"
+#endif
+
+#if defined(MBEDTLS_NET_C)
+#include "mbedtls/net_sockets.h"
+#endif
+
+#if defined(MBEDTLS_OID_C)
+#include "mbedtls/oid.h"
+#endif
+
+#if defined(MBEDTLS_PADLOCK_C)
+#include "mbedtls/padlock.h"
+#endif
+
+#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
+#include "mbedtls/pem.h"
+#endif
+
+#if defined(MBEDTLS_PK_C)
+#include "mbedtls/pk.h"
+#endif
+
+#if defined(MBEDTLS_PKCS12_C)
+#include "mbedtls/pkcs12.h"
+#endif
+
+#if defined(MBEDTLS_PKCS5_C)
+#include "mbedtls/pkcs5.h"
+#endif
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#endif
+
+#if defined(MBEDTLS_POLY1305_C)
+#include "mbedtls/poly1305.h"
+#endif
+
+#if defined(MBEDTLS_RIPEMD160_C)
+#include "mbedtls/ripemd160.h"
+#endif
+
+#if defined(MBEDTLS_RSA_C)
+#include "mbedtls/rsa.h"
+#endif
+
+#if defined(MBEDTLS_SHA1_C)
+#include "mbedtls/sha1.h"
+#endif
+
+#if defined(MBEDTLS_SHA256_C)
+#include "mbedtls/sha256.h"
+#endif
+
+#if defined(MBEDTLS_SHA512_C)
+#include "mbedtls/sha512.h"
+#endif
+
+#if defined(MBEDTLS_SSL_TLS_C)
+#include "mbedtls/ssl.h"
+#endif
+
+#if defined(MBEDTLS_THREADING_C)
+#include "mbedtls/threading.h"
+#endif
+
+#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
+#include "mbedtls/x509.h"
+#endif
+
+#if defined(MBEDTLS_XTEA_C)
+#include "mbedtls/xtea.h"
+#endif
+
+
+// Error code table type
+struct ssl_errs {
+    int16_t errnum;
+    const char *errstr;
+};
+
+// Table of high level error codes
+static const struct ssl_errs mbedtls_high_level_error_tab[] = {
+// BEGIN generated code
+#if defined(MBEDTLS_CIPHER_C)
+        { -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE), "CIPHER_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA), "CIPHER_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_CIPHER_ALLOC_FAILED), "CIPHER_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_CIPHER_INVALID_PADDING), "CIPHER_INVALID_PADDING" },
+        { -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED), "CIPHER_FULL_BLOCK_EXPECTED" },
+        { -(MBEDTLS_ERR_CIPHER_AUTH_FAILED), "CIPHER_AUTH_FAILED" },
+        { -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT), "CIPHER_INVALID_CONTEXT" },
+        { -(MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED), "CIPHER_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CIPHER_C */
+
+#if defined(MBEDTLS_DHM_C)
+        { -(MBEDTLS_ERR_DHM_BAD_INPUT_DATA), "DHM_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_DHM_READ_PARAMS_FAILED), "DHM_READ_PARAMS_FAILED" },
+        { -(MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED), "DHM_MAKE_PARAMS_FAILED" },
+        { -(MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED), "DHM_READ_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED), "DHM_MAKE_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_CALC_SECRET_FAILED), "DHM_CALC_SECRET_FAILED" },
+        { -(MBEDTLS_ERR_DHM_INVALID_FORMAT), "DHM_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_DHM_ALLOC_FAILED), "DHM_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_DHM_FILE_IO_ERROR), "DHM_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_DHM_HW_ACCEL_FAILED), "DHM_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_DHM_SET_GROUP_FAILED), "DHM_SET_GROUP_FAILED" },
+#endif /* MBEDTLS_DHM_C */
+
+#if defined(MBEDTLS_ECP_C)
+        { -(MBEDTLS_ERR_ECP_BAD_INPUT_DATA), "ECP_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL), "ECP_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE), "ECP_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_ECP_VERIFY_FAILED), "ECP_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_ECP_ALLOC_FAILED), "ECP_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_ECP_RANDOM_FAILED), "ECP_RANDOM_FAILED" },
+        { -(MBEDTLS_ERR_ECP_INVALID_KEY), "ECP_INVALID_KEY" },
+        { -(MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH), "ECP_SIG_LEN_MISMATCH" },
+        { -(MBEDTLS_ERR_ECP_HW_ACCEL_FAILED), "ECP_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_ECP_IN_PROGRESS), "ECP_IN_PROGRESS" },
+#endif /* MBEDTLS_ECP_C */
+
+#if defined(MBEDTLS_MD_C)
+        { -(MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE), "MD_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_MD_BAD_INPUT_DATA), "MD_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_MD_ALLOC_FAILED), "MD_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_MD_FILE_IO_ERROR), "MD_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_MD_HW_ACCEL_FAILED), "MD_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD_C */
+
+#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
+        { -(MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT), "PEM_NO_HEADER_FOOTER_PRESENT" },
+        { -(MBEDTLS_ERR_PEM_INVALID_DATA), "PEM_INVALID_DATA" },
+        { -(MBEDTLS_ERR_PEM_ALLOC_FAILED), "PEM_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_PEM_INVALID_ENC_IV), "PEM_INVALID_ENC_IV" },
+        { -(MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG), "PEM_UNKNOWN_ENC_ALG" },
+        { -(MBEDTLS_ERR_PEM_PASSWORD_REQUIRED), "PEM_PASSWORD_REQUIRED" },
+        { -(MBEDTLS_ERR_PEM_PASSWORD_MISMATCH), "PEM_PASSWORD_MISMATCH" },
+        { -(MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE), "PEM_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PEM_BAD_INPUT_DATA), "PEM_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
+
+#if defined(MBEDTLS_PK_C)
+        { -(MBEDTLS_ERR_PK_ALLOC_FAILED), "PK_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_PK_TYPE_MISMATCH), "PK_TYPE_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_BAD_INPUT_DATA), "PK_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PK_FILE_IO_ERROR), "PK_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_PK_KEY_INVALID_VERSION), "PK_KEY_INVALID_VERSION" },
+        { -(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT), "PK_KEY_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PK_UNKNOWN_PK_ALG), "PK_UNKNOWN_PK_ALG" },
+        { -(MBEDTLS_ERR_PK_PASSWORD_REQUIRED), "PK_PASSWORD_REQUIRED" },
+        { -(MBEDTLS_ERR_PK_PASSWORD_MISMATCH), "PK_PASSWORD_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_INVALID_PUBKEY), "PK_INVALID_PUBKEY" },
+        { -(MBEDTLS_ERR_PK_INVALID_ALG), "PK_INVALID_ALG" },
+        { -(MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE), "PK_UNKNOWN_NAMED_CURVE" },
+        { -(MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE), "PK_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PK_SIG_LEN_MISMATCH), "PK_SIG_LEN_MISMATCH" },
+        { -(MBEDTLS_ERR_PK_HW_ACCEL_FAILED), "PK_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_PK_C */
+
+#if defined(MBEDTLS_PKCS12_C)
+        { -(MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA), "PKCS12_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE), "PKCS12_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT), "PKCS12_PBE_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH), "PKCS12_PASSWORD_MISMATCH" },
+#endif /* MBEDTLS_PKCS12_C */
+
+#if defined(MBEDTLS_PKCS5_C)
+        { -(MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA), "PKCS5_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT), "PKCS5_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE), "PKCS5_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH), "PKCS5_PASSWORD_MISMATCH" },
+#endif /* MBEDTLS_PKCS5_C */
+
+#if defined(MBEDTLS_RSA_C)
+        { -(MBEDTLS_ERR_RSA_BAD_INPUT_DATA), "RSA_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_RSA_INVALID_PADDING), "RSA_INVALID_PADDING" },
+        { -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED), "RSA_KEY_GEN_FAILED" },
+        { -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED), "RSA_KEY_CHECK_FAILED" },
+        { -(MBEDTLS_ERR_RSA_PUBLIC_FAILED), "RSA_PUBLIC_FAILED" },
+        { -(MBEDTLS_ERR_RSA_PRIVATE_FAILED), "RSA_PRIVATE_FAILED" },
+        { -(MBEDTLS_ERR_RSA_VERIFY_FAILED), "RSA_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE), "RSA_OUTPUT_TOO_LARGE" },
+        { -(MBEDTLS_ERR_RSA_RNG_FAILED), "RSA_RNG_FAILED" },
+        { -(MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION), "RSA_UNSUPPORTED_OPERATION" },
+        { -(MBEDTLS_ERR_RSA_HW_ACCEL_FAILED), "RSA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_RSA_C */
+
+#if defined(MBEDTLS_SSL_TLS_C)
+        { -(MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE), "SSL_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_SSL_BAD_INPUT_DATA), "SSL_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_SSL_INVALID_MAC), "SSL_INVALID_MAC" },
+        { -(MBEDTLS_ERR_SSL_INVALID_RECORD), "SSL_INVALID_RECORD" },
+        { -(MBEDTLS_ERR_SSL_CONN_EOF), "SSL_CONN_EOF" },
+        { -(MBEDTLS_ERR_SSL_UNKNOWN_CIPHER), "SSL_UNKNOWN_CIPHER" },
+        { -(MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN), "SSL_NO_CIPHER_CHOSEN" },
+        { -(MBEDTLS_ERR_SSL_NO_RNG), "SSL_NO_RNG" },
+        { -(MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE), "SSL_NO_CLIENT_CERTIFICATE" },
+        { -(MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE), "SSL_CERTIFICATE_TOO_LARGE" },
+        { -(MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED), "SSL_CERTIFICATE_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED), "SSL_PRIVATE_KEY_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED), "SSL_CA_CHAIN_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE), "SSL_UNEXPECTED_MESSAGE" },
+        { -(MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED), "SSL_PEER_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY), "SSL_PEER_CLOSE_NOTIFY" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO), "SSL_BAD_HS_CLIENT_HELLO" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO), "SSL_BAD_HS_SERVER_HELLO" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE), "SSL_BAD_HS_CERTIFICATE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST), "SSL_BAD_HS_CERTIFICATE_REQUEST" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE), "SSL_BAD_HS_SERVER_KEY_EXCHANGE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE), "SSL_BAD_HS_SERVER_HELLO_DONE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY), "SSL_BAD_HS_CERTIFICATE_VERIFY" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC), "SSL_BAD_HS_CHANGE_CIPHER_SPEC" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_FINISHED), "SSL_BAD_HS_FINISHED" },
+        { -(MBEDTLS_ERR_SSL_ALLOC_FAILED), "SSL_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FAILED), "SSL_HW_ACCEL_FAILED" },
+        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH), "SSL_HW_ACCEL_FALLTHROUGH" },
+        { -(MBEDTLS_ERR_SSL_COMPRESSION_FAILED), "SSL_COMPRESSION_FAILED" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION), "SSL_BAD_HS_PROTOCOL_VERSION" },
+        { -(MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET), "SSL_BAD_HS_NEW_SESSION_TICKET" },
+        { -(MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED), "SSL_SESSION_TICKET_EXPIRED" },
+        { -(MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH), "SSL_PK_TYPE_MISMATCH" },
+        { -(MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY), "SSL_UNKNOWN_IDENTITY" },
+        { -(MBEDTLS_ERR_SSL_INTERNAL_ERROR), "SSL_INTERNAL_ERROR" },
+        { -(MBEDTLS_ERR_SSL_COUNTER_WRAPPING), "SSL_COUNTER_WRAPPING" },
+        { -(MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO), "SSL_WAITING_SERVER_HELLO_RENEGO" },
+        { -(MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED), "SSL_HELLO_VERIFY_REQUIRED" },
+        { -(MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL), "SSL_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE), "SSL_NO_USABLE_CIPHERSUITE" },
+        { -(MBEDTLS_ERR_SSL_WANT_READ), "SSL_WANT_READ" },
+        { -(MBEDTLS_ERR_SSL_WANT_WRITE), "SSL_WANT_WRITE" },
+        { -(MBEDTLS_ERR_SSL_TIMEOUT), "SSL_TIMEOUT" },
+        { -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT), "SSL_CLIENT_RECONNECT" },
+        { -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD), "SSL_UNEXPECTED_RECORD" },
+        { -(MBEDTLS_ERR_SSL_NON_FATAL), "SSL_NON_FATAL" },
+        { -(MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH), "SSL_INVALID_VERIFY_HASH" },
+        { -(MBEDTLS_ERR_SSL_CONTINUE_PROCESSING), "SSL_CONTINUE_PROCESSING" },
+        { -(MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS), "SSL_ASYNC_IN_PROGRESS" },
+        { -(MBEDTLS_ERR_SSL_EARLY_MESSAGE), "SSL_EARLY_MESSAGE" },
+        { -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS), "SSL_CRYPTO_IN_PROGRESS" },
+#endif /* MBEDTLS_SSL_TLS_C */
+
+#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
+        { -(MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE), "X509_FEATURE_UNAVAILABLE" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_OID), "X509_UNKNOWN_OID" },
+        { -(MBEDTLS_ERR_X509_INVALID_FORMAT), "X509_INVALID_FORMAT" },
+        { -(MBEDTLS_ERR_X509_INVALID_VERSION), "X509_INVALID_VERSION" },
+        { -(MBEDTLS_ERR_X509_INVALID_SERIAL), "X509_INVALID_SERIAL" },
+        { -(MBEDTLS_ERR_X509_INVALID_ALG), "X509_INVALID_ALG" },
+        { -(MBEDTLS_ERR_X509_INVALID_NAME), "X509_INVALID_NAME" },
+        { -(MBEDTLS_ERR_X509_INVALID_DATE), "X509_INVALID_DATE" },
+        { -(MBEDTLS_ERR_X509_INVALID_SIGNATURE), "X509_INVALID_SIGNATURE" },
+        { -(MBEDTLS_ERR_X509_INVALID_EXTENSIONS), "X509_INVALID_EXTENSIONS" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_VERSION), "X509_UNKNOWN_VERSION" },
+        { -(MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG), "X509_UNKNOWN_SIG_ALG" },
+        { -(MBEDTLS_ERR_X509_SIG_MISMATCH), "X509_SIG_MISMATCH" },
+        { -(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED), "X509_CERT_VERIFY_FAILED" },
+        { -(MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT), "X509_CERT_UNKNOWN_FORMAT" },
+        { -(MBEDTLS_ERR_X509_BAD_INPUT_DATA), "X509_BAD_INPUT_DATA" },
+        { -(MBEDTLS_ERR_X509_ALLOC_FAILED), "X509_ALLOC_FAILED" },
+        { -(MBEDTLS_ERR_X509_FILE_IO_ERROR), "X509_FILE_IO_ERROR" },
+        { -(MBEDTLS_ERR_X509_BUFFER_TOO_SMALL), "X509_BUFFER_TOO_SMALL" },
+        { -(MBEDTLS_ERR_X509_FATAL_ERROR), "X509_FATAL_ERROR" },
+#endif /* MBEDTLS_X509_USE_C || MBEDTLS_X509_CREATE_C */
+// END generated code
+};
+
+static const struct ssl_errs mbedtls_low_level_error_tab[] = {
+// Low level error codes
+//
+// BEGIN generated code
+#if defined(MBEDTLS_AES_C)
+    { -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH), "AES_INVALID_KEY_LENGTH" },
+    { -(MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH), "AES_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_AES_BAD_INPUT_DATA), "AES_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE), "AES_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_AES_HW_ACCEL_FAILED), "AES_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_AES_C */
+
+#if defined(MBEDTLS_ARC4_C)
+    { -(MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED), "ARC4_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_ARC4_C */
+
+#if defined(MBEDTLS_ARIA_C)
+    { -(MBEDTLS_ERR_ARIA_BAD_INPUT_DATA), "ARIA_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH), "ARIA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE), "ARIA_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED), "ARIA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_ARIA_C */
+
+#if defined(MBEDTLS_ASN1_PARSE_C)
+    { -(MBEDTLS_ERR_ASN1_OUT_OF_DATA), "ASN1_OUT_OF_DATA" },
+    { -(MBEDTLS_ERR_ASN1_UNEXPECTED_TAG), "ASN1_UNEXPECTED_TAG" },
+    { -(MBEDTLS_ERR_ASN1_INVALID_LENGTH), "ASN1_INVALID_LENGTH" },
+    { -(MBEDTLS_ERR_ASN1_LENGTH_MISMATCH), "ASN1_LENGTH_MISMATCH" },
+    { -(MBEDTLS_ERR_ASN1_INVALID_DATA), "ASN1_INVALID_DATA" },
+    { -(MBEDTLS_ERR_ASN1_ALLOC_FAILED), "ASN1_ALLOC_FAILED" },
+    { -(MBEDTLS_ERR_ASN1_BUF_TOO_SMALL), "ASN1_BUF_TOO_SMALL" },
+#endif /* MBEDTLS_ASN1_PARSE_C */
+
+#if defined(MBEDTLS_BASE64_C)
+    { -(MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL), "BASE64_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_BASE64_INVALID_CHARACTER), "BASE64_INVALID_CHARACTER" },
+#endif /* MBEDTLS_BASE64_C */
+
+#if defined(MBEDTLS_BIGNUM_C)
+    { -(MBEDTLS_ERR_MPI_FILE_IO_ERROR), "MPI_FILE_IO_ERROR" },
+    { -(MBEDTLS_ERR_MPI_BAD_INPUT_DATA), "MPI_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_MPI_INVALID_CHARACTER), "MPI_INVALID_CHARACTER" },
+    { -(MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL), "MPI_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_MPI_NEGATIVE_VALUE), "MPI_NEGATIVE_VALUE" },
+    { -(MBEDTLS_ERR_MPI_DIVISION_BY_ZERO), "MPI_DIVISION_BY_ZERO" },
+    { -(MBEDTLS_ERR_MPI_NOT_ACCEPTABLE), "MPI_NOT_ACCEPTABLE" },
+    { -(MBEDTLS_ERR_MPI_ALLOC_FAILED), "MPI_ALLOC_FAILED" },
+#endif /* MBEDTLS_BIGNUM_C */
+
+#if defined(MBEDTLS_BLOWFISH_C)
+    { -(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA), "BLOWFISH_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH), "BLOWFISH_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED), "BLOWFISH_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_BLOWFISH_C */
+
+#if defined(MBEDTLS_CAMELLIA_C)
+    { -(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA), "CAMELLIA_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH), "CAMELLIA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED), "CAMELLIA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CAMELLIA_C */
+
+#if defined(MBEDTLS_CCM_C)
+    { -(MBEDTLS_ERR_CCM_BAD_INPUT), "CCM_BAD_INPUT" },
+    { -(MBEDTLS_ERR_CCM_AUTH_FAILED), "CCM_AUTH_FAILED" },
+    { -(MBEDTLS_ERR_CCM_HW_ACCEL_FAILED), "CCM_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CCM_C */
+
+#if defined(MBEDTLS_CHACHA20_C)
+    { -(MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA), "CHACHA20_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE), "CHACHA20_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED), "CHACHA20_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CHACHA20_C */
+
+#if defined(MBEDTLS_CHACHAPOLY_C)
+    { -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE), "CHACHAPOLY_BAD_STATE" },
+    { -(MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED), "CHACHAPOLY_AUTH_FAILED" },
+#endif /* MBEDTLS_CHACHAPOLY_C */
+
+#if defined(MBEDTLS_CMAC_C)
+    { -(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED), "CMAC_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_CMAC_C */
+
+#if defined(MBEDTLS_CTR_DRBG_C)
+    { -(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED), "CTR_DRBG_ENTROPY_SOURCE_FAILED" },
+    { -(MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG), "CTR_DRBG_REQUEST_TOO_BIG" },
+    { -(MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG), "CTR_DRBG_INPUT_TOO_BIG" },
+    { -(MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR), "CTR_DRBG_FILE_IO_ERROR" },
+#endif /* MBEDTLS_CTR_DRBG_C */
+
+#if defined(MBEDTLS_DES_C)
+    { -(MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH), "DES_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_DES_HW_ACCEL_FAILED), "DES_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_DES_C */
+
+#if defined(MBEDTLS_ENTROPY_C)
+    { -(MBEDTLS_ERR_ENTROPY_SOURCE_FAILED), "ENTROPY_SOURCE_FAILED" },
+    { -(MBEDTLS_ERR_ENTROPY_MAX_SOURCES), "ENTROPY_MAX_SOURCES" },
+    { -(MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED), "ENTROPY_NO_SOURCES_DEFINED" },
+    { -(MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE), "ENTROPY_NO_STRONG_SOURCE" },
+    { -(MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR), "ENTROPY_FILE_IO_ERROR" },
+#endif /* MBEDTLS_ENTROPY_C */
+
+#if defined(MBEDTLS_GCM_C)
+    { -(MBEDTLS_ERR_GCM_AUTH_FAILED), "GCM_AUTH_FAILED" },
+    { -(MBEDTLS_ERR_GCM_HW_ACCEL_FAILED), "GCM_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_GCM_BAD_INPUT), "GCM_BAD_INPUT" },
+#endif /* MBEDTLS_GCM_C */
+
+#if defined(MBEDTLS_HKDF_C)
+    { -(MBEDTLS_ERR_HKDF_BAD_INPUT_DATA), "HKDF_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_HKDF_C */
+
+#if defined(MBEDTLS_HMAC_DRBG_C)
+    { -(MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG), "HMAC_DRBG_REQUEST_TOO_BIG" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG), "HMAC_DRBG_INPUT_TOO_BIG" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR), "HMAC_DRBG_FILE_IO_ERROR" },
+    { -(MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED), "HMAC_DRBG_ENTROPY_SOURCE_FAILED" },
+#endif /* MBEDTLS_HMAC_DRBG_C */
+
+#if defined(MBEDTLS_MD2_C)
+    { -(MBEDTLS_ERR_MD2_HW_ACCEL_FAILED), "MD2_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD2_C */
+
+#if defined(MBEDTLS_MD4_C)
+    { -(MBEDTLS_ERR_MD4_HW_ACCEL_FAILED), "MD4_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD4_C */
+
+#if defined(MBEDTLS_MD5_C)
+    { -(MBEDTLS_ERR_MD5_HW_ACCEL_FAILED), "MD5_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_MD5_C */
+
+#if defined(MBEDTLS_NET_C)
+    { -(MBEDTLS_ERR_NET_SOCKET_FAILED), "NET_SOCKET_FAILED" },
+    { -(MBEDTLS_ERR_NET_CONNECT_FAILED), "NET_CONNECT_FAILED" },
+    { -(MBEDTLS_ERR_NET_BIND_FAILED), "NET_BIND_FAILED" },
+    { -(MBEDTLS_ERR_NET_LISTEN_FAILED), "NET_LISTEN_FAILED" },
+    { -(MBEDTLS_ERR_NET_ACCEPT_FAILED), "NET_ACCEPT_FAILED" },
+    { -(MBEDTLS_ERR_NET_RECV_FAILED), "NET_RECV_FAILED" },
+    { -(MBEDTLS_ERR_NET_SEND_FAILED), "NET_SEND_FAILED" },
+    { -(MBEDTLS_ERR_NET_CONN_RESET), "NET_CONN_RESET" },
+    { -(MBEDTLS_ERR_NET_UNKNOWN_HOST), "NET_UNKNOWN_HOST" },
+    { -(MBEDTLS_ERR_NET_BUFFER_TOO_SMALL), "NET_BUFFER_TOO_SMALL" },
+    { -(MBEDTLS_ERR_NET_INVALID_CONTEXT), "NET_INVALID_CONTEXT" },
+    { -(MBEDTLS_ERR_NET_POLL_FAILED), "NET_POLL_FAILED" },
+    { -(MBEDTLS_ERR_NET_BAD_INPUT_DATA), "NET_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_NET_C */
+
+#if defined(MBEDTLS_OID_C)
+    { -(MBEDTLS_ERR_OID_NOT_FOUND), "OID_NOT_FOUND" },
+    { -(MBEDTLS_ERR_OID_BUF_TOO_SMALL), "OID_BUF_TOO_SMALL" },
+#endif /* MBEDTLS_OID_C */
+
+#if defined(MBEDTLS_PADLOCK_C)
+    { -(MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED), "PADLOCK_DATA_MISALIGNED" },
+#endif /* MBEDTLS_PADLOCK_C */
+
+#if defined(MBEDTLS_PLATFORM_C)
+    { -(MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED), "PLATFORM_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED), "PLATFORM_FEATURE_UNSUPPORTED" },
+#endif /* MBEDTLS_PLATFORM_C */
+
+#if defined(MBEDTLS_POLY1305_C)
+    { -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA), "POLY1305_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE), "POLY1305_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED), "POLY1305_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_POLY1305_C */
+
+#if defined(MBEDTLS_RIPEMD160_C)
+    { -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED), "RIPEMD160_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_RIPEMD160_C */
+
+#if defined(MBEDTLS_SHA1_C)
+    { -(MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED), "SHA1_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA1_BAD_INPUT_DATA), "SHA1_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA1_C */
+
+#if defined(MBEDTLS_SHA256_C)
+    { -(MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED), "SHA256_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA256_BAD_INPUT_DATA), "SHA256_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA256_C */
+
+#if defined(MBEDTLS_SHA512_C)
+    { -(MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED), "SHA512_HW_ACCEL_FAILED" },
+    { -(MBEDTLS_ERR_SHA512_BAD_INPUT_DATA), "SHA512_BAD_INPUT_DATA" },
+#endif /* MBEDTLS_SHA512_C */
+
+#if defined(MBEDTLS_THREADING_C)
+    { -(MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE), "THREADING_FEATURE_UNAVAILABLE" },
+    { -(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA), "THREADING_BAD_INPUT_DATA" },
+    { -(MBEDTLS_ERR_THREADING_MUTEX_ERROR), "THREADING_MUTEX_ERROR" },
+#endif /* MBEDTLS_THREADING_C */
+
+#if defined(MBEDTLS_XTEA_C)
+    { -(MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH), "XTEA_INVALID_INPUT_LENGTH" },
+    { -(MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED), "XTEA_HW_ACCEL_FAILED" },
+#endif /* MBEDTLS_XTEA_C */
+// END generated code
+};
+
+static const char *mbedtls_err_prefix = "MBEDTLS_ERR_";
+#define MBEDTLS_ERR_PREFIX_LEN ( sizeof("MBEDTLS_ERR_")-1 )
+
+// copy error text into buffer, ensure null termination, return strlen of result
+static size_t mbedtls_err_to_str(int err, const struct ssl_errs tab[], int tab_len, char *buf, size_t buflen) {
+    if (buflen == 0) return 0;
+
+    // prefix for all error names
+    strncpy(buf, mbedtls_err_prefix, buflen);
+    if (buflen <= MBEDTLS_ERR_PREFIX_LEN+1) {
+        buf[buflen-1] = 0;
+        return buflen-1;
+    }
+
+    // append error name from table
+    for (int i = 0; i < tab_len; i++) {
+        if (tab[i].errnum == err) {
+            strncpy(buf+MBEDTLS_ERR_PREFIX_LEN, tab[i].errstr, buflen-MBEDTLS_ERR_PREFIX_LEN);
+            buf[buflen-1] = 0;
+            return strlen(buf);
+        }
+    }
+
+    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (0x%04X)",
+            err);
+    return strlen(buf);
+}
+
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+
+void mbedtls_strerror(int ret, char *buf, size_t buflen) {
+    int use_ret;
+
+    if (buflen == 0) return;
+
+    buf[buflen-1] = 0;
+
+    if (ret < 0) ret = -ret;
+
+    //
+    // High-level error codes
+    //
+    uint8_t got_hl = (ret & 0xFF80) != 0;
+    if (got_hl) {
+        use_ret = ret & 0xFF80;
+
+        // special case
+#if defined(MBEDTLS_SSL_TLS_C)
+        if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) {
+            strncpy(buf, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE", buflen);
+            buf[buflen-1] = 0;
+            return;
+        }
+#endif
+
+        size_t len = mbedtls_err_to_str(use_ret, mbedtls_high_level_error_tab,
+                ARRAY_SIZE(mbedtls_high_level_error_tab), buf, buflen);
+
+        buf += len;
+        buflen -= len;
+        if (buflen == 0) return;
+    }
+
+    //
+    // Low-level error codes
+    //
+    use_ret = ret & ~0xFF80;
+
+    if (use_ret == 0) return;
+
+    // If high level code is present, make a concatenation between both error strings.
+    if (got_hl) {
+        if (buflen < 2) return;
+        *buf++ = '+';
+        buflen--;
+    }
+
+    mbedtls_err_to_str(use_ret, mbedtls_low_level_error_tab,
+            ARRAY_SIZE(mbedtls_low_level_error_tab), buf, buflen);
+}
+
+#else /* MBEDTLS_ERROR_C */
+
+#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
+
+/*
+ * Provide an non-function in case MBEDTLS_ERROR_C is not defined
+ */
+void mbedtls_strerror( int ret, char *buf, size_t buflen )
+{
+    ((void) ret);
+
+    if( buflen > 0 )
+        buf[0] = '\0';
+}
+
+#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
+
+#endif /* MBEDTLS_ERROR_C */
diff --git a/extmod/mbedtls_errors/tester.c b/extmod/mbedtls_errors/tester.c
new file mode 100644
index 0000000000000..9abb3bb0f42d3
--- /dev/null
+++ b/extmod/mbedtls_errors/tester.c
@@ -0,0 +1,58 @@
+#include "mbedtls/error.h"
+#include <string.h>
+#include <stdio.h>
+
+// test_code checks that the provided code results in the provided error string for any size
+// buffer. It calls mbedtls_strerror() to fill a buffer that is from 1 to 100 bytes in length
+// and then checks that the buffer contents is OK and that a few guard bytes before and after
+// the buffer were not overwritten.
+int test_code(int code, char *str) {
+    char buf[100];
+    int ok = 1;
+    int res;
+
+    // test zero-length buffer
+    memset(buf, -3, 100);
+    mbedtls_strerror(code, buf+4, 0);
+    for (int i=0; i < 10; i++) {
+        if (buf[i] != -3) {
+            printf("Error: guard overwritten buflen=0 i=%d buf[i]=%d\n", i, buf[i]);
+            ok = 0;
+        }
+    }
+
+    // test
+    for(size_t buflen=1; buflen<90; buflen++) {
+        memset(buf, -3, 100);
+        mbedtls_strerror(code, buf+4, buflen);
+        for (int i=0; i < 4; i++) {
+            if (buf[i] != -3) {
+                printf("Error: pre-guard overwritten buflen=%d i=%d buf[i]=%d\n", buflen, i, buf[i]);
+                ok = 0;
+            }
+        }
+        for (int i=4+buflen; i< 100; i++) {
+            if (buf[i] != -3) {
+                printf("Error: post-guard overwritten buflen=%d i=%d buf[i]=%d\n", buflen, i, buf[i]);
+                ok = 0;
+            }
+        }
+        char exp[100];
+        strncpy(exp, str, buflen);
+        exp[buflen-1] = 0;
+        if (strcmp(buf+4, exp) != 0) {
+            printf("Error: expected %s, got %s\n", exp, buf);
+            ok = 0;
+        }
+    }
+
+    printf("Test %x -> %s is %s\n", code, str, ok?"OK":"*** BAD ***");
+}
+
+int main() {
+    test_code(0x7200, "MBEDTLS_ERR_SSL_INVALID_RECORD");
+    test_code(0x7780, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE");
+    test_code(0x0074, "MBEDTLS_ERR_SHA256_BAD_INPUT_DATA");
+    test_code(0x6600|0x0074, "MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH+MBEDTLS_ERR_SHA256_BAD_INPUT_DATA");
+    test_code(103, "MBEDTLS_ERR_UNKNOWN (0x0067)");
+}
diff --git a/extmod/modussl_mbedtls.c b/extmod/modussl_mbedtls.c
index de119ee9520e7..fe0e721335959 100644
--- a/extmod/modussl_mbedtls.c
+++ b/extmod/modussl_mbedtls.c
@@ -78,17 +78,21 @@ STATIC void mbedtls_debug(void *ctx, int level, const char *file, int line, cons
 #endif
 
 STATIC NORETURN void mbedtls_raise_error(int err) {
-    #if defined(MBEDTLS_ERROR_C)
-    // Including mbedtls_strerror takes about 16KB on the esp32 due to all the strings.
-    // MBEDTLS_ERROR_C is the define used by mbedtls to conditionally include mbedtls_strerror.
-    // It is set/unset in the MBEDTLS_CONFIG_FILE which is defined in the Makefile.
-    // "small" negative integer error codes come from underlying stream/sockets, not mbedtls
+    // _mbedtls_ssl_send and _mbedtls_ssl_recv (below) turn positive error codes from the
+    // underlying socket into negative codes to pass them through mbedtls. Here we turn them
+    // positive again so they get interpreted as the OSError they really are. The
+    // cut-off of -256 is a bit hacky, sigh.
     if (err < 0 && err > -256) {
         mp_raise_OSError(-err);
     }
 
+    #if defined(MBEDTLS_ERROR_C)
+    // Including mbedtls_strerror takes about 1.5KB due to the error strings.
+    // MBEDTLS_ERROR_C is the define used by mbedtls to conditionally include mbedtls_strerror.
+    // It is set/unset in the MBEDTLS_CONFIG_FILE which is defined in the Makefile.
+
     // Try to allocate memory for the message
-    #define ERR_STR_MAX 100  // mbedtls_strerror truncates if it doesn't fit
+    #define ERR_STR_MAX 80  // mbedtls_strerror truncates if it doesn't fit
     mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
     byte *o_str_buf = m_new_maybe(byte, ERR_STR_MAX);
     if (o_str == NULL || o_str_buf == NULL) {
@@ -97,7 +101,7 @@ STATIC NORETURN void mbedtls_raise_error(int err) {
 
     // print the error message into the allocated buffer
     mbedtls_strerror(err, (char *)o_str_buf, ERR_STR_MAX);
-    size_t len = strnlen((char *)o_str_buf, ERR_STR_MAX);
+    size_t len = strlen((char *)o_str_buf);
 
     // Put the exception object together
     o_str->base.type = &mp_type_str;
@@ -109,7 +113,7 @@ STATIC NORETURN void mbedtls_raise_error(int err) {
     nlr_raise(mp_obj_exception_make_new(&mp_type_OSError, 2, 0, args));
     #else
     // mbedtls is compiled without error strings so we simply return the err number
-    mp_raise_OSError(err); // typ. err is negative
+    mp_raise_OSError(err); // err is typically a large negative number
     #endif
 }
 
diff --git a/lib/libc/string0.c b/lib/libc/string0.c
index 8c86bf65f7b40..5f40a71e3e284 100644
--- a/lib/libc/string0.c
+++ b/lib/libc/string0.c
@@ -169,6 +169,23 @@ char *strcpy(char *dest, const char *src) {
     return dest;
 }
 
+// Public Domain implementation of strncpy from:
+// http://en.wikibooks.org/wiki/C_Programming/Strings#The_strncpy_function
+char *strncpy(char *s1, const char *s2, size_t n) {
+     char *dst = s1;
+     const char *src = s2;
+     /* Copy bytes, one at a time.  */
+     while (n > 0) {
+         n--;
+         if ((*dst++ = *src++) == '\0') {
+             /* If we get here, we found a null character at the end of s2 */
+             *dst = '\0';
+             break;
+         }
+     }
+     return s1;
+ }
+
 // needed because gcc optimises strcpy + strcat to this
 char *stpcpy(char *dest, const char *src) {
     while (*src) {
diff --git a/ports/esp32/Makefile b/ports/esp32/Makefile
index 0f6a1969a6208..a2aafeef652ac 100644
--- a/ports/esp32/Makefile
+++ b/ports/esp32/Makefile
@@ -359,6 +359,7 @@ SRC_C = \
 
 EXTMOD_SRC_C += $(addprefix extmod/,\
 	modonewire.c \
+	mbedtls_errors/esp32_mbedtls_errors.c \
 	)
 
 LIB_SRC_C = $(addprefix lib/,\
@@ -506,11 +507,12 @@ ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*/*.c) \
 	)
 
-ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o,\
+# Mbedtls source files, exclude error.c in favor of extmod/mbedtls_errors/esp32_mbedtls_errors.c
+ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o, $(filter-out %/error.c,\
 	$(wildcard $(ESPCOMP)/mbedtls/mbedtls/library/*.c) \
 	$(wildcard $(ESPCOMP)/mbedtls/port/*.c) \
 	$(wildcard $(ESPCOMP)/mbedtls/port/esp32/*.c) \
-	)
+	))
 
 ESPIDF_MDNS_O = $(patsubst %.c,%.o,$(wildcard $(ESPCOMP)/mdns/*.c))
 
diff --git a/ports/stm32/Makefile b/ports/stm32/Makefile
index 2614d4aa0fcf0..0c9e4ef90b18d 100644
--- a/ports/stm32/Makefile
+++ b/ports/stm32/Makefile
@@ -472,6 +472,12 @@ endif
 ifeq ($(MICROPY_SSL_MBEDTLS),1)
 CFLAGS_MOD += -DMBEDTLS_CONFIG_FILE='"mbedtls/mbedtls_config.h"'
 SRC_MOD += mbedtls/mbedtls_port.c
+ifeq ($(MICROPY_SSL_MBEDTLS_ERRSTR),1)
+CFLAGS_MOD += -DMBEDTLS_ERROR_C=1
+# replace mbedtls' error.c by ours
+SRC_MOD := $(filter-out %/mbedtls/library/error.c, $(SRC_MOD))
+EXTMOD_SRC_C += extmod/mbedtls_errors/mp_mbedtls_errors.c
+endif
 endif
 
 ifeq ($(MICROPY_PY_BLUETOOTH),1)
diff --git a/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk b/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
index ead8bb8c07cf3..e794092d5cf28 100644
--- a/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
+++ b/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
@@ -17,6 +17,7 @@ MICROPY_PY_LWIP = 1
 MICROPY_PY_NETWORK_CYW43 = 1
 MICROPY_PY_USSL = 1
 MICROPY_SSL_MBEDTLS = 1
+MICROPY_SSL_MBEDTLS_ERRSTR = 1
 MICROPY_VFS_LFS2 = 1
 
 # PYBD-specific frozen modules
diff --git a/tests/net_inet/test_tls_sites.py b/tests/net_inet/test_tls_sites.py
index 876343acfc1d3..d2cb928c8d5b9 100644
--- a/tests/net_inet/test_tls_sites.py
+++ b/tests/net_inet/test_tls_sites.py
@@ -54,7 +54,7 @@ def main():
             test_one(site, opts)
             print(site, "ok")
         except Exception as e:
-            print(site, repr(e))
+            print(site, e)
 
 
 main()
diff --git a/tests/net_inet/tls_text_errors.py b/tests/net_inet/tls_text_errors.py
index 2ba167b868ef8..9e8ccfaf9ec77 100644
--- a/tests/net_inet/tls_text_errors.py
+++ b/tests/net_inet/tls_text_errors.py
@@ -14,10 +14,10 @@ def test(addr):
         print("wrap: no exception")
     except OSError as e:
         # mbedtls produces "mbedtls -0x7200: SSL - An invalid SSL record was received"
-        # axtls produces "RECORD_OVERFLOW"
+        # axtls produces "RECORD_OVERFLOW" but also prints "TLS buffer overflow,..."
         # CPython produces "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1108)"
         ok = (
-            "invalid SSL record" in str(e)
+            "SSL_INVALID_RECORD" in str(e)
             or "RECORD_OVERFLOW" in str(e)
             or "wrong version" in str(e)
         )

From a2c669b73d9c12e5153391c80597d0b466a27824 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Fri, 29 May 2020 21:40:02 -0700
Subject: [PATCH 06/10] address review comments

---
 extmod/modussl_axtls.c           | 4 +---
 extmod/modussl_mbedtls.c         | 1 -
 tests/net_inet/tls_num_errors.py | 2 +-
 3 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/extmod/modussl_axtls.c b/extmod/modussl_axtls.c
index 563ac3b5c1e71..0b0ce35fc8711 100644
--- a/extmod/modussl_axtls.c
+++ b/extmod/modussl_axtls.c
@@ -82,11 +82,10 @@ STATIC const struct ssl_errs ssl_error_tab[] = {
     { SSL_ERROR_NO_CERT_DEFINED, "NO_CERT_DEFINED" },
     { SSL_ERROR_NO_CLIENT_RENOG, "NO_CLIENT_RENOG" },
     { SSL_ERROR_NOT_SUPPORTED, "NOT_SUPPORTED" },
-    { 0, 0 },
 };
 
 STATIC NORETURN void ussl_raise_error(int err) {
-    for (int i = 0; ssl_error_tab[i].errnum != 0; i++) {
+    for (size_t i = 0; i < MP_ARRAY_SIZE(ssl_error_tab); i++) {
         if (ssl_error_tab[i].errnum == err) {
             // construct string object
             mp_obj_str_t *o_str = m_new_obj_maybe(mp_obj_str_t);
@@ -159,7 +158,6 @@ STATIC mp_obj_ssl_socket_t *ussl_socket_new(mp_obj_t sock, struct ssl_args *args
             int res = ssl_handshake_status(o->ssl_sock);
 
             if (res != SSL_OK) {
-                ssl_display_error(res);
                 ussl_raise_error(res);
             }
         }
diff --git a/extmod/modussl_mbedtls.c b/extmod/modussl_mbedtls.c
index fe0e721335959..1677dc6e1ca70 100644
--- a/extmod/modussl_mbedtls.c
+++ b/extmod/modussl_mbedtls.c
@@ -45,7 +45,6 @@
 #include "mbedtls/ctr_drbg.h"
 #include "mbedtls/debug.h"
 #include "mbedtls/error.h"
-#include MBEDTLS_CONFIG_FILE
 
 typedef struct _mp_obj_ssl_socket_t {
     mp_obj_base_t base;
diff --git a/tests/net_inet/tls_num_errors.py b/tests/net_inet/tls_num_errors.py
index b57e7f03d1252..dd7f714e6ef7e 100644
--- a/tests/net_inet/tls_num_errors.py
+++ b/tests/net_inet/tls_num_errors.py
@@ -1,4 +1,4 @@
-# test that modtls produces a text error message
+# test that modtls produces a numerical error message when out of heap
 
 try:
     import usocket as socket, ussl as ssl, sys

From e5f0fea3cbb4306dcf2494d9fd54783ea339a8ad Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Sat, 20 Jun 2020 09:31:45 -0700
Subject: [PATCH 07/10] rework mbedtls error message generation using a diff

---
 extmod/mbedtls_errors/do-esp32.sh             |   5 -
 extmod/mbedtls_errors/do-mp.sh                |   3 -
 extmod/mbedtls_errors/error_orig.fmt          | 123 -----------
 extmod/mbedtls_errors/generate_errors.pl      | 209 ------------------
 extmod/mbedtls_errors/generate_errors_orig.pl | 207 -----------------
 {extmod => lib}/mbedtls_errors/README.md      |  35 +--
 lib/mbedtls_errors/do-esp32.sh                |   7 +
 lib/mbedtls_errors/do-mp.sh                   |   4 +
 {extmod => lib}/mbedtls_errors/do-test.sh     |   2 +-
 {extmod => lib}/mbedtls_errors/error.fmt      |   0
 .../mbedtls_errors/esp32_mbedtls_errors.c     |   0
 lib/mbedtls_errors/generate_errors.diff       |  22 ++
 .../mbedtls_errors/mp_mbedtls_errors.c        |   2 +-
 {extmod => lib}/mbedtls_errors/tester.c       |   0
 ports/esp32/Makefile                          |   4 +-
 ports/stm32/Makefile                          |   2 +-
 ports/stm32/boards/PYBD_SF2/mpconfigboard.mk  |   1 -
 ports/stm32/mbedtls/mbedtls_config.h          |   1 +
 18 files changed, 57 insertions(+), 570 deletions(-)
 delete mode 100755 extmod/mbedtls_errors/do-esp32.sh
 delete mode 100755 extmod/mbedtls_errors/do-mp.sh
 delete mode 100644 extmod/mbedtls_errors/error_orig.fmt
 delete mode 100755 extmod/mbedtls_errors/generate_errors.pl
 delete mode 100755 extmod/mbedtls_errors/generate_errors_orig.pl
 rename {extmod => lib}/mbedtls_errors/README.md (59%)
 create mode 100755 lib/mbedtls_errors/do-esp32.sh
 create mode 100755 lib/mbedtls_errors/do-mp.sh
 rename {extmod => lib}/mbedtls_errors/do-test.sh (51%)
 rename {extmod => lib}/mbedtls_errors/error.fmt (100%)
 rename extmod/mbedtls_errors/mp_mbedtls_errors.c => lib/mbedtls_errors/esp32_mbedtls_errors.c (100%)
 create mode 100644 lib/mbedtls_errors/generate_errors.diff
 rename extmod/mbedtls_errors/esp32_mbedtls_errors.c => lib/mbedtls_errors/mp_mbedtls_errors.c (99%)
 rename {extmod => lib}/mbedtls_errors/tester.c (100%)

diff --git a/extmod/mbedtls_errors/do-esp32.sh b/extmod/mbedtls_errors/do-esp32.sh
deleted file mode 100755
index ad1eb618a45ec..0000000000000
--- a/extmod/mbedtls_errors/do-esp32.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#! /bin/bash -e
-# Generate esp32_mbedtls_errors.c for use in the Esp32 port, with the ESP-IDF version of mbedtls
-# The ESPIDF env var must be set to the top-level dir of ESPIDF
-echo "ESPIDF=$ESPIDF"
-./generate_errors.pl $ESPIDF/components/mbedtls/mbedtls/include/mbedtls . esp32_mbedtls_errors.c
diff --git a/extmod/mbedtls_errors/do-mp.sh b/extmod/mbedtls_errors/do-mp.sh
deleted file mode 100755
index 16b52848887d0..0000000000000
--- a/extmod/mbedtls_errors/do-mp.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#! /bin/bash -e
-# Generate mp_mbedtls_errors.c for inclusion in ports that use $MPY/lib/mbedtls
-./generate_errors.pl ../../lib/mbedtls/include/mbedtls . mp_mbedtls_errors.c
diff --git a/extmod/mbedtls_errors/error_orig.fmt b/extmod/mbedtls_errors/error_orig.fmt
deleted file mode 100644
index a08742c83bb73..0000000000000
--- a/extmod/mbedtls_errors/error_orig.fmt
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- *  Error message information
- *
- *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
- *  SPDX-License-Identifier: Apache-2.0
- *
- *  Licensed under the Apache License, Version 2.0 (the "License"); you may
- *  not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- */
-
-#if !defined(MBEDTLS_CONFIG_FILE)
-#include "mbedtls/config.h"
-#else
-#include MBEDTLS_CONFIG_FILE
-#endif
-
-#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
-#include "mbedtls/error.h"
-#include <string.h>
-#endif
-
-#if defined(MBEDTLS_PLATFORM_C)
-#include "mbedtls/platform.h"
-#else
-#define mbedtls_snprintf snprintf
-#define mbedtls_time_t   time_t
-#endif
-
-#if defined(MBEDTLS_ERROR_C)
-
-#include <stdio.h>
-
-HEADER_INCLUDED
-
-void mbedtls_strerror( int ret, char *buf, size_t buflen )
-{
-    size_t len;
-    int use_ret;
-
-    if( buflen == 0 )
-        return;
-
-    memset( buf, 0x00, buflen );
-
-    if( ret < 0 )
-        ret = -ret;
-
-    if( ret & 0xFF80 )
-    {
-        use_ret = ret & 0xFF80;
-
-        // High level error codes
-        //
-        // BEGIN generated code
-HIGH_LEVEL_CODE_CHECKS
-        // END generated code
-
-        if( strlen( buf ) == 0 )
-            mbedtls_snprintf( buf, buflen, "UNKNOWN ERROR CODE (%04X)", use_ret );
-    }
-
-    use_ret = ret & ~0xFF80;
-
-    if( use_ret == 0 )
-        return;
-
-    // If high level code is present, make a concatenation between both
-    // error strings.
-    //
-    len = strlen( buf );
-
-    if( len > 0 )
-    {
-        if( buflen - len < 5 )
-            return;
-
-        mbedtls_snprintf( buf + len, buflen - len, " : " );
-
-        buf += len + 3;
-        buflen -= len + 3;
-    }
-
-    // Low level error codes
-    //
-    // BEGIN generated code
-LOW_LEVEL_CODE_CHECKS
-    // END generated code
-
-    if( strlen( buf ) != 0 )
-        return;
-
-    mbedtls_snprintf( buf, buflen, "UNKNOWN ERROR CODE (%04X)", use_ret );
-}
-
-#else /* MBEDTLS_ERROR_C */
-
-#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
-
-/*
- * Provide an non-function in case MBEDTLS_ERROR_C is not defined
- */
-void mbedtls_strerror( int ret, char *buf, size_t buflen )
-{
-    ((void) ret);
-
-    if( buflen > 0 )
-        buf[0] = '\0';
-}
-
-#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
-
-#endif /* MBEDTLS_ERROR_C */
diff --git a/extmod/mbedtls_errors/generate_errors.pl b/extmod/mbedtls_errors/generate_errors.pl
deleted file mode 100755
index 88c1f97c85f9f..0000000000000
--- a/extmod/mbedtls_errors/generate_errors.pl
+++ /dev/null
@@ -1,209 +0,0 @@
-#!/usr/bin/env perl
-
-# Generate error.c
-#
-# Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
-# or generate_errors.pl include_dir data_dir error_file
-
-use strict;
-
-my ($include_dir, $data_dir, $error_file);
-
-if( @ARGV ) {
-    die "Invalid number of arguments" if scalar @ARGV != 3;
-    ($include_dir, $data_dir, $error_file) = @ARGV;
-
-    -d $include_dir or die "No such directory: $include_dir\n";
-    -d $data_dir or die "No such directory: $data_dir\n";
-} else {
-    $include_dir = 'include/mbedtls';
-    $data_dir = 'scripts/data_files';
-    $error_file = 'library/error.c';
-
-    unless( -d $include_dir && -d $data_dir ) {
-        chdir '..' or die;
-        -d $include_dir && -d $data_dir
-            or die "Without arguments, must be run from root or scripts\n"
-    }
-}
-
-my $error_format_file = $data_dir.'/error.fmt';
-
-my @low_level_modules = qw( AES ARC4 ARIA ASN1 BASE64 BIGNUM BLOWFISH
-                            CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
-                            ENTROPY GCM HKDF HMAC_DRBG MD2 MD4 MD5
-                            NET OID PADLOCK PBKDF2 PLATFORM POLY1305 RIPEMD160
-                            SHA1 SHA256 SHA512 THREADING XTEA );
-my @high_level_modules = qw( CIPHER DHM ECP MD
-                             PEM PK PKCS12 PKCS5
-                             RSA SSL X509 );
-
-my $line_separator = $/;
-undef $/;
-
-open(FORMAT_FILE, "$error_format_file") or die "Opening error format file '$error_format_file': $!";
-my $error_format = <FORMAT_FILE>;
-close(FORMAT_FILE);
-
-$/ = $line_separator;
-
-my @files = <$include_dir/*.h>;
-my @matches;
-foreach my $file (@files) {
-    open(FILE, "$file");
-    my @grep_res = grep(/^\s*#define\s+MBEDTLS_ERR_\w+\s+\-0x[0-9A-Fa-f]+/, <FILE>);
-    push(@matches, @grep_res);
-    close FILE;
-}
-
-my $ll_old_define = "";
-my $hl_old_define = "";
-
-my $ll_code_check = "";
-my $hl_code_check = "";
-
-my $headers = "";
-
-my %error_codes_seen;
-
-
-foreach my $line (@matches)
-{
-    next if ($line =~ /compat-1.2.h/);
-    my ($error_name, $error_code) = $line =~ /(MBEDTLS_ERR_\w+)\s+\-(0x\w+)/;
-    my ($description) = $line =~ /\/\*\*< (.*?)\.? \*\//;
-
-    die "Duplicated error code: $error_code ($error_name)\n"
-        if( $error_codes_seen{$error_code}++ );
-
-    $description =~ s/\\/\\\\/g;
-    if ($description eq "") {
-        $description = "DESCRIPTION MISSING";
-        warn "Missing description for $error_name\n";
-    }
-
-    my ($module_name) = $error_name =~ /^MBEDTLS_ERR_([^_]+)/;
-
-    # Fix faulty ones
-    $module_name = "BIGNUM" if ($module_name eq "MPI");
-    $module_name = "CTR_DRBG" if ($module_name eq "CTR");
-    $module_name = "HMAC_DRBG" if ($module_name eq "HMAC");
-
-    my $define_name = $module_name;
-    $define_name = "X509_USE,X509_CREATE" if ($define_name eq "X509");
-    $define_name = "ASN1_PARSE" if ($define_name eq "ASN1");
-    $define_name = "SSL_TLS" if ($define_name eq "SSL");
-    $define_name = "PEM_PARSE,PEM_WRITE" if ($define_name eq "PEM");
-
-    my $include_name = $module_name;
-    $include_name =~ tr/A-Z/a-z/;
-    $include_name = "" if ($include_name eq "asn1");
-
-    # Fix faulty ones
-    $include_name = "net_sockets" if ($module_name eq "NET");
-
-    my $found_ll = grep $_ eq $module_name, @low_level_modules;
-    my $found_hl = grep $_ eq $module_name, @high_level_modules;
-    if (!$found_ll && !$found_hl)
-    {
-        printf("Error: Do not know how to handle: $module_name\n");
-        exit 1;
-    }
-
-    my $code_check;
-    my $old_define;
-    my $white_space;
-    my $first;
-
-    if ($found_ll)
-    {
-        $code_check = \$ll_code_check;
-        $old_define = \$ll_old_define;
-        $white_space = '    ';
-    }
-    else
-    {
-        $code_check = \$hl_code_check;
-        $old_define = \$hl_old_define;
-        $white_space = '        ';
-    }
-
-    if ($define_name ne ${$old_define})
-    {
-        if (${$old_define} ne "")
-        {
-            ${$code_check} .= "#endif /* ";
-            $first = 0;
-            foreach my $dep (split(/,/, ${$old_define}))
-            {
-                ${$code_check} .= " || " if ($first++);
-                ${$code_check} .= "MBEDTLS_${dep}_C";
-            }
-            ${$code_check} .= " */\n\n";
-        }
-
-        ${$code_check} .= "#if ";
-        $headers .= "#if " if ($include_name ne "");
-        $first = 0;
-        foreach my $dep (split(/,/, ${define_name}))
-        {
-            ${$code_check} .= " || " if ($first);
-            $headers       .= " || " if ($first++);
-
-            ${$code_check} .= "defined(MBEDTLS_${dep}_C)";
-            $headers       .= "defined(MBEDTLS_${dep}_C)" if
-                                                    ($include_name ne "");
-        }
-        ${$code_check} .= "\n";
-        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
-                    "#endif\n\n" if ($include_name ne "");
-        ${$old_define} = $define_name;
-    }
-
-    if ($error_name eq "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE")
-    {
-#        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
-#                          "${white_space}\{\n".
-#                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n".
-#                          "${white_space}    return;\n".
-#                          "${white_space}}\n"
-    }
-    else
-    {
-#        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
-#                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n"
-         my $error_text = $error_name =~ s/^MBEDTLS_ERR_//r;
-         ${$code_check} .= "${white_space}{ -($error_name), \"$error_text\" },\n"
-    }
-};
-
-if ($ll_old_define ne "")
-{
-    $ll_code_check .= "#endif /* ";
-    my $first = 0;
-    foreach my $dep (split(/,/, $ll_old_define))
-    {
-        $ll_code_check .= " || " if ($first++);
-        $ll_code_check .= "MBEDTLS_${dep}_C";
-    }
-    $ll_code_check .= " */\n";
-}
-if ($hl_old_define ne "")
-{
-    $hl_code_check .= "#endif /* ";
-    my $first = 0;
-    foreach my $dep (split(/,/, $hl_old_define))
-    {
-        $hl_code_check .= " || " if ($first++);
-        $hl_code_check .= "MBEDTLS_${dep}_C";
-    }
-    $hl_code_check .= " */\n";
-}
-
-$error_format =~ s/HEADER_INCLUDED\n/$headers/g;
-$error_format =~ s/LOW_LEVEL_CODE_CHECKS\n/$ll_code_check/g;
-$error_format =~ s/HIGH_LEVEL_CODE_CHECKS\n/$hl_code_check/g;
-
-open(ERROR_FILE, ">$error_file") or die "Opening destination file '$error_file': $!";
-print ERROR_FILE $error_format;
-close(ERROR_FILE);
diff --git a/extmod/mbedtls_errors/generate_errors_orig.pl b/extmod/mbedtls_errors/generate_errors_orig.pl
deleted file mode 100755
index 0c1f7e16ece5d..0000000000000
--- a/extmod/mbedtls_errors/generate_errors_orig.pl
+++ /dev/null
@@ -1,207 +0,0 @@
-#!/usr/bin/env perl
-
-# Generate error.c
-#
-# Usage: ./generate_errors.pl or scripts/generate_errors.pl without arguments,
-# or generate_errors.pl include_dir data_dir error_file
-
-use strict;
-
-my ($include_dir, $data_dir, $error_file);
-
-if( @ARGV ) {
-    die "Invalid number of arguments" if scalar @ARGV != 3;
-    ($include_dir, $data_dir, $error_file) = @ARGV;
-
-    -d $include_dir or die "No such directory: $include_dir\n";
-    -d $data_dir or die "No such directory: $data_dir\n";
-} else {
-    $include_dir = 'include/mbedtls';
-    $data_dir = 'scripts/data_files';
-    $error_file = 'library/error.c';
-
-    unless( -d $include_dir && -d $data_dir ) {
-        chdir '..' or die;
-        -d $include_dir && -d $data_dir
-            or die "Without arguments, must be run from root or scripts\n"
-    }
-}
-
-my $error_format_file = $data_dir.'/error.fmt';
-
-my @low_level_modules = qw( AES ARC4 ARIA ASN1 BASE64 BIGNUM BLOWFISH
-                            CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
-                            ENTROPY GCM HKDF HMAC_DRBG MD2 MD4 MD5
-                            NET OID PADLOCK PBKDF2 PLATFORM POLY1305 RIPEMD160
-                            SHA1 SHA256 SHA512 THREADING XTEA );
-my @high_level_modules = qw( CIPHER DHM ECP MD
-                             PEM PK PKCS12 PKCS5
-                             RSA SSL X509 );
-
-my $line_separator = $/;
-undef $/;
-
-open(FORMAT_FILE, "$error_format_file") or die "Opening error format file '$error_format_file': $!";
-my $error_format = <FORMAT_FILE>;
-close(FORMAT_FILE);
-
-$/ = $line_separator;
-
-my @files = <$include_dir/*.h>;
-my @matches;
-foreach my $file (@files) {
-    open(FILE, "$file");
-    my @grep_res = grep(/^\s*#define\s+MBEDTLS_ERR_\w+\s+\-0x[0-9A-Fa-f]+/, <FILE>);
-    push(@matches, @grep_res);
-    close FILE;
-}
-
-my $ll_old_define = "";
-my $hl_old_define = "";
-
-my $ll_code_check = "";
-my $hl_code_check = "";
-
-my $headers = "";
-
-my %error_codes_seen;
-
-
-foreach my $line (@matches)
-{
-    next if ($line =~ /compat-1.2.h/);
-    my ($error_name, $error_code) = $line =~ /(MBEDTLS_ERR_\w+)\s+\-(0x\w+)/;
-    my ($description) = $line =~ /\/\*\*< (.*?)\.? \*\//;
-
-    die "Duplicated error code: $error_code ($error_name)\n"
-        if( $error_codes_seen{$error_code}++ );
-
-    $description =~ s/\\/\\\\/g;
-    if ($description eq "") {
-        $description = "DESCRIPTION MISSING";
-        warn "Missing description for $error_name\n";
-    }
-
-    my ($module_name) = $error_name =~ /^MBEDTLS_ERR_([^_]+)/;
-
-    # Fix faulty ones
-    $module_name = "BIGNUM" if ($module_name eq "MPI");
-    $module_name = "CTR_DRBG" if ($module_name eq "CTR");
-    $module_name = "HMAC_DRBG" if ($module_name eq "HMAC");
-
-    my $define_name = $module_name;
-    $define_name = "X509_USE,X509_CREATE" if ($define_name eq "X509");
-    $define_name = "ASN1_PARSE" if ($define_name eq "ASN1");
-    $define_name = "SSL_TLS" if ($define_name eq "SSL");
-    $define_name = "PEM_PARSE,PEM_WRITE" if ($define_name eq "PEM");
-
-    my $include_name = $module_name;
-    $include_name =~ tr/A-Z/a-z/;
-    $include_name = "" if ($include_name eq "asn1");
-
-    # Fix faulty ones
-    $include_name = "net_sockets" if ($module_name eq "NET");
-
-    my $found_ll = grep $_ eq $module_name, @low_level_modules;
-    my $found_hl = grep $_ eq $module_name, @high_level_modules;
-    if (!$found_ll && !$found_hl)
-    {
-        printf("Error: Do not know how to handle: $module_name\n");
-        exit 1;
-    }
-
-    my $code_check;
-    my $old_define;
-    my $white_space;
-    my $first;
-
-    if ($found_ll)
-    {
-        $code_check = \$ll_code_check;
-        $old_define = \$ll_old_define;
-        $white_space = '    ';
-    }
-    else
-    {
-        $code_check = \$hl_code_check;
-        $old_define = \$hl_old_define;
-        $white_space = '        ';
-    }
-
-    if ($define_name ne ${$old_define})
-    {
-        if (${$old_define} ne "")
-        {
-            ${$code_check} .= "#endif /* ";
-            $first = 0;
-            foreach my $dep (split(/,/, ${$old_define}))
-            {
-                ${$code_check} .= " || " if ($first++);
-                ${$code_check} .= "MBEDTLS_${dep}_C";
-            }
-            ${$code_check} .= " */\n\n";
-        }
-
-        ${$code_check} .= "#if ";
-        $headers .= "#if " if ($include_name ne "");
-        $first = 0;
-        foreach my $dep (split(/,/, ${define_name}))
-        {
-            ${$code_check} .= " || " if ($first);
-            $headers       .= " || " if ($first++);
-
-            ${$code_check} .= "defined(MBEDTLS_${dep}_C)";
-            $headers       .= "defined(MBEDTLS_${dep}_C)" if
-                                                    ($include_name ne "");
-        }
-        ${$code_check} .= "\n";
-        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
-                    "#endif\n\n" if ($include_name ne "");
-        ${$old_define} = $define_name;
-    }
-
-    if ($error_name eq "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE")
-    {
-        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
-                          "${white_space}\{\n".
-                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n".
-                          "${white_space}    return;\n".
-                          "${white_space}}\n"
-    }
-    else
-    {
-        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
-                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n"
-    }
-};
-
-if ($ll_old_define ne "")
-{
-    $ll_code_check .= "#endif /* ";
-    my $first = 0;
-    foreach my $dep (split(/,/, $ll_old_define))
-    {
-        $ll_code_check .= " || " if ($first++);
-        $ll_code_check .= "MBEDTLS_${dep}_C";
-    }
-    $ll_code_check .= " */\n";
-}
-if ($hl_old_define ne "")
-{
-    $hl_code_check .= "#endif /* ";
-    my $first = 0;
-    foreach my $dep (split(/,/, $hl_old_define))
-    {
-        $hl_code_check .= " || " if ($first++);
-        $hl_code_check .= "MBEDTLS_${dep}_C";
-    }
-    $hl_code_check .= " */\n";
-}
-
-$error_format =~ s/HEADER_INCLUDED\n/$headers/g;
-$error_format =~ s/LOW_LEVEL_CODE_CHECKS\n/$ll_code_check/g;
-$error_format =~ s/HIGH_LEVEL_CODE_CHECKS\n/$hl_code_check/g;
-
-open(ERROR_FILE, ">$error_file") or die "Opening destination file '$error_file': $!";
-print ERROR_FILE $error_format;
-close(ERROR_FILE);
diff --git a/extmod/mbedtls_errors/README.md b/lib/mbedtls_errors/README.md
similarity index 59%
rename from extmod/mbedtls_errors/README.md
rename to lib/mbedtls_errors/README.md
index 6772b2b10609b..792fe20b64a85 100644
--- a/extmod/mbedtls_errors/README.md
+++ b/lib/mbedtls_errors/README.md
@@ -4,25 +4,27 @@ MBEDTLS Error Strings for MicroPython
 This directory contains source code and tools to rework the Mbedtls error strings for
 micropython to use less space. In short, instead of storing and printing something like
 "SSL - Our own certificate(s) is/are too large to send in an SSL message" it prints
-the name of the error #define, which would be `MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE` in
+the name of the error #define, which would be "MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE" in
 this case, and only stores `SSL_CERTIFICATE_TOO_LARGE` in flash. The exact Mbedtls error
 defines are used because they're easy to search for to find more detailed information.
 
-Mbedtls defines a specific format for error values and
+Mbedtls defines a specific format for error value #defines and
 includes a Perl script to gather all `MBEDTLS_ERR` defines from includes files together with
 english error text. From that the Perl script generates `mbedtls_strerror()`. The files in this
 directory modify this process to produce a more space efficient error lookup table with
-shorter error strings. The files are as follows:
-- `generate_errors_orig.pl` - original mbedtls perl script, copied here for reference
-- `error_orig.fmt` - original mbedtls code template input to perl script
-- `generate_errors.pl` - modified perl script for MicroPython
+shorter error strings. Since the esp32 port uses Mbedtls from the ESP-IDF source while other ports
+use the Mbedtls version in the MicroPython source there are two different versions of files.
+The files are as follows:
+- `generate_errors.diff` - diff for original mbedtls perl script
+- `esp32_generate_errors.pl` - perl script with above diff applied, for esp32
+- `mp_generate_errors.pl` - perl script with above diff applied, for other ports
 - `error.fmt` - modified code template for MicroPython
 - `esp32_mbedtls_errors.c` - source file with `mbedtls_strerror` for Esp32, this is built
   using the include files in ESP-IDF's version of mbedtls
 - `do-esp32.sh` - shell script to produce `esp32_mbedtls_errors.c` -- note that as of v4.0
   and v3.3.2 ESP-IDF uses the same version of mbedtls
 - `mp_mbedtls_errors.c` - source file with `mbedtls_strerror` for ports using MicroPython's
-  version of mbedtls, this is built using the include files in `$MPY/lib/mbedtls`
+  version of mbedtls, this is built using the include files in `../mbedtls`
 - `do-mp.sh` - shell script to produce `mp_mbedtls_errors.c`
 - `tester.c` - simple C main to test `mp_mbedtls_errors.c` locally on a dev box
 - `do-test.sh` - shell script to produce `mp_mbedtls_errors.c` and compile the `tester` app
@@ -32,13 +34,12 @@ shorter error strings. The files are as follows:
 - To build MicroPython all that is needed is to include the `xx_mbedtls_errors.c` into the build
   (the Makefiles do this automatically). Note that Perl is not needed for routine MicroPython
   builds.
-- When a new version of Mbedtls is pulled-in the appropriate `do_` script(s) should be run and
-  a diff using the `_orig` files can show whether Mbedtls changed something in the error
-  formatting.
-- The `tester` app doesn't need to be run unless changes to the string handling in `error.fmt`
-  are made: it really just tests that there is not an off-by-one error in the string
-  copying/appending, etc.
-- To include/exclude `mbedtls_strerror` error strings in a specific MicroPython build use the
-  `??` macro. Excluding causes `mbedtls_strerror` to produce a string with the raw error code.
-  On the esp32, define/undefine `MBEDTLS_ERROR_C` in the ESP-IDF
-  `components/mbedtls/port/include/mbedtls/esp_config.h`.
+- When a new version of Mbedtls is pulled-in the appropriate `do_` script(s) should be run to
+  re-generate `esp32_mbedtls_errors.c` and/or `mp_mbedtls_errors.c`.
+- The `tester` app should be run if changes to the string handling in `error.fmt` are made:
+  it tests that there is not an off-by-one error in the string copying/appending, etc.
+- To include `mbedtls_strerror` error strings in a specific MicroPython build use
+  `MICROPY_SSL_MBEDTLS_ERRSTR=1`. By default `mbedtls_strerror` produces a string with the raw
+  error code and no text message.
+  On the esp32, define `MBEDTLS_ERROR_C` in the ESP-IDF
+  `components/mbedtls/port/include/mbedtls/esp_config.h` (this is the ESP-IDF default).
diff --git a/lib/mbedtls_errors/do-esp32.sh b/lib/mbedtls_errors/do-esp32.sh
new file mode 100755
index 0000000000000..6fd4682415c3f
--- /dev/null
+++ b/lib/mbedtls_errors/do-esp32.sh
@@ -0,0 +1,7 @@
+#! /bin/bash -e
+# Generate esp32_mbedtls_errors.c for use in the Esp32 port, with the ESP-IDF version of mbedtls
+# The IDF_PATH env var must be set to the top-level dir of ESPIDF
+echo "IDF_PATH=$IDF_PATH"
+MBEDTLS=$IDF_PATH/components/mbedtls/mbedtls
+patch -o esp32_generate_errors.pl $MBEDTLS/scripts/generate_errors.pl <generate_errors.diff
+perl ./esp32_generate_errors.pl $MBEDTLS/include/mbedtls . esp32_mbedtls_errors.c
diff --git a/lib/mbedtls_errors/do-mp.sh b/lib/mbedtls_errors/do-mp.sh
new file mode 100755
index 0000000000000..5c6b971179479
--- /dev/null
+++ b/lib/mbedtls_errors/do-mp.sh
@@ -0,0 +1,4 @@
+#! /bin/bash -e
+# Generate mp_mbedtls_errors.c for inclusion in ports that use $MPY/lib/mbedtls
+patch -o mp_generate_errors.pl ../mbedtls/scripts/generate_errors.pl <generate_errors.diff
+perl ./mp_generate_errors.pl ../mbedtls/include/mbedtls . mp_mbedtls_errors.c
diff --git a/extmod/mbedtls_errors/do-test.sh b/lib/mbedtls_errors/do-test.sh
similarity index 51%
rename from extmod/mbedtls_errors/do-test.sh
rename to lib/mbedtls_errors/do-test.sh
index d5b405b8e04f1..c15d038c76b41 100755
--- a/extmod/mbedtls_errors/do-test.sh
+++ b/lib/mbedtls_errors/do-test.sh
@@ -1,4 +1,4 @@
 #! /bin/bash -e
 # Generate mp_mbedtls_errors.c and build the tester app
 ./do-mp.sh
-cc -o tester -I../../lib/mbedtls/include/mbedtls/ mp_mbedtls_errors.c tester.c
+cc -o tester -I../mbedtls/include/ mp_mbedtls_errors.c tester.c
diff --git a/extmod/mbedtls_errors/error.fmt b/lib/mbedtls_errors/error.fmt
similarity index 100%
rename from extmod/mbedtls_errors/error.fmt
rename to lib/mbedtls_errors/error.fmt
diff --git a/extmod/mbedtls_errors/mp_mbedtls_errors.c b/lib/mbedtls_errors/esp32_mbedtls_errors.c
similarity index 100%
rename from extmod/mbedtls_errors/mp_mbedtls_errors.c
rename to lib/mbedtls_errors/esp32_mbedtls_errors.c
diff --git a/lib/mbedtls_errors/generate_errors.diff b/lib/mbedtls_errors/generate_errors.diff
new file mode 100644
index 0000000000000..ad24c372faed7
--- /dev/null
+++ b/lib/mbedtls_errors/generate_errors.diff
@@ -0,0 +1,22 @@
+--- generate_errors_orig.pl	2020-06-20 08:40:38.819060379 -0700
++++ generate_errors.pl	2020-06-20 08:47:26.511163591 -0700
+@@ -162,16 +162,12 @@
+ 
+     if ($error_name eq "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE")
+     {
+-        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+-                          "${white_space}\{\n".
+-                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n".
+-                          "${white_space}    return;\n".
+-                          "${white_space}}\n"
++        # no-op, this case is hard-coded in error.fmt
+     }
+     else
+     {
+-        ${$code_check} .= "${white_space}if( use_ret == -($error_name) )\n".
+-                          "${white_space}    mbedtls_snprintf( buf, buflen, \"$module_name - $description\" );\n"
++         my $error_text = $error_name =~ s/^MBEDTLS_ERR_//r;
++         ${$code_check} .= "${white_space}{ -($error_name), \"$error_text\" },\n"
+     }
+ };
+ 
diff --git a/extmod/mbedtls_errors/esp32_mbedtls_errors.c b/lib/mbedtls_errors/mp_mbedtls_errors.c
similarity index 99%
rename from extmod/mbedtls_errors/esp32_mbedtls_errors.c
rename to lib/mbedtls_errors/mp_mbedtls_errors.c
index 386ca5fa28c21..03a91f0dc9495 100644
--- a/extmod/mbedtls_errors/esp32_mbedtls_errors.c
+++ b/lib/mbedtls_errors/mp_mbedtls_errors.c
@@ -627,7 +627,7 @@ static size_t mbedtls_err_to_str(int err, const struct ssl_errs tab[], int tab_l
         }
     }
 
-    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (%04X)",
+    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (0x%04X)",
             err);
     return strlen(buf);
 }
diff --git a/extmod/mbedtls_errors/tester.c b/lib/mbedtls_errors/tester.c
similarity index 100%
rename from extmod/mbedtls_errors/tester.c
rename to lib/mbedtls_errors/tester.c
diff --git a/ports/esp32/Makefile b/ports/esp32/Makefile
index a2aafeef652ac..6cd2a9bc74068 100644
--- a/ports/esp32/Makefile
+++ b/ports/esp32/Makefile
@@ -359,10 +359,10 @@ SRC_C = \
 
 EXTMOD_SRC_C += $(addprefix extmod/,\
 	modonewire.c \
-	mbedtls_errors/esp32_mbedtls_errors.c \
 	)
 
 LIB_SRC_C = $(addprefix lib/,\
+	mbedtls_errors/esp32_mbedtls_errors.c \
 	mp-readline/readline.c \
 	netutils/netutils.c \
 	timeutils/timeutils.c \
@@ -507,7 +507,7 @@ ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*/*.c) \
 	)
 
-# Mbedtls source files, exclude error.c in favor of extmod/mbedtls_errors/esp32_mbedtls_errors.c
+# Mbedtls source files, exclude error.c in favor of lib/mbedtls_errors/esp32_mbedtls_errors.c
 ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o, $(filter-out %/error.c,\
 	$(wildcard $(ESPCOMP)/mbedtls/mbedtls/library/*.c) \
 	$(wildcard $(ESPCOMP)/mbedtls/port/*.c) \
diff --git a/ports/stm32/Makefile b/ports/stm32/Makefile
index 0c9e4ef90b18d..b471c5dd2150a 100644
--- a/ports/stm32/Makefile
+++ b/ports/stm32/Makefile
@@ -476,7 +476,7 @@ ifeq ($(MICROPY_SSL_MBEDTLS_ERRSTR),1)
 CFLAGS_MOD += -DMBEDTLS_ERROR_C=1
 # replace mbedtls' error.c by ours
 SRC_MOD := $(filter-out %/mbedtls/library/error.c, $(SRC_MOD))
-EXTMOD_SRC_C += extmod/mbedtls_errors/mp_mbedtls_errors.c
+EXTMOD_SRC_C += lib/mbedtls_errors/mp_mbedtls_errors.c
 endif
 endif
 
diff --git a/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk b/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
index e794092d5cf28..ead8bb8c07cf3 100644
--- a/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
+++ b/ports/stm32/boards/PYBD_SF2/mpconfigboard.mk
@@ -17,7 +17,6 @@ MICROPY_PY_LWIP = 1
 MICROPY_PY_NETWORK_CYW43 = 1
 MICROPY_PY_USSL = 1
 MICROPY_SSL_MBEDTLS = 1
-MICROPY_SSL_MBEDTLS_ERRSTR = 1
 MICROPY_VFS_LFS2 = 1
 
 # PYBD-specific frozen modules
diff --git a/ports/stm32/mbedtls/mbedtls_config.h b/ports/stm32/mbedtls/mbedtls_config.h
index 338c8b354146b..56fbbf3aaf086 100644
--- a/ports/stm32/mbedtls/mbedtls_config.h
+++ b/ports/stm32/mbedtls/mbedtls_config.h
@@ -67,6 +67,7 @@
 #define MBEDTLS_CTR_DRBG_C
 //#define MBEDTLS_ECP_C
 #define MBEDTLS_ENTROPY_C
+#define MBEDTLS_ERROR_C
 #define MBEDTLS_MD_C
 #define MBEDTLS_MD5_C
 #define MBEDTLS_OID_C

From 90c7b21c3772cbe9a86bda1b03a5e5a6bb4c87d9 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Thu, 2 Jul 2020 12:33:07 -0700
Subject: [PATCH 08/10] remove esp32_mbedtls_errors.c

---
 lib/mbedtls_errors/README.md              |  33 +-
 lib/mbedtls_errors/esp32_mbedtls_errors.c | 705 ----------------------
 ports/esp32/Makefile                      |   4 +-
 tools/codeformat.py                       |   1 +
 4 files changed, 18 insertions(+), 725 deletions(-)
 delete mode 100644 lib/mbedtls_errors/esp32_mbedtls_errors.c

diff --git a/lib/mbedtls_errors/README.md b/lib/mbedtls_errors/README.md
index 792fe20b64a85..0e13021eb1910 100644
--- a/lib/mbedtls_errors/README.md
+++ b/lib/mbedtls_errors/README.md
@@ -12,34 +12,31 @@ Mbedtls defines a specific format for error value #defines and
 includes a Perl script to gather all `MBEDTLS_ERR` defines from includes files together with
 english error text. From that the Perl script generates `mbedtls_strerror()`. The files in this
 directory modify this process to produce a more space efficient error lookup table with
-shorter error strings. Since the esp32 port uses Mbedtls from the ESP-IDF source while other ports
-use the Mbedtls version in the MicroPython source there are two different versions of files.
+shorter error strings.
+
 The files are as follows:
 - `generate_errors.diff` - diff for original mbedtls perl script
-- `esp32_generate_errors.pl` - perl script with above diff applied, for esp32
-- `mp_generate_errors.pl` - perl script with above diff applied, for other ports
 - `error.fmt` - modified code template for MicroPython
-- `esp32_mbedtls_errors.c` - source file with `mbedtls_strerror` for Esp32, this is built
-  using the include files in ESP-IDF's version of mbedtls
-- `do-esp32.sh` - shell script to produce `esp32_mbedtls_errors.c` -- note that as of v4.0
-  and v3.3.2 ESP-IDF uses the same version of mbedtls
-- `mp_mbedtls_errors.c` - source file with `mbedtls_strerror` for ports using MicroPython's
-  version of mbedtls, this is built using the include files in `../mbedtls`
+- `mp_mbedtls_errors.c` - source file with `mbedtls_strerror` this is built using the include
+  files in `../mbedtls`
 - `do-mp.sh` - shell script to produce `mp_mbedtls_errors.c`
 - `tester.c` - simple C main to test `mp_mbedtls_errors.c` locally on a dev box
 - `do-test.sh` - shell script to produce `mp_mbedtls_errors.c` and compile the `tester` app
+- `do-esp32.sh` - shell script to produce `esp32_mbedtls_errors.c` -- see below
+
+In order not to store multiple copies of `mbedtls_errors.c`
+([https://github.com/micropython/micropython/pull/5819#discussion_r445528006](see))
+it is assumed that all ports use the same version of mbedtls with the same error #defines.
+This is true as of MP v1.13, and ESP-IDF versions 3.3.2 and 4.0.1. If anything changes in the
+future the `do-esp32.sh` script can be used to generate an esp32-specific version.
 
 ### How-to
 
-- To build MicroPython all that is needed is to include the `xx_mbedtls_errors.c` into the build
+- To build MicroPython all that is needed is to include the `mp_mbedtls_errors.c` into the build
   (the Makefiles do this automatically). Note that Perl is not needed for routine MicroPython
   builds.
-- When a new version of Mbedtls is pulled-in the appropriate `do_` script(s) should be run to
-  re-generate `esp32_mbedtls_errors.c` and/or `mp_mbedtls_errors.c`.
+- When a new version of Mbedtls is pulled-in the `do-mp.sh` script should be run to
+  re-generate `mp_mbedtls_errors.c`.
 - The `tester` app should be run if changes to the string handling in `error.fmt` are made:
   it tests that there is not an off-by-one error in the string copying/appending, etc.
-- To include `mbedtls_strerror` error strings in a specific MicroPython build use
-  `MICROPY_SSL_MBEDTLS_ERRSTR=1`. By default `mbedtls_strerror` produces a string with the raw
-  error code and no text message.
-  On the esp32, define `MBEDTLS_ERROR_C` in the ESP-IDF
-  `components/mbedtls/port/include/mbedtls/esp_config.h` (this is the ESP-IDF default).
+- To include `mbedtls_strerror` error strings define `MBEDTLS_ERROR_C` in the build.
diff --git a/lib/mbedtls_errors/esp32_mbedtls_errors.c b/lib/mbedtls_errors/esp32_mbedtls_errors.c
deleted file mode 100644
index 03a91f0dc9495..0000000000000
--- a/lib/mbedtls_errors/esp32_mbedtls_errors.c
+++ /dev/null
@@ -1,705 +0,0 @@
-/*
- *  Error message information
- *
- *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
- *  SPDX-License-Identifier: Apache-2.0
- *
- *  Licensed under the Apache License, Version 2.0 (the "License"); you may
- *  not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- */
-
-#if !defined(MBEDTLS_CONFIG_FILE)
-#include "mbedtls/config.h"
-#else
-#include MBEDTLS_CONFIG_FILE
-#endif
-
-#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY)
-#include "mbedtls/error.h"
-#include <string.h>
-#endif
-
-#if defined(MBEDTLS_PLATFORM_C)
-#include "mbedtls/platform.h"
-#else
-#define mbedtls_snprintf snprintf
-#define mbedtls_time_t   time_t
-#endif
-
-#if defined(MBEDTLS_ERROR_C)
-
-#include <stdio.h>
-
-#if defined(MBEDTLS_AES_C)
-#include "mbedtls/aes.h"
-#endif
-
-#if defined(MBEDTLS_ARC4_C)
-#include "mbedtls/arc4.h"
-#endif
-
-#if defined(MBEDTLS_ARIA_C)
-#include "mbedtls/aria.h"
-#endif
-
-#if defined(MBEDTLS_BASE64_C)
-#include "mbedtls/base64.h"
-#endif
-
-#if defined(MBEDTLS_BIGNUM_C)
-#include "mbedtls/bignum.h"
-#endif
-
-#if defined(MBEDTLS_BLOWFISH_C)
-#include "mbedtls/blowfish.h"
-#endif
-
-#if defined(MBEDTLS_CAMELLIA_C)
-#include "mbedtls/camellia.h"
-#endif
-
-#if defined(MBEDTLS_CCM_C)
-#include "mbedtls/ccm.h"
-#endif
-
-#if defined(MBEDTLS_CHACHA20_C)
-#include "mbedtls/chacha20.h"
-#endif
-
-#if defined(MBEDTLS_CHACHAPOLY_C)
-#include "mbedtls/chachapoly.h"
-#endif
-
-#if defined(MBEDTLS_CIPHER_C)
-#include "mbedtls/cipher.h"
-#endif
-
-#if defined(MBEDTLS_CMAC_C)
-#include "mbedtls/cmac.h"
-#endif
-
-#if defined(MBEDTLS_CTR_DRBG_C)
-#include "mbedtls/ctr_drbg.h"
-#endif
-
-#if defined(MBEDTLS_DES_C)
-#include "mbedtls/des.h"
-#endif
-
-#if defined(MBEDTLS_DHM_C)
-#include "mbedtls/dhm.h"
-#endif
-
-#if defined(MBEDTLS_ECP_C)
-#include "mbedtls/ecp.h"
-#endif
-
-#if defined(MBEDTLS_ENTROPY_C)
-#include "mbedtls/entropy.h"
-#endif
-
-#if defined(MBEDTLS_GCM_C)
-#include "mbedtls/gcm.h"
-#endif
-
-#if defined(MBEDTLS_HKDF_C)
-#include "mbedtls/hkdf.h"
-#endif
-
-#if defined(MBEDTLS_HMAC_DRBG_C)
-#include "mbedtls/hmac_drbg.h"
-#endif
-
-#if defined(MBEDTLS_MD_C)
-#include "mbedtls/md.h"
-#endif
-
-#if defined(MBEDTLS_MD2_C)
-#include "mbedtls/md2.h"
-#endif
-
-#if defined(MBEDTLS_MD4_C)
-#include "mbedtls/md4.h"
-#endif
-
-#if defined(MBEDTLS_MD5_C)
-#include "mbedtls/md5.h"
-#endif
-
-#if defined(MBEDTLS_NET_C)
-#include "mbedtls/net_sockets.h"
-#endif
-
-#if defined(MBEDTLS_OID_C)
-#include "mbedtls/oid.h"
-#endif
-
-#if defined(MBEDTLS_PADLOCK_C)
-#include "mbedtls/padlock.h"
-#endif
-
-#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
-#include "mbedtls/pem.h"
-#endif
-
-#if defined(MBEDTLS_PK_C)
-#include "mbedtls/pk.h"
-#endif
-
-#if defined(MBEDTLS_PKCS12_C)
-#include "mbedtls/pkcs12.h"
-#endif
-
-#if defined(MBEDTLS_PKCS5_C)
-#include "mbedtls/pkcs5.h"
-#endif
-
-#if defined(MBEDTLS_PLATFORM_C)
-#include "mbedtls/platform.h"
-#endif
-
-#if defined(MBEDTLS_POLY1305_C)
-#include "mbedtls/poly1305.h"
-#endif
-
-#if defined(MBEDTLS_RIPEMD160_C)
-#include "mbedtls/ripemd160.h"
-#endif
-
-#if defined(MBEDTLS_RSA_C)
-#include "mbedtls/rsa.h"
-#endif
-
-#if defined(MBEDTLS_SHA1_C)
-#include "mbedtls/sha1.h"
-#endif
-
-#if defined(MBEDTLS_SHA256_C)
-#include "mbedtls/sha256.h"
-#endif
-
-#if defined(MBEDTLS_SHA512_C)
-#include "mbedtls/sha512.h"
-#endif
-
-#if defined(MBEDTLS_SSL_TLS_C)
-#include "mbedtls/ssl.h"
-#endif
-
-#if defined(MBEDTLS_THREADING_C)
-#include "mbedtls/threading.h"
-#endif
-
-#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
-#include "mbedtls/x509.h"
-#endif
-
-#if defined(MBEDTLS_XTEA_C)
-#include "mbedtls/xtea.h"
-#endif
-
-
-// Error code table type
-struct ssl_errs {
-    int16_t errnum;
-    const char *errstr;
-};
-
-// Table of high level error codes
-static const struct ssl_errs mbedtls_high_level_error_tab[] = {
-// BEGIN generated code
-#if defined(MBEDTLS_CIPHER_C)
-        { -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE), "CIPHER_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA), "CIPHER_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_CIPHER_ALLOC_FAILED), "CIPHER_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_CIPHER_INVALID_PADDING), "CIPHER_INVALID_PADDING" },
-        { -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED), "CIPHER_FULL_BLOCK_EXPECTED" },
-        { -(MBEDTLS_ERR_CIPHER_AUTH_FAILED), "CIPHER_AUTH_FAILED" },
-        { -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT), "CIPHER_INVALID_CONTEXT" },
-        { -(MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED), "CIPHER_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_CIPHER_C */
-
-#if defined(MBEDTLS_DHM_C)
-        { -(MBEDTLS_ERR_DHM_BAD_INPUT_DATA), "DHM_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_DHM_READ_PARAMS_FAILED), "DHM_READ_PARAMS_FAILED" },
-        { -(MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED), "DHM_MAKE_PARAMS_FAILED" },
-        { -(MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED), "DHM_READ_PUBLIC_FAILED" },
-        { -(MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED), "DHM_MAKE_PUBLIC_FAILED" },
-        { -(MBEDTLS_ERR_DHM_CALC_SECRET_FAILED), "DHM_CALC_SECRET_FAILED" },
-        { -(MBEDTLS_ERR_DHM_INVALID_FORMAT), "DHM_INVALID_FORMAT" },
-        { -(MBEDTLS_ERR_DHM_ALLOC_FAILED), "DHM_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_DHM_FILE_IO_ERROR), "DHM_FILE_IO_ERROR" },
-        { -(MBEDTLS_ERR_DHM_HW_ACCEL_FAILED), "DHM_HW_ACCEL_FAILED" },
-        { -(MBEDTLS_ERR_DHM_SET_GROUP_FAILED), "DHM_SET_GROUP_FAILED" },
-#endif /* MBEDTLS_DHM_C */
-
-#if defined(MBEDTLS_ECP_C)
-        { -(MBEDTLS_ERR_ECP_BAD_INPUT_DATA), "ECP_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL), "ECP_BUFFER_TOO_SMALL" },
-        { -(MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE), "ECP_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_ECP_VERIFY_FAILED), "ECP_VERIFY_FAILED" },
-        { -(MBEDTLS_ERR_ECP_ALLOC_FAILED), "ECP_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_ECP_RANDOM_FAILED), "ECP_RANDOM_FAILED" },
-        { -(MBEDTLS_ERR_ECP_INVALID_KEY), "ECP_INVALID_KEY" },
-        { -(MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH), "ECP_SIG_LEN_MISMATCH" },
-        { -(MBEDTLS_ERR_ECP_HW_ACCEL_FAILED), "ECP_HW_ACCEL_FAILED" },
-        { -(MBEDTLS_ERR_ECP_IN_PROGRESS), "ECP_IN_PROGRESS" },
-#endif /* MBEDTLS_ECP_C */
-
-#if defined(MBEDTLS_MD_C)
-        { -(MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE), "MD_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_MD_BAD_INPUT_DATA), "MD_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_MD_ALLOC_FAILED), "MD_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_MD_FILE_IO_ERROR), "MD_FILE_IO_ERROR" },
-        { -(MBEDTLS_ERR_MD_HW_ACCEL_FAILED), "MD_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_MD_C */
-
-#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C)
-        { -(MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT), "PEM_NO_HEADER_FOOTER_PRESENT" },
-        { -(MBEDTLS_ERR_PEM_INVALID_DATA), "PEM_INVALID_DATA" },
-        { -(MBEDTLS_ERR_PEM_ALLOC_FAILED), "PEM_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_PEM_INVALID_ENC_IV), "PEM_INVALID_ENC_IV" },
-        { -(MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG), "PEM_UNKNOWN_ENC_ALG" },
-        { -(MBEDTLS_ERR_PEM_PASSWORD_REQUIRED), "PEM_PASSWORD_REQUIRED" },
-        { -(MBEDTLS_ERR_PEM_PASSWORD_MISMATCH), "PEM_PASSWORD_MISMATCH" },
-        { -(MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE), "PEM_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_PEM_BAD_INPUT_DATA), "PEM_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
-
-#if defined(MBEDTLS_PK_C)
-        { -(MBEDTLS_ERR_PK_ALLOC_FAILED), "PK_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_PK_TYPE_MISMATCH), "PK_TYPE_MISMATCH" },
-        { -(MBEDTLS_ERR_PK_BAD_INPUT_DATA), "PK_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_PK_FILE_IO_ERROR), "PK_FILE_IO_ERROR" },
-        { -(MBEDTLS_ERR_PK_KEY_INVALID_VERSION), "PK_KEY_INVALID_VERSION" },
-        { -(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT), "PK_KEY_INVALID_FORMAT" },
-        { -(MBEDTLS_ERR_PK_UNKNOWN_PK_ALG), "PK_UNKNOWN_PK_ALG" },
-        { -(MBEDTLS_ERR_PK_PASSWORD_REQUIRED), "PK_PASSWORD_REQUIRED" },
-        { -(MBEDTLS_ERR_PK_PASSWORD_MISMATCH), "PK_PASSWORD_MISMATCH" },
-        { -(MBEDTLS_ERR_PK_INVALID_PUBKEY), "PK_INVALID_PUBKEY" },
-        { -(MBEDTLS_ERR_PK_INVALID_ALG), "PK_INVALID_ALG" },
-        { -(MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE), "PK_UNKNOWN_NAMED_CURVE" },
-        { -(MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE), "PK_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_PK_SIG_LEN_MISMATCH), "PK_SIG_LEN_MISMATCH" },
-        { -(MBEDTLS_ERR_PK_HW_ACCEL_FAILED), "PK_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_PK_C */
-
-#if defined(MBEDTLS_PKCS12_C)
-        { -(MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA), "PKCS12_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE), "PKCS12_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT), "PKCS12_PBE_INVALID_FORMAT" },
-        { -(MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH), "PKCS12_PASSWORD_MISMATCH" },
-#endif /* MBEDTLS_PKCS12_C */
-
-#if defined(MBEDTLS_PKCS5_C)
-        { -(MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA), "PKCS5_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT), "PKCS5_INVALID_FORMAT" },
-        { -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE), "PKCS5_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH), "PKCS5_PASSWORD_MISMATCH" },
-#endif /* MBEDTLS_PKCS5_C */
-
-#if defined(MBEDTLS_RSA_C)
-        { -(MBEDTLS_ERR_RSA_BAD_INPUT_DATA), "RSA_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_RSA_INVALID_PADDING), "RSA_INVALID_PADDING" },
-        { -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED), "RSA_KEY_GEN_FAILED" },
-        { -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED), "RSA_KEY_CHECK_FAILED" },
-        { -(MBEDTLS_ERR_RSA_PUBLIC_FAILED), "RSA_PUBLIC_FAILED" },
-        { -(MBEDTLS_ERR_RSA_PRIVATE_FAILED), "RSA_PRIVATE_FAILED" },
-        { -(MBEDTLS_ERR_RSA_VERIFY_FAILED), "RSA_VERIFY_FAILED" },
-        { -(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE), "RSA_OUTPUT_TOO_LARGE" },
-        { -(MBEDTLS_ERR_RSA_RNG_FAILED), "RSA_RNG_FAILED" },
-        { -(MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION), "RSA_UNSUPPORTED_OPERATION" },
-        { -(MBEDTLS_ERR_RSA_HW_ACCEL_FAILED), "RSA_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_RSA_C */
-
-#if defined(MBEDTLS_SSL_TLS_C)
-        { -(MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE), "SSL_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_SSL_BAD_INPUT_DATA), "SSL_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_SSL_INVALID_MAC), "SSL_INVALID_MAC" },
-        { -(MBEDTLS_ERR_SSL_INVALID_RECORD), "SSL_INVALID_RECORD" },
-        { -(MBEDTLS_ERR_SSL_CONN_EOF), "SSL_CONN_EOF" },
-        { -(MBEDTLS_ERR_SSL_UNKNOWN_CIPHER), "SSL_UNKNOWN_CIPHER" },
-        { -(MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN), "SSL_NO_CIPHER_CHOSEN" },
-        { -(MBEDTLS_ERR_SSL_NO_RNG), "SSL_NO_RNG" },
-        { -(MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE), "SSL_NO_CLIENT_CERTIFICATE" },
-        { -(MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE), "SSL_CERTIFICATE_TOO_LARGE" },
-        { -(MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED), "SSL_CERTIFICATE_REQUIRED" },
-        { -(MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED), "SSL_PRIVATE_KEY_REQUIRED" },
-        { -(MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED), "SSL_CA_CHAIN_REQUIRED" },
-        { -(MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE), "SSL_UNEXPECTED_MESSAGE" },
-        { -(MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED), "SSL_PEER_VERIFY_FAILED" },
-        { -(MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY), "SSL_PEER_CLOSE_NOTIFY" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO), "SSL_BAD_HS_CLIENT_HELLO" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO), "SSL_BAD_HS_SERVER_HELLO" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE), "SSL_BAD_HS_CERTIFICATE" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST), "SSL_BAD_HS_CERTIFICATE_REQUEST" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE), "SSL_BAD_HS_SERVER_KEY_EXCHANGE" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE), "SSL_BAD_HS_SERVER_HELLO_DONE" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY), "SSL_BAD_HS_CERTIFICATE_VERIFY" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC), "SSL_BAD_HS_CHANGE_CIPHER_SPEC" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_FINISHED), "SSL_BAD_HS_FINISHED" },
-        { -(MBEDTLS_ERR_SSL_ALLOC_FAILED), "SSL_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FAILED), "SSL_HW_ACCEL_FAILED" },
-        { -(MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH), "SSL_HW_ACCEL_FALLTHROUGH" },
-        { -(MBEDTLS_ERR_SSL_COMPRESSION_FAILED), "SSL_COMPRESSION_FAILED" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION), "SSL_BAD_HS_PROTOCOL_VERSION" },
-        { -(MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET), "SSL_BAD_HS_NEW_SESSION_TICKET" },
-        { -(MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED), "SSL_SESSION_TICKET_EXPIRED" },
-        { -(MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH), "SSL_PK_TYPE_MISMATCH" },
-        { -(MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY), "SSL_UNKNOWN_IDENTITY" },
-        { -(MBEDTLS_ERR_SSL_INTERNAL_ERROR), "SSL_INTERNAL_ERROR" },
-        { -(MBEDTLS_ERR_SSL_COUNTER_WRAPPING), "SSL_COUNTER_WRAPPING" },
-        { -(MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO), "SSL_WAITING_SERVER_HELLO_RENEGO" },
-        { -(MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED), "SSL_HELLO_VERIFY_REQUIRED" },
-        { -(MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL), "SSL_BUFFER_TOO_SMALL" },
-        { -(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE), "SSL_NO_USABLE_CIPHERSUITE" },
-        { -(MBEDTLS_ERR_SSL_WANT_READ), "SSL_WANT_READ" },
-        { -(MBEDTLS_ERR_SSL_WANT_WRITE), "SSL_WANT_WRITE" },
-        { -(MBEDTLS_ERR_SSL_TIMEOUT), "SSL_TIMEOUT" },
-        { -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT), "SSL_CLIENT_RECONNECT" },
-        { -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD), "SSL_UNEXPECTED_RECORD" },
-        { -(MBEDTLS_ERR_SSL_NON_FATAL), "SSL_NON_FATAL" },
-        { -(MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH), "SSL_INVALID_VERIFY_HASH" },
-        { -(MBEDTLS_ERR_SSL_CONTINUE_PROCESSING), "SSL_CONTINUE_PROCESSING" },
-        { -(MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS), "SSL_ASYNC_IN_PROGRESS" },
-        { -(MBEDTLS_ERR_SSL_EARLY_MESSAGE), "SSL_EARLY_MESSAGE" },
-        { -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS), "SSL_CRYPTO_IN_PROGRESS" },
-#endif /* MBEDTLS_SSL_TLS_C */
-
-#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
-        { -(MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE), "X509_FEATURE_UNAVAILABLE" },
-        { -(MBEDTLS_ERR_X509_UNKNOWN_OID), "X509_UNKNOWN_OID" },
-        { -(MBEDTLS_ERR_X509_INVALID_FORMAT), "X509_INVALID_FORMAT" },
-        { -(MBEDTLS_ERR_X509_INVALID_VERSION), "X509_INVALID_VERSION" },
-        { -(MBEDTLS_ERR_X509_INVALID_SERIAL), "X509_INVALID_SERIAL" },
-        { -(MBEDTLS_ERR_X509_INVALID_ALG), "X509_INVALID_ALG" },
-        { -(MBEDTLS_ERR_X509_INVALID_NAME), "X509_INVALID_NAME" },
-        { -(MBEDTLS_ERR_X509_INVALID_DATE), "X509_INVALID_DATE" },
-        { -(MBEDTLS_ERR_X509_INVALID_SIGNATURE), "X509_INVALID_SIGNATURE" },
-        { -(MBEDTLS_ERR_X509_INVALID_EXTENSIONS), "X509_INVALID_EXTENSIONS" },
-        { -(MBEDTLS_ERR_X509_UNKNOWN_VERSION), "X509_UNKNOWN_VERSION" },
-        { -(MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG), "X509_UNKNOWN_SIG_ALG" },
-        { -(MBEDTLS_ERR_X509_SIG_MISMATCH), "X509_SIG_MISMATCH" },
-        { -(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED), "X509_CERT_VERIFY_FAILED" },
-        { -(MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT), "X509_CERT_UNKNOWN_FORMAT" },
-        { -(MBEDTLS_ERR_X509_BAD_INPUT_DATA), "X509_BAD_INPUT_DATA" },
-        { -(MBEDTLS_ERR_X509_ALLOC_FAILED), "X509_ALLOC_FAILED" },
-        { -(MBEDTLS_ERR_X509_FILE_IO_ERROR), "X509_FILE_IO_ERROR" },
-        { -(MBEDTLS_ERR_X509_BUFFER_TOO_SMALL), "X509_BUFFER_TOO_SMALL" },
-        { -(MBEDTLS_ERR_X509_FATAL_ERROR), "X509_FATAL_ERROR" },
-#endif /* MBEDTLS_X509_USE_C || MBEDTLS_X509_CREATE_C */
-// END generated code
-};
-
-static const struct ssl_errs mbedtls_low_level_error_tab[] = {
-// Low level error codes
-//
-// BEGIN generated code
-#if defined(MBEDTLS_AES_C)
-    { -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH), "AES_INVALID_KEY_LENGTH" },
-    { -(MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH), "AES_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_AES_BAD_INPUT_DATA), "AES_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE), "AES_FEATURE_UNAVAILABLE" },
-    { -(MBEDTLS_ERR_AES_HW_ACCEL_FAILED), "AES_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_AES_C */
-
-#if defined(MBEDTLS_ARC4_C)
-    { -(MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED), "ARC4_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_ARC4_C */
-
-#if defined(MBEDTLS_ARIA_C)
-    { -(MBEDTLS_ERR_ARIA_BAD_INPUT_DATA), "ARIA_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH), "ARIA_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE), "ARIA_FEATURE_UNAVAILABLE" },
-    { -(MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED), "ARIA_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_ARIA_C */
-
-#if defined(MBEDTLS_ASN1_PARSE_C)
-    { -(MBEDTLS_ERR_ASN1_OUT_OF_DATA), "ASN1_OUT_OF_DATA" },
-    { -(MBEDTLS_ERR_ASN1_UNEXPECTED_TAG), "ASN1_UNEXPECTED_TAG" },
-    { -(MBEDTLS_ERR_ASN1_INVALID_LENGTH), "ASN1_INVALID_LENGTH" },
-    { -(MBEDTLS_ERR_ASN1_LENGTH_MISMATCH), "ASN1_LENGTH_MISMATCH" },
-    { -(MBEDTLS_ERR_ASN1_INVALID_DATA), "ASN1_INVALID_DATA" },
-    { -(MBEDTLS_ERR_ASN1_ALLOC_FAILED), "ASN1_ALLOC_FAILED" },
-    { -(MBEDTLS_ERR_ASN1_BUF_TOO_SMALL), "ASN1_BUF_TOO_SMALL" },
-#endif /* MBEDTLS_ASN1_PARSE_C */
-
-#if defined(MBEDTLS_BASE64_C)
-    { -(MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL), "BASE64_BUFFER_TOO_SMALL" },
-    { -(MBEDTLS_ERR_BASE64_INVALID_CHARACTER), "BASE64_INVALID_CHARACTER" },
-#endif /* MBEDTLS_BASE64_C */
-
-#if defined(MBEDTLS_BIGNUM_C)
-    { -(MBEDTLS_ERR_MPI_FILE_IO_ERROR), "MPI_FILE_IO_ERROR" },
-    { -(MBEDTLS_ERR_MPI_BAD_INPUT_DATA), "MPI_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_MPI_INVALID_CHARACTER), "MPI_INVALID_CHARACTER" },
-    { -(MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL), "MPI_BUFFER_TOO_SMALL" },
-    { -(MBEDTLS_ERR_MPI_NEGATIVE_VALUE), "MPI_NEGATIVE_VALUE" },
-    { -(MBEDTLS_ERR_MPI_DIVISION_BY_ZERO), "MPI_DIVISION_BY_ZERO" },
-    { -(MBEDTLS_ERR_MPI_NOT_ACCEPTABLE), "MPI_NOT_ACCEPTABLE" },
-    { -(MBEDTLS_ERR_MPI_ALLOC_FAILED), "MPI_ALLOC_FAILED" },
-#endif /* MBEDTLS_BIGNUM_C */
-
-#if defined(MBEDTLS_BLOWFISH_C)
-    { -(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA), "BLOWFISH_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH), "BLOWFISH_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED), "BLOWFISH_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_BLOWFISH_C */
-
-#if defined(MBEDTLS_CAMELLIA_C)
-    { -(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA), "CAMELLIA_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH), "CAMELLIA_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED), "CAMELLIA_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_CAMELLIA_C */
-
-#if defined(MBEDTLS_CCM_C)
-    { -(MBEDTLS_ERR_CCM_BAD_INPUT), "CCM_BAD_INPUT" },
-    { -(MBEDTLS_ERR_CCM_AUTH_FAILED), "CCM_AUTH_FAILED" },
-    { -(MBEDTLS_ERR_CCM_HW_ACCEL_FAILED), "CCM_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_CCM_C */
-
-#if defined(MBEDTLS_CHACHA20_C)
-    { -(MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA), "CHACHA20_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE), "CHACHA20_FEATURE_UNAVAILABLE" },
-    { -(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED), "CHACHA20_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_CHACHA20_C */
-
-#if defined(MBEDTLS_CHACHAPOLY_C)
-    { -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE), "CHACHAPOLY_BAD_STATE" },
-    { -(MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED), "CHACHAPOLY_AUTH_FAILED" },
-#endif /* MBEDTLS_CHACHAPOLY_C */
-
-#if defined(MBEDTLS_CMAC_C)
-    { -(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED), "CMAC_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_CMAC_C */
-
-#if defined(MBEDTLS_CTR_DRBG_C)
-    { -(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED), "CTR_DRBG_ENTROPY_SOURCE_FAILED" },
-    { -(MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG), "CTR_DRBG_REQUEST_TOO_BIG" },
-    { -(MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG), "CTR_DRBG_INPUT_TOO_BIG" },
-    { -(MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR), "CTR_DRBG_FILE_IO_ERROR" },
-#endif /* MBEDTLS_CTR_DRBG_C */
-
-#if defined(MBEDTLS_DES_C)
-    { -(MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH), "DES_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_DES_HW_ACCEL_FAILED), "DES_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_DES_C */
-
-#if defined(MBEDTLS_ENTROPY_C)
-    { -(MBEDTLS_ERR_ENTROPY_SOURCE_FAILED), "ENTROPY_SOURCE_FAILED" },
-    { -(MBEDTLS_ERR_ENTROPY_MAX_SOURCES), "ENTROPY_MAX_SOURCES" },
-    { -(MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED), "ENTROPY_NO_SOURCES_DEFINED" },
-    { -(MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE), "ENTROPY_NO_STRONG_SOURCE" },
-    { -(MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR), "ENTROPY_FILE_IO_ERROR" },
-#endif /* MBEDTLS_ENTROPY_C */
-
-#if defined(MBEDTLS_GCM_C)
-    { -(MBEDTLS_ERR_GCM_AUTH_FAILED), "GCM_AUTH_FAILED" },
-    { -(MBEDTLS_ERR_GCM_HW_ACCEL_FAILED), "GCM_HW_ACCEL_FAILED" },
-    { -(MBEDTLS_ERR_GCM_BAD_INPUT), "GCM_BAD_INPUT" },
-#endif /* MBEDTLS_GCM_C */
-
-#if defined(MBEDTLS_HKDF_C)
-    { -(MBEDTLS_ERR_HKDF_BAD_INPUT_DATA), "HKDF_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_HKDF_C */
-
-#if defined(MBEDTLS_HMAC_DRBG_C)
-    { -(MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG), "HMAC_DRBG_REQUEST_TOO_BIG" },
-    { -(MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG), "HMAC_DRBG_INPUT_TOO_BIG" },
-    { -(MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR), "HMAC_DRBG_FILE_IO_ERROR" },
-    { -(MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED), "HMAC_DRBG_ENTROPY_SOURCE_FAILED" },
-#endif /* MBEDTLS_HMAC_DRBG_C */
-
-#if defined(MBEDTLS_MD2_C)
-    { -(MBEDTLS_ERR_MD2_HW_ACCEL_FAILED), "MD2_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_MD2_C */
-
-#if defined(MBEDTLS_MD4_C)
-    { -(MBEDTLS_ERR_MD4_HW_ACCEL_FAILED), "MD4_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_MD4_C */
-
-#if defined(MBEDTLS_MD5_C)
-    { -(MBEDTLS_ERR_MD5_HW_ACCEL_FAILED), "MD5_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_MD5_C */
-
-#if defined(MBEDTLS_NET_C)
-    { -(MBEDTLS_ERR_NET_SOCKET_FAILED), "NET_SOCKET_FAILED" },
-    { -(MBEDTLS_ERR_NET_CONNECT_FAILED), "NET_CONNECT_FAILED" },
-    { -(MBEDTLS_ERR_NET_BIND_FAILED), "NET_BIND_FAILED" },
-    { -(MBEDTLS_ERR_NET_LISTEN_FAILED), "NET_LISTEN_FAILED" },
-    { -(MBEDTLS_ERR_NET_ACCEPT_FAILED), "NET_ACCEPT_FAILED" },
-    { -(MBEDTLS_ERR_NET_RECV_FAILED), "NET_RECV_FAILED" },
-    { -(MBEDTLS_ERR_NET_SEND_FAILED), "NET_SEND_FAILED" },
-    { -(MBEDTLS_ERR_NET_CONN_RESET), "NET_CONN_RESET" },
-    { -(MBEDTLS_ERR_NET_UNKNOWN_HOST), "NET_UNKNOWN_HOST" },
-    { -(MBEDTLS_ERR_NET_BUFFER_TOO_SMALL), "NET_BUFFER_TOO_SMALL" },
-    { -(MBEDTLS_ERR_NET_INVALID_CONTEXT), "NET_INVALID_CONTEXT" },
-    { -(MBEDTLS_ERR_NET_POLL_FAILED), "NET_POLL_FAILED" },
-    { -(MBEDTLS_ERR_NET_BAD_INPUT_DATA), "NET_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_NET_C */
-
-#if defined(MBEDTLS_OID_C)
-    { -(MBEDTLS_ERR_OID_NOT_FOUND), "OID_NOT_FOUND" },
-    { -(MBEDTLS_ERR_OID_BUF_TOO_SMALL), "OID_BUF_TOO_SMALL" },
-#endif /* MBEDTLS_OID_C */
-
-#if defined(MBEDTLS_PADLOCK_C)
-    { -(MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED), "PADLOCK_DATA_MISALIGNED" },
-#endif /* MBEDTLS_PADLOCK_C */
-
-#if defined(MBEDTLS_PLATFORM_C)
-    { -(MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED), "PLATFORM_HW_ACCEL_FAILED" },
-    { -(MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED), "PLATFORM_FEATURE_UNSUPPORTED" },
-#endif /* MBEDTLS_PLATFORM_C */
-
-#if defined(MBEDTLS_POLY1305_C)
-    { -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA), "POLY1305_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE), "POLY1305_FEATURE_UNAVAILABLE" },
-    { -(MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED), "POLY1305_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_POLY1305_C */
-
-#if defined(MBEDTLS_RIPEMD160_C)
-    { -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED), "RIPEMD160_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_RIPEMD160_C */
-
-#if defined(MBEDTLS_SHA1_C)
-    { -(MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED), "SHA1_HW_ACCEL_FAILED" },
-    { -(MBEDTLS_ERR_SHA1_BAD_INPUT_DATA), "SHA1_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_SHA1_C */
-
-#if defined(MBEDTLS_SHA256_C)
-    { -(MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED), "SHA256_HW_ACCEL_FAILED" },
-    { -(MBEDTLS_ERR_SHA256_BAD_INPUT_DATA), "SHA256_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_SHA256_C */
-
-#if defined(MBEDTLS_SHA512_C)
-    { -(MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED), "SHA512_HW_ACCEL_FAILED" },
-    { -(MBEDTLS_ERR_SHA512_BAD_INPUT_DATA), "SHA512_BAD_INPUT_DATA" },
-#endif /* MBEDTLS_SHA512_C */
-
-#if defined(MBEDTLS_THREADING_C)
-    { -(MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE), "THREADING_FEATURE_UNAVAILABLE" },
-    { -(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA), "THREADING_BAD_INPUT_DATA" },
-    { -(MBEDTLS_ERR_THREADING_MUTEX_ERROR), "THREADING_MUTEX_ERROR" },
-#endif /* MBEDTLS_THREADING_C */
-
-#if defined(MBEDTLS_XTEA_C)
-    { -(MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH), "XTEA_INVALID_INPUT_LENGTH" },
-    { -(MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED), "XTEA_HW_ACCEL_FAILED" },
-#endif /* MBEDTLS_XTEA_C */
-// END generated code
-};
-
-static const char *mbedtls_err_prefix = "MBEDTLS_ERR_";
-#define MBEDTLS_ERR_PREFIX_LEN ( sizeof("MBEDTLS_ERR_")-1 )
-
-// copy error text into buffer, ensure null termination, return strlen of result
-static size_t mbedtls_err_to_str(int err, const struct ssl_errs tab[], int tab_len, char *buf, size_t buflen) {
-    if (buflen == 0) return 0;
-
-    // prefix for all error names
-    strncpy(buf, mbedtls_err_prefix, buflen);
-    if (buflen <= MBEDTLS_ERR_PREFIX_LEN+1) {
-        buf[buflen-1] = 0;
-        return buflen-1;
-    }
-
-    // append error name from table
-    for (int i = 0; i < tab_len; i++) {
-        if (tab[i].errnum == err) {
-            strncpy(buf+MBEDTLS_ERR_PREFIX_LEN, tab[i].errstr, buflen-MBEDTLS_ERR_PREFIX_LEN);
-            buf[buflen-1] = 0;
-            return strlen(buf);
-        }
-    }
-
-    mbedtls_snprintf(buf+MBEDTLS_ERR_PREFIX_LEN, buflen-MBEDTLS_ERR_PREFIX_LEN, "UNKNOWN (0x%04X)",
-            err);
-    return strlen(buf);
-}
-
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-
-void mbedtls_strerror(int ret, char *buf, size_t buflen) {
-    int use_ret;
-
-    if (buflen == 0) return;
-
-    buf[buflen-1] = 0;
-
-    if (ret < 0) ret = -ret;
-
-    //
-    // High-level error codes
-    //
-    uint8_t got_hl = (ret & 0xFF80) != 0;
-    if (got_hl) {
-        use_ret = ret & 0xFF80;
-
-        // special case
-#if defined(MBEDTLS_SSL_TLS_C)
-        if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) {
-            strncpy(buf, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE", buflen);
-            buf[buflen-1] = 0;
-            return;
-        }
-#endif
-
-        size_t len = mbedtls_err_to_str(use_ret, mbedtls_high_level_error_tab,
-                ARRAY_SIZE(mbedtls_high_level_error_tab), buf, buflen);
-
-        buf += len;
-        buflen -= len;
-        if (buflen == 0) return;
-    }
-
-    //
-    // Low-level error codes
-    //
-    use_ret = ret & ~0xFF80;
-
-    if (use_ret == 0) return;
-
-    // If high level code is present, make a concatenation between both error strings.
-    if (got_hl) {
-        if (buflen < 2) return;
-        *buf++ = '+';
-        buflen--;
-    }
-
-    mbedtls_err_to_str(use_ret, mbedtls_low_level_error_tab,
-            ARRAY_SIZE(mbedtls_low_level_error_tab), buf, buflen);
-}
-
-#else /* MBEDTLS_ERROR_C */
-
-#if defined(MBEDTLS_ERROR_STRERROR_DUMMY)
-
-/*
- * Provide an non-function in case MBEDTLS_ERROR_C is not defined
- */
-void mbedtls_strerror( int ret, char *buf, size_t buflen )
-{
-    ((void) ret);
-
-    if( buflen > 0 )
-        buf[0] = '\0';
-}
-
-#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */
-
-#endif /* MBEDTLS_ERROR_C */
diff --git a/ports/esp32/Makefile b/ports/esp32/Makefile
index 6cd2a9bc74068..2cbe9f6be57f9 100644
--- a/ports/esp32/Makefile
+++ b/ports/esp32/Makefile
@@ -362,7 +362,7 @@ EXTMOD_SRC_C += $(addprefix extmod/,\
 	)
 
 LIB_SRC_C = $(addprefix lib/,\
-	mbedtls_errors/esp32_mbedtls_errors.c \
+	mbedtls_errors/mp_mbedtls_errors.c \
 	mp-readline/readline.c \
 	netutils/netutils.c \
 	timeutils/timeutils.c \
@@ -507,7 +507,7 @@ ESPIDF_LWIP_O = $(patsubst %.c,%.o,\
 	$(wildcard $(ESPCOMP)/lwip/port/esp32/*/*.c) \
 	)
 
-# Mbedtls source files, exclude error.c in favor of lib/mbedtls_errors/esp32_mbedtls_errors.c
+# Mbedtls source files, exclude error.c in favor of lib/mbedtls_errors/mp_mbedtls_errors.c
 ESPIDF_MBEDTLS_O = $(patsubst %.c,%.o, $(filter-out %/error.c,\
 	$(wildcard $(ESPCOMP)/mbedtls/mbedtls/library/*.c) \
 	$(wildcard $(ESPCOMP)/mbedtls/port/*.c) \
diff --git a/tools/codeformat.py b/tools/codeformat.py
index 653529460c079..81a3cdcf8e5a2 100755
--- a/tools/codeformat.py
+++ b/tools/codeformat.py
@@ -38,6 +38,7 @@
     "extmod/*.[ch]",
     "extmod/btstack/*.[ch]",
     "extmod/nimble/*.[ch]",
+    "lib/mbedtls_errors/tester.c",
     "lib/netutils/*.[ch]",
     "lib/timeutils/*.[ch]",
     "lib/utils/*.[ch]",

From 3a85292f2d5a0a4b136bbb8b7de16858307c0386 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Thu, 2 Jul 2020 12:34:36 -0700
Subject: [PATCH 09/10] codeformat on tester.c

---
 lib/mbedtls_errors/tester.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/mbedtls_errors/tester.c b/lib/mbedtls_errors/tester.c
index 9abb3bb0f42d3..6f1c788f50ad8 100644
--- a/lib/mbedtls_errors/tester.c
+++ b/lib/mbedtls_errors/tester.c
@@ -13,8 +13,8 @@ int test_code(int code, char *str) {
 
     // test zero-length buffer
     memset(buf, -3, 100);
-    mbedtls_strerror(code, buf+4, 0);
-    for (int i=0; i < 10; i++) {
+    mbedtls_strerror(code, buf + 4, 0);
+    for (int i = 0; i < 10; i++) {
         if (buf[i] != -3) {
             printf("Error: guard overwritten buflen=0 i=%d buf[i]=%d\n", i, buf[i]);
             ok = 0;
@@ -22,16 +22,16 @@ int test_code(int code, char *str) {
     }
 
     // test
-    for(size_t buflen=1; buflen<90; buflen++) {
+    for (size_t buflen = 1; buflen < 90; buflen++) {
         memset(buf, -3, 100);
-        mbedtls_strerror(code, buf+4, buflen);
-        for (int i=0; i < 4; i++) {
+        mbedtls_strerror(code, buf + 4, buflen);
+        for (int i = 0; i < 4; i++) {
             if (buf[i] != -3) {
                 printf("Error: pre-guard overwritten buflen=%d i=%d buf[i]=%d\n", buflen, i, buf[i]);
                 ok = 0;
             }
         }
-        for (int i=4+buflen; i< 100; i++) {
+        for (int i = 4 + buflen; i < 100; i++) {
             if (buf[i] != -3) {
                 printf("Error: post-guard overwritten buflen=%d i=%d buf[i]=%d\n", buflen, i, buf[i]);
                 ok = 0;
@@ -39,8 +39,8 @@ int test_code(int code, char *str) {
         }
         char exp[100];
         strncpy(exp, str, buflen);
-        exp[buflen-1] = 0;
-        if (strcmp(buf+4, exp) != 0) {
+        exp[buflen - 1] = 0;
+        if (strcmp(buf + 4, exp) != 0) {
             printf("Error: expected %s, got %s\n", exp, buf);
             ok = 0;
         }
@@ -53,6 +53,6 @@ int main() {
     test_code(0x7200, "MBEDTLS_ERR_SSL_INVALID_RECORD");
     test_code(0x7780, "MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE");
     test_code(0x0074, "MBEDTLS_ERR_SHA256_BAD_INPUT_DATA");
-    test_code(0x6600|0x0074, "MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH+MBEDTLS_ERR_SHA256_BAD_INPUT_DATA");
+    test_code(0x6600 | 0x0074, "MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH+MBEDTLS_ERR_SHA256_BAD_INPUT_DATA");
     test_code(103, "MBEDTLS_ERR_UNKNOWN (0x0067)");
 }

From b56866a003eb3cb2b66af63b1c32be257aba88e6 Mon Sep 17 00:00:00 2001
From: Thorsten von Eicken <tve@voneicken.com>
Date: Thu, 2 Jul 2020 12:48:16 -0700
Subject: [PATCH 10/10] remove MICROPY_SSL_MBEDTLS_ERRSTR

---
 ports/stm32/Makefile | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/ports/stm32/Makefile b/ports/stm32/Makefile
index b471c5dd2150a..8ae61c9dde4f5 100644
--- a/ports/stm32/Makefile
+++ b/ports/stm32/Makefile
@@ -472,13 +472,10 @@ endif
 ifeq ($(MICROPY_SSL_MBEDTLS),1)
 CFLAGS_MOD += -DMBEDTLS_CONFIG_FILE='"mbedtls/mbedtls_config.h"'
 SRC_MOD += mbedtls/mbedtls_port.c
-ifeq ($(MICROPY_SSL_MBEDTLS_ERRSTR),1)
-CFLAGS_MOD += -DMBEDTLS_ERROR_C=1
 # replace mbedtls' error.c by ours
 SRC_MOD := $(filter-out %/mbedtls/library/error.c, $(SRC_MOD))
 EXTMOD_SRC_C += lib/mbedtls_errors/mp_mbedtls_errors.c
 endif
-endif
 
 ifeq ($(MICROPY_PY_BLUETOOTH),1)