Repository navigation
Conversation
Frauschi
commented
Jul 21, 2026
Frauschi
commented
Jul 21, 2026
Frauschi
commented
Jul 22, 2026
Frauschi
commented
Jul 22, 2026
Frauschi
commented
Jul 22, 2026
Frauschi
commented
Jul 23, 2026
Frauschi
force-pushed
the
zephyr_fixes
branch
3 times, most recently
from
July 23, 2026 15:43
667dd58 to
92c96b4
Compare
…OS use
Extend the wolfSSL Zephyr module for the wolfPSA-provider and secure-sockets
efforts:
- Native RTOS threading: wolfCrypt's Zephyr port uses k_mutex/k_thread/
k_condvar directly (no CONFIG_POSIX_THREADS), with k_condvar gated on the
kernel version, covered by a native-threading ztest wired into CI.
- Config interface: a user-supplied CONFIG_WOLFSSL_SETTINGS_FILE is
authoritative and the module never layers Kconfig #defines over it. The
module-default block is shaped by build-profile knobs (WOLFSSL_CRYPTO_ONLY,
WOLFSSL_SINGLE_THREADED, which now defaults from !MULTITHREADING) plus new
classic-crypto/TLS/PQC feature knobs (RSA/ECC/ChaCha-Poly/Curve25519/SNI/
session-cache/session-ticket and ML-KEM/ML-DSA/LMS/XMSS/Falcon, each with
its memory-reduction "small" options). A consumer such as wolfPSA validates
its own requirements rather than the module injecting them.
- DRBG seeding: wc_GenerateSeed() on Zephyr draws seed material from the
hardware entropy driver when present (chunked to the entropy API's uint16_t
length, DT_HAS_CHOSEN-guarded) and falls back to sys_rand_get() otherwise;
HAVE_HASHDRBG stays guarded by WC_NO_HASHDRBG.
- z_time(): read the native_sim simulator RTC for a real wall clock on the
native targets regardless of libc.
Verified on native_sim/native/64 and nucleo_h743zi.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Downstream Zephyr integration fixes carried on
zephyr_fixes(vsmaster).Five commits, in two themes plus a native_sim time fix.
wolfPSA PSA-provider enablement
acbd93526support wolfPSA as the PSA Crypto provider underCONFIG_WOLFPSA: share one wolfCrypt config between the module and wolfPSA, and compile the extra sources wolfPSA needs (ascon, xmss), all gated onCONFIG_WOLFPSAso the stock TLS build is unaffected.a7ded24e9the module'suser_settings.hnow lets the USER drive the wolfCrypt config (theirCONFIG_WOLFSSL_SETTINGS_FILE, else the wolfPSA default feature set) and applies the wolfPSA structural baseline on top in both cases.Native Zephyr threading without POSIX
8ae3d20eea non-SINGLE_THREADEDwolfCrypt build on Zephyr used to requireCONFIG_POSIX_THREADS/CONFIG_PTHREAD_IPCvia a hard#error, even though mutexes and thread creation were already native. Drop the#error; backwolfSSL_Mutex/threads/condvars with nativek_mutex/k_thread/k_condvarfrom<zephyr/kernel.h>, and pull the POSIX pthread shims only when the app actually enables the POSIX layer. Adds a nativek_condvarCOND_TYPE+WOLFSSL_CONDand implements the sixwolfSSL_Cond*functions, plus azephyr/tests/wolfssl_condvarztest.56cf493acgateWOLFSSL_CONDonKERNEL_VERSION_NUMBER >= 0x20400(k_condvarwas introduced in Zephyr 2.4), so pre-2.4 targets build without condition variables exactly as before.native_sim time
4ea9ac70fread the native simulator RTC inz_time()regardless of libc, so ASN.1 certificate date validation has a real wall clock in simulation.Validation
wolfssl_test).k_mutex/k_thread/k_condvar(wolfssl_condvarztest: producer/consumer handshake + NULL guards).k_condvaris present with a matching API in the v2.7.4 kernel headers.Pairs with the wolfPSA module changes (separate repo/PR).