Ensure the casper and hashcrypt accelerator functions are using mutexes

[AlexLanzano]

Serialize NXP CASPER and HashCrypt accelerator access

The LPC55S69 CASPER and HashCrypt ports did no locking. They also refused to build with WOLFSSL_CRYPT_HW_MUTEX=1, which FreeRTOS builds turn on automatically.

Changes

• CASPER: RSA public exptmod and ECC mulmod/mul2add now hold the PK HW mutex for the whole hardware sequence. wc_casper_init() initializes that mutex.
• HashCrypt: all SHA-1/SHA-256 and AES (ECB, CBC, OFB, CFB, CTR) operations now hold the global crypt HW mutex. AES and SHA run on the same engine, so they share one
  lock.
• wc_port.h: WOLFSSL_CRYPT_HW_MUTEX is enabled automatically for CASPER and HashCrypt. A threaded build that sets it to 0 now fails to compile.
• README: documents the locking and the existing single SHA stream and no SHA-224 limitations.

[Copilot]

Pull request overview

This PR tightens thread-safety guarantees for the NXP CASPER and HashCrypt hardware acceleration ports by ensuring they consistently serialize access to shared peripherals/state via the wolfCrypt crypto HW mutex, and by preventing builds that would silently compile out that serialization.

Changes:

• Auto-enable WOLFSSL_CRYPT_HW_MUTEX for NXP CASPER/HashCrypt and add a compile-time error when those ports are enabled in non-SINGLE_THREADED builds with the mutex forced off.
• Add crypto HW mutex initialization and lock/unlock coverage around HashCrypt SHA/AES operations.
• Add PK mutex initialization and lock/unlock coverage around CASPER RSA/ECC operations; update NXP port README to document the serialization and limitations.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
wolfssl/wolfcrypt/wc_port.h	Auto-enables crypto HW mutex for CASPER/HashCrypt and adds a compile-time guard against disabling it in threaded builds.
wolfcrypt/src/port/nxp/README.md	Documents HashCrypt behavior constraints and the mutex-based serialization requirement/limitations.
wolfcrypt/src/port/nxp/hashcrypt_port.c	Adds crypto HW mutex init + locking around HashCrypt SHA/AES operations to serialize shared engine access.
wolfcrypt/src/port/nxp/casper_port.c	Adds PK mutex init + locking around CASPER RSA/ECC operations to serialize shared peripheral and scratch buffers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 4 · 1

Open (5)

• ret is returned uninitialized on the success path (when HASHCRYPT_SHA_Update succeeds).… · New
• ret can be returned uninitialized: (1) when finish_called is true, and (2) when… · New
• ret is returned uninitialized on the success path (when HASHCRYPT_SHA_Update succeeds).… · New
• ret can be returned uninitialized: (1) when finish_called is true, and (2) when… · New
• The return value of HASHCRYPT_SHA_Init is ignored here. Since other HashCrypt calls treat… · New

Resolved since last review (1)

• The comment in wc_ShaFinal() refers to wc_Sha256GetHash(), but this function implements SHA-1 and…

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11315

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Coverage: 3 of 3 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[philljj]

merge conflict in wc_port.h

[philljj]

Retest this please.

(test aborted from network)