Zephyr: wolfSSL module support for the wolfPSA provider and native RTOS use

Extend the wolfSSL Zephyr module for the wolfPSA-provider and secure-sockets
efforts:

  - Native RTOS threading: wolfCrypt's Zephyr port uses k_mutex/k_thread/
    k_condvar directly (no CONFIG_POSIX_THREADS), with k_condvar gated on the
    kernel version, covered by a native-threading ztest wired into CI.
  - Config interface: a user-supplied CONFIG_WOLFSSL_SETTINGS_FILE is
    authoritative and the module never layers Kconfig #defines over it. The
    module-default block is shaped by build-profile knobs (WOLFSSL_CRYPTO_ONLY,
    WOLFSSL_SINGLE_THREADED, which now defaults from !MULTITHREADING) plus new
    classic-crypto/TLS/PQC feature knobs (RSA/ECC/ChaCha-Poly/Curve25519/SNI/
    session-cache/session-ticket and ML-KEM/ML-DSA/LMS/XMSS/Falcon, each with
    its memory-reduction "small" options). A consumer such as wolfPSA validates
    its own requirements rather than the module injecting them.
  - DRBG seeding: wc_GenerateSeed() on Zephyr draws seed material from the
    hardware entropy driver when present (chunked to the entropy API's uint16_t
    length, DT_HAS_CHOSEN-guarded) and falls back to sys_rand_get() otherwise;
    HAVE_HASHDRBG stays guarded by WC_NO_HASHDRBG.
  - z_time(): read the native_sim simulator RTC for a real wall clock on the
    native targets regardless of libc.

Verified on native_sim/native/64 and nucleo_h743zi.

Author: Frauschi

.github/scripts/zephyr-4.x/zephyr-test.sh

@@ -10,7 +10,8 @@
 #   -b, --branch <branch>  wolfSSL branch/revision
 #   -z, --zephyr <version> Zephyr version tag
 #   -t, --target <board>   Board target
-#   -s, --sample <name>    Sample to build
+#   -s, --sample <name>    Sample/test app to build
+#   -d, --subdir <dir>     App subdir under zephyr/ (samples or tests; default samples)
 #   -v, --verbose          Verbose compile output (show full compiler commands)
 #   -W, --werror           Build with -Werror (treat warnings as errors)
 #   --commit <sha>         Checkout specific commit after fetching branch
@@ -49,6 +50,7 @@ WOLFSSL_BRANCH="master"
 ZEPHYR_VERSION="v4.1.0"
 BOARD_TARGET="native_sim"
 SAMPLE_NAME="wolfssl_tls_sock"
+SUBDIR="samples"
 INTERACTIVE=0
 VERBOSE=0
 WERROR=0
@@ -92,6 +94,7 @@ while [[ $# -gt 0 ]]; do
         -z|--zephyr)  ZEPHYR_VERSION="$2"; shift 2 ;;
         -t|--target)  BOARD_TARGET="$2"; shift 2 ;;
         -s|--sample)  SAMPLE_NAME="$2"; shift 2 ;;
+        -d|--subdir)  SUBDIR="$2"; shift 2 ;;
         -v|--verbose) VERBOSE=1; shift ;;
         -W|--werror) WERROR=1; shift ;;
         --commit) WOLFSSL_COMMIT="$2"; shift 2 ;;
@@ -123,7 +126,7 @@ echo "==> wolfSSL repo:   ${WOLFSSL_REPO}"
 echo "==> wolfSSL branch: ${WOLFSSL_BRANCH}"
 echo "==> Zephyr version: ${ZEPHYR_VERSION}"
 echo "==> Board target:   ${BOARD_TARGET}"
-echo "==> Sample:         ${SAMPLE_NAME}"
+echo "==> Sample:         ${SUBDIR}/${SAMPLE_NAME}"
 echo "==> Docker image:   ${DOCKER_IMAGE}"
 [[ -n "$WOLFSSL_COMMIT" ]] && echo "==> Commit:         ${WOLFSSL_COMMIT}"
 [[ "$WERROR" == "1" ]] && echo "==> Werror:         enabled"
@@ -144,6 +147,7 @@ set -euo pipefail
 ZEPHYR_VERSION="__ZEPHYR_VERSION__"
 BOARD_TARGET="__BOARD_TARGET__"
 SAMPLE_NAME="__SAMPLE_NAME__"
+SUBDIR="__SUBDIR__"
 WOLFSSL_REPO="__WOLFSSL_REPO__"
 WOLFSSL_BRANCH="__WOLFSSL_BRANCH__"
 WOLFSSL_COMMIT="__WOLFSSL_COMMIT__"
@@ -224,11 +228,11 @@ if [[ "$INTERACTIVE" == "1" ]]; then
     echo " wolfSSL:   modules/crypto/wolfssl"
     echo ""
     echo " Example build commands:"
-    echo "   west build -p always -b ${BOARD_TARGET} modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME}"
+    echo "   west build -p always -b ${BOARD_TARGET} modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME}"
     echo "   west build -t run"
     echo ""
     echo " To run twister tests:"
-    echo "   ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME} -vvv"
+    echo "   ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME} -vvv"
     echo "=========================================="
     echo ""
     exec /bin/bash
@@ -256,7 +260,7 @@ else
     fi
 
     west build -p always -b "${BOARD_TARGET}" \
-        "modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME}" \
+        "modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME}" \
         ${CMAKE_ARGS:+-- $CMAKE_ARGS}
 
     echo ""
@@ -300,7 +304,7 @@ else
                     exit 1
                 fi
                 # Check for success strings
-                if grep -q "Benchmark complete\|Test complete\|Client Return: 0" "${RUN_LOG}" 2>/dev/null; then
+                if grep -q "Benchmark complete\|Test complete\|Client Return: 0\|PROJECT EXECUTION SUCCESSFUL" "${RUN_LOG}" 2>/dev/null; then
                     echo "==> [container] App completed successfully!"
                     APP_RC=0
                     kill "${RUN_PID}" 2>/dev/null || true
@@ -315,7 +319,7 @@ else
 
             if [[ $APP_RC -ne 0 ]]; then
                 # Process exited on its own - check if it printed a success string
-                if grep -q "Benchmark complete\|Test complete\|Client Return: 0" "${RUN_LOG}" 2>/dev/null; then
+                if grep -q "Benchmark complete\|Test complete\|Client Return: 0\|PROJECT EXECUTION SUCCESSFUL" "${RUN_LOG}" 2>/dev/null; then
                     APP_RC=0
                 else
                     echo "==> [container] App exited without a success string"
@@ -336,6 +340,7 @@ INNER_SCRIPT
 BUILD_SCRIPT="${BUILD_SCRIPT//__ZEPHYR_VERSION__/$ZEPHYR_VERSION}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__BOARD_TARGET__/$BOARD_TARGET}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__SAMPLE_NAME__/$SAMPLE_NAME}"
+BUILD_SCRIPT="${BUILD_SCRIPT//__SUBDIR__/$SUBDIR}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_REPO__/$WOLFSSL_REPO}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_BRANCH__/$WOLFSSL_BRANCH}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_COMMIT__/$WOLFSSL_COMMIT}"

.github/workflows/zephyr-4.x.yml

@@ -103,3 +103,69 @@ jobs:
             .github/scripts/zephyr-4.x/artifacts/${{ matrix.board == 'native_sim' && 'native_sim' || 'frdm_rw612-rw612' }}-wolfssl_test/zephyr.map
           if-no-files-found: warn
           retention-days: 1
+
+  # Native k_mutex/k_thread/k_condvar threading ztest (no POSIX). native_sim
+  # only - it reads the native_sim simulator RTC - so it lives on this 4.x
+  # matrix rather than the legacy zephyr.yml (v2.7.4/v3.4.0/v3.5.0), where
+  # native_sim is unavailable or its POSIX headers clash with ztest.
+  condvar:
+    name: ${{ matrix.zephyr-ref }} | native_sim | wolfssl_condvar${{ matrix.crypto-only == 'y' && ' | crypto-only' || '' }}
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        zephyr-ref: [ v4.1.0, v4.3.0, v4.4.0 ]
+        # Both build profiles the testcase.yaml exercises: default (TLS + crypto)
+        # and the WOLFCRYPT_ONLY build-profile knob.
+        crypto-only: [ 'n', 'y' ]
+    steps:
+      - name: Checkout test driver
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: .github/scripts/zephyr-4.x
+          fetch-depth: 1
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
+                      /opt/hostedtoolcache/CodeQL "$AGENT_TOOLSDIRECTORY" || true
+          docker system prune -af || true
+          df -h /
+
+      - name: Resolve wolfSSL repo and branch
+        id: src
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "repo=https://github.com/${{ github.repository }}" >> "$GITHUB_OUTPUT"
+            echo "branch=refs/pull/${{ github.event.pull_request.number }}/merge" >> "$GITHUB_OUTPUT"
+          else
+            echo "repo=https://github.com/${{ github.repository }}" >> "$GITHUB_OUTPUT"
+            echo "branch=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and run condvar ztest
+        working-directory: .github/scripts/zephyr-4.x
+        run: |
+          CRYPTO_ONLY_ARG=""
+          if [[ "${{ matrix.crypto-only }}" == "y" ]]; then
+            CRYPTO_ONLY_ARG="--cmake-args -DCONFIG_WOLFSSL_CRYPTO_ONLY=y"
+          fi
+          bash ./zephyr-test.sh \
+            -r "${{ steps.src.outputs.repo }}" \
+            -b "${{ steps.src.outputs.branch }}" \
+            -z "${{ matrix.zephyr-ref }}" \
+            -t native_sim \
+            -d tests \
+            -s wolfssl_condvar \
+            $CRYPTO_ONLY_ARG
+
+      - name: Upload logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: zephyr-4.x-condvar-${{ matrix.zephyr-ref }}-${{ matrix.crypto-only }}-${{ strategy.job-index }}
+          path: .github/scripts/zephyr-4.x/logs/
+          retention-days: 5
+          if-no-files-found: ignore

.github/workflows/zephyr.yml

@@ -92,10 +92,13 @@ jobs:
       - name: Run wolfssl test
         id: wolfssl-test
         working-directory: zephyr
+        # Scope -T to the sample directory (not the whole module) so twister does
+        # not load zephyr/tests/*/testcase.yaml. The condvar test's modern
+        # list-form platform_allow is rejected by the 2.7.4 twister schema, and
+        # this is the only sample step that runs on 2.7.4. Runs both scenarios
+        # (wolfssl_test and wolfssl_test_no_malloc).
         run: |
-          ./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_test/sample.crypto.wolfssl_test -vvv
-          rm -rf zephyr/twister-out
-          ./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_test/sample.crypto.wolfssl_test_no_malloc -vvv
+          ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test -vvv
           rm -rf zephyr/twister-out
 
       - name: Run wolfssl TLS sock test

.wolfssl_known_macro_extras

@@ -95,6 +95,7 @@ CONFIG_CRYPTO_SHA3
 CONFIG_CRYPTO_SHA512
 CONFIG_CRYPTO_XTS
 CONFIG_CSPRNG_ENABLED
+CONFIG_ENTROPY_HAS_DRIVER
 CONFIG_ESP32C2_DEFAULT_CPU_FREQ_MHZ
 CONFIG_ESP32C3_DEFAULT_CPU_FREQ_MHZ
 CONFIG_ESP32H2_DEFAULT_CPU_FREQ_MHZ
@@ -154,6 +155,7 @@ CONFIG_POSIX_THREADS
 CONFIG_PREEMPT_COUNT
 CONFIG_PREEMPT_RT
 CONFIG_PTHREAD_IPC
+CONFIG_RTC
 CONFIG_SCHED_INFO
 CONFIG_SMP
 CONFIG_SNTP_TIME_SYNC_METHOD_SMOOTH
@@ -166,6 +168,11 @@ CONFIG_USE_WOLFSSL_ESP_SDK_TIME
 CONFIG_USE_WOLFSSL_ESP_SDK_WIFI
 CONFIG_WOLFCRYPT_ARMASM
 CONFIG_WOLFCRYPT_FIPS
+CONFIG_WOLFCRYPT_FIPS_READY
+CONFIG_WOLFCRYPT_FIPS_V2
+CONFIG_WOLFCRYPT_FIPS_V5
+CONFIG_WOLFCRYPT_FIPS_V6
+CONFIG_WOLFCRYPT_FIPS_V7
 CONFIG_WOLFCRYPT_INTELASM
 CONFIG_WOLFSSL
 CONFIG_WOLFSSL_ALLOW_TLS13
@@ -176,7 +183,11 @@ CONFIG_WOLFSSL_APPLE_HOMEKIT
 CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
+CONFIG_WOLFSSL_CHACHA_POLY
+CONFIG_WOLFSSL_CRYPTO_ONLY
+CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_DTLS
+CONFIG_WOLFSSL_ECC
 CONFIG_WOLFSSL_ENABLE_KYBER
 CONFIG_WOLFSSL_EXAMPLE_NAME_ESP32_SSH_SERVER
 CONFIG_WOLFSSL_EXAMPLE_NAME_ESP8266_SSH_SERVER
@@ -188,20 +199,30 @@ CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFMQTT_AWS_IOT_MQTT
 CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFMQTT_TEMPLATE
 CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFSSH_ECHOSERVER
 CONFIG_WOLFSSL_EXAMPLE_NAME_WOLFSSH_TEMPLATE
+CONFIG_WOLFSSL_FALCON
 CONFIG_WOLFSSL_HKDF
 CONFIG_WOLFSSL_KEEP_PEER_CERT
+CONFIG_WOLFSSL_LMS
 CONFIG_WOLFSSL_MAX_FRAGMENT_LEN
+CONFIG_WOLFSSL_MLDSA
 CONFIG_WOLFSSL_MLKEM
 CONFIG_WOLFSSL_NO_ASN_STRICT
 CONFIG_WOLFSSL_OPENSSL_EXTRA_X509_SMALL
 CONFIG_WOLFSSL_PSK
+CONFIG_WOLFSSL_RSA
 CONFIG_WOLFSSL_RSA_PSS
+CONFIG_WOLFSSL_SESSION_CACHE
 CONFIG_WOLFSSL_SESSION_EXPORT
+CONFIG_WOLFSSL_SESSION_TICKET
+CONFIG_WOLFSSL_SETTINGS_FILE
+CONFIG_WOLFSSL_SINGLE_THREADED
+CONFIG_WOLFSSL_SNI
 CONFIG_WOLFSSL_TARGET_HOST
 CONFIG_WOLFSSL_TARGET_PORT
 CONFIG_WOLFSSL_TLS13_ENABLED
 CONFIG_WOLFSSL_TLS_VERSION_1_2
 CONFIG_WOLFSSL_TLS_VERSION_1_3
+CONFIG_WOLFSSL_XMSS
 CONFIG_WOLFTPM
 CONFIG_WOLFTPM_EXAMPLE_NAME_ESPRESSIF
 CONFIG_X86
@@ -839,15 +860,8 @@ WOLFSSL_EVP_PRINT
 WOLFSSL_EXPORT_INT
 WOLFSSL_EXPORT_SPC_SZ
 WOLFSSL_EXTRA
-WOLFSSL_FALCON_FFT_AVX2
-WOLFSSL_FALCON_FFT_NEON
-WOLFSSL_FALCON_FPR_ASM
-WOLFSSL_FALCON_FPR_DOUBLE
 WOLFSSL_FALCON_NO_NTT_DSP
-WOLFSSL_FALCON_NTT_DSP
-WOLFSSL_FALCON_SIGN_SMALL_MEM
 WOLFSSL_FALCON_SIGN_STATS
-WOLFSSL_FALCON_VERIFY_ONLY
 WOLFSSL_FORCE_OCSP_NONCE_CHECK
 WOLFSSL_FRDM_K64
 WOLFSSL_FRDM_K64_JENKINS

wolfcrypt/src/random.c

@@ -5322,10 +5322,53 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
         #include <posix/time.h>
     #endif
 
+    #if defined(CONFIG_ENTROPY_HAS_DRIVER) && DT_HAS_CHOSEN(zephyr_entropy)
+        /* Match the zephyr/-prefixed include layout used above: it did not
+         * exist before Zephyr 3.1. */
+        #if KERNEL_VERSION_NUMBER >= 0x30100
+            #include <zephyr/device.h>
+            #include <zephyr/drivers/entropy.h>
+        #else
+            #include <device.h>
+            #include <drivers/entropy.h>
+        #endif
+    #endif
+
     int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
     {
+    /* Seed the DRBG straight from the hardware entropy driver when the platform
+     * exposes one (a zephyr,entropy chosen node), so wolfCrypt gets
+     * cryptographic-quality seed material instead of the general-purpose
+     * sys_rand_get(). A dead source returns an error, which makes wc_InitRng()
+     * fail (RNG_FAILURE_E) rather than yield weak output. Boards that set
+     * CONFIG_ENTROPY_HAS_DRIVER without a chosen entropy node fall back to
+     * sys_rand_get() rather than failing the build. */
+    #if defined(CONFIG_ENTROPY_HAS_DRIVER) && DT_HAS_CHOSEN(zephyr_entropy)
+        const struct device *dev = DEVICE_DT_GET(DT_CHOSEN(zephyr_entropy));
+        word32 off = 0;
+        word32 rem;
+        uint16_t chunk;
+
+        (void)os;
+        if (!device_is_ready(dev)) {
+            return RNG_FAILURE_E;
+        }
+        /* entropy_get_entropy() takes a uint16_t length; chunk the request so
+         * any word32 seed size is honored without silent truncation. */
+        while (off < sz) {
+            rem = sz - off;
+            chunk = (rem > 0xFFFFU) ? (uint16_t)0xFFFFU : (uint16_t)rem;
+            if (entropy_get_entropy(dev, (uint8_t *)output + off, chunk) != 0) {
+                return RNG_FAILURE_E;
+            }
+            off += chunk;
+        }
+        return 0;
+    #else
+        (void)os;
         sys_rand_get(output, sz);
         return 0;
+    #endif
     }
 
 #elif defined(WOLFSSL_TELIT_M2MB)