From 7f3d58a4e671eb1996a1ff59a08a355faf4dc54b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 10 Sep 2026 16:10:02 +0200 Subject: [PATCH 1/6] zephyr: call Zephyr's clock API instead of remapping the POSIX names wc_port.h guarded a sys_clock_gettime()/sys_clock_settime() remap with "#ifndef CLOCK_REALTIME". On Zephyr 4.3 and newer the same header includes , and both picolibc and newlib define CLOCK_REALTIME as 1. The guard was therefore always false, the whole block was skipped, and z_time() called clock_gettime() - a symbol Zephyr only defines when the application enables CONFIG_POSIX_TIMERS, which is itself gated behind CONFIG_POSIX_SYSTEM_INTERFACES. A build without them failed: test.c:3657:9: error: implicit declaration of function 'clock_settime'; did you mean 'sys_clock_settime'? Making the remap unconditional fixes that build but hands every consumer a library-wide rewrite of two POSIX names. wc_port.h is reached from every wolfCrypt header, so an application calling clock_gettime() would silently get sys_clock_gettime(), which reports failure as a negative errno instead of -1 plus errno, and code that stores a function pointer under either name would stop compiling depending on its include order. Drop the macros and name the Zephyr API at the three places that need it - z_time(), the wolfCrypt test's dummy wallclock and the threaded TLS sample - keeping the POSIX call for Zephyr versions without SYS_CLOCK_REALTIME. sys_clock_gettime() lives in lib/os/clock.c and is core Zephyr rather than POSIX, so a Zephyr build no longer has to enable the POSIX layer just to satisfy wc_port.c. --- wolfcrypt/src/wc_port.c | 4 ++++ wolfcrypt/test/test.c | 4 ++++ wolfssl/wolfcrypt/wc_port.h | 8 -------- zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c | 4 ++++ 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c index 4c6fbe7bdf6..154529d33c0 100644 --- a/wolfcrypt/src/wc_port.c +++ b/wolfcrypt/src/wc_port.c @@ -4601,7 +4601,11 @@ time_t z_time(time_t * timer) /* Fallback to uptime since boot. This works for relative times, but * not for ASN.1 date validation */ + #ifdef SYS_CLOCK_REALTIME + if (sys_clock_gettime(SYS_CLOCK_REALTIME, &ts) == 0) + #else if (clock_gettime(CLOCK_REALTIME, &ts) == 0) + #endif if (timer != NULL) *timer = ts.tv_sec; diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index e4407f710d8..4ce36b1c5fe 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -3654,7 +3654,11 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\ struct timespec utctime; utctime.tv_sec = 1521725159; /* dummy time: 2018-03-22T13:25:59+00:00 */ utctime.tv_nsec = 0; + #ifdef SYS_CLOCK_REALTIME + sys_clock_settime(SYS_CLOCK_REALTIME, &utctime); + #else clock_settime(CLOCK_REALTIME, &utctime); + #endif #endif #ifdef DEVKITPRO void *framebuffer; diff --git a/wolfssl/wolfcrypt/wc_port.h b/wolfssl/wolfcrypt/wc_port.h index 0d400713438..5e4d758c867 100644 --- a/wolfssl/wolfcrypt/wc_port.h +++ b/wolfssl/wolfcrypt/wc_port.h @@ -1729,14 +1729,6 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void); #include #endif - #ifndef CLOCK_REALTIME - #ifdef SYS_CLOCK_REALTIME - #define CLOCK_REALTIME SYS_CLOCK_REALTIME - #define clock_gettime sys_clock_gettime - #define clock_settime sys_clock_settime - #endif - #endif - #if defined(CONFIG_RTC) #if defined(CONFIG_PICOLIBC) || defined(CONFIG_NEWLIB_LIBC) #include diff --git a/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c b/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c index fc3faf71d04..aa09d8fd653 100644 --- a/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c +++ b/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c @@ -587,7 +587,11 @@ int main() struct timespec utctime; utctime.tv_sec = 1658510212; /* Friday, July 22, 2022 5:16:52 PM GMT */ utctime.tv_nsec = 0; +#ifdef SYS_CLOCK_REALTIME + sys_clock_settime(SYS_CLOCK_REALTIME, &utctime); +#else clock_settime(CLOCK_REALTIME, &utctime); +#endif #ifdef HAVE_FIPS wolfCrypt_SetCb_fips(myFipsCb); From b81dd21ece98d9b50f607a9b759b6a266983fc6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 10 Sep 2026 17:33:12 +0200 Subject: [PATCH 2/6] zephyr: put the wolfSSL interface library on zephyr_interface The module ended with target_link_libraries(wolfSSL INTERFACE zephyr_interface) which links the two the wrong way round. It makes anything that links wolfSSL inherit Zephyr's flags - which every zephyr_library() already has - and puts wolfSSL's own WOLFSSL_USER_SETTINGS and WOLFSSL_ZEPHYR definitions onto nothing. The app target picks them up anyway through CONFIG_APP_LINK_WITH_WOLFSSL, so the omission only shows up for other libraries. Consequently every Zephyr library or module that includes a wolfSSL header has to remember zephyr_library_link_libraries(wolfSSL) of its own. One that forgets still compiles, because the headers fall back to their unconfigured defaults - and then disagrees with libwolfssl about structure layout at run time. Use zephyr_link_libraries(wolfSSL) instead, so the interface properties reach every Zephyr library. This is what the mbedTLS module does. The replacement only adds. Building zephyr/samples/wolfssl_tls_sock for qemu_x86 both ways and comparing every entry in compile_commands.json, no translation unit loses a define or an include path; 175 of them gain WOLFSSL_USER_SETTINGS, WOLFSSL_ZEPHYR, WOLFSSL_HAVE_MIN and WOLFSSL_HAVE_MAX. The link line is unchanged and the resulting image has the same size and the same symbols. --- zephyr/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt index 39f5c58d805..7a21bced1de 100644 --- a/zephyr/CMakeLists.txt +++ b/zephyr/CMakeLists.txt @@ -222,6 +222,6 @@ if(CONFIG_WOLFSSL) # after wolfssl_external on the linkers command line. endif() - target_link_libraries(wolfSSL INTERFACE zephyr_interface) + zephyr_link_libraries(wolfSSL) endif() From aee18e8a7d89d637fc9013ecf13d32a7fa80461c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 10 Sep 2026 16:19:21 +0200 Subject: [PATCH 3/6] zephyr: stop redefining the POSIX socket names library-wide Zephyr 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES, so settings.h took over the job itself and defined socket, bind, connect, listen, accept, send, recv, sendto, recvfrom, setsockopt, getsockopt, shutdown, getpeername and getsockname as object-like macros onto their zsock_ counterparts. settings.h is reached from every wolfSSL header, so those macros rewrite any matching token in any translation unit that includes one - including members of structures that have nothing to do with wolfSSL. Zephyr's own struct socket_op_vtable declares bind, connect, listen, accept, shutdown, sendto, recvfrom, getsockopt and setsockopt, and whether a file compiles at all comes down to the order of its includes: #include /* members declared without the macros */ #include /* macros arrive */ static const struct socket_op_vtable vt = { .bind = my_bind }; error: 'const struct socket_op_vtable' has no member named 'zsock_bind' The compiler then drops the designated initializer and falls back to positional initialization, so the handler is installed in the wrong slot. Reversing the two includes builds cleanly. Zephyr's own TLS socket layer hits this and carries a block of #undefs to defuse it. Call Zephyr's API by its own name instead. send/recv already go through SEND_FUNCTION/RECV_FUNCTION and sendto/recvfrom through DTLS_SENDTO_FUNCTION/DTLS_RECVFROM_FUNCTION, so those only needed a value; socket and accept run through wc_socket_cloexec()/wc_accept_cloexec(); close and inet_pton/inet_ntop were already handled by CloseSocket and XINET_PTON/XINET_NTOP. That leaves bind, connect, listen, getsockopt, setsockopt and getpeername, which get XSOCKET_* wrappers in wolfio.h. They default to the BSD names, so every other port preprocesses exactly as before. zsock_ is also the only spelling that works across configurations from 4.4 on: the POSIX aliases in need CONFIG_NET_NAMESPACE_COMPAT_MODE, and CONFIG_NET_NAMESPACE_COMPAT_MODE itself only restores types and constants, never the function names. wolfssl/test.h keeps a remapping of its own, placed after its system includes where no later declaration can be caught by it, since the harness calls the socket API directly in many more places. --- src/wolfio.c | 18 +++++++++------- wolfssl/test.h | 21 ++++++++++++++++++ wolfssl/wolfcrypt/settings.h | 32 ++++----------------------- wolfssl/wolfcrypt/wc_port.h | 9 ++++++++ wolfssl/wolfio.h | 42 ++++++++++++++++++++++++++++++++++-- 5 files changed, 84 insertions(+), 38 deletions(-) diff --git a/src/wolfio.c b/src/wolfio.c index 09d0b6818f6..7734abf6c3f 100644 --- a/src/wolfio.c +++ b/src/wolfio.c @@ -652,8 +652,9 @@ int wolfIO_SockIsDGram(int sfd) /* optvalue 'type' is of size int */ XSOCKLENT length = (XSOCKLENT)sizeof(type); - if (getsockopt(sfd, SOL_SOCKET, SO_TYPE, (XSOCKOPT_TYPE_OPTVAL_TYPE)&type, - &length) == 0 && type != SOCK_DGRAM) { + if (XSOCKET_GETSOCKOPT(sfd, SOL_SOCKET, SO_TYPE, + (XSOCKOPT_TYPE_OPTVAL_TYPE)&type, &length) == 0 && + type != SOCK_DGRAM) { return 0; } else { @@ -798,7 +799,7 @@ int EmbedReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx) #endif /* WOLFSSL_DTLS13 */ timeout.tv_sec = dtls_timeout; #endif /* USE_WINDOWS_API */ - if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout, + if (XSOCKET_SETSOCKOPT(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout, sizeof(timeout)) != 0) { WOLFSSL_MSG("setsockopt rcvtimeo failed"); } @@ -1029,7 +1030,7 @@ int EmbedGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *ctx) return BAD_FUNC_ARG; XMEMSET(&peer, 0, sizeof(peer)); - if (getpeername(sd, (SOCKADDR*)&peer, &peerSz) != 0) { + if (XSOCKET_GETPEERNAME(sd, (SOCKADDR*)&peer, &peerSz) != 0) { WOLFSSL_MSG("getpeername failed in EmbedGenerateCookie"); return GEN_COOKIE_E; } @@ -1562,7 +1563,7 @@ int wolfIO_TcpConnect(SOCKET_T* sockfd, const char* ip, word16 port, int to_sec) (void)to_sec; #endif /* HAVE_IO_TIMEOUT */ - ret = connect(*sockfd, (SOCKADDR *)&addr, sockaddr_len); + ret = XSOCKET_CONNECT(*sockfd, (SOCKADDR *)&addr, sockaddr_len); #ifdef HAVE_IO_TIMEOUT if ((ret != 0) && (to_sec > 0)) { #ifdef USE_WINDOWS_API @@ -1643,14 +1644,15 @@ int wolfIO_TcpBind(SOCKET_T* sockfd, word16 port) { int optval = 1; XSOCKLENT optlen = sizeof(optval); - ret = setsockopt(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, optlen); + ret = XSOCKET_SETSOCKOPT(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, + optlen); } #endif if (ret == 0) - ret = bind(*sockfd, (SOCKADDR *)sin, sockaddr_len); + ret = XSOCKET_BIND(*sockfd, (SOCKADDR *)sin, sockaddr_len); if (ret == 0) - ret = listen(*sockfd, SOMAXCONN); + ret = XSOCKET_LISTEN(*sockfd, SOMAXCONN); if (ret != 0) { WOLFSSL_MSG("wolfIO_TcpBind failed"); diff --git a/wolfssl/test.h b/wolfssl/test.h index 57906a3b793..6c506a5e265 100644 --- a/wolfssl/test.h +++ b/wolfssl/test.h @@ -224,6 +224,27 @@ #define SOCKET_T int #define WOLFSSL_USE_GETADDRINFO + #if KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr 4.1 dropped CONFIG_NET_SOCKETS_POSIX_NAMES, so this harness calls + * the zsock_ API. Function-like on purpose: an object-like macro would also + * rewrite identically named structure members, such as sendto/recvfrom in + * WOLFSSL_DTLS_CTX or Zephyr's own struct socket_op_vtable. */ + #define socket(a,b,c) zsock_socket((a),(b),(c)) + #define bind(a,b,c) zsock_bind((a),(b),(c)) + #define connect(a,b,c) zsock_connect((a),(b),(c)) + #define listen(a,b) zsock_listen((a),(b)) + #define accept(a,b,c) zsock_accept((a),(b),(c)) + #define send(a,b,c,d) zsock_send((a),(b),(c),(d)) + #define recv(a,b,c,d) zsock_recv((a),(b),(c),(d)) + #define sendto(a,b,c,d,e,f) zsock_sendto((a),(b),(c),(d),(e),(f)) + #define recvfrom(a,b,c,d,e,f) zsock_recvfrom((a),(b),(c),(d),(e),(f)) + #define setsockopt(a,b,c,d,e) zsock_setsockopt((a),(b),(c),(d),(e)) + #define getsockopt(a,b,c,d,e) zsock_getsockopt((a),(b),(c),(d),(e)) + #define shutdown(a,b) zsock_shutdown((a),(b)) + #define getpeername(a,b,c) zsock_getpeername((a),(b),(c)) + #define getsockname(a,b,c) zsock_getsockname((a),(b),(c)) + #endif + #if !defined(CONFIG_POSIX_API) #define SOL_SOCKET 1 static unsigned long inet_addr(const char *cp) diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index a57a4c06b7d..e9003a5448d 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3168,34 +3168,10 @@ void *z_realloc(void *ptr, size_t size); #define realloc z_realloc - #if KERNEL_VERSION_NUMBER >= 0x40100 - /* Zephyr >= 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES and the - * corresponding macro block in . - * Define our own compile-time remapping to zsock_* so that wolfSSL - * always calls Zephyr's network stack directly, avoiding host-libc - * symbol conflicts on native_sim. */ - #define socket zsock_socket - #define bind zsock_bind - #define connect zsock_connect - #define listen zsock_listen - #define accept zsock_accept - #define send zsock_send - #define recv zsock_recv - #define sendto zsock_sendto - #define recvfrom zsock_recvfrom - #define setsockopt zsock_setsockopt - #define getsockopt zsock_getsockopt - #define shutdown zsock_shutdown - #define getpeername zsock_getpeername - #define getsockname zsock_getsockname - /* Note: close, poll, inet_pton, inet_ntop are NOT remapped here. - * They are general POSIX functions still declared in Zephyr's POSIX - * headers; redefining them conflicts with __syscall declarations in - * . close is handled via CloseSocket in wolfio.h, - * inet_pton/inet_ntop via XINET_PTON/XINET_NTOP in wolfio.h. */ - #else - /* Zephyr < 4.1: define CONFIG_NET_SOCKETS_POSIX_NAMES so that - * provides the POSIX name remapping macros. */ + /* Zephyr < 4.1: ask for the POSIX socket names. Newer + * Zephyr dropped this option; wolfSSL reaches the zsock_* API by name + * through the XSOCKET_* macros in wolfio.h instead. */ + #if KERNEL_VERSION_NUMBER < 0x40100 #if !defined(CONFIG_NET_SOCKETS_POSIX_NAMES) && !defined(CONFIG_POSIX_API) #define CONFIG_NET_SOCKETS_POSIX_NAMES #endif diff --git a/wolfssl/wolfcrypt/wc_port.h b/wolfssl/wolfcrypt/wc_port.h index 5e4d758c867..b69e13c4bd8 100644 --- a/wolfssl/wolfcrypt/wc_port.h +++ b/wolfssl/wolfcrypt/wc_port.h @@ -2058,11 +2058,20 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void); #if !defined(NO_FILESYSTEM) #define wc_fopen_owner_only(path) XFOPEN((path), "w+b") #endif +#if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr offers these under their zsock_ names in every configuration; + * the POSIX aliases need the compat mode from 4.4 on. */ + #define wc_socket_cloexec(domain, type, protocol) \ + zsock_socket((domain), (type), (protocol)) + #define wc_accept_cloexec(sockfd, addr, addrlen) \ + zsock_accept((sockfd), (addr), (addrlen)) +#else #define wc_socket_cloexec(domain, type, protocol) \ socket((domain), (type), (protocol)) #define wc_accept_cloexec(sockfd, addr, addrlen) \ accept((sockfd), (addr), (addrlen)) #endif +#endif #ifdef __cplusplus } /* extern "C" */ diff --git a/wolfssl/wolfio.h b/wolfssl/wolfio.h index 2194c254c29..4572d598592 100644 --- a/wolfssl/wolfio.h +++ b/wolfssl/wolfio.h @@ -497,8 +497,24 @@ #define WOLFSSL_MAX_SEND_SZ 256 #endif - #define SEND_FUNCTION send - #define RECV_FUNCTION recv + #if KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES. The zsock_ names + * are always present; the types and constants below still need + * CONFIG_NET_NAMESPACE_COMPAT_MODE from 4.4 on. */ + #define SEND_FUNCTION zsock_send + #define RECV_FUNCTION zsock_recv + #define DTLS_SENDTO_FUNCTION zsock_sendto + #define DTLS_RECVFROM_FUNCTION zsock_recvfrom + #define XSOCKET_BIND zsock_bind + #define XSOCKET_CONNECT zsock_connect + #define XSOCKET_LISTEN zsock_listen + #define XSOCKET_GETSOCKOPT zsock_getsockopt + #define XSOCKET_SETSOCKOPT zsock_setsockopt + #define XSOCKET_GETPEERNAME zsock_getpeername + #else + #define SEND_FUNCTION send + #define RECV_FUNCTION recv + #endif #elif defined(WOLFSSL_LINUXKM) #define SEND_FUNCTION linuxkm_send #define RECV_FUNCTION linuxkm_recv @@ -513,6 +529,28 @@ #endif #endif +/* Socket calls wolfSSL makes that have no wrapper of their own. A port that + * spells them differently overrides these above; everyone else gets the BSD + * names, so the expansion is unchanged. */ +#ifndef XSOCKET_BIND + #define XSOCKET_BIND bind +#endif +#ifndef XSOCKET_CONNECT + #define XSOCKET_CONNECT connect +#endif +#ifndef XSOCKET_LISTEN + #define XSOCKET_LISTEN listen +#endif +#ifndef XSOCKET_GETSOCKOPT + #define XSOCKET_GETSOCKOPT getsockopt +#endif +#ifndef XSOCKET_SETSOCKOPT + #define XSOCKET_SETSOCKOPT setsockopt +#endif +#ifndef XSOCKET_GETPEERNAME + #define XSOCKET_GETPEERNAME getpeername +#endif + #ifndef WOLFSSL_NO_SOCK #ifndef XSOCKLENT #ifdef USE_WINDOWS_API From 7fcce5ee56bd7edc7f93b06a9056389b3a5b7876 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Fri, 11 Sep 2026 11:57:48 +0200 Subject: [PATCH 4/6] zephyr: add Kconfig options for OCSP and OCSP stapling Nothing in the module exposed HAVE_OCSP or the certificate status request extension, so a Kconfig-driven build had no way to ask a TLS server to staple an OCSP response for its own certificate. Both stay off by default. --- .wolfssl_known_macro_extras | 2 ++ zephyr/Kconfig | 16 ++++++++++++++++ zephyr/user_settings.h | 8 ++++++++ 3 files changed, 26 insertions(+) diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 02f4e52f550..d7caf5cd2bf 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -212,6 +212,8 @@ CONFIG_WOLFSSL_MAX_FRAGMENT_LEN CONFIG_WOLFSSL_MLDSA CONFIG_WOLFSSL_MLKEM CONFIG_WOLFSSL_NO_ASN_STRICT +CONFIG_WOLFSSL_OCSP +CONFIG_WOLFSSL_OCSP_STAPLING CONFIG_WOLFSSL_OPENSSL_EXTRA_X509_SMALL CONFIG_WOLFSSL_PSK CONFIG_WOLFSSL_RSA diff --git a/zephyr/Kconfig b/zephyr/Kconfig index 1e96b8bf46b..f49401953ac 100644 --- a/zephyr/Kconfig +++ b/zephyr/Kconfig @@ -204,6 +204,22 @@ config WOLFSSL_SESSION_CACHE help Enable the TLS session cache (SMALL_SESSION_CACHE; NO_SESSION_CACHE off). +config WOLFSSL_OCSP + bool "wolfSSL OCSP certificate revocation checking" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default n + help + Enable OCSP (HAVE_OCSP). + +config WOLFSSL_OCSP_STAPLING + bool "wolfSSL OCSP stapling" + depends on WOLFSSL_OCSP + default n + help + Enable the TLS certificate status request extension + (HAVE_CERTIFICATE_STATUS_REQUEST), with which a client asks the server + to staple an OCSP response for its own certificate to the handshake. + config WOLFSSL_SESSION_TICKET bool "wolfSSL TLS session tickets" default y diff --git a/zephyr/user_settings.h b/zephyr/user_settings.h index caacdd2e116..449817e36a4 100644 --- a/zephyr/user_settings.h +++ b/zephyr/user_settings.h @@ -209,6 +209,14 @@ extern "C" { #define IGNORE_NAME_CONSTRAINTS #endif +/* OCSP */ +#if defined(CONFIG_WOLFSSL_OCSP) + #define HAVE_OCSP +#endif +#if defined(CONFIG_WOLFSSL_OCSP_STAPLING) + #define HAVE_CERTIFICATE_STATUS_REQUEST +#endif + /* Session Cache */ #if defined(CONFIG_WOLFSSL_SESSION_CACHE) #define SMALL_SESSION_CACHE From 1e34406ed966f180eecefde5c50c5ef839c0b4b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Fri, 11 Sep 2026 12:09:58 +0200 Subject: [PATCH 5/6] zephyr: add a Kconfig option for the crypto callback interface WOLF_CRYPTO_CB reached a Kconfig-driven build only through wolfTPM, so an application with a crypto device of its own had no way to enable the callback interface, and no way to reach WOLF_PRIVATE_KEY_ID with it - which is what lets a TLS private key stay on that device rather than sit in the application's memory. A port that brings its own device should keep defining WOLF_CRYPTO_CB from its own option rather than selecting this one: a select reaches a settings-file build, where the settings file is authoritative over anything that changes struct layouts. --- .wolfssl_known_macro_extras | 1 + zephyr/Kconfig | 11 +++++++++++ zephyr/user_settings.h | 8 +++++++- 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index d7caf5cd2bf..d7ccfdafe64 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -189,6 +189,7 @@ CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL CONFIG_WOLFSSL_CERTIFICATE_BUNDLE CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE CONFIG_WOLFSSL_CHACHA_POLY +CONFIG_WOLFSSL_CRYPTO_CB CONFIG_WOLFSSL_CRYPTO_ONLY CONFIG_WOLFSSL_CURVE25519 CONFIG_WOLFSSL_DTLS diff --git a/zephyr/Kconfig b/zephyr/Kconfig index f49401953ac..b4eeaf2c84b 100644 --- a/zephyr/Kconfig +++ b/zephyr/Kconfig @@ -111,6 +111,17 @@ config WOLFCRYPT_FIPS_READY endchoice +config WOLFSSL_CRYPTO_CB + bool "wolfCrypt crypto callbacks" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default n + help + Enable the crypto callback interface (WOLF_CRYPTO_CB), through which an + application registers a device with wc_CryptoCb_RegisterDevice() and + routes wolfCrypt operations to it. Also enables key references + (WOLF_PRIVATE_KEY_ID), which is what lets a TLS key live on that device + instead of in the application's memory. + config WOLFSSL_CRYPTO_ONLY bool "Build wolfCrypt only (no TLS layer)" depends on WOLFSSL_BUILTIN diff --git a/zephyr/user_settings.h b/zephyr/user_settings.h index 449817e36a4..fe8f98074a2 100644 --- a/zephyr/user_settings.h +++ b/zephyr/user_settings.h @@ -279,9 +279,15 @@ extern "C" { #define WOLFSSL_SET_CIPHER_BYTES #endif +#if defined(CONFIG_WOLFSSL_CRYPTO_CB) + #define WOLF_CRYPTO_CB +#endif + /* wolfTPM Zephyr */ #if defined(CONFIG_WOLFTPM) - #define WOLF_CRYPTO_CB + #ifndef WOLF_CRYPTO_CB + #define WOLF_CRYPTO_CB + #endif #define WOLFSSL_AES_CFB #endif From 1d3f15de58b11225c736e268deecc5861ad20c97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Mon, 7 Sep 2026 07:15:51 +0200 Subject: [PATCH 6/6] benchmark: label the GMAC rows by the device that ran them bench_gmac_internal() passed a literal 0 as useDeviceID to bench_stats_sym_finish(), so with BENCH_DEVID defined both the software and the hardware run printed "SW", and bench_stats_add() merged them into one entry because it keys on that value too. On an accelerator where GMAC goes from 146 KiB/s to 8.7 MiB/s the mislabelling is easy to spot, but the table said the two were the same measurement. --- wolfcrypt/benchmark/benchmark.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 3e6b8b304cf..ca01b9f4555 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -6498,7 +6498,8 @@ static void bench_gmac_internal(int useDeviceID, word32 ivSz, wc_AesFree((Aes*)&gmac); - bench_stats_sym_finish(gmacStr, 0, count, bench_size, start, ret); + bench_stats_sym_finish(gmacStr, useDeviceID, count, bench_size, start, + ret); #ifdef MULTI_VALUE_STATISTICS bench_multi_value_stats(max, min, sum, squareSum, runs); #endif