[jackctj117]

Description

Master's Zephyr module builds the v7 and FIPS Ready boundaries but not a v5 one. Dropping in a v5 bundle fails in three ways. This PR fixes all three without touching any source inside the boundary, and adds v5.2.3 as a Kconfig choice.

zephyr: build the FIPS v5 boundary

• wc_PRF_fips, wc_PRF_TLSv12_fips, wc_Tls13_HKDF_Extract_fips and wc_SSH_KDF_fips are defined twice at link. The v5 kdf.c predates libwolfssl_sources.h, so nothing defines BUILDING_WOLFSSL. types.h then includes wc_compat.h, which reaches fips.h before kdf.c sets FIPS_NO_WRAPPERS. The module now defines BUILDING_WOLFSSL for the library sources only, as the top-level CMakeLists.txt already does.
• random.c cannot find <random/rand32.h>. Under CONFIG_WOLFCRYPT_FIPS_V5, zephyr/fips-v5-compat/ is added to the library's include path. Its random/rand32.h and posix/time.h shims map onto the current headers; the module needs Zephyr 3.7 or later anyway, because CONFIG_WOLFCRYPT_FIPS selects STATIC_INIT_GNU.
• The v5 branch of the settings sets only version numbers. It now also defines:
  • NO_THREAD_LS, because THREAD_LS_T is empty on Zephyr and HAVE_THREAD_LS would only drop the ECC/SP cache locks;
  • WOLFSSL_ECDSA_SET_K, which the ECDSA CAST needs;
  • WC_RNG_SEED_CB, with wolfssl_zephyr_seed as WC_GENERATE_SEED_DEFAULT, because both v5 bundles' wc_GenerateSeed() is a bare sys_rand_get(). The callback, in zephyr/zephyr_init.c, seeds from the Zephyr CSPRNG, which reads the zephyr,entropy device; a board with no entropy driver fails the build unless CONFIG_TEST_RANDOM_GENERATOR is set, and CMake stops a build whose CSPRNG is not the hardware-driver one, since Zephyr 4.4 routes both the CTR-DRBG and the PSA generators through PSA Crypto, so the seed never passes through a DRBG outside the module. wolfSSL_Init() registers it, and an APPLICATION-level SYS_INIT hook, which runs after the POST constructor, registers it for wolfCrypt-only builds and logs a failure.
• The integrity-layout guards now apply to every FIPS boundary rather than only the v7 one, because v5 hashes the same two ranges. These guards are the CONFIG_LINKER_SORT_BY_ALIGNMENT check, the no-section-splitting flags and the dedicated rodata section. The Kconfig help and the README say to set CONFIG_LINKER_SORT_BY_ALIGNMENT=n, which Zephyr defaults on.
• Symmetric assembly stays off under FIPS v2, v5 and v6 (WOLFCRYPT_FIPS_PRE_V7_ASM). Their aes.c/sha256.c expect the boundary's own armv8-*.c assembly, which this module does not build, and on x86_64 their sha256.c would call the tree's sha256_asm.S from outside the boundary. CONFIG_WOLFCRYPT_ASM still accelerates the SP math.
• The ML-KEM, ML-DSA, XMSS and Falcon options are unavailable under v2 and v5, whose boundaries have no SHAKE, as Ed448 already was.

zephyr: add FIPS v5.2.3 as a Kconfig choice

• CONFIG_WOLFCRYPT_FIPS_V5_2_3, under a new v5 bundle choice that defaults to 5.2.1, sets HAVE_FIPS_VERSION_PATCH 3. user_settings.h then includes user_settings-fips-v5.2.3.h for the --enable-fips=v5.2.3 algorithm set, the way v7 includes its own file. TLS, certificate and platform options keep following Kconfig.
• The choice selects WOLFSSL_RSA, WOLFSSL_ECC and WOLFSSL_ECC_256, which user_settings.h would otherwise be able to disable after the set.
• WOLFSSL_SP_SMALL_STACK moves the 4096-bit mod-exp temporaries to the heap. It only affects sp_*.c, which are outside the boundary.

zephyr: test RNG init without wolfcrypt_test()

• The condvar ztest in zephyr/tests/wolfssl_condvar gains a case that calls wc_InitRng(). Its image calls neither wolfSSL_Init() nor wolfcrypt_test(), both of which register the seed callback themselves and so let the test sample pass with a broken boot hook; here nothing else registers it, and under FIPS v5 wc_InitRng() fails with DRBG_NO_SEED_CB unless the hook ran. CI already runs this test, plain and crypto-only, on native_sim without a bundle; the README shows the hand run with a 5.2.1 or 5.2.3 bundle. No new files.

Testing

• Reviewer: master with the v5.2.3 boundary built and the native_sim POST and wolfCrypt tests passed, on native_sim and on a Cortex-A53, with the first round of build fixes.
• Host compile of the v5.2.3 and the v5.2.1 bundle sources through user_settings.h, each with its Kconfig defaults: no warnings with -Wall, no symbol defined in more than one object, ssl.o references the seed callback for both, CONFIG_WOLFSSL_CERT_GEN honoured, and no SHAKE symbol in the v5.2.3 sha3.o.
• zephyr_init.c compiled against stub Zephyr headers with no warnings under -Wall -Wextra in every combination of CONFIG_WOLFSSL_SYS_INIT, CONFIG_WOLFCRYPT_FIPS_V5 and crypto-only, with the CSPRNG and with CONFIG_TEST_RANDOM_GENERATOR; the #error fires with neither.
• Kconfig parsed with kconfiglib for v2, v5.2.1, v5.2.3, v6, v7 and Ready: v5.2.3 keeps RSA, ECC and P-256 on when they are set off, the four PQC options are off under v2 and v5, and the symmetric assembly is off under v2, v5 and v6 and on under v7 and Ready.
• The condvar test file compiled on the host against the tree's wolfCrypt, built with WC_RNG_SEED_CB, through a stand-in ztest.h, and run three ways: with the tree's default seed callback and with one registered from a constructor it passes; with the callback cleared, which is the state of a v5 bundle before registration, wc_InitRng() returns RNG_FAILURE_E and the test fails. Not yet built under Zephyr.
• The bundle build itself has not yet been run under Zephyr after the rework.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Legacy Zephyr header compatibility and concurrent initialization behavior need correction before approval.

2 open issues

• Restrict compatibility headers to Zephyr 3.1 and newer · New
• Avoid shared initialization guard when thread-local storage is unavailable · New

What changed in this PR

This PR enables the Zephyr module to build a FIPS v5 bundle without modifying sources inside the FIPS boundary.

Changes:

• Defines BUILDING_WOLFSSL for library sources to prevent duplicate KDF wrapper symbols.
• Adds and distributes compatibility headers for legacy random and time includes.
• Enables configuration macros needed by v5 initialization and ECDSA self-tests.

File	Description
zephyr/​user_settings.h	Adds FIPS v5 thread-local and ECDSA settings.
zephyr/​include.am	Includes both compatibility headers in source distributions.
zephyr/​fips-v5-compat/​random/​rand32.h	Maps the legacy random include to newer Zephyr headers.
zephyr/​fips-v5-compat/​posix/​time.h	Maps the legacy time include to available headers.
zephyr/​CMakeLists.txt	Adds library-only build definitions and the v5 compatibility include path.

_{Review effort: Balanced}

[github-actions]

retest this please

[jackctj117]

@claude review

[claude]

Beyond the inline findings, I checked whether adding BUILDING_WOLFSSL only to the library in zephyr/CMakeLists.txt could make the library and the app disagree on struct layout. It can't: in the headers, that define only changes visibility, WARN_UNUSED_RESULT and deprecation attributes on declarations, and the top-level CMakeLists.txt already sets it the same way (PRIVATE).

Extended reasoning...

The PR changes Zephyr module build glue, adds two include shims and adds a FIPS v5.2.3 user_settings file. The inline findings already flag the settings-file problems. The hunt stopped at its bug limit rather than running out of candidates, so this is not an approval. The note above records one more concern that was checked and ruled out: the library-only define changes no struct layout.

Findings marked 🟡 are optional suggestions and need no follow-up push.

[Frauschi]

Nice to have the v5 boundary building. The two things I'd like sorted before this goes in are the integrity-layout guards, which v5 doesn't get yet, and the assembly that is still reachable through the Kconfig path. The rest are smaller.

[Frauschi]

Thanks for the quick rework, the earlier comments all look addressed. A few new things came up, mostly around the 5.2.1 and v6 paths and the Kconfig options that still reach into the v5.2.3 set.

[Frauschi]

@jackctj117 also, the Jenkins failure is legit.

[Frauschi]

LGTM, only Jenkins failure is this:

unrecognized macros used:
CONFIG_WOLFCRYPT_FIPS_LEGACY_ASM
CONFIG_WOLFCRYPT_FIPS_V5_2_3
add well-formed but unknown macros to .wolfssl_known_macro_extras at top of source tree.

[jackctj117]

Jenkins retest this please.

[philljj]

Retest this please.

(generic config toolchain)

addressed