[padelsbach]

Follow up on #39. The static/fixed PSA_WANT_* flags may not match what wolfPSA+wolfCrypt actually support. Instead, generate them in the manner already used by the Zephyr build.

[Copilot]

🟡 Changes recommended

Incorrect export-size maxima cause valid ML-KEM and standalone Ed25519/X25519 key exports to fail with undersized buffers, and the probe also misses feature definitions supplied through config.h.

2 open issues

• Include ML-KEM public keys in export-size maximum · New
• Add Edwards backends to export-size flag mapping · New

What changed in this PR

This PR derives the Makefile build’s PSA_WANT_* flags from wolfCrypt configuration, extending the approach used by Zephyr. It also adds TF-PSA-Crypto compatibility helpers following #39.

Changes:

• Share configuration-generation tools between Makefile and Zephyr builds.
• Add compatibility headers, cleanup, and secure-zeroization functions.
• Add feature-surface and lifecycle regression tests.

File	Description
zephyr/​CMakeLists.txt	Use shared generator and probe paths.
wolfpsa/​tf-psa-crypto/​build_info.h	Define compatibility feature macros.
wolfpsa/​psa/​crypto.h	Include compatibility features and extensions.
wolfpsa/​psa/​crypto_extra.h	Declare cleanup and service-key helpers.
wolfpsa/​psa/​crypto_config.h	Replace fixed flags with generated configuration.
wolfpsa/​psa_engine.h	Declare internal crypto cleanup.
wolfpsa/​mbedtls/​platform.h	Map platform helpers to C library functions.
wolfpsa/​mbedtls/​platform_util.h	Declare secure zeroization.
wolfpsa.map	Export new compatibility functions.
tools/​psa_want_probe.c	Support standalone settings and refine curve detection.
tools/​gen-crypto-config.py	Support both builds and preserve unchanged output timestamps.
test/​psa_server/​psa_want_surface_test.c	Check advertised capabilities and buffer maxima.
test/​psa_server/​psa_tf_psa_extra_test.c	Test cleanup, key-ID helpers, and zeroization.
test/​psa_server/​psa_devid_cryptocb_test.c	Test callbacks across cleanup and reinitialization.
test/​Makefile	Build new regression tests.
src/​psa_tf_psa.c	Implement compatibility functions.
src/​psa_crypto.c	Implement key-storage and wolfCrypt cleanup.
Makefile	Generate configuration and register new tests.
.gitignore	Ignore generated configuration and test binaries.

_{Review effort: Balanced}

[Frauschi]

Nice to have the Makefile surface come from the real config. I built it locally: the default config and the new surface test pass, the no-filesystem lane drops MBEDTLS_FS_IO, and a no-ECC lane drops the secp/ECDSA wants as expected. The comments are mostly about the size macros, where the generated header lives, and the Zephyr probe path.

A possible follow-up from #39, which could go into this PR if you like: the mbedtls_psa_crypto_free() comment in crypto_extra.h says it unregisters the crypto callbacks, but wolfPSA_CryptoCleanup() only drops one wolfCrypt reference. If wolfSSL or the application also called wolfCrypt_Init(), the callbacks stay registered, so the comment should say they are unregistered only when PSA held the last reference.

[Copilot]

🟡 Changes recommended

Unresolved export-sizing and configuration-handling defects can cause buffer errors, stale backend objects, broken non-default builds, and incorrect feature-test results.

4 open issues

• Preserve absolute BUILD_DIR paths in test include paths · New
• Require SHA-256 support in expected-support conditions · New
• Resolve benchmark header path from the selected BUILD_DIR · New
• Include Ed448's 57-byte seed in the export maximum · New

2 previously missed issues

In code that hasn't changed since last review

Rebuild wolfCrypt objects when generated feature flags change

Makefile:150

Changing feature flags in an existing BUILD_DIR regenerates this header and rebuilds the PSA objects, but leaves bundled wolfCrypt objects compiled with the old flags. For example, enabling a previously disabled Ed448 backend introduces frontend references to functions absent from the cached backend object. Make both normal and position-independent wolfCrypt objects depend on the generated header so capability changes rebuild both sides together.

Recompile surface tests when generated feature flags change

test/​Makefile:197

The new surface-test object has no dependency on the generated configuration header. After rebuilding wolfPSA with a different feature configuration, this rule relinks the old object with stale PSA_WANT_* expectations, producing false failures against the new library. Add the generated header as a prerequisite of psa_want_surface_test.o so its expectations are recompiled when the advertised features change.

2 resolved since last review

• Add Edwards backends to export-size flag mapping
• Include ML-KEM public keys in export-size maximum

_{Review effort: Balanced}

[Frauschi]

Approving on the understanding that #41 lands too, since it brings the 57-byte Ed448 key-pair export size.

[Frauschi]

This conflicts with #41, which defaults BUILD_TARGET to libwolfpsa.so for the -z defs check. want-surface-test only links the static library, so making it depend on $(SHLIBNAME) as well would keep both checks.

[Frauschi]

#41 adds the same EdDSA PSA_SIGNATURE_MAX_SIZE term via PSA_VENDOR_ECC_SIGNATURE_SIZE(), and git merges both copies without a conflict, so whichever PR lands second should drop its copy.