Skip to content

Fix mcxn build by providing the RNG for TZ_PSA builds#785

Merged
danielinux merged 1 commit into
wolfSSL:masterfrom
AlexLanzano:nxp-mcxn-ci-fix
May 26, 2026
Merged

Fix mcxn build by providing the RNG for TZ_PSA builds#785
danielinux merged 1 commit into
wolfSSL:masterfrom
AlexLanzano:nxp-mcxn-ci-fix

Conversation

@AlexLanzano
Copy link
Copy Markdown
Member

@AlexLanzano AlexLanzano commented May 26, 2026

Summary

Fixes the nxp_mcxn_tz_psa_test and nxp_mcxn_tz_psa_hw_test builds, which started failing after the wolfSSL submodule bump to 5.8.2. The new release added a compile-time check that refuses WC_NO_RNG together with any blinding macro (WC_RSA_BLINDING / WOLFSSL_CURVE25519_BLINDING / WOLFSSL_ECC_BLIND_K) — and the MCXN TZ-PSA test-app build was hitting exactly that combination.

Changes

  • test-app/Makefile: stop defaulting TEST_APP_NO_RNG=1 for mcxn when WOLFCRYPT_TZ_PSA=1. The TZ-PSA build already has a PSA-backed entropy source on the NS side (hal_trng_psa.cpsa_generate_random), so there's no reason to force-disable the RNG. The default is unchanged for mcxa/mcxw and for the non-PSA mcxn configs.

  • test-app/wcs/user_settings.h: when WOLFCRYPT_TZ_PSA is set, wire CUSTOM_RAND_GENERATE_BLOCK to a thin shim over hal_trng_get_entropy(). This gives wolfCrypt a working RNG without pulling in HASHDRBG, and routes every random byte through the PSA TRNG.

Note

I don't have the hardware to test this change

Copilot AI review requested due to automatic review settings May 26, 2026 14:04
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the test application build and wolfCrypt/wolfSSL user settings to ensure TrustZone PSA (WOLFCRYPT_TZ_PSA) builds on MCX targets (notably mcxn) have a functional RNG source, instead of defaulting to WC_NO_RNG.

Changes:

  • Add a PSA-mode RNG hook in test-app/wcs/user_settings.h by wiring CUSTOM_RAND_GENERATE_BLOCK to hal_trng_get_entropy().
  • Adjust test-app/Makefile so MCX targets only default to TEST_APP_NO_RNG=1 when not building with WOLFCRYPT_TZ_PSA=1.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
test-app/wcs/user_settings.h Adds a PSA-specific CUSTOM_RAND_GENERATE_BLOCK implementation using hal_trng_get_entropy().
test-app/Makefile Avoids forcing WC_NO_RNG defaults on MCX targets when WOLFCRYPT_TZ_PSA=1 is enabled.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread test-app/wcs/user_settings.h
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comment thread test-app/wcs/user_settings.h
@danielinux danielinux merged commit a41a985 into wolfSSL:master May 26, 2026
379 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants