random: add WC_RNG_SEED_DEVICE to seed from a nominated device

[dgarske]

Adds WC_RNG_SEED_DEVICE, an optional macro naming a device to seed the DRBG from before the default sources, for platforms that expose a hardware RNG such as /dev/hwrng (the NXP i.MX95 EdgeLock Secure Enclave, among others). Its value is a quoted string, set either by autotools --with-rng-seed-device=PATH, by CMake -DWOLFSSL_RNG_SEED_DEVICE=PATH, or directly as #define WC_RNG_SEED_DEVICE "/dev/hwrng" in user_settings.h; the two build systems take an unquoted path and add the quoting for you. The device attempt is self-contained and strictly additive: any failure to open or fill it falls through to the untouched getrandom() -> /dev/urandom -> /dev/random chain, so a default build is unchanged. Also fixes two pre-existing bugs in wc_GenerateSeed() (happy to split these out): WOLFSSL_KEEP_RNG_SEED_FD_OPEN with NO_DEV_URANDOM does not compile on master due to a dangling else, and the seed read loop spins forever if read() returns 0. Two new os-check-linux CI configs cover the device and fallback paths.

[Copilot]

Pull request overview

Adds an opt-in mechanism for seeding the wolfCrypt DRBG from a nominated device (e.g. /dev/hwrng) before the existing OS entropy fallback chain, and tightens up edge cases in the existing filesystem seeding path. This fits into wolfcrypt/src/random.c’s platform entropy acquisition (wc_GenerateSeed) and the build-system knobs that control it.

Changes:

• Add WC_RNG_SEED_DEVICE support to attempt seeding from a configured device before the existing sources, with best-effort fallback.
• Fix wc_GenerateSeed() filesystem seeding edge cases (compile issue in WOLFSSL_KEEP_RNG_SEED_FD_OPEN + avoid infinite loop on read() returning 0).
• Add Autotools/CMake configuration switches and Linux CI configs to exercise both the device and fallback paths.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfcrypt/src/random.c	Adds WC_RNG_SEED_DEVICE seeding attempt and fixes /dev/*random seeding loop/FD-open logic.
configure.ac	Introduces --with-rng-seed-device=PATH to define WC_RNG_SEED_DEVICE in Autotools builds.
CMakeLists.txt	Adds WOLFSSL_RNG_SEED_DEVICE cache option to emit -DWC_RNG_SEED_DEVICE=... for CMake builds.
cmake/options.h.in	Adds WC_RNG_SEED_DEVICE to generated options.h for CMake parity.
.github/configs/os-check-linux.json	Adds two Linux CI configurations to cover the device and fallback seeding paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

Jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11216

Scan targets checked: wolfcrypt-bugs, wolfcrypt-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.