Add WOLFSSL_ASYNC_CERT_YIELD: per-certificate non-blocking yield

[dgarske]

Adds an opt-in build option, WOLFSSL_ASYNC_CERT_YIELD, that makes ProcessPeerCerts() return WC_PENDING_E to the caller after each certificate in the peer's chain (and after the leaf) is verified, instead of verifying the whole chain in one wolfSSL_connect() / wolfSSL_accept() call. This lets a cooperative, single-threaded scheduler regain control between certificates to service a watchdog. Requires WOLFSSL_ASYNC_CRYPT; off by default. Independent of WC_ECC_NONBLOCK (which subdivides each verify further).

ZD 21071

[Copilot]

Pull request overview

Adds an opt-in asynchronous handshake behavior (WOLFSSL_ASYNC_CERT_YIELD) to cooperatively yield control between peer certificate chain elements during verification, returning WC_PENDING_E after each certificate so single-threaded schedulers can regain control (e.g., to service a watchdog).

Changes:

• Add a persistent ssl->options.certYieldPending flag (gated on WOLFSSL_ASYNC_CRYPT && WOLFSSL_ASYNC_CERT_YIELD) to reliably distinguish “fresh entry” vs “resume after deliberate yield”.
• Update ProcessPeerCerts() to deliberately return WC_PENDING_E after each chain certificate verify and once after the leaf verify, and to resume correctly on re-entry.
• Extend async examples + CI to exercise multi-certificate chains (--cert-chain) and validate the yield behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfssl/internal.h	Adds Options.certYieldPending bit to persist deliberate-yield state across re-entry.
src/ssl.c	Clears certYieldPending in wolfSSL_clear() so abandoned handshakes can restart cleanly.
src/internal.c	Implements per-certificate WC_PENDING_E yield points in ProcessPeerCerts() and a re-entry path keyed by certYieldPending.
README-async.md	Documents WOLFSSL_ASYNC_CERT_YIELD, intended usage model, and the “no async event queued” caveat.
examples/async/async_server.c	Adds --cert-chain option and constructs a 2-cert ECC chain in-memory for testing peer chain processing.
examples/async/async_client.c	Adds --cert-chain option and loads the appropriate CA buffer for verifying the presented chain.
.github/workflows/async-examples.yml	Adds a CI job to build/run async examples with -DWOLFSSL_ASYNC_CERT_YIELD and assert expected yielding behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753