adafruit · dhalbert · May 18, 2026 · May 12, 2026
diff --git a/lib/AnimatedGIF/gif.c b/lib/AnimatedGIF/gif.c
@@ -23,7 +23,7 @@
 //
 #include "AnimatedGIF_circuitpy.h"
 
-#ifdef HAL_ESP32_HAL_H_
+#ifndef memcpy_P
 #define memcpy_P memcpy
 #endif
 

diff --git a/lib/mbedtls_config/crt_bundle.c b/lib/mbedtls_config/crt_bundle.c
@@ -74,23 +74,32 @@ static int crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_b
     }
 
 
+    #if MBEDTLS_VERSION_MAJOR < 4
     // Fast check to avoid expensive computations when not necessary
     if (!mbedtls_pk_can_do(&parent.pk, child->MBEDTLS_PRIVATE(sig_pk))) {
         LOGE(TAG, "Simple compare failed");
         ret = -1;
         goto cleanup;
     }
+    #endif
 
     md_info = mbedtls_md_info_from_type(child->MBEDTLS_PRIVATE(sig_md));
     if ((ret = mbedtls_md(md_info, child->tbs.p, child->tbs.len, hash)) != 0) {
         LOGE(TAG, "Internal mbedTLS error %X", ret);
         goto cleanup;
     }
 
+    #if MBEDTLS_VERSION_MAJOR >= 4
+    if ((ret = mbedtls_pk_verify_ext(
+        child->MBEDTLS_PRIVATE(sig_pk), &parent.pk,
+        child->MBEDTLS_PRIVATE(sig_md), hash, mbedtls_md_get_size(md_info),
+        child->MBEDTLS_PRIVATE(sig).p, child->MBEDTLS_PRIVATE(sig).len)) != 0) {
+    #else
     if ((ret = mbedtls_pk_verify_ext(
         child->MBEDTLS_PRIVATE(sig_pk), child->MBEDTLS_PRIVATE(sig_opts), &parent.pk,
         child->MBEDTLS_PRIVATE(sig_md), hash, mbedtls_md_get_size(md_info),
         child->MBEDTLS_PRIVATE(sig).p, child->MBEDTLS_PRIVATE(sig).len)) != 0) {
+    #endif
 
         LOGE(TAG, "PK verify failed with error %X", ret);
         goto cleanup;

diff --git a/ports/zephyr-cp/Makefile b/ports/zephyr-cp/Makefile
@@ -23,6 +23,9 @@ endif
 
 .PHONY: $(BUILD)/zephyr-cp/zephyr/zephyr.elf flash recover debug debug-jlink debugserver attach run run-sim clean menuconfig all clean-all sim clean-sim test fetch-port-submodules
 
+export BSIM_COMPONENTS_PATH := $(CURDIR)/tools/bsim/components
+export BSIM_OUT_PATH := $(CURDIR)/tools/bsim
+
 $(BUILD)/zephyr-cp/zephyr/zephyr.elf:
 	python cptools/pre_zephyr_build_prep.py $(BOARD)
 	west build -b $(BOARD) -d $(BUILD) $(WEST_SHIELD_ARGS) --sysbuild -- $(WEST_CMAKE_ARGS)

diff --git a/ports/zephyr-cp/boards/frdm_rw612.conf b/ports/zephyr-cp/boards/frdm_rw612.conf
@@ -14,14 +14,9 @@ CONFIG_NET_HOSTNAME="circuitpython"
 
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
-CONFIG_MBEDTLS_RSA_C=y
-CONFIG_MBEDTLS_PKCS1_V15=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y
+CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
 CONFIG_MBEDTLS_ENTROPY_C=y
-CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
 CONFIG_MBEDTLS_CTR_DRBG_C=y
-CONFIG_MBEDTLS_SHA1=y
-CONFIG_MBEDTLS_USE_PSA_CRYPTO=n
 
 CONFIG_BT=y
 CONFIG_BT_PERIPHERAL=y

diff --git a/ports/zephyr-cp/boards/native/native_sim/autogen_board_info.toml b/ports/zephyr-cp/boards/native/native_sim/autogen_board_info.toml
@@ -94,7 +94,7 @@ sharpdisplay = true # Zephyr board has busio
 socketpool = true # Zephyr networking enabled
 spitarget = false
 ssl = false
-storage = true # Zephyr board has flash
+storage = true
 struct = true
 supervisor = true
 synthio = true # Zephyr board has audiobusio

diff --git a/ports/zephyr-cp/boards/native_sim.conf b/ports/zephyr-cp/boards/native_sim.conf
@@ -39,5 +39,5 @@ CONFIG_HEAP_MEM_POOL_SIZE=1024
 CONFIG_NET_LOG=y
 
 CONFIG_MBEDTLS=y
-CONFIG_MBEDTLS_SHA1=y
-CONFIG_MBEDTLS_SHA256=y
+CONFIG_PSA_WANT_ALG_SHA_1=y
+CONFIG_PSA_WANT_ALG_SHA_256=y
diff --git a/ports/zephyr-cp/boards/nrf7002dk_nrf5340_cpuapp.conf b/ports/zephyr-cp/boards/nrf7002dk_nrf5340_cpuapp.conf
@@ -2,7 +2,6 @@ CONFIG_NETWORKING=y
 CONFIG_WIFI=y
 
 CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
-CONFIG_MBEDTLS_USE_PSA_CRYPTO=n
 
 CONFIG_BT_DEVICE_APPEARANCE_DYNAMIC=y
 CONFIG_BT_DEVICE_NAME_DYNAMIC=y

diff --git a/ports/zephyr-cp/boards/rpi_pico2_rp2350a_m33_w.conf b/ports/zephyr-cp/boards/rpi_pico2_rp2350a_m33_w.conf
@@ -14,11 +14,6 @@ CONFIG_NET_HOSTNAME="circuitpython"
 
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
-CONFIG_MBEDTLS_RSA_C=y
-CONFIG_MBEDTLS_PKCS1_V15=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y
+CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
 CONFIG_MBEDTLS_ENTROPY_C=y
-CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
 CONFIG_MBEDTLS_CTR_DRBG_C=y
-CONFIG_MBEDTLS_SHA1=y
-CONFIG_MBEDTLS_USE_PSA_CRYPTO=n
diff --git a/ports/zephyr-cp/boards/rpi_pico_rp2040_w.conf b/ports/zephyr-cp/boards/rpi_pico_rp2040_w.conf
@@ -14,13 +14,8 @@ CONFIG_NET_HOSTNAME="circuitpython"
 
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
-CONFIG_MBEDTLS_RSA_C=y
-CONFIG_MBEDTLS_PKCS1_V15=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y
+CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
 CONFIG_MBEDTLS_ENTROPY_C=y
-CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
 CONFIG_MBEDTLS_CTR_DRBG_C=y
-CONFIG_MBEDTLS_SHA1=y
-CONFIG_MBEDTLS_USE_PSA_CRYPTO=n
 
 CONFIG_TEST_RANDOM_GENERATOR=y
diff --git a/ports/zephyr-cp/common-hal/busio/UART.h b/ports/zephyr-cp/common-hal/busio/UART.h
@@ -27,3 +27,7 @@ mp_obj_t common_hal_busio_uart_construct_from_device(busio_uart_obj_t *self, con
 
 // Internal helper for clearing buffer
 void common_hal_busio_uart_clear_rx_buffer(busio_uart_obj_t *self);
+
+// Zephyr-port-specific write-timeout accessors, used by usb_cdc/Serial.c.
+mp_float_t common_hal_busio_uart_get_write_timeout(busio_uart_obj_t *self);
+void common_hal_busio_uart_set_write_timeout(busio_uart_obj_t *self, mp_float_t write_timeout);
diff --git a/ports/zephyr-cp/common-hal/usb_cdc/Serial.c b/ports/zephyr-cp/common-hal/usb_cdc/Serial.c
@@ -7,6 +7,7 @@
 #include "shared/runtime/interrupt_char.h"
 #include "shared-bindings/usb_cdc/Serial.h"
 #include "shared-bindings/busio/UART.h"
+#include "common-hal/busio/UART.h"
 #include "supervisor/shared/tick.h"
 
 mp_obj_t common_hal_usb_cdc_serial_construct_from_device(usb_cdc_serial_obj_t *self, const struct device *uart_device, uint16_t receiver_buffer_size, byte *receiver_buffer) {

diff --git a/ports/zephyr-cp/common-hal/wifi/ScannedNetworks.c b/ports/zephyr-cp/common-hal/wifi/ScannedNetworks.c
@@ -16,6 +16,7 @@
 #include "shared-bindings/wifi/Network.h"
 #include "shared-bindings/wifi/Radio.h"
 #include "shared-bindings/wifi/ScannedNetworks.h"
+#include "bindings/zephyr_kernel/__init__.h"
 
 #include <zephyr/kernel.h>
 #include <zephyr/net/wifi_mgmt.h>

diff --git a/ports/zephyr-cp/cptools/build_circuitpython.py b/ports/zephyr-cp/cptools/build_circuitpython.py
@@ -520,7 +520,19 @@ async def build_circuitpython():
             ("-isystem", portdir / "modules" / "crypto" / "mbedtls" / "configs")
         )
         circuitpython_flags.extend(
-            ("-isystem", portdir / "modules" / "crypto" / "mbedtls" / "include")
+            ("-isystem", portdir / "modules" / "crypto" / "tf-psa-crypto" / "include")
+        )
+        circuitpython_flags.extend(
+            (
+                "-isystem",
+                portdir
+                / "modules"
+                / "crypto"
+                / "tf-psa-crypto"
+                / "drivers"
+                / "builtin"
+                / "include",
+            )
         )
         circuitpython_flags.extend(("-isystem", zephyrdir / "modules" / "mbedtls" / "configs"))
         if "ssl" in enabled_modules:

diff --git a/ports/zephyr-cp/cptools/zephyr2cp.py b/ports/zephyr-cp/cptools/zephyr2cp.py
@@ -350,6 +350,25 @@ def find_flash_devices(device_tree):
             )
             continue
 
+        # Skip soc-nv-flash nodes whose parent is itself a flash device — the
+        # parent is the real Zephyr device (e.g. nxp,imx-flexspi-nor) and the
+        # child has no driver-instantiated symbol.
+        if "soc-nv-flash" in compatible and node.parent is not None:
+            parent_compat = []
+            if "compatible" in node.parent.props:
+                parent_compat = node.parent.props["compatible"].to_strings()
+            parent_drivers = []
+            for c in parent_compat:
+                underscored = c.replace(",", "_").replace("-", "_")
+                d = COMPAT_TO_DRIVER.get(underscored) or MANUAL_COMPAT_TO_DRIVER.get(underscored)
+                if d:
+                    parent_drivers.append(d)
+            if "flash" in parent_drivers:
+                logger.debug(
+                    f"  skipping flash {node.labels[0] if node.labels else node.name} (parent is flash device)"
+                )
+                continue
+
         if node.labels:
             flashes.append(node.labels[0])
 

diff --git a/ports/zephyr-cp/prj.conf b/ports/zephyr-cp/prj.conf
@@ -9,6 +9,7 @@ CONFIG_FLASH_MAP_LABELS=y
 CONFIG_MAIN_STACK_SIZE=24288
 
 CONFIG_THREAD_STACK_INFO=y
+CONFIG_ARCH_POSIX_UPDATE_STACK_INFO=y
 CONFIG_STACK_SENTINEL=n
 CONFIG_DEBUG_THREAD_INFO=n
 CONFIG_EXCEPTION_STACK_TRACE=n
@@ -52,5 +53,6 @@ CONFIG_DYNAMIC_THREAD_PREFER_ALLOC=y
 
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
-CONFIG_MBEDTLS_SHA1=y
-CONFIG_MBEDTLS_SHA256=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_ALG_SHA_1=y
+CONFIG_PSA_WANT_ALG_SHA_256=y
diff --git a/ports/zephyr-cp/supervisor/port.c b/ports/zephyr-cp/supervisor/port.c
@@ -13,14 +13,15 @@
 #include "common-hal/audiobusio/I2SOut.h"
 #endif
 
+#include <stdlib.h>
+
 #include <zephyr/autoconf.h>
 #include <zephyr/kernel.h>
 #include <zephyr/sys/reboot.h>
 #include <zephyr/sys/util.h>
 
 #if defined(CONFIG_ARCH_POSIX)
 #include <limits.h>
-#include <stdlib.h>
 
 #include "cmdline.h"
 #include "posix_board_if.h"

diff --git a/.../zephyr-cp/tests/zephyr_display/golden/terminal_console_output_320x240.mask.png b/.../zephyr-cp/tests/zephyr_display/golden/terminal_console_output_320x240.mask.png
diff --git a/ports/zephyr-cp/zephyr-config/west.yml b/ports/zephyr-cp/zephyr-config/west.yml
@@ -8,6 +8,6 @@ manifest:
       path: modules/bsim_hw_models/nrf_hw_models
     - name: zephyr
       url: https://github.com/adafruit/zephyr
-      revision: d991bfc190507849d510326b24ba7b7a6c51a0e6
+      revision: e1dc85052bc8928572fdb972997c65eeb96f555b
       clone-depth: 100
       import: true
diff --git a/py/mpconfig.h b/py/mpconfig.h
@@ -26,6 +26,7 @@
 #ifndef MICROPY_INCLUDED_PY_MPCONFIG_H
 #define MICROPY_INCLUDED_PY_MPCONFIG_H
 
+#include <stddef.h>
 #include <stdint.h>
 
 #if defined(__cplusplus) // Required on at least one compiler to get ULLONG_MAX
@@ -204,10 +205,13 @@
 
 #if MP_INT_TYPE == MP_INT_TYPE_INTPTR
 typedef intptr_t mp_int_t;
-typedef uintptr_t mp_uint_t;
+// Use size_t so kw-function signatures and other size-typed APIs match without
+// triggering -Wincompatible-pointer-types under newer GCCs where size_t and
+// uintptr_t are distinct types of the same width (e.g. picolibc on 32-bit ARM).
+typedef size_t mp_uint_t;
 #define MP_INT_MAX INTPTR_MAX
 #define MP_INT_MIN INTPTR_MIN
-#define MP_UINT_MAX INTPTR_UMAX
+#define MP_UINT_MAX SIZE_MAX
 #elif MP_INT_TYPE == MP_INT_TYPE_INT64
 typedef int64_t mp_int_t;
 typedef uint64_t mp_uint_t;

diff --git a/shared-bindings/_bleio/CharacteristicBuffer.c b/shared-bindings/_bleio/CharacteristicBuffer.c
@@ -118,7 +118,7 @@ static mp_uint_t bleio_characteristic_buffer_write(mp_obj_t self_in, const void
     return 0;
 }
 
-static mp_uint_t bleio_characteristic_buffer_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t bleio_characteristic_buffer_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     bleio_characteristic_buffer_obj_t *self = MP_OBJ_TO_PTR(self_in);
     check_for_deinit(self);
     raise_error_if_not_connected(self);

diff --git a/shared-bindings/busio/UART.c b/shared-bindings/busio/UART.c
@@ -277,7 +277,7 @@ static mp_uint_t busio_uart_write(mp_obj_t self_in, const void *buf_in, mp_uint_
     return common_hal_busio_uart_write(self, buf, size, errcode);
 }
 
-static mp_uint_t busio_uart_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t busio_uart_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     busio_uart_obj_t *self = native_uart(self_in);
     check_for_deinit(self);
     mp_uint_t ret;

diff --git a/shared-bindings/jpegio/JpegDecoder.c b/shared-bindings/jpegio/JpegDecoder.c
@@ -141,7 +141,7 @@ MP_DEFINE_CONST_FUN_OBJ_2(jpegio_jpegdecoder_open_obj, jpegio_jpegdecoder_open);
 //|         """
 //|
 //|
-static mp_obj_t jpegio_jpegdecoder_decode(mp_uint_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
+static mp_obj_t jpegio_jpegdecoder_decode(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
     jpegio_jpegdecoder_obj_t *self = MP_OBJ_TO_PTR(pos_args[0]);
 
     enum { ARG_bitmap, ARG_scale, ARG_x, ARG_y, ARGS_X1_Y1_X2_Y2, ARG_skip_source_index, ARG_skip_dest_index };

diff --git a/shared-bindings/socketpool/Socket.c b/shared-bindings/socketpool/Socket.c
@@ -446,7 +446,7 @@ static mp_uint_t socket_write(mp_obj_t self_in, const void *buf, mp_uint_t size,
     return ret;
 }
 
-static mp_uint_t socket_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t socket_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     socketpool_socket_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret;
     if (request == MP_STREAM_POLL) {

diff --git a/shared-bindings/ssl/SSLSocket.c b/shared-bindings/ssl/SSLSocket.c
@@ -291,7 +291,7 @@ static mp_uint_t sslsocket_write(mp_obj_t self_in, const void *buf, mp_uint_t si
     return readwrite_common(self_in, common_hal_ssl_sslsocket_send, buf, size, errorcode);
 }
 
-static mp_uint_t sslsocket_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t sslsocket_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     ssl_sslsocket_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret;
     if (request == MP_STREAM_POLL) {

diff --git a/shared-bindings/terminalio/Terminal.c b/shared-bindings/terminalio/Terminal.c
@@ -222,7 +222,7 @@ MP_DEFINE_CONST_FUN_OBJ_1(terminalio_terminal_get_cursor_y_obj, terminalio_termi
 MP_PROPERTY_GETTER(terminalio_terminal_cursor_y_obj,
     (mp_obj_t)&terminalio_terminal_get_cursor_y_obj);
 
-static mp_uint_t terminalio_terminal_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t terminalio_terminal_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     terminalio_terminal_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret;
     if (request == MP_STREAM_POLL) {

diff --git a/shared-bindings/usb_cdc/Serial.c b/shared-bindings/usb_cdc/Serial.c
@@ -100,7 +100,7 @@ static mp_uint_t usb_cdc_serial_write_stream(mp_obj_t self_in, const void *buf_i
     return common_hal_usb_cdc_serial_write(self, buf, size, errcode);
 }
 
-static mp_uint_t usb_cdc_serial_ioctl_stream(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t usb_cdc_serial_ioctl_stream(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     usb_cdc_serial_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret = 0;
     switch (request) {

diff --git a/shared-bindings/usb_midi/PortIn.c b/shared-bindings/usb_midi/PortIn.c
@@ -60,7 +60,7 @@ static mp_uint_t usb_midi_portin_read(mp_obj_t self_in, void *buf_in, mp_uint_t
     return common_hal_usb_midi_portin_read(self, buf, size, errcode);
 }
 
-static mp_uint_t usb_midi_portin_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t usb_midi_portin_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     usb_midi_portin_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret;
     if (request == MP_STREAM_POLL) {

diff --git a/shared-bindings/usb_midi/PortOut.c b/shared-bindings/usb_midi/PortOut.c
@@ -42,7 +42,7 @@ static mp_uint_t usb_midi_portout_write(mp_obj_t self_in, const void *buf_in, mp
     return common_hal_usb_midi_portout_write(self, buf, size, errcode);
 }
 
-static mp_uint_t usb_midi_portout_ioctl(mp_obj_t self_in, mp_uint_t request, mp_uint_t arg, int *errcode) {
+static mp_uint_t usb_midi_portout_ioctl(mp_obj_t self_in, mp_uint_t request, uintptr_t arg, int *errcode) {
     usb_midi_portout_obj_t *self = MP_OBJ_TO_PTR(self_in);
     mp_uint_t ret;
     if (request == MP_STREAM_POLL) {

diff --git a/supervisor/shared/workflow.c b/supervisor/shared/workflow.c
@@ -23,8 +23,10 @@
 #endif
 #endif
 
-#if CIRCUITPY_TINYUSB || CIRCUITPY_USB_KEYBOARD_WORKFLOW
+#if CIRCUITPY_USB_DEVICE || CIRCUITPY_USB_KEYBOARD_WORKFLOW
 #include "supervisor/usb.h"
+#endif
+#if CIRCUITPY_TINYUSB
 #include "tusb.h"
 #endif
 
@@ -70,8 +72,8 @@ void supervisor_workflow_request_background(void) {
 bool supervisor_workflow_active(void) {
     #if CIRCUITPY_USB_DEVICE
     // Eventually there might be other non-USB workflows, such as BLE.
-    // tud_ready() checks for usb mounted and not suspended.
-    if (tud_ready()) {
+    // usb_connected() checks for usb mounted and not suspended.
+    if (usb_connected()) {
         return true;
     }
     #endif