crypto/tls: use Go's software TLS on the host target

loader/goroot.go

@@ -232,7 +232,6 @@ func pathsToOverride(goMinor int, needsSyscallPackage bool) map[string]bool {
 		"":                            true,
 		"crypto/":                     true,
 		"crypto/rand/":                false,
-		"crypto/tls/":                 false,
 		"crypto/x509/":                true,
 		"crypto/x509/internal/":       true,
 		"crypto/x509/internal/macos/": false,
@@ -279,6 +278,17 @@ func pathsToOverride(goMinor int, needsSyscallPackage bool) map[string]bool {
 		paths["crypto/internal/entropy/v1.0.0/"] = false
 	}
 
+	// crypto/tls: TinyGo's version is a thin wrapper around a netdev-provided
+	// (hardware/firmware-offloaded) TLS socket, which only makes sense on
+	// embedded/wasm targets that have such a netdev. On the host/native target
+	// (raw-syscall netdev, no TLS offload) there is no real TLS that way, so use
+	// Go's full software crypto/tls instead — leaving crypto/tls out of the
+	// overrides map makes the goroot link Go's implementation. needsSyscallPackage
+	// is true exactly for the embedded/wasm targets.
+	if needsSyscallPackage {
+		paths["crypto/tls/"] = false
+	}
+
 	if needsSyscallPackage {
 		paths["syscall/"] = true // include syscall/js
 		paths["internal/syscall/"] = true

src/runtime/runtime.go

@@ -139,6 +139,14 @@ func registerWeakPointer(ptr unsafe.Pointer) unsafe.Pointer {
 	return ptr
 }
 
+//go:linkname makeStrongFromWeak weak.runtime_makeStrongFromWeak
+func makeStrongFromWeak(u unsafe.Pointer) unsafe.Pointer {
+	// Counterpart to registerWeakPointer above. Because weak pointers are never
+	// collected here (the "weak" handle is just the pointer itself), the
+	// referent is always still alive, so return it unchanged.
+	return u
+}
+
 var godebugUpdate func(string, string)
 
 //go:linkname godebug_setUpdate internal/godebug.setUpdate