Add Altera Agilex 5 SDM crypto offload port

[aidangarske]

Description

• Adds libfcs based Agilex 5 SDM crypto callback integration
• Offloads RNG SHA256 AES ECC and HMAC operations
• Keeps unsupported and short operations on safe software fallback paths
• Preserves device resident ECC key isolation for signing and key agreement
• Adds lifecycle rekey copy cleanup and hardware usage regression coverage
• Supports Autotools CMake and user settings configurations
• Validates the BitBake packaged wolfCrypt test on Agilex 5 hardware
• Requires the matching meta-wolfSSL integration for the documented image flow

partner pr here: wolfSSL/meta-wolfssl#176

[github-actions]

retest this please

[Copilot]

Pull request overview

Adds a new wolfCrypt hardware-acceleration port for the Altera Agilex 5 Secure Device Manager (SDM) via libfcs, wiring it into wolfCrypt’s crypto callback framework with software fallback behavior and CI stubs.

Changes:

• Introduces the Altera FCS port (session glue + crypto callback dispatcher + RNG/SHA-256/AES/ECC/HMAC verify integration) and associated public header/docs.
• Integrates the port into Autotools and CMake builds (options, defines, sources, link requirements) and adds a CI workflow using stubbed libfcs/libfdt.
• Updates crypto callback lifecycle handling (cleanup returns status; cleanup can defer/unwind when callbacks report BUSY_E) and adds regression coverage in wolfcrypt tests.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfssl/wolfcrypt/settings.h	Auto-enables crypto-callback capabilities needed by the FCS port (CMD/SETKEY).
wolfssl/wolfcrypt/port/altera/altera_fcs.h	Adds the public Altera FCS port header/API surface and compile-time guards.
wolfssl/wolfcrypt/include.am	Installs the new Altera FCS port header.
wolfssl/wolfcrypt/cryptocb.h	Updates crypto callback cleanup API to return status.
wolfcrypt/test/test.c	Adds ALTERA-FCS hardware/no-hardware tests and a BUSY_E unregister regression test.
wolfcrypt/src/wc_port.c	Auto-registers/unregisters the FCS callback in wolfCrypt_Init/Cleanup with BUSY handling.
wolfcrypt/src/port/altera/README.md	Documents build, behavior, limitations, and validation for the Altera FCS port.
wolfcrypt/src/port/altera/altera_fcs_rng.c	Implements SDM TRNG seeding path for wolfCrypt RNG via libfcs.
wolfcrypt/src/port/altera/altera_fcs_hmac.c	Adds explicit API for SDM “vault-key” HMAC verification.
wolfcrypt/src/port/altera/altera_fcs_hash.c	Implements buffered SHA offload with mandatory copy/free callbacks and software fallback.
wolfcrypt/src/port/altera/altera_fcs_glue.c	Implements process-wide session management, locking, key-id allocation, and atfork behavior.
wolfcrypt/src/port/altera/altera_fcs_ecc.c	Implements device-resident ECC key creation and ECDSA/ECDH operations with no silent fallback.
wolfcrypt/src/port/altera/altera_fcs_cryptocb.c	Implements the crypto-callback dispatcher, registration mask, and deferred unregister logic.
wolfcrypt/src/port/altera/altera_fcs_aes.c	Implements AES-CBC/AES-CTR offload with key import/retirement and strict eligibility rules.
wolfcrypt/src/include.am	Adds Altera FCS sources to distribution and conditional build sources.
wolfcrypt/src/cryptocb.c	Makes crypto callback cleanup return status and honors BUSY_E on unregister command.
tests/include.am	Adds stubbed libfcs/libfdt files to the distribution list.
tests/altera-fcs-stub/libfcs.h	Provides minimal libfcs API header for host CI builds.
tests/altera-fcs-stub/libfcs_stub.c	Stub implementation that reports unavailable hardware (CI fallback validation).
tests/altera-fcs-stub/libfcs_osal_types.h	Stub OSAL type definitions needed by the libfcs header.
tests/altera-fcs-stub/fdt_stub.c	Link-only stub for libfdt dependency in CI.
configure.ac	Adds --enable-alterafcs option and wires feature selection/defines/libs into Autotools.
CMakeLists.txt	Adds WOLFSSL_ALTERA_FCS option and finds/lib-links libfcs + libfdt for CMake builds.
cmake/options.h.in	Adds CMake-generated preprocessor defines for Altera FCS-related options.
cmake/functions.cmake	Adds BUILD_ALTERA_FCS* feature derivation and source-list wiring for CMake builds.
.github/workflows/altera-fcs.yml	Adds CI workflow building/testing the port against the stubbed dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +72 B (+0.1%, 64,351 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m3

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +96 B (+0.1%, 123,063 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +128 B (+0.1%, 201,391 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.1%, 66,979 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.1%, 175,338 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .rodata +24 B, .text +256 B (+0.2%, 182,204 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.1%, 61,893 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +336 B, .text +1,472 B (+0.2%, 774,844 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +128 B (+0.1%, 214,190 B / 262,144 B, total: 82% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +604 B, .text +15,104 B (+5.6%, 296,924 B / 1,048,576 B, total: 28% used)
• RAM: .bss +4 B (+0.0%, 33,424 B / 262,144 B, total: 13% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +16 B, .text +320 B (+0.1%, 327,664 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.1%, 61,893 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-tls12

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.1%, 123,827 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +256 B (+0.1%, 237,665 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +64 B (+0.0%, 201,327 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +604 B, .text +15,424 B (+5.7%, 297,820 B / 1,048,576 B, total: 28% used)
• RAM: .bss +4 B (+0.0%, 33,424 B / 262,144 B, total: 13% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.GetCertName.str1.1 +23 B, .rodata.rdnChoice +1 B, .text +256 B (+0.1%, 237,729 B / 262,144 B, total: 91% used)

linuxkm-pie

• Data: __patchable_function_entries +16 B (+0.1%, 26,456 B)

linuxkm-standard

• Data: __patchable_function_entries +32 B (+0.1%, 49,216 B)

stm32-sim-stm32h753

• FLASH: .text +344 B (+0.2%, 186,160 B / 2,097,152 B, total: 9% used)

[aidangarske]

Jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11042

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 19
19 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.