[dgarske]

Description

The Athena F5200 port offloaded SHA-384 and AES-256-CTR. This extends it to what the engine and Microchip's CAL support, and fixes four problems outside the new handlers that the bare-metal builds depend on.

• Hash: SHA-224, SHA-256, SHA-512 and SHA-512/t on the same engine context, copy and free handling as SHA-384. A SHA-512 family object is identified by its IV, since wolfCrypt reports every SHA-512/t update as SHA-512.
• AES at all three key sizes: ECB, which carries XTS through _AesXtsHelper()'s bulk call; CBC; CTR; native GCM and GMAC; one-shot CMAC; RFC 3394 and RFC 5649 key wrap. WC_MPFS_ATHENA_AES_MIN_SZ keeps XTS's one-block tweak and tail calls in software. CAL moves GCM data and AAD in whole blocks, so other lengths go through a padded copy.
• RNG: random.c's wc_GenerateSeed() reads the NRBG directly when the port is enabled, so every RNG is seeded from the engine whatever its devId (WC_MPFS_ATHENA_NO_RNG opts out, and a CUSTOM_RAND_GENERATE_SEED still takes precedence); WC_MPFS_ATHENA_RNG_DRBG also generates from the engine's DRBG.
• ECDSA sign and verify, ECDH and EC key generation on P-192 to P-521, with the curve parameters taken from ecc.c's curve table, and the RSA CRT private operation. Private operations use the engine's countermeasure paths and purge the PKX afterwards; nonces are drawn before the hardware mutex is taken. RSA public operations are opt-in with WC_MPFS_ATHENA_RSA_PUBLIC, since with a small public exponent the engine is slower than software.
• Anything wolfCrypt would reject after the callback, such as an all-zero ECDSA digest or an RSA input outside 1 < x < n - 1, or that the engine cannot do, is declined to software. Each family has a WC_MPFS_ATHENA_NO_* opt-out.
• CTR counter carry: the engine increments only the low 32 bits of the counter block, so any stream crossing that boundary diverged from wc_AesCtrEncrypt(). Each transfer now stops at the wrap and aes->reg is advanced in software.
• aes.c: the 64-bit GMULT() table path reads at odd offsets and had no WOLFSSL_USE_ALIGN guard, unlike the 32-bit path; a strict-alignment 64-bit target now takes the byte loop.
• riscv-64-sha256-asm.S: the SHA-256 round constant tables were aligned to 4 bytes for the 8-byte ld loads that read them. Regenerated with the wolfSSL/scripts generator fix (wolfSSL/scripts#718).
• benchmark.c: benchmark_free() clears the static-memory hint. With it kept, the next benchmark_init() partitioned the same pool again from its start, over the heap structures already there, so running the benchmark more than once, as wolfBoot's test-app does per call size, corrupted the free lists.
• The known-answer self-test, wc_MpfsAthena_SelfTest(), is opt-in with WC_MPFS_ATHENA_SELFTEST.
• configure.ac no longer requires SHA-384 and AES-CTR. CI compiles every configuration, with and without the self-test, in one job, and checks every CAL symbol against the archive; README.

Testing

MPFS250TS Video Kit, E51 bare metal under wolfBoot's test-app (wolfBoot PR 980): the port self-test and the full wolfcrypt_test() with every family on the engine, including RSA-2048 and all five NIST curves, and the benchmark against software C and the RISC-V assembly. Host: wolfcrypt_test() through the port under ASan and UBSan against a CAL stub that models the engine's transfers, block granularity and operand layout, single and multi-threaded; make check with --enable-all; every CI leg.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +28 B, text +11,728 B (+4.2%, 294,228 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12055

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/workflows/mpfs-athena-compile.yml, configure.ac, wolfcrypt/src/port/microchip/README.md
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[Copilot]

🟡 Changes recommended

The documented custom-seed configuration lacks a visible function prototype in random.c, causing strict builds to fail, while the custom-seed CI leg omits random.c and misses the failure.

1 open issue

• Include custom seed prototype and compile random.c in CI · New

What changed in this PR

This PR expands PolarFire SoC Athena integration for accelerated cryptography, including AES-ECB-backed XTS, and addresses strict-alignment issues affecting bare-metal RISC-V targets.

Changes:

• Expands port declarations, configuration, and documentation for supported offloads.
• Adds alignment-safe GCM multiplication and 8-byte alignment for SHA-256 constant tables.
• Broadens compile-only CI coverage across algorithms and port configurations.

File	Description
wolfssl/​wolfcrypt/​settings.h	Clarifies hash-context ownership and software-fallback comments.
wolfssl/​wolfcrypt/​port/​microchip/​mpfs_athena.h	Documents expanded capabilities and adds configuration macros and the entropy API declaration.
wolfcrypt/​src/​port/​riscv64/​riscv-64-sha256-asm.S	Aligns three constant tables for 64-bit loads.
wolfcrypt/​src/​port/​microchip/​README.md	Expands setup, offload coverage, XTS benchmarks, and hardware guidance.
wolfcrypt/​src/​aes.c	Adds a byte-oriented GCM multiplication path for strict-alignment builds.
configure.ac	Enables ECB automatically for Athena XTS builds and removes mandatory SHA-384/CTR checks.
.github/​workflows/​mpfs-athena-compile.yml	Adds algorithm, RNG, memory, and opt-out compile configurations.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12055

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/workflows/mpfs-athena-compile.yml, configure.ac, wolfcrypt/src/port/microchip/README.md, wolfcrypt/src/port/riscv64/riscv-64-sha256-asm.S
Coverage: 3 of 3 in-scope changed file(s) opened by the reviewer

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

Repeated benchmark runs can leak or reinitialize a live static-memory heap mutex because the heap is not unloaded before its hint is cleared.

2 open issues

• Unload static memory before clearing the heap hint · New
• Avoid waiting for PKX results after synchronous DRBG calls · New

1 resolved since last review

• Include custom seed prototype and compile random.c in CI

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12055

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs
Unchanged since last review (not re-run): wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/workflows/mpfs-athena-compile.yml, configure.ac, wolfcrypt/benchmark/benchmark.c, wolfcrypt/src/port/microchip/README.md, wolfcrypt/src/port/riscv64/riscv-64-sha256-asm.S
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🔵 Needs a closer look

Clearing the static heap hint without unloading the pool leaks mutex resources across benchmark runs, and the NRBG completion guidance can lead callers to wait forever.

No open issues 🎉

2 resolved since last review

• Unload static memory before clearing the heap hint
• Avoid waiting for PKX results after synchronous DRBG calls

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12055

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/workflows/mpfs-athena-compile.yml, configure.ac, wolfcrypt/benchmark/benchmark.c, wolfcrypt/src/port/microchip/README.md, wolfcrypt/src/port/riscv64/riscv-64-sha256-asm.S
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.