wolfSSL · dgarske · Dec 3, 2025 · Dec 1, 2025
diff --git a/.github/workflows/test-build-riscv.yml b/.github/workflows/test-build-riscv.yml
@@ -0,0 +1,104 @@
+name: Wolfboot Reusable Build Workflow for RISC-V
+
+on:
+
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+      config-file:
+        required: true
+        type: string
+      make-args:
+        required: false
+        type: string
+
+jobs:
+
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - uses: actions/checkout@v4
+        with:
+          repository: sifive/freedom-e-sdk
+          path: freedom-e-sdk
+          submodules: recursive
+
+      - name: Workaround for sources.list
+        run: |
+            # Replace sources
+
+            set -euxo pipefail
+
+            # Peek (what repos are active now)
+            apt-cache policy
+            grep -RInE '^(deb|Types|URIs)' /etc/apt || true
+
+            # Enable nullglob so *.list/*.sources that don't exist don't break sed
+            shopt -s nullglob
+
+            echo "Replace sources.list (legacy)"
+            sudo sed -i \
+              -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+              /etc/apt/sources.list || true
+
+            echo "Replace sources.list.d/*.list (legacy)"
+            for f in /etc/apt/sources.list.d/*.list; do
+              sudo sed -i \
+                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+                "$f"
+            done
+
+            echo "Replace sources.list.d/*.sources (deb822)"
+            for f in /etc/apt/sources.list.d/*.sources; do
+              sudo sed -i \
+                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+                -e "s|https\?://azure\.archive\.ubuntu\.com|http://mirror.arizona.edu|g" \
+                "$f"
+            done
+
+            echo "Fix /etc/apt/apt-mirrors.txt (used by URIs: mirror+file:...)"
+            if grep -qE '^[[:space:]]*https?://azure\.archive\.ubuntu\.com/ubuntu/?' /etc/apt/apt-mirrors.txt; then
+              # Replace azure with our mirror (idempotent)
+              sudo sed -i 's|https\?://azure\.archive\.ubuntu\.com/ubuntu/|http://mirror.arizona.edu/ubuntu/|g' /etc/apt/apt-mirrors.txt
+            fi
+
+            # Peek (verify changes)
+            grep -RIn "azure.archive.ubuntu.com" /etc/apt || true
+            grep -RInE '^(deb|Types|URIs)' /etc/apt || true
+            echo "--- apt-mirrors.txt ---"
+            cat /etc/apt/apt-mirrors.txt || true
+
+      - name: Update repository
+        run: sudo apt-get update -o Acquire::Retries=3
+
+      - name: Download and install SiFive RISC-V toolchain
+        run: |
+          # Download SiFive prebuilt toolchain with newlib
+          wget -q https://static.dev.sifive.com/dev-tools/freedom-tools/v2020.12/riscv64-unknown-elf-toolchain-10.2.0-2020.12.8-x86_64-linux-ubuntu14.tar.gz
+          tar xzf riscv64-unknown-elf-toolchain-10.2.0-2020.12.8-x86_64-linux-ubuntu14.tar.gz
+          echo "$GITHUB_WORKSPACE/riscv64-unknown-elf-toolchain-10.2.0-2020.12.8-x86_64-linux-ubuntu14/bin" >> $GITHUB_PATH
+
+      - name: make clean
+        run: |
+          make distclean
+
+      - name: Select config
+        run: |
+          cp ${{inputs.config-file}} .config
+
+      - name: Build tools
+        run: |
+          make -C tools/keytools && make -C tools/bin-assemble
+
+      - name: Build wolfboot
+        run: |
+          make FREEDOM_E_SDK=$GITHUB_WORKSPACE/freedom-e-sdk CROSS_COMPILE=riscv64-unknown-elf- ${{inputs.make-args}}
+
diff --git a/.github/workflows/test-build-stm32cube.yml b/.github/workflows/test-build-stm32cube.yml
@@ -0,0 +1,105 @@
+name: Wolfboot Reusable Build Workflow for STM32Cube SDK
+
+on:
+
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+      config-file:
+        required: true
+        type: string
+      cube-repo:
+        description: 'STM32Cube repository to clone (e.g., STMicroelectronics/STM32CubeL4)'
+        required: true
+        type: string
+      make-args:
+        required: false
+        type: string
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{inputs.cube-repo}}
+          path: STM32Cube
+          submodules: true
+
+      - name: Workaround for sources.list
+        run: |
+            # Replace sources
+
+            set -euxo pipefail
+
+            # Peek (what repos are active now)
+            apt-cache policy
+            grep -RInE '^(deb|Types|URIs)' /etc/apt || true
+
+            # Enable nullglob so *.list/*.sources that don't exist don't break sed
+            shopt -s nullglob
+
+            echo "Replace sources.list (legacy)"
+            sudo sed -i \
+              -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+              /etc/apt/sources.list || true
+
+            echo "Replace sources.list.d/*.list (legacy)"
+            for f in /etc/apt/sources.list.d/*.list; do
+              sudo sed -i \
+                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+                "$f"
+            done
+
+            echo "Replace sources.list.d/*.sources (deb822)"
+            for f in /etc/apt/sources.list.d/*.sources; do
+              sudo sed -i \
+                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
+                -e "s|https\?://azure\.archive\.ubuntu\.com|http://mirror.arizona.edu|g" \
+                "$f"
+            done
+
+            echo "Fix /etc/apt/apt-mirrors.txt (used by URIs: mirror+file:...)"
+            if grep -qE '^[[:space:]]*https?://azure\.archive\.ubuntu\.com/ubuntu/?' /etc/apt/apt-mirrors.txt; then
+              # Replace azure with our mirror (idempotent)
+              sudo sed -i 's|https\?://azure\.archive\.ubuntu\.com/ubuntu/|http://mirror.arizona.edu/ubuntu/|g' /etc/apt/apt-mirrors.txt
+            fi
+
+            # Peek (verify changes)
+            grep -RIn "azure.archive.ubuntu.com" /etc/apt || true
+            grep -RInE '^(deb|Types|URIs)' /etc/apt || true
+            echo "--- apt-mirrors.txt ---"
+            cat /etc/apt/apt-mirrors.txt || true
+
+      - name: Update repository
+        run: sudo apt-get update
+
+      - name: Install cross compilers
+        run: |
+          sudo apt-get install -y gcc-arm-none-eabi
+
+      - name: make distclean
+        run: |
+          make distclean
+
+      - name: Select config
+        run: |
+          cp ${{inputs.config-file}} .config && make include/target.h
+
+      - name: Build tools
+        run: |
+          make -C tools/keytools && make -C tools/bin-assemble
+
+      - name: Build wolfboot
+        run: |
+          make STM32CUBE="$GITHUB_WORKSPACE/STM32Cube" ${{inputs.make-args}} V=1
+
diff --git a/.github/workflows/test-configs.yml b/.github/workflows/test-configs.yml
@@ -8,21 +8,19 @@ on:
 
 jobs:
 
-  # TODO: cypsoc6.config requires cy_device_headers.h
+  # TODO: cypsoc6.config requires cy_device_headers.h and component defines
   # cypsoc6_test:
-  #   uses: ./.github/workflows/test-build.yml
+  #   uses: ./.github/workflows/test-build-psoc6.yml
   #   with:
   #     arch: arm
   #     config-file: ./config/examples/cypsoc6.config
 
-  # TODO: hifive.config requires RISC-V compiler
-  # hifive1_test:
-  #   uses: ./.github/workflows/test-build.yml
-  #   with:
-  #     arch: riscv
-  #     config-file: ./config/examples/hifive.config
-  #
-  #
+  hifive1_test:
+    uses: ./.github/workflows/test-build-riscv.yml
+    with:
+      arch: riscv
+      config-file: ./config/examples/hifive1.config
+
   sama5d3_test:
     uses: ./.github/workflows/test-build.yml
     with:
@@ -93,6 +91,12 @@ jobs:
       config-file: ./config/examples/imx-rt1064.config
       make-args: PKA=1 NO_ARM_ASM=1
 
+  imx_rt1060_hab_test:
+    uses: ./.github/workflows/test-build-mcux-sdk.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/imx-rt1060_hab.config
+
   kinetis_k64f_test:
     uses: ./.github/workflows/test-build-mcux-sdk.yml
     with:
@@ -172,6 +176,20 @@ jobs:
       arch: ppc
       config-file: ./config/examples/nxp-t2080.config
 
+  nxp_ls1028a_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/nxp-ls1028a.config
+      make-args: CROSS_COMPILE=aarch64-linux-gnu-
+
+  nxp_ls1028a_tpm_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/nxp-ls1028a-tpm.config
+      make-args: CROSS_COMPILE=aarch64-linux-gnu-
+
   nxp_mcxa_test:
     uses: ./.github/workflows/test-build-mcux-sdk.yml
     with:
@@ -191,6 +209,13 @@ jobs:
       config-file: ./config/examples/raspi3.config
       make-args: wolfboot.bin CROSS_COMPILE=aarch64-linux-gnu-
 
+  raspi3_encrypted_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/raspi3-encrypted.config
+      make-args: wolfboot.bin CROSS_COMPILE=aarch64-linux-gnu-
+
   sim_tfm_smallstack_test:
     uses: ./.github/workflows/test-build.yml
     with:
@@ -375,12 +400,12 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32l0.config
 
-  # TODO: stm32l4-cube.config requires Cube HAL
-  # stm32l4_cube_test:
-  #   uses: ./.github/workflows/test-build.yml
-  #   with:
-  #     arch: arm
-  #     config-file: ./config/examples/stm32l4-cube.config
+  stm32l4_cube_test:
+    uses: ./.github/workflows/test-build-stm32cube.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32l4-cube.config
+      cube-repo: STMicroelectronics/STM32CubeL4
 
   stm32l5_nonsecure_dualbank_test:
     uses: ./.github/workflows/test-build.yml
@@ -436,12 +461,13 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32wb-delta.config
 
-  # TODO: stm32wb-pka-1mb.config requires STM32 HAL #include "stm32wbxx_hal.h
-  # stm32wb_pka_1mb_test:
-  #   uses: ./.github/workflows/test-build.yml
-  #   with:
-  #     arch: arm
-  #     config-file: ./config/examples/stm32wb-pka-1mb.config
+  stm32wb_pka_1mb_test:
+    uses: ./.github/workflows/test-build-stm32cube.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32wb-pka-1mb.config
+      cube-repo: STMicroelectronics/STM32CubeWB
+      make-args: PKA=1 NO_ARM_ASM=1
 
   stm32wb_tpm_test:
     uses: ./.github/workflows/test-build.yml
@@ -473,7 +499,12 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32wb.config
 
-  # TODO: ti-tms570lc435.config requires CCS_ROOT
+  # TODO: ti-tms570lc435.config requires F021 Flash API (Windows installer only)
+  # ti_tms570lc435_test:
+  #   uses: ./.github/workflows/test-build-ti-hercules.yml
+  #   with:
+  #     arch: arm
+  #     config-file: ./config/examples/ti-tms570lc435.config
 
   # Cannot run on CI without the SDK (see VORAGO_SDK_DIR)
   # vorago_va416x0_test:

diff --git a/hal/hifive1.ld b/hal/hifive1.ld
@@ -17,6 +17,7 @@ SECTIONS
         . = ORIGIN(FLASH) + 0x200;
         _start_vector = .;
         KEEP(*(.isr_vector))
+        *(.keystore*)
         *(.text*)
         *(.rodata*)
         *(.srodata*)

diff --git a/lib/wolfssl b/lib/wolfssl
+1 −1		.github/workflows/async.yml
+0 −10		.gitignore
+25 −16		.wolfssl_known_macro_extras
+1 −0		Makefile.am
+558 −0		README-async.md
+0 −2		SCRIPTS-LIST
+0 −104		async-check.sh
+2 −10		autogen.sh
+11 −15		configure.ac
+2 −2		doc/dox_comments/header_files/rsa.h
+1 −4		examples/async/README.md
+7 −1		linuxkm/Kbuild
+1 −1		linuxkm/linuxkm_memory.c
+35 −25		linuxkm/linuxkm_wc_port.h
+3 −0		linuxkm/lkcapi_sha_glue.c
+3 −0		linuxkm/module_exports.c.template
+27 −15		linuxkm/module_hooks.c
+6 −2		linuxkm/pie_redirect_table.c
+1 −0		scripts/include.am
+92 −0		scripts/rsapss.test
+11 −0		src/include.am
+459 −711		src/internal.c
+1 −1		src/ssl.c
+8 −0		src/ssl_load.c
+3 −3		src/tls.c
+31 −16		src/tls13.c
+0 −4		tests/api/test_rsa.c
+0 −3		wolfcrypt/benchmark/benchmark.c
+293 −162		wolfcrypt/src/aes.c
+1,158 −0		wolfcrypt/src/async.c
+3 −0		wolfcrypt/src/error.c
+14 −8		wolfcrypt/src/evp.c
+8 −0		wolfcrypt/src/pkcs7.c
+263 −2		wolfcrypt/src/port/cavium/README.md
+234 −2		wolfcrypt/src/port/cavium/README_Octeon.md
+1,234 −0		wolfcrypt/src/port/cavium/cavium_nitrox.c
+81 −23		wolfcrypt/src/port/cypress/README.md
+1,015 −10		wolfcrypt/src/port/cypress/psoc6_crypto.c
+409 −1		wolfcrypt/src/port/intel/README.md
+5,092 −0		wolfcrypt/src/port/intel/quickassist.c
+1,131 −0		wolfcrypt/src/port/intel/quickassist_mem.c
+2 −2		wolfcrypt/src/port/st/stm32.c
+7 −880		wolfcrypt/src/random.c
+1 −1		wolfcrypt/src/sha256.c
+1 −1		wolfcrypt/src/sha512.c
+2 −53		wolfcrypt/src/sp_arm32.c
+2 −58		wolfcrypt/src/sp_cortexm.c
+8 −0		wolfcrypt/src/wc_mlkem.c
+6 −6		wolfcrypt/src/wc_port.c
+906 −0		wolfcrypt/src/wolfentropy.c
+28 −16		wolfcrypt/test/test.c
+10 −1		wolfssl/internal.h
+9 −0		wolfssl/wolfcrypt/aes.h
+442 −0		wolfssl/wolfcrypt/async.h
+4 −2		wolfssl/wolfcrypt/error-crypt.h
+1 −0		wolfssl/wolfcrypt/include.am
+217 −0		wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h
+84 −7		wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h
+520 −0		wolfssl/wolfcrypt/port/intel/quickassist.h
+64 −0		wolfssl/wolfcrypt/port/intel/quickassist_mem.h
+2 −0		wolfssl/wolfcrypt/port/st/stm32.h
+0 −13		wolfssl/wolfcrypt/random.h
+9 −1		wolfssl/wolfcrypt/settings.h
+6 −6		wolfssl/wolfcrypt/wc_port.h
+72 −0		wolfssl/wolfcrypt/wolfentropy.h
+1 −0		wrapper/rust/wolfssl/Makefile
+5 −5		wrapper/rust/wolfssl/build.rs
+44 −0		wrapper/rust/wolfssl/src/wolfcrypt.rs
+227 −275		wrapper/rust/wolfssl/src/wolfcrypt/aes.rs
+1 −0		wrapper/rust/wolfssl/src/wolfcrypt/ecc.rs
+4 −5		wrapper/rust/wolfssl/src/wolfcrypt/kdf.rs
+168 −12		wrapper/rust/wolfssl/src/wolfcrypt/random.rs
+30 −49		wrapper/rust/wolfssl/src/wolfcrypt/rsa.rs
+2 −2		wrapper/rust/wolfssl/src/wolfcrypt/sha.rs
+25 −0		wrapper/rust/wolfssl/tests/test_random.rs
+11 −0		wrapper/rust/wolfssl/tests/test_wolfcrypt.rs