Add Altera Agilex 5 SDM crypto offload port

.github/workflows/altera-fcs.yml

@@ -0,0 +1,105 @@
+name: Altera Agilex 5 FCS port tests
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+# The stub exposes only the libfcs interface and always reports unavailable
+# hardware. This checks port compilation, build guards, linkage, and software
+# fallback without treating host output as SDM cryptographic validation.
+# Functional offload remains covered by wolfcrypttest on Agilex 5 hardware.
+
+jobs:
+  build:
+    name: ${{ matrix.name }}
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Autotools all algorithms
+            system: autotools
+            option: all
+            extra: --enable-aesctr
+          - name: Autotools RNG only
+            system: autotools
+            option: rng
+            extra: ''
+          - name: Autotools without ECC
+            system: autotools
+            option: all
+            extra: --enable-aesctr --disable-ecc
+          - name: CMake all algorithms
+            system: cmake
+            option: all
+            extra: ''
+          - name: CMake RNG only
+            system: cmake
+            option: rng
+            extra: ''
+
+    steps:
+      - uses: actions/checkout@v5
+        name: Checkout wolfSSL
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-apt-deps
+        with:
+          packages: autoconf automake libtool build-essential cmake
+          ghcr-debs-tag: ubuntu-24.04-minimal
+
+      - name: Build no-hardware dependency stubs
+        run: |
+          stub="$RUNNER_TEMP/altera-fcs-stub"
+          mkdir -p "$stub/include" "$stub/lib"
+          cp tests/altera-fcs-stub/libfcs.h \
+            tests/altera-fcs-stub/libfcs_osal_types.h "$stub/include/"
+          cc -I"$stub/include" -c \
+            tests/altera-fcs-stub/libfcs_stub.c -o "$stub/libfcs_stub.o"
+          ar rcs "$stub/lib/libFCS.a" "$stub/libfcs_stub.o"
+          cc -c tests/altera-fcs-stub/fdt_stub.c -o "$stub/fdt_stub.o"
+          ar rcs "$stub/lib/libfdt.a" "$stub/fdt_stub.o"
+          echo "ALTERA_FCS_STUB=$stub" >> "$GITHUB_ENV"
+
+      - name: Build and test with Autotools
+        if: matrix.system == 'autotools'
+        run: |
+          set -o pipefail
+          ./autogen.sh
+          CPPFLAGS="-I$ALTERA_FCS_STUB/include" \
+          LDFLAGS="-L$ALTERA_FCS_STUB/lib" \
+            ./configure --enable-alterafcs=${{ matrix.option }} \
+              --disable-shared ${{ matrix.extra }}
+          make -j"$(nproc)"
+          ./wolfcrypt/test/testwolfcrypt | tee altera-fcs-test.log
+          grep -q 'ALTERA-FCS test skipped: hardware unavailable' \
+            altera-fcs-test.log
+
+      - name: Build and test with CMake
+        if: matrix.system == 'cmake'
+        run: |
+          set -o pipefail
+          cmake -S . -B build \
+            -DWOLFSSL_ALTERA_FCS=${{ matrix.option }} \
+            -DALTERA_FCS_INCLUDE_DIR="$ALTERA_FCS_STUB/include" \
+            -DALTERA_FCS_OSAL_INCLUDE_DIR="$ALTERA_FCS_STUB/include" \
+            -DALTERA_FCS_LIBRARY="$ALTERA_FCS_STUB/lib/libFCS.a" \
+            -DALTERA_FDT_LIBRARY="$ALTERA_FCS_STUB/lib/libfdt.a"
+          cmake --build build --target wolfcrypttest -j"$(nproc)"
+          ./build/wolfcrypt/test/testwolfcrypt | tee altera-fcs-test.log
+          grep -q 'ALTERA-FCS test skipped: hardware unavailable' \
+            altera-fcs-test.log

.wolfssl_known_macro_extras

@@ -815,6 +815,7 @@ WOLFSSL_ALLOW_NO_CN_IN_SAN
 WOLFSSL_ALLOW_NO_SUITES
 WOLFSSL_ALLOW_SERVER_SC_EXT
 WOLFSSL_ALLOW_TLS_SHA1
+WOLFSSL_ALTERA_FCS_RAW_RNG
 WOLFSSL_ALTERNATIVE_DOWNGRADE
 WOLFSSL_ALT_NAMES_NO_REV
 WOLFSSL_ARM32_BUILD
@@ -1034,7 +1035,6 @@ WOLFSSL_SHA256_ALT_CH_MAJ
 WOLFSSL_SHA3_AVX2
 WOLFSSL_SHA3_NO_AVX2
 WOLFSSL_SHA3_PPC64_BLOCKS_N
-WOLFSSL_SHA512_HASHTYPE
 WOLFSSL_SHUTDOWNONCE
 WOLFSSL_SILABS_TRNG
 WOLFSSL_SLHDSA_FULL_HASH
@@ -1112,7 +1112,6 @@ WOLFSSL_XILINX_PATCH
 WOLFSSL_XIL_MSG_NO_SLEEP
 WOLFSSL_ZEPHYR
 WOLF_ALLOW_BUILTIN
-WOLF_CRYPTO_CB_CMD
 WOLF_CRYPTO_CB_ONLY_FALCON
 WOLF_CRYPTO_DEV
 WOLF_CRYPT_FIPS_H

CMakeLists.txt

@@ -2772,10 +2772,39 @@ endif()
 
 # TODO: - Session export
 
+add_option("WOLFSSL_ALTERA_FCS"
+    "Enable Altera Agilex 5 SDM crypto offload via libfcs (default: disabled)"
+    "no" "all;rng;yes;no")
+
 add_option("WOLFSSL_CRYPTOCB"
     "Enable crypto callbacks (default: disabled)"
     "no" "yes;no")
 
+if(WOLFSSL_ALTERA_FCS)
+    find_path(ALTERA_FCS_INCLUDE_DIR NAMES libfcs.h)
+    find_path(ALTERA_FCS_OSAL_INCLUDE_DIR
+        NAMES libfcs_osal_types.h)
+    find_library(ALTERA_FCS_LIBRARY NAMES FCS)
+    find_library(ALTERA_FDT_LIBRARY NAMES fdt)
+    if(ALTERA_FCS_INCLUDE_DIR AND ALTERA_FCS_OSAL_INCLUDE_DIR AND
+       ALTERA_FCS_LIBRARY AND ALTERA_FDT_LIBRARY)
+        list(APPEND WOLFSSL_INCLUDE_DIRS
+            ${ALTERA_FCS_INCLUDE_DIR}
+            ${ALTERA_FCS_OSAL_INCLUDE_DIR})
+        list(APPEND WOLFSSL_LINK_LIBS
+            ${ALTERA_FCS_LIBRARY}
+            ${ALTERA_FDT_LIBRARY})
+        list(APPEND PC_LIBS_PRIVATE "-lFCS" "-lfdt")
+    else()
+        message(FATAL_ERROR "Altera FCS requires libfcs and libfdt headers "
+            "and libraries")
+    endif()
+endif()
+
+if(WOLFSSL_ALTERA_FCS)
+    override_cache(WOLFSSL_CRYPTOCB "yes")
+endif()
+
 add_option("WOLFSSL_CRYPTOCB_NO_SW_TEST"
     "Disable crypto callback SW testing (default: disabled)"
     "no" "yes;no")
@@ -3999,6 +4028,39 @@ wolfssl_warn_unconsumed_forces()
 # the library. A series of AM_CONDITIONALs handle this in configure.ac.
 generate_build_flags()
 
+# FCS depends on algorithm options declared throughout this file. Derive its
+# compile definitions only after all options and BUILD_* selections are final.
+if(WOLFSSL_ALTERA_FCS)
+    list(APPEND WOLFSSL_DEFINITIONS
+        "-DWOLFSSL_ALTERA_FCS"
+        "-DWOLF_CRYPTO_CB_COPY"
+        "-DWOLF_CRYPTO_CB_FREE"
+        "-DWOLF_CRYPTO_CB_SETKEY")
+    if(WOLFSSL_ALTERA_FCS STREQUAL "rng")
+        if(BUILD_ALTERA_FCS_RNG)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALTERA_FCS_RNG")
+        endif()
+    else()
+        if(BUILD_ALTERA_FCS_RNG)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALTERA_FCS_RNG")
+        endif()
+        if(BUILD_ALTERA_FCS_HASH)
+            list(APPEND WOLFSSL_DEFINITIONS
+                "-DWOLFSSL_ALTERA_FCS_HASH"
+                "-DWOLFSSL_SHA512_HASHTYPE")
+        endif()
+        if(BUILD_ALTERA_FCS_AES)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALTERA_FCS_AES")
+        endif()
+        if(BUILD_ALTERA_FCS_ECC)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALTERA_FCS_ECC")
+        endif()
+        if(BUILD_ALTERA_FCS_HMAC)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALTERA_FCS_HMAC")
+        endif()
+    endif()
+endif()
+
 # TODO: - Bit of logic after optimization flags option (above)
 #       - Check for build-type conflicts section
 

cmake/functions.cmake

@@ -365,6 +365,31 @@ function(generate_build_flags)
     if(WOLFSSL_CRYPTOCB OR WOLFSSL_USER_SETTINGS)
         set(BUILD_CRYPTOCB "yes" PARENT_SCOPE)
     endif()
+    if(WOLFSSL_ALTERA_FCS OR WOLFSSL_USER_SETTINGS)
+        set(BUILD_ALTERA_FCS "yes" PARENT_SCOPE)
+        if(WOLFSSL_ALTERA_FCS STREQUAL "rng")
+            if(WOLFSSL_RNG OR WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_RNG "yes" PARENT_SCOPE)
+            endif()
+        else()
+            if(WOLFSSL_RNG OR WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_RNG "yes" PARENT_SCOPE)
+            endif()
+            if(WOLFSSL_SHA256 OR WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_HASH "yes" PARENT_SCOPE)
+            endif()
+            if(WOLFSSL_AES OR WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_AES "yes" PARENT_SCOPE)
+            endif()
+            if((WOLFSSL_ECC AND WOLFSSL_ASN) OR WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_ECC "yes" PARENT_SCOPE)
+            endif()
+            if(WOLFSSL_SHA256 OR WOLFSSL_SHA384 OR WOLFSSL_SHA512 OR
+               WOLFSSL_USER_SETTINGS)
+                set(BUILD_ALTERA_FCS_HMAC "yes" PARENT_SCOPE)
+            endif()
+        endif()
+    endif()
     if(WOLFSSL_VAULTIC)
         set(BUILD_VAULTIC "yes" PARENT_SCOPE)
     endif()
@@ -1288,6 +1313,32 @@ function(generate_lib_src_list LIB_SOURCES)
         list(APPEND LIB_SOURCES wolfcrypt/src/cryptocb.c)
     endif()
 
+    if(BUILD_ALTERA_FCS)
+        list(APPEND LIB_SOURCES
+            wolfcrypt/src/port/altera/altera_fcs_glue.c
+            wolfcrypt/src/port/altera/altera_fcs_cryptocb.c)
+        if(BUILD_ALTERA_FCS_RNG)
+            list(APPEND LIB_SOURCES
+                wolfcrypt/src/port/altera/altera_fcs_rng.c)
+        endif()
+        if(BUILD_ALTERA_FCS_HASH)
+            list(APPEND LIB_SOURCES
+                wolfcrypt/src/port/altera/altera_fcs_hash.c)
+        endif()
+        if(BUILD_ALTERA_FCS_AES)
+            list(APPEND LIB_SOURCES
+                wolfcrypt/src/port/altera/altera_fcs_aes.c)
+        endif()
+        if(BUILD_ALTERA_FCS_ECC)
+            list(APPEND LIB_SOURCES
+                wolfcrypt/src/port/altera/altera_fcs_ecc.c)
+        endif()
+        if(BUILD_ALTERA_FCS_HMAC)
+            list(APPEND LIB_SOURCES
+                wolfcrypt/src/port/altera/altera_fcs_hmac.c)
+        endif()
+    endif()
+
     if(BUILD_SHE)
         list(APPEND LIB_SOURCES wolfcrypt/src/wc_she.c)
     endif()

cmake/options.h.in

@@ -261,6 +261,10 @@ extern "C" {
 #cmakedefine WC_RSA_PSS
 #undef WOLF_CRYPTO_CB
 #cmakedefine WOLF_CRYPTO_CB
+#undef WOLF_CRYPTO_CB_COPY
+#cmakedefine WOLF_CRYPTO_CB_COPY
+#undef WOLF_CRYPTO_CB_FREE
+#cmakedefine WOLF_CRYPTO_CB_FREE
 #undef WOLF_CRYPTO_CB_RSA_PAD
 #cmakedefine WOLF_CRYPTO_CB_RSA_PAD
 #undef WOLFSSL_AARCH64_BUILD
@@ -289,6 +293,20 @@ extern "C" {
 #cmakedefine WOLFSSL_BASE64_ENCODE
 #undef WOLFSSL_CAAM
 #cmakedefine WOLFSSL_CAAM
+#undef WOLFSSL_ALTERA_FCS
+#cmakedefine WOLFSSL_ALTERA_FCS
+#undef WOLFSSL_ALTERA_FCS_RNG
+#cmakedefine WOLFSSL_ALTERA_FCS_RNG
+#undef WOLFSSL_ALTERA_FCS_HASH
+#cmakedefine WOLFSSL_ALTERA_FCS_HASH
+#undef WOLFSSL_ALTERA_FCS_AES
+#cmakedefine WOLFSSL_ALTERA_FCS_AES
+#undef WOLFSSL_ALTERA_FCS_ECC
+#cmakedefine WOLFSSL_ALTERA_FCS_ECC
+#undef WOLFSSL_ALTERA_FCS_HMAC
+#cmakedefine WOLFSSL_ALTERA_FCS_HMAC
+#undef WOLFSSL_SHA512_HASHTYPE
+#cmakedefine WOLFSSL_SHA512_HASHTYPE
 #undef WOLFSSL_CERT_EXT
 #cmakedefine WOLFSSL_CERT_EXT
 #undef WOLFSSL_CERT_GEN