Add QorIQ SEC support to the T2080 and T1040 bare-metal test apps

[dgarske]

Depends on wolfSSL PR #11199.

This branch calls the SEC driver API that PR introduces, so it cannot build with SEC_QORIQ=1 until #11199 merges and the lib/wolfssl submodule pin moves to include it. Merge order is wolfSSL first, then the pin, then this. Without the flag, nothing here references the port and the branch builds against the current pin unchanged.

wolfSSL #11199 adds a QorIQ SEC (CAAM) hardware crypto port for the PowerPC T-series. This is the wolfBoot side: the bare-metal test apps that drive the engine on real silicon, and the source of every benchmark figure in that PR.

What this branch consumes from it: the <wolfssl/wolfcrypt/port/nxp/sec_qoriq.h> header, wc_SecQoriqInit() and wc_SecQoriqGetDev(), the SecQoriqDev struct and its offload counters, the WOLFSSL_SEC_QORIQ and WOLFSSL_SEC_QORIQ_DEVID macros, and the seven wolfcrypt/src/port/nxp/sec_qoriq*.o objects the app links. None of these exist in wolfSSL today.

test-app/Makefile gains SEC_QORIQ=1, which compiles those objects into the app and requires SEC_QORIQ_CCSRBAR to be given explicitly. That base is board specific -- the NXP RDBs leave it at the 0xFE000000 reset value, the CW VPX3-152 U-Boot relocates it to 0xEF000000 -- and a wrong value aims the driver at unmapped space, so it is never defaulted.

The T2080 and T1040 apps register the device, run wolfcrypt_test() and benchmark() through it, and print the driver's offload counters. That last part matters: unhandled cases fall back to software, so a passing test proves nothing about offload on its own. The counters report what actually reached the engine.

Two supporting changes, neither dependent on #11199: the test-app stack grows to 256 KB for RSA-2048 under SP_MATH_ALL, and wolfcrypt_support.c learns the T1040's time base and 100 MHz SYSCLK so its timings are accurate.

Verified on a Curtiss-Wright VPX3-152 (T2080E) and an NXP T1040D4RDB (T1040E): wolfcrypt_test() passes in full on both with the engine enabled, pushing about 3.4 million descriptors through the T2080's job ring.

Everything is confined to test-app/.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds bare-metal test-app integration for NXP QorIQ SEC (CAAM) on PowerPC T2080/T1040 so wolfCrypt tests/benchmarks can run on real hardware while reporting SEC offload counters.

Changes:

• Add SEC_QORIQ build option and link the wolfSSL SEC QorIQ port into the test app.
• Enable SEC QorIQ init + offload counter reporting in the T2080 and T1040 test apps.
• Update PPC timing support (T1040 SYSCLK/timebase) and increase PPC stack size for large wolfCrypt test configurations.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test-app/wolfcrypt_support.c	Extends PPC timebase/timing support to TARGET_nxp_t1040 and corrects SYSCLK assumption.
test-app/app_nxp_t2080.c	Initializes SEC QorIQ in test/benchmark builds and prints offload counters; adds U-Boot/wolfBoot state handling.
test-app/app_nxp_t1040.c	Adds wolfCrypt test/benchmark harness and SEC QorIQ init + offload counter reporting.
test-app/PPC.ld	Increases bare-metal PPC stack allocation to accommodate deep wolfCrypt/RSA paths.
test-app/Makefile	Adds SEC_QORIQ build flag and PPC stack-usage limit override for wolfCrypt tests.
lib/wolfssl	Updates wolfSSL submodule pin (to include SEC QorIQ work).
.github/workflows/test-configs.yml	Adds CI build jobs to validate SEC QorIQ integration against the pinned wolfSSL revision.

Suppressed comments (1)

lib/wolfssl:1

• The PR description states that without SEC_QORIQ=1 the branch builds against the current wolfSSL pin unchanged, but this PR updates the lib/wolfssl submodule pin unconditionally. Recommendation (mandatory): either update the PR description to reflect the temporary pinning for CI, or avoid changing the pin in this PR (and instead fetch/override the wolfSSL revision only within the SEC_QORIQ CI jobs).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.