dgarske · Oct 24, 2026
diff --git a/.github/workflows/infineon-psoc-e8.yml b/.github/workflows/infineon-psoc-e8.yml
@@ -0,0 +1,82 @@
+name: Infineon PSOC Edge E8
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'embedded/infineon_psoc_e8/**'
+      - '.github/workflows/infineon-psoc-e8.yml'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'embedded/infineon_psoc_e8/**'
+      - '.github/workflows/infineon-psoc-e8.yml'
+  # No cron: nightly.yml calls this, so the nightly stays one run and one triage writer
+  workflow_call:
+    inputs:
+      caller_run_id:
+        description: 'run id of the calling workflow; keeps a called run in its own concurrency group'
+        type: string
+        default: ''
+  workflow_dispatch:
+
+# github.workflow is the CALLER's name in a called workflow, so hardcode ours
+concurrency:
+  group: ${{ inputs.caller_run_id && format('psoc-e8-call-{0}', inputs.caller_run_id) || format('psoc-e8-{0}', github.ref) }}
+  cancel-in-progress: ${{ !inputs.caller_run_id }}
+
+permissions:
+  contents: read
+
+jobs:
+  psoc_e8:
+    name: Build / infineon_psoc_e8 (arm-none-eabi) wolfSSL master
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: ./.github/actions/apt-update
+      - name: Install toolchain
+        run: |
+          set -euo pipefail
+          sudo apt-get install -y --no-install-recommends \
+            gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
+
+      # The Infineon device support is pinned to the releases the example was
+      # validated with; see embedded/infineon_psoc_e8/README.md.
+      - name: Fetch wolfSSL and Infineon device support
+        run: |
+          set -euo pipefail
+          clone() { bash "$GITHUB_WORKSPACE/.github/scripts/git-clone-retry.sh" -q --depth 1 --branch "$1" "$2" "$3"; }
+          clone master https://github.com/wolfSSL/wolfssl /tmp/wolfssl
+          clone release-v1.8.0 https://github.com/Infineon/mtb-dsl-pse8xxgp /tmp/mtb-dsl-pse8xxgp
+          clone release-v1.5.0 https://github.com/Infineon/mtb-template-pse8xxgp /tmp/mtb-template-pse8xxgp
+          clone release-v1.8.0 https://github.com/Infineon/core-lib /tmp/core-lib
+          clone v6.4.0 https://github.com/ARM-software/CMSIS_6 /tmp/CMSIS_6
+
+      - name: Build (crypto engine, engine ECDSA verify, software only)
+        run: |
+          set -euo pipefail
+          cd embedded/infineon_psoc_e8
+          args="WOLFSSL_ROOT=/tmp/wolfssl PSE84_DSL=/tmp/mtb-dsl-pse8xxgp \
+            PSE84_TEMPLATE=/tmp/mtb-template-pse8xxgp CORE_LIB=/tmp/core-lib \
+            CMSIS=/tmp/CMSIS_6"
+          make $args
+          make $args PSOC_CRYPTO_ECC=1
+          make $args PSOC_CRYPTO=0
+
+      - name: Assert it really cross-compiled
+        run: |
+          set -euo pipefail
+          cd embedded/infineon_psoc_e8
+          for elf in Build/wolfcrypt_test.elf Build-ecc/wolfcrypt_test.elf \
+                     Build-sw/wolfcrypt_bench.elf; do
+            arch=$(readelf -h "$elf" | awk -F: '/Machine:/ {print $2}' | xargs)
+            echo "$elf: $arch"
+            case "$arch" in
+              *ARM*) ;;
+              *) echo "FAIL: not an ARM binary: $arch"; exit 1 ;;
+            esac
+          done
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -79,6 +79,12 @@ jobs:
     with:
       caller_run_id: ${{ github.run_id }}
 
+  infineon-psoc-e8:
+    needs: [refs]
+    uses: ./.github/workflows/infineon-psoc-e8.yml
+    with:
+      caller_run_id: ${{ github.run_id }}
+
   mynewt:
     needs: [refs]
     uses: ./.github/workflows/mynewt.yml

diff --git a/README.md b/README.md
@@ -294,6 +294,17 @@ Please see the [riot-os-posix-lwip/README.md](riot-os-posix-lwip/README.md) for
 further usage and details.
 
 
+<br />
+
+#### Infineon PSOC Edge E8 (KIT_PSE84_AI)
+
+This directory contains a bare-metal wolfCrypt test and benchmark for the
+PSOC Edge E84 Cortex-M33, using the on-chip crypto engine for SHA and AES,
+and its TRNG to seed the DRBG.
+
+Please see the [embedded/infineon_psoc_e8/README.md](embedded/infineon_psoc_e8/README.md) for further usage and details.
+
+
 <br />
 
 #### RT1060 (i.MX RT1060-EVK)

diff --git a/embedded/infineon_psoc_e8/.gitignore b/embedded/infineon_psoc_e8/.gitignore
@@ -0,0 +1,4 @@
+Build/
+Build-sw/
+Build-ecc/
+Build-sw-ecc/
diff --git a/embedded/infineon_psoc_e8/Makefile b/embedded/infineon_psoc_e8/Makefile
@@ -0,0 +1,121 @@
+# Makefile for the wolfCrypt test and benchmark on Infineon PSOC Edge E8
+#
+# Target: KIT_PSE84_AI (PSE846GPS2DBZC4A), CM33 Secure, run in place from QSPI
+# Usage:  make                 - build wolfcrypt_test and wolfcrypt_bench
+#         make PSOC_CRYPTO=0   - software only, for comparison
+#         make PSOC_CRYPTO_ECC=1 - ECDSA verify on the engine as well
+#         make clean
+#
+# Copyright (C) 2006-2026 wolfSSL Inc.
+
+TOOLCHAIN ?= arm-none-eabi-
+CC = $(TOOLCHAIN)gcc
+OBJCOPY = $(TOOLCHAIN)objcopy
+SIZE = $(TOOLCHAIN)size
+
+WOLFSSL_ROOT ?= ../../../wolfssl
+
+# Infineon device support, from github.com/Infineon (see README.md).
+PSE84_DSL ?= ../../../mtb-dsl-pse8xxgp
+PSE84_TEMPLATE ?= ../../../mtb-template-pse8xxgp
+CORE_LIB ?= ../../../core-lib
+CMSIS ?= ../../../CMSIS_6
+PSE84_PART ?= pse846gps2dbzc4a
+
+PSOC_CRYPTO ?= 1
+PSOC_CRYPTO_ECC ?= 0
+
+BUILD_DIR ?= ./Build$(if $(filter 0,$(PSOC_CRYPTO)),-sw)$(if $(filter 1,$(PSOC_CRYPTO_ECC)),-ecc)
+
+ARCHFLAGS = -mcpu=cortex-m33 -mthumb -mabi=aapcs
+
+CFLAGS = $(ARCHFLAGS) -std=gnu99 -Wall -O2 -g
+CFLAGS += -ffunction-sections -fdata-sections
+CFLAGS += -DWOLFSSL_USER_SETTINGS -DWOLFSSL_IGNORE_FILE_WARN
+CFLAGS += -DCOMPONENT_CM33 -DCORE_NAME_CM33_0 -DCOMPONENT_SECURE_DEVICE
+CFLAGS += -D$(shell echo $(PSE84_PART) | tr a-z A-Z)
+CFLAGS += -DPSE84_PART_HEADER='"$(PSE84_PART)_s.h"'
+CFLAGS += -I. -I$(WOLFSSL_ROOT)
+CFLAGS += -I$(PSE84_DSL)/pdl/drivers/include
+CFLAGS += -I$(PSE84_DSL)/pdl/drivers/third_party/ethernet/include
+CFLAGS += -I$(PSE84_DSL)/pdl/devices/include
+CFLAGS += -I$(PSE84_DSL)/pdl/devices/include/ip
+CFLAGS += -I$(PSE84_TEMPLATE)/files
+CFLAGS += -I$(PSE84_TEMPLATE)/files/devices/include
+CFLAGS += -I$(CORE_LIB)/include
+CFLAGS += -I$(CMSIS)/CMSIS/Core/Include
+ifeq ($(PSOC_CRYPTO),1)
+CFLAGS += -DWOLFSSL_PSOC6_CRYPTO
+endif
+ifneq ($(PSOC_CRYPTO_ECC),1)
+CFLAGS += -DNO_PSOC6_CRYPTO_ECC
+endif
+
+LDFLAGS = $(ARCHFLAGS) --specs=nano.specs -nostartfiles
+LDFLAGS += -Wl,--gc-sections -T./linker.ld
+LIBS = -lm
+
+WOLF = $(WOLFSSL_ROOT)/wolfcrypt/src
+SRC_WOLF = $(WOLF)/aes.c $(WOLF)/ecc.c $(WOLF)/error.c $(WOLF)/hash.c \
+    $(WOLF)/hmac.c $(WOLF)/logging.c $(WOLF)/memory.c $(WOLF)/misc.c \
+    $(WOLF)/random.c $(WOLF)/sha.c $(WOLF)/sha256.c $(WOLF)/sha512.c \
+    $(WOLF)/sha3.c $(WOLF)/sp_int.c $(WOLF)/sp_cortexm.c $(WOLF)/wc_port.c \
+    $(WOLF)/wolfmath.c $(WOLF)/asn.c $(WOLF)/coding.c $(WOLF)/kdf.c \
+    $(WOLF)/wc_encrypt.c $(WOLF)/signature.c \
+    $(WOLF)/port/cypress/psoc6_crypto.c
+
+# PDL crypto core drivers: the engine, its TRNG, and the ECC drivers when
+# ECDSA verify runs on the engine.
+PDL = $(PSE84_DSL)/pdl/drivers/source
+SRC_PDL = $(PDL)/cy_crypto_core_hw.c $(PDL)/cy_crypto_core_mem_v2.c \
+    $(PDL)/cy_crypto_core_sha_v2.c $(PDL)/cy_crypto_core_aes_v2.c \
+    $(PDL)/cy_crypto_core_vu.c $(PDL)/cy_crypto_core_trng.c
+ifeq ($(PSOC_CRYPTO_ECC),1)
+SRC_PDL += $(PDL)/cy_crypto_core_ecc_domain_params.c \
+    $(PDL)/cy_crypto_core_ecc_nist_p.c $(PDL)/cy_crypto_core_ecc_ecdsa.c \
+    $(PDL)/cy_crypto_core_ecc_key_gen.c $(PDL)/cy_crypto_core_ecc_ec25519.c
+endif
+
+SRC_TEST = $(WOLFSSL_ROOT)/wolfcrypt/test/test.c
+SRC_BENCH = $(WOLFSSL_ROOT)/wolfcrypt/benchmark/benchmark.c
+
+objs = $(addprefix $(BUILD_DIR)/$(1)/, $(notdir $(2:.c=.o)))
+OBJS_COMMON = $(call objs,common,$(SRC_WOLF) $(SRC_PDL) startup.c board.c)
+OBJS_TEST = $(OBJS_COMMON) $(call objs,test,main.c $(SRC_TEST))
+OBJS_BENCH = $(OBJS_COMMON) $(call objs,bench,main.c $(SRC_BENCH))
+
+vpath %.c . $(sort $(dir $(SRC_WOLF) $(SRC_PDL) $(SRC_TEST) $(SRC_BENCH)))
+
+.PHONY: all clean check-deps
+
+all: check-deps $(BUILD_DIR)/wolfcrypt_test.bin $(BUILD_DIR)/wolfcrypt_bench.bin
+	$(SIZE) $(BUILD_DIR)/wolfcrypt_test.elf $(BUILD_DIR)/wolfcrypt_bench.elf
+
+check-deps:
+	@for d in $(WOLFSSL_ROOT)/wolfcrypt $(PSE84_DSL)/pdl \
+	    $(PSE84_TEMPLATE)/files $(CORE_LIB)/include $(CMSIS)/CMSIS; do \
+	    test -d $$d || { echo "missing $$d (see README.md)"; exit 1; }; done
+
+$(BUILD_DIR)/common/%.o: %.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(BUILD_DIR)/test/%.o: %.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(BUILD_DIR)/bench/%.o: %.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -DBENCH_APP -c -o $@ $<
+
+$(BUILD_DIR)/wolfcrypt_test.elf: $(OBJS_TEST)
+	$(CC) $(LDFLAGS) -Wl,-Map=$(@:.elf=.map) -o $@ $^ $(LIBS)
+
+$(BUILD_DIR)/wolfcrypt_bench.elf: $(OBJS_BENCH)
+	$(CC) $(LDFLAGS) -Wl,-Map=$(@:.elf=.map) -o $@ $^ $(LIBS)
+
+$(BUILD_DIR)/%.bin: $(BUILD_DIR)/%.elf
+	$(OBJCOPY) -O binary $< $@
+
+clean:
+	rm -rf ./Build ./Build-sw ./Build-ecc ./Build-sw-ecc
diff --git a/embedded/infineon_psoc_e8/README.md b/embedded/infineon_psoc_e8/README.md
@@ -0,0 +1,47 @@
+# wolfCrypt on Infineon PSOC Edge E8
+
+Bare-metal wolfCrypt test and benchmark for the PSOC Edge E84 Cortex-M33 on the KIT_PSE84_AI board. The example runs in the Secure state as the first CM33 image Infineon's extended boot launches, in place from QSPI. It uses the on-chip crypto engine (MXCRYPTO) through wolfSSL's `WOLFSSL_PSOC6_CRYPTO` port for SHA-1/2/3 and AES (ECB, CBC, CFB, GCM), and seeds the Hash-DRBG from the engine's TRNG.
+
+## Requirements
+
+- `arm-none-eabi-gcc` with newlib
+- wolfSSL, with PSOC Edge support in the `WOLFSSL_PSOC6_CRYPTO` port
+- Infineon device support and CMSIS, at the releases this example was tested with:
+
+```sh
+git clone --depth 1 -b release-v1.8.0 https://github.com/Infineon/mtb-dsl-pse8xxgp
+git clone --depth 1 -b release-v1.5.0 https://github.com/Infineon/mtb-template-pse8xxgp
+git clone --depth 1 -b release-v1.8.0 https://github.com/Infineon/core-lib
+git clone --depth 1 -b v6.4.0 https://github.com/ARM-software/CMSIS_6
+```
+
+- ModusToolbox Programming Tools, for OpenOCD and the KitProg3 QSPI flash loader
+
+## Building
+
+The Makefile expects wolfSSL and the four repositories above next to `wolfssl-examples`. Override `WOLFSSL_ROOT`, `PSE84_DSL`, `PSE84_TEMPLATE`, `CORE_LIB` and `CMSIS` to point elsewhere.
+
+```sh
+make                 # Build/wolfcrypt_test.bin and Build/wolfcrypt_bench.bin
+make PSOC_CRYPTO=0   # software only, in Build-sw/
+make PSOC_CRYPTO_ECC=1  # ECDSA verify on the engine too, in Build-ecc/
+```
+
+Only the PDL crypto core drivers are compiled, so no ModusToolbox project or BSP is needed. `PSE84_PART` selects the part header (default `pse846gps2dbzc4a`).
+
+## Running
+
+```sh
+tools/flash.sh Build/wolfcrypt_test.bin
+tools/flash.sh Build/wolfcrypt_bench.bin
+```
+
+`tools/flash.sh` wraps the image in the MCUboot-format header that extended boot expects (`tools/mcuboot_wrap.py`) and programs it to QSPI `0x60100000` through the kit's KitProg3. Set `MTB_PROGTOOLS` if the tools are not in `/opt/Tools/ModusToolboxProgtools-1.6`, and `KITPROG_SERIAL` if several probes are attached. Output appears on the KitProg3 COM port at 115200 baud.
+
+This replaces the factory CM33 image, so read QSPI back first to keep the stock demo.
+
+## Notes
+
+- The clocks are left as extended boot sets them: the CM33 at 200 MHz and the console's peripheral clock at 100 MHz. Benchmark timing uses the DWT cycle counter.
+- Code and constants run from QSPI through the Secure code-bus alias. The port translates such addresses for the crypto engine, which reads memory over the system bus.
+- ECC runs in software with wolfSSL's SP math assembly, which verifies faster than the engine; `PSOC_CRYPTO_ECC=1` moves ECDSA verify to the engine. `WOLFSSL_SP_SMALL` is set because the full-size SP tables are slow to read from XIP flash.