Fix for tools/scripts/va416x0/build_test.sh portability (MacOS)

Added option to support wolfCrypt test/benchmark in test-app Add some checking if partition size is too large
2026-02-26 14:00:11 -08:00 · 2026-02-26 14:00:11 -08:00 · cbaa132588
parent 5075db7a10
commit cbaa132588
15 changed files with 565 additions and 39 deletions
--- a/1
+++ b/1
@ -202,6 +202,7 @@ endif

 # Environment variables for sign tool
 SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) \
+		 WOLFBOOT_PARTITION_SIZE=$(WOLFBOOT_PARTITION_SIZE) \
 		 WOLFBOOT_SECTOR_SIZE=$(WOLFBOOT_SECTOR_SIZE) \
 		 ML_DSA_LEVEL=$(ML_DSA_LEVEL) \
 		 IMAGE_SIGNATURE_SIZE=$(IMAGE_SIGNATURE_SIZE) \
--- a/config/examples/vorago_va416x0.config
+++ b/config/examples/vorago_va416x0.config
@ -33,7 +33,7 @@ DUALBANK_SWAP?=0
 PKA?=0
 ENCRYPT=0
 WOLFTPM?=0
-OPTIMIZATION_LEVEL=1
+OPTIMIZATION_LEVEL=s

 # Optionally allow downgrade to older valid version in update partition
 ALLOW_DOWNGRADE?=0
@ -45,11 +45,11 @@ NO_ARM_ASM?=0
 # Optional: Use smaller SHA512
 #CFLAGS_EXTRA+=-DUSE_SLOW_SHA512

-# 38KB boot, 108KB partitions, 2KB swap
+# Optimized: 46KB wolfboot, 104KB partitions, 2KB swap
 WOLFBOOT_SECTOR_SIZE?=0x800
-WOLFBOOT_PARTITION_SIZE?=0x1B000
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x9800
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x24800
+WOLFBOOT_PARTITION_SIZE?=0x1A000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xB800
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x25800
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x3F800

 # ML-DSA 5: 36KB boot, 96KB partitions, 12KB swap
@ -81,3 +81,9 @@ WOLFBOOT_RESTORE_CLOCK?=1
 # Optional debugging
 #CFLAGS_EXTRA+=-DDEBUG_EXT_FLASH
 #CFLAGS_EXTRA+=-DTEST_EXT_FLASH
+
+# Optional: Enable wolfCrypt test and benchmark in test-app
+# Uncomment to enable
+# Note: Requires ~80-160KB additional flash and ~10-20KB RAM
+#WOLFCRYPT_TEST?=1
+#WOLFCRYPT_BENCHMARK?=1
--- a/include/user_settings.h
+++ b/include/user_settings.h
@ -92,6 +92,7 @@ extern int tolower(int c);
 #   define NO_ED448_EXPORT
 #   define WOLFSSL_SHA3
 #   define WOLFSSL_SHAKE256
+#   define WOLFSSL_SHA512
 #endif

 /* ECC */
@ -101,8 +102,8 @@ extern int tolower(int c);
    defined(WOLFBOOT_SIGN_SECONDARY_ECC256) || \
    defined(WOLFBOOT_SIGN_SECONDARY_ECC384) || \
    defined(WOLFBOOT_SIGN_SECONDARY_ECC521) || \
-    defined(WOLFCRYPT_SECURE_MODE)
-
+    defined(WOLFCRYPT_SECURE_MODE) || \
+    defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)

 #   define HAVE_ECC
 #   define ECC_TIMING_RESISTANT
@ -118,6 +119,7 @@ extern int tolower(int c);

    /* Some ECC options are disabled to reduce size */
 #   if !defined(WOLFCRYPT_SECURE_MODE) && \
+       !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK) && \
       !defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
       !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
 #       if !defined(WOLFBOOT_TPM)
@ -138,6 +140,7 @@ extern int tolower(int c);
 #       endif
 #   else
 #       define HAVE_ECC_SIGN
+#       define HAVE_ECC_VERIFY
 #ifndef PKCS11_SMALL
 #       define HAVE_ECC_CDH
 #endif
@ -147,6 +150,7 @@ extern int tolower(int c);
 #       define WOLFSSL_HAVE_SP_ECC
 #       define WOLFSSL_KEY_GEN
 #       define HAVE_ECC_KEY_EXPORT
+#       define HAVE_ECC_KEY_IMPORT
 #   endif

    /* SP MATH */
@ -160,15 +164,18 @@ extern int tolower(int c);

    /* Curve */
 #   if defined(WOLFBOOT_SIGN_ECC256) || defined(WOLFCRYPT_SECURE_MODE) || \
-        defined(WOLFBOOT_SIGN_SECONDARY_ECC256)
+        defined(WOLFBOOT_SIGN_SECONDARY_ECC256) || \
+        defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
 #       define HAVE_ECC256
 #   endif
 #   if defined(WOLFBOOT_SIGN_ECC384) || \
        defined(WOLFBOOT_SIGN_SECONDARY_ECC384) || \
-        defined(WOLFCRYPT_SECURE_MODE)
+        defined(WOLFCRYPT_SECURE_MODE) || \
+        defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
 #       define HAVE_ECC384
 #       define WOLFSSL_SP_384
 #   endif
+    /* ECC521 only enabled if specifically requested (not for tests - too large) */
 #   if defined(WOLFBOOT_SIGN_ECC521) || \
        defined(WOLFBOOT_SIGN_SECONDARY_ECC521) || \
        defined(WOLFCRYPT_SECURE_MODE)
@ -219,6 +226,7 @@ extern int tolower(int c);
 #   define RSA_LOW_MEM
 #   define WC_ASN_HASH_SHA256
 #   if !defined(WOLFBOOT_TPM) && !defined(WOLFCRYPT_SECURE_MODE) && \
+       !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK) && \
       !defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
       !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
 #       define WOLFSSL_RSA_VERIFY_INLINE
@ -305,7 +313,8 @@ extern int tolower(int c);
 #ifdef WOLFBOOT_HASH_SHA3_384
 #   define WOLFSSL_SHA3
 #   if defined(NO_RSA) && !defined(WOLFBOOT_TPM) && \
-    !defined(WOLFCRYPT_SECURE_MODE)
+        !defined(WOLFCRYPT_SECURE_MODE) && \
+        !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
 #       define NO_SHA256
 #   endif
 #endif
@ -313,7 +322,8 @@ extern int tolower(int c);
 #ifdef WOLFBOOT_HASH_SHA384
 #   define WOLFSSL_SHA384
 #   if defined(NO_RSA) && !defined(WOLFBOOT_TPM) && \
-    !defined(WOLFCRYPT_SECURE_MODE)
+    !defined(WOLFCRYPT_SECURE_MODE) && \
+    !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
 #       define NO_SHA256
 #   endif
 #ifndef WOLFSSL_SHA512
@ -410,7 +420,8 @@ extern int tolower(int c);

 #if (defined(WOLFBOOT_TPM_SEAL) && defined(WOLFBOOT_ATA_DISK_LOCK)) || \
    defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) || \
-    defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
+    defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER) || \
+    defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
 #   define WOLFSSL_BASE64_ENCODE
 #else
 #   define NO_CODING
@ -464,7 +475,8 @@ extern int tolower(int c);
    #endif
 #endif

-#if !defined(WOLFCRYPT_SECURE_MODE) && !defined(WOLFBOOT_TPM_PARMENC)
+#if !defined(WOLFCRYPT_SECURE_MODE) && !defined(WOLFBOOT_TPM_PARMENC) && \
+    !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
 #if !(defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
      defined(WOLFBOOT_SIGN_ML_DSA)) && \
    !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
@ -473,23 +485,40 @@ extern int tolower(int c);
    #define WC_NO_HASHDRBG
    #define NO_AES_CBC
 #else
-    #define HAVE_HASHDRBG
-    #define WOLFSSL_AES_CFB
+    #if defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
+        /* Use custom RNG for tests/benchmarks (saves ~7KB vs HASHDRBG).
+         * WARNING: my_rng_seed_gen is NOT cryptographically secure.
+         * Only used in test-app builds, not in production wolfBoot. */
+        #define WC_NO_HASHDRBG
+        #define CUSTOM_RAND_GENERATE_SEED my_rng_seed_gen
+        #define CUSTOM_RAND_GENERATE_BLOCK my_rng_seed_gen
+        extern int my_rng_seed_gen(unsigned char* output, unsigned int sz);
+    #else
+        #define HAVE_HASHDRBG
+        #define WOLFSSL_AES_CFB
+    #endif
 #endif


 #if !defined(ENCRYPT_WITH_AES128) && !defined(ENCRYPT_WITH_AES256) && \
-    !defined(WOLFBOOT_TPM_PARMENC) && !defined(WOLFCRYPT_SECURE_MODE)
+    !defined(WOLFBOOT_TPM_PARMENC) && !defined(WOLFCRYPT_SECURE_MODE) && \
+    !defined(SECURE_PKCS11) && !defined(WOLFCRYPT_TZ_PSA) && \
+    !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
    #define NO_AES
 #endif

-#if !defined(WOLFBOOT_TPM) && !defined(WOLFCRYPT_SECURE_MODE)
+#if !defined(WOLFBOOT_TPM) && !defined(WOLFCRYPT_SECURE_MODE) && \
+    !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
 #   define NO_HMAC
-#if !(defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
-      defined(WOLFBOOT_SIGN_ML_DSA)) &&          \
-    !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
-#define WC_NO_RNG
 #endif
+
+#if !defined(WOLFBOOT_TPM) && !defined(WOLFCRYPT_SECURE_MODE) && \
+    !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
+#   if !(defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
+       defined(WOLFBOOT_SIGN_ML_DSA)) &&          \
+      !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
+#   define WC_NO_RNG
+#   endif
 #   define WC_NO_HASHDRBG
 #   define NO_DEV_RANDOM
 #   if !defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
@ -534,9 +563,55 @@ extern int tolower(int c);
 #define NO_CHECK_PRIVATE_KEY
 #define NO_KDF

-#define BENCH_EMBEDDED
-#define NO_CRYPT_TEST
-#define NO_CRYPT_BENCHMARK
+/* wolfCrypt Test/Benchmark Configuration */
+#ifdef WOLFCRYPT_TEST
+    /* Skip extended tests to save memory */
+    #define NO_CRYPT_TEST_EXTENDED
+    /* Use smaller certificate buffers */
+    #define USE_CERT_BUFFERS_256
+    /* Override default NO_CRYPT_TEST */
+    #undef NO_CRYPT_TEST
+#else
+    #define NO_CRYPT_TEST
+#endif
+
+#ifdef WOLFCRYPT_BENCHMARK
+    /* Embedded benchmark mode */
+    #ifndef BENCH_EMBEDDED
+        #define BENCH_EMBEDDED
+    #endif
+    /* Override default NO_CRYPT_BENCHMARK */
+    #undef NO_CRYPT_BENCHMARK
+#else
+    #define NO_CRYPT_BENCHMARK
+#endif
+
+/* Common optimizations when test/benchmark enabled */
+#if defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
+    #define NO_WRITE_TEMP_FILES
+
+    /* Use static memory pool to avoid system malloc dependency.
+     * benchmark.c provides gBenchMemory static buffer.
+     * Default is 50KB with BENCH_EMBEDDED, override for smaller targets */
+    #ifndef WOLFSSL_STATIC_MEMORY
+        #define WOLFSSL_STATIC_MEMORY
+    #endif
+    #ifndef WOLFSSL_STATIC_MEMORY_TEST_SZ
+        #define WOLFSSL_STATIC_MEMORY_TEST_SZ (10 * 1024)
+    #endif
+
+    /* Enable SP math digit operations */
+    #define WOLFSSL_SP_MUL_D
+
+    /* User time functions provided */
+    #define WOLFSSL_USER_CURRTIME
+    #define XTIME my_time
+    extern unsigned long my_time(unsigned long* timer);
+#endif
+
+#if !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
+    #define BENCH_EMBEDDED
+#endif

 #if defined(WOLFCRYPT_TZ_PSA)
 #undef NO_CMAC
@ -566,7 +641,8 @@ extern int tolower(int c);
 #       define WOLFSSL_SP_NO_DYN_STACK
 #   endif
 #   if !defined(SECURE_PKCS11) && !defined(WOLFCRYPT_TZ_PSA) && \
-       !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
+       !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER) && \
+       !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
 #       define NO_WOLFSSL_MEMORY
 #       define WOLFSSL_NO_MALLOC
 #   endif
--- a/lib/wolfssl
+++ b/lib/wolfssl
@ -1 +1 @@
-Subproject commit 8741805e9d1fd9c3014b5b774ad09a77ccb5b0dc
+Subproject commit a08efc9b0afe99d6a448804746eb16febb67cbba
--- a/src/update_flash.c
+++ b/src/update_flash.c
@ -720,11 +720,13 @@ out:
 #    endif
 #endif

-/* Reserve space for two sectors in case of NVM_FLASH_WRITEONCE, for redundancy */
+/* Max firmware size: partition must hold header + fw + trailer sector(s) */
 #ifndef NVM_FLASH_WRITEONCE
-    #define MAX_UPDATE_SIZE (size_t)((WOLFBOOT_PARTITION_SIZE - WOLFBOOT_SECTOR_SIZE))
+    #define MAX_UPDATE_SIZE (size_t)((WOLFBOOT_PARTITION_SIZE - \
+        IMAGE_HEADER_SIZE - WOLFBOOT_SECTOR_SIZE))
 #else
-    #define MAX_UPDATE_SIZE (size_t)((WOLFBOOT_PARTITION_SIZE - (2 *WOLFBOOT_SECTOR_SIZE)))
+    #define MAX_UPDATE_SIZE (size_t)((WOLFBOOT_PARTITION_SIZE - \
+        IMAGE_HEADER_SIZE - (2 * WOLFBOOT_SECTOR_SIZE)))
 #endif

 static int wolfBoot_get_total_size(struct wolfBoot_image* boot,
--- a/test-app/ARM-va416x0.ld
+++ b/test-app/ARM-va416x0.ld
@ -1,5 +1,5 @@
-_Min_Heap_Size  = 0x00002000; /* required amount of heap  */
-_Min_Stack_Size = 0x00002000; /* required amount of stack */
+_Min_Heap_Size  = 0x00000100; /* minimal heap (not using malloc) */
+_Min_Stack_Size = 0x00003000; /* required amount of stack */

 /* Memory areas */
 MEMORY
--- a/test-app/Makefile
+++ b/test-app/Makefile
@ -95,6 +95,71 @@ ifeq ($(DEBUG_UART),1)
    APP_OBJS+=../src/string.o
 endif

+# wolfCrypt Test and Benchmark Support
+WOLFCRYPT_SUPPORT=0
+
+ifeq ($(WOLFCRYPT_TEST),1)
+  CFLAGS+=-DWOLFCRYPT_TEST
+  WOLFCRYPT_SUPPORT=1
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/test/test.o
+endif
+
+ifeq ($(WOLFCRYPT_BENCHMARK),1)
+  CFLAGS+=-DWOLFCRYPT_BENCHMARK
+  WOLFCRYPT_SUPPORT=1
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/benchmark/benchmark.o
+endif
+
+ifeq ($(WOLFCRYPT_SUPPORT),1)
+  # Add support infrastructure
+  APP_OBJS+=wolfcrypt_support.o
+  APP_OBJS+=syscalls.o
+
+  # Add wolfCrypt core implementation files
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hash.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wc_port.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/logging.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/misc.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wolfmath.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/asn.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/coding.o
+
+  # Add SHA implementations (needed for test/benchmark)
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha512.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
+
+  # Add RNG support (needed for ECC signing and tests)
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
+
+  # Add AES support (needed by benchmark for AES-CBC etc.)
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/aes.o
+
+  # Add ECC support (needed by test suite)
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/ecc.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sp_int.o
+
+  # Add SP math implementations for ARM Cortex-M
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sp_cortexm.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sp_c32.o
+
+  ifneq ($(NO_ARM_ASM),1)
+    APP_OBJS+= \
+          $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/thumb2-aes-asm_c.o \
+          $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.o \
+          $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.o \
+          $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.o \
+          $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.o
+
+    CFLAGS+=-DWOLFSSL_ARMASM -DWOLFSSL_ARMASM_NO_HW_CRYPTO -DWOLFSSL_ARMASM_INLINE \
+                              -DWOLFSSL_ARMASM_NO_NEON -DWOLFSSL_ARMASM_THUMB2
+  endif
+
+  CFLAGS+=-DWOLFSSL_USER_SETTINGS
+  CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFSSL)"
+endif
+
 ifeq ($(TZEN),1)
    CFLAGS+=-DNONSECURE_APP
    CFLAGS+=-I./
@ -335,6 +400,17 @@ ifeq ($(TARGET),va416x0)
  ifneq ($(SIGN),NONE)
    APP_OBJS+=../src/keystore.o
  endif
+  # Reduce size: newlib-nano and section GC
+  LDFLAGS+=--specs=nano.specs
+  ifneq ($(WOLFCRYPT_SUPPORT),1)
+    # Only use nosys stubs when not providing our own syscalls
+    LDFLAGS+=--specs=nosys.specs
+  endif
+  ifeq ($(WOLFCRYPT_BENCHMARK),1)
+    # Benchmark needs float printf for results
+    LDFLAGS+=-u _printf_float
+  endif
+  CFLAGS+=-ffunction-sections -fdata-sections
 endif

 ifeq ($(TARGET),sim)
--- a/test-app/app_va416x0.c
+++ b/test-app/app_va416x0.c
@ -35,6 +35,19 @@

 #include "../hal/va416x0.h"

+/* wolfCrypt test/benchmark support */
+#ifdef WOLFCRYPT_TEST
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfcrypt/test/test.h>
+int wolfcrypt_test(void *args);
+#endif
+
+#ifdef WOLFCRYPT_BENCHMARK
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfcrypt/benchmark/benchmark.h>
+int benchmark_test(void *args);
+#endif
+
 /* Vorago HAL includes */
 #include "va416xx_hal.h"
 #include "va416xx_hal_clkgen.h"
@ -151,6 +164,21 @@ void main(void)

    print_info();

+#ifdef WOLFCRYPT_TEST
+    wolfBoot_printf("\r\nRunning wolfCrypt tests...\r\n");
+    wolfCrypt_Init();
+    wolfcrypt_test(NULL);
+    wolfCrypt_Cleanup();
+    wolfBoot_printf("Tests complete.\r\n\r\n");
+#endif
+
+#ifdef WOLFCRYPT_BENCHMARK
+    wolfBoot_printf("Running wolfCrypt benchmarks...\r\n");
+    wolfCrypt_Init();
+    benchmark_test(NULL);
+    wolfCrypt_Cleanup();
+    wolfBoot_printf("Benchmarks complete.\r\n\r\n");
+#endif

    if (app_version > 1) {
        /* Turn on update LED */
--- a/test-app/syscalls.c
+++ b/test-app/syscalls.c
@ -0,0 +1,119 @@
+/* syscalls.c
+ *
+ * Newlib syscall stubs for embedded systems without filesystem
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <stdint.h>
+#include <sys/stat.h>
+#include <errno.h>
+
+#undef errno
+extern int errno;
+
+/* Heap management */
+extern char _end; /* Defined by linker */
+extern char _Min_Heap_Size; /* Linker symbol: address is the value */
+
+char *__env[1] = { 0 };
+char **environ = __env;
+
+int _close(int file)
+{
+    return -1;
+}
+
+int _fstat(int file, struct stat *st)
+{
+    st->st_mode = S_IFCHR;
+    return 0;
+}
+
+int _isatty(int file)
+{
+    return 1;
+}
+
+int _lseek(int file, int ptr, int dir)
+{
+    return 0;
+}
+
+int _read(int file, char *ptr, int len)
+{
+    return 0;
+}
+
+void *_sbrk(int incr)
+{
+    static char *heap_end = 0;
+    char *prev_heap_end;
+    char *heap_limit;
+
+    if (heap_end == 0) {
+        heap_end = &_end;
+    }
+    prev_heap_end = heap_end;
+
+    /* Calculate heap limit: _Min_Heap_Size is a linker symbol whose
+     * address represents the size value */
+    heap_limit = &_end + (uintptr_t)&_Min_Heap_Size;
+
+    if (heap_end + incr > heap_limit) {
+        errno = ENOMEM;
+        return (void *)-1;
+    }
+
+    heap_end += incr;
+    return prev_heap_end;
+}
+
+/* Forward declaration of UART write function */
+extern void uart_write(const char *buf, unsigned int sz);
+
+int _write(int file, char *ptr, int len)
+{
+    int i;
+
+    /* Write to UART for stdout/stderr */
+    if (file == 1 || file == 2) {
+        uart_write(ptr, len);
+    }
+
+    return len;
+}
+
+void _exit(int status)
+{
+    while (1) {
+        /* Intentional infinite loop - bare-metal has nowhere to exit to */
+    }
+}
+
+int _kill(int pid, int sig)
+{
+    errno = EINVAL;
+    return -1;
+}
+
+int _getpid(void)
+{
+    return 1;
+}
--- a/test-app/wcs/user_settings.h
+++ b/test-app/wcs/user_settings.h
@ -147,7 +147,9 @@ extern int tolower(int c);
 #define NO_ERROR_STRINGS
 #define NO_KDF

-#define WC_TEST_NO_CRYPTOCB_SW_TEST
+#ifdef WOLF_CRYPTO_CB
+    #define WC_TEST_NO_CRYPTOCB_SW_TEST
+#endif
 #define BENCH_EMBEDDED

 #define HAVE_ECC_KEY_EXPORT
--- a/test-app/wolfcrypt_support.c
+++ b/test-app/wolfcrypt_support.c
@ -0,0 +1,123 @@
+/* wolfcrypt_support.c
+ *
+ * Support infrastructure for wolfCrypt test and benchmark
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <stdint.h>
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/types.h>
+
+#if defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)
+
+/* ========== TIME FUNCTIONS ========== */
+
+/*
+ * Time implementation strategy:
+ * 1. If WOLFCRYPT_SECURE_MODE - use secure world API
+ * 2. If target has SysTick/timer - use hardware timer
+ * 3. Fallback - simple counter (not accurate for benchmarks)
+ */
+
+#if defined(WOLFCRYPT_SECURE_MODE)
+    /* Use secure mode API for time */
+    #include "wolfboot/wc_secure.h"
+#elif defined(TARGET_va416x0)
+    /* Use Vorago SDK HAL_time_ms (incremented by SysTick_Handler every 1ms) */
+    extern volatile uint64_t HAL_time_ms;
+#else
+    /* Simple tick counter fallback */
+    static volatile unsigned int tick_counter = 0;
+#endif
+
+/* my_time() - Used by wolfCrypt ASN.c for certificate time checking
+ * Returns: Current time in seconds since epoch (or counter value)
+ */
+unsigned long my_time(unsigned long* timer)
+{
+#if defined(WOLFCRYPT_SECURE_MODE)
+    /* Get time from secure world */
+    unsigned long t = wolfBoot_nsc_get_time();
+    if (timer) *timer = t;
+    return t;
+#elif defined(TARGET_va416x0)
+    unsigned long t = (unsigned long)(HAL_time_ms / 1000);
+    if (timer) *timer = t;
+    return t;
+#else
+    /* Simple incrementing counter */
+    tick_counter++;
+    if (timer) *timer = tick_counter;
+    return tick_counter;
+#endif
+}
+
+#ifdef WOLFCRYPT_BENCHMARK
+/* current_time() - Used by wolfCrypt benchmark tool for timing measurements
+ * Parameter: reset - if non-zero, reset the timer
+ * Returns: Current time in seconds (floating point)
+ */
+double current_time(int reset)
+{
+    (void)reset;
+
+#if defined(WOLFCRYPT_SECURE_MODE)
+    return wolfBoot_nsc_current_time(reset);
+#elif defined(TARGET_va416x0)
+    /* Use Vorago SDK SysTick-based millisecond counter */
+    return (double)HAL_time_ms / 1000.0;
+#else
+    /* Simple counter-based timing */
+    double timeNow = (double)tick_counter;
+    return timeNow;
+#endif
+}
+#endif /* WOLFCRYPT_BENCHMARK */
+
+/* ========== RNG SEED FUNCTIONS ========== */
+
+/*
+ * RNG seed generation strategy:
+ * 1. If WOLFCRYPT_SECURE_MODE - use secure TRNG
+ * 2. If target has TRNG - use hardware random
+ * 3. Fallback - pseudo-random based on time (NOT cryptographically secure)
+ */
+
+/* Simple incrementing RNG for testing (not cryptographically secure).
+ * Fixed non-zero seed for deterministic test/benchmark results. */
+static uint32_t test_rng_counter = 0x12345678;
+
+/* my_rng_seed_gen() - Generate random seed/data for test/benchmark
+ * This is NOT cryptographically secure - only for testing!
+ * Returns: 0 on success
+ */
+int my_rng_seed_gen(unsigned char* output, unsigned int sz)
+{
+    unsigned int i;
+    for (i = 0; i < sz; i++) {
+        if ((i % 4) == 0) {
+            test_rng_counter++;
+        }
+        output[i] = (unsigned char)(test_rng_counter >> ((i % 4) * 8));
+    }
+    return 0;
+}
+
+#endif /* WOLFCRYPT_TEST || WOLFCRYPT_BENCHMARK */
--- a/tools/keytools/sign.c
+++ b/tools/keytools/sign.c
@ -1740,6 +1740,55 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
        header[header_idx++] = 0xFF;
    }

+    /* Check if signed image fits in partition */
+    {
+        const char *env_psize = getenv("WOLFBOOT_PARTITION_SIZE");
+        const char *env_ssize = getenv("WOLFBOOT_SECTOR_SIZE");
+        if (env_psize) {
+            char *endptr;
+            unsigned long tmp;
+            uint32_t partition_sz, sector_sz = 0;
+
+            errno = 0;
+            tmp = strtoul(env_psize, &endptr, 0);
+            if (endptr == env_psize || *endptr != '\0' ||
+                    errno == ERANGE || tmp == 0 || tmp > UINT32_MAX) {
+                printf("Error: Invalid WOLFBOOT_PARTITION_SIZE '%s'\n",
+                    env_psize);
+                goto failure;
+            }
+            partition_sz = (uint32_t)tmp;
+
+            if (env_ssize) {
+                errno = 0;
+                tmp = strtoul(env_ssize, &endptr, 0);
+                if (endptr == env_ssize || *endptr != '\0' ||
+                        errno == ERANGE || tmp == 0 || tmp > UINT32_MAX) {
+                    printf("Error: Invalid WOLFBOOT_SECTOR_SIZE '%s'\n",
+                        env_ssize);
+                    goto failure;
+                }
+                sector_sz = (uint32_t)tmp;
+            }
+
+            {
+                uint32_t total_img_sz = CMD.header_sz + image_sz;
+                /* Only subtract sector for trailer when sector < partition.
+                 * When sector >= partition (e.g. update_ram targets), the
+                 * entire partition is available for the image. */
+                uint32_t max_img_sz = (sector_sz < partition_sz) ?
+                    (partition_sz - sector_sz) : partition_sz;
+                if (total_img_sz > max_img_sz) {
+                    printf("Error: Image size %u (header %u + firmware %u) "
+                        "exceeds max %u (partition %u - sector %u)\n",
+                        total_img_sz, CMD.header_sz, image_sz,
+                        max_img_sz, partition_sz, sector_sz);
+                    goto failure;
+                }
+            }
+        }
+    }
+
    /* Create output image */
    f = fopen(outfile, "w+b");
    if (f == NULL) {
--- a/tools/keytools/sign.py
+++ b/tools/keytools/sign.py
@ -72,6 +72,8 @@ HDR_IMG_TYPE_WOLFBOOT     = 0x0000
 HDR_IMG_TYPE_APP          = 0x0001

 WOLFBOOT_HEADER_SIZE = 256
+WOLFBOOT_PARTITION_SIZE = 0
+WOLFBOOT_SECTOR_SIZE = 0

 sign="auto"
 self_update=False
@ -386,6 +388,12 @@ if cfile:
            val=l.split('=')[1].rstrip('\n')
            WOLFBOOT_HEADER_SIZE = int(val,0)
            print("IMAGE_HEADER_SIZE (from .config): " + str(WOLFBOOT_HEADER_SIZE))
+        if "WOLFBOOT_PARTITION_SIZE" in l and "ADDRESS" not in l:
+            val=l.split('=')[1].rstrip('\n')
+            WOLFBOOT_PARTITION_SIZE = int(val,0)
+        if "WOLFBOOT_SECTOR_SIZE" in l:
+            val=l.split('=')[1].rstrip('\n')
+            WOLFBOOT_SECTOR_SIZE = int(val,0)

        l = cfile.readline()
    cfile.close()
@ -704,6 +712,24 @@ while True:
 infile.close()
 outfile.close()

+# Check if signed image fits in partition
+if WOLFBOOT_PARTITION_SIZE > 0:
+    img_size = os.path.getsize(image_file)
+    total_img_sz = WOLFBOOT_HEADER_SIZE + img_size
+    # Only subtract sector for trailer when sector < partition.
+    # When sector >= partition (e.g. update_ram targets), the
+    # entire partition is available for the image.
+    if WOLFBOOT_SECTOR_SIZE < WOLFBOOT_PARTITION_SIZE:
+        max_img_sz = WOLFBOOT_PARTITION_SIZE - WOLFBOOT_SECTOR_SIZE
+    else:
+        max_img_sz = WOLFBOOT_PARTITION_SIZE
+    if total_img_sz > max_img_sz:
+        print("Error: Image size %d (header %d + firmware %d) "
+            "exceeds max %d (partition %d - sector %d)" %
+            (total_img_sz, WOLFBOOT_HEADER_SIZE, img_size,
+            max_img_sz, WOLFBOOT_PARTITION_SIZE, WOLFBOOT_SECTOR_SIZE))
+        sys.exit(1)
+
 if (encrypt):
    delta_align=64
 else:
--- a/tools/scripts/va416x0/build_test.sh
+++ b/tools/scripts/va416x0/build_test.sh
@ -16,6 +16,20 @@ MODE=$1
 # Set version: default to 1 for clean, default to 2 for update
 VERSION=$([ "$MODE" = "clean" ] && echo "${2:-1}" || echo "${2:-2}")

+# Find JLinkExe (in PATH on Linux, /Applications/SEGGER on macOS)
+if command -v JLinkExe >/dev/null 2>&1; then
+    JLINK="JLinkExe"
+else
+    # Check for versioned JLink directory on macOS (e.g., JLink_V812g)
+    JLINK_PATH=$(find /Applications/SEGGER -name "JLinkExe" 2>/dev/null | head -n1)
+    if [ -n "$JLINK_PATH" ] && [ -x "$JLINK_PATH" ]; then
+        JLINK="$JLINK_PATH"
+    else
+        echo "Error: JLinkExe not found. Please install SEGGER J-Link software."
+        exit 1
+    fi
+fi
+
 # Function to get value from .config file
 get_config_value() {
    grep "^${1}" .config | sed -E "s/^${1}[?]?=//" | head -n1
@ -24,18 +38,23 @@ get_config_value() {
 # Extract values from .config
 BOOT_ADDRESS=$(get_config_value "WOLFBOOT_PARTITION_BOOT_ADDRESS")
 UPDATE_ADDRESS=$(get_config_value "WOLFBOOT_PARTITION_UPDATE_ADDRESS")
+PARTITION_SIZE=$(get_config_value "WOLFBOOT_PARTITION_SIZE")
+SECTOR_SIZE=$(get_config_value "WOLFBOOT_SECTOR_SIZE")
 IMAGE_HEADER_SIZE=$(get_config_value "IMAGE_HEADER_SIZE")
 SIGN=$(get_config_value "SIGN")
 HASH=$(get_config_value "HASH")
-SIGN_ARG="--${SIGN,,}"
-HASH_ARG="--${HASH,,}"
+SIGN_ARG="--$(echo "${SIGN}" | tr '[:upper:]' '[:lower:]')"
+HASH_ARG="--$(echo "${HASH}" | tr '[:upper:]' '[:lower:]')"

 # Common build steps
 make clean && make wolfboot.bin && make test-app/image.bin

 # Function to sign image
 sign_image() {
-    IMAGE_HEADER_SIZE=${IMAGE_HEADER_SIZE} ./tools/keytools/sign ${SIGN_ARG} ${HASH_ARG} test-app/image.bin wolfboot_signing_private_key.der "$1"
+    IMAGE_HEADER_SIZE=${IMAGE_HEADER_SIZE} \
+    WOLFBOOT_PARTITION_SIZE=${PARTITION_SIZE} \
+    WOLFBOOT_SECTOR_SIZE=${SECTOR_SIZE} \
+    ./tools/keytools/sign ${SIGN_ARG} ${HASH_ARG} test-app/image.bin wolfboot_signing_private_key.der "$1"
 }

 # Function to print summary
@ -57,10 +76,9 @@ if [ "$MODE" = "clean" ]; then
    ./tools/bin-assemble/bin-assemble factory.bin 0x0 wolfboot.bin \
        ${BOOT_ADDRESS} test-app/image_v${VERSION}_signed.bin \
        ${UPDATE_ADDRESS} blank_update.bin
-    JLinkExe -CommanderScript tools/scripts/va416x0/flash_va416xx.jlink
+    ${JLINK} -CommanderScript tools/scripts/va416x0/flash_va416xx.jlink
    print_summary
 else
-    PARTITION_SIZE=$(get_config_value "WOLFBOOT_PARTITION_SIZE")
    TRIGGER_ADDRESS=$(printf "0x%X" $((${UPDATE_ADDRESS} + ${PARTITION_SIZE} - 5)))
    PREV_VERSION=$((${VERSION} - 1))
    sign_image ${PREV_VERSION} && sign_image ${VERSION}
@ -69,6 +87,6 @@ else
        ${BOOT_ADDRESS} test-app/image_v${PREV_VERSION}_signed.bin \
        ${UPDATE_ADDRESS} test-app/image_v${VERSION}_signed.bin \
        ${TRIGGER_ADDRESS} trigger_magic.bin
-    JLinkExe -CommanderScript tools/scripts/va416x0/flash_va416xx_update.jlink
+    ${JLINK} -CommanderScript tools/scripts/va416x0/flash_va416xx_update.jlink
    print_summary "${TRIGGER_ADDRESS}" "${PREV_VERSION}"
 fi
--- a/tools/test.mk
+++ b/tools/test.mk
@ -1143,5 +1143,5 @@ test-size-all:
 		LIMIT=8560 NO_ARM_ASM=1
 	make keysclean
 	make clean
-	make test-size SIGN=ML_DSA ML_DSA_LEVEL=2 LIMIT=19354 \
+	make test-size SIGN=ML_DSA ML_DSA_LEVEL=2 LIMIT=19362 \
 		IMAGE_SIGNATURE_SIZE=2420 IMAGE_HEADER_SIZE?=8192