Renesas RX: GCC 8.3/14.2 build support, generic watchdog, and CI

[dgarske]

Summary

Updates the Renesas RX port to build with current GNU RX toolchains (GCC RX 8.3.0 and 14.2.0) and current wolfSSL, adds a generic external-watchdog hook, and adds RX CI.

RX build fixes (GCC RX 8.3/14.2 + updated wolfSSL)

The RX port previously built only with the old GNU RX 4.x toolchain. Fixes:

• libgcc is resolved via rx-elf-gcc -print-libgcc-file-name (correct per-endianness multilib) instead of a hard-coded -L.
• .bss is (NOLOAD) with its LMA pinned to its VMA, so it no longer wraps past the top-of-address-space ROM under newer binutils.
• The RX WOLFSSL_NO_CT_OPS workaround is gated to old GCC only (current wolfSSL sp_int.c needs ctMaskLT).
• -gstabs (removed in GCC 12) becomes -gdwarf-4.
• RX startup _exit halts instead of calling newlib __call_exitprocs (wolfBoot does not link libc).
• Relax -Werror=enum-conversion for the wolfSSL TSIP port (GCC RX 14.2 only).
• Host keytools build on old MinGW: %j -> %l in sign.c; gate fopen_s/errno_t on _MSC_VER in bin-assemble.c.

Generic external watchdog

wolfBoot_watchdog_feed() -- a weak no-op wolfBoot calls from its hash and flash copy/erase loops when built with -DWATCHDOG. Compiles out entirely otherwise. A port overrides it to service its watchdog.

Includes an RX reference driver that toggles a WDI GPIO for an external windowed watchdog (e.g. Maxim MAX6316-MAX6322), selected with WATCHDOG_WDI_PORT / WATCHDOG_WDI_PIN.

CI

Adds test-build-renesas-rx.yml and wires renesas-rx65n (little- and big-endian) and renesas-rx72n example builds into test-configs.yml, exercising the RX fixes on real GNU RX toolchains. GNURX is login-gated, so the jobs use a container image and are gated on ENABLE_RENESAS_RX_CI: publish ghcr.io/wolfssl/wolfboot-ci-rx and set the variable to enable.

Testing

Built with GCC RX 8.3.0 and 14.2.0: an RX65N config (TSIP, ECC256, big-endian, external SPI flash) end-to-end, and the renesas-rx65n and renesas-rx72n example configs (little- and big-endian). Watchdog verified with and without -DWATCHDOG.

[Copilot]

Pull request overview

This PR modernizes the Renesas RX port to build on current GNU RX toolchains and updated wolfSSL, adds an optional generic watchdog “feed” hook for long-running operations, and introduces gated CI builds for RX using a container-provided GNURX toolchain.

Changes:

• Update RX build/link/debug settings for newer GCC/binutils and wolfSSL compatibility.
• Add wolfBoot_watchdog_feed() hook and callsites in hash + flash copy/erase loops, with an RX reference implementation (WDI GPIO toggle).
• Add reusable GitHub Actions workflow to build RX example configs (gated behind ENABLE_RENESAS_RX_CI).

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/keytools/sign.c	Adjusts printing for certificate-chain file size checks in keytools signing flow.
tools/bin-assemble/bin-assemble.c	Makes MSVC-only APIs conditional on _MSC_VER to improve Windows toolchain portability.
src/update_flash.c	Adds watchdog “feed” callsites during sector copy and multi-sector erase loops.
src/libwolfboot.c	Introduces weak default watchdog feed implementation when WATCHDOG is enabled.
src/image.c	Adds watchdog “feed” callsites during image hashing loops.
src/boot_renesas_start.S	Changes RX _exit behavior to halt instead of calling newlib exit processing.
options.mk	Replaces removed -gstabs with DWARF debug flag under certain build paths.
include/user_settings.h	Gates RX constant-time ops workaround to older GCC RX only.
include/hal.h	Adds watchdog feed API/macro interface controlled by WATCHDOG.
hal/rx72n.ld	Pins .bss LMA to VMA and marks .bss as NOLOAD to avoid newer ld wrap errors.
hal/rx65n.ld	Pins .bss LMA to VMA and marks .bss as NOLOAD to avoid newer ld wrap errors.
hal/renesas-rx.c	Adds RX external watchdog (WDI GPIO toggle) implementation and init hook.
docs/Targets.md	Documents the new watchdog feed hook behavior under WATCHDOG.
docs/Renesas.md	Documents RX external watchdog wiring/configuration and the generic feed hook.
config/examples/renesas-rx72n.config	Adds commented example WATCHDOG/WDI pin config.
config/examples/renesas-rx65n.config	Adds commented example WATCHDOG/WDI pin config.
arch.mk	Updates RX link behavior to locate correct multilib libgcc and relaxes a GCC 14.2 warning for TSIP.
.github/workflows/test-configs.yml	Wires RX example builds into config-build CI, gated on ENABLE_RENESAS_RX_CI.
.github/workflows/test-build-renesas-rx.yml	Adds reusable RX build workflow using a GNURX container image.

Comments suppressed due to low confidence (2)

tools/keytools/sign.c:1588

• Casting st_size to long for printing can truncate on Windows/MinGW where off_t may be 64-bit but long is 32-bit. Use PRIdMAX with an (intmax_t) cast to keep the diagnostic accurate.

        if ((file_stat.st_size < 0) ||
            ((uintmax_t)file_stat.st_size > (uintmax_t)UINT32_MAX)) {
            printf("Error: Invalid certificate chain file size (%ld)\n",
                   (long)file_stat.st_size);

tools/keytools/sign.c:2567

• Same as above: printing st_size via (unsigned long) can truncate on LLP64 platforms. Use PRIuMAX with a (uintmax_t) cast so the reported size matches the value being checked.

                if ((uintmax_t)cc_stat.st_size > (uintmax_t)MAX_TLV_LEN) {
                    printf("Error: Certificate chain too large for TLV encoding "
                        "(%lu > %u)\n", (unsigned long)cc_stat.st_size, MAX_TLV_LEN);
                    goto cleanup;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.