Skip to content

Commit 0c4fce7

Browse files
mattia-moffamattia-moffa
committed
Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ
1 parent 344c551 commit 0c4fce7

19 files changed

Lines changed: 55 additions & 48 deletions

File tree

‎CMakeLists.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -690,14 +690,14 @@ if(ARCH STREQUAL "ARM")
690690
list(APPEND WOLFBOOT_COMPILE_OPTIONS -mcmse)
691691
list(APPEND WOLFBOOT_LINK_OPTIONS -mcmse)
692692
endif()
693+
list(APPEND WOLFBOOT_LINK_OPTIONS
694+
-Wl,--cmse-implib
695+
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wolfboot_tz_nsc.o)
693696

694697
# wolfCrypt TrustZone secure mode
695698
if(WOLFCRYPT_TZ)
696699
list(APPEND WOLFBOOT_DEFS WOLFCRYPT_SECURE_MODE)
697700
list(APPEND WOLFBOOT_SOURCES src/wc_callable.c)
698-
list(APPEND WOLFBOOT_LINK_OPTIONS
699-
-Wl,--cmse-implib
700-
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wc_secure_calls.o)
701701

702702
# PKCS11 TrustZone interface
703703
if(WOLFCRYPT_TZ_PKCS11)

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ keys: $(PRIVATE_KEY)
556556

557557
clean:
558558
$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
559-
$(Q)rm -f src/wc_secure_calls.o
559+
$(Q)rm -f src/wolfboot_tz_nsc.o
560560
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
561561
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
562562
$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec

‎arch.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -353,13 +353,13 @@ else
353353
OBJS+=hal/stm32_tz.o
354354
endif
355355
CFLAGS+=-mcmse
356+
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wolfboot_tz_nsc.o
356357
ifeq ($(WOLFCRYPT_TZ),1)
357358
CORTEXM_ARM_EXTRA_OBJS=
358359
CORTEXM_ARM_EXTRA_CFLAGS=
359360
SECURE_OBJS+=./src/wc_callable.o
360361
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
361362
CFLAGS+=-DWOLFCRYPT_SECURE_MODE
362-
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wc_secure_calls.o
363363
endif
364364
endif # TZEN=1
365365
ifeq ($(SPMATH),1)

‎cmake/wolfboot.cmake‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ function(gen_wolfboot_platform_target PLATFORM_NAME LINKER_SCRIPT_TARGET)
5252
${LINKER_SCRIPT_TARGET})
5353

5454
# TrustZone import library (generated by the linker via --out-implib)
55-
if(TZEN AND WOLFCRYPT_TZ)
56-
set(_wcs_implib "${CMAKE_BINARY_DIR}/wc_secure_calls.o")
55+
if(TZEN)
56+
set(_wcs_implib "${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o")
5757
add_custom_command(TARGET wolfboot_${PLATFORM_NAME} POST_BUILD
5858
BYPRODUCTS "${_wcs_implib}"
5959
COMMAND ${CMAKE_COMMAND} -E true

‎docs/API.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ secure domain. For this purpose, wolfBoot provides Non-Secure Callable (NSC)
7878
APIs that allow code running in the non-secure domain to call into the secure
7979
domain managed by wolfBoot.
8080

81+
When `TZEN=1` is enabled, these APIs are available to non-secure applications.
82+
8183
These APIs are listed below.
8284

8385
- `void wolfBoot_nsc_success(void)`: wrapper for `wolfBoot_success()`

‎include/wolfboot/wolfboot.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -576,7 +576,7 @@ int wolfBoot_set_encrypt_key(const uint8_t *key, const uint8_t *nonce);
576576
int wolfBoot_get_encrypt_key(uint8_t *key, uint8_t *nonce);
577577
int wolfBoot_erase_encrypt_key(void);
578578

579-
#if !defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
579+
#if !defined(__WOLFBOOT) && defined(TZEN)
580580

581581
/* Applications can access update success/trigger and flash erase/write
582582
* via non-secure callable, to facilitate updates
@@ -615,7 +615,7 @@ int wolfBoot_nsc_erase_update(uint32_t address, uint32_t len);
615615
CSME_NSE_API
616616
int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len);
617617

618-
#endif /* !__WOLFBOOT && WOLFCRYPT_SECURE_MODE */
618+
#endif /* !__WOLFBOOT && TZEN */
619619

620620

621621
#ifdef __cplusplus

‎src/libwolfboot.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2330,7 +2330,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
23302330
#endif /* MMU */
23312331
#endif /* EXT_ENCRYPTED */
23322332

2333-
#if defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
2333+
#if defined(__WOLFBOOT) && defined(TZEN)
23342334
CSME_NSE_API
23352335
void wolfBoot_nsc_success(void)
23362336
{
@@ -2386,4 +2386,4 @@ int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len
23862386
return ret;
23872387
}
23882388

2389-
#endif
2389+
#endif /* __WOLFBOOT && TZEN */

‎test-app/CMakeLists.txt‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ if(BUILD_TEST_APPS)
176176
target_include_directories(image PRIVATE ../lib/wolfPKCS11)
177177
endif()
178178

179-
# For TrustZone builds, avoid linking the bootloader lib (it defines NSC stubs).
179+
# wolfCrypt TrustZone test builds provide extra secure-call wrappers directly.
180180
if(TZEN AND WOLFCRYPT_TZ)
181181
target_sources(image PRIVATE ../src/libwolfboot.c)
182182
if(NOT SIGN STREQUAL "NONE")
@@ -189,11 +189,15 @@ if(BUILD_TEST_APPS)
189189
target_link_libraries(image PRIVATE wolfboot wolfboothal public_key target)
190190
endif()
191191

192-
# For TrustZone builds, the test app is a non-secure application
193-
if(TZEN AND WOLFCRYPT_TZ)
194-
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP WOLFBOOT_SECURE_CALLS)
192+
# For TrustZone builds, the test app is a non-secure application and links
193+
# the CMSE import library generated from the secure bootloader veneers.
194+
if(TZEN)
195+
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP)
195196
add_dependencies(image wolfboot_${PLATFORM_NAME})
196-
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wc_secure_calls.o)
197+
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o)
198+
endif()
199+
if(TZEN AND WOLFCRYPT_TZ)
200+
list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_SECURE_CALLS)
197201
endif()
198202

199203
if(WOLFCRYPT_TZ_PKCS11)

‎test-app/Makefile‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -165,9 +165,9 @@ ifeq ($(TZEN),1)
165165
CFLAGS+=-DNONSECURE_APP
166166
CFLAGS+=-I./
167167
APP_OBJS+=../hal/$(TARGET)_ns.o
168+
APP_OBJS+=../src/wolfboot_tz_nsc.o
168169
ifeq ($(WOLFCRYPT_TZ),1)
169170
CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFSSL)"
170-
APP_OBJS+=../src/wc_secure_calls.o
171171
WOLFCRYPT_APP_OBJS+=\
172172
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.o \
173173
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hash.o \
@@ -191,11 +191,6 @@ ifeq ($(TZEN),1)
191191
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wolfentropy.o \
192192
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o \
193193
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wc_encrypt.o
194-
ifeq ($(TEST_APP_NO_RNG),1)
195-
CFLAGS+=-DWC_NO_RNG
196-
else
197-
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
198-
endif
199194
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
200195
CFLAGS+=-DWOLFSSL_USER_SETTINGS -DWOLFTPM_USER_SETTINGS
201196
CFLAGS+=-DWOLFBOOT_PKCS11_APP -DSECURE_PKCS11 -DWOLFBOOT_TZ_PKCS11
@@ -234,6 +229,12 @@ ifeq ($(TZEN),1)
234229
APP_OBJS+=./wcs/sp_cortexm.o
235230
endif
236231
endif
232+
else
233+
ifeq ($(TEST_APP_NO_RNG),1)
234+
CFLAGS+=-DWC_NO_RNG
235+
else
236+
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
237+
endif
237238
endif
238239
CFLAGS+=-DWOLFBOOT_SECURE_CALLS -Wstack-usage=19184
239240
LDFLAGS+=--specs=nosys.specs -u _printf_float

‎test-app/app_mcxn.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ void main(void)
8383

8484
hal_init();
8585

86-
#ifdef WOLFCRYPT_SECURE_MODE
86+
#ifdef TZEN
8787
boot_ver = wolfBoot_nsc_current_firmware_version();
8888
#else
8989
boot_ver = wolfBoot_current_firmware_version();
@@ -107,7 +107,7 @@ void main(void)
107107
/* Blue off */
108108
gpio_init_output(GPIO1, PORT1, kCLOCK_Gpio1, kCLOCK_Port1, 2U, 1U);
109109

110-
#ifdef WOLFCRYPT_SECURE_MODE
110+
#ifdef TZEN
111111
wolfBoot_nsc_success();
112112
#else
113113
wolfBoot_success();

0 commit comments

Comments
 (0)