Merge remote-tracking branch 'upstream/master' into h5-wolfhsm-port

# Conflicts:
#	tools/unit-tests/Makefile

Author: aidangarske

.github/workflows/test-configs.yml

@@ -518,6 +518,18 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32h5-tz-tpm.config
 
+  stm32h5_tz_tpm_mfgid_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32h5-tz-tpm-mfgid.config
+
+  stm32h5_tz_tpm_mfgid_precomputed_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32h5-tz-tpm-mfgid-precomputed.config
+
   stm32h5_tz_dualbank_test:
     uses: ./.github/workflows/test-build.yml
     with:

.github/workflows/test-wolfhsm-simulator.yml

@@ -91,7 +91,7 @@ jobs:
             ./Build/wh_posix_server.elf --type tcp --nvminit $tmpfile &
           else
             # --flags=0x100 sets the WH_NVM_FLAGS_USAGE_VERIFY flag
-            ./Build/wh_posix_server.elf --type tcp --client 12 --id 255 --flags 0x100 --key ../../../../../wolfboot_signing_private_key_pub.der &
+            ./Build/wh_posix_server.elf --type tcp --client 1 --id 255 --flags 0x100 --key ../../../../../wolfboot_signing_private_key_pub.der &
           fi
           TCP_SERVER_PID=$!
           echo "TCP_SERVER_PID=$TCP_SERVER_PID" >> $GITHUB_ENV

Makefile

@@ -119,6 +119,17 @@ ifneq ($(USER_NVM_INIT),)
   NVM_CONFIG:=$(USER_NVM_INIT)
 endif
 
+# Eliminates compilation and linkage of the built-in wolfBoot keystore
+WOLFBOOT_NO_KEYSTORE :=
+ifeq ($(WOLFHSM_CLIENT),1)
+  WOLFBOOT_NO_KEYSTORE := 1
+endif
+ifeq ($(WOLFHSM_SERVER),1)
+  ifneq ($(CERT_CHAIN_VERIFY),)
+    WOLFBOOT_NO_KEYSTORE := 1
+  endif
+endif
+
 ifeq ($(SIGN),NONE)
   PRIVATE_KEY=
 else
@@ -139,6 +150,14 @@ else
   endif
   ifeq ($(FLASH_OTP_KEYSTORE),1)
     OBJS+=./src/flash_otp_keystore.o
+  else ifeq ($(WOLFBOOT_NO_KEYSTORE),1)
+    CFLAGS+=-DWOLFBOOT_NO_KEYSTORE
+    # No built-in keystore is compiled in, but firmware images must still be
+    # signed (for test/factory builds). src/keystore.o normally triggers
+    # generation of the signing key via 'src/keystore.c: $(PRIVATE_KEY)'.
+    # Without it, tie the key to the bootloader build so the signing key is
+    # still produced before any downstream signing step runs.
+    WOLFBOOT_SIGN_KEY_DEP=$(PRIVATE_KEY)
   else
     OBJS+=./src/keystore.o
   endif
@@ -550,8 +569,8 @@ factory_wstage1.bin: $(BINASSEMBLE) stage1/loader_stage1.bin wolfboot.bin $(BOOT
 wolfboot_stage1.bin: wolfboot.elf stage1/loader_stage1.bin
 	$(Q) cp stage1/loader_stage1.bin wolfboot_stage1.bin
 
-wolfboot.elf: include/target.h $(LSCRIPT) $(OBJS) $(BINASSEMBLE) FORCE
-	$(Q)(test $(SIGN) = NONE) || (test $(FLASH_OTP_KEYSTORE) = 1) || (grep -q $(SIGN_ALG) src/keystore.c) || \
+wolfboot.elf: include/target.h $(LSCRIPT) $(OBJS) $(BINASSEMBLE) $(WOLFBOOT_SIGN_KEY_DEP) FORCE
+	$(Q)(test $(SIGN) = NONE) || (test $(FLASH_OTP_KEYSTORE) = 1) || (test "$(WOLFBOOT_NO_KEYSTORE)" = "1") || (grep -q $(SIGN_ALG) src/keystore.c) || \
 		(echo "Key mismatch: please run 'make keysclean' to remove all keys if you want to change algorithm" && false)
 	@echo "\t[LD] $@"
 	@echo $(OBJS)

config/examples/sim-wolfHSM-client-ecc.config

@@ -23,9 +23,5 @@ WOLFBOOT_FIXED_PARTITIONS=1
 
 WOLFHSM_CLIENT=1
 
-# Uncomment the following to use wolfHSM ephemeral keys from the keystore
-# for image auth
-#WOLFHSM_CLIENT_LOCAL_KEYS=1
-
 # Uncomment for verbose wolfHSM printf statements
 #CFLAGS_EXTRA+=-DDEBUG_CRYPTOCB -DDEBUG_CRYPTOCB_VERBOSE

config/examples/sim-wolfHSM-client-mldsa.config

@@ -44,9 +44,5 @@ WOLFBOOT_FIXED_PARTITIONS=1
 
 WOLFHSM_CLIENT=1
 
-# Uncomment the following to use public wolfHSM ephemeral keys from the keystore
-# for image auth
-#WOLFHSM_CLIENT_LOCAL_KEYS=1
-
 # Uncomment for verbose wolfHSM printf statements
 #CFLAGS_EXTRA+=-DDEBUG_CRYPTOCB -DDEBUG_CRYPTOCB_VERBOSE

config/examples/stm32h5-tz-tpm-mfgid-precomputed.config

@@ -0,0 +1,44 @@
+ARCH?=ARM
+TZEN?=1
+TARGET?=stm32h5
+SIGN?=ECC256
+HASH?=SHA256
+DEBUG?=0
+VTOR?=1
+CORTEX_M0?=0
+CORTEX_M33?=1
+NO_ASM?=0
+NO_MPU=1
+EXT_FLASH?=0
+SPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=1
+WOLFBOOT_VERSION?=1
+V?=0
+SPMATH?=1
+RAM_CODE?=1
+DUALBANK_SWAP?=0
+WOLFBOOT_PARTITION_SIZE?=0xA0000
+WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
+FLAGS_HOME=0
+DISABLE_BACKUP=0
+WOLFCRYPT_TZ=1
+WOLFCRYPT_TZ_PKCS11=1
+IMAGE_HEADER_SIZE?=1024
+ARMORED=1
+WOLFTPM=1
+# Exercise the pre-provisioned ST33KTPM identity keys (IAK/IDevID).
+# ST33 vendor support is required (wolfTPM2_SetIdentityAuth -> TPM2_GetProductInfo).
+CFLAGS_EXTRA+=-DWOLFTPM_ST33
+CFLAGS_EXTRA+=-DWOLFTPM_MFG_IDENTITY
+# Default precomputed mode (WOLFBOOT_TPM_MFG_AUTH_DERIVE unset): the per-device
+# authValue is set directly from the WOLFBOOT_TPM_MFG_AIK_AUTH/EH_AUTH macros.
+# Ships a 0xFF placeholder that fails TPM auth until provisioned per-device; this
+# config exists to build-test the precomputed branch in CI.

config/examples/stm32h5-tz-tpm-mfgid.config

@@ -0,0 +1,44 @@
+ARCH?=ARM
+TZEN?=1
+TARGET?=stm32h5
+SIGN?=ECC256
+HASH?=SHA256
+DEBUG?=0
+VTOR?=1
+CORTEX_M0?=0
+CORTEX_M33?=1
+NO_ASM?=0
+NO_MPU=1
+EXT_FLASH?=0
+SPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=1
+WOLFBOOT_VERSION?=1
+V?=0
+SPMATH?=1
+RAM_CODE?=1
+DUALBANK_SWAP?=0
+WOLFBOOT_PARTITION_SIZE?=0xA0000
+WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
+FLAGS_HOME=0
+DISABLE_BACKUP=0
+WOLFCRYPT_TZ=1
+WOLFCRYPT_TZ_PKCS11=1
+IMAGE_HEADER_SIZE?=1024
+ARMORED=1
+WOLFTPM=1
+# Exercise the pre-provisioned ST33KTPM identity keys (IAK/IDevID).
+# ST33 vendor support is required (wolfTPM2_SetIdentityAuth -> TPM2_GetProductInfo).
+CFLAGS_EXTRA+=-DWOLFTPM_ST33
+CFLAGS_EXTRA+=-DWOLFTPM_MFG_IDENTITY
+# Derive the authValue on-device so the test-app works on a sample TPM. The
+# default precomputed mode ships a 0xFF placeholder that must be provisioned
+# per-device first.
+WOLFBOOT_TPM_MFG_AUTH_DERIVE=1

docs/TPM.md

@@ -17,6 +17,42 @@ In wolfBoot we support TPM based root of trust, sealing/unsealing, cryptographic
 | `WOLFBOOT_TPM_SEAL=1` | `WOLFBOOT_TPM_SEAL` | Enables support for sealing/unsealing based on PCR policy signed externally. |
 | `WOLFBOOT_TPM_SEAL_NV_BASE=0x01400300` | `WOLFBOOT_TPM_SEAL_NV_BASE` | To override the default sealed blob storage location in the platform hierarchy. |
 | `WOLFBOOT_TPM_SEAL_AUTH=secret` | `WOLFBOOT_TPM_SEAL_AUTH` | Password for sealing/unsealing secrets, if omitted the PCR policy will be used |
+| `WOLFBOOT_TPM_MFG_AUTH_DERIVE=1` | `WOLFBOOT_TPM_MFG_AUTH_DERIVE` | MFG identity: opt into on-device derive-from-master. The default is a precomputed per-device authValue (no master secret on device). Requires `WOLFTPM_MFG_IDENTITY`. |
+| (header macro) | `WOLFBOOT_TPM_MFG_AIK_AUTH` / `WOLFBOOT_TPM_MFG_EH_AUTH` | Default (precomputed) mode: the 16-byte per-device AIK / EH authValues (placeholder `0xFF` default). |
+| (header macro) | `WOLFBOOT_TPM_MFG_EH_MASTER` | Derive mode: override the endorsement-hierarchy master value (16-byte initializer list, sample default). |
+
+## TPM manufacturing identity (IAK / IDevID authValue)
+
+When `WOLFTPM_MFG_IDENTITY` is enabled, `wolfBoot_tpm2_get_aik()` and
+`wolfBoot_tpm2_get_timestamp()` authorize the pre-provisioned ST33KTPM identity
+keys. There are two ways to supply the required `authValue`:
+
+- **Precomputed mode (default, recommended).** The final **per-device**
+  `authValue` is set directly into the key handle; no master secret is present on
+  the device. Defaults to a `0xFF` placeholder (fails TPM auth until
+  provisioned). Per-device values are computed off-device at provisioning
+  (`SHA-256(CPSN || master)`, low 16 bytes) and baked in via
+  `WOLFBOOT_TPM_MFG_AIK_AUTH` / `WOLFBOOT_TPM_MFG_EH_AUTH`. When `WOLFBOOT_TPM_MFG_AUTH_DERIVE`
+  is not enabled, the `authOverride` argument to `wolfBoot_tpm2_get_aik()` is
+  treated as an optional override for the final AIK `authValue` (not a master secret).
+
+- **Derive mode (`WOLFBOOT_TPM_MFG_AUTH_DERIVE`).** The `authValue` is computed
+  on-device as the low 16 bytes of `SHA-256(TPM serial || master)`.
+  The endorsement master defaults to a sample and is overridable with
+  `WOLFBOOT_TPM_MFG_EH_MASTER`; the AIK master is passed to
+  `wolfBoot_tpm2_get_aik()` (NULL = sample). Convenient, but the master is
+  **shared across the whole reel/batch** — extracting it
+  from one device's firmware lets an attacker derive the `authValue` for every
+  sibling device.
+
+The byte-array macros are header defaults (overridable via `-D` / `CFLAGS_EXTRA`);
+they are not plain `options.mk` variables because brace initializers contain
+commas. `WOLFTPM_MFG_IDENTITY` itself is supplied via `CFLAGS_EXTRA`.
+
+> Note: because precomputed mode is the default and ships a `0xFF` placeholder, a
+> build that enables `WOLFTPM_MFG_IDENTITY` without provisioning the authValue (or
+> selecting `WOLFBOOT_TPM_MFG_AUTH_DERIVE`) fails TPM auth by design. The test-app
+> builds with `WOLFBOOT_TPM_MFG_AUTH_DERIVE` so it works on a sample TPM.
 
 ## Root of Trust (ROT)
 

docs/wolfHSM.md

@@ -75,16 +75,12 @@ This section describes the configuration options available for wolfHSM integrati
 
 This option enables wolfHSM client support in wolfBoot. Without defining this option, support for wolfHSM client mode is not compiled in.
 
+In client mode, wolfBoot always uses HSM-resident public keys for firmware authentication; public keys are never baked into a local `keystore.c`. The key to verify against is referenced either by the reserved key ID defined in the HAL (`hsmKeyIdPubKey`), or, when certificate-chain verification (`WOLFBOOT_CERT_CHAIN_VERIFY`) is enabled, by the leaf key ID resolved from the verified chain.
+
 ### `WOLFBOOT_ENABLE_WOLFHSM_SERVER`
 
 This option enables wolfHSM server support in wolfBoot. When defined, wolfBoot includes an embedded wolfHSM server that provides HSM functionality locally within the bootloader. This is mutually exclusive with `WOLFBOOT_ENABLE_WOLFHSM_CLIENT`.
 
-### `WOLFBOOT_USE_WOLFHSM_PUBKEY_ID`
-
-This option enables use of the reserved wolfHSM public key ID for firmware authentication, and is typically the desired behavior for using wolfHSM. When this option is defined, wolfBoot will use the reserved wolfHSM keyId defined by the HAL (`hsmKeyIdPubKey`). This option is meant to be used in conjunction with the `--nolocalkeys` keygen option, as the key material in the keystore will not be used.
-
-If this option is not defined, cryptographic operations are still performed on the wolfHSM server, but wolfBoot assumes the key material is present in the keystore and NOT stored on the HSM. This means that wolfBoot will first load keys from the keystore, send the key material to the wolfHSM server at the time of use (cached as ephemeral keys), and finally evict the key from the HSM after usage. This behavior is typically only useful for debugging or testing scenarios, where the keys may not be pre-loaded onto the HSM. The keystore for use in this mode should not be generated with the `--nolocalkeys` option.
-
 ## HAL Implementations
 
 In addition to the standard wolfBoot HAL functions, wolfHSM-enabled platforms must also implement or instantiate the following wolfHSM-specific items in the platform HAL:
@@ -127,7 +123,7 @@ The wolfBoot simulator supports using wolfHSM with all algorithms mentioned in [
 
 #### wolfHSM Client Mode Build
 
-To build the simulator configured to use wolfHSM client mode, ensure you build with the `WOLFHSM_CLIENT=1` makefile option. This will automatically define `WOLFBOOT_USE_WOLFHSM_PUBKEY_ID`, and requires the public key corresponding to the private key that signed the image to be pre-loaded into the HSM at the keyId specified by `hsmKeyIdPubKey` in the simulator HAL.
+To build the simulator configured to use wolfHSM client mode, ensure you build with the `WOLFHSM_CLIENT=1` makefile option. This requires the public key corresponding to the private key that signed the image to be pre-loaded into the HSM at the keyId specified by `hsmKeyIdPubKey` in the simulator HAL.
 
 ```sh
 # Grab the HSM client simulator configuration
@@ -175,8 +171,10 @@ Next, in a new terminal window, run the wolfHSM POSIX TCP server, loading the pu
 cd lib/wolfHSM/examples/posix/tcp/wh_server_tcp
 make WOLFSSL_DIR=../../../../../wolfssl
 
-# Run the server, loading the wolfBoot public key and using the client ID and keyId matching the values declared in `hal/sim.c`)
-./Build/wh_server_tcp.elf --client 12 --id 255 --key ../../../../../../wolfboot_signing_private_key_pub.der &
+# Run the server, loading the wolfBoot public key. The client ID (--client) must
+# match WOLFHSM_CLIENT_ID from the build config (default 1) and the keyId (--id)
+# must match hsmKeyIdPubKey in `hal/sim.c` (255 / 0xFF).
+./Build/wh_server_tcp.elf --client 1 --id 255 --key ../../../../../../wolfboot_signing_private_key_pub.der &
 
 # The server will now be waiting for connections
 ```

hal/aurix_tc3xx.c

@@ -95,6 +95,14 @@ static int _connectCb(void* context, whCommConnected connect);
 static whTransportMemClientContext tmcCtx[1] = {0};
 static whTransportClientCb         tmcCb[1]  = {WH_TRANSPORT_MEM_CLIENT_CB};
 
+/* wolfHSM client ID presented to the HSM server. Defined by the build system
+ * (WOLFHSM_CLIENT_ID in options.mk, default 1); must match the client ID the
+ * keys are provisioned under in the whnvmtool config
+ * (tools/scripts/tc3xx/wolfBoot-wolfHSM-keys.nvminit). */
+#ifndef WOLFBOOT_WOLFHSM_CLIENT_ID
+#error "WOLFBOOT_WOLFHSM_CLIENT_ID is not defined. Set WOLFHSM_CLIENT_ID in your .config or on the make command line."
+#endif
+
 /* Globally exported HAL symbols */
 whClientContext hsmClientCtx = {0};
 const int       hsmDevIdHash = WH_DEV_ID_DMA;
@@ -768,7 +776,7 @@ int hal_hsm_init_connect(void)
         .transport_cb      = tmcCb,
         .transport_context = (void*)tmcCtx,
         .transport_config  = (void*)tmcCfg,
-        .client_id         = 1,
+        .client_id         = WOLFBOOT_WOLFHSM_CLIENT_ID,
         .connect_cb        = _connectCb,
     }};