Skip to content

Commit c3dd2fa

Browse files
aidangarskeaidangarske
committed
Add WOLFCRYPT_TZ_WOLFHSM scaffolding for STM32H5
 - New WOLFCRYPT_TZ_WOLFHSM build flag, mutually exclusive with WOLFCRYPT_TZ_PKCS11 / _PSA / _FWTPM - Extract WOLFHSM_CLIENT_OBJS and WOLFHSM_SERVER_OBJS shared variables; legacy WOLFHSM_CLIENT/SERVER blocks now reference them to share file lists with the new TZ engine - New config/examples/stm32h5-tz-wolfhsm.config (one-line delta from stm32h5-tz-fwtpm.config) - NS test-app RNG seed routes through wcs_get_random (same pattern as PKCS11 / fwTPM) No NSC entries or wolfHSM-specific code yet — Phase 0 only wires up the build flag and validates existing-engine compatibility. Builds cleanly with stm32h5-tz-wolfhsm.config; existing TZ configs and the sim wolfHSM client/server configs continue to build. The four files to stage: - options.mk (mutex guards, shared-vars refactor, TZ_WOLFHSM block) - test-app/Makefile (NS-side TZ_WOLFHSM block + alias) - test-app/wcs/user_settings.h (RNG seed CFG) - config/examples/stm32h5-tz-wolfhsm.config (new)
1 parent 8c7b864 commit c3dd2fa

4 files changed

Lines changed: 116 additions & 34 deletions

File tree

‎config/examples/stm32h5-tz-wolfhsm.config‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
ARCH?=ARM
2+
TZEN?=1
3+
TARGET?=stm32h5
4+
SIGN?=ECC256
5+
HASH?=SHA256
6+
DEBUG?=0
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
EXT_FLASH?=0
13+
SPI_FLASH?=0
14+
ALLOW_DOWNGRADE?=0
15+
NVM_FLASH_WRITEONCE?=1
16+
WOLFBOOT_VERSION?=1
17+
V?=0
18+
SPMATH?=1
19+
RAM_CODE?=1
20+
DUALBANK_SWAP?=0
21+
WOLFBOOT_PARTITION_SIZE?=0xA0000
22+
WOLFBOOT_SECTOR_SIZE?=0x2000
23+
WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
24+
WOLFBOOT_KEYVAULT_SIZE?=0x1C000
25+
WOLFBOOT_NSC_ADDRESS?=0x0C05C000
26+
WOLFBOOT_NSC_SIZE?=0x4000
27+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
28+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
29+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
30+
FLAGS_HOME=0
31+
DISABLE_BACKUP=0
32+
WOLFCRYPT_TZ=1
33+
WOLFCRYPT_TZ_WOLFHSM=1
34+
IMAGE_HEADER_SIZE?=1024
35+
ARMORED=1

‎options.mk‎

Lines changed: 68 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -919,12 +919,24 @@ ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
919919
ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
920920
$(error WOLFCRYPT_TZ_PKCS11 and WOLFCRYPT_TZ_FWTPM are mutually exclusive)
921921
endif
922+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
923+
$(error WOLFCRYPT_TZ_PKCS11 and WOLFCRYPT_TZ_WOLFHSM are mutually exclusive)
924+
endif
922925
endif
923926

924927
ifeq ($(WOLFCRYPT_TZ_PSA),1)
925928
ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
926929
$(error WOLFCRYPT_TZ_PSA and WOLFCRYPT_TZ_FWTPM are mutually exclusive)
927930
endif
931+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
932+
$(error WOLFCRYPT_TZ_PSA and WOLFCRYPT_TZ_WOLFHSM are mutually exclusive)
933+
endif
934+
endif
935+
936+
ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
937+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
938+
$(error WOLFCRYPT_TZ_FWTPM and WOLFCRYPT_TZ_WOLFHSM are mutually exclusive)
939+
endif
928940
endif
929941

930942
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
@@ -1078,6 +1090,22 @@ ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
10781090
STACK_USAGE=20000
10791091
endif
10801092

1093+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
1094+
CFLAGS+=-DWOLFCRYPT_TZ_WOLFHSM
1095+
CFLAGS+=-DWOLFCRYPT_SECURE_MODE
1096+
CFLAGS+=-DWOLFHSM_CFG_ENABLE_SERVER
1097+
CFLAGS+=-DWOLFHSM_CFG_COMM_DATA_LEN=1280
1098+
CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFHSM)"
1099+
ifeq ($(USE_CLANG),1)
1100+
CLANG_MULTILIB_FLAGS:=$(filter -mthumb -mlittle-endian,$(LDFLAGS)) $(filter -mcpu=%,$(CFLAGS))
1101+
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-file-name=libc.a)
1102+
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-libgcc-file-name)
1103+
else
1104+
LDFLAGS+=--specs=nano.specs
1105+
endif
1106+
STACK_USAGE=20000
1107+
endif
1108+
10811109
OBJS+=$(PUBLIC_KEY_OBJS)
10821110
ifneq ($(STAGE1),1)
10831111
OBJS+=$(UPDATE_OBJS)
@@ -1273,6 +1301,44 @@ ifneq ($(WOLFBOOT_PART_ID),)
12731301
SIGN_OPTIONS+=--id $(WOLFBOOT_PART_ID)
12741302
endif
12751303

1304+
# Shared wolfHSM client/server object lists. Both the legacy WOLFHSM_CLIENT=1 /
1305+
# WOLFHSM_SERVER=1 flags and the WOLFCRYPT_TZ_WOLFHSM=1 TZ engine reference
1306+
# these to avoid object-list duplication.
1307+
WOLFHSM_CLIENT_OBJS := \
1308+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client.o \
1309+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_nvm.o \
1310+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_cryptocb.o \
1311+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_crypto.o \
1312+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_dma.o \
1313+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_crypto.o \
1314+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_dma.o \
1315+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_utils.o \
1316+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_comm.o \
1317+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_comm.o \
1318+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_nvm.o \
1319+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_customcb.o
1320+
1321+
WOLFHSM_SERVER_OBJS := \
1322+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_utils.o \
1323+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_comm.o \
1324+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_nvm.o \
1325+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_nvm_flash.o \
1326+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_keyid.o \
1327+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_flash_unit.o \
1328+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_crypto.o \
1329+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server.o \
1330+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_nvm.o \
1331+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_crypto.o \
1332+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_counter.o \
1333+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_keystore.o \
1334+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_customcb.o \
1335+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_customcb.o \
1336+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_keystore.o \
1337+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_crypto.o \
1338+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_counter.o \
1339+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_nvm.o \
1340+
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_comm.o
1341+
12761342
# wolfHSM client options
12771343
ifeq ($(WOLFHSM_CLIENT),1)
12781344
WOLFCRYPT_OBJS += \
@@ -1289,19 +1355,7 @@ ifeq ($(WOLFHSM_CLIENT),1)
12891355
CFLAGS += -DWOLFHSM_CFG_COMM_DATA_LEN=5000
12901356
endif
12911357

1292-
WOLFHSM_OBJS += \
1293-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client.o \
1294-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_nvm.o \
1295-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_cryptocb.o \
1296-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_crypto.o \
1297-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_client_dma.o \
1298-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_crypto.o \
1299-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_dma.o \
1300-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_utils.o \
1301-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_comm.o \
1302-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_comm.o \
1303-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_nvm.o \
1304-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_customcb.o
1358+
WOLFHSM_OBJS += $(WOLFHSM_CLIENT_OBJS)
13051359
#includes
13061360
CFLAGS += -I"$(WOLFBOOT_LIB_WOLFHSM)"
13071361
# defines
@@ -1341,26 +1395,7 @@ ifeq ($(WOLFHSM_SERVER),1)
13411395
CFLAGS += -DWOLFHSM_CFG_COMM_DATA_LEN=5000
13421396
endif
13431397

1344-
WOLFHSM_OBJS += \
1345-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_utils.o \
1346-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_comm.o \
1347-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_nvm.o \
1348-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_nvm_flash.o \
1349-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_keyid.o \
1350-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_flash_unit.o \
1351-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_crypto.o \
1352-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server.o \
1353-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_nvm.o \
1354-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_crypto.o \
1355-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_counter.o \
1356-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_keystore.o \
1357-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_server_customcb.o \
1358-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_customcb.o \
1359-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_keystore.o \
1360-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_crypto.o \
1361-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_counter.o \
1362-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_nvm.o \
1363-
$(WOLFBOOT_LIB_WOLFHSM)/src/wh_message_comm.o
1398+
WOLFHSM_OBJS += $(WOLFHSM_SERVER_OBJS)
13641399

13651400
#includes
13661401
CFLAGS += -I"$(WOLFBOOT_LIB_WOLFHSM)"

‎test-app/Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@ ifeq ($(WOLFCRYPT_TZ_FWTPM),1)
109109
WOLFCRYPT_TZ_FWTPM=1
110110
endif
111111

112+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
113+
WOLFCRYPT_TZ=1
114+
WOLFCRYPT_TZ_WOLFHSM=1
115+
endif
116+
112117
# Setup default linker flags
113118
LDFLAGS+=-T $(LSCRIPT) -Wl,-gc-sections -Wl,-Map=image.map -nostartfiles
114119

@@ -355,6 +360,12 @@ ifeq ($(TZEN),1)
355360
$(WOLFTPM_LOCAL_OBJDIR)/%, $(WOLFTPM_APP_OBJS))
356361
APP_OBJS+=$(sort $(WOLFTPM_APP_OBJS))
357362
endif
363+
ifeq ($(WOLFCRYPT_TZ_WOLFHSM),1)
364+
CFLAGS+=-DWOLFCRYPT_TZ_WOLFHSM
365+
CFLAGS+=-DWOLFHSM_CFG_ENABLE_CLIENT
366+
CFLAGS+=-DWOLFHSM_CFG_COMM_DATA_LEN=1280
367+
CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFHSM)"
368+
endif
358369
WOLFCRYPT_APP_OBJS := $(patsubst $(WOLFBOOT_LIB_WOLFSSL)/%, \
359370
$(WOLFSSL_LOCAL_OBJDIR)/%, $(WOLFCRYPT_APP_OBJS))
360371
ifneq ($(WOLFCRYPT_TZ_PKCS11),1)

‎test-app/wcs/user_settings.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,8 @@ extern int tolower(int c);
156156
#define HAVE_PKCS8
157157
#define HAVE_PKCS12
158158

159-
#if defined(SECURE_PKCS11) || defined(WOLFBOOT_TZ_FWTPM)
159+
#if defined(SECURE_PKCS11) || defined(WOLFBOOT_TZ_FWTPM) || \
160+
defined(WOLFCRYPT_TZ_WOLFHSM)
160161

161162
static inline int wcs_cmse_get_random(unsigned char* output, int sz)
162163
{

0 commit comments

Comments
 (0)