Add STM32C5 CCB ECDSA hardware blob-create support

Author: dgarske

wolfcrypt/src/port/st/README.md

@@ -224,8 +224,9 @@ Worked example: `STM32_Bare_Test/src/main_ccb.c` (examples repo, PR #13) runs th
 ### Current state
 
 - Validated on STM32U385 (NUCLEO-U385RG-Q, TZEN=0), P-256, on both the bare-metal and CubeMX/HAL build paths: `wc_ecc_make_key` -> `wc_ecc_sign_hash` -> `wc_ecc_verify_hash` round-trips, with the private scalar never present in software.
+- Also validated on STM32C5 (NUCLEO-C5A3ZG, TZEN=0), P-256, bare-metal: the same `wc_ecc_make_key` -> `wc_ecc_sign_hash` -> `wc_ecc_verify_hash` flow plus a persisted-blob re-import (`wc_ecc_import_wrapped_private_ex`) round-trip, all on the CCB hardware. On STM32C5 the blob-create step is a combined create-and-sign: the C5 OPSTEP machine only advances through the GCM-final phase when the random k is drawn and the PKA sign is started during creation (the r,s are a by-product and discarded). That extra sequence is gated by `WOLFSSL_STM32C5` in the bare driver; the U3 OPSTEP machine does not require it.
 - `Stm32Ccb_Init()` pulse-resets the PKA / SAES / RNG before each operation, so the first CCB op is robust even when prior standalone crypto (RNG seeding, ECC keygen) left an engine in a state that would otherwise stall the CCB's chained SAES GCM step. The family-specific reset register name is abstracted (`WC_STM32_CCB_RSTR`).
-- CCB requires the U3 at its full clock; the reference clock-tree bring-up (96 MHz) is in the bare example's `boards/u3/hw_init.c`.
+- CCB requires the U3 / C5 at its full clock; the reference clock-tree bring-up is in the bare example's `boards/u3/hw_init.c` (96 MHz) and `boards/c5a3/hw_init.c`.
 
 
 ## STM32 BARE-metal port

wolfcrypt/src/port/st/stm32.c

@@ -4274,8 +4274,10 @@ int wc_Stm32_Ccb_EccMakeBlob(int curveId, const byte* d, word32 dLen,
     if (curveId != ECC_SECP256R1) {
         return NOT_COMPILED_IN;
     }
+    /* Require pubX/pubY non-NULL to match the CubeMX/HAL implementation's
+     * contract (one public API, one NULL-handling rule across build flavors). */
     if (d == NULL || dLen != 32u || iv == NULL || tag == NULL ||
-        wrapped == NULL || wrappedSz == NULL) {
+        wrapped == NULL || wrappedSz == NULL || pubX == NULL || pubY == NULL) {
         return BAD_FUNC_ARG;
     }
     opsz  = WC_CCB_P256_OPSZ;
@@ -4345,6 +4347,41 @@ int wc_Stm32_Ccb_EccMakeBlob(int curveId, const byte* d, word32 dLen,
     WC_CCB_PKA_RAMW[PKA_ECDSA_SIGN_IN_PRIVATE_KEY_D + cipsz + 1u] = 0u;
     if ((ret = Stm32Ccb_PkaWaitFlag(PKA_SR_DATAOKF)) != 0) { goto done; }
 
+#if defined(WOLFSSL_STM32C5)
+    /* STM32C5: blob-create is a combined create+SIGN -- the OPSTEP machine only
+     * advances through the GCM-final tag phase if the random k is drawn and the
+     * PKA sign is started. Draw k, run the GCM final phase, read the tag, then
+     * START the PKA; the resulting r,s are a creation by-product and discarded
+     * (the blob is still {iv, tag, wrapped}). Mirrors the C5 HAL
+     * CCB_ECDSA_SignBlobCreation. The U3 OPSTEP machine does not require this. */
+    if ((ret = Stm32Ccb_WaitOpStep(0x09u)) != 0) { goto done; }
+    for (off = 0u; off < (opsz - 2u); off++) {
+        if ((ret = Stm32Ccb_RngWaitDrdy()) != 0) { goto done; }
+        WC_CCB_PKA_RAMW[PKA_ECDSA_SIGN_IN_K + off] = WC_CCB_MAGIC;
+    }
+    if ((PKA->SR & PKA_SR_RNGERRF) != 0u) { ret = WC_HW_E; goto done; }
+    WC_CCB_PKA_RAMW[PKA_ECDSA_SIGN_IN_K + (opsz - 2u)]      = 0u;
+    WC_CCB_PKA_RAMW[PKA_ECDSA_SIGN_IN_K + (opsz - 2u) + 1u] = 0u;
+    if ((ret = Stm32Ccb_PkaWaitFlag(PKA_SR_RNGOKF)) != 0) { goto done; }
+    if ((ret = Stm32Ccb_SaesWaitBusy()) != 0) { goto done; }
+    SAES->CR = (SAES->CR & ~WC_STM32_AES_CR_PHASE) | WC_STM32_AES_CR_PHASE_0 | WC_STM32_AES_CR_PHASE_1;
+    PKA->CLRFR = PKA_CLRFR_CMFC;
+    SAES->DINR = 0u;
+    SAES->DINR = WC_CCB_GCM_HDR_LEN(opsz);
+    SAES->DINR = 0u;
+    SAES->DINR = cipsz * 32u;
+    if ((ret = Stm32Ccb_SaesWaitCcf()) != 0) { goto done; }
+    for (i = 0u; i < 4u; i++) {
+        tagw[i] = SAES->DOUTR;
+    }
+    PKA->CR |= PKA_CR_START;
+    if ((ret = Stm32Ccb_PkaWaitFlag(PKA_SR_PROCENDF)) != 0) { goto done; }
+    if ((ret = Stm32Ccb_WaitOpStep(0x1Au)) != 0) { goto done; }
+    if (WC_CCB_PKA_RAMW[PKA_ECDSA_SIGN_OUT_ERROR] != WC_CCB_PKA_OK) {
+        ret = WC_HW_E;
+        goto done;
+    }
+#else
     /* GCM final phase: feed the length block and read the authentication tag. */
     SAES->CR = (SAES->CR & ~WC_STM32_AES_CR_PHASE) | WC_STM32_AES_CR_PHASE_0 | WC_STM32_AES_CR_PHASE_1;
     if ((ret = Stm32Ccb_WaitOpStep(0x0Au)) != 0) { goto done; }
@@ -4357,6 +4394,7 @@ int wc_Stm32_Ccb_EccMakeBlob(int curveId, const byte* d, word32 dLen,
     for (i = 0u; i < 4u; i++) {
         tagw[i] = SAES->DOUTR;
     }
+#endif
 
     XMEMCPY(iv,      ivw,   sizeof(ivw));
     XMEMCPY(tag,     tagw,  sizeof(tagw));
@@ -4368,8 +4406,9 @@ int wc_Stm32_Ccb_EccMakeBlob(int curveId, const byte* d, word32 dLen,
     Stm32Ccb_Reset();
     SAES->CR &= ~AES_CR_EN;
     wolfSSL_CryptHwMutexUnLock();
-    /* Derive the public key from the fresh blob (separate locked op). */
-    if (ret == 0 && pubX != NULL && pubY != NULL) {
+    /* Derive the public key from the fresh blob (separate locked op).
+     * pubX/pubY are guaranteed non-NULL by the argument check above. */
+    if (ret == 0) {
         ret = Stm32Ccb_ComputePub(iv, tag, wrapped, pubX, pubY);
     }
     return ret;