WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #651 from mattia-moffa/20251213-nrf5340-wolfcrypt-tz 

Support WOLFCRYPT_TZ and PKCS11 on nRF5340
pull/652/head
David Garske 2025-12-15 09:13:29 -08:00 committed by GitHub
parent 0c7fa9d4e4 26171affe0
commit 8c5aa75d13
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 241 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/test-configs.yml vendored
View File

@ -145,6 +145,12 @@ jobs:
arch: arm
config-file: ./config/examples/nrf5340-tz.config
nrf5340_app_wolfcrypt_tz_test:
uses: ./.github/workflows/test-build.yml
with:
arch: arm
config-file: ./config/examples/nrf5340-wolfcrypt-tz.config
nrf5340_net_test:
uses: ./.github/workflows/test-build.yml
with:

13
config/examples/nrf5340-tz.config
View File

@ -26,13 +26,16 @@ QSPI_FLASH?=1
# Flash is 4KB pages (app)
WOLFBOOT_SECTOR_SIZE?=0x1000
# Flash keyvault: 112K
# Flash keyvault: 124K
WOLFBOOT_KEYVAULT_ADDRESS?=0x20000
WOLFBOOT_KEYVAULT_SIZE?=0x1C000
WOLFBOOT_KEYVAULT_SIZE?=0x1F000
# Flash NSC: 16K
WOLFBOOT_NSC_ADDRESS?=0x3C000
WOLFBOOT_NSC_SIZE?=0x04000
# Flash NSC: 4K
# Note: the NSC area must be defined so that:
# - Its size is exactly 32, 64, 128, 256, 512, 1024, 2048 or 4096 bytes
# - Its end is 16K-aligned
WOLFBOOT_NSC_ADDRESS?=0x3F000
WOLFBOOT_NSC_SIZE?=0x01000
# Application offset (reserve 256K for wolfBoot + keyvault + NSC)
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x40000

79
config/examples/nrf5340-wolfcrypt-tz.config 100644
View File

@ -0,0 +1,79 @@
ARCH?=ARM
TZEN?=1
TARGET?=nrf5340
SIGN?=ECC384
HASH?=SHA384
WOLFBOOT_VERSION?=1
VTOR?=1
CORTEX_M0?=0
CORTEX_M33?=1
NO_ASM?=0
NO_MPU=1
ALLOW_DOWNGRADE?=0
NVM_FLASH_WRITEONCE?=0
DELTA_UPDATES?=1
SPMATH?=1
RAM_CODE?=1
DUALBANK_SWAP?=0
FLAGS_HOME=0
DISABLE_BACKUP=0
EXT_FLASH?=1
SPI_FLASH?=0
QSPI_FLASH?=1
WOLFCRYPT_TZ?=1
WOLFCRYPT_TZ_PKCS11?=1
# Flash is 4KB pages (app)
WOLFBOOT_SECTOR_SIZE?=0x1000
# Flash keyvault: 104K
WOLFBOOT_KEYVAULT_ADDRESS?=0x45000
WOLFBOOT_KEYVAULT_SIZE?=0x1A000
# Flash NSC: 4K
# Note: the NSC area must be defined so that:
# - Its size is exactly 32, 64, 128, 256, 512, 1024, 2048 or 4096 bytes
# - Its end is 16K-aligned
WOLFBOOT_NSC_ADDRESS?=0x5F000
WOLFBOOT_NSC_SIZE?=0x01000
# Application offset (reserve 384K for wolfBoot + keyvault + NSC)
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x60000
# Application Partition Size (640KB)
WOLFBOOT_PARTITION_SIZE?=0xA0000
# External Flash offset for application update (1MB)
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0
# External Flash offset for network update at 0x100000 (size=256KB)
# External Flash offset for swap (4KB)
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x140000
V?=0
DEBUG?=0
DEBUG_UART?=1
USE_GCC=1
OPTIMIZATION_LEVEL=2
# Optionally wait for network core to boot before starting application core
CFLAGS_EXTRA+=-DNRF_SYNC_CORES
# Use larger block size for swapping sectors (performance improvement)
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
# Enable optional power control pin (active low) P1.00
#CFLAGS_EXTRA+=-DQSPI_PWR_CTRL_PORT=1 -DQSPI_PWR_CTRL_PIN=0
# Use UART0 on P0.22
#CFLAGS_EXTRA+=-DUART_PORT=0 -DUART_PIN=22
#CFLAGS_EXTRA+=-DDEBUG_FLASH
#CFLAGS_EXTRA+=-DDEBUG_QSPI=1
# Hard fault debugging
#CFLAGS_EXTRA+=-DDEBUG_HARDFAULT

57
hal/nrf5340.c
View File

@ -136,7 +136,8 @@ static SharedMem_t* shm = (SharedMem_t*)&shm_shadow;
#endif
#ifdef TZEN
static void hal_spu_init(void) {
static void hal_spu_init(void)
{
uint8_t nsc_size_index;
uint8_t region;
uint8_t start_region;
@ -177,6 +178,57 @@ static void hal_spu_init(void) {
~SPU_RAMREGION_PERM_SECATTR) | SPU_RAMREGION_PERM_LOCK;
}
}
#ifdef WOLFCRYPT_SECURE_MODE
static uint32_t cryptocell_enable_prev = 0;
void hal_trng_init(void)
{
cryptocell_enable_prev = CRYPTOCELL_ENABLE;
CRYPTOCELL_ENABLE = 1;
CC_RNG_CLK = 1;
CC_RNG_SW_RESET = 1;
do {
CC_RNG_CLK = 1;
CC_RNG_SAMPLE_CNT = FICR_TRNG90B_ROSC1;
} while (CC_RNG_SAMPLE_CNT != FICR_TRNG90B_ROSC1);
CC_RNG_TRNG_CONFIG = 0;
CC_RNG_NOISE_SOURCE = 1;
}
void hal_trng_fini(void)
{
CC_RNG_NOISE_SOURCE = 0;
CC_RNG_CLK = 0;
CC_RNG_SW_RESET = 1;
CRYPTOCELL_ENABLE = cryptocell_enable_prev;
}
int hal_trng_get_entropy(unsigned char *out, unsigned int len)
{
unsigned int i = 0;
while (i < len) {
uint32_t data[CC_RNG_EHR_DATA_LEN];
uint8_t *data_bytes = (uint8_t *)data;
unsigned int word, byte;
while (!((CC_RNG_ISR & 0x01) && (CC_RNG_TRNG_VALID & 0x01))) {}
for (word = 0; word < CC_RNG_EHR_DATA_LEN; word++) {
data[word] = CC_RNG_EHR_DATA(word);
}
for (byte = 0; byte < 4 * CC_RNG_EHR_DATA_LEN && i < len; byte++) {
out[i++] = (unsigned char)data_bytes[byte];
}
}
return 0;
}
#endif
#endif
void uart_init(void)
@ -804,7 +856,8 @@ int hal_flash_protect(uint32_t start, uint32_t len)
}
#ifdef TZEN
static void periph_unsecure() {
static void periph_unsecure()
{
/* Unsecure both GPIO ports */
SPU_PERIPHID_PERM(GPIO_PERIPHID) &= ~SPU_PERIPHID_PERM_SECATTR;
SPU_GPIOPORT_PERM(0) = 0;

32
hal/nrf5340.h
View File

@ -451,6 +451,38 @@ void uart_write_sz(const char* c, unsigned int sz);
#undef QSPI_FLASH
#endif
/* CryptoCell */
#ifdef TARGET_nrf5340_app
#define CRYPTOCELL_BASE 0x50844000
#define CRYPTOCELL_ENABLE (*(volatile uint32_t *)(CRYPTOCELL_BASE + 0x500))
#define FICR_BASE 0x00FF0000
#define FICR_TRNG90B_ROSC1 (*(volatile uint32_t *)(FICR_BASE + 0xC10))
#define CC_RNG_BASE 0x50845000
#define CC_RNG_ISR (*(volatile uint32_t *)(CC_RNG_BASE + 0x104))
#define CC_RNG_ICR (*(volatile uint32_t *)(CC_RNG_BASE + 0x108))
#define CC_RNG_TRNG_CONFIG (*(volatile uint32_t *)(CC_RNG_BASE + 0x10C))
#define CC_RNG_TRNG_VALID (*(volatile uint32_t *)(CC_RNG_BASE + 0x110))
#define CC_RNG_EHR_DATA(n) (*(volatile uint32_t *)(CC_RNG_BASE + 0x114 + (n) * 0x4))
#define CC_RNG_EHR_DATA_LEN 6
#define CC_RNG_NOISE_SOURCE (*(volatile uint32_t *)(CC_RNG_BASE + 0x12C))
#define CC_RNG_SAMPLE_CNT (*(volatile uint32_t *)(CC_RNG_BASE + 0x130))
#define CC_RNG_AUTOCORR_STATISTIC (*(volatile uint32_t *)(CC_RNG_BASE + 0x134))
#define CC_RNG_TRNG_DEBUG (*(volatile uint32_t *)(CC_RNG_BASE + 0x138))
#define CC_RNG_SW_RESET (*(volatile uint32_t *)(CC_RNG_BASE + 0x140))
#define CC_RNG_BUSY (*(volatile uint32_t *)(CC_RNG_BASE + 0x1B8))
#define CC_RNG_TRNG_RESET (*(volatile uint32_t *)(CC_RNG_BASE + 0x1BC))
#define CC_RNG_HW_FLAGS (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C0))
#define CC_RNG_CLK (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C4))
#define CC_RNG_DMA (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C8))
#define CC_RNG_DMA_ROSC_LEN (*(volatile uint32_t *)(CC_RNG_BASE + 0x1CC))
#define CC_RNG_DMA_SRAM_ADDR (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D0))
#define CC_RNG_DMA_SAMPLES_NUM (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D4))
#define CC_RNG_WATCHDOG_VAL (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D8))
#define CC_RNG_DMA_BUSY (*(volatile uint32_t *)(CC_RNG_BASE + 0x1DC))
#endif
/* interprocessor communication (IPC) peripheral */
#ifdef TARGET_nrf5340_app
#if TZ_SECURE()

6
include/user_settings.h
View File

@ -162,11 +162,13 @@ extern int tolower(int c);
# if defined(WOLFBOOT_SIGN_ECC256) || defined(WOLFCRYPT_SECURE_MODE) || \
defined(WOLFBOOT_SIGN_SECONDARY_ECC256)
# define HAVE_ECC256
# elif defined(WOLFBOOT_SIGN_ECC384) || \
# endif
# if defined(WOLFBOOT_SIGN_ECC384) || \
defined(WOLFBOOT_SIGN_SECONDARY_ECC384)
# define HAVE_ECC384
# define WOLFSSL_SP_384
# elif defined(WOLFBOOT_SIGN_ECC521) || \
# endif
# if defined(WOLFBOOT_SIGN_ECC521) || \
defined(WOLFBOOT_SIGN_SECONDARY_ECC521)
# define HAVE_ECC521
# define WOLFSSL_SP_521

33
test-app/app_nrf5340.c
View File

@ -27,6 +27,11 @@
#include "hal/nrf5340.h"
#include "printf.h"
#ifdef WOLFCRYPT_SECURE_MODE
#include "wcs/user_settings.h"
#include "wolfssl/wolfcrypt/random.h"
#endif
void gpiotoggle(uint32_t port, uint32_t pin)
{
uint32_t reg_val = GPIO_OUT(port);
@ -34,6 +39,31 @@ void gpiotoggle(uint32_t port, uint32_t pin)
GPIO_OUTSET(port) = (~reg_val) & (1 << pin);
}
#ifdef WOLFCRYPT_SECURE_MODE
static int print_random_number(void)
{
WC_RNG rng;
int ret;
uint32_t rand;
ret = wc_InitRng(&rng);
if (ret != 0) {
wolfBoot_printf("Failed to initialize RNG\r\n");
return -1;
}
ret = wc_RNG_GenerateBlock(&rng, (byte *)&rand, sizeof(rand));
if (ret != 0) {
wolfBoot_printf("Failed to generate random number\r\n");
wc_FreeRng(&rng);
return -1;
}
wolfBoot_printf("Today's lucky number: 0x%08lX\r\n", rand);
wc_FreeRng(&rng);
return 0;
}
#endif
void main(void)
{
int i;
@ -64,6 +94,9 @@ void main(void)
wolfBoot_printf("Compiled: " __DATE__ ":" __TIME__ "\n");
#ifdef TZEN
wolfBoot_printf("TrustZone enabled: yes\n");
#ifdef WOLFCRYPT_SECURE_MODE
print_random_number();
#endif
#else
wolfBoot_printf("TrustZone enabled: no\n");
#endif

40
tools/scripts/nrf5340/build_flash.sh
View File

@ -54,21 +54,22 @@ while test $# -gt 0; do
echo "default: build, erase and program"
echo " "
echo "options:"
echo "-h, --help show brief help"
echo "-c, --clean cleanup build artifacts"
echo "-b, --build build release with symbols"
echo "-tz, --trustzone" use TrustZone configuration
echo "-d, --debug build debug"
echo "-v, --verbose build verbose"
echo "--version use custom version"
echo "-e, --erase do erase of internal/external flash"
echo "-ei, --erase-int do erase of internal flash"
echo "-ee, --erase-ext do erase of external flash"
echo "-p, --program program images built"
echo "-pi, --program-int program internal image (boot)"
echo "-pe, --program-ext program external image (update)"
echo "-u, --update build update, sign and program external flash"
echo "-t, --delta build update, sign delta and program external flash"
echo "-h, --help show brief help"
echo "-c, --clean cleanup build artifacts"
echo "-b, --build build release with symbols"
echo "-tz, --trustzone" use TrustZone configuration
echo "-wtz, --wc-trustzone" use TrustZone + wolfCrypt configuration
echo "-d, --debug build debug"
echo "-v, --verbose build verbose"
echo "--version use custom version"
echo "-e, --erase do erase of internal/external flash"
echo "-ei, --erase-int do erase of internal flash"
echo "-ee, --erase-ext do erase of external flash"
echo "-p, --program program images built"
echo "-pi, --program-int program internal image (boot)"
echo "-pe, --program-ext program external image (update)"
echo "-u, --update build update, sign and program external flash"
echo "-t, --delta build update, sign delta and program external flash"
exit 0
;;
-c|--clean)
@ -86,6 +87,11 @@ while test $# -gt 0; do
echo "Build with TrustZone config"
shift
;;
-wtz|--wolfcrypt-trustzone)
DO_WOLFCRYPT_TRUSTZONE=1
echo "Build with TrustZone + wolfCrypt config"
shift
;;
-d|--debug)
DO_BUILD=1
MAKE_ARGS+=" DEBUG=1"
@ -174,7 +180,9 @@ fi
if [[ $DO_BUILD == 1 ]]; then
# Build internal flash images for both cores
if [[ $DO_TRUSTZONE == 1 ]]; then
if [[ $DO_WOLFCRYPT_TRUSTZONE == 1 ]]; then
config_app=config/examples/nrf5340-wolfcrypt-tz.config
elif [[ $DO_TRUSTZONE == 1 ]]; then
config_app=config/examples/nrf5340-tz.config
else
config_app=config/examples/nrf5340.config