expose root CA list as makefile var

docs/wolfHSM.md

@@ -96,7 +96,7 @@ In addition to the standard wolfBoot HAL functions, wolfHSM-enabled platforms mu
 - `hsmDevIdHash`: The HSM device ID for hash operations. This is used to identify the HSM device to wolfBoot.
 - `hsmDevIdPubKey`: The HSM device ID for public key operations. This is used to identify the HSM device to wolfBoot.
 - `hsmKeyIdPubKey`: The HSM key ID for public key operations. This is used to identify the key to use for public key operations.
-- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS` (default 8). Each in-tree HAL provides a default of `{ 1 }`; override at build time by passing a comma-separated initializer in `WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST`, e.g. `make CFLAGS_EXTRA='-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3"'`.
+- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS` (default 8). Each in-tree HAL provides a default of `{ 1 }`; override the list via the `WOLFHSM_NVM_ROOT_CA_LIST` build option, which takes a comma-separated initializer (no quotes, no spaces) and is propagated to the HAL as `-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=...`. Set it in `.config` (e.g. `WOLFHSM_NVM_ROOT_CA_LIST=1,2,3`) or on the make command line (`make WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 ...`).
 
 ### Client HAL Functions
 

hal/aurix_tc3xx.c

@@ -111,7 +111,8 @@ const int hsmDevIdCrypt = WH_DEV_ID;
 const int hsmKeyIdCrypt = 0xFF;
 #endif
 #ifdef WOLFBOOT_CERT_CHAIN_VERIFY
-/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */
+/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
+ * line) to override the default single-root list. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
 #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
 #endif
@@ -125,7 +126,8 @@ const uint16_t hsmNvmIdCertRootCACount  =
 /* map wolfBoot HAL layer wofHSM exports to their tchsm config vals */
 const int      hsmDevIdHash             = HSM_DEVID;
 const int      hsmDevIdPubKey           = HSM_DEVID;
-/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */
+/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
+ * line) to override the default single-root list. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
 #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
 #endif

hal/sim.c

@@ -191,7 +191,8 @@ const int hsmDevIdCrypt = WH_DEV_ID;
 const int hsmKeyIdCrypt = 0xFF;
 #endif
 #ifdef WOLFBOOT_CERT_CHAIN_VERIFY
-/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */
+/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
+ * line) to override the default single-root list. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
 #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
 #endif
@@ -265,7 +266,8 @@ whServerContext hsmServerCtx = {0};
 
 const int      hsmDevIdHash             = INVALID_DEVID;
 const int      hsmDevIdPubKey           = INVALID_DEVID;
-/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */
+/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
+ * line) to override the default single-root list. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
 #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
 #endif

options.mk

@@ -1465,6 +1465,15 @@ ifneq ($(CERT_CHAIN_VERIFY),)
   # export the private key in DER format so it can be used with certificates
   KEYGEN_OPTIONS += --der
 
+  # Optional override for the wolfHSM trusted-root NVM ID list used during
+  # cert-chain verification. Expects a comma-separated initializer (no quotes,
+  # no spaces), e.g. WOLFHSM_NVM_ROOT_CA_LIST=1,2,3. Bounded by
+  # WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS. When unset, falls back to a HAL-specified
+  # default
+  ifneq ($(strip $(WOLFHSM_NVM_ROOT_CA_LIST)),)
+    CFLAGS += '-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=$(WOLFHSM_NVM_ROOT_CA_LIST)'
+  endif
+
   # User-provided cert chain takes precedence
   ifneq ($(USER_CERT_CHAIN),)
     CERT_CHAIN_FILE = $(USER_CERT_CHAIN)

tools/config.mk

@@ -134,4 +134,5 @@ CONFIG_VARS:= ARCH TARGET SIGN HASH MCUXSDK MCUXPRESSO MCUXPRESSO_CPU MCUXPRESSO
 	SIGN_SECONDARY \
 	WOLFHSM_CLIENT \
 	WOLFHSM_CLIENT_LOCAL_KEYS \
+	WOLFHSM_NVM_ROOT_CA_LIST \
 	ENCRYPT_CACHE