From a1f86fa1c20cd81ef496da5d4e0da95bb72f2ac6 Mon Sep 17 00:00:00 2001 From: Brett Nicholas <7547222+bigbrett@users.noreply.github.com> Date: Mon, 11 May 2026 17:09:38 -0600 Subject: [PATCH] expose root CA list as makefile var --- docs/wolfHSM.md | 2 +- hal/aurix_tc3xx.c | 6 ++++-- hal/sim.c | 6 ++++-- options.mk | 9 +++++++++ tools/config.mk | 1 + 5 files changed, 19 insertions(+), 5 deletions(-) diff --git a/docs/wolfHSM.md b/docs/wolfHSM.md index c6fc294e..6bdc040c 100644 --- a/docs/wolfHSM.md +++ b/docs/wolfHSM.md @@ -96,7 +96,7 @@ In addition to the standard wolfBoot HAL functions, wolfHSM-enabled platforms mu - `hsmDevIdHash`: The HSM device ID for hash operations. This is used to identify the HSM device to wolfBoot. - `hsmDevIdPubKey`: The HSM device ID for public key operations. This is used to identify the HSM device to wolfBoot. - `hsmKeyIdPubKey`: The HSM key ID for public key operations. This is used to identify the key to use for public key operations. -- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS` (default 8). Each in-tree HAL provides a default of `{ 1 }`; override at build time by passing a comma-separated initializer in `WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST`, e.g. `make CFLAGS_EXTRA='-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3"'`. +- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS` (default 8). Each in-tree HAL provides a default of `{ 1 }`; override the list via the `WOLFHSM_NVM_ROOT_CA_LIST` build option, which takes a comma-separated initializer (no quotes, no spaces) and is propagated to the HAL as `-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=...`. Set it in `.config` (e.g. `WOLFHSM_NVM_ROOT_CA_LIST=1,2,3`) or on the make command line (`make WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 ...`). ### Client HAL Functions diff --git a/hal/aurix_tc3xx.c b/hal/aurix_tc3xx.c index f3874537..71cdc89f 100644 --- a/hal/aurix_tc3xx.c +++ b/hal/aurix_tc3xx.c @@ -111,7 +111,8 @@ const int hsmDevIdCrypt = WH_DEV_ID; const int hsmKeyIdCrypt = 0xFF; #endif #ifdef WOLFBOOT_CERT_CHAIN_VERIFY -/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */ +/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command + * line) to override the default single-root list. */ #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1 #endif @@ -125,7 +126,8 @@ const uint16_t hsmNvmIdCertRootCACount = /* map wolfBoot HAL layer wofHSM exports to their tchsm config vals */ const int hsmDevIdHash = HSM_DEVID; const int hsmDevIdPubKey = HSM_DEVID; -/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */ +/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command + * line) to override the default single-root list. */ #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1 #endif diff --git a/hal/sim.c b/hal/sim.c index 004bb588..a5d234a3 100644 --- a/hal/sim.c +++ b/hal/sim.c @@ -191,7 +191,8 @@ const int hsmDevIdCrypt = WH_DEV_ID; const int hsmKeyIdCrypt = 0xFF; #endif #ifdef WOLFBOOT_CERT_CHAIN_VERIFY -/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */ +/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command + * line) to override the default single-root list. */ #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1 #endif @@ -265,7 +266,8 @@ whServerContext hsmServerCtx = {0}; const int hsmDevIdHash = INVALID_DEVID; const int hsmDevIdPubKey = INVALID_DEVID; -/* Override at build time, e.g. -DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST="1, 2, 3" */ +/* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command + * line) to override the default single-root list. */ #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST #define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1 #endif diff --git a/options.mk b/options.mk index 6062e771..52146818 100644 --- a/options.mk +++ b/options.mk @@ -1465,6 +1465,15 @@ ifneq ($(CERT_CHAIN_VERIFY),) # export the private key in DER format so it can be used with certificates KEYGEN_OPTIONS += --der + # Optional override for the wolfHSM trusted-root NVM ID list used during + # cert-chain verification. Expects a comma-separated initializer (no quotes, + # no spaces), e.g. WOLFHSM_NVM_ROOT_CA_LIST=1,2,3. Bounded by + # WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS. When unset, falls back to a HAL-specified + # default + ifneq ($(strip $(WOLFHSM_NVM_ROOT_CA_LIST)),) + CFLAGS += '-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=$(WOLFHSM_NVM_ROOT_CA_LIST)' + endif + # User-provided cert chain takes precedence ifneq ($(USER_CERT_CHAIN),) CERT_CHAIN_FILE = $(USER_CERT_CHAIN) diff --git a/tools/config.mk b/tools/config.mk index 0cab5295..ee4abfb6 100644 --- a/tools/config.mk +++ b/tools/config.mk @@ -134,4 +134,5 @@ CONFIG_VARS:= ARCH TARGET SIGN HASH MCUXSDK MCUXPRESSO MCUXPRESSO_CPU MCUXPRESSO SIGN_SECONDARY \ WOLFHSM_CLIENT \ WOLFHSM_CLIENT_LOCAL_KEYS \ + WOLFHSM_NVM_ROOT_CA_LIST \ ENCRYPT_CACHE