Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ

CMakeLists.txt

@@ -696,14 +696,14 @@ if(ARCH STREQUAL "ARM")
             list(APPEND WOLFBOOT_COMPILE_OPTIONS -mcmse)
             list(APPEND WOLFBOOT_LINK_OPTIONS -mcmse)
         endif()
+        list(APPEND WOLFBOOT_LINK_OPTIONS
+            -Wl,--cmse-implib
+            -Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wolfboot_tz_nsc.o)
 
         # wolfCrypt TrustZone secure mode
         if(WOLFCRYPT_TZ)
             list(APPEND WOLFBOOT_DEFS WOLFCRYPT_SECURE_MODE)
             list(APPEND WOLFBOOT_SOURCES src/wc_callable.c)
-            list(APPEND WOLFBOOT_LINK_OPTIONS
-                -Wl,--cmse-implib
-                -Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wc_secure_calls.o)
 
             # PKCS11 TrustZone interface
             if(WOLFCRYPT_TZ_PKCS11)

Makefile

@@ -562,7 +562,7 @@ keys: $(PRIVATE_KEY)
 
 clean:
 	$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
-	$(Q)rm -f src/wc_secure_calls.o
+	$(Q)rm -f src/wolfboot_tz_nsc.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
 	$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec

arch.mk

@@ -360,13 +360,13 @@ else
         OBJS+=hal/stm32_tz.o
       endif
       CFLAGS+=-mcmse
+      SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wolfboot_tz_nsc.o
       ifeq ($(WOLFCRYPT_TZ),1)
         CORTEXM_ARM_EXTRA_OBJS=
         CORTEXM_ARM_EXTRA_CFLAGS=
         SECURE_OBJS+=./src/wc_callable.o
         WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
         CFLAGS+=-DWOLFCRYPT_SECURE_MODE
-        SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wc_secure_calls.o
       endif
     endif # TZEN=1
       ifeq ($(SPMATH),1)

cmake/wolfboot.cmake

@@ -52,8 +52,8 @@ function(gen_wolfboot_platform_target PLATFORM_NAME LINKER_SCRIPT_TARGET)
                           ${LINKER_SCRIPT_TARGET})
 
     # TrustZone import library (generated by the linker via --out-implib)
-    if(TZEN AND WOLFCRYPT_TZ)
+    if(TZEN)
-        set(_wcs_implib "${CMAKE_BINARY_DIR}/wc_secure_calls.o")
+        set(_wcs_implib "${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o")
         add_custom_command(TARGET wolfboot_${PLATFORM_NAME} POST_BUILD
             BYPRODUCTS "${_wcs_implib}"
             COMMAND ${CMAKE_COMMAND} -E true

docs/API.md

@@ -78,6 +78,8 @@ secure domain. For this purpose, wolfBoot provides Non-Secure Callable (NSC)
 APIs that allow code running in the non-secure domain to call into the secure
 domain managed by wolfBoot.
 
+When `TZEN=1` is enabled, these APIs are available to non-secure applications.
+
 These APIs are listed below.
 
 - `void wolfBoot_nsc_success(void)`: wrapper for `wolfBoot_success()`

include/wolfboot/wolfboot.h

@@ -588,7 +588,7 @@ int wolfBoot_set_encrypt_key(const uint8_t *key, const uint8_t *nonce);
 int wolfBoot_get_encrypt_key(uint8_t *key, uint8_t *nonce);
 int wolfBoot_erase_encrypt_key(void);
 
-#if !defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
+#if !defined(__WOLFBOOT) && defined(TZEN)
 
 /* Applications can access update success/trigger and flash erase/write
  * via non-secure callable, to facilitate updates
@@ -627,7 +627,7 @@ int wolfBoot_nsc_erase_update(uint32_t address, uint32_t len);
 CSME_NSE_API
 int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len);
 
-#endif /* !__WOLFBOOT && WOLFCRYPT_SECURE_MODE */
+#endif /* !__WOLFBOOT && TZEN */
 
 
 #ifdef __cplusplus

src/libwolfboot.c

@@ -2354,7 +2354,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
 #endif /* MMU */
 #endif /* EXT_ENCRYPTED */
 
-#if defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
+#if defined(__WOLFBOOT) && defined(TZEN)
 CSME_NSE_API
 void wolfBoot_nsc_success(void)
 {
@@ -2410,4 +2410,4 @@ int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len
     return ret;
 }
 
-#endif
+#endif /* __WOLFBOOT && TZEN */

test-app/CMakeLists.txt

@@ -176,7 +176,7 @@ if(BUILD_TEST_APPS)
         target_include_directories(image PRIVATE ../lib/wolfPKCS11)
     endif()
 
-    # For TrustZone builds, avoid linking the bootloader lib (it defines NSC stubs).
+    # wolfCrypt TrustZone test builds provide extra secure-call wrappers directly.
     if(TZEN AND WOLFCRYPT_TZ)
         target_sources(image PRIVATE ../src/libwolfboot.c)
         if(NOT SIGN STREQUAL "NONE")
@@ -189,11 +189,15 @@ if(BUILD_TEST_APPS)
         target_link_libraries(image PRIVATE wolfboot wolfboothal public_key target)
     endif()
 
-    # For TrustZone builds, the test app is a non-secure application
+    # For TrustZone builds, the test app is a non-secure application and links
-    if(TZEN AND WOLFCRYPT_TZ)
+    # the CMSE import library generated from the secure bootloader veneers.
-        list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP WOLFBOOT_SECURE_CALLS)
+    if(TZEN)
+        list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP)
         add_dependencies(image wolfboot_${PLATFORM_NAME})
-        target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wc_secure_calls.o)
+        target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o)
+    endif()
+    if(TZEN AND WOLFCRYPT_TZ)
+        list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_SECURE_CALLS)
     endif()
 
     if(WOLFCRYPT_TZ_PKCS11)

test-app/Makefile

@@ -218,9 +218,9 @@ ifeq ($(TZEN),1)
     CFLAGS+=-DNONSECURE_APP
     CFLAGS+=-I./
     APP_OBJS+=../hal/$(TARGET)_ns.o
+    APP_OBJS+=../src/wolfboot_tz_nsc.o
     ifeq ($(WOLFCRYPT_TZ),1)
         CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFSSL)"
-        APP_OBJS+=../src/wc_secure_calls.o
         WOLFCRYPT_APP_OBJS+=\
             $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.o \
             $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hash.o \
@@ -244,11 +244,6 @@ ifeq ($(TZEN),1)
             $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wolfentropy.o \
             $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o \
             $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wc_encrypt.o
-        ifeq ($(TEST_APP_NO_RNG),1)
-            CFLAGS+=-DWC_NO_RNG
-        else
-            WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
-        endif
         ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
             CFLAGS+=-DWOLFSSL_USER_SETTINGS -DWOLFTPM_USER_SETTINGS
             CFLAGS+=-DWOLFBOOT_PKCS11_APP -DSECURE_PKCS11 -DWOLFBOOT_TZ_PKCS11
@@ -287,6 +282,12 @@ ifeq ($(TZEN),1)
                 APP_OBJS+=./wcs/sp_cortexm.o
               endif
             endif
+        else
+            ifeq ($(TEST_APP_NO_RNG),1)
+                CFLAGS+=-DWC_NO_RNG
+            else
+                WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
+            endif
         endif
         CFLAGS+=-DWOLFBOOT_SECURE_CALLS -Wstack-usage=19184
         LDFLAGS+=--specs=nosys.specs -u _printf_float

test-app/app_mcxn.c

@@ -83,7 +83,7 @@ void main(void)
 
     hal_init();
 
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     boot_ver = wolfBoot_nsc_current_firmware_version();
 #else
     boot_ver = wolfBoot_current_firmware_version();
@@ -107,7 +107,7 @@ void main(void)
         /* Blue off */
         gpio_init_output(GPIO1, PORT1, kCLOCK_Gpio1, kCLOCK_Port1, 2U, 1U);
 
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
         wolfBoot_nsc_success();
 #else
         wolfBoot_success();

test-app/app_stm32h5.c

@@ -318,7 +318,7 @@ static int cmd_update_xmodem(const char *args)
 
     printf("Erasing update partition...");
     fflush(stdout);
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     wolfBoot_nsc_erase_update(dst_offset, WOLFBOOT_PARTITION_SIZE);
 #else
     hal_flash_unlock();
@@ -387,7 +387,7 @@ static int cmd_update_xmodem(const char *args)
             if (crc == calc_crc) {
                 /* CRC is valid */
                 memcpy(xpkt_payload, xpkt + 3, XMODEM_PAYLOAD_SIZE);
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
                 ret = wolfBoot_nsc_write_update(dst_offset, xpkt_payload, XMODEM_PAYLOAD_SIZE);
 #else
                 ret = hal_flash_write(WOLFBOOT_PARTITION_UPDATE_ADDRESS + dst_offset, xpkt_payload, XMODEM_PAYLOAD_SIZE);
@@ -425,7 +425,7 @@ static int cmd_update_xmodem(const char *args)
     }
     else {
         printf("Transfer succeeded\r\n");
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
         update_ver = wolfBoot_nsc_update_firmware_version();
 #else
         update_ver = wolfBoot_update_firmware_version();
@@ -433,7 +433,7 @@ static int cmd_update_xmodem(const char *args)
         if (update_ver != 0) {
             printf("New firmware version: 0x%lx\r\n", update_ver);
             printf("Triggering update...\r\n");
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
             wolfBoot_nsc_update_trigger();
 #else
             wolfBoot_update_trigger();
@@ -444,7 +444,7 @@ static int cmd_update_xmodem(const char *args)
         }
     }
 
-#ifndef WOLFCRYPT_SECURE_MODE
+#ifndef TZEN
     hal_flash_lock();
 #endif
 
@@ -535,7 +535,7 @@ static int cmd_info(const char *args)
     uint16_t hdrSz;
     uint8_t boot_part_state = IMG_STATE_NEW, update_part_state = IMG_STATE_NEW;
 
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     cur_fw_version = wolfBoot_nsc_current_firmware_version();
     update_fw_version = wolfBoot_nsc_update_firmware_version();
 
@@ -597,7 +597,7 @@ static int cmd_info(const char *args)
 
 static int cmd_success(const char *args)
 {
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     wolfBoot_nsc_success();
 #else
     wolfBoot_success();
@@ -1335,7 +1335,7 @@ void main(void)
     /* Enable SysTick */
     systick_enable();
 
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     app_version = wolfBoot_nsc_current_firmware_version();
 #else
     app_version = wolfBoot_current_firmware_version();

test-app/emu-test-apps/common/emu_update.c

@@ -109,7 +109,7 @@ static uint32_t emu_current_version(void)
 {
     uintptr_t addr = (uintptr_t)WOLFBOOT_PARTITION_BOOT_ADDRESS;
 
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
     return wolfBoot_nsc_current_firmware_version();
 #else
     if (addr == 0u) {
@@ -178,7 +178,7 @@ static void wait_for_update(uint32_t version)
 
     memset(page, 0xFF, PAGESIZE);
 
-#ifndef WOLFCRYPT_SECURE_MODE
+#ifndef TZEN
     hal_flash_unlock();
 #endif
 
@@ -237,7 +237,7 @@ static void wait_for_update(uint32_t version)
             if ((page_idx == PAGESIZE) || (next_seq + (uint32_t)psize >= tot_len)) {
                 uint32_t dst = (WOLFBOOT_PARTITION_UPDATE_ADDRESS + recv_seq + (uint32_t)psize) - (uint32_t)page_idx;
                 uint32_t dst_off = (recv_seq + (uint32_t)psize) - (uint32_t)page_idx;
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
                 if ((dst_off % WOLFBOOT_SECTOR_SIZE) == 0u) {
                     wolfBoot_nsc_erase_update(dst_off, WOLFBOOT_SECTOR_SIZE);
                 }
@@ -255,7 +255,7 @@ static void wait_for_update(uint32_t version)
         ack(next_seq);
         if (next_seq >= tot_len) {
             uint32_t update_ver;
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
             update_ver = wolfBoot_nsc_update_firmware_version();
 #else
             update_ver = wolfBoot_get_blob_version((uint8_t *)WOLFBOOT_PARTITION_UPDATE_ADDRESS);
@@ -264,7 +264,7 @@ static void wait_for_update(uint32_t version)
                 __asm volatile("bkpt #0x4D");
                 break;
             }
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
             wolfBoot_nsc_update_trigger();
 #else
             wolfBoot_update_trigger();
@@ -274,7 +274,7 @@ static void wait_for_update(uint32_t version)
         }
     }
 
-#ifndef WOLFCRYPT_SECURE_MODE
+#ifndef TZEN
     hal_flash_lock();
 #endif
 
@@ -293,7 +293,7 @@ int main(void)
     printf("get_version=%lu\n", (unsigned long)version);
 
     if (version == 4u) {
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
         wolfBoot_nsc_success();
 #else
         wolfBoot_success();
@@ -310,7 +310,7 @@ int main(void)
         }
     }
     if (version == 8u) {
-#ifdef WOLFCRYPT_SECURE_MODE
+#ifdef TZEN
         wolfBoot_nsc_success();
 #else
         wolfBoot_success();

test-app/emu-test-apps/mcxw71/Makefile

@@ -33,7 +33,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
 NSC_OBJ :=
 ifeq ($(TZEN),1)
   CFLAGS += -DWOLFCRYPT_SECURE_MODE
-  NSC_OBJ := ../../../src/wc_secure_calls.o
+  NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
 endif
 
 VPATH := ../common

test-app/emu-test-apps/nrf5340/Makefile

@@ -29,7 +29,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
 NSC_OBJ :=
 ifeq ($(TZEN),1)
   CFLAGS += -DWOLFCRYPT_SECURE_MODE
-  NSC_OBJ := ../../../src/wc_secure_calls.o
+  NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
 endif
 
 VPATH := ../common

test-app/emu-test-apps/stm32h563/Makefile

@@ -29,7 +29,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
 NSC_OBJ :=
 ifeq ($(TZEN),1)
   CFLAGS += -DWOLFCRYPT_SECURE_MODE
-  NSC_OBJ := ../../../src/wc_secure_calls.o
+  NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
 endif
 
 VPATH := ../common

test-app/emu-test-apps/stm32l552/Makefile

@@ -30,7 +30,7 @@ NSC_OBJ :=
 ifeq ($(TZEN),1)
   CFLAGS += -DNONSECURE_APP
   CFLAGS += -DWOLFCRYPT_SECURE_MODE
-  NSC_OBJ := ../../../src/wc_secure_calls.o
+  NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
 endif
 
 VPATH := ../common

test-app/emu-test-apps/stm32u585/Makefile

@@ -30,7 +30,7 @@ NSC_OBJ :=
 ifeq ($(TZEN),1)
   CFLAGS += -DNONSECURE_APP
   CFLAGS += -DWOLFCRYPT_SECURE_MODE
-  NSC_OBJ := ../../../src/wc_secure_calls.o
+  NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
 endif
 
 VPATH := ../common

zephyr/CMakeLists.txt

@@ -32,7 +32,7 @@ zephyr_library_include_directories(
   ${WOLFBOOT_MODULE_DIR}/include
 )
 
-set(WOLFBOOT_CMSE_VENEERS ${WOLFBOOT_MODULE_DIR}/src/wc_secure_calls.o)
+set(WOLFBOOT_CMSE_VENEERS ${WOLFBOOT_MODULE_DIR}/src/wolfboot_tz_nsc.o)
 if(EXISTS ${WOLFBOOT_CMSE_VENEERS})
   zephyr_library_link_libraries(${WOLFBOOT_CMSE_VENEERS})
 else()

zephyr/README.md

@@ -49,7 +49,7 @@ cp config/examples/stm32h5-tz-psa.config .config
 make clean wolfboot.bin
 ```
 
-This also produces `src/wc_secure_calls.o`, which Zephyr links for CMSE veneers.
+This also produces `src/wolfboot_tz_nsc.o`, which Zephyr links for CMSE veneers.
 
 ## 4) Build the PSA crypto sample with wolfBoot as an extra module
 
@@ -101,7 +101,7 @@ wolfboot/src/arm_tee_psa_ipc.c
 
 ### PSA symbols missing during Zephyr build
 Make sure:
-- You built wolfBoot first (for `wc_secure_calls.o`).
+- You built wolfBoot first (for `wolfboot_tz_nsc.o`).
 - You passed `-DZEPHYR_EXTRA_MODULES=/path/to/wolfboot`.
 
 ### Kconfig warnings about WOLFBOOT_* symbols