WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ

pull/727/head
Mattia Moffa 2026-03-18 21:35:54 +01:00
parent 52223853c4
commit b5fab30310
19 changed files with 55 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CMakeLists.txt
View File

@ -696,14 +696,14 @@ if(ARCH STREQUAL "ARM")
list(APPEND WOLFBOOT_COMPILE_OPTIONS -mcmse)
list(APPEND WOLFBOOT_LINK_OPTIONS -mcmse)
endif()
list(APPEND WOLFBOOT_LINK_OPTIONS
-Wl,--cmse-implib
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wolfboot_tz_nsc.o)
# wolfCrypt TrustZone secure mode
if(WOLFCRYPT_TZ)
list(APPEND WOLFBOOT_DEFS WOLFCRYPT_SECURE_MODE)
list(APPEND WOLFBOOT_SOURCES src/wc_callable.c)
list(APPEND WOLFBOOT_LINK_OPTIONS
-Wl,--cmse-implib
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wc_secure_calls.o)
# PKCS11 TrustZone interface
if(WOLFCRYPT_TZ_PKCS11)

2
Makefile
View File

@ -562,7 +562,7 @@ keys: $(PRIVATE_KEY)
clean:
$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
$(Q)rm -f src/wc_secure_calls.o
$(Q)rm -f src/wolfboot_tz_nsc.o
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec

2
arch.mk
View File

@ -360,13 +360,13 @@ else
OBJS+=hal/stm32_tz.o
endif
CFLAGS+=-mcmse
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wolfboot_tz_nsc.o
ifeq ($(WOLFCRYPT_TZ),1)
CORTEXM_ARM_EXTRA_OBJS=
CORTEXM_ARM_EXTRA_CFLAGS=
SECURE_OBJS+=./src/wc_callable.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
CFLAGS+=-DWOLFCRYPT_SECURE_MODE
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wc_secure_calls.o
endif
endif # TZEN=1
ifeq ($(SPMATH),1)

4
cmake/wolfboot.cmake
View File

@ -52,8 +52,8 @@ function(gen_wolfboot_platform_target PLATFORM_NAME LINKER_SCRIPT_TARGET)
${LINKER_SCRIPT_TARGET})
# TrustZone import library (generated by the linker via --out-implib)
if(TZEN AND WOLFCRYPT_TZ)
set(_wcs_implib "${CMAKE_BINARY_DIR}/wc_secure_calls.o")
if(TZEN)
set(_wcs_implib "${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o")
add_custom_command(TARGET wolfboot_${PLATFORM_NAME} POST_BUILD
BYPRODUCTS "${_wcs_implib}"
COMMAND ${CMAKE_COMMAND} -E true

2
docs/API.md
View File

@ -78,6 +78,8 @@ secure domain. For this purpose, wolfBoot provides Non-Secure Callable (NSC)
APIs that allow code running in the non-secure domain to call into the secure
domain managed by wolfBoot.
When `TZEN=1` is enabled, these APIs are available to non-secure applications.
These APIs are listed below.
- `void wolfBoot_nsc_success(void)`: wrapper for `wolfBoot_success()`

4
include/wolfboot/wolfboot.h
View File

@ -588,7 +588,7 @@ int wolfBoot_set_encrypt_key(const uint8_t *key, const uint8_t *nonce);
int wolfBoot_get_encrypt_key(uint8_t *key, uint8_t *nonce);
int wolfBoot_erase_encrypt_key(void);
#if !defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
#if !defined(__WOLFBOOT) && defined(TZEN)
/* Applications can access update success/trigger and flash erase/write
* via non-secure callable, to facilitate updates
@ -627,7 +627,7 @@ int wolfBoot_nsc_erase_update(uint32_t address, uint32_t len);
CSME_NSE_API
int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len);
#endif /* !__WOLFBOOT && WOLFCRYPT_SECURE_MODE */
#endif /* !__WOLFBOOT && TZEN */
#ifdef __cplusplus

4
src/libwolfboot.c
View File

@ -2354,7 +2354,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
#endif /* MMU */
#endif /* EXT_ENCRYPTED */
#if defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
#if defined(__WOLFBOOT) && defined(TZEN)
CSME_NSE_API
void wolfBoot_nsc_success(void)
{
@ -2410,4 +2410,4 @@ int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len
return ret;
}
#endif
#endif /* __WOLFBOOT && TZEN */

14
test-app/CMakeLists.txt
View File

@ -176,7 +176,7 @@ if(BUILD_TEST_APPS)
target_include_directories(image PRIVATE ../lib/wolfPKCS11)
endif()
# For TrustZone builds, avoid linking the bootloader lib (it defines NSC stubs).
# wolfCrypt TrustZone test builds provide extra secure-call wrappers directly.
if(TZEN AND WOLFCRYPT_TZ)
target_sources(image PRIVATE ../src/libwolfboot.c)
if(NOT SIGN STREQUAL "NONE")
@ -189,11 +189,15 @@ if(BUILD_TEST_APPS)
target_link_libraries(image PRIVATE wolfboot wolfboothal public_key target)
endif()
# For TrustZone builds, the test app is a non-secure application
if(TZEN AND WOLFCRYPT_TZ)
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP WOLFBOOT_SECURE_CALLS)
# For TrustZone builds, the test app is a non-secure application and links
# the CMSE import library generated from the secure bootloader veneers.
if(TZEN)
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP)
add_dependencies(image wolfboot_${PLATFORM_NAME})
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wc_secure_calls.o)
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o)
endif()
if(TZEN AND WOLFCRYPT_TZ)
list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_SECURE_CALLS)
endif()
if(WOLFCRYPT_TZ_PKCS11)

13
test-app/Makefile
View File

@ -218,9 +218,9 @@ ifeq ($(TZEN),1)
CFLAGS+=-DNONSECURE_APP
CFLAGS+=-I./
APP_OBJS+=../hal/$(TARGET)_ns.o
APP_OBJS+=../src/wolfboot_tz_nsc.o
ifeq ($(WOLFCRYPT_TZ),1)
CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFSSL)"
APP_OBJS+=../src/wc_secure_calls.o
WOLFCRYPT_APP_OBJS+=\
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.o \
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hash.o \
@ -244,11 +244,6 @@ ifeq ($(TZEN),1)
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wolfentropy.o \
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o \
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wc_encrypt.o
ifeq ($(TEST_APP_NO_RNG),1)
CFLAGS+=-DWC_NO_RNG
else
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
endif
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
CFLAGS+=-DWOLFSSL_USER_SETTINGS -DWOLFTPM_USER_SETTINGS
CFLAGS+=-DWOLFBOOT_PKCS11_APP -DSECURE_PKCS11 -DWOLFBOOT_TZ_PKCS11
@ -287,6 +282,12 @@ ifeq ($(TZEN),1)
APP_OBJS+=./wcs/sp_cortexm.o
endif
endif
else
ifeq ($(TEST_APP_NO_RNG),1)
CFLAGS+=-DWC_NO_RNG
else
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
endif
endif
CFLAGS+=-DWOLFBOOT_SECURE_CALLS -Wstack-usage=19184
LDFLAGS+=--specs=nosys.specs -u _printf_float

4
test-app/app_mcxn.c
View File

@ -83,7 +83,7 @@ void main(void)
hal_init();
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
boot_ver = wolfBoot_nsc_current_firmware_version();
#else
boot_ver = wolfBoot_current_firmware_version();
@ -107,7 +107,7 @@ void main(void)
/* Blue off */
gpio_init_output(GPIO1, PORT1, kCLOCK_Gpio1, kCLOCK_Port1, 2U, 1U);
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_success();
#else
wolfBoot_success();

16
test-app/app_stm32h5.c
View File

@ -318,7 +318,7 @@ static int cmd_update_xmodem(const char *args)
printf("Erasing update partition...");
fflush(stdout);
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_erase_update(dst_offset, WOLFBOOT_PARTITION_SIZE);
#else
hal_flash_unlock();
@ -387,7 +387,7 @@ static int cmd_update_xmodem(const char *args)
if (crc == calc_crc) {
/* CRC is valid */
memcpy(xpkt_payload, xpkt + 3, XMODEM_PAYLOAD_SIZE);
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
ret = wolfBoot_nsc_write_update(dst_offset, xpkt_payload, XMODEM_PAYLOAD_SIZE);
#else
ret = hal_flash_write(WOLFBOOT_PARTITION_UPDATE_ADDRESS + dst_offset, xpkt_payload, XMODEM_PAYLOAD_SIZE);
@ -425,7 +425,7 @@ static int cmd_update_xmodem(const char *args)
}
else {
printf("Transfer succeeded\r\n");
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
update_ver = wolfBoot_nsc_update_firmware_version();
#else
update_ver = wolfBoot_update_firmware_version();
@ -433,7 +433,7 @@ static int cmd_update_xmodem(const char *args)
if (update_ver != 0) {
printf("New firmware version: 0x%lx\r\n", update_ver);
printf("Triggering update...\r\n");
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_update_trigger();
#else
wolfBoot_update_trigger();
@ -444,7 +444,7 @@ static int cmd_update_xmodem(const char *args)
}
}
#ifndef WOLFCRYPT_SECURE_MODE
#ifndef TZEN
hal_flash_lock();
#endif
@ -535,7 +535,7 @@ static int cmd_info(const char *args)
uint16_t hdrSz;
uint8_t boot_part_state = IMG_STATE_NEW, update_part_state = IMG_STATE_NEW;
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
cur_fw_version = wolfBoot_nsc_current_firmware_version();
update_fw_version = wolfBoot_nsc_update_firmware_version();
@ -597,7 +597,7 @@ static int cmd_info(const char *args)
static int cmd_success(const char *args)
{
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_success();
#else
wolfBoot_success();
@ -1335,7 +1335,7 @@ void main(void)
/* Enable SysTick */
systick_enable();
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
app_version = wolfBoot_nsc_current_firmware_version();
#else
app_version = wolfBoot_current_firmware_version();

16
test-app/emu-test-apps/common/emu_update.c
View File

@ -109,7 +109,7 @@ static uint32_t emu_current_version(void)
{
uintptr_t addr = (uintptr_t)WOLFBOOT_PARTITION_BOOT_ADDRESS;
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
return wolfBoot_nsc_current_firmware_version();
#else
if (addr == 0u) {
@ -178,7 +178,7 @@ static void wait_for_update(uint32_t version)
memset(page, 0xFF, PAGESIZE);
#ifndef WOLFCRYPT_SECURE_MODE
#ifndef TZEN
hal_flash_unlock();
#endif
@ -237,7 +237,7 @@ static void wait_for_update(uint32_t version)
if ((page_idx == PAGESIZE) || (next_seq + (uint32_t)psize >= tot_len)) {
uint32_t dst = (WOLFBOOT_PARTITION_UPDATE_ADDRESS + recv_seq + (uint32_t)psize) - (uint32_t)page_idx;
uint32_t dst_off = (recv_seq + (uint32_t)psize) - (uint32_t)page_idx;
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
if ((dst_off % WOLFBOOT_SECTOR_SIZE) == 0u) {
wolfBoot_nsc_erase_update(dst_off, WOLFBOOT_SECTOR_SIZE);
}
@ -255,7 +255,7 @@ static void wait_for_update(uint32_t version)
ack(next_seq);
if (next_seq >= tot_len) {
uint32_t update_ver;
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
update_ver = wolfBoot_nsc_update_firmware_version();
#else
update_ver = wolfBoot_get_blob_version((uint8_t *)WOLFBOOT_PARTITION_UPDATE_ADDRESS);
@ -264,7 +264,7 @@ static void wait_for_update(uint32_t version)
__asm volatile("bkpt #0x4D");
break;
}
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_update_trigger();
#else
wolfBoot_update_trigger();
@ -274,7 +274,7 @@ static void wait_for_update(uint32_t version)
}
}
#ifndef WOLFCRYPT_SECURE_MODE
#ifndef TZEN
hal_flash_lock();
#endif
@ -293,7 +293,7 @@ int main(void)
printf("get_version=%lu\n", (unsigned long)version);
if (version == 4u) {
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_success();
#else
wolfBoot_success();
@ -310,7 +310,7 @@ int main(void)
}
}
if (version == 8u) {
#ifdef WOLFCRYPT_SECURE_MODE
#ifdef TZEN
wolfBoot_nsc_success();
#else
wolfBoot_success();

2
test-app/emu-test-apps/mcxw71/Makefile
View File

@ -33,7 +33,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
NSC_OBJ :=
ifeq ($(TZEN),1)
CFLAGS += -DWOLFCRYPT_SECURE_MODE
NSC_OBJ := ../../../src/wc_secure_calls.o
NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
endif
VPATH := ../common

2
test-app/emu-test-apps/nrf5340/Makefile
View File

@ -29,7 +29,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
NSC_OBJ :=
ifeq ($(TZEN),1)
CFLAGS += -DWOLFCRYPT_SECURE_MODE
NSC_OBJ := ../../../src/wc_secure_calls.o
NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
endif
VPATH := ../common

2
test-app/emu-test-apps/stm32h563/Makefile
View File

@ -29,7 +29,7 @@ LDLIBS := -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group
NSC_OBJ :=
ifeq ($(TZEN),1)
CFLAGS += -DWOLFCRYPT_SECURE_MODE
NSC_OBJ := ../../../src/wc_secure_calls.o
NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
endif
VPATH := ../common

2
test-app/emu-test-apps/stm32l552/Makefile
View File

@ -30,7 +30,7 @@ NSC_OBJ :=
ifeq ($(TZEN),1)
CFLAGS += -DNONSECURE_APP
CFLAGS += -DWOLFCRYPT_SECURE_MODE
NSC_OBJ := ../../../src/wc_secure_calls.o
NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
endif
VPATH := ../common

2
test-app/emu-test-apps/stm32u585/Makefile
View File

@ -30,7 +30,7 @@ NSC_OBJ :=
ifeq ($(TZEN),1)
CFLAGS += -DNONSECURE_APP
CFLAGS += -DWOLFCRYPT_SECURE_MODE
NSC_OBJ := ../../../src/wc_secure_calls.o
NSC_OBJ := ../../../src/wolfboot_tz_nsc.o
endif
VPATH := ../common

2
zephyr/CMakeLists.txt
View File

@ -32,7 +32,7 @@ zephyr_library_include_directories(
${WOLFBOOT_MODULE_DIR}/include
)
set(WOLFBOOT_CMSE_VENEERS ${WOLFBOOT_MODULE_DIR}/src/wc_secure_calls.o)
set(WOLFBOOT_CMSE_VENEERS ${WOLFBOOT_MODULE_DIR}/src/wolfboot_tz_nsc.o)
if(EXISTS ${WOLFBOOT_CMSE_VENEERS})
zephyr_library_link_libraries(${WOLFBOOT_CMSE_VENEERS})
else()

4
zephyr/README.md
View File

@ -49,7 +49,7 @@ cp config/examples/stm32h5-tz-psa.config .config
make clean wolfboot.bin
```
This also produces `src/wc_secure_calls.o`, which Zephyr links for CMSE veneers.
This also produces `src/wolfboot_tz_nsc.o`, which Zephyr links for CMSE veneers.
## 4) Build the PSA crypto sample with wolfBoot as an extra module
@ -101,7 +101,7 @@ wolfboot/src/arm_tee_psa_ipc.c
### PSA symbols missing during Zephyr build
Make sure:
- You built wolfBoot first (for `wc_secure_calls.o`).
- You built wolfBoot first (for `wolfboot_tz_nsc.o`).
- You passed `-DZEPHYR_EXTRA_MODULES=/path/to/wolfboot`.
### Kconfig warnings about WOLFBOOT_* symbols