Merge pull request #728 from danielinux/prepare-release-2.8.0

Updated submodules
2026-03-20 09:38:36 -07:00 · 2026-03-20 09:38:36 -07:00 · c52a0457a6
parent a56c70e90a 16dadd6bc0
commit c52a0457a6
12 changed files with 46 additions and 28 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -717,6 +717,7 @@ if(ARCH STREQUAL "ARM")

                list(APPEND WOLFBOOT_DEFS
                    SECURE_PKCS11
+                    WOLFPKCS11_USER_SETTINGS
                    WOLFSSL_PKCS11_RW_TOKENS
                    WP11_HASH_PIN_COST=3)
                list(APPEND WOLFBOOT_DEFS "CK_CALLABLE=__attribute__\\(\\(cmse_nonsecure_entry\\)\\)")
--- a/hal/sim.c
+++ b/hal/sim.c
@ -29,6 +29,7 @@
 #include <stdio.h>
 #include <sys/mman.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <errno.h>
@ -87,6 +88,18 @@ uint32_t hal_sim_get_dualbank_state(void);
 char **main_argv;
 int main_argc;

+static int sim_memfd_create(const char *name, unsigned int flags)
+{
+#if defined(__linux__) && defined(SYS_memfd_create)
+    return (int)syscall(SYS_memfd_create, name, flags);
+#else
+    (void)name;
+    (void)flags;
+    errno = ENOSYS;
+    return -1;
+#endif
+}
+
 #ifdef WOLFBOOT_ENABLE_WOLFHSM_CLIENT

 /* Client configuration/contexts */
@ -558,7 +571,7 @@ void do_boot(const uint32_t *app_offset)
    exit(0);
 #else
    char *envp[1] = {NULL};
-    int fd = memfd_create("test_app", 0);
+    int fd = sim_memfd_create("test_app", 0);
    size_t wret;
    if (fd == -1) {
        wolfBoot_printf( "memfd error\n");
--- a/include/user_settings.h
+++ b/include/user_settings.h
@ -367,7 +367,9 @@ extern int tolower(int c);
 #   define HAVE_PBKDF2
 #   define WOLFPKCS11_CUSTOM_STORE
 #   define WOLFBOOT_SECURE_PKCS11
-#   define WOLFPKCS11_USER_SETTINGS
+#   ifndef WOLFPKCS11_USER_SETTINGS
+#       define WOLFPKCS11_USER_SETTINGS
+#   endif
 #   define WOLFPKCS11_NO_TIME
 #ifndef WOLFSSL_AES_COUNTER
 #   define WOLFSSL_AES_COUNTER
--- a/lib/wolfPKCS11
+++ b/lib/wolfPKCS11
@ -1 +1 @@
-Subproject commit 52be35889a76ecf208ea6049c04ea8a0a3ce2ae6
+Subproject commit a1c62599d24f40cbdb3e90bf4ef00023be3b4fe9
--- a/lib/wolfPSA
+++ b/lib/wolfPSA
@ -1 +1 @@
-Subproject commit ac6a40411a2d2e47bb22ddc687df148d2d2f2192
+Subproject commit bb36f766321230c516af1b50e3264ed290fe5955
--- a/lib/wolfTPM
+++ b/lib/wolfTPM
@ -1 +1 @@
-Subproject commit 6d5df60e2416a88cdd5dbad1967169aa2a9e6f7a
+Subproject commit d1756f96c2da425b56cbfac164c7226fb8d00e52
--- a/lib/wolfssl
+++ b/lib/wolfssl
@ -1 +1 @@
-Subproject commit 8741805e9d1fd9c3014b5b774ad09a77ccb5b0dc
+Subproject commit 63f6f0511b76c78f4266d5bee3114506d890cfcc
--- a/options.mk
+++ b/options.mk
@ -131,6 +131,10 @@ ifeq ($(WOLFBOOT_SMALL_STACK),1)
  OBJS+=./src/xmalloc.o
 endif

+# GCC 13 overestimates some wolfTPM wrapper stack usage; keep TPM
+# limits above 10 KB to avoid false -Wstack-usage failures.
+STACK_USAGE_WOLFTPM=10680
+

 ECC_OBJS= \
    $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/ecc.o
@ -192,7 +196,7 @@ ifeq ($(SIGN),ECC256)
       STACK_USAGE=4096
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=7616
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=5264
@ -216,7 +220,7 @@ ifeq ($(SIGN),ECC384)
       STACK_USAGE=5880
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=6680
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=11248
@ -240,7 +244,7 @@ ifeq ($(SIGN),ECC521)
       STACK_USAGE=4096
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=6680
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=11256
@ -261,7 +265,7 @@ ifeq ($(SIGN),ED25519)
  WOLFCRYPT_OBJS+=$(ED25519_OBJS)
  CFLAGS+=-D"WOLFBOOT_SIGN_ED25519"
  ifeq ($(WOLFTPM),1)
-    STACK_USAGE=6680
+    STACK_USAGE=$(STACK_USAGE_WOLFTPM)
  else
    STACK_USAGE?=5000
  endif
@ -275,7 +279,7 @@ ifeq ($(SIGN),ED448)
  SIGN_OPTIONS+=--ed448
  WOLFCRYPT_OBJS+= $(ED448_OBJS)
  ifeq ($(WOLFTPM),1)
-    STACK_USAGE=6680
+    STACK_USAGE=$(STACK_USAGE_WOLFTPM)
  else
    ifeq ($(WOLFBOOT_SMALL_STACK),1)
      STACK_USAGE?=1024
@ -313,7 +317,7 @@ ifneq ($(findstring RSA2048,$(SIGN)),)
    endif
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=9096
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=35952
@ -346,7 +350,7 @@ ifneq ($(findstring RSA3072,$(SIGN)),)
    endif
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=9096
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=52592
@ -383,7 +387,7 @@ ifneq ($(findstring RSA4096,$(SIGN)),)
    endif
  else
    ifeq ($(WOLFTPM),1)
-      STACK_USAGE=10680
+      STACK_USAGE=$(STACK_USAGE_WOLFTPM)
    else
      ifneq ($(SPMATH),1)
        STACK_USAGE=69232
@ -791,6 +795,7 @@ endif

 ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
  CFLAGS+=-DSECURE_PKCS11
+  CFLAGS+=-DWOLFPKCS11_USER_SETTINGS
  CFLAGS+=-DWOLFSSL_PKCS11_RW_TOKENS
  CFLAGS+=-DCK_CALLABLE="__attribute__((cmse_nonsecure_entry))"
  CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPKCS11)
@ -899,7 +904,6 @@ ifeq ($(WOLFTPM),1)
  CFLAGS+=-I$(WOLFBOOT_LIB_WOLFTPM)
  CFLAGS+=-D"WOLFBOOT_TPM"
  CFLAGS+=-D"WOLFTPM_SMALL_STACK"
-  CFLAGS+=-D"WOLFTPM_AUTODETECT"
  ifneq ($(SPI_FLASH),1)
    # don't use spi if we're using simulator
    ifeq ($(TARGET),sim)
@ -910,7 +914,7 @@ ifeq ($(WOLFTPM),1)
      OBJS+=$(WOLFBOOT_LIB_WOLFTPM)/src/tpm2_swtpm.o
    else
      # Use memory-mapped WOLFTPM on x86-64
-       ifeq ($(ARCH),x86_64)
+        ifeq ($(ARCH),x86_64)
          CFLAGS+=-DWOLFTPM_MMIO -DWOLFTPM_EXAMPLE_HAL -DWOLFTPM_INCLUDE_IO_FILE
          OBJS+=$(WOLFBOOT_LIB_WOLFTPM)/hal/tpm_io_mmio.o
        # By default, on other architectures, provide SPI driver
--- a/test-app/CMakeLists.txt
+++ b/test-app/CMakeLists.txt
@ -205,7 +205,7 @@ if(BUILD_TEST_APPS)
    endif()

    if(WOLFCRYPT_TZ_PKCS11)
-        list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_PKCS11_APP SECURE_PKCS11)
+        list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_PKCS11_APP SECURE_PKCS11 WOLFPKCS11_USER_SETTINGS)
        set(WOLFSSL_PKCS11_SOURCES
            wcs/pkcs11_stub.c
            wcs/pkcs11_test_ecc.c
--- a/tools/scripts/sim-sunnyday-update.sh
+++ b/tools/scripts/sim-sunnyday-update.sh
@ -14,5 +14,3 @@ fi

 echo Test successful.
 exit 0
-
-
--- a/tools/test.mk
+++ b/tools/test.mk
@ -1144,13 +1144,13 @@ test-all: clean


 test-size-all:
-	make test-size SIGN=NONE LIMIT=5060 NO_ARM_ASM=1
+	make test-size SIGN=NONE LIMIT=5066 NO_ARM_ASM=1
 	make keysclean
-	make test-size SIGN=ED25519 LIMIT=11778 NO_ARM_ASM=1
+	make test-size SIGN=ED25519 LIMIT=11818 NO_ARM_ASM=1
 	make keysclean
 	make test-size SIGN=ECC256  LIMIT=18944 NO_ARM_ASM=1
 	make clean
-	make test-size SIGN=ECC256 NO_ASM=1 LIMIT=13894 NO_ARM_ASM=1
+	make test-size SIGN=ECC256 NO_ASM=1 LIMIT=13914 NO_ARM_ASM=1
 	make keysclean
 	make test-size SIGN=RSA2048 LIMIT=11916 NO_ARM_ASM=1
 	make clean
@ -1162,9 +1162,9 @@ test-size-all:
 	make keysclean
 	make test-size SIGN=ECC384 LIMIT=19888 NO_ARM_ASM=1
 	make clean
-	make test-size SIGN=ECC384 NO_ASM=1 LIMIT=15270 NO_ARM_ASM=1
+	make test-size SIGN=ECC384 NO_ASM=1 LIMIT=15290 NO_ARM_ASM=1
 	make keysclean
-	make test-size SIGN=ED448 LIMIT=13846 NO_ARM_ASM=1
+	make test-size SIGN=ED448 LIMIT=13862 NO_ARM_ASM=1
 	make keysclean
 	make test-size SIGN=RSA3072 LIMIT=12056 NO_ARM_ASM=1
 	make clean
@ -1172,12 +1172,12 @@ test-size-all:
 	make keysclean
 	make test-size SIGN=LMS LMS_LEVELS=2 LMS_HEIGHT=5 LMS_WINTERNITZ=8 \
 		WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2644 \
-		IMAGE_HEADER_SIZE?=5288 LIMIT=7782 NO_ARM_ASM=1
+		IMAGE_HEADER_SIZE?=5288 LIMIT=7798 NO_ARM_ASM=1
 	make keysclean
 	make test-size SIGN=XMSS XMSS_PARAMS='XMSS-SHA2_10_256' \
 		IMAGE_SIGNATURE_SIZE=2500 IMAGE_HEADER_SIZE?=4096 \
-		LIMIT=8638 NO_ARM_ASM=1
+		LIMIT=8658 NO_ARM_ASM=1
 	make keysclean
 	make clean
-	make test-size SIGN=ML_DSA ML_DSA_LEVEL=2 LIMIT=19392 \
+	make test-size SIGN=ML_DSA ML_DSA_LEVEL=2 LIMIT=19400 \
 		IMAGE_SIGNATURE_SIZE=2420 IMAGE_HEADER_SIZE?=8192
--- a/tools/unit-tests/Makefile
+++ b/tools/unit-tests/Makefile
@ -87,7 +87,7 @@ unit-enc-nvm-flagshome:CFLAGS+=-DNVM_FLASH_WRITEONCE -DMOCK_PARTITIONS \
 	-DEXT_ENCRYPTED -DENCRYPT_WITH_CHACHA -DEXT_FLASH -DHAVE_CHACHA -DFLAGS_HOME
 unit-enc-nvm-flagshome:WOLFCRYPT_SRC+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/chacha.c
 unit-delta:CFLAGS+=-DNVM_FLASH_WRITEONCE -DMOCK_PARTITIONS -DDELTA_UPDATES -DDELTA_BLOCK_SIZE=512
-unit-pkcs11_store:CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPKCS11) -DMOCK_PARTITIONS -DMOCK_KEYVAULT -DSECURE_PKCS11
+unit-pkcs11_store:CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPKCS11) -DMOCK_PARTITIONS -DMOCK_KEYVAULT -DSECURE_PKCS11 -DWOLFPKCS11_USER_SETTINGS
 unit-psa_store:CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA) -DMOCK_PARTITIONS -DMOCK_KEYVAULT -DWOLFCRYPT_TZ_PSA
 unit-update-flash:CFLAGS+=-DMOCK_PARTITIONS -DWOLFBOOT_NO_SIGN -DUNIT_TEST_AUTH \
 	-DWOLFBOOT_HASH_SHA256 -DPRINTF_ENABLED -DEXT_FLASH -DPART_UPDATE_EXT -DPART_SWAP_EXT