diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 6ab44d93c9..db2ab0ae14 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -645,6 +645,8 @@ SSL_SNIFFER_EXPORTS SSN_BUILDING_LIBYASSL SSS_HAVE_SE05X_VER_GTE_07_02 STATIC_CHUNKS_ONLY +STM32C562xx +STM32C5A3xx STM32F107xC STM32F207xx STM32F217xx @@ -673,6 +675,7 @@ STM32U385xx STM32U575xx STM32U585xx STM32U5A9xx +STM32V873xx STM32WB55xx STM32WBA52xx STM32WL55xx @@ -1173,6 +1176,7 @@ WOLFSSL_XILINX_PATCH WOLFSSL_XIL_MSG_NO_SLEEP WOLFSSL_ZEPHYR WOLF_ALLOW_BUILTIN +WOLF_CONF_ASN_TIME WOLF_CRYPTO_CB_ASYNC_POLL WOLF_CRYPTO_CB_CMD WOLF_CRYPTO_CB_ONLY_FALCON diff --git a/IDE/STM32Cube/MX2/README.md b/IDE/STM32Cube/MX2/README.md new file mode 100644 index 0000000000..050302fab7 --- /dev/null +++ b/IDE/STM32Cube/MX2/README.md @@ -0,0 +1,38 @@ +# wolfSSL STM32CubeMX2 (MX2) codegen assets + +STM32CubeMX2 replaces the classic CubeMX pack mechanism: the configuration +GUI is defined by a JSON-Forms schema and the configuration header is +rendered by a Handlebars template through `cube codegen`, producing +`mx_wolfSSL_conf.h` in the generated project (the MX2 analog of +`wolfSSL.I-CUBE-wolfSSL_conf.h`, using the same `WOLF_CONF_*` scheme). + +- `mx_wolfSSL_parameters.json` - the wolfSSL configuration panel shown in + STM32CubeMX2 (JSON-Forms). Includes the `STM32 Hardware Crypto` toggle: + on devices where wolfSSL has register-level STM32 support (independent + of the HAL1 to HAL2 API change), the generated configuration enables the + RNG, HASH, AES and PKA peripherals. +- `mx_wolfSSL_conf_template.h.hbs` - the Handlebars template that renders + `mx_wolfSSL_conf.h`. + +`wolfssl/wolfcrypt/settings.h` picks the generated header up automatically +via `__has_include("mx_wolfSSL_conf.h")` (HAL2 projects have no global +define like HAL1's `USE_HAL_DRIVER`). + +These files are packaged into the `wolfSSL.wolfSSL_middlewares` pack for +STM32CubeMX2 by the wolfSSL pack tooling; the pack build prefers the copies +in this directory so the configuration stays versioned with the library. + +## Project checklist (validated on NUCLEO-C5A3ZG, full wolfcrypt_test pass) + +- Enable the console UART (Async) matching the wolfSSL panel's + `Console UART instance` (default `usart2`, the Nucleo VCP) and enable the + `RNG` peripheral so the generated clock init arms the RNG kernel clock. +- Raise `HEAP_SIZE`/`STACK_SIZE` in the project's `user_modifiable` linker + script (128 KB / 16 KB recommended); the defaults are too small for + wolfSSL and fail wolfcrypt_test's MEMORY test. +- Call `wolfCryptDemo(NULL)` (from `wolfssl_example.c`, the wolfCrypt Test + component) in `main()` to get the interactive test/benchmark menu on the + console UART; printf is retargeted through the syscalls utility's + `__io_putchar` hook automatically. +- For benchmark throughput output add `-u _printf_float` to the linker + options (newlib-nano) and build the Release profile. diff --git a/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs b/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs new file mode 100644 index 0000000000..f1059a4441 --- /dev/null +++ b/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs @@ -0,0 +1,1141 @@ +{{assign 'wolfSSL_instances' (@root.SWConfigurationAPI.getInstances "wolfSSL::Security:STM32CubeMX2 Config:wolfSSL")~}} +/** + ****************************************************************************** + * File Name : mx_wolfSSL_conf.h + * Description : This file provides code for the configuration + * of the mx_wolfSSL_conf.h instances. + ****************************************************************************** + * @attention + * + * Copyright (c) 2025 STMicroelectronics. + * All rights reserved. + * + * This software is licensed under terms that can be found in the LICENSE file + * in the root directory of this software component. + * If no LICENSE file comes with this software, it is provided AS-IS. + * + ****************************************************************************** + */ +/* Define to prevent recursive inclusion -------------------------------------*/ +#ifndef __MX_WOLFSSL_CONF_H__ +#define __MX_WOLFSSL_CONF_H__ + +#ifdef __cplusplus + extern "C" { +#endif + +/* Includes ------------------------------------------------------------------*/ + +/** + MiddleWare name : wolfSSL.wolfSSL_middlewares + MiddleWare fileName : mx_wolfSSL_conf.h + MiddleWare version : +*/ + +{{#each @root.wolfSSL_instances~}} +{{assign 'ctx' (@root.SWConfigurationAPI.getSwInstanceConfiguration this)~}} +{{assign 'info' @root.ctx.info}} +{{assign 'basic_config' @root.ctx.basic_config}} + +{{#if @root.info.label~}} +/*---------- User Label -----------*/ +#define {{@root.info.label}} +{{/if}} + +{{#if (eq @root.basic_config.debugSupport true)~}} +/*---------- WOLF_CONF_DEBUG -----------*/ +#define WOLF_CONF_DEBUG 1 +{{/if}} +{{#if (eq @root.basic_config.debugSupport false)~}} +/*---------- WOLF_CONF_DEBUG -----------*/ +#define WOLF_CONF_DEBUG 0 +{{/if}} + +{{#if (eq @root.basic_config.wolfCryptOnly true)~}} +/*---------- WOLF_CONF_WOLFCRYPT_ONLY -----------*/ +#define WOLF_CONF_WOLFCRYPT_ONLY 1 +{{/if}} +{{#if (eq @root.basic_config.wolfCryptOnly false)~}} +/*---------- WOLF_CONF_WOLFCRYPT_ONLY -----------*/ +#define WOLF_CONF_WOLFCRYPT_ONLY 0 +{{/if}} + +{{#if (eq @root.basic_config.tlsV13 true)~}} +/*---------- WOLF_CONF_TLS13 -----------*/ +#define WOLF_CONF_TLS13 1 +{{/if}} +{{#if (eq @root.basic_config.tlsV13 false)~}} +/*---------- WOLF_CONF_TLS13 -----------*/ +#define WOLF_CONF_TLS13 0 +{{/if}} + +{{#if (eq @root.basic_config.tlsV12 true)~}} +/*---------- WOLF_CONF_TLS12 -----------*/ +#define WOLF_CONF_TLS12 1 +{{/if}} +{{#if (eq @root.basic_config.tlsV12 false)~}} +/*---------- WOLF_CONF_TLS12 -----------*/ +#define WOLF_CONF_TLS12 0 +{{/if}} + +{{#if (eq @root.basic_config.dtlsSupport true)~}} +/*---------- WOLF_CONF_DTLS -----------*/ +#define WOLF_CONF_DTLS 1 +{{/if}} +{{#if (eq @root.basic_config.dtlsSupport false)~}} +/*---------- WOLF_CONF_DTLS -----------*/ +#define WOLF_CONF_DTLS 0 +{{/if}} + +/*---------- WOLF_CONF_MATH -----------*/ +#define WOLF_CONF_MATH {{@root.basic_config.mathConfiguration}} + +/*---------- WOLF_CONF_RTOS -----------*/ +#define WOLF_CONF_RTOS {{@root.basic_config.rtos}} + +{{#if (eq @root.basic_config.rngSupport true)~}} +/*---------- WOLF_CONF_RNG -----------*/ +#define WOLF_CONF_RNG 1 +{{/if}} +{{#if (eq @root.basic_config.rngSupport false)~}} +/*---------- WOLF_CONF_RNG -----------*/ +#define WOLF_CONF_RNG 0 +{{/if}} + +{{#if (eq @root.basic_config.rsaSupport true)~}} +/*---------- WOLF_CONF_RSA -----------*/ +#define WOLF_CONF_RSA 1 +{{/if}} +{{#if (eq @root.basic_config.rsaSupport false)~}} +/*---------- WOLF_CONF_RSA -----------*/ +#define WOLF_CONF_RSA 0 +{{/if}} + +{{#if (eq @root.basic_config.eccSupport true)~}} +/*---------- WOLF_CONF_ECC -----------*/ +#define WOLF_CONF_ECC 1 +{{/if}} +{{#if (eq @root.basic_config.eccSupport false)~}} +/*---------- WOLF_CONF_ECC -----------*/ +#define WOLF_CONF_ECC 0 +{{/if}} + +{{#if (eq @root.basic_config.dhSupport true)~}} +/*---------- WOLF_CONF_DH -----------*/ +#define WOLF_CONF_DH 1 +{{/if}} +{{#if (eq @root.basic_config.dhSupport false)~}} +/*---------- WOLF_CONF_DH -----------*/ +#define WOLF_CONF_DH 0 +{{/if}} + +/*---------- WOLF_CONF_AESGCM -----------*/ +#define WOLF_CONF_AESGCM {{@root.basic_config.aesGCMSupport}} + +{{#if (eq @root.basic_config.aesCBCSupport true)~}} +/*---------- WOLF_CONF_AESCBC -----------*/ +#define WOLF_CONF_AESCBC 1 +{{/if}} +{{#if (eq @root.basic_config.aesCBCSupport false)~}} +/*---------- WOLF_CONF_AESCBC -----------*/ +#define WOLF_CONF_AESCBC 0 +{{/if}} + +{{#if (eq @root.basic_config.chaCha20Support true)~}} +/*---------- WOLF_CONF_CHAPOLY -----------*/ +#define WOLF_CONF_CHAPOLY 1 +{{/if}} +{{#if (eq @root.basic_config.chaCha20Support false)~}} +/*---------- WOLF_CONF_CHAPOLY -----------*/ +#define WOLF_CONF_CHAPOLY 0 +{{/if}} + +{{#if (eq @root.basic_config.ed25519Support true)~}} +/*---------- WOLF_CONF_EDCURVE25519 -----------*/ +#define WOLF_CONF_EDCURVE25519 1 +{{/if}} +{{#if (eq @root.basic_config.ed25519Support false)~}} +/*---------- WOLF_CONF_EDCURVE25519 -----------*/ +#define WOLF_CONF_EDCURVE25519 0 +{{/if}} + +{{#if (eq @root.basic_config.md5Support true)~}} +/*---------- WOLF_CONF_MD5 -----------*/ +#define WOLF_CONF_MD5 1 +{{/if}} +{{#if (eq @root.basic_config.md5Support false)~}} +/*---------- WOLF_CONF_MD5 -----------*/ +#define WOLF_CONF_MD5 0 +{{/if}} + +{{#if (eq @root.basic_config.sha1Support true)~}} +/*---------- WOLF_CONF_SHA1 -----------*/ +#define WOLF_CONF_SHA1 1 +{{/if}} +{{#if (eq @root.basic_config.sha1Support false)~}} +/*---------- WOLF_CONF_SHA1 -----------*/ +#define WOLF_CONF_SHA1 0 +{{/if}} + +{{#if (eq @root.basic_config.sha2_224Support true)~}} +/*---------- WOLF_CONF_SHA2_224 -----------*/ +#define WOLF_CONF_SHA2_224 1 +{{/if}} +{{#if (eq @root.basic_config.sha2_224Support false)~}} +/*---------- WOLF_CONF_SHA2_224 -----------*/ +#define WOLF_CONF_SHA2_224 0 +{{/if}} + +{{#if (eq @root.basic_config.sha2_256Support true)~}} +/*---------- WOLF_CONF_SHA2_256 -----------*/ +#define WOLF_CONF_SHA2_256 1 +{{/if}} +{{#if (eq @root.basic_config.sha2_256Support false)~}} +/*---------- WOLF_CONF_SHA2_256 -----------*/ +#define WOLF_CONF_SHA2_256 0 +{{/if}} + +{{#if (eq @root.basic_config.sha2_384Support true)~}} +/*---------- WOLF_CONF_SHA2_384 -----------*/ +#define WOLF_CONF_SHA2_384 1 +{{/if}} +{{#if (eq @root.basic_config.sha2_384Support false)~}} +/*---------- WOLF_CONF_SHA2_384 -----------*/ +#define WOLF_CONF_SHA2_384 0 +{{/if}} + +{{#if (eq @root.basic_config.sha2_512Support true)~}} +/*---------- WOLF_CONF_SHA2_512 -----------*/ +#define WOLF_CONF_SHA2_512 1 +{{/if}} +{{#if (eq @root.basic_config.sha2_512Support false)~}} +/*---------- WOLF_CONF_SHA2_512 -----------*/ +#define WOLF_CONF_SHA2_512 0 +{{/if}} + +{{#if (eq @root.basic_config.sha3Support true)~}} +/*---------- WOLF_CONF_SHA3 -----------*/ +#define WOLF_CONF_SHA3 1 +{{/if}} +{{#if (eq @root.basic_config.sha3Support false)~}} +/*---------- WOLF_CONF_SHA3 -----------*/ +#define WOLF_CONF_SHA3 0 +{{/if}} + +{{#if (eq @root.basic_config.preSharedKeySupport true)~}} +/*---------- WOLF_CONF_PSK -----------*/ +#define WOLF_CONF_PSK 1 +{{/if}} +{{#if (eq @root.basic_config.preSharedKeySupport false)~}} +/*---------- WOLF_CONF_PSK -----------*/ +#define WOLF_CONF_PSK 0 +{{/if}} + +{{#if (eq @root.basic_config.pwdBasedKeyDerivationSupport true)~}} +/*---------- WOLF_CONF_PWDBASED -----------*/ +#define WOLF_CONF_PWDBASED 1 +{{/if}} +{{#if (eq @root.basic_config.pwdBasedKeyDerivationSupport false)~}} +/*---------- WOLF_CONF_PWDBASED -----------*/ +#define WOLF_CONF_PWDBASED 0 +{{/if}} + +{{#if (eq @root.basic_config.keepPeerCertSupport true)~}} +/*---------- WOLF_CONF_KEEP_PEER_CERT -----------*/ +#define WOLF_CONF_KEEP_PEER_CERT 1 +{{/if}} +{{#if (eq @root.basic_config.keepPeerCertSupport false)~}} +/*---------- WOLF_CONF_KEEP_PEER_CERT -----------*/ +#define WOLF_CONF_KEEP_PEER_CERT 0 +{{/if}} + +{{#if (eq @root.basic_config.base64EncodeSupport true)~}} +/*---------- WOLF_CONF_BASE64_ENCODE -----------*/ +#define WOLF_CONF_BASE64_ENCODE 1 +{{/if}} +{{#if (eq @root.basic_config.base64EncodeSupport false)~}} +/*---------- WOLF_CONF_BASE64_ENCODE -----------*/ +#define WOLF_CONF_BASE64_ENCODE 0 +{{/if}} + +/*---------- WOLF_CONF_OPENSSL_EXTRA -----------*/ +#define WOLF_CONF_OPENSSL_EXTRA {{@root.basic_config.openSSLExtraSupport}} + +{{#if (eq @root.basic_config.wolfCryptTestBenchmarkSupport true)~}} +/*---------- WOLF_CONF_TEST -----------*/ +#define WOLF_CONF_TEST 1 +{{/if}} +{{#if (eq @root.basic_config.wolfCryptTestBenchmarkSupport false)~}} +/*---------- WOLF_CONF_TEST -----------*/ +#define WOLF_CONF_TEST 0 +{{/if}} + +{{#if (eq @root.basic_config.kyberMLKemSupport true)~}} +/*---------- WOLF_CONF_KYBER -----------*/ +#define WOLF_CONF_KYBER 1 +{{/if}} +{{#if (eq @root.basic_config.kyberMLKemSupport false)~}} +/*---------- WOLF_CONF_KYBER -----------*/ +#define WOLF_CONF_KYBER 0 +{{/if}} + +{{#if (eq @root.basic_config.armASMSupport true)~}} +/*---------- WOLF_CONF_ARMASM -----------*/ +#define WOLF_CONF_ARMASM 1 +{{/if}} +{{#if (eq @root.basic_config.armASMSupport false)~}} +/*---------- WOLF_CONF_ARMASM -----------*/ +#define WOLF_CONF_ARMASM 0 +{{/if}} + +/*---------- WOLF_CONF_IO -----------*/ +#define WOLF_CONF_IO {{@root.basic_config.ioInterfaceConfig}} + +{{#if (eq @root.basic_config.sessionCacheSupport true)~}} +/*---------- WOLF_CONF_RESUMPTION -----------*/ +#define WOLF_CONF_RESUMPTION 1 +{{/if}} +{{#if (eq @root.basic_config.sessionCacheSupport false)~}} +/*---------- WOLF_CONF_RESUMPTION -----------*/ +#define WOLF_CONF_RESUMPTION 0 +{{/if}} + +{{#if (eq @root.basic_config.tpmSupport true)~}} +/*---------- WOLF_CONF_TPM -----------*/ +#define WOLF_CONF_TPM 1 +{{/if}} +{{#if (eq @root.basic_config.tpmSupport false)~}} +/*---------- WOLF_CONF_TPM -----------*/ +#define WOLF_CONF_TPM 0 +{{/if}} + +{{#if (eq @root.basic_config.tlsKeyCallbacksSupport true)~}} +/*---------- WOLF_CONF_PK -----------*/ +#define WOLF_CONF_PK 1 +{{/if}} +{{#if (eq @root.basic_config.tlsKeyCallbacksSupport false)~}} +/*---------- WOLF_CONF_PK -----------*/ +#define WOLF_CONF_PK 0 +{{/if}} + +{{#if (eq @root.basic_config.dtls13Support true)~}} +/*---------- WOLF_CONF_DTLS13 -----------*/ +#define WOLF_CONF_DTLS13 1 +{{/if}} +{{#if (eq @root.basic_config.dtls13Support false)~}} +/*---------- WOLF_CONF_DTLS13 -----------*/ +#define WOLF_CONF_DTLS13 0 +{{/if}} + +{{#if (eq @root.basic_config.hwCrypto true)~}} +/*---------- WOLF_CONF_HW_CRYPTO -----------*/ +#define WOLF_CONF_HW_CRYPTO 1 +{{/if}} +{{#if (eq @root.basic_config.hwCrypto false)~}} +/*---------- WOLF_CONF_HW_CRYPTO -----------*/ +#define WOLF_CONF_HW_CRYPTO 0 +{{/if}} + +/*---------- WOLF_CONF_CONSOLE_UART -----------*/ +#define WOLF_CONF_CONSOLE_UART_GETHANDLE mx_{{@root.basic_config.consoleUart}}_uart_gethandle +{{/each}} + +/* ------------------------------------------------------------------------- */ +/* Hardware platform */ +/* ------------------------------------------------------------------------- */ +/* Setup default (No crypto hardware acceleration or TLS UART test). + * Use undef in platform section to enable it. + */ +#define NO_STM32_HASH +#define NO_STM32_CRYPTO +#define NO_TLS_UART_TEST + +#if defined(STM32WB55xx) + #define WOLFSSL_STM32WB + #define WOLFSSL_STM32_PKA + #undef NO_STM32_CRYPTO + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32WBA52xx) + #define WOLFSSL_STM32WBA + #define WOLFSSL_STM32_PKA + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + /* NUCLEO-WBA52CG USART1 (TX=PB12 / RX=PA8) */ + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32WL55xx) + #define WOLFSSL_STM32WL + #define WOLFSSL_STM32_PKA + #undef NO_STM32_CRYPTO + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32F407xx) + #define WOLFSSL_STM32F4 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32F437xx) || defined(STM32F439xx) + #define WOLFSSL_STM32F4 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define STM32_HAL_V2 + #ifndef HAL_CONSOLE_UART + #ifdef STM32F439xx + #define HAL_CONSOLE_UART huart3 + #else + #define HAL_CONSOLE_UART huart4 + #endif + #endif +#elif defined(STM32F777xx) + #define WOLFSSL_STM32F7 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define STM32_HAL_V2 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32F756xx) + #define WOLFSSL_STM32F7 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define STM32_HAL_V2 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32H7S3xx) + #define WOLFSSL_STM32H7S + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define WOLFSSL_STM32_PKA + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32H753xx) + #define WOLFSSL_STM32H7 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32H723xx) || defined(STM32H725xx) || defined(STM32H743xx) + #define WOLFSSL_STM32H7 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32L4A6xx) + #define WOLFSSL_STM32L4 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART hlpuart1 + #endif +#elif defined(STM32L475xx) + #define WOLFSSL_STM32L4 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32L562xx) + #define WOLFSSL_STM32L5 + #define WOLFSSL_STM32_PKA + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32L552xx) + #define WOLFSSL_STM32L5 + #undef NO_STM32_HASH + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART hlpuart1 + #endif +#elif defined(STM32F207xx) + #define WOLFSSL_STM32F2 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32F217xx) + #define WOLFSSL_STM32F2 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32F107xC) + #define WOLFSSL_STM32F1 + #define NO_STM32_RNG + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart4 + #endif +#elif defined(STM32F401xE) + #define WOLFSSL_STM32F4 + #define NO_STM32_RNG + #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32G071xx) + #define WOLFSSL_STM32G0 + #define NO_STM32_RNG + #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart2 + #endif +#elif defined(STM32G491xx) + #define WOLFSSL_STM32G4 + #define HAL_CONSOLE_UART hlpuart1 +#elif defined(STM32U575xx) || defined(STM32U585xx) || defined(STM32U5A9xx) + #define WOLFSSL_STM32U5 + #define STM32_HAL_V2 + #if defined(STM32U585xx) || defined(STM32U5A9xx) + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define WOLFSSL_STM32_PKA + #endif + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32H563xx) + #define WOLFSSL_STM32H5 + #define STM32_HAL_V2 + #undef NO_STM32_HASH + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart3 + #endif +#elif defined(STM32MP135Fxx) + #define WOLFSSL_STM32MP13 + #define STM32_HAL_V2 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define WOLFSSL_STM32_PKA + #define WOLFSSL_STM32_PKA_V2 + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart4 + #endif +#elif defined(STM32N657xx) + #define WOLFSSL_STM32N6 + #define STM32_HAL_V2 + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define WOLFSSL_STM32_PKA + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart1 + #endif +#elif defined(STM32C562xx) || defined(STM32C5A3xx) + /* STM32C5: wolfSSL drives the crypto peripherals at register level + * (WOLFSSL_STM32_BARE), so only the CMSIS device header is needed and + * the HAL1 vs HAL2 API change does not matter (do NOT include + * mx_hal_def.h here: the HAL2 defs collide with wolfSSL's private + * bare-metal HAL stand-ins inside library sources; the example pulls + * it in itself for the console). RNG needs its kernel clock configured + * in the STM32CubeMX2 clock tree (CK48). */ + #define WOLFSSL_STM32C5 + #if defined(WOLF_CONF_HW_CRYPTO) && WOLF_CONF_HW_CRYPTO == 1 + #define WOLFSSL_STM32_BARE + #define WOLFSSL_STM32_PKA + #define NO_STM32_HMAC + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #else + #define NO_STM32_HASH + #define NO_STM32_CRYPTO + #define NO_STM32_RNG + #define WOLFSSL_GENSEED_FORTEST + #endif +#elif defined(STM32V873xx) + /* STM32V8 (Cortex-M85): register-level crypto like the C5 above. + * RNG uses the MCG48 generator (no CCIPR mux). Requires a wolfSSL + * version with STM32V8 support (5.9.3 or later). */ + #define WOLFSSL_STM32V8 + #if defined(WOLF_CONF_HW_CRYPTO) && WOLF_CONF_HW_CRYPTO == 1 + #define WOLFSSL_STM32_BARE + #define WOLFSSL_STM32_PKA + #define WOLFSSL_STM32_USE_SAES + #define NO_STM32_HMAC + #undef NO_STM32_HASH + #undef NO_STM32_CRYPTO + #else + #define NO_STM32_HASH + #define NO_STM32_CRYPTO + #define NO_STM32_RNG + #define WOLFSSL_GENSEED_FORTEST + #endif +#else + #warning Please define a hardware platform! + /* This means there is not a pre-defined platform for your board/CPU */ + /* You need to define a CPU type, HW crypto and debug UART */ + /* CPU Type: WOLFSSL_STM32F1, WOLFSSL_STM32F2, WOLFSSL_STM32F4, + WOLFSSL_STM32F7, WOLFSSL_STM32H7, WOLFSSL_STM32L4, WOLFSSL_STM32L5, + WOLFSSL_STM32G0, WOLFSSL_STM32G4, WOLFSSL_STM32WB, WOLFSSL_STM32U5 and + WOLFSSL_STM32MP13 */ + #define WOLFSSL_STM32F4 + + /* Debug UART used for printf */ + /* The UART interface number varies for each board/CPU */ + /* Typically this is the UART attached to the ST-Link USB CDC UART port */ + #ifndef HAL_CONSOLE_UART + #define HAL_CONSOLE_UART huart4 + #endif + + /* Hardware Crypto - uncomment as available on hardware */ + //#define STM32_HAL_V2 + //#define WOLFSSL_STM32_PKA + //#define WOLFSSL_STM32_PKA_V2 + //#define NO_STM32_RNG + //#undef NO_STM32_HASH + //#undef NO_STM32_CRYPTO + /* if no HW RNG is available use test seed */ + //#define WOLFSSL_GENSEED_FORTEST +#endif + +/* Honor the hardware crypto toggle on every family: the per-family arms + * above enable what each part supports; turning the toggle off forces the + * software paths regardless of family. */ +#if defined(WOLF_CONF_HW_CRYPTO) && WOLF_CONF_HW_CRYPTO == 0 + #undef WOLFSSL_STM32_PKA + #undef WOLFSSL_STM32_BARE + #ifndef NO_STM32_HASH + #define NO_STM32_HASH + #endif + #ifndef NO_STM32_CRYPTO + #define NO_STM32_CRYPTO + #endif + #ifndef NO_STM32_RNG + #define NO_STM32_RNG + #endif + #ifndef WOLFSSL_GENSEED_FORTEST + #define WOLFSSL_GENSEED_FORTEST + #endif +#endif + +/* ------------------------------------------------------------------------- */ +/* Platform */ +/* ------------------------------------------------------------------------- */ +#define SIZEOF_LONG_LONG 8 +#define WOLFSSL_GENERAL_ALIGNMENT 4 +#ifndef WOLFSSL_STM32_BARE + /* register-level (BARE) hardware crypto arms above take precedence; + * the two modes are mutually exclusive in wolfssl settings.h */ + #define WOLFSSL_STM32_CUBEMX +#endif +#define WOLFSSL_SMALL_STACK +#define WOLFSSL_IGNORE_FILE_WARN + +/* ------------------------------------------------------------------------- */ +/* Network stack: 1=User IO (custom), 2=LWIP (posix), 3=LWIP (native) */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLF_CONF_IO) && WOLF_CONF_IO == 2 + #define WOLFSSL_LWIP +#elif defined(WOLF_CONF_IO) && WOLF_CONF_IO == 3 + #define WOLFSSL_LWIP_NATIVE +#else /* custom */ + #define WOLFSSL_USER_IO + #define WOLFSSL_NO_SOCK +#endif + +/* ------------------------------------------------------------------------- */ +/* Operating System: 1=Bare-metal/Single threaded, 2=FREERTOS */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLF_CONF_RTOS) && WOLF_CONF_RTOS == 2 + #define FREERTOS +#else + #define SINGLE_THREADED +#endif + +/* ------------------------------------------------------------------------- */ +/* Math Configuration */ +/* ------------------------------------------------------------------------- */ +/* 1=Fast (stack) (tfm.c) + * 2=Normal (heap) (integer.c) + * 3-5=Single Precision: only common curves/key sizes: + * (ECC 256/384/521 and RSA/DH 2048/3072/4096) + * 3=Single Precision C (sp_c32.c) + * 4=Single Precision ASM Cortex-M3+ (sp_cortexm.c) + * 5=Single Precision ASM Cortex-M0 (sp_armthumb.c) + * 6=Wolf multi-precision C small (sp_int.c) + * 7=Wolf multi-precision C big (sp_int.c) + */ + +#if defined(WOLF_CONF_MATH) && WOLF_CONF_MATH == 1 + /* fast (stack) math - tfm.c */ + #define USE_FAST_MATH + #define TFM_TIMING_RESISTANT + + #if !defined(NO_RSA) || !defined(NO_DH) + /* Maximum math bits (Max DH/RSA key bits * 2) */ + #undef FP_MAX_BITS + #define FP_MAX_BITS 4096 + #endif + + /* Optimizations (TFM_ARM, TFM_ASM or none) */ + //#define TFM_NO_ASM + //#define TFM_ASM +#elif defined(WOLF_CONF_MATH) && WOLF_CONF_MATH == 2 + /* heap math - integer.c */ + #define USE_INTEGER_HEAP_MATH +#elif defined(WOLF_CONF_MATH) && (WOLF_CONF_MATH >= 3) + /* single precision only */ + #define WOLFSSL_SP + #if WOLF_CONF_MATH != 7 + #define WOLFSSL_SP_SMALL /* use smaller version of code */ + #endif + #if defined(WOLF_CONF_RSA) && WOLF_CONF_RSA == 1 + #define WOLFSSL_HAVE_SP_RSA + //#define WOLFSSL_SP_NO_2048 + //#define WOLFSSL_SP_NO_3072 + //#define WOLFSSL_SP_4096 + #endif + #if defined(WOLF_CONF_DH) && WOLF_CONF_DH == 1 + #define WOLFSSL_HAVE_SP_DH + #endif + #if defined(WOLF_CONF_ECC) && WOLF_CONF_ECC == 1 + #define WOLFSSL_HAVE_SP_ECC + //#define WOLFSSL_SP_NO_256 + //#define WOLFSSL_SP_384 + //#define WOLFSSL_SP_521 + #endif + #if WOLF_CONF_MATH == 6 || WOLF_CONF_MATH == 7 + #define WOLFSSL_SP_MATH_ALL /* use sp_int.c multi precision math */ + //#define WOLFSSL_SP_ARM_THUMB /* enable ARM Thumb ASM speedups */ + #else + #define WOLFSSL_SP_MATH /* disable non-standard curves / key sizes */ + #endif + #define SP_WORD_SIZE 32 /* force 32-bit mode */ + + /* Enable to put all math on stack (no heap) */ + //#define WOLFSSL_SP_NO_MALLOC + + #if WOLF_CONF_MATH == 4 || WOLF_CONF_MATH == 5 + #define WOLFSSL_SP_ASM /* required if using the ASM versions */ + #if WOLF_CONF_MATH == 4 + /* ARM Cortex-M3+ */ + #define WOLFSSL_SP_ARM_CORTEX_M_ASM + #endif + #if WOLF_CONF_MATH == 5 + /* Generic ARM Thumb (Cortex-M0) Assembly */ + #define WOLFSSL_SP_ARM_THUMB_ASM + #endif + #endif +#endif + +/* ------------------------------------------------------------------------- */ +/* Enable Features */ +/* ------------------------------------------------------------------------- */ +/* Required for TLS */ +#define HAVE_TLS_EXTENSIONS +#define HAVE_SUPPORTED_CURVES +#define HAVE_ENCRYPT_THEN_MAC +#define HAVE_EXTENDED_MASTER +#define WOLFSSL_ASN_TEMPLATE +#define HAVE_SNI + +#if defined(WOLF_CONF_TLS13) && WOLF_CONF_TLS13 == 1 + #define WOLFSSL_TLS13 + #define HAVE_HKDF +#endif +#if defined(WOLF_CONF_DTLS) && WOLF_CONF_DTLS == 1 + #define WOLFSSL_DTLS +#endif +#if defined(WOLF_CONF_DTLS13) && WOLF_CONF_DTLS13 == 1 + #define WOLFSSL_DTLS13 + #define WOLFSSL_SEND_HRR_COOKIE +#endif +#if defined(WOLF_CONF_PSK) && WOLF_CONF_PSK == 0 + #define NO_PSK +#endif +#if defined(WOLF_CONF_PWDBASED) && WOLF_CONF_PWDBASED == 0 + #define NO_PWDBASED +#endif +#if defined(WOLF_CONF_KEEP_PEER_CERT) && WOLF_CONF_KEEP_PEER_CERT == 1 + #define KEEP_PEER_CERT +#endif +#if defined(WOLF_CONF_BASE64_ENCODE) && WOLF_CONF_BASE64_ENCODE == 1 + #define WOLFSSL_BASE64_ENCODE +#endif +#if defined(WOLF_CONF_OPENSSL_EXTRA) && WOLF_CONF_OPENSSL_EXTRA >= 1 + #define OPENSSL_EXTRA + #if !defined(INT_MAX) + #include + #endif +#endif +#if defined(WOLF_CONF_OPENSSL_EXTRA) && WOLF_CONF_OPENSSL_EXTRA >= 2 + #define OPENSSL_ALL +#endif + +/* TLS Session Cache */ +#if defined(WOLF_CONF_RESUMPTION) && WOLF_CONF_RESUMPTION == 1 + #define SMALL_SESSION_CACHE + #define HAVE_SESSION_TICKET +#else + #define NO_SESSION_CACHE +#endif + +/* TPM support */ +#if defined(WOLF_CONF_TPM) && WOLF_CONF_TPM == 1 + #define WOLF_CRYPTO_CB + #define WOLFSSL_PUBLIC_MP + /* also AES CFB - enabled below */ +#endif + +/* TLS key callbacks */ +#if defined(WOLF_CONF_PK) && WOLF_CONF_PK == 1 + #define HAVE_PK_CALLBACKS +#endif + +/* ------------------------------------------------------------------------- */ +/* Crypto */ +/* ------------------------------------------------------------------------- */ +/* RSA */ +#undef NO_RSA +#if defined(WOLF_CONF_RSA) && WOLF_CONF_RSA == 1 + /* half as much memory but twice as slow */ + #undef RSA_LOW_MEM + //#define RSA_LOW_MEM + + /* Enables blinding mode, to prevent timing attacks */ + #undef WC_RSA_BLINDING + #define WC_RSA_BLINDING + + /* RSA PSS Support (required for TLS v1.3) */ + #ifdef WOLFSSL_TLS13 + #define WC_RSA_PSS + #endif +#else + #define NO_RSA +#endif + +/* ECC */ +#undef HAVE_ECC +#if defined(WOLF_CONF_ECC) && WOLF_CONF_ECC == 1 + #define HAVE_ECC + + /* Manually define enabled curves */ + #define ECC_USER_CURVES + + //#define HAVE_ECC192 + //#define HAVE_ECC224 + #undef NO_ECC256 + //#define HAVE_ECC384 + //#define HAVE_ECC521 + + /* Fixed point cache (speeds repeated operations against same private key) */ + #undef FP_ECC + //#define FP_ECC + #ifdef FP_ECC + /* Bits / Entries */ + #undef FP_ENTRIES + #define FP_ENTRIES 2 + #undef FP_LUT + #define FP_LUT 4 + #endif + + /* Optional ECC calculation method */ + /* Note: doubles heap usage, but slightly faster */ + #undef ECC_SHAMIR + #define ECC_SHAMIR + + /* Reduces heap usage, but slower */ + #define ECC_TIMING_RESISTANT + + /* Compressed ECC key support */ + //#define HAVE_COMP_KEY + + #ifdef USE_FAST_MATH + #if defined(NO_RSA) && defined(NO_DH) + /* Custom fastmath size if not using RSA/DH */ + /* MAX = ROUND32(ECC BITS) * 2 */ + #define FP_MAX_BITS (256 * 2) + #else + #define ALT_ECC_SIZE + #endif + + /* Enable TFM optimizations for ECC */ + //#define TFM_ECC192 + //#define TFM_ECC224 + //#define TFM_ECC256 + //#define TFM_ECC384 + //#define TFM_ECC521 + #endif +#endif + +/* DH */ +#undef NO_DH +#if defined(WOLF_CONF_DH) && WOLF_CONF_DH == 1 + #define HAVE_DH /* freeRTOS settings.h requires this */ + #define HAVE_FFDHE_2048 + #define HAVE_DH_DEFAULT_PARAMS +#else + #define NO_DH +#endif + +/* AES */ +#if defined(WOLF_CONF_AESGCM) && WOLF_CONF_AESGCM >= 1 + #define HAVE_AESGCM + #define HAVE_AES_DECRYPT + + /* GCM Method: GCM_SMALL, GCM_WORD32, GCM_TABLE or GCM_TABLE_4BIT */ + /* GCM_TABLE is about 4K larger and 3x faster for GHASH */ + #if WOLF_CONF_AESGCM == 2 + #define GCM_TABLE_4BIT + #else + #define GCM_SMALL + #endif +#endif + +#if defined(WOLF_CONF_AESCBC) && WOLF_CONF_AESCBC == 1 + #define HAVE_AES_CBC + #define HAVE_AES_DECRYPT +#else + #define NO_AES_CBC +#endif + +/* Other possible AES modes */ +#if defined(WOLF_CONF_TPM) && WOLF_CONF_TPM == 1 + #define WOLFSSL_AES_CFB /* Used by TPM parameter encryption */ +#endif + +//#define WOLFSSL_AES_COUNTER +//#define HAVE_AESCCM +//#define WOLFSSL_AES_XTS +//#define WOLFSSL_AES_DIRECT +//#define HAVE_AES_ECB +//#define HAVE_AES_KEYWRAP +//#define AES_MAX_KEY_SIZE 256 + +/* ChaCha20 / Poly1305 */ +#undef HAVE_CHACHA +#undef HAVE_POLY1305 +#if defined(WOLF_CONF_CHAPOLY) && WOLF_CONF_CHAPOLY == 1 + #define HAVE_CHACHA + #define HAVE_POLY1305 + + /* Needed for Poly1305 */ + #undef HAVE_ONE_TIME_AUTH + #define HAVE_ONE_TIME_AUTH +#endif + +/* Ed25519 / Curve25519 */ +#undef HAVE_CURVE25519 +#undef HAVE_ED25519 +#if defined(WOLF_CONF_EDCURVE25519) && WOLF_CONF_EDCURVE25519 == 1 + #define HAVE_CURVE25519 + #define HAVE_ED25519 + + /* Optionally use small math (less flash usage, but much slower) */ + #define CURVED25519_SMALL +#endif + +/* ------------------------------------------------------------------------- */ +/* Hashing */ +/* ------------------------------------------------------------------------- */ +/* Sha1 */ +#undef NO_SHA +#if defined(WOLF_CONF_SHA1) && WOLF_CONF_SHA1 == 1 + /* 1k smaller, but 25% slower */ + //#define USE_SLOW_SHA +#else + #define NO_SHA +#endif + +/* Sha2-256 */ +#undef NO_SHA256 +#if defined(WOLF_CONF_SHA2_256) && WOLF_CONF_SHA2_256 == 1 + /* not unrolled - ~2k smaller and ~25% slower */ + //#define USE_SLOW_SHA256 + + //#define WOLFSSL_SHAKE256 + + /* Sha2-224 */ + #if defined(WOLF_CONF_SHA2_224) && WOLF_CONF_SHA2_224 == 1 + #define WOLFSSL_SHA224 + #endif +#else + #define NO_SHA256 +#endif + +/* Sha2-512 */ +#undef WOLFSSL_SHA512 +#if defined(WOLF_CONF_SHA2_512) && WOLF_CONF_SHA2_512 == 1 + /* over twice as small, but 50% slower */ + //#define USE_SLOW_SHA512 + + #define WOLFSSL_SHA512 + #define HAVE_SHA512 /* old freeRTOS settings.h requires this */ +#endif + +/* Sha2-384 */ +#undef WOLFSSL_SHA384 +#if defined(WOLF_CONF_SHA2_384) && WOLF_CONF_SHA2_384 == 1 + #define WOLFSSL_SHA384 +#endif + +/* Sha3 */ +#undef WOLFSSL_SHA3 +#if defined(WOLF_CONF_SHA3) && WOLF_CONF_SHA3 == 1 + #define WOLFSSL_SHA3 +#endif + +/* MD5 */ +#if defined(WOLF_CONF_MD5) && WOLF_CONF_MD5 == 1 + /* enabled */ +#else + #define NO_MD5 +#endif + +/* ------------------------------------------------------------------------- */ +/* Post-Quantum Crypto */ +/* ------------------------------------------------------------------------- */ +/* NOTE: this is after the hashing section to override the potential SHA3 undef + * above. */ +#if defined(WOLF_CONF_KYBER) && WOLF_CONF_KYBER == 1 + #undef WOLFSSL_EXPERIMENTAL_SETTINGS + #define WOLFSSL_EXPERIMENTAL_SETTINGS + + #undef WOLFSSL_HAVE_MLKEM + #define WOLFSSL_HAVE_MLKEM + + #undef WOLFSSL_WC_MLKEM + #define WOLFSSL_WC_MLKEM + + #undef WOLFSSL_NO_SHAKE128 + #undef WOLFSSL_SHAKE128 + #define WOLFSSL_SHAKE128 + + #undef WOLFSSL_NO_SHAKE256 + #undef WOLFSSL_SHAKE256 + #define WOLFSSL_SHAKE256 + + #undef WOLFSSL_SHA3 + #define WOLFSSL_SHA3 +#endif /* WOLF_CONF_KYBER */ + +/* ------------------------------------------------------------------------- */ +/* Crypto Acceleration */ +/* ------------------------------------------------------------------------- */ +/* This enables inline assembly speedups for SHA2, SHA3, AES, + * ChaCha20/Poly1305 and Ed/Curve25519. These settings work for Cortex M4/M7 + * and the source code is located in wolfcrypt/src/port/arm/ + */ +#if defined(WOLF_CONF_ARMASM) && WOLF_CONF_ARMASM == 1 + #define WOLFSSL_ARMASM + #define WOLFSSL_ARMASM_INLINE + #define WOLFSSL_ARMASM_NO_HW_CRYPTO + #define WOLFSSL_ARMASM_NO_NEON + #define WOLFSSL_ARMASM_THUMB2 + #define WOLFSSL_ARM_ARCH 7 + /* Disable H/W offloading if accelerating S/W crypto */ + #undef NO_STM32_HASH + #define NO_STM32_HASH + #undef NO_STM32_CRYPTO + #define NO_STM32_CRYPTO +#endif + +/* ------------------------------------------------------------------------- */ +/* Benchmark / Test */ +/* ------------------------------------------------------------------------- */ +/* Use reduced benchmark / test sizes */ +#define BENCH_EMBEDDED +#define USE_CERT_BUFFERS_2048 +#define USE_CERT_BUFFERS_256 + +/* ------------------------------------------------------------------------- */ +/* Debugging */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLF_CONF_DEBUG) && WOLF_CONF_DEBUG == 1 + #define DEBUG_WOLFSSL + + /* Use this to measure / print heap usage */ + #if 0 + #define USE_WOLFSSL_MEMORY + #define WOLFSSL_TRACK_MEMORY + #define WOLFSSL_DEBUG_MEMORY + #define WOLFSSL_DEBUG_MEMORY_PRINT + #endif +#else + //#define NO_WOLFSSL_MEMORY + //#define NO_ERROR_STRINGS +#endif + +/* ------------------------------------------------------------------------- */ +/* Port */ +/* ------------------------------------------------------------------------- */ + +/* Override Current Time */ +/* Allows custom "custom_time()" function to be used for benchmark */ +#define WOLFSSL_USER_CURRTIME + +/* ------------------------------------------------------------------------- */ +/* RNG */ +/* ------------------------------------------------------------------------- */ +#define NO_OLD_RNGNAME /* conflicts with STM RNG macro */ +#if !defined(WOLF_CONF_RNG) || WOLF_CONF_RNG == 1 + /* default is enabled */ + #define HAVE_HASHDRBG +#else /* WOLF_CONF_RNG == 0 */ + #define WC_NO_HASHDRBG + #define WC_NO_RNG +#endif + +/* ------------------------------------------------------------------------- */ +/* Disable Features */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLF_CONF_TLS12) && WOLF_CONF_TLS12 == 0 + #define WOLFSSL_NO_TLS12 +#endif +#if defined(WOLF_CONF_WOLFCRYPT_ONLY) && WOLF_CONF_WOLFCRYPT_ONLY == 1 + #define WOLFCRYPT_ONLY +#endif +//#define NO_WOLFSSL_SERVER +//#define NO_WOLFSSL_CLIENT + +#if defined(WOLF_CONF_TEST) && WOLF_CONF_TEST == 0 + #define NO_CRYPT_TEST + #define NO_CRYPT_BENCHMARK +#endif + +#define NO_FILESYSTEM +#define NO_WRITEV +#define NO_MAIN_DRIVER +#define NO_DEV_RANDOM +#define NO_OLD_TLS +#define WOLFSSL_NO_CLIENT_AUTH /* disable client auth for Ed25519/Ed448 */ + +#define NO_DSA +#define NO_RC4 +#define NO_MD4 +#define NO_DES3 + +#ifndef WOLFSSL_SHAKE128 +#define WOLFSSL_NO_SHAKE128 +#endif + +#ifndef WOLFSSL_SHAKE256 +#define WOLFSSL_NO_SHAKE256 +#endif + +/* In-lining of misc.c functions */ +/* If defined, must include wolfcrypt/src/misc.c in build */ +/* Slower, but about 1k smaller */ +//#define NO_INLINE + +/* Base16 / Base64 encoding */ +//#define NO_CODING + +/* The STM32CubeMX2 flow has no RTC integration yet, so there is no trusted + * time source and certificate date validation is bypassed. Wire XTIME to a + * real clock and define WOLF_CONF_ASN_TIME to enforce certificate dates. */ +#ifndef WOLF_CONF_ASN_TIME + #define NO_ASN_TIME +#endif + +#ifdef __cplusplus +} +#endif +#endif /* __MX_WOLFSSL_CONF_H__ */ + +/** + * @} + */ + +/*****END OF FILE****/ diff --git a/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json b/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json new file mode 100644 index 0000000000..6706c35bb6 --- /dev/null +++ b/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json @@ -0,0 +1,342 @@ +{ + "componentid": "::Security:STM32CubeMX2 Config:wolfSSL", + "type": "object", + "grammarVersion": "3.3", + "properties": { + "parameters": { + "type": "object", + "properties": { + "info": { + "title": "wolfSSL configuration", + "type": "object", + "properties": { + "label": { + "type": "string", + "title": "User Label", + "description": "Adds extra #define in generated code", + "default": "MX_WOLFSSL", + "pattern": "^([A-Z_][A-Z0-9_]{1,31})?$", + "unique": "project", + "unicityTag": "middlewares_wolfssl_sw_label", + "minLength": 3, + "maxLength": 15 + } + } + }, + "basic_config": { + "title": "Basic configuration", + "type": "object", + "properties": { + "debugSupport": { + "type": "boolean", + "title": "Debug support", + "description": "Enable debug support", + "default": false + }, + "wolfCryptOnly": { + "type": "boolean", + "title": "wolfCrypt Only", + "description": "Enable wolfCrypt only", + "default": false + }, + "tlsV13": { + "type": "boolean", + "title": "TLS v1.3", + "description": "Enable TLS v1.3", + "default": true + }, + "tlsV12": { + "type": "boolean", + "title": "TLS v1.2", + "description": "Enable TLS v1.2", + "default": true + }, + "dtlsSupport": { + "type": "boolean", + "title": "DTLS Support", + "description": "Enable DTLS support", + "default": false + }, + "mathConfiguration": { + "type": "string", + "title": "Math configuration", + "description": "Configure math", + "default": "6", + "oneOf": [ + { + "const": "1", + "title": "Fast (stack) math" + }, + { + "const": "2", + "title": "Normal (heap) math" + }, + { + "const": "3", + "title": "Single Precision C math (only common curves/key sizes)" + }, + { + "const": "4", + "title": "Single Precision ASM Cortex-M3+ Math" + }, + { + "const": "5", + "title": "Single Precision ASM Cortex-M0 (Generic Thumb) Math" + }, + { + "const": "6", + "title": "Single Precision C all small" + }, + { + "const": "7", + "title": "Single Precision C all big" + } + ] + }, + "rtos": { + "type": "string", + "title": "RTOS", + "description": "Configure RTOS", + "default": "1", + "oneOf": [ + { + "const": "1", + "title": "Single Threaded (no RTOS / Baremetal)" + }, + { + "const": "2", + "title": "FreeRTOS" + } + ] + }, + "rngSupport": { + "type": "boolean", + "title": "RNG Support", + "description": "Enable RNG support", + "default": true + }, + "rsaSupport": { + "type": "boolean", + "title": "RSA Support", + "description": "Enable RSA support", + "default": true + }, + "eccSupport": { + "type": "boolean", + "title": "ECC Support", + "description": "Enable ECC support", + "default": true + }, + "dhSupport": { + "type": "boolean", + "title": "DH (Diffie-Hellman) Support", + "description": "Enable DH support", + "default": true + }, + "aesGCMSupport": { + "type": "string", + "title": "AES GCM Support", + "description": "Configure AES GCM support", + "default": "1", + "oneOf": [ + { + "const": "0", + "title": "Disabled" + }, + { + "const": "1", + "title": "GCM_SMALL" + }, + { + "const": "2", + "title": "GCM_TABLE_4BIT" + } + ] + }, + "aesCBCSupport": { + "type": "boolean", + "title": "AES CBC Support", + "description": "Enable AES CBC support", + "default": false + }, + "chaCha20Support": { + "type": "boolean", + "title": "ChaCha20 / Poly1305 Support", + "description": "Enable ChaCha20 / Poly1305 support", + "default": true + }, + "ed25519Support": { + "type": "boolean", + "title": "Ed25519 / Curve25519 Support", + "description": "Enable Ed25519 / Curve25519 support", + "default": false + }, + "md5Support": { + "type": "boolean", + "title": "MD5 Support", + "description": "Enable MD5 support", + "default": false + }, + "sha1Support": { + "type": "boolean", + "title": "SHA1 Support", + "description": "Enable SHA1 support", + "default": false + }, + "sha2_224Support": { + "type": "boolean", + "title": "SHA2-224 Support", + "description": "Enable SHA2-224 support", + "default": false + }, + "sha2_256Support": { + "type": "boolean", + "title": "SHA2-256 Support", + "description": "Enable SHA2-256 support", + "default": true + }, + "sha2_384Support": { + "type": "boolean", + "title": "SHA2-384 Support", + "description": "Enable SHA2-384 support", + "default": false + }, + "sha2_512Support": { + "type": "boolean", + "title": "SHA2-512 Support", + "description": "Enable SHA2-512 support", + "default": false + }, + "sha3Support": { + "type": "boolean", + "title": "SHA3 Support", + "description": "Enable SHA3 support", + "default": false + }, + "preSharedKeySupport": { + "type": "boolean", + "title": "Pre-Shared-Key Support", + "description": "Enable Pre-Shared-Key support", + "default": false + }, + "pwdBasedKeyDerivationSupport": { + "type": "boolean", + "title": "Pwd Based Key Derivation Support", + "description": "Enable Pwd Based Key Derivation support", + "default": false + }, + "keepPeerCertSupport": { + "type": "boolean", + "title": "Keep Peer Cert Support", + "description": "Enable Keep Peer Cert support", + "default": false + }, + "base64EncodeSupport": { + "type": "boolean", + "title": "Base64 Encode Support", + "description": "Enable Base64 Encode support", + "default": false + }, + "openSSLExtraSupport": { + "type": "string", + "title": "OpenSSL Extra Support", + "description": "Configure OpenSSL Extra support", + "default": "0", + "oneOf": [ + { + "const": "0", + "title": "Disabled" + }, + { + "const": "1", + "title": "Enable basic (OPENSSL_EXTRA)" + }, + { + "const": "2", + "title": "Enable all (OPENSSL_ALL)" + } + ] + }, + "wolfCryptTestBenchmarkSupport": { + "type": "boolean", + "title": "WolfCrypt Test / Benchmark Support", + "description": "Enable WolfCrypt Test / Benchmark support", + "default": true + }, + "kyberMLKemSupport": { + "type": "boolean", + "title": "KYBER / ML-KEM Post-Quantum Algorithm Support", + "description": "Enable KYBER / ML-KEM Post-Quantum Algorithm support", + "default": false + }, + "dtls13Support": { + "type": "boolean", + "title": "DTLS v1.3 Support", + "description": "Enable DTLS v1.3 (requires DTLS Support and TLS v1.3)", + "default": false + }, + "hwCrypto": { + "type": "boolean", + "title": "STM32 Hardware Crypto", + "description": "Use the STM32 hardware crypto peripherals (RNG, HASH, AES, PKA) where the selected device has wolfSSL support; software fallback otherwise", + "default": true + }, + "consoleUart": { + "type": "string", + "title": "Console UART instance", + "description": "Lowercase UART instance the wolfCrypt test/benchmark console uses (matches the STM32CubeMX2 UART user label, e.g. usart2); the generated handle getter mx__uart_gethandle() must exist", + "default": "usart2", + "pattern": "^[a-z0-9_]{3,16}$", + "minLength": 3, + "maxLength": 16 + }, + "armASMSupport": { + "type": "boolean", + "title": "ARM ASM Support", + "description": "Enable ARM ASM support", + "default": false + }, + "ioInterfaceConfig": { + "type": "string", + "title": "IO Interface Configuration", + "description": "Configure IO Interface", + "default": "1", + "oneOf": [ + { + "const": "1", + "title": "User IO" + }, + { + "const": "2", + "title": "LWIP (posix API)" + }, + { + "const": "3", + "title": "LWIP (native API)" + } + ] + }, + "sessionCacheSupport": { + "type": "boolean", + "title": "Session cache / Session tickets Support", + "description": "Enable Session cache / Session tickets support", + "default": false + }, + "tpmSupport": { + "type": "boolean", + "title": "TPM Support", + "description": "Enable TPM support", + "default": false + }, + "tlsKeyCallbacksSupport": { + "type": "boolean", + "title": "TLS Key Callbacks Support", + "description": "Enable TLS Key Callbacks support", + "default": false + } + } + } + } + } + } +} \ No newline at end of file diff --git a/IDE/STM32Cube/wolfssl_example.c b/IDE/STM32Cube/wolfssl_example.c index 2edefd727d..ac1c94d862 100644 --- a/IDE/STM32Cube/wolfssl_example.c +++ b/IDE/STM32Cube/wolfssl_example.c @@ -117,10 +117,21 @@ /* This sets which UART to use for the console. It is something you will have * to configure in STMCubeIDE and then change here. */ +#ifdef WOLF_CONF_CONSOLE_UART_GETHANDLE +/* STM32CubeMX2 (HAL2): the generated configuration selects the console UART + * through the MX2 handle getter (mx__uart_gethandle(), declared by + * mx_hal_def.h), so no HAL1-style extern handle exists. HAL2 also renames + * the status type (HAL_OK and friends are unchanged). */ +#include "mx_hal_def.h" +#undef HAL_CONSOLE_UART +#define HAL_CONSOLE_UART (*WOLF_CONF_CONSOLE_UART_GETHANDLE()) +typedef hal_status_t HAL_StatusTypeDef; /* HAL2 renames the status type */ +#else #ifndef HAL_CONSOLE_UART #define HAL_CONSOLE_UART huart4 #endif extern UART_HandleTypeDef HAL_CONSOLE_UART; +#endif /***************************************************************************** * Public types/enumerations/variables @@ -1833,8 +1844,40 @@ double current_time(void) return ((double) time.Hours * 3600) + ((double) time.Minutes * 60) + (double) time.Seconds + ((double) subsec / 1000); } +#else +/* No HAL RTC (e.g. STM32CubeMX2 / HAL2 projects): use the millisecond tick */ +double current_time(void) +{ + return (double)HAL_GetTick() / 1000.0; +} #endif /* HAL_RTC_MODULE_ENABLED */ +#ifdef WOLF_CONF_CONSOLE_UART_GETHANDLE +/* printf retargeting for STM32CubeMX2 projects, routed to the console UART. + * Both are weak or toolchain-specific so a project-provided version wins. */ +#if defined(__ICCARM__) +size_t __write(int handle, const unsigned char* buf, size_t bufSize) +{ + size_t i; + (void)handle; + for (i = 0; i < bufSize; i++) { + (void)HAL_UART_Transmit(&HAL_CONSOLE_UART, (uint8_t*)&buf[i], 1, + 0xFFFF); + } + return bufSize; +} +#elif defined(__GNUC__) +/* The STM32CubeMX2 syscalls utility routes newlib _write() to the weak + * __io_putchar() hook; implementing the hook is the intended retarget. */ +int __io_putchar(int ch) +{ + uint8_t c = (uint8_t)ch; + (void)HAL_UART_Transmit(&HAL_CONSOLE_UART, &c, 1, 0xFFFF); + return ch; +} +#endif +#endif /* WOLF_CONF_CONSOLE_UART_GETHANDLE */ + #ifdef CMSIS_OS2_H_ void wolfCryptDemo(void* argument) #else diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index 663c5d010a..862c5b13c7 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -356,6 +356,19 @@ #endif #endif +/* Probe for the STM32CubeMX2 generated configuration ahead of the chain + * below. __has_include must stay inside its own guarded block: preprocessors + * without it would otherwise fail parsing the #elif expression (the header + * name string is illegal in an integer constant expression), which the + * defined() short-circuit does not prevent. */ +#if !defined(HAVE_CONFIG_H) && !defined(WOLFSSL_USER_SETTINGS) && \ + !defined(WOLFSSL_OPTIONS_H) && !defined(WOLFSSL_NO_OPTIONS_H) && \ + !defined(WOLFSSL_CUSTOM_CONFIG) && defined(__has_include) + #if __has_include("mx_wolfSSL_conf.h") + #define WOLFSSL_MX2_CONF_INCLUDE + #endif +#endif + #ifdef WOLFSSL_USER_SETTINGS #if defined(BUILDING_WOLFSSL_ASM) && defined(WOLFSSL_USER_SETTINGS_ASM) /* @@ -377,6 +390,11 @@ #elif defined(USE_HAL_DRIVER) && !defined(HAVE_CONFIG_H) /* STM Configuration File (generated by CubeMX) */ #include "wolfSSL.I-CUBE-wolfSSL_conf.h" +#elif defined(WOLFSSL_MX2_CONF_INCLUDE) + /* STM Configuration File (generated by STM32CubeMX2). HAL2 projects + * have no global define like HAL1's USE_HAL_DRIVER, so the probe + * above detects the generated configuration header itself. */ + #include "mx_wolfSSL_conf.h" #elif defined(NUCLEUS_PLUS_2_3) /* NOTE: cyassl_nucleus_defs.h is akin to user_settings.h */ #include "nucleus.h"