Skip to content

Commit b5fab30

Browse files
mattia-moffamattia-moffa
committed
Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ
1 parent 5222385 commit b5fab30

19 files changed

Lines changed: 55 additions & 48 deletions

File tree

‎CMakeLists.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -696,14 +696,14 @@ if(ARCH STREQUAL "ARM")
696696
list(APPEND WOLFBOOT_COMPILE_OPTIONS -mcmse)
697697
list(APPEND WOLFBOOT_LINK_OPTIONS -mcmse)
698698
endif()
699+
list(APPEND WOLFBOOT_LINK_OPTIONS
700+
-Wl,--cmse-implib
701+
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wolfboot_tz_nsc.o)
699702

700703
# wolfCrypt TrustZone secure mode
701704
if(WOLFCRYPT_TZ)
702705
list(APPEND WOLFBOOT_DEFS WOLFCRYPT_SECURE_MODE)
703706
list(APPEND WOLFBOOT_SOURCES src/wc_callable.c)
704-
list(APPEND WOLFBOOT_LINK_OPTIONS
705-
-Wl,--cmse-implib
706-
-Wl,--out-implib=${CMAKE_CURRENT_BINARY_DIR}/wc_secure_calls.o)
707707

708708
# PKCS11 TrustZone interface
709709
if(WOLFCRYPT_TZ_PKCS11)

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -562,7 +562,7 @@ keys: $(PRIVATE_KEY)
562562

563563
clean:
564564
$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
565-
$(Q)rm -f src/wc_secure_calls.o
565+
$(Q)rm -f src/wolfboot_tz_nsc.o
566566
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
567567
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
568568
$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec

‎arch.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,13 +360,13 @@ else
360360
OBJS+=hal/stm32_tz.o
361361
endif
362362
CFLAGS+=-mcmse
363+
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wolfboot_tz_nsc.o
363364
ifeq ($(WOLFCRYPT_TZ),1)
364365
CORTEXM_ARM_EXTRA_OBJS=
365366
CORTEXM_ARM_EXTRA_CFLAGS=
366367
SECURE_OBJS+=./src/wc_callable.o
367368
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
368369
CFLAGS+=-DWOLFCRYPT_SECURE_MODE
369-
SECURE_LDFLAGS+=-Wl,--cmse-implib -Wl,--out-implib=./src/wc_secure_calls.o
370370
endif
371371
endif # TZEN=1
372372
ifeq ($(SPMATH),1)

‎cmake/wolfboot.cmake‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ function(gen_wolfboot_platform_target PLATFORM_NAME LINKER_SCRIPT_TARGET)
5252
${LINKER_SCRIPT_TARGET})
5353

5454
# TrustZone import library (generated by the linker via --out-implib)
55-
if(TZEN AND WOLFCRYPT_TZ)
56-
set(_wcs_implib "${CMAKE_BINARY_DIR}/wc_secure_calls.o")
55+
if(TZEN)
56+
set(_wcs_implib "${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o")
5757
add_custom_command(TARGET wolfboot_${PLATFORM_NAME} POST_BUILD
5858
BYPRODUCTS "${_wcs_implib}"
5959
COMMAND ${CMAKE_COMMAND} -E true

‎docs/API.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ secure domain. For this purpose, wolfBoot provides Non-Secure Callable (NSC)
7878
APIs that allow code running in the non-secure domain to call into the secure
7979
domain managed by wolfBoot.
8080

81+
When `TZEN=1` is enabled, these APIs are available to non-secure applications.
82+
8183
These APIs are listed below.
8284

8385
- `void wolfBoot_nsc_success(void)`: wrapper for `wolfBoot_success()`

‎include/wolfboot/wolfboot.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -588,7 +588,7 @@ int wolfBoot_set_encrypt_key(const uint8_t *key, const uint8_t *nonce);
588588
int wolfBoot_get_encrypt_key(uint8_t *key, uint8_t *nonce);
589589
int wolfBoot_erase_encrypt_key(void);
590590

591-
#if !defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
591+
#if !defined(__WOLFBOOT) && defined(TZEN)
592592

593593
/* Applications can access update success/trigger and flash erase/write
594594
* via non-secure callable, to facilitate updates
@@ -627,7 +627,7 @@ int wolfBoot_nsc_erase_update(uint32_t address, uint32_t len);
627627
CSME_NSE_API
628628
int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len);
629629

630-
#endif /* !__WOLFBOOT && WOLFCRYPT_SECURE_MODE */
630+
#endif /* !__WOLFBOOT && TZEN */
631631

632632

633633
#ifdef __cplusplus

‎src/libwolfboot.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2354,7 +2354,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
23542354
#endif /* MMU */
23552355
#endif /* EXT_ENCRYPTED */
23562356

2357-
#if defined(__WOLFBOOT) && defined(WOLFCRYPT_SECURE_MODE)
2357+
#if defined(__WOLFBOOT) && defined(TZEN)
23582358
CSME_NSE_API
23592359
void wolfBoot_nsc_success(void)
23602360
{
@@ -2410,4 +2410,4 @@ int wolfBoot_nsc_write_update(uint32_t address, const uint8_t *buf, uint32_t len
24102410
return ret;
24112411
}
24122412

2413-
#endif
2413+
#endif /* __WOLFBOOT && TZEN */

‎test-app/CMakeLists.txt‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ if(BUILD_TEST_APPS)
176176
target_include_directories(image PRIVATE ../lib/wolfPKCS11)
177177
endif()
178178

179-
# For TrustZone builds, avoid linking the bootloader lib (it defines NSC stubs).
179+
# wolfCrypt TrustZone test builds provide extra secure-call wrappers directly.
180180
if(TZEN AND WOLFCRYPT_TZ)
181181
target_sources(image PRIVATE ../src/libwolfboot.c)
182182
if(NOT SIGN STREQUAL "NONE")
@@ -189,11 +189,15 @@ if(BUILD_TEST_APPS)
189189
target_link_libraries(image PRIVATE wolfboot wolfboothal public_key target)
190190
endif()
191191

192-
# For TrustZone builds, the test app is a non-secure application
193-
if(TZEN AND WOLFCRYPT_TZ)
194-
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP WOLFBOOT_SECURE_CALLS)
192+
# For TrustZone builds, the test app is a non-secure application and links
193+
# the CMSE import library generated from the secure bootloader veneers.
194+
if(TZEN)
195+
list(APPEND TEST_APP_COMPILE_DEFINITIONS NONSECURE_APP)
195196
add_dependencies(image wolfboot_${PLATFORM_NAME})
196-
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wc_secure_calls.o)
197+
target_link_libraries(image PRIVATE ${CMAKE_BINARY_DIR}/wolfboot_tz_nsc.o)
198+
endif()
199+
if(TZEN AND WOLFCRYPT_TZ)
200+
list(APPEND TEST_APP_COMPILE_DEFINITIONS WOLFBOOT_SECURE_CALLS)
197201
endif()
198202

199203
if(WOLFCRYPT_TZ_PKCS11)

‎test-app/Makefile‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -218,9 +218,9 @@ ifeq ($(TZEN),1)
218218
CFLAGS+=-DNONSECURE_APP
219219
CFLAGS+=-I./
220220
APP_OBJS+=../hal/$(TARGET)_ns.o
221+
APP_OBJS+=../src/wolfboot_tz_nsc.o
221222
ifeq ($(WOLFCRYPT_TZ),1)
222223
CFLAGS+=-I"$(WOLFBOOT_LIB_WOLFSSL)"
223-
APP_OBJS+=../src/wc_secure_calls.o
224224
WOLFCRYPT_APP_OBJS+=\
225225
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.o \
226226
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hash.o \
@@ -244,11 +244,6 @@ ifeq ($(TZEN),1)
244244
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wolfentropy.o \
245245
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o \
246246
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/wc_encrypt.o
247-
ifeq ($(TEST_APP_NO_RNG),1)
248-
CFLAGS+=-DWC_NO_RNG
249-
else
250-
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
251-
endif
252247
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
253248
CFLAGS+=-DWOLFSSL_USER_SETTINGS -DWOLFTPM_USER_SETTINGS
254249
CFLAGS+=-DWOLFBOOT_PKCS11_APP -DSECURE_PKCS11 -DWOLFBOOT_TZ_PKCS11
@@ -287,6 +282,12 @@ ifeq ($(TZEN),1)
287282
APP_OBJS+=./wcs/sp_cortexm.o
288283
endif
289284
endif
285+
else
286+
ifeq ($(TEST_APP_NO_RNG),1)
287+
CFLAGS+=-DWC_NO_RNG
288+
else
289+
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
290+
endif
290291
endif
291292
CFLAGS+=-DWOLFBOOT_SECURE_CALLS -Wstack-usage=19184
292293
LDFLAGS+=--specs=nosys.specs -u _printf_float

‎test-app/app_mcxn.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ void main(void)
8383

8484
hal_init();
8585

86-
#ifdef WOLFCRYPT_SECURE_MODE
86+
#ifdef TZEN
8787
boot_ver = wolfBoot_nsc_current_firmware_version();
8888
#else
8989
boot_ver = wolfBoot_current_firmware_version();
@@ -107,7 +107,7 @@ void main(void)
107107
/* Blue off */
108108
gpio_init_output(GPIO1, PORT1, kCLOCK_Gpio1, kCLOCK_Port1, 2U, 1U);
109109

110-
#ifdef WOLFCRYPT_SECURE_MODE
110+
#ifdef TZEN
111111
wolfBoot_nsc_success();
112112
#else
113113
wolfBoot_success();

0 commit comments

Comments
 (0)