Skip to content

Commit 4ff0e0a

Browse files
authored
Merge pull request #662 from danielinux/zephyr-psa
zephyr integration as TEE.
2 parents 12d7f0a + 087a51e commit 4ff0e0a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+5891
-13
lines changed

.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,6 @@
1010
[submodule "lib/wolfHSM"]
1111
path = lib/wolfHSM
1212
url = https://github.com/wolfssl/wolfhsm.git
13+
[submodule "lib/wolfPSA"]
14+
path = lib/wolfPSA
15+
url = [email protected]:wolfSSL/wolfPSA.git

Makefile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,18 +140,21 @@ endif
140140
WOLFBOOT_LIB_WOLFSSL?=lib/wolfssl
141141
WOLFBOOT_LIB_WOLFTPM?=lib/wolfTPM
142142
WOLFBOOT_LIB_WOLFPKCS11?=lib/wolfPKCS11
143+
WOLFBOOT_LIB_WOLFPSA?=lib/wolfPSA
143144
WOLFBOOT_LIB_WOLFHSM?=lib/wolfHSM
144145

145146
# Convert to absolute paths using abspath function
146147
WOLFBOOT_LIB_WOLFSSL:=$(abspath $(WOLFBOOT_LIB_WOLFSSL))
147148
WOLFBOOT_LIB_WOLFTPM:=$(abspath $(WOLFBOOT_LIB_WOLFTPM))
148149
WOLFBOOT_LIB_WOLFPKCS11:=$(abspath $(WOLFBOOT_LIB_WOLFPKCS11))
150+
WOLFBOOT_LIB_WOLFPSA:=$(abspath $(WOLFBOOT_LIB_WOLFPSA))
149151
WOLFBOOT_LIB_WOLFHSM:=$(abspath $(WOLFBOOT_LIB_WOLFHSM))
150152

151153
# Export variables so they are available to sub-makefiles
152154
export WOLFBOOT_LIB_WOLFSSL
153155
export WOLFBOOT_LIB_WOLFTPM
154156
export WOLFBOOT_LIB_WOLFPKCS11
157+
export WOLFBOOT_LIB_WOLFPSA
155158
export WOLFBOOT_LIB_WOLFHSM
156159

157160
## Architecture/CPU configuration
@@ -169,6 +172,7 @@ CFLAGS+= \
169172
-Wno-array-bounds \
170173
-D"WOLFSSL_USER_SETTINGS" \
171174
-D"WOLFTPM_USER_SETTINGS"
175+
CFLAGS+=$(WOLFPSA_CFLAGS)
172176

173177
# Setup default optimizations (for GCC)
174178
ifeq ($(USE_GCC_HEADLESS),1)
Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
ARCH?=ARM
2+
TZEN?=1
3+
TARGET?=stm32h5
4+
SIGN?=ECC256
5+
HASH?=SHA256
6+
DEBUG?=0
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
EXT_FLASH?=0
13+
SPI_FLASH?=0
14+
ALLOW_DOWNGRADE?=0
15+
NVM_FLASH_WRITEONCE?=1
16+
WOLFBOOT_VERSION?=1
17+
V?=0
18+
SPMATH?=1
19+
RAM_CODE?=1
20+
DUALBANK_SWAP?=0
21+
WOLFBOOT_PARTITION_SIZE?=0xA0000
22+
WOLFBOOT_SECTOR_SIZE?=0x2000
23+
WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
24+
WOLFBOOT_KEYVAULT_SIZE?=0x1C000
25+
WOLFBOOT_NSC_ADDRESS?=0x0C05C000
26+
WOLFBOOT_NSC_SIZE?=0x4000
27+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
28+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
29+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
30+
FLAGS_HOME=0
31+
DISABLE_BACKUP=0
32+
WOLFCRYPT_TZ=1
33+
WOLFCRYPT_TZ_PSA=1
34+
IMAGE_HEADER_SIZE?=1024
35+
ARMORED=1

docs/STM32-TZ.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@ non-secure domain can access wolfCrypt through a standard PKCS11 interface and
2727
use the crypto library with pre-provisioned keys that are never exposed to the
2828
non-secure domain.
2929

30+
### PSA Crypto API in non-secure world
31+
32+
The `WOLFCRYPT_TZ_PSA` option provides a standard PSA Crypto interface using
33+
wolfPSA in the secure domain. The key storage uses the same secure flash
34+
keystore backend as PKCS11, exposed through the wolfPSA store API.
35+
3036
### Image header size
3137

3238
The `IMAGE_HEADER_SIZE` option has to be carefully tuned to accommodate for the

docs/Targets.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ SECWM2_STRT=0x1 SECWM2_END=0x0 No page of internal Flash Bank2 set as secure,
208208
This is similar to Scenario 1, but also includes wolfCrypt in secure mode, and
209209
that can be accessed via PKCS11 interface by non-secure applications.
210210

211-
This option can be enabled with the `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1`
211+
This option can be enabled with `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1` or `WOLFCRYPT_TZ_PSA=1`
212212
options in your configuration. This enables a PKCS11 accessible from NS domain via
213213
non-secure callables (NSC).
214214

@@ -349,7 +349,7 @@ SECWM2_STRT=0x1 SECWM2_END=0x0 No page of internal Flash Bank2 set as secure,
349349
This is similar to Scenario 1, but also includes wolfCrypt in secure mode, and
350350
that can be accessed via PKCS11 interface by non-secure applications.
351351

352-
This option can be enabled with the `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1`
352+
This option can be enabled with `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1` or `WOLFCRYPT_TZ_PSA=1`
353353
options in your configuration. This enables a PKCS11 accessible from NS domain via
354354
non-secure callables (NSC).
355355

@@ -1337,6 +1337,7 @@ SRAM memories into two parts:
13371337

13381338
The example configuration for this scenario is available in [/config/examples/stm32h5.config](/config/examples/stm32h5.config).
13391339

1340+
13401341
#### How to use it
13411342

13421343
- set the option bytes to enable trustzone:
@@ -1372,7 +1373,7 @@ STM32_Programmer_CLI -c port=swd -d update.bin 0x0C100000
13721373
This is similar to Scenario 1, but also includes wolfCrypt in secure mode, and
13731374
that can be accessed via PKCS11 interface by non-secure applications.
13741375

1375-
This option can be enabled with the `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1`
1376+
This option can be enabled with `WOLFCRYPT_TZ=1` and `WOLFCRYPT_TZ_PKCS11=1` or `WOLFCRYPT_TZ_PSA=1`
13761377
options in your configuration. This enables a PKCS11 accessible from NS domain via
13771378
non-secure callables (NSC).
13781379

@@ -1424,6 +1425,11 @@ STM32_Programmer_CLI -c port=swd -d test-app/image_v3_signed.bin 0x08160000
14241425
Reboot the board to initiate an update via DUALBANK hw-assisted swap.
14251426
Any version except the first one will also turn on the orange LED.
14261427

1428+
### Scenario 4: Replace TF-M with wolfBoot in Zephyr
1429+
1430+
For a full Zephyr integration walkthrough (build + flash), see:
1431+
[/zephyr/README.md](/zephyr/README.md)
1432+
14271433
### STM32H5 Debugging
14281434

14291435

docs/compile.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -354,6 +354,7 @@ Available overrides:
354354
- `WOLFBOOT_LIB_WOLFSSL`: Path to the [wolfSSL](https://github.com/wolfSSL/wolfssl) library source code
355355
- `WOLFBOOT_LIB_WOLFTPM`: Path to the [wolfTPM](https://github.com/wolfSSL/wolfTPM) library source code
356356
- `WOLFBOOT_LIB_WOLFPKCS11`: Path to the [wolfPKCS11](https://github.com/wolfssl/wolfpkcs11) library source code
357+
- `WOLFBOOT_LIB_WOLFPSA`: Path to the wolfPSA library source code
357358
- `WOLFBOOT_LIB_WOLFHSM`: Path to the [wolfHSM](https://github.com/wolfSSL/wolfHSM) library source code
358359

359360
## Key Generation and Signing

include/user_settings.h

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,32 @@ extern int tolower(int c);
367367
# define HAVE_AESGCM
368368
# define HAVE_PKCS8
369369
#endif
370+
371+
#if defined(WOLFCRYPT_TZ_PSA)
372+
# define WOLFSSL_AES_COUNTER
373+
# define WOLFSSL_AES_GCM
374+
# define HAVE_AESGCM
375+
# define HAVE_AESCCM
376+
# define HAVE_AES_ECB
377+
# define WOLFSSL_AES_CFB
378+
# define WOLFSSL_AES_OFB
379+
# define WOLFSSL_DES3
380+
# define WOLFSSL_DES_ECB
381+
# define HAVE_CHACHA
382+
# define HAVE_POLY1305
383+
# define WOLFSSL_CMAC
384+
# define WOLFSSL_ECDSA_DETERMINISTIC_K
385+
# define WOLFSSL_HAVE_PRF
386+
# define HAVE_HKDF
387+
# define HAVE_PBKDF2
388+
# define HAVE_PWDBASED
389+
# define WOLFSSL_KEY_GEN
390+
# define WC_RSA_PSS
391+
# define WOLFSSL_PSS_SALT_LEN_DISCOVER
392+
# define WOLFSSL_RSA_OAEP
393+
# define HAVE_ECC_KEY_EXPORT
394+
# define HAVE_ECC_KEY_IMPORT
395+
#endif
370396
/* PKCS11 for wolfBoot is always static */
371397
#define HAVE_PKCS11_STATIC
372398

@@ -502,6 +528,12 @@ extern int tolower(int c);
502528
#define NO_CRYPT_TEST
503529
#define NO_CRYPT_BENCHMARK
504530

531+
#if defined(WOLFCRYPT_TZ_PSA)
532+
#undef NO_CMAC
533+
#undef NO_DES3
534+
#undef NO_KDF
535+
#endif
536+
505537
#ifdef __QNX__
506538
# define WOLFSSL_HAVE_MIN
507539
# define WOLFSSL_HAVE_MAX
@@ -524,7 +556,8 @@ extern int tolower(int c);
524556
# define WOLFSSL_SP_NO_MALLOC
525557
# define WOLFSSL_SP_NO_DYN_STACK
526558
# endif
527-
# if !defined(SECURE_PKCS11) && !defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
559+
# if !defined(SECURE_PKCS11) && !defined(WOLFCRYPT_TZ_PSA) && \
560+
!defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
528561
# define NO_WOLFSSL_MEMORY
529562
# define WOLFSSL_NO_MALLOC
530563
# endif

include/wolfboot/arm_tee_api.h

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
/* arm_tee_api.h
2+
*
3+
* ARM TEE style PSA client veneers for Zephyr integration.
4+
*
5+
* Copyright (C) 2025 wolfSSL Inc.
6+
*
7+
* This file is part of wolfBoot.
8+
*
9+
* wolfBoot is free software; you can redistribute it and/or modify
10+
* it under the terms of the GNU General Public License as published by
11+
* the Free Software Foundation; either version 3 of the License, or
12+
* (at your option) any later version.
13+
*/
14+
15+
#ifndef WOLFBOOT_ARM_TEE_API_H
16+
#define WOLFBOOT_ARM_TEE_API_H
17+
18+
#include <stddef.h>
19+
#include <stdint.h>
20+
21+
#ifdef __cplusplus
22+
extern "C" {
23+
#endif
24+
25+
/* Provide minimal PSA client types if PSA client headers are unavailable. */
26+
#ifndef __PSA_CLIENT_H__
27+
typedef int32_t psa_handle_t;
28+
typedef struct psa_invec {
29+
const void *base;
30+
size_t len;
31+
} psa_invec;
32+
typedef struct psa_outvec {
33+
void *base;
34+
size_t len;
35+
} psa_outvec;
36+
#endif
37+
38+
#ifndef PSA_ERROR_INVALID_ARGUMENT
39+
#define PSA_ERROR_INVALID_ARGUMENT ((int32_t)-132)
40+
#endif
41+
#ifndef PSA_ERROR_NOT_SUPPORTED
42+
#define PSA_ERROR_NOT_SUPPORTED ((int32_t)-138)
43+
#endif
44+
45+
/* Pack extra args to keep veneers <= 4 args (ARM TEE style). */
46+
#define WOLFBOOT_ARM_TEE_TYPE_MASK 0xFFFFUL
47+
#define WOLFBOOT_ARM_TEE_IN_LEN_OFFSET 24
48+
#define WOLFBOOT_ARM_TEE_IN_LEN_MASK (0x7UL << WOLFBOOT_ARM_TEE_IN_LEN_OFFSET)
49+
#define WOLFBOOT_ARM_TEE_OUT_LEN_OFFSET 16
50+
#define WOLFBOOT_ARM_TEE_OUT_LEN_MASK (0x7UL << WOLFBOOT_ARM_TEE_OUT_LEN_OFFSET)
51+
52+
#define WOLFBOOT_ARM_TEE_PARAM_PACK(type, in_len, out_len) \
53+
((((uint32_t)(type)) & WOLFBOOT_ARM_TEE_TYPE_MASK) | \
54+
((((uint32_t)(in_len)) << WOLFBOOT_ARM_TEE_IN_LEN_OFFSET) & \
55+
WOLFBOOT_ARM_TEE_IN_LEN_MASK) | \
56+
((((uint32_t)(out_len)) << WOLFBOOT_ARM_TEE_OUT_LEN_OFFSET) & \
57+
WOLFBOOT_ARM_TEE_OUT_LEN_MASK))
58+
59+
#define WOLFBOOT_ARM_TEE_PARAM_UNPACK_TYPE(ctrl_param) \
60+
((int32_t)(int16_t)((ctrl_param) & WOLFBOOT_ARM_TEE_TYPE_MASK))
61+
#define WOLFBOOT_ARM_TEE_PARAM_UNPACK_IN_LEN(ctrl_param) \
62+
((size_t)(((ctrl_param) & WOLFBOOT_ARM_TEE_IN_LEN_MASK) >> \
63+
WOLFBOOT_ARM_TEE_IN_LEN_OFFSET))
64+
#define WOLFBOOT_ARM_TEE_PARAM_UNPACK_OUT_LEN(ctrl_param) \
65+
((size_t)(((ctrl_param) & WOLFBOOT_ARM_TEE_OUT_LEN_MASK) >> \
66+
WOLFBOOT_ARM_TEE_OUT_LEN_OFFSET))
67+
68+
#if defined(__ARM_FEATURE_CMSE) && defined(__GNUC__)
69+
#define WOLFBOOT_CMSE_NS_ENTRY __attribute__((cmse_nonsecure_entry))
70+
#else
71+
#define WOLFBOOT_CMSE_NS_ENTRY
72+
#endif
73+
74+
/* Secure-side NSC veneers expected by Zephyr ARM TEE client. */
75+
uint32_t WOLFBOOT_CMSE_NS_ENTRY arm_tee_psa_framework_version_veneer(void);
76+
uint32_t WOLFBOOT_CMSE_NS_ENTRY arm_tee_psa_version_veneer(uint32_t sid);
77+
psa_handle_t WOLFBOOT_CMSE_NS_ENTRY arm_tee_psa_connect_veneer(uint32_t sid,
78+
uint32_t version);
79+
int32_t WOLFBOOT_CMSE_NS_ENTRY arm_tee_psa_call_veneer(psa_handle_t handle,
80+
uint32_t ctrl_param,
81+
const psa_invec *in_vec, psa_outvec *out_vec);
82+
void WOLFBOOT_CMSE_NS_ENTRY arm_tee_psa_close_veneer(psa_handle_t handle);
83+
84+
/* Backing PSA IPC hooks (override in secure code). */
85+
uint32_t arm_tee_psa_framework_version(void);
86+
uint32_t arm_tee_psa_version(uint32_t sid);
87+
psa_handle_t arm_tee_psa_connect(uint32_t sid, uint32_t version);
88+
int32_t arm_tee_psa_call(psa_handle_t handle, int32_t type,
89+
const psa_invec *in_vec, size_t in_len,
90+
psa_outvec *out_vec, size_t out_len);
91+
void arm_tee_psa_close(psa_handle_t handle);
92+
93+
#ifdef __cplusplus
94+
}
95+
#endif
96+
97+
#endif /* WOLFBOOT_ARM_TEE_API_H */

lib/wolfPSA

Submodule wolfPSA added at b194ead

options.mk

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -681,6 +681,12 @@ ifeq ($(WOLFBOOT_HUGE_STACK),1)
681681
CFLAGS+=-DWOLFBOOT_HUGE_STACK
682682
endif
683683

684+
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
685+
ifeq ($(WOLFCRYPT_TZ_PSA),1)
686+
$(error WOLFCRYPT_TZ_PKCS11 and WOLFCRYPT_TZ_PSA are mutually exclusive)
687+
endif
688+
endif
689+
684690
ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
685691
CFLAGS+=-DSECURE_PKCS11
686692
CFLAGS+=-DWOLFSSL_PKCS11_RW_TOKENS
@@ -725,6 +731,51 @@ ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
725731
endif
726732
endif
727733

734+
ifeq ($(WOLFCRYPT_TZ_PSA),1)
735+
CFLAGS+=-DWOLFCRYPT_TZ_PSA
736+
CFLAGS+=-DWOLFSSL_PSA_ENGINE
737+
CFLAGS+=-DWOLFPSA_CUSTOM_STORE
738+
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)
739+
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)/wolfpsa
740+
LDFLAGS+=--specs=nano.specs
741+
WOLFCRYPT_OBJS+=src/psa_store.o
742+
WOLFCRYPT_OBJS+=src/arm_tee_psa_veneer.o
743+
WOLFCRYPT_OBJS+=src/arm_tee_psa_ipc.o
744+
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/pwdbased.o
745+
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
746+
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o
747+
ifeq ($(findstring random.o,$(WOLFCRYPT_OBJS)),)
748+
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
749+
endif
750+
WOLFPSA_SRCS := $(filter-out $(WOLFBOOT_LIB_WOLFPSA)/src/psa_store_posix.c, \
751+
$(wildcard $(WOLFBOOT_LIB_WOLFPSA)/src/*.c))
752+
WOLFPSA_OBJS := $(patsubst %.c,%.o,$(WOLFPSA_SRCS))
753+
WOLFCRYPT_OBJS+=$(WOLFPSA_OBJS)
754+
STACK_USAGE=16688
755+
ifneq ($(ENCRYPT),1)
756+
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/aes.o
757+
endif
758+
ifeq ($(findstring RSA,$(SIGN)),)
759+
ifeq ($(findstring RSA,$(SIGN_SECONDARY)),)
760+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
761+
endif
762+
endif
763+
ifeq ($(findstring ECC,$(SIGN)),)
764+
ifeq ($(findstring ECC,$(SIGN_SECONDARY)),)
765+
WOLFCRYPT_OBJS+=$(ECC_OBJS)
766+
endif
767+
endif
768+
ifeq ($(findstring ECC,$(SIGN)),)
769+
ifeq ($(findstring ECC,$(SIGN_SECONDARY)),)
770+
ifeq ($(findstring RSA,$(SIGN)),)
771+
ifeq ($(findstring RSA,$(SIGN_SECONDARY)),)
772+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
773+
endif
774+
endif
775+
endif
776+
endif
777+
endif
778+
728779
OBJS+=$(PUBLIC_KEY_OBJS)
729780
ifneq ($(STAGE1),1)
730781
OBJS+=$(UPDATE_OBJS)
@@ -762,12 +813,14 @@ ifeq ($(WOLFTPM),1)
762813
endif
763814
endif
764815
ifneq ($(WOLFCRYPT_TZ_PKCS11),1)
816+
ifneq ($(WOLFCRYPT_TZ_PSA),1)
765817
ifneq ($(ENCRYPT),1)
766818
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/aes.o
767819
endif
768820
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
769821
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
770822
endif
823+
endif
771824
ifeq ($(DEBUG),1)
772825
CFLAGS+=-DWOLFBOOT_DEBUG_TPM=1
773826
endif

0 commit comments

Comments
 (0)