Skip to content

Commit 6a1120d

Browse files
bigbrettdanielinux
bigbrett
authored and
danielinux
committed
-add wolfHSM RSA4096 configs for sim and AURIX
-various fixes for RSA4096 -remove erroneous coupling between SMALL_STACK and WOLFHSM_SERVER
1 parent 57b874b commit 6a1120d

18 files changed

+235
-39
lines changed

‎.github/workflows/test-configs.yml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -534,7 +534,37 @@ jobs:
534534
uses: ./.github/workflows/test-build.yml
535535
with:
536536
arch: host
537-
config-file: ./config/examples/sim-wolfHSM-client.config
537+
config-file: ./config/examples/sim-wolfHSM-client-ecc.config
538+
539+
sim_wolfhsm_client_mldsa_test:
540+
uses: ./.github/workflows/test-build.yml
541+
with:
542+
arch: host
543+
config-file: ./config/examples/sim-wolfHSM-client-mldsa.config
544+
545+
sim_wolfhsm_client_certchain_ecc_test:
546+
uses: ./.github/workflows/test-build.yml
547+
with:
548+
arch: host
549+
config-file: ./config/examples/sim-wolfHSM-client-certchain-ecc.config
550+
551+
sim_wolfhsm_client_certchain_rsa4096_test:
552+
uses: ./.github/workflows/test-build.yml
553+
with:
554+
arch: host
555+
config-file: ./config/examples/sim-wolfHSM-client-certchain-rsa4096.config
556+
557+
sim_wolfhsm_server_certchain_ecc_test:
558+
uses: ./.github/workflows/test-build.yml
559+
with:
560+
arch: host
561+
config-file: ./config/examples/sim-wolfHSM-server-certchain-ecc.config
562+
563+
sim_wolfhsm_server_certchain_rsa4096_test:
564+
uses: ./.github/workflows/test-build.yml
565+
with:
566+
arch: host
567+
config-file: ./config/examples/sim-wolfHSM-server-certchain-rsa4096.config
538568

539569
rp2350_test:
540570
uses: ./.github/workflows/test-build-pico-sdk.yml

‎.github/workflows/test-external-library-paths.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
build-tpm-tools: true
2525

2626
- name: "external wolfHSM"
27-
config: "config/examples/sim-wolfHSM-client.config"
27+
config: "config/examples/sim-wolfHSM-client-ecc.config"
2828

2929
- name: "Unit tests"
3030
config: ""

‎.github/workflows/test-wolfhsm-simulator.yml‎

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,36 @@ jobs:
1414
strategy:
1515
matrix:
1616
config:
17-
- name: "Standard wolfHSM"
18-
file: "config/examples/sim-wolfHSM-client.config"
19-
- name: "wolfHSM ML-DSA"
17+
- name: "wolfHSM client ECC"
18+
file: "config/examples/sim-wolfHSM-client-ecc.config"
19+
needs_posix_server: true
20+
posix_server_nvminit: false
21+
needs_nvm_image: false
22+
- name: "wolfHSM client ML-DSA"
2023
file: "config/examples/sim-wolfHSM-client-mldsa.config"
21-
- name: "wolfHSM cert chain verify"
22-
file: "config/examples/sim-wolfHSM-client-certchain.config"
23-
- name: "wolfHSM server cert chain verify"
24-
file: "config/examples/sim-wolfHSM-server-certchain.config"
24+
needs_posix_server: true
25+
posix_server_nvminit: false
26+
needs_nvm_image: false
27+
- name: "wolfHSM client cert chain verify ECC"
28+
file: "config/examples/sim-wolfHSM-client-certchain-ecc.config"
29+
needs_posix_server: true
30+
posix_server_nvminit: true
31+
needs_nvm_image: false
32+
- name: "wolfHSM client cert chain verify RSA4096"
33+
file: "config/examples/sim-wolfHSM-client-certchain-rsa4096.config"
34+
needs_posix_server: true
35+
posix_server_nvminit: true
36+
needs_nvm_image: false
37+
- name: "wolfHSM server cert chain verify ECC"
38+
file: "config/examples/sim-wolfHSM-server-certchain-ecc.config"
39+
needs_posix_server: false
40+
posix_server_nvminit: false
41+
needs_nvm_image: true
42+
- name: "wolfHSM server cert chain verify RSA4096"
43+
file: "config/examples/sim-wolfHSM-server-certchain-rsa4096.config"
44+
needs_posix_server: false
45+
posix_server_nvminit: false
46+
needs_nvm_image: true
2547

2648
fail-fast: false
2749

@@ -98,15 +120,15 @@ jobs:
98120
make clean && make test-sim-internal-flash-with-update
99121
100122
- name: Build example POSIX TCP server
101-
if: matrix.config.name != 'wolfHSM server cert chain verify'
123+
if: matrix.config.needs_posix_server
102124
run: cd lib/wolfHSM/examples/posix/wh_posix_server && make WOLFSSL_DIR=../../../../wolfssl
103125

104126
# Start the server in the background
105127
- name: Run POSIX TCP server
106-
if: matrix.config.name != 'wolfHSM server cert chain verify'
128+
if: matrix.config.needs_posix_server
107129
run: |
108130
cd lib/wolfHSM/examples/posix/wh_posix_server
109-
if [ "${{ matrix.config.name }}" = "wolfHSM cert chain verify" ]; then
131+
if [ "${{ matrix.config.posix_server_nvminit }}" = "true" ]; then
110132
tmpfile=$(mktemp)
111133
echo "obj 1 0xFFFF 0x0000 \"cert CA\" ../../../../../test-dummy-ca/root-cert.der" >> $tmpfile
112134
./Build/wh_posix_server.elf --type tcp --nvminit $tmpfile &
@@ -120,7 +142,7 @@ jobs:
120142
# For testing the wolfHSM server cert chain verify feature, we need to create an NVM image containing our root CA that
121143
# the internal wolfHSM server can load.
122144
- name: Create NVM image for wolfHSM server cert chain verify
123-
if: matrix.config.name == 'wolfHSM server cert chain verify'
145+
if: matrix.config.needs_nvm_image
124146
run: |
125147
make -C lib/wolfHSM/tools/whnvmtool
126148
tmpfile=$(mktemp)
@@ -134,6 +156,6 @@ jobs:
134156
135157
# Kill the server if it is still running
136158
- name: Kill POSIX TCP server
137-
if: always() && matrix.config.name != 'wolfHSM server cert chain verify'
159+
if: always() && matrix.config.needs_posix_server
138160
run: |
139161
kill $TCP_SERVER_PID || true

config/examples/aurix-tc375.config renamed to config/examples/aurix-tc375-ecc.config

File renamed without changes.

config/examples/aurix-tc375-elf.config renamed to config/examples/aurix-tc375-elf-ecc.config

File renamed without changes.

config/examples/aurix-tc375-elf-wolfHSM-certs.config renamed to config/examples/aurix-tc375-elf-wolfHSM-certs-ecc.config

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,6 @@ CERT_CHAIN_VERIFY=1
3131
# for actual length
3232
IMAGE_HEADER_SIZE=2048
3333

34-
# If SIGN=RSA4096, use the below options
35-
#WOLFBOOT_HUGE_STACK=1
36-
#IMAGE_HEADER_SIZE=4096
37-
38-
3934
ARCH_FLASH_OFFSET=0x800A0000
4035
WOLFBOOT_SECTOR_SIZE=0x4000
4136

‎config/examples/aurix-tc375-elf-wolfHSM-certs-rsa4096.config‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
ARCH?=AURIX_TC3
2+
TARGET?=aurix_tc3xx
3+
SIGN?=RSA4096
4+
HASH?=SHA256
5+
DEBUG?=0
6+
NO_ASM?=1
7+
WOLFBOOT_VERSION?=1
8+
V?=0
9+
SPMATH?=1
10+
RAM_CODE?=1
11+
EXT_FLASH?=1
12+
EXT_BOOT=1
13+
EXT_UPDATE=1
14+
EXT_SWAP=1
15+
FLAGS_INVERT=1
16+
FLASH_MULTI_SECTOR_ERASE=1
17+
DEBUG_UART=1
18+
PRINTF_ENABLED=1
19+
20+
# wolfHSM options
21+
WOLFHSM_CLIENT=1
22+
23+
# ELF loading specific configuration
24+
ELF=1
25+
ELF_FLASH_SCATTER=1
26+
27+
# Cert chain options
28+
CERT_CHAIN_VERIFY=1
29+
30+
# RSA4096 cert chains need the larger header and stack
31+
WOLFBOOT_HUGE_STACK=1
32+
IMAGE_HEADER_SIZE=4096
33+
34+
ARCH_FLASH_OFFSET=0x800A0000
35+
WOLFBOOT_SECTOR_SIZE=0x4000
36+
37+
# ELF memory partitioning (same PFLASH1 space as standard wolfBoot):
38+
# Standard wolfBoot uses 0x80300000-0x80600000 (3MB) for BOOT+UPDATE+SWAP
39+
# ELF mode splits this same space into EXEC+BOOT+UPDATE+SWAP:
40+
# - Execution space: 0x80300000 (~1.5MB) - where app runs after scatter loading
41+
# - BOOT partition: 0x8047C000 (~0.75MB) - where signed ELF file is stored
42+
# - UPDATE partition: 0x8053C000 (~0.75MB) - where update ELF file is stored
43+
# - SWAP sector: 0x805FC000 (16KB) - for atomic updates
44+
45+
# ELF storage partitions (where signed ELF files are stored)
46+
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x8047C000
47+
WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x8053C000
48+
WOLFBOOT_PARTITION_SWAP_ADDRESS=0x805FC000
49+
WOLFBOOT_PARTITION_SIZE=0xC0000
50+
51+
# ELF execution space (where test app runs after scatter loading)
52+
# Uses the same space that would be the BOOT partition in standard mode
53+
# This is only needed to configure the memory regions in the test app linker file
54+
# (see test-app/tc3tc_app.ld). For custom user apps with a different memory layout
55+
# and linker file this is not necessary.
56+
WOLFBOOT_ELF_EXEC_ADDRESS=0x80300000
57+
WOLFBOOT_ELF_EXEC_SIZE=0x17C000

config/examples/aurix-tc375-elf-wolfHSM.config renamed to config/examples/aurix-tc375-elf-wolfHSM-ecc.config

File renamed without changes.

config/examples/aurix-tc375-hsm.config renamed to config/examples/aurix-tc375-hsm-ecc.config

File renamed without changes.

config/examples/aurix-tc375-hsm-wolfHSM-certs.config renamed to config/examples/aurix-tc375-hsm-wolfHSM-certs-ecc.config

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,6 @@ CERT_CHAIN_VERIFY=1
2828
# for actual length
2929
IMAGE_HEADER_SIZE=2048
3030

31-
# If SIGN=RSA4096, use the below options
32-
#WOLFBOOT_HUGE_STACK=1
33-
#IMAGE_HEADER_SIZE=4096
34-
35-
3631
ARCH_FLASH_OFFSET=0x80028000
3732
WOLFBOOT_SECTOR_SIZE=0x4000
3833
WOLFBOOT_PARTITION_SIZE=0x30000

0 commit comments

Comments
 (0)