Skip to content

Commit 8c5aa75

Browse files
dgarskedgarske
authored
Merge pull request #651 from mattia-moffa/20251213-nrf5340-wolfcrypt-tz
Support WOLFCRYPT_TZ and PKCS11 on nRF5340
2 parents 0c7fa9d + 26171af commit 8c5aa75

File tree

8 files changed

+242
-26
lines changed

8 files changed

+242
-26
lines changed

‎.github/workflows/test-configs.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,12 @@ jobs:
145145
arch: arm
146146
config-file: ./config/examples/nrf5340-tz.config
147147

148+
nrf5340_app_wolfcrypt_tz_test:
149+
uses: ./.github/workflows/test-build.yml
150+
with:
151+
arch: arm
152+
config-file: ./config/examples/nrf5340-wolfcrypt-tz.config
153+
148154
nrf5340_net_test:
149155
uses: ./.github/workflows/test-build.yml
150156
with:

‎config/examples/nrf5340-tz.config‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,16 @@ QSPI_FLASH?=1
2626
# Flash is 4KB pages (app)
2727
WOLFBOOT_SECTOR_SIZE?=0x1000
2828

29-
# Flash keyvault: 112K
29+
# Flash keyvault: 124K
3030
WOLFBOOT_KEYVAULT_ADDRESS?=0x20000
31-
WOLFBOOT_KEYVAULT_SIZE?=0x1C000
32-
33-
# Flash NSC: 16K
34-
WOLFBOOT_NSC_ADDRESS?=0x3C000
35-
WOLFBOOT_NSC_SIZE?=0x04000
31+
WOLFBOOT_KEYVAULT_SIZE?=0x1F000
32+
33+
# Flash NSC: 4K
34+
# Note: the NSC area must be defined so that:
35+
# - Its size is exactly 32, 64, 128, 256, 512, 1024, 2048 or 4096 bytes
36+
# - Its end is 16K-aligned
37+
WOLFBOOT_NSC_ADDRESS?=0x3F000
38+
WOLFBOOT_NSC_SIZE?=0x01000
3639

3740
# Application offset (reserve 256K for wolfBoot + keyvault + NSC)
3841
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x40000

‎config/examples/nrf5340-wolfcrypt-tz.config‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
ARCH?=ARM
2+
TZEN?=1
3+
TARGET?=nrf5340
4+
SIGN?=ECC384
5+
HASH?=SHA384
6+
WOLFBOOT_VERSION?=1
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
ALLOW_DOWNGRADE?=0
13+
NVM_FLASH_WRITEONCE?=0
14+
DELTA_UPDATES?=1
15+
16+
SPMATH?=1
17+
RAM_CODE?=1
18+
19+
DUALBANK_SWAP?=0
20+
FLAGS_HOME=0
21+
DISABLE_BACKUP=0
22+
EXT_FLASH?=1
23+
SPI_FLASH?=0
24+
QSPI_FLASH?=1
25+
26+
WOLFCRYPT_TZ?=1
27+
WOLFCRYPT_TZ_PKCS11?=1
28+
29+
# Flash is 4KB pages (app)
30+
WOLFBOOT_SECTOR_SIZE?=0x1000
31+
32+
# Flash keyvault: 104K
33+
WOLFBOOT_KEYVAULT_ADDRESS?=0x45000
34+
WOLFBOOT_KEYVAULT_SIZE?=0x1A000
35+
36+
# Flash NSC: 4K
37+
# Note: the NSC area must be defined so that:
38+
# - Its size is exactly 32, 64, 128, 256, 512, 1024, 2048 or 4096 bytes
39+
# - Its end is 16K-aligned
40+
WOLFBOOT_NSC_ADDRESS?=0x5F000
41+
WOLFBOOT_NSC_SIZE?=0x01000
42+
43+
# Application offset (reserve 384K for wolfBoot + keyvault + NSC)
44+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x60000
45+
46+
# Application Partition Size (640KB)
47+
WOLFBOOT_PARTITION_SIZE?=0xA0000
48+
49+
# External Flash offset for application update (1MB)
50+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0
51+
52+
# External Flash offset for network update at 0x100000 (size=256KB)
53+
54+
# External Flash offset for swap (4KB)
55+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x140000
56+
57+
V?=0
58+
DEBUG?=0
59+
DEBUG_UART?=1
60+
USE_GCC=1
61+
OPTIMIZATION_LEVEL=2
62+
63+
# Optionally wait for network core to boot before starting application core
64+
CFLAGS_EXTRA+=-DNRF_SYNC_CORES
65+
66+
# Use larger block size for swapping sectors (performance improvement)
67+
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
68+
69+
# Enable optional power control pin (active low) P1.00
70+
#CFLAGS_EXTRA+=-DQSPI_PWR_CTRL_PORT=1 -DQSPI_PWR_CTRL_PIN=0
71+
72+
# Use UART0 on P0.22
73+
#CFLAGS_EXTRA+=-DUART_PORT=0 -DUART_PIN=22
74+
75+
#CFLAGS_EXTRA+=-DDEBUG_FLASH
76+
#CFLAGS_EXTRA+=-DDEBUG_QSPI=1
77+
78+
# Hard fault debugging
79+
#CFLAGS_EXTRA+=-DDEBUG_HARDFAULT

‎hal/nrf5340.c‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,8 @@ static SharedMem_t* shm = (SharedMem_t*)&shm_shadow;
136136
#endif
137137

138138
#ifdef TZEN
139-
static void hal_spu_init(void) {
139+
static void hal_spu_init(void)
140+
{
140141
uint8_t nsc_size_index;
141142
uint8_t region;
142143
uint8_t start_region;
@@ -177,6 +178,57 @@ static void hal_spu_init(void) {
177178
~SPU_RAMREGION_PERM_SECATTR) | SPU_RAMREGION_PERM_LOCK;
178179
}
179180
}
181+
182+
#ifdef WOLFCRYPT_SECURE_MODE
183+
static uint32_t cryptocell_enable_prev = 0;
184+
185+
void hal_trng_init(void)
186+
{
187+
cryptocell_enable_prev = CRYPTOCELL_ENABLE;
188+
CRYPTOCELL_ENABLE = 1;
189+
CC_RNG_CLK = 1;
190+
CC_RNG_SW_RESET = 1;
191+
192+
do {
193+
CC_RNG_CLK = 1;
194+
CC_RNG_SAMPLE_CNT = FICR_TRNG90B_ROSC1;
195+
} while (CC_RNG_SAMPLE_CNT != FICR_TRNG90B_ROSC1);
196+
197+
CC_RNG_TRNG_CONFIG = 0;
198+
CC_RNG_NOISE_SOURCE = 1;
199+
}
200+
201+
void hal_trng_fini(void)
202+
{
203+
CC_RNG_NOISE_SOURCE = 0;
204+
CC_RNG_CLK = 0;
205+
CC_RNG_SW_RESET = 1;
206+
207+
CRYPTOCELL_ENABLE = cryptocell_enable_prev;
208+
}
209+
210+
int hal_trng_get_entropy(unsigned char *out, unsigned int len)
211+
{
212+
unsigned int i = 0;
213+
214+
while (i < len) {
215+
uint32_t data[CC_RNG_EHR_DATA_LEN];
216+
uint8_t *data_bytes = (uint8_t *)data;
217+
unsigned int word, byte;
218+
219+
while (!((CC_RNG_ISR & 0x01) && (CC_RNG_TRNG_VALID & 0x01))) {}
220+
221+
for (word = 0; word < CC_RNG_EHR_DATA_LEN; word++) {
222+
data[word] = CC_RNG_EHR_DATA(word);
223+
}
224+
for (byte = 0; byte < 4 * CC_RNG_EHR_DATA_LEN && i < len; byte++) {
225+
out[i++] = (unsigned char)data_bytes[byte];
226+
}
227+
}
228+
229+
return 0;
230+
}
231+
#endif
180232
#endif
181233

182234
void uart_init(void)
@@ -804,7 +856,8 @@ int hal_flash_protect(uint32_t start, uint32_t len)
804856
}
805857

806858
#ifdef TZEN
807-
static void periph_unsecure() {
859+
static void periph_unsecure()
860+
{
808861
/* Unsecure both GPIO ports */
809862
SPU_PERIPHID_PERM(GPIO_PERIPHID) &= ~SPU_PERIPHID_PERM_SECATTR;
810863
SPU_GPIOPORT_PERM(0) = 0;

‎hal/nrf5340.h‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,38 @@ void uart_write_sz(const char* c, unsigned int sz);
451451
#undef QSPI_FLASH
452452
#endif
453453

454+
/* CryptoCell */
455+
#ifdef TARGET_nrf5340_app
456+
#define CRYPTOCELL_BASE 0x50844000
457+
#define CRYPTOCELL_ENABLE (*(volatile uint32_t *)(CRYPTOCELL_BASE + 0x500))
458+
459+
#define FICR_BASE 0x00FF0000
460+
#define FICR_TRNG90B_ROSC1 (*(volatile uint32_t *)(FICR_BASE + 0xC10))
461+
462+
#define CC_RNG_BASE 0x50845000
463+
#define CC_RNG_ISR (*(volatile uint32_t *)(CC_RNG_BASE + 0x104))
464+
#define CC_RNG_ICR (*(volatile uint32_t *)(CC_RNG_BASE + 0x108))
465+
#define CC_RNG_TRNG_CONFIG (*(volatile uint32_t *)(CC_RNG_BASE + 0x10C))
466+
#define CC_RNG_TRNG_VALID (*(volatile uint32_t *)(CC_RNG_BASE + 0x110))
467+
#define CC_RNG_EHR_DATA(n) (*(volatile uint32_t *)(CC_RNG_BASE + 0x114 + (n) * 0x4))
468+
#define CC_RNG_EHR_DATA_LEN 6
469+
#define CC_RNG_NOISE_SOURCE (*(volatile uint32_t *)(CC_RNG_BASE + 0x12C))
470+
#define CC_RNG_SAMPLE_CNT (*(volatile uint32_t *)(CC_RNG_BASE + 0x130))
471+
#define CC_RNG_AUTOCORR_STATISTIC (*(volatile uint32_t *)(CC_RNG_BASE + 0x134))
472+
#define CC_RNG_TRNG_DEBUG (*(volatile uint32_t *)(CC_RNG_BASE + 0x138))
473+
#define CC_RNG_SW_RESET (*(volatile uint32_t *)(CC_RNG_BASE + 0x140))
474+
#define CC_RNG_BUSY (*(volatile uint32_t *)(CC_RNG_BASE + 0x1B8))
475+
#define CC_RNG_TRNG_RESET (*(volatile uint32_t *)(CC_RNG_BASE + 0x1BC))
476+
#define CC_RNG_HW_FLAGS (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C0))
477+
#define CC_RNG_CLK (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C4))
478+
#define CC_RNG_DMA (*(volatile uint32_t *)(CC_RNG_BASE + 0x1C8))
479+
#define CC_RNG_DMA_ROSC_LEN (*(volatile uint32_t *)(CC_RNG_BASE + 0x1CC))
480+
#define CC_RNG_DMA_SRAM_ADDR (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D0))
481+
#define CC_RNG_DMA_SAMPLES_NUM (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D4))
482+
#define CC_RNG_WATCHDOG_VAL (*(volatile uint32_t *)(CC_RNG_BASE + 0x1D8))
483+
#define CC_RNG_DMA_BUSY (*(volatile uint32_t *)(CC_RNG_BASE + 0x1DC))
484+
#endif
485+
454486
/* interprocessor communication (IPC) peripheral */
455487
#ifdef TARGET_nrf5340_app
456488
#if TZ_SECURE()

‎include/user_settings.h‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,11 +162,13 @@ extern int tolower(int c);
162162
# if defined(WOLFBOOT_SIGN_ECC256) || defined(WOLFCRYPT_SECURE_MODE) || \
163163
defined(WOLFBOOT_SIGN_SECONDARY_ECC256)
164164
# define HAVE_ECC256
165-
# elif defined(WOLFBOOT_SIGN_ECC384) || \
165+
# endif
166+
# if defined(WOLFBOOT_SIGN_ECC384) || \
166167
defined(WOLFBOOT_SIGN_SECONDARY_ECC384)
167168
# define HAVE_ECC384
168169
# define WOLFSSL_SP_384
169-
# elif defined(WOLFBOOT_SIGN_ECC521) || \
170+
# endif
171+
# if defined(WOLFBOOT_SIGN_ECC521) || \
170172
defined(WOLFBOOT_SIGN_SECONDARY_ECC521)
171173
# define HAVE_ECC521
172174
# define WOLFSSL_SP_521

‎test-app/app_nrf5340.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,43 @@
2727
#include "hal/nrf5340.h"
2828
#include "printf.h"
2929

30+
#ifdef WOLFCRYPT_SECURE_MODE
31+
#include "wcs/user_settings.h"
32+
#include "wolfssl/wolfcrypt/random.h"
33+
#endif
34+
3035
void gpiotoggle(uint32_t port, uint32_t pin)
3136
{
3237
uint32_t reg_val = GPIO_OUT(port);
3338
GPIO_OUTCLR(port) = reg_val & (1 << pin);
3439
GPIO_OUTSET(port) = (~reg_val) & (1 << pin);
3540
}
3641

42+
#ifdef WOLFCRYPT_SECURE_MODE
43+
static int print_random_number(void)
44+
{
45+
WC_RNG rng;
46+
int ret;
47+
uint32_t rand;
48+
49+
ret = wc_InitRng(&rng);
50+
if (ret != 0) {
51+
wolfBoot_printf("Failed to initialize RNG\r\n");
52+
return -1;
53+
}
54+
ret = wc_RNG_GenerateBlock(&rng, (byte *)&rand, sizeof(rand));
55+
if (ret != 0) {
56+
wolfBoot_printf("Failed to generate random number\r\n");
57+
wc_FreeRng(&rng);
58+
return -1;
59+
}
60+
wolfBoot_printf("Today's lucky number: 0x%08lX\r\n", rand);
61+
wc_FreeRng(&rng);
62+
63+
return 0;
64+
}
65+
#endif
66+
3767
void main(void)
3868
{
3969
int i;
@@ -64,6 +94,9 @@ void main(void)
6494
wolfBoot_printf("Compiled: " __DATE__ ":" __TIME__ "\n");
6595
#ifdef TZEN
6696
wolfBoot_printf("TrustZone enabled: yes\n");
97+
#ifdef WOLFCRYPT_SECURE_MODE
98+
print_random_number();
99+
#endif
67100
#else
68101
wolfBoot_printf("TrustZone enabled: no\n");
69102
#endif

‎tools/scripts/nrf5340/build_flash.sh‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -54,21 +54,22 @@ while test $# -gt 0; do
5454
echo "default: build, erase and program"
5555
echo " "
5656
echo "options:"
57-
echo "-h, --help show brief help"
58-
echo "-c, --clean cleanup build artifacts"
59-
echo "-b, --build build release with symbols"
60-
echo "-tz, --trustzone" use TrustZone configuration
61-
echo "-d, --debug build debug"
62-
echo "-v, --verbose build verbose"
63-
echo "--version use custom version"
64-
echo "-e, --erase do erase of internal/external flash"
65-
echo "-ei, --erase-int do erase of internal flash"
66-
echo "-ee, --erase-ext do erase of external flash"
67-
echo "-p, --program program images built"
68-
echo "-pi, --program-int program internal image (boot)"
69-
echo "-pe, --program-ext program external image (update)"
70-
echo "-u, --update build update, sign and program external flash"
71-
echo "-t, --delta build update, sign delta and program external flash"
57+
echo "-h, --help show brief help"
58+
echo "-c, --clean cleanup build artifacts"
59+
echo "-b, --build build release with symbols"
60+
echo "-tz, --trustzone" use TrustZone configuration
61+
echo "-wtz, --wc-trustzone" use TrustZone + wolfCrypt configuration
62+
echo "-d, --debug build debug"
63+
echo "-v, --verbose build verbose"
64+
echo "--version use custom version"
65+
echo "-e, --erase do erase of internal/external flash"
66+
echo "-ei, --erase-int do erase of internal flash"
67+
echo "-ee, --erase-ext do erase of external flash"
68+
echo "-p, --program program images built"
69+
echo "-pi, --program-int program internal image (boot)"
70+
echo "-pe, --program-ext program external image (update)"
71+
echo "-u, --update build update, sign and program external flash"
72+
echo "-t, --delta build update, sign delta and program external flash"
7273
exit 0
7374
;;
7475
-c|--clean)
@@ -86,6 +87,11 @@ while test $# -gt 0; do
8687
echo "Build with TrustZone config"
8788
shift
8889
;;
90+
-wtz|--wolfcrypt-trustzone)
91+
DO_WOLFCRYPT_TRUSTZONE=1
92+
echo "Build with TrustZone + wolfCrypt config"
93+
shift
94+
;;
8995
-d|--debug)
9096
DO_BUILD=1
9197
MAKE_ARGS+=" DEBUG=1"
@@ -174,7 +180,9 @@ fi
174180
if [[ $DO_BUILD == 1 ]]; then
175181
# Build internal flash images for both cores
176182

177-
if [[ $DO_TRUSTZONE == 1 ]]; then
183+
if [[ $DO_WOLFCRYPT_TRUSTZONE == 1 ]]; then
184+
config_app=config/examples/nrf5340-wolfcrypt-tz.config
185+
elif [[ $DO_TRUSTZONE == 1 ]]; then
178186
config_app=config/examples/nrf5340-tz.config
179187
else
180188
config_app=config/examples/nrf5340.config

0 commit comments

Comments
 (0)