From 4277f250bb6d00fb049798b0fffaead712161c58 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Fri, 18 Sep 2026 11:26:38 -0700 Subject: [PATCH 1/2] Update wolfHSM to v1.5.0 --- .github/workflows/auto-pin-dependencies.yml | 38 +++++++++----- lib/wolfHSM | 2 +- lib/wolfSSL | 2 +- mk/common.mk | 1 + src/services/wolfhsm/runner/libc_stubs.h | 52 +++++++++++++++++++ src/services/wolfhsm/runner/user_settings.h | 10 ++++ .../wolfhsm/runner/wh_settings_local.h | 3 ++ src/services/wolfhsm/wt_hsm.c | 6 ++- .../stm32h563/nonsecure/wolfhsm_client_glue.c | 3 +- .../apps/freertos_guest1/main.c | 12 +---- .../wolfhsm-client/src/wolfhsm_client_glue.c | 24 +++------ .../wolfhsm-client/src/wolfhsm_zephyr_init.c | 24 +++------ .../scripts/build_freertos_guest.sh | 1 + tests/host/attestation_iak/main.c | 27 +++++----- tests/host/ffm_veneer/Makefile | 2 + tests/host/psa_ffm_client/Makefile | 2 + tests/host/wolfhsm_loopback/test_loopback.c | 9 ---- 17 files changed, 132 insertions(+), 86 deletions(-) create mode 100644 src/services/wolfhsm/runner/libc_stubs.h diff --git a/.github/workflows/auto-pin-dependencies.yml b/.github/workflows/auto-pin-dependencies.yml index e684d122..c5a78f5a 100644 --- a/.github/workflows/auto-pin-dependencies.yml +++ b/.github/workflows/auto-pin-dependencies.yml @@ -32,31 +32,44 @@ jobs: changed=0 failed=0 - # These dependencies publish stable release tags. wolfPSA remains - # manual while this branch carries fork-only runtime-devId/device-ID - # changes; including it here would undo the tested replacement - # patches on the next upstream release scan. + # These dependencies publish stable release tags. A required commit + # prevents a release from dropping newer integration work already in + # the pinned tree. wolfPSA remains manual while this branch carries + # fork-only runtime-devId/device-ID changes. specs=( - "lib/wolfSSL|https://github.com/wolfSSL/wolfSSL.git|v*-stable" - "lib/wolfHSM|https://github.com/wolfSSL/wolfHSM.git|wolfHSM-v*" - "lib/wolfIP|https://github.com/wolfSSL/wolfIP.git|v*" + "lib/wolfSSL|https://github.com/wolfSSL/wolfSSL.git|v*-stable|51975e27a5439668733976a584d417dfd7776026" + "lib/wolfHSM|https://github.com/wolfSSL/wolfHSM.git|wolfHSM-v*|a0323156606282448f00473a3fcb7aaa69361921" + "lib/wolfIP|https://github.com/wolfSSL/wolfIP.git|v*|" ) for spec in "${specs[@]}"; do - IFS='|' read -r path repo pattern <<< "$spec" + IFS='|' read -r path repo pattern required <<< "$spec" latest=$(git ls-remote --tags --refs "$repo" "$pattern" \ | awk -F/ '{print $NF}' | sort -V | tail -n 1) test -n "$latest" current=$(git -C "$path" rev-parse HEAD) - candidate=$(git ls-remote "$repo" "refs/tags/$latest" | awk '{print $1}') + git -C "$path" fetch --no-tags "$repo" "refs/tags/$latest" + candidate=$(git -C "$path" rev-parse 'FETCH_HEAD^{commit}') echo "$path: current=$current latest=$latest candidate=$candidate" + + if [ -n "$required" ] && + ! git -C "$path" merge-base --is-ancestor \ + "$required" "$candidate"; then + echo "$path: $latest lacks required commit $required; keeping current pin" + continue + fi if [ "$current" = "$candidate" ]; then continue fi + if git -C "$path" merge-base --is-ancestor \ + "$candidate" "$current"; then + echo "$path: current pin is newer than $latest; keeping current pin" + continue + fi + changed=1 - git -C "$path" fetch --depth 1 "$repo" "$latest" - git -C "$path" checkout --detach FETCH_HEAD + git -C "$path" checkout --detach "$candidate" if ! make test; then failed=1 @@ -74,9 +87,10 @@ jobs: done if [ "$changed" -eq 0 ]; then - echo "No upstream release tags advanced. Pins unchanged." + echo "No compatible upstream release tags advanced. Pins unchanged." fi echo "failed=$failed" >> "$GITHUB_OUTPUT" + exit "$failed" - name: Commit green release pins if: steps.gate.outputs.failed == '0' diff --git a/lib/wolfHSM b/lib/wolfHSM index a0323156..97dbbd72 160000 --- a/lib/wolfHSM +++ b/lib/wolfHSM @@ -1 +1 @@ -Subproject commit a0323156606282448f00473a3fcb7aaa69361921 +Subproject commit 97dbbd72ad2bf757279d7dc5101580290525c647 diff --git a/lib/wolfSSL b/lib/wolfSSL index 22e505bc..51975e27 160000 --- a/lib/wolfSSL +++ b/lib/wolfSSL @@ -1 +1 @@ -Subproject commit 22e505bcfad8ce21067ee4232128728543767a95 +Subproject commit 51975e27a5439668733976a584d417dfd7776026 diff --git a/mk/common.mk b/mk/common.mk index 1583cbad..b8fef1b1 100644 --- a/mk/common.mk +++ b/mk/common.mk @@ -203,6 +203,7 @@ WOLFCRYPT_SECURE_SRCS := \ $(WOLFSSL_DIR)/wolfcrypt/src/hash.c \ $(WOLFSSL_DIR)/wolfcrypt/src/hmac.c \ $(WOLFSSL_DIR)/wolfcrypt/src/logging.c \ + $(WOLFSSL_DIR)/wolfcrypt/src/memory.c \ $(WOLFSSL_DIR)/wolfcrypt/src/random.c \ $(WOLFSSL_DIR)/wolfcrypt/src/sha256.c \ $(ARCH_WOLFCRYPT_SP_SRCS) \ diff --git a/src/services/wolfhsm/runner/libc_stubs.h b/src/services/wolfhsm/runner/libc_stubs.h new file mode 100644 index 00000000..bf7935da --- /dev/null +++ b/src/services/wolfhsm/runner/libc_stubs.h @@ -0,0 +1,52 @@ +/* libc_stubs.h + * + * Copyright (C) 2026 wolfSSL Inc. + * + * This file is part of wolfTrust. + * + * wolfTrust is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfTrust is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, + * USA + */ + +#ifndef WOLFTRUST_LIBC_STUBS_H +#define WOLFTRUST_LIBC_STUBS_H + +#include + +void* memcpy(void* dst, const void* src, size_t size); +void* memset(void* dst, int value, size_t size); +void* memmove(void* dst, const void* src, size_t size); +int memcmp(const void* lhs, const void* rhs, size_t size); + +size_t strlen(const char* str); +int strcmp(const char* lhs, const char* rhs); +int strncmp(const char* lhs, const char* rhs, size_t size); +char* strncpy(char* dst, const char* src, size_t size); +int strcasecmp(const char* lhs, const char* rhs); +int strncasecmp(const char* lhs, const char* rhs, size_t size); + +int tolower(int value); +int toupper(int value); +int isspace(int value); +int isdigit(int value); +int isalpha(int value); +int isalnum(int value); +int isxdigit(int value); +int isupper(int value); +int islower(int value); +int iscntrl(int value); +int isprint(int value); + +#endif /* WOLFTRUST_LIBC_STUBS_H */ diff --git a/src/services/wolfhsm/runner/user_settings.h b/src/services/wolfhsm/runner/user_settings.h index 40f7679a..1a1a5184 100644 --- a/src/services/wolfhsm/runner/user_settings.h +++ b/src/services/wolfhsm/runner/user_settings.h @@ -43,6 +43,7 @@ * Disable the TLS/SSL layer — wolfCrypt primitives only. * ---------------------------------------------------------------------- */ #define WOLFCRYPT_ONLY +#define NO_CRYPT_BENCHMARK /* ------------------------------------------------------------------------- * No heap. @@ -51,9 +52,17 @@ * static or stack-owned objects. NO_WOLFSSL_MEMORY avoids wolfSSL's allocator * layer entirely, while WOLFSSL_NO_MALLOC makes any accidental XMALLOC path * fail closed instead of requiring malloc/sbrk or a static heap arena. + * NO_STDLIB_H and NO_STRING_H keep the freestanding Cortex-M build + * independent of libc headers; the linked local stubs provide these calls. * ---------------------------------------------------------------------- */ #define NO_WOLFSSL_MEMORY #define WOLFSSL_NO_MALLOC +#define NO_STDLIB_H +#define NO_STRING_H +#define NO_CTYPE_H +#define WOLFSSL_NO_ASSERT_H + +#include "libc_stubs.h" /* ------------------------------------------------------------------------- * Threading model: single-threaded from wolfCrypt's perspective. @@ -66,6 +75,7 @@ * No OS services. * ---------------------------------------------------------------------- */ #define NO_FILESYSTEM +#define NO_STDIO_FILESYSTEM #define NO_WOLFSSL_DIR #define WOLFSSL_USER_IO /* no BSD socket I/O callbacks needed */ #define NO_WRITEV diff --git a/src/services/wolfhsm/runner/wh_settings_local.h b/src/services/wolfhsm/runner/wh_settings_local.h index 187e0853..6bf919c9 100644 --- a/src/services/wolfhsm/runner/wh_settings_local.h +++ b/src/services/wolfhsm/runner/wh_settings_local.h @@ -131,4 +131,7 @@ *---------------------------------------------------------------------------*/ #define WOLFHSM_CFG_NO_SYS_TIME +/* The secure image is freestanding and leaves wolfHSM debug output disabled. */ +#define WOLFHSM_CFG_PRINTF(...) ((int)0) + #endif /* WOLFTRUST_SECURE_WH_SETTINGS_LOCAL_H */ diff --git a/src/services/wolfhsm/wt_hsm.c b/src/services/wolfhsm/wt_hsm.c index cd01445f..3808a294 100644 --- a/src/services/wolfhsm/wt_hsm.c +++ b/src/services/wolfhsm/wt_hsm.c @@ -1115,11 +1115,13 @@ static int wt_hsm_attest_generate_key(void) } if (ret == WH_ERROR_OK) { result = (whMessageCrypto_EccKeyGenResponse*)responsePayload; - if ((responseSize != + if ((responseSize < sizeof(whMessageCrypto_GenericResponseHeader) + sizeof(*result)) || (result->keyId != WT_HSM_ATTEST_KEY_ID) || - (result->len != 0u)) { + (result->len != responseSize - + sizeof(whMessageCrypto_GenericResponseHeader) - + sizeof(*result))) { ret = WH_ERROR_ABORTED; } } diff --git a/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c b/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c index 0fc0a231..a312e4f9 100644 --- a/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c +++ b/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c @@ -87,7 +87,8 @@ int wolfhsm_guest_init(void) g_comm_cfg.transport_cb = &wt_hsm_psa_transport_cb; g_comm_cfg.transport_context = &g_guest_tx; g_comm_cfg.transport_config = &g_guest_tx_cfg; - g_comm_cfg.client_id = 0u; + /* wolfTrust maps guest 0 to wolfHSM client namespace 1. */ + g_comm_cfg.client_id = 1u; g_client_cfg.comm = &g_comm_cfg; diff --git a/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c b/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c index 0f4fabc9..17e92ec5 100644 --- a/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c +++ b/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c @@ -25,11 +25,9 @@ #include "wolfssl/wolfcrypt/settings.h" #include "wolfssl/wolfcrypt/random.h" -#include "wolfssl/wolfcrypt/cryptocb.h" #include "wolfhsm/wh_error.h" #include "wolfhsm/wh_client.h" -#include "wolfhsm/wh_client_cryptocb.h" #include #include "wolfpsa/psa_engine.h" @@ -42,7 +40,6 @@ /* wolfHSM client glue (module/wolfhsm-client/src/wolfhsm_client_glue.c). */ int wolfhsm_guest_init(void); -int wolfhsm_guest_cryptocb(int devId, wc_CryptoInfo *info, void *ctx); whClientContext *wolfhsm_guest_client(void); int wolftrust_guest_rng_stub(unsigned char *output, unsigned int sz); @@ -376,8 +373,8 @@ static void run_ffm_negatives(void) } /* Bring up the single mediated crypto path: the wolfHSM client over the - * SPM-mediated psa_call transport, its cryptocb registered on WH_DEV_ID, and - * wolfPSA threading that devId through wolfCrypt — exactly guest0's wiring, + * SPM-mediated psa_call transport registers WH_DEV_ID during client init, and + * wolfPSA threads that devId through wolfCrypt, exactly guest0's wiring, * minus the Zephyr SYS_INIT hooks it does not have. */ static int guest_crypto_init(void) { @@ -392,11 +389,6 @@ static int guest_crypto_init(void) uart_put_i32((int32_t)rc); uart_puts("\r\n"); } - rc = wc_CryptoCb_RegisterDevice(WH_DEV_ID, wolfhsm_guest_cryptocb, NULL); - if (rc != 0) { - uart_puts("freertos_guest1: cryptocb register FAILED\r\n"); - return -1; - } (void)wolfPSA_SetDefaultDevID(WH_DEV_ID); /* PSA requires psa_crypto_init before any other psa_* call; guest0 gets * this from wolfPSA's Zephyr SYS_INIT, the bare FreeRTOS guest does it diff --git a/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_client_glue.c b/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_client_glue.c index be7ac5de..146bb388 100644 --- a/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_client_glue.c +++ b/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_client_glue.c @@ -33,16 +33,16 @@ #include "wolfhsm/wh_comm.h" #include "wolfhsm/wh_client.h" #include "wolfhsm/wh_client_crypto.h" -#include "wolfhsm/wh_client_cryptocb.h" - -#include "wolfssl/wolfcrypt/cryptocb.h" - #include "wolftrust/hsm_psa_transport.h" /* SERVICE_HSM from the platform manifest (port/stm32h563/manifest.json). */ #define WT_SERVICE_HSM_SID 4102u #define WT_SERVICE_HSM_VERSION 1u +#ifndef WT_WOLFHSM_CLIENT_ID +#define WT_WOLFHSM_CLIENT_ID 1u +#endif + static wt_hsm_psa_transport_ctx_t g_guest_tx; static const wt_hsm_psa_transport_cfg_t g_guest_tx_cfg = { @@ -64,7 +64,7 @@ int wolfhsm_guest_init(void) g_comm_cfg.transport_cb = &wt_hsm_psa_transport_cb; g_comm_cfg.transport_context = &g_guest_tx; g_comm_cfg.transport_config = &g_guest_tx_cfg; - g_comm_cfg.client_id = 0u; + g_comm_cfg.client_id = WT_WOLFHSM_CLIENT_ID; g_client_cfg.comm = &g_comm_cfg; @@ -82,9 +82,8 @@ whClientContext *wolfhsm_guest_client(void) return &g_client_ctx; } -/* Boot can race a Secure Partition restart window (the SPM refuses connects - * while the relay recovers), so one failed init must not be terminal — - * heal on demand by retrying the connect on the next crypto request. */ +/* Retry initialization for the direct RNG hook if early initialization did + * not complete. */ static int wolfhsm_guest_ensure_ready(void) { if (g_client_ready != 0) { @@ -93,15 +92,6 @@ static int wolfhsm_guest_ensure_ready(void) return wolfhsm_guest_init(); } -int wolfhsm_guest_cryptocb(int devId, wc_CryptoInfo *info, void *ctx) -{ - (void)ctx; - if (wolfhsm_guest_ensure_ready() != WH_ERROR_OK) { - return CRYPTOCB_UNAVAILABLE; - } - return wh_Client_CryptoCb(devId, info, &g_client_ctx); -} - int wolftrust_guest_rng_stub(unsigned char *output, unsigned int sz) { if (output == NULL && sz != 0u) { diff --git a/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_zephyr_init.c b/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_zephyr_init.c index ee021584..50f6bef7 100644 --- a/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_zephyr_init.c +++ b/tests/firmware/zephyr-stm32h5/module/wolfhsm-client/src/wolfhsm_zephyr_init.c @@ -20,45 +20,33 @@ /* Zephyr SYS_INIT wrapper for the wolfTrust wolfHSM client. Brings up the * client at POST_KERNEL so SYS_INIT consumers running later (wolfPSA's own - * init, an app's main()) find wc_CryptoCb_RegisterDevice() already done - * and the secure-side server reachable. */ + * init, an app's main()) find the wolfHSM client initialized and the + * secure-side server reachable. */ #include -#include #include #include "wolfhsm/wh_error.h" #include "wolfhsm/wh_client.h" -#include "wolfhsm/wh_client_cryptocb.h" - -#include "wolfssl/wolfcrypt/cryptocb.h" LOG_MODULE_REGISTER(wolftrust_wolfhsm_client, LOG_LEVEL_INF); int wolfhsm_guest_init(void); -int wolfhsm_guest_cryptocb(int devId, wc_CryptoInfo *info, void *ctx); -whClientContext *wolfhsm_guest_client(void); static int wolftrust_wolfhsm_client_sys_init(void) { int rc; - /* Boot can race a Secure Partition restart window; the glue cryptocb - * heals by retrying the connect on demand, so a failed init here is a - * warning, not a terminal error. */ rc = wolfhsm_guest_init(); if (rc != WH_ERROR_OK) { - LOG_WRN("wolfhsm_guest_init rc=%d (will retry on demand)", rc); + LOG_ERR("wolfhsm_guest_init failed rc=%d", rc); + return rc; } - rc = wc_CryptoCb_RegisterDevice(WH_DEV_ID, wolfhsm_guest_cryptocb, NULL); - if (rc != 0) { - LOG_ERR("wc_CryptoCb_RegisterDevice failed rc=%d", rc); - return -EIO; - } + /* wh_Client_Init() registers the crypto callback. */ /* wolfCrypt's "default devId" (wc_CryptoCb_DefaultDevID) returns the * first registered crypto_cb device; with WH_DEV_ID being the only - * device we register, that's already WH_DEV_ID. wolfPSA threads its + * device wolfHSM registers, that's already WH_DEV_ID. wolfPSA threads its * own runtime-settable devId via wolfPSA_SetDefaultDevID() — done in * the wolfpsa module's SYS_INIT hook. */ diff --git a/tests/firmware/zephyr-stm32h5/scripts/build_freertos_guest.sh b/tests/firmware/zephyr-stm32h5/scripts/build_freertos_guest.sh index 5e816bc2..9b872dc5 100755 --- a/tests/firmware/zephyr-stm32h5/scripts/build_freertos_guest.sh +++ b/tests/firmware/zephyr-stm32h5/scripts/build_freertos_guest.sh @@ -152,6 +152,7 @@ CFLAGS="\ -DWOLFHSM_CFG \ -DWOLF_CRYPTO_CB \ -DWT_ENGINE_HSM=1 \ +-DWT_WOLFHSM_CLIENT_ID=2 \ -DWC_RESEED_INTERVAL=1000000 \ -include ${SUBTREE_DIR}/module/wolfpsa/wolfpsa_no_trace.h \ -DWOLFSSL_SP_ASM -DWOLFSSL_SP_ARM_CORTEX_M_ASM -DWOLFSSL_ARM_ARCH=8 \ diff --git a/tests/host/attestation_iak/main.c b/tests/host/attestation_iak/main.c index 14c1e6b3..2f19d57a 100644 --- a/tests/host/attestation_iak/main.c +++ b/tests/host/attestation_iak/main.c @@ -67,7 +67,7 @@ #define WT_GUEST_CLIENT_ID 1u #define RAMSIM_SIZE (64u * 1024u) #define RAMSIM_SECTOR (4u * 1024u) -#define RAMSIM_PAGE 8u +#define RAMSIM_PAGE WOLFHSM_CFG_FLASH_UNIT_SIZE typedef union { uint64_t align; @@ -320,23 +320,20 @@ int main(void) int verified = 0; int pubInited = 0; int ret; + static whFlashRamsimCtx ramsim_ctx; + static whFlashRamsimCfg ramsim_cfg; + static const whFlashCb ramsim_cb[1] = {WH_FLASH_RAMSIM_CB}; (void)memset(g_flash_memory, 0xFF, sizeof(g_flash_memory)); (void)memset(&g_nvm_flash_cfg, 0, sizeof(g_nvm_flash_cfg)); - { - static whFlashRamsimCtx ramsim_ctx; - static whFlashRamsimCfg ramsim_cfg; - static const whFlashCb ramsim_cb[1] = {WH_FLASH_RAMSIM_CB}; - - ramsim_cfg.memory = g_flash_memory; - ramsim_cfg.size = RAMSIM_SIZE; - ramsim_cfg.sectorSize = RAMSIM_SECTOR; - ramsim_cfg.pageSize = RAMSIM_PAGE; - ramsim_cfg.erasedByte = 0xFF; - g_nvm_flash_cfg.cb = ramsim_cb; - g_nvm_flash_cfg.context = &ramsim_ctx; - g_nvm_flash_cfg.config = &ramsim_cfg; - } + ramsim_cfg.memory = g_flash_memory; + ramsim_cfg.size = RAMSIM_SIZE; + ramsim_cfg.sectorSize = RAMSIM_SECTOR; + ramsim_cfg.pageSize = RAMSIM_PAGE; + ramsim_cfg.erasedByte = 0xFF; + g_nvm_flash_cfg.cb = ramsim_cb; + g_nvm_flash_cfg.context = &ramsim_ctx; + g_nvm_flash_cfg.config = &ramsim_cfg; g_nvm_cfg.cb = g_nvm_cb; g_nvm_cfg.context = &g_nvm_flash_ctx; g_nvm_cfg.config = &g_nvm_flash_cfg; diff --git a/tests/host/ffm_veneer/Makefile b/tests/host/ffm_veneer/Makefile index 3701e628..7d578807 100644 --- a/tests/host/ffm_veneer/Makefile +++ b/tests/host/ffm_veneer/Makefile @@ -48,6 +48,8 @@ _WT_SRCS := \ _WC_SRCS := \ $(WOLFSSL)/wolfcrypt/src/sha256.c \ $(WOLFSSL)/wolfcrypt/src/random.c \ + $(WOLFSSL)/wolfcrypt/src/tfm.c \ + $(WOLFSSL)/wolfcrypt/src/wolfmath.c \ $(WOLFSSL)/wolfcrypt/src/memory.c \ $(WOLFSSL)/wolfcrypt/src/error.c \ $(WOLFSSL)/wolfcrypt/src/logging.c \ diff --git a/tests/host/psa_ffm_client/Makefile b/tests/host/psa_ffm_client/Makefile index 29738796..b3209299 100644 --- a/tests/host/psa_ffm_client/Makefile +++ b/tests/host/psa_ffm_client/Makefile @@ -53,6 +53,8 @@ _CLIENT_SRCS := \ _WC_SRCS := \ $(WOLFSSL)/wolfcrypt/src/sha256.c \ $(WOLFSSL)/wolfcrypt/src/random.c \ + $(WOLFSSL)/wolfcrypt/src/tfm.c \ + $(WOLFSSL)/wolfcrypt/src/wolfmath.c \ $(WOLFSSL)/wolfcrypt/src/memory.c \ $(WOLFSSL)/wolfcrypt/src/error.c \ $(WOLFSSL)/wolfcrypt/src/logging.c \ diff --git a/tests/host/wolfhsm_loopback/test_loopback.c b/tests/host/wolfhsm_loopback/test_loopback.c index b8d5ed10..e5a8977a 100644 --- a/tests/host/wolfhsm_loopback/test_loopback.c +++ b/tests/host/wolfhsm_loopback/test_loopback.c @@ -459,15 +459,6 @@ int main(void) return 1; } - /* Register wolfHSM as a crypto callback device so wolfCrypt operations - * on WH_DEV_ID are forwarded to the server */ - rc = wc_CryptoCb_RegisterDevice((int)WH_DEV_ID, - wh_Client_CryptoCb, client); - if (rc != 0) { - fprintf(stderr, "wc_CryptoCb_RegisterDevice: %d\n", rc); - return 1; - } - /* === Run tests ========================================================= */ rc = test_rng(client, server); if (rc != 0) { From 54ea637b3dfb88ca9e514d96dc99e200559d6368 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Fri, 18 Sep 2026 20:51:06 -0700 Subject: [PATCH 2/2] Fix wolfHSM pin integration and CI compatibility Use separate wolfHSM client IDs for the two bare-metal guests and adapt the cross-namespace probe to the pinned receive API. Exercise the IAK host suite with both 8-byte and 16-byte flash units, and keep auto-pin releases gated on the temporary wolfHSM PR commit. --- .github/workflows/auto-pin-dependencies.yml | 2 +- docs/Testing.md | 2 ++ tests/firmware/stm32h563/nonsecure/guest.c | 4 ++-- .../stm32h563/nonsecure/wolfhsm_client_glue.c | 15 +++++++++++---- .../zephyr-stm32h5/apps/guest0_psa/src/main.c | 4 ++-- tests/host/attestation_iak/Makefile | 11 +++++++++-- 6 files changed, 27 insertions(+), 11 deletions(-) diff --git a/.github/workflows/auto-pin-dependencies.yml b/.github/workflows/auto-pin-dependencies.yml index c5a78f5a..35c5ed1c 100644 --- a/.github/workflows/auto-pin-dependencies.yml +++ b/.github/workflows/auto-pin-dependencies.yml @@ -38,7 +38,7 @@ jobs: # fork-only runtime-devId/device-ID changes. specs=( "lib/wolfSSL|https://github.com/wolfSSL/wolfSSL.git|v*-stable|51975e27a5439668733976a584d417dfd7776026" - "lib/wolfHSM|https://github.com/wolfSSL/wolfHSM.git|wolfHSM-v*|a0323156606282448f00473a3fcb7aaa69361921" + "lib/wolfHSM|https://github.com/wolfSSL/wolfHSM.git|wolfHSM-v*|97dbbd72ad2bf757279d7dc5101580290525c647" "lib/wolfIP|https://github.com/wolfSSL/wolfIP.git|v*|" ) diff --git a/docs/Testing.md b/docs/Testing.md index 1300aa9b..d92c6b40 100644 --- a/docs/Testing.md +++ b/docs/Testing.md @@ -32,6 +32,8 @@ vectors, Secure Partition layout and recovery, HSM relay and key isolation, vault and storage services, attestation and COSE integration, firmware update, runtime remeasurement, VNET, public PSA headers, boot-handoff record consumption, and negative paths. +The attestation IAK suite runs wolfHSM NVM with both the default 8-byte and +STM32H5 16-byte flash programming units. Additional host checks: diff --git a/tests/firmware/stm32h563/nonsecure/guest.c b/tests/firmware/stm32h563/nonsecure/guest.c index cc874270..d8a514b8 100644 --- a/tests/firmware/stm32h563/nonsecure/guest.c +++ b/tests/firmware/stm32h563/nonsecure/guest.c @@ -35,7 +35,7 @@ #define WT_ALIGNED_WORD __attribute__((aligned(4))) -int wolfhsm_guest_init(void); +int wolfhsm_guest_init(uint32_t client_id); int wolfcrypt_benchmark_main(int argc, char** argv); /* Static buffers to keep large structs off the stack. */ @@ -878,7 +878,7 @@ static void run_hsm_selftest(void) uint32_t bench_i; /* --- Step 1: Init wolfHSM client --- */ - rc = wolfhsm_guest_init(); + rc = wolfhsm_guest_init(wt_guest_id() + 1u); if (rc != 0) { wt_uart_putc('g'); wt_uart_put_u32(wt_guest_id()); diff --git a/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c b/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c index a312e4f9..04819e74 100644 --- a/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c +++ b/tests/firmware/stm32h563/nonsecure/wolfhsm_client_glue.c @@ -68,6 +68,7 @@ static whClientContext g_client_ctx; static whClientConfig g_client_cfg; static whCommClientConfig g_comm_cfg; static int g_client_ready; +static uint32_t g_client_id; /* --------------------------------------------------------------------------- * Public API @@ -78,17 +79,21 @@ static int g_client_ready; * Call this once from Reset_Handler (or equivalent early-init code) after * .data/.bss are ready. wc_* calls will be routed to the secure HSM once * this returns WH_ERROR_OK. */ -int wolfhsm_guest_init(void) +int wolfhsm_guest_init(uint32_t client_id) { int rc; + if (client_id == 0u) { + return WH_ERROR_BADARGS; + } + g_client_ready = 0; + g_client_id = client_id; g_comm_cfg.transport_cb = &wt_hsm_psa_transport_cb; g_comm_cfg.transport_context = &g_guest_tx; g_comm_cfg.transport_config = &g_guest_tx_cfg; - /* wolfTrust maps guest 0 to wolfHSM client namespace 1. */ - g_comm_cfg.client_id = 1u; + g_comm_cfg.client_id = g_client_id; g_client_cfg.comm = &g_comm_cfg; @@ -125,7 +130,9 @@ int wolftrust_guest_rng_stub(unsigned char *output, unsigned int sz) } /* Boot can race a Secure Partition restart window; one failed init must * not be terminal — retry the connect on demand. */ - if (g_client_ready == 0 && wolfhsm_guest_init() != WH_ERROR_OK) { + if (g_client_ready == 0 && + (g_client_id == 0u || + wolfhsm_guest_init(g_client_id) != WH_ERROR_OK)) { return -1; } diff --git a/tests/firmware/zephyr-stm32h5/apps/guest0_psa/src/main.c b/tests/firmware/zephyr-stm32h5/apps/guest0_psa/src/main.c index c40c9616..0440d2ad 100644 --- a/tests/firmware/zephyr-stm32h5/apps/guest0_psa/src/main.c +++ b/tests/firmware/zephyr-stm32h5/apps/guest0_psa/src/main.c @@ -574,10 +574,10 @@ static void exercise_hsm_attack_probe(void) rc = wh_Client_SendRequest(ctx, WH_MESSAGE_GROUP_NVM, WH_MESSAGE_NVM_ACTION_READ, (uint16_t)sizeof(nvmbuf), nvmbuf); if (rc == WH_ERROR_OK) { - rSize = (uint16_t)sizeof(nvmbuf); guard2 = 1000; do { - rc = wh_Client_RecvResponse(ctx, &rGroup, &rAction, &rSize, nvmbuf); + rc = wh_Client_RecvResponse(ctx, &rGroup, &rAction, &rSize, + (uint16_t)sizeof(nvmbuf), nvmbuf); } while (rc == WH_ERROR_NOTREADY && guard2-- > 0); } if (rc != WH_ERROR_OK) { diff --git a/tests/host/attestation_iak/Makefile b/tests/host/attestation_iak/Makefile index 9426d774..b4fcfe43 100644 --- a/tests/host/attestation_iak/Makefile +++ b/tests/host/attestation_iak/Makefile @@ -136,7 +136,7 @@ $(BUILD_DIR)/%.o: %.c | $(BUILD_DIR) # --------------------------------------------------------------------------- # Targets # --------------------------------------------------------------------------- -.PHONY: all run compilers sanitize valgrind clean +.PHONY: all run run-one compilers sanitize valgrind clean all: $(TEST_BIN) @@ -144,8 +144,15 @@ $(TEST_BIN): $(ALL_OBJS) | $(BUILD_DIR) $(CC) $(CFLAGS) $(EXTRA_LDFLAGS) -o $@ $(ALL_OBJS) -lm run: $(TEST_BIN) + @echo "RUN: attestation_iak (default 8-byte flash unit)" + $(TEST_BIN) + @echo "RUN: attestation_iak (16-byte flash unit)" + $(MAKE) --no-print-directory run-one \ + BUILD_DIR=$(BUILD_DIR)-16 \ + EXTRA_CFLAGS="$(EXTRA_CFLAGS) -DWOLFHSM_CFG_FLASH_UNIT_SIZE=16" + +run-one: $(TEST_BIN) $(TEST_BIN) - @exit $$? compilers: $(MAKE) clean run CC=gcc BUILD_DIR=$(BUILD_DIR)/gcc