add support for microchip pic32cz wolfHSM client + improvements#826
Draft
rizlik wants to merge 3 commits into
Draft
add support for microchip pic32cz wolfHSM client + improvements#826rizlik wants to merge 3 commits into
rizlik wants to merge 3 commits into
Conversation
Four fixes needed by any wolfHSM client - include/user_settings.h emitted "typedef struct WC_RNG WC_RNG;" whenever WOLF_CRYPTO_CB && WC_NO_RNG, with no __ASSEMBLER__ guard, so a client built with ARM thumb2 assembly failed to assemble wolfSSL's .S sources. Guard it. - options.mk hardcoded WOLFHSM_CFG_COMM_DATA_LEN=5000 for every client. Make it a variable (default unchanged) so ports whose transport slot is smaller can override it. - options.mk gated DEBUG_UART on the existence of the driver *object*, which never exists on a clean tree, so DEBUG_UART was dropped on the very build meant to enable it. Test for the source instead. - Makefile unconditionally built an NVM key image with whnvmtool for WOLFHSM_CLIENT=1. Add WOLFHSM_NVM_IMAGE=0 for ports that install the verification key at boot instead.
Run wolfBoot on the PIC32CZ CA9x host core (Cortex-M7) as a wolfHSM client, offloading the image digest (SHA-256) and the ECDSA P-256 signature check to the wolfHSM server.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds PIC32CZ (CA9x) support for running wolfBoot as a wolfHSM client (M7 host core talking to M0+ HSM core), plus build/config improvements for UART debug and wolfHSM buffer sizing.
Changes:
- Add PIC32CZ wolfHSM client integration in the HAL and a new example config.
- Add a PIC32CZ SERCOM1 UART debug driver and hook it into the pic32cz test-app build.
- Improve build configurability for wolfHSM comm payload sizing and optional NVM image generation; update docs to list PIC32CZ wolfHSM support.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/scripts/der2c.sh | New helper to emit DER blobs as C arrays for embedding keys. |
| test-app/Makefile | Links PIC32CZ UART driver object only when DEBUG_UART=1. |
| test-app/app_pic32cz.c | Adds UART status prints based on booted firmware version. |
| options.mk | Fix DEBUG_UART driver detection; introduce configurable WOLFHSM_CFG_COMM_DATA_LEN. |
| Makefile | PIC32CZ main targets; allow skipping wolfHSM NVM image generation. |
| include/user_settings.h | Avoid typedef under __ASSEMBLER__ for ARM .S sources. |
| hal/uart/uart_drv_pic32cz.c | New PIC32CZ SERCOM1 UART driver (TX-only). |
| hal/pic32cz.c | Add DEBUG_UART init/print; add wolfHSM client connect/disconnect + optional pubkey import. |
| docs/wolfHSM.md | Document PIC32CZ as a supported wolfHSM platform. |
| docs/Targets.md | Add PIC32CZ + wolfHSM target documentation. |
| config/examples/pic32cz-wolfHSM.config | New example configuration for PIC32CZ wolfHSM client. |
| arch.mk | PIC32CZ wolfHSM client port integration and optional HSM firmware/pubkey header wiring. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| #if defined(TARGET_pic32cz) | ||
|
|
||
| extern void uart_write(const char* buf, unsigned int len); |
Comment on lines
+63
to
+69
| if (boot_version >= 2) { | ||
| static const char m[] = "APP: booted, verified firmware v2 (update applied)\r\n"; | ||
| uart_write(m, sizeof(m) - 1); | ||
| } else { | ||
| static const char m[] = "APP: booted, verified firmware v1\r\n"; | ||
| uart_write(m, sizeof(m) - 1); | ||
| } |
Comment on lines
+33
to
+44
| DER="$1" | ||
| SYM="$2" | ||
|
|
||
| if [ ! -r "$DER" ]; then | ||
| echo "$0: cannot read $DER" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "/* Generated from $(basename "$DER") by tools/scripts/der2c.sh. Do not edit. */" | ||
| echo "#ifndef WOLFBOOT_GEN_$(echo "$SYM" | tr '[:lower:]' '[:upper:]')_H" | ||
| echo "#define WOLFBOOT_GEN_$(echo "$SYM" | tr '[:lower:]' '[:upper:]')_H" | ||
| echo "" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.