Generic cryptocb support

.github/workflows/test-cryptocb-simulator.yml

@@ -0,0 +1,242 @@
+name: test simulator with crypto callback (cryptocb)
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  cryptocb_simulator_tests:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfboot-ci-sim:v1.0
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Trust workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      # 64 bit simulator, cryptocb enabled
+      #
+      - name: make clean
+        run: |
+          make keysclean
+
+      - name: Select config (64 bit simulator)
+        run: |
+          cp config/examples/sim.config .config
+
+      - name: Build tools
+        run: |
+          make -C tools/keytools && make -C tools/bin-assemble
+
+      # Classical algorithms (each tested once with SPMATH=1)
+      # Note: ECC uses wc_ecc_verify_hash_ex which bypasses cryptocb PK dispatch,
+      # so we only verify hash for ECC. ED25519 and RSA dispatch PK through cryptocb.
+      #
+      - name: Build wolfboot.elf (ED25519, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ED25519 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ED25519)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ECC256, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ECC256 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ECC256)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ECC384, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ECC384)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ECC521, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ECC521 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ECC521)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSA2048, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSA2048 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (RSA2048)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSA3072, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSA3072 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (RSA3072)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSA4096, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (RSA4096)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
+
+      # SHA-384 hash coverage (paired with algorithms that naturally use 384-bit)
+      #
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ECC384 + SHA384, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ECC384 + SHA384)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384"
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSA4096 + SHA384, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (RSA4096 + SHA384)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384" "RSA"
+
+      # SHA3-384 hash coverage
+      #
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ECC384 + SHA3-384, cryptocb)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA3 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ECC384 + SHA3-384)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA3-384"
+
+      # AES encrypted partition coverage (external flash + AES128-CTR)
+      #
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (ED25519 + AES128 encrypt, cryptocb)
+        run: |
+          cp config/examples/sim-encrypt-update.config .config
+          make clean && make test-sim-external-flash-with-enc-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run cryptocb sunnyday test (ED25519 + AES128 encrypt)
+        run: |
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify" "AES-CTR"
+
+      # PQ algorithms (each uses its own config, build + test inline)
+      #
+      - name: Build and test LMS (cryptocb)
+        run: |
+          cp config/examples/sim-lms.config .config
+          make keysclean && make clean
+          make keytools
+          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
+
+      - name: Build and test XMSS (cryptocb)
+        run: |
+          cp config/examples/sim-xmss.config .config
+          make keysclean && make clean
+          make keytools
+          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
+
+      - name: Build and test ML-DSA level 2 (cryptocb)
+        run: |
+          cp config/examples/sim-ml-dsa.config .config
+          make keysclean && make clean
+          make keytools
+          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
+
+      - name: Build and test ML-DSA level 3 (cryptocb)
+        run: |
+          cp config/examples/sim-ml-dsa3.config .config
+          make keysclean && make clean
+          make keytools
+          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
+
+      - name: Build and test ML-DSA level 5 (cryptocb)
+        run: |
+          cp config/examples/sim-ml-dsa5.config .config
+          make keysclean && make clean
+          make keytools
+          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
+          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
+
+      # Hybrid auth: ML_DSA + ECDSA
+      #
+      - name: make clean (hybrid)
+        run: |
+          make keysclean
+
+      - name: Select config (hybrid ML_DSA + ECC)
+        run: |
+          cp config/examples/sim-ml-dsa-ecc-hybrid.config .config
+
+      - name: Build tools (hybrid)
+        run: |
+          make -C tools/keytools && make -C tools/bin-assemble
+
+      - name: Build wolfboot.elf (hybrid, cryptocb)
+        run: |
+          make clean && make WOLFBOOT_TEST_SIM_CRYPTOCB=1
+
+      - name: Run hybrid boot test with cryptocb verification
+        run: |
+          ./wolfboot.elf get_version > sim_cryptocb.log 2>/dev/null
+          grep -q "sim-cryptocb: hash SHA-256" sim_cryptocb.log || (echo "hash SHA-256 not found" && cat sim_cryptocb.log && exit 1)
+          grep -q "sim-cryptocb: pk ML-DSA-verify" sim_cryptocb.log || (echo "pk ML-DSA-verify not found" && cat sim_cryptocb.log && exit 1)
+          echo "Hybrid cryptocb verification passed"

IDE/Renesas/e2studio/RA6M4/wolfBoot/user_settings.h

@@ -60,6 +60,9 @@
 #   define WOLF_CRYPTO_CB
 #   define RENESAS_SCE_INSTALLEDKEY_ADDR 0x08001000U
 #   define SCE_ID 7890
+#   define RENESAS_DEVID SCE_ID
+#   define WOLFBOOT_DEVID_PUBKEY SCE_ID
+#   define WOLFBOOT_DEVID_CRYPT (SCE_ID + 1)
 #   undef  VECTOR_Reset_Handler
 #   define VECTOR_Reset_Handler ((uint32_t *)(0x20204))
 ...

IDE/Renesas/e2studio/RX72N/include/user_settings.h

@@ -42,6 +42,8 @@
 #   define WOLF_CRYPTO_CB
 #   define RENESAS_TSIP_INSTALLEDKEY_ADDR 0xFFFF0000
 #   define RENESAS_DEVID 7890
+#   define WOLFBOOT_DEVID_PUBKEY RENESAS_DEVID
+#   define WOLFBOOT_DEVID_CRYPT (RENESAS_DEVID + 1)
 #else
     #define WOLFBOOT_SIGN_RSA2048
     /* #define WOLFBOOT_SIGN_RSA3072 */

IDE/Renesas/e2studio/RZN2L/user_settings.h

@@ -56,6 +56,8 @@
     #define RENESAS_RSIP_INSTALLEDKEY_FLASH_ADDR  0x60200000
     #define RENESAS_RSIP_INSTALLEDKEY_RAM_ADDR    0x10000100
     #define RENESAS_DEVID 7890
+    #define WOLFBOOT_DEVID_PUBKEY RENESAS_DEVID
+    #define WOLFBOOT_DEVID_CRYPT (RENESAS_DEVID + 1)
 
     #if defined(WOLFBOOT_SIGN_RSA3072) ||\
         defined(WOLFBOOT_SIGN_RSA4096) ||\

arch.mk

@@ -504,6 +504,8 @@ ifeq ($(ARCH),RENESAS_RX)
 
   ifeq ($(PKA),1)
     CFLAGS+=-DWOLFBOOT_RENESAS_TSIP
+    CFLAGS+=-DWOLFBOOT_DEVID_PUBKEY=7890
+    CFLAGS+=-DWOLFBOOT_DEVID_CRYPT=7891
     RX_DRIVER_PATH?=./lib
 
     OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/cryptocb.o \
@@ -1566,7 +1568,7 @@ ifeq ($(ARCH), AURIX_TC3)
     endif
 
     ifeq ($(AURIX_TC3_HSM),1)
-      ARCH_FLASH_OFFSET=0x80028000
+      ARCH_FLASH_OFFSET?=0x80028000
       # HSM compiler flags, build options, source code, etc
       ifeq ($(USE_GCC),1)
         # Just arm-none-eabi-gcc for now
@@ -1612,15 +1614,13 @@ ifeq ($(ARCH), AURIX_TC3)
           $(WOLFHSM_INFINEON_TC3XX)/port/server/io.o \
           $(WOLFHSM_INFINEON_TC3XX)/port/server/sysmem.o \
           $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_hh_hsm.o \
-          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_utils.o
-
-        # SW only for now, as we dont have the right protection macros
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/ccb_hsm.o \
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_hash.o \
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_aes.o \
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_cmac.o \
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_pk.o \
-        #$(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_trng.o
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_utils.o\
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/ccb_hsm.o \
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_hash.o \
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_aes.o \
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_cmac.o \
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_pk.o \
+          $(WOLFHSM_INFINEON_TC3XX)/port/server/tchsm_trng.o
       endif
 
       # HSM BSP specific object files
@@ -1635,7 +1635,7 @@ ifeq ($(ARCH), AURIX_TC3)
 
     else
       # Tricore compiler settings
-      ARCH_FLASH_OFFSET=0x800A0000
+      ARCH_FLASH_OFFSET?=0x800A0000
       ifeq ($(USE_GCC),1)
         HT_ROOT?=/opt/hightec/gnutri_v4.9.4.1-11fcedf-lin64
         CROSS_COMPILE?=$(HT_ROOT)/bin/tricore-

config/examples/aurix-tc375-ecc.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 
 ARCH_FLASH_OFFSET=0x800A0000
 WOLFBOOT_SECTOR_SIZE=0x4000

config/examples/aurix-tc375-elf-ecc.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 
 # ELF loading specific configuration
 ELF=1

config/examples/aurix-tc375-elf-wolfHSM-certs-ecc.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 
 # wolfHSM options
 WOLFHSM_CLIENT=1

config/examples/aurix-tc375-elf-wolfHSM-certs-rsa4096.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 
 # wolfHSM options
 WOLFHSM_CLIENT=1
@@ -34,6 +35,10 @@ IMAGE_HEADER_SIZE=4096
 ARCH_FLASH_OFFSET=0x800A0000
 WOLFBOOT_SECTOR_SIZE=0x4000
 
+# self-header feature (persist header in external flash)
+WOLFBOOT_SELF_HEADER=1
+SELF_HEADER_EXT=1
+
 # ELF memory partitioning (same PFLASH1 space as standard wolfBoot):
 # Standard wolfBoot uses 0x80300000-0x80600000 (3MB) for BOOT+UPDATE+SWAP
 # ELF mode splits this same space into EXEC+BOOT+UPDATE+SWAP:
@@ -43,10 +48,11 @@ WOLFBOOT_SECTOR_SIZE=0x4000
 # - SWAP sector:      0x805FC000 (16KB) - for atomic updates
 
 # ELF storage partitions (where signed ELF files are stored)
+WOLFBOOT_PARTITION_SIZE=0xC0000
+WOLFBOOT_PARTITION_SELF_HEADER_ADDRESS=0x80240000
 WOLFBOOT_PARTITION_BOOT_ADDRESS=0x8047C000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x8053C000
 WOLFBOOT_PARTITION_SWAP_ADDRESS=0x805FC000
-WOLFBOOT_PARTITION_SIZE=0xC0000
 
 # ELF execution space (where test app runs after scatter loading)
 # Uses the same space that would be the BOOT partition in standard mode

config/examples/aurix-tc375-elf-wolfHSM-ecc.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 WOLFHSM_CLIENT=1
 
 # ELF loading specific configuration

config/examples/aurix-tc375-hsm-ecc.config

@@ -16,6 +16,7 @@ FLAGS_INVERT=1
 FLASH_MULTI_SECTOR_ERASE=1
 DEBUG_UART=1
 PRINTF_ENABLED=1
+WOLFBOOT_IMG_HASH_ONESHOT=1
 
 ARCH_FLASH_OFFSET=0x80028000
 WOLFBOOT_SECTOR_SIZE=0x4000