mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
536421bb92
Routes wolfCrypt through the on-chip EdgeLock subsystem (ELS) on RW612 via the crypto callback interface, with SHA-256 as the first offloaded primitive. Anything the hardware does not implement declines to software, so enabling the port never removes functionality. Three properties of the hardware shape the design. ELS is one peripheral with global busy state: every operation is an _Async call followed by a wait, and nothing may start between the two, so one lock is held across each pair. ELS answers a rejected request by signalling the tamper controller, which resets the SoC, rather than by returning an error. Validation therefore happens in software before the call: getting it wrong reboots the device. mcuxClEls_WaitForOperation() busy-spins with no timeout, and would do so holding that lock. Completion is taken from the ELS interrupt instead, wired with IRQ_CONNECT because the IRQ has no devicetree node, with polling as the fallback for ISR context and for anything before the IRQ is armed. A late interrupt degrades to the synchronous wait rather than cancelling: measured, MCUXCLELS_RESET_CANCEL on an in-flight operation reboots the SoC. For SHA-256 the engine round-trips its intermediate state (hashoe writes it, hashld reloads it), so the state lives in the caller's wc_Sha256 and the lock covers one call. Holding it from update to final deadlocks TLS 1.3, which keeps several transcript hashes alive at once. ELS never pads, so the port carries the residual block and appends the padding itself. Registration happens inside wolfCrypt_Init(), which is also what zeroes the callback device table. Zephyr gains CONFIG_WOLFSSL_SYS_INIT to run that at boot from POST_KERNEL rather than leaving it to whichever library call happens to be first, which starts to matter once initialization brings up a peripheral. It defaults on when the port is enabled and stays available on its own, since nothing about it is specific to this hardware. The hook calls wolfSSL_Init() so the TLS layer is initialized too, and wolfCrypt_Init() in a WOLFCRYPT_ONLY build, where wolfSSL_Init() is not compiled. The port's Kconfig symbol is restricted to SOC_SERIES_RW6XX, the only series for which els_pkc exports src/platforms/<soc>, where mcux_els.h lives.
68 lines
1.9 KiB
C
68 lines
1.9 KiB
C
/* zephyr_init.c
|
|
*
|
|
* Copyright (C) 2006-2026 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
/* Only a port that brings up a peripheral needs a boot-time hook. */
|
|
|
|
#ifdef CONFIG_WOLFSSL_SYS_INIT
|
|
|
|
#include <errno.h>
|
|
|
|
#include <zephyr/init.h>
|
|
#include <zephyr/logging/log.h>
|
|
|
|
#include <wolfssl/wolfcrypt/settings.h>
|
|
#ifdef WOLFCRYPT_ONLY
|
|
#include <wolfssl/wolfcrypt/wc_port.h>
|
|
#else
|
|
#include <wolfssl/ssl.h>
|
|
#endif
|
|
|
|
LOG_MODULE_REGISTER(wolfssl, CONFIG_WOLFSSL_LOG_LEVEL);
|
|
|
|
static int wolfssl_module_init(void)
|
|
{
|
|
int ret;
|
|
|
|
/* Zephyr hands a non-device SYS_INIT return only to a trace hook, so the
|
|
* failure would otherwise leave no evidence. */
|
|
#ifdef WOLFCRYPT_ONLY
|
|
ret = wolfCrypt_Init();
|
|
if (ret != 0) {
|
|
LOG_ERR("wolfCrypt_Init failed: %d", ret);
|
|
return -EIO;
|
|
}
|
|
#else
|
|
ret = wolfSSL_Init();
|
|
if (ret != WOLFSSL_SUCCESS) {
|
|
LOG_ERR("wolfSSL_Init failed: %d", ret);
|
|
return -EIO;
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* POST_KERNEL because initialization takes mutexes and may allocate, late
|
|
* within it because a port needs the SoC and clock init that runs there. */
|
|
SYS_INIT(wolfssl_module_init, POST_KERNEL, 99);
|
|
|
|
#endif /* CONFIG_WOLFSSL_SYS_INIT */
|