Adds new STM32 Bare support for Hash, SAES/AES and PKA by dgarske · Pull Request #10395 · wolfSSL/wolfssl

dgarske · 2026-05-04T23:16:08Z

Adds a new WOLFSSL_STM32_BARE build flag that enables direct-register
access to the STM32 crypto, hash, RNG and PKA peripherals using only
CMSIS (no CubeMX HAL, no Standard Peripheral Library). Lets wolfCrypt
link into HAL-free firmware against the chip's CMSIS device header
alone.

WOLFSSL_STM32_BARE is opt-in, off by default, and mutually exclusive
with WOLFSSL_STM32_CUBEMX. Existing CubeMX HAL and StdPeriph builds
are unchanged.

Features

Direct-register HASH driver

HW SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256.
Context save / restore for interleaved multi-stream hashing.
Optional HW HMAC (STM32_HMAC) on families with HMAC mode.
New-generation HASH IP (4-bit ALGO field on H5/U3/N6/C5/MP13/H7S)
auto-detected via the CMSIS device header.

Direct-register AES driver

Legacy fat-CRYP path (F4 / F7 / H7) with CR.ALGOMODE, DINR/DOUTR
FIFOs.
TinyAES path (H5 / U5 / U3 / WBA / C5 / L5 / L4 / G4 / G0 / WL / WB)
with single-CR-write enable, KEYR + IVR + DINR + DOUTR poll.
AES-CBC, AES-CTR (via ECB-as-transform), AES-GCM HW-native where the
silicon supports it (STM32_CRYPTO_AES_GCM), AES-CCM.
Build-time IP selector WC_STM32_AES_INST: defaults to CRYP, routes
to SAES when WOLFSSL_STM32_USE_SAES is set.
AES_CR_* <- SAES_CR_* alias block for SAES-only chips (N6 device
header defines SAES_CR_* only).

Direct-register SAES + DHUK

New WOLFSSL_DHUK umbrella flag, family-gated on H5 / U3 / U5 / WBA / C5.
Existing WOLFSSL_STM32U5_DHUK continues to work via macro alias.
wc_Stm32_Aes_Wrap / wc_Stm32_Aes_DhukOp for SAES key-wrap-with-
silicon-bound-DHUK.
New wc_Stm32_Aes_SetDHUK_IV for the matching unwrap IV.
Shared Stm32SaesWaitInit / Stm32SaesEnsureRng helpers (drain the
SAES post-clock-enable BUSY phase while the IP fetches seeding
entropy from the RNG).

Direct-register RNG driver

WOLFSSL_STM32_RNG_NOLIB auto-enabled under WOLFSSL_STM32_BARE.
Bounded DRDY poll with SECS / CECS recovery (clear status, toggle
RNGEN, drain pipeline reads, bounded retries). Replaces the
unbounded spin in the original NOLIB path.
New-generation C5 / H7S RNG NIST candidate-config init
(RNG_CAND_NIST_CR_VALUE + NSCR + HTCR write under CR.CONDRST),
auto-detected via CMSIS symbol presence.
Tunables: STM32_BARE_RNG_BYTE_TIMEOUT, STM32_BARE_RNG_MAX_RETRIES.
Opt-out flags: WC_STM32_RNG_NO_NIST_INIT, WC_STM32_RNG_CED_DISABLE.

Direct-register PKA driver

ECDSA sign / verify and ECC scalar multiplication via V1 and V2 PKA
microcode (V1: WB / WL / L5 / G4; V2: U3 / U5 / H5 / WBA / C5 / N6).
WOLFSSL_STM32_PKA_V2 auto-set when the device header exposes the
V2 RAM slot constants.
V2 path includes coefB and primeOrder parameter loading, double-
zero RAM-end terminator, HAL-exact write order, HAL-exact
EXP_NB_BITS (from curve order MSB).
HAL-shape wc_stm32_pka_process with PROCENDF / RAMERRF / ADDRERRF /
OPERRF status handling.

Family clock-enable macros

Per-family direct-register clock enable / disable macros for AES,
SAES, HASH, RNG, and PKA peripherals, gated on the exact CMSIS RCC
bit names each family exposes. Compile-time #error guards catch
mis-configured boards (e.g. STM32_CRYPTO enabled but no AES IP
reachable on the chip).

Diagnostics

WC_STM32_PKA_DIAG -- printf mode / CR / SR on PKA timeout or error.
WC_STM32_SAES_DIAG -- printf CR / ISR / SR on SAES CCF timeout.
WC_STM32_RNG_DIAG -- printf state on RNG init failure paths.
DEBUG_STM32_BARE_GCM -- trace HW vs SW GHASH selection.

All gated, zero cost when undefined.

Supported families

The new BARE path covers every STM32 family that has an existing
wolfCrypt port arm:

Family	Chips on the bench / validated	IPs reached by BARE
STM32F4	F437, F439	CRYP, HASH, RNG
STM32F7	F767	RNG (F767 has no HASH/CRYP)
STM32H5	H563	HASH, RNG, V2 PKA
STM32H7	H753	CRYP, HASH, RNG
STM32U0	U083 (Cortex-M0+)	AES, RNG
STM32U3	U385	TinyAES, HASH, RNG, V2 PKA, SAES, DHUK
STM32U5	U575, U585, U545	TinyAES, HASH, RNG, V2 PKA, SAES, DHUK
STM32L5	L552, L562	TinyAES, HASH, RNG, V1 PKA, SAES, DHUK
STM32G4	G491	RNG, V1 PKA
STM32WB	WB55	AES1, RNG, V1 PKA
STM32WL	WL55	TinyAES, RNG, V1 PKA
STM32WBA	WBA52	TinyAES, HASH, RNG, V2 PKA, SAES, DHUK
STM32C5	C5A3	TinyAES, HASH, RNG, V2 PKA, SAES
STM32N6	N657	CRYP, HASH, RNG, V2 PKA, SAES
STM32G0	-	AES, RNG (arm only)
STM32F1, F2, L4	-	clock-enable arms
STM32MP13, H7S	-	clock-enable arms

Build flag

Add to user_settings.h:

#define WOLFSSL_STM32_BARE

The existing per-family flags (WOLFSSL_STM32H5, WOLFSSL_STM32U5,
etc.) drive the family arm selection in stm32.h. The existing
STM32_CRYPTO, STM32_HASH, STM32_RNG enable the corresponding
HW IPs, the same way they do under the HAL path.

Copilot

Pull request overview

This PR introduces a new STM32 “bare-metal” crypto port flavor (WOLFSSL_STM32_BARE) that uses CMSIS device-header register access (no HAL/StdPeriph dependency) and wires it into wolfCrypt’s AES/HASH/RNG paths, plus a direct-register PKA implementation used by the existing STM32 PKA integration.

Changes:

Add WOLFSSL_STM32_BARE selection in settings to include only CMSIS device headers and auto-enable the no-lib RNG path.
Add per-family bare-metal clock-enable macros and HAL/PKA stand-in types to support a direct-register PKA driver.
Add bare-metal AES (CRYP + TinyAES), HASH clock enable override, and bare PKA shims/driver, plus AES dispatcher updates in aes.c and RNG clock-enable macro use in random.c.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`wolfssl/wolfcrypt/settings.h`	Adds `WOLFSSL_STM32_BARE` selection, CMSIS header includes, and mutual exclusion with CubeMX.
`wolfssl/wolfcrypt/port/st/stm32.h`	Adds BARE clock-enable macros, HASH ALGO defines for new IP, and PKA stand-in types.
`wolfcrypt/src/port/st/stm32.c`	Implements bare-metal AES (CRYP/TinyAES), HASH clock enable override, and bare-metal PKA shims/driver.
`wolfcrypt/src/aes.c`	Routes ECB/CBC/CTR and GCM-encrypt through the BARE STM32 implementation with SW fallback behavior.
`wolfcrypt/src/random.c`	Uses a per-family RNG clock-enable macro (for BARE) instead of a fixed RCC register bit.
`wolfcrypt/src/ecc.c`	Adjusts STM32 PKA guards so BARE uses SW ECDSA paths while still leveraging HW scalar mul.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-05-05T00:38:37Z

MemBrowse Memory Report

No memory changes detected for:

dgarske · 2026-05-07T21:24:50Z

Note #10307 seems to have broken AES CBC on STM32... I will put the fix into my new wolfSSL/wolfssl-examples-stm32#13

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/st/stm32.c:1

After wc_Stm32_Aes_DhukOp() completes, the unwrapped key remains resident in SAES key registers (KEYR) until overwritten by a later operation. If the platform threat model includes debug/privileged register reads or post-operation key scraping, consider explicitly clearing KEYR/CR state (or triggering any available peripheral key/CCF/error clear mechanism) before releasing the mutex. This is especially relevant because DHUK is explicitly about protecting keys at rest/in RAM.

/* stm32.c

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

dgarske · 2026-05-22T03:16:08Z

Jenkins retest this please

Adds a direct-register "BARE" path for the STM32 family alongside the existing CubeMX HAL integration. Selects via WOLFSSL_STM32_BARE + WOLFSSL_STM32_PKA. Supports a wide matrix of C0 / C5 / F2 / F3 / F4 / F7 / G0 / G4 / H5 / H7 / H7RS / L4 / L5 / N6 / U0 / U3 / U5 / WB / WBA / WL silicon. Covered: - V1 PKA (WL/G4 layout) and V2 PKA (U5/H5/N6/C5/H7RS layout) shared HAL_PKA_* shims sized for the wolfcrypt ECC / RSA / DH call sites - TinyAES-shape AES IP (L4 / L5 / U5 / U3 / H5 / H573 / G0 / G4 / WB / WL / WBA) with shared CCF-poll / IVR / KEYR helpers and a BARE GCM path that piggy-backs HW ECB for the J0 / ENC blocks - Fat CRYP IP (F4 / F7 / H7) on the existing register-level driver - SAES (H573 / U5 / U3 / N6 / WBA / C5 / H7RS) with key wrap / unwrap and DHUK ECB + CBC entry points - HASH IP (F4 / F7 / H5 / H573 / U5 / U3 / N6 / C5 / H7RS / WBA) with context save/restore and the new-gen 4-bit ALGO field - RNG (all families, NIST candidate init for C5) Debug switches WC_STM32_PKA_DIAG and WC_STM32_SAES_DIAG (off by default) print diagnostics through the board's board_putc retarget -- useful for new-board bring-up. Both are documented at the top of the BARE block in stm32.c. Five V1+V2 PKA bug fixes captured during silicon bring-up: - INITOK wait gate for V2 PKA before HAL_PKA returns - B_COEFF parameter load for ECC scalar multiplication on V2 - Success-code sentinel divergence between V1 and V2 PKA out-error - MOD_NB_BITS save / restore in the ECC_MUL flow - coefSign default handling for V1 PKA (WL55 ECC regression fix) Aes.c BARE branches in wc_AesCbcEncrypt and wc_AesCbcDecrypt route the WOLFSSL_DHUK_WRAPPED_DEVID through wc_Stm32_Aes_DhukOp_ex() with HW IV chaining via SAES native CBC mode. ECC zero-digest guard added in ecc.c so V1 PKA does not fault on the (zero-)message edge case. Random.c gains an STM32C5 RNG NIST candidate init path (config 1/2/3, NSCR, HTCR write under CONDRST) -- still under investigation on silicon, currently held off in user_settings via NO_STM32_RNG until the C5 conditioning sequence is resolved.

dgarske self-assigned this May 4, 2026

Copilot AI review requested due to automatic review settings May 4, 2026 23:16

Copilot started reviewing on behalf of dgarske May 4, 2026 23:19 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

dgarske force-pushed the stm32_bare branch 3 times, most recently from 8058c8c to 22ee90e Compare May 7, 2026 18:11

dgarske force-pushed the stm32_bare branch 5 times, most recently from 1c9091e to 3519503 Compare May 11, 2026 21:35

dgarske requested a review from Copilot May 11, 2026 21:36

Copilot AI reviewed May 11, 2026

View reviewed changes

Comment thread wolfssl/wolfcrypt/port/st/stm32.h

Comment thread wolfssl/wolfcrypt/port/st/stm32.h

Comment thread wolfcrypt/src/port/st/stm32.c

Comment thread wolfcrypt/src/random.c

Comment thread wolfcrypt/src/port/st/stm32.c

dgarske force-pushed the stm32_bare branch 2 times, most recently from 965e81b to 2c8100c Compare May 12, 2026 20:16

dgarske requested a review from Copilot May 12, 2026 20:26

Copilot AI reviewed May 12, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske May 12, 2026 21:00 View session

dgarske force-pushed the stm32_bare branch 4 times, most recently from 0145fa0 to b0ba9ce Compare May 15, 2026 23:30

dgarske force-pushed the stm32_bare branch from b0ba9ce to 4264147 Compare May 22, 2026 01:45

dgarske force-pushed the stm32_bare branch from 4264147 to 29f2ff4 Compare May 27, 2026 18:02

STM32 DHUK Support

8e66aeb

Conversation

dgarske commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Features

Direct-register HASH driver

Direct-register AES driver

Direct-register SAES + DHUK

Direct-register RNG driver

Direct-register PKA driver

Family clock-enable macros

Diagnostics

Supported families

Build flag

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

dgarske commented May 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dgarske commented May 4, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading

dgarske commented May 22, 2026 •

edited

Loading