This should be automatically included in your build (arch.mk around line 107):

    CFLAGS+=-DSTM32L4A6xx -DUSE_HAL_DRIVER -Isrc -Ihal 

This code has been tested with STM32L4A6, but you can change that to match your model

Hi akuraparthy,

The L4 is our only STM32 port that requires drivers from ST. Please download the STM32L4xx_HAL driver from STM and point the STM32CUBE variable in your config to the path, i.e.:

STM32CUBE=/path/to/stm32-cube/in/your/system

Hope this helps.

Thanks,

--
Daniele - wolfSSL

> FYI what I am actually trying to do is checking if I can implement a secure bootloader with wolfssl.

We already have that! Check out wolfBoot:

https://github.com/wolfSSL/wolfBoot

It's fully featured and highly portable, you can see we already support some M0's like the STM32L073, the Atmel/Microchip SAM-R21 and Cypress PSOC6.

For your reference about the code size, wolfBoot ECC256+SHA256 on STM32L0 is ~ 18KB in size including crypto, down to ~16KB without assembly optimizations, ~14KB if using ED25519 and SHA384, and even a little smaller if using LMS (post quantum crypto algorithms).

Thanks,

--
Daniele @wolfSSL Support

Hello Nikos,

First of all, I think you should use the function wc_ecc_verify_hash_ex() https://www.wolfssl.com/documentation/m … fy_hash_ex. This would eliminate the need for converting the signature from raw (R,S) format to signature, and also make the code smaller. signature.c and asn.c should not be needed in your build if you stick to the APIs in ecc.h instead.

To create the "mp_int" object to import the R,S components in the format expected by this call, you could do the following:

            mp_int mp_r, mp_s;
            mp_init(&mp_r);
            mp_init(&mp_s);
            mp_read_unsigned_bin(&mp_r, r, sizeof(r));
            mp_read_unsigned_bin(&mp_s, s,  sizeof(s));

Very important: before using your ecc_pubkey structure to import the key, you must initialize it:

    eccret = wc_ecc_init(&ecc_pubkey);

Your import call then looks fine as is:

// Import the key buffer to the ecc_key structure format
    eccret = wc_ecc_import_unsigned(&ecc_pubkey, pubkeyX, pubkeyY, NULL, ECC_SECP256R1);

Then finally you can call the correct verify function as:

          eccret = wc_ecc_verify_hash_ex(&mp_r, &mp_s, hash_data, hash_len, &result, &eccpubkey);

If all goes as expected, eccret should be zero and result should be 1, indicating successful verification.

Another thing I have noticed in your configuration: the SP assembly optimizations don't match your current MCU. Cortex-M0 is ARMv6-M and we do provide thumb instructions optimization for it. I suggest you remove the option WOLFSSL_SP_ARM_CORTEX_M_ASM and use WOLFSSL_SP_ARM_THUMB_ASM instead. Also the correct assembly file for Cortex-M0 is sp_armthumb.c if you are compiling with options "-mcortex-m0 -mthumb" as expected for this MCU. The sp_cortexm.c source file contains assembly optimizations for Cortex-M3 and later (up to newer ARMv8-M).

I would also recommend to add the option WOLFSSL_HAVE_SP_ECC to ensure ecc is using those optimizations.

Furthermore, since you are defining WOLFSSL_NO_MALLOC, I expect that you don't have/don't want to use dynamic allocation. In this case, in combination with SP_MATH, I would also suggest the following:

#define WOLFSSL_SP_NO_MALLOC
#define WOLFSSL_SP_NO_DYN_STACK

I hope this helps. Please let us know if you are still experiencing issues after the suggested fixes.

Thanks,
Daniele @wolfSSL Support

Hello Gareth,

We have recently modified the NVM_FLASH_WRITEONCE code to add redundancy in the last two sectors of each partition, to mitigate the risk of corrupted/incomplete update flags for MCUs requiring this option.
This was introduced in https://github.com/wolfSSL/wolfBoot/pull/276

The problem you are reporting seems indeed a bug introduced in the above PR. The non-selected block address should be rather

(uint32_t)(base - ((1 + (!sel)) * WOLFBOOT_SECTOR_SIZE)) & (~(NVM_CACHE_SIZE - 1); 

>

I have submitted a fix here:
https://github.com/wolfSSL/wolfBoot/pull/287 and I'm planning to integrate more tests to avoid such errors in the future.

Please let me know if this fixes the issue for you.

Thanks,

--
Daniele, wolfSSL