Fixes for STM32 CubeMX with crypto callback only (AES and ECC)

[dgarske]

Summary

Brings the STM32 CubeMX/HAL crypto-callback device up to parity with the bare device so WOLF_CRYPTO_CB_ONLY_AES and WOLF_CRYPTO_CB_ONLY_ECC (software crypto stripped for code size) work on the HAL build with hardware AES and hardware ECDSA. Previously the CubeMX device did CCB ECDSA sign only -- no AES, no ECDSA verify, no normal-key sign -- so those stripped configs failed.

Features

• New CubeMX AES crypto-callback device (wc_Stm32_CubeAesRegister): services AES-ECB on the HAL, which keys AES-GCM; bulk GCM runs on the native HAL GCM engine. Fixes WOLF_CRYPTO_CB_ONLY_AES on CubeMX.
• CubeMX device now also does HW ECDSA sign + verify via the STM32 PKA (stm32_ecc_sign/verify_hash_ex) for normal keys, and CCB-protected sign via HAL_CCB. Fixes WOLF_CRYPTO_CB_ONLY_ECC on CubeMX (that macro compiles out the direct ecc.c PKA path, so the callback provides HW ECDSA). One devId (wc_Stm32_DhukRegister) serves AES + ECDSA + CCB.

Fixes

• Added the missing WOLFSSL_STM32U3 arm to the CubeMX PKA include chain in stm32.c (was #error Please add the hal_pk.h include).
• #ifndef-guarded the bare HASH-legacy macros in stm32.h so WOLFSSL_STM32_BARE coexists with the ST Cube HAL headers in one TU (e.g. Zephyr).

Docs

• wolfcrypt/src/port/st/README.md: "HW crypto via crypto callback" section covering AES + ECDSA, the required app-side HAL PKA setup (extern hpka + HAL_PKA_Init), and the note that CCB key provisioning needs software keygen (do it in a non-CB_ONLY_ECC build; CCB sign then runs stripped).

Testing

On NUCLEO-U385RG-Q (CubeMX/HAL), Result: 0 (PASS):

• cubecrypto (customer shape: WOLFSSL_STM32_PKA + CCB + CB_ONLY_ECC + CB_ONLY_AES): HW ECDSA sign + verify + tamper-reject (RFC 6979 P-256 key, via PKA through the callback), and AES-GCM KAT.
• ccb regression (non-CB_ONLY): CCB keygen + sign + verify + wrapped-key import all pass -- the ECDSA additions don't regress the CCB path.
• cubeaes: AES-GCM (McGrew TC3/TC4) match vectors, decrypt + tamper-reject.

wolfSSL/wolfssl-examples-stm32#16

[Copilot]

Pull request overview

This pull request adds STM32 CubeMX/HAL support for routing AES operations through wolfCrypt’s crypto-callback framework so WOLF_CRYPTO_CB_ONLY_AES can work on HAL-based STM32 builds (notably enabling AES-GCM key setup by providing an AES-ECB callback handler).

Changes:

• Added a CubeMX/HAL AES crypto-callback device (register/unregister + AES-ECB handling) and extended the existing CubeMX CCB crypto-callback device to also dispatch cipher callbacks.
• Fixed STM32U3 CubeMX PKA HAL include selection and improved compatibility when both “bare” STM32 code and Cube HAL HASH headers are present in the same translation unit.
• Documented usage for WOLF_CRYPTO_CB_ONLY_AES on CubeMX/HAL builds in the STM32 port README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
wolfssl/wolfcrypt/port/st/stm32.h	Avoids HASH macro redefinition conflicts with Cube HAL headers; declares CubeMX AES crypto-callback device APIs.
wolfcrypt/src/port/st/stm32.c	Implements CubeMX AES crypto-callback device (AES-ECB) and routes cipher callbacks through the existing CubeMX CCB device; adds STM32U3 PKA includes.
wolfcrypt/src/port/st/README.md	Adds documentation describing how to enable/register the AES crypto-callback device for WOLF_CRYPTO_CB_ONLY_AES.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/st/README.md:101

• The example snippet always calls wc_Stm32_DhukRegister(devId), but on CubeMX/HAL that symbol is only available when WOLFSSL_STM32_CCB is enabled. For the non-CCB case (described immediately below), the snippet should instead call wc_Stm32_CubeAesRegister(devId) (or show a conditional) to avoid a link/compile mismatch for readers copying the example.

wc_Stm32_DhukRegister(devId);      /* once; serves AES + ECDSA (+ CCB) */