Makefile

CC ?= arm-none-eabi-gcc
OBJCOPY ?= arm-none-eabi-objcopy

ROOT := ../../..

# TrustZone support: set TZEN=1 for TrustZone enabled builds
# Default is TZEN=0 (TrustZone disabled)
TZEN ?= 0

# TLS support: set ENABLE_TLS=1 to include wolfSSL TLS server
# Requires wolfSSL cloned alongside wolfip (or set WOLFSSL_ROOT)
ENABLE_TLS ?= 0

# TLS client test: set ENABLE_TLS_CLIENT=1 to include TLS client (Google test)
# Automatically enables TLS if needed
ENABLE_TLS_CLIENT ?= 0

# HTTPS web server: set ENABLE_HTTPS=1 to include HTTPS web server
# Automatically enables TLS if needed
ENABLE_HTTPS ?= 0

# SSH support: set ENABLE_SSH=1 to include wolfSSH server
# Automatically enables TLS if needed
ENABLE_SSH ?= 0

# MQTT support: set ENABLE_MQTT=1 to include wolfMQTT client
# Automatically enables TLS if needed
ENABLE_MQTT ?= 0

# MQTT Broker: set ENABLE_MQTT_BROKER=1 to include wolfMQTT broker (requires TLS)
ENABLE_MQTT_BROKER ?= 0

# FreeRTOS integration: set FREERTOS=1 to run the HTTPS server from a
# FreeRTOS task using the blocking BSD socket wrapper layer.
FREERTOS ?= 0
FREERTOS_PATH ?= $(ROOT)/../FreeRTOS_Kernel

# Auto-enable TLS when any feature that requires it is enabled
ifeq ($(ENABLE_TLS_CLIENT),1)
  ENABLE_TLS = 1
endif
ifeq ($(ENABLE_HTTPS),1)
  ENABLE_TLS = 1
endif
ifeq ($(ENABLE_SSH),1)
  ENABLE_TLS = 1
endif
ifeq ($(ENABLE_MQTT),1)
  ENABLE_TLS = 1
endif

# Disable wolfSSL Cortex-M assembly (set to 1 for emulators/CI that reject
# certain T32 instructions generated by sp_cortexm.c; real hardware uses 0)
WOLFSSL_SP_NO_ASM ?= 0

# Library paths - default to sibling directories (clone alongside pattern)
WOLFSSL_ROOT ?= $(ROOT)/../wolfssl
WOLFSSH_ROOT ?= $(ROOT)/../wolfssh
WOLFMQTT_ROOT ?= $(ROOT)/../wolfmqtt
# wolfBoot tree, used for TZEN=1 to sign the NS image and to provide
# the secure stub binary that gets concatenated into factory.bin.
# Override on the command line for local clones, e.g.:
#   make TZEN=1 WOLFBOOT_ROOT=$(HOME)/GitHub/wolfboot-alt3 ...
WOLFBOOT_ROOT ?= $(ROOT)/../wolfboot
FREERTOS_PORT_DIR := $(FREERTOS_PATH)/portable/GCC/ARM_CM33_NTZ/non_secure

# wolfBoot boot-partition layout (must match wolfBoot's stm32h5-tz.config).
# WOLFBOOT_BOOT_OFFSET is the offset (from 0x08000000) of the boot
# partition; we pad wolfboot.bin up to this offset before appending the
# signed NS image to produce factory.bin.
WOLFBOOT_BOOT_OFFSET ?= 0x60000
WOLFBOOT_SIGN_KEY ?= $(WOLFBOOT_ROOT)/wolfboot_signing_private_key.der

# Base compiler flags. -mcmse is intentionally NOT set: the NS app does
# not declare or call any NSC entry stubs (no cmse_nonsecure_entry
# functions). Adding -mcmse without those would be benign but
# unnecessary and pulls in the secure-mode support runtime.
CFLAGS := -mcpu=cortex-m33 -mthumb -Os -ffreestanding -fdata-sections -ffunction-sections
CFLAGS += -g -ggdb -Wall -Wextra -Werror
CFLAGS += -I. -I$(ROOT) -I$(ROOT)/src -I$(ROOT)/src/port -I$(ROOT)/src/port/stm32
CFLAGS += -DSTM32H5
EXTRA_CFLAGS ?=
EXTRA_CFLAGS_WOLFSSL ?=
CFLAGS += $(EXTRA_CFLAGS)

# Relaxed warnings for external libraries (wolfSSL has many unused var warnings)
CFLAGS_WOLFSSL := $(CFLAGS)
CFLAGS_WOLFSSL := $(filter-out -Werror,$(CFLAGS_WOLFSSL))
CFLAGS_WOLFSSL += -Wno-unused-variable -Wno-unused-function
CFLAGS_WOLFSSL += $(EXTRA_CFLAGS_WOLFSSL)

# Select linker script based on TZEN setting
ifeq ($(TZEN),1)
  LDSCRIPT := target_tzen.ld
  CFLAGS += -DTZEN_ENABLED=1
else
  LDSCRIPT := target.ld
  CFLAGS += -DTZEN_ENABLED=0
endif

LDFLAGS := -nostdlib -T $(LDSCRIPT) -Wl,-gc-sections

# Base source files
SRCS := startup.c ivt.c syscalls.c
SRCS += main.c $(ROOT)/src/port/stm32/stm32_eth.c $(ROOT)/src/wolfip.c

ifeq ($(FREERTOS),1)
ifeq ($(wildcard $(FREERTOS_PATH)/include/FreeRTOS.h),)
  $(error FreeRTOS kernel not found at $(FREERTOS_PATH). Populate it or override FREERTOS_PATH)
endif

ifeq ($(wildcard $(FREERTOS_PORT_DIR)/port.c),)
  $(error FreeRTOS ARM_CM33_NTZ port not found at $(FREERTOS_PORT_DIR))
endif
ifneq ($(ENABLE_TLS_CLIENT),0)
  $(error FREERTOS=1 does not support ENABLE_TLS_CLIENT yet)
endif
ifneq ($(ENABLE_SSH),0)
  $(error FREERTOS=1 does not support ENABLE_SSH yet)
endif
ifneq ($(ENABLE_MQTT),0)
  $(error FREERTOS=1 does not support ENABLE_MQTT yet)
endif
ifneq ($(ENABLE_MQTT_BROKER),0)
  $(error FREERTOS=1 does not support ENABLE_MQTT_BROKER yet)
endif

CFLAGS += -DWOLFIP_USE_FREERTOS
CFLAGS += -I$(FREERTOS_PATH)/include -I$(FREERTOS_PORT_DIR) -I$(ROOT)/src/port/freeRTOS
SRCS += echo_server_freertos.c
ifeq ($(ENABLE_HTTPS),1)
SRCS += https_server_freertos.c
endif
SRCS += $(ROOT)/src/port/freeRTOS/bsd_socket.c
SRCS += $(FREERTOS_PATH)/tasks.c
SRCS += $(FREERTOS_PATH)/list.c
SRCS += $(FREERTOS_PATH)/queue.c
SRCS += $(FREERTOS_PATH)/timers.c
SRCS += $(FREERTOS_PATH)/portable/MemMang/heap_4.c
SRCS += $(FREERTOS_PORT_DIR)/port.c
SRCS += $(wildcard $(FREERTOS_PORT_DIR)/portasm.c)
SRCS += $(wildcard $(FREERTOS_PORT_DIR)/portasm.s)
SRCS += $(wildcard $(FREERTOS_PORT_DIR)/portasm.S)
endif

# -----------------------------------------------------------------------------
# TLS Support (wolfSSL)
# -----------------------------------------------------------------------------
ifeq ($(ENABLE_TLS),1)

# Validate wolfSSL exists
ifeq ($(wildcard $(WOLFSSL_ROOT)/wolfssl/ssl.h),)
  $(error wolfSSL not found at $(WOLFSSL_ROOT). Clone it: git clone https://github.com/wolfSSL/wolfssl.git)
endif

CFLAGS += -DENABLE_TLS
CFLAGS += -DWOLFSSL_USER_SETTINGS
CFLAGS += -DWOLFSSL_WOLFIP
CFLAGS += -I$(WOLFSSL_ROOT)

# TLS server, client and wolfIP-wolfSSL glue
ifeq ($(FREERTOS),0)
SRCS += tls_server.c
SRCS += $(ROOT)/src/port/wolfssl_io.c
endif

# TLS client (Google test)
ifeq ($(ENABLE_TLS_CLIENT),1)
CFLAGS += -DENABLE_TLS_CLIENT
SRCS += tls_client.c
endif


# HTTPS web server - bare-metal mode uses the raw wolfIP httpd path.
ifeq ($(ENABLE_HTTPS),1)
CFLAGS += -DENABLE_HTTPS
ifeq ($(FREERTOS),0)
CFLAGS += -DWOLFIP_ENABLE_HTTP
SRCS += $(ROOT)/src/http/httpd.c
endif
endif

# wolfSSL source files (minimal set for TLS 1.3 server with ECC)
WOLFSSL_SRCS := \
    $(WOLFSSL_ROOT)/wolfcrypt/src/aes.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/sha.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/sha256.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/sha512.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/hmac.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/hash.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/kdf.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/random.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/ecc.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/asn.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/coding.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/wc_port.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/memory.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/wolfmath.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/sp_int.c

ifeq ($(WOLFSSL_SP_NO_ASM),1)
CFLAGS += -DWOLFSSL_SP_NO_ASM
CFLAGS_WOLFSSL += -DWOLFSSL_SP_NO_ASM
WOLFSSL_SRCS += $(WOLFSSL_ROOT)/wolfcrypt/src/sp_c32.c
else
WOLFSSL_SRCS += $(WOLFSSL_ROOT)/wolfcrypt/src/sp_cortexm.c
endif

WOLFSSL_SRCS += \
    $(WOLFSSL_ROOT)/src/ssl.c \
    $(WOLFSSL_ROOT)/src/tls.c \
    $(WOLFSSL_ROOT)/src/tls13.c \
    $(WOLFSSL_ROOT)/src/internal.c \
    $(WOLFSSL_ROOT)/src/keys.c \
    $(WOLFSSL_ROOT)/src/wolfio.c

# ChaCha20-Poly1305 (optional)
WOLFSSL_SRCS += \
    $(WOLFSSL_ROOT)/wolfcrypt/src/chacha.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/chacha20_poly1305.c \
    $(WOLFSSL_ROOT)/wolfcrypt/src/poly1305.c

# RSA for certificate verification (most servers use RSA certs)
WOLFSSL_SRCS += \
    $(WOLFSSL_ROOT)/wolfcrypt/src/rsa.c \
	$(WOLFSSL_ROOT)/wolfcrypt/src/signature.c


SRCS += $(WOLFSSL_SRCS)

endif # ENABLE_TLS

# -----------------------------------------------------------------------------
# SSH Support (wolfSSH)
# -----------------------------------------------------------------------------
ifeq ($(ENABLE_SSH),1)

# Validate wolfSSH exists
ifeq ($(wildcard $(WOLFSSH_ROOT)/wolfssh/ssh.h),)
  $(error wolfSSH not found at $(WOLFSSH_ROOT). Clone it: git clone https://github.com/wolfSSL/wolfssh.git)
endif

CFLAGS += -DENABLE_SSH
CFLAGS += -DWOLFSSH_USER_SETTINGS
CFLAGS += -I$(WOLFSSH_ROOT)

# SSH server and wolfSSH-wolfIP glue
SRCS += ssh_server.c
SRCS += $(ROOT)/src/port/wolfssh_io.c

# wolfSSH source files (minimal set for SSH server)
WOLFSSH_SRCS := \
    $(WOLFSSH_ROOT)/src/ssh.c \
    $(WOLFSSH_ROOT)/src/internal.c \
    $(WOLFSSH_ROOT)/src/io.c \
    $(WOLFSSH_ROOT)/src/keygen.c \
    $(WOLFSSH_ROOT)/src/log.c \
    $(WOLFSSH_ROOT)/src/port.c

SRCS += $(WOLFSSH_SRCS)

# wolfSSH objects use relaxed warnings + SSH/SSL include paths + user_settings.h
$(WOLFSSH_ROOT)/%.o: $(WOLFSSH_ROOT)/%.c
	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_SSH -DWOLFSSL_USER_SETTINGS -DWOLFSSH_USER_SETTINGS -I$(WOLFSSH_ROOT) -I$(WOLFSSL_ROOT) -c $< -o $@

endif # ENABLE_SSH

# -----------------------------------------------------------------------------
# MQTT Support (wolfMQTT)
# -----------------------------------------------------------------------------
ifeq ($(ENABLE_MQTT),1)

# Validate wolfMQTT exists
ifeq ($(wildcard $(WOLFMQTT_ROOT)/wolfmqtt/mqtt_client.h),)
  $(error wolfMQTT not found at $(WOLFMQTT_ROOT). Clone it: git clone https://github.com/wolfSSL/wolfMQTT.git)
endif

CFLAGS += -DENABLE_MQTT
CFLAGS += -DWOLFMQTT_USER_SETTINGS
CFLAGS += -I$(WOLFMQTT_ROOT)

# MQTT client and wolfMQTT-wolfIP glue
SRCS += mqtt_client.c
SRCS += $(ROOT)/src/port/wolfmqtt_io.c

# wolfMQTT source files (minimal set for MQTT client)
WOLFMQTT_SRCS := \
    $(WOLFMQTT_ROOT)/src/mqtt_client.c \
    $(WOLFMQTT_ROOT)/src/mqtt_packet.c \
    $(WOLFMQTT_ROOT)/src/mqtt_socket.c

SRCS += $(WOLFMQTT_SRCS)

# wolfMQTT objects use relaxed warnings + MQTT/SSL include paths + user_settings.h
$(WOLFMQTT_ROOT)/%.o: $(WOLFMQTT_ROOT)/%.c
	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_MQTT -DWOLFSSL_USER_SETTINGS -DWOLFMQTT_USER_SETTINGS $(if $(filter 1,$(ENABLE_MQTT_BROKER)),-DENABLE_MQTT_BROKER) -I$(WOLFMQTT_ROOT) -I$(WOLFSSL_ROOT) -I$(ROOT)/src -c $< -o $@

endif # ENABLE_MQTT

# -----------------------------------------------------------------------------
# MQTT Broker Support (wolfMQTT broker) - requires TLS
# -----------------------------------------------------------------------------
ifeq ($(ENABLE_MQTT_BROKER),1)

# MQTT Broker requires TLS
ifeq ($(ENABLE_TLS),0)
  $(error ENABLE_MQTT_BROKER=1 requires ENABLE_TLS=1)
endif

# Validate wolfMQTT exists
ifeq ($(wildcard $(WOLFMQTT_ROOT)/wolfmqtt/mqtt_broker.h),)
  $(error wolfMQTT (with broker) not found at $(WOLFMQTT_ROOT). Clone it: git clone https://github.com/wolfSSL/wolfMQTT.git)
endif

CFLAGS += -DENABLE_MQTT_BROKER
CFLAGS += -DWOLFMQTT_USER_SETTINGS
CFLAGS += -I$(WOLFMQTT_ROOT)

# MQTT broker wrapper
SRCS += mqtt_broker.c

# wolfMQTT broker source files
# Note: mqtt_client.c is needed by broker internals (MqttClient_Init, etc.)
WOLFMQTT_BROKER_SRCS := \
    $(WOLFMQTT_ROOT)/src/mqtt_broker.c

# Only add shared wolfMQTT sources if MQTT client is not already enabled
ifneq ($(ENABLE_MQTT),1)
WOLFMQTT_BROKER_SRCS += \
    $(WOLFMQTT_ROOT)/src/mqtt_client.c \
    $(WOLFMQTT_ROOT)/src/mqtt_packet.c \
    $(WOLFMQTT_ROOT)/src/mqtt_socket.c
endif

SRCS += $(WOLFMQTT_BROKER_SRCS)

# wolfMQTT objects use relaxed warnings + include paths + user_settings.h
# Only define this pattern rule if MQTT client didn't already define it
ifneq ($(ENABLE_MQTT),1)
$(WOLFMQTT_ROOT)/%.o: $(WOLFMQTT_ROOT)/%.c
	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_MQTT_BROKER -DWOLFSSL_USER_SETTINGS -DWOLFMQTT_USER_SETTINGS -I$(WOLFMQTT_ROOT) -I$(WOLFSSL_ROOT) -I$(ROOT)/src -c $< -o $@
endif

endif # ENABLE_MQTT_BROKER

# -----------------------------------------------------------------------------
# Build rules
# -----------------------------------------------------------------------------
OBJS := $(patsubst %.c,%.o,$(SRCS))

all: app.bin
	@echo "Built with TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_TLS_CLIENT=$(ENABLE_TLS_CLIENT) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT) ENABLE_MQTT_BROKER=$(ENABLE_MQTT_BROKER) FREERTOS=$(FREERTOS)"
ifeq ($(ENABLE_TLS),1)
	@echo "  wolfSSL: $(WOLFSSL_ROOT)"
endif
ifeq ($(ENABLE_SSH),1)
	@echo "  wolfSSH: $(WOLFSSH_ROOT)"
endif
ifeq ($(ENABLE_MQTT),1)
	@echo "  wolfMQTT (client): $(WOLFMQTT_ROOT)"
endif
ifeq ($(ENABLE_MQTT_BROKER),1)
	@echo "  wolfMQTT (broker): $(WOLFMQTT_ROOT)"
endif

app.elf: $(OBJS) $(LDSCRIPT)
	$(CC) $(CFLAGS) $(OBJS) $(LDFLAGS) -Wl,--start-group -lc -lm -lgcc -lnosys -Wl,--end-group -o $@

app.bin: app.elf
	$(OBJCOPY) -O binary $< $@

# -----------------------------------------------------------------------------
# TZEN=1: sign the NS image with wolfBoot keytools and combine with
# wolfboot.bin to produce factory.bin (single artifact for OpenOCD).
# -----------------------------------------------------------------------------

# Image header size MUST match the IMAGE_HEADER_SIZE that wolfBoot was
# built with (config/examples/stm32h5-tz.config sets 1024). Sign reads
# it from the env; the default for ECC256 is only 256 bytes, which
# would put the vector table at 0x08060100 instead of 0x08060400.
WOLFBOOT_IMAGE_HEADER_SIZE ?= 1024

# Signed NS image: wolfBoot's sign tool prepends a 1024-byte image
# header; the resulting app_v1_signed.bin loads at 0x08060000 and the
# vector table lands at 0x08060400 (which target_tzen.ld assumes).
app_v1_signed.bin: app.bin $(WOLFBOOT_SIGN_KEY)
	IMAGE_HEADER_SIZE=$(WOLFBOOT_IMAGE_HEADER_SIZE) \
	    $(WOLFBOOT_ROOT)/tools/keytools/sign --ecc256 --sha256 \
	    app.bin $(WOLFBOOT_SIGN_KEY) 1

signed: app_v1_signed.bin

# Combined factory image: wolfBoot stub padded out to the boot
# partition offset, followed by the signed NS image. Flash with
# `program factory.bin 0x08000000` in one step.
factory.bin: app_v1_signed.bin $(WOLFBOOT_ROOT)/wolfboot.bin
	$(OBJCOPY) -I binary -O binary --pad-to=$(WOLFBOOT_BOOT_OFFSET) \
	    --gap-fill=0xFF $(WOLFBOOT_ROOT)/wolfboot.bin wolfboot_padded.bin
	cat wolfboot_padded.bin app_v1_signed.bin > factory.bin
	@echo "factory.bin: $$(stat -c%s factory.bin) bytes"
	@echo "  wolfBoot:    $$(stat -c%s $(WOLFBOOT_ROOT)/wolfboot.bin) bytes (padded to $(WOLFBOOT_BOOT_OFFSET))"
	@echo "  signed app:  $$(stat -c%s app_v1_signed.bin) bytes"

factory: factory.bin

%.o: %.c
	$(CC) $(CFLAGS) -c $< -o $@

# wolfSSL objects use relaxed warnings + user_settings.h + include paths
$(WOLFSSL_ROOT)/%.o: $(WOLFSSL_ROOT)/%.c
	$(CC) $(CFLAGS_WOLFSSL) -DWOLFSSL_USER_SETTINGS $(if $(filter 1,$(ENABLE_SSH)),-DENABLE_SSH -DWOLFSSL_WOLFSSH) $(if $(filter 1,$(ENABLE_MQTT_BROKER)),-DENABLE_MQTT_BROKER) -I$(WOLFSSL_ROOT) -c $< -o $@

clean:
	rm -f *.o app.elf app.bin
	rm -f app_v1_signed.bin factory.bin wolfboot_padded.bin
	rm -f $(ROOT)/src/*.o
	rm -f $(ROOT)/src/port/*.o
	rm -f $(ROOT)/src/port/stm32/*.o
	rm -f $(ROOT)/src/port/freeRTOS/*.o
ifeq ($(FREERTOS),1)
	rm -f $(FREERTOS_PATH)/*.o
	rm -f $(FREERTOS_PATH)/portable/MemMang/*.o
	rm -f $(FREERTOS_PORT_DIR)/*.o
endif
ifeq ($(ENABLE_TLS),1)
	rm -f $(WOLFSSL_ROOT)/wolfcrypt/src/*.o
	rm -f $(WOLFSSL_ROOT)/src/*.o
endif
ifeq ($(ENABLE_SSH),1)
	rm -f $(WOLFSSH_ROOT)/src/*.o
endif
ifeq ($(ENABLE_MQTT),1)
	rm -f $(WOLFMQTT_ROOT)/src/*.o
endif
ifeq ($(ENABLE_MQTT_BROKER),1)
	rm -f $(WOLFMQTT_ROOT)/src/*.o
endif

# Verify what features are compiled into the binary
verify: app.bin
	@echo "=== Build Verification ==="
	@echo "Checking compiled features in app.bin..."
	@strings app.bin | grep -q "Initializing TLS server" && echo "  ✓ TLS server enabled" || echo "  ✗ TLS server disabled"
	@strings app.bin | grep -q "Initializing HTTPS server" && echo "  ✓ HTTPS server enabled" || echo "  ✗ HTTPS server disabled"
	@strings app.bin | grep -q "Initializing SSH server" && echo "  ✓ SSH server enabled" || echo "  ✗ SSH server disabled"
	@strings app.bin | grep -q "Initializing MQTT client" && echo "  ✓ MQTT client enabled" || echo "  ✗ MQTT client disabled"
	@strings app.bin | grep -q "MQTT Broker: Initializing" && echo "  ✓ MQTT broker enabled" || echo "  ✗ MQTT broker disabled"
	@echo ""
	@echo "Binary size: $$(ls -lh app.bin | awk '{print $$5}')"
	@echo "Build flags: TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT) ENABLE_MQTT_BROKER=$(ENABLE_MQTT_BROKER) FREERTOS=$(FREERTOS)"

# Show memory usage
size: app.elf
	@echo "=== Memory Usage ==="
	@arm-none-eabi-size app.elf
	@echo ""
	@echo "Flash usage: $$(arm-none-eabi-size app.elf | awk 'NR==2{printf "%.1f%% (%d / %d bytes)", ($$1+$$2)*100/2097152, $$1+$$2, 2097152}')"
	@echo "RAM usage (static): $$(arm-none-eabi-size app.elf | awk 'NR==2{printf "%.1f%% (%d / %d bytes)", ($$2+$$3)*100/655360, $$2+$$3, 655360}')"

.PHONY: all clean verify size

# -----------------------------------------------------------------------------
# Help
# -----------------------------------------------------------------------------
help:
	@echo "STM32H563 wolfIP Build System"
	@echo ""
	@echo "Usage: make [target] [options]"
	@echo ""
	@echo "Targets:"
	@echo "  all      Build app.bin (default)"
	@echo "  clean    Remove build artifacts"
	@echo "  verify   Check which features are compiled in"
	@echo "  size     Show memory usage statistics"
	@echo "  help     Show this help"
	@echo ""
	@echo "Options:"
	@echo "  TZEN=1          Enable TrustZone support"
	@echo "  ENABLE_TLS=1    Enable TLS server (requires wolfSSL)"
	@echo "  ENABLE_TLS_CLIENT=1 Enable TLS client test (Google)"
	@echo "  ENABLE_HTTPS=1  Enable HTTPS web server (requires TLS)"
	@echo "  ENABLE_SSH=1    Enable SSH server (requires TLS + wolfSSH)"
	@echo "  ENABLE_MQTT=1   Enable MQTT client (requires TLS + wolfMQTT)"
	@echo "  ENABLE_MQTT_BROKER=1 Enable MQTT broker (requires TLS + wolfMQTT)"
	@echo "  FREERTOS=1      Run HTTPS in a FreeRTOS task via BSD socket wrappers"
	@echo "  FREERTOS_PATH=  Path to FreeRTOS-Kernel (default: $(ROOT)/../FreeRTOS_Kernel)"
	@echo "  WOLFSSL_ROOT=   Path to wolfSSL (default: ../wolfssl)"
	@echo "  WOLFSSH_ROOT=   Path to wolfSSH (default: ../wolfssh)"
	@echo "  WOLFMQTT_ROOT=  Path to wolfMQTT (default: ../wolfmqtt)"
	@echo "  CC=             C compiler (default: arm-none-eabi-gcc)"
	@echo "  OBJCOPY=        Objcopy tool (default: arm-none-eabi-objcopy)"
	@echo ""
	@echo "Examples:"
	@echo "  make                                                        # Basic TCP echo (port 7)"
	@echo "  make ENABLE_TLS=1                                           # TLS echo server (port 8443)"
	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1                            # TLS + HTTPS web (port 443)"
	@echo "  make ENABLE_TLS=1 ENABLE_SSH=1                              # TLS + SSH shell (port 22)"
	@echo "  make ENABLE_TLS=1 ENABLE_TLS_CLIENT=1                       # TLS client (Google test)"
	@echo "  make ENABLE_TLS=1 ENABLE_MQTT=1                             # TLS + MQTT client"
	@echo "  make ENABLE_TLS=1 ENABLE_MQTT_BROKER=1                      # TLS + MQTT broker"
	@echo "  make FREERTOS=1 ENABLE_HTTPS=1                              # FreeRTOS HTTPS via BSD sockets"
	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1 ENABLE_SSH=1 ENABLE_MQTT=1 ENABLE_MQTT_BROKER=1 # Full featured"
	@echo ""
	@echo "Full Build Command (recommended):"
	@echo "  CC=arm-none-eabi-gcc OBJCOPY=arm-none-eabi-objcopy \\"
	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1 ENABLE_SSH=1 ENABLE_MQTT=1"
	@echo ""
	@echo "Testing:"
	@echo "  nc <ip> 7                                      # TCP echo"
	@echo "  echo 'Hello' | openssl s_client -connect <ip>:8443 -quiet  # TLS echo"
	@echo "  curl -k https://<ip>/                          # HTTPS web server"
	@echo "  ssh admin@<ip>                                 # SSH (password: wolfip)"
	@echo "  mosquitto_sub -h test.mosquitto.org -t 'wolfip/status' -v  # MQTT subscribe"
	@echo "  mosquitto_pub -h <ip> -p 8883 --cafile /dev/null --insecure -t test -m hello  # MQTT broker publish"

.PHONY: help