First cut at consolidated alpha releng.

Undoubtedly doesn't work yet, and still needs doc, but perhaps now
ready for testing on build machine.

41 files changed, 225 insertions, 161 deletions

diff --git a/firmware/.gitignore b/.gitignore
index f1a0492..71aedc2 100644
--- a/firmware/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
+build
 package.tar.gz
 screenlog.0
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..6b5d092
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,57 @@
+[submodule "source/core/cipher/aes"]
+	path = source/core/cipher/aes
+	url = https://git.cryptech.is/core/cipher/aes.git
+[submodule "source/core/cipher/chacha"]
+	path = source/core/cipher/chacha
+	url = https://git.cryptech.is/core/cipher/chacha.git
+[submodule "source/core/comm/fmc"]
+	path = source/core/comm/fmc
+	url = https://git.cryptech.is/core/comm/fmc.git
+[submodule "source/core/comm/uart"]
+	path = source/core/comm/uart
+	url = https://git.cryptech.is/core/comm/uart.git
+[submodule "source/core/hash/sha1"]
+	path = source/core/hash/sha1
+	url = https://git.cryptech.is/core/hash/sha1.git
+[submodule "source/core/hash/sha256"]
+	path = source/core/hash/sha256
+	url = https://git.cryptech.is/core/hash/sha256.git
+[submodule "source/core/hash/sha512"]
+	path = source/core/hash/sha512
+	url = https://git.cryptech.is/core/hash/sha512.git
+[submodule "source/core/math/modexpa7"]
+	path = source/core/math/modexpa7
+	url = https://git.cryptech.is/core/math/modexpa7.git
+[submodule "source/core/platform/alpha"]
+	path = source/core/platform/alpha
+	url = https://git.cryptech.is/core/platform/alpha.git
+[submodule "source/core/rng/avalanche_entropy"]
+	path = source/core/rng/avalanche_entropy
+	url = https://git.cryptech.is/core/rng/avalanche_entropy.git
+[submodule "source/core/rng/rosc_entropy"]
+	path = source/core/rng/rosc_entropy
+	url = https://git.cryptech.is/core/rng/rosc_entropy.git
+[submodule "source/core/rng/trng"]
+	path = source/core/rng/trng
+	url = https://git.cryptech.is/core/rng/trng.git
+[submodule "source/core/rng/vndecorrelator"]
+	path = source/core/rng/vndecorrelator
+	url = https://git.cryptech.is/core/rng/vndecorrelator.git
+[submodule "source/core/util/mkmif"]
+	path = source/core/util/mkmif
+	url = https://git.cryptech.is/core/util/mkmif.git
+[submodule "source/sw/libhal"]
+	path = source/sw/libhal
+	url = https://git.cryptech.is/sw/libhal.git
+[submodule "source/sw/pkcs11"]
+	path = source/sw/pkcs11
+	url = https://git.cryptech.is/sw/pkcs11.git
+[submodule "source/sw/stm32"]
+	path = source/sw/stm32
+	url = https://git.cryptech.is/sw/stm32.git
+[submodule "source/sw/thirdparty/libtfm"]
+	path = source/sw/thirdparty/libtfm
+	url = https://git.cryptech.is/sw/thirdparty/libtfm.git
+[submodule "source/user/ft/libcli"]
+	path = source/user/ft/libcli
+	url = https://git.cryptech.is/user/ft/libcli.git
diff --git a/software/Makefile b/Makefile
index 787fea4..1f5b63f 100644
--- a/software/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-# Top-level build of software packages to work with Cryptech Alpha board.
+# Top-level package build for Cryptech Alpha board.
 
 export CRYPTECH_VERSION := 2.0
 
@@ -19,15 +19,26 @@ PBUILDER_TARGETS := debian/jessie/i386 debian/jessie/amd64 ubuntu/xenial/i386 ub
 REPO_UPLOAD_USER := aptbot
 REPO_UPLOAD_URI	 := rsync://apt.cryptech.is/alpha/
 
+# Yes, we really are putting the firmware tarball into the source package here.
+
+FIRMWARE_TARBALL := build/cryptech-alpha-firmware.tar.gz
+BITSTREAM	 := build/core/platform/alpha/build/alpha_fmc.bit
+ELVES		 := build/sw/stm32/projects/bootloader/bootloader.elf build/sw/stm32/projects/hsm/hsm.elf
+FIRMWARE_BINARY	 := ${ELVES} ${ELVES:.elf=.bin}
+FIRMWARE_ALL	 := ${BITSTREAM} ${FIRMWARE_BINARY}
+
+RTL_SOURCE	 := $(shell find source/core -name .git -prune -o -type f -print)
+SW_SOURCE	 := $(shell find source/sw source/user -name .git -prune -o -type f -print)
+
 # Command to generate a new changelog containing one entry.
 # Does nothing if the changelog already exists.
 
 DCH =	test -f debian/changelog || \
 	EDITOR=true VISUAL=true TZ=UTC DEBEMAIL='APT Builder Robot <aptbot@cryptech.is>' \
 	dch --create --package ${PACKAGE_NAME} --newversion '${PACKAGE_VERSION}' \
-	'$(strip Version ${CRYPTECH_VERSION} of software for Cryptech Alpha development board.)'
+	'$(strip Version ${CRYPTECH_VERSION} package for Cryptech Alpha development board.)'
 
-all: init source pbuilder homebrew
+all: init firmware dsc pbuilder homebrew
 
 enchilada: all upload
 
@@ -41,7 +52,26 @@ clean:
 sandblast: clean
 	git submodule deinit -f .
 
-source:
+firmware: shadow ${FIRMWARE_TARBALL}
+
+shadow: build
+	./build-shadow-tree.py
+
+${FIRMWARE_TARBALL}: ${BITSTREAM} $(sort ${ELVES} ${ELVES:.elf=.bin})
+	./build-firmware-package.py $(basename $@) $^
+	gzip -9f $(basename $@)
+
+bitstream: ${BITSTREAM}
+
+${BITSTREAM}: ${RTL_SOURCE}
+	${MAKE} -C build/core/platform/alpha/build
+
+${ELVES:.elf=.bin}: shadow elves
+
+elves:
+	${MAKE} -C build/core/sw/stm32 bootloader hsm
+
+dsc:
 	cd source; ${DCH}
 	cd source; debuild -S -uc -us
 
@@ -61,4 +91,4 @@ upload:
 	${RSYNC} --ignore-existing       ${REPO_BASE}/ ${REPO_UPLOAD_URI}
 	${RSYNC} --delete --delete-delay ${REPO_BASE}/ ${REPO_UPLOAD_URI}
 
-.PHONY: all init clean source pbuilder homebrew upload enchilada sandblast
+.PHONY: all init clean firmware shadow bitstream elves dsc pbuilder homebrew upload enchilada sandblast
diff --git a/README.md b/README.md
index 9ec137c..e3f3eff 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,66 @@
-Unified release engineering stuff for Cryptech Alpha.
+Alpha Releng
+============
+
+Release engineering stuff for Cryptech Alpha.
+
+Work in progress, currently a merge in progress of two separate
+release engineering repositories, one for HSM firmware, one for host
+software.
+
+This README is probably obsolete by the time you're reading it.
+
+## Old Firmware README ##
+
+Preliminary release engineering super-repository for building firmware
+for the Cryptech "Alpha" board.
+
+Primary tasks here are to build a bitstream for the FPGA and the
+"bootstrap" and "hsm" images for the Alpha's CPU.
+
+Eventually there will be a lot of packaging and versioning glorp here,
+but let's start with basic build and clean targets.
+
+Current repository structure is, um, complicated.  On the RTL side, we
+have a tree of simple subrepositories, each representing one RTL core.
+
+On the software side, we have a subrepository which has several
+subrepositories of its own: current thinking is that this should
+probably be replaced by separate repositories and Makefile VPATH
+magic, but this is what we have today so it's what we build with
+today.
+
+This README is probably obsolete by the time you're reading it.
+
+## Old Software README ##
+
+Preliminary release engineering super-repository for building software
+to work with the Cryptech "Alpha" board.
+
+Primary task here is to build the PKCS #11 library and any needed
+support tools for whichever platforms we support.  This will involve
+some packaging voodoo.
+
+Our first targets for this are Debian and Ubuntu, probably the Jessie
+and Xenial releases, respectively.  If we really need to support
+multiple releases for each of these platforms, the packaging mechanics
+become more complicated, so we may just stop here for these platforms
+and assume we can fill any odd corners using the associated source
+package.
+
+Our next target for this is likely to be Mac OS X.  This should be
+relatively straightforward so long as we only have to support Homebrew
+and we don't have to produce Homebrew "bottles" (binary packages).  If
+we do need to bottle, we either need one or more Mac build machines or
+we need some kind of cross-compilation scheme (eg,
+https://github.com/tpoechtrager/osxcross).
+
+Supporting Homebrew at all requires a bit of extra voodoo on top of
+supporting Debian packaging, but none of it looks particularly
+difficult, and the Debian packaging will produce the source tarball we
+need for the Homebrew formula, so integrating production of these two
+kinds of packaging makes some sense.
+
+Windoze is not currently on the radar.  In theory, MinGW would suffice
+as a cross compiler if and when we have to do something about it.
+
+This README is probably obsolete by the time you're reading it.
diff --git a/firmware/build-package.py b/build-firmware-package.py
index 0df116b..0df116b 100755
--- a/firmware/build-package.py
+++ b/build-firmware-package.py
diff --git a/build-shadow-tree.py b/build-shadow-tree.py
new file mode 100755
index 0000000..f8c2376
--- /dev/null
+++ b/build-shadow-tree.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python
+
+# Create a symlink build tree like the old X11 project "lndir" program.
+#
+# Reason for this is simple: synthesizing the Alpha RTL code takes a
+# looong time, so we don't want to do it unnecessarily, but we also
+# don't want to include all of the intermediate files from the
+# synthesis in the source tarball.  So we symlink a shadow build tree
+# off to the side, do the synthesis there.
+#
+# We could construct this symlink tree by hand, but that's fragile, so
+# we'd probably write a script to do it anyway, so we might as well
+# just use the script to build the shadow tree and have done with it.
+
+import os
+
+verbose = True
+dry_run = False
+
+source_root = "source"
+build_root  = "build"
+
+if verbose:
+    " mkdir", build_root
+
+if not dry_run:
+    os.mkdir(build_root)
+
+for source_head, dirs, files in os.walk(source_root):
+    build_head = build_root + source_head[len(source_root):]
+
+    print source_head, build_head, dirs, files
+
+    for dn in dirs:
+        d = os.path.join(build_head, dn)
+        if verbose:
+            print " mkdir", d
+        if not dry_run:
+            os.mkdir(d)
+
+    for fn in files:
+        if fn == ".git":
+            continue
+        d = os.path.join(build_head,  fn)
+        s = os.path.join(source_head, fn)
+        s = os.path.abspath(s)
+        s = os.path.relpath(s, build_head)
+        if verbose:
+            print " ln -s", s, d
+        if not dry_run:
+            os.symlink(s, d)
diff --git a/firmware/.gitmodules b/firmware/.gitmodules
deleted file mode 100644
index 77a2f38..0000000
--- a/firmware/.gitmodules
+++ /dev/null
@@ -1,54 +0,0 @@
-[submodule "core/cipher/aes"]
-	path = core/cipher/aes
-	url = https://git.cryptech.is/core/cipher/aes.git
-[submodule "core/cipher/chacha"]
-	path = core/cipher/chacha
-	url = https://git.cryptech.is/core/cipher/chacha.git
-[submodule "core/comm/fmc"]
-	path = core/comm/fmc
-	url = https://git.cryptech.is/core/comm/fmc.git
-[submodule "core/comm/uart"]
-	path = core/comm/uart
-	url = https://git.cryptech.is/core/comm/uart.git
-[submodule "core/hash/sha1"]
-	path = core/hash/sha1
-	url = https://git.cryptech.is/core/hash/sha1.git
-[submodule "core/hash/sha256"]
-	path = core/hash/sha256
-	url = https://git.cryptech.is/core/hash/sha256.git
-[submodule "core/hash/sha512"]
-	path = core/hash/sha512
-	url = https://git.cryptech.is/core/hash/sha512.git
-[submodule "core/math/modexpa7"]
-	path = core/math/modexpa7
-	url = https://git.cryptech.is/core/math/modexpa7.git
-[submodule "core/platform/alpha"]
-	path = core/platform/alpha
-	url = https://git.cryptech.is/core/platform/alpha.git
-[submodule "core/rng/avalanche_entropy"]
-	path = core/rng/avalanche_entropy
-	url = https://git.cryptech.is/core/rng/avalanche_entropy.git
-[submodule "core/rng/rosc_entropy"]
-	path = core/rng/rosc_entropy
-	url = https://git.cryptech.is/core/rng/rosc_entropy.git
-[submodule "core/rng/trng"]
-	path = core/rng/trng
-	url = https://git.cryptech.is/core/rng/trng.git
-[submodule "core/rng/vndecorrelator"]
-	path = core/rng/vndecorrelator
-	url = https://git.cryptech.is/core/rng/vndecorrelator.git
-[submodule "core/util/mkmif"]
-	path = core/util/mkmif
-	url = https://git.cryptech.is/core/util/mkmif.git
-[submodule "sw/stm32"]
-	path = sw/stm32
-	url = https://git.cryptech.is/sw/stm32.git
-[submodule "sw/libhal"]
-	path = sw/libhal
-	url = https://git.cryptech.is/sw/libhal.git
-[submodule "sw/thirdparty/libtfm"]
-	path = sw/thirdparty/libtfm
-	url = https://git.cryptech.is/sw/thirdparty/libtfm.git
-[submodule "user/ft/libcli"]
-	path = user/ft/libcli
-	url = https://git.cryptech.is/user/ft/libcli.git
diff --git a/firmware/Makefile b/firmware/Makefile
deleted file mode 100644
index fc98e1d..0000000
--- a/firmware/Makefile
+++ /dev/null
@@ -1,35 +0,0 @@
-# Preliminary makefile for releng/alpha/firmware, just to test the
-# basic build sequence before we start messing with packaging scripts,
-# version numbers, and other forms of entertainment.  Expect changes.
-
-export GNUPGHOME := /home/aptbot/gnupg
-
-TARBALL   := package.tar.gz
-BITSTREAM := core/platform/alpha/build/alpha_fmc.bit
-BINARIES  := sw/stm32/projects/bootloader/bootloader.bin sw/stm32/projects/hsm/hsm.bin
-FIRMWARE  := ${BITSTREAM} ${BINARIES} ${BINARIES:.bin=.elf}
-RTLSOURCE := $(shell find core -name .git -prune -o -path core/platform/alpha/build -prune -o -type f -print)
-
-all: bitstream elves package
-
-bitstream: ${BITSTREAM}
-
-${BITSTREAM}: ${RTLSOURCE}
-	cd core/platform/alpha/build; ${MAKE}
-
-${BINARIES}: elves
-
-elves:
-	cd sw/stm32; ${MAKE} bootloader hsm
-
-package: ${TARBALL}
-
-${TARBALL}: ${FIRMWARE}
-	./build-package.py $(basename $@) $^
-	gzip -9f $(basename $@)
-
-clean:
-	git clean -dfx
-	git submodule foreach git clean -dfx
-
-.PHONY: all bitstream elves package clean
diff --git a/firmware/README.md b/firmware/README.md
deleted file mode 100644
index ebf4015..0000000
--- a/firmware/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-Preliminary release engineering super-repository for building firmware
-for the Cryptech "Alpha" board.
-
-Primary tasks here are to build a bitstream for the FPGA and the
-"bootstrap" and "hsm" images for the Alpha's CPU.
-
-Eventually there will be a lot of packaging and versioning glorp here,
-but let's start with basic build and clean targets.
-
-Current repository structure is, um, complicated.  On the RTL side, we
-have a tree of simple subrepositories, each representing one RTL core.
-
-On the software side, we have a subrepository which has several
-subrepositories of its own: current thinking is that this should
-probably be replaced by separate repositories and Makefile VPATH
-magic, but this is what we have today so it's what we build with
-today.
-
-This README is probably obsolete by the time you're reading it.
diff --git a/reprepro-conf/distributions b/reprepro-conf/distributions
new file mode 100644
index 0000000..4d06b15
--- /dev/null
+++ b/reprepro-conf/distributions
@@ -0,0 +1,15 @@
+Origin: cryptech.is
+Label: cryptech.is APT repository
+Codename: jessie
+Architectures: i386 amd64 source
+Components: main
+Description: cryptech.is APT Repository
+SignWith: yes
+
+Origin: cryptech.is
+Label: cryptech.is APT repository
+Codename: xenial
+Architectures: i386 amd64 source
+Components: main
+Description: cryptech.is APT Repository
+SignWith: yes
diff --git a/software/reprepro-conf/options b/reprepro-conf/options
index f5ad660..f5ad660 100644
--- a/software/reprepro-conf/options
+++ b/reprepro-conf/options
diff --git a/software/.gitmodules b/software/.gitmodules
deleted file mode 100644
index a464eb3..0000000
--- a/software/.gitmodules
+++ /dev/null
@@ -1,9 +0,0 @@
-[submodule "source/sw/libhal"]
-	path = source/sw/libhal
-	url = https://git.cryptech.is/sw/libhal.git
-[submodule "source/sw/pkcs11"]
-	path = source/sw/pkcs11
-	url = https://git.cryptech.is/sw/pkcs11.git
-[submodule "source/sw/thirdparty/libtfm"]
-	path = source/sw/thirdparty/libtfm
-	url = https://git.cryptech.is/sw/thirdparty/libtfm.git
diff --git a/software/README.md b/software/README.md
deleted file mode 100644
index 15c1006..0000000
--- a/software/README.md
+++ /dev/null
@@ -1,31 +0,0 @@
-Preliminary release engineering super-repository for building software
-to work with the Cryptech "Alpha" board.
-
-Primary task here is to build the PKCS #11 library and any needed
-support tools for whichever platforms we support.  This will involve
-some packaging voodoo.
-
-Our first targets for this are Debian and Ubuntu, probably the Jessie
-and Xenial releases, respectively.  If we really need to support
-multiple releases for each of these platforms, the packaging mechanics
-become more complicated, so we may just stop here for these platforms
-and assume we can fill any odd corners using the associated source
-package.
-
-Our next target for this is likely to be Mac OS X.  This should be
-relatively straightforward so long as we only have to support Homebrew
-and we don't have to produce Homebrew "bottles" (binary packages).  If
-we do need to bottle, we either need one or more Mac build machines or
-we need some kind of cross-compilation scheme (eg,
-https://github.com/tpoechtrager/osxcross).
-
-Supporting Homebrew at all requires a bit of extra voodoo on top of
-supporting Debian packaging, but none of it looks particularly
-difficult, and the Debian packaging will produce the source tarball we
-need for the Homebrew formula, so integrating production of these two
-kinds of packaging makes some sense.
-
-Windoze is not currently on the radar.  In theory, MinGW would suffice
-as a cross compiler if and when we have to do something about it.
-
-This README is probably obsolete by the time you're reading it.
diff --git a/software/reprepro-conf/distributions b/software/reprepro-conf/distributions
deleted file mode 100644
index 57c1afc..0000000
--- a/software/reprepro-conf/distributions
+++ /dev/null
@@ -1,7 +0,0 @@
-Origin: cryptech.is
-Label: cryptech.is APT repository
-Codename: jessie
-Architectures: i386 amd64 source
-Components: main
-Description: cryptech.is APT Repository
-SignWith: yes
diff --git a/software/source/sw/libhal b/software/source/sw/libhal
deleted file mode 160000
-Subproject 709a71c0030225ba08cddf5227a1c67c2dbb417
diff --git a/software/source/sw/thirdparty/libtfm b/software/source/sw/thirdparty/libtfm
deleted file mode 160000
-Subproject 269fc4e58f616a2cf1c318f494ec18a52991da8
diff --git a/software/source/Makefile b/source/Makefile
index e2fdb1b..e2fdb1b 100644
--- a/software/source/Makefile
+++ b/source/Makefile
diff --git a/firmware/core/cipher/aes b/source/core/cipher/aes
-Subproject 915759285c179cf99be3c17ad401c79e4b8be05
+Subproject 915759285c179cf99be3c17ad401c79e4b8be05
diff --git a/firmware/core/cipher/chacha b/source/core/cipher/chacha
-Subproject 549b75a635817ce263c368c9b8b5b0b07f90ec2
+Subproject 549b75a635817ce263c368c9b8b5b0b07f90ec2
diff --git a/firmware/core/comm/fmc b/source/core/comm/fmc
-Subproject 61c16de8beb8deaadd2ffedfabfb3ce96e8699f
+Subproject 61c16de8beb8deaadd2ffedfabfb3ce96e8699f
diff --git a/firmware/core/comm/uart b/source/core/comm/uart
-Subproject 0d3acd1815da8fcbd2b30f4fe1ff514f87b2522
+Subproject 0d3acd1815da8fcbd2b30f4fe1ff514f87b2522
diff --git a/firmware/core/hash/sha1 b/source/core/hash/sha1
-Subproject ae915a1ed47a807ec880c2f18053e4f8eda6bd9
+Subproject ae915a1ed47a807ec880c2f18053e4f8eda6bd9
diff --git a/firmware/core/hash/sha256 b/source/core/hash/sha256
-Subproject c894f78a95a01351f277c3d36bcf6dced08798e
+Subproject c894f78a95a01351f277c3d36bcf6dced08798e
diff --git a/firmware/core/hash/sha512 b/source/core/hash/sha512
-Subproject 88e0d83768004b6bab2d83edf7eae2841678b51
+Subproject 88e0d83768004b6bab2d83edf7eae2841678b51
diff --git a/firmware/core/math/modexpa7 b/source/core/math/modexpa7
-Subproject 4612bc24a8b43c14580d6be06542b1fa9a6e615
+Subproject 4612bc24a8b43c14580d6be06542b1fa9a6e615
diff --git a/firmware/core/platform/alpha b/source/core/platform/alpha
-Subproject fc8be8024560bb77221758b0351c3de7b4ea6e9
+Subproject fc8be8024560bb77221758b0351c3de7b4ea6e9
diff --git a/firmware/core/rng/avalanche_entropy b/source/core/rng/avalanche_entropy
-Subproject 5742813ab43fec9fa90d970f086f1e266875b8f
+Subproject 5742813ab43fec9fa90d970f086f1e266875b8f
diff --git a/firmware/core/rng/rosc_entropy b/source/core/rng/rosc_entropy
-Subproject 48e3c117ae6944775010031b1691446220944b6
+Subproject 48e3c117ae6944775010031b1691446220944b6
diff --git a/firmware/core/rng/trng b/source/core/rng/trng
-Subproject 953909d18796c1caea35263eb902b1dd7021d92
+Subproject 953909d18796c1caea35263eb902b1dd7021d92
diff --git a/firmware/core/rng/vndecorrelator b/source/core/rng/vndecorrelator
-Subproject 49e388c3dadcaabe1e4e66a37fcd52b2f125c1d
+Subproject 49e388c3dadcaabe1e4e66a37fcd52b2f125c1d
diff --git a/firmware/core/util/mkmif b/source/core/util/mkmif
-Subproject fd1dd73410ba6ca3d082ff61e4b39d6e8c2de35
+Subproject fd1dd73410ba6ca3d082ff61e4b39d6e8c2de35
diff --git a/software/source/debian/compat b/source/debian/compat
index ec63514..ec63514 100644
--- a/software/source/debian/compat
+++ b/source/debian/compat
diff --git a/software/source/debian/control b/source/debian/control
index 8ae25b9..8ae25b9 100644
--- a/software/source/debian/control
+++ b/source/debian/control
diff --git a/software/source/debian/copyright b/source/debian/copyright
index ec25460..ec25460 100644
--- a/software/source/debian/copyright
+++ b/source/debian/copyright
diff --git a/software/source/debian/rules b/source/debian/rules
index 2d33f6a..2d33f6a 100755
--- a/software/source/debian/rules
+++ b/source/debian/rules
diff --git a/software/source/debian/source/format b/source/debian/source/format
index 89ae9db..89ae9db 100644
--- a/software/source/debian/source/format
+++ b/source/debian/source/format
diff --git a/firmware/sw/libhal b/source/sw/libhal
-Subproject 709a71c0030225ba08cddf5227a1c67c2dbb417
+Subproject 709a71c0030225ba08cddf5227a1c67c2dbb417
diff --git a/software/source/sw/pkcs11 b/source/sw/pkcs11
-Subproject 3118c1384c46140269033ea63faa6ebca9a3af5
+Subproject 3118c1384c46140269033ea63faa6ebca9a3af5
diff --git a/firmware/sw/stm32 b/source/sw/stm32
-Subproject 0d25f920c9024a3a6f994b8f17b9b28ffa6e093
+Subproject 0d25f920c9024a3a6f994b8f17b9b28ffa6e093
diff --git a/firmware/sw/thirdparty/libtfm b/source/sw/thirdparty/libtfm
-Subproject 269fc4e58f616a2cf1c318f494ec18a52991da8
+Subproject 269fc4e58f616a2cf1c318f494ec18a52991da8
diff --git a/firmware/user/ft/libcli b/source/user/ft/libcli
-Subproject 54c6b8649b1a13e69a908c96e8d4d19cf8d7284
+Subproject 54c6b8649b1a13e69a908c96e8d4d19cf8d7284