HSMs are only supported on Linux x86_64 and macOS

[RaineKos]

I am testing out a build of Cosmian kms on a raspberry pi 5 with a zymkey 4i to create something like a micro KIMP server. I have the Zymkey working perfectly and have the PKCS11 fully connected and can see the hsm present on slot 0 in pkcs11-tool. Cosmian kms works great up until I try to add the HSM configuration and hit a brick wall with the following error.

Error: Unexpected server error: start KMS server: failed instantiating the server: Unexpected server error: Fatal: HSMs are only supported on Linux x86_64 and macOS.

I assume there is no bypass even for testing this. It just seems odd that everything else works up to this moment and all of a sudden using HSMs in ARM64 is just "forbidden"

I would appreciate some background into this.
For reference the system is using Debian Bookworm and running Cosmian kms 5.20.0. Appreciate any input or at least documenting this here so no one else wastes 6 hours to run into this.

[Manuthor]

Why this happens and how to fix it

The restriction is intentional but overly broad. The proprietary HSM vendors
(Proteccio, Utimaco, Crypt2pay) only ship x86_64 Linux shared libraries — there
is no aarch64 build from those vendors, period. The arch guard is applied to the
entire HSM dispatch block rather than per-driver, which kills
softhsm2, smartcardhsm, and the generic other model on ARM64.

That said, this is a source-available project — the fix is a two-line change
and you have the code in front of you.

---

How to fix it yourself right now

Build from source and make two targeted edits in
crate/server/src/core/kms/mod.rs:

1. Relax the top-level arch bail (line ~213)

// Before
#[cfg(not(any(
    all(target_os = "linux", target_arch = "x86_64"),
    target_os = "macos"
)))]
kms_bail!("Fatal: HSMs are only supported on Linux x86_64 and macOS");

// After
#[cfg(not(any(
    all(target_os = "linux", target_arch = "x86_64"),
    all(target_os = "linux", target_arch = "aarch64"),
    target_os = "macos"
)))]
kms_bail!("Fatal: HSMs are only supported on Linux x86_64, Linux aarch64, and macOS");

2. Extend the other / softhsm2 / smartcardhsm arm guards (line ~218)

These three arms carry #[cfg(all(target_os = "linux", target_arch = "x86_64"))]
or the equivalent. Change each to:

#[cfg(any(
    all(target_os = "linux", target_arch = "x86_64"),
    all(target_os = "linux", target_arch = "aarch64"),
    target_os = "macos"
))]

No changes needed in the HSM crates themselves — softhsm2_pkcs11_loader already
compiles cleanly on aarch64.

Wiring up Zymkey

Use the other model. It loads any PKCS#11 .so via the OTHER_HSM_PKCS11_LIB
environment variable — exactly what Zymkey exposes:

export OTHER_HSM_PKCS11_LIB=/usr/lib/zymbit/libzymkeyssl.so  # adjust to your SDK path

[hsm]
hsm_model = "other"
slot_passwords = [{ slot = 0, password = "" }]  # Zymkey PIN if set, empty otherwise

Verify the library path first with pkcs11-tool --module $OTHER_HSM_PKCS11_LIB --list-slots.
If that works, the KMS will work once the arch guard is relaxed.

Contributing back

A PR removing the unnecessary x86_64 restriction on the other / softhsm2 /
smartcardhsm arms is welcome and will be merged quickly — it is a clean, safe
change that benefits anyone running on ARM hardware.

[RaineKos]

This is great feedback. I am just through a compile of the source code (I am very new to rust, have a little experience in C). There were a few more guards throughout the mod.rs file that needed to be relaxed the same way. Specifically these (although my line numbers will be a little off since my reference is post modification):

the use smartcardhsm_pkcs11_loader, use softhsm2_pkcs11_loader, use tokio::sync::OnceCell, const OTHER_HSM_PKCS11_LIB, static GLOBAL_HSM: OnceCell..., and macro_rules! instantiate_hsm_with_env.

Once I did all these, I now have a clean compile. I will put it through some unit tests, and try a full connection to the HSM and if all that goes will, I will explore trying to get a PR in for it. I never contributed to somebody's github project that was as well organized as this so it may take a bit for me to figure out the process. If I can't at least all this will get someone the rest of the way to finish it off. Thanks a ton for the help finding the right direction.