Commit Graph

156 Commits (291adfe87d1194a86d4eaaabc4e942e030d41218)

Author SHA1 Message Date
Daniele Lacamera 291adfe87d Fixed merge of user_settings with new TPM logic 2023-09-21 08:31:28 +02:00
Daniele Lacamera 20e8b021b5 Added NS wrappers for PKCS11 API 2023-09-21 07:57:18 +02:00
Daniele Lacamera 5b57d2d08f PKCS11 store functions using wolfBoot hal 2023-09-21 07:57:18 +02:00
Daniele Lacamera 80f881dab5 Fixed STM32L5 TRNG driver + simplified GTZC and SAU setup 2023-09-21 07:57:18 +02:00
Daniele Lacamera fd809c5b69 Expanded WCS interface
- Added TRNG driver for STM32L5
- Link with correct objects in test-app
- Expanded wc_callable interface
2023-09-21 07:57:18 +02:00
Daniele Lacamera 9bf80ab8cd Initial draft: wolfcrypt secure mode 2023-09-21 07:57:18 +02:00
Marco Oliverio d9d1492ec8 makefile: add inlcude/target.h dep to keytools target 2023-09-19 10:12:59 +00:00
David Garske c04960c097 Fix simulator to not just while(1) on panic, which causes CI to spin/timeout (instead exit with error). Fix ROT logic and make sure read error code gets passed up stack. 2023-09-12 12:26:48 +02:00
David Garske 2349a68e76 Added support for storing sealed blobs into NV. Refactor the TPM signature verify to use existing load public key function and generic verify hash TPM function. Added support for RSA sign with ASN.1 encoding (Example: `SIGN=RSA2048ENC`). 2023-09-12 12:26:48 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy.
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
2023-09-12 12:26:48 +02:00
Marco Oliverio ef8f686760 Makefile: clean lib/wolfTPM/hal/*.o objects 2023-08-25 18:43:50 +02:00
Tesfa Mael 1fcac3557b Update makefile for SLOC 2023-08-22 07:18:15 +02:00
David Garske 6ea1a1e4a5 Added GitHub action build tests for NXP parts (iMX RT, Kinetis and LPC). 2023-08-21 11:08:48 +02:00
David Garske 2f0e699f82 Fix for keytools with path having spaces. Added note about sign.c use of `WOLFBOOT_SECTOR_SIZE` for delta support. 2023-08-18 10:39:42 -07:00
Daniele Lacamera e6e3afa0f4 sign.c: Fixed delta file truncate-before-close 2023-08-17 17:04:02 +02:00
David Garske 9ca58248e4 Adding GitHub Action for testing TPM features. 2023-08-17 13:43:58 +02:00
David Garske 69adb25496 wolfBoot TPM improvements:
* Added TPM SPI wait state support and debug logging.
* Added platform auth ownership (change platform password to random value before boot). Can be disabled using `WOLFBOOT_TPM_NO_CHG_PLAT_AUTH`.
* Added parameter encryption support.
* Added TPM based root of trust based on https://github.com/wolfSSL/wolfTPM/pull/276
* Removed the TPM hashing feature (not practical).
* Fixed RSA with wolfTPM build.
* Fixed cleanup wolfTPM objects on make clean.
2023-08-17 13:43:58 +02:00
David Garske db032d1461
Merge pull request #330 from danielinux/stage1_verify
x86 Stage1: add verification of components
2023-08-10 13:52:24 -07:00
David Garske 727fc12a35 Speedup the key tool builds. 2023-08-07 20:54:18 +02:00
David Garske 7190392245 Simulator fixes and support for using MacOS:
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
2023-08-07 20:54:18 +02:00
Daniele Lacamera 21493fcd8d Deprecate python keytools. 2023-08-03 08:05:18 +02:00
Daniele Lacamera 02dfec6fac Added wolfBoot authentication in stage1 2023-07-27 14:49:23 +02:00
Marco Oliverio c4ec5eef35 x86: support Intel FSP (TigerLake and QEMU) 2023-07-24 18:12:32 +00:00
Marco Oliverio 93bedf7333 Makefile: force stage1 building 2023-07-24 18:12:13 +00:00
David Garske db15f9b0f1 Further NXP P1021 fixes and improvements:
* Added ELF32 and ELF64 loader support (config `ELF=1` or build option `WOLFBOOT_ELF`).
* Add ELF support to `update_ram.c` loader.
* Add support for loading entire flash image to RAM when `EXT_FLASH=1` and `NO_XIP=1` (or `WOLFBOOT_USE_RAMBOOT`).
* Added QUICC Engine support to load microcode and enable.
* Add multiple core support for NXP P1021.
* Fixes to resolve first stage boot ROM relocation.
  - Implemented temporary workaround to resolve stack traps.
* Added PPC GOT relocation support.
* Fix for the PPC `isr_empty` handler address.
* Fix to allow stack to use DDR by having assembly setup DDR TLB. After relocating wolfBoot use stack on DDR.
* Cleanup wolfBoot output.
  - Only remove extra .bin/.elf created unless `make distclean` is used.
  - Don't output the key grep test (only check result).
  - Adjust build order (first stage, wolfboot, test app, key, sign test app and factory).
  - Fix to make sure linker script is rebuilt before objects.

Sample NXP P1021 Output:

```
Relocating BOOT ROM to DDR
Loading wolfBoot to DDR
Jumping to full wolfBoot
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
QE: Length 63732, Count 1
QE: uploading 'Microcode for P1021 r1.0' version 0.0.1
QE: Traps 0
MP: Starting core 2 (spin table 0xFFFFF240)
Versions: Boot 1, Update 0
Trying Boot partition at 0x200000
Loading header 512 bytes to 0x1DFFFE00
Loading image 3170724 bytes to 0x1E000000
Image size 3170724
Firmware Valid
Loading elf at 0x1E000000
Found valid elf32 (big endian)
Booting at 0x6000
```
2023-07-05 17:03:57 +02:00
David Garske a56e2252c1 Revert the TPM based key store (root of trust). This feature is not ready for next release. 2023-07-04 08:36:41 +02:00
Daniele Lacamera 588b3192d2 New simulator tests
- internal flash now mapped at 0xC0000000 (using `ARCH_FLASH_OFFSET`)
- wolfBoot binary included in internal flash (wolfboot partition is also
  now writeable to test self-updates and encryption)
- sim test app supports encryption (sets the key for test)
- added new target to store the update in the external flash
- external flash mapped to 0xD0000000
2023-05-15 11:13:38 +02:00
David Garske 0b7603f7bf
Merge pull request #303 from jpbland1/preseal
add script for preseal a public key to tpm
2023-05-05 15:02:55 -07:00
John Bland cbf3cffa96 add script for preseal a public key to tpm
add more detailed instructions on how to prepare a TPM keystore build and how to use the preseal script
2023-05-04 20:49:02 -04:00
David Garske 69ca95eb94 Adds `factory_wstage1.bin` option to include first stage loader. Fix test-app verbose issue. 2023-04-21 16:41:00 +02:00
David Garske 553ec760fd NXP QorIQ refactor for shared PPC (e500 / e6500) registers
* Fixes for e500 L1/L2 cache.
* Fixes for eLBC and DDR3 drivers on P1021.
* Fixes for LAW and TLB for P1021.
* Fix for the e500v2 core peripheral issues with data barrier / coherency safety.
* Support for SP math all (`SPMATHALL=1`).
* Support for stage 1 loader (`make stage1`).
2023-04-21 16:41:00 +02:00
Daniele Lacamera 99980348dd Update MAIN_TARGET for raspberry pi builds 2023-03-09 18:38:48 +01:00
Brett Nicholas 680ce5f8e8 first commit - test app boots on MIMXRT1064-EVK 2023-03-06 17:31:48 +01:00
David Garske 8dd0ee347f Support for the STM32 OCTOSPI peripheral. 2023-02-02 12:11:23 -08:00
Daniele Lacamera bf62ebe3fd Fix GPIO mode for SPI CS pins 2022-12-20 13:54:17 +01:00
David Garske a9526bab8f STM32 QSPI Flash support. Refactor SPI to allow different GPIO base/AF for each pin. Adds `DEBUG_UART` support for H7. 2022-12-20 13:31:28 +01:00
David Garske f283929161 Improvements to gap fill. The default gap filling byte is `0xFF`. If using `FLAGS_INVERT=1` uses `0x00`. Can be overridden at build-time using `FILL_BYTE`. Fixes ZD 15356. 2022-12-19 11:38:00 +01:00
Lealem Amedie 18bfcecd6b wolfBoot cmake support 2022-12-07 13:00:10 -08:00
David Garske bfed41889b Improvements to the NXP T2080 support. Adds NOR Flash and IFC configuration. Adds CPLD support. Make `DEBUG_UART` a configure option. 2022-12-06 06:20:48 +01:00
David Garske 2fc899254f Cleanups for NXP T2080 DEOS support:
* Expanded the NXP QorIQ T2080 documentation in `docs/Targets.md`.
* T2080 fixes for boot code placement and generation of .bin.
* T2080 UART driver cleanup.
* Improve bin-assemble fill speed and report items added.
* Make portability fixes to enable building in `mingw32-make`.
* Cleanup the `docs/Targets.md` sections and links.
* Cleanup execute bits on code files.
2022-12-06 06:20:48 +01:00
Daniele Lacamera ba88748b38 Add -fomit-frame-pointer to CFLAGS 2022-10-13 14:22:55 +02:00
Daniele Lacamera a6fdec3901 self-encrypt prototype; tested on stm32l0 2022-09-21 18:49:52 +02:00
Daniele Lacamera 16dc1628af Fixed target 'simulator' 2022-07-21 20:23:13 +02:00
Daniele Lacamera 93dd53ac0f Fixed support for raspberry-pi 2022-07-21 20:18:34 +02:00
Daniele Lacamera 1542a15c90 Keystore: array of public keys generated by keygen 2022-07-19 15:32:28 +02:00
Marco Oliverio c077207b01 feature: simulated target
This commit introduces a simulated target where the internal and optionally the
external flash can be simulated and backed by files. Using this target will
produce an executable wolfBoot ELF image.
2022-07-12 10:13:10 +02:00
Daniele Lacamera acfdd1f676 Added support for RSA3072 2022-05-31 12:13:34 +02:00
Daniele Lacamera cb0a903999 Reverted UPDATE_OBJS:= in Makefile (breaks lib build) 2022-05-20 08:06:07 +02:00
David Garske f63c323677 Cleanups and restore a few changes. 2022-05-20 08:06:07 +02:00
Daniele Lacamera 48466be46c Minor fixes 2022-05-20 08:06:07 +02:00