Commit Graph

141 Commits (291adfe87d1194a86d4eaaabc4e942e030d41218)

Author SHA1 Message Date
Daniele Lacamera 291adfe87d Fixed merge of user_settings with new TPM logic 2023-09-21 08:31:28 +02:00
Daniele Lacamera 20e8b021b5 Added NS wrappers for PKCS11 API 2023-09-21 07:57:18 +02:00
Daniele Lacamera fd809c5b69 Expanded WCS interface
- Added TRNG driver for STM32L5
- Link with correct objects in test-app
- Expanded wc_callable interface
2023-09-21 07:57:18 +02:00
David Garske c3378475ac
Merge pull request #369 from danielinux/armv8m-asm
Enable sp_math assembly optimizations for cortex-m33
2023-09-20 10:33:26 -07:00
Daniele Lacamera 1121a1c5f8 Expanded wolfBoot partition in stm32U5-dualbank 2023-09-20 13:52:29 +02:00
Daniele Lacamera 6ce0bbf013 Stm32l5 configuration: increase wolfboot partition
Bootloader partition expanded to 48KB to accommodate assembly
optimizations in wolfBoot.
2023-09-20 13:49:57 +02:00
Marco Oliverio c428d5ad23 config: tgl: default wolfboot load base to 64 MB
To have more room for app loading
2023-09-19 10:12:59 +00:00
Marco Oliverio e24c372777 fsp: remove WOLFBOOT_FIXED_PARTITIONS (and hardcoded size limit)
now the size of the image is limited by the available memory only.
The image is loaded in RAM just after wolfboot.
2023-09-19 10:12:59 +00:00
Daniele Lacamera d79ae03fba Updated configuration for tgl target 2023-09-19 10:12:59 +00:00
Daniele Lacamera 0babaae04a Stage1: allow signing with ecc384/sha384 2023-09-19 09:33:16 +00:00
David Garske 2349a68e76 Added support for storing sealed blobs into NV. Refactor the TPM signature verify to use existing load public key function and generic verify hash TPM function. Added support for RSA sign with ASN.1 encoding (Example: `SIGN=RSA2048ENC`). 2023-09-12 12:26:48 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy.
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
2023-09-12 12:26:48 +02:00
jordan e23d450e45 LMS wolfBoot support. 2023-09-06 07:57:10 +02:00
Marco Oliverio 6d1ed6db6b config: examples: kontron_vx3060s2: re-arrange components 2023-08-25 18:43:50 +02:00
David Garske 19424c86c9 Added optional `WOLFBOOT_TPM_KEYSTORE_AUTH` for build-time NV auth. 2023-08-22 07:12:05 +02:00
John Bland 131df548e6 Merge branch 'master' into nvm-encrypt-configs 2023-08-21 10:13:46 -04:00
David Garske 6ea1a1e4a5 Added GitHub action build tests for NXP parts (iMX RT, Kinetis and LPC). 2023-08-21 11:08:48 +02:00
David Garske 712a543c9d Fixes and improvements for iMXRT1050 QSPI. 2023-08-21 11:08:48 +02:00
John Bland 6302870a88 fix bad config address for simulator 2023-08-21 01:47:22 -04:00
John Bland c32f05c9fb add configs for NVM_FLASH_WRITEONCE with encription,
FLAGS_HOME, and invert. the powerfail test will fail for these configs to show the problem
2023-08-21 01:26:55 -04:00
David Garske 701674be4f
Merge pull request #343 from jpbland1/add-nvm-configs
add combinations of NVM_FLASH_WRITEONCE config tests
2023-08-17 07:02:51 -07:00
David Garske 9ca58248e4 Adding GitHub Action for testing TPM features. 2023-08-17 13:43:58 +02:00
David Garske b012cb9479 Fixes for measured boot. 2023-08-17 13:43:58 +02:00
David Garske 103503cf8a Fixes to get WOLFBOOT_TPM_KEYSTORE working with ECC SRK and Parameter Encryption. 2023-08-17 13:43:58 +02:00
John Bland baac5cc120 revert unready tests 2023-08-17 01:42:27 -04:00
John Bland 9fa6bb3ade add combinations of NVM_FLASH_WRITEONCE config tests 2023-08-15 17:06:48 -04:00
John Bland 6cbac8326f fix old address scheme in config 2023-08-15 12:44:35 -04:00
John Bland 20184d2b24 add test to demonstrate that NVM_FLASH_WRITEONCE
is calling nvm_select_fresh_sector on a potentially external partition, which will fail and crashes the simulator. the next commit will hold the fix
2023-08-15 02:57:46 -04:00
David Garske db032d1461
Merge pull request #330 from danielinux/stage1_verify
x86 Stage1: add verification of components
2023-08-10 13:52:24 -07:00
David Garske 7190392245 Simulator fixes and support for using MacOS:
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
2023-08-07 20:54:18 +02:00
Daniele Lacamera 95c7b92762 Moved FSP_M back to XIP 2023-08-07 15:47:40 +02:00
Daniele Lacamera 66c9ce8daa Addressed some of reviewer's comments 2023-08-03 19:37:31 +02:00
Daniele Lacamera a81365437b STAGE1_AUTH feature ported to TGL (untested) 2023-08-01 11:44:58 +02:00
John Bland c453e001fb add math define to rsa-sim 2023-07-28 07:55:16 +02:00
John Bland bd070816d1 add missing configs 2023-07-28 07:55:16 +02:00
Daniele Lacamera 06b6c0103e Feature: verification of FSP images' signatures 2023-07-27 09:39:53 +02:00
Marco Oliverio c4ec5eef35 x86: support Intel FSP (TigerLake and QEMU) 2023-07-24 18:12:32 +00:00
David Garske db15f9b0f1 Further NXP P1021 fixes and improvements:
* Added ELF32 and ELF64 loader support (config `ELF=1` or build option `WOLFBOOT_ELF`).
* Add ELF support to `update_ram.c` loader.
* Add support for loading entire flash image to RAM when `EXT_FLASH=1` and `NO_XIP=1` (or `WOLFBOOT_USE_RAMBOOT`).
* Added QUICC Engine support to load microcode and enable.
* Add multiple core support for NXP P1021.
* Fixes to resolve first stage boot ROM relocation.
  - Implemented temporary workaround to resolve stack traps.
* Added PPC GOT relocation support.
* Fix for the PPC `isr_empty` handler address.
* Fix to allow stack to use DDR by having assembly setup DDR TLB. After relocating wolfBoot use stack on DDR.
* Cleanup wolfBoot output.
  - Only remove extra .bin/.elf created unless `make distclean` is used.
  - Don't output the key grep test (only check result).
  - Adjust build order (first stage, wolfboot, test app, key, sign test app and factory).
  - Fix to make sure linker script is rebuilt before objects.

Sample NXP P1021 Output:

```
Relocating BOOT ROM to DDR
Loading wolfBoot to DDR
Jumping to full wolfBoot
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
QE: Length 63732, Count 1
QE: uploading 'Microcode for P1021 r1.0' version 0.0.1
QE: Traps 0
MP: Starting core 2 (spin table 0xFFFFF240)
Versions: Boot 1, Update 0
Trying Boot partition at 0x200000
Loading header 512 bytes to 0x1DFFFE00
Loading image 3170724 bytes to 0x1E000000
Image size 3170724
Firmware Valid
Loading elf at 0x1E000000
Found valid elf32 (big endian)
Booting at 0x6000
```
2023-07-05 17:03:57 +02:00
David Garske a56e2252c1 Revert the TPM based key store (root of trust). This feature is not ready for next release. 2023-07-04 08:36:41 +02:00
Dimitri Papadopoulos be037ca04d Fix typos found by codespell 2023-07-04 07:43:02 +02:00
John Bland c6629ed86a add missing steps for policy pubkey sealing
update wolfTPM version to include new sealing functions, add preseal helper commands
2023-05-18 12:33:49 +02:00
John Bland 6a21c02e6c add a simulator test for using encryption and delta updates
increase argument count max since the tools duplicate the sig and hash args
2023-05-17 19:39:00 +02:00
Daniele Lacamera 048af83858 New partition sizes in tests 2023-05-15 13:38:57 +02:00
Daniele Lacamera 39d8eedc61 Added sim-encrypt tests to github workflow 2023-05-15 11:54:37 +02:00
Daniele Lacamera 588b3192d2 New simulator tests
- internal flash now mapped at 0xC0000000 (using `ARCH_FLASH_OFFSET`)
- wolfBoot binary included in internal flash (wolfboot partition is also
  now writeable to test self-updates and encryption)
- sim test app supports encryption (sets the key for test)
- added new target to store the update in the external flash
- external flash mapped to 0xD0000000
2023-05-15 11:13:38 +02:00
David Garske 6f24981f03 Improvements to the clock calculation code (dynamic based on ratio). Remove execute bits on files. Make stage1 PIC. Disable L1/L2 for first stage. Add PLT/GOT to .data region. 2023-05-10 15:11:09 -07:00
David Garske fb20f2d41f Fix the eLBC NAND flash driver issues with page/col selection. Allow override of the `WOLFBOOT_SHA_BLOCK_SIZE`.
```
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
Part: Active 0, Address 0
Boot partition: 200000
Image size 3964
Firmware Valid
Loading 3964 bytes to RAM at 1E000000
Booting at 1E000000
```
2023-05-05 12:18:16 -07:00
David Garske c8a28005ac Disable XIP support. This enables `PART_BOOT_EXT` to correctly load the boot partition from external flash. 2023-05-05 10:43:10 -07:00
David Garske 0f110e4cd9 Progress on eSPI support for NXP P1021 TPM. 2023-05-04 15:23:45 -07:00
David Garske ef35f473c9
Merge pull request #296 from jpbland1/tpm-root-trust
wolfTPM pubkey storage with policy based access restriction
2023-05-04 15:09:06 -07:00