WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
3,123 Commits
31 Branches
32 Tags
44 MiB
Commit Graph

150 Commits (3bfd7de34d02a810aafbee0e338f03bc5b8d57db)

Author SHA1 Message Date
Yosuke Shimizu f4d5340641 Add hardware-based DICE on mcxn 2026-05-21 20:49:20 +02:00
Brett Nicholas 627e0664a2 fix include order for unit tests 2026-05-05 16:37:54 +02:00
Brett Nicholas a2e9267529 Adds generic cryptocb support for PK, hash, and symmetric crypto 2026-05-05 16:37:54 +02:00
Brett Nicholas 65d84a29ec Add SW-only RSA PSS 2026-04-28 15:02:57 +02:00
Daniele Lacamera cffa75d4a4 Proper interface renaming + documentation 2026-04-22 14:14:28 +02:00
Daniele Lacamera b22c85ed27 Added support for fTPM in TrustZone + STM32H5 test app 2026-04-21 20:53:48 +02:00
Brett Nicholas 2e7839e4ee add additional check for DELTA_UPDATE + DISABLE_BACKUP incompatibility 2026-04-17 08:27:05 +02:00
Brett Nicholas c45268ed7f monolithic self-updates: force DISABLE_BACKUP=1, eliminate swap, eliminate update code 2026-04-17 08:27:05 +02:00
Daniele Lacamera 776378ca78 Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
Daniele Lacamera 3697f9e335 image: use portable noinline macro 
F/2273
 2026-04-10 21:39:19 +02:00
Daniele Lacamera f5d50d4257 enforce skip-verify prerequisites 
F/2256
 2026-04-08 19:53:50 +02:00
Brett Nicholas 9debc4c559 Fix XMSS and ML_DSA keygen type mismatch between image headers and keystore by unifying AUTH_KEY_*/KEYGEN_* constants 2026-03-30 16:32:44 +02:00
Mattia Moffa b5fab30310 Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ 2026-03-18 22:26:32 +01:00
Thomas Cook 3b1ef9d6bc Address copilot pr comments. 2026-03-18 11:53:26 +01:00
Thomas Cook dd4312679b Deploy NO_DIRECT_READ_OF_ERASED_SECTOR to protect against hardfault with AHB read of erased sector. 2026-03-18 11:53:26 +01:00
Daniele Lacamera 4eca085b54 Added USE_CLANG option to Makefile 2026-03-10 15:49:45 +01:00
Daniele Lacamera 19d562dbde Fixed build errors with cross-clang compiler 2026-03-10 15:49:39 +01:00
David Garske a5356b830a NXP T2080 Port Refresh 
* Initial port refresh for the NXP T2080 target
* IFC Flash driver and multi-core support on T2080
* Working wolfBoot test-app startup on T2080
* Support for NAII and Curtiss-Wright T2080 vendor boards
 2026-03-05 17:49:37 +01:00
Brett Nicholas 4d31ef5502 Add self-header feature with support for sim and AURIX TC3xx 2026-02-27 11:39:51 +01:00
Daniele Lacamera a20101d6df Add support for DICE attestation + PSA attestation 2026-02-06 18:36:47 +01:00
David Garske 4ff0e0ad7d
Merge pull request #662 from danielinux/zephyr-psa 
zephyr integration as TEE.
 2026-01-08 08:53:11 -08:00
Daniele Lacamera af670811fe zephyr integration as TEE. 
- Integrates wolfPSA as psa_crypto/psa_store engine in TrustZone
- Provides interface to access APIs from non-secure mode
- Patches to enable wolfboot as TEE module in zephyr
- Patches to enable stm32h563-nucleo/ns as target in zephyr
- psa_crypto zephyr example using wolfboot/wolfPSA as secure engine
 2026-01-07 08:27:58 +01:00
David Garske 12d7f0a153 Improved encryption constants between the bootloader and the signing tool. Allows the sign tool to properly use the correct block size for each encryption algorithm (64 for ChaCha, 16 for AES). 2026-01-05 20:37:04 +01:00
Mattia Moffa f12d2f06b4 Add PKCS11 backend for encrypted partitions 2025-12-30 11:15:41 +01:00
gojimmypi 985e2f76c0 Improve image header default size, check for dupe hash def 2025-12-12 17:47:09 +01:00
Daniele Lacamera 3b3aa2e7c3 Updated ChangeLog & version number. 
+ Updated wolfTPM submodule
 2025-11-26 15:50:13 +01:00
David Garske 8cb3d33339 Added STM32H5 SPI Driver and support for TPM 
Cleanup STM32H5 HAL port.
Refactor `__ARM_FEATURE_CMSE` to `TZ_SECURE()`
Refactor attribute cmse_nonsecure_entry to use new macro `CSME_NSE_API`
Added TPM Non Secure Callable API's
Added TPM support to STM32H5 test application
 2025-11-19 16:29:28 +01:00
Mattia Moffa 177358e88d Update H5 app to use new NSC API 
- Make the update and swap partitions secure and inaccessible from the
  app except via NSC API
- Add a couple of necessary new NSC functions
- Update the app to only use NSC API
- Fix hal_flash_erase to account for secure addresses
- Fix some bugs in xmodem implementation
 2025-10-29 00:13:01 +01:00
Daniele Lacamera 18cbea59de Refactoring of IV handling to prevent reusing IVs 
During fallback operations, use a different encryption IV than the one
used to encrypt the backup during the update. This ensures that the same
IV is never reused to encrypt different sectors.
 2025-10-17 09:44:46 +02:00
gojimmypi fbd8dcf8a2
Update Copyright year to 2025 2025-10-15 11:33:53 -07:00
David Garske 0ce77a4d27
Merge pull request #590 from danielinux/flash-write-as-nsc 
NSC functions: add helper to facilitate updates as trustzone non-secure callable
 2025-10-07 09:21:02 -07:00
Daniele Lacamera 568452552c Fix corruption of last boot sector with encryption 
As reported by @reza-hdd in #589:

> When Firmware is large enough to consume all the allocated boot partition sectors, in the the final swap and erase operations (_wolfBoot_swap_and_final_erase_) the last sector of FW in Boot partition, which is used as a temporary sector for a copy operation, gets corrupted after being copied in external Swap partition and copied back. It looks like the contents are copied to the external Swap partition without being encrypted, but get decrypted when it is read back.

This was due to the function wolfBoot_copy_sector() assuming that all
copies having an external SWAP as destination would not need any
encryption, as the "normal" case during update is to copy already
encrypted sectors from UPDATE->SWAP.

In the final state, after the update is successfully applied, the
mechanism saves a copy of the last sector from BOOT->SWAP. In this case,
if the application is big enough, an extra function is needed to
encrypt the content of this last sector before writing it to SWAP.

Restoring the backup is OK (normal case SWAP->BOOT, decryption was
already there as also noted by the reporter).
 2025-09-10 13:27:22 +02:00
Daniele Lacamera cd347b5886 Fix visibility of new nsc declarations 2025-09-05 18:14:04 +02:00
Daniele Lacamera 82e4950b59 Added NSC functions to facilitate updates from NS application 2025-09-05 14:12:50 +02:00
Daniele Lacamera 68e688eeb6 Updated Changelog, version 2025-08-01 13:21:47 +02:00
David Garske 73fc193931 Portability fixes with include < vs ". Added `NO_SWAP_EXT` to allow support for onboard flash swap sector. Added `WOLFSSL_NO_CT_OPS` for ECDSA verify only. Added `WC_NO_DEFAULT_DEVID` to help with code size reduction. 2025-06-16 19:05:49 +02:00
David Garske 9451b47628 Fix for Renesas TSIP key types. Fix for Renesas RX .keystore location in linker script. Fix for wolfBoot as library with Renesas to make sure crypto hardware is initialized and setup. Add forced alignment on additional buffers used for flash read/write. 2025-06-16 19:05:49 +02:00
David Garske 487efc606d Improvements for portability using older gcc 4.8.2. Make sure wolfboot.h includes the `wolfBoot_verify_*` API's. Fixed issue with parsing headers when `#include` is `# include`. 2025-06-16 19:05:49 +02:00
Brett Nicholas 7660bf66f8 Add wolfHSM cert chain verification for ECC and RSA 2025-05-27 15:42:59 -06:00
Brett Nicholas d49e507926 - Support external flash for elf scatter-loading 
- Support ELF scatter-loading on TC3xx
- Modify TC3xx HAL flash erase to support arbitrary offsets and sizes
- Realign partition size and addresses to support more efficient sector mass erase on update
 2025-05-08 08:50:26 -06:00
Daniele Lacamera c4a3415e98 Updated bootloader version number 2025-04-30 11:49:15 +02:00
Daniele Lacamera ea0b4fb935 Added missing files + cosmetics as per review 
- Added missing `test-app/app_sim_scattered.c`
- Added missing `test-app/sim_scattered.ld`
- Fixed comments at the end of define blocks for consistency
- Removed unused constants as indicated
 2025-04-11 15:55:05 +02:00
Daniele Lacamera 386a172587 Fix regressions detected by github workflows 2025-04-07 17:10:37 +02:00
Daniele Lacamera 11091944d7 ELF_SCATTERED: added sha check (WIP) 2025-04-04 19:15:04 +02:00
Brett Nicholas fb6ca4378f WIP: structure is there, but some major issues. See WOLFBOOT-ELF-LOADER-GAPS.md and video 2025-04-03 09:53:00 +02:00
Daniele Lacamera 892acfded8 Prepare release 2.4.0 2025-01-07 13:35:28 +01:00
David Garske 4991eabb18 Peer review fixes. Default to ML-DSA level 2. 2024-12-05 13:39:47 -08:00
David Garske 35b98e723b Fix the Windows keytools artifact upload. 2024-12-05 11:32:22 -08:00
David Garske 4ac4de51ac Fix ML-DSA level comment. 2024-12-05 10:29:00 -08:00
Daniele Lacamera d5e402ebde Removing compile-time parameters from keygen 2024-12-03 14:50:54 +01:00