Commit Graph

221 Commits (5dd9fa94d7eac68a035ed8fd07587a8e1981d0d1)

Author SHA1 Message Date
Daniele Lacamera 6ce0bbf013 Stm32l5 configuration: increase wolfboot partition
Bootloader partition expanded to 48KB to accommodate assembly
optimizations in wolfBoot.
2023-09-20 13:49:57 +02:00
David Garske 6dbe4a0129 Refactor to allow using seal/unseal without image header. Just pass the public key hint and policy directly. 2023-09-12 12:26:48 +02:00
David Garske 05b83544fb Fixes based on peer review. Add output of signed policy to file (append .sig). Tested successfully with multiple PCRs. In example unlock_disk extend PCR with random value after unseal to prevent unsealing after boot. 2023-09-12 12:26:48 +02:00
David Garske 2349a68e76 Added support for storing sealed blobs into NV. Refactor the TPM signature verify to use existing load public key function and generic verify hash TPM function. Added support for RSA sign with ASN.1 encoding (Example: `SIGN=RSA2048ENC`). 2023-09-12 12:26:48 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy.
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
2023-09-12 12:26:48 +02:00
jordan e23d450e45 LMS wolfBoot support. 2023-09-06 07:57:10 +02:00
John Bland 92b5c1d33a update docs for the imx-rt1060 config 2023-08-22 23:52:14 -04:00
David Garske 6ea1a1e4a5 Added GitHub action build tests for NXP parts (iMX RT, Kinetis and LPC). 2023-08-21 11:08:48 +02:00
David Garske d223b34319 Add support for the RT1050 HyperFlash configuration (default on EVKB). 2023-08-21 11:08:48 +02:00
David Garske 7073bf33b4 Fix RT1050 example app LED. Fix documentation for test-app location. Peer review feedback to clarify RT1050 flash chip configuration. 2023-08-21 11:08:48 +02:00
David Garske 712a543c9d Fixes and improvements for iMXRT1050 QSPI. 2023-08-21 11:08:48 +02:00
David Garske 2f0e699f82 Fix for keytools with path having spaces. Added note about sign.c use of `WOLFBOOT_SECTOR_SIZE` for delta support. 2023-08-18 10:39:42 -07:00
David Garske b05c7ab980 Measure wolfBoot, not application. Added TPM docs. 2023-08-17 13:43:58 +02:00
David Garske 7190392245 Simulator fixes and support for using MacOS:
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
2023-08-07 20:54:18 +02:00
David Garske 3797238546 Documentation and code comment cleanups:
* Update documentation for signing with `--no-sign`, as the key argument should not be supplied.
* Recommend `make keysclean` instead of distclean on keys mismatch.
* Renesas headings/readme link and white-space.
2023-08-04 10:13:56 +02:00
Daniele Lacamera 21493fcd8d Deprecate python keytools. 2023-08-03 08:05:18 +02:00
Daniele Lacamera 693c4c0406 docs: update documentation with Intel FSP targets 2023-07-24 18:12:32 +00:00
David Garske db15f9b0f1 Further NXP P1021 fixes and improvements:
* Added ELF32 and ELF64 loader support (config `ELF=1` or build option `WOLFBOOT_ELF`).
* Add ELF support to `update_ram.c` loader.
* Add support for loading entire flash image to RAM when `EXT_FLASH=1` and `NO_XIP=1` (or `WOLFBOOT_USE_RAMBOOT`).
* Added QUICC Engine support to load microcode and enable.
* Add multiple core support for NXP P1021.
* Fixes to resolve first stage boot ROM relocation.
  - Implemented temporary workaround to resolve stack traps.
* Added PPC GOT relocation support.
* Fix for the PPC `isr_empty` handler address.
* Fix to allow stack to use DDR by having assembly setup DDR TLB. After relocating wolfBoot use stack on DDR.
* Cleanup wolfBoot output.
  - Only remove extra .bin/.elf created unless `make distclean` is used.
  - Don't output the key grep test (only check result).
  - Adjust build order (first stage, wolfboot, test app, key, sign test app and factory).
  - Fix to make sure linker script is rebuilt before objects.

Sample NXP P1021 Output:

```
Relocating BOOT ROM to DDR
Loading wolfBoot to DDR
Jumping to full wolfBoot
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
QE: Length 63732, Count 1
QE: uploading 'Microcode for P1021 r1.0' version 0.0.1
QE: Traps 0
MP: Starting core 2 (spin table 0xFFFFF240)
Versions: Boot 1, Update 0
Trying Boot partition at 0x200000
Loading header 512 bytes to 0x1DFFFE00
Loading image 3170724 bytes to 0x1E000000
Image size 3170724
Firmware Valid
Loading elf at 0x1E000000
Found valid elf32 (big endian)
Booting at 0x6000
```
2023-07-05 17:03:57 +02:00
David Garske a56e2252c1 Revert the TPM based key store (root of trust). This feature is not ready for next release. 2023-07-04 08:36:41 +02:00
Dimitri Papadopoulos be037ca04d Fix typos found by codespell 2023-07-04 07:43:02 +02:00
Hideki Miyazaki 4e20d5a90d addressed review comments 2023-06-10 08:53:32 +02:00
Hideki Miyazaki d9ada916e9 addressed review comments 2023-06-10 08:53:32 +02:00
John Bland c6629ed86a add missing steps for policy pubkey sealing
update wolfTPM version to include new sealing functions, add preseal helper commands
2023-05-18 12:33:49 +02:00
billphipps 106b78086a
Merge pull request #302 from dgarske/nxp_tpm
Support for NXP P1021 eSPI and TPM (and fixes for eLBC NAND)
2023-05-10 20:17:27 -04:00
David Garske 6f24981f03 Improvements to the clock calculation code (dynamic based on ratio). Remove execute bits on files. Make stage1 PIC. Disable L1/L2 for first stage. Add PLT/GOT to .data region. 2023-05-10 15:11:09 -07:00
David Garske c2fbcecda1 Reduce first stage init code (don't relocate CCSRBAR or invalidate all TLB's). Improve udelay to use timebase. Fix L1 cache line sizes. Fix L2ADDR to enable all 256KB. Use `do_boot` not the jump to function pointer. Switch PPC test app linker script to use `WOLFBOOT_LOAD_ADDRESS`. 2023-05-08 17:42:14 -07:00
David Garske bd8d45e40f
Merge pull request #304 from jpbland1/preseal-compiled
add ability to compile preseal with no filesystem
2023-05-08 15:07:40 -07:00
John Bland f4cca4a367 add ability to compile preseal with no filesystem
fix a key not being unloaded, normaly doesn't crop up since in normal circumstances wolfBoot and the TPM both turn on fresh but on the simulator not freeing the key caseus a leak
2023-05-08 12:45:42 -04:00
David Garske 0b7603f7bf
Merge pull request #303 from jpbland1/preseal
add script for preseal a public key to tpm
2023-05-05 15:02:55 -07:00
John Bland bf3ebee8bb use correct digest when getting unsealing the pubkey
add deinit call when wolfboot exits so the TPM doesn't have a hanging session
2023-05-05 16:27:22 -04:00
John Bland a654eb057e fix hex formating and clarify where to run preseal command 2023-05-04 23:12:49 -04:00
John Bland cbf3cffa96 add script for preseal a public key to tpm
add more detailed instructions on how to prepare a TPM keystore build and how to use the preseal script
2023-05-04 20:49:02 -04:00
David Garske 0f110e4cd9 Progress on eSPI support for NXP P1021 TPM. 2023-05-04 15:23:45 -07:00
David Garske ef35f473c9
Merge pull request #296 from jpbland1/tpm-root-trust
wolfTPM pubkey storage with policy based access restriction
2023-05-04 15:09:06 -07:00
John Bland fe2b797b01 get wolfboot simulator working with the tpm simulator
move pcr reset and extend outside of session

the tpm uses policy checking for modifying PCR's so we need to reset and extend the PCR's with the image hash before the session begins, currently tested unseal, having trouble getting the simulator to run update in order to test reseal
2023-05-03 11:39:25 -04:00
David Garske 69ca95eb94 Adds `factory_wstage1.bin` option to include first stage loader. Fix test-app verbose issue. 2023-04-21 16:41:00 +02:00
David Garske 553ec760fd NXP QorIQ refactor for shared PPC (e500 / e6500) registers
* Fixes for e500 L1/L2 cache.
* Fixes for eLBC and DDR3 drivers on P1021.
* Fixes for LAW and TLB for P1021.
* Fix for the e500v2 core peripheral issues with data barrier / coherency safety.
* Support for SP math all (`SPMATHALL=1`).
* Support for stage 1 loader (`make stage1`).
2023-04-21 16:41:00 +02:00
John Bland 371ff3bb9e add documentation for using --policy-signed 2023-04-18 17:29:27 -04:00
John Bland 79e2f43b68 add TPM pubkey sealing doc and update code based on pr comments 2023-04-14 01:55:14 -04:00
Daniele Lacamera 43fa7b17f1 Added WOLFBOOT_HUGE_STACK option
The option can be enabled to use RSA4096 with fast math.
2023-03-21 17:06:22 +01:00
Daniele Lacamera 2f2a6d416d Support encrypted images in MMU targets 2023-03-09 16:31:29 +01:00
Brett Nicholas a943e9defc updated to include RT1064 2023-03-06 17:31:48 +01:00
John Bland 80dbfffb26 change to wolfBoot.bin 2023-01-31 09:26:20 -08:00
John Bland 92bd8b6757 update flashing documentation and update scripts for the stm32u5 2023-01-31 09:26:20 -08:00
David Garske 47e9d7a591
Merge pull request #261 from cmcquinn/cmake-fixes
Improvements and fixes for CMake
2023-01-13 15:28:55 -08:00
David Garske 63c35ac95a Fixes for NXP P1021 NAND flash mapping and boot page. 2022-12-29 18:27:40 +01:00
David Garske 022b8d3c13 Progress on adding NXP QorIQ P1021 support. 2022-12-29 18:27:40 +01:00
David Garske e88a7dcae3 Progress on DDR support for QorIQ. Refactor the platform to use "nxp_". 2022-12-29 18:27:40 +01:00
David Garske a9526bab8f STM32 QSPI Flash support. Refactor SPI to allow different GPIO base/AF for each pin. Adds `DEBUG_UART` support for H7. 2022-12-20 13:31:28 +01:00
David Garske ac6f5207c7 Update documentation. 2022-12-19 11:38:00 +01:00
David Garske f283929161 Improvements to gap fill. The default gap filling byte is `0xFF`. If using `FLAGS_INVERT=1` uses `0x00`. Can be overridden at build-time using `FILL_BYTE`. Fixes ZD 15356. 2022-12-19 11:38:00 +01:00
Cameron McQuinn 8ace007cd8 Improvements and fixes for CMake 2022-12-15 00:56:57 -07:00
David Garske 6d45564112 Test size increases. Improve user_settings.h ECC options. 2022-12-06 06:20:48 +01:00
David Garske 2fc899254f Cleanups for NXP T2080 DEOS support:
* Expanded the NXP QorIQ T2080 documentation in `docs/Targets.md`.
* T2080 fixes for boot code placement and generation of .bin.
* T2080 UART driver cleanup.
* Improve bin-assemble fill speed and report items added.
* Make portability fixes to enable building in `mingw32-make`.
* Cleanup the `docs/Targets.md` sections and links.
* Cleanup execute bits on code files.
2022-12-06 06:20:48 +01:00
David Garske c346fab41b Support for NAII 68PPC2 with NXP T2080 on DEOS 2022-09-23 15:44:49 +02:00
Daniele Lacamera a6fdec3901 self-encrypt prototype; tested on stm32l0 2022-09-21 18:49:52 +02:00
Daniele Lacamera 32c99d4687 Simplified qemu command line for raspi3b 2022-07-22 09:27:04 +02:00
Daniele Lacamera 8945c2a93e New qemu machine name for rpi is `raspi3b` 2022-07-22 09:23:49 +02:00
Daniele Lacamera 1f1b6200d5 Fixed RAM size for rpi example in docs 2022-07-21 21:13:28 +02:00
Daniele Lacamera 93dd53ac0f Fixed support for raspberry-pi 2022-07-21 20:18:34 +02:00
Daniele Lacamera c9a7c2bc8d Updated documentation with new keygen syntax 2022-07-20 20:17:22 +02:00
David Garske a86a54f3d4
Merge pull request #219 from danielinux/library-doc
Updated/extended documentation for library mode
2022-07-19 08:57:00 -07:00
Daniele Lacamera 9605dd283f Fixes for test cases using keystore 2022-07-19 15:33:29 +02:00
Daniele Lacamera 1542a15c90 Keystore: array of public keys generated by keygen 2022-07-19 15:32:28 +02:00
David Garske cb5b39c79e Updates to documentation for using wolfBoot on Raspberry Pi and QEMU. 2022-07-19 15:30:31 +02:00
Daniele Lacamera 365e82628b Updated/extended documentation for library mode 2022-07-19 15:23:46 +02:00
David Garske fd167e1afc For signing with HSM add step for putting the right public key into bootloader for root of trust. 2022-07-15 18:53:13 +02:00
Marco Oliverio c077207b01 feature: simulated target
This commit introduces a simulated target where the internal and optionally the
external flash can be simulated and backed by files. Using this target will
produce an executable wolfBoot ELF image.
2022-07-12 10:13:10 +02:00
Daniele Lacamera a9ffb3c98a Fixed typos. Removed verbose command line help. 2022-05-24 17:24:31 +02:00
Daniele Lacamera 063c21430c Added partition ID. Extended sign manual 2022-05-24 13:31:50 +02:00
Daniele Lacamera c6ea92e947 Added mention of the combination delta+enc in docs 2022-05-23 15:32:44 +02:00
David Garske 80caddb1be Documentation cleanups for building wolfBoot as library. 2022-05-20 08:06:07 +02:00
David Garske 6068a8047c wolfBoot improvements (from elms):
* Add `WOLFBOOT_DUALBOOT` for dynamic fallback
* Refactor header field parsing
* Cleanup compiler warnings and logic extra check
* Option to leave out partition based functions
* Add `WOLFBOOT_FIXED_PARTITIONS` enable using partition enum and related functions
* Wrap all delta update references
* Update raspberry documentation
* EFI refactoring
* Add `keytools_check` target
* Add "library" target
2022-05-20 08:06:07 +02:00
David Garske 1c9e3fd46d Updated Targets.md with RT1050 information. 2022-04-27 11:15:32 -07:00
Elms 048eaffbe6 EFI: fixes and expand documenation
* Add EFI x86_64 include
* fix keytools build with EFI config
* Enable debug by default
* Expand `Targets.md` EFI section
2022-02-25 01:16:59 -08:00
David Garske b46c5b222c Cleanup STM32H7 target documentation and code. 2022-02-14 10:51:53 -08:00
David Garske 262a5b0a78
Merge pull request #167 from danielinux/aes-encryption
Add AES encryption support
2022-02-09 10:55:51 -08:00
Daniele Lacamera 43a5a38629 Fixes to AES-CTR encryption after testing 2022-01-31 16:46:09 +01:00
David Garske 4b3eb8e6fe Improve G0 target documentation for using the official STM32 tools. 2022-01-28 16:10:29 -08:00
David Garske 5463105eab Adds STM32U5 support. Thank you ST. 2022-01-24 00:07:03 -08:00
David Garske 84be565596 Add Nordic nRF52 support to documentation. 2022-01-19 23:53:23 -08:00
Daniele Lacamera 2e7b63eae5 Adding support for ED448 verification 2021-12-13 12:05:37 +01:00
Daniele Lacamera 218ae0ed23 Expanded documentation for delta updates 2021-12-06 17:36:48 +01:00
Marco Oliverio a187442455 support booting EFI application on x86_64 architecture
Co-authored-by: Daniele Lacamera <daniele@wolfssl.com>
2021-11-30 18:43:50 +01:00
David Garske 905730d927 Fixes for secure user memory feature. 2021-11-29 23:17:43 -08:00
David Garske 2526dbb40a Fix to use flash base address on STM32G0. 2021-11-29 23:17:43 -08:00
David Garske c6edd2ad5e Fix comment on sizes for STM32G0. 2021-11-29 23:17:43 -08:00
Hajer KALLEL de330fbe4f Alligned addresses for STM32L4 2021-08-26 13:03:49 -07:00
Hajer KALLEL 3ee5f3942a Added link to STM32L4 2021-08-26 13:03:49 -07:00
Hajer KALLEL dc798f29e2 Added support for STM32L4 2021-08-26 13:03:49 -07:00
Daniele Lacamera 39ee01a948 Added roll-back feature via inverse patch 2021-08-17 15:44:34 +02:00
Daniele Lacamera c35c9bb34e Improved diff algorithm to match update.
- Added in-place image patching to ./bmpatch tool
- Temporarily added debug prints
2021-08-16 11:59:46 +02:00
David Garske 1509b233da STM32L5 Documentation improvements. 2021-08-02 01:33:11 -07:00
Daniele Lacamera 0453044875 Fixed API function name in docs 2021-07-29 15:22:13 +02:00
Daniele Lacamera f9b826b677 SMALL_STACK: Added description in documentation
+ enabled option in the imx-rt1060 build
2021-07-09 11:18:27 +02:00
Daniele Lacamera f2bab09777 Added support for SIGN=NONE 2021-06-28 13:52:00 +02:00
David Garske a7b61db9e1 Cleanup ARM boot code. TI R5 support. 2021-06-23 09:12:17 +02:00
Elms a63e1d9638 docs: Add NXP T2080 PPC to documentation 2021-06-08 18:14:41 +02:00
Elms 736103c561 docs: Add info on swap interruption and self-update
Swap interruption recovery and general description of self-update
include that it can not be interrupted.
2021-05-20 07:52:43 +02:00
David Garske 252b3bcab9 Added list of targets to top of docs/Targets.md. 2021-04-26 15:04:26 -07:00