WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
3,130 Commits
31 Branches
32 Tags
44 MiB
Commit Graph

224 Commits (740383a3f53b932dca2ed1ae3e97274805bd0573)

Author SHA1 Message Date
Mattia Moffa 88bb215736 Validate NS inputs to TrustZone flash veneers 
Fixes F#4333-4335
 2026-06-09 15:50:14 +02:00
Daniele Lacamera 3a8404b5e2 Fix test regression, addressed copilot comments 2026-06-05 20:55:52 +02:00
Daniele Lacamera 3bf9a76462 F-4337: validate NS pointer in wolfBoot_nsc_get_partition_state CMSE veneer 
wolfBoot_nsc_get_partition_state is a cmse_nonsecure_entry secure-gateway
veneer (compiled with CSME_NSE_API under __WOLFBOOT && TZEN). The output
pointer st arrives directly from the non-secure caller and was forwarded
unchecked to wolfBoot_get_partition_state, which performs *st = *state
unconditionally once the partition magic check passes (libwolfboot.c:735).
Because the veneer runs in Secure state with full write access to Secure
SRAM, a malicious NS caller could aim st at Secure memory and turn the
veneer into a confused-deputy 1-byte write primitive (the partition-state
byte, e.g. 0x00/0xFF) against Secure SRAM (magic fields, key-store flags,
version counters).

Validate the st range with cmse_check_address_range
(CMSE_NONSECURE | CMSE_MPU_READWRITE) before forwarding, returning -1 when
the range is not accessible from the non-secure world. The check is wrapped
in WOLFBOOT_NSC_NS_RW, guarded by __ARM_FEATURE_CMSE == 3U so non-CMSE
builds (no security boundary) collapse to a plain non-NULL pass-through.
Same fix pattern as F-4416/F-4417/F-4644 (wc_callable.c, fwtpm_callable.c,
tpm.c).

Verified by compiling the veneer with cortex-m33 -mcmse: the expected
bl cmse_check_address_range is emitted before the callee. The bug is a
TrustZone Secure/Non-secure partitioning issue that cannot be exercised on
the host unit-test build (the TZEN veneer block is not compiled there).
 2026-06-05 19:51:13 +02:00
Mattia Moffa e8212dd2ec Check TLV fields' size is correct in image headers 
F#3540
 2026-05-06 19:03:12 +02:00
Mattia Moffa 481ff1ffdb trailer_write: exit on error 
F#3535
 2026-05-06 19:03:12 +02:00
Brett Nicholas a2e9267529 Adds generic cryptocb support for PK, hash, and symmetric crypto 2026-05-05 16:37:54 +02:00
Daniele Lacamera 2a9aa60d40 Fixed test regressions 2026-04-29 13:12:45 +02:00
Daniele Lacamera 1e6dd16c6a Harden encrypted key comparisons 
F/3042
 2026-04-29 11:31:08 +02:00
Daniele Lacamera 776378ca78 Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
Daniele Lacamera 8d9e912fb8 Addressed another round of copilot comments 2026-04-15 20:37:07 +02:00
Daniele Lacamera 26552b5aed Addressed copilot's comments 2026-04-15 18:32:25 +02:00
Daniele Lacamera 1359aac80d Block rollback fallback in non-flash update paths 
F/2254
 2026-04-15 17:31:29 +02:00
Daniele Lacamera af241649df Fix update sector flag index truncation 
F/2586
 2026-04-14 14:26:42 +02:00
Daniele Lacamera 2bd6274022 Fix endian handling for delta TLV consumers 
F/2581
 2026-04-14 14:09:59 +02:00
Daniele Lacamera 47815c03b3 encrypt: check custom key fetch in aes_init 2026-04-10 05:29:37 +02:00
Daniele Lacamera cdf84024fa docs: fix encrypt key erase return contract 2026-04-09 15:00:09 +02:00
Daniele Lacamera 1c07a99c27 libwolfboot: fix encrypted test-app builds 2026-04-08 19:53:50 +02:00
Daniele Lacamera 2f75363a19 zero custom encrypt stack buffers 
F/1889
 2026-04-08 19:53:50 +02:00
Daniele Lacamera 8e2f8b34da Use fixed-length erased-key check 
F/2252
 2026-04-08 19:53:50 +02:00
Daniele Lacamera dfc73ca7e1 Use constant-time encryption key validation 
F/2249
 2026-04-08 19:53:50 +02:00
Daniele Lacamera de4c33ee44 Propagate erase encrypt key write failures 
F/1893
 2026-04-08 19:50:11 +02:00
Daniele Lacamera 1442e1c8d0 Propagate encrypt key flash errors 
F/1892
 2026-04-08 19:50:11 +02:00
Daniele Lacamera b28a97e784 Fix PKCS11 init state typo 
F/1474
 2026-03-30 16:23:16 +02:00
Hideki Miyazaki 285063dc2d Move functions to RAM for flash operation 
- Remove standard library as much as possible
 - Do not use memcpy before it is relocated to RAM.
 - Prefer library functions over RX intrinsics.( Compiler option change)
 2026-03-21 05:52:57 +09:00
Mattia Moffa b5fab30310 Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ 2026-03-18 22:26:32 +01:00
Mattia Moffa fcf72e008c Remove NO_DIRECT_READ_OF_ERASED_SECTOR option; write after erase instead 2026-03-18 11:53:26 +01:00
Thomas Cook 3ef8c60242 Fix XMEMSET's per correct erased byte polarity. 2026-03-18 11:53:26 +01:00
Thomas Cook 9078ede0fc Add an update test to the test-app. 
Fix bugs found from the update test.
 2026-03-18 11:53:26 +01:00
Thomas Cook dd4312679b Deploy NO_DIRECT_READ_OF_ERASED_SECTOR to protect against hardfault with AHB read of erased sector. 2026-03-18 11:53:26 +01:00
Daniele Lacamera 62dedfc446 Propagate hal_flash_write() error when writing partition magic 
F/437
 2026-03-12 09:28:51 +01:00
Daniele Lacamera 249e078ee5 Added missing parenthesis around macro 
F/436
 2026-03-10 16:55:20 +01:00
Daniele Lacamera e08ef84c34 Added parenthesis around macro 
F/436
 2026-03-09 11:34:50 +01:00
Paul Adelsbach 260a78e5e3 Fix string compare functions 2026-03-06 19:25:07 +01:00
Brett Nicholas 4d31ef5502 Add self-header feature with support for sim and AURIX TC3xx 2026-02-27 11:39:51 +01:00
Daniele Lacamera 43f2273a7f Added extra verify step in encrypted fallback 
Using the original IV
 2026-02-24 11:34:48 +01:00
David Garske ee3c313a66 Versal port cleanups 2026-01-26 13:08:50 +01:00
David Garske 7511e2e467 Fix some compiler warnings and CI build test failures 2026-01-26 11:27:39 +01:00
David Garske e1bef7ac70 PolarFire PQC (ML-DSA) testing 2026-01-26 11:27:39 +01:00
David Garske cf08819d8e Support for CUSTOM_ENCRYPT_KEY that allows customer to supply their own implementation 2026-01-01 12:52:09 +01:00
Mattia Moffa 0462e0a198 More consistent formatting 2025-12-30 11:15:41 +01:00
Mattia Moffa ce4ae39d65 Address copilot suggestions 2025-12-30 11:15:41 +01:00
Mattia Moffa 7800c364e9 Fix cppcheck complaint 2025-12-30 11:15:41 +01:00
Mattia Moffa f12d2f06b4 Add PKCS11 backend for encrypted partitions 2025-12-30 11:15:41 +01:00
David Garske afb9c84cdf Fix for uSD read to handle start that is not block aligned 2025-12-24 18:31:55 +01:00
David Garske 2546ebcaf9 Fixes for unused variables. Also repaired STM32WB55 build with PKA 2025-11-20 18:26:58 +01:00
David Garske 8cb3d33339 Added STM32H5 SPI Driver and support for TPM 
Cleanup STM32H5 HAL port.
Refactor `__ARM_FEATURE_CMSE` to `TZ_SECURE()`
Refactor attribute cmse_nonsecure_entry to use new macro `CSME_NSE_API`
Added TPM Non Secure Callable API's
Added TPM support to STM32H5 test application
 2025-11-19 16:29:28 +01:00
David Garske 3a85a27fb9 Unify the hdr_cpy (we don't need two) 2025-11-19 11:11:28 +01:00
David Garske c2ed553da1 Added Vorago VA416x0 wolfBoot support 
Added check on image header size and sector size.
Expanded the ML-DSA testing.
 2025-11-19 11:11:28 +01:00
Mattia Moffa 177358e88d Update H5 app to use new NSC API 
- Make the update and swap partitions secure and inaccessible from the
  app except via NSC API
- Add a couple of necessary new NSC functions
- Update the app to only use NSC API
- Fix hal_flash_erase to account for secure addresses
- Fix some bugs in xmodem implementation
 2025-10-29 00:13:01 +01:00
Daniele Lacamera 6fba3b4054 Fixed unit tests 2025-10-17 12:03:42 +02:00