Commit Graph

171 Commits (e4abcbd78b73e29b5b47defd06cf18cc3c15c5ad)

Author SHA1 Message Date
Daniele Lacamera 6ce0bbf013 Stm32l5 configuration: increase wolfboot partition
Bootloader partition expanded to 48KB to accommodate assembly
optimizations in wolfBoot.
2023-09-20 13:49:57 +02:00
David Garske 6dbe4a0129 Refactor to allow using seal/unseal without image header. Just pass the public key hint and policy directly. 2023-09-12 12:26:48 +02:00
David Garske 05b83544fb Fixes based on peer review. Add output of signed policy to file (append .sig). Tested successfully with multiple PCRs. In example unlock_disk extend PCR with random value after unseal to prevent unsealing after boot. 2023-09-12 12:26:48 +02:00
David Garske 2349a68e76 Added support for storing sealed blobs into NV. Refactor the TPM signature verify to use existing load public key function and generic verify hash TPM function. Added support for RSA sign with ASN.1 encoding (Example: `SIGN=RSA2048ENC`). 2023-09-12 12:26:48 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy.
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
2023-09-12 12:26:48 +02:00
jordan e23d450e45 LMS wolfBoot support. 2023-09-06 07:57:10 +02:00
John Bland 92b5c1d33a update docs for the imx-rt1060 config 2023-08-22 23:52:14 -04:00
David Garske 6ea1a1e4a5 Added GitHub action build tests for NXP parts (iMX RT, Kinetis and LPC). 2023-08-21 11:08:48 +02:00
David Garske d223b34319 Add support for the RT1050 HyperFlash configuration (default on EVKB). 2023-08-21 11:08:48 +02:00
David Garske 7073bf33b4 Fix RT1050 example app LED. Fix documentation for test-app location. Peer review feedback to clarify RT1050 flash chip configuration. 2023-08-21 11:08:48 +02:00
David Garske 712a543c9d Fixes and improvements for iMXRT1050 QSPI. 2023-08-21 11:08:48 +02:00
David Garske 2f0e699f82 Fix for keytools with path having spaces. Added note about sign.c use of `WOLFBOOT_SECTOR_SIZE` for delta support. 2023-08-18 10:39:42 -07:00
David Garske b05c7ab980 Measure wolfBoot, not application. Added TPM docs. 2023-08-17 13:43:58 +02:00
David Garske 7190392245 Simulator fixes and support for using MacOS:
* Added simulator support for Mac.
* Fix for simulator to properly assemble wolfboot.bin + signedtestapp + update + swap.
* Fixes for handling 64-bit assigned mmap virtual addresses. Added hal_flash_write and hal_flash_erase support for 64-bit address using uintptr_t. Enabled if platform is 64-bit and `FORCE_32BIT` is not defined
* Fix simulator conflict with src/libwolfboot.o object in test-app.
* Cleanup test-app linker flags.
2023-08-07 20:54:18 +02:00
David Garske 3797238546 Documentation and code comment cleanups:
* Update documentation for signing with `--no-sign`, as the key argument should not be supplied.
* Recommend `make keysclean` instead of distclean on keys mismatch.
* Renesas headings/readme link and white-space.
2023-08-04 10:13:56 +02:00
Daniele Lacamera 21493fcd8d Deprecate python keytools. 2023-08-03 08:05:18 +02:00
Daniele Lacamera 693c4c0406 docs: update documentation with Intel FSP targets 2023-07-24 18:12:32 +00:00
David Garske db15f9b0f1 Further NXP P1021 fixes and improvements:
* Added ELF32 and ELF64 loader support (config `ELF=1` or build option `WOLFBOOT_ELF`).
* Add ELF support to `update_ram.c` loader.
* Add support for loading entire flash image to RAM when `EXT_FLASH=1` and `NO_XIP=1` (or `WOLFBOOT_USE_RAMBOOT`).
* Added QUICC Engine support to load microcode and enable.
* Add multiple core support for NXP P1021.
* Fixes to resolve first stage boot ROM relocation.
  - Implemented temporary workaround to resolve stack traps.
* Added PPC GOT relocation support.
* Fix for the PPC `isr_empty` handler address.
* Fix to allow stack to use DDR by having assembly setup DDR TLB. After relocating wolfBoot use stack on DDR.
* Cleanup wolfBoot output.
  - Only remove extra .bin/.elf created unless `make distclean` is used.
  - Don't output the key grep test (only check result).
  - Adjust build order (first stage, wolfboot, test app, key, sign test app and factory).
  - Fix to make sure linker script is rebuilt before objects.

Sample NXP P1021 Output:

```
Relocating BOOT ROM to DDR
Loading wolfBoot to DDR
Jumping to full wolfBoot
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
QE: Length 63732, Count 1
QE: uploading 'Microcode for P1021 r1.0' version 0.0.1
QE: Traps 0
MP: Starting core 2 (spin table 0xFFFFF240)
Versions: Boot 1, Update 0
Trying Boot partition at 0x200000
Loading header 512 bytes to 0x1DFFFE00
Loading image 3170724 bytes to 0x1E000000
Image size 3170724
Firmware Valid
Loading elf at 0x1E000000
Found valid elf32 (big endian)
Booting at 0x6000
```
2023-07-05 17:03:57 +02:00
David Garske a56e2252c1 Revert the TPM based key store (root of trust). This feature is not ready for next release. 2023-07-04 08:36:41 +02:00
Dimitri Papadopoulos be037ca04d Fix typos found by codespell 2023-07-04 07:43:02 +02:00
Hideki Miyazaki 4e20d5a90d addressed review comments 2023-06-10 08:53:32 +02:00
Hideki Miyazaki d9ada916e9 addressed review comments 2023-06-10 08:53:32 +02:00
John Bland c6629ed86a add missing steps for policy pubkey sealing
update wolfTPM version to include new sealing functions, add preseal helper commands
2023-05-18 12:33:49 +02:00
billphipps 106b78086a
Merge pull request #302 from dgarske/nxp_tpm
Support for NXP P1021 eSPI and TPM (and fixes for eLBC NAND)
2023-05-10 20:17:27 -04:00
David Garske 6f24981f03 Improvements to the clock calculation code (dynamic based on ratio). Remove execute bits on files. Make stage1 PIC. Disable L1/L2 for first stage. Add PLT/GOT to .data region. 2023-05-10 15:11:09 -07:00
David Garske c2fbcecda1 Reduce first stage init code (don't relocate CCSRBAR or invalidate all TLB's). Improve udelay to use timebase. Fix L1 cache line sizes. Fix L2ADDR to enable all 256KB. Use `do_boot` not the jump to function pointer. Switch PPC test app linker script to use `WOLFBOOT_LOAD_ADDRESS`. 2023-05-08 17:42:14 -07:00
David Garske bd8d45e40f
Merge pull request #304 from jpbland1/preseal-compiled
add ability to compile preseal with no filesystem
2023-05-08 15:07:40 -07:00
John Bland f4cca4a367 add ability to compile preseal with no filesystem
fix a key not being unloaded, normaly doesn't crop up since in normal circumstances wolfBoot and the TPM both turn on fresh but on the simulator not freeing the key caseus a leak
2023-05-08 12:45:42 -04:00
David Garske 0b7603f7bf
Merge pull request #303 from jpbland1/preseal
add script for preseal a public key to tpm
2023-05-05 15:02:55 -07:00
John Bland bf3ebee8bb use correct digest when getting unsealing the pubkey
add deinit call when wolfboot exits so the TPM doesn't have a hanging session
2023-05-05 16:27:22 -04:00
John Bland a654eb057e fix hex formating and clarify where to run preseal command 2023-05-04 23:12:49 -04:00
John Bland cbf3cffa96 add script for preseal a public key to tpm
add more detailed instructions on how to prepare a TPM keystore build and how to use the preseal script
2023-05-04 20:49:02 -04:00
David Garske 0f110e4cd9 Progress on eSPI support for NXP P1021 TPM. 2023-05-04 15:23:45 -07:00
David Garske ef35f473c9
Merge pull request #296 from jpbland1/tpm-root-trust
wolfTPM pubkey storage with policy based access restriction
2023-05-04 15:09:06 -07:00
John Bland fe2b797b01 get wolfboot simulator working with the tpm simulator
move pcr reset and extend outside of session

the tpm uses policy checking for modifying PCR's so we need to reset and extend the PCR's with the image hash before the session begins, currently tested unseal, having trouble getting the simulator to run update in order to test reseal
2023-05-03 11:39:25 -04:00
David Garske 69ca95eb94 Adds `factory_wstage1.bin` option to include first stage loader. Fix test-app verbose issue. 2023-04-21 16:41:00 +02:00
David Garske 553ec760fd NXP QorIQ refactor for shared PPC (e500 / e6500) registers
* Fixes for e500 L1/L2 cache.
* Fixes for eLBC and DDR3 drivers on P1021.
* Fixes for LAW and TLB for P1021.
* Fix for the e500v2 core peripheral issues with data barrier / coherency safety.
* Support for SP math all (`SPMATHALL=1`).
* Support for stage 1 loader (`make stage1`).
2023-04-21 16:41:00 +02:00
John Bland 371ff3bb9e add documentation for using --policy-signed 2023-04-18 17:29:27 -04:00
John Bland 79e2f43b68 add TPM pubkey sealing doc and update code based on pr comments 2023-04-14 01:55:14 -04:00
Daniele Lacamera 43fa7b17f1 Added WOLFBOOT_HUGE_STACK option
The option can be enabled to use RSA4096 with fast math.
2023-03-21 17:06:22 +01:00
Daniele Lacamera 2f2a6d416d Support encrypted images in MMU targets 2023-03-09 16:31:29 +01:00
Brett Nicholas a943e9defc updated to include RT1064 2023-03-06 17:31:48 +01:00
John Bland 80dbfffb26 change to wolfBoot.bin 2023-01-31 09:26:20 -08:00
John Bland 92bd8b6757 update flashing documentation and update scripts for the stm32u5 2023-01-31 09:26:20 -08:00
David Garske 47e9d7a591
Merge pull request #261 from cmcquinn/cmake-fixes
Improvements and fixes for CMake
2023-01-13 15:28:55 -08:00
David Garske 63c35ac95a Fixes for NXP P1021 NAND flash mapping and boot page. 2022-12-29 18:27:40 +01:00
David Garske 022b8d3c13 Progress on adding NXP QorIQ P1021 support. 2022-12-29 18:27:40 +01:00
David Garske e88a7dcae3 Progress on DDR support for QorIQ. Refactor the platform to use "nxp_". 2022-12-29 18:27:40 +01:00
David Garske a9526bab8f STM32 QSPI Flash support. Refactor SPI to allow different GPIO base/AF for each pin. Adds `DEBUG_UART` support for H7. 2022-12-20 13:31:28 +01:00
David Garske ac6f5207c7 Update documentation. 2022-12-19 11:38:00 +01:00