Commit Graph

97 Commits (ed695bb0a2dc782069d22f2d0241222500bcaef8)

Author SHA1 Message Date
Daniele Lacamera ed695bb0a2 armored: reset integrity state and extend sanity check 2026-07-01 20:28:58 +02:00
Daniele Lacamera 93f068b930 armored: harden image integrity check against fault injections 2026-07-01 19:48:02 +02:00
David Garske 7cdfb4266a NXP T2080 / CW VPX3-152: VxWorks 7 64-bit boot support
Add wolfBoot support for booting VxWorks 7 SMP 64-bit (and signed ELF
images) on the NXP T2080 (e6500) / Curtiss-Wright VPX3-152.

Key fix: bring up the e6500 cluster L2 cache in the correct order -- set
L2PE (ECC) in its own polled write BEFORE enabling L2E, with L2FI|L2LFC --
matching CW U-Boot (SDK2.0). The previous bare-L2E init left the L2 ECC
array uninitialized for the kernel's 0x1E0000 set, machine-checking VxWorks
(MCSR[IF], L2ERRDET MBECC).

Also: ePAPR spin-table SMP bring-up of all four cores, ELF in-place loader
staging-overlap fix, DPAA/LIODN + QMan/BMan init, 64-bit OS handoff
(LAW/TLB/IVOR), and NAII 68PPC2 + CW VPX3-152 board configs.
2026-06-15 06:13:28 +02:00
Brett Nicholas 182844b7a1 unify rsa and rsa-pss into single verify method 2026-04-28 15:02:57 +02:00
Brett Nicholas 1f72804143 support rsa-pss in ARMORED mode 2026-04-28 15:02:57 +02:00
Brett Nicholas 65d84a29ec Add SW-only RSA PSS 2026-04-28 15:02:57 +02:00
Daniele Lacamera 776378ca78 Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
Daniele Lacamera 4c0f425a7a Fix WOLFBOOT_MAX_SPACE precedence and test
F/2587
2026-04-14 14:28:44 +02:00
Daniele Lacamera 3697f9e335 image: use portable noinline macro
F/2273
2026-04-10 21:39:19 +02:00
Daniele Lacamera c1b2c40a40 image: restore ct compare contract
Make image_CT_compare return 0 on match again and update RSA hash checks plus delta base-hash validation to use the original semantics.

F/CI
2026-04-10 21:22:26 +02:00
Daniele Lacamera 0d6ad205d7 tpm: localize constant compare again
Restore wolfBoot_constant_compare to TPM-local code and use file-local helpers in update_flash and AHCI instead of a shared cross-module symbol.

F/CI
2026-04-10 06:17:41 +02:00
Daniele Lacamera 087ff9016c image: fix hardened hash compare sense
Use image_CT_compare directly in the protected RSA_VERIFY_HASH macro so signature confirmation only follows a real digest match.

F/CI
2026-04-10 05:59:18 +02:00
Daniele Lacamera 8033366c3e core: make constant compare common
Move wolfBoot_constant_compare out of TPM-only code so AHCI and update paths can use it without TPM feature gating.

F/CI
2026-04-10 05:48:36 +02:00
Daniele Lacamera fc9e7a3e8a Use constant-time delta base hash compare
F/2253
2026-04-08 19:53:50 +02:00
Daniele Lacamera 9715b4df26 Use constant-time RSA hash comparison
F/2247
2026-04-08 19:53:50 +02:00
Brett Nicholas 4d31ef5502 Add self-header feature with support for sim and AURIX TC3xx 2026-02-27 11:39:51 +01:00
Daniele Lacamera 47ad6c21ef Updated benchmark to run on rpi + stm32h563 2026-02-09 18:48:47 +01:00
Daniele Lacamera da35fd5a04 Made all cmp/flag checks more redundant in ARMORED 2026-01-13 16:19:06 +01:00
Daniele Lacamera fdf241d21f Addressed reviewer's comments. 2026-01-13 14:15:10 +01:00
Daniele Lacamera 50d8aedf8c [ARMORED] Improved redundancy of verification 2026-01-12 09:44:44 +01:00
David Garske 8cb3d33339 Added STM32H5 SPI Driver and support for TPM
Cleanup STM32H5 HAL port.
Refactor `__ARM_FEATURE_CMSE` to `TZ_SECURE()`
Refactor attribute cmse_nonsecure_entry to use new macro `CSME_NSE_API`
Added TPM Non Secure Callable API's
Added TPM support to STM32H5 test application
2025-11-19 16:29:28 +01:00
David Garske c2ed553da1 Added Vorago VA416x0 wolfBoot support
Added check on image header size and sector size.
Expanded the ML-DSA testing.
2025-11-19 11:11:28 +01:00
gojimmypi fbd8dcf8a2
Update Copyright year to 2025 2025-10-15 11:33:53 -07:00
David Garske 79cef5f605 Peer review fixes (thank you Copilot). 2025-06-16 19:05:49 +02:00
David Garske 487efc606d Improvements for portability using older gcc 4.8.2. Make sure wolfboot.h includes the `wolfBoot_verify_*` API's. Fixed issue with parsing headers when `#include` is `# include`. 2025-06-16 19:05:49 +02:00
Brett Nicholas d49e507926 - Support external flash for elf scatter-loading
- Support ELF scatter-loading on TC3xx
- Modify TC3xx HAL flash erase to support arbitrary offsets and sizes
- Realign partition size and addresses to support more efficient sector mass erase on update
2025-05-08 08:50:26 -06:00
David Garske b17ea82232 Fix to not include the fdt.h header unless MMU is defined. The fdt.h has a few structs with [0] size arrays that don't work with older GCC. 2025-04-29 11:50:29 +02:00
Daniele Lacamera 076cd1d6c4 Fix for unit test failing 2025-03-04 18:20:46 +01:00
Daniele Lacamera a195efe608 Avoid enforcing alignment on stack for IAR 2025-02-27 16:46:26 +01:00
David Garske 4c2d2b7e6e Add support for Armored mode with IAR. Currently only supports ECDSA and Cortex-M. ZD19190 2025-02-05 16:06:18 +01:00
jordan e2db8d58c4 Remove external ext_lms, ext_xmss pq integrations. 2025-01-20 16:38:24 +01:00
David Garske 7205820afa Added QSPI DMA support. 2024-12-30 15:36:43 +01:00
David Garske aec2809212 Cleanups after hybrid signing PR. 2024-10-31 11:23:52 +01:00
Daniele Lacamera cc447ea879 Support for hybrid authentication (2 ciphers) 2024-10-30 13:17:06 +01:00
David Garske 8a9fbe5674 Improve network core firmware update. 2024-10-11 10:29:59 +02:00
David Garske 6db7de6a75 Support for the Nordic nRF5340 (application and network cores):
* Added nRF5340 driver support for Clock, Internal Flash (NVMC), GPIO, SPU, OTP, UART, SPI, QSPI and IPC.
* Added support for updating the network core (Sign using "--id 2")
* Cleanup the nRF52 port
* Improved external QSPI and internal Flash tests and logging.
* Improved internal printf support for formatter length.
2024-10-11 10:29:59 +02:00
Marco Oliverio 0f8f30d6b8
Merge pull request #457 from danielinux/otp-regressions
Fix build OTP options
2024-06-26 12:07:02 +02:00
David Garske a92c1b9ad9 STM32U5 cache support. Including cache invalidate on `nvm_select_fresh_sector`. ZD 18210 2024-06-25 18:12:47 +02:00
Daniele Lacamera 391e8d05d8 Fix build OTP options
- ARMORED option is not needed in otp_primer
- do not attempt to compile otp_primer if the option is not declared
2024-06-18 15:00:54 +02:00
Daniele Lacamera fce6149cf8 Update license GPL2 -> GPL3 2024-04-16 16:46:15 +02:00
Daniele Lacamera 92f630ad3c Added "cc" clobbers 2024-04-11 12:39:12 +02:00
Daniele Lacamera d73341112d Anti-glitch armor: Added clobbers to assembly 2024-04-10 09:59:14 +02:00
David Garske 5ecd2f749d Cleaned up TLV example and simulator output. Moved `wolfBoot_find_header` to the public header. 2024-03-08 12:15:23 -08:00
David Garske 83283c6cf7 Fixes for NXP T1024 and booting Integrity OS:
* Fixed PPC spin table based on ePAPR 1.1.
* Added flattened device tree (FDT) support. Setting required FDT fields per ePAPR 1.1.
* Added Frame Manager microcode upload.
* Fixed CPLD and setting QE clock.
* Added support for setting logical device numbers and updated device tree.
* Fixed QUICC Engine base address (was incorrect, should be 0x140000).
* Fixed "cpu-release-addr" to use 64-bit value.
* Added secondary cached boot page.
* Added L2 cache support to multi-core.
* Added flattened device tree parser tool for testing (`make fdt-parser` and `tools/fdt-parser/fdt-parser`).
* Added checks for FDT header.
* Added automated test case for NXP T1024 FDT.
2024-01-17 14:16:15 +01:00
John Bland 6c2a37bdea remove complicated key saving process and instead
leave the encryption key for wolfBoot_success to erase.
FINAL_SWAP was also stopping the case where the partition was put into testing before the update sector status flags could be erased. now, don't erase the update sector flags. instead put the update partition in IMG_STATE_FINAL_FLAGS state before putting the boot partition in IMG_STATE_TESTING. Then only erase the update sector flags on wolfBoot_update_trigger. under this scheme, the sector flags are intact if the power failed before we could set IMG_STATE_TESTING but are wiped if we do need to swap over after after wolfBoot_success fails to be called
2023-10-13 14:30:04 +02:00
John Bland 00a9572b94 change the final steps of wolfBoot_update into
repeatable steps so that power failure wont erase the encryption key and wont cause skipping the testing phase of boot. this is done by marking the update partition as final swap when erasing the final sector and backing up the key in boot sector 0 after swaping the real boot sector 0 to swap. then when a power failure occurs the encryption key will be available in either boot sector 0 or the normal location. the intermediate phase also prevents skipping the testing phase since the last sector, which holds the boot state, is erased and then set repeatably, since the final swap state is set on the update partition
2023-10-13 14:30:04 +02:00
David Garske b3e2fb9ddd NXP T1024 wolfBoot support:
* Added DDR4 w/ECC.
* Added L2 and L2 CPC SRAM support
* Added platform SRAM 160KB support
* Added support for core timers (timebase) and platform clock.
* Added IFC driver with erase/write
* Added stage 1 loader to relocate wolfBoot to DDR
* Added CPLD, QUICC, FMAN and MP drivers
* Added eSPI driver for TPM.
* Added hal_early_init instead of calling ddr_init directly.
* Fixes for device tree (DTB) loading with update_ram and PPC boot.
* Fixes for relocating CCSRBAR to upper.
* Fixes for interrupt offsets.
2023-10-06 15:28:16 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy.
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
2023-09-12 12:26:48 +02:00
David Garske db15f9b0f1 Further NXP P1021 fixes and improvements:
* Added ELF32 and ELF64 loader support (config `ELF=1` or build option `WOLFBOOT_ELF`).
* Add ELF support to `update_ram.c` loader.
* Add support for loading entire flash image to RAM when `EXT_FLASH=1` and `NO_XIP=1` (or `WOLFBOOT_USE_RAMBOOT`).
* Added QUICC Engine support to load microcode and enable.
* Add multiple core support for NXP P1021.
* Fixes to resolve first stage boot ROM relocation.
  - Implemented temporary workaround to resolve stack traps.
* Added PPC GOT relocation support.
* Fix for the PPC `isr_empty` handler address.
* Fix to allow stack to use DDR by having assembly setup DDR TLB. After relocating wolfBoot use stack on DDR.
* Cleanup wolfBoot output.
  - Only remove extra .bin/.elf created unless `make distclean` is used.
  - Don't output the key grep test (only check result).
  - Adjust build order (first stage, wolfboot, test app, key, sign test app and factory).
  - Fix to make sure linker script is rebuilt before objects.

Sample NXP P1021 Output:

```
Relocating BOOT ROM to DDR
Loading wolfBoot to DDR
Jumping to full wolfBoot
wolfBoot HAL Init
Flash Init: Ret 0, ID 0x76207620
QE: Length 63732, Count 1
QE: uploading 'Microcode for P1021 r1.0' version 0.0.1
QE: Traps 0
MP: Starting core 2 (spin table 0xFFFFF240)
Versions: Boot 1, Update 0
Trying Boot partition at 0x200000
Loading header 512 bytes to 0x1DFFFE00
Loading image 3170724 bytes to 0x1E000000
Image size 3170724
Firmware Valid
Loading elf at 0x1E000000
Found valid elf32 (big endian)
Booting at 0x6000
```
2023-07-05 17:03:57 +02:00
David Garske a56e2252c1 Revert the TPM based key store (root of trust). This feature is not ready for next release. 2023-07-04 08:36:41 +02:00