When using swap using scratch, the decryption now happens when copying
from the scratch area to the primary slot, which means the image is
stored encrypted in the scratch area. This commit updates the
documentation accordingly.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
Currently, when swap using scratch is used with encrypted images,
MCUboot is decrypting the images during the copy from the secondary slot
to the scratch area. This means the scratch area contains plaintext
image data and therefore that the scratch area must be placed in the
MCU's internal flash memory. This commit makes the necessary changes to
perform the decryption when copying from the scratch area to the primary
slot instead, making possible to place the scratch area in an external
flash memory since the scratch area is now encrypted.
Note that BOOT_SWAP_SAVE_ENCTLV must be enabled if the scratch area is
placed in external flash memory.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
For swap using scratch, the boot_read_image_header routine, responsible
for reading the image headers, was always looking for the primary and
secondary image's headers at the beginning of respectively the primary
and secondary slots, regardless of the current boot status.
This means if during a swap-scratch upgrade a reset happens after the
sector containing the image header in the primary or secondary slot has
been erased, invalid image headers were read since at that time the
location of the headers has changed.
Currently, this doesn't seem to cause any issue because the swap-scratch
algorithm is implemented in such a way the content of the headers is no
more necessary when the headers are erased. However, to be able to
decrypt the secondary image when copied to the primary slot instead of
when copied to the scratch area, properly reading the secondary image's
header is required even after it has been erased from the secondary
slot.
To that end, the boot_read_image_header is modified to determine from
the boot status the current location of the image headers and to always
read the actual header, no matter the current state of the upgrade
process.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
This reverts commit 0fa46270c0.
This breaks:
samples/synchronization/sample.kernel.synchronization on
b_u585i_iot02a/stm32u585xx/ns error
as this TF-M configuration uses its own keys. This change is an API
change that needs to be coordinated with TF-M changes.
Before this revert, compiling this test results in:
.../encrypted.c:447: undefined reference to
`boot_enc_retrieve_private_key`
Signed-off-by: David Brown <david.brown@linaro.org>
In Mbed TLS 3.1, the private fields in the ASN.1 structure were made private.
This breaks code that accesses these private macros.
Fix this by changing the ASN.1 specific code to use a new field accessor
`ASN1_CONTEXT_MEMBER` that will be conditionally defined based on the version of
Mbed TLS that is present.
Signed-off-by: David Brown <david.brown@linaro.org>
The libc assert macro was used in curve25519.c even if the user provided
its own definition of the assert macro for MCUboot through
mcuboot_assert.h. This commit fixes this issue.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
Increase the size of the jmpbuf to accomodate other architectures.
Unfortunately, the size of this is not available in the libc crate.
Increase this so encompass any platforms we wish to support, including
aarch64 on both Linux and MacOS.
Increasing an array beyond 32 means there is no default offered, so
implement this manually.
Signed-off-by: David Brown <david.brown@linaro.org>
Cargo prints a warning about conflicting resolvers being used. Fix this
by explicitly setting the resolver in the project file.
Signed-off-by: David Brown <david.brown@linaro.org>
Many of these extern functions are missing the "C". It doesn't seem to matter on
any of our targets, but this does make the code more correct, and might be a
problem in the future.
Signed-off-by: David Brown <david.brown@linaro.org>
The symbols injected here cause some kind of poor interaction with the linker on
MacOS, which results in most of the code becoming hopelessly corrupt. For now,
just disable these symbols on this target.
Signed-off-by: David Brown <david.brown@linaro.org>
Since there are references to this struct passed to C code, put it into an Rc so
that it won't move around when the data is moved.
Signed-off-by: David Brown <david.brown@linaro.org>
This struct was having addresses taken of fields within it, and then being
returned. It is platform-specific whether this causes a move. It seems to be
working on x86_64, but causes a segfault on aarch64. Box the struct so that it
isn't moved after being initialized.
Signed-off-by: David Brown <david.brown@linaro.org>
When MCUBOOT_SWAP_SAVE_ENCTLV is enabled, a comparison between a signed
and an unsigned integer is made in boot_read_enc_key. This might cause a
warning to be emitted at compile-time.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
Replace Slack channel links with MCUboot Discord channel
as the discussions have moved there.
Signed-off-by: David Vincze <david.vincze@arm.com>
Change-Id: I132279574e674408dffc9ed377d216775a54fd56
Main method printed hardcoded versions, update to take argument
to enable the possibility of testing version strings by invoking
the command through command line.
Signed-off-by: Rustam Ismayilov <rustam.ismayilov@arm.com>
Change-Id: If75769ef223944865313ed95336e859ebef85fd6
Fix trailer info dumping reads pad characters as values for status
Refactor printing styled texts and frames
Use isinstance() for type checking
Fold notice text depending on line length
Refactoring some parts for readability
Fix additional linting issues
Signed-off-by: Rustam Ismayilov <rustam.ismayilov@arm.com>
Change-Id: I741562bb70b18407bdd32e9c7391048faf6394c6
'Measurement Value' added the 'properties' list initially,
rather than adding it separately later.
Added an assertion to ensure 'Measurement Value' remains as
the last item in the 'properties' list
Signed-off-by: Rustam Ismayilov <rustam.ismayilov@arm.com>
Change-Id: I106059c6c903c3d560477d5114d866f48590ad7e
Fixed hash algorithm defaults to SHA256 in case no key provided.
Verification improved by adding check for key - tlv mismatch,
VerifyResult.KEY_MISMATCH added to indicate this case.
Multiple styling fixes and import optimisation, exception handling.
Signed-off-by: Rustam Ismayilov <rustam.ismayilov@arm.com>
Change-Id: I61a588de5b39678707c0179f4edaa411ceb67c8e
Currently encryption supports only private key embed
in mcuboot itself. To support MCUBOOT_HW_KEY for image
encryption boot_retrieve_private_key() hook is added.
This hook helps retrieving private key from trusted
sources like OTP, TPM.
Signed-off-by: Dinesh Kumar K <dinesh@linumiz.com>
1. set BOOT_MAX_IMG_SECTORS value for frmd_mcxn947_qspi. W25Q64 flash on the board
is very large (8MB), so we must increase the number of max sectors when
targeting this board with MCUboot.
2. Set the zephyr,flash chosen node to point to internal flash as this board
supports booting from internal flash only.
Signed-off-by: Mahesh Mahadevan <mahesh.mahadevan@nxp.com>
swap_scratch.c requires definition of SLOT1, in single application
slot build it's not needed and file would not be used anyway so
now it is removed from mynewt build
Signed-off-by: Jerzy Kasenberg <jerzy.kasenberg@codecoup.pl>
An initial sanity test for imgtool is added, checks
different commands for key operations (keygen, getpriv,
getpub and getpubhash).
Also very basic test for sign / verify is added.
Some tests are disabled (marked as 'xfail') due to
the missing implementation.
Signed-off-by: Denis Mingulov <denis@mingulov.com>
keys.KeyClass._emit is able to use 'file' parameter not as a file
but some object (not only sys.stdout but io.StringIO, like by
tests).
Fixed all explicit checks for sys.stdio usage in favor of
io.TextIOBase, also improve a single unit test to cover
also all the changed methods.
Signed-off-by: Denis Mingulov <denis@mingulov.com>
Add imgtool test call to workflows, use pytest and
publish artifacts with test results.
Also enable test run on 'pull_request', but limit
the previous default imgtool_run.sh run ('environment' job)
to run on 'push' event only (the same behaviour as before).
Signed-off-by: Denis Mingulov <denis@mingulov.com>
Use socs folder to configure Espressif targets.
Remove all boards confs which was created by copying other boards.
Signed-off-by: Marek Matej <marek.matej@espressif.com>
check_config.h was included manually by custom configuration files.
This caused compilation errors when updating MbedTLS to 3.6.0
because check_config.h was processed too early, before the whole
configuration is defined, effectively causing configuration check errors.
MbedTLS already takes care of including check_config.h at the right time.
Remove those erroneous manual check_config.h includes.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
The bootutil_hmac_sha256_set_key routine performs some dynamic memory
allocations when mbedTLS is used. To properly free the allocated memory,
bootutil_hmac_sha256_drop must be called before reinitializing the HMAC
context using bootutil_hmac_sha256_init. However, in the hkdf routine,
the HMAC context was freed only once even though it was initialized
multiple times.
Signed-off-by: Thomas Altenbach <thomas.altenbach@legrand.com>
This change uses the flash functions to read the applications
reset vector. This allow flexibility on which flash device the
application is programmed.
For e.g: MCUBoot can be programmed and running from Internal
Flash while Zephyr can be loaded from a different Flash device.
This change is made for ARM platform, it can be extended to
non-ARM platforms as well.
Signed-off-by: Mahesh Mahadevan <mahesh.mahadevan@nxp.com>
The normal simulation test takes several hours to run on most machines. Allow a
few very slow tests to be skipped by setting the environment variable
`MCUBOOT_SKIP_SLOW_TESTS` to some value. For obvious reasons, this shouldn't be
done if these power failure simulation tests are needed.
With this change, on my desktop Linux machine, the test time with the skipping
goes from about 2 hours, to around 5 minutes.
Signed-off-by: David Brown <david.brown@linaro.org>
Thomas Altenbach