Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Initial support for LS1028A. Booting into OCRAM app. #306

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Initial support for LS1028A. Booting into OCRAM app. #306

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
71b782b
Initial support for LS1028A. Booting into OCRAM app.
billphipps May 11, 2023
6f613df
Update to add verbose unsealing during wolfboot
billphipps May 17, 2023
fc41632
Initial support for LS1028A. Booting into OCRAM app.
billphipps May 11, 2023
b64ee37
Update to add verbose unsealing during wolfboot
billphipps May 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update to add verbose unsealing during wolfboot
  • Loading branch information
@billphipps
billphipps committed May 18, 2023
commit 6f613df0a92e1fac1c75e249623ae1389ee39d00
5 changes: 2 additions & 3 deletions config/examples/nxp-ls1028a.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,12 @@ RAM_CODE?=0
DUALBANK_SWAP?=0
PKA?=0

WOLFTPM?=0
WOLFTPM?=1

MEASURED_BOOT?=0
MEASURED_PCR_A?=3

WOLFBOOT_TPM_KEYSTORE?=0
WOLFBOOT_TPM_KEYSTORE?=1
WOLFBOOT_TPM_KEYSTORE_NV_INDEX?=25166336
WOLFBOOT_TPM_POLICY_NV_INDEX?=25166337
WOLFBOOT_TPM_PCR_INDEX?=16
Expand All @@ -49,7 +49,6 @@ WOLFBOOT_PARTITION_SIZE?=0x20000

# Location in Flash for Application Partition
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x20040000
#WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x21000000

# Load Partition to RAM Address
WOLFBOOT_LOAD_ADDRESS?=0x18020100
Expand Down
10 changes: 8 additions & 2 deletions hal/nxp_ls1028a.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -722,8 +722,8 @@ static void spi_transaction(unsigned int sel, unsigned int pcs,
}
}


#if 0
/*#define TPM_TEST*/
#ifdef TPM_TEST
void read_tpm_id()
{
/*Read 4 bytes from offset D40F00. Assumes 0 wait state on TPM*/
Expand Down Expand Up @@ -1355,6 +1355,12 @@ void hal_init(void) {
wolfBoot_printf("Flash init done\n");
//test_flash();

#ifdef TPM_TEST
read_tpm_id();
wolfBoot_printf("TPM test done\n");

#endif

hal_ddr_init();
wolfBoot_printf("DDR init done\n");
test_hw_ddr();
Expand Down
27 changes: 24 additions & 3 deletions src/image.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,10 +138,12 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
ret = wolfTPM2_LoadEccPublicKey(&wolftpm_dev, &tpmKey, TPM_ECC_NIST_P256,
pubkey, KEYSTORE_ECC_POINT_SIZE, pubkey + KEYSTORE_ECC_POINT_SIZE,
KEYSTORE_ECC_POINT_SIZE);
if (ret < 0)
wolfBoot_printf("LoadEccPublicKey ret: %d\n", ret);
if (ret < 0)
return;
#ifdef WOLFTPM_KEYSTORE
ret = wolfBoot_unseal_pubkey(pubkey, &tpmKey);
wolfBoot_printf("Unseal PubKey ret: %d\n", ret);
if (ret < 0) {
wolfTPM2_UnloadHandle(&wolftpm_dev, &tpmKey.handle);

Expand All @@ -151,7 +153,7 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
ret = wolfTPM2_VerifyHashScheme(&wolftpm_dev, &tpmKey, sig,
IMAGE_SIGNATURE_SIZE, img->sha_hash, WOLFBOOT_SHA_DIGEST_SIZE,
TPM_ALG_ECDSA, TPM_ALG_SHA256);

wolfBoot_printf("Verify Hash Scheme ret: %d\n", ret);
/* unload handlre regardless of result */
wolfTPM2_UnloadHandle(&wolftpm_dev, &tpmKey.handle);

Expand Down Expand Up @@ -855,8 +857,10 @@ int wolfBoot_unseal_encryptkey(uint8_t* key, uint32_t* keySz)
return ret;

/* get the boot digest */
wolfBoot_printf("Unseal Enc- hash start\n");
if (image_hash(&boot, bootDigest) != 0)
return -1;
wolfBoot_printf("Unseal Enc- hash completed\n");

/* find the keyslot of the public key */
pubkeyHintSize = get_header(&boot, HDR_PUBKEY, &pubkeyHint);
Expand Down Expand Up @@ -972,8 +976,10 @@ int wolfBoot_reseal_keys(struct wolfBoot_image* newImg,
return -1;

/* get the backupImg hash */
wolfBoot_printf("Reseal keys- hash start\n");
if (image_hash(backupImg, workingDigest) != 0)
return -1;
wolfBoot_printf("Reseal keys- hash completed\n");

/* clear out the PCR digest */
pcrReset.pcrHandle = wolftpmPcrArray[0];
Expand Down Expand Up @@ -1053,8 +1059,10 @@ int wolfBoot_reseal_keys(struct wolfBoot_image* newImg,
XMEMSET(&pcrReset, 0, sizeof(PCR_Reset_In));

/* get the newImg hash */
wolfBoot_printf("Reseal keys- new hash start\n");
if (image_hash(newImg, workingDigest) != 0)
return -1;
wolfBoot_printf("Reseal keys- new hash completed\n");

/* clear out the PCR digest */
pcrReset.pcrHandle = wolftpmPcrArray[0];
Expand Down Expand Up @@ -1153,36 +1161,43 @@ static int wolfBoot_unseal_pubkey(uint8_t* pubkey, WOLFTPM2_KEY* tpmKey)
return ret;

/* get the boot digest */
wolfBoot_printf("Unseal pubkey- image hash start\n");
if (image_hash(&boot, bootDigest) != 0)
return -1;
wolfBoot_printf("Unseal pubkey- image hash completed\n");

/* clear out the PCR digest */
pcrReset.pcrHandle = wolftpmPcrArray[0];

ret = TPM2_PCR_Reset(&pcrReset);
wolfBoot_printf("Unseal pubkey- reset pcr ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

/* extend the PCRs with the image hash */
ret = wolfTPM2_ExtendPCR(&wolftpm_dev, wolftpmPcrArray[0], TPM_ALG_SHA256,
bootDigest, WOLFBOOT_SHA_DIGEST_SIZE);
wolfBoot_printf("Unseal pubkey- extend pcr ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

/* start a policy session with parameter encryption */
ret = wolfTPM2_StartSession(&wolftpm_dev, &wolftpm_session, NULL, NULL,
TPM_SE_POLICY, TPM_ALG_CFB);
wolfBoot_printf("Unseal pubkey- start session with param enc ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

/* set the auth session for the device */
ret = wolfTPM2_SetAuthSession(&wolftpm_dev, 0, &wolftpm_session,
(TPMA_SESSION_decrypt | TPMA_SESSION_encrypt | TPMA_SESSION_continueSession));
wolfBoot_printf("Unseal pubkey- set auth session ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

/* clear out the policy digest */
ret = wolfTPM2_PolicyRestart(wolftpm_session.handle.hndl);
wolfBoot_printf("Unseal pubkey- policy restart:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

Expand All @@ -1196,7 +1211,8 @@ static int wolfBoot_unseal_pubkey(uint8_t* pubkey, WOLFTPM2_KEY* tpmKey)
TPM_ALG_SHA256, (word32*)wolftpmPcrArray, sizeof(wolftpmPcrArray), NULL,
0, policySignature, policySignatureSz, WOLFTPM_KEYSTORE_INDEX,
WOLFTPM_POLICY_DIGEST_INDEX, tpmPubkey, (word32*)&tpmPubkeySz);
if (ret != TPM_RC_SUCCESS)
wolfBoot_printf("Unseal pubkey- unseal nv pubkey ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

/* unload the intermediate key */
Expand All @@ -1206,6 +1222,7 @@ static int wolfBoot_unseal_pubkey(uint8_t* pubkey, WOLFTPM2_KEY* tpmKey)
ret = wolfTPM2_LoadEccPublicKey(&wolftpm_dev, tpmKey, TPM_ECC_NIST_P256,
tpmPubkey, KEYSTORE_ECC_POINT_SIZE, tpmPubkey + KEYSTORE_ECC_POINT_SIZE,
KEYSTORE_ECC_POINT_SIZE);
wolfBoot_printf("Unseal pubkey- load nv pubkey ret:%d\n",ret);
if (ret != TPM_RC_SUCCESS)
return -ret;

Expand Down Expand Up @@ -1373,8 +1390,10 @@ int wolfBoot_verify_integrity(struct wolfBoot_image *img)
stored_sha_len = get_header(img, WOLFBOOT_SHA_HDR, &stored_sha);
if (stored_sha_len != WOLFBOOT_SHA_DIGEST_SIZE)
return -1;
wolfBoot_printf("Verify Integrity hash start\n");
if (image_hash(img, digest) != 0)
return -1;
wolfBoot_printf("Verify Integrity hash completed\n");
#if defined(WOLFBOOT_TPM) && defined(WOLFBOOT_MEASURED_BOOT)
/*
* TPM measurement must be performed regardless of the
Expand Down Expand Up @@ -1437,8 +1456,10 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
if ((image_type & 0xFF00) != HDR_IMG_TYPE_AUTH)
return -1;
if (img->sha_hash == NULL) {
wolfBoot_printf("Verify Authenticity hash start\n");
if (image_hash(img, digest) != 0)
return -1;
wolfBoot_printf("Verify Integrity hash completed\n");
img->sha_hash = digest;
}
key_mask = keystore_get_mask(key_slot);
Expand Down