Skip to content

Commit 3f228e9

Browse files
tomchytomchy
committed
[nrf fromlist] zephyr: Add Kconfig-based VID and CID checks
Add a possibility to configure vendor ID and image class ID through Kconfig. Upstream PR #: 2409 Signed-off-by: Tomasz Chyrowicz <[email protected]>
1 parent c61efa3 commit 3f228e9

File tree

6 files changed

+203
-0
lines changed

6 files changed

+203
-0
lines changed

‎boot/zephyr/CMakeLists.txt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,59 @@ if(DEFINED CONFIG_MEASURED_BOOT OR DEFINED CONFIG_BOOT_SHARE_DATA)
140140
)
141141
endif()
142142

143+
# Include the sample implementation.
144+
if(CONFIG_MCUBOOT_UUID_VID OR CONFIG_MCUBOOT_UUID_CID)
145+
zephyr_library_sources(
146+
mcuboot_uuid.c
147+
)
148+
endif()
149+
150+
# Generate VID value and raw value definition
151+
if(CONFIG_MCUBOOT_UUID_VID OR CONFIG_MCUBOOT_UUID_CID)
152+
string(REGEX MATCHALL "^([0-9A-F][0-9A-F]|\-)+$" match_parts ${CONFIG_MCUBOOT_UUID_VID_VALUE})
153+
if ("${match_parts}" STREQUAL "${CONFIG_MCUBOOT_UUID_VID_VALUE}")
154+
set(UUID_VID ${match_parts})
155+
else()
156+
set(UUID_DNS_NAMESPACE 6ba7b810-9dad-11d1-80b4-00c04fd430c8)
157+
string(
158+
UUID UUID_VID
159+
NAMESPACE ${UUID_DNS_NAMESPACE}
160+
NAME ${CONFIG_MCUBOOT_UUID_VID_VALUE}
161+
TYPE SHA1 UPPER
162+
)
163+
endif()
164+
165+
# Convert UUID into C array.
166+
string(REGEX REPLACE "([0-9A-F][0-9A-F])\-?" "0x\\1, " UUID_VID_RAW ${UUID_VID})
167+
add_compile_definitions(MCUBOOT_UUID_VID_VALUE=${UUID_VID_RAW})
168+
endif()
169+
170+
# Generate VID value(s) and raw value definition(s)
171+
if(CONFIG_MCUBOOT_UUID_CID)
172+
set(MCUBOOT_IMAGES_COUNT 4)
173+
foreach(image_id RANGE ${MCUBOOT_IMAGES_COUNT})
174+
if(CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id})
175+
# Check if RAW UUID format is used
176+
string(REGEX MATCHALL "^([0-9A-F][0-9A-F]|\-)+$" match_parts ${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE})
177+
if ("${match_parts}" STREQUAL "${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE}")
178+
set(UUID_CID_IMAGE_${image_id} ${match_parts})
179+
else()
180+
# If not - generate UUID based on VID and CID values
181+
string(
182+
UUID UUID_CID_IMAGE_${image_id}
183+
NAMESPACE ${UUID_VID}
184+
NAME ${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE}
185+
TYPE SHA1 UPPER
186+
)
187+
endif()
188+
189+
# Convert UUID into C array.
190+
string(REGEX REPLACE "([0-9A-F][0-9A-F])\-?" "0x\\1, " UUID_CID_IMAGE_${image_id}_RAW ${UUID_CID_IMAGE_${image_id}})
191+
add_compile_definitions(MCUBOOT_UUIC_CID_IMAGE_${image_id}_VALUE=${UUID_CID_IMAGE_${image_id}_RAW})
192+
endif()
193+
endforeach()
194+
endif()
195+
143196
# library which might be common source code for MCUBoot and an application
144197
zephyr_link_libraries(MCUBOOT_BOOTUTIL)
145198

‎boot/zephyr/Kconfig

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1077,6 +1077,44 @@ config MCUBOOT_HW_DOWNGRADE_PREVENTION
10771077

10781078
endchoice
10791079

1080+
config MCUBOOT_UUID_VID
1081+
bool "Expect vendor unique identifier in image's TLV"
1082+
help
1083+
Provide a vendor identification scheme to prevent processing images
1084+
generated by a different vendor.
1085+
1086+
config MCUBOOT_UUID_CID
1087+
bool "Expect image class unique identifier in image's TLV"
1088+
help
1089+
Provide an image class identification scheme to prevent processing
1090+
images for a different CPU or device produced by the same vendor.
1091+
1092+
config MCUBOOT_UUID_VID_VALUE
1093+
string "Vendor name"
1094+
default ""
1095+
depends on MCUBOOT_UUID_VID || MCUBOOT_UUID_CID
1096+
help
1097+
The vendor unique identifier.
1098+
The following formats are supported:
1099+
- Domain name (i.e. amce.corp) used to generate RFC 9562 UUID5
1100+
identifier.
1101+
- Raw UUID (i.e. 12345678-1234-5678-1234-567812345678)
1102+
1103+
if MCUBOOT_UUID_CID
1104+
1105+
image=0
1106+
rsource "Kconfig.uuid.template"
1107+
image=1
1108+
rsource "Kconfig.uuid.template"
1109+
image=2
1110+
rsource "Kconfig.uuid.template"
1111+
image=3
1112+
rsource "Kconfig.uuid.template"
1113+
image=4
1114+
rsource "Kconfig.uuid.template"
1115+
1116+
endif # MCUBOOT_UUID_CID
1117+
10801118
config BOOT_WATCHDOG_FEED
10811119
bool "Feed the watchdog while doing swap"
10821120
default y if WATCHDOG

‎boot/zephyr/Kconfig.uuid.template

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
config MCUBOOT_UUID_CID_IMAGE_$(image)_VALUE
2+
string "Image class name (image $(image))"
3+
default ""
4+
help
5+
The image class unique identifier.
6+
The following formats are supported:
7+
- Image class name (i.e. nRF5340_door_lock_btperipheral).
8+
This format requires MCUBOOT_UUID_VID_VALUE to be defined
9+
as the VID UUID is used as the namespace for generating RFC 9562
10+
UUID5 identifier.
11+
- Raw UUID (i.e. 12345678-1234-5678-1234-567812345678)
12+
13+
config MCUBOOT_UUID_CID_IMAGE_$(image)
14+
bool
15+
default y
16+
depends on MCUBOOT_UUID_CID_IMAGE_$(image)_VALUE != ""
17+
help
18+
Helper symbol to simplify the active CId list generation.
19+

‎boot/zephyr/include/mcuboot_config/mcuboot_config.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,14 @@
209209
#define MCUBOOT_HW_ROLLBACK_PROT
210210
#endif
211211

212+
#ifdef CONFIG_MCUBOOT_UUID_VID
213+
#define MCUBOOT_UUID_VID
214+
#endif
215+
216+
#ifdef CONFIG_MCUBOOT_UUID_CID
217+
#define MCUBOOT_UUID_CID
218+
#endif
219+
212220
#ifdef CONFIG_MEASURED_BOOT
213221
#define MCUBOOT_MEASURED_BOOT
214222
#endif

‎boot/zephyr/main.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@
4747
#include "bootutil/mcuboot_status.h"
4848
#include "flash_map_backend/flash_map_backend.h"
4949

50+
#if defined(CONFIG_MCUBOOT_UUID_VID) || defined(CONFIG_MCUBOOT_UUID_CID)
51+
#include "bootutil/mcuboot_uuid.h"
52+
#endif /* CONFIG_MCUBOOT_UUID_VID || CONFIG_MCUBOOT_UUID_CID */
53+
5054
/* Check if Espressif target is supported */
5155
#ifdef CONFIG_SOC_FAMILY_ESPRESSIF_ESP32
5256

@@ -510,6 +514,14 @@ int main(void)
510514

511515
mcuboot_status_change(MCUBOOT_STATUS_STARTUP);
512516

517+
#if defined(CONFIG_MCUBOOT_UUID_VID) || defined(CONFIG_MCUBOOT_UUID_CID)
518+
FIH_CALL(boot_uuid_init, fih_rc);
519+
if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
520+
BOOT_LOG_ERR("Unable to initialize UUID module: %d", fih_rc);
521+
FIH_PANIC;
522+
}
523+
#endif /* CONFIG_MCUBOOT_UUID_VID || CONFIG_MCUBOOT_UUID_CID */
524+
513525
#ifdef CONFIG_BOOT_SERIAL_ENTRANCE_GPIO
514526
BOOT_LOG_DBG("Checking GPIO for serial recovery");
515527
if (io_detect_pin() &&

‎boot/zephyr/mcuboot_uuid.c

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
#include <bootutil/mcuboot_uuid.h>
7+
8+
#define IMAGE_ID_COUNT 5
9+
#define CID_INIT(index, label) \
10+
static const struct image_uuid label = {{ \
11+
MCUBOOT_UUIC_CID_IMAGE_## index ##_VALUE \
12+
}}
13+
#define CID_CONFIG(index) UTIL_CAT(CONFIG_MCUBOOT_UUID_CID_IMAGE_, index)
14+
#define CID_DEFINE(index, prefix) \
15+
IF_ENABLED(CID_CONFIG(index), (CID_INIT(index, prefix##index)))
16+
17+
#define CID_CONDITION(index, label) \
18+
if (image_id == index) { \
19+
*uuid_cid = &label; \
20+
FIH_RET(FIH_SUCCESS); \
21+
}
22+
#define CID_CHECK(index, prefix) \
23+
IF_ENABLED(CID_CONFIG(index), (CID_CONDITION(index, prefix##index)))
24+
25+
static fih_ret boot_uuid_compare(const struct image_uuid *uuid1, const struct image_uuid *uuid2)
26+
{
27+
return fih_ret_encode_zero_equality(memcmp(uuid1->raw, uuid2->raw,
28+
ARRAY_SIZE(uuid1->raw)));
29+
}
30+
31+
#ifdef CONFIG_MCUBOOT_UUID_CID
32+
LISTIFY(IMAGE_ID_COUNT, CID_DEFINE, (;), uuid_cid_image_);
33+
34+
static fih_ret boot_uuid_cid_get(uint32_t image_id, const struct image_uuid **uuid_cid)
35+
{
36+
if (uuid_cid != NULL) {
37+
LISTIFY(IMAGE_ID_COUNT, CID_CHECK, (), uuid_cid_image_)
38+
}
39+
40+
FIH_RET(FIH_FAILURE);
41+
}
42+
#endif /* CONFIG_MCUBOOT_UUID_CID */
43+
44+
fih_ret boot_uuid_init(void)
45+
{
46+
FIH_RET(FIH_SUCCESS);
47+
}
48+
49+
#ifdef CONFIG_MCUBOOT_UUID_VID
50+
fih_ret boot_uuid_vid_match(uint32_t image_id, const struct image_uuid *uuid_vid)
51+
{
52+
const struct image_uuid uuid_vid_c = {{
53+
MCUBOOT_UUID_VID_VALUE
54+
}};
55+
56+
return boot_uuid_compare(uuid_vid, &uuid_vid_c);
57+
}
58+
#endif /* CONFIG_MCUBOOT_UUID_VID */
59+
60+
#ifdef CONFIG_MCUBOOT_UUID_CID
61+
fih_ret boot_uuid_cid_match(uint32_t image_id, const struct image_uuid *uuid_cid)
62+
{
63+
FIH_DECLARE(ret_code, FIH_FAILURE);
64+
const struct image_uuid *exp_uuid_cid = NULL;
65+
66+
FIH_CALL(boot_uuid_cid_get, ret_code, image_id, &exp_uuid_cid);
67+
if (FIH_NOT_EQ(ret_code, FIH_SUCCESS) && FIH_NOT_EQ(ret_code, FIH_FAILURE)) {
68+
FIH_RET(FIH_FAILURE);
69+
}
70+
71+
return boot_uuid_compare(uuid_cid, exp_uuid_cid);
72+
}
73+
#endif /* CONFIG_MCUBOOT_UUID_CID */

0 commit comments

Comments
 (0)