Skip to content

Commit 43a12ac

Browse files
tomchytomchy
committed
[nrf fromlist] zephyr: Add Kconfig-based VID and CID checks
Add a possibility to configure vendor ID and image class ID through Kconfig. Upstream PR #: 2409 Signed-off-by: Tomasz Chyrowicz <[email protected]>
1 parent 80ee1b1 commit 43a12ac

File tree

6 files changed

+203
-0
lines changed

6 files changed

+203
-0
lines changed

‎boot/zephyr/CMakeLists.txt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,59 @@ if(DEFINED CONFIG_MEASURED_BOOT OR DEFINED CONFIG_BOOT_SHARE_DATA)
134134
)
135135
endif()
136136

137+
# Include the sample implementation.
138+
if(CONFIG_MCUBOOT_UUID_VID OR CONFIG_MCUBOOT_UUID_CID)
139+
zephyr_library_sources(
140+
mcuboot_uuid.c
141+
)
142+
endif()
143+
144+
# Generate VID value and raw value definition
145+
if(CONFIG_MCUBOOT_UUID_VID OR CONFIG_MCUBOOT_UUID_CID)
146+
string(REGEX MATCHALL "^([0-9A-F][0-9A-F]|\-)+$" match_parts ${CONFIG_MCUBOOT_UUID_VID_VALUE})
147+
if ("${match_parts}" STREQUAL "${CONFIG_MCUBOOT_UUID_VID_VALUE}")
148+
set(UUID_VID ${match_parts})
149+
else()
150+
set(UUID_DNS_NAMESPACE 6ba7b810-9dad-11d1-80b4-00c04fd430c8)
151+
string(
152+
UUID UUID_VID
153+
NAMESPACE ${UUID_DNS_NAMESPACE}
154+
NAME ${CONFIG_MCUBOOT_UUID_VID_VALUE}
155+
TYPE SHA1 UPPER
156+
)
157+
endif()
158+
159+
# Convert UUID into C array.
160+
string(REGEX REPLACE "([0-9A-F][0-9A-F])\-?" "0x\\1, " UUID_VID_RAW ${UUID_VID})
161+
add_compile_definitions(MCUBOOT_UUID_VID_VALUE=${UUID_VID_RAW})
162+
endif()
163+
164+
# Generate VID value(s) and raw value definition(s)
165+
if(CONFIG_MCUBOOT_UUID_CID)
166+
set(MCUBOOT_IMAGES_COUNT 4)
167+
foreach(image_id RANGE ${MCUBOOT_IMAGES_COUNT})
168+
if(CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id})
169+
# Check if RAW UUID format is used
170+
string(REGEX MATCHALL "^([0-9A-F][0-9A-F]|\-)+$" match_parts ${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE})
171+
if ("${match_parts}" STREQUAL "${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE}")
172+
set(UUID_CID_IMAGE_${image_id} ${match_parts})
173+
else()
174+
# If not - generate UUID based on VID and CID values
175+
string(
176+
UUID UUID_CID_IMAGE_${image_id}
177+
NAMESPACE ${UUID_VID}
178+
NAME ${CONFIG_MCUBOOT_UUID_CID_IMAGE_${image_id}_VALUE}
179+
TYPE SHA1 UPPER
180+
)
181+
endif()
182+
183+
# Convert UUID into C array.
184+
string(REGEX REPLACE "([0-9A-F][0-9A-F])\-?" "0x\\1, " UUID_CID_IMAGE_${image_id}_RAW ${UUID_CID_IMAGE_${image_id}})
185+
add_compile_definitions(MCUBOOT_UUIC_CID_IMAGE_${image_id}_VALUE=${UUID_CID_IMAGE_${image_id}_RAW})
186+
endif()
187+
endforeach()
188+
endif()
189+
137190
# library which might be common source code for MCUBoot and an application
138191
zephyr_link_libraries(MCUBOOT_BOOTUTIL)
139192

‎boot/zephyr/Kconfig

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1020,6 +1020,44 @@ config MCUBOOT_HW_DOWNGRADE_PREVENTION
10201020

10211021
endchoice
10221022

1023+
config MCUBOOT_UUID_VID
1024+
bool "Expect vendor unique identifier in image's TLV"
1025+
help
1026+
Provide a vendor identification scheme to prevent processing images
1027+
generated by a different vendor.
1028+
1029+
config MCUBOOT_UUID_CID
1030+
bool "Expect image class unique identifier in image's TLV"
1031+
help
1032+
Provide an image class identification scheme to prevent processing
1033+
images for a different CPU or device produced by the same vendor.
1034+
1035+
config MCUBOOT_UUID_VID_VALUE
1036+
string "Vendor name"
1037+
default ""
1038+
depends on MCUBOOT_UUID_VID || MCUBOOT_UUID_CID
1039+
help
1040+
The vendor unique identifier.
1041+
The following formats are supported:
1042+
- Domain name (i.e. amce.corp) used to generate RFC 9562 UUID5
1043+
identifier.
1044+
- Raw UUID (i.e. 12345678-1234-5678-1234-567812345678)
1045+
1046+
if MCUBOOT_UUID_CID
1047+
1048+
image=0
1049+
rsource "Kconfig.uuid.template"
1050+
image=1
1051+
rsource "Kconfig.uuid.template"
1052+
image=2
1053+
rsource "Kconfig.uuid.template"
1054+
image=3
1055+
rsource "Kconfig.uuid.template"
1056+
image=4
1057+
rsource "Kconfig.uuid.template"
1058+
1059+
endif # MCUBOOT_UUID_CID
1060+
10231061
config BOOT_WATCHDOG_FEED
10241062
bool "Feed the watchdog while doing swap"
10251063
default y if WATCHDOG

‎boot/zephyr/Kconfig.uuid.template

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
config MCUBOOT_UUID_CID_IMAGE_$(image)_VALUE
2+
string "Image class name (image $(image))"
3+
default ""
4+
help
5+
The image class unique identifier.
6+
The following formats are supported:
7+
- Image class name (i.e. nRF5340_door_lock_btperipheral).
8+
This format requires MCUBOOT_UUID_VID_VALUE to be defined
9+
as the VID UUID is used as the namespace for generating RFC 9562
10+
UUID5 identifier.
11+
- Raw UUID (i.e. 12345678-1234-5678-1234-567812345678)
12+
13+
config MCUBOOT_UUID_CID_IMAGE_$(image)
14+
bool
15+
default y
16+
depends on MCUBOOT_UUID_CID_IMAGE_$(image)_VALUE != ""
17+
help
18+
Helper symbol to simplify the active CId list generation.
19+

‎boot/zephyr/include/mcuboot_config/mcuboot_config.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,14 @@
205205
#define MCUBOOT_HW_ROLLBACK_PROT
206206
#endif
207207

208+
#ifdef CONFIG_MCUBOOT_UUID_VID
209+
#define MCUBOOT_UUID_VID
210+
#endif
211+
212+
#ifdef CONFIG_MCUBOOT_UUID_CID
213+
#define MCUBOOT_UUID_CID
214+
#endif
215+
208216
#ifdef CONFIG_MEASURED_BOOT
209217
#define MCUBOOT_MEASURED_BOOT
210218
#endif

‎boot/zephyr/main.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@
4747
#include "bootutil/mcuboot_status.h"
4848
#include "flash_map_backend/flash_map_backend.h"
4949

50+
#if defined(CONFIG_MCUBOOT_UUID_VID) || defined(CONFIG_MCUBOOT_UUID_CID)
51+
#include "bootutil/mcuboot_uuid.h"
52+
#endif /* CONFIG_MCUBOOT_UUID_VID || CONFIG_MCUBOOT_UUID_CID */
53+
5054
/* Check if Espressif target is supported */
5155
#ifdef CONFIG_SOC_FAMILY_ESPRESSIF_ESP32
5256

@@ -510,6 +514,14 @@ int main(void)
510514

511515
mcuboot_status_change(MCUBOOT_STATUS_STARTUP);
512516

517+
#if defined(CONFIG_MCUBOOT_UUID_VID) || defined(CONFIG_MCUBOOT_UUID_CID)
518+
FIH_CALL(boot_uuid_init, fih_rc);
519+
if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
520+
BOOT_LOG_ERR("Unable to initialize UUID module: %d", fih_rc);
521+
FIH_PANIC;
522+
}
523+
#endif /* CONFIG_MCUBOOT_UUID_VID || CONFIG_MCUBOOT_UUID_CID */
524+
513525
#ifdef CONFIG_BOOT_SERIAL_ENTRANCE_GPIO
514526
BOOT_LOG_DBG("Checking GPIO for serial recovery");
515527
if (io_detect_pin() &&

‎boot/zephyr/mcuboot_uuid.c

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
#include <bootutil/mcuboot_uuid.h>
7+
8+
#define IMAGE_ID_COUNT 5
9+
#define CID_INIT(index, label) \
10+
static const struct image_uuid label = {{ \
11+
MCUBOOT_UUIC_CID_IMAGE_## index ##_VALUE \
12+
}}
13+
#define CID_CONFIG(index) UTIL_CAT(CONFIG_MCUBOOT_UUID_CID_IMAGE_, index)
14+
#define CID_DEFINE(index, prefix) \
15+
IF_ENABLED(CID_CONFIG(index), (CID_INIT(index, prefix##index)))
16+
17+
#define CID_CONDITION(index, label) \
18+
if (image_id == index) { \
19+
*uuid_cid = &label; \
20+
FIH_RET(FIH_SUCCESS); \
21+
}
22+
#define CID_CHECK(index, prefix) \
23+
IF_ENABLED(CID_CONFIG(index), (CID_CONDITION(index, prefix##index)))
24+
25+
static fih_ret boot_uuid_compare(const struct image_uuid *uuid1, const struct image_uuid *uuid2)
26+
{
27+
return fih_ret_encode_zero_equality(memcmp(uuid1->raw, uuid2->raw,
28+
ARRAY_SIZE(uuid1->raw)));
29+
}
30+
31+
#ifdef CONFIG_MCUBOOT_UUID_CID
32+
LISTIFY(IMAGE_ID_COUNT, CID_DEFINE, (;), uuid_cid_image_);
33+
34+
static fih_ret boot_uuid_cid_get(uint32_t image_id, const struct image_uuid **uuid_cid)
35+
{
36+
if (uuid_cid != NULL) {
37+
LISTIFY(IMAGE_ID_COUNT, CID_CHECK, (), uuid_cid_image_)
38+
}
39+
40+
FIH_RET(FIH_FAILURE);
41+
}
42+
#endif /* CONFIG_MCUBOOT_UUID_CID */
43+
44+
fih_ret boot_uuid_init(void)
45+
{
46+
FIH_RET(FIH_SUCCESS);
47+
}
48+
49+
#ifdef CONFIG_MCUBOOT_UUID_VID
50+
fih_ret boot_uuid_vid_match(uint32_t image_id, const struct image_uuid *uuid_vid)
51+
{
52+
const struct image_uuid uuid_vid_c = {{
53+
MCUBOOT_UUID_VID_VALUE
54+
}};
55+
56+
return boot_uuid_compare(uuid_vid, &uuid_vid_c);
57+
}
58+
#endif /* CONFIG_MCUBOOT_UUID_VID */
59+
60+
#ifdef CONFIG_MCUBOOT_UUID_CID
61+
fih_ret boot_uuid_cid_match(uint32_t image_id, const struct image_uuid *uuid_cid)
62+
{
63+
FIH_DECLARE(ret_code, FIH_FAILURE);
64+
const struct image_uuid *exp_uuid_cid = NULL;
65+
66+
FIH_CALL(boot_uuid_cid_get, ret_code, image_id, &exp_uuid_cid);
67+
if (FIH_NOT_EQ(ret_code, FIH_SUCCESS) && FIH_NOT_EQ(ret_code, FIH_FAILURE)) {
68+
FIH_RET(FIH_FAILURE);
69+
}
70+
71+
return boot_uuid_compare(uuid_cid, exp_uuid_cid);
72+
}
73+
#endif /* CONFIG_MCUBOOT_UUID_CID */

0 commit comments

Comments
 (0)