[nrf fromlist] boot: Add VID and CID checks

tomchy · tomchy · commit 90ad95e3eb25 · 2025-08-25T15:26:46.000+02:00
Add a possibility to express vendor ID and image class ID inside image's TLVs.

Upstream PR #: 2409

Signed-off-by: Tomasz Chyrowicz &lt;tomasz.chyrowicz@nordicsemi.no&gt;
diff --git a/boot/bootutil/include/bootutil/image.h b/boot/bootutil/include/bootutil/image.h
@@ -142,6 +142,8 @@ extern "C" {
                                              * ...
                                              * 0xffa0 - 0xfffe
                                              */
+#define IMAGE_TLV_UUID_VID          0x80    /* Vendor unique identifier */
+#define IMAGE_TLV_UUID_CID          0x81    /* Device class unique identifier */
 #define IMAGE_TLV_ANY               0xffff  /* Used to iterate over all TLV */
 
 #define VERSION_DEP_SLOT_ACTIVE     0x00   /* Check dependency against active slot. */
diff --git a/boot/bootutil/include/bootutil/mcuboot_uuid.h b/boot/bootutil/include/bootutil/mcuboot_uuid.h
@@ -0,0 +1,63 @@
+/*
+ *  Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef __MCUBOOT_UUID_H__
+#define __MCUBOOT_UUID_H__
+
+/**
+ * @file uuid.h
+ *
+ * @note A vendor ID as well as class ID values may be statically generated
+ *       using CMake, based on the vendor domain name as well as product name.
+ *       It is advised to use vendor ID as an input while generating device
+ *       class ID to avoid collisions between UUIDs from two different vendors.
+ */
+
+#include <stdint.h>
+#include "bootutil/fault_injection_hardening.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/** The 128-bit UUID, used for identifying vendors as well as image classes. */
+struct image_uuid {
+	uint8_t raw[16];
+};
+
+/**
+ * @brief Initialises the UUID module.
+ *
+ * @return FIH_SUCCESS on success
+ */
+fih_ret boot_uuid_init(void);
+
+/**
+ * @brief Check if the specified vendor UUID is allowed for a given image.
+ *
+ * @param[in] image_id  Index of the image (from 0).
+ * @param[in] uuid_vid  The reference to the image's vendor ID value.
+ *
+ * @return FIH_SUCCESS on success.
+ */
+fih_ret boot_uuid_vid_match(uint32_t image_id, const struct image_uuid *uuid_vid);
+
+/**
+ * @brief Check if the specified image class UUID is allowed for a given image.
+ *
+ * @param[in] image_id  Index of the image (from 0).
+ * @param[in] uuid_cid  The reference to the image's class ID value.
+ *
+ * @return FIH_SUCCESS on success
+ */
+fih_ret boot_uuid_cid_match(uint32_t image_id, const struct image_uuid *uuid_cid);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MCUBOOT_UUID_H__ */
diff --git a/boot/bootutil/src/image_validate.c b/boot/bootutil/src/image_validate.c
@@ -44,6 +44,9 @@
 #include "bootutil/bootutil_log.h"
 
 BOOT_LOG_MODULE_DECLARE(mcuboot);
+#if defined(MCUBOOT_UUID_VID) || defined(MCUBOOT_UUID_CID)
+#include "bootutil/mcuboot_uuid.h"
+#endif /* MCUBOOT_UUID_VID || MCUBOOT_UUID_CID */
 
 #ifdef MCUBOOT_ENC_IMAGES
 #include "bootutil/enc_key.h"
@@ -507,7 +510,8 @@ bootutil_img_validate(struct boot_loader_state *state,
 #endif
                      )
 {
-#if (defined(EXPECTED_KEY_TLV) && defined(MCUBOOT_HW_KEY)) || defined(MCUBOOT_HW_ROLLBACK_PROT)
+#if (defined(EXPECTED_KEY_TLV) && defined(MCUBOOT_HW_KEY)) || defined(MCUBOOT_HW_ROLLBACK_PROT) \
+    || defined(MCUBOOT_UUID_VID) || defined(MCUBOOT_UUID_CID)
     int image_index = (state == NULL ? 0 : BOOT_CURR_IMG(state));
 #endif
     uint32_t off;
@@ -553,6 +557,14 @@ bootutil_img_validate(struct boot_loader_state *state,
         goto out;
     }
 #endif
+#ifdef MCUBOOT_UUID_VID
+    struct image_uuid img_uuid_vid = {0x00};
+    FIH_DECLARE(uuid_vid_valid, FIH_FAILURE);
+#endif
+#ifdef MCUBOOT_UUID_CID
+    struct image_uuid img_uuid_cid = {0x00};
+    FIH_DECLARE(uuid_cid_valid, FIH_FAILURE);
+#endif
 
     BOOT_LOG_DBG("bootutil_img_validate: flash area %p", fap);
 
@@ -793,6 +805,64 @@ bootutil_img_validate(struct boot_loader_state *state,
             break;
         }
 #endif /* MCUBOOT_HW_ROLLBACK_PROT */
+#ifdef MCUBOOT_UUID_VID
+        case IMAGE_TLV_UUID_VID:
+        {
+            /*
+             * Verify the image's vendor ID length.
+             * This must always be present.
+             */
+            if (len != sizeof(img_uuid_vid)) {
+                /* Vendor UUID is not valid. */
+                rc = -1;
+                goto out;
+            }
+
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, img_uuid_vid.raw, len);
+            if (rc) {
+                goto out;
+            }
+
+            FIH_CALL(boot_uuid_vid_match, fih_rc, image_index, &img_uuid_vid);
+            if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
+                FIH_SET(uuid_vid_valid, FIH_FAILURE);
+                goto out;
+            }
+
+            /* The image's vendor identifier has been successfully verified. */
+            uuid_vid_valid = fih_rc;
+            break;
+        }
+#endif
+#ifdef MCUBOOT_UUID_CID
+        case IMAGE_TLV_UUID_CID:
+        {
+            /*
+             * Verify the image's class ID length.
+             * This must always be present.
+             */
+            if (len != sizeof(img_uuid_cid)) {
+                /* Image class UUID is not valid. */
+                rc = -1;
+                goto out;
+            }
+
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, img_uuid_cid.raw, len);
+            if (rc) {
+                goto out;
+            }
+
+            FIH_CALL(boot_uuid_cid_match, fih_rc, image_index, &img_uuid_cid);
+            if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
+                FIH_SET(uuid_cid_valid, FIH_FAILURE);
+                goto out;
+            }
+
+            /* The image's class identifier has been successfully verified. */
+            uuid_cid_valid = fih_rc;
+            break;
+        }
+#endif
         }
     }
 
@@ -821,6 +891,19 @@ bootutil_img_validate(struct boot_loader_state *state,
 skip_security_counter_check:
 #endif
 
+#ifdef MCUBOOT_UUID_VID
+    if (FIH_NOT_EQ(uuid_vid_valid, FIH_SUCCESS)) {
+        rc = -1;
+        goto out;
+    }
+#endif
+#ifdef MCUBOOT_UUID_CID
+    if (FIH_NOT_EQ(uuid_cid_valid, FIH_SUCCESS)) {
+        rc = -1;
+        goto out;
+    }
+#endif
+
 out:
     if (rc) {
         FIH_SET(fih_rc, FIH_FAILURE);
diff --git a/docs/design.md b/docs/design.md
@@ -104,22 +104,54 @@ struct image_tlv {
 /*
  * Image trailer TLV types.
  */
-#define IMAGE_TLV_KEYHASH           0x01   /* hash of the public key */
-#define IMAGE_TLV_SHA256            0x10   /* SHA256 of image hdr and body */
-#define IMAGE_TLV_RSA2048_PSS       0x20   /* RSA2048 of hash output */
-#define IMAGE_TLV_ECDSA224          0x21   /* ECDSA of hash output - Not supported anymore */
-#define IMAGE_TLV_ECDSA_SIG         0x22   /* ECDSA of hash output */
-#define IMAGE_TLV_RSA3072_PSS       0x23   /* RSA3072 of hash output */
-#define IMAGE_TLV_ED25519           0x24   /* ED25519 of hash output */
-#define IMAGE_TLV_SIG_PURE          0x25   /* If true then any signature found has been
-                                              calculated over image directly. */
-#define IMAGE_TLV_ENC_RSA2048       0x30   /* Key encrypted with RSA-OAEP-2048 */
-#define IMAGE_TLV_ENC_KW            0x31   /* Key encrypted with AES-KW-128 or
-                                              256 */
-#define IMAGE_TLV_ENC_EC256         0x32   /* Key encrypted with ECIES-P256 */
-#define IMAGE_TLV_ENC_X25519        0x33   /* Key encrypted with ECIES-X25519 */
-#define IMAGE_TLV_DEPENDENCY        0x40   /* Image depends on other image */
-#define IMAGE_TLV_SEC_CNT           0x50   /* security counter */
+#define IMAGE_TLV_KEYHASH           0x01    /* hash of the public key */
+#define IMAGE_TLV_PUBKEY            0x02    /* public key */
+#define IMAGE_TLV_SHA256            0x10    /* SHA256 of image hdr and body */
+#define IMAGE_TLV_SHA384            0x11    /* SHA384 of image hdr and body */
+#define IMAGE_TLV_SHA512            0x12    /* SHA512 of image hdr and body */
+#define IMAGE_TLV_RSA2048_PSS       0x20    /* RSA2048 of hash output */
+#define IMAGE_TLV_ECDSA224          0x21    /* ECDSA of hash output - Not supported anymore */
+#define IMAGE_TLV_ECDSA_SIG         0x22    /* ECDSA of hash output */
+#define IMAGE_TLV_RSA3072_PSS       0x23    /* RSA3072 of hash output */
+#define IMAGE_TLV_ED25519           0x24    /* ed25519 of hash output */
+#define IMAGE_TLV_SIG_PURE          0x25    /* Indicator that attached signature has been prepared
+                                             * over image rather than its digest.
+                                             */
+#define IMAGE_TLV_ENC_RSA2048       0x30    /* Key encrypted with RSA-OAEP-2048 */
+#define IMAGE_TLV_ENC_KW            0x31    /* Key encrypted with AES-KW 128 or 256*/
+#define IMAGE_TLV_ENC_EC256         0x32    /* Key encrypted with ECIES-EC256 */
+#define IMAGE_TLV_ENC_X25519        0x33    /* Key encrypted with ECIES-X25519 */
+#define IMAGE_TLV_ENC_X25519_SHA512 0x34    /* Key exchange using ECIES-X25519 and SHA512 for MAC
+                                             * tag and HKDF in key derivation process
+                                             */
+#define IMAGE_TLV_DEPENDENCY        0x40    /* Image depends on other image */
+#define IMAGE_TLV_SEC_CNT           0x50    /* security counter */
+#define IMAGE_TLV_BOOT_RECORD       0x60    /* measured boot record */
+/* The following flags relate to compressed images and are for the decompressed image data */
+#define IMAGE_TLV_DECOMP_SIZE       0x70    /* Decompressed image size excluding header/TLVs */
+#define IMAGE_TLV_DECOMP_SHA        0x71    /*
+                                             * Decompressed image shaX hash, this field must match
+                                             * the format and size of the raw slot (compressed)
+                                             * shaX hash
+                                             */
+#define IMAGE_TLV_DECOMP_SIGNATURE  0x72    /*
+                                             * Decompressed image signature, this field must match
+                                             * the format and size of the raw slot (compressed)
+                                             * signature
+                                             */
+#define IMAGE_TLV_COMP_DEC_SIZE     0x73    /* Compressed decrypted image size */
+                                            /*
+                                             * vendor reserved TLVs at xxA0-xxFF,
+                                             * where xx denotes the upper byte
+                                             * range.  Examples:
+                                             * 0x00a0 - 0x00ff
+                                             * 0x01a0 - 0x01ff
+                                             * 0x02a0 - 0x02ff
+                                             * ...
+                                             * 0xffa0 - 0xfffe
+                                             */
+#define IMAGE_TLV_UUID_VID          0x80    /* Vendor unique identifier */
+#define IMAGE_TLV_UUID_CID          0x81    /* Device class unique identifier */
 ```
 
 Optional type-length-value records (TLVs) containing image metadata are placed
