Skip to content

Commit 9451b47

Browse files
dgarskedanielinux
dgarske
authored and
danielinux
committed
Fix for Renesas TSIP key types. Fix for Renesas RX .keystore location in linker script. Fix for wolfBoot as library with Renesas to make sure crypto hardware is initialized and setup. Add forced alignment on additional buffers used for flash read/write.
1 parent 4787d70 commit 9451b47

File tree

8 files changed

+129
-74
lines changed

8 files changed

+129
-74
lines changed

‎hal/renesas-ra.c‎

Lines changed: 37 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -54,29 +54,19 @@ static inline void hal_panic(void)
5454
extern flash_ctrl_t g_flash0_ctrl;
5555
extern flash_cfg_t g_flash0_cfg;
5656

57-
void hal_init(void)
57+
#if defined(WOLFBOOT_RENESAS_SCEPROTECT) && !defined(WOLFBOOT_RENESAS_APP)
58+
static int sipInitDone = 0;
59+
int hal_renesas_init(void)
5860
{
5961
fsp_err_t err;
62+
uint32_t *pubkey;
6063

61-
#if defined(WOLFBOOT_RENESAS_SCEPROTECT) && !defined(WOLFBOOT_RENESAS_APP)
62-
/* retrieve installed pubkey from flash */
63-
uint32_t *pubkey = keystore_get_buffer(0);
64-
#endif
65-
err = R_FLASH_HP_Close(&g_flash0_ctrl);
66-
err = R_FLASH_HP_Open(&g_flash0_ctrl, &g_flash0_cfg);
64+
if (sipInitDone)
65+
return 0;
6766

68-
if(err != FSP_ERR_ALREADY_OPEN && err != FSP_SUCCESS){
69-
printf("ERROR: %d\n", err);
70-
hal_panic();
71-
}
67+
/* retrieve installed pubkey from flash */
68+
pubkey = keystore_get_buffer(0);
7269

73-
/* Setup Default Block 0 as Startup Setup Block */
74-
err = R_FLASH_HP_StartUpAreaSelect(&g_flash0_ctrl, FLASH_STARTUP_AREA_BLOCK0, true);
75-
if(err != FSP_SUCCESS){
76-
printf("ERROR: %d\n", err);
77-
hal_panic();
78-
}
79-
#if defined(WOLFBOOT_RENESAS_SCEPROTECT) && !defined(WOLFBOOT_RENESAS_APP)
8070
err = wolfCrypt_Init();
8171
if (err != 0) {
8272
printf("ERROR: wolfCrypt_Init %d\n", err);
@@ -93,12 +83,39 @@ void hal_init(void)
9383
pkInfo.keyflgs_crypt.bits.rsapub2048_installedkey_set = 1;
9484
pkInfo.keyflgs_crypt.bits.message_type = 1;
9585
err = wc_CryptoCb_CryptInitRenesasCmn(NULL, &pkInfo);
96-
9786
if (err < 0) {
9887
printf("ERROR: wc_CryptoCb_CryptInitRenesasCmn %d\n", err);
99-
hal_panic();
88+
return err;
10089
}
90+
sipInitDone = 1;
91+
return 0;
92+
}
93+
#endif
10194

95+
void hal_init(void)
96+
{
97+
fsp_err_t err;
98+
99+
err = R_FLASH_HP_Close(&g_flash0_ctrl);
100+
err = R_FLASH_HP_Open(&g_flash0_ctrl, &g_flash0_cfg);
101+
102+
if (err != FSP_ERR_ALREADY_OPEN && err != FSP_SUCCESS){
103+
wolfBoot_printf("ERROR: %d\n", err);
104+
hal_panic();
105+
}
106+
107+
/* Setup Default Block 0 as Startup Setup Block */
108+
err = R_FLASH_HP_StartUpAreaSelect(&g_flash0_ctrl, FLASH_STARTUP_AREA_BLOCK0, true);
109+
if (err != FSP_SUCCESS){
110+
wolfBoot_printf("ERROR: %d\n", err);
111+
hal_panic();
112+
}
113+
#if defined(WOLFBOOT_RENESAS_SCEPROTECT) && !defined(WOLFBOOT_RENESAS_APP)
114+
err = hal_renesas_init();
115+
if (err != 0) {
116+
wolfBoot_printf("ERROR: hal_renesas_init %d\n", err);
117+
hal_panic();
118+
}
102119
#endif
103120
}
104121

‎hal/renesas-rx.c‎

Lines changed: 48 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -367,38 +367,21 @@ void hal_clk_init(void)
367367
PROTECT_ON(); /* write protect on */
368368
}
369369

370-
void hal_init(void)
370+
#if defined(WOLFBOOT_RENESAS_TSIP) && !defined(WOLFBOOT_RENESAS_APP)
371+
static int sipInitDone = 0;
372+
int hal_renesas_init(void)
371373
{
372-
#if defined(WOLFBOOT_RENESAS_TSIP) && \
373-
!defined(WOLFBOOT_RENESAS_APP)
374374
int err;
375375
uint32_t key_type = 0;
376376
int tsip_key_type = -1;
377377
struct enc_pub_key *encrypted_user_key_data;
378-
#endif
379-
380-
/* For CCRX, mcu_clock_setup() in resetprg.c will set up clocks. */
381-
#if defined(__GNUC__)
382-
hal_clk_init();
383-
#endif
384378

385-
#ifdef ENABLE_LED
386-
hal_led_off();
387-
#endif
379+
if (sipInitDone)
380+
return 0;
388381

389-
#ifdef DEBUG_UART
390-
uart_init();
391-
uart_write("wolfBoot HAL Init\n", 18);
392-
#endif
393-
394-
hal_flash_init();
395-
396-
#if defined(WOLFBOOT_RENESAS_TSIP) && \
397-
!defined(WOLFBOOT_RENESAS_APP)
398382
err = wolfCrypt_Init();
399383
if (err != 0) {
400-
wolfBoot_printf("ERROR: wolfCrypt_Init %d\n", err);
401-
hal_panic();
384+
return err;
402385
}
403386

404387
/* retrive installed pubkey data from flash */
@@ -407,19 +390,19 @@ void hal_init(void)
407390
key_type = keystore_get_key_type(0);
408391
switch (key_type) {
409392
case AUTH_KEY_RSA2048:
410-
tsip_key_type = TSIP_RSA2048;
393+
tsip_key_type = TSIP_KEY_TYPE_RSA2048;
411394
break;
412395
case AUTH_KEY_RSA3072:
413-
tsip_key_type = TSIP_RSA3072;
396+
tsip_key_type = TSIP_KEY_TYPE_RSA3072;
414397
break;
415398
case AUTH_KEY_RSA4096:
416-
tsip_key_type = TSIP_RSA4096;
399+
tsip_key_type = TSIP_KEY_TYPE_RSA4096;
417400
break;
418401
case AUTH_KEY_ECC256:
419-
tsip_key_type = TSIP_ECCP256;
402+
tsip_key_type = TSIP_KEY_TYPE_ECDSAP256;
420403
break;
421404
case AUTH_KEY_ECC384:
422-
tsip_key_type = TSIP_ECCP384;
405+
tsip_key_type = TSIP_KEY_TYPE_ECDSAP384;
423406
break;
424407
case AUTH_KEY_ECC521:
425408
case AUTH_KEY_ED25519:
@@ -430,7 +413,7 @@ void hal_init(void)
430413
}
431414
if (tsip_key_type == -1) {
432415
wolfBoot_printf("key type (%d) not supported\n", key_type);
433-
hal_panic();
416+
return -1;
434417
}
435418

436419
/* Load encrypted UFPK (User Factory Programming Key) */
@@ -447,7 +430,7 @@ void hal_init(void)
447430
sizeof(encrypted_user_key_data->encrypted_user_key),
448431
tsip_key_type) != 0) {
449432
wolfBoot_printf("ERROR tsip_use_PublicKey_buffer\n");
450-
hal_panic();
433+
return -1;
451434
}
452435

453436
/* Init Crypt Callback */
@@ -456,9 +439,43 @@ void hal_init(void)
456439
err = wc_CryptoCb_CryptInitRenesasCmn(NULL, &pkInfo);
457440
if (err < 0) {
458441
wolfBoot_printf("ERROR: wc_CryptoCb_CryptInitRenesasCmn %d\n", err);
459-
hal_panic();
442+
return -1;
460443
}
444+
sipInitDone = 1;
445+
return 0;
446+
}
461447
#endif /* TSIP */
448+
449+
450+
void hal_init(void)
451+
{
452+
#if defined(WOLFBOOT_RENESAS_TSIP) && !defined(WOLFBOOT_RENESAS_APP)
453+
int err;
454+
#endif
455+
456+
/* For CCRX, mcu_clock_setup() in resetprg.c will set up clocks. */
457+
#if defined(__GNUC__)
458+
hal_clk_init();
459+
#endif
460+
461+
#ifdef ENABLE_LED
462+
hal_led_off();
463+
#endif
464+
465+
#ifdef DEBUG_UART
466+
uart_init();
467+
uart_write("wolfBoot HAL Init\n", 18);
468+
#endif
469+
470+
hal_flash_init();
471+
472+
#if defined(WOLFBOOT_RENESAS_TSIP) && !defined(WOLFBOOT_RENESAS_APP)
473+
err = hal_renesas_init();
474+
if (err != 0) {
475+
wolfBoot_printf("ERROR: hal_renesas_init %d\n", err);
476+
hal_panic();
477+
}
478+
#endif
462479
}
463480

464481
void hal_prepare_boot(void)

‎hal/renesas-rz.c‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
#include "wolfssl/wolfcrypt/wc_port.h"
3535
#include "wolfssl/wolfcrypt/port/Renesas/renesas-fspsm-crypt.h"
3636
#include "wolfssl/wolfcrypt/port/Renesas/renesas-fspsm-types.h"
37-
37+
3838
FSPSM_ST pkInfo;
3939
uint8_t wrapped_public_key[RSIP_BYTE_SIZE_WRAPPED_KEY_VALUE_RSA_2048_PUBLIC];
4040
rsip_wrapped_key_t *p_wrapped_public_key = (rsip_wrapped_key_t *) wrapped_public_key;
@@ -125,29 +125,31 @@ void ext_flash_unlock(void)
125125

126126
#endif
127127

128-
void hal_init(void)
129-
{
130-
131128
#if defined(WOLFBOOT_RENESAS_RSIP) && !defined(WOLFBOOT_RENESAS_APP)
132-
129+
static int sipInitDone = 0;
130+
int hal_renesas_init(void)
131+
{
133132
fsp_err_t err;
134133
int ret;
135134
rsa_public_t rsip_pub_key;
136135
const size_t key_size = sizeof(rsip_pub_key);
137136

138-
err = wolfCrypt_Init();
139-
if (err != 0) {
140-
printf("ERROR: wolfCrypt_Init %d\n", err);
141-
hal_panic();
137+
if (sipInitDone)
138+
reutrn 0;
139+
140+
ret = wolfCrypt_Init();
141+
if (ret != 0) {
142+
wolfBoot_printf("ERROR: wolfCrypt_Init %d\n", ret);
143+
return ret;
142144
}
143145

144146
/* copy the key from ext flash to RAM */
145147
ret = ext_flash_read(RENESAS_RSIP_INSTALLEDKEY_FLASH_ADDR,
146148
(uint8_t*)RENESAS_RSIP_INSTALLEDKEY_RAM_ADDR, key_size);
147149
if (ret != key_size){
148150
wolfBoot_printf("Error reading public key at %lx\n",
149-
RENESAS_RSIP_INSTALLEDKEY_FLASH_ADDR);
150-
hal_panic();
151+
RENESAS_RSIP_INSTALLEDKEY_FLASH_ADDR);
152+
return -1;
151153
}
152154
/* import enrypted key */
153155
XMEMCPY(&rsip_pub_key, (const void*)RENESAS_RSIP_INSTALLEDKEY_RAM_ADDR, key_size);
@@ -166,12 +168,23 @@ void hal_init(void)
166168
pkInfo.keyflgs_crypt.bits.message_type = 1;
167169
pkInfo.hash_type = RSIP_HASH_TYPE_SHA256;
168170
err = wc_CryptoCb_CryptInitRenesasCmn(NULL, &pkInfo);
169-
170171
if (err < 0) {
171172
wolfBoot_printf("ERROR: wc_CryptoCb_CryptInitRenesasCmn %d\n", err);
172-
hal_panic();
173+
return err;
173174
}
175+
sipInitDone = 1;
176+
return 0;
177+
}
178+
#endif
174179

180+
void hal_init(void)
181+
{
182+
#if defined(WOLFBOOT_RENESAS_RSIP) && !defined(WOLFBOOT_RENESAS_APP)
183+
int err = hal_renesas_init();
184+
if (err != 0) {
185+
printf("ERROR: hal_renesas_init %d\n", err);
186+
hal_panic();
187+
}
175188
#endif
176189
}
177190

‎include/user_settings.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,7 @@ extern int tolower(int c);
501501
#define WOLF_CRYPTO_CB_ONLY_ECC
502502
#define WOLF_CRYPTO_CB_ONLY_RSA
503503
#define WOLFSSL_NO_SW_MATH
504+
#define MAX_CRYPTO_DEVID_CALLBACKS 2
504505

505506
#ifdef WOLFBOOT_RENESAS_TSIP
506507
#define WOLFSSL_RENESAS_TSIP

‎include/wolfboot/wolfboot.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ extern "C" {
208208
#include "wolfssl/wolfcrypt/types.h"
209209
#include "wolfssl/wolfcrypt/sha3.h"
210210
# ifndef WOLFBOOT_SHA_BLOCK_SIZE
211-
# define WOLFBOOT_SHA_BLOCK_SIZE (128)
211+
# define WOLFBOOT_SHA_BLOCK_SIZE (256)
212212
# endif
213213
# define WOLFBOOT_SHA_HDR HDR_SHA3_384
214214
# define WOLFBOOT_SHA_DIGEST_SIZE (48)

‎src/image.c‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
#endif
5454

5555
/* Globals */
56-
static uint8_t digest[WOLFBOOT_SHA_DIGEST_SIZE];
56+
static uint8_t XALIGNED(4) digest[WOLFBOOT_SHA_DIGEST_SIZE];
5757

5858
#if defined(WOLFBOOT_CERT_CHAIN_VERIFY) && \
5959
defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT)
@@ -813,7 +813,7 @@ uint16_t wolfBoot_get_header(struct wolfBoot_image *img, uint16_t type,
813813
}
814814

815815
#ifdef EXT_FLASH
816-
static uint8_t ext_hash_block[WOLFBOOT_SHA_BLOCK_SIZE];
816+
static uint8_t XALIGNED(4) ext_hash_block[WOLFBOOT_SHA_BLOCK_SIZE];
817817
#endif
818818
/**
819819
* @brief Get a block of data to be hashed.
@@ -1565,7 +1565,7 @@ static int update_hash_flash_fwimg(wolfBoot_hash_t* ctx,
15651565
{
15661566
uint32_t current_offset = offset;
15671567
uint32_t remaining_size = size;
1568-
uint8_t read_buf[WOLFBOOT_SHA_BLOCK_SIZE]; /* Use local buffer */
1568+
uint8_t XALIGNED(4) read_buf[WOLFBOOT_SHA_BLOCK_SIZE]; /* Use local buffer */
15691569

15701570
while (remaining_size > 0) {
15711571
uint32_t read_size = (remaining_size > WOLFBOOT_SHA_BLOCK_SIZE)
@@ -1594,7 +1594,7 @@ static int update_hash_flash_fwimg(wolfBoot_hash_t* ctx,
15941594
static int update_hash_flash_addr(wolfBoot_hash_t* ctx, uintptr_t addr,
15951595
uint32_t size, int src_ext)
15961596
{
1597-
uint8_t buffer[WOLFBOOT_SHA_BLOCK_SIZE];
1597+
uint8_t XALIGNED(4) buffer[WOLFBOOT_SHA_BLOCK_SIZE];
15981598
uint32_t remaining_size = size;
15991599
uintptr_t current_addr = addr;
16001600

@@ -1633,7 +1633,7 @@ int wolfBoot_check_flash_image_elf(uint8_t part, unsigned long* entry_out)
16331633
size_t ph_size = 0;
16341634
size_t current_ph_offset = 0;
16351635
int64_t final_offset = -1;
1636-
uint8_t calc_digest[WOLFBOOT_SHA_DIGEST_SIZE];
1636+
uint8_t XALIGNED(4) calc_digest[WOLFBOOT_SHA_DIGEST_SIZE];
16371637
uint8_t* exp_digest;
16381638
int32_t stored_sha_len;
16391639
int i;
@@ -1988,7 +1988,14 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
19881988
* TSIP encrypted key is installed at
19891989
* RENESAS_TSIP_INSTALLEDKEY_ADDR
19901990
*/
1991+
extern int hal_renesas_init(void);
1992+
int rc = hal_renesas_init();
1993+
if (rc != 0) {
1994+
wolfBoot_printf("hal_renesas_init failed! %d\n", rc);
1995+
return rc;
1996+
}
19911997
key_slot = 0;
1998+
19921999
#elif defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
19932000
defined(WOLFBOOT_USE_WOLFHSM_PUBKEY_ID)
19942001
/* Don't care about the key slot, we are using a fixed wolfHSM keyId */

‎tools/keytools/keygen.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -168,8 +168,8 @@ const char Cfile_Banner[]=
168168
const char Store_hdr[] = "\n"
169169
"#if defined(__APPLE__) && defined(__MACH__)\n"
170170
"#define KEYSTORE_SECTION __attribute__((section (\"__KEYSTORE,__keystore\")))\n"
171-
"#elif defined(__CCRX__) /* Renesas RX */\n"
172-
"#define KEYSTORE_SECTION\n"
171+
"#elif defined(__CCRX__) || defined(WOLFBOOT_RENESAS_RSIP) || defined(WOLFBOOT_RENESAS_TSIP) || defined(WOLFBOOT_RENESAS_SCEPROTECT)\n"
172+
"#define KEYSTORE_SECTION /* Renesas RX */\n"
173173
"#elif defined(TARGET_x86_64_efi)\n"
174174
"#define KEYSTORE_SECTION\n"
175175
"#else\n"
@@ -258,7 +258,7 @@ const char Keystore_API[] =
258258
"{\n"
259259
" if (id >= keystore_num_pubkeys())\n"
260260
" return 0;\n"
261-
" return (int)PubKeys[id].part_id_mask;\n"
261+
" return PubKeys[id].part_id_mask;\n"
262262
"}\n"
263263
"\n"
264264
"uint32_t keystore_get_key_type(int id)\n"

‎tools/keytools/keygen.py‎

100755100644
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ def keystore_add(slot, pub, sz = 0):
172172
Keystore_API += "{\n"
173173
Keystore_API += " if (id >= keystore_num_pubkeys())\n"
174174
Keystore_API += " return -1;\n"
175-
Keystore_API += " return (int)PubKeys[id].part_id_mask;\n"
175+
Keystore_API += " return PubKeys[id].part_id_mask;\n"
176176
Keystore_API += "}\n\n"
177177
Keystore_API += "#endif /* Keystore public key size check */\n"
178178
Keystore_API += "#endif /* WOLFBOOT_NO_SIGN */\n"

0 commit comments

Comments
 (0)