michaelh/zephyr
1
0
Fork 0
Code Releases Activity

storage/flash_map: Add option to use MBEDTLS for img integrity check.

Browse source 
Add option to use MBEDTLS library to perform the flash area
integrity check.

Signed-off-by: Yong Cong Sin <yongcong.sin@gmail.com>
This commit is contained in:
Yong Cong Sin 2021-10-02 12:52:03 +08:00 • committed by Christopher Friedt
commit 113c6f249e
5 changed files with 90 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
subsys/storage/flash_map/CMakeLists.txt
View file

@ -5,3 +5,7 @@ zephyr_sources_ifndef(CONFIG_FLASH_MAP_CUSTOM flash_map_default.c)
zephyr_sources_ifdef(CONFIG_FLASH_MAP_SHELL flash_map_shell.c)
zephyr_sources_ifdef(CONFIG_FLASH_PAGE_LAYOUT flash_map_layout.c)
zephyr_sources_ifdef(CONFIG_FLASH_AREA_CHECK_INTEGRITY flash_map_integrity.c)
if(CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS)
zephyr_library_link_libraries_ifdef(CONFIG_MBEDTLS mbedTLS)
endif()

26
subsys/storage/flash_map/Kconfig
View file

@ -30,10 +30,32 @@ config FLASH_MAP_CUSTOM
config FLASH_AREA_CHECK_INTEGRITY
bool "Enable flash check functions"
select TINYCRYPT
select TINYCRYPT_SHA256
help
If enabled, there will be available the backend to check flash
integrity using SHA-256 verification algorithm.
if FLASH_AREA_CHECK_INTEGRITY
choice
prompt "Crypto backend for the flash check functions"
default FLASH_AREA_CHECK_INTEGRITY_TC
config FLASH_AREA_CHECK_INTEGRITY_TC
bool "Use TinyCrypt"
select TINYCRYPT
select TINYCRYPT_SHA256
help
Use TinyCrypt library to perform the integrity check.
config FLASH_AREA_CHECK_INTEGRITY_MBEDTLS
bool "Use MBEDTLS"
select MBEDTLS
select MBEDTLS_MD
select MBEDTLS_MAC_SHA256_ENABLED
select MBEDTLS_ENABLE_HEAP
help
Use MBEDTLS library to perform the integrity check.
endchoice
endif
endif

60
subsys/storage/flash_map/flash_map_integrity.c
View file

@ -17,15 +17,27 @@
#include <soc.h>
#include <init.h>
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY)
#define SHA256_DIGEST_SIZE 32
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
#include <tinycrypt/constants.h>
#include <tinycrypt/sha256.h>
#else
#include <mbedtls/md.h>
#endif
#include <string.h>
#endif /* CONFIG_FLASH_AREA_CHECK_INTEGRITY */
int flash_area_check_int_sha256(const struct flash_area *fa,
const struct flash_area_check *fac)
{
unsigned char hash[TC_SHA256_DIGEST_SIZE];
unsigned char hash[SHA256_DIGEST_SIZE];
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
struct tc_sha256_state_struct sha;
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
mbedtls_md_context_t mbed_hash_ctx;
const mbedtls_md_info_t *mbed_hash_info;
#endif
const struct device *dev;
int to_read;
int pos;
@ -40,9 +52,24 @@ int flash_area_check_int_sha256(const struct flash_area *fa,
return -EINVAL;
}
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
if (tc_sha256_init(&sha) != TC_CRYPTO_SUCCESS) {
return -ESRCH;
}
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
mbed_hash_info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
mbedtls_md_init(&mbed_hash_ctx);
if (mbedtls_md_setup(&mbed_hash_ctx, mbed_hash_info, 0) != 0) {
return -ESRCH;
}
if (mbedtls_md_starts(&mbed_hash_ctx)) {
rc = -ESRCH;
goto error;
}
#endif
dev = device_get_binding(fa->fa_dev_name);
to_read = fac->rblen;
@ -55,23 +82,50 @@ int flash_area_check_int_sha256(const struct flash_area *fa,
rc = flash_read(dev, (fa->fa_off + fac->off + pos),
fac->rbuf, to_read);
if (rc != 0) {
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
return rc;
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
goto error;
#endif
}
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
if (tc_sha256_update(&sha,
fac->rbuf,
to_read) != TC_CRYPTO_SUCCESS) {
return -ESRCH;
}
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
if (mbedtls_md_update(&mbed_hash_ctx, fac->rbuf, to_read) != 0) {
rc = -ESRCH;
goto error;
}
#endif
}
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
if (tc_sha256_final(hash, &sha) != TC_CRYPTO_SUCCESS) {
return -ESRCH;
}
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
if (mbedtls_md_finish(&mbed_hash_ctx, hash) != 0) {
rc = -ESRCH;
goto error;
}
#endif
if (memcmp(hash, fac->match, TC_SHA256_DIGEST_SIZE)) {
if (memcmp(hash, fac->match, SHA256_DIGEST_SIZE)) {
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_TC)
return -EILSEQ;
#else /* CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS */
rc = -EILSEQ;
goto error;
#endif
}
return 0;
#if defined(CONFIG_FLASH_AREA_CHECK_INTEGRITY_MBEDTLS)
error:
mbedtls_md_free(&mbed_hash_ctx);
#endif
return rc;
}