[nrf noup] zephyr: firmware_loader bootconf

support for powerup protection mode

Signed-off-by: Mateusz Michalek <mateusz.michalek@nordicsemi.no>

Author: michalek-no

boot/zephyr/Kconfig

@@ -589,11 +589,21 @@ config NCS_MCUBOOT_DISABLE_SELF_RWX_SUPPORTED
 	default y if SOC_NRF54LM20A_CPUAPP || SOC_NRF54LM20B_CPUAPP
 	default y if SOC_NRF54LS05A_CPUAPP || SOC_NRF54LS05B_CPUAPP
 
+config NCS_MCUBOOT_BOOTCONF_LOCK_WRITES
+	bool "Use BOOTCONF-backed MCUboot write protection"
+	depends on NCS_MCUBOOT_DISABLE_SELF_RWX_SUPPORTED
+	select NCS_MCUBOOT_DISABLE_SELF_RWX
+	help
+	  MCUboot is protected using UICR BOOTCONF programmed by bootconf.hex.
+	  This option is enabled by sysbuild when
+	  SB_CONFIG_MCUBOOT_BOOTCONF_LOCK_WRITES is set.
+
 config NCS_MCUBOOT_DISABLE_SELF_RWX
 	bool "Disable read and execution on self NVM"
-	depends on NCS_MCUBOOT_DISABLE_SELF_RWX_SUPPORTED && !FPROTECT
+	depends on NCS_MCUBOOT_DISABLE_SELF_RWX_SUPPORTED
+	depends on !FPROTECT || NCS_MCUBOOT_BOOTCONF_LOCK_WRITES
 	help
-	  Sets RRAMC's region no.4 protection before jumping to application.
+	  Sets RRAMC region protection before jumping to application.
 	  It disables reads writes and execution memory area which holds MCUBOOT.
 
 config NCS_MCUBOOT_DISABLE_SELF_RWX_SKIP_SIZE

boot/zephyr/firmware_loader.c

@@ -20,13 +20,66 @@
 #ifdef CONFIG_NRF_MCUBOOT_BOOT_REQUEST
 #include <bootutil/boot_request.h>
 #endif /* CONFIG_NRF_MCUBOOT_BOOT_REQUEST */
+#if defined(CONFIG_FPROTECT) && defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+#include <fprotect.h>
+#endif
+
+#define IMAGE_TLV_INSTALLER_IMAGE 0xa0
 
 BOOT_LOG_MODULE_DECLARE(mcuboot);
 
 /* Variables passed outside of unit via poiters. */
 static const struct flash_area *_fa_p;
 static struct image_header _hdr = { 0 };
 
+#if defined(CONFIG_FPROTECT) && defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+static bool boot_image_is_installer(const struct flash_area *fa_p,
+                                    const struct image_header *hdr)
+{
+    struct image_tlv_iter it;
+    uint32_t off;
+    uint16_t len;
+    uint8_t installer = 0;
+    int rc;
+
+    if (hdr->ih_protect_tlv_size == 0) {
+        return false;
+    }
+
+    rc = bootutil_tlv_iter_begin(&it, hdr, fa_p, IMAGE_TLV_INSTALLER_IMAGE, true);
+    if (rc != 0) {
+        return false;
+    }
+
+    rc = bootutil_tlv_iter_next(&it, &off, &len, NULL);
+    if (rc != 0 || len != sizeof(installer)) {
+        return false;
+    }
+
+    rc = LOAD_IMAGE_DATA(hdr, fa_p, off, &installer, sizeof(installer));
+
+    return rc == 0 && installer == 1;
+}
+
+static int protect_firmware_loader(void)
+{
+    const struct flash_area *fa_p;
+    int rc;
+
+    rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY(0), &fa_p);
+    if (rc != 0) {
+        return rc;
+    }
+
+    rc = fprotect_area(flash_area_get_off(fa_p), flash_area_get_size(fa_p));
+    flash_area_close(fa_p);
+
+    return rc;
+}
+#else
+#define boot_image_is_installer(_fa_p, _hdr) false
+#endif
+
 #if defined(MCUBOOT_VALIDATE_PRIMARY_SLOT) || defined(MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE)
 /**
  * Validate hash of a primary boot image.
@@ -110,7 +163,7 @@ boot_image_validate_once(const struct flash_area *fa_p,
  *
  * @return		FIH_SUCCESS on success; non-zero on failure.
  */
-static fih_ret validate_image_slot(int slot, struct boot_rsp *rsp)
+static fih_ret validate_image_slot(int slot, struct boot_rsp *rsp, bool *is_installer)
 {
     int rc = -1;
     FIH_DECLARE(fih_rc, FIH_FAILURE);
@@ -142,6 +195,7 @@ static fih_ret validate_image_slot(int slot, struct boot_rsp *rsp)
     rsp->br_flash_dev_id = flash_area_get_device_id(_fa_p);
     rsp->br_image_off = flash_area_get_off(_fa_p);
     rsp->br_hdr = &_hdr;
+    *is_installer = boot_image_is_installer(_fa_p, &_hdr);
 
 other:
     flash_area_close(_fa_p);
@@ -163,6 +217,7 @@ fih_ret
 boot_go(struct boot_rsp *rsp)
 {
     bool boot_firmware_loader = false;
+    bool booting_installer = false;
     FIH_DECLARE(fih_rc, FIH_FAILURE);
 
     BOOT_LOG_DBG("boot_go: firmware loader");
@@ -194,18 +249,33 @@ boot_go(struct boot_rsp *rsp)
 
     /* Check if firmware loader button is pressed. TODO: check all entrance methods */
     if (boot_firmware_loader == true) {
-        FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_SECONDARY(0), rsp);
+        FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_SECONDARY(0), rsp,
+                 &booting_installer);
 
         if (FIH_EQ(fih_rc, FIH_SUCCESS)) {
+#if defined(CONFIG_FPROTECT) && defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+            if (protect_firmware_loader() != 0) {
+                FIH_RET(FIH_FAILURE);
+            }
+#endif
             FIH_RET(fih_rc);
         }
     }
 
-    FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_PRIMARY(0), rsp);
+    FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_PRIMARY(0), rsp,
+             &booting_installer);
 
 #ifdef CONFIG_BOOT_FIRMWARE_LOADER_NO_APPLICATION
     if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
-        FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_SECONDARY(0), rsp);
+        FIH_CALL(validate_image_slot, fih_rc, FLASH_AREA_IMAGE_SECONDARY(0), rsp,
+                 &booting_installer);
+    }
+#endif
+
+#if defined(CONFIG_FPROTECT) && defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+    if (FIH_EQ(fih_rc, FIH_SUCCESS) && !booting_installer &&
+        protect_firmware_loader() != 0) {
+        FIH_RET(FIH_FAILURE);
     }
 #endif
 

boot/zephyr/main.c

@@ -188,7 +188,12 @@ K_SEM_DEFINE(boot_log_sem, 1, 1);
 #define RRAMC_REGION_RWX_LSB 0
 #define RRAMC_REGION_RWX_WIDTH 3
 
+#if defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+#define RRAMC_REGION_NUMBER 3
+#else
 #define RRAMC_REGION_NUMBER 4
+#endif
+
 #define NRF_RRAM_REGION_SIZE_UNIT 0x400
 #define NRF_RRAM_REGION_ADDRESS_RESOLUTION 0x400
 
@@ -206,9 +211,11 @@ K_SEM_DEFINE(boot_log_sem, 1, 1);
 #define RRAMC_REGION_CONFIG_H (((uint32_t)(&(RRAMC_REGION_CONFIG))) >> 16)
 #define RRAMC_REGION_CONFIG_L (((uint32_t)(&(RRAMC_REGION_CONFIG))) & 0x0000fffful)
 
+#if !defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
 #define RRAMC_REGION_ADDRESS NRF_RRAMC->REGION[RRAMC_REGION_NUMBER].ADDRESS
 #define RRAMC_REGION_ADDRESS_H (((uint32_t)(&(RRAMC_REGION_ADDRESS))) >> 16)
 #define RRAMC_REGION_ADDRESS_L (((uint32_t)(&(RRAMC_REGION_ADDRESS))) & 0x0000fffful)
+#endif
 
 BUILD_ASSERT((PROTECTED_REGION_START % NRF_RRAM_REGION_ADDRESS_RESOLUTION) == 0,
 	"Start of protected region is not aligned - not possible to protect");
@@ -336,6 +343,23 @@ static void __ramfunc jump_in(struct arm_vector_table *vt)
 #endif /* CONFIG_MCUBOOT_CLEANUP_RAM */
 
 #ifdef CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX
+#if defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+                ".thumb_func\n"
+                "region_disable_rwx:\n"
+                "   movw r1, %6\n"
+                "   movt r1, %7\n"
+                "   ldr  r2, [r1]\n"
+                /* Size should be set by bootconf.hex at reset. */
+                "   ldr  r5, =%12\n"
+                "   ands r4, r2, r5\n"
+                "   cbnz r4, clear_rwx\n"
+                "   movt r2, %8\n"
+                "clear_rwx:\n"
+                "   bfc  r2, %9, %10\n"
+                "   orr  r2, %11\n"
+                "   str  r2, [r1]\n"
+                "   dsb\n"
+#else
                 ".thumb_func\n"
                 "region_disable_rwx:\n"
                 "   movw r1, %6\n"
@@ -364,6 +388,7 @@ static void __ramfunc jump_in(struct arm_vector_table *vt)
                 "   orr  r2, %11\n"
                 "   str  r2, [r1]\n"
                 "   dsb\n"
+#endif /* CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES */
                 /* Next assembly line is important for current function */
 
  #endif /* CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX */
@@ -383,12 +408,16 @@ static void __ramfunc jump_in(struct arm_vector_table *vt)
                   "i" ((PROTECTED_REGION_SIZE) / (NRF_RRAM_REGION_SIZE_UNIT)),
                   "i" (RRAMC_REGION_RWX_LSB),
                   "i" (RRAMC_REGION_RWX_WIDTH),
-                  "i" (RRAMC_REGION_CONFIG_LOCK_Msk),
-                  "i" (RRAMC_REGION_CONFIG_SIZE_Msk),
+                  "i" (RRAMC_REGION_CONFIG_LOCK_Msk)
+#if !defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
+                  , "i" (RRAMC_REGION_CONFIG_SIZE_Msk),
                   "i" (RRAMC_REGION_ADDRESS_L),
                   "i" (RRAMC_REGION_ADDRESS_H),
                   "i" (PROTECTED_REGION_START_L),
                   "i" (PROTECTED_REGION_START_H)
+#else
+                  , "i" (RRAMC_REGION_CONFIG_SIZE_Msk)
+#endif
 #endif /* CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX */
                 : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "memory"
         );
@@ -972,6 +1001,7 @@ int main(void)
     nrf_crypto_keys_housekeeping();
 
 #ifdef CONFIG_FPROTECT
+#if !defined(CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES)
 #ifdef CONFIG_SOC_SERIES_NRF54L
 #if defined(CONFIG_SOC_NRF54L15) || defined(CONFIG_SOC_NRF54L10) || defined(CONFIG_SOC_NRF54L05)
     BUILD_ASSERT(FPROTECT_REGION_SIZE <= (62 * 1024), "Can not FPROTECT region that big");
@@ -989,6 +1019,7 @@ int main(void)
         while (1)
             ;
     }
+#endif /* !CONFIG_NCS_MCUBOOT_BOOTCONF_LOCK_WRITES */
 
 /* Lock back PCD used for CPUNET application udapte */
 #if defined(CONFIG_SOC_NRF5340_CPUAPP) && CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER != -1 && \