This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
commit 90977d12d040280b60d9e2068655eb6ab2c6dce8 Author: Szymon Janc <[email protected]> AuthorDate: Thu Jun 11 14:04:58 2026 +0200 encflash: Add MbedTLS implementation This allows to use Mbed TLS AES for flash encryption. --- .../ef_mbedtls/include/ef_mbedtls/ef_mbedtls.h | 44 +++++++++++++ hw/drivers/flash/enc_flash/ef_mbedtls/pkg.yml | 32 +++++++++ .../flash/enc_flash/ef_mbedtls/src/ef_mbedtls.c | 76 ++++++++++++++++++++++ 3 files changed, 152 insertions(+) diff --git a/hw/drivers/flash/enc_flash/ef_mbedtls/include/ef_mbedtls/ef_mbedtls.h b/hw/drivers/flash/enc_flash/ef_mbedtls/include/ef_mbedtls/ef_mbedtls.h new file mode 100644 index 000000000..3a9824a3b --- /dev/null +++ b/hw/drivers/flash/enc_flash/ef_mbedtls/include/ef_mbedtls/ef_mbedtls.h @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +#ifndef __EF_MBEDTLS_H__ +#define __EF_MBEDTLS_H__ + +/* + * Encrypting flash driver using AES from Mbed TLS + */ +#include <enc_flash/enc_flash.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * MbedTLS specific version of the flash device. + */ +struct eflash_mbedtls_dev { + struct enc_flash_dev dev; + uint8_t key[ENC_FLASH_BLK]; +}; + +#ifdef __cplusplus +} +#endif + +#endif /* __EF_MBEDTLS_H__ */ diff --git a/hw/drivers/flash/enc_flash/ef_mbedtls/pkg.yml b/hw/drivers/flash/enc_flash/ef_mbedtls/pkg.yml new file mode 100644 index 000000000..b00a129ea --- /dev/null +++ b/hw/drivers/flash/enc_flash/ef_mbedtls/pkg.yml @@ -0,0 +1,32 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +pkg.name: hw/drivers/flash/enc_flash/ef_mbedtls +pkg.description: Encrypting flash driver using Mbed TLS AES. +pkg.author: "Apache Mynewt <[email protected]>" +pkg.homepage: "http://mynewt.apache.org/"; +pkg.keywords: + - security + - encrypt + - flash + +pkg.deps: + - "@apache-mynewt-core/hw/drivers/flash/enc_flash" + - "@apache-mynewt-core/crypto/mbedtls" + diff --git a/hw/drivers/flash/enc_flash/ef_mbedtls/src/ef_mbedtls.c b/hw/drivers/flash/enc_flash/ef_mbedtls/src/ef_mbedtls.c new file mode 100644 index 000000000..d52f8d1dd --- /dev/null +++ b/hw/drivers/flash/enc_flash/ef_mbedtls/src/ef_mbedtls.c @@ -0,0 +1,76 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +#include <assert.h> +#include <string.h> + +#include <os/mynewt.h> + +#include <mbedtls/aes.h> + +#include <enc_flash/enc_flash.h> +#include "ef_mbedtls/ef_mbedtls.h" + +#define EDEV_TO_MBED(dev) (struct eflash_mbedtls_dev *)(edev) +#define ENC_FLASH_NONCE "mynewtencfla" + +static void +ef_mbedtls_get_block(struct eflash_mbedtls_dev *dev, uint32_t addr, uint8_t *blk) +{ + mbedtls_aes_context ctx; + + mbedtls_aes_init(&ctx); + + memcpy(blk, ENC_FLASH_NONCE, 12); + memcpy(blk + 12, &addr, sizeof(addr)); + + mbedtls_aes_setkey_enc(&ctx, dev->key, 128); + mbedtls_aes_crypt_ecb(&ctx, MBEDTLS_AES_ENCRYPT, blk, blk); + mbedtls_aes_free(&ctx); +} + +void +enc_flash_crypt_arch(struct enc_flash_dev *edev, uint32_t blk_addr, + const uint8_t *src, uint8_t *tgt, int off, int cnt) +{ + struct eflash_mbedtls_dev *dev = EDEV_TO_MBED(edev); + uint8_t blk[ENC_FLASH_BLK]; + uint8_t *b; + int i; + + ef_mbedtls_get_block(dev, blk_addr, blk); + b = &blk[off]; + for (i = 0 ; i < cnt; i++) { + *tgt++ = *b++ ^ *src++; + } +} + +void +enc_flash_setkey_arch(struct enc_flash_dev *edev, uint8_t *key) +{ + struct eflash_mbedtls_dev *dev = EDEV_TO_MBED(edev); + + memcpy(dev->key, key, ENC_FLASH_BLK); +} + +int +enc_flash_init_arch(const struct eflash_mbedtls_dev *edev) +{ + return 0; +}
