Separate fih

boot/boot_serial/include/boot_serial/boot_serial_encryption.h

@@ -6,7 +6,7 @@
 
 #ifndef H_BOOT_SERIAL_ENCRYPTION_
 #define H_BOOT_SERIAL_ENCRYPTION_
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 /**
  * Validate hash of a primary boot image doing on the fly decryption as well

boot/boot_serial/src/boot_serial_encryption.c

@@ -14,7 +14,7 @@
 #include <../src/bootutil_priv.h>
 #include "bootutil/bootutil_log.h"
 #include "bootutil/bootutil_public.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 BOOT_LOG_MODULE_REGISTER(serial_encryption);
 

boot/bootutil/CMakeLists.txt

@@ -10,6 +10,7 @@ add_library(bootutil STATIC)
 target_include_directories(bootutil
     PUBLIC
         include
+        ../fault_injection_hardening/include
     PRIVATE
         src
 )
@@ -26,7 +27,7 @@ target_sources(bootutil
         src/bootutil_public.c
         src/caps.c
         src/encrypted.c
-        src/fault_injection_hardening.c
+        ../fault_injection_hardening/src/fault_injection_hardening.c
         src/image_ecdsa.c
         src/image_ed25519.c
         src/image_rsa.c

boot/bootutil/include/bootutil/boot_hooks.h

@@ -35,7 +35,7 @@
 #define H_BOOTUTIL_HOOKS
 
 #include "bootutil/bootutil.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #define DO_HOOK_CALL(f, ret_default, ...) \
     f(__VA_ARGS__)

boot/bootutil/include/bootutil/bootutil.h

@@ -30,7 +30,7 @@
 
 #include <inttypes.h>
 #include <stddef.h>
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/bootutil_public.h"
 
 #ifdef __cplusplus

boot/bootutil/include/bootutil/image.h

@@ -30,7 +30,7 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #ifdef __cplusplus
 extern "C" {

boot/bootutil/include/bootutil/mcuboot_uuid.h

@@ -17,7 +17,7 @@
  */
 
 #include <stdint.h>
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #ifdef __cplusplus
 extern "C" {

boot/bootutil/include/bootutil/security_cnt.h

@@ -26,7 +26,7 @@
  */
 
 #include <stdint.h>
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #ifdef __cplusplus
 extern "C" {

boot/bootutil/include/fih_config.h

@@ -0,0 +1,32 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * (c) 2026, Infineon Technologies AG, or an affiliate of Infineon
+ * Technologies AG. All rights reserved.
+ */
+
+#ifndef __FIH_CONFIG_H__
+#define __FIH_CONFIG_H__
+
+/*
+ * MCUboot-specific configuration adapter for the fault_injection_hardening
+ * library.  This file maps the MCUBOOT_FIH_PROFILE_* build options to the
+ * generic FIH_PROFILE_* macros consumed by fault_injection_hardening.h.
+ */
+
+#include "mcuboot_config/mcuboot_config.h"
+
+#if defined(MCUBOOT_FIH_PROFILE_HIGH)
+#  define FIH_PROFILE_HIGH
+#elif defined(MCUBOOT_FIH_PROFILE_MEDIUM)
+#  define FIH_PROFILE_MEDIUM
+#elif defined(MCUBOOT_FIH_PROFILE_LOW)
+#  define FIH_PROFILE_LOW
+#elif defined(MCUBOOT_FIH_PROFILE_OFF)
+#  define FIH_PROFILE_OFF
+#else
+/* Default: fault injection hardening disabled */
+#  define FIH_PROFILE_OFF
+#endif
+
+#endif /* __FIH_CONFIG_H__ */

boot/bootutil/src/bootutil_find_key.c

@@ -29,7 +29,7 @@
 #include <stdint.h>
 
 #include "bootutil/crypto/sha.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/image.h"
 #include "bootutil/sign_key.h"
 #include "bootutil_priv.h"

boot/bootutil/src/bootutil_loader.h

@@ -33,7 +33,7 @@
 #include <flash_map_backend/flash_map_backend.h>
 
 #include "bootutil/image.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/bootutil.h"
 #include "bootutil_priv.h"
 

boot/bootutil/src/bootutil_misc.c

@@ -38,7 +38,7 @@
 #include "bootutil_priv.h"
 #include "bootutil_misc.h"
 #include "bootutil/bootutil_log.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #ifdef MCUBOOT_ENC_IMAGES
 #include "bootutil/enc_key.h"
 #endif

boot/bootutil/src/bootutil_priv.h

@@ -36,7 +36,7 @@
 
 #include "bootutil/bootutil.h"
 #include "bootutil/image.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil_area.h"
 #include "mcuboot_config/mcuboot_config.h"
 

boot/bootutil/src/fault_injection_hardening_delay_rng_mbedtls.c

@@ -4,7 +4,7 @@
  * Copyright (c) 2020 Arm Limited
  */
 
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #ifdef FIH_ENABLE_DELAY
 

boot/bootutil/src/fault_injection_hardening_delay_rng_psa.c

@@ -15,7 +15,7 @@
  * is the stable, backend-independent replacement.
  */
 
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #ifdef FIH_ENABLE_DELAY
 

boot/bootutil/src/image_ecdsa.c

@@ -35,7 +35,7 @@ BOOT_LOG_MODULE_DECLARE(mcuboot);
 #if defined(MCUBOOT_SIGN_EC256) || defined(MCUBOOT_SIGN_EC384)
 
 #include "bootutil_priv.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/crypto/ecdsa.h"
 
 #if !defined(MCUBOOT_BUILTIN_KEY)

boot/bootutil/src/image_rsa.c

@@ -35,7 +35,7 @@ BOOT_LOG_MODULE_DECLARE(mcuboot);
 #ifdef MCUBOOT_SIGN_RSA
 #include "bootutil_priv.h"
 #include "bootutil/sign_key.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #define BOOTUTIL_CRYPTO_RSA_SIGN_ENABLED
 #include "bootutil/crypto/rsa.h"

boot/bootutil/src/image_validate.c

@@ -40,7 +40,7 @@
 #include "bootutil/crypto/sha.h"
 #include "bootutil/sign_key.h"
 #include "bootutil/security_cnt.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #include "mcuboot_config/mcuboot_config.h"
 #include "bootutil/bootutil_log.h"

boot/bootutil/src/loader.c

@@ -45,7 +45,7 @@
 #include "bootutil/bootutil_log.h"
 #include "bootutil/security_cnt.h"
 #include "bootutil/boot_record.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/ramload.h"
 #include "bootutil/boot_hooks.h"
 #include "bootutil/mcuboot_status.h"

boot/bootutil/src/ram_load.c

@@ -31,7 +31,7 @@
 #include "bootutil/bootutil_public.h"
 #include "bootutil/image.h"
 #include "bootutil_priv.h"
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 #include "bootutil/ramload.h"
 #include "bootutil/mcuboot_status.h"
 

boot/cypress/MCUBootApp/MCUBootApp.mk

@@ -84,6 +84,7 @@ SOURCES_APP += $(SOURCES_APP_SRC)
 SOURCES_APP += $(SOURCES_FLASH_PORT)
 
 INCLUDE_DIRS_MCUBOOT := $(addprefix -I, $(CURDIR)/../bootutil/include)
+INCLUDE_DIRS_MCUBOOT += $(addprefix -I, $(CURDIR)/../fault_injection_hardening/include)
 INCLUDE_DIRS_MCUBOOT += $(addprefix -I, $(CURDIR)/../bootutil/src)
 INCLUDE_DIRS_MCUBOOT += $(addprefix -I, $(CURDIR)/..)
 

boot/cypress/MCUBootApp/main.c

@@ -36,7 +36,7 @@
 
 #include "bootutil/bootutil_log.h"
 
-#include "bootutil/fault_injection_hardening.h"
+#include "fault_injection_hardening.h"
 
 #include "watchdog.h"
 

boot/espressif/CMakeLists.txt

@@ -185,6 +185,7 @@ set(ZCBOR_DIR ${MCUBOOT_ROOT_DIR}/boot/zcbor)
 
 list(APPEND inc_directories
     ${BOOTUTIL_DIR}/include
+    ${MCUBOOT_ROOT_DIR}/boot/fault_injection_hardening/include
     ${BOOTUTIL_DIR}/src
     ${ESPRESSIF_PORT_DIR}/include
     )
@@ -206,7 +207,7 @@ set(bootutil_srcs
     ${BOOTUTIL_DIR}/src/bootutil_public.c
     ${BOOTUTIL_DIR}/src/caps.c
     ${BOOTUTIL_DIR}/src/encrypted.c
-    ${BOOTUTIL_DIR}/src/fault_injection_hardening.c
+    ${MCUBOOT_ROOT_DIR}/boot/fault_injection_hardening/src/fault_injection_hardening.c
     ${BOOTUTIL_DIR}/src/fault_injection_hardening_delay_rng_mbedtls.c
     ${BOOTUTIL_DIR}/src/image_ecdsa.c
     ${BOOTUTIL_DIR}/src/image_ed25519.c

boot/espressif/main.c

@@ -6,7 +6,7 @@
 
 #include <bootutil/bootutil.h>
 #include <bootutil/bootutil_log.h>
-#include <bootutil/fault_injection_hardening.h>
+#include <fault_injection_hardening.h>
 #include <bootutil/image.h>
 
 #include "bootloader_init.h"

boot/espressif/port/esp_loader.c

@@ -7,7 +7,7 @@
 #include <string.h>
 
 #include <bootutil/bootutil_log.h>
-#include <bootutil/fault_injection_hardening.h>
+#include <fault_injection_hardening.h>
 
 #include "bootloader_memory_utils.h"
 #include "bootloader_flash_priv.h"

boot/fault_injection_hardening/.gitignore

@@ -0,0 +1,42 @@
+# Build artifacts
+*.o
+*.a
+*.so
+*.dylib
+*.dll
+*.exe
+*.elf
+*.bin
+*.hex
+*.map
+
+# CMake
+CMakeCache.txt
+CMakeFiles/
+cmake_install.cmake
+Makefile
+build/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+dist/
+build/
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Cargo/Rust (if used)
+target/
+Cargo.lock
+
+# Temporary files
+*.tmp
+*.bak

boot/fault_injection_hardening/CMakeLists.txt

@@ -0,0 +1,37 @@
+#
+# CMakeLists.txt for the Fault Injection Hardening library
+#
+# This is the top-level CMakeLists.txt for building the FIH library as a
+# standalone component. When used within MCUboot, the FIH sources are typically
+# integrated into the bootutil library. This file allows FIH to be built and
+# tested independently.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2020 Arm Limited
+#
+
+cmake_minimum_required(VERSION 3.12)
+project(fault_injection_hardening)
+
+# Add the FIH library
+add_library(fih STATIC
+    src/fault_injection_hardening.c
+)
+
+target_include_directories(fih
+    PUBLIC
+        include
+)
+
+# When used outside MCUboot, callers must provide fih_config.h on the include path
+# or in their project. The following demonstrates how to add it:
+#
+# target_include_directories(your_target PRIVATE path/to/your/fih_config.h)
+
+# Enable testing (optional)
+enable_testing()
+
+# Add tests if they exist
+if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/tests/CMakeLists.txt")
+    add_subdirectory(tests)
+endif()