Boot: Add TLV iterator API

Add TLV iterator API to MCUBoot as part of a partial synchronization
with the mainstream MCUBoot repository. The hash of the source commit:
61fd888a7f4d741714553f36839dd49fb0065731.

Change-Id: I817b199f4923433010253c4a201ada250f743aa8
Signed-off-by: David Vincze <david.vincze@arm.com>
diff --git a/bl2/ext/mcuboot/CMakeLists.txt b/bl2/ext/mcuboot/CMakeLists.txt
index 49f3656..8d7aa35 100644
--- a/bl2/ext/mcuboot/CMakeLists.txt
+++ b/bl2/ext/mcuboot/CMakeLists.txt
@@ -79,6 +79,7 @@
 		"${MCUBOOT_DIR}/bootutil/src/bootutil_misc.c"
 		"${MCUBOOT_DIR}/bootutil/src/image_validate.c"
 		"${MCUBOOT_DIR}/bootutil/src/image_rsa.c"
+		"${MCUBOOT_DIR}/bootutil/src/tlv.c"
 		"${TFM_ROOT_DIR}/bl2/src/flash_map.c"
 		"${TFM_ROOT_DIR}/bl2/src/boot_record.c"
 		"${TFM_ROOT_DIR}/bl2/src/security_cnt.c"
diff --git a/bl2/ext/mcuboot/bootutil/include/bootutil/image.h b/bl2/ext/mcuboot/bootutil/include/bootutil/image.h
index 45b7797..f79c77b 100644
--- a/bl2/ext/mcuboot/bootutil/include/bootutil/image.h
+++ b/bl2/ext/mcuboot/bootutil/include/bootutil/image.h
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
@@ -28,6 +28,7 @@
 #define H_IMAGE_
 
 #include <inttypes.h>
+#include <stdbool.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -72,6 +73,7 @@
 #define IMAGE_TLV_DEPENDENCY        0x40   /* Image depends on other image */
 #define IMAGE_TLV_SEC_CNT           0x50   /* security counter */
 #define IMAGE_TLV_BOOT_RECORD       0x60   /* measured boot record */
+#define IMAGE_TLV_ANY               0xff   /* Used to iterate over all TLV */
 
 #define IMAGE_VER_MAJOR_LENGTH      8
 #define IMAGE_VER_MINOR_LENGTH      8
@@ -129,11 +131,27 @@
                           uint8_t *tmp_buf, uint32_t tmp_buf_sz,
                           uint8_t *seed, int seed_len, uint8_t *out_hash);
 
+struct image_tlv_iter {
+    const struct image_header *hdr;
+    const struct flash_area *fap;
+    uint8_t type;
+    bool prot;
+    uint32_t prot_len;
+    uint32_t tlv_off;
+    uint32_t tlv_end;
+};
+
+int bootutil_tlv_iter_begin(struct image_tlv_iter *it,
+                            const struct image_header *hdr,
+                            const struct flash_area *fap, uint8_t type,
+                            bool prot);
+int bootutil_tlv_iter_next(struct image_tlv_iter *it, uint32_t *off,
+                           uint16_t *len, uint8_t *type);
+
 int32_t bootutil_get_img_security_cnt(struct image_header *hdr,
                                       const struct flash_area *fap,
                                       uint32_t *security_cnt);
 
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/bl2/ext/mcuboot/bootutil/include/bootutil/sha256.h b/bl2/ext/mcuboot/bootutil/include/bootutil/sha256.h
index 8c3c23a..f903c46 100644
--- a/bl2/ext/mcuboot/bootutil/include/bootutil/sha256.h
+++ b/bl2/ext/mcuboot/bootutil/include/bootutil/sha256.h
@@ -27,7 +27,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/bootutil/src/bootutil_misc.c b/bl2/ext/mcuboot/bootutil/src/bootutil_misc.c
index eec7e5e..870420e 100644
--- a/bl2/ext/mcuboot/bootutil/src/bootutil_misc.c
+++ b/bl2/ext/mcuboot/bootutil/src/bootutil_misc.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/bootutil/src/bootutil_priv.h b/bl2/ext/mcuboot/bootutil/src/bootutil_priv.h
index 20d61b7..72efd1b 100644
--- a/bl2/ext/mcuboot/bootutil/src/bootutil_priv.h
+++ b/bl2/ext/mcuboot/bootutil/src/bootutil_priv.h
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/bootutil/src/image_rsa.c b/bl2/ext/mcuboot/bootutil/src/image_rsa.c
index 08ef6f5..0a05a6a 100644
--- a/bl2/ext/mcuboot/bootutil/src/image_rsa.c
+++ b/bl2/ext/mcuboot/bootutil/src/image_rsa.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/bootutil/src/image_validate.c b/bl2/ext/mcuboot/bootutil/src/image_validate.c
index 841f183..8c554ee 100644
--- a/bl2/ext/mcuboot/bootutil/src/image_validate.c
+++ b/bl2/ext/mcuboot/bootutil/src/image_validate.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
@@ -276,7 +276,8 @@
                       int seed_len, uint8_t *out_hash)
 {
     uint32_t off;
-    uint32_t end;
+    uint16_t len;
+    uint8_t type;
     int sha256_valid = 0;
 #ifdef EXPECTED_SIG_TLV
     int valid_signature = 0;
@@ -286,7 +287,7 @@
     uint8_t key_buf[SIG_BUF_SIZE + 24];
 #endif
 #endif
-    struct image_tlv tlv;
+    struct image_tlv_iter it;
     uint8_t buf[SIG_BUF_SIZE];
     uint8_t hash[32] = {0};
     uint32_t security_cnt;
@@ -304,7 +305,7 @@
         memcpy(out_hash, hash, 32);
     }
 
-    rc = boot_find_tlv_offs(hdr, fap, &off, &end);
+    rc = bootutil_tlv_iter_begin(&it, hdr, fap, IMAGE_TLV_ANY, false);
     if (rc) {
         return rc;
     }
@@ -313,22 +314,23 @@
      * Traverse through all of the TLVs, performing any checks we know
      * and are able to do.
      */
-    while (off < end) {
-        rc = LOAD_IMAGE_DATA(hdr, fap, off, &tlv, sizeof(tlv));
-        if (rc) {
-            return rc;
+    while (true) {
+        rc = bootutil_tlv_iter_next(&it, &off, &len, &type);
+        if (rc < 0) {
+            return -1;
+        } else if (rc > 0) {
+            break;
         }
 
-        if (tlv.it_type == IMAGE_TLV_SHA256) {
+        if (type == IMAGE_TLV_SHA256) {
             /*
              * Verify the SHA256 image hash.  This must always be
              * present.
              */
-            if (tlv.it_len != sizeof(hash)) {
+            if (len != sizeof(hash)) {
                 return -1;
             }
-            rc = LOAD_IMAGE_DATA(hdr, fap, off + sizeof(tlv),
-                                 buf, sizeof(hash));
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, buf, sizeof(hash));
             if (rc) {
                 return rc;
             }
@@ -339,72 +341,70 @@
             sha256_valid = 1;
 #ifdef EXPECTED_SIG_TLV
 #ifndef MCUBOOT_HW_KEY
-        } else if (tlv.it_type == IMAGE_TLV_KEYHASH) {
+        } else if (type == IMAGE_TLV_KEYHASH) {
             /*
              * Determine which key we should be checking.
              */
-            if (tlv.it_len > 32) {
+            if (len > 32) {
                 return -1;
             }
-            rc = LOAD_IMAGE_DATA(hdr, fap, off + sizeof(tlv), buf, tlv.it_len);
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, buf, len);
             if (rc) {
                 return rc;
             }
-            key_id = bootutil_find_key(buf, tlv.it_len);
+            key_id = bootutil_find_key(buf, len);
             /*
              * The key may not be found, which is acceptable.  There
              * can be multiple signatures, each preceded by a key.
              */
 #else /* MCUBOOT_HW_KEY */
-        } else if (tlv.it_type == IMAGE_TLV_KEY) {
+        } else if (type == IMAGE_TLV_KEY) {
             /*
              * Determine which key we should be checking.
              */
-            if (tlv.it_len > sizeof(key_buf)) {
+            if (len > sizeof(key_buf)) {
                 return -1;
             }
-            rc = LOAD_IMAGE_DATA(hdr, fap, off + sizeof(tlv),
-                                 key_buf, tlv.it_len);
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, key_buf, len);
             if (rc) {
                 return rc;
             }
-            key_id = bootutil_find_key(image_index, key_buf, tlv.it_len);
+            key_id = bootutil_find_key(image_index, key_buf, len);
             /*
              * The key may not be found, which is acceptable.  There
              * can be multiple signatures, each preceded by a key.
              */
 #endif /* MCUBOOT_HW_KEY */
-        } else if (tlv.it_type == EXPECTED_SIG_TLV) {
+        } else if (type == EXPECTED_SIG_TLV) {
             /* Ignore this signature if it is out of bounds. */
-            if (key_id >= 0 && key_id < bootutil_key_cnt) {
-                if (!EXPECTED_SIG_LEN(tlv.it_len) || tlv.it_len > sizeof(buf)) {
-                    return -1;
-                }
-                rc = LOAD_IMAGE_DATA(hdr, fap, off + sizeof(tlv),
-                                     buf, tlv.it_len);
-                if (rc) {
-                    return -1;
-                }
-                rc = bootutil_verify_sig(hash, sizeof(hash), buf, tlv.it_len,
-                                         key_id);
-                if (rc == 0) {
-                    valid_signature = 1;
-                }
+            if (key_id < 0 || key_id >= bootutil_key_cnt) {
+                key_id = -1;
+                continue;
+            }
+            if (!EXPECTED_SIG_LEN(len) || len > sizeof(buf)) {
+                return -1;
+            }
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, buf, len);
+            if (rc) {
+                return -1;
+            }
+            rc = bootutil_verify_sig(hash, sizeof(hash), buf, len, key_id);
+            if (rc == 0) {
+                valid_signature = 1;
             }
             key_id = -1;
 #endif
-        } else if (tlv.it_type == IMAGE_TLV_SEC_CNT) {
+        } else if (type == IMAGE_TLV_SEC_CNT) {
             /*
              * Verify the image's security counter.
              * This must always be present.
              */
-            if (tlv.it_len != sizeof(img_security_cnt)) {
+            if (len != sizeof(img_security_cnt)) {
                 /* Security counter is not valid. */
                 return -1;
             }
 
-            rc = LOAD_IMAGE_DATA(hdr, fap, off + sizeof(tlv),
-                                 &img_security_cnt, tlv.it_len);
+            rc = LOAD_IMAGE_DATA(hdr, fap, off, &img_security_cnt, len);
             if (rc) {
                 return rc;
             }
@@ -425,14 +425,6 @@
             /* The image's security counter has been successfully verified. */
             security_counter_valid = 1;
         }
-
-        /* Avoid integer overflow. */
-        if (boot_add_uint32_overflow_check(off, (sizeof(tlv) + tlv.it_len))) {
-            /* Potential overflow. */
-            break;
-        } else {
-            off += sizeof(tlv) + tlv.it_len;
-        }
     }
 
     if (!sha256_valid || !security_counter_valid) {
diff --git a/bl2/ext/mcuboot/bootutil/src/loader.c b/bl2/ext/mcuboot/bootutil/src/loader.c
index d5514cd..9b5b935 100644
--- a/bl2/ext/mcuboot/bootutil/src/loader.c
+++ b/bl2/ext/mcuboot/bootutil/src/loader.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
@@ -580,6 +580,7 @@
 boot_read_image_size(struct boot_loader_state *state, int slot, uint32_t *size)
 {
     const struct flash_area *fap = NULL;
+    struct image_tlv_info info;
     uint32_t off;
     int area_id;
     int rc;
@@ -595,10 +596,19 @@
         goto done;
     }
 
-    rc = boot_find_tlv_offs(boot_img_hdr(state, slot), fap, &off, size);
-    if (rc != 0) {
+    off = BOOT_TLV_OFF(boot_img_hdr(state, slot));
+
+    if (flash_area_read(fap, off, &info, sizeof(info))) {
+        rc = BOOT_EFLASH;
         goto done;
     }
+
+    if (info.it_magic != IMAGE_TLV_INFO_MAGIC) {
+        rc = BOOT_EBADIMAGE;
+        goto done;
+    }
+
+    *size = off + info.it_tlv_tot;
     rc = 0;
 
 done:
@@ -1779,11 +1789,10 @@
 boot_verify_slot_dependencies(struct boot_loader_state *state, uint32_t slot)
 {
     const struct flash_area *fap;
-    struct image_tlv tlv;
+    struct image_tlv_iter it;
     struct image_dependency dep;
     uint32_t off;
-    uint32_t end;
-    bool dep_tlvs_found = false;
+    uint16_t len;
     int area_id;
     int rc;
 
@@ -1794,62 +1803,42 @@
         goto done;
     }
 
-    rc = boot_find_tlv_offs(boot_img_hdr(state, slot), fap, &off, &end);
+    rc = bootutil_tlv_iter_begin(&it, boot_img_hdr(state, slot), fap,
+            IMAGE_TLV_DEPENDENCY, true);
     if (rc != 0) {
         goto done;
     }
 
-    /* Traverse through all of the TLVs to find the dependency TLVs. */
-    while(off < end) {
-        rc = flash_area_read(fap, off, &tlv, sizeof(tlv));
-        if (rc != 0) {
-             rc = BOOT_EFLASH;
-             goto done;
-         }
-
-        if (tlv.it_type == IMAGE_TLV_DEPENDENCY) {
-            dep_tlvs_found = true;
-
-            if (tlv.it_len != sizeof(dep)) {
-                rc = BOOT_EBADIMAGE;
-                goto done;
-            }
-
-            rc = flash_area_read(fap, off + sizeof(tlv), &dep, tlv.it_len);
-            if (rc != 0) {
-                rc = BOOT_EFLASH;
-                goto done;
-            }
-
-            if (dep.image_id >= BOOT_IMAGE_NUMBER) {
-                rc = BOOT_EBADARGS;
-                goto done;
-            }
-
-            /* Verify dependency and modify the swap type if not satisfied. */
-            rc = boot_verify_slot_dependency(state, &dep);
-            if (rc != 0) {
-                /* Dependency not satisfied. */
-                goto done;
-            }
-
-            /* Dependency satisfied, no action needed.
-             * Continue with the next TLV entry.
-             */
-        } else if (dep_tlvs_found) {
-            /* The dependency TLVs are contiguous in the TLV area. If a
-             * dependency had already been found and the last read TLV
-             * has a different type then there are no more dependency TLVs.
-             * The search can be finished.
-             */
+    while (true) {
+        rc = bootutil_tlv_iter_next(&it, &off, &len, NULL);
+        if (rc < 0) {
+            return -1;
+        } else if (rc > 0) {
+            rc = 0;
             break;
         }
-        /* Avoid integer overflow. */
-        if (boot_add_uint32_overflow_check(off, (sizeof(tlv) + tlv.it_len))) {
-            /* Potential overflow. */
-            return BOOT_EBADIMAGE;
-        } else {
-            off += sizeof(tlv) + tlv.it_len;
+
+        if (len != sizeof(dep)) {
+            rc = BOOT_EBADIMAGE;
+            goto done;
+        }
+
+        rc = flash_area_read(fap, off, &dep, len);
+        if (rc != 0) {
+            rc = BOOT_EFLASH;
+            goto done;
+        }
+
+        if (dep.image_id >= BOOT_IMAGE_NUMBER) {
+            rc = BOOT_EBADARGS;
+            goto done;
+        }
+
+        /* Verify dependency and modify the swap type if not satisfied. */
+        rc = boot_verify_slot_dependency(state, &dep);
+        if (rc != 0) {
+            /* Dependency not satisfied. */
+            goto done;
         }
     }
 
diff --git a/bl2/ext/mcuboot/bootutil/src/tlv.c b/bl2/ext/mcuboot/bootutil/src/tlv.c
new file mode 100644
index 0000000..5d3d32c
--- /dev/null
+++ b/bl2/ext/mcuboot/bootutil/src/tlv.c
@@ -0,0 +1,115 @@
+/*
+ * Copyright (c) 2019 JUUL Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <string.h>
+
+#include "bootutil/bootutil.h"
+#include "bootutil/image.h"
+#include "bootutil_priv.h"
+
+/*
+ * Initialize a TLV iterator.
+ *
+ * @param it An iterator struct
+ * @param hdr image_header of the slot's image
+ * @param fap flash_area of the slot which is storing the image
+ * @param type Type of TLV to look for
+ * @param prot true if TLV has to be stored in the protected area, false otherwise
+ *
+ * @returns 0 if the TLV iterator was succesfully started
+ *          -1 on errors
+ */
+int
+bootutil_tlv_iter_begin(struct image_tlv_iter *it, const struct image_header *hdr,
+                        const struct flash_area *fap, uint8_t type, bool prot)
+{
+    uint32_t off_;
+    struct image_tlv_info info;
+
+    if (it == NULL || hdr == NULL || fap == NULL) {
+        return -1;
+    }
+
+    off_ = BOOT_TLV_OFF(hdr);
+    if (LOAD_IMAGE_DATA(hdr, fap, off_, &info, sizeof(info))) {
+        return -1;
+    }
+
+    if (info.it_magic != IMAGE_TLV_INFO_MAGIC) {
+        return -1;
+    }
+
+    it->hdr = hdr;
+    it->fap = fap;
+    it->type = type;
+    it->prot = prot;
+    off_ += sizeof(info);
+    it->tlv_off = off_;
+    it->prot_len = off_ + it->hdr->ih_protect_tlv_size;
+    it->tlv_end = off_ + info.it_tlv_tot;
+    return 0;
+}
+
+/*
+ * Find next TLV
+ *
+ * @param it The image TLV iterator struct
+ * @param off The offset of the TLV's payload in flash
+ * @param len The length of the TLV's payload
+ * @param type If not NULL returns the type of TLV found
+ *
+ * @returns 0 if a TLV with with matching type was found
+ *          1 if no more TLVs with matching type are available
+ *          -1 on errors
+ */
+int
+bootutil_tlv_iter_next(struct image_tlv_iter *it, uint32_t *off, uint16_t *len,
+                       uint8_t *type)
+{
+    struct image_tlv tlv;
+    int rc;
+
+    if (it == NULL || it->hdr == NULL || it->fap == NULL) {
+        return -1;
+    }
+
+    while (it->tlv_off < it->tlv_end) {
+        rc = LOAD_IMAGE_DATA(it->hdr, it->fap, it->tlv_off, &tlv, sizeof tlv);
+        if (rc) {
+            return -1;
+        }
+
+        /* No more TLVs in the protected area */
+        if (it->prot && it->tlv_off >= it->prot_len) {
+            return 1;
+        }
+
+        if (it->type == IMAGE_TLV_ANY || tlv.it_type == it->type) {
+            if (type != NULL) {
+                *type = tlv.it_type;
+            }
+            *off = it->tlv_off + sizeof(tlv);
+            *len = tlv.it_len;
+            it->tlv_off += sizeof(tlv) + tlv.it_len;
+            return 0;
+        }
+
+        it->tlv_off += sizeof(tlv) + tlv.it_len;
+    }
+
+    return 1;
+}
diff --git a/bl2/ext/mcuboot/flash_map_extended.c b/bl2/ext/mcuboot/flash_map_extended.c
index d00686e..aa56d8b 100644
--- a/bl2/ext/mcuboot/flash_map_extended.c
+++ b/bl2/ext/mcuboot/flash_map_extended.c
@@ -9,7 +9,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  */
 
 #include <errno.h>
diff --git a/bl2/ext/mcuboot/flash_map_legacy.c b/bl2/ext/mcuboot/flash_map_legacy.c
index 34b6b54..bbf800e 100644
--- a/bl2/ext/mcuboot/flash_map_legacy.c
+++ b/bl2/ext/mcuboot/flash_map_legacy.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/include/config-rsa.h b/bl2/ext/mcuboot/include/config-rsa.h
index 33a356b..934ab24 100644
--- a/bl2/ext/mcuboot/include/config-rsa.h
+++ b/bl2/ext/mcuboot/include/config-rsa.h
@@ -24,7 +24,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  */
 
 /*
diff --git a/bl2/ext/mcuboot/include/flash_map/flash_map.h b/bl2/ext/mcuboot/include/flash_map/flash_map.h
index df8c6dd..16b516d 100644
--- a/bl2/ext/mcuboot/include/flash_map/flash_map.h
+++ b/bl2/ext/mcuboot/include/flash_map/flash_map.h
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2018-2019 Arm Limited.
  */
 
diff --git a/bl2/ext/mcuboot/include/target.h b/bl2/ext/mcuboot/include/target.h
index 69f691a..a82ed27 100644
--- a/bl2/ext/mcuboot/include/target.h
+++ b/bl2/ext/mcuboot/include/target.h
@@ -8,7 +8,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  */
 
 #ifndef H_TARGETS_TARGET_
diff --git a/bl2/ext/mcuboot/keys.c b/bl2/ext/mcuboot/keys.c
index f8e500a..6d6ec6a 100644
--- a/bl2/ext/mcuboot/keys.c
+++ b/bl2/ext/mcuboot/keys.c
@@ -20,7 +20,7 @@
 /*
  * Original code taken from mcuboot project at:
  * https://github.com/JuulLabs-OSS/mcuboot
- * Git SHA of the original version: 4f0ea747c314547daa6b6299ccbd77ae4dee6758
+ * Git SHA of the original version: 61fd888a7f4d741714553f36839dd49fb0065731
  * Modifications are Copyright (c) 2019 Arm Limited.
  */