From 928fa66272a0985c900c996912b54904c64d0520 Mon Sep 17 00:00:00 2001 From: Lionel Debieve Date: Thu, 6 Oct 2022 08:51:32 +0200 Subject: [PATCH] feat(stm32mp1-fdts): add CoT and fuse references for authentication Add the stm32mp1 CoT description file. Include the TRUSTED_BOARD_BOOT entry in the platform device tree file. Add the missing public root key reference for stm32mp15 and the encryption key reference for stm32mp13. Change-Id: I0ae2454979a3df6dd3e4361510317742e8fbc109 Signed-off-by: Lionel Debieve --- fdts/stm32mp1-cot-descriptors.dtsi | 156 +++++++++++++++++++++++++++++ fdts/stm32mp13-bl2.dtsi | 25 ++++- fdts/stm32mp131.dtsi | 3 + fdts/stm32mp15-bl2.dtsi | 27 ++++- fdts/stm32mp151.dtsi | 3 + 5 files changed, 212 insertions(+), 2 deletions(-) create mode 100644 fdts/stm32mp1-cot-descriptors.dtsi diff --git a/fdts/stm32mp1-cot-descriptors.dtsi b/fdts/stm32mp1-cot-descriptors.dtsi new file mode 100644 index 000000000..eb632ffa8 --- /dev/null +++ b/fdts/stm32mp1-cot-descriptors.dtsi @@ -0,0 +1,156 @@ +/* + * Copyright (c) 2020-2022, ARM Limited. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include +#include +#include + +cot { + manifests { + compatible = "arm, cert-descs"; + + stm32mp_cfg_cert: stm32mp_cfg_cert { + root-certificate; + image-id = ; + antirollback-counter = <&trusted_nv_counter>; + + hw_config_hash: hw_config_hash { + oid = HW_CONFIG_HASH_OID; + }; + + fw_config_hash: fw_config_hash { + oid = FW_CONFIG_HASH_OID; + }; + }; + + trusted_key_cert: trusted_key_cert { + root-certificate; + image-id = ; + antirollback-counter = <&trusted_nv_counter>; + + trusted_world_pk: trusted_world_pk { + oid = TRUSTED_WORLD_PK_OID; + }; + non_trusted_world_pk: non_trusted_world_pk { + oid = NON_TRUSTED_WORLD_PK_OID; + }; + }; + + trusted_os_fw_key_cert: trusted_os_fw_key_cert { + image-id = ; + parent = <&trusted_key_cert>; + signing-key = <&trusted_world_pk>; + antirollback-counter = <&trusted_nv_counter>; + + tos_fw_content_pk: tos_fw_content_pk { + oid = TRUSTED_OS_FW_CONTENT_CERT_PK_OID; + }; + }; + + trusted_os_fw_content_cert: trusted_os_fw_content_cert { + image-id = ; + parent = <&trusted_os_fw_key_cert>; + signing-key = <&tos_fw_content_pk>; + antirollback-counter = <&trusted_nv_counter>; + + tos_fw_hash: tos_fw_hash { + oid = TRUSTED_OS_FW_HASH_OID; + }; + tos_fw_extra1_hash: tos_fw_extra1_hash { + oid = TRUSTED_OS_FW_EXTRA1_HASH_OID; + }; + tos_fw_extra2_hash: tos_fw_extra2_hash { + oid = TRUSTED_OS_FW_EXTRA2_HASH_OID; + }; + tos_fw_config_hash: tos_fw_config_hash { + oid = TRUSTED_OS_FW_CONFIG_HASH_OID; + }; + }; + + non_trusted_fw_key_cert: non_trusted_fw_key_cert { + image-id = ; + parent = <&trusted_key_cert>; + signing-key = <&non_trusted_world_pk>; + antirollback-counter = <&non_trusted_nv_counter>; + + nt_fw_content_pk: nt_fw_content_pk { + oid = NON_TRUSTED_FW_CONTENT_CERT_PK_OID; + }; + }; + + non_trusted_fw_content_cert: non_trusted_fw_content_cert { + image-id = ; + parent = <&non_trusted_fw_key_cert>; + signing-key = <&nt_fw_content_pk>; + antirollback-counter = <&non_trusted_nv_counter>; + + nt_world_bl_hash: nt_world_bl_hash { + oid = NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID; + }; + }; + }; + + images { + compatible = "arm, img-descs"; + + hw_config { + image-id = ; + parent = <&stm32mp_cfg_cert>; + hash = <&hw_config_hash>; + }; + + fw_config { + image-id = ; + parent = <&stm32mp_cfg_cert>; + hash = <&fw_config_hash>; + }; + + bl32_image { + image-id = ; + parent = <&trusted_os_fw_content_cert>; + hash = <&tos_fw_hash>; + }; + + bl32_extra1_image { + image-id = ; + parent = <&trusted_os_fw_content_cert>; + hash = <&tos_fw_extra1_hash>; + }; + + bl32_extra2_image { + image-id = ; + parent = <&trusted_os_fw_content_cert>; + hash = <&tos_fw_extra2_hash>; + }; + + tos_fw_config { + image-id = ; + parent = <&trusted_os_fw_content_cert>; + hash = <&tos_fw_config_hash>; + }; + + bl33_image { + image-id = ; + parent = <&non_trusted_fw_content_cert>; + hash = <&nt_world_bl_hash>; + }; + }; +}; + +non_volatile_counters: non_volatile_counters { + #address-cells = <1>; + #size-cells = <0>; + + trusted_nv_counter: trusted_nv_counter { + id = ; + oid = TRUSTED_FW_NVCOUNTER_OID; + }; + + non_trusted_nv_counter: non_trusted_nv_counter { + id = ; + oid = NON_TRUSTED_FW_NVCOUNTER_OID; + }; +}; diff --git a/fdts/stm32mp13-bl2.dtsi b/fdts/stm32mp13-bl2.dtsi index 4e3701c85..836e9ae4c 100644 --- a/fdts/stm32mp13-bl2.dtsi +++ b/fdts/stm32mp13-bl2.dtsi @@ -56,7 +56,30 @@ bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4"; hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc"; tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021"; - nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9"; +#if TRUSTED_BOARD_BOOT + stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf"; + t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c"; + tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04"; + nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859"; + tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d"; + nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7"; +#endif }; }; + +#if TRUSTED_BOARD_BOOT + tb_fw-config { + compatible = "arm,tb_fw"; + + /* Disable authentication for development */ + disable_auth = <0x0>; + + /* Use SRAM2 to manage the mbedTLS heap */ + mbedtls_heap_addr = <0x0 0x30004000>; /* SRAM2_BASE */ + mbedtls_heap_size = <0x2000>; /* SRAM2_SIZE */ + }; + +#include "stm32mp1-cot-descriptors.dtsi" +#endif + }; diff --git a/fdts/stm32mp131.dtsi b/fdts/stm32mp131.dtsi index 2c6240851..543afa5c4 100644 --- a/fdts/stm32mp131.dtsi +++ b/fdts/stm32mp131.dtsi @@ -455,6 +455,9 @@ reg = <0xe4 0xc>; st,non-secure-otp; }; + enckey_otp: enckey_otp@170 { + reg = <0x170 0x10>; + }; }; /* * Break node order to solve dependency probe issue between diff --git a/fdts/stm32mp15-bl2.dtsi b/fdts/stm32mp15-bl2.dtsi index 501b092ff..b2d0ba645 100644 --- a/fdts/stm32mp15-bl2.dtsi +++ b/fdts/stm32mp15-bl2.dtsi @@ -85,8 +85,33 @@ bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4"; hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc"; tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021"; - nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9"; +#if TRUSTED_BOARD_BOOT + stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf"; + t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c"; + tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04"; + nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859"; + tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d"; + nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7"; +#endif }; }; + +#if TRUSTED_BOARD_BOOT + tb_fw-config { + compatible = "arm,tb_fw"; + + /* Disable authentication for development */ + disable_auth = <0x0>; + + /* + * The following two entries are placeholders for Mbed TLS + * heap information. + */ + mbedtls_heap_addr = <0x0 0x0>; + mbedtls_heap_size = <0x0>; + }; + +#include "stm32mp1-cot-descriptors.dtsi" +#endif #endif /* !STM32MP_USE_STM32IMAGE */ }; diff --git a/fdts/stm32mp151.dtsi b/fdts/stm32mp151.dtsi index bb16fda89..a938edc0c 100644 --- a/fdts/stm32mp151.dtsi +++ b/fdts/stm32mp151.dtsi @@ -487,6 +487,9 @@ ts_cal2: calib@5e { reg = <0x5e 0x2>; }; + pkh_otp: pkh_otp@60 { + reg = <0x60 0x20>; + }; mac_addr: mac_addr@e4 { reg = <0xe4 0x8>; st,non-secure-otp; -- 2.39.5