feat(stm32mp1-fdts): add CoT and fuse references for authentication

Add the stm32mp1 CoT description file. Include the TRUSTED_BOARD_BOOT
entry in the platform device tree file.
Add the missing public root key reference for stm32mp15 and the
encryption key reference for stm32mp13.

Change-Id: I0ae2454979a3df6dd3e4361510317742e8fbc109
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>

diff --git a/fdts/stm32mp1-cot-descriptors.dtsi b/fdts/stm32mp1-cot-descriptors.dtsi
new file mode 100644 (file)
index 0000000..eb632ff
--- /dev/null
+++ b/fdts/stm32mp1-cot-descriptors.dtsi
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2020-2022, ARM Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <common/nv_cntr_ids.h>
+#include <common/tbbr/tbbr_img_def.h>
+#include <tools_share/tbbr_oid.h>
+
+cot {
+       manifests {
+               compatible = "arm, cert-descs";
+
+               stm32mp_cfg_cert: stm32mp_cfg_cert {
+                       root-certificate;
+                       image-id = <STM32MP_CONFIG_CERT_ID>;
+                       antirollback-counter = <&trusted_nv_counter>;
+
+                       hw_config_hash: hw_config_hash {
+                               oid = HW_CONFIG_HASH_OID;
+                       };
+
+                       fw_config_hash: fw_config_hash {
+                               oid = FW_CONFIG_HASH_OID;
+                       };
+               };
+
+               trusted_key_cert: trusted_key_cert {
+                       root-certificate;
+                       image-id = <TRUSTED_KEY_CERT_ID>;
+                       antirollback-counter = <&trusted_nv_counter>;
+
+                       trusted_world_pk: trusted_world_pk {
+                               oid = TRUSTED_WORLD_PK_OID;
+                       };
+                       non_trusted_world_pk: non_trusted_world_pk {
+                               oid = NON_TRUSTED_WORLD_PK_OID;
+                       };
+               };
+
+               trusted_os_fw_key_cert: trusted_os_fw_key_cert {
+                       image-id = <TRUSTED_OS_FW_KEY_CERT_ID>;
+                       parent = <&trusted_key_cert>;
+                       signing-key = <&trusted_world_pk>;
+                       antirollback-counter = <&trusted_nv_counter>;
+
+                       tos_fw_content_pk: tos_fw_content_pk {
+                               oid = TRUSTED_OS_FW_CONTENT_CERT_PK_OID;
+                       };
+               };
+
+               trusted_os_fw_content_cert: trusted_os_fw_content_cert {
+                       image-id = <TRUSTED_OS_FW_CONTENT_CERT_ID>;
+                       parent = <&trusted_os_fw_key_cert>;
+                       signing-key = <&tos_fw_content_pk>;
+                       antirollback-counter = <&trusted_nv_counter>;
+
+                       tos_fw_hash: tos_fw_hash {
+                               oid = TRUSTED_OS_FW_HASH_OID;
+                       };
+                       tos_fw_extra1_hash: tos_fw_extra1_hash {
+                               oid = TRUSTED_OS_FW_EXTRA1_HASH_OID;
+                       };
+                       tos_fw_extra2_hash: tos_fw_extra2_hash {
+                               oid = TRUSTED_OS_FW_EXTRA2_HASH_OID;
+                       };
+                       tos_fw_config_hash: tos_fw_config_hash {
+                               oid = TRUSTED_OS_FW_CONFIG_HASH_OID;
+                       };
+               };
+
+               non_trusted_fw_key_cert: non_trusted_fw_key_cert {
+                       image-id = <NON_TRUSTED_FW_KEY_CERT_ID>;
+                       parent = <&trusted_key_cert>;
+                       signing-key = <&non_trusted_world_pk>;
+                       antirollback-counter = <&non_trusted_nv_counter>;
+
+                       nt_fw_content_pk: nt_fw_content_pk {
+                               oid = NON_TRUSTED_FW_CONTENT_CERT_PK_OID;
+                       };
+               };
+
+               non_trusted_fw_content_cert: non_trusted_fw_content_cert {
+                       image-id = <NON_TRUSTED_FW_CONTENT_CERT_ID>;
+                       parent = <&non_trusted_fw_key_cert>;
+                       signing-key = <&nt_fw_content_pk>;
+                       antirollback-counter = <&non_trusted_nv_counter>;
+
+                       nt_world_bl_hash: nt_world_bl_hash {
+                               oid = NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID;
+                       };
+               };
+       };
+
+       images {
+               compatible = "arm, img-descs";
+
+               hw_config {
+                       image-id = <HW_CONFIG_ID>;
+                       parent = <&stm32mp_cfg_cert>;
+                       hash = <&hw_config_hash>;
+               };
+
+               fw_config {
+                       image-id = <FW_CONFIG_ID>;
+                       parent = <&stm32mp_cfg_cert>;
+                       hash = <&fw_config_hash>;
+               };
+
+               bl32_image {
+                       image-id = <BL32_IMAGE_ID>;
+                       parent = <&trusted_os_fw_content_cert>;
+                       hash = <&tos_fw_hash>;
+               };
+
+               bl32_extra1_image {
+                       image-id = <BL32_EXTRA1_IMAGE_ID>;
+                       parent = <&trusted_os_fw_content_cert>;
+                       hash = <&tos_fw_extra1_hash>;
+               };
+
+               bl32_extra2_image {
+                       image-id = <BL32_EXTRA2_IMAGE_ID>;
+                       parent = <&trusted_os_fw_content_cert>;
+                       hash = <&tos_fw_extra2_hash>;
+               };
+
+               tos_fw_config {
+                       image-id = <TOS_FW_CONFIG_ID>;
+                       parent = <&trusted_os_fw_content_cert>;
+                       hash = <&tos_fw_config_hash>;
+               };
+
+               bl33_image {
+                       image-id = <BL33_IMAGE_ID>;
+                       parent = <&non_trusted_fw_content_cert>;
+                       hash = <&nt_world_bl_hash>;
+               };
+       };
+};
+
+non_volatile_counters: non_volatile_counters {
+       #address-cells = <1>;
+       #size-cells = <0>;
+
+       trusted_nv_counter: trusted_nv_counter {
+               id  = <TRUSTED_NV_CTR_ID>;
+               oid = TRUSTED_FW_NVCOUNTER_OID;
+       };
+
+       non_trusted_nv_counter: non_trusted_nv_counter {
+               id  = <NON_TRUSTED_NV_CTR_ID>;
+               oid = NON_TRUSTED_FW_NVCOUNTER_OID;
+       };
+};

diff --git a/fdts/stm32mp13-bl2.dtsi b/fdts/stm32mp13-bl2.dtsi
index 4e3701c855b911d19a1f28b36ec36b07d9ff5b48..836e9ae4c499b54ffcfc329bfdb28e928cbf0ba3 100644 (file)
--- a/fdts/stm32mp13-bl2.dtsi
+++ b/fdts/stm32mp13-bl2.dtsi
@@ -56,7 +56,30 @@
                        bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4";
                        hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc";
                        tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021";
-                       nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9";
+#if TRUSTED_BOARD_BOOT
+                       stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf";
+                       t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c";
+                       tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04";
+                       nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859";
+                       tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d";
+                       nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7";
+#endif
                };
        };
+
+#if TRUSTED_BOARD_BOOT
+       tb_fw-config {
+               compatible = "arm,tb_fw";
+
+               /* Disable authentication for development */
+               disable_auth = <0x0>;
+
+               /* Use SRAM2 to manage the mbedTLS heap */
+               mbedtls_heap_addr = <0x0 0x30004000>; /* SRAM2_BASE */
+               mbedtls_heap_size = <0x2000>; /* SRAM2_SIZE */
+       };
+
+#include "stm32mp1-cot-descriptors.dtsi"
+#endif
+
 };

diff --git a/fdts/stm32mp131.dtsi b/fdts/stm32mp131.dtsi
index 2c62408515b776250bcea0b4726c6a002a2087fb..543afa5c4e9037e4292c59293817342859b15ecb 100644 (file)
--- a/fdts/stm32mp131.dtsi
+++ b/fdts/stm32mp131.dtsi
@@ -455,6 +455,9 @@
                                reg = <0xe4 0xc>;
                                st,non-secure-otp;
                        };
+                       enckey_otp: enckey_otp@170 {
+                               reg = <0x170 0x10>;
+                       };
                };
                /*
                 * Break node order to solve dependency probe issue between

diff --git a/fdts/stm32mp15-bl2.dtsi b/fdts/stm32mp15-bl2.dtsi
index 501b092ff452927001f3e2ada065d98db886cdb7..b2d0ba6453634e0c22aef4b879dfecde277ef359 100644 (file)
--- a/fdts/stm32mp15-bl2.dtsi
+++ b/fdts/stm32mp15-bl2.dtsi
@@ -85,8 +85,33 @@
                        bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4";
                        hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc";
                        tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021";
-                       nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9";
+#if TRUSTED_BOARD_BOOT
+                       stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf";
+                       t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c";
+                       tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04";
+                       nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859";
+                       tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d";
+                       nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7";
+#endif
                };
        };
+
+#if TRUSTED_BOARD_BOOT
+       tb_fw-config {
+               compatible = "arm,tb_fw";
+
+               /* Disable authentication for development */
+               disable_auth = <0x0>;
+
+               /*
+                * The following two entries are placeholders for Mbed TLS
+                * heap information.
+                */
+               mbedtls_heap_addr = <0x0 0x0>;
+               mbedtls_heap_size = <0x0>;
+       };
+
+#include "stm32mp1-cot-descriptors.dtsi"
+#endif
 #endif /* !STM32MP_USE_STM32IMAGE */
 };

diff --git a/fdts/stm32mp151.dtsi b/fdts/stm32mp151.dtsi
index bb16fda89e199e5664e943225f57b96b510a0cad..a938edc0c48772d98d8be8dc624ea87fe0630666 100644 (file)
--- a/fdts/stm32mp151.dtsi
+++ b/fdts/stm32mp151.dtsi
@@ -487,6 +487,9 @@
                        ts_cal2: calib@5e {
                                reg = <0x5e 0x2>;
                        };
+                       pkh_otp: pkh_otp@60 {
+                               reg = <0x60 0x20>;
+                       };
                        mac_addr: mac_addr@e4 {
                                reg = <0xe4 0x8>;
                                st,non-secure-otp;