mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-17 01:54:22 +00:00
feat(stm32mp1-fdts): add CoT and fuse references for authentication
Add the stm32mp1 CoT description file. Include the TRUSTED_BOARD_BOOT entry in the platform device tree file. Add the missing public root key reference for stm32mp15 and the encryption key reference for stm32mp13. Change-Id: I0ae2454979a3df6dd3e4361510317742e8fbc109 Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
This commit is contained in:
Lionel Debieve
parent
54007c37d5
commit
928fa66272
5 changed files with 212 additions and 2 deletions
156
fdts/stm32mp1-cot-descriptors.dtsi
Normal file
156
fdts/stm32mp1-cot-descriptors.dtsi
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
/*
|
||||
* Copyright (c) 2020-2022, ARM Limited. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#include <common/nv_cntr_ids.h>
|
||||
#include <common/tbbr/tbbr_img_def.h>
|
||||
#include <tools_share/tbbr_oid.h>
|
||||
|
||||
cot {
|
||||
manifests {
|
||||
compatible = "arm, cert-descs";
|
||||
|
||||
stm32mp_cfg_cert: stm32mp_cfg_cert {
|
||||
root-certificate;
|
||||
image-id = <STM32MP_CONFIG_CERT_ID>;
|
||||
antirollback-counter = <&trusted_nv_counter>;
|
||||
|
||||
hw_config_hash: hw_config_hash {
|
||||
oid = HW_CONFIG_HASH_OID;
|
||||
};
|
||||
|
||||
fw_config_hash: fw_config_hash {
|
||||
oid = FW_CONFIG_HASH_OID;
|
||||
};
|
||||
};
|
||||
|
||||
trusted_key_cert: trusted_key_cert {
|
||||
root-certificate;
|
||||
image-id = <TRUSTED_KEY_CERT_ID>;
|
||||
antirollback-counter = <&trusted_nv_counter>;
|
||||
|
||||
trusted_world_pk: trusted_world_pk {
|
||||
oid = TRUSTED_WORLD_PK_OID;
|
||||
};
|
||||
non_trusted_world_pk: non_trusted_world_pk {
|
||||
oid = NON_TRUSTED_WORLD_PK_OID;
|
||||
};
|
||||
};
|
||||
|
||||
trusted_os_fw_key_cert: trusted_os_fw_key_cert {
|
||||
image-id = <TRUSTED_OS_FW_KEY_CERT_ID>;
|
||||
parent = <&trusted_key_cert>;
|
||||
signing-key = <&trusted_world_pk>;
|
||||
antirollback-counter = <&trusted_nv_counter>;
|
||||
|
||||
tos_fw_content_pk: tos_fw_content_pk {
|
||||
oid = TRUSTED_OS_FW_CONTENT_CERT_PK_OID;
|
||||
};
|
||||
};
|
||||
|
||||
trusted_os_fw_content_cert: trusted_os_fw_content_cert {
|
||||
image-id = <TRUSTED_OS_FW_CONTENT_CERT_ID>;
|
||||
parent = <&trusted_os_fw_key_cert>;
|
||||
signing-key = <&tos_fw_content_pk>;
|
||||
antirollback-counter = <&trusted_nv_counter>;
|
||||
|
||||
tos_fw_hash: tos_fw_hash {
|
||||
oid = TRUSTED_OS_FW_HASH_OID;
|
||||
};
|
||||
tos_fw_extra1_hash: tos_fw_extra1_hash {
|
||||
oid = TRUSTED_OS_FW_EXTRA1_HASH_OID;
|
||||
};
|
||||
tos_fw_extra2_hash: tos_fw_extra2_hash {
|
||||
oid = TRUSTED_OS_FW_EXTRA2_HASH_OID;
|
||||
};
|
||||
tos_fw_config_hash: tos_fw_config_hash {
|
||||
oid = TRUSTED_OS_FW_CONFIG_HASH_OID;
|
||||
};
|
||||
};
|
||||
|
||||
non_trusted_fw_key_cert: non_trusted_fw_key_cert {
|
||||
image-id = <NON_TRUSTED_FW_KEY_CERT_ID>;
|
||||
parent = <&trusted_key_cert>;
|
||||
signing-key = <&non_trusted_world_pk>;
|
||||
antirollback-counter = <&non_trusted_nv_counter>;
|
||||
|
||||
nt_fw_content_pk: nt_fw_content_pk {
|
||||
oid = NON_TRUSTED_FW_CONTENT_CERT_PK_OID;
|
||||
};
|
||||
};
|
||||
|
||||
non_trusted_fw_content_cert: non_trusted_fw_content_cert {
|
||||
image-id = <NON_TRUSTED_FW_CONTENT_CERT_ID>;
|
||||
parent = <&non_trusted_fw_key_cert>;
|
||||
signing-key = <&nt_fw_content_pk>;
|
||||
antirollback-counter = <&non_trusted_nv_counter>;
|
||||
|
||||
nt_world_bl_hash: nt_world_bl_hash {
|
||||
oid = NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
images {
|
||||
compatible = "arm, img-descs";
|
||||
|
||||
hw_config {
|
||||
image-id = <HW_CONFIG_ID>;
|
||||
parent = <&stm32mp_cfg_cert>;
|
||||
hash = <&hw_config_hash>;
|
||||
};
|
||||
|
||||
fw_config {
|
||||
image-id = <FW_CONFIG_ID>;
|
||||
parent = <&stm32mp_cfg_cert>;
|
||||
hash = <&fw_config_hash>;
|
||||
};
|
||||
|
||||
bl32_image {
|
||||
image-id = <BL32_IMAGE_ID>;
|
||||
parent = <&trusted_os_fw_content_cert>;
|
||||
hash = <&tos_fw_hash>;
|
||||
};
|
||||
|
||||
bl32_extra1_image {
|
||||
image-id = <BL32_EXTRA1_IMAGE_ID>;
|
||||
parent = <&trusted_os_fw_content_cert>;
|
||||
hash = <&tos_fw_extra1_hash>;
|
||||
};
|
||||
|
||||
bl32_extra2_image {
|
||||
image-id = <BL32_EXTRA2_IMAGE_ID>;
|
||||
parent = <&trusted_os_fw_content_cert>;
|
||||
hash = <&tos_fw_extra2_hash>;
|
||||
};
|
||||
|
||||
tos_fw_config {
|
||||
image-id = <TOS_FW_CONFIG_ID>;
|
||||
parent = <&trusted_os_fw_content_cert>;
|
||||
hash = <&tos_fw_config_hash>;
|
||||
};
|
||||
|
||||
bl33_image {
|
||||
image-id = <BL33_IMAGE_ID>;
|
||||
parent = <&non_trusted_fw_content_cert>;
|
||||
hash = <&nt_world_bl_hash>;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
non_volatile_counters: non_volatile_counters {
|
||||
#address-cells = <1>;
|
||||
#size-cells = <0>;
|
||||
|
||||
trusted_nv_counter: trusted_nv_counter {
|
||||
id = <TRUSTED_NV_CTR_ID>;
|
||||
oid = TRUSTED_FW_NVCOUNTER_OID;
|
||||
};
|
||||
|
||||
non_trusted_nv_counter: non_trusted_nv_counter {
|
||||
id = <NON_TRUSTED_NV_CTR_ID>;
|
||||
oid = NON_TRUSTED_FW_NVCOUNTER_OID;
|
||||
};
|
||||
};
|
||||
|
|
@ -56,7 +56,30 @@
|
|||
bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4";
|
||||
hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc";
|
||||
tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021";
|
||||
nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9";
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf";
|
||||
t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c";
|
||||
tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04";
|
||||
nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859";
|
||||
tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d";
|
||||
nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7";
|
||||
#endif
|
||||
};
|
||||
};
|
||||
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
tb_fw-config {
|
||||
compatible = "arm,tb_fw";
|
||||
|
||||
/* Disable authentication for development */
|
||||
disable_auth = <0x0>;
|
||||
|
||||
/* Use SRAM2 to manage the mbedTLS heap */
|
||||
mbedtls_heap_addr = <0x0 0x30004000>; /* SRAM2_BASE */
|
||||
mbedtls_heap_size = <0x2000>; /* SRAM2_SIZE */
|
||||
};
|
||||
|
||||
#include "stm32mp1-cot-descriptors.dtsi"
|
||||
#endif
|
||||
|
||||
};
|
||||
|
|
|
|||
|
|
@ -455,6 +455,9 @@
|
|||
reg = <0xe4 0xc>;
|
||||
st,non-secure-otp;
|
||||
};
|
||||
enckey_otp: enckey_otp@170 {
|
||||
reg = <0x170 0x10>;
|
||||
};
|
||||
};
|
||||
/*
|
||||
* Break node order to solve dependency probe issue between
|
||||
|
|
|
|||
|
|
@ -85,8 +85,33 @@
|
|||
bl33_uuid = "d6d0eea7-fcea-d54b-9782-9934f234b6e4";
|
||||
hw_cfg_uuid = "08b8f1d9-c9cf-9349-a962-6fbc6b7265cc";
|
||||
tos_fw_cfg_uuid = "26257c1a-dbc6-7f47-8d96-c4c4b0248021";
|
||||
nt_fw_cfg_uuid = "28da9815-93e8-7e44-ac66-1aaf801550f9";
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
stm32mp_cfg_cert_uuid = "501d8dd2-8bce-49a5-84eb-559a9f2eaeaf";
|
||||
t_key_cert_uuid = "827ee890-f860-e411-a1b4-777a21b4f94c";
|
||||
tos_fw_key_cert_uuid = "9477d603-fb60-e411-85dd-b7105b8cee04";
|
||||
nt_fw_key_cert_uuid = "8ad5832a-fb60-e411-8aaf-df30bbc49859";
|
||||
tos_fw_content_cert_uuid = "a49f4411-5e63-e411-8728-3f05722af33d";
|
||||
nt_fw_content_cert_uuid = "8ec4c1f3-5d63-e411-a7a9-87ee40b23fa7";
|
||||
#endif
|
||||
};
|
||||
};
|
||||
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
tb_fw-config {
|
||||
compatible = "arm,tb_fw";
|
||||
|
||||
/* Disable authentication for development */
|
||||
disable_auth = <0x0>;
|
||||
|
||||
/*
|
||||
* The following two entries are placeholders for Mbed TLS
|
||||
* heap information.
|
||||
*/
|
||||
mbedtls_heap_addr = <0x0 0x0>;
|
||||
mbedtls_heap_size = <0x0>;
|
||||
};
|
||||
|
||||
#include "stm32mp1-cot-descriptors.dtsi"
|
||||
#endif
|
||||
#endif /* !STM32MP_USE_STM32IMAGE */
|
||||
};
|
||||
|
|
|
|||
|
|
@ -487,6 +487,9 @@
|
|||
ts_cal2: calib@5e {
|
||||
reg = <0x5e 0x2>;
|
||||
};
|
||||
pkh_otp: pkh_otp@60 {
|
||||
reg = <0x60 0x20>;
|
||||
};
|
||||
mac_addr: mac_addr@e4 {
|
||||
reg = <0xe4 0x8>;
|
||||
st,non-secure-otp;
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue