NXP Layerscape secure boot support for TF-A

index 70fdec5c2a..084af08792 100644
@@ -300,4 +300,79 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL
 	default "strong"  if BR2_SSP_STRONG
 	default "all"     if BR2_SSP_ALL
 
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+	bool "NXP Layerscape secure boot"
+	depends on BR2_TARGET_ARM_TRUSTED_FIRMWARE_RCW
+	select BR2_PACKAGE_HOST_QORIQ_CST
+	help
+	  Sign the boot images with the NXP Code Signing Tool
+	  (TRUSTED_BOARD_BOOT=1).
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+
+choice
+	prompt "Signature format"
+	help
+	  Format used to sign the BL31, BL33 and DDR images. BL2 and
+	  the PBI are always signed by CST with the SRK keys, whatever
+	  the format.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+	bool "X.509"
+	help
+	  Sign BL31, BL33 and DDR images with X.509 certificates
+	  (TF-A NXP_TBBR_USE_X509=1, GENERATE_COT=1, mbed TLS).
+
+endchoice
+
+choice
+	prompt "CST input files"
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+	bool "Generate from SRK keys"
+	help
+	  Use the TF-A default input files with the SRK keys below.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+	bool "Custom input files (advanced)"
+	help
+	  Use your own input files instead of the TF-A defaults.
+
+endchoice
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR
+	string "SRK keys directory"
+	help
+	  Absolute path to the directory containing the SRK key pair,
+	  srk.pub and srk.pri, as generated by the gen_keys tool of
+	  qoriq-cst. If empty, TF-A generates a new development SRK
+	  key pair in its build directory and images are signed with
+	  them.
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR
+	string "Custom CST input files directory"
+	help
+	  Directory with input files named as in TF-A, e.g.
+	  input_pbi_ch3_2, input_bl2_ch3_2 and input_blx_ch3.
+
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR
+	string "X.509 keys directory"
+	help
+	  Directory with rot.pem, trusted_world.pem,
+	  non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+	  If empty, TF-A generates automatically new keys at each build.
+
+endif
+
+endif
+
 endif

67 lines not on this page · raw message

index 367a03c1ce..24c30057e3 100644
@@ -1,2 +1,4 @@
 # Locally computed
 sha256  b807d8bf190b7c46b4260729b4bbe2f7df83cd1086edcb181d66595ae6598d23  arm-trusted-firmware-v2.15.0-git4.tar.gz
+# From https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7:
+sha256  a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6  mbedtls-3.6.7.tar.bz2

index 4042bf9c7e..b5d7c12ba6 100755
@@ -9,3 +9,9 @@ ln -sf dpc-usxgmii.dtb "$TARGET_DIR/boot/dpc.dtb"
 ln -sf dpl-eth.19.dtb "$TARGET_DIR/boot/dpl.dtb"
 sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/extlinux.conf" > "$TARGET_DIR/boot/extlinux/extlinux.conf"
 sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/genimage.cfg" > "$BINARIES_DIR/genimage.cfg"
+
+if grep -q "^BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y" "$BR2_CONFIG"; then
+    sed -i -e 's/"bl2_sd.pbl"/"bl2_sd_sec.pbl"/' \
+        -e 's/"fip_ddr.bin"/"ddr_fip_sec.bin"/' \
+        "$BINARIES_DIR/genimage.cfg"
+fi

index f0c03a5958..90a5964ab1 100644
@@ -39,6 +39,40 @@ board/freescale/lx2160ardb/readme.txt.
 For details about the medium image layout, see the definition in
 board/freescale/lx2160a-rdb/genimage.cfg.
 
+Secure boot
+===========
+
+With BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y, TF-A signs the
+boot images with the NXP Code Signing Tool (host-qoriq-cst):
+  - the PBI and BL2 get a CSF header signed with the SRK key; the
+    BootROM checks it against the SRKH fuses;
+  - BL31, BL33 and the DDR PHY firmware get X.509 certificates; BL2
+    checks them against the ROT key hash embedded in BL2.
+
+Set the images to install:
+
+  BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="fip.bin bl2_sd_sec.pbl ddr_fip_sec.bin"
+
+Set the keys to use:
+  - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR: directory
+    containing srk.pri and srk.pub;
+  - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR:
+    directory containing rot.pem, trusted_world.pem,
+    non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+
+If these directories are empty, development keys are generated in the
+TF-A build directory. For the CSF headers, custom CST input files can
+be used instead of the SRK keys directory.
+
+The post-build script then puts the signed images in sdcard.img.
+
+When changing any of these options, rebuild TF-A from scratch:
+
+  make arm-trusted-firmware-dirclean && make
+
+While the ITS fuse is not blown, a BootROM authentication failure is not
+fatal: the board still boots, with the SNVS in Non-Secure state.
+
 Known limitations
 =================