Skip to content

Commit 45761ac

Browse files
sreeramIfxsreeramIfx
committed
soc: cyw20829: add support of Secure LCS
Enable support of SECURE LCS stage. In this stage, the protection state is set to “secure”. A secured device will boot only when the authentication of its flash boot and application code succeeds Signed-off-by: Sreeram Tatapudi <[email protected]>
1 parent bdfb2d9 commit 45761ac

File tree

5 files changed

+106
-19
lines changed

5 files changed

+106
-19
lines changed

‎boards/infineon/cyw920829m2evk_02/board.cmake‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@ endif()
1818
include(${ZEPHYR_BASE}/boards/common/openocd.board.cmake)
1919
board_runner_args(jlink "--device=CYW20829_tm")
2020
include (${ZEPHYR_BASE}/boards/common/jlink.board.cmake)
21+
22+
set_property(TARGET runners_yaml_props_target PROPERTY hex_file zephyr_merged.hex)

‎soc/infineon/cat1b/cyw20829/CMakeLists.txt‎

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,66 @@ math(EXPR flash_addr_offset
3030
OUTPUT_FORMAT HEXADECIMAL
3131
)
3232
set(gen_app_header_args --flash_addr_offset ${flash_addr_offset})
33+
set(app_signed_enc_path ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME})
34+
35+
if(CONFIG_INFINEON_SECURE_LCS OR (DEFINED CONFIG_MCUBOOT_ENCRYPTION_KEY_FILE) OR (DEFINED CONFIG_MCUBOOT_SIGNATURE_KEY_FILE))
36+
# Check cysecuretools
37+
find_program(CYSECURETOOLS cysecuretools REQUIRED)
38+
message("-- Found cysecuretools: ${CYSECURETOOLS}")
39+
40+
# Locate CySecureTools policy file
41+
if(IS_ABSOLUTE "${CONFIG_INFINEON_SECURE_POLICY}")
42+
cmake_path(SET cysecuretools_policy "${CONFIG_INFINEON_SECURE_POLICY}")
43+
else()
44+
find_file(
45+
cysecuretools_policy
46+
NAMES
47+
"${CONFIG_INFINEON_SECURE_POLICY}"
48+
PATHS
49+
"${APPLICATION_SOURCE_DIR}"
50+
"${WEST_TOPDIR}"
51+
"${SOC_FULL_DIR}/cyw20829"
52+
NO_DEFAULT_PATH
53+
)
54+
endif()
55+
56+
if(NOT IS_ABSOLUTE "${cysecuretools_policy}" OR NOT EXISTS "${cysecuretools_policy}")
57+
message(FATAL_ERROR "Can't find policy file \"${CONFIG_INFINEON_SECURE_POLICY}\" "
58+
"(Note: Relative paths are searched through "
59+
"APPLICATION_SOURCE_DIR=\"${APPLICATION_SOURCE_DIR}\" "
60+
"and WEST_TOPDIR=\"${WEST_TOPDIR}\")")
61+
endif()
62+
63+
message("-- Using cysecuretools policy: ${cysecuretools_policy}")
64+
set(CYSECURETOOLS_POLICY ${cysecuretools_policy} CACHE PATH "cysecuretool policy")
65+
endif()
66+
67+
if(CONFIG_INFINEON_SECURE_LCS)
68+
#
69+
# Additional postbuild action for SECURE LCS
70+
#
71+
set(gen_app_header_args ${gen_app_header_args} --secure_lcs True)
72+
set(app_signed_path ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}.signed)
73+
set(app_signed_enc_path "${app_signed_path}")
74+
75+
if(CONFIG_INFINEON_SMIF_ENCRYPTION)
76+
set(gen_app_header_args ${gen_app_header_args} --smif-config ${ZEPHYR_BINARY_DIR}/nonce-output.bin)
77+
set(enc_option --encrypt --nonce-output nonce-output.bin)
78+
# The encrypted image file path generated by cysecuretools
79+
set(app_signed_enc_path "${app_signed_path}_encrypted")
80+
endif()
81+
82+
set(bin2hex_option bin2hex --image ${app_signed_enc_path}.bin --output ${app_signed_enc_path}.hex --offset 0x60000030)
83+
84+
# Sign Zephyr L1 app in SECURE LCS
85+
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
86+
COMMAND ${CYSECURETOOLS} -q -t cyw20829
87+
-p ${cysecuretools_policy} sign-image --image-format bootrom_next_app
88+
-i ${ZEPHYR_BINARY_DIR}/${KERNEL_BIN_NAME} -k 0 -o ${app_signed_path}.bin
89+
--slot-size ${CONFIG_FLASH_LOAD_SIZE} --app-addr 0x08000030
90+
${enc_option} ${bin2hex_option}
91+
)
92+
endif()
3393

3494
# Generate platform specific header (TOC2, l1_desc, etc)
3595
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
@@ -39,9 +99,13 @@ set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
3999
--bootstrap-dst-addr ${bootstrap_dst_addr}
40100
)
41101

102+
set(MERGED_FILE ${CMAKE_BINARY_DIR}/zephyr/zephyr_merged.hex CACHE PATH "merged hex")
103+
42104
# Merge platform specific header and zephyr image to a single binary.
43105
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
44106
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
45-
-o ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}.hex
46-
${app_temp_path}.hex ${ZEPHYR_BINARY_DIR}/app_header.hex
107+
-o ${MERGED_FILE}
108+
${app_signed_enc_path}.hex ${ZEPHYR_BINARY_DIR}/app_header.hex
47109
)
110+
111+
set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts ${MERGED_FILE})

‎soc/infineon/cat1b/cyw20829/Kconfig‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,40 @@ config SOC_SERIES_CYW20829
1616
select BUILD_OUTPUT_HEX
1717
select BUILD_OUTPUT_BIN
1818
select SOC_EARLY_INIT_HOOK
19+
20+
config INFINEON_SECURE_LCS
21+
bool "Secure LCS stage support"
22+
help
23+
Enable support of SECURE LCS stage. In this stage, the protection
24+
state is set to “secure”. A secured device will boot only when the
25+
authentication of its flash boot and application code succeeds.
26+
27+
config INFINEON_SECURE_POLICY
28+
string "Path to policy JSON file"
29+
default "default_policy.json"
30+
help
31+
Policy is a text file in JSON format that contains a set of properties
32+
for the device configuration (e.g., enabling/disabling debug access ports,
33+
SMIF configuration, keys information, etc).
34+
35+
config INFINEON_SMIF_ENCRYPTION
36+
bool "SMIF encryption support"
37+
depends on INFINEON_SECURE_LCS
38+
help
39+
Enables SMIF encryption.
40+
41+
config CYW20829_FLASH_SAHB_ADDR
42+
hex
43+
default $(dt_nodelabel_reg_addr_hex,flash_sahb)
44+
45+
config CYW20829_FLASH_CBUS_ADDR
46+
hex
47+
default $(dt_nodelabel_reg_addr_hex,flash_cbus)
48+
49+
config CYW20829_SRAM_SAHB_ADDR
50+
hex
51+
default $(dt_nodelabel_reg_addr_hex,sram_sahb)
52+
53+
config CYW20829_SRAM_CBUS_ADDR
54+
hex
55+
default $(dt_nodelabel_reg_addr_hex,sram_cbus)

‎soc/infineon/cat1b/cyw20829/Kconfig.soc‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,6 @@ config SOC_PACKAGE_CYW20829_40_QFN
2626
config SOC_PACKAGE_CYW20829_77_BGA
2727
bool
2828

29-
config CYW20829_FLASH_SAHB_ADDR
30-
hex
31-
default $(dt_nodelabel_reg_addr_hex,flash_sahb)
32-
33-
config CYW20829_FLASH_CBUS_ADDR
34-
hex
35-
default $(dt_nodelabel_reg_addr_hex,flash_cbus)
36-
37-
config CYW20829_SRAM_SAHB_ADDR
38-
hex
39-
default $(dt_nodelabel_reg_addr_hex,sram_sahb)
40-
41-
config CYW20829_SRAM_CBUS_ADDR
42-
hex
43-
default $(dt_nodelabel_reg_addr_hex,sram_cbus)
44-
4529
# MPN
4630
config SOC_CYW20829A0LKML
4731
bool

‎tests/application_development/vector_table_relocation/src/main.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727

2828
#if (defined(CONFIG_ARM_MPU) && !defined(CONFIG_CPU_HAS_NXP_SYSMPU))
2929
#include <cmsis_core.h>
30-
void disable_mpu_rasr_xn(void)
30+
static void disable_mpu_rasr_xn(void)
3131
{
3232
uint32_t index;
3333
/* Kept the max index as 8(irrespective of soc) because the sram

0 commit comments

Comments
 (0)