Skip to content

Commit 4d486de

Browse files
sreeramIfxsreeramIfx
committed
soc: cyw20829: add support of Secure LCS
Enable support of SECURE LCS stage. In this stage, the protection state is set to “secure”. A secured device will boot only when the authentication of its flash boot and application code succeeds Signed-off-by: Sreeram Tatapudi <[email protected]>
1 parent 1b93307 commit 4d486de

File tree

9 files changed

+435
-151
lines changed

9 files changed

+435
-151
lines changed

‎dts/arm/infineon/cat1b/cyw20829/cyw20829.dtsi‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77

88
#include <mem.h>
99

10+
#define BOOTSTRAP_SIZE DT_SIZE_K(12)
11+
#define SRAM0_SIZE (DT_SIZE_K(256) - BOOTSTRAP_SIZE)
12+
1013
/ {
1114
cpus {
1215
#address-cells = <1>;
@@ -35,14 +38,46 @@
3538
};
3639

3740
sram0: memory@20000000 {
41+
#address-cells = <1>;
42+
#size-cells = <1>;
43+
3844
compatible = "mmio-sram";
39-
reg = <0x20000000 DT_SIZE_K(244)>;
45+
reg = <0x20000000 SRAM0_SIZE>;
46+
47+
/* SRAM aliased address path */
48+
sram_sahb: sram_bus_alias@20000000 {
49+
reg = <0x20000000 0x00040000>; /* SAHB address */
50+
};
51+
52+
sram_cbus: sram_bus_alias@4000000 {
53+
reg = <0x04000000 0x00040000>; /* CBUS address */
54+
};
4055
};
4156

57+
/* sram_bootstrap address calculation:
58+
* sram_sahb + sram_size (256k) - bootstrap size
59+
* (e.g. 0x20000000 + 0x40000 - 12K (0x3000) = 0x2003D000)
60+
*/
4261
sram_bootstrap: memory@2003D000 {
4362
compatible = "zephyr,memory-region", "mmio-sram";
4463
zephyr,memory-region = "BOOTSTRAP_RAM";
45-
reg = <0x2003D000 DT_SIZE_K(12)>;
64+
reg = <0x2003D000 BOOTSTRAP_SIZE>;
65+
};
66+
67+
qspi_flash: qspi_flash@40890000 {
68+
compatible = "infineon,cat1-qspi-flash";
69+
reg = <0x40890000 0x30000>;
70+
#address-cells = <1>;
71+
#size-cells = <1>;
72+
};
73+
74+
/* Flash aliased address path */
75+
flash_sahb: flash_bus_alias@60000000 {
76+
reg = <0x60000000 0x80000>; /* SAHB address */
77+
};
78+
79+
flash_cbus: flash_bus_alias@8000000 {
80+
reg = <0x08000000 0x80000>; /* CBUS address */
4681
};
4782

4883
soc {

‎soc/infineon/cat1b/cyw20829/CMakeLists.txt‎

Lines changed: 103 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
# Copyright (c) 2023 Cypress Semiconductor Corporation.
1+
# Copyright (c) 2024 Cypress Semiconductor Corporation.
22
# SPDX-License-Identifier: Apache-2.0
33

44
zephyr_sources(soc.c)
5-
zephyr_sources(app_header.c)
65
zephyr_sources(mpu_regions.c)
76
zephyr_include_directories(.)
87

@@ -19,3 +18,105 @@ zephyr_compile_definitions(CY_PDL_FLASH_BOOT)
1918

2019
# Use custome linker script
2120
set(SOC_LINKER_SCRIPT ${ZEPHYR_BASE}/soc/infineon/cat1b/cyw20829/linker.ld CACHE INTERNAL "")
21+
22+
if(CONFIG_INFINEON_SECURE_LCS OR CONFIG_BOOTLOADER_MCUBOOT)
23+
# Check cysecuretools
24+
find_program(CYSECURETOOLS cysecuretools)
25+
if(NOT CYSECURETOOLS)
26+
message(FATAL_ERROR "Can't find cysecuretools. To fix, install cysecuretools with pip3.")
27+
else()
28+
message("-- Found cysecuretools: ${CYSECURETOOLS}")
29+
endif()
30+
31+
set(default_policy)
32+
set(default_policy_name)
33+
# Cysecuretools policy.
34+
if(NOT CONFIG_INFINEON_SECURE_POLICY)
35+
# Get default cysecuretools policy
36+
if(CONFIG_INFINEON_SECURE_LCS)
37+
message(INFO "CONFIG_INFINEON_SECURE_POLICY was not defined.")
38+
set(default_policy_name policy_secure.json)
39+
else()
40+
set(default_policy_name policy_no_secure.json)
41+
endif()
42+
endif()
43+
44+
find_file(
45+
default_policy
46+
NAMES
47+
${CONFIG_INFINEON_SECURE_POLICY}
48+
${default_policy_name}
49+
PATHS
50+
${APPLICATION_SOURCE_DIR}
51+
${ZEPHYR_BASE}
52+
NO_DEFAULT_PATH
53+
)
54+
55+
if(NOT default_policy)
56+
message(FATAL_ERROR "Can't find policy:${CONFIG_INFINEON_SECURE_POLICY}"
57+
"/${default_policy_name}"
58+
"Checked locations: ${APPLICATION_SOURCE_DIR}, ${ZEPHYR_BASE}")
59+
endif()
60+
61+
set(cysecuretools_policy ${default_policy} CACHE PATH "cysecuretools policy")
62+
message("-- Using cysecuretools policy: ${cysecuretools_policy}")
63+
endif()
64+
65+
# Copy Zephyr application hex
66+
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
67+
${CMAKE_COMMAND} -E copy
68+
${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}.hex ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}_org.hex
69+
)
70+
71+
# Get sram_bootstrap address and size
72+
dt_nodelabel(sram_bootstrap NODELABEL "sram_bootstrap")
73+
dt_reg_addr(bootstrap_dst_addr PATH ${sram_bootstrap})
74+
dt_reg_size(bootstrap_size PATH ${sram_bootstrap})
75+
76+
# Calculate the place in flash
77+
math(EXPR flash_addr_offset
78+
"${CONFIG_CYW20829_FLASH_SAHB_ADDR} + ${CONFIG_FLASH_LOAD_OFFSET} + ${CONFIG_ROM_START_OFFSET}"
79+
OUTPUT_FORMAT HEXADECIMAL
80+
)
81+
set(gen_app_header_args --flash_addr_offset ${flash_addr_offset})
82+
set(app_temp_path ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}_org)
83+
84+
if(CONFIG_INFINEON_SECURE_LCS)
85+
#
86+
# Addition postbuild action for SECURE LCS
87+
#
88+
set(gen_app_header_args ${gen_app_header_args} --secure_lcs True)
89+
set(app_temp_path ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}_signed_tmp)
90+
91+
if(CONFIG_INFINEON_SMIF_ENCRYPTION)
92+
set(gen_app_header_args ${gen_app_header_args} --smif-config ${ZEPHYR_BINARY_DIR}/nonce-output.bin)
93+
set(enc_option --encrypt --nonce-output nonce-output.bin)
94+
set(bin2hex_option bin2hex --image ${app_temp_path}_encrypted.bin --output ${app_temp_path}.hex --offset 0x60000030)
95+
else()
96+
set(bin2hex_option bin2hex --image ${app_temp_path}.bin --output ${app_temp_path}.hex --offset 0x60000030)
97+
endif()
98+
99+
# Sign Zephyr L1 app in SECURE LCS
100+
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
101+
COMMAND ${CYSECURETOOLS} -q -t cyw20829
102+
-p ${cysecuretools_policy} sign-image --image-format bootrom_next_app
103+
-i ${ZEPHYR_BINARY_DIR}/${KERNEL_BIN_NAME} -k 0 -o ${app_temp_path}.bin
104+
--slot-size ${CONFIG_FLASH_LOAD_SIZE} --app-addr 0x08000030
105+
${enc_option} ${bin2hex_option}
106+
)
107+
endif()
108+
109+
# Generate platform specific header (TOC2, l1_desc, etc)
110+
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
111+
${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/soc/infineon/cat1b/cyw20829/gen_app_header.py
112+
-p ${ZEPHYR_BINARY_DIR} -n ${KERNEL_NAME} ${gen_app_header_args}
113+
--bootstrap-size ${bootstrap_size}
114+
--bootstrap-dst-addr ${bootstrap_dst_addr}
115+
)
116+
117+
# Merge platform specific header and zephyr image to a single binary.
118+
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
119+
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
120+
-o ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME}.hex
121+
${app_temp_path}.hex ${ZEPHYR_BINARY_DIR}/app_header.hex
122+
)

‎soc/infineon/cat1b/cyw20829/Kconfig‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,23 @@ config SOC_SERIES_CYW20829
1616
select BUILD_OUTPUT_HEX
1717
select BUILD_OUTPUT_BIN
1818
select SOC_EARLY_INIT_HOOK
19+
20+
config INFINEON_SECURE_LCS
21+
bool "Secure LCS stage support"
22+
help
23+
Enable support of SECURE LCS stage. In this stage, the protection
24+
state is set to “secure”. A secured device will boot only when the
25+
authentication of its flash boot and application code succeeds.
26+
27+
config INFINEON_SECURE_POLICY
28+
string "Path to policy JSON file"
29+
help
30+
Policy is a text file in JSON format that contains a set of properties
31+
for the device configuration (e.g., enabling/disabling debug access ports,
32+
SMIF configuration, keys information, etc).
33+
34+
config INFINEON_SMIF_ENCRYPTION
35+
bool "SMIF encryption support"
36+
depends on INFINEON_SECURE_LCS
37+
help
38+
Enables SMIF encryption.

‎soc/infineon/cat1b/cyw20829/Kconfig.defconfig‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ config MAIN_STACK_SIZE
2828
config IDLE_STACK_SIZE
2929
default 1024 if PM
3030

31+
config ROM_START_OFFSET
32+
default 0x400 if BOOTLOADER_MCUBOOT
33+
3134
# add additional die specific params
3235

3336
endif # SOC_DIE_CYW20829

‎soc/infineon/cat1b/cyw20829/Kconfig.soc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,22 @@ config SOC_PACKAGE_CYW20829_40_QFN
2626
config SOC_PACKAGE_CYW20829_77_BGA
2727
bool
2828

29+
config CYW20829_FLASH_SAHB_ADDR
30+
hex
31+
default $(dt_nodelabel_reg_addr_hex,flash_sahb)
32+
33+
config CYW20829_FLASH_CBUS_ADDR
34+
hex
35+
default $(dt_nodelabel_reg_addr_hex,flash_cbus)
36+
37+
config CYW20829_SRAM_SAHB_ADDR
38+
hex
39+
default $(dt_nodelabel_reg_addr_hex,sram_sahb)
40+
41+
config CYW20829_SRAM_CBUS_ADDR
42+
hex
43+
default $(dt_nodelabel_reg_addr_hex,sram_cbus)
44+
2945
# MPN
3046
config SOC_CYW20829A0LKML
3147
bool

‎soc/infineon/cat1b/cyw20829/app_header.c‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎soc/infineon/cat1b/cyw20829/bootstrap.ld‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,7 @@
1-
/* Copyright 2024 Cypress Semiconductor Corporation (an Infineon company) or
2-
* an affiliate of Cypress Semiconductor Corporation
3-
*
4-
* SPDX-License-Identifier: Apache-2.0
5-
*/
6-
7-
SECTIONS
8-
{
9-
.app_header :
10-
{
11-
KEEP(*(.app_header))
12-
} > APP_HEADER_FLASH
13-
14-
/* Cortex-M33 bootstrap code area */
15-
.bootstrapText :
1+
/* Cortex-M33 bootstrap code area */
2+
bootstrap.text_lma = BS_CODE_LMA_CBUS;
3+
bootstrap.text_vma = BS_CODE_VMA_CBUS;
4+
.bootstrapText (bootstrap.text_vma) : AT (bootstrap.text_lma)
165
{
176
. = ALIGN(4);
187
__bootstrapText_begin = .;
@@ -49,19 +38,23 @@ SECTIONS
4938

5039
. = ALIGN(4);
5140
__bootstrapText_end = .;
52-
} > BOOTSTRAP_RAM AT>BOOTSTRAP_FLASH
41+
}
5342

54-
.bootstrapzero.table :
43+
bootstrap.zerotable.vma = (__bootstrapText_end);
44+
bootstrap.zerotable.lma = (bootstrap.text_lma + (__bootstrapText_end - __bootstrapText_begin));
45+
.bootstrapzero.table (bootstrap.zerotable.vma): AT (bootstrap.zerotable.lma)
5546
{
5647
. = ALIGN(4);
5748
__bootstrapzero_table_start__ = .;
5849
LONG (__bootstrap_bss_start__)
5950
LONG ((__bootstrap_bss_end__ - __bootstrap_bss_start__)/4)
6051
. = ALIGN(4);
6152
__bootstrapzero_table_end__ = .;
62-
} > BOOTSTRAP_RAM AT>BOOTSTRAP_FLASH
53+
}
6354

64-
.bootstrapData :
55+
bootstrap.data.vma = ((__bootstrapzero_table_end__ - RAM_START_ADDR_CBUS) + RAM_START_ADDR_SAHB); /* CBUS -> SAHB */
56+
bootstrap.data.lma = (bootstrap.zerotable.lma + (__bootstrapzero_table_end__ - __bootstrapzero_table_start__));
57+
.bootstrapData (bootstrap.data.vma): AT (bootstrap.data.lma)
6558
{
6659
__bootstrapData_start__ = .;
6760
. = ALIGN(4);
@@ -85,9 +78,9 @@ SECTIONS
8578

8679
. = ALIGN(4);
8780
__bootstrapData_end__ = .;
88-
} > BOOTSTRAP_RAM AT>BOOTSTRAP_FLASH
81+
} > BOOTSTRAP_RAM
8982

90-
.bootstrapBss (NOLOAD):
83+
.bootstrapBss (__bootstrapData_end__) (NOLOAD):
9184
{
9285
. = ALIGN(4);
9386
__bootstrap_bss_start__ = .;
@@ -111,4 +104,3 @@ SECTIONS
111104
. = ALIGN(4);
112105
__bootstrap_bss_end__ = .;
113106
} > BOOTSTRAP_RAM
114-
}

0 commit comments

Comments
 (0)