[Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A

[Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A

[Leo Denieul]

Subject: [PATCH 0/2] NXP Layerscape secure boot support for TF-A
This series adds the support to build signed boot images for NXP
Layerscape SoCs with the NXP Code Signing Tool, and enables it for the
LX2160ARDB (lx2160a-rdb_defconfig).

Tested on a LX2160ARDB with SRKH fused (ITS not blown): with the right
keys the BootROM authenticates the PBI and BL2 (SNVS Secure, no error
in SCRATCHRW3), with wrong SRK keys, BL31/BL33 certificates are
rejected by BL2.

This series depends on:
  - configs/lx2160a-rdb: new defconfig (v8)
  - package/qoriq-cst: new package (v6)

A TF-A bump with SRK key generation at build time will follow

Leo Denieul (2):
  boot/arm-trusted-firmware: add NXP Layerscape secure boot support
  board/freescale/lx2160a-rdb: add secure boot support

 .../arm-trusted-firmware.hash                 |  2 +
 board/freescale/lx2160a-rdb/post-build.sh     |  6 ++
 board/freescale/lx2160a-rdb/readme.txt        | 34 +++++++++
 boot/arm-trusted-firmware/Config.in           | 75 +++++++++++++++++++
 .../arm-trusted-firmware.mk                   | 63 ++++++++++++++++
 5 files changed, 180 insertions(+)

-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/2] boot/arm-trusted-firmware: add NXP Layerscape secure boot support

[Leo Denieul]

Add options to build signed boot images for NXP Layerscape SoCs with
the NXP Code Signing Tool (host-qoriq-cst), as done by NXP flexbuild:
the PBI and BL2 get a CSF header signed with the SRK key, checked by
the BootROM against the SRKH fuses, and BL31, BL33 and the DDR PHY
firmware get X.509 certificates checked by BL2.

With TF-A versions that build the mbed TLS sources with their own
CFLAGS (e.g. NXP lf-6.12.34-2.1.0, used by
freescale_lx2160ardb_defconfig), mbed TLS 3.6 fails to build:

  mbedtls/include/psa/crypto.h:122:29: error: redundant redeclaration
  of 'psa_key_attributes_init' [-Werror=redundant-decls]

as psa/crypto.h redeclares functions already defined static inline in
psa/crypto_struct.h. Add -Wno-error=redundant-decls when X.509 is
enabled. Recent TF-A versions build mbed TLS through CMake and are not
affected.

Signed-off-by: Leo Denieul <leo.denieul.yoshino@gmail.com>
---
 boot/arm-trusted-firmware/Config.in           | 75 +++++++++++++++++++
 .../arm-trusted-firmware.mk                   | 63 ++++++++++++++++
 2 files changed, 138 insertions(+)

diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in
index 70fdec5c2a..084af08792 100644
--- a/boot/arm-trusted-firmware/Config.in
+++ b/boot/arm-trusted-firmware/Config.in
@@ -300,4 +300,79 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL
 	default "strong"  if BR2_SSP_STRONG
 	default "all"     if BR2_SSP_ALL
 
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+	bool "NXP Layerscape secure boot"
+	depends on BR2_TARGET_ARM_TRUSTED_FIRMWARE_RCW
+	select BR2_PACKAGE_HOST_QORIQ_CST
+	help
+	  Sign the boot images with the NXP Code Signing Tool
+	  (TRUSTED_BOARD_BOOT=1).
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+
+choice
+	prompt "Signature format"
+	help
+	  Format used to sign the BL31, BL33 and DDR images. BL2 and
+	  the PBI are always signed by CST with the SRK keys, whatever
+	  the format.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+	bool "X.509"
+	help
+	  Sign BL31, BL33 and DDR images with X.509 certificates
+	  (TF-A NXP_TBBR_USE_X509=1, GENERATE_COT=1, mbed TLS).
+
+endchoice
+
+choice
+	prompt "CST input files"
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+	bool "Generate from SRK keys"
+	help
+	  Use the TF-A default input files with the SRK keys below.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+	bool "Custom input files (advanced)"
+	help
+	  Use your own input files instead of the TF-A defaults.
+
+endchoice
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR
+	string "SRK keys directory"
+	help
+	  Absolute path to the directory containing the SRK key pair,
+	  srk.pub and srk.pri, as generated by the gen_keys tool of
+	  qoriq-cst. If empty, TF-A generates a new development SRK
+	  key pair in its build directory and images are signed with
+	  them.
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR
+	string "Custom CST input files directory"
+	help
+	  Directory with input files named as in TF-A, e.g.
+	  input_pbi_ch3_2, input_bl2_ch3_2 and input_blx_ch3.
+
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR
+	string "X.509 keys directory"
+	help
+	  Directory with rot.pem, trusted_world.pem,
+	  non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+	  If empty, TF-A generates automatically new keys at each build.
+
+endif
+
+endif
+
 endif
diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index 2aaa7e3d19..b711d673c2 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -243,4 +243,67 @@ endif
 
 endif
 
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT),y)
+ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR))
+ARM_TRUSTED_FIRMWARE_DEPENDENCIES += host-qoriq-cst
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += TRUSTED_BOARD_BOOT=1 CST_DIR=$(HOST_DIR)/bin/cst
+
+ifeq ($(BR2_PACKAGE_QORIQ_DDR_PHY_BINARY),y)
+ARM_TRUSTED_FIRMWARE_DEPENDENCIES += qoriq-ddr-phy-binary
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += DDR_PHY_BIN_PATH=$(QORIQ_DDR_PHY_BINARY_DIR)/lx2160a
+define ARM_TRUSTED_FIRMWARE_BUILD_FIP_DDR
+	$(ARM_TRUSTED_FIRMWARE_MAKE_ENV) $(MAKE) -C $(@D) \
+	$(ARM_TRUSTED_FIRMWARE_MAKE_OPTS) fip_ddr
+endef
+ARM_TRUSTED_FIRMWARE_POST_BUILD_HOOKS += ARM_TRUSTED_FIRMWARE_BUILD_FIP_DDR
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS),y)
+ifneq ($(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR),)
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
+	SRK_PRI_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR)/srk.pri \
+	SRK_PUB_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR)/srk.pub
+endif
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509),y)
+ARM_TRUSTED_FIRMWARE_EXTRA_DOWNLOADS += $(MBEDTLS_SITE)/$(MBEDTLS_SOURCE)
+define ARM_TRUSTED_FIRMWARE_EXTRACT_MBEDTLS
+	mkdir -p $(@D)/mbedtls
+	$(call suitable-extractor,$(MBEDTLS_SOURCE)) \
+	$(ARM_TRUSTED_FIRMWARE_DL_DIR)/$(MBEDTLS_SOURCE) | \
+	$(TAR) --strip-components=1 -C $(@D)/mbedtls $(TAR_OPTIONS) -
+endef
+ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_EXTRACT_MBEDTLS
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += GENERATE_COT=1 NXP_TBBR_USE_X509=1 MBEDTLS_DIR=$(@D)/mbedtls
+
+ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR))
+ifneq ($(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR),)
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
+	ROT_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/rot.pem \
+	TRUSTED_WORLD_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/trusted_world.pem \
+	NON_TRUSTED_WORLD_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/non_trusted_world.pem \
+	BL31_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/bl31.pem \
+	BL33_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/bl33.pem \
+	DDR_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/ddr.pem
+endif
+
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM),y)
+ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR))
+ifeq ($(BR_BUILDING),y)
+ifeq ($(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR),)
+$(error No CST input files directory set, check BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR)
+endif
+endif
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += BL2_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_bl2_ch3_2 \
+	PBI_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_pbi_ch3_2 \
+	BL31_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3 \
+	BL33_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3 \
+	DDR_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3
+endif
+
+endif
+
 $(eval $(generic-package))
-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/2] board/freescale/lx2160a-rdb: add secure boot support

[Leo Denieul]

When NXP secure boot is enabled, use the signed BL2 and DDR FIP
(bl2_sd_sec.pbl, ddr_fip_sec.bin) in the SD card image, add the hash
of the mbed TLS archive needed for X.509 and document the secure boot
build in the readme.

Signed-off-by: Leo Denieul <leo.denieul.yoshino@gmail.com>
---
 .../arm-trusted-firmware.hash                 |  2 ++
 board/freescale/lx2160a-rdb/post-build.sh     |  6 ++++
 board/freescale/lx2160a-rdb/readme.txt        | 34 +++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash b/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
index 367a03c1ce..24c30057e3 100644
--- a/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
+++ b/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
@@ -1,2 +1,4 @@
 # Locally computed
 sha256  b807d8bf190b7c46b4260729b4bbe2f7df83cd1086edcb181d66595ae6598d23  arm-trusted-firmware-v2.15.0-git4.tar.gz
+# From https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7:
+sha256  a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6  mbedtls-3.6.7.tar.bz2
diff --git a/board/freescale/lx2160a-rdb/post-build.sh b/board/freescale/lx2160a-rdb/post-build.sh
index 4042bf9c7e..b5d7c12ba6 100755
--- a/board/freescale/lx2160a-rdb/post-build.sh
+++ b/board/freescale/lx2160a-rdb/post-build.sh
@@ -9,3 +9,9 @@ ln -sf dpc-usxgmii.dtb "$TARGET_DIR/boot/dpc.dtb"
 ln -sf dpl-eth.19.dtb "$TARGET_DIR/boot/dpl.dtb"
 sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/extlinux.conf" > "$TARGET_DIR/boot/extlinux/extlinux.conf"
 sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/genimage.cfg" > "$BINARIES_DIR/genimage.cfg"
+
+if grep -q "^BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y" "$BR2_CONFIG"; then
+    sed -i -e 's/"bl2_sd.pbl"/"bl2_sd_sec.pbl"/' \
+        -e 's/"fip_ddr.bin"/"ddr_fip_sec.bin"/' \
+        "$BINARIES_DIR/genimage.cfg"
+fi
diff --git a/board/freescale/lx2160a-rdb/readme.txt b/board/freescale/lx2160a-rdb/readme.txt
index f0c03a5958..90a5964ab1 100644
--- a/board/freescale/lx2160a-rdb/readme.txt
+++ b/board/freescale/lx2160a-rdb/readme.txt
@@ -39,6 +39,40 @@ board/freescale/lx2160ardb/readme.txt.
 For details about the medium image layout, see the definition in
 board/freescale/lx2160a-rdb/genimage.cfg.
 
+Secure boot
+===========
+
+With BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y, TF-A signs the
+boot images with the NXP Code Signing Tool (host-qoriq-cst):
+  - the PBI and BL2 get a CSF header signed with the SRK key; the
+    BootROM checks it against the SRKH fuses;
+  - BL31, BL33 and the DDR PHY firmware get X.509 certificates; BL2
+    checks them against the ROT key hash embedded in BL2.
+
+Set the images to install:
+
+  BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="fip.bin bl2_sd_sec.pbl ddr_fip_sec.bin"
+
+Set the keys to use:
+  - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR: directory
+    containing srk.pri and srk.pub;
+  - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR:
+    directory containing rot.pem, trusted_world.pem,
+    non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+
+If these directories are empty, development keys are generated in the
+TF-A build directory. For the CSF headers, custom CST input files can
+be used instead of the SRK keys directory.
+
+The post-build script then puts the signed images in sdcard.img.
+
+When changing any of these options, rebuild TF-A from scratch:
+
+  make arm-trusted-firmware-dirclean && make
+
+While the ITS fuse is not blown, a BootROM authentication failure is not
+fatal: the board still boots, with the SNVS in Non-Secure state.
+
 Known limitations
 =================
 
-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A

[Leo Denieul]

Correction on the test description of the cover letter: with wrong
SRK keys, the BootROM reports the SRK hash mismatch (SNVS Non-Secure,
error code in SCRATCHRW3) and the boot continues as ITS is not blown.
Separately, tampered BL31/BL33 X.509 certificates are rejected by BL2.

Leo
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/2] board/freescale/lx2160a-rdb: add secure boot support

[Vincent Jardin via buildroot]

Hi Leo,

> +if grep -q "^BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y" "$BR2_CONFIG"; then
> +    sed -i -e 's/"bl2_sd.pbl"/"bl2_sd_sec.pbl"/' \
> +        -e 's/"fip_ddr.bin"/"ddr_fip_sec.bin"/' \
> +        "$BINARIES_DIR/genimage.cfg"
> +fi

What if the names of those files are different ? since their names
are not enforced and can be freely set with:

BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="fip.bin bl2_sd_sec.pbl ddr_fip_sec.bin"

If you assume those names, something should check or enforce this assumption,
which I believe is not a good idea.

Maybe the alternative is to have 2 specific BR2 ATF settings respectively
for bl2_sd_sec.pbl and for ddr_fip_sec.bin.

Best regards,
  Vincent
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot