Skip to content

Commit 281d80a

Browse files
calebofearthcalebofearth
committed
Merge remote-tracking branch 'origin/main' into copilot/update-readme-subsystem-components
2 parents d39edd4 + f0d0ad7 commit 281d80a

6 files changed

Lines changed: 55 additions & 20 deletions

‎CODEOWNERS‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
CaliptraChecklistAndEvaluationMethodology.md @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou @ericeilertson @JohnTraverAmd @syncsrc-nv @zhalvorsen
2-
CaliptraTrademarkAuditProcess.md @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou @ericeilertson @JohnTraverAmd @syncsrc-nv @zhalvorsen
3-
CaliptraTrademarkPolicy.md @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou @ericeilertson @JohnTraverAmd @syncsrc-nv @zhalvorsen
4-
CaliptraWGTechnicalCharter.md @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou
1+
/doc/trademark/ @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou @ericeilertson @JohnTraverAmd @syncsrc-nv @zhalvorsen
52
CODEOWNERS @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou
63
LICENSE @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou
74
MAINTAINERS.md @andreslagarcavilla @Bryankel @Jhprabhu @nvpachou

‎doc/Caliptra.md‎

Lines changed: 54 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -577,21 +577,49 @@ Caliptra ROM generates the Alias<sub>FMC</sub> certificate and endorses it with
577577
| tcg-dice-MultiTcbInfo | Flags | NOT_CONFIGURED if lifecycle is unprovisioned
578578
| | | NOT_SECURE if lifecycle is manufacturing
579579
| | | DEBUG if not debug locked
580-
| | SVN | [0] fuse SVN
581-
| | | [1] firmware SVN
580+
| | SVN | [2] Image Bundle FW SVN
582581
| | FWIDs | [0] SHA384 digest of
583-
| | | lifecycle state
584-
| | | debug locked state
585-
| | | anti-rollback disable fuse
586-
| | | ECDSA vendor public key index fuse
587-
| | | LMS vendor public key index fuse
588-
| | | LMS verification enable fuse
589-
| | | boolean indicating whether owner public key hash is in fuses
590-
| | | vendor public key hash
591-
| | | owner public key hash
592-
| | | [1] SHA384 digest of FMC
593-
594-
Caliptra does not generate an Alias<sub>FMC</sub> CSR. Owners that wish to endorse Alias<sub>FMC</sub> must do so with proprietary flows.
582+
| | | Owner Public Key Hash (sha-384)
583+
| | | Owner public key Hash in fuses flag (u8) // Flag to indicate whether Owner Pub Key Hash is Fused
584+
| | | Anti-rollback disable Fuse (u8)
585+
| | | ECC Revoke Fuse (u8)
586+
| | | LMS Revoke Fuse (u32)
587+
| | | ML-DSA Revoke Fuse (u8)
588+
| | | Image Bundle FW min SVN Fuse - min SVN value (u8)
589+
| | | Auth Manifest SoC min SVN Fuse - min SVN value (u8)
590+
| | | Auth Manifest SoC max SVN Fuse - max SVN value (u8)
591+
| | | [1] SHA384 digest of
592+
| | | Vendor Public Key Hash Fuse (sha-384)
593+
| | | LMS Verify/PQC Type Fuse (u8)
594+
| | | Lifecycle State Wire (u8)
595+
| | | Debug Lock Wire (u8)
596+
| | | Image Bundle FW SVN from cold boot (u8)
597+
| | | PK Index ECC (u8)
598+
| | | PK Index PQC (u8)
599+
| | | [2] SHA384 digest of FMC
600+
| |Type | [0] CALIPTRA_2_X_FUSE_OWNER_INFO
601+
| | | [1] CALIPTRA_2_X_FUSE_VENDOR_INFO
602+
| | | [2] CALIPTRA_2_X_FMC_FIRMWARE_INFO
603+
604+
#### MultiTcbInfo Extension
605+
606+
The MultiTcbInfo extension contains three TCBInfo entries, each corresponding to a unique target environment, attested by Caliptra ROM:
607+
608+
* **TCBInfo[0] - Platform Owner Fuse Configuration**
609+
* Type: CALIPTRA_2_X_FUSE_OWNER_INFO
610+
* Corresponds to the fuse configuration owned by the platform owner
611+
* Scope: Owner-controlled security settings (key hashes, revocation, anti-rollback)
612+
613+
* **TCBInfo[1] - Platform Vendor Fuse Configuration**
614+
* Type: CALIPTRA_2_X_FUSE_VENDOR_INFO
615+
* Corresponds to the fuse configuration owned by the platform vendor (Caliptra integrator)
616+
* Scope: Vendor-controlled security settings (vendor key, lifecycle, debug state)
617+
618+
* **TCBInfo[2] - FMC Firmware Measurement**
619+
* Type: CALIPTRA_2_X_FMC_FIRMWARE_INFO
620+
* Corresponds to the digest of the FMC
621+
* Scope: First Mutable Code firmware digest
622+
* SVN: Firmware security version number
595623

596624
### Alias<sub>RT</sub> certificate
597625

@@ -622,9 +650,19 @@ Caliptra FMC generates the Alias<sub>RT</sub> certificate and endorses it with t
622650
| Authority Key Identifier | - | First 20 bytes of SHA256 hash of DER-formatted FMC Alias public key in uncompressed form
623651
| tcg-dice-Ueid | ueid | UEID specified by IDevID attribute fuses
624652
| tcg-dice-TcbInfo | SVN | Firmware SVN
625-
| | FWIDs | [0] SHA384 digest of RT
653+
| | FWIDs | SHA384 digest of RT
654+
| | Type | CALIPTRA_2_X_RT_FIRMWARE_INFO
655+
656+
#### TcbInfo Extension
657+
658+
The TcbInfo extension corresponds to the Caliptra Runtime Firmware target environment, attested by Caliptra FMC:
659+
660+
* **TCBInfo - RT Firmware Measurement**
661+
* Type: CALIPTRA_2_X_RT_FIRMWARE_INFO
662+
* Corresponds to the digest of the Caliptra Runtime Firmware
663+
* Scope: Caliptra Runtime Firmware
664+
* SVN: Firmware security version number
626665

627-
Caliptra does not generate an Alias<sub>RT</sub> CSR. Owners that wish to endorse Alias<sub>RT</sub> must do so with proprietary flows.
628666

629667
### DPE certificate
630668

‎doc/trademark/Caliptra Conformance Program - Terms and Conditions.pdf‎

-18.5 KB
Binary file not shown.

CaliptraChecklistAndEvaluationMethodology.md renamed to doc/trademark/CaliptraChecklistAndEvaluationMethodology.md

File renamed without changes.

CaliptraTrademarkAuditProcess.md renamed to doc/trademark/CaliptraTrademarkAuditProcess.md

File renamed without changes.

CaliptraTrademarkPolicy.md renamed to doc/trademark/CaliptraTrademarkPolicy.md

File renamed without changes.

0 commit comments

Comments
 (0)