Skip to content

Commit 2262400

Browse files
lauracarlessoaescolar
lauracarlesso
authored and
aescolar
committed
boards: infineon: Documenting Secure Boot for Edge boards
For edge boards, the extended boot has secure boot disabled by default. To enable Secure Boot the user is required to reprovision the device with steps documented in an application note 237849. Added documentation and guidance in the boards index.rst files. Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Laura Carlesso <laura.carlesso@infineon.com>
1 parent 4288af5 commit 2262400

2 files changed

Lines changed: 124 additions & 0 deletions

File tree

‎boards/infineon/kit_pse84_ai/doc/index.rst‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,71 @@ to set the CMake variable ``OPENOCD``.
120120
Once the gdb console starts after executing the west debug command, you may now set breakpoints and
121121
perform other standard GDB debugging on the PSOC E84 CM33 core.
122122

123+
Secure Boot
124+
***********
125+
126+
The PSOC™ Edge E84 MCU includes an extended boot stage in ROM that, on reset, jumps to the first
127+
application image. On the KIT-PSE84-AI the destination is selected by the level of the boot pin,
128+
which by default is pulled HIGH and causes the ROM extended boot to jump to the first application
129+
located in **external flash**.
130+
131+
To make the ROM extended boot jump to a first application located in internal **RRAM**, one of the
132+
following must be done:
133+
134+
- **Hardware rework**: remove resistor ``R188`` and populate resistor ``R187`` to pull the boot
135+
pin LOW.
136+
- **Reprovisioning (no hardware rework)**: reprovision the device using the same flow described
137+
in `Enabling Secure Boot`_ below, but customize the generated OEM policy JSON to ignore the
138+
boot pin state. While following the provisioning steps, after the OEM key pair has been
139+
generated, set ``oem_alt_boot`` to ``false`` in
140+
:file:`policy/policy_oem_provisioning.json` in the project, before provisioning the kit.
141+
142+
In either case, the boot behavior is then locked to booting from RRAM and must be reverted
143+
(reattaching ``R188`` / removing ``R187``, or reprovisioning again with ``oem_alt_boot`` set back
144+
to ``true``) to re-enable booting from external flash.
145+
146+
In all cases the first application image must be in MCUboot image format, i.e. it must be
147+
preceded by an MCUboot image header (magic number, header size, vector table address, image size)
148+
and followed by the trailer with the hash/signature TLVs. Out of the box, the device is **not**
149+
provisioned for secure boot, so the ROM extended boot only checks the image format and hash; no
150+
cryptographic signature verification is performed against a provisioned key.
151+
152+
The MCUboot image format is produced automatically by the
153+
:file:`soc/infineon/edge/pse84/pse84_metadata.cmake` helper
154+
``pse84_add_metadata_secure_hex()``, which invokes ``imgtool sign`` with the header address,
155+
header size and slot size derived from the devicetree memory map. By default this helper does not
156+
pass a signing key, which is sufficient for a non-provisioned device.
157+
158+
Enabling Secure Boot
159+
====================
160+
161+
To enable real signature verification by the ROM extended boot, the device must be reprovisioned.
162+
Follow sections **2.2.1**, **2.2.2** and **2.2.3** of the
163+
`PSOC™ Edge Security Getting Started Application Note`_ to:
164+
165+
#. Generate (or import) the OEM signing key pair.
166+
#. Provision the device with the corresponding public key and lifecycle transition.
167+
#. Program the desired security counter / anti-rollback value.
168+
169+
After the device has been reprovisioned, the
170+
``pse84_add_metadata_secure_hex()`` function in
171+
:file:`soc/infineon/edge/pse84/pse84_metadata.cmake` must be updated so that ``imgtool sign``
172+
also receives the signing key and a security counter. The relevant additions are:
173+
174+
.. code-block:: none
175+
176+
${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version "0.0.0+0"
177+
--header-size ${header_size} --erased-val 0xff --pad-header
178+
--slot-size ${slot_size} --hex-addr ${header_addr}
179+
--key <oem-private-key-file>
180+
--security-counter <value>
181+
${INPUT_FILE} ${OUTPUT_FILE}
182+
183+
Where ``<oem-private-key-file>`` is the path to the OEM private key file (e.g. a ``.pem``
184+
file) matching the public key provisioned into the device, and ``<value>`` is the security
185+
counter assigned during provisioning. Without these additional parameters, images built for a
186+
provisioned device will be rejected by the ROM extended boot.
187+
123188
References
124189
**********
125190

@@ -134,6 +199,9 @@ References
134199
.. _kit_pse84_ai User Manual Website:
135200
https://www.infineon.com/assets/row/public/documents/30/44/infineon-kit-pse84-ai-user-guide-usermanual-en.pdf
136201

202+
.. _PSOC™ Edge Security Getting Started Application Note:
203+
https://www.infineon.com/assets/row/public/documents/30/42/infineon-an237849-getting-started-psoc-edge-security-applicationnotes-en.pdf
204+
137205
.. _ModusToolbox™:
138206
https://softwaretools.infineon.com/tools/com.ifx.tb.tool.modustoolboxsetup
139207

‎boards/infineon/kit_pse84_eval/doc/index.rst‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,59 @@ to set the CMake variable ``OPENOCD``.
121121
Once the gdb console starts after executing the west debug command, you may now set breakpoints and
122122
perform other standard GDB debugging on the PSOC E84 CM33 core.
123123

124+
Secure Boot
125+
***********
126+
127+
The PSOC™ Edge E84 MCU includes an extended boot stage in ROM that, on reset, jumps to the first
128+
application image. The destination is selected by the on-board ``BOOT SW``:
129+
130+
- ``BOOT SW`` **OFF**: the ROM extended boot jumps to the first application located in internal
131+
RRAM.
132+
- ``BOOT SW`` **ON**: the ROM extended boot jumps to the first application located in external
133+
flash.
134+
135+
In both cases the first application image must be in MCUboot image format, i.e. it must be
136+
preceded by an MCUboot image header (magic number, header size, vector table address, image size)
137+
and followed by the trailer with the hash/signature TLVs. Out of the box, the device is **not**
138+
provisioned for secure boot, so the ROM extended boot only checks the image format and hash; no
139+
cryptographic signature verification is performed against a provisioned key.
140+
141+
The MCUboot image format is produced automatically by the
142+
:file:`soc/infineon/edge/pse84/pse84_metadata.cmake` helper
143+
``pse84_add_metadata_secure_hex()``, which invokes ``imgtool sign`` with the header address,
144+
header size and slot size derived from the devicetree memory map. By default this helper does not
145+
pass a signing key, which is sufficient for a non-provisioned device.
146+
147+
Enabling Secure Boot
148+
====================
149+
150+
To enable real signature verification by the ROM extended boot, the device must be reprovisioned.
151+
Follow sections **2.2.1**, **2.2.2** and **2.2.3** of the
152+
`PSOC™ Edge Security Getting Started Application Note`_ to:
153+
154+
#. Generate (or import) the OEM signing key pair.
155+
#. Provision the device with the corresponding public key and lifecycle transition.
156+
#. Program the desired security counter / anti-rollback value.
157+
158+
After the device has been reprovisioned, the
159+
``pse84_add_metadata_secure_hex()`` function in
160+
:file:`soc/infineon/edge/pse84/pse84_metadata.cmake` must be updated so that ``imgtool sign``
161+
also receives the signing key and a security counter. The relevant additions are:
162+
163+
.. code-block:: none
164+
165+
${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version "0.0.0+0"
166+
--header-size ${header_size} --erased-val 0xff --pad-header
167+
--slot-size ${slot_size} --hex-addr ${header_addr}
168+
--key <oem-private-key-file>
169+
--security-counter <value>
170+
${INPUT_FILE} ${OUTPUT_FILE}
171+
172+
Where ``<oem-private-key-file>`` is the path to the OEM private key file (e.g. a ``.pem``
173+
file) matching the public key provisioned into the device, and ``<value>`` is the security
174+
counter assigned during provisioning. Without these additional parameters, images built for a
175+
provisioned device will be rejected by the ROM extended boot.
176+
124177
References
125178
**********
126179

@@ -135,6 +188,9 @@ References
135188
.. _kit_pse84_eval User Manual Website:
136189
https://www.infineon.com/assets/row/public/documents/30/44/infineon-kit-pse84-eval-qsg-usermanual-en.pdf
137190

191+
.. _PSOC™ Edge Security Getting Started Application Note:
192+
https://www.infineon.com/assets/row/public/documents/30/42/infineon-an237849-getting-started-psoc-edge-security-applicationnotes-en.pdf
193+
138194
.. _ModusToolbox™:
139195
https://softwaretools.infineon.com/tools/com.ifx.tb.tool.modustoolboxsetup
140196

0 commit comments

Comments
 (0)