Skip to content

Commit

Permalink
Restyled by whitespace
Browse files Browse the repository at this point in the history
Restyled by clang-format
Restyled by gn
Restyled by prettier-markdown
Restyled by autopep8
Restyled by isort
  • Loading branch information
restyled-commits authored and marius-alex-tache committed Nov 28, 2023
1 parent 8144867 commit 9f167d2
Show file tree
Hide file tree
Showing 15 changed files with 180 additions and 150 deletions.
58 changes: 35 additions & 23 deletions docs/guides/nxp_manufacturing_flow.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,10 @@ ninja -C out spake2p

### a. Certificates

To generate the different certificates, NXP provides a Python script `scripts/tools/nxp/generate_certs.py`.
This script will always generate the PAI and DAC certificates/keys.
It can also generate the Certification Declaration and the PAA certificate/key depending on the parameters.
To generate the different certificates, NXP provides a Python script
`scripts/tools/nxp/generate_certs.py`. This script will always generate the PAI
and DAC certificates/keys. It can also generate the Certification Declaration
and the PAA certificate/key depending on the parameters.

| Parameter | Description | Type | Required |
| ------------------ | ------------------------------------------------------------------------------------------------- | ---------------------- | -------- |
Expand All @@ -53,19 +54,22 @@ It can also generate the Certification Declaration and the PAA certificate/key d
| `--valid_from` | The start date for the certificate's validity period. | string | No |
| `--lifetime` | The lifetime for the certificates, in whole days. | string | No |

You can also run the following command to get more details on the parameters and their default value (if applicable):
You can also run the following command to get more details on the parameters and
their default value (if applicable):

```shell
python scripts/tools/nxp/generate_certs.py --help
```

Example of a command that will generate CD, PAA, PAI and DAC certificates and keys in both .pem and .der formats:
Example of a command that will generate CD, PAA, PAI and DAC certificates and
keys in both .pem and .der formats:

```shell
python scripts/tools/nxp/generate_certs.py --gen_cd --cd_type 1 --chip_cert_path ./out/chip-cert --vendor_id 0x1037 --product_id 0xA220 --vendor_name "NXP Semiconductors" --product_name all-clusters-app --device_type 65535 --output .
```

> **Note**: the commands provided in this guide are just for the example and shall be adapted to your use case accordingly
> **Note**: the commands provided in this guide are just for the example and
> shall be adapted to your use case accordingly
### c. Provisioning data

Expand Down Expand Up @@ -150,7 +154,8 @@ location given by `__MATTER_FACTORY_DATA_START`, using `JLink`:
loadfile factory_data.bin 0xf4000
```

where `0xf4000` is the value of `__MATTER_FACTORY_DATA_START` in the corresponding .map file (can be different if using a custom linker script).
where `0xf4000` is the value of `__MATTER_FACTORY_DATA_START` in the
corresponding .map file (can be different if using a custom linker script).

For the **RT1060**, **RT1170** and **RW61X** platform, the binary needs to be
written using `MCUXpresso Flash Tool GUI` at the address value corresponding to
Expand Down Expand Up @@ -195,38 +200,45 @@ Also, demo **DAC**, **PAI** and **PAA** certificates needed in case

Supported platforms:

- K32W1 - `src/plaftorm/nxp/k32w/k32w1/FactoryDataProviderImpl.h`
- K32W1 - `src/plaftorm/nxp/k32w/k32w1/FactoryDataProviderImpl.h`

For platforms that have a secure subsystem (`SSS`), the DAC private key can be converted
to an encrypted blob. This blob will overwrite the DAC private key in factory data and
will be imported in the `SSS` at initialization, by the factory data provider instance.
For platforms that have a secure subsystem (`SSS`), the DAC private key can be
converted to an encrypted blob. This blob will overwrite the DAC private key in
factory data and will be imported in the `SSS` at initialization, by the factory
data provider instance.

The conversion process shall happen at manufacturing time and should be run one time only:
The conversion process shall happen at manufacturing time and should be run one
time only:

- Write factory data binary.
- Build the application with `chip_with_factory_data=1 chip_convert_dac_private_key=1` set.
- Write the application to the board and let it run.
- Write factory data binary.
- Build the application with
`chip_with_factory_data=1 chip_convert_dac_private_key=1` set.
- Write the application to the board and let it run.

After the conversion process:

- Make sure the application is built with `chip_with_factory_data=1`, but without
`chip_convert_dac_private_key` arg, since conversion already happened.
- Write the application to the board.
- Make sure the application is built with `chip_with_factory_data=1`, but
without `chip_convert_dac_private_key` arg, since conversion already
happened.
- Write the application to the board.

If you are using Jlink, you can see a conversion script example in:

```shell
./scripts/tools/nxp/factory_data_generator/k32w1/example_convert_dac_private_key.jlink
```

Factory data should now contain a corresponding encrypted blob instead of the DAC private key.
Factory data should now contain a corresponding encrypted blob instead of the
DAC private key.

If an encrypted blob of the DAC private key is already available (e.g. obtained previously, using
other methods), then the conversion process shall be skipped. Instead, option `--dac_key_use_sss_blob`
can be used in the factory data generation command:
If an encrypted blob of the DAC private key is already available (e.g. obtained
previously, using other methods), then the conversion process shall be skipped.
Instead, option `--dac_key_use_sss_blob` can be used in the factory data
generation command:

```shell
python3 ./scripts/tools/nxp/factory_data_generator/generate.py -i 10000 -s UXKLzwHdN3DZZLBaL2iVGhQi/OoQwIwJRQV4rpEalbA= -p 14014 -d 1000 --vid "0x1037" --pid "0xA221" --vendor_name "NXP Semiconductors" --product_name "Lighting app" --serial_num "12345678" --date "2023-01-01" --hw_version 1 --hw_version_str "1.0" --cert_declaration ./Chip-Test-CD-1037-A221.der --dac_cert ./Chip-DAC-NXP-1037-A221-Cert.der --dac_key ./Chip-DAC-NXP-1037-A221-Key-encrypted-blob.bin --pai_cert ./Chip-PAI-NXP-1037-A221-Cert.der --spake2p_path ./out/spake2p --unique_id "00112233445566778899aabbccddeeff" --dac_key_use_sss_blob --out ./factory_data_with_blob.bin
```

Please note that `--dac_key` now points to a binary file that contains the encrypted blob.
Please note that `--dac_key` now points to a binary file that contains the
encrypted blob.
14 changes: 9 additions & 5 deletions examples/contact-sensor-app/nxp/k32w/k32w0/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -463,14 +463,18 @@ Optionally, add the following defines:
#### Simple hash verification
When secure boot is not used, a simple hash can be appended at the end of the image
for integrity check. Applications should be built with `chip_simple_hash_verification=1`.
When secure boot is not used, a simple hash can be appended at the end of the
image for integrity check. Applications should be built with
`chip_simple_hash_verification=1`.
To support simple hash verification feature, the SSBL project must be compiled
with:
To support simple hash verification feature, the SSBL project must be compiled with:
- `gSimpleHashVerification=1`
and update the post-build command to use simple hash verification instead of the default
options. Go to `Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
and update the post-build command to use simple hash verification instead of the
default options. Go to
`Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
`Edit` under `Post-build steps` subsection. The command should look similar to:
![SSBL_SIMPLE_HASH_VERIFICATION](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_simple_hash.JPG)
Expand Down
7 changes: 4 additions & 3 deletions examples/contact-sensor-app/nxp/k32w/k32w0/main/AppTask.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -258,10 +258,11 @@ CHIP_ERROR AppTask::Init()
/* SSBL will always be seen as booting from address 0, thanks to the remapping mechanism.
* This means the SSBL version will always offset from address 0. */
extern uint32_t __MATTER_SSBL_VERSION_START[];
K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t*) __MATTER_SSBL_VERSION_START), (uint32_t)__MATTER_SSBL_VERSION_START);
K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t *) __MATTER_SSBL_VERSION_START),
(uint32_t) __MATTER_SSBL_VERSION_START);
#endif

auto& bleManager = chip::DeviceLayer::Internal::BLEMgrImpl();
auto & bleManager = chip::DeviceLayer::Internal::BLEMgrImpl();
bleManager.RegisterAppCallbacks(app_gap_callback, app_gatt_callback);

return err;
Expand Down Expand Up @@ -865,7 +866,7 @@ void AppTask::DispatchEvent(AppEvent * aEvent)
else
#endif

if (aEvent->Handler)
if (aEvent->Handler)
{
aEvent->Handler(aEvent);
}
Expand Down
14 changes: 9 additions & 5 deletions examples/lighting-app/nxp/k32w/k32w0/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -480,14 +480,18 @@ Optionally, add the following defines:

#### Simple hash verification

When secure boot is not used, a simple hash can be appended at the end of the image
for integrity check. Applications should be built with `chip_simple_hash_verification=1`.
When secure boot is not used, a simple hash can be appended at the end of the
image for integrity check. Applications should be built with
`chip_simple_hash_verification=1`.

To support simple hash verification feature, the SSBL project must be compiled
with:

To support simple hash verification feature, the SSBL project must be compiled with:
- `gSimpleHashVerification=1`

and update the post-build command to use simple hash verification instead of the default
options. Go to `Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
and update the post-build command to use simple hash verification instead of the
default options. Go to
`Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
`Edit` under `Post-build steps` subsection. The command should look similar to:

![SSBL_SIMPLE_HASH_VERIFICATION](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_simple_hash.JPG)
Expand Down
3 changes: 2 additions & 1 deletion examples/lighting-app/nxp/k32w/k32w0/main/AppTask.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,8 @@ CHIP_ERROR AppTask::Init()
/* SSBL will always be seen as booting from address 0, thanks to the remapping mechanism.
* This means the SSBL version will always offset from address 0. */
extern uint32_t __MATTER_SSBL_VERSION_START[];
K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t*) __MATTER_SSBL_VERSION_START), (uint32_t)__MATTER_SSBL_VERSION_START);
K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t *) __MATTER_SSBL_VERSION_START),
(uint32_t) __MATTER_SSBL_VERSION_START);
#endif

return err;
Expand Down
1 change: 1 addition & 0 deletions scripts/tools/nxp/factory_data_generator/generate.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
# Global variable for hash ID
hash_id = "CE47BA5E"


def set_logger():
stdout_handler = logging.StreamHandler(stream=sys.stdout)
logging.basicConfig(
Expand Down
22 changes: 11 additions & 11 deletions scripts/tools/nxp/generate_certs.py
Original file line number Diff line number Diff line change
Expand Up @@ -194,17 +194,17 @@ def allow_any_int(i): return int(i, 0)
log.basicConfig(format='[%(levelname)s] %(message)s', level=log.INFO)

gen_test_certs(args.chip_cert_path,
args.output,
args.vendor_id,
args.product_id,
args.vendor_name + " " + args.product_name,
args.gen_cd,
args.cd_type,
args.device_type,
args.paa_cert,
args.paa_key,
args.valid_from,
args.lifetime)
args.output,
args.vendor_id,
args.product_id,
args.vendor_name + " " + args.product_name,
args.gen_cd,
args.cd_type,
args.device_type,
args.paa_cert,
args.paa_key,
args.valid_from,
args.lifetime)


if __name__ == "__main__":
Expand Down
Loading

0 comments on commit 9f167d2

Please sign in to comment.