andrius
/
arm-trusted-firmware
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qemu: Support optional encryption of BL31 and BL32 images 

Enable encryption IO layer to be stacked above FIP IO layer for optional
encryption of Bl31 and BL32 images in case ENCRYPT_BL31 or ENCRYPT_BL32
build flag is set.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I24cba64728861e833abffc3d5d9807599c49feb6
This commit is contained in:
Sumit Garg 2019-11-14 17:34:56 +05:30
parent a886bbeceb
commit 518577627e
3 changed files with 82 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
plat/qemu/common/qemu_io_storage.c
View File

@ -12,6 +12,7 @@
#include <common/bl_common.h>
#include <common/debug.h>
#include <drivers/io/io_driver.h>
#include <drivers/io/io_encrypted.h>
#include <drivers/io/io_fip.h>
#include <drivers/io/io_memmap.h>
#include <drivers/io/io_semihosting.h>
@ -47,6 +48,10 @@ static const io_dev_connector_t *memmap_dev_con;
static uintptr_t memmap_dev_handle;
static const io_dev_connector_t *sh_dev_con;
static uintptr_t sh_dev_handle;
#ifndef DECRYPTION_SUPPORT_none
static const io_dev_connector_t *enc_dev_con;
static uintptr_t enc_dev_handle;
#endif
static const io_block_spec_t fip_block_spec = {
.offset = PLAT_QEMU_FIP_BASE,
@ -172,10 +177,11 @@ static const io_file_spec_t sh_file_spec[] = {
#endif /* TRUSTED_BOARD_BOOT */
};
static int open_fip(const uintptr_t spec);
static int open_memmap(const uintptr_t spec);
#ifndef DECRYPTION_SUPPORT_none
static int open_enc_fip(const uintptr_t spec);
#endif
struct plat_io_policy {
uintptr_t *dev_handle;
@ -190,16 +196,46 @@ static const struct plat_io_policy policies[] = {
(uintptr_t)&fip_block_spec,
open_memmap
},
[ENC_IMAGE_ID] = {
&fip_dev_handle,
(uintptr_t)NULL,
open_fip
},
[BL2_IMAGE_ID] = {
&fip_dev_handle,
(uintptr_t)&bl2_uuid_spec,
open_fip
},
#if ENCRYPT_BL31 && !defined(DECRYPTION_SUPPORT_none)
[BL31_IMAGE_ID] = {
&enc_dev_handle,
(uintptr_t)&bl31_uuid_spec,
open_enc_fip
},
#else
[BL31_IMAGE_ID] = {
&fip_dev_handle,
(uintptr_t)&bl31_uuid_spec,
open_fip
},
#endif
#if ENCRYPT_BL32 && !defined(DECRYPTION_SUPPORT_none)
[BL32_IMAGE_ID] = {
&enc_dev_handle,
(uintptr_t)&bl32_uuid_spec,
open_enc_fip
},
[BL32_EXTRA1_IMAGE_ID] = {
&enc_dev_handle,
(uintptr_t)&bl32_extra1_uuid_spec,
open_enc_fip
},
[BL32_EXTRA2_IMAGE_ID] = {
&enc_dev_handle,
(uintptr_t)&bl32_extra2_uuid_spec,
open_enc_fip
},
#else
[BL32_IMAGE_ID] = {
&fip_dev_handle,
(uintptr_t)&bl32_uuid_spec,
@ -215,6 +251,7 @@ static const struct plat_io_policy policies[] = {
(uintptr_t)&bl32_extra2_uuid_spec,
open_fip
},
#endif
[BL33_IMAGE_ID] = {
&fip_dev_handle,
(uintptr_t)&bl33_uuid_spec,
@ -271,7 +308,7 @@ static int open_fip(const uintptr_t spec)
/* See if a Firmware Image Package is available */
result = io_dev_init(fip_dev_handle, (uintptr_t)FIP_IMAGE_ID);
if (result == 0) {
if (result == 0 && spec != (uintptr_t)NULL) {
result = io_open(fip_dev_handle, spec, &local_image_handle);
if (result == 0) {
VERBOSE("Using FIP\n");
@ -281,6 +318,25 @@ static int open_fip(const uintptr_t spec)
return result;
}
#ifndef DECRYPTION_SUPPORT_none
static int open_enc_fip(const uintptr_t spec)
{
int result;
uintptr_t local_image_handle;
/* See if an encrypted FIP is available */
result = io_dev_init(enc_dev_handle, (uintptr_t)ENC_IMAGE_ID);
if (result == 0) {
result = io_open(enc_dev_handle, spec, &local_image_handle);
if (result == 0) {
VERBOSE("Using encrypted FIP\n");
io_close(local_image_handle);
}
}
return result;
}
#endif
static int open_memmap(const uintptr_t spec)
{
int result;
@ -333,6 +389,15 @@ void plat_qemu_io_setup(void)
&memmap_dev_handle);
assert(io_result == 0);
#ifndef DECRYPTION_SUPPORT_none
io_result = register_io_dev_enc(&enc_dev_con);
assert(io_result == 0);
io_result = io_dev_open(enc_dev_con, (uintptr_t)NULL,
&enc_dev_handle);
assert(io_result == 0);
#endif
/* Register the additional IO devices on this platform */
io_result = register_io_dev_sh(&sh_dev_con);
assert(io_result == 0);

2
plat/qemu/qemu/include/platform_def.h
View File

@ -172,7 +172,7 @@
#define PLAT_VIRT_ADDR_SPACE_SIZE (1ULL << 32)
#define MAX_MMAP_REGIONS 11
#define MAX_XLAT_TABLES 6
#define MAX_IO_DEVICES 3
#define MAX_IO_DEVICES 4
#define MAX_IO_HANDLES 4
/*

13
plat/qemu/qemu/platform.mk
View File

@ -128,6 +128,11 @@ ifeq ($(add-lib-optee),yes)
BL2_SOURCES += lib/optee/optee_utils.c
endif
ifneq (${DECRYPTION_SUPPORT},none)
BL1_SOURCES += drivers/io/io_encrypted.c
BL2_SOURCES += drivers/io/io_encrypted.c
endif
QEMU_GICV2_SOURCES := drivers/arm/gic/v2/gicv2_helpers.c \
drivers/arm/gic/v2/gicv2_main.c \
drivers/arm/gic/common/gic_common.c \
@ -165,11 +170,19 @@ endif
# Add the build options to pack Trusted OS Extra1 and Trusted OS Extra2 images
# in the FIP if the platform requires.
ifneq ($(BL32_EXTRA1),)
ifneq (${DECRYPTION_SUPPORT},none)
$(eval $(call TOOL_ADD_IMG,bl32_extra1,--tos-fw-extra1,,$(ENCRYPT_BL32)))
else
$(eval $(call TOOL_ADD_IMG,bl32_extra1,--tos-fw-extra1))
endif
endif
ifneq ($(BL32_EXTRA2),)
ifneq (${DECRYPTION_SUPPORT},none)
$(eval $(call TOOL_ADD_IMG,bl32_extra2,--tos-fw-extra2,,$(ENCRYPT_BL32)))
else
$(eval $(call TOOL_ADD_IMG,bl32_extra2,--tos-fw-extra2))
endif
endif
SEPARATE_CODE_AND_RODATA := 1
ENABLE_STACK_PROTECTOR := 0