qemu: Add support for Trusted Board Boot
This patch adds support for TBB to qemu. An RSA ROT keypair is generated at build time and is included into BL1/BL2. The key and content certificates are read over semihosting. Fixes ARM-software/tf-issues#526 Signed-off-by: Michalis Pappas <mpappas@fastmail.fm>
This commit is contained in:
Michalis Pappas
parent
ccd0c24cf8
commit
5cc34b10b0
|
|
@ -13,6 +13,7 @@ ifeq ($(NEED_BL32),yes)
|
|||
$(eval $(call add_define,QEMU_LOAD_BL32))
|
||||
endif
|
||||
|
||||
PLAT_PATH := plat/qemu/
|
||||
PLAT_INCLUDES := -Iinclude/plat/arm/common/ \
|
||||
-Iinclude/plat/arm/common/aarch64/ \
|
||||
-Iplat/qemu/include \
|
||||
|
|
@ -36,6 +37,51 @@ include lib/xlat_tables_v2/xlat_tables.mk
|
|||
PLAT_BL_COMMON_SOURCES += ${XLAT_TABLES_LIB_SRCS}
|
||||
endif
|
||||
|
||||
ifneq (${TRUSTED_BOARD_BOOT},0)
|
||||
|
||||
include drivers/auth/mbedtls/mbedtls_crypto.mk
|
||||
include drivers/auth/mbedtls/mbedtls_x509.mk
|
||||
|
||||
USE_TBBR_DEFS := 1
|
||||
|
||||
AUTH_SOURCES := drivers/auth/auth_mod.c \
|
||||
drivers/auth/crypto_mod.c \
|
||||
drivers/auth/img_parser_mod.c \
|
||||
drivers/auth/tbbr/tbbr_cot.c
|
||||
|
||||
PLAT_INCLUDES += -Iinclude/bl1/tbbr
|
||||
|
||||
BL1_SOURCES += ${AUTH_SOURCES} \
|
||||
bl1/tbbr/tbbr_img_desc.c \
|
||||
plat/common/tbbr/plat_tbbr.c \
|
||||
plat/qemu/qemu_trusted_boot.c \
|
||||
$(PLAT_PATH)/qemu_rotpk.S
|
||||
|
||||
BL2_SOURCES += ${AUTH_SOURCES} \
|
||||
plat/common/tbbr/plat_tbbr.c \
|
||||
plat/qemu/qemu_trusted_boot.c \
|
||||
$(PLAT_PATH)/qemu_rotpk.S
|
||||
|
||||
ROT_KEY = $(BUILD_PLAT)/rot_key.pem
|
||||
ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin
|
||||
|
||||
$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
|
||||
|
||||
$(BUILD_PLAT)/bl1/qemu_rotpk.o: $(ROTPK_HASH)
|
||||
$(BUILD_PLAT)/bl2/qemu_rotpk.o: $(ROTPK_HASH)
|
||||
|
||||
certificates: $(ROT_KEY)
|
||||
|
||||
$(ROT_KEY):
|
||||
@echo " OPENSSL $@"
|
||||
$(Q)openssl genrsa 2048 > $@ 2>/dev/null
|
||||
|
||||
$(ROTPK_HASH): $(ROT_KEY)
|
||||
@echo " OPENSSL $@"
|
||||
$(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
|
||||
openssl dgst -sha256 -binary > $@ 2>/dev/null
|
||||
endif
|
||||
|
||||
BL1_SOURCES += drivers/io/io_semihosting.c \
|
||||
drivers/io/io_storage.c \
|
||||
drivers/io/io_fip.c \
|
||||
|
|
|
|||
|
|
@ -26,14 +26,14 @@
|
|||
#define BL33_IMAGE_NAME "bl33.bin"
|
||||
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
#define BL2_CERT_NAME "bl2.crt"
|
||||
#define TRUSTED_BOOT_FW_CERT_NAME "tb_fw.crt"
|
||||
#define TRUSTED_KEY_CERT_NAME "trusted_key.crt"
|
||||
#define BL31_KEY_CERT_NAME "bl31_key.crt"
|
||||
#define BL32_KEY_CERT_NAME "bl32_key.crt"
|
||||
#define BL33_KEY_CERT_NAME "bl33_key.crt"
|
||||
#define BL31_CERT_NAME "bl31.crt"
|
||||
#define BL32_CERT_NAME "bl32.crt"
|
||||
#define BL33_CERT_NAME "bl33.crt"
|
||||
#define SOC_FW_KEY_CERT_NAME "soc_fw_key.crt"
|
||||
#define TOS_FW_KEY_CERT_NAME "tos_fw_key.crt"
|
||||
#define NT_FW_KEY_CERT_NAME "nt_fw_key.crt"
|
||||
#define SOC_FW_CONTENT_CERT_NAME "soc_fw_content.crt"
|
||||
#define TOS_FW_CONTENT_CERT_NAME "tos_fw_content.crt"
|
||||
#define NT_FW_CONTENT_CERT_NAME "nt_fw_content.crt"
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
|
||||
|
||||
|
|
@ -76,36 +76,36 @@ static const io_uuid_spec_t bl33_uuid_spec = {
|
|||
};
|
||||
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
static const io_uuid_spec_t bl2_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_BOOT_FIRMWARE_BL2_CERT,
|
||||
static const io_uuid_spec_t tb_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_BOOT_FW_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t trusted_key_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl31_key_cert_uuid_spec = {
|
||||
.uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_KEY_CERT,
|
||||
static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_SOC_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl32_key_cert_uuid_spec = {
|
||||
.uuid = UUID_SECURE_PAYLOAD_BL32_KEY_CERT,
|
||||
static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl33_key_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_KEY_CERT,
|
||||
static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl31_cert_uuid_spec = {
|
||||
.uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_CERT,
|
||||
static const io_uuid_spec_t soc_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_SOC_FW_CONTENT_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl32_cert_uuid_spec = {
|
||||
.uuid = UUID_SECURE_PAYLOAD_BL32_CERT,
|
||||
static const io_uuid_spec_t tos_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t bl33_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_CERT,
|
||||
static const io_uuid_spec_t nt_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
|
||||
};
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
|
||||
|
|
@ -135,36 +135,36 @@ static const io_file_spec_t sh_file_spec[] = {
|
|||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
[BL2_CERT_ID] = {
|
||||
.path = BL2_CERT_NAME,
|
||||
[TRUSTED_BOOT_FW_CERT_ID] = {
|
||||
.path = TRUSTED_BOOT_FW_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[TRUSTED_KEY_CERT_ID] = {
|
||||
.path = TRUSTED_KEY_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL31_KEY_CERT_ID] = {
|
||||
.path = BL31_KEY_CERT_NAME,
|
||||
[SOC_FW_KEY_CERT_ID] = {
|
||||
.path = SOC_FW_KEY_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL32_KEY_CERT_ID] = {
|
||||
.path = BL32_KEY_CERT_NAME,
|
||||
[TRUSTED_OS_FW_KEY_CERT_ID] = {
|
||||
.path = TOS_FW_KEY_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL33_KEY_CERT_ID] = {
|
||||
.path = BL33_KEY_CERT_NAME,
|
||||
[NON_TRUSTED_FW_KEY_CERT_ID] = {
|
||||
.path = NT_FW_KEY_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL31_CERT_ID] = {
|
||||
.path = BL31_CERT_NAME,
|
||||
[SOC_FW_CONTENT_CERT_ID] = {
|
||||
.path = SOC_FW_CONTENT_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL32_CERT_ID] = {
|
||||
.path = BL32_CERT_NAME,
|
||||
[TRUSTED_OS_FW_CONTENT_CERT_ID] = {
|
||||
.path = TOS_FW_CONTENT_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
[BL33_CERT_ID] = {
|
||||
.path = BL33_CERT_NAME,
|
||||
[NON_TRUSTED_FW_CONTENT_CERT_ID] = {
|
||||
.path = NT_FW_CONTENT_CERT_NAME,
|
||||
.mode = FOPEN_MODE_RB
|
||||
},
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
|
|
@ -219,9 +219,9 @@ static const struct plat_io_policy policies[] = {
|
|||
open_fip
|
||||
},
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
[BL2_CERT_ID] = {
|
||||
[TRUSTED_BOOT_FW_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl2_cert_uuid_spec,
|
||||
(uintptr_t)&tb_fw_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[TRUSTED_KEY_CERT_ID] = {
|
||||
|
|
@ -229,34 +229,34 @@ static const struct plat_io_policy policies[] = {
|
|||
(uintptr_t)&trusted_key_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL31_KEY_CERT_ID] = {
|
||||
[SOC_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl31_key_cert_uuid_spec,
|
||||
(uintptr_t)&soc_fw_key_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL32_KEY_CERT_ID] = {
|
||||
[TRUSTED_OS_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl32_key_cert_uuid_spec,
|
||||
(uintptr_t)&tos_fw_key_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL33_KEY_CERT_ID] = {
|
||||
[NON_TRUSTED_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl33_key_cert_uuid_spec,
|
||||
(uintptr_t)&nt_fw_key_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL31_CERT_ID] = {
|
||||
[SOC_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl31_cert_uuid_spec,
|
||||
(uintptr_t)&soc_fw_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL32_CERT_ID] = {
|
||||
[TRUSTED_OS_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl32_cert_uuid_spec,
|
||||
(uintptr_t)&tos_fw_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
[BL33_CERT_ID] = {
|
||||
[NON_TRUSTED_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&bl33_cert_uuid_spec,
|
||||
(uintptr_t)&nt_fw_cert_uuid_spec,
|
||||
open_fip
|
||||
},
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
/*
|
||||
* Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
.global qemu_rotpk_hash
|
||||
.global qemu_rotpk_hash_end
|
||||
qemu_rotpk_hash:
|
||||
/* DER header */
|
||||
.byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
|
||||
.byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
|
||||
/* SHA256 */
|
||||
.incbin ROTPK_HASH
|
||||
qemu_rotpk_hash_end:
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
/*
|
||||
* Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#include <platform.h>
|
||||
|
||||
extern char qemu_rotpk_hash[], qemu_rotpk_hash_end[];
|
||||
|
||||
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
|
||||
unsigned int *flags)
|
||||
{
|
||||
*key_ptr = qemu_rotpk_hash;
|
||||
*key_len = qemu_rotpk_hash_end - qemu_rotpk_hash;
|
||||
*flags = ROTPK_IS_HASH;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
|
||||
{
|
||||
*nv_ctr = 0;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
Loading…
Reference in New Issue