uniphier: embed ROTPK hash into BL1/BL2
Currently, ROTPK_NOT_DEPLOYED flag is set in plat_get_rotpk_info(). It is up to users how to retrieve ROTPK if the ROT verification is desired. This is not nice. This commit improves plat_get_rotpk_info() implementation and automates the ROTPK deployment. UniPhier platform has no ROTPK storage, so it should be embedded in BL1/BL2, like ARM_ROTPK_LOCATION=devel_rsa case. This makes sense because UniPhier platform implements its internal ROM i.e. BL1 is used as updatable pseudo ROM. Things work like this: - ROT_KEY (default: $(BUILD_PLAT)/rot_key.pem) is created if missing. Users can override ROT_KEY from the command line if they want to use a specific ROT key. - ROTPK_HASH is generated based on ROT_KEY. - ROTPK_HASH is included by uniphier_rotpk.S and compiled into BL1/BL2. - ROT_KEY is input to cert_create tool. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
This commit is contained in:
parent
0dc3c35305
commit
63634800fc
|
@ -86,11 +86,29 @@ TBB_SOURCES := drivers/auth/auth_mod.c \
|
||||||
drivers/auth/img_parser_mod.c \
|
drivers/auth/img_parser_mod.c \
|
||||||
drivers/auth/tbbr/tbbr_cot.c \
|
drivers/auth/tbbr/tbbr_cot.c \
|
||||||
plat/common/tbbr/plat_tbbr.c \
|
plat/common/tbbr/plat_tbbr.c \
|
||||||
|
$(PLAT_PATH)/uniphier_rotpk.S \
|
||||||
$(PLAT_PATH)/uniphier_tbbr.c
|
$(PLAT_PATH)/uniphier_tbbr.c
|
||||||
|
|
||||||
BL1_SOURCES += $(TBB_SOURCES)
|
BL1_SOURCES += $(TBB_SOURCES)
|
||||||
BL2_SOURCES += $(TBB_SOURCES)
|
BL2_SOURCES += $(TBB_SOURCES)
|
||||||
|
|
||||||
|
ROT_KEY = $(BUILD_PLAT)/rot_key.pem
|
||||||
|
ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin
|
||||||
|
|
||||||
|
$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
|
||||||
|
$(BUILD_PLAT)/bl1/uniphier_rotpk.o: $(ROTPK_HASH)
|
||||||
|
$(BUILD_PLAT)/bl2/uniphier_rotpk.o: $(ROTPK_HASH)
|
||||||
|
|
||||||
|
certificates: $(ROT_KEY)
|
||||||
|
$(ROT_KEY):
|
||||||
|
@echo " OPENSSL $@"
|
||||||
|
$(Q)openssl genrsa 2048 > $@ 2>/dev/null
|
||||||
|
|
||||||
|
$(ROTPK_HASH): $(ROT_KEY)
|
||||||
|
@echo " OPENSSL $@"
|
||||||
|
$(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
|
||||||
|
openssl dgst -sha256 -binary > $@ 2>/dev/null
|
||||||
|
|
||||||
endif
|
endif
|
||||||
|
|
||||||
.PHONY: bl1_gzip
|
.PHONY: bl1_gzip
|
||||||
|
|
|
@ -0,0 +1,15 @@
|
||||||
|
/*
|
||||||
|
* Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
|
||||||
|
*
|
||||||
|
* SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
*/
|
||||||
|
|
||||||
|
.global uniphier_rotpk_hash
|
||||||
|
.global uniphier_rotpk_hash_end
|
||||||
|
uniphier_rotpk_hash:
|
||||||
|
/* DER header */
|
||||||
|
.byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
|
||||||
|
.byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
|
||||||
|
/* SHA256 */
|
||||||
|
.incbin ROTPK_HASH
|
||||||
|
uniphier_rotpk_hash_end:
|
|
@ -6,10 +6,14 @@
|
||||||
|
|
||||||
#include <platform.h>
|
#include <platform.h>
|
||||||
|
|
||||||
|
extern char uniphier_rotpk_hash[], uniphier_rotpk_hash_end[];
|
||||||
|
|
||||||
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
|
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
|
||||||
unsigned int *flags)
|
unsigned int *flags)
|
||||||
{
|
{
|
||||||
*flags = ROTPK_NOT_DEPLOYED;
|
*key_ptr = uniphier_rotpk_hash;
|
||||||
|
*key_len = uniphier_rotpk_hash_end - uniphier_rotpk_hash;
|
||||||
|
*flags = ROTPK_IS_HASH;
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue