hikey960: Add development TBB support
This patch adds experimental support for TBB to the HiKey960 board. To build and test with TBB modify the uefi-tools project platforms.config +ATF_BUILDFLAGS=TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 SAVE_KEYS=1 \ MBEDTLS_DIR=./mbedtls Signed-off-by: Teddy Reed <teddy@casualhacking.io>
This commit is contained in:
Teddy Reed
parent
776ba05a47
commit
745d8a82b9
|
|
@ -76,6 +76,44 @@ static const io_uuid_spec_t bl33_uuid_spec = {
|
|||
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
|
||||
};
|
||||
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
static const io_uuid_spec_t trusted_key_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t scp_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_SCP_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_SOC_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t scp_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_SCP_FW_CONTENT_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t soc_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_SOC_FW_CONTENT_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t tos_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
|
||||
};
|
||||
|
||||
static const io_uuid_spec_t nt_fw_cert_uuid_spec = {
|
||||
.uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
|
||||
};
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
|
||||
static const struct plat_io_policy policies[] = {
|
||||
[FIP_IMAGE_ID] = {
|
||||
&ufs_dev_handle,
|
||||
|
|
@ -111,7 +149,54 @@ static const struct plat_io_policy policies[] = {
|
|||
&fip_dev_handle,
|
||||
(uintptr_t)&bl33_uuid_spec,
|
||||
check_fip
|
||||
}
|
||||
},
|
||||
#if TRUSTED_BOARD_BOOT
|
||||
[TRUSTED_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&trusted_key_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[SCP_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&scp_fw_key_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[SOC_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&soc_fw_key_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[TRUSTED_OS_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&tos_fw_key_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[NON_TRUSTED_FW_KEY_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&nt_fw_key_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[SCP_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&scp_fw_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[SOC_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&soc_fw_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[TRUSTED_OS_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&tos_fw_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
[NON_TRUSTED_FW_CONTENT_CERT_ID] = {
|
||||
&fip_dev_handle,
|
||||
(uintptr_t)&nt_fw_cert_uuid_spec,
|
||||
check_fip
|
||||
},
|
||||
#endif /* TRUSTED_BOARD_BOOT */
|
||||
};
|
||||
|
||||
static int check_ufs(const uintptr_t spec)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
/*
|
||||
* Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
.global hikey960_rotpk_hash
|
||||
.global hikey960_rotpk_hash_end
|
||||
.section .rodata.hikey960_rotpk_hash, "a"
|
||||
hikey960_rotpk_hash:
|
||||
/* DER header */
|
||||
.byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
|
||||
.byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
|
||||
/* SHA256 */
|
||||
.incbin ROTPK_HASH
|
||||
hikey960_rotpk_hash_end:
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
/*
|
||||
* Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#include <platform.h>
|
||||
|
||||
extern char hikey960_rotpk_hash[], hikey960_rotpk_hash_end[];
|
||||
|
||||
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
|
||||
unsigned int *flags)
|
||||
{
|
||||
*key_ptr = hikey960_rotpk_hash;
|
||||
*key_len = hikey960_rotpk_hash_end - hikey960_rotpk_hash;
|
||||
*flags = ROTPK_IS_HASH;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
|
||||
{
|
||||
*nv_ctr = 0;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
*/
|
||||
|
||||
/* Size of cacheable stacks */
|
||||
#define PLATFORM_STACK_SIZE 0x800
|
||||
#define PLATFORM_STACK_SIZE 0x1000
|
||||
|
||||
#define FIRMWARE_WELCOME_STR "Booting Trusted Firmware\n"
|
||||
|
||||
|
|
@ -49,8 +49,8 @@
|
|||
* BL1 specific defines.
|
||||
*/
|
||||
#define BL1_RO_BASE (0x1AC00000)
|
||||
#define BL1_RO_LIMIT (BL1_RO_BASE + 0x10000)
|
||||
#define BL1_RW_BASE (BL1_RO_LIMIT) /* 1AC1_0000 */
|
||||
#define BL1_RO_LIMIT (BL1_RO_BASE + 0x20000)
|
||||
#define BL1_RW_BASE (BL1_RO_LIMIT) /* 1AC2_0000 */
|
||||
#define BL1_RW_SIZE (0x00188000)
|
||||
#define BL1_RW_LIMIT (0x1B000000)
|
||||
|
||||
|
|
@ -104,7 +104,7 @@
|
|||
#define NS_BL1U_SIZE (0x00100000)
|
||||
#define NS_BL1U_LIMIT (NS_BL1U_BASE + NS_BL1U_SIZE)
|
||||
|
||||
#define HIKEY960_NS_IMAGE_OFFSET (0x1AC18000) /* offset in l-loader */
|
||||
#define HIKEY960_NS_IMAGE_OFFSET (0x1AC28000) /* offset in l-loader */
|
||||
#define HIKEY960_NS_TMP_OFFSET (0x1AE00000)
|
||||
|
||||
#define SCP_BL2_BASE (0x89C80000)
|
||||
|
|
|
|||
|
|
@ -108,6 +108,46 @@ BL31_SOURCES += drivers/arm/cci/cci.c \
|
|||
plat/hisilicon/hikey960/drivers/ipc/hisi_ipc.c \
|
||||
${HIKEY960_GIC_SOURCES}
|
||||
|
||||
ifneq (${TRUSTED_BOARD_BOOT},0)
|
||||
|
||||
include drivers/auth/mbedtls/mbedtls_crypto.mk
|
||||
include drivers/auth/mbedtls/mbedtls_x509.mk
|
||||
|
||||
USE_TBBR_DEFS := 1
|
||||
|
||||
AUTH_SOURCES := drivers/auth/auth_mod.c \
|
||||
drivers/auth/crypto_mod.c \
|
||||
drivers/auth/img_parser_mod.c \
|
||||
drivers/auth/tbbr/tbbr_cot.c
|
||||
|
||||
BL1_SOURCES += ${AUTH_SOURCES} \
|
||||
plat/common/tbbr/plat_tbbr.c \
|
||||
plat/hisilicon/hikey960/hikey960_tbbr.c \
|
||||
plat/hisilicon/hikey960/hikey960_rotpk.S
|
||||
|
||||
BL2_SOURCES += ${AUTH_SOURCES} \
|
||||
plat/common/tbbr/plat_tbbr.c \
|
||||
plat/hisilicon/hikey960/hikey960_tbbr.c \
|
||||
plat/hisilicon/hikey960/hikey960_rotpk.S
|
||||
|
||||
ROT_KEY = $(BUILD_PLAT)/rot_key.pem
|
||||
ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin
|
||||
|
||||
$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
|
||||
$(BUILD_PLAT)/bl1/hikey960_rotpk.o: $(ROTPK_HASH)
|
||||
$(BUILD_PLAT)/bl2/hikey960_rotpk.o: $(ROTPK_HASH)
|
||||
|
||||
certificates: $(ROT_KEY)
|
||||
$(ROT_KEY): | $(BUILD_PLAT)
|
||||
@echo " OPENSSL $@"
|
||||
$(Q)openssl genrsa 2048 > $@ 2>/dev/null
|
||||
|
||||
$(ROTPK_HASH): $(ROT_KEY)
|
||||
@echo " OPENSSL $@"
|
||||
$(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
|
||||
openssl dgst -sha256 -binary > $@ 2>/dev/null
|
||||
endif
|
||||
|
||||
# Enable workarounds for selected Cortex-A53 errata.
|
||||
ERRATA_A53_836870 := 1
|
||||
ERRATA_A53_843419 := 1
|
||||
|
|
|
|||
Loading…
Reference in New Issue