warp7: Enable Trusted Board Boot for WaRP7
This patch enables Trusted Board Boot for warp7. A subsequent patch contains build/run instructions. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Jun Nie <jun.nie@linaro.org>
This commit is contained in:
parent
e483639ad2
commit
a41d81cdb1
|
@ -62,6 +62,43 @@ BL2_SOURCES += common/desc_image_load.c \
|
||||||
plat/imx/imx7/warp7/warp7_image_load.c \
|
plat/imx/imx7/warp7/warp7_image_load.c \
|
||||||
${XLAT_TABLES_LIB_SRCS}
|
${XLAT_TABLES_LIB_SRCS}
|
||||||
|
|
||||||
|
ifneq (${TRUSTED_BOARD_BOOT},0)
|
||||||
|
|
||||||
|
include drivers/auth/mbedtls/mbedtls_crypto.mk
|
||||||
|
include drivers/auth/mbedtls/mbedtls_x509.mk
|
||||||
|
|
||||||
|
AUTH_SOURCES := drivers/auth/auth_mod.c \
|
||||||
|
drivers/auth/crypto_mod.c \
|
||||||
|
drivers/auth/img_parser_mod.c \
|
||||||
|
drivers/auth/tbbr/tbbr_cot.c
|
||||||
|
|
||||||
|
BL2_SOURCES += ${AUTH_SOURCES} \
|
||||||
|
plat/common/tbbr/plat_tbbr.c \
|
||||||
|
plat/imx/imx7/warp7/warp7_trusted_boot.c \
|
||||||
|
plat/imx/imx7/warp7/warp7_rotpk.S
|
||||||
|
|
||||||
|
ROT_KEY = $(BUILD_PLAT)/rot_key.pem
|
||||||
|
ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin
|
||||||
|
|
||||||
|
$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
|
||||||
|
$(eval $(call MAKE_LIB_DIRS))
|
||||||
|
|
||||||
|
$(BUILD_PLAT)/bl2/warp7_rotpk.o: $(ROTPK_HASH)
|
||||||
|
|
||||||
|
certificates: $(ROT_KEY)
|
||||||
|
|
||||||
|
$(ROT_KEY): | $(BUILD_PLAT)
|
||||||
|
@echo " OPENSSL $@"
|
||||||
|
@if [ ! -f $(ROT_KEY) ]; then \
|
||||||
|
openssl genrsa 2048 > $@ 2>/dev/null; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
$(ROTPK_HASH): $(ROT_KEY)
|
||||||
|
@echo " OPENSSL $@"
|
||||||
|
$(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
|
||||||
|
openssl dgst -sha256 -binary > $@ 2>/dev/null
|
||||||
|
endif
|
||||||
|
|
||||||
# Build config flags
|
# Build config flags
|
||||||
# ------------------
|
# ------------------
|
||||||
|
|
||||||
|
@ -86,6 +123,21 @@ USE_COHERENT_MEM := 1
|
||||||
PLAT_WARP7_UART :=1
|
PLAT_WARP7_UART :=1
|
||||||
$(eval $(call add_define,PLAT_WARP7_UART))
|
$(eval $(call add_define,PLAT_WARP7_UART))
|
||||||
|
|
||||||
|
# Add the build options to pack BLx images and kernel device tree
|
||||||
|
# in the FIP if the platform requires.
|
||||||
|
ifneq ($(BL2),)
|
||||||
|
$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tb_fw.crt,--tb-fw-cert))
|
||||||
|
endif
|
||||||
|
ifneq ($(BL32_EXTRA1),)
|
||||||
|
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA1,--tos-fw-extra1))
|
||||||
|
endif
|
||||||
|
ifneq ($(BL32_EXTRA2),)
|
||||||
|
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA2,--tos-fw-extra2))
|
||||||
|
endif
|
||||||
|
ifneq ($(HW_CONFIG),)
|
||||||
|
$(eval $(call TOOL_ADD_IMG,HW_CONFIG,--hw-config))
|
||||||
|
endif
|
||||||
|
|
||||||
# Verify build config
|
# Verify build config
|
||||||
# -------------------
|
# -------------------
|
||||||
|
|
||||||
|
|
|
@ -72,6 +72,32 @@ static const io_uuid_spec_t bl33_uuid_spec = {
|
||||||
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
|
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
#if TRUSTED_BOARD_BOOT
|
||||||
|
static const io_uuid_spec_t tb_fw_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_TRUSTED_BOOT_FW_CERT,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const io_uuid_spec_t trusted_key_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_TRUSTED_KEY_CERT,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const io_uuid_spec_t tos_fw_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
|
||||||
|
};
|
||||||
|
|
||||||
|
static const io_uuid_spec_t nt_fw_cert_uuid_spec = {
|
||||||
|
.uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
|
||||||
|
};
|
||||||
|
#endif /* TRUSTED_BOARD_BOOT */
|
||||||
|
|
||||||
/* TODO: this structure is replicated multiple times. rationalize it ! */
|
/* TODO: this structure is replicated multiple times. rationalize it ! */
|
||||||
struct plat_io_policy {
|
struct plat_io_policy {
|
||||||
uintptr_t *dev_handle;
|
uintptr_t *dev_handle;
|
||||||
|
@ -112,7 +138,39 @@ static const struct plat_io_policy policies[] = {
|
||||||
&fip_dev_handle,
|
&fip_dev_handle,
|
||||||
(uintptr_t)&bl33_uuid_spec,
|
(uintptr_t)&bl33_uuid_spec,
|
||||||
open_fip
|
open_fip
|
||||||
}
|
},
|
||||||
|
#if TRUSTED_BOARD_BOOT
|
||||||
|
[TRUSTED_BOOT_FW_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&tb_fw_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
[TRUSTED_KEY_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&trusted_key_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
[TRUSTED_OS_FW_KEY_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&tos_fw_key_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
[NON_TRUSTED_FW_KEY_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&nt_fw_key_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
[TRUSTED_OS_FW_CONTENT_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&tos_fw_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
[NON_TRUSTED_FW_CONTENT_CERT_ID] = {
|
||||||
|
&fip_dev_handle,
|
||||||
|
(uintptr_t)&nt_fw_cert_uuid_spec,
|
||||||
|
open_fip
|
||||||
|
},
|
||||||
|
#endif /* TRUSTED_BOARD_BOOT */
|
||||||
};
|
};
|
||||||
|
|
||||||
static int open_fip(const uintptr_t spec)
|
static int open_fip(const uintptr_t spec)
|
||||||
|
|
|
@ -0,0 +1,15 @@
|
||||||
|
/*
|
||||||
|
* Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
|
||||||
|
*
|
||||||
|
* SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
*/
|
||||||
|
|
||||||
|
.global warp7_rotpk_hash
|
||||||
|
.global warp7_rotpk_hash_end
|
||||||
|
warp7_rotpk_hash:
|
||||||
|
/* DER header */
|
||||||
|
.byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
|
||||||
|
.byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
|
||||||
|
/* SHA256 */
|
||||||
|
.incbin ROTPK_HASH
|
||||||
|
warp7_rotpk_hash_end:
|
|
@ -0,0 +1,31 @@
|
||||||
|
/*
|
||||||
|
* Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
|
||||||
|
*
|
||||||
|
* SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <plat/common/platform.h>
|
||||||
|
|
||||||
|
extern char warp7_rotpk_hash[], warp7_rotpk_hash_end[];
|
||||||
|
|
||||||
|
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
|
||||||
|
unsigned int *flags)
|
||||||
|
{
|
||||||
|
*key_ptr = warp7_rotpk_hash;
|
||||||
|
*key_len = warp7_rotpk_hash_end - warp7_rotpk_hash;
|
||||||
|
*flags = ROTPK_IS_HASH;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
|
||||||
|
{
|
||||||
|
*nv_ctr = 0;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
|
||||||
|
{
|
||||||
|
return 1;
|
||||||
|
}
|
Loading…
Reference in New Issue