diff options
author | Bryan O'Donoghue <bryan.odonoghue@linaro.org> | 2019-05-22 13:42:39 +0100 |
---|---|---|
committer | Bryan O'Donoghue <bryan.odonoghue@linaro.org> | 2019-05-23 08:02:12 +0100 |
commit | ba3f2f0002ca1277307b96d975b980f9b55d470c (patch) | |
tree | 3d2cc31cece991b0a4a69f36588bc0ba5f520f6b | |
parent | 9eaadab86b9e4178f93cfd91b86c3325ed4eb692 (diff) |
plat: imx8mm: Enable Trusted Bootimx_4.14.78_1.0.0_ga-mbl-v2-debug
This patch enables Trusted Boot for BL2 components loaded from the FIP.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
-rw-r--r-- | plat/imx/imx8mm/imx8mm_io_storage.c | 22 | ||||
-rw-r--r-- | plat/imx/imx8mm/imx8mm_rotpk.S | 15 | ||||
-rw-r--r-- | plat/imx/imx8mm/imx8mm_trusted_boot.c | 31 | ||||
-rw-r--r-- | plat/imx/imx8mm/platform.mk | 37 |
4 files changed, 103 insertions, 2 deletions
diff --git a/plat/imx/imx8mm/imx8mm_io_storage.c b/plat/imx/imx8mm/imx8mm_io_storage.c index 5ef67052..3ec1a717 100644 --- a/plat/imx/imx8mm/imx8mm_io_storage.c +++ b/plat/imx/imx8mm/imx8mm_io_storage.c @@ -47,7 +47,7 @@ static const io_uuid_spec_t bl33_uuid_spec = { .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33, }; -#if 0 && TRUSTED_BOARD_BOOT +#if TRUSTED_BOARD_BOOT static const io_uuid_spec_t tb_fw_cert_uuid_spec = { .uuid = UUID_TRUSTED_BOOT_FW_CERT, }; @@ -56,6 +56,10 @@ static const io_uuid_spec_t trusted_key_cert_uuid_spec = { .uuid = UUID_TRUSTED_KEY_CERT, }; +static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = { + .uuid = UUID_SOC_FW_KEY_CERT, +}; + static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = { .uuid = UUID_TRUSTED_OS_FW_KEY_CERT, }; @@ -64,6 +68,10 @@ static const io_uuid_spec_t tos_fw_cert_uuid_spec = { .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT, }; +static const io_uuid_spec_t soc_fw_content_cert_uuid_spec = { + .uuid = UUID_SOC_FW_CONTENT_CERT, +}; + static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = { .uuid = UUID_NON_TRUSTED_FW_KEY_CERT, }; @@ -110,12 +118,17 @@ static const struct plat_io_policy policies[] = { (uintptr_t)&bl33_uuid_spec, open_fip }, -#if 0 && TRUSTED_BOARD_BOOT +#if TRUSTED_BOARD_BOOT [TRUSTED_BOOT_FW_CERT_ID] = { &fip_dev_handle, (uintptr_t)&tb_fw_cert_uuid_spec, open_fip }, + [SOC_FW_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&soc_fw_key_cert_uuid_spec, + open_fip + }, [TRUSTED_KEY_CERT_ID] = { &fip_dev_handle, (uintptr_t)&trusted_key_cert_uuid_spec, @@ -131,6 +144,11 @@ static const struct plat_io_policy policies[] = { (uintptr_t)&nt_fw_key_cert_uuid_spec, open_fip }, + [SOC_FW_CONTENT_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&soc_fw_content_cert_uuid_spec, + open_fip + }, [TRUSTED_OS_FW_CONTENT_CERT_ID] = { &fip_dev_handle, (uintptr_t)&tos_fw_cert_uuid_spec, diff --git a/plat/imx/imx8mm/imx8mm_rotpk.S b/plat/imx/imx8mm/imx8mm_rotpk.S new file mode 100644 index 00000000..f74b6d25 --- /dev/null +++ b/plat/imx/imx8mm/imx8mm_rotpk.S @@ -0,0 +1,15 @@ +/* + * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + + .global warp7_rotpk_hash + .global warp7_rotpk_hash_end +warp7_rotpk_hash: + /* DER header */ + .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48 + .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 + /* SHA256 */ + .incbin ROTPK_HASH +warp7_rotpk_hash_end: diff --git a/plat/imx/imx8mm/imx8mm_trusted_boot.c b/plat/imx/imx8mm/imx8mm_trusted_boot.c new file mode 100644 index 00000000..56b8d552 --- /dev/null +++ b/plat/imx/imx8mm/imx8mm_trusted_boot.c @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2019, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include <platform.h> + +extern char warp7_rotpk_hash[], warp7_rotpk_hash_end[]; + +int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, + unsigned int *flags) +{ + *key_ptr = warp7_rotpk_hash; + *key_len = warp7_rotpk_hash_end - warp7_rotpk_hash; + *flags = ROTPK_IS_HASH; + + return 0; +} + +int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr) +{ + *nv_ctr = 0; + + return 0; +} + +int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr) +{ + return 1; +} diff --git a/plat/imx/imx8mm/platform.mk b/plat/imx/imx8mm/platform.mk index f9e9c6c0..dc06997a 100644 --- a/plat/imx/imx8mm/platform.mk +++ b/plat/imx/imx8mm/platform.mk @@ -70,6 +70,43 @@ BL2_SOURCES += common/desc_image_load.c \ PLAT_INCLUDES += -Iinclude/common/tbbr endif +ifneq (${TRUSTED_BOARD_BOOT},0) + +include drivers/auth/mbedtls/mbedtls_crypto.mk +include drivers/auth/mbedtls/mbedtls_x509.mk + +AUTH_SOURCES := drivers/auth/auth_mod.c \ + drivers/auth/crypto_mod.c \ + drivers/auth/img_parser_mod.c \ + drivers/auth/tbbr/tbbr_cot.c + +BL2_SOURCES += ${AUTH_SOURCES} \ + plat/common/tbbr/plat_tbbr.c \ + plat/imx/imx8mm/imx8mm_trusted_boot.c \ + plat/imx/imx8mm/imx8mm_rotpk.S + +ROT_KEY = $(BUILD_PLAT)/rot_key.pem +ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin + +$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"')) +$(eval $(call MAKE_LIB_DIRS)) + +$(BUILD_PLAT)/bl2/imx8mm_rotpk.o: $(ROTPK_HASH) + +certificates: $(ROT_KEY) + +$(ROT_KEY): | $(BUILD_PLAT) + @echo " OPENSSL $@" + @if [ ! -f $(ROT_KEY) ]; then \ + openssl genrsa 2048 > $@ 2>/dev/null; \ + fi + +$(ROTPK_HASH): $(ROT_KEY) + @echo " OPENSSL $@" + $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\ + openssl dgst -sha256 -binary > $@ 2>/dev/null +endif + ENABLE_PLAT_COMPAT := 0 USE_COHERENT_MEM := 0 MULTI_CONSOLE_API := 1 |