hikey960: Add development TBB support

This patch adds experimental support for TBB to the HiKey960 board. To
build and test with TBB modify the uefi-tools project platforms.config

+ATF_BUILDFLAGS=TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 SAVE_KEYS=1 \
  MBEDTLS_DIR=./mbedtls

Signed-off-by: Teddy Reed <teddy@casualhacking.io>

diff --git a/plat/hisilicon/hikey960/hikey960_io_storage.c b/plat/hisilicon/hikey960/hikey960_io_storage.c
index be7c941ff3246733418536434a59d31660f1442a..cff3b0d235ae3651d08c41a25285f30a84350db6 100644 (file)
--- a/plat/hisilicon/hikey960/hikey960_io_storage.c
+++ b/plat/hisilicon/hikey960/hikey960_io_storage.c
@@ -76,6 +76,44 @@ static const io_uuid_spec_t bl33_uuid_spec = {
        .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
 };
 
+#if TRUSTED_BOARD_BOOT
+static const io_uuid_spec_t trusted_key_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_KEY_CERT,
+};
+
+static const io_uuid_spec_t scp_fw_key_cert_uuid_spec = {
+       .uuid = UUID_SCP_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = {
+       .uuid = UUID_SOC_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = {
+       .uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t scp_fw_cert_uuid_spec = {
+       .uuid = UUID_SCP_FW_CONTENT_CERT,
+};
+
+static const io_uuid_spec_t soc_fw_cert_uuid_spec = {
+       .uuid = UUID_SOC_FW_CONTENT_CERT,
+};
+
+static const io_uuid_spec_t tos_fw_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
+};
+
+static const io_uuid_spec_t nt_fw_cert_uuid_spec = {
+       .uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
+};
+#endif /* TRUSTED_BOARD_BOOT */
+
 static const struct plat_io_policy policies[] = {
        [FIP_IMAGE_ID] = {
                &ufs_dev_handle,
@@ -111,7 +149,54 @@ static const struct plat_io_policy policies[] = {
                &fip_dev_handle,
                (uintptr_t)&bl33_uuid_spec,
                check_fip
-       }
+       },
+#if TRUSTED_BOARD_BOOT
+       [TRUSTED_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&trusted_key_cert_uuid_spec,
+               check_fip
+       },
+       [SCP_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&scp_fw_key_cert_uuid_spec,
+               check_fip
+       },
+       [SOC_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&soc_fw_key_cert_uuid_spec,
+               check_fip
+       },
+       [TRUSTED_OS_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&tos_fw_key_cert_uuid_spec,
+               check_fip
+       },
+       [NON_TRUSTED_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&nt_fw_key_cert_uuid_spec,
+               check_fip
+       },
+       [SCP_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&scp_fw_cert_uuid_spec,
+               check_fip
+       },
+       [SOC_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&soc_fw_cert_uuid_spec,
+               check_fip
+       },
+       [TRUSTED_OS_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&tos_fw_cert_uuid_spec,
+               check_fip
+       },
+       [NON_TRUSTED_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&nt_fw_cert_uuid_spec,
+               check_fip
+       },
+#endif /* TRUSTED_BOARD_BOOT */
 };
 
 static int check_ufs(const uintptr_t spec)

diff --git a/plat/hisilicon/hikey960/hikey960_rotpk.S b/plat/hisilicon/hikey960/hikey960_rotpk.S
new file mode 100644 (file)
index 0000000..f230ed6
--- /dev/null
+++ b/plat/hisilicon/hikey960/hikey960_rotpk.S
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+       .global hikey960_rotpk_hash
+       .global hikey960_rotpk_hash_end
+       .section .rodata.hikey960_rotpk_hash, "a"
+hikey960_rotpk_hash:
+       /* DER header */
+       .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
+       .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
+       /* SHA256 */
+       .incbin ROTPK_HASH
+hikey960_rotpk_hash_end:

diff --git a/plat/hisilicon/hikey960/hikey960_tbbr.c b/plat/hisilicon/hikey960/hikey960_tbbr.c
new file mode 100644 (file)
index 0000000..e9f28b3
--- /dev/null
+++ b/plat/hisilicon/hikey960/hikey960_tbbr.c
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <platform.h>
+
+extern char hikey960_rotpk_hash[], hikey960_rotpk_hash_end[];
+
+int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
+                       unsigned int *flags)
+{
+       *key_ptr = hikey960_rotpk_hash;
+       *key_len = hikey960_rotpk_hash_end - hikey960_rotpk_hash;
+       *flags = ROTPK_IS_HASH;
+
+       return 0;
+}
+
+int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
+{
+       *nv_ctr = 0;
+
+       return 0;
+}
+
+int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
+{
+       return 1;
+}

diff --git a/plat/hisilicon/hikey960/include/platform_def.h b/plat/hisilicon/hikey960/include/platform_def.h
index 5a6021a8561a113a0f6fa5e9fcdc13d4b1408a5c..40304eb5c45be9b484aacab49a6411f2afee63ba 100644 (file)
--- a/plat/hisilicon/hikey960/include/platform_def.h
+++ b/plat/hisilicon/hikey960/include/platform_def.h
@@ -19,7 +19,7 @@
  */
 
 /* Size of cacheable stacks */
-#define PLATFORM_STACK_SIZE            0x800
+#define PLATFORM_STACK_SIZE            0x1000
 
 #define FIRMWARE_WELCOME_STR           "Booting Trusted Firmware\n"
 
@@ -49,8 +49,8 @@
  * BL1 specific defines.
  */
 #define BL1_RO_BASE                    (0x1AC00000)
-#define BL1_RO_LIMIT                   (BL1_RO_BASE + 0x10000)
-#define BL1_RW_BASE                    (BL1_RO_LIMIT)          /* 1AC1_0000 */
+#define BL1_RO_LIMIT                   (BL1_RO_BASE + 0x20000)
+#define BL1_RW_BASE                    (BL1_RO_LIMIT)          /* 1AC2_0000 */
 #define BL1_RW_SIZE                    (0x00188000)
 #define BL1_RW_LIMIT                   (0x1B000000)
 
@@ -104,7 +104,7 @@
 #define NS_BL1U_SIZE                   (0x00100000)
 #define NS_BL1U_LIMIT                  (NS_BL1U_BASE + NS_BL1U_SIZE)
 
-#define HIKEY960_NS_IMAGE_OFFSET       (0x1AC18000)    /* offset in l-loader */
+#define HIKEY960_NS_IMAGE_OFFSET       (0x1AC28000)    /* offset in l-loader */
 #define HIKEY960_NS_TMP_OFFSET         (0x1AE00000)
 
 #define SCP_BL2_BASE                   (0x89C80000)

diff --git a/plat/hisilicon/hikey960/platform.mk b/plat/hisilicon/hikey960/platform.mk
index 5fa7218421e97f91c7b0e0e3c9ae303cc92a3ff0..6f3a40303edcae951df8796f1c9becf66b7adda3 100644 (file)
--- a/plat/hisilicon/hikey960/platform.mk
+++ b/plat/hisilicon/hikey960/platform.mk
@@ -108,6 +108,46 @@ BL31_SOURCES               +=      drivers/arm/cci/cci.c                   \
                                plat/hisilicon/hikey960/drivers/ipc/hisi_ipc.c \
                                ${HIKEY960_GIC_SOURCES}
 
+ifneq (${TRUSTED_BOARD_BOOT},0)
+
+include drivers/auth/mbedtls/mbedtls_crypto.mk
+include drivers/auth/mbedtls/mbedtls_x509.mk
+
+USE_TBBR_DEFS          :=      1
+
+AUTH_SOURCES           :=      drivers/auth/auth_mod.c                 \
+                               drivers/auth/crypto_mod.c               \
+                               drivers/auth/img_parser_mod.c           \
+                               drivers/auth/tbbr/tbbr_cot.c
+
+BL1_SOURCES            +=      ${AUTH_SOURCES}                         \
+                               plat/common/tbbr/plat_tbbr.c            \
+                               plat/hisilicon/hikey960/hikey960_tbbr.c \
+                               plat/hisilicon/hikey960/hikey960_rotpk.S
+
+BL2_SOURCES            +=      ${AUTH_SOURCES}                         \
+                               plat/common/tbbr/plat_tbbr.c            \
+                               plat/hisilicon/hikey960/hikey960_tbbr.c \
+                               plat/hisilicon/hikey960/hikey960_rotpk.S
+
+ROT_KEY                =       $(BUILD_PLAT)/rot_key.pem
+ROTPK_HASH             =       $(BUILD_PLAT)/rotpk_sha256.bin
+
+$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
+$(BUILD_PLAT)/bl1/hikey960_rotpk.o: $(ROTPK_HASH)
+$(BUILD_PLAT)/bl2/hikey960_rotpk.o: $(ROTPK_HASH)
+
+certificates: $(ROT_KEY)
+$(ROT_KEY): | $(BUILD_PLAT)
+       @echo "  OPENSSL $@"
+       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+
+$(ROTPK_HASH): $(ROT_KEY)
+       @echo "  OPENSSL $@"
+       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       openssl dgst -sha256 -binary > $@ 2>/dev/null
+endif
+
 # Enable workarounds for selected Cortex-A53 errata.
 ERRATA_A53_836870              :=      1
 ERRATA_A53_843419              :=      1