warp7: Enable Trusted Board Boot for WaRP7

This patch enables Trusted Board Boot for warp7. A subsequent patch
contains build/run instructions.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Jun Nie <jun.nie@linaro.org>

diff --git a/plat/imx/imx7/warp7/platform.mk b/plat/imx/imx7/warp7/platform.mk
index a77186582745f8d7313f76bd2130770ee090552f..f7bd4ae5ba153d046b48e49fb7b2327ff14ccf94 100644 (file)
--- a/plat/imx/imx7/warp7/platform.mk
+++ b/plat/imx/imx7/warp7/platform.mk
@@ -62,6 +62,43 @@ BL2_SOURCES          +=      common/desc_image_load.c                        \
                                plat/imx/imx7/warp7/warp7_image_load.c          \
                                ${XLAT_TABLES_LIB_SRCS}
 
+ifneq (${TRUSTED_BOARD_BOOT},0)
+
+include drivers/auth/mbedtls/mbedtls_crypto.mk
+include drivers/auth/mbedtls/mbedtls_x509.mk
+
+AUTH_SOURCES   :=      drivers/auth/auth_mod.c                 \
+                       drivers/auth/crypto_mod.c               \
+                       drivers/auth/img_parser_mod.c           \
+                       drivers/auth/tbbr/tbbr_cot.c
+
+BL2_SOURCES            +=      ${AUTH_SOURCES}                                 \
+                               plat/common/tbbr/plat_tbbr.c                    \
+                               plat/imx/imx7/warp7/warp7_trusted_boot.c        \
+                               plat/imx/imx7/warp7/warp7_rotpk.S
+
+ROT_KEY             = $(BUILD_PLAT)/rot_key.pem
+ROTPK_HASH          = $(BUILD_PLAT)/rotpk_sha256.bin
+
+$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
+$(eval $(call MAKE_LIB_DIRS))
+
+$(BUILD_PLAT)/bl2/warp7_rotpk.o: $(ROTPK_HASH)
+
+certificates: $(ROT_KEY)
+
+$(ROT_KEY): | $(BUILD_PLAT)
+       @echo "  OPENSSL $@"
+       @if [ ! -f $(ROT_KEY) ]; then \
+               openssl genrsa 2048 > $@ 2>/dev/null; \
+       fi
+
+$(ROTPK_HASH): $(ROT_KEY)
+       @echo "  OPENSSL $@"
+       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       openssl dgst -sha256 -binary > $@ 2>/dev/null
+endif
+
 # Build config flags
 # ------------------
 
@@ -86,6 +123,21 @@ USE_COHERENT_MEM            := 1
 PLAT_WARP7_UART                        :=1
 $(eval $(call add_define,PLAT_WARP7_UART))
 
+# Add the build options to pack BLx images and kernel device tree
+# in the FIP if the platform requires.
+ifneq ($(BL2),)
+$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tb_fw.crt,--tb-fw-cert))
+endif
+ifneq ($(BL32_EXTRA1),)
+$(eval $(call TOOL_ADD_IMG,BL32_EXTRA1,--tos-fw-extra1))
+endif
+ifneq ($(BL32_EXTRA2),)
+$(eval $(call TOOL_ADD_IMG,BL32_EXTRA2,--tos-fw-extra2))
+endif
+ifneq ($(HW_CONFIG),)
+$(eval $(call TOOL_ADD_IMG,HW_CONFIG,--hw-config))
+endif
+
 # Verify build config
 # -------------------
 

diff --git a/plat/imx/imx7/warp7/warp7_io_storage.c b/plat/imx/imx7/warp7/warp7_io_storage.c
index 6f0319d1dcc36f6e1848046f21e8eb6102a8f50d..fcfb5036bf3ce9d5f2639be897122b7b8079f08b 100644 (file)
--- a/plat/imx/imx7/warp7/warp7_io_storage.c
+++ b/plat/imx/imx7/warp7/warp7_io_storage.c
@@ -72,6 +72,32 @@ static const io_uuid_spec_t bl33_uuid_spec = {
        .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
 };
 
+#if TRUSTED_BOARD_BOOT
+static const io_uuid_spec_t tb_fw_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_BOOT_FW_CERT,
+};
+
+static const io_uuid_spec_t trusted_key_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_KEY_CERT,
+};
+
+static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t tos_fw_cert_uuid_spec = {
+       .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
+};
+
+static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = {
+       .uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
+};
+
+static const io_uuid_spec_t nt_fw_cert_uuid_spec = {
+       .uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
+};
+#endif /* TRUSTED_BOARD_BOOT */
+
 /* TODO: this structure is replicated multiple times. rationalize it ! */
 struct plat_io_policy {
        uintptr_t *dev_handle;
@@ -112,7 +138,39 @@ static const struct plat_io_policy policies[] = {
                &fip_dev_handle,
                (uintptr_t)&bl33_uuid_spec,
                open_fip
-       }
+       },
+#if TRUSTED_BOARD_BOOT
+       [TRUSTED_BOOT_FW_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&tb_fw_cert_uuid_spec,
+               open_fip
+       },
+       [TRUSTED_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&trusted_key_cert_uuid_spec,
+               open_fip
+       },
+       [TRUSTED_OS_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&tos_fw_key_cert_uuid_spec,
+               open_fip
+       },
+       [NON_TRUSTED_FW_KEY_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&nt_fw_key_cert_uuid_spec,
+               open_fip
+       },
+       [TRUSTED_OS_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&tos_fw_cert_uuid_spec,
+               open_fip
+       },
+       [NON_TRUSTED_FW_CONTENT_CERT_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)&nt_fw_cert_uuid_spec,
+               open_fip
+       },
+#endif /* TRUSTED_BOARD_BOOT */
 };
 
 static int open_fip(const uintptr_t spec)

diff --git a/plat/imx/imx7/warp7/warp7_rotpk.S b/plat/imx/imx7/warp7/warp7_rotpk.S
new file mode 100644 (file)
index 0000000..f74b6d2
--- /dev/null
+++ b/plat/imx/imx7/warp7/warp7_rotpk.S
@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+       .global warp7_rotpk_hash
+       .global warp7_rotpk_hash_end
+warp7_rotpk_hash:
+       /* DER header */
+       .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
+       .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
+       /* SHA256 */
+       .incbin ROTPK_HASH
+warp7_rotpk_hash_end:

diff --git a/plat/imx/imx7/warp7/warp7_trusted_boot.c b/plat/imx/imx7/warp7/warp7_trusted_boot.c
new file mode 100644 (file)
index 0000000..8157cd5
--- /dev/null
+++ b/plat/imx/imx7/warp7/warp7_trusted_boot.c
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <plat/common/platform.h>
+
+extern char warp7_rotpk_hash[], warp7_rotpk_hash_end[];
+
+int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
+                       unsigned int *flags)
+{
+       *key_ptr = warp7_rotpk_hash;
+       *key_len = warp7_rotpk_hash_end - warp7_rotpk_hash;
+       *flags = ROTPK_IS_HASH;
+
+       return 0;
+}
+
+int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
+{
+       *nv_ctr = 0;
+
+       return 0;
+}
+
+int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
+{
+       return 1;
+}