From 745d8a82b9b42b93a1acf4249cb245190ae7d117 Mon Sep 17 00:00:00 2001 From: Teddy Reed Date: Mon, 3 Sep 2018 17:38:50 -0400 Subject: [PATCH] hikey960: Add development TBB support This patch adds experimental support for TBB to the HiKey960 board. To build and test with TBB modify the uefi-tools project platforms.config +ATF_BUILDFLAGS=TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 SAVE_KEYS=1 \ MBEDTLS_DIR=./mbedtls Signed-off-by: Teddy Reed --- plat/hisilicon/hikey960/hikey960_io_storage.c | 87 ++++++++++++++++++- plat/hisilicon/hikey960/hikey960_rotpk.S | 16 ++++ plat/hisilicon/hikey960/hikey960_tbbr.c | 31 +++++++ .../hisilicon/hikey960/include/platform_def.h | 8 +- plat/hisilicon/hikey960/platform.mk | 40 +++++++++ 5 files changed, 177 insertions(+), 5 deletions(-) create mode 100644 plat/hisilicon/hikey960/hikey960_rotpk.S create mode 100644 plat/hisilicon/hikey960/hikey960_tbbr.c diff --git a/plat/hisilicon/hikey960/hikey960_io_storage.c b/plat/hisilicon/hikey960/hikey960_io_storage.c index be7c941f..cff3b0d2 100644 --- a/plat/hisilicon/hikey960/hikey960_io_storage.c +++ b/plat/hisilicon/hikey960/hikey960_io_storage.c @@ -76,6 +76,44 @@ static const io_uuid_spec_t bl33_uuid_spec = { .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33, }; +#if TRUSTED_BOARD_BOOT +static const io_uuid_spec_t trusted_key_cert_uuid_spec = { + .uuid = UUID_TRUSTED_KEY_CERT, +}; + +static const io_uuid_spec_t scp_fw_key_cert_uuid_spec = { + .uuid = UUID_SCP_FW_KEY_CERT, +}; + +static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = { + .uuid = UUID_SOC_FW_KEY_CERT, +}; + +static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_KEY_CERT, +}; + +static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_KEY_CERT, +}; + +static const io_uuid_spec_t scp_fw_cert_uuid_spec = { + .uuid = UUID_SCP_FW_CONTENT_CERT, +}; + +static const io_uuid_spec_t soc_fw_cert_uuid_spec = { + .uuid = UUID_SOC_FW_CONTENT_CERT, +}; + +static const io_uuid_spec_t tos_fw_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT, +}; + +static const io_uuid_spec_t nt_fw_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT, +}; +#endif /* TRUSTED_BOARD_BOOT */ + static const struct plat_io_policy policies[] = { [FIP_IMAGE_ID] = { &ufs_dev_handle, @@ -111,7 +149,54 @@ static const struct plat_io_policy policies[] = { &fip_dev_handle, (uintptr_t)&bl33_uuid_spec, check_fip - } + }, +#if TRUSTED_BOARD_BOOT + [TRUSTED_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&trusted_key_cert_uuid_spec, + check_fip + }, + [SCP_FW_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&scp_fw_key_cert_uuid_spec, + check_fip + }, + [SOC_FW_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&soc_fw_key_cert_uuid_spec, + check_fip + }, + [TRUSTED_OS_FW_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&tos_fw_key_cert_uuid_spec, + check_fip + }, + [NON_TRUSTED_FW_KEY_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&nt_fw_key_cert_uuid_spec, + check_fip + }, + [SCP_FW_CONTENT_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&scp_fw_cert_uuid_spec, + check_fip + }, + [SOC_FW_CONTENT_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&soc_fw_cert_uuid_spec, + check_fip + }, + [TRUSTED_OS_FW_CONTENT_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&tos_fw_cert_uuid_spec, + check_fip + }, + [NON_TRUSTED_FW_CONTENT_CERT_ID] = { + &fip_dev_handle, + (uintptr_t)&nt_fw_cert_uuid_spec, + check_fip + }, +#endif /* TRUSTED_BOARD_BOOT */ }; static int check_ufs(const uintptr_t spec) diff --git a/plat/hisilicon/hikey960/hikey960_rotpk.S b/plat/hisilicon/hikey960/hikey960_rotpk.S new file mode 100644 index 00000000..f230ed69 --- /dev/null +++ b/plat/hisilicon/hikey960/hikey960_rotpk.S @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + + .global hikey960_rotpk_hash + .global hikey960_rotpk_hash_end + .section .rodata.hikey960_rotpk_hash, "a" +hikey960_rotpk_hash: + /* DER header */ + .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48 + .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 + /* SHA256 */ + .incbin ROTPK_HASH +hikey960_rotpk_hash_end: diff --git a/plat/hisilicon/hikey960/hikey960_tbbr.c b/plat/hisilicon/hikey960/hikey960_tbbr.c new file mode 100644 index 00000000..e9f28b3b --- /dev/null +++ b/plat/hisilicon/hikey960/hikey960_tbbr.c @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include + +extern char hikey960_rotpk_hash[], hikey960_rotpk_hash_end[]; + +int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, + unsigned int *flags) +{ + *key_ptr = hikey960_rotpk_hash; + *key_len = hikey960_rotpk_hash_end - hikey960_rotpk_hash; + *flags = ROTPK_IS_HASH; + + return 0; +} + +int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr) +{ + *nv_ctr = 0; + + return 0; +} + +int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr) +{ + return 1; +} diff --git a/plat/hisilicon/hikey960/include/platform_def.h b/plat/hisilicon/hikey960/include/platform_def.h index 5a6021a8..40304eb5 100644 --- a/plat/hisilicon/hikey960/include/platform_def.h +++ b/plat/hisilicon/hikey960/include/platform_def.h @@ -19,7 +19,7 @@ */ /* Size of cacheable stacks */ -#define PLATFORM_STACK_SIZE 0x800 +#define PLATFORM_STACK_SIZE 0x1000 #define FIRMWARE_WELCOME_STR "Booting Trusted Firmware\n" @@ -49,8 +49,8 @@ * BL1 specific defines. */ #define BL1_RO_BASE (0x1AC00000) -#define BL1_RO_LIMIT (BL1_RO_BASE + 0x10000) -#define BL1_RW_BASE (BL1_RO_LIMIT) /* 1AC1_0000 */ +#define BL1_RO_LIMIT (BL1_RO_BASE + 0x20000) +#define BL1_RW_BASE (BL1_RO_LIMIT) /* 1AC2_0000 */ #define BL1_RW_SIZE (0x00188000) #define BL1_RW_LIMIT (0x1B000000) @@ -104,7 +104,7 @@ #define NS_BL1U_SIZE (0x00100000) #define NS_BL1U_LIMIT (NS_BL1U_BASE + NS_BL1U_SIZE) -#define HIKEY960_NS_IMAGE_OFFSET (0x1AC18000) /* offset in l-loader */ +#define HIKEY960_NS_IMAGE_OFFSET (0x1AC28000) /* offset in l-loader */ #define HIKEY960_NS_TMP_OFFSET (0x1AE00000) #define SCP_BL2_BASE (0x89C80000) diff --git a/plat/hisilicon/hikey960/platform.mk b/plat/hisilicon/hikey960/platform.mk index 5fa72184..6f3a4030 100644 --- a/plat/hisilicon/hikey960/platform.mk +++ b/plat/hisilicon/hikey960/platform.mk @@ -108,6 +108,46 @@ BL31_SOURCES += drivers/arm/cci/cci.c \ plat/hisilicon/hikey960/drivers/ipc/hisi_ipc.c \ ${HIKEY960_GIC_SOURCES} +ifneq (${TRUSTED_BOARD_BOOT},0) + +include drivers/auth/mbedtls/mbedtls_crypto.mk +include drivers/auth/mbedtls/mbedtls_x509.mk + +USE_TBBR_DEFS := 1 + +AUTH_SOURCES := drivers/auth/auth_mod.c \ + drivers/auth/crypto_mod.c \ + drivers/auth/img_parser_mod.c \ + drivers/auth/tbbr/tbbr_cot.c + +BL1_SOURCES += ${AUTH_SOURCES} \ + plat/common/tbbr/plat_tbbr.c \ + plat/hisilicon/hikey960/hikey960_tbbr.c \ + plat/hisilicon/hikey960/hikey960_rotpk.S + +BL2_SOURCES += ${AUTH_SOURCES} \ + plat/common/tbbr/plat_tbbr.c \ + plat/hisilicon/hikey960/hikey960_tbbr.c \ + plat/hisilicon/hikey960/hikey960_rotpk.S + +ROT_KEY = $(BUILD_PLAT)/rot_key.pem +ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin + +$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"')) +$(BUILD_PLAT)/bl1/hikey960_rotpk.o: $(ROTPK_HASH) +$(BUILD_PLAT)/bl2/hikey960_rotpk.o: $(ROTPK_HASH) + +certificates: $(ROT_KEY) +$(ROT_KEY): | $(BUILD_PLAT) + @echo " OPENSSL $@" + $(Q)openssl genrsa 2048 > $@ 2>/dev/null + +$(ROTPK_HASH): $(ROT_KEY) + @echo " OPENSSL $@" + $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\ + openssl dgst -sha256 -binary > $@ 2>/dev/null +endif + # Enable workarounds for selected Cortex-A53 errata. ERRATA_A53_836870 := 1 ERRATA_A53_843419 := 1 -- 2.30.2