Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-13 16:14:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(synquacer): add TBBR support

Browse source 
enable Trusted-Boot for Synquacer platform.

Cc: Sumit Garg <sumit.garg@linaro.org>
Cc: Masahisa Kojima <masahisa.kojima@linaro.org>
Cc: Manish V Badarkhe <manish.badarkhe@arm.com>
Cc: Leonardo Sandoval <leonardo.sandoval@linaro.org>
Change-Id: I2608b4d573d95d55da1fc5544333e0dbf3f763f2
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
This commit is contained in:
Jassi Brar 2022-03-03 15:24:31 -06:00
parent 48ab390444
commit 19aaeea00b
5 changed files with 166 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
plat/socionext/synquacer/include/platform_def.h
View file

@ -42,7 +42,11 @@
#define MAX_XLAT_TABLES 8
#define MAX_MMAP_REGIONS 8
#if TRUSTED_BOARD_BOOT
#define PLATFORM_STACK_SIZE 0x1000
#else
#define PLATFORM_STACK_SIZE 0x400
#endif
#if !RESET_TO_BL31

30
plat/socionext/synquacer/platform.mk
View file

@ -51,6 +51,36 @@ BL2_SOURCES += common/desc_image_load.c \
$(PLAT_PATH)/sq_bl2_setup.c \
$(PLAT_PATH)/sq_image_desc.c \
$(PLAT_PATH)/sq_io_storage.c
ifeq (${TRUSTED_BOARD_BOOT},1)
include drivers/auth/mbedtls/mbedtls_crypto.mk
include drivers/auth/mbedtls/mbedtls_x509.mk
BL2_SOURCES += drivers/auth/auth_mod.c \
drivers/auth/crypto_mod.c \
drivers/auth/img_parser_mod.c \
drivers/auth/tbbr/tbbr_cot_common.c \
drivers/auth/tbbr/tbbr_cot_bl2.c \
plat/common/tbbr/plat_tbbr.c \
$(PLAT_PATH)/sq_rotpk.S \
$(PLAT_PATH)/sq_tbbr.c
ROT_KEY = $(BUILD_PLAT)/rot_key.pem
ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin
$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"'))
$(BUILD_PLAT)/bl2/sq_rotpk.o: $(ROTPK_HASH)
certificates: $(ROT_KEY)
$(ROT_KEY): | $(BUILD_PLAT)
@echo " OPENSSL $@"
$(Q)openssl genrsa 2048 > $@ 2>/dev/null
$(ROTPK_HASH): $(ROT_KEY)
@echo " OPENSSL $@"
$(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
openssl dgst -sha256 -binary > $@ 2>/dev/null
endif # TRUSTED_BOARD_BOOT
endif
BL31_SOURCES += drivers/arm/ccn/ccn.c \

76
plat/socionext/synquacer/sq_io_storage.c
View file

@ -47,6 +47,40 @@ static const io_uuid_spec_t sq_bl33_spec = {
.uuid = UUID_NON_TRUSTED_FIRMWARE_BL33,
};
#if TRUSTED_BOARD_BOOT
static const io_uuid_spec_t sq_tb_fw_cert_spec = {
.uuid = UUID_TRUSTED_BOOT_FW_CERT,
};
static const io_uuid_spec_t sq_trusted_key_cert_spec = {
.uuid = UUID_TRUSTED_KEY_CERT,
};
static const io_uuid_spec_t sq_soc_fw_key_cert_spec = {
.uuid = UUID_SOC_FW_KEY_CERT,
};
static const io_uuid_spec_t sq_tos_fw_key_cert_spec = {
.uuid = UUID_TRUSTED_OS_FW_KEY_CERT,
};
static const io_uuid_spec_t sq_nt_fw_key_cert_spec = {
.uuid = UUID_NON_TRUSTED_FW_KEY_CERT,
};
static const io_uuid_spec_t sq_soc_fw_cert_spec = {
.uuid = UUID_SOC_FW_CONTENT_CERT,
};
static const io_uuid_spec_t sq_tos_fw_cert_spec = {
.uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT,
};
static const io_uuid_spec_t sq_nt_fw_cert_spec = {
.uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT,
};
#endif /* TRUSTED_BOARD_BOOT */
struct sq_io_policy {
uintptr_t *dev_handle;
uintptr_t image_spec;
@ -78,6 +112,48 @@ static const struct sq_io_policy sq_io_policies[] = {
.image_spec = (uintptr_t)&sq_bl33_spec,
.init_params = FIP_IMAGE_ID,
},
#if TRUSTED_BOARD_BOOT
[TRUSTED_BOOT_FW_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_tb_fw_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[TRUSTED_KEY_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_trusted_key_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[SOC_FW_KEY_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_soc_fw_key_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[TRUSTED_OS_FW_KEY_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_tos_fw_key_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[NON_TRUSTED_FW_KEY_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_nt_fw_key_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[SOC_FW_CONTENT_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_soc_fw_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[TRUSTED_OS_FW_CONTENT_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_tos_fw_cert_spec,
.init_params = FIP_IMAGE_ID,
},
[NON_TRUSTED_FW_CONTENT_CERT_ID] = {
.dev_handle = &sq_fip_dev_handle,
.image_spec = (uintptr_t)&sq_nt_fw_cert_spec,
.init_params = FIP_IMAGE_ID,
},
#endif
};
static int sq_io_memmap_setup(void)

16
plat/socionext/synquacer/sq_rotpk.S Normal file
View file

@ -0,0 +1,16 @@
/*
* Copyright (c) 2022, Socionext Inc. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
.global sq_rotpk_hash
.global sq_rotpk_hash_end
.section .rodata.sq_rotpk_hash, "a"
sq_rotpk_hash:
/* DER header */
.byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48
.byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
/* SHA256 */
.incbin ROTPK_HASH
sq_rotpk_hash_end:

40
plat/socionext/synquacer/sq_tbbr.c Normal file
View file

@ -0,0 +1,40 @@
/*
* Copyright (c) 2022, Socionext Inc. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <plat/common/platform.h>
extern char sq_rotpk_hash[], sq_rotpk_hash_end[];
int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
unsigned int *flags)
{
*key_ptr = sq_rotpk_hash;
*key_len = sq_rotpk_hash_end - sq_rotpk_hash;
*flags = ROTPK_IS_HASH;
return 0;
}
int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
{
/*
* No support for non-volatile counter. Update the ROT key to protect
* the system against rollback.
*/
*nv_ctr = 0;
return 0;
}
int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
{
return 0;
}
int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
{
return get_mbedtls_heap_helper(heap_addr, heap_size);
}