Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-23 13:36:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(stm32mp1): add the decryption support

Browse source 
Add the decryption support for STM32MP1 binaries.
Decryption is limited to the BL32 loaded images.

Limitation: STM32MP15 doesn't support the feature.

Change-Id: I96800bac7b22109f8471eb2953fc0dc269fc4fd1
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
This commit is contained in:
Lionel Debieve 2022-10-05 16:51:12 +02:00
parent beb625f90b
commit cd791164a9
5 changed files with 77 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
plat/st/common/bl2_io_storage.c
View file

@ -14,6 +14,7 @@
#include <drivers/fwu/fwu_metadata.h>
#include <drivers/io/io_block.h>
#include <drivers/io/io_driver.h>
#include <drivers/io/io_encrypted.h>
#include <drivers/io/io_fip.h>
#include <drivers/io/io_memmap.h>
#include <drivers/io/io_mtd.h>
@ -48,6 +49,11 @@ uintptr_t storage_dev_handle;
static const io_dev_connector_t *fip_dev_con;
#ifndef DECRYPTION_SUPPORT_none
static const io_dev_connector_t *enc_dev_con;
uintptr_t enc_dev_handle;
#endif
#if STM32MP_SDMMC || STM32MP_EMMC
static struct mmc_device_info mmc_info;
@ -118,6 +124,29 @@ int open_fip(const uintptr_t spec)
return io_dev_init(fip_dev_handle, (uintptr_t)FIP_IMAGE_ID);
}
#ifndef DECRYPTION_SUPPORT_none
int open_enc_fip(const uintptr_t spec)
{
int result;
uintptr_t local_image_handle;
result = io_dev_init(enc_dev_handle, (uintptr_t)ENC_IMAGE_ID);
if (result != 0) {
return result;
}
result = io_open(enc_dev_handle, spec, &local_image_handle);
if (result != 0) {
return result;
}
VERBOSE("Using encrypted FIP\n");
io_close(local_image_handle);
return 0;
}
#endif
int open_storage(const uintptr_t spec)
{
return io_dev_init(storage_dev_handle, 0);
@ -383,6 +412,15 @@ void stm32mp_io_setup(void)
io_result = io_dev_open(fip_dev_con, (uintptr_t)NULL,
&fip_dev_handle);
#ifndef DECRYPTION_SUPPORT_none
io_result = register_io_dev_enc(&enc_dev_con);
assert(io_result == 0);
io_result = io_dev_open(enc_dev_con, (uintptr_t)NULL,
&enc_dev_handle);
assert(io_result == 0);
#endif
switch (boot_context->boot_interface_selected) {
#if STM32MP_SDMMC
case BOOT_API_CTX_BOOT_INTERFACE_SEL_FLASH_SD:

6
plat/st/common/include/stm32mp_io_storage.h
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2021, STMicroelectronics - All Rights Reserved
* Copyright (c) 2021-2022, STMicroelectronics - All Rights Reserved
*
* SPDX-License-Identifier: BSD-3-Clause
*/
@ -13,11 +13,15 @@
/* IO devices handle */
extern uintptr_t storage_dev_handle;
extern uintptr_t fip_dev_handle;
extern uintptr_t enc_dev_handle;
extern io_block_spec_t image_block_spec;
/* Function declarations */
int open_fip(const uintptr_t spec);
#ifndef DECRYPTION_SUPPORT_none
int open_enc_fip(const uintptr_t spec);
#endif
int open_storage(const uintptr_t spec);
#endif /* STM32MP_IO_STORAGE_H */

24
plat/st/common/stm32mp_fconf_io.c
View file

@ -42,6 +42,14 @@ struct plat_io_policy policies[MAX_NUMBER_IDS] = {
.img_type_guid = STM32MP_FIP_GUID,
.check = open_storage
},
#ifndef DECRYPTION_SUPPORT_none
[ENC_IMAGE_ID] = {
.dev_handle = &fip_dev_handle,
.image_spec = (uintptr_t)NULL,
.img_type_guid = NULL_GUID,
.check = open_fip
},
#endif
#if STM32MP_SDMMC || STM32MP_EMMC
[GPT_IMAGE_ID] = {
.dev_handle = &storage_dev_handle,
@ -151,8 +159,20 @@ int fconf_populate_stm32mp_io_policies(uintptr_t config)
uuid_ptr->uuid = uuid_helper.uuid_struct;
policies[load_info[i].image_id].image_spec = (uintptr_t)uuid_ptr;
policies[load_info[i].image_id].dev_handle = &fip_dev_handle;
policies[load_info[i].image_id].check = open_fip;
switch (load_info[i].image_id) {
#if ENCRYPT_BL32 && !defined(DECRYPTION_SUPPORT_none)
case BL32_IMAGE_ID:
case BL32_EXTRA1_IMAGE_ID:
case BL32_EXTRA2_IMAGE_ID:
policies[load_info[i].image_id].dev_handle = &enc_dev_handle;
policies[load_info[i].image_id].check = open_enc_fip;
break;
#endif
default:
policies[load_info[i].image_id].dev_handle = &fip_dev_handle;
policies[load_info[i].image_id].check = open_fip;
break;
}
}
return 0;

13
plat/st/stm32mp1/platform.mk
View file

@ -87,6 +87,11 @@ STM32MP15_OPTEE_RSV_SHM := 1
$(eval $(call add_defines,STM32MP15_OPTEE_RSV_SHM))
STM32MP_CRYPTO_ROM_LIB := 1
# Decryption support
ifneq ($(DECRYPTION_SUPPORT),none)
$(error "DECRYPTION_SUPPORT not supported on STM32MP15")
endif
endif
# STM32 image header binary type for BL2
@ -221,10 +226,10 @@ else
# Add the build options to pack Trusted OS Extra1 and Trusted OS Extra2 images
# in the FIP if the platform requires.
ifneq ($(BL32_EXTRA1),)
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA1,--tos-fw-extra1))
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA1,--tos-fw-extra1,,$(ENCRYPT_BL32)))
endif
ifneq ($(BL32_EXTRA2),)
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA2,--tos-fw-extra2))
$(eval $(call TOOL_ADD_IMG,BL32_EXTRA2,--tos-fw-extra2,,$(ENCRYPT_BL32)))
endif
endif
endif
@ -387,6 +392,10 @@ BL2_SOURCES += drivers/io/io_block.c \
drivers/st/crypto/stm32_hash.c \
plat/st/stm32mp1/bl2_plat_setup.c
ifneq (${DECRYPTION_SUPPORT},none)
BL2_SOURCES += drivers/io/io_encrypted.c
endif
ifeq (${TRUSTED_BOARD_BOOT},1)
AUTH_SOURCES := drivers/auth/auth_mod.c \
drivers/auth/crypto_mod.c \

1
plat/st/stm32mp1/stm32mp1_def.h
View file

@ -451,6 +451,7 @@ enum ddr_type {
#define MONOTONIC_OTP "monotonic_otp"
#define UID_OTP "uid_otp"
#define PKH_OTP "pkh_otp"
#define ENCKEY_OTP "enckey_otp"
#define BOARD_ID_OTP "board_id"
/* OTP mask */