diff --git a/plat/qemu/platform.mk b/plat/qemu/platform.mk index ed197a1..2a7415f 100644 --- a/plat/qemu/platform.mk +++ b/plat/qemu/platform.mk @@ -13,6 +13,7 @@ $(eval $(call add_define,QEMU_LOAD_BL32)) endif +PLAT_PATH := plat/qemu/ PLAT_INCLUDES := -Iinclude/plat/arm/common/ \ -Iinclude/plat/arm/common/aarch64/ \ -Iplat/qemu/include \ @@ -36,6 +37,51 @@ PLAT_BL_COMMON_SOURCES += ${XLAT_TABLES_LIB_SRCS} endif +ifneq (${TRUSTED_BOARD_BOOT},0) + + include drivers/auth/mbedtls/mbedtls_crypto.mk + include drivers/auth/mbedtls/mbedtls_x509.mk + + USE_TBBR_DEFS := 1 + + AUTH_SOURCES := drivers/auth/auth_mod.c \ + drivers/auth/crypto_mod.c \ + drivers/auth/img_parser_mod.c \ + drivers/auth/tbbr/tbbr_cot.c + + PLAT_INCLUDES += -Iinclude/bl1/tbbr + + BL1_SOURCES += ${AUTH_SOURCES} \ + bl1/tbbr/tbbr_img_desc.c \ + plat/common/tbbr/plat_tbbr.c \ + plat/qemu/qemu_trusted_boot.c \ + $(PLAT_PATH)/qemu_rotpk.S + + BL2_SOURCES += ${AUTH_SOURCES} \ + plat/common/tbbr/plat_tbbr.c \ + plat/qemu/qemu_trusted_boot.c \ + $(PLAT_PATH)/qemu_rotpk.S + + ROT_KEY = $(BUILD_PLAT)/rot_key.pem + ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin + + $(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"')) + + $(BUILD_PLAT)/bl1/qemu_rotpk.o: $(ROTPK_HASH) + $(BUILD_PLAT)/bl2/qemu_rotpk.o: $(ROTPK_HASH) + + certificates: $(ROT_KEY) + + $(ROT_KEY): + @echo " OPENSSL $@" + $(Q)openssl genrsa 2048 > $@ 2>/dev/null + + $(ROTPK_HASH): $(ROT_KEY) + @echo " OPENSSL $@" + $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\ + openssl dgst -sha256 -binary > $@ 2>/dev/null +endif + BL1_SOURCES += drivers/io/io_semihosting.c \ drivers/io/io_storage.c \ drivers/io/io_fip.c \ diff --git a/plat/qemu/qemu_io_storage.c b/plat/qemu/qemu_io_storage.c index e0f7e8a..1918f21 100644 --- a/plat/qemu/qemu_io_storage.c +++ b/plat/qemu/qemu_io_storage.c @@ -26,14 +26,14 @@ #define BL33_IMAGE_NAME "bl33.bin" #if TRUSTED_BOARD_BOOT -#define BL2_CERT_NAME "bl2.crt" +#define TRUSTED_BOOT_FW_CERT_NAME "tb_fw.crt" #define TRUSTED_KEY_CERT_NAME "trusted_key.crt" -#define BL31_KEY_CERT_NAME "bl31_key.crt" -#define BL32_KEY_CERT_NAME "bl32_key.crt" -#define BL33_KEY_CERT_NAME "bl33_key.crt" -#define BL31_CERT_NAME "bl31.crt" -#define BL32_CERT_NAME "bl32.crt" -#define BL33_CERT_NAME "bl33.crt" +#define SOC_FW_KEY_CERT_NAME "soc_fw_key.crt" +#define TOS_FW_KEY_CERT_NAME "tos_fw_key.crt" +#define NT_FW_KEY_CERT_NAME "nt_fw_key.crt" +#define SOC_FW_CONTENT_CERT_NAME "soc_fw_content.crt" +#define TOS_FW_CONTENT_CERT_NAME "tos_fw_content.crt" +#define NT_FW_CONTENT_CERT_NAME "nt_fw_content.crt" #endif /* TRUSTED_BOARD_BOOT */ @@ -76,36 +76,36 @@ }; #if TRUSTED_BOARD_BOOT -static const io_uuid_spec_t bl2_cert_uuid_spec = { - .uuid = UUID_TRUSTED_BOOT_FIRMWARE_BL2_CERT, +static const io_uuid_spec_t tb_fw_cert_uuid_spec = { + .uuid = UUID_TRUSTED_BOOT_FW_CERT, }; static const io_uuid_spec_t trusted_key_cert_uuid_spec = { .uuid = UUID_TRUSTED_KEY_CERT, }; -static const io_uuid_spec_t bl31_key_cert_uuid_spec = { - .uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_KEY_CERT, +static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = { + .uuid = UUID_SOC_FW_KEY_CERT, }; -static const io_uuid_spec_t bl32_key_cert_uuid_spec = { - .uuid = UUID_SECURE_PAYLOAD_BL32_KEY_CERT, +static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_KEY_CERT, }; -static const io_uuid_spec_t bl33_key_cert_uuid_spec = { - .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_KEY_CERT, +static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_KEY_CERT, }; -static const io_uuid_spec_t bl31_cert_uuid_spec = { - .uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_CERT, +static const io_uuid_spec_t soc_fw_cert_uuid_spec = { + .uuid = UUID_SOC_FW_CONTENT_CERT, }; -static const io_uuid_spec_t bl32_cert_uuid_spec = { - .uuid = UUID_SECURE_PAYLOAD_BL32_CERT, +static const io_uuid_spec_t tos_fw_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT, }; -static const io_uuid_spec_t bl33_cert_uuid_spec = { - .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_CERT, +static const io_uuid_spec_t nt_fw_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT, }; #endif /* TRUSTED_BOARD_BOOT */ @@ -135,36 +135,36 @@ .mode = FOPEN_MODE_RB }, #if TRUSTED_BOARD_BOOT - [BL2_CERT_ID] = { - .path = BL2_CERT_NAME, + [TRUSTED_BOOT_FW_CERT_ID] = { + .path = TRUSTED_BOOT_FW_CERT_NAME, .mode = FOPEN_MODE_RB }, [TRUSTED_KEY_CERT_ID] = { .path = TRUSTED_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL31_KEY_CERT_ID] = { - .path = BL31_KEY_CERT_NAME, + [SOC_FW_KEY_CERT_ID] = { + .path = SOC_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL32_KEY_CERT_ID] = { - .path = BL32_KEY_CERT_NAME, + [TRUSTED_OS_FW_KEY_CERT_ID] = { + .path = TOS_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL33_KEY_CERT_ID] = { - .path = BL33_KEY_CERT_NAME, + [NON_TRUSTED_FW_KEY_CERT_ID] = { + .path = NT_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL31_CERT_ID] = { - .path = BL31_CERT_NAME, + [SOC_FW_CONTENT_CERT_ID] = { + .path = SOC_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL32_CERT_ID] = { - .path = BL32_CERT_NAME, + [TRUSTED_OS_FW_CONTENT_CERT_ID] = { + .path = TOS_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL33_CERT_ID] = { - .path = BL33_CERT_NAME, + [NON_TRUSTED_FW_CONTENT_CERT_ID] = { + .path = NT_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, #endif /* TRUSTED_BOARD_BOOT */ @@ -219,9 +219,9 @@ open_fip }, #if TRUSTED_BOARD_BOOT - [BL2_CERT_ID] = { + [TRUSTED_BOOT_FW_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl2_cert_uuid_spec, + (uintptr_t)&tb_fw_cert_uuid_spec, open_fip }, [TRUSTED_KEY_CERT_ID] = { @@ -229,34 +229,34 @@ (uintptr_t)&trusted_key_cert_uuid_spec, open_fip }, - [BL31_KEY_CERT_ID] = { + [SOC_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl31_key_cert_uuid_spec, + (uintptr_t)&soc_fw_key_cert_uuid_spec, open_fip }, - [BL32_KEY_CERT_ID] = { + [TRUSTED_OS_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl32_key_cert_uuid_spec, + (uintptr_t)&tos_fw_key_cert_uuid_spec, open_fip }, - [BL33_KEY_CERT_ID] = { + [NON_TRUSTED_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl33_key_cert_uuid_spec, + (uintptr_t)&nt_fw_key_cert_uuid_spec, open_fip }, - [BL31_CERT_ID] = { + [SOC_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl31_cert_uuid_spec, + (uintptr_t)&soc_fw_cert_uuid_spec, open_fip }, - [BL32_CERT_ID] = { + [TRUSTED_OS_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl32_cert_uuid_spec, + (uintptr_t)&tos_fw_cert_uuid_spec, open_fip }, - [BL33_CERT_ID] = { + [NON_TRUSTED_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl33_cert_uuid_spec, + (uintptr_t)&nt_fw_cert_uuid_spec, open_fip }, #endif /* TRUSTED_BOARD_BOOT */ diff --git a/plat/qemu/qemu_rotpk.S b/plat/qemu/qemu_rotpk.S new file mode 100644 index 0000000..5d1b83f --- /dev/null +++ b/plat/qemu/qemu_rotpk.S @@ -0,0 +1,15 @@ +/* + * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + + .global qemu_rotpk_hash + .global qemu_rotpk_hash_end +qemu_rotpk_hash: + /* DER header */ + .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48 + .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 + /* SHA256 */ + .incbin ROTPK_HASH +qemu_rotpk_hash_end: diff --git a/plat/qemu/qemu_trusted_boot.c b/plat/qemu/qemu_trusted_boot.c new file mode 100644 index 0000000..7d8fed2 --- /dev/null +++ b/plat/qemu/qemu_trusted_boot.c @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include + +extern char qemu_rotpk_hash[], qemu_rotpk_hash_end[]; + +int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, + unsigned int *flags) +{ + *key_ptr = qemu_rotpk_hash; + *key_len = qemu_rotpk_hash_end - qemu_rotpk_hash; + *flags = ROTPK_IS_HASH; + + return 0; +} + +int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr) +{ + *nv_ctr = 0; + + return 0; +} + +int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr) +{ + return 1; +}