From 5cc34b10b0f64faa27901256aed7a26223f072d0 Mon Sep 17 00:00:00 2001 From: Michalis Pappas Date: Wed, 18 Oct 2017 09:43:37 +0800 Subject: qemu: Add support for Trusted Board Boot This patch adds support for TBB to qemu. An RSA ROT keypair is generated at build time and is included into BL1/BL2. The key and content certificates are read over semihosting. Fixes ARM-software/tf-issues#526 Signed-off-by: Michalis Pappas --- plat/qemu/platform.mk | 46 ++++++++++++++++++++ plat/qemu/qemu_io_storage.c | 98 +++++++++++++++++++++---------------------- plat/qemu/qemu_rotpk.S | 15 +++++++ plat/qemu/qemu_trusted_boot.c | 31 ++++++++++++++ 4 files changed, 141 insertions(+), 49 deletions(-) create mode 100644 plat/qemu/qemu_rotpk.S create mode 100644 plat/qemu/qemu_trusted_boot.c diff --git a/plat/qemu/platform.mk b/plat/qemu/platform.mk index ed197a1d..2a7415f5 100644 --- a/plat/qemu/platform.mk +++ b/plat/qemu/platform.mk @@ -13,6 +13,7 @@ ifeq ($(NEED_BL32),yes) $(eval $(call add_define,QEMU_LOAD_BL32)) endif +PLAT_PATH := plat/qemu/ PLAT_INCLUDES := -Iinclude/plat/arm/common/ \ -Iinclude/plat/arm/common/aarch64/ \ -Iplat/qemu/include \ @@ -36,6 +37,51 @@ include lib/xlat_tables_v2/xlat_tables.mk PLAT_BL_COMMON_SOURCES += ${XLAT_TABLES_LIB_SRCS} endif +ifneq (${TRUSTED_BOARD_BOOT},0) + + include drivers/auth/mbedtls/mbedtls_crypto.mk + include drivers/auth/mbedtls/mbedtls_x509.mk + + USE_TBBR_DEFS := 1 + + AUTH_SOURCES := drivers/auth/auth_mod.c \ + drivers/auth/crypto_mod.c \ + drivers/auth/img_parser_mod.c \ + drivers/auth/tbbr/tbbr_cot.c + + PLAT_INCLUDES += -Iinclude/bl1/tbbr + + BL1_SOURCES += ${AUTH_SOURCES} \ + bl1/tbbr/tbbr_img_desc.c \ + plat/common/tbbr/plat_tbbr.c \ + plat/qemu/qemu_trusted_boot.c \ + $(PLAT_PATH)/qemu_rotpk.S + + BL2_SOURCES += ${AUTH_SOURCES} \ + plat/common/tbbr/plat_tbbr.c \ + plat/qemu/qemu_trusted_boot.c \ + $(PLAT_PATH)/qemu_rotpk.S + + ROT_KEY = $(BUILD_PLAT)/rot_key.pem + ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin + + $(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"')) + + $(BUILD_PLAT)/bl1/qemu_rotpk.o: $(ROTPK_HASH) + $(BUILD_PLAT)/bl2/qemu_rotpk.o: $(ROTPK_HASH) + + certificates: $(ROT_KEY) + + $(ROT_KEY): + @echo " OPENSSL $@" + $(Q)openssl genrsa 2048 > $@ 2>/dev/null + + $(ROTPK_HASH): $(ROT_KEY) + @echo " OPENSSL $@" + $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\ + openssl dgst -sha256 -binary > $@ 2>/dev/null +endif + BL1_SOURCES += drivers/io/io_semihosting.c \ drivers/io/io_storage.c \ drivers/io/io_fip.c \ diff --git a/plat/qemu/qemu_io_storage.c b/plat/qemu/qemu_io_storage.c index e0f7e8ab..1918f21d 100644 --- a/plat/qemu/qemu_io_storage.c +++ b/plat/qemu/qemu_io_storage.c @@ -26,14 +26,14 @@ #define BL33_IMAGE_NAME "bl33.bin" #if TRUSTED_BOARD_BOOT -#define BL2_CERT_NAME "bl2.crt" +#define TRUSTED_BOOT_FW_CERT_NAME "tb_fw.crt" #define TRUSTED_KEY_CERT_NAME "trusted_key.crt" -#define BL31_KEY_CERT_NAME "bl31_key.crt" -#define BL32_KEY_CERT_NAME "bl32_key.crt" -#define BL33_KEY_CERT_NAME "bl33_key.crt" -#define BL31_CERT_NAME "bl31.crt" -#define BL32_CERT_NAME "bl32.crt" -#define BL33_CERT_NAME "bl33.crt" +#define SOC_FW_KEY_CERT_NAME "soc_fw_key.crt" +#define TOS_FW_KEY_CERT_NAME "tos_fw_key.crt" +#define NT_FW_KEY_CERT_NAME "nt_fw_key.crt" +#define SOC_FW_CONTENT_CERT_NAME "soc_fw_content.crt" +#define TOS_FW_CONTENT_CERT_NAME "tos_fw_content.crt" +#define NT_FW_CONTENT_CERT_NAME "nt_fw_content.crt" #endif /* TRUSTED_BOARD_BOOT */ @@ -76,36 +76,36 @@ static const io_uuid_spec_t bl33_uuid_spec = { }; #if TRUSTED_BOARD_BOOT -static const io_uuid_spec_t bl2_cert_uuid_spec = { - .uuid = UUID_TRUSTED_BOOT_FIRMWARE_BL2_CERT, +static const io_uuid_spec_t tb_fw_cert_uuid_spec = { + .uuid = UUID_TRUSTED_BOOT_FW_CERT, }; static const io_uuid_spec_t trusted_key_cert_uuid_spec = { .uuid = UUID_TRUSTED_KEY_CERT, }; -static const io_uuid_spec_t bl31_key_cert_uuid_spec = { - .uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_KEY_CERT, +static const io_uuid_spec_t soc_fw_key_cert_uuid_spec = { + .uuid = UUID_SOC_FW_KEY_CERT, }; -static const io_uuid_spec_t bl32_key_cert_uuid_spec = { - .uuid = UUID_SECURE_PAYLOAD_BL32_KEY_CERT, +static const io_uuid_spec_t tos_fw_key_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_KEY_CERT, }; -static const io_uuid_spec_t bl33_key_cert_uuid_spec = { - .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_KEY_CERT, +static const io_uuid_spec_t nt_fw_key_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_KEY_CERT, }; -static const io_uuid_spec_t bl31_cert_uuid_spec = { - .uuid = UUID_EL3_RUNTIME_FIRMWARE_BL31_CERT, +static const io_uuid_spec_t soc_fw_cert_uuid_spec = { + .uuid = UUID_SOC_FW_CONTENT_CERT, }; -static const io_uuid_spec_t bl32_cert_uuid_spec = { - .uuid = UUID_SECURE_PAYLOAD_BL32_CERT, +static const io_uuid_spec_t tos_fw_cert_uuid_spec = { + .uuid = UUID_TRUSTED_OS_FW_CONTENT_CERT, }; -static const io_uuid_spec_t bl33_cert_uuid_spec = { - .uuid = UUID_NON_TRUSTED_FIRMWARE_BL33_CERT, +static const io_uuid_spec_t nt_fw_cert_uuid_spec = { + .uuid = UUID_NON_TRUSTED_FW_CONTENT_CERT, }; #endif /* TRUSTED_BOARD_BOOT */ @@ -135,36 +135,36 @@ static const io_file_spec_t sh_file_spec[] = { .mode = FOPEN_MODE_RB }, #if TRUSTED_BOARD_BOOT - [BL2_CERT_ID] = { - .path = BL2_CERT_NAME, + [TRUSTED_BOOT_FW_CERT_ID] = { + .path = TRUSTED_BOOT_FW_CERT_NAME, .mode = FOPEN_MODE_RB }, [TRUSTED_KEY_CERT_ID] = { .path = TRUSTED_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL31_KEY_CERT_ID] = { - .path = BL31_KEY_CERT_NAME, + [SOC_FW_KEY_CERT_ID] = { + .path = SOC_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL32_KEY_CERT_ID] = { - .path = BL32_KEY_CERT_NAME, + [TRUSTED_OS_FW_KEY_CERT_ID] = { + .path = TOS_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL33_KEY_CERT_ID] = { - .path = BL33_KEY_CERT_NAME, + [NON_TRUSTED_FW_KEY_CERT_ID] = { + .path = NT_FW_KEY_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL31_CERT_ID] = { - .path = BL31_CERT_NAME, + [SOC_FW_CONTENT_CERT_ID] = { + .path = SOC_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL32_CERT_ID] = { - .path = BL32_CERT_NAME, + [TRUSTED_OS_FW_CONTENT_CERT_ID] = { + .path = TOS_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, - [BL33_CERT_ID] = { - .path = BL33_CERT_NAME, + [NON_TRUSTED_FW_CONTENT_CERT_ID] = { + .path = NT_FW_CONTENT_CERT_NAME, .mode = FOPEN_MODE_RB }, #endif /* TRUSTED_BOARD_BOOT */ @@ -219,9 +219,9 @@ static const struct plat_io_policy policies[] = { open_fip }, #if TRUSTED_BOARD_BOOT - [BL2_CERT_ID] = { + [TRUSTED_BOOT_FW_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl2_cert_uuid_spec, + (uintptr_t)&tb_fw_cert_uuid_spec, open_fip }, [TRUSTED_KEY_CERT_ID] = { @@ -229,34 +229,34 @@ static const struct plat_io_policy policies[] = { (uintptr_t)&trusted_key_cert_uuid_spec, open_fip }, - [BL31_KEY_CERT_ID] = { + [SOC_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl31_key_cert_uuid_spec, + (uintptr_t)&soc_fw_key_cert_uuid_spec, open_fip }, - [BL32_KEY_CERT_ID] = { + [TRUSTED_OS_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl32_key_cert_uuid_spec, + (uintptr_t)&tos_fw_key_cert_uuid_spec, open_fip }, - [BL33_KEY_CERT_ID] = { + [NON_TRUSTED_FW_KEY_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl33_key_cert_uuid_spec, + (uintptr_t)&nt_fw_key_cert_uuid_spec, open_fip }, - [BL31_CERT_ID] = { + [SOC_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl31_cert_uuid_spec, + (uintptr_t)&soc_fw_cert_uuid_spec, open_fip }, - [BL32_CERT_ID] = { + [TRUSTED_OS_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl32_cert_uuid_spec, + (uintptr_t)&tos_fw_cert_uuid_spec, open_fip }, - [BL33_CERT_ID] = { + [NON_TRUSTED_FW_CONTENT_CERT_ID] = { &fip_dev_handle, - (uintptr_t)&bl33_cert_uuid_spec, + (uintptr_t)&nt_fw_cert_uuid_spec, open_fip }, #endif /* TRUSTED_BOARD_BOOT */ diff --git a/plat/qemu/qemu_rotpk.S b/plat/qemu/qemu_rotpk.S new file mode 100644 index 00000000..5d1b83f4 --- /dev/null +++ b/plat/qemu/qemu_rotpk.S @@ -0,0 +1,15 @@ +/* + * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + + .global qemu_rotpk_hash + .global qemu_rotpk_hash_end +qemu_rotpk_hash: + /* DER header */ + .byte 0x30, 0x31, 0x30, 0x0D, 0x06, 0x09, 0x60, 0x86, 0x48 + .byte 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 + /* SHA256 */ + .incbin ROTPK_HASH +qemu_rotpk_hash_end: diff --git a/plat/qemu/qemu_trusted_boot.c b/plat/qemu/qemu_trusted_boot.c new file mode 100644 index 00000000..7d8fed20 --- /dev/null +++ b/plat/qemu/qemu_trusted_boot.c @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include + +extern char qemu_rotpk_hash[], qemu_rotpk_hash_end[]; + +int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, + unsigned int *flags) +{ + *key_ptr = qemu_rotpk_hash; + *key_len = qemu_rotpk_hash_end - qemu_rotpk_hash; + *flags = ROTPK_IS_HASH; + + return 0; +} + +int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr) +{ + *nv_ctr = 0; + + return 0; +} + +int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr) +{ + return 1; +} -- cgit v1.2.3