qemu: Support optional encryption of BL31 and BL32 images

Enable encryption IO layer to be stacked above FIP IO layer for optional
encryption of Bl31 and BL32 images in case ENCRYPT_BL31 or ENCRYPT_BL32
build flag is set.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I24cba64728861e833abffc3d5d9807599c49feb6

diff --git a/plat/qemu/common/qemu_io_storage.c b/plat/qemu/common/qemu_io_storage.c
index 0e81cd1997b3739a153cf12d87a02c53d45f33a7..1107e443f3845b5c340645052196d75621a2b306 100644 (file)
--- a/plat/qemu/common/qemu_io_storage.c
+++ b/plat/qemu/common/qemu_io_storage.c
@@ -12,6 +12,7 @@
 #include <common/bl_common.h>
 #include <common/debug.h>
 #include <drivers/io/io_driver.h>
+#include <drivers/io/io_encrypted.h>
 #include <drivers/io/io_fip.h>
 #include <drivers/io/io_memmap.h>
 #include <drivers/io/io_semihosting.h>
@@ -47,6 +48,10 @@ static const io_dev_connector_t *memmap_dev_con;
 static uintptr_t memmap_dev_handle;
 static const io_dev_connector_t *sh_dev_con;
 static uintptr_t sh_dev_handle;
+#ifndef DECRYPTION_SUPPORT_none
+static const io_dev_connector_t *enc_dev_con;
+static uintptr_t enc_dev_handle;
+#endif
 
 static const io_block_spec_t fip_block_spec = {
        .offset = PLAT_QEMU_FIP_BASE,
@@ -172,10 +177,11 @@ static const io_file_spec_t sh_file_spec[] = {
 #endif /* TRUSTED_BOARD_BOOT */
 };
 
-
-
 static int open_fip(const uintptr_t spec);
 static int open_memmap(const uintptr_t spec);
+#ifndef DECRYPTION_SUPPORT_none
+static int open_enc_fip(const uintptr_t spec);
+#endif
 
 struct plat_io_policy {
        uintptr_t *dev_handle;
@@ -190,16 +196,46 @@ static const struct plat_io_policy policies[] = {
                (uintptr_t)&fip_block_spec,
                open_memmap
        },
+       [ENC_IMAGE_ID] = {
+               &fip_dev_handle,
+               (uintptr_t)NULL,
+               open_fip
+       },
        [BL2_IMAGE_ID] = {
                &fip_dev_handle,
                (uintptr_t)&bl2_uuid_spec,
                open_fip
        },
+#if ENCRYPT_BL31 && !defined(DECRYPTION_SUPPORT_none)
+       [BL31_IMAGE_ID] = {
+               &enc_dev_handle,
+               (uintptr_t)&bl31_uuid_spec,
+               open_enc_fip
+       },
+#else
        [BL31_IMAGE_ID] = {
                &fip_dev_handle,
                (uintptr_t)&bl31_uuid_spec,
                open_fip
        },
+#endif
+#if ENCRYPT_BL32 && !defined(DECRYPTION_SUPPORT_none)
+       [BL32_IMAGE_ID] = {
+               &enc_dev_handle,
+               (uintptr_t)&bl32_uuid_spec,
+               open_enc_fip
+       },
+       [BL32_EXTRA1_IMAGE_ID] = {
+               &enc_dev_handle,
+               (uintptr_t)&bl32_extra1_uuid_spec,
+               open_enc_fip
+       },
+       [BL32_EXTRA2_IMAGE_ID] = {
+               &enc_dev_handle,
+               (uintptr_t)&bl32_extra2_uuid_spec,
+               open_enc_fip
+       },
+#else
        [BL32_IMAGE_ID] = {
                &fip_dev_handle,
                (uintptr_t)&bl32_uuid_spec,
@@ -215,6 +251,7 @@ static const struct plat_io_policy policies[] = {
                (uintptr_t)&bl32_extra2_uuid_spec,
                open_fip
        },
+#endif
        [BL33_IMAGE_ID] = {
                &fip_dev_handle,
                (uintptr_t)&bl33_uuid_spec,
@@ -271,7 +308,7 @@ static int open_fip(const uintptr_t spec)
 
        /* See if a Firmware Image Package is available */
        result = io_dev_init(fip_dev_handle, (uintptr_t)FIP_IMAGE_ID);
-       if (result == 0) {
+       if (result == 0 && spec != (uintptr_t)NULL) {
                result = io_open(fip_dev_handle, spec, &local_image_handle);
                if (result == 0) {
                        VERBOSE("Using FIP\n");
@@ -281,6 +318,25 @@ static int open_fip(const uintptr_t spec)
        return result;
 }
 
+#ifndef DECRYPTION_SUPPORT_none
+static int open_enc_fip(const uintptr_t spec)
+{
+       int result;
+       uintptr_t local_image_handle;
+
+       /* See if an encrypted FIP is available */
+       result = io_dev_init(enc_dev_handle, (uintptr_t)ENC_IMAGE_ID);
+       if (result == 0) {
+               result = io_open(enc_dev_handle, spec, &local_image_handle);
+               if (result == 0) {
+                       VERBOSE("Using encrypted FIP\n");
+                       io_close(local_image_handle);
+               }
+       }
+       return result;
+}
+#endif
+
 static int open_memmap(const uintptr_t spec)
 {
        int result;
@@ -333,6 +389,15 @@ void plat_qemu_io_setup(void)
                                &memmap_dev_handle);
        assert(io_result == 0);
 
+#ifndef DECRYPTION_SUPPORT_none
+       io_result = register_io_dev_enc(&enc_dev_con);
+       assert(io_result == 0);
+
+       io_result = io_dev_open(enc_dev_con, (uintptr_t)NULL,
+                               &enc_dev_handle);
+       assert(io_result == 0);
+#endif
+
        /* Register the additional IO devices on this platform */
        io_result = register_io_dev_sh(&sh_dev_con);
        assert(io_result == 0);

diff --git a/plat/qemu/qemu/include/platform_def.h b/plat/qemu/qemu/include/platform_def.h
index 4abd77ebc221a14571a0822a0d6a28dad2a99281..ed4b748aff35cc4eee24bd5bb57e755f52ce7c9d 100644 (file)
--- a/plat/qemu/qemu/include/platform_def.h
+++ b/plat/qemu/qemu/include/platform_def.h
@@ -172,7 +172,7 @@
 #define PLAT_VIRT_ADDR_SPACE_SIZE      (1ULL << 32)
 #define MAX_MMAP_REGIONS               11
 #define MAX_XLAT_TABLES                        6
-#define MAX_IO_DEVICES                 3
+#define MAX_IO_DEVICES                 4
 #define MAX_IO_HANDLES                 4
 
 /*

diff --git a/plat/qemu/qemu/platform.mk b/plat/qemu/qemu/platform.mk
index bc10569ba7c836d9d1f880b140c128b45a392d10..928d69a7138a8088e872d2e28937793600ba5be1 100644 (file)
--- a/plat/qemu/qemu/platform.mk
+++ b/plat/qemu/qemu/platform.mk
@@ -128,6 +128,11 @@ ifeq ($(add-lib-optee),yes)
 BL2_SOURCES            +=      lib/optee/optee_utils.c
 endif
 
+ifneq (${DECRYPTION_SUPPORT},none)
+BL1_SOURCES            +=      drivers/io/io_encrypted.c
+BL2_SOURCES            +=      drivers/io/io_encrypted.c
+endif
+
 QEMU_GICV2_SOURCES     :=      drivers/arm/gic/v2/gicv2_helpers.c      \
                                drivers/arm/gic/v2/gicv2_main.c         \
                                drivers/arm/gic/common/gic_common.c     \
@@ -165,11 +170,19 @@ endif
 # Add the build options to pack Trusted OS Extra1 and Trusted OS Extra2 images
 # in the FIP if the platform requires.
 ifneq ($(BL32_EXTRA1),)
+ifneq (${DECRYPTION_SUPPORT},none)
+$(eval $(call TOOL_ADD_IMG,bl32_extra1,--tos-fw-extra1,,$(ENCRYPT_BL32)))
+else
 $(eval $(call TOOL_ADD_IMG,bl32_extra1,--tos-fw-extra1))
 endif
+endif
 ifneq ($(BL32_EXTRA2),)
+ifneq (${DECRYPTION_SUPPORT},none)
+$(eval $(call TOOL_ADD_IMG,bl32_extra2,--tos-fw-extra2,,$(ENCRYPT_BL32)))
+else
 $(eval $(call TOOL_ADD_IMG,bl32_extra2,--tos-fw-extra2))
 endif
+endif
 
 SEPARATE_CODE_AND_RODATA := 1
 ENABLE_STACK_PROTECTOR  := 0