Merge changes from topic "sp_dual_signing" into integration

* changes:
  SPM: Add owner field to cactus secure partitions
  SPM: Alter sp_gen.mk entry depending on owner of partition
  plat/arm: enable support for Plat owned SPs

Makefile

@@ -1135,7 +1135,7 @@ endif
 # Add Secure Partition packages
 ifeq (${NEED_SP_PKG},yes)
 $(BUILD_PLAT)/sp_gen.mk: ${SP_MK_GEN} ${SP_LAYOUT_FILE} | ${BUILD_PLAT}
-	${Q}${PYTHON} "$<" "$@" $(filter-out $<,$^) $(BUILD_PLAT)
+	${Q}${PYTHON} "$<" "$@" $(filter-out $<,$^) $(BUILD_PLAT) ${COT}
 sp: $(SPTOOL) $(DTBS) $(BUILD_PLAT)/sp_gen.mk
 	${Q}$(SPTOOL) $(SPTOOL_ARGS)
 	@${ECHO_BLANK_LINE}

include/plat/arm/common/fconf_arm_sp_getter.h

@@ -14,11 +14,13 @@
 #define arm__sp_getter(prop)	arm_sp.prop
 
 #define ARM_SP_MAX_SIZE		U(0x80000)
+#define ARM_SP_OWNER_NAME_LEN	U(8)
 
 struct arm_sp_t {
 	unsigned int		number_of_sp;
 	union uuid_helper_t	uuids[MAX_SP_IDS];
 	uintptr_t		load_addr[MAX_SP_IDS];
+	char			owner[MAX_SP_IDS][ARM_SP_OWNER_NAME_LEN];
 };
 
 int fconf_populate_arm_sp(uintptr_t config);

plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts

@@ -84,11 +84,13 @@
 		cactus-primary {
 			uuid = <0x1e67b5b4 0xe14f904a 0x13fb1fb8 0xcbdae1da>;
 			load-address = <0x7000000>;
+			owner = "SiP";
 		};
 
 		cactus-secondary {
 			uuid = <0x092358d1 0xb94723f0 0x64447c82 0xc88f57f5>;
 			load-address = <0x7100000>;
+			owner = "Plat";
 		};
 #endif
 	};

plat/arm/common/fconf/arm_fconf_io.c

@@ -52,6 +52,7 @@ const io_uuid_spec_t arm_uuid_spec[MAX_NUMBER_IDS] = {
 	[NON_TRUSTED_FW_CONTENT_CERT_ID] = {UUID_NON_TRUSTED_FW_CONTENT_CERT},
 #if defined(SPD_spmd)
 	[SIP_SP_CONTENT_CERT_ID] = {UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
+	[PLAT_SP_CONTENT_CERT_ID] = {UUID_PLAT_SECURE_PARTITION_CONTENT_CERT},
 #endif
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
@@ -189,6 +190,11 @@ struct plat_io_policy policies[MAX_NUMBER_IDS] = {
 		(uintptr_t)&arm_uuid_spec[SIP_SP_CONTENT_CERT_ID],
 		open_fip
 	},
+	[PLAT_SP_CONTENT_CERT_ID] = {
+		&fip_dev_handle,
+		(uintptr_t)&arm_uuid_spec[PLAT_SP_CONTENT_CERT_ID],
+		open_fip
+	},
 #endif
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
@@ -197,7 +203,7 @@ struct plat_io_policy policies[MAX_NUMBER_IDS] = {
 #ifdef IMAGE_BL2
 
 #if TRUSTED_BOARD_BOOT
-#define FCONF_ARM_IO_UUID_NUMBER	U(20)
+#define FCONF_ARM_IO_UUID_NUMBER	U(21)
 #else
 #define FCONF_ARM_IO_UUID_NUMBER	U(10)
 #endif
@@ -234,6 +240,7 @@ static const struct policies_load_info load_info[FCONF_ARM_IO_UUID_NUMBER] = {
 	{NON_TRUSTED_FW_CONTENT_CERT_ID, "nt_fw_content_cert_uuid"},
 #if defined(SPD_spmd)
 	{SIP_SP_CONTENT_CERT_ID, "sip_sp_content_cert_uuid"},
+	{PLAT_SP_CONTENT_CERT_ID, "plat_sp_content_cert_uuid"},
 #endif
 #endif /* TRUSTED_BOARD_BOOT */
 };

plat/arm/common/fconf/arm_fconf_sp.c

@@ -30,7 +30,13 @@ int fconf_populate_arm_sp(uintptr_t config)
 	union uuid_helper_t uuid_helper;
 	unsigned int index = 0;
 	uint32_t val32;
-	const unsigned int sp_start_index = SP_PKG1_ID;
+	bool is_plat_owned = false;
+	const unsigned int sip_start = SP_PKG1_ID;
+	unsigned int sip_index = sip_start;
+	const unsigned int sip_end = sip_start + MAX_SP_IDS / 2;
+	const unsigned int plat_start = SP_PKG5_ID;
+	unsigned int plat_index = plat_start;
+	const unsigned int plat_end = plat_start + MAX_SP_IDS / 2;
 
 	/* As libfdt use void *, we can't avoid this cast */
 	const void *dtb = (void *)config;
@@ -45,27 +51,20 @@ int fconf_populate_arm_sp(uintptr_t config)
 	}
 
 	fdt_for_each_subnode(sp_node, dtb, node) {
-		if (index == MAX_SP_IDS) {
+		if ((index == MAX_SP_IDS) || (sip_index == sip_end)
+		    || (plat_index == plat_end)) {
 			ERROR("FCONF: Reached max number of SPs\n");
 			return -1;
 		}
 
+		/* Read UUID */
 		err = fdt_read_uint32_array(dtb, sp_node, "uuid", 4,
 					    uuid_helper.word);
 		if (err < 0) {
 			ERROR("FCONF: cannot read SP uuid\n");
 			return -1;
 		}
-
 		arm_sp.uuids[index] = uuid_helper;
-
-		err = fdt_read_uint32(dtb, sp_node, "load-address", &val32);
-		if (err < 0) {
-			ERROR("FCONF: cannot read SP load address\n");
-			return -1;
-		}
-		arm_sp.load_addr[index] = val32;
-
 		VERBOSE("FCONF: %s UUID %x-%x-%x-%x load_addr=%lx\n",
 			__func__,
 			uuid_helper.word[0],
@@ -74,8 +73,52 @@ int fconf_populate_arm_sp(uintptr_t config)
 			uuid_helper.word[3],
 			arm_sp.load_addr[index]);
 
-		/* Add SP information in mem param descriptor */
-		sp_mem_params_descs[index].image_id = sp_start_index + index;
+		/* Read Load address */
+		err = fdt_read_uint32(dtb, sp_node, "load-address", &val32);
+		if (err < 0) {
+			ERROR("FCONF: cannot read SP load address\n");
+			return -1;
+		}
+		arm_sp.load_addr[index] = val32;
+
+		/* Read owner field only for dualroot CoT */
+#if defined(ARM_COT_dualroot)
+		/* Owner is an optional field, no need to catch error */
+		fdtw_read_string(dtb, sp_node, "owner",
+				arm_sp.owner[index], ARM_SP_OWNER_NAME_LEN);
+#endif
+		/* If owner is empty mark it as SiP owned */
+		if ((strncmp(arm_sp.owner[index], "SiP",
+			     ARM_SP_OWNER_NAME_LEN) == 0) ||
+		    (strncmp(arm_sp.owner[index], "",
+			     ARM_SP_OWNER_NAME_LEN) == 0)) {
+			is_plat_owned = false;
+		} else if (strcmp(arm_sp.owner[index], "Plat") == 0) {
+			is_plat_owned = true;
+		} else {
+			ERROR("FCONF: %s is not a valid SP owner\n",
+			      arm_sp.owner[index]);
+			return -1;
+		}
+		/*
+		 * Add SP information in mem param descriptor and IO policies
+		 * structure.
+		 */
+		if (is_plat_owned) {
+			sp_mem_params_descs[index].image_id = plat_index;
+			policies[plat_index].image_spec =
+						(uintptr_t)&arm_sp.uuids[index];
+			policies[plat_index].dev_handle = &fip_dev_handle;
+			policies[plat_index].check = open_fip;
+			plat_index++;
+		} else {
+			sp_mem_params_descs[index].image_id = sip_index;
+			policies[sip_index].image_spec =
+						(uintptr_t)&arm_sp.uuids[index];
+			policies[sip_index].dev_handle = &fip_dev_handle;
+			policies[sip_index].check = open_fip;
+			sip_index++;
+		}
 		SET_PARAM_HEAD(&sp_mem_params_descs[index].image_info,
 					PARAM_IMAGE_BINARY, VERSION_2, 0);
 		sp_mem_params_descs[index].image_info.image_max_size =
@@ -84,13 +127,6 @@ int fconf_populate_arm_sp(uintptr_t config)
 							INVALID_IMAGE_ID;
 		sp_mem_params_descs[index].image_info.image_base =
 							arm_sp.load_addr[index];
-
-		/* Add SP information in IO policies structure */
-		policies[sp_start_index + index].image_spec =
-						(uintptr_t)&arm_sp.uuids[index];
-		policies[sp_start_index + index].dev_handle = &fip_dev_handle;
-		policies[sp_start_index + index].check = open_fip;
-
 		index++;
 	}
 

tools/sptool/sp_mk_generator.py

@@ -19,6 +19,7 @@ standard format.
 param1: Generated mk file "sp_gen.mk"
 param2: "SP_LAYOUT_FILE", json file containing platform provided information
 param3: plat out directory
+param4: CoT parameter
 
 Generated "sp_gen.mk" file contains triplet of following information for each
 Secure Partition entry
@@ -58,11 +59,39 @@ json_dir = os.path.dirname(json_file)
 gen_file = os.path.abspath(sys.argv[1])
 out_dir = os.path.abspath(sys.argv[3])
 dtb_dir = out_dir + "/fdts/"
+MAX_SP = 8
+dualroot = sys.argv[4].lower() == "dualroot"
+split = int(MAX_SP / 2)
 print(dtb_dir)
+platform_count = 1
+sip_count = 1
 
 with open(gen_file, 'w') as out_file:
     for idx, key in enumerate(data.keys()):
 
+        pkg_num = idx + 1
+
+        if (pkg_num > MAX_SP):
+            print("WARNING: Too many secure partitions\n")
+            exit(-1)
+
+        if dualroot:
+            owner = data[key].get('owner')
+            if owner == "Plat":
+                if (platform_count > split):
+                    print("WARNING: Maximum Secure partitions by Plat " +
+                    "have been exceeded (" + str(split) + ")\n")
+                    exit(-1)
+                pkg_num = split + platform_count
+                platform_count += 1
+            elif (sip_count > split):
+                print("WARNING: Maximum Secure partitions by SiP " +
+                "have been exceeded (" + str(split) + ")\n")
+                exit(-1)
+            else:
+                pkg_num = sip_count
+                sip_count += 1
+
         """
         Append FDT_SOURCES
         """
@@ -81,10 +110,10 @@ with open(gen_file, 'w') as out_file:
         Extract uuid from partition manifest
         """
         pm_file = open(dts)
-        key = "uuid"
+        uuid_key = "uuid"
 
         for line in pm_file:
-            if key in line:
+            if uuid_key in line:
                 uuid_hex = re.findall(r'\<(.+?)\>', line)[0];
 
         # PM has uuid in format 0xABC... 0x... 0x... 0x...
@@ -103,5 +132,6 @@ with open(gen_file, 'w') as out_file:
         """
         Append CRT_ARGS
         """
-        out_file.write("CRT_ARGS += --sp-pkg" + str(idx + 1) + " " + dst + "\n")
+
+        out_file.write("CRT_ARGS += --sp-pkg" + str(pkg_num) + " " + dst + "\n")
         out_file.write("\n")