1 /* 2 * Copyright (c) 2021-2023, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stddef.h> 8 9 #include <mbedtls/version.h> 10 11 #include <drivers/auth/auth_mod.h> 12 #include <drivers/auth/tbbr_cot_common.h> 13 14 #if USE_TBBR_DEFS 15 #include <tools_share/tbbr_oid.h> 16 #else 17 #include <platform_oid.h> 18 #endif 19 20 #include <platform_def.h> 21 22 static unsigned char trusted_world_pk_buf[PK_DER_LEN]; 23 static unsigned char non_trusted_world_pk_buf[PK_DER_LEN]; 24 static unsigned char content_pk_buf[PK_DER_LEN]; 25 static unsigned char nt_fw_config_hash_buf[HASH_DER_LEN]; 26 27 static auth_param_type_desc_t non_trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( 28 AUTH_PARAM_NV_CTR, NON_TRUSTED_FW_NVCOUNTER_OID); 29 static auth_param_type_desc_t trusted_world_pk = AUTH_PARAM_TYPE_DESC( 30 AUTH_PARAM_PUB_KEY, TRUSTED_WORLD_PK_OID); 31 static auth_param_type_desc_t non_trusted_world_pk = AUTH_PARAM_TYPE_DESC( 32 AUTH_PARAM_PUB_KEY, NON_TRUSTED_WORLD_PK_OID); 33 static auth_param_type_desc_t nt_fw_content_pk = AUTH_PARAM_TYPE_DESC( 34 AUTH_PARAM_PUB_KEY, NON_TRUSTED_FW_CONTENT_CERT_PK_OID); 35 static auth_param_type_desc_t nt_world_bl_hash = AUTH_PARAM_TYPE_DESC( 36 AUTH_PARAM_HASH, NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID); 37 static auth_param_type_desc_t nt_fw_config_hash = AUTH_PARAM_TYPE_DESC( 38 AUTH_PARAM_HASH, NON_TRUSTED_FW_CONFIG_HASH_OID); 39 /* 40 * Trusted key certificate 41 */ 42 static const auth_img_desc_t trusted_key_cert = { 43 .img_id = TRUSTED_KEY_CERT_ID, 44 .img_type = IMG_CERT, 45 .parent = NULL, 46 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 47 [0] = { 48 .type = AUTH_METHOD_SIG, 49 .param.sig = { 50 .pk = &subject_pk, 51 .sig = &sig, 52 .alg = &sig_alg, 53 .data = &raw_data 54 } 55 }, 56 [1] = { 57 .type = AUTH_METHOD_NV_CTR, 58 .param.nv_ctr = { 59 .cert_nv_ctr = &trusted_nv_ctr, 60 .plat_nv_ctr = &trusted_nv_ctr 61 } 62 } 63 }, 64 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 65 [0] = { 66 .type_desc = &trusted_world_pk, 67 .data = { 68 .ptr = (void *)trusted_world_pk_buf, 69 .len = (unsigned int)PK_DER_LEN 70 } 71 }, 72 [1] = { 73 .type_desc = &non_trusted_world_pk, 74 .data = { 75 .ptr = (void *)non_trusted_world_pk_buf, 76 .len = (unsigned int)PK_DER_LEN 77 } 78 } 79 } 80 }; 81 /* 82 * Non-Trusted Firmware 83 */ 84 static const auth_img_desc_t non_trusted_fw_key_cert = { 85 .img_id = NON_TRUSTED_FW_KEY_CERT_ID, 86 .img_type = IMG_CERT, 87 .parent = &trusted_key_cert, 88 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 89 [0] = { 90 .type = AUTH_METHOD_SIG, 91 .param.sig = { 92 .pk = &non_trusted_world_pk, 93 .sig = &sig, 94 .alg = &sig_alg, 95 .data = &raw_data 96 } 97 }, 98 [1] = { 99 .type = AUTH_METHOD_NV_CTR, 100 .param.nv_ctr = { 101 .cert_nv_ctr = &non_trusted_nv_ctr, 102 .plat_nv_ctr = &non_trusted_nv_ctr 103 } 104 } 105 }, 106 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 107 [0] = { 108 .type_desc = &nt_fw_content_pk, 109 .data = { 110 .ptr = (void *)content_pk_buf, 111 .len = (unsigned int)PK_DER_LEN 112 } 113 } 114 } 115 }; 116 static const auth_img_desc_t non_trusted_fw_content_cert = { 117 .img_id = NON_TRUSTED_FW_CONTENT_CERT_ID, 118 .img_type = IMG_CERT, 119 .parent = &non_trusted_fw_key_cert, 120 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 121 [0] = { 122 .type = AUTH_METHOD_SIG, 123 .param.sig = { 124 .pk = &nt_fw_content_pk, 125 .sig = &sig, 126 .alg = &sig_alg, 127 .data = &raw_data 128 } 129 }, 130 [1] = { 131 .type = AUTH_METHOD_NV_CTR, 132 .param.nv_ctr = { 133 .cert_nv_ctr = &non_trusted_nv_ctr, 134 .plat_nv_ctr = &non_trusted_nv_ctr 135 } 136 } 137 }, 138 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 139 [0] = { 140 .type_desc = &nt_world_bl_hash, 141 .data = { 142 .ptr = (void *)nt_world_bl_hash_buf, 143 .len = (unsigned int)HASH_DER_LEN 144 } 145 }, 146 [1] = { 147 .type_desc = &nt_fw_config_hash, 148 .data = { 149 .ptr = (void *)nt_fw_config_hash_buf, 150 .len = (unsigned int)HASH_DER_LEN 151 } 152 } 153 } 154 }; 155 static const auth_img_desc_t bl33_image = { 156 .img_id = BL33_IMAGE_ID, 157 .img_type = IMG_RAW, 158 .parent = &non_trusted_fw_content_cert, 159 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 160 [0] = { 161 .type = AUTH_METHOD_HASH, 162 .param.hash = { 163 .data = &raw_data, 164 .hash = &nt_world_bl_hash 165 } 166 } 167 } 168 }; 169 170 static const auth_img_desc_t * const cot_desc[] = { 171 [TRUSTED_KEY_CERT_ID] = &trusted_key_cert, 172 [NON_TRUSTED_FW_KEY_CERT_ID] = &non_trusted_fw_key_cert, 173 [NON_TRUSTED_FW_CONTENT_CERT_ID] = &non_trusted_fw_content_cert, 174 [BL33_IMAGE_ID] = &bl33_image, 175 }; 176 177 /* Register the CoT in the authentication module */ 178 REGISTER_COT(cot_desc); 179
