1 /* 2 * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stddef.h> 8 9 #include <platform_def.h> 10 #include <drivers/auth/mbedtls/mbedtls_config.h> 11 12 #include <drivers/auth/auth_mod.h> 13 #include <drivers/auth/tbbr_cot_common.h> 14 #if USE_TBBR_DEFS 15 #include <tools_share/tbbr_oid.h> 16 #else 17 #include <platform_oid.h> 18 #endif 19 20 /* 21 * The platform must allocate buffers to store the authentication parameters 22 * extracted from the certificates. In this case, because of the way the CoT is 23 * established, we can reuse some of the buffers on different stages 24 */ 25 26 static unsigned char fw_config_hash_buf[HASH_DER_LEN]; 27 static unsigned char tb_fw_config_hash_buf[HASH_DER_LEN]; 28 static unsigned char hw_config_hash_buf[HASH_DER_LEN]; 29 unsigned char tb_fw_hash_buf[HASH_DER_LEN]; 30 unsigned char scp_fw_hash_buf[HASH_DER_LEN]; 31 unsigned char nt_world_bl_hash_buf[HASH_DER_LEN]; 32 33 /* 34 * common Parameter type descriptors across BL1 and BL2 35 */ 36 auth_param_type_desc_t trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( 37 AUTH_PARAM_NV_CTR, TRUSTED_FW_NVCOUNTER_OID); 38 auth_param_type_desc_t subject_pk = AUTH_PARAM_TYPE_DESC( 39 AUTH_PARAM_PUB_KEY, 0); 40 auth_param_type_desc_t sig = AUTH_PARAM_TYPE_DESC( 41 AUTH_PARAM_SIG, 0); 42 auth_param_type_desc_t sig_alg = AUTH_PARAM_TYPE_DESC( 43 AUTH_PARAM_SIG_ALG, 0); 44 auth_param_type_desc_t raw_data = AUTH_PARAM_TYPE_DESC( 45 AUTH_PARAM_RAW_DATA, 0); 46 47 /* common hash used across BL1 and BL2 */ 48 auth_param_type_desc_t tb_fw_hash = AUTH_PARAM_TYPE_DESC( 49 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID); 50 auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC( 51 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID); 52 auth_param_type_desc_t fw_config_hash = AUTH_PARAM_TYPE_DESC( 53 AUTH_PARAM_HASH, FW_CONFIG_HASH_OID); 54 static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC( 55 AUTH_PARAM_HASH, HW_CONFIG_HASH_OID); 56 57 /* trusted_boot_fw_cert */ 58 const auth_img_desc_t trusted_boot_fw_cert = { 59 .img_id = TRUSTED_BOOT_FW_CERT_ID, 60 .img_type = IMG_CERT, 61 .parent = NULL, 62 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 63 [0] = { 64 .type = AUTH_METHOD_SIG, 65 .param.sig = { 66 .pk = &subject_pk, 67 .sig = &sig, 68 .alg = &sig_alg, 69 .data = &raw_data 70 } 71 }, 72 [1] = { 73 .type = AUTH_METHOD_NV_CTR, 74 .param.nv_ctr = { 75 .cert_nv_ctr = &trusted_nv_ctr, 76 .plat_nv_ctr = &trusted_nv_ctr 77 } 78 } 79 }, 80 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 81 [0] = { 82 .type_desc = &tb_fw_hash, 83 .data = { 84 .ptr = (void *)tb_fw_hash_buf, 85 .len = (unsigned int)HASH_DER_LEN 86 } 87 }, 88 [1] = { 89 .type_desc = &tb_fw_config_hash, 90 .data = { 91 .ptr = (void *)tb_fw_config_hash_buf, 92 .len = (unsigned int)HASH_DER_LEN 93 } 94 }, 95 [2] = { 96 .type_desc = &hw_config_hash, 97 .data = { 98 .ptr = (void *)hw_config_hash_buf, 99 .len = (unsigned int)HASH_DER_LEN 100 } 101 }, 102 [3] = { 103 .type_desc = &fw_config_hash, 104 .data = { 105 .ptr = (void *)fw_config_hash_buf, 106 .len = (unsigned int)HASH_DER_LEN 107 } 108 } 109 } 110 }; 111 112 /* HW Config */ 113 const auth_img_desc_t hw_config = { 114 .img_id = HW_CONFIG_ID, 115 .img_type = IMG_RAW, 116 .parent = &trusted_boot_fw_cert, 117 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 118 [0] = { 119 .type = AUTH_METHOD_HASH, 120 .param.hash = { 121 .data = &raw_data, 122 .hash = &hw_config_hash 123 } 124 } 125 } 126 }; 127