1 /* 2 * Copyright (c) 2015-2023, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stddef.h> 8 9 #include <mbedtls/version.h> 10 11 #include <drivers/auth/auth_mod.h> 12 #include <drivers/auth/tbbr_cot_common.h> 13 14 #if USE_TBBR_DEFS 15 #include <tools_share/tbbr_oid.h> 16 #else 17 #include <platform_oid.h> 18 #endif 19 20 #include <platform_def.h> 21 /* 22 * The platform must allocate buffers to store the authentication parameters 23 * extracted from the certificates. In this case, because of the way the CoT is 24 * established, we can reuse some of the buffers on different stages 25 */ 26 27 static unsigned char fw_config_hash_buf[HASH_DER_LEN]; 28 static unsigned char tb_fw_config_hash_buf[HASH_DER_LEN]; 29 static unsigned char hw_config_hash_buf[HASH_DER_LEN]; 30 unsigned char tb_fw_hash_buf[HASH_DER_LEN]; 31 unsigned char scp_fw_hash_buf[HASH_DER_LEN]; 32 unsigned char nt_world_bl_hash_buf[HASH_DER_LEN]; 33 34 /* 35 * common Parameter type descriptors across BL1 and BL2 36 */ 37 auth_param_type_desc_t trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( 38 AUTH_PARAM_NV_CTR, TRUSTED_FW_NVCOUNTER_OID); 39 auth_param_type_desc_t subject_pk = AUTH_PARAM_TYPE_DESC( 40 AUTH_PARAM_PUB_KEY, 0); 41 auth_param_type_desc_t sig = AUTH_PARAM_TYPE_DESC( 42 AUTH_PARAM_SIG, 0); 43 auth_param_type_desc_t sig_alg = AUTH_PARAM_TYPE_DESC( 44 AUTH_PARAM_SIG_ALG, 0); 45 auth_param_type_desc_t raw_data = AUTH_PARAM_TYPE_DESC( 46 AUTH_PARAM_RAW_DATA, 0); 47 48 /* common hash used across BL1 and BL2 */ 49 auth_param_type_desc_t tb_fw_hash = AUTH_PARAM_TYPE_DESC( 50 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID); 51 auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC( 52 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID); 53 auth_param_type_desc_t fw_config_hash = AUTH_PARAM_TYPE_DESC( 54 AUTH_PARAM_HASH, FW_CONFIG_HASH_OID); 55 static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC( 56 AUTH_PARAM_HASH, HW_CONFIG_HASH_OID); 57 58 /* trusted_boot_fw_cert */ 59 const auth_img_desc_t trusted_boot_fw_cert = { 60 .img_id = TRUSTED_BOOT_FW_CERT_ID, 61 .img_type = IMG_CERT, 62 .parent = NULL, 63 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 64 [0] = { 65 .type = AUTH_METHOD_SIG, 66 .param.sig = { 67 .pk = &subject_pk, 68 .sig = &sig, 69 .alg = &sig_alg, 70 .data = &raw_data 71 } 72 }, 73 [1] = { 74 .type = AUTH_METHOD_NV_CTR, 75 .param.nv_ctr = { 76 .cert_nv_ctr = &trusted_nv_ctr, 77 .plat_nv_ctr = &trusted_nv_ctr 78 } 79 } 80 }, 81 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 82 [0] = { 83 .type_desc = &tb_fw_hash, 84 .data = { 85 .ptr = (void *)tb_fw_hash_buf, 86 .len = (unsigned int)HASH_DER_LEN 87 } 88 }, 89 [1] = { 90 .type_desc = &tb_fw_config_hash, 91 .data = { 92 .ptr = (void *)tb_fw_config_hash_buf, 93 .len = (unsigned int)HASH_DER_LEN 94 } 95 }, 96 [2] = { 97 .type_desc = &hw_config_hash, 98 .data = { 99 .ptr = (void *)hw_config_hash_buf, 100 .len = (unsigned int)HASH_DER_LEN 101 } 102 }, 103 [3] = { 104 .type_desc = &fw_config_hash, 105 .data = { 106 .ptr = (void *)fw_config_hash_buf, 107 .len = (unsigned int)HASH_DER_LEN 108 } 109 } 110 } 111 }; 112 113 /* HW Config */ 114 const auth_img_desc_t hw_config = { 115 .img_id = HW_CONFIG_ID, 116 .img_type = IMG_RAW, 117 .parent = &trusted_boot_fw_cert, 118 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 119 [0] = { 120 .type = AUTH_METHOD_HASH, 121 .param.hash = { 122 .data = &raw_data, 123 .hash = &hw_config_hash 124 } 125 } 126 } 127 }; 128