feat(rme): add dummy realm attestation key to RMMD
Add a dummy realm attestation key to RMMD, and return it on request.
The realm attestation key is requested with an SMC with the following
parameters:
* Fid (0xC400001B2).
* Attestation key buffer PA (the realm attestation key is copied
at this address by the monitor).
* Attestation key buffer length as input and size of realm
attesation key as output.
* Type of elliptic curve.
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Signed-off-by: Subhasish Ghosh <subhasish.ghosh@arm.com>
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
Change-Id: I12d8d98fd221f4638ef225c9383374ddf6e65eac
diff --git a/docs/getting_started/porting-guide.rst b/docs/getting_started/porting-guide.rst
index d935436..3d3b2e3 100644
--- a/docs/getting_started/porting-guide.rst
+++ b/docs/getting_started/porting-guide.rst
@@ -2043,6 +2043,32 @@
The function returns 0 on success, -EINVAL on failure.
+Function : plat_get_cca_realm_attest_key() [mandatory when ENABLE_RME == 1]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+ Argument : uintptr_t, size_t *, unsigned int
+ Return : int
+
+This function returns the delegated realm attestation key which will be used to
+sign Realm attestation token. The API currently only supports P-384 ECC curve
+key.
+
+The parameters of the function are:
+
+ arg0 - A pointer to the buffer where the attestation key should be copied
+ by this function. The buffer must be big enough to hold the
+ attestation key.
+
+ arg1 - Contains the size (in bytes) of the buffer passed in arg0. The
+ function returns the attestation key length in this parameter.
+
+ arg2 - The type of the elliptic curve to which the requested attestation key
+ belongs.
+
+The function returns 0 on success, -EINVAL on failure.
+
Function : bl31_plat_enable_mmu [optional]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -3180,7 +3206,7 @@
--------------
-*Copyright (c) 2013-2021, Arm Limited and Contributors. All rights reserved.*
+*Copyright (c) 2013-2022, Arm Limited and Contributors. All rights reserved.*
.. _PSCI: http://infocenter.arm.com/help/topic/com.arm.doc.den0022c/DEN0022C_Power_State_Coordination_Interface.pdf
.. _Arm Generic Interrupt Controller version 2.0 (GICv2): http://infocenter.arm.com/help/topic/com.arm.doc.ihi0048b/index.html
diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h
index 9deb33d..7664509 100644
--- a/include/plat/common/platform.h
+++ b/include/plat/common/platform.h
@@ -307,6 +307,9 @@
******************************************************************************/
int plat_get_cca_attest_token(uintptr_t buf, size_t *len,
uintptr_t hash, size_t hash_size);
+int plat_get_cca_realm_attest_key(uintptr_t buf, size_t *len,
+ unsigned int type);
+
/*******************************************************************************
* Optional BL31 functions (may be overridden)
******************************************************************************/
diff --git a/include/services/rmmd_svc.h b/include/services/rmmd_svc.h
index 9b4c39f..2fbdddd 100644
--- a/include/services/rmmd_svc.h
+++ b/include/services/rmmd_svc.h
@@ -97,6 +97,25 @@
#define SHA384_DIGEST_SIZE 48U
#define SHA512_DIGEST_SIZE 64U
+/*
+ * Retrieve Realm attestation key from EL3. Only P-384 ECC curve key is
+ * supported. The arguments to this SMC are :
+ * arg0 - Function ID.
+ * arg1 - Realm attestation key buffer Physical address.
+ * arg2 - Realm attestation key buffer size (in bytes).
+ * arg3 - The type of the elliptic curve to which the requested
+ * attestation key belongs to. The value should be one of the
+ * defined curve types.
+ * The return arguments are :
+ * ret0 - Status / error.
+ * ret1 - Size of the realm attestation key if successful.
+ */
+#define RMMD_ATTEST_GET_REALM_KEY RMM_FID(SMC_64, ATTEST_GET_REALM_KEY)
+
+/* ECC Curve types for attest key generation */
+#define ATTEST_KEY_CURVE_ECC_SECP384R1 0
+
+
#ifndef __ASSEMBLER__
#include <stdint.h>
@@ -120,5 +139,4 @@
uint64_t flags);
#endif /* __ASSEMBLER__ */
-
#endif /* RMMD_SVC_H */
diff --git a/plat/arm/board/fvp/fvp_realm_attest_key.c b/plat/arm/board/fvp/fvp_realm_attest_key.c
new file mode 100644
index 0000000..b32f557
--- /dev/null
+++ b/plat/arm/board/fvp/fvp_realm_attest_key.c
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2022, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <services/rmmd_svc.h>
+
+static uint8_t sample_attest_priv_key[] = {
+ 0x20, 0x11, 0xC7, 0xF0, 0x3C, 0xEE, 0x43, 0x25, 0x17, 0x6E,
+ 0x52, 0x4F, 0x03, 0x3C, 0x0C, 0xE1, 0xE2, 0x1A, 0x76, 0xE6,
+ 0xC1, 0xA4, 0xF0, 0xB8, 0x39, 0xAA, 0x1D, 0xF6, 0x1E, 0x0E,
+ 0x8A, 0x5C, 0x8A, 0x05, 0x74, 0x0F, 0x9B, 0x69, 0xEF, 0xA7,
+ 0xEB, 0x1A, 0x41, 0x85, 0xBD, 0x11, 0x7F, 0x68
+};
+
+int plat_get_cca_realm_attest_key(uintptr_t buf, size_t *len, unsigned int type)
+{
+ assert(type == ATTEST_KEY_CURVE_ECC_SECP384R1);
+
+ if (*len < sizeof(sample_attest_priv_key)) {
+ return -EINVAL;
+ }
+
+ (void)memcpy((void *)buf, sample_attest_priv_key,
+ sizeof(sample_attest_priv_key));
+ *len = sizeof(sample_attest_priv_key);
+
+ return 0;
+}
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index 895d773..c9f5551 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -193,7 +193,8 @@
ifeq (${ENABLE_RME},1)
BL2_SOURCES += plat/arm/board/fvp/aarch64/fvp_helpers.S
-BL31_SOURCES += plat/arm/board/fvp/fvp_plat_attest_token.c
+BL31_SOURCES += plat/arm/board/fvp/fvp_plat_attest_token.c \
+ plat/arm/board/fvp/fvp_realm_attest_key.c
endif
ifeq (${BL2_AT_EL3},1)
diff --git a/services/std_svc/rmmd/rmmd_attest.c b/services/std_svc/rmmd/rmmd_attest.c
index d111b88..0432ec3 100644
--- a/services/std_svc/rmmd/rmmd_attest.c
+++ b/services/std_svc/rmmd/rmmd_attest.c
@@ -116,3 +116,51 @@
return err;
}
+int rmmd_attest_get_signing_key(uint64_t buf_pa, uint64_t *buf_len,
+ uint64_t ecc_curve)
+{
+ int err;
+ uintptr_t va;
+
+ /*
+ * TODO: Currently we don't validate incoming buf_pa. This is a
+ * prototype and we will need to allocate static buffer for EL3-RMM
+ * communication.
+ */
+
+ /* We need a page of buffer to pass data */
+ if (*buf_len != PAGE_SIZE) {
+ ERROR("Invalid buffer length\n");
+ return RMMD_ERR_INVAL;
+ }
+
+ if (ecc_curve != ATTEST_KEY_CURVE_ECC_SECP384R1) {
+ ERROR("Invalid ECC curve specified\n");
+ return RMMD_ERR_INVAL;
+ }
+
+ spin_lock(&lock);
+
+ /* Map the buffer that was provided by the RMM. */
+ err = mmap_add_dynamic_region_alloc_va(buf_pa, &va, PAGE_SIZE,
+ MT_RW_DATA | MT_REALM);
+ if (err != 0) {
+ ERROR("mmap_add_dynamic_region_alloc_va failed: %d (%p).\n"
+ , err, (void *)buf_pa);
+ spin_unlock(&lock);
+ return RMMD_ERR_NOMEM;
+ }
+
+ /* Get the Realm attestation key. */
+ err = plat_get_cca_realm_attest_key(va, buf_len, (unsigned int)ecc_curve);
+ if (err != 0) {
+ ERROR("Failed to get attestation key: %d.\n", err);
+ err = RMMD_ERR_UNK;
+ }
+
+ /* Unmap RMM memory. */
+ (void)mmap_remove_dynamic_region(va, PAGE_SIZE);
+ spin_unlock(&lock);
+
+ return err;
+}
diff --git a/services/std_svc/rmmd/rmmd_main.c b/services/std_svc/rmmd/rmmd_main.c
index c59e68a..cf5ff7b 100644
--- a/services/std_svc/rmmd/rmmd_main.c
+++ b/services/std_svc/rmmd/rmmd_main.c
@@ -375,6 +375,9 @@
case RMMD_ATTEST_GET_PLAT_TOKEN:
ret = rmmd_attest_get_platform_token(x1, &x2, x3);
SMC_RET2(handle, ret, x2);
+ case RMMD_ATTEST_GET_REALM_KEY:
+ ret = rmmd_attest_get_signing_key(x1, &x2, x3);
+ SMC_RET2(handle, ret, x2);
default:
WARN("RMMD: Unsupported RMM-EL3 call 0x%08x\n", smc_fid);
SMC_RET1(handle, SMC_UNK);
diff --git a/services/std_svc/rmmd/rmmd_private.h b/services/std_svc/rmmd/rmmd_private.h
index d7ef4e1..73df2b8 100644
--- a/services/std_svc/rmmd/rmmd_private.h
+++ b/services/std_svc/rmmd/rmmd_private.h
@@ -54,6 +54,8 @@
/* Functions implementing attestation utilities for RMM */
int rmmd_attest_get_platform_token(uint64_t buf_pa, uint64_t *buf_len,
uint64_t challenge_hash_len);
+int rmmd_attest_get_signing_key(uint64_t buf_pa, uint64_t *buf_len,
+ uint64_t ecc_curve);
/* Assembly helpers */
uint64_t rmmd_rmm_enter(uint64_t *c_rt_ctx);