blob: 78e38f6bb5a83a72ee7fb11a8dc112bdc1547a82 [file] [log] [blame]
laurenw-arm56f1e3e2021-03-03 14:19:38 -06001/*
Manish V Badarkheabf1b8d2022-01-27 13:50:23 +00002 * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
laurenw-arm56f1e3e2021-03-03 14:19:38 -06003 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7#include <stddef.h>
8
9#include <drivers/auth/auth_mod.h>
Manish V Badarkheabf1b8d2022-01-27 13:50:23 +000010#include MBEDTLS_CONFIG_FILE
laurenw-arm56f1e3e2021-03-03 14:19:38 -060011#include <drivers/auth/tbbr_cot_common.h>
12
13#if USE_TBBR_DEFS
14#include <tools_share/tbbr_oid.h>
15#else
16#include <platform_oid.h>
17#endif
18#include <platform_def.h>
19
20
21static unsigned char trusted_world_pk_buf[PK_DER_LEN];
22static unsigned char non_trusted_world_pk_buf[PK_DER_LEN];
23static unsigned char content_pk_buf[PK_DER_LEN];
24static unsigned char nt_fw_config_hash_buf[HASH_DER_LEN];
25
26static auth_param_type_desc_t non_trusted_nv_ctr = AUTH_PARAM_TYPE_DESC(
27 AUTH_PARAM_NV_CTR, NON_TRUSTED_FW_NVCOUNTER_OID);
28static auth_param_type_desc_t trusted_world_pk = AUTH_PARAM_TYPE_DESC(
29 AUTH_PARAM_PUB_KEY, TRUSTED_WORLD_PK_OID);
30static auth_param_type_desc_t non_trusted_world_pk = AUTH_PARAM_TYPE_DESC(
31 AUTH_PARAM_PUB_KEY, NON_TRUSTED_WORLD_PK_OID);
32static auth_param_type_desc_t nt_fw_content_pk = AUTH_PARAM_TYPE_DESC(
33 AUTH_PARAM_PUB_KEY, NON_TRUSTED_FW_CONTENT_CERT_PK_OID);
34static auth_param_type_desc_t nt_world_bl_hash = AUTH_PARAM_TYPE_DESC(
35 AUTH_PARAM_HASH, NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID);
36static auth_param_type_desc_t nt_fw_config_hash = AUTH_PARAM_TYPE_DESC(
37 AUTH_PARAM_HASH, NON_TRUSTED_FW_CONFIG_HASH_OID);
38/*
39 * Trusted key certificate
40 */
41static const auth_img_desc_t trusted_key_cert = {
42 .img_id = TRUSTED_KEY_CERT_ID,
43 .img_type = IMG_CERT,
44 .parent = NULL,
45 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
46 [0] = {
47 .type = AUTH_METHOD_SIG,
48 .param.sig = {
49 .pk = &subject_pk,
50 .sig = &sig,
51 .alg = &sig_alg,
52 .data = &raw_data
53 }
54 },
55 [1] = {
56 .type = AUTH_METHOD_NV_CTR,
57 .param.nv_ctr = {
58 .cert_nv_ctr = &trusted_nv_ctr,
59 .plat_nv_ctr = &trusted_nv_ctr
60 }
61 }
62 },
63 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) {
64 [0] = {
65 .type_desc = &trusted_world_pk,
66 .data = {
67 .ptr = (void *)trusted_world_pk_buf,
68 .len = (unsigned int)PK_DER_LEN
69 }
70 },
71 [1] = {
72 .type_desc = &non_trusted_world_pk,
73 .data = {
74 .ptr = (void *)non_trusted_world_pk_buf,
75 .len = (unsigned int)PK_DER_LEN
76 }
77 }
78 }
79};
80/*
81 * Non-Trusted Firmware
82 */
83static const auth_img_desc_t non_trusted_fw_key_cert = {
84 .img_id = NON_TRUSTED_FW_KEY_CERT_ID,
85 .img_type = IMG_CERT,
86 .parent = &trusted_key_cert,
87 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
88 [0] = {
89 .type = AUTH_METHOD_SIG,
90 .param.sig = {
91 .pk = &non_trusted_world_pk,
92 .sig = &sig,
93 .alg = &sig_alg,
94 .data = &raw_data
95 }
96 },
97 [1] = {
98 .type = AUTH_METHOD_NV_CTR,
99 .param.nv_ctr = {
100 .cert_nv_ctr = &non_trusted_nv_ctr,
101 .plat_nv_ctr = &non_trusted_nv_ctr
102 }
103 }
104 },
105 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) {
106 [0] = {
107 .type_desc = &nt_fw_content_pk,
108 .data = {
109 .ptr = (void *)content_pk_buf,
110 .len = (unsigned int)PK_DER_LEN
111 }
112 }
113 }
114};
115static const auth_img_desc_t non_trusted_fw_content_cert = {
116 .img_id = NON_TRUSTED_FW_CONTENT_CERT_ID,
117 .img_type = IMG_CERT,
118 .parent = &non_trusted_fw_key_cert,
119 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
120 [0] = {
121 .type = AUTH_METHOD_SIG,
122 .param.sig = {
123 .pk = &nt_fw_content_pk,
124 .sig = &sig,
125 .alg = &sig_alg,
126 .data = &raw_data
127 }
128 },
129 [1] = {
130 .type = AUTH_METHOD_NV_CTR,
131 .param.nv_ctr = {
132 .cert_nv_ctr = &non_trusted_nv_ctr,
133 .plat_nv_ctr = &non_trusted_nv_ctr
134 }
135 }
136 },
137 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) {
138 [0] = {
139 .type_desc = &nt_world_bl_hash,
140 .data = {
141 .ptr = (void *)nt_world_bl_hash_buf,
142 .len = (unsigned int)HASH_DER_LEN
143 }
144 },
145 [1] = {
146 .type_desc = &nt_fw_config_hash,
147 .data = {
148 .ptr = (void *)nt_fw_config_hash_buf,
149 .len = (unsigned int)HASH_DER_LEN
150 }
151 }
152 }
153};
154static const auth_img_desc_t bl33_image = {
155 .img_id = BL33_IMAGE_ID,
156 .img_type = IMG_RAW,
157 .parent = &non_trusted_fw_content_cert,
158 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
159 [0] = {
160 .type = AUTH_METHOD_HASH,
161 .param.hash = {
162 .data = &raw_data,
163 .hash = &nt_world_bl_hash
164 }
165 }
166 }
167};
168
169static const auth_img_desc_t * const cot_desc[] = {
170 [TRUSTED_KEY_CERT_ID] = &trusted_key_cert,
171 [NON_TRUSTED_FW_KEY_CERT_ID] = &non_trusted_fw_key_cert,
172 [NON_TRUSTED_FW_CONTENT_CERT_ID] = &non_trusted_fw_content_cert,
173 [BL33_IMAGE_ID] = &bl33_image,
174};
175
176/* Register the CoT in the authentication module */
177REGISTER_COT(cot_desc);