1 /* 2 * Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stddef.h> 8 9 #include <platform_def.h> 10 #include <drivers/auth/mbedtls/mbedtls_config.h> 11 12 #include <drivers/auth/auth_mod.h> 13 #include <drivers/auth/tbbr_cot_common.h> 14 #if USE_TBBR_DEFS 15 #include <tools_share/tbbr_oid.h> 16 #else 17 #include <platform_oid.h> 18 #endif 19 20 /* 21 * The platform must allocate buffers to store the authentication parameters 22 * extracted from the certificates. In this case, because of the way the CoT is 23 * established, we can reuse some of the buffers on different stages 24 */ 25 26 unsigned char tb_fw_hash_buf[HASH_DER_LEN]; 27 unsigned char tb_fw_config_hash_buf[HASH_DER_LEN]; 28 unsigned char hw_config_hash_buf[HASH_DER_LEN]; 29 unsigned char scp_fw_hash_buf[HASH_DER_LEN]; 30 unsigned char nt_world_bl_hash_buf[HASH_DER_LEN]; 31 32 /* 33 * common Parameter type descriptors across BL1 and BL2 34 */ 35 auth_param_type_desc_t trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( 36 AUTH_PARAM_NV_CTR, TRUSTED_FW_NVCOUNTER_OID); 37 auth_param_type_desc_t subject_pk = AUTH_PARAM_TYPE_DESC( 38 AUTH_PARAM_PUB_KEY, 0); 39 auth_param_type_desc_t sig = AUTH_PARAM_TYPE_DESC( 40 AUTH_PARAM_SIG, 0); 41 auth_param_type_desc_t sig_alg = AUTH_PARAM_TYPE_DESC( 42 AUTH_PARAM_SIG_ALG, 0); 43 auth_param_type_desc_t raw_data = AUTH_PARAM_TYPE_DESC( 44 AUTH_PARAM_RAW_DATA, 0); 45 46 /* common hash used across BL1 and BL2 */ 47 auth_param_type_desc_t tb_fw_hash = AUTH_PARAM_TYPE_DESC( 48 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID); 49 auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC( 50 AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID); 51 auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC( 52 AUTH_PARAM_HASH, HW_CONFIG_HASH_OID); 53 54 /* trusted_boot_fw_cert */ 55 const auth_img_desc_t trusted_boot_fw_cert = { 56 .img_id = TRUSTED_BOOT_FW_CERT_ID, 57 .img_type = IMG_CERT, 58 .parent = NULL, 59 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 60 [0] = { 61 .type = AUTH_METHOD_SIG, 62 .param.sig = { 63 .pk = &subject_pk, 64 .sig = &sig, 65 .alg = &sig_alg, 66 .data = &raw_data 67 } 68 }, 69 [1] = { 70 .type = AUTH_METHOD_NV_CTR, 71 .param.nv_ctr = { 72 .cert_nv_ctr = &trusted_nv_ctr, 73 .plat_nv_ctr = &trusted_nv_ctr 74 } 75 } 76 }, 77 .authenticated_data = (const auth_param_desc_t[COT_MAX_VERIFIED_PARAMS]) { 78 [0] = { 79 .type_desc = &tb_fw_hash, 80 .data = { 81 .ptr = (void *)tb_fw_hash_buf, 82 .len = (unsigned int)HASH_DER_LEN 83 } 84 }, 85 [1] = { 86 .type_desc = &tb_fw_config_hash, 87 .data = { 88 .ptr = (void *)tb_fw_config_hash_buf, 89 .len = (unsigned int)HASH_DER_LEN 90 } 91 }, 92 [2] = { 93 .type_desc = &hw_config_hash, 94 .data = { 95 .ptr = (void *)hw_config_hash_buf, 96 .len = (unsigned int)HASH_DER_LEN 97 } 98 } 99 } 100 }; 101 102 /* HW Config */ 103 const auth_img_desc_t hw_config = { 104 .img_id = HW_CONFIG_ID, 105 .img_type = IMG_RAW, 106 .parent = &trusted_boot_fw_cert, 107 .img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { 108 [0] = { 109 .type = AUTH_METHOD_HASH, 110 .param.hash = { 111 .data = &raw_data, 112 .hash = &hw_config_hash 113 } 114 } 115 } 116 }; 117