1 /* 2 * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * Redistributions of source code must retain the above copyright notice, this 8 * list of conditions and the following disclaimer. 9 * 10 * Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * Neither the name of ARM nor the names of its contributors may be used 15 * to endorse or promote products derived from this software without specific 16 * prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include "tbbr/tbb_cert.h" 32 #include "tbbr/tbb_ext.h" 33 #include "tbbr/tbb_key.h" 34 35 /* 36 * Certificates used in the chain of trust 37 * 38 * The order of the certificates must follow the enumeration specified in 39 * tbb_cert.h. All certificates are self-signed, so the issuer certificate 40 * field points to itself. 41 */ 42 static cert_t tbb_certs[] = { 43 [TRUSTED_BOOT_FW_CERT] = { 44 .id = TRUSTED_BOOT_FW_CERT, 45 .opt = "tb-fw-cert", 46 .help_msg = "Trusted Boot FW Certificate (output file)", 47 .fn = NULL, 48 .cn = "Trusted Boot FW Certificate", 49 .key = ROT_KEY, 50 .issuer = TRUSTED_BOOT_FW_CERT, 51 .ext = { 52 TRUSTED_FW_NVCOUNTER_EXT, 53 TRUSTED_BOOT_FW_HASH_EXT 54 }, 55 .num_ext = 2 56 }, 57 [TRUSTED_KEY_CERT] = { 58 .id = TRUSTED_KEY_CERT, 59 .opt = "trusted-key-cert", 60 .help_msg = "Trusted Key Certificate (output file)", 61 .fn = NULL, 62 .cn = "Trusted Key Certificate", 63 .key = ROT_KEY, 64 .issuer = TRUSTED_KEY_CERT, 65 .ext = { 66 TRUSTED_FW_NVCOUNTER_EXT, 67 TRUSTED_WORLD_PK_EXT, 68 NON_TRUSTED_WORLD_PK_EXT 69 }, 70 .num_ext = 3 71 }, 72 [SCP_FW_KEY_CERT] = { 73 .id = SCP_FW_KEY_CERT, 74 .opt = "scp-fw-key-cert", 75 .help_msg = "SCP Firmware Key Certificate (output file)", 76 .fn = NULL, 77 .cn = "SCP Firmware Key Certificate", 78 .key = TRUSTED_WORLD_KEY, 79 .issuer = SCP_FW_KEY_CERT, 80 .ext = { 81 TRUSTED_FW_NVCOUNTER_EXT, 82 SCP_FW_CONTENT_CERT_PK_EXT 83 }, 84 .num_ext = 2 85 }, 86 [SCP_FW_CONTENT_CERT] = { 87 .id = SCP_FW_CONTENT_CERT, 88 .opt = "scp-fw-cert", 89 .help_msg = "SCP Firmware Content Certificate (output file)", 90 .fn = NULL, 91 .cn = "SCP Firmware Content Certificate", 92 .key = SCP_FW_CONTENT_CERT_KEY, 93 .issuer = SCP_FW_CONTENT_CERT, 94 .ext = { 95 TRUSTED_FW_NVCOUNTER_EXT, 96 SCP_FW_HASH_EXT 97 }, 98 .num_ext = 2 99 }, 100 [SOC_FW_KEY_CERT] = { 101 .id = SOC_FW_KEY_CERT, 102 .opt = "soc-fw-key-cert", 103 .help_msg = "SoC Firmware Key Certificate (output file)", 104 .fn = NULL, 105 .cn = "SoC Firmware Key Certificate", 106 .key = TRUSTED_WORLD_KEY, 107 .issuer = SOC_FW_KEY_CERT, 108 .ext = { 109 TRUSTED_FW_NVCOUNTER_EXT, 110 SOC_FW_CONTENT_CERT_PK_EXT 111 }, 112 .num_ext = 2 113 }, 114 [SOC_FW_CONTENT_CERT] = { 115 .id = SOC_FW_CONTENT_CERT, 116 .opt = "soc-fw-cert", 117 .help_msg = "SoC Firmware Content Certificate (output file)", 118 .fn = NULL, 119 .cn = "SoC Firmware Content Certificate", 120 .key = SOC_FW_CONTENT_CERT_KEY, 121 .issuer = SOC_FW_CONTENT_CERT, 122 .ext = { 123 TRUSTED_FW_NVCOUNTER_EXT, 124 SOC_AP_FW_HASH_EXT 125 }, 126 .num_ext = 2 127 }, 128 [TRUSTED_OS_FW_KEY_CERT] = { 129 .id = TRUSTED_OS_FW_KEY_CERT, 130 .opt = "tos-fw-key-cert", 131 .help_msg = "Trusted OS Firmware Key Certificate (output file)", 132 .fn = NULL, 133 .cn = "Trusted OS Firmware Key Certificate", 134 .key = TRUSTED_WORLD_KEY, 135 .issuer = TRUSTED_OS_FW_KEY_CERT, 136 .ext = { 137 TRUSTED_FW_NVCOUNTER_EXT, 138 TRUSTED_OS_FW_CONTENT_CERT_PK_EXT 139 }, 140 .num_ext = 2 141 }, 142 [TRUSTED_OS_FW_CONTENT_CERT] = { 143 .id = TRUSTED_OS_FW_CONTENT_CERT, 144 .opt = "tos-fw-cert", 145 .help_msg = "Trusted OS Firmware Content Certificate (output file)", 146 .fn = NULL, 147 .cn = "Trusted OS Firmware Content Certificate", 148 .key = TRUSTED_OS_FW_CONTENT_CERT_KEY, 149 .issuer = TRUSTED_OS_FW_CONTENT_CERT, 150 .ext = { 151 TRUSTED_FW_NVCOUNTER_EXT, 152 TRUSTED_OS_FW_HASH_EXT 153 }, 154 .num_ext = 2 155 }, 156 [NON_TRUSTED_FW_KEY_CERT] = { 157 .id = NON_TRUSTED_FW_KEY_CERT, 158 .opt = "nt-fw-key-cert", 159 .help_msg = "Non-Trusted Firmware Key Certificate (output file)", 160 .fn = NULL, 161 .cn = "Non-Trusted Firmware Key Certificate", 162 .key = NON_TRUSTED_WORLD_KEY, 163 .issuer = NON_TRUSTED_FW_KEY_CERT, 164 .ext = { 165 NON_TRUSTED_FW_NVCOUNTER_EXT, 166 NON_TRUSTED_FW_CONTENT_CERT_PK_EXT 167 }, 168 .num_ext = 2 169 }, 170 [NON_TRUSTED_FW_CONTENT_CERT] = { 171 .id = NON_TRUSTED_FW_CONTENT_CERT, 172 .opt = "nt-fw-cert", 173 .help_msg = "Non-Trusted Firmware Content Certificate (output file)", 174 .fn = NULL, 175 .cn = "Non-Trusted Firmware Content Certificate", 176 .key = NON_TRUSTED_FW_CONTENT_CERT_KEY, 177 .issuer = NON_TRUSTED_FW_CONTENT_CERT, 178 .ext = { 179 NON_TRUSTED_FW_NVCOUNTER_EXT, 180 NON_TRUSTED_WORLD_BOOTLOADER_HASH_EXT 181 }, 182 .num_ext = 2 183 }, 184 [FWU_CERT] = { 185 .id = FWU_CERT, 186 .opt = "fwu-cert", 187 .help_msg = "Firmware Update Certificate (output file)", 188 .fn = NULL, 189 .cn = "Firmware Update Certificate", 190 .key = ROT_KEY, 191 .issuer = FWU_CERT, 192 .ext = { 193 SCP_FWU_CFG_HASH_EXT, 194 AP_FWU_CFG_HASH_EXT, 195 FWU_HASH_EXT 196 }, 197 .num_ext = 3 198 } 199 }; 200 201 REGISTER_COT(tbb_certs); 202