1 /* 2 * Copyright (c) 2015-2025, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdio.h> 8 #include <string.h> 9 #include <openssl/err.h> 10 #include <openssl/x509v3.h> 11 12 #if USE_TBBR_DEFS 13 #include <tbbr_oid.h> 14 #else 15 #include <platform_oid.h> 16 #endif 17 18 #include "ext.h" 19 #include "tbbr/tbb_ext.h" 20 #include "tbbr/tbb_key.h" 21 22 static ext_t tbb_ext[] = { 23 [TRUSTED_FW_NVCOUNTER_EXT] = { 24 .oid = TRUSTED_FW_NVCOUNTER_OID, 25 .opt = "tfw-nvctr", 26 .help_msg = "Trusted Firmware Non-Volatile counter value", 27 .sn = "TrustedWorldNVCounter", 28 .ln = "Trusted World Non-Volatile counter", 29 .asn1_type = V_ASN1_INTEGER, 30 .type = EXT_TYPE_NVCOUNTER, 31 .attr.nvctr_type = NVCTR_TYPE_TFW 32 }, 33 [NON_TRUSTED_FW_NVCOUNTER_EXT] = { 34 .oid = NON_TRUSTED_FW_NVCOUNTER_OID, 35 .opt = "ntfw-nvctr", 36 .help_msg = "Non-Trusted Firmware Non-Volatile counter value", 37 .sn = "NormalWorldNVCounter", 38 .ln = "Non-Trusted Firmware Non-Volatile counter", 39 .asn1_type = V_ASN1_INTEGER, 40 .type = EXT_TYPE_NVCOUNTER, 41 .attr.nvctr_type = NVCTR_TYPE_NTFW 42 }, 43 [TRUSTED_BOOT_FW_HASH_EXT] = { 44 .oid = TRUSTED_BOOT_FW_HASH_OID, 45 .opt = "tb-fw", 46 .help_msg = "Trusted Boot Firmware image file", 47 .sn = "TrustedBootFirmwareHash", 48 .ln = "Trusted Boot Firmware hash (SHA256)", 49 .asn1_type = V_ASN1_OCTET_STRING, 50 .type = EXT_TYPE_HASH, 51 .optional = 1 52 }, 53 [TRUSTED_BOOT_FW_CONFIG_HASH_EXT] = { 54 .oid = TRUSTED_BOOT_FW_CONFIG_HASH_OID, 55 .opt = "tb-fw-config", 56 .help_msg = "Trusted Boot Firmware Config file", 57 .sn = "TrustedBootFirmwareConfigHash", 58 .ln = "Trusted Boot Firmware Config hash", 59 .asn1_type = V_ASN1_OCTET_STRING, 60 .type = EXT_TYPE_HASH, 61 .optional = 1 62 }, 63 [HW_CONFIG_HASH_EXT] = { 64 .oid = HW_CONFIG_HASH_OID, 65 .opt = "hw-config", 66 .help_msg = "HW Config file", 67 .sn = "HWConfigHash", 68 .ln = "HW Config hash", 69 .asn1_type = V_ASN1_OCTET_STRING, 70 .type = EXT_TYPE_HASH, 71 .optional = 1 72 }, 73 [FW_CONFIG_HASH_EXT] = { 74 .oid = FW_CONFIG_HASH_OID, 75 .opt = "fw-config", 76 .help_msg = "Firmware Config file", 77 .sn = "FirmwareConfigHash", 78 .ln = "Firmware Config hash", 79 .asn1_type = V_ASN1_OCTET_STRING, 80 .type = EXT_TYPE_HASH, 81 .optional = 1 82 }, 83 [TRUSTED_WORLD_PK_EXT] = { 84 .oid = TRUSTED_WORLD_PK_OID, 85 .sn = "TrustedWorldPublicKey", 86 .ln = "Trusted World Public Key", 87 .asn1_type = V_ASN1_OCTET_STRING, 88 .type = EXT_TYPE_PKEY, 89 .attr.key = TRUSTED_WORLD_KEY 90 }, 91 [NON_TRUSTED_WORLD_PK_EXT] = { 92 .oid = NON_TRUSTED_WORLD_PK_OID, 93 .sn = "NonTrustedWorldPublicKey", 94 .ln = "Non-Trusted World Public Key", 95 .asn1_type = V_ASN1_OCTET_STRING, 96 .type = EXT_TYPE_PKEY, 97 .attr.key = NON_TRUSTED_WORLD_KEY 98 }, 99 [SCP_FW_CONTENT_CERT_PK_EXT] = { 100 .oid = SCP_FW_CONTENT_CERT_PK_OID, 101 .sn = "SCPFirmwareContentCertPK", 102 .ln = "SCP Firmware content certificate public key", 103 .asn1_type = V_ASN1_OCTET_STRING, 104 .type = EXT_TYPE_PKEY, 105 .attr.key = SCP_FW_CONTENT_CERT_KEY 106 }, 107 [SCP_FW_HASH_EXT] = { 108 .oid = SCP_FW_HASH_OID, 109 .opt = "scp-fw", 110 .help_msg = "SCP Firmware image file", 111 .sn = "SCPFirmwareHash", 112 .ln = "SCP Firmware hash (SHA256)", 113 .asn1_type = V_ASN1_OCTET_STRING, 114 .type = EXT_TYPE_HASH 115 }, 116 [SOC_FW_CONTENT_CERT_PK_EXT] = { 117 .oid = SOC_FW_CONTENT_CERT_PK_OID, 118 .sn = "SoCFirmwareContentCertPK", 119 .ln = "SoC Firmware content certificate public key", 120 .asn1_type = V_ASN1_OCTET_STRING, 121 .type = EXT_TYPE_PKEY, 122 .attr.key = SOC_FW_CONTENT_CERT_KEY 123 }, 124 [SOC_AP_FW_HASH_EXT] = { 125 .oid = SOC_AP_FW_HASH_OID, 126 .opt = "soc-fw", 127 .help_msg = "SoC AP Firmware image file", 128 .sn = "SoCAPFirmwareHash", 129 .ln = "SoC AP Firmware hash (SHA256)", 130 .asn1_type = V_ASN1_OCTET_STRING, 131 .type = EXT_TYPE_HASH 132 }, 133 [SOC_FW_CONFIG_HASH_EXT] = { 134 .oid = SOC_FW_CONFIG_HASH_OID, 135 .opt = "soc-fw-config", 136 .help_msg = "SoC Firmware Config file", 137 .sn = "SocFirmwareConfigHash", 138 .ln = "SoC Firmware Config hash", 139 .asn1_type = V_ASN1_OCTET_STRING, 140 .type = EXT_TYPE_HASH, 141 .optional = 1 142 }, 143 [TRUSTED_OS_FW_CONTENT_CERT_PK_EXT] = { 144 .oid = TRUSTED_OS_FW_CONTENT_CERT_PK_OID, 145 .sn = "TrustedOSFirmwareContentCertPK", 146 .ln = "Trusted OS Firmware content certificate public key", 147 .asn1_type = V_ASN1_OCTET_STRING, 148 .type = EXT_TYPE_PKEY, 149 .attr.key = TRUSTED_OS_FW_CONTENT_CERT_KEY 150 }, 151 [TRUSTED_OS_FW_HASH_EXT] = { 152 .oid = TRUSTED_OS_FW_HASH_OID, 153 .opt = "tos-fw", 154 .help_msg = "Trusted OS image file", 155 .sn = "TrustedOSHash", 156 .ln = "Trusted OS hash (SHA256)", 157 .asn1_type = V_ASN1_OCTET_STRING, 158 .type = EXT_TYPE_HASH 159 }, 160 [TRUSTED_OS_FW_EXTRA1_HASH_EXT] = { 161 .oid = TRUSTED_OS_FW_EXTRA1_HASH_OID, 162 .opt = "tos-fw-extra1", 163 .help_msg = "Trusted OS Extra1 image file", 164 .sn = "TrustedOSExtra1Hash", 165 .ln = "Trusted OS Extra1 hash (SHA256)", 166 .asn1_type = V_ASN1_OCTET_STRING, 167 .type = EXT_TYPE_HASH, 168 .optional = 1 169 }, 170 [TRUSTED_OS_FW_EXTRA2_HASH_EXT] = { 171 .oid = TRUSTED_OS_FW_EXTRA2_HASH_OID, 172 .opt = "tos-fw-extra2", 173 .help_msg = "Trusted OS Extra2 image file", 174 .sn = "TrustedOSExtra2Hash", 175 .ln = "Trusted OS Extra2 hash (SHA256)", 176 .asn1_type = V_ASN1_OCTET_STRING, 177 .type = EXT_TYPE_HASH, 178 .optional = 1 179 }, 180 [TRUSTED_OS_FW_CONFIG_HASH_EXT] = { 181 .oid = TRUSTED_OS_FW_CONFIG_HASH_OID, 182 .opt = "tos-fw-config", 183 .help_msg = "Trusted OS Firmware Config file", 184 .sn = "TrustedOSFirmwareConfigHash", 185 .ln = "Trusted OS Firmware Config hash", 186 .asn1_type = V_ASN1_OCTET_STRING, 187 .type = EXT_TYPE_HASH, 188 .optional = 1 189 }, 190 [NON_TRUSTED_FW_CONTENT_CERT_PK_EXT] = { 191 .oid = NON_TRUSTED_FW_CONTENT_CERT_PK_OID, 192 .sn = "NonTrustedFirmwareContentCertPK", 193 .ln = "Non-Trusted Firmware content certificate public key", 194 .asn1_type = V_ASN1_OCTET_STRING, 195 .type = EXT_TYPE_PKEY, 196 .attr.key = NON_TRUSTED_FW_CONTENT_CERT_KEY 197 }, 198 [NON_TRUSTED_WORLD_BOOTLOADER_HASH_EXT] = { 199 .oid = NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID, 200 .opt = "nt-fw", 201 .help_msg = "Non-Trusted World Bootloader image file", 202 .sn = "NonTrustedWorldBootloaderHash", 203 .ln = "Non-Trusted World hash (SHA256)", 204 .asn1_type = V_ASN1_OCTET_STRING, 205 .type = EXT_TYPE_HASH 206 }, 207 [NON_TRUSTED_FW_CONFIG_HASH_EXT] = { 208 .oid = NON_TRUSTED_FW_CONFIG_HASH_OID, 209 .opt = "nt-fw-config", 210 .help_msg = "Non Trusted OS Firmware Config file", 211 .sn = "NonTrustedOSFirmwareConfigHash", 212 .ln = "Non-Trusted OS Firmware Config hash", 213 .asn1_type = V_ASN1_OCTET_STRING, 214 .type = EXT_TYPE_HASH, 215 .optional = 1 216 }, 217 [SP_PKG1_HASH_EXT] = { 218 .oid = SP_PKG1_HASH_OID, 219 .opt = "sp-pkg1", 220 .help_msg = "Secure Partition Package1 file", 221 .sn = "SPPkg1Hash", 222 .ln = "SP Pkg1 hash (SHA256)", 223 .asn1_type = V_ASN1_OCTET_STRING, 224 .type = EXT_TYPE_HASH, 225 .optional = 1 226 }, 227 [SP_PKG2_HASH_EXT] = { 228 .oid = SP_PKG2_HASH_OID, 229 .opt = "sp-pkg2", 230 .help_msg = "Secure Partition Package2 file", 231 .sn = "SPPkg2Hash", 232 .ln = "SP Pkg2 hash (SHA256)", 233 .asn1_type = V_ASN1_OCTET_STRING, 234 .type = EXT_TYPE_HASH, 235 .optional = 1 236 }, 237 [SP_PKG3_HASH_EXT] = { 238 .oid = SP_PKG3_HASH_OID, 239 .opt = "sp-pkg3", 240 .help_msg = "Secure Partition Package3 file", 241 .sn = "SPPkg3Hash", 242 .ln = "SP Pkg3 hash (SHA256)", 243 .asn1_type = V_ASN1_OCTET_STRING, 244 .type = EXT_TYPE_HASH, 245 .optional = 1 246 }, 247 [SP_PKG4_HASH_EXT] = { 248 .oid = SP_PKG4_HASH_OID, 249 .opt = "sp-pkg4", 250 .help_msg = "Secure Partition Package4 file", 251 .sn = "SPPkg4Hash", 252 .ln = "SP Pkg4 hash (SHA256)", 253 .asn1_type = V_ASN1_OCTET_STRING, 254 .type = EXT_TYPE_HASH, 255 .optional = 1 256 }, 257 [SP_PKG5_HASH_EXT] = { 258 .oid = SP_PKG5_HASH_OID, 259 .opt = "sp-pkg5", 260 .help_msg = "Secure Partition Package5 file", 261 .sn = "SPPkg5Hash", 262 .ln = "SP Pkg5 hash (SHA256)", 263 .asn1_type = V_ASN1_OCTET_STRING, 264 .type = EXT_TYPE_HASH, 265 .optional = 1 266 }, 267 [SP_PKG6_HASH_EXT] = { 268 .oid = SP_PKG6_HASH_OID, 269 .opt = "sp-pkg6", 270 .help_msg = "Secure Partition Package6 file", 271 .sn = "SPPkg6Hash", 272 .ln = "SP Pkg6 hash (SHA256)", 273 .asn1_type = V_ASN1_OCTET_STRING, 274 .type = EXT_TYPE_HASH, 275 .optional = 1 276 }, 277 [SP_PKG7_HASH_EXT] = { 278 .oid = SP_PKG7_HASH_OID, 279 .opt = "sp-pkg7", 280 .help_msg = "Secure Partition Package7 file", 281 .sn = "SPPkg7Hash", 282 .ln = "SP Pkg7 hash (SHA256)", 283 .asn1_type = V_ASN1_OCTET_STRING, 284 .type = EXT_TYPE_HASH, 285 .optional = 1 286 }, 287 [SP_PKG8_HASH_EXT] = { 288 .oid = SP_PKG8_HASH_OID, 289 .opt = "sp-pkg8", 290 .help_msg = "Secure Partition Package8 file", 291 .sn = "SPPkg8Hash", 292 .ln = "SP Pkg8 hash (SHA256)", 293 .asn1_type = V_ASN1_OCTET_STRING, 294 .type = EXT_TYPE_HASH, 295 .optional = 1 296 }, 297 [SCP_FWU_CFG_HASH_EXT] = { 298 .oid = SCP_FWU_CFG_HASH_OID, 299 .opt = "scp-fwu-cfg", 300 .help_msg = "SCP Firmware Update Config image file", 301 .sn = "SCPFWUpdateConfig", 302 .ln = "SCP Firmware Update Config hash (SHA256)", 303 .asn1_type = V_ASN1_OCTET_STRING, 304 .type = EXT_TYPE_HASH, 305 .optional = 1 306 }, 307 [AP_FWU_CFG_HASH_EXT] = { 308 .oid = AP_FWU_CFG_HASH_OID, 309 .opt = "ap-fwu-cfg", 310 .help_msg = "AP Firmware Update Config image file", 311 .sn = "APFWUpdateConfig", 312 .ln = "AP Firmware Update Config hash (SHA256)", 313 .asn1_type = V_ASN1_OCTET_STRING, 314 .type = EXT_TYPE_HASH, 315 .optional = 1 316 }, 317 [FWU_HASH_EXT] = { 318 .oid = FWU_HASH_OID, 319 .opt = "fwu", 320 .help_msg = "Firmware Updater image file", 321 .sn = "FWUpdaterHash", 322 .ln = "Firmware Updater hash (SHA256)", 323 .asn1_type = V_ASN1_OCTET_STRING, 324 .type = EXT_TYPE_HASH, 325 .optional = 1 326 } 327 }; 328 329 REGISTER_EXTENSIONS(tbb_ext); 330