From 0b6377d1c60c01dd456a1a88dac5b1e83c0e3273 Mon Sep 17 00:00:00 2001 From: Joel Hutton Date: Wed, 20 Feb 2019 11:56:46 +0000 Subject: [PATCH] Reduce memory needed for CoT description When Trusted Board Boot is enabled, we need to specify the Chain of Trust (CoT) of the BL1 and BL2 images. A CoT consists of an array of image descriptors. The authentication module assumes that each image descriptor in this array is indexed by its unique image identifier. For example, the Trusted Boot Firmware Certificate has to be at index [TRUSTED_BOOT_FW_CERT_ID]. Unique image identifiers may not necessarily be consecutive. Also, a given BL image might not use all image descriptors. For example, BL1 does not need any of the descriptors related to BL31. As a result, the CoT array might contain holes, which unnecessarily takes up space in the BL binary. Using pointers to auth_img_desc_t structs (rather than structs themselves) means these unused elements only use 1 pointer worth of space, rather than one struct worth of space. This patch also changes the code which accesses this array to reflect the change to pointers. Image descriptors not needed in BL1 or BL2 respectively are also ifdef'd out in this patch. For example, verifying the BL31 image is the responsibility of BL2 so BL1 does not need any of the data structures describing BL31. memory diff: bl1: bl2: text text -20 -20 bss bss -1463 0 data data -256 -48 rodata rodata -5240 -1952 total total -6979 -2020 Change-Id: I163668b174dc2b9bbb183acec817f2126864aaad Signed-off-by: Joel Hutton --- drivers/auth/auth_mod.c | 8 +- drivers/auth/tbbr/tbbr_cot.c | 1237 ++++++++++++++++--------------- include/drivers/auth/auth_mod.h | 10 +- 3 files changed, 655 insertions(+), 600 deletions(-) diff --git a/drivers/auth/auth_mod.c b/drivers/auth/auth_mod.c index 97e122032..d66e5dd1d 100644 --- a/drivers/auth/auth_mod.c +++ b/drivers/auth/auth_mod.c @@ -30,6 +30,10 @@ #pragma weak plat_set_nv_ctr2 +/* Pointer to CoT */ +extern const auth_img_desc_t **const cot_desc_ptr; +extern unsigned int auth_img_flags[MAX_NUMBER_IDS]; + static int cmp_auth_param_type_desc(const auth_param_type_desc_t *a, const auth_param_type_desc_t *b) { @@ -300,7 +304,7 @@ int auth_mod_get_parent_id(unsigned int img_id, unsigned int *parent_id) assert(parent_id != NULL); /* Get the image descriptor */ - img_desc = &cot_desc_ptr[img_id]; + img_desc = cot_desc_ptr[img_id]; /* Check if the image has no parent (ROT) */ if (img_desc->parent == NULL) { @@ -349,7 +353,7 @@ int auth_mod_verify_img(unsigned int img_id, int rc, i; /* Get the image descriptor from the chain of trust */ - img_desc = &cot_desc_ptr[img_id]; + img_desc = cot_desc_ptr[img_id]; /* Ask the parser to check the image integrity */ rc = img_parser_check_integrity(img_desc->img_type, img_ptr, img_len); diff --git a/drivers/auth/tbbr/tbbr_cot.c b/drivers/auth/tbbr/tbbr_cot.c index ec14a185d..1c962596c 100644 --- a/drivers/auth/tbbr/tbbr_cot.c +++ b/drivers/auth/tbbr/tbbr_cot.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. + * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -27,29 +27,31 @@ * extracted from the certificates. In this case, because of the way the CoT is * established, we can reuse some of the buffers on different stages */ + static unsigned char tb_fw_hash_buf[HASH_DER_LEN]; static unsigned char tb_fw_config_hash_buf[HASH_DER_LEN]; static unsigned char hw_config_hash_buf[HASH_DER_LEN]; static unsigned char scp_fw_hash_buf[HASH_DER_LEN]; +static unsigned char nt_world_bl_hash_buf[HASH_DER_LEN]; + +#ifdef IMAGE_BL2 static unsigned char soc_fw_hash_buf[HASH_DER_LEN]; static unsigned char tos_fw_hash_buf[HASH_DER_LEN]; static unsigned char tos_fw_extra1_hash_buf[HASH_DER_LEN]; static unsigned char tos_fw_extra2_hash_buf[HASH_DER_LEN]; -static unsigned char nt_world_bl_hash_buf[HASH_DER_LEN]; static unsigned char trusted_world_pk_buf[PK_DER_LEN]; static unsigned char non_trusted_world_pk_buf[PK_DER_LEN]; static unsigned char content_pk_buf[PK_DER_LEN]; static unsigned char soc_fw_config_hash_buf[HASH_DER_LEN]; static unsigned char tos_fw_config_hash_buf[HASH_DER_LEN]; static unsigned char nt_fw_config_hash_buf[HASH_DER_LEN]; +#endif /* * Parameter type descriptors */ static auth_param_type_desc_t trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_NV_CTR, TRUSTED_FW_NVCOUNTER_OID); -static auth_param_type_desc_t non_trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_NV_CTR, NON_TRUSTED_FW_NVCOUNTER_OID); static auth_param_type_desc_t subject_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, 0); @@ -60,11 +62,29 @@ static auth_param_type_desc_t sig_alg = AUTH_PARAM_TYPE_DESC( static auth_param_type_desc_t raw_data = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_RAW_DATA, 0); + +static auth_param_type_desc_t tb_fw_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID); +static auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID); +static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, HW_CONFIG_HASH_OID); +#ifdef IMAGE_BL1 +static auth_param_type_desc_t scp_bl2u_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, SCP_FWU_CFG_HASH_OID); +static auth_param_type_desc_t bl2u_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, AP_FWU_CFG_HASH_OID); +static auth_param_type_desc_t ns_bl2u_hash = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_HASH, FWU_HASH_OID); +#endif /* IMAGE_BL1 */ + +#ifdef IMAGE_BL2 +static auth_param_type_desc_t non_trusted_nv_ctr = AUTH_PARAM_TYPE_DESC( + AUTH_PARAM_NV_CTR, NON_TRUSTED_FW_NVCOUNTER_OID); static auth_param_type_desc_t trusted_world_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, TRUSTED_WORLD_PK_OID); static auth_param_type_desc_t non_trusted_world_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, NON_TRUSTED_WORLD_PK_OID); - static auth_param_type_desc_t scp_fw_content_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, SCP_FW_CONTENT_CERT_PK_OID); static auth_param_type_desc_t soc_fw_content_pk = AUTH_PARAM_TYPE_DESC( @@ -73,13 +93,6 @@ static auth_param_type_desc_t tos_fw_content_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, TRUSTED_OS_FW_CONTENT_CERT_PK_OID); static auth_param_type_desc_t nt_fw_content_pk = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_PUB_KEY, NON_TRUSTED_FW_CONTENT_CERT_PK_OID); - -static auth_param_type_desc_t tb_fw_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, TRUSTED_BOOT_FW_HASH_OID); -static auth_param_type_desc_t tb_fw_config_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, TRUSTED_BOOT_FW_CONFIG_HASH_OID); -static auth_param_type_desc_t hw_config_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, HW_CONFIG_HASH_OID); static auth_param_type_desc_t scp_fw_hash = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_HASH, SCP_FW_HASH_OID); static auth_param_type_desc_t soc_fw_hash = AUTH_PARAM_TYPE_DESC( @@ -98,678 +111,716 @@ static auth_param_type_desc_t nt_world_bl_hash = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_HASH, NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID); static auth_param_type_desc_t nt_fw_config_hash = AUTH_PARAM_TYPE_DESC( AUTH_PARAM_HASH, NON_TRUSTED_FW_CONFIG_HASH_OID); -static auth_param_type_desc_t scp_bl2u_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, SCP_FWU_CFG_HASH_OID); -static auth_param_type_desc_t bl2u_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, AP_FWU_CFG_HASH_OID); -static auth_param_type_desc_t ns_bl2u_hash = AUTH_PARAM_TYPE_DESC( - AUTH_PARAM_HASH, FWU_HASH_OID); -/* - * TBBR Chain of trust definition - */ -static const auth_img_desc_t cot_desc[] = { +#endif /* IMAGE_BL2 */ + + /* * BL2 */ - [TRUSTED_BOOT_FW_CERT_ID] = { - .img_id = TRUSTED_BOOT_FW_CERT_ID, - .img_type = IMG_CERT, - .parent = NULL, - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &subject_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } +static const auth_img_desc_t trusted_boot_fw_cert = { + .img_id = TRUSTED_BOOT_FW_CERT_ID, + .img_type = IMG_CERT, + .parent = NULL, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &subject_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &tb_fw_hash, - .data = { - .ptr = (void *)tb_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [1] = { - .type_desc = &tb_fw_config_hash, - .data = { - .ptr = (void *)tb_fw_config_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [2] = { - .type_desc = &hw_config_hash, - .data = { - .ptr = (void *)hw_config_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [BL2_IMAGE_ID] = { - .img_id = BL2_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_BOOT_FW_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tb_fw_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &tb_fw_hash, + .data = { + .ptr = (void *)tb_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [1] = { + .type_desc = &tb_fw_config_hash, + .data = { + .ptr = (void *)tb_fw_config_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [2] = { + .type_desc = &hw_config_hash, + .data = { + .ptr = (void *)hw_config_hash_buf, + .len = (unsigned int)HASH_DER_LEN } } - }, - /* HW Config */ - [HW_CONFIG_ID] = { - .img_id = HW_CONFIG_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_BOOT_FW_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &hw_config_hash, - } + } + }; +#ifdef IMAGE_BL1 +static const auth_img_desc_t bl2_image = { + .img_id = BL2_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &trusted_boot_fw_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tb_fw_hash } } - }, - /* TB FW Config */ - [TB_FW_CONFIG_ID] = { - .img_id = TB_FW_CONFIG_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_BOOT_FW_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tb_fw_config_hash, - } + } +}; +#endif /* IMAGE_BL1 */ +/* HW Config */ +static const auth_img_desc_t hw_config = { + .img_id = HW_CONFIG_ID, + .img_type = IMG_RAW, + .parent = &trusted_boot_fw_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &hw_config_hash } } - }, - /* - * Trusted key certificate - */ - [TRUSTED_KEY_CERT_ID] = { - .img_id = TRUSTED_KEY_CERT_ID, - .img_type = IMG_CERT, - .parent = NULL, - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &subject_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + } +}; +/* TB FW Config */ +#ifdef IMAGE_BL1 +static const auth_img_desc_t tb_fw_config = { + .img_id = TB_FW_CONFIG_ID, + .img_type = IMG_RAW, + .parent = &trusted_boot_fw_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tb_fw_config_hash + } + } + } +}; +#endif /* IMAGE_BL1 */ +#ifdef IMAGE_BL2 +/* + * Trusted key certificate + */ +static const auth_img_desc_t trusted_key_cert = { + .img_id = TRUSTED_KEY_CERT_ID, + .img_type = IMG_CERT, + .parent = NULL, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &subject_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &trusted_world_pk, - .data = { - .ptr = (void *)trusted_world_pk_buf, - .len = (unsigned int)PK_DER_LEN - } - }, - [1] = { - .type_desc = &non_trusted_world_pk, - .data = { - .ptr = (void *)non_trusted_world_pk_buf, - .len = (unsigned int)PK_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - /* - * SCP Firmware - */ - [SCP_FW_KEY_CERT_ID] = { - .img_id = SCP_FW_KEY_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[TRUSTED_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &trusted_world_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + .authenticated_data = { + [0] = { + .type_desc = &trusted_world_pk, + .data = { + .ptr = (void *)trusted_world_pk_buf, + .len = (unsigned int)PK_DER_LEN } }, - .authenticated_data = { - [0] = { - .type_desc = &scp_fw_content_pk, - .data = { - .ptr = (void *)content_pk_buf, - .len = (unsigned int)PK_DER_LEN - } + [1] = { + .type_desc = &non_trusted_world_pk, + .data = { + .ptr = (void *)non_trusted_world_pk_buf, + .len = (unsigned int)PK_DER_LEN } } - }, - [SCP_FW_CONTENT_CERT_ID] = { - .img_id = SCP_FW_CONTENT_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[SCP_FW_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &scp_fw_content_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + } +}; +/* + * SCP Firmware + */ +static const auth_img_desc_t scp_fw_key_cert = { + .img_id = SCP_FW_KEY_CERT_ID, + .img_type = IMG_CERT, + .parent = &trusted_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &trusted_world_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &scp_fw_hash, - .data = { - .ptr = (void *)scp_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [SCP_BL2_IMAGE_ID] = { - .img_id = SCP_BL2_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[SCP_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &scp_fw_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &scp_fw_content_pk, + .data = { + .ptr = (void *)content_pk_buf, + .len = (unsigned int)PK_DER_LEN } } - }, - /* - * SoC Firmware - */ - [SOC_FW_KEY_CERT_ID] = { - .img_id = SOC_FW_KEY_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[TRUSTED_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &trusted_world_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + } +}; +static const auth_img_desc_t scp_fw_content_cert = { + .img_id = SCP_FW_CONTENT_CERT_ID, + .img_type = IMG_CERT, + .parent = &scp_fw_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &scp_fw_content_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &soc_fw_content_pk, - .data = { - .ptr = (void *)content_pk_buf, - .len = (unsigned int)PK_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [SOC_FW_CONTENT_CERT_ID] = { - .img_id = SOC_FW_CONTENT_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[SOC_FW_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &soc_fw_content_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + .authenticated_data = { + [0] = { + .type_desc = &scp_fw_hash, + .data = { + .ptr = (void *)scp_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + } + } +}; +static const auth_img_desc_t scp_bl2_image = { + .img_id = SCP_BL2_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &scp_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &scp_fw_hash + } + } + } +}; +/* + * SoC Firmware + */ +static const auth_img_desc_t soc_fw_key_cert = { + .img_id = SOC_FW_KEY_CERT_ID, + .img_type = IMG_CERT, + .parent = &trusted_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &trusted_world_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &soc_fw_hash, - .data = { - .ptr = (void *)soc_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [1] = { - .type_desc = &soc_fw_config_hash, - .data = { - .ptr = (void *)soc_fw_config_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [BL31_IMAGE_ID] = { - .img_id = BL31_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[SOC_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &soc_fw_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &soc_fw_content_pk, + .data = { + .ptr = (void *)content_pk_buf, + .len = (unsigned int)PK_DER_LEN } } - }, - /* SOC FW Config */ - [SOC_FW_CONFIG_ID] = { - .img_id = SOC_FW_CONFIG_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[SOC_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &soc_fw_config_hash, - } + } +}; +static const auth_img_desc_t soc_fw_content_cert = { + .img_id = SOC_FW_CONTENT_CERT_ID, + .img_type = IMG_CERT, + .parent = &soc_fw_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &soc_fw_content_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data + } + }, + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - /* - * Trusted OS Firmware - */ - [TRUSTED_OS_FW_KEY_CERT_ID] = { - .img_id = TRUSTED_OS_FW_KEY_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[TRUSTED_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &trusted_world_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + .authenticated_data = { + [0] = { + .type_desc = &soc_fw_hash, + .data = { + .ptr = (void *)soc_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN } }, - .authenticated_data = { - [0] = { - .type_desc = &tos_fw_content_pk, - .data = { - .ptr = (void *)content_pk_buf, - .len = (unsigned int)PK_DER_LEN - } + [1] = { + .type_desc = &soc_fw_config_hash, + .data = { + .ptr = (void *)soc_fw_config_hash_buf, + .len = (unsigned int)HASH_DER_LEN } } - }, - [TRUSTED_OS_FW_CONTENT_CERT_ID] = { - .img_id = TRUSTED_OS_FW_CONTENT_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[TRUSTED_OS_FW_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &tos_fw_content_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &trusted_nv_ctr, - .plat_nv_ctr = &trusted_nv_ctr - } + } +}; +static const auth_img_desc_t bl31_image = { + .img_id = BL31_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &soc_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &soc_fw_hash + } + } + } +}; +/* SOC FW Config */ +static const auth_img_desc_t soc_fw_config = { + .img_id = SOC_FW_CONFIG_ID, + .img_type = IMG_RAW, + .parent = &soc_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &soc_fw_config_hash + } + } + } +}; +/* + * Trusted OS Firmware + */ +static const auth_img_desc_t trusted_os_fw_key_cert = { + .img_id = TRUSTED_OS_FW_KEY_CERT_ID, + .img_type = IMG_CERT, + .parent = &trusted_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &trusted_world_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &tos_fw_hash, - .data = { - .ptr = (void *)tos_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [1] = { - .type_desc = &tos_fw_extra1_hash, - .data = { - .ptr = (void *)tos_fw_extra1_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [2] = { - .type_desc = &tos_fw_extra2_hash, - .data = { - .ptr = (void *)tos_fw_extra2_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [3] = { - .type_desc = &tos_fw_config_hash, - .data = { - .ptr = (void *)tos_fw_config_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [BL32_IMAGE_ID] = { - .img_id = BL32_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_OS_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tos_fw_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &tos_fw_content_pk, + .data = { + .ptr = (void *)content_pk_buf, + .len = (unsigned int)PK_DER_LEN } } - }, - [BL32_EXTRA1_IMAGE_ID] = { - .img_id = BL32_EXTRA1_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_OS_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tos_fw_extra1_hash, - } + } +}; +static const auth_img_desc_t trusted_os_fw_content_cert = { + .img_id = TRUSTED_OS_FW_CONTENT_CERT_ID, + .img_type = IMG_CERT, + .parent = &trusted_os_fw_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &tos_fw_content_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data + } + }, + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &trusted_nv_ctr, + .plat_nv_ctr = &trusted_nv_ctr } } }, - [BL32_EXTRA2_IMAGE_ID] = { - .img_id = BL32_EXTRA2_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_OS_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tos_fw_extra2_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &tos_fw_hash, + .data = { + .ptr = (void *)tos_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [1] = { + .type_desc = &tos_fw_extra1_hash, + .data = { + .ptr = (void *)tos_fw_extra1_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [2] = { + .type_desc = &tos_fw_extra2_hash, + .data = { + .ptr = (void *)tos_fw_extra2_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [3] = { + .type_desc = &tos_fw_config_hash, + .data = { + .ptr = (void *)tos_fw_config_hash_buf, + .len = (unsigned int)HASH_DER_LEN } } - }, - /* TOS FW Config */ - [TOS_FW_CONFIG_ID] = { - .img_id = TOS_FW_CONFIG_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[TRUSTED_OS_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &tos_fw_config_hash, - } + } +}; +static const auth_img_desc_t bl32_image = { + .img_id = BL32_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &trusted_os_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tos_fw_hash } } - }, - /* - * Non-Trusted Firmware - */ - [NON_TRUSTED_FW_KEY_CERT_ID] = { - .img_id = NON_TRUSTED_FW_KEY_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[TRUSTED_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &non_trusted_world_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &non_trusted_nv_ctr, - .plat_nv_ctr = &non_trusted_nv_ctr - } + } +}; +static const auth_img_desc_t bl32_extra1_image = { + .img_id = BL32_EXTRA1_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &trusted_os_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tos_fw_extra1_hash + } + } + } +}; +static const auth_img_desc_t bl32_extra2_image = { + .img_id = BL32_EXTRA2_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &trusted_os_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tos_fw_extra2_hash + } + } + } +}; +/* TOS FW Config */ +static const auth_img_desc_t tos_fw_config = { + .img_id = TOS_FW_CONFIG_ID, + .img_type = IMG_RAW, + .parent = &trusted_os_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &tos_fw_config_hash + } + } + } +}; +/* + * Non-Trusted Firmware + */ +static const auth_img_desc_t non_trusted_fw_key_cert = { + .img_id = NON_TRUSTED_FW_KEY_CERT_ID, + .img_type = IMG_CERT, + .parent = &trusted_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &non_trusted_world_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &nt_fw_content_pk, - .data = { - .ptr = (void *)content_pk_buf, - .len = (unsigned int)PK_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &non_trusted_nv_ctr, + .plat_nv_ctr = &non_trusted_nv_ctr } } }, - [NON_TRUSTED_FW_CONTENT_CERT_ID] = { - .img_id = NON_TRUSTED_FW_CONTENT_CERT_ID, - .img_type = IMG_CERT, - .parent = &cot_desc[NON_TRUSTED_FW_KEY_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &nt_fw_content_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } - }, - [1] = { - .type = AUTH_METHOD_NV_CTR, - .param.nv_ctr = { - .cert_nv_ctr = &non_trusted_nv_ctr, - .plat_nv_ctr = &non_trusted_nv_ctr - } + .authenticated_data = { + [0] = { + .type_desc = &nt_fw_content_pk, + .data = { + .ptr = (void *)content_pk_buf, + .len = (unsigned int)PK_DER_LEN + } + } + } +}; +static const auth_img_desc_t non_trusted_fw_content_cert = { + .img_id = NON_TRUSTED_FW_CONTENT_CERT_ID, + .img_type = IMG_CERT, + .parent = &non_trusted_fw_key_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &nt_fw_content_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } }, - .authenticated_data = { - [0] = { - .type_desc = &nt_world_bl_hash, - .data = { - .ptr = (void *)nt_world_bl_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [1] = { - .type_desc = &nt_fw_config_hash, - .data = { - .ptr = (void *)nt_fw_config_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type = AUTH_METHOD_NV_CTR, + .param.nv_ctr = { + .cert_nv_ctr = &non_trusted_nv_ctr, + .plat_nv_ctr = &non_trusted_nv_ctr } } }, - [BL33_IMAGE_ID] = { - .img_id = BL33_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[NON_TRUSTED_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &nt_world_bl_hash, - } + .authenticated_data = { + [0] = { + .type_desc = &nt_world_bl_hash, + .data = { + .ptr = (void *)nt_world_bl_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [1] = { + .type_desc = &nt_fw_config_hash, + .data = { + .ptr = (void *)nt_fw_config_hash_buf, + .len = (unsigned int)HASH_DER_LEN } } - }, - /* NT FW Config */ - [NT_FW_CONFIG_ID] = { - .img_id = NT_FW_CONFIG_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[NON_TRUSTED_FW_CONTENT_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &nt_fw_config_hash, - } + } +}; +static const auth_img_desc_t bl33_image = { + .img_id = BL33_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &non_trusted_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &nt_world_bl_hash + } + } + } +}; +/* NT FW Config */ +static const auth_img_desc_t nt_fw_config = { + .img_id = NT_FW_CONFIG_ID, + .img_type = IMG_RAW, + .parent = &non_trusted_fw_content_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &nt_fw_config_hash + } + } + } +}; +#else /* IMAGE_BL2 */ +/* + * FWU auth descriptor. + */ +static const auth_img_desc_t fwu_cert = { + .img_id = FWU_CERT_ID, + .img_type = IMG_CERT, + .parent = NULL, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_SIG, + .param.sig = { + .pk = &subject_pk, + .sig = &sig, + .alg = &sig_alg, + .data = &raw_data } } }, - /* - * FWU auth descriptor. - */ - [FWU_CERT_ID] = { - .img_id = FWU_CERT_ID, - .img_type = IMG_CERT, - .parent = NULL, - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_SIG, - .param.sig = { - .pk = &subject_pk, - .sig = &sig, - .alg = &sig_alg, - .data = &raw_data, - } + .authenticated_data = { + [0] = { + .type_desc = &scp_bl2u_hash, + .data = { + .ptr = (void *)scp_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN } }, - .authenticated_data = { - [0] = { - .type_desc = &scp_bl2u_hash, - .data = { - .ptr = (void *)scp_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [1] = { - .type_desc = &bl2u_hash, - .data = { - .ptr = (void *)tb_fw_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } - }, - [2] = { - .type_desc = &ns_bl2u_hash, - .data = { - .ptr = (void *)nt_world_bl_hash_buf, - .len = (unsigned int)HASH_DER_LEN - } + [1] = { + .type_desc = &bl2u_hash, + .data = { + .ptr = (void *)tb_fw_hash_buf, + .len = (unsigned int)HASH_DER_LEN + } + }, + [2] = { + .type_desc = &ns_bl2u_hash, + .data = { + .ptr = (void *)nt_world_bl_hash_buf, + .len = (unsigned int)HASH_DER_LEN } } - }, - /* - * SCP_BL2U - */ - [SCP_BL2U_IMAGE_ID] = { - .img_id = SCP_BL2U_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[FWU_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &scp_bl2u_hash, - } + } +}; +/* + * SCP_BL2U + */ +static const auth_img_desc_t scp_bl2u_image = { + .img_id = SCP_BL2U_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &fwu_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &scp_bl2u_hash } } - }, - /* - * BL2U - */ - [BL2U_IMAGE_ID] = { - .img_id = BL2U_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[FWU_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &bl2u_hash, - } + } +}; +/* + * BL2U + */ +static const auth_img_desc_t bl2u_image = { + .img_id = BL2U_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &fwu_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &bl2u_hash } } - }, - /* - * NS_BL2U - */ - [NS_BL2U_IMAGE_ID] = { - .img_id = NS_BL2U_IMAGE_ID, - .img_type = IMG_RAW, - .parent = &cot_desc[FWU_CERT_ID], - .img_auth_methods = { - [0] = { - .type = AUTH_METHOD_HASH, - .param.hash = { - .data = &raw_data, - .hash = &ns_bl2u_hash, + } +}; +/* + * NS_BL2U + */ +static const auth_img_desc_t ns_bl2u_image = { + .img_id = NS_BL2U_IMAGE_ID, + .img_type = IMG_RAW, + .parent = &fwu_cert, + .img_auth_methods = { + [0] = { + .type = AUTH_METHOD_HASH, + .param.hash = { + .data = &raw_data, + .hash = &ns_bl2u_hash } } } - } + }; +#endif /* IMAGE_BL2 */ +/* + * TBBR Chain of trust definition + */ + +#ifdef IMAGE_BL1 +static const auth_img_desc_t * const cot_desc[] = { + [TRUSTED_BOOT_FW_CERT_ID] = &trusted_boot_fw_cert, + [BL2_IMAGE_ID] = &bl2_image, + [HW_CONFIG_ID] = &hw_config, + [TB_FW_CONFIG_ID] = &tb_fw_config, + [FWU_CERT_ID] = &fwu_cert, + [SCP_BL2U_IMAGE_ID] = &scp_bl2u_image, + [BL2U_IMAGE_ID] = &bl2u_image, + [NS_BL2U_IMAGE_ID] = &ns_bl2u_image +}; +#else /* IMAGE_BL2 */ +static const auth_img_desc_t * const cot_desc[] = { + [TRUSTED_BOOT_FW_CERT_ID] = &trusted_boot_fw_cert, + [HW_CONFIG_ID] = &hw_config, + [TRUSTED_KEY_CERT_ID] = &trusted_key_cert, + [SCP_FW_KEY_CERT_ID] = &scp_fw_key_cert, + [SCP_FW_CONTENT_CERT_ID] = &scp_fw_content_cert, + [SCP_BL2_IMAGE_ID] = &scp_bl2_image, + [SOC_FW_KEY_CERT_ID] = &soc_fw_key_cert, + [SOC_FW_CONTENT_CERT_ID] = &soc_fw_content_cert, + [BL31_IMAGE_ID] = &bl31_image, + [SOC_FW_CONFIG_ID] = &soc_fw_config, + [TRUSTED_OS_FW_KEY_CERT_ID] = &trusted_os_fw_key_cert, + [TRUSTED_OS_FW_CONTENT_CERT_ID] = &trusted_os_fw_content_cert, + [BL32_IMAGE_ID] = &bl32_image, + [BL32_EXTRA1_IMAGE_ID] = &bl32_extra1_image, + [BL32_EXTRA2_IMAGE_ID] = &bl32_extra2_image, + [TOS_FW_CONFIG_ID] = &tos_fw_config, + [NON_TRUSTED_FW_KEY_CERT_ID] = &non_trusted_fw_key_cert, + [NON_TRUSTED_FW_CONTENT_CERT_ID] = &non_trusted_fw_content_cert, + [BL33_IMAGE_ID] = &bl33_image, + [NT_FW_CONFIG_ID] = &nt_fw_config, }; +#endif /* Register the CoT in the authentication module */ REGISTER_COT(cot_desc); diff --git a/include/drivers/auth/auth_mod.h b/include/drivers/auth/auth_mod.h index 908995391..0119ed2e0 100644 --- a/include/drivers/auth/auth_mod.h +++ b/include/drivers/auth/auth_mod.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. + * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -38,13 +38,13 @@ int auth_mod_verify_img(unsigned int img_id, void *img_ptr, unsigned int img_len); -/* Macro to register a CoT defined as an array of auth_img_desc_t */ +/* Macro to register a CoT defined as an array of auth_img_desc_t pointers */ #define REGISTER_COT(_cot) \ - const auth_img_desc_t *const cot_desc_ptr = \ - (const auth_img_desc_t *const)&_cot[0]; \ + const auth_img_desc_t **const cot_desc_ptr = \ + (const auth_img_desc_t **const)_cot; \ unsigned int auth_img_flags[MAX_NUMBER_IDS] -extern const auth_img_desc_t *const cot_desc_ptr; +extern const auth_img_desc_t **const cot_desc_ptr; extern unsigned int auth_img_flags[MAX_NUMBER_IDS]; #endif /* TRUSTED_BOARD_BOOT */