aboutsummaryrefslogtreecommitdiff
path: root/include/drivers/auth/auth_mod.h
AgeCommit message (Collapse)Author
2023-02-21refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILEGovindraj Raja
Currently we include MBEDTLS_CONFIG_FILE directly and if a custom config file is used it will included. However from mbedtls-3.x onwards it discourages usage of MBEDTLS_CONFIG_FILE include directly, so to resolve this and keep 2.28 compatibility include version.h which would include the custom config file if present and also would expose us with mbedtls-major-version number which could be used for selecting features and functions for mbedtls 2.28 or 3.3 Change-Id: I029992311be2a38b588ebbb350875b03ea29acdb Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2022-01-11refactor(measured-boot): avoid Measured-Boot dependency on Trusted-BootManish V Badarkhe
Measured-Boot and Trusted-Boot are orthogonal to each other and hence removed dependency of Trusted-Boot on Measured-Boot by making below changes - 1. BL1 and BL2 main functions are used for initializing Crypto module instead of the authentication module 2. Updated Crypto module registration macro for MEASURED_BOOT with only necessary callbacks for calculating image hashes 3. The 'load_auth_image' function is now used for the image measurement during Trusted or Non-Trusted Boot flow Change-Id: I3570e80bae8ce8f5b58d84bd955aa43e925d9fff Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
2020-09-15lib: fconf: Implement a parser to populate CoTManish V Badarkhe
Implemented a parser which populates the properties of the CoT descriptors as per the binding document [1]. 'COT_DESC_IN_DTB' build option is disabled by default and can be enabled in future for all Arm platforms by making necessary changes in the memory map. Currently, this parser is tested only for FVP platform. [1]: https://trustedfirmware-a.readthedocs.io/en/latest/components/cot-binding.html Change-Id: I2f911206087a1a2942aa728de151d2ac269d27cc Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
2020-08-12dualroot: add chain of trust for Platform owned SPsManish Pandey
For dualroot CoT there are two sets of SP certificates, one owned by Silicon Provider(SiP) and other owned by Platform. Each certificate can have a maximum of 4 SPs. This patch reduces the number of SiP owned SPs from 8 to 4 and adds the remaining 4 to Plat owned SP. Plat owned SP certificate is signed using Platform RoT key and protected against anti-rollback using the Non-trusted Non-volatile counter. Change-Id: Idc3ddd87d6d85a5506a7435f45a6ec17c4c50425 Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
2020-07-31tbbr/dualroot: rename SP package certificate fileManish Pandey
Currently only single signing domain is supported for SP packages but there is plan to support dual signing domains if CoT is dualroot. SP_CONTENT_CERT_ID is the certificate file which is currently generated and signed with trusted world key which in-turn is derived from Silicon provider RoT key. To allow dual signing domain for SP packages, other certificate file will be derived from Platform owned RoT key. This patch renames "SP_CONTENT_CERT_ID" to "SIP_SP_CONTENT_CERT_ID" and does other related changes. Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: I0bc445a3ab257e2dac03faa64f46e36a9fed5e93
2020-06-09dualroot: add chain of trust for secure partitionsManish Pandey
A new certificate "sip-sp-cert" has been added for Silicon Provider(SiP) owned Secure Partitions(SP). A similar support for Platform owned SP can be added in future. The certificate is also protected against anti- rollback using the trusted Non-Volatile counter. To avoid deviating from TBBR spec, support for SP CoT is only provided in dualroot. Secure Partition content certificate is assigned image ID 31 and SP images follows after it. The CoT for secure partition look like below. +------------------+ +-------------------+ | ROTPK/ROTPK Hash |------>| Trusted Key | +------------------+ | Certificate | | (Auth Image) | /+-------------------+ / | / | / | / | L v +------------------+ +-------------------+ | Trusted World |------>| SiP owned SPs | | Public Key | | Content Cert | +------------------+ | (Auth Image) | / +-------------------+ / | / v| +------------------+ L +-------------------+ | SP_PKG1 Hash |------>| SP_PKG1 | | | | (Data Image) | +------------------+ +-------------------+ . . . . . . +------------------+ +-------------------+ | SP_PKG8 Hash |------>| SP_PKG8 | | | | (Data Image) | +------------------+ +-------------------+ Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: Ia31546bac1327a3e0b5d37e8b99c808442d5e53f
2020-04-02Check for out-of-bound accesses in the CoT descriptionSandrine Bailleux
The chain of trust array is now always accessed through a fconf getter. This gives us an ideal spot to check for out-of-bound accesses. Change-Id: Ic5ea20e43cf8ca959bb7f9b60de7c0839b390add Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2019-06-13Fix type of cot_desc_ptrSandrine Bailleux
The chain of trust description and the pointer pointing to its first element were incompatible, thus requiring an explicit type cast for the assignment. - cot_desc was an array of const pointers to const image descriptors. - cot_desc_ptr was a const pointer to (non-constant) pointers to const image descriptors. Thus, trying to assign cot_desc to cot_desc_ptr (with no cast) would generate the following compiler warning: drivers/auth/tbbr/tbbr_cot.c:826:14: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] REGISTER_COT(cot_desc); ^~~~~~~~ Change-Id: Iae62dd1bdb43fe379e3843d96461d47cc2f68a06 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2019-04-08cot-desc: optimise memory furtherJoel Hutton
This changes the auth_img_desc_t struct to have pointers to struct arrays instead of struct arrays. This saves memory as many of these were never used, and can be NULL pointers. Note the memory savings are only when these arrays are not initialised, as it is assumed these arrays are fixed length. A possible future optimisation could allow for variable length. memory diff: bl1: bl2: text text -12 -12 bss bss -1463 0 data data -56 -48 rodata rodata -5688 -2592 total total -7419 -2652 Change-Id: I8f9bdedf75048b8867f40c56381e3a6dc6402bcc Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>
2019-04-08Reduce memory needed for CoT descriptionJoel Hutton
When Trusted Board Boot is enabled, we need to specify the Chain of Trust (CoT) of the BL1 and BL2 images. A CoT consists of an array of image descriptors. The authentication module assumes that each image descriptor in this array is indexed by its unique image identifier. For example, the Trusted Boot Firmware Certificate has to be at index [TRUSTED_BOOT_FW_CERT_ID]. Unique image identifiers may not necessarily be consecutive. Also, a given BL image might not use all image descriptors. For example, BL1 does not need any of the descriptors related to BL31. As a result, the CoT array might contain holes, which unnecessarily takes up space in the BL binary. Using pointers to auth_img_desc_t structs (rather than structs themselves) means these unused elements only use 1 pointer worth of space, rather than one struct worth of space. This patch also changes the code which accesses this array to reflect the change to pointers. Image descriptors not needed in BL1 or BL2 respectively are also ifdef'd out in this patch. For example, verifying the BL31 image is the responsibility of BL2 so BL1 does not need any of the data structures describing BL31. memory diff: bl1: bl2: text text -20 -20 bss bss -1463 0 data data -256 -48 rodata rodata -5240 -1952 total total -6979 -2020 Change-Id: I163668b174dc2b9bbb183acec817f2126864aaad Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>
2019-01-04Sanitise includes across codebaseAntonio Nino Diaz
Enforce full include path for includes. Deprecate old paths. The following folders inside include/lib have been left unchanged: - include/lib/cpus/${ARCH} - include/lib/el3_runtime/${ARCH} The reason for this change is that having a global namespace for includes isn't a good idea. It defeats one of the advantages of having folders and it introduces problems that are sometimes subtle (because you may not know the header you are actually including if there are two of them). For example, this patch had to be created because two headers were called the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platform to avoid collision."). More recently, this patch has had similar problems: 46f9b2c3a282 ("drivers: add tzc380 support"). This problem was introduced in commit 4ecca33988b9 ("Move include and source files to logical locations"). At that time, there weren't too many headers so it wasn't a real issue. However, time has shown that this creates problems. Platforms that want to preserve the way they include headers may add the removed paths to PLAT_INCLUDES, but this is discouraged. Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-11-08Standardise header guards across codebaseAntonio Nino Diaz
All identifiers, regardless of use, that start with two underscores are reserved. This means they can't be used in header guards. The style that this project is now to use the full name of the file in capital letters followed by 'H'. For example, for a file called "uart_example.h", the header guard is UART_EXAMPLE_H. The exceptions are files that are imported from other projects: - CryptoCell driver - dt-bindings folders - zlib headers Change-Id: I50561bf6c88b491ec440d0c8385c74650f3c106e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-04-13Fix MISRA rule 8.4 Part 4Roberto Vargas
Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd TRUSTED_BOARD_BOOT=1 \ GENERATE_COT=1 ARM_ROTPK_LOCATION=devel_rsa \ ROT_KEY=arm_rotprivk_rsa.pem MBEDTLS_DIR=mbedtls all Change-Id: Ie4cd6011b3e4fdcdd94ccb97a7e941f3b5b7aeb8 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-13Fix MISRA rule 8.3 Part 4Roberto Vargas
Rule 8.3: All declarations of an object or function shall use the same names and type qualifiers Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd TRUSTED_BOARD_BOOT=1 \ GENERATE_COT=1 ARM_ROTPK_LOCATION=devel_rsa \ ROT_KEY=arm_rotprivk_rsa.pem MBEDTLS_DIR=mbedtls all Change-Id: Ia34fe1ae1f142e89c9a6c19831e3daf4d28f5831 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2017-05-03Use SPDX license identifiersdp-arm
To make software license auditing simpler, use SPDX[0] license identifiers instead of duplicating the license text in every file. NOTE: Files that have been imported by FreeBSD have not been modified. [0]: https://spdx.org/ Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761a Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
2016-01-13Rearrange fields in TF data structures to reduce paddingSoby Mathew
This patch rearranges fields of the `image_desc_t` & `auth_img_desc_t` data structures to reduce padding between the fields and thereby save memory. NOTE: Platform ports which anonymously initialize these structures should be aware of the rearrangement and do the required modification. Change-Id: I428b5429632797b31d5bd306174599c07e24c060
2016-01-05Always build with '-pedantic'Sandrine Bailleux
By default ARM TF is built with the '-pedantic' compiler flag, which helps detecting violations of the C standard. However, the mbed TLS library and its associated authentication module in TF used to fail building with this compiler flag. As a workaround, the mbed TLS authentication module makefile used to set the 'DISABLE_PEDANTIC' TF build flag. The compiler errors flagged by '-pedantic' in the mbed TLS library have been fixed between versions 1.3.9 and 2.2.0 and the library now properly builds with this compiler flag. This patch fixes the remaining compiler errors in the mbed TLS authentication module in TF and unsets the 'DISABLE_PEDANTIC' TF build flag. This means that TF is now always built with '-pedantic'. In particular, this patch: * Removes the final semi-colon in REGISTER_COT() macro. This semi-colon was causing the following error message: drivers/auth/tbbr/tbbr_cot.c:544:23: error: ISO C does not allow extra ';' outside of a function [-Werror=pedantic] This has been fixed both in the mbed TLS authentication module as well as in the certificate generation tool. Note that the latter code didn't need fixing since it is not built with '-pedantic' but the change has been propagated for consistency. Also fixed the REGISTER_KEYS() and REGISTER_EXTENSIONS() macros, which were suffering from the same issue. * Fixes a pointer type. It was causing the following error message: drivers/auth/mbedtls/mbedtls_crypto.c: In function 'verify_hash': drivers/auth/mbedtls/mbedtls_crypto.c:177:42: error: pointer of type 'void *' used in arithmetic [-Werror=pointer-arith] Change-Id: I7b7a04ef711efd65e17b5be26990d1a0d940257d
2015-06-25TBB: add authentication frameworkJuan Castillo
This patch adds the authentication framework that will be used as the base to implement Trusted Board Boot in the Trusted Firmware. The framework comprises the following modules: - Image Parser Module (IPM) This module is responsible for interpreting images, check their integrity and extract authentication information from them during Trusted Board Boot. The module currently supports three types of images i.e. raw binaries, X509v3 certificates and any type specific to a platform. An image parser library must be registered for each image type (the only exception is the raw image parser, which is included in the main module by default). Each parser library (if used) must export a structure in a specific linker section which contains function pointers to: 1. Initialize the library 2. Check the integrity of the image type supported by the library 3. Extract authentication information from the image - Cryptographic Module (CM) This module is responsible for verifying digital signatures and hashes. It relies on an external cryptographic library to perform the cryptographic operations. To register a cryptographic library, the library must use the REGISTER_CRYPTO_LIB macro, passing function pointers to: 1. Initialize the library 2. Verify a digital signature 3. Verify a hash Failing to register a cryptographic library will generate a build time error. - Authentication Module (AM) This module provides methods to authenticate an image, like hash comparison or digital signatures. It uses the image parser module to extract authentication parameters, the crypto module to perform cryptographic operations and the Chain of Trust to authenticate the images. The Chain of Trust (CoT) is a data structure that defines the dependencies between images and the authentication methods that must be followed to authenticate an image. The Chain of Trust, when added, must provide a header file named cot_def.h with the following definitions: - COT_MAX_VERIFIED_PARAMS Integer value indicating the maximum number of authentication parameters an image can present. This value will be used by the authentication module to allocate the memory required to load the parameters in the image descriptor. Change-Id: Ied11bd5cd410e1df8767a1df23bb720ce7e58178