Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-24 22:05:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge changes from topic "cca_dtb" into integration

Browse source 
* changes:
  feat(arm): add COT_DESC_IN_DTB option for CCA CoT
  feat(fvp): add CCA CoT in DTB support
  docs(arm): update TBBR CoT dtsi file name in doc
  feat(dt-bindings): introduce CCA CoT, rename TBBR
This commit is contained in:
Manish V Badarkhe 2024-01-19 11:40:02 +01:00 • committed by TrustedFirmware Code Review
commit 3d43bf5580
5 changed files with 308 additions and 5 deletions

2
docs/security_advisories/security-advisory-tfv-10.rst
View file

@ -98,7 +98,7 @@ All standard chains of trust provided in TF-A source tree (that is, under
``drivers/auth/``) require that the certificate's signature has already been
validated prior to calling ``get_ext()``, or any function that calls ``get_ext()``.
Platforms taking their chain of trust from a dynamic configuration file (such as
``fdts/cot_descriptors.dtsi``) are also safe, as signature verification will
``fdts/tbbr_cot_descriptors.dtsi``) are also safe, as signature verification will
always be done prior to any calls to ``get_ext()`` or ``auth_nvctr()`` in this
case, no matter the order of the properties in the file. Therefore, it is not
possible to exploit this vulnerability pre-authentication in upstream TF-A.

287
fdts/cca_cot_descriptors.dtsi Normal file
View file

@ -0,0 +1,287 @@
/*
* Copyright (c) 2023-2024, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <tools_share/cca_oid.h>
#include <common/tbbr/tbbr_img_def.h>
#include <common/nv_cntr_ids.h>
cot {
manifests {
compatible = "arm, cert-descs";
cca_content_cert: cca_content_cert {
root-certificate;
image-id =<CCA_CONTENT_CERT_ID>;
antirollback-counter = <&cca_nv_counter>;
tb_fw_hash: tb_fw_hash {
oid = TRUSTED_BOOT_FW_HASH_OID;
};
tb_fw_config_hash: tb_fw_config_hash {
oid = TRUSTED_BOOT_FW_CONFIG_HASH_OID;
};
hw_config_hash: hw_config_hash {
oid = HW_CONFIG_HASH_OID;
};
fw_config_hash: fw_config_hash {
oid = FW_CONFIG_HASH_OID;
};
soc_fw_hash: soc_fw_hash {
oid = SOC_AP_FW_HASH_OID;
};
soc_fw_config_hash: soc_fw_config_hash {
oid = SOC_FW_CONFIG_HASH_OID;
};
rmm_hash: rmm_hash {
oid = RMM_HASH_OID;
};
};
core_swd_key_cert: core_swd_key_cert {
root-certificate;
image-id = <CORE_SWD_KEY_CERT_ID>;
signing-key = <&swd_rot_pk>;
antirollback-counter = <&trusted_nv_counter>;
core_swd_pk: core_swd_pk {
oid = CORE_SWD_PK_OID;
};
};
trusted_os_fw_content_cert: trusted_os_fw_content_cert {
image-id = <TRUSTED_OS_FW_CONTENT_CERT_ID>;
parent = <&core_swd_key_cert>;
signing-key = <&core_swd_pk>;
antirollback-counter = <&trusted_nv_counter>;
tos_fw_hash: tos_fw_hash {
oid = TRUSTED_OS_FW_HASH_OID;
};
tos_fw_config_hash: tos_fw_config_hash {
oid = TRUSTED_OS_FW_CONFIG_HASH_OID;
};
};
plat_key_cert: plat_key_cert {
root-certificate;
image-id = <PLAT_KEY_CERT_ID>;
signing-key = <&prot_pk>;
antirollback-counter = <&non_trusted_nv_counter>;
plat_pk: plat_pk {
oid = PLAT_PK_OID;
};
};
non_trusted_fw_content_cert: non_trusted_fw_content_cert {
image-id = <NON_TRUSTED_FW_CONTENT_CERT_ID>;
parent = <&plat_key_cert>;
signing-key = <&plat_pk>;
antirollback-counter = <&non_trusted_nv_counter>;
nt_world_bl_hash: nt_world_bl_hash {
oid = NON_TRUSTED_WORLD_BOOTLOADER_HASH_OID;
};
nt_fw_config_hash: nt_fw_config_hash {
oid = NON_TRUSTED_FW_CONFIG_HASH_OID;
};
};
#if defined(SPD_spmd)
sip_sp_content_cert: sip_sp_content_cert {
image-id = <SIP_SP_CONTENT_CERT_ID>;
parent = <&core_swd_key_cert>;
signing-key = <&core_swd_pk>;
antirollback-counter = <&trusted_nv_counter>;
sp_pkg1_hash: sp_pkg1_hash {
oid = SP_PKG1_HASH_OID;
};
sp_pkg2_hash: sp_pkg2_hash {
oid = SP_PKG2_HASH_OID;
};
sp_pkg3_hash: sp_pkg3_hash {
oid = SP_PKG3_HASH_OID;
};
sp_pkg4_hash: sp_pkg4_hash {
oid = SP_PKG4_HASH_OID;
};
};
plat_sp_content_cert: plat_sp_content_cert {
image-id = <PLAT_SP_CONTENT_CERT_ID>;
parent = <&plat_key_cert>;
signing-key = <&plat_pk>;
antirollback-counter = <&non_trusted_nv_counter>;
sp_pkg5_hash: sp_pkg5_hash {
oid = SP_PKG5_HASH_OID;
};
sp_pkg6_hash: sp_pkg6_hash {
oid = SP_PKG6_HASH_OID;
};
sp_pkg7_hash: sp_pkg7_hash {
oid = SP_PKG7_HASH_OID;
};
sp_pkg8_hash: sp_pkg8_hash {
oid = SP_PKG8_HASH_OID;
};
};
#endif
};
images {
compatible = "arm, img-descs";
fw_config {
image-id = <FW_CONFIG_ID>;
parent = <&cca_content_cert>;
hash = <&fw_config_hash>;
};
hw_config {
image-id = <HW_CONFIG_ID>;
parent = <&cca_content_cert>;
hash = <&hw_config_hash>;
};
tb_fw_hash {
image-id = <BL2_IMAGE_ID>;
parent = <&cca_content_cert>;
hash = <&tb_fw_hash>;
};
tb_fw_config {
image-id = <TB_FW_CONFIG_ID>;
parent = <&cca_content_cert>;
hash = <&tb_fw_config_hash>;
};
bl31_image {
image-id = <BL31_IMAGE_ID>;
parent = <&cca_content_cert>;
hash = <&soc_fw_hash>;
};
soc_fw_config {
image-id = <SOC_FW_CONFIG_ID>;
parent = <&cca_content_cert>;
hash = <&soc_fw_config_hash>;
};
rmm_image {
image-id = <RMM_IMAGE_ID>;
parent = <&cca_content_cert>;
hash = <&rmm_hash>;
};
bl32_image {
image-id = <BL32_IMAGE_ID>;
parent = <&trusted_os_fw_content_cert>;
hash = <&tos_fw_hash>;
};
tos_fw_config {
image-id = <TOS_FW_CONFIG_ID>;
parent = <&trusted_os_fw_content_cert>;
hash = <&tos_fw_config_hash>;
};
bl33_image {
image-id = <BL33_IMAGE_ID>;
parent = <&non_trusted_fw_content_cert>;
hash = <&nt_world_bl_hash>;
};
nt_fw_config {
image-id = <NT_FW_CONFIG_ID>;
parent = <&non_trusted_fw_content_cert>;
hash = <&nt_fw_config_hash>;
};
#if defined(SPD_spmd)
sp_pkg1 {
image-id = <SP_PKG1_ID>;
parent = <&sip_sp_content_cert>;
hash = <&sp_pkg1_hash>;
};
sp_pkg2 {
image-id = <SP_PKG2_ID>;
parent = <&sip_sp_content_cert>;
hash = <&sp_pkg2_hash>;
};
sp_pkg3 {
image-id = <SP_PKG3_ID>;
parent = <&sip_sp_content_cert>;
hash = <&sp_pkg3_hash>;
};
sp_pkg4 {
image-id = <SP_PKG4_ID>;
parent = <&sip_sp_content_cert>;
hash = <&sp_pkg4_hash>;
};
sp_pkg5 {
image-id = <SP_PKG5_ID>;
parent = <&plat_sp_content_cert>;
hash = <&sp_pkg5_hash>;
};
sp_pkg6 {
image-id = <SP_PKG6_ID>;
parent = <&plat_sp_content_cert>;
hash = <&sp_pkg6_hash>;
};
sp_pkg7 {
image-id = <SP_PKG7_ID>;
parent = <&plat_sp_content_cert>;
hash = <&sp_pkg7_hash>;
};
sp_pkg8 {
image-id = <SP_PKG8_ID>;
parent = <&plat_sp_content_cert>;
hash = <&sp_pkg8_hash>;
};
#endif
};
};
non_volatile_counters: non_volatile_counters {
compatible = "arm, non-volatile-counter";
#address-cells = <1>;
#size-cells = <0>;
cca_nv_counter: cca_nv_counter {
id = <TRUSTED_NV_CTR_ID>;
oid = CCA_FW_NVCOUNTER_OID;
};
trusted_nv_counter: trusted_nv_counter {
id = <TRUSTED_NV_CTR_ID>;
oid = TRUSTED_FW_NVCOUNTER_OID;
};
non_trusted_nv_counter: non_trusted_nv_counter {
id = <NON_TRUSTED_NV_CTR_ID>;
oid = NON_TRUSTED_FW_NVCOUNTER_OID;
};
};
rot_keys {
swd_rot_pk: swd_rot_pk {
oid = SWD_ROT_PK_OID;
};
prot_pk: prot_pk {
oid = PROT_PK_OID;
};
};

2
fdts/cot_descriptors.dtsi → fdts/tbbr_cot_descriptors.dtsi
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2020, ARM Limited. All rights reserved.
* Copyright (c) 2020-2024, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/

15
plat/arm/board/fvp/fdts/fvp_tb_fw_config.dts
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2020-2023, ARM Limited. All rights reserved.
* Copyright (c) 2020-2024, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
@ -104,7 +104,11 @@
};
#if COT_DESC_IN_DTB
#include "cot_descriptors.dtsi"
#if defined(ARM_COT_cca)
#include "cca_cot_descriptors.dtsi"
#elif defined(ARM_COT_tbbr)
#include "tbbr_cot_descriptors.dtsi"
#endif
#endif
#if MEASURED_BOOT
@ -117,6 +121,13 @@
#include "../fvp_def.h"
#if defined(ARM_COT_cca)
/* FVP does not support the CCA NV Counter so use the Trusted one. */
&cca_nv_counter {
reg = <TFW_NVCTR_BASE>;
};
#endif
&trusted_nv_counter {
reg = <TFW_NVCTR_BASE>;
};

7
plat/arm/common/arm_common.mk
View file

@ -383,7 +383,12 @@ ifneq (${TRUSTED_BOARD_BOOT},0)
else ifeq (${COT},dualroot)
AUTH_SOURCES += drivers/auth/dualroot/cot.c
else ifeq (${COT},cca)
AUTH_SOURCES += drivers/auth/cca/cot.c
BL1_SOURCES += drivers/auth/cca/cot.c
ifneq (${COT_DESC_IN_DTB},0)
BL2_SOURCES += lib/fconf/fconf_cot_getter.c
else
BL2_SOURCES += drivers/auth/cca/cot.c
endif
else
$(error Unknown chain of trust ${COT})
endif