From 102b0d2daa97dae68d3eed54d8fe37a9cc38a892 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 28 Apr 2024 11:13:47 +0200 Subject: Adding upstream version 2.8.0+dfsg. Signed-off-by: Daniel Baumann --- drivers/measured_boot/rss/rss_measured_boot.c | 137 +++++++++++++++++++++++++ drivers/measured_boot/rss/rss_measured_boot.mk | 32 ++++++ 2 files changed, 169 insertions(+) create mode 100644 drivers/measured_boot/rss/rss_measured_boot.c create mode 100644 drivers/measured_boot/rss/rss_measured_boot.mk (limited to 'drivers/measured_boot/rss') diff --git a/drivers/measured_boot/rss/rss_measured_boot.c b/drivers/measured_boot/rss/rss_measured_boot.c new file mode 100644 index 0000000..cf545a7 --- /dev/null +++ b/drivers/measured_boot/rss/rss_measured_boot.c @@ -0,0 +1,137 @@ +/* + * Copyright (c) 2022, Arm Limited. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include + +#define MBOOT_ALG_SHA512 0 +#define MBOOT_ALG_SHA384 1 +#define MBOOT_ALG_SHA256 2 + +#if MBOOT_ALG_ID == MBOOT_ALG_SHA512 +#define CRYPTO_MD_ID CRYPTO_MD_SHA512 +#define PSA_CRYPTO_MD_ID PSA_ALG_SHA_512 +#elif MBOOT_ALG_ID == MBOOT_ALG_SHA384 +#define CRYPTO_MD_ID CRYPTO_MD_SHA384 +#define PSA_CRYPTO_MD_ID PSA_ALG_SHA_384 +#elif MBOOT_ALG_ID == MBOOT_ALG_SHA256 +#define CRYPTO_MD_ID CRYPTO_MD_SHA256 +#define PSA_CRYPTO_MD_ID PSA_ALG_SHA_256 +#else +# error Invalid Measured Boot algorithm. +#endif /* MBOOT_ALG_ID */ + +/* Pointer to struct rss_mboot_metadata */ +static struct rss_mboot_metadata *plat_metadata_ptr; + +/* Functions' declarations */ +void rss_measured_boot_init(void) +{ + /* At this point it is expected that communication channel over MHU + * is already initialised by platform init. + */ + struct rss_mboot_metadata *metadata_ptr; + + /* Get pointer to platform's struct rss_mboot_metadata structure */ + plat_metadata_ptr = plat_rss_mboot_get_metadata(); + assert(plat_metadata_ptr != NULL); + + /* Use a local variable to preserve the value of the global pointer */ + metadata_ptr = plat_metadata_ptr; + + /* Init the non-const members of the metadata structure */ + while (metadata_ptr->id != RSS_MBOOT_INVALID_ID) { + metadata_ptr->sw_type_size = + strlen((const char *)&metadata_ptr->sw_type) + 1; + metadata_ptr++; + } +} + +int rss_mboot_measure_and_record(uintptr_t data_base, uint32_t data_size, + uint32_t data_id) +{ + unsigned char hash_data[CRYPTO_MD_MAX_SIZE]; + int rc; + psa_status_t ret; + const struct rss_mboot_metadata *metadata_ptr = plat_metadata_ptr; + + /* Get the metadata associated with this image. */ + while ((metadata_ptr->id != RSS_MBOOT_INVALID_ID) && + (metadata_ptr->id != data_id)) { + metadata_ptr++; + } + + /* If image is not present in metadata array then skip */ + if (metadata_ptr->id == RSS_MBOOT_INVALID_ID) { + return 0; + } + + /* Calculate hash */ + rc = crypto_mod_calc_hash(CRYPTO_MD_ID, + (void *)data_base, data_size, hash_data); + if (rc != 0) { + return rc; + } + + ret = rss_measured_boot_extend_measurement( + metadata_ptr->slot, + metadata_ptr->signer_id, + metadata_ptr->signer_id_size, + metadata_ptr->version, + metadata_ptr->version_size, + PSA_CRYPTO_MD_ID, + metadata_ptr->sw_type, + metadata_ptr->sw_type_size, + hash_data, + MBOOT_DIGEST_SIZE, + metadata_ptr->lock_measurement); + if (ret != PSA_SUCCESS) { + return ret; + } + + return 0; +} + +int rss_mboot_set_signer_id(unsigned int img_id, + const void *pk_ptr, + size_t pk_len) +{ + unsigned char hash_data[CRYPTO_MD_MAX_SIZE]; + struct rss_mboot_metadata *metadata_ptr = plat_metadata_ptr; + int rc; + + /* Get the metadata associated with this image. */ + while ((metadata_ptr->id != RSS_MBOOT_INVALID_ID) && + (metadata_ptr->id != img_id)) { + metadata_ptr++; + } + + /* If image is not present in metadata array then skip */ + if (metadata_ptr->id == RSS_MBOOT_INVALID_ID) { + return 0; + } + + /* Calculate public key hash */ + rc = crypto_mod_calc_hash(CRYPTO_MD_ID, (void *)pk_ptr, + pk_len, hash_data); + if (rc != 0) { + return rc; + } + + /* Update metadata struct with the received signer_id */ + (void)memcpy(metadata_ptr->signer_id, hash_data, MBOOT_DIGEST_SIZE); + metadata_ptr->signer_id_size = MBOOT_DIGEST_SIZE; + + return 0; +} diff --git a/drivers/measured_boot/rss/rss_measured_boot.mk b/drivers/measured_boot/rss/rss_measured_boot.mk new file mode 100644 index 0000000..18ee836 --- /dev/null +++ b/drivers/measured_boot/rss/rss_measured_boot.mk @@ -0,0 +1,32 @@ +# +# Copyright (c) 2022, Arm Limited. All rights reserved. +# +# SPDX-License-Identifier: BSD-3-Clause +# + +# Hash algorithm for measured boot +# SHA-256 (or stronger) is required. +MBOOT_RSS_HASH_ALG := sha256 + +ifeq (${MBOOT_RSS_HASH_ALG}, sha512) + MBOOT_ALG_ID := MBOOT_ALG_SHA512 + MBOOT_DIGEST_SIZE := 64U +else ifeq (${MBOOT_RSS_HASH_ALG}, sha384) + MBOOT_ALG_ID := MBOOT_ALG_SHA384 + MBOOT_DIGEST_SIZE := 48U +else + MBOOT_ALG_ID := MBOOT_ALG_SHA256 + MBOOT_DIGEST_SIZE := 32U +endif #MBOOT_RSS_HASH_ALG + +# Set definitions for Measured Boot driver. +$(eval $(call add_defines,\ + $(sort \ + MBOOT_ALG_ID \ + MBOOT_DIGEST_SIZE \ + MBOOT_RSS_BACKEND \ +))) + +MEASURED_BOOT_SRC_DIR := drivers/measured_boot/rss/ + +MEASURED_BOOT_SOURCES += ${MEASURED_BOOT_SRC_DIR}rss_measured_boot.c -- cgit v1.2.3