TBB: add a platform specific function to validate the ROTPK

This patch adds the function plat_match_rotpk() to the platform
porting layer to provide a Root Of Trust Public key (ROTPK)
verification mechanism. This function is called during the
Trusted Board Boot process and receives a supposed valid copy
of the ROTPK as a parameter, usually obtained from an external
source (for instance, a certificate). It returns 0 (success) if
that key matches the actual ROTPK stored in the system or any
other value otherwise.

The mechanism to access the actual ROTPK stored in the system
is platform specific and should be implemented as part of this
function. The format of the ROTPK is also platform specific
(to save memory, some platforms might store a hash of the key
instead of the whole key).

TRUSTED_BOARD_BOOT build option has been added to allow the user
to enable the Trusted Board Boot features. The implementation of
the plat_match_rotpk() funtion is mandatory when Trusted Board
Boot is enabled.

For development purposes, FVP and Juno ports provide a dummy
function that returns always success (valid key). A safe trusted
boot implementation should provide a proper matching function.

Documentation updated accordingly.

Change-Id: I74ff12bc2b041556c48533375527d9e8c035b8c3

diff --git a/Makefile b/Makefile
index b5db6294b7d484bd52a6717928a0e0038a3624fc..e6abc182fed0d9ecc8e98bc0bfc7349f924900ff 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -70,6 +70,8 @@ FIP_NAME              := fip.bin
 # Flags to generate the Chain of Trust
 GENERATE_COT           := 0
 CREATE_KEYS            := 1
+# Flags to build TF with Trusted Boot support
+TRUSTED_BOARD_BOOT     := 0
 
 # Checkpatch ignores
 CHECK_IGNORE           =       --ignore COMPLEX_MACRO
@@ -243,6 +245,10 @@ $(eval $(call add_define,USE_COHERENT_MEM))
 $(eval $(call assert_boolean,GENERATE_COT))
 $(eval $(call assert_boolean,CREATE_KEYS))
 
+# Process TRUSTED_BOARD_BOOT flag
+$(eval $(call assert_boolean,TRUSTED_BOARD_BOOT))
+$(eval $(call add_define,TRUSTED_BOARD_BOOT))
+
 ASFLAGS                        +=      -nostdinc -ffreestanding -Wa,--fatal-warnings   \
                                -Werror -Wmissing-include-dirs                  \
                                -mgeneral-regs-only -D__ASSEMBLY__              \

diff --git a/docs/porting-guide.md b/docs/porting-guide.md
index 747cb005b6d4885d0c8d68513873e833b1eac7ad..a30535d77e12e02e2cd0ab3230009ffad5005325 100644 (file)
--- a/docs/porting-guide.md
+++ b/docs/porting-guide.md
@@ -392,6 +392,17 @@ The ARM FVP port uses this function to initialize the mailbox memory used for
 providing the warm-boot entry-point addresses.
 
 
+### Function: plat_match_rotpk()
+
+    Argument : const unsigned char *, unsigned int
+    Return   : int
+
+This function is mandatory when Trusted Board Boot is enabled. It receives a
+pointer to a buffer containing a signing key and its size as parameters and
+returns 0 (success) if that key matches the ROT (Root Of Trust) key stored in
+the platform. Any other return value means a mismatch.
+
+
 
 2.3 Common optional modifications
 ---------------------------------

diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h
index 69bb749ae70a8ccc51e952cff3376701f108d77e..18b7eae227fb20378dc1fd898a01e9148dbc41b9 100644 (file)
--- a/include/plat/common/platform.h
+++ b/include/plat/common/platform.h
@@ -191,4 +191,9 @@ void bl31_plat_enable_mmu(uint32_t flags);
  ******************************************************************************/
 void bl32_plat_enable_mmu(uint32_t flags);
 
+/*******************************************************************************
+ * Trusted Boot functions
+ ******************************************************************************/
+int plat_match_rotpk(const unsigned char *, unsigned int);
+
 #endif /* __PLATFORM_H__ */

diff --git a/plat/fvp/fvp_trusted_boot.c b/plat/fvp/fvp_trusted_boot.c
new file mode 100644 (file)
index 0000000..e7dcc01
--- /dev/null
+++ b/plat/fvp/fvp_trusted_boot.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <debug.h>
+#include "fvp_def.h"
+#include "fvp_private.h"
+
+/*
+ * Check the validity of the key
+ *
+ * 0 = success, Otherwise = error
+ */
+int plat_match_rotpk(const unsigned char *key_buf, unsigned int key_len)
+{
+       /* TODO: check against the ROT key stored in the platform */
+       return 0;
+}

diff --git a/plat/fvp/platform.mk b/plat/fvp/platform.mk
index 892e43caeaa03c08bcbd57e858ebed7e048fc4d8..bcee3286d9e6ec7466f59822be5a9da4a1d78a0c 100644 (file)
--- a/plat/fvp/platform.mk
+++ b/plat/fvp/platform.mk
@@ -89,3 +89,8 @@ BL31_SOURCES          +=      drivers/arm/cci400/cci400.c                     \
                                plat/fvp/aarch64/fvp_helpers.S                  \
                                plat/fvp/aarch64/fvp_common.c                   \
                                plat/fvp/drivers/pwrc/fvp_pwrc.c
+
+ifneq (${TRUSTED_BOARD_BOOT},0)
+  BL1_SOURCES          +=      plat/fvp/fvp_trusted_boot.c
+  BL2_SOURCES          +=      plat/fvp/fvp_trusted_boot.c
+endif

diff --git a/plat/juno/juno_trusted_boot.c b/plat/juno/juno_trusted_boot.c
new file mode 100644 (file)
index 0000000..e63d4b2
--- /dev/null
+++ b/plat/juno/juno_trusted_boot.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <debug.h>
+#include "juno_def.h"
+#include "juno_private.h"
+
+/*
+ * Check the validity of the key
+ *
+ * 0 = success, Otherwise = error
+ */
+int plat_match_rotpk(const unsigned char *key_buf, unsigned int key_len)
+{
+       /* TODO: check against the ROT key stored in the platform */
+       return 0;
+}

diff --git a/plat/juno/platform.mk b/plat/juno/platform.mk
index 158e3ace354863b9f59090c0e947cde2d5bd7a86..8beaecf0ac1d695826a6158ac1be2f8d22c9569e 100644 (file)
--- a/plat/juno/platform.mk
+++ b/plat/juno/platform.mk
@@ -90,6 +90,11 @@ BL31_SOURCES         +=      drivers/arm/cci400/cci400.c             \
                                plat/juno/plat_topology.c               \
                                plat/juno/scpi.c
 
+ifneq (${TRUSTED_BOARD_BOOT},0)
+  BL1_SOURCES          +=      plat/juno/juno_trusted_boot.c
+  BL2_SOURCES          +=      plat/juno/juno_trusted_boot.c
+endif
+
 ifneq (${RESET_TO_BL31},0)
   $(error "Using BL3-1 as the reset vector is not supported on Juno. \
   Please set RESET_TO_BL31 to 0.")