andrius
/
arm-trusted-firmware
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Allow dynamic overriding of ROTPK verification 

A production ROM with TBB enabled must have the ability to boot test software
before a real ROTPK is deployed (e.g. manufacturing mode). Previously the
function plat_get_rotpk_info() must return a valid ROTPK for TBB to succeed.
This patch adds an additional bit `ROTPK_NOT_DEPLOYED` in the output `flags`
parameter from plat_get_rotpk_info(). If this bit is set, then the ROTPK
in certificate is used without verifying against the platform value.

Fixes ARM-software/tf-issues#381

Change-Id: Icbbffab6bff8ed76b72431ee21337f550d8fdbbb
This commit is contained in:
Soby Mathew 2016-05-24 15:05:15 +01:00
parent a7e530331d
commit 04943d33cf
3 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
docs/porting-guide.md
View File

@ -631,10 +631,19 @@ In case the function returns a hash of the key:
digest OCTET STRING
}
The function returns 0 on success. Any other value means the ROTPK could not be
retrieved from the platform. The function also reports extra information related
to the ROTPK in the flags parameter.
The function returns 0 on success. Any other value is treated as error by the
Trusted Board Boot. The function also reports extra information related
to the ROTPK in the flags parameter:
ROTPK_IS_HASH : Indicates that the ROTPK returned by the platform is a
hash.
ROTPK_NOT_DEPLOYED : This allows the platform to skip certificate ROTPK
verification while the platform ROTPK is not deployed.
When this flag is set, the function does not need to
return a platform ROTPK, and the authentication
framework uses the ROTPK in the certificate without
verifying it against the platform value. This flag
must not be used in a deployed production environment.
### Function: plat_get_nv_ctr()

16
drivers/auth/auth_mod.c
View File

@ -199,8 +199,9 @@ static int auth_signature(const auth_method_param_sig_t *param,
}
return_if_error(rc);
/* If the PK is a hash of the key, retrieve the key from the image */
if (flags & ROTPK_IS_HASH) {
if (flags & (ROTPK_IS_HASH | ROTPK_NOT_DEPLOYED)) {
/* If the PK is a hash of the key or if the ROTPK is not
deployed on the platform, retrieve the key from the image */
pk_hash_ptr = pk_ptr;
pk_hash_len = pk_len;
rc = img_parser_get_auth_param(img_desc->img_type,
@ -215,9 +216,14 @@ static int auth_signature(const auth_method_param_sig_t *param,
pk_ptr, pk_len);
return_if_error(rc);
/* Ask the crypto-module to verify the key hash */
rc = crypto_mod_verify_hash(pk_ptr, pk_len,
pk_hash_ptr, pk_hash_len);
if (flags & ROTPK_NOT_DEPLOYED) {
NOTICE("ROTPK is not deployed on platform. "
"Skipping ROTPK verification.\n");
} else {
/* Ask the crypto-module to verify the key hash */
rc = crypto_mod_verify_hash(pk_ptr, pk_len,
pk_hash_ptr, pk_hash_len);
}
} else {
/* Ask the crypto module to verify the signature */
rc = crypto_mod_verify_signature(data_ptr, data_len,

3
include/plat/common/platform.h
View File

@ -49,6 +49,9 @@ struct image_desc;
* plat_get_rotpk_info() flags
******************************************************************************/
#define ROTPK_IS_HASH (1 << 0)
/* Flag used to skip verification of the certificate ROTPK while the platform
ROTPK is not deployed */
#define ROTPK_NOT_DEPLOYED (1 << 1)
/*******************************************************************************
* Function declarations