MA-18352-5 Support device IDs provision

The device IDs are provisioned from bootloader, this commit
add commands to provision the deivce IDs:
    $ fastboot oem append-device-id

Test: Device IDs provision and attest.

Change-Id: Id3c737d3da02f7ba463e51b0525f3cb9bcf0c6d1
Signed-off-by: Ji Luo <ji.luo@nxp.com>
(cherry picked from commit 7575ac07ac625c35269868511297385a69c96196)
(cherry picked from commit 7f300b1fc543d8f4cbe7329a78e31273678162a5)

diff --git a/drivers/fastboot/fb_fsl/fb_fsl_command.c b/drivers/fastboot/fb_fsl/fb_fsl_command.c
index d208672..b5ec0ff 100644 (file)
--- a/drivers/fastboot/fb_fsl/fb_fsl_command.c
+++ b/drivers/fastboot/fb_fsl/fb_fsl_command.c
@@ -664,6 +664,37 @@ static void flashing(char *cmd, char *response)
                        strcpy(response, "OKAY");
                }
        }
+#ifdef CONFIG_ID_ATTESTATION
+       else if (endswith(cmd, FASTBOOT_APPEND_ATTESTATION_ID)) {
+               if (trusty_append_attestation_id(ATTESTATION_ID_BRAND, strlen(ATTESTATION_ID_BRAND))) {
+                       printf("Error append ATTESTATION_ID_BRAND failed!\n");
+                       strcpy(response, "FAILAppend ATTESTATION_ID_BRAND failed!");
+               } else if (trusty_append_attestation_id(ATTESTATION_ID_DEVICE, strlen(ATTESTATION_ID_DEVICE))) {
+                       printf("Error append ATTESTATION_ID_DEVICE failed!\n");
+                       strcpy(response, "FAILAppend ATTESTATION_ID_DEVICE failed!");
+               } else if (trusty_append_attestation_id(CONFIG_ATTESTATION_ID_PRODUCT, strlen(CONFIG_ATTESTATION_ID_PRODUCT))) {
+                       printf("Error append ATTESTATION_ID_PRODUCT failed!\n");
+                       strcpy(response, "FAILAppend ATTESTATION_ID_PRODUCT failed!");
+               } else if (trusty_append_attestation_id(ATTESTATION_ID_MANUFACTURER, strlen(ATTESTATION_ID_MANUFACTURER))) {
+                       printf("Error append ATTESTATION_ID_MANUFACTURER failed!\n");
+                       strcpy(response, "FAILAppend ATTESTATION_ID_MANUFACTURER failed!");
+               } else if (trusty_append_attestation_id(ATTESTATION_ID_MODEL, strlen(ATTESTATION_ID_MODEL))) {
+                       printf("Error append ATTESTATION_ID_MODEL failed!\n");
+                       strcpy(response, "FAILAppend ATTESTATION_ID_MODEL failed!");
+               } else {
+                       char *serial = get_serial();
+
+                       if (!serial) {
+                               printf("Error Failed to append the serial number!\n");
+                               strcpy(response, "FAIL Failed to append the serial number!");
+                       } else if (trusty_append_attestation_id(serial, 16)) {
+                               printf("Error Failed to append the serial number!\n");
+                               strcpy(response, "FAILFailed to append the serial number!");
+                       } else
+                               strcpy(response, "OKAY");
+               }
+       }
+#endif
 #ifndef CONFIG_AVB_ATX
        else if (endswith(cmd, FASTBOOT_SET_RPMB_KEY)) {
                if (fastboot_set_rpmb_key(fastboot_buf_addr, fastboot_bytes_received)) {

diff --git a/include/configs/imx8qm_mek_android_auto.h b/include/configs/imx8qm_mek_android_auto.h
index 0258fb1..63b0506 100644 (file)
--- a/include/configs/imx8qm_mek_android_auto.h
+++ b/include/configs/imx8qm_mek_android_auto.h
@@ -66,6 +66,15 @@
 #define KEYSLOT_HWPARTITION_ID 2
 #define KEYSLOT_BLKS           0x3FFF
 
+#ifdef CONFIG_ID_ATTESTATION
+#define ATTESTATION_ID_BRAND "Android"
+#define ATTESTATION_ID_DEVICE "mek_8q"
+#define ATTESTATION_ID_MANUFACTURER "nxp"
+#define ATTESTATION_ID_MODEL "MEK-MX8Q"
+#endif
+
+#endif
+
 #ifdef CONFIG_DUAL_BOOTLOADER
 #define BOOTLOADER_RBIDX_OFFSET  0x3FE000
 #define BOOTLOADER_RBIDX_START   0x3FF000
@@ -74,8 +83,6 @@
 #define CONFIG_SYS_SPL_PTE_RAM_BASE 0x801F8000
 #endif
 
-#endif
-
 
 #ifdef CONFIG_SPL_BUILD
 #undef CONFIG_BLK

diff --git a/include/fb_fsl.h b/include/fb_fsl.h
index 3c551af..8e2f1c4 100644 (file)
--- a/include/fb_fsl.h
+++ b/include/fb_fsl.h
@@ -103,6 +103,7 @@
 #define FASTBOOT_APPEND_EC_ATTESTATION_CERT_ENC  "append-ec-atte-cert-enc"
 #define FASTBOOT_GET_MPPUBK  "get-mppubk"
 #define FASTBOOT_GET_SERIAL_NUMBER  "get-serial-number"
+#define FASTBOOT_APPEND_ATTESTATION_ID "append-device-id"
 #endif
 
 #ifdef CONFIG_ANDROID_THINGS_SUPPORT

diff --git a/include/interface/keymaster/keymaster.h b/include/interface/keymaster/keymaster.h
index c98442d..928854e 100644 (file)
--- a/include/interface/keymaster/keymaster.h
+++ b/include/interface/keymaster/keymaster.h
@@ -66,7 +66,8 @@ enum keymaster_command {
     KM_SET_ATTESTATION_KEY_ENC         = (0xa000 << KEYMASTER_REQ_SHIFT),
     KM_APPEND_ATTESTATION_CERT_CHAIN_ENC = (0xb000 << KEYMASTER_REQ_SHIFT),
     KM_GET_MPPUBK                      = (0xc000 << KEYMASTER_REQ_SHIFT),
-    KM_VERIFY_SECURE_UNLOCK            = (0xd000 << KEYMASTER_REQ_SHIFT)
+    KM_VERIFY_SECURE_UNLOCK            = (0xd000 << KEYMASTER_REQ_SHIFT),
+    KM_APPEND_ATTESTATION_ID           = (0xe000 << KEYMASTER_REQ_SHIFT)
 };
 
 typedef enum {
@@ -287,6 +288,10 @@ struct km_attestation_data {
     const uint8_t *data;
 } TRUSTY_ATTR_PACKED;
 
+struct km_attestation_id_data {
+    uint32_t data_size;
+    const uint8_t *data;
+} TRUSTY_ATTR_PACKED;
 /**
  * km_raw_buffer - represents a single raw buffer
  *

diff --git a/include/trusty/keymaster.h b/include/trusty/keymaster.h
index a44ae21..2a5551c 100644 (file)
--- a/include/trusty/keymaster.h
+++ b/include/trusty/keymaster.h
@@ -169,4 +169,12 @@ int trusty_verify_secure_unlock(uint8_t *unlock_credential,
                                 uint32_t credential_size,
                                 uint8_t *serial, uint32_t serial_size);
 
+/*
+ * trusty_append_attestation_id is called to set attestation Device ID.
+ *
+ * @ data: Device ID string
+ * @ data_size: Device ID size
+ * */
+int trusty_append_attestation_id(const char *data, uint32_t data_size);
+
 #endif /* TRUSTY_KEYMASTER_H_ */

diff --git a/include/trusty/keymaster_serializable.h b/include/trusty/keymaster_serializable.h
index a8295df..830c0ba 100644 (file)
--- a/include/trusty/keymaster_serializable.h
+++ b/include/trusty/keymaster_serializable.h
@@ -67,6 +67,14 @@ int km_boot_params_serialize(const struct km_boot_params *params, uint8_t **out,
 int km_attestation_data_serialize(const struct km_attestation_data *data,
                                   uint8_t **out, uint32_t *out_size);
 
+/**
+ * Serializes a km_attestation_id_data structure. On success, allocates |*out_size|
+ * bytes to |*out| and writes the serialized |data| to |*out|. Caller takes
+ * ownership of |*out|. Returns one of trusty_err.
+ */
+int km_attestation_id_data_serialize(const struct km_attestation_id_data *data,
+                                 uint8_t** out, uint32_t *out_size);
+
 /**
  * Serializes a km_secure_unlock_data structure. On success, allocates |*out_size|
  * bytes to |*out| and writes the serialized |data| to |*out|. Caller takes

diff --git a/lib/Kconfig b/lib/Kconfig
index 2785d6f..dad01f2 100644 (file)
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -383,6 +383,16 @@ config LOAD_KEY_FROM_RPMB
        default n
        depends on IMX_TRUSTY_OS
 
+config ID_ATTESTATION
+       bool "Support device ID attestation"
+       default n
+       depends on IMX_TRUSTY_OS
+
+config ATTESTATION_ID_PRODUCT
+       string "Product name for ID attestation"
+       depends on IMX_TRUSTY_OS && ID_ATTESTATION
+       default SYS_CONFIG_NAME
+
 endmenu
 
 menu "Hashing Support"

diff --git a/lib/trusty/ql-tipc/keymaster.c b/lib/trusty/ql-tipc/keymaster.c
index cecb5ce..4880510 100644 (file)
--- a/lib/trusty/ql-tipc/keymaster.c
+++ b/lib/trusty/ql-tipc/keymaster.c
@@ -580,3 +580,26 @@ end:
     }
     return rc;
 }
+
+int trusty_append_attestation_id(const char *data, uint32_t data_size)
+{
+    struct km_attestation_id_data attestation_id_data = {
+        .data_size = data_size,
+        .data = (uint8_t *)data,
+    };
+    uint8_t *req = NULL;
+    uint32_t req_size = 0;
+    int rc = km_attestation_id_data_serialize(&attestation_id_data, &req, &req_size);
+
+    if (rc < 0) {
+        trusty_error("failed (%d) to serialize request\n", rc);
+        goto end;
+    }
+    rc = km_do_tipc(KM_APPEND_ATTESTATION_ID, req, req_size, NULL, NULL);
+
+end:
+    if (req) {
+        trusty_free(req);
+    }
+    return rc;
+}

diff --git a/lib/trusty/ql-tipc/keymaster_serializable.c b/lib/trusty/ql-tipc/keymaster_serializable.c
index 6d9297d..232a093 100644 (file)
--- a/lib/trusty/ql-tipc/keymaster_serializable.c
+++ b/lib/trusty/ql-tipc/keymaster_serializable.c
@@ -97,6 +97,23 @@ int km_attestation_data_serialize(const struct km_attestation_data *data,
     return TRUSTY_ERR_NONE;
 }
 
+int km_attestation_id_data_serialize(const struct km_attestation_id_data *data,
+                                 uint8_t** out, uint32_t *out_size)
+{
+    if (!out || !data || !out_size) {
+        return TRUSTY_ERR_INVALID_ARGS;
+    }
+    *out_size = (sizeof(data->data_size) + data->data_size);
+    *out = trusty_calloc(*out_size, 1);
+    if (!*out) {
+        return TRUSTY_ERR_NO_MEMORY;
+    }
+
+    append_sized_buf_to_buf(*out, data->data, data->data_size);
+
+    return TRUSTY_ERR_NONE;
+}
+
 int km_secure_unlock_data_serialize(const struct km_secure_unlock_data *data,
                                  uint8_t** out, uint32_t *out_size)
 {