ta: qcom_pas: verify image signature and device bindings

Segment-hash verification proves an image matches its own digest table;
it cannot prove who signed it or that it is permitted on this device, so
establish provenance before the peripheral leaves reset. The fuse read
selecting this path fails closed: an error means secure boot enabled, so
a transient failure cannot downgrade a fused board to hash-only
verification.

UIE-encrypted and QTI-countersigned images are refused, as neither is
implemented here, and the chain is limited to one ECDSA P-384 root.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Assisted-by: Claude:sonnet-5

Author: zelvam95

ta/qcom_pas/include/auth/pas_policy.h

@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#ifndef __PAS_POLICY_H
+#define __PAS_POLICY_H
+
+#include <stdint.h>
+#include <tee_api_types.h>
+
+TEE_Result pas_policy_expected_swid(uint32_t pas_id, uint32_t *swid);
+
+#endif /* __PAS_POLICY_H */

ta/qcom_pas/include/auth/pas_sig.h

@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#ifndef __PAS_AUTH_SIG_H
+#define __PAS_AUTH_SIG_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <tee_api_types.h>
+
+#define PAS_AUTH_MAX_HASH_SIZE		48U
+#define PAS_AUTH_MAX_SIG_SIZE		512U
+
+TEE_Result pas_sig_verify_cert_chain(const uint8_t *chain_der,
+				     size_t chain_der_len, bool eku_enforced,
+				     uint32_t num_roots,
+				     uint32_t root_cert_sel,
+				     const uint8_t **leaf_der,
+				     size_t *leaf_der_len,
+				     const uint8_t **roots_der,
+				     size_t *roots_der_len);
+
+TEE_Result pas_sig_check_root_of_trust(uint32_t hash_algo, size_t hash_len,
+				       const uint8_t *root_der,
+				       size_t root_der_len,
+				       const uint8_t *expected);
+
+TEE_Result pas_sig_algo_from_leaf(const uint8_t *leaf_der,
+				  size_t leaf_der_len, uint32_t *sig_algo,
+				  uint32_t *hash_algo);
+
+TEE_Result pas_sig_verify_signature(uint32_t sig_algo, uint32_t hash_algo,
+				    const uint8_t *leaf_der,
+				    size_t leaf_der_len,
+				    const uint8_t *msg, size_t msg_len,
+				    const uint8_t *sig, size_t sig_len);
+
+#endif /* __PAS_AUTH_SIG_H */

ta/qcom_pas/include/auth/pas_sig_auth.h

@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#ifndef __PAS_SIG_AUTH_H
+#define __PAS_SIG_AUTH_H
+
+#include <pas_mbn.h>
+#include <pas_meta.h>
+#include <tee_internal_api.h>
+
+#ifdef CFG_QCOM_PAS_AUTH
+TEE_Result pas_sig_auth_hash_len(const struct pas_md_slot *slot,
+				 uint32_t *hash_len);
+
+TEE_Result pas_sig_auth_authenticate(const struct pas_mbn *hs,
+				     const uint8_t *meta_data,
+				     size_t meta_data_size,
+				     uint32_t pas_id, uint32_t hash_len,
+				     const uint8_t *anchor);
+#else
+static inline TEE_Result
+pas_sig_auth_hash_len(const struct pas_md_slot *slot __unused,
+		      uint32_t *hash_len)
+{
+	*hash_len = TEE_SHA384_HASH_SIZE;
+	return TEE_SUCCESS;
+}
+
+static inline TEE_Result
+pas_sig_auth_authenticate(const struct pas_mbn *hs __unused,
+			  const uint8_t *meta_data __unused,
+			  size_t meta_data_size __unused,
+			  uint32_t pas_id __unused,
+			  uint32_t hash_len __unused,
+			  const uint8_t *anchor __unused)
+{
+	return TEE_SUCCESS;
+}
+#endif /* CFG_QCOM_PAS_AUTH */
+
+#endif /* __PAS_SIG_AUTH_H */

ta/qcom_pas/src/auth/pas_auth.c

@@ -4,10 +4,14 @@
  */
 
 #include <pas_auth.h>
+#include <pas_fuse.h>
 #include <pas_mbn.h>
 #include <pas_meta.h>
+#include <pas_sig_auth.h>
+#include <pta_qcom_fuse.h>
 #include <pta_qcom_pas.h>
 #include <string.h>
+#include <string_ext.h>
 #include <tee_internal_api.h>
 #include <utee_defines.h>
 
@@ -80,7 +84,9 @@ TEE_Result pas_auth_save_metadata(struct qcom_pas_session *s, uint32_t pt,
 TEE_Result pas_auth_prepare(struct qcom_pas_session *s, uint32_t pas_id)
 {
 	struct pas_md_slot *slot = get_meta_data_slot(s, pas_id);
+	uint8_t anchor[PTA_QCOM_FUSE_ROOT_OF_TRUST_SIZE] = { };
 	TEE_Result res = TEE_ERROR_GENERIC;
+	bool secboot_on = false;
 	uint32_t hash_len = 0;
 
 	if (!slot) {
@@ -96,16 +102,37 @@ TEE_Result pas_auth_prepare(struct qcom_pas_session *s, uint32_t pas_id)
 		return res;
 	}
 
+	res = pas_fuse_get_secboot_and_root_anchor(anchor, &secboot_on);
+	if (res)
+		secboot_on = true;
+
+	res = pas_sig_auth_hash_len(slot, &hash_len);
+	if (res) {
+		EMSG("PAS auth: cannot pick hash size: %#"PRIx32, res);
+		goto out;
+	}
+
 	res = pas_mbn_parse(slot->meta_data, slot->meta_data_size, hash_len,
 			    &slot->mbn);
 	if (res) {
 		EMSG("PAS auth: MBN parse failed: %#"PRIx32, res);
-		return res;
+		goto out;
+	}
+
+	if (secboot_on) {
+		res = pas_sig_auth_authenticate(&slot->mbn, slot->meta_data,
+						slot->meta_data_size, pas_id,
+						hash_len, anchor);
+		if (res)
+			goto out;
 	}
 
 	slot->ready = true;
+	res = TEE_SUCCESS;
+out:
+	memzero_explicit(anchor, sizeof(anchor));
 
-	return TEE_SUCCESS;
+	return res;
 }
 
 TEE_Result pas_auth_verify(struct qcom_pas_session *s,

ta/qcom_pas/src/auth/pas_policy.c

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#include <pas_policy.h>
+#include <tee_api_types.h>
+#include <util.h>
+
+#define PAS_ID_QDSP6		1
+#define PAS_ID_WPSS		6
+#define PAS_ID_VENUS		9
+#define PAS_ID_TURING		18
+#define PAS_ID_TURING1		30
+#define PAS_ID_CAMERA		33
+#define PAS_ID_GPDSP0		39
+#define PAS_ID_GPDSP1		40
+
+#define SECBOOT_ADSP_SW_TYPE	0x04
+#define SECBOOT_WCNSS_SW_TYPE	0x0D
+#define SECBOOT_VIDEO_SW_TYPE	0x0E
+#define SECBOOT_CDSP_SW_TYPE	0x17
+#define SECBOOT_CAMERA_FW_SW_TYPE	0x34
+#define SECBOOT_CDSP1_SW_TYPE	0x44
+#define SECBOOT_GPDSP0_SW_TYPE	0x58
+#define SECBOOT_GPDSP1_SW_TYPE	0x5A
+
+static const struct {
+	uint32_t pas_id;
+	uint32_t swid;
+} pas_swid_map[] = {
+	{ PAS_ID_QDSP6, SECBOOT_ADSP_SW_TYPE },
+	{ PAS_ID_WPSS, SECBOOT_WCNSS_SW_TYPE },
+	{ PAS_ID_VENUS, SECBOOT_VIDEO_SW_TYPE },
+	{ PAS_ID_TURING, SECBOOT_CDSP_SW_TYPE },
+	{ PAS_ID_TURING1, SECBOOT_CDSP1_SW_TYPE },
+	{ PAS_ID_CAMERA, SECBOOT_CAMERA_FW_SW_TYPE },
+	{ PAS_ID_GPDSP0, SECBOOT_GPDSP0_SW_TYPE },
+	{ PAS_ID_GPDSP1, SECBOOT_GPDSP1_SW_TYPE },
+};
+
+TEE_Result pas_policy_expected_swid(uint32_t pas_id, uint32_t *swid)
+{
+	size_t i = 0;
+
+	if (!swid)
+		return TEE_ERROR_BAD_PARAMETERS;
+
+	for (i = 0; i < ARRAY_SIZE(pas_swid_map); i++) {
+		if (pas_swid_map[i].pas_id == pas_id) {
+			*swid = pas_swid_map[i].swid;
+			return TEE_SUCCESS;
+		}
+	}
+
+	return TEE_ERROR_NOT_SUPPORTED;
+}