Skip to content

Commit f7de2ad

Browse files
david-hazi-armdavid-hazi-arm
committed
provisioning: Prevent re-provisioning
After successful provisioning, the code writes a pattern into the ITS, which could be checked on the next boot. Signed-off-by: Dávid Házi <[email protected]>
1 parent ca1fe7b commit f7de2ad

File tree

7 files changed

+148
-56
lines changed

7 files changed

+148
-56
lines changed

‎applications/freertos_iot_libraries_tests/main.c‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -160,25 +160,36 @@ int main( void )
160160
mbedtls_platform_mutex_lock,
161161
mbedtls_platform_mutex_unlock );
162162

163-
xRetVal = vDevModeKeyProvisioning();
164-
165-
if( xRetVal != CKR_OK )
166-
{
167-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
168-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
169-
return EXIT_FAILURE;
170-
}
171-
else
163+
if( uxIsDeviceProvisioned() == false )
172164
{
165+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
166+
167+
if( uxReturnValue != CKR_OK )
168+
{
169+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
170+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
171+
return EXIT_FAILURE;
172+
}
173+
173174
LogInfo( ( "Device key provisioning succeeded \n" ) );
174-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
175175

176-
if( status != PSA_SUCCESS )
176+
/* FIXME: Magic value */
177+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
178+
179+
if( uxStatus != PSA_SUCCESS )
177180
{
178-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
181+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
182+
return EXIT_FAILURE;
183+
}
184+
else
185+
{
186+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
179187
}
180188

181-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
189+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
190+
{
191+
return EXIT_FAILURE;
192+
}
182193
}
183194

184195
status = network_startup();

‎applications/helpers/provisioning/dev_mode_key_provisioning.c‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@
6767
#include "mbedtls/entropy.h"
6868
#include "mbedtls/ctr_drbg.h"
6969

70+
/* TF-M ITS include */
71+
#include "psa/internal_trusted_storage.h"
72+
7073
/* Default FreeRTOS API for console logging. */
7174
#define DEV_MODE_KEY_PROVISIONING_PRINT( X ) printf
7275

@@ -91,6 +94,9 @@ extern void vLoggingPrint( const char * pcFormat );
9194

9295
#define DER_FORMAT_BUFFER_LENGTH 512
9396

97+
#define FIRST_BOOT_ITS_UID ( 1U )
98+
#define BOOT_PATTERN ( 0x55 )
99+
94100
/* Adding one to all of the lengths because ASN1 may pad a leading 0 byte
95101
* to numbers that could be interpreted as negative */
96102
typedef struct RsaParams_t
@@ -1443,4 +1449,39 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
14431449
return result;
14441450
}
14451451

1452+
UBaseType_t uxIsDeviceProvisioned( void )
1453+
{
1454+
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
1455+
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
1456+
uint8_t boot_pattern_in_its = 0;
1457+
size_t read_data_length = 0;
1458+
1459+
status = psa_its_get( uid, 0, 1, &boot_pattern_in_its,
1460+
&read_data_length );
1461+
1462+
if( status != PSA_SUCCESS )
1463+
{
1464+
return 0;
1465+
}
1466+
1467+
if( boot_pattern_in_its == BOOT_PATTERN )
1468+
{
1469+
return 1;
1470+
}
1471+
else
1472+
{
1473+
return 0;
1474+
}
1475+
}
1476+
1477+
psa_status_t xWriteDeviceProvisioned( void )
1478+
{
1479+
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
1480+
const psa_storage_create_flags_t flags = PSA_STORAGE_FLAG_WRITE_ONCE;
1481+
uint8_t first_boot_pattern = BOOT_PATTERN;
1482+
1483+
/* Write the pattern to ITS */
1484+
return psa_its_set( uid, 1, &first_boot_pattern, flags );
1485+
}
1486+
14461487
/*-----------------------------------------------------------*/

‎applications/helpers/provisioning/dev_mode_key_provisioning.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,4 +247,8 @@ CK_RV xDestroyProvidedObjects( CK_SESSION_HANDLE xSession,
247247
*/
248248
int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
249249
size_t keyBits );
250+
251+
UBaseType_t uxIsDeviceProvisioned( void );
252+
psa_status_t xWriteDeviceProvisioned( void );
253+
250254
#endif /* _AWS_DEV_MODE_KEY_PROVISIONING_H_ */

‎applications/keyword_detection/main.c‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -183,25 +183,37 @@ int main( void )
183183
}
184184
#endif
185185

186-
UBaseType_t xRetVal = vDevModeKeyProvisioning();
187-
188-
if( xRetVal != CKR_OK )
186+
if( uxIsDeviceProvisioned() == false )
189187
{
190-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
191-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
192-
return EXIT_FAILURE;
193-
}
188+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
194189

195-
LogInfo( ( "Device key provisioning succeeded \n" ) );
190+
if( uxReturnValue != CKR_OK )
191+
{
192+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
193+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
194+
return EXIT_FAILURE;
195+
}
196196

197-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
197+
LogInfo( ( "Device key provisioning succeeded \n" ) );
198198

199-
if( status != PSA_SUCCESS )
200-
{
201-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
202-
}
199+
/* FIXME: Magic value */
200+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
201+
202+
if( uxStatus != PSA_SUCCESS )
203+
{
204+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
205+
return EXIT_FAILURE;
206+
}
207+
else
208+
{
209+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
210+
}
203211

204-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
212+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
213+
{
214+
return EXIT_FAILURE;
215+
}
216+
}
205217

206218
/* The next initializations are done as a part of the main */
207219
/* function as these resources are shared between tasks */

‎applications/object_detection/main.c‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -171,26 +171,37 @@ int main( void )
171171
}
172172
#endif
173173

174-
UBaseType_t xReturnValue = vDevModeKeyProvisioning();
175-
176-
if( xReturnValue != CKR_OK )
174+
if( uxIsDeviceProvisioned() == false )
177175
{
178-
LogError( ( "Device key provisioning failed [%d]\n", xReturnValue ) );
179-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
180-
return EXIT_FAILURE;
181-
}
176+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
182177

183-
LogInfo( ( "Device key provisioning succeeded \n" ) );
178+
if( uxReturnValue != CKR_OK )
179+
{
180+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
181+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
182+
return EXIT_FAILURE;
183+
}
184184

185-
/* FIXME: Magic value */
186-
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
185+
LogInfo( ( "Device key provisioning succeeded \n" ) );
187186

188-
if( uxStatus != PSA_SUCCESS )
189-
{
190-
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
191-
}
187+
/* FIXME: Magic value */
188+
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
189+
190+
if( uxStatus != PSA_SUCCESS )
191+
{
192+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
193+
return EXIT_FAILURE;
194+
}
195+
else
196+
{
197+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
198+
}
192199

193-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
200+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
201+
{
202+
return EXIT_FAILURE;
203+
}
204+
}
194205

195206
/* The next initializations are done as a part of the main */
196207
/* function as these resources are shared between tasks */

‎applications/speech_recognition/main.c‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -182,25 +182,37 @@ int main( void )
182182
}
183183
#endif
184184

185-
UBaseType_t xRetVal = vDevModeKeyProvisioning();
186-
187-
if( xRetVal != CKR_OK )
185+
if( uxIsDeviceProvisioned() == false )
188186
{
189-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
190-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
191-
return EXIT_FAILURE;
192-
}
187+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
193188

194-
LogInfo( ( "Device key provisioning succeeded \n" ) );
189+
if( uxReturnValue != CKR_OK )
190+
{
191+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
192+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
193+
return EXIT_FAILURE;
194+
}
195195

196-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
196+
LogInfo( ( "Device key provisioning succeeded \n" ) );
197197

198-
if( status != PSA_SUCCESS )
199-
{
200-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
201-
}
198+
/* FIXME: Magic value */
199+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
200+
201+
if( uxStatus != PSA_SUCCESS )
202+
{
203+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
204+
return EXIT_FAILURE;
205+
}
206+
else
207+
{
208+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
209+
}
202210

203-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
211+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
212+
{
213+
return EXIT_FAILURE;
214+
}
215+
}
204216

205217
/* The next initializations are done as a part of the main */
206218
/* function as these resources are shared between tasks */

‎release_changes/202409101951.change.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
provisioning: Prevent re-provisioning

0 commit comments

Comments
 (0)