1 /*
2 * Copyright (c) 2021-2025, Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <stdint.h>
8
9 #include <common/tbbr/tbbr_img_def.h>
10 #if TRANSFER_LIST
11 #include <tpm_event_log.h>
12 #endif
13 #include <drivers/auth/crypto_mod.h>
14 #include <drivers/measured_boot/metadata.h>
15 #include <event_measure.h>
16 #include <event_print.h>
17 #if defined(ARM_COT_cca)
18 #include <tools_share/cca_oid.h>
19 #else
20 #include <tools_share/tbbr_oid.h>
21 #endif /* ARM_COT_cca */
22 #include <fvp_critical_data.h>
23
24 #include <plat/arm/common/plat_arm.h>
25 #include <plat/common/common_def.h>
26
27 #if !TRANSFER_LIST && (defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd))
28 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \
29 assert_res_eventlog_mem_insufficient);
30 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */
31
32 /* Event Log data */
33 static uint64_t event_log_base;
34
35 static const struct event_log_hash_info crypto_hash_info = {
36 .func = crypto_mod_calc_hash,
37 .ids = (const uint32_t[]){ CRYPTO_MD_ID },
38 .count = 1U,
39 };
40
41 /* FVP table with platform specific image IDs, names and PCRs */
42 const event_log_metadata_t fvp_event_log_metadata[] = {
43 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 },
44 { BL32_IMAGE_ID, MBOOT_BL32_IMAGE_STRING, PCR_0 },
45 { BL32_EXTRA1_IMAGE_ID, MBOOT_BL32_EXTRA1_IMAGE_STRING, PCR_0 },
46 { BL32_EXTRA2_IMAGE_ID, MBOOT_BL32_EXTRA2_IMAGE_STRING, PCR_0 },
47 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 },
48 { HW_CONFIG_ID, MBOOT_HW_CONFIG_STRING, PCR_0 },
49 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 },
50 { SCP_BL2_IMAGE_ID, MBOOT_SCP_BL2_IMAGE_STRING, PCR_0 },
51 { SOC_FW_CONFIG_ID, MBOOT_SOC_FW_CONFIG_STRING, PCR_0 },
52 { TOS_FW_CONFIG_ID, MBOOT_TOS_FW_CONFIG_STRING, PCR_0 },
53 { RMM_IMAGE_ID, MBOOT_RMM_IMAGE_STRING, PCR_0},
54
55 #if defined(SPD_spmd)
56 { SP_PKG1_ID, MBOOT_SP1_STRING, PCR_0 },
57 { SP_PKG2_ID, MBOOT_SP2_STRING, PCR_0 },
58 { SP_PKG3_ID, MBOOT_SP3_STRING, PCR_0 },
59 { SP_PKG4_ID, MBOOT_SP4_STRING, PCR_0 },
60 { SP_PKG5_ID, MBOOT_SP5_STRING, PCR_0 },
61 { SP_PKG6_ID, MBOOT_SP6_STRING, PCR_0 },
62 { SP_PKG7_ID, MBOOT_SP7_STRING, PCR_0 },
63 { SP_PKG8_ID, MBOOT_SP8_STRING, PCR_0 },
64 #endif
65
66 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 },
67
68 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */
69 };
70
bl2_plat_mboot_init(void)71 void bl2_plat_mboot_init(void)
72 {
73 uint8_t *event_log_start;
74 uint8_t *event_log_finish;
75 size_t bl1_event_log_size __unused = 0;
76 size_t event_log_max_size __unused = 0;
77 int rc __unused;
78
79 #if TRANSFER_LIST
80 event_log_start = transfer_list_event_log_extend(
81 secure_tl, PLAT_ARM_EVENT_LOG_MAX_SIZE);
82 event_log_finish = event_log_start + PLAT_ARM_EVENT_LOG_MAX_SIZE;
83
84 event_log_base = (uintptr_t)event_log_start;
85 #else
86 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size,
87 &event_log_max_size);
88 if (rc != 0) {
89 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n",
90 __func__);
91 /*
92 * It is a fatal error because on FVP platform, BL2 software
93 * assumes that a valid Event Log buffer exist and it will use
94 * same Event Log buffer to append image measurements.
95 */
96 panic();
97 }
98
99 /*
100 * BL1 and BL2 share the same Event Log buffer and that BL2 will
101 * append its measurements after BL1's
102 */
103 event_log_start =
104 (uint8_t *)((uintptr_t)event_log_base + bl1_event_log_size);
105 event_log_finish =
106 (uint8_t *)((uintptr_t)event_log_base + event_log_max_size);
107 #endif
108
109 rc = event_log_init_and_reg(event_log_start, event_log_finish,
110 &crypto_hash_info);
111 if (rc < 0) {
112 ERROR("Failed to initialize event log (%d).\n", rc);
113 panic();
114 }
115 }
116
plat_mboot_measure_critical_data(unsigned int critical_data_id,const void * base,size_t size)117 int plat_mboot_measure_critical_data(unsigned int critical_data_id,
118 const void *base, size_t size)
119 {
120 /*
121 * It is very unlikely that the critical data size would be
122 * bigger than 2^32 bytes
123 */
124 assert(size < UINT32_MAX);
125 assert(base != NULL);
126
127 /* Calculate image hash and record data in Event Log */
128 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size,
129 critical_data_id,
130 fvp_event_log_metadata);
131 if (err != 0) {
132 ERROR("%s%s critical data (%i)\n",
133 "Failed to ", "record", err);
134 return err;
135 }
136
137 return 0;
138 }
139
140 #if TRUSTED_BOARD_BOOT
fvp_populate_critical_data(struct fvp_critical_data * critical_data)141 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data)
142 {
143 char *nv_ctr_oids[MAX_NV_CTR_IDS] = {
144 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID,
145 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID,
146 };
147
148 for (int i = 0; i < MAX_NV_CTR_IDS; i++) {
149 int rc = plat_get_nv_ctr(nv_ctr_oids[i],
150 &critical_data->nv_ctr[i]);
151 if (rc != 0) {
152 return rc;
153 }
154 }
155
156 return 0;
157 }
158 #endif /* TRUSTED_BOARD_BOOT */
159
fvp_populate_and_measure_critical_data(void)160 static int fvp_populate_and_measure_critical_data(void)
161 {
162 int rc = 0;
163
164 /*
165 * FVP platform only measures 'platform NV-counter' and hence its
166 * measurement makes sense during Trusted-Boot flow only.
167 */
168 #if TRUSTED_BOARD_BOOT
169 struct fvp_critical_data populate_critical_data;
170
171 rc = fvp_populate_critical_data(&populate_critical_data);
172 if (rc == 0) {
173 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID,
174 &populate_critical_data,
175 sizeof(populate_critical_data));
176 }
177 #endif /* TRUSTED_BOARD_BOOT */
178
179 return rc;
180 }
181
bl2_plat_mboot_finish(void)182 void bl2_plat_mboot_finish(void)
183 {
184 int rc;
185
186 /* Event Log address in Non-Secure memory */
187 uintptr_t ns_log_addr __unused;
188
189 /* Event Log filled size */
190 size_t event_log_cur_size;
191
192 struct transfer_list_entry *te __maybe_unused;
193
194 rc = fvp_populate_and_measure_critical_data();
195 if (rc != 0) {
196 panic();
197 }
198
199 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base);
200
201 #if TRANSFER_LIST
202 /*
203 * Re-size the event log for the next stage and update the size to include
204 * the entire event log (i.e., not just what this stage has added.)
205 */
206 event_log_base = (uintptr_t)transfer_list_event_log_finish(
207 secure_tl, (uintptr_t)event_log_base + event_log_cur_size);
208
209 /* Ensure changes are visible to the next stage. */
210 flush_dcache_range((uintptr_t)secure_tl, secure_tl->size);
211
212 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base);
213
214 /* If there is DT_SPMC_MANIFEST, update event log information. */
215 te = transfer_list_find(secure_tl, TL_TAG_DT_SPMC_MANIFEST);
216 if (te != NULL) {
217 te = transfer_list_find(secure_tl, TL_TAG_TPM_EVLOG);
218 assert(te != NULL && te->data_size > 0);
219
220 rc = arm_set_tos_fw_info((uintptr_t)transfer_list_entry_data(te),
221 te->data_size);
222 if (rc != 0) {
223 WARN("%s(): Unable to update %s_FW_CONFIG\n",
224 __func__, "TOS");
225 }
226
227 transfer_list_update_checksum(secure_tl);
228 }
229 #else
230 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)
231 /* Copy Event Log to TZC secured DRAM memory */
232 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE,
233 (const void *)event_log_base,
234 event_log_cur_size);
235
236 /* Ensure that the Event Log is visible in TZC secured DRAM memory */
237 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size);
238 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */
239
240 rc = arm_set_nt_fw_info(
241 #ifdef SPD_opteed
242 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE,
243 #endif
244 event_log_cur_size, &ns_log_addr);
245 if (rc != 0) {
246 ERROR("%s(): Unable to update %s_FW_CONFIG\n",
247 __func__, "NT");
248 /*
249 * It is a fatal error because on FVP secure world software
250 * assumes that a valid event log exists and will use it to
251 * record the measurements into the fTPM.
252 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the
253 * secure Event Log buffer address.
254 */
255 panic();
256 }
257
258 /* Copy Event Log to Non-secure memory */
259 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base,
260 event_log_cur_size);
261
262 /* Ensure that the Event Log is visible in Non-secure memory */
263 flush_dcache_range(ns_log_addr, event_log_cur_size);
264
265 #if defined(SPD_tspd) || defined(SPD_spmd)
266 /* Set Event Log data in TOS_FW_CONFIG */
267 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE,
268 event_log_cur_size);
269 if (rc != 0) {
270 ERROR("%s(): Unable to update %s_FW_CONFIG\n",
271 __func__, "TOS");
272 panic();
273 }
274 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */
275 #endif /* TRANSFER_LIST */
276
277 event_log_dump((uint8_t *)event_log_base, event_log_cur_size);
278 }
279