1 /* 2 * Copyright (c) 2021-2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdint.h> 8 9 #include <common/tbbr/tbbr_img_def.h> 10 #include <drivers/measured_boot/event_log/event_log.h> 11 #include <drivers/measured_boot/metadata.h> 12 #if defined(ARM_COT_cca) 13 #include <tools_share/cca_oid.h> 14 #else 15 #include <tools_share/tbbr_oid.h> 16 #endif /* ARM_COT_cca */ 17 #include <fvp_critical_data.h> 18 19 #include <plat/arm/common/plat_arm.h> 20 #include <plat/common/common_def.h> 21 22 #if !TRANSFER_LIST && (defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)) 23 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \ 24 assert_res_eventlog_mem_insufficient); 25 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 26 27 /* Event Log data */ 28 static uint64_t event_log_base; 29 30 /* FVP table with platform specific image IDs, names and PCRs */ 31 const event_log_metadata_t fvp_event_log_metadata[] = { 32 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 }, 33 { BL32_IMAGE_ID, MBOOT_BL32_IMAGE_STRING, PCR_0 }, 34 { BL32_EXTRA1_IMAGE_ID, MBOOT_BL32_EXTRA1_IMAGE_STRING, PCR_0 }, 35 { BL32_EXTRA2_IMAGE_ID, MBOOT_BL32_EXTRA2_IMAGE_STRING, PCR_0 }, 36 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 }, 37 { HW_CONFIG_ID, MBOOT_HW_CONFIG_STRING, PCR_0 }, 38 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 }, 39 { SCP_BL2_IMAGE_ID, MBOOT_SCP_BL2_IMAGE_STRING, PCR_0 }, 40 { SOC_FW_CONFIG_ID, MBOOT_SOC_FW_CONFIG_STRING, PCR_0 }, 41 { TOS_FW_CONFIG_ID, MBOOT_TOS_FW_CONFIG_STRING, PCR_0 }, 42 { RMM_IMAGE_ID, MBOOT_RMM_IMAGE_STRING, PCR_0}, 43 44 #if defined(SPD_spmd) 45 { SP_PKG1_ID, MBOOT_SP1_STRING, PCR_0 }, 46 { SP_PKG2_ID, MBOOT_SP2_STRING, PCR_0 }, 47 { SP_PKG3_ID, MBOOT_SP3_STRING, PCR_0 }, 48 { SP_PKG4_ID, MBOOT_SP4_STRING, PCR_0 }, 49 { SP_PKG5_ID, MBOOT_SP5_STRING, PCR_0 }, 50 { SP_PKG6_ID, MBOOT_SP6_STRING, PCR_0 }, 51 { SP_PKG7_ID, MBOOT_SP7_STRING, PCR_0 }, 52 { SP_PKG8_ID, MBOOT_SP8_STRING, PCR_0 }, 53 #endif 54 55 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 }, 56 57 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 58 }; 59 60 void bl2_plat_mboot_init(void) 61 { 62 uint8_t *event_log_start; 63 uint8_t *event_log_finish; 64 size_t bl1_event_log_size __unused; 65 size_t event_log_max_size __unused; 66 int rc __unused; 67 68 #if TRANSFER_LIST 69 event_log_start = transfer_list_event_log_extend( 70 secure_tl, PLAT_ARM_EVENT_LOG_MAX_SIZE, &event_log_max_size); 71 event_log_finish = event_log_start + event_log_max_size; 72 73 event_log_base = (uintptr_t)event_log_start; 74 #else 75 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size, 76 &event_log_max_size); 77 if (rc != 0) { 78 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n", 79 __func__); 80 /* 81 * It is a fatal error because on FVP platform, BL2 software 82 * assumes that a valid Event Log buffer exist and it will use 83 * same Event Log buffer to append image measurements. 84 */ 85 panic(); 86 } 87 88 /* 89 * BL1 and BL2 share the same Event Log buffer and that BL2 will 90 * append its measurements after BL1's 91 */ 92 event_log_start = 93 (uint8_t *)((uintptr_t)event_log_base + bl1_event_log_size); 94 event_log_finish = 95 (uint8_t *)((uintptr_t)event_log_base + event_log_max_size); 96 #endif 97 98 event_log_init((uint8_t *)event_log_start, event_log_finish); 99 } 100 101 int plat_mboot_measure_critical_data(unsigned int critical_data_id, 102 const void *base, size_t size) 103 { 104 /* 105 * It is very unlikely that the critical data size would be 106 * bigger than 2^32 bytes 107 */ 108 assert(size < UINT32_MAX); 109 assert(base != NULL); 110 111 /* Calculate image hash and record data in Event Log */ 112 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size, 113 critical_data_id, 114 fvp_event_log_metadata); 115 if (err != 0) { 116 ERROR("%s%s critical data (%i)\n", 117 "Failed to ", "record", err); 118 return err; 119 } 120 121 return 0; 122 } 123 124 #if TRUSTED_BOARD_BOOT 125 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data) 126 { 127 char *nv_ctr_oids[MAX_NV_CTR_IDS] = { 128 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID, 129 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID, 130 }; 131 132 for (int i = 0; i < MAX_NV_CTR_IDS; i++) { 133 int rc = plat_get_nv_ctr(nv_ctr_oids[i], 134 &critical_data->nv_ctr[i]); 135 if (rc != 0) { 136 return rc; 137 } 138 } 139 140 return 0; 141 } 142 #endif /* TRUSTED_BOARD_BOOT */ 143 144 static int fvp_populate_and_measure_critical_data(void) 145 { 146 int rc = 0; 147 148 /* 149 * FVP platform only measures 'platform NV-counter' and hence its 150 * measurement makes sense during Trusted-Boot flow only. 151 */ 152 #if TRUSTED_BOARD_BOOT 153 struct fvp_critical_data populate_critical_data; 154 155 rc = fvp_populate_critical_data(&populate_critical_data); 156 if (rc == 0) { 157 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID, 158 &populate_critical_data, 159 sizeof(populate_critical_data)); 160 } 161 #endif /* TRUSTED_BOARD_BOOT */ 162 163 return rc; 164 } 165 166 void bl2_plat_mboot_finish(void) 167 { 168 int rc; 169 170 /* Event Log address in Non-Secure memory */ 171 uintptr_t ns_log_addr __unused; 172 173 /* Event Log filled size */ 174 size_t event_log_cur_size; 175 176 rc = fvp_populate_and_measure_critical_data(); 177 if (rc != 0) { 178 panic(); 179 } 180 181 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 182 183 #if TRANSFER_LIST 184 /* 185 * Re-size the event log for the next stage and update the size to include 186 * the entire event log (i.e., not just what this stage has added.) 187 */ 188 event_log_base = (uintptr_t)transfer_list_event_log_finish( 189 secure_tl, (uintptr_t)event_log_base + event_log_cur_size); 190 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 191 #else 192 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 193 /* Copy Event Log to TZC secured DRAM memory */ 194 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE, 195 (const void *)event_log_base, 196 event_log_cur_size); 197 198 /* Ensure that the Event Log is visible in TZC secured DRAM memory */ 199 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size); 200 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 201 202 rc = arm_set_nt_fw_info( 203 #ifdef SPD_opteed 204 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 205 #endif 206 event_log_cur_size, &ns_log_addr); 207 if (rc != 0) { 208 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 209 __func__, "NT"); 210 /* 211 * It is a fatal error because on FVP secure world software 212 * assumes that a valid event log exists and will use it to 213 * record the measurements into the fTPM. 214 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the 215 * secure Event Log buffer address. 216 */ 217 panic(); 218 } 219 220 /* Copy Event Log to Non-secure memory */ 221 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base, 222 event_log_cur_size); 223 224 /* Ensure that the Event Log is visible in Non-secure memory */ 225 flush_dcache_range(ns_log_addr, event_log_cur_size); 226 227 #if defined(SPD_tspd) || defined(SPD_spmd) 228 /* Set Event Log data in TOS_FW_CONFIG */ 229 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 230 event_log_cur_size); 231 if (rc != 0) { 232 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 233 __func__, "TOS"); 234 panic(); 235 } 236 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */ 237 #endif /* TRANSFER_LIST */ 238 239 event_log_dump((uint8_t *)event_log_base, event_log_cur_size); 240 } 241