1 /* 2 * Copyright (c) 2021-2023, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdint.h> 8 9 #include <common/tbbr/tbbr_img_def.h> 10 #include <drivers/measured_boot/event_log/event_log.h> 11 #include <drivers/measured_boot/rss/rss_measured_boot.h> 12 #if defined(ARM_COT_cca) 13 #include <tools_share/cca_oid.h> 14 #else 15 #include <tools_share/tbbr_oid.h> 16 #endif /* ARM_COT_cca */ 17 #include <fvp_critical_data.h> 18 19 #include <plat/arm/common/plat_arm.h> 20 #include <plat/common/common_def.h> 21 22 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 23 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \ 24 assert_res_eventlog_mem_insufficient); 25 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 26 27 /* Event Log data */ 28 static uint64_t event_log_base; 29 30 /* FVP table with platform specific image IDs, names and PCRs */ 31 const event_log_metadata_t fvp_event_log_metadata[] = { 32 { BL31_IMAGE_ID, EVLOG_BL31_STRING, PCR_0 }, 33 { BL32_IMAGE_ID, EVLOG_BL32_STRING, PCR_0 }, 34 { BL32_EXTRA1_IMAGE_ID, EVLOG_BL32_EXTRA1_STRING, PCR_0 }, 35 { BL32_EXTRA2_IMAGE_ID, EVLOG_BL32_EXTRA2_STRING, PCR_0 }, 36 { BL33_IMAGE_ID, EVLOG_BL33_STRING, PCR_0 }, 37 { HW_CONFIG_ID, EVLOG_HW_CONFIG_STRING, PCR_0 }, 38 { NT_FW_CONFIG_ID, EVLOG_NT_FW_CONFIG_STRING, PCR_0 }, 39 { SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 }, 40 { SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 }, 41 { TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 }, 42 { RMM_IMAGE_ID, EVLOG_RMM_STRING, PCR_0}, 43 44 #if defined(SPD_spmd) 45 { SP_PKG1_ID, EVLOG_SP1_STRING, PCR_0 }, 46 { SP_PKG2_ID, EVLOG_SP2_STRING, PCR_0 }, 47 { SP_PKG3_ID, EVLOG_SP3_STRING, PCR_0 }, 48 { SP_PKG4_ID, EVLOG_SP4_STRING, PCR_0 }, 49 { SP_PKG5_ID, EVLOG_SP5_STRING, PCR_0 }, 50 { SP_PKG6_ID, EVLOG_SP6_STRING, PCR_0 }, 51 { SP_PKG7_ID, EVLOG_SP7_STRING, PCR_0 }, 52 { SP_PKG8_ID, EVLOG_SP8_STRING, PCR_0 }, 53 #endif 54 55 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 }, 56 57 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 58 }; 59 60 /* FVP table with platform specific image IDs and metadata. Intentionally not a 61 * const struct, some members might set by bootloaders during trusted boot. 62 */ 63 struct rss_mboot_metadata fvp_rss_mboot_metadata[] = { 64 { 65 .id = BL31_IMAGE_ID, 66 .slot = U(9), 67 .signer_id_size = SIGNER_ID_MIN_SIZE, 68 .sw_type = RSS_MBOOT_BL31_STRING, 69 .pk_oid = BL31_IMAGE_KEY_OID, 70 .lock_measurement = true }, 71 { 72 .id = HW_CONFIG_ID, 73 .slot = U(10), 74 .signer_id_size = SIGNER_ID_MIN_SIZE, 75 .sw_type = RSS_MBOOT_HW_CONFIG_STRING, 76 .pk_oid = HW_CONFIG_KEY_OID, 77 .lock_measurement = true }, 78 { 79 .id = SOC_FW_CONFIG_ID, 80 .slot = U(11), 81 .signer_id_size = SIGNER_ID_MIN_SIZE, 82 .sw_type = RSS_MBOOT_SOC_FW_CONFIG_STRING, 83 .pk_oid = SOC_FW_CONFIG_KEY_OID, 84 .lock_measurement = true }, 85 #if ENABLE_RME 86 { 87 .id = RMM_IMAGE_ID, 88 .slot = U(12), 89 .signer_id_size = SIGNER_ID_MIN_SIZE, 90 .sw_type = RSS_MBOOT_RMM_STRING, 91 .pk_oid = RMM_IMAGE_KEY_OID, 92 .lock_measurement = true }, 93 #endif /* ENABLE_RME */ 94 { 95 .id = RSS_MBOOT_INVALID_ID } 96 }; 97 98 void bl2_plat_mboot_init(void) 99 { 100 uint8_t *event_log_start; 101 uint8_t *event_log_finish; 102 size_t bl1_event_log_size; 103 size_t event_log_max_size; 104 int rc; 105 106 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size, 107 &event_log_max_size); 108 if (rc != 0) { 109 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n", 110 __func__); 111 /* 112 * It is a fatal error because on FVP platform, BL2 software 113 * assumes that a valid Event Log buffer exist and it will use 114 * same Event Log buffer to append image measurements. 115 */ 116 panic(); 117 } 118 119 /* 120 * BL1 and BL2 share the same Event Log buffer and that BL2 will 121 * append its measurements after BL1's 122 */ 123 event_log_start = (uint8_t *)((uintptr_t)event_log_base + 124 bl1_event_log_size); 125 event_log_finish = (uint8_t *)((uintptr_t)event_log_base + 126 event_log_max_size); 127 128 event_log_init((uint8_t *)event_log_start, event_log_finish); 129 130 rss_measured_boot_init(fvp_rss_mboot_metadata); 131 } 132 133 int plat_mboot_measure_critical_data(unsigned int critical_data_id, 134 const void *base, size_t size) 135 { 136 /* 137 * It is very unlikely that the critical data size would be 138 * bigger than 2^32 bytes 139 */ 140 assert(size < UINT32_MAX); 141 assert(base != NULL); 142 143 /* Calculate image hash and record data in Event Log */ 144 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size, 145 critical_data_id, 146 fvp_event_log_metadata); 147 if (err != 0) { 148 ERROR("%s%s critical data (%i)\n", 149 "Failed to ", "record", err); 150 return err; 151 } 152 153 return 0; 154 } 155 156 #if TRUSTED_BOARD_BOOT 157 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data) 158 { 159 char *nv_ctr_oids[MAX_NV_CTR_IDS] = { 160 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID, 161 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID, 162 }; 163 164 for (int i = 0; i < MAX_NV_CTR_IDS; i++) { 165 int rc = plat_get_nv_ctr(nv_ctr_oids[i], 166 &critical_data->nv_ctr[i]); 167 if (rc != 0) { 168 return rc; 169 } 170 } 171 172 return 0; 173 } 174 #endif /* TRUSTED_BOARD_BOOT */ 175 176 static int fvp_populate_and_measure_critical_data(void) 177 { 178 int rc = 0; 179 180 /* 181 * FVP platform only measures 'platform NV-counter' and hence its 182 * measurement makes sense during Trusted-Boot flow only. 183 */ 184 #if TRUSTED_BOARD_BOOT 185 struct fvp_critical_data populate_critical_data; 186 187 rc = fvp_populate_critical_data(&populate_critical_data); 188 if (rc == 0) { 189 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID, 190 &populate_critical_data, 191 sizeof(populate_critical_data)); 192 } 193 #endif /* TRUSTED_BOARD_BOOT */ 194 195 return rc; 196 } 197 198 void bl2_plat_mboot_finish(void) 199 { 200 int rc; 201 202 /* Event Log address in Non-Secure memory */ 203 uintptr_t ns_log_addr; 204 205 /* Event Log filled size */ 206 size_t event_log_cur_size; 207 208 rc = fvp_populate_and_measure_critical_data(); 209 if (rc != 0) { 210 panic(); 211 } 212 213 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 214 215 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 216 /* Copy Event Log to TZC secured DRAM memory */ 217 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE, 218 (const void *)event_log_base, 219 event_log_cur_size); 220 221 /* Ensure that the Event Log is visible in TZC secured DRAM memory */ 222 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size); 223 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 224 225 rc = arm_set_nt_fw_info( 226 #ifdef SPD_opteed 227 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 228 #endif 229 event_log_cur_size, &ns_log_addr); 230 if (rc != 0) { 231 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 232 __func__, "NT"); 233 /* 234 * It is a fatal error because on FVP secure world software 235 * assumes that a valid event log exists and will use it to 236 * record the measurements into the fTPM. 237 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the 238 * secure Event Log buffer address. 239 */ 240 panic(); 241 } 242 243 /* Copy Event Log to Non-secure memory */ 244 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base, 245 event_log_cur_size); 246 247 /* Ensure that the Event Log is visible in Non-secure memory */ 248 flush_dcache_range(ns_log_addr, event_log_cur_size); 249 250 #if defined(SPD_tspd) || defined(SPD_spmd) 251 /* Set Event Log data in TOS_FW_CONFIG */ 252 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 253 event_log_cur_size); 254 if (rc != 0) { 255 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 256 __func__, "TOS"); 257 panic(); 258 } 259 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */ 260 261 dump_event_log((uint8_t *)event_log_base, event_log_cur_size); 262 } 263