1 /* 2 * Copyright (c) 2021-2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdint.h> 8 9 #include <common/tbbr/tbbr_img_def.h> 10 #include <drivers/measured_boot/event_log/event_log.h> 11 #include <drivers/measured_boot/metadata.h> 12 #if defined(ARM_COT_cca) 13 #include <tools_share/cca_oid.h> 14 #else 15 #include <tools_share/tbbr_oid.h> 16 #endif /* ARM_COT_cca */ 17 #include <fvp_critical_data.h> 18 19 #include <plat/arm/common/plat_arm.h> 20 #include <plat/common/common_def.h> 21 22 #if !TRANSFER_LIST && (defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)) 23 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \ 24 assert_res_eventlog_mem_insufficient); 25 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 26 27 /* Event Log data */ 28 static uint64_t event_log_base; 29 30 /* FVP table with platform specific image IDs, names and PCRs */ 31 const event_log_metadata_t fvp_event_log_metadata[] = { 32 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 }, 33 { BL32_IMAGE_ID, MBOOT_BL32_IMAGE_STRING, PCR_0 }, 34 { BL32_EXTRA1_IMAGE_ID, MBOOT_BL32_EXTRA1_IMAGE_STRING, PCR_0 }, 35 { BL32_EXTRA2_IMAGE_ID, MBOOT_BL32_EXTRA2_IMAGE_STRING, PCR_0 }, 36 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 }, 37 { HW_CONFIG_ID, MBOOT_HW_CONFIG_STRING, PCR_0 }, 38 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 }, 39 { SCP_BL2_IMAGE_ID, MBOOT_SCP_BL2_IMAGE_STRING, PCR_0 }, 40 { SOC_FW_CONFIG_ID, MBOOT_SOC_FW_CONFIG_STRING, PCR_0 }, 41 { TOS_FW_CONFIG_ID, MBOOT_TOS_FW_CONFIG_STRING, PCR_0 }, 42 { RMM_IMAGE_ID, MBOOT_RMM_IMAGE_STRING, PCR_0}, 43 44 #if defined(SPD_spmd) 45 { SP_PKG1_ID, MBOOT_SP1_STRING, PCR_0 }, 46 { SP_PKG2_ID, MBOOT_SP2_STRING, PCR_0 }, 47 { SP_PKG3_ID, MBOOT_SP3_STRING, PCR_0 }, 48 { SP_PKG4_ID, MBOOT_SP4_STRING, PCR_0 }, 49 { SP_PKG5_ID, MBOOT_SP5_STRING, PCR_0 }, 50 { SP_PKG6_ID, MBOOT_SP6_STRING, PCR_0 }, 51 { SP_PKG7_ID, MBOOT_SP7_STRING, PCR_0 }, 52 { SP_PKG8_ID, MBOOT_SP8_STRING, PCR_0 }, 53 #endif 54 55 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 }, 56 57 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 58 }; 59 60 void bl2_plat_mboot_init(void) 61 { 62 uint8_t *event_log_start; 63 uint8_t *event_log_finish; 64 size_t bl1_event_log_size __unused; 65 size_t event_log_max_size __unused; 66 int rc __unused; 67 68 #if TRANSFER_LIST 69 event_log_start = transfer_list_event_log_extend( 70 secure_tl, PLAT_ARM_EVENT_LOG_MAX_SIZE, &event_log_max_size); 71 event_log_finish = event_log_start + event_log_max_size; 72 event_log_base = (uintptr_t)event_log_start; 73 #else 74 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size, 75 &event_log_max_size); 76 if (rc != 0) { 77 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n", 78 __func__); 79 /* 80 * It is a fatal error because on FVP platform, BL2 software 81 * assumes that a valid Event Log buffer exist and it will use 82 * same Event Log buffer to append image measurements. 83 */ 84 panic(); 85 } 86 87 /* 88 * BL1 and BL2 share the same Event Log buffer and that BL2 will 89 * append its measurements after BL1's 90 */ 91 event_log_start = 92 (uint8_t *)((uintptr_t)event_log_base + bl1_event_log_size); 93 event_log_finish = 94 (uint8_t *)((uintptr_t)event_log_base + event_log_max_size); 95 #endif 96 97 event_log_init((uint8_t *)event_log_start, event_log_finish); 98 } 99 100 int plat_mboot_measure_critical_data(unsigned int critical_data_id, 101 const void *base, size_t size) 102 { 103 /* 104 * It is very unlikely that the critical data size would be 105 * bigger than 2^32 bytes 106 */ 107 assert(size < UINT32_MAX); 108 assert(base != NULL); 109 110 /* Calculate image hash and record data in Event Log */ 111 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size, 112 critical_data_id, 113 fvp_event_log_metadata); 114 if (err != 0) { 115 ERROR("%s%s critical data (%i)\n", 116 "Failed to ", "record", err); 117 return err; 118 } 119 120 return 0; 121 } 122 123 #if TRUSTED_BOARD_BOOT 124 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data) 125 { 126 char *nv_ctr_oids[MAX_NV_CTR_IDS] = { 127 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID, 128 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID, 129 }; 130 131 for (int i = 0; i < MAX_NV_CTR_IDS; i++) { 132 int rc = plat_get_nv_ctr(nv_ctr_oids[i], 133 &critical_data->nv_ctr[i]); 134 if (rc != 0) { 135 return rc; 136 } 137 } 138 139 return 0; 140 } 141 #endif /* TRUSTED_BOARD_BOOT */ 142 143 static int fvp_populate_and_measure_critical_data(void) 144 { 145 int rc = 0; 146 147 /* 148 * FVP platform only measures 'platform NV-counter' and hence its 149 * measurement makes sense during Trusted-Boot flow only. 150 */ 151 #if TRUSTED_BOARD_BOOT 152 struct fvp_critical_data populate_critical_data; 153 154 rc = fvp_populate_critical_data(&populate_critical_data); 155 if (rc == 0) { 156 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID, 157 &populate_critical_data, 158 sizeof(populate_critical_data)); 159 } 160 #endif /* TRUSTED_BOARD_BOOT */ 161 162 return rc; 163 } 164 165 void bl2_plat_mboot_finish(void) 166 { 167 int rc; 168 169 /* Event Log address in Non-Secure memory */ 170 uintptr_t ns_log_addr __unused; 171 172 /* Event Log filled size */ 173 size_t event_log_cur_size; 174 175 struct transfer_list_entry *te __maybe_unused; 176 177 rc = fvp_populate_and_measure_critical_data(); 178 if (rc != 0) { 179 panic(); 180 } 181 182 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 183 184 #if TRANSFER_LIST 185 /* 186 * Re-size the event log for the next stage and update the size to include 187 * the entire event log (i.e., not just what this stage has added.) 188 */ 189 event_log_base = (uintptr_t)transfer_list_event_log_finish( 190 secure_tl, (uintptr_t)event_log_base + event_log_cur_size); 191 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 192 193 /* If there is DT_SPMC_MANIFEST, update event log information. */ 194 te = transfer_list_find(secure_tl, TL_TAG_DT_SPMC_MANIFEST); 195 if (te != NULL) { 196 te = transfer_list_find(secure_tl, TL_TAG_TPM_EVLOG); 197 assert(te != NULL && te->data_size > 0); 198 199 rc = arm_set_tos_fw_info((uintptr_t)transfer_list_entry_data(te), 200 te->data_size); 201 if (rc != 0) { 202 WARN("%s(): Unable to update %s_FW_CONFIG\n", 203 __func__, "TOS"); 204 } 205 206 transfer_list_update_checksum(secure_tl); 207 } 208 #else 209 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 210 /* Copy Event Log to TZC secured DRAM memory */ 211 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE, 212 (const void *)event_log_base, 213 event_log_cur_size); 214 215 /* Ensure that the Event Log is visible in TZC secured DRAM memory */ 216 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size); 217 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 218 219 rc = arm_set_nt_fw_info( 220 #ifdef SPD_opteed 221 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 222 #endif 223 event_log_cur_size, &ns_log_addr); 224 if (rc != 0) { 225 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 226 __func__, "NT"); 227 /* 228 * It is a fatal error because on FVP secure world software 229 * assumes that a valid event log exists and will use it to 230 * record the measurements into the fTPM. 231 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the 232 * secure Event Log buffer address. 233 */ 234 panic(); 235 } 236 237 /* Copy Event Log to Non-secure memory */ 238 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base, 239 event_log_cur_size); 240 241 /* Ensure that the Event Log is visible in Non-secure memory */ 242 flush_dcache_range(ns_log_addr, event_log_cur_size); 243 244 #if defined(SPD_tspd) || defined(SPD_spmd) 245 /* Set Event Log data in TOS_FW_CONFIG */ 246 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 247 event_log_cur_size); 248 if (rc != 0) { 249 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 250 __func__, "TOS"); 251 panic(); 252 } 253 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */ 254 #endif /* TRANSFER_LIST */ 255 256 event_log_dump((uint8_t *)event_log_base, event_log_cur_size); 257 } 258