1 /* 2 * Copyright (c) 2021-2023, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdint.h> 8 9 #include <common/tbbr/tbbr_img_def.h> 10 #include <drivers/measured_boot/event_log/event_log.h> 11 #include <drivers/measured_boot/rss/rss_measured_boot.h> 12 #include <tools_share/tbbr_oid.h> 13 #include <fvp_critical_data.h> 14 15 #include <plat/arm/common/plat_arm.h> 16 #include <plat/common/common_def.h> 17 18 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 19 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \ 20 assert_res_eventlog_mem_insufficient); 21 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 22 23 /* Event Log data */ 24 static uint64_t event_log_base; 25 26 /* FVP table with platform specific image IDs, names and PCRs */ 27 const event_log_metadata_t fvp_event_log_metadata[] = { 28 { BL31_IMAGE_ID, EVLOG_BL31_STRING, PCR_0 }, 29 { BL32_IMAGE_ID, EVLOG_BL32_STRING, PCR_0 }, 30 { BL32_EXTRA1_IMAGE_ID, EVLOG_BL32_EXTRA1_STRING, PCR_0 }, 31 { BL32_EXTRA2_IMAGE_ID, EVLOG_BL32_EXTRA2_STRING, PCR_0 }, 32 { BL33_IMAGE_ID, EVLOG_BL33_STRING, PCR_0 }, 33 { HW_CONFIG_ID, EVLOG_HW_CONFIG_STRING, PCR_0 }, 34 { NT_FW_CONFIG_ID, EVLOG_NT_FW_CONFIG_STRING, PCR_0 }, 35 { SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 }, 36 { SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 }, 37 { TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 }, 38 { RMM_IMAGE_ID, EVLOG_RMM_STRING, PCR_0}, 39 40 #if defined(SPD_spmd) 41 { SP_PKG1_ID, EVLOG_SP1_STRING, PCR_0 }, 42 { SP_PKG2_ID, EVLOG_SP2_STRING, PCR_0 }, 43 { SP_PKG3_ID, EVLOG_SP3_STRING, PCR_0 }, 44 { SP_PKG4_ID, EVLOG_SP4_STRING, PCR_0 }, 45 { SP_PKG5_ID, EVLOG_SP5_STRING, PCR_0 }, 46 { SP_PKG6_ID, EVLOG_SP6_STRING, PCR_0 }, 47 { SP_PKG7_ID, EVLOG_SP7_STRING, PCR_0 }, 48 { SP_PKG8_ID, EVLOG_SP8_STRING, PCR_0 }, 49 #endif 50 51 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 }, 52 53 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 54 }; 55 56 /* FVP table with platform specific image IDs and metadata. Intentionally not a 57 * const struct, some members might set by bootloaders during trusted boot. 58 */ 59 struct rss_mboot_metadata fvp_rss_mboot_metadata[] = { 60 { 61 .id = BL31_IMAGE_ID, 62 .slot = U(9), 63 .signer_id_size = SIGNER_ID_MIN_SIZE, 64 .sw_type = RSS_MBOOT_BL31_STRING, 65 .lock_measurement = true }, 66 { 67 .id = HW_CONFIG_ID, 68 .slot = U(10), 69 .signer_id_size = SIGNER_ID_MIN_SIZE, 70 .sw_type = RSS_MBOOT_HW_CONFIG_STRING, 71 .lock_measurement = true }, 72 { 73 .id = SOC_FW_CONFIG_ID, 74 .slot = U(11), 75 .signer_id_size = SIGNER_ID_MIN_SIZE, 76 .sw_type = RSS_MBOOT_SOC_FW_CONFIG_STRING, 77 .lock_measurement = true }, 78 { 79 .id = RMM_IMAGE_ID, 80 .slot = U(12), 81 .signer_id_size = SIGNER_ID_MIN_SIZE, 82 .sw_type = RSS_MBOOT_RMM_STRING, 83 .lock_measurement = true }, 84 { 85 .id = RSS_MBOOT_INVALID_ID } 86 }; 87 88 void bl2_plat_mboot_init(void) 89 { 90 uint8_t *event_log_start; 91 uint8_t *event_log_finish; 92 size_t bl1_event_log_size; 93 int rc; 94 95 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size); 96 if (rc != 0) { 97 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n", 98 __func__); 99 /* 100 * It is a fatal error because on FVP platform, BL2 software 101 * assumes that a valid Event Log buffer exist and it will use 102 * same Event Log buffer to append image measurements. 103 */ 104 panic(); 105 } 106 107 /* 108 * BL1 and BL2 share the same Event Log buffer and that BL2 will 109 * append its measurements after BL1's 110 */ 111 event_log_start = (uint8_t *)((uintptr_t)event_log_base + 112 bl1_event_log_size); 113 event_log_finish = (uint8_t *)((uintptr_t)event_log_base + 114 PLAT_ARM_EVENT_LOG_MAX_SIZE); 115 116 event_log_init((uint8_t *)event_log_start, event_log_finish); 117 118 rss_measured_boot_init(); 119 } 120 121 int plat_mboot_measure_critical_data(unsigned int critical_data_id, 122 const void *base, size_t size) 123 { 124 /* 125 * It is very unlikely that the critical data size would be 126 * bigger than 2^32 bytes 127 */ 128 assert(size < UINT32_MAX); 129 assert(base != NULL); 130 131 /* Calculate image hash and record data in Event Log */ 132 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size, 133 critical_data_id, 134 fvp_event_log_metadata); 135 if (err != 0) { 136 ERROR("%s%s critical data (%i)\n", 137 "Failed to ", "record", err); 138 return err; 139 } 140 141 return 0; 142 } 143 144 #if TRUSTED_BOARD_BOOT 145 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data) 146 { 147 char *nv_ctr_oids[MAX_NV_CTR_IDS] = { 148 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID, 149 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID, 150 }; 151 152 for (int i = 0; i < MAX_NV_CTR_IDS; i++) { 153 int rc = plat_get_nv_ctr(nv_ctr_oids[i], 154 &critical_data->nv_ctr[i]); 155 if (rc != 0) { 156 return rc; 157 } 158 } 159 160 return 0; 161 } 162 #endif /* TRUSTED_BOARD_BOOT */ 163 164 static int fvp_populate_and_measure_critical_data(void) 165 { 166 int rc = 0; 167 168 /* 169 * FVP platform only measures 'platform NV-counter' and hence its 170 * measurement makes sense during Trusted-Boot flow only. 171 */ 172 #if TRUSTED_BOARD_BOOT 173 struct fvp_critical_data populate_critical_data; 174 175 rc = fvp_populate_critical_data(&populate_critical_data); 176 if (rc == 0) { 177 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID, 178 &populate_critical_data, 179 sizeof(populate_critical_data)); 180 } 181 #endif /* TRUSTED_BOARD_BOOT */ 182 183 return rc; 184 } 185 186 void bl2_plat_mboot_finish(void) 187 { 188 int rc; 189 190 /* Event Log address in Non-Secure memory */ 191 uintptr_t ns_log_addr; 192 193 /* Event Log filled size */ 194 size_t event_log_cur_size; 195 196 rc = fvp_populate_and_measure_critical_data(); 197 if (rc != 0) { 198 panic(); 199 } 200 201 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 202 203 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 204 /* Copy Event Log to TZC secured DRAM memory */ 205 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE, 206 (const void *)event_log_base, 207 event_log_cur_size); 208 209 /* Ensure that the Event Log is visible in TZC secured DRAM memory */ 210 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size); 211 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 212 213 rc = arm_set_nt_fw_info( 214 #ifdef SPD_opteed 215 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 216 #endif 217 event_log_cur_size, &ns_log_addr); 218 if (rc != 0) { 219 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 220 __func__, "NT"); 221 /* 222 * It is a fatal error because on FVP secure world software 223 * assumes that a valid event log exists and will use it to 224 * record the measurements into the fTPM. 225 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the 226 * secure Event Log buffer address. 227 */ 228 panic(); 229 } 230 231 /* Copy Event Log to Non-secure memory */ 232 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base, 233 event_log_cur_size); 234 235 /* Ensure that the Event Log is visible in Non-secure memory */ 236 flush_dcache_range(ns_log_addr, event_log_cur_size); 237 238 #if defined(SPD_tspd) || defined(SPD_spmd) 239 /* Set Event Log data in TOS_FW_CONFIG */ 240 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 241 event_log_cur_size); 242 if (rc != 0) { 243 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 244 __func__, "TOS"); 245 panic(); 246 } 247 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */ 248 249 dump_event_log((uint8_t *)event_log_base, event_log_cur_size); 250 } 251