1 /* 2 * Copyright (c) 2021-2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <stdint.h> 8 9 #include <common/tbbr/tbbr_img_def.h> 10 #if TRANSFER_LIST 11 #include <tpm_event_log.h> 12 #endif 13 #include <drivers/auth/crypto_mod.h> 14 #include <drivers/measured_boot/metadata.h> 15 #include <event_measure.h> 16 #include <event_print.h> 17 #if defined(ARM_COT_cca) 18 #include <tools_share/cca_oid.h> 19 #else 20 #include <tools_share/tbbr_oid.h> 21 #endif /* ARM_COT_cca */ 22 #include <fvp_critical_data.h> 23 24 #include <plat/arm/common/plat_arm.h> 25 #include <plat/common/common_def.h> 26 27 #if !TRANSFER_LIST && (defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)) 28 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \ 29 assert_res_eventlog_mem_insufficient); 30 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 31 32 /* Event Log data */ 33 static uint64_t event_log_base; 34 35 static const struct event_log_hash_info crypto_hash_info = { 36 .func = crypto_mod_calc_hash, 37 .ids = (const uint32_t[]){ CRYPTO_MD_ID }, 38 .count = 1U, 39 }; 40 41 /* FVP table with platform specific image IDs, names and PCRs */ 42 const event_log_metadata_t fvp_event_log_metadata[] = { 43 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 }, 44 { BL32_IMAGE_ID, MBOOT_BL32_IMAGE_STRING, PCR_0 }, 45 { BL32_EXTRA1_IMAGE_ID, MBOOT_BL32_EXTRA1_IMAGE_STRING, PCR_0 }, 46 { BL32_EXTRA2_IMAGE_ID, MBOOT_BL32_EXTRA2_IMAGE_STRING, PCR_0 }, 47 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 }, 48 { HW_CONFIG_ID, MBOOT_HW_CONFIG_STRING, PCR_0 }, 49 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 }, 50 { SCP_BL2_IMAGE_ID, MBOOT_SCP_BL2_IMAGE_STRING, PCR_0 }, 51 { SOC_FW_CONFIG_ID, MBOOT_SOC_FW_CONFIG_STRING, PCR_0 }, 52 { TOS_FW_CONFIG_ID, MBOOT_TOS_FW_CONFIG_STRING, PCR_0 }, 53 { RMM_IMAGE_ID, MBOOT_RMM_IMAGE_STRING, PCR_0}, 54 55 #if defined(SPD_spmd) 56 { SP_PKG1_ID, MBOOT_SP1_STRING, PCR_0 }, 57 { SP_PKG2_ID, MBOOT_SP2_STRING, PCR_0 }, 58 { SP_PKG3_ID, MBOOT_SP3_STRING, PCR_0 }, 59 { SP_PKG4_ID, MBOOT_SP4_STRING, PCR_0 }, 60 { SP_PKG5_ID, MBOOT_SP5_STRING, PCR_0 }, 61 { SP_PKG6_ID, MBOOT_SP6_STRING, PCR_0 }, 62 { SP_PKG7_ID, MBOOT_SP7_STRING, PCR_0 }, 63 { SP_PKG8_ID, MBOOT_SP8_STRING, PCR_0 }, 64 #endif 65 66 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 }, 67 68 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 69 }; 70 71 void bl2_plat_mboot_init(void) 72 { 73 uint8_t *event_log_start; 74 uint8_t *event_log_finish; 75 size_t bl1_event_log_size __unused; 76 size_t event_log_max_size __unused; 77 int rc __unused; 78 79 #if TRANSFER_LIST 80 event_log_start = transfer_list_event_log_extend( 81 secure_tl, PLAT_ARM_EVENT_LOG_MAX_SIZE); 82 event_log_finish = event_log_start + PLAT_ARM_EVENT_LOG_MAX_SIZE; 83 84 event_log_base = (uintptr_t)event_log_start; 85 #else 86 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size, 87 &event_log_max_size); 88 if (rc != 0) { 89 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n", 90 __func__); 91 /* 92 * It is a fatal error because on FVP platform, BL2 software 93 * assumes that a valid Event Log buffer exist and it will use 94 * same Event Log buffer to append image measurements. 95 */ 96 panic(); 97 } 98 99 /* 100 * BL1 and BL2 share the same Event Log buffer and that BL2 will 101 * append its measurements after BL1's 102 */ 103 event_log_start = 104 (uint8_t *)((uintptr_t)event_log_base + bl1_event_log_size); 105 event_log_finish = 106 (uint8_t *)((uintptr_t)event_log_base + event_log_max_size); 107 #endif 108 109 rc = event_log_init_and_reg(event_log_start, event_log_finish, 110 &crypto_hash_info); 111 if (rc < 0) { 112 ERROR("Failed to initialize event log (%d).\n", rc); 113 panic(); 114 } 115 } 116 117 int plat_mboot_measure_critical_data(unsigned int critical_data_id, 118 const void *base, size_t size) 119 { 120 /* 121 * It is very unlikely that the critical data size would be 122 * bigger than 2^32 bytes 123 */ 124 assert(size < UINT32_MAX); 125 assert(base != NULL); 126 127 /* Calculate image hash and record data in Event Log */ 128 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size, 129 critical_data_id, 130 fvp_event_log_metadata); 131 if (err != 0) { 132 ERROR("%s%s critical data (%i)\n", 133 "Failed to ", "record", err); 134 return err; 135 } 136 137 return 0; 138 } 139 140 #if TRUSTED_BOARD_BOOT 141 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data) 142 { 143 char *nv_ctr_oids[MAX_NV_CTR_IDS] = { 144 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID, 145 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID, 146 }; 147 148 for (int i = 0; i < MAX_NV_CTR_IDS; i++) { 149 int rc = plat_get_nv_ctr(nv_ctr_oids[i], 150 &critical_data->nv_ctr[i]); 151 if (rc != 0) { 152 return rc; 153 } 154 } 155 156 return 0; 157 } 158 #endif /* TRUSTED_BOARD_BOOT */ 159 160 static int fvp_populate_and_measure_critical_data(void) 161 { 162 int rc = 0; 163 164 /* 165 * FVP platform only measures 'platform NV-counter' and hence its 166 * measurement makes sense during Trusted-Boot flow only. 167 */ 168 #if TRUSTED_BOARD_BOOT 169 struct fvp_critical_data populate_critical_data; 170 171 rc = fvp_populate_critical_data(&populate_critical_data); 172 if (rc == 0) { 173 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID, 174 &populate_critical_data, 175 sizeof(populate_critical_data)); 176 } 177 #endif /* TRUSTED_BOARD_BOOT */ 178 179 return rc; 180 } 181 182 void bl2_plat_mboot_finish(void) 183 { 184 int rc; 185 186 /* Event Log address in Non-Secure memory */ 187 uintptr_t ns_log_addr __unused; 188 189 /* Event Log filled size */ 190 size_t event_log_cur_size; 191 192 struct transfer_list_entry *te __maybe_unused; 193 194 rc = fvp_populate_and_measure_critical_data(); 195 if (rc != 0) { 196 panic(); 197 } 198 199 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 200 201 #if TRANSFER_LIST 202 /* 203 * Re-size the event log for the next stage and update the size to include 204 * the entire event log (i.e., not just what this stage has added.) 205 */ 206 event_log_base = (uintptr_t)transfer_list_event_log_finish( 207 secure_tl, (uintptr_t)event_log_base + event_log_cur_size); 208 209 /* Ensure changes are visible to the next stage. */ 210 flush_dcache_range((uintptr_t)secure_tl, secure_tl->size); 211 212 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base); 213 214 /* If there is DT_SPMC_MANIFEST, update event log information. */ 215 te = transfer_list_find(secure_tl, TL_TAG_DT_SPMC_MANIFEST); 216 if (te != NULL) { 217 te = transfer_list_find(secure_tl, TL_TAG_TPM_EVLOG); 218 assert(te != NULL && te->data_size > 0); 219 220 rc = arm_set_tos_fw_info((uintptr_t)transfer_list_entry_data(te), 221 te->data_size); 222 if (rc != 0) { 223 WARN("%s(): Unable to update %s_FW_CONFIG\n", 224 __func__, "TOS"); 225 } 226 227 transfer_list_update_checksum(secure_tl); 228 } 229 #else 230 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) 231 /* Copy Event Log to TZC secured DRAM memory */ 232 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE, 233 (const void *)event_log_base, 234 event_log_cur_size); 235 236 /* Ensure that the Event Log is visible in TZC secured DRAM memory */ 237 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size); 238 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */ 239 240 rc = arm_set_nt_fw_info( 241 #ifdef SPD_opteed 242 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 243 #endif 244 event_log_cur_size, &ns_log_addr); 245 if (rc != 0) { 246 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 247 __func__, "NT"); 248 /* 249 * It is a fatal error because on FVP secure world software 250 * assumes that a valid event log exists and will use it to 251 * record the measurements into the fTPM. 252 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the 253 * secure Event Log buffer address. 254 */ 255 panic(); 256 } 257 258 /* Copy Event Log to Non-secure memory */ 259 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base, 260 event_log_cur_size); 261 262 /* Ensure that the Event Log is visible in Non-secure memory */ 263 flush_dcache_range(ns_log_addr, event_log_cur_size); 264 265 #if defined(SPD_tspd) || defined(SPD_spmd) 266 /* Set Event Log data in TOS_FW_CONFIG */ 267 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE, 268 event_log_cur_size); 269 if (rc != 0) { 270 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 271 __func__, "TOS"); 272 panic(); 273 } 274 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */ 275 #endif /* TRANSFER_LIST */ 276 277 event_log_dump((uint8_t *)event_log_base, event_log_cur_size); 278 } 279