1 /*
2 * Copyright (c) 2021-2023, Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <stdint.h>
8
9 #include <common/tbbr/tbbr_img_def.h>
10 #include <drivers/measured_boot/event_log/event_log.h>
11 #include <drivers/measured_boot/rss/rss_measured_boot.h>
12 #if defined(ARM_COT_cca)
13 #include <tools_share/cca_oid.h>
14 #else
15 #include <tools_share/tbbr_oid.h>
16 #endif /* ARM_COT_cca */
17 #include <fvp_critical_data.h>
18
19 #include <plat/arm/common/plat_arm.h>
20 #include <plat/common/common_def.h>
21
22 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)
23 CASSERT(ARM_EVENT_LOG_DRAM1_SIZE >= PLAT_ARM_EVENT_LOG_MAX_SIZE, \
24 assert_res_eventlog_mem_insufficient);
25 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */
26
27 /* Event Log data */
28 static uint64_t event_log_base;
29
30 /* FVP table with platform specific image IDs, names and PCRs */
31 const event_log_metadata_t fvp_event_log_metadata[] = {
32 { BL31_IMAGE_ID, EVLOG_BL31_STRING, PCR_0 },
33 { BL32_IMAGE_ID, EVLOG_BL32_STRING, PCR_0 },
34 { BL32_EXTRA1_IMAGE_ID, EVLOG_BL32_EXTRA1_STRING, PCR_0 },
35 { BL32_EXTRA2_IMAGE_ID, EVLOG_BL32_EXTRA2_STRING, PCR_0 },
36 { BL33_IMAGE_ID, EVLOG_BL33_STRING, PCR_0 },
37 { HW_CONFIG_ID, EVLOG_HW_CONFIG_STRING, PCR_0 },
38 { NT_FW_CONFIG_ID, EVLOG_NT_FW_CONFIG_STRING, PCR_0 },
39 { SCP_BL2_IMAGE_ID, EVLOG_SCP_BL2_STRING, PCR_0 },
40 { SOC_FW_CONFIG_ID, EVLOG_SOC_FW_CONFIG_STRING, PCR_0 },
41 { TOS_FW_CONFIG_ID, EVLOG_TOS_FW_CONFIG_STRING, PCR_0 },
42 { RMM_IMAGE_ID, EVLOG_RMM_STRING, PCR_0},
43
44 #if defined(SPD_spmd)
45 { SP_PKG1_ID, EVLOG_SP1_STRING, PCR_0 },
46 { SP_PKG2_ID, EVLOG_SP2_STRING, PCR_0 },
47 { SP_PKG3_ID, EVLOG_SP3_STRING, PCR_0 },
48 { SP_PKG4_ID, EVLOG_SP4_STRING, PCR_0 },
49 { SP_PKG5_ID, EVLOG_SP5_STRING, PCR_0 },
50 { SP_PKG6_ID, EVLOG_SP6_STRING, PCR_0 },
51 { SP_PKG7_ID, EVLOG_SP7_STRING, PCR_0 },
52 { SP_PKG8_ID, EVLOG_SP8_STRING, PCR_0 },
53 #endif
54
55 { CRITICAL_DATA_ID, EVLOG_CRITICAL_DATA_STRING, PCR_1 },
56
57 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */
58 };
59
60 /* FVP table with platform specific image IDs and metadata. Intentionally not a
61 * const struct, some members might set by bootloaders during trusted boot.
62 */
63 struct rss_mboot_metadata fvp_rss_mboot_metadata[] = {
64 {
65 .id = BL31_IMAGE_ID,
66 .slot = U(9),
67 .signer_id_size = SIGNER_ID_MIN_SIZE,
68 .sw_type = RSS_MBOOT_BL31_STRING,
69 .pk_oid = BL31_IMAGE_KEY_OID,
70 .lock_measurement = true },
71 {
72 .id = HW_CONFIG_ID,
73 .slot = U(10),
74 .signer_id_size = SIGNER_ID_MIN_SIZE,
75 .sw_type = RSS_MBOOT_HW_CONFIG_STRING,
76 .pk_oid = HW_CONFIG_KEY_OID,
77 .lock_measurement = true },
78 {
79 .id = SOC_FW_CONFIG_ID,
80 .slot = U(11),
81 .signer_id_size = SIGNER_ID_MIN_SIZE,
82 .sw_type = RSS_MBOOT_SOC_FW_CONFIG_STRING,
83 .pk_oid = SOC_FW_CONFIG_KEY_OID,
84 .lock_measurement = true },
85 #if ENABLE_RME
86 {
87 .id = RMM_IMAGE_ID,
88 .slot = U(12),
89 .signer_id_size = SIGNER_ID_MIN_SIZE,
90 .sw_type = RSS_MBOOT_RMM_STRING,
91 .pk_oid = RMM_IMAGE_KEY_OID,
92 .lock_measurement = true },
93 #endif /* ENABLE_RME */
94 {
95 .id = RSS_MBOOT_INVALID_ID }
96 };
97
bl2_plat_mboot_init(void)98 void bl2_plat_mboot_init(void)
99 {
100 uint8_t *event_log_start;
101 uint8_t *event_log_finish;
102 size_t bl1_event_log_size;
103 size_t event_log_max_size;
104 int rc;
105
106 rc = arm_get_tb_fw_info(&event_log_base, &bl1_event_log_size,
107 &event_log_max_size);
108 if (rc != 0) {
109 ERROR("%s(): Unable to get Event Log info from TB_FW_CONFIG\n",
110 __func__);
111 /*
112 * It is a fatal error because on FVP platform, BL2 software
113 * assumes that a valid Event Log buffer exist and it will use
114 * same Event Log buffer to append image measurements.
115 */
116 panic();
117 }
118
119 /*
120 * BL1 and BL2 share the same Event Log buffer and that BL2 will
121 * append its measurements after BL1's
122 */
123 event_log_start = (uint8_t *)((uintptr_t)event_log_base +
124 bl1_event_log_size);
125 event_log_finish = (uint8_t *)((uintptr_t)event_log_base +
126 event_log_max_size);
127
128 event_log_init((uint8_t *)event_log_start, event_log_finish);
129
130 rss_measured_boot_init(fvp_rss_mboot_metadata);
131 }
132
plat_mboot_measure_critical_data(unsigned int critical_data_id,const void * base,size_t size)133 int plat_mboot_measure_critical_data(unsigned int critical_data_id,
134 const void *base, size_t size)
135 {
136 /*
137 * It is very unlikely that the critical data size would be
138 * bigger than 2^32 bytes
139 */
140 assert(size < UINT32_MAX);
141 assert(base != NULL);
142
143 /* Calculate image hash and record data in Event Log */
144 int err = event_log_measure_and_record((uintptr_t)base, (uint32_t)size,
145 critical_data_id,
146 fvp_event_log_metadata);
147 if (err != 0) {
148 ERROR("%s%s critical data (%i)\n",
149 "Failed to ", "record", err);
150 return err;
151 }
152
153 return 0;
154 }
155
156 #if TRUSTED_BOARD_BOOT
fvp_populate_critical_data(struct fvp_critical_data * critical_data)157 static int fvp_populate_critical_data(struct fvp_critical_data *critical_data)
158 {
159 char *nv_ctr_oids[MAX_NV_CTR_IDS] = {
160 [TRUSTED_NV_CTR_ID] = TRUSTED_FW_NVCOUNTER_OID,
161 [NON_TRUSTED_NV_CTR_ID] = NON_TRUSTED_FW_NVCOUNTER_OID,
162 };
163
164 for (int i = 0; i < MAX_NV_CTR_IDS; i++) {
165 int rc = plat_get_nv_ctr(nv_ctr_oids[i],
166 &critical_data->nv_ctr[i]);
167 if (rc != 0) {
168 return rc;
169 }
170 }
171
172 return 0;
173 }
174 #endif /* TRUSTED_BOARD_BOOT */
175
fvp_populate_and_measure_critical_data(void)176 static int fvp_populate_and_measure_critical_data(void)
177 {
178 int rc = 0;
179
180 /*
181 * FVP platform only measures 'platform NV-counter' and hence its
182 * measurement makes sense during Trusted-Boot flow only.
183 */
184 #if TRUSTED_BOARD_BOOT
185 struct fvp_critical_data populate_critical_data;
186
187 rc = fvp_populate_critical_data(&populate_critical_data);
188 if (rc == 0) {
189 rc = plat_mboot_measure_critical_data(CRITICAL_DATA_ID,
190 &populate_critical_data,
191 sizeof(populate_critical_data));
192 }
193 #endif /* TRUSTED_BOARD_BOOT */
194
195 return rc;
196 }
197
bl2_plat_mboot_finish(void)198 void bl2_plat_mboot_finish(void)
199 {
200 int rc;
201
202 /* Event Log address in Non-Secure memory */
203 uintptr_t ns_log_addr;
204
205 /* Event Log filled size */
206 size_t event_log_cur_size;
207
208 rc = fvp_populate_and_measure_critical_data();
209 if (rc != 0) {
210 panic();
211 }
212
213 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_base);
214
215 #if defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd)
216 /* Copy Event Log to TZC secured DRAM memory */
217 (void)memcpy((void *)ARM_EVENT_LOG_DRAM1_BASE,
218 (const void *)event_log_base,
219 event_log_cur_size);
220
221 /* Ensure that the Event Log is visible in TZC secured DRAM memory */
222 flush_dcache_range(ARM_EVENT_LOG_DRAM1_BASE, event_log_cur_size);
223 #endif /* defined(SPD_tspd) || defined(SPD_opteed) || defined(SPD_spmd) */
224
225 rc = arm_set_nt_fw_info(
226 #ifdef SPD_opteed
227 (uintptr_t)ARM_EVENT_LOG_DRAM1_BASE,
228 #endif
229 event_log_cur_size, &ns_log_addr);
230 if (rc != 0) {
231 ERROR("%s(): Unable to update %s_FW_CONFIG\n",
232 __func__, "NT");
233 /*
234 * It is a fatal error because on FVP secure world software
235 * assumes that a valid event log exists and will use it to
236 * record the measurements into the fTPM.
237 * Note: In FVP platform, OP-TEE uses nt_fw_config to get the
238 * secure Event Log buffer address.
239 */
240 panic();
241 }
242
243 /* Copy Event Log to Non-secure memory */
244 (void)memcpy((void *)ns_log_addr, (const void *)event_log_base,
245 event_log_cur_size);
246
247 /* Ensure that the Event Log is visible in Non-secure memory */
248 flush_dcache_range(ns_log_addr, event_log_cur_size);
249
250 #if defined(SPD_tspd) || defined(SPD_spmd)
251 /* Set Event Log data in TOS_FW_CONFIG */
252 rc = arm_set_tos_fw_info((uintptr_t)ARM_EVENT_LOG_DRAM1_BASE,
253 event_log_cur_size);
254 if (rc != 0) {
255 ERROR("%s(): Unable to update %s_FW_CONFIG\n",
256 __func__, "TOS");
257 panic();
258 }
259 #endif /* defined(SPD_tspd) || defined(SPD_spmd) */
260
261 dump_event_log((uint8_t *)event_log_base, event_log_cur_size);
262 }
263
