blob: 30473be319e5d16f2f1541ed0ab8dc24d82a5f78 [file] [log] [blame]
Soby Mathew7c6df5b2018-01-15 14:43:42 +00001/*
Achin Guptada6ef0e2019-10-11 14:54:48 +01002 * Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
Soby Mathew7c6df5b2018-01-15 14:43:42 +00003 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7#include <assert.h>
Antonio Nino Diaze0f90632018-12-14 00:18:21 +00008#include <string.h>
Louis Mayencourt73d42d72019-12-09 11:29:38 +00009#include <libfdt.h>
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000010
11#include <platform_def.h>
12
13#include <common/debug.h>
14#include <common/desc_image_load.h>
15#include <common/tbbr/tbbr_img_def.h>
John Tsichritzisc34341a2018-07-30 13:41:52 +010016#if TRUSTED_BOARD_BOOT
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000017#include <drivers/auth/mbedtls/mbedtls_config.h>
Alexei Fedorov25d7c882020-03-20 18:38:55 +000018#if MEASURED_BOOT
19#include <drivers/auth/crypto_mod.h>
20#include <mbedtls/md.h>
21#endif
John Tsichritzisc34341a2018-07-30 13:41:52 +010022#endif
Louis Mayencourt6d2b5732019-12-17 13:17:25 +000023#include <lib/fconf/fconf.h>
24#include <lib/fconf/fconf_dyn_cfg_getter.h>
Louis Mayencourt5b9055f2019-10-01 10:45:14 +010025#include <lib/fconf/fconf_tbbr_getter.h>
Alexei Fedorovc7176172020-07-13 12:11:05 +010026
Antonio Nino Diazbd7b7402019-01-25 14:30:04 +000027#include <plat/arm/common/arm_dyn_cfg_helpers.h>
28#include <plat/arm/common/plat_arm.h>
Soby Mathew7c6df5b2018-01-15 14:43:42 +000029
John Tsichritzisc34341a2018-07-30 13:41:52 +010030#if TRUSTED_BOARD_BOOT
31
32static void *mbedtls_heap_addr;
33static size_t mbedtls_heap_size;
34
35/*
36 * This function is the implementation of the shared Mbed TLS heap between
37 * BL1 and BL2 for Arm platforms. The shared heap address is passed from BL1
38 * to BL2 with a pointer. This pointer resides inside the TB_FW_CONFIG file
39 * which is a DTB.
40 *
41 * This function is placed inside an #if directive for the below reasons:
42 * - To allocate space for the Mbed TLS heap --only if-- Trusted Board Boot
43 * is enabled.
44 * - This implementation requires the DTB to be present so that BL1 has a
Antonio Nino Diaz05f49572018-09-25 11:37:23 +010045 * mechanism to pass the pointer to BL2.
John Tsichritzisc34341a2018-07-30 13:41:52 +010046 */
47int arm_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
48{
49 assert(heap_addr != NULL);
50 assert(heap_size != NULL);
51
52#if defined(IMAGE_BL1) || BL2_AT_EL3
53
54 /* If in BL1 or BL2_AT_EL3 define a heap */
55 static unsigned char heap[TF_MBEDTLS_HEAP_SIZE];
56
57 *heap_addr = heap;
58 *heap_size = sizeof(heap);
59 mbedtls_heap_addr = heap;
60 mbedtls_heap_size = sizeof(heap);
61
62#elif defined(IMAGE_BL2)
63
John Tsichritzisc34341a2018-07-30 13:41:52 +010064 /* If in BL2, retrieve the already allocated heap's info from DTB */
Louis Mayencourt5b9055f2019-10-01 10:45:14 +010065 *heap_addr = FCONF_GET_PROPERTY(tbbr, dyn_config, mbedtls_heap_addr);
66 *heap_size = FCONF_GET_PROPERTY(tbbr, dyn_config, mbedtls_heap_size);
67
John Tsichritzisc34341a2018-07-30 13:41:52 +010068#endif
69
70 return 0;
71}
72
73/*
74 * Puts the shared Mbed TLS heap information to the DTB.
75 * Executed only from BL1.
76 */
77void arm_bl1_set_mbedtls_heap(void)
78{
79 int err;
Louis Mayencourt6d2b5732019-12-17 13:17:25 +000080 uintptr_t tb_fw_cfg_dtb;
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +010081 const struct dyn_cfg_dtb_info_t *tb_fw_config_info;
John Tsichritzisc34341a2018-07-30 13:41:52 +010082
83 /*
84 * If tb_fw_cfg_dtb==NULL then DTB is not present for the current
85 * platform. As such, we don't attempt to write to the DTB at all.
86 *
87 * If mbedtls_heap_addr==NULL, then it means we are using the default
88 * heap implementation. As such, BL2 will have its own heap for sure
89 * and hence there is no need to pass any information to the DTB.
90 *
91 * In the latter case, if we still wanted to write in the DTB the heap
92 * information, we would need to call plat_get_mbedtls_heap to retrieve
93 * the default heap's address and size.
94 */
Louis Mayencourt6d2b5732019-12-17 13:17:25 +000095
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +010096 tb_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID);
Manish V Badarkhe9cb29f02020-06-29 07:17:24 +010097 assert(tb_fw_config_info != NULL);
98
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +010099 tb_fw_cfg_dtb = tb_fw_config_info->config_addr;
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000100
101 if ((tb_fw_cfg_dtb != 0UL) && (mbedtls_heap_addr != NULL)) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100102 /* As libfdt uses void *, we can't avoid this cast */
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000103 void *dtb = (void *)tb_fw_cfg_dtb;
104
105 err = arm_set_dtb_mbedtls_heap_info(dtb,
John Tsichritzisc34341a2018-07-30 13:41:52 +0100106 mbedtls_heap_addr, mbedtls_heap_size);
107 if (err < 0) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100108 ERROR("%swrite shared Mbed TLS heap information%s",
109 "BL1: unable to ", " to DTB\n");
John Tsichritzisc34341a2018-07-30 13:41:52 +0100110 panic();
111 }
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000112#if !MEASURED_BOOT
John Tsichritzis03459c22018-09-07 10:52:12 +0100113 /*
114 * Ensure that the info written to the DTB is visible to other
115 * images. It's critical because BL2 won't be able to proceed
116 * without the heap info.
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000117 *
118 * In MEASURED_BOOT case flushing is done in
119 * arm_bl1_set_bl2_hash() function which is called after heap
120 * information is written in the DTB.
John Tsichritzis03459c22018-09-07 10:52:12 +0100121 */
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000122 flush_dcache_range(tb_fw_cfg_dtb, fdt_totalsize(dtb));
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000123#endif /* !MEASURED_BOOT */
John Tsichritzisc34341a2018-07-30 13:41:52 +0100124 }
125}
126
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000127#if MEASURED_BOOT
128/*
Alexei Fedorovc7176172020-07-13 12:11:05 +0100129 * Calculates and writes BL2 hash data to TB_FW_CONFIG DTB.
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000130 * Executed only from BL1.
131 */
Alexei Fedorovc7176172020-07-13 12:11:05 +0100132void arm_bl1_set_bl2_hash(const image_desc_t *image_desc)
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000133{
134 unsigned char hash_data[MBEDTLS_MD_MAX_SIZE];
Alexei Fedorovc7176172020-07-13 12:11:05 +0100135 const image_info_t image_info = image_desc->image_info;
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000136 uintptr_t tb_fw_cfg_dtb;
137 int err;
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +0100138 const struct dyn_cfg_dtb_info_t *tb_fw_config_info;
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000139
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +0100140 tb_fw_config_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TB_FW_CONFIG_ID);
Manish V Badarkhe9cb29f02020-06-29 07:17:24 +0100141 assert(tb_fw_config_info != NULL);
142
Manish V Badarkhe8c66f7a2020-06-11 22:09:10 +0100143 tb_fw_cfg_dtb = tb_fw_config_info->config_addr;
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000144
145 /*
146 * If tb_fw_cfg_dtb==NULL then DTB is not present for the current
147 * platform. As such, we cannot write to the DTB at all and pass
148 * measured data.
149 */
150 if (tb_fw_cfg_dtb == 0UL) {
151 panic();
152 }
153
154 /* Calculate hash */
155 err = crypto_mod_calc_hash(MBEDTLS_MD_ID,
156 (void *)image_info.image_base,
157 image_info.image_size, hash_data);
158 if (err != 0) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100159 ERROR("%scalculate%s\n", "BL1: unable to ",
160 " BL2 hash");
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000161 panic();
162 }
163
164 err = arm_set_bl2_hash_info((void *)tb_fw_cfg_dtb, hash_data);
165 if (err < 0) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100166 ERROR("%swrite%sdata%s\n", "BL1: unable to ",
167 " BL2 hash ", "to DTB\n");
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000168 panic();
169 }
170
171 /*
172 * Ensure that the info written to the DTB is visible to other
173 * images. It's critical because BL2 won't be able to proceed
174 * without the heap info and its hash data.
175 */
176 flush_dcache_range(tb_fw_cfg_dtb, fdt_totalsize((void *)tb_fw_cfg_dtb));
177}
Alexei Fedorovc7176172020-07-13 12:11:05 +0100178
179/*
180 * Reads TCG_DIGEST_SIZE bytes of BL2 hash data from the DTB.
181 * Executed only from BL2.
182 */
183void arm_bl2_get_hash(void *data)
184{
185 const void *bl2_hash;
186
187 assert(data != NULL);
188
189 /* Retrieve TCG_DIGEST_SIZE bytes of BL2 hash data from the DTB */
190 bl2_hash = FCONF_GET_PROPERTY(tbbr, dyn_config, bl2_hash_data);
191 (void)memcpy(data, bl2_hash, TCG_DIGEST_SIZE);
192}
Alexei Fedorov25d7c882020-03-20 18:38:55 +0000193#endif /* MEASURED_BOOT */
John Tsichritzisc34341a2018-07-30 13:41:52 +0100194#endif /* TRUSTED_BOARD_BOOT */
195
Soby Mathew7c6df5b2018-01-15 14:43:42 +0000196/*
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000197 * BL2 utility function to initialize dynamic configuration specified by
Manish V Badarkhe1da211a2020-05-31 10:17:59 +0100198 * FW_CONFIG. Populate the bl_mem_params_node_t of other FW_CONFIGs if
199 * specified in FW_CONFIG.
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000200 */
201void arm_bl2_dyn_cfg_init(void)
202{
Soby Mathewb6814842018-04-04 09:40:32 +0100203 unsigned int i;
204 bl_mem_params_node_t *cfg_mem_params = NULL;
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000205 uintptr_t image_base;
Manish V Badarkhea8be3bb2020-07-15 04:27:57 +0100206 uint32_t image_size;
Soby Mathewb6814842018-04-04 09:40:32 +0100207 const unsigned int config_ids[] = {
208 HW_CONFIG_ID,
209 SOC_FW_CONFIG_ID,
210 NT_FW_CONFIG_ID,
Soby Mathewb6814842018-04-04 09:40:32 +0100211 TOS_FW_CONFIG_ID
Soby Mathewb6814842018-04-04 09:40:32 +0100212 };
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000213
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000214 const struct dyn_cfg_dtb_info_t *dtb_info;
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000215
Soby Mathewb6814842018-04-04 09:40:32 +0100216 /* Iterate through all the fw config IDs */
217 for (i = 0; i < ARRAY_SIZE(config_ids); i++) {
218 /* Get the config load address and size from TB_FW_CONFIG */
219 cfg_mem_params = get_bl_mem_params_node(config_ids[i]);
220 if (cfg_mem_params == NULL) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100221 VERBOSE("%sHW_CONFIG in bl_mem_params_node\n",
222 "Couldn't find ");
Soby Mathewb6814842018-04-04 09:40:32 +0100223 continue;
224 }
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000225
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000226 dtb_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, config_ids[i]);
227 if (dtb_info == NULL) {
Alexei Fedorovc7176172020-07-13 12:11:05 +0100228 VERBOSE("%sconfig_id %d load info in TB_FW_CONFIG\n",
229 "Couldn't find ", config_ids[i]);
Soby Mathewb6814842018-04-04 09:40:32 +0100230 continue;
231 }
232
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000233 image_base = dtb_info->config_addr;
234 image_size = dtb_info->config_max_size;
235
Soby Mathewb6814842018-04-04 09:40:32 +0100236 /*
237 * Do some runtime checks on the load addresses of soc_fw_config,
238 * tos_fw_config, nt_fw_config. This is not a comprehensive check
239 * of all invalid addresses but to prevent trivial porting errors.
240 */
241 if (config_ids[i] != HW_CONFIG_ID) {
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000242
Alexei Fedorovc7176172020-07-13 12:11:05 +0100243 if (check_uptr_overflow(image_base, image_size)) {
Soby Mathewb6814842018-04-04 09:40:32 +0100244 continue;
Alexei Fedorovc7176172020-07-13 12:11:05 +0100245 }
Usama Arife97998f2018-11-30 15:43:56 +0000246#ifdef BL31_BASE
Soby Mathewaf14b462018-06-01 16:53:38 +0100247 /* Ensure the configs don't overlap with BL31 */
Alexei Fedorov91e20c82019-12-19 11:59:31 +0000248 if ((image_base >= BL31_BASE) &&
Alexei Fedorovc7176172020-07-13 12:11:05 +0100249 (image_base <= BL31_LIMIT)) {
Soby Mathewb6814842018-04-04 09:40:32 +0100250 continue;
Alexei Fedorovc7176172020-07-13 12:11:05 +0100251 }
Usama Arife97998f2018-11-30 15:43:56 +0000252#endif
Soby Mathewb6814842018-04-04 09:40:32 +0100253 /* Ensure the configs are loaded in a valid address */
Alexei Fedorovc7176172020-07-13 12:11:05 +0100254 if (image_base < ARM_BL_RAM_BASE) {
Soby Mathewb6814842018-04-04 09:40:32 +0100255 continue;
Alexei Fedorovc7176172020-07-13 12:11:05 +0100256 }
Soby Mathewb6814842018-04-04 09:40:32 +0100257#ifdef BL32_BASE
258 /*
259 * If BL32 is present, ensure that the configs don't
260 * overlap with it.
261 */
Alexei Fedorov91e20c82019-12-19 11:59:31 +0000262 if ((image_base >= BL32_BASE) &&
Alexei Fedorovc7176172020-07-13 12:11:05 +0100263 (image_base <= BL32_LIMIT)) {
Soby Mathewb6814842018-04-04 09:40:32 +0100264 continue;
Alexei Fedorovc7176172020-07-13 12:11:05 +0100265 }
Soby Mathewb6814842018-04-04 09:40:32 +0100266#endif
267 }
268
Louis Mayencourt6d2b5732019-12-17 13:17:25 +0000269 cfg_mem_params->image_info.image_base = image_base;
270 cfg_mem_params->image_info.image_max_size = (uint32_t)image_size;
Soby Mathewb6814842018-04-04 09:40:32 +0100271
Alexei Fedorov91e20c82019-12-19 11:59:31 +0000272 /*
273 * Remove the IMAGE_ATTRIB_SKIP_LOADING attribute from
274 * HW_CONFIG or FW_CONFIG nodes
275 */
Soby Mathewb6814842018-04-04 09:40:32 +0100276 cfg_mem_params->image_info.h.attr &= ~IMAGE_ATTRIB_SKIP_LOADING;
277 }
Soby Mathew96a1c6b2018-01-15 14:45:33 +0000278}