1 /*
2 * Copyright (c) 2025, Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stdarg.h>
9 #include <stdint.h>
10
11 #include <plat/common/common_def.h>
12 #include <plat/common/platform.h>
13 #include <platform_def.h>
14
15 #include <drivers/auth/crypto_mod.h>
16 #include <drivers/gpio_spi.h>
17 #include <drivers/measured_boot/metadata.h>
18 #include <drivers/tpm/tpm2.h>
19 #include <drivers/tpm/tpm2_chip.h>
20 #include <drivers/tpm/tpm2_slb9670/slb9670_gpio.h>
21 #include <event_measure.h>
22 #include <event_print.h>
23 #include <tools_share/tbbr_oid.h>
24
25 #include "./include/rpi3_measured_boot.h"
26
27 /* RPI3 table with platform specific image IDs, names and PCRs */
28 const event_log_metadata_t rpi3_event_log_metadata[] = {
29 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 },
30 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 },
31 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 },
32
33 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */
34 };
35
36 static const struct event_log_hash_info crypto_hash_info = {
37 .func = crypto_mod_calc_hash,
38 .ids = (const uint32_t[]){ CRYPTO_MD_ID },
39 .count = 1U,
40 };
41
42 #if DISCRETE_TPM
43 extern struct tpm_chip_data tpm_chip_data;
44 #if (TPM_INTERFACE == FIFO_SPI)
45 extern struct gpio_spi_data tpm_rpi3_gpio_data;
46 struct spi_plat *spidev;
47 #endif
48
rpi3_bl2_tpm_early_interface_setup(void)49 static void rpi3_bl2_tpm_early_interface_setup(void)
50 {
51 #if (TPM_INTERFACE == FIFO_SPI)
52 tpm2_slb9670_gpio_init(&tpm_rpi3_gpio_data);
53
54 spidev = gpio_spi_init(&tpm_rpi3_gpio_data);
55 #endif
56 }
57 #endif
58
59 static uint8_t *event_log_start;
60 static size_t event_log_size;
61
bl2_plat_mboot_init(void)62 void bl2_plat_mboot_init(void)
63 {
64 uint8_t *bl2_event_log_start;
65 uint8_t *bl2_event_log_finish;
66 int rc;
67
68 #if DISCRETE_TPM
69 rpi3_bl2_tpm_early_interface_setup();
70 rc = tpm_interface_init(&tpm_chip_data, 0);
71 if (rc != 0) {
72 ERROR("BL2: TPM interface init failed\n");
73 panic();
74 }
75 #endif
76
77 rpi3_mboot_fetch_eventlog_info(&event_log_start, &event_log_size);
78 bl2_event_log_start = event_log_start + event_log_size;
79 bl2_event_log_finish = event_log_start + PLAT_ARM_EVENT_LOG_MAX_SIZE;
80
81 rc = event_log_init_and_reg(bl2_event_log_start, bl2_event_log_finish,
82 &crypto_hash_info);
83 if (rc < 0) {
84 ERROR("Failed to initialize event log (%d).\n", rc);
85 panic();
86 }
87 }
88
bl2_plat_mboot_finish(void)89 void bl2_plat_mboot_finish(void)
90 {
91 int rc;
92
93 /* Event Log address in Non-Secure memory */
94 uintptr_t ns_log_addr;
95
96 /* Event Log filled size */
97 size_t event_log_cur_size;
98
99 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_start);
100
101 /* write the eventlog addr and size to NT_FW_CONFIG TPM entry */
102 rc = rpi3_set_nt_fw_info(event_log_cur_size, &ns_log_addr);
103 if (rc != 0) {
104 ERROR("%s(): Unable to update %s_FW_CONFIG\n",
105 __func__, "NT");
106 /*
107 * fatal error due to Bl33 maintaining the assumption
108 * that the eventlog is successfully passed via
109 * NT_FW_CONFIG.
110 */
111 panic();
112 }
113
114 /* Copy Event Log to Non-secure memory */
115 (void)memcpy((void *)ns_log_addr, (const void *)event_log_start,
116 event_log_cur_size);
117
118 /* Ensure that the Event Log is visible in Non-secure memory */
119 flush_dcache_range(ns_log_addr, event_log_cur_size);
120
121 /* Dump Event Log for user view */
122 event_log_dump((uint8_t *)event_log_start, event_log_cur_size);
123
124 #if DISCRETE_TPM
125 /* relinquish control of TPM locality 0 and close interface */
126 rc = tpm_interface_close(&tpm_chip_data, 0);
127 if (rc != 0) {
128 ERROR("BL2: TPM interface close failed\n");
129 panic();
130 }
131 #endif
132 }
133
plat_mboot_measure_image(unsigned int image_id,image_info_t * image_data)134 int plat_mboot_measure_image(unsigned int image_id, image_info_t *image_data)
135 {
136 int rc = 0;
137
138 unsigned char hash_data[CRYPTO_MD_MAX_SIZE];
139 const event_log_metadata_t *metadata_ptr = rpi3_event_log_metadata;
140
141 /* Measure the payload with algorithm selected by EventLog driver */
142 rc = event_log_measure(image_data->image_base, image_data->image_size, hash_data);
143 if (rc != 0) {
144 return rc;
145 }
146
147 #if DISCRETE_TPM
148 rc = tpm_pcr_extend(&tpm_chip_data, 0, TPM_ALG_ID, hash_data, TCG_DIGEST_SIZE);
149 if (rc != 0) {
150 ERROR("BL2: TPM PCR-0 extend failed\n");
151 panic();
152 }
153 #endif
154
155 while ((metadata_ptr->id != EVLOG_INVALID_ID) &&
156 (metadata_ptr->id != image_id)) {
157 metadata_ptr++;
158 }
159 assert(metadata_ptr->id != EVLOG_INVALID_ID);
160
161 event_log_record(hash_data, EV_POST_CODE, metadata_ptr);
162
163 return rc;
164 }
165