1 /* 2 * Copyright (c) 2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stdarg.h> 9 #include <stdint.h> 10 11 #include "./include/rpi3_measured_boot.h" 12 13 #include <drivers/auth/crypto_mod.h> 14 #include <drivers/gpio_spi.h> 15 #include <drivers/measured_boot/event_log/event_log.h> 16 #include <drivers/measured_boot/metadata.h> 17 #include <drivers/tpm/tpm2.h> 18 #include <drivers/tpm/tpm2_chip.h> 19 #include <drivers/tpm/tpm2_slb9670/slb9670_gpio.h> 20 #include <plat/common/common_def.h> 21 #include <plat/common/platform.h> 22 #include <platform_def.h> 23 #include <tools_share/tbbr_oid.h> 24 25 /* RPI3 table with platform specific image IDs, names and PCRs */ 26 const event_log_metadata_t rpi3_event_log_metadata[] = { 27 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 }, 28 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 }, 29 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 }, 30 31 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 32 }; 33 34 #if DISCRETE_TPM 35 extern struct tpm_chip_data tpm_chip_data; 36 #if (TPM_INTERFACE == FIFO_SPI) 37 extern struct gpio_spi_data tpm_rpi3_gpio_data; 38 struct spi_plat *spidev; 39 #endif 40 41 static void rpi3_bl2_tpm_early_interface_setup(void) 42 { 43 #if (TPM_INTERFACE == FIFO_SPI) 44 tpm2_slb9670_gpio_init(&tpm_rpi3_gpio_data); 45 46 spidev = gpio_spi_init(&tpm_rpi3_gpio_data); 47 #endif 48 } 49 #endif 50 51 static uint8_t *event_log_start; 52 static size_t event_log_size; 53 54 void bl2_plat_mboot_init(void) 55 { 56 uint8_t *bl2_event_log_start; 57 uint8_t *bl2_event_log_finish; 58 59 #if DISCRETE_TPM 60 int rc; 61 62 rpi3_bl2_tpm_early_interface_setup(); 63 rc = tpm_interface_init(&tpm_chip_data, 0); 64 if (rc != 0) { 65 ERROR("BL2: TPM interface init failed\n"); 66 panic(); 67 } 68 #endif 69 70 rpi3_mboot_fetch_eventlog_info(&event_log_start, &event_log_size); 71 bl2_event_log_start = event_log_start + event_log_size; 72 bl2_event_log_finish = event_log_start + PLAT_ARM_EVENT_LOG_MAX_SIZE; 73 event_log_init(bl2_event_log_start, bl2_event_log_finish); 74 } 75 76 void bl2_plat_mboot_finish(void) 77 { 78 int rc; 79 80 /* Event Log address in Non-Secure memory */ 81 uintptr_t ns_log_addr; 82 83 /* Event Log filled size */ 84 size_t event_log_cur_size; 85 86 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_start); 87 88 /* write the eventlog addr and size to NT_FW_CONFIG TPM entry */ 89 rc = rpi3_set_nt_fw_info(event_log_cur_size, &ns_log_addr); 90 if (rc != 0) { 91 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 92 __func__, "NT"); 93 /* 94 * fatal error due to Bl33 maintaining the assumption 95 * that the eventlog is successfully passed via 96 * NT_FW_CONFIG. 97 */ 98 panic(); 99 } 100 101 /* Copy Event Log to Non-secure memory */ 102 (void)memcpy((void *)ns_log_addr, (const void *)event_log_start, 103 event_log_cur_size); 104 105 /* Ensure that the Event Log is visible in Non-secure memory */ 106 flush_dcache_range(ns_log_addr, event_log_cur_size); 107 108 /* Dump Event Log for user view */ 109 event_log_dump((uint8_t *)event_log_start, event_log_cur_size); 110 111 #if DISCRETE_TPM 112 /* relinquish control of TPM locality 0 and close interface */ 113 rc = tpm_interface_close(&tpm_chip_data, 0); 114 if (rc != 0) { 115 ERROR("BL2: TPM interface close failed\n"); 116 panic(); 117 } 118 #endif 119 } 120 121 int plat_mboot_measure_image(unsigned int image_id, image_info_t *image_data) 122 { 123 int rc = 0; 124 125 unsigned char hash_data[CRYPTO_MD_MAX_SIZE]; 126 const event_log_metadata_t *metadata_ptr = rpi3_event_log_metadata; 127 128 /* Measure the payload with algorithm selected by EventLog driver */ 129 rc = event_log_measure(image_data->image_base, image_data->image_size, hash_data); 130 if (rc != 0) { 131 return rc; 132 } 133 134 #if DISCRETE_TPM 135 rc = tpm_pcr_extend(&tpm_chip_data, 0, TPM_ALG_ID, hash_data, TCG_DIGEST_SIZE); 136 if (rc != 0) { 137 ERROR("BL2: TPM PCR-0 extend failed\n"); 138 panic(); 139 } 140 #endif 141 142 while ((metadata_ptr->id != EVLOG_INVALID_ID) && 143 (metadata_ptr->id != image_id)) { 144 metadata_ptr++; 145 } 146 assert(metadata_ptr->id != EVLOG_INVALID_ID); 147 148 event_log_record(hash_data, EV_POST_CODE, metadata_ptr); 149 150 return rc; 151 } 152