1 /* 2 * Copyright (c) 2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stdarg.h> 9 #include <stdint.h> 10 11 #include <plat/common/common_def.h> 12 #include <plat/common/platform.h> 13 #include <platform_def.h> 14 15 #include <tpm2.h> 16 #include <tpm2_chip.h> 17 18 #include <drivers/auth/crypto_mod.h> 19 #include <drivers/delay_timer.h> 20 #include <drivers/gpio_spi.h> 21 #include <drivers/measured_boot/metadata.h> 22 #include <drivers/tpm/tpm2_slb9670/slb9670_gpio.h> 23 #include <event_measure.h> 24 #include <event_print.h> 25 #include <tools_share/tbbr_oid.h> 26 27 #include "./include/rpi3_measured_boot.h" 28 29 /* RPI3 table with platform specific image IDs, names and PCRs */ 30 const event_log_metadata_t rpi3_event_log_metadata[] = { 31 { BL31_IMAGE_ID, MBOOT_BL31_IMAGE_STRING, PCR_0 }, 32 { BL33_IMAGE_ID, MBOOT_BL33_IMAGE_STRING, PCR_0 }, 33 { NT_FW_CONFIG_ID, MBOOT_NT_FW_CONFIG_STRING, PCR_0 }, 34 35 { EVLOG_INVALID_ID, NULL, (unsigned int)(-1) } /* Terminator */ 36 }; 37 38 static const struct event_log_hash_info crypto_hash_info = { 39 .func = crypto_mod_calc_hash, 40 .ids = (const uint32_t[]){ CRYPTO_MD_ID }, 41 .count = 1U, 42 }; 43 44 #if DISCRETE_TPM 45 extern struct tpm_chip_data tpm_chip_data; 46 47 static void rpi3_bl2_tpm_early_interface_setup(void) 48 { 49 #if TPM_INTERFACE_FIFO_SPI 50 struct spi_plat *spidev; 51 const struct tpm_timeout_ops timeout_ops = { 52 .timeout_init_us = timeout_init_us, 53 .timeout_elapsed = timeout_elapsed 54 }; 55 56 const struct gpio_spi_config *tpm_rpi3_gpio_data = 57 tpm2_slb9670_get_config(); 58 int rc; 59 60 tpm2_slb9670_gpio_init(tpm_rpi3_gpio_data); 61 62 spidev = gpio_spi_init(tpm_rpi3_gpio_data); 63 64 rc = tpm_interface_init(spidev, &timeout_ops, &tpm_chip_data, 0); 65 if (rc != 0) { 66 ERROR("BL2: TPM interface init failed\n"); 67 panic(); 68 } 69 70 #endif 71 } 72 #endif 73 74 static uint8_t *event_log_start; 75 static size_t event_log_size; 76 77 void bl2_plat_mboot_init(void) 78 { 79 uint8_t *bl2_event_log_start; 80 uint8_t *bl2_event_log_finish; 81 int rc; 82 #if DISCRETE_TPM 83 rpi3_bl2_tpm_early_interface_setup(); 84 #endif 85 86 rpi3_mboot_fetch_eventlog_info(&event_log_start, &event_log_size); 87 bl2_event_log_start = event_log_start + event_log_size; 88 bl2_event_log_finish = event_log_start + PLAT_ARM_EVENT_LOG_MAX_SIZE; 89 90 rc = event_log_init_and_reg(bl2_event_log_start, bl2_event_log_finish, 91 &crypto_hash_info); 92 if (rc < 0) { 93 ERROR("Failed to initialize event log (%d).\n", rc); 94 panic(); 95 } 96 } 97 98 void bl2_plat_mboot_finish(void) 99 { 100 int rc; 101 102 /* Event Log address in Non-Secure memory */ 103 uintptr_t ns_log_addr; 104 105 /* Event Log filled size */ 106 size_t event_log_cur_size; 107 108 event_log_cur_size = event_log_get_cur_size((uint8_t *)event_log_start); 109 110 /* write the eventlog addr and size to NT_FW_CONFIG TPM entry */ 111 rc = rpi3_set_nt_fw_info(event_log_cur_size, &ns_log_addr); 112 if (rc != 0) { 113 ERROR("%s(): Unable to update %s_FW_CONFIG\n", 114 __func__, "NT"); 115 /* 116 * fatal error due to Bl33 maintaining the assumption 117 * that the eventlog is successfully passed via 118 * NT_FW_CONFIG. 119 */ 120 panic(); 121 } 122 123 /* Copy Event Log to Non-secure memory */ 124 (void)memcpy((void *)ns_log_addr, (const void *)event_log_start, 125 event_log_cur_size); 126 127 /* Ensure that the Event Log is visible in Non-secure memory */ 128 flush_dcache_range(ns_log_addr, event_log_cur_size); 129 130 /* Dump Event Log for user view */ 131 event_log_dump((uint8_t *)event_log_start, event_log_cur_size); 132 133 #if DISCRETE_TPM 134 /* relinquish control of TPM locality 0 and close interface */ 135 rc = tpm_interface_close(&tpm_chip_data, 0); 136 if (rc != 0) { 137 ERROR("BL2: TPM interface close failed\n"); 138 panic(); 139 } 140 #endif 141 } 142 143 int plat_mboot_measure_image(unsigned int image_id, image_info_t *image_data) 144 { 145 int rc = 0; 146 147 unsigned char hash_data[CRYPTO_MD_MAX_SIZE]; 148 const event_log_metadata_t *metadata_ptr = rpi3_event_log_metadata; 149 150 /* Measure the payload with algorithm selected by EventLog driver */ 151 rc = event_log_measure(image_data->image_base, image_data->image_size, hash_data); 152 if (rc != 0) { 153 return rc; 154 } 155 156 #if DISCRETE_TPM 157 rc = tpm_pcr_extend(&tpm_chip_data, 0, TPM_ALG_ID, hash_data, TCG_DIGEST_SIZE); 158 if (rc != 0) { 159 ERROR("BL2: TPM PCR-0 extend failed\n"); 160 panic(); 161 } 162 #endif 163 164 while ((metadata_ptr->id != EVLOG_INVALID_ID) && 165 (metadata_ptr->id != image_id)) { 166 metadata_ptr++; 167 } 168 assert(metadata_ptr->id != EVLOG_INVALID_ID); 169 170 event_log_record(hash_data, EV_POST_CODE, metadata_ptr); 171 172 return rc; 173 } 174