@@ -45,6 +45,9 @@ UCODE0_BIN=src/x86/ucode0.bin
 FSP_NVS_CACHE=1
 FSP_NVS_BASE=0xff9e0000
 FSP_NVS_SIZE=0x20000
+# Set to 1 to check the saved training data against a hash in TPM NV before
+# FSP-M uses it (needs ANTI_ROLLBACK=1)
+FSP_NVS_TPM=0
 
 FSP_T_BIN=./src/x86/fsp_t.bin
 FSP_M_BIN=./src/x86/fsp_m.bin
 
@@ -9111,6 +9111,7 @@ Notable options in [config/examples/nai_68int6.config](../config/examples/nai_68
 | `X86_UART_NUMBER=2` | LPSS UART2 for all three FSP phases (Kontron uses 0) |
 | `ACPI=1` | Required. Generates ACPI tables (RSDP/XSDT/FADT/MADT/MCFG/TPM2/HPET/DMAR and a minimal DSDT with the TPM device); the board's PCI interrupt routing is only in the DSDT `_PRT`, since the MP table is the Kontron one. The DSDT also declares the board devices on LPSS I2C0 (EEPROMs, RTC/watchdog) and GSPI0 (the PRC, for NAI's `naigspi` driver) |
 | `FSP_NVS_CACHE=1`, `FSP_NVS_BASE`, `FSP_NVS_SIZE` | Keeps FSP-M's memory training data (its non-volatile storage HOB) in a 128 KB area of the BIOS region below the wolfBoot window, so later boots skip full memory training. Stage 1 passes a valid copy back through `NvsBufferPtr`; stage 2 rewrites it, before FSP-S and before the BIOS region is locked, only when it changes. The record is keyed on a CRC of the FSP-M image and its UPDs, so a change to either falls back to full training. Stage 1 sets a CMOS flag before FspMemInit runs with a saved record, an FSP-requested reset clears it, and stage 2 clears it once FspSiliconInit succeeds. If FspMemInit fails with the record, or a boot finds the flag still set because the previous boot crashed or hung with the record, boots train from scratch until one gets through FspSiliconInit, and stage 2 replaces the record. The flag is kept in CMOS, so it survives a reset but needs the RTC battery to survive loss of power. `assemble_image.sh -n` blanks the area, so an image built from a board's flash dump does not carry that board's training data |
+| `FSP_NVS_TPM=1` | Authenticates the saved training data, which is otherwise the only unauthenticated input FSP-M consumes. Stage 2 keeps a SHA-256 of the record in a TPM NV index that only the platform hierarchy can write, and stage 1 reads it, before memory is up, and compares it with the record in flash before handing the record to FspMemInit; without a match it trains from scratch. Needs `ANTI_ROLLBACK=1`, which disables the platform hierarchy before handoff so the OS cannot rewrite the hash. The first boot after enabling it trains once. Without this option, prefer `FSP_NVS_CACHE=0` on a Boot Guard image |
 | `FSP_HYPERTHREADING=1` | Hyper-Threading on (off by default). The MADT and the MP table list the enabled logical processors from the CPUID topology, so either setting works |
 | `MP_CPU_NUM_ENTRY=8` | MP table processor entries, one per logical processor (default 4) |
 | `WOLFBOOT_CMDLINE_MAX` | Buffer for a signed `HDR_CMDLINE`, including the terminating NUL (default 256); a longer command line is ignored and the built-in one is used |
 
@@ -46,5 +46,6 @@ void fsp_nvs_reject(void);
 void fsp_nvs_before_reset(void);
 void fsp_nvs_boot_ok(void);
 void fsp_nvs_save(void);
+void fsp_nvs_tpm_sync(void);
 
 #endif /* FSP_NVS_H */
@@ -2103,6 +2103,14 @@ ifeq ($(FSP), 1)
     endif
     CFLAGS+=-DWOLFBOOT_FSP_NVS_CACHE
     CFLAGS+=-DFSP_NVS_BASE=$(FSP_NVS_BASE) -DFSP_NVS_SIZE=$(FSP_NVS_SIZE)
+    ifeq ($(FSP_NVS_TPM),1)
+      # anti-rollback disables the platform hierarchy before handoff, which
+      # is what keeps the OS from rewriting the reference hash
+      ifneq ($(ANTI_ROLLBACK),1)
+        $(error FSP_NVS_TPM=1 needs ANTI_ROLLBACK=1)
+      endif
+      CFLAGS+=-DWOLFBOOT_FSP_NVS_TPM
+    endif
   endif
 endif
 
 
@@ -30,6 +30,9 @@
  */
 
 #include "loader.h"
+#ifdef WOLFBOOT_FSP_NVS_TPM
+#include "x86/fsp_nvs.h"
+#endif
 #include "image.h"
 #include "hal.h"
 #include "hooks.h"
@@ -167,6 +170,9 @@ int main(void)
         wolfBoot_panic();
     }
 #endif
+#ifdef WOLFBOOT_FSP_NVS_TPM
+    fsp_nvs_tpm_sync();
+#endif
 #ifdef WOLFCRYPT_SECURE_MODE
     wcs_Init();
 #endif
 
@@ -101,7 +101,195 @@ void fsp_nvs_boot_ok(void)
     cmos_write(FSP_NVS_STATE_CMOS_IDX, 0);
 }
 
+#ifdef WOLFBOOT_FSP_NVS_TPM
+#include <wolfssl/wolfcrypt/sha256.h>
+
+/* TPM NV index holding the SHA-256 of the record stage 2 last saved. It is
+ * created by the platform hierarchy, which wolfBoot disables before handoff,
+ * so only wolfBoot can write it. */
+#ifndef FSP_NVS_TPM_NV_INDEX
+#define FSP_NVS_TPM_NV_INDEX 0x01400410U
+#endif
+#define FSP_NVS_HASH_SIZE 32
+
+/* Only an index the platform hierarchy created, and that it alone can
+ * write, holds a hash wolfBoot stored. TPMA_NV bits: PPWRITE, OWNERWRITE,
+ * AUTHWRITE, POLICYWRITE and PLATFORMCREATE. */
+#define FSP_NVS_NV_ATTR_MASK 0x4000000FU
+#define FSP_NVS_NV_ATTR 0x40000001U
+
+static int fsp_nvs_record_hash(const struct fsp_nvs_record *rec, uint8_t *hash)
+{
+    wc_Sha256 sha;
+    int ret;
+
+    ret = wc_InitSha256(&sha);
+    if (ret != 0)
+        return ret;
+    ret = wc_Sha256Update(&sha, (const uint8_t *)rec, sizeof(*rec) + rec->len);
+    if (ret == 0)
+        ret = wc_Sha256Final(&sha, hash);
+    wc_Sha256Free(&sha);
+    return ret;
+}
+#endif /* WOLFBOOT_FSP_NVS_TPM */
+
 #ifdef BUILD_LOADER_STAGE1
+#ifdef WOLFBOOT_FSP_NVS_TPM
+/* Stage 1 has no writable data before memory is up, so wolfTPM cannot run
+ * yet. Read the reference hash with a minimal FIFO exchange that keeps all
+ * of its state on the stack. */
+#ifndef FSP_NVS_TPM_BASE
+#define FSP_NVS_TPM_BASE 0xFED40000U
+#endif
+#define TIS_ACCESS (FSP_NVS_TPM_BASE + 0x00)
+#define TIS_STS (FSP_NVS_TPM_BASE + 0x18)
+#define TIS_FIFO (FSP_NVS_TPM_BASE + 0x24)
+#define TIS_ACCESS_VALID 0x80
+#define TIS_ACCESS_ACTIVE 0x20
+#define TIS_ACCESS_REQUEST 0x02
+#define TIS_STS_VALID 0x80
+#define TIS_STS_READY 0x40
+#define TIS_STS_GO 0x20
+#define TIS_STS_AVAIL 0x10
+#define TIS_POLL_MAX 2000000U
+
+static int tis_wait_sts(uint8_t mask)
+{
+    uint32_t i;
+
+    for (i = 0; i < TIS_POLL_MAX; i++) {
+        if ((mmio_read8(TIS_STS) & mask) == mask)
+            return 0;
+    }
+    return -1;
+}
+
+static int tis_xfer(const uint8_t *cmd, uint32_t cmd_sz, uint8_t *rsp,
+                    uint32_t rsp_max, uint32_t *rsp_sz)
+{
+    uint32_t i, n, total;
+    int ret = -1;
+
+    mmio_write8(TIS_ACCESS, TIS_ACCESS_REQUEST);
+    for (i = 0; i < TIS_POLL_MAX; i++) {
+        if ((mmio_read8(TIS_ACCESS) & (TIS_ACCESS_VALID | TIS_ACCESS_ACTIVE)) ==
+            (TIS_ACCESS_VALID | TIS_ACCESS_ACTIVE))
+            break;
+    }
+    if (i == TIS_POLL_MAX)
+        return -1;
+    mmio_write8(TIS_STS, TIS_STS_READY);
+    if (tis_wait_sts(TIS_STS_READY) != 0)
+        goto out;
+    for (i = 0; i < cmd_sz; i++) {
+        /* burst count, STS bits 8-23 */
+        for (n = 0; n < TIS_POLL_MAX; n++) {
+            if ((mmio_read32(TIS_STS) & 0x00FFFF00U) != 0)
+                break;
+        }
+        if (n == TIS_POLL_MAX)
+            goto out;
+        mmio_write8(TIS_FIFO, cmd[i]);
+    }
+    mmio_write8(TIS_STS, TIS_STS_GO);
+    total = 10;
+    for (i = 0; i < total; i++) {
+        if (tis_wait_sts(TIS_STS_VALID | TIS_STS_AVAIL) != 0 || i >= rsp_max)
+            goto out;
+        rsp[i] = mmio_read8(TIS_FIFO);
+        if (i == 5) {
+            total = ((uint32_t)rsp[2] << 24) | ((uint32_t)rsp[3] << 16) |
+                    ((uint32_t)rsp[4] << 8) | rsp[5];
+            if (total < 10 || total > rsp_max)
+                goto out;
+        }
+    }
+    *rsp_sz = total;
+    ret = 0;
+out:
+    mmio_write8(TIS_STS, TIS_STS_READY);
+    mmio_write8(TIS_ACCESS, TIS_ACCESS_ACTIVE);
+    return ret;
+}
+
+static uint32_t tpm_rsp_code(const uint8_t *rsp)
+{
+    return ((uint32_t)rsp[6] << 24) | ((uint32_t)rsp[7] << 16) |
+           ((uint32_t)rsp[8] << 8) | rsp[9];
+}
+
+/* Returns 0 with the reference hash, or -1 when there is none to trust. */
+static int fsp_nvs_tpm_ref(uint8_t *hash)
+{
+    static const uint8_t startup[] = {
+        0x80, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x01, 0x44, 0x00, 0x00
+    };
+    uint8_t nv_read[35] = {
+        0x80, 0x02, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x01, 0x4e,
+        0, 0, 0, 0, /* authHandle: the index */
+        0, 0, 0, 0, /* nvIndex */
+        0x00, 0x00, 0x00, 0x09, /* authorization size */
+        0x40, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, /* empty PW */
+        0x00, FSP_NVS_HASH_SIZE, 0x00, 0x00 /* size, offset */
+    };
+    uint8_t nv_public[14] = {
+        0x80, 0x01, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x01, 0x69,
+        0, 0, 0, 0 /* nvIndex */
+    };
+    uint8_t rsp[96];
+    uint32_t rsp_sz = 0, rc, attr, i;
+
+    for (i = 0; i < 4; i++) {
+        nv_read[10 + i] = nv_read[14 + i] = nv_public[10 + i] =
+            (uint8_t)(FSP_NVS_TPM_NV_INDEX >> (24 - 8 * i));
+    }
+    /* TPM_RC_INITIALIZE (0x100): already started */
+    if (tis_xfer(startup, sizeof(startup), rsp, sizeof(rsp), &rsp_sz) != 0)
+        return -1;
+    rc = tpm_rsp_code(rsp);
+    if (rc != 0 && rc != 0x100)
+        return -1;
+    /* TPMS_NV_PUBLIC: index, name algorithm, then the attributes */
+    if (tis_xfer(nv_public, sizeof(nv_public), rsp, sizeof(rsp),
+                 &rsp_sz) != 0 || tpm_rsp_code(rsp) != 0 || rsp_sz < 22)
+        return -1;
+    attr = ((uint32_t)rsp[18] << 24) | ((uint32_t)rsp[19] << 16) |
+           ((uint32_t)rsp[20] << 8) | rsp[21];
+    if ((attr & FSP_NVS_NV_ATTR_MASK) != FSP_NVS_NV_ATTR)
+        return -1;
+    if (tis_xfer(nv_read, sizeof(nv_read), rsp, sizeof(rsp), &rsp_sz) != 0)
+        return -1;
+    if (tpm_rsp_code(rsp) != 0 || rsp_sz < 16 + FSP_NVS_HASH_SIZE ||
+        rsp[14] != 0 || rsp[15] != FSP_NVS_HASH_SIZE)
+        return -1;
+    memcpy(hash, rsp + 16, FSP_NVS_HASH_SIZE);
+    return 0;
+}
+
+static int fsp_nvs_tpm_check(const struct fsp_nvs_record *rec)
+{
+    uint8_t ref[FSP_NVS_HASH_SIZE], hash[FSP_NVS_HASH_SIZE];
+    uint8_t diff = 0;
+    int i;
+
+    if (fsp_nvs_tpm_ref(ref) != 0) {
+        wolfBoot_printf("FSP NVS: no TPM reference hash\r\n");
+        return -1;
+    }
+    if (fsp_nvs_record_hash(rec, hash) != 0)
+        return -1;
+    for (i = 0; i < FSP_NVS_HASH_SIZE; i++)
+        diff |= ref[i] ^ hash[i];
+    if (diff != 0) {
+        wolfBoot_printf("FSP NVS: saved training data does not match the "
+                        "TPM reference hash\r\n");
+        return -1;
+    }
+    return 0;
+}
+#endif /* WOLFBOOT_FSP_NVS_TPM */
+
 void fsp_nvs_reject(void)
 {
     cmos_write(FSP_NVS_STATE_CMOS_IDX, FSP_NVS_STATE_SKIP);
@@ -140,6 +328,10 @@ int fsp_nvs_apply(uint8_t *udp_m, uint32_t udp_size, const uint8_t *fsp_m,
         wolfBoot_printf("FSP NVS: no saved training data\r\n");
         return 0;
     }
+#ifdef WOLFBOOT_FSP_NVS_TPM
+    if (fsp_nvs_tpm_check(rec) != 0)
+        return 0;
+#endif
     cmos_write(FSP_NVS_STATE_CMOS_IDX, FSP_NVS_STATE_IN_USE);
     arch->NvsBufferPtr = (uint32_t)(uintptr_t)rec->data;
     arch->BootMode = BOOT_ASSUMING_NO_CONFIGURATION_CHANGES;
@@ -224,4 +416,77 @@ void fsp_nvs_save(void)
     }
     wolfBoot_printf("FSP NVS: saved %d bytes of training data\r\n", (int)len);
 }
+
+#ifdef WOLFBOOT_FSP_NVS_TPM
+#include "tpm.h"
+#include <wolftpm/tpm2_wrap.h>
+
+/* Keep the TPM reference hash equal to the record in flash, but only when
+ * that record holds the data FspMemInit returned on this boot: if the save
+ * failed, flash may still hold an older record, one stage 1 perhaps rejected.
+ * Must run before the platform hierarchy is disabled. */
+void fsp_nvs_tpm_sync(void)
+{
+    const struct fsp_nvs_record *rec =
+        (const struct fsp_nvs_record *)(uintptr_t)FSP_NVS_BASE;
+    WOLFTPM2_DEV *dev = &wolftpm_dev;
+    WOLFTPM2_HANDLE parent;
+    WOLFTPM2_NV nv;
+    NV_Write_In in;
+    struct stage2_parameter *params = stage2_get_parameters();
+    struct efi_hob_guid_type *hob;
+    uint8_t hash[FSP_NVS_HASH_SIZE], ref[FSP_NVS_HASH_SIZE];
+    word32 attr = 0, sz = sizeof(ref);
+    int rc;
+
+    hob = fsp_nvs_find_hob((struct efi_hob *)(uintptr_t)params->hobList);
+    if (hob == NULL ||
+        !fsp_nvs_is_current(rec, params->fsp_nvs_key,
+                            (const uint8_t *)(hob + 1),
+                            hob->header.hob_length - sizeof(*hob)) ||
+        fsp_nvs_record_hash(rec, hash) != 0)
+        return;
+
+    memset(&nv, 0, sizeof(nv));
+    nv.handle.hndl = FSP_NVS_TPM_NV_INDEX;
+    if (wolfTPM2_NVOpen(dev, &nv, FSP_NVS_TPM_NV_INDEX, NULL, 0) == 0) {
+        if ((nv.attributes & FSP_NVS_NV_ATTR_MASK) != FSP_NVS_NV_ATTR) {
+            wolfBoot_printf("FSP NVS: TPM reference index is not "
+                            "platform-owned\r\n");
+            return;
+        }
+        wolfTPM2_SetAuthHandle(dev, 0, &nv.handle);
+        rc = wolfTPM2_NVReadAuth(dev, &nv, FSP_NVS_TPM_NV_INDEX, ref, &sz, 0);
+        wolfTPM2_UnsetAuth(dev, 0);
+        if (rc == 0 && sz == sizeof(ref) &&
+            memcmp(ref, hash, sizeof(ref)) == 0)
+            return;
+    }
+
+    memset(&parent, 0, sizeof(parent));
+    parent.hndl = TPM_RH_PLATFORM;
+    wolfTPM2_GetNvAttributesTemplate(TPM_RH_PLATFORM, &attr);
+    attr &= ~TPMA_NV_AUTHWRITE;
+    rc = wolfTPM2_NVCreateAuth(dev, &parent, &nv, FSP_NVS_TPM_NV_INDEX, attr,
+                               sizeof(hash), NULL, 0);
+    if (rc == TPM_RC_NV_DEFINED)
+        rc = 0;
+    wolfTPM2_UnsetAuth(dev, 1);
+    if (rc == 0) {
+        memset(&in, 0, sizeof(in));
+        in.authHandle = TPM_RH_PLATFORM;
+        in.nvIndex = FSP_NVS_TPM_NV_INDEX;
+        in.data.size = sizeof(hash);
+        memcpy(in.data.buffer, hash, sizeof(hash));
+        wolfTPM2_SetAuthPassword(dev, 0, NULL);
+        rc = TPM2_NV_Write(&in);
+        wolfTPM2_UnsetAuth(dev, 0);
+    }
+    if (rc != 0)
+        wolfBoot_printf("FSP NVS: TPM reference hash update failed 0x%x\r\n",
+                        rc);
+    else
+        wolfBoot_printf("FSP NVS: TPM reference hash updated\r\n");
+}
+#endif /* WOLFBOOT_FSP_NVS_TPM */
 #endif /* BUILD_LOADER_STAGE1 */
@@ -2325,17 +2325,24 @@ unit-boot-x86-fsp-measure: ../../include/target.h unit-boot-x86-fsp-measure.c \
 # unit-fsp-nvs runs the FSP-M memory training data cache record check and
 # the stage 1 hand-off (src/x86/fsp_nvs.c) against a RAM-backed area.
 unit-fsp-nvs:CFLAGS+=-DWOLFBOOT_FSP -DWOLFBOOT_FSP_NVS_CACHE \
-	-DBUILD_LOADER_STAGE1 -DPRINTF_ENABLED
+	-DWOLFBOOT_FSP_NVS_TPM -DBUILD_LOADER_STAGE1 -DPRINTF_ENABLED
 unit-fsp-nvs: unit-fsp-nvs.c ../../src/x86/fsp_nvs.c
-	gcc -o $@ unit-fsp-nvs.c $(CFLAGS) $(LDFLAGS)
+	gcc -o $@ unit-fsp-nvs.c \
+		$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.c $(CFLAGS) \
+		-ffunction-sections -fdata-sections $(LDFLAGS) -Wl,--gc-sections
 
 # unit-fsp-nvs-save runs the stage 2 save path against a synthetic HOB list
 # and a RAM-backed flash area; built non-PIE so the HOB list sits below 4 GB
 # (stage2_parameter.hobList is 32-bit).
 unit-fsp-nvs-save:CFLAGS+=-DWOLFBOOT_FSP -DWOLFBOOT_FSP_NVS_CACHE \
-	-DPRINTF_ENABLED -fno-pie
+	-DWOLFBOOT_FSP_NVS_TPM -DWOLFBOOT_TPM -DWOLFTPM_USER_SETTINGS \
+	-I$(WOLFBOOT_LIB_WOLFTPM) -D__WOLFBOOT -DWOLFBOOT_HASH_SHA384 \
+	-DWOLFBOOT_SIGN_ECC384 -DPRINTF_ENABLED -fno-pie
 unit-fsp-nvs-save: unit-fsp-nvs-save.c ../../src/x86/fsp_nvs.c ../../src/x86/hob.c
-	gcc -o $@ unit-fsp-nvs-save.c $(CFLAGS) -no-pie $(LDFLAGS)
+	gcc -o $@ unit-fsp-nvs-save.c \
+		$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.c $(CFLAGS) \
+		-ffunction-sections -fdata-sections -no-pie $(LDFLAGS) \
+		-Wl,--gc-sections
 
 # unit-nrf5340-flash-protect runs the real hal_flash_protect() from
 # hal/nrf5340.c against a mock SPU region-permission array (F-13623: the