blob: 3c0acc7d08e179676ee365d3fca688a8a987cf83 [file] [log] [blame]
Andrew Walbran68a8c162022-03-07 15:38:42 +00001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! pVM firmware.
16
17#![no_main]
18#![no_std]
19
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +000020extern crate alloc;
21
Alan Stokes4db76eb2023-04-26 14:28:15 +010022mod bcc;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090023mod bootargs;
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010024mod config;
Pierre-Clément Tosi90cd4f12023-02-17 11:19:56 +000025mod crypto;
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000026mod dice;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010027mod entry;
Andrew Walbrandfb73372022-04-21 10:52:27 +000028mod exceptions;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000029mod fdt;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000030mod gpt;
Pierre-Clément Tosifc531152022-10-20 12:22:23 +010031mod heap;
Pierre-Clément Tosida4440a2022-08-22 18:06:32 +010032mod helpers;
Andrew Walbranba47d1d2022-12-14 15:21:44 +000033mod hvc;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000034mod instance;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000035mod memory;
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +000036mod mmu;
Pierre-Clément Tosi90cd4f12023-02-17 11:19:56 +000037mod rand;
Andrew Walbran848decf2022-12-15 14:39:38 +000038mod virtio;
Andrew Walbran68a8c162022-03-07 15:38:42 +000039
Alan Stokes4db76eb2023-04-26 14:28:15 +010040use crate::bcc::Bcc;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000041use crate::dice::PartialInputs;
42use crate::entry::RebootReason;
43use crate::fdt::modify_for_next_stage;
44use crate::helpers::flush;
45use crate::helpers::GUEST_PAGE_SIZE;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000046use crate::instance::get_or_generate_instance_salt;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000047use crate::memory::MemoryTracker;
48use crate::virtio::pci;
Alan Stokes4db76eb2023-04-26 14:28:15 +010049use alloc::boxed::Box;
50use core::ops::Range;
Alan Stokesc4354b82023-05-04 16:06:52 +010051use diced_open_dice::{bcc_handover_parse, DiceArtifacts};
Andrew Walbran730375d2022-12-21 14:04:34 +000052use fdtpci::{PciError, PciInfo};
Andrew Walbran19690632022-12-07 16:41:30 +000053use libfdt::Fdt;
Alan Stokes4db76eb2023-04-26 14:28:15 +010054use log::{debug, error, info, trace, warn};
Pierre-Clément Tosi2d652982023-01-09 19:30:17 +000055use pvmfw_avb::verify_payload;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090056use pvmfw_avb::DebugLevel;
Alice Wang0aa30322023-01-31 11:00:10 +000057use pvmfw_embedded_key::PUBLIC_KEY;
Andrew Walbran68a8c162022-03-07 15:38:42 +000058
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000059const NEXT_BCC_SIZE: usize = GUEST_PAGE_SIZE;
60
Alice Wang28cbcf12022-12-01 07:58:28 +000061fn main(
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +000062 fdt: &mut Fdt,
Alice Wang28cbcf12022-12-01 07:58:28 +000063 signed_kernel: &[u8],
64 ramdisk: Option<&[u8]>,
Alice Wang843d8312023-02-15 09:47:06 +000065 current_bcc_handover: &[u8],
Alan Stokes4db76eb2023-04-26 14:28:15 +010066 mut debug_policy: Option<&mut [u8]>,
Andrew Walbran19690632022-12-07 16:41:30 +000067 memory: &mut MemoryTracker,
Pierre-Clément Tosi97f52492023-04-04 15:52:17 +010068) -> Result<Range<usize>, RebootReason> {
Pierre-Clément Tosi37105a62022-10-18 12:21:48 +010069 info!("pVM firmware");
Pierre-Clément Tosi8036b4f2023-02-17 10:31:31 +000070 debug!("FDT: {:?}", fdt.as_ptr());
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000071 debug!("Signed kernel: {:?} ({:#x} bytes)", signed_kernel.as_ptr(), signed_kernel.len());
Alice Wanga78279c2022-12-16 12:41:19 +000072 debug!("AVB public key: addr={:?}, size={:#x} ({1})", PUBLIC_KEY.as_ptr(), PUBLIC_KEY.len());
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000073 if let Some(rd) = ramdisk {
74 debug!("Ramdisk: {:?} ({:#x} bytes)", rd.as_ptr(), rd.len());
75 } else {
76 debug!("Ramdisk: None");
77 }
Alan Stokes4db76eb2023-04-26 14:28:15 +010078
Alice Wang843d8312023-02-15 09:47:06 +000079 let bcc_handover = bcc_handover_parse(current_bcc_handover).map_err(|e| {
80 error!("Invalid BCC Handover: {e:?}");
81 RebootReason::InvalidBcc
82 })?;
83 trace!("BCC: {bcc_handover:x?}");
Andrew Walbran19690632022-12-07 16:41:30 +000084
Alan Stokes4db76eb2023-04-26 14:28:15 +010085 let cdi_seal = bcc_handover.cdi_seal();
86
87 let bcc = Bcc::new(bcc_handover.bcc()).map_err(|e| {
88 error!("{e}");
89 RebootReason::InvalidBcc
90 })?;
91
92 // The bootloader should never pass us a debug policy when the boot is secure (the bootloader
93 // is locked). If it gets it wrong, disregard it & log it, to avoid it causing problems.
94 if debug_policy.is_some() && !bcc.is_debug_mode() {
95 warn!("Ignoring debug policy, BCC does not indicate Debug mode");
96 debug_policy = None;
Alan Stokesd1ee63e2023-04-24 16:17:39 +010097 }
98
Andrew Walbran19690632022-12-07 16:41:30 +000099 // Set up PCI bus for VirtIO devices.
Andrew Walbrand1d03182022-12-09 18:20:01 +0000100 let pci_info = PciInfo::from_fdt(fdt).map_err(handle_pci_error)?;
101 debug!("PCI: {:#x?}", pci_info);
Andrew Walbranb398fc82023-01-24 14:45:46 +0000102 let mut pci_root = pci::initialise(pci_info, memory)?;
Andrew Walbran19690632022-12-07 16:41:30 +0000103
Alice Wang1f0add02023-01-23 16:22:53 +0000104 let verified_boot_data = verify_payload(signed_kernel, ramdisk, PUBLIC_KEY).map_err(|e| {
Pierre-Clément Tosi2d652982023-01-09 19:30:17 +0000105 error!("Failed to verify the payload: {e}");
106 RebootReason::PayloadVerificationError
107 })?;
108
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000109 let next_bcc = heap::aligned_boxed_slice(NEXT_BCC_SIZE, GUEST_PAGE_SIZE).ok_or_else(|| {
110 error!("Failed to allocate the next-stage BCC");
111 RebootReason::InternalError
112 })?;
113 // By leaking the slice, its content will be left behind for the next stage.
114 let next_bcc = Box::leak(next_bcc);
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +0000115
Pierre-Clément Tosif58f3a32023-02-02 16:24:23 +0000116 let dice_inputs = PartialInputs::new(&verified_boot_data).map_err(|e| {
117 error!("Failed to compute partial DICE inputs: {e:?}");
118 RebootReason::InternalError
119 })?;
Pierre-Clément Tosi90cd4f12023-02-17 11:19:56 +0000120 let (new_instance, salt) = get_or_generate_instance_salt(&mut pci_root, &dice_inputs, cdi_seal)
121 .map_err(|e| {
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +0000122 error!("Failed to get instance.img salt: {e}");
123 RebootReason::InternalError
124 })?;
125 trace!("Got salt from instance.img: {salt:x?}");
126
Alan Stokesa38d3b32023-05-05 12:19:18 +0100127 // It is possible that the DICE chain we were given is rooted in the UDS. We do not want to give
128 // such a chain to the payload, or even the associated CDIs. So remove the entire chain we
129 // were given and taint the CDIs. Note that the resulting CDIs are still deterministically
130 // derived from those we received, so will vary iff they do.
131 // TODO(b/280405545): Remove this post Android 14.
132 let truncated_bcc_handover = bcc::truncate(bcc_handover).map_err(|e| {
133 error!("{e}");
134 RebootReason::InternalError
Pierre-Clément Tosif58f3a32023-02-02 16:24:23 +0000135 })?;
Alan Stokesa38d3b32023-05-05 12:19:18 +0100136
Alan Stokesc4354b82023-05-04 16:06:52 +0100137 dice_inputs.write_next_bcc(truncated_bcc_handover.as_slice(), &salt, next_bcc).map_err(
138 |e| {
Alan Stokesa38d3b32023-05-05 12:19:18 +0100139 error!("Failed to derive next-stage DICE secrets: {e:?}");
140 RebootReason::SecretDerivationError
Alan Stokesc4354b82023-05-04 16:06:52 +0100141 },
142 )?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000143 flush(next_bcc);
144
Pierre-Clément Tosib2d8aa72023-02-17 15:22:50 +0000145 let strict_boot = true;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900146 let debuggable = verified_boot_data.debug_level != DebugLevel::None;
147 modify_for_next_stage(fdt, next_bcc, new_instance, strict_boot, debug_policy, debuggable)
148 .map_err(|e| {
149 error!("Failed to configure device tree: {e}");
150 RebootReason::InternalError
151 })?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000152
Alice Wang4379c832022-12-05 15:50:20 +0000153 info!("Starting payload...");
Pierre-Clément Tosi97f52492023-04-04 15:52:17 +0100154
155 let bcc_range = {
156 let r = next_bcc.as_ptr_range();
157 (r.start as usize)..(r.end as usize)
158 };
159
160 Ok(bcc_range)
Pierre-Clément Tosi263ffd52022-10-05 20:27:50 +0100161}
Andrew Walbrand1d03182022-12-09 18:20:01 +0000162
163/// Logs the given PCI error and returns the appropriate `RebootReason`.
164fn handle_pci_error(e: PciError) -> RebootReason {
165 error!("{}", e);
166 match e {
167 PciError::FdtErrorPci(_)
168 | PciError::FdtNoPci
169 | PciError::FdtErrorReg(_)
170 | PciError::FdtMissingReg
171 | PciError::FdtRegEmpty
172 | PciError::FdtRegMissingSize
173 | PciError::CamWrongSize(_)
174 | PciError::FdtErrorRanges(_)
175 | PciError::FdtMissingRanges
176 | PciError::RangeAddressMismatch { .. }
177 | PciError::NoSuitableRange => RebootReason::InvalidFdt,
Andrew Walbrand1d03182022-12-09 18:20:01 +0000178 }
179}