blob: d1ea5f027f73eb2640f670714f24dfb85badec37 [file] [log] [blame]
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +00001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Support for DICE derivation and BCC generation.
16
17use core::ffi::CStr;
Alice Wang1f0add02023-01-23 16:22:53 +000018use core::mem::size_of;
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000019use dice::bcc::format_config_descriptor;
20use dice::bcc::Handover;
21use dice::hash;
22use dice::ConfigType;
23use dice::InputValues;
Alice Wang1f0add02023-01-23 16:22:53 +000024use pvmfw_avb::{DebugLevel, Digest, VerifiedBootData};
25
26fn to_dice_mode(debug_level: DebugLevel) -> dice::Mode {
27 match debug_level {
28 DebugLevel::None => dice::Mode::Normal,
29 DebugLevel::Full => dice::Mode::Debug,
30 }
31}
32
33fn to_dice_hash(verified_boot_data: &VerifiedBootData) -> dice::Result<dice::Hash> {
34 let mut digests = [0u8; size_of::<Digest>() * 2];
35 digests[..size_of::<Digest>()].copy_from_slice(&verified_boot_data.kernel_digest);
36 if let Some(initrd_digest) = verified_boot_data.initrd_digest {
37 digests[size_of::<Digest>()..].copy_from_slice(&initrd_digest);
38 }
39 hash(&digests)
40}
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000041
42/// Derive the VM-specific secrets and certificate through DICE.
43pub fn derive_next_bcc(
44 bcc: &Handover,
45 next_bcc: &mut [u8],
Alice Wang1f0add02023-01-23 16:22:53 +000046 verified_boot_data: &VerifiedBootData,
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000047 authority: &[u8],
48) -> dice::Result<usize> {
Alice Wang1f0add02023-01-23 16:22:53 +000049 let code_hash = to_dice_hash(verified_boot_data)?;
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000050 let auth_hash = hash(authority)?;
Alice Wang1f0add02023-01-23 16:22:53 +000051 let mode = to_dice_mode(verified_boot_data.debug_level);
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000052 let component_name = CStr::from_bytes_with_nul(b"vm_entry\0").unwrap();
53 let mut config_descriptor_buffer = [0; 128];
54 let config_descriptor_size = format_config_descriptor(
55 &mut config_descriptor_buffer,
56 Some(component_name),
57 None, // component_version
58 false, // resettable
59 )?;
60 let config = &config_descriptor_buffer[..config_descriptor_size];
61 let config = ConfigType::Descriptor(config);
62
63 let input_values = InputValues::new(
64 &code_hash,
65 None, // code_descriptor
66 &config,
67 Some(&auth_hash),
68 None, // auth_descriptor
69 mode,
70 None, // TODO(b/249723852): Get salt from instance.img (virtio-blk) and/or TRNG.
71 );
72
73 bcc.main_flow(&input_values, next_bcc)
74}