blob: f80bae1e91034103a703c0ed26bab1a639c35ae0 [file] [log] [blame]
Andrew Walbran68a8c162022-03-07 15:38:42 +00001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! pVM firmware.
16
17#![no_main]
18#![no_std]
19
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +000020extern crate alloc;
21
Alan Stokes4db76eb2023-04-26 14:28:15 +010022mod bcc;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090023mod bootargs;
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010024mod config;
Jaewan Kimc6e023b2023-10-12 15:11:05 +090025mod device_assignment;
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000026mod dice;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010027mod entry;
Andrew Walbrandfb73372022-04-21 10:52:27 +000028mod exceptions;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000029mod fdt;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000030mod gpt;
Pierre-Clément Tosida4440a2022-08-22 18:06:32 +010031mod helpers;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000032mod instance;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000033mod memory;
Andrew Walbran68a8c162022-03-07 15:38:42 +000034
Alan Stokes4db76eb2023-04-26 14:28:15 +010035use crate::bcc::Bcc;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000036use crate::dice::PartialInputs;
37use crate::entry::RebootReason;
38use crate::fdt::modify_for_next_stage;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000039use crate::helpers::GUEST_PAGE_SIZE;
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +000040use crate::instance::get_or_generate_instance_salt;
Alan Stokes7f27c0d2023-09-07 16:22:58 +010041use alloc::borrow::Cow;
Alan Stokes4db76eb2023-04-26 14:28:15 +010042use alloc::boxed::Box;
43use core::ops::Range;
Alan Stokesc4354b82023-05-04 16:06:52 +010044use diced_open_dice::{bcc_handover_parse, DiceArtifacts};
Andrew Walbran730375d2022-12-21 14:04:34 +000045use fdtpci::{PciError, PciInfo};
Andrew Walbran19690632022-12-07 16:41:30 +000046use libfdt::Fdt;
Alan Stokes4db76eb2023-04-26 14:28:15 +010047use log::{debug, error, info, trace, warn};
Pierre-Clément Tosi2d652982023-01-09 19:30:17 +000048use pvmfw_avb::verify_payload;
Alice Wangab0d0202023-05-17 08:07:41 +000049use pvmfw_avb::Capability;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090050use pvmfw_avb::DebugLevel;
Alice Wang0aa30322023-01-31 11:00:10 +000051use pvmfw_embedded_key::PUBLIC_KEY;
Pierre-Clément Tosic332fae2023-06-22 11:37:12 +000052use vmbase::heap;
Alice Wang3fa9b802023-06-06 07:52:31 +000053use vmbase::memory::flush;
Alice Wang93ee98a2023-06-08 08:20:39 +000054use vmbase::memory::MEMORY;
Pierre-Clément Tosi80251972023-07-12 12:51:12 +000055use vmbase::rand;
Alice Wangeade1672023-06-08 14:56:20 +000056use vmbase::virtio::pci;
Andrew Walbran68a8c162022-03-07 15:38:42 +000057
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000058const NEXT_BCC_SIZE: usize = GUEST_PAGE_SIZE;
59
Alice Wang28cbcf12022-12-01 07:58:28 +000060fn main(
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +000061 fdt: &mut Fdt,
Alice Wang28cbcf12022-12-01 07:58:28 +000062 signed_kernel: &[u8],
63 ramdisk: Option<&[u8]>,
Alice Wang843d8312023-02-15 09:47:06 +000064 current_bcc_handover: &[u8],
Alan Stokes65618332023-12-15 14:09:25 +000065 mut debug_policy: Option<&[u8]>,
Pierre-Clément Tosi97f52492023-04-04 15:52:17 +010066) -> Result<Range<usize>, RebootReason> {
Pierre-Clément Tosi37105a62022-10-18 12:21:48 +010067 info!("pVM firmware");
Pierre-Clément Tosi8036b4f2023-02-17 10:31:31 +000068 debug!("FDT: {:?}", fdt.as_ptr());
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000069 debug!("Signed kernel: {:?} ({:#x} bytes)", signed_kernel.as_ptr(), signed_kernel.len());
Alice Wanga78279c2022-12-16 12:41:19 +000070 debug!("AVB public key: addr={:?}, size={:#x} ({1})", PUBLIC_KEY.as_ptr(), PUBLIC_KEY.len());
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000071 if let Some(rd) = ramdisk {
72 debug!("Ramdisk: {:?} ({:#x} bytes)", rd.as_ptr(), rd.len());
73 } else {
74 debug!("Ramdisk: None");
75 }
Alan Stokes4db76eb2023-04-26 14:28:15 +010076
Alice Wang843d8312023-02-15 09:47:06 +000077 let bcc_handover = bcc_handover_parse(current_bcc_handover).map_err(|e| {
78 error!("Invalid BCC Handover: {e:?}");
79 RebootReason::InvalidBcc
80 })?;
81 trace!("BCC: {bcc_handover:x?}");
Andrew Walbran19690632022-12-07 16:41:30 +000082
Alan Stokes4db76eb2023-04-26 14:28:15 +010083 let cdi_seal = bcc_handover.cdi_seal();
84
85 let bcc = Bcc::new(bcc_handover.bcc()).map_err(|e| {
86 error!("{e}");
87 RebootReason::InvalidBcc
88 })?;
89
90 // The bootloader should never pass us a debug policy when the boot is secure (the bootloader
91 // is locked). If it gets it wrong, disregard it & log it, to avoid it causing problems.
92 if debug_policy.is_some() && !bcc.is_debug_mode() {
93 warn!("Ignoring debug policy, BCC does not indicate Debug mode");
94 debug_policy = None;
Alan Stokesd1ee63e2023-04-24 16:17:39 +010095 }
96
Andrew Walbran19690632022-12-07 16:41:30 +000097 // Set up PCI bus for VirtIO devices.
Andrew Walbrand1d03182022-12-09 18:20:01 +000098 let pci_info = PciInfo::from_fdt(fdt).map_err(handle_pci_error)?;
99 debug!("PCI: {:#x?}", pci_info);
Alice Wangeff58392023-07-04 13:32:09 +0000100 let mut pci_root = pci::initialize(pci_info, MEMORY.lock().as_mut().unwrap()).map_err(|e| {
101 error!("Failed to initialize PCI: {e}");
Alice Wang287de622023-06-08 13:17:03 +0000102 RebootReason::InternalError
103 })?;
Andrew Walbran19690632022-12-07 16:41:30 +0000104
Alice Wang1f0add02023-01-23 16:22:53 +0000105 let verified_boot_data = verify_payload(signed_kernel, ramdisk, PUBLIC_KEY).map_err(|e| {
Pierre-Clément Tosi2d652982023-01-09 19:30:17 +0000106 error!("Failed to verify the payload: {e}");
107 RebootReason::PayloadVerificationError
108 })?;
Pierre-Clément Tosif90655d2023-06-28 11:00:17 +0000109 let debuggable = verified_boot_data.debug_level != DebugLevel::None;
110 if debuggable {
111 info!("Successfully verified a debuggable payload.");
112 info!("Please disregard any previous libavb ERROR about initrd_normal.");
113 }
Pierre-Clément Tosi2d652982023-01-09 19:30:17 +0000114
Shikha Panwar4a0651d2023-09-28 13:06:13 +0000115 if verified_boot_data.has_capability(Capability::RemoteAttest) {
Alice Wangab0d0202023-05-17 08:07:41 +0000116 info!("Service VM capable of remote attestation detected");
Alice Wang12e4c862023-12-11 13:52:27 +0000117 if service_vm_version::VERSION != verified_boot_data.rollback_index {
118 // For RKP VM, we only boot if the version in the AVB footer of its kernel matches
119 // the one embedded in pvmfw at build time.
120 // This prevents the pvmfw from booting a roll backed RKP VM.
121 error!(
122 "Service VM version mismatch: expected {}, found {}",
123 service_vm_version::VERSION,
124 verified_boot_data.rollback_index
125 );
126 return Err(RebootReason::InvalidPayload);
127 }
Alice Wangab0d0202023-05-17 08:07:41 +0000128 }
129
Shikha Panwar4a0651d2023-09-28 13:06:13 +0000130 if verified_boot_data.has_capability(Capability::SecretkeeperProtection) {
131 info!("Guest OS is capable of Secretkeeper protection");
132 // For Secretkeeper based Antirollback protection, rollback_index of the image > 0
133 if verified_boot_data.rollback_index == 0 {
134 error!(
135 "Expected positive rollback_index, found {:?}",
136 verified_boot_data.rollback_index
137 );
138 return Err(RebootReason::InvalidPayload);
139 };
140 }
141
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000142 let next_bcc = heap::aligned_boxed_slice(NEXT_BCC_SIZE, GUEST_PAGE_SIZE).ok_or_else(|| {
143 error!("Failed to allocate the next-stage BCC");
144 RebootReason::InternalError
145 })?;
146 // By leaking the slice, its content will be left behind for the next stage.
147 let next_bcc = Box::leak(next_bcc);
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +0000148
Pierre-Clément Tosif58f3a32023-02-02 16:24:23 +0000149 let dice_inputs = PartialInputs::new(&verified_boot_data).map_err(|e| {
150 error!("Failed to compute partial DICE inputs: {e:?}");
151 RebootReason::InternalError
152 })?;
Pierre-Clément Tosi90cd4f12023-02-17 11:19:56 +0000153 let (new_instance, salt) = get_or_generate_instance_salt(&mut pci_root, &dice_inputs, cdi_seal)
154 .map_err(|e| {
Pierre-Clément Tosi1cc5eb72023-02-02 11:09:18 +0000155 error!("Failed to get instance.img salt: {e}");
156 RebootReason::InternalError
157 })?;
158 trace!("Got salt from instance.img: {salt:x?}");
159
Alan Stokes7f27c0d2023-09-07 16:22:58 +0100160 let new_bcc_handover = if cfg!(dice_changes) {
161 Cow::Borrowed(current_bcc_handover)
162 } else {
163 // It is possible that the DICE chain we were given is rooted in the UDS. We do not want to
164 // give such a chain to the payload, or even the associated CDIs. So remove the
165 // entire chain we were given and taint the CDIs. Note that the resulting CDIs are
166 // still deterministically derived from those we received, so will vary iff they do.
167 // TODO(b/280405545): Remove this post Android 14.
168 let truncated_bcc_handover = bcc::truncate(bcc_handover).map_err(|e| {
169 error!("{e}");
170 RebootReason::InternalError
171 })?;
172 Cow::Owned(truncated_bcc_handover)
173 };
Alan Stokesa38d3b32023-05-05 12:19:18 +0100174
Alan Stokes7f27c0d2023-09-07 16:22:58 +0100175 dice_inputs.write_next_bcc(new_bcc_handover.as_ref(), &salt, next_bcc).map_err(|e| {
176 error!("Failed to derive next-stage DICE secrets: {e:?}");
177 RebootReason::SecretDerivationError
178 })?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000179 flush(next_bcc);
180
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000181 let kaslr_seed = u64::from_ne_bytes(rand::random_array().map_err(|e| {
182 error!("Failed to generated guest KASLR seed: {e}");
183 RebootReason::InternalError
184 })?);
Pierre-Clément Tosib2d8aa72023-02-17 15:22:50 +0000185 let strict_boot = true;
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000186 modify_for_next_stage(
187 fdt,
188 next_bcc,
189 new_instance,
190 strict_boot,
191 debug_policy,
192 debuggable,
193 kaslr_seed,
194 )
195 .map_err(|e| {
196 error!("Failed to configure device tree: {e}");
197 RebootReason::InternalError
198 })?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000199
Alice Wang4379c832022-12-05 15:50:20 +0000200 info!("Starting payload...");
Pierre-Clément Tosi97f52492023-04-04 15:52:17 +0100201
202 let bcc_range = {
203 let r = next_bcc.as_ptr_range();
204 (r.start as usize)..(r.end as usize)
205 };
206
207 Ok(bcc_range)
Pierre-Clément Tosi263ffd52022-10-05 20:27:50 +0100208}
Andrew Walbrand1d03182022-12-09 18:20:01 +0000209
210/// Logs the given PCI error and returns the appropriate `RebootReason`.
211fn handle_pci_error(e: PciError) -> RebootReason {
212 error!("{}", e);
213 match e {
214 PciError::FdtErrorPci(_)
215 | PciError::FdtNoPci
216 | PciError::FdtErrorReg(_)
217 | PciError::FdtMissingReg
218 | PciError::FdtRegEmpty
219 | PciError::FdtRegMissingSize
220 | PciError::CamWrongSize(_)
221 | PciError::FdtErrorRanges(_)
222 | PciError::FdtMissingRanges
223 | PciError::RangeAddressMismatch { .. }
224 | PciError::NoSuitableRange => RebootReason::InvalidFdt,
Andrew Walbrand1d03182022-12-09 18:20:01 +0000225 }
226}