1DRTM Proof of Concept 2===================== 3 4Dynamic Root of Trust for Measurement (DRTM) begins a new trust environment 5by measuring and executing a protected payload. 6 7Static Root of Trust for Measurement (SRTM)/Measured Boot implementation, 8currently used by TF-A covers all firmwares, from the boot ROM to the normal 9world bootloader. As a whole, they make up the system's TCB. These boot 10measurements allow attesting to what software is running on the system and 11enable enforcing security policies. 12 13As the boot chain grows or firmware becomes dynamically extensible, 14establishing an attestable TCB becomes more challenging. DRTM provides a 15solution to this problem by allowing measurement chains to be started at 16any time. As these measurements are stored separately from the boot-time 17measurements, they reduce the size of the TCB, which helps reduce the attack 18surface and the risk of untrusted code executing, which could compromise 19the security of the system. 20 21Components 22~~~~~~~~~~ 23 24 - **DCE-Preamble**: The DCE Preamble prepares the platform for DRTM by 25 doing any needed configuration, loading the target payload image(DLME), 26 and preparing input parameters needed by DRTM. Finally, it invokes the 27 DL Event to start the dynamic launch. 28 29 - **D-CRTM**: The D-CRTM is the trust anchor (or root of trust) for the 30 DRTM boot sequence and is where the dynamic launch starts. The D-CRTM 31 must be implemented as a trusted agent in the system. The D-CRTM 32 initializes the TPM for DRTM and prepares the environment for the next 33 stage of DRTM, the DCE. The D-CRTM measures the DCE, verifies its 34 signature, and transfers control to it. 35 36 - **DCE**: The DCE executes on an application core. The DCE verifies the 37 system’s state, measures security-critical attributes of the system, 38 prepares the memory region for the target payload, measures the payload, 39 and finally transfers control to the payload. 40 41 - **DLME**: The protected payload is referred to as the Dynamically Launched 42 Measured Environment, or DLME. The DLME begins execution in a safe state, 43 with a single thread of execution, DMA protections, and interrupts 44 disabled. The DCE provides data to the DLME that it can use to verify the 45 configuration of the system. 46 47In this proof of concept, DCE and D-CRTM are implemented in BL31 and 48DCE-Preamble and DLME are implemented in UEFI application. A DL Event is 49triggered as a SMC by DCE-Preamble and handled by D-CRTM, which launches the 50DLME via DCE. 51 52This manual provides instructions to build TF-A code with pre-buit EDK2 53and DRTM UEFI application. 54 55Building the PoC for the Arm FVP platform 56~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 57 58(1) Use the below command to clone TF-A source code - 59 60.. code:: shell 61 62 $ git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git 63 64(2) There are prebuilt binaries required to execute the DRTM implementation 65 in the `prebuilts-drtm-bins`_. 66 Download EDK2 *FVP_AARCH64_EFI.fd* and UEFI DRTM application *test-disk.img* 67 binary from `prebuilts-drtm-bins`_. 68 69(3) Build the TF-A code using below command 70 71.. code:: shell 72 73 $ make CROSS_COMPILE=aarch64-none-elf- ARM_ROTPK_LOCATION=devel_rsa 74 DEBUG=1 V=1 BL33=</path/to/FVP_AARCH64_EFI.fd> DRTM_SUPPORT=1 75 MBEDTLS_DIR=</path/to/mbedTLS-source> USE_ROMLIB=1 all fip 76 77Running DRTM UEFI application on the Armv8-A AEM FVP 78~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 79To run the DRTM test application along with DRTM implementation in BL31, 80you need an FVP model. Please use the version of FVP_Base_RevC-2xAEMvA model 81advertised in the TF-A documentation. 82 83.. code:: shell 84 85 FVP_Base_RevC-2xAEMvA \ 86 --data cluster0.cpu0=</path/to/romlib.bin>@0x03ff2000 \ 87 --stat \ 88 -C bp.flashloader0.fname=<path/to/fip.bin> \ 89 -C bp.secureflashloader.fname=<path/to/bl1.bin> \ 90 -C bp.ve_sysregs.exit_on_shutdown=1 \ 91 -C bp.virtioblockdevice.image_path=<path/to/test-disk.img> \ 92 -C cache_state_modelled=1 \ 93 -C cluster0.check_memory_attributes=0 \ 94 -C cluster0.cpu0.etm-present=0 \ 95 -C cluster0.cpu1.etm-present=0 \ 96 -C cluster0.cpu2.etm-present=0 \ 97 -C cluster0.cpu3.etm-present=0 \ 98 -C cluster0.stage12_tlb_size=1024 \ 99 -C cluster1.check_memory_attributes=0 \ 100 -C cluster1.cpu0.etm-present=0 \ 101 -C cluster1.cpu1.etm-present=0 \ 102 -C cluster1.cpu2.etm-present=0 \ 103 -C cluster1.cpu3.etm-present=0 \ 104 -C cluster1.stage12_tlb_size=1024 \ 105 -C pctl.startup=0.0.0.0 \ 106 -Q 1000 \ 107 "$@" 108 109The bottom of the output from *uart1* should look something like the 110following to indicate that the last SMC to unprotect memory has been fired 111successfully. 112 113.. code-block:: shell 114 115 ... 116 117 INFO: DRTM service handler: version 118 INFO: ++ DRTM service handler: TPM features 119 INFO: ++ DRTM service handler: Min. mem. requirement features 120 INFO: ++ DRTM service handler: DMA protection features 121 INFO: ++ DRTM service handler: Boot PE ID features 122 INFO: ++ DRTM service handler: TCB-hashes features 123 INFO: DRTM service handler: dynamic launch 124 WARNING: DRTM service handler: close locality is not supported 125 INFO: DRTM service handler: unprotect mem 126 127-------------- 128 129*Copyright (c) 2022, Arm Limited. All rights reserved.* 130 131.. _prebuilts-drtm-bins: https://downloads.trustedfirmware.org/tf-a/drtm 132.. _DRTM-specification: https://developer.arm.com/documentation/den0113/a 133