Repository: chipsalliance/caliptra-sw (rust)

Issue:
Runtime not generating TCI nodes for measurements that were stashed from ROM
ROM stashes measurements to fht.meas_log_addr and in PCR31.
I don't see consumption of those measurements from either source in the runtime FW. Runtime should call DeriveChild with the DefaultContext for each one of the stashed measurements.

Pull request description:
Add ROM's stashed measurements to DPE in runtime
Fixes #1079 

Patch:
diff --git a/error/src/lib.rs b/error/src/lib.rs
index c6c3bc23..44d8813a 100644
--- a/error/src/lib.rs
+++ b/error/src/lib.rs
@@ -356,6 +356,8 @@ impl CaliptraError {
     pub const RUNTIME_GLOBAL_WDT_EXPIRED: CaliptraError = CaliptraError::new_const(0x000E001F);
     pub const RUNTIME_IDEV_CERT_POPULATION_FAILED: CaliptraError =
         CaliptraError::new_const(0x000E0021);
+    pub const RUNTIME_ADD_ROM_MEASUREMENTS_TO_DPE_FAILED: CaliptraError =
+        CaliptraError::new_const(0x000E0022);
 
     /// FMC Errors
     pub const FMC_GLOBAL_NMI: CaliptraError = CaliptraError::new_const(0x000F0001);
diff --git a/runtime/README.md b/runtime/README.md
index 8149e9fe..2a4e26f1 100644
--- a/runtime/README.md
+++ b/runtime/README.md
@@ -598,6 +598,10 @@ Caliptra Runtime firmware is responsible for initializing DPE’s Default Contex
 * Set flag in the TCI Node that this node was created by the DPE implementation.
   This will be used to set the VENDOR\_INFO field in TcbInfo to “VNDR”.
 
+When initializing DPE, Runtime Firmware shall also add each of ROM's stashed 
+measurements to DPE. To do so, it should call DeriveChild for each measurement
+in the measurement log. 
+
 *Note: the Runtime CDI (from KeyVault) will be used as-needed and will not be
 accessed during initialization.*
 
diff --git a/runtime/src/drivers.rs b/runtime/src/drivers.rs
index f0d02111..b13ffe88 100644
--- a/runtime/src/drivers.rs
+++ b/runtime/src/drivers.rs
@@ -275,6 +275,28 @@ impl Drivers {
         .execute(&mut dpe, &mut env, locality)
         .map_err(|_| CaliptraError::RUNTIME_INITIALIZE_DPE_FAILED)?;
 
+        // Call DeriveChild to create TCIs for each measurement added in ROM
+        let num_measurements = drivers.persistent_data.get().fht.meas_log_index as usize;
+        let measurement_log = drivers.persistent_data.get().measurement_log;
+        for measurement_log_entry in measurement_log.iter().take(num_measurements) {
+            let measurement_data = measurement_log_entry.pcr_entry.measured_data();
+            let tci_type = u32::from_be_bytes(measurement_log_entry.metadata);
+            DeriveChildCmd {
+                handle: ContextHandle::default(),
+                data: measurement_data
+                    .try_into()
+                    .map_err(|_| CaliptraError::RUNTIME_ADD_ROM_MEASUREMENTS_TO_DPE_FAILED)?,
+                flags: DeriveChildFlags::MAKE_DEFAULT
+                    | DeriveChildFlags::CHANGE_LOCALITY
+                    | DeriveChildFlags::INPUT_ALLOW_CA
+                    | DeriveChildFlags::INPUT_ALLOW_X509,
+                tci_type,
+                target_locality: locality,
+            }
+            .execute(&mut dpe, &mut env, locality)
+            .map_err(|_| CaliptraError::RUNTIME_ADD_ROM_MEASUREMENTS_TO_DPE_FAILED)?;
+        }
+
         // Write DPE to persistent data.
         drivers.persistent_data.get_mut().dpe = dpe;
         Ok(())


Test patch:
diff --git a/runtime/doc/test-coverage.md b/runtime/doc/test-coverage.md
index 79d8e3ac..7a0a954f 100644
--- a/runtime/doc/test-coverage.md
+++ b/runtime/doc/test-coverage.md
@@ -74,4 +74,5 @@ Test Scenario| Test Name | Runtime Error Code
 Check validation of DPE structure after a warm/update reset and ensure that validation fails if the DPE's SRAM bytes are maliciously edited | N/A | N/A
 Verify the RT Journey PCR on a warm reset | N/A | N/A
 Check that the RT Journey PCR was updated correctly on update reset | N/A | N/A
-Check if disable attestation was called when the mailbox is executing a command during a warm reset | N/A | N/A
\ No newline at end of file
+Check if disable attestation was called when the mailbox is executing a command during a warm reset | N/A | N/A
+Check that measurements in the measurement log are added to DPE upon initializing drivers | N/A | N/A
\ No newline at end of file