From 6da62684dee6b2df49fa1d51e74e14c181c9349e Mon Sep 17 00:00:00 2001 From: Sergii Dmytruk Date: Sun, 23 Oct 2022 00:55:03 +0300 Subject: util/cbmem: add parsing of TPM logs per specs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CBMEM can contain log in different forms (at most one is present): - coreboot-specific format (CBMEM_ID_TPM_CB_LOG exported as LB_TAG_TPM_CB_LOG) - TPM1.2 format (CBMEM_ID_TCPA_TCG_LOG) - TPM2 format (CBMEM_ID_TPM2_TCG_LOG) The last two follow specifications by Trusted Computing Group, but until now cbmem couldn't print them. These formats were added not so long ago in: - commit 4191dbf0c9a5 ("security/tpm: add TPM log format as per 1.2 spec") - commit 53db677586e3 ("security/tpm: add TPM log format as per 2.0 spec") These changes make cbmem utility check for existence of TPM1.2/TPM2 logs in CBMEM and add code necessary for parsing and printing of their entries. TEST=`cbmem -L` for CONFIG_TPM1=y case TCPA log: Specification: 1.21 Platform class: PC Client TCPA log entry 1: PCR: 2 Event type: Action Digest: 5622416ea417186aa1ac32b32c527ac09009fb5e Event data: FMAP: FMAP TEST=`cbmem -L` for CONFIG_TPM2=y case TPM2 log: Specification: 2.00 Platform class: PC Client TPM2 log entry 1: PCR: 2 Event type: Action Digests: SHA256: 68d27f08cb261463a6d004524333ac5db1a3c2166721785a6061327b6538657c Event data: FMAP: FMAP Change-Id: Ib76dc7dec56dd1789a219539a1ac05a958f47a5c Ticket: https://ticket.coreboot.org/issues/425 Signed-off-by: Krystian Hebel Signed-off-by: Michał Żygowski Signed-off-by: Sergii Dmytruk Reviewed-on: https://review.coreboot.org/c/coreboot/+/68749 Reviewed-by: Paul Menzel Tested-by: build bot (Jenkins) --- .../bsd/include/commonlib/bsd/tpm_log_defs.h | 64 ++++++++++++++++++++++ 1 file changed, 64 insertions(+) (limited to 'src/commonlib/bsd/include') diff --git a/src/commonlib/bsd/include/commonlib/bsd/tpm_log_defs.h b/src/commonlib/bsd/include/commonlib/bsd/tpm_log_defs.h index 3a754173e5..041b636574 100644 --- a/src/commonlib/bsd/include/commonlib/bsd/tpm_log_defs.h +++ b/src/commonlib/bsd/include/commonlib/bsd/tpm_log_defs.h @@ -9,6 +9,26 @@ #define TCPA_SPEC_ID_EVENT_SIGNATURE "Spec ID Event00" #define TCG_EFI_SPEC_ID_EVENT_SIGNATURE "Spec ID Event03" +struct tcpa_log_entry { + uint32_t pcr; + uint32_t event_type; + uint8_t digest[20]; + uint32_t event_data_size; + uint8_t event[0]; +} __packed; + +struct tcpa_spec_entry { + struct tcpa_log_entry entry; + uint8_t signature[16]; + uint32_t platform_class; + uint8_t spec_version_minor; + uint8_t spec_version_major; + uint8_t spec_errata; + uint8_t reserved; + uint8_t vendor_info_size; + uint8_t vendor_info[0]; +} __packed; + #define TPM2_ALG_ERROR 0x0000 #define TPM2_ALG_HMAC 0x0005 #define TPM2_ALG_NULL 0x0010 @@ -56,6 +76,28 @@ struct spec_id_event_data { uint8_t vendor_info_size; } __packed; +union tpm_hash_digest { + uint8_t sha1[SHA1_DIGEST_SIZE]; + uint8_t sha256[SHA256_DIGEST_SIZE]; + uint8_t sm3_256[SM3_256_DIGEST_SIZE]; + uint8_t sha384[SHA384_DIGEST_SIZE]; + uint8_t sha512[SHA512_DIGEST_SIZE]; +}; + +struct tpm_hash_algorithm { + uint16_t hashAlg; + union tpm_hash_digest digest; +} __packed; + +struct tcg_pcr_event2_header { + uint32_t pcr_index; + uint32_t event_type; + uint32_t digest_count; + uint8_t digests[0]; + /* uint32_t event_size; */ + /* uint8_t event[0]; */ +} __packed; + struct tpm_digest_sizes { uint16_t alg_id; uint16_t digest_size; @@ -78,4 +120,26 @@ struct tcg_efi_spec_id_event { /* uint8_t vendor_info[vendor_info_size]; */ } __packed; +static const char *tpm_event_types[] __maybe_unused = { + [EV_PREBOOT_CERT] = "Reserved", + [EV_POST_CODE] = "POST code", + [EV_UNUSED] = "Unused", + [EV_NO_ACTION] = "No action", + [EV_SEPARATOR] = "Separator", + [EV_ACTION] = "Action", + [EV_EVENT_TAG] = "Event tag", + [EV_S_CRTM_CONTENTS] = "S-CRTM contents", + [EV_S_CRTM_VERSION] = "S-CRTM version", + [EV_CPU_MICROCODE] = "CPU microcode", + [EV_PLATFORM_CONFIG_FLAGS] = "Platform configuration flags", + [EV_TABLE_OF_DEVICES] = "Table of devices", + [EV_COMPACT_HASH] = "Compact hash", + [EV_IPL] = "IPL", + [EV_IPL_PARTITION_DATA] = "IPL partition data", + [EV_NONHOST_CODE] = "Non-host code", + [EV_NONHOST_CONFIG] = "Non-host configuration", + [EV_NONHOST_INFO] = "Non-host information", + [EV_OMIT_BOOT_DEVICE_EVENTS] = "Omit boot device events", +}; + #endif -- cgit v1.2.3