Attention is currently required from: Michał Żygowski, Maciej Pijanowski, Christian Walter, Krystian Hebel.
Hello Michał Żygowski, Maciej Pijanowski, Krystian Hebel,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/68748
to review the following change.
Change subject: [WIP] security/tpm: add TPM log format as per 2.0 spec ......................................................................
[WIP] security/tpm: add TPM log format as per 2.0 spec
Used by default for all boards with TPM2 which don't specify log format explicitly.
Change-Id: I0fac386bebab1b7104378ae3424957c6497e84e1 Ticket: https://ticket.coreboot.org/issues/422 Ticket: https://ticket.coreboot.org/issues/423 Signed-off-by: Sergii Dmytruk sergii.dmytruk@3mdeb.com --- A src/commonlib/include/commonlib/tpm_log_defs.h M src/security/tpm/Kconfig M src/security/tpm/Makefile.inc A src/security/tpm/tpm2_log_serialized.h M src/security/tpm/tspi.h M src/security/tpm/tspi/crtm.h A src/security/tpm/tspi/log-tpm2.c 7 files changed, 425 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/48/68748/1
diff --git a/src/commonlib/include/commonlib/tpm_log_defs.h b/src/commonlib/include/commonlib/tpm_log_defs.h new file mode 100644 index 0000000..18dc82b --- /dev/null +++ b/src/commonlib/include/commonlib/tpm_log_defs.h @@ -0,0 +1,70 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef __TPM_LOG_DEFS_H__ +#define __TPM_LOG_DEFS_H__ + +#include <stdint.h> +#include <commonlib/helpers.h> + +#define TCG_EFI_SPEC_ID_EVENT_SIGNATURE "Spec ID Event03" + +#define TPM2_ALG_ERROR 0x0000 +#define TPM2_ALG_HMAC 0x0005 +#define TPM2_ALG_NULL 0x0010 +#define TPM2_ALG_SHA1 0x0004 +#define TPM2_ALG_SHA256 0x000B +#define TPM2_ALG_SHA384 0x000C +#define TPM2_ALG_SHA512 0x000D +#define TPM2_ALG_SM3_256 0x0012 + +#define SHA1_DIGEST_SIZE 20 +#define SHA256_DIGEST_SIZE 32 +#define SHA384_DIGEST_SIZE 48 +#define SHA512_DIGEST_SIZE 64 +#define SM3_256_DIGEST_SIZE 32 + +#define MAX_HASH_COUNT 4 + +#define EV_PREBOOT_CERT 0x00000000 +#define EV_POST_CODE 0x00000001 +#define EV_UNUSED 0x00000002 +#define EV_NO_ACTION 0x00000003 +#define EV_SEPARATOR 0x00000004 +#define EV_ACTION 0x00000005 +#define EV_EVENT_TAG 0x00000006 +#define EV_S_CRTM_CONTENTS 0x00000007 +#define EV_S_CRTM_VERSION 0x00000008 +#define EV_CPU_MICROCODE 0x00000009 +#define EV_PLATFORM_CONFIG_FLAGS 0x0000000A +#define EV_TABLE_OF_DEVICES 0x0000000B +#define EV_COMPACT_HASH 0x0000000C +#define EV_IPL 0x0000000D +#define EV_IPL_PARTITION_DATA 0x0000000E +#define EV_NONHOST_CODE 0x0000000F +#define EV_NONHOST_CONFIG 0x00000010 +#define EV_NONHOST_INFO 0x00000011 +#define EV_OMIT_BOOT_DEVICE_EVENTS 0x00000012 + +struct tpm_digest_sizes { + uint16_t alg_id; + uint16_t digest_size; +} __packed; + +struct tcg_efi_spec_id_event { + uint32_t pcr_index; + uint32_t event_type; + uint8_t digest[20]; + uint32_t event_size; + uint8_t signature[16]; + uint32_t platform_class; + uint8_t spec_version_minor; + uint8_t spec_version_major; + uint8_t spec_errata; + uint8_t uintn_size; + uint32_t num_of_algorithms; + struct tpm_digest_sizes digest_sizes[0]; /* variable number of members */ + /* uint8_t vendor_info_size; */ + /* uint8_t vendor_info[vendor_info_size]; */ +} __packed; + +#endif diff --git a/src/security/tpm/Kconfig b/src/security/tpm/Kconfig index 254a951..81506b4 100644 --- a/src/security/tpm/Kconfig +++ b/src/security/tpm/Kconfig @@ -105,12 +105,16 @@ config USE_TPM_LOG_TPM12 bool default n +config USE_TPM_LOG_TPM2 + bool + default n
choice prompt "TPM event log format" depends on TPM_MEASURED_BOOT default TPM_LOG_CB if USE_TPM_LOG_CB default TPM_LOG_TPM12 if TPM1 || USE_TPM_LOG_TPM12 + default TPM_LOG_TPM2 if TPM2 || USE_TPM_LOG_TPM2
config TPM_LOG_CB bool "coreboot's custom format" @@ -121,6 +125,28 @@ help Log per TPM 1.2 specification. See "TCG PC Client Specific Implementation Specification for Conventional BIOS". +config TPM_LOG_TPM2 + bool "TPM 2.0 format" + help + Log per TPM 2.0 specification. + See "TCG PC Client Platform Firmware Profile Specification". + +endchoice + +choice + prompt "TPM2 hashing algorithm" + depends on TPM_MEASURED_BOOT && TPM_LOG_TPM2 + default TPM_HASH_SHA1 if TPM1 + default TPM_HASH_SHA256 if TPM2 + +config TPM_HASH_SHA1 + bool "SHA1" +config TPM_HASH_SHA256 + bool "SHA256" +config TPM_HASH_SHA384 + bool "SHA384" +config TPM_HASH_SHA512 + bool "SHA512"
endchoice
diff --git a/src/security/tpm/Makefile.inc b/src/security/tpm/Makefile.inc index 4540534..f4a5634 100644 --- a/src/security/tpm/Makefile.inc +++ b/src/security/tpm/Makefile.inc @@ -67,4 +67,10 @@ postcar-$(CONFIG_TPM_LOG_TPM12) += tspi/log-tpm12.c bootblock-$(CONFIG_TPM_LOG_TPM12) += tspi/log-tpm12.c
+ramstage-$(CONFIG_TPM_LOG_TPM2) += tspi/log-tpm2.c +romstage-$(CONFIG_TPM_LOG_TPM2) += tspi/log-tpm2.c +verstage-$(CONFIG_TPM_LOG_TPM2) += tspi/log-tpm2.c +postcar-$(CONFIG_TPM_LOG_TPM2) += tspi/log-tpm2.c +bootblock-$(CONFIG_TPM_LOG_TPM2) += tspi/log-tpm2.c + endif # CONFIG_TPM_MEASURED_BOOT diff --git a/src/security/tpm/tpm2_log_serialized.h b/src/security/tpm/tpm2_log_serialized.h new file mode 100644 index 0000000..45f939d --- /dev/null +++ b/src/security/tpm/tpm2_log_serialized.h @@ -0,0 +1,67 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef __TPM2_LOG_SERIALIZED_H__ +#define __TPM2_LOG_SERIALIZED_H__ + +#include <stdint.h> + +#include <commonlib/helpers.h> +#include <commonlib/tpm_log_defs.h> + +#define MAX_TCPA_LOG_ENTRIES 50 +#define TCPA_PCR_HASH_NAME 50 +#define TCPA_PCR_HASH_LEN 10 +/* Assumption of 2K TCPA log size reserved for CAR/SRAM, but depends on hash */ +#define MAX_PRERAM_TCPA_LOG_ENTRIES 15 + +/* + * TPM2.0 log entries can't be generally represented as C structures due to + * varying number of digests and their sizes. However, it works as long as + * we're only using single kind of digests. + */ +#if CONFIG(TPM_LOG_CB) && CONFIG(TPM1) +# define TCPA_DIGEST_MAX_LENGTH SHA1_DIGEST_SIZE +#elif CONFIG(TPM_LOG_CB) && CONFIG(TPM2) +# define TCPA_DIGEST_MAX_LENGTH SHA256_DIGEST_SIZE +#elif CONFIG(TPM_LOG_TPM12) +# define TCPA_DIGEST_MAX_LENGTH SHA1_DIGEST_SIZE +#elif CONFIG(TPM_LOG_TPM2) +# if CONFIG(TPM_HASH_SHA1) +# define TCPA_DIGEST_MAX_LENGTH SHA1_DIGEST_SIZE +# endif +# if CONFIG(TPM_HASH_SHA256) +# define TCPA_DIGEST_MAX_LENGTH SHA256_DIGEST_SIZE +# endif +# if CONFIG(TPM_HASH_SHA384) +# define TCPA_DIGEST_MAX_LENGTH SHA384_DIGEST_SIZE +# endif +# if CONFIG(TPM_HASH_SHA512) +# define TCPA_DIGEST_MAX_LENGTH SHA512_DIGEST_SIZE +# endif +#endif + +#ifndef TCPA_DIGEST_MAX_LENGTH +# error "Misconfiguration: failed to determine TPM hashing algorithm" +#endif + +/* TCG_PCR_EVENT2 */ +struct tcpa_entry { + uint32_t pcr; + uint32_t event_type; + uint32_t digest_count; + uint16_t digest_type; + uint8_t digest[TCPA_DIGEST_MAX_LENGTH]; + uint32_t name_length; + char name[TCPA_PCR_HASH_NAME]; +} __packed; + +struct tcpa_table { + struct tcg_efi_spec_id_event header; /* TCG_PCR_EVENT actually */ + struct tpm_digest_sizes digest_sizes[1]; + uint8_t vendor_info_size; + uint16_t max_entries; + uint16_t num_entries; + struct tcpa_entry entries[0]; /* Variable number of entries */ +} __packed; + +#endif diff --git a/src/security/tpm/tspi.h b/src/security/tpm/tspi.h index 09b7fc0..20b97f4 100644 --- a/src/security/tpm/tspi.h +++ b/src/security/tpm/tspi.h @@ -11,6 +11,8 @@ #include <commonlib/tcpa_log_serialized.h> #elif CONFIG(TPM_LOG_TPM12) #include "tpm12_log_serialized.h" +#elif CONFIG(TPM_LOG_TPM2) +#include "tpm2_log_serialized.h" #endif
#define TPM_PCR_MAX_LEN 64 diff --git a/src/security/tpm/tspi/crtm.h b/src/security/tpm/tspi/crtm.h index ddc25e5..5cdc0e3 100644 --- a/src/security/tpm/tspi/crtm.h +++ b/src/security/tpm/tspi/crtm.h @@ -22,6 +22,19 @@ # define TPM_MEASURE_ALGO VB2_HASH_SHA256 #elif CONFIG(TPM_LOG_TPM12) # define TPM_MEASURE_ALGO VB2_HASH_SHA1 +#elif CONFIG(TPM_LOG_TPM2) +# if CONFIG(TPM_HASH_SHA1) +# define TPM_MEASURE_ALGO VB2_HASH_SHA1 +# endif +# if CONFIG(TPM_HASH_SHA256) +# define TPM_MEASURE_ALGO VB2_HASH_SHA256 +# endif +# if CONFIG(TPM_HASH_SHA384) +# define TPM_MEASURE_ALGO VB2_HASH_SHA384 +# endif +# if CONFIG(TPM_HASH_SHA512) +# define TPM_MEASURE_ALGO VB2_HASH_SHA512 +# endif #endif
#ifndef TPM_MEASURE_ALGO diff --git a/src/security/tpm/tspi/log-tpm2.c b/src/security/tpm/tspi/log-tpm2.c new file mode 100644 index 0000000..1d911db --- /dev/null +++ b/src/security/tpm/tspi/log-tpm2.c @@ -0,0 +1,226 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +/* + * Unlike log.c this implements TCPA log according to TPM2 specification + * rather then using coreboot-specific log format. + * + * First entry is in TPM1.2 format and serves as a header, the rest are in + * a newer (agile) format which supports SHA256 and multiple hashes, but we + * store only one hash. + * + * This is defined in "TCG EFI Protocol Specification". + */ + +#include <endian.h> +#include <console/console.h> +#include <security/tpm/tspi.h> +#include <security/tpm/tspi/crtm.h> +#include <region_file.h> +#include <string.h> +#include <symbols.h> +#include <cbmem.h> +#include <bootstate.h> +#include <vb2_sha.h> + +static uint16_t tpmalg_from_vb2_hash(enum vb2_hash_algorithm hash_type) +{ + switch (hash_type) { + case VB2_HASH_SHA1: + return TPM2_ALG_SHA1; + case VB2_HASH_SHA256: + return TPM2_ALG_SHA256; + case VB2_HASH_SHA384: + return TPM2_ALG_SHA384; + case VB2_HASH_SHA512: + return TPM2_ALG_SHA512; + + default: + return 0xFF; + } +} + +static struct tcpa_table *tcpa_cbmem_init(void) +{ + static struct tcpa_table *tclt; + if (tclt) + return tclt; + + if (cbmem_possibly_online()) { + size_t tcpa_log_len; + struct tcg_efi_spec_id_event *hdr; + + tclt = cbmem_find(CBMEM_ID_TPM_LOG); + if (tclt) + return tclt; + + tcpa_log_len = sizeof(struct tcpa_table) + + MAX_TCPA_LOG_ENTRIES * sizeof(struct tcpa_entry); + tclt = cbmem_add(CBMEM_ID_TPM_LOG, tcpa_log_len); + if (!tclt) + return NULL; + + memset(tclt, 0, tcpa_log_len); + hdr = &tclt->header; + + hdr->event_type = htole32(EV_NO_ACTION); + hdr->event_size = htole32(37); + strcpy((char *)hdr->signature, TCG_EFI_SPEC_ID_EVENT_SIGNATURE); + hdr->platform_class = htole32(0x00); // client platform + hdr->spec_version_minor = 0x00; + hdr->spec_version_major = 0x02; + hdr->spec_errata = 0x00; + hdr->uintn_size = 0x02; // 64-bit UINT + hdr->num_of_algorithms = htole32(1); + hdr->digest_sizes[0].alg_id = htole16(tpmalg_from_vb2_hash(TPM_MEASURE_ALGO)); + hdr->digest_sizes[0].digest_size = htole16(vb2_digest_size(TPM_MEASURE_ALGO)); + + tclt->vendor_info_size = sizeof(tclt->max_entries) + sizeof(tclt->num_entries); + tclt->max_entries = MAX_TCPA_LOG_ENTRIES; + tclt->num_entries = 0; + } + + return tclt; +} + +struct tcpa_table *tcpa_log_init(void) +{ + static struct tcpa_table *tclt; + + /* We are dealing here with pre CBMEM environment. + * If cbmem isn't available use CAR or SRAM */ + if (!cbmem_possibly_online() && + !CONFIG(VBOOT_RETURN_FROM_VERSTAGE)) + return (struct tcpa_table *)_tpm_tcpa_log; + else if (ENV_ROMSTAGE && + !CONFIG(VBOOT_RETURN_FROM_VERSTAGE)) { + tclt = tcpa_cbmem_init(); + if (!tclt) + return (struct tcpa_table *)_tpm_tcpa_log; + } else { + tclt = tcpa_cbmem_init(); + } + + return tclt; +} + +void tcpa_log_dump(void *unused) +{ + int i, j; + struct tcpa_table *tclt; + int hash_size; + const char *alg_name; + + tclt = tcpa_log_init(); + if (!tclt) + return; + + hash_size = vb2_digest_size(TPM_MEASURE_ALGO); + alg_name = vb2_get_hash_algorithm_name(TPM_MEASURE_ALGO); + + printk(BIOS_INFO, "coreboot TCPA measurements:\n\n"); + for (i = 0; i < tclt->num_entries; i++) { + struct tcpa_entry *tce = &tclt->entries[i]; + + printk(BIOS_INFO, " PCR-%u ", le32toh(tce->pcr)); + + for (j = 0; j < hash_size; j++) + printk(BIOS_INFO, "%02x", tce->digest[j]); + + printk(BIOS_INFO, " %s [%s]\n", alg_name, tce->name); + } + printk(BIOS_INFO, "\n"); +} + +void tcpa_log_add_table_entry(const char *name, const uint32_t pcr, + enum vb2_hash_algorithm digest_algo, + const uint8_t *digest, + const size_t digest_len) +{ + struct tcpa_table *tclt; + struct tcpa_entry *tce; + + tclt = tcpa_log_init(); + if (!tclt) { + printk(BIOS_WARNING, "TCPA: Log non-existent!\n"); + return; + } + + if (digest_algo != TPM_MEASURE_ALGO) { + printk(BIOS_WARNING, "TCPA: digest is of unsupported type: %s\n", + vb2_get_hash_algorithm_name(digest_algo)); + return; + } + + if (digest_len != vb2_digest_size(TPM_MEASURE_ALGO)) { + printk(BIOS_WARNING, "TCPA: digest has invalid length: %d\n", (int)digest_len); + return; + } + + if (tclt->num_entries >= tclt->max_entries) { + printk(BIOS_WARNING, "TCPA: TCPA log table is full\n"); + return; + } + + if (!name) { + printk(BIOS_WARNING, "TCPA: TCPA entry name not set\n"); + return; + } + + tce = &tclt->entries[tclt->num_entries++]; + + tce->pcr = htole32(pcr); + tce->event_type = htole32(EV_ACTION); + + tce->digest_count = htole32(1); + tce->digest_type = htole16(tpmalg_from_vb2_hash(TPM_MEASURE_ALGO)); + memcpy(tce->digest, digest, vb2_digest_size(TPM_MEASURE_ALGO)); + + tce->name_length = htole32(TCPA_PCR_HASH_NAME); + strncpy(tce->name, name, TCPA_PCR_HASH_NAME - 1); +} + +void tcpa_preram_log_clear(void) +{ + printk(BIOS_INFO, "TCPA: Clearing coreboot TCPA log\n"); + struct tcpa_table *tclt = (struct tcpa_table *)_tpm_tcpa_log; + tclt->max_entries = MAX_TCPA_LOG_ENTRIES; + tclt->num_entries = 0; +} + +#if !CONFIG(VBOOT_RETURN_FROM_VERSTAGE) +static void recover_tcpa_log(int is_recovery) +{ + struct tcpa_table *preram_log = (struct tcpa_table *)_tpm_tcpa_log; + struct tcpa_table *ram_log = NULL; + int i; + + if (preram_log->num_entries > MAX_PRERAM_TCPA_LOG_ENTRIES) { + printk(BIOS_WARNING, + "TCPA: Pre-RAM TCPA log is too full, possible corruption\n"); + return; + } + + ram_log = tcpa_cbmem_init(); + if (!ram_log) { + printk(BIOS_WARNING, "TCPA: CBMEM not available something went wrong\n"); + return; + } + + for (i = 0; i < preram_log->num_entries; i++) { + struct tcpa_entry *tce = &ram_log->entries[ram_log->num_entries++]; + + tce->pcr = preram_log->entries[i].pcr; + tce->event_type = preram_log->entries[i].event_type; + + tce->digest_count = preram_log->entries[i].digest_count; + tce->digest_type = preram_log->entries[i].digest_type; + memcpy(tce->digest, preram_log->entries[i].digest, sizeof(tce->digest)); + + tce->name_length = preram_log->entries[i].name_length; + strncpy(tce->name, preram_log->entries[i].name, TCPA_PCR_HASH_NAME - 1); + } +} +CBMEM_CREATION_HOOK(recover_tcpa_log); +#endif + +BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_BOOT, BS_ON_ENTRY, tcpa_log_dump, NULL);