src/security/tpm/tspi/log-tpm2.c

   1 /* SPDX-License-Identifier: GPL-2.0-only */
   2
   3 /*
   4  * Unlike log.c this implements TPM log according to TPM2.0 specification
   5  * rather then using coreboot-specific log format.
   6  *
   7  * First entry is in TPM1.2 format and serves as a header, the rest are in
   8  * a newer (agile) format which supports SHA256 and multiple hashes, but we
   9  * store only one hash.
  10  *
  11  * This is defined in "TCG EFI Protocol Specification".
  12  */
  13
  14 #include <endian.h>
  15 #include <console/console.h>
  16 #include <security/tpm/tspi.h>
  17 #include <security/tpm/tspi/crtm.h>
  18 #include <security/tpm/tspi/logs.h>
  19 #include <region_file.h>
  20 #include <string.h>
  21 #include <symbols.h>
  22 #include <cbmem.h>
  23 #include <vb2_sha.h>
  24
  25 static uint16_t tpmalg_from_vb2_hash(enum vb2_hash_algorithm hash_type)
  26 {
  27         switch (hash_type) {
  28         case VB2_HASH_SHA1:
  29                 return TPM2_ALG_SHA1;
  30         case VB2_HASH_SHA256:
  31                 return TPM2_ALG_SHA256;
  32         case VB2_HASH_SHA384:
  33                 return TPM2_ALG_SHA384;
  34         case VB2_HASH_SHA512:
  35                 return TPM2_ALG_SHA512;
  36
  37         default:
  38                 return 0xFF;
  39         }
  40 }
  41
  42 void *tpm2_log_cbmem_init(void)
  43 {
  44         static struct tpm_2_log_table *tclt;
  45         if (tclt)
  46                 return tclt;
  47
  48         if (ENV_HAS_CBMEM) {
  49                 size_t tpm_log_len;
  50                 struct tcg_efi_spec_id_event *hdr;
  51
  52                 tclt = cbmem_find(CBMEM_ID_TPM2_TCG_LOG);
  53                 if (tclt)
  54                         return tclt;
  55
  56                 tpm_log_len = sizeof(struct tpm_2_log_table) +
  57                         MAX_TPM_LOG_ENTRIES * sizeof(struct tpm_2_log_entry);
  58                 tclt = cbmem_add(CBMEM_ID_TPM2_TCG_LOG, tpm_log_len);
  59                 if (!tclt)
  60                         return NULL;
  61
  62                 memset(tclt, 0, tpm_log_len);
  63                 hdr = &tclt->header;
  64
  65                 hdr->event_type = htole32(EV_NO_ACTION);
  66                 hdr->event_size = htole32(33 + sizeof(tclt->vendor));
  67                 strcpy((char *)hdr->signature, TPM_20_SPEC_ID_EVENT_SIGNATURE);
  68                 hdr->platform_class = htole32(0x00); // client platform
  69                 hdr->spec_version_minor = 0x00;
  70                 hdr->spec_version_major = 0x02;
  71                 hdr->spec_errata = 0x00;
  72                 hdr->uintn_size = 0x02; // 64-bit UINT
  73                 hdr->num_of_algorithms = htole32(1);
  74                 hdr->digest_sizes[0].alg_id = htole16(tpmalg_from_vb2_hash(TPM_MEASURE_ALGO));
  75                 hdr->digest_sizes[0].digest_size = htole16(vb2_digest_size(TPM_MEASURE_ALGO));
  76
  77                 tclt->vendor_info_size = sizeof(tclt->vendor);
  78                 tclt->vendor.reserved = 0;
  79                 tclt->vendor.version_major = TPM_20_LOG_VI_MAJOR;
  80                 tclt->vendor.version_minor = TPM_20_LOG_VI_MINOR;
  81                 tclt->vendor.magic = htole32(TPM_20_LOG_VI_MAGIC);
  82                 tclt->vendor.max_entries = htole16(MAX_TPM_LOG_ENTRIES);
  83                 tclt->vendor.num_entries = htole16(0);
  84                 tclt->vendor.entry_size = htole32(sizeof(struct tpm_2_log_entry));
  85         }
  86
  87         return tclt;
  88 }
  89
  90 void tpm2_log_dump(void)
  91 {
  92         int i, j;
  93         struct tpm_2_log_table *tclt;
  94         int hash_size;
  95         const char *alg_name;
  96
  97         tclt = tpm_log_init();
  98         if (!tclt)
  99                 return;
 100
 101         hash_size = vb2_digest_size(TPM_MEASURE_ALGO);
 102         alg_name = vb2_get_hash_algorithm_name(TPM_MEASURE_ALGO);
 103
 104         printk(BIOS_INFO, "coreboot TPM 2.0 measurements:\n\n");
 105         for (i = 0; i < le16toh(tclt->vendor.num_entries); i++) {
 106                 struct tpm_2_log_entry *tce = &tclt->entries[i];
 107
 108                 printk(BIOS_INFO, " PCR-%u ", le32toh(tce->pcr));
 109
 110                 for (j = 0; j < hash_size; j++)
 111                         printk(BIOS_INFO, "%02x", tce->digest[j]);
 112
 113                 printk(BIOS_INFO, " %s [%s]\n", alg_name, tce->data);
 114         }
 115         printk(BIOS_INFO, "\n");
 116 }
 117
 118 void tpm2_log_add_table_entry(const char *name, const uint32_t pcr,
 119                               enum vb2_hash_algorithm digest_algo,
 120                               const uint8_t *digest,
 121                               const size_t digest_len)
 122 {
 123         struct tpm_2_log_table *tclt;
 124         struct tpm_2_log_entry *tce;
 125
 126         tclt = tpm_log_init();
 127         if (!tclt) {
 128                 printk(BIOS_WARNING, "TPM LOG: non-existent!\n");
 129                 return;
 130         }
 131
 132         if (!name) {
 133                 printk(BIOS_WARNING, "TPM LOG: entry name not set\n");
 134                 return;
 135         }
 136
 137         if (digest_algo != TPM_MEASURE_ALGO) {
 138                 printk(BIOS_WARNING, "TPM LOG: digest is of unsupported type: %s\n",
 139                        vb2_get_hash_algorithm_name(digest_algo));
 140                 return;
 141         }
 142
 143         if (digest_len != vb2_digest_size(TPM_MEASURE_ALGO)) {
 144                 printk(BIOS_WARNING, "TPM LOG: digest has invalid length: %d\n",
 145                        (int)digest_len);
 146                 return;
 147         }
 148
 149         if (le16toh(tclt->vendor.num_entries) >= le16toh(tclt->vendor.max_entries)) {
 150                 printk(BIOS_WARNING, "TPM LOG: log table is full\n");
 151                 return;
 152         }
 153
 154         tce = &tclt->entries[le16toh(tclt->vendor.num_entries)];
 155         tclt->vendor.num_entries = htole16(le16toh(tclt->vendor.num_entries) + 1);
 156
 157         tce->pcr = htole32(pcr);
 158         tce->event_type = htole32(EV_ACTION);
 159
 160         tce->digest_count = htole32(1);
 161         tce->digest_type = htole16(tpmalg_from_vb2_hash(TPM_MEASURE_ALGO));
 162         memcpy(tce->digest, digest, vb2_digest_size(TPM_MEASURE_ALGO));
 163
 164         tce->data_length = htole32(sizeof(tce->data));
 165         strncpy((char *)tce->data, name, sizeof(tce->data) - 1);
 166         tce->data[sizeof(tce->data) - 1] = '\0';
 167 }
 168
 169 int tpm2_log_get(int entry_idx, int *pcr, const uint8_t **digest_data,
 170                  enum vb2_hash_algorithm *digest_algo, const char **event_name)
 171 {
 172         struct tpm_2_log_table *tclt;
 173         struct tpm_2_log_entry *tce;
 174
 175         tclt = tpm_log_init();
 176         if (!tclt)
 177                 return 1;
 178
 179         if (entry_idx < 0 || entry_idx >= le16toh(tclt->vendor.num_entries))
 180                 return 1;
 181
 182         tce = &tclt->entries[entry_idx];
 183
 184         *pcr = le32toh(tce->pcr);
 185         *digest_data = tce->digest;
 186         *digest_algo = TPM_MEASURE_ALGO; /* We validate algorithm on addition */
 187         *event_name = (char *)tce->data;
 188         return 0;
 189 }
 190
 191 uint16_t tpm2_log_get_size(const void *log_table)
 192 {
 193         const struct tpm_2_log_table *tclt = log_table;
 194         return le16toh(tclt->vendor.num_entries);
 195 }
 196
 197 void tpm2_preram_log_clear(void)
 198 {
 199         printk(BIOS_INFO, "TPM LOG: clearing the log\n");
 200         /*
 201          * Pre-RAM log is only for internal use and isn't exported anywhere, hence it's header
 202          * is not initialized.
 203          */
 204         struct tpm_2_log_table *tclt = (struct tpm_2_log_table *)_tpm_log;
 205         tclt->vendor.max_entries = htole16(MAX_TPM_LOG_ENTRIES);
 206         tclt->vendor.num_entries = htole16(0);
 207 }
 208
 209 void tpm2_log_copy_entries(const void *from, void *to)
 210 {
 211         const struct tpm_2_log_table *from_log = from;
 212         struct tpm_2_log_table *to_log = to;
 213         int i;
 214
 215         for (i = 0; i < le16toh(from_log->vendor.num_entries); i++) {
 216                 if (le16toh(to_log->vendor.num_entries) >= le16toh(to_log->vendor.max_entries)) {
 217                         printk(BIOS_WARNING, "TPM LOG: log table is full\n");
 218                         return;
 219                 }
 220
 221                 struct tpm_2_log_entry *tce =
 222                         &to_log->entries[le16toh(to_log->vendor.num_entries)];
 223                 to_log->vendor.num_entries = htole16(le16toh(to_log->vendor.num_entries) + 1);
 224
 225                 tce->pcr = from_log->entries[i].pcr;
 226                 tce->event_type = from_log->entries[i].event_type;
 227
 228                 tce->digest_count = from_log->entries[i].digest_count;
 229                 tce->digest_type = from_log->entries[i].digest_type;
 230                 memcpy(tce->digest, from_log->entries[i].digest, sizeof(tce->digest));
 231
 232                 tce->data_length = from_log->entries[i].data_length;
 233                 memcpy(tce->data, from_log->entries[i].data, sizeof(tce->data));
 234         }
 235 }