security/tpm: Fix TCPA log feature

Until now the TCPA log wasn't working correctly.

* Refactor TCPA log code.
* Add TCPA log dump fucntion.
* Make TCPA log available in bootblock.
* Fix TCPA log formatting.
* Add x86 and Cavium memory for early log.

Change-Id: Ic93133531b84318f48940d34bded48cbae739c44
Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/29563
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>

4 files changed, 179 insertions, 49 deletions

diff --git a/src/security/tpm/Makefile.inc b/src/security/tpm/Makefile.inc
index 34ead8f07d..c05fb55a88 100644
--- a/src/security/tpm/Makefile.inc
+++ b/src/security/tpm/Makefile.inc
@@ -12,11 +12,16 @@ postcar-$(CONFIG_VBOOT) += tss/tcg-1.2/tss.c
 
 ## TSPI
 
-ramstage-y += tspi/tspi.c tspi/log.c
-romstage-y += tspi/tspi.c tspi/log.c
+ramstage-y += tspi/tspi.c
+romstage-y += tspi/tspi.c
 
-verstage-$(CONFIG_VBOOT) += tspi/tspi.c tspi/log.c
-postcar-$(CONFIG_VBOOT) += tspi/tspi.c tspi/log.c
+verstage-$(CONFIG_VBOOT) += tspi/tspi.c
+postcar-$(CONFIG_VBOOT) += tspi/tspi.c
+
+ramstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+romstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+verstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+postcar-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
 
 endif # CONFIG_TPM1
 
@@ -36,10 +41,15 @@ postcar-$(CONFIG_VBOOT) += tss/tcg-2.0/tss.c
 
 ## TSPI
 
-ramstage-y += tspi/tspi.c tspi/log.c
-romstage-y += tspi/tspi.c tspi/log.c
+ramstage-y += tspi/tspi.c
+romstage-y += tspi/tspi.c
+
+verstage-$(CONFIG_VBOOT) += tspi/tspi.c
+postcar-$(CONFIG_VBOOT) += tspi/tspi.c
 
-verstage-$(CONFIG_VBOOT) += tspi/tspi.c tspi/log.c
-postcar-$(CONFIG_VBOOT) += tspi/tspi.c tspi/log.c
+ramstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+romstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+verstage-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
+postcar-$(CONFIG_VBOOT_MEASURED_BOOT) += tspi/log.c
 
 endif # CONFIG_TPM2
diff --git a/src/security/tpm/tspi.h b/src/security/tpm/tspi.h
index d69b97695d..55f883c481 100644
--- a/src/security/tpm/tspi.h
+++ b/src/security/tpm/tspi.h
@@ -21,26 +21,46 @@
 #include <security/tpm/tss.h>
 #include <commonlib/tcpa_log_serialized.h>
 #include <commonlib/region.h>
+#include <vb2_api.h>
 
-#define TPM_PCR_MAX_LEN		64
-#define HASH_DATA_CHUNK_SIZE	1024
+#define TPM_PCR_MAX_LEN 64
+#define HASH_DATA_CHUNK_SIZE 1024
+
+/**
+ * Clears the pre-RAM tcpa log data and initializes
+ * any content with default values
+ */
+void tcpa_preram_log_clear(void);
 
 /**
  * Add table entry for cbmem TCPA log.
+ * @param name Name of the hashed data
+ * @param pcr PCR used to extend hashed data
+ * @param diget_algo sets the digest algorithm
+ * @param digest sets the hash extended into the tpm
+ * @param digest_len the length of the digest
  */
 void tcpa_log_add_table_entry(const char *name, const uint32_t pcr,
+			      enum vb2_hash_algorithm digest_algo,
 			      const uint8_t *digest,
-			      const size_t digest_length);
+			      const size_t digest_len);
+
+/**
+ * Dump TCPA log entries on console
+ */
+void tcpa_log_dump(void *unused);
 
 /**
  * Ask vboot for a digest and extend a TPM PCR with it.
  * @param pcr sets the pcr index
+ * @param diget_algo sets the digest algorithm
  * @param digest sets the hash to extend into the tpm
  * @param digest_len the length of the digest
  * @param name sets additional info where the digest comes from
  * @return TPM_SUCCESS on success. If not a tpm error is returned
  */
-uint32_t tpm_extend_pcr(int pcr, uint8_t *digest, size_t digest_len,
+uint32_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo,
+			uint8_t *digest, size_t digest_len,
 			const char *name);
 
 /**
diff --git a/src/security/tpm/tspi/log.c b/src/security/tpm/tspi/log.c
index 17f6f1f3b9..18ab288dcc 100644
--- a/src/security/tpm/tspi/log.c
+++ b/src/security/tpm/tspi/log.c
@@ -14,67 +14,162 @@
  */
 
 #include <string.h>
-#include <cbmem.h>
 #include <console/console.h>
 #include <security/tpm/tspi.h>
+#include <arch/early_variables.h>
+#include <fmap.h>
+#include <region_file.h>
+#include <string.h>
+#include <security/vboot/symbols.h>
+#include <cbmem.h>
+#include <bootstate.h>
 
-static struct tcpa_table *tcpa_log_init(void)
+static struct tcpa_table *tcpa_cbmem_init(void)
 {
 	MAYBE_STATIC struct tcpa_table *tclt = NULL;
-
-	if (!cbmem_possibly_online())
-		return NULL;
-
-	if (tclt != NULL)
-		return tclt;
-
-	tclt = (struct tcpa_table *) cbmem_entry_find(CBMEM_ID_TCPA_LOG);
 	if (tclt)
 		return tclt;
 
-	tclt = cbmem_add(CBMEM_ID_TCPA_LOG,
-			 sizeof(struct tcpa_table) +
-			 MAX_TCPA_LOG_ENTRIES *
-			 sizeof(struct tcpa_entry));
-
-	if (!tclt) {
-		printk(BIOS_ERR, "ERROR: Could not create TCPA log table\n");
-		return NULL;
+	if (cbmem_possibly_online()) {
+		tclt = cbmem_find(CBMEM_ID_TCPA_LOG);
+		if (!tclt) {
+			size_t tcpa_log_len = sizeof(struct tcpa_table) +
+			MAX_TCPA_LOG_ENTRIES * sizeof(struct tcpa_entry);
+			tclt = cbmem_add(CBMEM_ID_TCPA_LOG, tcpa_log_len);
+			if (tclt) {
+				tclt->max_entries = MAX_TCPA_LOG_ENTRIES;
+				tclt->num_entries = 0;
+			}
+		}
 	}
+	return tclt;
+}
 
-	tclt->max_entries = MAX_TCPA_LOG_ENTRIES;
-	tclt->num_entries = 0;
+static struct tcpa_table *tcpa_log_init(void)
+{
+	MAYBE_STATIC struct tcpa_table *tclt = NULL;
 
-	printk(BIOS_DEBUG, "TCPA log created at %p\n", tclt);
+	/* We are dealing here with pre CBMEM environment.
+	 * If cbmem isn't available use CAR or SRAM */
+	if (!cbmem_possibly_online() &&
+		!IS_ENABLED(CONFIG_VBOOT_RETURN_FROM_VERSTAGE))
+		return (struct tcpa_table *)_vboot2_tpm_log;
+	else if (ENV_ROMSTAGE &&
+		!IS_ENABLED(CONFIG_VBOOT_RETURN_FROM_VERSTAGE)) {
+		tclt = tcpa_cbmem_init();
+		if (!tclt)
+			return (struct tcpa_table *)_vboot2_tpm_log;
+	} else {
+		tclt = tcpa_cbmem_init();
+	}
 
 	return tclt;
 }
 
-void tcpa_log_add_table_entry(const char *name, const uint32_t pcr,
-			      const uint8_t *digest, const size_t digest_length)
+void tcpa_log_dump(void *unused)
 {
+	int i, j;
 	struct tcpa_table *tclt;
-	struct tcpa_entry *tce;
 
 	tclt = tcpa_log_init();
-
 	if (!tclt)
 		return;
 
-	if (tclt->num_entries == tclt->max_entries) {
-		printk(BIOS_WARNING, "ERROR: TCPA log table is full\n");
+	printk(BIOS_INFO, "coreboot TCPA measurements:\n\n");
+	for (i = 0; i < tclt->num_entries; i++) {
+		struct tcpa_entry *tce = &tclt->entries[i];
+		if (tce) {
+			printk(BIOS_INFO, " PCR-%u ", tce->pcr);
+
+			for (j = 0; j < tce->digest_length; j++)
+				printk(BIOS_INFO, "%02x", tce->digest[j]);
+
+			printk(BIOS_INFO, " %s [%s]\n",
+				   tce->digest_type, tce->name);
+		}
+	}
+	printk(BIOS_INFO, "\n");
+}
+
+void tcpa_log_add_table_entry(const char *name, const uint32_t pcr,
+			enum vb2_hash_algorithm digest_algo,
+			const uint8_t *digest,
+			const size_t digest_len)
+{
+	struct tcpa_table *tclt = tcpa_log_init();
+	if (!tclt) {
+		printk(BIOS_WARNING, "TCPA: Log non-existent!\n");
 		return;
 	}
 
-	tce = &tclt->entries[tclt->num_entries++];
+	if (tclt->num_entries >= tclt->max_entries) {
+		printk(BIOS_WARNING, "TCPA: TCPA log table is full\n");
+		return;
+	}
 
+	if (!name) {
+		printk(BIOS_WARNING, "TCPA: TCPA entry name not set\n");
+		return;
+	}
+
+	struct tcpa_entry *tce = &tclt->entries[tclt->num_entries++];
 	strncpy(tce->name, name, TCPA_PCR_HASH_NAME - 1);
 	tce->pcr = pcr;
 
-	if (digest_length > TCPA_DIGEST_MAX_LENGTH) {
-		printk(BIOS_WARNING, "ERROR: PCR digest too long for TCPA log entry\n");
+	if (digest_len > TCPA_DIGEST_MAX_LENGTH) {
+		printk(BIOS_WARNING, "TCPA: PCR digest too long for TCPA log entry\n");
+		return;
+	}
+
+	strncpy(tce->digest_type,
+			vb2_get_hash_algorithm_name(digest_algo),
+			TCPA_PCR_HASH_LEN - 1);
+	tce->digest_length = digest_len;
+	memcpy(tce->digest, digest, tce->digest_length);
+}
+
+void tcpa_preram_log_clear(void)
+{
+	printk(BIOS_INFO, "TCPA: Clearing coreboot TCPA log\n");
+	struct tcpa_table *tclt = (struct tcpa_table *)_vboot2_tpm_log;
+	tclt->max_entries = MAX_TCPA_LOG_ENTRIES;
+	tclt->num_entries = 0;
+}
+
+#if !IS_ENABLED(CONFIG_VBOOT_RETURN_FROM_VERSTAGE)
+static void recover_tcpa_log(int is_recovery)
+{
+	struct tcpa_table *preram_log = (struct tcpa_table *)_vboot2_tpm_log;
+	struct tcpa_table *ram_log = NULL;
+	int i;
+
+	if (preram_log->num_entries > MAX_PRERAM_TCPA_LOG_ENTRIES) {
+		printk(BIOS_WARNING, "TCPA: Pre-RAM TCPA log is too full, possible corruption\n");
 		return;
 	}
-	memcpy(tce->digest, digest, digest_length);
-	tce->digest_length = digest_length;
+
+	ram_log = tcpa_cbmem_init();
+	if (!ram_log) {
+		printk(BIOS_WARNING, "TCPA: CBMEM not available something went wrong\n");
+		return;
+	}
+
+	for (i = 0; i < preram_log->num_entries; i++) {
+		struct tcpa_entry *tce = &ram_log->entries[ram_log->num_entries++];
+		strncpy(tce->name, preram_log->entries[i].name, TCPA_PCR_HASH_NAME - 1);
+		tce->pcr = preram_log->entries[i].pcr;
+
+		if (preram_log->entries[i].digest_length > TCPA_DIGEST_MAX_LENGTH) {
+			printk(BIOS_WARNING, "TCPA: PCR digest too long for TCPA log entry\n");
+			return;
+		}
+
+		strncpy(tce->digest_type, preram_log->entries[i].digest_type, TCPA_PCR_HASH_LEN - 1);
+		tce->digest_length = MIN(preram_log->entries[i].digest_length, TCPA_DIGEST_MAX_LENGTH);
+		memcpy(tce->digest, preram_log->entries[i].digest, tce->digest_length);
+	}
 }
+ROMSTAGE_CBMEM_INIT_HOOK(recover_tcpa_log);
+#endif
+
+BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_BOOT, BS_ON_ENTRY, tcpa_log_dump, NULL);
diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c
index b8ebf7b809..f1b72fbff3 100644
--- a/src/security/tpm/tspi/tspi.c
+++ b/src/security/tpm/tspi/tspi.c
@@ -202,8 +202,8 @@ uint32_t tpm_clear_and_reenable(void)
 	return TPM_SUCCESS;
 }
 
-uint32_t tpm_extend_pcr(int pcr, uint8_t *digest,
-			size_t digest_len, const char *name)
+uint32_t tpm_extend_pcr(int pcr, enum vb2_hash_algorithm digest_algo,
+			uint8_t *digest, size_t digest_len, const char *name)
 {
 	uint32_t result;
 
@@ -214,6 +214,10 @@ uint32_t tpm_extend_pcr(int pcr, uint8_t *digest,
 	if (result != TPM_SUCCESS)
 		return result;
 
+	if (IS_ENABLED(CONFIG_VBOOT_MEASURED_BOOT))
+		tcpa_log_add_table_entry(name, pcr, digest_algo,
+			digest, digest_len);
+
 	return TPM_SUCCESS;
 }
 
@@ -235,10 +239,11 @@ uint32_t tpm_measure_region(const struct region_device *rdev, uint8_t pcr,
 		printk(BIOS_ERR, "TPM: Can't initialize library.\n");
 		return result;
 	}
-	if (IS_ENABLED(CONFIG_TPM1))
+	if (IS_ENABLED(CONFIG_TPM1)) {
 		hash_alg = VB2_HASH_SHA1;
-	else /* CONFIG_TPM2 */
+	} else { /* CONFIG_TPM2 */
 		hash_alg = VB2_HASH_SHA256;
+	}
 
 	digest_len = vb2_digest_size(hash_alg);
 	assert(digest_len <= sizeof(digest));
@@ -267,7 +272,7 @@ uint32_t tpm_measure_region(const struct region_device *rdev, uint8_t pcr,
 		printk(BIOS_ERR, "TPM: Error finalizing hash.\n");
 		return TPM_E_HASH_ERROR;
 	}
-	result = tpm_extend_pcr(pcr, digest, digest_len, rname);
+	result = tpm_extend_pcr(pcr, hash_alg, digest, digest_len, rname);
 	if (result != TPM_SUCCESS) {
 		printk(BIOS_ERR, "TPM: Extending hash into PCR failed.\n");
 		return result;