Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TpmTestingPkg and TPM Replay feature [Rebase & FF] #287

Merged
merged 4 commits into from
Aug 23, 2023

Conversation

makubacki
Copy link
Member

@makubacki makubacki commented Aug 15, 2023

Description

Contains four commits:


TpmTestingPkg: Add initial package

Adds a new package that holds TPM testing functionality.

Currently, a feature is present called "TPM Replay" that provides
the ability to replay TPM measurements from a custom-made event log.

The primary purpose is for testing operating system features
dependent on TPM measurements. More details about this feature are
available in TpmTestingPkg/TpmReplayPeiDxe/Readme.md.

This feature is designed to ease platform integration and can be
applied to physical and virtual systems.


TpmTestingPkg: Remove DXE functionality

Removes DXE placeholders since they are currently not used. This
commit is left in source history to show where DXE functionality
would hook into the code flows if added in the future.


TpmTestingPkg: Add TPM Replay tool

Adds a new tool that allows a user to specify a TPM Event Log in
JSON or YAML (validated against a supplied schema) that is transformed
into a binary that can be used by the TPM Replay feature.

A binary can also be transformed back to a YAML file.

This is an initial draft of the tool. Some files or code will likely
move to other more generic repos, the schema to a public schema
store, and new features are planned to be added as well. For example,
some PCR7 events will allow individual UEFI variable details to be
specified in the input JSON/YAML file to make their creation more
clear.

While this is planned, the initial draft provides sufficient
functionality to use with the feature and share with others now.


.azurepipelines: Add TpmTestingPkg

Includes the package in the pipeline build.

Rebalances the build matrix taking the new package into account.


  • Impacts functionality?
    • Functionality - Does the change ultimately impact how firmware functions?
    • Examples: Add a new library, publish a new PPI, update an algorithm, ...
  • Impacts security?
    • Security - Does the change have a direct security impact on an application,
      flow, or firmware?
    • Examples: Crypto algorithm change, buffer overflow fix, parameter
      validation improvement, ...
  • Breaking change?
    • Breaking change - Will anyone consuming this change experience a break
      in build or boot behavior?
    • Examples: Add a new library class, move a module to a different repo, call
      a function in a new library class in a pre-existing module, ...
  • Includes tests?
    • Tests - Does the change include any explicit test code?
    • Examples: Unit tests, integration tests, robot tests, ...
  • Includes documentation?
    • Documentation - Does the change contain explicit documentation additions
      outside direct code modifications (and comments)?
    • Examples: Update readme file, add feature readme file, link to documentation
      on an a separate Web page, ...

How This Was Tested

  • Input YAML to binary
  • Input JSON to binary
  • Input binary to YAML
  • Replay events on QEMU Q35 to PCRs
  • Verify event log in OS against the input file

Example: YAML to Binary and Binary Back to YAML

tpm_replay_script_example
(click the image to enlarge it)

Example: Viewing the Replayed Log in Windows

tpm_replay_event_log_in_os

Integration Instructions

N/A

@github-actions github-actions bot added language:python Pull requests that update Python code impact:non-functional Does not have a functional impact labels Aug 15, 2023
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@makubacki makubacki added type:enhancement New feature or pull request and removed impact:non-functional Does not have a functional impact labels Aug 16, 2023
Copy link
Contributor

@os-d os-d left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A large PR :). I actively reviewed the C code (in the overrides just your MU_CHANGE tags, obv). The python I skimmed as the eyes were getting tired. Worth another reviewer going deeper on the python.

@makubacki makubacki force-pushed the add_tpm_replay_draft_3 branch 4 times, most recently from 6863ea2 to b25722e Compare August 23, 2023 19:29
Adds a new package that holds TPM testing functionality.

Currently, a feature is present called "TPM Replay" that provides
the ability to replay TPM measurements from a custom-made event log.

The primary purpose is for testing operating system features
dependent on TPM measurements. More details about this feature are
available in TpmTestingPkg/TpmReplayPeiDxe/Readme.md.

This feature is designed to ease platform integration and can be
applied to physical and virtual systems.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Removes DXE placeholders since they are currenlty not used. This
commit is left in source history to show where DXE functionality
would hook into the code flows if added in the future.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Adds a new tool that allows a user to specify a TPM Event Log in
JSON or YAML (validated against a supplied schema) that is transformed
into a binary that can be used by the TPM Replay feature.

A binary can also be transformed back to a YAML file.

This is an initial draft of the tool. Some files or code will likely
move to other more generic repos, the schema to a public schema
store, and new features are planned to be added as well. For example,
some PCR7 events will allow individual UEFI variable details to be
specified in the input JSON/YAML file to make their creation more
clear.

While this is planned, the initial draft provides sufficient
functionality to use with the feature and share with others now.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Includes the package in the pipeline build.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
@makubacki makubacki merged commit c489602 into microsoft:release/202302 Aug 23, 2023
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
language:python Pull requests that update Python code type:enhancement New feature or pull request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants