tpmeventlog

Documentation

Index

• Constants
• func ParseLocality(eventData []byte) (uint8, error)
• func RegisterEventDataParser(pcrIndex pcr.ID, eventType EventType, fn EventDataParserFunc)
• type Digest
• type ErrInvalidDigestLength
  • func (err ErrInvalidDigestLength) Error() string
• type ErrLocality
  • func (err ErrLocality) Error() string
• type ErrNotSupportedHashAlgo
  • func (err ErrNotSupportedHashAlgo) Error() string
• type ErrParse
  • func (err ErrParse) Error() string
  • func (err ErrParse) Unwrap() error
• type ErrRead
  • func (err ErrRead) Error() string
  • func (err ErrRead) Unwrap() error
• type Event
• type EventDataParsed
  • func ParseEventData(ev *Event, imageSize uint64) (*EventDataParsed, error)
• type EventDataParserFunc
• type EventType
  • func (t EventType) String() string
• type TPMAlgorithm
• type TPMEventLog
  • func Parse(input io.Reader) (*TPMEventLog, error)
  • func (eventLog *TPMEventLog) FilterEvents(pcrIndex pcr.ID, hashAlgo TPMAlgorithm) ([]*Event, error)

Constants

const (
	EV_PREBOOT_CERT                  = EventType(0x00000000)
	EV_POST_CODE                     = EventType(0x00000001)
	EV_UNUSED                        = EventType(0x00000002)
	EV_NO_ACTION                     = EventType(0x00000003)
	EV_SEPARATOR                     = EventType(0x00000004)
	EV_ACTION                        = EventType(0x00000005)
	EV_EVENT_TAG                     = EventType(0x00000006)
	EV_S_CRTM_CONTENTS               = EventType(0x00000007)
	EV_S_CRTM_VERSION                = EventType(0x00000008)
	EV_CPU_MICROCODE                 = EventType(0x00000009)
	EV_PLATFORM_CONFIG_FLAGS         = EventType(0x0000000A)
	EV_TABLE_OF_DEVICES              = EventType(0x0000000B)
	EV_COMPACT_HASH                  = EventType(0x0000000C)
	EV_IPL                           = EventType(0x0000000D)
	EV_IPL_PARTITION_DATA            = EventType(0x0000000E)
	EV_NONHOST_CODE                  = EventType(0x0000000F)
	EV_NONHOST_CONFIG                = EventType(0x00000010)
	EV_NONHOST_INFO                  = EventType(0x00000011)
	EV_OMIT_BOOT_DEVICE_EVENTS       = EventType(0x00000012)
	EV_EFI_EVENT_BASE                = EventType(0x80000000)
	EV_EFI_VARIABLE_DRIVER_CONFIG    = EventType(0x80000001)
	EV_EFI_VARIABLE_BOOT             = EventType(0x80000002)
	EV_EFI_BOOT_SERVICES_APPLICATION = EventType(0x80000003)
	EV_EFI_BOOT_SERVICES_DRIVER      = EventType(0x80000004)
	EV_EFI_RUNTIME_SERVICES_DRIVER   = EventType(0x80000005)
	EV_EFI_GPT_EVENT                 = EventType(0x80000006)
	EV_EFI_ACTION                    = EventType(0x80000007)
	EV_EFI_PLATFORM_FIRMWARE_BLOB    = EventType(0x80000008)
	EV_EFI_HANDOFF_TABLES            = EventType(0x80000009)
	EV_EFI_PLATFORM_FIRMWARE_BLOB2   = EventType(0x8000000A)
	EV_EFI_HCRTM_EVENT               = EventType(0x80000010)
	EV_EFI_VARIABLE_AUTHORITY        = EventType(0x800000E0)
)

The list of available EventLog entry types.

const (
	// TPMAlgorithmSHA1 is the identified of SHA1 algorithm.
	TPMAlgorithmSHA1 = tpm2.AlgSHA1

	// TPMAlgorithmSHA256 is the identified of SHA256 algorithm.
	TPMAlgorithmSHA256 = tpm2.AlgSHA256
)

const (
	// PhysAddrBase is the physical address where the BIOS region is mapped to (downwards).
	PhysAddrBase = 0x100000000
)

Functions

func ParseLocality

func ParseLocality(eventData []byte) (uint8, error)

ParseLocality parses TPM locality from EV_NO_ACTION event corresponding to the TPM initialization.

func RegisterEventDataParser

func RegisterEventDataParser(pcrIndex pcr.ID, eventType EventType, fn EventDataParserFunc)

Types

type Digest

type Digest struct {
	HashAlgo TPMAlgorithm
	Digest   []byte
}

Digest is the digest reported by an Event.

type ErrInvalidDigestLength

type ErrInvalidDigestLength struct {
	Expected int
	Received int
}

ErrInvalidDigestLength means an event has a digest of a size not appropriate for a selected hash algorithm.

func (ErrInvalidDigestLength) Error

func (err ErrInvalidDigestLength) Error() string

Error implements interface `error`.

type ErrLocality

type ErrLocality struct {
	EventData []byte
}

ErrLocality means it was unable to detect the locality to initialize the PCR0 value.

func (ErrLocality) Error

func (err ErrLocality) Error() string

Error implements interface `error`.

type ErrNotSupportedHashAlgo

type ErrNotSupportedHashAlgo struct {
	TPMAlgo TPMAlgorithm
}

ErrNotSupportedHashAlgo means selected hash algorithm is not supported (yet?)

func (ErrNotSupportedHashAlgo) Error

func (err ErrNotSupportedHashAlgo) Error() string

Error implements interface `error`.

type ErrParse

type ErrParse struct {
	Err error
}

ErrParse means unable to read from the io.Reader

func (ErrParse) Error

func (err ErrParse) Error() string

Error implements interface `error`.

func (ErrParse) Unwrap

func (err ErrParse) Unwrap() error

Unwrap implements `xerrors.Wrapper`.

type ErrRead

type ErrRead struct {
	Err error
}

ErrRead means unable to read from the io.Reader

func (ErrRead) Error

func (err ErrRead) Error() string

Error implements interface `error`.

func (ErrRead) Unwrap

func (err ErrRead) Unwrap() error

Unwrap implements `xerrors.Wrapper`.

type Event

type Event struct {
	PCRIndex pcr.ID
	Type     EventType
	Data     []byte
	Digest   *Digest
}

Event is a single entry of a parsed EventLog.

type EventDataParsed

type EventDataParsed struct {
	pkgbytes.Ranges
	TPMInitLocality *uint8
	Description     *string
	FvGUIDs         []guid.GUID
}

func ParseEventData

func ParseEventData(
	ev *Event,
	imageSize uint64,
) (*EventDataParsed, error)

type EventDataParserFunc

type EventDataParserFunc func(ev *Event, imageSize uint64) (*EventDataParsed, error)

type EventType

type EventType uint32

EventType defines the kind of data reported by an Event.

See also: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf#page=102

func (EventType) String

func (t EventType) String() string

String implements fmt.Stringer

type TPMAlgorithm

type TPMAlgorithm = tpm2.Algorithm

TPMAlgorithm is an identified of a TPM-supported hash algorithm.

See also: https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf#page=42

type TPMEventLog

type TPMEventLog struct {
	Events []*Event
}

TPMEventLog is a parsed EventLog.

func Parse

func Parse(input io.Reader) (*TPMEventLog, error)

Parse parses a binary EventLog.

func (*TPMEventLog) FilterEvents

func (eventLog *TPMEventLog) FilterEvents(pcrIndex pcr.ID, hashAlgo TPMAlgorithm) ([]*Event, error)

FilterEvents returns only the events which has a specified PCR index and a digest of a specified hash algorithm.