tdx-verifier: eventlog: handle OVMF/efistub measurements correctly

deps/verifier/src/tdx/claims.rs

@@ -220,6 +220,32 @@ fn parse_ccel(ccel: CcEventLog, ccel_map: &mut Map<String, Value>) -> Result<()>
         }
     }
 
+    // Digest of kernel cmdline using TDVF
+    match ccel.query_digest(MeasuredEntity::TdvfKernelParams) {
+        Some(cmdline_digest) => {
+            ccel_map.insert(
+                "cmdline".to_string(),
+                serde_json::Value::String(cmdline_digest),
+            );
+        }
+        _ => {
+            warn!("No tdvf kernel cmdline hash in CCEL");
+        }
+    }
+
+    // Digest of initrd using TDVF
+    match ccel.query_digest(MeasuredEntity::TdvfInitrd) {
+        Some(initrd_digest) => {
+            ccel_map.insert(
+                "initrd".to_string(),
+                serde_json::Value::String(initrd_digest),
+            );
+        }
+        _ => {
+            warn!("No tdvf initrd hash in CCEL");
+        }
+    }
+
     // Map of Kernel Parameters
     match ccel.query_event_data(MeasuredEntity::TdShimKernelParams) {
         Some(config_info) => {

deps/verifier/src/tdx/eventlog.rs

@@ -2,18 +2,27 @@ use anyhow::*;
 use byteorder::{LittleEndian, ReadBytesExt};
 use core::mem::size_of;
 use eventlog_rs::Eventlog;
+use log::{trace, warn};
+use std::result::Result::Ok;
+
 use strum::{Display, EnumString};
 
-#[derive(Debug, Clone, EnumString, Display)]
+const KERNEL_VENMEDIA_DEVPATH_OFFSET: usize = 55;
+
+#[derive(Copy, Debug, Clone, EnumString, Display)]
 pub enum MeasuredEntity {
     #[strum(serialize = "td_hob\0")]
     TdShim,
     #[strum(serialize = "td_payload\0")]
     TdShimKernel,
     #[strum(serialize = "td_payload_info\0")]
     TdShimKernelParams,
-    #[strum(serialize = "k\0e\0r\0n\0e\0l\0")]
+    #[strum(serialize = "kernel")]
     TdvfKernel,
+    #[strum(serialize = "LOADED_IMAGE::LoadOptions")]
+    TdvfKernelParams,
+    #[strum(serialize = "Linux initrd")]
+    TdvfInitrd,
 }
 
 #[derive(Debug, Clone, Copy)]
@@ -38,6 +47,15 @@ impl TryFrom<Vec<u8>> for CcEventLog {
     }
 }
 
+fn read_string(raw_bytes: &[u8]) -> Result<String, std::string::FromUtf16Error> {
+    let mut utf16_string = Vec::new();
+
+    for i in raw_bytes.chunks_exact(2) {
+        utf16_string.push(u16::from_be_bytes(i.try_into().unwrap_or([0u8; 2])));
+    }
+    String::from_utf16(utf16_string.as_ref())
+}
+
 impl CcEventLog {
     pub fn integrity_check(&self, rtmr_from_quote: Rtmr) -> Result<()> {
         let rtmr_eventlog = self.rebuild_rtmr()?;
@@ -67,21 +85,71 @@ impl CcEventLog {
     }
 
     pub fn query_digest(&self, entity: MeasuredEntity) -> Option<String> {
-        let event_desc_prefix = Self::generate_query_key_prefix(entity)?;
-
         for event_entry in self.cc_events.log.clone() {
-            if event_entry.event_desc.len() < event_desc_prefix.len() {
-                continue;
-            }
-            if &event_entry.event_desc[..event_desc_prefix.len()] == event_desc_prefix.as_slice() {
-                let digest = &event_entry.digests[0].digest;
-                return Some(hex::encode(digest));
+            match (entity, event_entry.event_type) {
+                (MeasuredEntity::TdvfKernel, ev)
+                    if ev.as_str() == "EV_EFI_BOOT_SERVICES_APPLICATION" =>
+                {
+                    match read_string(
+                        &event_entry.event_desc[KERNEL_VENMEDIA_DEVPATH_OFFSET
+                            ..KERNEL_VENMEDIA_DEVPATH_OFFSET
+                                + 2 * MeasuredEntity::TdvfKernel.to_string().len()],
+                    ) {
+                        Ok(kernel) if kernel == entity.to_string() => {
+                            return Some(hex::encode(&event_entry.digests[0].digest));
+                        }
+                        Ok(s) => warn!("Unknown Vendor Media Device Path: {s}"),
+                        Err(e) => warn!("Failed to read UEFI_IMAGE_LOAD_EVENT: {e}"),
+                    }
+                }
+                (MeasuredEntity::TdvfKernelParams | MeasuredEntity::TdvfInitrd, ev)
+                    if ev.as_str() == "EV_EVENT_TAG" =>
+                {
+                    let offset = size_of::<u32>();
+
+                    // Read the tagged event size after the first u32 (=Event ID)
+                    let event_size = (&event_entry.event_desc[offset..2 * offset])
+                        .read_u32::<LittleEndian>()
+                        .unwrap_or_default() as usize;
+
+                    // Read the tagged event after the event size
+                    match String::from_utf8(
+                        event_entry.event_desc[offset * 2..offset * 2 + event_size - 1].to_vec(),
+                    ) {
+                        Ok(event) if event == entity.to_string() => {
+                            return Some(hex::encode(&event_entry.digests[0].digest))
+                        }
+                        Ok(event) => warn!("Unknown tagged event: {event:?}"),
+                        Err(e) => warn!("Failed to parse tagged event: {e}"),
+                    }
+                }
+                (
+                    MeasuredEntity::TdShim
+                    | MeasuredEntity::TdShimKernel
+                    | MeasuredEntity::TdShimKernelParams,
+                    _,
+                ) => {
+                    let event_desc_prefix =
+                        Self::generate_query_key_prefix(entity).unwrap_or_default();
+
+                    if event_entry.event_desc.len() < event_desc_prefix.len() {
+                        continue;
+                    }
+                    if &event_entry.event_desc[..event_desc_prefix.len()]
+                        == event_desc_prefix.as_slice()
+                    {
+                        return Some(hex::encode(&event_entry.digests[0].digest));
+                    }
+                }
+                (me, ev) => trace!(
+                    "Unmatched MeasuredEntity {:?} with event {ev}",
+                    me.to_string()
+                ),
             }
         }
         None
     }
 
-    #[allow(dead_code)]
     pub fn query_event_data(&self, entity: MeasuredEntity) -> Option<Vec<u8>> {
         let event_desc_prefix = Self::generate_query_key_prefix(entity)?;
 
@@ -96,29 +164,25 @@ impl CcEventLog {
         None
     }
 
-    #[allow(unused_assignments)]
     fn generate_query_key_prefix(entity: MeasuredEntity) -> Option<Vec<u8>> {
-        let mut event_desc_prefix = Vec::new();
         match entity {
             MeasuredEntity::TdShimKernel => {
                 // Event data is in UEFI_PLATFORM_FIRMWARE_BLOB2 format
                 // Defined in TCG PC Client Platform Firmware Profile Specification section
                 // 'UEFI_PLATFORM_FIRMWARE_BLOB Structure Definition'
                 let entity_name = entity.to_string();
-                event_desc_prefix = vec![entity_name.as_bytes().len() as u8];
+                let mut event_desc_prefix = vec![entity_name.len() as u8];
                 event_desc_prefix.extend_from_slice(entity_name.as_bytes());
-            }
-            MeasuredEntity::TdvfKernel => {
-                event_desc_prefix = entity.to_string().as_bytes().to_vec();
+                Some(event_desc_prefix)
             }
             MeasuredEntity::TdShim | MeasuredEntity::TdShimKernelParams => {
                 // Event data is in TD_SHIM_PLATFORM_CONFIG_INFO format
                 // Defined in td-shim spec 'Table 3.5-4 TD_SHIM_PLATFORM_CONFIG_INFO'
                 // link: https://github.com/confidential-containers/td-shim/blob/main/doc/tdshim_spec.md
-                event_desc_prefix = entity.to_string().as_bytes().to_vec();
+                Some(entity.to_string().as_bytes().to_vec())
             }
+            _ => None,
         }
-        Some(event_desc_prefix)
     }
 }
 
@@ -189,7 +253,7 @@ mod tests {
     }
 
     #[test]
-    fn test_query_digest() {
+    fn test_query_digest_tdshim() {
         let ccel_bin = fs::read("./test_data/CCEL_data").unwrap();
         let ccel = CcEventLog::try_from(ccel_bin).unwrap();
 
@@ -208,4 +272,31 @@ mod tests {
             "64ed1e5a47e8632f80faf428465bd987af3e8e4ceb10a5a9f387b6302e30f4993bded2331f0691c4a38ad34e4cbbc627".to_string()
         );
     }
+
+    #[test]
+    fn test_query_digest_ovmf() {
+        let ccel_bin = fs::read("./test_data/CCEL_data_ovmf").expect("open test data");
+        let ccel = CcEventLog::try_from(ccel_bin).expect("parse CCEL eventlog");
+
+        let kernel_hash = ccel.query_digest(MeasuredEntity::TdvfKernel);
+        let kernel_params_hash = ccel.query_digest(MeasuredEntity::TdvfKernelParams);
+        let initrd_hash = ccel.query_digest(MeasuredEntity::TdvfInitrd);
+
+        assert!(kernel_hash.is_some());
+        assert!(kernel_params_hash.is_some());
+        assert!(initrd_hash.is_some());
+
+        assert_eq!(
+            kernel_hash.unwrap(),
+            "a2ccae1e7d6c668ca325bb09c882d8ce44d26d714ba6f58d2e8083fe291a704646afe24a2368bca3341728d78ec80a80".to_string()
+        );
+        assert_eq!(
+            initrd_hash.unwrap(),
+            "b15af9286108d3d8c9f794a51409e55bad6334f5d96a1e4469f8df2d75fd69aac648d939e13daf6800e82e6c1f6628c4".to_string()
+        );
+        assert_eq!(
+            kernel_params_hash.unwrap(),
+            "4230f84885a6f3f305e91a1955045398bd9edd8ffd2aaf2aab8ad3ac53476c4ac82a3675ef559c4ae949a06e84119fc2".to_string()
+        );
+    }
 }