search

joholl / tpmstream

A tool to help you understand TPM commands and responses.
https://joholl.github.io/tpmstream-web
BSD 2-Clause "Simplified" License
27 stars 1 forks source link

tpmstream.io: add support for swtpm log file format #23

Open berrange opened 3 weeks ago

berrange commented 3 weeks ago

The swtpm program that is used to provide QEMU/KVM virtual machines with a virtual TPM can save a log of all TPM command packets.

The file format looks like this:

Ctrl Cmd: length 4 00 00 00 10 Ctrl Rsp: length 4 00 00 00 00 SWTPM_IO_Read: length 10 80 01 00 00 00 0A 00 00 01 81 SWTPM_IO_Write: length 10 80 01 00 00 00 0A 00 00 01 01 Ctrl Cmd: length 4 00 00 00 01 Ctrl Rsp: length 8 00 00 00 00 00 01 FF FF SWTPM_IO_Read: length 12 80 01 00 00 00 0C 00 00 01 44 00 00 SWTPM_IO_Write: length 10 80 01 00 00 00 0A 00 00 00 00 SWTPM_IO_Read: length 22 80 01 00 00 00 16 00 00 01 7A 00 00 00 05 00 00 00 00 00 00 00 01 SWTPM_IO_Write: length 43 80 01 00 00 00 2B 00 00 00 00 00 00 00 00 05 00 ....

"Ctrl Cmd" and "Ctrl Rsp" are markers for messages on SWTPM's control channel, followed by data, which should be ignored.

"SWTPM_IO_Read" and "SWTPM_IO_WRITE" are markers for TPM commands and responses respectively, where we can capture the following data and convert to binary.

This allows viewing the swtpm command stream using

tpmstream convert swtpm.log

the auto format detection looks for " Ctrl Cmd:" in the leading bytes. The format can also be requested explicitly

tpmstream convert --in swtpm-log swtpm.log

HarryR commented 1 day ago

Awesome, qemu's TPM support is a common testbed, and being able to easily debug newly developing firmware will hopefully make peoples lives easier. I second this PR.

Also, tpmstream is really useful.