colin/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tpm: Don't create an EventLog if algorithms are misconfigured

Browse Source 
We already check the active banks vs what U-Boot was compiled with when
trying to extend a PCR and we refuse to do so if the TPM active ones
don't match the ones U-Boot supports.

Do the same thing for the EventLog creation since extending will fail
anyway and print a message so the user can figure out the missing
algorithms.

Co-developed-by: Raymond Mao <raymond.mao@linaro.org>
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Ilias Apalodimas
2024-12-24 08:01:08 -08:00
parent 27891e85f3
commit 8dc886ce31
3 changed files with 56 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
lib/tpm_tcg2.c
View File

@@ -567,11 +567,36 @@ int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog,
bool ignore_existing_log)
{
struct tcg2_event_log log;
int rc;
int rc, i;
elog->log_position = 0;
elog->found = false;
/*
* Make sure U-Boot is compiled with all the active PCRs
* since we are about to create an EventLog and we won't
* measure anything if the PCR banks don't match
*/
if (!tpm2_check_active_banks(dev)) {
log_err("Cannot create EventLog\n");
log_err("Mismatch between U-Boot and TPM hash algos\n");
log_info("TPM:\n");
tpm2_print_active_banks(dev);
log_info("U-Boot:\n");
for (i = 0; i < ARRAY_SIZE(hash_algo_list); i++) {
const struct digest_info *algo = &hash_algo_list[i];
const char *str;
if (!algo->supported)
continue;
str = tpm2_algorithm_name(algo->hash_alg);
if (str)
log_info("%s\n", str);
}
return -EINVAL;
}
rc = tcg2_platform_get_log(dev, (void **)&log.log, &log.log_size);
if (!rc) {
log.log_position = 0;