tpm: Don't create an EventLog if algorithms are misconfigured
We already check the active banks vs what U-Boot was compiled with when trying to extend a PCR and we refuse to do so if the TPM active ones don't match the ones U-Boot supports. Do the same thing for the EventLog creation since extending will fail anyway and print a message so the user can figure out the missing algorithms. Co-developed-by: Raymond Mao <raymond.mao@linaro.org> Signed-off-by: Raymond Mao <raymond.mao@linaro.org> Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
@@ -770,4 +770,11 @@ bool tpm2_check_active_banks(struct udevice *dev);
|
||||
*/
|
||||
bool tpm2_is_active_bank(struct tpms_pcr_selection *selection);
|
||||
|
||||
/**
|
||||
* tpm2_print_active_banks() - Print the active TPM PCRs
|
||||
*
|
||||
* @dev: TPM device
|
||||
*/
|
||||
void tpm2_print_active_banks(struct udevice *dev);
|
||||
|
||||
#endif /* __TPM_V2_H */
|
||||
|
23
lib/tpm-v2.c
23
lib/tpm-v2.c
@@ -926,3 +926,26 @@ bool tpm2_check_active_banks(struct udevice *dev)
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
void tpm2_print_active_banks(struct udevice *dev)
|
||||
{
|
||||
struct tpml_pcr_selection pcrs;
|
||||
size_t i;
|
||||
int rc;
|
||||
|
||||
rc = tpm2_get_pcr_info(dev, &pcrs);
|
||||
if (rc) {
|
||||
log_err("Can't retrieve active PCRs\n");
|
||||
return;
|
||||
}
|
||||
|
||||
for (i = 0; i < pcrs.count; i++) {
|
||||
if (tpm2_is_active_bank(&pcrs.selection[i])) {
|
||||
const char *str;
|
||||
|
||||
str = tpm2_algorithm_name(pcrs.selection[i].hash);
|
||||
if (str)
|
||||
log_info("%s\n", str);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@@ -567,11 +567,36 @@ int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog,
|
||||
bool ignore_existing_log)
|
||||
{
|
||||
struct tcg2_event_log log;
|
||||
int rc;
|
||||
int rc, i;
|
||||
|
||||
elog->log_position = 0;
|
||||
elog->found = false;
|
||||
|
||||
/*
|
||||
* Make sure U-Boot is compiled with all the active PCRs
|
||||
* since we are about to create an EventLog and we won't
|
||||
* measure anything if the PCR banks don't match
|
||||
*/
|
||||
if (!tpm2_check_active_banks(dev)) {
|
||||
log_err("Cannot create EventLog\n");
|
||||
log_err("Mismatch between U-Boot and TPM hash algos\n");
|
||||
log_info("TPM:\n");
|
||||
tpm2_print_active_banks(dev);
|
||||
log_info("U-Boot:\n");
|
||||
for (i = 0; i < ARRAY_SIZE(hash_algo_list); i++) {
|
||||
const struct digest_info *algo = &hash_algo_list[i];
|
||||
const char *str;
|
||||
|
||||
if (!algo->supported)
|
||||
continue;
|
||||
|
||||
str = tpm2_algorithm_name(algo->hash_alg);
|
||||
if (str)
|
||||
log_info("%s\n", str);
|
||||
}
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
rc = tcg2_platform_get_log(dev, (void **)&log.log, &log.log_size);
|
||||
if (!rc) {
|
||||
log.log_position = 0;
|
||||
|
Reference in New Issue
Block a user