diff mbox series

[06/11] tpm: Don't create an EventLog if algorithms are misconfigured

Message ID 20241223144737.554992-7-raymond.mao@linaro.org
State Superseded
Headers show
Series [01/11] efi_loader: Don't warn if the TCG2 FinalEvents table is not installed | expand

Commit Message

Raymond Mao Dec. 23, 2024, 2:47 p.m. UTC 
From: Ilias Apalodimas <ilias.apalodimas@linaro.org>

We already check the active banks vs what U-Boot was compiled with when
trying to extend a PCR and we refuse to do so if the TPM active ones
don't match the ones U-Boot supports.

Do the same thing for the EventLog creation since extending will fail
anyway and print a message so the user can figure out the missing
algorithms.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Co-developed-by: Raymond Mao <raymond.mao@linaro.org>
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
 include/tpm-v2.h |  7 +++++++
 lib/tpm-v2.c     | 23 +++++++++++++++++++++++
 lib/tpm_tcg2.c   | 27 ++++++++++++++++++++++++++-
 3 files changed, 56 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/include/tpm-v2.h b/include/tpm-v2.h
index c49eadda26..6b3f2175b7 100644
--- a/include/tpm-v2.h
+++ b/include/tpm-v2.h
@@ -770,4 +770,11 @@  bool tpm2_check_active_banks(struct udevice *dev);
  */
 bool tpm2_is_active_bank(struct tpms_pcr_selection *selection);
 
+/**
+ * tpm2_print_active_banks() - Print the active TPM PCRs
+ *
+ * @dev: TPM device
+ */
+void tpm2_print_active_banks(struct udevice *dev);
+
 #endif /* __TPM_V2_H */
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index 96c164f2a5..bac6fd9101 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -926,3 +926,26 @@  bool tpm2_check_active_banks(struct udevice *dev)
 
 	return true;
 }
+
+void tpm2_print_active_banks(struct udevice *dev)
+{
+	struct tpml_pcr_selection pcrs;
+	size_t i;
+	int rc;
+
+	rc = tpm2_get_pcr_info(dev, &pcrs);
+	if (rc) {
+		log_err("Can't retrieve active PCRs\n");
+		return;
+	}
+
+	for (i = 0; i < pcrs.count; i++) {
+		if (tpm2_is_active_bank(&pcrs.selection[i])) {
+			const char *str;
+
+			str = tpm2_algorithm_name(pcrs.selection[i].hash);
+			if (str)
+				log_info("%s\n", str);
+		}
+	}
+}
diff --git a/lib/tpm_tcg2.c b/lib/tpm_tcg2.c
index 4682f7664f..7ecd53106f 100644
--- a/lib/tpm_tcg2.c
+++ b/lib/tpm_tcg2.c
@@ -568,11 +568,36 @@  int tcg2_log_prepare_buffer(struct udevice *dev, struct tcg2_event_log *elog,
 			    bool ignore_existing_log)
 {
 	struct tcg2_event_log log;
-	int rc;
+	int rc, i;
 
 	elog->log_position = 0;
 	elog->found = false;
 
+	/*
+	 * Make sure U-Boot is compiled with all the active PCRs
+	 * since we are about to create an EventLog and we won't
+	 * measure anything if the PCR banks don't match
+	 */
+	if (!tpm2_check_active_banks(dev)) {
+		log_err("Cannot create EventLog\n");
+		log_err("Mismatch between U-Boot and TPM hash algos\n");
+		log_info("TPM:\n");
+		tpm2_print_active_banks(dev);
+		log_info("U-Boot:\n");
+		for (i = 0; i < ARRAY_SIZE(hash_algo_list); i++) {
+			const struct digest_info *algo = &hash_algo_list[i];
+			const char *str;
+
+			if (!algo->supported)
+				continue;
+
+			str = tpm2_algorithm_name(algo->hash_alg);
+			if (str)
+				log_info("%s\n", str);
+		}
+		return -EINVAL;
+	}
+
 	rc = tcg2_platform_get_log(dev, (void **)&log.log, &log.log_size);
 	if (!rc) {
 		log.log_position = 0;