diff options
| author | Ilias Apalodimas <ilias.apalodimas@linaro.org> | 2021-03-24 16:50:46 +0200 |
|---|---|---|
| committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2021-03-25 20:45:44 +0100 |
| commit | f69a2016b6330b70915c371491af33f5fd58c849 (patch) | |
| tree | d4ac8422388d708ea89f12d973136dba846f9cf8 /lib | |
| parent | d8cf113fe5860d4d262dfd2211524cda5bff19b2 (diff) | |
| download | u-boot-f69a2016b6330b70915c371491af33f5fd58c849.tar.gz | |
efi_loader: Add an S-CRTM even for firmware version
TCG PC Client Platform Firmware Profile Spec mandates that an S-CRTM
event for the version identifier using the event type EV_S_CRTM_VERSION
must be measured.
So since we are trying to add more conformance into U-Boot, let's add
the event using U_BOOT_VERSION_STRING, extend PCR[0] accordingly and log
it in the EventLog
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/efi_loader/efi_tcg2.c | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 35ae8ed596..09046844c7 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -13,6 +13,7 @@ #include <efi_loader.h> #include <efi_tcg2.h> #include <log.h> +#include <version.h> #include <tpm-v2.h> #include <u-boot/sha1.h> #include <u-boot/sha256.h> @@ -1064,6 +1065,36 @@ out: } /** + * efi_append_scrtm_version - Append an S-CRTM EV_S_CRTM_VERSION event on the + * eventlog and extend the PCRs + * + * @dev: TPM device + * + * @Return: status code + */ +static efi_status_t efi_append_scrtm_version(struct udevice *dev) +{ + struct tpml_digest_values digest_list; + u8 ver[] = U_BOOT_VERSION_STRING; + const int pcr_index = 0; + efi_status_t ret; + + ret = tcg2_create_digest(ver, sizeof(ver), &digest_list); + if (ret != EFI_SUCCESS) + goto out; + + ret = tcg2_pcr_extend(dev, pcr_index, &digest_list); + if (ret != EFI_SUCCESS) + goto out; + + ret = tcg2_agile_log_append(pcr_index, EV_S_CRTM_VERSION, &digest_list, + sizeof(ver), ver); + +out: + return ret; +} + +/** * efi_tcg2_register() - register EFI_TCG2_PROTOCOL * * If a TPM2 device is available, the TPM TCG2 Protocol is registered @@ -1086,6 +1117,10 @@ efi_status_t efi_tcg2_register(void) if (ret != EFI_SUCCESS) goto fail; + ret = efi_append_scrtm_version(dev); + if (ret != EFI_SUCCESS) + goto out; + ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol, (void *)&efi_tcg2_protocol); if (ret != EFI_SUCCESS) { |