efi_loader: Add an S-CRTM even for firmware version

TCG PC Client Platform Firmware Profile Spec mandates that an S-CRTM
event for the version identifier using the event type EV_S_CRTM_VERSION
must be measured.

So since we are trying to add more conformance into U-Boot, let's add
the event using U_BOOT_VERSION_STRING, extend PCR[0] accordingly and log
it in the EventLog

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 35ae8ed5962e050cd134fd81f97b6ab80ea5ca15..09046844c7239d3b41727075a2e5642dfc2ada9d 100644 (file)
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -13,6 +13,7 @@
 #include <efi_loader.h>
 #include <efi_tcg2.h>
 #include <log.h>
+#include <version.h>
 #include <tpm-v2.h>
 #include <u-boot/sha1.h>
 #include <u-boot/sha256.h>
@@ -1063,6 +1064,36 @@ out:
        return ret;
 }
 
+/**
+ * efi_append_scrtm_version - Append an S-CRTM EV_S_CRTM_VERSION event on the
+ *                           eventlog and extend the PCRs
+ *
+ * @dev:       TPM device
+ *
+ * @Return:    status code
+ */
+static efi_status_t efi_append_scrtm_version(struct udevice *dev)
+{
+       struct tpml_digest_values digest_list;
+       u8 ver[] = U_BOOT_VERSION_STRING;
+       const int pcr_index = 0;
+       efi_status_t ret;
+
+       ret = tcg2_create_digest(ver, sizeof(ver), &digest_list);
+       if (ret != EFI_SUCCESS)
+               goto out;
+
+       ret = tcg2_pcr_extend(dev, pcr_index, &digest_list);
+       if (ret != EFI_SUCCESS)
+               goto out;
+
+       ret = tcg2_agile_log_append(pcr_index, EV_S_CRTM_VERSION, &digest_list,
+                                   sizeof(ver), ver);
+
+out:
+       return ret;
+}
+
 /**
  * efi_tcg2_register() - register EFI_TCG2_PROTOCOL
  *
@@ -1086,6 +1117,10 @@ efi_status_t efi_tcg2_register(void)
        if (ret != EFI_SUCCESS)
                goto fail;
 
+       ret = efi_append_scrtm_version(dev);
+       if (ret != EFI_SUCCESS)
+               goto out;
+
        ret = efi_add_protocol(efi_root, &efi_guid_tcg2_protocol,
                               (void *)&efi_tcg2_protocol);
        if (ret != EFI_SUCCESS) {