From f28dcbcfc971f7159c853e206933c07f57d3f17c Mon Sep 17 00:00:00 2001 From: Arthur Heymans Date: Thu, 29 Apr 2021 09:31:01 +0200 Subject: [PATCH] security/tpm/crtm: Measure FMAP into TPM FMAP is used to look up cbfs files or other FMAP regions so it should be measured too. TESTED: on qemu q35 with swtpm Change-Id: Ic424a094e7f790cce45c5a98b8bc6d46a8dcca1b Signed-off-by: Arthur Heymans Reviewed-on: https://review.coreboot.org/c/coreboot/+/52753 Tested-by: build bot (Jenkins) Reviewed-by: Patrick Rudolph --- src/security/tpm/tspi/crtm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/security/tpm/tspi/crtm.c b/src/security/tpm/tspi/crtm.c index 80483d575e..0841d23f13 100644 --- a/src/security/tpm/tspi/crtm.c +++ b/src/security/tpm/tspi/crtm.c @@ -59,6 +59,17 @@ uint32_t tspi_init_crtm(void) return VB2_SUCCESS; } + struct region_device fmap; + if (fmap_locate_area_as_rdev("FMAP", &fmap) == 0) { + if (tpm_measure_region(&fmap, TPM_RUNTIME_DATA_PCR, "FMAP: FMAP")) { + printk(BIOS_ERR, + "TSPI: Couldn't measure FMAP into CRTM!\n"); + return VB2_ERROR_UNKNOWN; + } + } else { + printk(BIOS_ERR, "TSPI: Could not find FMAP!\n"); + } + /* measure bootblock from RO */ struct cbfsf bootblock_data; struct region_device bootblock_fmap;