tpm2: downgrade most log functions from error to debug

Because most TPM2 functions here are 'library-like' functions, they should be
at debug level, not error level.

The only functions not reduced to logging at debug are tpm2_list_devices(),
since it is expected to print output, and the tpm2_parse_pcr_argument_*()
functions, since the system-wide parse_*_argument() functions generally log at
error level.

src/cryptenroll/cryptenroll-tpm2.c

@@ -209,13 +209,13 @@ int enroll_tpm2(struct crypt_device *cd,
         _cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL;
         r = tpm2_context_new(device, &tpm2_context);
         if (r < 0)
-                return r;
+                return log_error_errno(r, "Failed to create TPM2 context: %m");
 
         bool pcr_value_specified = tpm2_pcr_values_has_any_values(hash_pcr_values, n_hash_pcr_values);
 
         r = tpm2_pcr_read_missing_values(tpm2_context, hash_pcr_values, n_hash_pcr_values);
         if (r < 0)
-                return r;
+                return log_error_errno(r, "Could not read pcr values: %m");
 
         uint16_t hash_pcr_bank = 0;
         uint32_t hash_pcr_mask = 0;
@@ -260,7 +260,7 @@ int enroll_tpm2(struct crypt_device *cd,
                       &srk_buf,
                       &srk_buf_size);
         if (r < 0)
-                return r;
+                return log_error_errno(r, "Failed to seal to TPM2: %m");
 
         /* Let's see if we already have this specific PCR policy hash enrolled, if so, exit early. */
         r = search_policy_hash(cd, policy.buffer, policy.size);
@@ -292,7 +292,7 @@ int enroll_tpm2(struct crypt_device *cd,
                                 srk_buf, srk_buf_size,
                                 &secret2, &secret2_size);
                 if (r < 0)
-                        return r;
+                        return log_error_errno(r, "Failed to unseal secret using TPM2: %m");
 
                 if (memcmp_nn(secret, secret_size, secret2, secret2_size) != 0)
                         return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "TPM2 seal/unseal verification failed.");