Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-16 09:54:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

efi_loader: correctly handle no tpm device error

Browse source 
When the TCG2 protocol is installed in efi_tcg2_register(),
TPM2 device must be present.
tcg2_measure_pe_image() expects that TCP2 protocol is installed
and TPM device is available. If TCG2 Protocol is installed but
TPM device is not found, tcg2_measure_pe_image() returns
EFI_SECURITY_VIOLATION and efi_load_image() ends with failure.

The same error handling is applied to
efi_tcg2_measure_efi_app_invocation().

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Masahisa Kojima 2021-12-07 14:15:33 +09:00 • committed by Heinrich Schuchardt
parent 9e32bf9362
commit f9b51dcf29
3 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/efi_loader/efi_boottime.c
View file

@ -3016,9 +3016,12 @@ efi_status_t EFIAPI efi_start_image(efi_handle_t image_handle,
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
ret = efi_tcg2_measure_efi_app_invocation(image_obj);
if (ret != EFI_SUCCESS) {
log_warning("tcg2 measurement fails(0x%lx)\n",
ret);
if (ret == EFI_SECURITY_VIOLATION) {
/*
* TCG2 Protocol is installed but no TPM device found,
* this is not expected.
*/
return EFI_EXIT(EFI_SECURITY_VIOLATION);
}
}
}

13
lib/efi_loader/efi_image_loader.c
View file

@ -934,9 +934,16 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
#if CONFIG_IS_ENABLED(EFI_TCG2_PROTOCOL)
/* Measure an PE/COFF image */
if (tcg2_measure_pe_image(efi, efi_size, handle,
loaded_image_info))
log_err("PE image measurement failed\n");
ret = tcg2_measure_pe_image(efi, efi_size, handle, loaded_image_info);
if (ret == EFI_SECURITY_VIOLATION) {
/*
* TCG2 Protocol is installed but no TPM device found,
* this is not expected.
*/
log_err("PE image measurement failed, no tpm device found\n");
goto err;
}
#endif
/* Copy PE headers */

4
lib/efi_loader/efi_tcg2.c
View file

@ -977,7 +977,7 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size,
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS)
return ret;
return EFI_SECURITY_VIOLATION;
switch (handle->image_type) {
case IMAGE_SUBSYSTEM_EFI_APPLICATION:
@ -2200,7 +2200,7 @@ efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *ha
ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS)
return ret;
return EFI_SECURITY_VIOLATION;
ret = tcg2_measure_boot_variable(dev);
if (ret != EFI_SUCCESS)