Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-19 19:34:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

efi_loader: correctly handle no tpm device error

Browse source 
When the TCG2 protocol is installed in efi_tcg2_register(),
TPM2 device must be present.
tcg2_measure_pe_image() expects that TCP2 protocol is installed
and TPM device is available. If TCG2 Protocol is installed but
TPM device is not found, tcg2_measure_pe_image() returns
EFI_SECURITY_VIOLATION and efi_load_image() ends with failure.

The same error handling is applied to
efi_tcg2_measure_efi_app_invocation().

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Masahisa Kojima 2021-12-07 14:15:33 +09:00 • committed by Heinrich Schuchardt
parent 9e32bf9362
commit f9b51dcf29
3 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/efi_loader/efi_boottime.c
View file

@ -3016,9 +3016,12 @@ efi_status_t EFIAPI efi_start_image(efi_handle_t image_handle,
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
ret = efi_tcg2_measure_efi_app_invocation(image_obj); ret = efi_tcg2_measure_efi_app_invocation(image_obj);
if (ret != EFI_SUCCESS) { if (ret == EFI_SECURITY_VIOLATION) {
log_warning("tcg2 measurement fails(0x%lx)\n", /*
ret); * TCG2 Protocol is installed but no TPM device found,
* this is not expected.
*/
return EFI_EXIT(EFI_SECURITY_VIOLATION);
} }
} }
} }

13
lib/efi_loader/efi_image_loader.c
View file

@ -934,9 +934,16 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
#if CONFIG_IS_ENABLED(EFI_TCG2_PROTOCOL) #if CONFIG_IS_ENABLED(EFI_TCG2_PROTOCOL)
/* Measure an PE/COFF image */ /* Measure an PE/COFF image */
if (tcg2_measure_pe_image(efi, efi_size, handle, ret = tcg2_measure_pe_image(efi, efi_size, handle, loaded_image_info);
loaded_image_info)) if (ret == EFI_SECURITY_VIOLATION) {
log_err("PE image measurement failed\n"); /*
* TCG2 Protocol is installed but no TPM device found,
* this is not expected.
*/
log_err("PE image measurement failed, no tpm device found\n");
goto err;
}
#endif #endif
/* Copy PE headers */ /* Copy PE headers */

4
lib/efi_loader/efi_tcg2.c
View file

@ -977,7 +977,7 @@ efi_status_t tcg2_measure_pe_image(void *efi, u64 efi_size,
ret = platform_get_tpm2_device(&dev); ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
return ret; return EFI_SECURITY_VIOLATION;
switch (handle->image_type) { switch (handle->image_type) {
case IMAGE_SUBSYSTEM_EFI_APPLICATION: case IMAGE_SUBSYSTEM_EFI_APPLICATION:
@ -2200,7 +2200,7 @@ efi_status_t efi_tcg2_measure_efi_app_invocation(struct efi_loaded_image_obj *ha
ret = platform_get_tpm2_device(&dev); ret = platform_get_tpm2_device(&dev);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)
return ret; return EFI_SECURITY_VIOLATION;
ret = tcg2_measure_boot_variable(dev); ret = tcg2_measure_boot_variable(dev);
if (ret != EFI_SUCCESS) if (ret != EFI_SUCCESS)