colin/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

efi_loader: correctly handle no tpm device error

Browse Source 
When the TCG2 protocol is installed in efi_tcg2_register(),
TPM2 device must be present.
tcg2_measure_pe_image() expects that TCP2 protocol is installed
and TPM device is available. If TCG2 Protocol is installed but
TPM device is not found, tcg2_measure_pe_image() returns
EFI_SECURITY_VIOLATION and efi_load_image() ends with failure.

The same error handling is applied to
efi_tcg2_measure_efi_app_invocation().

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Masahisa Kojima
2021-12-07 14:15:33 +09:00
committed by Heinrich Schuchardt
parent 9e32bf9362
commit f9b51dcf29
3 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/efi_loader/efi_boottime.c
View File

@@ -3016,9 +3016,12 @@ efi_status_t EFIAPI efi_start_image(efi_handle_t image_handle,
if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
ret = efi_tcg2_measure_efi_app_invocation(image_obj);
if (ret != EFI_SUCCESS) {
log_warning("tcg2 measurement fails(0x%lx)\n",
ret);
if (ret == EFI_SECURITY_VIOLATION) {
/*
* TCG2 Protocol is installed but no TPM device found,
* this is not expected.
*/
return EFI_EXIT(EFI_SECURITY_VIOLATION);
}
}
}