Make TPM errors less fatal
Handle TPM errors, and stop trying to use the TPM once we hit one.
This commit is contained in:
parent
5962f7d5e7
commit
bf25cda14e
11 changed files with 29 additions and 4 deletions
|
@ -725,6 +725,7 @@ grub_dl_load_file (const char *filename)
|
||||||
grub_file_close (file);
|
grub_file_close (file);
|
||||||
|
|
||||||
grub_tpm_measure(core, size, GRUB_BINARY_PCR, "grub_module", filename);
|
grub_tpm_measure(core, size, GRUB_BINARY_PCR, "grub_module", filename);
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
mod = grub_dl_load_core (core, size);
|
mod = grub_dl_load_core (core, size);
|
||||||
grub_free (core);
|
grub_free (core);
|
||||||
|
|
|
@ -7,21 +7,28 @@
|
||||||
|
|
||||||
#define TCPA_MAGIC 0x41504354
|
#define TCPA_MAGIC 0x41504354
|
||||||
|
|
||||||
|
static int tpm_presence = -1;
|
||||||
|
|
||||||
int tpm_present(void);
|
int tpm_present(void);
|
||||||
|
|
||||||
int tpm_present(void)
|
int tpm_present(void)
|
||||||
{
|
{
|
||||||
struct grub_bios_int_registers regs;
|
struct grub_bios_int_registers regs;
|
||||||
|
|
||||||
|
if (tpm_presence != -1)
|
||||||
|
return tpm_presence;
|
||||||
|
|
||||||
regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
|
regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
|
||||||
regs.eax = 0xbb00;
|
regs.eax = 0xbb00;
|
||||||
regs.ebx = TCPA_MAGIC;
|
regs.ebx = TCPA_MAGIC;
|
||||||
grub_bios_interrupt (0x1a, ®s);
|
grub_bios_interrupt (0x1a, ®s);
|
||||||
|
|
||||||
if (regs.eax == 0)
|
if (regs.eax == 0)
|
||||||
return 1;
|
tpm_presence = 1;
|
||||||
|
else
|
||||||
|
tpm_presence = 0;
|
||||||
|
|
||||||
return 0;
|
return tpm_presence;
|
||||||
}
|
}
|
||||||
|
|
||||||
grub_err_t
|
grub_err_t
|
||||||
|
@ -49,7 +56,10 @@ grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
|
||||||
grub_bios_interrupt (0x1a, ®s);
|
grub_bios_interrupt (0x1a, ®s);
|
||||||
|
|
||||||
if (regs.eax)
|
if (regs.eax)
|
||||||
return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
|
{
|
||||||
|
tpm_presence = 0;
|
||||||
|
return grub_error (GRUB_ERR_IO, N_("TPM error %x, disabling TPM"), regs.eax);
|
||||||
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
@ -126,7 +136,10 @@ grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
|
||||||
grub_free(event);
|
grub_free(event);
|
||||||
|
|
||||||
if (regs.eax)
|
if (regs.eax)
|
||||||
return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
|
{
|
||||||
|
tpm_presence = 0;
|
||||||
|
return grub_error (GRUB_ERR_IO, N_("TPM error %x, disabling TPM"), regs.eax);
|
||||||
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -107,6 +107,7 @@ int grub_create_loader_cmdline (int argc, char *argv[], char *buf,
|
||||||
|
|
||||||
grub_tpm_measure ((void *)orig, grub_strlen (orig), GRUB_ASCII_PCR,
|
grub_tpm_measure ((void *)orig, grub_strlen (orig), GRUB_ASCII_PCR,
|
||||||
"grub_kernel_cmdline", orig);
|
"grub_kernel_cmdline", orig);
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
return i;
|
return i;
|
||||||
}
|
}
|
||||||
|
|
|
@ -170,6 +170,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_linuxefi", "Initrd");
|
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_linuxefi", "Initrd");
|
||||||
|
grub_print_error();
|
||||||
ptr += cursize;
|
ptr += cursize;
|
||||||
grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
|
grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
|
||||||
ptr += ALIGN_UP_OVERHEAD (cursize, 4);
|
ptr += ALIGN_UP_OVERHEAD (cursize, 4);
|
||||||
|
@ -226,6 +227,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
||||||
}
|
}
|
||||||
|
|
||||||
grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel");
|
grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel");
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
if (! grub_linuxefi_secure_validate (kernel, filelen))
|
if (! grub_linuxefi_secure_validate (kernel, filelen))
|
||||||
{
|
{
|
||||||
|
|
|
@ -719,6 +719,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
||||||
}
|
}
|
||||||
|
|
||||||
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux", "Kernel");
|
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux", "Kernel");
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
grub_memcpy (&lh, kernel, sizeof (lh));
|
grub_memcpy (&lh, kernel, sizeof (lh));
|
||||||
|
|
||||||
|
|
|
@ -166,6 +166,7 @@ grub_multiboot_load (grub_file_t file, const char *filename)
|
||||||
}
|
}
|
||||||
|
|
||||||
grub_tpm_measure((unsigned char*)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
|
grub_tpm_measure((unsigned char*)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
header = find_header (buffer, len);
|
header = find_header (buffer, len);
|
||||||
|
|
||||||
|
|
|
@ -162,6 +162,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
||||||
}
|
}
|
||||||
|
|
||||||
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux16", "Kernel");
|
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux16", "Kernel");
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
grub_memcpy (&lh, kernel, sizeof (lh));
|
grub_memcpy (&lh, kernel, sizeof (lh));
|
||||||
kernel_offset = sizeof (lh);
|
kernel_offset = sizeof (lh);
|
||||||
|
|
|
@ -290,6 +290,8 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
|
||||||
return grub_errno;
|
return grub_errno;
|
||||||
}
|
}
|
||||||
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_initrd", "Initrd");
|
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_initrd", "Initrd");
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
ptr += cursize;
|
ptr += cursize;
|
||||||
}
|
}
|
||||||
if (newc)
|
if (newc)
|
||||||
|
|
|
@ -386,6 +386,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
|
||||||
|
|
||||||
grub_file_close (file);
|
grub_file_close (file);
|
||||||
grub_tpm_measure (module, size, GRUB_BINARY_PCR, "grub_multiboot", argv[0]);
|
grub_tpm_measure (module, size, GRUB_BINARY_PCR, "grub_multiboot", argv[0]);
|
||||||
|
grub_print_error();
|
||||||
return GRUB_ERR_NONE;
|
return GRUB_ERR_NONE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -128,6 +128,7 @@ grub_multiboot_load (grub_file_t file, const char *filename)
|
||||||
COMPILE_TIME_ASSERT (MULTIBOOT_HEADER_ALIGN % 4 == 0);
|
COMPILE_TIME_ASSERT (MULTIBOOT_HEADER_ALIGN % 4 == 0);
|
||||||
|
|
||||||
grub_tpm_measure ((unsigned char *)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
|
grub_tpm_measure ((unsigned char *)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
|
||||||
|
grub_print_error();
|
||||||
|
|
||||||
header = find_header (buffer, len);
|
header = find_header (buffer, len);
|
||||||
|
|
||||||
|
|
|
@ -963,6 +963,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
|
||||||
cmdstring[cmdlen-1]= '\0';
|
cmdstring[cmdlen-1]= '\0';
|
||||||
grub_tpm_measure ((unsigned char *)cmdstring, cmdlen, GRUB_ASCII_PCR,
|
grub_tpm_measure ((unsigned char *)cmdstring, cmdlen, GRUB_ASCII_PCR,
|
||||||
"grub_cmd", cmdstring);
|
"grub_cmd", cmdstring);
|
||||||
|
grub_print_error();
|
||||||
grub_free(cmdstring);
|
grub_free(cmdstring);
|
||||||
invert = 0;
|
invert = 0;
|
||||||
argc = argv.argc - 1;
|
argc = argv.argc - 1;
|
||||||
|
|
Loading…
Reference in a new issue