dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0139-Make-TPM-errors-less-fatal.patch

d9d99f
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
d9d99f
From: Matthew Garrett <mjg59@coreos.com>
d9d99f
Date: Thu, 13 Oct 2016 13:55:26 -0700
d9d99f
Subject: [PATCH] Make TPM errors less fatal
d9d99f
d9d99f
Handle TPM errors, and stop trying to use the TPM once we hit one.
d9d99f
---
d9d99f
 grub-core/kern/dl.c                   |  1 +
d9d99f
 grub-core/kern/i386/pc/tpm.c          | 21 +++++++++++++++++----
d9d99f
 grub-core/lib/cmdline.c               |  1 +
d9d99f
 grub-core/loader/i386/efi/linux.c     |  2 ++
d9d99f
 grub-core/loader/i386/linux.c         |  1 +
d9d99f
 grub-core/loader/i386/multiboot_mbi.c |  1 +
d9d99f
 grub-core/loader/i386/pc/linux.c      |  1 +
d9d99f
 grub-core/loader/linux.c              |  2 ++
d9d99f
 grub-core/loader/multiboot.c          |  1 +
d9d99f
 grub-core/loader/multiboot_mbi2.c     |  1 +
d9d99f
 grub-core/script/execute.c            |  1 +
d9d99f
 11 files changed, 29 insertions(+), 4 deletions(-)
d9d99f
d9d99f
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
d9d99f
index d0989573866..91105bc4677 100644
d9d99f
--- a/grub-core/kern/dl.c
d9d99f
+++ b/grub-core/kern/dl.c
d9d99f
@@ -831,6 +831,7 @@ grub_dl_load_file (const char *filename)
d9d99f
   grub_file_close (file);
d9d99f
 
d9d99f
   grub_tpm_measure(core, size, GRUB_BINARY_PCR, "grub_module", filename);
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   mod = grub_dl_load_core (core, size);
d9d99f
   grub_free (core);
d9d99f
diff --git a/grub-core/kern/i386/pc/tpm.c b/grub-core/kern/i386/pc/tpm.c
d9d99f
index 8c6c1e6ece2..f6f264aff2e 100644
d9d99f
--- a/grub-core/kern/i386/pc/tpm.c
d9d99f
+++ b/grub-core/kern/i386/pc/tpm.c
d9d99f
@@ -7,21 +7,28 @@
d9d99f
 
d9d99f
 #define TCPA_MAGIC 0x41504354
d9d99f
 
d9d99f
+static int tpm_presence = -1;
d9d99f
+
d9d99f
 int tpm_present(void);
d9d99f
 
d9d99f
 int tpm_present(void)
d9d99f
 {
d9d99f
   struct grub_bios_int_registers regs;
d9d99f
 
d9d99f
+  if (tpm_presence != -1)
d9d99f
+    return tpm_presence;
d9d99f
+
d9d99f
   regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
d9d99f
   regs.eax = 0xbb00;
d9d99f
   regs.ebx = TCPA_MAGIC;
d9d99f
   grub_bios_interrupt (0x1a, ®s;;
d9d99f
 
d9d99f
   if (regs.eax == 0)
d9d99f
-    return 1;
d9d99f
+    tpm_presence = 1;
d9d99f
+  else
d9d99f
+    tpm_presence = 0;
d9d99f
 
d9d99f
-  return 0;
d9d99f
+  return tpm_presence;
d9d99f
 }
d9d99f
 
d9d99f
 grub_err_t
d9d99f
@@ -49,7 +56,10 @@ grub_tpm_execute(PassThroughToTPM_InputParamBlock *inbuf,
d9d99f
   grub_bios_interrupt (0x1a, ®s;;
d9d99f
 
d9d99f
   if (regs.eax)
d9d99f
-    return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
d9d99f
+    {
d9d99f
+	tpm_presence = 0;
d9d99f
+	return grub_error (GRUB_ERR_IO, N_("TPM error %x, disabling TPM"), regs.eax);
d9d99f
+    }
d9d99f
 
d9d99f
   return 0;
d9d99f
 }
d9d99f
@@ -126,7 +136,10 @@ grub_tpm_log_event(unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
d9d99f
 	grub_free(event);
d9d99f
 
d9d99f
 	if (regs.eax)
d9d99f
-		return grub_error (GRUB_ERR_IO, N_("TPM error %x\n"), regs.eax);
d9d99f
+	  {
d9d99f
+		tpm_presence = 0;
d9d99f
+		return grub_error (GRUB_ERR_IO, N_("TPM error %x, disabling TPM"), regs.eax);
d9d99f
+	  }
d9d99f
 
d9d99f
 	return 0;
d9d99f
 }
d9d99f
diff --git a/grub-core/lib/cmdline.c b/grub-core/lib/cmdline.c
d9d99f
index 178f7382f07..d5c12957cad 100644
d9d99f
--- a/grub-core/lib/cmdline.c
d9d99f
+++ b/grub-core/lib/cmdline.c
d9d99f
@@ -128,6 +128,7 @@ int grub_create_loader_cmdline (int argc, char *argv[], char *buf,
d9d99f
 
d9d99f
   grub_tpm_measure ((void *)orig, grub_strlen (orig), GRUB_ASCII_PCR,
d9d99f
 		    "grub_kernel_cmdline", orig);
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   return i;
d9d99f
 }
d9d99f
diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
d9d99f
index 074dbd6513e..ea9f5134e67 100644
d9d99f
--- a/grub-core/loader/i386/efi/linux.c
d9d99f
+++ b/grub-core/loader/i386/efi/linux.c
d9d99f
@@ -133,6 +133,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
d9d99f
           goto fail;
d9d99f
         }
d9d99f
       grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_linuxefi", "Initrd");
d9d99f
+      grub_print_error();
d9d99f
       ptr += cursize;
d9d99f
       grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
d9d99f
       ptr += ALIGN_UP_OVERHEAD (cursize, 4);
d9d99f
@@ -198,6 +199,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
d9d99f
     }
d9d99f
 
d9d99f
   grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel");
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   rc = grub_linuxefi_secure_validate (kernel, filelen);
d9d99f
   if (rc < 0)
d9d99f
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
d9d99f
index 273f48a6c88..76304f05700 100644
d9d99f
--- a/grub-core/loader/i386/linux.c
d9d99f
+++ b/grub-core/loader/i386/linux.c
d9d99f
@@ -726,6 +726,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
d9d99f
     }
d9d99f
 
d9d99f
   grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux", "Kernel");
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   grub_memcpy (&lh, kernel, sizeof (lh));
d9d99f
 
d9d99f
diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c
d9d99f
index 2ce424a997b..ca85358f771 100644
d9d99f
--- a/grub-core/loader/i386/multiboot_mbi.c
d9d99f
+++ b/grub-core/loader/i386/multiboot_mbi.c
d9d99f
@@ -175,6 +175,7 @@ grub_multiboot_load (grub_file_t file, const char *filename)
d9d99f
     }
d9d99f
 
d9d99f
   grub_tpm_measure((unsigned char*)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   header = find_header (buffer, len);
d9d99f
 
d9d99f
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
d9d99f
index 4f8c02288ec..cfff25c21b5 100644
d9d99f
--- a/grub-core/loader/i386/pc/linux.c
d9d99f
+++ b/grub-core/loader/i386/pc/linux.c
d9d99f
@@ -163,6 +163,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
d9d99f
     }
d9d99f
 
d9d99f
   grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux16", "Kernel");
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   grub_memcpy (&lh, kernel, sizeof (lh));
d9d99f
   kernel_offset = sizeof (lh);
d9d99f
diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c
d9d99f
index 78c41e33416..c2c7cfcd0fd 100644
d9d99f
--- a/grub-core/loader/linux.c
d9d99f
+++ b/grub-core/loader/linux.c
d9d99f
@@ -290,6 +290,8 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
d9d99f
 	  return grub_errno;
d9d99f
 	}
d9d99f
       grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_initrd", "Initrd");
d9d99f
+      grub_print_error();
d9d99f
+
d9d99f
       ptr += cursize;
d9d99f
     }
d9d99f
   if (newc)
d9d99f
diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
d9d99f
index 3b87dc4fab3..9a8dae5565b 100644
d9d99f
--- a/grub-core/loader/multiboot.c
d9d99f
+++ b/grub-core/loader/multiboot.c
d9d99f
@@ -442,6 +442,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
d9d99f
 
d9d99f
   grub_file_close (file);
d9d99f
   grub_tpm_measure (module, size, GRUB_BINARY_PCR, "grub_multiboot", argv[0]);
d9d99f
+  grub_print_error();
d9d99f
   return GRUB_ERR_NONE;
d9d99f
 }
d9d99f
 
d9d99f
diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c
d9d99f
index 60ae4606fda..54078455e2f 100644
d9d99f
--- a/grub-core/loader/multiboot_mbi2.c
d9d99f
+++ b/grub-core/loader/multiboot_mbi2.c
d9d99f
@@ -133,6 +133,7 @@ grub_multiboot2_load (grub_file_t file, const char *filename)
d9d99f
   COMPILE_TIME_ASSERT (MULTIBOOT_HEADER_ALIGN % 4 == 0);
d9d99f
 
d9d99f
   grub_tpm_measure ((unsigned char *)mld.buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
d9d99f
+  grub_print_error();
d9d99f
 
d9d99f
   header = find_header (mld.buffer, len);
d9d99f
   if (header == 0)
d9d99f
diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
d9d99f
index 976643c47b0..93965777138 100644
d9d99f
--- a/grub-core/script/execute.c
d9d99f
+++ b/grub-core/script/execute.c
d9d99f
@@ -997,6 +997,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
d9d99f
   cmdstring[cmdlen-1]= '\0';
d9d99f
   grub_tpm_measure ((unsigned char *)cmdstring, cmdlen, GRUB_ASCII_PCR,
d9d99f
 		    "grub_cmd", cmdstring);
d9d99f
+  grub_print_error();
d9d99f
   grub_free(cmdstring);
d9d99f
   invert = 0;
d9d99f
   argc = argv.argc - 1;