File 0001-tpm-Disable-tpm-verifier-if-tpm-is-not-pre... of Package grub2

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch of Package grub2 (Revision b49e534b25ae2f13bb42be8850443f1e)

Currently displaying revision b49e534b25ae2f13bb42be8850443f1e , Show latest

From 649896ed3be7bb31efb0e6801282381c5a7a31ca Mon Sep 17 00:00:00 2001
From: Michael Chang <mchang@suse.com>
Date: Mon, 29 Aug 2022 11:28:28 +0800
Subject: [PATCH] tpm: Disable tpm verifier if tpm is not present

This helps to prevent out of memory error when reading large files via disablig
tpm device as verifier has to read all content into memory in one chunk to
measure the hash and extend to tpm.

Signed-off-by: Michael Chang <mchang@suse.com>
---
 grub-core/commands/efi/tpm.c | 30 ++++++++++++++++++++++++++++++
 grub-core/commands/tpm.c     | 17 +++++++++++++++++
 include/grub/tpm.h           |  1 +
 3 files changed, 48 insertions(+)

diff --git a/grub-core/commands/efi/tpm.c b/grub-core/commands/efi/tpm.c
index 1e399a964..585b3ccb1 100644
--- a/grub-core/commands/efi/tpm.c
+++ b/grub-core/commands/efi/tpm.c
@@ -240,3 +240,33 @@ grub_tpm_measure (unsigned char *buf, grub_size_t size, grub_uint8_t pcr,
   else
     return grub_tpm2_log_event (tpm_handle, buf, size, pcr, description);
 }
+
+int
+grub_tpm_present ()
+{
+  grub_efi_handle_t tpm_handle;
+  grub_efi_uint8_t protocol_version;
+
+  if (!grub_tpm_handle_find (&tpm_handle, &protocol_version))
+    return 0;
+
+  if (protocol_version == 1)
+    {
+      grub_efi_tpm_protocol_t *tpm;
+
+      /*FIXME: Check tpm == 0 when open protocol failed ? */
+      tpm = grub_efi_open_protocol (tpm_handle, &tpm_guid,
+				    GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+
+      return grub_tpm1_present (tpm);
+    }
+  else
+    {
+      grub_efi_tpm2_protocol_t *tpm;
+
+      /*FIXME: Check tpm == 0 when open protocol failed ? */
+      tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid,
+				    GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+      return grub_tpm2_present (tpm);
+    }
+}
diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c
index 2052c36ea..13675493f 100644
--- a/grub-core/commands/tpm.c
+++ b/grub-core/commands/tpm.c
@@ -26,6 +26,7 @@
 #include <grub/term.h>
 #include <grub/verify.h>
 #include <grub/dl.h>
+#include <grub/command.h>
 
 GRUB_MOD_LICENSE ("GPLv3+");
 
@@ -84,12 +85,28 @@ struct grub_file_verifier grub_tpm_verifier = {
   .verify_string = grub_tpm_verify_string,
 };
 
+static grub_err_t
+grub_cmd_tpm_hello (grub_command_t cmd __attribute__ ((unused)),
+		  int argc __attribute__ ((unused)),
+		  char **argv __attribute__ ((unused)))
+{
+  grub_printf ("Hello!\n");
+  return 0;
+}
+
+static grub_command_t cmd_tpm_hello;
 GRUB_MOD_INIT (tpm)
 {
+  cmd_tpm_hello = grub_register_command ("tpm-hello", grub_cmd_tpm_hello, 0, "Show if running debug tpm.");
+  if (!grub_tpm_present())
+    return;
   grub_verifier_register (&grub_tpm_verifier);
 }
 
 GRUB_MOD_FINI (tpm)
 {
+  grub_unregister_command (cmd_tpm_hello);
+  if (!grub_tpm_present())
+    return;
   grub_verifier_unregister (&grub_tpm_verifier);
 }
diff --git a/include/grub/tpm.h b/include/grub/tpm.h
index 5c285cbc5..c19fcbd0a 100644
--- a/include/grub/tpm.h
+++ b/include/grub/tpm.h
@@ -36,4 +36,5 @@
 
 grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size,
 			     grub_uint8_t pcr, const char *description);
+int grub_tpm_present (void);
 #endif
-- 
2.37.2

Places

File 0001-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch of Package grub2 (Revision b49e534b25ae2f13bb42be8850443f1e)

Places