summaryrefslogtreecommitdiff
path: root/SecurityPkg/Tcg/TcgDxe
diff options
context:
space:
mode:
authorYao, Jiewen <jiewen.yao@intel.com>2015-01-12 03:21:00 +0000
committerjyao1 <jyao1@Edk2>2015-01-12 03:21:00 +0000
commit6f785cfcc304c48ec04e542ee429df95e7b51bc5 (patch)
tree5fc40fc8b8be583bf58179a4e3d245cad6c5e1ad /SecurityPkg/Tcg/TcgDxe
parent4610b23ab10942d140eb51c4bdbefc5f896979ad (diff)
downloadedk2-platforms-6f785cfcc304c48ec04e542ee429df95e7b51bc5.tar.xz
Handle TPM device error and avoid deadloop in BDS.
If TPM error happens, set TPM flag to NOT present, so that trusted boot patch is disabled. Also report status code for failure, so that platform may register handler to apply policy like force system reset, or disable TPM permanently. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com> Reviewed-by: "Dong, Guo" <guo.dong@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16598 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'SecurityPkg/Tcg/TcgDxe')
-rw-r--r--SecurityPkg/Tcg/TcgDxe/TcgDxe.c36
-rw-r--r--SecurityPkg/Tcg/TcgDxe/TcgDxe.inf5
2 files changed, 32 insertions, 9 deletions
diff --git a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
index 282505dbc7..ea05dc8433 100644
--- a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
+++ b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
@@ -8,7 +8,7 @@ buffer overflow, integer overflow.
TcgDxePassThroughToTpm() will receive untrusted input and do basic validation.
-Copyright (c) 2005 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -51,6 +51,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#include <Library/TpmCommLib.h>
#include <Library/PcdLib.h>
#include <Library/UefiLib.h>
+#include <Library/ReportStatusCodeLib.h>
#include "TpmComm.h"
@@ -264,7 +265,7 @@ TcgDxeStatusCheck (
}
if (EventLogLastEntry != NULL) {
- if (TcgData->BsCap.TPMDeactivatedFlag) {
+ if (TcgData->BsCap.TPMDeactivatedFlag || (!ProtocolCapability.TPMPresentFlag)) {
*EventLogLastEntry = (EFI_PHYSICAL_ADDRESS)(UINTN)0;
} else {
*EventLogLastEntry = (EFI_PHYSICAL_ADDRESS)(UINTN)TcgData->LastEvent;
@@ -411,7 +412,7 @@ TcgDxeLogEvent (
TcgData = TCG_DXE_DATA_FROM_THIS (This);
- if (TcgData->BsCap.TPMDeactivatedFlag) {
+ if (TcgData->BsCap.TPMDeactivatedFlag || (!ProtocolCapability.TPMPresentFlag)) {
return EFI_DEVICE_ERROR;
}
return TcgDxeLogEventI (
@@ -495,8 +496,8 @@ TcgDxeHashLogExtendEventI (
{
EFI_STATUS Status;
- if (HashData == NULL && HashDataLen > 0) {
- return EFI_INVALID_PARAMETER;
+ if (!TcgData->BsCap.TPMPresentFlag) {
+ return EFI_DEVICE_ERROR;
}
if (HashDataLen > 0 || HashData != NULL) {
@@ -507,7 +508,7 @@ TcgDxeHashLogExtendEventI (
);
if (EFI_ERROR(Status)) {
DEBUG ((DEBUG_ERROR, "TpmCommHashAll Failed. %x\n", Status));
- return Status;
+ goto Done;
}
}
@@ -521,6 +522,17 @@ TcgDxeHashLogExtendEventI (
Status = TcgDxeLogEventI (TcgData, NewEventHdr, NewEventData);
}
+Done:
+ if ((Status == EFI_DEVICE_ERROR) || (Status == EFI_TIMEOUT)) {
+ DEBUG ((EFI_D_ERROR, "TcgDxeHashLogExtendEventI - %r. Disable TPM.\n", Status));
+ TcgData->BsCap.TPMPresentFlag = FALSE;
+ REPORT_STATUS_CODE (
+ EFI_ERROR_CODE | EFI_ERROR_MINOR,
+ (PcdGet32 (PcdStatusCodeSubClassTpmDevice) | EFI_P_EC_INTERFACE_ERROR)
+ );
+ Status = EFI_DEVICE_ERROR;
+ }
+
return Status;
}
@@ -569,13 +581,17 @@ TcgDxeHashLogExtendEvent (
TcgData = TCG_DXE_DATA_FROM_THIS (This);
- if (TcgData->BsCap.TPMDeactivatedFlag) {
+ if (TcgData->BsCap.TPMDeactivatedFlag || (!ProtocolCapability.TPMPresentFlag)) {
return EFI_DEVICE_ERROR;
}
if (AlgorithmId != TPM_ALG_SHA) {
return EFI_UNSUPPORTED;
}
+
+ if (HashData == NULL && HashDataLen > 0) {
+ return EFI_INVALID_PARAMETER;
+ }
Status = TcgDxeHashLogExtendEventI (
TcgData,
@@ -1346,6 +1362,10 @@ DriverEntry (
return Status;
}
+ if (GetFirstGuidHob (&gTpmErrorHobGuid) != NULL) {
+ mTcgDxeData.BsCap.TPMPresentFlag = FALSE;
+ }
+
Status = GetTpmStatus (&mTcgDxeData.BsCap.TPMDeactivatedFlag);
if (EFI_ERROR (Status)) {
DEBUG ((
@@ -1363,7 +1383,7 @@ DriverEntry (
EFI_NATIVE_INTERFACE,
&mTcgDxeData.TcgProtocol
);
- if (!EFI_ERROR (Status) && !mTcgDxeData.BsCap.TPMDeactivatedFlag) {
+ if (!EFI_ERROR (Status) && (!mTcgDxeData.BsCap.TPMDeactivatedFlag) && ProtocolCapability.TPMPresentFlag) {
//
// Setup the log area and copy event log from hob list to it
//
diff --git a/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf b/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
index 6cb49124a8..39aeb8b950 100644
--- a/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
+++ b/SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
@@ -2,7 +2,7 @@
# Produces TCG protocol and measures boot environment
# This module will produce TCG protocol and measure boot environment.
#
-# Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.<BR>
# This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at
@@ -51,6 +51,7 @@
PrintLib
UefiLib
PcdLib
+ ReportStatusCodeLib
[Guids]
## SOMETIMES_CONSUMES ## SystemTable # Smbios Table
@@ -59,6 +60,7 @@
gEfiGlobalVariableGuid ## SOMETIMES_CONSUMES ## Variable:L"BootXXXX"
gTcgEventEntryHobGuid ## SOMETIMES_CONSUMES ## HOB
+ gTpmErrorHobGuid ## SOMETIMES_CONSUMES ## HOB
gEfiEventExitBootServicesGuid ## CONSUMES ## Event
gEventExitBootServicesFailedGuid ## SOMETIMES_CONSUMES ## Event
gEfiTpmDeviceInstanceTpm12Guid ## PRODUCES ## GUID # TPM device identifier
@@ -76,6 +78,7 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultOemRevision ## SOMETIMES_CONSUMES
gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorId ## SOMETIMES_CONSUMES
gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiDefaultCreatorRevision ## SOMETIMES_CONSUMES
+ gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeSubClassTpmDevice ## SOMETIMES_CONSUMES
[Depex]
TRUE