Currently booting the system is prevented when call to EFI firmware hash_log_extend_event() returns unknown error. Solve this by following convention used in commit a4356538d (commands/tpm: Don't propagate measurement failures to the verifiers layer).
Let the system to be bootable by default when unknown TPM error is encountered. Check environment variable tpm_fail_fatal to fallback to previous behaviour. Signed-off-by: Michał Grzelak <mchl.gr...@gmail.com> --- docs/grub.texi | 5 +++++ grub-core/commands/efi/tpm.c | 3 ++- grub-core/commands/tpm.c | 7 ------- include/grub/tpm.h | 9 +++++++++ 4 files changed, 16 insertions(+), 8 deletions(-) diff --git a/docs/grub.texi b/docs/grub.texi index 9b58886a9..fc4e08f2c 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -3841,6 +3841,11 @@ If this variable is set and true (i.e., not set to ``0'', ``false'', fatal. Otherwise, they will merely be debug-logged and boot will continue. +Call to EFI firmware, like hash_log_extend_event(), can return an unknown +error, i.e. due to bug present in firmware. When this variable is set and +true (same values as with TPM measurements) this situation will be considered +to be fatal and error-logged as ``unknown TPM error''. If not set, booting +the OS will be enabled. @node Environment block @section The GRUB environment block diff --git a/grub-core/commands/efi/tpm.c b/grub-core/commands/efi/tpm.c index c616768f9..508ae8b3a 100644 --- a/grub-core/commands/efi/tpm.c +++ b/grub-core/commands/efi/tpm.c @@ -146,7 +146,8 @@ grub_efi_log_event_status (grub_efi_status_t status) case GRUB_EFI_NOT_FOUND: return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("TPM unavailable")); default: - return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unknown TPM error")); + return grub_error (is_tpm_fail_fatal () ? GRUB_ERR_UNKNOWN_DEVICE + : GRUB_ERR_NONE, N_("unknown TPM error")); } } diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c index 9f830916d..c7e599170 100644 --- a/grub-core/commands/tpm.c +++ b/grub-core/commands/tpm.c @@ -18,7 +18,6 @@ * Core TPM support code. */ -#include <grub/env.h> #include <grub/err.h> #include <grub/i18n.h> #include <grub/misc.h> @@ -40,12 +39,6 @@ grub_tpm_verify_init (grub_file_t io, return GRUB_ERR_NONE; } -static inline bool -is_tpm_fail_fatal (void) -{ - return grub_env_get_bool ("tpm_fail_fatal", false); -} - static grub_err_t grub_tpm_verify_write (void *context, void *buf, grub_size_t size) { diff --git a/include/grub/tpm.h b/include/grub/tpm.h index c19fcbd0a..11238da18 100644 --- a/include/grub/tpm.h +++ b/include/grub/tpm.h @@ -19,6 +19,8 @@ #ifndef GRUB_TPM_HEADER #define GRUB_TPM_HEADER 1 +#include <grub/env.h> + #define GRUB_STRING_PCR 8 #define GRUB_BINARY_PCR 9 @@ -37,4 +39,11 @@ grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size, grub_uint8_t pcr, const char *description); int grub_tpm_present (void); + +static inline bool +is_tpm_fail_fatal (void) +{ + return grub_env_get_bool ("tpm_fail_fatal", false); +} + #endif -- 2.37.3 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel