Hi Ana, Applying this seems to fail. Can you rebase and respin the series?
Thanks /Ilias On Tue, 3 Nov 2026 at 18:13, Ana Bobillo <[email protected]> wrote: > > From: Ana Bobillo <[email protected]> > > With TCG2 measured boot, efi_load_pe() measures each image into PCR 4 > or 2. When the measurement finds no TPM, it marks the image as not > authenticated, so that it cannot be started. Any other error is ignored, > so an image whose hash cannot be computed, because efi_image_parse() > rejects it, or whose PCR could not be extended is loaded and can be > started without being measured. With the range checks added to > efi_image_parse() earlier in this series, more malformed images take > this path. Such an image runs with boot services and can start the > expected boot loader itself, which is measured as usual, so the PCRs > end up as for a good boot. > > Handle every failed measurement like the missing TPM: mark the image as > not authenticated, so that LoadImage() returns EFI_SECURITY_VIOLATION > and StartImage() refuses to start it. A full event log is no error, as > in EDK2's DxeTpm2MeasureBootLib: the PCR has been extended all the same. > > Fixes: 163a0d7e2cbd ("efi_loader: add PE/COFF image measurement") > Signed-off-by: Ana Bobillo <[email protected]> > --- > This applies on top of Heinrich's "efi_loader: handling of missing > TPM in efi_load_pe()": https://patchwork.ozlabs.org/patch/2335140/ > > lib/efi_loader/efi_image_loader.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/lib/efi_loader/efi_image_loader.c > b/lib/efi_loader/efi_image_loader.c > index a0879f18621..ef6ff055c63 100644 > --- a/lib/efi_loader/efi_image_loader.c > +++ b/lib/efi_loader/efi_image_loader.c > @@ -1163,6 +1163,14 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj > *handle, > */ > log_err("PE image measurement failed, no tpm device found\n"); > handle->auth_status = EFI_IMAGE_AUTH_FAILED; > + } else if (ret != EFI_SUCCESS && ret != EFI_VOLUME_FULL) { > + /* > + * The image cannot be hashed or the PCR cannot be extended. > + * Do not start an image that has not been measured. A full > + * event log is no error: the PCR has been extended all the > same. > + */ > + log_err("PE image measurement failed\n"); > + handle->auth_status = EFI_IMAGE_AUTH_FAILED; > } > #endif >
