diff mbox series

[v4,3/4] efi_loader: simplify tcg2_measure_secure_boot_variable()

Message ID 20211026082727.23399-4-masahisa.kojima@linaro.org
State Accepted
Commit 96485d2f3f30c1f482bd138752188cbbc64fb307
Headers show
Series Enhance Measured Boot | expand

Commit Message

Masahisa Kojima Oct. 26, 2021, 8:27 a.m. UTC 
This commit simplifies tcg2_measure_secure_boot_variable()
using secure_variables table.

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>

---
Newly added in v4

 lib/efi_loader/efi_tcg2.c | 60 ++++++++++++---------------------------
 1 file changed, 18 insertions(+), 42 deletions(-)

-- 
2.17.1
diff mbox series

Patch

diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 377b138855..6545ec9e79 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -81,12 +81,19 @@  static const struct digest_info hash_algo_list[] = {
 	},
 };
 
-static const u16 *secure_variables[] = {
-	u"SecureBoot",
-	u"PK",
-	u"KEK",
-	u"db",
-	u"dbx",
+struct variable_info {
+	const u16	*name;
+	bool		accept_empty;
+};
+
+static struct variable_info secure_variables[] = {
+	{u"SecureBoot",		true},
+	{u"PK",			true},
+	{u"KEK",		true},
+	{u"db",			true},
+	{u"dbx",		true},
+	{u"dbt",		false},
+	{u"dbr",		false},
 };
 
 #define MAX_HASH_COUNT ARRAY_SIZE(hash_algo_list)
@@ -1820,52 +1827,21 @@  static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev)
 	for (i = 0; i < count; i++) {
 		const efi_guid_t *guid;
 
-		guid = efi_auth_var_get_guid(secure_variables[i]);
+		guid = efi_auth_var_get_guid(secure_variables[i].name);
 
-		/*
-		 * According to the TCG2 PC Client PFP spec, "SecureBoot",
-		 * "PK", "KEK", "db" and "dbx" variables must be measured
-		 * even if they are empty.
-		 */
-		data = efi_get_var(secure_variables[i], guid, &data_size);
+		data = efi_get_var(secure_variables[i].name, guid, &data_size);
+		if (!data && !secure_variables[i].accept_empty)
+			continue;
 
 		ret = tcg2_measure_variable(dev, 7,
 					    EV_EFI_VARIABLE_DRIVER_CONFIG,
-					    secure_variables[i], guid,
+					    secure_variables[i].name, guid,
 					    data_size, data);
 		free(data);
 		if (ret != EFI_SUCCESS)
 			goto error;
 	}
 
-	/*
-	 * TCG2 PC Client PFP spec says "dbt" and "dbr" are
-	 * measured if present and not empty.
-	 */
-	data = efi_get_var(L"dbt",
-			   &efi_guid_image_security_database,
-			   &data_size);
-	if (data) {
-		ret = tcg2_measure_variable(dev, 7,
-					    EV_EFI_VARIABLE_DRIVER_CONFIG,
-					    L"dbt",
-					    &efi_guid_image_security_database,
-					    data_size, data);
-		free(data);
-	}
-
-	data = efi_get_var(L"dbr",
-			   &efi_guid_image_security_database,
-			   &data_size);
-	if (data) {
-		ret = tcg2_measure_variable(dev, 7,
-					    EV_EFI_VARIABLE_DRIVER_CONFIG,
-					    L"dbr",
-					    &efi_guid_image_security_database,
-					    data_size, data);
-		free(data);
-	}
-
 error:
 	return ret;
 }