Bug 2002265

Summary: Shim refuses to boot the system when TPM event logging fails
Product: Red Hat Enterprise Linux 8 Reporter: Renaud Métrich <rmetrich>
Component: shimAssignee: Bootloader engineering team <bootloader-eng-team>
Status: CLOSED ERRATA QA Contact: Release Test Team <release-test-team-automation>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.4CC: bootloader-eng-team, jaredz, lmiksik, mlewando, pjanda, pjones, prjagtap, release-test-team-automation, rharwood, sbarcomb
Target Milestone: rcKeywords: OtherQA
Target Release: ---Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
URL: https://github.com/rhboot/shim/pull/414
Whiteboard:
Fixed In Version: shim-15.5-2.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2065214 (view as bug list) Environment:
Last Closed: 2022-05-10 15:33:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2000946, 2065214    

Description Renaud Métrich 2021-09-08 11:28:31 UTC
Description of problem:

On Dell hardware (at least PowerEdge T340 with BIOS 2.6.3), when selecting option "TPM 1.2 On without Pre-Boot Measurements" in the UEFI firmware, Shim refuses to boot the system the system because the call of mirror_one_mok_variable() function on MokListRT, MokListXRT and SbatLevelRT fails.

Actually the failure is not when creating the variables, but calling tpm_log_event() (line 819):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
 532 static EFI_STATUS NONNULL(1)
 533 mirror_one_mok_variable(struct mok_state_variable *v,
 534                         BOOLEAN only_first)
 535 {
 :
 544         BOOLEAN log = v->flags & MOK_VARIABLE_LOG;
 :
 812                 if (log) {
 813                         /*
 814                          * Log this variable into whichever PCR the table
 815                          * says.
 816                          */
 817                         EFI_PHYSICAL_ADDRESS datap =
 818                                         (EFI_PHYSICAL_ADDRESS)(UINTN)FullData,
 819                         efi_status = tpm_log_event(datap, FullDataSize,
 820                                                    v->pcr, (CHAR8 *)v->name8);
 821                         if (EFI_ERROR(efi_status)) {
 822                                 dprint(L"tpm_log_event(0x%llx, %lu, %lu, \"%s\")->%r\n",
 823                                        FullData, FullDataSize, v->pcr, v->name,
 824                                        efi_status);
 825                                 return efi_status;
 826                         }
 827                 }
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Verbose mode snippet:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
mok.c:358:mirror_mok_db() SetVariable("MokListRT", ... varsz=0x826) = Success
mok.c:792:mirror_one_mok_variable() mirror_mok_db("MokListRT",  datasz=2086) returned Success
mok.c:823:mirror_one_mok_variable() tpm_log_event(0x5C506020, 2086, 14, "MokList")->Unsupported
Could not create MokListRT: Unsupported
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Talking to Javier, he believes that having tpm_log_event() fail should NOT make the mirror_one_mok_variable() function fail, exactly as the code in Grub does (i.e. ignore errors at TPM level):
see patch https://src.fedoraproject.org/rpms/grub2/raw/rawhide/f/0152-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch


Version-Release number of selected component (if applicable):

All shim releases, customer reproduces with latest for RHEL8.4 (shim-x64-15.4-2.el8_1.x86_64)


How reproducible:

Always on customer system, I don't have the hardware to test myself.

Comment 1 Renaud Métrich 2021-09-09 09:51:24 UTC
I gave the customer a shim-unsigned-x64 package with the proposed patch (see https://github.com/rhboot/shim/pull/414).
The customer reported it works fine.

Comment 28 errata-xmlrpc 2022-05-10 15:33:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (shim bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2126