> From: Ilias Apalodimas <[email protected]> > Date: Thu, 16 Dec 2021 16:52:08 +0200 > > Right now we unconditionally pass a 'kaslr-seed' property to the kernel > if the DTB we ended up in EFI includes the entry. However the kernel > EFI stub completely ignores it and only relies on EFI_RNG_PROTOCOL. > So let's get rid of it unconditionally since it would mess up the > (upcoming) DTB TPM measuring as well.
NAK OpenBSD uses the kaslr-seed property in the bootloader to mix in some additional entropy. (It will also use EFI_RNG_PROTOCOL if it is avilable, but most U-Boot boards don't provide that, or at least not yet). Even on Linux the EFI stub isn't the only way to load a Linux kernel. You can use a conventional EFI bootloader like grub. Cheers, Mark > Signed-off-by: Ilias Apalodimas <[email protected]> > --- > cmd/bootefi.c | 2 ++ > include/efi_loader.h | 2 ++ > lib/efi_loader/efi_dt_fixup.c | 22 ++++++++++++++++++++++ > 3 files changed, 26 insertions(+) > > diff --git a/cmd/bootefi.c b/cmd/bootefi.c > index d77d3b6e943d..25f9bfce9b84 100644 > --- a/cmd/bootefi.c > +++ b/cmd/bootefi.c > @@ -310,6 +310,8 @@ efi_status_t efi_install_fdt(void *fdt) > /* Create memory reservations as indicated by the device tree */ > efi_carve_out_dt_rsv(fdt); > > + efi_purge_kaslr_seed(fdt); > + > /* Install device tree as UEFI table */ > ret = efi_install_configuration_table(&efi_guid_fdt, fdt); > if (ret != EFI_SUCCESS) { > diff --git a/include/efi_loader.h b/include/efi_loader.h > index 9dd6c2033634..e560401ac54f 100644 > --- a/include/efi_loader.h > +++ b/include/efi_loader.h > @@ -519,6 +519,8 @@ efi_status_t EFIAPI efi_convert_pointer(efi_uintn_t > debug_disposition, > void **address); > /* Carve out DT reserved memory ranges */ > void efi_carve_out_dt_rsv(void *fdt); > +/* Purge unused kaslr-seed */ > +void efi_purge_kaslr_seed(void *fdt); > /* Called by bootefi to make console interface available */ > efi_status_t efi_console_register(void); > /* Called by bootefi to make all disk storage accessible as EFI objects */ > diff --git a/lib/efi_loader/efi_dt_fixup.c b/lib/efi_loader/efi_dt_fixup.c > index b6fe5d2e5a34..02f7de73872e 100644 > --- a/lib/efi_loader/efi_dt_fixup.c > +++ b/lib/efi_loader/efi_dt_fixup.c > @@ -40,6 +40,28 @@ static void efi_reserve_memory(u64 addr, u64 size, bool > nomap) > addr, size); > } > > +/** > + * efi_remove_kaslr_seed() - Removed unused kaslr-seed > + * > + * Kernel's EFI STUB only relies on EFI_RNG_PROTOCOL for randomization > + * and completely ignores the kaslr-seed. Weed it out from the DTB we > + * hand over, which would mess up our DTB TPM measurements as well. > + * > + * @fdt: Pointer to device tree > + */ > +void efi_purge_kaslr_seed(void *fdt) > +{ > + int nodeoff = fdt_path_offset(fdt, "/chosen"); > + int err = 0; > + > + if (nodeoff < 0) > + return; > + > + err = fdt_delprop(fdt, nodeoff, "kaslr-seed"); > + if (err < 0) > + log_err("Error deleting kaslr-seed\n"); > +} > + > /** > * efi_carve_out_dt_rsv() - Carve out DT reserved memory ranges > * > -- > 2.30.2 > >
