On 12/16/21 15:52, Ilias Apalodimas wrote:
Right now we unconditionally pass a 'kaslr-seed' property to the kernel
if the DTB we ended up in EFI includes the entry. However the kernel
EFI stub completely ignores it and only relies on EFI_RNG_PROTOCOL.
So let's get rid of it unconditionally since it would mess up the
(upcoming) DTB TPM measuring as well.
Signed-off-by: Ilias Apalodimas <[email protected]>
---
cmd/bootefi.c | 2 ++
include/efi_loader.h | 2 ++
lib/efi_loader/efi_dt_fixup.c | 22 ++++++++++++++++++++++
3 files changed, 26 insertions(+)
diff --git a/cmd/bootefi.c b/cmd/bootefi.c
index d77d3b6e943d..25f9bfce9b84 100644
--- a/cmd/bootefi.c
+++ b/cmd/bootefi.c
@@ -310,6 +310,8 @@ efi_status_t efi_install_fdt(void *fdt)
/* Create memory reservations as indicated by the device tree */
efi_carve_out_dt_rsv(fdt);
+ efi_purge_kaslr_seed(fdt);
+
/* Install device tree as UEFI table */
ret = efi_install_configuration_table(&efi_guid_fdt, fdt);
if (ret != EFI_SUCCESS) {
diff --git a/include/efi_loader.h b/include/efi_loader.h
index 9dd6c2033634..e560401ac54f 100644
--- a/include/efi_loader.h
+++ b/include/efi_loader.h
@@ -519,6 +519,8 @@ efi_status_t EFIAPI efi_convert_pointer(efi_uintn_t
debug_disposition,
void **address);
/* Carve out DT reserved memory ranges */
void efi_carve_out_dt_rsv(void *fdt);
+/* Purge unused kaslr-seed */
+void efi_purge_kaslr_seed(void *fdt);
/* Called by bootefi to make console interface available */
efi_status_t efi_console_register(void);
/* Called by bootefi to make all disk storage accessible as EFI objects */
diff --git a/lib/efi_loader/efi_dt_fixup.c b/lib/efi_loader/efi_dt_fixup.c
index b6fe5d2e5a34..02f7de73872e 100644
--- a/lib/efi_loader/efi_dt_fixup.c
+++ b/lib/efi_loader/efi_dt_fixup.c
@@ -40,6 +40,28 @@ static void efi_reserve_memory(u64 addr, u64 size, bool
nomap)
addr, size);
}
+/**
+ * efi_remove_kaslr_seed() - Removed unused kaslr-seed
name mismatch
+ *
+ * Kernel's EFI STUB only relies on EFI_RNG_PROTOCOL for randomization
+ * and completely ignores the kaslr-seed. Weed it out from the DTB we
+ * hand over, which would mess up our DTB TPM measurements as well.
+ *
+ * @fdt: Pointer to device tree
+ */
+void efi_purge_kaslr_seed(void *fdt)
+{
+ int nodeoff = fdt_path_offset(fdt, "/chosen");
+ int err = 0;
+
+ if (nodeoff < 0)
+ return;
+
+ err = fdt_delprop(fdt, nodeoff, "kaslr-seed");
+ if (err < 0)
+ log_err("Error deleting kaslr-seed\n");
If the node does not present this is not an error!
Best regards
Heinrich
+}
+
/**
* efi_carve_out_dt_rsv() - Carve out DT reserved memory ranges
*
