diff options
| author | Ilias Apalodimas <ilias.apalodimas@linaro.org> | 2022-01-03 14:07:37 +0200 |
|---|---|---|
| committer | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2022-01-15 10:57:22 +0100 |
| commit | a2f1482fc0e6c5dbdbafecd360d168f9c12fc529 (patch) | |
| tree | bf78235b627bc129aa589287daa5f4a7e85e9f93 /cmd | |
| parent | bc314f8e5f9b646e5ed09ccee2a2ddb012519305 (diff) | |
| download | u-boot-a2f1482fc0e6c5dbdbafecd360d168f9c12fc529.zip u-boot-a2f1482fc0e6c5dbdbafecd360d168f9c12fc529.tar.gz u-boot-a2f1482fc0e6c5dbdbafecd360d168f9c12fc529.tar.bz2 | |
efi_loader: Get rid of kaslr-seed if EFI_RNG_PROTOCOL is installed
U-Boot, in some occasions, injects a 'kaslr-seed' property on the /chosen
node. That would be problematic in case we want to measure the DTB we
install in the configuration table, since it would change across reboots.
The Linux kernel EFI-stub completely ignores it and only relies on
EFI_RNG_PROTOCOL for it's own randomness needs (i.e the randomization
of the physical placement of the kernel). In fact it (blindly) overwrites
the existing seed if the protocol is installed. However it still uses it
for randomizing it's virtual placement.
So let's get rid of it in the presence of the RNG protocol.
It's worth noting that TPMs also provide an RNG. So if we tweak our
EFI_RNG_PROTOCOL slightly and install the protocol when a TPM device
is present the 'kaslr-seed' property will always be removed, allowing
us to reliably measure our DTB.
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/bootefi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/cmd/bootefi.c b/cmd/bootefi.c index 83eab0b..3a8b2b6 100644 --- a/cmd/bootefi.c +++ b/cmd/bootefi.c @@ -310,6 +310,8 @@ efi_status_t efi_install_fdt(void *fdt) /* Create memory reservations as indicated by the device tree */ efi_carve_out_dt_rsv(fdt); + efi_try_purge_kaslr_seed(fdt); + /* Install device tree as UEFI table */ ret = efi_install_configuration_table(&efi_guid_fdt, fdt); if (ret != EFI_SUCCESS) { |