From patchwork Thu Dec 16 14:52:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 524507 Delivered-To: patch@linaro.org Received: by 2002:a05:6e04:2287:0:0:0:0 with SMTP id bl7csp644263imb; Thu, 16 Dec 2021 06:52:21 -0800 (PST) X-Google-Smtp-Source: ABdhPJzGvUJaWUa/NUorDVX+E9xMO/m/bp+svBmC6reOounodjMwmP11Cj+s5ipYIYXO+q7BEZ95 X-Received: by 2002:a17:906:314f:: with SMTP id e15mr15979347eje.658.1639666341206; Thu, 16 Dec 2021 06:52:21 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1639666341; cv=none; d=google.com; s=arc-20160816; b=rhzvMf/IuOb7i8+dND18BlQhcq2Vv9gr1OL1ht0tc0hO3cOQDrL74LCR9xzFnTRw01 LPHzRZy3alqegfmtSsOww/FfrvsH+ZsDRpdCSzUB1qqiHlyaL40EvKdb194a8riKB19e MUABsM3Hh84IkaY1YTVItLOLT5ygRepBCXHkyhGBFedxVaZD1UTWGmRrqspeLXJeQprt lHdUhwvIDztLT+oGyArsShLQytDUcuP5FnYLpcAemPJvRiLFf2V9JZ9nI7kmGCnBTCNA cggJ6QEK7rSc64YyKu+qdugHYKwHZ5E25bE9mVUmaibfNiMXbana+kW6m6luS54jAlxz rSQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=er0ESM+2mhmlelMhIEbJU17daY967A+vNgiaumYVQPY=; b=JJy8+JKU03uuFvH04hBOGL6ygf+xpAvXXOiUhfPw9jbU42SRl9ObO/YbHSguVnLNX6 zTanG3/euoP8oYLSIH8AUL7sxE1AAkx18kKFhOVX7IUbAs08/Xaxr5wqedi8Iynl1B09 cD/ZuUl7RczisPgJWPi2RPFY/oMpBTQvofrP/OCf/MRBgQGLBQmZShMpFSveB7A18V1b ITpRuGLyEDgE5W4O773TgjJ6WGrxbFs4e4ktyzhfyo/1evhMH5ErrT+D7pa3Wih+5txt 4oDIQtwAWO9skDdZoDxhomint8mJutV1JAcZECIb9ODTYip8fNqt2b1p9RJQ4F+EMmU1 wWCw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=XD7PxOtJ; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id r13si3716961edv.421.2021.12.16.06.52.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Dec 2021 06:52:21 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=XD7PxOtJ; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 69AC281423; Thu, 16 Dec 2021 15:52:17 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="XD7PxOtJ"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id C897C82EBB; Thu, 16 Dec 2021 15:52:15 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 7C9CC80F67 for ; Thu, 16 Dec 2021 15:52:12 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-wr1-x42b.google.com with SMTP id a18so44696134wrn.6 for ; Thu, 16 Dec 2021 06:52:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=er0ESM+2mhmlelMhIEbJU17daY967A+vNgiaumYVQPY=; b=XD7PxOtJXHgbLDQoIFx7jOvd8WYRLQ5/ahzVWyV1U6Wzs05YVYNstqTwfADSDWBBlF Ade6uZOZWhKHGW1rJRrkmRcggzwzIIanBuWnSrWOVJco8nm5LN7+UfrzURJNBrEm4oBq COnSTzwXU+oldwC0g8XSPl2GR2eNKCzpw2qiMFAC87JlbE5FNOz8QzV5O1s4KK5DpcpH 3yr1qCiUfKQXi3BzHrccj+Hn45Q8bq5y80b8euaPwwlTZs+Hl9MCM8iVtTklMDWr2Qo2 ZGtImuE8+NbH7KJnZpG/XxOydEvxUzKlHeIt92C7uYFJqdcEW+x/Yot3bNR4oUBEjtMq CR2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=er0ESM+2mhmlelMhIEbJU17daY967A+vNgiaumYVQPY=; b=SSLR12DMoxk3+Fi1zCH2vwacHlFfhASeCaMqM2k3lEdmvbxNb5MenBSBl3AfmHw9BW X0yvdby0Q1kabHtefUZyzgQs8+rMlG8GtHvHMtPupsUGIAZV8srhmA9Qils/FoVYGwdR xWOdJo5l+64k77tqYu16AENCZr2dYR4D36yxYyNcmfR1ppAXq6PrpIohlIjmsuLUJ847 7QkctBN2cRoKuSRtrTn83JX2H+fWSOwPW7MUYERG6+jEVOwRDuG0kO2+thvxYaDt6fFm bMczgooUAFzlS/KF2QcTuVgnkO8Uj45kNqBy02cFotUhPEL1OEjNNrQ70T3RZmODEq1/ egHQ== X-Gm-Message-State: AOAM530Y0sHrnS0sdX2xvlCbHbRhJFAhp/IciuZlvqNNJlBqLVsf5ard nIefuA9I0vxe4PszGBcko75Aeg== X-Received: by 2002:adf:fc09:: with SMTP id i9mr5210376wrr.336.1639666331937; Thu, 16 Dec 2021 06:52:11 -0800 (PST) Received: from hades.. (athedsl-4461669.home.otenet.gr. [94.71.4.85]) by smtp.gmail.com with ESMTPSA id o2sm3899225wru.109.2021.12.16.06.52.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Dec 2021 06:52:11 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: ardb@kernel.org, Ilias Apalodimas , Alexander Graf , u-boot@lists.denx.de Subject: [PATCH] efi_loader: Get rid of kaslr-seed Date: Thu, 16 Dec 2021 16:52:08 +0200 Message-Id: <20211216145209.2426137-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.38 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean Right now we unconditionally pass a 'kaslr-seed' property to the kernel if the DTB we ended up in EFI includes the entry. However the kernel EFI stub completely ignores it and only relies on EFI_RNG_PROTOCOL. So let's get rid of it unconditionally since it would mess up the (upcoming) DTB TPM measuring as well. Signed-off-by: Ilias Apalodimas Acked-by: Ard Biesheuvel --- cmd/bootefi.c | 2 ++ include/efi_loader.h | 2 ++ lib/efi_loader/efi_dt_fixup.c | 22 ++++++++++++++++++++++ 3 files changed, 26 insertions(+) diff --git a/cmd/bootefi.c b/cmd/bootefi.c index d77d3b6e943d..25f9bfce9b84 100644 --- a/cmd/bootefi.c +++ b/cmd/bootefi.c @@ -310,6 +310,8 @@ efi_status_t efi_install_fdt(void *fdt) /* Create memory reservations as indicated by the device tree */ efi_carve_out_dt_rsv(fdt); + efi_purge_kaslr_seed(fdt); + /* Install device tree as UEFI table */ ret = efi_install_configuration_table(&efi_guid_fdt, fdt); if (ret != EFI_SUCCESS) { diff --git a/include/efi_loader.h b/include/efi_loader.h index 9dd6c2033634..e560401ac54f 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -519,6 +519,8 @@ efi_status_t EFIAPI efi_convert_pointer(efi_uintn_t debug_disposition, void **address); /* Carve out DT reserved memory ranges */ void efi_carve_out_dt_rsv(void *fdt); +/* Purge unused kaslr-seed */ +void efi_purge_kaslr_seed(void *fdt); /* Called by bootefi to make console interface available */ efi_status_t efi_console_register(void); /* Called by bootefi to make all disk storage accessible as EFI objects */ diff --git a/lib/efi_loader/efi_dt_fixup.c b/lib/efi_loader/efi_dt_fixup.c index b6fe5d2e5a34..02f7de73872e 100644 --- a/lib/efi_loader/efi_dt_fixup.c +++ b/lib/efi_loader/efi_dt_fixup.c @@ -40,6 +40,28 @@ static void efi_reserve_memory(u64 addr, u64 size, bool nomap) addr, size); } +/** + * efi_remove_kaslr_seed() - Removed unused kaslr-seed + * + * Kernel's EFI STUB only relies on EFI_RNG_PROTOCOL for randomization + * and completely ignores the kaslr-seed. Weed it out from the DTB we + * hand over, which would mess up our DTB TPM measurements as well. + * + * @fdt: Pointer to device tree + */ +void efi_purge_kaslr_seed(void *fdt) +{ + int nodeoff = fdt_path_offset(fdt, "/chosen"); + int err = 0; + + if (nodeoff < 0) + return; + + err = fdt_delprop(fdt, nodeoff, "kaslr-seed"); + if (err < 0) + log_err("Error deleting kaslr-seed\n"); +} + /** * efi_carve_out_dt_rsv() - Carve out DT reserved memory ranges *