diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2024-09-17 10:49:29 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2024-10-09 22:04:56 -0600 |
| commit | b03b2a45f9f07bdfb0074adf9c8b4339080a7def (patch) | |
| tree | 02a2f3cbbb56dc29801d418a571a7219bb21c35f /lib/efi_loader/efi_dt_fixup.c | |
| parent | 93b9cd792089e536f2bfa85d9903fd4798209f76 (diff) | |
efi_leader: delete rng-seed if having EFI RNG protocol
For measured be boot we must avoid any volatile values in the device-tree.
We already delete /chosen/kaslr-seed if we provide and EFI RNG protocol.
Additionally remove /chosen/rng-seed provided by QEMU or U-Boot.
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Diffstat (limited to 'lib/efi_loader/efi_dt_fixup.c')
| -rw-r--r-- | lib/efi_loader/efi_dt_fixup.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/lib/efi_loader/efi_dt_fixup.c b/lib/efi_loader/efi_dt_fixup.c index 9d017804eea..0dac94b0c6c 100644 --- a/lib/efi_loader/efi_dt_fixup.c +++ b/lib/efi_loader/efi_dt_fixup.c @@ -41,7 +41,7 @@ static void efi_reserve_memory(u64 addr, u64 size, bool nomap) } /** - * efi_try_purge_kaslr_seed() - Remove unused kaslr-seed + * efi_try_purge_rng_seed() - Remove unused kaslr-seed, rng-seed * * Kernel's EFI STUB only relies on EFI_RNG_PROTOCOL for randomization * and completely ignores the kaslr-seed for its own randomness needs @@ -51,8 +51,9 @@ static void efi_reserve_memory(u64 addr, u64 size, bool nomap) * * @fdt: Pointer to device tree */ -void efi_try_purge_kaslr_seed(void *fdt) +void efi_try_purge_rng_seed(void *fdt) { + const char * const prop[] = {"kaslr-seed", "rng-seed"}; const efi_guid_t efi_guid_rng_protocol = EFI_RNG_PROTOCOL_GUID; struct efi_handler *handler; efi_status_t ret; @@ -67,9 +68,13 @@ void efi_try_purge_kaslr_seed(void *fdt) if (nodeoff < 0) return; - err = fdt_delprop(fdt, nodeoff, "kaslr-seed"); - if (err < 0 && err != -FDT_ERR_NOTFOUND) - log_err("Error deleting kaslr-seed\n"); + for (size_t i = 0; i < ARRAY_SIZE(prop); ++i) { + err = fdt_delprop(fdt, nodeoff, prop[i]); + if (err < 0 && err != -FDT_ERR_NOTFOUND) + log_err("Error deleting %s\n", prop[i]); + else + log_debug("Deleted /chosen/%s\n", prop[i]); + } } /** |