-
Notifications
You must be signed in to change notification settings - Fork 281
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Also use a config table to mirror mok variables.
Everything was going just fine until I made a vendor_db with 17kB of sha256 sums in it. And then the same source tree that had worked fine without that threw errors and failed all over the place. I wrote some code to diagnose the problem, and of course it was a failure in mirroring MokList to MokListRT. As Patrick noted in 741c61a, some systems have obnoxiously low amounts of variable storage available: mok.c:550:import_mok_state() BS+RT variable info: MaximumVariableStorageSize:0x000000000000DFE4 RemainingVariableStorageSize:0x000000000000D21C MaximumVariableSize:0x0000000000001FC4 The most annoying part is that on at least this edk2 build, SetVariable() /does actually appear to set the variable/, but it returns EFI_INVALID_PARAMETER. I'm not planning on relying on that behavior. So... yeah, the largest *volatile* (i.e. RAM only) variable this edk2 build will let you create is less than two pages. It's only got 7.9G free, so I guess it's feeling like space is a little tight. We're also not quite preserving that return code well enough for his workaround to work. New plan. We try to create variables the normal way, but we don't consider not having enough space to be fatal. In that case, we create an EFI_SECURITY_LIST with one sha256sum in it, with a value of all 0, and try to add that so we're sure there's /something/ there that's innocuous. On systems where the first SetVariable() / QueryVariableInfo() lied to us, the correct variable should be there, otherwise the one with the zero-hash will be. We then also build a config table to hold this info and install that. The config table is a packed array of this struct: struct mok_variable_config_entry { CHAR8 name[256]; UINT64 data_size; UINT8 data[]; }; There will be N+1 entries, and the last entry is all 0 for name and data_size. The total allocation size will always be a multiple of 4096. In the typical RHEL 7.9 case that means it'll be around 5 pages. It's installed with this guid: c451ed2b-9694-45d3-baba-ed9f8988a389 Anything that can go wrong will. Signed-off-by: Peter Jones <pjones@redhat.com> Upstream: not yet, I don't want people to read this before Wednesday. Signed-off-by: Peter Jones <pjones@redhat.com>
- Loading branch information
Showing
3 changed files
with
140 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters