efi: implement platform-agnostic arm64 host security checks - #564
Closed
alexclewontin wants to merge 7 commits into
Closed
efi: implement platform-agnostic arm64 host security checks#564alexclewontin wants to merge 7 commits into
alexclewontin wants to merge 7 commits into
Conversation
CheckResult.Warnings is a CompoundError interface that RunChecks leaves nil when no warnings were detected. Unwrap on a nil interface panics, so only unwrap when warnings are present.
github.com/canonical/cpuid does not compile on non-x86 architectures, which forced the AMD64 host environment to be split across a filename gated default_env_amd64.go and a default_env_amd64_null.go stub. That made the implementation invisible to the compiler, and untestable, on every other architecture. Confine that dependency to a new internal/cpuid package. It is a deliberately thin wrapper, and the only place in the tree that is gated by architecture at build time. It exposes VendorIdentificator, Family and HasFeature, delegating to the upstream package on amd64 and returning zero values elsewhere. internal/efi is now architecture neutral: it carries no build constraints, the AMD64 implementation collapses into default_env.go, and AMD64() selects on a mockable runtimeGOARCH rather than a build tag. This mirrors the runtime dispatch used elsewhere for host security checks. The CPUIDFeature* constants stay in internal/efi, so callers are unchanged. Their drift guards against the upstream bit positions move to internal/cpuid, which is now the only package able to see both. The AMD64 tests lose their build constraints and drive the CPU identity through new mock hooks instead of mutating upstream package variables, so they run everywhere. TestNotAMD64Host no longer depends on the host architecture, and therefore now runs on amd64 too.
Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
force-pushed
the
check-host-security-arm64
branch
from
September 3, 2026 17:31
d599a22 to
142a04a
Compare
MitchellAugustin
approved these changes
Sep 3, 2026
MitchellAugustin
left a comment
MitchellAugustin
left a comment
Member
There was a problem hiding this comment.
What has been implemented here so far looks good from my perspective. Main thoughts:
- In my comparison of this PR's diff against #560 diff, none of the new delta seems problematic to me
- SMBIOS table 4 detection and platform-level items discussed in 560 have been cleanly included in this PR
This was only a static code review (I did not test)
| // checkHostSecurityARM64Platform selects the platform-specific firmware | ||
| // integrity check. Tests replace this to supply synthetic platforms. | ||
| var checkHostSecurityARM64Platform = func(env internal_efi.HostEnvironmentARM64, cpuManufacturer string) (platformFirmwareIntegrityConfig, error) { | ||
| return platformFirmwareIntegrityNone, &UnsupportedPlatformError{fmt.Errorf("unsupported CPU manufacturer: %s", cpuManufacturer)} |
Member
There was a problem hiding this comment.
I guess this is intentionally a stub until we have our updates from NVIDIA?
Member
Author
There was a problem hiding this comment.
yes, although this could be a stub that includes a switch case statement
Member
Author
|
Closing in favor of #566 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a framework for host security checks on arm64 platforms. It builds on #563 (which represents most of the diff), and is part of an attempt to split up #560.
It adds a generic framework to check host security on ARM64. Very few truly cross-platform APIs were found to be applicable to that ecosystem, but we can use the backing driver for the TPM to prove that a given TPM is a fTPM: if it is using the OP-TEE fTPM driver we can be sure that it is an fTPM. This is not conclusive (absence of that driver doesn't prove that a TPM is a dTPM), but it is a common reference implementation for the ARM ecosystem, so worth including.