diff mbox series

[v2,5/5] efi: random: refresh non-volatile random seed when RNG is initialized

Message ID 20221118133239.2515648-6-Jason@zx2c4.com (mailing list archive)
State Not Applicable
Delegated to: Herbert Xu
Headers show
Series Use EFI variables for random seed | expand

Commit Message

Jason A. Donenfeld Nov. 18, 2022, 1:32 p.m. UTC
EFI has a rather unique benefit that it has access to some limited
non-volatile storage, where the kernel can store a random seed. Register
a notification for when the RNG is initialized, and at that point, store
a new random seed.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 drivers/firmware/efi/efi.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

Comments

Ard Biesheuvel Nov. 22, 2022, 1:39 p.m. UTC | #1
On Fri, 18 Nov 2022 at 14:34, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> EFI has a rather unique benefit that it has access to some limited
> non-volatile storage, where the kernel can store a random seed. Register
> a notification for when the RNG is initialized, and at that point, store
> a new random seed.
>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
>  drivers/firmware/efi/efi.c | 19 +++++++++++++++++++
>  1 file changed, 19 insertions(+)
>

Not sure why I don't see v3 in my inbox. In any case,

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

for this patch, or the one with the varname wide string literal used
in place instead of via a CPP macro.

> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index f12cc29bd4b8..f8edf6164833 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -337,6 +337,24 @@ static void __init efi_debugfs_init(void)
>  static inline void efi_debugfs_init(void) {}
>  #endif
>
> +static void refresh_nv_rng_seed(struct work_struct *work)
> +{
> +       u8 seed[EFI_RANDOM_SEED_SIZE];
> +
> +       get_random_bytes(seed, sizeof(seed));
> +       efi.set_variable(LINUX_EFI_RANDOM_NV_SEED_VAR, &LINUX_EFI_RANDOM_SEED_TABLE_GUID,
> +                        EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS |
> +                        EFI_VARIABLE_RUNTIME_ACCESS, sizeof(seed), seed);
> +       memzero_explicit(seed, sizeof(seed));
> +}
> +static int refresh_nv_rng_seed_notification(struct notifier_block *nb, unsigned long action, void *data)
> +{
> +       static DECLARE_WORK(work, refresh_nv_rng_seed);
> +       schedule_work(&work);
> +       return 0;
> +}
> +static struct notifier_block refresh_nv_rng_seed_nb = { .notifier_call = refresh_nv_rng_seed_notification };
> +
>  /*
>   * We register the efi subsystem with the firmware subsystem and the
>   * efivars subsystem with the efi subsystem, if the system was booted with
> @@ -413,6 +431,7 @@ static int __init efisubsys_init(void)
>                 platform_device_register_simple("efi_secret", 0, NULL, 0);
>  #endif
>
> +       execute_with_initialized_rng(&refresh_nv_rng_seed_nb);
>         return 0;
>
>  err_remove_group:
> --
> 2.38.1
>
diff mbox series

Patch

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index f12cc29bd4b8..f8edf6164833 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -337,6 +337,24 @@  static void __init efi_debugfs_init(void)
 static inline void efi_debugfs_init(void) {}
 #endif
 
+static void refresh_nv_rng_seed(struct work_struct *work)
+{
+	u8 seed[EFI_RANDOM_SEED_SIZE];
+
+	get_random_bytes(seed, sizeof(seed));
+	efi.set_variable(LINUX_EFI_RANDOM_NV_SEED_VAR, &LINUX_EFI_RANDOM_SEED_TABLE_GUID,
+			 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			 EFI_VARIABLE_RUNTIME_ACCESS, sizeof(seed), seed);
+	memzero_explicit(seed, sizeof(seed));
+}
+static int refresh_nv_rng_seed_notification(struct notifier_block *nb, unsigned long action, void *data)
+{
+	static DECLARE_WORK(work, refresh_nv_rng_seed);
+	schedule_work(&work);
+	return 0;
+}
+static struct notifier_block refresh_nv_rng_seed_nb = { .notifier_call = refresh_nv_rng_seed_notification };
+
 /*
  * We register the efi subsystem with the firmware subsystem and the
  * efivars subsystem with the efi subsystem, if the system was booted with
@@ -413,6 +431,7 @@  static int __init efisubsys_init(void)
 		platform_device_register_simple("efi_secret", 0, NULL, 0);
 #endif
 
+	execute_with_initialized_rng(&refresh_nv_rng_seed_nb);
 	return 0;
 
 err_remove_group: