torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

efi: random: refresh non-volatile random seed when RNG is initialized

Browse Source 
EFI has a rather unique benefit that it has access to some limited
non-volatile storage, where the kernel can store a random seed. Register
a notification for when the RNG is initialized, and at that point, store
a new random seed.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld 2022-11-16 17:16:42 +01:00
parent 898f1e5c37
commit e7b813b32a
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/firmware/efi/efi.c
View File

@ -337,6 +337,24 @@ static void __init efi_debugfs_init(void)
static inline void efi_debugfs_init(void) {} static inline void efi_debugfs_init(void) {}
#endif #endif
static void refresh_nv_rng_seed(struct work_struct *work)
{
u8 seed[EFI_RANDOM_SEED_SIZE];
get_random_bytes(seed, sizeof(seed));
efi.set_variable(L"RandomSeed", &LINUX_EFI_RANDOM_SEED_TABLE_GUID,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS, sizeof(seed), seed);
memzero_explicit(seed, sizeof(seed));
}
static int refresh_nv_rng_seed_notification(struct notifier_block *nb, unsigned long action, void *data)
{
static DECLARE_WORK(work, refresh_nv_rng_seed);
schedule_work(&work);
return NOTIFY_DONE;
}
static struct notifier_block refresh_nv_rng_seed_nb = { .notifier_call = refresh_nv_rng_seed_notification };
/* /*
* We register the efi subsystem with the firmware subsystem and the * We register the efi subsystem with the firmware subsystem and the
* efivars subsystem with the efi subsystem, if the system was booted with * efivars subsystem with the efi subsystem, if the system was booted with
@ -413,6 +431,7 @@ static int __init efisubsys_init(void)
platform_device_register_simple("efi_secret", 0, NULL, 0); platform_device_register_simple("efi_secret", 0, NULL, 0);
#endif #endif
execute_with_initialized_rng(&refresh_nv_rng_seed_nb);
return 0; return 0;
err_remove_group: err_remove_group: