Commit e7b813b3 authored by Jason A. Donenfeld's avatar Jason A. Donenfeld
Browse files

efi: random: refresh non-volatile random seed when RNG is initialized 



EFI has a rather unique benefit that it has access to some limited
non-volatile storage, where the kernel can store a random seed. Register
a notification for when the RNG is initialized, and at that point, store
a new random seed.

Reviewed-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
parent 898f1e5c

drivers/firmware/efi/efi.c

+19 −0
Original line number Diff line number Diff line
@@ -337,6 +337,24 @@ static void __init efi_debugfs_init(void) 
static inline void efi_debugfs_init(void) {}

#endif



static void refresh_nv_rng_seed(struct work_struct *work)

{

	u8 seed[EFI_RANDOM_SEED_SIZE];



	get_random_bytes(seed, sizeof(seed));

	efi.set_variable(L"RandomSeed", &LINUX_EFI_RANDOM_SEED_TABLE_GUID,

			 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS |

			 EFI_VARIABLE_RUNTIME_ACCESS, sizeof(seed), seed);

	memzero_explicit(seed, sizeof(seed));

}

static int refresh_nv_rng_seed_notification(struct notifier_block *nb, unsigned long action, void *data)

{

	static DECLARE_WORK(work, refresh_nv_rng_seed);

	schedule_work(&work);

	return NOTIFY_DONE;

}

static struct notifier_block refresh_nv_rng_seed_nb = { .notifier_call = refresh_nv_rng_seed_notification };



/*

 * We register the efi subsystem with the firmware subsystem and the

 * efivars subsystem with the efi subsystem, if the system was booted with
@@ -413,6 +431,7 @@ static int __init efisubsys_init(void) 
		platform_device_register_simple("efi_secret", 0, NULL, 0);

#endif



	execute_with_initialized_rng(&refresh_nv_rng_seed_nb);

	return 0;



err_remove_group: