Getting a random seed into the kernel very early is important for data
structures that rely on the random number generator at initialization
time, but hardware based RNGs may not become available until much later
in the boot.
For this reason, the EFI stub will currently invoke the EFI RNG protocol
to get a random seed from the hardware before tearing down the EFI boot
services and performing the low level boot of the kernel proper. The
generated seed is passed via a EFI configuration table, which is
available very early, and so the random number generator comes up much
earlier as well.
Any boot stage preceding the EFI stub can install configuration tables,
so we can decide to expose the same mechanism to other loaders. This
allows, e.g., systemd-boot to pass the seed it keeps in a file on the
ESP without having to rely on PID #1 dd'ing it into /dev/random, which
is much too late to be useful.
As suggested by Jason, let's use blake2s to combine seeds obtained via
the config table and via the protocol if both are available, and throw
in a personalization string for good measure.
Older kernels will simply supersede the bootloader provided seed, unless
the RNG protocol is not available, in which case the bootloader seed
will be forwarded untouched if one is present. This should not be an
issue, but let's reduce the seed size to blake2's output size, and
switch to the correct memory type in separate changes so they can be
backported.
Cc: Ilias Apalodimas <ilias.apalodimas@xxxxxxxxxx>
Cc: Jason A. Donenfeld <Jason@xxxxxxxxx>
Cc: Lennart Poettering <lennart@xxxxxxxxxxxxxx>
Cc: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Ard Biesheuvel (3):
efi: random: reduce seed size to 32 bytes
efi: random: Use 'ACPI reclaim' memory for random seed
efi: random: combine bootloader provided RNG seed with RNG protocol
output
drivers/firmware/efi/efi.c | 2 +-
drivers/firmware/efi/libstub/Makefile | 4 +
drivers/firmware/efi/libstub/efistub.h | 2 +
drivers/firmware/efi/libstub/random.c | 83 ++++++++++++--------
include/linux/efi.h | 4 +-
lib/crypto/blake2s-generic.c | 2 +
lib/crypto/blake2s.c | 7 +-
7 files changed, 64 insertions(+), 40 deletions(-)
--
2.35.1
