[PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

From: Ard Biesheuvel <ardb@kernel.org>

commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.

Instead of blindly creating the EFI random seed configuration table if
the RNG protocol is implemented and works, check whether such a EFI
configuration table was provided by an earlier boot stage and if so,
concatenate the existing and the new seeds, leaving it up to the core
code to mix it in and credit it the way it sees fit.

This can be used for, e.g., systemd-boot, to pass an additional seed to
Linux in a way that can be consumed by the kernel very early. In that
case, the following definitions should be used to pass the seed to the
EFI stub:

struct linux_efi_random_seed {
      u32     size; // of the 'seed' array in bytes
      u8      seed[];
};

The memory for the struct must be allocated as EFI_ACPI_RECLAIM_MEMORY
pool memory, and the address of the struct in memory should be installed
as a EFI configuration table using the following GUID:

LINUX_EFI_RANDOM_SEED_TABLE_GUID        1ce1e5bc-7ceb-42f2-81e5-8aadf180f57b

Note that doing so is safe even on kernels that were built without this
patch applied, but the seed will simply be overwritten with a seed
derived from the EFI RNG protocol, if available. The recommended seed
size is 32 bytes, and seeds larger than 512 bytes are considered
corrupted and ignored entirely.

In order to preserve forward secrecy, seeds from previous bootloaders
are memzero'd out, and in order to preserve memory, those older seeds
are also freed from memory. Freeing from memory without first memzeroing
is not safe to do, as it's possible that nothing else will ever
overwrite those pages used by EFI.

Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
[ardb: incorporate Jason's followup changes to extend the maximum seed
       size on the consumer end, memzero() it and drop a needless printk]
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 drivers/firmware/efi/efi.c             |  4 +--
 drivers/firmware/efi/libstub/efistub.h |  2 ++
 drivers/firmware/efi/libstub/random.c  | 42 ++++++++++++++++++++++----
 include/linux/efi.h                    |  2 --
 4 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index a06decee51e0..a6e9968a2ddc 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -608,7 +608,7 @@ int __init efi_config_parse_tables(const efi_config_table_t *config_tables,
 
 		seed = early_memremap(efi_rng_seed, sizeof(*seed));
 		if (seed != NULL) {
-			size = min(seed->size, EFI_RANDOM_SEED_SIZE);
+			size = min_t(u32, seed->size, SZ_1K); // sanity check
 			early_memunmap(seed, sizeof(*seed));
 		} else {
 			pr_err("Could not map UEFI random seed!\n");
@@ -617,8 +617,8 @@ int __init efi_config_parse_tables(const efi_config_table_t *config_tables,
 			seed = early_memremap(efi_rng_seed,
 					      sizeof(*seed) + size);
 			if (seed != NULL) {
-				pr_notice("seeding entropy pool\n");
 				add_bootloader_randomness(seed->bits, size);
+				memzero_explicit(seed->bits, size);
 				early_memunmap(seed, sizeof(*seed) + size);
 			} else {
 				pr_err("Could not map UEFI random seed!\n");
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index b0ae0a454404..0ce2bf4b8b58 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -873,6 +873,8 @@ efi_status_t efi_get_random_bytes(unsigned long size, u8 *out);
 efi_status_t efi_random_alloc(unsigned long size, unsigned long align,
 			      unsigned long *addr, unsigned long random_seed);
 
+efi_status_t efi_random_get_seed(void);
+
 efi_status_t check_platform_features(void);
 
 void *get_efi_config_table(efi_guid_t guid);
diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index 33ab56769595..f85d2c066877 100644
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -67,27 +67,43 @@ efi_status_t efi_random_get_seed(void)
 	efi_guid_t rng_proto = EFI_RNG_PROTOCOL_GUID;
 	efi_guid_t rng_algo_raw = EFI_RNG_ALGORITHM_RAW;
 	efi_guid_t rng_table_guid = LINUX_EFI_RANDOM_SEED_TABLE_GUID;
+	struct linux_efi_random_seed *prev_seed, *seed = NULL;
+	int prev_seed_size = 0, seed_size = EFI_RANDOM_SEED_SIZE;
 	efi_rng_protocol_t *rng = NULL;
-	struct linux_efi_random_seed *seed = NULL;
 	efi_status_t status;
 
 	status = efi_bs_call(locate_protocol, &rng_proto, NULL, (void **)&rng);
 	if (status != EFI_SUCCESS)
 		return status;
 
+	/*
+	 * Check whether a seed was provided by a prior boot stage. In that
+	 * case, instead of overwriting it, let's create a new buffer that can
+	 * hold both, and concatenate the existing and the new seeds.
+	 * Note that we should read the seed size with caution, in case the
+	 * table got corrupted in memory somehow.
+	 */
+	prev_seed = get_efi_config_table(LINUX_EFI_RANDOM_SEED_TABLE_GUID);
+	if (prev_seed && prev_seed->size <= 512U) {
+		prev_seed_size = prev_seed->size;
+		seed_size += prev_seed_size;
+	}
+
 	/*
 	 * Use EFI_ACPI_RECLAIM_MEMORY here so that it is guaranteed that the
 	 * allocation will survive a kexec reboot (although we refresh the seed
 	 * beforehand)
 	 */
 	status = efi_bs_call(allocate_pool, EFI_ACPI_RECLAIM_MEMORY,
-			     sizeof(*seed) + EFI_RANDOM_SEED_SIZE,
+			     struct_size(seed, bits, seed_size),
 			     (void **)&seed);
-	if (status != EFI_SUCCESS)
-		return status;
+	if (status != EFI_SUCCESS) {
+		efi_warn("Failed to allocate memory for RNG seed.\n");
+		goto err_warn;
+	}
 
 	status = efi_call_proto(rng, get_rng, &rng_algo_raw,
-				 EFI_RANDOM_SEED_SIZE, seed->bits);
+				EFI_RANDOM_SEED_SIZE, seed->bits);
 
 	if (status == EFI_UNSUPPORTED)
 		/*
@@ -100,14 +116,28 @@ efi_status_t efi_random_get_seed(void)
 	if (status != EFI_SUCCESS)
 		goto err_freepool;
 
-	seed->size = EFI_RANDOM_SEED_SIZE;
+	seed->size = seed_size;
+	if (prev_seed_size)
+		memcpy(seed->bits + EFI_RANDOM_SEED_SIZE, prev_seed->bits,
+		       prev_seed_size);
+
 	status = efi_bs_call(install_configuration_table, &rng_table_guid, seed);
 	if (status != EFI_SUCCESS)
 		goto err_freepool;
 
+	if (prev_seed_size) {
+		/* wipe and free the old seed if we managed to install the new one */
+		memzero_explicit(prev_seed->bits, prev_seed_size);
+		efi_bs_call(free_pool, prev_seed);
+	}
 	return EFI_SUCCESS;
 
 err_freepool:
+	memzero_explicit(seed, struct_size(seed, bits, seed_size));
 	efi_bs_call(free_pool, seed);
+	efi_warn("Failed to obtain seed from EFI_RNG_PROTOCOL\n");
+err_warn:
+	if (prev_seed)
+		efi_warn("Retaining bootloader-supplied seed only");
 	return status;
 }
diff --git a/include/linux/efi.h b/include/linux/efi.h
index f87b2f5db9f8..4f51616f01b2 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1139,8 +1139,6 @@ void efi_check_for_embedded_firmwares(void);
 static inline void efi_check_for_embedded_firmwares(void) { }
 #endif
 
-efi_status_t efi_random_get_seed(void);
-
 #define arch_efi_call_virt(p, f, args...)	((p)->f(args))
 
 /*
-- 
2.39.0

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Greg KH]

On Tue, Jan 10, 2023 at 05:04:16PM +0100, Jason A. Donenfeld wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
> 
> commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.
> 
> Instead of blindly creating the EFI random seed configuration table if
> the RNG protocol is implemented and works, check whether such a EFI
> configuration table was provided by an earlier boot stage and if so,
> concatenate the existing and the new seeds, leaving it up to the core
> code to mix it in and credit it the way it sees fit.
> 
> This can be used for, e.g., systemd-boot, to pass an additional seed to
> Linux in a way that can be consumed by the kernel very early. In that
> case, the following definitions should be used to pass the seed to the
> EFI stub:
> 
> struct linux_efi_random_seed {
>       u32     size; // of the 'seed' array in bytes
>       u8      seed[];
> };
> 
> The memory for the struct must be allocated as EFI_ACPI_RECLAIM_MEMORY
> pool memory, and the address of the struct in memory should be installed
> as a EFI configuration table using the following GUID:
> 
> LINUX_EFI_RANDOM_SEED_TABLE_GUID        1ce1e5bc-7ceb-42f2-81e5-8aadf180f57b
> 
> Note that doing so is safe even on kernels that were built without this
> patch applied, but the seed will simply be overwritten with a seed
> derived from the EFI RNG protocol, if available. The recommended seed
> size is 32 bytes, and seeds larger than 512 bytes are considered
> corrupted and ignored entirely.
> 
> In order to preserve forward secrecy, seeds from previous bootloaders
> are memzero'd out, and in order to preserve memory, those older seeds
> are also freed from memory. Freeing from memory without first memzeroing
> is not safe to do, as it's possible that nothing else will ever
> overwrite those pages used by EFI.
> 
> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
> [ardb: incorporate Jason's followup changes to extend the maximum seed
>        size on the consumer end, memzero() it and drop a needless printk]
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
>  drivers/firmware/efi/efi.c             |  4 +--
>  drivers/firmware/efi/libstub/efistub.h |  2 ++
>  drivers/firmware/efi/libstub/random.c  | 42 ++++++++++++++++++++++----
>  include/linux/efi.h                    |  2 --
>  4 files changed, 40 insertions(+), 10 deletions(-)

Now queued up, thanks.

greg k-h

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

Thanks! IIRC, this applies to all current stable kernels (now that
you've sunsetted 4.9).

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Greg KH]

On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> Thanks! IIRC, this applies to all current stable kernels (now that
> you've sunsetted 4.9).

It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
provide working backports for them?

thanks,

greg k-h

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > Thanks! IIRC, this applies to all current stable kernels (now that
> > you've sunsetted 4.9).
>
> It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> provide working backports for them?

Oh, darn. I thought it would for some reason. Okay, lemme get cranking on that.

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Ard Biesheuvel]

On Tue, 10 Jan 2023 at 18:10, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > you've sunsetted 4.9).
> >
> > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > provide working backports for them?
>
> Oh, darn. I thought it would for some reason. Okay, lemme get cranking on that.

Should we bother? Isn't v5.10 far enough back for this? This is not a
bugfix after all.

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

On Tue, Jan 10, 2023 at 6:20 PM Ard Biesheuvel <ardb@kernel.org> wrote:
>
> On Tue, 10 Jan 2023 at 18:10, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> >
> > On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > > you've sunsetted 4.9).
> > >
> > > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > > provide working backports for them?
> >
> > Oh, darn. I thought it would for some reason. Okay, lemme get cranking on that.
>
> Should we bother? Isn't v5.10 far enough back for this? This is not a
> bugfix after all.

This *is* a bug fix. And not just because we used to clobber that
configuration table unnecessarily, but moreover because of the forward
secrecy issues due to the missing memzero. We did all that in a single
patch under the assumption that this would be backported as a unit.

Anyway, don't sweat it - I'm working on the backport now. Seems
straightforward enough.

Jason

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Ard Biesheuvel]

On Tue, 10 Jan 2023 at 18:32, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> On Tue, Jan 10, 2023 at 6:20 PM Ard Biesheuvel <ardb@kernel.org> wrote:
> >
> > On Tue, 10 Jan 2023 at 18:10, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> > >
> > > On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > > > you've sunsetted 4.9).
> > > >
> > > > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > > > provide working backports for them?
> > >
> > > Oh, darn. I thought it would for some reason. Okay, lemme get cranking on that.
> >
> > Should we bother? Isn't v5.10 far enough back for this? This is not a
> > bugfix after all.
>
> This *is* a bug fix. And not just because we used to clobber that
> configuration table unnecessarily, but moreover because of the forward
> secrecy issues due to the missing memzero. We did all that in a single
> patch under the assumption that this would be backported as a unit.
>
> Anyway, don't sweat it - I'm working on the backport now. Seems
> straightforward enough.
>

Fair enough.

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > Thanks! IIRC, this applies to all current stable kernels (now that
> > you've sunsetted 4.9).
>
> It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> provide working backports for them?

I did 5.4.y, which turned out to be hairy than I wanted. You and Ard
can decide if you want it or not. I'll leave 4.19 and 4.14 for another
day.

[PATCH stable 5.4.y] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

From: Ard Biesheuvel <ardb@kernel.org>

commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.

Instead of blindly creating the EFI random seed configuration table if
the RNG protocol is implemented and works, check whether such a EFI
configuration table was provided by an earlier boot stage and if so,
concatenate the existing and the new seeds, leaving it up to the core
code to mix it in and credit it the way it sees fit.

This can be used for, e.g., systemd-boot, to pass an additional seed to
Linux in a way that can be consumed by the kernel very early. In that
case, the following definitions should be used to pass the seed to the
EFI stub:

struct linux_efi_random_seed {
      u32     size; // of the 'seed' array in bytes
      u8      seed[];
};

The memory for the struct must be allocated as EFI_ACPI_RECLAIM_MEMORY
pool memory, and the address of the struct in memory should be installed
as a EFI configuration table using the following GUID:

LINUX_EFI_RANDOM_SEED_TABLE_GUID        1ce1e5bc-7ceb-42f2-81e5-8aadf180f57b

Note that doing so is safe even on kernels that were built without this
patch applied, but the seed will simply be overwritten with a seed
derived from the EFI RNG protocol, if available. The recommended seed
size is 32 bytes, and seeds larger than 512 bytes are considered
corrupted and ignored entirely.

In order to preserve forward secrecy, seeds from previous bootloaders
are memzero'd out, and in order to preserve memory, those older seeds
are also freed from memory. Freeing from memory without first memzeroing
is not safe to do, as it's possible that nothing else will ever
overwrite those pages used by EFI.

Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
[ardb: incorporate Jason's followup changes to extend the maximum seed
       size on the consumer end, memzero() it and drop a needless printk]
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 arch/x86/boot/compressed/eboot.c       |  3 +
 drivers/firmware/efi/efi.c             |  4 +-
 drivers/firmware/efi/libstub/Makefile  |  5 +-
 drivers/firmware/efi/libstub/efistub.h |  3 +-
 drivers/firmware/efi/libstub/random.c  | 86 +++++++++++++++++++++-----
 include/linux/efi.h                    |  2 +
 6 files changed, 83 insertions(+), 20 deletions(-)

diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index 82bc60c8acb2..68945c5700bf 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -782,6 +782,9 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
 
 	/* Ask the firmware to clear memory on unclean shutdown */
 	efi_enable_reset_attack_mitigation(sys_table);
+
+	efi_random_get_seed(sys_table);
+
 	efi_retrieve_tpm2_eventlog(sys_table);
 
 	setup_graphics(boot_params);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index ac9fb336c80f..f4be4ac7d3aa 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -546,7 +546,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
 
 		seed = early_memremap(efi.rng_seed, sizeof(*seed));
 		if (seed != NULL) {
-			size = min(seed->size, EFI_RANDOM_SEED_SIZE);
+			size = min_t(u32, seed->size, SZ_1K); // sanity check
 			early_memunmap(seed, sizeof(*seed));
 		} else {
 			pr_err("Could not map UEFI random seed!\n");
@@ -555,8 +555,8 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
 			seed = early_memremap(efi.rng_seed,
 					      sizeof(*seed) + size);
 			if (seed != NULL) {
-				pr_notice("seeding entropy pool\n");
 				add_bootloader_randomness(seed->bits, size);
+				memzero_explicit(seed->bits, size);
 				early_memunmap(seed, sizeof(*seed) + size);
 			} else {
 				pr_err("Could not map UEFI random seed!\n");
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 8c5b5529dbc0..d943d59ff54c 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -39,7 +39,8 @@ OBJECT_FILES_NON_STANDARD	:= y
 # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
 KCOV_INSTRUMENT			:= n
 
-lib-y				:= efi-stub-helper.o gop.o secureboot.o tpm.o
+lib-y				:= efi-stub-helper.o gop.o secureboot.o tpm.o \
+				   random.o
 
 # include the stub's generic dependencies from lib/ when building for ARM/arm64
 arm-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c
@@ -48,7 +49,7 @@ arm-deps-$(CONFIG_ARM64) += sort.c
 $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
 	$(call if_changed_rule,cc_o_c)
 
-lib-$(CONFIG_EFI_ARMSTUB)	+= arm-stub.o fdt.o string.o random.o \
+lib-$(CONFIG_EFI_ARMSTUB)	+= arm-stub.o fdt.o string.o \
 				   $(patsubst %.c,lib-%.o,$(arm-deps-y))
 
 lib-$(CONFIG_ARM)		+= arm32-stub.o
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index 7f1556fd867d..4ebf02b99c1b 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -34,6 +34,7 @@ extern int __pure novamap(void);
 } while (0)
 
 #define pr_efi_err(sys_table, msg) efi_printk(sys_table, "EFI stub: ERROR: "msg)
+#define pr_efi_warn(sys_table, msg) efi_printk(sys_table, "EFI stub: WARNING: "msg)
 
 void efi_char16_printk(efi_system_table_t *, efi_char16_t *);
 
@@ -63,8 +64,6 @@ efi_status_t efi_random_alloc(efi_system_table_t *sys_table_arg,
 
 efi_status_t check_platform_features(efi_system_table_t *sys_table_arg);
 
-efi_status_t efi_random_get_seed(efi_system_table_t *sys_table_arg);
-
 void *get_efi_config_table(efi_system_table_t *sys_table, efi_guid_t guid);
 
 /* Helper macros for the usual case of using simple C variables: */
diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index b4b1d1dcb5fd..c8b1e0088895 100644
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -9,12 +9,22 @@
 
 #include "efistub.h"
 
-struct efi_rng_protocol {
+typedef struct efi_rng_protocol {
 	efi_status_t (*get_info)(struct efi_rng_protocol *,
 				 unsigned long *, efi_guid_t *);
 	efi_status_t (*get_rng)(struct efi_rng_protocol *,
 				efi_guid_t *, unsigned long, u8 *out);
-};
+} efi_rng_protocol_t;
+
+typedef struct {
+	u32 get_info;
+	u32 get_rng;
+} efi_rng_protocol_32_t;
+
+typedef struct {
+	u64 get_info;
+	u64 get_rng;
+} efi_rng_protocol_64_t;
 
 efi_status_t efi_get_random_bytes(efi_system_table_t *sys_table_arg,
 				  unsigned long size, u8 *out)
@@ -28,7 +38,7 @@ efi_status_t efi_get_random_bytes(efi_system_table_t *sys_table_arg,
 	if (status != EFI_SUCCESS)
 		return status;
 
-	return rng->get_rng(rng, NULL, size, out);
+	return efi_call_proto(efi_rng_protocol, get_rng, rng, NULL, size, out);
 }
 
 /*
@@ -141,13 +151,27 @@ efi_status_t efi_random_alloc(efi_system_table_t *sys_table_arg,
 	return status;
 }
 
+/**
+ * efi_random_get_seed() - provide random seed as configuration table
+ *
+ * The EFI_RNG_PROTOCOL is used to read random bytes. These random bytes are
+ * saved as a configuration table which can be used as entropy by the kernel
+ * for the initialization of its pseudo random number generator.
+ *
+ * If the EFI_RNG_PROTOCOL is not available or there are not enough random bytes
+ * available, the configuration table will not be installed and an error code
+ * will be returned.
+ *
+ * Return:	status code
+ */
 efi_status_t efi_random_get_seed(efi_system_table_t *sys_table_arg)
 {
 	efi_guid_t rng_proto = EFI_RNG_PROTOCOL_GUID;
 	efi_guid_t rng_algo_raw = EFI_RNG_ALGORITHM_RAW;
 	efi_guid_t rng_table_guid = LINUX_EFI_RANDOM_SEED_TABLE_GUID;
-	struct efi_rng_protocol *rng;
-	struct linux_efi_random_seed *seed;
+	struct linux_efi_random_seed *prev_seed, *seed = NULL;
+	int prev_seed_size = 0, seed_size = EFI_RANDOM_SEED_SIZE;
+	struct efi_rng_protocol *rng = NULL;
 	efi_status_t status;
 
 	status = efi_call_early(locate_protocol, &rng_proto, NULL,
@@ -155,34 +179,68 @@ efi_status_t efi_random_get_seed(efi_system_table_t *sys_table_arg)
 	if (status != EFI_SUCCESS)
 		return status;
 
-	status = efi_call_early(allocate_pool, EFI_RUNTIME_SERVICES_DATA,
-				sizeof(*seed) + EFI_RANDOM_SEED_SIZE,
+	/*
+	 * Check whether a seed was provided by a prior boot stage. In that
+	 * case, instead of overwriting it, let's create a new buffer that can
+	 * hold both, and concatenate the existing and the new seeds.
+	 * Note that we should read the seed size with caution, in case the
+	 * table got corrupted in memory somehow.
+	 */
+	prev_seed = get_efi_config_table(sys_table_arg, LINUX_EFI_RANDOM_SEED_TABLE_GUID);
+	if (prev_seed && prev_seed->size <= 512U) {
+		prev_seed_size = prev_seed->size;
+		seed_size += prev_seed_size;
+	}
+
+	/*
+	 * Use EFI_ACPI_RECLAIM_MEMORY here so that it is guaranteed that the
+	 * allocation will survive a kexec reboot (although we refresh the seed
+	 * beforehand)
+	 */
+	status = efi_call_early(allocate_pool, EFI_ACPI_RECLAIM_MEMORY,
+				struct_size(seed, bits, seed_size),
 				(void **)&seed);
-	if (status != EFI_SUCCESS)
-		return status;
+	if (status != EFI_SUCCESS) {
+		pr_efi_warn(sys_table_arg, "Failed to allocate memory for RNG seed.\n");
+		goto err_warn;
+	}
 
-	status = rng->get_rng(rng, &rng_algo_raw, EFI_RANDOM_SEED_SIZE,
-			      seed->bits);
+	status = efi_call_proto(efi_rng_protocol, get_rng, rng, &rng_algo_raw,
+				EFI_RANDOM_SEED_SIZE, seed->bits);
 	if (status == EFI_UNSUPPORTED)
 		/*
 		 * Use whatever algorithm we have available if the raw algorithm
 		 * is not implemented.
 		 */
-		status = rng->get_rng(rng, NULL, EFI_RANDOM_SEED_SIZE,
-				      seed->bits);
+		status = efi_call_proto(efi_rng_protocol, get_rng, rng, NULL,
+					EFI_RANDOM_SEED_SIZE, seed->bits);
 
 	if (status != EFI_SUCCESS)
 		goto err_freepool;
 
-	seed->size = EFI_RANDOM_SEED_SIZE;
+	seed->size = seed_size;
+	if (prev_seed_size)
+		memcpy(seed->bits + EFI_RANDOM_SEED_SIZE, prev_seed->bits,
+		       prev_seed_size);
+
 	status = efi_call_early(install_configuration_table, &rng_table_guid,
 				seed);
 	if (status != EFI_SUCCESS)
 		goto err_freepool;
 
+	if (prev_seed_size) {
+		/* wipe and free the old seed if we managed to install the new one */
+		memzero_explicit(prev_seed->bits, prev_seed_size);
+		efi_call_early(free_pool, prev_seed);
+	}
 	return EFI_SUCCESS;
 
 err_freepool:
+	memzero_explicit(seed, struct_size(seed, bits, seed_size));
 	efi_call_early(free_pool, seed);
+	pr_efi_warn(sys_table_arg, "Failed to obtain seed from EFI_RNG_PROTOCOL\n");
+err_warn:
+	if (prev_seed)
+		pr_efi_warn(sys_table_arg, "Retaining bootloader-supplied seed only");
 	return status;
 }
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 880cd86c829d..d68c96dee81d 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1653,6 +1653,8 @@ static inline void
 efi_enable_reset_attack_mitigation(efi_system_table_t *sys_table_arg) { }
 #endif
 
+efi_status_t efi_random_get_seed(efi_system_table_t *sys_table_arg);
+
 void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table);
 
 /*
-- 
2.39.0

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Ard Biesheuvel]

On Tue, 10 Jan 2023 at 20:45, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > you've sunsetted 4.9).
> >
> > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > provide working backports for them?
>
> I did 5.4.y, which turned out to be hairy than I wanted. You and Ard
> can decide if you want it or not. I'll leave 4.19 and 4.14 for another
> day.

I appreciate you spending the effort, but I'm not convinced this is
worth the risk. You are backporting new functionality (invoking the
firmware's RNG protocol at boot on x86), and we might end up
regressing on systems where the firmware's implementation is
problematic, even if the patch by itself is correct. This applies to
mixed mode especially, as the conversion between Win64 and i386
calling conventions has kicked up some very surprising issues in the
past.

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Greg KH]

On Wed, Jan 11, 2023 at 09:44:34AM +0100, Ard Biesheuvel wrote:
> On Tue, 10 Jan 2023 at 20:45, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> >
> > On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > > you've sunsetted 4.9).
> > >
> > > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > > provide working backports for them?
> >
> > I did 5.4.y, which turned out to be hairy than I wanted. You and Ard
> > can decide if you want it or not. I'll leave 4.19 and 4.14 for another
> > day.
> 
> I appreciate you spending the effort, but I'm not convinced this is
> worth the risk. You are backporting new functionality (invoking the
> firmware's RNG protocol at boot on x86), and we might end up
> regressing on systems where the firmware's implementation is
> problematic, even if the patch by itself is correct. This applies to
> mixed mode especially, as the conversion between Win64 and i386
> calling conventions has kicked up some very surprising issues in the
> past.

Yeah, I'll leave this alone on those old kernel trees.  They are
primarily only used in Android (i.e. arm64) systems and shouldn't be
messing with efi.  Those x86 systems still stuck using these old kernels
are fragile enough, and should have moved to newer kernels anyway...

thanks,

greg k-h

Re: [PATCH stable] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Jason A. Donenfeld]

On Wed, Jan 11, 2023 at 09:44:34AM +0100, Ard Biesheuvel wrote:
> On Tue, 10 Jan 2023 at 20:45, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> >
> > On Tue, Jan 10, 2023 at 6:09 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Jan 10, 2023 at 05:57:21PM +0100, Jason A. Donenfeld wrote:
> > > > Thanks! IIRC, this applies to all current stable kernels (now that
> > > > you've sunsetted 4.9).
> > >
> > > It does not apply cleanly to 5.4.y or 4.19.y or 4.14.y so can you
> > > provide working backports for them?
> >
> > I did 5.4.y, which turned out to be hairy than I wanted. You and Ard
> > can decide if you want it or not. I'll leave 4.19 and 4.14 for another
> > day.
> 
> I appreciate you spending the effort, but I'm not convinced this is
> worth the risk. You are backporting new functionality (invoking the
> firmware's RNG protocol at boot on x86), and we might end up
> regressing on systems where the firmware's implementation is
> problematic, even if the patch by itself is correct. This applies to
> mixed mode especially, as the conversion between Win64 and i386
> calling conventions has kicked up some very surprising issues in the
> past.

Alright, yea, I was afraid that might be the case indeed. Oh well.

So this means that for the purposes of systemd's usage of this, 5.10+ is
the relevant cut-off. I'm noting it here because I'm sure I'll forget,
and the question is bound to come up down the road.

Jason

Re: [PATCH stable 5.4.y] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Greg KH]

On Tue, Jan 10, 2023 at 08:45:40PM +0100, Jason A. Donenfeld wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
> 
> commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.
> 

Now queued up, thanks.

greg k-h

Re: [PATCH stable 5.4.y] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Ard Biesheuvel]

On Thu, 12 Jan 2023 at 13:29, Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Jan 10, 2023 at 08:45:40PM +0100, Jason A. Donenfeld wrote:
> > From: Ard Biesheuvel <ardb@kernel.org>
> >
> > commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.
> >
>
> Now queued up, thanks.
>

Queued up where? Not v5.4 I hope?

Re: [PATCH stable 5.4.y] efi: random: combine bootloader provided RNG seed with RNG protocol output

[Greg KH]

On Thu, Jan 12, 2023 at 01:31:19PM +0100, Ard Biesheuvel wrote:
> On Thu, 12 Jan 2023 at 13:29, Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Jan 10, 2023 at 08:45:40PM +0100, Jason A. Donenfeld wrote:
> > > From: Ard Biesheuvel <ardb@kernel.org>
> > >
> > > commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.
> > >
> >
> > Now queued up, thanks.
> >
> 
> Queued up where? Not v5.4 I hope?

Ick, yes, I did that, I'll go drop this now, sorry for the noise.

greg "burried in patches" k-h