linux-kernel - Re: [PATCH 0/2] x86, efi/random: invoke EFI_RNG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKv+Gu-SMOXK_K-Nh3=8UtB5zbmGnaSQcQSGdC+bnWzyZ4aW8g@mail.gmail.com>
Date:   Wed, 6 Nov 2019 15:38:34 +0100
From:   Ard Biesheuvel <ard.biesheuvel@...aro.org>
To:     Dominik Brodowski <linux@...inikbrodowski.net>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Matt Fleming <matt@...eblueprint.co.uk>,
        Catalin Marinas <catalin.marinas@....com>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Kees Cook <keescook@...omium.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Hsin-Yi Wang <hsinyi@...omium.org>,
        Stephen Boyd <swboyd@...omium.org>,
        Rob Herring <robh@...nel.org>, "Theodore Ts'o" <tytso@....edu>,
        Thomas Gleixner <tglx@...utronix.de>,
        Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        linux-efi <linux-efi@...r.kernel.org>,
        Mario Limonciello <Mario.Limonciello@...l.com>
Subject: Re: [PATCH 0/2] x86, efi/random: invoke EFI_RNG_PROTOCOL in the x86
 EFI stub

On Wed, 6 Nov 2019 at 08:09, Dominik Brodowski
<linux@...inikbrodowski.net> wrote:
>
> EFI v2.4 and later may provide for a EFI_RNG_PROTOCOL, which can be called
> from the EFI stubs to seed the kernel entropy pool. So far, this feature has
> only been implemented on arm/arm64. This series makes the relevant EFI
> libstub code arch-independent and enables the feature also on x86.
>
> Please note that this feature only works if Linux is booted as an EFI stub,
> and that the EFI-provided randomness is not credited as entropy unless
> RANDOM_TRUST_BOOTLOADER is set.
>
> Thanks to Ard Biesheuvel for his hints on how to test the EFI_RNG_PROTOCOL
> from the UEFI shell ( RngTest-X64.efi ), and especially to Mario Limonciello:
> he gave me highly useful hints on the implementation of the EFI_RNG_PROTOCOL
> which ultimately helped me to determine why the earlier RFC patch did not
> work out as expected.
>
> The patches are also available in the Git repository at:
>
>   https://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux.git/ random
>
> Dominik Brodowski (2):
>   efi/random: use arch-independent efi_call_proto()
>   x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table
>

Thanks Dominik. I'll get these queued up.

For others reading this, it is worth mentioning that there is an open
source UEFI driver for the ChaosKey, which produces the EFI RNG
protocol and can be loaded into UEFI persistently using 'efibootmgr
-r'.

>  arch/x86/boot/compressed/eboot.c       |  3 +++
>  drivers/firmware/efi/libstub/Makefile  |  5 +++--
>  drivers/firmware/efi/libstub/efistub.h |  2 --
>  drivers/firmware/efi/libstub/random.c  | 21 ++++++++++++++++-----
>  include/linux/efi.h                    |  2 ++
>  5 files changed, 24 insertions(+), 9 deletions(-)
>
> --
> 2.24.0
>