efi: random: combine bootloader provided RNG seed with RNG protocol output

commit 196dff2712ca5a2e651977bb2fe6b05474111a83 upstream.

Instead of blindly creating the EFI random seed configuration table if
the RNG protocol is implemented and works, check whether such a EFI
configuration table was provided by an earlier boot stage and if so,
concatenate the existing and the new seeds, leaving it up to the core
code to mix it in and credit it the way it sees fit.

This can be used for, e.g., systemd-boot, to pass an additional seed to
Linux in a way that can be consumed by the kernel very early. In that
case, the following definitions should be used to pass the seed to the
EFI stub:

struct linux_efi_random_seed {
      u32     size; // of the 'seed' array in bytes
      u8      seed[];
};

The memory for the struct must be allocated as EFI_ACPI_RECLAIM_MEMORY
pool memory, and the address of the struct in memory should be installed
as a EFI configuration table using the following GUID:

LINUX_EFI_RANDOM_SEED_TABLE_GUID        1ce1e5bc-7ceb-42f2-81e5-8aadf180f57b

Note that doing so is safe even on kernels that were built without this
patch applied, but the seed will simply be overwritten with a seed
derived from the EFI RNG protocol, if available. The recommended seed
size is 32 bytes, and seeds larger than 512 bytes are considered
corrupted and ignored entirely.

In order to preserve forward secrecy, seeds from previous bootloaders
are memzero'd out, and in order to preserve memory, those older seeds
are also freed from memory. Freeing from memory without first memzeroing
is not safe to do, as it's possible that nothing else will ever
overwrite those pages used by EFI.

Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
[ardb: incorporate Jason's followup changes to extend the maximum seed
       size on the consumer end, memzero() it and drop a needless printk]
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 70be9c87fb673234899457bb7eda9fa09213e657..ba03f5a4b30ce3ef28d5cd188c4090fc6d08e3b0 100644 (file)
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -590,7 +590,7 @@ int __init efi_config_parse_tables(const efi_config_table_t *config_tables,
 
                seed = early_memremap(efi_rng_seed, sizeof(*seed));
                if (seed != NULL) {
-                       size = min(seed->size, EFI_RANDOM_SEED_SIZE);
+                       size = min_t(u32, seed->size, SZ_1K); // sanity check
                        early_memunmap(seed, sizeof(*seed));
                } else {
                        pr_err("Could not map UEFI random seed!\n");
@@ -599,8 +599,8 @@ int __init efi_config_parse_tables(const efi_config_table_t *config_tables,
                        seed = early_memremap(efi_rng_seed,
                                              sizeof(*seed) + size);
                        if (seed != NULL) {
-                               pr_notice("seeding entropy pool\n");
                                add_bootloader_randomness(seed->bits, size);
+                               memzero_explicit(seed->bits, size);
                                early_memunmap(seed, sizeof(*seed) + size);
                        } else {
                                pr_err("Could not map UEFI random seed!\n");

diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index cde0a2ef507d9853e7b9a2c1675e181fc7cd993b..fbffdd7290a31853f8ea6acdcf9715e68ba94624 100644 (file)
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -766,6 +766,8 @@ efi_status_t efi_get_random_bytes(unsigned long size, u8 *out);
 efi_status_t efi_random_alloc(unsigned long size, unsigned long align,
                              unsigned long *addr, unsigned long random_seed);
 
+efi_status_t efi_random_get_seed(void);
+
 efi_status_t check_platform_features(void);
 
 void *get_efi_config_table(efi_guid_t guid);

diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index 33ab567695951d6c3c9df4217d067fb53367a373..f85d2c066877772c256b1f2cd282de1f6c37bf4c 100644 (file)
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -67,27 +67,43 @@ efi_status_t efi_random_get_seed(void)
        efi_guid_t rng_proto = EFI_RNG_PROTOCOL_GUID;
        efi_guid_t rng_algo_raw = EFI_RNG_ALGORITHM_RAW;
        efi_guid_t rng_table_guid = LINUX_EFI_RANDOM_SEED_TABLE_GUID;
+       struct linux_efi_random_seed *prev_seed, *seed = NULL;
+       int prev_seed_size = 0, seed_size = EFI_RANDOM_SEED_SIZE;
        efi_rng_protocol_t *rng = NULL;
-       struct linux_efi_random_seed *seed = NULL;
        efi_status_t status;
 
        status = efi_bs_call(locate_protocol, &rng_proto, NULL, (void **)&rng);
        if (status != EFI_SUCCESS)
                return status;
 
+       /*
+        * Check whether a seed was provided by a prior boot stage. In that
+        * case, instead of overwriting it, let's create a new buffer that can
+        * hold both, and concatenate the existing and the new seeds.
+        * Note that we should read the seed size with caution, in case the
+        * table got corrupted in memory somehow.
+        */
+       prev_seed = get_efi_config_table(LINUX_EFI_RANDOM_SEED_TABLE_GUID);
+       if (prev_seed && prev_seed->size <= 512U) {
+               prev_seed_size = prev_seed->size;
+               seed_size += prev_seed_size;
+       }
+
        /*
         * Use EFI_ACPI_RECLAIM_MEMORY here so that it is guaranteed that the
         * allocation will survive a kexec reboot (although we refresh the seed
         * beforehand)
         */
        status = efi_bs_call(allocate_pool, EFI_ACPI_RECLAIM_MEMORY,
-                            sizeof(*seed) + EFI_RANDOM_SEED_SIZE,
+                            struct_size(seed, bits, seed_size),
                             (void **)&seed);
-       if (status != EFI_SUCCESS)
-               return status;
+       if (status != EFI_SUCCESS) {
+               efi_warn("Failed to allocate memory for RNG seed.\n");
+               goto err_warn;
+       }
 
        status = efi_call_proto(rng, get_rng, &rng_algo_raw,
-                                EFI_RANDOM_SEED_SIZE, seed->bits);
+                               EFI_RANDOM_SEED_SIZE, seed->bits);
 
        if (status == EFI_UNSUPPORTED)
                /*
@@ -100,14 +116,28 @@ efi_status_t efi_random_get_seed(void)
        if (status != EFI_SUCCESS)
                goto err_freepool;
 
-       seed->size = EFI_RANDOM_SEED_SIZE;
+       seed->size = seed_size;
+       if (prev_seed_size)
+               memcpy(seed->bits + EFI_RANDOM_SEED_SIZE, prev_seed->bits,
+                      prev_seed_size);
+
        status = efi_bs_call(install_configuration_table, &rng_table_guid, seed);
        if (status != EFI_SUCCESS)
                goto err_freepool;
 
+       if (prev_seed_size) {
+               /* wipe and free the old seed if we managed to install the new one */
+               memzero_explicit(prev_seed->bits, prev_seed_size);
+               efi_bs_call(free_pool, prev_seed);
+       }
        return EFI_SUCCESS;
 
 err_freepool:
+       memzero_explicit(seed, struct_size(seed, bits, seed_size));
        efi_bs_call(free_pool, seed);
+       efi_warn("Failed to obtain seed from EFI_RNG_PROTOCOL\n");
+err_warn:
+       if (prev_seed)
+               efi_warn("Retaining bootloader-supplied seed only");
        return status;
 }

diff --git a/include/linux/efi.h b/include/linux/efi.h
index 4cd4ed34d3cb8dfc2e5b350fb1b94ac77c5b492b..5598fc348c69af647f61891fadb41595ce795c56 100644 (file)
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1114,8 +1114,6 @@ void efi_check_for_embedded_firmwares(void);
 static inline void efi_check_for_embedded_firmwares(void) { }
 #endif
 
-efi_status_t efi_random_get_seed(void);
-
 /*
  * Arch code can implement the following three template macros, avoiding
  * reptition for the void/non-void return cases of {__,}efi_call_virt():