diff options
Diffstat (limited to 'src/interface/efi/efi_entropy.c')
| -rw-r--r-- | src/interface/efi/efi_entropy.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/interface/efi/efi_entropy.c b/src/interface/efi/efi_entropy.c index a865bad59..f6e82e2c0 100644 --- a/src/interface/efi/efi_entropy.c +++ b/src/interface/efi/efi_entropy.c @@ -222,6 +222,7 @@ static int efi_get_noise_ticks ( noise_sample_t *noise ) { * @ret rc Return status code */ static int efi_get_noise_rng ( noise_sample_t *noise ) { + static uint8_t prev[EFI_ENTROPY_RNG_LEN]; uint8_t buf[EFI_ENTROPY_RNG_LEN]; EFI_STATUS efirc; int rc; @@ -239,6 +240,17 @@ static int efi_get_noise_rng ( noise_sample_t *noise ) { return rc; } + /* Fail (and permanently disable the EFI RNG) if we get + * consecutive identical results. + */ + if ( memcmp ( buf, prev, sizeof ( buf ) ) == 0 ) { + DBGC ( &tick, "ENTROPY detected broken EFI RNG:\n" ); + DBGC_HDA ( &tick, 0, buf, sizeof ( buf ) ); + efirng = NULL; + return -EIO; + } + memcpy ( prev, buf, sizeof ( prev ) ); + /* Reduce random bytes to a single noise sample. This seems * like overkill, but we have no way of knowing how much * entropy is actually present in the bytes returned by the |