uefi/time: add monotonic counter services

UEFI possess monotonic counters useful for randomness seeding.

These APIs are used, e.g. in systemd-stub, to perform randomness
seeding.

Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

Author: RaitoBezarius

uefi-test-runner/src/boot/misc.rs

@@ -28,6 +28,17 @@ pub fn test() {
     test_install_configuration_table();
     info!("Testing crc32...");
     test_calculate_crc32();
+    info!("Testing monotonic count...");
+    test_monotonic_count();
+}
+
+fn test_monotonic_count() {
+    let first = boot::get_next_monotonic_count().expect("failed to get monotonic count");
+    let second = boot::get_next_monotonic_count().expect("failed to get monotonic count");
+    assert!(
+        second > first,
+        "monotonic count did not increase: {first} then {second}"
+    );
 }
 
 fn test_tpl() {

uefi-test-runner/src/runtime/mod.rs

@@ -2,12 +2,14 @@
 
 mod vars;
 
+use uefi::Status;
 use uefi::runtime::{self, Daylight, Time, TimeParams};
 
 pub fn test() {
     info!("Testing runtime services");
     vars::test();
     test_time();
+    test_monotonic_count();
 }
 
 fn test_time() {
@@ -37,3 +39,13 @@ fn test_time() {
     info!("After setting time: {now}");
     assert_eq!(now.year(), 2020);
 }
+
+fn test_monotonic_count() {
+    match runtime::get_next_high_monotonic_count() {
+        Ok(high_count) => info!("High monotonic count: {high_count}"),
+        Err(err) if matches!(err.status(), Status::UNSUPPORTED) => {
+            info!("High monotonic count not available: {}", err.status());
+        }
+        Err(err) => panic!("failed to get high monotonic count: {err:?}"),
+    }
+}

uefi/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Added
 
+- `boot::get_next_monotonic_count` and `runtime::get_next_high_monotonic_count`,
+  safe wrappers around the UEFI monotonic counter services.
 - `CStr8::as_slice`, `CStr8::as_slice_with_nul`, `CStr8::num_chars`, `CStr8::is_empty`,
   `CStr8::num_bytes`, `CStr8::is_ascii`, and `Char8::is_ascii`.
 

uefi/src/boot.rs

@@ -1616,6 +1616,34 @@ pub unsafe fn install_configuration_table(
     unsafe { (bt.install_configuration_table)(guid_entry, table_ptr) }.to_result()
 }
 
+/// Returns the next value of the platform's 64-bit monotonic counter.
+///
+/// The counter is guaranteed to return a numerically larger value on every
+/// call for the lifetime of the current boot. It is not related to any time
+/// source, so it must not be used for delays or time measurement.
+///
+/// The platform monotonic counter is split into two 32-bit halves. This boot
+/// service manages all 64 bits; the volatile low half is incremented by each
+/// call, while the non-volatile high half is incremented on reset or low-half
+/// overflow. After exiting boot services, an operating system can extend the
+/// counter at runtime with [`runtime::get_next_high_monotonic_count`].
+///
+/// # Errors
+///
+/// * [`Status::DEVICE_ERROR`]: the counter could not be read due to a hardware
+///   error.
+///
+/// [`runtime::get_next_high_monotonic_count`]: crate::runtime::get_next_high_monotonic_count
+pub fn get_next_monotonic_count() -> Result<u64> {
+    let bt = boot_services_raw_panicking();
+    // SAFETY: The pointer is not null and we assume it to be initialized.
+    let bt = unsafe { bt.as_ref() };
+
+    let mut count = 0;
+    // SAFETY: The memory is valid.
+    unsafe { (bt.get_next_monotonic_count)(&mut count) }.to_result_with_val(|| count)
+}
+
 /// Sets the watchdog timer.
 ///
 /// UEFI will start a 5-minute countdown after a UEFI image is loaded. The

uefi/src/runtime/mod.rs

@@ -70,6 +70,33 @@ pub fn get_time_and_caps() -> Result<(Time, TimeCapabilities)> {
     unsafe { (rt.get_time)(time_ptr.cast(), &mut caps) }.to_result_with_val(|| (time, caps))
 }
 
+/// Returns the next high 32 bits of the platform's monotonic counter.
+///
+/// The high half of the counter is non-volatile and is incremented by this
+/// call. It is intended to be used by an operating system to extend the
+/// platform monotonic counter after exiting boot services: snapshot the full
+/// 64-bit value with [`boot::get_next_monotonic_count`] before
+/// `ExitBootServices`, manage the volatile low 32 bits locally, and call this
+/// function to bump the high 32 bits when the low half rolls over.
+///
+/// # Errors
+///
+/// * [`Status::DEVICE_ERROR`]: the counter could not be saved due to a hardware
+///   error.
+/// * [`Status::UNSUPPORTED`]: this platform does not support the monotonic
+///   counter at runtime.
+///
+/// [`boot::get_next_monotonic_count`]: crate::boot::get_next_monotonic_count
+pub fn get_next_high_monotonic_count() -> Result<u32> {
+    let rt = runtime_services_raw_panicking();
+    // SAFETY: The pointer is not null and we assume it to be initialized.
+    let rt = unsafe { rt.as_ref() };
+
+    let mut high_count = 0;
+    // SAFETY: The memory is valid.
+    unsafe { (rt.get_next_high_monotonic_count)(&mut high_count) }.to_result_with_val(|| high_count)
+}
+
 /// Sets the current local time and date information
 ///
 /// During runtime, if a PC-AT CMOS device is present in the platform, the