EFI-Backed Persistent Boot Counter for Early-Boot HMAC in FreeBSD

This project introduces a firmware-backed persistent boot counter into the FreeBSD base system to address the early-boot entropy problem. During system startup, before the kernel’s random number generator is sufficiently seeded, certain subsystems may produce predictable values, which can weaken authentication mechanisms such as HMAC-based protocols. The proposed solution leverages the UEFI monotonic counter, accessed during the loader stage (before ExitBootServices), and transports it to the kernel using the existing metadata mechanism. The kernel exposes this value via a read-only sysctl (kern.bootcount), allowing early-boot consumers such as networking subsystems to incorporate it into their computations and ensure per-boot uniqueness. The implementation involves modifying loader.efi to capture the counter, extending the metadata pipeline, and adding a kernel module for ingestion and exposure. The project also includes a fallback mechanism for non-UEFI systems, a testing framework using QEMU/OVMF, and documentation. Deliverables include a working kernel interface, regression tests, documentation, and optional integration with subsystems such as SNMP and CARP via the opencrypto framework.