old AMD RDRAND bug reappeared after BIOS firmware update

[slatc]

Hello,
I own an HP EliteBook 735 G6 running both Linux and Windows 11. The computer worked fine with BIOS version 1.31, but I had to update it because the new Secure Boot certificates require version 1.32 or later.

So, I tried version 1.33 (the latest one). The installation went smoothly, but upon booting into Linux, warning messages regarding RDRAND appeared. It seems that a known old bug associated with this AMD processor has resurfaced: the RDRAND instruction is unreliable. It consistently returns the same value instead of a random number.

To my knowledge, this bug was fixed years ago by AMD, which had made a BIOS patch available to manufacturers.

I tried version 1.32 and encountered the same issue.

Reverting to version 1.31 resolved the problem, but I was unable to install the new Secure Boot certificates. Consequently, I reinstalled version 1.33. The certificates are now up to date, but I am still facing the RDRAND bug.

I tried contacting technical support, but since this computer has reached its end of life, the agent was unable to assist me.

Is there something I can do about this issue?

[BeemerBiker]

According to two AI bot's this is a linux problem as windows manages system randomness (entropy) differently than Linux

How to Disable RDRAND in Linux

The easiest way to tell your system to avoid the RDRAND instruction is to add nordrand to your Linux bootloader (like GRUB). 

• Open your terminal in Linux.

• Open your GRUB configuration file with a text editor (e.g., sudo nano /etc/default/grub).

• Look for the line that starts with GRUB_CMDLINE_LINUX_DEFAULT.

• Add nordrand inside the quotation marks at the end of the parameters.

• Save the file (in nano, press Ctrl+O, then Enter. Press Ctrl+X to exit).

• Update your bootloader by running sudo update-grub (on Debian/Ubuntu-based systems) or grub-mkconfig -o /boot/grub/grub.cfg.

• Reboot your computer. 

[slatc]

Thanks.
I’ve already tried that (the AI ​​bots are a bit outdated: the current parameter isn't "nordrand", but "random.trust_cpu=off"), but it didn't make any difference.
It seems that nowadays, the operating system doesn't use RDRAND if it is detected as faulty (the error message is "RDRAND is not reliable on this platform; disabling").
However, that doesn't prevent a program or library from calling the instruction directly and getting an incorrect result (I verified this on Linux; I haven't tested it on Windows, but I imagine the result would be the same).

For now, I can only hope that no program calls RDRAND directly. I don't know to what extent this is a problem.

I imagine the real solution would be a firmware update (like it was before v1.32). But I don't know if it is possible to report the issue to HP, or even if a new firmware update will ever be released for this model.