Hi Sean,
On Fri, Aug 04, 2023 at 04:33:56PM -0700, seanedmond@linux.microsoft.com wrote:
From: Dhananjay Phadke dphadke@linux.microsoft.com
Add support for KASLR seed from TPM device. Invokes tpm_get_random() API to read 8-bytes of random bytes for KASLR.
Can you elaborate a bit more why you specifically need an RNG from the TPM?
Signed-off-by: Dhananjay Phadke dphadke@linux.microsoft.com Signed-off-by: Drew Kluemke ankluemk@microsoft.com Signed-off-by: Sean Edmond seanedmond@microsoft.com
boot/image-fdt.c | 3 +++ common/fdt_support.c | 39 ++++++++++++++++++++++++++++++++++++++- include/fdt_support.h | 1 + lib/Kconfig | 9 +++++++++ 4 files changed, 51 insertions(+), 1 deletion(-)
diff --git a/boot/image-fdt.c b/boot/image-fdt.c index f10200f647..127443963e 100644 --- a/boot/image-fdt.c +++ b/boot/image-fdt.c @@ -624,6 +624,9 @@ int image_setup_libfdt(struct bootm_headers *images, void *blob, goto err; }
- if (IS_ENABLED(CONFIG_KASLR_TPM_SEED))
fdt_tpm_kaslr_seed(blob);
So, why can't we just add entropy from any available RNG? In Arm world we could have TF-A, OP-TEE, an RNG hardware or a TPM capable of doing that (or all of them).
Can't we just do platform_get_rng_device(&dev); dm_rng_read(....);
And even if we specifically need an RNG from a TPM, I think it's better to find a way and teach platform_get_rng_device() to return a list of devices in priority instead of hardcoding that.
[...]
Thanks /Ilias