Hi Sean, On Fri, Aug 04, 2023 at 04:33:56PM -0700, [email protected] wrote: > From: Dhananjay Phadke <[email protected]> > > Add support for KASLR seed from TPM device. Invokes tpm_get_random() > API to read 8-bytes of random bytes for KASLR.
Can you elaborate a bit more why you specifically need an RNG from the TPM? > > Signed-off-by: Dhananjay Phadke <[email protected]> > Signed-off-by: Drew Kluemke <[email protected]> > Signed-off-by: Sean Edmond <[email protected]> > --- > boot/image-fdt.c | 3 +++ > common/fdt_support.c | 39 ++++++++++++++++++++++++++++++++++++++- > include/fdt_support.h | 1 + > lib/Kconfig | 9 +++++++++ > 4 files changed, 51 insertions(+), 1 deletion(-) > > diff --git a/boot/image-fdt.c b/boot/image-fdt.c > index f10200f647..127443963e 100644 > --- a/boot/image-fdt.c > +++ b/boot/image-fdt.c > @@ -624,6 +624,9 @@ int image_setup_libfdt(struct bootm_headers *images, void > *blob, > goto err; > } > > + if (IS_ENABLED(CONFIG_KASLR_TPM_SEED)) > + fdt_tpm_kaslr_seed(blob); So, why can't we just add entropy from any available RNG? In Arm world we could have TF-A, OP-TEE, an RNG hardware or a TPM capable of doing that (or all of them). Can't we just do platform_get_rng_device(&dev); dm_rng_read(....); And even if we specifically need an RNG from a TPM, I think it's better to find a way and teach platform_get_rng_device() to return a list of devices in priority instead of hardcoding that. [...] Thanks /Ilias
