Hello Hung-Chun
On Wed, 14 Oct 2026 at 22:06, Hung-Chun Tseng <[email protected]> wrote:
>
> tpm2_get_random() reads the size of the returned random bytes with the
> "w" format of unpack_byte_string(), which stores a u16, but data_size
> is a u32. Only its lower half is written, so its upper half keeps
> whatever was on the stack, and the "data_size > this_bytes" check
> fails with TPM_LIB_ERROR whenever that is not zero.
>
> On qemu-riscv64_smode with a swtpm TPM, this breaks the kaslr-seed
> fixup on every bootefi:
Just a not here, kaslr-seed is not what you want for KASLR. Having the
EFI rng protocol is better since it randomizes both the physical and
virtual placement of the kernel.
>
> tpm-rng tpm-rng: dm_rng_read failed: -1
>
> Under gdb, data_size was 0xffffffff before the call and 0xffff0008
> after it, for an 8-byte request. Whether it fails depends on the stack
> contents, so unrelated changes can hide it.
>
> The size field of a TPM2B is a UINT16, so declare data_size as u16.
>
> Fixes: 06bea4980980 ("tpm: add TPM2_GetRandom command support")
> Signed-off-by: Hung-Chun Tseng <[email protected]>
> ---
Reviewed-by: Ilias Apalodimas <[email protected]>
> lib/tpm-v2.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
> index f443b738f..4c7dfc556 100644
> --- a/lib/tpm-v2.c
> +++ b/lib/tpm-v2.c
> @@ -977,7 +977,7 @@ u32 tpm2_get_random(struct udevice *dev, void *data, u32
> count)
> const size_t data_size_offset = 10;
> const size_t data_offset = 12;
> size_t response_length = sizeof(response);
> - u32 data_size;
> + u16 data_size;
> u8 *out = data;
>
> while (count > 0) {
> --
> 2.43.0
>
