mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 02:25:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

arch64: Support rng-seed to seed the kernel's rng

Browse source 
Having this property in the chosen node in conjuction with
CONFIG_RANDOM_TRUST_BOOTLOADER lets us seed the kernel's random number
generator with some truly random numbers. This is useful to get a better
stack canary than the default build time one and it means that you
should see a message like:

   random: get_random_bytes called from start_kernel+0x1e8/0x39c with crng_init=1

instead of a message like

   random: get_random_bytes called from start_kernel+0x1e8/0x39c with crng_init=0

in the kernel logs. We seed 256 bytes here because that seems good
enough to kick start the rng.

BUG=None
TEST=Boot vm, see crng_init=1 when guest kernel has
CONFIG_RANDOM_TRUST_BOOTLOADER=y

Change-Id: If3689f56cc17204a16410cf368e8413de160646c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2055526
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Stephen Boyd <swboyd@chromium.org>
Commit-Queue: Stephen Boyd <swboyd@chromium.org>
This commit is contained in:
Stephen Boyd 2020-02-13 17:48:08 -08:00 committed by Commit Bot
parent 7c43b32a36
commit a0742bb58e
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
aarch64/src/fdt.rs
View file

@ -197,6 +197,12 @@ fn create_chosen_node(
let kaslr_seed = u64::from_le_bytes(kaslr_seed_bytes); let kaslr_seed = u64::from_le_bytes(kaslr_seed_bytes);
property_u64(fdt, "kaslr-seed", kaslr_seed)?; property_u64(fdt, "kaslr-seed", kaslr_seed)?;
let mut rng_seed_bytes = [0u8; 256];
random_file
.read_exact(&mut rng_seed_bytes)
.map_err(Error::FdtIoError)?;
property(fdt, "rng-seed", &rng_seed_bytes)?;
if let Some((initrd_addr, initrd_size)) = initrd { if let Some((initrd_addr, initrd_size)) = initrd {
let initrd_start = initrd_addr.offset() as u32; let initrd_start = initrd_addr.offset() as u32;
let initrd_end = initrd_start + initrd_size as u32; let initrd_end = initrd_start + initrd_size as u32;