[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[XEN PATCH v3] libxl/arm: provide guests with random seed

Pass 128 bytes of random seed via FDT, so that guests' CRNGs are better seeded
early at boot. This is larger than ChaCha20 key size of 32, so each byte of
CRNG state will be mixed 4 times using this seed. There does not seem to be
advantage in larger seed though.

Depending on its configuration Linux can use the seed as device randomness
or to just quickly initialize CRNG.
In either case this will provide extra randomness to further harden CRNG.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
Reviewed-by: Julien Grall <julien@xxxxxxx>

        Changes in V3:
                - Rebased on current master

 tools/libs/light/libxl_arm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/libs/light/libxl_arm.c b/tools/libs/light/libxl_arm.c
index e2901f13b7..e3140a6e00 100644
--- a/tools/libs/light/libxl_arm.c
+++ b/tools/libs/light/libxl_arm.c
@@ -305,6 +305,9 @@ static int make_chosen_node(libxl__gc *gc, void *fdt, bool 
     int res;
+    /* 1024 bit enough to mix Linux CRNG state several times */
+    uint8_t seed[128];
     /* See linux Documentation/devicetree/... */
     res = fdt_begin_node(fdt, "chosen");
     if (res) return res;
@@ -343,6 +346,11 @@ static int make_chosen_node(libxl__gc *gc, void *fdt, bool 
         if (res) return res;
+    res = libxl__random_bytes(gc, seed, sizeof(seed));
+    if (res) return res;
+    res = fdt_property(fdt, "rng-seed", seed, sizeof(seed));
+    if (res) return res;
     res = fdt_end_node(fdt);
     if (res) return res;



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.