Conversation
Particularly exciting to me is the work on allowing nearly all platforms to pass RNG seeds via a boot-time protocol. The hope is that if the hypervisor, kexec, firmware, or traditional bootloader is in a good position to provide an RNG seed, it can do so across platforms. 2/7
1
1
5
On device tree platforms, there's been the "rng-seed" parameter since 2019. New on x86, there's SETUP_RNG_SEED: git.kernel.org/pub/scm/linux/ And on the m68k "virt" platform, there's now BI_VIRT_RNG_SEED: git.kernel.org/pub/scm/linux/ 3/7
1
2
Correspondingly, on QEMU for 7.1+, there will be support for passing these RNG seeds from host to guest: git.qemu.org/?p=qemu.git;a= git.qemu.org/?p=qemu.git;a= git.qemu.org/?p=qemu.git;a= git.qemu.org/?p=qemu.git;a= git.qemu.org/?p=qemu.git;a= github.com/alistair23/qem github.com/stffrdhrn/qemu 4/7
1
7
And kexec-tools will be able to do it too: git.kernel.org/pub/scm/utils/ And I'll probably take a look at adding support to the rust-vmm project (used by projects like Firecracker), unless of course somebody beats me to it (hint hint !) 5/7
1
7
But what I'm hoping is that various bootloaders and architecture firmwares start looking into supporting this using whatever capabilities are available. Other operating systems, such as the BSDs, have managed seed files in their bootloaders with success for a very long time. 6/7
1
6
Now for Linux, the kernel-side pieces are there, and we now just have to fill in the bootloader and firmware side. That's a separate case-by-case puzzle, and as always, there's no doubt work to be done, but the plumbing is starting to be viable. 7/7
1
4
Replying to
Why doesn't the Linux kernel keep a random seed in pstore?
Replying to
Not a bad idea. The pstore-efi case isn't so useful, as EFI already can supply a seed (via EFI_RNG_PROTOCOL). But pstore has a few backends (-blk, -mtd, -ram). Maybe that's the right abstraction for this -- persistent storage w/o a real filesystem. 1/3
1
1
Though, I wonder about the privacy of the data on various backends; I haven't looked into that. It'd also be useful to have a specific pstore backend + real system in mind that this would help on. 2/3
1
1
Show replies