lkml.org 
[lkml]   [2022]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 076/264] random: avoid arch_get_random_seed_long() when collecting IRQ randomness
    Date
    From: Ard Biesheuvel <ardb@kernel.org>

    commit 390596c9959c2a4f5b456df339f0604df3d55fe0 upstream.

    When reseeding the CRNG periodically, arch_get_random_seed_long() is
    called to obtain entropy from an architecture specific source if one
    is implemented. In most cases, these are special instructions, but in
    some cases, such as on ARM, we may want to back this using firmware
    calls, which are considerably more expensive.

    Another call to arch_get_random_seed_long() exists in the CRNG driver,
    in add_interrupt_randomness(), which collects entropy by capturing
    inter-interrupt timing and relying on interrupt jitter to provide
    random bits. This is done by keeping a per-CPU state, and mixing in
    the IRQ number, the cycle counter and the return address every time an
    interrupt is taken, and mixing this per-CPU state into the entropy pool
    every 64 invocations, or at least once per second. The entropy that is
    gathered this way is credited as 1 bit of entropy. Every time this
    happens, arch_get_random_seed_long() is invoked, and the result is
    mixed in as well, and also credited with 1 bit of entropy.

    This means that arch_get_random_seed_long() is called at least once
    per second on every CPU, which seems excessive, and doesn't really
    scale, especially in a virtualization scenario where CPUs may be
    oversubscribed: in cases where arch_get_random_seed_long() is backed
    by an instruction that actually goes back to a shared hardware entropy
    source (such as RNDRRS on ARM), we will end up hitting it hundreds of
    times per second.

    So let's drop the call to arch_get_random_seed_long() from
    add_interrupt_randomness(), and instead, rely on crng_reseed() to call
    the arch hook to get random seed material from the platform.

    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Reviewed-by: Andre Przywara <andre.przywara@arm.com>
    Tested-by: Andre Przywara <andre.przywara@arm.com>
    Reviewed-by: Eric Biggers <ebiggers@google.com>
    Acked-by: Marc Zyngier <maz@kernel.org>
    Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Link: https://lore.kernel.org/r/20201105152944.16953-1-ardb@kernel.org
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/random.c | 15 +--------------
    1 file changed, 1 insertion(+), 14 deletions(-)

    --- a/drivers/char/random.c
    +++ b/drivers/char/random.c
    @@ -1331,8 +1331,6 @@ void add_interrupt_randomness(int irq, i
    cycles_t cycles = random_get_entropy();
    __u32 c_high, j_high;
    __u64 ip;
    - unsigned long seed;
    - int credit = 0;

    if (cycles == 0)
    cycles = get_reg(fast_pool, regs);
    @@ -1368,23 +1366,12 @@ void add_interrupt_randomness(int irq, i

    fast_pool->last = now;
    __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
    -
    - /*
    - * If we have architectural seed generator, produce a seed and
    - * add it to the pool. For the sake of paranoia don't let the
    - * architectural seed generator dominate the input from the
    - * interrupt noise.
    - */
    - if (arch_get_random_seed_long(&seed)) {
    - __mix_pool_bytes(r, &seed, sizeof(seed));
    - credit = 1;
    - }
    spin_unlock(&r->lock);

    fast_pool->count = 0;

    /* award one bit for the contents of the fast pool */
    - credit_entropy_bits(r, credit + 1);
    + credit_entropy_bits(r, 1);
    }
    EXPORT_SYMBOL_GPL(add_interrupt_randomness);


    \
     
     \ /
      Last update: 2022-06-23 18:59    [W:4.104 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site