lkml.org 
[lkml]   [2020]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC PATCH 25/41] random: probe cycle counter resolution at initialization
Date
An upcoming patch will change the entropy estimate per
add_interrupt_randomness() event for fips_enabled based on whether
random_get_entropy() resp. get_cycles() is able to capture individual
instructions.

For example, x86's TSC would qualify, whereas I've seen cycle counters on
e.g. a Raspberry PI 2B with an advertised resolution of only 52ns even
though the CPU had been clocked at 1GHz. And then there's possibly hardware
which doesn't have a cycle counter at all and where get_cycles() would
always return the same constant.

Make rand_initialize() probe the cycle counter resolution.

Introduce a new static_key have_highres_cycle_ctr, indicicating whether
or not the system's cycle counter is able to capture individual
instructions. Initially it's set to true. Introduce
probe_cycle_ctr_resolution() and call it from rand_initialize().
Make probe_cycle_ctr_resolution() compare 16 successive
random_get_entropy() values and disable have_highres_cycle_ctr in case
the same value has been read two times in a row. As have_highres_cycle_ctr
will be only accessed if fips_enabled is true, make it return early in
case it's not set.

Signed-off-by: Nicolai Stange <nstange@suse.de>
---
drivers/char/random.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index aaddee4e4ab1..a985ceb22c7c 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -335,6 +335,7 @@
#include <linux/syscalls.h>
#include <linux/completion.h>
#include <linux/uuid.h>
+#include <linux/jump_label.h>
#include <crypto/chacha.h>
#include <crypto/sha.h>

@@ -478,6 +479,8 @@ static struct ratelimit_state urandom_warning =

static int ratelimit_disable __read_mostly;

+static DEFINE_STATIC_KEY_TRUE(have_highres_cycle_ctr);
+
module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");

@@ -2170,6 +2173,31 @@ static void __init init_std_data(struct entropy_store *r)
mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
}

+static void probe_cycle_ctr_resolution(void)
+{
+ cycles_t prev;
+ int i;
+
+ if (!fips_enabled)
+ return;
+
+ /*
+ * Check if the cycle counter has insn granularity (or at
+ * least close to).
+ */
+ prev = random_get_entropy();
+ for (i = 0; i < 16; ++i) {
+ cycles_t next;
+
+ next = random_get_entropy();
+ if (next == prev) {
+ static_branch_disable(&have_highres_cycle_ctr);
+ return;
+ }
+ prev = next;
+ }
+}
+
/*
* Note that setup_arch() may call add_device_randomness()
* long before we get here. This allows seeding of the pools
@@ -2182,6 +2210,7 @@ static void __init init_std_data(struct entropy_store *r)
*/
int __init rand_initialize(void)
{
+ probe_cycle_ctr_resolution();
init_std_data(&input_pool);
crng_initialize_primary(&primary_crng);
crng_global_init_time = jiffies;
--
2.26.2
\
 
 \ /
  Last update: 2020-09-21 10:00    [W:0.291 / U:1.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site