From 56f4345999929227f1857ba99c24733009e890b5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 26 May 2022 16:44:20 +0200 Subject: [PATCH] 5.18-stable patches added patches: alpha-define-get_cycles-macro-for-arch-override.patch arm-use-fallback-for-random_get_entropy-instead-of-zero.patch ia64-define-get_cycles-macro-for-arch-override.patch init-call-time_init-before-rand_initialize.patch m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch parisc-define-get_cycles-macro-for-arch-override.patch powerpc-define-get_cycles-macro-for-arch-override.patch random-avoid-initializing-twice-in-credit-race.patch random-check-for-signals-after-page-of-pool-writes.patch random-convert-to-using-fops-read_iter.patch random-convert-to-using-fops-write_iter.patch random-credit-architectural-init-the-exact-amount.patch random-do-not-pretend-to-handle-premature-next-security-model.patch random-do-not-use-batches-when-crng_ready.patch random-do-not-use-input-pool-from-hard-irqs.patch random-fix-sysctl-documentation-nits.patch random-handle-latent-entropy-and-command-line-from-random_init.patch random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch random-make-consistent-use-of-buf-and-len.patch random-move-initialization-functions-out-of-hot-pages.patch random-move-initialization-out-of-reseeding-hot-path.patch random-move-randomize_page-into-mm-where-it-belongs.patch random-order-timer-entropy-functions-below-interrupt-functions.patch random-remove-extern-from-functions-in-header.patch random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch random-unify-batched-entropy-implementations.patch random-use-first-128-bits-of-input-as-fast-init.patch random-use-proper-jiffies-comparison-macro.patch random-use-proper-return-types-on-get_random_-int-long-_wait.patch random-use-static-branch-for-crng_ready.patch random-use-symbolic-constants-for-crng_init-states.patch random-wire-up-fops-splice_-read-write-_iter.patch riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch s390-define-get_cycles-macro-for-arch-override.patch siphash-use-one-source-of-truth-for-siphash-permutations.patch sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch um-use-fallback-for-random_get_entropy-instead-of-zero.patch x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch --- ...e-get_cycles-macro-for-arch-override.patch | 36 ++ ...r-random_get_entropy-instead-of-zero.patch | 36 ++ ...e-get_cycles-macro-for-arch-override.patch | 34 ++ ...all-time_init-before-rand_initialize.patch | 50 ++ ...r-random_get_entropy-instead-of-zero.patch | 38 ++ ...et_entropy-instead-of-just-c0-random.patch | 66 ++ ...r-random_get_entropy-instead-of-zero.patch | 38 ++ ...e-get_cycles-macro-for-arch-override.patch | 39 ++ ...e-get_cycles-macro-for-arch-override.patch | 37 ++ ...id-initializing-twice-in-credit-race.patch | 54 ++ ...or-signals-after-page-of-pool-writes.patch | 101 ++++ ...ndom-convert-to-using-fops-read_iter.patch | 183 ++++++ ...dom-convert-to-using-fops-write_iter.patch | 148 +++++ ...-architectural-init-the-exact-amount.patch | 61 ++ ...handle-premature-next-security-model.patch | 479 +++++++++++++++ ...m-do-not-use-batches-when-crng_ready.patch | 61 ++ ...do-not-use-input-pool-from-hard-irqs.patch | 147 +++++ ...random-fix-sysctl-documentation-nits.patch | 42 ++ ...py-and-command-line-from-random_init.patch | 132 ++++ ...-fast_mix-by-using-simpler-arguments.patch | 94 +++ ...ntropy-existing-in-order-to-simplify.patch | 222 +++++++ ...m-make-consistent-use-of-buf-and-len.patch | 566 ++++++++++++++++++ ...alization-functions-out-of-hot-pages.patch | 199 ++++++ ...ialization-out-of-reseeding-hot-path.patch | 95 +++ ...domize_page-into-mm-where-it-belongs.patch | 134 +++++ ...-functions-below-interrupt-functions.patch | 299 +++++++++ ...move-extern-from-functions-in-header.patch | 150 +++++ ...ng-for-in-kernel-unseeded-randomness.patch | 200 +++++++ ...nify-batched-entropy-implementations.patch | 190 ++++++ ...first-128-bits-of-input-as-fast-init.patch | 307 ++++++++++ ...-use-proper-jiffies-comparison-macro.patch | 29 + ...-types-on-get_random_-int-long-_wait.patch | 46 ++ ...dom-use-static-branch-for-crng_ready.patch | 97 +++ ...bolic-constants-for-crng_init-states.patch | 125 ++++ ...ire-up-fops-splice_-read-write-_iter.patch | 45 ++ ...r-random_get_entropy-instead-of-zero.patch | 40 ++ ...e-get_cycles-macro-for-arch-override.patch | 39 ++ queue-5.18/series | 43 ++ ...ce-of-truth-for-siphash-permutations.patch | 223 +++++++ ...r-random_get_entropy-instead-of-zero.patch | 43 ++ ...lock-fallback-for-random_get_entropy.patch | 100 ++++ ...r-random_get_entropy-instead-of-zero.patch | 51 ++ ...r-random_get_entropy-instead-of-zero.patch | 73 +++ ...r-random_get_entropy-instead-of-zero.patch | 51 ++ 44 files changed, 5243 insertions(+) create mode 100644 queue-5.18/alpha-define-get_cycles-macro-for-arch-override.patch create mode 100644 queue-5.18/arm-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/ia64-define-get_cycles-macro-for-arch-override.patch create mode 100644 queue-5.18/init-call-time_init-before-rand_initialize.patch create mode 100644 queue-5.18/m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch create mode 100644 queue-5.18/nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/parisc-define-get_cycles-macro-for-arch-override.patch create mode 100644 queue-5.18/powerpc-define-get_cycles-macro-for-arch-override.patch create mode 100644 queue-5.18/random-avoid-initializing-twice-in-credit-race.patch create mode 100644 queue-5.18/random-check-for-signals-after-page-of-pool-writes.patch create mode 100644 queue-5.18/random-convert-to-using-fops-read_iter.patch create mode 100644 queue-5.18/random-convert-to-using-fops-write_iter.patch create mode 100644 queue-5.18/random-credit-architectural-init-the-exact-amount.patch create mode 100644 queue-5.18/random-do-not-pretend-to-handle-premature-next-security-model.patch create mode 100644 queue-5.18/random-do-not-use-batches-when-crng_ready.patch create mode 100644 queue-5.18/random-do-not-use-input-pool-from-hard-irqs.patch create mode 100644 queue-5.18/random-fix-sysctl-documentation-nits.patch create mode 100644 queue-5.18/random-handle-latent-entropy-and-command-line-from-random_init.patch create mode 100644 queue-5.18/random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch create mode 100644 queue-5.18/random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch create mode 100644 queue-5.18/random-make-consistent-use-of-buf-and-len.patch create mode 100644 queue-5.18/random-move-initialization-functions-out-of-hot-pages.patch create mode 100644 queue-5.18/random-move-initialization-out-of-reseeding-hot-path.patch create mode 100644 queue-5.18/random-move-randomize_page-into-mm-where-it-belongs.patch create mode 100644 queue-5.18/random-order-timer-entropy-functions-below-interrupt-functions.patch create mode 100644 queue-5.18/random-remove-extern-from-functions-in-header.patch create mode 100644 queue-5.18/random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch create mode 100644 queue-5.18/random-unify-batched-entropy-implementations.patch create mode 100644 queue-5.18/random-use-first-128-bits-of-input-as-fast-init.patch create mode 100644 queue-5.18/random-use-proper-jiffies-comparison-macro.patch create mode 100644 queue-5.18/random-use-proper-return-types-on-get_random_-int-long-_wait.patch create mode 100644 queue-5.18/random-use-static-branch-for-crng_ready.patch create mode 100644 queue-5.18/random-use-symbolic-constants-for-crng_init-states.patch create mode 100644 queue-5.18/random-wire-up-fops-splice_-read-write-_iter.patch create mode 100644 queue-5.18/riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/s390-define-get_cycles-macro-for-arch-override.patch create mode 100644 queue-5.18/siphash-use-one-source-of-truth-for-siphash-permutations.patch create mode 100644 queue-5.18/sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch create mode 100644 queue-5.18/um-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch create mode 100644 queue-5.18/xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch diff --git a/queue-5.18/alpha-define-get_cycles-macro-for-arch-override.patch b/queue-5.18/alpha-define-get_cycles-macro-for-arch-override.patch new file mode 100644 index 00000000000..c90b9af7bc9 --- /dev/null +++ b/queue-5.18/alpha-define-get_cycles-macro-for-arch-override.patch @@ -0,0 +1,36 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 23 Apr 2022 21:11:41 +0200 +Subject: alpha: define get_cycles macro for arch-override + +From: "Jason A. Donenfeld" + +commit 1097710bc9660e1e588cf2186a35db3d95c4d258 upstream. + +Alpha defines a get_cycles() function, but it does not do the usual +`#define get_cycles get_cycles` dance, making it impossible for generic +code to see if an arch-specific function was defined. While the +get_cycles() ifdef is not currently used, the following timekeeping +patch in this series will depend on the macro existing (or not existing) +when defining random_get_entropy(). + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Richard Henderson +Cc: Ivan Kokshaysky +Acked-by: Matt Turner +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/alpha/include/asm/timex.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/alpha/include/asm/timex.h ++++ b/arch/alpha/include/asm/timex.h +@@ -28,5 +28,6 @@ static inline cycles_t get_cycles (void) + __asm__ __volatile__ ("rpcc %0" : "=r"(ret)); + return ret; + } ++#define get_cycles get_cycles + + #endif diff --git a/queue-5.18/arm-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/arm-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..36d8229b7ed --- /dev/null +++ b/queue-5.18/arm-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,36 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: arm: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit ff8a8f59c99f6a7c656387addc4d9f2247d75077 upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Reviewed-by: Russell King (Oracle) +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/timex.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/include/asm/timex.h ++++ b/arch/arm/include/asm/timex.h +@@ -11,5 +11,6 @@ + + typedef unsigned long cycles_t; + #define get_cycles() ({ cycles_t c; read_current_timer(&c) ? 0 : c; }) ++#define random_get_entropy() (((unsigned long)get_cycles()) ?: random_get_entropy_fallback()) + + #endif diff --git a/queue-5.18/ia64-define-get_cycles-macro-for-arch-override.patch b/queue-5.18/ia64-define-get_cycles-macro-for-arch-override.patch new file mode 100644 index 00000000000..c8a48cf6a92 --- /dev/null +++ b/queue-5.18/ia64-define-get_cycles-macro-for-arch-override.patch @@ -0,0 +1,34 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 23 Apr 2022 21:11:41 +0200 +Subject: ia64: define get_cycles macro for arch-override + +From: "Jason A. Donenfeld" + +commit 57c0900b91d8891ab43f0e6b464d059fda51d102 upstream. + +Itanium defines a get_cycles() function, but it does not do the usual +`#define get_cycles get_cycles` dance, making it impossible for generic +code to see if an arch-specific function was defined. While the +get_cycles() ifdef is not currently used, the following timekeeping +patch in this series will depend on the macro existing (or not existing) +when defining random_get_entropy(). + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/include/asm/timex.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/ia64/include/asm/timex.h ++++ b/arch/ia64/include/asm/timex.h +@@ -39,6 +39,7 @@ get_cycles (void) + ret = ia64_getreg(_IA64_REG_AR_ITC); + return ret; + } ++#define get_cycles get_cycles + + extern void ia64_cpu_local_tick (void); + extern unsigned long long ia64_native_sched_clock (void); diff --git a/queue-5.18/init-call-time_init-before-rand_initialize.patch b/queue-5.18/init-call-time_init-before-rand_initialize.patch new file mode 100644 index 00000000000..d0d4b07f9e4 --- /dev/null +++ b/queue-5.18/init-call-time_init-before-rand_initialize.patch @@ -0,0 +1,50 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Thu, 5 May 2022 02:20:22 +0200 +Subject: init: call time_init() before rand_initialize() + +From: "Jason A. Donenfeld" + +commit fe222a6ca2d53c38433cba5d3be62a39099e708e upstream. + +Currently time_init() is called after rand_initialize(), but +rand_initialize() makes use of the timer on various platforms, and +sometimes this timer needs to be initialized by time_init() first. In +order for random_get_entropy() to not return zero during early boot when +it's potentially used as an entropy source, reverse the order of these +two calls. The block doing random initialization was right before +time_init() before, so changing the order shouldn't have any complicated +effects. + +Cc: Andrew Morton +Reviewed-by: Stafford Horne +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + init/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/init/main.c ++++ b/init/main.c +@@ -1035,11 +1035,13 @@ asmlinkage __visible void __init __no_sa + softirq_init(); + timekeeping_init(); + kfence_init(); ++ time_init(); + + /* + * For best initial stack canary entropy, prepare it after: + * - setup_arch() for any UEFI RNG entropy and boot cmdline access + * - timekeeping_init() for ktime entropy used in rand_initialize() ++ * - time_init() for making random_get_entropy() work on some platforms + * - rand_initialize() to get any arch-specific entropy like RDRAND + * - add_latent_entropy() to get any latent entropy + * - adding command line entropy +@@ -1049,7 +1051,6 @@ asmlinkage __visible void __init __no_sa + add_device_randomness(command_line, strlen(command_line)); + boot_init_stack_canary(); + +- time_init(); + perf_event_init(); + profile_init(); + call_function_init(); diff --git a/queue-5.18/m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..6e68d323fcb --- /dev/null +++ b/queue-5.18/m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,38 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: m68k: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit 0f392c95391f2d708b12971a07edaa7973f9eece upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Acked-by: Geert Uytterhoeven +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/include/asm/timex.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/m68k/include/asm/timex.h ++++ b/arch/m68k/include/asm/timex.h +@@ -35,7 +35,7 @@ static inline unsigned long random_get_e + { + if (mach_random_get_entropy) + return mach_random_get_entropy(); +- return 0; ++ return random_get_entropy_fallback(); + } + #define random_get_entropy random_get_entropy + diff --git a/queue-5.18/mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch b/queue-5.18/mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch new file mode 100644 index 00000000000..0794dd8f130 --- /dev/null +++ b/queue-5.18/mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch @@ -0,0 +1,66 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: mips: use fallback for random_get_entropy() instead of just c0 random + +From: "Jason A. Donenfeld" + +commit 1c99c6a7c3c599a68321b01b9ec243215ede5a68 upstream. + +For situations in which we don't have a c0 counter register available, +we've been falling back to reading the c0 "random" register, which is +usually bounded by the amount of TLB entries and changes every other +cycle or so. This means it wraps extremely often. We can do better by +combining this fast-changing counter with a potentially slower-changing +counter from random_get_entropy_fallback() in the more significant bits. +This commit combines the two, taking into account that the changing bits +are in a different bit position depending on the CPU model. In addition, +we previously were falling back to 0 for ancient CPUs that Linux does +not support anyway; remove that dead path entirely. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Tested-by: Maciej W. Rozycki +Acked-by: Thomas Bogendoerfer +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/include/asm/timex.h | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/arch/mips/include/asm/timex.h ++++ b/arch/mips/include/asm/timex.h +@@ -76,25 +76,24 @@ static inline cycles_t get_cycles(void) + else + return 0; /* no usable counter */ + } ++#define get_cycles get_cycles + + /* + * Like get_cycles - but where c0_count is not available we desperately + * use c0_random in an attempt to get at least a little bit of entropy. +- * +- * R6000 and R6000A neither have a count register nor a random register. +- * That leaves no entropy source in the CPU itself. + */ + static inline unsigned long random_get_entropy(void) + { +- unsigned int prid = read_c0_prid(); +- unsigned int imp = prid & PRID_IMP_MASK; ++ unsigned int c0_random; + +- if (can_use_mips_counter(prid)) ++ if (can_use_mips_counter(read_c0_prid())) + return read_c0_count(); +- else if (likely(imp != PRID_IMP_R6000 && imp != PRID_IMP_R6000A)) +- return read_c0_random(); ++ ++ if (cpu_has_3kex) ++ c0_random = (read_c0_random() >> 8) & 0x3f; + else +- return 0; /* no usable register */ ++ c0_random = read_c0_random() & 0x3f; ++ return (random_get_entropy_fallback() << 6) | (0x3f - c0_random); + } + #define random_get_entropy random_get_entropy + diff --git a/queue-5.18/nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..e950071b645 --- /dev/null +++ b/queue-5.18/nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,38 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: nios2: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit c04e72700f2293013dab40208e809369378f224c upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Acked-by: Dinh Nguyen +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/nios2/include/asm/timex.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/nios2/include/asm/timex.h ++++ b/arch/nios2/include/asm/timex.h +@@ -8,5 +8,8 @@ + typedef unsigned long cycles_t; + + extern cycles_t get_cycles(void); ++#define get_cycles get_cycles ++ ++#define random_get_entropy() (((unsigned long)get_cycles()) ?: random_get_entropy_fallback()) + + #endif diff --git a/queue-5.18/parisc-define-get_cycles-macro-for-arch-override.patch b/queue-5.18/parisc-define-get_cycles-macro-for-arch-override.patch new file mode 100644 index 00000000000..516eeabc7dd --- /dev/null +++ b/queue-5.18/parisc-define-get_cycles-macro-for-arch-override.patch @@ -0,0 +1,39 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 23 Apr 2022 21:11:41 +0200 +Subject: parisc: define get_cycles macro for arch-override + +From: "Jason A. Donenfeld" + +commit 8865bbe6ba1120e67f72201b7003a16202cd42be upstream. + +PA-RISC defines a get_cycles() function, but it does not do the usual +`#define get_cycles get_cycles` dance, making it impossible for generic +code to see if an arch-specific function was defined. While the +get_cycles() ifdef is not currently used, the following timekeeping +patch in this series will depend on the macro existing (or not existing) +when defining random_get_entropy(). + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Acked-by: Helge Deller +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/include/asm/timex.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/parisc/include/asm/timex.h ++++ b/arch/parisc/include/asm/timex.h +@@ -13,9 +13,10 @@ + + typedef unsigned long cycles_t; + +-static inline cycles_t get_cycles (void) ++static inline cycles_t get_cycles(void) + { + return mfctl(16); + } ++#define get_cycles get_cycles + + #endif diff --git a/queue-5.18/powerpc-define-get_cycles-macro-for-arch-override.patch b/queue-5.18/powerpc-define-get_cycles-macro-for-arch-override.patch new file mode 100644 index 00000000000..97a296e0647 --- /dev/null +++ b/queue-5.18/powerpc-define-get_cycles-macro-for-arch-override.patch @@ -0,0 +1,37 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 23 Apr 2022 21:11:41 +0200 +Subject: powerpc: define get_cycles macro for arch-override + +From: "Jason A. Donenfeld" + +commit 408835832158df0357e18e96da7f2d1ed6b80e7f upstream. + +PowerPC defines a get_cycles() function, but it does not do the usual +`#define get_cycles get_cycles` dance, making it impossible for generic +code to see if an arch-specific function was defined. While the +get_cycles() ifdef is not currently used, the following timekeeping +patch in this series will depend on the macro existing (or not existing) +when defining random_get_entropy(). + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Acked-by: Michael Ellerman +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/timex.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/include/asm/timex.h ++++ b/arch/powerpc/include/asm/timex.h +@@ -19,6 +19,7 @@ static inline cycles_t get_cycles(void) + { + return mftb(); + } ++#define get_cycles get_cycles + + #endif /* __KERNEL__ */ + #endif /* _ASM_POWERPC_TIMEX_H */ diff --git a/queue-5.18/random-avoid-initializing-twice-in-credit-race.patch b/queue-5.18/random-avoid-initializing-twice-in-credit-race.patch new file mode 100644 index 00000000000..5d6a8f459b5 --- /dev/null +++ b/queue-5.18/random-avoid-initializing-twice-in-credit-race.patch @@ -0,0 +1,54 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Mon, 9 May 2022 13:40:55 +0200 +Subject: random: avoid initializing twice in credit race + +From: "Jason A. Donenfeld" + +commit fed7ef061686cc813b1f3d8d0edc6c35b4d3537b upstream. + +Since all changes of crng_init now go through credit_init_bits(), we can +fix a long standing race in which two concurrent callers of +credit_init_bits() have the new bit count >= some threshold, but are +doing so with crng_init as a lower threshold, checked outside of a lock, +resulting in crng_reseed() or similar being called twice. + +In order to fix this, we can use the original cmpxchg value of the bit +count, and only change crng_init when the bit count transitions from +below a threshold to meeting the threshold. + +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -821,7 +821,7 @@ static void extract_entropy(void *buf, s + + static void credit_init_bits(size_t nbits) + { +- unsigned int init_bits, orig, add; ++ unsigned int new, orig, add; + unsigned long flags; + + if (crng_ready() || !nbits) +@@ -831,12 +831,12 @@ static void credit_init_bits(size_t nbit + + do { + orig = READ_ONCE(input_pool.init_bits); +- init_bits = min_t(unsigned int, POOL_BITS, orig + add); +- } while (cmpxchg(&input_pool.init_bits, orig, init_bits) != orig); ++ new = min_t(unsigned int, POOL_BITS, orig + add); ++ } while (cmpxchg(&input_pool.init_bits, orig, new) != orig); + +- if (!crng_ready() && init_bits >= POOL_READY_BITS) ++ if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) + crng_reseed(); +- else if (unlikely(crng_init == CRNG_EMPTY && init_bits >= POOL_EARLY_BITS)) { ++ else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) { + spin_lock_irqsave(&base_crng.lock, flags); + if (crng_init == CRNG_EMPTY) { + extract_entropy(base_crng.key, sizeof(base_crng.key)); diff --git a/queue-5.18/random-check-for-signals-after-page-of-pool-writes.patch b/queue-5.18/random-check-for-signals-after-page-of-pool-writes.patch new file mode 100644 index 00000000000..6f6bb01e1b9 --- /dev/null +++ b/queue-5.18/random-check-for-signals-after-page-of-pool-writes.patch @@ -0,0 +1,101 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sun, 22 May 2022 22:25:41 +0200 +Subject: random: check for signals after page of pool writes + +From: "Jason A. Donenfeld" + +commit 1ce6c8d68f8ac587f54d0a271ac594d3d51f3efb upstream. + +get_random_bytes_user() checks for signals after producing a PAGE_SIZE +worth of output, just like /dev/zero does. write_pool() is doing +basically the same work (actually, slightly more expensive), and so +should stop to check for signals in the same way. Let's also name it +write_pool_user() to match get_random_bytes_user(), so this won't be +misused in the future. + +Before this patch, massive writes to /dev/urandom would tie up the +process for an extremely long time and make it unterminatable. After, it +can be successfully interrupted. The following test program can be used +to see this works as intended: + + #include + #include + #include + #include + + static unsigned char x[~0U]; + + static void handle(int) { } + + int main(int argc, char *argv[]) + { + pid_t pid = getpid(), child; + int fd; + signal(SIGUSR1, handle); + if (!(child = fork())) { + for (;;) + kill(pid, SIGUSR1); + } + fd = open("/dev/urandom", O_WRONLY); + pause(); + printf("interrupted after writing %zd bytes\n", write(fd, x, sizeof(x))); + close(fd); + kill(child, SIGTERM); + return 0; + } + +Result before: "interrupted after writing 2147479552 bytes" +Result after: "interrupted after writing 4096 bytes" + +Cc: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1291,7 +1291,7 @@ static __poll_t random_poll(struct file + return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; + } + +-static ssize_t write_pool(struct iov_iter *iter) ++static ssize_t write_pool_user(struct iov_iter *iter) + { + u8 block[BLAKE2S_BLOCK_SIZE]; + ssize_t ret = 0; +@@ -1306,7 +1306,13 @@ static ssize_t write_pool(struct iov_ite + mix_pool_bytes(block, copied); + if (!iov_iter_count(iter) || copied != sizeof(block)) + break; +- cond_resched(); ++ ++ BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0); ++ if (ret % PAGE_SIZE == 0) { ++ if (signal_pending(current)) ++ break; ++ cond_resched(); ++ } + } + + memzero_explicit(block, sizeof(block)); +@@ -1315,7 +1321,7 @@ static ssize_t write_pool(struct iov_ite + + static ssize_t random_write_iter(struct kiocb *kiocb, struct iov_iter *iter) + { +- return write_pool(iter); ++ return write_pool_user(iter); + } + + static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter) +@@ -1389,7 +1395,7 @@ static long random_ioctl(struct file *f, + ret = import_single_range(WRITE, p, len, &iov, &iter); + if (unlikely(ret)) + return ret; +- ret = write_pool(&iter); ++ ret = write_pool_user(&iter); + if (unlikely(ret < 0)) + return ret; + /* Since we're crediting, enforce that it was all written into the pool. */ diff --git a/queue-5.18/random-convert-to-using-fops-read_iter.patch b/queue-5.18/random-convert-to-using-fops-read_iter.patch new file mode 100644 index 00000000000..184fa3548b2 --- /dev/null +++ b/queue-5.18/random-convert-to-using-fops-read_iter.patch @@ -0,0 +1,183 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: Jens Axboe +Date: Thu, 19 May 2022 17:31:36 -0600 +Subject: random: convert to using fops->read_iter() + +From: Jens Axboe + +commit 1b388e7765f2eaa137cf5d92b47ef5925ad83ced upstream. + +This is a pre-requisite to wiring up splice() again for the random +and urandom drivers. It also allows us to remove the INT_MAX check in +getrandom(), because import_single_range() applies capping internally. + +Signed-off-by: Jens Axboe +[Jason: rewrote get_random_bytes_user() to simplify and also incorporate + additional suggestions from Al.] +Cc: Al Viro +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 65 ++++++++++++++++++++++---------------------------- + 1 file changed, 29 insertions(+), 36 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -446,13 +446,13 @@ void get_random_bytes(void *buf, size_t + } + EXPORT_SYMBOL(get_random_bytes); + +-static ssize_t get_random_bytes_user(void __user *ubuf, size_t len) ++static ssize_t get_random_bytes_user(struct iov_iter *iter) + { +- size_t block_len, left, ret = 0; + u32 chacha_state[CHACHA_STATE_WORDS]; +- u8 output[CHACHA_BLOCK_SIZE]; ++ u8 block[CHACHA_BLOCK_SIZE]; ++ size_t ret = 0, copied; + +- if (!len) ++ if (unlikely(!iov_iter_count(iter))) + return 0; + + /* +@@ -466,30 +466,22 @@ static ssize_t get_random_bytes_user(voi + * use chacha_state after, so we can simply return those bytes to + * the user directly. + */ +- if (len <= CHACHA_KEY_SIZE) { +- ret = len - copy_to_user(ubuf, &chacha_state[4], len); ++ if (iov_iter_count(iter) <= CHACHA_KEY_SIZE) { ++ ret = copy_to_iter(&chacha_state[4], CHACHA_KEY_SIZE, iter); + goto out_zero_chacha; + } + + for (;;) { +- chacha20_block(chacha_state, output); ++ chacha20_block(chacha_state, block); + if (unlikely(chacha_state[12] == 0)) + ++chacha_state[13]; + +- block_len = min_t(size_t, len, CHACHA_BLOCK_SIZE); +- left = copy_to_user(ubuf, output, block_len); +- if (left) { +- ret += block_len - left; ++ copied = copy_to_iter(block, sizeof(block), iter); ++ ret += copied; ++ if (!iov_iter_count(iter) || copied != sizeof(block)) + break; +- } + +- ubuf += block_len; +- ret += block_len; +- len -= block_len; +- if (!len) +- break; +- +- BUILD_BUG_ON(PAGE_SIZE % CHACHA_BLOCK_SIZE != 0); ++ BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0); + if (ret % PAGE_SIZE == 0) { + if (signal_pending(current)) + break; +@@ -497,7 +489,7 @@ static ssize_t get_random_bytes_user(voi + } + } + +- memzero_explicit(output, sizeof(output)); ++ memzero_explicit(block, sizeof(block)); + out_zero_chacha: + memzero_explicit(chacha_state, sizeof(chacha_state)); + return ret ? ret : -EFAULT; +@@ -1265,6 +1257,10 @@ static void __cold try_to_generate_entro + + SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags) + { ++ struct iov_iter iter; ++ struct iovec iov; ++ int ret; ++ + if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE)) + return -EINVAL; + +@@ -1275,19 +1271,18 @@ SYSCALL_DEFINE3(getrandom, char __user * + if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM)) + return -EINVAL; + +- if (len > INT_MAX) +- len = INT_MAX; +- + if (!crng_ready() && !(flags & GRND_INSECURE)) { +- int ret; +- + if (flags & GRND_NONBLOCK) + return -EAGAIN; + ret = wait_for_random_bytes(); + if (unlikely(ret)) + return ret; + } +- return get_random_bytes_user(ubuf, len); ++ ++ ret = import_single_range(READ, ubuf, len, &iov, &iter); ++ if (unlikely(ret)) ++ return ret; ++ return get_random_bytes_user(&iter); + } + + static __poll_t random_poll(struct file *file, poll_table *wait) +@@ -1331,8 +1326,7 @@ static ssize_t random_write(struct file + return (ssize_t)len; + } + +-static ssize_t urandom_read(struct file *file, char __user *ubuf, +- size_t len, loff_t *ppos) ++static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter) + { + static int maxwarn = 10; + +@@ -1348,23 +1342,22 @@ static ssize_t urandom_read(struct file + ++urandom_warning.missed; + else if (ratelimit_disable || __ratelimit(&urandom_warning)) { + --maxwarn; +- pr_notice("%s: uninitialized urandom read (%zd bytes read)\n", +- current->comm, len); ++ pr_notice("%s: uninitialized urandom read (%zu bytes read)\n", ++ current->comm, iov_iter_count(iter)); + } + } + +- return get_random_bytes_user(ubuf, len); ++ return get_random_bytes_user(iter); + } + +-static ssize_t random_read(struct file *file, char __user *ubuf, +- size_t len, loff_t *ppos) ++static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter) + { + int ret; + + ret = wait_for_random_bytes(); + if (ret != 0) + return ret; +- return get_random_bytes_user(ubuf, len); ++ return get_random_bytes_user(iter); + } + + static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) +@@ -1426,7 +1419,7 @@ static int random_fasync(int fd, struct + } + + const struct file_operations random_fops = { +- .read = random_read, ++ .read_iter = random_read_iter, + .write = random_write, + .poll = random_poll, + .unlocked_ioctl = random_ioctl, +@@ -1436,7 +1429,7 @@ const struct file_operations random_fops + }; + + const struct file_operations urandom_fops = { +- .read = urandom_read, ++ .read_iter = urandom_read_iter, + .write = random_write, + .unlocked_ioctl = random_ioctl, + .compat_ioctl = compat_ptr_ioctl, diff --git a/queue-5.18/random-convert-to-using-fops-write_iter.patch b/queue-5.18/random-convert-to-using-fops-write_iter.patch new file mode 100644 index 00000000000..2d1bc77a8f2 --- /dev/null +++ b/queue-5.18/random-convert-to-using-fops-write_iter.patch @@ -0,0 +1,148 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: Jens Axboe +Date: Thu, 19 May 2022 17:43:15 -0600 +Subject: random: convert to using fops->write_iter() + +From: Jens Axboe + +commit 22b0a222af4df8ee9bb8e07013ab44da9511b047 upstream. + +Now that the read side has been converted to fix a regression with +splice, convert the write side as well to have some symmetry in the +interface used (and help deprecate ->write()). + +Signed-off-by: Jens Axboe +[Jason: cleaned up random_ioctl a bit, require full writes in + RNDADDENTROPY since it's crediting entropy, simplify control flow of + write_pool(), and incorporate suggestions from Al.] +Cc: Al Viro +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 67 ++++++++++++++++++++++++++------------------------ + 1 file changed, 35 insertions(+), 32 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1291,39 +1291,31 @@ static __poll_t random_poll(struct file + return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; + } + +-static int write_pool(const char __user *ubuf, size_t len) ++static ssize_t write_pool(struct iov_iter *iter) + { +- size_t block_len; +- int ret = 0; + u8 block[BLAKE2S_BLOCK_SIZE]; ++ ssize_t ret = 0; ++ size_t copied; + +- while (len) { +- block_len = min(len, sizeof(block)); +- if (copy_from_user(block, ubuf, block_len)) { +- ret = -EFAULT; +- goto out; +- } +- len -= block_len; +- ubuf += block_len; +- mix_pool_bytes(block, block_len); ++ if (unlikely(!iov_iter_count(iter))) ++ return 0; ++ ++ for (;;) { ++ copied = copy_from_iter(block, sizeof(block), iter); ++ ret += copied; ++ mix_pool_bytes(block, copied); ++ if (!iov_iter_count(iter) || copied != sizeof(block)) ++ break; + cond_resched(); + } + +-out: + memzero_explicit(block, sizeof(block)); +- return ret; ++ return ret ? ret : -EFAULT; + } + +-static ssize_t random_write(struct file *file, const char __user *ubuf, +- size_t len, loff_t *ppos) ++static ssize_t random_write_iter(struct kiocb *kiocb, struct iov_iter *iter) + { +- int ret; +- +- ret = write_pool(ubuf, len); +- if (ret) +- return ret; +- +- return (ssize_t)len; ++ return write_pool(iter); + } + + static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter) +@@ -1362,9 +1354,8 @@ static ssize_t random_read_iter(struct k + + static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) + { +- int size, ent_count; + int __user *p = (int __user *)arg; +- int retval; ++ int ent_count; + + switch (cmd) { + case RNDGETENTCNT: +@@ -1381,20 +1372,32 @@ static long random_ioctl(struct file *f, + return -EINVAL; + credit_init_bits(ent_count); + return 0; +- case RNDADDENTROPY: ++ case RNDADDENTROPY: { ++ struct iov_iter iter; ++ struct iovec iov; ++ ssize_t ret; ++ int len; ++ + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + if (get_user(ent_count, p++)) + return -EFAULT; + if (ent_count < 0) + return -EINVAL; +- if (get_user(size, p++)) ++ if (get_user(len, p++)) ++ return -EFAULT; ++ ret = import_single_range(WRITE, p, len, &iov, &iter); ++ if (unlikely(ret)) ++ return ret; ++ ret = write_pool(&iter); ++ if (unlikely(ret < 0)) ++ return ret; ++ /* Since we're crediting, enforce that it was all written into the pool. */ ++ if (unlikely(ret != len)) + return -EFAULT; +- retval = write_pool((const char __user *)p, size); +- if (retval < 0) +- return retval; + credit_init_bits(ent_count); + return 0; ++ } + case RNDZAPENTCNT: + case RNDCLEARPOOL: + /* No longer has any effect. */ +@@ -1420,7 +1423,7 @@ static int random_fasync(int fd, struct + + const struct file_operations random_fops = { + .read_iter = random_read_iter, +- .write = random_write, ++ .write_iter = random_write_iter, + .poll = random_poll, + .unlocked_ioctl = random_ioctl, + .compat_ioctl = compat_ptr_ioctl, +@@ -1430,7 +1433,7 @@ const struct file_operations random_fops + + const struct file_operations urandom_fops = { + .read_iter = urandom_read_iter, +- .write = random_write, ++ .write_iter = random_write_iter, + .unlocked_ioctl = random_ioctl, + .compat_ioctl = compat_ptr_ioctl, + .fasync = random_fasync, diff --git a/queue-5.18/random-credit-architectural-init-the-exact-amount.patch b/queue-5.18/random-credit-architectural-init-the-exact-amount.patch new file mode 100644 index 00000000000..ff0282cb3fe --- /dev/null +++ b/queue-5.18/random-credit-architectural-init-the-exact-amount.patch @@ -0,0 +1,61 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Thu, 12 May 2022 15:32:26 +0200 +Subject: random: credit architectural init the exact amount + +From: "Jason A. Donenfeld" + +commit 12e45a2a6308105469968951e6d563e8f4fea187 upstream. + +RDRAND and RDSEED can fail sometimes, which is fine. We currently +initialize the RNG with 512 bits of RDRAND/RDSEED. We only need 256 bits +of those to succeed in order to initialize the RNG. Instead of the +current "all or nothing" approach, actually credit these contributions +the amount that is actually contributed. + +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -899,9 +899,8 @@ early_param("random.trust_bootloader", p + */ + int __init random_init(const char *command_line) + { +- size_t i; + ktime_t now = ktime_get_real(); +- bool arch_init = true; ++ unsigned int i, arch_bytes; + unsigned long rv; + + #if defined(LATENT_ENTROPY_PLUGIN) +@@ -909,11 +908,12 @@ int __init random_init(const char *comma + _mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed)); + #endif + +- for (i = 0; i < BLAKE2S_BLOCK_SIZE; i += sizeof(rv)) { ++ for (i = 0, arch_bytes = BLAKE2S_BLOCK_SIZE; ++ i < BLAKE2S_BLOCK_SIZE; i += sizeof(rv)) { + if (!arch_get_random_seed_long_early(&rv) && + !arch_get_random_long_early(&rv)) { + rv = random_get_entropy(); +- arch_init = false; ++ arch_bytes -= sizeof(rv); + } + _mix_pool_bytes(&rv, sizeof(rv)); + } +@@ -924,8 +924,8 @@ int __init random_init(const char *comma + + if (crng_ready()) + crng_reseed(); +- else if (arch_init && trust_cpu) +- credit_init_bits(BLAKE2S_BLOCK_SIZE * 8); ++ else if (trust_cpu) ++ credit_init_bits(arch_bytes * 8); + + return 0; + } diff --git a/queue-5.18/random-do-not-pretend-to-handle-premature-next-security-model.patch b/queue-5.18/random-do-not-pretend-to-handle-premature-next-security-model.patch new file mode 100644 index 00000000000..5440758919e --- /dev/null +++ b/queue-5.18/random-do-not-pretend-to-handle-premature-next-security-model.patch @@ -0,0 +1,479 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 30 Apr 2022 22:03:29 +0200 +Subject: random: do not pretend to handle premature next security model + +From: "Jason A. Donenfeld" + +commit e85c0fc1d94c52483a603651748d4c76d6aa1c6b upstream. + +Per the thread linked below, "premature next" is not considered to be a +realistic threat model, and leads to more serious security problems. + +"Premature next" is the scenario in which: + +- Attacker compromises the current state of a fully initialized RNG via + some kind of infoleak. +- New bits of entropy are added directly to the key used to generate the + /dev/urandom stream, without any buffering or pooling. +- Attacker then, somehow having read access to /dev/urandom, samples RNG + output and brute forces the individual new bits that were added. +- Result: the RNG never "recovers" from the initial compromise, a + so-called violation of what academics term "post-compromise security". + +The usual solutions to this involve some form of delaying when entropy +gets mixed into the crng. With Fortuna, this involves multiple input +buckets. With what the Linux RNG was trying to do prior, this involves +entropy estimation. + +However, by delaying when entropy gets mixed in, it also means that RNG +compromises are extremely dangerous during the window of time before +the RNG has gathered enough entropy, during which time nonces may become +predictable (or repeated), ephemeral keys may not be secret, and so +forth. Moreover, it's unclear how realistic "premature next" is from an +attack perspective, if these attacks even make sense in practice. + +Put together -- and discussed in more detail in the thread below -- +these constitute grounds for just doing away with the current code that +pretends to handle premature next. I say "pretends" because it wasn't +doing an especially great job at it either; should we change our mind +about this direction, we would probably implement Fortuna to "fix" the +"problem", in which case, removing the pretend solution still makes +sense. + +This also reduces the crng reseed period from 5 minutes down to 1 +minute. The rationale from the thread might lead us toward reducing that +even further in the future (or even eliminating it), but that remains a +topic of a future commit. + +At a high level, this patch changes semantics from: + + Before: Seed for the first time after 256 "bits" of estimated + entropy have been accumulated since the system booted. Thereafter, + reseed once every five minutes, but only if 256 new "bits" have been + accumulated since the last reseeding. + + After: Seed for the first time after 256 "bits" of estimated entropy + have been accumulated since the system booted. Thereafter, reseed + once every minute. + +Most of this patch is renaming and removing: POOL_MIN_BITS becomes +POOL_INIT_BITS, credit_entropy_bits() becomes credit_init_bits(), +crng_reseed() loses its "force" parameter since it's now always true, +the drain_entropy() function no longer has any use so it's removed, +entropy estimation is skipped if we've already init'd, the various +notifiers for "low on entropy" are now only active prior to init, and +finally, some documentation comments are cleaned up here and there. + +Link: https://lore.kernel.org/lkml/YmlMGx6+uigkGiZ0@zx2c4.com/ +Cc: Theodore Ts'o +Cc: Nadia Heninger +Cc: Tom Ristenpart +Reviewed-by: Eric Biggers +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 186 ++++++++++++++++++-------------------------------- + 1 file changed, 68 insertions(+), 118 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -15,14 +15,12 @@ + * - Sysctl interface. + * + * The high level overview is that there is one input pool, into which +- * various pieces of data are hashed. Some of that data is then "credited" as +- * having a certain number of bits of entropy. When enough bits of entropy are +- * available, the hash is finalized and handed as a key to a stream cipher that +- * expands it indefinitely for various consumers. This key is periodically +- * refreshed as the various entropy collectors, described below, add data to the +- * input pool and credit it. There is currently no Fortuna-like scheduler +- * involved, which can lead to malicious entropy sources causing a premature +- * reseed, and the entropy estimates are, at best, conservative guesses. ++ * various pieces of data are hashed. Prior to initialization, some of that ++ * data is then "credited" as having a certain number of bits of entropy. ++ * When enough bits of entropy are available, the hash is finalized and ++ * handed as a key to a stream cipher that expands it indefinitely for ++ * various consumers. This key is periodically refreshed as the various ++ * entropy collectors, described below, add data to the input pool. + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +@@ -231,7 +229,10 @@ static void _warn_unseeded_randomness(co + * + *********************************************************************/ + +-enum { CRNG_RESEED_INTERVAL = 300 * HZ }; ++enum { ++ CRNG_RESEED_START_INTERVAL = HZ, ++ CRNG_RESEED_INTERVAL = 60 * HZ ++}; + + static struct { + u8 key[CHACHA_KEY_SIZE] __aligned(__alignof__(long)); +@@ -253,26 +254,18 @@ static DEFINE_PER_CPU(struct crng, crngs + .lock = INIT_LOCAL_LOCK(crngs.lock), + }; + +-/* Used by crng_reseed() to extract a new seed from the input pool. */ +-static bool drain_entropy(void *buf, size_t nbytes, bool force); +-/* Used by crng_make_state() to extract a new seed when crng_init==0. */ ++/* Used by crng_reseed() and crng_make_state() to extract a new seed from the input pool. */ + static void extract_entropy(void *buf, size_t nbytes); + +-/* +- * This extracts a new crng key from the input pool, but only if there is a +- * sufficient amount of entropy available or force is true, in order to +- * mitigate bruteforcing of newly added bits. +- */ +-static void crng_reseed(bool force) ++/* This extracts a new crng key from the input pool. */ ++static void crng_reseed(void) + { + unsigned long flags; + unsigned long next_gen; + u8 key[CHACHA_KEY_SIZE]; + bool finalize_init = false; + +- /* Only reseed if we can, to prevent brute forcing a small amount of new bits. */ +- if (!drain_entropy(key, sizeof(key), force)) +- return; ++ extract_entropy(key, sizeof(key)); + + /* + * We copy the new key into the base_crng, overwriting the old one, +@@ -344,10 +337,10 @@ static void crng_fast_key_erasure(u8 key + } + + /* +- * Return whether the crng seed is considered to be sufficiently +- * old that a reseeding might be attempted. This happens if the last +- * reseeding was CRNG_RESEED_INTERVAL ago, or during early boot, at +- * an interval proportional to the uptime. ++ * Return whether the crng seed is considered to be sufficiently old ++ * that a reseeding is needed. This happens if the last reseeding ++ * was CRNG_RESEED_INTERVAL ago, or during early boot, at an interval ++ * proportional to the uptime. + */ + static bool crng_has_old_seed(void) + { +@@ -359,7 +352,7 @@ static bool crng_has_old_seed(void) + if (uptime >= CRNG_RESEED_INTERVAL / HZ * 2) + WRITE_ONCE(early_boot, false); + else +- interval = max_t(unsigned int, 5 * HZ, ++ interval = max_t(unsigned int, CRNG_RESEED_START_INTERVAL, + (unsigned int)uptime / 2 * HZ); + } + return time_after(jiffies, READ_ONCE(base_crng.birth) + interval); +@@ -401,11 +394,11 @@ static void crng_make_state(u32 chacha_s + } + + /* +- * If the base_crng is old enough, we try to reseed, which in turn +- * bumps the generation counter that we check below. ++ * If the base_crng is old enough, we reseed, which in turn bumps the ++ * generation counter that we check below. + */ + if (unlikely(crng_has_old_seed())) +- crng_reseed(false); ++ crng_reseed(); + + local_lock_irqsave(&crngs.lock, flags); + crng = raw_cpu_ptr(&crngs); +@@ -734,30 +727,24 @@ EXPORT_SYMBOL(get_random_bytes_arch); + * + * After which, if added entropy should be credited: + * +- * static void credit_entropy_bits(size_t nbits) ++ * static void credit_init_bits(size_t nbits) + * +- * Finally, extract entropy via these two, with the latter one +- * setting the entropy count to zero and extracting only if there +- * is POOL_MIN_BITS entropy credited prior or force is true: ++ * Finally, extract entropy via: + * + * static void extract_entropy(void *buf, size_t nbytes) +- * static bool drain_entropy(void *buf, size_t nbytes, bool force) + * + **********************************************************************/ + + enum { + POOL_BITS = BLAKE2S_HASH_SIZE * 8, +- POOL_MIN_BITS = POOL_BITS, /* No point in settling for less. */ +- POOL_FAST_INIT_BITS = POOL_MIN_BITS / 2 ++ POOL_INIT_BITS = POOL_BITS, /* No point in settling for less. */ ++ POOL_FAST_INIT_BITS = POOL_INIT_BITS / 2 + }; + +-/* For notifying userspace should write into /dev/random. */ +-static DECLARE_WAIT_QUEUE_HEAD(random_write_wait); +- + static struct { + struct blake2s_state hash; + spinlock_t lock; +- unsigned int entropy_count; ++ unsigned int init_bits; + } input_pool = { + .hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE), + BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4, +@@ -772,9 +759,9 @@ static void _mix_pool_bytes(const void * + } + + /* +- * This function adds bytes into the entropy "pool". It does not +- * update the entropy estimate. The caller should call +- * credit_entropy_bits if this is appropriate. ++ * This function adds bytes into the input pool. It does not ++ * update the initialization bit counter; the caller should call ++ * credit_init_bits if this is appropriate. + */ + static void mix_pool_bytes(const void *in, size_t nbytes) + { +@@ -831,43 +818,24 @@ static void extract_entropy(void *buf, s + memzero_explicit(&block, sizeof(block)); + } + +-/* +- * First we make sure we have POOL_MIN_BITS of entropy in the pool unless force +- * is true, and then we set the entropy count to zero (but don't actually touch +- * any data). Only then can we extract a new key with extract_entropy(). +- */ +-static bool drain_entropy(void *buf, size_t nbytes, bool force) +-{ +- unsigned int entropy_count; +- do { +- entropy_count = READ_ONCE(input_pool.entropy_count); +- if (!force && entropy_count < POOL_MIN_BITS) +- return false; +- } while (cmpxchg(&input_pool.entropy_count, entropy_count, 0) != entropy_count); +- extract_entropy(buf, nbytes); +- wake_up_interruptible(&random_write_wait); +- kill_fasync(&fasync, SIGIO, POLL_OUT); +- return true; +-} +- +-static void credit_entropy_bits(size_t nbits) ++static void credit_init_bits(size_t nbits) + { +- unsigned int entropy_count, orig, add; ++ unsigned int init_bits, orig, add; + unsigned long flags; + +- if (!nbits) ++ if (crng_ready() || !nbits) + return; + + add = min_t(size_t, nbits, POOL_BITS); + + do { +- orig = READ_ONCE(input_pool.entropy_count); +- entropy_count = min_t(unsigned int, POOL_BITS, orig + add); +- } while (cmpxchg(&input_pool.entropy_count, orig, entropy_count) != orig); +- +- if (!crng_ready() && entropy_count >= POOL_MIN_BITS) +- crng_reseed(false); +- else if (unlikely(crng_init == 0 && entropy_count >= POOL_FAST_INIT_BITS)) { ++ orig = READ_ONCE(input_pool.init_bits); ++ init_bits = min_t(unsigned int, POOL_BITS, orig + add); ++ } while (cmpxchg(&input_pool.init_bits, orig, init_bits) != orig); ++ ++ if (!crng_ready() && init_bits >= POOL_INIT_BITS) ++ crng_reseed(); ++ else if (unlikely(crng_init == 0 && init_bits >= POOL_FAST_INIT_BITS)) { + spin_lock_irqsave(&base_crng.lock, flags); + if (crng_init == 0) { + extract_entropy(base_crng.key, sizeof(base_crng.key)); +@@ -978,13 +946,10 @@ int __init rand_initialize(void) + _mix_pool_bytes(&now, sizeof(now)); + _mix_pool_bytes(utsname(), sizeof(*(utsname()))); + +- extract_entropy(base_crng.key, sizeof(base_crng.key)); +- ++base_crng.generation; +- +- if (arch_init && trust_cpu && !crng_ready()) { +- crng_init = 2; +- pr_notice("crng init done (trusting CPU's manufacturer)\n"); +- } ++ if (crng_ready()) ++ crng_reseed(); ++ else if (arch_init && trust_cpu) ++ credit_init_bits(BLAKE2S_BLOCK_SIZE * 8); + + if (ratelimit_disable) { + urandom_warning.interval = 0; +@@ -1038,6 +1003,9 @@ static void add_timer_randomness(struct + _mix_pool_bytes(&num, sizeof(num)); + spin_unlock_irqrestore(&input_pool.lock, flags); + ++ if (crng_ready()) ++ return; ++ + /* + * Calculate number of bits of randomness we probably added. + * We take into account the first, second and third-order deltas +@@ -1068,7 +1036,7 @@ static void add_timer_randomness(struct + * Round down by 1 bit on general principles, + * and limit entropy estimate to 12 bits. + */ +- credit_entropy_bits(min_t(unsigned int, fls(delta >> 1), 11)); ++ credit_init_bits(min_t(unsigned int, fls(delta >> 1), 11)); + } + + void add_input_randomness(unsigned int type, unsigned int code, +@@ -1121,18 +1089,15 @@ void rand_initialize_disk(struct gendisk + void add_hwgenerator_randomness(const void *buffer, size_t count, + size_t entropy) + { ++ mix_pool_bytes(buffer, count); ++ credit_init_bits(entropy); ++ + /* +- * Throttle writing if we're above the trickle threshold. +- * We'll be woken up again once below POOL_MIN_BITS, when +- * the calling thread is about to terminate, or once +- * CRNG_RESEED_INTERVAL has elapsed. ++ * Throttle writing to once every CRNG_RESEED_INTERVAL, unless ++ * we're not yet initialized. + */ +- wait_event_interruptible_timeout(random_write_wait, +- kthread_should_stop() || +- input_pool.entropy_count < POOL_MIN_BITS, +- CRNG_RESEED_INTERVAL); +- mix_pool_bytes(buffer, count); +- credit_entropy_bits(entropy); ++ if (!kthread_should_stop() && crng_ready()) ++ schedule_timeout_interruptible(CRNG_RESEED_INTERVAL); + } + EXPORT_SYMBOL_GPL(add_hwgenerator_randomness); + +@@ -1144,7 +1109,7 @@ void add_bootloader_randomness(const voi + { + mix_pool_bytes(buf, size); + if (trust_bootloader) +- credit_entropy_bits(size * 8); ++ credit_init_bits(size * 8); + } + EXPORT_SYMBOL_GPL(add_bootloader_randomness); + +@@ -1160,7 +1125,7 @@ void add_vmfork_randomness(const void *u + { + add_device_randomness(unique_vm_id, size); + if (crng_ready()) { +- crng_reseed(true); ++ crng_reseed(); + pr_notice("crng reseeded due to virtual machine fork\n"); + } + blocking_notifier_call_chain(&vmfork_chain, 0, NULL); +@@ -1279,7 +1244,7 @@ static void mix_interrupt_randomness(str + local_irq_enable(); + + mix_pool_bytes(pool, sizeof(pool)); +- credit_entropy_bits(1); ++ credit_init_bits(1); + + memzero_explicit(pool, sizeof(pool)); + } +@@ -1326,7 +1291,7 @@ EXPORT_SYMBOL_GPL(add_interrupt_randomne + */ + static void entropy_timer(struct timer_list *t) + { +- credit_entropy_bits(1); ++ credit_init_bits(1); + } + + /* +@@ -1419,16 +1384,8 @@ SYSCALL_DEFINE3(getrandom, char __user * + + static __poll_t random_poll(struct file *file, poll_table *wait) + { +- __poll_t mask; +- + poll_wait(file, &crng_init_wait, wait); +- poll_wait(file, &random_write_wait, wait); +- mask = 0; +- if (crng_ready()) +- mask |= EPOLLIN | EPOLLRDNORM; +- if (input_pool.entropy_count < POOL_MIN_BITS) +- mask |= EPOLLOUT | EPOLLWRNORM; +- return mask; ++ return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; + } + + static int write_pool(const char __user *ubuf, size_t count) +@@ -1508,7 +1465,7 @@ static long random_ioctl(struct file *f, + switch (cmd) { + case RNDGETENTCNT: + /* Inherently racy, no point locking. */ +- if (put_user(input_pool.entropy_count, p)) ++ if (put_user(input_pool.init_bits, p)) + return -EFAULT; + return 0; + case RNDADDTOENTCNT: +@@ -1518,7 +1475,7 @@ static long random_ioctl(struct file *f, + return -EFAULT; + if (ent_count < 0) + return -EINVAL; +- credit_entropy_bits(ent_count); ++ credit_init_bits(ent_count); + return 0; + case RNDADDENTROPY: + if (!capable(CAP_SYS_ADMIN)) +@@ -1532,27 +1489,20 @@ static long random_ioctl(struct file *f, + retval = write_pool((const char __user *)p, size); + if (retval < 0) + return retval; +- credit_entropy_bits(ent_count); ++ credit_init_bits(ent_count); + return 0; + case RNDZAPENTCNT: + case RNDCLEARPOOL: +- /* +- * Clear the entropy pool counters. We no longer clear +- * the entropy pool, as that's silly. +- */ ++ /* No longer has any effect. */ + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; +- if (xchg(&input_pool.entropy_count, 0) >= POOL_MIN_BITS) { +- wake_up_interruptible(&random_write_wait); +- kill_fasync(&fasync, SIGIO, POLL_OUT); +- } + return 0; + case RNDRESEEDCRNG: + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + if (!crng_ready()) + return -ENODATA; +- crng_reseed(false); ++ crng_reseed(); + return 0; + default: + return -EINVAL; +@@ -1604,7 +1554,7 @@ const struct file_operations urandom_fop + * + * - write_wakeup_threshold - the amount of entropy in the input pool + * below which write polls to /dev/random will unblock, requesting +- * more entropy, tied to the POOL_MIN_BITS constant. It is writable ++ * more entropy, tied to the POOL_INIT_BITS constant. It is writable + * to avoid breaking old userspaces, but writing to it does not + * change any behavior of the RNG. + * +@@ -1619,7 +1569,7 @@ const struct file_operations urandom_fop + #include + + static int sysctl_random_min_urandom_seed = CRNG_RESEED_INTERVAL / HZ; +-static int sysctl_random_write_wakeup_bits = POOL_MIN_BITS; ++static int sysctl_random_write_wakeup_bits = POOL_INIT_BITS; + static int sysctl_poolsize = POOL_BITS; + static u8 sysctl_bootid[UUID_SIZE]; + +@@ -1675,7 +1625,7 @@ static struct ctl_table random_table[] = + }, + { + .procname = "entropy_avail", +- .data = &input_pool.entropy_count, ++ .data = &input_pool.init_bits, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = proc_dointvec, diff --git a/queue-5.18/random-do-not-use-batches-when-crng_ready.patch b/queue-5.18/random-do-not-use-batches-when-crng_ready.patch new file mode 100644 index 00000000000..89151269688 --- /dev/null +++ b/queue-5.18/random-do-not-use-batches-when-crng_ready.patch @@ -0,0 +1,61 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Tue, 3 May 2022 14:14:32 +0200 +Subject: random: do not use batches when !crng_ready() + +From: "Jason A. Donenfeld" + +commit cbe89e5a375a51bbb952929b93fa973416fea74e upstream. + +It's too hard to keep the batches synchronized, and pointless anyway, +since in !crng_ready(), we're updating the base_crng key really often, +where batching only hurts. So instead, if the crng isn't ready, just +call into get_random_bytes(). At this stage nothing is performance +critical anyhow. + +Cc: Theodore Ts'o +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -465,10 +465,8 @@ static void crng_pre_init_inject(const v + + if (account) { + crng_init_cnt += min_t(size_t, len, CRNG_INIT_CNT_THRESH - crng_init_cnt); +- if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) { +- ++base_crng.generation; ++ if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) + crng_init = 1; +- } + } + + spin_unlock_irqrestore(&base_crng.lock, flags); +@@ -624,6 +622,11 @@ u64 get_random_u64(void) + + warn_unseeded_randomness(&previous); + ++ if (!crng_ready()) { ++ _get_random_bytes(&ret, sizeof(ret)); ++ return ret; ++ } ++ + local_lock_irqsave(&batched_entropy_u64.lock, flags); + batch = raw_cpu_ptr(&batched_entropy_u64); + +@@ -658,6 +661,11 @@ u32 get_random_u32(void) + + warn_unseeded_randomness(&previous); + ++ if (!crng_ready()) { ++ _get_random_bytes(&ret, sizeof(ret)); ++ return ret; ++ } ++ + local_lock_irqsave(&batched_entropy_u32.lock, flags); + batch = raw_cpu_ptr(&batched_entropy_u32); + diff --git a/queue-5.18/random-do-not-use-input-pool-from-hard-irqs.patch b/queue-5.18/random-do-not-use-input-pool-from-hard-irqs.patch new file mode 100644 index 00000000000..1602b470d5e --- /dev/null +++ b/queue-5.18/random-do-not-use-input-pool-from-hard-irqs.patch @@ -0,0 +1,147 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 6 May 2022 18:30:51 +0200 +Subject: random: do not use input pool from hard IRQs + +From: "Jason A. Donenfeld" + +commit e3e33fc2ea7fcefd0d761db9d6219f83b4248f5c upstream. + +Years ago, a separate fast pool was added for interrupts, so that the +cost associated with taking the input pool spinlocks and mixing into it +would be avoided in places where latency is critical. However, one +oversight was that add_input_randomness() and add_disk_randomness() +still sometimes are called directly from the interrupt handler, rather +than being deferred to a thread. This means that some unlucky interrupts +will be caught doing a blake2s_compress() call and potentially spinning +on input_pool.lock, which can also be taken by unprivileged users by +writing into /dev/urandom. + +In order to fix this, add_timer_randomness() now checks whether it is +being called from a hard IRQ and if so, just mixes into the per-cpu IRQ +fast pool using fast_mix(), which is much faster and can be done +lock-free. A nice consequence of this, as well, is that it means hard +IRQ context FPU support is likely no longer useful. + +The entropy estimation algorithm used by add_timer_randomness() is also +somewhat different than the one used for add_interrupt_randomness(). The +former looks at deltas of deltas of deltas, while the latter just waits +for 64 interrupts for one bit or for one second since the last bit. In +order to bridge these, and since add_interrupt_randomness() runs after +an add_timer_randomness() that's called from hard IRQ, we add to the +fast pool credit the related amount, and then subtract one to account +for add_interrupt_randomness()'s contribution. + +A downside of this, however, is that the num argument is potentially +attacker controlled, which puts a bit more pressure on the fast_mix() +sponge to do more than it's really intended to do. As a mitigating +factor, the first 96 bits of input aren't attacker controlled (a cycle +counter followed by zeros), which means it's essentially two rounds of +siphash rather than one, which is somewhat better. It's also not that +much different from add_interrupt_randomness()'s use of the irq stack +instruction pointer register. + +Cc: Thomas Gleixner +Cc: Filipe Manana +Cc: Peter Zijlstra +Cc: Borislav Petkov +Cc: Theodore Ts'o +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 51 +++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 36 insertions(+), 15 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1123,6 +1123,7 @@ static void mix_interrupt_randomness(str + * we don't wind up "losing" some. + */ + unsigned long pool[2]; ++ unsigned int count; + + /* Check to see if we're running on the wrong CPU due to hotplug. */ + local_irq_disable(); +@@ -1136,12 +1137,13 @@ static void mix_interrupt_randomness(str + * consistent view, before we reenable irqs again. + */ + memcpy(pool, fast_pool->pool, sizeof(pool)); ++ count = fast_pool->count; + fast_pool->count = 0; + fast_pool->last = jiffies; + local_irq_enable(); + + mix_pool_bytes(pool, sizeof(pool)); +- credit_init_bits(1); ++ credit_init_bits(max(1u, (count & U16_MAX) / 64)); + + memzero_explicit(pool, sizeof(pool)); + } +@@ -1181,22 +1183,30 @@ struct timer_rand_state { + + /* + * This function adds entropy to the entropy "pool" by using timing +- * delays. It uses the timer_rand_state structure to make an estimate +- * of how many bits of entropy this call has added to the pool. +- * +- * The number "num" is also added to the pool - it should somehow describe +- * the type of event which just happened. This is currently 0-255 for +- * keyboard scan codes, and 256 upwards for interrupts. ++ * delays. It uses the timer_rand_state structure to make an estimate ++ * of how many bits of entropy this call has added to the pool. The ++ * value "num" is also added to the pool; it should somehow describe ++ * the type of event that just happened. + */ + static void add_timer_randomness(struct timer_rand_state *state, unsigned int num) + { + unsigned long entropy = random_get_entropy(), now = jiffies, flags; + long delta, delta2, delta3; ++ unsigned int bits; + +- spin_lock_irqsave(&input_pool.lock, flags); +- _mix_pool_bytes(&entropy, sizeof(entropy)); +- _mix_pool_bytes(&num, sizeof(num)); +- spin_unlock_irqrestore(&input_pool.lock, flags); ++ /* ++ * If we're in a hard IRQ, add_interrupt_randomness() will be called ++ * sometime after, so mix into the fast pool. ++ */ ++ if (in_hardirq()) { ++ fast_mix(this_cpu_ptr(&irq_randomness)->pool, ++ (unsigned long[2]){ entropy, num }); ++ } else { ++ spin_lock_irqsave(&input_pool.lock, flags); ++ _mix_pool_bytes(&entropy, sizeof(entropy)); ++ _mix_pool_bytes(&num, sizeof(num)); ++ spin_unlock_irqrestore(&input_pool.lock, flags); ++ } + + if (crng_ready()) + return; +@@ -1227,11 +1237,22 @@ static void add_timer_randomness(struct + delta = delta3; + + /* +- * delta is now minimum absolute delta. +- * Round down by 1 bit on general principles, +- * and limit entropy estimate to 12 bits. ++ * delta is now minimum absolute delta. Round down by 1 bit ++ * on general principles, and limit entropy estimate to 11 bits. ++ */ ++ bits = min(fls(delta >> 1), 11); ++ ++ /* ++ * As mentioned above, if we're in a hard IRQ, add_interrupt_randomness() ++ * will run after this, which uses a different crediting scheme of 1 bit ++ * per every 64 interrupts. In order to let that function do accounting ++ * close to the one in this function, we credit a full 64/64 bit per bit, ++ * and then subtract one to account for the extra one added. + */ +- credit_init_bits(min_t(unsigned int, fls(delta >> 1), 11)); ++ if (in_hardirq()) ++ this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1; ++ else ++ credit_init_bits(bits); + } + + void add_input_randomness(unsigned int type, unsigned int code, diff --git a/queue-5.18/random-fix-sysctl-documentation-nits.patch b/queue-5.18/random-fix-sysctl-documentation-nits.patch new file mode 100644 index 00000000000..68c23dad1eb --- /dev/null +++ b/queue-5.18/random-fix-sysctl-documentation-nits.patch @@ -0,0 +1,42 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Tue, 3 May 2022 21:43:58 +0200 +Subject: random: fix sysctl documentation nits + +From: "Jason A. Donenfeld" + +commit 069c4ea6871c18bd368f27756e0f91ffb524a788 upstream. + +A semicolon was missing, and the almost-alphabetical-but-not ordering +was confusing, so regroup these by category instead. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/sysctl/kernel.rst | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/Documentation/admin-guide/sysctl/kernel.rst ++++ b/Documentation/admin-guide/sysctl/kernel.rst +@@ -994,6 +994,9 @@ This is a directory, with the following + * ``boot_id``: a UUID generated the first time this is retrieved, and + unvarying after that; + ++* ``uuid``: a UUID generated every time this is retrieved (this can ++ thus be used to generate UUIDs at will); ++ + * ``entropy_avail``: the pool's entropy count, in bits; + + * ``poolsize``: the entropy pool size, in bits; +@@ -1001,10 +1004,7 @@ This is a directory, with the following + * ``urandom_min_reseed_secs``: obsolete (used to determine the minimum + number of seconds between urandom pool reseeding). This file is + writable for compatibility purposes, but writing to it has no effect +- on any RNG behavior. +- +-* ``uuid``: a UUID generated every time this is retrieved (this can +- thus be used to generate UUIDs at will); ++ on any RNG behavior; + + * ``write_wakeup_threshold``: when the entropy count drops below this + (as a number of bits), processes waiting to write to ``/dev/random`` diff --git a/queue-5.18/random-handle-latent-entropy-and-command-line-from-random_init.patch b/queue-5.18/random-handle-latent-entropy-and-command-line-from-random_init.patch new file mode 100644 index 00000000000..a54a2ff8028 --- /dev/null +++ b/queue-5.18/random-handle-latent-entropy-and-command-line-from-random_init.patch @@ -0,0 +1,132 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Thu, 5 May 2022 02:20:22 +0200 +Subject: random: handle latent entropy and command line from random_init() + +From: "Jason A. Donenfeld" + +commit 2f14062bb14b0fcfcc21e6dc7d5b5c0d25966164 upstream. + +Currently, start_kernel() adds latent entropy and the command line to +the entropy bool *after* the RNG has been initialized, deferring when +it's actually used by things like stack canaries until the next time +the pool is seeded. This surely is not intended. + +Rather than splitting up which entropy gets added where and when between +start_kernel() and random_init(), just do everything in random_init(), +which should eliminate these kinds of bugs in the future. + +While we're at it, rename the awkwardly titled "rand_initialize()" to +the more standard "random_init()" nomenclature. + +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 17 ++++++++++------- + include/linux/random.h | 15 +++++++-------- + init/main.c | 10 +++------- + 3 files changed, 20 insertions(+), 22 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -891,12 +891,13 @@ early_param("random.trust_bootloader", p + + /* + * The first collection of entropy occurs at system boot while interrupts +- * are still turned off. Here we push in RDSEED, a timestamp, and utsname(). +- * Depending on the above configuration knob, RDSEED may be considered +- * sufficient for initialization. Note that much earlier setup may already +- * have pushed entropy into the input pool by the time we get here. ++ * are still turned off. Here we push in latent entropy, RDSEED, a timestamp, ++ * utsname(), and the command line. Depending on the above configuration knob, ++ * RDSEED may be considered sufficient for initialization. Note that much ++ * earlier setup may already have pushed entropy into the input pool by the ++ * time we get here. + */ +-int __init rand_initialize(void) ++int __init random_init(const char *command_line) + { + size_t i; + ktime_t now = ktime_get_real(); +@@ -918,6 +919,8 @@ int __init rand_initialize(void) + } + _mix_pool_bytes(&now, sizeof(now)); + _mix_pool_bytes(utsname(), sizeof(*(utsname()))); ++ _mix_pool_bytes(command_line, strlen(command_line)); ++ add_latent_entropy(); + + if (crng_ready()) + crng_reseed(); +@@ -1637,8 +1640,8 @@ static struct ctl_table random_table[] = + }; + + /* +- * rand_initialize() is called before sysctl_init(), +- * so we cannot call register_sysctl_init() in rand_initialize() ++ * random_init() is called before sysctl_init(), ++ * so we cannot call register_sysctl_init() in random_init() + */ + static int __init random_sysctls_init(void) + { +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -14,22 +14,21 @@ struct notifier_block; + + extern void add_device_randomness(const void *, size_t); + extern void add_bootloader_randomness(const void *, size_t); ++extern void add_input_randomness(unsigned int type, unsigned int code, ++ unsigned int value) __latent_entropy; ++extern void add_interrupt_randomness(int irq) __latent_entropy; ++extern void add_hwgenerator_randomness(const void *buffer, size_t count, ++ size_t entropy); + + #if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) + static inline void add_latent_entropy(void) + { +- add_device_randomness((const void *)&latent_entropy, +- sizeof(latent_entropy)); ++ add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); + } + #else + static inline void add_latent_entropy(void) {} + #endif + +-extern void add_input_randomness(unsigned int type, unsigned int code, +- unsigned int value) __latent_entropy; +-extern void add_interrupt_randomness(int irq) __latent_entropy; +-extern void add_hwgenerator_randomness(const void *buffer, size_t count, +- size_t entropy); + #if IS_ENABLED(CONFIG_VMGENID) + extern void add_vmfork_randomness(const void *unique_vm_id, size_t size); + extern int register_random_vmfork_notifier(struct notifier_block *nb); +@@ -41,7 +40,7 @@ static inline int unregister_random_vmfo + + extern void get_random_bytes(void *buf, size_t nbytes); + extern int wait_for_random_bytes(void); +-extern int __init rand_initialize(void); ++extern int __init random_init(const char *command_line); + extern bool rng_is_initialized(void); + extern int register_random_ready_notifier(struct notifier_block *nb); + extern int unregister_random_ready_notifier(struct notifier_block *nb); +--- a/init/main.c ++++ b/init/main.c +@@ -1040,15 +1040,11 @@ asmlinkage __visible void __init __no_sa + /* + * For best initial stack canary entropy, prepare it after: + * - setup_arch() for any UEFI RNG entropy and boot cmdline access +- * - timekeeping_init() for ktime entropy used in rand_initialize() ++ * - timekeeping_init() for ktime entropy used in random_init() + * - time_init() for making random_get_entropy() work on some platforms +- * - rand_initialize() to get any arch-specific entropy like RDRAND +- * - add_latent_entropy() to get any latent entropy +- * - adding command line entropy ++ * - random_init() to initialize the RNG from from early entropy sources + */ +- rand_initialize(); +- add_latent_entropy(); +- add_device_randomness(command_line, strlen(command_line)); ++ random_init(command_line); + boot_init_stack_canary(); + + perf_event_init(); diff --git a/queue-5.18/random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch b/queue-5.18/random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch new file mode 100644 index 00000000000..81bfdefbe24 --- /dev/null +++ b/queue-5.18/random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch @@ -0,0 +1,94 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 6 May 2022 23:19:43 +0200 +Subject: random: help compiler out with fast_mix() by using simpler arguments + +From: "Jason A. Donenfeld" + +commit 791332b3cbb080510954a4c152ce02af8832eac9 upstream. + +Now that fast_mix() has more than one caller, gcc no longer inlines it. +That's fine. But it also doesn't handle the compound literal argument we +pass it very efficiently, nor does it handle the loop as well as it +could. So just expand the code to spell out this function so that it +generates the same code as it did before. Performance-wise, this now +behaves as it did before the last commit. The difference in actual code +size on x86 is 45 bytes, which is less than a cache line. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 44 +++++++++++++++++++++++--------------------- + 1 file changed, 23 insertions(+), 21 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1068,25 +1068,30 @@ static DEFINE_PER_CPU(struct fast_pool, + * and therefore this has no security on its own. s represents the + * four-word SipHash state, while v represents a two-word input. + */ +-static void fast_mix(unsigned long s[4], const unsigned long v[2]) ++static void fast_mix(unsigned long s[4], unsigned long v1, unsigned long v2) + { +- size_t i; +- +- for (i = 0; i < 2; ++i) { +- s[3] ^= v[i]; + #ifdef CONFIG_64BIT +- s[0] += s[1]; s[1] = rol64(s[1], 13); s[1] ^= s[0]; s[0] = rol64(s[0], 32); +- s[2] += s[3]; s[3] = rol64(s[3], 16); s[3] ^= s[2]; +- s[0] += s[3]; s[3] = rol64(s[3], 21); s[3] ^= s[0]; +- s[2] += s[1]; s[1] = rol64(s[1], 17); s[1] ^= s[2]; s[2] = rol64(s[2], 32); ++#define PERM() do { \ ++ s[0] += s[1]; s[1] = rol64(s[1], 13); s[1] ^= s[0]; s[0] = rol64(s[0], 32); \ ++ s[2] += s[3]; s[3] = rol64(s[3], 16); s[3] ^= s[2]; \ ++ s[0] += s[3]; s[3] = rol64(s[3], 21); s[3] ^= s[0]; \ ++ s[2] += s[1]; s[1] = rol64(s[1], 17); s[1] ^= s[2]; s[2] = rol64(s[2], 32); \ ++} while (0) + #else +- s[0] += s[1]; s[1] = rol32(s[1], 5); s[1] ^= s[0]; s[0] = rol32(s[0], 16); +- s[2] += s[3]; s[3] = rol32(s[3], 8); s[3] ^= s[2]; +- s[0] += s[3]; s[3] = rol32(s[3], 7); s[3] ^= s[0]; +- s[2] += s[1]; s[1] = rol32(s[1], 13); s[1] ^= s[2]; s[2] = rol32(s[2], 16); ++#define PERM() do { \ ++ s[0] += s[1]; s[1] = rol32(s[1], 5); s[1] ^= s[0]; s[0] = rol32(s[0], 16); \ ++ s[2] += s[3]; s[3] = rol32(s[3], 8); s[3] ^= s[2]; \ ++ s[0] += s[3]; s[3] = rol32(s[3], 7); s[3] ^= s[0]; \ ++ s[2] += s[1]; s[1] = rol32(s[1], 13); s[1] ^= s[2]; s[2] = rol32(s[2], 16); \ ++} while (0) + #endif +- s[0] ^= v[i]; +- } ++ ++ s[3] ^= v1; ++ PERM(); ++ s[0] ^= v1; ++ s[3] ^= v2; ++ PERM(); ++ s[0] ^= v2; + } + + #ifdef CONFIG_SMP +@@ -1156,10 +1161,8 @@ void add_interrupt_randomness(int irq) + struct pt_regs *regs = get_irq_regs(); + unsigned int new_count; + +- fast_mix(fast_pool->pool, (unsigned long[2]){ +- entropy, +- (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq) +- }); ++ fast_mix(fast_pool->pool, entropy, ++ (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq)); + new_count = ++fast_pool->count; + + if (new_count & MIX_INFLIGHT) +@@ -1199,8 +1202,7 @@ static void add_timer_randomness(struct + * sometime after, so mix into the fast pool. + */ + if (in_hardirq()) { +- fast_mix(this_cpu_ptr(&irq_randomness)->pool, +- (unsigned long[2]){ entropy, num }); ++ fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num); + } else { + spin_lock_irqsave(&input_pool.lock, flags); + _mix_pool_bytes(&entropy, sizeof(entropy)); diff --git a/queue-5.18/random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch b/queue-5.18/random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch new file mode 100644 index 00000000000..32121f615bf --- /dev/null +++ b/queue-5.18/random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch @@ -0,0 +1,222 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Tue, 12 Apr 2022 19:59:57 +0200 +Subject: random: insist on random_get_entropy() existing in order to simplify + +From: "Jason A. Donenfeld" + +commit 4b758eda851eb9336ca86a0041a4d3da55f66511 upstream. + +All platforms are now guaranteed to provide some value for +random_get_entropy(). In case some bug leads to this not being so, we +print a warning, because that indicates that something is really very +wrong (and likely other things are impacted too). This should never be +hit, but it's a good and cheap way of finding out if something ever is +problematic. + +Since we now have viable fallback code for random_get_entropy() on all +platforms, which is, in the worst case, not worse than jiffies, we can +count on getting the best possible value out of it. That means there's +no longer a use for using jiffies as entropy input. It also means we no +longer have a reason for doing the round-robin register flow in the IRQ +handler, which was always of fairly dubious value. + +Instead we can greatly simplify the IRQ handler inputs and also unify +the construction between 64-bits and 32-bits. We now collect the cycle +counter and the return address, since those are the two things that +matter. Because the return address and the irq number are likely +related, to the extent we mix in the irq number, we can just xor it into +the top unchanging bytes of the return address, rather than the bottom +changing bytes of the cycle counter as before. Then, we can do a fixed 2 +rounds of SipHash/HSipHash. Finally, we use the same construction of +hashing only half of the [H]SipHash state on 32-bit and 64-bit. We're +not actually discarding any entropy, since that entropy is carried +through until the next time. And more importantly, it lets us do the +same sponge-like construction everywhere. + +Cc: Theodore Ts'o +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 86 +++++++++++++++----------------------------------- + 1 file changed, 26 insertions(+), 60 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1025,15 +1025,14 @@ int __init rand_initialize(void) + */ + void add_device_randomness(const void *buf, size_t size) + { +- unsigned long cycles = random_get_entropy(); +- unsigned long flags, now = jiffies; ++ unsigned long entropy = random_get_entropy(); ++ unsigned long flags; + + if (crng_init == 0 && size) + crng_pre_init_inject(buf, size, false); + + spin_lock_irqsave(&input_pool.lock, flags); +- _mix_pool_bytes(&cycles, sizeof(cycles)); +- _mix_pool_bytes(&now, sizeof(now)); ++ _mix_pool_bytes(&entropy, sizeof(entropy)); + _mix_pool_bytes(buf, size); + spin_unlock_irqrestore(&input_pool.lock, flags); + } +@@ -1056,12 +1055,11 @@ struct timer_rand_state { + */ + static void add_timer_randomness(struct timer_rand_state *state, unsigned int num) + { +- unsigned long cycles = random_get_entropy(), now = jiffies, flags; ++ unsigned long entropy = random_get_entropy(), now = jiffies, flags; + long delta, delta2, delta3; + + spin_lock_irqsave(&input_pool.lock, flags); +- _mix_pool_bytes(&cycles, sizeof(cycles)); +- _mix_pool_bytes(&now, sizeof(now)); ++ _mix_pool_bytes(&entropy, sizeof(entropy)); + _mix_pool_bytes(&num, sizeof(num)); + spin_unlock_irqrestore(&input_pool.lock, flags); + +@@ -1223,7 +1221,6 @@ struct fast_pool { + unsigned long pool[4]; + unsigned long last; + unsigned int count; +- u16 reg_idx; + }; + + static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = { +@@ -1241,13 +1238,13 @@ static DEFINE_PER_CPU(struct fast_pool, + * This is [Half]SipHash-1-x, starting from an empty key. Because + * the key is fixed, it assumes that its inputs are non-malicious, + * and therefore this has no security on its own. s represents the +- * 128 or 256-bit SipHash state, while v represents a 128-bit input. ++ * four-word SipHash state, while v represents a two-word input. + */ +-static void fast_mix(unsigned long s[4], const unsigned long *v) ++static void fast_mix(unsigned long s[4], const unsigned long v[2]) + { + size_t i; + +- for (i = 0; i < 16 / sizeof(long); ++i) { ++ for (i = 0; i < 2; ++i) { + s[3] ^= v[i]; + #ifdef CONFIG_64BIT + s[0] += s[1]; s[1] = rol64(s[1], 13); s[1] ^= s[0]; s[0] = rol64(s[0], 32); +@@ -1287,33 +1284,17 @@ int random_online_cpu(unsigned int cpu) + } + #endif + +-static unsigned long get_reg(struct fast_pool *f, struct pt_regs *regs) +-{ +- unsigned long *ptr = (unsigned long *)regs; +- unsigned int idx; +- +- if (regs == NULL) +- return 0; +- idx = READ_ONCE(f->reg_idx); +- if (idx >= sizeof(struct pt_regs) / sizeof(unsigned long)) +- idx = 0; +- ptr += idx++; +- WRITE_ONCE(f->reg_idx, idx); +- return *ptr; +-} +- + static void mix_interrupt_randomness(struct work_struct *work) + { + struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix); + /* +- * The size of the copied stack pool is explicitly 16 bytes so that we +- * tax mix_pool_byte()'s compression function the same amount on all +- * platforms. This means on 64-bit we copy half the pool into this, +- * while on 32-bit we copy all of it. The entropy is supposed to be +- * sufficiently dispersed between bits that in the sponge-like +- * half case, on average we don't wind up "losing" some. ++ * The size of the copied stack pool is explicitly 2 longs so that we ++ * only ever ingest half of the siphash output each time, retaining ++ * the other half as the next "key" that carries over. The entropy is ++ * supposed to be sufficiently dispersed between bits so on average ++ * we don't wind up "losing" some. + */ +- u8 pool[16]; ++ unsigned long pool[2]; + + /* Check to see if we're running on the wrong CPU due to hotplug. */ + local_irq_disable(); +@@ -1345,36 +1326,21 @@ static void mix_interrupt_randomness(str + void add_interrupt_randomness(int irq) + { + enum { MIX_INFLIGHT = 1U << 31 }; +- unsigned long cycles = random_get_entropy(), now = jiffies; ++ unsigned long entropy = random_get_entropy(); + struct fast_pool *fast_pool = this_cpu_ptr(&irq_randomness); + struct pt_regs *regs = get_irq_regs(); + unsigned int new_count; +- union { +- u32 u32[4]; +- u64 u64[2]; +- unsigned long longs[16 / sizeof(long)]; +- } irq_data; +- +- if (cycles == 0) +- cycles = get_reg(fast_pool, regs); +- +- if (sizeof(unsigned long) == 8) { +- irq_data.u64[0] = cycles ^ rol64(now, 32) ^ irq; +- irq_data.u64[1] = regs ? instruction_pointer(regs) : _RET_IP_; +- } else { +- irq_data.u32[0] = cycles ^ irq; +- irq_data.u32[1] = now; +- irq_data.u32[2] = regs ? instruction_pointer(regs) : _RET_IP_; +- irq_data.u32[3] = get_reg(fast_pool, regs); +- } + +- fast_mix(fast_pool->pool, irq_data.longs); ++ fast_mix(fast_pool->pool, (unsigned long[2]){ ++ entropy, ++ (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq) ++ }); + new_count = ++fast_pool->count; + + if (new_count & MIX_INFLIGHT) + return; + +- if (new_count < 64 && (!time_after(now, fast_pool->last + HZ) || ++ if (new_count < 64 && (!time_is_before_jiffies(fast_pool->last + HZ) || + unlikely(crng_init == 0))) + return; + +@@ -1410,28 +1376,28 @@ static void entropy_timer(struct timer_l + static void try_to_generate_entropy(void) + { + struct { +- unsigned long cycles; ++ unsigned long entropy; + struct timer_list timer; + } stack; + +- stack.cycles = random_get_entropy(); ++ stack.entropy = random_get_entropy(); + + /* Slow counter - or none. Don't even bother */ +- if (stack.cycles == random_get_entropy()) ++ if (stack.entropy == random_get_entropy()) + return; + + timer_setup_on_stack(&stack.timer, entropy_timer, 0); + while (!crng_ready() && !signal_pending(current)) { + if (!timer_pending(&stack.timer)) + mod_timer(&stack.timer, jiffies + 1); +- mix_pool_bytes(&stack.cycles, sizeof(stack.cycles)); ++ mix_pool_bytes(&stack.entropy, sizeof(stack.entropy)); + schedule(); +- stack.cycles = random_get_entropy(); ++ stack.entropy = random_get_entropy(); + } + + del_timer_sync(&stack.timer); + destroy_timer_on_stack(&stack.timer); +- mix_pool_bytes(&stack.cycles, sizeof(stack.cycles)); ++ mix_pool_bytes(&stack.entropy, sizeof(stack.entropy)); + } + + diff --git a/queue-5.18/random-make-consistent-use-of-buf-and-len.patch b/queue-5.18/random-make-consistent-use-of-buf-and-len.patch new file mode 100644 index 00000000000..a4cc4d49e4c --- /dev/null +++ b/queue-5.18/random-make-consistent-use-of-buf-and-len.patch @@ -0,0 +1,566 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 13 May 2022 13:18:46 +0200 +Subject: random: make consistent use of buf and len + +From: "Jason A. Donenfeld" + +commit a19402634c435a4eae226df53c141cdbb9922e7b upstream. + +The current code was a mix of "nbytes", "count", "size", "buffer", "in", +and so forth. Instead, let's clean this up by naming input parameters +"buf" (or "ubuf") and "len", so that you always understand that you're +reading this variety of function argument. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 199 +++++++++++++++++++++++-------------------------- + include/linux/random.h | 12 +- + 2 files changed, 103 insertions(+), 108 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -208,7 +208,7 @@ static void _warn_unseeded_randomness(co + * + * There are a few exported interfaces for use by other drivers: + * +- * void get_random_bytes(void *buf, size_t nbytes) ++ * void get_random_bytes(void *buf, size_t len) + * u32 get_random_u32() + * u64 get_random_u64() + * unsigned int get_random_int() +@@ -249,7 +249,7 @@ static DEFINE_PER_CPU(struct crng, crngs + }; + + /* Used by crng_reseed() and crng_make_state() to extract a new seed from the input pool. */ +-static void extract_entropy(void *buf, size_t nbytes); ++static void extract_entropy(void *buf, size_t len); + + /* This extracts a new crng key from the input pool. */ + static void crng_reseed(void) +@@ -403,24 +403,24 @@ static void crng_make_state(u32 chacha_s + local_unlock_irqrestore(&crngs.lock, flags); + } + +-static void _get_random_bytes(void *buf, size_t nbytes) ++static void _get_random_bytes(void *buf, size_t len) + { + u32 chacha_state[CHACHA_STATE_WORDS]; + u8 tmp[CHACHA_BLOCK_SIZE]; +- size_t len; ++ size_t first_block_len; + +- if (!nbytes) ++ if (!len) + return; + +- len = min_t(size_t, 32, nbytes); +- crng_make_state(chacha_state, buf, len); +- nbytes -= len; +- buf += len; ++ first_block_len = min_t(size_t, 32, len); ++ crng_make_state(chacha_state, buf, first_block_len); ++ len -= first_block_len; ++ buf += first_block_len; + +- while (nbytes) { +- if (nbytes < CHACHA_BLOCK_SIZE) { ++ while (len) { ++ if (len < CHACHA_BLOCK_SIZE) { + chacha20_block(chacha_state, tmp); +- memcpy(buf, tmp, nbytes); ++ memcpy(buf, tmp, len); + memzero_explicit(tmp, sizeof(tmp)); + break; + } +@@ -428,7 +428,7 @@ static void _get_random_bytes(void *buf, + chacha20_block(chacha_state, buf); + if (unlikely(chacha_state[12] == 0)) + ++chacha_state[13]; +- nbytes -= CHACHA_BLOCK_SIZE; ++ len -= CHACHA_BLOCK_SIZE; + buf += CHACHA_BLOCK_SIZE; + } + +@@ -445,20 +445,20 @@ static void _get_random_bytes(void *buf, + * wait_for_random_bytes() should be called and return 0 at least once + * at any point prior. + */ +-void get_random_bytes(void *buf, size_t nbytes) ++void get_random_bytes(void *buf, size_t len) + { + warn_unseeded_randomness(); +- _get_random_bytes(buf, nbytes); ++ _get_random_bytes(buf, len); + } + EXPORT_SYMBOL(get_random_bytes); + +-static ssize_t get_random_bytes_user(void __user *buf, size_t nbytes) ++static ssize_t get_random_bytes_user(void __user *ubuf, size_t len) + { +- size_t len, left, ret = 0; ++ size_t block_len, left, ret = 0; + u32 chacha_state[CHACHA_STATE_WORDS]; + u8 output[CHACHA_BLOCK_SIZE]; + +- if (!nbytes) ++ if (!len) + return 0; + + /* +@@ -472,8 +472,8 @@ static ssize_t get_random_bytes_user(voi + * use chacha_state after, so we can simply return those bytes to + * the user directly. + */ +- if (nbytes <= CHACHA_KEY_SIZE) { +- ret = nbytes - copy_to_user(buf, &chacha_state[4], nbytes); ++ if (len <= CHACHA_KEY_SIZE) { ++ ret = len - copy_to_user(ubuf, &chacha_state[4], len); + goto out_zero_chacha; + } + +@@ -482,17 +482,17 @@ static ssize_t get_random_bytes_user(voi + if (unlikely(chacha_state[12] == 0)) + ++chacha_state[13]; + +- len = min_t(size_t, nbytes, CHACHA_BLOCK_SIZE); +- left = copy_to_user(buf, output, len); ++ block_len = min_t(size_t, len, CHACHA_BLOCK_SIZE); ++ left = copy_to_user(ubuf, output, block_len); + if (left) { +- ret += len - left; ++ ret += block_len - left; + break; + } + +- buf += len; +- ret += len; +- nbytes -= len; +- if (!nbytes) ++ ubuf += block_len; ++ ret += block_len; ++ len -= block_len; ++ if (!len) + break; + + BUILD_BUG_ON(PAGE_SIZE % CHACHA_BLOCK_SIZE != 0); +@@ -666,24 +666,24 @@ unsigned long randomize_page(unsigned lo + * use. Use get_random_bytes() instead. It returns the number of + * bytes filled in. + */ +-size_t __must_check get_random_bytes_arch(void *buf, size_t nbytes) ++size_t __must_check get_random_bytes_arch(void *buf, size_t len) + { +- size_t left = nbytes; ++ size_t left = len; + u8 *p = buf; + + while (left) { + unsigned long v; +- size_t chunk = min_t(size_t, left, sizeof(unsigned long)); ++ size_t block_len = min_t(size_t, left, sizeof(unsigned long)); + + if (!arch_get_random_long(&v)) + break; + +- memcpy(p, &v, chunk); +- p += chunk; +- left -= chunk; ++ memcpy(p, &v, block_len); ++ p += block_len; ++ left -= block_len; + } + +- return nbytes - left; ++ return len - left; + } + EXPORT_SYMBOL(get_random_bytes_arch); + +@@ -694,15 +694,15 @@ EXPORT_SYMBOL(get_random_bytes_arch); + * + * Callers may add entropy via: + * +- * static void mix_pool_bytes(const void *in, size_t nbytes) ++ * static void mix_pool_bytes(const void *buf, size_t len) + * + * After which, if added entropy should be credited: + * +- * static void credit_init_bits(size_t nbits) ++ * static void credit_init_bits(size_t bits) + * + * Finally, extract entropy via: + * +- * static void extract_entropy(void *buf, size_t nbytes) ++ * static void extract_entropy(void *buf, size_t len) + * + **********************************************************************/ + +@@ -724,9 +724,9 @@ static struct { + .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock), + }; + +-static void _mix_pool_bytes(const void *in, size_t nbytes) ++static void _mix_pool_bytes(const void *buf, size_t len) + { +- blake2s_update(&input_pool.hash, in, nbytes); ++ blake2s_update(&input_pool.hash, buf, len); + } + + /* +@@ -734,12 +734,12 @@ static void _mix_pool_bytes(const void * + * update the initialization bit counter; the caller should call + * credit_init_bits if this is appropriate. + */ +-static void mix_pool_bytes(const void *in, size_t nbytes) ++static void mix_pool_bytes(const void *buf, size_t len) + { + unsigned long flags; + + spin_lock_irqsave(&input_pool.lock, flags); +- _mix_pool_bytes(in, nbytes); ++ _mix_pool_bytes(buf, len); + spin_unlock_irqrestore(&input_pool.lock, flags); + } + +@@ -747,7 +747,7 @@ static void mix_pool_bytes(const void *i + * This is an HKDF-like construction for using the hashed collected entropy + * as a PRF key, that's then expanded block-by-block. + */ +-static void extract_entropy(void *buf, size_t nbytes) ++static void extract_entropy(void *buf, size_t len) + { + unsigned long flags; + u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE]; +@@ -776,12 +776,12 @@ static void extract_entropy(void *buf, s + spin_unlock_irqrestore(&input_pool.lock, flags); + memzero_explicit(next_key, sizeof(next_key)); + +- while (nbytes) { +- i = min_t(size_t, nbytes, BLAKE2S_HASH_SIZE); ++ while (len) { ++ i = min_t(size_t, len, BLAKE2S_HASH_SIZE); + /* output = HASHPRF(seed, RDSEED || ++counter) */ + ++block.counter; + blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed)); +- nbytes -= i; ++ len -= i; + buf += i; + } + +@@ -789,16 +789,16 @@ static void extract_entropy(void *buf, s + memzero_explicit(&block, sizeof(block)); + } + +-static void credit_init_bits(size_t nbits) ++static void credit_init_bits(size_t bits) + { + static struct execute_work set_ready; + unsigned int new, orig, add; + unsigned long flags; + +- if (crng_ready() || !nbits) ++ if (crng_ready() || !bits) + return; + +- add = min_t(size_t, nbits, POOL_BITS); ++ add = min_t(size_t, bits, POOL_BITS); + + do { + orig = READ_ONCE(input_pool.init_bits); +@@ -834,14 +834,12 @@ static void credit_init_bits(size_t nbit + * The following exported functions are used for pushing entropy into + * the above entropy accumulation routines: + * +- * void add_device_randomness(const void *buf, size_t size); +- * void add_hwgenerator_randomness(const void *buffer, size_t count, +- * size_t entropy); +- * void add_bootloader_randomness(const void *buf, size_t size); +- * void add_vmfork_randomness(const void *unique_vm_id, size_t size); ++ * void add_device_randomness(const void *buf, size_t len); ++ * void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy); ++ * void add_bootloader_randomness(const void *buf, size_t len); ++ * void add_vmfork_randomness(const void *unique_vm_id, size_t len); + * void add_interrupt_randomness(int irq); +- * void add_input_randomness(unsigned int type, unsigned int code, +- * unsigned int value); ++ * void add_input_randomness(unsigned int type, unsigned int code, unsigned int value); + * void add_disk_randomness(struct gendisk *disk); + * + * add_device_randomness() adds data to the input pool that +@@ -909,7 +907,7 @@ int __init random_init(const char *comma + { + ktime_t now = ktime_get_real(); + unsigned int i, arch_bytes; +- unsigned long rv; ++ unsigned long entropy; + + #if defined(LATENT_ENTROPY_PLUGIN) + static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy; +@@ -917,13 +915,13 @@ int __init random_init(const char *comma + #endif + + for (i = 0, arch_bytes = BLAKE2S_BLOCK_SIZE; +- i < BLAKE2S_BLOCK_SIZE; i += sizeof(rv)) { +- if (!arch_get_random_seed_long_early(&rv) && +- !arch_get_random_long_early(&rv)) { +- rv = random_get_entropy(); +- arch_bytes -= sizeof(rv); ++ i < BLAKE2S_BLOCK_SIZE; i += sizeof(entropy)) { ++ if (!arch_get_random_seed_long_early(&entropy) && ++ !arch_get_random_long_early(&entropy)) { ++ entropy = random_get_entropy(); ++ arch_bytes -= sizeof(entropy); + } +- _mix_pool_bytes(&rv, sizeof(rv)); ++ _mix_pool_bytes(&entropy, sizeof(entropy)); + } + _mix_pool_bytes(&now, sizeof(now)); + _mix_pool_bytes(utsname(), sizeof(*(utsname()))); +@@ -946,14 +944,14 @@ int __init random_init(const char *comma + * the entropy pool having similar initial state across largely + * identical devices. + */ +-void add_device_randomness(const void *buf, size_t size) ++void add_device_randomness(const void *buf, size_t len) + { + unsigned long entropy = random_get_entropy(); + unsigned long flags; + + spin_lock_irqsave(&input_pool.lock, flags); + _mix_pool_bytes(&entropy, sizeof(entropy)); +- _mix_pool_bytes(buf, size); ++ _mix_pool_bytes(buf, len); + spin_unlock_irqrestore(&input_pool.lock, flags); + } + EXPORT_SYMBOL(add_device_randomness); +@@ -963,10 +961,9 @@ EXPORT_SYMBOL(add_device_randomness); + * Those devices may produce endless random bits and will be throttled + * when our pool is full. + */ +-void add_hwgenerator_randomness(const void *buffer, size_t count, +- size_t entropy) ++void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy) + { +- mix_pool_bytes(buffer, count); ++ mix_pool_bytes(buf, len); + credit_init_bits(entropy); + + /* +@@ -982,11 +979,11 @@ EXPORT_SYMBOL_GPL(add_hwgenerator_random + * Handle random seed passed by bootloader, and credit it if + * CONFIG_RANDOM_TRUST_BOOTLOADER is set. + */ +-void add_bootloader_randomness(const void *buf, size_t size) ++void add_bootloader_randomness(const void *buf, size_t len) + { +- mix_pool_bytes(buf, size); ++ mix_pool_bytes(buf, len); + if (trust_bootloader) +- credit_init_bits(size * 8); ++ credit_init_bits(len * 8); + } + EXPORT_SYMBOL_GPL(add_bootloader_randomness); + +@@ -998,9 +995,9 @@ static BLOCKING_NOTIFIER_HEAD(vmfork_cha + * don't credit it, but we do immediately force a reseed after so + * that it's used by the crng posthaste. + */ +-void add_vmfork_randomness(const void *unique_vm_id, size_t size) ++void add_vmfork_randomness(const void *unique_vm_id, size_t len) + { +- add_device_randomness(unique_vm_id, size); ++ add_device_randomness(unique_vm_id, len); + if (crng_ready()) { + crng_reseed(); + pr_notice("crng reseeded due to virtual machine fork\n"); +@@ -1220,8 +1217,7 @@ static void add_timer_randomness(struct + credit_init_bits(bits); + } + +-void add_input_randomness(unsigned int type, unsigned int code, +- unsigned int value) ++void add_input_randomness(unsigned int type, unsigned int code, unsigned int value) + { + static unsigned char last_value; + static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES }; +@@ -1340,8 +1336,7 @@ static void try_to_generate_entropy(void + * + **********************************************************************/ + +-SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count, unsigned int, +- flags) ++SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags) + { + if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE)) + return -EINVAL; +@@ -1353,8 +1348,8 @@ SYSCALL_DEFINE3(getrandom, char __user * + if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM)) + return -EINVAL; + +- if (count > INT_MAX) +- count = INT_MAX; ++ if (len > INT_MAX) ++ len = INT_MAX; + + if (!crng_ready() && !(flags & GRND_INSECURE)) { + int ret; +@@ -1365,7 +1360,7 @@ SYSCALL_DEFINE3(getrandom, char __user * + if (unlikely(ret)) + return ret; + } +- return get_random_bytes_user(buf, count); ++ return get_random_bytes_user(ubuf, len); + } + + static __poll_t random_poll(struct file *file, poll_table *wait) +@@ -1374,21 +1369,21 @@ static __poll_t random_poll(struct file + return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; + } + +-static int write_pool(const char __user *ubuf, size_t count) ++static int write_pool(const char __user *ubuf, size_t len) + { +- size_t len; ++ size_t block_len; + int ret = 0; + u8 block[BLAKE2S_BLOCK_SIZE]; + +- while (count) { +- len = min(count, sizeof(block)); +- if (copy_from_user(block, ubuf, len)) { ++ while (len) { ++ block_len = min(len, sizeof(block)); ++ if (copy_from_user(block, ubuf, block_len)) { + ret = -EFAULT; + goto out; + } +- count -= len; +- ubuf += len; +- mix_pool_bytes(block, len); ++ len -= block_len; ++ ubuf += block_len; ++ mix_pool_bytes(block, block_len); + cond_resched(); + } + +@@ -1397,20 +1392,20 @@ out: + return ret; + } + +-static ssize_t random_write(struct file *file, const char __user *buffer, +- size_t count, loff_t *ppos) ++static ssize_t random_write(struct file *file, const char __user *ubuf, ++ size_t len, loff_t *ppos) + { + int ret; + +- ret = write_pool(buffer, count); ++ ret = write_pool(ubuf, len); + if (ret) + return ret; + +- return (ssize_t)count; ++ return (ssize_t)len; + } + +-static ssize_t urandom_read(struct file *file, char __user *buf, size_t nbytes, +- loff_t *ppos) ++static ssize_t urandom_read(struct file *file, char __user *ubuf, ++ size_t len, loff_t *ppos) + { + static int maxwarn = 10; + +@@ -1427,22 +1422,22 @@ static ssize_t urandom_read(struct file + else if (ratelimit_disable || __ratelimit(&urandom_warning)) { + --maxwarn; + pr_notice("%s: uninitialized urandom read (%zd bytes read)\n", +- current->comm, nbytes); ++ current->comm, len); + } + } + +- return get_random_bytes_user(buf, nbytes); ++ return get_random_bytes_user(ubuf, len); + } + +-static ssize_t random_read(struct file *file, char __user *buf, size_t nbytes, +- loff_t *ppos) ++static ssize_t random_read(struct file *file, char __user *ubuf, ++ size_t len, loff_t *ppos) + { + int ret; + + ret = wait_for_random_bytes(); + if (ret != 0) + return ret; +- return get_random_bytes_user(buf, nbytes); ++ return get_random_bytes_user(ubuf, len); + } + + static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) +@@ -1567,7 +1562,7 @@ static u8 sysctl_bootid[UUID_SIZE]; + * UUID. The difference is in whether table->data is NULL; if it is, + * then a new UUID is generated and returned to the user. + */ +-static int proc_do_uuid(struct ctl_table *table, int write, void *buffer, ++static int proc_do_uuid(struct ctl_table *table, int write, void *buf, + size_t *lenp, loff_t *ppos) + { + u8 tmp_uuid[UUID_SIZE], *uuid; +@@ -1594,14 +1589,14 @@ static int proc_do_uuid(struct ctl_table + } + + snprintf(uuid_string, sizeof(uuid_string), "%pU", uuid); +- return proc_dostring(&fake_table, 0, buffer, lenp, ppos); ++ return proc_dostring(&fake_table, 0, buf, lenp, ppos); + } + + /* The same as proc_dointvec, but writes don't change anything. */ +-static int proc_do_rointvec(struct ctl_table *table, int write, void *buffer, ++static int proc_do_rointvec(struct ctl_table *table, int write, void *buf, + size_t *lenp, loff_t *ppos) + { +- return write ? 0 : proc_dointvec(table, 0, buffer, lenp, ppos); ++ return write ? 0 : proc_dointvec(table, 0, buf, lenp, ppos); + } + + static struct ctl_table random_table[] = { +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -12,12 +12,12 @@ + + struct notifier_block; + +-void add_device_randomness(const void *, size_t); +-void add_bootloader_randomness(const void *, size_t); ++void add_device_randomness(const void *buf, size_t len); ++void add_bootloader_randomness(const void *buf, size_t len); + void add_input_randomness(unsigned int type, unsigned int code, + unsigned int value) __latent_entropy; + void add_interrupt_randomness(int irq) __latent_entropy; +-void add_hwgenerator_randomness(const void *buffer, size_t count, size_t entropy); ++void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy); + + #if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) + static inline void add_latent_entropy(void) +@@ -29,7 +29,7 @@ static inline void add_latent_entropy(vo + #endif + + #if IS_ENABLED(CONFIG_VMGENID) +-void add_vmfork_randomness(const void *unique_vm_id, size_t size); ++void add_vmfork_randomness(const void *unique_vm_id, size_t len); + int register_random_vmfork_notifier(struct notifier_block *nb); + int unregister_random_vmfork_notifier(struct notifier_block *nb); + #else +@@ -37,8 +37,8 @@ static inline int register_random_vmfork + static inline int unregister_random_vmfork_notifier(struct notifier_block *nb) { return 0; } + #endif + +-void get_random_bytes(void *buf, size_t nbytes); +-size_t __must_check get_random_bytes_arch(void *buf, size_t nbytes); ++void get_random_bytes(void *buf, size_t len); ++size_t __must_check get_random_bytes_arch(void *buf, size_t len); + u32 get_random_u32(void); + u64 get_random_u64(void); + static inline unsigned int get_random_int(void) diff --git a/queue-5.18/random-move-initialization-functions-out-of-hot-pages.patch b/queue-5.18/random-move-initialization-functions-out-of-hot-pages.patch new file mode 100644 index 00000000000..c32d475e4b7 --- /dev/null +++ b/queue-5.18/random-move-initialization-functions-out-of-hot-pages.patch @@ -0,0 +1,199 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 13 May 2022 16:17:12 +0200 +Subject: random: move initialization functions out of hot pages + +From: "Jason A. Donenfeld" + +commit 560181c27b582557d633ecb608110075433383af upstream. + +Much of random.c is devoted to initializing the rng and accounting for +when a sufficient amount of entropy has been added. In a perfect world, +this would all happen during init, and so we could mark these functions +as __init. But in reality, this isn't the case: sometimes the rng only +finishes initializing some seconds after system init is finished. + +For this reason, at the moment, a whole host of functions that are only +used relatively close to system init and then never again are intermixed +with functions that are used in hot code all the time. This creates more +cache misses than necessary. + +In order to pack the hot code closer together, this commit moves the +initialization functions that can't be marked as __init into +.text.unlikely by way of the __cold attribute. + +Of particular note is moving credit_init_bits() into a macro wrapper +that inlines the crng_ready() static branch check. This avoids a +function call to a nop+ret, and most notably prevents extra entropy +arithmetic from being computed in mix_interrupt_randomness(). + +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 46 +++++++++++++++++++++------------------------- + 1 file changed, 21 insertions(+), 25 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -109,7 +109,7 @@ bool rng_is_initialized(void) + } + EXPORT_SYMBOL(rng_is_initialized); + +-static void crng_set_ready(struct work_struct *work) ++static void __cold crng_set_ready(struct work_struct *work) + { + static_branch_enable(&crng_is_ready); + } +@@ -148,7 +148,7 @@ EXPORT_SYMBOL(wait_for_random_bytes); + * returns: 0 if callback is successfully added + * -EALREADY if pool is already initialised (callback not called) + */ +-int register_random_ready_notifier(struct notifier_block *nb) ++int __cold register_random_ready_notifier(struct notifier_block *nb) + { + unsigned long flags; + int ret = -EALREADY; +@@ -166,7 +166,7 @@ int register_random_ready_notifier(struc + /* + * Delete a previously registered readiness callback function. + */ +-int unregister_random_ready_notifier(struct notifier_block *nb) ++int __cold unregister_random_ready_notifier(struct notifier_block *nb) + { + unsigned long flags; + int ret; +@@ -177,7 +177,7 @@ int unregister_random_ready_notifier(str + return ret; + } + +-static void process_random_ready_list(void) ++static void __cold process_random_ready_list(void) + { + unsigned long flags; + +@@ -187,15 +187,9 @@ static void process_random_ready_list(vo + } + + #define warn_unseeded_randomness() \ +- _warn_unseeded_randomness(__func__, (void *)_RET_IP_) +- +-static void _warn_unseeded_randomness(const char *func_name, void *caller) +-{ +- if (!IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) || crng_ready()) +- return; +- printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", +- func_name, caller, crng_init); +-} ++ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \ ++ printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \ ++ __func__, (void *)_RET_IP_, crng_init) + + + /********************************************************************* +@@ -614,7 +608,7 @@ EXPORT_SYMBOL(get_random_u32); + * This function is called when the CPU is coming up, with entry + * CPUHP_RANDOM_PREPARE, which comes before CPUHP_WORKQUEUE_PREP. + */ +-int random_prepare_cpu(unsigned int cpu) ++int __cold random_prepare_cpu(unsigned int cpu) + { + /* + * When the cpu comes back online, immediately invalidate both +@@ -789,13 +783,15 @@ static void extract_entropy(void *buf, s + memzero_explicit(&block, sizeof(block)); + } + +-static void credit_init_bits(size_t bits) ++#define credit_init_bits(bits) if (!crng_ready()) _credit_init_bits(bits) ++ ++static void __cold _credit_init_bits(size_t bits) + { + static struct execute_work set_ready; + unsigned int new, orig, add; + unsigned long flags; + +- if (crng_ready() || !bits) ++ if (!bits) + return; + + add = min_t(size_t, bits, POOL_BITS); +@@ -979,7 +975,7 @@ EXPORT_SYMBOL_GPL(add_hwgenerator_random + * Handle random seed passed by bootloader, and credit it if + * CONFIG_RANDOM_TRUST_BOOTLOADER is set. + */ +-void add_bootloader_randomness(const void *buf, size_t len) ++void __cold add_bootloader_randomness(const void *buf, size_t len) + { + mix_pool_bytes(buf, len); + if (trust_bootloader) +@@ -995,7 +991,7 @@ static BLOCKING_NOTIFIER_HEAD(vmfork_cha + * don't credit it, but we do immediately force a reseed after so + * that it's used by the crng posthaste. + */ +-void add_vmfork_randomness(const void *unique_vm_id, size_t len) ++void __cold add_vmfork_randomness(const void *unique_vm_id, size_t len) + { + add_device_randomness(unique_vm_id, len); + if (crng_ready()) { +@@ -1008,13 +1004,13 @@ void add_vmfork_randomness(const void *u + EXPORT_SYMBOL_GPL(add_vmfork_randomness); + #endif + +-int register_random_vmfork_notifier(struct notifier_block *nb) ++int __cold register_random_vmfork_notifier(struct notifier_block *nb) + { + return blocking_notifier_chain_register(&vmfork_chain, nb); + } + EXPORT_SYMBOL_GPL(register_random_vmfork_notifier); + +-int unregister_random_vmfork_notifier(struct notifier_block *nb) ++int __cold unregister_random_vmfork_notifier(struct notifier_block *nb) + { + return blocking_notifier_chain_unregister(&vmfork_chain, nb); + } +@@ -1059,7 +1055,7 @@ static void fast_mix(unsigned long s[4], + * This function is called when the CPU has just come online, with + * entry CPUHP_AP_RANDOM_ONLINE, just after CPUHP_AP_WORKQUEUE_ONLINE. + */ +-int random_online_cpu(unsigned int cpu) ++int __cold random_online_cpu(unsigned int cpu) + { + /* + * During CPU shutdown and before CPU onlining, add_interrupt_ +@@ -1214,7 +1210,7 @@ static void add_timer_randomness(struct + if (in_hardirq()) + this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1; + else +- credit_init_bits(bits); ++ _credit_init_bits(bits); + } + + void add_input_randomness(unsigned int type, unsigned int code, unsigned int value) +@@ -1242,7 +1238,7 @@ void add_disk_randomness(struct gendisk + } + EXPORT_SYMBOL_GPL(add_disk_randomness); + +-void rand_initialize_disk(struct gendisk *disk) ++void __cold rand_initialize_disk(struct gendisk *disk) + { + struct timer_rand_state *state; + +@@ -1271,7 +1267,7 @@ void rand_initialize_disk(struct gendisk + * + * So the re-arming always happens in the entropy loop itself. + */ +-static void entropy_timer(struct timer_list *t) ++static void __cold entropy_timer(struct timer_list *t) + { + credit_init_bits(1); + } +@@ -1280,7 +1276,7 @@ static void entropy_timer(struct timer_l + * If we have an actual cycle counter, see if we can + * generate enough entropy with timing noise + */ +-static void try_to_generate_entropy(void) ++static void __cold try_to_generate_entropy(void) + { + struct { + unsigned long entropy; diff --git a/queue-5.18/random-move-initialization-out-of-reseeding-hot-path.patch b/queue-5.18/random-move-initialization-out-of-reseeding-hot-path.patch new file mode 100644 index 00000000000..7c423625b11 --- /dev/null +++ b/queue-5.18/random-move-initialization-out-of-reseeding-hot-path.patch @@ -0,0 +1,95 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Mon, 9 May 2022 13:53:24 +0200 +Subject: random: move initialization out of reseeding hot path + +From: "Jason A. Donenfeld" + +commit 68c9c8b192c6dae9be6278e98ee44029d5da2d31 upstream. + +Initialization happens once -- by way of credit_init_bits() -- and then +it never happens again. Therefore, it doesn't need to be in +crng_reseed(), which is a hot path that is called multiple times. It +also doesn't make sense to have there, as initialization activity is +better associated with initialization routines. + +After the prior commit, crng_reseed() now won't be called by multiple +concurrent callers, which means that we can safely move the +"finialize_init" logic into crng_init_bits() unconditionally. + +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 42 +++++++++++++++++++----------------------- + 1 file changed, 19 insertions(+), 23 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -264,7 +264,6 @@ static void crng_reseed(void) + unsigned long flags; + unsigned long next_gen; + u8 key[CHACHA_KEY_SIZE]; +- bool finalize_init = false; + + extract_entropy(key, sizeof(key)); + +@@ -281,28 +280,10 @@ static void crng_reseed(void) + ++next_gen; + WRITE_ONCE(base_crng.generation, next_gen); + WRITE_ONCE(base_crng.birth, jiffies); +- if (!crng_ready()) { ++ if (!crng_ready()) + crng_init = CRNG_READY; +- finalize_init = true; +- } + spin_unlock_irqrestore(&base_crng.lock, flags); + memzero_explicit(key, sizeof(key)); +- if (finalize_init) { +- process_random_ready_list(); +- wake_up_interruptible(&crng_init_wait); +- kill_fasync(&fasync, SIGIO, POLL_IN); +- pr_notice("crng init done\n"); +- if (unseeded_warning.missed) { +- pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n", +- unseeded_warning.missed); +- unseeded_warning.missed = 0; +- } +- if (urandom_warning.missed) { +- pr_notice("%d urandom warning(s) missed due to ratelimiting\n", +- urandom_warning.missed); +- urandom_warning.missed = 0; +- } +- } + } + + /* +@@ -834,10 +815,25 @@ static void credit_init_bits(size_t nbit + new = min_t(unsigned int, POOL_BITS, orig + add); + } while (cmpxchg(&input_pool.init_bits, orig, new) != orig); + +- if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) +- crng_reseed(); +- else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) { ++ if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) { ++ crng_reseed(); /* Sets crng_init to CRNG_READY under base_crng.lock. */ ++ process_random_ready_list(); ++ wake_up_interruptible(&crng_init_wait); ++ kill_fasync(&fasync, SIGIO, POLL_IN); ++ pr_notice("crng init done\n"); ++ if (unseeded_warning.missed) { ++ pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n", ++ unseeded_warning.missed); ++ unseeded_warning.missed = 0; ++ } ++ if (urandom_warning.missed) { ++ pr_notice("%d urandom warning(s) missed due to ratelimiting\n", ++ urandom_warning.missed); ++ urandom_warning.missed = 0; ++ } ++ } else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) { + spin_lock_irqsave(&base_crng.lock, flags); ++ /* Check if crng_init is CRNG_EMPTY, to avoid race with crng_reseed(). */ + if (crng_init == CRNG_EMPTY) { + extract_entropy(base_crng.key, sizeof(base_crng.key)); + crng_init = CRNG_EARLY; diff --git a/queue-5.18/random-move-randomize_page-into-mm-where-it-belongs.patch b/queue-5.18/random-move-randomize_page-into-mm-where-it-belongs.patch new file mode 100644 index 00000000000..209aa304091 --- /dev/null +++ b/queue-5.18/random-move-randomize_page-into-mm-where-it-belongs.patch @@ -0,0 +1,134 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 14 May 2022 13:59:30 +0200 +Subject: random: move randomize_page() into mm where it belongs + +From: "Jason A. Donenfeld" + +commit 5ad7dd882e45d7fe432c32e896e2aaa0b21746ea upstream. + +randomize_page is an mm function. It is documented like one. It contains +the history of one. It has the naming convention of one. It looks +just like another very similar function in mm, randomize_stack_top(). +And it has always been maintained and updated by mm people. There is no +need for it to be in random.c. In the "which shape does not look like +the other ones" test, pointing to randomize_page() is correct. + +So move randomize_page() into mm/util.c, right next to the similar +randomize_stack_top() function. + +This commit contains no actual code changes. + +Cc: Andrew Morton +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 32 -------------------------------- + include/linux/mm.h | 1 + + include/linux/random.h | 2 -- + mm/util.c | 32 ++++++++++++++++++++++++++++++++ + 4 files changed, 33 insertions(+), 34 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -622,38 +622,6 @@ int __cold random_prepare_cpu(unsigned i + } + #endif + +-/** +- * randomize_page - Generate a random, page aligned address +- * @start: The smallest acceptable address the caller will take. +- * @range: The size of the area, starting at @start, within which the +- * random address must fall. +- * +- * If @start + @range would overflow, @range is capped. +- * +- * NOTE: Historical use of randomize_range, which this replaces, presumed that +- * @start was already page aligned. We now align it regardless. +- * +- * Return: A page aligned address within [start, start + range). On error, +- * @start is returned. +- */ +-unsigned long randomize_page(unsigned long start, unsigned long range) +-{ +- if (!PAGE_ALIGNED(start)) { +- range -= PAGE_ALIGN(start) - start; +- start = PAGE_ALIGN(start); +- } +- +- if (start > ULONG_MAX - range) +- range = ULONG_MAX - start; +- +- range >>= PAGE_SHIFT; +- +- if (range == 0) +- return start; +- +- return start + (get_random_long() % range << PAGE_SHIFT); +-} +- + /* + * This function will use the architecture-specific hardware random + * number generator if it is available. It is not recommended for +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2677,6 +2677,7 @@ extern int install_special_mapping(struc + unsigned long flags, struct page **pages); + + unsigned long randomize_stack_top(unsigned long stack_top); ++unsigned long randomize_page(unsigned long start, unsigned long range); + + extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long); + +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -73,8 +73,6 @@ static inline unsigned long get_random_c + return get_random_long() & CANARY_MASK; + } + +-unsigned long randomize_page(unsigned long start, unsigned long range); +- + int __init random_init(const char *command_line); + bool rng_is_initialized(void); + int wait_for_random_bytes(void); +--- a/mm/util.c ++++ b/mm/util.c +@@ -343,6 +343,38 @@ unsigned long randomize_stack_top(unsign + #endif + } + ++/** ++ * randomize_page - Generate a random, page aligned address ++ * @start: The smallest acceptable address the caller will take. ++ * @range: The size of the area, starting at @start, within which the ++ * random address must fall. ++ * ++ * If @start + @range would overflow, @range is capped. ++ * ++ * NOTE: Historical use of randomize_range, which this replaces, presumed that ++ * @start was already page aligned. We now align it regardless. ++ * ++ * Return: A page aligned address within [start, start + range). On error, ++ * @start is returned. ++ */ ++unsigned long randomize_page(unsigned long start, unsigned long range) ++{ ++ if (!PAGE_ALIGNED(start)) { ++ range -= PAGE_ALIGN(start) - start; ++ start = PAGE_ALIGN(start); ++ } ++ ++ if (start > ULONG_MAX - range) ++ range = ULONG_MAX - start; ++ ++ range >>= PAGE_SHIFT; ++ ++ if (range == 0) ++ return start; ++ ++ return start + (get_random_long() % range << PAGE_SHIFT); ++} ++ + #ifdef CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT + unsigned long arch_randomize_brk(struct mm_struct *mm) + { diff --git a/queue-5.18/random-order-timer-entropy-functions-below-interrupt-functions.patch b/queue-5.18/random-order-timer-entropy-functions-below-interrupt-functions.patch new file mode 100644 index 00000000000..c3e2b889bd0 --- /dev/null +++ b/queue-5.18/random-order-timer-entropy-functions-below-interrupt-functions.patch @@ -0,0 +1,299 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 6 May 2022 18:27:38 +0200 +Subject: random: order timer entropy functions below interrupt functions + +From: "Jason A. Donenfeld" + +commit a4b5c26b79ffdfcfb816c198f2fc2b1e7b5b580f upstream. + +There are no code changes here; this is just a reordering of functions, +so that in subsequent commits, the timer entropy functions can call into +the interrupt ones. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 238 +++++++++++++++++++++++++------------------------- + 1 file changed, 119 insertions(+), 119 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -854,14 +854,14 @@ static void credit_init_bits(size_t nbit + * the above entropy accumulation routines: + * + * void add_device_randomness(const void *buf, size_t size); +- * void add_input_randomness(unsigned int type, unsigned int code, +- * unsigned int value); +- * void add_disk_randomness(struct gendisk *disk); + * void add_hwgenerator_randomness(const void *buffer, size_t count, + * size_t entropy); + * void add_bootloader_randomness(const void *buf, size_t size); + * void add_vmfork_randomness(const void *unique_vm_id, size_t size); + * void add_interrupt_randomness(int irq); ++ * void add_input_randomness(unsigned int type, unsigned int code, ++ * unsigned int value); ++ * void add_disk_randomness(struct gendisk *disk); + * + * add_device_randomness() adds data to the input pool that + * is likely to differ between two devices (or possibly even per boot). +@@ -871,19 +871,6 @@ static void credit_init_bits(size_t nbit + * that might otherwise be identical and have very little entropy + * available to them (particularly common in the embedded world). + * +- * add_input_randomness() uses the input layer interrupt timing, as well +- * as the event type information from the hardware. +- * +- * add_disk_randomness() uses what amounts to the seek time of block +- * layer request events, on a per-disk_devt basis, as input to the +- * entropy pool. Note that high-speed solid state drives with very low +- * seek times do not make for good sources of entropy, as their seek +- * times are usually fairly consistent. +- * +- * The above two routines try to estimate how many bits of entropy +- * to credit. They do this by keeping track of the first and second +- * order deltas of the event timings. +- * + * add_hwgenerator_randomness() is for true hardware RNGs, and will credit + * entropy as specified by the caller. If the entropy pool is full it will + * block until more entropy is needed. +@@ -901,6 +888,19 @@ static void credit_init_bits(size_t nbit + * as inputs, it feeds the input pool roughly once a second or after 64 + * interrupts, crediting 1 bit of entropy for whichever comes first. + * ++ * add_input_randomness() uses the input layer interrupt timing, as well ++ * as the event type information from the hardware. ++ * ++ * add_disk_randomness() uses what amounts to the seek time of block ++ * layer request events, on a per-disk_devt basis, as input to the ++ * entropy pool. Note that high-speed solid state drives with very low ++ * seek times do not make for good sources of entropy, as their seek ++ * times are usually fairly consistent. ++ * ++ * The last two routines try to estimate how many bits of entropy ++ * to credit. They do this by keeping track of the first and second ++ * order deltas of the event timings. ++ * + **********************************************************************/ + + static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU); +@@ -978,109 +978,6 @@ void add_device_randomness(const void *b + } + EXPORT_SYMBOL(add_device_randomness); + +-/* There is one of these per entropy source */ +-struct timer_rand_state { +- unsigned long last_time; +- long last_delta, last_delta2; +-}; +- +-/* +- * This function adds entropy to the entropy "pool" by using timing +- * delays. It uses the timer_rand_state structure to make an estimate +- * of how many bits of entropy this call has added to the pool. +- * +- * The number "num" is also added to the pool - it should somehow describe +- * the type of event which just happened. This is currently 0-255 for +- * keyboard scan codes, and 256 upwards for interrupts. +- */ +-static void add_timer_randomness(struct timer_rand_state *state, unsigned int num) +-{ +- unsigned long entropy = random_get_entropy(), now = jiffies, flags; +- long delta, delta2, delta3; +- +- spin_lock_irqsave(&input_pool.lock, flags); +- _mix_pool_bytes(&entropy, sizeof(entropy)); +- _mix_pool_bytes(&num, sizeof(num)); +- spin_unlock_irqrestore(&input_pool.lock, flags); +- +- if (crng_ready()) +- return; +- +- /* +- * Calculate number of bits of randomness we probably added. +- * We take into account the first, second and third-order deltas +- * in order to make our estimate. +- */ +- delta = now - READ_ONCE(state->last_time); +- WRITE_ONCE(state->last_time, now); +- +- delta2 = delta - READ_ONCE(state->last_delta); +- WRITE_ONCE(state->last_delta, delta); +- +- delta3 = delta2 - READ_ONCE(state->last_delta2); +- WRITE_ONCE(state->last_delta2, delta2); +- +- if (delta < 0) +- delta = -delta; +- if (delta2 < 0) +- delta2 = -delta2; +- if (delta3 < 0) +- delta3 = -delta3; +- if (delta > delta2) +- delta = delta2; +- if (delta > delta3) +- delta = delta3; +- +- /* +- * delta is now minimum absolute delta. +- * Round down by 1 bit on general principles, +- * and limit entropy estimate to 12 bits. +- */ +- credit_init_bits(min_t(unsigned int, fls(delta >> 1), 11)); +-} +- +-void add_input_randomness(unsigned int type, unsigned int code, +- unsigned int value) +-{ +- static unsigned char last_value; +- static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES }; +- +- /* Ignore autorepeat and the like. */ +- if (value == last_value) +- return; +- +- last_value = value; +- add_timer_randomness(&input_timer_state, +- (type << 4) ^ code ^ (code >> 4) ^ value); +-} +-EXPORT_SYMBOL_GPL(add_input_randomness); +- +-#ifdef CONFIG_BLOCK +-void add_disk_randomness(struct gendisk *disk) +-{ +- if (!disk || !disk->random) +- return; +- /* First major is 1, so we get >= 0x200 here. */ +- add_timer_randomness(disk->random, 0x100 + disk_devt(disk)); +-} +-EXPORT_SYMBOL_GPL(add_disk_randomness); +- +-void rand_initialize_disk(struct gendisk *disk) +-{ +- struct timer_rand_state *state; +- +- /* +- * If kzalloc returns null, we just won't use that entropy +- * source. +- */ +- state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL); +- if (state) { +- state->last_time = INITIAL_JIFFIES; +- disk->random = state; +- } +-} +-#endif +- + /* + * Interface for in-kernel drivers of true hardware RNGs. + * Those devices may produce endless random bits and will be throttled +@@ -1276,6 +1173,109 @@ void add_interrupt_randomness(int irq) + } + EXPORT_SYMBOL_GPL(add_interrupt_randomness); + ++/* There is one of these per entropy source */ ++struct timer_rand_state { ++ unsigned long last_time; ++ long last_delta, last_delta2; ++}; ++ ++/* ++ * This function adds entropy to the entropy "pool" by using timing ++ * delays. It uses the timer_rand_state structure to make an estimate ++ * of how many bits of entropy this call has added to the pool. ++ * ++ * The number "num" is also added to the pool - it should somehow describe ++ * the type of event which just happened. This is currently 0-255 for ++ * keyboard scan codes, and 256 upwards for interrupts. ++ */ ++static void add_timer_randomness(struct timer_rand_state *state, unsigned int num) ++{ ++ unsigned long entropy = random_get_entropy(), now = jiffies, flags; ++ long delta, delta2, delta3; ++ ++ spin_lock_irqsave(&input_pool.lock, flags); ++ _mix_pool_bytes(&entropy, sizeof(entropy)); ++ _mix_pool_bytes(&num, sizeof(num)); ++ spin_unlock_irqrestore(&input_pool.lock, flags); ++ ++ if (crng_ready()) ++ return; ++ ++ /* ++ * Calculate number of bits of randomness we probably added. ++ * We take into account the first, second and third-order deltas ++ * in order to make our estimate. ++ */ ++ delta = now - READ_ONCE(state->last_time); ++ WRITE_ONCE(state->last_time, now); ++ ++ delta2 = delta - READ_ONCE(state->last_delta); ++ WRITE_ONCE(state->last_delta, delta); ++ ++ delta3 = delta2 - READ_ONCE(state->last_delta2); ++ WRITE_ONCE(state->last_delta2, delta2); ++ ++ if (delta < 0) ++ delta = -delta; ++ if (delta2 < 0) ++ delta2 = -delta2; ++ if (delta3 < 0) ++ delta3 = -delta3; ++ if (delta > delta2) ++ delta = delta2; ++ if (delta > delta3) ++ delta = delta3; ++ ++ /* ++ * delta is now minimum absolute delta. ++ * Round down by 1 bit on general principles, ++ * and limit entropy estimate to 12 bits. ++ */ ++ credit_init_bits(min_t(unsigned int, fls(delta >> 1), 11)); ++} ++ ++void add_input_randomness(unsigned int type, unsigned int code, ++ unsigned int value) ++{ ++ static unsigned char last_value; ++ static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES }; ++ ++ /* Ignore autorepeat and the like. */ ++ if (value == last_value) ++ return; ++ ++ last_value = value; ++ add_timer_randomness(&input_timer_state, ++ (type << 4) ^ code ^ (code >> 4) ^ value); ++} ++EXPORT_SYMBOL_GPL(add_input_randomness); ++ ++#ifdef CONFIG_BLOCK ++void add_disk_randomness(struct gendisk *disk) ++{ ++ if (!disk || !disk->random) ++ return; ++ /* First major is 1, so we get >= 0x200 here. */ ++ add_timer_randomness(disk->random, 0x100 + disk_devt(disk)); ++} ++EXPORT_SYMBOL_GPL(add_disk_randomness); ++ ++void rand_initialize_disk(struct gendisk *disk) ++{ ++ struct timer_rand_state *state; ++ ++ /* ++ * If kzalloc returns null, we just won't use that entropy ++ * source. ++ */ ++ state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL); ++ if (state) { ++ state->last_time = INITIAL_JIFFIES; ++ disk->random = state; ++ } ++} ++#endif ++ + /* + * Each time the timer fires, we expect that we got an unpredictable + * jump in the cycle counter. Even if the timer is running on another diff --git a/queue-5.18/random-remove-extern-from-functions-in-header.patch b/queue-5.18/random-remove-extern-from-functions-in-header.patch new file mode 100644 index 00000000000..5caaae803e0 --- /dev/null +++ b/queue-5.18/random-remove-extern-from-functions-in-header.patch @@ -0,0 +1,150 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 13 May 2022 12:29:38 +0200 +Subject: random: remove extern from functions in header + +From: "Jason A. Donenfeld" + +commit 7782cfeca7d420e8bb707613d4cfb0f7ff29bb3a upstream. + +Accoriding to the kernel style guide, having `extern` on functions in +headers is old school and deprecated, and doesn't add anything. So remove +them from random.h, and tidy up the file a little bit too. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/random.h | 77 +++++++++++++++++++------------------------------ + 1 file changed, 31 insertions(+), 46 deletions(-) + +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -12,13 +12,12 @@ + + struct notifier_block; + +-extern void add_device_randomness(const void *, size_t); +-extern void add_bootloader_randomness(const void *, size_t); +-extern void add_input_randomness(unsigned int type, unsigned int code, +- unsigned int value) __latent_entropy; +-extern void add_interrupt_randomness(int irq) __latent_entropy; +-extern void add_hwgenerator_randomness(const void *buffer, size_t count, +- size_t entropy); ++void add_device_randomness(const void *, size_t); ++void add_bootloader_randomness(const void *, size_t); ++void add_input_randomness(unsigned int type, unsigned int code, ++ unsigned int value) __latent_entropy; ++void add_interrupt_randomness(int irq) __latent_entropy; ++void add_hwgenerator_randomness(const void *buffer, size_t count, size_t entropy); + + #if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) + static inline void add_latent_entropy(void) +@@ -26,30 +25,20 @@ static inline void add_latent_entropy(vo + add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); + } + #else +-static inline void add_latent_entropy(void) {} ++static inline void add_latent_entropy(void) { } + #endif + + #if IS_ENABLED(CONFIG_VMGENID) +-extern void add_vmfork_randomness(const void *unique_vm_id, size_t size); +-extern int register_random_vmfork_notifier(struct notifier_block *nb); +-extern int unregister_random_vmfork_notifier(struct notifier_block *nb); ++void add_vmfork_randomness(const void *unique_vm_id, size_t size); ++int register_random_vmfork_notifier(struct notifier_block *nb); ++int unregister_random_vmfork_notifier(struct notifier_block *nb); + #else + static inline int register_random_vmfork_notifier(struct notifier_block *nb) { return 0; } + static inline int unregister_random_vmfork_notifier(struct notifier_block *nb) { return 0; } + #endif + +-extern void get_random_bytes(void *buf, size_t nbytes); +-extern int wait_for_random_bytes(void); +-extern int __init random_init(const char *command_line); +-extern bool rng_is_initialized(void); +-extern int register_random_ready_notifier(struct notifier_block *nb); +-extern int unregister_random_ready_notifier(struct notifier_block *nb); +-extern size_t __must_check get_random_bytes_arch(void *buf, size_t nbytes); +- +-#ifndef MODULE +-extern const struct file_operations random_fops, urandom_fops; +-#endif +- ++void get_random_bytes(void *buf, size_t nbytes); ++size_t __must_check get_random_bytes_arch(void *buf, size_t nbytes); + u32 get_random_u32(void); + u64 get_random_u64(void); + static inline unsigned int get_random_int(void) +@@ -81,11 +70,17 @@ static inline unsigned long get_random_l + + static inline unsigned long get_random_canary(void) + { +- unsigned long val = get_random_long(); +- +- return val & CANARY_MASK; ++ return get_random_long() & CANARY_MASK; + } + ++unsigned long randomize_page(unsigned long start, unsigned long range); ++ ++int __init random_init(const char *command_line); ++bool rng_is_initialized(void); ++int wait_for_random_bytes(void); ++int register_random_ready_notifier(struct notifier_block *nb); ++int unregister_random_ready_notifier(struct notifier_block *nb); ++ + /* Calls wait_for_random_bytes() and then calls get_random_bytes(buf, nbytes). + * Returns the result of the call to wait_for_random_bytes. */ + static inline int get_random_bytes_wait(void *buf, size_t nbytes) +@@ -109,8 +104,6 @@ declare_get_random_var_wait(int) + declare_get_random_var_wait(long) + #undef declare_get_random_var + +-unsigned long randomize_page(unsigned long start, unsigned long range); +- + /* + * This is designed to be standalone for just prandom + * users, but for now we include it from +@@ -121,22 +114,10 @@ unsigned long randomize_page(unsigned lo + #ifdef CONFIG_ARCH_RANDOM + # include + #else +-static inline bool __must_check arch_get_random_long(unsigned long *v) +-{ +- return false; +-} +-static inline bool __must_check arch_get_random_int(unsigned int *v) +-{ +- return false; +-} +-static inline bool __must_check arch_get_random_seed_long(unsigned long *v) +-{ +- return false; +-} +-static inline bool __must_check arch_get_random_seed_int(unsigned int *v) +-{ +- return false; +-} ++static inline bool __must_check arch_get_random_long(unsigned long *v) { return false; } ++static inline bool __must_check arch_get_random_int(unsigned int *v) { return false; } ++static inline bool __must_check arch_get_random_seed_long(unsigned long *v) { return false; } ++static inline bool __must_check arch_get_random_seed_int(unsigned int *v) { return false; } + #endif + + /* +@@ -160,8 +141,12 @@ static inline bool __init arch_get_rando + #endif + + #ifdef CONFIG_SMP +-extern int random_prepare_cpu(unsigned int cpu); +-extern int random_online_cpu(unsigned int cpu); ++int random_prepare_cpu(unsigned int cpu); ++int random_online_cpu(unsigned int cpu); ++#endif ++ ++#ifndef MODULE ++extern const struct file_operations random_fops, urandom_fops; + #endif + + #endif /* _LINUX_RANDOM_H */ diff --git a/queue-5.18/random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch b/queue-5.18/random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch new file mode 100644 index 00000000000..55b9bed34e4 --- /dev/null +++ b/queue-5.18/random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch @@ -0,0 +1,200 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Mon, 9 May 2022 16:13:18 +0200 +Subject: random: remove ratelimiting for in-kernel unseeded randomness + +From: "Jason A. Donenfeld" + +commit cc1e127bfa95b5fb2f9307e7168bf8b2b45b4c5e upstream. + +The CONFIG_WARN_ALL_UNSEEDED_RANDOM debug option controls whether the +kernel warns about all unseeded randomness or just the first instance. +There's some complicated rate limiting and comparison to the previous +caller, such that even with CONFIG_WARN_ALL_UNSEEDED_RANDOM enabled, +developers still don't see all the messages or even an accurate count of +how many were missed. This is the result of basically parallel +mechanisms aimed at accomplishing more or less the same thing, added at +different points in random.c history, which sort of compete with the +first-instance-only limiting we have now. + +It turns out, however, that nobody cares about the first unseeded +randomness instance of in-kernel users. The same first user has been +there for ages now, and nobody is doing anything about it. It isn't even +clear that anybody _can_ do anything about it. Most places that can do +something about it have switched over to using get_random_bytes_wait() +or wait_for_random_bytes(), which is the right thing to do, but there is +still much code that needs randomness sometimes during init, and as a +geeneral rule, if you're not using one of the _wait functions or the +readiness notifier callback, you're bound to be doing it wrong just +based on that fact alone. + +So warning about this same first user that can't easily change is simply +not an effective mechanism for anything at all. Users can't do anything +about it, as the Kconfig text points out -- the problem isn't in +userspace code -- and kernel developers don't or more often can't react +to it. + +Instead, show the warning for all instances when CONFIG_WARN_ALL_UNSEEDED_RANDOM +is set, so that developers can debug things need be, or if it isn't set, +don't show a warning at all. + +At the same time, CONFIG_WARN_ALL_UNSEEDED_RANDOM now implies setting +random.ratelimit_disable=1 on by default, since if you care about one +you probably care about the other too. And we can clean up usage around +the related urandom_warning ratelimiter as well (whose behavior isn't +changing), so that it properly counts missed messages after the 10 +message threshold is reached. + +Cc: Theodore Ts'o +Cc: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 61 ++++++++++++++------------------------------------ + lib/Kconfig.debug | 3 -- + 2 files changed, 19 insertions(+), 45 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -86,11 +86,10 @@ static DEFINE_SPINLOCK(random_ready_chai + static RAW_NOTIFIER_HEAD(random_ready_chain); + + /* Control how we warn userspace. */ +-static struct ratelimit_state unseeded_warning = +- RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3); + static struct ratelimit_state urandom_warning = + RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3); +-static int ratelimit_disable __read_mostly; ++static int ratelimit_disable __read_mostly = ++ IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM); + module_param_named(ratelimit_disable, ratelimit_disable, int, 0644); + MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression"); + +@@ -181,27 +180,15 @@ static void process_random_ready_list(vo + spin_unlock_irqrestore(&random_ready_chain_lock, flags); + } + +-#define warn_unseeded_randomness(previous) \ +- _warn_unseeded_randomness(__func__, (void *)_RET_IP_, (previous)) ++#define warn_unseeded_randomness() \ ++ _warn_unseeded_randomness(__func__, (void *)_RET_IP_) + +-static void _warn_unseeded_randomness(const char *func_name, void *caller, void **previous) ++static void _warn_unseeded_randomness(const char *func_name, void *caller) + { +-#ifdef CONFIG_WARN_ALL_UNSEEDED_RANDOM +- const bool print_once = false; +-#else +- static bool print_once __read_mostly; +-#endif +- +- if (print_once || crng_ready() || +- (previous && (caller == READ_ONCE(*previous)))) ++ if (!IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) || crng_ready()) + return; +- WRITE_ONCE(*previous, caller); +-#ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM +- print_once = true; +-#endif +- if (__ratelimit(&unseeded_warning)) +- printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", +- func_name, caller, crng_init); ++ printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", ++ func_name, caller, crng_init); + } + + +@@ -454,9 +441,7 @@ static void _get_random_bytes(void *buf, + */ + void get_random_bytes(void *buf, size_t nbytes) + { +- static void *previous; +- +- warn_unseeded_randomness(&previous); ++ warn_unseeded_randomness(); + _get_random_bytes(buf, nbytes); + } + EXPORT_SYMBOL(get_random_bytes); +@@ -552,10 +537,9 @@ u64 get_random_u64(void) + u64 ret; + unsigned long flags; + struct batched_entropy *batch; +- static void *previous; + unsigned long next_gen; + +- warn_unseeded_randomness(&previous); ++ warn_unseeded_randomness(); + + if (!crng_ready()) { + _get_random_bytes(&ret, sizeof(ret)); +@@ -591,10 +575,9 @@ u32 get_random_u32(void) + u32 ret; + unsigned long flags; + struct batched_entropy *batch; +- static void *previous; + unsigned long next_gen; + +- warn_unseeded_randomness(&previous); ++ warn_unseeded_randomness(); + + if (!crng_ready()) { + _get_random_bytes(&ret, sizeof(ret)); +@@ -821,16 +804,9 @@ static void credit_init_bits(size_t nbit + wake_up_interruptible(&crng_init_wait); + kill_fasync(&fasync, SIGIO, POLL_IN); + pr_notice("crng init done\n"); +- if (unseeded_warning.missed) { +- pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n", +- unseeded_warning.missed); +- unseeded_warning.missed = 0; +- } +- if (urandom_warning.missed) { ++ if (urandom_warning.missed) + pr_notice("%d urandom warning(s) missed due to ratelimiting\n", + urandom_warning.missed); +- urandom_warning.missed = 0; +- } + } else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) { + spin_lock_irqsave(&base_crng.lock, flags); + /* Check if crng_init is CRNG_EMPTY, to avoid race with crng_reseed(). */ +@@ -948,10 +924,6 @@ int __init rand_initialize(void) + else if (arch_init && trust_cpu) + credit_init_bits(BLAKE2S_BLOCK_SIZE * 8); + +- if (ratelimit_disable) { +- urandom_warning.interval = 0; +- unseeded_warning.interval = 0; +- } + return 0; + } + +@@ -1438,11 +1410,14 @@ static ssize_t urandom_read(struct file + if (!crng_ready()) + try_to_generate_entropy(); + +- if (!crng_ready() && maxwarn > 0) { +- maxwarn--; +- if (__ratelimit(&urandom_warning)) ++ if (!crng_ready()) { ++ if (!ratelimit_disable && maxwarn <= 0) ++ ++urandom_warning.missed; ++ else if (ratelimit_disable || __ratelimit(&urandom_warning)) { ++ --maxwarn; + pr_notice("%s: uninitialized urandom read (%zd bytes read)\n", + current->comm, nbytes); ++ } + } + + return get_random_bytes_user(buf, nbytes); +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -1616,8 +1616,7 @@ config WARN_ALL_UNSEEDED_RANDOM + so architecture maintainers really need to do what they can + to get the CRNG seeded sooner after the system is booted. + However, since users cannot do anything actionable to +- address this, by default the kernel will issue only a single +- warning for the first use of unseeded randomness. ++ address this, by default this option is disabled. + + Say Y here if you want to receive warnings for all uses of + unseeded randomness. This will be of use primarily for diff --git a/queue-5.18/random-unify-batched-entropy-implementations.patch b/queue-5.18/random-unify-batched-entropy-implementations.patch new file mode 100644 index 00000000000..02a6e6910d4 --- /dev/null +++ b/queue-5.18/random-unify-batched-entropy-implementations.patch @@ -0,0 +1,190 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sun, 15 May 2022 00:22:05 +0200 +Subject: random: unify batched entropy implementations + +From: "Jason A. Donenfeld" + +commit 3092adcef3ffd2ef59634998297ca8358461ebce upstream. + +There are currently two separate batched entropy implementations, for +u32 and u64, with nearly identical code, with the goal of avoiding +unaligned memory accesses and letting the buffers be used more +efficiently. Having to maintain these two functions independently is a +bit of a hassle though, considering that they always need to be kept in +sync. + +This commit factors them out into a type-generic macro, so that the +expansion produces the same code as before, such that diffing the +assembly shows no differences. This will also make it easier in the +future to add u16 and u8 batches. + +This was initially tested using an always_inline function and letting +gcc constant fold the type size in, but the code gen was less efficient, +and in general it was more verbose and harder to follow. So this patch +goes with the boring macro solution, similar to what's already done for +the _wait functions in random.h. + +Cc: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 145 ++++++++++++++++++-------------------------------- + 1 file changed, 54 insertions(+), 91 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -509,99 +509,62 @@ out_zero_chacha: + * provided by this function is okay, the function wait_for_random_bytes() + * should be called and return 0 at least once at any point prior. + */ +-struct batched_entropy { +- union { +- /* +- * We make this 1.5x a ChaCha block, so that we get the +- * remaining 32 bytes from fast key erasure, plus one full +- * block from the detached ChaCha state. We can increase +- * the size of this later if needed so long as we keep the +- * formula of (integer_blocks + 0.5) * CHACHA_BLOCK_SIZE. +- */ +- u64 entropy_u64[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(u64))]; +- u32 entropy_u32[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(u32))]; +- }; +- local_lock_t lock; +- unsigned long generation; +- unsigned int position; +-}; + ++#define DEFINE_BATCHED_ENTROPY(type) \ ++struct batch_ ##type { \ ++ /* \ ++ * We make this 1.5x a ChaCha block, so that we get the \ ++ * remaining 32 bytes from fast key erasure, plus one full \ ++ * block from the detached ChaCha state. We can increase \ ++ * the size of this later if needed so long as we keep the \ ++ * formula of (integer_blocks + 0.5) * CHACHA_BLOCK_SIZE. \ ++ */ \ ++ type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))]; \ ++ local_lock_t lock; \ ++ unsigned long generation; \ ++ unsigned int position; \ ++}; \ ++ \ ++static DEFINE_PER_CPU(struct batch_ ##type, batched_entropy_ ##type) = { \ ++ .lock = INIT_LOCAL_LOCK(batched_entropy_ ##type.lock), \ ++ .position = UINT_MAX \ ++}; \ ++ \ ++type get_random_ ##type(void) \ ++{ \ ++ type ret; \ ++ unsigned long flags; \ ++ struct batch_ ##type *batch; \ ++ unsigned long next_gen; \ ++ \ ++ warn_unseeded_randomness(); \ ++ \ ++ if (!crng_ready()) { \ ++ _get_random_bytes(&ret, sizeof(ret)); \ ++ return ret; \ ++ } \ ++ \ ++ local_lock_irqsave(&batched_entropy_ ##type.lock, flags); \ ++ batch = raw_cpu_ptr(&batched_entropy_##type); \ ++ \ ++ next_gen = READ_ONCE(base_crng.generation); \ ++ if (batch->position >= ARRAY_SIZE(batch->entropy) || \ ++ next_gen != batch->generation) { \ ++ _get_random_bytes(batch->entropy, sizeof(batch->entropy)); \ ++ batch->position = 0; \ ++ batch->generation = next_gen; \ ++ } \ ++ \ ++ ret = batch->entropy[batch->position]; \ ++ batch->entropy[batch->position] = 0; \ ++ ++batch->position; \ ++ local_unlock_irqrestore(&batched_entropy_ ##type.lock, flags); \ ++ return ret; \ ++} \ ++EXPORT_SYMBOL(get_random_ ##type); + +-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = { +- .lock = INIT_LOCAL_LOCK(batched_entropy_u64.lock), +- .position = UINT_MAX +-}; +- +-u64 get_random_u64(void) +-{ +- u64 ret; +- unsigned long flags; +- struct batched_entropy *batch; +- unsigned long next_gen; +- +- warn_unseeded_randomness(); +- +- if (!crng_ready()) { +- _get_random_bytes(&ret, sizeof(ret)); +- return ret; +- } +- +- local_lock_irqsave(&batched_entropy_u64.lock, flags); +- batch = raw_cpu_ptr(&batched_entropy_u64); +- +- next_gen = READ_ONCE(base_crng.generation); +- if (batch->position >= ARRAY_SIZE(batch->entropy_u64) || +- next_gen != batch->generation) { +- _get_random_bytes(batch->entropy_u64, sizeof(batch->entropy_u64)); +- batch->position = 0; +- batch->generation = next_gen; +- } +- +- ret = batch->entropy_u64[batch->position]; +- batch->entropy_u64[batch->position] = 0; +- ++batch->position; +- local_unlock_irqrestore(&batched_entropy_u64.lock, flags); +- return ret; +-} +-EXPORT_SYMBOL(get_random_u64); +- +-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32) = { +- .lock = INIT_LOCAL_LOCK(batched_entropy_u32.lock), +- .position = UINT_MAX +-}; +- +-u32 get_random_u32(void) +-{ +- u32 ret; +- unsigned long flags; +- struct batched_entropy *batch; +- unsigned long next_gen; +- +- warn_unseeded_randomness(); +- +- if (!crng_ready()) { +- _get_random_bytes(&ret, sizeof(ret)); +- return ret; +- } +- +- local_lock_irqsave(&batched_entropy_u32.lock, flags); +- batch = raw_cpu_ptr(&batched_entropy_u32); +- +- next_gen = READ_ONCE(base_crng.generation); +- if (batch->position >= ARRAY_SIZE(batch->entropy_u32) || +- next_gen != batch->generation) { +- _get_random_bytes(batch->entropy_u32, sizeof(batch->entropy_u32)); +- batch->position = 0; +- batch->generation = next_gen; +- } +- +- ret = batch->entropy_u32[batch->position]; +- batch->entropy_u32[batch->position] = 0; +- ++batch->position; +- local_unlock_irqrestore(&batched_entropy_u32.lock, flags); +- return ret; +-} +-EXPORT_SYMBOL(get_random_u32); ++DEFINE_BATCHED_ENTROPY(u64) ++DEFINE_BATCHED_ENTROPY(u32) + + #ifdef CONFIG_SMP + /* diff --git a/queue-5.18/random-use-first-128-bits-of-input-as-fast-init.patch b/queue-5.18/random-use-first-128-bits-of-input-as-fast-init.patch new file mode 100644 index 00000000000..7b02f3b6137 --- /dev/null +++ b/queue-5.18/random-use-first-128-bits-of-input-as-fast-init.patch @@ -0,0 +1,307 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 30 Apr 2022 15:08:20 +0200 +Subject: random: use first 128 bits of input as fast init + +From: "Jason A. Donenfeld" + +commit 5c3b747ef54fa2a7318776777f6044540d99f721 upstream. + +Before, the first 64 bytes of input, regardless of how entropic it was, +would be used to mutate the crng base key directly, and none of those +bytes would be credited as having entropy. Then 256 bits of credited +input would be accumulated, and only then would the rng transition from +the earlier "fast init" phase into being actually initialized. + +The thinking was that by mixing and matching fast init and real init, an +attacker who compromised the fast init state, considered easy to do +given how little entropy might be in those first 64 bytes, would then be +able to bruteforce bits from the actual initialization. By keeping these +separate, bruteforcing became impossible. + +However, by not crediting potentially creditable bits from those first 64 +bytes of input, we delay initialization, and actually make the problem +worse, because it means the user is drawing worse random numbers for a +longer period of time. + +Instead, we can take the first 128 bits as fast init, and allow them to +be credited, and then hold off on the next 128 bits until they've +accumulated. This is still a wide enough margin to prevent bruteforcing +the rng state, while still initializing much faster. + +Then, rather than trying to piecemeal inject into the base crng key at +various points, instead just extract from the pool when we need it, for +the crng_init==0 phase. Performance may even be better for the various +inputs here, since there are likely more calls to mix_pool_bytes() then +there are to get_random_bytes() during this phase of system execution. + +Since the preinit injection code is gone, bootloader randomness can then +do something significantly more straight forward, removing the weird +system_wq hack in hwgenerator randomness. + +Cc: Theodore Ts'o +Cc: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 146 ++++++++++++++++---------------------------------- + 1 file changed, 49 insertions(+), 97 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -231,10 +231,7 @@ static void _warn_unseeded_randomness(co + * + *********************************************************************/ + +-enum { +- CRNG_RESEED_INTERVAL = 300 * HZ, +- CRNG_INIT_CNT_THRESH = 2 * CHACHA_KEY_SIZE +-}; ++enum { CRNG_RESEED_INTERVAL = 300 * HZ }; + + static struct { + u8 key[CHACHA_KEY_SIZE] __aligned(__alignof__(long)); +@@ -258,6 +255,8 @@ static DEFINE_PER_CPU(struct crng, crngs + + /* Used by crng_reseed() to extract a new seed from the input pool. */ + static bool drain_entropy(void *buf, size_t nbytes, bool force); ++/* Used by crng_make_state() to extract a new seed when crng_init==0. */ ++static void extract_entropy(void *buf, size_t nbytes); + + /* + * This extracts a new crng key from the input pool, but only if there is a +@@ -382,17 +381,20 @@ static void crng_make_state(u32 chacha_s + /* + * For the fast path, we check whether we're ready, unlocked first, and + * then re-check once locked later. In the case where we're really not +- * ready, we do fast key erasure with the base_crng directly, because +- * this is what crng_pre_init_inject() mutates during early init. ++ * ready, we do fast key erasure with the base_crng directly, extracting ++ * when crng_init==0. + */ + if (!crng_ready()) { + bool ready; + + spin_lock_irqsave(&base_crng.lock, flags); + ready = crng_ready(); +- if (!ready) ++ if (!ready) { ++ if (crng_init == 0) ++ extract_entropy(base_crng.key, sizeof(base_crng.key)); + crng_fast_key_erasure(base_crng.key, chacha_state, + random_data, random_data_len); ++ } + spin_unlock_irqrestore(&base_crng.lock, flags); + if (!ready) + return; +@@ -433,48 +435,6 @@ static void crng_make_state(u32 chacha_s + local_unlock_irqrestore(&crngs.lock, flags); + } + +-/* +- * This function is for crng_init == 0 only. It loads entropy directly +- * into the crng's key, without going through the input pool. It is, +- * generally speaking, not very safe, but we use this only at early +- * boot time when it's better to have something there rather than +- * nothing. +- * +- * If account is set, then the crng_init_cnt counter is incremented. +- * This shouldn't be set by functions like add_device_randomness(), +- * where we can't trust the buffer passed to it is guaranteed to be +- * unpredictable (so it might not have any entropy at all). +- */ +-static void crng_pre_init_inject(const void *input, size_t len, bool account) +-{ +- static int crng_init_cnt = 0; +- struct blake2s_state hash; +- unsigned long flags; +- +- blake2s_init(&hash, sizeof(base_crng.key)); +- +- spin_lock_irqsave(&base_crng.lock, flags); +- if (crng_init != 0) { +- spin_unlock_irqrestore(&base_crng.lock, flags); +- return; +- } +- +- blake2s_update(&hash, base_crng.key, sizeof(base_crng.key)); +- blake2s_update(&hash, input, len); +- blake2s_final(&hash, base_crng.key); +- +- if (account) { +- crng_init_cnt += min_t(size_t, len, CRNG_INIT_CNT_THRESH - crng_init_cnt); +- if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) +- crng_init = 1; +- } +- +- spin_unlock_irqrestore(&base_crng.lock, flags); +- +- if (crng_init == 1) +- pr_notice("fast init done\n"); +-} +- + static void _get_random_bytes(void *buf, size_t nbytes) + { + u32 chacha_state[CHACHA_STATE_WORDS]; +@@ -787,7 +747,8 @@ EXPORT_SYMBOL(get_random_bytes_arch); + + enum { + POOL_BITS = BLAKE2S_HASH_SIZE * 8, +- POOL_MIN_BITS = POOL_BITS /* No point in settling for less. */ ++ POOL_MIN_BITS = POOL_BITS, /* No point in settling for less. */ ++ POOL_FAST_INIT_BITS = POOL_MIN_BITS / 2 + }; + + /* For notifying userspace should write into /dev/random. */ +@@ -824,24 +785,6 @@ static void mix_pool_bytes(const void *i + spin_unlock_irqrestore(&input_pool.lock, flags); + } + +-static void credit_entropy_bits(size_t nbits) +-{ +- unsigned int entropy_count, orig, add; +- +- if (!nbits) +- return; +- +- add = min_t(size_t, nbits, POOL_BITS); +- +- do { +- orig = READ_ONCE(input_pool.entropy_count); +- entropy_count = min_t(unsigned int, POOL_BITS, orig + add); +- } while (cmpxchg(&input_pool.entropy_count, orig, entropy_count) != orig); +- +- if (!crng_ready() && entropy_count >= POOL_MIN_BITS) +- crng_reseed(false); +-} +- + /* + * This is an HKDF-like construction for using the hashed collected entropy + * as a PRF key, that's then expanded block-by-block. +@@ -907,6 +850,33 @@ static bool drain_entropy(void *buf, siz + return true; + } + ++static void credit_entropy_bits(size_t nbits) ++{ ++ unsigned int entropy_count, orig, add; ++ unsigned long flags; ++ ++ if (!nbits) ++ return; ++ ++ add = min_t(size_t, nbits, POOL_BITS); ++ ++ do { ++ orig = READ_ONCE(input_pool.entropy_count); ++ entropy_count = min_t(unsigned int, POOL_BITS, orig + add); ++ } while (cmpxchg(&input_pool.entropy_count, orig, entropy_count) != orig); ++ ++ if (!crng_ready() && entropy_count >= POOL_MIN_BITS) ++ crng_reseed(false); ++ else if (unlikely(crng_init == 0 && entropy_count >= POOL_FAST_INIT_BITS)) { ++ spin_lock_irqsave(&base_crng.lock, flags); ++ if (crng_init == 0) { ++ extract_entropy(base_crng.key, sizeof(base_crng.key)); ++ crng_init = 1; ++ } ++ spin_unlock_irqrestore(&base_crng.lock, flags); ++ } ++} ++ + + /********************************************************************** + * +@@ -950,9 +920,9 @@ static bool drain_entropy(void *buf, siz + * entropy as specified by the caller. If the entropy pool is full it will + * block until more entropy is needed. + * +- * add_bootloader_randomness() is the same as add_hwgenerator_randomness() or +- * add_device_randomness(), depending on whether or not the configuration +- * option CONFIG_RANDOM_TRUST_BOOTLOADER is set. ++ * add_bootloader_randomness() is called by bootloader drivers, such as EFI ++ * and device tree, and credits its input depending on whether or not the ++ * configuration option CONFIG_RANDOM_TRUST_BOOTLOADER is set. + * + * add_vmfork_randomness() adds a unique (but not necessarily secret) ID + * representing the current instance of a VM to the pool, without crediting, +@@ -1036,9 +1006,6 @@ void add_device_randomness(const void *b + unsigned long entropy = random_get_entropy(); + unsigned long flags; + +- if (crng_init == 0 && size) +- crng_pre_init_inject(buf, size, false); +- + spin_lock_irqsave(&input_pool.lock, flags); + _mix_pool_bytes(&entropy, sizeof(entropy)); + _mix_pool_bytes(buf, size); +@@ -1154,12 +1121,6 @@ void rand_initialize_disk(struct gendisk + void add_hwgenerator_randomness(const void *buffer, size_t count, + size_t entropy) + { +- if (unlikely(crng_init == 0 && entropy < POOL_MIN_BITS)) { +- crng_pre_init_inject(buffer, count, true); +- mix_pool_bytes(buffer, count); +- return; +- } +- + /* + * Throttle writing if we're above the trickle threshold. + * We'll be woken up again once below POOL_MIN_BITS, when +@@ -1167,7 +1128,7 @@ void add_hwgenerator_randomness(const vo + * CRNG_RESEED_INTERVAL has elapsed. + */ + wait_event_interruptible_timeout(random_write_wait, +- !system_wq || kthread_should_stop() || ++ kthread_should_stop() || + input_pool.entropy_count < POOL_MIN_BITS, + CRNG_RESEED_INTERVAL); + mix_pool_bytes(buffer, count); +@@ -1176,17 +1137,14 @@ void add_hwgenerator_randomness(const vo + EXPORT_SYMBOL_GPL(add_hwgenerator_randomness); + + /* +- * Handle random seed passed by bootloader. +- * If the seed is trustworthy, it would be regarded as hardware RNGs. Otherwise +- * it would be regarded as device data. +- * The decision is controlled by CONFIG_RANDOM_TRUST_BOOTLOADER. ++ * Handle random seed passed by bootloader, and credit it if ++ * CONFIG_RANDOM_TRUST_BOOTLOADER is set. + */ + void add_bootloader_randomness(const void *buf, size_t size) + { ++ mix_pool_bytes(buf, size); + if (trust_bootloader) +- add_hwgenerator_randomness(buf, size, size * 8); +- else +- add_device_randomness(buf, size); ++ credit_entropy_bits(size * 8); + } + EXPORT_SYMBOL_GPL(add_bootloader_randomness); + +@@ -1320,13 +1278,8 @@ static void mix_interrupt_randomness(str + fast_pool->last = jiffies; + local_irq_enable(); + +- if (unlikely(crng_init == 0)) { +- crng_pre_init_inject(pool, sizeof(pool), true); +- mix_pool_bytes(pool, sizeof(pool)); +- } else { +- mix_pool_bytes(pool, sizeof(pool)); +- credit_entropy_bits(1); +- } ++ mix_pool_bytes(pool, sizeof(pool)); ++ credit_entropy_bits(1); + + memzero_explicit(pool, sizeof(pool)); + } +@@ -1348,8 +1301,7 @@ void add_interrupt_randomness(int irq) + if (new_count & MIX_INFLIGHT) + return; + +- if (new_count < 64 && (!time_is_before_jiffies(fast_pool->last + HZ) || +- unlikely(crng_init == 0))) ++ if (new_count < 64 && !time_is_before_jiffies(fast_pool->last + HZ)) + return; + + if (unlikely(!fast_pool->mix.func)) diff --git a/queue-5.18/random-use-proper-jiffies-comparison-macro.patch b/queue-5.18/random-use-proper-jiffies-comparison-macro.patch new file mode 100644 index 00000000000..27e58705cc8 --- /dev/null +++ b/queue-5.18/random-use-proper-jiffies-comparison-macro.patch @@ -0,0 +1,29 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Tue, 10 May 2022 15:20:42 +0200 +Subject: random: use proper jiffies comparison macro + +From: "Jason A. Donenfeld" + +commit 8a5b8a4a4ceb353b4dd5bafd09e2b15751bcdb51 upstream. + +This expands to exactly the same code that it replaces, but makes things +consistent by using the same macro for jiffy comparisons throughout. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -324,7 +324,7 @@ static bool crng_has_old_seed(void) + interval = max_t(unsigned int, CRNG_RESEED_START_INTERVAL, + (unsigned int)uptime / 2 * HZ); + } +- return time_after(jiffies, READ_ONCE(base_crng.birth) + interval); ++ return time_is_before_jiffies(READ_ONCE(base_crng.birth) + interval); + } + + /* diff --git a/queue-5.18/random-use-proper-return-types-on-get_random_-int-long-_wait.patch b/queue-5.18/random-use-proper-return-types-on-get_random_-int-long-_wait.patch new file mode 100644 index 00000000000..807a2f19cc2 --- /dev/null +++ b/queue-5.18/random-use-proper-return-types-on-get_random_-int-long-_wait.patch @@ -0,0 +1,46 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 13 May 2022 12:32:23 +0200 +Subject: random: use proper return types on get_random_{int,long}_wait() + +From: "Jason A. Donenfeld" + +commit 7c3a8a1db5e03d02cc0abb3357a84b8b326dfac3 upstream. + +Before these were returning signed values, but the API is intended to be +used with unsigned values. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/random.h | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -90,18 +90,18 @@ static inline int get_random_bytes_wait( + return ret; + } + +-#define declare_get_random_var_wait(var) \ +- static inline int get_random_ ## var ## _wait(var *out) { \ ++#define declare_get_random_var_wait(name, ret_type) \ ++ static inline int get_random_ ## name ## _wait(ret_type *out) { \ + int ret = wait_for_random_bytes(); \ + if (unlikely(ret)) \ + return ret; \ +- *out = get_random_ ## var(); \ ++ *out = get_random_ ## name(); \ + return 0; \ + } +-declare_get_random_var_wait(u32) +-declare_get_random_var_wait(u64) +-declare_get_random_var_wait(int) +-declare_get_random_var_wait(long) ++declare_get_random_var_wait(u32, u32) ++declare_get_random_var_wait(u64, u32) ++declare_get_random_var_wait(int, unsigned int) ++declare_get_random_var_wait(long, unsigned long) + #undef declare_get_random_var + + /* diff --git a/queue-5.18/random-use-static-branch-for-crng_ready.patch b/queue-5.18/random-use-static-branch-for-crng_ready.patch new file mode 100644 index 00000000000..a193a1c6dcd --- /dev/null +++ b/queue-5.18/random-use-static-branch-for-crng_ready.patch @@ -0,0 +1,97 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Tue, 3 May 2022 15:30:45 +0200 +Subject: random: use static branch for crng_ready() + +From: "Jason A. Donenfeld" + +commit f5bda35fba615ace70a656d4700423fa6c9bebee upstream. + +Since crng_ready() is only false briefly during initialization and then +forever after becomes true, we don't need to evaluate it after, making +it a prime candidate for a static branch. + +One complication, however, is that it changes state in a particular call +to credit_init_bits(), which might be made from atomic context, which +means we must kick off a workqueue to change the static key. Further +complicating things, credit_init_bits() may be called sufficiently early +on in system initialization such that system_wq is NULL. + +Fortunately, there exists the nice function execute_in_process_context(), +which will immediately execute the function if !in_interrupt(), and +otherwise defer it to a workqueue. During early init, before workqueues +are available, in_interrupt() is always false, because interrupts +haven't even been enabled yet, which means the function in that case +executes immediately. Later on, after workqueues are available, +in_interrupt() might be true, but in that case, the work is queued in +system_wq and all goes well. + +Cc: Theodore Ts'o +Cc: Sultan Alsawaf +Reviewed-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -77,8 +77,9 @@ static enum { + CRNG_EMPTY = 0, /* Little to no entropy collected */ + CRNG_EARLY = 1, /* At least POOL_EARLY_BITS collected */ + CRNG_READY = 2 /* Fully initialized with POOL_READY_BITS collected */ +-} crng_init = CRNG_EMPTY; +-#define crng_ready() (likely(crng_init >= CRNG_READY)) ++} crng_init __read_mostly = CRNG_EMPTY; ++static DEFINE_STATIC_KEY_FALSE(crng_is_ready); ++#define crng_ready() (static_branch_likely(&crng_is_ready) || crng_init >= CRNG_READY) + /* Various types of waiters for crng_init->CRNG_READY transition. */ + static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait); + static struct fasync_struct *fasync; +@@ -108,6 +109,11 @@ bool rng_is_initialized(void) + } + EXPORT_SYMBOL(rng_is_initialized); + ++static void crng_set_ready(struct work_struct *work) ++{ ++ static_branch_enable(&crng_is_ready); ++} ++ + /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */ + static void try_to_generate_entropy(void); + +@@ -267,7 +273,7 @@ static void crng_reseed(void) + ++next_gen; + WRITE_ONCE(base_crng.generation, next_gen); + WRITE_ONCE(base_crng.birth, jiffies); +- if (!crng_ready()) ++ if (!static_branch_likely(&crng_is_ready)) + crng_init = CRNG_READY; + spin_unlock_irqrestore(&base_crng.lock, flags); + memzero_explicit(key, sizeof(key)); +@@ -785,6 +791,7 @@ static void extract_entropy(void *buf, s + + static void credit_init_bits(size_t nbits) + { ++ static struct execute_work set_ready; + unsigned int new, orig, add; + unsigned long flags; + +@@ -800,6 +807,7 @@ static void credit_init_bits(size_t nbit + + if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) { + crng_reseed(); /* Sets crng_init to CRNG_READY under base_crng.lock. */ ++ execute_in_process_context(crng_set_ready, &set_ready); + process_random_ready_list(); + wake_up_interruptible(&crng_init_wait); + kill_fasync(&fasync, SIGIO, POLL_IN); +@@ -1348,7 +1356,7 @@ SYSCALL_DEFINE3(getrandom, char __user * + if (count > INT_MAX) + count = INT_MAX; + +- if (!(flags & GRND_INSECURE) && !crng_ready()) { ++ if (!crng_ready() && !(flags & GRND_INSECURE)) { + int ret; + + if (flags & GRND_NONBLOCK) diff --git a/queue-5.18/random-use-symbolic-constants-for-crng_init-states.patch b/queue-5.18/random-use-symbolic-constants-for-crng_init-states.patch new file mode 100644 index 00000000000..cc8c9e0a8b7 --- /dev/null +++ b/queue-5.18/random-use-symbolic-constants-for-crng_init-states.patch @@ -0,0 +1,125 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sun, 8 May 2022 13:20:30 +0200 +Subject: random: use symbolic constants for crng_init states + +From: "Jason A. Donenfeld" + +commit e3d2c5e79a999aa4e7d6f0127e16d3da5a4ff70d upstream. + +crng_init represents a state machine, with three states, and various +rules for transitions. For the longest time, we've been managing these +with "0", "1", and "2", and expecting people to figure it out. To make +the code more obvious, replace these with proper enum values +representing the transition, and then redocument what each of these +states mean. + +Reviewed-by: Dominik Brodowski +Cc: Joe Perches +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 38 +++++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -70,16 +70,16 @@ + *********************************************************************/ + + /* +- * crng_init = 0 --> Uninitialized +- * 1 --> Initialized +- * 2 --> Initialized from input_pool +- * + * crng_init is protected by base_crng->lock, and only increases +- * its value (from 0->1->2). ++ * its value (from empty->early->ready). + */ +-static int crng_init = 0; +-#define crng_ready() (likely(crng_init > 1)) +-/* Various types of waiters for crng_init->2 transition. */ ++static enum { ++ CRNG_EMPTY = 0, /* Little to no entropy collected */ ++ CRNG_EARLY = 1, /* At least POOL_EARLY_BITS collected */ ++ CRNG_READY = 2 /* Fully initialized with POOL_READY_BITS collected */ ++} crng_init = CRNG_EMPTY; ++#define crng_ready() (likely(crng_init >= CRNG_READY)) ++/* Various types of waiters for crng_init->CRNG_READY transition. */ + static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait); + static struct fasync_struct *fasync; + static DEFINE_SPINLOCK(random_ready_chain_lock); +@@ -282,7 +282,7 @@ static void crng_reseed(void) + WRITE_ONCE(base_crng.generation, next_gen); + WRITE_ONCE(base_crng.birth, jiffies); + if (!crng_ready()) { +- crng_init = 2; ++ crng_init = CRNG_READY; + finalize_init = true; + } + spin_unlock_irqrestore(&base_crng.lock, flags); +@@ -376,7 +376,7 @@ static void crng_make_state(u32 chacha_s + * For the fast path, we check whether we're ready, unlocked first, and + * then re-check once locked later. In the case where we're really not + * ready, we do fast key erasure with the base_crng directly, extracting +- * when crng_init==0. ++ * when crng_init is CRNG_EMPTY. + */ + if (!crng_ready()) { + bool ready; +@@ -384,7 +384,7 @@ static void crng_make_state(u32 chacha_s + spin_lock_irqsave(&base_crng.lock, flags); + ready = crng_ready(); + if (!ready) { +- if (crng_init == 0) ++ if (crng_init == CRNG_EMPTY) + extract_entropy(base_crng.key, sizeof(base_crng.key)); + crng_fast_key_erasure(base_crng.key, chacha_state, + random_data, random_data_len); +@@ -738,8 +738,8 @@ EXPORT_SYMBOL(get_random_bytes_arch); + + enum { + POOL_BITS = BLAKE2S_HASH_SIZE * 8, +- POOL_INIT_BITS = POOL_BITS, /* No point in settling for less. */ +- POOL_FAST_INIT_BITS = POOL_INIT_BITS / 2 ++ POOL_READY_BITS = POOL_BITS, /* When crng_init->CRNG_READY */ ++ POOL_EARLY_BITS = POOL_READY_BITS / 2 /* When crng_init->CRNG_EARLY */ + }; + + static struct { +@@ -834,13 +834,13 @@ static void credit_init_bits(size_t nbit + init_bits = min_t(unsigned int, POOL_BITS, orig + add); + } while (cmpxchg(&input_pool.init_bits, orig, init_bits) != orig); + +- if (!crng_ready() && init_bits >= POOL_INIT_BITS) ++ if (!crng_ready() && init_bits >= POOL_READY_BITS) + crng_reseed(); +- else if (unlikely(crng_init == 0 && init_bits >= POOL_FAST_INIT_BITS)) { ++ else if (unlikely(crng_init == CRNG_EMPTY && init_bits >= POOL_EARLY_BITS)) { + spin_lock_irqsave(&base_crng.lock, flags); +- if (crng_init == 0) { ++ if (crng_init == CRNG_EMPTY) { + extract_entropy(base_crng.key, sizeof(base_crng.key)); +- crng_init = 1; ++ crng_init = CRNG_EARLY; + } + spin_unlock_irqrestore(&base_crng.lock, flags); + } +@@ -1561,7 +1561,7 @@ const struct file_operations urandom_fop + * + * - write_wakeup_threshold - the amount of entropy in the input pool + * below which write polls to /dev/random will unblock, requesting +- * more entropy, tied to the POOL_INIT_BITS constant. It is writable ++ * more entropy, tied to the POOL_READY_BITS constant. It is writable + * to avoid breaking old userspaces, but writing to it does not + * change any behavior of the RNG. + * +@@ -1576,7 +1576,7 @@ const struct file_operations urandom_fop + #include + + static int sysctl_random_min_urandom_seed = CRNG_RESEED_INTERVAL / HZ; +-static int sysctl_random_write_wakeup_bits = POOL_INIT_BITS; ++static int sysctl_random_write_wakeup_bits = POOL_READY_BITS; + static int sysctl_poolsize = POOL_BITS; + static u8 sysctl_bootid[UUID_SIZE]; + diff --git a/queue-5.18/random-wire-up-fops-splice_-read-write-_iter.patch b/queue-5.18/random-wire-up-fops-splice_-read-write-_iter.patch new file mode 100644 index 00000000000..1dda75051c5 --- /dev/null +++ b/queue-5.18/random-wire-up-fops-splice_-read-write-_iter.patch @@ -0,0 +1,45 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: Jens Axboe +Date: Thu, 19 May 2022 17:31:37 -0600 +Subject: random: wire up fops->splice_{read,write}_iter() + +From: Jens Axboe + +commit 79025e727a846be6fd215ae9cdb654368ac3f9a6 upstream. + +Now that random/urandom is using {read,write}_iter, we can wire it up to +using the generic splice handlers. + +Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") +Signed-off-by: Jens Axboe +[Jason: added the splice_write path. Note that sendfile() and such still + does not work for read, though it does for write, because of a file + type restriction in splice_direct_to_actor(), which I'll address + separately.] +Cc: Al Viro +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1429,6 +1429,8 @@ const struct file_operations random_fops + .compat_ioctl = compat_ptr_ioctl, + .fasync = random_fasync, + .llseek = noop_llseek, ++ .splice_read = generic_file_splice_read, ++ .splice_write = iter_file_splice_write, + }; + + const struct file_operations urandom_fops = { +@@ -1438,6 +1440,8 @@ const struct file_operations urandom_fop + .compat_ioctl = compat_ptr_ioctl, + .fasync = random_fasync, + .llseek = noop_llseek, ++ .splice_read = generic_file_splice_read, ++ .splice_write = iter_file_splice_write, + }; + + diff --git a/queue-5.18/riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..5609c6311d1 --- /dev/null +++ b/queue-5.18/riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,40 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: riscv: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit 6d01238623faa9425f820353d2066baf6c9dc872 upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Paul Walmsley +Acked-by: Palmer Dabbelt +Reviewed-by: Palmer Dabbelt +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/timex.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/include/asm/timex.h ++++ b/arch/riscv/include/asm/timex.h +@@ -41,7 +41,7 @@ static inline u32 get_cycles_hi(void) + static inline unsigned long random_get_entropy(void) + { + if (unlikely(clint_time_val == NULL)) +- return 0; ++ return random_get_entropy_fallback(); + return get_cycles(); + } + #define random_get_entropy() random_get_entropy() diff --git a/queue-5.18/s390-define-get_cycles-macro-for-arch-override.patch b/queue-5.18/s390-define-get_cycles-macro-for-arch-override.patch new file mode 100644 index 00000000000..245e24775ad --- /dev/null +++ b/queue-5.18/s390-define-get_cycles-macro-for-arch-override.patch @@ -0,0 +1,39 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 23 Apr 2022 21:11:41 +0200 +Subject: s390: define get_cycles macro for arch-override + +From: "Jason A. Donenfeld" + +commit 2e3df523256cb9836de8441e9c791a796759bb3c upstream. + +S390x defines a get_cycles() function, but it does not do the usual +`#define get_cycles get_cycles` dance, making it impossible for generic +code to see if an arch-specific function was defined. While the +get_cycles() ifdef is not currently used, the following timekeeping +patch in this series will depend on the macro existing (or not existing) +when defining random_get_entropy(). + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Vasily Gorbik +Cc: Alexander Gordeev +Cc: Christian Borntraeger +Cc: Sven Schnelle +Acked-by: Heiko Carstens +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/timex.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -197,6 +197,7 @@ static inline cycles_t get_cycles(void) + { + return (cycles_t) get_tod_clock() >> 2; + } ++#define get_cycles get_cycles + + int get_phys_clock(unsigned long *clock); + void init_cpu_timer(void); diff --git a/queue-5.18/series b/queue-5.18/series index eb07e808014..491ded1208a 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -1,2 +1,45 @@ lockdown-also-lock-down-previous-kgdb-use.patch hid-amd_sfh-add-support-for-sensor-discovery.patch +random-fix-sysctl-documentation-nits.patch +init-call-time_init-before-rand_initialize.patch +ia64-define-get_cycles-macro-for-arch-override.patch +s390-define-get_cycles-macro-for-arch-override.patch +parisc-define-get_cycles-macro-for-arch-override.patch +alpha-define-get_cycles-macro-for-arch-override.patch +powerpc-define-get_cycles-macro-for-arch-override.patch +timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch +m68k-use-fallback-for-random_get_entropy-instead-of-zero.patch +riscv-use-fallback-for-random_get_entropy-instead-of-zero.patch +mips-use-fallback-for-random_get_entropy-instead-of-just-c0-random.patch +arm-use-fallback-for-random_get_entropy-instead-of-zero.patch +nios2-use-fallback-for-random_get_entropy-instead-of-zero.patch +x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch +um-use-fallback-for-random_get_entropy-instead-of-zero.patch +sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch +xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch +random-insist-on-random_get_entropy-existing-in-order-to-simplify.patch +random-do-not-use-batches-when-crng_ready.patch +random-use-first-128-bits-of-input-as-fast-init.patch +random-do-not-pretend-to-handle-premature-next-security-model.patch +random-order-timer-entropy-functions-below-interrupt-functions.patch +random-do-not-use-input-pool-from-hard-irqs.patch +random-help-compiler-out-with-fast_mix-by-using-simpler-arguments.patch +siphash-use-one-source-of-truth-for-siphash-permutations.patch +random-use-symbolic-constants-for-crng_init-states.patch +random-avoid-initializing-twice-in-credit-race.patch +random-move-initialization-out-of-reseeding-hot-path.patch +random-remove-ratelimiting-for-in-kernel-unseeded-randomness.patch +random-use-proper-jiffies-comparison-macro.patch +random-handle-latent-entropy-and-command-line-from-random_init.patch +random-credit-architectural-init-the-exact-amount.patch +random-use-static-branch-for-crng_ready.patch +random-remove-extern-from-functions-in-header.patch +random-use-proper-return-types-on-get_random_-int-long-_wait.patch +random-make-consistent-use-of-buf-and-len.patch +random-move-initialization-functions-out-of-hot-pages.patch +random-move-randomize_page-into-mm-where-it-belongs.patch +random-unify-batched-entropy-implementations.patch +random-convert-to-using-fops-read_iter.patch +random-convert-to-using-fops-write_iter.patch +random-wire-up-fops-splice_-read-write-_iter.patch +random-check-for-signals-after-page-of-pool-writes.patch diff --git a/queue-5.18/siphash-use-one-source-of-truth-for-siphash-permutations.patch b/queue-5.18/siphash-use-one-source-of-truth-for-siphash-permutations.patch new file mode 100644 index 00000000000..70b8455167c --- /dev/null +++ b/queue-5.18/siphash-use-one-source-of-truth-for-siphash-permutations.patch @@ -0,0 +1,223 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sat, 7 May 2022 14:03:46 +0200 +Subject: siphash: use one source of truth for siphash permutations + +From: "Jason A. Donenfeld" + +commit e73aaae2fa9024832e1f42e30c787c7baf61d014 upstream. + +The SipHash family of permutations is currently used in three places: + +- siphash.c itself, used in the ordinary way it was intended. +- random32.c, in a construction from an anonymous contributor. +- random.c, as part of its fast_mix function. + +Each one of these places reinvents the wheel with the same C code, same +rotation constants, and same symmetry-breaking constants. + +This commit tidies things up a bit by placing macros for the +permutations and constants into siphash.h, where each of the three .c +users can access them. It also leaves a note dissuading more users of +them from emerging. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 30 +++++++----------------------- + include/linux/prandom.h | 23 +++++++---------------- + include/linux/siphash.h | 28 ++++++++++++++++++++++++++++ + lib/siphash.c | 32 ++++++++++---------------------- + 4 files changed, 52 insertions(+), 61 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -51,6 +51,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1053,12 +1054,11 @@ struct fast_pool { + + static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = { + #ifdef CONFIG_64BIT +- /* SipHash constants */ +- .pool = { 0x736f6d6570736575UL, 0x646f72616e646f6dUL, +- 0x6c7967656e657261UL, 0x7465646279746573UL } ++#define FASTMIX_PERM SIPHASH_PERMUTATION ++ .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 } + #else +- /* HalfSipHash constants */ +- .pool = { 0, 0, 0x6c796765U, 0x74656462U } ++#define FASTMIX_PERM HSIPHASH_PERMUTATION ++ .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 } + #endif + }; + +@@ -1070,27 +1070,11 @@ static DEFINE_PER_CPU(struct fast_pool, + */ + static void fast_mix(unsigned long s[4], unsigned long v1, unsigned long v2) + { +-#ifdef CONFIG_64BIT +-#define PERM() do { \ +- s[0] += s[1]; s[1] = rol64(s[1], 13); s[1] ^= s[0]; s[0] = rol64(s[0], 32); \ +- s[2] += s[3]; s[3] = rol64(s[3], 16); s[3] ^= s[2]; \ +- s[0] += s[3]; s[3] = rol64(s[3], 21); s[3] ^= s[0]; \ +- s[2] += s[1]; s[1] = rol64(s[1], 17); s[1] ^= s[2]; s[2] = rol64(s[2], 32); \ +-} while (0) +-#else +-#define PERM() do { \ +- s[0] += s[1]; s[1] = rol32(s[1], 5); s[1] ^= s[0]; s[0] = rol32(s[0], 16); \ +- s[2] += s[3]; s[3] = rol32(s[3], 8); s[3] ^= s[2]; \ +- s[0] += s[3]; s[3] = rol32(s[3], 7); s[3] ^= s[0]; \ +- s[2] += s[1]; s[1] = rol32(s[1], 13); s[1] ^= s[2]; s[2] = rol32(s[2], 16); \ +-} while (0) +-#endif +- + s[3] ^= v1; +- PERM(); ++ FASTMIX_PERM(s[0], s[1], s[2], s[3]); + s[0] ^= v1; + s[3] ^= v2; +- PERM(); ++ FASTMIX_PERM(s[0], s[1], s[2], s[3]); + s[0] ^= v2; + } + +--- a/include/linux/prandom.h ++++ b/include/linux/prandom.h +@@ -10,6 +10,7 @@ + + #include + #include ++#include + + u32 prandom_u32(void); + void prandom_bytes(void *buf, size_t nbytes); +@@ -27,15 +28,10 @@ DECLARE_PER_CPU(unsigned long, net_rand_ + * The core SipHash round function. Each line can be executed in + * parallel given enough CPU resources. + */ +-#define PRND_SIPROUND(v0, v1, v2, v3) ( \ +- v0 += v1, v1 = rol64(v1, 13), v2 += v3, v3 = rol64(v3, 16), \ +- v1 ^= v0, v0 = rol64(v0, 32), v3 ^= v2, \ +- v0 += v3, v3 = rol64(v3, 21), v2 += v1, v1 = rol64(v1, 17), \ +- v3 ^= v0, v1 ^= v2, v2 = rol64(v2, 32) \ +-) ++#define PRND_SIPROUND(v0, v1, v2, v3) SIPHASH_PERMUTATION(v0, v1, v2, v3) + +-#define PRND_K0 (0x736f6d6570736575 ^ 0x6c7967656e657261) +-#define PRND_K1 (0x646f72616e646f6d ^ 0x7465646279746573) ++#define PRND_K0 (SIPHASH_CONST_0 ^ SIPHASH_CONST_2) ++#define PRND_K1 (SIPHASH_CONST_1 ^ SIPHASH_CONST_3) + + #elif BITS_PER_LONG == 32 + /* +@@ -43,14 +39,9 @@ DECLARE_PER_CPU(unsigned long, net_rand_ + * This is weaker, but 32-bit machines are not used for high-traffic + * applications, so there is less output for an attacker to analyze. + */ +-#define PRND_SIPROUND(v0, v1, v2, v3) ( \ +- v0 += v1, v1 = rol32(v1, 5), v2 += v3, v3 = rol32(v3, 8), \ +- v1 ^= v0, v0 = rol32(v0, 16), v3 ^= v2, \ +- v0 += v3, v3 = rol32(v3, 7), v2 += v1, v1 = rol32(v1, 13), \ +- v3 ^= v0, v1 ^= v2, v2 = rol32(v2, 16) \ +-) +-#define PRND_K0 0x6c796765 +-#define PRND_K1 0x74656462 ++#define PRND_SIPROUND(v0, v1, v2, v3) HSIPHASH_PERMUTATION(v0, v1, v2, v3) ++#define PRND_K0 (HSIPHASH_CONST_0 ^ HSIPHASH_CONST_2) ++#define PRND_K1 (HSIPHASH_CONST_1 ^ HSIPHASH_CONST_3) + + #else + #error Unsupported BITS_PER_LONG +--- a/include/linux/siphash.h ++++ b/include/linux/siphash.h +@@ -138,4 +138,32 @@ static inline u32 hsiphash(const void *d + return ___hsiphash_aligned(data, len, key); + } + ++/* ++ * These macros expose the raw SipHash and HalfSipHash permutations. ++ * Do not use them directly! If you think you have a use for them, ++ * be sure to CC the maintainer of this file explaining why. ++ */ ++ ++#define SIPHASH_PERMUTATION(a, b, c, d) ( \ ++ (a) += (b), (b) = rol64((b), 13), (b) ^= (a), (a) = rol64((a), 32), \ ++ (c) += (d), (d) = rol64((d), 16), (d) ^= (c), \ ++ (a) += (d), (d) = rol64((d), 21), (d) ^= (a), \ ++ (c) += (b), (b) = rol64((b), 17), (b) ^= (c), (c) = rol64((c), 32)) ++ ++#define SIPHASH_CONST_0 0x736f6d6570736575ULL ++#define SIPHASH_CONST_1 0x646f72616e646f6dULL ++#define SIPHASH_CONST_2 0x6c7967656e657261ULL ++#define SIPHASH_CONST_3 0x7465646279746573ULL ++ ++#define HSIPHASH_PERMUTATION(a, b, c, d) ( \ ++ (a) += (b), (b) = rol32((b), 5), (b) ^= (a), (a) = rol32((a), 16), \ ++ (c) += (d), (d) = rol32((d), 8), (d) ^= (c), \ ++ (a) += (d), (d) = rol32((d), 7), (d) ^= (a), \ ++ (c) += (b), (b) = rol32((b), 13), (b) ^= (c), (c) = rol32((c), 16)) ++ ++#define HSIPHASH_CONST_0 0U ++#define HSIPHASH_CONST_1 0U ++#define HSIPHASH_CONST_2 0x6c796765U ++#define HSIPHASH_CONST_3 0x74656462U ++ + #endif /* _LINUX_SIPHASH_H */ +--- a/lib/siphash.c ++++ b/lib/siphash.c +@@ -18,19 +18,13 @@ + #include + #endif + +-#define SIPROUND \ +- do { \ +- v0 += v1; v1 = rol64(v1, 13); v1 ^= v0; v0 = rol64(v0, 32); \ +- v2 += v3; v3 = rol64(v3, 16); v3 ^= v2; \ +- v0 += v3; v3 = rol64(v3, 21); v3 ^= v0; \ +- v2 += v1; v1 = rol64(v1, 17); v1 ^= v2; v2 = rol64(v2, 32); \ +- } while (0) ++#define SIPROUND SIPHASH_PERMUTATION(v0, v1, v2, v3) + + #define PREAMBLE(len) \ +- u64 v0 = 0x736f6d6570736575ULL; \ +- u64 v1 = 0x646f72616e646f6dULL; \ +- u64 v2 = 0x6c7967656e657261ULL; \ +- u64 v3 = 0x7465646279746573ULL; \ ++ u64 v0 = SIPHASH_CONST_0; \ ++ u64 v1 = SIPHASH_CONST_1; \ ++ u64 v2 = SIPHASH_CONST_2; \ ++ u64 v3 = SIPHASH_CONST_3; \ + u64 b = ((u64)(len)) << 56; \ + v3 ^= key->key[1]; \ + v2 ^= key->key[0]; \ +@@ -389,19 +383,13 @@ u32 hsiphash_4u32(const u32 first, const + } + EXPORT_SYMBOL(hsiphash_4u32); + #else +-#define HSIPROUND \ +- do { \ +- v0 += v1; v1 = rol32(v1, 5); v1 ^= v0; v0 = rol32(v0, 16); \ +- v2 += v3; v3 = rol32(v3, 8); v3 ^= v2; \ +- v0 += v3; v3 = rol32(v3, 7); v3 ^= v0; \ +- v2 += v1; v1 = rol32(v1, 13); v1 ^= v2; v2 = rol32(v2, 16); \ +- } while (0) ++#define HSIPROUND HSIPHASH_PERMUTATION(v0, v1, v2, v3) + + #define HPREAMBLE(len) \ +- u32 v0 = 0; \ +- u32 v1 = 0; \ +- u32 v2 = 0x6c796765U; \ +- u32 v3 = 0x74656462U; \ ++ u32 v0 = HSIPHASH_CONST_0; \ ++ u32 v1 = HSIPHASH_CONST_1; \ ++ u32 v2 = HSIPHASH_CONST_2; \ ++ u32 v3 = HSIPHASH_CONST_3; \ + u32 b = ((u32)(len)) << 24; \ + v3 ^= key->key[1]; \ + v2 ^= key->key[0]; \ diff --git a/queue-5.18/sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..d65ae798842 --- /dev/null +++ b/queue-5.18/sparc-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,43 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: sparc: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit ac9756c79797bb98972736b13cfb239fd2cffb79 upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +This is accomplished by just including the asm-generic code like on +other architectures, which means we can get rid of the empty stub +function here. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: David S. Miller +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/timex_32.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/sparc/include/asm/timex_32.h ++++ b/arch/sparc/include/asm/timex_32.h +@@ -9,8 +9,6 @@ + + #define CLOCK_TICK_RATE 1193180 /* Underlying HZ */ + +-/* XXX Maybe do something better at some point... -DaveM */ +-typedef unsigned long cycles_t; +-#define get_cycles() (0) ++#include + + #endif diff --git a/queue-5.18/timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch b/queue-5.18/timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch new file mode 100644 index 00000000000..d64f455f416 --- /dev/null +++ b/queue-5.18/timekeeping-add-raw-clock-fallback-for-random_get_entropy.patch @@ -0,0 +1,100 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Sun, 10 Apr 2022 16:49:50 +0200 +Subject: timekeeping: Add raw clock fallback for random_get_entropy() + +From: "Jason A. Donenfeld" + +commit 1366992e16bddd5e2d9a561687f367f9f802e2e4 upstream. + +The addition of random_get_entropy_fallback() provides access to +whichever time source has the highest frequency, which is useful for +gathering entropy on platforms without available cycle counters. It's +not necessarily as good as being able to quickly access a cycle counter +that the CPU has, but it's still something, even when it falls back to +being jiffies-based. + +In the event that a given arch does not define get_cycles(), falling +back to the get_cycles() default implementation that returns 0 is really +not the best we can do. Instead, at least calling +random_get_entropy_fallback() would be preferable, because that always +needs to return _something_, even falling back to jiffies eventually. +It's not as though random_get_entropy_fallback() is super high precision +or guaranteed to be entropic, but basically anything that's not zero all +the time is better than returning zero all the time. + +Finally, since random_get_entropy_fallback() is used during extremely +early boot when randomizing freelists in mm_init(), it can be called +before timekeeping has been initialized. In that case there really is +nothing we can do; jiffies hasn't even started ticking yet. So just give +up and return 0. + +Suggested-by: Thomas Gleixner +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Theodore Ts'o +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/timex.h | 8 ++++++++ + kernel/time/timekeeping.c | 15 +++++++++++++++ + 2 files changed, 23 insertions(+) + +--- a/include/linux/timex.h ++++ b/include/linux/timex.h +@@ -62,6 +62,8 @@ + #include + #include + ++unsigned long random_get_entropy_fallback(void); ++ + #include + + #ifndef random_get_entropy +@@ -74,8 +76,14 @@ + * + * By default we use get_cycles() for this purpose, but individual + * architectures may override this in their asm/timex.h header file. ++ * If a given arch does not have get_cycles(), then we fallback to ++ * using random_get_entropy_fallback(). + */ ++#ifdef get_cycles + #define random_get_entropy() ((unsigned long)get_cycles()) ++#else ++#define random_get_entropy() random_get_entropy_fallback() ++#endif + #endif + + /* +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2380,6 +2381,20 @@ static int timekeeping_validate_timex(co + return 0; + } + ++/** ++ * random_get_entropy_fallback - Returns the raw clock source value, ++ * used by random.c for platforms with no valid random_get_entropy(). ++ */ ++unsigned long random_get_entropy_fallback(void) ++{ ++ struct tk_read_base *tkr = &tk_core.timekeeper.tkr_mono; ++ struct clocksource *clock = READ_ONCE(tkr->clock); ++ ++ if (unlikely(timekeeping_suspended || !clock)) ++ return 0; ++ return clock->read(clock); ++} ++EXPORT_SYMBOL_GPL(random_get_entropy_fallback); + + /** + * do_adjtimex() - Accessor function to NTP __do_adjtimex function diff --git a/queue-5.18/um-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/um-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..23c36efcf1b --- /dev/null +++ b/queue-5.18/um-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,51 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: um: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit 9f13fb0cd11ed2327abff69f6501a2c124c88b5a upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +This is accomplished by just including the asm-generic code like on +other architectures, which means we can get rid of the empty stub +function here. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Richard Weinberger +Cc: Anton Ivanov +Acked-by: Johannes Berg +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/um/include/asm/timex.h | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/arch/um/include/asm/timex.h ++++ b/arch/um/include/asm/timex.h +@@ -2,13 +2,8 @@ + #ifndef __UM_TIMEX_H + #define __UM_TIMEX_H + +-typedef unsigned long cycles_t; +- +-static inline cycles_t get_cycles (void) +-{ +- return 0; +-} +- + #define CLOCK_TICK_RATE (HZ) + ++#include ++ + #endif diff --git a/queue-5.18/x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..116003f0118 --- /dev/null +++ b/queue-5.18/x86-tsc-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,73 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: x86/tsc: Use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit 3bd4abc07a267e6a8b33d7f8717136e18f921c53 upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is suboptimal. Instead, fallback +to calling random_get_entropy_fallback(), which isn't extremely high +precision or guaranteed to be entropic, but is certainly better than +returning zero all the time. + +If CONFIG_X86_TSC=n, then it's possible for the kernel to run on systems +without RDTSC, such as 486 and certain 586, so the fallback code is only +required for that case. + +As well, fix up both the new function and the get_cycles() function from +which it was derived to use cpu_feature_enabled() rather than +boot_cpu_has(), and use !IS_ENABLED() instead of #ifndef. + +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Thomas Gleixner +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Cc: Borislav Petkov +Cc: x86@kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/timex.h | 9 +++++++++ + arch/x86/include/asm/tsc.h | 7 +++---- + 2 files changed, 12 insertions(+), 4 deletions(-) + +--- a/arch/x86/include/asm/timex.h ++++ b/arch/x86/include/asm/timex.h +@@ -5,6 +5,15 @@ + #include + #include + ++static inline unsigned long random_get_entropy(void) ++{ ++ if (!IS_ENABLED(CONFIG_X86_TSC) && ++ !cpu_feature_enabled(X86_FEATURE_TSC)) ++ return random_get_entropy_fallback(); ++ return rdtsc(); ++} ++#define random_get_entropy random_get_entropy ++ + /* Assume we use the PIT time source for the clock tick */ + #define CLOCK_TICK_RATE PIT_TICK_RATE + +--- a/arch/x86/include/asm/tsc.h ++++ b/arch/x86/include/asm/tsc.h +@@ -20,13 +20,12 @@ extern void disable_TSC(void); + + static inline cycles_t get_cycles(void) + { +-#ifndef CONFIG_X86_TSC +- if (!boot_cpu_has(X86_FEATURE_TSC)) ++ if (!IS_ENABLED(CONFIG_X86_TSC) && ++ !cpu_feature_enabled(X86_FEATURE_TSC)) + return 0; +-#endif +- + return rdtsc(); + } ++#define get_cycles get_cycles + + extern struct system_counterval_t convert_art_to_tsc(u64 art); + extern struct system_counterval_t convert_art_ns_to_tsc(u64 art_ns); diff --git a/queue-5.18/xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch b/queue-5.18/xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch new file mode 100644 index 00000000000..3470723b4d7 --- /dev/null +++ b/queue-5.18/xtensa-use-fallback-for-random_get_entropy-instead-of-zero.patch @@ -0,0 +1,51 @@ +From foo@baz Thu May 26 04:17:01 PM CEST 2022 +From: "Jason A. Donenfeld" +Date: Fri, 8 Apr 2022 18:03:13 +0200 +Subject: xtensa: use fallback for random_get_entropy() instead of zero + +From: "Jason A. Donenfeld" + +commit e10e2f58030c5c211d49042a8c2a1b93d40b2ffb upstream. + +In the event that random_get_entropy() can't access a cycle counter or +similar, falling back to returning 0 is really not the best we can do. +Instead, at least calling random_get_entropy_fallback() would be +preferable, because that always needs to return _something_, even +falling back to jiffies eventually. It's not as though +random_get_entropy_fallback() is super high precision or guaranteed to +be entropic, but basically anything that's not zero all the time is +better than returning zero all the time. + +This is accomplished by just including the asm-generic code like on +other architectures, which means we can get rid of the empty stub +function here. + +Cc: Thomas Gleixner +Cc: Arnd Bergmann +Acked-by: Max Filippov +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/xtensa/include/asm/timex.h | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/arch/xtensa/include/asm/timex.h ++++ b/arch/xtensa/include/asm/timex.h +@@ -29,10 +29,6 @@ + + extern unsigned long ccount_freq; + +-typedef unsigned long long cycles_t; +- +-#define get_cycles() (0) +- + void local_timer_setup(unsigned cpu); + + /* +@@ -59,4 +55,6 @@ static inline void set_linux_timer (unsi + xtensa_set_sr(ccompare, SREG_CCOMPARE + LINUX_TIMER); + } + ++#include ++ + #endif /* _XTENSA_TIMEX_H */ -- 2.47.3