1a07fdae3SJason A. Donenfeld // SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 21da177e4SLinus Torvalds /* 39f9eff85SJason A. Donenfeld * Copyright (C) 2017-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 49e95ce27SMatt Mackall * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005 55f75d9f3SJason A. Donenfeld * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999. All rights reserved. 61da177e4SLinus Torvalds * 75f75d9f3SJason A. Donenfeld * This driver produces cryptographically secure pseudorandom data. It is divided 85f75d9f3SJason A. Donenfeld * into roughly six sections, each with a section header: 91da177e4SLinus Torvalds * 105f75d9f3SJason A. Donenfeld * - Initialization and readiness waiting. 115f75d9f3SJason A. Donenfeld * - Fast key erasure RNG, the "crng". 125f75d9f3SJason A. Donenfeld * - Entropy accumulation and extraction routines. 135f75d9f3SJason A. Donenfeld * - Entropy collection routines. 145f75d9f3SJason A. Donenfeld * - Userspace reader/writer interfaces. 155f75d9f3SJason A. Donenfeld * - Sysctl interface. 161da177e4SLinus Torvalds * 175f75d9f3SJason A. Donenfeld * The high level overview is that there is one input pool, into which 18e85c0fc1SJason A. Donenfeld * various pieces of data are hashed. Prior to initialization, some of that 19e85c0fc1SJason A. Donenfeld * data is then "credited" as having a certain number of bits of entropy. 20e85c0fc1SJason A. Donenfeld * When enough bits of entropy are available, the hash is finalized and 21e85c0fc1SJason A. Donenfeld * handed as a key to a stream cipher that expands it indefinitely for 22e85c0fc1SJason A. Donenfeld * various consumers. This key is periodically refreshed as the various 23e85c0fc1SJason A. Donenfeld * entropy collectors, described below, add data to the input pool. 241da177e4SLinus Torvalds */ 251da177e4SLinus Torvalds 2612cd53afSYangtao Li #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 2712cd53afSYangtao Li 281da177e4SLinus Torvalds #include <linux/utsname.h> 291da177e4SLinus Torvalds #include <linux/module.h> 301da177e4SLinus Torvalds #include <linux/kernel.h> 311da177e4SLinus Torvalds #include <linux/major.h> 321da177e4SLinus Torvalds #include <linux/string.h> 331da177e4SLinus Torvalds #include <linux/fcntl.h> 341da177e4SLinus Torvalds #include <linux/slab.h> 351da177e4SLinus Torvalds #include <linux/random.h> 361da177e4SLinus Torvalds #include <linux/poll.h> 371da177e4SLinus Torvalds #include <linux/init.h> 381da177e4SLinus Torvalds #include <linux/fs.h> 39322cbb50SChristoph Hellwig #include <linux/blkdev.h> 401da177e4SLinus Torvalds #include <linux/interrupt.h> 4127ac792cSAndrea Righi #include <linux/mm.h> 42dd0f0cf5SMichael Ellerman #include <linux/nodemask.h> 431da177e4SLinus Torvalds #include <linux/spinlock.h> 44c84dbf61STorsten Duwe #include <linux/kthread.h> 451da177e4SLinus Torvalds #include <linux/percpu.h> 46775f4b29STheodore Ts'o #include <linux/ptrace.h> 476265e169STheodore Ts'o #include <linux/workqueue.h> 48d178a1ebSYinghai Lu #include <linux/irq.h> 494e00b339STheodore Ts'o #include <linux/ratelimit.h> 50c6e9d6f3STheodore Ts'o #include <linux/syscalls.h> 51c6e9d6f3STheodore Ts'o #include <linux/completion.h> 528da4b8c4SAndy Shevchenko #include <linux/uuid.h> 5387e7d5abSJason A. Donenfeld #include <linux/uaccess.h> 54b7b67d13SJason A. Donenfeld #include <linux/suspend.h> 55e73aaae2SJason A. Donenfeld #include <linux/siphash.h> 561c21fe00SJason A. Donenfeld #include <linux/sched/isolation.h> 571ca1b917SEric Biggers #include <crypto/chacha.h> 589f9eff85SJason A. Donenfeld #include <crypto/blake2s.h> 59*6bb20c15SJason A. Donenfeld #include <asm/archrandom.h> 601da177e4SLinus Torvalds #include <asm/processor.h> 611da177e4SLinus Torvalds #include <asm/irq.h> 62775f4b29STheodore Ts'o #include <asm/irq_regs.h> 631da177e4SLinus Torvalds #include <asm/io.h> 641da177e4SLinus Torvalds 655f1bb112SJason A. Donenfeld /********************************************************************* 665f1bb112SJason A. Donenfeld * 675f1bb112SJason A. Donenfeld * Initialization and readiness waiting. 685f1bb112SJason A. Donenfeld * 695f1bb112SJason A. Donenfeld * Much of the RNG infrastructure is devoted to various dependencies 705f1bb112SJason A. Donenfeld * being able to wait until the RNG has collected enough entropy and 715f1bb112SJason A. Donenfeld * is ready for safe consumption. 725f1bb112SJason A. Donenfeld * 735f1bb112SJason A. Donenfeld *********************************************************************/ 745f1bb112SJason A. Donenfeld 755f1bb112SJason A. Donenfeld /* 765f1bb112SJason A. Donenfeld * crng_init is protected by base_crng->lock, and only increases 77e3d2c5e7SJason A. Donenfeld * its value (from empty->early->ready). 785f1bb112SJason A. Donenfeld */ 79e3d2c5e7SJason A. Donenfeld static enum { 80e3d2c5e7SJason A. Donenfeld CRNG_EMPTY = 0, /* Little to no entropy collected */ 81e3d2c5e7SJason A. Donenfeld CRNG_EARLY = 1, /* At least POOL_EARLY_BITS collected */ 82e3d2c5e7SJason A. Donenfeld CRNG_READY = 2 /* Fully initialized with POOL_READY_BITS collected */ 83f5bda35fSJason A. Donenfeld } crng_init __read_mostly = CRNG_EMPTY; 84f5bda35fSJason A. Donenfeld static DEFINE_STATIC_KEY_FALSE(crng_is_ready); 85f5bda35fSJason A. Donenfeld #define crng_ready() (static_branch_likely(&crng_is_ready) || crng_init >= CRNG_READY) 86e3d2c5e7SJason A. Donenfeld /* Various types of waiters for crng_init->CRNG_READY transition. */ 875f1bb112SJason A. Donenfeld static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait); 885f1bb112SJason A. Donenfeld static struct fasync_struct *fasync; 89bbc7e1beSJason A. Donenfeld static ATOMIC_NOTIFIER_HEAD(random_ready_notifier); 905f1bb112SJason A. Donenfeld 915f1bb112SJason A. Donenfeld /* Control how we warn userspace. */ 920313bc27SLinus Torvalds static struct ratelimit_state urandom_warning = 93c01d4d0aSJason A. Donenfeld RATELIMIT_STATE_INIT_FLAGS("urandom_warning", HZ, 3, RATELIMIT_MSG_ON_RELEASE); 94cc1e127bSJason A. Donenfeld static int ratelimit_disable __read_mostly = 95cc1e127bSJason A. Donenfeld IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM); 965f1bb112SJason A. Donenfeld module_param_named(ratelimit_disable, ratelimit_disable, int, 0644); 975f1bb112SJason A. Donenfeld MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression"); 985f1bb112SJason A. Donenfeld 995f1bb112SJason A. Donenfeld /* 1005f1bb112SJason A. Donenfeld * Returns whether or not the input pool has been seeded and thus guaranteed 1010313bc27SLinus Torvalds * to supply cryptographically secure random numbers. This applies to: the 102a890d1c6SJason A. Donenfeld * /dev/urandom device, the get_random_bytes function, and the get_random_{u8, 103de492c83SJason A. Donenfeld * u16,u32,u64,long} family of functions. 1045f1bb112SJason A. Donenfeld * 1055f1bb112SJason A. Donenfeld * Returns: true if the input pool has been seeded. 1065f1bb112SJason A. Donenfeld * false if the input pool has not been seeded. 1075f1bb112SJason A. Donenfeld */ 1085f1bb112SJason A. Donenfeld bool rng_is_initialized(void) 1095f1bb112SJason A. Donenfeld { 1105f1bb112SJason A. Donenfeld return crng_ready(); 1115f1bb112SJason A. Donenfeld } 1125f1bb112SJason A. Donenfeld EXPORT_SYMBOL(rng_is_initialized); 1135f1bb112SJason A. Donenfeld 114560181c2SJason A. Donenfeld static void __cold crng_set_ready(struct work_struct *work) 115f5bda35fSJason A. Donenfeld { 116f5bda35fSJason A. Donenfeld static_branch_enable(&crng_is_ready); 117f5bda35fSJason A. Donenfeld } 118f5bda35fSJason A. Donenfeld 1195f1bb112SJason A. Donenfeld /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */ 1205f1bb112SJason A. Donenfeld static void try_to_generate_entropy(void); 1215f1bb112SJason A. Donenfeld 1225f1bb112SJason A. Donenfeld /* 1235f1bb112SJason A. Donenfeld * Wait for the input pool to be seeded and thus guaranteed to supply 1240313bc27SLinus Torvalds * cryptographically secure random numbers. This applies to: the /dev/urandom 125a890d1c6SJason A. Donenfeld * device, the get_random_bytes function, and the get_random_{u8,u16,u32,u64, 126b240bab5SJason A. Donenfeld * long} family of functions. Using any of these functions without first 127a890d1c6SJason A. Donenfeld * calling this function forfeits the guarantee of security. 1285f1bb112SJason A. Donenfeld * 1295f1bb112SJason A. Donenfeld * Returns: 0 if the input pool has been seeded. 1305f1bb112SJason A. Donenfeld * -ERESTARTSYS if the function was interrupted by a signal. 1315f1bb112SJason A. Donenfeld */ 1325f1bb112SJason A. Donenfeld int wait_for_random_bytes(void) 1335f1bb112SJason A. Donenfeld { 134a96cfe2dSJason A. Donenfeld while (!crng_ready()) { 1355f1bb112SJason A. Donenfeld int ret; 1363e504d20SJason A. Donenfeld 1373e504d20SJason A. Donenfeld try_to_generate_entropy(); 1385f1bb112SJason A. Donenfeld ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ); 1395f1bb112SJason A. Donenfeld if (ret) 1405f1bb112SJason A. Donenfeld return ret > 0 ? 0 : ret; 141a96cfe2dSJason A. Donenfeld } 1425f1bb112SJason A. Donenfeld return 0; 1435f1bb112SJason A. Donenfeld } 1445f1bb112SJason A. Donenfeld EXPORT_SYMBOL(wait_for_random_bytes); 1455f1bb112SJason A. Donenfeld 146bbc7e1beSJason A. Donenfeld /* 147bbc7e1beSJason A. Donenfeld * Add a callback function that will be invoked when the crng is initialised, 148bbc7e1beSJason A. Donenfeld * or immediately if it already has been. Only use this is you are absolutely 149bbc7e1beSJason A. Donenfeld * sure it is required. Most users should instead be able to test 150bbc7e1beSJason A. Donenfeld * `rng_is_initialized()` on demand, or make use of `get_random_bytes_wait()`. 151bbc7e1beSJason A. Donenfeld */ 152bbc7e1beSJason A. Donenfeld int __cold execute_with_initialized_rng(struct notifier_block *nb) 153bbc7e1beSJason A. Donenfeld { 154bbc7e1beSJason A. Donenfeld unsigned long flags; 155bbc7e1beSJason A. Donenfeld int ret = 0; 156bbc7e1beSJason A. Donenfeld 157bbc7e1beSJason A. Donenfeld spin_lock_irqsave(&random_ready_notifier.lock, flags); 158bbc7e1beSJason A. Donenfeld if (crng_ready()) 159bbc7e1beSJason A. Donenfeld nb->notifier_call(nb, 0, NULL); 160bbc7e1beSJason A. Donenfeld else 161bbc7e1beSJason A. Donenfeld ret = raw_notifier_chain_register((struct raw_notifier_head *)&random_ready_notifier.head, nb); 162bbc7e1beSJason A. Donenfeld spin_unlock_irqrestore(&random_ready_notifier.lock, flags); 163bbc7e1beSJason A. Donenfeld return ret; 164bbc7e1beSJason A. Donenfeld } 165bbc7e1beSJason A. Donenfeld 166cc1e127bSJason A. Donenfeld #define warn_unseeded_randomness() \ 167560181c2SJason A. Donenfeld if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \ 168560181c2SJason A. Donenfeld printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \ 169560181c2SJason A. Donenfeld __func__, (void *)_RET_IP_, crng_init) 1705f1bb112SJason A. Donenfeld 1715f1bb112SJason A. Donenfeld 1723655adc7SJason A. Donenfeld /********************************************************************* 1733655adc7SJason A. Donenfeld * 1743655adc7SJason A. Donenfeld * Fast key erasure RNG, the "crng". 1753655adc7SJason A. Donenfeld * 1763655adc7SJason A. Donenfeld * These functions expand entropy from the entropy extractor into 1773655adc7SJason A. Donenfeld * long streams for external consumption using the "fast key erasure" 1783655adc7SJason A. Donenfeld * RNG described at <https://blog.cr.yp.to/20170723-random.html>. 1793655adc7SJason A. Donenfeld * 1803655adc7SJason A. Donenfeld * There are a few exported interfaces for use by other drivers: 1813655adc7SJason A. Donenfeld * 182a1940263SJason A. Donenfeld * void get_random_bytes(void *buf, size_t len) 183a890d1c6SJason A. Donenfeld * u8 get_random_u8() 184a890d1c6SJason A. Donenfeld * u16 get_random_u16() 1853655adc7SJason A. Donenfeld * u32 get_random_u32() 186e9a688bcSJason A. Donenfeld * u32 get_random_u32_below(u32 ceil) 1877f576b25SJason A. Donenfeld * u32 get_random_u32_above(u32 floor) 1887f576b25SJason A. Donenfeld * u32 get_random_u32_inclusive(u32 floor, u32 ceil) 1893655adc7SJason A. Donenfeld * u64 get_random_u64() 1903655adc7SJason A. Donenfeld * unsigned long get_random_long() 1913655adc7SJason A. Donenfeld * 1923655adc7SJason A. Donenfeld * These interfaces will return the requested number of random bytes 1930313bc27SLinus Torvalds * into the given buffer or as a return value. This is equivalent to 194de492c83SJason A. Donenfeld * a read from /dev/urandom. The u8, u16, u32, u64, long family of 195de492c83SJason A. Donenfeld * functions may be higher performance for one-off random integers, 196de492c83SJason A. Donenfeld * because they do a bit of buffering and do not invoke reseeding 197de492c83SJason A. Donenfeld * until the buffer is emptied. 1983655adc7SJason A. Donenfeld * 1993655adc7SJason A. Donenfeld *********************************************************************/ 2003655adc7SJason A. Donenfeld 201e85c0fc1SJason A. Donenfeld enum { 202e85c0fc1SJason A. Donenfeld CRNG_RESEED_START_INTERVAL = HZ, 203e85c0fc1SJason A. Donenfeld CRNG_RESEED_INTERVAL = 60 * HZ 204e85c0fc1SJason A. Donenfeld }; 2053655adc7SJason A. Donenfeld 2063655adc7SJason A. Donenfeld static struct { 2073655adc7SJason A. Donenfeld u8 key[CHACHA_KEY_SIZE] __aligned(__alignof__(long)); 2083655adc7SJason A. Donenfeld unsigned long generation; 2093655adc7SJason A. Donenfeld spinlock_t lock; 2103655adc7SJason A. Donenfeld } base_crng = { 2113655adc7SJason A. Donenfeld .lock = __SPIN_LOCK_UNLOCKED(base_crng.lock) 2123655adc7SJason A. Donenfeld }; 2133655adc7SJason A. Donenfeld 2143655adc7SJason A. Donenfeld struct crng { 2153655adc7SJason A. Donenfeld u8 key[CHACHA_KEY_SIZE]; 2163655adc7SJason A. Donenfeld unsigned long generation; 2173655adc7SJason A. Donenfeld local_lock_t lock; 2183655adc7SJason A. Donenfeld }; 2193655adc7SJason A. Donenfeld 2203655adc7SJason A. Donenfeld static DEFINE_PER_CPU(struct crng, crngs) = { 2213655adc7SJason A. Donenfeld .generation = ULONG_MAX, 2223655adc7SJason A. Donenfeld .lock = INIT_LOCAL_LOCK(crngs.lock), 2233655adc7SJason A. Donenfeld }; 2243655adc7SJason A. Donenfeld 2259148de31SJason A. Donenfeld /* 2269148de31SJason A. Donenfeld * Return the interval until the next reseeding, which is normally 2279148de31SJason A. Donenfeld * CRNG_RESEED_INTERVAL, but during early boot, it is at an interval 2289148de31SJason A. Donenfeld * proportional to the uptime. 2299148de31SJason A. Donenfeld */ 2309148de31SJason A. Donenfeld static unsigned int crng_reseed_interval(void) 2319148de31SJason A. Donenfeld { 2329148de31SJason A. Donenfeld static bool early_boot = true; 2339148de31SJason A. Donenfeld 2349148de31SJason A. Donenfeld if (unlikely(READ_ONCE(early_boot))) { 2359148de31SJason A. Donenfeld time64_t uptime = ktime_get_seconds(); 2369148de31SJason A. Donenfeld if (uptime >= CRNG_RESEED_INTERVAL / HZ * 2) 2379148de31SJason A. Donenfeld WRITE_ONCE(early_boot, false); 2389148de31SJason A. Donenfeld else 2399148de31SJason A. Donenfeld return max_t(unsigned int, CRNG_RESEED_START_INTERVAL, 2409148de31SJason A. Donenfeld (unsigned int)uptime / 2 * HZ); 2419148de31SJason A. Donenfeld } 2429148de31SJason A. Donenfeld return CRNG_RESEED_INTERVAL; 2439148de31SJason A. Donenfeld } 2449148de31SJason A. Donenfeld 245e85c0fc1SJason A. Donenfeld /* Used by crng_reseed() and crng_make_state() to extract a new seed from the input pool. */ 246a1940263SJason A. Donenfeld static void extract_entropy(void *buf, size_t len); 2473655adc7SJason A. Donenfeld 248e85c0fc1SJason A. Donenfeld /* This extracts a new crng key from the input pool. */ 2499148de31SJason A. Donenfeld static void crng_reseed(struct work_struct *work) 2503655adc7SJason A. Donenfeld { 2519148de31SJason A. Donenfeld static DECLARE_DELAYED_WORK(next_reseed, crng_reseed); 2523655adc7SJason A. Donenfeld unsigned long flags; 2533655adc7SJason A. Donenfeld unsigned long next_gen; 2543655adc7SJason A. Donenfeld u8 key[CHACHA_KEY_SIZE]; 2553655adc7SJason A. Donenfeld 2569148de31SJason A. Donenfeld /* Immediately schedule the next reseeding, so that it fires sooner rather than later. */ 2579148de31SJason A. Donenfeld if (likely(system_unbound_wq)) 2589148de31SJason A. Donenfeld queue_delayed_work(system_unbound_wq, &next_reseed, crng_reseed_interval()); 2599148de31SJason A. Donenfeld 260e85c0fc1SJason A. Donenfeld extract_entropy(key, sizeof(key)); 2613655adc7SJason A. Donenfeld 2623655adc7SJason A. Donenfeld /* 2633655adc7SJason A. Donenfeld * We copy the new key into the base_crng, overwriting the old one, 2643655adc7SJason A. Donenfeld * and update the generation counter. We avoid hitting ULONG_MAX, 2653655adc7SJason A. Donenfeld * because the per-cpu crngs are initialized to ULONG_MAX, so this 2663655adc7SJason A. Donenfeld * forces new CPUs that come online to always initialize. 2673655adc7SJason A. Donenfeld */ 2683655adc7SJason A. Donenfeld spin_lock_irqsave(&base_crng.lock, flags); 2693655adc7SJason A. Donenfeld memcpy(base_crng.key, key, sizeof(base_crng.key)); 2703655adc7SJason A. Donenfeld next_gen = base_crng.generation + 1; 2713655adc7SJason A. Donenfeld if (next_gen == ULONG_MAX) 2723655adc7SJason A. Donenfeld ++next_gen; 2733655adc7SJason A. Donenfeld WRITE_ONCE(base_crng.generation, next_gen); 274f5bda35fSJason A. Donenfeld if (!static_branch_likely(&crng_is_ready)) 275e3d2c5e7SJason A. Donenfeld crng_init = CRNG_READY; 2763655adc7SJason A. Donenfeld spin_unlock_irqrestore(&base_crng.lock, flags); 2773655adc7SJason A. Donenfeld memzero_explicit(key, sizeof(key)); 2783655adc7SJason A. Donenfeld } 2793655adc7SJason A. Donenfeld 2803655adc7SJason A. Donenfeld /* 2813655adc7SJason A. Donenfeld * This generates a ChaCha block using the provided key, and then 2827f637be4SJason A. Donenfeld * immediately overwrites that key with half the block. It returns 2833655adc7SJason A. Donenfeld * the resultant ChaCha state to the user, along with the second 2843655adc7SJason A. Donenfeld * half of the block containing 32 bytes of random data that may 2853655adc7SJason A. Donenfeld * be used; random_data_len may not be greater than 32. 2868717627dSJason A. Donenfeld * 2878717627dSJason A. Donenfeld * The returned ChaCha state contains within it a copy of the old 2888717627dSJason A. Donenfeld * key value, at index 4, so the state should always be zeroed out 2898717627dSJason A. Donenfeld * immediately after using in order to maintain forward secrecy. 2908717627dSJason A. Donenfeld * If the state cannot be erased in a timely manner, then it is 2918717627dSJason A. Donenfeld * safer to set the random_data parameter to &chacha_state[4] so 2928717627dSJason A. Donenfeld * that this function overwrites it before returning. 2933655adc7SJason A. Donenfeld */ 2943655adc7SJason A. Donenfeld static void crng_fast_key_erasure(u8 key[CHACHA_KEY_SIZE], 2953655adc7SJason A. Donenfeld u32 chacha_state[CHACHA_STATE_WORDS], 2963655adc7SJason A. Donenfeld u8 *random_data, size_t random_data_len) 2973655adc7SJason A. Donenfeld { 2983655adc7SJason A. Donenfeld u8 first_block[CHACHA_BLOCK_SIZE]; 2993655adc7SJason A. Donenfeld 3003655adc7SJason A. Donenfeld BUG_ON(random_data_len > 32); 3013655adc7SJason A. Donenfeld 3023655adc7SJason A. Donenfeld chacha_init_consts(chacha_state); 3033655adc7SJason A. Donenfeld memcpy(&chacha_state[4], key, CHACHA_KEY_SIZE); 3043655adc7SJason A. Donenfeld memset(&chacha_state[12], 0, sizeof(u32) * 4); 3053655adc7SJason A. Donenfeld chacha20_block(chacha_state, first_block); 3063655adc7SJason A. Donenfeld 3073655adc7SJason A. Donenfeld memcpy(key, first_block, CHACHA_KEY_SIZE); 3088717627dSJason A. Donenfeld memcpy(random_data, first_block + CHACHA_KEY_SIZE, random_data_len); 3093655adc7SJason A. Donenfeld memzero_explicit(first_block, sizeof(first_block)); 3103655adc7SJason A. Donenfeld } 3113655adc7SJason A. Donenfeld 3123655adc7SJason A. Donenfeld /* 3133655adc7SJason A. Donenfeld * This function returns a ChaCha state that you may use for generating 3143655adc7SJason A. Donenfeld * random data. It also returns up to 32 bytes on its own of random data 3153655adc7SJason A. Donenfeld * that may be used; random_data_len may not be greater than 32. 3163655adc7SJason A. Donenfeld */ 3173655adc7SJason A. Donenfeld static void crng_make_state(u32 chacha_state[CHACHA_STATE_WORDS], 3183655adc7SJason A. Donenfeld u8 *random_data, size_t random_data_len) 3193655adc7SJason A. Donenfeld { 3203655adc7SJason A. Donenfeld unsigned long flags; 3213655adc7SJason A. Donenfeld struct crng *crng; 3223655adc7SJason A. Donenfeld 3233655adc7SJason A. Donenfeld BUG_ON(random_data_len > 32); 3243655adc7SJason A. Donenfeld 3253655adc7SJason A. Donenfeld /* 3263655adc7SJason A. Donenfeld * For the fast path, we check whether we're ready, unlocked first, and 3273655adc7SJason A. Donenfeld * then re-check once locked later. In the case where we're really not 3285c3b747eSJason A. Donenfeld * ready, we do fast key erasure with the base_crng directly, extracting 329e3d2c5e7SJason A. Donenfeld * when crng_init is CRNG_EMPTY. 3303655adc7SJason A. Donenfeld */ 331a96cfe2dSJason A. Donenfeld if (!crng_ready()) { 3323655adc7SJason A. Donenfeld bool ready; 3333655adc7SJason A. Donenfeld 3343655adc7SJason A. Donenfeld spin_lock_irqsave(&base_crng.lock, flags); 3353655adc7SJason A. Donenfeld ready = crng_ready(); 3365c3b747eSJason A. Donenfeld if (!ready) { 337e3d2c5e7SJason A. Donenfeld if (crng_init == CRNG_EMPTY) 3385c3b747eSJason A. Donenfeld extract_entropy(base_crng.key, sizeof(base_crng.key)); 3393655adc7SJason A. Donenfeld crng_fast_key_erasure(base_crng.key, chacha_state, 3403655adc7SJason A. Donenfeld random_data, random_data_len); 3415c3b747eSJason A. Donenfeld } 3423655adc7SJason A. Donenfeld spin_unlock_irqrestore(&base_crng.lock, flags); 3433655adc7SJason A. Donenfeld if (!ready) 3443655adc7SJason A. Donenfeld return; 3453655adc7SJason A. Donenfeld } 3463655adc7SJason A. Donenfeld 3473655adc7SJason A. Donenfeld local_lock_irqsave(&crngs.lock, flags); 3483655adc7SJason A. Donenfeld crng = raw_cpu_ptr(&crngs); 3493655adc7SJason A. Donenfeld 3503655adc7SJason A. Donenfeld /* 3513655adc7SJason A. Donenfeld * If our per-cpu crng is older than the base_crng, then it means 3523655adc7SJason A. Donenfeld * somebody reseeded the base_crng. In that case, we do fast key 3533655adc7SJason A. Donenfeld * erasure on the base_crng, and use its output as the new key 3543655adc7SJason A. Donenfeld * for our per-cpu crng. This brings us up to date with base_crng. 3553655adc7SJason A. Donenfeld */ 3563655adc7SJason A. Donenfeld if (unlikely(crng->generation != READ_ONCE(base_crng.generation))) { 3573655adc7SJason A. Donenfeld spin_lock(&base_crng.lock); 3583655adc7SJason A. Donenfeld crng_fast_key_erasure(base_crng.key, chacha_state, 3593655adc7SJason A. Donenfeld crng->key, sizeof(crng->key)); 3603655adc7SJason A. Donenfeld crng->generation = base_crng.generation; 3613655adc7SJason A. Donenfeld spin_unlock(&base_crng.lock); 3623655adc7SJason A. Donenfeld } 3633655adc7SJason A. Donenfeld 3643655adc7SJason A. Donenfeld /* 3653655adc7SJason A. Donenfeld * Finally, when we've made it this far, our per-cpu crng has an up 3663655adc7SJason A. Donenfeld * to date key, and we can do fast key erasure with it to produce 3673655adc7SJason A. Donenfeld * some random data and a ChaCha state for the caller. All other 3683655adc7SJason A. Donenfeld * branches of this function are "unlikely", so most of the time we 3693655adc7SJason A. Donenfeld * should wind up here immediately. 3703655adc7SJason A. Donenfeld */ 3713655adc7SJason A. Donenfeld crng_fast_key_erasure(crng->key, chacha_state, random_data, random_data_len); 3723655adc7SJason A. Donenfeld local_unlock_irqrestore(&crngs.lock, flags); 3733655adc7SJason A. Donenfeld } 3743655adc7SJason A. Donenfeld 375a1940263SJason A. Donenfeld static void _get_random_bytes(void *buf, size_t len) 3763655adc7SJason A. Donenfeld { 3773655adc7SJason A. Donenfeld u32 chacha_state[CHACHA_STATE_WORDS]; 3783655adc7SJason A. Donenfeld u8 tmp[CHACHA_BLOCK_SIZE]; 379a1940263SJason A. Donenfeld size_t first_block_len; 3803655adc7SJason A. Donenfeld 381a1940263SJason A. Donenfeld if (!len) 3823655adc7SJason A. Donenfeld return; 3833655adc7SJason A. Donenfeld 384a1940263SJason A. Donenfeld first_block_len = min_t(size_t, 32, len); 385a1940263SJason A. Donenfeld crng_make_state(chacha_state, buf, first_block_len); 386a1940263SJason A. Donenfeld len -= first_block_len; 387a1940263SJason A. Donenfeld buf += first_block_len; 3883655adc7SJason A. Donenfeld 389a1940263SJason A. Donenfeld while (len) { 390a1940263SJason A. Donenfeld if (len < CHACHA_BLOCK_SIZE) { 3913655adc7SJason A. Donenfeld chacha20_block(chacha_state, tmp); 392a1940263SJason A. Donenfeld memcpy(buf, tmp, len); 3933655adc7SJason A. Donenfeld memzero_explicit(tmp, sizeof(tmp)); 3943655adc7SJason A. Donenfeld break; 3953655adc7SJason A. Donenfeld } 3963655adc7SJason A. Donenfeld 3973655adc7SJason A. Donenfeld chacha20_block(chacha_state, buf); 3983655adc7SJason A. Donenfeld if (unlikely(chacha_state[12] == 0)) 3993655adc7SJason A. Donenfeld ++chacha_state[13]; 400a1940263SJason A. Donenfeld len -= CHACHA_BLOCK_SIZE; 4013655adc7SJason A. Donenfeld buf += CHACHA_BLOCK_SIZE; 4023655adc7SJason A. Donenfeld } 4033655adc7SJason A. Donenfeld 4043655adc7SJason A. Donenfeld memzero_explicit(chacha_state, sizeof(chacha_state)); 4053655adc7SJason A. Donenfeld } 4063655adc7SJason A. Donenfeld 4073655adc7SJason A. Donenfeld /* 40819258d05SJason A. Donenfeld * This returns random bytes in arbitrary quantities. The quality of the 40919258d05SJason A. Donenfeld * random bytes is good as /dev/urandom. In order to ensure that the 41019258d05SJason A. Donenfeld * randomness provided by this function is okay, the function 41119258d05SJason A. Donenfeld * wait_for_random_bytes() should be called and return 0 at least once 41219258d05SJason A. Donenfeld * at any point prior. 4133655adc7SJason A. Donenfeld */ 414a1940263SJason A. Donenfeld void get_random_bytes(void *buf, size_t len) 4153655adc7SJason A. Donenfeld { 416cc1e127bSJason A. Donenfeld warn_unseeded_randomness(); 417a1940263SJason A. Donenfeld _get_random_bytes(buf, len); 4183655adc7SJason A. Donenfeld } 4193655adc7SJason A. Donenfeld EXPORT_SYMBOL(get_random_bytes); 4203655adc7SJason A. Donenfeld 4211b388e77SJens Axboe static ssize_t get_random_bytes_user(struct iov_iter *iter) 4223655adc7SJason A. Donenfeld { 4233655adc7SJason A. Donenfeld u32 chacha_state[CHACHA_STATE_WORDS]; 4241b388e77SJens Axboe u8 block[CHACHA_BLOCK_SIZE]; 4251b388e77SJens Axboe size_t ret = 0, copied; 4263655adc7SJason A. Donenfeld 4271b388e77SJens Axboe if (unlikely(!iov_iter_count(iter))) 4283655adc7SJason A. Donenfeld return 0; 4293655adc7SJason A. Donenfeld 430aba120ccSJason A. Donenfeld /* 431aba120ccSJason A. Donenfeld * Immediately overwrite the ChaCha key at index 4 with random 43263b8ea5eSJason A. Donenfeld * bytes, in case userspace causes copy_to_iter() below to sleep 433aba120ccSJason A. Donenfeld * forever, so that we still retain forward secrecy in that case. 434aba120ccSJason A. Donenfeld */ 435aba120ccSJason A. Donenfeld crng_make_state(chacha_state, (u8 *)&chacha_state[4], CHACHA_KEY_SIZE); 436aba120ccSJason A. Donenfeld /* 437aba120ccSJason A. Donenfeld * However, if we're doing a read of len <= 32, we don't need to 438aba120ccSJason A. Donenfeld * use chacha_state after, so we can simply return those bytes to 439aba120ccSJason A. Donenfeld * the user directly. 440aba120ccSJason A. Donenfeld */ 4411b388e77SJens Axboe if (iov_iter_count(iter) <= CHACHA_KEY_SIZE) { 4421b388e77SJens Axboe ret = copy_to_iter(&chacha_state[4], CHACHA_KEY_SIZE, iter); 443aba120ccSJason A. Donenfeld goto out_zero_chacha; 444aba120ccSJason A. Donenfeld } 4453655adc7SJason A. Donenfeld 4465209aed5SJason A. Donenfeld for (;;) { 4471b388e77SJens Axboe chacha20_block(chacha_state, block); 4483655adc7SJason A. Donenfeld if (unlikely(chacha_state[12] == 0)) 4493655adc7SJason A. Donenfeld ++chacha_state[13]; 4503655adc7SJason A. Donenfeld 4511b388e77SJens Axboe copied = copy_to_iter(block, sizeof(block), iter); 4521b388e77SJens Axboe ret += copied; 4531b388e77SJens Axboe if (!iov_iter_count(iter) || copied != sizeof(block)) 4545209aed5SJason A. Donenfeld break; 455e3c1c4fdSJason A. Donenfeld 4561b388e77SJens Axboe BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0); 4575209aed5SJason A. Donenfeld if (ret % PAGE_SIZE == 0) { 458e3c1c4fdSJason A. Donenfeld if (signal_pending(current)) 459e3c1c4fdSJason A. Donenfeld break; 460e3c1c4fdSJason A. Donenfeld cond_resched(); 461e3c1c4fdSJason A. Donenfeld } 4625209aed5SJason A. Donenfeld } 4633655adc7SJason A. Donenfeld 4641b388e77SJens Axboe memzero_explicit(block, sizeof(block)); 465aba120ccSJason A. Donenfeld out_zero_chacha: 466aba120ccSJason A. Donenfeld memzero_explicit(chacha_state, sizeof(chacha_state)); 4675209aed5SJason A. Donenfeld return ret ? ret : -EFAULT; 4683655adc7SJason A. Donenfeld } 4693655adc7SJason A. Donenfeld 4703655adc7SJason A. Donenfeld /* 4713655adc7SJason A. Donenfeld * Batched entropy returns random integers. The quality of the random 4723655adc7SJason A. Donenfeld * number is good as /dev/urandom. In order to ensure that the randomness 4733655adc7SJason A. Donenfeld * provided by this function is okay, the function wait_for_random_bytes() 4743655adc7SJason A. Donenfeld * should be called and return 0 at least once at any point prior. 4753655adc7SJason A. Donenfeld */ 4763655adc7SJason A. Donenfeld 4773092adceSJason A. Donenfeld #define DEFINE_BATCHED_ENTROPY(type) \ 4783092adceSJason A. Donenfeld struct batch_ ##type { \ 4793092adceSJason A. Donenfeld /* \ 4803092adceSJason A. Donenfeld * We make this 1.5x a ChaCha block, so that we get the \ 4813092adceSJason A. Donenfeld * remaining 32 bytes from fast key erasure, plus one full \ 4823092adceSJason A. Donenfeld * block from the detached ChaCha state. We can increase \ 4833092adceSJason A. Donenfeld * the size of this later if needed so long as we keep the \ 4843092adceSJason A. Donenfeld * formula of (integer_blocks + 0.5) * CHACHA_BLOCK_SIZE. \ 4853092adceSJason A. Donenfeld */ \ 4863092adceSJason A. Donenfeld type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))]; \ 4873092adceSJason A. Donenfeld local_lock_t lock; \ 4883092adceSJason A. Donenfeld unsigned long generation; \ 4893092adceSJason A. Donenfeld unsigned int position; \ 4903092adceSJason A. Donenfeld }; \ 4913092adceSJason A. Donenfeld \ 4923092adceSJason A. Donenfeld static DEFINE_PER_CPU(struct batch_ ##type, batched_entropy_ ##type) = { \ 4933092adceSJason A. Donenfeld .lock = INIT_LOCAL_LOCK(batched_entropy_ ##type.lock), \ 4943092adceSJason A. Donenfeld .position = UINT_MAX \ 4953092adceSJason A. Donenfeld }; \ 4963092adceSJason A. Donenfeld \ 4973092adceSJason A. Donenfeld type get_random_ ##type(void) \ 4983092adceSJason A. Donenfeld { \ 4993092adceSJason A. Donenfeld type ret; \ 5003092adceSJason A. Donenfeld unsigned long flags; \ 5013092adceSJason A. Donenfeld struct batch_ ##type *batch; \ 5023092adceSJason A. Donenfeld unsigned long next_gen; \ 5033092adceSJason A. Donenfeld \ 5043092adceSJason A. Donenfeld warn_unseeded_randomness(); \ 5053092adceSJason A. Donenfeld \ 5063092adceSJason A. Donenfeld if (!crng_ready()) { \ 5073092adceSJason A. Donenfeld _get_random_bytes(&ret, sizeof(ret)); \ 5083092adceSJason A. Donenfeld return ret; \ 5093092adceSJason A. Donenfeld } \ 5103092adceSJason A. Donenfeld \ 5113092adceSJason A. Donenfeld local_lock_irqsave(&batched_entropy_ ##type.lock, flags); \ 5123092adceSJason A. Donenfeld batch = raw_cpu_ptr(&batched_entropy_##type); \ 5133092adceSJason A. Donenfeld \ 5143092adceSJason A. Donenfeld next_gen = READ_ONCE(base_crng.generation); \ 5153092adceSJason A. Donenfeld if (batch->position >= ARRAY_SIZE(batch->entropy) || \ 5163092adceSJason A. Donenfeld next_gen != batch->generation) { \ 5173092adceSJason A. Donenfeld _get_random_bytes(batch->entropy, sizeof(batch->entropy)); \ 5183092adceSJason A. Donenfeld batch->position = 0; \ 5193092adceSJason A. Donenfeld batch->generation = next_gen; \ 5203092adceSJason A. Donenfeld } \ 5213092adceSJason A. Donenfeld \ 5223092adceSJason A. Donenfeld ret = batch->entropy[batch->position]; \ 5233092adceSJason A. Donenfeld batch->entropy[batch->position] = 0; \ 5243092adceSJason A. Donenfeld ++batch->position; \ 5253092adceSJason A. Donenfeld local_unlock_irqrestore(&batched_entropy_ ##type.lock, flags); \ 5263092adceSJason A. Donenfeld return ret; \ 5273092adceSJason A. Donenfeld } \ 5283092adceSJason A. Donenfeld EXPORT_SYMBOL(get_random_ ##type); 5293655adc7SJason A. Donenfeld 530585cd5feSJason A. Donenfeld DEFINE_BATCHED_ENTROPY(u8) 531a890d1c6SJason A. Donenfeld DEFINE_BATCHED_ENTROPY(u16) 532a890d1c6SJason A. Donenfeld DEFINE_BATCHED_ENTROPY(u32) 533a890d1c6SJason A. Donenfeld DEFINE_BATCHED_ENTROPY(u64) 5343655adc7SJason A. Donenfeld 535e9a688bcSJason A. Donenfeld u32 __get_random_u32_below(u32 ceil) 536e9a688bcSJason A. Donenfeld { 537e9a688bcSJason A. Donenfeld /* 538e9a688bcSJason A. Donenfeld * This is the slow path for variable ceil. It is still fast, most of 539e9a688bcSJason A. Donenfeld * the time, by doing traditional reciprocal multiplication and 540e9a688bcSJason A. Donenfeld * opportunistically comparing the lower half to ceil itself, before 541e9a688bcSJason A. Donenfeld * falling back to computing a larger bound, and then rejecting samples 542e9a688bcSJason A. Donenfeld * whose lower half would indicate a range indivisible by ceil. The use 543e9a688bcSJason A. Donenfeld * of `-ceil % ceil` is analogous to `2^32 % ceil`, but is computable 544e9a688bcSJason A. Donenfeld * in 32-bits. 545e9a688bcSJason A. Donenfeld */ 5467f576b25SJason A. Donenfeld u32 rand = get_random_u32(); 5477f576b25SJason A. Donenfeld u64 mult; 5487f576b25SJason A. Donenfeld 5497f576b25SJason A. Donenfeld /* 5507f576b25SJason A. Donenfeld * This function is technically undefined for ceil == 0, and in fact 5517f576b25SJason A. Donenfeld * for the non-underscored constant version in the header, we build bug 5527f576b25SJason A. Donenfeld * on that. But for the non-constant case, it's convenient to have that 5537f576b25SJason A. Donenfeld * evaluate to being a straight call to get_random_u32(), so that 5547f576b25SJason A. Donenfeld * get_random_u32_inclusive() can work over its whole range without 5557f576b25SJason A. Donenfeld * undefined behavior. 5567f576b25SJason A. Donenfeld */ 5577f576b25SJason A. Donenfeld if (unlikely(!ceil)) 5587f576b25SJason A. Donenfeld return rand; 5597f576b25SJason A. Donenfeld 5607f576b25SJason A. Donenfeld mult = (u64)ceil * rand; 561e9a688bcSJason A. Donenfeld if (unlikely((u32)mult < ceil)) { 562e9a688bcSJason A. Donenfeld u32 bound = -ceil % ceil; 563e9a688bcSJason A. Donenfeld while (unlikely((u32)mult < bound)) 564e9a688bcSJason A. Donenfeld mult = (u64)ceil * get_random_u32(); 565e9a688bcSJason A. Donenfeld } 566e9a688bcSJason A. Donenfeld return mult >> 32; 567e9a688bcSJason A. Donenfeld } 568e9a688bcSJason A. Donenfeld EXPORT_SYMBOL(__get_random_u32_below); 569e9a688bcSJason A. Donenfeld 5703191dd5aSJason A. Donenfeld #ifdef CONFIG_SMP 5713191dd5aSJason A. Donenfeld /* 5723191dd5aSJason A. Donenfeld * This function is called when the CPU is coming up, with entry 5733191dd5aSJason A. Donenfeld * CPUHP_RANDOM_PREPARE, which comes before CPUHP_WORKQUEUE_PREP. 5743191dd5aSJason A. Donenfeld */ 575560181c2SJason A. Donenfeld int __cold random_prepare_cpu(unsigned int cpu) 5763191dd5aSJason A. Donenfeld { 5773191dd5aSJason A. Donenfeld /* 5783191dd5aSJason A. Donenfeld * When the cpu comes back online, immediately invalidate both 5793191dd5aSJason A. Donenfeld * the per-cpu crng and all batches, so that we serve fresh 5803191dd5aSJason A. Donenfeld * randomness. 5813191dd5aSJason A. Donenfeld */ 5823191dd5aSJason A. Donenfeld per_cpu_ptr(&crngs, cpu)->generation = ULONG_MAX; 583a890d1c6SJason A. Donenfeld per_cpu_ptr(&batched_entropy_u8, cpu)->position = UINT_MAX; 584a890d1c6SJason A. Donenfeld per_cpu_ptr(&batched_entropy_u16, cpu)->position = UINT_MAX; 5853191dd5aSJason A. Donenfeld per_cpu_ptr(&batched_entropy_u32, cpu)->position = UINT_MAX; 5863191dd5aSJason A. Donenfeld per_cpu_ptr(&batched_entropy_u64, cpu)->position = UINT_MAX; 5873191dd5aSJason A. Donenfeld return 0; 5883191dd5aSJason A. Donenfeld } 5893191dd5aSJason A. Donenfeld #endif 5903191dd5aSJason A. Donenfeld 591a5ed7cb1SJason A. Donenfeld 592a5ed7cb1SJason A. Donenfeld /********************************************************************** 593a5ed7cb1SJason A. Donenfeld * 594a5ed7cb1SJason A. Donenfeld * Entropy accumulation and extraction routines. 595a5ed7cb1SJason A. Donenfeld * 596a5ed7cb1SJason A. Donenfeld * Callers may add entropy via: 597a5ed7cb1SJason A. Donenfeld * 598a1940263SJason A. Donenfeld * static void mix_pool_bytes(const void *buf, size_t len) 599a5ed7cb1SJason A. Donenfeld * 600a5ed7cb1SJason A. Donenfeld * After which, if added entropy should be credited: 601a5ed7cb1SJason A. Donenfeld * 602a1940263SJason A. Donenfeld * static void credit_init_bits(size_t bits) 603a5ed7cb1SJason A. Donenfeld * 604e85c0fc1SJason A. Donenfeld * Finally, extract entropy via: 605a5ed7cb1SJason A. Donenfeld * 606a1940263SJason A. Donenfeld * static void extract_entropy(void *buf, size_t len) 607a5ed7cb1SJason A. Donenfeld * 608a5ed7cb1SJason A. Donenfeld **********************************************************************/ 609a5ed7cb1SJason A. Donenfeld 610c5704490SJason A. Donenfeld enum { 6116e8ec255SJason A. Donenfeld POOL_BITS = BLAKE2S_HASH_SIZE * 8, 612e3d2c5e7SJason A. Donenfeld POOL_READY_BITS = POOL_BITS, /* When crng_init->CRNG_READY */ 613e3d2c5e7SJason A. Donenfeld POOL_EARLY_BITS = POOL_READY_BITS / 2 /* When crng_init->CRNG_EARLY */ 6141da177e4SLinus Torvalds }; 6151da177e4SLinus Torvalds 61690ed1e67SJason A. Donenfeld static struct { 6176e8ec255SJason A. Donenfeld struct blake2s_state hash; 61843358209SMatt Mackall spinlock_t lock; 619e85c0fc1SJason A. Donenfeld unsigned int init_bits; 62090ed1e67SJason A. Donenfeld } input_pool = { 6216e8ec255SJason A. Donenfeld .hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE), 6226e8ec255SJason A. Donenfeld BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4, 6236e8ec255SJason A. Donenfeld BLAKE2S_IV5, BLAKE2S_IV6, BLAKE2S_IV7 }, 6246e8ec255SJason A. Donenfeld .hash.outlen = BLAKE2S_HASH_SIZE, 625eece09ecSThomas Gleixner .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock), 6261da177e4SLinus Torvalds }; 6271da177e4SLinus Torvalds 628a1940263SJason A. Donenfeld static void _mix_pool_bytes(const void *buf, size_t len) 629a5ed7cb1SJason A. Donenfeld { 630a1940263SJason A. Donenfeld blake2s_update(&input_pool.hash, buf, len); 631a5ed7cb1SJason A. Donenfeld } 63290ed1e67SJason A. Donenfeld 6331da177e4SLinus Torvalds /* 634e85c0fc1SJason A. Donenfeld * This function adds bytes into the input pool. It does not 635e85c0fc1SJason A. Donenfeld * update the initialization bit counter; the caller should call 636e85c0fc1SJason A. Donenfeld * credit_init_bits if this is appropriate. 6371da177e4SLinus Torvalds */ 638a1940263SJason A. Donenfeld static void mix_pool_bytes(const void *buf, size_t len) 6391da177e4SLinus Torvalds { 640902c098aSTheodore Ts'o unsigned long flags; 641902c098aSTheodore Ts'o 64290ed1e67SJason A. Donenfeld spin_lock_irqsave(&input_pool.lock, flags); 643a1940263SJason A. Donenfeld _mix_pool_bytes(buf, len); 64490ed1e67SJason A. Donenfeld spin_unlock_irqrestore(&input_pool.lock, flags); 6451da177e4SLinus Torvalds } 6461da177e4SLinus Torvalds 647a5ed7cb1SJason A. Donenfeld /* 648a5ed7cb1SJason A. Donenfeld * This is an HKDF-like construction for using the hashed collected entropy 649a5ed7cb1SJason A. Donenfeld * as a PRF key, that's then expanded block-by-block. 650a5ed7cb1SJason A. Donenfeld */ 651a1940263SJason A. Donenfeld static void extract_entropy(void *buf, size_t len) 652a5ed7cb1SJason A. Donenfeld { 653a5ed7cb1SJason A. Donenfeld unsigned long flags; 654a5ed7cb1SJason A. Donenfeld u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE]; 655a5ed7cb1SJason A. Donenfeld struct { 656a5ed7cb1SJason A. Donenfeld unsigned long rdseed[32 / sizeof(long)]; 657a5ed7cb1SJason A. Donenfeld size_t counter; 658a5ed7cb1SJason A. Donenfeld } block; 659d349ab99SJason A. Donenfeld size_t i, longs; 660a5ed7cb1SJason A. Donenfeld 661d349ab99SJason A. Donenfeld for (i = 0; i < ARRAY_SIZE(block.rdseed);) { 662d349ab99SJason A. Donenfeld longs = arch_get_random_seed_longs(&block.rdseed[i], ARRAY_SIZE(block.rdseed) - i); 663d349ab99SJason A. Donenfeld if (longs) { 664d349ab99SJason A. Donenfeld i += longs; 665d349ab99SJason A. Donenfeld continue; 666d349ab99SJason A. Donenfeld } 667d349ab99SJason A. Donenfeld longs = arch_get_random_longs(&block.rdseed[i], ARRAY_SIZE(block.rdseed) - i); 668d349ab99SJason A. Donenfeld if (longs) { 669d349ab99SJason A. Donenfeld i += longs; 670d349ab99SJason A. Donenfeld continue; 671d349ab99SJason A. Donenfeld } 672d349ab99SJason A. Donenfeld block.rdseed[i++] = random_get_entropy(); 673a5ed7cb1SJason A. Donenfeld } 674a5ed7cb1SJason A. Donenfeld 675a5ed7cb1SJason A. Donenfeld spin_lock_irqsave(&input_pool.lock, flags); 676a5ed7cb1SJason A. Donenfeld 677a5ed7cb1SJason A. Donenfeld /* seed = HASHPRF(last_key, entropy_input) */ 678a5ed7cb1SJason A. Donenfeld blake2s_final(&input_pool.hash, seed); 679a5ed7cb1SJason A. Donenfeld 680a5ed7cb1SJason A. Donenfeld /* next_key = HASHPRF(seed, RDSEED || 0) */ 681a5ed7cb1SJason A. Donenfeld block.counter = 0; 682a5ed7cb1SJason A. Donenfeld blake2s(next_key, (u8 *)&block, seed, sizeof(next_key), sizeof(block), sizeof(seed)); 683a5ed7cb1SJason A. Donenfeld blake2s_init_key(&input_pool.hash, BLAKE2S_HASH_SIZE, next_key, sizeof(next_key)); 684a5ed7cb1SJason A. Donenfeld 685a5ed7cb1SJason A. Donenfeld spin_unlock_irqrestore(&input_pool.lock, flags); 686a5ed7cb1SJason A. Donenfeld memzero_explicit(next_key, sizeof(next_key)); 687a5ed7cb1SJason A. Donenfeld 688a1940263SJason A. Donenfeld while (len) { 689a1940263SJason A. Donenfeld i = min_t(size_t, len, BLAKE2S_HASH_SIZE); 690a5ed7cb1SJason A. Donenfeld /* output = HASHPRF(seed, RDSEED || ++counter) */ 691a5ed7cb1SJason A. Donenfeld ++block.counter; 692a5ed7cb1SJason A. Donenfeld blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed)); 693a1940263SJason A. Donenfeld len -= i; 694a5ed7cb1SJason A. Donenfeld buf += i; 695a5ed7cb1SJason A. Donenfeld } 696a5ed7cb1SJason A. Donenfeld 697a5ed7cb1SJason A. Donenfeld memzero_explicit(seed, sizeof(seed)); 698a5ed7cb1SJason A. Donenfeld memzero_explicit(&block, sizeof(block)); 699a5ed7cb1SJason A. Donenfeld } 700a5ed7cb1SJason A. Donenfeld 701560181c2SJason A. Donenfeld #define credit_init_bits(bits) if (!crng_ready()) _credit_init_bits(bits) 702560181c2SJason A. Donenfeld 703560181c2SJason A. Donenfeld static void __cold _credit_init_bits(size_t bits) 704a5ed7cb1SJason A. Donenfeld { 705f5bda35fSJason A. Donenfeld static struct execute_work set_ready; 706fed7ef06SJason A. Donenfeld unsigned int new, orig, add; 7075c3b747eSJason A. Donenfeld unsigned long flags; 7085c3b747eSJason A. Donenfeld 709560181c2SJason A. Donenfeld if (!bits) 7105c3b747eSJason A. Donenfeld return; 7115c3b747eSJason A. Donenfeld 712a1940263SJason A. Donenfeld add = min_t(size_t, bits, POOL_BITS); 7135c3b747eSJason A. Donenfeld 714e85c0fc1SJason A. Donenfeld orig = READ_ONCE(input_pool.init_bits); 715b7a68f67SUros Bizjak do { 716fed7ef06SJason A. Donenfeld new = min_t(unsigned int, POOL_BITS, orig + add); 717b7a68f67SUros Bizjak } while (!try_cmpxchg(&input_pool.init_bits, &orig, new)); 7185c3b747eSJason A. Donenfeld 71968c9c8b1SJason A. Donenfeld if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) { 7209148de31SJason A. Donenfeld crng_reseed(NULL); /* Sets crng_init to CRNG_READY under base_crng.lock. */ 72160e5b288SJason A. Donenfeld if (static_key_initialized) 722f5bda35fSJason A. Donenfeld execute_in_process_context(crng_set_ready, &set_ready); 723bbc7e1beSJason A. Donenfeld atomic_notifier_call_chain(&random_ready_notifier, 0, NULL); 72468c9c8b1SJason A. Donenfeld wake_up_interruptible(&crng_init_wait); 72568c9c8b1SJason A. Donenfeld kill_fasync(&fasync, SIGIO, POLL_IN); 72668c9c8b1SJason A. Donenfeld pr_notice("crng init done\n"); 727cc1e127bSJason A. Donenfeld if (urandom_warning.missed) 72868c9c8b1SJason A. Donenfeld pr_notice("%d urandom warning(s) missed due to ratelimiting\n", 72968c9c8b1SJason A. Donenfeld urandom_warning.missed); 73068c9c8b1SJason A. Donenfeld } else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) { 7315c3b747eSJason A. Donenfeld spin_lock_irqsave(&base_crng.lock, flags); 73268c9c8b1SJason A. Donenfeld /* Check if crng_init is CRNG_EMPTY, to avoid race with crng_reseed(). */ 733e3d2c5e7SJason A. Donenfeld if (crng_init == CRNG_EMPTY) { 7345c3b747eSJason A. Donenfeld extract_entropy(base_crng.key, sizeof(base_crng.key)); 735e3d2c5e7SJason A. Donenfeld crng_init = CRNG_EARLY; 7365c3b747eSJason A. Donenfeld } 7375c3b747eSJason A. Donenfeld spin_unlock_irqrestore(&base_crng.lock, flags); 7385c3b747eSJason A. Donenfeld } 7395c3b747eSJason A. Donenfeld } 7405c3b747eSJason A. Donenfeld 74192c653cfSJason A. Donenfeld 74292c653cfSJason A. Donenfeld /********************************************************************** 74392c653cfSJason A. Donenfeld * 74492c653cfSJason A. Donenfeld * Entropy collection routines. 74592c653cfSJason A. Donenfeld * 74692c653cfSJason A. Donenfeld * The following exported functions are used for pushing entropy into 74792c653cfSJason A. Donenfeld * the above entropy accumulation routines: 74892c653cfSJason A. Donenfeld * 749a1940263SJason A. Donenfeld * void add_device_randomness(const void *buf, size_t len); 750db516da9SJason A. Donenfeld * void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after); 751a1940263SJason A. Donenfeld * void add_bootloader_randomness(const void *buf, size_t len); 752a1940263SJason A. Donenfeld * void add_vmfork_randomness(const void *unique_vm_id, size_t len); 75392c653cfSJason A. Donenfeld * void add_interrupt_randomness(int irq); 754a1940263SJason A. Donenfeld * void add_input_randomness(unsigned int type, unsigned int code, unsigned int value); 755a4b5c26bSJason A. Donenfeld * void add_disk_randomness(struct gendisk *disk); 75692c653cfSJason A. Donenfeld * 75792c653cfSJason A. Donenfeld * add_device_randomness() adds data to the input pool that 75892c653cfSJason A. Donenfeld * is likely to differ between two devices (or possibly even per boot). 75992c653cfSJason A. Donenfeld * This would be things like MAC addresses or serial numbers, or the 76092c653cfSJason A. Donenfeld * read-out of the RTC. This does *not* credit any actual entropy to 76192c653cfSJason A. Donenfeld * the pool, but it initializes the pool to different values for devices 76292c653cfSJason A. Donenfeld * that might otherwise be identical and have very little entropy 76392c653cfSJason A. Donenfeld * available to them (particularly common in the embedded world). 76492c653cfSJason A. Donenfeld * 76592c653cfSJason A. Donenfeld * add_hwgenerator_randomness() is for true hardware RNGs, and will credit 76692c653cfSJason A. Donenfeld * entropy as specified by the caller. If the entropy pool is full it will 76792c653cfSJason A. Donenfeld * block until more entropy is needed. 76892c653cfSJason A. Donenfeld * 7695c3b747eSJason A. Donenfeld * add_bootloader_randomness() is called by bootloader drivers, such as EFI 7705c3b747eSJason A. Donenfeld * and device tree, and credits its input depending on whether or not the 771b9b01a56SJason A. Donenfeld * command line option 'random.trust_bootloader'. 77292c653cfSJason A. Donenfeld * 773ae099e8eSJason A. Donenfeld * add_vmfork_randomness() adds a unique (but not necessarily secret) ID 774ae099e8eSJason A. Donenfeld * representing the current instance of a VM to the pool, without crediting, 775ae099e8eSJason A. Donenfeld * and then force-reseeds the crng so that it takes effect immediately. 776ae099e8eSJason A. Donenfeld * 77792c653cfSJason A. Donenfeld * add_interrupt_randomness() uses the interrupt timing as random 77892c653cfSJason A. Donenfeld * inputs to the entropy pool. Using the cycle counters and the irq source 77992c653cfSJason A. Donenfeld * as inputs, it feeds the input pool roughly once a second or after 64 78092c653cfSJason A. Donenfeld * interrupts, crediting 1 bit of entropy for whichever comes first. 78192c653cfSJason A. Donenfeld * 782a4b5c26bSJason A. Donenfeld * add_input_randomness() uses the input layer interrupt timing, as well 783a4b5c26bSJason A. Donenfeld * as the event type information from the hardware. 784a4b5c26bSJason A. Donenfeld * 785a4b5c26bSJason A. Donenfeld * add_disk_randomness() uses what amounts to the seek time of block 786a4b5c26bSJason A. Donenfeld * layer request events, on a per-disk_devt basis, as input to the 787a4b5c26bSJason A. Donenfeld * entropy pool. Note that high-speed solid state drives with very low 788a4b5c26bSJason A. Donenfeld * seek times do not make for good sources of entropy, as their seek 789a4b5c26bSJason A. Donenfeld * times are usually fairly consistent. 790a4b5c26bSJason A. Donenfeld * 791a4b5c26bSJason A. Donenfeld * The last two routines try to estimate how many bits of entropy 792a4b5c26bSJason A. Donenfeld * to credit. They do this by keeping track of the first and second 793a4b5c26bSJason A. Donenfeld * order deltas of the event timings. 794a4b5c26bSJason A. Donenfeld * 79592c653cfSJason A. Donenfeld **********************************************************************/ 79692c653cfSJason A. Donenfeld 797b9b01a56SJason A. Donenfeld static bool trust_cpu __initdata = true; 798b9b01a56SJason A. Donenfeld static bool trust_bootloader __initdata = true; 79992c653cfSJason A. Donenfeld static int __init parse_trust_cpu(char *arg) 80092c653cfSJason A. Donenfeld { 80192c653cfSJason A. Donenfeld return kstrtobool(arg, &trust_cpu); 80292c653cfSJason A. Donenfeld } 803d97c68d1SJason A. Donenfeld static int __init parse_trust_bootloader(char *arg) 804d97c68d1SJason A. Donenfeld { 805d97c68d1SJason A. Donenfeld return kstrtobool(arg, &trust_bootloader); 806d97c68d1SJason A. Donenfeld } 80792c653cfSJason A. Donenfeld early_param("random.trust_cpu", parse_trust_cpu); 808d97c68d1SJason A. Donenfeld early_param("random.trust_bootloader", parse_trust_bootloader); 809775f4b29STheodore Ts'o 810b7b67d13SJason A. Donenfeld static int random_pm_notification(struct notifier_block *nb, unsigned long action, void *data) 811b7b67d13SJason A. Donenfeld { 812b7b67d13SJason A. Donenfeld unsigned long flags, entropy = random_get_entropy(); 813b7b67d13SJason A. Donenfeld 814b7b67d13SJason A. Donenfeld /* 815b7b67d13SJason A. Donenfeld * Encode a representation of how long the system has been suspended, 816b7b67d13SJason A. Donenfeld * in a way that is distinct from prior system suspends. 817b7b67d13SJason A. Donenfeld */ 818b7b67d13SJason A. Donenfeld ktime_t stamps[] = { ktime_get(), ktime_get_boottime(), ktime_get_real() }; 819b7b67d13SJason A. Donenfeld 820b7b67d13SJason A. Donenfeld spin_lock_irqsave(&input_pool.lock, flags); 821b7b67d13SJason A. Donenfeld _mix_pool_bytes(&action, sizeof(action)); 822b7b67d13SJason A. Donenfeld _mix_pool_bytes(stamps, sizeof(stamps)); 823b7b67d13SJason A. Donenfeld _mix_pool_bytes(&entropy, sizeof(entropy)); 824b7b67d13SJason A. Donenfeld spin_unlock_irqrestore(&input_pool.lock, flags); 825b7b67d13SJason A. Donenfeld 826b7b67d13SJason A. Donenfeld if (crng_ready() && (action == PM_RESTORE_PREPARE || 827261e224dSKalesh Singh (action == PM_POST_SUSPEND && !IS_ENABLED(CONFIG_PM_AUTOSLEEP) && 828261e224dSKalesh Singh !IS_ENABLED(CONFIG_PM_USERSPACE_AUTOSLEEP)))) { 8299148de31SJason A. Donenfeld crng_reseed(NULL); 830b7b67d13SJason A. Donenfeld pr_notice("crng reseeded on system resumption\n"); 831b7b67d13SJason A. Donenfeld } 832b7b67d13SJason A. Donenfeld return 0; 833b7b67d13SJason A. Donenfeld } 834b7b67d13SJason A. Donenfeld 835b7b67d13SJason A. Donenfeld static struct notifier_block pm_notifier = { .notifier_call = random_pm_notification }; 836b7b67d13SJason A. Donenfeld 837775f4b29STheodore Ts'o /* 838f6238499SJason A. Donenfeld * This is called extremely early, before time keeping functionality is 839f6238499SJason A. Donenfeld * available, but arch randomness is. Interrupts are not yet enabled. 840775f4b29STheodore Ts'o */ 841f6238499SJason A. Donenfeld void __init random_init_early(const char *command_line) 842775f4b29STheodore Ts'o { 843d349ab99SJason A. Donenfeld unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)]; 844f6238499SJason A. Donenfeld size_t i, longs, arch_bits; 845775f4b29STheodore Ts'o 8461754abb3SJason A. Donenfeld #if defined(LATENT_ENTROPY_PLUGIN) 8471754abb3SJason A. Donenfeld static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy; 8481754abb3SJason A. Donenfeld _mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed)); 8491754abb3SJason A. Donenfeld #endif 8501754abb3SJason A. Donenfeld 851d349ab99SJason A. Donenfeld for (i = 0, arch_bits = sizeof(entropy) * 8; i < ARRAY_SIZE(entropy);) { 8522c03e16fSJason A. Donenfeld longs = arch_get_random_seed_longs(entropy, ARRAY_SIZE(entropy) - i); 853d349ab99SJason A. Donenfeld if (longs) { 854d349ab99SJason A. Donenfeld _mix_pool_bytes(entropy, sizeof(*entropy) * longs); 855d349ab99SJason A. Donenfeld i += longs; 856d349ab99SJason A. Donenfeld continue; 85792c653cfSJason A. Donenfeld } 8582c03e16fSJason A. Donenfeld longs = arch_get_random_longs(entropy, ARRAY_SIZE(entropy) - i); 859d349ab99SJason A. Donenfeld if (longs) { 860d349ab99SJason A. Donenfeld _mix_pool_bytes(entropy, sizeof(*entropy) * longs); 861d349ab99SJason A. Donenfeld i += longs; 862d349ab99SJason A. Donenfeld continue; 863d349ab99SJason A. Donenfeld } 864d349ab99SJason A. Donenfeld arch_bits -= sizeof(*entropy) * 8; 865d349ab99SJason A. Donenfeld ++i; 86692c653cfSJason A. Donenfeld } 867f6238499SJason A. Donenfeld 868dd54fd7dSJason A. Donenfeld _mix_pool_bytes(init_utsname(), sizeof(*(init_utsname()))); 8692f14062bSJason A. Donenfeld _mix_pool_bytes(command_line, strlen(command_line)); 870f6238499SJason A. Donenfeld 871f6238499SJason A. Donenfeld /* Reseed if already seeded by earlier phases. */ 872f6238499SJason A. Donenfeld if (crng_ready()) 8739148de31SJason A. Donenfeld crng_reseed(NULL); 874f6238499SJason A. Donenfeld else if (trust_cpu) 875f6238499SJason A. Donenfeld _credit_init_bits(arch_bits); 876f6238499SJason A. Donenfeld } 877f6238499SJason A. Donenfeld 878f6238499SJason A. Donenfeld /* 879f6238499SJason A. Donenfeld * This is called a little bit after the prior function, and now there is 880f6238499SJason A. Donenfeld * access to timestamps counters. Interrupts are not yet enabled. 881f6238499SJason A. Donenfeld */ 882f6238499SJason A. Donenfeld void __init random_init(void) 883f6238499SJason A. Donenfeld { 884f6238499SJason A. Donenfeld unsigned long entropy = random_get_entropy(); 885f6238499SJason A. Donenfeld ktime_t now = ktime_get_real(); 886f6238499SJason A. Donenfeld 887f6238499SJason A. Donenfeld _mix_pool_bytes(&now, sizeof(now)); 888f6238499SJason A. Donenfeld _mix_pool_bytes(&entropy, sizeof(entropy)); 8892f14062bSJason A. Donenfeld add_latent_entropy(); 890655b2264STheodore Ts'o 89160e5b288SJason A. Donenfeld /* 892f6238499SJason A. Donenfeld * If we were initialized by the cpu or bootloader before jump labels 893f6238499SJason A. Donenfeld * are initialized, then we should enable the static branch here, where 89460e5b288SJason A. Donenfeld * it's guaranteed that jump labels have been initialized. 89560e5b288SJason A. Donenfeld */ 89660e5b288SJason A. Donenfeld if (!static_branch_likely(&crng_is_ready) && crng_init >= CRNG_READY) 89760e5b288SJason A. Donenfeld crng_set_ready(NULL); 89860e5b288SJason A. Donenfeld 899f6238499SJason A. Donenfeld /* Reseed if already seeded by earlier phases. */ 900e85c0fc1SJason A. Donenfeld if (crng_ready()) 9019148de31SJason A. Donenfeld crng_reseed(NULL); 902775f4b29STheodore Ts'o 903b7b67d13SJason A. Donenfeld WARN_ON(register_pm_notifier(&pm_notifier)); 904b7b67d13SJason A. Donenfeld 905f6238499SJason A. Donenfeld WARN(!entropy, "Missing cycle counter and fallback timer; RNG " 9064b758edaSJason A. Donenfeld "entropy collection will consequently suffer."); 90792c653cfSJason A. Donenfeld } 9081da177e4SLinus Torvalds 909a2080a67SLinus Torvalds /* 910e192be9dSTheodore Ts'o * Add device- or boot-specific data to the input pool to help 911e192be9dSTheodore Ts'o * initialize it. 912a2080a67SLinus Torvalds * 913e192be9dSTheodore Ts'o * None of this adds any entropy; it is meant to avoid the problem of 914e192be9dSTheodore Ts'o * the entropy pool having similar initial state across largely 915e192be9dSTheodore Ts'o * identical devices. 916a2080a67SLinus Torvalds */ 917a1940263SJason A. Donenfeld void add_device_randomness(const void *buf, size_t len) 918a2080a67SLinus Torvalds { 9194b758edaSJason A. Donenfeld unsigned long entropy = random_get_entropy(); 9204b758edaSJason A. Donenfeld unsigned long flags; 921a2080a67SLinus Torvalds 9223ef4cb2dSTheodore Ts'o spin_lock_irqsave(&input_pool.lock, flags); 9234b758edaSJason A. Donenfeld _mix_pool_bytes(&entropy, sizeof(entropy)); 924a1940263SJason A. Donenfeld _mix_pool_bytes(buf, len); 9253ef4cb2dSTheodore Ts'o spin_unlock_irqrestore(&input_pool.lock, flags); 926a2080a67SLinus Torvalds } 927a2080a67SLinus Torvalds EXPORT_SYMBOL(add_device_randomness); 928a2080a67SLinus Torvalds 92992c653cfSJason A. Donenfeld /* 930db516da9SJason A. Donenfeld * Interface for in-kernel drivers of true hardware RNGs. Those devices 931db516da9SJason A. Donenfeld * may produce endless random bits, so this function will sleep for 932db516da9SJason A. Donenfeld * some amount of time after, if the sleep_after parameter is true. 93392c653cfSJason A. Donenfeld */ 934db516da9SJason A. Donenfeld void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after) 93592c653cfSJason A. Donenfeld { 936a1940263SJason A. Donenfeld mix_pool_bytes(buf, len); 937e85c0fc1SJason A. Donenfeld credit_init_bits(entropy); 938e85c0fc1SJason A. Donenfeld 939e85c0fc1SJason A. Donenfeld /* 940745558f9SDominik Brodowski * Throttle writing to once every reseed interval, unless we're not yet 941d775335eSJason A. Donenfeld * initialized or no entropy is credited. 942e85c0fc1SJason A. Donenfeld */ 943db516da9SJason A. Donenfeld if (sleep_after && !kthread_should_stop() && (crng_ready() || !entropy)) 944745558f9SDominik Brodowski schedule_timeout_interruptible(crng_reseed_interval()); 94592c653cfSJason A. Donenfeld } 94692c653cfSJason A. Donenfeld EXPORT_SYMBOL_GPL(add_hwgenerator_randomness); 94792c653cfSJason A. Donenfeld 94892c653cfSJason A. Donenfeld /* 949b9b01a56SJason A. Donenfeld * Handle random seed passed by bootloader, and credit it depending 950b9b01a56SJason A. Donenfeld * on the command line option 'random.trust_bootloader'. 95192c653cfSJason A. Donenfeld */ 95239e0f991SJason A. Donenfeld void __init add_bootloader_randomness(const void *buf, size_t len) 95392c653cfSJason A. Donenfeld { 954a1940263SJason A. Donenfeld mix_pool_bytes(buf, len); 955d97c68d1SJason A. Donenfeld if (trust_bootloader) 956a1940263SJason A. Donenfeld credit_init_bits(len * 8); 95792c653cfSJason A. Donenfeld } 95892c653cfSJason A. Donenfeld 959a4107d34SJason A. Donenfeld #if IS_ENABLED(CONFIG_VMGENID) 960f3c2682bSJason A. Donenfeld static BLOCKING_NOTIFIER_HEAD(vmfork_chain); 961f3c2682bSJason A. Donenfeld 962ae099e8eSJason A. Donenfeld /* 963ae099e8eSJason A. Donenfeld * Handle a new unique VM ID, which is unique, not secret, so we 964ae099e8eSJason A. Donenfeld * don't credit it, but we do immediately force a reseed after so 965ae099e8eSJason A. Donenfeld * that it's used by the crng posthaste. 966ae099e8eSJason A. Donenfeld */ 967560181c2SJason A. Donenfeld void __cold add_vmfork_randomness(const void *unique_vm_id, size_t len) 968ae099e8eSJason A. Donenfeld { 969a1940263SJason A. Donenfeld add_device_randomness(unique_vm_id, len); 970ae099e8eSJason A. Donenfeld if (crng_ready()) { 9719148de31SJason A. Donenfeld crng_reseed(NULL); 972ae099e8eSJason A. Donenfeld pr_notice("crng reseeded due to virtual machine fork\n"); 973ae099e8eSJason A. Donenfeld } 974f3c2682bSJason A. Donenfeld blocking_notifier_call_chain(&vmfork_chain, 0, NULL); 975ae099e8eSJason A. Donenfeld } 976a4107d34SJason A. Donenfeld #if IS_MODULE(CONFIG_VMGENID) 977ae099e8eSJason A. Donenfeld EXPORT_SYMBOL_GPL(add_vmfork_randomness); 978a4107d34SJason A. Donenfeld #endif 979f3c2682bSJason A. Donenfeld 980560181c2SJason A. Donenfeld int __cold register_random_vmfork_notifier(struct notifier_block *nb) 981f3c2682bSJason A. Donenfeld { 982f3c2682bSJason A. Donenfeld return blocking_notifier_chain_register(&vmfork_chain, nb); 983f3c2682bSJason A. Donenfeld } 984f3c2682bSJason A. Donenfeld EXPORT_SYMBOL_GPL(register_random_vmfork_notifier); 985f3c2682bSJason A. Donenfeld 986560181c2SJason A. Donenfeld int __cold unregister_random_vmfork_notifier(struct notifier_block *nb) 987f3c2682bSJason A. Donenfeld { 988f3c2682bSJason A. Donenfeld return blocking_notifier_chain_unregister(&vmfork_chain, nb); 989f3c2682bSJason A. Donenfeld } 990f3c2682bSJason A. Donenfeld EXPORT_SYMBOL_GPL(unregister_random_vmfork_notifier); 991a4107d34SJason A. Donenfeld #endif 992ae099e8eSJason A. Donenfeld 99392c653cfSJason A. Donenfeld struct fast_pool { 994f5eab0e2SJason A. Donenfeld unsigned long pool[4]; 99592c653cfSJason A. Donenfeld unsigned long last; 9963191dd5aSJason A. Donenfeld unsigned int count; 997748bc4ddSJason A. Donenfeld struct timer_list mix; 99892c653cfSJason A. Donenfeld }; 99992c653cfSJason A. Donenfeld 1000748bc4ddSJason A. Donenfeld static void mix_interrupt_randomness(struct timer_list *work); 1001748bc4ddSJason A. Donenfeld 1002f5eab0e2SJason A. Donenfeld static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = { 1003f5eab0e2SJason A. Donenfeld #ifdef CONFIG_64BIT 1004e73aaae2SJason A. Donenfeld #define FASTMIX_PERM SIPHASH_PERMUTATION 1005748bc4ddSJason A. Donenfeld .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 }, 1006f5eab0e2SJason A. Donenfeld #else 1007e73aaae2SJason A. Donenfeld #define FASTMIX_PERM HSIPHASH_PERMUTATION 1008748bc4ddSJason A. Donenfeld .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 }, 1009f5eab0e2SJason A. Donenfeld #endif 1010748bc4ddSJason A. Donenfeld .mix = __TIMER_INITIALIZER(mix_interrupt_randomness, 0) 1011f5eab0e2SJason A. Donenfeld }; 1012f5eab0e2SJason A. Donenfeld 101392c653cfSJason A. Donenfeld /* 1014f5eab0e2SJason A. Donenfeld * This is [Half]SipHash-1-x, starting from an empty key. Because 1015f5eab0e2SJason A. Donenfeld * the key is fixed, it assumes that its inputs are non-malicious, 1016f5eab0e2SJason A. Donenfeld * and therefore this has no security on its own. s represents the 10174b758edaSJason A. Donenfeld * four-word SipHash state, while v represents a two-word input. 101892c653cfSJason A. Donenfeld */ 1019791332b3SJason A. Donenfeld static void fast_mix(unsigned long s[4], unsigned long v1, unsigned long v2) 102092c653cfSJason A. Donenfeld { 1021791332b3SJason A. Donenfeld s[3] ^= v1; 1022e73aaae2SJason A. Donenfeld FASTMIX_PERM(s[0], s[1], s[2], s[3]); 1023791332b3SJason A. Donenfeld s[0] ^= v1; 1024791332b3SJason A. Donenfeld s[3] ^= v2; 1025e73aaae2SJason A. Donenfeld FASTMIX_PERM(s[0], s[1], s[2], s[3]); 1026791332b3SJason A. Donenfeld s[0] ^= v2; 1027f5eab0e2SJason A. Donenfeld } 1028775f4b29STheodore Ts'o 10293191dd5aSJason A. Donenfeld #ifdef CONFIG_SMP 10303191dd5aSJason A. Donenfeld /* 10313191dd5aSJason A. Donenfeld * This function is called when the CPU has just come online, with 10323191dd5aSJason A. Donenfeld * entry CPUHP_AP_RANDOM_ONLINE, just after CPUHP_AP_WORKQUEUE_ONLINE. 10333191dd5aSJason A. Donenfeld */ 1034560181c2SJason A. Donenfeld int __cold random_online_cpu(unsigned int cpu) 10353191dd5aSJason A. Donenfeld { 10363191dd5aSJason A. Donenfeld /* 10373191dd5aSJason A. Donenfeld * During CPU shutdown and before CPU onlining, add_interrupt_ 10383191dd5aSJason A. Donenfeld * randomness() may schedule mix_interrupt_randomness(), and 10393191dd5aSJason A. Donenfeld * set the MIX_INFLIGHT flag. However, because the worker can 10403191dd5aSJason A. Donenfeld * be scheduled on a different CPU during this period, that 10413191dd5aSJason A. Donenfeld * flag will never be cleared. For that reason, we zero out 10423191dd5aSJason A. Donenfeld * the flag here, which runs just after workqueues are onlined 10433191dd5aSJason A. Donenfeld * for the CPU again. This also has the effect of setting the 10443191dd5aSJason A. Donenfeld * irq randomness count to zero so that new accumulated irqs 10453191dd5aSJason A. Donenfeld * are fresh. 10463191dd5aSJason A. Donenfeld */ 10473191dd5aSJason A. Donenfeld per_cpu_ptr(&irq_randomness, cpu)->count = 0; 10483191dd5aSJason A. Donenfeld return 0; 10493191dd5aSJason A. Donenfeld } 10503191dd5aSJason A. Donenfeld #endif 10513191dd5aSJason A. Donenfeld 1052748bc4ddSJason A. Donenfeld static void mix_interrupt_randomness(struct timer_list *work) 105358340f8eSJason A. Donenfeld { 105458340f8eSJason A. Donenfeld struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix); 1055f5eab0e2SJason A. Donenfeld /* 10564b758edaSJason A. Donenfeld * The size of the copied stack pool is explicitly 2 longs so that we 10574b758edaSJason A. Donenfeld * only ever ingest half of the siphash output each time, retaining 10584b758edaSJason A. Donenfeld * the other half as the next "key" that carries over. The entropy is 10594b758edaSJason A. Donenfeld * supposed to be sufficiently dispersed between bits so on average 10604b758edaSJason A. Donenfeld * we don't wind up "losing" some. 1061f5eab0e2SJason A. Donenfeld */ 10624b758edaSJason A. Donenfeld unsigned long pool[2]; 1063e3e33fc2SJason A. Donenfeld unsigned int count; 106458340f8eSJason A. Donenfeld 106558340f8eSJason A. Donenfeld /* Check to see if we're running on the wrong CPU due to hotplug. */ 106658340f8eSJason A. Donenfeld local_irq_disable(); 106758340f8eSJason A. Donenfeld if (fast_pool != this_cpu_ptr(&irq_randomness)) { 106858340f8eSJason A. Donenfeld local_irq_enable(); 106958340f8eSJason A. Donenfeld return; 107058340f8eSJason A. Donenfeld } 107158340f8eSJason A. Donenfeld 107258340f8eSJason A. Donenfeld /* 107358340f8eSJason A. Donenfeld * Copy the pool to the stack so that the mixer always has a 107458340f8eSJason A. Donenfeld * consistent view, before we reenable irqs again. 107558340f8eSJason A. Donenfeld */ 1076f5eab0e2SJason A. Donenfeld memcpy(pool, fast_pool->pool, sizeof(pool)); 1077e3e33fc2SJason A. Donenfeld count = fast_pool->count; 10783191dd5aSJason A. Donenfeld fast_pool->count = 0; 107958340f8eSJason A. Donenfeld fast_pool->last = jiffies; 108058340f8eSJason A. Donenfeld local_irq_enable(); 108158340f8eSJason A. Donenfeld 108258340f8eSJason A. Donenfeld mix_pool_bytes(pool, sizeof(pool)); 1083e78a802aSJason A. Donenfeld credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8)); 1084c2a7de4fSJason A. Donenfeld 108558340f8eSJason A. Donenfeld memzero_explicit(pool, sizeof(pool)); 108658340f8eSJason A. Donenfeld } 108758340f8eSJason A. Donenfeld 1088703f7066SSebastian Andrzej Siewior void add_interrupt_randomness(int irq) 10891da177e4SLinus Torvalds { 109058340f8eSJason A. Donenfeld enum { MIX_INFLIGHT = 1U << 31 }; 10914b758edaSJason A. Donenfeld unsigned long entropy = random_get_entropy(); 10921b2a1a7eSChristoph Lameter struct fast_pool *fast_pool = this_cpu_ptr(&irq_randomness); 1093775f4b29STheodore Ts'o struct pt_regs *regs = get_irq_regs(); 109458340f8eSJason A. Donenfeld unsigned int new_count; 10953060d6feSYinghai Lu 1096791332b3SJason A. Donenfeld fast_mix(fast_pool->pool, entropy, 1097791332b3SJason A. Donenfeld (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq)); 10983191dd5aSJason A. Donenfeld new_count = ++fast_pool->count; 1099775f4b29STheodore Ts'o 110058340f8eSJason A. Donenfeld if (new_count & MIX_INFLIGHT) 11011da177e4SLinus Torvalds return; 1102840f9507STheodore Ts'o 1103534d2eafSJason A. Donenfeld if (new_count < 1024 && !time_is_before_jiffies(fast_pool->last + HZ)) 11041da177e4SLinus Torvalds return; 11051da177e4SLinus Torvalds 11063191dd5aSJason A. Donenfeld fast_pool->count |= MIX_INFLIGHT; 1107748bc4ddSJason A. Donenfeld if (!timer_pending(&fast_pool->mix)) { 1108748bc4ddSJason A. Donenfeld fast_pool->mix.expires = jiffies; 1109748bc4ddSJason A. Donenfeld add_timer_on(&fast_pool->mix, raw_smp_processor_id()); 1110748bc4ddSJason A. Donenfeld } 11111da177e4SLinus Torvalds } 11124b44f2d1SStephan Mueller EXPORT_SYMBOL_GPL(add_interrupt_randomness); 11131da177e4SLinus Torvalds 1114a4b5c26bSJason A. Donenfeld /* There is one of these per entropy source */ 1115a4b5c26bSJason A. Donenfeld struct timer_rand_state { 1116a4b5c26bSJason A. Donenfeld unsigned long last_time; 1117a4b5c26bSJason A. Donenfeld long last_delta, last_delta2; 1118a4b5c26bSJason A. Donenfeld }; 1119a4b5c26bSJason A. Donenfeld 1120a4b5c26bSJason A. Donenfeld /* 1121a4b5c26bSJason A. Donenfeld * This function adds entropy to the entropy "pool" by using timing 1122a4b5c26bSJason A. Donenfeld * delays. It uses the timer_rand_state structure to make an estimate 1123e3e33fc2SJason A. Donenfeld * of how many bits of entropy this call has added to the pool. The 1124e3e33fc2SJason A. Donenfeld * value "num" is also added to the pool; it should somehow describe 1125e3e33fc2SJason A. Donenfeld * the type of event that just happened. 1126a4b5c26bSJason A. Donenfeld */ 1127a4b5c26bSJason A. Donenfeld static void add_timer_randomness(struct timer_rand_state *state, unsigned int num) 1128a4b5c26bSJason A. Donenfeld { 1129a4b5c26bSJason A. Donenfeld unsigned long entropy = random_get_entropy(), now = jiffies, flags; 1130a4b5c26bSJason A. Donenfeld long delta, delta2, delta3; 1131e3e33fc2SJason A. Donenfeld unsigned int bits; 1132a4b5c26bSJason A. Donenfeld 1133e3e33fc2SJason A. Donenfeld /* 1134e3e33fc2SJason A. Donenfeld * If we're in a hard IRQ, add_interrupt_randomness() will be called 1135e3e33fc2SJason A. Donenfeld * sometime after, so mix into the fast pool. 1136e3e33fc2SJason A. Donenfeld */ 1137e3e33fc2SJason A. Donenfeld if (in_hardirq()) { 1138791332b3SJason A. Donenfeld fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num); 1139e3e33fc2SJason A. Donenfeld } else { 1140a4b5c26bSJason A. Donenfeld spin_lock_irqsave(&input_pool.lock, flags); 1141a4b5c26bSJason A. Donenfeld _mix_pool_bytes(&entropy, sizeof(entropy)); 1142a4b5c26bSJason A. Donenfeld _mix_pool_bytes(&num, sizeof(num)); 1143a4b5c26bSJason A. Donenfeld spin_unlock_irqrestore(&input_pool.lock, flags); 1144e3e33fc2SJason A. Donenfeld } 1145a4b5c26bSJason A. Donenfeld 1146a4b5c26bSJason A. Donenfeld if (crng_ready()) 1147a4b5c26bSJason A. Donenfeld return; 1148a4b5c26bSJason A. Donenfeld 1149a4b5c26bSJason A. Donenfeld /* 1150a4b5c26bSJason A. Donenfeld * Calculate number of bits of randomness we probably added. 1151a4b5c26bSJason A. Donenfeld * We take into account the first, second and third-order deltas 1152a4b5c26bSJason A. Donenfeld * in order to make our estimate. 1153a4b5c26bSJason A. Donenfeld */ 1154a4b5c26bSJason A. Donenfeld delta = now - READ_ONCE(state->last_time); 1155a4b5c26bSJason A. Donenfeld WRITE_ONCE(state->last_time, now); 1156a4b5c26bSJason A. Donenfeld 1157a4b5c26bSJason A. Donenfeld delta2 = delta - READ_ONCE(state->last_delta); 1158a4b5c26bSJason A. Donenfeld WRITE_ONCE(state->last_delta, delta); 1159a4b5c26bSJason A. Donenfeld 1160a4b5c26bSJason A. Donenfeld delta3 = delta2 - READ_ONCE(state->last_delta2); 1161a4b5c26bSJason A. Donenfeld WRITE_ONCE(state->last_delta2, delta2); 1162a4b5c26bSJason A. Donenfeld 1163a4b5c26bSJason A. Donenfeld if (delta < 0) 1164a4b5c26bSJason A. Donenfeld delta = -delta; 1165a4b5c26bSJason A. Donenfeld if (delta2 < 0) 1166a4b5c26bSJason A. Donenfeld delta2 = -delta2; 1167a4b5c26bSJason A. Donenfeld if (delta3 < 0) 1168a4b5c26bSJason A. Donenfeld delta3 = -delta3; 1169a4b5c26bSJason A. Donenfeld if (delta > delta2) 1170a4b5c26bSJason A. Donenfeld delta = delta2; 1171a4b5c26bSJason A. Donenfeld if (delta > delta3) 1172a4b5c26bSJason A. Donenfeld delta = delta3; 1173a4b5c26bSJason A. Donenfeld 1174a4b5c26bSJason A. Donenfeld /* 1175e3e33fc2SJason A. Donenfeld * delta is now minimum absolute delta. Round down by 1 bit 1176e3e33fc2SJason A. Donenfeld * on general principles, and limit entropy estimate to 11 bits. 1177a4b5c26bSJason A. Donenfeld */ 1178e3e33fc2SJason A. Donenfeld bits = min(fls(delta >> 1), 11); 1179e3e33fc2SJason A. Donenfeld 1180e3e33fc2SJason A. Donenfeld /* 1181e3e33fc2SJason A. Donenfeld * As mentioned above, if we're in a hard IRQ, add_interrupt_randomness() 1182e3e33fc2SJason A. Donenfeld * will run after this, which uses a different crediting scheme of 1 bit 1183e3e33fc2SJason A. Donenfeld * per every 64 interrupts. In order to let that function do accounting 1184e3e33fc2SJason A. Donenfeld * close to the one in this function, we credit a full 64/64 bit per bit, 1185e3e33fc2SJason A. Donenfeld * and then subtract one to account for the extra one added. 1186e3e33fc2SJason A. Donenfeld */ 1187e3e33fc2SJason A. Donenfeld if (in_hardirq()) 1188e3e33fc2SJason A. Donenfeld this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1; 1189e3e33fc2SJason A. Donenfeld else 1190560181c2SJason A. Donenfeld _credit_init_bits(bits); 1191a4b5c26bSJason A. Donenfeld } 1192a4b5c26bSJason A. Donenfeld 1193a1940263SJason A. Donenfeld void add_input_randomness(unsigned int type, unsigned int code, unsigned int value) 1194a4b5c26bSJason A. Donenfeld { 1195a4b5c26bSJason A. Donenfeld static unsigned char last_value; 1196a4b5c26bSJason A. Donenfeld static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES }; 1197a4b5c26bSJason A. Donenfeld 1198a4b5c26bSJason A. Donenfeld /* Ignore autorepeat and the like. */ 1199a4b5c26bSJason A. Donenfeld if (value == last_value) 1200a4b5c26bSJason A. Donenfeld return; 1201a4b5c26bSJason A. Donenfeld 1202a4b5c26bSJason A. Donenfeld last_value = value; 1203a4b5c26bSJason A. Donenfeld add_timer_randomness(&input_timer_state, 1204a4b5c26bSJason A. Donenfeld (type << 4) ^ code ^ (code >> 4) ^ value); 1205a4b5c26bSJason A. Donenfeld } 1206a4b5c26bSJason A. Donenfeld EXPORT_SYMBOL_GPL(add_input_randomness); 1207a4b5c26bSJason A. Donenfeld 1208a4b5c26bSJason A. Donenfeld #ifdef CONFIG_BLOCK 1209a4b5c26bSJason A. Donenfeld void add_disk_randomness(struct gendisk *disk) 1210a4b5c26bSJason A. Donenfeld { 1211a4b5c26bSJason A. Donenfeld if (!disk || !disk->random) 1212a4b5c26bSJason A. Donenfeld return; 1213a4b5c26bSJason A. Donenfeld /* First major is 1, so we get >= 0x200 here. */ 1214a4b5c26bSJason A. Donenfeld add_timer_randomness(disk->random, 0x100 + disk_devt(disk)); 1215a4b5c26bSJason A. Donenfeld } 1216a4b5c26bSJason A. Donenfeld EXPORT_SYMBOL_GPL(add_disk_randomness); 1217a4b5c26bSJason A. Donenfeld 1218560181c2SJason A. Donenfeld void __cold rand_initialize_disk(struct gendisk *disk) 1219a4b5c26bSJason A. Donenfeld { 1220a4b5c26bSJason A. Donenfeld struct timer_rand_state *state; 1221a4b5c26bSJason A. Donenfeld 1222a4b5c26bSJason A. Donenfeld /* 1223a4b5c26bSJason A. Donenfeld * If kzalloc returns null, we just won't use that entropy 1224a4b5c26bSJason A. Donenfeld * source. 1225a4b5c26bSJason A. Donenfeld */ 1226a4b5c26bSJason A. Donenfeld state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL); 1227a4b5c26bSJason A. Donenfeld if (state) { 1228a4b5c26bSJason A. Donenfeld state->last_time = INITIAL_JIFFIES; 1229a4b5c26bSJason A. Donenfeld disk->random = state; 1230a4b5c26bSJason A. Donenfeld } 1231a4b5c26bSJason A. Donenfeld } 1232a4b5c26bSJason A. Donenfeld #endif 1233a4b5c26bSJason A. Donenfeld 123478c768e6SJason A. Donenfeld struct entropy_timer_state { 123578c768e6SJason A. Donenfeld unsigned long entropy; 123678c768e6SJason A. Donenfeld struct timer_list timer; 12371c21fe00SJason A. Donenfeld atomic_t samples; 12381c21fe00SJason A. Donenfeld unsigned int samples_per_bit; 123978c768e6SJason A. Donenfeld }; 124078c768e6SJason A. Donenfeld 12411da177e4SLinus Torvalds /* 12420e42d14bSJason A. Donenfeld * Each time the timer fires, we expect that we got an unpredictable jump in 12430e42d14bSJason A. Donenfeld * the cycle counter. Even if the timer is running on another CPU, the timer 12440e42d14bSJason A. Donenfeld * activity will be touching the stack of the CPU that is generating entropy. 124550ee7529SLinus Torvalds * 12460e42d14bSJason A. Donenfeld * Note that we don't re-arm the timer in the timer itself - we are happy to be 12470e42d14bSJason A. Donenfeld * scheduled away, since that just makes the load more complex, but we do not 12480e42d14bSJason A. Donenfeld * want the timer to keep ticking unless the entropy loop is running. 124950ee7529SLinus Torvalds * 125050ee7529SLinus Torvalds * So the re-arming always happens in the entropy loop itself. 125150ee7529SLinus Torvalds */ 1252560181c2SJason A. Donenfeld static void __cold entropy_timer(struct timer_list *timer) 125350ee7529SLinus Torvalds { 125478c768e6SJason A. Donenfeld struct entropy_timer_state *state = container_of(timer, struct entropy_timer_state, timer); 1255b83e45fdSJason A. Donenfeld unsigned long entropy = random_get_entropy(); 125678c768e6SJason A. Donenfeld 1257b83e45fdSJason A. Donenfeld mix_pool_bytes(&entropy, sizeof(entropy)); 12581c21fe00SJason A. Donenfeld if (atomic_inc_return(&state->samples) % state->samples_per_bit == 0) 1259e85c0fc1SJason A. Donenfeld credit_init_bits(1); 126050ee7529SLinus Torvalds } 126150ee7529SLinus Torvalds 126250ee7529SLinus Torvalds /* 12630e42d14bSJason A. Donenfeld * If we have an actual cycle counter, see if we can generate enough entropy 12640e42d14bSJason A. Donenfeld * with timing noise. 126550ee7529SLinus Torvalds */ 1266560181c2SJason A. Donenfeld static void __cold try_to_generate_entropy(void) 126750ee7529SLinus Torvalds { 126812273347SJason A. Donenfeld enum { NUM_TRIAL_SAMPLES = 8192, MAX_SAMPLES_PER_BIT = HZ / 15 }; 126939ec9e6bSJason A. Donenfeld u8 stack_bytes[sizeof(struct entropy_timer_state) + SMP_CACHE_BYTES - 1]; 127039ec9e6bSJason A. Donenfeld struct entropy_timer_state *stack = PTR_ALIGN((void *)stack_bytes, SMP_CACHE_BYTES); 127178c768e6SJason A. Donenfeld unsigned int i, num_different = 0; 127278c768e6SJason A. Donenfeld unsigned long last = random_get_entropy(); 12731c21fe00SJason A. Donenfeld int cpu = -1; 127450ee7529SLinus Torvalds 127578c768e6SJason A. Donenfeld for (i = 0; i < NUM_TRIAL_SAMPLES - 1; ++i) { 127639ec9e6bSJason A. Donenfeld stack->entropy = random_get_entropy(); 127739ec9e6bSJason A. Donenfeld if (stack->entropy != last) 127878c768e6SJason A. Donenfeld ++num_different; 127939ec9e6bSJason A. Donenfeld last = stack->entropy; 128078c768e6SJason A. Donenfeld } 128139ec9e6bSJason A. Donenfeld stack->samples_per_bit = DIV_ROUND_UP(NUM_TRIAL_SAMPLES, num_different + 1); 128239ec9e6bSJason A. Donenfeld if (stack->samples_per_bit > MAX_SAMPLES_PER_BIT) 128350ee7529SLinus Torvalds return; 128450ee7529SLinus Torvalds 128539ec9e6bSJason A. Donenfeld atomic_set(&stack->samples, 0); 128639ec9e6bSJason A. Donenfeld timer_setup_on_stack(&stack->timer, entropy_timer, 0); 12873e504d20SJason A. Donenfeld while (!crng_ready() && !signal_pending(current)) { 12881c21fe00SJason A. Donenfeld /* 12891c21fe00SJason A. Donenfeld * Check !timer_pending() and then ensure that any previous callback has finished 12901c21fe00SJason A. Donenfeld * executing by checking try_to_del_timer_sync(), before queueing the next one. 12911c21fe00SJason A. Donenfeld */ 129239ec9e6bSJason A. Donenfeld if (!timer_pending(&stack->timer) && try_to_del_timer_sync(&stack->timer) >= 0) { 12931c21fe00SJason A. Donenfeld struct cpumask timer_cpus; 12941c21fe00SJason A. Donenfeld unsigned int num_cpus; 12951c21fe00SJason A. Donenfeld 12961c21fe00SJason A. Donenfeld /* 12971c21fe00SJason A. Donenfeld * Preemption must be disabled here, both to read the current CPU number 12981c21fe00SJason A. Donenfeld * and to avoid scheduling a timer on a dead CPU. 12991c21fe00SJason A. Donenfeld */ 13001c21fe00SJason A. Donenfeld preempt_disable(); 13011c21fe00SJason A. Donenfeld 13021c21fe00SJason A. Donenfeld /* Only schedule callbacks on timer CPUs that are online. */ 13031c21fe00SJason A. Donenfeld cpumask_and(&timer_cpus, housekeeping_cpumask(HK_TYPE_TIMER), cpu_online_mask); 13041c21fe00SJason A. Donenfeld num_cpus = cpumask_weight(&timer_cpus); 13051c21fe00SJason A. Donenfeld /* In very bizarre case of misconfiguration, fallback to all online. */ 13061c21fe00SJason A. Donenfeld if (unlikely(num_cpus == 0)) { 13071c21fe00SJason A. Donenfeld timer_cpus = *cpu_online_mask; 13081c21fe00SJason A. Donenfeld num_cpus = cpumask_weight(&timer_cpus); 13091c21fe00SJason A. Donenfeld } 13101c21fe00SJason A. Donenfeld 13111c21fe00SJason A. Donenfeld /* Basic CPU round-robin, which avoids the current CPU. */ 13121c21fe00SJason A. Donenfeld do { 13131c21fe00SJason A. Donenfeld cpu = cpumask_next(cpu, &timer_cpus); 13141c21fe00SJason A. Donenfeld if (cpu == nr_cpumask_bits) 13151c21fe00SJason A. Donenfeld cpu = cpumask_first(&timer_cpus); 13161c21fe00SJason A. Donenfeld } while (cpu == smp_processor_id() && num_cpus > 1); 13171c21fe00SJason A. Donenfeld 13181c21fe00SJason A. Donenfeld /* Expiring the timer at `jiffies` means it's the next tick. */ 131939ec9e6bSJason A. Donenfeld stack->timer.expires = jiffies; 13201c21fe00SJason A. Donenfeld 132139ec9e6bSJason A. Donenfeld add_timer_on(&stack->timer, cpu); 13221c21fe00SJason A. Donenfeld 13231c21fe00SJason A. Donenfeld preempt_enable(); 13241c21fe00SJason A. Donenfeld } 132539ec9e6bSJason A. Donenfeld mix_pool_bytes(&stack->entropy, sizeof(stack->entropy)); 132650ee7529SLinus Torvalds schedule(); 132739ec9e6bSJason A. Donenfeld stack->entropy = random_get_entropy(); 132850ee7529SLinus Torvalds } 132939ec9e6bSJason A. Donenfeld mix_pool_bytes(&stack->entropy, sizeof(stack->entropy)); 133050ee7529SLinus Torvalds 133139ec9e6bSJason A. Donenfeld del_timer_sync(&stack->timer); 133239ec9e6bSJason A. Donenfeld destroy_timer_on_stack(&stack->timer); 133350ee7529SLinus Torvalds } 133450ee7529SLinus Torvalds 1335a6adf8e7SJason A. Donenfeld 1336a6adf8e7SJason A. Donenfeld /********************************************************************** 1337a6adf8e7SJason A. Donenfeld * 1338a6adf8e7SJason A. Donenfeld * Userspace reader/writer interfaces. 1339a6adf8e7SJason A. Donenfeld * 1340a6adf8e7SJason A. Donenfeld * getrandom(2) is the primary modern interface into the RNG and should 1341a6adf8e7SJason A. Donenfeld * be used in preference to anything else. 1342a6adf8e7SJason A. Donenfeld * 13430313bc27SLinus Torvalds * Reading from /dev/random has the same functionality as calling 13440313bc27SLinus Torvalds * getrandom(2) with flags=0. In earlier versions, however, it had 13450313bc27SLinus Torvalds * vastly different semantics and should therefore be avoided, to 13460313bc27SLinus Torvalds * prevent backwards compatibility issues. 13470313bc27SLinus Torvalds * 13480313bc27SLinus Torvalds * Reading from /dev/urandom has the same functionality as calling 13490313bc27SLinus Torvalds * getrandom(2) with flags=GRND_INSECURE. Because it does not block 13500313bc27SLinus Torvalds * waiting for the RNG to be ready, it should not be used. 1351a6adf8e7SJason A. Donenfeld * 1352a6adf8e7SJason A. Donenfeld * Writing to either /dev/random or /dev/urandom adds entropy to 1353a6adf8e7SJason A. Donenfeld * the input pool but does not credit it. 1354a6adf8e7SJason A. Donenfeld * 13550313bc27SLinus Torvalds * Polling on /dev/random indicates when the RNG is initialized, on 13560313bc27SLinus Torvalds * the read side, and when it wants new entropy, on the write side. 1357a6adf8e7SJason A. Donenfeld * 1358a6adf8e7SJason A. Donenfeld * Both /dev/random and /dev/urandom have the same set of ioctls for 1359a6adf8e7SJason A. Donenfeld * adding entropy, getting the entropy count, zeroing the count, and 1360a6adf8e7SJason A. Donenfeld * reseeding the crng. 1361a6adf8e7SJason A. Donenfeld * 1362a6adf8e7SJason A. Donenfeld **********************************************************************/ 1363a6adf8e7SJason A. Donenfeld 1364a1940263SJason A. Donenfeld SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags) 13651da177e4SLinus Torvalds { 13661b388e77SJens Axboe struct iov_iter iter; 13671b388e77SJens Axboe struct iovec iov; 13681b388e77SJens Axboe int ret; 13691b388e77SJens Axboe 1370a6adf8e7SJason A. Donenfeld if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE)) 1371a6adf8e7SJason A. Donenfeld return -EINVAL; 1372301f0595STheodore Ts'o 1373a6adf8e7SJason A. Donenfeld /* 1374a6adf8e7SJason A. Donenfeld * Requesting insecure and blocking randomness at the same time makes 1375a6adf8e7SJason A. Donenfeld * no sense. 1376a6adf8e7SJason A. Donenfeld */ 1377a6adf8e7SJason A. Donenfeld if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM)) 1378a6adf8e7SJason A. Donenfeld return -EINVAL; 1379c6f1deb1SAndy Lutomirski 1380f5bda35fSJason A. Donenfeld if (!crng_ready() && !(flags & GRND_INSECURE)) { 1381a6adf8e7SJason A. Donenfeld if (flags & GRND_NONBLOCK) 1382a6adf8e7SJason A. Donenfeld return -EAGAIN; 138330c08efeSAndy Lutomirski ret = wait_for_random_bytes(); 1384a6adf8e7SJason A. Donenfeld if (unlikely(ret)) 138530c08efeSAndy Lutomirski return ret; 1386a6adf8e7SJason A. Donenfeld } 13871b388e77SJens Axboe 1388de4eda9dSAl Viro ret = import_single_range(ITER_DEST, ubuf, len, &iov, &iter); 13891b388e77SJens Axboe if (unlikely(ret)) 13901b388e77SJens Axboe return ret; 13911b388e77SJens Axboe return get_random_bytes_user(&iter); 139230c08efeSAndy Lutomirski } 139330c08efeSAndy Lutomirski 1394248045b8SJason A. Donenfeld static __poll_t random_poll(struct file *file, poll_table *wait) 139589b310a2SChristoph Hellwig { 139630c08efeSAndy Lutomirski poll_wait(file, &crng_init_wait, wait); 1397e85c0fc1SJason A. Donenfeld return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; 13981da177e4SLinus Torvalds } 13991da177e4SLinus Torvalds 14001ce6c8d6SJason A. Donenfeld static ssize_t write_pool_user(struct iov_iter *iter) 14017f397dcdSMatt Mackall { 140204ec96b7SJason A. Donenfeld u8 block[BLAKE2S_BLOCK_SIZE]; 140322b0a222SJens Axboe ssize_t ret = 0; 140422b0a222SJens Axboe size_t copied; 14057f397dcdSMatt Mackall 140622b0a222SJens Axboe if (unlikely(!iov_iter_count(iter))) 140722b0a222SJens Axboe return 0; 140822b0a222SJens Axboe 140922b0a222SJens Axboe for (;;) { 141022b0a222SJens Axboe copied = copy_from_iter(block, sizeof(block), iter); 141122b0a222SJens Axboe ret += copied; 141222b0a222SJens Axboe mix_pool_bytes(block, copied); 141322b0a222SJens Axboe if (!iov_iter_count(iter) || copied != sizeof(block)) 141422b0a222SJens Axboe break; 14151ce6c8d6SJason A. Donenfeld 14161ce6c8d6SJason A. Donenfeld BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0); 14171ce6c8d6SJason A. Donenfeld if (ret % PAGE_SIZE == 0) { 14181ce6c8d6SJason A. Donenfeld if (signal_pending(current)) 14191ce6c8d6SJason A. Donenfeld break; 142091f3f1e3SMatt Mackall cond_resched(); 14217f397dcdSMatt Mackall } 14221ce6c8d6SJason A. Donenfeld } 14237f397dcdSMatt Mackall 14247b5164fbSJason A. Donenfeld memzero_explicit(block, sizeof(block)); 142522b0a222SJens Axboe return ret ? ret : -EFAULT; 14267f397dcdSMatt Mackall } 14277f397dcdSMatt Mackall 142822b0a222SJens Axboe static ssize_t random_write_iter(struct kiocb *kiocb, struct iov_iter *iter) 14291da177e4SLinus Torvalds { 14301ce6c8d6SJason A. Donenfeld return write_pool_user(iter); 14311da177e4SLinus Torvalds } 14321da177e4SLinus Torvalds 14331b388e77SJens Axboe static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter) 14340313bc27SLinus Torvalds { 14350313bc27SLinus Torvalds static int maxwarn = 10; 14360313bc27SLinus Torvalds 143748bff105SJason A. Donenfeld /* 143848bff105SJason A. Donenfeld * Opportunistically attempt to initialize the RNG on platforms that 143948bff105SJason A. Donenfeld * have fast cycle counters, but don't (for now) require it to succeed. 144048bff105SJason A. Donenfeld */ 144148bff105SJason A. Donenfeld if (!crng_ready()) 144248bff105SJason A. Donenfeld try_to_generate_entropy(); 144348bff105SJason A. Donenfeld 1444cc1e127bSJason A. Donenfeld if (!crng_ready()) { 1445cc1e127bSJason A. Donenfeld if (!ratelimit_disable && maxwarn <= 0) 1446cc1e127bSJason A. Donenfeld ++urandom_warning.missed; 1447cc1e127bSJason A. Donenfeld else if (ratelimit_disable || __ratelimit(&urandom_warning)) { 1448cc1e127bSJason A. Donenfeld --maxwarn; 14491b388e77SJens Axboe pr_notice("%s: uninitialized urandom read (%zu bytes read)\n", 14501b388e77SJens Axboe current->comm, iov_iter_count(iter)); 14510313bc27SLinus Torvalds } 1452cc1e127bSJason A. Donenfeld } 14530313bc27SLinus Torvalds 14541b388e77SJens Axboe return get_random_bytes_user(iter); 14550313bc27SLinus Torvalds } 14560313bc27SLinus Torvalds 14571b388e77SJens Axboe static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter) 1458a6adf8e7SJason A. Donenfeld { 1459a6adf8e7SJason A. Donenfeld int ret; 1460a6adf8e7SJason A. Donenfeld 1461cd4f24aeSJason A. Donenfeld if (!crng_ready() && 1462cd4f24aeSJason A. Donenfeld ((kiocb->ki_flags & (IOCB_NOWAIT | IOCB_NOIO)) || 1463cd4f24aeSJason A. Donenfeld (kiocb->ki_filp->f_flags & O_NONBLOCK))) 1464cd4f24aeSJason A. Donenfeld return -EAGAIN; 1465cd4f24aeSJason A. Donenfeld 1466a6adf8e7SJason A. Donenfeld ret = wait_for_random_bytes(); 1467a6adf8e7SJason A. Donenfeld if (ret != 0) 1468a6adf8e7SJason A. Donenfeld return ret; 14691b388e77SJens Axboe return get_random_bytes_user(iter); 1470a6adf8e7SJason A. Donenfeld } 1471a6adf8e7SJason A. Donenfeld 147243ae4860SMatt Mackall static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) 14731da177e4SLinus Torvalds { 14741da177e4SLinus Torvalds int __user *p = (int __user *)arg; 147522b0a222SJens Axboe int ent_count; 14761da177e4SLinus Torvalds 14771da177e4SLinus Torvalds switch (cmd) { 14781da177e4SLinus Torvalds case RNDGETENTCNT: 1479a6adf8e7SJason A. Donenfeld /* Inherently racy, no point locking. */ 1480e85c0fc1SJason A. Donenfeld if (put_user(input_pool.init_bits, p)) 14811da177e4SLinus Torvalds return -EFAULT; 14821da177e4SLinus Torvalds return 0; 14831da177e4SLinus Torvalds case RNDADDTOENTCNT: 14841da177e4SLinus Torvalds if (!capable(CAP_SYS_ADMIN)) 14851da177e4SLinus Torvalds return -EPERM; 14861da177e4SLinus Torvalds if (get_user(ent_count, p)) 14871da177e4SLinus Torvalds return -EFAULT; 1488a49c010eSJason A. Donenfeld if (ent_count < 0) 1489a49c010eSJason A. Donenfeld return -EINVAL; 1490e85c0fc1SJason A. Donenfeld credit_init_bits(ent_count); 1491a49c010eSJason A. Donenfeld return 0; 149222b0a222SJens Axboe case RNDADDENTROPY: { 149322b0a222SJens Axboe struct iov_iter iter; 149422b0a222SJens Axboe struct iovec iov; 149522b0a222SJens Axboe ssize_t ret; 149622b0a222SJens Axboe int len; 149722b0a222SJens Axboe 14981da177e4SLinus Torvalds if (!capable(CAP_SYS_ADMIN)) 14991da177e4SLinus Torvalds return -EPERM; 15001da177e4SLinus Torvalds if (get_user(ent_count, p++)) 15011da177e4SLinus Torvalds return -EFAULT; 15021da177e4SLinus Torvalds if (ent_count < 0) 15031da177e4SLinus Torvalds return -EINVAL; 150422b0a222SJens Axboe if (get_user(len, p++)) 15051da177e4SLinus Torvalds return -EFAULT; 1506de4eda9dSAl Viro ret = import_single_range(ITER_SOURCE, p, len, &iov, &iter); 150722b0a222SJens Axboe if (unlikely(ret)) 150822b0a222SJens Axboe return ret; 15091ce6c8d6SJason A. Donenfeld ret = write_pool_user(&iter); 151022b0a222SJens Axboe if (unlikely(ret < 0)) 151122b0a222SJens Axboe return ret; 151222b0a222SJens Axboe /* Since we're crediting, enforce that it was all written into the pool. */ 151322b0a222SJens Axboe if (unlikely(ret != len)) 151422b0a222SJens Axboe return -EFAULT; 1515e85c0fc1SJason A. Donenfeld credit_init_bits(ent_count); 1516a49c010eSJason A. Donenfeld return 0; 151722b0a222SJens Axboe } 15181da177e4SLinus Torvalds case RNDZAPENTCNT: 15191da177e4SLinus Torvalds case RNDCLEARPOOL: 1520e85c0fc1SJason A. Donenfeld /* No longer has any effect. */ 15211da177e4SLinus Torvalds if (!capable(CAP_SYS_ADMIN)) 15221da177e4SLinus Torvalds return -EPERM; 15231da177e4SLinus Torvalds return 0; 1524d848e5f8STheodore Ts'o case RNDRESEEDCRNG: 1525d848e5f8STheodore Ts'o if (!capable(CAP_SYS_ADMIN)) 1526d848e5f8STheodore Ts'o return -EPERM; 1527a96cfe2dSJason A. Donenfeld if (!crng_ready()) 1528d848e5f8STheodore Ts'o return -ENODATA; 15299148de31SJason A. Donenfeld crng_reseed(NULL); 1530d848e5f8STheodore Ts'o return 0; 15311da177e4SLinus Torvalds default: 15321da177e4SLinus Torvalds return -EINVAL; 15331da177e4SLinus Torvalds } 15341da177e4SLinus Torvalds } 15351da177e4SLinus Torvalds 15369a6f70bbSJeff Dike static int random_fasync(int fd, struct file *filp, int on) 15379a6f70bbSJeff Dike { 15389a6f70bbSJeff Dike return fasync_helper(fd, filp, on, &fasync); 15399a6f70bbSJeff Dike } 15409a6f70bbSJeff Dike 15412b8693c0SArjan van de Ven const struct file_operations random_fops = { 15421b388e77SJens Axboe .read_iter = random_read_iter, 154322b0a222SJens Axboe .write_iter = random_write_iter, 1544a11e1d43SLinus Torvalds .poll = random_poll, 154543ae4860SMatt Mackall .unlocked_ioctl = random_ioctl, 1546507e4e2bSArnd Bergmann .compat_ioctl = compat_ptr_ioctl, 15479a6f70bbSJeff Dike .fasync = random_fasync, 15486038f373SArnd Bergmann .llseek = noop_llseek, 154979025e72SJens Axboe .splice_read = generic_file_splice_read, 155079025e72SJens Axboe .splice_write = iter_file_splice_write, 15511da177e4SLinus Torvalds }; 15521da177e4SLinus Torvalds 15530313bc27SLinus Torvalds const struct file_operations urandom_fops = { 15541b388e77SJens Axboe .read_iter = urandom_read_iter, 155522b0a222SJens Axboe .write_iter = random_write_iter, 15560313bc27SLinus Torvalds .unlocked_ioctl = random_ioctl, 15570313bc27SLinus Torvalds .compat_ioctl = compat_ptr_ioctl, 15580313bc27SLinus Torvalds .fasync = random_fasync, 15590313bc27SLinus Torvalds .llseek = noop_llseek, 156079025e72SJens Axboe .splice_read = generic_file_splice_read, 156179025e72SJens Axboe .splice_write = iter_file_splice_write, 15620313bc27SLinus Torvalds }; 15630313bc27SLinus Torvalds 15640deff3c4SJason A. Donenfeld 15651da177e4SLinus Torvalds /******************************************************************** 15661da177e4SLinus Torvalds * 15670deff3c4SJason A. Donenfeld * Sysctl interface. 15680deff3c4SJason A. Donenfeld * 15690deff3c4SJason A. Donenfeld * These are partly unused legacy knobs with dummy values to not break 15700deff3c4SJason A. Donenfeld * userspace and partly still useful things. They are usually accessible 15710deff3c4SJason A. Donenfeld * in /proc/sys/kernel/random/ and are as follows: 15720deff3c4SJason A. Donenfeld * 15730deff3c4SJason A. Donenfeld * - boot_id - a UUID representing the current boot. 15740deff3c4SJason A. Donenfeld * 15750deff3c4SJason A. Donenfeld * - uuid - a random UUID, different each time the file is read. 15760deff3c4SJason A. Donenfeld * 15770deff3c4SJason A. Donenfeld * - poolsize - the number of bits of entropy that the input pool can 15780deff3c4SJason A. Donenfeld * hold, tied to the POOL_BITS constant. 15790deff3c4SJason A. Donenfeld * 15800deff3c4SJason A. Donenfeld * - entropy_avail - the number of bits of entropy currently in the 15810deff3c4SJason A. Donenfeld * input pool. Always <= poolsize. 15820deff3c4SJason A. Donenfeld * 15830deff3c4SJason A. Donenfeld * - write_wakeup_threshold - the amount of entropy in the input pool 15840deff3c4SJason A. Donenfeld * below which write polls to /dev/random will unblock, requesting 1585e3d2c5e7SJason A. Donenfeld * more entropy, tied to the POOL_READY_BITS constant. It is writable 15860deff3c4SJason A. Donenfeld * to avoid breaking old userspaces, but writing to it does not 15870deff3c4SJason A. Donenfeld * change any behavior of the RNG. 15880deff3c4SJason A. Donenfeld * 1589d0efdf35SJason A. Donenfeld * - urandom_min_reseed_secs - fixed to the value CRNG_RESEED_INTERVAL. 15900deff3c4SJason A. Donenfeld * It is writable to avoid breaking old userspaces, but writing 15910deff3c4SJason A. Donenfeld * to it does not change any behavior of the RNG. 15921da177e4SLinus Torvalds * 15931da177e4SLinus Torvalds ********************************************************************/ 15941da177e4SLinus Torvalds 15951da177e4SLinus Torvalds #ifdef CONFIG_SYSCTL 15961da177e4SLinus Torvalds 15971da177e4SLinus Torvalds #include <linux/sysctl.h> 15981da177e4SLinus Torvalds 1599d0efdf35SJason A. Donenfeld static int sysctl_random_min_urandom_seed = CRNG_RESEED_INTERVAL / HZ; 1600e3d2c5e7SJason A. Donenfeld static int sysctl_random_write_wakeup_bits = POOL_READY_BITS; 1601489c7fc4SJason A. Donenfeld static int sysctl_poolsize = POOL_BITS; 160264276a99SJason A. Donenfeld static u8 sysctl_bootid[UUID_SIZE]; 16031da177e4SLinus Torvalds 16041da177e4SLinus Torvalds /* 1605f22052b2SGreg Price * This function is used to return both the bootid UUID, and random 16061da177e4SLinus Torvalds * UUID. The difference is in whether table->data is NULL; if it is, 16071da177e4SLinus Torvalds * then a new UUID is generated and returned to the user. 16081da177e4SLinus Torvalds */ 1609a1940263SJason A. Donenfeld static int proc_do_uuid(struct ctl_table *table, int write, void *buf, 1610248045b8SJason A. Donenfeld size_t *lenp, loff_t *ppos) 16111da177e4SLinus Torvalds { 161264276a99SJason A. Donenfeld u8 tmp_uuid[UUID_SIZE], *uuid; 161364276a99SJason A. Donenfeld char uuid_string[UUID_STRING_LEN + 1]; 161464276a99SJason A. Donenfeld struct ctl_table fake_table = { 161564276a99SJason A. Donenfeld .data = uuid_string, 161664276a99SJason A. Donenfeld .maxlen = UUID_STRING_LEN 161764276a99SJason A. Donenfeld }; 161864276a99SJason A. Donenfeld 161964276a99SJason A. Donenfeld if (write) 162064276a99SJason A. Donenfeld return -EPERM; 16211da177e4SLinus Torvalds 16221da177e4SLinus Torvalds uuid = table->data; 16231da177e4SLinus Torvalds if (!uuid) { 16241da177e4SLinus Torvalds uuid = tmp_uuid; 16251da177e4SLinus Torvalds generate_random_uuid(uuid); 162644e4360fSMathieu Desnoyers } else { 162744e4360fSMathieu Desnoyers static DEFINE_SPINLOCK(bootid_spinlock); 162844e4360fSMathieu Desnoyers 162944e4360fSMathieu Desnoyers spin_lock(&bootid_spinlock); 163044e4360fSMathieu Desnoyers if (!uuid[8]) 163144e4360fSMathieu Desnoyers generate_random_uuid(uuid); 163244e4360fSMathieu Desnoyers spin_unlock(&bootid_spinlock); 163344e4360fSMathieu Desnoyers } 16341da177e4SLinus Torvalds 163564276a99SJason A. Donenfeld snprintf(uuid_string, sizeof(uuid_string), "%pU", uuid); 1636a1940263SJason A. Donenfeld return proc_dostring(&fake_table, 0, buf, lenp, ppos); 16371da177e4SLinus Torvalds } 16381da177e4SLinus Torvalds 163977553cf8SJason A. Donenfeld /* The same as proc_dointvec, but writes don't change anything. */ 1640a1940263SJason A. Donenfeld static int proc_do_rointvec(struct ctl_table *table, int write, void *buf, 164177553cf8SJason A. Donenfeld size_t *lenp, loff_t *ppos) 164277553cf8SJason A. Donenfeld { 1643a1940263SJason A. Donenfeld return write ? 0 : proc_dointvec(table, 0, buf, lenp, ppos); 164477553cf8SJason A. Donenfeld } 164577553cf8SJason A. Donenfeld 16465475e8f0SXiaoming Ni static struct ctl_table random_table[] = { 16471da177e4SLinus Torvalds { 16481da177e4SLinus Torvalds .procname = "poolsize", 16491da177e4SLinus Torvalds .data = &sysctl_poolsize, 16501da177e4SLinus Torvalds .maxlen = sizeof(int), 16511da177e4SLinus Torvalds .mode = 0444, 16526d456111SEric W. Biederman .proc_handler = proc_dointvec, 16531da177e4SLinus Torvalds }, 16541da177e4SLinus Torvalds { 16551da177e4SLinus Torvalds .procname = "entropy_avail", 1656e85c0fc1SJason A. Donenfeld .data = &input_pool.init_bits, 16571da177e4SLinus Torvalds .maxlen = sizeof(int), 16581da177e4SLinus Torvalds .mode = 0444, 1659c5704490SJason A. Donenfeld .proc_handler = proc_dointvec, 16601da177e4SLinus Torvalds }, 16611da177e4SLinus Torvalds { 16621da177e4SLinus Torvalds .procname = "write_wakeup_threshold", 16630deff3c4SJason A. Donenfeld .data = &sysctl_random_write_wakeup_bits, 16641da177e4SLinus Torvalds .maxlen = sizeof(int), 16651da177e4SLinus Torvalds .mode = 0644, 166677553cf8SJason A. Donenfeld .proc_handler = proc_do_rointvec, 16671da177e4SLinus Torvalds }, 16681da177e4SLinus Torvalds { 1669f5c2742cSTheodore Ts'o .procname = "urandom_min_reseed_secs", 16700deff3c4SJason A. Donenfeld .data = &sysctl_random_min_urandom_seed, 1671f5c2742cSTheodore Ts'o .maxlen = sizeof(int), 1672f5c2742cSTheodore Ts'o .mode = 0644, 167377553cf8SJason A. Donenfeld .proc_handler = proc_do_rointvec, 1674f5c2742cSTheodore Ts'o }, 1675f5c2742cSTheodore Ts'o { 16761da177e4SLinus Torvalds .procname = "boot_id", 16771da177e4SLinus Torvalds .data = &sysctl_bootid, 16781da177e4SLinus Torvalds .mode = 0444, 16796d456111SEric W. Biederman .proc_handler = proc_do_uuid, 16801da177e4SLinus Torvalds }, 16811da177e4SLinus Torvalds { 16821da177e4SLinus Torvalds .procname = "uuid", 16831da177e4SLinus Torvalds .mode = 0444, 16846d456111SEric W. Biederman .proc_handler = proc_do_uuid, 16851da177e4SLinus Torvalds }, 1686894d2491SEric W. Biederman { } 16871da177e4SLinus Torvalds }; 16885475e8f0SXiaoming Ni 16895475e8f0SXiaoming Ni /* 16902f14062bSJason A. Donenfeld * random_init() is called before sysctl_init(), 16912f14062bSJason A. Donenfeld * so we cannot call register_sysctl_init() in random_init() 16925475e8f0SXiaoming Ni */ 16935475e8f0SXiaoming Ni static int __init random_sysctls_init(void) 16945475e8f0SXiaoming Ni { 16955475e8f0SXiaoming Ni register_sysctl_init("kernel/random", random_table); 16965475e8f0SXiaoming Ni return 0; 16975475e8f0SXiaoming Ni } 16985475e8f0SXiaoming Ni device_initcall(random_sysctls_init); 16990deff3c4SJason A. Donenfeld #endif 1700