History

Merge tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random

Pull randomness updates from Ted Ts'o: "Cleanups and bug fixes to /dev/random, add a new getrandom(2) system call, which is a superset of OpenBSD's getentropy(2) call, for use with userspace crypto libraries such as LibreSSL. Also add the ability to have a kernel thread to pull entropy from hardware rng devices into /dev/random" * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: hwrng: Pass entropy to add_hwgenerator_randomness() in bits, not bytes random: limit the contribution of the hw rng to at most half random: introduce getrandom(2) system call hw_random: fix sparse warning (NULL vs 0 for pointer) random: use registers from interrupted code for CPU's w/o a cycle counter hwrng: add per-device entropy derating hwrng: create filler thread random: add_hwgenerator_randomness() for feeding entropy from devices random: use an improved fast_mix() function random: clean up interrupt entropy accounting for archs w/o cycle counters random: only update the last_pulled time if we actually transferred entropy random: remove unneeded hash of a portion of the entropy pool random: always update the entropy pool under the spinlock

Linus Torvalds committed 12 years ago

Commit f4f142e2 parents bb2cbf5 e02b8768 files · +274 −131Browse files

Unified · Split

8 files
  1. arch/x86/syscalls/syscall_32.tbl +1 −0
  2. arch/x86/syscalls/syscall_64.tbl +1 −0
  3. drivers/char/hw_random/core.c +65 −2
  4. drivers/char/random.c +187 −128
  5. include/linux/hw_random.h +5 −0
  6. include/linux/syscalls.h +3 −0
  7. include/uapi/asm-generic/unistd.h +3 −1
  8. include/uapi/linux/random.h +9 −0
arch/x86/syscalls/syscall_32.tbl+1−0
@@ -361,3 +361,4 @@ · 360 unmodified lines
361361 352 i386 sched_getattr sys_sched_getattr
362362 353 i386 renameat2 sys_renameat2
363363 354 i386 seccomp sys_seccomp
364+355 i386 getrandom sys_getrandom
arch/x86/syscalls/syscall_64.tbl+1−0
@@ -324,6 +324,7 @@ · 323 unmodified lines
324324 315 common sched_getattr sys_sched_getattr
325325 316 common renameat2 sys_renameat2
326326 317 common seccomp sys_seccomp
327+318 common getrandom sys_getrandom
327328
328329 #
329330 # x32-specific system call numbers start at 512 to avoid cache impact
drivers/char/hw_random/core.c+65−2
@@ -38,6 +38,7 @@ · 37 unmodified lines
3838 #include <linux/fs.h>
3939 #include <linux/sched.h>
4040 #include <linux/miscdevice.h>
41+#include <linux/kthread.h>
4142 #include <linux/delay.h>
4243 #include <linux/slab.h>
4344 #include <linux/random.h>
@@ -50,10 +51,22 @@ · 6 unmodified lines
5051
5152
5253 static struct hwrng *current_rng;
54+static struct task_struct *hwrng_fill;
5355 static LIST_HEAD(rng_list);
5456 static DEFINE_MUTEX(rng_mutex);
5557 static int data_avail;
56−static u8 *rng_buffer;
58+static u8 *rng_buffer, *rng_fillbuf;
59+static unsigned short current_quality;
60+static unsigned short default_quality; /* = 0; default to "off" */
61+
62+module_param(current_quality, ushort, 0644);
63+MODULE_PARM_DESC(current_quality,
64+ "current hwrng entropy estimation per mill");
65+module_param(default_quality, ushort, 0644);
66+MODULE_PARM_DESC(default_quality,
67+ "default entropy content of hwrng per mill");
68+
69+static void start_khwrngd(void);
5770
5871 static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
5972 int wait);
@@ -89,6 +102,15 @@ static inline int hwrng_init(struct hwrng *rng) · 29 unmodified lines
89102 return ret;
90103 }
91104 add_early_randomness(rng);
105+
106+ current_quality = rng->quality ? : default_quality;
107+ current_quality &= 1023;
108+
109+ if (current_quality == 0 && hwrng_fill)
110+ kthread_stop(hwrng_fill);
111+ if (current_quality > 0 && !hwrng_fill)
112+ start_khwrngd();
113+
92114 return 0;
93115 }
94116
@@ -325,6 +347,36 @@ err_misc_dereg: · 230 unmodified lines
325347 goto out;
326348 }
327349
350+static int hwrng_fillfn(void *unused)
351+{
352+ long rc;
353+
354+ while (!kthread_should_stop()) {
355+ if (!current_rng)
356+ break;
357+ rc = rng_get_data(current_rng, rng_fillbuf,
358+ rng_buffer_size(), 1);
359+ if (rc <= 0) {
360+ pr_warn("hwrng: no data available\n");
361+ msleep_interruptible(10000);
362+ continue;
363+ }
364+ add_hwgenerator_randomness((void *)rng_fillbuf, rc,
365+ rc * current_quality * 8 >> 10);
366+ }
367+ hwrng_fill = NULL;
368+ return 0;
369+}
370+
371+static void start_khwrngd(void)
372+{
373+ hwrng_fill = kthread_run(hwrng_fillfn, NULL, "hwrng");
374+ if (hwrng_fill == ERR_PTR(-ENOMEM)) {
375+ pr_err("hwrng_fill thread creation failed");
376+ hwrng_fill = NULL;
377+ }
378+}
379+
328380 int hwrng_register(struct hwrng *rng)
329381 {
330382 int err = -EINVAL;
@@ -343,6 +395,13 @@ int hwrng_register(struct hwrng *rng) · 12 unmodified lines
343395 if (!rng_buffer)
344396 goto out_unlock;
345397 }
398+ if (!rng_fillbuf) {
399+ rng_fillbuf = kmalloc(rng_buffer_size(), GFP_KERNEL);
400+ if (!rng_fillbuf) {
401+ kfree(rng_buffer);
402+ goto out_unlock;
403+ }
404+ }
346405
347406 /* Must not register two RNGs with the same name. */
348407 err = -EEXIST;
@@ -406,8 +465,11 @@ void hwrng_unregister(struct hwrng *rng) · 57 unmodified lines
406465 current_rng = NULL;
407466 }
408467 }
409− if (list_empty(&rng_list))
468+ if (list_empty(&rng_list)) {
410469 unregister_miscdev();
470+ if (hwrng_fill)
471+ kthread_stop(hwrng_fill);
472+ }
411473
412474 mutex_unlock(&rng_mutex);
413475 }
@@ -418,6 +480,7 @@ static void __exit hwrng_exit(void) · 4 unmodified lines
418480 mutex_lock(&rng_mutex);
419481 BUG_ON(current_rng);
420482 kfree(rng_buffer);
483+ kfree(rng_fillbuf);
421484 mutex_unlock(&rng_mutex);
422485 }
423486
drivers/char/random.c+187−128
@@ -250,6 +250,7 @@ · 249 unmodified lines
250250 #include <linux/interrupt.h>
251251 #include <linux/mm.h>
252252 #include <linux/spinlock.h>
253+#include <linux/kthread.h>
253254 #include <linux/percpu.h>
254255 #include <linux/cryptohash.h>
255256 #include <linux/fips.h>
@@ -257,6 +258,8 @@ · 1 unmodified line
257258 #include <linux/kmemcheck.h>
258259 #include <linux/workqueue.h>
259260 #include <linux/irq.h>
261+#include <linux/syscalls.h>
262+#include <linux/completion.h>
260263
261264 #include <asm/processor.h>
262265 #include <asm/uaccess.h>
@@ -267,6 +270,8 @@ · 4 unmodified lines
267270 #define CREATE_TRACE_POINTS
268271 #include <trace/events/random.h>
269272
273+/* #define ADD_INTERRUPT_BENCH */
274+
270275 /*
271276 * Configuration information
272277 */
@@ -401,6 +406,7 @@ static struct poolinfo { · 128 unmodified lines
401406 */
402407 static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
403408 static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
409+static DECLARE_WAIT_QUEUE_HEAD(urandom_init_wait);
404410 static struct fasync_struct *fasync;
405411
406412 /**********************************************************************
@@ -481,9 +487,9 @@ static __u32 const twist_table[8] = { · 74 unmodified lines
481487 * the entropy is concentrated in the low-order bits.
482488 */
483489 static void _mix_pool_bytes(struct entropy_store *r, const void *in,
484− int nbytes, __u8 out[64])
490+ int nbytes)
485491 {
486− unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
492+ unsigned long i, tap1, tap2, tap3, tap4, tap5;
487493 int input_rotate;
488494 int wordmask = r->poolinfo->poolwords - 1;
489495 const char *bytes = in;
@@ -495,9 +501,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in, · 5 unmodified lines
495501 tap4 = r->poolinfo->tap4;
496502 tap5 = r->poolinfo->tap5;
497503
498− smp_rmb();
499− input_rotate = ACCESS_ONCE(r->input_rotate);
500− i = ACCESS_ONCE(r->add_ptr);
504+ input_rotate = r->input_rotate;
505+ i = r->add_ptr;
501506
502507 /* mix one byte at a time to simplify size handling and churn faster */
503508 while (nbytes--) {
@@ -524,39 +529,33 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in, · 20 unmodified lines
524529 input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
525530 }
526531
527− ACCESS_ONCE(r->input_rotate) = input_rotate;
528− ACCESS_ONCE(r->add_ptr) = i;
529− smp_wmb();
530−
531− if (out)
532− for (j = 0; j < 16; j++)
533− ((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
532+ r->input_rotate = input_rotate;
533+ r->add_ptr = i;
534534 }
535535
536536 static void __mix_pool_bytes(struct entropy_store *r, const void *in,
537− int nbytes, __u8 out[64])
537+ int nbytes)
538538 {
539539 trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
540− _mix_pool_bytes(r, in, nbytes, out);
540+ _mix_pool_bytes(r, in, nbytes);
541541 }
542542
543543 static void mix_pool_bytes(struct entropy_store *r, const void *in,
544− int nbytes, __u8 out[64])
544+ int nbytes)
545545 {
546546 unsigned long flags;
547547
548548 trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
549549 spin_lock_irqsave(&r->lock, flags);
550− _mix_pool_bytes(r, in, nbytes, out);
550+ _mix_pool_bytes(r, in, nbytes);
551551 spin_unlock_irqrestore(&r->lock, flags);
552552 }
553553
554554 struct fast_pool {
555555 __u32 pool[4];
556556 unsigned long last;
557− unsigned short count;
558− unsigned char rotate;
559− unsigned char last_timer_intr;
557+ unsigned short reg_idx;
558+ unsigned char count;
560559 };
561560
562561 /*
@@ -564,25 +563,29 @@ struct fast_pool { · 1 unmodified line
564563 * collector. It's hardcoded for an 128 bit pool and assumes that any
565564 * locks that might be needed are taken by the caller.
566565 */
567−static void fast_mix(struct fast_pool *f, __u32 input[4])
566+static void fast_mix(struct fast_pool *f)
568567 {
569− __u32 w;
570− unsigned input_rotate = f->rotate;
571−
572− w = rol32(input[0], input_rotate) ^ f->pool[0] ^ f->pool[3];
573− f->pool[0] = (w >> 3) ^ twist_table[w & 7];
574− input_rotate = (input_rotate + 14) & 31;
575− w = rol32(input[1], input_rotate) ^ f->pool[1] ^ f->pool[0];
576− f->pool[1] = (w >> 3) ^ twist_table[w & 7];
577− input_rotate = (input_rotate + 7) & 31;
578− w = rol32(input[2], input_rotate) ^ f->pool[2] ^ f->pool[1];
579− f->pool[2] = (w >> 3) ^ twist_table[w & 7];
580− input_rotate = (input_rotate + 7) & 31;
581− w = rol32(input[3], input_rotate) ^ f->pool[3] ^ f->pool[2];
582− f->pool[3] = (w >> 3) ^ twist_table[w & 7];
583− input_rotate = (input_rotate + 7) & 31;
584−
585− f->rotate = input_rotate;
568+ __u32 a = f->pool[0], b = f->pool[1];
569+ __u32 c = f->pool[2], d = f->pool[3];
570+
571+ a += b; c += d;
572+ b = rol32(a, 6); d = rol32(c, 27);
573+ d ^= a; b ^= c;
574+
575+ a += b; c += d;
576+ b = rol32(a, 16); d = rol32(c, 14);
577+ d ^= a; b ^= c;
578+
579+ a += b; c += d;
580+ b = rol32(a, 6); d = rol32(c, 27);
581+ d ^= a; b ^= c;
582+
583+ a += b; c += d;
584+ b = rol32(a, 16); d = rol32(c, 14);
585+ d ^= a; b ^= c;
586+
587+ f->pool[0] = a; f->pool[1] = b;
588+ f->pool[2] = c; f->pool[3] = d;
586589 f->count++;
587590 }
588591
@@ -657,6 +660,7 @@ retry: · 68 unmodified lines
657660 r->entropy_total = 0;
658661 if (r == &nonblocking_pool) {
659662 prandom_reseed_late();
663+ wake_up_interruptible(&urandom_init_wait);
660664 pr_notice("random: %s pool is initialized\n", r->name);
661665 }
662666 }
@@ -739,13 +743,13 @@ void add_device_randomness(const void *buf, unsigned int size) · 76 unmodified lines
739743
740744 trace_add_device_randomness(size, _RET_IP_);
741745 spin_lock_irqsave(&input_pool.lock, flags);
742− _mix_pool_bytes(&input_pool, buf, size, NULL);
743− _mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
746+ _mix_pool_bytes(&input_pool, buf, size);
747+ _mix_pool_bytes(&input_pool, &time, sizeof(time));
744748 spin_unlock_irqrestore(&input_pool.lock, flags);
745749
746750 spin_lock_irqsave(&nonblocking_pool.lock, flags);
747− _mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
748− _mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
751+ _mix_pool_bytes(&nonblocking_pool, buf, size);
752+ _mix_pool_bytes(&nonblocking_pool, &time, sizeof(time));
749753 spin_unlock_irqrestore(&nonblocking_pool.lock, flags);
750754 }
751755 EXPORT_SYMBOL(add_device_randomness);
@@ -778,7 +782,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num) · 26 unmodified lines
778782 sample.cycles = random_get_entropy();
779783 sample.num = num;
780784 r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
781− mix_pool_bytes(r, &sample, sizeof(sample), NULL);
785+ mix_pool_bytes(r, &sample, sizeof(sample));
782786
783787 /*
784788 * Calculate number of bits of randomness we probably added.
@@ -835,6 +839,38 @@ EXPORT_SYMBOL_GPL(add_input_randomness); · 50 unmodified lines
835839
836840 static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
837841
842+#ifdef ADD_INTERRUPT_BENCH
843+static unsigned long avg_cycles, avg_deviation;
844+
845+#define AVG_SHIFT 8 /* Exponential average factor k=1/256 */
846+#define FIXED_1_2 (1 << (AVG_SHIFT-1))
847+
848+static void add_interrupt_bench(cycles_t start)
849+{
850+ long delta = random_get_entropy() - start;
851+
852+ /* Use a weighted moving average */
853+ delta = delta - ((avg_cycles + FIXED_1_2) >> AVG_SHIFT);
854+ avg_cycles += delta;
855+ /* And average deviation */
856+ delta = abs(delta) - ((avg_deviation + FIXED_1_2) >> AVG_SHIFT);
857+ avg_deviation += delta;
858+}
859+#else
860+#define add_interrupt_bench(x)
861+#endif
862+
863+static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
864+{
865+ __u32 *ptr = (__u32 *) regs;
866+
867+ if (regs == NULL)
868+ return 0;
869+ if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
870+ f->reg_idx = 0;
871+ return *(ptr + f->reg_idx++);
872+}
873+
838874 void add_interrupt_randomness(int irq, int irq_flags)
839875 {
840876 struct entropy_store *r;
@@ -842,55 +878,52 @@ void add_interrupt_randomness(int irq, int irq_flags) · 1 unmodified line
842878 struct pt_regs *regs = get_irq_regs();
843879 unsigned long now = jiffies;
844880 cycles_t cycles = random_get_entropy();
845− __u32 input[4], c_high, j_high;
881+ __u32 c_high, j_high;
846882 __u64 ip;
847883 unsigned long seed;
848− int credit;
884+ int credit = 0;
849885
886+ if (cycles == 0)
887+ cycles = get_reg(fast_pool, regs);
850888 c_high = (sizeof(cycles) > 4) ? cycles >> 32 : 0;
851889 j_high = (sizeof(now) > 4) ? now >> 32 : 0;
852− input[0] = cycles ^ j_high ^ irq;
853− input[1] = now ^ c_high;
890+ fast_pool->pool[0] ^= cycles ^ j_high ^ irq;
891+ fast_pool->pool[1] ^= now ^ c_high;
854892 ip = regs ? instruction_pointer(regs) : _RET_IP_;
855− input[2] = ip;
856− input[3] = ip >> 32;
893+ fast_pool->pool[2] ^= ip;
894+ fast_pool->pool[3] ^= (sizeof(ip) > 4) ? ip >> 32 :
895+ get_reg(fast_pool, regs);
857896
858− fast_mix(fast_pool, input);
897+ fast_mix(fast_pool);
898+ add_interrupt_bench(cycles);
859899
860− if ((fast_pool->count & 63) && !time_after(now, fast_pool->last + HZ))
900+ if ((fast_pool->count < 64) &&
901+ !time_after(now, fast_pool->last + HZ))
861902 return;
862903
863− fast_pool->last = now;
864−
865904 r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
866− __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
905+ if (!spin_trylock(&r->lock))
906+ return;
867907
868− /*
869− * If we don't have a valid cycle counter, and we see
870− * back-to-back timer interrupts, then skip giving credit for
871− * any entropy, otherwise credit 1 bit.
872− */
873− credit = 1;
874− if (cycles == 0) {
875− if (irq_flags & __IRQF_TIMER) {
876− if (fast_pool->last_timer_intr)
877− credit = 0;
878− fast_pool->last_timer_intr = 1;
879− } else
880− fast_pool->last_timer_intr = 0;
881− }
908+ fast_pool->last = now;
909+ __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
882910
883911 /*
884912 * If we have architectural seed generator, produce a seed and
885− * add it to the pool. For the sake of paranoia count it as
886− * 50% entropic.
913+ * add it to the pool. For the sake of paranoia don't let the
914+ * architectural seed generator dominate the input from the
915+ * interrupt noise.
887916 */
888917 if (arch_get_random_seed_long(&seed)) {
889− __mix_pool_bytes(r, &seed, sizeof(seed), NULL);
890− credit += sizeof(seed) * 4;
918+ __mix_pool_bytes(r, &seed, sizeof(seed));
919+ credit = 1;
891920 }
921+ spin_unlock(&r->lock);
892922
893− credit_entropy_bits(r, credit);
923+ fast_pool->count = 0;
924+
925+ /* award one bit for the contents of the fast pool */
926+ credit_entropy_bits(r, credit + 1);
894927 }
895928
896929 #ifdef CONFIG_BLOCK
@@ -922,6 +955,11 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, · 25 unmodified lines
922955 static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes);
923956 static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
924957 {
958+ if (!r->pull ||
959+ r->entropy_count >= (nbytes << (ENTROPY_SHIFT + 3)) ||
960+ r->entropy_count > r->poolinfo->poolfracbits)
961+ return;
962+
925963 if (r->limit == 0 && random_min_urandom_seed) {
926964 unsigned long now = jiffies;
927965
@@ -930,10 +968,8 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes) · 2 unmodified lines
930968 return;
931969 r->last_pulled = now;
932970 }
933− if (r->pull &&
934− r->entropy_count < (nbytes << (ENTROPY_SHIFT + 3)) &&
935− r->entropy_count < r->poolinfo->poolfracbits)
936− _xfer_secondary_pool(r, nbytes);
971+
972+ _xfer_secondary_pool(r, nbytes);
937973 }
938974
939975 static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
@@ -953,7 +989,7 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes) · 13 unmodified lines
953989 ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
954990 bytes = extract_entropy(r->pull, tmp, bytes,
955991 random_read_wakeup_bits / 8, rsvd_bytes);
956− mix_pool_bytes(r, tmp, bytes, NULL);
992+ mix_pool_bytes(r, tmp, bytes);
957993 credit_entropy_bits(r, bytes*8);
958994 }
959995
@@ -1039,7 +1075,6 @@ static void extract_buf(struct entropy_store *r, __u8 *out) · 79 unmodified lines
10391075 unsigned long l[LONGS(20)];
10401076 } hash;
10411077 __u32 workspace[SHA_WORKSPACE_WORDS];
1042− __u8 extract[64];
10431078 unsigned long flags;
10441079
10451080 /*
@@ -1068,15 +1103,9 @@ static void extract_buf(struct entropy_store *r, __u8 *out) · 22 unmodified lines
10681103 * brute-forcing the feedback as hard as brute-forcing the
10691104 * hash.
10701105 */
1071− __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
1106+ __mix_pool_bytes(r, hash.w, sizeof(hash.w));
10721107 spin_unlock_irqrestore(&r->lock, flags);
10731108
1074− /*
1075− * To avoid duplicates, we atomically extract a portion of the
1076− * pool while mixing, and hash one final time.
1077− */
1078− sha_transform(hash.w, extract, workspace);
1079− memset(extract, 0, sizeof(extract));
10801109 memset(workspace, 0, sizeof(workspace));
10811110
10821111 /*
@@ -1160,13 +1189,14 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, · 77 unmodified lines
11601189 {
11611190 ssize_t ret = 0, i;
11621191 __u8 tmp[EXTRACT_SIZE];
1192+ int large_request = (nbytes > 256);
11631193
11641194 trace_extract_entropy_user(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
11651195 xfer_secondary_pool(r, nbytes);
11661196 nbytes = account(r, nbytes, 0, 0);
11671197
11681198 while (nbytes) {
1169− if (need_resched()) {
1199+ if (large_request && need_resched()) {
11701200 if (signal_pending(current)) {
11711201 if (ret == 0)
11721202 ret = -ERESTARTSYS;
@@ -1263,14 +1293,14 @@ static void init_std_data(struct entropy_store *r) · 90 unmodified lines
12631293 unsigned long rv;
12641294
12651295 r->last_pulled = jiffies;
1266− mix_pool_bytes(r, &now, sizeof(now), NULL);
1296+ mix_pool_bytes(r, &now, sizeof(now));
12671297 for (i = r->poolinfo->poolbytes; i > 0; i -= sizeof(rv)) {
12681298 if (!arch_get_random_seed_long(&rv) &&
12691299 !arch_get_random_long(&rv))
12701300 rv = random_get_entropy();
1271− mix_pool_bytes(r, &rv, sizeof(rv), NULL);
1301+ mix_pool_bytes(r, &rv, sizeof(rv));
12721302 }
1273− mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
1303+ mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
12741304 }
12751305
12761306 /*
@@ -1309,39 +1339,8 @@ void rand_initialize_disk(struct gendisk *disk) · 32 unmodified lines
13091339 }
13101340 #endif
13111341
1312−/*
1313− * Attempt an emergency refill using arch_get_random_seed_long().
1314− *
1315− * As with add_interrupt_randomness() be paranoid and only
1316− * credit the output as 50% entropic.
1317− */
1318−static int arch_random_refill(void)
1319−{
1320− const unsigned int nlongs = 64; /* Arbitrary number */
1321− unsigned int n = 0;
1322− unsigned int i;
1323− unsigned long buf[nlongs];
1324−
1325− if (!arch_has_random_seed())
1326− return 0;
1327−
1328− for (i = 0; i < nlongs; i++) {
1329− if (arch_get_random_seed_long(&buf[n]))
1330− n++;
1331− }
1332−
1333− if (n) {
1334− unsigned int rand_bytes = n * sizeof(unsigned long);
1335−
1336− mix_pool_bytes(&input_pool, buf, rand_bytes, NULL);
1337− credit_entropy_bits(&input_pool, rand_bytes*4);
1338− }
1339−
1340− return n;
1341−}
1342−
13431342 static ssize_t
1344−random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1343+_random_read(int nonblock, char __user *buf, size_t nbytes)
13451344 {
13461345 ssize_t n;
13471346
@@ -1360,12 +1359,7 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) · 12 unmodified lines
13601359 return n;
13611360
13621361 /* Pool is (near) empty. Maybe wait and retry. */
1363−
1364− /* First try an emergency refill */
1365− if (arch_random_refill())
1366− continue;
1367−
1368− if (file->f_flags & O_NONBLOCK)
1362+ if (nonblock)
13691363 return -EAGAIN;
13701364
13711365 wait_event_interruptible(random_read_wait,
@@ -1376,6 +1370,12 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) · 4 unmodified lines
13761370 }
13771371 }
13781372
1373+static ssize_t
1374+random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1375+{
1376+ return _random_read(file->f_flags & O_NONBLOCK, buf, nbytes);
1377+}
1378+
13791379 static ssize_t
13801380 urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
13811381 {
@@ -1424,7 +1424,7 @@ write_pool(struct entropy_store *r, const char __user *buffer, size_t count) · 42 unmodified lines
14241424 count -= bytes;
14251425 p += bytes;
14261426
1427− mix_pool_bytes(r, buf, bytes, NULL);
1427+ mix_pool_bytes(r, buf, bytes);
14281428 cond_resched();
14291429 }
14301430
@@ -1520,6 +1520,29 @@ const struct file_operations urandom_fops = { · 89 unmodified lines
15201520 .llseek = noop_llseek,
15211521 };
15221522
1523+SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
1524+ unsigned int, flags)
1525+{
1526+ if (flags & ~(GRND_NONBLOCK|GRND_RANDOM))
1527+ return -EINVAL;
1528+
1529+ if (count > INT_MAX)
1530+ count = INT_MAX;
1531+
1532+ if (flags & GRND_RANDOM)
1533+ return _random_read(flags & GRND_NONBLOCK, buf, count);
1534+
1535+ if (unlikely(nonblocking_pool.initialized == 0)) {
1536+ if (flags & GRND_NONBLOCK)
1537+ return -EAGAIN;
1538+ wait_event_interruptible(urandom_init_wait,
1539+ nonblocking_pool.initialized);
1540+ if (signal_pending(current))
1541+ return -ERESTARTSYS;
1542+ }
1543+ return urandom_read(NULL, buf, count, NULL);
1544+}
1545+
15231546 /***************************************************************
15241547 * Random UUID interface
15251548 *
@@ -1663,6 +1686,22 @@ struct ctl_table random_table[] = { · 137 unmodified lines
16631686 .mode = 0444,
16641687 .proc_handler = proc_do_uuid,
16651688 },
1689+#ifdef ADD_INTERRUPT_BENCH
1690+ {
1691+ .procname = "add_interrupt_avg_cycles",
1692+ .data = &avg_cycles,
1693+ .maxlen = sizeof(avg_cycles),
1694+ .mode = 0444,
1695+ .proc_handler = proc_doulongvec_minmax,
1696+ },
1697+ {
1698+ .procname = "add_interrupt_avg_deviation",
1699+ .data = &avg_deviation,
1700+ .maxlen = sizeof(avg_deviation),
1701+ .mode = 0444,
1702+ .proc_handler = proc_doulongvec_minmax,
1703+ },
1704+#endif
16661705 { }
16671706 };
16681707 #endif /* CONFIG_SYSCTL */
@@ -1719,3 +1758,23 @@ randomize_range(unsigned long start, unsigned long end, unsigned long len) · 50 unmodified lines
17191758 return 0;
17201759 return PAGE_ALIGN(get_random_int() % range + start);
17211760 }
1761+
1762+/* Interface for in-kernel drivers of true hardware RNGs.
1763+ * Those devices may produce endless random bits and will be throttled
1764+ * when our pool is full.
1765+ */
1766+void add_hwgenerator_randomness(const char *buffer, size_t count,
1767+ size_t entropy)
1768+{
1769+ struct entropy_store *poolp = &input_pool;
1770+
1771+ /* Suspend writing if we're above the trickle threshold.
1772+ * We'll be woken up again once below random_write_wakeup_thresh,
1773+ * or when the calling thread is about to terminate.
1774+ */
1775+ wait_event_interruptible(random_write_wait, kthread_should_stop() ||
1776+ ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
1777+ mix_pool_bytes(poolp, buffer, count);
1778+ credit_entropy_bits(poolp, entropy);
1779+}
1780+EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
include/linux/hw_random.h+5−0
@@ -29,6 +29,8 @@ · 28 unmodified lines
2929 * @read: New API. drivers can fill up to max bytes of data
3030 * into the buffer. The buffer is aligned for any type.
3131 * @priv: Private data, for use by the RNG driver.
32+ * @quality: Estimation of true entropy in RNG's bitstream
33+ * (per mill).
3234 */
3335 struct hwrng {
3436 const char *name;
@@ -38,6 +40,7 @@ struct hwrng { · 3 unmodified lines
3840 int (*data_read)(struct hwrng *rng, u32 *data);
3941 int (*read)(struct hwrng *rng, void *data, size_t max, bool wait);
4042 unsigned long priv;
43+ unsigned short quality;
4144
4245 /* internal. */
4346 struct list_head list;
@@ -47,5 +50,7 @@ struct hwrng { · 3 unmodified lines
4750 extern int hwrng_register(struct hwrng *rng);
4851 /** Unregister a Hardware Random Number Generator driver. */
4952 extern void hwrng_unregister(struct hwrng *rng);
53+/** Feed random bits into the pool. */
54+extern void add_hwgenerator_randomness(const char *buffer, size_t count, size_t entropy);
5055
5156 #endif /* LINUX_HWRANDOM_H_ */
include/linux/syscalls.h+3−0
@@ -868,4 +868,7 @@ asmlinkage long sys_kcmp(pid_t pid1, pid_t pid2, int type, · 867 unmodified lines
868868 asmlinkage long sys_finit_module(int fd, const char __user *uargs, int flags);
869869 asmlinkage long sys_seccomp(unsigned int op, unsigned int flags,
870870 const char __user *uargs);
871+asmlinkage long sys_getrandom(char __user *buf, size_t count,
872+ unsigned int flags);
873+
871874 #endif
include/uapi/asm-generic/unistd.h+3−1
@@ -701,9 +701,11 @@ __SYSCALL(__NR_sched_getattr, sys_sched_getattr) · 700 unmodified lines
701701 __SYSCALL(__NR_renameat2, sys_renameat2)
702702 #define __NR_seccomp 277
703703 __SYSCALL(__NR_seccomp, sys_seccomp)
704+#define __NR_getrandom 278
705+__SYSCALL(__NR_getrandom, sys_getrandom)
704706
705707 #undef __NR_syscalls
706−#define __NR_syscalls 278
708+#define __NR_syscalls 279
707709
708710 /*
709711 * All syscalls below here should go away really,
include/uapi/linux/random.h+9−0
@@ -40,4 +40,13 @@ struct rand_pool_info { · 39 unmodified lines
4040 __u32 buf[0];
4141 };
4242
43+/*
44+ * Flags for getrandom(2)
45+ *
46+ * GRND_NONBLOCK Don't block and return EAGAIN instead
47+ * GRND_RANDOM Use the /dev/random pool instead of /dev/urandom
48+ */
49+#define GRND_NONBLOCK 0x0001
50+#define GRND_RANDOM 0x0002
51+
4352 #endif /* _UAPI_LINUX_RANDOM_H */