From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
qemu-devel@nongnu.org, kvm@vger.kernel.org,
linux-s390@vger.kernel.org, adrian@parity.io
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>,
dwmw@amazon.co.uk, acatan@amazon.com, graf@amazon.com,
colmmacc@amazon.com, sblbir@amazon.com, raduweis@amazon.com,
jannh@google.com, gregkh@linuxfoundation.org, tytso@mit.edu
Subject: [PATCH RFC v1 1/2] random: add mechanism for VM forks to reinitialize crng
Date: Wed, 23 Feb 2022 14:12:30 +0100 [thread overview]
Message-ID: <20220223131231.403386-2-Jason@zx2c4.com> (raw)
In-Reply-To: <20220223131231.403386-1-Jason@zx2c4.com>
When a VM forks, we must immediately mix in additional information to
the stream of random output so that two forks or a rollback don't
produce the same stream of random numbers, which could have catastrophic
cryptographic consequences. This commit adds a simple API, add_vmfork_
randomness(), for that.
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
drivers/char/random.c | 58 ++++++++++++++++++++++++++++++++++++++++++
include/linux/random.h | 1 +
2 files changed, 59 insertions(+)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 536237a0f073..29d6ce484d15 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -344,6 +344,46 @@ static void crng_reseed(void)
}
}
+/*
+ * This mixes unique_vm_id directly into the base_crng key as soon as
+ * possible, similarly to crng_pre_init_inject(), even if the crng is
+ * already running, in order to immediately branch streams from prior
+ * VM instances.
+ */
+static void crng_vm_fork_inject(const void *unique_vm_id, size_t len)
+{
+ unsigned long flags, next_gen;
+ struct blake2s_state hash;
+
+ /*
+ * Unlike crng_reseed(), we take the lock as early as possible,
+ * since we don't want the RNG to be used until it's updated.
+ */
+ spin_lock_irqsave(&base_crng.lock, flags);
+
+ /*
+ * Also update the generation, while locked, as early as
+ * possible. This will mean unlocked reads of the generation
+ * will cause a reseeding of per-cpu crngs, and those will
+ * spin on the base_crng lock waiting for the rest of this
+ * operation to complete, which achieves the goal of blocking
+ * the production of new output until this is done.
+ */
+ next_gen = base_crng.generation + 1;
+ if (next_gen == ULONG_MAX)
+ ++next_gen;
+ WRITE_ONCE(base_crng.generation, next_gen);
+ WRITE_ONCE(base_crng.birth, jiffies);
+
+ /* This is the same formulation used by crng_pre_init_inject(). */
+ blake2s_init(&hash, sizeof(base_crng.key));
+ blake2s_update(&hash, base_crng.key, sizeof(base_crng.key));
+ blake2s_update(&hash, unique_vm_id, len);
+ blake2s_final(&hash, base_crng.key);
+
+ spin_unlock_irqrestore(&base_crng.lock, flags);
+}
+
/*
* This generates a ChaCha block using the provided key, and then
* immediately overwites that key with half the block. It returns
@@ -935,6 +975,7 @@ static bool drain_entropy(void *buf, size_t nbytes)
* void add_hwgenerator_randomness(const void *buffer, size_t count,
* size_t entropy);
* void add_bootloader_randomness(const void *buf, size_t size);
+ * void add_vmfork_randomness(const void *unique_vm_id, size_t size);
* void add_interrupt_randomness(int irq);
*
* add_device_randomness() adds data to the input pool that
@@ -966,6 +1007,11 @@ static bool drain_entropy(void *buf, size_t nbytes)
* add_device_randomness(), depending on whether or not the configuration
* option CONFIG_RANDOM_TRUST_BOOTLOADER is set.
*
+ * add_vmfork_randomness() adds a unique (but not neccessarily secret) ID
+ * representing the current instance of a VM to the pool, without crediting,
+ * and then immediately mixes that ID into the current base_crng key, so
+ * that it takes effect prior to a reseeding.
+ *
* add_interrupt_randomness() uses the interrupt timing as random
* inputs to the entropy pool. Using the cycle counters and the irq source
* as inputs, it feeds the input pool roughly once a second or after 64
@@ -1195,6 +1241,18 @@ void add_bootloader_randomness(const void *buf, size_t size)
}
EXPORT_SYMBOL_GPL(add_bootloader_randomness);
+/*
+ * Handle a new unique VM ID, which is unique, not secret, so we
+ * don't credit it, but we do mix it into the entropy pool and
+ * inject it into the crng.
+ */
+void add_vmfork_randomness(const void *unique_vm_id, size_t size)
+{
+ add_device_randomness(unique_vm_id, size);
+ crng_vm_fork_inject(unique_vm_id, size);
+}
+EXPORT_SYMBOL_GPL(add_vmfork_randomness);
+
struct fast_pool {
union {
u32 pool32[4];
diff --git a/include/linux/random.h b/include/linux/random.h
index 6148b8d1ccf3..51b8ed797732 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -34,6 +34,7 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
extern void add_interrupt_randomness(int irq) __latent_entropy;
extern void add_hwgenerator_randomness(const void *buffer, size_t count,
size_t entropy);
+extern void add_vmfork_randomness(const void *unique_vm_id, size_t size);
extern void get_random_bytes(void *buf, size_t nbytes);
extern int wait_for_random_bytes(void);
--
2.35.1
next prev parent reply other threads:[~2022-02-23 13:13 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-23 13:12 [PATCH RFC v1 0/2] VM fork detection for RNG Jason A. Donenfeld
2022-02-23 13:12 ` Jason A. Donenfeld [this message]
2022-02-23 23:16 ` [PATCH RFC v1 1/2] random: add mechanism for VM forks to reinitialize crng Eric Biggers
2022-02-24 0:54 ` Jason A. Donenfeld
2022-02-24 1:27 ` Eric Biggers
2022-02-24 11:15 ` Jason A. Donenfeld
2022-02-23 13:12 ` [PATCH RFC v1 2/2] drivers/virt: add vmgenid driver for reinitializing RNG Jason A. Donenfeld
2022-02-23 16:36 ` Jason A. Donenfeld
2022-02-23 16:08 ` [PATCH RFC v1 0/2] VM fork detection for RNG Jason A. Donenfeld
2022-02-23 16:19 ` Jason A. Donenfeld
[not found] ` <2653b6c7-a851-7a48-f1f8-3bde742a0c9f@redhat.com>
2022-02-24 10:43 ` Jason A. Donenfeld
2022-02-24 10:55 ` Daniel P. Berrangé
2022-02-24 10:57 ` Jason A. Donenfeld
2022-02-25 10:40 ` Michael S. Tsirkin
2022-02-24 8:53 ` Alexander Graf
2022-02-24 10:43 ` Daniel P. Berrangé
2022-02-24 11:35 ` Alexander Graf
2022-02-24 10:53 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220223131231.403386-2-Jason@zx2c4.com \
--to=jason@zx2c4.com \
--cc=acatan@amazon.com \
--cc=adrian@parity.io \
--cc=colmmacc@amazon.com \
--cc=dwmw@amazon.co.uk \
--cc=graf@amazon.com \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=qemu-devel@nongnu.org \
--cc=raduweis@amazon.com \
--cc=sblbir@amazon.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).