linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Theodore Tso <tytso@mit.edu>,
	Dominik Brodowski <linux@dominikbrodowski.net>,
	Eric Biggers <ebiggers@google.com>,
	Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>,
	"Jason A. Donenfeld" <Jason@zx2c4.com>
Subject: [PATCH 5.15 038/145] random: use computational hash for entropy extraction
Date: Fri, 27 May 2022 10:48:59 +0200	[thread overview]
Message-ID: <20220527084855.501642285@linuxfoundation.org> (raw)
In-Reply-To: <20220527084850.364560116@linuxfoundation.org>

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit 6e8ec2552c7d13991148e551e3325a624d73fac6 upstream.

The current 4096-bit LFSR used for entropy collection had a few
desirable attributes for the context in which it was created. For
example, the state was huge, which meant that /dev/random would be able
to output quite a bit of accumulated entropy before blocking. It was
also, in its time, quite fast at accumulating entropy byte-by-byte,
which matters given the varying contexts in which mix_pool_bytes() is
called. And its diffusion was relatively high, which meant that changes
would ripple across several words of state rather quickly.

However, it also suffers from a few security vulnerabilities. In
particular, inputs learned by an attacker can be undone, but moreover,
if the state of the pool leaks, its contents can be controlled and
entirely zeroed out. I've demonstrated this attack with this SMT2
script, <https://xn--4db.cc/5o9xO8pb>, which Boolector/CaDiCal solves in
a matter of seconds on a single core of my laptop, resulting in little
proof of concept C demonstrators such as <https://xn--4db.cc/jCkvvIaH/c>.

For basically all recent formal models of RNGs, these attacks represent
a significant cryptographic flaw. But how does this manifest
practically? If an attacker has access to the system to such a degree
that he can learn the internal state of the RNG, arguably there are
other lower hanging vulnerabilities -- side-channel, infoleak, or
otherwise -- that might have higher priority. On the other hand, seed
files are frequently used on systems that have a hard time generating
much entropy on their own, and these seed files, being files, often leak
or are duplicated and distributed accidentally, or are even seeded over
the Internet intentionally, where their contents might be recorded or
tampered with. Seen this way, an otherwise quasi-implausible
vulnerability is a bit more practical than initially thought.

Another aspect of the current mix_pool_bytes() function is that, while
its performance was arguably competitive for the time in which it was
created, it's no longer considered so. This patch improves performance
significantly: on a high-end CPU, an i7-11850H, it improves performance
of mix_pool_bytes() by 225%, and on a low-end CPU, a Cortex-A7, it
improves performance by 103%.

This commit replaces the LFSR of mix_pool_bytes() with a straight-
forward cryptographic hash function, BLAKE2s, which is already in use
for pool extraction. Universal hashing with a secret seed was considered
too, something along the lines of <https://eprint.iacr.org/2013/338>,
but the requirement for a secret seed makes for a chicken & egg problem.
Instead we go with a formally proven scheme using a computational hash
function, described in sections 5.1, 6.4, and B.1.8 of
<https://eprint.iacr.org/2019/198>.

BLAKE2s outputs 256 bits, which should give us an appropriate amount of
min-entropy accumulation, and a wide enough margin of collision
resistance against active attacks. mix_pool_bytes() becomes a simple
call to blake2s_update(), for accumulation, while the extraction step
becomes a blake2s_final() to generate a seed, with which we can then do
a HKDF-like or BLAKE2X-like expansion, the first part of which we fold
back as an init key for subsequent blake2s_update()s, and the rest we
produce to the caller. This then is provided to our CRNG like usual. In
that expansion step, we make opportunistic use of 32 bytes of RDRAND
output, just as before. We also always reseed the crng with 32 bytes,
unconditionally, or not at all, rather than sometimes with 16 as before,
as we don't win anything by limiting beyond the 16 byte threshold.

Going for a hash function as an entropy collector is a conservative,
proven approach. The result of all this is a much simpler and much less
bespoke construction than what's there now, which not only plugs a
vulnerability but also improves performance considerably.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/random.c |  304 +++++++++-----------------------------------------
 1 file changed, 55 insertions(+), 249 deletions(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -42,61 +42,6 @@
  */
 
 /*
- * (now, with legal B.S. out of the way.....)
- *
- * This routine gathers environmental noise from device drivers, etc.,
- * and returns good random numbers, suitable for cryptographic use.
- * Besides the obvious cryptographic uses, these numbers are also good
- * for seeding TCP sequence numbers, and other places where it is
- * desirable to have numbers which are not only random, but hard to
- * predict by an attacker.
- *
- * Theory of operation
- * ===================
- *
- * Computers are very predictable devices.  Hence it is extremely hard
- * to produce truly random numbers on a computer --- as opposed to
- * pseudo-random numbers, which can easily generated by using a
- * algorithm.  Unfortunately, it is very easy for attackers to guess
- * the sequence of pseudo-random number generators, and for some
- * applications this is not acceptable.  So instead, we must try to
- * gather "environmental noise" from the computer's environment, which
- * must be hard for outside attackers to observe, and use that to
- * generate random numbers.  In a Unix environment, this is best done
- * from inside the kernel.
- *
- * Sources of randomness from the environment include inter-keyboard
- * timings, inter-interrupt timings from some interrupts, and other
- * events which are both (a) non-deterministic and (b) hard for an
- * outside observer to measure.  Randomness from these sources are
- * added to an "entropy pool", which is mixed using a CRC-like function.
- * This is not cryptographically strong, but it is adequate assuming
- * the randomness is not chosen maliciously, and it is fast enough that
- * the overhead of doing it on every interrupt is very reasonable.
- * As random bytes are mixed into the entropy pool, the routines keep
- * an *estimate* of how many bits of randomness have been stored into
- * the random number generator's internal state.
- *
- * When random bytes are desired, they are obtained by taking the BLAKE2s
- * hash of the contents of the "entropy pool".  The BLAKE2s hash avoids
- * exposing the internal state of the entropy pool.  It is believed to
- * be computationally infeasible to derive any useful information
- * about the input of BLAKE2s from its output.  Even if it is possible to
- * analyze BLAKE2s in some clever way, as long as the amount of data
- * returned from the generator is less than the inherent entropy in
- * the pool, the output data is totally unpredictable.  For this
- * reason, the routine decreases its internal estimate of how many
- * bits of "true randomness" are contained in the entropy pool as it
- * outputs random numbers.
- *
- * If this estimate goes to zero, the routine can still generate
- * random numbers; however, an attacker may (at least in theory) be
- * able to infer the future output of the generator from prior
- * outputs.  This requires successful cryptanalysis of BLAKE2s, which is
- * not believed to be feasible, but there is a remote possibility.
- * Nonetheless, these numbers should be useful for the vast majority
- * of purposes.
- *
  * Exported interfaces ---- output
  * ===============================
  *
@@ -298,23 +243,6 @@
  *
  *	mknod /dev/random c 1 8
  *	mknod /dev/urandom c 1 9
- *
- * Acknowledgements:
- * =================
- *
- * Ideas for constructing this random number generator were derived
- * from Pretty Good Privacy's random number generator, and from private
- * discussions with Phil Karn.  Colin Plumb provided a faster random
- * number generator, which speed up the mixing function of the entropy
- * pool, taken from PGPfone.  Dale Worley has also contributed many
- * useful ideas and suggestions to improve this driver.
- *
- * Any flaws in the design are solely my responsibility, and should
- * not be attributed to the Phil, Colin, or any of authors of PGP.
- *
- * Further background information on this topic may be obtained from
- * RFC 1750, "Randomness Recommendations for Security", by Donald
- * Eastlake, Steve Crocker, and Jeff Schiller.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -358,79 +286,15 @@
 
 /* #define ADD_INTERRUPT_BENCH */
 
-/*
- * If the entropy count falls under this number of bits, then we
- * should wake up processes which are selecting or polling on write
- * access to /dev/random.
- */
-static int random_write_wakeup_bits = 28 * (1 << 5);
-
-/*
- * Originally, we used a primitive polynomial of degree .poolwords
- * over GF(2).  The taps for various sizes are defined below.  They
- * were chosen to be evenly spaced except for the last tap, which is 1
- * to get the twisting happening as fast as possible.
- *
- * For the purposes of better mixing, we use the CRC-32 polynomial as
- * well to make a (modified) twisted Generalized Feedback Shift
- * Register.  (See M. Matsumoto & Y. Kurita, 1992.  Twisted GFSR
- * generators.  ACM Transactions on Modeling and Computer Simulation
- * 2(3):179-194.  Also see M. Matsumoto & Y. Kurita, 1994.  Twisted
- * GFSR generators II.  ACM Transactions on Modeling and Computer
- * Simulation 4:254-266)
- *
- * Thanks to Colin Plumb for suggesting this.
- *
- * The mixing operation is much less sensitive than the output hash,
- * where we use BLAKE2s.  All that we want of mixing operation is that
- * it be a good non-cryptographic hash; i.e. it not produce collisions
- * when fed "random" data of the sort we expect to see.  As long as
- * the pool state differs for different inputs, we have preserved the
- * input entropy and done a good job.  The fact that an intelligent
- * attacker can construct inputs that will produce controlled
- * alterations to the pool's state is not important because we don't
- * consider such inputs to contribute any randomness.  The only
- * property we need with respect to them is that the attacker can't
- * increase his/her knowledge of the pool's state.  Since all
- * additions are reversible (knowing the final state and the input,
- * you can reconstruct the initial state), if an attacker has any
- * uncertainty about the initial state, he/she can only shuffle that
- * uncertainty about, but never cause any collisions (which would
- * decrease the uncertainty).
- *
- * Our mixing functions were analyzed by Lacharme, Roeck, Strubel, and
- * Videau in their paper, "The Linux Pseudorandom Number Generator
- * Revisited" (see: http://eprint.iacr.org/2012/251.pdf).  In their
- * paper, they point out that we are not using a true Twisted GFSR,
- * since Matsumoto & Kurita used a trinomial feedback polynomial (that
- * is, with only three taps, instead of the six that we are using).
- * As a result, the resulting polynomial is neither primitive nor
- * irreducible, and hence does not have a maximal period over
- * GF(2**32).  They suggest a slight change to the generator
- * polynomial which improves the resulting TGFSR polynomial to be
- * irreducible, which we have made here.
- */
 enum poolinfo {
-	POOL_WORDS = 128,
-	POOL_WORDMASK = POOL_WORDS - 1,
-	POOL_BYTES = POOL_WORDS * sizeof(u32),
-	POOL_BITS = POOL_BYTES * 8,
+	POOL_BITS = BLAKE2S_HASH_SIZE * 8,
 	POOL_BITSHIFT = ilog2(POOL_BITS),
 
 	/* To allow fractional bits to be tracked, the entropy_count field is
 	 * denominated in units of 1/8th bits. */
 	POOL_ENTROPY_SHIFT = 3,
 #define POOL_ENTROPY_BITS() (input_pool.entropy_count >> POOL_ENTROPY_SHIFT)
-	POOL_FRACBITS = POOL_BITS << POOL_ENTROPY_SHIFT,
-
-	/* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
-	POOL_TAP1 = 104,
-	POOL_TAP2 = 76,
-	POOL_TAP3 = 51,
-	POOL_TAP4 = 25,
-	POOL_TAP5 = 1,
-
-	EXTRACT_SIZE = BLAKE2S_HASH_SIZE / 2
+	POOL_FRACBITS = POOL_BITS << POOL_ENTROPY_SHIFT
 };
 
 /*
@@ -438,6 +302,12 @@ enum poolinfo {
  */
 static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
 static struct fasync_struct *fasync;
+/*
+ * If the entropy count falls under this number of bits, then we
+ * should wake up processes which are selecting or polling on write
+ * access to /dev/random.
+ */
+static int random_write_wakeup_bits = POOL_BITS * 3 / 4;
 
 static DEFINE_SPINLOCK(random_ready_list_lock);
 static LIST_HEAD(random_ready_list);
@@ -493,73 +363,31 @@ MODULE_PARM_DESC(ratelimit_disable, "Dis
  *
  **********************************************************************/
 
-static u32 input_pool_data[POOL_WORDS] __latent_entropy;
-
 static struct {
+	struct blake2s_state hash;
 	spinlock_t lock;
-	u16 add_ptr;
-	u16 input_rotate;
 	int entropy_count;
 } input_pool = {
+	.hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE),
+		    BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4,
+		    BLAKE2S_IV5, BLAKE2S_IV6, BLAKE2S_IV7 },
+	.hash.outlen = BLAKE2S_HASH_SIZE,
 	.lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
 };
 
-static ssize_t extract_entropy(void *buf, size_t nbytes, int min);
-static ssize_t _extract_entropy(void *buf, size_t nbytes);
+static bool extract_entropy(void *buf, size_t nbytes, int min);
+static void _extract_entropy(void *buf, size_t nbytes);
 
 static void crng_reseed(struct crng_state *crng, bool use_input_pool);
 
-static const u32 twist_table[8] = {
-	0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
-	0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
-
 /*
  * This function adds bytes into the entropy "pool".  It does not
  * update the entropy estimate.  The caller should call
  * credit_entropy_bits if this is appropriate.
- *
- * The pool is stirred with a primitive polynomial of the appropriate
- * degree, and then twisted.  We twist by three bits at a time because
- * it's cheap to do so and helps slightly in the expected case where
- * the entropy is concentrated in the low-order bits.
  */
 static void _mix_pool_bytes(const void *in, int nbytes)
 {
-	unsigned long i;
-	int input_rotate;
-	const u8 *bytes = in;
-	u32 w;
-
-	input_rotate = input_pool.input_rotate;
-	i = input_pool.add_ptr;
-
-	/* mix one byte at a time to simplify size handling and churn faster */
-	while (nbytes--) {
-		w = rol32(*bytes++, input_rotate);
-		i = (i - 1) & POOL_WORDMASK;
-
-		/* XOR in the various taps */
-		w ^= input_pool_data[i];
-		w ^= input_pool_data[(i + POOL_TAP1) & POOL_WORDMASK];
-		w ^= input_pool_data[(i + POOL_TAP2) & POOL_WORDMASK];
-		w ^= input_pool_data[(i + POOL_TAP3) & POOL_WORDMASK];
-		w ^= input_pool_data[(i + POOL_TAP4) & POOL_WORDMASK];
-		w ^= input_pool_data[(i + POOL_TAP5) & POOL_WORDMASK];
-
-		/* Mix the result back in with a twist */
-		input_pool_data[i] = (w >> 3) ^ twist_table[w & 7];
-
-		/*
-		 * Normally, we add 7 bits of rotation to the pool.
-		 * At the beginning of the pool, add an extra 7 bits
-		 * rotation, so that successive passes spread the
-		 * input bits across the pool evenly.
-		 */
-		input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
-	}
-
-	input_pool.input_rotate = input_rotate;
-	input_pool.add_ptr = i;
+	blake2s_update(&input_pool.hash, in, nbytes);
 }
 
 static void __mix_pool_bytes(const void *in, int nbytes)
@@ -953,15 +781,14 @@ static int crng_slow_load(const u8 *cp,
 static void crng_reseed(struct crng_state *crng, bool use_input_pool)
 {
 	unsigned long flags;
-	int i, num;
+	int i;
 	union {
 		u8 block[CHACHA_BLOCK_SIZE];
 		u32 key[8];
 	} buf;
 
 	if (use_input_pool) {
-		num = extract_entropy(&buf, 32, 16);
-		if (num == 0)
+		if (!extract_entropy(&buf, 32, 16))
 			return;
 	} else {
 		_extract_crng(&primary_crng, buf.block);
@@ -1329,74 +1156,48 @@ retry:
 }
 
 /*
- * This function does the actual extraction for extract_entropy.
- *
- * Note: we assume that .poolwords is a multiple of 16 words.
+ * This is an HKDF-like construction for using the hashed collected entropy
+ * as a PRF key, that's then expanded block-by-block.
  */
-static void extract_buf(u8 *out)
+static void _extract_entropy(void *buf, size_t nbytes)
 {
-	struct blake2s_state state __aligned(__alignof__(unsigned long));
-	u8 hash[BLAKE2S_HASH_SIZE];
-	unsigned long *salt;
 	unsigned long flags;
-
-	blake2s_init(&state, sizeof(hash));
-
-	/*
-	 * If we have an architectural hardware random number
-	 * generator, use it for BLAKE2's salt & personal fields.
-	 */
-	for (salt = (unsigned long *)&state.h[4];
-	     salt < (unsigned long *)&state.h[8]; ++salt) {
-		unsigned long v;
-		if (!arch_get_random_long(&v))
-			break;
-		*salt ^= v;
+	u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE];
+	struct {
+		unsigned long rdrand[32 / sizeof(long)];
+		size_t counter;
+	} block;
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(block.rdrand); ++i) {
+		if (!arch_get_random_long(&block.rdrand[i]))
+			block.rdrand[i] = random_get_entropy();
 	}
 
-	/* Generate a hash across the pool */
 	spin_lock_irqsave(&input_pool.lock, flags);
-	blake2s_update(&state, (const u8 *)input_pool_data, POOL_BYTES);
-	blake2s_final(&state, hash); /* final zeros out state */
 
-	/*
-	 * We mix the hash back into the pool to prevent backtracking
-	 * attacks (where the attacker knows the state of the pool
-	 * plus the current outputs, and attempts to find previous
-	 * outputs), unless the hash function can be inverted. By
-	 * mixing at least a hash worth of hash data back, we make
-	 * brute-forcing the feedback as hard as brute-forcing the
-	 * hash.
-	 */
-	__mix_pool_bytes(hash, sizeof(hash));
-	spin_unlock_irqrestore(&input_pool.lock, flags);
+	/* seed = HASHPRF(last_key, entropy_input) */
+	blake2s_final(&input_pool.hash, seed);
 
-	/* Note that EXTRACT_SIZE is half of hash size here, because above
-	 * we've dumped the full length back into mixer. By reducing the
-	 * amount that we emit, we retain a level of forward secrecy.
-	 */
-	memcpy(out, hash, EXTRACT_SIZE);
-	memzero_explicit(hash, sizeof(hash));
-}
+	/* next_key = HASHPRF(seed, RDRAND || 0) */
+	block.counter = 0;
+	blake2s(next_key, (u8 *)&block, seed, sizeof(next_key), sizeof(block), sizeof(seed));
+	blake2s_init_key(&input_pool.hash, BLAKE2S_HASH_SIZE, next_key, sizeof(next_key));
 
-static ssize_t _extract_entropy(void *buf, size_t nbytes)
-{
-	ssize_t ret = 0, i;
-	u8 tmp[EXTRACT_SIZE];
+	spin_unlock_irqrestore(&input_pool.lock, flags);
+	memzero_explicit(next_key, sizeof(next_key));
 
 	while (nbytes) {
-		extract_buf(tmp);
-		i = min_t(int, nbytes, EXTRACT_SIZE);
-		memcpy(buf, tmp, i);
+		i = min_t(size_t, nbytes, BLAKE2S_HASH_SIZE);
+		/* output = HASHPRF(seed, RDRAND || ++counter) */
+		++block.counter;
+		blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed));
 		nbytes -= i;
 		buf += i;
-		ret += i;
 	}
 
-	/* Wipe data just returned from memory */
-	memzero_explicit(tmp, sizeof(tmp));
-
-	return ret;
+	memzero_explicit(seed, sizeof(seed));
+	memzero_explicit(&block, sizeof(block));
 }
 
 /*
@@ -1404,13 +1205,18 @@ static ssize_t _extract_entropy(void *bu
  * returns it in a buffer.
  *
  * The min parameter specifies the minimum amount we can pull before
- * failing to avoid races that defeat catastrophic reseeding.
+ * failing to avoid races that defeat catastrophic reseeding. If we
+ * have less than min entropy available, we return false and buf is
+ * not filled.
  */
-static ssize_t extract_entropy(void *buf, size_t nbytes, int min)
+static bool extract_entropy(void *buf, size_t nbytes, int min)
 {
 	trace_extract_entropy(nbytes, POOL_ENTROPY_BITS(), _RET_IP_);
-	nbytes = account(nbytes, min);
-	return _extract_entropy(buf, nbytes);
+	if (account(nbytes, min)) {
+		_extract_entropy(buf, nbytes);
+		return true;
+	}
+	return false;
 }
 
 #define warn_unseeded_randomness(previous) \
@@ -1674,7 +1480,7 @@ static void __init init_std_data(void)
 	unsigned long rv;
 
 	mix_pool_bytes(&now, sizeof(now));
-	for (i = POOL_BYTES; i > 0; i -= sizeof(rv)) {
+	for (i = BLAKE2S_BLOCK_SIZE; i > 0; i -= sizeof(rv)) {
 		if (!arch_get_random_seed_long(&rv) &&
 		    !arch_get_random_long(&rv))
 			rv = random_get_entropy();



  parent reply	other threads:[~2022-05-27 11:48 UTC|newest]

Thread overview: 152+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-27  8:48 [PATCH 5.15 000/145] 5.15.44-rc1 review Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 001/145] HID: amd_sfh: Add support for sensor discovery Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 002/145] KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 003/145] [PATCH 5.15] ice: fix crash at allocation failure Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 004/145] ACPI: sysfs: Fix BERT error region memory mapping Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 005/145] MAINTAINERS: co-maintain random.c Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 006/145] MAINTAINERS: add git tree for random.c Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 007/145] lib/crypto: blake2s: include as built-in Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 008/145] lib/crypto: blake2s: move hmac construction into wireguard Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 009/145] lib/crypto: sha1: re-roll loops to reduce code size Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 010/145] lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 011/145] random: document add_hwgenerator_randomness() with other input functions Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 012/145] random: remove unused irq_flags argument from add_interrupt_randomness() Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 013/145] random: use BLAKE2s instead of SHA1 in extraction Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 014/145] random: do not sign extend bytes for rotation when mixing Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 015/145] random: do not re-init if crng_reseed completes before primary init Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 016/145] random: mix bootloader randomness into pool Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 017/145] random: harmonize "crng init done" messages Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 018/145] random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 019/145] random: early initialization of ChaCha constants Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 020/145] random: avoid superfluous call to RDRAND in CRNG extraction Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 021/145] random: dont reset crng_init_cnt on urandom_read() Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 022/145] random: fix typo in comments Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 023/145] random: cleanup poolinfo abstraction Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 024/145] random: cleanup integer types Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 025/145] random: remove incomplete last_data logic Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 026/145] random: remove unused extract_entropy() reserved argument Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 027/145] random: rather than entropy_store abstraction, use global Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 028/145] random: remove unused OUTPUT_POOL constants Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 029/145] random: de-duplicate INPUT_POOL constants Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 030/145] random: prepend remaining pool constants with POOL_ Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 031/145] random: cleanup fractional entropy shift constants Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 032/145] random: access input_pool_data directly rather than through pointer Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 033/145] random: selectively clang-format where it makes sense Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 034/145] random: simplify arithmetic function flow in account() Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 035/145] random: continually use hwgenerator randomness Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 036/145] random: access primary_pool directly rather than through pointer Greg Kroah-Hartman
2022-05-27  8:48 ` [PATCH 5.15 037/145] random: only call crng_finalize_init() for primary_crng Greg Kroah-Hartman
2022-05-27  8:48 ` Greg Kroah-Hartman [this message]
2022-05-27  8:49 ` [PATCH 5.15 039/145] random: simplify entropy debiting Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 040/145] random: use linear min-entropy accumulation crediting Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 041/145] random: always wake up entropy writers after extraction Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 042/145] random: make credit_entropy_bits() always safe Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 043/145] random: remove use_input_pool parameter from crng_reseed() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 044/145] random: remove batched entropy locking Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 045/145] random: fix locking in crng_fast_load() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 046/145] random: use RDSEED instead of RDRAND in entropy extraction Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 047/145] random: get rid of secondary crngs Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 048/145] random: inline leaves of rand_initialize() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 049/145] random: ensure early RDSEED goes through mixer on init Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 050/145] random: do not xor RDRAND when writing into /dev/random Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 051/145] random: absorb fast pool into input pool after fast load Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 052/145] random: use simpler fast key erasure flow on per-cpu keys Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 053/145] random: use hash function for crng_slow_load() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 054/145] random: make more consistent use of integer types Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 055/145] random: remove outdated INT_MAX >> 6 check in urandom_read() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 056/145] random: zero buffer after reading entropy from userspace Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 057/145] random: fix locking for crng_init in crng_reseed() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 058/145] random: tie batched entropy generation to base_crng generation Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 059/145] random: remove ifdefd out interrupt bench Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 060/145] random: remove unused tracepoints Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 061/145] random: add proper SPDX header Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 062/145] random: deobfuscate irq u32/u64 contributions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 063/145] random: introduce drain_entropy() helper to declutter crng_reseed() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 064/145] random: remove useless header comment Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 065/145] random: remove whitespace and reorder includes Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 066/145] random: group initialization wait functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 067/145] random: group crng functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 068/145] random: group entropy extraction functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 069/145] random: group entropy collection functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 070/145] random: group userspace read/write functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 071/145] random: group sysctl functions Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 072/145] random: rewrite header introductory comment Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 073/145] random: defer fast pool mixing to worker Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 074/145] random: do not take pool spinlock at boot Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 075/145] random: unify early init crng load accounting Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 076/145] random: check for crng_init == 0 in add_device_randomness() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 077/145] random: pull add_hwgenerator_randomness() declaration into random.h Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 078/145] random: clear fast pool, crng, and batches in cpuhp bring up Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 079/145] random: round-robin registers as ulong, not u32 Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 080/145] random: only wake up writers after zap if threshold was passed Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 081/145] random: cleanup UUID handling Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 082/145] random: unify cycles_t and jiffies usage and types Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 083/145] random: do crng pre-init loading in worker rather than irq Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 084/145] random: give sysctl_random_min_urandom_seed a more sensible value Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 085/145] random: dont let 644 read-only sysctls be written to Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 086/145] random: replace custom notifier chain with standard one Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 087/145] random: use SipHash as interrupt entropy accumulator Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 088/145] random: make consistent usage of crng_ready() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 089/145] random: reseed more often immediately after booting Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 090/145] random: check for signal and try earlier when generating entropy Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 091/145] random: skip fast_init if hwrng provides large chunk of entropy Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 092/145] random: treat bootloader trust toggle the same way as cpu trust toggle Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 093/145] random: re-add removed comment about get_random_{u32,u64} reseeding Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 094/145] random: mix build-time latent entropy into pool at init Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 095/145] random: do not split fast init input in add_hwgenerator_randomness() Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 096/145] random: do not allow user to keep crng key around on stack Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 097/145] random: check for signal_pending() outside of need_resched() check Greg Kroah-Hartman
2022-05-27  8:49 ` [PATCH 5.15 098/145] random: check for signals every PAGE_SIZE chunk of /dev/[u]random Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 099/145] random: allow partial reads if later user copies fail Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 100/145] random: make random_get_entropy() return an unsigned long Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 101/145] random: document crng_fast_key_erasure() destination possibility Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 102/145] random: fix sysctl documentation nits Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 103/145] init: call time_init() before rand_initialize() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 104/145] ia64: define get_cycles macro for arch-override Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 105/145] s390: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 106/145] parisc: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 107/145] alpha: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 108/145] powerpc: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 109/145] timekeeping: Add raw clock fallback for random_get_entropy() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 110/145] m68k: use fallback for random_get_entropy() instead of zero Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 111/145] riscv: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 112/145] mips: use fallback for random_get_entropy() instead of just c0 random Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 113/145] arm: use fallback for random_get_entropy() instead of zero Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 114/145] nios2: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 115/145] x86/tsc: Use " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 116/145] um: use " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 117/145] sparc: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 118/145] xtensa: " Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 119/145] random: insist on random_get_entropy() existing in order to simplify Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 120/145] random: do not use batches when !crng_ready() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 121/145] random: use first 128 bits of input as fast init Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 122/145] random: do not pretend to handle premature next security model Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 123/145] random: order timer entropy functions below interrupt functions Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 124/145] random: do not use input pool from hard IRQs Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 125/145] random: help compiler out with fast_mix() by using simpler arguments Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 126/145] siphash: use one source of truth for siphash permutations Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 127/145] random: use symbolic constants for crng_init states Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 128/145] random: avoid initializing twice in credit race Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 129/145] random: move initialization out of reseeding hot path Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 130/145] random: remove ratelimiting for in-kernel unseeded randomness Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 131/145] random: use proper jiffies comparison macro Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 132/145] random: handle latent entropy and command line from random_init() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 133/145] random: credit architectural init the exact amount Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 134/145] random: use static branch for crng_ready() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 135/145] random: remove extern from functions in header Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 136/145] random: use proper return types on get_random_{int,long}_wait() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 137/145] random: make consistent use of buf and len Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 138/145] random: move initialization functions out of hot pages Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 139/145] random: move randomize_page() into mm where it belongs Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 140/145] random: unify batched entropy implementations Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 141/145] random: convert to using fops->read_iter() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 142/145] random: convert to using fops->write_iter() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 143/145] random: wire up fops->splice_{read,write}_iter() Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 144/145] random: check for signals after page of pool writes Greg Kroah-Hartman
2022-05-27  8:50 ` [PATCH 5.15 145/145] ALSA: ctxfi: Add SB046x PCI ID Greg Kroah-Hartman
2022-05-27 22:39 ` [PATCH 5.15 000/145] 5.15.44-rc1 review Guenter Roeck
2022-05-28  6:29 ` Bagas Sanjaya
2022-05-28 10:52 ` Naresh Kamboju
2022-05-28 15:27 ` Sudip Mukherjee
2022-05-28 21:08 ` Ron Economos
2022-05-29  0:35 ` Fox Chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220527084855.501642285@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=Jason@zx2c4.com \
    --cc=ebiggers@google.com \
    --cc=jeanphilippe.aumasson@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@dominikbrodowski.net \
    --cc=stable@vger.kernel.org \
    --cc=tytso@mit.edu \
    --subject='Re: [PATCH 5.15 038/145] random: use computational hash for entropy extraction' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).