forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c 
 kernel/drivers/char/random.c
....@@ -1,310 +1,26 @@
1
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
12 /*
2
- * random.c -- A strong random number generator
3
- *
4
- * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
5
- * Rights Reserved.
6
- *
3
+ * Copyright (C) 2017-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
74  * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
5
+ * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999. All rights reserved.
86  *
9
- * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999.  All
10
- * rights reserved.
7
+ * This driver produces cryptographically secure pseudorandom data. It is divided
8
+ * into roughly six sections, each with a section header:
119  *
12
- * Redistribution and use in source and binary forms, with or without
13
- * modification, are permitted provided that the following conditions
14
- * are met:
15
- * 1. Redistributions of source code must retain the above copyright
16
- *    notice, and the entire permission notice in its entirety,
17
- *    including the disclaimer of warranties.
18
- * 2. Redistributions in binary form must reproduce the above copyright
19
- *    notice, this list of conditions and the following disclaimer in the
20
- *    documentation and/or other materials provided with the distribution.
21
- * 3. The name of the author may not be used to endorse or promote
22
- *    products derived from this software without specific prior
23
- *    written permission.
10
+ *   - Initialization and readiness waiting.
11
+ *   - Fast key erasure RNG, the "crng".
12
+ *   - Entropy accumulation and extraction routines.
13
+ *   - Entropy collection routines.
14
+ *   - Userspace reader/writer interfaces.
15
+ *   - Sysctl interface.
2416  *
25
- * ALTERNATIVELY, this product may be distributed under the terms of
26
- * the GNU General Public License, in which case the provisions of the GPL are
27
- * required INSTEAD OF the above restrictions.  (This clause is
28
- * necessary due to a potential bad interaction between the GPL and
29
- * the restrictions contained in a BSD-style copyright.)
30
- *
31
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
32
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
33
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
34
- * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
35
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
36
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
37
- * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
38
- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
39
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
40
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
41
- * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
42
- * DAMAGE.
43
- */
44
-
45
-/*
46
- * (now, with legal B.S. out of the way.....)
47
- *
48
- * This routine gathers environmental noise from device drivers, etc.,
49
- * and returns good random numbers, suitable for cryptographic use.
50
- * Besides the obvious cryptographic uses, these numbers are also good
51
- * for seeding TCP sequence numbers, and other places where it is
52
- * desirable to have numbers which are not only random, but hard to
53
- * predict by an attacker.
54
- *
55
- * Theory of operation
56
- * ===================
57
- *
58
- * Computers are very predictable devices.  Hence it is extremely hard
59
- * to produce truly random numbers on a computer --- as opposed to
60
- * pseudo-random numbers, which can easily generated by using a
61
- * algorithm.  Unfortunately, it is very easy for attackers to guess
62
- * the sequence of pseudo-random number generators, and for some
63
- * applications this is not acceptable.  So instead, we must try to
64
- * gather "environmental noise" from the computer's environment, which
65
- * must be hard for outside attackers to observe, and use that to
66
- * generate random numbers.  In a Unix environment, this is best done
67
- * from inside the kernel.
68
- *
69
- * Sources of randomness from the environment include inter-keyboard
70
- * timings, inter-interrupt timings from some interrupts, and other
71
- * events which are both (a) non-deterministic and (b) hard for an
72
- * outside observer to measure.  Randomness from these sources are
73
- * added to an "entropy pool", which is mixed using a CRC-like function.
74
- * This is not cryptographically strong, but it is adequate assuming
75
- * the randomness is not chosen maliciously, and it is fast enough that
76
- * the overhead of doing it on every interrupt is very reasonable.
77
- * As random bytes are mixed into the entropy pool, the routines keep
78
- * an *estimate* of how many bits of randomness have been stored into
79
- * the random number generator's internal state.
80
- *
81
- * When random bytes are desired, they are obtained by taking the SHA
82
- * hash of the contents of the "entropy pool".  The SHA hash avoids
83
- * exposing the internal state of the entropy pool.  It is believed to
84
- * be computationally infeasible to derive any useful information
85
- * about the input of SHA from its output.  Even if it is possible to
86
- * analyze SHA in some clever way, as long as the amount of data
87
- * returned from the generator is less than the inherent entropy in
88
- * the pool, the output data is totally unpredictable.  For this
89
- * reason, the routine decreases its internal estimate of how many
90
- * bits of "true randomness" are contained in the entropy pool as it
91
- * outputs random numbers.
92
- *
93
- * If this estimate goes to zero, the routine can still generate
94
- * random numbers; however, an attacker may (at least in theory) be
95
- * able to infer the future output of the generator from prior
96
- * outputs.  This requires successful cryptanalysis of SHA, which is
97
- * not believed to be feasible, but there is a remote possibility.
98
- * Nonetheless, these numbers should be useful for the vast majority
99
- * of purposes.
100
- *
101
- * Exported interfaces ---- output
102
- * ===============================
103
- *
104
- * There are four exported interfaces; two for use within the kernel,
105
- * and two or use from userspace.
106
- *
107
- * Exported interfaces ---- userspace output
108
- * -----------------------------------------
109
- *
110
- * The userspace interfaces are two character devices /dev/random and
111
- * /dev/urandom.  /dev/random is suitable for use when very high
112
- * quality randomness is desired (for example, for key generation or
113
- * one-time pads), as it will only return a maximum of the number of
114
- * bits of randomness (as estimated by the random number generator)
115
- * contained in the entropy pool.
116
- *
117
- * The /dev/urandom device does not have this limit, and will return
118
- * as many bytes as are requested.  As more and more random bytes are
119
- * requested without giving time for the entropy pool to recharge,
120
- * this will result in random numbers that are merely cryptographically
121
- * strong.  For many applications, however, this is acceptable.
122
- *
123
- * Exported interfaces ---- kernel output
124
- * --------------------------------------
125
- *
126
- * The primary kernel interface is
127
- *
128
- * 	void get_random_bytes(void *buf, int nbytes);
129
- *
130
- * This interface will return the requested number of random bytes,
131
- * and place it in the requested buffer.  This is equivalent to a
132
- * read from /dev/urandom.
133
- *
134
- * For less critical applications, there are the functions:
135
- *
136
- * 	u32 get_random_u32()
137
- * 	u64 get_random_u64()
138
- * 	unsigned int get_random_int()
139
- * 	unsigned long get_random_long()
140
- *
141
- * These are produced by a cryptographic RNG seeded from get_random_bytes,
142
- * and so do not deplete the entropy pool as much.  These are recommended
143
- * for most in-kernel operations *if the result is going to be stored in
144
- * the kernel*.
145
- *
146
- * Specifically, the get_random_int() family do not attempt to do
147
- * "anti-backtracking".  If you capture the state of the kernel (e.g.
148
- * by snapshotting the VM), you can figure out previous get_random_int()
149
- * return values.  But if the value is stored in the kernel anyway,
150
- * this is not a problem.
151
- *
152
- * It *is* safe to expose get_random_int() output to attackers (e.g. as
153
- * network cookies); given outputs 1..n, it's not feasible to predict
154
- * outputs 0 or n+1.  The only concern is an attacker who breaks into
155
- * the kernel later; the get_random_int() engine is not reseeded as
156
- * often as the get_random_bytes() one.
157
- *
158
- * get_random_bytes() is needed for keys that need to stay secret after
159
- * they are erased from the kernel.  For example, any key that will
160
- * be wrapped and stored encrypted.  And session encryption keys: we'd
161
- * like to know that after the session is closed and the keys erased,
162
- * the plaintext is unrecoverable to someone who recorded the ciphertext.
163
- *
164
- * But for network ports/cookies, stack canaries, PRNG seeds, address
165
- * space layout randomization, session *authentication* keys, or other
166
- * applications where the sensitive data is stored in the kernel in
167
- * plaintext for as long as it's sensitive, the get_random_int() family
168
- * is just fine.
169
- *
170
- * Consider ASLR.  We want to keep the address space secret from an
171
- * outside attacker while the process is running, but once the address
172
- * space is torn down, it's of no use to an attacker any more.  And it's
173
- * stored in kernel data structures as long as it's alive, so worrying
174
- * about an attacker's ability to extrapolate it from the get_random_int()
175
- * CRNG is silly.
176
- *
177
- * Even some cryptographic keys are safe to generate with get_random_int().
178
- * In particular, keys for SipHash are generally fine.  Here, knowledge
179
- * of the key authorizes you to do something to a kernel object (inject
180
- * packets to a network connection, or flood a hash table), and the
181
- * key is stored with the object being protected.  Once it goes away,
182
- * we no longer care if anyone knows the key.
183
- *
184
- * prandom_u32()
185
- * -------------
186
- *
187
- * For even weaker applications, see the pseudorandom generator
188
- * prandom_u32(), prandom_max(), and prandom_bytes().  If the random
189
- * numbers aren't security-critical at all, these are *far* cheaper.
190
- * Useful for self-tests, random error simulation, randomized backoffs,
191
- * and any other application where you trust that nobody is trying to
192
- * maliciously mess with you by guessing the "random" numbers.
193
- *
194
- * Exported interfaces ---- input
195
- * ==============================
196
- *
197
- * The current exported interfaces for gathering environmental noise
198
- * from the devices are:
199
- *
200
- *	void add_device_randomness(const void *buf, unsigned int size);
201
- * 	void add_input_randomness(unsigned int type, unsigned int code,
202
- *                                unsigned int value);
203
- *	void add_interrupt_randomness(int irq, int irq_flags);
204
- * 	void add_disk_randomness(struct gendisk *disk);
205
- *
206
- * add_device_randomness() is for adding data to the random pool that
207
- * is likely to differ between two devices (or possibly even per boot).
208
- * This would be things like MAC addresses or serial numbers, or the
209
- * read-out of the RTC. This does *not* add any actual entropy to the
210
- * pool, but it initializes the pool to different values for devices
211
- * that might otherwise be identical and have very little entropy
212
- * available to them (particularly common in the embedded world).
213
- *
214
- * add_input_randomness() uses the input layer interrupt timing, as well as
215
- * the event type information from the hardware.
216
- *
217
- * add_interrupt_randomness() uses the interrupt timing as random
218
- * inputs to the entropy pool. Using the cycle counters and the irq source
219
- * as inputs, it feeds the randomness roughly once a second.
220
- *
221
- * add_disk_randomness() uses what amounts to the seek time of block
222
- * layer request events, on a per-disk_devt basis, as input to the
223
- * entropy pool. Note that high-speed solid state drives with very low
224
- * seek times do not make for good sources of entropy, as their seek
225
- * times are usually fairly consistent.
226
- *
227
- * All of these routines try to estimate how many bits of randomness a
228
- * particular randomness source.  They do this by keeping track of the
229
- * first and second order deltas of the event timings.
230
- *
231
- * Ensuring unpredictability at system startup
232
- * ============================================
233
- *
234
- * When any operating system starts up, it will go through a sequence
235
- * of actions that are fairly predictable by an adversary, especially
236
- * if the start-up does not involve interaction with a human operator.
237
- * This reduces the actual number of bits of unpredictability in the
238
- * entropy pool below the value in entropy_count.  In order to
239
- * counteract this effect, it helps to carry information in the
240
- * entropy pool across shut-downs and start-ups.  To do this, put the
241
- * following lines an appropriate script which is run during the boot
242
- * sequence:
243
- *
244
- *	echo "Initializing random number generator..."
245
- *	random_seed=/var/run/random-seed
246
- *	# Carry a random seed from start-up to start-up
247
- *	# Load and then save the whole entropy pool
248
- *	if [ -f $random_seed ]; then
249
- *		cat $random_seed >/dev/urandom
250
- *	else
251
- *		touch $random_seed
252
- *	fi
253
- *	chmod 600 $random_seed
254
- *	dd if=/dev/urandom of=$random_seed count=1 bs=512
255
- *
256
- * and the following lines in an appropriate script which is run as
257
- * the system is shutdown:
258
- *
259
- *	# Carry a random seed from shut-down to start-up
260
- *	# Save the whole entropy pool
261
- *	echo "Saving random seed..."
262
- *	random_seed=/var/run/random-seed
263
- *	touch $random_seed
264
- *	chmod 600 $random_seed
265
- *	dd if=/dev/urandom of=$random_seed count=1 bs=512
266
- *
267
- * For example, on most modern systems using the System V init
268
- * scripts, such code fragments would be found in
269
- * /etc/rc.d/init.d/random.  On older Linux systems, the correct script
270
- * location might be in /etc/rcb.d/rc.local or /etc/rc.d/rc.0.
271
- *
272
- * Effectively, these commands cause the contents of the entropy pool
273
- * to be saved at shut-down time and reloaded into the entropy pool at
274
- * start-up.  (The 'dd' in the addition to the bootup script is to
275
- * make sure that /etc/random-seed is different for every start-up,
276
- * even if the system crashes without executing rc.0.)  Even with
277
- * complete knowledge of the start-up activities, predicting the state
278
- * of the entropy pool requires knowledge of the previous history of
279
- * the system.
280
- *
281
- * Configuring the /dev/random driver under Linux
282
- * ==============================================
283
- *
284
- * The /dev/random driver under Linux uses minor numbers 8 and 9 of
285
- * the /dev/mem major number (#1).  So if your system does not have
286
- * /dev/random and /dev/urandom created already, they can be created
287
- * by using the commands:
288
- *
289
- * 	mknod /dev/random c 1 8
290
- * 	mknod /dev/urandom c 1 9
291
- *
292
- * Acknowledgements:
293
- * =================
294
- *
295
- * Ideas for constructing this random number generator were derived
296
- * from Pretty Good Privacy's random number generator, and from private
297
- * discussions with Phil Karn.  Colin Plumb provided a faster random
298
- * number generator, which speed up the mixing function of the entropy
299
- * pool, taken from PGPfone.  Dale Worley has also contributed many
300
- * useful ideas and suggestions to improve this driver.
301
- *
302
- * Any flaws in the design are solely my responsibility, and should
303
- * not be attributed to the Phil, Colin, or any of authors of PGP.
304
- *
305
- * Further background information on this topic may be obtained from
306
- * RFC 1750, "Randomness Recommendations for Security", by Donald
307
- * Eastlake, Steve Crocker, and Jeff Schiller.
17
+ * The high level overview is that there is one input pool, into which
18
+ * various pieces of data are hashed. Prior to initialization, some of that
19
+ * data is then "credited" as having a certain number of bits of entropy.
20
+ * When enough bits of entropy are available, the hash is finalized and
21
+ * handed as a key to a stream cipher that expands it indefinitely for
22
+ * various consumers. This key is periodically refreshed as the various
23
+ * entropy collectors, described below, add data to the input pool.
30824  */
30925 
31026 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
....@@ -327,8 +43,6 @@
32743 #include <linux/spinlock.h>
32844 #include <linux/kthread.h>
32945 #include <linux/percpu.h>
330
-#include <linux/cryptohash.h>
331
-#include <linux/fips.h>
33246 #include <linux/ptrace.h>
33347 #include <linux/workqueue.h>
33448 #include <linux/irq.h>
....@@ -336,759 +50,805 @@
33650 #include <linux/syscalls.h>
33751 #include <linux/completion.h>
33852 #include <linux/uuid.h>
339
-#include <crypto/chacha.h>
340
-
341
-#include <asm/processor.h>
34253 #include <linux/uaccess.h>
54
+#include <linux/siphash.h>
55
+#include <linux/uio.h>
56
+#include <crypto/chacha.h>
57
+#include <crypto/blake2s.h>
58
+#include <asm/processor.h>
34359 #include <asm/irq.h>
34460 #include <asm/irq_regs.h>
34561 #include <asm/io.h>
34662 
347
-#define CREATE_TRACE_POINTS
348
-#include <trace/events/random.h>
349
-
350
-/* #define ADD_INTERRUPT_BENCH */
351
-
352
-/*
353
- * Configuration information
354
- */
355
-#define INPUT_POOL_SHIFT	12
356
-#define INPUT_POOL_WORDS	(1 << (INPUT_POOL_SHIFT-5))
357
-#define OUTPUT_POOL_SHIFT	10
358
-#define OUTPUT_POOL_WORDS	(1 << (OUTPUT_POOL_SHIFT-5))
359
-#define EXTRACT_SIZE		10
360
-
361
-
362
-#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
363
-
364
-/*
365
- * To allow fractional bits to be tracked, the entropy_count field is
366
- * denominated in units of 1/8th bits.
367
- *
368
- * 2*(ENTROPY_SHIFT + poolbitshift) must <= 31, or the multiply in
369
- * credit_entropy_bits() needs to be 64 bits wide.
370
- */
371
-#define ENTROPY_SHIFT 3
372
-#define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
373
-
374
-/*
375
- * If the entropy count falls under this number of bits, then we
376
- * should wake up processes which are selecting or polling on write
377
- * access to /dev/random.
378
- */
379
-static int random_write_wakeup_bits = 28 * OUTPUT_POOL_WORDS;
380
-
381
-/*
382
- * Originally, we used a primitive polynomial of degree .poolwords
383
- * over GF(2).  The taps for various sizes are defined below.  They
384
- * were chosen to be evenly spaced except for the last tap, which is 1
385
- * to get the twisting happening as fast as possible.
386
- *
387
- * For the purposes of better mixing, we use the CRC-32 polynomial as
388
- * well to make a (modified) twisted Generalized Feedback Shift
389
- * Register.  (See M. Matsumoto & Y. Kurita, 1992.  Twisted GFSR
390
- * generators.  ACM Transactions on Modeling and Computer Simulation
391
- * 2(3):179-194.  Also see M. Matsumoto & Y. Kurita, 1994.  Twisted
392
- * GFSR generators II.  ACM Transactions on Modeling and Computer
393
- * Simulation 4:254-266)
394
- *
395
- * Thanks to Colin Plumb for suggesting this.
396
- *
397
- * The mixing operation is much less sensitive than the output hash,
398
- * where we use SHA-1.  All that we want of mixing operation is that
399
- * it be a good non-cryptographic hash; i.e. it not produce collisions
400
- * when fed "random" data of the sort we expect to see.  As long as
401
- * the pool state differs for different inputs, we have preserved the
402
- * input entropy and done a good job.  The fact that an intelligent
403
- * attacker can construct inputs that will produce controlled
404
- * alterations to the pool's state is not important because we don't
405
- * consider such inputs to contribute any randomness.  The only
406
- * property we need with respect to them is that the attacker can't
407
- * increase his/her knowledge of the pool's state.  Since all
408
- * additions are reversible (knowing the final state and the input,
409
- * you can reconstruct the initial state), if an attacker has any
410
- * uncertainty about the initial state, he/she can only shuffle that
411
- * uncertainty about, but never cause any collisions (which would
412
- * decrease the uncertainty).
413
- *
414
- * Our mixing functions were analyzed by Lacharme, Roeck, Strubel, and
415
- * Videau in their paper, "The Linux Pseudorandom Number Generator
416
- * Revisited" (see: http://eprint.iacr.org/2012/251.pdf).  In their
417
- * paper, they point out that we are not using a true Twisted GFSR,
418
- * since Matsumoto & Kurita used a trinomial feedback polynomial (that
419
- * is, with only three taps, instead of the six that we are using).
420
- * As a result, the resulting polynomial is neither primitive nor
421
- * irreducible, and hence does not have a maximal period over
422
- * GF(2**32).  They suggest a slight change to the generator
423
- * polynomial which improves the resulting TGFSR polynomial to be
424
- * irreducible, which we have made here.
425
- */
426
-static const struct poolinfo {
427
-	int poolbitshift, poolwords, poolbytes, poolfracbits;
428
-#define S(x) ilog2(x)+5, (x), (x)*4, (x) << (ENTROPY_SHIFT+5)
429
-	int tap1, tap2, tap3, tap4, tap5;
430
-} poolinfo_table[] = {
431
-	/* was: x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 */
432
-	/* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
433
-	{ S(128),	104,	76,	51,	25,	1 },
434
-};
435
-
436
-/*
437
- * Static global variables
438
- */
439
-static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
440
-static struct fasync_struct *fasync;
441
-
442
-static DEFINE_SPINLOCK(random_ready_list_lock);
443
-static LIST_HEAD(random_ready_list);
444
-
445
-struct crng_state {
446
-	__u32		state[16];
447
-	unsigned long	init_time;
448
-	spinlock_t	lock;
449
-};
450
-
451
-static struct crng_state primary_crng = {
452
-	.lock = __SPIN_LOCK_UNLOCKED(primary_crng.lock),
453
-};
454
-
455
-/*
456
- * crng_init =  0 --> Uninitialized
457
- *		1 --> Initialized
458
- *		2 --> Initialized from input_pool
459
- *
460
- * crng_init is protected by primary_crng->lock, and only increases
461
- * its value (from 0->1->2).
462
- */
463
-static int crng_init = 0;
464
-#define crng_ready() (likely(crng_init > 1))
465
-static int crng_init_cnt = 0;
466
-static unsigned long crng_global_init_time = 0;
467
-#define CRNG_INIT_CNT_THRESH (2*CHACHA_KEY_SIZE)
468
-static void _extract_crng(struct crng_state *crng, __u8 out[CHACHA_BLOCK_SIZE]);
469
-static void _crng_backtrack_protect(struct crng_state *crng,
470
-				    __u8 tmp[CHACHA_BLOCK_SIZE], int used);
471
-static void process_random_ready_list(void);
472
-static void _get_random_bytes(void *buf, int nbytes);
473
-
474
-static struct ratelimit_state unseeded_warning =
475
-	RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
476
-static struct ratelimit_state urandom_warning =
477
-	RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
478
-
479
-static int ratelimit_disable __read_mostly;
480
-
481
-module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
482
-MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
483
-
484
-/**********************************************************************
485
- *
486
- * OS independent entropy store.   Here are the functions which handle
487
- * storing entropy in an entropy pool.
488
- *
489
- **********************************************************************/
490
-
491
-struct entropy_store;
492
-struct entropy_store {
493
-	/* read-only data: */
494
-	const struct poolinfo *poolinfo;
495
-	__u32 *pool;
496
-	const char *name;
497
-
498
-	/* read-write data: */
499
-	spinlock_t lock;
500
-	unsigned short add_ptr;
501
-	unsigned short input_rotate;
502
-	int entropy_count;
503
-	unsigned int initialized:1;
504
-	unsigned int last_data_init:1;
505
-	__u8 last_data[EXTRACT_SIZE];
506
-};
507
-
508
-static ssize_t extract_entropy(struct entropy_store *r, void *buf,
509
-			       size_t nbytes, int min, int rsvd);
510
-static ssize_t _extract_entropy(struct entropy_store *r, void *buf,
511
-				size_t nbytes, int fips);
512
-
513
-static void crng_reseed(struct crng_state *crng, struct entropy_store *r);
514
-static __u32 input_pool_data[INPUT_POOL_WORDS] __latent_entropy;
515
-
516
-static struct entropy_store input_pool = {
517
-	.poolinfo = &poolinfo_table[0],
518
-	.name = "input",
519
-	.lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
520
-	.pool = input_pool_data
521
-};
522
-
523
-static __u32 const twist_table[8] = {
524
-	0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
525
-	0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
526
-
527
-/*
528
- * This function adds bytes into the entropy "pool".  It does not
529
- * update the entropy estimate.  The caller should call
530
- * credit_entropy_bits if this is appropriate.
531
- *
532
- * The pool is stirred with a primitive polynomial of the appropriate
533
- * degree, and then twisted.  We twist by three bits at a time because
534
- * it's cheap to do so and helps slightly in the expected case where
535
- * the entropy is concentrated in the low-order bits.
536
- */
537
-static void _mix_pool_bytes(struct entropy_store *r, const void *in,
538
-			    int nbytes)
539
-{
540
-	unsigned long i, tap1, tap2, tap3, tap4, tap5;
541
-	int input_rotate;
542
-	int wordmask = r->poolinfo->poolwords - 1;
543
-	const char *bytes = in;
544
-	__u32 w;
545
-
546
-	tap1 = r->poolinfo->tap1;
547
-	tap2 = r->poolinfo->tap2;
548
-	tap3 = r->poolinfo->tap3;
549
-	tap4 = r->poolinfo->tap4;
550
-	tap5 = r->poolinfo->tap5;
551
-
552
-	input_rotate = r->input_rotate;
553
-	i = r->add_ptr;
554
-
555
-	/* mix one byte at a time to simplify size handling and churn faster */
556
-	while (nbytes--) {
557
-		w = rol32(*bytes++, input_rotate);
558
-		i = (i - 1) & wordmask;
559
-
560
-		/* XOR in the various taps */
561
-		w ^= r->pool[i];
562
-		w ^= r->pool[(i + tap1) & wordmask];
563
-		w ^= r->pool[(i + tap2) & wordmask];
564
-		w ^= r->pool[(i + tap3) & wordmask];
565
-		w ^= r->pool[(i + tap4) & wordmask];
566
-		w ^= r->pool[(i + tap5) & wordmask];
567
-
568
-		/* Mix the result back in with a twist */
569
-		r->pool[i] = (w >> 3) ^ twist_table[w & 7];
570
-
571
-		/*
572
-		 * Normally, we add 7 bits of rotation to the pool.
573
-		 * At the beginning of the pool, add an extra 7 bits
574
-		 * rotation, so that successive passes spread the
575
-		 * input bits across the pool evenly.
576
-		 */
577
-		input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
578
-	}
579
-
580
-	r->input_rotate = input_rotate;
581
-	r->add_ptr = i;
582
-}
583
-
584
-static void __mix_pool_bytes(struct entropy_store *r, const void *in,
585
-			     int nbytes)
586
-{
587
-	trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
588
-	_mix_pool_bytes(r, in, nbytes);
589
-}
590
-
591
-static void mix_pool_bytes(struct entropy_store *r, const void *in,
592
-			   int nbytes)
593
-{
594
-	unsigned long flags;
595
-
596
-	trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
597
-	spin_lock_irqsave(&r->lock, flags);
598
-	_mix_pool_bytes(r, in, nbytes);
599
-	spin_unlock_irqrestore(&r->lock, flags);
600
-}
601
-
602
-struct fast_pool {
603
-	__u32		pool[4];
604
-	unsigned long	last;
605
-	unsigned short	reg_idx;
606
-	unsigned char	count;
607
-};
608
-
609
-/*
610
- * This is a fast mixing routine used by the interrupt randomness
611
- * collector.  It's hardcoded for an 128 bit pool and assumes that any
612
- * locks that might be needed are taken by the caller.
613
- */
614
-static void fast_mix(struct fast_pool *f)
615
-{
616
-	__u32 a = f->pool[0],	b = f->pool[1];
617
-	__u32 c = f->pool[2],	d = f->pool[3];
618
-
619
-	a += b;			c += d;
620
-	b = rol32(b, 6);	d = rol32(d, 27);
621
-	d ^= a;			b ^= c;
622
-
623
-	a += b;			c += d;
624
-	b = rol32(b, 16);	d = rol32(d, 14);
625
-	d ^= a;			b ^= c;
626
-
627
-	a += b;			c += d;
628
-	b = rol32(b, 6);	d = rol32(d, 27);
629
-	d ^= a;			b ^= c;
630
-
631
-	a += b;			c += d;
632
-	b = rol32(b, 16);	d = rol32(d, 14);
633
-	d ^= a;			b ^= c;
634
-
635
-	f->pool[0] = a;  f->pool[1] = b;
636
-	f->pool[2] = c;  f->pool[3] = d;
637
-	f->count++;
638
-}
639
-
640
-static void process_random_ready_list(void)
641
-{
642
-	unsigned long flags;
643
-	struct random_ready_callback *rdy, *tmp;
644
-
645
-	spin_lock_irqsave(&random_ready_list_lock, flags);
646
-	list_for_each_entry_safe(rdy, tmp, &random_ready_list, list) {
647
-		struct module *owner = rdy->owner;
648
-
649
-		list_del_init(&rdy->list);
650
-		rdy->func(rdy);
651
-		module_put(owner);
652
-	}
653
-	spin_unlock_irqrestore(&random_ready_list_lock, flags);
654
-}
655
-
656
-/*
657
- * Credit (or debit) the entropy store with n bits of entropy.
658
- * Use credit_entropy_bits_safe() if the value comes from userspace
659
- * or otherwise should be checked for extreme values.
660
- */
661
-static void credit_entropy_bits(struct entropy_store *r, int nbits)
662
-{
663
-	int entropy_count, orig, has_initialized = 0;
664
-	const int pool_size = r->poolinfo->poolfracbits;
665
-	int nfrac = nbits << ENTROPY_SHIFT;
666
-
667
-	if (!nbits)
668
-		return;
669
-
670
-retry:
671
-	entropy_count = orig = READ_ONCE(r->entropy_count);
672
-	if (nfrac < 0) {
673
-		/* Debit */
674
-		entropy_count += nfrac;
675
-	} else {
676
-		/*
677
-		 * Credit: we have to account for the possibility of
678
-		 * overwriting already present entropy.	 Even in the
679
-		 * ideal case of pure Shannon entropy, new contributions
680
-		 * approach the full value asymptotically:
681
-		 *
682
-		 * entropy <- entropy + (pool_size - entropy) *
683
-		 *	(1 - exp(-add_entropy/pool_size))
684
-		 *
685
-		 * For add_entropy <= pool_size/2 then
686
-		 * (1 - exp(-add_entropy/pool_size)) >=
687
-		 *    (add_entropy/pool_size)*0.7869...
688
-		 * so we can approximate the exponential with
689
-		 * 3/4*add_entropy/pool_size and still be on the
690
-		 * safe side by adding at most pool_size/2 at a time.
691
-		 *
692
-		 * The use of pool_size-2 in the while statement is to
693
-		 * prevent rounding artifacts from making the loop
694
-		 * arbitrarily long; this limits the loop to log2(pool_size)*2
695
-		 * turns no matter how large nbits is.
696
-		 */
697
-		int pnfrac = nfrac;
698
-		const int s = r->poolinfo->poolbitshift + ENTROPY_SHIFT + 2;
699
-		/* The +2 corresponds to the /4 in the denominator */
700
-
701
-		do {
702
-			unsigned int anfrac = min(pnfrac, pool_size/2);
703
-			unsigned int add =
704
-				((pool_size - entropy_count)*anfrac*3) >> s;
705
-
706
-			entropy_count += add;
707
-			pnfrac -= anfrac;
708
-		} while (unlikely(entropy_count < pool_size-2 && pnfrac));
709
-	}
710
-
711
-	if (WARN_ON(entropy_count < 0)) {
712
-		pr_warn("negative entropy/overflow: pool %s count %d\n",
713
-			r->name, entropy_count);
714
-		entropy_count = 0;
715
-	} else if (entropy_count > pool_size)
716
-		entropy_count = pool_size;
717
-	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
718
-		goto retry;
719
-
720
-	if (has_initialized) {
721
-		r->initialized = 1;
722
-		kill_fasync(&fasync, SIGIO, POLL_IN);
723
-	}
724
-
725
-	trace_credit_entropy_bits(r->name, nbits,
726
-				  entropy_count >> ENTROPY_SHIFT, _RET_IP_);
727
-
728
-	if (r == &input_pool) {
729
-		int entropy_bits = entropy_count >> ENTROPY_SHIFT;
730
-
731
-		if (crng_init < 2) {
732
-			if (entropy_bits < 128)
733
-				return;
734
-			crng_reseed(&primary_crng, r);
735
-			entropy_bits = ENTROPY_BITS(r);
736
-		}
737
-	}
738
-}
739
-
740
-static int credit_entropy_bits_safe(struct entropy_store *r, int nbits)
741
-{
742
-	const int nbits_max = r->poolinfo->poolwords * 32;
743
-
744
-	if (nbits < 0)
745
-		return -EINVAL;
746
-
747
-	/* Cap the value to avoid overflows */
748
-	nbits = min(nbits,  nbits_max);
749
-
750
-	credit_entropy_bits(r, nbits);
751
-	return 0;
752
-}
63
+// GKI: Keep this header to retain the original CRC that previously used the
64
+// random.h tracepoints.
65
+#include <linux/writeback.h>
75366 
75467 /*********************************************************************
75568  *
756
- * CRNG using CHACHA20
69
+ * Initialization and readiness waiting.
70
+ *
71
+ * Much of the RNG infrastructure is devoted to various dependencies
72
+ * being able to wait until the RNG has collected enough entropy and
73
+ * is ready for safe consumption.
75774  *
75875  *********************************************************************/
75976 
760
-#define CRNG_RESEED_INTERVAL (300*HZ)
761
-
77
+/*
78
+ * crng_init is protected by base_crng->lock, and only increases
79
+ * its value (from empty->early->ready).
80
+ */
81
+static enum {
82
+	CRNG_EMPTY = 0, /* Little to no entropy collected */
83
+	CRNG_EARLY = 1, /* At least POOL_EARLY_BITS collected */
84
+	CRNG_READY = 2  /* Fully initialized with POOL_READY_BITS collected */
85
+} crng_init __read_mostly = CRNG_EMPTY;
86
+#define crng_ready() (likely(crng_init >= CRNG_READY))
87
+/* Various types of waiters for crng_init->CRNG_READY transition. */
76288 static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
89
+static struct fasync_struct *fasync;
90
+static DEFINE_SPINLOCK(random_ready_chain_lock);
91
+static RAW_NOTIFIER_HEAD(random_ready_chain);
76392 
764
-#ifdef CONFIG_NUMA
765
-/*
766
- * Hack to deal with crazy userspace progams when they are all trying
767
- * to access /dev/urandom in parallel.  The programs are almost
768
- * certainly doing something terribly wrong, but we'll work around
769
- * their brain damage.
770
- */
771
-static struct crng_state **crng_node_pool __read_mostly;
772
-#endif
773
-
774
-static void invalidate_batched_entropy(void);
775
-static void numa_crng_init(void);
776
-
777
-static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
778
-static int __init parse_trust_cpu(char *arg)
779
-{
780
-	return kstrtobool(arg, &trust_cpu);
781
-}
782
-early_param("random.trust_cpu", parse_trust_cpu);
783
-
784
-static void crng_initialize(struct crng_state *crng)
785
-{
786
-	int		i;
787
-	int		arch_init = 1;
788
-	unsigned long	rv;
789
-
790
-	memcpy(&crng->state[0], "expand 32-byte k", 16);
791
-	if (crng == &primary_crng)
792
-		_extract_entropy(&input_pool, &crng->state[4],
793
-				 sizeof(__u32) * 12, 0);
794
-	else
795
-		_get_random_bytes(&crng->state[4], sizeof(__u32) * 12);
796
-	for (i = 4; i < 16; i++) {
797
-		if (!arch_get_random_seed_long(&rv) &&
798
-		    !arch_get_random_long(&rv)) {
799
-			rv = random_get_entropy();
800
-			arch_init = 0;
801
-		}
802
-		crng->state[i] ^= rv;
803
-	}
804
-	if (trust_cpu && arch_init && crng == &primary_crng) {
805
-		invalidate_batched_entropy();
806
-		numa_crng_init();
807
-		crng_init = 2;
808
-		pr_notice("crng done (trusting CPU's manufacturer)\n");
809
-	}
810
-	crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
811
-}
812
-
813
-#ifdef CONFIG_NUMA
814
-static void do_numa_crng_init(struct work_struct *work)
815
-{
816
-	int i;
817
-	struct crng_state *crng;
818
-	struct crng_state **pool;
819
-
820
-	pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
821
-	for_each_online_node(i) {
822
-		crng = kmalloc_node(sizeof(struct crng_state),
823
-				    GFP_KERNEL | __GFP_NOFAIL, i);
824
-		spin_lock_init(&crng->lock);
825
-		crng_initialize(crng);
826
-		pool[i] = crng;
827
-	}
828
-	/* pairs with READ_ONCE() in select_crng() */
829
-	if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) {
830
-		for_each_node(i)
831
-			kfree(pool[i]);
832
-		kfree(pool);
833
-	}
834
-}
835
-
836
-static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
837
-
838
-static void numa_crng_init(void)
839
-{
840
-	schedule_work(&numa_crng_init_work);
841
-}
842
-
843
-static struct crng_state *select_crng(void)
844
-{
845
-	struct crng_state **pool;
846
-	int nid = numa_node_id();
847
-
848
-	/* pairs with cmpxchg_release() in do_numa_crng_init() */
849
-	pool = READ_ONCE(crng_node_pool);
850
-	if (pool && pool[nid])
851
-		return pool[nid];
852
-
853
-	return &primary_crng;
854
-}
855
-#else
856
-static void numa_crng_init(void) {}
857
-
858
-static struct crng_state *select_crng(void)
859
-{
860
-	return &primary_crng;
861
-}
862
-#endif
93
+/* Control how we warn userspace. */
94
+static struct ratelimit_state urandom_warning =
95
+	RATELIMIT_STATE_INIT_FLAGS("urandom_warning", HZ, 3, RATELIMIT_MSG_ON_RELEASE);
96
+static int ratelimit_disable __read_mostly =
97
+	IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM);
98
+module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
99
+MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
863100 
864101 /*
865
- * crng_fast_load() can be called by code in the interrupt service
866
- * path.  So we can't afford to dilly-dally.
102
+ * Returns whether or not the input pool has been seeded and thus guaranteed
103
+ * to supply cryptographically secure random numbers. This applies to: the
104
+ * /dev/urandom device, the get_random_bytes function, and the get_random_{u32,
105
+ * ,u64,int,long} family of functions.
106
+ *
107
+ * Returns: true if the input pool has been seeded.
108
+ *          false if the input pool has not been seeded.
867109  */
868
-static int crng_fast_load(const char *cp, size_t len)
110
+bool rng_is_initialized(void)
111
+{
112
+	return crng_ready();
113
+}
114
+EXPORT_SYMBOL(rng_is_initialized);
115
+
116
+/* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
117
+static void try_to_generate_entropy(void);
118
+
119
+/*
120
+ * Wait for the input pool to be seeded and thus guaranteed to supply
121
+ * cryptographically secure random numbers. This applies to: the /dev/urandom
122
+ * device, the get_random_bytes function, and the get_random_{u32,u64,int,long}
123
+ * family of functions. Using any of these functions without first calling
124
+ * this function forfeits the guarantee of security.
125
+ *
126
+ * Returns: 0 if the input pool has been seeded.
127
+ *          -ERESTARTSYS if the function was interrupted by a signal.
128
+ */
129
+int wait_for_random_bytes(void)
130
+{
131
+	while (!crng_ready()) {
132
+		int ret;
133
+
134
+		try_to_generate_entropy();
135
+		ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
136
+		if (ret)
137
+			return ret > 0 ? 0 : ret;
138
+	}
139
+	return 0;
140
+}
141
+EXPORT_SYMBOL(wait_for_random_bytes);
142
+
143
+/*
144
+ * Add a callback function that will be invoked when the input
145
+ * pool is initialised.
146
+ *
147
+ * returns: 0 if callback is successfully added
148
+ *	    -EALREADY if pool is already initialised (callback not called)
149
+ */
150
+int __cold register_random_ready_notifier(struct notifier_block *nb)
869151 {
870152 	unsigned long flags;
871
-	char *p;
153
+	int ret = -EALREADY;
872154 
873
-	if (!spin_trylock_irqsave(&primary_crng.lock, flags))
874
-		return 0;
875
-	if (crng_init != 0) {
876
-		spin_unlock_irqrestore(&primary_crng.lock, flags);
877
-		return 0;
878
-	}
879
-	p = (unsigned char *) &primary_crng.state[4];
880
-	while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) {
881
-		p[crng_init_cnt % CHACHA_KEY_SIZE] ^= *cp;
882
-		cp++; crng_init_cnt++; len--;
883
-	}
884
-	spin_unlock_irqrestore(&primary_crng.lock, flags);
885
-	if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
886
-		invalidate_batched_entropy();
887
-		crng_init = 1;
888
-		pr_notice("fast init done\n");
889
-	}
890
-	return 1;
155
+	if (crng_ready())
156
+		return ret;
157
+
158
+	spin_lock_irqsave(&random_ready_chain_lock, flags);
159
+	if (!crng_ready())
160
+		ret = raw_notifier_chain_register(&random_ready_chain, nb);
161
+	spin_unlock_irqrestore(&random_ready_chain_lock, flags);
162
+	return ret;
891163 }
892164 
893165 /*
894
- * crng_slow_load() is called by add_device_randomness, which has two
895
- * attributes.  (1) We can't trust the buffer passed to it is
896
- * guaranteed to be unpredictable (so it might not have any entropy at
897
- * all), and (2) it doesn't have the performance constraints of
898
- * crng_fast_load().
899
- *
900
- * So we do something more comprehensive which is guaranteed to touch
901
- * all of the primary_crng's state, and which uses a LFSR with a
902
- * period of 255 as part of the mixing algorithm.  Finally, we do
903
- * *not* advance crng_init_cnt since buffer we may get may be something
904
- * like a fixed DMI table (for example), which might very well be
905
- * unique to the machine, but is otherwise unvarying.
166
+ * Delete a previously registered readiness callback function.
906167  */
907
-static int crng_slow_load(const char *cp, size_t len)
168
+int __cold unregister_random_ready_notifier(struct notifier_block *nb)
908169 {
909
-	unsigned long		flags;
910
-	static unsigned char	lfsr = 1;
911
-	unsigned char		tmp;
912
-	unsigned		i, max = CHACHA_KEY_SIZE;
913
-	const char *		src_buf = cp;
914
-	char *			dest_buf = (char *) &primary_crng.state[4];
170
+	unsigned long flags;
171
+	int ret;
915172 
916
-	if (!spin_trylock_irqsave(&primary_crng.lock, flags))
917
-		return 0;
918
-	if (crng_init != 0) {
919
-		spin_unlock_irqrestore(&primary_crng.lock, flags);
920
-		return 0;
921
-	}
922
-	if (len > max)
923
-		max = len;
924
-
925
-	for (i = 0; i < max ; i++) {
926
-		tmp = lfsr;
927
-		lfsr >>= 1;
928
-		if (tmp & 1)
929
-			lfsr ^= 0xE1;
930
-		tmp = dest_buf[i % CHACHA_KEY_SIZE];
931
-		dest_buf[i % CHACHA_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
932
-		lfsr += (tmp << 3) | (tmp >> 5);
933
-	}
934
-	spin_unlock_irqrestore(&primary_crng.lock, flags);
935
-	return 1;
173
+	spin_lock_irqsave(&random_ready_chain_lock, flags);
174
+	ret = raw_notifier_chain_unregister(&random_ready_chain, nb);
175
+	spin_unlock_irqrestore(&random_ready_chain_lock, flags);
176
+	return ret;
936177 }
937178 
938
-static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
179
+static void process_oldschool_random_ready_list(void);
180
+static void __cold process_random_ready_list(void)
939181 {
940
-	unsigned long	flags;
941
-	int		i, num;
942
-	union {
943
-		__u8	block[CHACHA_BLOCK_SIZE];
944
-		__u32	key[8];
945
-	} buf;
182
+	unsigned long flags;
946183 
947
-	if (r) {
948
-		num = extract_entropy(r, &buf, 32, 16, 0);
949
-		if (num == 0)
184
+	spin_lock_irqsave(&random_ready_chain_lock, flags);
185
+	raw_notifier_call_chain(&random_ready_chain, 0, NULL);
186
+	spin_unlock_irqrestore(&random_ready_chain_lock, flags);
187
+
188
+	process_oldschool_random_ready_list();
189
+}
190
+
191
+#define warn_unseeded_randomness() \
192
+	if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \
193
+		printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \
194
+				__func__, (void *)_RET_IP_, crng_init)
195
+
196
+
197
+/*********************************************************************
198
+ *
199
+ * Fast key erasure RNG, the "crng".
200
+ *
201
+ * These functions expand entropy from the entropy extractor into
202
+ * long streams for external consumption using the "fast key erasure"
203
+ * RNG described at <https://blog.cr.yp.to/20170723-random.html>.
204
+ *
205
+ * There are a few exported interfaces for use by other drivers:
206
+ *
207
+ *	void get_random_bytes(void *buf, size_t len)
208
+ *	u32 get_random_u32()
209
+ *	u64 get_random_u64()
210
+ *	unsigned int get_random_int()
211
+ *	unsigned long get_random_long()
212
+ *
213
+ * These interfaces will return the requested number of random bytes
214
+ * into the given buffer or as a return value. This is equivalent to
215
+ * a read from /dev/urandom. The u32, u64, int, and long family of
216
+ * functions may be higher performance for one-off random integers,
217
+ * because they do a bit of buffering and do not invoke reseeding
218
+ * until the buffer is emptied.
219
+ *
220
+ *********************************************************************/
221
+
222
+enum {
223
+	CRNG_RESEED_START_INTERVAL = HZ,
224
+	CRNG_RESEED_INTERVAL = 60 * HZ
225
+};
226
+
227
+static struct {
228
+	u8 key[CHACHA_KEY_SIZE] __aligned(__alignof__(long));
229
+	unsigned long birth;
230
+	unsigned long generation;
231
+	spinlock_t lock;
232
+} base_crng = {
233
+	.lock = __SPIN_LOCK_UNLOCKED(base_crng.lock)
234
+};
235
+
236
+struct crng {
237
+	u8 key[CHACHA_KEY_SIZE];
238
+	unsigned long generation;
239
+	local_lock_t lock;
240
+};
241
+
242
+static DEFINE_PER_CPU(struct crng, crngs) = {
243
+	.generation = ULONG_MAX,
244
+	.lock = INIT_LOCAL_LOCK(crngs.lock),
245
+};
246
+
247
+/* Used by crng_reseed() and crng_make_state() to extract a new seed from the input pool. */
248
+static void extract_entropy(void *buf, size_t len);
249
+
250
+/* This extracts a new crng key from the input pool. */
251
+static void crng_reseed(void)
252
+{
253
+	unsigned long flags;
254
+	unsigned long next_gen;
255
+	u8 key[CHACHA_KEY_SIZE];
256
+
257
+	extract_entropy(key, sizeof(key));
258
+
259
+	/*
260
+	 * We copy the new key into the base_crng, overwriting the old one,
261
+	 * and update the generation counter. We avoid hitting ULONG_MAX,
262
+	 * because the per-cpu crngs are initialized to ULONG_MAX, so this
263
+	 * forces new CPUs that come online to always initialize.
264
+	 */
265
+	spin_lock_irqsave(&base_crng.lock, flags);
266
+	memcpy(base_crng.key, key, sizeof(base_crng.key));
267
+	next_gen = base_crng.generation + 1;
268
+	if (next_gen == ULONG_MAX)
269
+		++next_gen;
270
+	WRITE_ONCE(base_crng.generation, next_gen);
271
+	WRITE_ONCE(base_crng.birth, jiffies);
272
+	if (!crng_ready())
273
+		crng_init = CRNG_READY;
274
+	spin_unlock_irqrestore(&base_crng.lock, flags);
275
+	memzero_explicit(key, sizeof(key));
276
+}
277
+
278
+/*
279
+ * This generates a ChaCha block using the provided key, and then
280
+ * immediately overwites that key with half the block. It returns
281
+ * the resultant ChaCha state to the user, along with the second
282
+ * half of the block containing 32 bytes of random data that may
283
+ * be used; random_data_len may not be greater than 32.
284
+ *
285
+ * The returned ChaCha state contains within it a copy of the old
286
+ * key value, at index 4, so the state should always be zeroed out
287
+ * immediately after using in order to maintain forward secrecy.
288
+ * If the state cannot be erased in a timely manner, then it is
289
+ * safer to set the random_data parameter to &chacha_state[4] so
290
+ * that this function overwrites it before returning.
291
+ */
292
+static void crng_fast_key_erasure(u8 key[CHACHA_KEY_SIZE],
293
+				  u32 chacha_state[CHACHA_STATE_WORDS],
294
+				  u8 *random_data, size_t random_data_len)
295
+{
296
+	u8 first_block[CHACHA_BLOCK_SIZE];
297
+
298
+	BUG_ON(random_data_len > 32);
299
+
300
+	chacha_init_consts(chacha_state);
301
+	memcpy(&chacha_state[4], key, CHACHA_KEY_SIZE);
302
+	memset(&chacha_state[12], 0, sizeof(u32) * 4);
303
+	chacha20_block(chacha_state, first_block);
304
+
305
+	memcpy(key, first_block, CHACHA_KEY_SIZE);
306
+	memcpy(random_data, first_block + CHACHA_KEY_SIZE, random_data_len);
307
+	memzero_explicit(first_block, sizeof(first_block));
308
+}
309
+
310
+/*
311
+ * Return whether the crng seed is considered to be sufficiently old
312
+ * that a reseeding is needed. This happens if the last reseeding
313
+ * was CRNG_RESEED_INTERVAL ago, or during early boot, at an interval
314
+ * proportional to the uptime.
315
+ */
316
+static bool crng_has_old_seed(void)
317
+{
318
+	static bool early_boot = true;
319
+	unsigned long interval = CRNG_RESEED_INTERVAL;
320
+
321
+	if (unlikely(READ_ONCE(early_boot))) {
322
+		time64_t uptime = ktime_get_seconds();
323
+		if (uptime >= CRNG_RESEED_INTERVAL / HZ * 2)
324
+			WRITE_ONCE(early_boot, false);
325
+		else
326
+			interval = max_t(unsigned int, CRNG_RESEED_START_INTERVAL,
327
+					 (unsigned int)uptime / 2 * HZ);
328
+	}
329
+	return time_is_before_jiffies(READ_ONCE(base_crng.birth) + interval);
330
+}
331
+
332
+/*
333
+ * This function returns a ChaCha state that you may use for generating
334
+ * random data. It also returns up to 32 bytes on its own of random data
335
+ * that may be used; random_data_len may not be greater than 32.
336
+ */
337
+static void crng_make_state(u32 chacha_state[CHACHA_STATE_WORDS],
338
+			    u8 *random_data, size_t random_data_len)
339
+{
340
+	unsigned long flags;
341
+	struct crng *crng;
342
+
343
+	BUG_ON(random_data_len > 32);
344
+
345
+	/*
346
+	 * For the fast path, we check whether we're ready, unlocked first, and
347
+	 * then re-check once locked later. In the case where we're really not
348
+	 * ready, we do fast key erasure with the base_crng directly, extracting
349
+	 * when crng_init is CRNG_EMPTY.
350
+	 */
351
+	if (!crng_ready()) {
352
+		bool ready;
353
+
354
+		spin_lock_irqsave(&base_crng.lock, flags);
355
+		ready = crng_ready();
356
+		if (!ready) {
357
+			if (crng_init == CRNG_EMPTY)
358
+				extract_entropy(base_crng.key, sizeof(base_crng.key));
359
+			crng_fast_key_erasure(base_crng.key, chacha_state,
360
+					      random_data, random_data_len);
361
+		}
362
+		spin_unlock_irqrestore(&base_crng.lock, flags);
363
+		if (!ready)
950364 			return;
951
-	} else {
952
-		_extract_crng(&primary_crng, buf.block);
953
-		_crng_backtrack_protect(&primary_crng, buf.block,
954
-					CHACHA_KEY_SIZE);
955365 	}
956
-	spin_lock_irqsave(&crng->lock, flags);
957
-	for (i = 0; i < 8; i++) {
958
-		unsigned long	rv;
959
-		if (!arch_get_random_seed_long(&rv) &&
960
-		    !arch_get_random_long(&rv))
961
-			rv = random_get_entropy();
962
-		crng->state[i+4] ^= buf.key[i] ^ rv;
366
+
367
+	/*
368
+	 * If the base_crng is old enough, we reseed, which in turn bumps the
369
+	 * generation counter that we check below.
370
+	 */
371
+	if (unlikely(crng_has_old_seed()))
372
+		crng_reseed();
373
+
374
+	local_lock_irqsave(&crngs.lock, flags);
375
+	crng = raw_cpu_ptr(&crngs);
376
+
377
+	/*
378
+	 * If our per-cpu crng is older than the base_crng, then it means
379
+	 * somebody reseeded the base_crng. In that case, we do fast key
380
+	 * erasure on the base_crng, and use its output as the new key
381
+	 * for our per-cpu crng. This brings us up to date with base_crng.
382
+	 */
383
+	if (unlikely(crng->generation != READ_ONCE(base_crng.generation))) {
384
+		spin_lock(&base_crng.lock);
385
+		crng_fast_key_erasure(base_crng.key, chacha_state,
386
+				      crng->key, sizeof(crng->key));
387
+		crng->generation = base_crng.generation;
388
+		spin_unlock(&base_crng.lock);
963389 	}
964
-	memzero_explicit(&buf, sizeof(buf));
965
-	WRITE_ONCE(crng->init_time, jiffies);
966
-	spin_unlock_irqrestore(&crng->lock, flags);
967
-	if (crng == &primary_crng && crng_init < 2) {
968
-		invalidate_batched_entropy();
969
-		numa_crng_init();
970
-		crng_init = 2;
390
+
391
+	/*
392
+	 * Finally, when we've made it this far, our per-cpu crng has an up
393
+	 * to date key, and we can do fast key erasure with it to produce
394
+	 * some random data and a ChaCha state for the caller. All other
395
+	 * branches of this function are "unlikely", so most of the time we
396
+	 * should wind up here immediately.
397
+	 */
398
+	crng_fast_key_erasure(crng->key, chacha_state, random_data, random_data_len);
399
+	local_unlock_irqrestore(&crngs.lock, flags);
400
+}
401
+
402
+static void _get_random_bytes(void *buf, size_t len)
403
+{
404
+	u32 chacha_state[CHACHA_STATE_WORDS];
405
+	u8 tmp[CHACHA_BLOCK_SIZE];
406
+	size_t first_block_len;
407
+
408
+	if (!len)
409
+		return;
410
+
411
+	first_block_len = min_t(size_t, 32, len);
412
+	crng_make_state(chacha_state, buf, first_block_len);
413
+	len -= first_block_len;
414
+	buf += first_block_len;
415
+
416
+	while (len) {
417
+		if (len < CHACHA_BLOCK_SIZE) {
418
+			chacha20_block(chacha_state, tmp);
419
+			memcpy(buf, tmp, len);
420
+			memzero_explicit(tmp, sizeof(tmp));
421
+			break;
422
+		}
423
+
424
+		chacha20_block(chacha_state, buf);
425
+		if (unlikely(chacha_state[12] == 0))
426
+			++chacha_state[13];
427
+		len -= CHACHA_BLOCK_SIZE;
428
+		buf += CHACHA_BLOCK_SIZE;
429
+	}
430
+
431
+	memzero_explicit(chacha_state, sizeof(chacha_state));
432
+}
433
+
434
+/*
435
+ * This function is the exported kernel interface.  It returns some
436
+ * number of good random numbers, suitable for key generation, seeding
437
+ * TCP sequence numbers, etc.  It does not rely on the hardware random
438
+ * number generator.  For random bytes direct from the hardware RNG
439
+ * (when available), use get_random_bytes_arch(). In order to ensure
440
+ * that the randomness provided by this function is okay, the function
441
+ * wait_for_random_bytes() should be called and return 0 at least once
442
+ * at any point prior.
443
+ */
444
+void get_random_bytes(void *buf, int len)
445
+{
446
+	warn_unseeded_randomness();
447
+	_get_random_bytes(buf, len);
448
+}
449
+EXPORT_SYMBOL(get_random_bytes);
450
+
451
+static ssize_t get_random_bytes_user(struct iov_iter *iter)
452
+{
453
+	u32 chacha_state[CHACHA_STATE_WORDS];
454
+	u8 block[CHACHA_BLOCK_SIZE];
455
+	size_t ret = 0, copied;
456
+
457
+	if (unlikely(!iov_iter_count(iter)))
458
+		return 0;
459
+
460
+	/*
461
+	 * Immediately overwrite the ChaCha key at index 4 with random
462
+	 * bytes, in case userspace causes copy_to_iter() below to sleep
463
+	 * forever, so that we still retain forward secrecy in that case.
464
+	 */
465
+	crng_make_state(chacha_state, (u8 *)&chacha_state[4], CHACHA_KEY_SIZE);
466
+	/*
467
+	 * However, if we're doing a read of len <= 32, we don't need to
468
+	 * use chacha_state after, so we can simply return those bytes to
469
+	 * the user directly.
470
+	 */
471
+	if (iov_iter_count(iter) <= CHACHA_KEY_SIZE) {
472
+		ret = copy_to_iter(&chacha_state[4], CHACHA_KEY_SIZE, iter);
473
+		goto out_zero_chacha;
474
+	}
475
+
476
+	for (;;) {
477
+		chacha20_block(chacha_state, block);
478
+		if (unlikely(chacha_state[12] == 0))
479
+			++chacha_state[13];
480
+
481
+		copied = copy_to_iter(block, sizeof(block), iter);
482
+		ret += copied;
483
+		if (!iov_iter_count(iter) || copied != sizeof(block))
484
+			break;
485
+
486
+		BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0);
487
+		if (ret % PAGE_SIZE == 0) {
488
+			if (signal_pending(current))
489
+				break;
490
+			cond_resched();
491
+		}
492
+	}
493
+
494
+	memzero_explicit(block, sizeof(block));
495
+out_zero_chacha:
496
+	memzero_explicit(chacha_state, sizeof(chacha_state));
497
+	return ret ? ret : -EFAULT;
498
+}
499
+
500
+/*
501
+ * Batched entropy returns random integers. The quality of the random
502
+ * number is good as /dev/urandom. In order to ensure that the randomness
503
+ * provided by this function is okay, the function wait_for_random_bytes()
504
+ * should be called and return 0 at least once at any point prior.
505
+ */
506
+
507
+#define DEFINE_BATCHED_ENTROPY(type)						\
508
+struct batch_ ##type {								\
509
+	/*									\
510
+	 * We make this 1.5x a ChaCha block, so that we get the			\
511
+	 * remaining 32 bytes from fast key erasure, plus one full		\
512
+	 * block from the detached ChaCha state. We can increase		\
513
+	 * the size of this later if needed so long as we keep the		\
514
+	 * formula of (integer_blocks + 0.5) * CHACHA_BLOCK_SIZE.		\
515
+	 */									\
516
+	type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))];		\
517
+	local_lock_t lock;							\
518
+	unsigned long generation;						\
519
+	unsigned int position;							\
520
+};										\
521
+										\
522
+static DEFINE_PER_CPU(struct batch_ ##type, batched_entropy_ ##type) = {	\
523
+	.lock = INIT_LOCAL_LOCK(batched_entropy_ ##type.lock),			\
524
+	.position = UINT_MAX							\
525
+};										\
526
+										\
527
+type get_random_ ##type(void)							\
528
+{										\
529
+	type ret;								\
530
+	unsigned long flags;							\
531
+	struct batch_ ##type *batch;						\
532
+	unsigned long next_gen;							\
533
+										\
534
+	warn_unseeded_randomness();						\
535
+										\
536
+	if  (!crng_ready()) {							\
537
+		_get_random_bytes(&ret, sizeof(ret));				\
538
+		return ret;							\
539
+	}									\
540
+										\
541
+	local_lock_irqsave(&batched_entropy_ ##type.lock, flags);		\
542
+	batch = raw_cpu_ptr(&batched_entropy_##type);				\
543
+										\
544
+	next_gen = READ_ONCE(base_crng.generation);				\
545
+	if (batch->position >= ARRAY_SIZE(batch->entropy) ||			\
546
+	    next_gen != batch->generation) {					\
547
+		_get_random_bytes(batch->entropy, sizeof(batch->entropy));	\
548
+		batch->position = 0;						\
549
+		batch->generation = next_gen;					\
550
+	}									\
551
+										\
552
+	ret = batch->entropy[batch->position];					\
553
+	batch->entropy[batch->position] = 0;					\
554
+	++batch->position;							\
555
+	local_unlock_irqrestore(&batched_entropy_ ##type.lock, flags);		\
556
+	return ret;								\
557
+}										\
558
+EXPORT_SYMBOL(get_random_ ##type);
559
+
560
+DEFINE_BATCHED_ENTROPY(u64)
561
+DEFINE_BATCHED_ENTROPY(u32)
562
+
563
+#ifdef CONFIG_SMP
564
+/*
565
+ * This function is called when the CPU is coming up, with entry
566
+ * CPUHP_RANDOM_PREPARE, which comes before CPUHP_WORKQUEUE_PREP.
567
+ */
568
+int __cold random_prepare_cpu(unsigned int cpu)
569
+{
570
+	/*
571
+	 * When the cpu comes back online, immediately invalidate both
572
+	 * the per-cpu crng and all batches, so that we serve fresh
573
+	 * randomness.
574
+	 */
575
+	per_cpu_ptr(&crngs, cpu)->generation = ULONG_MAX;
576
+	per_cpu_ptr(&batched_entropy_u32, cpu)->position = UINT_MAX;
577
+	per_cpu_ptr(&batched_entropy_u64, cpu)->position = UINT_MAX;
578
+	return 0;
579
+}
580
+#endif
581
+
582
+/*
583
+ * This function will use the architecture-specific hardware random
584
+ * number generator if it is available. It is not recommended for
585
+ * use. Use get_random_bytes() instead. It returns the number of
586
+ * bytes filled in.
587
+ */
588
+int __must_check get_random_bytes_arch(void *buf, int len)
589
+{
590
+	size_t left = len;
591
+	u8 *p = buf;
592
+
593
+	while (left) {
594
+		unsigned long v;
595
+		size_t block_len = min_t(size_t, left, sizeof(unsigned long));
596
+
597
+		if (!arch_get_random_long(&v))
598
+			break;
599
+
600
+		memcpy(p, &v, block_len);
601
+		p += block_len;
602
+		left -= block_len;
603
+	}
604
+
605
+	return len - left;
606
+}
607
+EXPORT_SYMBOL(get_random_bytes_arch);
608
+
609
+
610
+/**********************************************************************
611
+ *
612
+ * Entropy accumulation and extraction routines.
613
+ *
614
+ * Callers may add entropy via:
615
+ *
616
+ *     static void mix_pool_bytes(const void *buf, size_t len)
617
+ *
618
+ * After which, if added entropy should be credited:
619
+ *
620
+ *     static void credit_init_bits(size_t bits)
621
+ *
622
+ * Finally, extract entropy via:
623
+ *
624
+ *     static void extract_entropy(void *buf, size_t len)
625
+ *
626
+ **********************************************************************/
627
+
628
+enum {
629
+	POOL_BITS = BLAKE2S_HASH_SIZE * 8,
630
+	POOL_READY_BITS = POOL_BITS, /* When crng_init->CRNG_READY */
631
+	POOL_EARLY_BITS = POOL_READY_BITS / 2 /* When crng_init->CRNG_EARLY */
632
+};
633
+
634
+static struct {
635
+	struct blake2s_state hash;
636
+	spinlock_t lock;
637
+	unsigned int init_bits;
638
+} input_pool = {
639
+	.hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE),
640
+		    BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4,
641
+		    BLAKE2S_IV5, BLAKE2S_IV6, BLAKE2S_IV7 },
642
+	.hash.outlen = BLAKE2S_HASH_SIZE,
643
+	.lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
644
+};
645
+
646
+static void _mix_pool_bytes(const void *buf, size_t len)
647
+{
648
+	blake2s_update(&input_pool.hash, buf, len);
649
+}
650
+
651
+/*
652
+ * This function adds bytes into the input pool. It does not
653
+ * update the initialization bit counter; the caller should call
654
+ * credit_init_bits if this is appropriate.
655
+ */
656
+static void mix_pool_bytes(const void *buf, size_t len)
657
+{
658
+	unsigned long flags;
659
+
660
+	spin_lock_irqsave(&input_pool.lock, flags);
661
+	_mix_pool_bytes(buf, len);
662
+	spin_unlock_irqrestore(&input_pool.lock, flags);
663
+}
664
+
665
+/*
666
+ * This is an HKDF-like construction for using the hashed collected entropy
667
+ * as a PRF key, that's then expanded block-by-block.
668
+ */
669
+static void extract_entropy(void *buf, size_t len)
670
+{
671
+	unsigned long flags;
672
+	u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE];
673
+	struct {
674
+		unsigned long rdseed[32 / sizeof(long)];
675
+		size_t counter;
676
+	} block;
677
+	size_t i;
678
+
679
+	for (i = 0; i < ARRAY_SIZE(block.rdseed); ++i) {
680
+		if (!arch_get_random_seed_long(&block.rdseed[i]) &&
681
+		    !arch_get_random_long(&block.rdseed[i]))
682
+			block.rdseed[i] = random_get_entropy();
683
+	}
684
+
685
+	spin_lock_irqsave(&input_pool.lock, flags);
686
+
687
+	/* seed = HASHPRF(last_key, entropy_input) */
688
+	blake2s_final(&input_pool.hash, seed);
689
+
690
+	/* next_key = HASHPRF(seed, RDSEED || 0) */
691
+	block.counter = 0;
692
+	blake2s(next_key, (u8 *)&block, seed, sizeof(next_key), sizeof(block), sizeof(seed));
693
+	blake2s_init_key(&input_pool.hash, BLAKE2S_HASH_SIZE, next_key, sizeof(next_key));
694
+
695
+	spin_unlock_irqrestore(&input_pool.lock, flags);
696
+	memzero_explicit(next_key, sizeof(next_key));
697
+
698
+	while (len) {
699
+		i = min_t(size_t, len, BLAKE2S_HASH_SIZE);
700
+		/* output = HASHPRF(seed, RDSEED || ++counter) */
701
+		++block.counter;
702
+		blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed));
703
+		len -= i;
704
+		buf += i;
705
+	}
706
+
707
+	memzero_explicit(seed, sizeof(seed));
708
+	memzero_explicit(&block, sizeof(block));
709
+}
710
+
711
+#define credit_init_bits(bits) if (!crng_ready()) _credit_init_bits(bits)
712
+
713
+static void __cold _credit_init_bits(size_t bits)
714
+{
715
+	unsigned int new, orig, add;
716
+	unsigned long flags;
717
+
718
+	if (!bits)
719
+		return;
720
+
721
+	add = min_t(size_t, bits, POOL_BITS);
722
+
723
+	do {
724
+		orig = READ_ONCE(input_pool.init_bits);
725
+		new = min_t(unsigned int, POOL_BITS, orig + add);
726
+	} while (cmpxchg(&input_pool.init_bits, orig, new) != orig);
727
+
728
+	if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) {
729
+		crng_reseed(); /* Sets crng_init to CRNG_READY under base_crng.lock. */
971730 		process_random_ready_list();
972731 		wake_up_interruptible(&crng_init_wait);
973732 		kill_fasync(&fasync, SIGIO, POLL_IN);
974733 		pr_notice("crng init done\n");
975
-		if (unseeded_warning.missed) {
976
-			pr_notice("%d get_random_xx warning(s) missed due to ratelimiting\n",
977
-				  unseeded_warning.missed);
978
-			unseeded_warning.missed = 0;
979
-		}
980
-		if (urandom_warning.missed) {
734
+		if (urandom_warning.missed)
981735 			pr_notice("%d urandom warning(s) missed due to ratelimiting\n",
982736 				  urandom_warning.missed);
983
-			urandom_warning.missed = 0;
737
+	} else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) {
738
+		spin_lock_irqsave(&base_crng.lock, flags);
739
+		/* Check if crng_init is CRNG_EMPTY, to avoid race with crng_reseed(). */
740
+		if (crng_init == CRNG_EMPTY) {
741
+			extract_entropy(base_crng.key, sizeof(base_crng.key));
742
+			crng_init = CRNG_EARLY;
984743 		}
744
+		spin_unlock_irqrestore(&base_crng.lock, flags);
985745 	}
986746 }
987747 
988
-static void _extract_crng(struct crng_state *crng,
989
-			  __u8 out[CHACHA_BLOCK_SIZE])
990
-{
991
-	unsigned long v, flags, init_time;
992748 
993
-	if (crng_ready()) {
994
-		init_time = READ_ONCE(crng->init_time);
995
-		if (time_after(READ_ONCE(crng_global_init_time), init_time) ||
996
-		    time_after(jiffies, init_time + CRNG_RESEED_INTERVAL))
997
-			crng_reseed(crng, crng == &primary_crng ?
998
-				    &input_pool : NULL);
999
-	}
1000
-	spin_lock_irqsave(&crng->lock, flags);
1001
-	if (arch_get_random_long(&v))
1002
-		crng->state[14] ^= v;
1003
-	chacha20_block(&crng->state[0], out);
1004
-	if (crng->state[12] == 0)
1005
-		crng->state[13]++;
1006
-	spin_unlock_irqrestore(&crng->lock, flags);
1007
-}
749
+/**********************************************************************
750
+ *
751
+ * Entropy collection routines.
752
+ *
753
+ * The following exported functions are used for pushing entropy into
754
+ * the above entropy accumulation routines:
755
+ *
756
+ *	void add_device_randomness(const void *buf, size_t len);
757
+ *	void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy);
758
+ *	void add_bootloader_randomness(const void *buf, size_t len);
759
+ *	void add_interrupt_randomness(int irq);
760
+ *	void add_input_randomness(unsigned int type, unsigned int code, unsigned int value);
761
+ *	void add_disk_randomness(struct gendisk *disk);
762
+ *
763
+ * add_device_randomness() adds data to the input pool that
764
+ * is likely to differ between two devices (or possibly even per boot).
765
+ * This would be things like MAC addresses or serial numbers, or the
766
+ * read-out of the RTC. This does *not* credit any actual entropy to
767
+ * the pool, but it initializes the pool to different values for devices
768
+ * that might otherwise be identical and have very little entropy
769
+ * available to them (particularly common in the embedded world).
770
+ *
771
+ * add_hwgenerator_randomness() is for true hardware RNGs, and will credit
772
+ * entropy as specified by the caller. If the entropy pool is full it will
773
+ * block until more entropy is needed.
774
+ *
775
+ * add_bootloader_randomness() is called by bootloader drivers, such as EFI
776
+ * and device tree, and credits its input depending on whether or not the
777
+ * configuration option CONFIG_RANDOM_TRUST_BOOTLOADER is set.
778
+ *
779
+ * add_interrupt_randomness() uses the interrupt timing as random
780
+ * inputs to the entropy pool. Using the cycle counters and the irq source
781
+ * as inputs, it feeds the input pool roughly once a second or after 64
782
+ * interrupts, crediting 1 bit of entropy for whichever comes first.
783
+ *
784
+ * add_input_randomness() uses the input layer interrupt timing, as well
785
+ * as the event type information from the hardware.
786
+ *
787
+ * add_disk_randomness() uses what amounts to the seek time of block
788
+ * layer request events, on a per-disk_devt basis, as input to the
789
+ * entropy pool. Note that high-speed solid state drives with very low
790
+ * seek times do not make for good sources of entropy, as their seek
791
+ * times are usually fairly consistent.
792
+ *
793
+ * The last two routines try to estimate how many bits of entropy
794
+ * to credit. They do this by keeping track of the first and second
795
+ * order deltas of the event timings.
796
+ *
797
+ **********************************************************************/
1008798 
1009
-static void extract_crng(__u8 out[CHACHA_BLOCK_SIZE])
799
+static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
800
+static bool trust_bootloader __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER);
801
+static int __init parse_trust_cpu(char *arg)
1010802 {
1011
-	_extract_crng(select_crng(), out);
803
+	return kstrtobool(arg, &trust_cpu);
1012804 }
805
+static int __init parse_trust_bootloader(char *arg)
806
+{
807
+	return kstrtobool(arg, &trust_bootloader);
808
+}
809
+early_param("random.trust_cpu", parse_trust_cpu);
810
+early_param("random.trust_bootloader", parse_trust_bootloader);
1013811 
1014812 /*
1015
- * Use the leftover bytes from the CRNG block output (if there is
1016
- * enough) to mutate the CRNG key to provide backtracking protection.
813
+ * The first collection of entropy occurs at system boot while interrupts
814
+ * are still turned off. Here we push in latent entropy, RDSEED, a timestamp,
815
+ * utsname(), and the command line. Depending on the above configuration knob,
816
+ * RDSEED may be considered sufficient for initialization. Note that much
817
+ * earlier setup may already have pushed entropy into the input pool by the
818
+ * time we get here.
1017819  */
1018
-static void _crng_backtrack_protect(struct crng_state *crng,
1019
-				    __u8 tmp[CHACHA_BLOCK_SIZE], int used)
820
+int __init random_init(const char *command_line)
1020821 {
1021
-	unsigned long	flags;
1022
-	__u32		*s, *d;
1023
-	int		i;
822
+	ktime_t now = ktime_get_real();
823
+	unsigned int i, arch_bytes;
824
+	unsigned long entropy;
1024825 
1025
-	used = round_up(used, sizeof(__u32));
1026
-	if (used + CHACHA_KEY_SIZE > CHACHA_BLOCK_SIZE) {
1027
-		extract_crng(tmp);
1028
-		used = 0;
1029
-	}
1030
-	spin_lock_irqsave(&crng->lock, flags);
1031
-	s = (__u32 *) &tmp[used];
1032
-	d = &crng->state[4];
1033
-	for (i=0; i < 8; i++)
1034
-		*d++ ^= *s++;
1035
-	spin_unlock_irqrestore(&crng->lock, flags);
1036
-}
826
+#if defined(LATENT_ENTROPY_PLUGIN)
827
+	static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy;
828
+	_mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed));
829
+#endif
1037830 
1038
-static void crng_backtrack_protect(__u8 tmp[CHACHA_BLOCK_SIZE], int used)
1039
-{
1040
-	_crng_backtrack_protect(select_crng(), tmp, used);
1041
-}
1042
-
1043
-static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
1044
-{
1045
-	ssize_t ret = 0, i = CHACHA_BLOCK_SIZE;
1046
-	__u8 tmp[CHACHA_BLOCK_SIZE] __aligned(4);
1047
-	int large_request = (nbytes > 256);
1048
-
1049
-	while (nbytes) {
1050
-		if (large_request && need_resched()) {
1051
-			if (signal_pending(current)) {
1052
-				if (ret == 0)
1053
-					ret = -ERESTARTSYS;
1054
-				break;
1055
-			}
1056
-			schedule();
831
+	for (i = 0, arch_bytes = BLAKE2S_BLOCK_SIZE;
832
+	     i < BLAKE2S_BLOCK_SIZE; i += sizeof(entropy)) {
833
+		if (!arch_get_random_seed_long_early(&entropy) &&
834
+		    !arch_get_random_long_early(&entropy)) {
835
+			entropy = random_get_entropy();
836
+			arch_bytes -= sizeof(entropy);
1057837 		}
1058
-
1059
-		extract_crng(tmp);
1060
-		i = min_t(int, nbytes, CHACHA_BLOCK_SIZE);
1061
-		if (copy_to_user(buf, tmp, i)) {
1062
-			ret = -EFAULT;
1063
-			break;
1064
-		}
1065
-
1066
-		nbytes -= i;
1067
-		buf += i;
1068
-		ret += i;
838
+		_mix_pool_bytes(&entropy, sizeof(entropy));
1069839 	}
1070
-	crng_backtrack_protect(tmp, i);
840
+	_mix_pool_bytes(&now, sizeof(now));
841
+	_mix_pool_bytes(utsname(), sizeof(*(utsname())));
842
+	_mix_pool_bytes(command_line, strlen(command_line));
843
+	add_latent_entropy();
1071844 
1072
-	/* Wipe data just written to memory */
1073
-	memzero_explicit(tmp, sizeof(tmp));
845
+	if (crng_ready())
846
+		crng_reseed();
847
+	else if (trust_cpu)
848
+		credit_init_bits(arch_bytes * 8);
1074849 
1075
-	return ret;
850
+	return 0;
1076851 }
1077
-
1078
-
1079
-/*********************************************************************
1080
- *
1081
- * Entropy input management
1082
- *
1083
- *********************************************************************/
1084
-
1085
-/* There is one of these per entropy source */
1086
-struct timer_rand_state {
1087
-	cycles_t last_time;
1088
-	long last_delta, last_delta2;
1089
-};
1090
-
1091
-#define INIT_TIMER_RAND_STATE { INITIAL_JIFFIES, };
1092852 
1093853 /*
1094854  * Add device- or boot-specific data to the input pool to help
....@@ -1098,57 +858,212 @@
1098858  * the entropy pool having similar initial state across largely
1099859  * identical devices.
1100860  */
1101
-void add_device_randomness(const void *buf, unsigned int size)
861
+void add_device_randomness(const void *buf, unsigned int len)
1102862 {
1103
-	unsigned long time = random_get_entropy() ^ jiffies;
863
+	unsigned long entropy = random_get_entropy();
1104864 	unsigned long flags;
1105865 
1106
-	if (!crng_ready() && size)
1107
-		crng_slow_load(buf, size);
1108
-
1109
-	trace_add_device_randomness(size, _RET_IP_);
1110866 	spin_lock_irqsave(&input_pool.lock, flags);
1111
-	_mix_pool_bytes(&input_pool, buf, size);
1112
-	_mix_pool_bytes(&input_pool, &time, sizeof(time));
867
+	_mix_pool_bytes(&entropy, sizeof(entropy));
868
+	_mix_pool_bytes(buf, len);
1113869 	spin_unlock_irqrestore(&input_pool.lock, flags);
1114870 }
1115871 EXPORT_SYMBOL(add_device_randomness);
1116872 
1117
-static struct timer_rand_state input_timer_state = INIT_TIMER_RAND_STATE;
873
+/*
874
+ * Interface for in-kernel drivers of true hardware RNGs.
875
+ * Those devices may produce endless random bits and will be throttled
876
+ * when our pool is full.
877
+ */
878
+void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy)
879
+{
880
+	mix_pool_bytes(buf, len);
881
+	credit_init_bits(entropy);
882
+
883
+	/*
884
+	 * Throttle writing to once every CRNG_RESEED_INTERVAL, unless
885
+	 * we're not yet initialized.
886
+	 */
887
+	if (!kthread_should_stop() && crng_ready())
888
+		schedule_timeout_interruptible(CRNG_RESEED_INTERVAL);
889
+}
890
+EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
891
+
892
+/*
893
+ * Handle random seed passed by bootloader, and credit it if
894
+ * CONFIG_RANDOM_TRUST_BOOTLOADER is set.
895
+ */
896
+void __cold add_bootloader_randomness(const void *buf, size_t len)
897
+{
898
+	mix_pool_bytes(buf, len);
899
+	if (trust_bootloader)
900
+		credit_init_bits(len * 8);
901
+}
902
+EXPORT_SYMBOL_GPL(add_bootloader_randomness);
903
+
904
+struct fast_pool {
905
+	unsigned long pool[4];
906
+	unsigned long last;
907
+	unsigned int count;
908
+	struct timer_list mix;
909
+};
910
+
911
+static void mix_interrupt_randomness(struct timer_list *work);
912
+
913
+static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = {
914
+#ifdef CONFIG_64BIT
915
+#define FASTMIX_PERM SIPHASH_PERMUTATION
916
+	.pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 },
917
+#else
918
+#define FASTMIX_PERM HSIPHASH_PERMUTATION
919
+	.pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 },
920
+#endif
921
+	.mix = __TIMER_INITIALIZER(mix_interrupt_randomness, 0)
922
+};
923
+
924
+/*
925
+ * This is [Half]SipHash-1-x, starting from an empty key. Because
926
+ * the key is fixed, it assumes that its inputs are non-malicious,
927
+ * and therefore this has no security on its own. s represents the
928
+ * four-word SipHash state, while v represents a two-word input.
929
+ */
930
+static void fast_mix(unsigned long s[4], unsigned long v1, unsigned long v2)
931
+{
932
+	s[3] ^= v1;
933
+	FASTMIX_PERM(s[0], s[1], s[2], s[3]);
934
+	s[0] ^= v1;
935
+	s[3] ^= v2;
936
+	FASTMIX_PERM(s[0], s[1], s[2], s[3]);
937
+	s[0] ^= v2;
938
+}
939
+
940
+#ifdef CONFIG_SMP
941
+/*
942
+ * This function is called when the CPU has just come online, with
943
+ * entry CPUHP_AP_RANDOM_ONLINE, just after CPUHP_AP_WORKQUEUE_ONLINE.
944
+ */
945
+int __cold random_online_cpu(unsigned int cpu)
946
+{
947
+	/*
948
+	 * During CPU shutdown and before CPU onlining, add_interrupt_
949
+	 * randomness() may schedule mix_interrupt_randomness(), and
950
+	 * set the MIX_INFLIGHT flag. However, because the worker can
951
+	 * be scheduled on a different CPU during this period, that
952
+	 * flag will never be cleared. For that reason, we zero out
953
+	 * the flag here, which runs just after workqueues are onlined
954
+	 * for the CPU again. This also has the effect of setting the
955
+	 * irq randomness count to zero so that new accumulated irqs
956
+	 * are fresh.
957
+	 */
958
+	per_cpu_ptr(&irq_randomness, cpu)->count = 0;
959
+	return 0;
960
+}
961
+#endif
962
+
963
+static void mix_interrupt_randomness(struct timer_list *work)
964
+{
965
+	struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix);
966
+	/*
967
+	 * The size of the copied stack pool is explicitly 2 longs so that we
968
+	 * only ever ingest half of the siphash output each time, retaining
969
+	 * the other half as the next "key" that carries over. The entropy is
970
+	 * supposed to be sufficiently dispersed between bits so on average
971
+	 * we don't wind up "losing" some.
972
+	 */
973
+	unsigned long pool[2];
974
+	unsigned int count;
975
+
976
+	/* Check to see if we're running on the wrong CPU due to hotplug. */
977
+	local_irq_disable();
978
+	if (fast_pool != this_cpu_ptr(&irq_randomness)) {
979
+		local_irq_enable();
980
+		return;
981
+	}
982
+
983
+	/*
984
+	 * Copy the pool to the stack so that the mixer always has a
985
+	 * consistent view, before we reenable irqs again.
986
+	 */
987
+	memcpy(pool, fast_pool->pool, sizeof(pool));
988
+	count = fast_pool->count;
989
+	fast_pool->count = 0;
990
+	fast_pool->last = jiffies;
991
+	local_irq_enable();
992
+
993
+	mix_pool_bytes(pool, sizeof(pool));
994
+	credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8));
995
+
996
+	memzero_explicit(pool, sizeof(pool));
997
+}
998
+
999
+void add_interrupt_randomness(int irq)
1000
+{
1001
+	enum { MIX_INFLIGHT = 1U << 31 };
1002
+	unsigned long entropy = random_get_entropy();
1003
+	struct fast_pool *fast_pool = this_cpu_ptr(&irq_randomness);
1004
+	struct pt_regs *regs = get_irq_regs();
1005
+	unsigned int new_count;
1006
+
1007
+	fast_mix(fast_pool->pool, entropy,
1008
+		 (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq));
1009
+	new_count = ++fast_pool->count;
1010
+
1011
+	if (new_count & MIX_INFLIGHT)
1012
+		return;
1013
+
1014
+	if (new_count < 1024 && !time_is_before_jiffies(fast_pool->last + HZ))
1015
+		return;
1016
+
1017
+	fast_pool->count |= MIX_INFLIGHT;
1018
+	if (!timer_pending(&fast_pool->mix)) {
1019
+		fast_pool->mix.expires = jiffies;
1020
+		add_timer_on(&fast_pool->mix, raw_smp_processor_id());
1021
+	}
1022
+}
1023
+EXPORT_SYMBOL_GPL(add_interrupt_randomness);
1024
+
1025
+/* There is one of these per entropy source */
1026
+struct timer_rand_state {
1027
+	unsigned long last_time;
1028
+	long last_delta, last_delta2;
1029
+};
11181030 
11191031 /*
11201032  * This function adds entropy to the entropy "pool" by using timing
1121
- * delays.  It uses the timer_rand_state structure to make an estimate
1122
- * of how many bits of entropy this call has added to the pool.
1123
- *
1124
- * The number "num" is also added to the pool - it should somehow describe
1125
- * the type of event which just happened.  This is currently 0-255 for
1126
- * keyboard scan codes, and 256 upwards for interrupts.
1127
- *
1033
+ * delays. It uses the timer_rand_state structure to make an estimate
1034
+ * of how many bits of entropy this call has added to the pool. The
1035
+ * value "num" is also added to the pool; it should somehow describe
1036
+ * the type of event that just happened.
11281037  */
1129
-static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
1038
+static void add_timer_randomness(struct timer_rand_state *state, unsigned int num)
11301039 {
1131
-	struct entropy_store	*r;
1132
-	struct {
1133
-		long jiffies;
1134
-		unsigned cycles;
1135
-		unsigned num;
1136
-	} sample;
1040
+	unsigned long entropy = random_get_entropy(), now = jiffies, flags;
11371041 	long delta, delta2, delta3;
1042
+	unsigned int bits;
11381043 
1139
-	sample.jiffies = jiffies;
1140
-	sample.cycles = random_get_entropy();
1141
-	sample.num = num;
1142
-	r = &input_pool;
1143
-	mix_pool_bytes(r, &sample, sizeof(sample));
1044
+	/*
1045
+	 * If we're in a hard IRQ, add_interrupt_randomness() will be called
1046
+	 * sometime after, so mix into the fast pool.
1047
+	 */
1048
+	if (in_irq()) {
1049
+		fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);
1050
+	} else {
1051
+		spin_lock_irqsave(&input_pool.lock, flags);
1052
+		_mix_pool_bytes(&entropy, sizeof(entropy));
1053
+		_mix_pool_bytes(&num, sizeof(num));
1054
+		spin_unlock_irqrestore(&input_pool.lock, flags);
1055
+	}
1056
+
1057
+	if (crng_ready())
1058
+		return;
11441059 
11451060 	/*
11461061 	 * Calculate number of bits of randomness we probably added.
11471062 	 * We take into account the first, second and third-order deltas
11481063 	 * in order to make our estimate.
11491064 	 */
1150
-	delta = sample.jiffies - READ_ONCE(state->last_time);
1151
-	WRITE_ONCE(state->last_time, sample.jiffies);
1065
+	delta = now - READ_ONCE(state->last_time);
1066
+	WRITE_ONCE(state->last_time, now);
11521067 
11531068 	delta2 = delta - READ_ONCE(state->last_delta);
11541069 	WRITE_ONCE(state->last_delta, delta);
....@@ -1168,390 +1083,64 @@
11681083 		delta = delta3;
11691084 
11701085 	/*
1171
-	 * delta is now minimum absolute delta.
1172
-	 * Round down by 1 bit on general principles,
1173
-	 * and limit entropy estimate to 12 bits.
1086
+	 * delta is now minimum absolute delta. Round down by 1 bit
1087
+	 * on general principles, and limit entropy estimate to 11 bits.
11741088 	 */
1175
-	credit_entropy_bits(r, min_t(int, fls(delta>>1), 11));
1089
+	bits = min(fls(delta >> 1), 11);
1090
+
1091
+	/*
1092
+	 * As mentioned above, if we're in a hard IRQ, add_interrupt_randomness()
1093
+	 * will run after this, which uses a different crediting scheme of 1 bit
1094
+	 * per every 64 interrupts. In order to let that function do accounting
1095
+	 * close to the one in this function, we credit a full 64/64 bit per bit,
1096
+	 * and then subtract one to account for the extra one added.
1097
+	 */
1098
+	if (in_irq())
1099
+		this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1;
1100
+	else
1101
+		_credit_init_bits(bits);
11761102 }
11771103 
1178
-void add_input_randomness(unsigned int type, unsigned int code,
1179
-				 unsigned int value)
1104
+void add_input_randomness(unsigned int type, unsigned int code, unsigned int value)
11801105 {
11811106 	static unsigned char last_value;
1107
+	static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES };
11821108 
1183
-	/* ignore autorepeat and the like */
1109
+	/* Ignore autorepeat and the like. */
11841110 	if (value == last_value)
11851111 		return;
11861112 
11871113 	last_value = value;
11881114 	add_timer_randomness(&input_timer_state,
11891115 			     (type << 4) ^ code ^ (code >> 4) ^ value);
1190
-	trace_add_input_randomness(ENTROPY_BITS(&input_pool));
11911116 }
11921117 EXPORT_SYMBOL_GPL(add_input_randomness);
1193
-
1194
-static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
1195
-
1196
-#ifdef ADD_INTERRUPT_BENCH
1197
-static unsigned long avg_cycles, avg_deviation;
1198
-
1199
-#define AVG_SHIFT 8     /* Exponential average factor k=1/256 */
1200
-#define FIXED_1_2 (1 << (AVG_SHIFT-1))
1201
-
1202
-static void add_interrupt_bench(cycles_t start)
1203
-{
1204
-        long delta = random_get_entropy() - start;
1205
-
1206
-        /* Use a weighted moving average */
1207
-        delta = delta - ((avg_cycles + FIXED_1_2) >> AVG_SHIFT);
1208
-        avg_cycles += delta;
1209
-        /* And average deviation */
1210
-        delta = abs(delta) - ((avg_deviation + FIXED_1_2) >> AVG_SHIFT);
1211
-        avg_deviation += delta;
1212
-}
1213
-#else
1214
-#define add_interrupt_bench(x)
1215
-#endif
1216
-
1217
-static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
1218
-{
1219
-	__u32 *ptr = (__u32 *) regs;
1220
-	unsigned int idx;
1221
-
1222
-	if (regs == NULL)
1223
-		return 0;
1224
-	idx = READ_ONCE(f->reg_idx);
1225
-	if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
1226
-		idx = 0;
1227
-	ptr += idx++;
1228
-	WRITE_ONCE(f->reg_idx, idx);
1229
-	return *ptr;
1230
-}
1231
-
1232
-void add_interrupt_randomness(int irq, int irq_flags)
1233
-{
1234
-	struct entropy_store	*r;
1235
-	struct fast_pool	*fast_pool = this_cpu_ptr(&irq_randomness);
1236
-	struct pt_regs		*regs = get_irq_regs();
1237
-	unsigned long		now = jiffies;
1238
-	cycles_t		cycles = random_get_entropy();
1239
-	__u32			c_high, j_high;
1240
-	__u64			ip;
1241
-	unsigned long		seed;
1242
-	int			credit = 0;
1243
-
1244
-	if (cycles == 0)
1245
-		cycles = get_reg(fast_pool, regs);
1246
-	c_high = (sizeof(cycles) > 4) ? cycles >> 32 : 0;
1247
-	j_high = (sizeof(now) > 4) ? now >> 32 : 0;
1248
-	fast_pool->pool[0] ^= cycles ^ j_high ^ irq;
1249
-	fast_pool->pool[1] ^= now ^ c_high;
1250
-	ip = regs ? instruction_pointer(regs) : _RET_IP_;
1251
-	fast_pool->pool[2] ^= ip;
1252
-	fast_pool->pool[3] ^= (sizeof(ip) > 4) ? ip >> 32 :
1253
-		get_reg(fast_pool, regs);
1254
-
1255
-	fast_mix(fast_pool);
1256
-	add_interrupt_bench(cycles);
1257
-
1258
-	if (unlikely(crng_init == 0)) {
1259
-		if ((fast_pool->count >= 64) &&
1260
-		    crng_fast_load((char *) fast_pool->pool,
1261
-				   sizeof(fast_pool->pool))) {
1262
-			fast_pool->count = 0;
1263
-			fast_pool->last = now;
1264
-		}
1265
-		return;
1266
-	}
1267
-
1268
-	if ((fast_pool->count < 64) &&
1269
-	    !time_after(now, fast_pool->last + HZ))
1270
-		return;
1271
-
1272
-	r = &input_pool;
1273
-	if (!spin_trylock(&r->lock))
1274
-		return;
1275
-
1276
-	fast_pool->last = now;
1277
-	__mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
1278
-
1279
-	/*
1280
-	 * If we have architectural seed generator, produce a seed and
1281
-	 * add it to the pool.  For the sake of paranoia don't let the
1282
-	 * architectural seed generator dominate the input from the
1283
-	 * interrupt noise.
1284
-	 */
1285
-	if (arch_get_random_seed_long(&seed)) {
1286
-		__mix_pool_bytes(r, &seed, sizeof(seed));
1287
-		credit = 1;
1288
-	}
1289
-	spin_unlock(&r->lock);
1290
-
1291
-	fast_pool->count = 0;
1292
-
1293
-	/* award one bit for the contents of the fast pool */
1294
-	credit_entropy_bits(r, credit + 1);
1295
-}
1296
-EXPORT_SYMBOL_GPL(add_interrupt_randomness);
12971118 
12981119 #ifdef CONFIG_BLOCK
12991120 void add_disk_randomness(struct gendisk *disk)
13001121 {
13011122 	if (!disk || !disk->random)
13021123 		return;
1303
-	/* first major is 1, so we get >= 0x200 here */
1124
+	/* First major is 1, so we get >= 0x200 here. */
13041125 	add_timer_randomness(disk->random, 0x100 + disk_devt(disk));
1305
-	trace_add_disk_randomness(disk_devt(disk), ENTROPY_BITS(&input_pool));
13061126 }
13071127 EXPORT_SYMBOL_GPL(add_disk_randomness);
1308
-#endif
13091128 
1310
-/*********************************************************************
1311
- *
1312
- * Entropy extraction routines
1313
- *
1314
- *********************************************************************/
1315
-
1316
-/*
1317
- * This function decides how many bytes to actually take from the
1318
- * given pool, and also debits the entropy count accordingly.
1319
- */
1320
-static size_t account(struct entropy_store *r, size_t nbytes, int min,
1321
-		      int reserved)
1129
+void __cold rand_initialize_disk(struct gendisk *disk)
13221130 {
1323
-	int entropy_count, orig, have_bytes;
1324
-	size_t ibytes, nfrac;
1325
-
1326
-	BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
1327
-
1328
-	/* Can we pull enough? */
1329
-retry:
1330
-	entropy_count = orig = READ_ONCE(r->entropy_count);
1331
-	ibytes = nbytes;
1332
-	/* never pull more than available */
1333
-	have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
1334
-
1335
-	if ((have_bytes -= reserved) < 0)
1336
-		have_bytes = 0;
1337
-	ibytes = min_t(size_t, ibytes, have_bytes);
1338
-	if (ibytes < min)
1339
-		ibytes = 0;
1340
-
1341
-	if (WARN_ON(entropy_count < 0)) {
1342
-		pr_warn("negative entropy count: pool %s count %d\n",
1343
-			r->name, entropy_count);
1344
-		entropy_count = 0;
1345
-	}
1346
-	nfrac = ibytes << (ENTROPY_SHIFT + 3);
1347
-	if ((size_t) entropy_count > nfrac)
1348
-		entropy_count -= nfrac;
1349
-	else
1350
-		entropy_count = 0;
1351
-
1352
-	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
1353
-		goto retry;
1354
-
1355
-	trace_debit_entropy(r->name, 8 * ibytes);
1356
-	if (ibytes && ENTROPY_BITS(r) < random_write_wakeup_bits) {
1357
-		wake_up_interruptible(&random_write_wait);
1358
-		kill_fasync(&fasync, SIGIO, POLL_OUT);
1359
-	}
1360
-
1361
-	return ibytes;
1362
-}
1363
-
1364
-/*
1365
- * This function does the actual extraction for extract_entropy and
1366
- * extract_entropy_user.
1367
- *
1368
- * Note: we assume that .poolwords is a multiple of 16 words.
1369
- */
1370
-static void extract_buf(struct entropy_store *r, __u8 *out)
1371
-{
1372
-	int i;
1373
-	union {
1374
-		__u32 w[5];
1375
-		unsigned long l[LONGS(20)];
1376
-	} hash;
1377
-	__u32 workspace[SHA_WORKSPACE_WORDS];
1378
-	unsigned long flags;
1131
+	struct timer_rand_state *state;
13791132 
13801133 	/*
1381
-	 * If we have an architectural hardware random number
1382
-	 * generator, use it for SHA's initial vector
1134
+	 * If kzalloc returns null, we just won't use that entropy
1135
+	 * source.
13831136 	 */
1384
-	sha_init(hash.w);
1385
-	for (i = 0; i < LONGS(20); i++) {
1386
-		unsigned long v;
1387
-		if (!arch_get_random_long(&v))
1388
-			break;
1389
-		hash.l[i] = v;
1137
+	state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
1138
+	if (state) {
1139
+		state->last_time = INITIAL_JIFFIES;
1140
+		disk->random = state;
13901141 	}
1391
-
1392
-	/* Generate a hash across the pool, 16 words (512 bits) at a time */
1393
-	spin_lock_irqsave(&r->lock, flags);
1394
-	for (i = 0; i < r->poolinfo->poolwords; i += 16)
1395
-		sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
1396
-
1397
-	/*
1398
-	 * We mix the hash back into the pool to prevent backtracking
1399
-	 * attacks (where the attacker knows the state of the pool
1400
-	 * plus the current outputs, and attempts to find previous
1401
-	 * ouputs), unless the hash function can be inverted. By
1402
-	 * mixing at least a SHA1 worth of hash data back, we make
1403
-	 * brute-forcing the feedback as hard as brute-forcing the
1404
-	 * hash.
1405
-	 */
1406
-	__mix_pool_bytes(r, hash.w, sizeof(hash.w));
1407
-	spin_unlock_irqrestore(&r->lock, flags);
1408
-
1409
-	memzero_explicit(workspace, sizeof(workspace));
1410
-
1411
-	/*
1412
-	 * In case the hash function has some recognizable output
1413
-	 * pattern, we fold it in half. Thus, we always feed back
1414
-	 * twice as much data as we output.
1415
-	 */
1416
-	hash.w[0] ^= hash.w[3];
1417
-	hash.w[1] ^= hash.w[4];
1418
-	hash.w[2] ^= rol32(hash.w[2], 16);
1419
-
1420
-	memcpy(out, &hash, EXTRACT_SIZE);
1421
-	memzero_explicit(&hash, sizeof(hash));
14221142 }
1423
-
1424
-static ssize_t _extract_entropy(struct entropy_store *r, void *buf,
1425
-				size_t nbytes, int fips)
1426
-{
1427
-	ssize_t ret = 0, i;
1428
-	__u8 tmp[EXTRACT_SIZE];
1429
-	unsigned long flags;
1430
-
1431
-	while (nbytes) {
1432
-		extract_buf(r, tmp);
1433
-
1434
-		if (fips) {
1435
-			spin_lock_irqsave(&r->lock, flags);
1436
-			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
1437
-				panic("Hardware RNG duplicated output!\n");
1438
-			memcpy(r->last_data, tmp, EXTRACT_SIZE);
1439
-			spin_unlock_irqrestore(&r->lock, flags);
1440
-		}
1441
-		i = min_t(int, nbytes, EXTRACT_SIZE);
1442
-		memcpy(buf, tmp, i);
1443
-		nbytes -= i;
1444
-		buf += i;
1445
-		ret += i;
1446
-	}
1447
-
1448
-	/* Wipe data just returned from memory */
1449
-	memzero_explicit(tmp, sizeof(tmp));
1450
-
1451
-	return ret;
1452
-}
1453
-
1454
-/*
1455
- * This function extracts randomness from the "entropy pool", and
1456
- * returns it in a buffer.
1457
- *
1458
- * The min parameter specifies the minimum amount we can pull before
1459
- * failing to avoid races that defeat catastrophic reseeding while the
1460
- * reserved parameter indicates how much entropy we must leave in the
1461
- * pool after each pull to avoid starving other readers.
1462
- */
1463
-static ssize_t extract_entropy(struct entropy_store *r, void *buf,
1464
-				 size_t nbytes, int min, int reserved)
1465
-{
1466
-	__u8 tmp[EXTRACT_SIZE];
1467
-	unsigned long flags;
1468
-
1469
-	/* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
1470
-	if (fips_enabled) {
1471
-		spin_lock_irqsave(&r->lock, flags);
1472
-		if (!r->last_data_init) {
1473
-			r->last_data_init = 1;
1474
-			spin_unlock_irqrestore(&r->lock, flags);
1475
-			trace_extract_entropy(r->name, EXTRACT_SIZE,
1476
-					      ENTROPY_BITS(r), _RET_IP_);
1477
-			extract_buf(r, tmp);
1478
-			spin_lock_irqsave(&r->lock, flags);
1479
-			memcpy(r->last_data, tmp, EXTRACT_SIZE);
1480
-		}
1481
-		spin_unlock_irqrestore(&r->lock, flags);
1482
-	}
1483
-
1484
-	trace_extract_entropy(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
1485
-	nbytes = account(r, nbytes, min, reserved);
1486
-
1487
-	return _extract_entropy(r, buf, nbytes, fips_enabled);
1488
-}
1489
-
1490
-#define warn_unseeded_randomness(previous) \
1491
-	_warn_unseeded_randomness(__func__, (void *) _RET_IP_, (previous))
1492
-
1493
-static void _warn_unseeded_randomness(const char *func_name, void *caller,
1494
-				      void **previous)
1495
-{
1496
-#ifdef CONFIG_WARN_ALL_UNSEEDED_RANDOM
1497
-	const bool print_once = false;
1498
-#else
1499
-	static bool print_once __read_mostly;
15001143 #endif
1501
-
1502
-	if (print_once ||
1503
-	    crng_ready() ||
1504
-	    (previous && (caller == READ_ONCE(*previous))))
1505
-		return;
1506
-	WRITE_ONCE(*previous, caller);
1507
-#ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
1508
-	print_once = true;
1509
-#endif
1510
-	if (__ratelimit(&unseeded_warning))
1511
-		pr_notice("random: %s called from %pS with crng_init=%d\n",
1512
-			  func_name, caller, crng_init);
1513
-}
1514
-
1515
-/*
1516
- * This function is the exported kernel interface.  It returns some
1517
- * number of good random numbers, suitable for key generation, seeding
1518
- * TCP sequence numbers, etc.  It does not rely on the hardware random
1519
- * number generator.  For random bytes direct from the hardware RNG
1520
- * (when available), use get_random_bytes_arch(). In order to ensure
1521
- * that the randomness provided by this function is okay, the function
1522
- * wait_for_random_bytes() should be called and return 0 at least once
1523
- * at any point prior.
1524
- */
1525
-static void _get_random_bytes(void *buf, int nbytes)
1526
-{
1527
-	__u8 tmp[CHACHA_BLOCK_SIZE] __aligned(4);
1528
-
1529
-	trace_get_random_bytes(nbytes, _RET_IP_);
1530
-
1531
-	while (nbytes >= CHACHA_BLOCK_SIZE) {
1532
-		extract_crng(buf);
1533
-		buf += CHACHA_BLOCK_SIZE;
1534
-		nbytes -= CHACHA_BLOCK_SIZE;
1535
-	}
1536
-
1537
-	if (nbytes > 0) {
1538
-		extract_crng(tmp);
1539
-		memcpy(buf, tmp, nbytes);
1540
-		crng_backtrack_protect(tmp, nbytes);
1541
-	} else
1542
-		crng_backtrack_protect(tmp, CHACHA_BLOCK_SIZE);
1543
-	memzero_explicit(tmp, sizeof(tmp));
1544
-}
1545
-
1546
-void get_random_bytes(void *buf, int nbytes)
1547
-{
1548
-	static void *previous;
1549
-
1550
-	warn_unseeded_randomness(&previous);
1551
-	_get_random_bytes(buf, nbytes);
1552
-}
1553
-EXPORT_SYMBOL(get_random_bytes);
1554
-
15551144 
15561145 /*
15571146  * Each time the timer fires, we expect that we got an unpredictable
....@@ -1566,99 +1155,401 @@
15661155  *
15671156  * So the re-arming always happens in the entropy loop itself.
15681157  */
1569
-static void entropy_timer(struct timer_list *t)
1158
+static void __cold entropy_timer(struct timer_list *t)
15701159 {
1571
-	credit_entropy_bits(&input_pool, 1);
1160
+	credit_init_bits(1);
15721161 }
15731162 
15741163 /*
15751164  * If we have an actual cycle counter, see if we can
15761165  * generate enough entropy with timing noise
15771166  */
1578
-static void try_to_generate_entropy(void)
1167
+static void __cold try_to_generate_entropy(void)
15791168 {
15801169 	struct {
1581
-		unsigned long now;
1170
+		unsigned long entropy;
15821171 		struct timer_list timer;
15831172 	} stack;
15841173 
1585
-	stack.now = random_get_entropy();
1174
+	stack.entropy = random_get_entropy();
15861175 
1587
-#ifndef CONFIG_ARCH_ROCKCHIP
15881176 	/* Slow counter - or none. Don't even bother */
1589
-	if (stack.now == random_get_entropy())
1177
+	if (stack.entropy == random_get_entropy())
15901178 		return;
1591
-#endif
15921179 
15931180 	timer_setup_on_stack(&stack.timer, entropy_timer, 0);
1594
-	while (!crng_ready()) {
1181
+	while (!crng_ready() && !signal_pending(current)) {
15951182 		if (!timer_pending(&stack.timer))
1596
-			mod_timer(&stack.timer, jiffies+1);
1597
-		mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
1183
+			mod_timer(&stack.timer, jiffies + 1);
1184
+		mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));
15981185 		schedule();
1599
-		stack.now = random_get_entropy();
1186
+		stack.entropy = random_get_entropy();
16001187 	}
16011188 
16021189 	del_timer_sync(&stack.timer);
16031190 	destroy_timer_on_stack(&stack.timer);
1604
-	mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
1191
+	mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));
16051192 }
16061193 
1607
-/*
1608
- * Wait for the urandom pool to be seeded and thus guaranteed to supply
1609
- * cryptographically secure random numbers. This applies to: the /dev/urandom
1610
- * device, the get_random_bytes function, and the get_random_{u32,u64,int,long}
1611
- * family of functions. Using any of these functions without first calling
1612
- * this function forfeits the guarantee of security.
1194
+
1195
+/**********************************************************************
16131196  *
1614
- * Returns: 0 if the urandom pool has been seeded.
1615
- *          -ERESTARTSYS if the function was interrupted by a signal.
1616
- */
1617
-int wait_for_random_bytes(void)
1197
+ * Userspace reader/writer interfaces.
1198
+ *
1199
+ * getrandom(2) is the primary modern interface into the RNG and should
1200
+ * be used in preference to anything else.
1201
+ *
1202
+ * Reading from /dev/random has the same functionality as calling
1203
+ * getrandom(2) with flags=0. In earlier versions, however, it had
1204
+ * vastly different semantics and should therefore be avoided, to
1205
+ * prevent backwards compatibility issues.
1206
+ *
1207
+ * Reading from /dev/urandom has the same functionality as calling
1208
+ * getrandom(2) with flags=GRND_INSECURE. Because it does not block
1209
+ * waiting for the RNG to be ready, it should not be used.
1210
+ *
1211
+ * Writing to either /dev/random or /dev/urandom adds entropy to
1212
+ * the input pool but does not credit it.
1213
+ *
1214
+ * Polling on /dev/random indicates when the RNG is initialized, on
1215
+ * the read side, and when it wants new entropy, on the write side.
1216
+ *
1217
+ * Both /dev/random and /dev/urandom have the same set of ioctls for
1218
+ * adding entropy, getting the entropy count, zeroing the count, and
1219
+ * reseeding the crng.
1220
+ *
1221
+ **********************************************************************/
1222
+
1223
+SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags)
16181224 {
1619
-	if (likely(crng_ready()))
1225
+	struct iov_iter iter;
1226
+	struct iovec iov;
1227
+	int ret;
1228
+
1229
+	if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE))
1230
+		return -EINVAL;
1231
+
1232
+	/*
1233
+	 * Requesting insecure and blocking randomness at the same time makes
1234
+	 * no sense.
1235
+	 */
1236
+	if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM))
1237
+		return -EINVAL;
1238
+
1239
+	if (!crng_ready() && !(flags & GRND_INSECURE)) {
1240
+		if (flags & GRND_NONBLOCK)
1241
+			return -EAGAIN;
1242
+		ret = wait_for_random_bytes();
1243
+		if (unlikely(ret))
1244
+			return ret;
1245
+	}
1246
+
1247
+	ret = import_single_range(READ, ubuf, len, &iov, &iter);
1248
+	if (unlikely(ret))
1249
+		return ret;
1250
+	return get_random_bytes_user(&iter);
1251
+}
1252
+
1253
+static __poll_t random_poll(struct file *file, poll_table *wait)
1254
+{
1255
+	poll_wait(file, &crng_init_wait, wait);
1256
+	return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM;
1257
+}
1258
+
1259
+static ssize_t write_pool_user(struct iov_iter *iter)
1260
+{
1261
+	u8 block[BLAKE2S_BLOCK_SIZE];
1262
+	ssize_t ret = 0;
1263
+	size_t copied;
1264
+
1265
+	if (unlikely(!iov_iter_count(iter)))
16201266 		return 0;
16211267 
1622
-#ifdef CONFIG_ARCH_ROCKCHIP
1623
-	try_to_generate_entropy();
1624
-#endif
1268
+	for (;;) {
1269
+		copied = copy_from_iter(block, sizeof(block), iter);
1270
+		ret += copied;
1271
+		mix_pool_bytes(block, copied);
1272
+		if (!iov_iter_count(iter) || copied != sizeof(block))
1273
+			break;
16251274 
1626
-	do {
1627
-		int ret;
1628
-		ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
1629
-		if (ret)
1630
-			return ret > 0 ? 0 : ret;
1275
+		BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0);
1276
+		if (ret % PAGE_SIZE == 0) {
1277
+			if (signal_pending(current))
1278
+				break;
1279
+			cond_resched();
1280
+		}
1281
+	}
16311282 
1632
-		try_to_generate_entropy();
1633
-	} while (!crng_ready());
1634
-
1635
-	return 0;
1283
+	memzero_explicit(block, sizeof(block));
1284
+	return ret ? ret : -EFAULT;
16361285 }
1637
-EXPORT_SYMBOL(wait_for_random_bytes);
16381286 
1639
-/*
1640
- * Returns whether or not the urandom pool has been seeded and thus guaranteed
1641
- * to supply cryptographically secure random numbers. This applies to: the
1642
- * /dev/urandom device, the get_random_bytes function, and the get_random_{u32,
1643
- * ,u64,int,long} family of functions.
1644
- *
1645
- * Returns: true if the urandom pool has been seeded.
1646
- *          false if the urandom pool has not been seeded.
1647
- */
1648
-bool rng_is_initialized(void)
1287
+static ssize_t random_write_iter(struct kiocb *kiocb, struct iov_iter *iter)
16491288 {
1650
-	return crng_ready();
1289
+	return write_pool_user(iter);
16511290 }
1652
-EXPORT_SYMBOL(rng_is_initialized);
1291
+
1292
+static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
1293
+{
1294
+	static int maxwarn = 10;
1295
+
1296
+	if (!crng_ready()) {
1297
+		if (!ratelimit_disable && maxwarn <= 0)
1298
+			++urandom_warning.missed;
1299
+		else if (ratelimit_disable || __ratelimit(&urandom_warning)) {
1300
+			--maxwarn;
1301
+			pr_notice("%s: uninitialized urandom read (%zu bytes read)\n",
1302
+				  current->comm, iov_iter_count(iter));
1303
+		}
1304
+	}
1305
+
1306
+	return get_random_bytes_user(iter);
1307
+}
1308
+
1309
+static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
1310
+{
1311
+	int ret;
1312
+
1313
+	if (!crng_ready() &&
1314
+	    ((kiocb->ki_flags & (IOCB_NOWAIT | IOCB_NOIO)) ||
1315
+	     (kiocb->ki_filp->f_flags & O_NONBLOCK)))
1316
+		return -EAGAIN;
1317
+
1318
+	ret = wait_for_random_bytes();
1319
+	if (ret != 0)
1320
+		return ret;
1321
+	return get_random_bytes_user(iter);
1322
+}
1323
+
1324
+static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
1325
+{
1326
+	int __user *p = (int __user *)arg;
1327
+	int ent_count;
1328
+
1329
+	switch (cmd) {
1330
+	case RNDGETENTCNT:
1331
+		/* Inherently racy, no point locking. */
1332
+		if (put_user(input_pool.init_bits, p))
1333
+			return -EFAULT;
1334
+		return 0;
1335
+	case RNDADDTOENTCNT:
1336
+		if (!capable(CAP_SYS_ADMIN))
1337
+			return -EPERM;
1338
+		if (get_user(ent_count, p))
1339
+			return -EFAULT;
1340
+		if (ent_count < 0)
1341
+			return -EINVAL;
1342
+		credit_init_bits(ent_count);
1343
+		return 0;
1344
+	case RNDADDENTROPY: {
1345
+		struct iov_iter iter;
1346
+		struct iovec iov;
1347
+		ssize_t ret;
1348
+		int len;
1349
+
1350
+		if (!capable(CAP_SYS_ADMIN))
1351
+			return -EPERM;
1352
+		if (get_user(ent_count, p++))
1353
+			return -EFAULT;
1354
+		if (ent_count < 0)
1355
+			return -EINVAL;
1356
+		if (get_user(len, p++))
1357
+			return -EFAULT;
1358
+		ret = import_single_range(WRITE, p, len, &iov, &iter);
1359
+		if (unlikely(ret))
1360
+			return ret;
1361
+		ret = write_pool_user(&iter);
1362
+		if (unlikely(ret < 0))
1363
+			return ret;
1364
+		/* Since we're crediting, enforce that it was all written into the pool. */
1365
+		if (unlikely(ret != len))
1366
+			return -EFAULT;
1367
+		credit_init_bits(ent_count);
1368
+		return 0;
1369
+	}
1370
+	case RNDZAPENTCNT:
1371
+	case RNDCLEARPOOL:
1372
+		/* No longer has any effect. */
1373
+		if (!capable(CAP_SYS_ADMIN))
1374
+			return -EPERM;
1375
+		return 0;
1376
+	case RNDRESEEDCRNG:
1377
+		if (!capable(CAP_SYS_ADMIN))
1378
+			return -EPERM;
1379
+		if (!crng_ready())
1380
+			return -ENODATA;
1381
+		crng_reseed();
1382
+		return 0;
1383
+	default:
1384
+		return -EINVAL;
1385
+	}
1386
+}
1387
+
1388
+static int random_fasync(int fd, struct file *filp, int on)
1389
+{
1390
+	return fasync_helper(fd, filp, on, &fasync);
1391
+}
1392
+
1393
+const struct file_operations random_fops = {
1394
+	.read_iter = random_read_iter,
1395
+	.write_iter = random_write_iter,
1396
+	.poll = random_poll,
1397
+	.unlocked_ioctl = random_ioctl,
1398
+	.compat_ioctl = compat_ptr_ioctl,
1399
+	.fasync = random_fasync,
1400
+	.llseek = noop_llseek,
1401
+	.splice_read = generic_file_splice_read,
1402
+	.splice_write = iter_file_splice_write,
1403
+};
1404
+
1405
+const struct file_operations urandom_fops = {
1406
+	.read_iter = urandom_read_iter,
1407
+	.write_iter = random_write_iter,
1408
+	.unlocked_ioctl = random_ioctl,
1409
+	.compat_ioctl = compat_ptr_ioctl,
1410
+	.fasync = random_fasync,
1411
+	.llseek = noop_llseek,
1412
+	.splice_read = generic_file_splice_read,
1413
+	.splice_write = iter_file_splice_write,
1414
+};
1415
+
1416
+
1417
+/********************************************************************
1418
+ *
1419
+ * Sysctl interface.
1420
+ *
1421
+ * These are partly unused legacy knobs with dummy values to not break
1422
+ * userspace and partly still useful things. They are usually accessible
1423
+ * in /proc/sys/kernel/random/ and are as follows:
1424
+ *
1425
+ * - boot_id - a UUID representing the current boot.
1426
+ *
1427
+ * - uuid - a random UUID, different each time the file is read.
1428
+ *
1429
+ * - poolsize - the number of bits of entropy that the input pool can
1430
+ *   hold, tied to the POOL_BITS constant.
1431
+ *
1432
+ * - entropy_avail - the number of bits of entropy currently in the
1433
+ *   input pool. Always <= poolsize.
1434
+ *
1435
+ * - write_wakeup_threshold - the amount of entropy in the input pool
1436
+ *   below which write polls to /dev/random will unblock, requesting
1437
+ *   more entropy, tied to the POOL_READY_BITS constant. It is writable
1438
+ *   to avoid breaking old userspaces, but writing to it does not
1439
+ *   change any behavior of the RNG.
1440
+ *
1441
+ * - urandom_min_reseed_secs - fixed to the value CRNG_RESEED_INTERVAL.
1442
+ *   It is writable to avoid breaking old userspaces, but writing
1443
+ *   to it does not change any behavior of the RNG.
1444
+ *
1445
+ ********************************************************************/
1446
+
1447
+#ifdef CONFIG_SYSCTL
1448
+
1449
+#include <linux/sysctl.h>
1450
+
1451
+static int sysctl_random_min_urandom_seed = CRNG_RESEED_INTERVAL / HZ;
1452
+static int sysctl_random_write_wakeup_bits = POOL_READY_BITS;
1453
+static int sysctl_poolsize = POOL_BITS;
1454
+static u8 sysctl_bootid[UUID_SIZE];
16531455 
16541456 /*
1655
- * Add a callback function that will be invoked when the nonblocking
1656
- * pool is initialised.
1657
- *
1658
- * returns: 0 if callback is successfully added
1659
- *	    -EALREADY if pool is already initialised (callback not called)
1660
- *	    -ENOENT if module for callback is not alive
1457
+ * This function is used to return both the bootid UUID, and random
1458
+ * UUID. The difference is in whether table->data is NULL; if it is,
1459
+ * then a new UUID is generated and returned to the user.
16611460  */
1461
+static int proc_do_uuid(struct ctl_table *table, int write, void *buf,
1462
+			size_t *lenp, loff_t *ppos)
1463
+{
1464
+	u8 tmp_uuid[UUID_SIZE], *uuid;
1465
+	char uuid_string[UUID_STRING_LEN + 1];
1466
+	struct ctl_table fake_table = {
1467
+		.data = uuid_string,
1468
+		.maxlen = UUID_STRING_LEN
1469
+	};
1470
+
1471
+	if (write)
1472
+		return -EPERM;
1473
+
1474
+	uuid = table->data;
1475
+	if (!uuid) {
1476
+		uuid = tmp_uuid;
1477
+		generate_random_uuid(uuid);
1478
+	} else {
1479
+		static DEFINE_SPINLOCK(bootid_spinlock);
1480
+
1481
+		spin_lock(&bootid_spinlock);
1482
+		if (!uuid[8])
1483
+			generate_random_uuid(uuid);
1484
+		spin_unlock(&bootid_spinlock);
1485
+	}
1486
+
1487
+	snprintf(uuid_string, sizeof(uuid_string), "%pU", uuid);
1488
+	return proc_dostring(&fake_table, 0, buf, lenp, ppos);
1489
+}
1490
+
1491
+/* The same as proc_dointvec, but writes don't change anything. */
1492
+static int proc_do_rointvec(struct ctl_table *table, int write, void *buf,
1493
+			    size_t *lenp, loff_t *ppos)
1494
+{
1495
+	return write ? 0 : proc_dointvec(table, 0, buf, lenp, ppos);
1496
+}
1497
+
1498
+extern struct ctl_table random_table[];
1499
+struct ctl_table random_table[] = {
1500
+	{
1501
+		.procname	= "poolsize",
1502
+		.data		= &sysctl_poolsize,
1503
+		.maxlen		= sizeof(int),
1504
+		.mode		= 0444,
1505
+		.proc_handler	= proc_dointvec,
1506
+	},
1507
+	{
1508
+		.procname	= "entropy_avail",
1509
+		.data		= &input_pool.init_bits,
1510
+		.maxlen		= sizeof(int),
1511
+		.mode		= 0444,
1512
+		.proc_handler	= proc_dointvec,
1513
+	},
1514
+	{
1515
+		.procname	= "write_wakeup_threshold",
1516
+		.data		= &sysctl_random_write_wakeup_bits,
1517
+		.maxlen		= sizeof(int),
1518
+		.mode		= 0644,
1519
+		.proc_handler	= proc_do_rointvec,
1520
+	},
1521
+	{
1522
+		.procname	= "urandom_min_reseed_secs",
1523
+		.data		= &sysctl_random_min_urandom_seed,
1524
+		.maxlen		= sizeof(int),
1525
+		.mode		= 0644,
1526
+		.proc_handler	= proc_do_rointvec,
1527
+	},
1528
+	{
1529
+		.procname	= "boot_id",
1530
+		.data		= &sysctl_bootid,
1531
+		.mode		= 0444,
1532
+		.proc_handler	= proc_do_uuid,
1533
+	},
1534
+	{
1535
+		.procname	= "uuid",
1536
+		.mode		= 0444,
1537
+		.proc_handler	= proc_do_uuid,
1538
+	},
1539
+	{ }
1540
+};
1541
+#endif	/* CONFIG_SYSCTL */
1542
+
1543
+/*
1544
+ * Android KABI fixups
1545
+ *
1546
+ * Add back two functions that were being used by out-of-tree drivers.
1547
+ *
1548
+ * Yes, horrible hack, the things we do for FIPS "compliance"...
1549
+ */
1550
+static DEFINE_SPINLOCK(random_ready_list_lock);
1551
+static LIST_HEAD(random_ready_list);
1552
+
16621553 int add_random_ready_callback(struct random_ready_callback *rdy)
16631554 {
16641555 	struct module *owner;
....@@ -1690,9 +1581,6 @@
16901581 }
16911582 EXPORT_SYMBOL(add_random_ready_callback);
16921583 
1693
-/*
1694
- * Delete a previously registered readiness callback function.
1695
- */
16961584 void del_random_ready_callback(struct random_ready_callback *rdy)
16971585 {
16981586 	unsigned long flags;
....@@ -1709,601 +1597,18 @@
17091597 }
17101598 EXPORT_SYMBOL(del_random_ready_callback);
17111599 
1712
-/*
1713
- * This function will use the architecture-specific hardware random
1714
- * number generator if it is available.  The arch-specific hw RNG will
1715
- * almost certainly be faster than what we can do in software, but it
1716
- * is impossible to verify that it is implemented securely (as
1717
- * opposed, to, say, the AES encryption of a sequence number using a
1718
- * key known by the NSA).  So it's useful if we need the speed, but
1719
- * only if we're willing to trust the hardware manufacturer not to
1720
- * have put in a back door.
1721
- *
1722
- * Return number of bytes filled in.
1723
- */
1724
-int __must_check get_random_bytes_arch(void *buf, int nbytes)
1725
-{
1726
-	int left = nbytes;
1727
-	char *p = buf;
1728
-
1729
-	trace_get_random_bytes_arch(left, _RET_IP_);
1730
-	while (left) {
1731
-		unsigned long v;
1732
-		int chunk = min_t(int, left, sizeof(unsigned long));
1733
-
1734
-		if (!arch_get_random_long(&v))
1735
-			break;
1736
-
1737
-		memcpy(p, &v, chunk);
1738
-		p += chunk;
1739
-		left -= chunk;
1740
-	}
1741
-
1742
-	return nbytes - left;
1743
-}
1744
-EXPORT_SYMBOL(get_random_bytes_arch);
1745
-
1746
-/*
1747
- * init_std_data - initialize pool with system data
1748
- *
1749
- * @r: pool to initialize
1750
- *
1751
- * This function clears the pool's entropy count and mixes some system
1752
- * data into the pool to prepare it for use. The pool is not cleared
1753
- * as that can only decrease the entropy in the pool.
1754
- */
1755
-static void __init init_std_data(struct entropy_store *r)
1756
-{
1757
-	int i;
1758
-	ktime_t now = ktime_get_real();
1759
-	unsigned long rv;
1760
-
1761
-	mix_pool_bytes(r, &now, sizeof(now));
1762
-	for (i = r->poolinfo->poolbytes; i > 0; i -= sizeof(rv)) {
1763
-		if (!arch_get_random_seed_long(&rv) &&
1764
-		    !arch_get_random_long(&rv))
1765
-			rv = random_get_entropy();
1766
-		mix_pool_bytes(r, &rv, sizeof(rv));
1767
-	}
1768
-	mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
1769
-}
1770
-
1771
-/*
1772
- * Note that setup_arch() may call add_device_randomness()
1773
- * long before we get here. This allows seeding of the pools
1774
- * with some platform dependent data very early in the boot
1775
- * process. But it limits our options here. We must use
1776
- * statically allocated structures that already have all
1777
- * initializations complete at compile time. We should also
1778
- * take care not to overwrite the precious per platform data
1779
- * we were given.
1780
- */
1781
-int __init rand_initialize(void)
1782
-{
1783
-	init_std_data(&input_pool);
1784
-	crng_initialize(&primary_crng);
1785
-	crng_global_init_time = jiffies;
1786
-	if (ratelimit_disable) {
1787
-		urandom_warning.interval = 0;
1788
-		unseeded_warning.interval = 0;
1789
-	}
1790
-	return 0;
1791
-}
1792
-
1793
-#ifdef CONFIG_BLOCK
1794
-void rand_initialize_disk(struct gendisk *disk)
1795
-{
1796
-	struct timer_rand_state *state;
1797
-
1798
-	/*
1799
-	 * If kzalloc returns null, we just won't use that entropy
1800
-	 * source.
1801
-	 */
1802
-	state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
1803
-	if (state) {
1804
-		state->last_time = INITIAL_JIFFIES;
1805
-		disk->random = state;
1806
-	}
1807
-}
1808
-#endif
1809
-
1810
-static ssize_t
1811
-urandom_read_nowarn(struct file *file, char __user *buf, size_t nbytes,
1812
-		    loff_t *ppos)
1813
-{
1814
-	int ret;
1815
-
1816
-	nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
1817
-	ret = extract_crng_user(buf, nbytes);
1818
-	trace_urandom_read(8 * nbytes, 0, ENTROPY_BITS(&input_pool));
1819
-	return ret;
1820
-}
1821
-
1822
-static ssize_t
1823
-urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1600
+static void process_oldschool_random_ready_list(void)
18241601 {
18251602 	unsigned long flags;
1826
-	static int maxwarn = 10;
1603
+	struct random_ready_callback *rdy, *tmp;
18271604 
1828
-	if (!crng_ready() && maxwarn > 0) {
1829
-		maxwarn--;
1830
-		if (__ratelimit(&urandom_warning))
1831
-			pr_notice("%s: uninitialized urandom read (%zd bytes read)\n",
1832
-				  current->comm, nbytes);
1833
-		spin_lock_irqsave(&primary_crng.lock, flags);
1834
-		crng_init_cnt = 0;
1835
-		spin_unlock_irqrestore(&primary_crng.lock, flags);
1605
+	spin_lock_irqsave(&random_ready_list_lock, flags);
1606
+	list_for_each_entry_safe(rdy, tmp, &random_ready_list, list) {
1607
+		struct module *owner = rdy->owner;
1608
+
1609
+		list_del_init(&rdy->list);
1610
+		rdy->func(rdy);
1611
+		module_put(owner);
18361612 	}
1837
-
1838
-	return urandom_read_nowarn(file, buf, nbytes, ppos);
1613
+	spin_unlock_irqrestore(&random_ready_list_lock, flags);
18391614 }
1840
-
1841
-static ssize_t
1842
-random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1843
-{
1844
-	int ret;
1845
-
1846
-	ret = wait_for_random_bytes();
1847
-	if (ret != 0)
1848
-		return ret;
1849
-	return urandom_read_nowarn(file, buf, nbytes, ppos);
1850
-}
1851
-
1852
-static __poll_t
1853
-random_poll(struct file *file, poll_table * wait)
1854
-{
1855
-	__poll_t mask;
1856
-
1857
-	poll_wait(file, &crng_init_wait, wait);
1858
-	poll_wait(file, &random_write_wait, wait);
1859
-	mask = 0;
1860
-	if (crng_ready())
1861
-		mask |= EPOLLIN | EPOLLRDNORM;
1862
-	if (ENTROPY_BITS(&input_pool) < random_write_wakeup_bits)
1863
-		mask |= EPOLLOUT | EPOLLWRNORM;
1864
-	return mask;
1865
-}
1866
-
1867
-static int
1868
-write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
1869
-{
1870
-	size_t bytes;
1871
-	__u32 t, buf[16];
1872
-	const char __user *p = buffer;
1873
-
1874
-	while (count > 0) {
1875
-		int b, i = 0;
1876
-
1877
-		bytes = min(count, sizeof(buf));
1878
-		if (copy_from_user(&buf, p, bytes))
1879
-			return -EFAULT;
1880
-
1881
-		for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
1882
-			if (!arch_get_random_int(&t))
1883
-				break;
1884
-			buf[i] ^= t;
1885
-		}
1886
-
1887
-		count -= bytes;
1888
-		p += bytes;
1889
-
1890
-		mix_pool_bytes(r, buf, bytes);
1891
-		cond_resched();
1892
-	}
1893
-
1894
-	return 0;
1895
-}
1896
-
1897
-static ssize_t random_write(struct file *file, const char __user *buffer,
1898
-			    size_t count, loff_t *ppos)
1899
-{
1900
-	size_t ret;
1901
-
1902
-	ret = write_pool(&input_pool, buffer, count);
1903
-	if (ret)
1904
-		return ret;
1905
-
1906
-	return (ssize_t)count;
1907
-}
1908
-
1909
-static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
1910
-{
1911
-	int size, ent_count;
1912
-	int __user *p = (int __user *)arg;
1913
-	int retval;
1914
-
1915
-	switch (cmd) {
1916
-	case RNDGETENTCNT:
1917
-		/* inherently racy, no point locking */
1918
-		ent_count = ENTROPY_BITS(&input_pool);
1919
-		if (put_user(ent_count, p))
1920
-			return -EFAULT;
1921
-		return 0;
1922
-	case RNDADDTOENTCNT:
1923
-		if (!capable(CAP_SYS_ADMIN))
1924
-			return -EPERM;
1925
-		if (get_user(ent_count, p))
1926
-			return -EFAULT;
1927
-		return credit_entropy_bits_safe(&input_pool, ent_count);
1928
-	case RNDADDENTROPY:
1929
-		if (!capable(CAP_SYS_ADMIN))
1930
-			return -EPERM;
1931
-		if (get_user(ent_count, p++))
1932
-			return -EFAULT;
1933
-		if (ent_count < 0)
1934
-			return -EINVAL;
1935
-		if (get_user(size, p++))
1936
-			return -EFAULT;
1937
-		retval = write_pool(&input_pool, (const char __user *)p,
1938
-				    size);
1939
-		if (retval < 0)
1940
-			return retval;
1941
-		return credit_entropy_bits_safe(&input_pool, ent_count);
1942
-	case RNDZAPENTCNT:
1943
-	case RNDCLEARPOOL:
1944
-		/*
1945
-		 * Clear the entropy pool counters. We no longer clear
1946
-		 * the entropy pool, as that's silly.
1947
-		 */
1948
-		if (!capable(CAP_SYS_ADMIN))
1949
-			return -EPERM;
1950
-		input_pool.entropy_count = 0;
1951
-		return 0;
1952
-	case RNDRESEEDCRNG:
1953
-		if (!capable(CAP_SYS_ADMIN))
1954
-			return -EPERM;
1955
-		if (crng_init < 2)
1956
-			return -ENODATA;
1957
-		crng_reseed(&primary_crng, &input_pool);
1958
-		WRITE_ONCE(crng_global_init_time, jiffies - 1);
1959
-		return 0;
1960
-	default:
1961
-		return -EINVAL;
1962
-	}
1963
-}
1964
-
1965
-static int random_fasync(int fd, struct file *filp, int on)
1966
-{
1967
-	return fasync_helper(fd, filp, on, &fasync);
1968
-}
1969
-
1970
-const struct file_operations random_fops = {
1971
-	.read  = random_read,
1972
-	.write = random_write,
1973
-	.poll  = random_poll,
1974
-	.unlocked_ioctl = random_ioctl,
1975
-	.fasync = random_fasync,
1976
-	.llseek = noop_llseek,
1977
-};
1978
-
1979
-const struct file_operations urandom_fops = {
1980
-	.read  = urandom_read,
1981
-	.write = random_write,
1982
-	.unlocked_ioctl = random_ioctl,
1983
-	.fasync = random_fasync,
1984
-	.llseek = noop_llseek,
1985
-};
1986
-
1987
-SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
1988
-		unsigned int, flags)
1989
-{
1990
-	int ret;
1991
-
1992
-	if (flags & ~(GRND_NONBLOCK|GRND_RANDOM|GRND_INSECURE))
1993
-		return -EINVAL;
1994
-
1995
-	/*
1996
-	 * Requesting insecure and blocking randomness at the same time makes
1997
-	 * no sense.
1998
-	 */
1999
-	if ((flags & (GRND_INSECURE|GRND_RANDOM)) == (GRND_INSECURE|GRND_RANDOM))
2000
-		return -EINVAL;
2001
-
2002
-	if (count > INT_MAX)
2003
-		count = INT_MAX;
2004
-
2005
-	if (!(flags & GRND_INSECURE) && !crng_ready()) {
2006
-		if (flags & GRND_NONBLOCK)
2007
-			return -EAGAIN;
2008
-		ret = wait_for_random_bytes();
2009
-		if (unlikely(ret))
2010
-			return ret;
2011
-	}
2012
-	return urandom_read_nowarn(NULL, buf, count, NULL);
2013
-}
2014
-
2015
-/********************************************************************
2016
- *
2017
- * Sysctl interface
2018
- *
2019
- ********************************************************************/
2020
-
2021
-#ifdef CONFIG_SYSCTL
2022
-
2023
-#include <linux/sysctl.h>
2024
-
2025
-static int min_write_thresh;
2026
-static int max_write_thresh = INPUT_POOL_WORDS * 32;
2027
-static int random_min_urandom_seed = 60;
2028
-static char sysctl_bootid[16];
2029
-
2030
-/*
2031
- * This function is used to return both the bootid UUID, and random
2032
- * UUID.  The difference is in whether table->data is NULL; if it is,
2033
- * then a new UUID is generated and returned to the user.
2034
- *
2035
- * If the user accesses this via the proc interface, the UUID will be
2036
- * returned as an ASCII string in the standard UUID format; if via the
2037
- * sysctl system call, as 16 bytes of binary data.
2038
- */
2039
-static int proc_do_uuid(struct ctl_table *table, int write,
2040
-			void __user *buffer, size_t *lenp, loff_t *ppos)
2041
-{
2042
-	struct ctl_table fake_table;
2043
-	unsigned char buf[64], tmp_uuid[16], *uuid;
2044
-
2045
-	uuid = table->data;
2046
-	if (!uuid) {
2047
-		uuid = tmp_uuid;
2048
-		generate_random_uuid(uuid);
2049
-	} else {
2050
-		static DEFINE_SPINLOCK(bootid_spinlock);
2051
-
2052
-		spin_lock(&bootid_spinlock);
2053
-		if (!uuid[8])
2054
-			generate_random_uuid(uuid);
2055
-		spin_unlock(&bootid_spinlock);
2056
-	}
2057
-
2058
-	sprintf(buf, "%pU", uuid);
2059
-
2060
-	fake_table.data = buf;
2061
-	fake_table.maxlen = sizeof(buf);
2062
-
2063
-	return proc_dostring(&fake_table, write, buffer, lenp, ppos);
2064
-}
2065
-
2066
-/*
2067
- * Return entropy available scaled to integral bits
2068
- */
2069
-static int proc_do_entropy(struct ctl_table *table, int write,
2070
-			   void __user *buffer, size_t *lenp, loff_t *ppos)
2071
-{
2072
-	struct ctl_table fake_table;
2073
-	int entropy_count;
2074
-
2075
-	entropy_count = *(int *)table->data >> ENTROPY_SHIFT;
2076
-
2077
-	fake_table.data = &entropy_count;
2078
-	fake_table.maxlen = sizeof(entropy_count);
2079
-
2080
-	return proc_dointvec(&fake_table, write, buffer, lenp, ppos);
2081
-}
2082
-
2083
-static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
2084
-extern struct ctl_table random_table[];
2085
-struct ctl_table random_table[] = {
2086
-	{
2087
-		.procname	= "poolsize",
2088
-		.data		= &sysctl_poolsize,
2089
-		.maxlen		= sizeof(int),
2090
-		.mode		= 0444,
2091
-		.proc_handler	= proc_dointvec,
2092
-	},
2093
-	{
2094
-		.procname	= "entropy_avail",
2095
-		.maxlen		= sizeof(int),
2096
-		.mode		= 0444,
2097
-		.proc_handler	= proc_do_entropy,
2098
-		.data		= &input_pool.entropy_count,
2099
-	},
2100
-	{
2101
-		.procname	= "write_wakeup_threshold",
2102
-		.data		= &random_write_wakeup_bits,
2103
-		.maxlen		= sizeof(int),
2104
-		.mode		= 0644,
2105
-		.proc_handler	= proc_dointvec_minmax,
2106
-		.extra1		= &min_write_thresh,
2107
-		.extra2		= &max_write_thresh,
2108
-	},
2109
-	{
2110
-		.procname	= "urandom_min_reseed_secs",
2111
-		.data		= &random_min_urandom_seed,
2112
-		.maxlen		= sizeof(int),
2113
-		.mode		= 0644,
2114
-		.proc_handler	= proc_dointvec,
2115
-	},
2116
-	{
2117
-		.procname	= "boot_id",
2118
-		.data		= &sysctl_bootid,
2119
-		.maxlen		= 16,
2120
-		.mode		= 0444,
2121
-		.proc_handler	= proc_do_uuid,
2122
-	},
2123
-	{
2124
-		.procname	= "uuid",
2125
-		.maxlen		= 16,
2126
-		.mode		= 0444,
2127
-		.proc_handler	= proc_do_uuid,
2128
-	},
2129
-#ifdef ADD_INTERRUPT_BENCH
2130
-	{
2131
-		.procname	= "add_interrupt_avg_cycles",
2132
-		.data		= &avg_cycles,
2133
-		.maxlen		= sizeof(avg_cycles),
2134
-		.mode		= 0444,
2135
-		.proc_handler	= proc_doulongvec_minmax,
2136
-	},
2137
-	{
2138
-		.procname	= "add_interrupt_avg_deviation",
2139
-		.data		= &avg_deviation,
2140
-		.maxlen		= sizeof(avg_deviation),
2141
-		.mode		= 0444,
2142
-		.proc_handler	= proc_doulongvec_minmax,
2143
-	},
2144
-#endif
2145
-	{ }
2146
-};
2147
-#endif 	/* CONFIG_SYSCTL */
2148
-
2149
-struct batched_entropy {
2150
-	union {
2151
-		u64 entropy_u64[CHACHA_BLOCK_SIZE / sizeof(u64)];
2152
-		u32 entropy_u32[CHACHA_BLOCK_SIZE / sizeof(u32)];
2153
-	};
2154
-	unsigned int position;
2155
-	spinlock_t batch_lock;
2156
-};
2157
-
2158
-/*
2159
- * Get a random word for internal kernel use only. The quality of the random
2160
- * number is good as /dev/urandom, but there is no backtrack protection, with
2161
- * the goal of being quite fast and not depleting entropy. In order to ensure
2162
- * that the randomness provided by this function is okay, the function
2163
- * wait_for_random_bytes() should be called and return 0 at least once at any
2164
- * point prior.
2165
- */
2166
-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = {
2167
-	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u64.lock),
2168
-};
2169
-
2170
-u64 get_random_u64(void)
2171
-{
2172
-	u64 ret;
2173
-	unsigned long flags;
2174
-	struct batched_entropy *batch;
2175
-	static void *previous;
2176
-
2177
-	warn_unseeded_randomness(&previous);
2178
-
2179
-	batch = raw_cpu_ptr(&batched_entropy_u64);
2180
-	spin_lock_irqsave(&batch->batch_lock, flags);
2181
-	if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
2182
-		extract_crng((u8 *)batch->entropy_u64);
2183
-		batch->position = 0;
2184
-	}
2185
-	ret = batch->entropy_u64[batch->position++];
2186
-	spin_unlock_irqrestore(&batch->batch_lock, flags);
2187
-	return ret;
2188
-}
2189
-EXPORT_SYMBOL(get_random_u64);
2190
-
2191
-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32) = {
2192
-	.batch_lock	= __SPIN_LOCK_UNLOCKED(batched_entropy_u32.lock),
2193
-};
2194
-u32 get_random_u32(void)
2195
-{
2196
-	u32 ret;
2197
-	unsigned long flags;
2198
-	struct batched_entropy *batch;
2199
-	static void *previous;
2200
-
2201
-	warn_unseeded_randomness(&previous);
2202
-
2203
-	batch = raw_cpu_ptr(&batched_entropy_u32);
2204
-	spin_lock_irqsave(&batch->batch_lock, flags);
2205
-	if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
2206
-		extract_crng((u8 *)batch->entropy_u32);
2207
-		batch->position = 0;
2208
-	}
2209
-	ret = batch->entropy_u32[batch->position++];
2210
-	spin_unlock_irqrestore(&batch->batch_lock, flags);
2211
-	return ret;
2212
-}
2213
-EXPORT_SYMBOL(get_random_u32);
2214
-
2215
-/* It's important to invalidate all potential batched entropy that might
2216
- * be stored before the crng is initialized, which we can do lazily by
2217
- * simply resetting the counter to zero so that it's re-extracted on the
2218
- * next usage. */
2219
-static void invalidate_batched_entropy(void)
2220
-{
2221
-	int cpu;
2222
-	unsigned long flags;
2223
-
2224
-	for_each_possible_cpu (cpu) {
2225
-		struct batched_entropy *batched_entropy;
2226
-
2227
-		batched_entropy = per_cpu_ptr(&batched_entropy_u32, cpu);
2228
-		spin_lock_irqsave(&batched_entropy->batch_lock, flags);
2229
-		batched_entropy->position = 0;
2230
-		spin_unlock(&batched_entropy->batch_lock);
2231
-
2232
-		batched_entropy = per_cpu_ptr(&batched_entropy_u64, cpu);
2233
-		spin_lock(&batched_entropy->batch_lock);
2234
-		batched_entropy->position = 0;
2235
-		spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
2236
-	}
2237
-}
2238
-
2239
-/**
2240
- * randomize_page - Generate a random, page aligned address
2241
- * @start:	The smallest acceptable address the caller will take.
2242
- * @range:	The size of the area, starting at @start, within which the
2243
- *		random address must fall.
2244
- *
2245
- * If @start + @range would overflow, @range is capped.
2246
- *
2247
- * NOTE: Historical use of randomize_range, which this replaces, presumed that
2248
- * @start was already page aligned.  We now align it regardless.
2249
- *
2250
- * Return: A page aligned address within [start, start + range).  On error,
2251
- * @start is returned.
2252
- */
2253
-unsigned long
2254
-randomize_page(unsigned long start, unsigned long range)
2255
-{
2256
-	if (!PAGE_ALIGNED(start)) {
2257
-		range -= PAGE_ALIGN(start) - start;
2258
-		start = PAGE_ALIGN(start);
2259
-	}
2260
-
2261
-	if (start > ULONG_MAX - range)
2262
-		range = ULONG_MAX - start;
2263
-
2264
-	range >>= PAGE_SHIFT;
2265
-
2266
-	if (range == 0)
2267
-		return start;
2268
-
2269
-	return start + (get_random_long() % range << PAGE_SHIFT);
2270
-}
2271
-
2272
-/* Interface for in-kernel drivers of true hardware RNGs.
2273
- * Those devices may produce endless random bits and will be throttled
2274
- * when our pool is full.
2275
- */
2276
-void add_hwgenerator_randomness(const char *buffer, size_t count,
2277
-				size_t entropy)
2278
-{
2279
-	struct entropy_store *poolp = &input_pool;
2280
-
2281
-	if (unlikely(crng_init == 0)) {
2282
-		crng_fast_load(buffer, count);
2283
-		return;
2284
-	}
2285
-
2286
-	/* Suspend writing if we're above the trickle threshold.
2287
-	 * We'll be woken up again once below random_write_wakeup_thresh,
2288
-	 * or when the calling thread is about to terminate.
2289
-	 */
2290
-	wait_event_interruptible(random_write_wait, kthread_should_stop() ||
2291
-			ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
2292
-	mix_pool_bytes(poolp, buffer, count);
2293
-	credit_entropy_bits(poolp, entropy);
2294
-}
2295
-EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
2296
-
2297
-/* Handle random seed passed by bootloader.
2298
- * If the seed is trustworthy, it would be regarded as hardware RNGs. Otherwise
2299
- * it would be regarded as device data.
2300
- * The decision is controlled by CONFIG_RANDOM_TRUST_BOOTLOADER.
2301
- */
2302
-void add_bootloader_randomness(const void *buf, unsigned int size)
2303
-{
2304
-	if (IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER))
2305
-		add_hwgenerator_randomness(buf, size, size * 8);
2306
-	else
2307
-		add_device_randomness(buf, size);
2308
-}
2309
-EXPORT_SYMBOL_GPL(add_bootloader_randomness);