From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>,
Praveen Shetty <praveen.shetty@intel.com>,
Vladimir Medvedkin <vladimir.medvedkin@intel.com>,
Bruce Richardson <bruce.richardson@intel.com>,
Anatoly Burakov <anatoly.burakov@intel.com>,
Jingjing Wu <jingjing.wu@intel.com>
Subject: [PATCH 11/18] net/intel: use secure random for default RSS key
Date: Tue, 15 Sep 2026 12:21:09 -0700 [thread overview]
Message-ID: <20260915192207.3926217-12-stephen@networkplumber.org> (raw)
In-Reply-To: <20260915192207.3926217-1-stephen@networkplumber.org>
When the application does not supply an RSS key, these drivers built
the default key a byte at a time from rte_rand(). That generator is a
fast non-cryptographic PRNG whose state is recoverable from its output,
so the resulting key is predictable. Linux fills its default RSS key
from get_random_bytes() for the same reason.
Use rte_random_bytes() which takes randomness from the operating
system, and propagate the error where the caller can report it.
ice_get_default_rss_key() has no way to return an error to its caller,
so it keeps rte_rand() as a fallback if the system random generator
is unavailable.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/intel/cpfl/cpfl_ethdev.c | 5 +++--
drivers/net/intel/iavf/iavf_ethdev.c | 8 +++++---
drivers/net/intel/ice/ice_dcf.c | 10 ++++++----
drivers/net/intel/ice/ice_ethdev.c | 11 ++++++++---
drivers/net/intel/idpf/idpf_ethdev.c | 5 +++--
5 files changed, 25 insertions(+), 14 deletions(-)
diff --git a/drivers/net/intel/cpfl/cpfl_ethdev.c b/drivers/net/intel/cpfl/cpfl_ethdev.c
index 4315adb68c..c3f18686bb 100644
--- a/drivers/net/intel/cpfl/cpfl_ethdev.c
+++ b/drivers/net/intel/cpfl/cpfl_ethdev.c
@@ -478,8 +478,9 @@ cpfl_init_rss(struct idpf_vport *vport)
nb_q = dev_data->nb_rx_queues;
if (rss_conf->rss_key == NULL) {
- for (i = 0; i < vport->rss_key_size; i++)
- vport->rss_key[i] = (uint8_t)rte_rand();
+ ret = rte_random_bytes(vport->rss_key, vport->rss_key_size);
+ if (ret != 0)
+ return ret;
} else if (rss_conf->rss_key_len != vport->rss_key_size) {
PMD_INIT_LOG(ERR, "Invalid RSS key length in RSS configuration, should be %d",
vport->rss_key_size);
diff --git a/drivers/net/intel/iavf/iavf_ethdev.c b/drivers/net/intel/iavf/iavf_ethdev.c
index d601ec3b6a..fcef1eb26a 100644
--- a/drivers/net/intel/iavf/iavf_ethdev.c
+++ b/drivers/net/intel/iavf/iavf_ethdev.c
@@ -565,12 +565,14 @@ iavf_init_rss(struct iavf_adapter *adapter)
/* configure RSS key */
if (!rss_conf->rss_key) {
/* Calculate the default hash key */
- for (i = 0; i < vf->vf_res->rss_key_size; i++)
- vf->rss_key[i] = (uint8_t)rte_rand();
- } else
+ ret = rte_random_bytes(vf->rss_key, vf->vf_res->rss_key_size);
+ if (ret != 0)
+ return ret;
+ } else {
memcpy(vf->rss_key, rss_conf->rss_key,
RTE_MIN(rss_conf->rss_key_len,
vf->vf_res->rss_key_size));
+ }
/* init RSS LUT table */
for (i = 0, j = 0; i < vf->vf_res->rss_lut_size; i++, j++) {
diff --git a/drivers/net/intel/ice/ice_dcf.c b/drivers/net/intel/ice/ice_dcf.c
index 3b635c0822..b73af13d5b 100644
--- a/drivers/net/intel/ice/ice_dcf.c
+++ b/drivers/net/intel/ice/ice_dcf.c
@@ -1125,14 +1125,16 @@ ice_dcf_init_rss(struct ice_dcf_hw *hw)
*/
/* configure RSS key */
- if (!rss_conf->rss_key)
+ if (!rss_conf->rss_key) {
/* Calculate the default hash key */
- for (i = 0; i < hw->vf_res->rss_key_size; i++)
- hw->rss_key[i] = (uint8_t)rte_rand();
- else
+ ret = rte_random_bytes(hw->rss_key, hw->vf_res->rss_key_size);
+ if (ret != 0)
+ return ret;
+ } else {
memcpy(hw->rss_key, rss_conf->rss_key,
RTE_MIN(rss_conf->rss_key_len,
hw->vf_res->rss_key_size));
+ }
/* init RSS LUT table */
for (i = 0, j = 0; i < hw->vf_res->rss_lut_size; i++, j++) {
diff --git a/drivers/net/intel/ice/ice_ethdev.c b/drivers/net/intel/ice/ice_ethdev.c
index 76b8ff0a72..105a6636c0 100644
--- a/drivers/net/intel/ice/ice_ethdev.c
+++ b/drivers/net/intel/ice/ice_ethdev.c
@@ -3778,9 +3778,14 @@ ice_get_default_rss_key(uint8_t *rss_key, uint32_t rss_key_size)
}
if (!default_key_done) {
- /* Calculate the default hash key */
- for (i = 0; i < sizeof(default_key); i++)
- key[i] = (uint8_t)rte_rand();
+ /* Calculate the default hash key. Fall back to rte_rand()
+ * if the system random generator is not available, this
+ * function cannot report an error.
+ */
+ if (rte_random_bytes(key, sizeof(default_key)) != 0) {
+ for (i = 0; i < sizeof(default_key); i++)
+ key[i] = (uint8_t)rte_rand();
+ }
default_key_done = true;
}
memcpy(rss_key, key, RTE_MIN(rss_key_size, sizeof(default_key)));
diff --git a/drivers/net/intel/idpf/idpf_ethdev.c b/drivers/net/intel/idpf/idpf_ethdev.c
index c13505416a..ab4d007a22 100644
--- a/drivers/net/intel/idpf/idpf_ethdev.c
+++ b/drivers/net/intel/idpf/idpf_ethdev.c
@@ -432,8 +432,9 @@ idpf_init_rss(struct idpf_vport *vport)
nb_q = dev_data->nb_rx_queues;
if (rss_conf->rss_key == NULL) {
- for (i = 0; i < vport->rss_key_size; i++)
- vport->rss_key[i] = (uint8_t)rte_rand();
+ ret = rte_random_bytes(vport->rss_key, vport->rss_key_size);
+ if (ret != 0)
+ return ret;
} else if (rss_conf->rss_key_len != vport->rss_key_size) {
PMD_INIT_LOG(ERR, "Invalid RSS key length in RSS configuration, should be %d",
vport->rss_key_size);
--
2.53.0
next prev parent reply other threads:[~2026-09-15 19:23 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-15 19:20 [PATCH 00/18] random number generator improvements Stephen Hemminger
2026-09-15 19:20 ` [PATCH 01/18] eal/windows: add getentropy shim Stephen Hemminger
2026-09-15 19:21 ` [PATCH 02/18] random: always use getentropy Stephen Hemminger
2026-09-15 19:21 ` [PATCH 03/18] eal: add 32 bit random number function Stephen Hemminger
2026-09-15 19:21 ` [PATCH 04/18] sched: fix data race in RED random number generation Stephen Hemminger
2026-09-15 19:21 ` [PATCH 05/18] eal/windows: add getrandom shim Stephen Hemminger
2026-09-15 19:21 ` [PATCH 06/18] eal: add function to get random bytes Stephen Hemminger
2026-09-15 19:21 ` [PATCH 07/18] hash: use secure random for Toeplitz hash key Stephen Hemminger
2026-09-15 19:21 ` [PATCH 08/18] pipeline: use secure random for IPsec salt Stephen Hemminger
2026-09-15 19:21 ` [PATCH 09/18] net: use secure random for random MAC address Stephen Hemminger
2026-09-15 19:21 ` [PATCH 10/18] ipsec: use secure random for SAD hash seed Stephen Hemminger
2026-09-15 19:21 ` Stephen Hemminger [this message]
2026-09-15 19:21 ` [PATCH 12/18] random: use all 64 bits of the seed Stephen Hemminger
2026-09-15 19:21 ` [PATCH 13/18] drivers/net: use secure random for RSS key Stephen Hemminger
2026-09-15 19:21 ` [PATCH 14/18] drivers/net: use common random MAC address helper Stephen Hemminger
2026-09-15 19:21 ` [PATCH 15/18] random: remove RDSEED fallback for initial seed Stephen Hemminger
2026-09-16 7:44 ` Bruce Richardson
2026-09-15 19:21 ` [PATCH 16/18] test: allow setting random seed for tests Stephen Hemminger
2026-09-15 19:21 ` [PATCH 17/18] test: add random number generator tests Stephen Hemminger
2026-09-15 19:21 ` [PATCH 18/18] doc: recommend secure random for unpredictable values Stephen Hemminger
2026-09-22 12:32 ` Aaron Conole
2026-10-10 2:27 ` [PATCH v2 0/5] random: fix initial seed entropy Stephen Hemminger
2026-10-10 2:27 ` [PATCH v2 1/5] eal/windows: add getentropy shim Stephen Hemminger
2026-10-10 2:27 ` [PATCH v2 2/5] random: always use getentropy Stephen Hemminger
2026-10-10 2:27 ` [PATCH v2 3/5] random: use all 64 bits of the seed Stephen Hemminger
2026-10-10 2:27 ` [PATCH v2 4/5] random: remove RDSEED fallback for initial seed Stephen Hemminger
2026-10-10 2:27 ` [PATCH v2 5/5] test: allow setting random seed for tests Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260915192207.3926217-12-stephen@networkplumber.org \
--to=stephen@networkplumber.org \
--cc=anatoly.burakov@intel.com \
--cc=bruce.richardson@intel.com \
--cc=dev@dpdk.org \
--cc=jingjing.wu@intel.com \
--cc=praveen.shetty@intel.com \
--cc=vladimir.medvedkin@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox