From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D3E46C433EF for ; Fri, 14 Jan 2022 15:08:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=WDAE1fB6nu9QZgPiYa/P5z8X/6igQn2oDlVSDAlLNKQ=; b=O6nI/XOKQ3QvRR AXPZbjP0tBCYZz+H2kVUhylANJZnzfGeBpEklOxI43iR1B0wigY+4ppMylAa8hncFjBrLEwyu7551 a9st1RmEVSuY26CxAzmBOPi2Cr6irTtDHjKSbOY503tv5M4xt1VNSf8AJ1VB0MfNKH3PVgUB/HBOq Y3d5Q31vl+V6peOvfuUyidgKob2LPylmuKdajNx8fbi+BM2El5joE0lXHo+2c1iPCrDLkPf1jq+w0 ZUFHhnCur4LxlVJKnMZ89ttobZpennctlgFCOkH6nKT1Ngl4griwlDJYS3HKcYBdoeZEDFhr2pub1 rgJfEfm3zQl2nsG+M32Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1n8OAw-009VRI-Jw; Fri, 14 Jan 2022 15:07:34 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1n8OAs-009VPl-OR for linux-arm-kernel@lists.infradead.org; Fri, 14 Jan 2022 15:07:32 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id C6FAF6D; Fri, 14 Jan 2022 07:07:28 -0800 (PST) Received: from donnerap.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id BB5623F774; Fri, 14 Jan 2022 07:07:27 -0800 (PST) Date: Fri, 14 Jan 2022 15:07:25 +0000 From: Andre Przywara To: Ard Biesheuvel Cc: linux-arm-kernel@lists.infradead.org, catalin.marinas@arm.com, will@kernel.org, mark.rutland@arm.com, jason@zx2c4.com, Mark Brown Subject: Re: [PATCH] arm64: random: implement arch_get_random_int/_long based on RNDR Message-ID: <20220114150725.23693d0e@donnerap.cambridge.arm.com> In-Reply-To: <20220113131239.1610455-1-ardb@kernel.org> References: <20220113131239.1610455-1-ardb@kernel.org> Organization: ARM X-Mailer: Claws Mail 3.17.5 (GTK+ 2.24.32; aarch64-unknown-linux-gnu) MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220114_070730_925723_6948F0B7 X-CRM114-Status: GOOD ( 28.81 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, 13 Jan 2022 14:12:39 +0100 Ard Biesheuvel wrote: Hi, > When support for RNDR/RNDRRS was introduced, we elected to only > implement arch_get_random_seed_int/_long(), and back them by RNDR > instead of RNDRRS. This was needed to prevent potential performance > and/or starvation issues resulting from the fact that the /dev/random > driver used to invoke these routines on various hot paths. > > These issues have all been addressed now [0] [1], and so we can wire up > this API more straight-forwardly: > > - map arch_get_random_int/_long() onto RNDR, which returns the output of > a DRBG that is reseeded at an implemented defined rate; > - map arch_get_random_seed_int/_long() onto the TRNG firmware service, > which returns true, conditioned entropy, or onto RNDRRS if the TRNG > service is unavailable, which returns the output of a DRBG that is > reseeded every time it is used. > > [0] 390596c9959c random: avoid arch_get_random_seed_long() when collecting IRQ randomness > [1] 2ee25b6968b1 random: avoid superfluous call to RDRAND in CRNG extraction > > Cc: Andre Przywara > Cc: Mark Brown > Signed-off-by: Ard Biesheuvel Looks alright to me, at least from the code point of view: I am not a "crypto guy". Reviewed-by: Andre Przywara Cheers, Andre > --- > arch/arm64/include/asm/archrandom.h | 45 +++++++++++++++++--- > 1 file changed, 39 insertions(+), 6 deletions(-) > > diff --git a/arch/arm64/include/asm/archrandom.h b/arch/arm64/include/asm/archrandom.h > index 09e43272ccb0..d1bb5e71df25 100644 > --- a/arch/arm64/include/asm/archrandom.h > +++ b/arch/arm64/include/asm/archrandom.h > @@ -42,13 +42,47 @@ static inline bool __arm64_rndr(unsigned long *v) > return ok; > } > > +static inline bool __arm64_rndrrs(unsigned long *v) > +{ > + bool ok; > + > + /* > + * Reads of RNDRRS set PSTATE.NZCV to 0b0000 on success, > + * and set PSTATE.NZCV to 0b0100 otherwise. > + */ > + asm volatile( > + __mrs_s("%0", SYS_RNDRRS_EL0) "\n" > + " cset %w1, ne\n" > + : "=r" (*v), "=r" (ok) > + : > + : "cc"); > + > + return ok; > +} > + > static inline bool __must_check arch_get_random_long(unsigned long *v) > { > + /* > + * Only support the generic interface after we have detected > + * the system wide capability, avoiding complexity with the > + * cpufeature code and with potential scheduling between CPUs > + * with and without the feature. > + */ > + if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndr(v)) > + return true; > return false; > } > > static inline bool __must_check arch_get_random_int(unsigned int *v) > { > + if (cpus_have_const_cap(ARM64_HAS_RNG)) { > + unsigned long val; > + > + if (__arm64_rndr(&val)) { > + *v = val; > + return true; > + } > + } > return false; > } > > @@ -71,12 +105,11 @@ static inline bool __must_check arch_get_random_seed_long(unsigned long *v) > } > > /* > - * Only support the generic interface after we have detected > - * the system wide capability, avoiding complexity with the > - * cpufeature code and with potential scheduling between CPUs > - * with and without the feature. > + * RNDRRS is not backed by an entropy source but by a DRBG that is > + * reseeded after each invocation. This is not a 100% fit but good > + * enough to implement this API if no other entropy source exists. > */ > - if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndr(v)) > + if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndrrs(v)) > return true; > > return false; > @@ -96,7 +129,7 @@ static inline bool __must_check arch_get_random_seed_int(unsigned int *v) > } > > if (cpus_have_const_cap(ARM64_HAS_RNG)) { > - if (__arm64_rndr(&val)) { > + if (__arm64_rndrrs(&val)) { > *v = val; > return true; > } _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel