Commit 35bde68b authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Will Deacon
Browse files

arm64: random: implement arch_get_random_int/_long based on RNDR 



When support for RNDR/RNDRRS was introduced, we elected to only
implement arch_get_random_seed_int/_long(), and back them by RNDR
instead of RNDRRS. This was needed to prevent potential performance
and/or starvation issues resulting from the fact that the /dev/random
driver used to invoke these routines on various hot paths.

These issues have all been addressed now [0] [1], and so we can wire up
this API more straight-forwardly:

- map arch_get_random_int/_long() onto RNDR, which returns the output of
  a DRBG that is reseeded at an implemented defined rate;
- map arch_get_random_seed_int/_long() onto the TRNG firmware service,
  which returns true, conditioned entropy, or onto RNDRRS if the TRNG
  service is unavailable, which returns the output of a DRBG that is
  reseeded every time it is used.

[0] 390596c9 random: avoid arch_get_random_seed_long() when collecting IRQ randomness
[1] 2ee25b69 random: avoid superfluous call to RDRAND in CRNG extraction

Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Acked-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: default avatarAndre Przywara <andre.przywara@arm.com>
Reviewed-by: default avatarMark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220113131239.1610455-1-ardb@kernel.org


Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent dfd42fac

arch/arm64/include/asm/archrandom.h

+39 −6
Original line number Diff line number Diff line
@@ -42,13 +42,47 @@ static inline bool __arm64_rndr(unsigned long *v) 
	return ok;

}



static inline bool __arm64_rndrrs(unsigned long *v)

{

	bool ok;



	/*

	 * Reads of RNDRRS set PSTATE.NZCV to 0b0000 on success,

	 * and set PSTATE.NZCV to 0b0100 otherwise.

	 */

	asm volatile(

		__mrs_s("%0", SYS_RNDRRS_EL0) "\n"

	"	cset %w1, ne\n"

	: "=r" (*v), "=r" (ok)

	:

	: "cc");



	return ok;

}



static inline bool __must_check arch_get_random_long(unsigned long *v)

{

	/*

	 * Only support the generic interface after we have detected

	 * the system wide capability, avoiding complexity with the

	 * cpufeature code and with potential scheduling between CPUs

	 * with and without the feature.

	 */

	if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndr(v))

		return true;

	return false;

}



static inline bool __must_check arch_get_random_int(unsigned int *v)

{

	if (cpus_have_const_cap(ARM64_HAS_RNG)) {

		unsigned long val;



		if (__arm64_rndr(&val)) {

			*v = val;

			return true;

		}

	}

	return false;

}
@@ -71,12 +105,11 @@ static inline bool __must_check arch_get_random_seed_long(unsigned long *v) 
	}



	/*

	 * Only support the generic interface after we have detected

	 * the system wide capability, avoiding complexity with the

	 * cpufeature code and with potential scheduling between CPUs

	 * with and without the feature.

	 * RNDRRS is not backed by an entropy source but by a DRBG that is

	 * reseeded after each invocation. This is not a 100% fit but good

	 * enough to implement this API if no other entropy source exists.

	 */

	if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndr(v))

	if (cpus_have_const_cap(ARM64_HAS_RNG) && __arm64_rndrrs(v))

		return true;



	return false;
@@ -96,7 +129,7 @@ static inline bool __must_check arch_get_random_seed_int(unsigned int *v) 
	}



	if (cpus_have_const_cap(ARM64_HAS_RNG)) {

		if (__arm64_rndr(&val)) {

		if (__arm64_rndrrs(&val)) {

			*v = val;

			return true;

		}