Skip to content

L
linux
Switch branch/tag
  1. 02 Jun, 2023 9 commits
  3. 24 May, 2023 13 commits
  5. 22 May, 2023 1 commit
  7. 19 May, 2023 8 commits
  9. 12 May, 2023 9 commits
    • Herbert Xu's avatar
      hwrng: virtio - Fix race on data_avail and actual data · ac52578d
      Herbert Xu authored 
      The virtio rng device kicks off a new entropy request whenever the
data available reaches zero.  When a new request occurs at the end
of a read operation, that is, when the result of that request is
only needed by the next reader, then there is a race between the
writing of the new data and the next reader.

This is because there is no synchronisation whatsoever between the
writer and the reader.

Fix this by writing data_avail with smp_store_release and reading
it with smp_load_acquire when we first enter read.  The subsequent
reads are safe because they're either protected by the first load
acquire, or by the completion mechanism.

Also remove the redundant zeroing of data_idx in random_recv_done
(data_idx must already be zero at this point) and data_avail in
request_entropy (ditto).

Reported-by: syzbot+726dc8c62c3536431ceb@syzkaller.appspotmail.com
Fixes: f7f510ec ("virtio: An entropy device, as suggested by hpa.")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      ac52578d
    • Srujana Challa's avatar
      crypto: octeontx2 - hardware configuration for inline IPsec · a4855a8c
      Srujana Challa authored 
      On OcteonTX2/OctoenTX3 variants of silicon, Admin function (AF)
handles resource allocation and configuration for PFs and their VFs.
PFs request the AF directly, via mailboxes.
Unlike PFs, VFs cannot send a mailbox request directly. A VF sends
mailbox messages to its parent PF, with which it shares a
mailbox region. The PF then forwards these messages to the AF.

This patch adds code to configure inline-IPsec HW resources for
CPT VFs as CPT VFs cannot send a mailbox request directly to AF.
Signed-off-by: default avatarSrujana Challa <schalla@marvell.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      a4855a8c
    • Srujana Challa's avatar
      crypto: octeontx2 - add support for AF to CPT PF uplink mbox · 5c553114
      Srujana Challa authored 
      This patch adds support for AF -> CPT PF uplink mailbox messages
and adds a mailbox handler to submit a CPT instruction from AF as
current architecture doesn't allow AF to submit CPT instruction
directly to HW.
Signed-off-by: default avatarSrujana Challa <schalla@marvell.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      5c553114
    • David Yang's avatar
      crypto: engine - Fix struct crypto_engine_op doc · dee3590c
      David Yang authored 
      Remove redundant underscore and fix some grammar in prepare_request doc.
Signed-off-by: default avatarDavid Yang <mmyangfl@gmail.com>
Acked-by: default avatarRandy Dunlap <rdunlap@infradead.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      dee3590c
    • David Yang's avatar
      hwrng: histb - Move driver to drivers/char/hw_random/histb-rng.c · 903e6ada
      David Yang authored 
      Move to drivers/char/hw_random since histb-(t)rng does not provide
cryptography pseudo rng.

histb-rng is pretty like hisi-rng, but after investigation, we confirm
there is no RNG_PHY_SEED register on histb-rng so a separate driver is
needed.

Still we rename relevant function names to match those in hisi-rng.

Link: https://lore.kernel.org/r/20230401164448.1393336-1-mmyangfl@gmail.comSigned-off-by: default avatarDavid Yang <mmyangfl@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      903e6ada
    • Stephan Müller's avatar
      crypto: jitter - add interface for gathering of raw entropy · 69f1c387
      Stephan Müller authored 
      The test interface allows a privileged process to capture the raw
unconditioned noise that is collected by the Jitter RNG for statistical
analysis. Such testing allows the analysis how much entropy
the Jitter RNG noise source provides on a given platform. The obtained
data is the time stamp sampled by the Jitter RNG. Considering that
the Jitter RNG inserts the delta of this time stamp compared to the
immediately preceding time stamp, the obtained data needs to be
post-processed accordingly to obtain the data the Jitter RNG inserts
into its entropy pool.

The raw entropy collection is provided to obtain the raw unmodified
time stamps that are about to be added to the Jitter RNG entropy pool
and are credited with entropy. Thus, this patch adds an interface
which renders the Jitter RNG insecure. This patch is NOT INTENDED
FOR PRODUCTION SYSTEMS, but solely for development/test systems to
verify the available entropy rate.

Access to the data is given through the jent_raw_hires debugfs file.
The data buffer should be multiples of sizeof(u32) to fill the entire
buffer. Using the option jitterentropy_testing.boot_raw_hires_test=1
the raw noise of the first 1000 entropy events since boot can be
sampled.

This test interface allows generating the data required for
analysis whether the Jitter RNG is in compliance with SP800-90B
sections 3.1.3 and 3.1.4.

If the test interface is not compiled, its code is a noop which has no
impact on the performance.
Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      69f1c387
    • Stephan Müller's avatar
      crypto: jitter - replace LFSR with SHA3-256 · bb897c55
      Stephan Müller authored 
      Using the kernel crypto API, the SHA3-256 algorithm is used as
conditioning element to replace the LFSR in the Jitter RNG. All other
parts of the Jitter RNG are unchanged.

The application and use of the SHA-3 conditioning operation is identical
to the user space Jitter RNG 3.4.0 by applying the following concept:

- the Jitter RNG initializes a SHA-3 state which acts as the "entropy
  pool" when the Jitter RNG is allocated.

- When a new time delta is obtained, it is inserted into the "entropy
  pool" with a SHA-3 update operation. Note, this operation in most of
  the cases is a simple memcpy() onto the SHA-3 stack.

- To cause a true SHA-3 operation for each time delta operation, a
  second SHA-3 operation is performed hashing Jitter RNG status
  information. The final message digest is also inserted into the
  "entropy pool" with a SHA-3 update operation. Yet, this data is not
  considered to provide any entropy, but it shall stir the entropy pool.

- To generate a random number, a SHA-3 final operation is performed to
  calculate a message digest followed by an immediate SHA-3 init to
  re-initialize the "entropy pool". The obtained message digest is one
  block of the Jitter RNG that is returned to the caller.

Mathematically speaking, the random number generated by the Jitter RNG
is:

aux_t = SHA-3(Jitter RNG state data)

Jitter RNG block = SHA-3(time_i || aux_i || time_(i-1) || aux_(i-1) ||
                         ... || time_(i-255) || aux_(i-255))

when assuming that the OSR = 1, i.e. the default value.

This operation implies that the Jitter RNG has an output-blocksize of
256 bits instead of the 64 bits of the LFSR-based Jitter RNG that is
replaced with this patch.

The patch also replaces the varying number of invocations of the
conditioning function with one fixed number of invocations. The use
of the conditioning function consistent with the userspace Jitter RNG
library version 3.4.0.

The code is tested with a system that exhibited the least amount of
entropy generated by the Jitter RNG: the SiFive Unmatched RISC-V
system. The measured entropy rate is well above the heuristically
implied entropy value of 1 bit of entropy per time delta. On all other
tested systems, the measured entropy rate is even higher by orders
of magnitude. The measurement was performed using updated tooling
provided with the user space Jitter RNG library test framework.

The performance of the Jitter RNG with this patch is about en par
with the performance of the Jitter RNG without the patch.
Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      bb897c55
    • Herbert Xu's avatar
      crypto: hash - Make crypto_ahash_alg helper available · 3908edf8
      Herbert Xu authored 
      Move the crypto_ahash_alg helper into include/crypto/internal so
that drivers can use it.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      3908edf8
    • Herbert Xu's avatar
      crypto: hash - Add statesize to crypto_ahash · c7535fb2
      Herbert Xu authored 
      As ahash drivers may need to use fallbacks, their state size
is thus variable.  Deal with this by making it an attribute
of crypto_ahash.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      c7535fb2
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7