gnu: linux-libre: Try to aggressively gather entropy during boot.
Fixes <https://bugs.gnu.org/37501>. * gnu/packages/patches/linux-libre-active-entropy.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/linux.scm (linux-libre-5.2-source): Use it.
This commit is contained in:
Marius Bakke
parent
5157edd885
commit
dd69897113
3 changed files with 89 additions and 1 deletions
|
|
@ -1078,6 +1078,7 @@ dist_patch_DATA = \
|
||||||
%D%/packages/patches/lierolibre-remove-arch-warning.patch \
|
%D%/packages/patches/lierolibre-remove-arch-warning.patch \
|
||||||
%D%/packages/patches/lierolibre-try-building-other-arch.patch \
|
%D%/packages/patches/lierolibre-try-building-other-arch.patch \
|
||||||
%D%/packages/patches/linkchecker-tests-require-network.patch \
|
%D%/packages/patches/linkchecker-tests-require-network.patch \
|
||||||
|
%D%/packages/patches/linux-libre-active-entropy.patch \
|
||||||
%D%/packages/patches/linux-pam-no-setfsuid.patch \
|
%D%/packages/patches/linux-pam-no-setfsuid.patch \
|
||||||
%D%/packages/patches/lirc-localstatedir.patch \
|
%D%/packages/patches/lirc-localstatedir.patch \
|
||||||
%D%/packages/patches/lirc-reproducible-build.patch \
|
%D%/packages/patches/lirc-reproducible-build.patch \
|
||||||
|
|
|
||||||
|
|
@ -420,7 +420,8 @@ (define (source-with-patches source patches)
|
||||||
|
|
||||||
(define-public linux-libre-5.2-source
|
(define-public linux-libre-5.2-source
|
||||||
(source-with-patches linux-libre-5.2-pristine-source
|
(source-with-patches linux-libre-5.2-pristine-source
|
||||||
(list %boot-logo-patch
|
(list (search-patch "linux-libre-active-entropy.patch")
|
||||||
|
%boot-logo-patch
|
||||||
%linux-libre-arm-export-__sync_icache_dcache-patch)))
|
%linux-libre-arm-export-__sync_icache_dcache-patch)))
|
||||||
|
|
||||||
(define-public linux-libre-4.19-source
|
(define-public linux-libre-4.19-source
|
||||||
|
|
|
||||||
86
gnu/packages/patches/linux-libre-active-entropy.patch
Normal file
86
gnu/packages/patches/linux-libre-active-entropy.patch
Normal file
|
|
@ -0,0 +1,86 @@
|
||||||
|
Try to actively add entropy instead of waiting forever.
|
||||||
|
Fixes <https://bugs.gnu.org/37501>.
|
||||||
|
|
||||||
|
Taken from upstream:
|
||||||
|
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=50ee7529ec4500c88f8664560770a7a1b65db72b
|
||||||
|
|
||||||
|
diff --git a/drivers/char/random.c b/drivers/char/random.c
|
||||||
|
index 5d5ea4ce1442..2fda6166c1dd 100644
|
||||||
|
--- a/drivers/char/random.c
|
||||||
|
+++ b/drivers/char/random.c
|
||||||
|
@@ -1731,6 +1731,56 @@ void get_random_bytes(void *buf, int nbytes)
|
||||||
|
}
|
||||||
|
EXPORT_SYMBOL(get_random_bytes);
|
||||||
|
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Each time the timer fires, we expect that we got an unpredictable
|
||||||
|
+ * jump in the cycle counter. Even if the timer is running on another
|
||||||
|
+ * CPU, the timer activity will be touching the stack of the CPU that is
|
||||||
|
+ * generating entropy..
|
||||||
|
+ *
|
||||||
|
+ * Note that we don't re-arm the timer in the timer itself - we are
|
||||||
|
+ * happy to be scheduled away, since that just makes the load more
|
||||||
|
+ * complex, but we do not want the timer to keep ticking unless the
|
||||||
|
+ * entropy loop is running.
|
||||||
|
+ *
|
||||||
|
+ * So the re-arming always happens in the entropy loop itself.
|
||||||
|
+ */
|
||||||
|
+static void entropy_timer(struct timer_list *t)
|
||||||
|
+{
|
||||||
|
+ credit_entropy_bits(&input_pool, 1);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * If we have an actual cycle counter, see if we can
|
||||||
|
+ * generate enough entropy with timing noise
|
||||||
|
+ */
|
||||||
|
+static void try_to_generate_entropy(void)
|
||||||
|
+{
|
||||||
|
+ struct {
|
||||||
|
+ unsigned long now;
|
||||||
|
+ struct timer_list timer;
|
||||||
|
+ } stack;
|
||||||
|
+
|
||||||
|
+ stack.now = random_get_entropy();
|
||||||
|
+
|
||||||
|
+ /* Slow counter - or none. Don't even bother */
|
||||||
|
+ if (stack.now == random_get_entropy())
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ timer_setup_on_stack(&stack.timer, entropy_timer, 0);
|
||||||
|
+ while (!crng_ready()) {
|
||||||
|
+ if (!timer_pending(&stack.timer))
|
||||||
|
+ mod_timer(&stack.timer, jiffies+1);
|
||||||
|
+ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
|
||||||
|
+ schedule();
|
||||||
|
+ stack.now = random_get_entropy();
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ del_timer_sync(&stack.timer);
|
||||||
|
+ destroy_timer_on_stack(&stack.timer);
|
||||||
|
+ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Wait for the urandom pool to be seeded and thus guaranteed to supply
|
||||||
|
* cryptographically secure random numbers. This applies to: the /dev/urandom
|
||||||
|
@@ -1745,7 +1795,17 @@ int wait_for_random_bytes(void)
|
||||||
|
{
|
||||||
|
if (likely(crng_ready()))
|
||||||
|
return 0;
|
||||||
|
- return wait_event_interruptible(crng_init_wait, crng_ready());
|
||||||
|
+
|
||||||
|
+ do {
|
||||||
|
+ int ret;
|
||||||
|
+ ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
|
||||||
|
+ if (ret)
|
||||||
|
+ return ret > 0 ? 0 : ret;
|
||||||
|
+
|
||||||
|
+ try_to_generate_entropy();
|
||||||
|
+ } while (!crng_ready());
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
EXPORT_SYMBOL(wait_for_random_bytes);
|
||||||
|
|
||||||
Loading…
Reference in a new issue