[v2,00/11] archs/random: fallback to using ktime_read_raw_clock() if no cycle counter

Message

Jason A. Donenfeld April 10, 2022, 9:49 p.m. UTC

Hi folks,

The RNG uses a function called random_get_entropy() basically anytime
that it needs to timestamp an event. For example, an interrupt comes in,
and we mix a random_get_entropy() into the entropy pool somehow.
Somebody mashes their keyboard or moves their mouse around? We mix a
random_get_entropy() into the entropy pool. It's one of the main
varieties of input.

Unfortunately, it's always 0 on a few platforms. The RNG has accumulated
various hacks to deal with this, but in general it's not great. Surely
we can do better than 0. In fact, *anything* that's not the same exact
value all the time would be better than 0. Even a counter that
increments once per hour would be better than 0! I think you get the
idea.

On most platforms, random_get_entropy() is aliased to get_cycles(),
which makes sense for platforms where get_cycles() is defined. RDTSC,
for example, has all the characteristics we care about for this
function: it's fast to acquire (i.e. acceptable in an irq handler),
pretty high precision, available, forms a 2-monotone distribution, etc.
But for platforms without that, what is the next best thing?

Sometimes the next best thing is architecture-defined. For example,
really old MIPS has the CP0 random register, which isn't a cycle
counter, but is at least something. However, some platforms don't even
have an architecture-defined fallback.

Fortunately, the timekeeping subsystem has already solved this problem
of trying to determine what the least bad clock is on constrained
systems, falling back to jiffies in the worst case. By exporting the raw
clock, we can get a decent fallback function for when there's no cycle
counter or architecture-specific function.

This series makes the RNG more useful on: m68k, RISC-V, MIPS, ARM32,
NIOS II, SPARC32, Xtensa, and Usermode Linux. Previously these platforms
would, in certain circumstances, but out of luck with regards to having
any type of event timestamping source in the RNG.

Finally, note that this series isn't about "jitter entropy" or other
ways of initializing the RNG. That's a different topic for a different
thread. Please don't let this discussion veer off into that. Here, I'm
just trying to find a good fallback counter/timer for platforms without
get_cycles(), a question with limited scope.

If this (or a future revision) looks good to you all and receives the
requisite acks, my plan was to take these through the random.git tree
for 5.19, so that I can then build on top of it.

Thanks,
Jason

Changes v1->v2:
- Use ktime_read_raw_clock() instead of sched_clock(), per Thomas'
  suggestion.
- Drop arm64 change.
- Cleanup header inclusion ordering problem.

Cc: Thomas Gleixner <[e-mail]>
Cc: Arnd Bergmann <[e-mail]>
Cc: Theodore Ts'o <[e-mail]>
Cc: Dominik Brodowski <[e-mail]>
Cc: Russell King <[e-mail]>
Cc: Catalin Marinas <[e-mail]>
Cc: Will Deacon <[e-mail]>
Cc: Geert Uytterhoeven <[e-mail]>
Cc: Thomas Bogendoerfer <[e-mail]>
Cc: Paul Walmsley <[e-mail]>
Cc: Palmer Dabbelt <[e-mail]>
Cc: Albert Ou <[e-mail]>
Cc: David S. Miller <[e-mail]>
Cc: Richard Weinberger <[e-mail]>
Cc: Anton Ivanov <[e-mail]>
Cc: Johannes Berg <[e-mail]>
Cc: Ingo Molnar <[e-mail]>
Cc: Borislav Petkov <[e-mail]>
Cc: Dave Hansen <[e-mail]>
Cc: H. Peter Anvin <[e-mail]>
Cc: Chris Zankel <[e-mail]>
Cc: Max Filippov <[e-mail]>
Cc: John Stultz <[e-mail]>
Cc: Stephen Boyd <[e-mail]>
Cc: Dinh Nguyen <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]

Jason A. Donenfeld (11):
  timekeeping: add accessor for raw clock
  timekeeping: use ktime_read_raw_clock() for random_get_entropy() if no
    get_cycles()
  m68k: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  riscv: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  mips: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  arm: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  nios2: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  x86: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  um: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  sparc: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero
  xtensa: use ktime_read_raw_clock() for random_get_entropy() instead of
    zero

 arch/arm/include/asm/timex.h      |  1 +
 arch/m68k/include/asm/timex.h     |  2 +-
 arch/mips/include/asm/timex.h     |  2 +-
 arch/nios2/include/asm/timex.h    |  2 ++
 arch/riscv/include/asm/timex.h    |  2 +-
 arch/sparc/include/asm/timex_32.h |  4 +---
 arch/um/include/asm/timex.h       |  9 ++-------
 arch/x86/include/asm/tsc.h        | 10 ++++++++++
 arch/xtensa/include/asm/timex.h   |  6 ++----
 include/linux/timex.h             |  8 ++++++++
 kernel/time/timekeeping.c         |  8 ++++++++
 11 files changed, 37 insertions(+), 17 deletions(-)