linux-kernel - Re: [PATCH] /dev/random: Insufficient of entropy on many architectures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130912233535.GI3809@logfs.org>
Date:	Thu, 12 Sep 2013 19:35:36 -0400
From:	Jörn Engel <joern@...fs.org>
To:	Theodore Ts'o <tytso@....edu>
Cc:	John Stultz <john.stultz@...aro.org>,
	Stephan Mueller <smueller@...onox.de>,
	LKML <linux-kernel@...r.kernel.org>, dave.taht@...ferbloat.net,
	Frederic Weisbecker <fweisbec@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH] /dev/random: Insufficient of entropy on many
 architectures

On Thu, 12 September 2013 19:31:55 -0400, Theodore Ts'o wrote:
> On Thu, Sep 12, 2013 at 05:07:17PM -0400, Jörn Engel wrote:
> > 
> > I happen to have a real-world system with >100k interrupts per second
> > and - surprise - add_interrupt_randomness() showed up prominently in
> > the profiles.  I was also told twice to just remove that call.  I
> > resisted both times and have done far more work to reduce overhead
> > while still collecting entropy.  Some others would have caved in.
> 
> Would it be possible for you to send me the perf numbers that you saw?

Eventually.  The idiot that was me half a year ago failed to attach
perf numbers to the patch description.

> What platform is this?  x86?   Some embedded processor?

x86.  I suspect NAPI significantly cuts down the number of interrupts
for ethernet cards.  My case is with FC interrupts.  Quite likely
doing something like NAPI would help far more for performance than
disabling add_interrupt_randomness().

> > One option is to add the "input_pool.entropy_count > trickle_thresh"
> > condition that all other entropy sources currently have.  But instead
> > I would rather rename fast_mix() to not_too_fast_mix() and implement a
> > real fast_mix().  Essentially just xor the collected numbers into a
> > pool and schedule something to shuffle the bits at a later point.
> 
> We can try some different things to make fast_mix() faster, but it
> would be good to get some hard numbers before we start deciding we
> need to do something more complicated.
> 
> One thing that comes to mind is that fast_mix() is only called in
> exactly one place, and we always pass in a long.  So there are
> certainly ways that we could optimize fast_mix even keeping the
> current mixing algorithm.

I think the existing code is doing just fine for low interrupt loads.
It makes sense to spend a bit more work to squeeze the last bit of
randomness out.  But when you get lots of interrupts, you can be
sloppy and just xor things into the pool.

My patch below is going too far by not even doing the xor.  I was
stupid and under time pressure.  But to my defence,
add_timer_randomness() makes the same mistake.

Jörn

--
Eighty percent of success is showing up.
-- Woody Allen

>From ee197e39b9a6c905db870606f5bacab2a52a8da2 Mon Sep 17 00:00:00 2001
From: Joern Engel <joern@...fs.org>
Date: Wed, 13 Feb 2013 10:34:26 -0800
Subject: [PATCH] random: limit overhead of add_interrupt_randomness

fast_mix is noticeably less fast than the name might imply.  Add
rate-limiting to it, so we only run it once per jiffie and cpu for the
painful case of a single interrupt hammering a cpu.  Instead we do the
dumbest possible mixing - we xor the input with the pool without any
shifting whatsoever.  Gathers some randomness at near-zero cost.

Signed-off-by: Joern Engel <joern@...fs.org>
---
 drivers/char/random.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index b86eae9..7b7f64e 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -557,6 +557,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in,
 struct fast_pool {
 	__u32		pool[4];
 	unsigned long	last;
+	unsigned long	last_jiffies;
 	unsigned short	count;
 	unsigned char	rotate;
 	unsigned char	last_timer_intr;
@@ -760,6 +761,17 @@ void add_interrupt_randomness(int irq, int irq_flags)
 		input[3] = ip >> 32;
 	}
 
+	/*
+	 * Even fast_mix is slow when dealing with 6-digit interrupt
+	 * rates.  Rate-limit this to once per jiffie.  If we get lots
+	 * of interrupts, this still generates 1.6 bits of entropy per
+	 * second and cpu.  If we get few interrupts, it shouldn't
+	 * substantially change the entropy collection.
+	 */
+	if (fast_pool->last_jiffies == jiffies)
+		return;
+	fast_pool->last_jiffies = jiffies;
+
 	fast_mix(fast_pool, input, sizeof(input));
 
 	if ((fast_pool->count & 1023) &&
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/