[core-updates] Entropy starvation during boot

+++ b/gnu/services/base.scm

+                              (dump-port seed urandom)

+

+                              ;; Writing SEED to URANDOM isn't enough: we must

+                              ;; also tell the kernel to account for these

+                              ;; extra bits of entropy.

+                              (let ((bits (* 8 (stat:size (stat seed)))))

+                                (add-to-entropy-count urandom bits)))))))

+++ b/guix/build/syscalls.scm

+            add-to-entropy-count

+

+;;;

+;;; Random.

+;;;

+

+;; From <uapi/linux/random.h>.

+(define RNDADDTOENTCNT #x40045201)

+

+(define (add-to-entropy-count port-or-fd n)

+  "Add N to the kernel's entropy count (the value that can be read from

+/proc/sys/kernel/random/entropy_avail).  PORT-OR-FD must correspond to

+/dev/urandom or /dev/random.  Raise to 'system-error with EPERM when the

+caller lacks root privileges."

+  (let ((fd  (if (port? port-or-fd)

+                 (fileno port-or-fd)

+                 port-or-fd))

+        (box (make-bytevector (sizeof int))))

+    (bytevector-sint-set! box 0 n (native-endianness)

+                          (sizeof int))

+    (let-values (((ret err)

+                  (%ioctl fd RNDADDTOENTCNT

+                          (bytevector->pointer box))))

+      (unless (zero? err)

+        (throw 'system-error "add-to-entropy-count" "~A"

+               (list (strerror err))

+               (list err))))))

+

+++ b/tests/syscalls.scm

+(when (zero? (getuid))

+  (test-skip 1))

+(test-equal "add-to-entropy-count"

+  EPERM

+  (call-with-output-file "/dev/urandom"

+    (lambda (port)

+      (catch 'system-error

+        (lambda ()

+          (add-to-entropy-count port 77)

+          #f)

+        (lambda args

+          (system-error-errno args))))))

+

+++ b/gnu/local.mk

+  %D%/packages/patches/linux-libre-active-entropy.patch		\

+++ b/gnu/packages/linux.scm

+                       (list (search-patch "linux-libre-active-entropy.patch")

+                             %boot-logo-patch

+++ b/gnu/packages/patches/linux-libre-active-entropy.patch

+Try to actively add entropy instead of waiting forever.

+Fixes <https://bugs.gnu.org/37501>.

+

+Taken from upstream:

+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=50ee7529ec4500c88f8664560770a7a1b65db72b

+

+diff --git a/drivers/char/random.c b/drivers/char/random.c

+index 5d5ea4ce1442..2fda6166c1dd 100644

+--- a/drivers/char/random.c

++++ b/drivers/char/random.c

+@@ -1731,6 +1731,56 @@ void get_random_bytes(void *buf, int nbytes)

+ }

+ EXPORT_SYMBOL(get_random_bytes);

+ 

++

++/*

++ * Each time the timer fires, we expect that we got an unpredictable

++ * jump in the cycle counter. Even if the timer is running on another

++ * CPU, the timer activity will be touching the stack of the CPU that is

++ * generating entropy..

++ *

++ * Note that we don't re-arm the timer in the timer itself - we are

++ * happy to be scheduled away, since that just makes the load more

++ * complex, but we do not want the timer to keep ticking unless the

++ * entropy loop is running.

++ *

++ * So the re-arming always happens in the entropy loop itself.

++ */

++static void entropy_timer(struct timer_list *t)

++{

++	credit_entropy_bits(&input_pool, 1);

++}

++

++/*

++ * If we have an actual cycle counter, see if we can

++ * generate enough entropy with timing noise

++ */

++static void try_to_generate_entropy(void)

++{

++	struct {

++		unsigned long now;

++		struct timer_list timer;

++	} stack;

++

++	stack.now = random_get_entropy();

++

++	/* Slow counter - or none. Don't even bother */

++	if (stack.now == random_get_entropy())

++		return;

++

++	timer_setup_on_stack(&stack.timer, entropy_timer, 0);

++	while (!crng_ready()) {

++		if (!timer_pending(&stack.timer))

++			mod_timer(&stack.timer, jiffies+1);

++		mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));

++		schedule();

++		stack.now = random_get_entropy();

++	}

++

++	del_timer_sync(&stack.timer);

++	destroy_timer_on_stack(&stack.timer);

++	mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));

++}

++

+ /*

+  * Wait for the urandom pool to be seeded and thus guaranteed to supply

+  * cryptographically secure random numbers. This applies to: the /dev/urandom

+@@ -1745,7 +1795,17 @@ int wait_for_random_bytes(void)

+ {

+ 	if (likely(crng_ready()))

+ 		return 0;

+-	return wait_event_interruptible(crng_init_wait, crng_ready());

++

++	do {

++		int ret;

++		ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);

++		if (ret)

++			return ret > 0 ? 0 : ret;

++

++		try_to_generate_entropy();

++	} while (!crng_ready());

++

++	return 0;

+ }

+ EXPORT_SYMBOL(wait_for_random_bytes);

+