Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Andy Lutomirski <luto@amacapital.net>
Mime-Version: 1.0 (1.0)
Subject: Re: [RFC PATCH 03/11] x86/boot: Allow a "silent" kaslr random byte fetch
Date:   Wed, 5 Feb 2020 17:08:55 -0800
Message-Id: <B173D69E-DC6C-4658-B5CB-391D3C6A6597@amacapital.net>
References: <20200205223950.1212394-4-kristen@linux.intel.com>
Cc:     tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, hpa@zytor.com,
        arjan@linux.intel.com, keescook@chromium.org,
        rick.p.edgecombe@intel.com, x86@kernel.org,
        linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com
In-Reply-To: <20200205223950.1212394-4-kristen@linux.intel.com>
To:     Kristen Carlson Accardi <kristen@linux.intel.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Feb 5, 2020, at 2:39 PM, Kristen Carlson Accardi <kristen@linux.intel.c=
om> wrote:
>=20
> =EF=BB=BFFrom: Kees Cook <keescook@chromium.org>
>=20
> Under earlyprintk, each RNG call produces a debug report line. When
> shuffling hundreds of functions, this is not useful information (each
> line is identical and tells us nothing new). Instead, allow for a NULL
> "purpose" to suppress the debug reporting.

Have you counted how many RDRAND calls this causes?  RDRAND is exceedingly s=
low on all CPUs I=E2=80=99ve looked at. The whole =E2=80=9CRDRAND has great b=
andwidth=E2=80=9D marketing BS actually means that it has decent bandwidth i=
f all CPUs hammer it at the same time. The latency is abysmal.  I have asked=
 Intel to improve this, but the latency of that request will be quadrillions=
 of cycles :)

It wouldn=E2=80=99t shock me if just the RDRAND calls account for a respecta=
ble fraction of total time. The RDTSC fallback, on the other hand, may be so=
 predictable as to be useless.

I would suggest adding a little ChaCha20 DRBG or similar to the KASLR enviro=
nment instead. What crypto primitives are available there?=