OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/scripts
History
Emese Revfy 38addce8b6 gcc-plugins: Add latent_entropy plugin 
This adds a new gcc plugin named "latent_entropy". It is designed to
extract as much possible uncertainty from a running system at boot time as
possible, hoping to capitalize on any possible variation in CPU operation
(due to runtime data differences, hardware differences, SMP ordering,
thermal timing variation, cache behavior, etc).

At the very least, this plugin is a much more comprehensive example for
how to manipulate kernel code using the gcc plugin internals.

The need for very-early boot entropy tends to be very architecture or
system design specific, so this plugin is more suited for those sorts
of special cases. The existing kernel RNG already attempts to extract
entropy from reliable runtime variation, but this plugin takes the idea to
a logical extreme by permuting a global variable based on any variation
in code execution (e.g. a different value (and permutation function)
is used to permute the global based on loop count, case statement,
if/then/else branching, etc).

To do this, the plugin starts by inserting a local variable in every
marked function. The plugin then adds logic so that the value of this
variable is modified by randomly chosen operations (add, xor and rol) and
random values (gcc generates separate static values for each location at
compile time and also injects the stack pointer at runtime). The resulting
value depends on the control flow path (e.g., loops and branches taken).

Before the function returns, the plugin mixes this local variable into
the latent_entropy global variable. The value of this global variable
is added to the kernel entropy pool in do_one_initcall() and _do_fork(),
though it does not credit any bytes of entropy to the pool; the contents
of the global are just used to mix the pool.

Additionally, the plugin can pre-initialize arrays with build-time
random contents, so that two different kernel builds running on identical
hardware will not have the same starting values.

Signed-off-by: Emese Revfy <re.emese@gmail.com>
[kees: expanded commit message and code comments]
Signed-off-by: Kees Cook <keescook@chromium.org>
 		2016-10-10 14:51:44 -07:00
..
basic scripts: Fix size mismatch of kexec_purgatory_size 2016-07-22 14:05:40 +02:00
coccinelle scripts/coccinelle: require coccinelle >= 1.0.4 on device_node_continue.cocci 2016-07-22 12:13:39 +02:00
dtc scripts/dtc: dt_to_config - kernel config options for a devicetree 2016-07-22 14:48:16 -05:00
gcc-plugins gcc-plugins: Add latent_entropy plugin 2016-10-10 14:51:44 -07:00
gdb Revert "scripts/gdb: add a Radix Tree Parser" 2016-07-15 14:54:27 +09:00
genksyms scripts: genksyms: fix resource leak 2016-04-20 09:24:49 +02:00
kconfig Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2016-05-26 22:27:09 -07:00
ksymoops Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
mod staging: fsl-mc: add support for device table matching 2016-06-26 17:14:03 -07:00
package builddeb: Skip gcc-plugins when not configured 2016-08-16 10:16:38 +02:00
selinux selinux: explicitly declare the role "base_r" 2015-07-13 13:32:00 -04:00
tracing kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
.gitignore KEYS: Reserve an extra certificate symbol for inserting without recompiling 2016-02-26 15:30:20 +00:00
Kbuild.include kbuild: no gcc-plugins during cc-option tests 2016-08-08 17:49:05 -07:00
Lindent scripts/Lindent: handle missing indent gracefully 2015-09-04 16:54:41 -07:00
Makefile GCC plugin infrastructure 2016-06-07 22:57:10 +02:00
Makefile.asm-generic kbuild: Remove stale asm-generic wrappers 2016-07-07 15:58:45 +02:00
Makefile.build Shared library support 2016-06-07 22:57:10 +02:00
Makefile.clean Shared library support 2016-06-07 22:57:10 +02:00
Makefile.dtbinst dtbsinstall: don't move target directory out of the way 2016-01-28 11:40:32 +01:00
Makefile.extrawarn kbuild: move -Wunused-const-variable to W=1 warning level 2016-05-11 13:05:40 +02:00
Makefile.fwinst kbuild: include $(src)/Makefile rather than $(obj)/Makefile 2015-04-02 16:42:08 +02:00
Makefile.gcc-plugins gcc-plugins: Add latent_entropy plugin 2016-10-10 14:51:44 -07:00
Makefile.headersinst kbuild: collect shorthands into scripts/Kbuild.include 2014-11-26 14:36:52 +01:00
Makefile.help Add a target to use the Coccinelle checker 2010-06-12 00:00:29 +02:00
Makefile.host Shared library support 2016-06-07 22:57:10 +02:00
Makefile.kasan arm64: add KASAN support 2015-10-12 17:46:36 +01:00
Makefile.lib Merge branch 'akpm' (patches from Andrew) 2016-08-02 21:08:07 -04:00
Makefile.modbuiltin kbuild: Create output directory in Makefile.modbuiltin 2010-06-10 12:23:08 +02:00
Makefile.modinst modsign: Abort modules_install when signing fails 2015-08-07 16:26:13 +01:00
Makefile.modpost modpost: Add flag -E for making section mismatches fatal 2015-10-06 10:46:21 +10:30
Makefile.modsign modsign: lookup lines ending in .ko in .mod files 2014-08-27 21:54:11 +09:30
Makefile.ubsan Disable "maybe-uninitialized" warning globally 2016-07-27 13:17:41 -07:00
adjust_autoksyms.sh kbuild: fix adjust_autoksyms.sh for modules that need only one symbol 2016-05-10 17:25:29 +02:00
analyze_suspend.py PM / tools: scripts: AnalyzeSuspend v4.2 2016-07-15 23:34:14 +02:00
asn1_compiler.c ASN.1: fix open failure check on headername 2016-04-06 14:06:48 +01:00
bloat-o-meter scripts/bloat-o-meter: fix percent on <1% changes 2016-07-26 16:19:19 -07:00
bootgraph.pl kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
check-lc_ctype.c DocBook: Use a fixed encoding for output 2015-09-28 01:31:48 -06:00
check_extable.sh scripts: add check_extable.sh script. 2015-04-13 21:03:02 +09:30
checkincludes.pl checkincludes: fix perlcritic warnings 2010-03-07 21:19:57 +01:00
checkkconfigsymbols.py checkkconfigsymbols.py: Fix typo in help message 2016-05-01 14:11:12 -07:00
checkpatch.pl treewide: remove references to the now unnecessary DEFINE_PCI_DEVICE_TABLE 2016-09-01 17:52:01 -07:00
checkstack.pl Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2014-10-07 21:16:26 -04:00
checksyscalls.sh x86/asm/entry: Move the arch/x86/syscalls/ definitions to arch/x86/entry/syscalls/ 2015-06-04 07:37:37 +02:00
checkversion.pl kbuild: don't warn about include/linux/version.h not including itself 2011-04-29 15:38:55 +02:00
cleanfile scripts: Make cleanfile/cleanpatch warn about long lines 2007-07-16 21:15:50 +02:00
cleanpatch scripts: Make cleanfile/cleanpatch warn about long lines 2007-07-16 21:15:50 +02:00
coccicheck coccicheck: refer to Documentation/coccinelle.txt and wiki 2016-07-22 12:13:39 +02:00
config kbuild: trivial - remove trailing empty lines 2014-06-10 00:04:06 +02:00
conmakehash.c kbuild: trivial - remove trailing spaces 2014-04-30 17:34:32 +02:00
decode_stacktrace.sh scripts/decode_stacktrace.sh: handle symbols in modules 2016-05-19 19:12:14 -07:00
decodecode scripts/decodecode: make faulting insn ptr more robust 2013-04-29 15:54:27 -07:00
depmod.sh depmod: pass -P $CONFIG_SYMBOL_PREFIX 2013-02-22 11:52:31 +01:00
diffconfig vfs,ext2: remove CONFIG_EXT2_FS_XIP and rename CONFIG_FS_XIP to CONFIG_FS_DAX 2015-02-16 17:56:04 -08:00
docproc.c docproc: print a comment about autogeneration for rst output 2016-05-14 09:56:56 -06:00
export_report.pl kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
extract-cert.c KEYS: Remove unnecessary header #inclusions from extract-cert.c 2015-09-25 16:31:45 +01:00
extract-ikconfig scripts/extract-ikconfig: Support LZ4-compressed images. 2015-04-15 14:01:12 +02:00
extract-module-sig.pl KEYS: Provide a script to extract a module signature 2015-10-21 15:18:36 +01:00
extract-sys-certs.pl KEYS: Use the symbol value for list size, updated by scripts/insert-sys-cert 2016-02-26 15:32:05 +00:00
extract-vmlinux scripts: add extract-vmlinux 2011-08-31 16:12:17 +02:00
extract_xc3028.pl [media] extract_xc3028.pl: move it to scripts/dir 2016-07-17 14:08:12 -03:00
faddr2line scripts/faddr2line: improve on base path filtering a bit 2016-09-19 14:49:08 -07:00
gcc-goto.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
gcc-ld kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
gcc-plugin.sh gcc-plugins: abort builds cleanly when not supported 2016-08-08 17:49:05 -07:00
gcc-version.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
gcc-x86_32-has-stack-protector.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
gcc-x86_64-has-stack-protector.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
gen_initramfs_list.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
get_dvb_firmware [media] doc-rst: move DVB avulse docs to Documentation/media 2016-07-17 14:02:45 -03:00
get_maintainer.pl get_maintainer: quiet noisy implicit -f vcs_file_exists checking 2016-08-26 17:39:34 -07:00
gfp-translate chmod +x scripts/gfp-translate 2012-06-27 12:44:29 -07:00
headerdep.pl headerdep: perlcritic warning 2010-03-23 12:26:38 +01:00
headers.sh CRIS: Fix headers_install 2014-12-20 00:01:12 +01:00
headers_check.pl headers_check: don't warn about c++ guards 2016-05-24 14:12:48 +10:00
headers_install.sh Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2014-10-14 09:22:26 +02:00
insert-sys-cert.c KEYS: Reserve an extra certificate symbol for inserting without recompiling 2016-02-26 15:30:20 +00:00
kallsyms.c ARM: 8553/1: kallsyms: remove --page-offset command line option 2016-04-07 21:57:16 +01:00
kernel-doc doc-rst: kernel-doc: fix a change introduced by mistake 2016-07-23 08:04:21 -03:00
kernel-doc-xml-ref scripts/kernel-doc: Adding cross-reference links to html documentation. 2015-08-16 22:11:16 -06:00
ld-version.sh ld-version: Drop the 4th and 5th version components 2016-05-13 14:02:05 +02:00
link-vmlinux.sh GCC plugin infrastructure 2016-06-07 22:57:10 +02:00
makelst kbuild: introduce ccflags-y, asflags-y and ldflags-y 2007-10-15 22:25:06 +02:00
markup_oops.pl kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
mkcompile_h kbuild: trivial - remove trailing spaces 2014-04-30 17:34:32 +02:00
mkmakefile kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
mksysmap mksysmap: Add h8300 local symbol pattern 2015-06-23 13:35:47 +09:00
mkuboot.sh mkuboot.sh: Fail if mkimage is missing 2011-01-07 14:31:01 +01:00
mkversion Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
module-common.lds kernel: add support for .init_array.* constructors 2015-02-13 21:21:42 -08:00
namespace.pl kallsyms: add support for relative offsets in kallsyms address table 2016-03-15 16:55:16 -07:00
objdiff scripts: objdiff: support directories for the augument of record command 2014-06-10 14:59:33 +02:00
patch-kernel kbuild: trivial - remove trailing spaces 2014-04-30 17:34:32 +02:00
pnmtologo.c kbuild: trivial - remove trailing empty lines 2014-06-10 00:04:06 +02:00
profile2linkerlist.pl kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00
prune-kernel scripts: add "prune-kernel" script to clean up old kernel images 2016-02-09 10:09:52 -08:00
recordmcount.c scripts/recordmcount.c: account for .softirqentry.text 2016-09-28 16:19:02 -07:00
recordmcount.h recordmcount: Fix endianness handling bug for nop_mcount 2015-11-03 10:45:26 -05:00
recordmcount.pl scripts/recordmcount.c: account for .softirqentry.text 2016-09-28 16:19:02 -07:00
setlocalversion kbuild: setlocalversion: print error to STDERR 2016-06-20 17:37:45 +02:00
show_delta kbuild: trivial - remove trailing empty lines 2014-06-10 00:04:06 +02:00
sign-file.c modsign: Make sign-file determine the format of the X.509 cert 2016-06-14 13:18:33 +01:00
sortextable.c parisc: Use generic extable search and sort routines 2016-03-23 16:00:46 +01:00
sortextable.h scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized 2014-10-14 02:18:23 +02:00
spelling.txt scripts/spelling.txt: add "fimware" misspelling 2016-05-19 19:12:14 -07:00
stackdelta scripts: add stackdelta script 2015-08-28 17:04:40 +02:00
stackusage scripts: add stackusage script 2015-08-28 17:04:40 +02:00
tags.sh treewide: remove references to the now unnecessary DEFINE_PCI_DEVICE_TABLE 2016-09-01 17:52:01 -07:00
unifdef.c unifdef: update to upstream version 2.5 2011-01-22 15:50:59 +01:00
ver_linux scripts: fix typo in ver_linux 2016-02-07 23:01:45 -08:00
xen-hypercalls.sh xen: build infrastructure for generating hypercall depending symbols 2015-03-16 14:49:13 +00:00
xz_wrap.sh kbuild: Make scripts executable 2014-08-20 16:03:45 +02:00