On May 29, 2018 9:58:10 AM PDT, Prarit Bhargava <pra...@redhat.com> wrote: > > >On 05/29/2018 12:07 PM, Theodore Y. Ts'o wrote: >> On Tue, May 29, 2018 at 11:01:07AM -0400, Prarit Bhargava wrote: >>> Kees, in early boot no pool is available so the stack canary is >initialized from >>> the TSC. Later in boot, the stack canary will use the the crng. >>> >>> ie) in early boot only TSC is okay, and late boot (when crng_ready() >is true) >>> the pool will be used. >> >> But that means all of the kernel threads (e.g., workqueues, et. al) >> would not be well protected by the stack canary. That >> seems.... rather unfortunate. > >Well, as stated the TSC is used as a source of entropy in early boot. >It's >always been that way and get_random_bytes() AFAICT has always returned >0. CPUs >added later on via hotplug do use get_random_bytes(). > >Does anyone cc'd have a better idea on how to get another source of >entropy this >early in boot? > >P. > >> >> - Ted >>
RDRAND/RDSEED for newer x86 processors. -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
