Re: [RFC PATCH 03/11] x86/boot: Allow a "silent" kaslr random byte fetch

[Andy Lutomirski]

> On Feb 5, 2020, at 2:39 PM, Kristen Carlson Accardi <kristen@xxxxxxxxxxxxxxx> wrote:
> 
> ïFrom: Kees Cook <keescook@xxxxxxxxxxxx>
> 
> Under earlyprintk, each RNG call produces a debug report line. When
> shuffling hundreds of functions, this is not useful information (each
> line is identical and tells us nothing new). Instead, allow for a NULL
> "purpose" to suppress the debug reporting.

Have you counted how many RDRAND calls this causes?  RDRAND is exceedingly slow on all CPUs Iâve looked at. The whole âRDRAND has great bandwidthâ marketing BS actually means that it has decent bandwidth if all CPUs hammer it at the same time. The latency is abysmal.  I have asked Intel to improve this, but the latency of that request will be quadrillions of cycles :)

It wouldnât shock me if just the RDRAND calls account for a respectable fraction of total time. The RDTSC fallback, on the other hand, may be so predictable as to be useless.

I would suggest adding a little ChaCha20 DRBG or similar to the KASLR environment instead. What crypto primitives are available there?