On Fri, May 31, 2024 at 04:06:37PM -0700, Andy Lutomirski wrote: > > On May 28, 2024, at 5:25 AM, Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > > > > Provide a generic C vDSO getrandom() implementation, which operates on > > an opaque state returned by vgetrandom_alloc() and produces random bytes > > the same way as getrandom(). This has a the API signature: > > > > ssize_t vgetrandom(void *buffer, size_t len, unsigned int flags, void *opaque_state); > > > +/** > > + * type vdso_kernel_ulong - unsigned long type that matches kernel's unsigned long > > + * > > + * Data shared between userspace and the kernel must operate the same way in both 64-bit code and in > > + * 32-bit compat code, over the same potentially 64-bit kernel. This type represents the size of an > > + * unsigned long as used by kernel code. This isn't necessarily the same as an unsigned long as used > > + * by userspace, however. > > Why is this better than using plain u64? It’s certainly more > complicated. It also rather fundamentally breaks CRIU on 32-bit > userspace (although CRIU may well be unable to keep vgetrandom working > after a restore onto a different kernel anyway). Admittedly 32-bit > userspace is a slowly dying breed, but still. That came out of this conversation: https://lore.kernel.org/all/878rjs7mcx.fsf@xxxxxxxxxxxxxxxxxxxxxxxx/ (And I'd like single instruction increments, which means long, not u64 on 32-bit machines.) > > +{ > > + ssize_t ret = min_t(size_t, INT_MAX & PAGE_MASK /* = MAX_RW_COUNT */, len); > > + struct vgetrandom_state *state = opaque_state; > > + size_t batch_len, nblocks, orig_len = len; > > + unsigned long current_generation; > > + void *orig_buffer = buffer; > > + u32 counter[2] = { 0 }; > > + bool in_use, have_retried = false; > > + > > + /* The state must not straddle a page, since pages can be zeroed at any time. */ > > + if (unlikely(((unsigned long)opaque_state & ~PAGE_MASK) + sizeof(*state) > PAGE_SIZE)) > > + goto fallback_syscall; > > This is weird. Either the provided pointer is valid or it isn’t. > Reasonable outcomes are a segfault if the pointer is bad or success > (or fallback if needed for some reason) if the pointer is good. Why > is there specific code to catch a specific sort of pointer screwup > here? I guess I could make it return -EFAULT in this case, rather than silently succeeding. Jason
