random: remove cacheline alignment for locks

[linux-2.6] / drivers / char / random.c

diff --git a/drivers/char/random.c b/drivers/char/random.c
index a2329a11e1393c9aa17ed85b201d2b677ae79dd0..973706e97e7756911fdbee21d14dde498d883be7 100644 (file)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -395,7 +395,7 @@ module_param(debug, bool, 0644);
 
 struct entropy_store;
 struct entropy_store {
-       /* mostly-read data: */
+       /* read-only data: */
        struct poolinfo *poolinfo;
        __u32 *pool;
        const char *name;
@@ -403,7 +403,7 @@ struct entropy_store {
        struct entropy_store *pull;
 
        /* read-write data: */
-       spinlock_t lock ____cacheline_aligned_in_smp;
+       spinlock_t lock;
        unsigned add_ptr;
        int entropy_count;
        int input_rotate;
@@ -765,42 +765,42 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
 static void extract_buf(struct entropy_store *r, __u8 *out)
 {
        int i;
-       __u32 data[16], buf[5 + SHA_WORKSPACE_WORDS];
+       __u32 extract[16], hash[5], workspace[SHA_WORKSPACE_WORDS];
+
+       /* Generate a hash across the pool, 16 words (512 bits) at a time */
+       sha_init(hash);
+       for (i = 0; i < r->poolinfo->poolwords; i += 16)
+               sha_transform(hash, (__u8 *)(r->pool + i), workspace);
 
-       sha_init(buf);
        /*
-        * As we hash the pool, we mix intermediate values of
-        * the hash back into the pool.  This eliminates
-        * backtracking attacks (where the attacker knows
-        * the state of the pool plus the current outputs, and
-        * attempts to find previous ouputs), unless the hash
-        * function can be inverted.
+        * We mix the hash back into the pool to prevent backtracking
+        * attacks (where the attacker knows the state of the pool
+        * plus the current outputs, and attempts to find previous
+        * ouputs), unless the hash function can be inverted. By
+        * mixing at least a SHA1 worth of hash data back, we make
+        * brute-forcing the feedback as hard as brute-forcing the
+        * hash.
         */
-       for (i = 0; i < r->poolinfo->poolwords; i += 16) {
-               /* hash blocks of 16 words = 512 bits */
-               sha_transform(buf, (__u8 *)(r->pool + i), buf + 5);
-               /* feed back portion of the resulting hash */
-               add_entropy_words(r, &buf[i % 5], 1);
-       }
+       __add_entropy_words(r, hash, 5, extract);
 
        /*
-        * To avoid duplicates, we atomically extract a
-        * portion of the pool while mixing, and hash one
-        * final time.
+        * To avoid duplicates, we atomically extract a portion of the
+        * pool while mixing, and hash one final time.
         */
-       __add_entropy_words(r, &buf[i % 5], 1, data);
-       sha_transform(buf, (__u8 *)data, buf + 5);
+       sha_transform(hash, (__u8 *)extract, workspace);
+       memset(extract, 0, sizeof(extract));
+       memset(workspace, 0, sizeof(workspace));
 
        /*
-        * In case the hash function has some recognizable
-        * output pattern, we fold it in half.
+        * In case the hash function has some recognizable output
+        * pattern, we fold it in half. Thus, we always feed back
+        * twice as much data as we output.
         */
-
-       buf[0] ^= buf[3];
-       buf[1] ^= buf[4];
-       buf[2] ^= rol32(buf[2], 16);
-       memcpy(out, buf, EXTRACT_SIZE);
-       memset(buf, 0, sizeof(buf));
+       hash[0] ^= hash[3];
+       hash[1] ^= hash[4];
+       hash[2] ^= rol32(hash[2], 16);
+       memcpy(out, hash, EXTRACT_SIZE);
+       memset(hash, 0, sizeof(hash));
 }
 
 static ssize_t extract_entropy(struct entropy_store *r, void *buf,