new file mode 100644

@@ -0,0 +1,138 @@

+From 0fd09a9a3418124e59cded88699d4c6bcdb811b2 Mon Sep 17 00:00:00 2001

+From: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>

+Date: Tue, 18 Sep 2018 18:33:06 -0700

+Subject: [PATCH] hwrng: rdrand - Add RNG driver based on x86 rdrand

+ instruction

+

+Add a Hardware Random Number Generator driver, which uses the

+rdrand/rdseed instructions available on modern Intel and AMD CPUs.

+

+This can be used to feed the kernel's entropy pool on entropy-starved

+virtual machines.

+

+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>

+---

+ drivers/char/hw_random/Kconfig      | 14 ++++++++

+ drivers/char/hw_random/Makefile     |  1 +

+ drivers/char/hw_random/rdrand-rng.c | 72 +++++++++++++++++++++++++++++++++++++

+ 3 files changed, 87 insertions(+)

+ create mode 100644 drivers/char/hw_random/rdrand-rng.c

+

+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig

+index 95a031e..c7e7ce7 100644

+--- a/drivers/char/hw_random/Kconfig

+@@ -60,6 +60,20 @@ config HW_RANDOM_AMD

+ 

+ 	  If unsure, say Y.

+ 

++config HW_RANDOM_RDRAND

++	tristate "x86 rdrand Random Number Generator support"

++	depends on (X86_32 || X86_64) && ARCH_RANDOM

++	default HW_RANDOM

++	---help---

++	  This driver provides kernel-side support for a Random Number

++	  Generator that uses the RDRAND/RDSEED instructions on modern Intel

++	  and AMD CPUs.

++

++	  To compile this driver as a module, choose M here: the

++	  module will be called rdrand-rng.

++

++	  If unsure, say N.

++

+ config HW_RANDOM_ATMEL

+ 	tristate "Atmel Random Number Generator support"

+ 	depends on ARCH_AT91 && HAVE_CLK && OF

+diff --git a/drivers/char/hw_random/Makefile b/drivers/char/hw_random/Makefile

+index f3728d0..c677d3a 100644

+--- a/drivers/char/hw_random/Makefile

+@@ -8,6 +8,7 @@ rng-core-y := core.o

+ obj-$(CONFIG_HW_RANDOM_TIMERIOMEM) += timeriomem-rng.o

+ obj-$(CONFIG_HW_RANDOM_INTEL) += intel-rng.o

+ obj-$(CONFIG_HW_RANDOM_AMD) += amd-rng.o

++obj-$(CONFIG_HW_RANDOM_RDRAND) += rdrand-rng.o

+ obj-$(CONFIG_HW_RANDOM_ATMEL) += atmel-rng.o

+ obj-$(CONFIG_HW_RANDOM_BCM63XX)	+= bcm63xx-rng.o

+ obj-$(CONFIG_HW_RANDOM_GEODE) += geode-rng.o

+diff --git a/drivers/char/hw_random/rdrand-rng.c b/drivers/char/hw_random/rdrand-rng.c

+new file mode 100644

+index 0000000..ba017f3

+--- /dev/null

+@@ -0,0 +1,72 @@

++// SPDX-License-Identifier: GPL-2.0

++/*

++ * RNG driver that uses the RDRAND/RDSEED instructions (found on modern

++ * Intel and AMD CPUs).

++ *

++ * Author: Srivatsa S. Bhat <srivatsa@csail.mit.edu>

++ *

++ */

++

++#include <linux/hw_random.h>

++#include <linux/kernel.h>

++#include <linux/module.h>

++#include <asm/archrandom.h>

++

++#define PFX	KBUILD_MODNAME ": "

++

++static int rdrand_rng_read(struct hwrng *rng, void *buf, size_t max_bytes, bool wait)

++{

++	char *p = buf;

++	size_t read_bytes = 0;

++

++	while (max_bytes) {

++		unsigned long v;

++		size_t chunk = min(max_bytes, (int)sizeof(unsigned long));

++

++		if (unlikely(!arch_get_random_seed_long(&v)) &&

++		    unlikely(!arch_get_random_long(&v))) {

++			break;

++		}

++

++		memcpy(p, &v, chunk);

++		p += chunk;

++		max_bytes -= chunk;

++		read_bytes += chunk;

++	}

++

++	return read_bytes;

++}

++

++static struct hwrng rdrand_rng = {

++	.name		= KBUILD_MODNAME,

++	.quality	= 1000,

++	.read		= rdrand_rng_read,

++};

++

++static int __init mod_init(void)

++{

++	int err = -ENODEV;

++

++	if (!arch_has_random_seed() && !arch_has_random()) {

++		pr_err(PFX "Neither RDSEED nor RDRAND is available.\n");

++		return err;

++	}

++

++	err = hwrng_register(&rdrand_rng);

++	if (err)

++		pr_err(PFX "RNG registration failed (%d)\n", err);

++

++	return err;

++}

++

++static void __exit mod_exit(void)

++{

++	hwrng_unregister(&rdrand_rng);

++}

++

++module_init(mod_init);

++module_exit(mod_exit);

++

++MODULE_AUTHOR("Srivatsa S. Bhat <srivatsa@csail.mit.edu>");

++MODULE_DESCRIPTION("H/W RNG driver for x86 CPUs that support RDRAND/RDSEED");

++MODULE_LICENSE("GPL");

+-- 

+2.7.4

+

@@ -2738,6 +2738,7 @@ CONFIG_HW_RANDOM=m

 CONFIG_HW_RANDOM_TIMERIOMEM=m

 CONFIG_HW_RANDOM_INTEL=m

 CONFIG_HW_RANDOM_AMD=m

+CONFIG_HW_RANDOM_RDRAND=m

 CONFIG_HW_RANDOM_VIA=m

 CONFIG_HW_RANDOM_VIRTIO=m

 CONFIG_HW_RANDOM_TPM=m

@@ -2510,6 +2510,7 @@ CONFIG_HW_RANDOM=m

 CONFIG_HW_RANDOM_TIMERIOMEM=m

 CONFIG_HW_RANDOM_INTEL=m

 CONFIG_HW_RANDOM_AMD=m

+CONFIG_HW_RANDOM_RDRAND=m

 CONFIG_HW_RANDOM_VIA=m

 CONFIG_HW_RANDOM_VIRTIO=m

 CONFIG_HW_RANDOM_TPM=m

@@ -1976,7 +1976,12 @@ CONFIG_SERIAL_CORE_CONSOLE=y

 # CONFIG_SERIAL_DEV_BUS is not set

 # CONFIG_TTY_PRINTK is not set

 # CONFIG_IPMI_HANDLER is not set

-# CONFIG_HW_RANDOM is not set

+CONFIG_HW_RANDOM=m

+# CONFIG_HW_RANDOM_TIMERIOMEM is not set

+# CONFIG_HW_RANDOM_INTEL is not set

+# CONFIG_HW_RANDOM_AMD is not set

+CONFIG_HW_RANDOM_RDRAND=m

+# CONFIG_HW_RANDOM_VIA is not set

 # CONFIG_NVRAM is not set

 # CONFIG_R3964 is not set

 # CONFIG_APPLICOM is not set

@@ -2551,6 +2556,7 @@ CONFIG_USB_STORAGE=m

 # CONFIG_USB_HSIC_USB3503 is not set

 # CONFIG_USB_HSIC_USB4604 is not set

 # CONFIG_USB_LINK_LAYER_TEST is not set

+# CONFIG_USB_CHAOSKEY is not set

 #

 # USB Physical Layer drivers

@@ -2468,6 +2468,7 @@ CONFIG_HW_RANDOM=m

 CONFIG_HW_RANDOM_TIMERIOMEM=m

 CONFIG_HW_RANDOM_INTEL=m

 CONFIG_HW_RANDOM_AMD=m

+CONFIG_HW_RANDOM_RDRAND=m

 CONFIG_HW_RANDOM_VIA=m

 CONFIG_HW_RANDOM_VIRTIO=m

 CONFIG_HW_RANDOM_TPM=m

@@ -2,7 +2,7 @@

 Summary:        Kernel

 Name:           linux-aws

 Version:        4.14.54

-Release:        3%{?kat_build:.%kat_build}%{?dist}

+Release:        4%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

 Group:        	System Environment/Kernel

@@ -36,6 +36,7 @@ Patch28:        kvm-dont-accept-wrong-gsi-values.patch

 # Out-of-tree patches from AppArmor:

 Patch29:        0001-apparmor-add-base-infastructure-for-socket-mediation.patch

 Patch30:        0002-apparmor-af_unix-mediation.patch

+Patch31:        0001-hwrng-rdrand-Add-RNG-driver-based-on-x86-rdrand-inst.patch

 %if 0%{?kat_build:1}

 Patch1000:	%{kat_build}.patch

@@ -124,6 +125,7 @@ This package contains the 'perf' performance analysis tools for Linux kernel.

 %patch28 -p1

 %patch29 -p1

 %patch30 -p1

+%patch31 -p1

 %if 0%{?kat_build:1}

 %patch1000 -p1

@@ -311,6 +313,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 /usr/share/doc/*

 %changelog

+*   Tue Sep 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-4

+-   Add rdrand-based RNG driver to enhance kernel entropy.

 *   Sun Sep 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-3

 -   Add full retpoline support by building with retpoline-enabled gcc.

 *   Thu Aug 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-2

@@ -2,7 +2,7 @@

 Summary:        Kernel

 Name:           linux-esx

 Version:        4.14.54

-Release:        2%{?dist}

+Release:        3%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

 Group:          System Environment/Kernel

@@ -35,6 +35,7 @@ Patch21:        vmware-balloon-late-initcall.patch

 Patch22:        add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch

 # Fix CVE-2017-1000252

 Patch24:        kvm-dont-accept-wrong-gsi-values.patch

+Patch25:        0001-hwrng-rdrand-Add-RNG-driver-based-on-x86-rdrand-inst.patch

 BuildRequires: bc

@@ -90,6 +91,7 @@ The Linux package contains the Linux kernel doc files

 %patch21 -p1

 %patch22 -p1

 %patch24 -p1

+%patch25 -p1

 %build

 # patch vmw_balloon driver

@@ -186,6 +188,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Tue Sep 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-3

+-   Add rdrand-based RNG driver to enhance kernel entropy.

 *   Sun Sep 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-2

 -   Add full retpoline support by building with retpoline-enabled gcc.

 *   Mon Jul 09 2018 Him Kalyan Bordoloi <bordoloih@vmware.com> 4.14.54-1

@@ -2,7 +2,7 @@

 Summary:        Kernel

 Name:           linux-secure

 Version:        4.14.54

-Release:        3%{?kat_build:.%kat_build}%{?dist}

+Release:        4%{?kat_build:.%kat_build}%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

 Group:          System Environment/Kernel

@@ -35,6 +35,7 @@ Patch31:        kvm-dont-accept-wrong-gsi-values.patch

 # Out-of-tree patches from AppArmor:

 Patch32:        0001-apparmor-add-base-infastructure-for-socket-mediation.patch

 Patch33:        0002-apparmor-af_unix-mediation.patch

+Patch34:        0001-hwrng-rdrand-Add-RNG-driver-based-on-x86-rdrand-inst.patch

 # NSX requirements (should be removed)

 Patch99:        LKCM.patch

@@ -100,6 +101,7 @@ The Linux package contains the Linux kernel doc files

 %patch31 -p1

 %patch32 -p1

 %patch33 -p1

+%patch34 -p1

 pushd ..

 %patch99 -p0

@@ -227,6 +229,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Tue Sep 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-4

+-   Add rdrand-based RNG driver to enhance kernel entropy.

 *   Sun Sep 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-3

 -   Add full retpoline support by building with retpoline-enabled gcc.

 *   Thu Aug 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-2

@@ -2,7 +2,7 @@

 Summary:        Kernel

 Name:           linux

 Version:        4.14.54

-Release:        6%{?kat_build:.%kat_build}%{?dist}

+Release:        7%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

 Group:        	System Environment/Kernel

@@ -44,6 +44,8 @@ Patch28:        kvm-dont-accept-wrong-gsi-values.patch

 # Out-of-tree patches from AppArmor:

 Patch29:        0001-apparmor-add-base-infastructure-for-socket-mediation.patch

 Patch30:        0002-apparmor-af_unix-mediation.patch

+Patch31:        0001-hwrng-rdrand-Add-RNG-driver-based-on-x86-rdrand-inst.patch

+

 %if 0%{?kat_build:1}

 Patch1000:	%{kat_build}.patch

@@ -146,6 +148,7 @@ Kernel Device Tree Blob files for Raspberry Pi3

 %patch28 -p1

 %patch29 -p1

 %patch30 -p1

+%patch31 -p1

 %if 0%{?kat_build:1}

 %patch1000 -p1

@@ -366,6 +369,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 %endif

 %changelog

+*   Tue Sep 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-7

+-   Add rdrand-based RNG driver to enhance kernel entropy.

 *   Sun Sep 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-6

 -   Add full retpoline support by building with retpoline-enabled gcc.

 *   Thu Aug 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.14.54-5

new file mode 100644

@@ -0,0 +1,2 @@

+# Automatically load the following kernel modules on every boot.

+rdrand-rng

@@ -1,7 +1,7 @@

 Summary:          Systemd-239

 Name:             systemd

 Version:          239

-Release:          1%{?dist}

+Release:          2%{?dist}

 License:          LGPLv2+ and GPLv2+ and MIT

 URL:              http://www.freedesktop.org/wiki/Software/systemd/

 Group:            System Environment/Security

@@ -13,6 +13,7 @@ Source1:          99-vmware-hotplug.rules

 Source2:          50-security-hardening.conf

 Source3:          systemd.cfg

 Source4:          99-dhcp-en.network

+Source5:          10-rdrand-rng.conf

 Patch0:           01-enoX-uses-instance-number-for-vmware-hv.patch

 Patch1:           02-install-general-aliases.patch

@@ -133,6 +134,7 @@ rm %{buildroot}/lib/systemd/system/default.target

 ln -sfv multi-user.target %{buildroot}/lib/systemd/system/default.target

 install -dm 0755 %{buildroot}/%{_sysconfdir}/systemd/network

 install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/systemd/network

+install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/modules-load.d

 %find_lang %{name} ../%{name}.lang

 %post

@@ -173,6 +175,7 @@ rm -rf %{buildroot}/*

 %config(noreplace) %{_sysconfdir}/systemd/coredump.conf

 %config(noreplace) %{_sysconfdir}/systemd/timesyncd.conf

 %config(noreplace) %{_sysconfdir}/pam.d/systemd-user

+%config(noreplace) %{_sysconfdir}/modules-load.d/10-rdrand-rng.conf

 %config(noreplace) %{_sysconfdir}/systemd/network/99-dhcp-en.network

 %dir %{_sysconfdir}/udev

@@ -237,6 +240,8 @@ rm -rf %{buildroot}/*

 %files lang -f %{name}.lang

 %changelog

+*    Tue Sep 18 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 239-2

+-    Automatically load rdrand-rng kernel module on every boot.

 *    Tue Aug 28 2018 Anish Swaminathan <anishs@vmware.com>  239-1

 -    Update systemd to 239

 *    Wed Apr 11 2018 Xiaolin Li <xiaolinl@vmware.com>  236-3