1 /* 2 * Copyright (c) 2012 Alex Hornung <alex@alexhornung.com>. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in 13 * the documentation and/or other materials provided with the 14 * distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 18 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 19 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 20 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, 22 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 26 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 #include <sys/param.h> 30 #include <sys/systm.h> 31 #include <sys/kernel.h> 32 #include <sys/kobj.h> 33 #include <sys/libkern.h> 34 #include <sys/module.h> 35 #include <sys/bus.h> 36 #include <sys/random.h> 37 #include <sys/malloc.h> 38 #include <sys/sysctl.h> 39 40 #include <machine/specialreg.h> 41 42 /* 43 * WARNING! 44 * 45 * The RDRAND instruction is a very slow instruction, burning approximately 46 * 0.79uS per 64-bit word on a modern ryzen cpu. Intel cpu's run this 47 * instruction far more quickly. The quality of the results are unknown 48 * either way. The add_buffer_randomness() call is also not cheap. 49 * 50 * Our code harvests at a 10hz rate on every single core, and also chains 51 * some entropy from core to core so honestly it doesn't take much to really 52 * mix things up. Use a decent size (16 or 32 bytes should be good). 53 */ 54 #define RDRAND_ALIGN(p) (void *)(roundup2((uintptr_t)(p), 16)) 55 #define RDRAND_SIZE 16 56 57 static int rdrand_debug; 58 SYSCTL_INT(_debug, OID_AUTO, rdrand, CTLFLAG_RW, &rdrand_debug, 0, 59 "Enable rdrand debugging"); 60 61 struct rdrand_softc { 62 struct callout *sc_rng_co; 63 int32_t sc_rng_ticks; 64 }; 65 66 67 static void rdrand_rng_harvest(void *); 68 int rdrand_rng(uint8_t *out, long limit); 69 70 71 static void 72 rdrand_identify(driver_t *drv, device_t parent) 73 { 74 75 /* NB: order 10 is so we get attached after h/w devices */ 76 if (device_find_child(parent, "rdrand", -1) == NULL && 77 BUS_ADD_CHILD(parent, parent, 10, "rdrand", -1) == 0) 78 panic("rdrand: could not attach"); 79 } 80 81 82 static int 83 rdrand_probe(device_t dev) 84 { 85 86 if ((cpu_feature2 & CPUID2_RDRAND) == 0) { 87 device_printf(dev, "No RdRand support.\n"); 88 return (EINVAL); 89 } 90 91 device_set_desc(dev, "RdRand RNG"); 92 return 0; 93 } 94 95 96 static int 97 rdrand_attach(device_t dev) 98 { 99 struct rdrand_softc *sc; 100 int i; 101 102 sc = device_get_softc(dev); 103 104 if (hz > 10) 105 sc->sc_rng_ticks = hz / 10; 106 else 107 sc->sc_rng_ticks = 1; 108 109 sc->sc_rng_co = kmalloc(ncpus * sizeof(*sc->sc_rng_co), 110 M_TEMP, M_WAITOK | M_ZERO); 111 112 for (i = 0; i < ncpus; ++i) { 113 callout_init_mp(&sc->sc_rng_co[i]); 114 callout_reset_bycpu(&sc->sc_rng_co[i], sc->sc_rng_ticks, 115 rdrand_rng_harvest, sc, i); 116 } 117 118 return 0; 119 } 120 121 122 static int 123 rdrand_detach(device_t dev) 124 { 125 struct rdrand_softc *sc; 126 int i; 127 128 sc = device_get_softc(dev); 129 130 for (i = 0; i < ncpus; ++i) { 131 callout_terminate(&sc->sc_rng_co[i]); 132 } 133 134 return (0); 135 } 136 137 138 static void 139 rdrand_rng_harvest(void *arg) 140 { 141 struct rdrand_softc *sc = arg; 142 uint8_t randomness[RDRAND_SIZE + 32]; 143 uint8_t *arandomness; /* randomness aligned */ 144 int cnt; 145 146 arandomness = RDRAND_ALIGN(randomness); 147 148 cnt = rdrand_rng(arandomness, RDRAND_SIZE); 149 if (cnt > 0 && cnt < sizeof(randomness)) { 150 add_buffer_randomness_src(arandomness, cnt, 151 RAND_SRC_RDRAND | 152 RAND_SRCF_PCPU); 153 154 if (rdrand_debug > 0) { 155 --rdrand_debug; 156 kprintf("rdrand(%d,cpu=%d): %02x %02x %02x %02x...\n", 157 cnt, mycpu->gd_cpuid, 158 arandomness[0], 159 arandomness[1], 160 arandomness[2], 161 arandomness[3]); 162 } 163 } 164 165 callout_reset(&sc->sc_rng_co[mycpu->gd_cpuid], sc->sc_rng_ticks, 166 rdrand_rng_harvest, sc); 167 } 168 169 170 static device_method_t rdrand_methods[] = { 171 DEVMETHOD(device_identify, rdrand_identify), 172 DEVMETHOD(device_probe, rdrand_probe), 173 DEVMETHOD(device_attach, rdrand_attach), 174 DEVMETHOD(device_detach, rdrand_detach), 175 176 DEVMETHOD_END 177 }; 178 179 180 static driver_t rdrand_driver = { 181 "rdrand", 182 rdrand_methods, 183 sizeof(struct rdrand_softc), 184 }; 185 186 static devclass_t rdrand_devclass; 187 188 DRIVER_MODULE(rdrand, nexus, rdrand_driver, rdrand_devclass, NULL, NULL); 189 MODULE_VERSION(rdrand, 1); 190 MODULE_DEPEND(rdrand, crypto, 1, 1, 1); 191