Home | History | Annotate | Line # | Download | only in kern
subr_cprng.c revision 1.4.2.2 
      1 /*	$NetBSD: subr_cprng.c,v 1.4.2.2 2012/04/29 23:05:05 mrg Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2011 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Thor Lancelot Simon.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/types.h>
     33 #include <sys/time.h>
     34 #include <sys/param.h>
     35 #include <sys/kernel.h>
     36 #include <sys/systm.h>
     37 #include <sys/kmem.h>
     38 #include <sys/mutex.h>
     39 #include <sys/rngtest.h>
     40 #include <sys/rnd.h>
     41 #include <dev/rnd_private.h>
     42 
     43 #if defined(__HAVE_CPU_COUNTER)
     44 #include <machine/cpu_counter.h>
     45 #endif
     46 
     47 #include <sys/cprng.h>
     48 
     49 __KERNEL_RCSID(0, "$NetBSD: subr_cprng.c,v 1.4.2.2 2012/04/29 23:05:05 mrg Exp $");
     50 
     51 void
     52 cprng_init(void)
     53 {
     54 	nist_ctr_initialize();
     55 }
     56 
     57 static inline uint32_t
     58 cprng_counter(void)
     59 {
     60 	struct timeval tv;
     61 
     62 #if defined(__HAVE_CPU_COUNTER)
     63 	if (cpu_hascounter())
     64 		return cpu_counter32();
     65 #endif
     66 	if (__predict_false(cold)) {
     67 		/* microtime unsafe if clock not running yet */
     68 		return 0;
     69 	}
     70 	microtime(&tv);
     71 	return (tv.tv_sec * 1000000 + tv.tv_usec);
     72 }
     73 
     74 static void
     75 cprng_strong_doreseed(cprng_strong_t *const c)
     76 {
     77 	uint32_t cc = cprng_counter();
     78 
     79 	KASSERT(mutex_owned(&c->mtx));
     80 	KASSERT(mutex_owned(&c->reseed.mtx));
     81 	KASSERT(c->reseed.len == NIST_BLOCK_KEYLEN_BYTES);
     82 
     83 	if (nist_ctr_drbg_reseed(&c->drbg, c->reseed.data, c->reseed.len,
     84 				 &cc, sizeof(cc))) {
     85 		panic("cprng %s: nist_ctr_drbg_reseed failed.", c->name);
     86 	}
     87 #ifdef RND_VERBOSE
     88 	printf("cprng %s: reseeded with rnd_filled = %d\n", c->name,
     89 							    rnd_filled);
     90 #endif
     91 	c->entropy_serial = rnd_filled;
     92 	c->reseed.state = RSTATE_IDLE;
     93 	if (c->flags & CPRNG_USE_CV) {
     94 		cv_broadcast(&c->cv);
     95 	}
     96 	selnotify(&c->selq, 0, 0);
     97 }
     98 
     99 static void
    100 cprng_strong_sched_reseed(cprng_strong_t *const c)
    101 {
    102 	KASSERT(mutex_owned(&c->mtx));
    103 	if (mutex_tryenter(&c->reseed.mtx)) {
    104 		switch (c->reseed.state) {
    105 		    case RSTATE_IDLE:
    106 			c->reseed.state = RSTATE_PENDING;
    107 			c->reseed.len = NIST_BLOCK_KEYLEN_BYTES;
    108 			rndsink_attach(&c->reseed);
    109 			break;
    110 		    case RSTATE_HASBITS:
    111 			/* Just rekey the underlying generator now. */
    112 			cprng_strong_doreseed(c);
    113 			break;
    114 		    case RSTATE_PENDING:
    115 			if (c->entropy_serial != rnd_filled) {
    116 				rndsink_detach(&c->reseed);
    117 				rndsink_attach(&c->reseed);
    118 			}
    119 			break;
    120 		    default:
    121 			panic("cprng %s: bad reseed state %d",
    122 			      c->name, c->reseed.state);
    123 			break;
    124 		}
    125 		mutex_spin_exit(&c->reseed.mtx);
    126 	}
    127 #ifdef RND_VERBOSE
    128 	else {
    129 		printf("cprng %s: skipping sched_reseed, sink busy\n",
    130 		       c->name);
    131 	}
    132 #endif
    133 }
    134 
    135 static void
    136 cprng_strong_reseed(void *const arg)
    137 {
    138 	cprng_strong_t *c = arg;
    139 
    140 	KASSERT(mutex_owned(&c->reseed.mtx));
    141 	KASSERT(RSTATE_HASBITS == c->reseed.state);
    142 
    143 	if (!mutex_tryenter(&c->mtx)) {
    144 #ifdef RND_VERBOSE
    145 	    printf("cprng: sink %s cprng busy, no reseed\n", c->reseed.name);
    146 #endif
    147 	    return;
    148 	}
    149 
    150 	cprng_strong_doreseed(c);
    151 	mutex_exit(&c->mtx);
    152 }
    153 
    154 cprng_strong_t *
    155 cprng_strong_create(const char *const name, int ipl, int flags)
    156 {
    157 	cprng_strong_t *c;
    158 	uint8_t key[NIST_BLOCK_KEYLEN_BYTES];
    159 	int r, getmore = 0, hard = 0;
    160 	uint32_t cc;
    161 
    162 	c = kmem_alloc(sizeof(*c), KM_NOSLEEP);
    163 	if (c == NULL) {
    164 		return NULL;
    165 	}
    166 	c->flags = flags;
    167 	strlcpy(c->name, name, sizeof(c->name));
    168 	c->reseed.state = RSTATE_IDLE;
    169 	c->reseed.cb = cprng_strong_reseed;
    170 	c->reseed.arg = c;
    171 	c->entropy_serial = rnd_filled;
    172 	mutex_init(&c->reseed.mtx, MUTEX_DEFAULT, IPL_VM);
    173 	strlcpy(c->reseed.name, name, sizeof(c->reseed.name));
    174 
    175 	mutex_init(&c->mtx, MUTEX_DEFAULT, ipl);
    176 
    177 	if (c->flags & CPRNG_USE_CV) {
    178 		cv_init(&c->cv, name);
    179 	}
    180 
    181 	selinit(&c->selq);
    182 
    183 	r = rnd_extract_data(key, sizeof(key), RND_EXTRACT_GOOD);
    184 	if (r != sizeof(key)) {
    185 		if (c->flags & CPRNG_INIT_ANY) {
    186 #ifdef DEBUG
    187 			printf("cprng %s: WARNING insufficient "
    188 			       "entropy at creation.\n", name);
    189 #endif
    190 			rnd_extract_data(key + r, sizeof(key - r),
    191 					 RND_EXTRACT_ANY);
    192 		} else {
    193 			hard++;
    194 		}
    195 		getmore++;
    196 	}
    197 
    198 	if (nist_ctr_drbg_instantiate(&c->drbg, key, sizeof(key),
    199 				      &cc, sizeof(cc), name, strlen(name))) {
    200 		panic("cprng %s: instantiation failed.", name);
    201 	}
    202 
    203 	if (getmore) {
    204 		/* Cause readers to wait for rekeying. */
    205 		if (hard) {
    206 			c->drbg.reseed_counter =
    207 			    NIST_CTR_DRBG_RESEED_INTERVAL + 1;
    208 		} else {
    209 			c->drbg.reseed_counter =
    210 			    (NIST_CTR_DRBG_RESEED_INTERVAL / 2) + 1;
    211 		}
    212 	}
    213 	return c;
    214 }
    215 
    216 size_t
    217 cprng_strong(cprng_strong_t *const c, void *const p, size_t len, int flags)
    218 {
    219 	uint32_t cc = cprng_counter();
    220 #ifdef DEBUG
    221 	int testfail = 0;
    222 #endif
    223 	if (len > CPRNG_MAX_LEN) {	/* XXX should we loop? */
    224 		len = CPRNG_MAX_LEN;	/* let the caller loop if desired */
    225 	}
    226 	mutex_enter(&c->mtx);
    227 
    228 	if (nist_ctr_drbg_generate(&c->drbg, p, len, &cc, sizeof(cc))) {
    229 		/* A generator failure really means we hit the hard limit. */
    230 		if (c->flags & CPRNG_REKEY_ANY) {
    231 			uint8_t key[NIST_BLOCK_KEYLEN_BYTES];
    232 
    233  			printf("cprng %s: WARNING pseudorandom rekeying.\n",
    234 			       c->name);
    235                         rnd_extract_data(key, sizeof(key), RND_EXTRACT_ANY);
    236 			cc = cprng_counter();
    237 			if (nist_ctr_drbg_reseed(&c->drbg, key, sizeof(key),
    238 			    &cc, sizeof(cc))) {
    239 				panic("cprng %s: nist_ctr_drbg_reseed "
    240 				      "failed.", c->name);
    241 			}
    242 		} else {
    243 			if (!(flags & FNONBLOCK) &&
    244 			     (c->flags & CPRNG_USE_CV)) {
    245 				int wr;
    246 
    247 				cprng_strong_sched_reseed(c);
    248 				do {
    249 					wr = cv_wait_sig(&c->cv, &c->mtx);
    250 					if (wr == ERESTART) {
    251 						mutex_exit(&c->mtx);
    252 						return 0;
    253 					}
    254 				} while (nist_ctr_drbg_generate(&c->drbg, p,
    255 								len, &cc,
    256 								sizeof(cc)));
    257 			} else {
    258 				len = 0;
    259 			}
    260 		}
    261 	}
    262 
    263 #ifdef DEBUG
    264 	/*
    265 	 * If the generator has just been keyed, perform
    266 	 * the statistical RNG test.
    267 	 */
    268 	if (__predict_false(c->drbg.reseed_counter == 1)) {
    269 		rngtest_t *rt = kmem_alloc(sizeof(*rt), KM_NOSLEEP);
    270 
    271 		if (rt) {
    272 
    273 			strncpy(rt->rt_name, c->name, sizeof(rt->rt_name));
    274 
    275 			if (nist_ctr_drbg_generate(&c->drbg, rt->rt_b,
    276 		  	    sizeof(rt->rt_b), NULL, 0)) {
    277 				panic("cprng %s: nist_ctr_drbg_generate "
    278 				      "failed!", c->name);
    279 
    280 			}
    281 			testfail = rngtest(rt);
    282 
    283 			if (testfail) {
    284 				printf("cprng %s: failed statistical RNG "
    285 				       "test.\n", c->name);
    286 				c->drbg.reseed_counter =
    287 				    NIST_CTR_DRBG_RESEED_INTERVAL + 1;
    288 				len = 0;
    289 			}
    290 			memset(rt, 0, sizeof(*rt));
    291 			kmem_free(rt, sizeof(*rt));
    292 		}
    293 	}
    294 #endif
    295 	if (__predict_false(c->drbg.reseed_counter >
    296 			     (NIST_CTR_DRBG_RESEED_INTERVAL / 2))) {
    297 		cprng_strong_sched_reseed(c);
    298 	} else if (rnd_full) {
    299 		if (c->entropy_serial != rnd_filled) {
    300 #ifdef RND_VERBOSE
    301 			printf("cprng %s: reseeding from full pool "
    302 			       "(serial %d vs pool %d)\n", c->name,
    303 			       c->entropy_serial, rnd_filled);
    304 #endif
    305 			cprng_strong_sched_reseed(c);
    306 		}
    307 	}
    308 
    309 	mutex_exit(&c->mtx);
    310 	return len;
    311 }
    312 
    313 void
    314 cprng_strong_destroy(cprng_strong_t *c)
    315 {
    316 	mutex_enter(&c->mtx);
    317 	mutex_spin_enter(&c->reseed.mtx);
    318 
    319 	if (c->flags & CPRNG_USE_CV) {
    320 		KASSERT(!cv_has_waiters(&c->cv));
    321 		cv_destroy(&c->cv);
    322 	}
    323 	seldestroy(&c->selq);
    324 
    325 	if (RSTATE_PENDING == c->reseed.state) {
    326 		rndsink_detach(&c->reseed);
    327 	}
    328 	mutex_spin_exit(&c->reseed.mtx);
    329 	mutex_destroy(&c->reseed.mtx);
    330 
    331 	nist_ctr_drbg_destroy(&c->drbg);
    332 
    333 	mutex_exit(&c->mtx);
    334 	mutex_destroy(&c->mtx);
    335 
    336 	memset(c, 0, sizeof(*c));
    337 	kmem_free(c, sizeof(*c));
    338 }
    339 
    340 int
    341 cprng_strong_getflags(cprng_strong_t *const c)
    342 {
    343 	KASSERT(mutex_owned(&c->mtx));
    344 	return c->flags;
    345 }
    346 
    347 void
    348 cprng_strong_setflags(cprng_strong_t *const c, int flags)
    349 {
    350 	KASSERT(mutex_owned(&c->mtx));
    351 	if (flags & CPRNG_USE_CV) {
    352 		if (!(c->flags & CPRNG_USE_CV)) {
    353 			cv_init(&c->cv, (const char *)c->name);
    354 		}
    355 	} else {
    356 		if (c->flags & CPRNG_USE_CV) {
    357 			KASSERT(!cv_has_waiters(&c->cv));
    358 			cv_destroy(&c->cv);
    359 		}
    360 	}
    361 	if (flags & CPRNG_REKEY_ANY) {
    362 		if (!(c->flags & CPRNG_REKEY_ANY)) {
    363 			if (c->flags & CPRNG_USE_CV) {
    364 				cv_broadcast(&c->cv);
    365 			}
    366 			selnotify(&c->selq, 0, 0);
    367 		}
    368 	}
    369 	c->flags = flags;
    370 }
    371