Home | History | Annotate | Line # | Download | only in kern
subr_cprng.c revision 1.9 
      1 /*	$NetBSD: subr_cprng.c,v 1.9 2012/05/19 16:00:41 tls Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2011 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Thor Lancelot Simon.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/types.h>
     33 #include <sys/time.h>
     34 #include <sys/param.h>
     35 #include <sys/kernel.h>
     36 #include <sys/systm.h>
     37 #include <sys/kmem.h>
     38 #include <sys/mutex.h>
     39 #include <sys/rngtest.h>
     40 #include <sys/rnd.h>
     41 #include <dev/rnd_private.h>
     42 
     43 #if defined(__HAVE_CPU_COUNTER)
     44 #include <machine/cpu_counter.h>
     45 #endif
     46 
     47 #include <sys/cprng.h>
     48 
     49 __KERNEL_RCSID(0, "$NetBSD: subr_cprng.c,v 1.9 2012/05/19 16:00:41 tls Exp $");
     50 
     51 void
     52 cprng_init(void)
     53 {
     54 	nist_ctr_initialize();
     55 }
     56 
     57 static inline uint32_t
     58 cprng_counter(void)
     59 {
     60 	struct timeval tv;
     61 
     62 #if defined(__HAVE_CPU_COUNTER)
     63 	if (cpu_hascounter())
     64 		return cpu_counter32();
     65 #endif
     66 	if (__predict_false(cold)) {
     67 		/* microtime unsafe if clock not running yet */
     68 		return 0;
     69 	}
     70 	microtime(&tv);
     71 	return (tv.tv_sec * 1000000 + tv.tv_usec);
     72 }
     73 
     74 static void
     75 cprng_strong_doreseed(cprng_strong_t *const c)
     76 {
     77 	uint32_t cc = cprng_counter();
     78 
     79 	KASSERT(mutex_owned(&c->mtx));
     80 	KASSERT(mutex_owned(&c->reseed.mtx));
     81 	KASSERT(c->reseed.len == NIST_BLOCK_KEYLEN_BYTES);
     82 
     83 	if (nist_ctr_drbg_reseed(&c->drbg, c->reseed.data, c->reseed.len,
     84 				 &cc, sizeof(cc))) {
     85 		panic("cprng %s: nist_ctr_drbg_reseed failed.", c->name);
     86 	}
     87 #ifdef RND_VERBOSE
     88 	printf("cprng %s: reseeded with rnd_filled = %d\n", c->name,
     89 							    rnd_filled);
     90 #endif
     91 	c->entropy_serial = rnd_filled;
     92 	c->reseed.state = RSTATE_IDLE;
     93 	if (c->flags & CPRNG_USE_CV) {
     94 		cv_broadcast(&c->cv);
     95 	}
     96 	selnotify(&c->selq, 0, 0);
     97 }
     98 
     99 static void
    100 cprng_strong_sched_reseed(cprng_strong_t *const c)
    101 {
    102 	KASSERT(mutex_owned(&c->mtx));
    103 	if (mutex_tryenter(&c->reseed.mtx)) {
    104 		switch (c->reseed.state) {
    105 		    case RSTATE_IDLE:
    106 			c->reseed.state = RSTATE_PENDING;
    107 			c->reseed.len = NIST_BLOCK_KEYLEN_BYTES;
    108 			rndsink_attach(&c->reseed);
    109 			break;
    110 		    case RSTATE_HASBITS:
    111 			/* Just rekey the underlying generator now. */
    112 			cprng_strong_doreseed(c);
    113 			break;
    114 		    case RSTATE_PENDING:
    115 			if (c->entropy_serial != rnd_filled) {
    116 				rndsink_detach(&c->reseed);
    117 				rndsink_attach(&c->reseed);
    118 			}
    119 			break;
    120 		    default:
    121 			panic("cprng %s: bad reseed state %d",
    122 			      c->name, c->reseed.state);
    123 			break;
    124 		}
    125 		mutex_spin_exit(&c->reseed.mtx);
    126 	}
    127 #ifdef RND_VERBOSE
    128 	else {
    129 		printf("cprng %s: skipping sched_reseed, sink busy\n",
    130 		       c->name);
    131 	}
    132 #endif
    133 }
    134 
    135 static void
    136 cprng_strong_reseed(void *const arg)
    137 {
    138 	cprng_strong_t *c = arg;
    139 
    140 	KASSERT(mutex_owned(&c->reseed.mtx));
    141 	KASSERT(RSTATE_HASBITS == c->reseed.state);
    142 
    143 	if (!mutex_tryenter(&c->mtx)) {
    144 #ifdef RND_VERBOSE
    145 	    printf("cprng: sink %s cprng busy, no reseed\n", c->reseed.name);
    146 #endif
    147 	    if (c->flags & CPRNG_USE_CV) {	/* XXX if flags change? */
    148         	cv_broadcast(&c->cv);
    149 	    }
    150 	    return;
    151 	}
    152 
    153 	cprng_strong_doreseed(c);
    154 	mutex_exit(&c->mtx);
    155 }
    156 
    157 cprng_strong_t *
    158 cprng_strong_create(const char *const name, int ipl, int flags)
    159 {
    160 	cprng_strong_t *c;
    161 	uint8_t key[NIST_BLOCK_KEYLEN_BYTES];
    162 	int r, getmore = 0, hard = 0;
    163 	uint32_t cc;
    164 
    165 	c = kmem_alloc(sizeof(*c), KM_NOSLEEP);
    166 	if (c == NULL) {
    167 		return NULL;
    168 	}
    169 	c->flags = flags;
    170 	strlcpy(c->name, name, sizeof(c->name));
    171 	c->reseed.state = RSTATE_IDLE;
    172 	c->reseed.cb = cprng_strong_reseed;
    173 	c->reseed.arg = c;
    174 	c->entropy_serial = rnd_filled;
    175 	mutex_init(&c->reseed.mtx, MUTEX_DEFAULT, IPL_VM);
    176 	strlcpy(c->reseed.name, name, sizeof(c->reseed.name));
    177 
    178 	mutex_init(&c->mtx, MUTEX_DEFAULT, ipl);
    179 
    180 	if (c->flags & CPRNG_USE_CV) {
    181 		cv_init(&c->cv, name);
    182 	}
    183 
    184 	selinit(&c->selq);
    185 
    186 	r = rnd_extract_data(key, sizeof(key), RND_EXTRACT_GOOD);
    187 	if (r != sizeof(key)) {
    188 		if (c->flags & CPRNG_INIT_ANY) {
    189 #ifdef DEBUG
    190 			printf("cprng %s: WARNING insufficient "
    191 			       "entropy at creation.\n", name);
    192 #endif
    193 			rnd_extract_data(key + r, sizeof(key - r),
    194 					 RND_EXTRACT_ANY);
    195 		} else {
    196 			hard++;
    197 		}
    198 		getmore++;
    199 	}
    200 
    201 	if (nist_ctr_drbg_instantiate(&c->drbg, key, sizeof(key),
    202 				      &cc, sizeof(cc), name, strlen(name))) {
    203 		panic("cprng %s: instantiation failed.", name);
    204 	}
    205 
    206 	if (getmore) {
    207 		/* Cause readers to wait for rekeying. */
    208 		if (hard) {
    209 			c->drbg.reseed_counter =
    210 			    NIST_CTR_DRBG_RESEED_INTERVAL + 1;
    211 		} else {
    212 			c->drbg.reseed_counter =
    213 			    (NIST_CTR_DRBG_RESEED_INTERVAL / 2) + 1;
    214 		}
    215 	}
    216 	return c;
    217 }
    218 
    219 size_t
    220 cprng_strong(cprng_strong_t *const c, void *const p, size_t len, int flags)
    221 {
    222 	uint32_t cc = cprng_counter();
    223 #ifdef DEBUG
    224 	int testfail = 0;
    225 #endif
    226 	if (len > CPRNG_MAX_LEN) {	/* XXX should we loop? */
    227 		len = CPRNG_MAX_LEN;	/* let the caller loop if desired */
    228 	}
    229 	mutex_enter(&c->mtx);
    230 
    231 	if (nist_ctr_drbg_generate(&c->drbg, p, len, &cc, sizeof(cc))) {
    232 		/* A generator failure really means we hit the hard limit. */
    233 		if (c->flags & CPRNG_REKEY_ANY) {
    234 			uint8_t key[NIST_BLOCK_KEYLEN_BYTES];
    235 
    236  			printf("cprng %s: WARNING pseudorandom rekeying.\n",
    237 			       c->name);
    238                         rnd_extract_data(key, sizeof(key), RND_EXTRACT_ANY);
    239 			cc = cprng_counter();
    240 			if (nist_ctr_drbg_reseed(&c->drbg, key, sizeof(key),
    241 			    &cc, sizeof(cc))) {
    242 				panic("cprng %s: nist_ctr_drbg_reseed "
    243 				      "failed.", c->name);
    244 			}
    245 		} else {
    246 			int wr;
    247 
    248 			do {
    249 				cprng_strong_sched_reseed(c);
    250 				if ((flags & FNONBLOCK) ||
    251 				    !(c->flags & CPRNG_USE_CV)) {
    252 					len = 0;
    253 					break;
    254 				}
    255 			/*
    256 			 * XXX There's a race with the cv_broadcast
    257 			 * XXX in cprng_strong_sched_reseed, because
    258 			 * XXX of the use of tryenter in that function.
    259 			 * XXX This "timedwait" hack works around it,
    260 			 * XXX at the expense of occasionaly polling
    261 			 * XXX for success on a /dev/random rekey.
    262 			 */
    263 				wr = cv_timedwait_sig(&c->cv, &c->mtx,
    264 						      mstohz(100));
    265 				if (wr == ERESTART) {
    266 					mutex_exit(&c->mtx);
    267 					return 0;
    268 				}
    269 			} while (nist_ctr_drbg_generate(&c->drbg, p,
    270 							len, &cc,
    271 							sizeof(cc)));
    272 		}
    273 	}
    274 
    275 #ifdef DEBUG
    276 	/*
    277 	 * If the generator has just been keyed, perform
    278 	 * the statistical RNG test.
    279 	 */
    280 	if (__predict_false(c->drbg.reseed_counter == 1)) {
    281 		rngtest_t *rt = kmem_alloc(sizeof(*rt), KM_NOSLEEP);
    282 
    283 		if (rt) {
    284 
    285 			strncpy(rt->rt_name, c->name, sizeof(rt->rt_name));
    286 
    287 			if (nist_ctr_drbg_generate(&c->drbg, rt->rt_b,
    288 		  	    sizeof(rt->rt_b), NULL, 0)) {
    289 				panic("cprng %s: nist_ctr_drbg_generate "
    290 				      "failed!", c->name);
    291 
    292 			}
    293 			testfail = rngtest(rt);
    294 
    295 			if (testfail) {
    296 				printf("cprng %s: failed statistical RNG "
    297 				       "test.\n", c->name);
    298 				c->drbg.reseed_counter =
    299 				    NIST_CTR_DRBG_RESEED_INTERVAL + 1;
    300 				len = 0;
    301 			}
    302 			memset(rt, 0, sizeof(*rt));
    303 			kmem_free(rt, sizeof(*rt));
    304 		}
    305 	}
    306 #endif
    307 	if (__predict_false(c->drbg.reseed_counter >
    308 			     (NIST_CTR_DRBG_RESEED_INTERVAL / 2))) {
    309 		cprng_strong_sched_reseed(c);
    310 	} else if (rnd_full) {
    311 		if (c->entropy_serial != rnd_filled) {
    312 #ifdef RND_VERBOSE
    313 			printf("cprng %s: reseeding from full pool "
    314 			       "(serial %d vs pool %d)\n", c->name,
    315 			       c->entropy_serial, rnd_filled);
    316 #endif
    317 			cprng_strong_sched_reseed(c);
    318 		}
    319 	}
    320 
    321 	mutex_exit(&c->mtx);
    322 	return len;
    323 }
    324 
    325 void
    326 cprng_strong_destroy(cprng_strong_t *c)
    327 {
    328 	mutex_enter(&c->mtx);
    329 	mutex_spin_enter(&c->reseed.mtx);
    330 
    331 	if (c->flags & CPRNG_USE_CV) {
    332 		KASSERT(!cv_has_waiters(&c->cv));
    333 		cv_destroy(&c->cv);
    334 	}
    335 	seldestroy(&c->selq);
    336 
    337 	if (RSTATE_PENDING == c->reseed.state) {
    338 		rndsink_detach(&c->reseed);
    339 	}
    340 	mutex_spin_exit(&c->reseed.mtx);
    341 	mutex_destroy(&c->reseed.mtx);
    342 
    343 	nist_ctr_drbg_destroy(&c->drbg);
    344 
    345 	mutex_exit(&c->mtx);
    346 	mutex_destroy(&c->mtx);
    347 
    348 	memset(c, 0, sizeof(*c));
    349 	kmem_free(c, sizeof(*c));
    350 }
    351 
    352 int
    353 cprng_strong_getflags(cprng_strong_t *const c)
    354 {
    355 	KASSERT(mutex_owned(&c->mtx));
    356 	return c->flags;
    357 }
    358 
    359 void
    360 cprng_strong_setflags(cprng_strong_t *const c, int flags)
    361 {
    362 	KASSERT(mutex_owned(&c->mtx));
    363 	if (flags & CPRNG_USE_CV) {
    364 		if (!(c->flags & CPRNG_USE_CV)) {
    365 			cv_init(&c->cv, (const char *)c->name);
    366 		}
    367 	} else {
    368 		if (c->flags & CPRNG_USE_CV) {
    369 			KASSERT(!cv_has_waiters(&c->cv));
    370 			cv_destroy(&c->cv);
    371 		}
    372 	}
    373 	if (flags & CPRNG_REKEY_ANY) {
    374 		if (!(c->flags & CPRNG_REKEY_ANY)) {
    375 			if (c->flags & CPRNG_USE_CV) {
    376 				cv_broadcast(&c->cv);
    377 			}
    378 			selnotify(&c->selq, 0, 0);
    379 		}
    380 	}
    381 	c->flags = flags;
    382 }
    383