upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

random/ivy: Provide mechanism to read independent seed values from rdrand

Browse source 
On x86 platforms with the intrinsic, rdrand is a deterministic bit generator
(AES-CTR) seeded from an entropic source.  On x86 platforms with rdseed, it
is something closer to the upstream entropic source.  (There is more nuance;
a block diagram is provided in [1].)

On devices with rdrand and without rdseed, there is no good intrinsic for
acecssing the good entropic soure directly.  However, the DRBG is guaranteed
to reseed every 8 kB on these platforms.  As a conservative option, on such
hardware we can read an extra 7.99kB samples every time we want a sample
from an independent seed.

As one can imagine, this drastically slows the effective read rate of
RDRAND (a factor of 1024 on amd64 and 2048 on ia32).  Microbenchmarks on AMD
Zen (has RDSEED) show an RDRAND rate of 25 MB/s and Intel Haswell (no
RDSEED) show RDRAND of 170 MB/s.  This would reduce the read rate on Haswell
to ~170 kB/s (at 100% CPU).  random(4)'s harvestq thread periodically
"feeds" from pure sources in amounts of 128-1024 bytes.  On Haswell,
enabling this feature increases the CPU time of RDRAND in each "feed" from
approximately 0.7-6 µs to 0.7-6 ms.

Because there is some performance penalty to this more conservative option,
a knob is provided to enable the change.  The change does not affect
platforms with RDSEED.

[1]: https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide#inpage-nav-4-2

Approved by:	csprng(delphij, markm)
Differential Revision:	https://reviews.freebsd.org/D22455
This commit is contained in:
Conrad Meyer 2019-11-22 19:30:31 +00:00
parent 7e8baf37e0
commit cb285f7c7c
1 changed files with 35 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
sys/dev/random/ivy.c
View file

@ -40,6 +40,7 @@ __FBSDID("$FreeBSD$");
#include <sys/malloc.h>
#include <sys/module.h>
#include <sys/random.h>
#include <sys/sysctl.h>
#include <sys/systm.h>
#include <machine/md_var.h>
@ -59,23 +60,46 @@ static struct random_source random_ivy = {
.rs_read = random_ivy_read
};
SYSCTL_NODE(_kern_random, OID_AUTO, rdrand, CTLFLAG_RW, 0,
"rdrand (ivy) entropy source");
static bool acquire_independent_seed_samples = false;
SYSCTL_BOOL(_kern_random_rdrand, OID_AUTO, rdrand_independent_seed,
CTLFLAG_RWTUN, &acquire_independent_seed_samples, 0,
"If non-zero, use more expensive and slow, but safer, seeded samples "
"where RDSEED is not present.");
static bool
x86_rdrand_store(u_long *buf)
{
u_long rndval;
u_long rndval, seed_iterations, i;
int retry;
retry = RETRY_COUNT;
__asm __volatile(
"1:\n\t"
"rdrand %1\n\t" /* read randomness into rndval */
"jc 2f\n\t" /* CF is set on success, exit retry loop */
"dec %0\n\t" /* otherwise, retry-- */
"jne 1b\n\t" /* and loop if retries are not exhausted */
"2:"
: "+r" (retry), "=r" (rndval) : : "cc");
/* Per [1], "§ 5.2.6 Generating Seeds from RDRAND,"
* machines lacking RDSEED will guarantee RDRAND is reseeded every 8kB
* of generated output.
*
* [1]: https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide#inpage-nav-6-8
*/
if (acquire_independent_seed_samples)
seed_iterations = 8 * 1024 / sizeof(*buf);
else
seed_iterations = 1;
for (i = 0; i < seed_iterations; i++) {
retry = RETRY_COUNT;
__asm __volatile(
"1:\n\t"
"rdrand %1\n\t" /* read randomness into rndval */
"jc 2f\n\t" /* CF is set on success, exit retry loop */
"dec %0\n\t" /* otherwise, retry-- */
"jne 1b\n\t" /* and loop if retries are not exhausted */
"2:"
: "+r" (retry), "=r" (rndval) : : "cc");
if (retry == 0)
return (false);
}
*buf = rndval;
return (retry != 0);
return (true);
}
static bool