From owner-svn-src-all@freebsd.org Fri Nov 22 19:30:31 2019 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B7DA21BF522; Fri, 22 Nov 2019 19:30:31 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47KRNR4PKpz482K; Fri, 22 Nov 2019 19:30:31 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 76CAC43C; Fri, 22 Nov 2019 19:30:31 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id xAMJUVk3086171; Fri, 22 Nov 2019 19:30:31 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id xAMJUVP2086170; Fri, 22 Nov 2019 19:30:31 GMT (envelope-from cem@FreeBSD.org) Message-Id: <201911221930.xAMJUVP2086170@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: Conrad Meyer Date: Fri, 22 Nov 2019 19:30:31 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r355014 - head/sys/dev/random X-SVN-Group: head X-SVN-Commit-Author: cem X-SVN-Commit-Paths: head/sys/dev/random X-SVN-Commit-Revision: 355014 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Nov 2019 19:30:31 -0000 Author: cem Date: Fri Nov 22 19:30:31 2019 New Revision: 355014 URL: https://svnweb.freebsd.org/changeset/base/355014 Log: random/ivy: Provide mechanism to read independent seed values from rdrand On x86 platforms with the intrinsic, rdrand is a deterministic bit generator (AES-CTR) seeded from an entropic source. On x86 platforms with rdseed, it is something closer to the upstream entropic source. (There is more nuance; a block diagram is provided in [1].) On devices with rdrand and without rdseed, there is no good intrinsic for acecssing the good entropic soure directly. However, the DRBG is guaranteed to reseed every 8 kB on these platforms. As a conservative option, on such hardware we can read an extra 7.99kB samples every time we want a sample from an independent seed. As one can imagine, this drastically slows the effective read rate of RDRAND (a factor of 1024 on amd64 and 2048 on ia32). Microbenchmarks on AMD Zen (has RDSEED) show an RDRAND rate of 25 MB/s and Intel Haswell (no RDSEED) show RDRAND of 170 MB/s. This would reduce the read rate on Haswell to ~170 kB/s (at 100% CPU). random(4)'s harvestq thread periodically "feeds" from pure sources in amounts of 128-1024 bytes. On Haswell, enabling this feature increases the CPU time of RDRAND in each "feed" from approximately 0.7-6 µs to 0.7-6 ms. Because there is some performance penalty to this more conservative option, a knob is provided to enable the change. The change does not affect platforms with RDSEED. [1]: https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide#inpage-nav-4-2 Approved by: csprng(delphij, markm) Differential Revision: https://reviews.freebsd.org/D22455 Modified: head/sys/dev/random/ivy.c Modified: head/sys/dev/random/ivy.c ============================================================================== --- head/sys/dev/random/ivy.c Fri Nov 22 18:55:27 2019 (r355013) +++ head/sys/dev/random/ivy.c Fri Nov 22 19:30:31 2019 (r355014) @@ -40,6 +40,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include @@ -59,23 +60,46 @@ static struct random_source random_ivy = { .rs_read = random_ivy_read }; +SYSCTL_NODE(_kern_random, OID_AUTO, rdrand, CTLFLAG_RW, 0, + "rdrand (ivy) entropy source"); +static bool acquire_independent_seed_samples = false; +SYSCTL_BOOL(_kern_random_rdrand, OID_AUTO, rdrand_independent_seed, + CTLFLAG_RWTUN, &acquire_independent_seed_samples, 0, + "If non-zero, use more expensive and slow, but safer, seeded samples " + "where RDSEED is not present."); + static bool x86_rdrand_store(u_long *buf) { - u_long rndval; + u_long rndval, seed_iterations, i; int retry; - retry = RETRY_COUNT; - __asm __volatile( - "1:\n\t" - "rdrand %1\n\t" /* read randomness into rndval */ - "jc 2f\n\t" /* CF is set on success, exit retry loop */ - "dec %0\n\t" /* otherwise, retry-- */ - "jne 1b\n\t" /* and loop if retries are not exhausted */ - "2:" - : "+r" (retry), "=r" (rndval) : : "cc"); + /* Per [1], "§ 5.2.6 Generating Seeds from RDRAND," + * machines lacking RDSEED will guarantee RDRAND is reseeded every 8kB + * of generated output. + * + * [1]: https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide#inpage-nav-6-8 + */ + if (acquire_independent_seed_samples) + seed_iterations = 8 * 1024 / sizeof(*buf); + else + seed_iterations = 1; + + for (i = 0; i < seed_iterations; i++) { + retry = RETRY_COUNT; + __asm __volatile( + "1:\n\t" + "rdrand %1\n\t" /* read randomness into rndval */ + "jc 2f\n\t" /* CF is set on success, exit retry loop */ + "dec %0\n\t" /* otherwise, retry-- */ + "jne 1b\n\t" /* and loop if retries are not exhausted */ + "2:" + : "+r" (retry), "=r" (rndval) : : "cc"); + if (retry == 0) + return (false); + } *buf = rndval; - return (retry != 0); + return (true); } static bool