usr/src/uts/sun4v/io/n2rng/n2rng_provider.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/sysmacros.h>
  27 #include <sys/modctl.h>
  28 #include <sys/conf.h>
  29 #include <sys/devops.h>
  30 #include <sys/cmn_err.h>
  31 #include <sys/kmem.h>
  32 #include <sys/stat.h>
  33 #include <sys/open.h>
  34 #include <sys/file.h>
  35 #include <sys/cpuvar.h>
  36 #include <sys/disp.h>
  37 #include <sys/hsvc.h>
  38 #include <sys/machsystm.h>
  39 #include <sys/ksynch.h>
  40 #include <sys/hypervisor_api.h>
  41 #include <sys/n2rng.h>
  42 #include <sys/sha1.h>
  43 #include <sys/ddi.h>  /* near end to get min and max macros right */
  44 #include <sys/sunddi.h>
  45 #include <rng/fips_random.h>
  46
  47 /* n must be a power of 2 */
  48 #define ROUNDUP(k, n)           (((k) + (n) - 1) & ~((n) - 1))
  49
  50 /*
  51  * Policy.  ENTROPY_STARVATION is the maximum number of calls each
  52  * FIPS instance will accept without successfully getting more
  53  * entropy.  It needs to be large enough to allow RNG operations to
  54  * not stall because of health checks, etc.  But we don't want it too
  55  * large.  FIPS 186-2 change 1 (5 October 2001) states that no more
  56  * that 2,000,000 DSA signatures (done using this algorithm) should be
  57  * done without reseeding.  We make sure we add 64 bits of entropy at
  58  * most every 10000 operations, hence we will have stirred in 160 bits
  59  * of entropy at most once every 30000 operations.  Normally, we stir
  60  * in 64 bits of entropy for every number generated.
  61  */
  62 #define ENTROPY_STARVATION      10000ULL
  63
  64
  65 int
  66 fips_random(n2rng_t *n2rng, uint8_t *out, size_t nbytes)
  67 {
  68         int                     i;
  69         fipsrandomstruct_t      *frsp;
  70         int                     rv;
  71         union {
  72                 uint32_t        as32[SHA1WORDS];
  73                 uint64_t        as64[ROUNDUP(SHA1WORDS, 2) >> 1];
  74         } entropy = {0};
  75         uint32_t                tempout[SHA1WORDS];
  76
  77
  78         for (i = 0; i < nbytes; i += SHA1BYTES) {
  79                 frsp = &n2rng->n_frs.fipsarray[
  80                     atomic_inc_32_nv(&n2rng->n_frs.fips_round_robin_j) %
  81                     N2RNG_FIPS_INSTANCES];
  82                 /*
  83                  * Since in the new scheme of things, the RNG latency
  84                  * will be high on reads after the first, we get just
  85                  * one word of entropy per call.
  86                  */
  87                 if ((rv = n2rng_getentropy(n2rng, (void *)&entropy.as64[1],
  88                     sizeof (uint64_t))) != 0) {
  89
  90                         /*
  91                          * If all rngs have failed, dispatch task to unregister
  92                          * from kcf and put the driver in an error state.  If
  93                          * recoverable errors persist, a configuration retry
  94                          * will be initiated.
  95                          */
  96                         if (rv == EPERM) {
  97                                 n2rng_failure(n2rng);
  98                                 return (EIO);
  99                         }
 100                         /* Failure with possible recovery */
 101                         entropy.as64[1] = 0;
 102                 }
 103
 104                 /*
 105                  * The idea here is that a Niagara2 chip is highly
 106                  * parallel, with many strands.  If we have just one
 107                  * instance of the FIPS data, then only one FIPS
 108                  * computation can happen at a time, serializeing all
 109                  * the RNG stuff.  So we make N2RNG_FIPS_INSTANCES,
 110                  * and use them round-robin, with the counter being
 111                  * n2rng->n_frs.fips_round_robin_j.  We increment the
 112                  * counter with an atomic op, avoiding having to have
 113                  * a global muxtex.  The atomic ops are also
 114                  * significantly faster than mutexes.  The mutex is
 115                  * put inside the loop, otherwise one thread reading
 116                  * many blocks could stall all other strands.
 117                  */
 118                 frsp = &n2rng->n_frs.fipsarray[
 119                     atomic_inc_32_nv(&n2rng->n_frs.fips_round_robin_j) %
 120                     N2RNG_FIPS_INSTANCES];
 121
 122                 mutex_enter(&frsp->mtx);
 123
 124                 if (entropy.as64[1] == 0) {
 125                         /*
 126                          * If we did not get any entropy, entropyword
 127                          * is zero.  We get a false positive with
 128                          * probablitity 2^-64.  It's not worth a few
 129                          * extra stores and tests eliminate the false
 130                          * positive.
 131                          */
 132                         if (++frsp->entropyhunger > ENTROPY_STARVATION) {
 133                                 mutex_exit(&frsp->mtx);
 134                                 n2rng_unconfigured(n2rng);
 135                                 return (EIO);
 136                         }
 137                 } else {
 138                         frsp->entropyhunger = 0;
 139                 }
 140
 141                 /* nbytes - i is bytes to go */
 142                 fips_random_inner(frsp->XKEY, tempout, entropy.as32);
 143
 144                 bcopy(tempout, &out[i], min(nbytes - i, SHA1BYTES));
 145
 146                 mutex_exit(&frsp->mtx);
 147         }
 148
 149         /* Zeroize sensitive information */
 150
 151         entropy.as64[1] = 0;
 152         bzero(tempout, SHA1BYTES);
 153
 154         return (0);
 155 }
 156
 157 /*
 158  * Initializes one FIPS RNG instance.  Must be called once for each
 159  * instance.
 160  */
 161 int
 162 n2rng_fips_random_init(n2rng_t *n2rng, fipsrandomstruct_t *frsp)
 163 {
 164         /*
 165          * All FIPS-approved algorithms will operate as cryptograpic
 166          * quality PRNGs even if there is no entropy source.  (In
 167          * fact, this the only one that accepts entropy on the fly.)
 168          * One motivation for this is that they system keeps on
 169          * delivering cryptographic quality random numbers, even if
 170          * the entropy source fails.
 171          */
 172
 173         int rv;
 174         static uint32_t FIPS_RNG_NO_USER_INPUT[] = {0, 0, 0, 0, 0};
 175
 176         rv = n2rng_getentropy(n2rng, (void *)frsp->XKEY, ROUNDUP(SHA1BYTES, 8));
 177         if (rv) {
 178                 return (rv);
 179         }
 180         frsp->entropyhunger = 0;
 181         mutex_init(&frsp->mtx, NULL, MUTEX_DRIVER, NULL);
 182
 183         /* compute the first (compare only) random value */
 184         fips_random_inner(frsp->XKEY, frsp->x_jminus1, FIPS_RNG_NO_USER_INPUT);
 185
 186         return (0);
 187 }
 188
 189 void
 190 n2rng_fips_random_fini(fipsrandomstruct_t *frsp)
 191 {
 192         mutex_destroy(&frsp->mtx);
 193         /*
 194          * Zeroise fips data.  Not really necessary, since the
 195          * algorithm has backtracking resistance, but do it anyway.
 196          */
 197         bzero(frsp, sizeof (fipsrandomstruct_t));
 198 }