H. Peter Anvin [Tue, 4 Mar 2014 23:24:39 +0000 (15:24 -0800)]
rdrand: Enable the RDSEED instruction
Enable the use of the RDSEED instruction. Since RDSEED can more
easily be starved of entropy due to use on other threads, allow it to
fall back to RDRAND by having a function which for every RDSEED
failure executes RDRAND and stores a sample in a separate buffer.
The RDRAND buffer and its high water mark are made static so that they
can accumulate data across multiple invocations.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Tue, 4 Mar 2014 23:04:40 +0000 (15:04 -0800)]
rdrand: Fix the RDRAND data reduction
The RDRAND data reduction function was not correct. Specifically:
1. When using AESni, in order to guarantee at least one reseed event
per reduction stripe we need to process the data in a different
order. This means writing it out all the data to a buffer before
processing it, and then process it in much larger stripes.
2. When using gcrypt, we are only performing one reduction at a time,
so only process enough input for one reduction and only generate
that amount of output.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Tue, 4 Mar 2014 22:55:38 +0000 (14:55 -0800)]
rdrand: Simplify by changing x86_rdrand_nlong to x86_rdrand_bytes
Make the code simpler by making x86_rdrand_nlong instead take a count
in bytes and return the number of bytes written (the latter will
matter for upcoming RDSEED enabling.)
The function may still round up the size of the output buffer to a 4-
or 8-byte boundary.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Tue, 4 Mar 2014 22:49:10 +0000 (14:49 -0800)]
rngd_rdrand: Support compiling for x32 by adding unative_t
On the x32 ABI for x86-64, sizeof(long) == 4, but we still use the
8-byte randomness instructions and flags. In order to support
compilation for x32, introduce a new type "unative_t" which is
typedef'd to the appropriate type for the architecture.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Tue, 25 Feb 2014 05:49:58 +0000 (21:49 -0800)]
rdrand_asm.S: On x86-64 we have enough registers, avoid repeated loads
On x86-64 there are enough registers that there really is no point in
using a repeated memory operand for the key material. Load it into a
register instead, hopefully it will be slightly faster.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Mon, 24 Feb 2014 22:01:49 +0000 (14:01 -0800)]
rngd_rdrand: Don't use a fixed AES key for data reduction
If we're going to run the data through AES anyway, there is no point
in using the same key every time. Grab a key from /dev/urandom,
although of course it is unknown how much entropy actually *is* in
/dev/urandom at this point, it is presumably better than nothing,
which is what we have now and XOR with rdrand output.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Mon, 24 Feb 2014 21:35:48 +0000 (13:35 -0800)]
rngd_rdrand: Code style cleanups
Break up the code into smaller functions for readability, make the
code conform a little closer to Linux standard, and try to reduce the
number of #ifdefs.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:41 +0000 (14:31 -0700)]
rngd: As long as FIPS error rates are low, re-try the same source
Allow for a small number of FIPS errors before advancing to the
next source. This prevents a high bandwidth source from stalling
out by shifting to a low bandwidth source (e.g. DRNG->TPM) just
because of a single FIPS failure. FIPS failures are frequent
enough (1:1250) that this happens on a regular basis.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:40 +0000 (14:31 -0700)]
rngd: Initialize RNGs in order of preference
The DRNG entropy source, if present, is going to be orders of
magnitudes faster than most other sources, so initialize it
first so that it shows up first in the list.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:39 +0000 (14:31 -0700)]
rngd: Allow up to a 1:1000 false error rate on FIPS tests
The FIPS tests have a measured false positive error rate of
approximately 1:1250. In order to not permanently disable a
functioning random number source under high traffic, allow
one failure per 1000 successful blocks.
However, never allow more than 25 subsequent failures; this is
handled by not allowing the failures counter to go below zero.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:38 +0000 (14:31 -0700)]
rngd: don't open the TPM if hwrng is available
If /dev/hwrng is avaiable, do not open the TPM. Newer kernels export
TPM randomness via /dev/hwrng; this properly handles multiplexing of
the TPM so that we don't interfere with TrouSerS. Thus, we don't want
to open /dev/tpm0 if we can open /dev/hwrng.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:36 +0000 (14:31 -0700)]
rngd_rdrand: Actually perform the correct AES data reduction
The pointers were confused in such a way that the AES data reduction
wasn't actually being performed. Furthermore, architecturally we need
a 512:1 data reduction, rather than 128:1. Finally, initialize the IV
to random value during startup and remove some unnecessary buffer
shuffling.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:35 +0000 (14:31 -0700)]
drng: Move DRNG code to a separate file and make safe on non-x86
Move all the DRNG code to a separate file, and make sure it is
properly stubbed out on non-x86. Furthermore, fix the CPUID bits we
check for; in particular we need AES-ni for the whitening code.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Mon, 30 Jul 2012 21:48:09 +0000 (14:48 -0700)]
Change the default device from /dev/hw_random to /dev/hwrng
Change the default device name for the hardware random number device
from /dev/hw_random to /dev/hwrng, which is the filename documented in
devices.txt and appears to be the device name created by udev and
devtmpfs.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Mon, 30 Jul 2012 21:42:36 +0000 (14:42 -0700)]
rngd_linux: Modify write_wakeup_threshold to the fill threshold
The kernel.random.write_wakeup_threshold sysctl needs to be set to the
point where we want poll() on the random device to wake up. This
replaces the level check in ioctl() used during polling.
Set it by default to 3/4 to the value of kernel.random.poolsize.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Brad Hill [Tue, 17 Jul 2012 23:50:40 +0000 (19:50 -0400)]
Added -q and -v flags, updated help and man page
-q and --quiet flags to suppress error messages from rngd.c
-v and --verbose flags to list available entropy sources
help and man page reflect these changes and have minor fixes
projects / thirdparty / rng-tools.git / log
