[efi] Add EFI entropy source

Originally-implemented-by: Jarrod Johnson <jbjohnso@us.ibm.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/arch/x86/include/bits/errfile.h b/src/arch/x86/include/bits/errfile.h
index 9ca849d52fa1768d3d4275a016c809b2df114e7c..6afeb73f3900664e3a83366b69a7d420672fd599 100644 (file)
--- a/src/arch/x86/include/bits/errfile.h
+++ b/src/arch/x86/include/bits/errfile.h
@@ -50,6 +50,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #define ERRFILE_cpuid_cmd      ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00000000 )
 #define ERRFILE_cpuid_settings ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00010000 )
+#define ERRFILE_efi_entropy    ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00020000 )
 
 /** @} */
 

diff --git a/src/arch/x86/interface/efi/efi_entropy.c b/src/arch/x86/interface/efi/efi_entropy.c
new file mode 100644 (file)
index 0000000..54d61e9
--- /dev/null
+++ b/src/arch/x86/interface/efi/efi_entropy.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2015 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <errno.h>
+#include <ipxe/entropy.h>
+#include <ipxe/efi/efi.h>
+
+/** @file
+ *
+ * EFI entropy source
+ *
+ */
+
+/** Time (in 100ns units) to delay waiting for timer tick
+ *
+ * In theory, UEFI allows us to specify a trigger time of zero to
+ * simply wait for the next timer tick.  In practice, specifying zero
+ * seems to often return immediately, which produces almost no
+ * entropy.  Specify a delay of 1000ns to try to force an existent
+ * delay.
+ */
+#define EFI_ENTROPY_TRIGGER_TIME 10
+
+/** Event used to wait for timer tick */
+static EFI_EVENT tick;
+
+/**
+ * Enable entropy gathering
+ *
+ * @ret rc             Return status code
+ */
+static int efi_entropy_enable ( void ) {
+       EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
+       EFI_STATUS efirc;
+       int rc;
+
+       /* Create timer tick event */
+       if ( ( efirc = bs->CreateEvent ( EVT_TIMER, TPL_NOTIFY, NULL, NULL,
+                                        &tick ) ) != 0 ) {
+               rc = -EEFI ( efirc );
+               DBGC ( &tick, "ENTROPY could not create event: %s\n",
+                      strerror ( rc ) );
+               return rc;
+       }
+
+       return 0;
+}
+
+/**
+ * Disable entropy gathering
+ *
+ */
+static void efi_entropy_disable ( void ) {
+       EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
+
+       /* Close timer tick event */
+       bs->CloseEvent ( tick );
+}
+
+/**
+ * Wait for an RTC tick
+ *
+ * @ret low            TSC low-order bits, or negative error
+ */
+static int efi_entropy_tick ( void ) {
+       EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
+       UINTN index;
+       uint16_t low;
+       uint32_t discard_d;
+       EFI_STATUS efirc;
+       int rc;
+
+       /* Wait for next timer tick */
+       if ( ( efirc = bs->SetTimer ( tick, TimerRelative,
+                                     EFI_ENTROPY_TRIGGER_TIME ) ) != 0 ) {
+               rc = -EEFI ( efirc );
+               DBGC ( &tick, "ENTROPY could not set timer: %s\n",
+                      strerror ( rc ) );
+               return rc;
+       }
+       if ( ( efirc = bs->WaitForEvent ( 1, &tick, &index ) ) != 0 ) {
+               rc = -EEFI ( efirc );
+               DBGC ( &tick, "ENTROPY could not wait for timer tick: %s\n",
+                      strerror ( rc ) );
+               return rc;
+       }
+
+       /* Get current TSC low-order bits */
+       __asm__ __volatile__ ( "rdtsc" : "=a" ( low ), "=d" ( discard_d ) );
+
+       return low;
+}
+
+/**
+ * Get noise sample
+ *
+ * @ret noise          Noise sample
+ * @ret rc             Return status code
+ */
+static int efi_get_noise ( noise_sample_t *noise ) {
+       int before;
+       int after;
+       int rc;
+
+       /* Wait for a timer tick */
+       before = efi_entropy_tick();
+       if ( before < 0 ) {
+               rc = before;
+               return rc;
+       }
+
+       /* Wait for another timer tick */
+       after = efi_entropy_tick();
+       if ( after < 0 ) {
+               rc = after;
+               return rc;
+       }
+
+       /* Use TSC delta as noise sample */
+       *noise = ( after - before );
+
+       return 0;
+}
+
+PROVIDE_ENTROPY_INLINE ( efi, min_entropy_per_sample );
+PROVIDE_ENTROPY ( efi, entropy_enable, efi_entropy_enable );
+PROVIDE_ENTROPY ( efi, entropy_disable, efi_entropy_disable );
+PROVIDE_ENTROPY ( efi, get_noise, efi_get_noise );

diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h
index 4276d9366c02e489a0c0563aec64212be17e855b..7b7777daec2d241d4ec1fb8dfc102a882fb50ae6 100644 (file)
--- a/src/config/defaults/efi.h
+++ b/src/config/defaults/efi.h
@@ -7,7 +7,7 @@
  *
  */
 
-FILE_LICENCE ( GPL2_OR_LATER );
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #define UACCESS_EFI
 #define IOAPI_X86
@@ -19,7 +19,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #define SMBIOS_EFI
 #define SANBOOT_NULL
 #define BOFM_EFI
-#define ENTROPY_NULL
+#define ENTROPY_EFI
 #define TIME_NULL
 #define REBOOT_EFI
 

diff --git a/src/include/ipxe/efi/efi_entropy.h b/src/include/ipxe/efi/efi_entropy.h
new file mode 100644 (file)
index 0000000..39a6673
--- /dev/null
+++ b/src/include/ipxe/efi/efi_entropy.h
@@ -0,0 +1,35 @@
+#ifndef _IPXE_EFI_ENTROPY_H
+#define _IPXE_EFI_ENTROPY_H
+
+/** @file
+ *
+ * EFI entropy source
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+
+#ifdef ENTROPY_EFI
+#define ENTROPY_PREFIX_efi
+#else
+#define ENTROPY_PREFIX_efi __efi_
+#endif
+
+/**
+ * min-entropy per sample
+ *
+ * @ret min_entropy    min-entropy of each sample
+ */
+static inline __always_inline double
+ENTROPY_INLINE ( efi, min_entropy_per_sample ) ( void ) {
+
+       /* We use essentially the same mechanism as for the BIOS
+        * RTC-based entropy source, and so assume the same
+        * min-entropy per sample.
+        */
+       return 1.3;
+}
+
+#endif /* _IPXE_EFI_ENTROPY_H */

diff --git a/src/include/ipxe/entropy.h b/src/include/ipxe/entropy.h
index a9dcb29cb7279a2b0faa3802be93628904e23f4a..beeb3abfabfdf8cf8545f35c79c5891c057ec61b 100644 (file)
--- a/src/include/ipxe/entropy.h
+++ b/src/include/ipxe/entropy.h
@@ -54,6 +54,7 @@ typedef uint8_t entropy_sample_t;
 
 /* Include all architecture-independent entropy API headers */
 #include <ipxe/null_entropy.h>
+#include <ipxe/efi/efi_entropy.h>
 #include <ipxe/linux/linux_entropy.h>
 
 /* Include all architecture-dependent entropy API headers */