nehemiah.c revision 240135 
1/*-
2 * Copyright (c) 2004 Mark R V Murray
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer
10 *    in this position and unchanged.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 *
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD: head/sys/dev/random/nehemiah.c 240135 2012-09-05 13:18:51Z kib $");
30
31#include "opt_cpu.h"
32
33#ifdef PADLOCK_RNG
34
35#include <sys/param.h>
36#include <sys/time.h>
37#include <sys/lock.h>
38#include <sys/mutex.h>
39#include <sys/selinfo.h>
40#include <sys/systm.h>
41
42#include <machine/pcb.h>
43
44#include <dev/random/randomdev.h>
45
46#define RANDOM_BLOCK_SIZE	256
47#define CIPHER_BLOCK_SIZE	16
48
49static void random_nehemiah_init(void);
50static void random_nehemiah_deinit(void);
51static int random_nehemiah_read(void *, int);
52
53struct random_systat random_nehemiah = {
54	.ident = "Hardware, VIA Nehemiah",
55	.init = random_nehemiah_init,
56	.deinit = random_nehemiah_deinit,
57	.read = random_nehemiah_read,
58	.write = (random_write_func_t *)random_null_func,
59	.reseed = (random_reseed_func_t *)random_null_func,
60	.seeded = 1,
61};
62
63union VIA_ACE_CW {
64	uint64_t raw;
65	struct {
66		u_int round_count : 4;
67		u_int algorithm_type : 3;
68		u_int key_generation_type : 1;
69		u_int intermediate : 1;
70		u_int decrypt : 1;
71		u_int key_size : 2;
72		u_int filler0 : 20;
73		u_int filler1 : 32;
74		u_int filler2 : 32;
75		u_int filler3 : 32;
76	} field;
77};
78
79/* The extra 7 is to allow an 8-byte write on the last byte of the
80 * arrays.  The ACE wants the AES data 16-byte/128-bit aligned, and
81 * it _always_ writes n*64 bits. The RNG does not care about alignment,
82 * and it always writes n*32 bits or n*64 bits.
83 */
84static uint8_t key[CIPHER_BLOCK_SIZE+7]	__aligned(16);
85static uint8_t iv[CIPHER_BLOCK_SIZE+7]	__aligned(16);
86static uint8_t in[RANDOM_BLOCK_SIZE+7]	__aligned(16);
87static uint8_t out[RANDOM_BLOCK_SIZE+7]	__aligned(16);
88
89static union VIA_ACE_CW acw		__aligned(16);
90
91static struct fpu_kern_ctx *fpu_ctx_save;
92
93static struct mtx random_nehemiah_mtx;
94
95/* ARGSUSED */
96static __inline size_t
97VIA_RNG_store(void *buf)
98{
99#ifdef __GNUCLIKE_ASM
100	uint32_t retval = 0;
101	uint32_t rate = 0;
102
103	/* The .byte line is really VIA C3 "xstore" instruction */
104	__asm __volatile(
105		"movl	$0,%%edx		\n\t"
106		".byte	0x0f, 0xa7, 0xc0"
107			: "=a" (retval), "+d" (rate), "+D" (buf)
108			:
109			: "memory"
110	);
111	if (rate == 0)
112		return (retval&0x1f);
113#endif
114	return (0);
115}
116
117/* ARGSUSED */
118static __inline void
119VIA_ACE_cbc(void *in, void *out, size_t count, void *key, union VIA_ACE_CW *cw, void *iv)
120{
121#ifdef __GNUCLIKE_ASM
122	/* The .byte line is really VIA C3 "xcrypt-cbc" instruction */
123	__asm __volatile(
124		"pushf				\n\t"
125		"popf				\n\t"
126		"rep				\n\t"
127		".byte	0x0f, 0xa7, 0xc8"
128			: "+a" (iv), "+c" (count), "+D" (out), "+S" (in)
129			: "b" (key), "d" (cw)
130			: "cc", "memory"
131		);
132#endif
133}
134
135static void
136random_nehemiah_init(void)
137{
138	acw.raw = 0ULL;
139	acw.field.round_count = 12;
140
141	mtx_init(&random_nehemiah_mtx, "random nehemiah", NULL, MTX_DEF);
142	fpu_ctx_save = fpu_kern_alloc_ctx(FPU_KERN_NORMAL);
143}
144
145void
146random_nehemiah_deinit(void)
147{
148
149	fpu_kern_free_ctx(fpu_ctx_save);
150	mtx_destroy(&random_nehemiah_mtx);
151}
152
153static int
154random_nehemiah_read(void *buf, int c)
155{
156	int i, error;
157	size_t count, ret;
158	uint8_t *p;
159
160	mtx_lock(&random_nehemiah_mtx);
161	error = fpu_kern_enter(curthread, fpu_ctx_save, FPU_KERN_NORMAL);
162	if (error != 0) {
163		mtx_unlock(&random_nehemiah_mtx);
164		return (0);
165	}
166
167	/* Get a random AES key */
168	count = 0;
169	p = key;
170	do {
171		ret = VIA_RNG_store(p);
172		p += ret;
173		count += ret;
174	} while (count < CIPHER_BLOCK_SIZE);
175
176	/* Get a random AES IV */
177	count = 0;
178	p = iv;
179	do {
180		ret = VIA_RNG_store(p);
181		p += ret;
182		count += ret;
183	} while (count < CIPHER_BLOCK_SIZE);
184
185	/* Get a block of random bytes */
186	count = 0;
187	p = in;
188	do {
189		ret = VIA_RNG_store(p);
190		p += ret;
191		count += ret;
192	} while (count < RANDOM_BLOCK_SIZE);
193
194	/* This is a Davies-Meyer hash of the most paranoid variety; the
195	 * key, IV and the data are all read directly from the hardware RNG.
196	 * All of these are used precisely once.
197	 */
198	VIA_ACE_cbc(in, out, RANDOM_BLOCK_SIZE/CIPHER_BLOCK_SIZE,
199	    key, &acw, iv);
200	for (i = 0; i < RANDOM_BLOCK_SIZE; i++)
201		out[i] ^= in[i];
202
203	c = MIN(RANDOM_BLOCK_SIZE, c);
204	memcpy(buf, out, (size_t)c);
205
206	fpu_kern_leave(curthread, fpu_ctx_save);
207	mtx_unlock(&random_nehemiah_mtx);
208	return (c);
209}
210
211#endif
212