/src/botan/src/lib/entropy/rdseed/rdseed.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Entropy Source Using Intel's rdseed instruction |
3 | | * (C) 2015 Daniel Neus |
4 | | * (C) 2015,2019 Jack Lloyd |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/internal/rdseed.h> |
10 | | |
11 | | #include <botan/internal/cpuid.h> |
12 | | |
13 | | #include <immintrin.h> |
14 | | |
15 | | namespace Botan { |
16 | | |
17 | | namespace { |
18 | | |
19 | 0 | BOTAN_FUNC_ISA("rdseed") bool read_rdseed(secure_vector<uint32_t>& seed) { |
20 | | /* |
21 | | * RDSEED is not guaranteed to generate an output within any specific number |
22 | | * of attempts. However in testing on a Skylake system, with all hyperthreads |
23 | | * occupied in tight RDSEED loops, RDSEED will still usually succeed in under |
24 | | * 150 attempts. The maximum ever seen was 230 attempts until success. When |
25 | | * idle, RDSEED usually succeeds in 1 or 2 attempts. |
26 | | * |
27 | | * We set an upper bound of 1024 attempts, because it is possible that due |
28 | | * to firmware issue RDSEED is simply broken and never succeeds. We do not |
29 | | * want to loop forever in that case. If we exceed that limit, then we assume |
30 | | * the hardware is actually just broken, and stop the poll. |
31 | | */ |
32 | 0 | const size_t RDSEED_RETRIES = 1024; |
33 | |
|
34 | 0 | for(size_t i = 0; i != RDSEED_RETRIES; ++i) { |
35 | 0 | uint32_t r = 0; |
36 | 0 | int cf = 0; |
37 | |
|
38 | 0 | #if defined(BOTAN_USE_GCC_INLINE_ASM) |
39 | 0 | asm("rdseed %0; adcl $0,%1" : "=r"(r), "=r"(cf) : "0"(r), "1"(cf) : "cc"); |
40 | | #else |
41 | | cf = _rdseed32_step(&r); |
42 | | #endif |
43 | |
|
44 | 0 | if(1 == cf) { |
45 | 0 | seed.push_back(r); |
46 | 0 | return true; |
47 | 0 | } |
48 | | |
49 | | // Intel suggests pausing if RDSEED fails. |
50 | 0 | _mm_pause(); |
51 | 0 | } |
52 | | |
53 | 0 | return false; // failed to produce an output after many attempts |
54 | 0 | } |
55 | | |
56 | | } // namespace |
57 | | |
58 | 0 | size_t Intel_Rdseed::poll(RandomNumberGenerator& rng) { |
59 | 0 | const size_t RDSEED_BYTES = 1024; |
60 | 0 | static_assert(RDSEED_BYTES % 4 == 0, "Bad RDSEED configuration"); |
61 | |
|
62 | 0 | if(CPUID::has_rdseed()) { |
63 | 0 | secure_vector<uint32_t> seed; |
64 | 0 | seed.reserve(RDSEED_BYTES / 4); |
65 | |
|
66 | 0 | for(size_t p = 0; p != RDSEED_BYTES / 4; ++p) { |
67 | | /* |
68 | | If at any point we exceed our retry count, we stop the entire seed |
69 | | gathering process. This situation will only occur in situations of |
70 | | extremely high RDSEED utilization. If RDSEED is currently so highly |
71 | | contended, then the rest of the poll is likely to also face contention and |
72 | | it is better to quit now rather than (presumably) face very high retry |
73 | | times for the rest of the poll. |
74 | | */ |
75 | 0 | if(!read_rdseed(seed)) { |
76 | 0 | break; |
77 | 0 | } |
78 | 0 | } |
79 | |
|
80 | 0 | if(!seed.empty()) { |
81 | 0 | rng.add_entropy(reinterpret_cast<const uint8_t*>(seed.data()), seed.size() * sizeof(uint32_t)); |
82 | 0 | } |
83 | 0 | } |
84 | | |
85 | | // RDSEED is used but not trusted |
86 | 0 | return 0; |
87 | 0 | } |
88 | | |
89 | | } // namespace Botan |