Botan 3.8.1
Crypto and TLS for C&
processor_rng.cpp
Go to the documentation of this file.
1/*
2* (C) 2016,2019,2020 Jack Lloyd
3*
4* Botan is released under the Simplified BSD License (see license.txt)
5*/
6
7#include <botan/processor_rng.h>
8
9#include <botan/internal/cpuid.h>
10#include <botan/internal/loadstor.h>
11#include <botan/internal/target_info.h>
12
13#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY) && !defined(BOTAN_USE_GCC_INLINE_ASM)
14 #include <immintrin.h>
15#endif
16
17namespace Botan {
18
19namespace {
20
21#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
22/*
23 * According to Intel, RDRAND is guaranteed to generate a random
24 * number within 10 retries on a working CPU
25 */
26const size_t HWRNG_RETRIES = 10;
27
28#elif defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY)
29/**
30 * PowerISA 3.0 p.78:
31 * When the error value is obtained, software is expected to repeat the
32 * operation. [...] The recommended number of attempts may be
33 * implementation specific. In the absence of other guidance, ten attempts
34 * should be adequate.
35 */
36const size_t HWRNG_RETRIES = 10;
37
38#else
39/*
40 * Lacking specific guidance we give the CPU quite a bit of leeway
41 */
42const size_t HWRNG_RETRIES = 512;
43#endif
44
45#if defined(BOTAN_TARGET_ARCH_IS_X86_32)
46typedef uint32_t hwrng_output;
47#else
48typedef uint64_t hwrng_output;
49#endif
50
51hwrng_output read_hwrng(bool& success) {
52 hwrng_output output = 0;
53 success = false;
54
55#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
56 int cf = 0;
57 #if defined(BOTAN_USE_GCC_INLINE_ASM)
58 // same asm seq works for 32 and 64 bit
59 asm volatile("rdrand %0; adcl $0,%1" : "=r"(output), "=r"(cf) : "0"(output), "1"(cf) : "cc");
60 #elif defined(BOTAN_TARGET_ARCH_IS_X86_32)
61 cf = _rdrand32_step(&output);
62 #else
63 cf = _rdrand64_step(reinterpret_cast<unsigned long long*>(&output));
64 #endif
65 success = (1 == cf);
66
67#elif defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY)
68
69 /*
70 DARN indicates error by returning 0xFF..FF, ie is biased. Which is crazy.
71 Avoid the bias by invoking it twice and, assuming both succeed, returning the
72 XOR of the two results, which should unbias the output.
73 */
74 uint64_t output2 = 0;
75 // DARN codes are 0: 32-bit conditioned, 1: 64-bit conditioned, 2: 64-bit raw (ala RDSEED)
76 asm volatile("darn %0, 1" : "=r"(output));
77 asm volatile("darn %0, 1" : "=r"(output2));
78
79 if((~output) != 0 && (~output2) != 0) {
80 output ^= output2;
81 success = true;
82 }
83
84#endif
85
86 if(success) {
87 return output;
88 }
89
90 return 0;
91}
92
93hwrng_output read_hwrng() {
94 for(size_t i = 0; i < HWRNG_RETRIES; ++i) {
95 bool success = false;
96 hwrng_output output = read_hwrng(success);
97
98 if(success) {
99 return output;
100 }
101 }
102
103 throw PRNG_Unseeded("Processor RNG instruction failed to produce output within expected iterations");
104}
105
106} // namespace
107
108//static
110#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
112#elif defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY)
114#else
115 return false;
116#endif
117}
118
119std::string Processor_RNG::name() const {
120#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
121 return "rdrand";
122#elif defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY)
123 return "darn";
124#else
125 return "hwrng";
126#endif
127}
128
129void Processor_RNG::fill_bytes_with_input(std::span<uint8_t> out, std::span<const uint8_t> in) {
130 // No way to provide entropy to processor-specific generator, ignore...
131 BOTAN_UNUSED(in);
132
133 while(out.size() >= sizeof(hwrng_output)) {
134 const hwrng_output r = read_hwrng();
135 store_le(r, out.data());
136 out = out.subspan(sizeof(hwrng_output));
137 }
138
139 if(!out.empty()) {
140 // at most sizeof(hwrng_output)-1 bytes left
141 const hwrng_output r = read_hwrng();
142 uint8_t hwrng_bytes[sizeof(hwrng_output)];
143 store_le(r, hwrng_bytes);
144
145 for(size_t i = 0; i != out.size(); ++i) {
146 out[i] = hwrng_bytes[i];
147 }
148 }
149}
150
153 throw Invalid_State("Current CPU does not support RNG instruction");
154 }
155}
156
158 size_t /*poll_bits*/,
159 std::chrono::milliseconds /*poll_timeout*/) {
160 /* no way to add entropy */
161 return 0;
162}
163
164} // namespace Botan
#define BOTAN_UNUSED
Definition assert.h:120
static bool has(CPUID::Feature feat)
Definition cpuid.h:94
size_t reseed(Entropy_Sources &, size_t, std::chrono::milliseconds) override
std::string name() const override
constexpr auto store_le(ParamTs &&... params)
Definition loadstor.h:736