bsd/dev/random/randomdev.c

   1 /*
   2  * Copyright (c) 1999-2006 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/param.h>
  30 #include <sys/systm.h>
  31 #include <sys/proc.h>
  32 #include <sys/errno.h>
  33 #include <sys/ioctl.h>
  34 #include <sys/conf.h>
  35 #include <sys/fcntl.h>
  36 #include <string.h>
  37 #include <miscfs/devfs/devfs.h>
  38 #include <kern/lock.h>
  39 #include <kern/clock.h>
  40 #include <sys/time.h>
  41 #include <sys/malloc.h>
  42 #include <sys/uio_internal.h>
  43
  44 #include <dev/random/randomdev.h>
  45 #include <dev/random/YarrowCoreLib/include/yarrow.h>
  46 #include <libkern/crypto/sha1.h>
  47
  48 #include <mach/mach_time.h>
  49 #include <machine/machine_routines.h>
  50
  51 #define RANDOM_MAJOR  -1 /* let the kernel pick the device number */
  52
  53 d_ioctl_t       random_ioctl;
  54
  55 /*
  56  * A struct describing which functions will get invoked for certain
  57  * actions.
  58  */
  59 static struct cdevsw random_cdevsw =
  60 {
  61         random_open,            /* open */
  62         random_close,           /* close */
  63         random_read,            /* read */
  64         random_write,           /* write */
  65         random_ioctl,           /* ioctl */
  66         (stop_fcn_t *)nulldev, /* stop */
  67         (reset_fcn_t *)nulldev, /* reset */
  68         NULL,                           /* tty's */
  69         eno_select,                     /* select */
  70         eno_mmap,                       /* mmap */
  71         eno_strat,                      /* strategy */
  72         eno_getc,                       /* getc */
  73         eno_putc,                       /* putc */
  74         0                                       /* type */
  75 };
  76
  77 /* Used to detect whether we've already been initialized */
  78 static int gRandomInstalled = 0;
  79 static PrngRef gPrngRef;
  80 static int gRandomError = 1;
  81 static lck_grp_t *gYarrowGrp;
  82 static lck_attr_t *gYarrowAttr;
  83 static lck_grp_attr_t *gYarrowGrpAttr;
  84 static lck_mtx_t *gYarrowMutex = 0;
  85
  86 void CheckReseed(void);
  87
  88 #define RESEED_TICKS 50 /* how long a reseed operation can take */
  89
  90
  91 enum {kBSizeInBits = 160}; // MUST be a multiple of 32!!!
  92 enum {kBSizeInBytes = kBSizeInBits / 8};
  93 typedef u_int32_t BlockWord;
  94 enum {kWordSizeInBits = 32};
  95 enum {kBSize = 5};
  96 typedef BlockWord Block[kBSize];
  97
  98 /* define prototypes to keep the compiler happy... */
  99
 100 void add_blocks(Block a, Block b, BlockWord carry);
 101 void fips_initialize(void);
 102 void random_block(Block b);
 103 u_int32_t CalculateCRC(u_int8_t* buffer, size_t length);
 104
 105 /*
 106  * Get 120 bits from yarrow
 107  */
 108
 109 /*
 110  * add block b to block a
 111  */
 112 void
 113 add_blocks(Block a, Block b, BlockWord carry)
 114 {
 115         int i = kBSize;
 116         while (--i >= 0)
 117         {
 118                 u_int64_t c = (u_int64_t)carry +
 119                                           (u_int64_t)a[i] +
 120                                           (u_int64_t)b[i];
 121                 a[i] = c & ((1LL << kWordSizeInBits) - 1);
 122                 carry = c >> kWordSizeInBits;
 123         }
 124 }
 125
 126
 127
 128 struct sha1_ctxt g_sha1_ctx;
 129 char zeros[(512 - kBSizeInBits) / 8];
 130 Block g_xkey;
 131 Block g_random_data;
 132 int g_bytes_used;
 133 unsigned char g_SelfTestInitialized = 0;
 134 u_int32_t gLastBlockChecksum;
 135
 136 static const u_int32_t g_crc_table[] =
 137 {
 138         0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
 139         0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
 140         0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE, 0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
 141         0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
 142         0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172, 0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
 143         0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940, 0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
 144         0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
 145         0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924, 0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
 146         0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
 147         0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818, 0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
 148         0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E, 0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
 149         0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
 150         0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2, 0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
 151         0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0, 0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
 152         0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
 153         0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
 154         0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A, 0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
 155         0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8, 0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
 156         0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
 157         0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC, 0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
 158         0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
 159         0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
 160         0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236, 0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
 161         0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
 162         0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A, 0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
 163         0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38, 0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
 164         0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
 165         0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C, 0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
 166         0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2, 0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
 167         0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
 168         0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
 169         0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94, 0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D,
 170 };
 171
 172 /*
 173  * Setup for fips compliance
 174  */
 175
 176 /*
 177  * calculate a crc-32 checksum
 178  */
 179 u_int32_t CalculateCRC(u_int8_t* buffer, size_t length)
 180 {
 181         u_int32_t crc = 0;
 182
 183         size_t i;
 184         for (i = 0; i < length; ++i)
 185         {
 186                 u_int32_t temp = (crc ^ ((u_int32_t) buffer[i])) & 0xFF;
 187                 crc = (crc >> 8) ^ g_crc_table[temp];
 188         }
 189
 190         return crc;
 191 }
 192
 193 /*
 194  * get a random block of data per fips 186-2
 195  */
 196 void
 197 random_block(Block b)
 198 {
 199         int repeatCount = 0;
 200         do
 201         {
 202                 // do one iteration
 203                 Block xSeed;
 204                 prngOutput (gPrngRef, (BYTE*) &xSeed, sizeof (xSeed));
 205
 206                 // add the seed to the previous value of g_xkey
 207                 add_blocks (g_xkey, xSeed, 0);
 208
 209                 // compute "G"
 210                 SHA1Update (&g_sha1_ctx, (const u_int8_t *) &g_xkey, sizeof (g_xkey));
 211
 212                 // add zeros to fill the internal SHA-1 buffer
 213                 SHA1Update (&g_sha1_ctx, (const u_int8_t *)zeros, sizeof (zeros));
 214
 215                 // write the resulting block
 216                 memmove(b, g_sha1_ctx.h.b8, sizeof (Block));
 217
 218                 // calculate the CRC-32 of the block
 219                 u_int32_t new_crc = CalculateCRC(g_sha1_ctx.h.b8, sizeof (Block));
 220
 221                 // make sure we don't repeat
 222                 int cmp = new_crc == gLastBlockChecksum;
 223                 gLastBlockChecksum = new_crc;
 224                 if (!g_SelfTestInitialized)
 225                 {
 226                         g_SelfTestInitialized = 1;
 227                         return;
 228                 }
 229                 else if (!cmp)
 230                 {
 231                         return;
 232                 }
 233
 234                 repeatCount += 1;
 235
 236                 // fix up the next value of g_xkey
 237                 add_blocks (g_xkey, b, 1);
 238         } while (repeatCount < 2);
 239
 240         /*
 241          * If we got here, three sucessive checksums of the random number
 242          * generator have been the same.  Since the odds of this happening are
 243          * 1 in 18,446,744,073,709,551,616, (1 in 18 quintillion) one of the following has
 244          * most likely happened:
 245          *
 246          * 1: There is a significant bug in this code.
 247          * 2: There has been a massive system failure.
 248          * 3: The universe has ceased to exist.
 249          *
 250          * There is no good way to recover from any of these cases. We
 251          * therefore panic.
 252          */
 253
 254          panic("FIPS random self-test failed.");
 255 }
 256
 257 /*
 258  *Initialize ONLY the Yarrow generator.
 259  */
 260 void
 261 PreliminarySetup(void)
 262 {
 263     prng_error_status perr;
 264
 265     /* create a Yarrow object */
 266     perr = prngInitialize(&gPrngRef);
 267     if (perr != 0) {
 268         printf ("Couldn't initialize Yarrow, /dev/random will not work.\n");
 269         return;
 270     }
 271
 272         /* clear the error flag, reads and write should then work */
 273     gRandomError = 0;
 274
 275    {
 276     struct timeval tt;
 277     char buffer [16];
 278
 279     /* get a little non-deterministic data as an initial seed. */
 280     microtime(&tt);
 281
 282     /*
 283          * So how much of the system clock is entropic?
 284          * It's hard to say, but assume that at least the
 285          * least significant byte of a 64 bit structure
 286          * is entropic.  It's probably more, how can you figure
 287          * the exact time the user turned the computer on, for example.
 288     */
 289     perr = prngInput(gPrngRef, (BYTE*) &tt, sizeof (tt), SYSTEM_SOURCE, 8);
 290     if (perr != 0) {
 291         /* an error, complain */
 292         printf ("Couldn't seed Yarrow.\n");
 293         return;
 294     }
 295
 296     /* turn the data around */
 297     perr = prngOutput(gPrngRef, (BYTE*) buffer, sizeof (buffer));
 298
 299     /* and scramble it some more */
 300     perr = prngForceReseed(gPrngRef, RESEED_TICKS);
 301     }
 302
 303     /* make a mutex to control access */
 304     gYarrowGrpAttr = lck_grp_attr_alloc_init();
 305     gYarrowGrp     = lck_grp_alloc_init("random", gYarrowGrpAttr);
 306     gYarrowAttr    = lck_attr_alloc_init();
 307     gYarrowMutex   = lck_mtx_alloc_init(gYarrowGrp, gYarrowAttr);
 308
 309         fips_initialize ();
 310 }
 311
 312 void
 313 fips_initialize(void)
 314 {
 315         /* Read the initial value of g_xkey from yarrow */
 316         prngOutput (gPrngRef, (BYTE*) &g_xkey, sizeof (g_xkey));
 317
 318         /* initialize our SHA1 generator */
 319         SHA1Init (&g_sha1_ctx);
 320
 321         /* other initializations */
 322         memset (zeros, 0, sizeof (zeros));
 323         g_bytes_used = 0;
 324         random_block(g_random_data);
 325 }
 326
 327 /*
 328  * Called to initialize our device,
 329  * and to register ourselves with devfs
 330  */
 331 void
 332 random_init(void)
 333 {
 334         int ret;
 335
 336         if (gRandomInstalled)
 337                 return;
 338
 339         /* install us in the file system */
 340         gRandomInstalled = 1;
 341
 342 #ifndef ARM_BOARD_CONFIG_S5L8900XFPGA_1136JFS
 343         /* setup yarrow and the mutex */
 344         PreliminarySetup();
 345 #endif
 346
 347         ret = cdevsw_add(RANDOM_MAJOR, &random_cdevsw);
 348         if (ret < 0) {
 349                 printf("random_init: failed to allocate a major number!\n");
 350                 gRandomInstalled = 0;
 351                 return;
 352         }
 353
 354         devfs_make_node(makedev (ret, 0), DEVFS_CHAR,
 355                 UID_ROOT, GID_WHEEL, 0666, "random", 0);
 356
 357         /*
 358          * also make urandom
 359          * (which is exactly the same thing in our context)
 360          */
 361         devfs_make_node(makedev (ret, 1), DEVFS_CHAR,
 362                 UID_ROOT, GID_WHEEL, 0666, "urandom", 0);
 363 }
 364
 365 int
 366 random_ioctl(   __unused dev_t dev, u_long cmd, __unused caddr_t data,
 367                                 __unused int flag, __unused struct proc *p  )
 368 {
 369         switch (cmd) {
 370         case FIONBIO:
 371         case FIOASYNC:
 372                 break;
 373         default:
 374                 return ENODEV;
 375         }
 376
 377         return (0);
 378 }
 379
 380 /*
 381  * Open the device.  Make sure init happened, and make sure the caller is
 382  * authorized.
 383  */
 384
 385 int
 386 random_open(__unused dev_t dev, int flags, __unused int devtype, __unused struct proc *p)
 387 {
 388         if (gRandomError != 0) {
 389                 /* forget it, yarrow didn't come up */
 390                 return (ENOTSUP);
 391         }
 392
 393         /*
 394          * if we are being opened for write,
 395          * make sure that we have privledges do so
 396          */
 397         if (flags & FWRITE) {
 398                 if (securelevel >= 2)
 399                         return (EPERM);
 400 #ifndef __APPLE__
 401                 if ((securelevel >= 1) && proc_suser(p))
 402                         return (EPERM);
 403 #endif  /* !__APPLE__ */
 404         }
 405
 406         return (0);
 407 }
 408
 409
 410 /*
 411  * close the device.
 412  */
 413
 414 int
 415 random_close(__unused dev_t dev, __unused int flags, __unused int mode, __unused struct proc *p)
 416 {
 417         return (0);
 418 }
 419
 420
 421 /*
 422  * Get entropic data from the Security Server, and use it to reseed the
 423  * prng.
 424  */
 425 int
 426 random_write (__unused dev_t dev, struct uio *uio, __unused int ioflag)
 427 {
 428     int retCode = 0;
 429     char rdBuffer[256];
 430
 431     if (gRandomError != 0) {
 432         return (ENOTSUP);
 433     }
 434
 435     /* get control of the Yarrow instance, Yarrow is NOT thread safe */
 436     lck_mtx_lock(gYarrowMutex);
 437
 438     /* Security server is sending us entropy */
 439
 440     while (uio_resid(uio) > 0 && retCode == 0) {
 441         /* get the user's data */
 442         // LP64todo - fix this!  uio_resid may be 64-bit value
 443         int bytesToInput = min(uio_resid(uio), sizeof (rdBuffer));
 444         retCode = uiomove(rdBuffer, bytesToInput, uio);
 445         if (retCode != 0)
 446             goto /*ugh*/ error_exit;
 447
 448         /* put it in Yarrow */
 449         if (prngInput(gPrngRef, (BYTE*) rdBuffer,
 450                         bytesToInput, SYSTEM_SOURCE,
 451                 bytesToInput * 8) != 0) {
 452             retCode = EIO;
 453             goto error_exit;
 454         }
 455     }
 456
 457     /* force a reseed */
 458     if (prngForceReseed(gPrngRef, RESEED_TICKS) != 0) {
 459         retCode = EIO;
 460         goto error_exit;
 461     }
 462
 463     /* retCode should be 0 at this point */
 464
 465 error_exit: /* do this to make sure the mutex unlocks. */
 466     lck_mtx_unlock(gYarrowMutex);
 467     return (retCode);
 468 }
 469
 470 /*
 471  * return data to the caller.  Results unpredictable.
 472  */
 473 int
 474 random_read(__unused dev_t dev, struct uio *uio, __unused int ioflag)
 475 {
 476     int retCode = 0;
 477
 478     if (gRandomError != 0)
 479         return (ENOTSUP);
 480
 481    /* lock down the mutex */
 482     lck_mtx_lock(gYarrowMutex);
 483
 484     CheckReseed();
 485         int bytes_remaining = uio_resid(uio);
 486     while (bytes_remaining > 0 && retCode == 0) {
 487         /* get the user's data */
 488                 int bytes_to_read = 0;
 489
 490                 int bytes_available = kBSizeInBytes - g_bytes_used;
 491         if (bytes_available == 0)
 492                 {
 493                         random_block(g_random_data);
 494                         g_bytes_used = 0;
 495                         bytes_available = kBSizeInBytes;
 496                 }
 497
 498                 bytes_to_read = min (bytes_remaining, bytes_available);
 499
 500         retCode = uiomove(((caddr_t)g_random_data)+ g_bytes_used, bytes_to_read, uio);
 501         g_bytes_used += bytes_to_read;
 502
 503         if (retCode != 0)
 504             goto error_exit;
 505
 506                 bytes_remaining = uio_resid(uio);
 507     }
 508
 509     retCode = 0;
 510
 511 error_exit:
 512     lck_mtx_unlock(gYarrowMutex);
 513     return retCode;
 514 }
 515
 516 /* export good random numbers to the rest of the kernel */
 517 void
 518 read_random(void* buffer, u_int numbytes)
 519 {
 520     if (gYarrowMutex == 0) { /* are we initialized? */
 521 #ifndef ARM_BOARD_CONFIG_S5L8900XFPGA_1136JFS
 522         PreliminarySetup ();
 523 #endif
 524     }
 525
 526     lck_mtx_lock(gYarrowMutex);
 527     CheckReseed();
 528
 529         int bytes_read = 0;
 530
 531         int bytes_remaining = numbytes;
 532     while (bytes_remaining > 0) {
 533         int bytes_to_read = min(bytes_remaining, kBSizeInBytes - g_bytes_used);
 534         if (bytes_to_read == 0)
 535                 {
 536                         random_block(g_random_data);
 537                         g_bytes_used = 0;
 538                         bytes_to_read = min(bytes_remaining, kBSizeInBytes);
 539                 }
 540
 541                 memmove ((u_int8_t*) buffer + bytes_read, ((u_int8_t*)g_random_data)+ g_bytes_used, bytes_to_read);
 542                 g_bytes_used += bytes_to_read;
 543                 bytes_read += bytes_to_read;
 544                 bytes_remaining -= bytes_to_read;
 545     }
 546
 547     lck_mtx_unlock(gYarrowMutex);
 548 }
 549
 550 /*
 551  * Return an unsigned long pseudo-random number.
 552  */
 553 u_long
 554 RandomULong(void)
 555 {
 556         u_long buf;
 557         read_random(&buf, sizeof (buf));
 558         return (buf);
 559 }
 560
 561 void
 562 CheckReseed(void)
 563 {
 564 }