From eb2252fd7a580a625d426562b9498f28226a75e7 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 14 Apr 2015 10:56:20 +0100 Subject: [efi] Add EFI entropy source Originally-implemented-by: Jarrod Johnson Signed-off-by: Michael Brown --- src/arch/x86/include/bits/errfile.h | 1 + src/arch/x86/interface/efi/efi_entropy.c | 150 +++++++++++++++++++++++++++++++ src/config/defaults/efi.h | 4 +- src/include/ipxe/efi/efi_entropy.h | 35 ++++++++ src/include/ipxe/entropy.h | 1 + 5 files changed, 189 insertions(+), 2 deletions(-) create mode 100644 src/arch/x86/interface/efi/efi_entropy.c create mode 100644 src/include/ipxe/efi/efi_entropy.h diff --git a/src/arch/x86/include/bits/errfile.h b/src/arch/x86/include/bits/errfile.h index 9ca849d5..6afeb73f 100644 --- a/src/arch/x86/include/bits/errfile.h +++ b/src/arch/x86/include/bits/errfile.h @@ -50,6 +50,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define ERRFILE_cpuid_cmd ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00000000 ) #define ERRFILE_cpuid_settings ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00010000 ) +#define ERRFILE_efi_entropy ( ERRFILE_ARCH | ERRFILE_OTHER | 0x00020000 ) /** @} */ diff --git a/src/arch/x86/interface/efi/efi_entropy.c b/src/arch/x86/interface/efi/efi_entropy.c new file mode 100644 index 00000000..54d61e91 --- /dev/null +++ b/src/arch/x86/interface/efi/efi_entropy.c @@ -0,0 +1,150 @@ +/* + * Copyright (C) 2015 Michael Brown . + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + * + * You can also choose to distribute this program under the terms of + * the Unmodified Binary Distribution Licence (as given in the file + * COPYING.UBDL), provided that you have satisfied its requirements. + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include +#include +#include + +/** @file + * + * EFI entropy source + * + */ + +/** Time (in 100ns units) to delay waiting for timer tick + * + * In theory, UEFI allows us to specify a trigger time of zero to + * simply wait for the next timer tick. In practice, specifying zero + * seems to often return immediately, which produces almost no + * entropy. Specify a delay of 1000ns to try to force an existent + * delay. + */ +#define EFI_ENTROPY_TRIGGER_TIME 10 + +/** Event used to wait for timer tick */ +static EFI_EVENT tick; + +/** + * Enable entropy gathering + * + * @ret rc Return status code + */ +static int efi_entropy_enable ( void ) { + EFI_BOOT_SERVICES *bs = efi_systab->BootServices; + EFI_STATUS efirc; + int rc; + + /* Create timer tick event */ + if ( ( efirc = bs->CreateEvent ( EVT_TIMER, TPL_NOTIFY, NULL, NULL, + &tick ) ) != 0 ) { + rc = -EEFI ( efirc ); + DBGC ( &tick, "ENTROPY could not create event: %s\n", + strerror ( rc ) ); + return rc; + } + + return 0; +} + +/** + * Disable entropy gathering + * + */ +static void efi_entropy_disable ( void ) { + EFI_BOOT_SERVICES *bs = efi_systab->BootServices; + + /* Close timer tick event */ + bs->CloseEvent ( tick ); +} + +/** + * Wait for an RTC tick + * + * @ret low TSC low-order bits, or negative error + */ +static int efi_entropy_tick ( void ) { + EFI_BOOT_SERVICES *bs = efi_systab->BootServices; + UINTN index; + uint16_t low; + uint32_t discard_d; + EFI_STATUS efirc; + int rc; + + /* Wait for next timer tick */ + if ( ( efirc = bs->SetTimer ( tick, TimerRelative, + EFI_ENTROPY_TRIGGER_TIME ) ) != 0 ) { + rc = -EEFI ( efirc ); + DBGC ( &tick, "ENTROPY could not set timer: %s\n", + strerror ( rc ) ); + return rc; + } + if ( ( efirc = bs->WaitForEvent ( 1, &tick, &index ) ) != 0 ) { + rc = -EEFI ( efirc ); + DBGC ( &tick, "ENTROPY could not wait for timer tick: %s\n", + strerror ( rc ) ); + return rc; + } + + /* Get current TSC low-order bits */ + __asm__ __volatile__ ( "rdtsc" : "=a" ( low ), "=d" ( discard_d ) ); + + return low; +} + +/** + * Get noise sample + * + * @ret noise Noise sample + * @ret rc Return status code + */ +static int efi_get_noise ( noise_sample_t *noise ) { + int before; + int after; + int rc; + + /* Wait for a timer tick */ + before = efi_entropy_tick(); + if ( before < 0 ) { + rc = before; + return rc; + } + + /* Wait for another timer tick */ + after = efi_entropy_tick(); + if ( after < 0 ) { + rc = after; + return rc; + } + + /* Use TSC delta as noise sample */ + *noise = ( after - before ); + + return 0; +} + +PROVIDE_ENTROPY_INLINE ( efi, min_entropy_per_sample ); +PROVIDE_ENTROPY ( efi, entropy_enable, efi_entropy_enable ); +PROVIDE_ENTROPY ( efi, entropy_disable, efi_entropy_disable ); +PROVIDE_ENTROPY ( efi, get_noise, efi_get_noise ); diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 4276d936..7b7777da 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -7,7 +7,7 @@ * */ -FILE_LICENCE ( GPL2_OR_LATER ); +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define UACCESS_EFI #define IOAPI_X86 @@ -19,7 +19,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); #define SMBIOS_EFI #define SANBOOT_NULL #define BOFM_EFI -#define ENTROPY_NULL +#define ENTROPY_EFI #define TIME_NULL #define REBOOT_EFI diff --git a/src/include/ipxe/efi/efi_entropy.h b/src/include/ipxe/efi/efi_entropy.h new file mode 100644 index 00000000..39a66735 --- /dev/null +++ b/src/include/ipxe/efi/efi_entropy.h @@ -0,0 +1,35 @@ +#ifndef _IPXE_EFI_ENTROPY_H +#define _IPXE_EFI_ENTROPY_H + +/** @file + * + * EFI entropy source + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +#ifdef ENTROPY_EFI +#define ENTROPY_PREFIX_efi +#else +#define ENTROPY_PREFIX_efi __efi_ +#endif + +/** + * min-entropy per sample + * + * @ret min_entropy min-entropy of each sample + */ +static inline __always_inline double +ENTROPY_INLINE ( efi, min_entropy_per_sample ) ( void ) { + + /* We use essentially the same mechanism as for the BIOS + * RTC-based entropy source, and so assume the same + * min-entropy per sample. + */ + return 1.3; +} + +#endif /* _IPXE_EFI_ENTROPY_H */ diff --git a/src/include/ipxe/entropy.h b/src/include/ipxe/entropy.h index a9dcb29c..beeb3abf 100644 --- a/src/include/ipxe/entropy.h +++ b/src/include/ipxe/entropy.h @@ -54,6 +54,7 @@ typedef uint8_t entropy_sample_t; /* Include all architecture-independent entropy API headers */ #include +#include #include /* Include all architecture-dependent entropy API headers */ -- cgit