entropy adjustments: cope with broken AMD rdrand/rdseed ; add (checke…

…d) rdrand/rdseed to initial bootstrap (#17)

* detect and disable bad rdrand/rdsede on AMD CPUs, which returns -1
* bootstrap with either 3 times whirlwind (if no rdrand/rdseed is available) or 5 times (checked!) rdrand/rdseed and once whirlwind

Reviewed-by: @cfcs

entropy/mirage_crypto_entropy.ml

@@ -29,10 +29,11 @@
 
 module Cpu_native = struct
 
-  external cycles     : unit -> int  = "caml_cycle_counter" [@@noalloc]
-  external random     : unit -> int  = "caml_cpu_random"    [@@noalloc]
-  external rng_type   : unit -> int  = "caml_cpu_rng_type"  [@@noalloc]
-  external detect     : unit -> unit = "caml_entropy_detect"
+  external cycles : unit -> int  = "caml_cycle_counter" [@@noalloc]
+  external unchecked_random : unit -> int  = "caml_cpu_unchecked_random" [@@noalloc]
+  external checked_random : unit -> int  = "caml_cpu_checked_random" [@@noalloc]
+  external rng_type : unit -> int  = "caml_cpu_rng_type" [@@noalloc]
+  external detect : unit -> unit = "caml_entropy_detect"
 
   let () = detect ()
 
@@ -74,7 +75,7 @@ let sources () =
  * See Whirlwind RNG:
  *   http://www.ieee-security.org/TC/SP2014/papers/Not-So-RandomNumbersinVirtualizedLinuxandtheWhirlwindRNG.pdf
  *)
-let bootstrap f =
+let whirlwind_bootstrap f =
   let outer     = 100
   and inner_max = 1024
   and a         = ref 0
@@ -98,7 +99,7 @@ let interrupt_hook () =
   | Some _ ->
       let buf = Cstruct.create 12 in fun () ->
         let a = Cpu_native.cycles ()
-        and b = Cpu_native.random () in
+        and b = Cpu_native.unchecked_random () in
         Cstruct.LE.set_uint32 buf 0 (Int32.of_int a) ;
         Cstruct.LE.set_uint64 buf 4 (Int64.of_int b) ;
         buf
@@ -111,7 +112,18 @@ let interrupt_hook () =
  *
  * Compile-time entropy. A function returning it could go into `t.inits`.
  *)
-let bootstrap_functions = [ bootstrap ]
+
+let checked_rdrand_rdseed f =
+  let cs = Cstruct.create 8 in
+  let random = Cpu_native.checked_random () in
+  Cstruct.LE.set_uint64 cs 0 (Int64.of_int random);
+  f cs;
+  Lwt.return_unit
+
+let bootstrap_functions () =
+  match Cpu_native.cpu_rng with
+  | None -> [ whirlwind_bootstrap ; whirlwind_bootstrap ; whirlwind_bootstrap ]
+  | Some _ -> [ checked_rdrand_rdseed ; checked_rdrand_rdseed ; whirlwind_bootstrap ; checked_rdrand_rdseed ; checked_rdrand_rdseed ]
 
 let running = ref false
 
@@ -125,7 +137,7 @@ let initialize (type a) ?g (rng : a Mirage_crypto_rng.generator) =
     let `Acc handler = Mirage_crypto_rng.accumulate (Some rng) in
     Lwt_list.iteri_p
       (fun i boot -> boot (handler ~source:i))
-      bootstrap_functions >|= fun () ->
+      (bootstrap_functions ()) >|= fun () ->
     let hook = interrupt_hook () in
     Mirage_runtime.at_enter_iter (fun () ->
         let e = hook () in

src/native/entropy_cpu_stubs.c

@@ -59,20 +59,37 @@ enum cpu_rng_t {
 
 static enum cpu_rng_t __cpu_rng = RNG_NONE;
 
+#define RETRIES 10
+
 static void detect () {
 #if defined (__x86__)
 
   unsigned int sig, eax, ebx, ecx, edx;
   int max = __get_cpuid_max (0, &sig);
+  random_t r = 0;
 
   if (max < 1) return;
 
   if (sig == signature_INTEL_ebx || sig == signature_AMD_ebx) {
     __cpuid (1, eax, ebx, ecx, edx);
-    if (ecx & bit_RDRND) __cpu_rng = RNG_RDRAND;
+    if (ecx & bit_RDRND)
+      /* AMD Ryzen 3000 bug where RDRAND always returns -1
+         https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ */
+      for (int i = 0; i < RETRIES; i++)
+        if (_rdrand_step(&r) == 1 && r != (random_t) (-1)) {
+          __cpu_rng = RNG_RDRAND;
+          break;
+        }
     if (max > 7) {
       __cpuid_count (7, 0, eax, ebx, ecx, edx);
-      if (ebx & bit_RDSEED) __cpu_rng = RNG_RDSEED;
+      if (ebx & bit_RDSEED)
+        /* RDSEED could return -1 as well, thus we test it here as well
+           https://www.reddit.com/r/Amd/comments/cmza34/agesa_1003_abb_fixes_rdrandrdseed/ */
+        for (int i = 0; i < RETRIES; i++)
+          if (_rdseed_step(&r) == 1 && r != (random_t) (-1)) {
+            __cpu_rng = RNG_RDSEED;
+            break;
+          }
     }
   }
 #endif
@@ -88,15 +105,50 @@ CAMLprim value caml_cycle_counter (value __unused(unit)) {
 #endif
 }
 
-CAMLprim value caml_cpu_random (value __unused(unit)) {
+CAMLprim value caml_cpu_checked_random (value __unused(unit)) {
 #if defined (__x86__)
   random_t r = 0;
-  if (__cpu_rng == RNG_RDSEED) {
+  int ok = 0;
+  int i = RETRIES;
+  switch (__cpu_rng) {
+  case RNG_RDSEED:
+    do { ok = _rdseed_step (&r); _mm_pause (); } while ( !(ok | !--i) );
+    break;
+  case RNG_RDRAND:
+    do { ok = _rdrand_step (&r); } while ( !(ok | !--i) );
+    break;
+  case RNG_NONE:
+    break;
+  }
+  return Val_long(r);
+#else
+  /* ARM: CPU-assisted randomness here. */
+  return Val_long (0);
+#endif
+}
+
+CAMLprim value caml_cpu_unchecked_random (value __unused(unit)) {
+#if defined (__x86__)
+  random_t r = 0;
+  /* rdrand/rdseed may fail (and return CR = 0) if insufficient entropy is
+     available (or the hardware DRNG is in the middle of reseeding).
+
+     we could handle these by retrying in a loop - which would be
+     computationally expensive, but since this code is run whenever the Lwt
+     event loop is entered, and only used to feed entropy into the pool, it is
+     fine to add not-so-random entropy.
+ */
+  switch (__cpu_rng) {
+  case RNG_RDSEED:
     _rdseed_step (&r);
-  } else if (__cpu_rng == RNG_RDRAND) {
+    break;
+  case RNG_RDRAND:
     _rdrand_step (&r);
+    break;
+  case RNG_NONE:
+    break;
   }
-  return Val_long (r); /* Zeroed-out if carry == 0. */
+  return Val_long (r);
 #else
   /* ARM: CPU-assisted randomness here. */
   return Val_long (0);