17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
502f574fkais * Common Development and Distribution License (the "License").
602f574fkais * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
229b009fcValerie Bubb Fenwick * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
23717fae5Gordon Ross * Copyright 2012 Nexenta Systems, Inc.  All rights reserved.
2480d5689Patrick Mooney * Copyright 2017 Joyent, Inc.
256ea3c06Garrett D'Amore */
267c478bdstevel@tonic-gate
277c478bdstevel@tonic-gate/*
287c478bdstevel@tonic-gate * This file implements the interfaces that the /dev/random
297c478bdstevel@tonic-gate * driver uses for read(2), write(2) and poll(2) on /dev/random or
307c478bdstevel@tonic-gate * /dev/urandom. It also implements the kernel API - random_add_entropy(),
313364c16Vladimir Kotal * random_add_pseudo_entropy(), random_get_pseudo_bytes()
323364c16Vladimir Kotal * and random_get_bytes().
337c478bdstevel@tonic-gate *
347c478bdstevel@tonic-gate * We periodically collect random bits from providers which are registered
357c478bdstevel@tonic-gate * with the Kernel Cryptographic Framework (kCF) as capable of random
367c478bdstevel@tonic-gate * number generation. The random bits are maintained in a cache and
377c478bdstevel@tonic-gate * it is used for high quality random numbers (/dev/random) requests.
387c478bdstevel@tonic-gate * We pick a provider and call its SPI routine, if the cache does not have
397c478bdstevel@tonic-gate * enough bytes to satisfy a request.
407c478bdstevel@tonic-gate *
417c478bdstevel@tonic-gate * /dev/urandom requests use a software-based generator algorithm that uses the
427c478bdstevel@tonic-gate * random bits in the cache as a seed. We create one pseudo-random generator
437c478bdstevel@tonic-gate * (for /dev/urandom) per possible CPU on the system, and use it,
447c478bdstevel@tonic-gate * kmem-magazine-style, to avoid cache line contention.
457c478bdstevel@tonic-gate *
467c478bdstevel@tonic-gate * LOCKING HIERARCHY:
47fe54a78Hai-May Chao *	1) rmp->rm_mag.rm_lock protects the per-cpu pseudo-random generators.
487c478bdstevel@tonic-gate * 	2) rndpool_lock protects the high-quality randomness pool.
49fe54a78Hai-May Chao *		It may be locked while a rmp->rm_mag.rm_lock is held.
507c478bdstevel@tonic-gate *
517c478bdstevel@tonic-gate * A history note: The kernel API and the software-based algorithms in this
527c478bdstevel@tonic-gate * file used to be part of the /dev/random driver.
537c478bdstevel@tonic-gate */
547c478bdstevel@tonic-gate
557c478bdstevel@tonic-gate#include <sys/types.h>
567c478bdstevel@tonic-gate#include <sys/conf.h>
577c478bdstevel@tonic-gate#include <sys/sunddi.h>
587c478bdstevel@tonic-gate#include <sys/disp.h>
597c478bdstevel@tonic-gate#include <sys/modctl.h>
607c478bdstevel@tonic-gate#include <sys/ddi.h>
617c478bdstevel@tonic-gate#include <sys/crypto/common.h>
627c478bdstevel@tonic-gate#include <sys/crypto/api.h>
637c478bdstevel@tonic-gate#include <sys/crypto/impl.h>
647c478bdstevel@tonic-gate#include <sys/crypto/sched_impl.h>
657355649Anthony Scarpino#include <sys/crypto/ioctladmin.h>
667c478bdstevel@tonic-gate#include <sys/random.h>
677c478bdstevel@tonic-gate#include <sys/sha1.h>
687c478bdstevel@tonic-gate#include <sys/time.h>
697c478bdstevel@tonic-gate#include <sys/sysmacros.h>
707c478bdstevel@tonic-gate#include <sys/cpuvar.h>
717c478bdstevel@tonic-gate#include <sys/taskq.h>
72fe54a78Hai-May Chao#include <rng/fips_random.h>
737c478bdstevel@tonic-gate
747c478bdstevel@tonic-gate#define	RNDPOOLSIZE		1024	/* Pool size in bytes */
757c478bdstevel@tonic-gate#define	MINEXTRACTBYTES		20
767c478bdstevel@tonic-gate#define	MAXEXTRACTBYTES		1024
777c478bdstevel@tonic-gate#define	PRNG_MAXOBLOCKS		1310720	/* Max output block per prng key */
787c478bdstevel@tonic-gate#define	TIMEOUT_INTERVAL	5	/* Periodic mixing interval in secs */
797c478bdstevel@tonic-gate
807c478bdstevel@tonic-gatetypedef enum    extract_type {
817c478bdstevel@tonic-gate	NONBLOCK_EXTRACT,
827c478bdstevel@tonic-gate	BLOCKING_EXTRACT,
837c478bdstevel@tonic-gate	ALWAYS_EXTRACT
847c478bdstevel@tonic-gate} extract_type_t;
857c478bdstevel@tonic-gate
867c478bdstevel@tonic-gate/*
877c478bdstevel@tonic-gate * Hash-algo generic definitions. For now, they are SHA1's. We use SHA1
887c478bdstevel@tonic-gate * routines directly instead of using k-API because we can't return any
897c478bdstevel@tonic-gate * error code in /dev/urandom case and we can get an error using k-API
907c478bdstevel@tonic-gate * if a mechanism is disabled.
917c478bdstevel@tonic-gate */
927c478bdstevel@tonic-gate#define	HASHSIZE		20
937c478bdstevel@tonic-gate#define	HASH_CTX		SHA1_CTX
947c478bdstevel@tonic-gate#define	HashInit(ctx)		SHA1Init((ctx))
957c478bdstevel@tonic-gate#define	HashUpdate(ctx, p, s)	SHA1Update((ctx), (p), (s))
967c478bdstevel@tonic-gate#define	HashFinal(d, ctx)	SHA1Final((d), (ctx))
977c478bdstevel@tonic-gate
987c478bdstevel@tonic-gate/* HMAC-SHA1 */
997c478bdstevel@tonic-gate#define	HMAC_KEYSIZE			20
1007c478bdstevel@tonic-gate
1017c478bdstevel@tonic-gate/*
1027c478bdstevel@tonic-gate * Cache of random bytes implemented as a circular buffer. findex and rindex
1037c478bdstevel@tonic-gate * track the front and back of the circular buffer.
1047c478bdstevel@tonic-gate */
1057c478bdstevel@tonic-gateuint8_t rndpool[RNDPOOLSIZE];
1067c478bdstevel@tonic-gatestatic int findex, rindex;
1077c478bdstevel@tonic-gatestatic int rnbyte_cnt;		/* Number of bytes in the cache */
1087c478bdstevel@tonic-gate
1097c478bdstevel@tonic-gatestatic kmutex_t rndpool_lock;	/* protects r/w accesses to the cache, */
1107c478bdstevel@tonic-gate				/* and the global variables */
1117c478bdstevel@tonic-gatestatic kcondvar_t rndpool_read_cv; /* serializes poll/read syscalls */
1127c478bdstevel@tonic-gatestatic int num_waiters;		/* #threads waiting to read from /dev/random */
1137c478bdstevel@tonic-gate
1147c478bdstevel@tonic-gatestatic struct pollhead rnd_pollhead;
115104d3bdDan OpenSolaris Anderson/* LINTED E_STATIC_UNUSED */
1167c478bdstevel@tonic-gatestatic timeout_id_t kcf_rndtimeout_id;
1177c478bdstevel@tonic-gatestatic crypto_mech_type_t rngmech_type = CRYPTO_MECH_INVALID;
1187c478bdstevel@tonic-gaternd_stats_t rnd_stats;
119f317a3akrishnastatic boolean_t rng_prov_found = B_TRUE;
120f317a3akrishnastatic boolean_t rng_ok_to_log = B_TRUE;
121f5229b7Krishna Yenduristatic boolean_t rngprov_task_idle = B_TRUE;
1227c478bdstevel@tonic-gate
1237c478bdstevel@tonic-gatestatic void rndc_addbytes(uint8_t *, size_t);
1247c478bdstevel@tonic-gatestatic void rndc_getbytes(uint8_t *ptr, size_t len);
1257c478bdstevel@tonic-gatestatic void rnd_handler(void *);
126717fae5Gordon Rossstatic void rnd_alloc_magazines(void);
127717fae5Gordon Rossstatic void rnd_fips_discard_initial(void);
128717fae5Gordon Rossstatic void rnd_init2(void *);
129717fae5Gordon Rossstatic void rnd_schedule_timeout(void);
1307c478bdstevel@tonic-gate
131717fae5Gordon Ross/*
132717fae5Gordon Ross * Called from kcf:_init()
133717fae5Gordon Ross */
1347c478bdstevel@tonic-gatevoid
1357c478bdstevel@tonic-gatekcf_rnd_init()
1367c478bdstevel@tonic-gate{
1377c478bdstevel@tonic-gate	hrtime_t ts;
1387c478bdstevel@tonic-gate	time_t now;
1397c478bdstevel@tonic-gate
1407c478bdstevel@tonic-gate	mutex_init(&rndpool_lock, NULL, MUTEX_DEFAULT, NULL);
1417c478bdstevel@tonic-gate	cv_init(&rndpool_read_cv, NULL, CV_DEFAULT, NULL);
1427c478bdstevel@tonic-gate
1437c478bdstevel@tonic-gate	/*
1447c478bdstevel@tonic-gate	 * Add bytes to the cache using
1457c478bdstevel@tonic-gate	 * . 2 unpredictable times: high resolution time since the boot-time,
1467c478bdstevel@tonic-gate	 *   and the current time-of-the day.
1477c478bdstevel@tonic-gate	 * This is used only to make the timeout value in the timer
1487c478bdstevel@tonic-gate	 * unpredictable.
1497c478bdstevel@tonic-gate	 */
1507c478bdstevel@tonic-gate	ts = gethrtime();
1517c478bdstevel@tonic-gate	rndc_addbytes((uint8_t *)&ts, sizeof (ts));
1527c478bdstevel@tonic-gate
1537c478bdstevel@tonic-gate	(void) drv_getparm(TIME, &now);
1547c478bdstevel@tonic-gate	rndc_addbytes((uint8_t *)&now, sizeof (now));
1557c478bdstevel@tonic-gate
1567c478bdstevel@tonic-gate	rnbyte_cnt = 0;
1577c478bdstevel@tonic-gate	findex = rindex = 0;
1587c478bdstevel@tonic-gate	num_waiters = 0;
1597c478bdstevel@tonic-gate
1607c478bdstevel@tonic-gate	rnd_alloc_magazines();
161717fae5Gordon Ross
162717fae5Gordon Ross	(void) taskq_dispatch(system_taskq, rnd_init2, NULL, TQ_SLEEP);
163717fae5Gordon Ross}
164717fae5Gordon Ross
165717fae5Gordon Ross/*
166717fae5Gordon Ross * This is called via the system taskq, so that we can do further
167717fae5Gordon Ross * initializations that have to wait until the kcf module itself is
168717fae5Gordon Ross * done loading.  (After kcf:_init returns.)
169717fae5Gordon Ross */
170717fae5Gordon Rossstatic void
171717fae5Gordon Rossrnd_init2(void *unused)
172717fae5Gordon Ross{
173717fae5Gordon Ross
174717fae5Gordon Ross	_NOTE(ARGUNUSED(unused));
175717fae5Gordon Ross
176717fae5Gordon Ross	/*
177717fae5Gordon Ross	 * This will load a randomness provider; typically "swrand",
178717fae5Gordon Ross	 * but could be another provider if so configured.
179717fae5Gordon Ross	 */
180717fae5Gordon Ross	rngmech_type = crypto_mech2id(SUN_RANDOM);
181717fae5Gordon Ross
182717fae5Gordon Ross	/* Update rng_prov_found etc. */
183717fae5Gordon Ross	(void) kcf_rngprov_check();
184717fae5Gordon Ross
185717fae5Gordon Ross	/* FIPS 140-2 init. */
186717fae5Gordon Ross	rnd_fips_discard_initial();
187717fae5Gordon Ross
188717fae5Gordon Ross	/* Start rnd_handler calls. */
189717fae5Gordon Ross	rnd_schedule_timeout();
1907c478bdstevel@tonic-gate}
1917c478bdstevel@tonic-gate
1927c478bdstevel@tonic-gate/*
1937c478bdstevel@tonic-gate * Return TRUE if at least one provider exists that can
1947c478bdstevel@tonic-gate * supply random numbers.
1957c478bdstevel@tonic-gate */
1967c478bdstevel@tonic-gateboolean_t
1977c478bdstevel@tonic-gatekcf_rngprov_check(void)
1987c478bdstevel@tonic-gate{
1997c478bdstevel@tonic-gate	int rv;
2007c478bdstevel@tonic-gate	kcf_provider_desc_t *pd;
2017c478bdstevel@tonic-gate
202436935aVladimir Kotal	if ((pd = kcf_get_mech_provider(rngmech_type, NULL, NULL, &rv,
2039b009fcValerie Bubb Fenwick	    NULL, CRYPTO_FG_RANDOM, 0)) != NULL) {
2047c478bdstevel@tonic-gate		KCF_PROV_REFRELE(pd);
205f317a3akrishna		/*
206f317a3akrishna		 * We logged a warning once about no provider being available
207f317a3akrishna		 * and now a provider became available. So, set the flag so
208f317a3akrishna		 * that we can log again if the problem recurs.
209f317a3akrishna		 */
210f317a3akrishna		rng_ok_to_log = B_TRUE;
211f317a3akrishna		rng_prov_found = B_TRUE;
2127c478bdstevel@tonic-gate		return (B_TRUE);
213f317a3akrishna	} else {
214f317a3akrishna		rng_prov_found = B_FALSE;
2157c478bdstevel@tonic-gate		return (B_FALSE);
216f317a3akrishna	}
2177c478bdstevel@tonic-gate}
2187c478bdstevel@tonic-gate
2197c478bdstevel@tonic-gate/*
2207c478bdstevel@tonic-gate * Pick a software-based provider and submit a request to seed
2217c478bdstevel@tonic-gate * its random number generator.
2227c478bdstevel@tonic-gate */
2237c478bdstevel@tonic-gatestatic void
2248047c9fmcpowersrngprov_seed(uint8_t *buf, int len, uint_t entropy_est, uint32_t flags)
2257c478bdstevel@tonic-gate{
2267c478bdstevel@tonic-gate	kcf_provider_desc_t *pd = NULL;
2277c478bdstevel@tonic-gate
2286a1073fkrishna	if (kcf_get_sw_prov(rngmech_type, &pd, NULL, B_FALSE) ==
2296a1073fkrishna	    CRYPTO_SUCCESS) {
2308047c9fmcpowers		(void) KCF_PROV_SEED_RANDOM(pd, pd->pd_sid, buf, len,
2318047c9fmcpowers		    entropy_est, flags, NULL);
2327c478bdstevel@tonic-gate		KCF_PROV_REFRELE(pd);
2337c478bdstevel@tonic-gate	}
2347c478bdstevel@tonic-gate}
2357c478bdstevel@tonic-gate
2367c478bdstevel@tonic-gate/*
2377c478bdstevel@tonic-gate * This routine is called for blocking reads.
2387c478bdstevel@tonic-gate *
2397c478bdstevel@tonic-gate * The argument is_taskq_thr indicates whether the caller is
2407c478bdstevel@tonic-gate * the taskq thread dispatched by the timeout handler routine.
2417c478bdstevel@tonic-gate * In this case, we cycle through all the providers
2427c478bdstevel@tonic-gate * submitting a request to each provider to generate random numbers.
2437c478bdstevel@tonic-gate *
2447c478bdstevel@tonic-gate * For other cases, we pick a provider and submit a request to generate
2457c478bdstevel@tonic-gate * random numbers. We retry using another provider if we get an error.
2467c478bdstevel@tonic-gate *
2477c478bdstevel@tonic-gate * Returns the number of bytes that are written to 'ptr'. Returns -1
2487c478bdstevel@tonic-gate * if no provider is found. ptr and need are unchanged.
2497c478bdstevel@tonic-gate */
2507c478bdstevel@tonic-gatestatic int
2518b50271Krishna Yendurirngprov_getbytes(uint8_t *ptr, size_t need, boolean_t is_taskq_thr)
2527c478bdstevel@tonic-gate{
2537c478bdstevel@tonic-gate	int rv;
2547c478bdstevel@tonic-gate	int prov_cnt = 0;
2557c478bdstevel@tonic-gate	int total_bytes = 0;
2567c478bdstevel@tonic-gate	kcf_provider_desc_t *pd;
2577c478bdstevel@tonic-gate	kcf_req_params_t params;
2587c478bdstevel@tonic-gate	kcf_prov_tried_t *list = NULL;
2597c478bdstevel@tonic-gate
260436935aVladimir Kotal	while ((pd = kcf_get_mech_provider(rngmech_type, NULL, NULL, &rv,
2619b009fcValerie Bubb Fenwick	    list, CRYPTO_FG_RANDOM, 0)) != NULL) {
2627c478bdstevel@tonic-gate
2637c478bdstevel@tonic-gate		prov_cnt++;
2647c478bdstevel@tonic-gate
2657c478bdstevel@tonic-gate		KCF_WRAP_RANDOM_OPS_PARAMS(&params, KCF_OP_RANDOM_GENERATE,
2668047c9fmcpowers		    pd->pd_sid, ptr, need, 0, 0);
2677c478bdstevel@tonic-gate		rv = kcf_submit_request(pd, NULL, NULL, &params, B_FALSE);
2687c478bdstevel@tonic-gate		ASSERT(rv != CRYPTO_QUEUED);
2697c478bdstevel@tonic-gate
2707c478bdstevel@tonic-gate		if (rv == CRYPTO_SUCCESS) {
2717c478bdstevel@tonic-gate			total_bytes += need;
2727c478bdstevel@tonic-gate			if (is_taskq_thr)
2737c478bdstevel@tonic-gate				rndc_addbytes(ptr, need);
2747c478bdstevel@tonic-gate			else {
2757c478bdstevel@tonic-gate				KCF_PROV_REFRELE(pd);
2767c478bdstevel@tonic-gate				break;
2777c478bdstevel@tonic-gate			}
2787c478bdstevel@tonic-gate		}
2797c478bdstevel@tonic-gate
2807c478bdstevel@tonic-gate		if (is_taskq_thr || rv != CRYPTO_SUCCESS) {
2817c478bdstevel@tonic-gate			/* Add pd to the linked list of providers tried. */
2827c478bdstevel@tonic-gate			if (kcf_insert_triedlist(&list, pd, KM_SLEEP) == NULL) {
2837c478bdstevel@tonic-gate				KCF_PROV_REFRELE(pd);
2847c478bdstevel@tonic-gate				break;
2857c478bdstevel@tonic-gate			}
2867c478bdstevel@tonic-gate		}
2877c478bdstevel@tonic-gate
2887c478bdstevel@tonic-gate	}
2897c478bdstevel@tonic-gate
2907c478bdstevel@tonic-gate	if (list != NULL)
2917c478bdstevel@tonic-gate		kcf_free_triedlist(list);
2927c478bdstevel@tonic-gate
2937c478bdstevel@tonic-gate	if (prov_cnt == 0) { /* no provider could be found. */
294f317a3akrishna		rng_prov_found = B_FALSE;
2957c478bdstevel@tonic-gate		return (-1);
296f317a3akrishna	} else {
297f317a3akrishna		rng_prov_found = B_TRUE;
298f317a3akrishna		/* See comments in kcf_rngprov_check() */
299f317a3akrishna		rng_ok_to_log = B_TRUE;
3007c478bdstevel@tonic-gate	}
3017c478bdstevel@tonic-gate
3027c478bdstevel@tonic-gate	return (total_bytes);
3037c478bdstevel@tonic-gate}
3047c478bdstevel@tonic-gate
3057c478bdstevel@tonic-gatestatic void
3067c478bdstevel@tonic-gatenotify_done(void *arg, int rv)
3077c478bdstevel@tonic-gate{
3087c478bdstevel@tonic-gate	uchar_t *rndbuf = arg;
3097c478bdstevel@tonic-gate
3107c478bdstevel@tonic-gate	if (rv == CRYPTO_SUCCESS)
3117c478bdstevel@tonic-gate		rndc_addbytes(rndbuf, MINEXTRACTBYTES);
3127c478bdstevel@tonic-gate
3137c478bdstevel@tonic-gate	bzero(rndbuf, MINEXTRACTBYTES);
3147c478bdstevel@tonic-gate	kmem_free(rndbuf, MINEXTRACTBYTES);
3157c478bdstevel@tonic-gate}
3167c478bdstevel@tonic-gate
3177c478bdstevel@tonic-gate/*
3187c478bdstevel@tonic-gate * Cycle through all the providers submitting a request to each provider
3197c478bdstevel@tonic-gate * to generate random numbers. This is called for the modes - NONBLOCK_EXTRACT
3207c478bdstevel@tonic-gate * and ALWAYS_EXTRACT.
3217c478bdstevel@tonic-gate *
3227c478bdstevel@tonic-gate * Returns the number of bytes that are written to 'ptr'. Returns -1
3237c478bdstevel@tonic-gate * if no provider is found. ptr and len are unchanged.
3247c478bdstevel@tonic-gate */
3257c478bdstevel@tonic-gatestatic int
3268b50271Krishna Yendurirngprov_getbytes_nblk(uint8_t *ptr, size_t len)
3277c478bdstevel@tonic-gate{
328104d3bdDan OpenSolaris Anderson	int rv, total_bytes;
329104d3bdDan OpenSolaris Anderson	size_t blen;
3307c478bdstevel@tonic-gate	uchar_t *rndbuf;
3317c478bdstevel@tonic-gate	kcf_provider_desc_t *pd;
3327c478bdstevel@tonic-gate	kcf_req_params_t params;
3337c478bdstevel@tonic-gate	crypto_call_req_t req;
3347c478bdstevel@tonic-gate	kcf_prov_tried_t *list = NULL;
3357c478bdstevel@tonic-gate	int prov_cnt = 0;
3367c478bdstevel@tonic-gate
3377c478bdstevel@tonic-gate	blen = 0;
3387c478bdstevel@tonic-gate	total_bytes = 0;
3397c478bdstevel@tonic-gate	req.cr_flag = CRYPTO_SKIP_REQID;
3407c478bdstevel@tonic-gate	req.cr_callback_func = notify_done;
3417c478bdstevel@tonic-gate
342436935aVladimir Kotal	while ((pd = kcf_get_mech_provider(rngmech_type, NULL, NULL, &rv,
3439b009fcValerie Bubb Fenwick	    list, CRYPTO_FG_RANDOM, 0)) != NULL) {
3447c478bdstevel@tonic-gate
3457c478bdstevel@tonic-gate		prov_cnt ++;
3467c478bdstevel@tonic-gate		switch (pd->pd_prov_type) {
3477c478bdstevel@tonic-gate		case CRYPTO_HW_PROVIDER:
3487c478bdstevel@tonic-gate			/*
3497c478bdstevel@tonic-gate			 * We have to allocate a buffer here as we can not
3507c478bdstevel@tonic-gate			 * assume that the input buffer will remain valid
3517c478bdstevel@tonic-gate			 * when the callback comes. We use a fixed size buffer
3527c478bdstevel@tonic-gate			 * to simplify the book keeping.
3537c478bdstevel@tonic-gate			 */
3547c478bdstevel@tonic-gate			rndbuf = kmem_alloc(MINEXTRACTBYTES, KM_NOSLEEP);
3557c478bdstevel@tonic-gate			if (rndbuf == NULL) {
3567c478bdstevel@tonic-gate				KCF_PROV_REFRELE(pd);
3577c478bdstevel@tonic-gate				if (list != NULL)
3587c478bdstevel@tonic-gate					kcf_free_triedlist(list);
3597c478bdstevel@tonic-gate				return (total_bytes);
3607c478bdstevel@tonic-gate			}
3617c478bdstevel@tonic-gate			req.cr_callback_arg = rndbuf;
3627c478bdstevel@tonic-gate			KCF_WRAP_RANDOM_OPS_PARAMS(&params,
3637c478bdstevel@tonic-gate			    KCF_OP_RANDOM_GENERATE,
3648047c9fmcpowers			    pd->pd_sid, rndbuf, MINEXTRACTBYTES, 0, 0);
3657c478bdstevel@tonic-gate			break;
3667c478bdstevel@tonic-gate
3677c478bdstevel@tonic-gate		case CRYPTO_SW_PROVIDER:
3687c478bdstevel@tonic-gate			/*
3697c478bdstevel@tonic-gate			 * We do not need to allocate a buffer in the software
3707c478bdstevel@tonic-gate			 * provider case as there is no callback involved. We
3717c478bdstevel@tonic-gate			 * avoid any extra data copy by directly passing 'ptr'.
3727c478bdstevel@tonic-gate			 */
3737c478bdstevel@tonic-gate			KCF_WRAP_RANDOM_OPS_PARAMS(&params,
3747c478bdstevel@tonic-gate			    KCF_OP_RANDOM_GENERATE,
3758047c9fmcpowers			    pd->pd_sid, ptr, len, 0, 0);
3767c478bdstevel@tonic-gate			break;
3777c478bdstevel@tonic-gate		}
3787c478bdstevel@tonic-gate
3797c478bdstevel@tonic-gate		rv = kcf_submit_request(pd, NULL, &req, &params, B_FALSE);
3807c478bdstevel@tonic-gate		if (rv == CRYPTO_SUCCESS) {
3817c478bdstevel@tonic-gate			switch (pd->pd_prov_type) {
3827c478bdstevel@tonic-gate			case CRYPTO_HW_PROVIDER:
3837c478bdstevel@tonic-gate				/*
3847c478bdstevel@tonic-gate				 * Since we have the input buffer handy,
3857c478bdstevel@tonic-gate				 * we directly copy to it rather than
3867c478bdstevel@tonic-gate				 * adding to the pool.
3877c478bdstevel@tonic-gate				 */
3887c478bdstevel@tonic-gate				blen = min(MINEXTRACTBYTES, len);
3897c478bdstevel@tonic-gate				bcopy(rndbuf, ptr, blen);
3907c478bdstevel@tonic-gate				if (len < MINEXTRACTBYTES)
3917c478bdstevel@tonic-gate					rndc_addbytes(rndbuf + len,
3927c478bdstevel@tonic-gate					    MINEXTRACTBYTES - len);
3937c478bdstevel@tonic-gate				ptr += blen;
3947c478bdstevel@tonic-gate				len -= blen;
3957c478bdstevel@tonic-gate				total_bytes += blen;
3967c478bdstevel@tonic-gate				break;
3977c478bdstevel@tonic-gate
3987c478bdstevel@tonic-gate			case CRYPTO_SW_PROVIDER:
3997c478bdstevel@tonic-gate				total_bytes += len;
4007c478bdstevel@tonic-gate				len = 0;
4017c478bdstevel@tonic-gate				break;
4027c478bdstevel@tonic-gate			}
4037c478bdstevel@tonic-gate		}
4047c478bdstevel@tonic-gate
4057c478bdstevel@tonic-gate		/*
4067c478bdstevel@tonic-gate		 * We free the buffer in the callback routine
4077c478bdstevel@tonic-gate		 * for the CRYPTO_QUEUED case.
4087c478bdstevel@tonic-gate		 */
4097c478bdstevel@tonic-gate		if (pd->pd_prov_type == CRYPTO_HW_PROVIDER &&
4107c478bdstevel@tonic-gate		    rv != CRYPTO_QUEUED) {
4117c478bdstevel@tonic-gate			bzero(rndbuf, MINEXTRACTBYTES);
4127c478bdstevel@tonic-gate			kmem_free(rndbuf, MINEXTRACTBYTES);
4137c478bdstevel@tonic-gate		}
4147c478bdstevel@tonic-gate
4157c478bdstevel@tonic-gate		if (len == 0) {
4167c478bdstevel@tonic-gate			KCF_PROV_REFRELE(pd);
4177c478bdstevel@tonic-gate			break;
4187c478bdstevel@tonic-gate		}
4197c478bdstevel@tonic-gate
4207c478bdstevel@tonic-gate		if (rv != CRYPTO_SUCCESS) {
4217c478bdstevel@tonic-gate			/* Add pd to the linked list of providers tried. */
4227c478bdstevel@tonic-gate			if (kcf_insert_triedlist(&list, pd, KM_NOSLEEP) ==
4237c478bdstevel@tonic-gate			    NULL) {
4247c478bdstevel@tonic-gate				KCF_PROV_REFRELE(pd);
4257c478bdstevel@tonic-gate				break;
4267c478bdstevel@tonic-gate			}
4277c478bdstevel@tonic-gate		}
4287c478bdstevel@tonic-gate	}
4297c478bdstevel@tonic-gate
4307c478bdstevel@tonic-gate	if (list != NULL) {
4317c478bdstevel@tonic-gate		kcf_free_triedlist(list);
4327c478bdstevel@tonic-gate	}
4337c478bdstevel@tonic-gate
4347c478bdstevel@tonic-gate	if (prov_cnt == 0) { /* no provider could be found. */
435f317a3akrishna		rng_prov_found = B_FALSE;
4367c478bdstevel@tonic-gate		return (-1);
437f317a3akrishna	} else {
438f317a3akrishna		rng_prov_found = B_TRUE;
439f317a3akrishna		/* See comments in kcf_rngprov_check() */
440f317a3akrishna		rng_ok_to_log = B_TRUE;
4417c478bdstevel@tonic-gate	}
4427c478bdstevel@tonic-gate
4437c478bdstevel@tonic-gate	return (total_bytes);
4447c478bdstevel@tonic-gate}
4457c478bdstevel@tonic-gate
4467c478bdstevel@tonic-gatestatic void
4477c478bdstevel@tonic-gaterngprov_task(void *arg)
4487c478bdstevel@tonic-gate{
4497c478bdstevel@tonic-gate	int len = (int)(uintptr_t)arg;
4507c478bdstevel@tonic-gate	uchar_t tbuf[MAXEXTRACTBYTES];
4517c478bdstevel@tonic-gate
4527c478bdstevel@tonic-gate	ASSERT(len <= MAXEXTRACTBYTES);
4538b50271Krishna Yenduri	(void) rngprov_getbytes(tbuf, len, B_TRUE);
454f5229b7Krishna Yenduri	rngprov_task_idle = B_TRUE;
4557c478bdstevel@tonic-gate}
4567c478bdstevel@tonic-gate
4577c478bdstevel@tonic-gate/*
4587c478bdstevel@tonic-gate * Returns "len" random or pseudo-random bytes in *ptr.
4597c478bdstevel@tonic-gate * Will block if not enough random bytes are available and the
4607c478bdstevel@tonic-gate * call is blocking.
4617c478bdstevel@tonic-gate *
4627c478bdstevel@tonic-gate * Called with rndpool_lock held (allowing caller to do optimistic locking;
4637c478bdstevel@tonic-gate * releases the lock before return).
4647c478bdstevel@tonic-gate */
4657c478bdstevel@tonic-gatestatic int
4668b50271Krishna Yendurirnd_get_bytes(uint8_t *ptr, size_t len, extract_type_t how)
4677c478bdstevel@tonic-gate{
46895014fbDan OpenSolaris Anderson	size_t	bytes;
46995014fbDan OpenSolaris Anderson	int	got;
4707c478bdstevel@tonic-gate
4717c478bdstevel@tonic-gate	ASSERT(mutex_owned(&rndpool_lock));
4727c478bdstevel@tonic-gate	/*
4737c478bdstevel@tonic-gate	 * Check if the request can be satisfied from the cache
4747c478bdstevel@tonic-gate	 * of random bytes.
4757c478bdstevel@tonic-gate	 */
4767c478bdstevel@tonic-gate	if (len <= rnbyte_cnt) {
4777c478bdstevel@tonic-gate		rndc_getbytes(ptr, len);
4787c478bdstevel@tonic-gate		mutex_exit(&rndpool_lock);
4797c478bdstevel@tonic-gate		return (0);
4807c478bdstevel@tonic-gate	}
4817c478bdstevel@tonic-gate	mutex_exit(&rndpool_lock);
4827c478bdstevel@tonic-gate
4837c478bdstevel@tonic-gate	switch (how) {
4847c478bdstevel@tonic-gate	case BLOCKING_EXTRACT:
4858b50271Krishna Yenduri		if ((got = rngprov_getbytes(ptr, len, B_FALSE)) == -1)
4867c478bdstevel@tonic-gate			break;	/* No provider found */
4877c478bdstevel@tonic-gate
4887c478bdstevel@tonic-gate		if (got == len)
4897c478bdstevel@tonic-gate			return (0);
4907c478bdstevel@tonic-gate		len -= got;
4917c478bdstevel@tonic-gate		ptr += got;
4927c478bdstevel@tonic-gate		break;
4937c478bdstevel@tonic-gate
4947c478bdstevel@tonic-gate	case NONBLOCK_EXTRACT:
4957c478bdstevel@tonic-gate	case ALWAYS_EXTRACT:
4968b50271Krishna Yenduri		if ((got = rngprov_getbytes_nblk(ptr, len)) == -1) {
4977c478bdstevel@tonic-gate			/* No provider found */
4987c478bdstevel@tonic-gate			if (how == NONBLOCK_EXTRACT) {
4997c478bdstevel@tonic-gate				return (EAGAIN);
5007c478bdstevel@tonic-gate			}
5017c478bdstevel@tonic-gate		} else {
5027c478bdstevel@tonic-gate			if (got == len)
5037c478bdstevel@tonic-gate				return (0);
5047c478bdstevel@tonic-gate			len -= got;
5057c478bdstevel@tonic-gate			ptr += got;
5067c478bdstevel@tonic-gate		}
5077c478bdstevel@tonic-gate		if (how == NONBLOCK_EXTRACT && (rnbyte_cnt < len))
5087c478bdstevel@tonic-gate			return (EAGAIN);
5097c478bdstevel@tonic-gate		break;
5107c478bdstevel@tonic-gate	}
5117c478bdstevel@tonic-gate
5127c478bdstevel@tonic-gate	mutex_enter(&rndpool_lock);
5137c478bdstevel@tonic-gate	while (len > 0) {
5147c478bdstevel@tonic-gate		if (how == BLOCKING_EXTRACT) {
5157c478bdstevel@tonic-gate			/* Check if there is enough */
5167c478bdstevel@tonic-gate			while (rnbyte_cnt < MINEXTRACTBYTES) {
5177c478bdstevel@tonic-gate				num_waiters++;
5187c478bdstevel@tonic-gate				if (cv_wait_sig(&rndpool_read_cv,
5197c478bdstevel@tonic-gate				    &rndpool_lock) == 0) {
5207c478bdstevel@tonic-gate					num_waiters--;
5217c478bdstevel@tonic-gate					mutex_exit(&rndpool_lock);
5227c478bdstevel@tonic-gate					return (EINTR);
5237c478bdstevel@tonic-gate				}
5247c478bdstevel@tonic-gate				num_waiters--;
5257c478bdstevel@tonic-gate			}
5267c478bdstevel@tonic-gate		}
5277c478bdstevel@tonic-gate
5287c478bdstevel@tonic-gate		/* Figure out how many bytes to extract */
5297c478bdstevel@tonic-gate		bytes = min(len, rnbyte_cnt);
5307c478bdstevel@tonic-gate		rndc_getbytes(ptr, bytes);
5317c478bdstevel@tonic-gate
5327c478bdstevel@tonic-gate		len -= bytes;
5337c478bdstevel@tonic-gate		ptr += bytes;
5347c478bdstevel@tonic-gate
5357c478bdstevel@tonic-gate		if (len > 0 && how == ALWAYS_EXTRACT) {
5367c478bdstevel@tonic-gate			/*
5377c478bdstevel@tonic-gate			 * There are not enough bytes, but we can not block.
5387c478bdstevel@tonic-gate			 * This only happens in the case of /dev/urandom which
5397c478bdstevel@tonic-gate			 * runs an additional generation algorithm. So, there
5407c478bdstevel@tonic-gate			 * is no problem.
5417c478bdstevel@tonic-gate			 */
5427c478bdstevel@tonic-gate			while (len > 0) {
5437c478bdstevel@tonic-gate				*ptr = rndpool[findex];
5447c478bdstevel@tonic-gate				ptr++; len--;
5457c478bdstevel@tonic-gate				rindex = findex = (findex + 1) &
5467c478bdstevel@tonic-gate				    (RNDPOOLSIZE - 1);
5477c478bdstevel@tonic-gate			}
5487c478bdstevel@tonic-gate			break;
5497c478bdstevel@tonic-gate		}
5507c478bdstevel@tonic-gate	}
5517c478bdstevel@tonic-gate
5527c478bdstevel@tonic-gate	mutex_exit(&rndpool_lock);
5537c478bdstevel@tonic-gate	return (0);
5547c478bdstevel@tonic-gate}
5557c478bdstevel@tonic-gate
5567c478bdstevel@tonic-gateint
5578b50271Krishna Yendurikcf_rnd_get_bytes(uint8_t *ptr, size_t len, boolean_t noblock)
5587c478bdstevel@tonic-gate{
5597c478bdstevel@tonic-gate	extract_type_t how;
5607c478bdstevel@tonic-gate	int error;
5617c478bdstevel@tonic-gate
5627c478bdstevel@tonic-gate	how = noblock ? NONBLOCK_EXTRACT : BLOCKING_EXTRACT;
5637c478bdstevel@tonic-gate	mutex_enter(&rndpool_lock);
5648b50271Krishna Yenduri	if ((error = rnd_get_bytes(ptr, len, how)) != 0)
5657c478bdstevel@tonic-gate		return (error);
5667c478bdstevel@tonic-gate
5677c478bdstevel@tonic-gate	BUMP_RND_STATS(rs_rndOut, len);
5687c478bdstevel@tonic-gate	return (0);
5697c478bdstevel@tonic-gate}
5707c478bdstevel@tonic-gate
5717c478bdstevel@tonic-gate/*
5727c478bdstevel@tonic-gate * Revisit this if the structs grow or we come up with a better way
5737c478bdstevel@tonic-gate * of cache-line-padding structures.
5747c478bdstevel@tonic-gate */
5757c478bdstevel@tonic-gate#define	RND_CPU_CACHE_SIZE	64
576fe54a78Hai-May Chao#define	RND_CPU_PAD_SIZE	RND_CPU_CACHE_SIZE*6
5777c478bdstevel@tonic-gate#define	RND_CPU_PAD (RND_CPU_PAD_SIZE - \
578fe54a78Hai-May Chao	sizeof (rndmag_t))
5797c478bdstevel@tonic-gate/*
5807c478bdstevel@tonic-gate * Per-CPU random state.  Somewhat like like kmem's magazines, this provides
5817c478bdstevel@tonic-gate * a per-CPU instance of the pseudo-random generator.  We have it much easier
5827c478bdstevel@tonic-gate * than kmem, as we can afford to "leak" random bits if a CPU is DR'ed out.
5837c478bdstevel@tonic-gate *
5847c478bdstevel@tonic-gate * Note that this usage is preemption-safe; a thread
5857c478bdstevel@tonic-gate * entering a critical section remembers which generator it locked
5867c478bdstevel@tonic-gate * and unlocks the same one; should it be preempted and wind up running on
5877c478bdstevel@tonic-gate * a different CPU, there will be a brief period of increased contention
5887c478bdstevel@tonic-gate * before it exits the critical section but nothing will melt.
5897c478bdstevel@tonic-gate */
5907c478bdstevel@tonic-gatetypedef struct rndmag_s
5917c478bdstevel@tonic-gate{
5927c478bdstevel@tonic-gate	kmutex_t	rm_lock;
59356498afHai-May Chao	uint8_t		*rm_buffer;	/* Start of buffer */
5947c478bdstevel@tonic-gate	uint8_t		*rm_eptr;	/* End of buffer */
5957c478bdstevel@tonic-gate	uint8_t		*rm_rptr;	/* Current read pointer */
5967c478bdstevel@tonic-gate	uint32_t	rm_oblocks;	/* time to rekey? */
5977c478bdstevel@tonic-gate	uint32_t	rm_ofuzz;	/* Rekey backoff state */
5987c478bdstevel@tonic-gate	uint32_t	rm_olimit;	/* Hard rekey limit */
5997c478bdstevel@tonic-gate	rnd_stats_t	rm_stats;	/* Per-CPU Statistics */
60056498afHai-May Chao	uint32_t	rm_key[HASHSIZE/BYTES_IN_WORD];	/* FIPS XKEY */
60156498afHai-May Chao	uint32_t	rm_seed[HASHSIZE/BYTES_IN_WORD]; /* seed for rekey */
60256498afHai-May Chao	uint32_t	rm_previous[HASHSIZE/BYTES_IN_WORD]; /* prev random */
6037c478bdstevel@tonic-gate} rndmag_t;
6047c478bdstevel@tonic-gate
605fe54a78Hai-May Chaotypedef struct rndmag_pad_s
606fe54a78Hai-May Chao{
607fe54a78Hai-May Chao	rndmag_t	rm_mag;
608fe54a78Hai-May Chao	uint8_t		rm_pad[RND_CPU_PAD];
609fe54a78Hai-May Chao} rndmag_pad_t;
610fe54a78Hai-May Chao
6117c478bdstevel@tonic-gate/*
612fe54a78Hai-May Chao * Generate random bytes for /dev/urandom by applying the
613fe54a78Hai-May Chao * FIPS 186-2 algorithm with a key created from bytes extracted
6147c478bdstevel@tonic-gate * from the pool.  A maximum of PRNG_MAXOBLOCKS output blocks
6157c478bdstevel@tonic-gate * is generated before a new key is obtained.
6167c478bdstevel@tonic-gate *
6177c478bdstevel@tonic-gate * Note that callers to this routine are likely to assume it can't fail.
6187c478bdstevel@tonic-gate *
6197c478bdstevel@tonic-gate * Called with rmp locked; releases lock.
6207c478bdstevel@tonic-gate */
6217c478bdstevel@tonic-gatestatic int
622fe54a78Hai-May Chaornd_generate_pseudo_bytes(rndmag_pad_t *rmp, uint8_t *ptr, size_t len)
6237c478bdstevel@tonic-gate{
624104d3bdDan OpenSolaris Anderson	size_t bytes = len, size;
625104d3bdDan OpenSolaris Anderson	int nblock;
6267c478bdstevel@tonic-gate	uint32_t oblocks;
62756498afHai-May Chao	uint32_t tempout[HASHSIZE/BYTES_IN_WORD];
62856498afHai-May Chao	uint32_t seed[HASHSIZE/BYTES_IN_WORD];
629fe54a78Hai-May Chao	int i;
630fe54a78Hai-May Chao	hrtime_t timestamp;
631fe54a78Hai-May Chao	uint8_t *src, *dst;
6327c478bdstevel@tonic-gate
633fe54a78Hai-May Chao	ASSERT(mutex_owned(&rmp->rm_mag.rm_lock));
6347c478bdstevel@tonic-gate
6357c478bdstevel@tonic-gate	/* Nothing is being asked */
6367c478bdstevel@tonic-gate	if (len == 0) {
637fe54a78Hai-May Chao		mutex_exit(&rmp->rm_mag.rm_lock);
6387c478bdstevel@tonic-gate		return (0);
6397c478bdstevel@tonic-gate	}
6407c478bdstevel@tonic-gate
6417c478bdstevel@tonic-gate	nblock = howmany(len, HASHSIZE);
6427c478bdstevel@tonic-gate
643fe54a78Hai-May Chao	rmp->rm_mag.rm_oblocks += nblock;
644fe54a78Hai-May Chao	oblocks = rmp->rm_mag.rm_oblocks;
6457c478bdstevel@tonic-gate
6467c478bdstevel@tonic-gate	do {
647fe54a78Hai-May Chao		if (oblocks >= rmp->rm_mag.rm_olimit) {
6487c478bdstevel@tonic-gate
6497c478bdstevel@tonic-gate			/*
6507c478bdstevel@tonic-gate			 * Contention-avoiding rekey: see if
6517c478bdstevel@tonic-gate			 * the pool is locked, and if so, wait a bit.
6527c478bdstevel@tonic-gate			 * Do an 'exponential back-in' to ensure we don't
6537c478bdstevel@tonic-gate			 * run too long without rekey.
6547c478bdstevel@tonic-gate			 */
655fe54a78Hai-May Chao			if (rmp->rm_mag.rm_ofuzz) {
6567c478bdstevel@tonic-gate				/*
6577c478bdstevel@tonic-gate				 * Decaying exponential back-in for rekey.
6587c478bdstevel@tonic-gate				 */
6597c478bdstevel@tonic-gate				if ((rnbyte_cnt < MINEXTRACTBYTES) ||
6607c478bdstevel@tonic-gate				    (!mutex_tryenter(&rndpool_lock))) {
661fe54a78Hai-May Chao					rmp->rm_mag.rm_olimit +=
662fe54a78Hai-May Chao					    rmp->rm_mag.rm_ofuzz;
663fe54a78Hai-May Chao					rmp->rm_mag.rm_ofuzz >>= 1;
6647c478bdstevel@tonic-gate					goto punt;
6657c478bdstevel@tonic-gate				}
6667c478bdstevel@tonic-gate			} else {
6677c478bdstevel@tonic-gate				mutex_enter(&rndpool_lock);
6687c478bdstevel@tonic-gate			}
6697c478bdstevel@tonic-gate
6707c478bdstevel@tonic-gate			/* Get a new chunk of entropy */
671fe54a78Hai-May Chao			(void) rnd_get_bytes((uint8_t *)rmp->rm_mag.rm_key,
6728b50271Krishna Yenduri			    HMAC_KEYSIZE, ALWAYS_EXTRACT);
673fe54a78Hai-May Chao
674fe54a78Hai-May Chao			rmp->rm_mag.rm_olimit = PRNG_MAXOBLOCKS/2;
675fe54a78Hai-May Chao			rmp->rm_mag.rm_ofuzz = PRNG_MAXOBLOCKS/4;
6767c478bdstevel@tonic-gate			oblocks = 0;
677fe54a78Hai-May Chao			rmp->rm_mag.rm_oblocks = nblock;
6787c478bdstevel@tonic-gate		}
6797c478bdstevel@tonic-gatepunt:
680fe54a78Hai-May Chao		timestamp = gethrtime();
681fe54a78Hai-May Chao
682fe54a78Hai-May Chao		src = (uint8_t *)&timestamp;
683fe54a78Hai-May Chao		dst = (uint8_t *)rmp->rm_mag.rm_seed;
684fe54a78Hai-May Chao
685fe54a78Hai-May Chao		for (i = 0; i < HASHSIZE; i++) {
686fe54a78Hai-May Chao			dst[i] ^= src[i % sizeof (timestamp)];
687fe54a78Hai-May Chao		}
688fe54a78Hai-May Chao
689fe54a78Hai-May Chao		bcopy(rmp->rm_mag.rm_seed, seed, HASHSIZE);
690fe54a78Hai-May Chao
691fe54a78Hai-May Chao		fips_random_inner(rmp->rm_mag.rm_key, tempout,
692fe54a78Hai-May Chao		    seed);
693fe54a78Hai-May Chao
6947c478bdstevel@tonic-gate		if (bytes >= HASHSIZE) {
6957c478bdstevel@tonic-gate			size = HASHSIZE;
6967c478bdstevel@tonic-gate		} else {
6977c478bdstevel@tonic-gate			size = min(bytes, HASHSIZE);
6987c478bdstevel@tonic-gate		}
699fe54a78Hai-May Chao
700fe54a78Hai-May Chao		/*
701fe54a78Hai-May Chao		 * FIPS 140-2: Continuous RNG test - each generation
702fe54a78Hai-May Chao		 * of an n-bit block shall be compared with the previously
703fe54a78Hai-May Chao		 * generated block. Test shall fail if any two compared
704fe54a78Hai-May Chao		 * n-bit blocks are equal.
705fe54a78Hai-May Chao		 */
70656498afHai-May Chao		for (i = 0; i < HASHSIZE/BYTES_IN_WORD; i++) {
707fe54a78Hai-May Chao			if (tempout[i] != rmp->rm_mag.rm_previous[i])
708fe54a78Hai-May Chao				break;
709fe54a78Hai-May Chao		}
710b5a2d84Hai-May Chao		if (i == HASHSIZE/BYTES_IN_WORD) {
711fe54a78Hai-May Chao			cmn_err(CE_WARN, "kcf_random: The value of 160-bit "
712fe54a78Hai-May Chao			    "block random bytes are same as the previous "
713fe54a78Hai-May Chao			    "one.\n");
714b5a2d84Hai-May Chao			/* discard random bytes and return error */
715b971bb4Valerie Bubb Fenwick			mutex_exit(&rmp->rm_mag.rm_lock);
716b5a2d84Hai-May Chao			return (EIO);
717b5a2d84Hai-May Chao		}
718fe54a78Hai-May Chao
719fe54a78Hai-May Chao		bcopy(tempout, rmp->rm_mag.rm_previous,
720fe54a78Hai-May Chao		    HASHSIZE);
721fe54a78Hai-May Chao
722fe54a78Hai-May Chao		bcopy(tempout, ptr, size);
7237c478bdstevel@tonic-gate		ptr += size;
7247c478bdstevel@tonic-gate		bytes -= size;
7257c478bdstevel@tonic-gate		oblocks++;
7267c478bdstevel@tonic-gate		nblock--;
7277c478bdstevel@tonic-gate	} while (bytes > 0);
7287c478bdstevel@tonic-gate
729fe54a78Hai-May Chao	/* Zero out sensitive information */
730fe54a78Hai-May Chao	bzero(seed, HASHSIZE);
731fe54a78Hai-May Chao	bzero(tempout, HASHSIZE);
732fe54a78Hai-May Chao	mutex_exit(&rmp->rm_mag.rm_lock);
7337c478bdstevel@tonic-gate	return (0);
7347c478bdstevel@tonic-gate}
7357c478bdstevel@tonic-gate
7367c478bdstevel@tonic-gate/*
7377c478bdstevel@tonic-gate * Per-CPU Random magazines.
7387c478bdstevel@tonic-gate */
739fe54a78Hai-May Chaostatic rndmag_pad_t *rndmag;
7407c478bdstevel@tonic-gatestatic uint8_t	*rndbuf;
7417c478bdstevel@tonic-gatestatic size_t 	rndmag_total;
7427c478bdstevel@tonic-gate/*
7437c478bdstevel@tonic-gate * common/os/cpu.c says that platform support code can shrinkwrap
7447c478bdstevel@tonic-gate * max_ncpus.  On the off chance that we get loaded very early, we
7457c478bdstevel@tonic-gate * read it exactly once, to copy it here.
7467c478bdstevel@tonic-gate */
7477c478bdstevel@tonic-gatestatic uint32_t	random_max_ncpus = 0;
7487c478bdstevel@tonic-gate
7497c478bdstevel@tonic-gate/*
7507c478bdstevel@tonic-gate * Boot-time tunables, for experimentation.
7517c478bdstevel@tonic-gate */
75202f574fkaissize_t	rndmag_threshold = 2560;
75302f574fkaissize_t	rndbuf_len = 5120;
754fa626f0krishnasize_t	rndmag_size = 1280;
7557c478bdstevel@tonic-gate
7567c478bdstevel@tonic-gate
7577c478bdstevel@tonic-gateint
7587c478bdstevel@tonic-gatekcf_rnd_get_pseudo_bytes(uint8_t *ptr, size_t len)
7597c478bdstevel@tonic-gate{
760fe54a78Hai-May Chao	rndmag_pad_t *rmp;
7617c478bdstevel@tonic-gate	uint8_t *cptr, *eptr;
7627c478bdstevel@tonic-gate
7637c478bdstevel@tonic-gate	/*
7647c478bdstevel@tonic-gate	 * Anyone who asks for zero bytes of randomness should get slapped.
7657c478bdstevel@tonic-gate	 */
7667c478bdstevel@tonic-gate	ASSERT(len > 0);
7677c478bdstevel@tonic-gate
7687c478bdstevel@tonic-gate	/*
7697c478bdstevel@tonic-gate	 * Fast path.
7707c478bdstevel@tonic-gate	 */
7717c478bdstevel@tonic-gate	for (;;) {
7727c478bdstevel@tonic-gate		rmp = &rndmag[CPU->cpu_seqid];
773fe54a78Hai-May Chao		mutex_enter(&rmp->rm_mag.rm_lock);
7747c478bdstevel@tonic-gate
7757c478bdstevel@tonic-gate		/*
7767c478bdstevel@tonic-gate		 * Big requests bypass buffer and tail-call the
7777c478bdstevel@tonic-gate		 * generate routine directly.
7787c478bdstevel@tonic-gate		 */
7797c478bdstevel@tonic-gate		if (len > rndmag_threshold) {
7807c478bdstevel@tonic-gate			BUMP_CPU_RND_STATS(rmp, rs_urndOut, len);
7817c478bdstevel@tonic-gate			return (rnd_generate_pseudo_bytes(rmp, ptr, len));
7827c478bdstevel@tonic-gate		}
7837c478bdstevel@tonic-gate
784fe54a78Hai-May Chao		cptr = rmp->rm_mag.rm_rptr;
7857c478bdstevel@tonic-gate		eptr = cptr + len;
7867c478bdstevel@tonic-gate
787fe54a78Hai-May Chao		if (eptr <= rmp->rm_mag.rm_eptr) {
788fe54a78Hai-May Chao			rmp->rm_mag.rm_rptr = eptr;
7897c478bdstevel@tonic-gate			bcopy(cptr, ptr, len);
7907c478bdstevel@tonic-gate			BUMP_CPU_RND_STATS(rmp, rs_urndOut, len);
791fe54a78Hai-May Chao			mutex_exit(&rmp->rm_mag.rm_lock);
7927c478bdstevel@tonic-gate
7937c478bdstevel@tonic-gate			return (0);
7947c478bdstevel@tonic-gate		}
7957c478bdstevel@tonic-gate		/*
7967c478bdstevel@tonic-gate		 * End fast path.
7977c478bdstevel@tonic-gate		 */
798fe54a78Hai-May Chao		rmp->rm_mag.rm_rptr = rmp->rm_mag.rm_buffer;
7997c478bdstevel@tonic-gate		/*
8007c478bdstevel@tonic-gate		 * Note:  We assume the generate routine always succeeds
8017c478bdstevel@tonic-gate		 * in this case (because it does at present..)
8027c478bdstevel@tonic-gate		 * It also always releases rm_lock.
8037c478bdstevel@tonic-gate		 */
804fe54a78Hai-May Chao		(void) rnd_generate_pseudo_bytes(rmp, rmp->rm_mag.rm_buffer,
8057c478bdstevel@tonic-gate		    rndbuf_len);
8067c478bdstevel@tonic-gate	}
8077c478bdstevel@tonic-gate}
8087c478bdstevel@tonic-gate
8097c478bdstevel@tonic-gate/*
8107c478bdstevel@tonic-gate * We set up (empty) magazines for all of max_ncpus, possibly wasting a
8117c478bdstevel@tonic-gate * little memory on big systems that don't have the full set installed.
8127c478bdstevel@tonic-gate * See above;  "empty" means "rptr equal to eptr"; this will trigger the
8137c478bdstevel@tonic-gate * refill path in rnd_get_pseudo_bytes above on the first call for each CPU.
8147c478bdstevel@tonic-gate *
8157c478bdstevel@tonic-gate * TODO: make rndmag_size tunable at run time!
8167c478bdstevel@tonic-gate */
8177c478bdstevel@tonic-gatestatic void
8187c478bdstevel@tonic-gaternd_alloc_magazines()
8197c478bdstevel@tonic-gate{
820fe54a78Hai-May Chao	rndmag_pad_t *rmp;
8217c478bdstevel@tonic-gate	int i;
8227c478bdstevel@tonic-gate
8237c478bdstevel@tonic-gate	rndbuf_len = roundup(rndbuf_len, HASHSIZE);
8247c478bdstevel@tonic-gate	if (rndmag_size < rndbuf_len)
8257c478bdstevel@tonic-gate		rndmag_size = rndbuf_len;
8267c478bdstevel@tonic-gate	rndmag_size = roundup(rndmag_size, RND_CPU_CACHE_SIZE);
8277c478bdstevel@tonic-gate
8287c478bdstevel@tonic-gate	random_max_ncpus = max_ncpus;
8297c478bdstevel@tonic-gate	rndmag_total = rndmag_size * random_max_ncpus;
8307c478bdstevel@tonic-gate
8317c478bdstevel@tonic-gate	rndbuf = kmem_alloc(rndmag_total, KM_SLEEP);
832fe54a78Hai-May Chao	rndmag = kmem_zalloc(sizeof (rndmag_pad_t) * random_max_ncpus,
833fe54a78Hai-May Chao	    KM_SLEEP);
8347c478bdstevel@tonic-gate
8357c478bdstevel@tonic-gate	for (i = 0; i < random_max_ncpus; i++) {
8367c478bdstevel@tonic-gate		uint8_t *buf;
8377c478bdstevel@tonic-gate
8387c478bdstevel@tonic-gate		rmp = &rndmag[i];
839fe54a78Hai-May Chao		mutex_init(&rmp->rm_mag.rm_lock, NULL, MUTEX_DRIVER, NULL);
8407c478bdstevel@tonic-gate
8417c478bdstevel@tonic-gate		buf = rndbuf + i * rndmag_size;
8427c478bdstevel@tonic-gate
843fe54a78Hai-May Chao		rmp->rm_mag.rm_buffer = buf;
844fe54a78Hai-May Chao		rmp->rm_mag.rm_eptr = buf + rndbuf_len;
845fe54a78Hai-May Chao		rmp->rm_mag.rm_rptr = buf + rndbuf_len;
846fe54a78Hai-May Chao		rmp->rm_mag.rm_oblocks = 1;
847717fae5Gordon Ross	}
848717fae5Gordon Ross}
849fe54a78Hai-May Chao
850717fae5Gordon Ross/*
851717fae5Gordon Ross * FIPS 140-2: the first n-bit (n > 15) block generated
852717fae5Gordon Ross * after power-up, initialization, or reset shall not
853717fae5Gordon Ross * be used, but shall be saved for comparison.
854717fae5Gordon Ross */
855717fae5Gordon Rossstatic void
856717fae5Gordon Rossrnd_fips_discard_initial(void)
857717fae5Gordon Ross{
858717fae5Gordon Ross	uint8_t discard_buf[HASHSIZE];
859717fae5Gordon Ross	rndmag_pad_t *rmp;
860717fae5Gordon Ross	int i;
861717fae5Gordon Ross
862717fae5Gordon Ross	for (i = 0; i < random_max_ncpus; i++) {
863717fae5Gordon Ross		rmp = &rndmag[i];
864717fae5Gordon Ross
865717fae5Gordon Ross		/* rnd_get_bytes() will call mutex_exit(&rndpool_lock) */
866fe54a78Hai-May Chao		mutex_enter(&rndpool_lock);
867fe54a78Hai-May Chao		(void) rnd_get_bytes(discard_buf,
8688b50271Krishna Yenduri		    HMAC_KEYSIZE, ALWAYS_EXTRACT);
869fe54a78Hai-May Chao		bcopy(discard_buf, rmp->rm_mag.rm_previous,
870fe54a78Hai-May Chao		    HMAC_KEYSIZE);
871fe54a78Hai-May Chao		/* rnd_get_bytes() will call mutex_exit(&rndpool_lock) */
872fe54a78Hai-May Chao		mutex_enter(&rndpool_lock);
873fe54a78Hai-May Chao		(void) rnd_get_bytes((uint8_t *)rmp->rm_mag.rm_key,
8748b50271Krishna Yenduri		    HMAC_KEYSIZE, ALWAYS_EXTRACT);
875fe54a78Hai-May Chao		/* rnd_get_bytes() will call mutex_exit(&rndpool_lock) */
876fe54a78Hai-May Chao		mutex_enter(&rndpool_lock);
877fe54a78Hai-May Chao		(void) rnd_get_bytes((uint8_t *)rmp->rm_mag.rm_seed,
8788b50271Krishna Yenduri		    HMAC_KEYSIZE, ALWAYS_EXTRACT);
8797c478bdstevel@tonic-gate	}
8807c478bdstevel@tonic-gate}
8817c478bdstevel@tonic-gate
882a0d1cddGarrett D'Amorestatic void
883717fae5Gordon Rossrnd_schedule_timeout(void)
8847c478bdstevel@tonic-gate{
8857c478bdstevel@tonic-gate	clock_t ut;	/* time in microseconds */
8867c478bdstevel@tonic-gate
8877c478bdstevel@tonic-gate	/*
8887c478bdstevel@tonic-gate	 * The new timeout value is taken from the buffer of random bytes.
8897c478bdstevel@tonic-gate	 * We're merely reading the first 32 bits from the buffer here, not
8907c478bdstevel@tonic-gate	 * consuming any random bytes.
8917c478bdstevel@tonic-gate	 * The timeout multiplier value is a random value between 0.5 sec and
8927c478bdstevel@tonic-gate	 * 1.544480 sec (0.5 sec + 0xFF000 microseconds).
8937c478bdstevel@tonic-gate	 * The new timeout is TIMEOUT_INTERVAL times that multiplier.
8947c478bdstevel@tonic-gate	 */
8957c478bdstevel@tonic-gate	ut = 500000 + (clock_t)((((uint32_t)rndpool[findex]) << 12) & 0xFF000);
8967c478bdstevel@tonic-gate	kcf_rndtimeout_id = timeout(rnd_handler, NULL,
8977c478bdstevel@tonic-gate	    TIMEOUT_INTERVAL * drv_usectohz(ut));
8987c478bdstevel@tonic-gate}
8997c478bdstevel@tonic-gate
9007c478bdstevel@tonic-gate/*
9019d31afcKrishna Yenduri * Called from the driver for a poll on /dev/random
9029d31afcKrishna Yenduri * . POLLOUT always succeeds.
9039d31afcKrishna Yenduri * . POLLIN and POLLRDNORM will block until a
9049d31afcKrishna Yenduri *   minimum amount of entropy is available.
9059d31afcKrishna Yenduri *
9067c478bdstevel@tonic-gate * &rnd_pollhead is passed in *phpp in order to indicate the calling thread
9077c478bdstevel@tonic-gate * will block. When enough random bytes are available, later, the timeout
9087c478bdstevel@tonic-gate * handler routine will issue the pollwakeup() calls.
9097c478bdstevel@tonic-gate */
9107c478bdstevel@tonic-gatevoid
9119d31afcKrishna Yendurikcf_rnd_chpoll(short events, int anyyet, short *reventsp,
9129d31afcKrishna Yenduri    struct pollhead **phpp)
9137c478bdstevel@tonic-gate{
9149d31afcKrishna Yenduri	*reventsp = events & POLLOUT;
9159d31afcKrishna Yenduri
9169d31afcKrishna Yenduri	if (events & (POLLIN | POLLRDNORM)) {
9179d31afcKrishna Yenduri		/*
9189d31afcKrishna Yenduri		 * Sampling of rnbyte_cnt is an atomic
9199d31afcKrishna Yenduri		 * operation. Hence we do not need any locking.
9209d31afcKrishna Yenduri		 */
9219d31afcKrishna Yenduri		if (rnbyte_cnt >= MINEXTRACTBYTES)
9229d31afcKrishna Yenduri			*reventsp |= (events & (POLLIN | POLLRDNORM));
9237c478bdstevel@tonic-gate	}
9249d31afcKrishna Yenduri
92580d5689Patrick Mooney	if ((*reventsp == 0 && !anyyet) || (events & POLLET))
9269d31afcKrishna Yenduri		*phpp = &rnd_pollhead;
9277c478bdstevel@tonic-gate}
9287c478bdstevel@tonic-gate
9297c478bdstevel@tonic-gate/*ARGSUSED*/
9307c478bdstevel@tonic-gatestatic void
9317c478bdstevel@tonic-gaternd_handler(void *arg)
9327c478bdstevel@tonic-gate{
9337c478bdstevel@tonic-gate	int len = 0;
9347c478bdstevel@tonic-gate
935f317a3akrishna	if (!rng_prov_found && rng_ok_to_log) {
936f317a3akrishna		cmn_err(CE_WARN, "No randomness provider enabled for "
937f317a3akrishna		    "/dev/random. Use cryptoadm(1M) to enable a provider.");
938f317a3akrishna		rng_ok_to_log = B_FALSE;
939f317a3akrishna	}
940f317a3akrishna
9417c478bdstevel@tonic-gate	if (num_waiters > 0)
942f5229b7Krishna Yenduri		/*
943f5229b7Krishna Yenduri		 * Note: len has no relationship with how many bytes
944f5229b7Krishna Yenduri		 * a poll thread needs.
945f5229b7Krishna Yenduri		 */
9467c478bdstevel@tonic-gate		len = MAXEXTRACTBYTES;
9477c478bdstevel@tonic-gate	else if (rnbyte_cnt < RNDPOOLSIZE)
9487c478bdstevel@tonic-gate		len = MINEXTRACTBYTES;
9497c478bdstevel@tonic-gate
950f5229b7Krishna Yenduri	/*
951f5229b7Krishna Yenduri	 * Only one thread gets to set rngprov_task_idle at a given point
952f5229b7Krishna Yenduri	 * of time and the order of the writes is defined. Also, it is OK
953f5229b7Krishna Yenduri	 * if we read an older value of it and skip the dispatch once
954f5229b7Krishna Yenduri	 * since we will get the correct value during the next time here.
955f5229b7Krishna Yenduri	 * So, no locking is needed here.
956f5229b7Krishna Yenduri	 */
957f5229b7Krishna Yenduri	if (len > 0 && rngprov_task_idle) {
958f5229b7Krishna Yenduri		rngprov_task_idle = B_FALSE;
959f5229b7Krishna Yenduri
960f5229b7Krishna Yenduri		/*
961f5229b7Krishna Yenduri		 * It is OK if taskq_dispatch fails here. We will retry
962f5229b7Krishna Yenduri		 * the next time around. Meanwhile, a thread doing a
963f5229b7Krishna Yenduri		 * read() will go to the provider directly, if the
964f5229b7Krishna Yenduri		 * cache becomes empty.
965f5229b7Krishna Yenduri		 */
966f5229b7Krishna Yenduri		if (taskq_dispatch(system_taskq, rngprov_task,
967fc8ae2eToomas Soome		    (void *)(uintptr_t)len, TQ_NOSLEEP | TQ_NOQUEUE) ==
968fc8ae2eToomas Soome		    TASKQID_INVALID) {
969f5229b7Krishna Yenduri			rngprov_task_idle = B_TRUE;
970f5229b7Krishna Yenduri		}
9717c478bdstevel@tonic-gate	}
9727c478bdstevel@tonic-gate
9737c478bdstevel@tonic-gate	mutex_enter(&rndpool_lock);
9747c478bdstevel@tonic-gate	/*
9757c478bdstevel@tonic-gate	 * Wake up threads waiting in poll() or for enough accumulated
9767c478bdstevel@tonic-gate	 * random bytes to read from /dev/random. In case a poll() is
9777c478bdstevel@tonic-gate	 * concurrent with a read(), the polling process may be woken up
9787c478bdstevel@tonic-gate	 * indicating that enough randomness is now available for reading,
9797c478bdstevel@tonic-gate	 * and another process *steals* the bits from the pool, causing the
9807c478bdstevel@tonic-gate	 * subsequent read() from the first process to block. It is acceptable
9817c478bdstevel@tonic-gate	 * since the blocking will eventually end, after the timeout
9827c478bdstevel@tonic-gate	 * has expired enough times to honor the read.
9837c478bdstevel@tonic-gate	 *
9847c478bdstevel@tonic-gate	 * Note - Since we hold the rndpool_lock across the pollwakeup() call
9857c478bdstevel@tonic-gate	 * we MUST NOT grab the rndpool_lock in kcf_rndchpoll().
9867c478bdstevel@tonic-gate	 */
9877c478bdstevel@tonic-gate	if (rnbyte_cnt >= MINEXTRACTBYTES)
9887c478bdstevel@tonic-gate		pollwakeup(&rnd_pollhead, POLLIN | POLLRDNORM);
9897c478bdstevel@tonic-gate
9907c478bdstevel@tonic-gate	if (num_waiters > 0)
9917c478bdstevel@tonic-gate		cv_broadcast(&rndpool_read_cv);
9927c478bdstevel@tonic-gate	mutex_exit(&rndpool_lock);
9937c478bdstevel@tonic-gate
994717fae5Gordon Ross	rnd_schedule_timeout();
9957c478bdstevel@tonic-gate}
9967c478bdstevel@tonic-gate
9977c478bdstevel@tonic-gatestatic void
9987c478bdstevel@tonic-gaterndc_addbytes(uint8_t *ptr, size_t len)
9997c478bdstevel@tonic-gate{
10007c478bdstevel@tonic-gate	ASSERT(ptr != NULL && len > 0);
10017c478bdstevel@tonic-gate	ASSERT(rnbyte_cnt <= RNDPOOLSIZE);
10027c478bdstevel@tonic-gate
10037c478bdstevel@tonic-gate	mutex_enter(&rndpool_lock);
10047c478bdstevel@tonic-gate	while ((len > 0) && (rnbyte_cnt < RNDPOOLSIZE)) {
10057c478bdstevel@tonic-gate		rndpool[rindex] ^= *ptr;
10067c478bdstevel@tonic-gate		ptr++; len--;
10077c478bdstevel@tonic-gate		rindex = (rindex + 1) & (RNDPOOLSIZE - 1);
10087c478bdstevel@tonic-gate		rnbyte_cnt++;
10097c478bdstevel@tonic-gate	}
10107c478bdstevel@tonic-gate
10117c478bdstevel@tonic-gate	/* Handle buffer full case */
10127c478bdstevel@tonic-gate	while (len > 0) {
10137c478bdstevel@tonic-gate		rndpool[rindex] ^= *ptr;
10147c478bdstevel@tonic-gate		ptr++; len--;
10157c478bdstevel@tonic-gate		findex = rindex = (rindex + 1) & (RNDPOOLSIZE - 1);
10167c478bdstevel@tonic-gate	}
10177c478bdstevel@tonic-gate	mutex_exit(&rndpool_lock);
10187c478bdstevel@tonic-gate}
10197c478bdstevel@tonic-gate
10207c478bdstevel@tonic-gate/*
10217c478bdstevel@tonic-gate * Caller should check len <= rnbyte_cnt under the
10227c478bdstevel@tonic-gate * rndpool_lock before calling.
10237c478bdstevel@tonic-gate */
10247c478bdstevel@tonic-gatestatic void
10257c478bdstevel@tonic-gaterndc_getbytes(uint8_t *ptr, size_t len)
10267c478bdstevel@tonic-gate{
10277c478bdstevel@tonic-gate	ASSERT(MUTEX_HELD(&rndpool_lock));
10287c478bdstevel@tonic-gate	ASSERT(len <= rnbyte_cnt && rnbyte_cnt <= RNDPOOLSIZE);
10297c478bdstevel@tonic-gate
10307c478bdstevel@tonic-gate	BUMP_RND_STATS(rs_rndcOut, len);
10317c478bdstevel@tonic-gate
10327c478bdstevel@tonic-gate	while (len > 0) {
10337c478bdstevel@tonic-gate		*ptr = rndpool[findex];
10347c478bdstevel@tonic-gate		ptr++; len--;
10357c478bdstevel@tonic-gate		findex = (findex + 1) & (RNDPOOLSIZE - 1);
10367c478bdstevel@tonic-gate		rnbyte_cnt--;
10377c478bdstevel@tonic-gate	}
10387c478bdstevel@tonic-gate}
10397c478bdstevel@tonic-gate
10407c478bdstevel@tonic-gate/* Random number exported entry points */
10417c478bdstevel@tonic-gate
10427c478bdstevel@tonic-gate/*
10437c478bdstevel@tonic-gate * Mix the supplied bytes into the entropy pool of a kCF
10447c478bdstevel@tonic-gate * RNG provider.
10457c478bdstevel@tonic-gate */
10467c478bdstevel@tonic-gateint
10478047c9fmcpowersrandom_add_pseudo_entropy(uint8_t *ptr, size_t len, uint_t entropy_est)
10488047c9fmcpowers{
10498047c9fmcpowers	if (len < 1)
10508047c9fmcpowers		return (-1);
10518047c9fmcpowers
10528047c9fmcpowers	rngprov_seed(ptr, len, entropy_est, 0);
10538047c9fmcpowers
10548047c9fmcpowers	return (0);
10558047c9fmcpowers}
10568047c9fmcpowers
10578047c9fmcpowers/*
10588047c9fmcpowers * Mix the supplied bytes into the entropy pool of a kCF
10598047c9fmcpowers * RNG provider. Mix immediately.
10608047c9fmcpowers */
10618047c9fmcpowersint
10628047c9fmcpowersrandom_add_entropy(uint8_t *ptr, size_t len, uint_t entropy_est)
10637c478bdstevel@tonic-gate{
10647c478bdstevel@tonic-gate	if (len < 1)
10657c478bdstevel@tonic-gate		return (-1);
10667c478bdstevel@tonic-gate
10678047c9fmcpowers	rngprov_seed(ptr, len, entropy_est, CRYPTO_SEED_NOW);
10687c478bdstevel@tonic-gate
10697c478bdstevel@tonic-gate	return (0);
10707c478bdstevel@tonic-gate}
10717c478bdstevel@tonic-gate
10727c478bdstevel@tonic-gate/*
10737c478bdstevel@tonic-gate * Get bytes from the /dev/urandom generator. This function
10747c478bdstevel@tonic-gate * always succeeds. Returns 0.
10757c478bdstevel@tonic-gate */
10767c478bdstevel@tonic-gateint
10777c478bdstevel@tonic-gaterandom_get_pseudo_bytes(uint8_t *ptr, size_t len)
10787c478bdstevel@tonic-gate{
10797c478bdstevel@tonic-gate	ASSERT(!mutex_owned(&rndpool_lock));
10807c478bdstevel@tonic-gate
10817c478bdstevel@tonic-gate	if (len < 1)
10827c478bdstevel@tonic-gate		return (0);
10837c478bdstevel@tonic-gate	return (kcf_rnd_get_pseudo_bytes(ptr, len));
10847c478bdstevel@tonic-gate}
10857c478bdstevel@tonic-gate
10867c478bdstevel@tonic-gate/*
10877c478bdstevel@tonic-gate * Get bytes from the /dev/random generator. Returns 0
10887c478bdstevel@tonic-gate * on success. Returns EAGAIN if there is insufficient entropy.
10897c478bdstevel@tonic-gate */
10907c478bdstevel@tonic-gateint
10917c478bdstevel@tonic-gaterandom_get_bytes(uint8_t *ptr, size_t len)
10927c478bdstevel@tonic-gate{
10937c478bdstevel@tonic-gate	ASSERT(!mutex_owned(&rndpool_lock));
10947c478bdstevel@tonic-gate
10957c478bdstevel@tonic-gate	if (len < 1)
10967c478bdstevel@tonic-gate		return (0);
10978b50271Krishna Yenduri	return (kcf_rnd_get_bytes(ptr, len, B_TRUE));
10987c478bdstevel@tonic-gate}
10999d12795Robert Mustacchi
11009d12795Robert Mustacchiint
11019d12795Robert Mustacchirandom_get_blocking_bytes(uint8_t *ptr, size_t len)
11029d12795Robert Mustacchi{
11039d12795Robert Mustacchi	ASSERT(!mutex_owned(&rndpool_lock));
11049d12795Robert Mustacchi
11059d12795Robert Mustacchi	if (len < 1)
11069d12795Robert Mustacchi		return (0);
11079d12795Robert Mustacchi	return (kcf_rnd_get_bytes(ptr, len, B_FALSE));
11089d12795Robert Mustacchi}
1109