Date: Fri, 12 Oct 2012 10:50:55 +0200 From: Harald Schmalzbauer <h.schmalzbauer@omnilan.de> To: Konstantin Belousov <kostikbel@gmail.com> Cc: current@freebsd.org Subject: Re: Bull Mountain (IvyBridge +) random number generator Message-ID: <5077D9EF.4040500@omnilan.de> In-Reply-To: <20120902103406.GU33100@deviant.kiev.zoral.com.ua> References: <20120902103406.GU33100@deviant.kiev.zoral.com.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig77E0D30FCB304C4E5095328C Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable schrieb Konstantin Belousov am 02.09.2012 12:34 (localtime): > It is relatively well known that Ivy Bridge CPUs (Core iX 3XXX) have > built-in hardware random number generator, which is claimed to be both > very fast and high quality. Generator is accessible using non-privilege= d > RDRAND instruction. It is claimed that CPU performs sanitization of the= > random sequence. In particular, it seems that paranoid AES encryption o= f > the raw random stream, performed by our padlock driver, is not needed > for Bull Mountain (there are hints that hardware performs it already). > > See > http://spectrum.ieee.org/computing/hardware/behind-intels-new-randomnum= ber-generator/0 > http://software.intel.com/en-us/articles/intel-digital-random-number-ge= nerator-drng-software-implementation-guide/ > and IA32 ADM. > > Patch at > http://people.freebsd.org/~kib/misc/bull_mountain.2.patch > implements support for the generator. I do not own any IvyBridge machin= es, > so I cannot test. Patch makes both padlock and bull generators the opti= ons, > you need to enable IVY_RNG to get support for the generator. > > I would be interested in seeing reports including verbose boot dmesg, > and some tests of /dev/random quality on the IvyBridge machines, you ca= n > start with http://lists.gnupg.org/pipermail/gnupg-devel/2000-March/0163= 28.html. Thanks a lot for implementing this! I have an ESXi host with Ivy Brindge CPU. FreeBSD guest reports the following: CPU: Intel(R) Xeon(R) CPU E3-1270 V2 @ 3.50GHz (3492.07-MHz K8-class CPU)= Origin =3D "GenuineIntel" Id =3D 0x306a9 Family =3D 6 Model =3D 3a=20 Stepping =3D 9 =20 Features=3D0x1fa3fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PG= E,MCA,CMOV,PAT,PSE36,DTS,MMX,FXSR,SSE,SSE2,SS,HTT> =20 Features2=3D0xfeba2203<SSE3,PCLMULQDQ,SSSE3,CX16,PCID,SSE4.1,SSE4.2,x2API= C,POPCNT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND,HV> AMD Features=3D0x28100800<SYSCALL,NX,RDTSCP,LM> AMD Features2=3D0x1<LAHF> TSC: P-state invariant real memory =3D 8589934592 (8192 MB) avail memory =3D 8235110400 (7853 MB) Event timer "LAPIC" quality 600 ACPI APIC Table: <PTLTD APIC > FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs FreeBSD/SMP: 1 package(s) x 4 core(s) cpu0 (BSP): APIC ID: 0 cpu1 (AP): APIC ID: 1 cpu2 (AP): APIC ID: 2 cpu3 (AP): APIC ID: 3 MADT: Forcing active-low polarity and level trigger for SCI But unfortunately accessing /dev/random doesn't work with IVY_RNG enabled= =2E 'dd' consumes 100% wcpu bound to one core but never finishes (dd if=3D/dev/random bs=3D1k count=3D100|./ent) Also some other functions are blocked, logging in for example (doesn't matter if it's console or ssh). But I can walk arround in already established sessions. I made a 9.1-RC-2 debug kernel but no info appears. Also IVY_RNG isn't reported after kldloading, nor during boot, but this is the expected behaviour if I unterstand your patch correctly. I guess using RDRAND in an hypervisor environment should make no difference but please correct me if I'm wrong. Thanks, -Harry --------------enig77E0D30FCB304C4E5095328C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (FreeBSD) iEYEARECAAYFAlB32e8ACgkQLDqVQ9VXb8joVwCg0kZhUEjh0ZEDPya63etS1kRB NJ4AoInWyDMMMceGFdozWViMQwAIree9 =U2f4 -----END PGP SIGNATURE----- --------------enig77E0D30FCB304C4E5095328C--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5077D9EF.4040500>