randomdev.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 2017 Oliver Pinter
    3  * Copyright (c) 2000-2015 Mark R V Murray
    4  * All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions
    8  * are met:
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer
   11  *    in this position and unchanged.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  *
   16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   26  *
   27  */
   28 
   29 #include <sys/cdefs.h>
   30 __FBSDID("$FreeBSD$");
   31 
   32 #include <sys/param.h>
   33 #include <sys/systm.h>
   34 #include <sys/bus.h>
   35 #include <sys/conf.h>
   36 #include <sys/fcntl.h>
   37 #include <sys/filio.h>
   38 #include <sys/kernel.h>
   39 #include <sys/kthread.h>
   40 #include <sys/lock.h>
   41 #include <sys/module.h>
   42 #include <sys/malloc.h>
   43 #include <sys/poll.h>
   44 #include <sys/proc.h>
   45 #include <sys/random.h>
   46 #include <sys/sbuf.h>
   47 #include <sys/selinfo.h>
   48 #include <sys/sysctl.h>
   49 #include <sys/systm.h>
   50 #include <sys/uio.h>
   51 #include <sys/unistd.h>
   52 
   53 #include <crypto/rijndael/rijndael-api-fst.h>
   54 #include <crypto/sha2/sha256.h>
   55 
   56 #include <dev/random/hash.h>
   57 #include <dev/random/randomdev.h>
   58 #include <dev/random/random_harvestq.h>
   59 
   60 #define RANDOM_UNIT     0
   61 
   62 /*
   63  * In loadable random, the core randomdev.c / random(9) routines have static
   64  * visibility and an alternative name to avoid conflicting with the function
   65  * pointers of the real names in the core kernel.  random_alg_context_init
   66  * installs pointers to the loadable static names into the core kernel's
   67  * function pointers at SI_SUB_RANDOM:SI_ORDER_SECOND.
   68  */
   69 #if defined(RANDOM_LOADABLE)
   70 static int (read_random_uio)(struct uio *, bool);
   71 static void (read_random)(void *, u_int);
   72 static bool (is_random_seeded)(void);
   73 #endif
   74 
   75 static d_read_t randomdev_read;
   76 static d_write_t randomdev_write;
   77 static d_poll_t randomdev_poll;
   78 static d_ioctl_t randomdev_ioctl;
   79 
   80 static struct cdevsw random_cdevsw = {
   81         .d_name = "random",
   82         .d_version = D_VERSION,
   83         .d_read = randomdev_read,
   84         .d_write = randomdev_write,
   85         .d_poll = randomdev_poll,
   86         .d_ioctl = randomdev_ioctl,
   87 };
   88 
   89 /* For use with make_dev(9)/destroy_dev(9). */
   90 static struct cdev *random_dev;
   91 
   92 #if defined(RANDOM_LOADABLE)
   93 static void
   94 random_alg_context_init(void *dummy __unused)
   95 {
   96         _read_random_uio = (read_random_uio);
   97         _read_random = (read_random);
   98         _is_random_seeded = (is_random_seeded);
   99 }
  100 SYSINIT(random_device, SI_SUB_RANDOM, SI_ORDER_SECOND, random_alg_context_init,
  101     NULL);
  102 #endif
  103 
  104 static struct selinfo rsel;
  105 
  106 /*
  107  * This is the read uio(9) interface for random(4).
  108  */
  109 /* ARGSUSED */
  110 static int
  111 randomdev_read(struct cdev *dev __unused, struct uio *uio, int flags)
  112 {
  113 
  114         return ((read_random_uio)(uio, (flags & O_NONBLOCK) != 0));
  115 }
  116 
  117 /*
  118  * If the random device is not seeded, blocks until it is seeded.
  119  *
  120  * Returns zero when the random device is seeded.
  121  *
  122  * If the 'interruptible' parameter is true, and the device is unseeded, this
  123  * routine may be interrupted.  If interrupted, it will return either ERESTART
  124  * or EINTR.
  125  */
  126 #define SEEDWAIT_INTERRUPTIBLE          true
  127 #define SEEDWAIT_UNINTERRUPTIBLE        false
  128 static int
  129 randomdev_wait_until_seeded(bool interruptible)
  130 {
  131         int error, spamcount, slpflags;
  132 
  133         slpflags = interruptible ? PCATCH : 0;
  134 
  135         error = 0;
  136         spamcount = 0;
  137         while (!p_random_alg_context->ra_seeded()) {
  138                 /* keep tapping away at the pre-read until we seed/unblock. */
  139                 p_random_alg_context->ra_pre_read();
  140                 /* Only bother the console every 10 seconds or so */
  141                 if (spamcount == 0)
  142                         printf("random: %s unblock wait\n", __func__);
  143                 spamcount = (spamcount + 1) % 100;
  144                 error = tsleep(p_random_alg_context, slpflags, "randseed",
  145                     hz / 10);
  146                 if (error == ERESTART || error == EINTR) {
  147                         KASSERT(interruptible,
  148                             ("unexpected wake of non-interruptible sleep"));
  149                         break;
  150                 }
  151                 /* Squash tsleep timeout condition */
  152                 if (error == EWOULDBLOCK)
  153                         error = 0;
  154                 KASSERT(error == 0, ("unexpected tsleep error %d", error));
  155         }
  156         return (error);
  157 }
  158 
  159 int
  160 (read_random_uio)(struct uio *uio, bool nonblock)
  161 {
  162         /* 16 MiB takes about 0.08 s CPU time on my 2017 AMD Zen CPU */
  163 #define SIGCHK_PERIOD (16 * 1024 * 1024)
  164         const size_t sigchk_period = SIGCHK_PERIOD;
  165         CTASSERT(SIGCHK_PERIOD % PAGE_SIZE == 0);
  166 #undef SIGCHK_PERIOD
  167 
  168         uint8_t *random_buf;
  169         size_t total_read, read_len;
  170         ssize_t bufsize;
  171         int error;
  172 
  173 
  174         KASSERT(uio->uio_rw == UIO_READ, ("%s: bogus write", __func__));
  175         KASSERT(uio->uio_resid >= 0, ("%s: bogus negative resid", __func__));
  176 
  177         p_random_alg_context->ra_pre_read();
  178         error = 0;
  179         /* (Un)Blocking logic */
  180         if (!p_random_alg_context->ra_seeded()) {
  181                 if (nonblock)
  182                         error = EWOULDBLOCK;
  183                 else
  184                         error = randomdev_wait_until_seeded(
  185                             SEEDWAIT_INTERRUPTIBLE);
  186         }
  187         if (error != 0)
  188                 return (error);
  189 
  190         total_read = 0;
  191 
  192         /* Easy to deal with the trivial 0 byte case. */
  193         if (__predict_false(uio->uio_resid == 0))
  194                 return (0);
  195 
  196         /*
  197          * If memory is plentiful, use maximally sized requests to avoid
  198          * per-call algorithm overhead.  But fall back to a single page
  199          * allocation if the full request isn't immediately available.
  200          */
  201         bufsize = MIN(sigchk_period, (size_t)uio->uio_resid);
  202         random_buf = malloc(bufsize, M_ENTROPY, M_NOWAIT);
  203         if (random_buf == NULL) {
  204                 bufsize = PAGE_SIZE;
  205                 random_buf = malloc(bufsize, M_ENTROPY, M_WAITOK);
  206         }
  207 
  208         error = 0;
  209         while (uio->uio_resid > 0 && error == 0) {
  210                 read_len = MIN((size_t)uio->uio_resid, bufsize);
  211 
  212                 p_random_alg_context->ra_read(random_buf, read_len);
  213 
  214                 /*
  215                  * uiomove() may yield the CPU before each 'read_len' bytes (up
  216                  * to bufsize) are copied out.
  217                  */
  218                 error = uiomove(random_buf, read_len, uio);
  219                 total_read += read_len;
  220 
  221                 /*
  222                  * Poll for signals every few MBs to avoid very long
  223                  * uninterruptible syscalls.
  224                  */
  225                 if (error == 0 && uio->uio_resid != 0 &&
  226                     total_read % sigchk_period == 0) {
  227                         error = tsleep_sbt(p_random_alg_context, PCATCH,
  228                             "randrd", SBT_1NS, 0, C_HARDCLOCK);
  229                         /* Squash tsleep timeout condition */
  230                         if (error == EWOULDBLOCK)
  231                                 error = 0;
  232                 }
  233         }
  234 
  235         /*
  236          * Short reads due to signal interrupt should not indicate error.
  237          * Instead, the uio will reflect that the read was shorter than
  238          * requested.
  239          */
  240         if (error == ERESTART || error == EINTR)
  241                 error = 0;
  242 
  243         zfree(random_buf, M_ENTROPY);
  244         return (error);
  245 }
  246 
  247 /*-
  248  * Kernel API version of read_random().  This is similar to read_random_uio(),
  249  * except it doesn't interface with uio(9).  It cannot assumed that random_buf
  250  * is a multiple of RANDOM_BLOCKSIZE bytes.
  251  *
  252  * If the tunable 'kern.random.initial_seeding.bypass_before_seeding' is set
  253  * non-zero, silently fail to emit random data (matching the pre-r346250
  254  * behavior).  If read_random is called prior to seeding and bypassed because
  255  * of this tunable, the condition is reported in the read-only sysctl
  256  * 'kern.random.initial_seeding.read_random_bypassed_before_seeding'.
  257  */
  258 void
  259 (read_random)(void *random_buf, u_int len)
  260 {
  261 
  262         KASSERT(random_buf != NULL, ("No suitable random buffer in %s", __func__));
  263         p_random_alg_context->ra_pre_read();
  264 
  265         if (len == 0)
  266                 return;
  267 
  268         /* (Un)Blocking logic */
  269         if (__predict_false(!p_random_alg_context->ra_seeded())) {
  270                 if (random_bypass_before_seeding) {
  271                         if (!read_random_bypassed_before_seeding) {
  272                                 if (!random_bypass_disable_warnings)
  273                                         printf("read_random: WARNING: bypassing"
  274                                             " request for random data because "
  275                                             "the random device is not yet "
  276                                             "seeded and the knob "
  277                                             "'bypass_before_seeding' was "
  278                                             "enabled.\n");
  279                                 read_random_bypassed_before_seeding = true;
  280                         }
  281                         /* Avoid potentially leaking stack garbage */
  282                         memset(random_buf, 0, len);
  283                         return;
  284                 }
  285 
  286                 (void)randomdev_wait_until_seeded(SEEDWAIT_UNINTERRUPTIBLE);
  287         }
  288         p_random_alg_context->ra_read(random_buf, len);
  289 }
  290 
  291 bool
  292 (is_random_seeded)(void)
  293 {
  294         return (p_random_alg_context->ra_seeded());
  295 }
  296 
  297 static __inline void
  298 randomdev_accumulate(uint8_t *buf, u_int count)
  299 {
  300         static u_int destination = 0;
  301         static struct harvest_event event;
  302         static struct randomdev_hash hash;
  303         static uint32_t entropy_data[RANDOM_KEYSIZE_WORDS];
  304         uint32_t timestamp;
  305         int i;
  306 
  307         /* Extra timing here is helpful to scrape scheduler jitter entropy */
  308         randomdev_hash_init(&hash);
  309         timestamp = (uint32_t)get_cyclecount();
  310         randomdev_hash_iterate(&hash, &timestamp, sizeof(timestamp));
  311         randomdev_hash_iterate(&hash, buf, count);
  312         timestamp = (uint32_t)get_cyclecount();
  313         randomdev_hash_iterate(&hash, &timestamp, sizeof(timestamp));
  314         randomdev_hash_finish(&hash, entropy_data);
  315         for (i = 0; i < RANDOM_KEYSIZE_WORDS; i += sizeof(event.he_entropy)/sizeof(event.he_entropy[0])) {
  316                 event.he_somecounter = (uint32_t)get_cyclecount();
  317                 event.he_size = sizeof(event.he_entropy);
  318                 event.he_source = RANDOM_CACHED;
  319                 event.he_destination = destination++; /* Harmless cheating */
  320                 memcpy(event.he_entropy, entropy_data + i, sizeof(event.he_entropy));
  321                 p_random_alg_context->ra_event_processor(&event);
  322         }
  323         explicit_bzero(&event, sizeof(event));
  324         explicit_bzero(entropy_data, sizeof(entropy_data));
  325 }
  326 
  327 /* ARGSUSED */
  328 static int
  329 randomdev_write(struct cdev *dev __unused, struct uio *uio, int flags __unused)
  330 {
  331         uint8_t *random_buf;
  332         int c, error = 0;
  333         ssize_t nbytes;
  334 
  335         random_buf = malloc(PAGE_SIZE, M_ENTROPY, M_WAITOK);
  336         nbytes = uio->uio_resid;
  337         while (uio->uio_resid > 0 && error == 0) {
  338                 c = MIN(uio->uio_resid, PAGE_SIZE);
  339                 error = uiomove(random_buf, c, uio);
  340                 if (error)
  341                         break;
  342                 randomdev_accumulate(random_buf, c);
  343         }
  344         if (nbytes != uio->uio_resid && (error == ERESTART || error == EINTR))
  345                 /* Partial write, not error. */
  346                 error = 0;
  347         free(random_buf, M_ENTROPY);
  348         return (error);
  349 }
  350 
  351 /* ARGSUSED */
  352 static int
  353 randomdev_poll(struct cdev *dev __unused, int events, struct thread *td __unused)
  354 {
  355 
  356         if (events & (POLLIN | POLLRDNORM)) {
  357                 if (p_random_alg_context->ra_seeded())
  358                         events &= (POLLIN | POLLRDNORM);
  359                 else
  360                         selrecord(td, &rsel);
  361         }
  362         return (events);
  363 }
  364 
  365 /* This will be called by the entropy processor when it seeds itself and becomes secure */
  366 void
  367 randomdev_unblock(void)
  368 {
  369 
  370         selwakeuppri(&rsel, PUSER);
  371         wakeup(p_random_alg_context);
  372         printf("random: unblocking device.\n");
  373 #ifndef RANDOM_FENESTRASX
  374         /* Do random(9) a favour while we are about it. */
  375         (void)atomic_cmpset_int(&arc4rand_iniseed_state, ARC4_ENTR_NONE, ARC4_ENTR_HAVE);
  376 #endif
  377 }
  378 
  379 /* ARGSUSED */
  380 static int
  381 randomdev_ioctl(struct cdev *dev __unused, u_long cmd, caddr_t addr __unused,
  382     int flags __unused, struct thread *td __unused)
  383 {
  384         int error = 0;
  385 
  386         switch (cmd) {
  387                 /* Really handled in upper layer */
  388         case FIOASYNC:
  389         case FIONBIO:
  390                 break;
  391         default:
  392                 error = ENOTTY;
  393         }
  394 
  395         return (error);
  396 }
  397 
  398 /* ARGSUSED */
  399 static int
  400 randomdev_modevent(module_t mod __unused, int type, void *data __unused)
  401 {
  402         int error = 0;
  403 
  404         switch (type) {
  405         case MOD_LOAD:
  406                 printf("random: entropy device external interface\n");
  407                 random_dev = make_dev_credf(MAKEDEV_ETERNAL_KLD, &random_cdevsw,
  408                     RANDOM_UNIT, NULL, UID_ROOT, GID_WHEEL, 0644, "random");
  409                 make_dev_alias(random_dev, "urandom"); /* compatibility */
  410                 break;
  411         case MOD_UNLOAD:
  412                 error = EBUSY;
  413                 break;
  414         case MOD_SHUTDOWN:
  415                 break;
  416         default:
  417                 error = EOPNOTSUPP;
  418                 break;
  419         }
  420         return (error);
  421 }
  422 
  423 static moduledata_t randomdev_mod = {
  424         "random_device",
  425         randomdev_modevent,
  426         0
  427 };
  428 
  429 DECLARE_MODULE(random_device, randomdev_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
  430 MODULE_VERSION(random_device, 1);
  431 MODULE_DEPEND(random_device, crypto, 1, 1, 1);
  432 MODULE_DEPEND(random_device, random_harvestq, 1, 1, 1);
Cache object: f5e3c925705d39e0f138e82423aa1be6
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/dev/random/randomdev.c

FreeBSD/Linux Kernel Cross Reference
sys/dev/random/randomdev.c
