1 /*-
2 * Copyright (c) 2017 Oliver Pinter
3 * Copyright (c) 2000-2015 Mark R V Murray
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer
11 * in this position and unchanged.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 */
28
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/bus.h>
35 #include <sys/conf.h>
36 #include <sys/fcntl.h>
37 #include <sys/filio.h>
38 #include <sys/kernel.h>
39 #include <sys/kthread.h>
40 #include <sys/lock.h>
41 #include <sys/module.h>
42 #include <sys/malloc.h>
43 #include <sys/poll.h>
44 #include <sys/proc.h>
45 #include <sys/random.h>
46 #include <sys/sbuf.h>
47 #include <sys/selinfo.h>
48 #include <sys/sysctl.h>
49 #include <sys/systm.h>
50 #include <sys/uio.h>
51 #include <sys/unistd.h>
52
53 #include <crypto/rijndael/rijndael-api-fst.h>
54 #include <crypto/sha2/sha256.h>
55
56 #include <dev/random/hash.h>
57 #include <dev/random/randomdev.h>
58 #include <dev/random/random_harvestq.h>
59
60 #define RANDOM_UNIT 0
61
62 #if defined(RANDOM_LOADABLE)
63 #define READ_RANDOM_UIO _read_random_uio
64 #define READ_RANDOM _read_random
65 static int READ_RANDOM_UIO(struct uio *, bool);
66 static u_int READ_RANDOM(void *, u_int);
67 #else
68 #define READ_RANDOM_UIO read_random_uio
69 #define READ_RANDOM read_random
70 #endif
71
72 static d_read_t randomdev_read;
73 static d_write_t randomdev_write;
74 static d_poll_t randomdev_poll;
75 static d_ioctl_t randomdev_ioctl;
76
77 static struct cdevsw random_cdevsw = {
78 .d_name = "random",
79 .d_version = D_VERSION,
80 .d_read = randomdev_read,
81 .d_write = randomdev_write,
82 .d_poll = randomdev_poll,
83 .d_ioctl = randomdev_ioctl,
84 };
85
86 /* For use with make_dev(9)/destroy_dev(9). */
87 static struct cdev *random_dev;
88
89 static void
random_alg_context_ra_init_alg(void * data)90 random_alg_context_ra_init_alg(void *data)
91 {
92
93 p_random_alg_context = &random_alg_context;
94 p_random_alg_context->ra_init_alg(data);
95 #if defined(RANDOM_LOADABLE)
96 random_infra_init(READ_RANDOM_UIO, READ_RANDOM);
97 #endif
98 }
99
100 static void
random_alg_context_ra_deinit_alg(void * data)101 random_alg_context_ra_deinit_alg(void *data)
102 {
103
104 #if defined(RANDOM_LOADABLE)
105 random_infra_uninit();
106 #endif
107 p_random_alg_context->ra_deinit_alg(data);
108 p_random_alg_context = NULL;
109 }
110
111 SYSINIT(random_device, SI_SUB_RANDOM, SI_ORDER_THIRD, random_alg_context_ra_init_alg, NULL);
112 SYSUNINIT(random_device, SI_SUB_RANDOM, SI_ORDER_THIRD, random_alg_context_ra_deinit_alg, NULL);
113
114 static struct selinfo rsel;
115
116 /*
117 * This is the read uio(9) interface for random(4).
118 */
119 /* ARGSUSED */
120 static int
randomdev_read(struct cdev * dev __unused,struct uio * uio,int flags)121 randomdev_read(struct cdev *dev __unused, struct uio *uio, int flags)
122 {
123
124 return (READ_RANDOM_UIO(uio, (flags & O_NONBLOCK) != 0));
125 }
126
127 int
READ_RANDOM_UIO(struct uio * uio,bool nonblock)128 READ_RANDOM_UIO(struct uio *uio, bool nonblock)
129 {
130 uint8_t *random_buf;
131 int error, spamcount;
132 ssize_t read_len, total_read, c;
133 /* 16 MiB takes about 0.08 s CPU time on my 2017 AMD Zen CPU */
134 #define SIGCHK_PERIOD (16 * 1024 * 1024)
135 const size_t sigchk_period = SIGCHK_PERIOD;
136
137 CTASSERT(SIGCHK_PERIOD % PAGE_SIZE == 0);
138 #undef SIGCHK_PERIOD
139
140 random_buf = malloc(PAGE_SIZE, M_ENTROPY, M_WAITOK);
141 p_random_alg_context->ra_pre_read();
142 error = 0;
143 spamcount = 0;
144 /* (Un)Blocking logic */
145 while (!p_random_alg_context->ra_seeded()) {
146 if (nonblock) {
147 error = EWOULDBLOCK;
148 break;
149 }
150 /* keep tapping away at the pre-read until we seed/unblock. */
151 p_random_alg_context->ra_pre_read();
152 /* Only bother the console every 10 seconds or so */
153 if (spamcount == 0)
154 printf("random: %s unblock wait\n", __func__);
155 spamcount = (spamcount + 1)%100;
156 error = tsleep(&random_alg_context, PCATCH, "randseed", hz/10);
157 if (error == ERESTART || error == EINTR)
158 break;
159 /* Squash tsleep timeout condition */
160 if (error == EWOULDBLOCK)
161 error = 0;
162 KASSERT(error == 0, ("unexpected tsleep error %d", error));
163 }
164 if (error == 0) {
165 read_rate_increment((uio->uio_resid + sizeof(uint32_t))/sizeof(uint32_t));
166 total_read = 0;
167 while (uio->uio_resid && !error) {
168 read_len = uio->uio_resid;
169 /*
170 * Belt-and-braces.
171 * Round up the read length to a crypto block size multiple,
172 * which is what the underlying generator is expecting.
173 * See the random_buf size requirements in the Fortuna code.
174 */
175 read_len = roundup(read_len, RANDOM_BLOCKSIZE);
176 /* Work in chunks page-sized or less */
177 read_len = MIN(read_len, PAGE_SIZE);
178 p_random_alg_context->ra_read(random_buf, read_len);
179 c = MIN(uio->uio_resid, read_len);
180 /*
181 * uiomove() may yield the CPU before each 'c' bytes
182 * (up to PAGE_SIZE) are copied out.
183 */
184 error = uiomove(random_buf, c, uio);
185 total_read += c;
186 /*
187 * Poll for signals every few MBs to avoid very long
188 * uninterruptible syscalls.
189 */
190 if (error == 0 && uio->uio_resid != 0 &&
191 total_read % sigchk_period == 0) {
192 error = tsleep_sbt(&random_alg_context, PCATCH,
193 "randrd", SBT_1NS, 0, C_HARDCLOCK);
194 /* Squash tsleep timeout condition */
195 if (error == EWOULDBLOCK)
196 error = 0;
197 }
198 }
199 if (error == ERESTART || error == EINTR)
200 error = 0;
201 }
202 free(random_buf, M_ENTROPY);
203 return (error);
204 }
205
206 /*-
207 * Kernel API version of read_random().
208 * This is similar to random_alg_read(),
209 * except it doesn't interface with uio(9).
210 * It cannot assumed that random_buf is a multiple of
211 * RANDOM_BLOCKSIZE bytes.
212 */
213 u_int
READ_RANDOM(void * random_buf,u_int len)214 READ_RANDOM(void *random_buf, u_int len)
215 {
216 u_int read_len;
217 uint8_t local_buf[len + RANDOM_BLOCKSIZE];
218
219 KASSERT(random_buf != NULL, ("No suitable random buffer in %s", __func__));
220 p_random_alg_context->ra_pre_read();
221 /* (Un)Blocking logic; if not seeded, return nothing. */
222 if (p_random_alg_context->ra_seeded()) {
223 read_rate_increment((len + sizeof(uint32_t))/sizeof(uint32_t));
224 if (len > 0) {
225 /*
226 * Belt-and-braces.
227 * Round up the read length to a crypto block size multiple,
228 * which is what the underlying generator is expecting.
229 */
230 read_len = roundup(len, RANDOM_BLOCKSIZE);
231 p_random_alg_context->ra_read(local_buf, read_len);
232 memcpy(random_buf, local_buf, len);
233 }
234 } else
235 len = 0;
236 return (len);
237 }
238
239 static __inline void
randomdev_accumulate(uint8_t * buf,u_int count)240 randomdev_accumulate(uint8_t *buf, u_int count)
241 {
242 static u_int destination = 0;
243 static struct harvest_event event;
244 static struct randomdev_hash hash;
245 static uint32_t entropy_data[RANDOM_KEYSIZE_WORDS];
246 uint32_t timestamp;
247 int i;
248
249 /* Extra timing here is helpful to scrape scheduler jitter entropy */
250 randomdev_hash_init(&hash);
251 timestamp = (uint32_t)get_cyclecount();
252 randomdev_hash_iterate(&hash, ×tamp, sizeof(timestamp));
253 randomdev_hash_iterate(&hash, buf, count);
254 timestamp = (uint32_t)get_cyclecount();
255 randomdev_hash_iterate(&hash, ×tamp, sizeof(timestamp));
256 randomdev_hash_finish(&hash, entropy_data);
257 explicit_bzero(&hash, sizeof(hash));
258 for (i = 0; i < RANDOM_KEYSIZE_WORDS; i += sizeof(event.he_entropy)/sizeof(event.he_entropy[0])) {
259 event.he_somecounter = (uint32_t)get_cyclecount();
260 event.he_size = sizeof(event.he_entropy);
261 event.he_source = RANDOM_CACHED;
262 event.he_destination = destination++; /* Harmless cheating */
263 memcpy(event.he_entropy, entropy_data + i, sizeof(event.he_entropy));
264 p_random_alg_context->ra_event_processor(&event);
265 }
266 explicit_bzero(entropy_data, sizeof(entropy_data));
267 }
268
269 /* ARGSUSED */
270 static int
randomdev_write(struct cdev * dev __unused,struct uio * uio,int flags __unused)271 randomdev_write(struct cdev *dev __unused, struct uio *uio, int flags __unused)
272 {
273 uint8_t *random_buf;
274 int c, error = 0;
275 ssize_t nbytes;
276
277 random_buf = malloc(PAGE_SIZE, M_ENTROPY, M_WAITOK);
278 nbytes = uio->uio_resid;
279 while (uio->uio_resid > 0 && error == 0) {
280 c = MIN(uio->uio_resid, PAGE_SIZE);
281 error = uiomove(random_buf, c, uio);
282 if (error)
283 break;
284 randomdev_accumulate(random_buf, c);
285 tsleep(&random_alg_context, 0, "randwr", hz/10);
286 }
287 if (nbytes != uio->uio_resid && (error == ERESTART || error == EINTR))
288 /* Partial write, not error. */
289 error = 0;
290 free(random_buf, M_ENTROPY);
291 return (error);
292 }
293
294 /* ARGSUSED */
295 static int
randomdev_poll(struct cdev * dev __unused,int events,struct thread * td __unused)296 randomdev_poll(struct cdev *dev __unused, int events, struct thread *td __unused)
297 {
298
299 if (events & (POLLIN | POLLRDNORM)) {
300 if (p_random_alg_context->ra_seeded())
301 events &= (POLLIN | POLLRDNORM);
302 else
303 selrecord(td, &rsel);
304 }
305 return (events);
306 }
307
308 /* This will be called by the entropy processor when it seeds itself and becomes secure */
309 void
randomdev_unblock(void)310 randomdev_unblock(void)
311 {
312
313 selwakeuppri(&rsel, PUSER);
314 wakeup(&random_alg_context);
315 printf("random: unblocking device.\n");
316 /* Do random(9) a favour while we are about it. */
317 (void)atomic_cmpset_int(&arc4rand_iniseed_state, ARC4_ENTR_NONE, ARC4_ENTR_HAVE);
318 }
319
320 /* ARGSUSED */
321 static int
randomdev_ioctl(struct cdev * dev __unused,u_long cmd,caddr_t addr __unused,int flags __unused,struct thread * td __unused)322 randomdev_ioctl(struct cdev *dev __unused, u_long cmd, caddr_t addr __unused,
323 int flags __unused, struct thread *td __unused)
324 {
325 int error = 0;
326
327 switch (cmd) {
328 /* Really handled in upper layer */
329 case FIOASYNC:
330 case FIONBIO:
331 break;
332 default:
333 error = ENOTTY;
334 }
335
336 return (error);
337 }
338
339 void
random_source_register(struct random_source * rsource)340 random_source_register(struct random_source *rsource)
341 {
342 struct random_sources *rrs;
343
344 KASSERT(rsource != NULL, ("invalid input to %s", __func__));
345
346 rrs = malloc(sizeof(*rrs), M_ENTROPY, M_WAITOK);
347 rrs->rrs_source = rsource;
348
349 random_harvest_register_source(rsource->rs_source);
350
351 printf("random: registering fast source %s\n", rsource->rs_ident);
352 LIST_INSERT_HEAD(&source_list, rrs, rrs_entries);
353 }
354
355 void
random_source_deregister(struct random_source * rsource)356 random_source_deregister(struct random_source *rsource)
357 {
358 struct random_sources *rrs = NULL;
359
360 KASSERT(rsource != NULL, ("invalid input to %s", __func__));
361
362 random_harvest_deregister_source(rsource->rs_source);
363
364 LIST_FOREACH(rrs, &source_list, rrs_entries)
365 if (rrs->rrs_source == rsource) {
366 LIST_REMOVE(rrs, rrs_entries);
367 break;
368 }
369 if (rrs != NULL)
370 free(rrs, M_ENTROPY);
371 }
372
373 static int
random_source_handler(SYSCTL_HANDLER_ARGS)374 random_source_handler(SYSCTL_HANDLER_ARGS)
375 {
376 struct random_sources *rrs;
377 struct sbuf sbuf;
378 int error, count;
379
380 sbuf_new_for_sysctl(&sbuf, NULL, 64, req);
381 count = 0;
382 LIST_FOREACH(rrs, &source_list, rrs_entries) {
383 sbuf_cat(&sbuf, (count++ ? ",'" : "'"));
384 sbuf_cat(&sbuf, rrs->rrs_source->rs_ident);
385 sbuf_cat(&sbuf, "'");
386 }
387 error = sbuf_finish(&sbuf);
388 sbuf_delete(&sbuf);
389 return (error);
390 }
391 SYSCTL_PROC(_kern_random, OID_AUTO, random_sources, CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
392 NULL, 0, random_source_handler, "A",
393 "List of active fast entropy sources.");
394
395 /* ARGSUSED */
396 static int
randomdev_modevent(module_t mod __unused,int type,void * data __unused)397 randomdev_modevent(module_t mod __unused, int type, void *data __unused)
398 {
399 int error = 0;
400
401 switch (type) {
402 case MOD_LOAD:
403 printf("random: entropy device external interface\n");
404 random_dev = make_dev_credf(MAKEDEV_ETERNAL_KLD, &random_cdevsw,
405 RANDOM_UNIT, NULL, UID_ROOT, GID_WHEEL, 0644, "random");
406 make_dev_alias(random_dev, "urandom"); /* compatibility */
407 break;
408 case MOD_UNLOAD:
409 destroy_dev(random_dev);
410 break;
411 case MOD_SHUTDOWN:
412 break;
413 default:
414 error = EOPNOTSUPP;
415 break;
416 }
417 return (error);
418 }
419
420 static moduledata_t randomdev_mod = {
421 "random_device",
422 randomdev_modevent,
423 0
424 };
425
426 DECLARE_MODULE(random_device, randomdev_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
427 MODULE_VERSION(random_device, 1);
428 MODULE_DEPEND(random_device, crypto, 1, 1, 1);
429 MODULE_DEPEND(random_device, random_harvestq, 1, 1, 1);
430