1/*-
2 * Copyright (c) 2017 Oliver Pinter
3 * Copyright (c) 2000-2015 Mark R V Murray
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer
11 *    in this position and unchanged.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 */
28
29#include <sys/cdefs.h>
30__FBSDID("$FreeBSD$");
31
32#include <sys/param.h>
33#include <sys/systm.h>
34#include <sys/bus.h>
35#include <sys/conf.h>
36#include <sys/fcntl.h>
37#include <sys/filio.h>
38#include <sys/kernel.h>
39#include <sys/kthread.h>
40#include <sys/lock.h>
41#include <sys/module.h>
42#include <sys/malloc.h>
43#include <sys/poll.h>
44#include <sys/proc.h>
45#include <sys/random.h>
46#include <sys/sbuf.h>
47#include <sys/selinfo.h>
48#include <sys/sysctl.h>
49#include <sys/systm.h>
50#include <sys/uio.h>
51#include <sys/unistd.h>
52
53#include <crypto/rijndael/rijndael-api-fst.h>
54#include <crypto/sha2/sha256.h>
55
56#include <dev/random/hash.h>
57#include <dev/random/randomdev.h>
58#include <dev/random/random_harvestq.h>
59
60#define	RANDOM_UNIT	0
61
62#if defined(RANDOM_LOADABLE)
63#define READ_RANDOM_UIO	_read_random_uio
64#define READ_RANDOM	_read_random
65static int READ_RANDOM_UIO(struct uio *, bool);
66static u_int READ_RANDOM(void *, u_int);
67#else
68#define READ_RANDOM_UIO	read_random_uio
69#define READ_RANDOM	read_random
70#endif
71
72static d_read_t randomdev_read;
73static d_write_t randomdev_write;
74static d_poll_t randomdev_poll;
75static d_ioctl_t randomdev_ioctl;
76
77static struct cdevsw random_cdevsw = {
78	.d_name = "random",
79	.d_version = D_VERSION,
80	.d_read = randomdev_read,
81	.d_write = randomdev_write,
82	.d_poll = randomdev_poll,
83	.d_ioctl = randomdev_ioctl,
84};
85
86/* For use with make_dev(9)/destroy_dev(9). */
87static struct cdev *random_dev;
88
89static void
90random_alg_context_ra_init_alg(void *data)
91{
92
93	p_random_alg_context = &random_alg_context;
94	p_random_alg_context->ra_init_alg(data);
95#if defined(RANDOM_LOADABLE)
96	random_infra_init(READ_RANDOM_UIO, READ_RANDOM);
97#endif
98}
99
100static void
101random_alg_context_ra_deinit_alg(void *data)
102{
103
104#if defined(RANDOM_LOADABLE)
105	random_infra_uninit();
106#endif
107	p_random_alg_context->ra_deinit_alg(data);
108	p_random_alg_context = NULL;
109}
110
111SYSINIT(random_device, SI_SUB_RANDOM, SI_ORDER_THIRD, random_alg_context_ra_init_alg, NULL);
112SYSUNINIT(random_device, SI_SUB_RANDOM, SI_ORDER_THIRD, random_alg_context_ra_deinit_alg, NULL);
113
114static struct selinfo rsel;
115
116/*
117 * This is the read uio(9) interface for random(4).
118 */
119/* ARGSUSED */
120static int
121randomdev_read(struct cdev *dev __unused, struct uio *uio, int flags)
122{
123
124	return (READ_RANDOM_UIO(uio, (flags & O_NONBLOCK) != 0));
125}
126
127int
128READ_RANDOM_UIO(struct uio *uio, bool nonblock)
129{
130	uint8_t *random_buf;
131	int error, spamcount;
132	ssize_t read_len, total_read, c;
133	/* 16 MiB takes about 0.08 s CPU time on my 2017 AMD Zen CPU */
134#define SIGCHK_PERIOD (16 * 1024 * 1024)
135	const size_t sigchk_period = SIGCHK_PERIOD;
136
137	CTASSERT(SIGCHK_PERIOD % PAGE_SIZE == 0);
138#undef SIGCHK_PERIOD
139
140	random_buf = malloc(PAGE_SIZE, M_ENTROPY, M_WAITOK);
141	p_random_alg_context->ra_pre_read();
142	error = 0;
143	spamcount = 0;
144	/* (Un)Blocking logic */
145	while (!p_random_alg_context->ra_seeded()) {
146		if (nonblock) {
147			error = EWOULDBLOCK;
148			break;
149		}
150		/* keep tapping away at the pre-read until we seed/unblock. */
151		p_random_alg_context->ra_pre_read();
152		/* Only bother the console every 10 seconds or so */
153		if (spamcount == 0)
154			printf("random: %s unblock wait\n", __func__);
155		spamcount = (spamcount + 1)%100;
156		error = tsleep(&random_alg_context, PCATCH, "randseed", hz/10);
157		if (error == ERESTART || error == EINTR)
158			break;
159		/* Squash tsleep timeout condition */
160		if (error == EWOULDBLOCK)
161			error = 0;
162		KASSERT(error == 0, ("unexpected tsleep error %d", error));
163	}
164	if (error == 0) {
165		read_rate_increment((uio->uio_resid + sizeof(uint32_t))/sizeof(uint32_t));
166		total_read = 0;
167		while (uio->uio_resid && !error) {
168			read_len = uio->uio_resid;
169			/*
170			 * Belt-and-braces.
171			 * Round up the read length to a crypto block size multiple,
172			 * which is what the underlying generator is expecting.
173			 * See the random_buf size requirements in the Fortuna code.
174			 */
175			read_len = roundup(read_len, RANDOM_BLOCKSIZE);
176			/* Work in chunks page-sized or less */
177			read_len = MIN(read_len, PAGE_SIZE);
178			p_random_alg_context->ra_read(random_buf, read_len);
179			c = MIN(uio->uio_resid, read_len);
180			/*
181			 * uiomove() may yield the CPU before each 'c' bytes
182			 * (up to PAGE_SIZE) are copied out.
183			 */
184			error = uiomove(random_buf, c, uio);
185			total_read += c;
186			/*
187			 * Poll for signals every few MBs to avoid very long
188			 * uninterruptible syscalls.
189			 */
190			if (error == 0 && uio->uio_resid != 0 &&
191			    total_read % sigchk_period == 0) {
192				error = tsleep_sbt(&random_alg_context, PCATCH,
193				    "randrd", SBT_1NS, 0, C_HARDCLOCK);
194				/* Squash tsleep timeout condition */
195				if (error == EWOULDBLOCK)
196					error = 0;
197			}
198		}
199		if (error == ERESTART || error == EINTR)
200			error = 0;
201	}
202	free(random_buf, M_ENTROPY);
203	return (error);
204}
205
206/*-
207 * Kernel API version of read_random().
208 * This is similar to random_alg_read(),
209 * except it doesn't interface with uio(9).
210 * It cannot assumed that random_buf is a multiple of
211 * RANDOM_BLOCKSIZE bytes.
212 */
213u_int
214READ_RANDOM(void *random_buf, u_int len)
215{
216	u_int read_len;
217	uint8_t local_buf[len + RANDOM_BLOCKSIZE];
218
219	KASSERT(random_buf != NULL, ("No suitable random buffer in %s", __func__));
220	p_random_alg_context->ra_pre_read();
221	/* (Un)Blocking logic; if not seeded, return nothing. */
222	if (p_random_alg_context->ra_seeded()) {
223		read_rate_increment((len + sizeof(uint32_t))/sizeof(uint32_t));
224		if (len > 0) {
225			/*
226			 * Belt-and-braces.
227			 * Round up the read length to a crypto block size multiple,
228			 * which is what the underlying generator is expecting.
229			 */
230			read_len = roundup(len, RANDOM_BLOCKSIZE);
231			p_random_alg_context->ra_read(local_buf, read_len);
232			memcpy(random_buf, local_buf, len);
233		}
234	} else
235		len = 0;
236	return (len);
237}
238
239static __inline void
240randomdev_accumulate(uint8_t *buf, u_int count)
241{
242	static u_int destination = 0;
243	static struct harvest_event event;
244	static struct randomdev_hash hash;
245	static uint32_t entropy_data[RANDOM_KEYSIZE_WORDS];
246	uint32_t timestamp;
247	int i;
248
249	/* Extra timing here is helpful to scrape scheduler jitter entropy */
250	randomdev_hash_init(&hash);
251	timestamp = (uint32_t)get_cyclecount();
252	randomdev_hash_iterate(&hash, &timestamp, sizeof(timestamp));
253	randomdev_hash_iterate(&hash, buf, count);
254	timestamp = (uint32_t)get_cyclecount();
255	randomdev_hash_iterate(&hash, &timestamp, sizeof(timestamp));
256	randomdev_hash_finish(&hash, entropy_data);
257	explicit_bzero(&hash, sizeof(hash));
258	for (i = 0; i < RANDOM_KEYSIZE_WORDS; i += sizeof(event.he_entropy)/sizeof(event.he_entropy[0])) {
259		event.he_somecounter = (uint32_t)get_cyclecount();
260		event.he_size = sizeof(event.he_entropy);
261		event.he_source = RANDOM_CACHED;
262		event.he_destination = destination++; /* Harmless cheating */
263		memcpy(event.he_entropy, entropy_data + i, sizeof(event.he_entropy));
264		p_random_alg_context->ra_event_processor(&event);
265	}
266	explicit_bzero(entropy_data, sizeof(entropy_data));
267}
268
269/* ARGSUSED */
270static int
271randomdev_write(struct cdev *dev __unused, struct uio *uio, int flags __unused)
272{
273	uint8_t *random_buf;
274	int c, error = 0;
275	ssize_t nbytes;
276
277	random_buf = malloc(PAGE_SIZE, M_ENTROPY, M_WAITOK);
278	nbytes = uio->uio_resid;
279	while (uio->uio_resid > 0 && error == 0) {
280		c = MIN(uio->uio_resid, PAGE_SIZE);
281		error = uiomove(random_buf, c, uio);
282		if (error)
283			break;
284		randomdev_accumulate(random_buf, c);
285		tsleep(&random_alg_context, 0, "randwr", hz/10);
286	}
287	if (nbytes != uio->uio_resid && (error == ERESTART || error == EINTR))
288		/* Partial write, not error. */
289		error = 0;
290	free(random_buf, M_ENTROPY);
291	return (error);
292}
293
294/* ARGSUSED */
295static int
296randomdev_poll(struct cdev *dev __unused, int events, struct thread *td __unused)
297{
298
299	if (events & (POLLIN | POLLRDNORM)) {
300		if (p_random_alg_context->ra_seeded())
301			events &= (POLLIN | POLLRDNORM);
302		else
303			selrecord(td, &rsel);
304	}
305	return (events);
306}
307
308/* This will be called by the entropy processor when it seeds itself and becomes secure */
309void
310randomdev_unblock(void)
311{
312
313	selwakeuppri(&rsel, PUSER);
314	wakeup(&random_alg_context);
315	printf("random: unblocking device.\n");
316	/* Do random(9) a favour while we are about it. */
317	(void)atomic_cmpset_int(&arc4rand_iniseed_state, ARC4_ENTR_NONE, ARC4_ENTR_HAVE);
318}
319
320/* ARGSUSED */
321static int
322randomdev_ioctl(struct cdev *dev __unused, u_long cmd, caddr_t addr __unused,
323    int flags __unused, struct thread *td __unused)
324{
325	int error = 0;
326
327	switch (cmd) {
328		/* Really handled in upper layer */
329	case FIOASYNC:
330	case FIONBIO:
331		break;
332	default:
333		error = ENOTTY;
334	}
335
336	return (error);
337}
338
339void
340random_source_register(struct random_source *rsource)
341{
342	struct random_sources *rrs;
343
344	KASSERT(rsource != NULL, ("invalid input to %s", __func__));
345
346	rrs = malloc(sizeof(*rrs), M_ENTROPY, M_WAITOK);
347	rrs->rrs_source = rsource;
348
349	random_harvest_register_source(rsource->rs_source);
350
351	printf("random: registering fast source %s\n", rsource->rs_ident);
352	LIST_INSERT_HEAD(&source_list, rrs, rrs_entries);
353}
354
355void
356random_source_deregister(struct random_source *rsource)
357{
358	struct random_sources *rrs = NULL;
359
360	KASSERT(rsource != NULL, ("invalid input to %s", __func__));
361
362	random_harvest_deregister_source(rsource->rs_source);
363
364	LIST_FOREACH(rrs, &source_list, rrs_entries)
365		if (rrs->rrs_source == rsource) {
366			LIST_REMOVE(rrs, rrs_entries);
367			break;
368		}
369	if (rrs != NULL)
370		free(rrs, M_ENTROPY);
371}
372
373static int
374random_source_handler(SYSCTL_HANDLER_ARGS)
375{
376	struct random_sources *rrs;
377	struct sbuf sbuf;
378	int error, count;
379
380	sbuf_new_for_sysctl(&sbuf, NULL, 64, req);
381	count = 0;
382	LIST_FOREACH(rrs, &source_list, rrs_entries) {
383		sbuf_cat(&sbuf, (count++ ? ",'" : "'"));
384		sbuf_cat(&sbuf, rrs->rrs_source->rs_ident);
385		sbuf_cat(&sbuf, "'");
386	}
387	error = sbuf_finish(&sbuf);
388	sbuf_delete(&sbuf);
389	return (error);
390}
391SYSCTL_PROC(_kern_random, OID_AUTO, random_sources, CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
392	    NULL, 0, random_source_handler, "A",
393	    "List of active fast entropy sources.");
394
395/* ARGSUSED */
396static int
397randomdev_modevent(module_t mod __unused, int type, void *data __unused)
398{
399	int error = 0;
400
401	switch (type) {
402	case MOD_LOAD:
403		printf("random: entropy device external interface\n");
404		random_dev = make_dev_credf(MAKEDEV_ETERNAL_KLD, &random_cdevsw,
405		    RANDOM_UNIT, NULL, UID_ROOT, GID_WHEEL, 0644, "random");
406		make_dev_alias(random_dev, "urandom"); /* compatibility */
407		break;
408	case MOD_UNLOAD:
409		destroy_dev(random_dev);
410		break;
411	case MOD_SHUTDOWN:
412		break;
413	default:
414		error = EOPNOTSUPP;
415		break;
416	}
417	return (error);
418}
419
420static moduledata_t randomdev_mod = {
421	"random_device",
422	randomdev_modevent,
423	0
424};
425
426DECLARE_MODULE(random_device, randomdev_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
427MODULE_VERSION(random_device, 1);
428MODULE_DEPEND(random_device, crypto, 1, 1, 1);
429MODULE_DEPEND(random_device, random_harvestq, 1, 1, 1);
430