From owner-svn-src-head@freebsd.org Tue Jun 4 00:01:38 2019 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 63D8115C1DE6; Tue, 4 Jun 2019 00:01:38 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 053CF75DB3; Tue, 4 Jun 2019 00:01:38 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id D5435D971; Tue, 4 Jun 2019 00:01:37 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x5401brl046777; Tue, 4 Jun 2019 00:01:37 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x5401b3s046776; Tue, 4 Jun 2019 00:01:37 GMT (envelope-from cem@FreeBSD.org) Message-Id: <201906040001.x5401b3s046776@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: Conrad Meyer Date: Tue, 4 Jun 2019 00:01:37 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r348595 - head/sys/dev/virtio/random X-SVN-Group: head X-SVN-Commit-Author: cem X-SVN-Commit-Paths: head/sys/dev/virtio/random X-SVN-Commit-Revision: 348595 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 053CF75DB3 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.97 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.97)[-0.969,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jun 2019 00:01:38 -0000 Author: cem Date: Tue Jun 4 00:01:37 2019 New Revision: 348595 URL: https://svnweb.freebsd.org/changeset/base/348595 Log: virtio_random(4): Fix random(4) integration random(4) masks unregistered entropy sources. Prior to this revision, virtio_random(4) did not correctly register a random_source and did not function as a source of entropy. Random source registration for loadable pure sources requires registering a poll callback, which is invoked periodically by random(4)'s harvestq kthread. The periodic poll makes virtio_random(4)'s periodic entropy collection redundant, so this revision removes the callout. The current random source API is somewhat limiting, so simply fail to attach any virtio_random devices if one is already registered as a source. This scenario is expected to be uncommon. While here, handle the possibility of short reads from the hypervisor random device gracefully / correctly. It is not clear why a hypervisor would return a short read or if it is allowed by spec, but we may as well handle it. Reviewed by: bryanv (earlier version), markm Security: yes (note: many other "pure" random sources remain broken) Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D20419 Modified: head/sys/dev/virtio/random/virtio_random.c Modified: head/sys/dev/virtio/random/virtio_random.c ============================================================================== --- head/sys/dev/virtio/random/virtio_random.c Mon Jun 3 23:57:29 2019 (r348594) +++ head/sys/dev/virtio/random/virtio_random.c Tue Jun 4 00:01:37 2019 (r348595) @@ -33,21 +33,24 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include #include #include #include +#include #include #include #include +#include +#include #include #include struct vtrnd_softc { uint64_t vtrnd_features; - struct callout vtrnd_callout; struct virtqueue *vtrnd_vq; }; @@ -59,8 +62,8 @@ static int vtrnd_detach(device_t); static void vtrnd_negotiate_features(device_t); static int vtrnd_alloc_virtqueue(device_t); -static void vtrnd_harvest(struct vtrnd_softc *); -static void vtrnd_timer(void *); +static int vtrnd_harvest(struct vtrnd_softc *, void *, size_t *); +static unsigned vtrnd_read(void *, unsigned); #define VTRND_FEATURES 0 @@ -68,6 +71,15 @@ static struct virtio_feature_desc vtrnd_feature_desc[] { 0, NULL } }; +static struct random_source random_vtrnd = { + .rs_ident = "VirtIO Entropy Adapter", + .rs_source = RANDOM_PURE_VIRTIO, + .rs_read = vtrnd_read, +}; + +/* Kludge for API limitations of random(4). */ +static _Atomic(struct vtrnd_softc *) g_vtrnd_softc; + static device_method_t vtrnd_methods[] = { /* Device methods. */ DEVMETHOD(device_probe, vtrnd_probe), @@ -125,13 +137,11 @@ vtrnd_probe(device_t dev) static int vtrnd_attach(device_t dev) { - struct vtrnd_softc *sc; + struct vtrnd_softc *sc, *exp; int error; sc = device_get_softc(dev); - callout_init(&sc->vtrnd_callout, 1); - virtio_set_feature_desc(dev, vtrnd_feature_desc); vtrnd_negotiate_features(dev); @@ -141,7 +151,13 @@ vtrnd_attach(device_t dev) goto fail; } - callout_reset(&sc->vtrnd_callout, 5 * hz, vtrnd_timer, sc); + exp = NULL; + if (!atomic_compare_exchange_strong_explicit(&g_vtrnd_softc, &exp, sc, + memory_order_release, memory_order_acquire)) { + error = EEXIST; + goto fail; + } + random_source_register(&random_vtrnd); fail: if (error) @@ -156,9 +172,20 @@ vtrnd_detach(device_t dev) struct vtrnd_softc *sc; sc = device_get_softc(dev); + KASSERT( + atomic_load_explicit(&g_vtrnd_softc, memory_order_acquire) == sc, + ("only one global instance at a time")); - callout_drain(&sc->vtrnd_callout); + random_source_deregister(&random_vtrnd); + atomic_store_explicit(&g_vtrnd_softc, NULL, memory_order_release); + /* + * Unfortunately, deregister does not guarantee our source callback + * will not be invoked after it returns. Use a kludge to prevent some, + * but not all, possible races. + */ + tsleep_sbt(&g_vtrnd_softc, 0, "vtrnddet", mstosbt(50), 0, C_HARDCLOCK); + return (0); } @@ -185,44 +212,64 @@ vtrnd_alloc_virtqueue(device_t dev) return (virtio_alloc_virtqueues(dev, 0, 1, &vq_info)); } -static void -vtrnd_harvest(struct vtrnd_softc *sc) +static int +vtrnd_harvest(struct vtrnd_softc *sc, void *buf, size_t *sz) { struct sglist_seg segs[1]; struct sglist sg; struct virtqueue *vq; - uint32_t value; + uint32_t value[HARVESTSIZE] __aligned(sizeof(uint32_t) * HARVESTSIZE); + uint32_t rdlen; int error; - vq = sc->vtrnd_vq; + _Static_assert(sizeof(value) < PAGE_SIZE, "sglist assumption"); sglist_init(&sg, 1, segs); - error = sglist_append(&sg, &value, sizeof(value)); - KASSERT(error == 0 && sg.sg_nseg == 1, - ("%s: error %d adding buffer to sglist", __func__, error)); + error = sglist_append(&sg, value, *sz); + if (error != 0) + panic("%s: sglist_append error=%d", __func__, error); - if (!virtqueue_empty(vq)) - return; - if (virtqueue_enqueue(vq, &value, &sg, 0, 1) != 0) - return; + vq = sc->vtrnd_vq; + KASSERT(virtqueue_empty(vq), ("%s: non-empty queue", __func__)); + error = virtqueue_enqueue(vq, buf, &sg, 0, 1); + if (error != 0) + return (error); + /* * Poll for the response, but the command is likely already * done when we return from the notify. */ virtqueue_notify(vq); - virtqueue_poll(vq, NULL); + virtqueue_poll(vq, &rdlen); - random_harvest_queue(&value, sizeof(value), RANDOM_PURE_VIRTIO); + if (rdlen > *sz) + panic("%s: random device wrote %zu bytes beyond end of provided" + " buffer %p:%zu", __func__, (size_t)rdlen - *sz, + (void *)value, *sz); + else if (rdlen == 0) + return (EAGAIN); + *sz = MIN(rdlen, *sz); + memcpy(buf, value, *sz); + explicit_bzero(value, *sz); + return (0); } -static void -vtrnd_timer(void *xsc) +static unsigned +vtrnd_read(void *buf, unsigned usz) { struct vtrnd_softc *sc; + size_t sz; + int error; - sc = xsc; + sc = g_vtrnd_softc; + if (sc == NULL) + return (0); - vtrnd_harvest(sc); - callout_schedule(&sc->vtrnd_callout, 5 * hz); + sz = usz; + error = vtrnd_harvest(sc, buf, &sz); + if (error != 0) + return (0); + + return (sz); }