From owner-freebsd-security@FreeBSD.ORG Wed Sep 26 16:54:16 2012 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9D76E106564A; Wed, 26 Sep 2012 16:54:16 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 460618FC08; Wed, 26 Sep 2012 16:54:15 +0000 (UTC) Received: from ds4.des.no (smtp.des.no [194.63.250.102]) by smtp.des.no (Postfix) with ESMTP id DE242666A; Wed, 26 Sep 2012 18:54:07 +0200 (CEST) Received: by ds4.des.no (Postfix, from userid 1001) id 8E28982B3; Wed, 26 Sep 2012 18:54:07 +0200 (CEST) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Ben Laurie References: <20120918211422.GA1400@garage.freebsd.pl> <20120919231051.4bc5335b@gumby.homeunix.com> <20120920102104.GA1397@garage.freebsd.pl> <201209200758.51924.jhb@freebsd.org> <20120922080323.GA1454@garage.freebsd.pl> <20120922195325.GH1454@garage.freebsd.pl> <505E59DC.7090505@gmail.com> <20120923151706.GN1454@garage.freebsd.pl> <5060D723.6020305@gmail.com> <86r4pqqwnm.fsf@ds4.des.no> Date: Wed, 26 Sep 2012 18:54:05 +0200 In-Reply-To: <86r4pqqwnm.fsf@ds4.des.no> ("Dag-Erling =?utf-8?Q?Sm=C3=B8rg?= =?utf-8?Q?rav=22's?= message of "Tue, 25 Sep 2012 11:28:13 +0200") Message-ID: <86sja4sp1u.fsf@ds4.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: Jonathan Anderson , Pawel Jakub Dawidek , John Baldwin , freebsd-security@freebsd.org, RW , Mariusz Gromada Subject: Re: Collecting entropy from device_attach() times. X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Sep 2012 16:54:16 -0000 Dag-Erling Sm=C3=B8rgrav writes: > If you give me a couple of days, I'll try to come up with a patch that > collects and stores attach times during boot so we can gather and > analyse real data. Here's the patch, as a superset of Pawel's. The output looks like this: des@crashbox ~% sysctl -b hw.attachtimes| hexdump -C 00000000 72 61 6d 30 00 00 00 00 00 00 00 00 00 00 00 00 |ram0..........= ..| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 01 24 53 |..............= $S| 00000020 63 70 75 30 00 00 00 00 00 00 00 00 00 00 00 00 |cpu0..........= ..| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 01 4d 6c cb |.............M= l.| 00000040 63 70 75 31 00 00 00 00 00 00 00 00 00 00 00 00 |cpu1..........= ..| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 01 4d da b6 |.............M= ..| 00000060 61 74 74 69 6d 65 72 30 00 00 00 00 00 00 00 00 |attimer0......= ..| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 04 59 70 8f |.............Y= p.| [...] where the first 24 bytes of each record contain the device name (dev->nameunit) and the last eight bytes contain d(cyclecount) for device_attach() as a big-endian uint64_t. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no Index: sys/dev/random/randomdev_soft.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- sys/dev/random/randomdev_soft.c (revision 240914) +++ sys/dev/random/randomdev_soft.c (working copy) @@ -303,7 +303,7 @@ KASSERT(origin =3D=3D RANDOM_START || origin =3D=3D RANDOM_WRITE || origin =3D=3D RANDOM_KEYBOARD || origin =3D=3D RANDOM_MOUSE || origin =3D=3D RANDOM_NET || origin =3D=3D RANDOM_INTERRUPT || - origin =3D=3D RANDOM_PURE, + origin =3D=3D RANDOM_PURE || origin =3D=3D RANDOM_DEVICE, ("random_harvest_internal: origin %d invalid\n", origin)); =20 /* Lockless read to avoid lock operations if fifo is full. */ Index: sys/sys/random.h =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- sys/sys/random.h (revision 240914) +++ sys/sys/random.h (working copy) @@ -45,6 +45,7 @@ RANDOM_NET, RANDOM_INTERRUPT, RANDOM_PURE, + RANDOM_DEVICE, ENTROPYSOURCE }; void random_harvest(void *, u_int, u_int, u_int, enum esource); Index: sys/kern/subr_bus.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- sys/kern/subr_bus.c (revision 240914) +++ sys/kern/subr_bus.c (working copy) @@ -31,6 +31,7 @@ =20 #include #include +#include #include #include #include @@ -44,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -53,6 +55,7 @@ #include #include =20 +#include #include =20 #include @@ -60,6 +63,16 @@ SYSCTL_NODE(_hw, OID_AUTO, bus, CTLFLAG_RW, NULL, NULL); SYSCTL_NODE(, OID_AUTO, dev, CTLFLAG_RW, NULL, NULL); =20 +#define MAXNATTACHTIMES 128 +static struct attachtime { + char name[24]; + uint64_t delta; +} attachtimes[MAXNATTACHTIMES]; +static int nattachtimes; +SYSCTL_OPAQUE(_hw, OID_AUTO, attachtimes, CTLFLAG_RD, + &attachtimes, sizeof(attachtimes), "S,attachtimes", + "time spent in device_attach()"); + /* * Used to attach drivers to devclasses. */ @@ -2760,8 +2773,10 @@ int device_attach(device_t dev) { + uint64_t attachtime; int error; =20 + attachtime =3D get_cyclecount(); device_sysctl_init(dev); if (!device_is_quiet(dev)) device_print_child(dev->parent, dev); @@ -2784,6 +2799,15 @@ dev->state =3D DS_ATTACHED; dev->flags &=3D ~DF_DONENOMATCH; devadded(dev); + attachtime =3D get_cyclecount() - attachtime; + if (nattachtimes < MAXNATTACHTIMES) { + strlcpy(attachtimes[nattachtimes].name, dev->nameunit, + sizeof(attachtimes[nattachtimes])); + attachtimes[nattachtimes].delta =3D htobe64(attachtime); + ++nattachtimes; + } + random_harvest(&attachtime, sizeof(attachtime), 4, 0, RANDOM_DEVICE); + return (0); } =20