From owner-svn-src-all@freebsd.org Mon Dec 30 01:38:20 2019 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 24D4D1D0EBA; Mon, 30 Dec 2019 01:38:20 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47mKnm0DpNz4Mfr; Mon, 30 Dec 2019 01:38:20 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F344E2265E; Mon, 30 Dec 2019 01:38:19 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id xBU1cJ1m064430; Mon, 30 Dec 2019 01:38:19 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id xBU1cJqR064429; Mon, 30 Dec 2019 01:38:19 GMT (envelope-from cem@FreeBSD.org) Message-Id: <201912300138.xBU1cJqR064429@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: Conrad Meyer Date: Mon, 30 Dec 2019 01:38:19 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r356194 - head/sys/dev/random X-SVN-Group: head X-SVN-Commit-Author: cem X-SVN-Commit-Paths: head/sys/dev/random X-SVN-Commit-Revision: 356194 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Dec 2019 01:38:20 -0000 Author: cem Date: Mon Dec 30 01:38:19 2019 New Revision: 356194 URL: https://svnweb.freebsd.org/changeset/base/356194 Log: random(4): Make entropy source deregistration safe Allow loadable modules that provide random entropy source(s) to safely unload. Prior to this change, no driver could ensure that their random_source structure was not being used by random_harvestq.c for any period of time after invoking random_source_deregister(). This change converts the source_list LIST to a ConcurrencyKit CK_LIST and uses an epoch(9) to protect typical read accesses of the list. The existing HARVEST_LOCK spin mutex is used to safely add and remove list entries. random_source_deregister() uses epoch_wait() to ensure no concurrent source_list readers are accessing a random_source before freeing the list item and returning to the caller. Callers can safely unload immediately after random_source_deregister() returns. Reviewed by: markj Approved by: csprng(markm) Discussed with: jhb Differential Revision: https://reviews.freebsd.org/D22489 Modified: head/sys/dev/random/random_harvestq.c Modified: head/sys/dev/random/random_harvestq.c ============================================================================== --- head/sys/dev/random/random_harvestq.c Mon Dec 30 00:49:49 2019 (r356193) +++ head/sys/dev/random/random_harvestq.c Mon Dec 30 01:38:19 2019 (r356194) @@ -34,7 +34,9 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include +#include #include #include #include @@ -76,6 +78,14 @@ static void random_sources_feed(void); static u_int read_rate; /* + * Random must initialize much earlier than epoch, but we can initialize the + * epoch code before SMP starts. Prior to SMP, we can safely bypass + * concurrency primitives. + */ +static __read_mostly bool epoch_inited; +static __read_mostly epoch_t rs_epoch; + +/* * How many events to queue up. We create this many items in * an 'empty' queue, then transfer them to the 'harvest' queue with * supplied junk. When used, they are transferred back to the @@ -94,12 +104,12 @@ volatile int random_kthread_control; __read_frequently u_int hc_source_mask; struct random_sources { - LIST_ENTRY(random_sources) rrs_entries; + CK_LIST_ENTRY(random_sources) rrs_entries; struct random_source *rrs_source; }; -static LIST_HEAD(sources_head, random_sources) source_list = - LIST_HEAD_INITIALIZER(source_list); +static CK_LIST_HEAD(sources_head, random_sources) source_list = + CK_LIST_HEAD_INITIALIZER(source_list); SYSCTL_NODE(_kern_random, OID_AUTO, harvest, CTLFLAG_RW, 0, "Entropy Device Parameters"); @@ -202,6 +212,14 @@ random_kthread(void) SYSINIT(random_device_h_proc, SI_SUB_KICK_SCHEDULER, SI_ORDER_ANY, kproc_start, &random_proc_kp); +static void +rs_epoch_init(void *dummy __unused) +{ + rs_epoch = epoch_alloc("Random Sources", EPOCH_PREEMPT); + epoch_inited = true; +} +SYSINIT(rs_epoch_init, SI_SUB_EPOCH, SI_ORDER_ANY, rs_epoch_init, NULL); + /* * Run through all fast sources reading entropy for the given * number of rounds, which should be a multiple of the number @@ -211,9 +229,13 @@ static void random_sources_feed(void) { uint32_t entropy[HARVESTSIZE]; + struct epoch_tracker et; struct random_sources *rrs; u_int i, n, local_read_rate; + bool rse_warm; + rse_warm = epoch_inited; + /* * Step over all of live entropy sources, and feed their output * to the system-wide RNG. @@ -223,7 +245,9 @@ random_sources_feed(void) local_read_rate = MAX(local_read_rate, 1); /* But not exceeding RANDOM_KEYSIZE_WORDS */ local_read_rate = MIN(local_read_rate, RANDOM_KEYSIZE_WORDS); - LIST_FOREACH(rrs, &source_list, rrs_entries) { + if (rse_warm) + epoch_enter_preempt(rs_epoch, &et); + CK_LIST_FOREACH(rrs, &source_list, rrs_entries) { for (i = 0; i < p_random_alg_context->ra_poolcount*local_read_rate; i++) { n = rrs->rrs_source->rs_read(entropy, sizeof(entropy)); KASSERT((n <= sizeof(entropy)), ("%s: rs_read returned too much data (%u > %zu)", __func__, n, sizeof(entropy))); @@ -243,6 +267,8 @@ random_sources_feed(void) random_harvest_direct(entropy, n, rrs->rrs_source->rs_source); } } + if (rse_warm) + epoch_exit_preempt(rs_epoch, &et); explicit_bzero(entropy, sizeof(entropy)); } @@ -573,7 +599,10 @@ random_source_register(struct random_source *rsource) random_harvest_register_source(rsource->rs_source); printf("random: registering fast source %s\n", rsource->rs_ident); - LIST_INSERT_HEAD(&source_list, rrs, rrs_entries); + + RANDOM_HARVEST_LOCK(); + CK_LIST_INSERT_HEAD(&source_list, rrs, rrs_entries); + RANDOM_HARVEST_UNLOCK(); } void @@ -585,29 +614,40 @@ random_source_deregister(struct random_source *rsource random_harvest_deregister_source(rsource->rs_source); - LIST_FOREACH(rrs, &source_list, rrs_entries) + RANDOM_HARVEST_LOCK(); + CK_LIST_FOREACH(rrs, &source_list, rrs_entries) if (rrs->rrs_source == rsource) { - LIST_REMOVE(rrs, rrs_entries); + CK_LIST_REMOVE(rrs, rrs_entries); break; } - if (rrs != NULL) - free(rrs, M_ENTROPY); + RANDOM_HARVEST_UNLOCK(); + + if (rrs != NULL && epoch_inited) + epoch_wait_preempt(rs_epoch); + free(rrs, M_ENTROPY); } static int random_source_handler(SYSCTL_HANDLER_ARGS) { + struct epoch_tracker et; struct random_sources *rrs; struct sbuf sbuf; int error, count; + error = sysctl_wire_old_buffer(req, 0); + if (error != 0) + return (error); + sbuf_new_for_sysctl(&sbuf, NULL, 64, req); count = 0; - LIST_FOREACH(rrs, &source_list, rrs_entries) { + epoch_enter_preempt(rs_epoch, &et); + CK_LIST_FOREACH(rrs, &source_list, rrs_entries) { sbuf_cat(&sbuf, (count++ ? ",'" : "'")); sbuf_cat(&sbuf, rrs->rrs_source->rs_ident); sbuf_cat(&sbuf, "'"); } + epoch_exit_preempt(rs_epoch, &et); error = sbuf_finish(&sbuf); sbuf_delete(&sbuf); return (error);