git: 7878a69e0415 - stable/12 - random(4): Make entropy source deregistration safe

The branch stable/12 has been updated by obrien:

URL: https://cgit.FreeBSD.org/src/commit/?id=7878a69e0415251e4c7a0d3447f998207258ad41

commit 7878a69e0415251e4c7a0d3447f998207258ad41
Author:     Conrad Meyer <cem@FreeBSD.org>
AuthorDate: 2019-12-30 01:38:19 +0000
Commit:     David E. O'Brien <obrien@FreeBSD.org>
CommitDate: 2022-02-22 06:20:50 +0000

    random(4): Make entropy source deregistration safe
    
    Allow loadable modules that provide random entropy source(s) to safely
    unload.  Prior to this change, no driver could ensure that their
    random_source structure was not being used by random_harvestq.c for any
    period of time after invoking random_source_deregister().
    
    This change converts the source_list LIST to a ConcurrencyKit CK_LIST and
    uses an epoch(9) to protect typical read accesses of the list.  The existing
    HARVEST_LOCK spin mutex is used to safely add and remove list entries.
    random_source_deregister() uses epoch_wait() to ensure no concurrent
    source_list readers are accessing a random_source before freeing the list
    item and returning to the caller.
    
    Callers can safely unload immediately after random_source_deregister()
    returns.
    
    (cherry picked from commit 374c99911ee45c5d2ddd42bc6bcf711a8a66b07e)
---
 sys/dev/random/random_harvestq.c | 60 +++++++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 10 deletions(-)

diff --git a/sys/dev/random/random_harvestq.c b/sys/dev/random/random_harvestq.c
index 3f29a5bad979..c01cd0851a89 100644
--- a/sys/dev/random/random_harvestq.c
+++ b/sys/dev/random/random_harvestq.c
@@ -34,7 +34,9 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/ck.h>
 #include <sys/conf.h>
+#include <sys/epoch.h>
 #include <sys/eventhandler.h>
 #include <sys/hash.h>
 #include <sys/kernel.h>
@@ -71,6 +73,14 @@ static void random_sources_feed(void);
 
 static u_int read_rate;
 
+/*
+ * Random must initialize much earlier than epoch, but we can initialize the
+ * epoch code before SMP starts.  Prior to SMP, we can safely bypass
+ * concurrency primitives.
+ */
+static __read_mostly bool epoch_inited;
+static __read_mostly epoch_t rs_epoch;
+
 /*
  * How many events to queue up. We create this many items in
  * an 'empty' queue, then transfer them to the 'harvest' queue with
@@ -90,12 +100,12 @@ volatile int random_kthread_control;
 __read_frequently u_int hc_source_mask;
 
 struct random_sources {
-	LIST_ENTRY(random_sources)	 rrs_entries;
+	CK_LIST_ENTRY(random_sources)	 rrs_entries;
 	struct random_source		*rrs_source;
 };
 
-static LIST_HEAD(sources_head, random_sources) source_list =
-    LIST_HEAD_INITIALIZER(source_list);
+static CK_LIST_HEAD(sources_head, random_sources) source_list =
+    CK_LIST_HEAD_INITIALIZER(source_list);
 
 SYSCTL_NODE(_kern_random, OID_AUTO, harvest, CTLFLAG_RW, 0,
     "Entropy Device Parameters");
@@ -199,6 +209,14 @@ random_kthread(void)
 SYSINIT(random_device_h_proc, SI_SUB_KICK_SCHEDULER, SI_ORDER_ANY, kproc_start,
     &random_proc_kp);
 
+static void
+rs_epoch_init(void *dummy __unused)
+{
+	rs_epoch = epoch_alloc(EPOCH_PREEMPT);
+	epoch_inited = true;
+}
+SYSINIT(rs_epoch_init, SI_SUB_EPOCH, SI_ORDER_ANY, rs_epoch_init, NULL);
+
 /*
  * Run through all fast sources reading entropy for the given
  * number of rounds, which should be a multiple of the number
@@ -208,8 +226,12 @@ static void
 random_sources_feed(void)
 {
 	uint32_t entropy[HARVESTSIZE];
+	struct epoch_tracker et;
 	struct random_sources *rrs;
 	u_int i, n, local_read_rate, npools;
+	bool rse_warm;
+
+	rse_warm = epoch_inited;
 
 	/*
 	 * Step over all of live entropy sources, and feed their output
@@ -233,7 +255,9 @@ random_sources_feed(void)
 	npools = howmany(p_random_alg_context->ra_poolcount * local_read_rate,
 	    RANDOM_KTHREAD_HZ);
 
-	LIST_FOREACH(rrs, &source_list, rrs_entries) {
+	if (rse_warm)
+		epoch_enter_preempt(rs_epoch, &et);
+	CK_LIST_FOREACH(rrs, &source_list, rrs_entries) {
 		for (i = 0; i < npools; i++) {
 			n = rrs->rrs_source->rs_read(entropy, sizeof(entropy));
 			KASSERT((n <= sizeof(entropy)), ("%s: rs_read returned too much data (%u > %zu)", __func__, n, sizeof(entropy)));
@@ -253,6 +277,8 @@ random_sources_feed(void)
 			random_harvest_direct(entropy, n, rrs->rrs_source->rs_source);
 		}
 	}
+	if (rse_warm)
+		epoch_exit_preempt(rs_epoch, &et);
 	explicit_bzero(entropy, sizeof(entropy));
 }
 
@@ -575,7 +601,10 @@ random_source_register(struct random_source *rsource)
 	random_harvest_register_source(rsource->rs_source);
 
 	printf("random: registering fast source %s\n", rsource->rs_ident);
-	LIST_INSERT_HEAD(&source_list, rrs, rrs_entries);
+
+	RANDOM_HARVEST_LOCK();
+	CK_LIST_INSERT_HEAD(&source_list, rrs, rrs_entries);
+	RANDOM_HARVEST_UNLOCK();
 }
 
 void
@@ -587,29 +616,40 @@ random_source_deregister(struct random_source *rsource)
 
 	random_harvest_deregister_source(rsource->rs_source);
 
-	LIST_FOREACH(rrs, &source_list, rrs_entries)
+	RANDOM_HARVEST_LOCK();
+	CK_LIST_FOREACH(rrs, &source_list, rrs_entries)
 		if (rrs->rrs_source == rsource) {
-			LIST_REMOVE(rrs, rrs_entries);
+			CK_LIST_REMOVE(rrs, rrs_entries);
 			break;
 		}
-	if (rrs != NULL)
-		free(rrs, M_ENTROPY);
+	RANDOM_HARVEST_UNLOCK();
+
+	if (rrs != NULL && epoch_inited)
+		epoch_wait_preempt(rs_epoch);
+	free(rrs, M_ENTROPY);
 }
 
 static int
 random_source_handler(SYSCTL_HANDLER_ARGS)
 {
+	struct epoch_tracker et;
 	struct random_sources *rrs;
 	struct sbuf sbuf;
 	int error, count;
 
+	error = sysctl_wire_old_buffer(req, 0);
+	if (error != 0)
+		return (error);
+
 	sbuf_new_for_sysctl(&sbuf, NULL, 64, req);
 	count = 0;
-	LIST_FOREACH(rrs, &source_list, rrs_entries) {
+	epoch_enter_preempt(rs_epoch, &et);
+	CK_LIST_FOREACH(rrs, &source_list, rrs_entries) {
 		sbuf_cat(&sbuf, (count++ ? ",'" : "'"));
 		sbuf_cat(&sbuf, rrs->rrs_source->rs_ident);
 		sbuf_cat(&sbuf, "'");
 	}
+	epoch_exit_preempt(rs_epoch, &et);
 	error = sbuf_finish(&sbuf);
 	sbuf_delete(&sbuf);
 	return (error);