[libcxx] Use Fuchsia-native CPRNG for std::random_device

[mcgrathr]

Summary

Use the zx_cprng_draw system call directly rather than going
through the libc getentropy function. The libc function is a
trivial wrapper around the system call, and is not a standard C
function. Avoiding it reduces the Fuchsia libc ABI surface that
libc++ depends on.

[ldionne]

libcxx/src/random.cpp

188

This pragma is magic. It leaves a breadcrumb in the .o and the linker will pick it up automatically?

On what platforms does this work?

[mcgrathr]

libcxx/src/random.cpp

188

Correct. The pragma syntax comes from MSVC and works there and in Clang on PE-COFF and ELF formats. The ELF linker magic it uses is only supported by lld last I checked (it emits an extra non-allocated section that other linkers would just ignore). For Fuchsia, we are fine assuming that current Clang and LLD are the only tools used.

[ldionne]

libcxx/src/random.cpp

188

This is pretty awesome, we could use that for mach-o as well.

[phosek]

LGTM

libcxx/src/random.cpp

188

We already use it elsewhere in libc++, for example https://github.com/llvm/llvm-project/blob/3064dd8ccffc561e0f01cfa930b9a481d90e7f4f/libcxx/src/chrono.cpp#L52, https://github.com/llvm/llvm-project/blob/3064dd8ccffc561e0f01cfa930b9a481d90e7f4f/libcxx/src/thread.cpp#L31 or https://github.com/llvm/llvm-project/blob/3064dd8ccffc561e0f01cfa930b9a481d90e7f4f/libcxx/include/__config#L1375.

libcxx/include/__config

 //      When this option is used, the token passed to `std::random_device`'s
 //      constructor *must* be "/dev/urandom" -- anything else is an error.
 //
 // _LIBCPP_USING_GETENTROPY
 //      Use getentropy().
 //      When this option is used, the token passed to `std::random_device`'s
 //      constructor *must* be "/dev/urandom" -- anything else is an error.
 //
+// _LIBCPP_USING_FUCHSIA_CPRNG
+//      Use Fuchsia's zx_cprng_draw() system call, which is specified to
+//      deliver high-quality entropy and cannot fail.
+//      When this option is used, the token passed to `std::random_device`'s
+//      constructor *must* be "/dev/urandom" -- anything else is an error.
+//
 // _LIBCPP_USING_NACL_RANDOM
 //      NaCl's sandbox (which PNaCl also runs in) doesn't allow filesystem access,
 //      including accesses to the special files under `/dev`. This implementation
 //      uses the NaCL syscall `nacl_secure_random_init()` to get entropy.
 //      When this option is used, the token passed to `std::random_device`'s
 //      constructor *must* be "/dev/urandom" -- anything else is an error.
 //
 // _LIBCPP_USING_WIN32_RANDOM
 //      Use rand_s(), for use on Windows.
 //      When this option is used, the token passed to `std::random_device`'s
 //      constructor *must* be "/dev/urandom" -- anything else is an error.
 #if defined(__OpenBSD__)
 #  define _LIBCPP_USING_ARC4_RANDOM
-#elif defined(__Fuchsia__) || defined(__wasi__)
+#elif defined(__wasi__)
 #  define _LIBCPP_USING_GETENTROPY
+#elif defined(__Fuchsia__)
+#  define _LIBCPP_USING_FUCHSIA_CPRNG
 #elif defined(__native_client__)
 #  define _LIBCPP_USING_NACL_RANDOM
 #elif defined(_LIBCPP_WIN32API)
 #  define _LIBCPP_USING_WIN32_RANDOM
 #else
 #  define _LIBCPP_USING_DEV_RANDOM
 #endif
 

libcxx/src/random.cpp

 #   include <fcntl.h>
 #   include <unistd.h>
 #   if __has_include(<sys/ioctl.h>) && __has_include(<linux/random.h>)
 #       include <sys/ioctl.h>
 #       include <linux/random.h>
 #   endif
 #elif defined(_LIBCPP_USING_NACL_RANDOM)
 #   include <nacl/nacl_random.h>
+#elif defined(_LIBCPP_USING_FUCHSIA_CPRNG)
+#  include <zircon/syscalls.h>
 #endif
 
 
 _LIBCPP_BEGIN_NAMESPACE_STD
 
 #if defined(_LIBCPP_USING_GETENTROPY)
 
 random_device::random_device(const string& __token)

 {
     unsigned r;
     errno_t err = rand_s(&r);
     if (err)
         __throw_system_error(err, "random_device rand_s failed.");
     return r;
 }
 
+#elif defined(_LIBCPP_USING_FUCHSIA_CPRNG)
+
+random_device::random_device(const string& __token) {
+  if (__token != "/dev/urandom")
+    __throw_system_error(ENOENT, ("random device not supported " + __token).c_str());
+}
+
+random_device::~random_device() {}
+
+unsigned random_device::operator()() {
+  // Implicitly link against the vDSO system call ABI without
+  // requiring the final link to specify -lzircon explicitly when
+  // statically linking libc++.
+#  pragma comment(lib, "zircon")
+
+  // The system call cannot fail.  It returns only when the bits are ready.
+  unsigned r;
+  _zx_cprng_draw(&r, sizeof(r));
+  return r;
+}
+
 #else
 #error "Random device not implemented for this architecture"
 #endif
 
 double
 random_device::entropy() const noexcept
 {
 #if defined(_LIBCPP_USING_DEV_RANDOM) && defined(RNDGETENTCNT)
   int ent;
   if (::ioctl(__f_, RNDGETENTCNT, &ent) < 0)
     return 0;
 
   if (ent < 0)
     return 0;
 
   if (ent > std::numeric_limits<result_type>::digits)
     return std::numeric_limits<result_type>::digits;
 
   return ent;
-#elif defined(__OpenBSD__)
+#elif defined(__OpenBSD__) || defined(_LIBCPP_USING_FUCHSIA_CPRNG)
   return std::numeric_limits<result_type>::digits;
 #else
   return 0;
 #endif
 }
 
 _LIBCPP_END_NAMESPACE_STD