summaryrefslogtreecommitdiff
path: root/sys/dev/rnd.c
AgeCommit message (Collapse)Author
2018-04-28replace add_*_randomness with enqueue_randomness()Jasper Lievisse Adriaanse
this gets rid of the source annotation which doesn't really add anything other than adding complexitiy. randomess is generally good enough that the few extra bits that the source type would add are not worth it. ok mikeb@ deraadt@
2018-02-09Situation occur where bootloader cannot supply kernel with earlyTheo de Raadt
random data. But a new source of entropy arrived a few months ago -- KARL generates highly disturbed images for some kernels (well, not for bsd.rd) This assumes the tail of text (just before etext[]) is readable. We are trying to use a portable symbol name, and also avoid reading a locore0 which has been unmapped... ok mortimer
2018-02-08Do not hardcode key length. Pointed out by jsing@mortimer
ok deraadt@
2018-02-08Use a temporary chacha instance to fill large randomdata sections. Avoidsmortimer
grabbing the rnglock repeatedly. ok deraadt@ djm@
2017-11-26Don't mention XOR as a mix-in function since addition is done since 1.180Mike Belopuhov
2017-11-19Remove interlocks between producers and consumers of randomness dataMike Belopuhov
A lot of randomness event producers are executed in the interrupt context increasing the time spent in the interrupt handler resulting in extra costs when adding randomness data to the pool. However, in practice randomness event producers require interlocking between each other, but not with with consumers due to the opportunistic nature of event consumers. To be able to take advantage of this idea, the ring buffer indexing is now done with two free running producer and consumer counters modulo power of 2 size of the ring buffer. With input from and OK visa, tb, jasper
2017-07-30clang (and newer gcc at high -O) are unaware that objects placed in strangeTheo de Raadt
sections, such as __attribute__((section(".openbsd.randomdata"))), may be non-zero. In combination with "const" or "static" the compiler becomes even more sure nothing can influence the object and assumes the value will be 0. A few optimizations later, a security requirement has been removed. Until a better annotation arrives in compilers, be warned: Do not mix const or static with these random objects, you won't get what you want. Spotted in a regression test by bluhm, long discussion with kettenis.
2017-03-15spelling and whitespaceTheo de Raadt
2016-12-08fix spelling errors and typos, from Michael W. BombardieriTheo de Raadt
2016-10-18when openbsd.randomdata was made readonly, the proto seed copy got doneTheo de Raadt
too late, leading to poor rng in the kernel early on. a behavioural artifact in vmm spotted the issue. ok tedu guenther mlarkin
2016-10-07another unused variable bites the dust. spotted by deraadtTed Unangst
2016-10-07the old time delta code is no longer used. nothing reads these values.Ted Unangst
remove it another relic of the superstitious past. ok deraadt millert mikeb
2016-09-23kern.arandom no longer existsTheo de Raadt
from rob pierce
2016-09-22Stop pushing version & cfdata into as entropy, since the contents areTheo de Raadt
known and we rely on the bootpath to prime us anyways. This also solves the issue raised by kettenis, of version potentially being non-word aligned ok kettenis djm
2016-09-04Rototil the _rs_clearseed() function once more such that we don't map pagesMark Kettenis
beyond the end of .text/.rodata. ok deraadt@
2016-09-03Since the initial entropy pool is 8192 bytes, we need three pages to createMark Kettenis
the alias mapping when clearing it, since there is no guarantee the pool is page aligned. ok deraadt@
2016-09-01openbsd.randomdata became RO in userland due to the RELRO work. We shouldTheo de Raadt
also do so in the kernel, which gains us RO ssp cookie, which will prevent spraying attacks. The random layer was openbsd.randomdata annotating working entropy/chacha buffers which in turn required them to be RW. To make that work again, so we need to copy RO seeds to RW working buffers, and later clear the RO seed buffers afterwards using a temporary RW mapping. help & ok kettenis, ok guenther
2016-07-15Remove unused re_nbits from dev/rnd.cTom Cosgrove
"another leftover of the bean counter" od tedu@ deraadt@
2016-05-23remove the sysctl kern.random counters, since none of the remainingTheo de Raadt
ones are capable of giving valuable works vs does-not-work evidence. ok tedu
2016-05-17Change the random event buffer from a queue to an endless ring. This wayTed Unangst
we don't drop any events when the queue is full. They are instead mixed into previous events. The mixing function selected is addition instead of xor to reduce the possibility that new values effectively erase existing ones. Convert some types to u_int to ensure defined overflow. ok deraadt djm
2016-02-19Right shift by an amount larger than width of type is undefined behavior.Stefan Kempf
Pointed out by Martin Natano, slightly tweaked by me. ok deraadt@
2016-01-08Use uiomove() instead of uiomovei().Stefan Kempf
Diff from Martin Natano, thanks! ok kettenis@, deraadt@
2015-12-28use ulmin when looking at uio_resid to prevent wrapping around.Ted Unangst
from Martin Natano (and also reported by Stefan Kempf)
2015-10-27Sync chacha_ivsetup to the version in ssh so that we couldMike Belopuhov
specify custom counter value when setting up Chacha context. ok reyk djm
2015-05-25missing word in comment; Kyle MilzTheo de Raadt
2015-05-04use the size of the buffer not the pointer in resume_randomness()Jonathan Gray
ok djm@ miod@ deraadt@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-17the rnd event ringbuf calculations aren't correct, which may result inTed Unangst
failure to fire the collection timeout. discovered by markus. the order of events here doesn't actually matter, so switch to a simple stack, which is easier to understand. ok markus
2015-02-10First step towards making uiomove() take a size_t size argument:Miod Vallat
- rename uiomove() to uiomovei() and update all its users. - introduce uiomove(), which is similar to uiomovei() but with a size_t. - rewrite uiomovei() as an uiomove() wrapper. ok kettenis@
2015-02-07New framework that allows hibernate to pass in entropy from it's freshTheo de Raadt
boot. ok mlarkin
2015-01-27remove the second void * argument on tasks.David Gwynne
when workqs were introduced, we provided a second argument so you could pass a thing and some context to work on it in. there were very few things that took advantage of the second argument, so when i introduced pools i suggested removing it. since tasks were meant to replace workqs, it was requested that we keep the second argument to make porting from workqs to tasks easier. now that workqs are gone, i had a look at the use of the second argument again and found only one good use of it (vdsp(4) on sparc64 if you're interested) and a tiny handful of questionable uses. the vast majority of tasks only used a single argument. i have since modified all tasks that used two args to only use one, so now we can remove the second argument. so this is a mechanical change. all tasks only passed NULL as their second argument, so we can just remove it. ok krw@
2014-12-23not necessary to zero hash context; the hash final functions all do that.Ted Unangst
2014-12-23tmp is a bad name for a shactxTed Unangst
2014-12-19rename buffer to digest, more clear. ok deraadtTed Unangst
2014-12-19sha512 produces enough output, we can simplify extraction by not looping.Ted Unangst
ok deraadt djm
2014-12-18Create a suspend/resume infrastructure for the RNG. At suspend time,Theo de Raadt
process all queued entropy and create a brand new pool to prevent backtracking upon resume. At resume time, process the entropy queue (since other resume code paths which run earlier can enqueue entropy) and force all higher to reseed. ok reyk djm
2014-10-24obvious sizes for freeTed Unangst
2014-10-20typo; deraadtTed Unangst
2014-10-20use SHA512 to hash entropy instead of MD5Ted Unangst
2014-09-15update comments to reflect chacha20. from Max FillingerTed Unangst
2014-07-17zero entropy bufTed Unangst
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-06-14Change return value of getentropy() to int 0 for success. MaximumTheo de Raadt
buffersize is enforced strictly, this supplies sufficient entropy payload to act as seed material. Discourage general use of this API, but lock down this function name as the go-to for userland PRNG seeding. Improve documentation. ok miod matthew
2014-06-13Add new getentropy() system call. Code and pressure from matthew.Theo de Raadt
I accepted that he's right (again) to seperate this out from heavy sysctl API and this will simply a variety of things. Functionname is not used by anyone in the ports tree, so we guess we can use it. Shocking that no application has a function called this. ok matthew & others who pushed him to start this early on
2014-02-05tiny style adjustmentsTed Unangst
2014-01-22Emit a warning if no entropy was supplied by the boot loader.Joel Sing
ok deraadt@
2014-01-19Refactor rnd startup so arc4random/arc4random_buf can create a chacha stateTheo de Raadt
on first call, very early on, from boot-supplied entropy, then feed from that. Later when we have more subsystems ready, the main() can properly initialize the entropy-driven model. Lots of discussion with mikeb. ok kettenis markus mikeb
2014-01-19With the earlier initialization of the random subsystem, random_hostseed()Theo de Raadt
is no longer providing significant value. The random subsystem is in pretty good state, and moments later userland will feed the dmesg. ok jsing
2014-01-19In random_start() we can assume the msg buffer is mapped, all systems doTheo de Raadt
it at startup, or in cpu_startup(). Improve comments to explain what is happening here. ok kettenis jsing
2013-12-28Put the entropy_pool[] into the ELF .openbsd.randomdata segment.Theo de Raadt
Also allow random_init() to be called later, by moving a few entropy control initializions into the lower-level _rs_seed() layer. tested by jsing, phessler and a few others
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 11:31:41 +0000