summaryrefslogtreecommitdiff
path: root/sys/dev/rnd.c
AgeCommit message (Collapse)Author
2021-03-06ansiJonathan Gray
2020-06-15slight copyright update regarding recent workTheo de Raadt
2020-05-31introduce "cpu_rnd_messybits" for use instead of nanotime in dev/rnd.c.David Gwynne
rnd.c uses nanotime to get access to some bits that change quickly between events that it can mix into the entropy pool. it doesn't use nanotime to get a monotonically increasing set or ordered and accurate timestamps, it just wants something with bits that change. there's been discussions for years about letting rnd use a clock that's super fast to read, but not necessarily accurate, but it wasn't until recently that i figured out it wasn't interested in time at all, so things like keeping a fast clock coherent between cpu cores or correct according to ntp is unecessary. this means we can just let rnd read the cycle counters on cpus and things will be fine. cpus with cycle counters that vary in their speed and arent kept consistent between cores may even be desirable in this context. so this is the first step in converting rnd.c to reading cycle counter. it copies the nanotime backend to each arch, and they can replace it with something MD as a second step later on. djm@ suggested rnd_messybytes, but we landed on cpu_rnd_messybits. thanks to visa for his eyes. ok deraadt@ visa@ deraadt@ says he will help handle any MD fallout that occurs.
2020-05-29dev/rndvar.h no longer has statistical interfaces (removed during variousTheo de Raadt
conversion steps). it only contains kernel prototypes for 4 interfaces, all of which legitimately belong in sys/systm.h, which are already included by all enqueue_randomness() users.
2020-05-293 includes not neededTheo de Raadt
2020-05-27Update comment block at the top to describe (a) the ring damage logic,Theo de Raadt
and (b) the boot-time acceleration.
2020-05-26Rewrite the entropy enqueue ring to collect damage asyncronously, and adapt theTheo de Raadt
dequeue to mix a selection of "best" ring entries. Change the dequeue timeout to exponentially backoff because excessive pool buffer generation is pointless -- rekey's generally happen at 1.6MB and a long timeout, a lot of cpu cycles were being wasted. During boot-up (before timeouts work) aggressively consume enqueue damage and rekey every time, to accelerate entropy injection into the chacha ring. The goal is to compensate rapidly for weak seeding in unidentifiable conditions, and ensure quality to arc4random() calls early in boot. ok kettenis visa
2020-05-25For large reads from /dev/random, use the arc4random_ctx_*() functionsChristian Weisgerber
instead of hand-rolling the same code to set up a temporary ChaCha instance. tweak/ok semarie@, ok deraadt@
2020-05-25Pass bootblock indicator RB_GOODRANDOM to random_start(). Future workTheo de Raadt
will frantically compensate. ok kettenis
2020-05-18During the rekey operation, we feedback 1 word to the lowest level.Theo de Raadt
But it was a constant, that is really silly. Pass back the first word from the middle layer. ok visa
2020-05-16entropy_add_ptr and entropy_input_rotate are only used insideTheo de Raadt
enqueue_randomness(), so make them local static instead of global.
2020-05-16be more consistant about with using sizeof(object) rather than the constantTheo de Raadt
defining the [size]
2020-05-15Describe the purpose of add_entropy_words() in simpler terms.Theo de Raadt
2020-05-15The description of the enqueue_randomness() input parameter was crazy untrue.Theo de Raadt
2020-05-15Explain enqueue_randomness() better. It is the supply-entropy function,Theo de Raadt
and change wording from 'entropy queue', what we have is a ring which collects 'damage' from successive calls until drawn down
2020-05-15The long explanation for CRC stirring isn't helping. If anythingTheo de Raadt
it suggests we should reconsider this mechanism and do something simpler... delete the explanation for now.
2020-05-15The main comment block from 1996 has become highly inaccurate andTheo de Raadt
misleading, so rewrite it. The interesting parts are bootblock-seeding from file + hwrng, arc4random() being available incredibly early, and seperate timeouts to pull entropy data forward into a stir of the chacha state (one for entropy ring crc whitening into a buffer, the 2nd for buffer folding into the chacha) Now that it is better documented, I can try to improve each component.
2020-05-15remove unneccessary include filesTheo de Raadt
2020-03-06Make sure 'ts' is initialized.tobhe
ok deraadt@
2020-03-02previous commit accidentally aliased two unique timeoutsTheo de Raadt
hit by millert
2020-03-01rename functions and types unrelated to the higher-level arc4 APITheo de Raadt
ok djm markus
2020-02-20Replace field f_isfd with field f_flags in struct filterops to allowVisa Hankala
adding more filter properties without cluttering the struct. OK mpi@, anton@
2019-12-31Use C99 designated initializers with struct filterops. In addition,Visa Hankala
make the structs const so that the data are put in .rodata. OK mpi@, deraadt@, anton@, bluhm@
2018-04-28replace add_*_randomness with enqueue_randomness()Jasper Lievisse Adriaanse
this gets rid of the source annotation which doesn't really add anything other than adding complexitiy. randomess is generally good enough that the few extra bits that the source type would add are not worth it. ok mikeb@ deraadt@
2018-02-09Situation occur where bootloader cannot supply kernel with earlyTheo de Raadt
random data. But a new source of entropy arrived a few months ago -- KARL generates highly disturbed images for some kernels (well, not for bsd.rd) This assumes the tail of text (just before etext[]) is readable. We are trying to use a portable symbol name, and also avoid reading a locore0 which has been unmapped... ok mortimer
2018-02-08Do not hardcode key length. Pointed out by jsing@mortimer
ok deraadt@
2018-02-08Use a temporary chacha instance to fill large randomdata sections. Avoidsmortimer
grabbing the rnglock repeatedly. ok deraadt@ djm@
2017-11-26Don't mention XOR as a mix-in function since addition is done since 1.180Mike Belopuhov
2017-11-19Remove interlocks between producers and consumers of randomness dataMike Belopuhov
A lot of randomness event producers are executed in the interrupt context increasing the time spent in the interrupt handler resulting in extra costs when adding randomness data to the pool. However, in practice randomness event producers require interlocking between each other, but not with with consumers due to the opportunistic nature of event consumers. To be able to take advantage of this idea, the ring buffer indexing is now done with two free running producer and consumer counters modulo power of 2 size of the ring buffer. With input from and OK visa, tb, jasper
2017-07-30clang (and newer gcc at high -O) are unaware that objects placed in strangeTheo de Raadt
sections, such as __attribute__((section(".openbsd.randomdata"))), may be non-zero. In combination with "const" or "static" the compiler becomes even more sure nothing can influence the object and assumes the value will be 0. A few optimizations later, a security requirement has been removed. Until a better annotation arrives in compilers, be warned: Do not mix const or static with these random objects, you won't get what you want. Spotted in a regression test by bluhm, long discussion with kettenis.
2017-03-15spelling and whitespaceTheo de Raadt
2016-12-08fix spelling errors and typos, from Michael W. BombardieriTheo de Raadt
2016-10-18when openbsd.randomdata was made readonly, the proto seed copy got doneTheo de Raadt
too late, leading to poor rng in the kernel early on. a behavioural artifact in vmm spotted the issue. ok tedu guenther mlarkin
2016-10-07another unused variable bites the dust. spotted by deraadtTed Unangst
2016-10-07the old time delta code is no longer used. nothing reads these values.Ted Unangst
remove it another relic of the superstitious past. ok deraadt millert mikeb
2016-09-23kern.arandom no longer existsTheo de Raadt
from rob pierce
2016-09-22Stop pushing version & cfdata into as entropy, since the contents areTheo de Raadt
known and we rely on the bootpath to prime us anyways. This also solves the issue raised by kettenis, of version potentially being non-word aligned ok kettenis djm
2016-09-04Rototil the _rs_clearseed() function once more such that we don't map pagesMark Kettenis
beyond the end of .text/.rodata. ok deraadt@
2016-09-03Since the initial entropy pool is 8192 bytes, we need three pages to createMark Kettenis
the alias mapping when clearing it, since there is no guarantee the pool is page aligned. ok deraadt@
2016-09-01openbsd.randomdata became RO in userland due to the RELRO work. We shouldTheo de Raadt
also do so in the kernel, which gains us RO ssp cookie, which will prevent spraying attacks. The random layer was openbsd.randomdata annotating working entropy/chacha buffers which in turn required them to be RW. To make that work again, so we need to copy RO seeds to RW working buffers, and later clear the RO seed buffers afterwards using a temporary RW mapping. help & ok kettenis, ok guenther
2016-07-15Remove unused re_nbits from dev/rnd.cTom Cosgrove
"another leftover of the bean counter" od tedu@ deraadt@
2016-05-23remove the sysctl kern.random counters, since none of the remainingTheo de Raadt
ones are capable of giving valuable works vs does-not-work evidence. ok tedu
2016-05-17Change the random event buffer from a queue to an endless ring. This wayTed Unangst
we don't drop any events when the queue is full. They are instead mixed into previous events. The mixing function selected is addition instead of xor to reduce the possibility that new values effectively erase existing ones. Convert some types to u_int to ensure defined overflow. ok deraadt djm
2016-02-19Right shift by an amount larger than width of type is undefined behavior.Stefan Kempf
Pointed out by Martin Natano, slightly tweaked by me. ok deraadt@
2016-01-08Use uiomove() instead of uiomovei().Stefan Kempf
Diff from Martin Natano, thanks! ok kettenis@, deraadt@
2015-12-28use ulmin when looking at uio_resid to prevent wrapping around.Ted Unangst
from Martin Natano (and also reported by Stefan Kempf)
2015-10-27Sync chacha_ivsetup to the version in ssh so that we couldMike Belopuhov
specify custom counter value when setting up Chacha context. ok reyk djm
2015-05-25missing word in comment; Kyle MilzTheo de Raadt
2015-05-04use the size of the buffer not the pointer in resume_randomness()Jonathan Gray
ok djm@ miod@ deraadt@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-16 19:08:44 +0000