summaryrefslogtreecommitdiff
path: root/sys/dev/rnd.c
AgeCommit message (Collapse)Author
2020-05-25For large reads from /dev/random, use the arc4random_ctx_*() functionsChristian Weisgerber
instead of hand-rolling the same code to set up a temporary ChaCha instance. tweak/ok semarie@, ok deraadt@
2020-05-25Pass bootblock indicator RB_GOODRANDOM to random_start(). Future workTheo de Raadt
will frantically compensate. ok kettenis
2020-05-18During the rekey operation, we feedback 1 word to the lowest level.Theo de Raadt
But it was a constant, that is really silly. Pass back the first word from the middle layer. ok visa
2020-05-16entropy_add_ptr and entropy_input_rotate are only used insideTheo de Raadt
enqueue_randomness(), so make them local static instead of global.
2020-05-16be more consistant about with using sizeof(object) rather than the constantTheo de Raadt
defining the [size]
2020-05-15Describe the purpose of add_entropy_words() in simpler terms.Theo de Raadt
2020-05-15The description of the enqueue_randomness() input parameter was crazy untrue.Theo de Raadt
2020-05-15Explain enqueue_randomness() better. It is the supply-entropy function,Theo de Raadt
and change wording from 'entropy queue', what we have is a ring which collects 'damage' from successive calls until drawn down
2020-05-15The long explanation for CRC stirring isn't helping. If anythingTheo de Raadt
it suggests we should reconsider this mechanism and do something simpler... delete the explanation for now.
2020-05-15The main comment block from 1996 has become highly inaccurate andTheo de Raadt
misleading, so rewrite it. The interesting parts are bootblock-seeding from file + hwrng, arc4random() being available incredibly early, and seperate timeouts to pull entropy data forward into a stir of the chacha state (one for entropy ring crc whitening into a buffer, the 2nd for buffer folding into the chacha) Now that it is better documented, I can try to improve each component.
2020-05-15remove unneccessary include filesTheo de Raadt
2020-03-06Make sure 'ts' is initialized.tobhe
ok deraadt@
2020-03-02previous commit accidentally aliased two unique timeoutsTheo de Raadt
hit by millert
2020-03-01rename functions and types unrelated to the higher-level arc4 APITheo de Raadt
ok djm markus
2020-02-20Replace field f_isfd with field f_flags in struct filterops to allowVisa Hankala
adding more filter properties without cluttering the struct. OK mpi@, anton@
2019-12-31Use C99 designated initializers with struct filterops. In addition,Visa Hankala
make the structs const so that the data are put in .rodata. OK mpi@, deraadt@, anton@, bluhm@
2018-04-28replace add_*_randomness with enqueue_randomness()Jasper Lievisse Adriaanse
this gets rid of the source annotation which doesn't really add anything other than adding complexitiy. randomess is generally good enough that the few extra bits that the source type would add are not worth it. ok mikeb@ deraadt@
2018-02-09Situation occur where bootloader cannot supply kernel with earlyTheo de Raadt
random data. But a new source of entropy arrived a few months ago -- KARL generates highly disturbed images for some kernels (well, not for bsd.rd) This assumes the tail of text (just before etext[]) is readable. We are trying to use a portable symbol name, and also avoid reading a locore0 which has been unmapped... ok mortimer
2018-02-08Do not hardcode key length. Pointed out by jsing@mortimer
ok deraadt@
2018-02-08Use a temporary chacha instance to fill large randomdata sections. Avoidsmortimer
grabbing the rnglock repeatedly. ok deraadt@ djm@
2017-11-26Don't mention XOR as a mix-in function since addition is done since 1.180Mike Belopuhov
2017-11-19Remove interlocks between producers and consumers of randomness dataMike Belopuhov
A lot of randomness event producers are executed in the interrupt context increasing the time spent in the interrupt handler resulting in extra costs when adding randomness data to the pool. However, in practice randomness event producers require interlocking between each other, but not with with consumers due to the opportunistic nature of event consumers. To be able to take advantage of this idea, the ring buffer indexing is now done with two free running producer and consumer counters modulo power of 2 size of the ring buffer. With input from and OK visa, tb, jasper
2017-07-30clang (and newer gcc at high -O) are unaware that objects placed in strangeTheo de Raadt
sections, such as __attribute__((section(".openbsd.randomdata"))), may be non-zero. In combination with "const" or "static" the compiler becomes even more sure nothing can influence the object and assumes the value will be 0. A few optimizations later, a security requirement has been removed. Until a better annotation arrives in compilers, be warned: Do not mix const or static with these random objects, you won't get what you want. Spotted in a regression test by bluhm, long discussion with kettenis.
2017-03-15spelling and whitespaceTheo de Raadt
2016-12-08fix spelling errors and typos, from Michael W. BombardieriTheo de Raadt
2016-10-18when openbsd.randomdata was made readonly, the proto seed copy got doneTheo de Raadt
too late, leading to poor rng in the kernel early on. a behavioural artifact in vmm spotted the issue. ok tedu guenther mlarkin
2016-10-07another unused variable bites the dust. spotted by deraadtTed Unangst
2016-10-07the old time delta code is no longer used. nothing reads these values.Ted Unangst
remove it another relic of the superstitious past. ok deraadt millert mikeb
2016-09-23kern.arandom no longer existsTheo de Raadt
from rob pierce
2016-09-22Stop pushing version & cfdata into as entropy, since the contents areTheo de Raadt
known and we rely on the bootpath to prime us anyways. This also solves the issue raised by kettenis, of version potentially being non-word aligned ok kettenis djm
2016-09-04Rototil the _rs_clearseed() function once more such that we don't map pagesMark Kettenis
beyond the end of .text/.rodata. ok deraadt@
2016-09-03Since the initial entropy pool is 8192 bytes, we need three pages to createMark Kettenis
the alias mapping when clearing it, since there is no guarantee the pool is page aligned. ok deraadt@
2016-09-01openbsd.randomdata became RO in userland due to the RELRO work. We shouldTheo de Raadt
also do so in the kernel, which gains us RO ssp cookie, which will prevent spraying attacks. The random layer was openbsd.randomdata annotating working entropy/chacha buffers which in turn required them to be RW. To make that work again, so we need to copy RO seeds to RW working buffers, and later clear the RO seed buffers afterwards using a temporary RW mapping. help & ok kettenis, ok guenther
2016-07-15Remove unused re_nbits from dev/rnd.cTom Cosgrove
"another leftover of the bean counter" od tedu@ deraadt@
2016-05-23remove the sysctl kern.random counters, since none of the remainingTheo de Raadt
ones are capable of giving valuable works vs does-not-work evidence. ok tedu
2016-05-17Change the random event buffer from a queue to an endless ring. This wayTed Unangst
we don't drop any events when the queue is full. They are instead mixed into previous events. The mixing function selected is addition instead of xor to reduce the possibility that new values effectively erase existing ones. Convert some types to u_int to ensure defined overflow. ok deraadt djm
2016-02-19Right shift by an amount larger than width of type is undefined behavior.Stefan Kempf
Pointed out by Martin Natano, slightly tweaked by me. ok deraadt@
2016-01-08Use uiomove() instead of uiomovei().Stefan Kempf
Diff from Martin Natano, thanks! ok kettenis@, deraadt@
2015-12-28use ulmin when looking at uio_resid to prevent wrapping around.Ted Unangst
from Martin Natano (and also reported by Stefan Kempf)
2015-10-27Sync chacha_ivsetup to the version in ssh so that we couldMike Belopuhov
specify custom counter value when setting up Chacha context. ok reyk djm
2015-05-25missing word in comment; Kyle MilzTheo de Raadt
2015-05-04use the size of the buffer not the pointer in resume_randomness()Jonathan Gray
ok djm@ miod@ deraadt@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-17the rnd event ringbuf calculations aren't correct, which may result inTed Unangst
failure to fire the collection timeout. discovered by markus. the order of events here doesn't actually matter, so switch to a simple stack, which is easier to understand. ok markus
2015-02-10First step towards making uiomove() take a size_t size argument:Miod Vallat
- rename uiomove() to uiomovei() and update all its users. - introduce uiomove(), which is similar to uiomovei() but with a size_t. - rewrite uiomovei() as an uiomove() wrapper. ok kettenis@
2015-02-07New framework that allows hibernate to pass in entropy from it's freshTheo de Raadt
boot. ok mlarkin
2015-01-27remove the second void * argument on tasks.David Gwynne
when workqs were introduced, we provided a second argument so you could pass a thing and some context to work on it in. there were very few things that took advantage of the second argument, so when i introduced pools i suggested removing it. since tasks were meant to replace workqs, it was requested that we keep the second argument to make porting from workqs to tasks easier. now that workqs are gone, i had a look at the use of the second argument again and found only one good use of it (vdsp(4) on sparc64 if you're interested) and a tiny handful of questionable uses. the vast majority of tasks only used a single argument. i have since modified all tasks that used two args to only use one, so now we can remove the second argument. so this is a mechanical change. all tasks only passed NULL as their second argument, so we can just remove it. ok krw@
2014-12-23not necessary to zero hash context; the hash final functions all do that.Ted Unangst
2014-12-23tmp is a bad name for a shactxTed Unangst
2014-12-19rename buffer to digest, more clear. ok deraadtTed Unangst
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-11 13:19:08 +0000