summaryrefslogtreecommitdiff
path: root/sys/dev/rnd.c
AgeCommit message (Collapse)Author
2013-11-02replace rc4 with ChaCha20 here, too; ok djm, tedu, deraadtMarkus Friedl
2013-10-30replace workq_add_task with the task api.David Gwynne
this guarantees the reliability of the arc4_reinit task being run by not relying on a pool to give us memory in an interrupt context. ok mpi@
2013-07-09Fix a pair of aesthetic nits in dev/rnd.c:Bret Lambert
fix language (feed -> fed) in a comment 16 -> MD5_DIGEST_LENGTH for legibility No change to resulting object file. ok djm@
2013-03-25reseed the random pool with 'dmesg' when more devices are attachedMarkus Friedl
from hshoexer@; ok tedu@, "looks good" deraadt@
2012-06-24Change arc4random_uniform() to calculate ``2**32 % upper_bound'' asMatthew Dempsky
``-upper_bound % upper_bound''. Simplifies the code and makes it the same on both ILP32 and LP64 architectures, and also slightly faster on LP64 architectures by using a 32-bit remainder instead of a 64-bit remainder. Pointed out by Jorden Verwer on tech@ ok deraadt; no objections from djm or otto
2011-07-06Add a new kqfilter for random which returns ARC4_MAIN_MAX_BYTES for readNicholas Marriott
and POOLBYTES for write. looks right to deraadt
2011-01-11bring back carrying over state from the previous RC4 instance whenDamien Miller
rekeying; ok deraadt@
2011-01-11all the bzeros in rnd are important, use explicit_bzeroTed Unangst
2011-01-10update the documentation regarding the *4 vs *6 decision for early RC4Theo de Raadt
stream discard. this continues to be under discussion... at least this moves the large-buffer transactions to using a *6 discard discussed at length with djm and kjell
2011-01-10move comment block regarding ARC4_MAIN_MAX_BYTESTheo de Raadt
2011-01-10randomread does its own rekeying now, so we don't need the large buf function.Ted Unangst
ok deraadt
2011-01-10OK, this is getting silly, but we might as well zero the entropy bufferTheo de Raadt
supplied by root (it can be large enough to overwhelm the entropy buffer, and we are doing a re-key almost immediately)
2011-01-10zero another intermediate key storage areaTheo de Raadt
2011-01-09be more careful with nanotime() calls in early entropy storage, sinceTheo de Raadt
at least sparc may not have the clock mapped (found by miod). while here, protect some more timeout_*() calls with timeout_initialized()
2011-01-08split randomattach into random_init() and random_start(), so that weTheo de Raadt
can make attempts to load 'entropy' into the RC4. ok miod ariane
2011-01-08spacesTheo de Raadt
2011-01-08switch back from PAGE_SIZE for the sake of sparcTheo de Raadt
2011-01-08destatic. ok deraadtTed Unangst
2011-01-07some minor improvements to rnd.Ted Unangst
1. only support pool words == 2048. 2. define the amount of key we use. 3. define the amount of rc4 we skip. 4. use arc4random_buf instead of reimplementing inline. 5. bzero some more "secrets". ok deraadt djm
2011-01-07substantial rewrite. put a very thin mutex at the entropy-collectionTheo de Raadt
side so that entropy events can come in from any kernel context. place a 2nd very thin mutex at the call-down path as well, so that any context can request random data. in the middle, meet with a bcopy that has no mutex, but copying unlocked data is actually a benefit. move the pool->MD5->RC4init sequence into a workq driven from a timeout, so that we can do all the heavy work without any mutex held or IPL; only grab the 2nd mutex to swap to a new RC4 state. (this workq design from tedu) ok dlg tedu
2011-01-07since randomwrite() also has no blocking operations at all, we need toTheo de Raadt
do a yield, otherwise an accidental cat by root into /dev/random kind of makes your machine hurt a lot.
2011-01-06For very large operations in randomread(), use a local rc4 instanceTheo de Raadt
much like arc4random_buf_large does, but without re-initializing it every 8K. ok tedu
2011-01-06make all /dev/*random nodes respond; in fact, don't even worry aboutTheo de Raadt
the minor number at all. The chances of an application ignoring the error on /dev/random are *greater* than the risk of an application getting bad data from it. ok dlg tedu kjell
2011-01-04in arc4_stir() only grab 64 bytes from the MD5 output. Grabbing moreTheo de Raadt
does not substantially increase the quality of the RC4 state. These days we may have lots more userland libc's initializing themselves, or lots of largebuf kernel calls which re-initialize their own RC4, and thus deplete the MD5 more than originally intended. discussed at length with tedu, djm, kjell and kettenis ok kettenis
2011-01-01Do not fold the MD5 in half. This might have made sense to someone whenTheo de Raadt
we were feeding the MD5 output direct to consumers, but now we only feed the RC4, so the effect is to throw away half of the stretched data. ok tedu djm, initial discussion started by kjell
2011-01-01comment cleanupTheo de Raadt
2010-12-31make randomattach do the parts of it's job in the right order, then moveTheo de Raadt
it to where it belongs
2010-12-31cleanup the ioctl functionTheo de Raadt
2010-12-31delete includes we do not needTheo de Raadt
2010-12-31further improvements describing what we are doingTheo de Raadt
2010-12-31all random nodes have been arc4-based for a while, so none of them everTheo de Raadt
block. the kq and poll code should have been replaced with "selltrue" type code a while ago. with and ok nicm
2010-12-30be more cynical about boot-time entropy, and fold time and entropy data in.Theo de Raadt
ok djm
2010-12-29knfTheo de Raadt
2010-12-29Since there is only one random_state, we can access it directly withoutTheo de Raadt
the rs-> song and dance. Exactly the same diff was written by djm.
2010-12-29arc4random_count is not used; other things inside rndstats do the accountingTheo de Raadt
2010-12-29the rnd_debug stuff was not usefulTheo de Raadt
2010-12-29kill RND_ARND_OLD, and decrease RND_NODEV to account for it; ok djmTheo de Raadt
2010-12-29Remove the get_random_bytes() API.Theo de Raadt
ok kjell djm
2010-12-29the random ioctl stuff is not very useful. I want to see all theTheo de Raadt
non-essential parts of rnd.c removed so that we can keep our eye on what the code should be doing. ok tedu who had a similar diff in the past
2010-12-24try to update the monster comment at the top of this file to explainTheo de Raadt
what it is we are doing ok djm
2010-12-22rewrite randomwrite() for clarity after discussion with mikebTheo de Raadt
ok djm
2010-11-21adding timer randomness in ioctl doesn't really help and looks suspicious.Ted Unangst
ok deraadt
2010-10-02remove support for srandom and urandom. direct everyone to arandom instead.Ted Unangst
we do this to prevent people from opening a device that sounds good, but doesn't have the properties they really need. ok deraadt
2010-04-20remove proc.h include from uvm_map.h. This has far reaching effects, asTed Unangst
sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
2009-11-09Every selwakeup() should have a matching KNOTE() (even if kqueue isn'tNicholas Marriott
supported it doesn't do any harm), so put the KNOTE() in selwakeup() itself and remove it from any occurences where both are used, except one for kqueue itself and one in sys_pipe.c (where the selwakeup is under a PIPE_SEL flag). Based on a diff from tedu. ok deraadt
2009-06-05Sanity check: we overrun the rnd_ed[] array if nbits is 32, but thatPhilip Guenthe
should be impossible given the multi-order delta logic ok deraadt@
2008-12-15remove i386-only inline assembler roll() function; gcc optimises theDamien Miller
equivalent C code into a rol instruction anyway (confirmed with objdump -d); "nuke it" weingart@
2008-11-24extra decl not needed; spotted by djmTheo de Raadt
2008-11-24allow entropy to be queued before randomattach() is calledTheo de Raadt
worked on with djm
2008-11-24Seed the random pool with the dmesg buffer at randomattach().Marco Pfatschbacher
This lets early arc4random() calls to return at least non-uniqe values on different machines. The dmesg will have different MAC addresses, etc. Also ignore the entropy count in arc4_stir, and just take what's there. sizeof(struct timeval) should be sizof(struct timespec) This was forgotten when we switched to nanotime. With help from mickey. OK djm@, deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-04 19:17:09 +0000