Make sure 'ts' is initialized.

ok deraadt@

previous commit accidentally aliased two unique timeouts
hit by millert

rename functions and types unrelated to the higher-level arc4 API
ok djm markus

Replace field f_isfd with field f_flags in struct filterops to allow
adding more filter properties without cluttering the struct.

OK mpi@, anton@

Use C99 designated initializers with struct filterops. In addition,
make the structs const so that the data are put in .rodata.

OK mpi@, deraadt@, anton@, bluhm@

replace add_*_randomness with enqueue_randomness()

this gets rid of the source annotation which doesn't really add
anything other than adding complexitiy. randomess is generally
good enough that the

replace add_*_randomness with enqueue_randomness()

this gets rid of the source annotation which doesn't really add
anything other than adding complexitiy. randomess is generally
good enough that the few extra bits that the source type would
add are not worth it.

ok mikeb@ deraadt@

show more ...

Situation occur where bootloader cannot supply kernel with early
random data. But a new source of entropy arrived a few months ago
-- KARL generates highly disturbed images for some kernels (well,
no

Situation occur where bootloader cannot supply kernel with early
random data. But a new source of entropy arrived a few months ago
-- KARL generates highly disturbed images for some kernels (well,
not for bsd.rd)
This assumes the tail of text (just before etext[]) is readable.
We are trying to use a portable symbol name, and also avoid reading
a locore0 which has been unmapped...
ok mortimer

show more ...

Do not hardcode key length. Pointed out by jsing@

ok deraadt@

Use a temporary chacha instance to fill large randomdata sections. Avoids
grabbing the rnglock repeatedly.

ok deraadt@ djm@

Don't mention XOR as a mix-in function since addition is done since 1.180

Remove interlocks between producers and consumers of randomness data

A lot of randomness event producers are executed in the interrupt
context increasing the time spent in the interrupt handler resu

Remove interlocks between producers and consumers of randomness data

A lot of randomness event producers are executed in the interrupt
context increasing the time spent in the interrupt handler resulting
in extra costs when adding randomness data to the pool. However, in
practice randomness event producers require interlocking between each
other, but not with with consumers due to the opportunistic nature of
event consumers.

To be able to take advantage of this idea, the ring buffer indexing
is now done with two free running producer and consumer counters modulo
power of 2 size of the ring buffer.

With input from and OK visa, tb, jasper

show more ...

clang (and newer gcc at high -O) are unaware that objects placed in strange
sections, such as __attribute__((section(".openbsd.randomdata"))), may be
non-zero. In combination with "const" or "static

clang (and newer gcc at high -O) are unaware that objects placed in strange
sections, such as __attribute__((section(".openbsd.randomdata"))), may be
non-zero. In combination with "const" or "static" the compiler becomes even
more sure nothing can influence the object and assumes the value will be 0.
A few optimizations later, a security requirement has been removed.

Until a better annotation arrives in compilers, be warned: Do not mix
const or static with these random objects, you won't get what you want.
Spotted in a regression test by bluhm, long discussion with kettenis.

show more ...

spelling and whitespace

fix spelling errors and typos, from Michael W. Bombardieri

when openbsd.randomdata was made readonly, the proto seed copy got done
too late, leading to poor rng in the kernel early on. a behavioural
artifact in vmm spotted the issue.
ok tedu guenther mlarkin

another unused variable bites the dust. spotted by deraadt

the old time delta code is no longer used. nothing reads these values.
remove it another relic of the superstitious past.
ok deraadt millert mikeb

kern.arandom no longer exists
from rob pierce

Stop pushing version & cfdata into as entropy, since the contents are
known and we rely on the bootpath to prime us anyways.
This also solves the issue raised by kettenis, of version potentially
bein

Stop pushing version & cfdata into as entropy, since the contents are
known and we rely on the bootpath to prime us anyways.
This also solves the issue raised by kettenis, of version potentially
being non-word aligned
ok kettenis djm

show more ...

Rototil the _rs_clearseed() function once more such that we don't map pages
beyond the end of .text/.rodata.

ok deraadt@

Since the initial entropy pool is 8192 bytes, we need three pages to create
the alias mapping when clearing it, since there is no guarantee the pool is
page aligned.

ok deraadt@

openbsd.randomdata became RO in userland due to the RELRO work. We should
also do so in the kernel, which gains us RO ssp cookie, which will prevent
spraying attacks.

The random layer was openbsd.r

openbsd.randomdata became RO in userland due to the RELRO work. We should
also do so in the kernel, which gains us RO ssp cookie, which will prevent
spraying attacks.

The random layer was openbsd.randomdata annotating working entropy/chacha
buffers which in turn required them to be RW. To make that work again,
so we need to copy RO seeds to RW working buffers, and later clear the
RO seed buffers afterwards using a temporary RW mapping.

help & ok kettenis, ok guenther

show more ...

Remove unused re_nbits from dev/rnd.c

"another leftover of the bean counter"

od tedu@ deraadt@

remove the sysctl kern.random counters, since none of the remaining
ones are capable of giving valuable works vs does-not-work evidence.
ok tedu

Change the random event buffer from a queue to an endless ring. This way
we don't drop any events when the queue is full. They are instead mixed
into previous events.
The mixing function selected is

Change the random event buffer from a queue to an endless ring. This way
we don't drop any events when the queue is full. They are instead mixed
into previous events.
The mixing function selected is addition instead of xor to reduce the
possibility that new values effectively erase existing ones.
Convert some types to u_int to ensure defined overflow.
ok deraadt djm

show more ...