1 /* 2 * Copyright (c) 2004-2014 The DragonFly Project. All rights reserved. 3 * 4 * This code is derived from software contributed to The DragonFly Project 5 * by Matthew Dillon <dillon@backplane.com> 6 * by Alex Hornung <alex@alexhornung.com> 7 * by Robin J Carey 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions, and the following disclaimer, 14 * without modification, immediately at the beginning of the file. 15 * 2. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 */ 30 /* --- NOTES --- 31 * 32 * Note: The word "entropy" is often incorrectly used to describe 33 * random data. The word "entropy" originates from the science of 34 * Physics. The correct descriptive definition would be something 35 * along the lines of "seed", "unpredictable numbers" or 36 * "unpredictable data". 37 * 38 * Note: Some /dev/[u]random implementations save "seed" between 39 * boots which represents a security hazard since an adversary 40 * could acquire this data (since it is stored in a file). If 41 * the unpredictable data used in the above routines is only 42 * generated during Kernel operation, then an adversary can only 43 * acquire that data through a Kernel security compromise and/or 44 * a cryptographic algorithm failure/cryptanalysis. 45 * 46 * Note: On FreeBSD-4.11, interrupts have to be manually enabled 47 * using the rndcontrol(8) command. 48 * 49 * --- DESIGN (FreeBSD-4.11 based) --- 50 * 51 * The rnddev module automatically initializes itself the first time 52 * it is used (client calls any public rnddev_*() interface routine). 53 * Both CSPRNGs are initially seeded from the precise nano[up]time() routines. 54 * Tests show this method produces good enough results, suitable for intended 55 * use. It is necessary for both CSPRNGs to be completely seeded, initially. 56 * 57 * After initialization and during Kernel operation the only suitable 58 * unpredictable data available is: 59 * 60 * (1) Keyboard scan-codes. 61 * (2) Nanouptime acquired by a Keyboard/Read-Event. 62 * (3) Suitable interrupt source; hard-disk/ATA-device. 63 * 64 * (X) Mouse-event (xyz-data unsuitable); NOT IMPLEMENTED. 65 * 66 * This data is added to both CSPRNGs in real-time as it happens/ 67 * becomes-available. Additionally, unpredictable (?) data may be 68 * acquired from a true-random number generator if such a device is 69 * available to the system (not advisable !). 70 * Nanouptime() acquired by a Read-Event is a very important aspect of 71 * this design, since it ensures that unpredictable data is added to 72 * the CSPRNGs even if there are no other sources. 73 * The nanouptime() Kernel routine is used since time relative to 74 * boot is less adversary-known than time itself. 75 * 76 * This design has been thoroughly tested with debug logging 77 * and the output from both /dev/random and /dev/urandom has 78 * been tested with the DIEHARD test-suite; both pass. 79 * 80 * MODIFICATIONS MADE TO ORIGINAL "kern_random.c": 81 * 82 * 6th July 2005: 83 * 84 * o Changed ReadSeed() function to schedule future read-seed-events 85 * by at least one second. Previous implementation used a randomised 86 * scheduling { 0, 1, 2, 3 seconds }. 87 * o Changed SEED_NANOUP() function to use a "previous" accumulator 88 * algorithm similar to ReadSeed(). This ensures that there is no 89 * way that an adversary can tell what number is being added to the 90 * CSPRNGs, since the number added to the CSPRNGs at Event-Time is 91 * the sum of nanouptime()@Event and an unknown/secret number. 92 * o Changed rnddev_add_interrupt() function to schedule future 93 * interrupt-events by at least one second. Previous implementation 94 * had no scheduling algorithm which allowed an "interrupt storm" 95 * to occur resulting in skewed data entering into the CSPRNGs. 96 * 97 * 98 * 9th July 2005: 99 * 100 * o Some small cleanups and change all internal functions to be 101 * static/private. 102 * o Removed ReadSeed() since its functionality is already performed 103 * by another function { rnddev_add_interrupt_OR_read() } and remove 104 * the silly rndByte accumulator/feedback-thing (since multipying by 105 * rndByte could yield a value of 0). 106 * o Made IBAA/L14 public interface become static/private; 107 * Local to this file (not changed to that in the original C modules). 108 * 109 * 16th July 2005: 110 * 111 * o SEED_NANOUP() -> NANOUP_EVENT() function rename. 112 * o Make NANOUP_EVENT() handle the time-buffering directly so that all 113 * time-stamp-events use this single time-buffer (including keyboard). 114 * This removes dependancy on "time_second" Kernel variable. 115 * o Removed second-time-buffer code in rnddev_add_interrupt_OR_read (void). 116 * o Rewrote the time-buffering algorithm in NANOUP_EVENT() to use a 117 * randomised time-delay range. 118 * 119 * 12th Dec 2005: 120 * 121 * o Updated to (hopefully final) L15 algorithm. 122 * 123 * 12th June 2006: 124 * 125 * o Added missing (u_char *) cast in RnddevRead() function. 126 * o Changed copyright to 3-clause BSD license and cleaned up the layout 127 * of this file. 128 * 129 * For a proper changelog, refer to the version control history of this 130 * file. 131 */ 132 133 #include <sys/types.h> 134 #include <sys/kernel.h> 135 #include <sys/systm.h> 136 #include <sys/poll.h> 137 #include <sys/event.h> 138 #include <sys/random.h> 139 #include <sys/systimer.h> 140 #include <sys/time.h> 141 #include <sys/proc.h> 142 #include <sys/lock.h> 143 #include <sys/sysctl.h> 144 #include <sys/spinlock.h> 145 #include <sys/csprng.h> 146 #include <machine/atomic.h> 147 #include <machine/clock.h> 148 149 #include <sys/thread2.h> 150 #include <sys/spinlock2.h> 151 #include <sys/mplock2.h> 152 153 154 struct csprng_state csprng_state; 155 156 /* 157 * Portability note: The u_char/unsigned char type is used where 158 * uint8_t from <stdint.h> or u_int8_t from <sys/types.h> should really 159 * be being used. On FreeBSD, it is safe to make the assumption that these 160 * different types are equivalent (on all architectures). 161 * The FreeBSD <sys/crypto/rc4> module also makes this assumption. 162 */ 163 164 /*------------------------------ IBAA ----------------------------------*/ 165 166 /*-------------------------- IBAA CSPRNG -------------------------------*/ 167 168 /* 169 * NOTE: The original source code from which this source code (IBAA) 170 * was taken has no copyright/license. The algorithm has no patent 171 * and is freely/publicly available from: 172 * 173 * http://www.burtleburtle.net/bob/rand/isaac.html 174 */ 175 176 /* 177 * ^ means XOR, & means bitwise AND, a<<b means shift a by b. 178 * barrel(a) shifts a 19 bits to the left, and bits wrap around 179 * ind(x) is (x AND 255), or (x mod 256) 180 */ 181 typedef u_int32_t u4; /* unsigned four bytes, 32 bits */ 182 183 #define ALPHA (8) 184 #define SIZE (1 << ALPHA) 185 #define MASK (SIZE - 1) 186 #define ind(x) ((x) & (SIZE - 1)) 187 #define barrel(a) (((a) << 20) ^ ((a) >> 12)) /* beta=32,shift=20 */ 188 189 static void IBAA 190 ( 191 u4 *m, /* Memory: array of SIZE ALPHA-bit terms */ 192 u4 *r, /* Results: the sequence, same size as m */ 193 u4 *aa, /* Accumulator: a single value */ 194 u4 *bb, /* the previous result */ 195 u4 *counter /* counter */ 196 ) 197 { 198 u4 a, b, x, y, i; 199 200 a = *aa; 201 b = *bb + *counter; 202 ++*counter; 203 for (i = 0; i < SIZE; ++i) { 204 x = m[i]; 205 a = barrel(a) + m[ind(i + (SIZE / 2))]; /* set a */ 206 m[i] = y = m[ind(x)] + a + b; /* set m */ 207 r[i] = b = m[ind(y >> ALPHA)] + x; /* set r */ 208 } 209 *bb = b; *aa = a; 210 } 211 212 /*-------------------------- IBAA CSPRNG -------------------------------*/ 213 214 215 static u4 IBAA_memory[SIZE]; 216 static u4 IBAA_results[SIZE]; 217 static u4 IBAA_aa; 218 static u4 IBAA_bb; 219 static u4 IBAA_counter; 220 221 static volatile int IBAA_byte_index; 222 223 224 static void IBAA_Init(void); 225 static void IBAA_Call(void); 226 static void IBAA_Seed(const u_int32_t val); 227 static u_char IBAA_Byte(void); 228 229 /* 230 * Initialize IBAA. 231 */ 232 static void 233 IBAA_Init(void) 234 { 235 size_t i; 236 237 for (i = 0; i < SIZE; ++i) { 238 IBAA_memory[i] = i; 239 } 240 IBAA_aa = IBAA_bb = 0; 241 IBAA_counter = 0; 242 IBAA_byte_index = sizeof(IBAA_results); /* force IBAA_Call() */ 243 } 244 245 /* 246 * PRIVATE: Call IBAA to produce 256 32-bit u4 results. 247 */ 248 static void 249 IBAA_Call (void) 250 { 251 IBAA(IBAA_memory, IBAA_results, &IBAA_aa, &IBAA_bb, &IBAA_counter); 252 IBAA_byte_index = 0; 253 } 254 255 /* 256 * Add a 32-bit u4 seed value into IBAAs memory. Mix the low 4 bits 257 * with 4 bits of PNG data to reduce the possibility of a seeding-based 258 * attack. 259 */ 260 static void 261 IBAA_Seed (const u_int32_t val) 262 { 263 static int memIndex; 264 u4 *iptr; 265 266 iptr = &IBAA_memory[memIndex & MASK]; 267 *iptr = ((*iptr << 3) | (*iptr >> 29)) + (val ^ (IBAA_Byte() & 15)); 268 ++memIndex; 269 } 270 271 static void 272 IBAA_Vector (const char *buf, int bytes) 273 { 274 int i; 275 276 while (bytes >= sizeof(int)) { 277 IBAA_Seed(*(const int *)buf); 278 buf += sizeof(int); 279 bytes -= sizeof(int); 280 } 281 282 /* 283 * Warm up the generator to get rid of weak initial states. 284 */ 285 for (i = 0; i < 10; ++i) 286 IBAA_Call(); 287 } 288 289 /* 290 * Extract a byte from IBAAs 256 32-bit u4 results array. 291 * 292 * NOTE: This code is designed to prevent MP races from taking 293 * IBAA_byte_index out of bounds. 294 */ 295 static u_char 296 IBAA_Byte(void) 297 { 298 u_char result; 299 int index; 300 301 index = IBAA_byte_index; 302 if (index == sizeof(IBAA_results)) { 303 IBAA_Call(); 304 index = 0; 305 } 306 result = ((u_char *)IBAA_results)[index]; 307 IBAA_byte_index = index + 1; 308 return result; 309 } 310 311 /*------------------------------ IBAA ----------------------------------*/ 312 313 314 /*------------------------------- L15 ----------------------------------*/ 315 316 /* 317 * IMPORTANT NOTE: LByteType must be exactly 8-bits in size or this software 318 * will not function correctly. 319 */ 320 typedef unsigned char LByteType; 321 322 #define L15_STATE_SIZE 256 323 324 static LByteType L15_x, L15_y; 325 static LByteType L15_start_x; 326 static LByteType L15_state[L15_STATE_SIZE]; 327 328 /* 329 * PRIVATE FUNCS: 330 */ 331 332 static void L15_Swap(const LByteType pos1, const LByteType pos2); 333 static void L15_InitState(void); 334 static void L15_KSA(const LByteType * const key, 335 const size_t keyLen); 336 static void L15_Discard(const LByteType numCalls); 337 338 /* 339 * PUBLIC INTERFACE: 340 */ 341 static void L15(const LByteType * const key, const size_t keyLen); 342 static LByteType L15_Byte(void); 343 static void L15_Vector(const LByteType * const key, 344 const size_t keyLen); 345 346 static __inline void 347 L15_Swap(const LByteType pos1, const LByteType pos2) 348 { 349 const LByteType save1 = L15_state[pos1]; 350 351 L15_state[pos1] = L15_state[pos2]; 352 L15_state[pos2] = save1; 353 } 354 355 static void 356 L15_InitState (void) 357 { 358 size_t i; 359 for (i = 0; i < L15_STATE_SIZE; ++i) 360 L15_state[i] = i; 361 } 362 363 #define L_SCHEDULE(xx) \ 364 \ 365 for (i = 0; i < L15_STATE_SIZE; ++i) { \ 366 L15_Swap(i, (stateIndex += (L15_state[i] + (xx)))); \ 367 } 368 369 static void 370 L15_KSA (const LByteType * const key, const size_t keyLen) 371 { 372 size_t i, keyIndex; 373 static LByteType stateIndex = 0; 374 375 for (keyIndex = 0; keyIndex < keyLen; ++keyIndex) { 376 L_SCHEDULE(key[keyIndex]); 377 } 378 L_SCHEDULE(keyLen); 379 } 380 381 static void 382 L15_Discard(const LByteType numCalls) 383 { 384 LByteType i; 385 for (i = 0; i < numCalls; ++i) { 386 (void)L15_Byte(); 387 } 388 } 389 390 391 /* 392 * PUBLIC INTERFACE: 393 */ 394 static void 395 L15(const LByteType * const key, const size_t keyLen) 396 { 397 L15_x = L15_start_x = 0; 398 L15_y = L15_STATE_SIZE - 1; 399 L15_InitState(); 400 L15_KSA(key, keyLen); 401 L15_Discard(L15_Byte()); 402 } 403 404 static LByteType 405 L15_Byte(void) 406 { 407 LByteType z; 408 409 L15_Swap(L15_state[L15_x], L15_y); 410 z = (L15_state [L15_x++] + L15_state[L15_y--]); 411 if (L15_x == L15_start_x) { 412 --L15_y; 413 } 414 return (L15_state[z]); 415 } 416 417 static void 418 L15_Vector (const LByteType * const key, const size_t keyLen) 419 { 420 L15_KSA(key, keyLen); 421 } 422 423 /*------------------------------- L15 ----------------------------------*/ 424 425 /************************************************************************ 426 * KERNEL INTERFACE * 427 ************************************************************************ 428 * 429 * By Robin J Carey, Matthew Dillon and Alex Hornung. 430 */ 431 432 static int rand_thread_value; 433 static void NANOUP_EVENT(void); 434 static thread_t rand_td; 435 static struct spinlock rand_spin; 436 437 static int sysctl_kern_random(SYSCTL_HANDLER_ARGS); 438 439 static int nrandevents; 440 static int rand_mode = 2; 441 static struct systimer systimer_rand; 442 443 static int sysctl_kern_rand_mode(SYSCTL_HANDLER_ARGS); 444 445 SYSCTL_INT(_kern, OID_AUTO, nrandevents, CTLFLAG_RD, &nrandevents, 0, ""); 446 SYSCTL_PROC(_kern, OID_AUTO, random, CTLFLAG_RD | CTLFLAG_ANYBODY, 0, 0, 447 sysctl_kern_random, "I", "Acquire random data"); 448 SYSCTL_PROC(_kern, OID_AUTO, rand_mode, CTLTYPE_STRING | CTLFLAG_RW, NULL, 0, 449 sysctl_kern_rand_mode, "A", "RNG mode (csprng, ibaa or mixed)"); 450 451 452 /* 453 * Called from early boot 454 */ 455 void 456 rand_initialize(void) 457 { 458 struct timespec now; 459 int i; 460 461 csprng_init(&csprng_state); 462 #if 0 463 /* 464 * XXX: we do the reseeding when someone uses the RNG instead 465 * of regularly using init_reseed (which initializes a callout) 466 * to avoid unnecessary and regular reseeding. 467 */ 468 csprng_init_reseed(&csprng_state); 469 #endif 470 471 472 spin_init(&rand_spin, "randinit"); 473 474 /* Initialize IBAA. */ 475 IBAA_Init(); 476 477 /* Initialize L15. */ 478 nanouptime(&now); 479 L15((const LByteType *)&now.tv_nsec, sizeof(now.tv_nsec)); 480 for (i = 0; i < (SIZE / 2); ++i) { 481 nanotime(&now); 482 add_buffer_randomness_src((const uint8_t *)&now.tv_nsec, 483 sizeof(now.tv_nsec), RAND_SRC_TIMING); 484 nanouptime(&now); 485 add_buffer_randomness_src((const uint8_t *)&now.tv_nsec, 486 sizeof(now.tv_nsec), RAND_SRC_TIMING); 487 } 488 489 /* 490 * Warm up the generator to get rid of weak initial states. 491 */ 492 for (i = 0; i < 10; ++i) 493 IBAA_Call(); 494 } 495 496 /* 497 * Keyboard events 498 */ 499 void 500 add_keyboard_randomness(u_char scancode) 501 { 502 spin_lock(&rand_spin); 503 L15_Vector((const LByteType *) &scancode, sizeof (scancode)); 504 spin_unlock(&rand_spin); 505 add_interrupt_randomness(0); 506 } 507 508 /* 509 * Interrupt events. This is SMP safe and allowed to race. 510 * 511 * This adjusts rand_thread_value which will be incorporated into the next 512 * time-buffered seed. It does not effect the seeding period per-say. 513 */ 514 void 515 add_interrupt_randomness(int intr) 516 { 517 if (tsc_present) { 518 rand_thread_value = (rand_thread_value << 4) ^ 1 ^ 519 ((int)rdtsc() % 151); 520 } 521 ++rand_thread_value; /* ~1 bit */ 522 } 523 524 /* 525 * True random number source 526 */ 527 int 528 add_buffer_randomness(const char *buf, int bytes) 529 { 530 spin_lock(&rand_spin); 531 L15_Vector((const LByteType *)buf, bytes); 532 IBAA_Vector(buf, bytes); 533 spin_unlock(&rand_spin); 534 535 atomic_add_int(&nrandevents, 1); 536 537 csprng_add_entropy(&csprng_state, RAND_SRC_UNKNOWN, 538 (const uint8_t *)buf, bytes, 0); 539 540 return 0; 541 } 542 543 544 int 545 add_buffer_randomness_src(const char *buf, int bytes, int srcid) 546 { 547 spin_lock(&rand_spin); 548 L15_Vector((const LByteType *)buf, bytes); 549 IBAA_Vector(buf, bytes); 550 spin_unlock(&rand_spin); 551 552 atomic_add_int(&nrandevents, 1); 553 554 csprng_add_entropy(&csprng_state, srcid & 0xff, 555 (const uint8_t *)buf, bytes, 0); 556 557 return 0; 558 } 559 560 561 /* 562 * Kqueue filter (always succeeds) 563 */ 564 int 565 random_filter_read(struct knote *kn, long hint) 566 { 567 return (1); 568 } 569 570 /* 571 * Heavy weight random number generator. May return less then the 572 * requested number of bytes. 573 * 574 * Instead of stopping early, 575 */ 576 u_int 577 read_random(void *buf, u_int nbytes) 578 { 579 int i, j; 580 581 if (rand_mode == 0) { 582 /* Only use CSPRNG */ 583 i = csprng_get_random(&csprng_state, buf, nbytes, 0); 584 } else if (rand_mode == 1) { 585 /* Only use IBAA */ 586 spin_lock(&rand_spin); 587 for (i = 0; i < nbytes; i++) 588 ((u_char *)buf)[i] = IBAA_Byte(); 589 spin_unlock(&rand_spin); 590 } else { 591 /* Mix both CSPRNG and IBAA */ 592 i = csprng_get_random(&csprng_state, buf, nbytes, 0); 593 spin_lock(&rand_spin); 594 for (j = 0; j < i; j++) 595 ((u_char *)buf)[j] ^= IBAA_Byte(); 596 spin_unlock(&rand_spin); 597 } 598 599 add_interrupt_randomness(0); 600 return (i > 0) ? i : 0; 601 } 602 603 /* 604 * Heavy weight random number generator. Must return the requested 605 * number of bytes. 606 */ 607 u_int 608 read_random_unlimited(void *buf, u_int nbytes) 609 { 610 u_int i; 611 612 spin_lock(&rand_spin); 613 for (i = 0; i < nbytes; ++i) 614 ((u_char *)buf)[i] = IBAA_Byte(); 615 spin_unlock(&rand_spin); 616 add_interrupt_randomness(0); 617 return (i); 618 } 619 620 /* 621 * Read random data via sysctl(). 622 */ 623 static 624 int 625 sysctl_kern_random(SYSCTL_HANDLER_ARGS) 626 { 627 char buf[64]; 628 size_t n; 629 size_t r; 630 int error = 0; 631 632 n = req->oldlen; 633 if (n > 1024 * 1024) 634 n = 1024 * 1024; 635 while (n > 0) { 636 if ((r = n) > sizeof(buf)) 637 r = sizeof(buf); 638 read_random_unlimited(buf, r); 639 error = SYSCTL_OUT(req, buf, r); 640 if (error) 641 break; 642 n -= r; 643 } 644 return(error); 645 } 646 647 /* 648 * Change the random mode via sysctl(). 649 */ 650 static 651 const char * 652 rand_mode_to_str(int mode) 653 { 654 switch (mode) { 655 case 0: 656 return "csprng"; 657 case 1: 658 return "ibaa"; 659 case 2: 660 return "mixed"; 661 default: 662 return "unknown"; 663 } 664 } 665 666 static 667 int 668 sysctl_kern_rand_mode(SYSCTL_HANDLER_ARGS) 669 { 670 char mode[32]; 671 int error; 672 673 strncpy(mode, rand_mode_to_str(rand_mode), sizeof(mode)-1); 674 error = sysctl_handle_string(oidp, mode, sizeof(mode), req); 675 if (error || req->newptr == NULL) 676 return error; 677 678 if ((strncmp(mode, "csprng", sizeof(mode))) == 0) 679 rand_mode = 0; 680 else if ((strncmp(mode, "ibaa", sizeof(mode))) == 0) 681 rand_mode = 1; 682 else if ((strncmp(mode, "mixed", sizeof(mode))) == 0) 683 rand_mode = 2; 684 else 685 error = EINVAL; 686 687 return error; 688 } 689 690 /* 691 * Random number generator helper thread. This limits code overhead from 692 * high frequency events by delaying the clearing of rand_thread_value. 693 * 694 * This is a time-buffered loop, with a randomizing delay. Note that interrupt 695 * entropy does not cause the thread to wakeup any faster, but does improve the 696 * quality of the entropy produced. 697 */ 698 static 699 void 700 rand_thread_loop(void *dummy) 701 { 702 int64_t count; 703 704 for (;;) { 705 /* 706 * Generate entropy. 707 */ 708 NANOUP_EVENT(); 709 spin_lock(&rand_spin); 710 count = (uint8_t)L15_Byte(); 711 spin_unlock(&rand_spin); 712 713 /* 714 * Calculate 1/10 of a second to 2/10 of a second, fine-grained 715 * using a L15_Byte() feedback. 716 * 717 * Go faster in the first 1200 seconds after boot. This effects 718 * the time-after-next interrupt (pipeline delay). 719 */ 720 count = sys_cputimer->freq * (count + 256) / (256 * 10); 721 if (time_uptime < 120) 722 count = count / 10 + 1; 723 systimer_rand.periodic = count; 724 725 tsleep(rand_td, 0, "rwait", 0); 726 } 727 } 728 729 /* 730 * Systimer trigger - fine-grained random trigger 731 */ 732 static 733 void 734 rand_thread_wakeup(struct systimer *timer, int in_ipi, struct intrframe *frame) 735 { 736 wakeup(rand_td); 737 } 738 739 static 740 void 741 rand_thread_init(void) 742 { 743 systimer_init_periodic_nq(&systimer_rand, rand_thread_wakeup, NULL, 25); 744 lwkt_create(rand_thread_loop, NULL, &rand_td, NULL, 0, 0, "random"); 745 } 746 747 SYSINIT(rand, SI_SUB_HELPER_THREADS, SI_ORDER_ANY, rand_thread_init, 0); 748 749 /* 750 * Caller is time-buffered. Incorporate any accumulated interrupt randomness 751 * as well as the high frequency bits of the TSC. 752 * 753 * A delta nanoseconds value is used to remove absolute time from the generated 754 * entropy. Even though we are pushing 32 bits, this entropy is probably only 755 * good for one or two bits without any interrupt sources, and possibly 8 bits with. 756 */ 757 static void 758 NANOUP_EVENT(void) 759 { 760 static struct timespec last; 761 struct timespec now; 762 int nsec; 763 764 /* 765 * Delta nanoseconds since last event 766 */ 767 nanouptime(&now); 768 nsec = now.tv_nsec - last.tv_nsec; 769 last = now; 770 771 /* 772 * Interrupt randomness. 773 */ 774 nsec ^= rand_thread_value; 775 776 /* 777 * The TSC, if present, generally has an even higher 778 * resolution. Integrate a portion of it into our seed. 779 */ 780 if (tsc_present) 781 nsec ^= (rdtsc() & 255) << 8; 782 783 /* 784 * Ok. 785 */ 786 787 add_buffer_randomness_src((const uint8_t *)&nsec, sizeof(nsec), RAND_SRC_INTR); 788 } 789 790