xref: /dragonfly/sys/kern/kern_nrandom.c (revision 7b1120e5)
1 /*
2  * Copyright (c) 2004-2014 The DragonFly Project. All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Matthew Dillon <dillon@backplane.com>
6  * by Alex Hornung <alex@alexhornung.com>
7  * by Robin J Carey
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions, and the following disclaimer,
14  *    without modification, immediately at the beginning of the file.
15  * 2. The name of the author may not be used to endorse or promote products
16  *    derived from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
22  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  */
30 /*			   --- NOTES ---
31  *
32  * Note: The word "entropy" is often incorrectly used to describe
33  * random data. The word "entropy" originates from the science of
34  * Physics. The correct descriptive definition would be something
35  * along the lines of "seed", "unpredictable numbers" or
36  * "unpredictable data".
37  *
38  * Note: Some /dev/[u]random implementations save "seed" between
39  * boots which represents a security hazard since an adversary
40  * could acquire this data (since it is stored in a file). If
41  * the unpredictable data used in the above routines is only
42  * generated during Kernel operation, then an adversary can only
43  * acquire that data through a Kernel security compromise and/or
44  * a cryptographic algorithm failure/cryptanalysis.
45  *
46  * Note: On FreeBSD-4.11, interrupts have to be manually enabled
47  * using the rndcontrol(8) command.
48  *
49  *		--- DESIGN (FreeBSD-4.11 based) ---
50  *
51  *   The rnddev module automatically initializes itself the first time
52  * it is used (client calls any public rnddev_*() interface routine).
53  * Both CSPRNGs are initially seeded from the precise nano[up]time() routines.
54  * Tests show this method produces good enough results, suitable for intended
55  * use. It is necessary for both CSPRNGs to be completely seeded, initially.
56  *
57  *   After initialization and during Kernel operation the only suitable
58  * unpredictable data available is:
59  *
60  *	(1) Keyboard scan-codes.
61  *	(2) Nanouptime acquired by a Keyboard/Read-Event.
62  *	(3) Suitable interrupt source; hard-disk/ATA-device.
63  *
64  *      (X) Mouse-event (xyz-data unsuitable); NOT IMPLEMENTED.
65  *
66  *   This data is added to both CSPRNGs in real-time as it happens/
67  * becomes-available. Additionally, unpredictable (?) data may be
68  * acquired from a true-random number generator if such a device is
69  * available to the system (not advisable !).
70  *   Nanouptime() acquired by a Read-Event is a very important aspect of
71  * this design, since it ensures that unpredictable data is added to
72  * the CSPRNGs even if there are no other sources.
73  *   The nanouptime() Kernel routine is used since time relative to
74  * boot is less adversary-known than time itself.
75  *
76  *   This design has been thoroughly tested with debug logging
77  * and the output from both /dev/random and /dev/urandom has
78  * been tested with the DIEHARD test-suite; both pass.
79  *
80  * MODIFICATIONS MADE TO ORIGINAL "kern_random.c":
81  *
82  * 6th July 2005:
83  *
84  * o Changed ReadSeed() function to schedule future read-seed-events
85  *   by at least one second. Previous implementation used a randomised
86  *   scheduling { 0, 1, 2, 3 seconds }.
87  * o Changed SEED_NANOUP() function to use a "previous" accumulator
88  *   algorithm similar to ReadSeed(). This ensures that there is no
89  *   way that an adversary can tell what number is being added to the
90  *   CSPRNGs, since the number added to the CSPRNGs at Event-Time is
91  *   the sum of nanouptime()@Event and an unknown/secret number.
92  * o Changed rnddev_add_interrupt() function to schedule future
93  *   interrupt-events by at least one second. Previous implementation
94  *   had no scheduling algorithm which allowed an "interrupt storm"
95  *   to occur resulting in skewed data entering into the CSPRNGs.
96  *
97  *
98  * 9th July 2005:
99  *
100  * o Some small cleanups and change all internal functions to be
101  *   static/private.
102  * o Removed ReadSeed() since its functionality is already performed
103  *   by another function { rnddev_add_interrupt_OR_read() } and remove
104  *   the silly rndByte accumulator/feedback-thing (since multipying by
105  *   rndByte could yield a value of 0).
106  * o Made IBAA/L14 public interface become static/private;
107  *   Local to this file (not changed to that in the original C modules).
108  *
109  * 16th July 2005:
110  *
111  * o SEED_NANOUP() -> NANOUP_EVENT() function rename.
112  * o Make NANOUP_EVENT() handle the time-buffering directly so that all
113  *   time-stamp-events use this single time-buffer (including keyboard).
114  *   This removes dependancy on "time_second" Kernel variable.
115  * o Removed second-time-buffer code in rnddev_add_interrupt_OR_read (void).
116  * o Rewrote the time-buffering algorithm in NANOUP_EVENT() to use a
117  *   randomised time-delay range.
118  *
119  * 12th Dec 2005:
120  *
121  * o Updated to (hopefully final) L15 algorithm.
122  *
123  * 12th June 2006:
124  *
125  * o Added missing (u_char *) cast in RnddevRead() function.
126  * o Changed copyright to 3-clause BSD license and cleaned up the layout
127  *   of this file.
128  *
129  * For a proper changelog, refer to the version control history of this
130  * file.
131  */
132 
133 #include <sys/types.h>
134 #include <sys/kernel.h>
135 #include <sys/systm.h>
136 #include <sys/poll.h>
137 #include <sys/event.h>
138 #include <sys/random.h>
139 #include <sys/systimer.h>
140 #include <sys/time.h>
141 #include <sys/proc.h>
142 #include <sys/lock.h>
143 #include <sys/sysctl.h>
144 #include <sys/spinlock.h>
145 #include <sys/csprng.h>
146 #include <machine/atomic.h>
147 #include <machine/clock.h>
148 
149 #include <sys/spinlock2.h>
150 
151 struct csprng_state csprng_state;
152 
153 /*
154  * Portability note: The u_char/unsigned char type is used where
155  * uint8_t from <stdint.h> or u_int8_t from <sys/types.h> should really
156  * be being used. On FreeBSD, it is safe to make the assumption that these
157  * different types are equivalent (on all architectures).
158  * The FreeBSD <sys/crypto/rc4> module also makes this assumption.
159  */
160 
161 /*------------------------------ IBAA ----------------------------------*/
162 
163 /*-------------------------- IBAA CSPRNG -------------------------------*/
164 
165 /*
166  * NOTE: The original source code from which this source code (IBAA)
167  *       was taken has no copyright/license. The algorithm has no patent
168  *       and is freely/publicly available from:
169  *
170  *           http://www.burtleburtle.net/bob/rand/isaac.html
171  */
172 
173 /*
174  * ^ means XOR, & means bitwise AND, a<<b means shift a by b.
175  * barrel(a) shifts a 19 bits to the left, and bits wrap around
176  * ind(x) is (x AND 255), or (x mod 256)
177  */
178 typedef	u_int32_t	u4;   /* unsigned four bytes, 32 bits */
179 
180 #define	ALPHA		(8)
181 #define	SIZE		(1 << ALPHA)
182 #define MASK		(SIZE - 1)
183 #define	ind(x)		((x) & (SIZE - 1))
184 #define	barrel(a)	(((a) << 20) ^ ((a) >> 12))  /* beta=32,shift=20 */
185 
186 static void IBAA
187 (
188 	u4 *m,		/* Memory: array of SIZE ALPHA-bit terms */
189 	u4 *r,		/* Results: the sequence, same size as m */
190 	u4 *aa,		/* Accumulator: a single value */
191 	u4 *bb,		/* the previous result */
192 	u4 *counter	/* counter */
193 )
194 {
195 	u4 a, b, x, y, i;
196 
197 	a = *aa;
198 	b = *bb + *counter;
199 	++*counter;
200 	for (i = 0; i < SIZE; ++i) {
201 		x = m[i];
202 		a = barrel(a) + m[ind(i + (SIZE / 2))];	/* set a */
203 		m[i] = y = m[ind(x)] + a + b;		/* set m */
204 		r[i] = b = m[ind(y >> ALPHA)] + x;	/* set r */
205 	}
206 	*bb = b; *aa = a;
207 }
208 
209 /*-------------------------- IBAA CSPRNG -------------------------------*/
210 
211 
212 static u4	IBAA_memory[SIZE];
213 static u4	IBAA_results[SIZE];
214 static u4	IBAA_aa;
215 static u4	IBAA_bb;
216 static u4	IBAA_counter;
217 
218 static volatile int IBAA_byte_index;
219 
220 
221 static void	IBAA_Init(void);
222 static void	IBAA_Call(void);
223 static void	IBAA_Seed(const u_int32_t val);
224 static u_char	IBAA_Byte(void);
225 
226 /*
227  * Initialize IBAA.
228  */
229 static void
230 IBAA_Init(void)
231 {
232 	size_t	i;
233 
234 	for (i = 0; i < SIZE; ++i) {
235 		IBAA_memory[i] = i;
236 	}
237 	IBAA_aa = IBAA_bb = 0;
238 	IBAA_counter = 0;
239 	IBAA_byte_index = sizeof(IBAA_results);	/* force IBAA_Call() */
240 }
241 
242 /*
243  * PRIVATE: Call IBAA to produce 256 32-bit u4 results.
244  */
245 static void
246 IBAA_Call (void)
247 {
248 	IBAA(IBAA_memory, IBAA_results, &IBAA_aa, &IBAA_bb, &IBAA_counter);
249 	IBAA_byte_index = 0;
250 }
251 
252 /*
253  * Add a 32-bit u4 seed value into IBAAs memory.  Mix the low 4 bits
254  * with 4 bits of PNG data to reduce the possibility of a seeding-based
255  * attack.
256  */
257 static void
258 IBAA_Seed (const u_int32_t val)
259 {
260 	static int memIndex;
261 	u4 *iptr;
262 
263 	iptr = &IBAA_memory[memIndex & MASK];
264 	*iptr = ((*iptr << 3) | (*iptr >> 29)) + (val ^ (IBAA_Byte() & 15));
265 	++memIndex;
266 }
267 
268 static void
269 IBAA_Vector (const char *buf, int bytes)
270 {
271 	int i;
272 
273 	while (bytes >= sizeof(int)) {
274 		IBAA_Seed(*(const int *)buf);
275 		buf += sizeof(int);
276 		bytes -= sizeof(int);
277 	}
278 
279 	/*
280 	 * Warm up the generator to get rid of weak initial states.
281 	 */
282 	for (i = 0; i < 10; ++i)
283 		IBAA_Call();
284 }
285 
286 /*
287  * Extract a byte from IBAAs 256 32-bit u4 results array.
288  *
289  * NOTE: This code is designed to prevent MP races from taking
290  * IBAA_byte_index out of bounds.
291  */
292 static u_char
293 IBAA_Byte(void)
294 {
295 	u_char result;
296 	int index;
297 
298 	index = IBAA_byte_index;
299 	if (index == sizeof(IBAA_results)) {
300 		IBAA_Call();
301 		index = 0;
302 	}
303 	result = ((u_char *)IBAA_results)[index];
304 	IBAA_byte_index = index + 1;
305 	return result;
306 }
307 
308 /*------------------------------ IBAA ----------------------------------*/
309 
310 
311 /*------------------------------- L15 ----------------------------------*/
312 
313 /*
314  * IMPORTANT NOTE: LByteType must be exactly 8-bits in size or this software
315  * will not function correctly.
316  */
317 typedef unsigned char	LByteType;
318 
319 #define	L15_STATE_SIZE	256
320 
321 static LByteType	L15_x, L15_y;
322 static LByteType	L15_start_x;
323 static LByteType	L15_state[L15_STATE_SIZE];
324 
325 /*
326  * PRIVATE FUNCS:
327  */
328 
329 static void		L15_Swap(const LByteType pos1, const LByteType pos2);
330 static void		L15_InitState(void);
331 static void		L15_KSA(const LByteType * const key,
332 				const size_t keyLen);
333 static void		L15_Discard(const LByteType numCalls);
334 
335 /*
336  * PUBLIC INTERFACE:
337  */
338 static void		L15(const LByteType * const key, const size_t keyLen);
339 static LByteType	L15_Byte(void);
340 static void		L15_Vector(const LByteType * const key,
341 				const size_t keyLen);
342 
343 static __inline void
344 L15_Swap(const LByteType pos1, const LByteType pos2)
345 {
346 	const LByteType	save1 = L15_state[pos1];
347 
348 	L15_state[pos1] = L15_state[pos2];
349 	L15_state[pos2] = save1;
350 }
351 
352 static void
353 L15_InitState (void)
354 {
355 	size_t i;
356 	for (i = 0; i < L15_STATE_SIZE; ++i)
357 		L15_state[i] = i;
358 }
359 
360 #define  L_SCHEDULE(xx)						\
361 								\
362 for (i = 0; i < L15_STATE_SIZE; ++i) {				\
363     L15_Swap(i, (stateIndex += (L15_state[i] + (xx))));		\
364 }
365 
366 static void
367 L15_KSA (const LByteType * const key, const size_t keyLen)
368 {
369 	size_t	i, keyIndex;
370 	static LByteType stateIndex = 0;
371 
372 	for (keyIndex = 0; keyIndex < keyLen; ++keyIndex) {
373 		L_SCHEDULE(key[keyIndex]);
374 	}
375 	L_SCHEDULE(keyLen);
376 }
377 
378 static void
379 L15_Discard(const LByteType numCalls)
380 {
381 	LByteType i;
382 	for (i = 0; i < numCalls; ++i) {
383 		(void)L15_Byte();
384 	}
385 }
386 
387 
388 /*
389  * PUBLIC INTERFACE:
390  */
391 static void
392 L15(const LByteType * const key, const size_t keyLen)
393 {
394 	L15_x = L15_start_x = 0;
395 	L15_y = L15_STATE_SIZE - 1;
396 	L15_InitState();
397 	L15_KSA(key, keyLen);
398 	L15_Discard(L15_Byte());
399 }
400 
401 static LByteType
402 L15_Byte(void)
403 {
404 	LByteType z;
405 
406 	L15_Swap(L15_state[L15_x], L15_y);
407 	z = (L15_state [L15_x++] + L15_state[L15_y--]);
408 	if (L15_x == L15_start_x) {
409 		--L15_y;
410 	}
411 	return (L15_state[z]);
412 }
413 
414 static void
415 L15_Vector (const LByteType * const key, const size_t keyLen)
416 {
417 	L15_KSA(key, keyLen);
418 }
419 
420 /*------------------------------- L15 ----------------------------------*/
421 
422 /************************************************************************
423  *				KERNEL INTERFACE			*
424  ************************************************************************
425  *
426  * By Robin J Carey, Matthew Dillon and Alex Hornung.
427  */
428 
429 static int rand_thread_value;
430 static void NANOUP_EVENT(void);
431 static thread_t rand_td;
432 static struct spinlock rand_spin;
433 
434 static int sysctl_kern_random(SYSCTL_HANDLER_ARGS);
435 
436 static int nrandevents;
437 static int rand_mode = 2;
438 static struct systimer systimer_rand;
439 
440 static int sysctl_kern_rand_mode(SYSCTL_HANDLER_ARGS);
441 
442 SYSCTL_INT(_kern, OID_AUTO, nrandevents, CTLFLAG_RD, &nrandevents, 0, "");
443 SYSCTL_PROC(_kern, OID_AUTO, random, CTLFLAG_RD | CTLFLAG_ANYBODY, 0, 0,
444 		sysctl_kern_random, "I", "Acquire random data");
445 SYSCTL_PROC(_kern, OID_AUTO, rand_mode, CTLTYPE_STRING | CTLFLAG_RW, NULL, 0,
446     sysctl_kern_rand_mode, "A", "RNG mode (csprng, ibaa or mixed)");
447 
448 
449 /*
450  * Called from early boot (pre-SMP)
451  */
452 void
453 rand_initialize(void)
454 {
455 	struct timespec	now;
456 	int i;
457 
458 	csprng_init(&csprng_state);
459 #if 0
460 	/*
461 	 * XXX: we do the reseeding when someone uses the RNG instead
462 	 * of regularly using init_reseed (which initializes a callout)
463 	 * to avoid unnecessary and regular reseeding.
464 	 */
465 	csprng_init_reseed(&csprng_state);
466 #endif
467 
468 
469 	spin_init(&rand_spin, "randinit");
470 
471 	/* Initialize IBAA. */
472 	IBAA_Init();
473 
474 	/* Initialize L15. */
475 	nanouptime(&now);
476 	L15((const LByteType *)&now.tv_nsec, sizeof(now.tv_nsec));
477 	for (i = 0; i < (SIZE / 2); ++i) {
478 		nanotime(&now);
479 		add_buffer_randomness_src((const uint8_t *)&now.tv_nsec,
480 		    sizeof(now.tv_nsec), RAND_SRC_TIMING);
481 		nanouptime(&now);
482 		add_buffer_randomness_src((const uint8_t *)&now.tv_nsec,
483 		    sizeof(now.tv_nsec), RAND_SRC_TIMING);
484 	}
485 
486 	/*
487 	 * Warm up the generator to get rid of weak initial states.
488 	 */
489 	for (i = 0; i < 10; ++i)
490 		IBAA_Call();
491 }
492 
493 /*
494  * Keyboard events
495  */
496 void
497 add_keyboard_randomness(u_char scancode)
498 {
499 	spin_lock(&rand_spin);
500 	L15_Vector((const LByteType *) &scancode, sizeof (scancode));
501 	spin_unlock(&rand_spin);
502 	add_interrupt_randomness(0);
503 }
504 
505 /*
506  * Interrupt events.  This is SMP safe and allowed to race.
507  *
508  * This adjusts rand_thread_value which will be incorporated into the next
509  * time-buffered seed.  It does not effect the seeding period per-say.
510  */
511 void
512 add_interrupt_randomness(int intr)
513 {
514 	if (tsc_present) {
515 		rand_thread_value = (rand_thread_value << 4) ^ 1 ^
516 		((int)rdtsc() % 151);
517 	}
518 	++rand_thread_value;				/* ~1 bit */
519 }
520 
521 /*
522  * True random number source
523  */
524 int
525 add_buffer_randomness(const char *buf, int bytes)
526 {
527 	spin_lock(&rand_spin);
528 	L15_Vector((const LByteType *)buf, bytes);
529 	IBAA_Vector(buf, bytes);
530 	spin_unlock(&rand_spin);
531 
532 	atomic_add_int(&nrandevents, 1);
533 
534 	csprng_add_entropy(&csprng_state, RAND_SRC_UNKNOWN,
535 	    (const uint8_t *)buf, bytes, 0);
536 
537 	return 0;
538 }
539 
540 
541 int
542 add_buffer_randomness_src(const char *buf, int bytes, int srcid)
543 {
544 	spin_lock(&rand_spin);
545 	L15_Vector((const LByteType *)buf, bytes);
546 	IBAA_Vector(buf, bytes);
547 	spin_unlock(&rand_spin);
548 
549 	atomic_add_int(&nrandevents, 1);
550 
551 	csprng_add_entropy(&csprng_state, srcid & 0xff,
552 	    (const uint8_t *)buf, bytes, 0);
553 
554 	return 0;
555 }
556 
557 
558 /*
559  * Kqueue filter (always succeeds)
560  */
561 int
562 random_filter_read(struct knote *kn, long hint)
563 {
564 	return (1);
565 }
566 
567 /*
568  * Heavy weight random number generator.  May return less then the
569  * requested number of bytes.
570  *
571  * Instead of stopping early,
572  */
573 u_int
574 read_random(void *buf, u_int nbytes)
575 {
576 	int i, j;
577 
578 	if (rand_mode == 0) {
579 		/* Only use CSPRNG */
580 		i = csprng_get_random(&csprng_state, buf, nbytes, 0);
581 	} else if (rand_mode == 1) {
582 		/* Only use IBAA */
583 		spin_lock(&rand_spin);
584 		for (i = 0; i < nbytes; i++)
585 			((u_char *)buf)[i] = IBAA_Byte();
586 		spin_unlock(&rand_spin);
587 	} else {
588 		/* Mix both CSPRNG and IBAA */
589 		i = csprng_get_random(&csprng_state, buf, nbytes, 0);
590 		spin_lock(&rand_spin);
591 		for (j = 0; j < i; j++)
592 			((u_char *)buf)[j] ^= IBAA_Byte();
593 		spin_unlock(&rand_spin);
594 	}
595 
596 	add_interrupt_randomness(0);
597 	return (i > 0) ? i : 0;
598 }
599 
600 /*
601  * Heavy weight random number generator.  Must return the requested
602  * number of bytes.
603  */
604 u_int
605 read_random_unlimited(void *buf, u_int nbytes)
606 {
607 	u_int i;
608 
609 	spin_lock(&rand_spin);
610 	for (i = 0; i < nbytes; ++i)
611 		((u_char *)buf)[i] = IBAA_Byte();
612 	spin_unlock(&rand_spin);
613 	add_interrupt_randomness(0);
614 	return (i);
615 }
616 
617 /*
618  * Read random data via sysctl().
619  */
620 static
621 int
622 sysctl_kern_random(SYSCTL_HANDLER_ARGS)
623 {
624 	char buf[64];
625 	size_t n;
626 	size_t r;
627 	int error = 0;
628 
629 	n = req->oldlen;
630 	if (n > 1024 * 1024)
631 		n = 1024 * 1024;
632 	while (n > 0) {
633 		if ((r = n) > sizeof(buf))
634 			r = sizeof(buf);
635 		read_random_unlimited(buf, r);
636 		error = SYSCTL_OUT(req, buf, r);
637 		if (error)
638 			break;
639 		n -= r;
640 	}
641 	return(error);
642 }
643 
644 /*
645  * Change the random mode via sysctl().
646  */
647 static
648 const char *
649 rand_mode_to_str(int mode)
650 {
651 	switch (mode) {
652 	case 0:
653 		return "csprng";
654 	case 1:
655 		return "ibaa";
656 	case 2:
657 		return "mixed";
658 	default:
659 		return "unknown";
660 	}
661 }
662 
663 static
664 int
665 sysctl_kern_rand_mode(SYSCTL_HANDLER_ARGS)
666 {
667 	char mode[32];
668 	int error;
669 
670 	strncpy(mode, rand_mode_to_str(rand_mode), sizeof(mode)-1);
671 	error = sysctl_handle_string(oidp, mode, sizeof(mode), req);
672 	if (error || req->newptr == NULL)
673 	    return error;
674 
675 	if ((strncmp(mode, "csprng", sizeof(mode))) == 0)
676 		rand_mode = 0;
677 	else if ((strncmp(mode, "ibaa", sizeof(mode))) == 0)
678 		rand_mode = 1;
679 	else if ((strncmp(mode, "mixed", sizeof(mode))) == 0)
680 		rand_mode = 2;
681 	else
682 		error = EINVAL;
683 
684 	return error;
685 }
686 
687 /*
688  * Random number generator helper thread.  This limits code overhead from
689  * high frequency events by delaying the clearing of rand_thread_value.
690  *
691  * This is a time-buffered loop, with a randomizing delay.  Note that interrupt
692  * entropy does not cause the thread to wakeup any faster, but does improve the
693  * quality of the entropy produced.
694  */
695 static
696 void
697 rand_thread_loop(void *dummy)
698 {
699 	int64_t count;
700 
701 	for (;;) {
702 		/*
703 		 * Generate entropy.
704 		 */
705 		NANOUP_EVENT();
706 		spin_lock(&rand_spin);
707 		count = (uint8_t)L15_Byte();
708 		spin_unlock(&rand_spin);
709 
710 		/*
711 		 * Calculate 1/10 of a second to 2/10 of a second, fine-grained
712 		 * using a L15_Byte() feedback.
713 		 *
714 		 * Go faster in the first 1200 seconds after boot.  This effects
715 		 * the time-after-next interrupt (pipeline delay).
716 		 */
717 		count = sys_cputimer->freq * (count + 256) / (256 * 10);
718 		if (time_uptime < 120)
719 			count = count / 10 + 1;
720 		systimer_rand.periodic = count;
721 
722 		tsleep(rand_td, 0, "rwait", 0);
723 	}
724 }
725 
726 /*
727  * Systimer trigger - fine-grained random trigger
728  */
729 static
730 void
731 rand_thread_wakeup(struct systimer *timer, int in_ipi, struct intrframe *frame)
732 {
733 	wakeup(rand_td);
734 }
735 
736 static
737 void
738 rand_thread_init(void)
739 {
740 	systimer_init_periodic_nq(&systimer_rand, rand_thread_wakeup, NULL, 25);
741 	lwkt_create(rand_thread_loop, NULL, &rand_td, NULL, 0, 0, "random");
742 }
743 
744 SYSINIT(rand, SI_SUB_HELPER_THREADS, SI_ORDER_ANY, rand_thread_init, 0);
745 
746 /*
747  * Caller is time-buffered.  Incorporate any accumulated interrupt randomness
748  * as well as the high frequency bits of the TSC.
749  *
750  * A delta nanoseconds value is used to remove absolute time from the generated
751  * entropy.  Even though we are pushing 32 bits, this entropy is probably only
752  * good for one or two bits without any interrupt sources, and possibly 8 bits with.
753  */
754 static void
755 NANOUP_EVENT(void)
756 {
757 	static struct timespec	last;
758 	struct timespec		now;
759 	int			nsec;
760 
761 	/*
762 	 * Delta nanoseconds since last event
763 	 */
764 	nanouptime(&now);
765 	nsec = now.tv_nsec - last.tv_nsec;
766 	last = now;
767 
768 	/*
769 	 * Interrupt randomness.
770 	 */
771 	nsec ^= rand_thread_value;
772 
773 	/*
774 	 * The TSC, if present, generally has an even higher
775 	 * resolution.  Integrate a portion of it into our seed.
776 	 */
777 	if (tsc_present)
778 		nsec ^= (rdtsc() & 255) << 8;
779 
780 	/*
781 	 * Ok.
782 	 */
783 
784 	add_buffer_randomness_src((const uint8_t *)&nsec, sizeof(nsec), RAND_SRC_INTR);
785 }
786 
787