summaryrefslogtreecommitdiff
path: root/sys/dev/random
Commit message (Collapse)AuthorAgeFilesLines
* Revert previous commit, until issue with sparc64 resolved.Simon J. Gerraty2016-06-091-3/+1
| | | | | | | Approved by: so (implicit) Notes: svn path=/head/; revision=301735
* Add a prototype for random_harvest_queue to dev/random/random_harvestq.hSimon J. Gerraty2016-06-091-1/+3
| | | | | | | | | | | | | This fixes a warning that occurs in a number of files that use the random_harvest_queue function. Differential Revision: https://reviews.freebsd.org/D4229 Submitted by: stevek@juniper.net Reviewed by: markm Approved by: so Notes: svn path=/head/; revision=301713
* Don't repeat the the word 'the'Eitan Adler2016-05-171-1/+1
| | | | | | | | | | (one manual change to fix grammar) Confirmed With: db Approved by: secteam (not really, but this is a comment typo fix) Notes: svn path=/head/; revision=300050
* dev/random: minor spelling fixes in comments.Pedro F. Giffuni2016-05-022-4/+4
| | | | | | | | | | No functional change. Reviewed by: markm Approved by: so Notes: svn path=/head/; revision=298923
* dev/random: use our roundup() macro instead of re-implementing it.Pedro F. Giffuni2016-04-253-7/+4
| | | | | | | | | | | While here also use howmany() macro from sys/param.h No functional change. Reviewed by: markm (roundup replacement part) Approved by: so Notes: svn path=/head/; revision=298593
* Fix rdrand_rng.ko and padlock_rng.ko dependencies, making modulesKonstantin Belousov2016-04-162-2/+2
| | | | | | | | | | loadable when not compiled into the kernel. Approved by: so (delphij) Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=298102
* Don't start the random harvester process until timers are working.John Baldwin2016-03-281-1/+2
| | | | | | | | | | | | | | This is a no-op currently, but in kernels with earlier AP startup, the random kthread was trying to use timeouts with sleeps before timers are working. Wait until SI_SUB_KICK_SCHEDULER to start the random kproc. Reviewed by: delphij, imp, markm Approved by: so Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D5712 Notes: svn path=/head/; revision=297366
* Add missing braces.Gleb Smirnoff2016-02-171-1/+2
| | | | | | | | Found by: PVS-Studio Approved by: so (implicit) Notes: svn path=/head/; revision=295718
* Replace sys/crypto/sha2/sha2.c with lib/libmd/sha512c.cAllan Jude2015-12-277-10/+8
| | | | | | | | | | | | | | | | | | | | | cperciva's libmd implementation is 5-30% faster The same was done for SHA256 previously in r263218 cperciva's implementation was lacking SHA-384 which I implemented, validated against OpenSSL and the NIST documentation Extend sbin/md5 to create sha384(1) Chase dependancies on sys/crypto/sha2/sha2.{c,h} and replace them with sha512{c.c,.h} Reviewed by: cperciva, des, delphij Approved by: secteam, bapt (mentor) MFC after: 2 weeks Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D3929 Notes: svn path=/head/; revision=292782
* Fix printf-like formats for KASSERT.Mark Murray2015-10-051-1/+1
| | | | | | | | Submitted by: jenkins Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=288780
* It appears that under some circumstances, like virtualisiation, theMark Murray2015-10-051-1/+10
| | | | | | | | | | | | | | | | | | 'rdrand' instruction may occasionally not return random numbers, in spite of looping attempts to do so. The reusult is a KASSERT/panic. Reluctantly accept this state-of-affairs, but make a noise about it. if this 'noise' spams the console, it may be time to discontinue using that source. This is written in a general way to account for /any/ source that might not supply random numbers when required. Submitted by: jkh (report and slightly different fix) Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=288703
* Make the UMA harvesting go away completely if not wanted. Default to "not ↵Mark Murray2015-08-225-29/+19
| | | | | | | | | | | | | | | | | | | wanted". Provide and document the RANDOM_ENABLE_UMA option. Change RANDOM_FAST to RANDOM_UMA to clarify the harvesting. Remove RANDOM_DEBUG option, replace with SDT probes. These will be of use to folks measuring the harvesting effect when deciding whether to use RANDOM_ENABLE_UMA. Requested by: scottl and others. Approved by: so (/dev/random blanket) Differential Revision: https://reviews.freebsd.org/D3197 Notes: svn path=/head/; revision=287023
* Add DEV_RANDOM pseudo-option and use it to "include out" random(4)Mark Murray2015-08-1711-331/+574
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if desired. Retire randomdev_none.c and introduce random_infra.c for resident infrastructure. Completely stub out random(4) calls in the "without DEV_RANDOM" case. Add RANDOM_LOADABLE option to allow loadable Yarrow/Fortuna/LocallyWritten algorithm. Add a skeleton "other" algorithm framework for folks to add their own processing code. NIST, anyone? Retire the RANDOM_DUMMY option. Build modules for Yarrow, Fortuna and "other". Use atomics for the live entropy rate-tracking. Convert ints to bools for the 'seeded' logic. Move _write() function from the algorithm-specific areas to randomdev.c Get rid of reseed() function - it is unused. Tidy up the opt_*.h includes. Update documentation for random(4) modules. Fix test program (reviewers, please leave this). Differential Revision: https://reviews.freebsd.org/D3354 Reviewed by: wblock,delphij,jmg,bjk Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=286839
* Fix some untidy logic. I committed the wrong local fix; please pass the ↵Mark Murray2015-07-191-1/+1
| | | | | | | | | pointy hat. Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285700
* Remove out-of-date comments.Mark Murray2015-07-192-2/+0
| | | | | | | Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285693
* Fix the read blocking so that it is interruptable and slow down the rate of ↵Mark Murray2015-07-191-4/+10
| | | | | | | | | console warning spamming while blocked. Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285692
* Optimise the buffer-size calculation. It was possible to get one block too many.Mark Murray2015-07-191-19/+16
| | | | | | | Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285690
* Fix the build after breaking it in r285549.Ed Schouten2015-07-141-1/+1
| | | | | | | | | | | | I performed the commit on a different system as where I wrote the change. After pulling in the change from Phabricator, I didn't notice that a single chunk did not apply. Approved by: secteam (implicit, as intended change was approved) Pointy hat to: me Notes: svn path=/head/; revision=285573
* Implement the CloudABI random_get() system call.Ed Schouten2015-07-141-0/+7
| | | | | | | | | | | | | | | | | The random_get() system call works similar to getentropy()/getrandom() on OpenBSD/Linux. It fills a buffer with random data. This change introduces a new function, read_random_uio(), that is used to implement read() on the random devices. We can call into this function from within the CloudABI compatibility layer. Approved by: secteam Reviewed by: jmg, markm, wblock Obtained from: https://github.com/NuxiNL/freebsd Differential Revision: https://reviews.freebsd.org/D3053 Notes: svn path=/head/; revision=285549
* Rework the read routines to keep the PRNG sources happy. These workMark Murray2015-07-131-7/+24
| | | | | | | | | | | in units of crypto blocks, so must have adequate space to write. This means needing to be careful about buffers and keeping track of external read request length. Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285439
* * Address review (and add a bit myself).Mark Murray2015-07-129-196/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Tweek man page. - Remove all mention of RANDOM_FORTUNA. If the system owner wants YARROW or DUMMY, they ask for it, otherwise they get FORTUNA. - Tidy up headers a bit. - Tidy up declarations a bit. - Make static in a couple of places where needed. - Move Yarrow/Fortuna SYSINIT/SYSUNINIT to randomdev.c, moving us towards a single file where the algorithm context is used. - Get rid of random_*_process_buffer() functions. They were only used in one place each, and are better subsumed into those places. - Remove *_post_read() functions as they are stubs everywhere. - Assert against buffer size illegalities. - Clean up some silly code in the randomdev_read() routine. - Make the harvesting more consistent. - Make some requested argument name changes. - Tidy up and clarify a few comments. - Make some requested comment changes. - Make some requested macro changes. * NOTE: the thing calling itself a 'unit test' is not yet a proper unit test, but it helps me ensure things work. It may be a proper unit test at some time in the future, but for now please don't make any assumptions or hold any expectations. Differential Revision: https://reviews.freebsd.org/D2025 Approved by: so (/dev/random blanket) Notes: svn path=/head/; revision=285422
* Huge cleanup of random(4) code.Mark Murray2015-06-3023-2147/+1423
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * GENERAL - Update copyright. - Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set neither to ON, which means we want Fortuna - If there is no 'device random' in the kernel, there will be NO random(4) device in the kernel, and the KERN_ARND sysctl will return nothing. With RANDOM_DUMMY there will be a random(4) that always blocks. - Repair kern.arandom (KERN_ARND sysctl). The old version went through arc4random(9) and was a bit weird. - Adjust arc4random stirring a bit - the existing code looks a little suspect. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Redo read_random(9) so as to duplicate random(4)'s read internals. This makes it a first-class citizen rather than a hack. - Move stuff out of locked regions when it does not need to be there. - Trim RANDOM_DEBUG printfs. Some are excess to requirement, some behind boot verbose. - Use SYSINIT to sequence the startup. - Fix init/deinit sysctl stuff. - Make relevant sysctls also tunables. - Add different harvesting "styles" to allow for different requirements (direct, queue, fast). - Add harvesting of FFS atime events. This needs to be checked for weighing down the FS code. - Add harvesting of slab allocator events. This needs to be checked for weighing down the allocator code. - Fix the random(9) manpage. - Loadable modules are not present for now. These will be re-engineered when the dust settles. - Use macros for locks. - Fix comments. * src/share/man/... - Update the man pages. * src/etc/... - The startup/shutdown work is done in D2924. * src/UPDATING - Add UPDATING announcement. * src/sys/dev/random/build.sh - Add copyright. - Add libz for unit tests. * src/sys/dev/random/dummy.c - Remove; no longer needed. Functionality incorporated into randomdev.*. * live_entropy_sources.c live_entropy_sources.h - Remove; content moved. - move content to randomdev.[ch] and optimise. * src/sys/dev/random/random_adaptors.c src/sys/dev/random/random_adaptors.h - Remove; plugability is no longer used. Compile-time algorithm selection is the way to go. * src/sys/dev/random/random_harvestq.c src/sys/dev/random/random_harvestq.h - Add early (re)boot-time randomness caching. * src/sys/dev/random/randomdev_soft.c src/sys/dev/random/randomdev_soft.h - Remove; no longer needed. * src/sys/dev/random/uint128.h - Provide a fake uint128_t; if a real one ever arrived, we can use that instead. All that is needed here is N=0, N++, N==0, and some localised trickery is used to manufacture a 128-bit 0ULLL. * src/sys/dev/random/unit_test.c src/sys/dev/random/unit_test.h - Improve unit tests; previously the testing human needed clairvoyance; now the test will do a basic check of compressibility. Clairvoyant talent is still a good idea. - This is still a long way off a proper unit test. * src/sys/dev/random/fortuna.c src/sys/dev/random/fortuna.h - Improve messy union to just uint128_t. - Remove unneeded 'static struct fortuna_start_cache'. - Tighten up up arithmetic. - Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing. - Assert that locks are held correctly. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Turn into self-sufficient module (no longer requires randomdev_soft.[ch]) * src/sys/dev/random/yarrow.c src/sys/dev/random/yarrow.h - Improve messy union to just uint128_t. - Remove unneeded 'staic struct start_cache'. - Tighten up up arithmetic. - Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing. - Assert that locks are held correctly. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Turn into self-sufficient module (no longer requires randomdev_soft.[ch]) - Fix some magic numbers elsewhere used as FAST and SLOW. Differential Revision: https://reviews.freebsd.org/D2025 Reviewed by: vsevolod,delphij,rwatson,trasz,jmg Approved by: so (delphij) Notes: svn path=/head/; revision=284959
* - fortuna.c: catch up with r278927 and fix a buffer overflow by using theXin LI2015-02-182-1/+7
| | | | | | | | | | | | | | temporary buffer when remaining space is not enough to hold a whole block. - yarrow.c: add a comment that we intend to change the code and remove memcpy's in the future. (*) Requested by: markm (*) Reviewed by: markm Approved by: so (self) Notes: svn path=/head/; revision=278950
* Fix a bug where this function overflowed it's buffer... This wasJohn-Mark Gurney2015-02-171-2/+10
| | | | | | | | | | | | causing ZFS panics on boot... This is purely reviewed and tested by peter. Reviewed by: peter Approved by: so (implicit), peter Notes: svn path=/head/; revision=278927
* When the new random adaptor code was brought it in r273872, a call toJohn-Mark Gurney2015-02-174-15/+16
| | | | | | | | | | | | | | | | | | | | | | randomdev_init_reader to change read_random over to the newly installed adaptor was missed. This means both read_random and arc4random (seeded from read_random) were not returning very random data. This also effects userland arc4random as it is seeded from kernel arc4random. The random devices are uneffected and have returned good randomness since the change. All keys generated with a kernel of r273872 must be regenerated with a kernel with this patch. Keys generated may be predictable. Remove the warning as log is too early to print anything, and it would always get printed due to early use of arc4random... Reviewed by: delphij, markm Approved by: so (delphij) Notes: svn path=/head/; revision=278907
* Update comment.Konstantin Belousov2014-11-111-1/+1
| | | | | | | | | Noted by: dim Approved by: secteam (des) MFC after: 4 days Notes: svn path=/head/; revision=274381
* Constify the AES code and propagate to consumers. This allows us toDag-Erling Smørgrav2014-11-103-18/+13
| | | | | | | | | update the Fortuna code to use SHAd-256 as defined in FS&K. Approved by: so (self) Notes: svn path=/head/; revision=274340
* Fix random.ko module.Konstantin Belousov2014-11-074-23/+7
| | | | | | | | | | | | | | | | - Remove duplicated sources between standard part of the kernel and module. In particular, it caused duplicated lock initialization and sysctl registration, both having bad consequences. - Add missed source files to module. - Static part of the kernel provides randomdev module, not random_adaptors. Correct dependencies. - Use cdev modules declaration macros. Approved by: secteam (delphij) Reviewed by: markm Notes: svn path=/head/; revision=274252
* Simplify assembler in ivy.c. Move the copying of the random bits intoKonstantin Belousov2014-11-071-12/+11
| | | | | | | | | | | | | buffer from asm to C, which reduces amount of arguments for inline asm and simplifies constraints. Use unsigned types consistently. Submitted by: bde Approved by: secteam (delphij) Reviewed by: markm MFC after: 1 week Notes: svn path=/head/; revision=274250
* When reseeding the DPRNG, we're supposed to hash the current key andDag-Erling Smørgrav2014-11-041-10/+20
| | | | | | | | | | | | | | some accumulated entropy twice and use that as the new key. Due to a typo, we were using the output of the first hash round instead of the second. Correct this, but eliminate temp[] since we can reuse hash[]. Also add comments explaining what is going on and why. Noticed by: Sami Farin <sami.farin@gmail.com> Reviewed by: markm@ Approved by: so (des) Notes: svn path=/head/; revision=274103
* Don't assert random_adaptors_lock in random_adaptor_read_rate().Xin LI2014-11-031-4/+0
| | | | | | | | | Reported by: many Pointy hat to: delphij (for not testing the commit with WITNESS) Approved by: so Notes: svn path=/head/; revision=274006
* - Make sure random_adaptor accesses happen only whenXin LI2014-11-021-22/+39
| | | | | | | | | | | | | | | | | | random_adaptors_lock is held. - Use sx_sleep instead of tsleep in read and write path to allow another thread that registers a new random adapter when waiting. Assert that random_adaptor is not NULL after reacquiring the lock. - Capture EINTR/ERESTART from sx_sleep to allow the blocking cycle be stopped when user requests so, while there also make short read/write's return 0. - Move M_WAITOK allocations out of lock scope. In collobration with: kib, markm, ian, jilles Reviewed by: kib, markm Approved by: so Notes: svn path=/head/; revision=273997
* Restore the auto-reseed logic, but move it to a much later point,Dag-Erling Smørgrav2014-11-022-26/+5
| | | | | | | | | immediately before kick_init. Approved by: so (self) Notes: svn path=/head/; revision=273958
* This is the much-discussed major upgrade to the random(4) device, known to ↵Mark Murray2014-10-3025-1374/+2301
| | | | | | | | | | | | | | | | | | | | | | you all as /dev/random. This code has had an extensive rewrite and a good series of reviews, both by the author and other parties. This means a lot of code has been simplified. Pluggable structures for high-rate entropy generators are available, and it is most definitely not the case that /dev/random can be driven by only a hardware souce any more. This has been designed out of the device. Hardware sources are stirred into the CSPRNG (Yarrow, Fortuna) like any other entropy source. Pluggable modules may be written by third parties for additional sources. The harvesting structures and consequently the locking have been simplified. Entropy harvesting is done in a more general way (the documentation for this will follow). There is some GREAT entropy to be had in the UMA allocator, but it is disabled for now as messing with that is likely to annoy many people. The venerable (but effective) Yarrow algorithm, which is no longer supported by its authors now has an alternative, Fortuna. For now, Yarrow is retained as the default algorithm, but this may be changed using a kernel option. It is intended to make Fortuna the default algorithm for 11.0. Interested parties are encouraged to read ISBN 978-0-470-47424-2 "Cryptography Engineering" By Ferguson, Schneier and Kohno for Fortuna's gory details. Heck, read it anyway. Many thanks to Arthur Mesh who did early grunt work, and who got caught in the crossfire rather more than he deserved to. My thanks also to folks who helped me thresh this out on whiteboards and in the odd "Hallway track", or otherwise. My Nomex pants are on. Let the feedback commence! Reviewed by: trasz,des(partial),imp(partial?),rwatson(partial?) Approved by: so(des) Notes: svn path=/head/; revision=273872
* Make sure correct object code is generated at -O0.Navdeep Parhar2014-10-131-1/+1
| | | | | | | | | Submitted by: grehan@ Approved by: so@ (des) MFC after: 1 month Notes: svn path=/head/; revision=273027
* Use Intel's official name (Secure Key) per Intel® Digital Random NumberXin LI2014-06-271-1/+1
| | | | | | | | | | | Generator (DRNG) Software Implementation Guide. Reviewed by: kib Approved by: so MFC after: 2 weeks Notes: svn path=/head/; revision=267984
* Correctly set the sysctl format to Alphanumeric, rather than letting it default.Mark Murray2014-04-261-2/+2
| | | | | | | Approved by: security-officer(des) Notes: svn path=/head/; revision=264969
* Convert the random entropy harvesting code to use a const void * pointerAdrian Chadd2013-11-011-1/+1
| | | | | | | | | | | | | | rather than just void *. Then, as part of this, convert a couple of mbuf m->m_data accesses to mtod(m, const void *). Reviewed by: markm Approved by: security-officer (delphij) Sponsored by: Netflix, Inc. Notes: svn path=/head/; revision=257525
* Utilize the stronger guarantees on the call arguments from theKonstantin Belousov2013-10-171-31/+24
| | | | | | | | | | | | | | | | harvester, which now always calls hwrngs with the buffer length multiple of the word size. This allows to remove the excessive memory accesses to temporary buffer when saving the entropy word. Streamline the assembly and unify it between i386 and amd64. Reviewed by: markm, des Approved by: so (des) Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Notes: svn path=/head/; revision=256670
* Make sure a vaiable is always initialised.Mark Murray2013-10-121-0/+1
| | | | Notes: svn path=/projects/random_number_generator/; revision=256400
* Fix a problem where the priority order of yarrow,dummy can get reversedMark Murray2013-10-124-7/+18
| | | | | | | | | | | | to dummy,yarrow and break the usability of /dev/random. Fix the name of the tunable to something logical that 'sysctl kern.random' emits. Submitted by: des@ (the idea, code by me) Notes: svn path=/projects/random_number_generator/; revision=256399
* Fix for i386.Mark Murray2013-10-111-0/+1
| | | | Notes: svn path=/projects/random_number_generator/; revision=256346
* Fix a constant printf which is (int) on some architectures and (long int) on ↵Mark Murray2013-10-101-1/+1
| | | | | | | others. Notes: svn path=/projects/random_number_generator/; revision=256254
* Add a RANDOM_RWFILE option and hide the entropy cache code behind it.Dag-Erling Smørgrav2013-10-094-19/+36
| | | | | | | | Rename YARROW_RNG and FORTUNA_RNG to RANDOM_YARROW and RANDOM_FORTUNA. Add the RANDOM_* options to LINT. Notes: svn path=/projects/random_number_generator/; revision=256240
* Sigh. I can't even get a single #ifdef right. Who's got the hat?Mark Murray2013-10-091-1/+1
| | | | Notes: svn path=/projects/random_number_generator/; revision=256205
* staticize struct random_hardware_sourceDag-Erling Smørgrav2013-10-092-2/+2
| | | | Notes: svn path=/projects/random_number_generator/; revision=256204
* Wrap some policy-rich code in 'if NOTYET' until we can thresh out what it ↵Mark Murray2013-10-091-0/+2
| | | | | | | really needs to do. Notes: svn path=/projects/random_number_generator/; revision=256203
* Re-add /dev/urandom for compatibility purposes.Dag-Erling Smørgrav2013-10-091-0/+1
| | | | Notes: svn path=/projects/random_number_generator/; revision=256184
* comment nitDag-Erling Smørgrav2013-10-091-1/+1
| | | | Notes: svn path=/projects/random_number_generator/; revision=256183
* Add missing include guards and move the existing ones out of theDag-Erling Smørgrav2013-10-098-9/+34
| | | | | | | implementation namespace. Notes: svn path=/projects/random_number_generator/; revision=256182
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 04:48:01 +0000