drivers/char/random.c

19  * data is then "credited" as having a certain number of bits of entropy.
20  * When enough bits of entropy are available, the hash is finalized and
23  * entropy collectors, described below, add data to the input pool.
70  * being able to wait until the RNG has collected enough entropy and
80 	CRNG_EMPTY = 0, /* Little to no entropy collected */
119 /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
176  * These functions expand entropy from the entropy extractor into
471  * Batched entropy returns random integers. The quality of the random
486 	type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))];		\
515 	if (batch->position >= ARRAY_SIZE(batch->entropy) ||			\
517 		_get_random_bytes(batch->entropy, sizeof(batch->entropy));	\
522 	ret = batch->entropy[batch->position];					\
523 	batch->entropy[batch->position] = 0;					\
596  * Callers may add entropy via:
600  * After which, if added entropy should be credited:
604  * Finally, extract entropy via:
648  * This is an HKDF-like construction for using the hashed collected entropy
746  * The following exported functions are used for pushing entropy into
747  * the above entropy accumulation routines:
750  *	void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after);
760  * read-out of the RTC. This does *not* credit any actual entropy to
762  * that might otherwise be identical and have very little entropy
766  * entropy as specified by the caller. If the entropy pool is full it will
767  * block until more entropy is needed.
778  * inputs to the entropy pool. Using the cycle counters and the irq source
780  * interrupts, crediting 1 bit of entropy for whichever comes first.
787  * entropy pool. Note that high-speed solid state drives with very low
788  * seek times do not make for good sources of entropy, as their seek
791  * The last two routines try to estimate how many bits of entropy
812 	unsigned long flags, entropy = random_get_entropy();
823 	_mix_pool_bytes(&entropy, sizeof(entropy));
843 	unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)];
851 	for (i = 0, arch_bits = sizeof(entropy) * 8; i < ARRAY_SIZE(entropy);) {
852 		longs = arch_get_random_seed_longs(entropy, ARRAY_SIZE(entropy) - i);
854 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);
858 		longs = arch_get_random_longs(entropy, ARRAY_SIZE(entropy) - i);
860 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);
864 		arch_bits -= sizeof(*entropy) * 8;
884 	unsigned long entropy = random_get_entropy();
888 	_mix_pool_bytes(&entropy, sizeof(entropy));
905 	WARN(!entropy, "Missing cycle counter and fallback timer; RNG "
906 		       "entropy collection will consequently suffer.");
913  * None of this adds any entropy; it is meant to avoid the problem of
914  * the entropy pool having similar initial state across largely
919 	unsigned long entropy = random_get_entropy();
923 	_mix_pool_bytes(&entropy, sizeof(entropy));
934 void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after)
937 	credit_init_bits(entropy);
941 	 * initialized or no entropy is credited.
943 	if (sleep_after && !kthread_should_stop() && (crng_ready() || !entropy))
1058 	 * the other half as the next "key" that carries over. The entropy is
1091 	unsigned long entropy = random_get_entropy();
1096 	fast_mix(fast_pool->pool, entropy,
1114 /* There is one of these per entropy source */
1121  * This function adds entropy to the entropy "pool" by using timing
1123  * of how many bits of entropy this call has added to the pool. The
1129 	unsigned long entropy = random_get_entropy(), now = jiffies, flags;
1138 		fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);
1141 		_mix_pool_bytes(&entropy, sizeof(entropy));
1176 	 * on general principles, and limit entropy estimate to 11 bits.
1223 	 * If kzalloc returns null, we just won't use that entropy
1235 	unsigned long entropy;
1244  * activity will be touching the stack of the CPU that is generating entropy.
1248  * want the timer to keep ticking unless the entropy loop is running.
1250  * So the re-arming always happens in the entropy loop itself.
1255 	unsigned long entropy = random_get_entropy();
1257 	mix_pool_bytes(&entropy, sizeof(entropy));
1263  * If we have an actual cycle counter, see if we can generate enough entropy
1276 		stack->entropy = random_get_entropy();
1277 		if (stack->entropy != last)
1279 		last = stack->entropy;
1325 		mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));
1327 		stack->entropy = random_get_entropy();
1329 	mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));
1352  * Writing to either /dev/random or /dev/urandom adds entropy to
1356  * the read side, and when it wants new entropy, on the write side.
1359  * adding entropy, getting the entropy count, zeroing the count, and
1575  * - poolsize - the number of bits of entropy that the input pool can
1578  * - entropy_avail - the number of bits of entropy currently in the
1581  * - write_wakeup_threshold - the amount of entropy in the input pool
1583  *   more entropy, tied to the POOL_READY_BITS constant. It is writable