12  *   - Entropy accumulation and extraction routines.
13  *   - Entropy collection routines.
19  * data is then "credited" as having a certain number of bits of entropy.
20  * When enough bits of entropy are available, the hash is finalized and
23  * entropy collectors, described below, add data to the input pool.
75  * being able to wait until the RNG has collected enough entropy and
85 	CRNG_EMPTY = 0, /* Little to no entropy collected */
124 /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
181  * These functions expand entropy from the entropy extractor into
492  * Batched entropy returns random integers. The quality of the random
507 	type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))];		\
536 	if (batch->position >= ARRAY_SIZE(batch->entropy) ||			\
538 		_get_random_bytes(batch->entropy, sizeof(batch->entropy));	\
543 	ret = batch->entropy[batch->position];					\
544 	batch->entropy[batch->position] = 0;					\
615  * Entropy accumulation and extraction routines.
617  * Callers may add entropy via:
621  * After which, if added entropy should be credited:
625  * Finally, extract entropy via:
669  * This is an HKDF-like construction for using the hashed collected entropy
768  * Entropy collection routines.
770  * The following exported functions are used for pushing entropy into
771  * the above entropy accumulation routines:
774  *	void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after);
784  * read-out of the RTC. This does *not* credit any actual entropy to
786  * that might otherwise be identical and have very little entropy
790  * entropy as specified by the caller. If the entropy pool is full it will
791  * block until more entropy is needed.
802  * inputs to the entropy pool. Using the cycle counters and the irq source
804  * interrupts, crediting 1 bit of entropy for whichever comes first.
811  * entropy pool. Note that high-speed solid state drives with very low
812  * seek times do not make for good sources of entropy, as their seek
815  * The last two routines try to estimate how many bits of entropy
836 	unsigned long flags, entropy = random_get_entropy();  in random_pm_notification()  local
847 	_mix_pool_bytes(&entropy, sizeof(entropy));  in random_pm_notification()
867 	unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)];  in random_init_early()  local
875 	for (i = 0, arch_bits = sizeof(entropy) * 8; i < ARRAY_SIZE(entropy);) {  in random_init_early()
876 		longs = arch_get_random_seed_longs(entropy, ARRAY_SIZE(entropy) - i);  in random_init_early()
878 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);  in random_init_early()
882 		longs = arch_get_random_longs(entropy, ARRAY_SIZE(entropy) - i);  in random_init_early()
884 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);  in random_init_early()
888 		arch_bits -= sizeof(*entropy) * 8;  in random_init_early()
908 	unsigned long entropy = random_get_entropy();  in random_init()  local
912 	_mix_pool_bytes(&entropy, sizeof(entropy));  in random_init()
929 	WARN(!entropy, "Missing cycle counter and fallback timer; RNG "  in random_init()
930 		       "entropy collection will consequently suffer.");  in random_init()
937  * None of this adds any entropy; it is meant to avoid the problem of
938  * the entropy pool having similar initial state across largely
943 	unsigned long entropy = random_get_entropy();  in add_device_randomness()  local
947 	_mix_pool_bytes(&entropy, sizeof(entropy));  in add_device_randomness()
958 void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after)  in add_hwgenerator_randomness()  argument
961 	credit_init_bits(entropy);  in add_hwgenerator_randomness()
965 	 * initialized or no entropy is credited.  in add_hwgenerator_randomness()
967 	if (sleep_after && !kthread_should_stop() && (crng_ready() || !entropy))  in add_hwgenerator_randomness()
1082 	 * the other half as the next "key" that carries over. The entropy is  in mix_interrupt_randomness()
1115 	unsigned long entropy = random_get_entropy();  in add_interrupt_randomness()  local
1120 	fast_mix(fast_pool->pool, entropy,  in add_interrupt_randomness()
1138 /* There is one of these per entropy source */
1145  * This function adds entropy to the entropy "pool" by using timing
1147  * of how many bits of entropy this call has added to the pool. The
1153 	unsigned long entropy = random_get_entropy(), now = jiffies, flags;  in add_timer_randomness()  local
1162 		fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);  in add_timer_randomness()
1165 		_mix_pool_bytes(&entropy, sizeof(entropy));  in add_timer_randomness()
1200 	 * on general principles, and limit entropy estimate to 11 bits.  in add_timer_randomness()
1247 	 * If kzalloc returns null, we just won't use that entropy  in rand_initialize_disk()
1259 	unsigned long entropy;  member
1268  * activity will be touching the stack of the CPU that is generating entropy.
1272  * want the timer to keep ticking unless the entropy loop is running.
1274  * So the re-arming always happens in the entropy loop itself.
1279 	unsigned long entropy = random_get_entropy();  in entropy_timer()  local
1281 	mix_pool_bytes(&entropy, sizeof(entropy));  in entropy_timer()
1287  * If we have an actual cycle counter, see if we can generate enough entropy
1300 		stack->entropy = random_get_entropy();  in try_to_generate_entropy()
1301 		if (stack->entropy != last)  in try_to_generate_entropy()
1303 		last = stack->entropy;  in try_to_generate_entropy()
1349 		mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));  in try_to_generate_entropy()
1351 		stack->entropy = random_get_entropy();  in try_to_generate_entropy()
1353 	mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));  in try_to_generate_entropy()
1376  * Writing to either /dev/random or /dev/urandom adds entropy to
1380  * the read side, and when it wants new entropy, on the write side.
1383  * adding entropy, getting the entropy count, zeroing the count, and
1599  * - poolsize - the number of bits of entropy that the input pool can
1602  * - entropy_avail - the number of bits of entropy currently in the
1605  * - write_wakeup_threshold - the amount of entropy in the input pool
1607  *   more entropy, tied to the POOL_READY_BITS constant. It is writable