12  *   - Entropy accumulation and extraction routines.
13  *   - Entropy collection routines.
19  * data is then "credited" as having a certain number of bits of entropy.
20  * When enough bits of entropy are available, the hash is finalized and
23  * entropy collectors, described below, add data to the input pool.
70  * being able to wait until the RNG has collected enough entropy and
80 	CRNG_EMPTY = 0, /* Little to no entropy collected */
119 /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
176  * These functions expand entropy from the entropy extractor into
471  * Batched entropy returns random integers. The quality of the random
486 	type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))];		\
515 	if (batch->position >= ARRAY_SIZE(batch->entropy) ||			\
517 		_get_random_bytes(batch->entropy, sizeof(batch->entropy));	\
522 	ret = batch->entropy[batch->position];					\
523 	batch->entropy[batch->position] = 0;					\
594  * Entropy accumulation and extraction routines.
596  * Callers may add entropy via:
600  * After which, if added entropy should be credited:
604  * Finally, extract entropy via:
648  * This is an HKDF-like construction for using the hashed collected entropy
744  * Entropy collection routines.
746  * The following exported functions are used for pushing entropy into
747  * the above entropy accumulation routines:
750  *	void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after);
760  * read-out of the RTC. This does *not* credit any actual entropy to
762  * that might otherwise be identical and have very little entropy
766  * entropy as specified by the caller. If the entropy pool is full it will
767  * block until more entropy is needed.
778  * inputs to the entropy pool. Using the cycle counters and the irq source
780  * interrupts, crediting 1 bit of entropy for whichever comes first.
787  * entropy pool. Note that high-speed solid state drives with very low
788  * seek times do not make for good sources of entropy, as their seek
791  * The last two routines try to estimate how many bits of entropy
812 	unsigned long flags, entropy = random_get_entropy();  in random_pm_notification()  local
823 	_mix_pool_bytes(&entropy, sizeof(entropy));  in random_pm_notification()
843 	unsigned long entropy[BLAKE2S_BLOCK_SIZE / sizeof(long)];  in random_init_early()  local
851 	for (i = 0, arch_bits = sizeof(entropy) * 8; i < ARRAY_SIZE(entropy);) {  in random_init_early()
852 		longs = arch_get_random_seed_longs(entropy, ARRAY_SIZE(entropy) - i);  in random_init_early()
854 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);  in random_init_early()
858 		longs = arch_get_random_longs(entropy, ARRAY_SIZE(entropy) - i);  in random_init_early()
860 			_mix_pool_bytes(entropy, sizeof(*entropy) * longs);  in random_init_early()
864 		arch_bits -= sizeof(*entropy) * 8;  in random_init_early()
884 	unsigned long entropy = random_get_entropy();  in random_init()  local
888 	_mix_pool_bytes(&entropy, sizeof(entropy));  in random_init()
905 	WARN(!entropy, "Missing cycle counter and fallback timer; RNG "  in random_init()
906 		       "entropy collection will consequently suffer.");  in random_init()
913  * None of this adds any entropy; it is meant to avoid the problem of
914  * the entropy pool having similar initial state across largely
919 	unsigned long entropy = random_get_entropy();  in add_device_randomness()  local
923 	_mix_pool_bytes(&entropy, sizeof(entropy));  in add_device_randomness()
934 void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy, bool sleep_after)  in add_hwgenerator_randomness()  argument
937 	credit_init_bits(entropy);  in add_hwgenerator_randomness()
941 	 * initialized or no entropy is credited.  in add_hwgenerator_randomness()
943 	if (sleep_after && !kthread_should_stop() && (crng_ready() || !entropy))  in add_hwgenerator_randomness()
1058 	 * the other half as the next "key" that carries over. The entropy is  in mix_interrupt_randomness()
1091 	unsigned long entropy = random_get_entropy();  in add_interrupt_randomness()  local
1096 	fast_mix(fast_pool->pool, entropy,  in add_interrupt_randomness()
1114 /* There is one of these per entropy source */
1121  * This function adds entropy to the entropy "pool" by using timing
1123  * of how many bits of entropy this call has added to the pool. The
1129 	unsigned long entropy = random_get_entropy(), now = jiffies, flags;  in add_timer_randomness()  local
1138 		fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);  in add_timer_randomness()
1141 		_mix_pool_bytes(&entropy, sizeof(entropy));  in add_timer_randomness()
1176 	 * on general principles, and limit entropy estimate to 11 bits.  in add_timer_randomness()
1223 	 * If kzalloc returns null, we just won't use that entropy  in rand_initialize_disk()
1235 	unsigned long entropy;  member
1244  * activity will be touching the stack of the CPU that is generating entropy.
1248  * want the timer to keep ticking unless the entropy loop is running.
1250  * So the re-arming always happens in the entropy loop itself.
1255 	unsigned long entropy = random_get_entropy();  in entropy_timer()  local
1257 	mix_pool_bytes(&entropy, sizeof(entropy));  in entropy_timer()
1263  * If we have an actual cycle counter, see if we can generate enough entropy
1276 		stack->entropy = random_get_entropy();  in try_to_generate_entropy()
1277 		if (stack->entropy != last)  in try_to_generate_entropy()
1279 		last = stack->entropy;  in try_to_generate_entropy()
1325 		mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));  in try_to_generate_entropy()
1327 		stack->entropy = random_get_entropy();  in try_to_generate_entropy()
1329 	mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));  in try_to_generate_entropy()
1352  * Writing to either /dev/random or /dev/urandom adds entropy to
1356  * the read side, and when it wants new entropy, on the write side.
1359  * adding entropy, getting the entropy count, zeroing the count, and
1577  * - poolsize - the number of bits of entropy that the input pool can
1580  * - entropy_avail - the number of bits of entropy currently in the
1583  * - write_wakeup_threshold - the amount of entropy in the input pool
1585  *   more entropy, tied to the POOL_READY_BITS constant. It is writable