12  *   - Entropy accumulation and extraction routines.
13  *   - Entropy collection routines.
19  * data is then "credited" as having a certain number of bits of entropy.
20  * When enough bits of entropy are available, the hash is finalized and
23  * entropy collectors, described below, add data to the input pool.
68  * being able to wait until the RNG has collected enough entropy and
78 	CRNG_EMPTY = 0, /* Little to no entropy collected */
112 /* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
194  * These functions expand entropy from the entropy extractor into
494  * Batched entropy returns random integers. The quality of the random
509 	type entropy[CHACHA_BLOCK_SIZE * 3 / (2 * sizeof(type))];		\
538 	if (batch->position >= ARRAY_SIZE(batch->entropy) ||			\
540 		_get_random_bytes(batch->entropy, sizeof(batch->entropy));	\
545 	ret = batch->entropy[batch->position];					\
546 	batch->entropy[batch->position] = 0;					\
605  * Entropy accumulation and extraction routines.
607  * Callers may add entropy via:
611  * After which, if added entropy should be credited:
615  * Finally, extract entropy via:
659  * This is an HKDF-like construction for using the hashed collected entropy
744  * Entropy collection routines.
746  * The following exported functions are used for pushing entropy into
747  * the above entropy accumulation routines:
750  *	void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy);
759  * read-out of the RTC. This does *not* credit any actual entropy to
761  * that might otherwise be identical and have very little entropy
765  * entropy as specified by the caller. If the entropy pool is full it will
766  * block until more entropy is needed.
773  * inputs to the entropy pool. Using the cycle counters and the irq source
775  * interrupts, crediting 1 bit of entropy for whichever comes first.
782  * entropy pool. Note that high-speed solid state drives with very low
783  * seek times do not make for good sources of entropy, as their seek
786  * The last two routines try to estimate how many bits of entropy
806  * The first collection of entropy occurs at system boot while interrupts
807  * are still turned off. Here we push in latent entropy, RDSEED, a timestamp,
810  * earlier setup may already have pushed entropy into the input pool by the
817 	unsigned long entropy;  in random_init()  local
825 	     i < BLAKE2S_BLOCK_SIZE; i += sizeof(entropy)) {  in random_init()
826 		if (!arch_get_random_seed_long_early(&entropy) &&  in random_init()
827 		    !arch_get_random_long_early(&entropy)) {  in random_init()
828 			entropy = random_get_entropy();  in random_init()
829 			arch_bytes -= sizeof(entropy);  in random_init()
831 		_mix_pool_bytes(&entropy, sizeof(entropy));  in random_init()
850  * None of this adds any entropy; it is meant to avoid the problem of
851  * the entropy pool having similar initial state across largely
856 	unsigned long entropy = random_get_entropy();  in add_device_randomness()  local
860 	_mix_pool_bytes(&entropy, sizeof(entropy));  in add_device_randomness()
871 void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy)  in add_hwgenerator_randomness()  argument
874 	credit_init_bits(entropy);  in add_hwgenerator_randomness()
962 	 * the other half as the next "key" that carries over. The entropy is  in mix_interrupt_randomness()
995 	unsigned long entropy = random_get_entropy();  in add_interrupt_randomness()  local
1000 	fast_mix(fast_pool->pool, entropy,  in add_interrupt_randomness()
1018 /* There is one of these per entropy source */
1025  * This function adds entropy to the entropy "pool" by using timing
1027  * of how many bits of entropy this call has added to the pool. The
1033 	unsigned long entropy = random_get_entropy(), now = jiffies, flags;  in add_timer_randomness()  local
1042 		fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);  in add_timer_randomness()
1045 		_mix_pool_bytes(&entropy, sizeof(entropy));  in add_timer_randomness()
1080 	 * on general principles, and limit entropy estimate to 11 bits.  in add_timer_randomness()
1127 	 * If kzalloc returns null, we just won't use that entropy  in rand_initialize_disk()
1142  * generating entropy..
1147  * entropy loop is running.
1149  * So the re-arming always happens in the entropy loop itself.
1158  * generate enough entropy with timing noise
1163 		unsigned long entropy;  in try_to_generate_entropy()  member
1167 	stack.entropy = random_get_entropy();  in try_to_generate_entropy()
1170 	if (stack.entropy == random_get_entropy())  in try_to_generate_entropy()
1177 		mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));  in try_to_generate_entropy()
1179 		stack.entropy = random_get_entropy();  in try_to_generate_entropy()
1184 	mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));  in try_to_generate_entropy()
1204  * Writing to either /dev/random or /dev/urandom adds entropy to
1208  * the read side, and when it wants new entropy, on the write side.
1211  * adding entropy, getting the entropy count, zeroing the count, and
1422  * - poolsize - the number of bits of entropy that the input pool can
1425  * - entropy_avail - the number of bits of entropy currently in the
1428  * - write_wakeup_threshold - the amount of entropy in the input pool
1430  *   more entropy, tied to the POOL_READY_BITS constant. It is writable