VIA RNG testers needed

[Thor Lancelot Simon <tls%panix.com@localhost>]

Please see attached a patch which (among other things) reworks our support
for the onboard random number generator in the VIA C3 and later CPUs.  I
have no way to test that part of the patch and I would really appreciate
some help from anyone who can.

I'd particularly appreciate testing on older systems such as C3 and on
newer ones (late-model C7, Nano, etc.) that have dual noise sources.

A fuller discussion of the other parts of the patch can be found on
tech-kern, tech-security, and tech-crypto.

-- 
  Thor Lancelot Simon	                                     tls%panix.com@localhost

  "We cannot usually in social life pursue a single value or a single moral
   aim, untroubled by the need to compromise with others."      - H.L.A. Hart

Index: arch/amd64/include/Makefile
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/amd64/include/Makefile,v
retrieving revision 1.18
diff -u -p -r1.18 Makefile
--- arch/amd64/include/Makefile	23 Jul 2014 18:19:43 -0000	1.18
+++ arch/amd64/include/Makefile	19 Dec 2015 22:17:36 -0000
@@ -4,7 +4,7 @@ INCSDIR= /usr/include/amd64
 
 INCS=	ansi.h aout_machdep.h asm.h \
 	bootinfo.h bswap.h byte_swap.h \
-	cdefs.h cpu.h \
+	cdefs.h cpu.h cpu_rng.h\
 	disklabel.h \
 	elf_machdep.h endian.h endian_machdep.h \
 	float.h fpu.h frame.h frame_regs.h \
Index: arch/amd64/include/types.h
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/amd64/include/types.h,v
retrieving revision 1.48
diff -u -p -r1.48 types.h
--- arch/amd64/include/types.h	27 Aug 2015 12:30:50 -0000	1.48
+++ arch/amd64/include/types.h	19 Dec 2015 21:39:37 -0000
@@ -93,6 +93,7 @@ typedef	unsigned char		__cpu_simple_lock
 #define	__HAVE_TLS_VARIANT_II
 #define	__HAVE_COMMON___TLS_GET_ADDR
 #define	__HAVE_INTR_CONTROL
+#define __HAVE_CPU_RNG
 
 #ifdef _KERNEL_OPT
 #define	__HAVE_RAS
Index: arch/i386/include/Makefile
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/i386/include/Makefile,v
retrieving revision 1.43
diff -u -p -r1.43 Makefile
--- arch/i386/include/Makefile	23 Jul 2014 18:19:44 -0000	1.43
+++ arch/i386/include/Makefile	19 Dec 2015 22:16:58 -0000
@@ -4,7 +4,7 @@ INCSDIR= /usr/include/i386
 
 INCS=	ansi.h aout_machdep.h apmvar.h asm.h \
 	bioscall.h bootinfo.h bswap.h byte_swap.h \
-	cdefs.h cpu.h cputypes.h \
+	cdefs.h cpu.h cpu_rng.h cputypes.h \
 	disklabel.h \
 	elf_machdep.h endian.h endian_machdep.h \
 	fenv.h float.h frame.h freebsd_machdep.h \
Index: arch/i386/include/types.h
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/i386/include/types.h,v
retrieving revision 1.83
diff -u -p -r1.83 types.h
--- arch/i386/include/types.h	27 Aug 2015 12:30:51 -0000	1.83
+++ arch/i386/include/types.h	19 Dec 2015 21:40:33 -0000
@@ -109,6 +109,8 @@ typedef	unsigned char		__cpu_simple_lock
 #define	__HAVE_SYSCALL_INTERN
 #define	__HAVE_MINIMAL_EMUL
 #define	__HAVE_OLD_DISKLABEL
+#define __HAVE_CPU_RNG
+
 #if defined(_KERNEL)
 /*
  * Processors < i586 do not have cmpxchg8b, and we compile for i486
Index: arch/x86/conf/files.x86
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/x86/conf/files.x86,v
retrieving revision 1.85
diff -u -p -r1.85 files.x86
--- arch/x86/conf/files.x86	11 Nov 2015 08:20:22 -0000	1.85
+++ arch/x86/conf/files.x86	25 Dec 2015 22:32:35 -0000
@@ -27,6 +27,7 @@ define  ipmibus {}
 device	cpu: cpufeaturebus
 attach	cpu at cpubus
 file 	arch/x86/x86/cpu.c 		cpu
+file	arch/x86/x86/cpu_rng.c		cpu
 
 device	acpicpu: acpi
 attach	acpicpu at cpufeaturebus
Index: arch/x86/include/Makefile
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/x86/include/Makefile,v
retrieving revision 1.19
diff -u -p -r1.19 Makefile
--- arch/x86/include/Makefile	11 Feb 2014 20:17:16 -0000	1.19
+++ arch/x86/include/Makefile	19 Dec 2015 21:46:23 -0000
@@ -7,6 +7,7 @@ INCS=	aout_machdep.h \
 	cacheinfo.h \
 	cpu.h \
 	cpu_extended_state.h \
+	cpu_rng.h \
 	cpu_ucode.h \
 	cputypes.h \
 	cpuvar.h \
Index: arch/x86/include/cpu_rng.h
===================================================================
RCS file: arch/x86/include/cpu_rng.h
diff -N arch/x86/include/cpu_rng.h
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ arch/x86/include/cpu_rng.h	25 Dec 2015 22:57:30 -0000
@@ -0,0 +1,49 @@
+/* $NetBSD: $ */
+
+#ifndef _X86_CPURNG_H_
+#define _X86_CPURNG_H_
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Thor Lancelot Simon.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/cpu.h>
+
+#include <x86/specialreg.h>
+
+#include <machine/cpufunc.h>
+#include <machine/cpuvar.h>
+
+typedef uint64_t cpu_rng_t;
+
+void cpu_rng_init(void);
+size_t cpu_rng(cpu_rng_t *);
+
+#endif
Index: arch/x86/include/via_padlock.h
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/x86/include/via_padlock.h,v
retrieving revision 1.8
diff -u -p -r1.8 via_padlock.h
--- arch/x86/include/via_padlock.h	13 Apr 2015 16:03:51 -0000	1.8
+++ arch/x86/include/via_padlock.h	25 Dec 2015 22:10:56 -0000
@@ -59,11 +59,6 @@ struct via_padlock_softc {
 	uint8_t	op_iv[16];	/* 128 bit aligned */
 	void		*op_buf;
 
-	int			sc_rnd_hz;
-	struct callout		sc_rnd_co;
-	krndsource_t	sc_rnd_source;
-	bool			sc_rnd_attached;
-
 	/* normal softc stuff */
 	int32_t		sc_cid;
 	bool		sc_cid_attached;
@@ -74,8 +69,6 @@ struct via_padlock_softc {
 #define VIAC3_SESSION(sid)	((sid) & 0x0fffffff)
 #define VIAC3_SID(crd,ses)	(((crd) << 28) | ((ses) & 0x0fffffff))
 
-#define VIAC3_RNG_BUFSIZ	16
-
 #endif /* _KERNEL */
 
 #if defined(_KERNEL) || defined(_KMEMUSER)
Index: arch/x86/x86/cpu_rng.c
===================================================================
RCS file: arch/x86/x86/cpu_rng.c
diff -N arch/x86/x86/cpu_rng.c
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ arch/x86/x86/cpu_rng.c	25 Dec 2015 22:58:39 -0000
@@ -0,0 +1,166 @@
+/* $NetBSD: $ */
+
+/*-
+ * Copyright (c) 2015 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Thor Lancelot Simon.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * The VIA RNG code in this file is inspired by Jason Wright and
+ * Theo de Raadt's OpenBSD version but has been rewritten in light of
+ * comments from Henric Jungheim on the tech%openbsd.org@localhost mailing list.
+ */
+
+#include <machine/cpu_rng.h>
+
+static enum { CPU_RNG_NONE = 0,
+	      CPU_RNG_RDRAND,
+	      CPU_RNG_RDSEED,
+	      CPU_RNG_VIA } cpu_rng_mode = CPU_RNG_NONE;
+
+void
+cpu_rng_init(void)
+{
+	if (cpu_feature[5] & CPUID_SEF_RDSEED) {
+		cpu_rng_mode = CPU_RNG_RDSEED;
+		aprint_normal("cpu_rng: RDSEED\n");
+	} else
+
+	if (cpu_feature[1] & CPUID2_RDRAND) {
+		cpu_rng_mode = CPU_RNG_RDRAND;
+		aprint_normal("cpu_rng: RDRAND\n");
+	} else
+
+	if (cpu_feature[4] & CPUID_VIA_HAS_RNG) {
+		cpu_rng_mode = CPU_RNG_VIA;
+		aprint_normal("cpu_rng: VIA\n");
+	}
+}
+
+static inline size_t
+cpu_rng_rdrand(cpu_rng_t *out)
+{
+	uint8_t rndsts;
+#ifndef __x86_64__
+	uint32_t outword[2] = out;
+	int i;
+
+	for (i = 0; i < 2; i++) {
+		__asm __volatile("rdrand %0; setc %1":"=r"(outword + i),
+				 "=qm"(rndsts));
+		if (rndsts != 1) return 0;
+	}
+#else
+	__asm __volatile("rdrand %0; setc %1":"=r"(out),
+			 "=qm"(rndsts));
+	if (rndsts != 1) return 0;
+#endif
+	return sizeof(*out) * NBBY;
+}
+
+static inline size_t
+cpu_rng_rdseed(cpu_rng_t *out)
+{
+	uint8_t rndsts;
+
+#ifndef __x86_64__
+	uint32_t outword[2] = out;
+	int i;
+
+	for (i = 0; i < 2; i++) {
+		__asm __volatile("rdseed %0; setc %1":"=r"(outword + i),
+				 "=qm"(rndsts));
+
+		/*
+		 * Userspace could have exhausted RDSEED, but the
+		 * CPU-internal generator feeding RDRAND is guaranteed
+		 * to be seeded even in this case.
+		 */
+		if (rndsts != 1) return cpu_rng_rdrand(out);
+	}
+#else
+	__asm __volatile("rdseed %0; setc %1":"=r"(out),
+			 "=qm"(rndsts));
+	if (rndsts != 1) return cpu_rng_rdrand(out);
+#endif
+	return sizeof(*out) * NBBY;
+}
+
+static size_t
+cpu_rng_via(cpu_rng_t *out)
+{
+	uint32_t creg0, rndsts;
+
+	/*
+	 * Sadly, we have to monkey with the coprocessor enable and fault
+	 * registers, which are really for the FPU, in order to read
+	 * from the RNG.
+	 *
+	 * Don't remove CR0_TS from the call below -- comments in the Linux
+	 * driver indicate that the xstorerng instruction can generate
+	 * spurious DNA faults though no FPU or SIMD state is changed
+	 * even if such a fault is generated.
+	 *
+	 */
+	kpreempt_disable();
+	x86_disable_intr();
+	creg0 = rcr0();
+	lcr0(creg0 & ~(CR0_EM|CR0_TS)); /* Permit access to SIMD/FPU path */
+	/*
+	 * Read one 8-byte buffer from the VIA RNG.
+	 */
+	__asm __volatile("xstorerng"
+			 : "=a" (rndsts), "+D" (out) : "d" (0) : "memory");
+	/* Put CR0 back how it was */
+	lcr0(creg0);
+	x86_enable_intr();
+	kpreempt_enable();
+
+	/*
+	 * The Cryptography Research paper on the VIA RNG estimates
+	 * 0.75 bits of entropy per output bit and advises users to
+	 * be "even more conservative".
+	 */
+	return rndsts & 0xf ? 0 : sizeof(cpu_rng_t) * NBBY / 2;
+}
+
+size_t
+cpu_rng(cpu_rng_t *out)
+{
+	switch (cpu_rng_mode) {
+	    case CPU_RNG_NONE:
+		return 0;
+	    case CPU_RNG_RDSEED:
+		return cpu_rng_rdseed(out);
+	    case CPU_RNG_RDRAND:
+		return cpu_rng_rdrand(out);
+	    case CPU_RNG_VIA:
+		return cpu_rng_via(out);
+	    default:
+		panic("cpu_rng: unknown mode %d", (int)cpu_rng_mode);
+	}
+}
Index: arch/x86/x86/identcpu.c
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/x86/x86/identcpu.c,v
retrieving revision 1.49
diff -u -p -r1.49 identcpu.c
--- arch/x86/x86/identcpu.c	13 Dec 2015 15:02:19 -0000	1.49
+++ arch/x86/x86/identcpu.c	25 Dec 2015 22:35:37 -0000
@@ -554,8 +554,15 @@ cpu_probe_c3(struct cpu_info *ci)
 		    /* Actually do the enables. */
 		    if (rng_enable) {
 			msr = rdmsr(MSR_VIA_RNG);
-			wrmsr(MSR_VIA_RNG, msr | MSR_VIA_RNG_ENABLE);
+			/* C7 stepping 8 and subsequent CPUs have dual RNG */
+			if (model > 0xA || (model == 0xA && stepping > 0x7)) {
+				wrmsr(MSR_VIA_RNG, msr | MSR_VIA_RNG_ENABLE |
+						   MSR_VIA_RNG_2NOISE);
+			} else {
+				wrmsr(MSR_VIA_RNG, msr | MSR_VIA_RNG_ENABLE);
+			}
 		    }
+
 		    if (ace_enable) {
 			msr = rdmsr(MSR_VIA_ACE);
 			wrmsr(MSR_VIA_ACE, msr | MSR_VIA_ACE_ENABLE);
Index: arch/x86/x86/via_padlock.c
===================================================================
RCS file: /Volumes/NB/repo/src/sys/arch/x86/x86/via_padlock.c,v
retrieving revision 1.24
diff -u -p -r1.24 via_padlock.c
--- arch/x86/x86/via_padlock.c	13 Apr 2015 16:03:51 -0000	1.24
+++ arch/x86/x86/via_padlock.c	25 Dec 2015 22:09:52 -0000
@@ -28,7 +28,6 @@ __KERNEL_RCSID(0, "$NetBSD: via_padlock.
 #include <sys/kernel.h>
 #include <sys/device.h>
 #include <sys/module.h>
-#include <sys/rndsource.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/cpu.h>
@@ -72,64 +71,6 @@ static	__inline void via_padlock_cbc(voi
 	    void *);
 
 static void
-via_c3_rnd(void *arg)
-{
-	struct via_padlock_softc *sc = arg;
-
-	uint32_t creg0, len = VIAC3_RNG_BUFSIZ;
-	uint32_t buffer[VIAC3_RNG_BUFSIZ/4 + 1]; /* CPU goes 3 bytes beyond */
-	uint32_t eax, ecx, edi; /* XXX write-only, but necessary it seems */
-
-	/*
-	 * Sadly, we have to monkey with the coprocessor enable and fault
-	 * registers, which are really for the FPU, in order to read
-	 * from the RNG.
-	 *
-	 * Don't remove CR0_TS from the call below -- comments in the Linux
-	 * driver indicate that the xstorerng instruction can generate
-	 * spurious DNA faults though no FPU or SIMD state is changed
-	 * even if such a fault is generated.
-	 *
-	 */
-	kpreempt_disable();
-	x86_disable_intr();
-	creg0 = rcr0();
-	lcr0(creg0 & ~(CR0_EM|CR0_TS));	/* Permit access to SIMD/FPU path */
-	/*
-	 * Collect the random data from the C3 RNG into our buffer.
-	 * We turn on maximum whitening (is this actually desirable
-	 * if we will feed the data to SHA1?) (%edx[0,1] = "11").
-	 */
-	__asm __volatile("rep xstorerng"
-			 : "=a" (eax), "=c" (ecx), "=D" (edi)
-			 : "d" (3), "D" (buffer), "c" (len)
-			 : "memory", "cc");
-	/* Put CR0 back how it was */
-	lcr0(creg0);
-	x86_enable_intr();
-	kpreempt_enable();
-	rnd_add_data(&sc->sc_rnd_source, buffer, len, len * NBBY);
-	callout_reset(&sc->sc_rnd_co, sc->sc_rnd_hz, via_c3_rnd, sc);
-}
-
-static void
-via_c3_rnd_init(struct via_padlock_softc *sc)
-{
-	sc->sc_rnd_attached = true;
-
-	if (hz >= 100) {
-	    sc->sc_rnd_hz = 10 * hz / 100;
-	} else {
-	    sc->sc_rnd_hz = 10;
-	}
-	rnd_attach_source(&sc->sc_rnd_source, device_xname(sc->sc_dev),
-			  RND_TYPE_RNG, RND_FLAG_COLLECT_VALUE);
-	callout_init(&sc->sc_rnd_co, 0);
-	/* Call once to prime the pool early and set callout. */
-	via_c3_rnd(sc);
-}
-
-static void
 via_c3_ace_init(struct via_padlock_softc *sc)
 {
 	/*
@@ -608,7 +549,6 @@ via_padlock_attach_intr(device_t self)
 
 	aprint_normal("%s:", device_xname(self));
 	if (cpu_feature[4] & CPUID_VIA_HAS_RNG) {
-		via_c3_rnd_init(sc);
 		aprint_normal(" RNG");
 	}
 	if (cpu_feature[4] & CPUID_VIA_HAS_ACE) {
@@ -623,12 +563,6 @@ via_padlock_detach(device_t self, int fl
 {
 	struct via_padlock_softc *sc = device_private(self);
 
-	if (sc->sc_rnd_attached) {
-		callout_halt(&sc->sc_rnd_co, NULL);
-		callout_destroy(&sc->sc_rnd_co);
-		rnd_detach_source(&sc->sc_rnd_source);
-		sc->sc_rnd_attached = false;
-	}
 	if (sc->sc_cid_attached) {
 		crypto_unregister(sc->sc_cid, CRYPTO_AES_CBC);
 		crypto_unregister(sc->sc_cid, CRYPTO_MD5_HMAC_96);
Index: kern/kern_rndq.c
===================================================================
RCS file: /Volumes/NB/repo/src/sys/kern/kern_rndq.c,v
retrieving revision 1.73
diff -u -p -r1.73 kern_rndq.c
--- kern/kern_rndq.c	29 Aug 2015 10:00:19 -0000	1.73
+++ kern/kern_rndq.c	25 Dec 2015 20:04:08 -0000
@@ -59,6 +59,10 @@ __KERNEL_RCSID(0, "$NetBSD: kern_rndq.c,
 #include <compat/sys/rnd.h>
 #endif
 
+#if defined(__HAVE_CPU_RNG)
+#include <machine/cpu_rng.h>
+#endif
+
 #if defined(__HAVE_CPU_COUNTER)
 #include <machine/cpu_counter.h>
 #endif
@@ -404,6 +408,31 @@ rnd_dv_estimate(krndsource_t *rs, uint32
 	return ret;
 }
 
+#if defined(__HAVE_CPU_RNG)
+krndsource_t rnd_cpu_source;
+
+static void
+rnd_cpu_get(size_t bytes, void *priv)
+{
+        krndsource_t *cpusrcp = priv;
+	size_t entropy = 0, cnt  = RND_POOLBITS / 2 / NBBY / sizeof(cpu_rng_t);
+	cpu_rng_t buf[cnt];
+
+        KASSERT(cpusrcp == &rnd_cpu_source);
+        if (RND_ENABLED(cpusrcp)) {
+		cpu_rng_t *bufp = buf;
+		for (bufp = buf; bufp < buf + cnt; bufp++) {
+			entropy += cpu_rng(bufp);
+		}
+		if (__predict_true(entropy)) {
+			rnd_add_data(cpusrcp, buf, sizeof(buf), entropy);
+		}
+	explicit_memset(buf, 0, sizeof(buf));
+        }
+}
+
+#endif
+
 #if defined(__HAVE_CPU_COUNTER)
 static struct {
 	kmutex_t	lock;
@@ -550,6 +579,27 @@ rnd_init(void)
 	}
 
 	/*
+	 * Attach CPU RNG if available.
+	 */
+#if defined(__HAVE_CPU_RNG)
+	{
+		cpu_rng_t test;
+
+		cpu_rng_init();
+		if (cpu_rng(&test)) {
+			rndsource_setcb(&rnd_cpu_source, rnd_cpu_get,
+					&rnd_cpu_source);
+			rnd_attach_source(&rnd_cpu_source, "cpurng",
+					  RND_TYPE_RNG,
+					  RND_FLAG_COLLECT_VALUE|
+					  RND_FLAG_HASCB|RND_FLAG_HASENABLE);
+			rnd_cpu_get(RND_POOLBITS / NBBY, &rnd_cpu_source);
+		}
+		explicit_memset(&test, 0, sizeof(test));
+	}
+#endif
+
+	/*
 	 * If we have a cycle counter, take its error with respect
 	 * to the callout mechanism as a source of entropy, ala
 	 * TrueRand.