Change Details

Is something like this what you had in mind? Do you object to the thread pflag approach to limiting false positives? I booted this in a small x86 test VM and did not observe any warnings. Perhaps the check should be in the direct arc4rand API calls rather than in randomstir?

Is something like this what you had in mind? Do you object to the thread pflag approach to limiting false positives? x86 VM victims: ``` Apr 17 17:24:41 testvm kernel: #1 0xffffffff80c15265 at witness_warn+0x285 Apr 17 17:24:41 testvm kernel: #2 0xffffffff80c93371 at arc4rand+0x41 Apr 17 17:24:41 testvm kernel: #3 0xffffffff80c93538 at arc4random+0x18 Apr 17 17:24:41 testvm kernel: #4 0xffffffff80d3dc4d at in_pcb_lport+0x2bd Apr 17 17:24:41 testvm kernel: #5 0xffffffff80e0ed2e at in6_pcbsetport+0x9e ... (Many other stacks that arrive in in_pcb_lport) ... Apr 17 17:24:41 testvm kernel: #3 0xffffffff80c93538 at arc4random+0x18 Apr 17 17:24:41 testvm kernel: #4 0xffffffff80e108b5 at initid+0x25 Apr 17 17:24:41 testvm kernel: #5 0xffffffff80e10b68 at randomid+0xd8 Apr 17 17:24:41 testvm kernel: #6 0xffffffff80e10bc0 at ip6_randomflowlabel+0x10 ... (and many duplicates) ... ``` I didn't see any other callers (but WITNESS_WARN is very spammy).

Is something like this what you had in mind? Do you object to the thread pflag approach to limiting false positives? I booted this in a small x86 test VM and did not observe any warnings.x86 VM victims: Perhaps the check should be in the direct arc4rand API calls rather than in``` randomstir?Apr 17 17:24:41 testvm kernel: #1 0xffffffff80c15265 at witness_warn+0x285 Apr 17 17:24:41 testvm kernel: #2 0xffffffff80c93371 at arc4rand+0x41 Apr 17 17:24:41 testvm kernel: #3 0xffffffff80c93538 at arc4random+0x18 Apr 17 17:24:41 testvm kernel: #4 0xffffffff80d3dc4d at in_pcb_lport+0x2bd Apr 17 17:24:41 testvm kernel: #5 0xffffffff80e0ed2e at in6_pcbsetport+0x9e ... (Many other stacks that arrive in in_pcb_lport) ... Apr 17 17:24:41 testvm kernel: #3 0xffffffff80c93538 at arc4random+0x18 Apr 17 17:24:41 testvm kernel: #4 0xffffffff80e108b5 at initid+0x25 Apr 17 17:24:41 testvm kernel: #5 0xffffffff80e10b68 at randomid+0xd8 Apr 17 17:24:41 testvm kernel: #6 0xffffffff80e10bc0 at ip6_randomflowlabel+0x10 ... (and many duplicates) ... ``` I didn't see any other callers (but WITNESS_WARN is very spammy).