Revert cprng_fast(9) to seed and reseed asynchronously in softint.

This reverts sys/crypto/cprng_fast/cprng_fast.c revisions 1.17-1.19.

I thought we had eliminated all paths into cprng_fast(9) from hard
interrupt context, which would allow us to call into cprng_strong(9)
and entropy(9) to synchronously reseed whenever needed -- this would
improve security over netbsd-9 for the first query to cprng_intr(9)
on each CPU.

Unfortunately, I missed the calls under spin locks (which are
effectively also hard interrupt context, in that they hold up
interrupts on this CPU or interrupt handlers trying to take the lock
on other CPUs). And one such spin lock is struct ifnet::ifq_lock at
IPL_NET, which is held by if_transmit when it calls IFQ_ENQUEUE which
calls into altq(4) which sometimes does, e.g., red_addq which calls
cprng_fast32.

Until we migrate ifq_lock to IPL_SOFTNET (which is potentially
feasible, because most of the network stack runs in softint now, but
it requires a lot of auditing and maybe changes to lots of drivers),
we'll have to make sure cprng_fast(9) doesn't try to take an adaptive
lock.

And the simplest way to ensure that is to just revert back to the
netbsd-9 semantics of asynchronously reseeding in softint, at the
cost of a potential security weakness. I don't expect this
regression to be permanent -- we just can't restore the change as is
until we deal with ifq_lock.

1.19 cprng_fast(9): Drop and retake percpu reference across cprng_strong.
1.18 cprng_fast(9): Assert not in pserialize read section.
1.17 cprng(9): cprng_fast is no longer used from interrupt context.

PR kern/58575: altq(4) takes adaptive lock while holding spin lock

branches: 1.19.6;
cprng_fast(9): Drop and retake percpu reference across cprng_strong.

cprng_strong may sleep on an adaptive lock (via entropy_extract),
which invalidates percpu(9) references.

Discovered by stumbling upon this panic in a test run:

panic: kernel diagnostic assertion "(cprng == percpu_getref(cprng_fast_percpu)) && (percpu_putref(cprng_fast_percpu), true)" failed: file "/home/riastradh/netbsd/current/src/sys/rump/librump/rumpkern/../../../crypto/cprng_fast/cprng_fast.c", line 117

XXX pullup-10

branches: 1.18.4;
cprng_fast(9): Assert not in pserialize read section.

This may sleep to take the global entropy lock in case it needs to be
reseeded. If that happens we can't be in a pserialize read section.

cprng(9): cprng_fast is no longer used from interrupt context.

Rip out logic to defer reseeding to softint.

Rewrite cprng_fast in terms of new ChaCha API.

Count cprng_fast reseed events.

Adapt cprng_fast to use entropy_epoch(), not rnd_initial_entropy.

This way it has an opportunity to be reseeded after boot.

More rnd.h user cleanup.

cprng_strong(kern_cprng, ...) never blocks, pass 0 for flags.

FASYNC was wrong anyway! It's FNONBLOCK.

branches: 1.11.2; 1.11.4;
Fix inconsistent use of inline in prototype and definition

Tweak cprng_fast_buf to use 32-bit unaligned writes if possible.

Move initial entropy bookkeeping out of the fast path.

Use percpu_foreach instead of manual iteration.

Access to struct cprng_fast must be consistently at IPL_VM.

branches: 1.6.2;
No need for cprng_fast_seed to be inline.

Include <sys/rnd.h>, don't copypasta declare rnd_initial_entropy.

Sort #includes.

define function consistently as inline

Merge tls-earlyentropy branch into HEAD.

branches: 1.1.2;
file cprng_fast.c was initially added on branch tls-earlyentropy.

branches: 1.2.4;
Merge tls-earlyentropy branch into HEAD.

branches: 1.1.2;
file cprng_fast.h was initially added on branch tls-earlyentropy.

Rewrite cprng_fast in terms of new ChaCha API.

branches: 1.2.4;
Merge tls-earlyentropy branch into HEAD.

branches: 1.1.2;
file files.cprng_fast was initially added on branch tls-earlyentropy.