1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * include/linux/prandom.h
4 *
5 * Include file for the fast pseudo-random 32-bit
6 * generation.
7 */
8 #ifndef _LINUX_PRANDOM_H
9 #define _LINUX_PRANDOM_H
10
11 #include <linux/types.h>
12 #include <linux/percpu.h>
13 #include <linux/siphash.h>
14
15 u32 prandom_u32(void);
16 void prandom_bytes(void *buf, size_t nbytes);
17 void prandom_seed(u32 seed);
18 void prandom_reseed_late(void);
19
20 DECLARE_PER_CPU(unsigned long, net_rand_noise);
21
22 #define PRANDOM_ADD_NOISE(a, b, c, d) \
23 prandom_u32_add_noise((unsigned long)(a), (unsigned long)(b), \
24 (unsigned long)(c), (unsigned long)(d))
25
26 #if BITS_PER_LONG == 64
27 /*
28 * The core SipHash round function. Each line can be executed in
29 * parallel given enough CPU resources.
30 */
31 #define PRND_SIPROUND(v0, v1, v2, v3) SIPHASH_PERMUTATION(v0, v1, v2, v3)
32
33 #define PRND_K0 (SIPHASH_CONST_0 ^ SIPHASH_CONST_2)
34 #define PRND_K1 (SIPHASH_CONST_1 ^ SIPHASH_CONST_3)
35
36 #elif BITS_PER_LONG == 32
37 /*
38 * On 32-bit machines, we use HSipHash, a reduced-width version of SipHash.
39 * This is weaker, but 32-bit machines are not used for high-traffic
40 * applications, so there is less output for an attacker to analyze.
41 */
42 #define PRND_SIPROUND(v0, v1, v2, v3) HSIPHASH_PERMUTATION(v0, v1, v2, v3)
43 #define PRND_K0 (HSIPHASH_CONST_0 ^ HSIPHASH_CONST_2)
44 #define PRND_K1 (HSIPHASH_CONST_1 ^ HSIPHASH_CONST_3)
45
46 #else
47 #error Unsupported BITS_PER_LONG
48 #endif
49
prandom_u32_add_noise(unsigned long a,unsigned long b,unsigned long c,unsigned long d)50 static inline void prandom_u32_add_noise(unsigned long a, unsigned long b,
51 unsigned long c, unsigned long d)
52 {
53 /*
54 * This is not used cryptographically; it's just
55 * a convenient 4-word hash function. (3 xor, 2 add, 2 rol)
56 */
57 a ^= raw_cpu_read(net_rand_noise);
58 PRND_SIPROUND(a, b, c, d);
59 raw_cpu_write(net_rand_noise, d);
60 }
61
62 struct rnd_state {
63 __u32 s1, s2, s3, s4;
64 };
65
66 u32 prandom_u32_state(struct rnd_state *state);
67 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
68 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
69
70 #define prandom_init_once(pcpu_state) \
71 DO_ONCE(prandom_seed_full_state, (pcpu_state))
72
73 /**
74 * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
75 * @ep_ro: right open interval endpoint
76 *
77 * Returns a pseudo-random number that is in interval [0, ep_ro). Note
78 * that the result depends on PRNG being well distributed in [0, ~0U]
79 * u32 space. Here we use maximally equidistributed combined Tausworthe
80 * generator, that is, prandom_u32(). This is useful when requesting a
81 * random index of an array containing ep_ro elements, for example.
82 *
83 * Returns: pseudo-random number in interval [0, ep_ro)
84 */
prandom_u32_max(u32 ep_ro)85 static inline u32 prandom_u32_max(u32 ep_ro)
86 {
87 return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
88 }
89
90 /*
91 * Handle minimum values for seeds
92 */
__seed(u32 x,u32 m)93 static inline u32 __seed(u32 x, u32 m)
94 {
95 return (x < m) ? x + m : x;
96 }
97
98 /**
99 * prandom_seed_state - set seed for prandom_u32_state().
100 * @state: pointer to state structure to receive the seed.
101 * @seed: arbitrary 64-bit value to use as a seed.
102 */
prandom_seed_state(struct rnd_state * state,u64 seed)103 static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
104 {
105 u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL;
106
107 state->s1 = __seed(i, 2U);
108 state->s2 = __seed(i, 8U);
109 state->s3 = __seed(i, 16U);
110 state->s4 = __seed(i, 128U);
111 PRANDOM_ADD_NOISE(state, i, 0, 0);
112 }
113
114 /* Pseudo random number generator from numerical recipes. */
next_pseudo_random32(u32 seed)115 static inline u32 next_pseudo_random32(u32 seed)
116 {
117 return seed * 1664525 + 1013904223;
118 }
119
120 #endif
121