1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * include/linux/prandom.h 4 * 5 * Include file for the fast pseudo-random 32-bit 6 * generation. 7 */ 8 #ifndef _LINUX_PRANDOM_H 9 #define _LINUX_PRANDOM_H 10 11 #include <linux/types.h> 12 #include <linux/percpu.h> 13 #include <linux/siphash.h> 14 15 u32 prandom_u32(void); 16 void prandom_bytes(void *buf, size_t nbytes); 17 void prandom_seed(u32 seed); 18 void prandom_reseed_late(void); 19 20 DECLARE_PER_CPU(unsigned long, net_rand_noise); 21 22 #define PRANDOM_ADD_NOISE(a, b, c, d) \ 23 prandom_u32_add_noise((unsigned long)(a), (unsigned long)(b), \ 24 (unsigned long)(c), (unsigned long)(d)) 25 26 #if BITS_PER_LONG == 64 27 /* 28 * The core SipHash round function. Each line can be executed in 29 * parallel given enough CPU resources. 30 */ 31 #define PRND_SIPROUND(v0, v1, v2, v3) SIPHASH_PERMUTATION(v0, v1, v2, v3) 32 33 #define PRND_K0 (SIPHASH_CONST_0 ^ SIPHASH_CONST_2) 34 #define PRND_K1 (SIPHASH_CONST_1 ^ SIPHASH_CONST_3) 35 36 #elif BITS_PER_LONG == 32 37 /* 38 * On 32-bit machines, we use HSipHash, a reduced-width version of SipHash. 39 * This is weaker, but 32-bit machines are not used for high-traffic 40 * applications, so there is less output for an attacker to analyze. 41 */ 42 #define PRND_SIPROUND(v0, v1, v2, v3) HSIPHASH_PERMUTATION(v0, v1, v2, v3) 43 #define PRND_K0 (HSIPHASH_CONST_0 ^ HSIPHASH_CONST_2) 44 #define PRND_K1 (HSIPHASH_CONST_1 ^ HSIPHASH_CONST_3) 45 46 #else 47 #error Unsupported BITS_PER_LONG 48 #endif 49 50 static inline void prandom_u32_add_noise(unsigned long a, unsigned long b, 51 unsigned long c, unsigned long d) 52 { 53 /* 54 * This is not used cryptographically; it's just 55 * a convenient 4-word hash function. (3 xor, 2 add, 2 rol) 56 */ 57 a ^= raw_cpu_read(net_rand_noise); 58 PRND_SIPROUND(a, b, c, d); 59 raw_cpu_write(net_rand_noise, d); 60 } 61 62 struct rnd_state { 63 __u32 s1, s2, s3, s4; 64 }; 65 66 u32 prandom_u32_state(struct rnd_state *state); 67 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); 68 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); 69 70 #define prandom_init_once(pcpu_state) \ 71 DO_ONCE(prandom_seed_full_state, (pcpu_state)) 72 73 /** 74 * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro) 75 * @ep_ro: right open interval endpoint 76 * 77 * Returns a pseudo-random number that is in interval [0, ep_ro). Note 78 * that the result depends on PRNG being well distributed in [0, ~0U] 79 * u32 space. Here we use maximally equidistributed combined Tausworthe 80 * generator, that is, prandom_u32(). This is useful when requesting a 81 * random index of an array containing ep_ro elements, for example. 82 * 83 * Returns: pseudo-random number in interval [0, ep_ro) 84 */ 85 static inline u32 prandom_u32_max(u32 ep_ro) 86 { 87 return (u32)(((u64) prandom_u32() * ep_ro) >> 32); 88 } 89 90 /* 91 * Handle minimum values for seeds 92 */ 93 static inline u32 __seed(u32 x, u32 m) 94 { 95 return (x < m) ? x + m : x; 96 } 97 98 /** 99 * prandom_seed_state - set seed for prandom_u32_state(). 100 * @state: pointer to state structure to receive the seed. 101 * @seed: arbitrary 64-bit value to use as a seed. 102 */ 103 static inline void prandom_seed_state(struct rnd_state *state, u64 seed) 104 { 105 u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL; 106 107 state->s1 = __seed(i, 2U); 108 state->s2 = __seed(i, 8U); 109 state->s3 = __seed(i, 16U); 110 state->s4 = __seed(i, 128U); 111 PRANDOM_ADD_NOISE(state, i, 0, 0); 112 } 113 114 /* Pseudo random number generator from numerical recipes. */ 115 static inline u32 next_pseudo_random32(u32 seed) 116 { 117 return seed * 1664525 + 1013904223; 118 } 119 120 #endif 121