Branch data Line data Source code
1 : : /*
2 : : * random.c -- A strong random number generator
3 : : *
4 : : * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
5 : : *
6 : : * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999. All
7 : : * rights reserved.
8 : : *
9 : : * Redistribution and use in source and binary forms, with or without
10 : : * modification, are permitted provided that the following conditions
11 : : * are met:
12 : : * 1. Redistributions of source code must retain the above copyright
13 : : * notice, and the entire permission notice in its entirety,
14 : : * including the disclaimer of warranties.
15 : : * 2. Redistributions in binary form must reproduce the above copyright
16 : : * notice, this list of conditions and the following disclaimer in the
17 : : * documentation and/or other materials provided with the distribution.
18 : : * 3. The name of the author may not be used to endorse or promote
19 : : * products derived from this software without specific prior
20 : : * written permission.
21 : : *
22 : : * ALTERNATIVELY, this product may be distributed under the terms of
23 : : * the GNU General Public License, in which case the provisions of the GPL are
24 : : * required INSTEAD OF the above restrictions. (This clause is
25 : : * necessary due to a potential bad interaction between the GPL and
26 : : * the restrictions contained in a BSD-style copyright.)
27 : : *
28 : : * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
29 : : * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
30 : : * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
31 : : * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
32 : : * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
33 : : * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
34 : : * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
35 : : * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
36 : : * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 : : * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
38 : : * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
39 : : * DAMAGE.
40 : : */
41 : :
42 : : /*
43 : : * (now, with legal B.S. out of the way.....)
44 : : *
45 : : * This routine gathers environmental noise from device drivers, etc.,
46 : : * and returns good random numbers, suitable for cryptographic use.
47 : : * Besides the obvious cryptographic uses, these numbers are also good
48 : : * for seeding TCP sequence numbers, and other places where it is
49 : : * desirable to have numbers which are not only random, but hard to
50 : : * predict by an attacker.
51 : : *
52 : : * Theory of operation
53 : : * ===================
54 : : *
55 : : * Computers are very predictable devices. Hence it is extremely hard
56 : : * to produce truly random numbers on a computer --- as opposed to
57 : : * pseudo-random numbers, which can easily generated by using a
58 : : * algorithm. Unfortunately, it is very easy for attackers to guess
59 : : * the sequence of pseudo-random number generators, and for some
60 : : * applications this is not acceptable. So instead, we must try to
61 : : * gather "environmental noise" from the computer's environment, which
62 : : * must be hard for outside attackers to observe, and use that to
63 : : * generate random numbers. In a Unix environment, this is best done
64 : : * from inside the kernel.
65 : : *
66 : : * Sources of randomness from the environment include inter-keyboard
67 : : * timings, inter-interrupt timings from some interrupts, and other
68 : : * events which are both (a) non-deterministic and (b) hard for an
69 : : * outside observer to measure. Randomness from these sources are
70 : : * added to an "entropy pool", which is mixed using a CRC-like function.
71 : : * This is not cryptographically strong, but it is adequate assuming
72 : : * the randomness is not chosen maliciously, and it is fast enough that
73 : : * the overhead of doing it on every interrupt is very reasonable.
74 : : * As random bytes are mixed into the entropy pool, the routines keep
75 : : * an *estimate* of how many bits of randomness have been stored into
76 : : * the random number generator's internal state.
77 : : *
78 : : * When random bytes are desired, they are obtained by taking the SHA
79 : : * hash of the contents of the "entropy pool". The SHA hash avoids
80 : : * exposing the internal state of the entropy pool. It is believed to
81 : : * be computationally infeasible to derive any useful information
82 : : * about the input of SHA from its output. Even if it is possible to
83 : : * analyze SHA in some clever way, as long as the amount of data
84 : : * returned from the generator is less than the inherent entropy in
85 : : * the pool, the output data is totally unpredictable. For this
86 : : * reason, the routine decreases its internal estimate of how many
87 : : * bits of "true randomness" are contained in the entropy pool as it
88 : : * outputs random numbers.
89 : : *
90 : : * If this estimate goes to zero, the routine can still generate
91 : : * random numbers; however, an attacker may (at least in theory) be
92 : : * able to infer the future output of the generator from prior
93 : : * outputs. This requires successful cryptanalysis of SHA, which is
94 : : * not believed to be feasible, but there is a remote possibility.
95 : : * Nonetheless, these numbers should be useful for the vast majority
96 : : * of purposes.
97 : : *
98 : : * Exported interfaces ---- output
99 : : * ===============================
100 : : *
101 : : * There are three exported interfaces; the first is one designed to
102 : : * be used from within the kernel:
103 : : *
104 : : * void get_random_bytes(void *buf, int nbytes);
105 : : *
106 : : * This interface will return the requested number of random bytes,
107 : : * and place it in the requested buffer.
108 : : *
109 : : * The two other interfaces are two character devices /dev/random and
110 : : * /dev/urandom. /dev/random is suitable for use when very high
111 : : * quality randomness is desired (for example, for key generation or
112 : : * one-time pads), as it will only return a maximum of the number of
113 : : * bits of randomness (as estimated by the random number generator)
114 : : * contained in the entropy pool.
115 : : *
116 : : * The /dev/urandom device does not have this limit, and will return
117 : : * as many bytes as are requested. As more and more random bytes are
118 : : * requested without giving time for the entropy pool to recharge,
119 : : * this will result in random numbers that are merely cryptographically
120 : : * strong. For many applications, however, this is acceptable.
121 : : *
122 : : * Exported interfaces ---- input
123 : : * ==============================
124 : : *
125 : : * The current exported interfaces for gathering environmental noise
126 : : * from the devices are:
127 : : *
128 : : * void add_device_randomness(const void *buf, unsigned int size);
129 : : * void add_input_randomness(unsigned int type, unsigned int code,
130 : : * unsigned int value);
131 : : * void add_interrupt_randomness(int irq, int irq_flags);
132 : : * void add_disk_randomness(struct gendisk *disk);
133 : : *
134 : : * add_device_randomness() is for adding data to the random pool that
135 : : * is likely to differ between two devices (or possibly even per boot).
136 : : * This would be things like MAC addresses or serial numbers, or the
137 : : * read-out of the RTC. This does *not* add any actual entropy to the
138 : : * pool, but it initializes the pool to different values for devices
139 : : * that might otherwise be identical and have very little entropy
140 : : * available to them (particularly common in the embedded world).
141 : : *
142 : : * add_input_randomness() uses the input layer interrupt timing, as well as
143 : : * the event type information from the hardware.
144 : : *
145 : : * add_interrupt_randomness() uses the interrupt timing as random
146 : : * inputs to the entropy pool. Using the cycle counters and the irq source
147 : : * as inputs, it feeds the randomness roughly once a second.
148 : : *
149 : : * add_disk_randomness() uses what amounts to the seek time of block
150 : : * layer request events, on a per-disk_devt basis, as input to the
151 : : * entropy pool. Note that high-speed solid state drives with very low
152 : : * seek times do not make for good sources of entropy, as their seek
153 : : * times are usually fairly consistent.
154 : : *
155 : : * All of these routines try to estimate how many bits of randomness a
156 : : * particular randomness source. They do this by keeping track of the
157 : : * first and second order deltas of the event timings.
158 : : *
159 : : * Ensuring unpredictability at system startup
160 : : * ============================================
161 : : *
162 : : * When any operating system starts up, it will go through a sequence
163 : : * of actions that are fairly predictable by an adversary, especially
164 : : * if the start-up does not involve interaction with a human operator.
165 : : * This reduces the actual number of bits of unpredictability in the
166 : : * entropy pool below the value in entropy_count. In order to
167 : : * counteract this effect, it helps to carry information in the
168 : : * entropy pool across shut-downs and start-ups. To do this, put the
169 : : * following lines an appropriate script which is run during the boot
170 : : * sequence:
171 : : *
172 : : * echo "Initializing random number generator..."
173 : : * random_seed=/var/run/random-seed
174 : : * # Carry a random seed from start-up to start-up
175 : : * # Load and then save the whole entropy pool
176 : : * if [ -f $random_seed ]; then
177 : : * cat $random_seed >/dev/urandom
178 : : * else
179 : : * touch $random_seed
180 : : * fi
181 : : * chmod 600 $random_seed
182 : : * dd if=/dev/urandom of=$random_seed count=1 bs=512
183 : : *
184 : : * and the following lines in an appropriate script which is run as
185 : : * the system is shutdown:
186 : : *
187 : : * # Carry a random seed from shut-down to start-up
188 : : * # Save the whole entropy pool
189 : : * echo "Saving random seed..."
190 : : * random_seed=/var/run/random-seed
191 : : * touch $random_seed
192 : : * chmod 600 $random_seed
193 : : * dd if=/dev/urandom of=$random_seed count=1 bs=512
194 : : *
195 : : * For example, on most modern systems using the System V init
196 : : * scripts, such code fragments would be found in
197 : : * /etc/rc.d/init.d/random. On older Linux systems, the correct script
198 : : * location might be in /etc/rcb.d/rc.local or /etc/rc.d/rc.0.
199 : : *
200 : : * Effectively, these commands cause the contents of the entropy pool
201 : : * to be saved at shut-down time and reloaded into the entropy pool at
202 : : * start-up. (The 'dd' in the addition to the bootup script is to
203 : : * make sure that /etc/random-seed is different for every start-up,
204 : : * even if the system crashes without executing rc.0.) Even with
205 : : * complete knowledge of the start-up activities, predicting the state
206 : : * of the entropy pool requires knowledge of the previous history of
207 : : * the system.
208 : : *
209 : : * Configuring the /dev/random driver under Linux
210 : : * ==============================================
211 : : *
212 : : * The /dev/random driver under Linux uses minor numbers 8 and 9 of
213 : : * the /dev/mem major number (#1). So if your system does not have
214 : : * /dev/random and /dev/urandom created already, they can be created
215 : : * by using the commands:
216 : : *
217 : : * mknod /dev/random c 1 8
218 : : * mknod /dev/urandom c 1 9
219 : : *
220 : : * Acknowledgements:
221 : : * =================
222 : : *
223 : : * Ideas for constructing this random number generator were derived
224 : : * from Pretty Good Privacy's random number generator, and from private
225 : : * discussions with Phil Karn. Colin Plumb provided a faster random
226 : : * number generator, which speed up the mixing function of the entropy
227 : : * pool, taken from PGPfone. Dale Worley has also contributed many
228 : : * useful ideas and suggestions to improve this driver.
229 : : *
230 : : * Any flaws in the design are solely my responsibility, and should
231 : : * not be attributed to the Phil, Colin, or any of authors of PGP.
232 : : *
233 : : * Further background information on this topic may be obtained from
234 : : * RFC 1750, "Randomness Recommendations for Security", by Donald
235 : : * Eastlake, Steve Crocker, and Jeff Schiller.
236 : : */
237 : :
238 : : #include <linux/utsname.h>
239 : : #include <linux/module.h>
240 : : #include <linux/kernel.h>
241 : : #include <linux/major.h>
242 : : #include <linux/string.h>
243 : : #include <linux/fcntl.h>
244 : : #include <linux/slab.h>
245 : : #include <linux/random.h>
246 : : #include <linux/poll.h>
247 : : #include <linux/init.h>
248 : : #include <linux/fs.h>
249 : : #include <linux/genhd.h>
250 : : #include <linux/interrupt.h>
251 : : #include <linux/mm.h>
252 : : #include <linux/spinlock.h>
253 : : #include <linux/percpu.h>
254 : : #include <linux/cryptohash.h>
255 : : #include <linux/fips.h>
256 : : #include <linux/ptrace.h>
257 : : #include <linux/kmemcheck.h>
258 : : #include <linux/workqueue.h>
259 : : #include <linux/irq.h>
260 : :
261 : : #include <asm/processor.h>
262 : : #include <asm/uaccess.h>
263 : : #include <asm/irq.h>
264 : : #include <asm/irq_regs.h>
265 : : #include <asm/io.h>
266 : :
267 : : #define CREATE_TRACE_POINTS
268 : : #include <trace/events/random.h>
269 : :
270 : : /*
271 : : * Configuration information
272 : : */
273 : : #define INPUT_POOL_SHIFT 12
274 : : #define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
275 : : #define OUTPUT_POOL_SHIFT 10
276 : : #define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
277 : : #define SEC_XFER_SIZE 512
278 : : #define EXTRACT_SIZE 10
279 : :
280 : : #define DEBUG_RANDOM_BOOT 0
281 : :
282 : : #define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
283 : :
284 : : /*
285 : : * To allow fractional bits to be tracked, the entropy_count field is
286 : : * denominated in units of 1/8th bits.
287 : : *
288 : : * 2*(ENTROPY_SHIFT + log2(poolbits)) must <= 31, or the multiply in
289 : : * credit_entropy_bits() needs to be 64 bits wide.
290 : : */
291 : : #define ENTROPY_SHIFT 3
292 : : #define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
293 : :
294 : : /*
295 : : * The minimum number of bits of entropy before we wake up a read on
296 : : * /dev/random. Should be enough to do a significant reseed.
297 : : */
298 : : static int random_read_wakeup_thresh = 64;
299 : :
300 : : /*
301 : : * If the entropy count falls under this number of bits, then we
302 : : * should wake up processes which are selecting or polling on write
303 : : * access to /dev/random.
304 : : */
305 : : static int random_write_wakeup_thresh = 28 * OUTPUT_POOL_WORDS;
306 : :
307 : : /*
308 : : * The minimum number of seconds between urandom pool resending. We
309 : : * do this to limit the amount of entropy that can be drained from the
310 : : * input pool even if there are heavy demands on /dev/urandom.
311 : : */
312 : : static int random_min_urandom_seed = 60;
313 : :
314 : : /*
315 : : * Originally, we used a primitive polynomial of degree .poolwords
316 : : * over GF(2). The taps for various sizes are defined below. They
317 : : * were chosen to be evenly spaced except for the last tap, which is 1
318 : : * to get the twisting happening as fast as possible.
319 : : *
320 : : * For the purposes of better mixing, we use the CRC-32 polynomial as
321 : : * well to make a (modified) twisted Generalized Feedback Shift
322 : : * Register. (See M. Matsumoto & Y. Kurita, 1992. Twisted GFSR
323 : : * generators. ACM Transactions on Modeling and Computer Simulation
324 : : * 2(3):179-194. Also see M. Matsumoto & Y. Kurita, 1994. Twisted
325 : : * GFSR generators II. ACM Transactions on Mdeling and Computer
326 : : * Simulation 4:254-266)
327 : : *
328 : : * Thanks to Colin Plumb for suggesting this.
329 : : *
330 : : * The mixing operation is much less sensitive than the output hash,
331 : : * where we use SHA-1. All that we want of mixing operation is that
332 : : * it be a good non-cryptographic hash; i.e. it not produce collisions
333 : : * when fed "random" data of the sort we expect to see. As long as
334 : : * the pool state differs for different inputs, we have preserved the
335 : : * input entropy and done a good job. The fact that an intelligent
336 : : * attacker can construct inputs that will produce controlled
337 : : * alterations to the pool's state is not important because we don't
338 : : * consider such inputs to contribute any randomness. The only
339 : : * property we need with respect to them is that the attacker can't
340 : : * increase his/her knowledge of the pool's state. Since all
341 : : * additions are reversible (knowing the final state and the input,
342 : : * you can reconstruct the initial state), if an attacker has any
343 : : * uncertainty about the initial state, he/she can only shuffle that
344 : : * uncertainty about, but never cause any collisions (which would
345 : : * decrease the uncertainty).
346 : : *
347 : : * Our mixing functions were analyzed by Lacharme, Roeck, Strubel, and
348 : : * Videau in their paper, "The Linux Pseudorandom Number Generator
349 : : * Revisited" (see: http://eprint.iacr.org/2012/251.pdf). In their
350 : : * paper, they point out that we are not using a true Twisted GFSR,
351 : : * since Matsumoto & Kurita used a trinomial feedback polynomial (that
352 : : * is, with only three taps, instead of the six that we are using).
353 : : * As a result, the resulting polynomial is neither primitive nor
354 : : * irreducible, and hence does not have a maximal period over
355 : : * GF(2**32). They suggest a slight change to the generator
356 : : * polynomial which improves the resulting TGFSR polynomial to be
357 : : * irreducible, which we have made here.
358 : : */
359 : : static struct poolinfo {
360 : : int poolbitshift, poolwords, poolbytes, poolbits, poolfracbits;
361 : : #define S(x) ilog2(x)+5, (x), (x)*4, (x)*32, (x) << (ENTROPY_SHIFT+5)
362 : : int tap1, tap2, tap3, tap4, tap5;
363 : : } poolinfo_table[] = {
364 : : /* was: x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 */
365 : : /* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
366 : : { S(128), 104, 76, 51, 25, 1 },
367 : : /* was: x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 */
368 : : /* x^32 + x^26 + x^19 + x^14 + x^7 + x + 1 */
369 : : { S(32), 26, 19, 14, 7, 1 },
370 : : #if 0
371 : : /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
372 : : { S(2048), 1638, 1231, 819, 411, 1 },
373 : :
374 : : /* x^1024 + x^817 + x^615 + x^412 + x^204 + x + 1 -- 290 */
375 : : { S(1024), 817, 615, 412, 204, 1 },
376 : :
377 : : /* x^1024 + x^819 + x^616 + x^410 + x^207 + x^2 + 1 -- 115 */
378 : : { S(1024), 819, 616, 410, 207, 2 },
379 : :
380 : : /* x^512 + x^411 + x^308 + x^208 + x^104 + x + 1 -- 225 */
381 : : { S(512), 411, 308, 208, 104, 1 },
382 : :
383 : : /* x^512 + x^409 + x^307 + x^206 + x^102 + x^2 + 1 -- 95 */
384 : : { S(512), 409, 307, 206, 102, 2 },
385 : : /* x^512 + x^409 + x^309 + x^205 + x^103 + x^2 + 1 -- 95 */
386 : : { S(512), 409, 309, 205, 103, 2 },
387 : :
388 : : /* x^256 + x^205 + x^155 + x^101 + x^52 + x + 1 -- 125 */
389 : : { S(256), 205, 155, 101, 52, 1 },
390 : :
391 : : /* x^128 + x^103 + x^78 + x^51 + x^27 + x^2 + 1 -- 70 */
392 : : { S(128), 103, 78, 51, 27, 2 },
393 : :
394 : : /* x^64 + x^52 + x^39 + x^26 + x^14 + x + 1 -- 15 */
395 : : { S(64), 52, 39, 26, 14, 1 },
396 : : #endif
397 : : };
398 : :
399 : : /*
400 : : * Static global variables
401 : : */
402 : : static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
403 : : static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
404 : : static struct fasync_struct *fasync;
405 : :
406 : : /**********************************************************************
407 : : *
408 : : * OS independent entropy store. Here are the functions which handle
409 : : * storing entropy in an entropy pool.
410 : : *
411 : : **********************************************************************/
412 : :
413 : : struct entropy_store;
414 : : struct entropy_store {
415 : : /* read-only data: */
416 : : const struct poolinfo *poolinfo;
417 : : __u32 *pool;
418 : : const char *name;
419 : : struct entropy_store *pull;
420 : : struct work_struct push_work;
421 : :
422 : : /* read-write data: */
423 : : unsigned long last_pulled;
424 : : spinlock_t lock;
425 : : unsigned short add_ptr;
426 : : unsigned short input_rotate;
427 : : int entropy_count;
428 : : int entropy_total;
429 : : unsigned int initialized:1;
430 : : unsigned int limit:1;
431 : : unsigned int last_data_init:1;
432 : : __u8 last_data[EXTRACT_SIZE];
433 : : };
434 : :
435 : : static void push_to_pool(struct work_struct *work);
436 : : static __u32 input_pool_data[INPUT_POOL_WORDS];
437 : : static __u32 blocking_pool_data[OUTPUT_POOL_WORDS];
438 : : static __u32 nonblocking_pool_data[OUTPUT_POOL_WORDS];
439 : :
440 : : static struct entropy_store input_pool = {
441 : : .poolinfo = &poolinfo_table[0],
442 : : .name = "input",
443 : : .limit = 1,
444 : : .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
445 : : .pool = input_pool_data
446 : : };
447 : :
448 : : static struct entropy_store blocking_pool = {
449 : : .poolinfo = &poolinfo_table[1],
450 : : .name = "blocking",
451 : : .limit = 1,
452 : : .pull = &input_pool,
453 : : .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock),
454 : : .pool = blocking_pool_data,
455 : : .push_work = __WORK_INITIALIZER(blocking_pool.push_work,
456 : : push_to_pool),
457 : : };
458 : :
459 : : static struct entropy_store nonblocking_pool = {
460 : : .poolinfo = &poolinfo_table[1],
461 : : .name = "nonblocking",
462 : : .pull = &input_pool,
463 : : .lock = __SPIN_LOCK_UNLOCKED(nonblocking_pool.lock),
464 : : .pool = nonblocking_pool_data,
465 : : .push_work = __WORK_INITIALIZER(nonblocking_pool.push_work,
466 : : push_to_pool),
467 : : };
468 : :
469 : : static __u32 const twist_table[8] = {
470 : : 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
471 : : 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
472 : :
473 : : /*
474 : : * This function adds bytes into the entropy "pool". It does not
475 : : * update the entropy estimate. The caller should call
476 : : * credit_entropy_bits if this is appropriate.
477 : : *
478 : : * The pool is stirred with a primitive polynomial of the appropriate
479 : : * degree, and then twisted. We twist by three bits at a time because
480 : : * it's cheap to do so and helps slightly in the expected case where
481 : : * the entropy is concentrated in the low-order bits.
482 : : */
483 : 0 : static void _mix_pool_bytes(struct entropy_store *r, const void *in,
484 : : int nbytes, __u8 out[64])
485 : : {
486 : : unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
487 : : int input_rotate;
488 : 4985345 : int wordmask = r->poolinfo->poolwords - 1;
489 : : const char *bytes = in;
490 : : __u32 w;
491 : :
492 : 4985345 : tap1 = r->poolinfo->tap1;
493 : 4985345 : tap2 = r->poolinfo->tap2;
494 : 4985345 : tap3 = r->poolinfo->tap3;
495 : 4985345 : tap4 = r->poolinfo->tap4;
496 : 4985345 : tap5 = r->poolinfo->tap5;
497 : :
498 : 4985345 : smp_rmb();
499 : 4985346 : input_rotate = ACCESS_ONCE(r->input_rotate);
500 : 4985346 : i = ACCESS_ONCE(r->add_ptr);
501 : :
502 : : /* mix one byte at a time to simplify size handling and churn faster */
503 [ + + ]: 39260131 : while (nbytes--) {
504 : 34274785 : w = rol32(*bytes++, input_rotate);
505 : 34274785 : i = (i - 1) & wordmask;
506 : :
507 : : /* XOR in the various taps */
508 : 34274785 : w ^= r->pool[i];
509 : 34274785 : w ^= r->pool[(i + tap1) & wordmask];
510 : 34274785 : w ^= r->pool[(i + tap2) & wordmask];
511 : 34274785 : w ^= r->pool[(i + tap3) & wordmask];
512 : 34274785 : w ^= r->pool[(i + tap4) & wordmask];
513 : 34274785 : w ^= r->pool[(i + tap5) & wordmask];
514 : :
515 : : /* Mix the result back in with a twist */
516 : 34274785 : r->pool[i] = (w >> 3) ^ twist_table[w & 7];
517 : :
518 : : /*
519 : : * Normally, we add 7 bits of rotation to the pool.
520 : : * At the beginning of the pool, add an extra 7 bits
521 : : * rotation, so that successive passes spread the
522 : : * input bits across the pool evenly.
523 : : */
524 [ + + ]: 34274785 : input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
525 : : }
526 : :
527 : 4985346 : ACCESS_ONCE(r->input_rotate) = input_rotate;
528 : 4985346 : ACCESS_ONCE(r->add_ptr) = i;
529 : 4985346 : smp_wmb();
530 : :
531 [ + + ]: 4985340 : if (out)
532 [ + + ]: 1005074 : for (j = 0; j < 16; j++)
533 : 945952 : ((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
534 : 4985340 : }
535 : :
536 : 0 : static void __mix_pool_bytes(struct entropy_store *r, const void *in,
537 : : int nbytes, __u8 out[64])
538 : : {
539 : 180082 : trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
540 : 180082 : _mix_pool_bytes(r, in, nbytes, out);
541 : 180081 : }
542 : :
543 : 0 : static void mix_pool_bytes(struct entropy_store *r, const void *in,
544 : : int nbytes, __u8 out[64])
545 : : {
546 : : unsigned long flags;
547 : :
548 : 388345 : trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
549 : 388345 : spin_lock_irqsave(&r->lock, flags);
550 : 388345 : _mix_pool_bytes(r, in, nbytes, out);
551 : : spin_unlock_irqrestore(&r->lock, flags);
552 : 388345 : }
553 : :
554 : : struct fast_pool {
555 : : __u32 pool[4];
556 : : unsigned long last;
557 : : unsigned short count;
558 : : unsigned char rotate;
559 : : unsigned char last_timer_intr;
560 : : };
561 : :
562 : : /*
563 : : * This is a fast mixing routine used by the interrupt randomness
564 : : * collector. It's hardcoded for an 128 bit pool and assumes that any
565 : : * locks that might be needed are taken by the caller.
566 : : */
567 : 0 : static void fast_mix(struct fast_pool *f, __u32 input[4])
568 : : {
569 : : __u32 w;
570 : 3114289 : unsigned input_rotate = f->rotate;
571 : :
572 : 6228578 : w = rol32(input[0], input_rotate) ^ f->pool[0] ^ f->pool[3];
573 : 3114289 : f->pool[0] = (w >> 3) ^ twist_table[w & 7];
574 : 3114289 : input_rotate = (input_rotate + 14) & 31;
575 : 6228578 : w = rol32(input[1], input_rotate) ^ f->pool[1] ^ f->pool[0];
576 : 3114289 : f->pool[1] = (w >> 3) ^ twist_table[w & 7];
577 : 3114289 : input_rotate = (input_rotate + 7) & 31;
578 : 6228578 : w = rol32(input[2], input_rotate) ^ f->pool[2] ^ f->pool[1];
579 : 3114289 : f->pool[2] = (w >> 3) ^ twist_table[w & 7];
580 : 3114289 : input_rotate = (input_rotate + 7) & 31;
581 : 6228578 : w = rol32(input[3], input_rotate) ^ f->pool[3] ^ f->pool[2];
582 : 3114289 : f->pool[3] = (w >> 3) ^ twist_table[w & 7];
583 : 3114289 : input_rotate = (input_rotate + 7) & 31;
584 : :
585 : 3114289 : f->rotate = input_rotate;
586 : 3114289 : f->count++;
587 : 3114289 : }
588 : :
589 : : /*
590 : : * Credit (or debit) the entropy store with n bits of entropy.
591 : : * Use credit_entropy_bits_safe() if the value comes from userspace
592 : : * or otherwise should be checked for extreme values.
593 : : */
594 : 0 : static void credit_entropy_bits(struct entropy_store *r, int nbits)
595 : : {
596 : : int entropy_count, orig;
597 : 509304 : const int pool_size = r->poolinfo->poolfracbits;
598 : 509304 : int nfrac = nbits << ENTROPY_SHIFT;
599 : :
600 [ + ]: 509304 : if (!nbits)
601 : 1 : return;
602 : :
603 : : retry:
604 : 142913 : entropy_count = orig = ACCESS_ONCE(r->entropy_count);
605 [ - + ]: 142913 : if (nfrac < 0) {
606 : : /* Debit */
607 : 0 : entropy_count += nfrac;
608 : : } else {
609 : : /*
610 : : * Credit: we have to account for the possibility of
611 : : * overwriting already present entropy. Even in the
612 : : * ideal case of pure Shannon entropy, new contributions
613 : : * approach the full value asymptotically:
614 : : *
615 : : * entropy <- entropy + (pool_size - entropy) *
616 : : * (1 - exp(-add_entropy/pool_size))
617 : : *
618 : : * For add_entropy <= pool_size/2 then
619 : : * (1 - exp(-add_entropy/pool_size)) >=
620 : : * (add_entropy/pool_size)*0.7869...
621 : : * so we can approximate the exponential with
622 : : * 3/4*add_entropy/pool_size and still be on the
623 : : * safe side by adding at most pool_size/2 at a time.
624 : : *
625 : : * The use of pool_size-2 in the while statement is to
626 : : * prevent rounding artifacts from making the loop
627 : : * arbitrarily long; this limits the loop to log2(pool_size)*2
628 : : * turns no matter how large nbits is.
629 : : */
630 : : int pnfrac = nfrac;
631 : 142913 : const int s = r->poolinfo->poolbitshift + ENTROPY_SHIFT + 2;
632 : : /* The +2 corresponds to the /4 in the denominator */
633 : :
634 : : do {
635 : 142913 : unsigned int anfrac = min(pnfrac, pool_size/2);
636 : 142913 : unsigned int add =
637 : 142913 : ((pool_size - entropy_count)*anfrac*3) >> s;
638 : :
639 : 142913 : entropy_count += add;
640 : 142913 : pnfrac -= anfrac;
641 [ + + ][ - + ]: 142913 : } while (unlikely(entropy_count < pool_size-2 && pnfrac));
642 : : }
643 : :
644 [ - + ]: 142913 : if (entropy_count < 0) {
645 : 0 : pr_warn("random: negative entropy/overflow: pool %s count %d\n",
646 : : r->name, entropy_count);
647 : 0 : WARN_ON(1);
648 : : entropy_count = 0;
649 [ - + ]: 142913 : } else if (entropy_count > pool_size)
650 : : entropy_count = pool_size;
651 [ + + ]: 142914 : if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
652 : : goto retry;
653 : :
654 : 142912 : r->entropy_total += nbits;
655 [ + + ][ + + ]: 142912 : if (!r->initialized && r->entropy_total > 128) {
656 : 1 : r->initialized = 1;
657 : 1 : r->entropy_total = 0;
658 [ - + ]: 1 : if (r == &nonblocking_pool) {
659 : 0 : prandom_reseed_late();
660 : 0 : pr_notice("random: %s pool is initialized\n", r->name);
661 : : }
662 : : }
663 : :
664 : 285824 : trace_credit_entropy_bits(r->name, nbits,
665 : : entropy_count >> ENTROPY_SHIFT,
666 : 142912 : r->entropy_total, _RET_IP_);
667 : :
668 [ + + ]: 142912 : if (r == &input_pool) {
669 : : int entropy_bytes = entropy_count >> ENTROPY_SHIFT;
670 : :
671 : : /* should we wake readers? */
672 [ + - ]: 141671 : if (entropy_bytes >= random_read_wakeup_thresh) {
673 : 141671 : wake_up_interruptible(&random_read_wait);
674 : 141671 : kill_fasync(&fasync, SIGIO, POLL_IN);
675 : : }
676 : : /* If the input pool is getting full, send some
677 : : * entropy to the two output pools, flipping back and
678 : : * forth between them, until the output pools are 75%
679 : : * full.
680 : : */
681 [ + + ][ + - ]: 141671 : if (entropy_bytes > random_write_wakeup_thresh &&
682 [ + + ]: 60923 : r->initialized &&
683 : 60923 : r->entropy_total >= 2*random_read_wakeup_thresh) {
684 : : static struct entropy_store *last = &blocking_pool;
685 : : struct entropy_store *other = &blocking_pool;
686 : :
687 [ + + ]: 4018 : if (last == &blocking_pool)
688 : : other = &nonblocking_pool;
689 [ + + ]: 4018 : if (other->entropy_count <=
690 : 4018 : 3 * other->poolinfo->poolfracbits / 4)
691 : 59 : last = other;
692 [ + + ]: 4018 : if (last->entropy_count <=
693 : 4018 : 3 * last->poolinfo->poolfracbits / 4) {
694 : 1167 : schedule_work(&last->push_work);
695 : 1167 : r->entropy_total = 0;
696 : : }
697 : : }
698 : : }
699 : : }
700 : :
701 : : static void credit_entropy_bits_safe(struct entropy_store *r, int nbits)
702 : : {
703 : : const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1));
704 : :
705 : : /* Cap the value to avoid overflows */
706 [ # # ][ # # ]: 0 : nbits = min(nbits, nbits_max);
707 [ # # ][ # # ]: 0 : nbits = max(nbits, -nbits_max);
708 : :
709 : 0 : credit_entropy_bits(r, nbits);
710 : : }
711 : :
712 : : /*********************************************************************
713 : : *
714 : : * Entropy input management
715 : : *
716 : : *********************************************************************/
717 : :
718 : : /* There is one of these per entropy source */
719 : : struct timer_rand_state {
720 : : cycles_t last_time;
721 : : long last_delta, last_delta2;
722 : : unsigned dont_count_entropy:1;
723 : : };
724 : :
725 : : #define INIT_TIMER_RAND_STATE { INITIAL_JIFFIES, };
726 : :
727 : : /*
728 : : * Add device- or boot-specific data to the input and nonblocking
729 : : * pools to help initialize them to unique values.
730 : : *
731 : : * None of this adds any entropy, it is meant to avoid the
732 : : * problem of the nonblocking pool having similar initial state
733 : : * across largely identical devices.
734 : : */
735 : 0 : void add_device_randomness(const void *buf, unsigned int size)
736 : : {
737 [ + - ]: 1104230 : unsigned long time = random_get_entropy() ^ jiffies;
738 : : unsigned long flags;
739 : :
740 : 1104230 : trace_add_device_randomness(size, _RET_IP_);
741 : 1104230 : spin_lock_irqsave(&input_pool.lock, flags);
742 : 1104230 : _mix_pool_bytes(&input_pool, buf, size, NULL);
743 : 1104230 : _mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
744 : : spin_unlock_irqrestore(&input_pool.lock, flags);
745 : :
746 : 1104230 : spin_lock_irqsave(&nonblocking_pool.lock, flags);
747 : 1104230 : _mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
748 : 1104230 : _mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
749 : : spin_unlock_irqrestore(&nonblocking_pool.lock, flags);
750 : 1104230 : }
751 : : EXPORT_SYMBOL(add_device_randomness);
752 : :
753 : : static struct timer_rand_state input_timer_state = INIT_TIMER_RAND_STATE;
754 : :
755 : : /*
756 : : * This function adds entropy to the entropy "pool" by using timing
757 : : * delays. It uses the timer_rand_state structure to make an estimate
758 : : * of how many bits of entropy this call has added to the pool.
759 : : *
760 : : * The number "num" is also added to the pool - it should somehow describe
761 : : * the type of event which just happened. This is currently 0-255 for
762 : : * keyboard scan codes, and 256 upwards for interrupts.
763 : : *
764 : : */
765 : 0 : static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
766 : : {
767 : : struct entropy_store *r;
768 : : struct {
769 : : long jiffies;
770 : : unsigned cycles;
771 : : unsigned num;
772 : : } sample;
773 : : long delta, delta2, delta3;
774 : :
775 : 387104 : preempt_disable();
776 : :
777 : 387104 : sample.jiffies = jiffies;
778 [ + - ]: 387104 : sample.cycles = random_get_entropy();
779 : 387104 : sample.num = num;
780 [ - + ]: 387104 : r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
781 : 387104 : mix_pool_bytes(r, &sample, sizeof(sample), NULL);
782 : :
783 : : /*
784 : : * Calculate number of bits of randomness we probably added.
785 : : * We take into account the first, second and third-order deltas
786 : : * in order to make our estimate.
787 : : */
788 : :
789 [ + ]: 387104 : if (!state->dont_count_entropy) {
790 : 387104 : delta = sample.jiffies - state->last_time;
791 : 387104 : state->last_time = sample.jiffies;
792 : :
793 : 387104 : delta2 = delta - state->last_delta;
794 : 387104 : state->last_delta = delta;
795 : :
796 : 387104 : delta3 = delta2 - state->last_delta2;
797 : 387104 : state->last_delta2 = delta2;
798 : :
799 [ - + ]: 774208 : if (delta < 0)
800 : 0 : delta = -delta;
801 [ + + ]: 387104 : if (delta2 < 0)
802 : 128697 : delta2 = -delta2;
803 [ + + ]: 387104 : if (delta3 < 0)
804 : 139765 : delta3 = -delta3;
805 [ + + ]: 387104 : if (delta > delta2)
806 : : delta = delta2;
807 [ + + ]: 387104 : if (delta > delta3)
808 : : delta = delta3;
809 : :
810 : : /*
811 : : * delta is now minimum absolute delta.
812 : : * Round down by 1 bit on general principles,
813 : : * and limit entropy entimate to 12 bits.
814 : : */
815 : 387104 : credit_entropy_bits(r, min_t(int, fls(delta>>1), 11));
816 : : }
817 : 0 : preempt_enable();
818 : 387104 : }
819 : :
820 : 0 : void add_input_randomness(unsigned int type, unsigned int code,
821 : : unsigned int value)
822 : : {
823 : : static unsigned char last_value;
824 : :
825 : : /* ignore autorepeat and the like */
826 [ + + ]: 2 : if (value == last_value)
827 : 0 : return;
828 : :
829 : 1 : last_value = value;
830 : 1 : add_timer_randomness(&input_timer_state,
831 : 1 : (type << 4) ^ code ^ (code >> 4) ^ value);
832 : 1 : trace_add_input_randomness(ENTROPY_BITS(&input_pool));
833 : : }
834 : : EXPORT_SYMBOL_GPL(add_input_randomness);
835 : :
836 : : static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
837 : :
838 : 0 : void add_interrupt_randomness(int irq, int irq_flags)
839 : : {
840 : : struct entropy_store *r;
841 : 6228564 : struct fast_pool *fast_pool = &__get_cpu_var(irq_randomness);
842 : : struct pt_regs *regs = get_irq_regs();
843 : 3114282 : unsigned long now = jiffies;
844 [ + ]: 3114282 : cycles_t cycles = random_get_entropy();
845 : : __u32 input[4], c_high, j_high;
846 : : __u64 ip;
847 : :
848 : : c_high = (sizeof(cycles) > 4) ? cycles >> 32 : 0;
849 : : j_high = (sizeof(now) > 4) ? now >> 32 : 0;
850 : 3114279 : input[0] = cycles ^ j_high ^ irq;
851 : 3114279 : input[1] = now ^ c_high;
852 [ + - ]: 3114279 : ip = regs ? instruction_pointer(regs) : _RET_IP_;
853 : 3114279 : input[2] = ip;
854 : 3114279 : input[3] = ip >> 32;
855 : :
856 : 3114279 : fast_mix(fast_pool, input);
857 : :
858 [ + + ][ + + ]: 3114267 : if ((fast_pool->count & 63) && !time_after(now, fast_pool->last + HZ))
859 : 2993331 : return;
860 : :
861 : 120936 : fast_pool->last = now;
862 : :
863 [ - + ]: 120936 : r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
864 : 120936 : __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
865 : : /*
866 : : * If we don't have a valid cycle counter, and we see
867 : : * back-to-back timer interrupts, then skip giving credit for
868 : : * any entropy.
869 : : */
870 [ - + ]: 120959 : if (cycles == 0) {
871 [ # # ]: 0 : if (irq_flags & __IRQF_TIMER) {
872 [ # # ]: 0 : if (fast_pool->last_timer_intr)
873 : : return;
874 : 0 : fast_pool->last_timer_intr = 1;
875 : : } else
876 : 0 : fast_pool->last_timer_intr = 0;
877 : : }
878 : 120959 : credit_entropy_bits(r, 1);
879 : : }
880 : :
881 : : #ifdef CONFIG_BLOCK
882 : 0 : void add_disk_randomness(struct gendisk *disk)
883 : : {
884 [ + + ][ + - ]: 401979 : if (!disk || !disk->random)
885 : 0 : return;
886 : : /* first major is 1, so we get >= 0x200 here */
887 : 387103 : add_timer_randomness(disk->random, 0x100 + disk_devt(disk));
888 : 387103 : trace_add_disk_randomness(disk_devt(disk), ENTROPY_BITS(&input_pool));
889 : : }
890 : : #endif
891 : :
892 : : /*********************************************************************
893 : : *
894 : : * Entropy extraction routines
895 : : *
896 : : *********************************************************************/
897 : :
898 : : static ssize_t extract_entropy(struct entropy_store *r, void *buf,
899 : : size_t nbytes, int min, int rsvd);
900 : :
901 : : /*
902 : : * This utility inline function is responsible for transferring entropy
903 : : * from the primary pool to the secondary extraction pool. We make
904 : : * sure we pull enough for a 'catastrophic reseed'.
905 : : */
906 : : static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes);
907 : 0 : static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
908 : : {
909 [ + + ][ + - ]: 29283 : if (r->limit == 0 && random_min_urandom_seed) {
910 : 28042 : unsigned long now = jiffies;
911 : :
912 [ + + ]: 28042 : if (time_before(now,
913 : : r->last_pulled + random_min_urandom_seed * HZ))
914 : 0 : return;
915 : 392 : r->last_pulled = now;
916 : : }
917 [ + + ][ + + ]: 1633 : if (r->pull &&
918 [ + - ]: 74 : r->entropy_count < (nbytes << (ENTROPY_SHIFT + 3)) &&
919 : 74 : r->entropy_count < r->poolinfo->poolfracbits)
920 : 74 : _xfer_secondary_pool(r, nbytes);
921 : : }
922 : :
923 : 0 : static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
924 : : {
925 : : __u32 tmp[OUTPUT_POOL_WORDS];
926 : :
927 : : /* For /dev/random's pool, always leave two wakeup worth's BITS */
928 [ + + ]: 1241 : int rsvd = r->limit ? 0 : random_read_wakeup_thresh/4;
929 : 1241 : int bytes = nbytes;
930 : :
931 : : /* pull at least as many as BYTES as wakeup BITS */
932 : 1241 : bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
933 : : /* but never more than the buffer size */
934 : 1241 : bytes = min_t(int, bytes, sizeof(tmp));
935 : :
936 : 3723 : trace_xfer_secondary_pool(r->name, bytes * 8, nbytes * 8,
937 : 2482 : ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
938 : 1241 : bytes = extract_entropy(r->pull, tmp, bytes,
939 : : random_read_wakeup_thresh / 8, rsvd);
940 : 1241 : mix_pool_bytes(r, tmp, bytes, NULL);
941 : 1241 : credit_entropy_bits(r, bytes*8);
942 : 1241 : }
943 : :
944 : : /*
945 : : * Used as a workqueue function so that when the input pool is getting
946 : : * full, we can "spill over" some entropy to the output pools. That
947 : : * way the output pools can store some of the excess entropy instead
948 : : * of letting it go to waste.
949 : : */
950 : 0 : static void push_to_pool(struct work_struct *work)
951 : : {
952 : 1167 : struct entropy_store *r = container_of(work, struct entropy_store,
953 : : push_work);
954 [ - + ]: 1167 : BUG_ON(!r);
955 : 1167 : _xfer_secondary_pool(r, random_read_wakeup_thresh/8);
956 : 2334 : trace_push_to_pool(r->name, r->entropy_count >> ENTROPY_SHIFT,
957 : 1167 : r->pull->entropy_count >> ENTROPY_SHIFT);
958 : 0 : }
959 : :
960 : : /*
961 : : * These functions extracts randomness from the "entropy pool", and
962 : : * returns it in a buffer.
963 : : *
964 : : * The min parameter specifies the minimum amount we can pull before
965 : : * failing to avoid races that defeat catastrophic reseeding while the
966 : : * reserved parameter indicates how much entropy we must leave in the
967 : : * pool after each pull to avoid starving other readers.
968 : : *
969 : : * Note: extract_entropy() assumes that .poolwords is a multiple of 16 words.
970 : : */
971 : :
972 : 0 : static size_t account(struct entropy_store *r, size_t nbytes, int min,
973 : : int reserved)
974 : : {
975 : : unsigned long flags;
976 : : int wakeup_write = 0;
977 : : int have_bytes;
978 : : int entropy_count, orig;
979 : : size_t ibytes;
980 : :
981 : : /* Hold lock while accounting */
982 : 29283 : spin_lock_irqsave(&r->lock, flags);
983 : :
984 [ - + ]: 29283 : BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
985 : :
986 : : /* Can we pull enough? */
987 : : retry:
988 : 29283 : entropy_count = orig = ACCESS_ONCE(r->entropy_count);
989 : 29283 : have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
990 : : ibytes = nbytes;
991 [ + - ]: 29283 : if (have_bytes < min + reserved) {
992 : : ibytes = 0;
993 : : } else {
994 : : /* If limited, never pull more than available */
995 [ + + ][ - + ]: 29283 : if (r->limit && ibytes + reserved >= have_bytes)
996 : 0 : ibytes = have_bytes - reserved;
997 : :
998 [ + + ]: 29283 : if (have_bytes >= ibytes + reserved)
999 : 1919 : entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
1000 : : else
1001 : 27364 : entropy_count = reserved << (ENTROPY_SHIFT + 3);
1002 : :
1003 [ - + ]: 29283 : if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
1004 : : goto retry;
1005 : :
1006 [ + + ]: 29283 : if ((r->entropy_count >> ENTROPY_SHIFT)
1007 : 29283 : < random_write_wakeup_thresh)
1008 : : wakeup_write = 1;
1009 : : }
1010 : : spin_unlock_irqrestore(&r->lock, flags);
1011 : :
1012 : 29283 : trace_debit_entropy(r->name, 8 * ibytes);
1013 [ + + ]: 29283 : if (wakeup_write) {
1014 : 28907 : wake_up_interruptible(&random_write_wait);
1015 : 28907 : kill_fasync(&fasync, SIGIO, POLL_OUT);
1016 : : }
1017 : :
1018 : 29282 : return ibytes;
1019 : : }
1020 : :
1021 : 0 : static void extract_buf(struct entropy_store *r, __u8 *out)
1022 : : {
1023 : : int i;
1024 : : union {
1025 : : __u32 w[5];
1026 : : unsigned long l[LONGS(20)];
1027 : : } hash;
1028 : : __u32 workspace[SHA_WORKSPACE_WORDS];
1029 : : __u8 extract[64];
1030 : : unsigned long flags;
1031 : :
1032 : : /* Generate a hash across the pool, 16 words (512 bits) at a time */
1033 : 59121 : sha_init(hash.w);
1034 : 59122 : spin_lock_irqsave(&r->lock, flags);
1035 [ + + ]: 244299 : for (i = 0; i < r->poolinfo->poolwords; i += 16)
1036 : 126056 : sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
1037 : :
1038 : : /*
1039 : : * If we have a architectural hardware random number
1040 : : * generator, mix that in, too.
1041 : : */
1042 : : for (i = 0; i < LONGS(20); i++) {
1043 : : unsigned long v;
1044 : : if (!arch_get_random_long(&v))
1045 : : break;
1046 : : hash.l[i] ^= v;
1047 : : }
1048 : :
1049 : : /*
1050 : : * We mix the hash back into the pool to prevent backtracking
1051 : : * attacks (where the attacker knows the state of the pool
1052 : : * plus the current outputs, and attempts to find previous
1053 : : * ouputs), unless the hash function can be inverted. By
1054 : : * mixing at least a SHA1 worth of hash data back, we make
1055 : : * brute-forcing the feedback as hard as brute-forcing the
1056 : : * hash.
1057 : : */
1058 : 59122 : __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
1059 : : spin_unlock_irqrestore(&r->lock, flags);
1060 : :
1061 : : /*
1062 : : * To avoid duplicates, we atomically extract a portion of the
1063 : : * pool while mixing, and hash one final time.
1064 : : */
1065 : 59122 : sha_transform(hash.w, extract, workspace);
1066 : 59122 : memset(extract, 0, sizeof(extract));
1067 : 59122 : memset(workspace, 0, sizeof(workspace));
1068 : :
1069 : : /*
1070 : : * In case the hash function has some recognizable output
1071 : : * pattern, we fold it in half. Thus, we always feed back
1072 : : * twice as much data as we output.
1073 : : */
1074 : 59122 : hash.w[0] ^= hash.w[3];
1075 : 59122 : hash.w[1] ^= hash.w[4];
1076 : 118244 : hash.w[2] ^= rol32(hash.w[2], 16);
1077 : :
1078 : 59122 : memcpy(out, &hash, EXTRACT_SIZE);
1079 : 59122 : memset(&hash, 0, sizeof(hash));
1080 : 59122 : }
1081 : :
1082 : 0 : static ssize_t extract_entropy(struct entropy_store *r, void *buf,
1083 : : size_t nbytes, int min, int reserved)
1084 : : {
1085 : : ssize_t ret = 0, i;
1086 : : __u8 tmp[EXTRACT_SIZE];
1087 : : unsigned long flags;
1088 : :
1089 : : /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
1090 : : if (fips_enabled) {
1091 : : spin_lock_irqsave(&r->lock, flags);
1092 : : if (!r->last_data_init) {
1093 : : r->last_data_init = 1;
1094 : : spin_unlock_irqrestore(&r->lock, flags);
1095 : : trace_extract_entropy(r->name, EXTRACT_SIZE,
1096 : : ENTROPY_BITS(r), _RET_IP_);
1097 : : xfer_secondary_pool(r, EXTRACT_SIZE);
1098 : : extract_buf(r, tmp);
1099 : : spin_lock_irqsave(&r->lock, flags);
1100 : : memcpy(r->last_data, tmp, EXTRACT_SIZE);
1101 : : }
1102 : : spin_unlock_irqrestore(&r->lock, flags);
1103 : : }
1104 : :
1105 : 29185 : trace_extract_entropy(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
1106 : 29184 : xfer_secondary_pool(r, nbytes);
1107 : 29185 : nbytes = account(r, nbytes, min, reserved);
1108 : :
1109 [ + + ]: 85679 : while (nbytes) {
1110 : 56494 : extract_buf(r, tmp);
1111 : :
1112 : : if (fips_enabled) {
1113 : : spin_lock_irqsave(&r->lock, flags);
1114 : : if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
1115 : : panic("Hardware RNG duplicated output!\n");
1116 : : memcpy(r->last_data, tmp, EXTRACT_SIZE);
1117 : : spin_unlock_irqrestore(&r->lock, flags);
1118 : : }
1119 : 56495 : i = min_t(int, nbytes, EXTRACT_SIZE);
1120 : 56495 : memcpy(buf, tmp, i);
1121 : 56495 : nbytes -= i;
1122 : 56495 : buf += i;
1123 : 56495 : ret += i;
1124 : : }
1125 : :
1126 : : /* Wipe data just returned from memory */
1127 : 29185 : memset(tmp, 0, sizeof(tmp));
1128 : :
1129 : 29185 : return ret;
1130 : : }
1131 : :
1132 : 0 : static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
1133 : : size_t nbytes)
1134 : : {
1135 : : ssize_t ret = 0, i;
1136 : : __u8 tmp[EXTRACT_SIZE];
1137 : :
1138 : 98 : trace_extract_entropy_user(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
1139 : 98 : xfer_secondary_pool(r, nbytes);
1140 : 98 : nbytes = account(r, nbytes, 0, 0);
1141 : :
1142 [ + + ]: 2725 : while (nbytes) {
1143 [ - + ]: 2627 : if (need_resched()) {
1144 [ # # ]: 0 : if (signal_pending(current)) {
1145 [ # # ]: 0 : if (ret == 0)
1146 : : ret = -ERESTARTSYS;
1147 : : break;
1148 : : }
1149 : 0 : schedule();
1150 : : }
1151 : :
1152 : 2627 : extract_buf(r, tmp);
1153 : 2627 : i = min_t(int, nbytes, EXTRACT_SIZE);
1154 [ + - ]: 2627 : if (copy_to_user(buf, tmp, i)) {
1155 : : ret = -EFAULT;
1156 : : break;
1157 : : }
1158 : :
1159 : 2627 : nbytes -= i;
1160 : 2627 : buf += i;
1161 : 2627 : ret += i;
1162 : : }
1163 : :
1164 : : /* Wipe data just returned from memory */
1165 : 98 : memset(tmp, 0, sizeof(tmp));
1166 : :
1167 : 98 : return ret;
1168 : : }
1169 : :
1170 : : /*
1171 : : * This function is the exported kernel interface. It returns some
1172 : : * number of good random numbers, suitable for key generation, seeding
1173 : : * TCP sequence numbers, etc. It does not use the hw random number
1174 : : * generator, if available; use get_random_bytes_arch() for that.
1175 : : */
1176 : 0 : void get_random_bytes(void *buf, int nbytes)
1177 : : {
1178 : : #if DEBUG_RANDOM_BOOT > 0
1179 : : if (unlikely(nonblocking_pool.initialized == 0))
1180 : : printk(KERN_NOTICE "random: %pF get_random_bytes called "
1181 : : "with %d bits of entropy available\n",
1182 : : (void *) _RET_IP_,
1183 : : nonblocking_pool.entropy_total);
1184 : : #endif
1185 : 27944 : trace_get_random_bytes(nbytes, _RET_IP_);
1186 : 27944 : extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
1187 : 27944 : }
1188 : : EXPORT_SYMBOL(get_random_bytes);
1189 : :
1190 : : /*
1191 : : * This function will use the architecture-specific hardware random
1192 : : * number generator if it is available. The arch-specific hw RNG will
1193 : : * almost certainly be faster than what we can do in software, but it
1194 : : * is impossible to verify that it is implemented securely (as
1195 : : * opposed, to, say, the AES encryption of a sequence number using a
1196 : : * key known by the NSA). So it's useful if we need the speed, but
1197 : : * only if we're willing to trust the hardware manufacturer not to
1198 : : * have put in a back door.
1199 : : */
1200 : 0 : void get_random_bytes_arch(void *buf, int nbytes)
1201 : : {
1202 : : char *p = buf;
1203 : :
1204 : 0 : trace_get_random_bytes_arch(nbytes, _RET_IP_);
1205 : : while (nbytes) {
1206 : : unsigned long v;
1207 : : int chunk = min(nbytes, (int)sizeof(unsigned long));
1208 : :
1209 : : if (!arch_get_random_long(&v))
1210 : : break;
1211 : :
1212 : : memcpy(p, &v, chunk);
1213 : : p += chunk;
1214 : : nbytes -= chunk;
1215 : : }
1216 : :
1217 [ # # ]: 0 : if (nbytes)
1218 : 0 : extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
1219 : 0 : }
1220 : : EXPORT_SYMBOL(get_random_bytes_arch);
1221 : :
1222 : :
1223 : : /*
1224 : : * init_std_data - initialize pool with system data
1225 : : *
1226 : : * @r: pool to initialize
1227 : : *
1228 : : * This function clears the pool's entropy count and mixes some system
1229 : : * data into the pool to prepare it for use. The pool is not cleared
1230 : : * as that can only decrease the entropy in the pool.
1231 : : */
1232 : 0 : static void init_std_data(struct entropy_store *r)
1233 : : {
1234 : : int i;
1235 : 0 : ktime_t now = ktime_get_real();
1236 : : unsigned long rv;
1237 : :
1238 : 0 : r->last_pulled = jiffies;
1239 : 0 : mix_pool_bytes(r, &now, sizeof(now), NULL);
1240 [ # # ]: 0 : for (i = r->poolinfo->poolbytes; i > 0; i -= sizeof(rv)) {
1241 : : if (!arch_get_random_long(&rv))
1242 [ # # ]: 0 : rv = random_get_entropy();
1243 : 0 : mix_pool_bytes(r, &rv, sizeof(rv), NULL);
1244 : : }
1245 : 0 : mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
1246 : 0 : }
1247 : :
1248 : : /*
1249 : : * Note that setup_arch() may call add_device_randomness()
1250 : : * long before we get here. This allows seeding of the pools
1251 : : * with some platform dependent data very early in the boot
1252 : : * process. But it limits our options here. We must use
1253 : : * statically allocated structures that already have all
1254 : : * initializations complete at compile time. We should also
1255 : : * take care not to overwrite the precious per platform data
1256 : : * we were given.
1257 : : */
1258 : 0 : static int rand_initialize(void)
1259 : : {
1260 : 0 : init_std_data(&input_pool);
1261 : 0 : init_std_data(&blocking_pool);
1262 : 0 : init_std_data(&nonblocking_pool);
1263 : 0 : return 0;
1264 : : }
1265 : : early_initcall(rand_initialize);
1266 : :
1267 : : #ifdef CONFIG_BLOCK
1268 : 0 : void rand_initialize_disk(struct gendisk *disk)
1269 : : {
1270 : : struct timer_rand_state *state;
1271 : :
1272 : : /*
1273 : : * If kzalloc returns null, we just won't use that entropy
1274 : : * source.
1275 : : */
1276 : : state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
1277 [ # # ]: 0 : if (state) {
1278 : 0 : state->last_time = INITIAL_JIFFIES;
1279 : 0 : disk->random = state;
1280 : : }
1281 : 0 : }
1282 : : #endif
1283 : :
1284 : : static ssize_t
1285 : 0 : random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1286 : : {
1287 : : ssize_t n, retval = 0, count = 0;
1288 : :
1289 [ # # ]: 0 : if (nbytes == 0)
1290 : : return 0;
1291 : :
1292 [ # # ]: 0 : while (nbytes > 0) {
1293 : 0 : n = nbytes;
1294 [ # # ]: 0 : if (n > SEC_XFER_SIZE)
1295 : : n = SEC_XFER_SIZE;
1296 : :
1297 : 0 : n = extract_entropy_user(&blocking_pool, buf, n);
1298 : :
1299 [ # # ]: 0 : if (n < 0) {
1300 : : retval = n;
1301 : : break;
1302 : : }
1303 : :
1304 : 0 : trace_random_read(n*8, (nbytes-n)*8,
1305 : 0 : ENTROPY_BITS(&blocking_pool),
1306 : 0 : ENTROPY_BITS(&input_pool));
1307 : :
1308 [ # # ]: 0 : if (n == 0) {
1309 [ # # ]: 0 : if (file->f_flags & O_NONBLOCK) {
1310 : : retval = -EAGAIN;
1311 : : break;
1312 : : }
1313 : :
1314 [ # # ][ # # ]: 0 : wait_event_interruptible(random_read_wait,
[ # # ]
1315 : : ENTROPY_BITS(&input_pool) >=
1316 : : random_read_wakeup_thresh);
1317 : :
1318 [ # # ]: 0 : if (signal_pending(current)) {
1319 : : retval = -ERESTARTSYS;
1320 : : break;
1321 : : }
1322 : :
1323 : 0 : continue;
1324 : : }
1325 : :
1326 : : count += n;
1327 : : buf += n;
1328 : : nbytes -= n;
1329 : : break; /* This break makes the device work */
1330 : : /* like a named pipe */
1331 : : }
1332 : :
1333 [ # # ]: 0 : return (count ? count : retval);
1334 : : }
1335 : :
1336 : : static ssize_t
1337 : 0 : urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
1338 : : {
1339 : : int ret;
1340 : :
1341 [ - + ]: 98 : if (unlikely(nonblocking_pool.initialized == 0))
1342 [ # # ]: 0 : printk_once(KERN_NOTICE "random: %s urandom read "
1343 : : "with %d bits of entropy available\n",
1344 : : current->comm, nonblocking_pool.entropy_total);
1345 : :
1346 : 98 : ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
1347 : :
1348 : 196 : trace_urandom_read(8 * nbytes, ENTROPY_BITS(&nonblocking_pool),
1349 : 98 : ENTROPY_BITS(&input_pool));
1350 : 0 : return ret;
1351 : : }
1352 : :
1353 : : static unsigned int
1354 : 0 : random_poll(struct file *file, poll_table * wait)
1355 : : {
1356 : : unsigned int mask;
1357 : :
1358 : : poll_wait(file, &random_read_wait, wait);
1359 : : poll_wait(file, &random_write_wait, wait);
1360 : : mask = 0;
1361 [ # # ]: 0 : if (ENTROPY_BITS(&input_pool) >= random_read_wakeup_thresh)
1362 : : mask |= POLLIN | POLLRDNORM;
1363 [ # # ]: 0 : if (ENTROPY_BITS(&input_pool) < random_write_wakeup_thresh)
1364 : 0 : mask |= POLLOUT | POLLWRNORM;
1365 : 0 : return mask;
1366 : : }
1367 : :
1368 : : static int
1369 : 0 : write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
1370 : : {
1371 : : size_t bytes;
1372 : : __u32 buf[16];
1373 : : const char __user *p = buffer;
1374 : :
1375 [ # # ]: 0 : while (count > 0) {
1376 : 0 : bytes = min(count, sizeof(buf));
1377 [ # # ]: 0 : if (copy_from_user(&buf, p, bytes))
1378 : : return -EFAULT;
1379 : :
1380 : 0 : count -= bytes;
1381 : 0 : p += bytes;
1382 : :
1383 : 0 : mix_pool_bytes(r, buf, bytes, NULL);
1384 : 0 : cond_resched();
1385 : : }
1386 : :
1387 : : return 0;
1388 : : }
1389 : :
1390 : 0 : static ssize_t random_write(struct file *file, const char __user *buffer,
1391 : : size_t count, loff_t *ppos)
1392 : : {
1393 : : size_t ret;
1394 : :
1395 : 0 : ret = write_pool(&blocking_pool, buffer, count);
1396 [ # # ]: 0 : if (ret)
1397 : : return ret;
1398 : 0 : ret = write_pool(&nonblocking_pool, buffer, count);
1399 [ # # ]: 0 : if (ret)
1400 : : return ret;
1401 : :
1402 : 0 : return (ssize_t)count;
1403 : : }
1404 : :
1405 : 0 : static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
1406 : : {
1407 : : int size, ent_count;
1408 : 6 : int __user *p = (int __user *)arg;
1409 : : int retval;
1410 : :
1411 [ - - - - : 6 : switch (cmd) {
+ ]
1412 : : case RNDGETENTCNT:
1413 : : /* inherently racy, no point locking */
1414 : 0 : ent_count = ENTROPY_BITS(&input_pool);
1415 [ # # ]: 0 : if (put_user(ent_count, p))
1416 : : return -EFAULT;
1417 : 0 : return 0;
1418 : : case RNDADDTOENTCNT:
1419 [ # # ]: 0 : if (!capable(CAP_SYS_ADMIN))
1420 : : return -EPERM;
1421 [ # # ]: 0 : if (get_user(ent_count, p))
1422 : : return -EFAULT;
1423 : : credit_entropy_bits_safe(&input_pool, ent_count);
1424 : 0 : return 0;
1425 : : case RNDADDENTROPY:
1426 [ # # ]: 0 : if (!capable(CAP_SYS_ADMIN))
1427 : : return -EPERM;
1428 [ # # ]: 0 : if (get_user(ent_count, p++))
1429 : : return -EFAULT;
1430 [ # # ]: 0 : if (ent_count < 0)
1431 : : return -EINVAL;
1432 [ # # ]: 0 : if (get_user(size, p++))
1433 : : return -EFAULT;
1434 : 0 : retval = write_pool(&input_pool, (const char __user *)p,
1435 : : size);
1436 [ # # ]: 0 : if (retval < 0)
1437 : : return retval;
1438 : : credit_entropy_bits_safe(&input_pool, ent_count);
1439 : 0 : return 0;
1440 : : case RNDZAPENTCNT:
1441 : : case RNDCLEARPOOL:
1442 : : /*
1443 : : * Clear the entropy pool counters. We no longer clear
1444 : : * the entropy pool, as that's silly.
1445 : : */
1446 [ # # ]: 0 : if (!capable(CAP_SYS_ADMIN))
1447 : : return -EPERM;
1448 : 0 : input_pool.entropy_count = 0;
1449 : 0 : nonblocking_pool.entropy_count = 0;
1450 : 0 : blocking_pool.entropy_count = 0;
1451 : 0 : return 0;
1452 : : default:
1453 : : return -EINVAL;
1454 : : }
1455 : : }
1456 : :
1457 : 0 : static int random_fasync(int fd, struct file *filp, int on)
1458 : : {
1459 : 0 : return fasync_helper(fd, filp, on, &fasync);
1460 : : }
1461 : :
1462 : : const struct file_operations random_fops = {
1463 : : .read = random_read,
1464 : : .write = random_write,
1465 : : .poll = random_poll,
1466 : : .unlocked_ioctl = random_ioctl,
1467 : : .fasync = random_fasync,
1468 : : .llseek = noop_llseek,
1469 : : };
1470 : :
1471 : : const struct file_operations urandom_fops = {
1472 : : .read = urandom_read,
1473 : : .write = random_write,
1474 : : .unlocked_ioctl = random_ioctl,
1475 : : .fasync = random_fasync,
1476 : : .llseek = noop_llseek,
1477 : : };
1478 : :
1479 : : /***************************************************************
1480 : : * Random UUID interface
1481 : : *
1482 : : * Used here for a Boot ID, but can be useful for other kernel
1483 : : * drivers.
1484 : : ***************************************************************/
1485 : :
1486 : : /*
1487 : : * Generate random UUID
1488 : : */
1489 : 0 : void generate_random_uuid(unsigned char uuid_out[16])
1490 : : {
1491 : 3 : get_random_bytes(uuid_out, 16);
1492 : : /* Set UUID version to 4 --- truly random generation */
1493 : 3 : uuid_out[6] = (uuid_out[6] & 0x0F) | 0x40;
1494 : : /* Set the UUID variant to DCE */
1495 : 3 : uuid_out[8] = (uuid_out[8] & 0x3F) | 0x80;
1496 : 3 : }
1497 : : EXPORT_SYMBOL(generate_random_uuid);
1498 : :
1499 : : /********************************************************************
1500 : : *
1501 : : * Sysctl interface
1502 : : *
1503 : : ********************************************************************/
1504 : :
1505 : : #ifdef CONFIG_SYSCTL
1506 : :
1507 : : #include <linux/sysctl.h>
1508 : :
1509 : : static int min_read_thresh = 8, min_write_thresh;
1510 : : static int max_read_thresh = INPUT_POOL_WORDS * 32;
1511 : : static int max_write_thresh = INPUT_POOL_WORDS * 32;
1512 : : static char sysctl_bootid[16];
1513 : :
1514 : : /*
1515 : : * These functions is used to return both the bootid UUID, and random
1516 : : * UUID. The difference is in whether table->data is NULL; if it is,
1517 : : * then a new UUID is generated and returned to the user.
1518 : : *
1519 : : * If the user accesses this via the proc interface, it will be returned
1520 : : * as an ASCII string in the standard UUID format. If accesses via the
1521 : : * sysctl system call, it is returned as 16 bytes of binary data.
1522 : : */
1523 : 0 : static int proc_do_uuid(struct ctl_table *table, int write,
1524 : : void __user *buffer, size_t *lenp, loff_t *ppos)
1525 : : {
1526 : : struct ctl_table fake_table;
1527 : : unsigned char buf[64], tmp_uuid[16], *uuid;
1528 : :
1529 : 4 : uuid = table->data;
1530 [ + + ]: 4 : if (!uuid) {
1531 : : uuid = tmp_uuid;
1532 : 2 : generate_random_uuid(uuid);
1533 : : } else {
1534 : : static DEFINE_SPINLOCK(bootid_spinlock);
1535 : :
1536 : : spin_lock(&bootid_spinlock);
1537 [ + + ]: 2 : if (!uuid[8])
1538 : 1 : generate_random_uuid(uuid);
1539 : : spin_unlock(&bootid_spinlock);
1540 : : }
1541 : :
1542 : 4 : sprintf(buf, "%pU", uuid);
1543 : :
1544 : 4 : fake_table.data = buf;
1545 : 4 : fake_table.maxlen = sizeof(buf);
1546 : :
1547 : 4 : return proc_dostring(&fake_table, write, buffer, lenp, ppos);
1548 : : }
1549 : :
1550 : : /*
1551 : : * Return entropy available scaled to integral bits
1552 : : */
1553 : 0 : static int proc_do_entropy(ctl_table *table, int write,
1554 : : void __user *buffer, size_t *lenp, loff_t *ppos)
1555 : : {
1556 : : ctl_table fake_table;
1557 : : int entropy_count;
1558 : :
1559 : 2 : entropy_count = *(int *)table->data >> ENTROPY_SHIFT;
1560 : :
1561 : 2 : fake_table.data = &entropy_count;
1562 : 2 : fake_table.maxlen = sizeof(entropy_count);
1563 : :
1564 : 2 : return proc_dointvec(&fake_table, write, buffer, lenp, ppos);
1565 : : }
1566 : :
1567 : : static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
1568 : : extern struct ctl_table random_table[];
1569 : : struct ctl_table random_table[] = {
1570 : : {
1571 : : .procname = "poolsize",
1572 : : .data = &sysctl_poolsize,
1573 : : .maxlen = sizeof(int),
1574 : : .mode = 0444,
1575 : : .proc_handler = proc_dointvec,
1576 : : },
1577 : : {
1578 : : .procname = "entropy_avail",
1579 : : .maxlen = sizeof(int),
1580 : : .mode = 0444,
1581 : : .proc_handler = proc_do_entropy,
1582 : : .data = &input_pool.entropy_count,
1583 : : },
1584 : : {
1585 : : .procname = "read_wakeup_threshold",
1586 : : .data = &random_read_wakeup_thresh,
1587 : : .maxlen = sizeof(int),
1588 : : .mode = 0644,
1589 : : .proc_handler = proc_dointvec_minmax,
1590 : : .extra1 = &min_read_thresh,
1591 : : .extra2 = &max_read_thresh,
1592 : : },
1593 : : {
1594 : : .procname = "write_wakeup_threshold",
1595 : : .data = &random_write_wakeup_thresh,
1596 : : .maxlen = sizeof(int),
1597 : : .mode = 0644,
1598 : : .proc_handler = proc_dointvec_minmax,
1599 : : .extra1 = &min_write_thresh,
1600 : : .extra2 = &max_write_thresh,
1601 : : },
1602 : : {
1603 : : .procname = "urandom_min_reseed_secs",
1604 : : .data = &random_min_urandom_seed,
1605 : : .maxlen = sizeof(int),
1606 : : .mode = 0644,
1607 : : .proc_handler = proc_dointvec,
1608 : : },
1609 : : {
1610 : : .procname = "boot_id",
1611 : : .data = &sysctl_bootid,
1612 : : .maxlen = 16,
1613 : : .mode = 0444,
1614 : : .proc_handler = proc_do_uuid,
1615 : : },
1616 : : {
1617 : : .procname = "uuid",
1618 : : .maxlen = 16,
1619 : : .mode = 0444,
1620 : : .proc_handler = proc_do_uuid,
1621 : : },
1622 : : { }
1623 : : };
1624 : : #endif /* CONFIG_SYSCTL */
1625 : :
1626 : : static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
1627 : :
1628 : 0 : int random_int_secret_init(void)
1629 : : {
1630 : 0 : get_random_bytes(random_int_secret, sizeof(random_int_secret));
1631 : 0 : return 0;
1632 : : }
1633 : :
1634 : : /*
1635 : : * Get a random word for internal kernel use only. Similar to urandom but
1636 : : * with the goal of minimal entropy pool depletion. As a result, the random
1637 : : * value is not cryptographically secure but for several uses the cost of
1638 : : * depleting entropy is too high
1639 : : */
1640 : : static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
1641 : 0 : unsigned int get_random_int(void)
1642 : : {
1643 : : __u32 *hash;
1644 : : unsigned int ret;
1645 : :
1646 : : if (arch_get_random_int(&ret))
1647 : : return ret;
1648 : :
1649 : 1185960 : hash = get_cpu_var(get_random_int_hash);
1650 : :
1651 [ + ]: 1185955 : hash[0] += current->pid + jiffies + random_get_entropy();
1652 : 1185956 : md5_transform(hash, random_int_secret);
1653 : 1185948 : ret = hash[0];
1654 : 1185948 : put_cpu_var(get_random_int_hash);
1655 : :
1656 : : return ret;
1657 : : }
1658 : : EXPORT_SYMBOL(get_random_int);
1659 : :
1660 : : /*
1661 : : * randomize_range() returns a start address such that
1662 : : *
1663 : : * [...... <range> .....]
1664 : : * start end
1665 : : *
1666 : : * a <range> with size "len" starting at the return value is inside in the
1667 : : * area defined by [start, end], but is otherwise randomized.
1668 : : */
1669 : : unsigned long
1670 : 0 : randomize_range(unsigned long start, unsigned long end, unsigned long len)
1671 : : {
1672 : 27246 : unsigned long range = end - len - start;
1673 : :
1674 [ + - ]: 27246 : if (end <= start + len)
1675 : : return 0;
1676 : 27246 : return PAGE_ALIGN(get_random_int() % range + start);
1677 : : }
|
