mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-11-06 23:17:41 +00:00
4dd7a52b53
[ Upstream commit51c37a70aa
] For properly initialising the Tausworthe generator [1], we have a strict seeding requirement, that is, s1 > 1, s2 > 7, s3 > 15. Commit697f8d0348
("random32: seeding improvement") introduced a __seed() function that imposes boundary checks proposed by the errata paper [2] to properly ensure above conditions. However, we're off by one, as the function is implemented as: "return (x < m) ? x + m : x;", and called with __seed(X, 1), __seed(X, 7), __seed(X, 15). Thus, an unwanted seed of 1, 7, 15 would be possible, whereas the lower boundary should actually be of at least 2, 8, 16, just as GSL does. Fix this, as otherwise an initialization with an unwanted seed could have the effect that Tausworthe's PRNG properties cannot not be ensured. Note that this PRNG is *not* used for cryptography in the kernel. [1] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps [2] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps Joint work with Hannes Frederic Sowa. Fixes:697f8d0348
("random32: seeding improvement") Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: Florian Weimer <fweimer@redhat.com> Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
150 lines
3.9 KiB
C
150 lines
3.9 KiB
C
/*
|
|
This is a maximally equidistributed combined Tausworthe generator
|
|
based on code from GNU Scientific Library 1.5 (30 Jun 2004)
|
|
|
|
x_n = (s1_n ^ s2_n ^ s3_n)
|
|
|
|
s1_{n+1} = (((s1_n & 4294967294) <<12) ^ (((s1_n <<13) ^ s1_n) >>19))
|
|
s2_{n+1} = (((s2_n & 4294967288) << 4) ^ (((s2_n << 2) ^ s2_n) >>25))
|
|
s3_{n+1} = (((s3_n & 4294967280) <<17) ^ (((s3_n << 3) ^ s3_n) >>11))
|
|
|
|
The period of this generator is about 2^88.
|
|
|
|
From: P. L'Ecuyer, "Maximally Equidistributed Combined Tausworthe
|
|
Generators", Mathematics of Computation, 65, 213 (1996), 203--213.
|
|
|
|
This is available on the net from L'Ecuyer's home page,
|
|
|
|
http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps
|
|
ftp://ftp.iro.umontreal.ca/pub/simulation/lecuyer/papers/tausme.ps
|
|
|
|
There is an erratum in the paper "Tables of Maximally
|
|
Equidistributed Combined LFSR Generators", Mathematics of
|
|
Computation, 68, 225 (1999), 261--269:
|
|
http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps
|
|
|
|
... the k_j most significant bits of z_j must be non-
|
|
zero, for each j. (Note: this restriction also applies to the
|
|
computer code given in [4], but was mistakenly not mentioned in
|
|
that paper.)
|
|
|
|
This affects the seeding procedure by imposing the requirement
|
|
s1 > 1, s2 > 7, s3 > 15.
|
|
|
|
*/
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/percpu.h>
|
|
#include <linux/export.h>
|
|
#include <linux/jiffies.h>
|
|
#include <linux/random.h>
|
|
|
|
static DEFINE_PER_CPU(struct rnd_state, net_rand_state);
|
|
|
|
/**
|
|
* prandom32 - seeded pseudo-random number generator.
|
|
* @state: pointer to state structure holding seeded state.
|
|
*
|
|
* This is used for pseudo-randomness with no outside seeding.
|
|
* For more random results, use random32().
|
|
*/
|
|
u32 prandom32(struct rnd_state *state)
|
|
{
|
|
#define TAUSWORTHE(s,a,b,c,d) ((s&c)<<d) ^ (((s <<a) ^ s)>>b)
|
|
|
|
state->s1 = TAUSWORTHE(state->s1, 13, 19, 4294967294UL, 12);
|
|
state->s2 = TAUSWORTHE(state->s2, 2, 25, 4294967288UL, 4);
|
|
state->s3 = TAUSWORTHE(state->s3, 3, 11, 4294967280UL, 17);
|
|
|
|
return (state->s1 ^ state->s2 ^ state->s3);
|
|
}
|
|
EXPORT_SYMBOL(prandom32);
|
|
|
|
/**
|
|
* random32 - pseudo random number generator
|
|
*
|
|
* A 32 bit pseudo-random number is generated using a fast
|
|
* algorithm suitable for simulation. This algorithm is NOT
|
|
* considered safe for cryptographic use.
|
|
*/
|
|
u32 random32(void)
|
|
{
|
|
unsigned long r;
|
|
struct rnd_state *state = &get_cpu_var(net_rand_state);
|
|
r = prandom32(state);
|
|
put_cpu_var(state);
|
|
return r;
|
|
}
|
|
EXPORT_SYMBOL(random32);
|
|
|
|
/**
|
|
* srandom32 - add entropy to pseudo random number generator
|
|
* @seed: seed value
|
|
*
|
|
* Add some additional seeding to the random32() pool.
|
|
*/
|
|
void srandom32(u32 entropy)
|
|
{
|
|
int i;
|
|
/*
|
|
* No locking on the CPUs, but then somewhat random results are, well,
|
|
* expected.
|
|
*/
|
|
for_each_possible_cpu (i) {
|
|
struct rnd_state *state = &per_cpu(net_rand_state, i);
|
|
state->s1 = __seed(state->s1 ^ entropy, 2);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL(srandom32);
|
|
|
|
/*
|
|
* Generate some initially weak seeding values to allow
|
|
* to start the random32() engine.
|
|
*/
|
|
static int __init random32_init(void)
|
|
{
|
|
int i;
|
|
|
|
for_each_possible_cpu(i) {
|
|
struct rnd_state *state = &per_cpu(net_rand_state,i);
|
|
|
|
#define LCG(x) ((x) * 69069) /* super-duper LCG */
|
|
state->s1 = __seed(LCG(i + jiffies), 2);
|
|
state->s2 = __seed(LCG(state->s1), 8);
|
|
state->s3 = __seed(LCG(state->s2), 16);
|
|
|
|
/* "warm it up" */
|
|
prandom32(state);
|
|
prandom32(state);
|
|
prandom32(state);
|
|
prandom32(state);
|
|
prandom32(state);
|
|
prandom32(state);
|
|
}
|
|
return 0;
|
|
}
|
|
core_initcall(random32_init);
|
|
|
|
/*
|
|
* Generate better values after random number generator
|
|
* is fully initialized.
|
|
*/
|
|
static int __init random32_reseed(void)
|
|
{
|
|
int i;
|
|
|
|
for_each_possible_cpu(i) {
|
|
struct rnd_state *state = &per_cpu(net_rand_state,i);
|
|
u32 seeds[3];
|
|
|
|
get_random_bytes(&seeds, sizeof(seeds));
|
|
state->s1 = __seed(seeds[0], 2);
|
|
state->s2 = __seed(seeds[1], 8);
|
|
state->s3 = __seed(seeds[2], 16);
|
|
|
|
/* mix it in */
|
|
prandom32(state);
|
|
}
|
|
return 0;
|
|
}
|
|
late_initcall(random32_reseed);
|