1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * s390 arch random implementation. 4 * 5 * Copyright IBM Corp. 2017, 2020 6 * Author(s): Harald Freudenberger 7 * 8 * The s390_arch_random_generate() function may be called from random.c 9 * in interrupt context. So this implementation does the best to be very 10 * fast. There is a buffer of random data which is asynchronously checked 11 * and filled by a workqueue thread. 12 * If there are enough bytes in the buffer the s390_arch_random_generate() 13 * just delivers these bytes. Otherwise false is returned until the 14 * worker thread refills the buffer. 15 * The worker fills the rng buffer by pulling fresh entropy from the 16 * high quality (but slow) true hardware random generator. This entropy 17 * is then spread over the buffer with an pseudo random generator PRNG. 18 * As the arch_get_random_seed_long() fetches 8 bytes and the calling 19 * function add_interrupt_randomness() counts this as 1 bit entropy the 20 * distribution needs to make sure there is in fact 1 bit entropy contained 21 * in 8 bytes of the buffer. The current values pull 32 byte entropy 22 * and scatter this into a 2048 byte buffer. So 8 byte in the buffer 23 * will contain 1 bit of entropy. 24 * The worker thread is rescheduled based on the charge level of the 25 * buffer but at least with 500 ms delay to avoid too much CPU consumption. 26 * So the max. amount of rng data delivered via arch_get_random_seed is 27 * limited to 4k bytes per second. 28 */ 29 30 #include <linux/kernel.h> 31 #include <linux/atomic.h> 32 #include <linux/random.h> 33 #include <linux/slab.h> 34 #include <linux/static_key.h> 35 #include <linux/workqueue.h> 36 #include <linux/moduleparam.h> 37 #include <asm/cpacf.h> 38 39 DEFINE_STATIC_KEY_FALSE(s390_arch_random_available); 40 41 atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0); 42 EXPORT_SYMBOL(s390_arch_random_counter); 43 44 #define ARCH_REFILL_TICKS (HZ/2) 45 #define ARCH_PRNG_SEED_SIZE 32 46 #define ARCH_RNG_BUF_SIZE 2048 47 48 static DEFINE_SPINLOCK(arch_rng_lock); 49 static u8 *arch_rng_buf; 50 static unsigned int arch_rng_buf_idx; 51 52 static void arch_rng_refill_buffer(struct work_struct *); 53 static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer); 54 55 bool s390_arch_random_generate(u8 *buf, unsigned int nbytes) 56 { 57 /* lock rng buffer */ 58 if (!spin_trylock(&arch_rng_lock)) 59 return false; 60 61 /* try to resolve the requested amount of bytes from the buffer */ 62 arch_rng_buf_idx -= nbytes; 63 if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) { 64 memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes); 65 atomic64_add(nbytes, &s390_arch_random_counter); 66 spin_unlock(&arch_rng_lock); 67 return true; 68 } 69 70 /* not enough bytes in rng buffer, refill is done asynchronously */ 71 spin_unlock(&arch_rng_lock); 72 73 return false; 74 } 75 EXPORT_SYMBOL(s390_arch_random_generate); 76 77 static void arch_rng_refill_buffer(struct work_struct *unused) 78 { 79 unsigned int delay = ARCH_REFILL_TICKS; 80 81 spin_lock(&arch_rng_lock); 82 if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) { 83 /* buffer is exhausted and needs refill */ 84 u8 seed[ARCH_PRNG_SEED_SIZE]; 85 u8 prng_wa[240]; 86 /* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */ 87 cpacf_trng(NULL, 0, seed, sizeof(seed)); 88 /* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */ 89 memset(prng_wa, 0, sizeof(prng_wa)); 90 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 91 &prng_wa, NULL, 0, seed, sizeof(seed)); 92 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 93 &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0); 94 arch_rng_buf_idx = ARCH_RNG_BUF_SIZE; 95 } 96 delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE; 97 spin_unlock(&arch_rng_lock); 98 99 /* kick next check */ 100 queue_delayed_work(system_long_wq, &arch_rng_work, delay); 101 } 102 103 /* 104 * Here follows the implementation of s390_arch_get_random_long(). 105 * 106 * The random longs to be pulled by arch_get_random_long() are 107 * prepared in an 4K buffer which is filled from the NIST 800-90 108 * compliant s390 drbg. By default the random long buffer is refilled 109 * 256 times before the drbg itself needs a reseed. The reseed of the 110 * drbg is done with 32 bytes fetched from the high quality (but slow) 111 * trng which is assumed to deliver 100% entropy. So the 32 * 8 = 256 112 * bits of entropy are spread over 256 * 4KB = 1MB serving 131072 113 * arch_get_random_long() invocations before reseeded. 114 * 115 * How often the 4K random long buffer is refilled with the drbg 116 * before the drbg is reseeded can be adjusted. There is a module 117 * parameter 's390_arch_rnd_long_drbg_reseed' accessible via 118 * /sys/module/arch_random/parameters/rndlong_drbg_reseed 119 * or as kernel command line parameter 120 * arch_random.rndlong_drbg_reseed=<value> 121 * This parameter tells how often the drbg fills the 4K buffer before 122 * it is re-seeded by fresh entropy from the trng. 123 * A value of 16 results in reseeding the drbg at every 16 * 4 KB = 64 124 * KB with 32 bytes of fresh entropy pulled from the trng. So a value 125 * of 16 would result in 256 bits entropy per 64 KB. 126 * A value of 256 results in 1MB of drbg output before a reseed of the 127 * drbg is done. So this would spread the 256 bits of entropy among 1MB. 128 * Setting this parameter to 0 forces the reseed to take place every 129 * time the 4K buffer is depleted, so the entropy rises to 256 bits 130 * entropy per 4K or 0.5 bit entropy per arch_get_random_long(). With 131 * setting this parameter to negative values all this effort is 132 * disabled, arch_get_random long() returns false and thus indicating 133 * that the arch_get_random_long() feature is disabled at all. 134 */ 135 136 static unsigned long rndlong_buf[512]; 137 static DEFINE_SPINLOCK(rndlong_lock); 138 static int rndlong_buf_index; 139 140 static int rndlong_drbg_reseed = 256; 141 module_param_named(rndlong_drbg_reseed, rndlong_drbg_reseed, int, 0600); 142 MODULE_PARM_DESC(rndlong_drbg_reseed, "s390 arch_get_random_long() drbg reseed"); 143 144 static inline void refill_rndlong_buf(void) 145 { 146 static u8 prng_ws[240]; 147 static int drbg_counter; 148 149 if (--drbg_counter < 0) { 150 /* need to re-seed the drbg */ 151 u8 seed[32]; 152 153 /* fetch seed from trng */ 154 cpacf_trng(NULL, 0, seed, sizeof(seed)); 155 /* seed drbg */ 156 memset(prng_ws, 0, sizeof(prng_ws)); 157 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 158 &prng_ws, NULL, 0, seed, sizeof(seed)); 159 /* re-init counter for drbg */ 160 drbg_counter = rndlong_drbg_reseed; 161 } 162 163 /* fill the arch_get_random_long buffer from drbg */ 164 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, &prng_ws, 165 (u8 *) rndlong_buf, sizeof(rndlong_buf), 166 NULL, 0); 167 } 168 169 bool s390_arch_get_random_long(unsigned long *v) 170 { 171 bool rc = false; 172 unsigned long flags; 173 174 /* arch_get_random_long() disabled ? */ 175 if (rndlong_drbg_reseed < 0) 176 return false; 177 178 /* try to lock the random long lock */ 179 if (!spin_trylock_irqsave(&rndlong_lock, flags)) 180 return false; 181 182 if (--rndlong_buf_index >= 0) { 183 /* deliver next long value from the buffer */ 184 *v = rndlong_buf[rndlong_buf_index]; 185 rc = true; 186 goto out; 187 } 188 189 /* buffer is depleted and needs refill */ 190 if (in_interrupt()) { 191 /* delay refill in interrupt context to next caller */ 192 rndlong_buf_index = 0; 193 goto out; 194 } 195 196 /* refill random long buffer */ 197 refill_rndlong_buf(); 198 rndlong_buf_index = ARRAY_SIZE(rndlong_buf); 199 200 /* and provide one random long */ 201 *v = rndlong_buf[--rndlong_buf_index]; 202 rc = true; 203 204 out: 205 spin_unlock_irqrestore(&rndlong_lock, flags); 206 return rc; 207 } 208 EXPORT_SYMBOL(s390_arch_get_random_long); 209 210 static int __init s390_arch_random_init(void) 211 { 212 /* all the needed PRNO subfunctions available ? */ 213 if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) && 214 cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { 215 216 /* alloc arch random working buffer */ 217 arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL); 218 if (!arch_rng_buf) 219 return -ENOMEM; 220 221 /* kick worker queue job to fill the random buffer */ 222 queue_delayed_work(system_long_wq, 223 &arch_rng_work, ARCH_REFILL_TICKS); 224 225 /* enable arch random to the outside world */ 226 static_branch_enable(&s390_arch_random_available); 227 } 228 229 return 0; 230 } 231 arch_initcall(s390_arch_random_init); 232