| .. | .. |
|---|
| 2 | 2 | /* |
|---|
| 3 | 3 | * s390 arch random implementation. |
|---|
| 4 | 4 | * |
|---|
| 5 | | - * Copyright IBM Corp. 2017, 2018 |
|---|
| 5 | + * Copyright IBM Corp. 2017, 2020 |
|---|
| 6 | 6 | * Author(s): Harald Freudenberger |
|---|
| 7 | | - * |
|---|
| 8 | | - * The s390_arch_random_generate() function may be called from random.c |
|---|
| 9 | | - * in interrupt context. So this implementation does the best to be very |
|---|
| 10 | | - * fast. There is a buffer of random data which is asynchronously checked |
|---|
| 11 | | - * and filled by a workqueue thread. |
|---|
| 12 | | - * If there are enough bytes in the buffer the s390_arch_random_generate() |
|---|
| 13 | | - * just delivers these bytes. Otherwise false is returned until the |
|---|
| 14 | | - * worker thread refills the buffer. |
|---|
| 15 | | - * The worker fills the rng buffer by pulling fresh entropy from the |
|---|
| 16 | | - * high quality (but slow) true hardware random generator. This entropy |
|---|
| 17 | | - * is then spread over the buffer with an pseudo random generator PRNG. |
|---|
| 18 | | - * As the arch_get_random_seed_long() fetches 8 bytes and the calling |
|---|
| 19 | | - * function add_interrupt_randomness() counts this as 1 bit entropy the |
|---|
| 20 | | - * distribution needs to make sure there is in fact 1 bit entropy contained |
|---|
| 21 | | - * in 8 bytes of the buffer. The current values pull 32 byte entropy |
|---|
| 22 | | - * and scatter this into a 2048 byte buffer. So 8 byte in the buffer |
|---|
| 23 | | - * will contain 1 bit of entropy. |
|---|
| 24 | | - * The worker thread is rescheduled based on the charge level of the |
|---|
| 25 | | - * buffer but at least with 500 ms delay to avoid too much CPU consumption. |
|---|
| 26 | | - * So the max. amount of rng data delivered via arch_get_random_seed is |
|---|
| 27 | | - * limited to 4k bytes per second. |
|---|
| 28 | 7 | */ |
|---|
| 29 | 8 | |
|---|
| 30 | 9 | #include <linux/kernel.h> |
|---|
| 31 | 10 | #include <linux/atomic.h> |
|---|
| 32 | 11 | #include <linux/random.h> |
|---|
| 33 | | -#include <linux/slab.h> |
|---|
| 34 | 12 | #include <linux/static_key.h> |
|---|
| 35 | | -#include <linux/workqueue.h> |
|---|
| 36 | 13 | #include <asm/cpacf.h> |
|---|
| 37 | 14 | |
|---|
| 38 | 15 | DEFINE_STATIC_KEY_FALSE(s390_arch_random_available); |
|---|
| 39 | 16 | |
|---|
| 40 | 17 | atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0); |
|---|
| 41 | 18 | EXPORT_SYMBOL(s390_arch_random_counter); |
|---|
| 42 | | - |
|---|
| 43 | | -#define ARCH_REFILL_TICKS (HZ/2) |
|---|
| 44 | | -#define ARCH_PRNG_SEED_SIZE 32 |
|---|
| 45 | | -#define ARCH_RNG_BUF_SIZE 2048 |
|---|
| 46 | | - |
|---|
| 47 | | -static DEFINE_SPINLOCK(arch_rng_lock); |
|---|
| 48 | | -static u8 *arch_rng_buf; |
|---|
| 49 | | -static unsigned int arch_rng_buf_idx; |
|---|
| 50 | | - |
|---|
| 51 | | -static void arch_rng_refill_buffer(struct work_struct *); |
|---|
| 52 | | -static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer); |
|---|
| 53 | | - |
|---|
| 54 | | -bool s390_arch_random_generate(u8 *buf, unsigned int nbytes) |
|---|
| 55 | | -{ |
|---|
| 56 | | - /* max hunk is ARCH_RNG_BUF_SIZE */ |
|---|
| 57 | | - if (nbytes > ARCH_RNG_BUF_SIZE) |
|---|
| 58 | | - return false; |
|---|
| 59 | | - |
|---|
| 60 | | - /* lock rng buffer */ |
|---|
| 61 | | - if (!spin_trylock(&arch_rng_lock)) |
|---|
| 62 | | - return false; |
|---|
| 63 | | - |
|---|
| 64 | | - /* try to resolve the requested amount of bytes from the buffer */ |
|---|
| 65 | | - arch_rng_buf_idx -= nbytes; |
|---|
| 66 | | - if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) { |
|---|
| 67 | | - memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes); |
|---|
| 68 | | - atomic64_add(nbytes, &s390_arch_random_counter); |
|---|
| 69 | | - spin_unlock(&arch_rng_lock); |
|---|
| 70 | | - return true; |
|---|
| 71 | | - } |
|---|
| 72 | | - |
|---|
| 73 | | - /* not enough bytes in rng buffer, refill is done asynchronously */ |
|---|
| 74 | | - spin_unlock(&arch_rng_lock); |
|---|
| 75 | | - |
|---|
| 76 | | - return false; |
|---|
| 77 | | -} |
|---|
| 78 | | -EXPORT_SYMBOL(s390_arch_random_generate); |
|---|
| 79 | | - |
|---|
| 80 | | -static void arch_rng_refill_buffer(struct work_struct *unused) |
|---|
| 81 | | -{ |
|---|
| 82 | | - unsigned int delay = ARCH_REFILL_TICKS; |
|---|
| 83 | | - |
|---|
| 84 | | - spin_lock(&arch_rng_lock); |
|---|
| 85 | | - if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) { |
|---|
| 86 | | - /* buffer is exhausted and needs refill */ |
|---|
| 87 | | - u8 seed[ARCH_PRNG_SEED_SIZE]; |
|---|
| 88 | | - u8 prng_wa[240]; |
|---|
| 89 | | - /* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */ |
|---|
| 90 | | - cpacf_trng(NULL, 0, seed, sizeof(seed)); |
|---|
| 91 | | - /* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */ |
|---|
| 92 | | - memset(prng_wa, 0, sizeof(prng_wa)); |
|---|
| 93 | | - cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, |
|---|
| 94 | | - &prng_wa, NULL, 0, seed, sizeof(seed)); |
|---|
| 95 | | - cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, |
|---|
| 96 | | - &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0); |
|---|
| 97 | | - arch_rng_buf_idx = ARCH_RNG_BUF_SIZE; |
|---|
| 98 | | - } |
|---|
| 99 | | - delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE; |
|---|
| 100 | | - spin_unlock(&arch_rng_lock); |
|---|
| 101 | | - |
|---|
| 102 | | - /* kick next check */ |
|---|
| 103 | | - queue_delayed_work(system_long_wq, &arch_rng_work, delay); |
|---|
| 104 | | -} |
|---|
| 105 | | - |
|---|
| 106 | | -static int __init s390_arch_random_init(void) |
|---|
| 107 | | -{ |
|---|
| 108 | | - /* all the needed PRNO subfunctions available ? */ |
|---|
| 109 | | - if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) && |
|---|
| 110 | | - cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { |
|---|
| 111 | | - |
|---|
| 112 | | - /* alloc arch random working buffer */ |
|---|
| 113 | | - arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL); |
|---|
| 114 | | - if (!arch_rng_buf) |
|---|
| 115 | | - return -ENOMEM; |
|---|
| 116 | | - |
|---|
| 117 | | - /* kick worker queue job to fill the random buffer */ |
|---|
| 118 | | - queue_delayed_work(system_long_wq, |
|---|
| 119 | | - &arch_rng_work, ARCH_REFILL_TICKS); |
|---|
| 120 | | - |
|---|
| 121 | | - /* enable arch random to the outside world */ |
|---|
| 122 | | - static_branch_enable(&s390_arch_random_available); |
|---|
| 123 | | - } |
|---|
| 124 | | - |
|---|
| 125 | | - return 0; |
|---|
| 126 | | -} |
|---|
| 127 | | -arch_initcall(s390_arch_random_init); |
|---|