forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2023-12-11 d2ccde1c8e90d38cee87a1b0309ad2827f3fd30d 
 kernel/crypto/drbg.c
....@@ -98,6 +98,7 @@
9898  */
9999 
100100 #include <crypto/drbg.h>
101
+#include <crypto/internal/cipher.h>
101102 #include <linux/kernel.h>
102103 
103104 /***************************************************************
....@@ -217,6 +218,57 @@
217218 	default:
218219 		return 32;
219220 	}
221
+}
222
+
223
+/*
224
+ * FIPS 140-2 continuous self test for the noise source
225
+ * The test is performed on the noise source input data. Thus, the function
226
+ * implicitly knows the size of the buffer to be equal to the security
227
+ * strength.
228
+ *
229
+ * Note, this function disregards the nonce trailing the entropy data during
230
+ * initial seeding.
231
+ *
232
+ * drbg->drbg_mutex must have been taken.
233
+ *
234
+ * @drbg DRBG handle
235
+ * @entropy buffer of seed data to be checked
236
+ *
237
+ * return:
238
+ *	0 on success
239
+ *	-EAGAIN on when the CTRNG is not yet primed
240
+ *	< 0 on error
241
+ */
242
+static int drbg_fips_continuous_test(struct drbg_state *drbg,
243
+				     const unsigned char *entropy)
244
+{
245
+	unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
246
+	int ret = 0;
247
+
248
+	if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
249
+		return 0;
250
+
251
+	/* skip test if we test the overall system */
252
+	if (list_empty(&drbg->test_data.list))
253
+		return 0;
254
+	/* only perform test in FIPS mode */
255
+	if (!fips_enabled)
256
+		return 0;
257
+
258
+	if (!drbg->fips_primed) {
259
+		/* Priming of FIPS test */
260
+		memcpy(drbg->prev, entropy, entropylen);
261
+		drbg->fips_primed = true;
262
+		/* priming: another round is needed */
263
+		return -EAGAIN;
264
+	}
265
+	ret = memcmp(drbg->prev, entropy, entropylen);
266
+	if (!ret)
267
+		panic("DRBG continuous self test failed\n");
268
+	memcpy(drbg->prev, entropy, entropylen);
269
+
270
+	/* the test shall pass when the two values are not equal */
271
+	return 0;
220272 }
221273 
222274 /*
....@@ -984,55 +1036,80 @@
9841036  ******************************************************************/
9851037 
9861038 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
987
-			      int reseed)
1039
+			      int reseed, enum drbg_seed_state new_seed_state)
9881040 {
9891041 	int ret = drbg->d_ops->update(drbg, seed, reseed);
9901042 
9911043 	if (ret)
9921044 		return ret;
9931045 
994
-	drbg->seeded = true;
1046
+	drbg->seeded = new_seed_state;
9951047 	/* 10.1.1.2 / 10.1.1.3 step 5 */
9961048 	drbg->reseed_ctr = 1;
1049
+
1050
+	switch (drbg->seeded) {
1051
+	case DRBG_SEED_STATE_UNSEEDED:
1052
+		/* Impossible, but handle it to silence compiler warnings. */
1053
+		fallthrough;
1054
+	case DRBG_SEED_STATE_PARTIAL:
1055
+		/*
1056
+		 * Require frequent reseeds until the seed source is
1057
+		 * fully initialized.
1058
+		 */
1059
+		drbg->reseed_threshold = 50;
1060
+		break;
1061
+
1062
+	case DRBG_SEED_STATE_FULL:
1063
+		/*
1064
+		 * Seed source has become fully initialized, frequent
1065
+		 * reseeds no longer required.
1066
+		 */
1067
+		drbg->reseed_threshold = drbg_max_requests(drbg);
1068
+		break;
1069
+	}
9971070 
9981071 	return ret;
9991072 }
10001073 
1001
-static void drbg_async_seed(struct work_struct *work)
1074
+static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1075
+					unsigned char *entropy,
1076
+					unsigned int entropylen)
1077
+{
1078
+	int ret;
1079
+
1080
+	do {
1081
+		get_random_bytes(entropy, entropylen);
1082
+		ret = drbg_fips_continuous_test(drbg, entropy);
1083
+		if (ret && ret != -EAGAIN)
1084
+			return ret;
1085
+	} while (ret);
1086
+
1087
+	return 0;
1088
+}
1089
+
1090
+static int drbg_seed_from_random(struct drbg_state *drbg)
10021091 {
10031092 	struct drbg_string data;
10041093 	LIST_HEAD(seedlist);
1005
-	struct drbg_state *drbg = container_of(work, struct drbg_state,
1006
-					       seed_work);
10071094 	unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
10081095 	unsigned char entropy[32];
1096
+	int ret;
10091097 
10101098 	BUG_ON(!entropylen);
10111099 	BUG_ON(entropylen > sizeof(entropy));
1012
-	get_random_bytes(entropy, entropylen);
10131100 
10141101 	drbg_string_fill(&data, entropy, entropylen);
10151102 	list_add_tail(&data.list, &seedlist);
10161103 
1017
-	mutex_lock(&drbg->drbg_mutex);
1104
+	ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1105
+	if (ret)
1106
+		goto out;
10181107 
1019
-	/* If nonblocking pool is initialized, deactivate Jitter RNG */
1020
-	crypto_free_rng(drbg->jent);
1021
-	drbg->jent = NULL;
1108
+	ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
10221109 
1023
-	/* Set seeded to false so that if __drbg_seed fails the
1024
-	 * next generate call will trigger a reseed.
1025
-	 */
1026
-	drbg->seeded = false;
1027
-
1028
-	__drbg_seed(drbg, &seedlist, true);
1029
-
1030
-	if (drbg->seeded)
1031
-		drbg->reseed_threshold = drbg_max_requests(drbg);
1032
-
1033
-	mutex_unlock(&drbg->drbg_mutex);
1034
-
1110
+out:
10351111 	memzero_explicit(entropy, entropylen);
1112
+	return ret;
10361113 }
10371114 
10381115 /*
....@@ -1054,6 +1131,7 @@
10541131 	unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
10551132 	struct drbg_string data1;
10561133 	LIST_HEAD(seedlist);
1134
+	enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
10571135 
10581136 	/* 9.1 / 9.2 / 9.3.1 step 3 */
10591137 	if (pers && pers->len > (drbg_max_addtl(drbg))) {
....@@ -1081,7 +1159,12 @@
10811159 		BUG_ON((entropylen * 2) > sizeof(entropy));
10821160 
10831161 		/* Get seed from in-kernel /dev/urandom */
1084
-		get_random_bytes(entropy, entropylen);
1162
+		if (!rng_is_initialized())
1163
+			new_seed_state = DRBG_SEED_STATE_PARTIAL;
1164
+
1165
+		ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1166
+		if (ret)
1167
+			goto out;
10851168 
10861169 		if (!drbg->jent) {
10871170 			drbg_string_fill(&data1, entropy, entropylen);
....@@ -1094,7 +1177,23 @@
10941177 						   entropylen);
10951178 			if (ret) {
10961179 				pr_devel("DRBG: jent failed with %d\n", ret);
1097
-				return ret;
1180
+
1181
+				/*
1182
+				 * Do not treat the transient failure of the
1183
+				 * Jitter RNG as an error that needs to be
1184
+				 * reported. The combined number of the
1185
+				 * maximum reseed threshold times the maximum
1186
+				 * number of Jitter RNG transient errors is
1187
+				 * less than the reseed threshold required by
1188
+				 * SP800-90A allowing us to treat the
1189
+				 * transient errors as such.
1190
+				 *
1191
+				 * However, we mandate that at least the first
1192
+				 * seeding operation must succeed with the
1193
+				 * Jitter RNG.
1194
+				 */
1195
+				if (!reseed || ret != -EAGAIN)
1196
+					goto out;
10981197 			}
10991198 
11001199 			drbg_string_fill(&data1, entropy, entropylen * 2);
....@@ -1119,8 +1218,9 @@
11191218 		memset(drbg->C, 0, drbg_statelen(drbg));
11201219 	}
11211220 
1122
-	ret = __drbg_seed(drbg, &seedlist, reseed);
1221
+	ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
11231222 
1223
+out:
11241224 	memzero_explicit(entropy, entropylen * 2);
11251225 
11261226 	return ret;
....@@ -1131,17 +1231,22 @@
11311231 {
11321232 	if (!drbg)
11331233 		return;
1134
-	kzfree(drbg->Vbuf);
1234
+	kfree_sensitive(drbg->Vbuf);
11351235 	drbg->Vbuf = NULL;
11361236 	drbg->V = NULL;
1137
-	kzfree(drbg->Cbuf);
1237
+	kfree_sensitive(drbg->Cbuf);
11381238 	drbg->Cbuf = NULL;
11391239 	drbg->C = NULL;
1140
-	kzfree(drbg->scratchpadbuf);
1240
+	kfree_sensitive(drbg->scratchpadbuf);
11411241 	drbg->scratchpadbuf = NULL;
11421242 	drbg->reseed_ctr = 0;
11431243 	drbg->d_ops = NULL;
11441244 	drbg->core = NULL;
1245
+	if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1246
+		kfree_sensitive(drbg->prev);
1247
+		drbg->prev = NULL;
1248
+		drbg->fips_primed = false;
1249
+	}
11451250 }
11461251 
11471252 /*
....@@ -1209,6 +1314,16 @@
12091314 			goto fini;
12101315 		}
12111316 		drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1317
+	}
1318
+
1319
+	if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1320
+		drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1321
+				     GFP_KERNEL);
1322
+		if (!drbg->prev) {
1323
+			ret = -ENOMEM;
1324
+			goto fini;
1325
+		}
1326
+		drbg->fips_primed = false;
12121327 	}
12131328 
12141329 	return 0;
....@@ -1283,19 +1398,25 @@
12831398 	 * here. The spec is a bit convoluted here, we make it simpler.
12841399 	 */
12851400 	if (drbg->reseed_threshold < drbg->reseed_ctr)
1286
-		drbg->seeded = false;
1401
+		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
12871402 
1288
-	if (drbg->pr || !drbg->seeded) {
1403
+	if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
12891404 		pr_devel("DRBG: reseeding before generation (prediction "
12901405 			 "resistance: %s, state %s)\n",
12911406 			 drbg->pr ? "true" : "false",
1292
-			 drbg->seeded ? "seeded" : "unseeded");
1407
+			 (drbg->seeded ==  DRBG_SEED_STATE_FULL ?
1408
+			  "seeded" : "unseeded"));
12931409 		/* 9.3.1 steps 7.1 through 7.3 */
12941410 		len = drbg_seed(drbg, addtl, true);
12951411 		if (len)
12961412 			goto err;
12971413 		/* 9.3.1 step 7.4 */
12981414 		addtl = NULL;
1415
+	} else if (rng_is_initialized() &&
1416
+		   drbg->seeded == DRBG_SEED_STATE_PARTIAL) {
1417
+		len = drbg_seed_from_random(drbg);
1418
+		if (len)
1419
+			goto err;
12991420 	}
13001421 
13011422 	if (addtl && 0 < addtl->len)
....@@ -1388,51 +1509,15 @@
13881509 	return 0;
13891510 }
13901511 
1391
-static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
1392
-{
1393
-	struct drbg_state *drbg = container_of(rdy, struct drbg_state,
1394
-					       random_ready);
1395
-
1396
-	schedule_work(&drbg->seed_work);
1397
-}
1398
-
13991512 static int drbg_prepare_hrng(struct drbg_state *drbg)
14001513 {
1401
-	int err;
1402
-
14031514 	/* We do not need an HRNG in test mode. */
14041515 	if (list_empty(&drbg->test_data.list))
14051516 		return 0;
14061517 
1407
-	INIT_WORK(&drbg->seed_work, drbg_async_seed);
1408
-
1409
-	drbg->random_ready.owner = THIS_MODULE;
1410
-	drbg->random_ready.func = drbg_schedule_async_seed;
1411
-
1412
-	err = add_random_ready_callback(&drbg->random_ready);
1413
-
1414
-	switch (err) {
1415
-	case 0:
1416
-		break;
1417
-
1418
-	case -EALREADY:
1419
-		err = 0;
1420
-		/* fall through */
1421
-
1422
-	default:
1423
-		drbg->random_ready.func = NULL;
1424
-		return err;
1425
-	}
1426
-
14271518 	drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
14281519 
1429
-	/*
1430
-	 * Require frequent reseeds until the seed source is fully
1431
-	 * initialized.
1432
-	 */
1433
-	drbg->reseed_threshold = 50;
1434
-
1435
-	return err;
1520
+	return 0;
14361521 }
14371522 
14381523 /*
....@@ -1475,7 +1560,7 @@
14751560 	if (!drbg->core) {
14761561 		drbg->core = &drbg_cores[coreref];
14771562 		drbg->pr = pr;
1478
-		drbg->seeded = false;
1563
+		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
14791564 		drbg->reseed_threshold = drbg_max_requests(drbg);
14801565 
14811566 		ret = drbg_alloc_state(drbg);
....@@ -1526,12 +1611,9 @@
15261611  */
15271612 static int drbg_uninstantiate(struct drbg_state *drbg)
15281613 {
1529
-	if (drbg->random_ready.func) {
1530
-		del_random_ready_callback(&drbg->random_ready);
1531
-		cancel_work_sync(&drbg->seed_work);
1614
+	if (!IS_ERR_OR_NULL(drbg->jent))
15321615 		crypto_free_rng(drbg->jent);
1533
-		drbg->jent = NULL;
1534
-	}
1616
+	drbg->jent = NULL;
15351617 
15361618 	if (drbg->d_ops)
15371619 		drbg->d_ops->crypto_fini(drbg);
....@@ -1587,7 +1669,6 @@
15871669 	}
15881670 
15891671 	sdesc->shash.tfm = tfm;
1590
-	sdesc->shash.flags = 0;
15911672 	drbg->priv_data = sdesc;
15921673 
15931674 	return crypto_shash_alignmask(tfm);
....@@ -1598,7 +1679,7 @@
15981679 	struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
15991680 	if (sdesc) {
16001681 		crypto_free_shash(sdesc->shash.tfm);
1601
-		kzfree(sdesc);
1682
+		kfree_sensitive(sdesc);
16021683 	}
16031684 	drbg->priv_data = NULL;
16041685 	return 0;
....@@ -2039,7 +2120,7 @@
20392120 	crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
20402121 }
20412122 
2042
-module_init(drbg_init);
2123
+subsys_initcall(drbg_init);
20432124 module_exit(drbg_exit);
20442125 #ifndef CRYPTO_DRBG_HASH_STRING
20452126 #define CRYPTO_DRBG_HASH_STRING ""
....@@ -2058,3 +2139,4 @@
20582139 		   CRYPTO_DRBG_HMAC_STRING
20592140 		   CRYPTO_DRBG_CTR_STRING);
20602141 MODULE_ALIAS_CRYPTO("stdrng");
2142
+MODULE_IMPORT_NS(CRYPTO_INTERNAL);