1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * s390 arch random implementation.
  4 *
  5 * Copyright IBM Corp. 2017, 2018
  6 * Author(s): Harald Freudenberger
  7 *
  8 * The s390_arch_random_generate() function may be called from random.c
  9 * in interrupt context. So this implementation does the best to be very
 10 * fast. There is a buffer of random data which is asynchronously checked
 11 * and filled by a workqueue thread.
 12 * If there are enough bytes in the buffer the s390_arch_random_generate()
 13 * just delivers these bytes. Otherwise false is returned until the
 14 * worker thread refills the buffer.
 15 * The worker fills the rng buffer by pulling fresh entropy from the
 16 * high quality (but slow) true hardware random generator. This entropy
 17 * is then spread over the buffer with an pseudo random generator PRNG.
 18 * As the arch_get_random_seed_long() fetches 8 bytes and the calling
 19 * function add_interrupt_randomness() counts this as 1 bit entropy the
 20 * distribution needs to make sure there is in fact 1 bit entropy contained
 21 * in 8 bytes of the buffer. The current values pull 32 byte entropy
 22 * and scatter this into a 2048 byte buffer. So 8 byte in the buffer
 23 * will contain 1 bit of entropy.
 24 * The worker thread is rescheduled based on the charge level of the
 25 * buffer but at least with 500 ms delay to avoid too much CPU consumption.
 26 * So the max. amount of rng data delivered via arch_get_random_seed is
 27 * limited to 4k bytes per second.
 28 */
 29
 30#include <linux/kernel.h>
 31#include <linux/atomic.h>
 32#include <linux/random.h>
 33#include <linux/slab.h>
 34#include <linux/static_key.h>
 35#include <linux/workqueue.h>
 36#include <asm/cpacf.h>
 37
 38DEFINE_STATIC_KEY_FALSE(s390_arch_random_available);
 39
 40atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0);
 41EXPORT_SYMBOL(s390_arch_random_counter);
 42
 43#define ARCH_REFILL_TICKS (HZ/2)
 44#define ARCH_PRNG_SEED_SIZE 32
 45#define ARCH_RNG_BUF_SIZE 2048
 46
 47static DEFINE_SPINLOCK(arch_rng_lock);
 48static u8 *arch_rng_buf;
 49static unsigned int arch_rng_buf_idx;
 50
 51static void arch_rng_refill_buffer(struct work_struct *);
 52static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer);
 53
 54bool s390_arch_random_generate(u8 *buf, unsigned int nbytes)
 55{
 56	/* lock rng buffer */
 57	if (!spin_trylock(&arch_rng_lock))
 58		return false;
 59
 60	/* try to resolve the requested amount of bytes from the buffer */
 61	arch_rng_buf_idx -= nbytes;
 62	if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) {
 63		memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes);
 64		atomic64_add(nbytes, &s390_arch_random_counter);
 65		spin_unlock(&arch_rng_lock);
 66		return true;
 67	}
 68
 69	/* not enough bytes in rng buffer, refill is done asynchronously */
 70	spin_unlock(&arch_rng_lock);
 71
 72	return false;
 73}
 74EXPORT_SYMBOL(s390_arch_random_generate);
 75
 76static void arch_rng_refill_buffer(struct work_struct *unused)
 77{
 78	unsigned int delay = ARCH_REFILL_TICKS;
 79
 80	spin_lock(&arch_rng_lock);
 81	if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) {
 82		/* buffer is exhausted and needs refill */
 83		u8 seed[ARCH_PRNG_SEED_SIZE];
 84		u8 prng_wa[240];
 85		/* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */
 86		cpacf_trng(NULL, 0, seed, sizeof(seed));
 87		/* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */
 88		memset(prng_wa, 0, sizeof(prng_wa));
 89		cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 90			   &prng_wa, NULL, 0, seed, sizeof(seed));
 91		cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 92			   &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0);
 93		arch_rng_buf_idx = ARCH_RNG_BUF_SIZE;
 94	}
 95	delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE;
 96	spin_unlock(&arch_rng_lock);
 97
 98	/* kick next check */
 99	queue_delayed_work(system_long_wq, &arch_rng_work, delay);
100}
101
102static int __init s390_arch_random_init(void)
103{
104	/* all the needed PRNO subfunctions available ? */
105	if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) &&
106	    cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
107
108		/* alloc arch random working buffer */
109		arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL);
110		if (!arch_rng_buf)
111			return -ENOMEM;
112
113		/* kick worker queue job to fill the random buffer */
114		queue_delayed_work(system_long_wq,
115				   &arch_rng_work, ARCH_REFILL_TICKS);
116
117		/* enable arch random to the outside world */
118		static_branch_enable(&s390_arch_random_available);
119	}
120
121	return 0;
122}
123arch_initcall(s390_arch_random_init);