1/*
   2 * DRBG: Deterministic Random Bits Generator
   3 *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
   4 *       properties:
   5 *		* CTR DRBG with DF with AES-128, AES-192, AES-256 cores
   6 *		* Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   7 *		* HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   8 *		* with and without prediction resistance
   9 *
  10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014
  11 *
  12 * Redistribution and use in source and binary forms, with or without
  13 * modification, are permitted provided that the following conditions
  14 * are met:
  15 * 1. Redistributions of source code must retain the above copyright
  16 *    notice, and the entire permission notice in its entirety,
  17 *    including the disclaimer of warranties.
  18 * 2. Redistributions in binary form must reproduce the above copyright
  19 *    notice, this list of conditions and the following disclaimer in the
  20 *    documentation and/or other materials provided with the distribution.
  21 * 3. The name of the author may not be used to endorse or promote
  22 *    products derived from this software without specific prior
  23 *    written permission.
  24 *
  25 * ALTERNATIVELY, this product may be distributed under the terms of
  26 * the GNU General Public License, in which case the provisions of the GPL are
  27 * required INSTEAD OF the above restrictions.  (This clause is
  28 * necessary due to a potential bad interaction between the GPL and
  29 * the restrictions contained in a BSD-style copyright.)
  30 *
  31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34 * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
  35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42 * DAMAGE.
  43 *
  44 * DRBG Usage
  45 * ==========
  46 * The SP 800-90A DRBG allows the user to specify a personalization string
  47 * for initialization as well as an additional information string for each
  48 * random number request. The following code fragments show how a caller
  49 * uses the kernel crypto API to use the full functionality of the DRBG.
  50 *
  51 * Usage without any additional data
  52 * ---------------------------------
  53 * struct crypto_rng *drng;
  54 * int err;
  55 * char data[DATALEN];
  56 *
  57 * drng = crypto_alloc_rng(drng_name, 0, 0);
  58 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59 * crypto_free_rng(drng);
  60 *
  61 *
  62 * Usage with personalization string during initialization
  63 * -------------------------------------------------------
  64 * struct crypto_rng *drng;
  65 * int err;
  66 * char data[DATALEN];
  67 * struct drbg_string pers;
  68 * char personalization[11] = "some-string";
  69 *
  70 * drbg_string_fill(&pers, personalization, strlen(personalization));
  71 * drng = crypto_alloc_rng(drng_name, 0, 0);
  72 * // The reset completely re-initializes the DRBG with the provided
  73 * // personalization string
  74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76 * crypto_free_rng(drng);
  77 *
  78 *
  79 * Usage with additional information string during random number request
  80 * ---------------------------------------------------------------------
  81 * struct crypto_rng *drng;
  82 * int err;
  83 * char data[DATALEN];
  84 * char addtl_string[11] = "some-string";
  85 * string drbg_string addtl;
  86 *
  87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88 * drng = crypto_alloc_rng(drng_name, 0, 0);
  89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90 * // the same error codes.
  91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92 * crypto_free_rng(drng);
  93 *
  94 *
  95 * Usage with personalization and additional information strings
  96 * -------------------------------------------------------------
  97 * Just mix both scenarios above.
  98 */
  99
 100#include <crypto/drbg.h>
 101#include <crypto/internal/cipher.h>
 102#include <linux/kernel.h>
 103#include <linux/jiffies.h>
 104
 105/***************************************************************
 106 * Backend cipher definitions available to DRBG
 107 ***************************************************************/
 108
 109/*
 110 * The order of the DRBG definitions here matter: every DRBG is registered
 111 * as stdrng. Each DRBG receives an increasing cra_priority values the later
 112 * they are defined in this array (see drbg_fill_array).
 113 *
 114 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and the
 115 * HMAC-SHA512 / SHA256 / AES 256 over other ciphers. Thus, the
 116 * favored DRBGs are the latest entries in this array.
 117 */
 118static const struct drbg_core drbg_cores[] = {
 119#ifdef CONFIG_CRYPTO_DRBG_CTR
 120	{
 121		.flags = DRBG_CTR | DRBG_STRENGTH128,
 122		.statelen = 32, /* 256 bits as defined in 10.2.1 */
 123		.blocklen_bytes = 16,
 124		.cra_name = "ctr_aes128",
 125		.backend_cra_name = "aes",
 126	}, {
 127		.flags = DRBG_CTR | DRBG_STRENGTH192,
 128		.statelen = 40, /* 320 bits as defined in 10.2.1 */
 129		.blocklen_bytes = 16,
 130		.cra_name = "ctr_aes192",
 131		.backend_cra_name = "aes",
 132	}, {
 133		.flags = DRBG_CTR | DRBG_STRENGTH256,
 134		.statelen = 48, /* 384 bits as defined in 10.2.1 */
 135		.blocklen_bytes = 16,
 136		.cra_name = "ctr_aes256",
 137		.backend_cra_name = "aes",
 138	},
 139#endif /* CONFIG_CRYPTO_DRBG_CTR */
 140#ifdef CONFIG_CRYPTO_DRBG_HASH
 141	{
 
 
 
 
 
 
 142		.flags = DRBG_HASH | DRBG_STRENGTH256,
 143		.statelen = 111, /* 888 bits */
 144		.blocklen_bytes = 48,
 145		.cra_name = "sha384",
 146		.backend_cra_name = "sha384",
 147	}, {
 148		.flags = DRBG_HASH | DRBG_STRENGTH256,
 149		.statelen = 111, /* 888 bits */
 150		.blocklen_bytes = 64,
 151		.cra_name = "sha512",
 152		.backend_cra_name = "sha512",
 153	}, {
 154		.flags = DRBG_HASH | DRBG_STRENGTH256,
 155		.statelen = 55, /* 440 bits */
 156		.blocklen_bytes = 32,
 157		.cra_name = "sha256",
 158		.backend_cra_name = "sha256",
 159	},
 160#endif /* CONFIG_CRYPTO_DRBG_HASH */
 161#ifdef CONFIG_CRYPTO_DRBG_HMAC
 162	{
 
 
 
 
 
 
 163		.flags = DRBG_HMAC | DRBG_STRENGTH256,
 164		.statelen = 48, /* block length of cipher */
 165		.blocklen_bytes = 48,
 166		.cra_name = "hmac_sha384",
 167		.backend_cra_name = "hmac(sha384)",
 168	}, {
 169		.flags = DRBG_HMAC | DRBG_STRENGTH256,
 170		.statelen = 32, /* block length of cipher */
 171		.blocklen_bytes = 32,
 172		.cra_name = "hmac_sha256",
 173		.backend_cra_name = "hmac(sha256)",
 174	}, {
 175		.flags = DRBG_HMAC | DRBG_STRENGTH256,
 176		.statelen = 64, /* block length of cipher */
 177		.blocklen_bytes = 64,
 178		.cra_name = "hmac_sha512",
 179		.backend_cra_name = "hmac(sha512)",
 180	},
 181#endif /* CONFIG_CRYPTO_DRBG_HMAC */
 182};
 183
 184static int drbg_uninstantiate(struct drbg_state *drbg);
 185
 186/******************************************************************
 187 * Generic helper functions
 188 ******************************************************************/
 189
 190/*
 191 * Return strength of DRBG according to SP800-90A section 8.4
 192 *
 193 * @flags DRBG flags reference
 194 *
 195 * Return: normalized strength in *bytes* value or 32 as default
 196 *	   to counter programming errors
 197 */
 198static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
 199{
 200	switch (flags & DRBG_STRENGTH_MASK) {
 201	case DRBG_STRENGTH128:
 202		return 16;
 203	case DRBG_STRENGTH192:
 204		return 24;
 205	case DRBG_STRENGTH256:
 206		return 32;
 207	default:
 208		return 32;
 209	}
 210}
 211
 212/*
 213 * FIPS 140-2 continuous self test for the noise source
 214 * The test is performed on the noise source input data. Thus, the function
 215 * implicitly knows the size of the buffer to be equal to the security
 216 * strength.
 217 *
 218 * Note, this function disregards the nonce trailing the entropy data during
 219 * initial seeding.
 220 *
 221 * drbg->drbg_mutex must have been taken.
 222 *
 223 * @drbg DRBG handle
 224 * @entropy buffer of seed data to be checked
 225 *
 226 * return:
 227 *	0 on success
 228 *	-EAGAIN on when the CTRNG is not yet primed
 229 *	< 0 on error
 230 */
 231static int drbg_fips_continuous_test(struct drbg_state *drbg,
 232				     const unsigned char *entropy)
 233{
 234	unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
 235	int ret = 0;
 236
 237	if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
 238		return 0;
 239
 240	/* skip test if we test the overall system */
 241	if (list_empty(&drbg->test_data.list))
 242		return 0;
 243	/* only perform test in FIPS mode */
 244	if (!fips_enabled)
 245		return 0;
 246
 247	if (!drbg->fips_primed) {
 248		/* Priming of FIPS test */
 249		memcpy(drbg->prev, entropy, entropylen);
 250		drbg->fips_primed = true;
 251		/* priming: another round is needed */
 252		return -EAGAIN;
 253	}
 254	ret = memcmp(drbg->prev, entropy, entropylen);
 255	if (!ret)
 256		panic("DRBG continuous self test failed\n");
 257	memcpy(drbg->prev, entropy, entropylen);
 258
 259	/* the test shall pass when the two values are not equal */
 260	return 0;
 261}
 262
 263/*
 264 * Convert an integer into a byte representation of this integer.
 265 * The byte representation is big-endian
 266 *
 267 * @val value to be converted
 268 * @buf buffer holding the converted integer -- caller must ensure that
 269 *      buffer size is at least 32 bit
 270 */
 271#if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
 272static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
 273{
 274	struct s {
 275		__be32 conv;
 276	};
 277	struct s *conversion = (struct s *) buf;
 278
 279	conversion->conv = cpu_to_be32(val);
 280}
 281#endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
 282
 283/******************************************************************
 284 * CTR DRBG callback functions
 285 ******************************************************************/
 286
 287#ifdef CONFIG_CRYPTO_DRBG_CTR
 288#define CRYPTO_DRBG_CTR_STRING "CTR "
 289MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
 290MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
 291MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
 292MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
 293MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
 294MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
 295
 296static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
 297				 const unsigned char *key);
 298static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
 299			  const struct drbg_string *in);
 300static int drbg_init_sym_kernel(struct drbg_state *drbg);
 301static int drbg_fini_sym_kernel(struct drbg_state *drbg);
 302static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
 303			      u8 *inbuf, u32 inbuflen,
 304			      u8 *outbuf, u32 outlen);
 305#define DRBG_OUTSCRATCHLEN 256
 306
 307/* BCC function for CTR DRBG as defined in 10.4.3 */
 308static int drbg_ctr_bcc(struct drbg_state *drbg,
 309			unsigned char *out, const unsigned char *key,
 310			struct list_head *in)
 311{
 312	int ret = 0;
 313	struct drbg_string *curr = NULL;
 314	struct drbg_string data;
 315	short cnt = 0;
 316
 317	drbg_string_fill(&data, out, drbg_blocklen(drbg));
 318
 319	/* 10.4.3 step 2 / 4 */
 320	drbg_kcapi_symsetkey(drbg, key);
 321	list_for_each_entry(curr, in, list) {
 322		const unsigned char *pos = curr->buf;
 323		size_t len = curr->len;
 324		/* 10.4.3 step 4.1 */
 325		while (len) {
 326			/* 10.4.3 step 4.2 */
 327			if (drbg_blocklen(drbg) == cnt) {
 328				cnt = 0;
 329				ret = drbg_kcapi_sym(drbg, out, &data);
 330				if (ret)
 331					return ret;
 332			}
 333			out[cnt] ^= *pos;
 334			pos++;
 335			cnt++;
 336			len--;
 337		}
 338	}
 339	/* 10.4.3 step 4.2 for last block */
 340	if (cnt)
 341		ret = drbg_kcapi_sym(drbg, out, &data);
 342
 343	return ret;
 344}
 345
 346/*
 347 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
 348 * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
 349 * the scratchpad is used as follows:
 350 * drbg_ctr_update:
 351 *	temp
 352 *		start: drbg->scratchpad
 353 *		length: drbg_statelen(drbg) + drbg_blocklen(drbg)
 354 *			note: the cipher writing into this variable works
 355 *			blocklen-wise. Now, when the statelen is not a multiple
 356 *			of blocklen, the generateion loop below "spills over"
 357 *			by at most blocklen. Thus, we need to give sufficient
 358 *			memory.
 359 *	df_data
 360 *		start: drbg->scratchpad +
 361 *				drbg_statelen(drbg) + drbg_blocklen(drbg)
 362 *		length: drbg_statelen(drbg)
 363 *
 364 * drbg_ctr_df:
 365 *	pad
 366 *		start: df_data + drbg_statelen(drbg)
 367 *		length: drbg_blocklen(drbg)
 368 *	iv
 369 *		start: pad + drbg_blocklen(drbg)
 370 *		length: drbg_blocklen(drbg)
 371 *	temp
 372 *		start: iv + drbg_blocklen(drbg)
 373 *		length: drbg_satelen(drbg) + drbg_blocklen(drbg)
 374 *			note: temp is the buffer that the BCC function operates
 375 *			on. BCC operates blockwise. drbg_statelen(drbg)
 376 *			is sufficient when the DRBG state length is a multiple
 377 *			of the block size. For AES192 (and maybe other ciphers)
 378 *			this is not correct and the length for temp is
 379 *			insufficient (yes, that also means for such ciphers,
 380 *			the final output of all BCC rounds are truncated).
 381 *			Therefore, add drbg_blocklen(drbg) to cover all
 382 *			possibilities.
 383 */
 384
 385/* Derivation Function for CTR DRBG as defined in 10.4.2 */
 386static int drbg_ctr_df(struct drbg_state *drbg,
 387		       unsigned char *df_data, size_t bytes_to_return,
 388		       struct list_head *seedlist)
 389{
 390	int ret = -EFAULT;
 391	unsigned char L_N[8];
 392	/* S3 is input */
 393	struct drbg_string S1, S2, S4, cipherin;
 394	LIST_HEAD(bcc_list);
 395	unsigned char *pad = df_data + drbg_statelen(drbg);
 396	unsigned char *iv = pad + drbg_blocklen(drbg);
 397	unsigned char *temp = iv + drbg_blocklen(drbg);
 398	size_t padlen = 0;
 399	unsigned int templen = 0;
 400	/* 10.4.2 step 7 */
 401	unsigned int i = 0;
 402	/* 10.4.2 step 8 */
 403	const unsigned char *K = (unsigned char *)
 404			   "\x00\x01\x02\x03\x04\x05\x06\x07"
 405			   "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 406			   "\x10\x11\x12\x13\x14\x15\x16\x17"
 407			   "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
 408	unsigned char *X;
 409	size_t generated_len = 0;
 410	size_t inputlen = 0;
 411	struct drbg_string *seed = NULL;
 412
 413	memset(pad, 0, drbg_blocklen(drbg));
 414	memset(iv, 0, drbg_blocklen(drbg));
 415
 416	/* 10.4.2 step 1 is implicit as we work byte-wise */
 417
 418	/* 10.4.2 step 2 */
 419	if ((512/8) < bytes_to_return)
 420		return -EINVAL;
 421
 422	/* 10.4.2 step 2 -- calculate the entire length of all input data */
 423	list_for_each_entry(seed, seedlist, list)
 424		inputlen += seed->len;
 425	drbg_cpu_to_be32(inputlen, &L_N[0]);
 426
 427	/* 10.4.2 step 3 */
 428	drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
 429
 430	/* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
 431	padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
 432	/* wrap the padlen appropriately */
 433	if (padlen)
 434		padlen = drbg_blocklen(drbg) - padlen;
 435	/*
 436	 * pad / padlen contains the 0x80 byte and the following zero bytes.
 437	 * As the calculated padlen value only covers the number of zero
 438	 * bytes, this value has to be incremented by one for the 0x80 byte.
 439	 */
 440	padlen++;
 441	pad[0] = 0x80;
 442
 443	/* 10.4.2 step 4 -- first fill the linked list and then order it */
 444	drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
 445	list_add_tail(&S1.list, &bcc_list);
 446	drbg_string_fill(&S2, L_N, sizeof(L_N));
 447	list_add_tail(&S2.list, &bcc_list);
 448	list_splice_tail(seedlist, &bcc_list);
 449	drbg_string_fill(&S4, pad, padlen);
 450	list_add_tail(&S4.list, &bcc_list);
 451
 452	/* 10.4.2 step 9 */
 453	while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
 454		/*
 455		 * 10.4.2 step 9.1 - the padding is implicit as the buffer
 456		 * holds zeros after allocation -- even the increment of i
 457		 * is irrelevant as the increment remains within length of i
 458		 */
 459		drbg_cpu_to_be32(i, iv);
 460		/* 10.4.2 step 9.2 -- BCC and concatenation with temp */
 461		ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
 462		if (ret)
 463			goto out;
 464		/* 10.4.2 step 9.3 */
 465		i++;
 466		templen += drbg_blocklen(drbg);
 467	}
 468
 469	/* 10.4.2 step 11 */
 470	X = temp + (drbg_keylen(drbg));
 471	drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
 472
 473	/* 10.4.2 step 12: overwriting of outval is implemented in next step */
 474
 475	/* 10.4.2 step 13 */
 476	drbg_kcapi_symsetkey(drbg, temp);
 477	while (generated_len < bytes_to_return) {
 478		short blocklen = 0;
 479		/*
 480		 * 10.4.2 step 13.1: the truncation of the key length is
 481		 * implicit as the key is only drbg_blocklen in size based on
 482		 * the implementation of the cipher function callback
 483		 */
 484		ret = drbg_kcapi_sym(drbg, X, &cipherin);
 485		if (ret)
 486			goto out;
 487		blocklen = (drbg_blocklen(drbg) <
 488				(bytes_to_return - generated_len)) ?
 489			    drbg_blocklen(drbg) :
 490				(bytes_to_return - generated_len);
 491		/* 10.4.2 step 13.2 and 14 */
 492		memcpy(df_data + generated_len, X, blocklen);
 493		generated_len += blocklen;
 494	}
 495
 496	ret = 0;
 497
 498out:
 499	memset(iv, 0, drbg_blocklen(drbg));
 500	memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 501	memset(pad, 0, drbg_blocklen(drbg));
 502	return ret;
 503}
 504
 505/*
 506 * update function of CTR DRBG as defined in 10.2.1.2
 507 *
 508 * The reseed variable has an enhanced meaning compared to the update
 509 * functions of the other DRBGs as follows:
 510 * 0 => initial seed from initialization
 511 * 1 => reseed via drbg_seed
 512 * 2 => first invocation from drbg_ctr_update when addtl is present. In
 513 *      this case, the df_data scratchpad is not deleted so that it is
 514 *      available for another calls to prevent calling the DF function
 515 *      again.
 516 * 3 => second invocation from drbg_ctr_update. When the update function
 517 *      was called with addtl, the df_data memory already contains the
 518 *      DFed addtl information and we do not need to call DF again.
 519 */
 520static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
 521			   int reseed)
 522{
 523	int ret = -EFAULT;
 524	/* 10.2.1.2 step 1 */
 525	unsigned char *temp = drbg->scratchpad;
 526	unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
 527				 drbg_blocklen(drbg);
 528
 529	if (3 > reseed)
 530		memset(df_data, 0, drbg_statelen(drbg));
 531
 532	if (!reseed) {
 533		/*
 534		 * The DRBG uses the CTR mode of the underlying AES cipher. The
 535		 * CTR mode increments the counter value after the AES operation
 536		 * but SP800-90A requires that the counter is incremented before
 537		 * the AES operation. Hence, we increment it at the time we set
 538		 * it by one.
 539		 */
 540		crypto_inc(drbg->V, drbg_blocklen(drbg));
 541
 542		ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
 543					     drbg_keylen(drbg));
 544		if (ret)
 545			goto out;
 546	}
 547
 548	/* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
 549	if (seed) {
 550		ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
 551		if (ret)
 552			goto out;
 553	}
 554
 555	ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
 556				 temp, drbg_statelen(drbg));
 557	if (ret)
 558		return ret;
 559
 560	/* 10.2.1.2 step 5 */
 561	ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
 562				     drbg_keylen(drbg));
 563	if (ret)
 564		goto out;
 565	/* 10.2.1.2 step 6 */
 566	memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
 567	/* See above: increment counter by one to compensate timing of CTR op */
 568	crypto_inc(drbg->V, drbg_blocklen(drbg));
 569	ret = 0;
 570
 571out:
 572	memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 573	if (2 != reseed)
 574		memset(df_data, 0, drbg_statelen(drbg));
 575	return ret;
 576}
 577
 578/*
 579 * scratchpad use: drbg_ctr_update is called independently from
 580 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
 581 */
 582/* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
 583static int drbg_ctr_generate(struct drbg_state *drbg,
 584			     unsigned char *buf, unsigned int buflen,
 585			     struct list_head *addtl)
 586{
 587	int ret;
 588	int len = min_t(int, buflen, INT_MAX);
 589
 590	/* 10.2.1.5.2 step 2 */
 591	if (addtl && !list_empty(addtl)) {
 592		ret = drbg_ctr_update(drbg, addtl, 2);
 593		if (ret)
 594			return 0;
 595	}
 596
 597	/* 10.2.1.5.2 step 4.1 */
 598	ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len);
 599	if (ret)
 600		return ret;
 601
 602	/* 10.2.1.5.2 step 6 */
 603	ret = drbg_ctr_update(drbg, NULL, 3);
 604	if (ret)
 605		len = ret;
 606
 607	return len;
 608}
 609
 610static const struct drbg_state_ops drbg_ctr_ops = {
 611	.update		= drbg_ctr_update,
 612	.generate	= drbg_ctr_generate,
 613	.crypto_init	= drbg_init_sym_kernel,
 614	.crypto_fini	= drbg_fini_sym_kernel,
 615};
 616#endif /* CONFIG_CRYPTO_DRBG_CTR */
 617
 618/******************************************************************
 619 * HMAC DRBG callback functions
 620 ******************************************************************/
 621
 622#if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
 623static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
 624			   const struct list_head *in);
 625static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
 626				  const unsigned char *key);
 627static int drbg_init_hash_kernel(struct drbg_state *drbg);
 628static int drbg_fini_hash_kernel(struct drbg_state *drbg);
 629#endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
 630
 631#ifdef CONFIG_CRYPTO_DRBG_HMAC
 632#define CRYPTO_DRBG_HMAC_STRING "HMAC "
 633MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
 634MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
 635MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
 636MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
 637MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
 638MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
 
 
 639
 640/* update function of HMAC DRBG as defined in 10.1.2.2 */
 641static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 642			    int reseed)
 643{
 644	int ret = -EFAULT;
 645	int i = 0;
 646	struct drbg_string seed1, seed2, vdata;
 647	LIST_HEAD(seedlist);
 648	LIST_HEAD(vdatalist);
 649
 650	if (!reseed) {
 651		/* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
 652		memset(drbg->V, 1, drbg_statelen(drbg));
 653		drbg_kcapi_hmacsetkey(drbg, drbg->C);
 654	}
 655
 656	drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
 657	list_add_tail(&seed1.list, &seedlist);
 658	/* buffer of seed2 will be filled in for loop below with one byte */
 659	drbg_string_fill(&seed2, NULL, 1);
 660	list_add_tail(&seed2.list, &seedlist);
 661	/* input data of seed is allowed to be NULL at this point */
 662	if (seed)
 663		list_splice_tail(seed, &seedlist);
 664
 665	drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
 666	list_add_tail(&vdata.list, &vdatalist);
 667	for (i = 2; 0 < i; i--) {
 668		/* first round uses 0x0, second 0x1 */
 669		unsigned char prefix = DRBG_PREFIX0;
 670		if (1 == i)
 671			prefix = DRBG_PREFIX1;
 672		/* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
 673		seed2.buf = &prefix;
 674		ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
 675		if (ret)
 676			return ret;
 677		drbg_kcapi_hmacsetkey(drbg, drbg->C);
 678
 679		/* 10.1.2.2 step 2 and 5 -- HMAC for V */
 680		ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
 681		if (ret)
 682			return ret;
 683
 684		/* 10.1.2.2 step 3 */
 685		if (!seed)
 686			return ret;
 687	}
 688
 689	return 0;
 690}
 691
 692/* generate function of HMAC DRBG as defined in 10.1.2.5 */
 693static int drbg_hmac_generate(struct drbg_state *drbg,
 694			      unsigned char *buf,
 695			      unsigned int buflen,
 696			      struct list_head *addtl)
 697{
 698	int len = 0;
 699	int ret = 0;
 700	struct drbg_string data;
 701	LIST_HEAD(datalist);
 702
 703	/* 10.1.2.5 step 2 */
 704	if (addtl && !list_empty(addtl)) {
 705		ret = drbg_hmac_update(drbg, addtl, 1);
 706		if (ret)
 707			return ret;
 708	}
 709
 710	drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
 711	list_add_tail(&data.list, &datalist);
 712	while (len < buflen) {
 713		unsigned int outlen = 0;
 714		/* 10.1.2.5 step 4.1 */
 715		ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
 716		if (ret)
 717			return ret;
 718		outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 719			  drbg_blocklen(drbg) : (buflen - len);
 720
 721		/* 10.1.2.5 step 4.2 */
 722		memcpy(buf + len, drbg->V, outlen);
 723		len += outlen;
 724	}
 725
 726	/* 10.1.2.5 step 6 */
 727	if (addtl && !list_empty(addtl))
 728		ret = drbg_hmac_update(drbg, addtl, 1);
 729	else
 730		ret = drbg_hmac_update(drbg, NULL, 1);
 731	if (ret)
 732		return ret;
 733
 734	return len;
 735}
 736
 737static const struct drbg_state_ops drbg_hmac_ops = {
 738	.update		= drbg_hmac_update,
 739	.generate	= drbg_hmac_generate,
 740	.crypto_init	= drbg_init_hash_kernel,
 741	.crypto_fini	= drbg_fini_hash_kernel,
 742};
 743#endif /* CONFIG_CRYPTO_DRBG_HMAC */
 744
 745/******************************************************************
 746 * Hash DRBG callback functions
 747 ******************************************************************/
 748
 749#ifdef CONFIG_CRYPTO_DRBG_HASH
 750#define CRYPTO_DRBG_HASH_STRING "HASH "
 751MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
 752MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
 753MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
 754MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
 755MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
 756MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
 
 
 757
 758/*
 759 * Increment buffer
 760 *
 761 * @dst buffer to increment
 762 * @add value to add
 763 */
 764static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
 765				const unsigned char *add, size_t addlen)
 766{
 767	/* implied: dstlen > addlen */
 768	unsigned char *dstptr;
 769	const unsigned char *addptr;
 770	unsigned int remainder = 0;
 771	size_t len = addlen;
 772
 773	dstptr = dst + (dstlen-1);
 774	addptr = add + (addlen-1);
 775	while (len) {
 776		remainder += *dstptr + *addptr;
 777		*dstptr = remainder & 0xff;
 778		remainder >>= 8;
 779		len--; dstptr--; addptr--;
 780	}
 781	len = dstlen - addlen;
 782	while (len && remainder > 0) {
 783		remainder = *dstptr + 1;
 784		*dstptr = remainder & 0xff;
 785		remainder >>= 8;
 786		len--; dstptr--;
 787	}
 788}
 789
 790/*
 791 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
 792 * interlinked, the scratchpad is used as follows:
 793 * drbg_hash_update
 794 *	start: drbg->scratchpad
 795 *	length: drbg_statelen(drbg)
 796 * drbg_hash_df:
 797 *	start: drbg->scratchpad + drbg_statelen(drbg)
 798 *	length: drbg_blocklen(drbg)
 799 *
 800 * drbg_hash_process_addtl uses the scratchpad, but fully completes
 801 * before either of the functions mentioned before are invoked. Therefore,
 802 * drbg_hash_process_addtl does not need to be specifically considered.
 803 */
 804
 805/* Derivation Function for Hash DRBG as defined in 10.4.1 */
 806static int drbg_hash_df(struct drbg_state *drbg,
 807			unsigned char *outval, size_t outlen,
 808			struct list_head *entropylist)
 809{
 810	int ret = 0;
 811	size_t len = 0;
 812	unsigned char input[5];
 813	unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
 814	struct drbg_string data;
 815
 816	/* 10.4.1 step 3 */
 817	input[0] = 1;
 818	drbg_cpu_to_be32((outlen * 8), &input[1]);
 819
 820	/* 10.4.1 step 4.1 -- concatenation of data for input into hash */
 821	drbg_string_fill(&data, input, 5);
 822	list_add(&data.list, entropylist);
 823
 824	/* 10.4.1 step 4 */
 825	while (len < outlen) {
 826		short blocklen = 0;
 827		/* 10.4.1 step 4.1 */
 828		ret = drbg_kcapi_hash(drbg, tmp, entropylist);
 829		if (ret)
 830			goto out;
 831		/* 10.4.1 step 4.2 */
 832		input[0]++;
 833		blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
 834			    drbg_blocklen(drbg) : (outlen - len);
 835		memcpy(outval + len, tmp, blocklen);
 836		len += blocklen;
 837	}
 838
 839out:
 840	memset(tmp, 0, drbg_blocklen(drbg));
 841	return ret;
 842}
 843
 844/* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
 845static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
 846			    int reseed)
 847{
 848	int ret = 0;
 849	struct drbg_string data1, data2;
 850	LIST_HEAD(datalist);
 851	LIST_HEAD(datalist2);
 852	unsigned char *V = drbg->scratchpad;
 853	unsigned char prefix = DRBG_PREFIX1;
 854
 855	if (!seed)
 856		return -EINVAL;
 857
 858	if (reseed) {
 859		/* 10.1.1.3 step 1 */
 860		memcpy(V, drbg->V, drbg_statelen(drbg));
 861		drbg_string_fill(&data1, &prefix, 1);
 862		list_add_tail(&data1.list, &datalist);
 863		drbg_string_fill(&data2, V, drbg_statelen(drbg));
 864		list_add_tail(&data2.list, &datalist);
 865	}
 866	list_splice_tail(seed, &datalist);
 867
 868	/* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
 869	ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
 870	if (ret)
 871		goto out;
 872
 873	/* 10.1.1.2 / 10.1.1.3 step 4  */
 874	prefix = DRBG_PREFIX0;
 875	drbg_string_fill(&data1, &prefix, 1);
 876	list_add_tail(&data1.list, &datalist2);
 877	drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 878	list_add_tail(&data2.list, &datalist2);
 879	/* 10.1.1.2 / 10.1.1.3 step 4 */
 880	ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 881
 882out:
 883	memset(drbg->scratchpad, 0, drbg_statelen(drbg));
 884	return ret;
 885}
 886
 887/* processing of additional information string for Hash DRBG */
 888static int drbg_hash_process_addtl(struct drbg_state *drbg,
 889				   struct list_head *addtl)
 890{
 891	int ret = 0;
 892	struct drbg_string data1, data2;
 893	LIST_HEAD(datalist);
 894	unsigned char prefix = DRBG_PREFIX2;
 895
 896	/* 10.1.1.4 step 2 */
 897	if (!addtl || list_empty(addtl))
 898		return 0;
 899
 900	/* 10.1.1.4 step 2a */
 901	drbg_string_fill(&data1, &prefix, 1);
 902	drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 903	list_add_tail(&data1.list, &datalist);
 904	list_add_tail(&data2.list, &datalist);
 905	list_splice_tail(addtl, &datalist);
 906	ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 907	if (ret)
 908		goto out;
 909
 910	/* 10.1.1.4 step 2b */
 911	drbg_add_buf(drbg->V, drbg_statelen(drbg),
 912		     drbg->scratchpad, drbg_blocklen(drbg));
 913
 914out:
 915	memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 916	return ret;
 917}
 918
 919/* Hashgen defined in 10.1.1.4 */
 920static int drbg_hash_hashgen(struct drbg_state *drbg,
 921			     unsigned char *buf,
 922			     unsigned int buflen)
 923{
 924	int len = 0;
 925	int ret = 0;
 926	unsigned char *src = drbg->scratchpad;
 927	unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
 928	struct drbg_string data;
 929	LIST_HEAD(datalist);
 930
 931	/* 10.1.1.4 step hashgen 2 */
 932	memcpy(src, drbg->V, drbg_statelen(drbg));
 933
 934	drbg_string_fill(&data, src, drbg_statelen(drbg));
 935	list_add_tail(&data.list, &datalist);
 936	while (len < buflen) {
 937		unsigned int outlen = 0;
 938		/* 10.1.1.4 step hashgen 4.1 */
 939		ret = drbg_kcapi_hash(drbg, dst, &datalist);
 940		if (ret) {
 941			len = ret;
 942			goto out;
 943		}
 944		outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 945			  drbg_blocklen(drbg) : (buflen - len);
 946		/* 10.1.1.4 step hashgen 4.2 */
 947		memcpy(buf + len, dst, outlen);
 948		len += outlen;
 949		/* 10.1.1.4 hashgen step 4.3 */
 950		if (len < buflen)
 951			crypto_inc(src, drbg_statelen(drbg));
 952	}
 953
 954out:
 955	memset(drbg->scratchpad, 0,
 956	       (drbg_statelen(drbg) + drbg_blocklen(drbg)));
 957	return len;
 958}
 959
 960/* generate function for Hash DRBG as defined in  10.1.1.4 */
 961static int drbg_hash_generate(struct drbg_state *drbg,
 962			      unsigned char *buf, unsigned int buflen,
 963			      struct list_head *addtl)
 964{
 965	int len = 0;
 966	int ret = 0;
 967	union {
 968		unsigned char req[8];
 969		__be64 req_int;
 970	} u;
 971	unsigned char prefix = DRBG_PREFIX3;
 972	struct drbg_string data1, data2;
 973	LIST_HEAD(datalist);
 974
 975	/* 10.1.1.4 step 2 */
 976	ret = drbg_hash_process_addtl(drbg, addtl);
 977	if (ret)
 978		return ret;
 979	/* 10.1.1.4 step 3 */
 980	len = drbg_hash_hashgen(drbg, buf, buflen);
 981
 982	/* this is the value H as documented in 10.1.1.4 */
 983	/* 10.1.1.4 step 4 */
 984	drbg_string_fill(&data1, &prefix, 1);
 985	list_add_tail(&data1.list, &datalist);
 986	drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 987	list_add_tail(&data2.list, &datalist);
 988	ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 989	if (ret) {
 990		len = ret;
 991		goto out;
 992	}
 993
 994	/* 10.1.1.4 step 5 */
 995	drbg_add_buf(drbg->V, drbg_statelen(drbg),
 996		     drbg->scratchpad, drbg_blocklen(drbg));
 997	drbg_add_buf(drbg->V, drbg_statelen(drbg),
 998		     drbg->C, drbg_statelen(drbg));
 999	u.req_int = cpu_to_be64(drbg->reseed_ctr);
1000	drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1001
1002out:
1003	memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1004	return len;
1005}
1006
1007/*
1008 * scratchpad usage: as update and generate are used isolated, both
1009 * can use the scratchpad
1010 */
1011static const struct drbg_state_ops drbg_hash_ops = {
1012	.update		= drbg_hash_update,
1013	.generate	= drbg_hash_generate,
1014	.crypto_init	= drbg_init_hash_kernel,
1015	.crypto_fini	= drbg_fini_hash_kernel,
1016};
1017#endif /* CONFIG_CRYPTO_DRBG_HASH */
1018
1019/******************************************************************
1020 * Functions common for DRBG implementations
1021 ******************************************************************/
1022
1023static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1024			      int reseed, enum drbg_seed_state new_seed_state)
1025{
1026	int ret = drbg->d_ops->update(drbg, seed, reseed);
1027
1028	if (ret)
1029		return ret;
1030
1031	drbg->seeded = new_seed_state;
1032	drbg->last_seed_time = jiffies;
1033	/* 10.1.1.2 / 10.1.1.3 step 5 */
1034	drbg->reseed_ctr = 1;
1035
1036	switch (drbg->seeded) {
1037	case DRBG_SEED_STATE_UNSEEDED:
1038		/* Impossible, but handle it to silence compiler warnings. */
1039		fallthrough;
1040	case DRBG_SEED_STATE_PARTIAL:
1041		/*
1042		 * Require frequent reseeds until the seed source is
1043		 * fully initialized.
1044		 */
1045		drbg->reseed_threshold = 50;
1046		break;
1047
1048	case DRBG_SEED_STATE_FULL:
1049		/*
1050		 * Seed source has become fully initialized, frequent
1051		 * reseeds no longer required.
1052		 */
1053		drbg->reseed_threshold = drbg_max_requests(drbg);
1054		break;
1055	}
1056
1057	return ret;
1058}
1059
1060static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1061					unsigned char *entropy,
1062					unsigned int entropylen)
1063{
1064	int ret;
1065
1066	do {
1067		get_random_bytes(entropy, entropylen);
1068		ret = drbg_fips_continuous_test(drbg, entropy);
1069		if (ret && ret != -EAGAIN)
1070			return ret;
1071	} while (ret);
1072
1073	return 0;
1074}
1075
1076static int drbg_seed_from_random(struct drbg_state *drbg)
1077{
1078	struct drbg_string data;
1079	LIST_HEAD(seedlist);
1080	unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1081	unsigned char entropy[32];
1082	int ret;
1083
1084	BUG_ON(!entropylen);
1085	BUG_ON(entropylen > sizeof(entropy));
1086
1087	drbg_string_fill(&data, entropy, entropylen);
1088	list_add_tail(&data.list, &seedlist);
1089
1090	ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1091	if (ret)
1092		goto out;
1093
1094	ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
1095
1096out:
1097	memzero_explicit(entropy, entropylen);
1098	return ret;
1099}
1100
1101static bool drbg_nopr_reseed_interval_elapsed(struct drbg_state *drbg)
1102{
1103	unsigned long next_reseed;
1104
1105	/* Don't ever reseed from get_random_bytes() in test mode. */
1106	if (list_empty(&drbg->test_data.list))
1107		return false;
1108
1109	/*
1110	 * Obtain fresh entropy for the nopr DRBGs after 300s have
1111	 * elapsed in order to still achieve sort of partial
1112	 * prediction resistance over the time domain at least. Note
1113	 * that the period of 300s has been chosen to match the
1114	 * CRNG_RESEED_INTERVAL of the get_random_bytes()' chacha
1115	 * rngs.
1116	 */
1117	next_reseed = drbg->last_seed_time + 300 * HZ;
1118	return time_after(jiffies, next_reseed);
1119}
1120
1121/*
1122 * Seeding or reseeding of the DRBG
1123 *
1124 * @drbg: DRBG state struct
1125 * @pers: personalization / additional information buffer
1126 * @reseed: 0 for initial seed process, 1 for reseeding
1127 *
1128 * return:
1129 *	0 on success
1130 *	error value otherwise
1131 */
1132static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1133		     bool reseed)
1134{
1135	int ret;
1136	unsigned char entropy[((32 + 16) * 2)];
1137	unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1138	struct drbg_string data1;
1139	LIST_HEAD(seedlist);
1140	enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
1141
1142	/* 9.1 / 9.2 / 9.3.1 step 3 */
1143	if (pers && pers->len > (drbg_max_addtl(drbg))) {
1144		pr_devel("DRBG: personalization string too long %zu\n",
1145			 pers->len);
1146		return -EINVAL;
1147	}
1148
1149	if (list_empty(&drbg->test_data.list)) {
1150		drbg_string_fill(&data1, drbg->test_data.buf,
1151				 drbg->test_data.len);
1152		pr_devel("DRBG: using test entropy\n");
1153	} else {
1154		/*
1155		 * Gather entropy equal to the security strength of the DRBG.
1156		 * With a derivation function, a nonce is required in addition
1157		 * to the entropy. A nonce must be at least 1/2 of the security
1158		 * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1159		 * of the strength. The consideration of a nonce is only
1160		 * applicable during initial seeding.
1161		 */
1162		BUG_ON(!entropylen);
1163		if (!reseed)
1164			entropylen = ((entropylen + 1) / 2) * 3;
1165		BUG_ON((entropylen * 2) > sizeof(entropy));
1166
1167		/* Get seed from in-kernel /dev/urandom */
1168		if (!rng_is_initialized())
1169			new_seed_state = DRBG_SEED_STATE_PARTIAL;
1170
1171		ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1172		if (ret)
1173			goto out;
1174
1175		if (!drbg->jent) {
1176			drbg_string_fill(&data1, entropy, entropylen);
1177			pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1178				 entropylen);
1179		} else {
1180			/*
1181			 * Get seed from Jitter RNG, failures are
1182			 * fatal only in FIPS mode.
1183			 */
1184			ret = crypto_rng_get_bytes(drbg->jent,
1185						   entropy + entropylen,
1186						   entropylen);
1187			if (fips_enabled && ret) {
1188				pr_devel("DRBG: jent failed with %d\n", ret);
1189
1190				/*
1191				 * Do not treat the transient failure of the
1192				 * Jitter RNG as an error that needs to be
1193				 * reported. The combined number of the
1194				 * maximum reseed threshold times the maximum
1195				 * number of Jitter RNG transient errors is
1196				 * less than the reseed threshold required by
1197				 * SP800-90A allowing us to treat the
1198				 * transient errors as such.
1199				 *
1200				 * However, we mandate that at least the first
1201				 * seeding operation must succeed with the
1202				 * Jitter RNG.
1203				 */
1204				if (!reseed || ret != -EAGAIN)
1205					goto out;
1206			}
1207
1208			drbg_string_fill(&data1, entropy, entropylen * 2);
1209			pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1210				 entropylen * 2);
1211		}
1212	}
1213	list_add_tail(&data1.list, &seedlist);
1214
1215	/*
1216	 * concatenation of entropy with personalization str / addtl input)
1217	 * the variable pers is directly handed in by the caller, so check its
1218	 * contents whether it is appropriate
1219	 */
1220	if (pers && pers->buf && 0 < pers->len) {
1221		list_add_tail(&pers->list, &seedlist);
1222		pr_devel("DRBG: using personalization string\n");
1223	}
1224
1225	if (!reseed) {
1226		memset(drbg->V, 0, drbg_statelen(drbg));
1227		memset(drbg->C, 0, drbg_statelen(drbg));
1228	}
1229
1230	ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
1231
1232out:
1233	memzero_explicit(entropy, entropylen * 2);
1234
1235	return ret;
1236}
1237
1238/* Free all substructures in a DRBG state without the DRBG state structure */
1239static inline void drbg_dealloc_state(struct drbg_state *drbg)
1240{
1241	if (!drbg)
1242		return;
1243	kfree_sensitive(drbg->Vbuf);
1244	drbg->Vbuf = NULL;
1245	drbg->V = NULL;
1246	kfree_sensitive(drbg->Cbuf);
1247	drbg->Cbuf = NULL;
1248	drbg->C = NULL;
1249	kfree_sensitive(drbg->scratchpadbuf);
1250	drbg->scratchpadbuf = NULL;
1251	drbg->reseed_ctr = 0;
1252	drbg->d_ops = NULL;
1253	drbg->core = NULL;
1254	if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1255		kfree_sensitive(drbg->prev);
1256		drbg->prev = NULL;
1257		drbg->fips_primed = false;
1258	}
1259}
1260
1261/*
1262 * Allocate all sub-structures for a DRBG state.
1263 * The DRBG state structure must already be allocated.
1264 */
1265static inline int drbg_alloc_state(struct drbg_state *drbg)
1266{
1267	int ret = -ENOMEM;
1268	unsigned int sb_size = 0;
1269
1270	switch (drbg->core->flags & DRBG_TYPE_MASK) {
1271#ifdef CONFIG_CRYPTO_DRBG_HMAC
1272	case DRBG_HMAC:
1273		drbg->d_ops = &drbg_hmac_ops;
1274		break;
1275#endif /* CONFIG_CRYPTO_DRBG_HMAC */
1276#ifdef CONFIG_CRYPTO_DRBG_HASH
1277	case DRBG_HASH:
1278		drbg->d_ops = &drbg_hash_ops;
1279		break;
1280#endif /* CONFIG_CRYPTO_DRBG_HASH */
1281#ifdef CONFIG_CRYPTO_DRBG_CTR
1282	case DRBG_CTR:
1283		drbg->d_ops = &drbg_ctr_ops;
1284		break;
1285#endif /* CONFIG_CRYPTO_DRBG_CTR */
1286	default:
1287		ret = -EOPNOTSUPP;
1288		goto err;
1289	}
1290
1291	ret = drbg->d_ops->crypto_init(drbg);
1292	if (ret < 0)
1293		goto err;
1294
1295	drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1296	if (!drbg->Vbuf) {
1297		ret = -ENOMEM;
1298		goto fini;
1299	}
1300	drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1301	drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1302	if (!drbg->Cbuf) {
1303		ret = -ENOMEM;
1304		goto fini;
1305	}
1306	drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1307	/* scratchpad is only generated for CTR and Hash */
1308	if (drbg->core->flags & DRBG_HMAC)
1309		sb_size = 0;
1310	else if (drbg->core->flags & DRBG_CTR)
1311		sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1312			  drbg_statelen(drbg) +	/* df_data */
1313			  drbg_blocklen(drbg) +	/* pad */
1314			  drbg_blocklen(drbg) +	/* iv */
1315			  drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1316	else
1317		sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1318
1319	if (0 < sb_size) {
1320		drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1321		if (!drbg->scratchpadbuf) {
1322			ret = -ENOMEM;
1323			goto fini;
1324		}
1325		drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1326	}
1327
1328	if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1329		drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1330				     GFP_KERNEL);
1331		if (!drbg->prev) {
1332			ret = -ENOMEM;
1333			goto fini;
1334		}
1335		drbg->fips_primed = false;
1336	}
1337
1338	return 0;
1339
1340fini:
1341	drbg->d_ops->crypto_fini(drbg);
1342err:
1343	drbg_dealloc_state(drbg);
1344	return ret;
1345}
1346
1347/*************************************************************************
1348 * DRBG interface functions
1349 *************************************************************************/
1350
1351/*
1352 * DRBG generate function as required by SP800-90A - this function
1353 * generates random numbers
1354 *
1355 * @drbg DRBG state handle
1356 * @buf Buffer where to store the random numbers -- the buffer must already
1357 *      be pre-allocated by caller
1358 * @buflen Length of output buffer - this value defines the number of random
1359 *	   bytes pulled from DRBG
1360 * @addtl Additional input that is mixed into state, may be NULL -- note
1361 *	  the entropy is pulled by the DRBG internally unconditionally
1362 *	  as defined in SP800-90A. The additional input is mixed into
1363 *	  the state in addition to the pulled entropy.
1364 *
1365 * return: 0 when all bytes are generated; < 0 in case of an error
1366 */
1367static int drbg_generate(struct drbg_state *drbg,
1368			 unsigned char *buf, unsigned int buflen,
1369			 struct drbg_string *addtl)
1370{
1371	int len = 0;
1372	LIST_HEAD(addtllist);
1373
1374	if (!drbg->core) {
1375		pr_devel("DRBG: not yet seeded\n");
1376		return -EINVAL;
1377	}
1378	if (0 == buflen || !buf) {
1379		pr_devel("DRBG: no output buffer provided\n");
1380		return -EINVAL;
1381	}
1382	if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1383		pr_devel("DRBG: wrong format of additional information\n");
1384		return -EINVAL;
1385	}
1386
1387	/* 9.3.1 step 2 */
1388	len = -EINVAL;
1389	if (buflen > (drbg_max_request_bytes(drbg))) {
1390		pr_devel("DRBG: requested random numbers too large %u\n",
1391			 buflen);
1392		goto err;
1393	}
1394
1395	/* 9.3.1 step 3 is implicit with the chosen DRBG */
1396
1397	/* 9.3.1 step 4 */
1398	if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1399		pr_devel("DRBG: additional information string too long %zu\n",
1400			 addtl->len);
1401		goto err;
1402	}
1403	/* 9.3.1 step 5 is implicit with the chosen DRBG */
1404
1405	/*
1406	 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1407	 * here. The spec is a bit convoluted here, we make it simpler.
1408	 */
1409	if (drbg->reseed_threshold < drbg->reseed_ctr)
1410		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1411
1412	if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
1413		pr_devel("DRBG: reseeding before generation (prediction "
1414			 "resistance: %s, state %s)\n",
1415			 drbg->pr ? "true" : "false",
1416			 (drbg->seeded ==  DRBG_SEED_STATE_FULL ?
1417			  "seeded" : "unseeded"));
1418		/* 9.3.1 steps 7.1 through 7.3 */
1419		len = drbg_seed(drbg, addtl, true);
1420		if (len)
1421			goto err;
1422		/* 9.3.1 step 7.4 */
1423		addtl = NULL;
1424	} else if (rng_is_initialized() &&
1425		   (drbg->seeded == DRBG_SEED_STATE_PARTIAL ||
1426		    drbg_nopr_reseed_interval_elapsed(drbg))) {
1427		len = drbg_seed_from_random(drbg);
1428		if (len)
1429			goto err;
1430	}
1431
1432	if (addtl && 0 < addtl->len)
1433		list_add_tail(&addtl->list, &addtllist);
1434	/* 9.3.1 step 8 and 10 */
1435	len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1436
1437	/* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1438	drbg->reseed_ctr++;
1439	if (0 >= len)
1440		goto err;
1441
1442	/*
1443	 * Section 11.3.3 requires to re-perform self tests after some
1444	 * generated random numbers. The chosen value after which self
1445	 * test is performed is arbitrary, but it should be reasonable.
1446	 * However, we do not perform the self tests because of the following
1447	 * reasons: it is mathematically impossible that the initial self tests
1448	 * were successfully and the following are not. If the initial would
1449	 * pass and the following would not, the kernel integrity is violated.
1450	 * In this case, the entire kernel operation is questionable and it
1451	 * is unlikely that the integrity violation only affects the
1452	 * correct operation of the DRBG.
1453	 *
1454	 * Albeit the following code is commented out, it is provided in
1455	 * case somebody has a need to implement the test of 11.3.3.
1456	 */
1457#if 0
1458	if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1459		int err = 0;
1460		pr_devel("DRBG: start to perform self test\n");
1461		if (drbg->core->flags & DRBG_HMAC)
1462			err = alg_test("drbg_pr_hmac_sha512",
1463				       "drbg_pr_hmac_sha512", 0, 0);
1464		else if (drbg->core->flags & DRBG_CTR)
1465			err = alg_test("drbg_pr_ctr_aes256",
1466				       "drbg_pr_ctr_aes256", 0, 0);
1467		else
1468			err = alg_test("drbg_pr_sha256",
1469				       "drbg_pr_sha256", 0, 0);
1470		if (err) {
1471			pr_err("DRBG: periodical self test failed\n");
1472			/*
1473			 * uninstantiate implies that from now on, only errors
1474			 * are returned when reusing this DRBG cipher handle
1475			 */
1476			drbg_uninstantiate(drbg);
1477			return 0;
1478		} else {
1479			pr_devel("DRBG: self test successful\n");
1480		}
1481	}
1482#endif
1483
1484	/*
1485	 * All operations were successful, return 0 as mandated by
1486	 * the kernel crypto API interface.
1487	 */
1488	len = 0;
1489err:
1490	return len;
1491}
1492
1493/*
1494 * Wrapper around drbg_generate which can pull arbitrary long strings
1495 * from the DRBG without hitting the maximum request limitation.
1496 *
1497 * Parameters: see drbg_generate
1498 * Return codes: see drbg_generate -- if one drbg_generate request fails,
1499 *		 the entire drbg_generate_long request fails
1500 */
1501static int drbg_generate_long(struct drbg_state *drbg,
1502			      unsigned char *buf, unsigned int buflen,
1503			      struct drbg_string *addtl)
1504{
1505	unsigned int len = 0;
1506	unsigned int slice = 0;
1507	do {
1508		int err = 0;
1509		unsigned int chunk = 0;
1510		slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1511		chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1512		mutex_lock(&drbg->drbg_mutex);
1513		err = drbg_generate(drbg, buf + len, chunk, addtl);
1514		mutex_unlock(&drbg->drbg_mutex);
1515		if (0 > err)
1516			return err;
1517		len += chunk;
1518	} while (slice > 0 && (len < buflen));
1519	return 0;
1520}
1521
1522static int drbg_prepare_hrng(struct drbg_state *drbg)
1523{
1524	/* We do not need an HRNG in test mode. */
1525	if (list_empty(&drbg->test_data.list))
1526		return 0;
1527
1528	drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1529	if (IS_ERR(drbg->jent)) {
1530		const int err = PTR_ERR(drbg->jent);
1531
1532		drbg->jent = NULL;
1533		if (fips_enabled)
1534			return err;
1535		pr_info("DRBG: Continuing without Jitter RNG\n");
1536	}
1537
1538	return 0;
1539}
1540
1541/*
1542 * DRBG instantiation function as required by SP800-90A - this function
1543 * sets up the DRBG handle, performs the initial seeding and all sanity
1544 * checks required by SP800-90A
1545 *
1546 * @drbg memory of state -- if NULL, new memory is allocated
1547 * @pers Personalization string that is mixed into state, may be NULL -- note
1548 *	 the entropy is pulled by the DRBG internally unconditionally
1549 *	 as defined in SP800-90A. The additional input is mixed into
1550 *	 the state in addition to the pulled entropy.
1551 * @coreref reference to core
1552 * @pr prediction resistance enabled
1553 *
1554 * return
1555 *	0 on success
1556 *	error value otherwise
1557 */
1558static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1559			    int coreref, bool pr)
1560{
1561	int ret;
1562	bool reseed = true;
1563
1564	pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1565		 "%s\n", coreref, pr ? "enabled" : "disabled");
1566	mutex_lock(&drbg->drbg_mutex);
1567
1568	/* 9.1 step 1 is implicit with the selected DRBG type */
1569
1570	/*
1571	 * 9.1 step 2 is implicit as caller can select prediction resistance
1572	 * and the flag is copied into drbg->flags --
1573	 * all DRBG types support prediction resistance
1574	 */
1575
1576	/* 9.1 step 4 is implicit in  drbg_sec_strength */
1577
1578	if (!drbg->core) {
1579		drbg->core = &drbg_cores[coreref];
1580		drbg->pr = pr;
1581		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1582		drbg->last_seed_time = 0;
1583		drbg->reseed_threshold = drbg_max_requests(drbg);
1584
1585		ret = drbg_alloc_state(drbg);
1586		if (ret)
1587			goto unlock;
1588
1589		ret = drbg_prepare_hrng(drbg);
1590		if (ret)
1591			goto free_everything;
1592
1593		reseed = false;
1594	}
1595
1596	ret = drbg_seed(drbg, pers, reseed);
1597
1598	if (ret && !reseed)
1599		goto free_everything;
1600
1601	mutex_unlock(&drbg->drbg_mutex);
1602	return ret;
1603
1604unlock:
1605	mutex_unlock(&drbg->drbg_mutex);
1606	return ret;
1607
1608free_everything:
1609	mutex_unlock(&drbg->drbg_mutex);
1610	drbg_uninstantiate(drbg);
1611	return ret;
1612}
1613
1614/*
1615 * DRBG uninstantiate function as required by SP800-90A - this function
1616 * frees all buffers and the DRBG handle
1617 *
1618 * @drbg DRBG state handle
1619 *
1620 * return
1621 *	0 on success
1622 */
1623static int drbg_uninstantiate(struct drbg_state *drbg)
1624{
1625	if (!IS_ERR_OR_NULL(drbg->jent))
1626		crypto_free_rng(drbg->jent);
1627	drbg->jent = NULL;
1628
1629	if (drbg->d_ops)
1630		drbg->d_ops->crypto_fini(drbg);
1631	drbg_dealloc_state(drbg);
1632	/* no scrubbing of test_data -- this shall survive an uninstantiate */
1633	return 0;
1634}
1635
1636/*
1637 * Helper function for setting the test data in the DRBG
1638 *
1639 * @drbg DRBG state handle
1640 * @data test data
1641 * @len test data length
1642 */
1643static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1644				   const u8 *data, unsigned int len)
1645{
1646	struct drbg_state *drbg = crypto_rng_ctx(tfm);
1647
1648	mutex_lock(&drbg->drbg_mutex);
1649	drbg_string_fill(&drbg->test_data, data, len);
1650	mutex_unlock(&drbg->drbg_mutex);
1651}
1652
1653/***************************************************************
1654 * Kernel crypto API cipher invocations requested by DRBG
1655 ***************************************************************/
1656
1657#if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1658struct sdesc {
1659	struct shash_desc shash;
1660	char ctx[];
1661};
1662
1663static int drbg_init_hash_kernel(struct drbg_state *drbg)
1664{
1665	struct sdesc *sdesc;
1666	struct crypto_shash *tfm;
1667
1668	tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1669	if (IS_ERR(tfm)) {
1670		pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1671				drbg->core->backend_cra_name);
1672		return PTR_ERR(tfm);
1673	}
1674	BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1675	sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1676			GFP_KERNEL);
1677	if (!sdesc) {
1678		crypto_free_shash(tfm);
1679		return -ENOMEM;
1680	}
1681
1682	sdesc->shash.tfm = tfm;
1683	drbg->priv_data = sdesc;
1684
1685	return 0;
1686}
1687
1688static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1689{
1690	struct sdesc *sdesc = drbg->priv_data;
1691	if (sdesc) {
1692		crypto_free_shash(sdesc->shash.tfm);
1693		kfree_sensitive(sdesc);
1694	}
1695	drbg->priv_data = NULL;
1696	return 0;
1697}
1698
1699static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1700				  const unsigned char *key)
1701{
1702	struct sdesc *sdesc = drbg->priv_data;
1703
1704	crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1705}
1706
1707static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1708			   const struct list_head *in)
1709{
1710	struct sdesc *sdesc = drbg->priv_data;
1711	struct drbg_string *input = NULL;
1712
1713	crypto_shash_init(&sdesc->shash);
1714	list_for_each_entry(input, in, list)
1715		crypto_shash_update(&sdesc->shash, input->buf, input->len);
1716	return crypto_shash_final(&sdesc->shash, outval);
1717}
1718#endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1719
1720#ifdef CONFIG_CRYPTO_DRBG_CTR
1721static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1722{
1723	struct crypto_cipher *tfm =
1724		(struct crypto_cipher *)drbg->priv_data;
1725	if (tfm)
1726		crypto_free_cipher(tfm);
1727	drbg->priv_data = NULL;
1728
1729	if (drbg->ctr_handle)
1730		crypto_free_skcipher(drbg->ctr_handle);
1731	drbg->ctr_handle = NULL;
1732
1733	if (drbg->ctr_req)
1734		skcipher_request_free(drbg->ctr_req);
1735	drbg->ctr_req = NULL;
1736
1737	kfree(drbg->outscratchpadbuf);
1738	drbg->outscratchpadbuf = NULL;
1739
1740	return 0;
1741}
1742
1743static int drbg_init_sym_kernel(struct drbg_state *drbg)
1744{
1745	struct crypto_cipher *tfm;
1746	struct crypto_skcipher *sk_tfm;
1747	struct skcipher_request *req;
1748	unsigned int alignmask;
1749	char ctr_name[CRYPTO_MAX_ALG_NAME];
1750
1751	tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1752	if (IS_ERR(tfm)) {
1753		pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1754				drbg->core->backend_cra_name);
1755		return PTR_ERR(tfm);
1756	}
1757	BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1758	drbg->priv_data = tfm;
1759
1760	if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1761	    drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1762		drbg_fini_sym_kernel(drbg);
1763		return -EINVAL;
1764	}
1765	sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1766	if (IS_ERR(sk_tfm)) {
1767		pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1768				ctr_name);
1769		drbg_fini_sym_kernel(drbg);
1770		return PTR_ERR(sk_tfm);
1771	}
1772	drbg->ctr_handle = sk_tfm;
1773	crypto_init_wait(&drbg->ctr_wait);
1774
1775	req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1776	if (!req) {
1777		pr_info("DRBG: could not allocate request queue\n");
1778		drbg_fini_sym_kernel(drbg);
1779		return -ENOMEM;
1780	}
1781	drbg->ctr_req = req;
1782	skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
1783						CRYPTO_TFM_REQ_MAY_SLEEP,
1784					crypto_req_done, &drbg->ctr_wait);
1785
1786	alignmask = crypto_skcipher_alignmask(sk_tfm);
1787	drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1788					 GFP_KERNEL);
1789	if (!drbg->outscratchpadbuf) {
1790		drbg_fini_sym_kernel(drbg);
1791		return -ENOMEM;
1792	}
1793	drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1794					      alignmask + 1);
1795
1796	sg_init_table(&drbg->sg_in, 1);
1797	sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1798
1799	return alignmask;
1800}
1801
1802static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1803				 const unsigned char *key)
1804{
1805	struct crypto_cipher *tfm = drbg->priv_data;
1806
1807	crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1808}
1809
1810static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1811			  const struct drbg_string *in)
1812{
1813	struct crypto_cipher *tfm = drbg->priv_data;
1814
1815	/* there is only component in *in */
1816	BUG_ON(in->len < drbg_blocklen(drbg));
1817	crypto_cipher_encrypt_one(tfm, outval, in->buf);
1818	return 0;
1819}
1820
1821static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1822			      u8 *inbuf, u32 inlen,
1823			      u8 *outbuf, u32 outlen)
1824{
1825	struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out;
1826	u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN);
1827	int ret;
1828
1829	if (inbuf) {
1830		/* Use caller-provided input buffer */
1831		sg_set_buf(sg_in, inbuf, inlen);
1832	} else {
1833		/* Use scratchpad for in-place operation */
1834		inlen = scratchpad_use;
1835		memset(drbg->outscratchpad, 0, scratchpad_use);
1836		sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
1837	}
1838
1839	while (outlen) {
1840		u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1841
1842		/* Output buffer may not be valid for SGL, use scratchpad */
1843		skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out,
1844					   cryptlen, drbg->V);
1845		ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req),
1846					&drbg->ctr_wait);
1847		if (ret)
1848			goto out;
1849
1850		crypto_init_wait(&drbg->ctr_wait);
1851
1852		memcpy(outbuf, drbg->outscratchpad, cryptlen);
1853		memzero_explicit(drbg->outscratchpad, cryptlen);
1854
1855		outlen -= cryptlen;
1856		outbuf += cryptlen;
1857	}
1858	ret = 0;
1859
1860out:
1861	return ret;
1862}
1863#endif /* CONFIG_CRYPTO_DRBG_CTR */
1864
1865/***************************************************************
1866 * Kernel crypto API interface to register DRBG
1867 ***************************************************************/
1868
1869/*
1870 * Look up the DRBG flags by given kernel crypto API cra_name
1871 * The code uses the drbg_cores definition to do this
1872 *
1873 * @cra_name kernel crypto API cra_name
1874 * @coreref reference to integer which is filled with the pointer to
1875 *  the applicable core
1876 * @pr reference for setting prediction resistance
1877 *
1878 * return: flags
1879 */
1880static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1881					 int *coreref, bool *pr)
1882{
1883	int i = 0;
1884	size_t start = 0;
1885	int len = 0;
1886
1887	*pr = true;
1888	/* disassemble the names */
1889	if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1890		start = 10;
1891		*pr = false;
1892	} else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1893		start = 8;
1894	} else {
1895		return;
1896	}
1897
1898	/* remove the first part */
1899	len = strlen(cra_driver_name) - start;
1900	for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1901		if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1902			    len)) {
1903			*coreref = i;
1904			return;
1905		}
1906	}
1907}
1908
1909static int drbg_kcapi_init(struct crypto_tfm *tfm)
1910{
1911	struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1912
1913	mutex_init(&drbg->drbg_mutex);
1914
1915	return 0;
1916}
1917
1918static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1919{
1920	drbg_uninstantiate(crypto_tfm_ctx(tfm));
1921}
1922
1923/*
1924 * Generate random numbers invoked by the kernel crypto API:
1925 * The API of the kernel crypto API is extended as follows:
1926 *
1927 * src is additional input supplied to the RNG.
1928 * slen is the length of src.
1929 * dst is the output buffer where random data is to be stored.
1930 * dlen is the length of dst.
1931 */
1932static int drbg_kcapi_random(struct crypto_rng *tfm,
1933			     const u8 *src, unsigned int slen,
1934			     u8 *dst, unsigned int dlen)
1935{
1936	struct drbg_state *drbg = crypto_rng_ctx(tfm);
1937	struct drbg_string *addtl = NULL;
1938	struct drbg_string string;
1939
1940	if (slen) {
1941		/* linked list variable is now local to allow modification */
1942		drbg_string_fill(&string, src, slen);
1943		addtl = &string;
1944	}
1945
1946	return drbg_generate_long(drbg, dst, dlen, addtl);
1947}
1948
1949/*
1950 * Seed the DRBG invoked by the kernel crypto API
1951 */
1952static int drbg_kcapi_seed(struct crypto_rng *tfm,
1953			   const u8 *seed, unsigned int slen)
1954{
1955	struct drbg_state *drbg = crypto_rng_ctx(tfm);
1956	struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1957	bool pr = false;
1958	struct drbg_string string;
1959	struct drbg_string *seed_string = NULL;
1960	int coreref = 0;
1961
1962	drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1963			      &pr);
1964	if (0 < slen) {
1965		drbg_string_fill(&string, seed, slen);
1966		seed_string = &string;
1967	}
1968
1969	return drbg_instantiate(drbg, seed_string, coreref, pr);
1970}
1971
1972/***************************************************************
1973 * Kernel module: code to load the module
1974 ***************************************************************/
1975
1976/*
1977 * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1978 * of the error handling.
1979 *
1980 * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1981 * as seed source of get_random_bytes does not fail.
1982 *
1983 * Note 2: There is no sensible way of testing the reseed counter
1984 * enforcement, so skip it.
1985 */
1986static inline int __init drbg_healthcheck_sanity(void)
1987{
1988	int len = 0;
1989#define OUTBUFLEN 16
1990	unsigned char buf[OUTBUFLEN];
1991	struct drbg_state *drbg = NULL;
1992	int ret;
1993	int rc = -EFAULT;
1994	bool pr = false;
1995	int coreref = 0;
1996	struct drbg_string addtl;
1997	size_t max_addtllen, max_request_bytes;
1998
1999	/* only perform test in FIPS mode */
2000	if (!fips_enabled)
2001		return 0;
2002
2003#ifdef CONFIG_CRYPTO_DRBG_CTR
2004	drbg_convert_tfm_core("drbg_nopr_ctr_aes256", &coreref, &pr);
2005#endif
2006#ifdef CONFIG_CRYPTO_DRBG_HASH
2007	drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
2008#endif
2009#ifdef CONFIG_CRYPTO_DRBG_HMAC
2010	drbg_convert_tfm_core("drbg_nopr_hmac_sha512", &coreref, &pr);
2011#endif
2012
2013	drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
2014	if (!drbg)
2015		return -ENOMEM;
2016
2017	mutex_init(&drbg->drbg_mutex);
2018	drbg->core = &drbg_cores[coreref];
2019	drbg->reseed_threshold = drbg_max_requests(drbg);
2020
2021	/*
2022	 * if the following tests fail, it is likely that there is a buffer
2023	 * overflow as buf is much smaller than the requested or provided
2024	 * string lengths -- in case the error handling does not succeed
2025	 * we may get an OOPS. And we want to get an OOPS as this is a
2026	 * grave bug.
2027	 */
2028
2029	max_addtllen = drbg_max_addtl(drbg);
2030	max_request_bytes = drbg_max_request_bytes(drbg);
2031	drbg_string_fill(&addtl, buf, max_addtllen + 1);
2032	/* overflow addtllen with additonal info string */
2033	len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
2034	BUG_ON(0 < len);
2035	/* overflow max_bits */
2036	len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
2037	BUG_ON(0 < len);
2038
2039	/* overflow max addtllen with personalization string */
2040	ret = drbg_seed(drbg, &addtl, false);
2041	BUG_ON(0 == ret);
2042	/* all tests passed */
2043	rc = 0;
2044
2045	pr_devel("DRBG: Sanity tests for failure code paths successfully "
2046		 "completed\n");
2047
2048	kfree(drbg);
2049	return rc;
2050}
2051
2052static struct rng_alg drbg_algs[22];
2053
2054/*
2055 * Fill the array drbg_algs used to register the different DRBGs
2056 * with the kernel crypto API. To fill the array, the information
2057 * from drbg_cores[] is used.
2058 */
2059static inline void __init drbg_fill_array(struct rng_alg *alg,
2060					  const struct drbg_core *core, int pr)
2061{
2062	int pos = 0;
2063	static int priority = 200;
2064
2065	memcpy(alg->base.cra_name, "stdrng", 6);
2066	if (pr) {
2067		memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
2068		pos = 8;
2069	} else {
2070		memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
2071		pos = 10;
2072	}
2073	memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2074	       strlen(core->cra_name));
2075
2076	alg->base.cra_priority = priority;
2077	priority++;
2078	/*
2079	 * If FIPS mode enabled, the selected DRBG shall have the
2080	 * highest cra_priority over other stdrng instances to ensure
2081	 * it is selected.
2082	 */
2083	if (fips_enabled)
2084		alg->base.cra_priority += 200;
2085
2086	alg->base.cra_ctxsize 	= sizeof(struct drbg_state);
2087	alg->base.cra_module	= THIS_MODULE;
2088	alg->base.cra_init	= drbg_kcapi_init;
2089	alg->base.cra_exit	= drbg_kcapi_cleanup;
2090	alg->generate		= drbg_kcapi_random;
2091	alg->seed		= drbg_kcapi_seed;
2092	alg->set_ent		= drbg_kcapi_set_entropy;
2093	alg->seedsize		= 0;
2094}
2095
2096static int __init drbg_init(void)
2097{
2098	unsigned int i = 0; /* pointer to drbg_algs */
2099	unsigned int j = 0; /* pointer to drbg_cores */
2100	int ret;
2101
2102	ret = drbg_healthcheck_sanity();
2103	if (ret)
2104		return ret;
2105
2106	if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2107		pr_info("DRBG: Cannot register all DRBG types"
2108			"(slots needed: %zu, slots available: %zu)\n",
2109			ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2110		return -EFAULT;
2111	}
2112
2113	/*
2114	 * each DRBG definition can be used with PR and without PR, thus
2115	 * we instantiate each DRBG in drbg_cores[] twice.
2116	 *
2117	 * As the order of placing them into the drbg_algs array matters
2118	 * (the later DRBGs receive a higher cra_priority) we register the
2119	 * prediction resistance DRBGs first as the should not be too
2120	 * interesting.
2121	 */
2122	for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2123		drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2124	for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2125		drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2126	return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2127}
2128
2129static void __exit drbg_exit(void)
2130{
2131	crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2132}
2133
2134subsys_initcall(drbg_init);
2135module_exit(drbg_exit);
2136#ifndef CRYPTO_DRBG_HASH_STRING
2137#define CRYPTO_DRBG_HASH_STRING ""
2138#endif
2139#ifndef CRYPTO_DRBG_HMAC_STRING
2140#define CRYPTO_DRBG_HMAC_STRING ""
2141#endif
2142#ifndef CRYPTO_DRBG_CTR_STRING
2143#define CRYPTO_DRBG_CTR_STRING ""
2144#endif
2145MODULE_LICENSE("GPL");
2146MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2147MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2148		   "using following cores: "
2149		   CRYPTO_DRBG_HASH_STRING
2150		   CRYPTO_DRBG_HMAC_STRING
2151		   CRYPTO_DRBG_CTR_STRING);
2152MODULE_ALIAS_CRYPTO("stdrng");
2153MODULE_IMPORT_NS(CRYPTO_INTERNAL);