Back to home page

LXR

 
 

    


0001 /*
0002  * DRBG: Deterministic Random Bits Generator
0003  *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
0004  *       properties:
0005  *      * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
0006  *      * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
0007  *      * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
0008  *      * with and without prediction resistance
0009  *
0010  * Copyright Stephan Mueller <smueller@chronox.de>, 2014
0011  *
0012  * Redistribution and use in source and binary forms, with or without
0013  * modification, are permitted provided that the following conditions
0014  * are met:
0015  * 1. Redistributions of source code must retain the above copyright
0016  *    notice, and the entire permission notice in its entirety,
0017  *    including the disclaimer of warranties.
0018  * 2. Redistributions in binary form must reproduce the above copyright
0019  *    notice, this list of conditions and the following disclaimer in the
0020  *    documentation and/or other materials provided with the distribution.
0021  * 3. The name of the author may not be used to endorse or promote
0022  *    products derived from this software without specific prior
0023  *    written permission.
0024  *
0025  * ALTERNATIVELY, this product may be distributed under the terms of
0026  * the GNU General Public License, in which case the provisions of the GPL are
0027  * required INSTEAD OF the above restrictions.  (This clause is
0028  * necessary due to a potential bad interaction between the GPL and
0029  * the restrictions contained in a BSD-style copyright.)
0030  *
0031  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
0032  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
0033  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
0034  * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
0035  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
0036  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
0037  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
0038  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
0039  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
0040  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
0041  * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
0042  * DAMAGE.
0043  *
0044  * DRBG Usage
0045  * ==========
0046  * The SP 800-90A DRBG allows the user to specify a personalization string
0047  * for initialization as well as an additional information string for each
0048  * random number request. The following code fragments show how a caller
0049  * uses the kernel crypto API to use the full functionality of the DRBG.
0050  *
0051  * Usage without any additional data
0052  * ---------------------------------
0053  * struct crypto_rng *drng;
0054  * int err;
0055  * char data[DATALEN];
0056  *
0057  * drng = crypto_alloc_rng(drng_name, 0, 0);
0058  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
0059  * crypto_free_rng(drng);
0060  *
0061  *
0062  * Usage with personalization string during initialization
0063  * -------------------------------------------------------
0064  * struct crypto_rng *drng;
0065  * int err;
0066  * char data[DATALEN];
0067  * struct drbg_string pers;
0068  * char personalization[11] = "some-string";
0069  *
0070  * drbg_string_fill(&pers, personalization, strlen(personalization));
0071  * drng = crypto_alloc_rng(drng_name, 0, 0);
0072  * // The reset completely re-initializes the DRBG with the provided
0073  * // personalization string
0074  * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
0075  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
0076  * crypto_free_rng(drng);
0077  *
0078  *
0079  * Usage with additional information string during random number request
0080  * ---------------------------------------------------------------------
0081  * struct crypto_rng *drng;
0082  * int err;
0083  * char data[DATALEN];
0084  * char addtl_string[11] = "some-string";
0085  * string drbg_string addtl;
0086  *
0087  * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
0088  * drng = crypto_alloc_rng(drng_name, 0, 0);
0089  * // The following call is a wrapper to crypto_rng_get_bytes() and returns
0090  * // the same error codes.
0091  * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
0092  * crypto_free_rng(drng);
0093  *
0094  *
0095  * Usage with personalization and additional information strings
0096  * -------------------------------------------------------------
0097  * Just mix both scenarios above.
0098  */
0099 
0100 #include <crypto/drbg.h>
0101 #include <linux/kernel.h>
0102 
0103 /***************************************************************
0104  * Backend cipher definitions available to DRBG
0105  ***************************************************************/
0106 
0107 /*
0108  * The order of the DRBG definitions here matter: every DRBG is registered
0109  * as stdrng. Each DRBG receives an increasing cra_priority values the later
0110  * they are defined in this array (see drbg_fill_array).
0111  *
0112  * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
0113  * the SHA256 / AES 256 over other ciphers. Thus, the favored
0114  * DRBGs are the latest entries in this array.
0115  */
0116 static const struct drbg_core drbg_cores[] = {
0117 #ifdef CONFIG_CRYPTO_DRBG_CTR
0118     {
0119         .flags = DRBG_CTR | DRBG_STRENGTH128,
0120         .statelen = 32, /* 256 bits as defined in 10.2.1 */
0121         .blocklen_bytes = 16,
0122         .cra_name = "ctr_aes128",
0123         .backend_cra_name = "aes",
0124     }, {
0125         .flags = DRBG_CTR | DRBG_STRENGTH192,
0126         .statelen = 40, /* 320 bits as defined in 10.2.1 */
0127         .blocklen_bytes = 16,
0128         .cra_name = "ctr_aes192",
0129         .backend_cra_name = "aes",
0130     }, {
0131         .flags = DRBG_CTR | DRBG_STRENGTH256,
0132         .statelen = 48, /* 384 bits as defined in 10.2.1 */
0133         .blocklen_bytes = 16,
0134         .cra_name = "ctr_aes256",
0135         .backend_cra_name = "aes",
0136     },
0137 #endif /* CONFIG_CRYPTO_DRBG_CTR */
0138 #ifdef CONFIG_CRYPTO_DRBG_HASH
0139     {
0140         .flags = DRBG_HASH | DRBG_STRENGTH128,
0141         .statelen = 55, /* 440 bits */
0142         .blocklen_bytes = 20,
0143         .cra_name = "sha1",
0144         .backend_cra_name = "sha1",
0145     }, {
0146         .flags = DRBG_HASH | DRBG_STRENGTH256,
0147         .statelen = 111, /* 888 bits */
0148         .blocklen_bytes = 48,
0149         .cra_name = "sha384",
0150         .backend_cra_name = "sha384",
0151     }, {
0152         .flags = DRBG_HASH | DRBG_STRENGTH256,
0153         .statelen = 111, /* 888 bits */
0154         .blocklen_bytes = 64,
0155         .cra_name = "sha512",
0156         .backend_cra_name = "sha512",
0157     }, {
0158         .flags = DRBG_HASH | DRBG_STRENGTH256,
0159         .statelen = 55, /* 440 bits */
0160         .blocklen_bytes = 32,
0161         .cra_name = "sha256",
0162         .backend_cra_name = "sha256",
0163     },
0164 #endif /* CONFIG_CRYPTO_DRBG_HASH */
0165 #ifdef CONFIG_CRYPTO_DRBG_HMAC
0166     {
0167         .flags = DRBG_HMAC | DRBG_STRENGTH128,
0168         .statelen = 20, /* block length of cipher */
0169         .blocklen_bytes = 20,
0170         .cra_name = "hmac_sha1",
0171         .backend_cra_name = "hmac(sha1)",
0172     }, {
0173         .flags = DRBG_HMAC | DRBG_STRENGTH256,
0174         .statelen = 48, /* block length of cipher */
0175         .blocklen_bytes = 48,
0176         .cra_name = "hmac_sha384",
0177         .backend_cra_name = "hmac(sha384)",
0178     }, {
0179         .flags = DRBG_HMAC | DRBG_STRENGTH256,
0180         .statelen = 64, /* block length of cipher */
0181         .blocklen_bytes = 64,
0182         .cra_name = "hmac_sha512",
0183         .backend_cra_name = "hmac(sha512)",
0184     }, {
0185         .flags = DRBG_HMAC | DRBG_STRENGTH256,
0186         .statelen = 32, /* block length of cipher */
0187         .blocklen_bytes = 32,
0188         .cra_name = "hmac_sha256",
0189         .backend_cra_name = "hmac(sha256)",
0190     },
0191 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
0192 };
0193 
0194 static int drbg_uninstantiate(struct drbg_state *drbg);
0195 
0196 /******************************************************************
0197  * Generic helper functions
0198  ******************************************************************/
0199 
0200 /*
0201  * Return strength of DRBG according to SP800-90A section 8.4
0202  *
0203  * @flags DRBG flags reference
0204  *
0205  * Return: normalized strength in *bytes* value or 32 as default
0206  *     to counter programming errors
0207  */
0208 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
0209 {
0210     switch (flags & DRBG_STRENGTH_MASK) {
0211     case DRBG_STRENGTH128:
0212         return 16;
0213     case DRBG_STRENGTH192:
0214         return 24;
0215     case DRBG_STRENGTH256:
0216         return 32;
0217     default:
0218         return 32;
0219     }
0220 }
0221 
0222 /*
0223  * Convert an integer into a byte representation of this integer.
0224  * The byte representation is big-endian
0225  *
0226  * @val value to be converted
0227  * @buf buffer holding the converted integer -- caller must ensure that
0228  *      buffer size is at least 32 bit
0229  */
0230 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
0231 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
0232 {
0233     struct s {
0234         __be32 conv;
0235     };
0236     struct s *conversion = (struct s *) buf;
0237 
0238     conversion->conv = cpu_to_be32(val);
0239 }
0240 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
0241 
0242 /******************************************************************
0243  * CTR DRBG callback functions
0244  ******************************************************************/
0245 
0246 #ifdef CONFIG_CRYPTO_DRBG_CTR
0247 #define CRYPTO_DRBG_CTR_STRING "CTR "
0248 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
0249 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
0250 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
0251 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
0252 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
0253 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
0254 
0255 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
0256                  const unsigned char *key);
0257 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
0258               const struct drbg_string *in);
0259 static int drbg_init_sym_kernel(struct drbg_state *drbg);
0260 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
0261 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
0262                   u8 *inbuf, u32 inbuflen,
0263                   u8 *outbuf, u32 outlen);
0264 #define DRBG_CTR_NULL_LEN 128
0265 #define DRBG_OUTSCRATCHLEN DRBG_CTR_NULL_LEN
0266 
0267 /* BCC function for CTR DRBG as defined in 10.4.3 */
0268 static int drbg_ctr_bcc(struct drbg_state *drbg,
0269             unsigned char *out, const unsigned char *key,
0270             struct list_head *in)
0271 {
0272     int ret = 0;
0273     struct drbg_string *curr = NULL;
0274     struct drbg_string data;
0275     short cnt = 0;
0276 
0277     drbg_string_fill(&data, out, drbg_blocklen(drbg));
0278 
0279     /* 10.4.3 step 2 / 4 */
0280     drbg_kcapi_symsetkey(drbg, key);
0281     list_for_each_entry(curr, in, list) {
0282         const unsigned char *pos = curr->buf;
0283         size_t len = curr->len;
0284         /* 10.4.3 step 4.1 */
0285         while (len) {
0286             /* 10.4.3 step 4.2 */
0287             if (drbg_blocklen(drbg) == cnt) {
0288                 cnt = 0;
0289                 ret = drbg_kcapi_sym(drbg, out, &data);
0290                 if (ret)
0291                     return ret;
0292             }
0293             out[cnt] ^= *pos;
0294             pos++;
0295             cnt++;
0296             len--;
0297         }
0298     }
0299     /* 10.4.3 step 4.2 for last block */
0300     if (cnt)
0301         ret = drbg_kcapi_sym(drbg, out, &data);
0302 
0303     return ret;
0304 }
0305 
0306 /*
0307  * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
0308  * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
0309  * the scratchpad is used as follows:
0310  * drbg_ctr_update:
0311  *  temp
0312  *      start: drbg->scratchpad
0313  *      length: drbg_statelen(drbg) + drbg_blocklen(drbg)
0314  *          note: the cipher writing into this variable works
0315  *          blocklen-wise. Now, when the statelen is not a multiple
0316  *          of blocklen, the generateion loop below "spills over"
0317  *          by at most blocklen. Thus, we need to give sufficient
0318  *          memory.
0319  *  df_data
0320  *      start: drbg->scratchpad +
0321  *              drbg_statelen(drbg) + drbg_blocklen(drbg)
0322  *      length: drbg_statelen(drbg)
0323  *
0324  * drbg_ctr_df:
0325  *  pad
0326  *      start: df_data + drbg_statelen(drbg)
0327  *      length: drbg_blocklen(drbg)
0328  *  iv
0329  *      start: pad + drbg_blocklen(drbg)
0330  *      length: drbg_blocklen(drbg)
0331  *  temp
0332  *      start: iv + drbg_blocklen(drbg)
0333  *      length: drbg_satelen(drbg) + drbg_blocklen(drbg)
0334  *          note: temp is the buffer that the BCC function operates
0335  *          on. BCC operates blockwise. drbg_statelen(drbg)
0336  *          is sufficient when the DRBG state length is a multiple
0337  *          of the block size. For AES192 (and maybe other ciphers)
0338  *          this is not correct and the length for temp is
0339  *          insufficient (yes, that also means for such ciphers,
0340  *          the final output of all BCC rounds are truncated).
0341  *          Therefore, add drbg_blocklen(drbg) to cover all
0342  *          possibilities.
0343  */
0344 
0345 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
0346 static int drbg_ctr_df(struct drbg_state *drbg,
0347                unsigned char *df_data, size_t bytes_to_return,
0348                struct list_head *seedlist)
0349 {
0350     int ret = -EFAULT;
0351     unsigned char L_N[8];
0352     /* S3 is input */
0353     struct drbg_string S1, S2, S4, cipherin;
0354     LIST_HEAD(bcc_list);
0355     unsigned char *pad = df_data + drbg_statelen(drbg);
0356     unsigned char *iv = pad + drbg_blocklen(drbg);
0357     unsigned char *temp = iv + drbg_blocklen(drbg);
0358     size_t padlen = 0;
0359     unsigned int templen = 0;
0360     /* 10.4.2 step 7 */
0361     unsigned int i = 0;
0362     /* 10.4.2 step 8 */
0363     const unsigned char *K = (unsigned char *)
0364                "\x00\x01\x02\x03\x04\x05\x06\x07"
0365                "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
0366                "\x10\x11\x12\x13\x14\x15\x16\x17"
0367                "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
0368     unsigned char *X;
0369     size_t generated_len = 0;
0370     size_t inputlen = 0;
0371     struct drbg_string *seed = NULL;
0372 
0373     memset(pad, 0, drbg_blocklen(drbg));
0374     memset(iv, 0, drbg_blocklen(drbg));
0375 
0376     /* 10.4.2 step 1 is implicit as we work byte-wise */
0377 
0378     /* 10.4.2 step 2 */
0379     if ((512/8) < bytes_to_return)
0380         return -EINVAL;
0381 
0382     /* 10.4.2 step 2 -- calculate the entire length of all input data */
0383     list_for_each_entry(seed, seedlist, list)
0384         inputlen += seed->len;
0385     drbg_cpu_to_be32(inputlen, &L_N[0]);
0386 
0387     /* 10.4.2 step 3 */
0388     drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
0389 
0390     /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
0391     padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
0392     /* wrap the padlen appropriately */
0393     if (padlen)
0394         padlen = drbg_blocklen(drbg) - padlen;
0395     /*
0396      * pad / padlen contains the 0x80 byte and the following zero bytes.
0397      * As the calculated padlen value only covers the number of zero
0398      * bytes, this value has to be incremented by one for the 0x80 byte.
0399      */
0400     padlen++;
0401     pad[0] = 0x80;
0402 
0403     /* 10.4.2 step 4 -- first fill the linked list and then order it */
0404     drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
0405     list_add_tail(&S1.list, &bcc_list);
0406     drbg_string_fill(&S2, L_N, sizeof(L_N));
0407     list_add_tail(&S2.list, &bcc_list);
0408     list_splice_tail(seedlist, &bcc_list);
0409     drbg_string_fill(&S4, pad, padlen);
0410     list_add_tail(&S4.list, &bcc_list);
0411 
0412     /* 10.4.2 step 9 */
0413     while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
0414         /*
0415          * 10.4.2 step 9.1 - the padding is implicit as the buffer
0416          * holds zeros after allocation -- even the increment of i
0417          * is irrelevant as the increment remains within length of i
0418          */
0419         drbg_cpu_to_be32(i, iv);
0420         /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
0421         ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
0422         if (ret)
0423             goto out;
0424         /* 10.4.2 step 9.3 */
0425         i++;
0426         templen += drbg_blocklen(drbg);
0427     }
0428 
0429     /* 10.4.2 step 11 */
0430     X = temp + (drbg_keylen(drbg));
0431     drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
0432 
0433     /* 10.4.2 step 12: overwriting of outval is implemented in next step */
0434 
0435     /* 10.4.2 step 13 */
0436     drbg_kcapi_symsetkey(drbg, temp);
0437     while (generated_len < bytes_to_return) {
0438         short blocklen = 0;
0439         /*
0440          * 10.4.2 step 13.1: the truncation of the key length is
0441          * implicit as the key is only drbg_blocklen in size based on
0442          * the implementation of the cipher function callback
0443          */
0444         ret = drbg_kcapi_sym(drbg, X, &cipherin);
0445         if (ret)
0446             goto out;
0447         blocklen = (drbg_blocklen(drbg) <
0448                 (bytes_to_return - generated_len)) ?
0449                 drbg_blocklen(drbg) :
0450                 (bytes_to_return - generated_len);
0451         /* 10.4.2 step 13.2 and 14 */
0452         memcpy(df_data + generated_len, X, blocklen);
0453         generated_len += blocklen;
0454     }
0455 
0456     ret = 0;
0457 
0458 out:
0459     memset(iv, 0, drbg_blocklen(drbg));
0460     memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
0461     memset(pad, 0, drbg_blocklen(drbg));
0462     return ret;
0463 }
0464 
0465 /*
0466  * update function of CTR DRBG as defined in 10.2.1.2
0467  *
0468  * The reseed variable has an enhanced meaning compared to the update
0469  * functions of the other DRBGs as follows:
0470  * 0 => initial seed from initialization
0471  * 1 => reseed via drbg_seed
0472  * 2 => first invocation from drbg_ctr_update when addtl is present. In
0473  *      this case, the df_data scratchpad is not deleted so that it is
0474  *      available for another calls to prevent calling the DF function
0475  *      again.
0476  * 3 => second invocation from drbg_ctr_update. When the update function
0477  *      was called with addtl, the df_data memory already contains the
0478  *      DFed addtl information and we do not need to call DF again.
0479  */
0480 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
0481                int reseed)
0482 {
0483     int ret = -EFAULT;
0484     /* 10.2.1.2 step 1 */
0485     unsigned char *temp = drbg->scratchpad;
0486     unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
0487                  drbg_blocklen(drbg);
0488 
0489     if (3 > reseed)
0490         memset(df_data, 0, drbg_statelen(drbg));
0491 
0492     if (!reseed) {
0493         /*
0494          * The DRBG uses the CTR mode of the underlying AES cipher. The
0495          * CTR mode increments the counter value after the AES operation
0496          * but SP800-90A requires that the counter is incremented before
0497          * the AES operation. Hence, we increment it at the time we set
0498          * it by one.
0499          */
0500         crypto_inc(drbg->V, drbg_blocklen(drbg));
0501 
0502         ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
0503                          drbg_keylen(drbg));
0504         if (ret)
0505             goto out;
0506     }
0507 
0508     /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
0509     if (seed) {
0510         ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
0511         if (ret)
0512             goto out;
0513     }
0514 
0515     ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
0516                  temp, drbg_statelen(drbg));
0517     if (ret)
0518         return ret;
0519 
0520     /* 10.2.1.2 step 5 */
0521     ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
0522                      drbg_keylen(drbg));
0523     if (ret)
0524         goto out;
0525     /* 10.2.1.2 step 6 */
0526     memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
0527     /* See above: increment counter by one to compensate timing of CTR op */
0528     crypto_inc(drbg->V, drbg_blocklen(drbg));
0529     ret = 0;
0530 
0531 out:
0532     memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
0533     if (2 != reseed)
0534         memset(df_data, 0, drbg_statelen(drbg));
0535     return ret;
0536 }
0537 
0538 /*
0539  * scratchpad use: drbg_ctr_update is called independently from
0540  * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
0541  */
0542 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
0543 static int drbg_ctr_generate(struct drbg_state *drbg,
0544                  unsigned char *buf, unsigned int buflen,
0545                  struct list_head *addtl)
0546 {
0547     int ret;
0548     int len = min_t(int, buflen, INT_MAX);
0549 
0550     /* 10.2.1.5.2 step 2 */
0551     if (addtl && !list_empty(addtl)) {
0552         ret = drbg_ctr_update(drbg, addtl, 2);
0553         if (ret)
0554             return 0;
0555     }
0556 
0557     /* 10.2.1.5.2 step 4.1 */
0558     ret = drbg_kcapi_sym_ctr(drbg, drbg->ctr_null_value, DRBG_CTR_NULL_LEN,
0559                  buf, len);
0560     if (ret)
0561         return ret;
0562 
0563     /* 10.2.1.5.2 step 6 */
0564     ret = drbg_ctr_update(drbg, NULL, 3);
0565     if (ret)
0566         len = ret;
0567 
0568     return len;
0569 }
0570 
0571 static const struct drbg_state_ops drbg_ctr_ops = {
0572     .update     = drbg_ctr_update,
0573     .generate   = drbg_ctr_generate,
0574     .crypto_init    = drbg_init_sym_kernel,
0575     .crypto_fini    = drbg_fini_sym_kernel,
0576 };
0577 #endif /* CONFIG_CRYPTO_DRBG_CTR */
0578 
0579 /******************************************************************
0580  * HMAC DRBG callback functions
0581  ******************************************************************/
0582 
0583 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
0584 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
0585                const struct list_head *in);
0586 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
0587                   const unsigned char *key);
0588 static int drbg_init_hash_kernel(struct drbg_state *drbg);
0589 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
0590 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
0591 
0592 #ifdef CONFIG_CRYPTO_DRBG_HMAC
0593 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
0594 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
0595 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
0596 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
0597 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
0598 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
0599 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
0600 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
0601 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
0602 
0603 /* update function of HMAC DRBG as defined in 10.1.2.2 */
0604 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
0605                 int reseed)
0606 {
0607     int ret = -EFAULT;
0608     int i = 0;
0609     struct drbg_string seed1, seed2, vdata;
0610     LIST_HEAD(seedlist);
0611     LIST_HEAD(vdatalist);
0612 
0613     if (!reseed) {
0614         /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
0615         memset(drbg->V, 1, drbg_statelen(drbg));
0616         drbg_kcapi_hmacsetkey(drbg, drbg->C);
0617     }
0618 
0619     drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
0620     list_add_tail(&seed1.list, &seedlist);
0621     /* buffer of seed2 will be filled in for loop below with one byte */
0622     drbg_string_fill(&seed2, NULL, 1);
0623     list_add_tail(&seed2.list, &seedlist);
0624     /* input data of seed is allowed to be NULL at this point */
0625     if (seed)
0626         list_splice_tail(seed, &seedlist);
0627 
0628     drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
0629     list_add_tail(&vdata.list, &vdatalist);
0630     for (i = 2; 0 < i; i--) {
0631         /* first round uses 0x0, second 0x1 */
0632         unsigned char prefix = DRBG_PREFIX0;
0633         if (1 == i)
0634             prefix = DRBG_PREFIX1;
0635         /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
0636         seed2.buf = &prefix;
0637         ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
0638         if (ret)
0639             return ret;
0640         drbg_kcapi_hmacsetkey(drbg, drbg->C);
0641 
0642         /* 10.1.2.2 step 2 and 5 -- HMAC for V */
0643         ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
0644         if (ret)
0645             return ret;
0646 
0647         /* 10.1.2.2 step 3 */
0648         if (!seed)
0649             return ret;
0650     }
0651 
0652     return 0;
0653 }
0654 
0655 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
0656 static int drbg_hmac_generate(struct drbg_state *drbg,
0657                   unsigned char *buf,
0658                   unsigned int buflen,
0659                   struct list_head *addtl)
0660 {
0661     int len = 0;
0662     int ret = 0;
0663     struct drbg_string data;
0664     LIST_HEAD(datalist);
0665 
0666     /* 10.1.2.5 step 2 */
0667     if (addtl && !list_empty(addtl)) {
0668         ret = drbg_hmac_update(drbg, addtl, 1);
0669         if (ret)
0670             return ret;
0671     }
0672 
0673     drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
0674     list_add_tail(&data.list, &datalist);
0675     while (len < buflen) {
0676         unsigned int outlen = 0;
0677         /* 10.1.2.5 step 4.1 */
0678         ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
0679         if (ret)
0680             return ret;
0681         outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
0682               drbg_blocklen(drbg) : (buflen - len);
0683 
0684         /* 10.1.2.5 step 4.2 */
0685         memcpy(buf + len, drbg->V, outlen);
0686         len += outlen;
0687     }
0688 
0689     /* 10.1.2.5 step 6 */
0690     if (addtl && !list_empty(addtl))
0691         ret = drbg_hmac_update(drbg, addtl, 1);
0692     else
0693         ret = drbg_hmac_update(drbg, NULL, 1);
0694     if (ret)
0695         return ret;
0696 
0697     return len;
0698 }
0699 
0700 static const struct drbg_state_ops drbg_hmac_ops = {
0701     .update     = drbg_hmac_update,
0702     .generate   = drbg_hmac_generate,
0703     .crypto_init    = drbg_init_hash_kernel,
0704     .crypto_fini    = drbg_fini_hash_kernel,
0705 };
0706 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
0707 
0708 /******************************************************************
0709  * Hash DRBG callback functions
0710  ******************************************************************/
0711 
0712 #ifdef CONFIG_CRYPTO_DRBG_HASH
0713 #define CRYPTO_DRBG_HASH_STRING "HASH "
0714 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
0715 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
0716 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
0717 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
0718 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
0719 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
0720 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
0721 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
0722 
0723 /*
0724  * Increment buffer
0725  *
0726  * @dst buffer to increment
0727  * @add value to add
0728  */
0729 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
0730                 const unsigned char *add, size_t addlen)
0731 {
0732     /* implied: dstlen > addlen */
0733     unsigned char *dstptr;
0734     const unsigned char *addptr;
0735     unsigned int remainder = 0;
0736     size_t len = addlen;
0737 
0738     dstptr = dst + (dstlen-1);
0739     addptr = add + (addlen-1);
0740     while (len) {
0741         remainder += *dstptr + *addptr;
0742         *dstptr = remainder & 0xff;
0743         remainder >>= 8;
0744         len--; dstptr--; addptr--;
0745     }
0746     len = dstlen - addlen;
0747     while (len && remainder > 0) {
0748         remainder = *dstptr + 1;
0749         *dstptr = remainder & 0xff;
0750         remainder >>= 8;
0751         len--; dstptr--;
0752     }
0753 }
0754 
0755 /*
0756  * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
0757  * interlinked, the scratchpad is used as follows:
0758  * drbg_hash_update
0759  *  start: drbg->scratchpad
0760  *  length: drbg_statelen(drbg)
0761  * drbg_hash_df:
0762  *  start: drbg->scratchpad + drbg_statelen(drbg)
0763  *  length: drbg_blocklen(drbg)
0764  *
0765  * drbg_hash_process_addtl uses the scratchpad, but fully completes
0766  * before either of the functions mentioned before are invoked. Therefore,
0767  * drbg_hash_process_addtl does not need to be specifically considered.
0768  */
0769 
0770 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
0771 static int drbg_hash_df(struct drbg_state *drbg,
0772             unsigned char *outval, size_t outlen,
0773             struct list_head *entropylist)
0774 {
0775     int ret = 0;
0776     size_t len = 0;
0777     unsigned char input[5];
0778     unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
0779     struct drbg_string data;
0780 
0781     /* 10.4.1 step 3 */
0782     input[0] = 1;
0783     drbg_cpu_to_be32((outlen * 8), &input[1]);
0784 
0785     /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
0786     drbg_string_fill(&data, input, 5);
0787     list_add(&data.list, entropylist);
0788 
0789     /* 10.4.1 step 4 */
0790     while (len < outlen) {
0791         short blocklen = 0;
0792         /* 10.4.1 step 4.1 */
0793         ret = drbg_kcapi_hash(drbg, tmp, entropylist);
0794         if (ret)
0795             goto out;
0796         /* 10.4.1 step 4.2 */
0797         input[0]++;
0798         blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
0799                 drbg_blocklen(drbg) : (outlen - len);
0800         memcpy(outval + len, tmp, blocklen);
0801         len += blocklen;
0802     }
0803 
0804 out:
0805     memset(tmp, 0, drbg_blocklen(drbg));
0806     return ret;
0807 }
0808 
0809 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
0810 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
0811                 int reseed)
0812 {
0813     int ret = 0;
0814     struct drbg_string data1, data2;
0815     LIST_HEAD(datalist);
0816     LIST_HEAD(datalist2);
0817     unsigned char *V = drbg->scratchpad;
0818     unsigned char prefix = DRBG_PREFIX1;
0819 
0820     if (!seed)
0821         return -EINVAL;
0822 
0823     if (reseed) {
0824         /* 10.1.1.3 step 1 */
0825         memcpy(V, drbg->V, drbg_statelen(drbg));
0826         drbg_string_fill(&data1, &prefix, 1);
0827         list_add_tail(&data1.list, &datalist);
0828         drbg_string_fill(&data2, V, drbg_statelen(drbg));
0829         list_add_tail(&data2.list, &datalist);
0830     }
0831     list_splice_tail(seed, &datalist);
0832 
0833     /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
0834     ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
0835     if (ret)
0836         goto out;
0837 
0838     /* 10.1.1.2 / 10.1.1.3 step 4  */
0839     prefix = DRBG_PREFIX0;
0840     drbg_string_fill(&data1, &prefix, 1);
0841     list_add_tail(&data1.list, &datalist2);
0842     drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
0843     list_add_tail(&data2.list, &datalist2);
0844     /* 10.1.1.2 / 10.1.1.3 step 4 */
0845     ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
0846 
0847 out:
0848     memset(drbg->scratchpad, 0, drbg_statelen(drbg));
0849     return ret;
0850 }
0851 
0852 /* processing of additional information string for Hash DRBG */
0853 static int drbg_hash_process_addtl(struct drbg_state *drbg,
0854                    struct list_head *addtl)
0855 {
0856     int ret = 0;
0857     struct drbg_string data1, data2;
0858     LIST_HEAD(datalist);
0859     unsigned char prefix = DRBG_PREFIX2;
0860 
0861     /* 10.1.1.4 step 2 */
0862     if (!addtl || list_empty(addtl))
0863         return 0;
0864 
0865     /* 10.1.1.4 step 2a */
0866     drbg_string_fill(&data1, &prefix, 1);
0867     drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
0868     list_add_tail(&data1.list, &datalist);
0869     list_add_tail(&data2.list, &datalist);
0870     list_splice_tail(addtl, &datalist);
0871     ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
0872     if (ret)
0873         goto out;
0874 
0875     /* 10.1.1.4 step 2b */
0876     drbg_add_buf(drbg->V, drbg_statelen(drbg),
0877              drbg->scratchpad, drbg_blocklen(drbg));
0878 
0879 out:
0880     memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
0881     return ret;
0882 }
0883 
0884 /* Hashgen defined in 10.1.1.4 */
0885 static int drbg_hash_hashgen(struct drbg_state *drbg,
0886                  unsigned char *buf,
0887                  unsigned int buflen)
0888 {
0889     int len = 0;
0890     int ret = 0;
0891     unsigned char *src = drbg->scratchpad;
0892     unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
0893     struct drbg_string data;
0894     LIST_HEAD(datalist);
0895 
0896     /* 10.1.1.4 step hashgen 2 */
0897     memcpy(src, drbg->V, drbg_statelen(drbg));
0898 
0899     drbg_string_fill(&data, src, drbg_statelen(drbg));
0900     list_add_tail(&data.list, &datalist);
0901     while (len < buflen) {
0902         unsigned int outlen = 0;
0903         /* 10.1.1.4 step hashgen 4.1 */
0904         ret = drbg_kcapi_hash(drbg, dst, &datalist);
0905         if (ret) {
0906             len = ret;
0907             goto out;
0908         }
0909         outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
0910               drbg_blocklen(drbg) : (buflen - len);
0911         /* 10.1.1.4 step hashgen 4.2 */
0912         memcpy(buf + len, dst, outlen);
0913         len += outlen;
0914         /* 10.1.1.4 hashgen step 4.3 */
0915         if (len < buflen)
0916             crypto_inc(src, drbg_statelen(drbg));
0917     }
0918 
0919 out:
0920     memset(drbg->scratchpad, 0,
0921            (drbg_statelen(drbg) + drbg_blocklen(drbg)));
0922     return len;
0923 }
0924 
0925 /* generate function for Hash DRBG as defined in  10.1.1.4 */
0926 static int drbg_hash_generate(struct drbg_state *drbg,
0927                   unsigned char *buf, unsigned int buflen,
0928                   struct list_head *addtl)
0929 {
0930     int len = 0;
0931     int ret = 0;
0932     union {
0933         unsigned char req[8];
0934         __be64 req_int;
0935     } u;
0936     unsigned char prefix = DRBG_PREFIX3;
0937     struct drbg_string data1, data2;
0938     LIST_HEAD(datalist);
0939 
0940     /* 10.1.1.4 step 2 */
0941     ret = drbg_hash_process_addtl(drbg, addtl);
0942     if (ret)
0943         return ret;
0944     /* 10.1.1.4 step 3 */
0945     len = drbg_hash_hashgen(drbg, buf, buflen);
0946 
0947     /* this is the value H as documented in 10.1.1.4 */
0948     /* 10.1.1.4 step 4 */
0949     drbg_string_fill(&data1, &prefix, 1);
0950     list_add_tail(&data1.list, &datalist);
0951     drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
0952     list_add_tail(&data2.list, &datalist);
0953     ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
0954     if (ret) {
0955         len = ret;
0956         goto out;
0957     }
0958 
0959     /* 10.1.1.4 step 5 */
0960     drbg_add_buf(drbg->V, drbg_statelen(drbg),
0961              drbg->scratchpad, drbg_blocklen(drbg));
0962     drbg_add_buf(drbg->V, drbg_statelen(drbg),
0963              drbg->C, drbg_statelen(drbg));
0964     u.req_int = cpu_to_be64(drbg->reseed_ctr);
0965     drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
0966 
0967 out:
0968     memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
0969     return len;
0970 }
0971 
0972 /*
0973  * scratchpad usage: as update and generate are used isolated, both
0974  * can use the scratchpad
0975  */
0976 static const struct drbg_state_ops drbg_hash_ops = {
0977     .update     = drbg_hash_update,
0978     .generate   = drbg_hash_generate,
0979     .crypto_init    = drbg_init_hash_kernel,
0980     .crypto_fini    = drbg_fini_hash_kernel,
0981 };
0982 #endif /* CONFIG_CRYPTO_DRBG_HASH */
0983 
0984 /******************************************************************
0985  * Functions common for DRBG implementations
0986  ******************************************************************/
0987 
0988 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
0989                   int reseed)
0990 {
0991     int ret = drbg->d_ops->update(drbg, seed, reseed);
0992 
0993     if (ret)
0994         return ret;
0995 
0996     drbg->seeded = true;
0997     /* 10.1.1.2 / 10.1.1.3 step 5 */
0998     drbg->reseed_ctr = 1;
0999 
1000     return ret;
1001 }
1002 
1003 static void drbg_async_seed(struct work_struct *work)
1004 {
1005     struct drbg_string data;
1006     LIST_HEAD(seedlist);
1007     struct drbg_state *drbg = container_of(work, struct drbg_state,
1008                            seed_work);
1009     unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1010     unsigned char entropy[32];
1011 
1012     BUG_ON(!entropylen);
1013     BUG_ON(entropylen > sizeof(entropy));
1014     get_random_bytes(entropy, entropylen);
1015 
1016     drbg_string_fill(&data, entropy, entropylen);
1017     list_add_tail(&data.list, &seedlist);
1018 
1019     mutex_lock(&drbg->drbg_mutex);
1020 
1021     /* If nonblocking pool is initialized, deactivate Jitter RNG */
1022     crypto_free_rng(drbg->jent);
1023     drbg->jent = NULL;
1024 
1025     /* Set seeded to false so that if __drbg_seed fails the
1026      * next generate call will trigger a reseed.
1027      */
1028     drbg->seeded = false;
1029 
1030     __drbg_seed(drbg, &seedlist, true);
1031 
1032     if (drbg->seeded)
1033         drbg->reseed_threshold = drbg_max_requests(drbg);
1034 
1035     mutex_unlock(&drbg->drbg_mutex);
1036 
1037     memzero_explicit(entropy, entropylen);
1038 }
1039 
1040 /*
1041  * Seeding or reseeding of the DRBG
1042  *
1043  * @drbg: DRBG state struct
1044  * @pers: personalization / additional information buffer
1045  * @reseed: 0 for initial seed process, 1 for reseeding
1046  *
1047  * return:
1048  *  0 on success
1049  *  error value otherwise
1050  */
1051 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1052              bool reseed)
1053 {
1054     int ret;
1055     unsigned char entropy[((32 + 16) * 2)];
1056     unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1057     struct drbg_string data1;
1058     LIST_HEAD(seedlist);
1059 
1060     /* 9.1 / 9.2 / 9.3.1 step 3 */
1061     if (pers && pers->len > (drbg_max_addtl(drbg))) {
1062         pr_devel("DRBG: personalization string too long %zu\n",
1063              pers->len);
1064         return -EINVAL;
1065     }
1066 
1067     if (list_empty(&drbg->test_data.list)) {
1068         drbg_string_fill(&data1, drbg->test_data.buf,
1069                  drbg->test_data.len);
1070         pr_devel("DRBG: using test entropy\n");
1071     } else {
1072         /*
1073          * Gather entropy equal to the security strength of the DRBG.
1074          * With a derivation function, a nonce is required in addition
1075          * to the entropy. A nonce must be at least 1/2 of the security
1076          * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1077          * of the strength. The consideration of a nonce is only
1078          * applicable during initial seeding.
1079          */
1080         BUG_ON(!entropylen);
1081         if (!reseed)
1082             entropylen = ((entropylen + 1) / 2) * 3;
1083         BUG_ON((entropylen * 2) > sizeof(entropy));
1084 
1085         /* Get seed from in-kernel /dev/urandom */
1086         get_random_bytes(entropy, entropylen);
1087 
1088         if (!drbg->jent) {
1089             drbg_string_fill(&data1, entropy, entropylen);
1090             pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1091                  entropylen);
1092         } else {
1093             /* Get seed from Jitter RNG */
1094             ret = crypto_rng_get_bytes(drbg->jent,
1095                            entropy + entropylen,
1096                            entropylen);
1097             if (ret) {
1098                 pr_devel("DRBG: jent failed with %d\n", ret);
1099                 return ret;
1100             }
1101 
1102             drbg_string_fill(&data1, entropy, entropylen * 2);
1103             pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1104                  entropylen * 2);
1105         }
1106     }
1107     list_add_tail(&data1.list, &seedlist);
1108 
1109     /*
1110      * concatenation of entropy with personalization str / addtl input)
1111      * the variable pers is directly handed in by the caller, so check its
1112      * contents whether it is appropriate
1113      */
1114     if (pers && pers->buf && 0 < pers->len) {
1115         list_add_tail(&pers->list, &seedlist);
1116         pr_devel("DRBG: using personalization string\n");
1117     }
1118 
1119     if (!reseed) {
1120         memset(drbg->V, 0, drbg_statelen(drbg));
1121         memset(drbg->C, 0, drbg_statelen(drbg));
1122     }
1123 
1124     ret = __drbg_seed(drbg, &seedlist, reseed);
1125 
1126     memzero_explicit(entropy, entropylen * 2);
1127 
1128     return ret;
1129 }
1130 
1131 /* Free all substructures in a DRBG state without the DRBG state structure */
1132 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1133 {
1134     if (!drbg)
1135         return;
1136     kzfree(drbg->V);
1137     drbg->Vbuf = NULL;
1138     kzfree(drbg->C);
1139     drbg->Cbuf = NULL;
1140     kzfree(drbg->scratchpadbuf);
1141     drbg->scratchpadbuf = NULL;
1142     drbg->reseed_ctr = 0;
1143     drbg->d_ops = NULL;
1144     drbg->core = NULL;
1145 }
1146 
1147 /*
1148  * Allocate all sub-structures for a DRBG state.
1149  * The DRBG state structure must already be allocated.
1150  */
1151 static inline int drbg_alloc_state(struct drbg_state *drbg)
1152 {
1153     int ret = -ENOMEM;
1154     unsigned int sb_size = 0;
1155 
1156     switch (drbg->core->flags & DRBG_TYPE_MASK) {
1157 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1158     case DRBG_HMAC:
1159         drbg->d_ops = &drbg_hmac_ops;
1160         break;
1161 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1162 #ifdef CONFIG_CRYPTO_DRBG_HASH
1163     case DRBG_HASH:
1164         drbg->d_ops = &drbg_hash_ops;
1165         break;
1166 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1167 #ifdef CONFIG_CRYPTO_DRBG_CTR
1168     case DRBG_CTR:
1169         drbg->d_ops = &drbg_ctr_ops;
1170         break;
1171 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1172     default:
1173         ret = -EOPNOTSUPP;
1174         goto err;
1175     }
1176 
1177     ret = drbg->d_ops->crypto_init(drbg);
1178     if (ret < 0)
1179         goto err;
1180 
1181     drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1182     if (!drbg->Vbuf) {
1183         ret = -ENOMEM;
1184         goto fini;
1185     }
1186     drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1187     drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1188     if (!drbg->Cbuf) {
1189         ret = -ENOMEM;
1190         goto fini;
1191     }
1192     drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1193     /* scratchpad is only generated for CTR and Hash */
1194     if (drbg->core->flags & DRBG_HMAC)
1195         sb_size = 0;
1196     else if (drbg->core->flags & DRBG_CTR)
1197         sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1198               drbg_statelen(drbg) + /* df_data */
1199               drbg_blocklen(drbg) + /* pad */
1200               drbg_blocklen(drbg) + /* iv */
1201               drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1202     else
1203         sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1204 
1205     if (0 < sb_size) {
1206         drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1207         if (!drbg->scratchpadbuf) {
1208             ret = -ENOMEM;
1209             goto fini;
1210         }
1211         drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1212     }
1213 
1214     return 0;
1215 
1216 fini:
1217     drbg->d_ops->crypto_fini(drbg);
1218 err:
1219     drbg_dealloc_state(drbg);
1220     return ret;
1221 }
1222 
1223 /*************************************************************************
1224  * DRBG interface functions
1225  *************************************************************************/
1226 
1227 /*
1228  * DRBG generate function as required by SP800-90A - this function
1229  * generates random numbers
1230  *
1231  * @drbg DRBG state handle
1232  * @buf Buffer where to store the random numbers -- the buffer must already
1233  *      be pre-allocated by caller
1234  * @buflen Length of output buffer - this value defines the number of random
1235  *     bytes pulled from DRBG
1236  * @addtl Additional input that is mixed into state, may be NULL -- note
1237  *    the entropy is pulled by the DRBG internally unconditionally
1238  *    as defined in SP800-90A. The additional input is mixed into
1239  *    the state in addition to the pulled entropy.
1240  *
1241  * return: 0 when all bytes are generated; < 0 in case of an error
1242  */
1243 static int drbg_generate(struct drbg_state *drbg,
1244              unsigned char *buf, unsigned int buflen,
1245              struct drbg_string *addtl)
1246 {
1247     int len = 0;
1248     LIST_HEAD(addtllist);
1249 
1250     if (!drbg->core) {
1251         pr_devel("DRBG: not yet seeded\n");
1252         return -EINVAL;
1253     }
1254     if (0 == buflen || !buf) {
1255         pr_devel("DRBG: no output buffer provided\n");
1256         return -EINVAL;
1257     }
1258     if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1259         pr_devel("DRBG: wrong format of additional information\n");
1260         return -EINVAL;
1261     }
1262 
1263     /* 9.3.1 step 2 */
1264     len = -EINVAL;
1265     if (buflen > (drbg_max_request_bytes(drbg))) {
1266         pr_devel("DRBG: requested random numbers too large %u\n",
1267              buflen);
1268         goto err;
1269     }
1270 
1271     /* 9.3.1 step 3 is implicit with the chosen DRBG */
1272 
1273     /* 9.3.1 step 4 */
1274     if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1275         pr_devel("DRBG: additional information string too long %zu\n",
1276              addtl->len);
1277         goto err;
1278     }
1279     /* 9.3.1 step 5 is implicit with the chosen DRBG */
1280 
1281     /*
1282      * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1283      * here. The spec is a bit convoluted here, we make it simpler.
1284      */
1285     if (drbg->reseed_threshold < drbg->reseed_ctr)
1286         drbg->seeded = false;
1287 
1288     if (drbg->pr || !drbg->seeded) {
1289         pr_devel("DRBG: reseeding before generation (prediction "
1290              "resistance: %s, state %s)\n",
1291              drbg->pr ? "true" : "false",
1292              drbg->seeded ? "seeded" : "unseeded");
1293         /* 9.3.1 steps 7.1 through 7.3 */
1294         len = drbg_seed(drbg, addtl, true);
1295         if (len)
1296             goto err;
1297         /* 9.3.1 step 7.4 */
1298         addtl = NULL;
1299     }
1300 
1301     if (addtl && 0 < addtl->len)
1302         list_add_tail(&addtl->list, &addtllist);
1303     /* 9.3.1 step 8 and 10 */
1304     len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1305 
1306     /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1307     drbg->reseed_ctr++;
1308     if (0 >= len)
1309         goto err;
1310 
1311     /*
1312      * Section 11.3.3 requires to re-perform self tests after some
1313      * generated random numbers. The chosen value after which self
1314      * test is performed is arbitrary, but it should be reasonable.
1315      * However, we do not perform the self tests because of the following
1316      * reasons: it is mathematically impossible that the initial self tests
1317      * were successfully and the following are not. If the initial would
1318      * pass and the following would not, the kernel integrity is violated.
1319      * In this case, the entire kernel operation is questionable and it
1320      * is unlikely that the integrity violation only affects the
1321      * correct operation of the DRBG.
1322      *
1323      * Albeit the following code is commented out, it is provided in
1324      * case somebody has a need to implement the test of 11.3.3.
1325      */
1326 #if 0
1327     if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1328         int err = 0;
1329         pr_devel("DRBG: start to perform self test\n");
1330         if (drbg->core->flags & DRBG_HMAC)
1331             err = alg_test("drbg_pr_hmac_sha256",
1332                        "drbg_pr_hmac_sha256", 0, 0);
1333         else if (drbg->core->flags & DRBG_CTR)
1334             err = alg_test("drbg_pr_ctr_aes128",
1335                        "drbg_pr_ctr_aes128", 0, 0);
1336         else
1337             err = alg_test("drbg_pr_sha256",
1338                        "drbg_pr_sha256", 0, 0);
1339         if (err) {
1340             pr_err("DRBG: periodical self test failed\n");
1341             /*
1342              * uninstantiate implies that from now on, only errors
1343              * are returned when reusing this DRBG cipher handle
1344              */
1345             drbg_uninstantiate(drbg);
1346             return 0;
1347         } else {
1348             pr_devel("DRBG: self test successful\n");
1349         }
1350     }
1351 #endif
1352 
1353     /*
1354      * All operations were successful, return 0 as mandated by
1355      * the kernel crypto API interface.
1356      */
1357     len = 0;
1358 err:
1359     return len;
1360 }
1361 
1362 /*
1363  * Wrapper around drbg_generate which can pull arbitrary long strings
1364  * from the DRBG without hitting the maximum request limitation.
1365  *
1366  * Parameters: see drbg_generate
1367  * Return codes: see drbg_generate -- if one drbg_generate request fails,
1368  *       the entire drbg_generate_long request fails
1369  */
1370 static int drbg_generate_long(struct drbg_state *drbg,
1371                   unsigned char *buf, unsigned int buflen,
1372                   struct drbg_string *addtl)
1373 {
1374     unsigned int len = 0;
1375     unsigned int slice = 0;
1376     do {
1377         int err = 0;
1378         unsigned int chunk = 0;
1379         slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1380         chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1381         mutex_lock(&drbg->drbg_mutex);
1382         err = drbg_generate(drbg, buf + len, chunk, addtl);
1383         mutex_unlock(&drbg->drbg_mutex);
1384         if (0 > err)
1385             return err;
1386         len += chunk;
1387     } while (slice > 0 && (len < buflen));
1388     return 0;
1389 }
1390 
1391 static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
1392 {
1393     struct drbg_state *drbg = container_of(rdy, struct drbg_state,
1394                            random_ready);
1395 
1396     schedule_work(&drbg->seed_work);
1397 }
1398 
1399 static int drbg_prepare_hrng(struct drbg_state *drbg)
1400 {
1401     int err;
1402 
1403     /* We do not need an HRNG in test mode. */
1404     if (list_empty(&drbg->test_data.list))
1405         return 0;
1406 
1407     INIT_WORK(&drbg->seed_work, drbg_async_seed);
1408 
1409     drbg->random_ready.owner = THIS_MODULE;
1410     drbg->random_ready.func = drbg_schedule_async_seed;
1411 
1412     err = add_random_ready_callback(&drbg->random_ready);
1413 
1414     switch (err) {
1415     case 0:
1416         break;
1417 
1418     case -EALREADY:
1419         err = 0;
1420         /* fall through */
1421 
1422     default:
1423         drbg->random_ready.func = NULL;
1424         return err;
1425     }
1426 
1427     drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1428 
1429     /*
1430      * Require frequent reseeds until the seed source is fully
1431      * initialized.
1432      */
1433     drbg->reseed_threshold = 50;
1434 
1435     return err;
1436 }
1437 
1438 /*
1439  * DRBG instantiation function as required by SP800-90A - this function
1440  * sets up the DRBG handle, performs the initial seeding and all sanity
1441  * checks required by SP800-90A
1442  *
1443  * @drbg memory of state -- if NULL, new memory is allocated
1444  * @pers Personalization string that is mixed into state, may be NULL -- note
1445  *   the entropy is pulled by the DRBG internally unconditionally
1446  *   as defined in SP800-90A. The additional input is mixed into
1447  *   the state in addition to the pulled entropy.
1448  * @coreref reference to core
1449  * @pr prediction resistance enabled
1450  *
1451  * return
1452  *  0 on success
1453  *  error value otherwise
1454  */
1455 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1456                 int coreref, bool pr)
1457 {
1458     int ret;
1459     bool reseed = true;
1460 
1461     pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1462          "%s\n", coreref, pr ? "enabled" : "disabled");
1463     mutex_lock(&drbg->drbg_mutex);
1464 
1465     /* 9.1 step 1 is implicit with the selected DRBG type */
1466 
1467     /*
1468      * 9.1 step 2 is implicit as caller can select prediction resistance
1469      * and the flag is copied into drbg->flags --
1470      * all DRBG types support prediction resistance
1471      */
1472 
1473     /* 9.1 step 4 is implicit in  drbg_sec_strength */
1474 
1475     if (!drbg->core) {
1476         drbg->core = &drbg_cores[coreref];
1477         drbg->pr = pr;
1478         drbg->seeded = false;
1479         drbg->reseed_threshold = drbg_max_requests(drbg);
1480 
1481         ret = drbg_alloc_state(drbg);
1482         if (ret)
1483             goto unlock;
1484 
1485         ret = drbg_prepare_hrng(drbg);
1486         if (ret)
1487             goto free_everything;
1488 
1489         if (IS_ERR(drbg->jent)) {
1490             ret = PTR_ERR(drbg->jent);
1491             drbg->jent = NULL;
1492             if (fips_enabled || ret != -ENOENT)
1493                 goto free_everything;
1494             pr_info("DRBG: Continuing without Jitter RNG\n");
1495         }
1496 
1497         reseed = false;
1498     }
1499 
1500     ret = drbg_seed(drbg, pers, reseed);
1501 
1502     if (ret && !reseed)
1503         goto free_everything;
1504 
1505     mutex_unlock(&drbg->drbg_mutex);
1506     return ret;
1507 
1508 unlock:
1509     mutex_unlock(&drbg->drbg_mutex);
1510     return ret;
1511 
1512 free_everything:
1513     mutex_unlock(&drbg->drbg_mutex);
1514     drbg_uninstantiate(drbg);
1515     return ret;
1516 }
1517 
1518 /*
1519  * DRBG uninstantiate function as required by SP800-90A - this function
1520  * frees all buffers and the DRBG handle
1521  *
1522  * @drbg DRBG state handle
1523  *
1524  * return
1525  *  0 on success
1526  */
1527 static int drbg_uninstantiate(struct drbg_state *drbg)
1528 {
1529     if (drbg->random_ready.func) {
1530         del_random_ready_callback(&drbg->random_ready);
1531         cancel_work_sync(&drbg->seed_work);
1532         crypto_free_rng(drbg->jent);
1533         drbg->jent = NULL;
1534     }
1535 
1536     if (drbg->d_ops)
1537         drbg->d_ops->crypto_fini(drbg);
1538     drbg_dealloc_state(drbg);
1539     /* no scrubbing of test_data -- this shall survive an uninstantiate */
1540     return 0;
1541 }
1542 
1543 /*
1544  * Helper function for setting the test data in the DRBG
1545  *
1546  * @drbg DRBG state handle
1547  * @data test data
1548  * @len test data length
1549  */
1550 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1551                    const u8 *data, unsigned int len)
1552 {
1553     struct drbg_state *drbg = crypto_rng_ctx(tfm);
1554 
1555     mutex_lock(&drbg->drbg_mutex);
1556     drbg_string_fill(&drbg->test_data, data, len);
1557     mutex_unlock(&drbg->drbg_mutex);
1558 }
1559 
1560 /***************************************************************
1561  * Kernel crypto API cipher invocations requested by DRBG
1562  ***************************************************************/
1563 
1564 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1565 struct sdesc {
1566     struct shash_desc shash;
1567     char ctx[];
1568 };
1569 
1570 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1571 {
1572     struct sdesc *sdesc;
1573     struct crypto_shash *tfm;
1574 
1575     tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1576     if (IS_ERR(tfm)) {
1577         pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1578                 drbg->core->backend_cra_name);
1579         return PTR_ERR(tfm);
1580     }
1581     BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1582     sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1583             GFP_KERNEL);
1584     if (!sdesc) {
1585         crypto_free_shash(tfm);
1586         return -ENOMEM;
1587     }
1588 
1589     sdesc->shash.tfm = tfm;
1590     sdesc->shash.flags = 0;
1591     drbg->priv_data = sdesc;
1592 
1593     return crypto_shash_alignmask(tfm);
1594 }
1595 
1596 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1597 {
1598     struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1599     if (sdesc) {
1600         crypto_free_shash(sdesc->shash.tfm);
1601         kzfree(sdesc);
1602     }
1603     drbg->priv_data = NULL;
1604     return 0;
1605 }
1606 
1607 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1608                   const unsigned char *key)
1609 {
1610     struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1611 
1612     crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1613 }
1614 
1615 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1616                const struct list_head *in)
1617 {
1618     struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1619     struct drbg_string *input = NULL;
1620 
1621     crypto_shash_init(&sdesc->shash);
1622     list_for_each_entry(input, in, list)
1623         crypto_shash_update(&sdesc->shash, input->buf, input->len);
1624     return crypto_shash_final(&sdesc->shash, outval);
1625 }
1626 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1627 
1628 #ifdef CONFIG_CRYPTO_DRBG_CTR
1629 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1630 {
1631     struct crypto_cipher *tfm =
1632         (struct crypto_cipher *)drbg->priv_data;
1633     if (tfm)
1634         crypto_free_cipher(tfm);
1635     drbg->priv_data = NULL;
1636 
1637     if (drbg->ctr_handle)
1638         crypto_free_skcipher(drbg->ctr_handle);
1639     drbg->ctr_handle = NULL;
1640 
1641     if (drbg->ctr_req)
1642         skcipher_request_free(drbg->ctr_req);
1643     drbg->ctr_req = NULL;
1644 
1645     kfree(drbg->ctr_null_value_buf);
1646     drbg->ctr_null_value = NULL;
1647 
1648     kfree(drbg->outscratchpadbuf);
1649     drbg->outscratchpadbuf = NULL;
1650 
1651     return 0;
1652 }
1653 
1654 static void drbg_skcipher_cb(struct crypto_async_request *req, int error)
1655 {
1656     struct drbg_state *drbg = req->data;
1657 
1658     if (error == -EINPROGRESS)
1659         return;
1660     drbg->ctr_async_err = error;
1661     complete(&drbg->ctr_completion);
1662 }
1663 
1664 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1665 {
1666     struct crypto_cipher *tfm;
1667     struct crypto_skcipher *sk_tfm;
1668     struct skcipher_request *req;
1669     unsigned int alignmask;
1670     char ctr_name[CRYPTO_MAX_ALG_NAME];
1671 
1672     tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1673     if (IS_ERR(tfm)) {
1674         pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1675                 drbg->core->backend_cra_name);
1676         return PTR_ERR(tfm);
1677     }
1678     BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1679     drbg->priv_data = tfm;
1680 
1681     if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1682         drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1683         drbg_fini_sym_kernel(drbg);
1684         return -EINVAL;
1685     }
1686     sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1687     if (IS_ERR(sk_tfm)) {
1688         pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1689                 ctr_name);
1690         drbg_fini_sym_kernel(drbg);
1691         return PTR_ERR(sk_tfm);
1692     }
1693     drbg->ctr_handle = sk_tfm;
1694 
1695     req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1696     if (!req) {
1697         pr_info("DRBG: could not allocate request queue\n");
1698         drbg_fini_sym_kernel(drbg);
1699         return -ENOMEM;
1700     }
1701     drbg->ctr_req = req;
1702     skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
1703                     drbg_skcipher_cb, drbg);
1704 
1705     alignmask = crypto_skcipher_alignmask(sk_tfm);
1706     drbg->ctr_null_value_buf = kzalloc(DRBG_CTR_NULL_LEN + alignmask,
1707                        GFP_KERNEL);
1708     if (!drbg->ctr_null_value_buf) {
1709         drbg_fini_sym_kernel(drbg);
1710         return -ENOMEM;
1711     }
1712     drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf,
1713                            alignmask + 1);
1714 
1715     drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1716                      GFP_KERNEL);
1717     if (!drbg->outscratchpadbuf) {
1718         drbg_fini_sym_kernel(drbg);
1719         return -ENOMEM;
1720     }
1721     drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1722                           alignmask + 1);
1723 
1724     return alignmask;
1725 }
1726 
1727 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1728                  const unsigned char *key)
1729 {
1730     struct crypto_cipher *tfm =
1731         (struct crypto_cipher *)drbg->priv_data;
1732 
1733     crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1734 }
1735 
1736 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1737               const struct drbg_string *in)
1738 {
1739     struct crypto_cipher *tfm =
1740         (struct crypto_cipher *)drbg->priv_data;
1741 
1742     /* there is only component in *in */
1743     BUG_ON(in->len < drbg_blocklen(drbg));
1744     crypto_cipher_encrypt_one(tfm, outval, in->buf);
1745     return 0;
1746 }
1747 
1748 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1749                   u8 *inbuf, u32 inlen,
1750                   u8 *outbuf, u32 outlen)
1751 {
1752     struct scatterlist sg_in;
1753     int ret;
1754 
1755     sg_init_one(&sg_in, inbuf, inlen);
1756 
1757     while (outlen) {
1758         u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1759         struct scatterlist sg_out;
1760 
1761         /* Output buffer may not be valid for SGL, use scratchpad */
1762         sg_init_one(&sg_out, drbg->outscratchpad, cryptlen);
1763         skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out,
1764                        cryptlen, drbg->V);
1765         ret = crypto_skcipher_encrypt(drbg->ctr_req);
1766         switch (ret) {
1767         case 0:
1768             break;
1769         case -EINPROGRESS:
1770         case -EBUSY:
1771             ret = wait_for_completion_interruptible(
1772                 &drbg->ctr_completion);
1773             if (!ret && !drbg->ctr_async_err) {
1774                 reinit_completion(&drbg->ctr_completion);
1775                 break;
1776             }
1777         default:
1778             goto out;
1779         }
1780         init_completion(&drbg->ctr_completion);
1781 
1782         memcpy(outbuf, drbg->outscratchpad, cryptlen);
1783 
1784         outlen -= cryptlen;
1785         outbuf += cryptlen;
1786     }
1787     ret = 0;
1788 
1789 out:
1790     memzero_explicit(drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1791     return ret;
1792 }
1793 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1794 
1795 /***************************************************************
1796  * Kernel crypto API interface to register DRBG
1797  ***************************************************************/
1798 
1799 /*
1800  * Look up the DRBG flags by given kernel crypto API cra_name
1801  * The code uses the drbg_cores definition to do this
1802  *
1803  * @cra_name kernel crypto API cra_name
1804  * @coreref reference to integer which is filled with the pointer to
1805  *  the applicable core
1806  * @pr reference for setting prediction resistance
1807  *
1808  * return: flags
1809  */
1810 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1811                      int *coreref, bool *pr)
1812 {
1813     int i = 0;
1814     size_t start = 0;
1815     int len = 0;
1816 
1817     *pr = true;
1818     /* disassemble the names */
1819     if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1820         start = 10;
1821         *pr = false;
1822     } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1823         start = 8;
1824     } else {
1825         return;
1826     }
1827 
1828     /* remove the first part */
1829     len = strlen(cra_driver_name) - start;
1830     for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1831         if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1832                 len)) {
1833             *coreref = i;
1834             return;
1835         }
1836     }
1837 }
1838 
1839 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1840 {
1841     struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1842 
1843     mutex_init(&drbg->drbg_mutex);
1844 
1845     return 0;
1846 }
1847 
1848 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1849 {
1850     drbg_uninstantiate(crypto_tfm_ctx(tfm));
1851 }
1852 
1853 /*
1854  * Generate random numbers invoked by the kernel crypto API:
1855  * The API of the kernel crypto API is extended as follows:
1856  *
1857  * src is additional input supplied to the RNG.
1858  * slen is the length of src.
1859  * dst is the output buffer where random data is to be stored.
1860  * dlen is the length of dst.
1861  */
1862 static int drbg_kcapi_random(struct crypto_rng *tfm,
1863                  const u8 *src, unsigned int slen,
1864                  u8 *dst, unsigned int dlen)
1865 {
1866     struct drbg_state *drbg = crypto_rng_ctx(tfm);
1867     struct drbg_string *addtl = NULL;
1868     struct drbg_string string;
1869 
1870     if (slen) {
1871         /* linked list variable is now local to allow modification */
1872         drbg_string_fill(&string, src, slen);
1873         addtl = &string;
1874     }
1875 
1876     return drbg_generate_long(drbg, dst, dlen, addtl);
1877 }
1878 
1879 /*
1880  * Seed the DRBG invoked by the kernel crypto API
1881  */
1882 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1883                const u8 *seed, unsigned int slen)
1884 {
1885     struct drbg_state *drbg = crypto_rng_ctx(tfm);
1886     struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1887     bool pr = false;
1888     struct drbg_string string;
1889     struct drbg_string *seed_string = NULL;
1890     int coreref = 0;
1891 
1892     drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1893                   &pr);
1894     if (0 < slen) {
1895         drbg_string_fill(&string, seed, slen);
1896         seed_string = &string;
1897     }
1898 
1899     return drbg_instantiate(drbg, seed_string, coreref, pr);
1900 }
1901 
1902 /***************************************************************
1903  * Kernel module: code to load the module
1904  ***************************************************************/
1905 
1906 /*
1907  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1908  * of the error handling.
1909  *
1910  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1911  * as seed source of get_random_bytes does not fail.
1912  *
1913  * Note 2: There is no sensible way of testing the reseed counter
1914  * enforcement, so skip it.
1915  */
1916 static inline int __init drbg_healthcheck_sanity(void)
1917 {
1918     int len = 0;
1919 #define OUTBUFLEN 16
1920     unsigned char buf[OUTBUFLEN];
1921     struct drbg_state *drbg = NULL;
1922     int ret = -EFAULT;
1923     int rc = -EFAULT;
1924     bool pr = false;
1925     int coreref = 0;
1926     struct drbg_string addtl;
1927     size_t max_addtllen, max_request_bytes;
1928 
1929     /* only perform test in FIPS mode */
1930     if (!fips_enabled)
1931         return 0;
1932 
1933 #ifdef CONFIG_CRYPTO_DRBG_CTR
1934     drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
1935 #elif defined CONFIG_CRYPTO_DRBG_HASH
1936     drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
1937 #else
1938     drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
1939 #endif
1940 
1941     drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
1942     if (!drbg)
1943         return -ENOMEM;
1944 
1945     mutex_init(&drbg->drbg_mutex);
1946     drbg->core = &drbg_cores[coreref];
1947     drbg->reseed_threshold = drbg_max_requests(drbg);
1948 
1949     /*
1950      * if the following tests fail, it is likely that there is a buffer
1951      * overflow as buf is much smaller than the requested or provided
1952      * string lengths -- in case the error handling does not succeed
1953      * we may get an OOPS. And we want to get an OOPS as this is a
1954      * grave bug.
1955      */
1956 
1957     max_addtllen = drbg_max_addtl(drbg);
1958     max_request_bytes = drbg_max_request_bytes(drbg);
1959     drbg_string_fill(&addtl, buf, max_addtllen + 1);
1960     /* overflow addtllen with additonal info string */
1961     len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
1962     BUG_ON(0 < len);
1963     /* overflow max_bits */
1964     len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
1965     BUG_ON(0 < len);
1966 
1967     /* overflow max addtllen with personalization string */
1968     ret = drbg_seed(drbg, &addtl, false);
1969     BUG_ON(0 == ret);
1970     /* all tests passed */
1971     rc = 0;
1972 
1973     pr_devel("DRBG: Sanity tests for failure code paths successfully "
1974          "completed\n");
1975 
1976     kfree(drbg);
1977     return rc;
1978 }
1979 
1980 static struct rng_alg drbg_algs[22];
1981 
1982 /*
1983  * Fill the array drbg_algs used to register the different DRBGs
1984  * with the kernel crypto API. To fill the array, the information
1985  * from drbg_cores[] is used.
1986  */
1987 static inline void __init drbg_fill_array(struct rng_alg *alg,
1988                       const struct drbg_core *core, int pr)
1989 {
1990     int pos = 0;
1991     static int priority = 200;
1992 
1993     memcpy(alg->base.cra_name, "stdrng", 6);
1994     if (pr) {
1995         memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
1996         pos = 8;
1997     } else {
1998         memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
1999         pos = 10;
2000     }
2001     memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2002            strlen(core->cra_name));
2003 
2004     alg->base.cra_priority = priority;
2005     priority++;
2006     /*
2007      * If FIPS mode enabled, the selected DRBG shall have the
2008      * highest cra_priority over other stdrng instances to ensure
2009      * it is selected.
2010      */
2011     if (fips_enabled)
2012         alg->base.cra_priority += 200;
2013 
2014     alg->base.cra_ctxsize   = sizeof(struct drbg_state);
2015     alg->base.cra_module    = THIS_MODULE;
2016     alg->base.cra_init  = drbg_kcapi_init;
2017     alg->base.cra_exit  = drbg_kcapi_cleanup;
2018     alg->generate       = drbg_kcapi_random;
2019     alg->seed       = drbg_kcapi_seed;
2020     alg->set_ent        = drbg_kcapi_set_entropy;
2021     alg->seedsize       = 0;
2022 }
2023 
2024 static int __init drbg_init(void)
2025 {
2026     unsigned int i = 0; /* pointer to drbg_algs */
2027     unsigned int j = 0; /* pointer to drbg_cores */
2028     int ret;
2029 
2030     ret = drbg_healthcheck_sanity();
2031     if (ret)
2032         return ret;
2033 
2034     if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2035         pr_info("DRBG: Cannot register all DRBG types"
2036             "(slots needed: %zu, slots available: %zu)\n",
2037             ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2038         return -EFAULT;
2039     }
2040 
2041     /*
2042      * each DRBG definition can be used with PR and without PR, thus
2043      * we instantiate each DRBG in drbg_cores[] twice.
2044      *
2045      * As the order of placing them into the drbg_algs array matters
2046      * (the later DRBGs receive a higher cra_priority) we register the
2047      * prediction resistance DRBGs first as the should not be too
2048      * interesting.
2049      */
2050     for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2051         drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2052     for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2053         drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2054     return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2055 }
2056 
2057 static void __exit drbg_exit(void)
2058 {
2059     crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2060 }
2061 
2062 module_init(drbg_init);
2063 module_exit(drbg_exit);
2064 #ifndef CRYPTO_DRBG_HASH_STRING
2065 #define CRYPTO_DRBG_HASH_STRING ""
2066 #endif
2067 #ifndef CRYPTO_DRBG_HMAC_STRING
2068 #define CRYPTO_DRBG_HMAC_STRING ""
2069 #endif
2070 #ifndef CRYPTO_DRBG_CTR_STRING
2071 #define CRYPTO_DRBG_CTR_STRING ""
2072 #endif
2073 MODULE_LICENSE("GPL");
2074 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2075 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2076            "using following cores: "
2077            CRYPTO_DRBG_HASH_STRING
2078            CRYPTO_DRBG_HMAC_STRING
2079            CRYPTO_DRBG_CTR_STRING);
2080 MODULE_ALIAS_CRYPTO("stdrng");