crypto/drbg.c

   1 /*
   2  * DRBG: Deterministic Random Bits Generator
   3  *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
   4  *       properties:
   5  *              * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
   6  *              * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   7  *              * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   8  *              * with and without prediction resistance
   9  *
  10  * Copyright Stephan Mueller <smueller@chronox.de>, 2014
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, and the entire permission notice in its entirety,
  17  *    including the disclaimer of warranties.
  18  * 2. Redistributions in binary form must reproduce the above copyright
  19  *    notice, this list of conditions and the following disclaimer in the
  20  *    documentation and/or other materials provided with the distribution.
  21  * 3. The name of the author may not be used to endorse or promote
  22  *    products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * ALTERNATIVELY, this product may be distributed under the terms of
  26  * the GNU General Public License, in which case the provisions of the GPL are
  27  * required INSTEAD OF the above restrictions.  (This clause is
  28  * necessary due to a potential bad interaction between the GPL and
  29  * the restrictions contained in a BSD-style copyright.)
  30  *
  31  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34  * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
  35  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41  * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42  * DAMAGE.
  43  *
  44  * DRBG Usage
  45  * ==========
  46  * The SP 800-90A DRBG allows the user to specify a personalization string
  47  * for initialization as well as an additional information string for each
  48  * random number request. The following code fragments show how a caller
  49  * uses the kernel crypto API to use the full functionality of the DRBG.
  50  *
  51  * Usage without any additional data
  52  * ---------------------------------
  53  * struct crypto_rng *drng;
  54  * int err;
  55  * char data[DATALEN];
  56  *
  57  * drng = crypto_alloc_rng(drng_name, 0, 0);
  58  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59  * crypto_free_rng(drng);
  60  *
  61  *
  62  * Usage with personalization string during initialization
  63  * -------------------------------------------------------
  64  * struct crypto_rng *drng;
  65  * int err;
  66  * char data[DATALEN];
  67  * struct drbg_string pers;
  68  * char personalization[11] = "some-string";
  69  *
  70  * drbg_string_fill(&pers, personalization, strlen(personalization));
  71  * drng = crypto_alloc_rng(drng_name, 0, 0);
  72  * // The reset completely re-initializes the DRBG with the provided
  73  * // personalization string
  74  * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76  * crypto_free_rng(drng);
  77  *
  78  *
  79  * Usage with additional information string during random number request
  80  * ---------------------------------------------------------------------
  81  * struct crypto_rng *drng;
  82  * int err;
  83  * char data[DATALEN];
  84  * char addtl_string[11] = "some-string";
  85  * string drbg_string addtl;
  86  *
  87  * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88  * drng = crypto_alloc_rng(drng_name, 0, 0);
  89  * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90  * // the same error codes.
  91  * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92  * crypto_free_rng(drng);
  93  *
  94  *
  95  * Usage with personalization and additional information strings
  96  * -------------------------------------------------------------
  97  * Just mix both scenarios above.
  98  */
  99
 100 #include <crypto/drbg.h>
 101 #include <crypto/internal/cipher.h>
 102 #include <linux/kernel.h>
 103
 104 /***************************************************************
 105  * Backend cipher definitions available to DRBG
 106  ***************************************************************/
 107
 108 /*
 109  * The order of the DRBG definitions here matter: every DRBG is registered
 110  * as stdrng. Each DRBG receives an increasing cra_priority values the later
 111  * they are defined in this array (see drbg_fill_array).
 112  *
 113  * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
 114  * the SHA256 / AES 256 over other ciphers. Thus, the favored
 115  * DRBGs are the latest entries in this array.
 116  */
 117 static const struct drbg_core drbg_cores[] = {
 118 #ifdef CONFIG_CRYPTO_DRBG_CTR
 119         {
 120                 .flags = DRBG_CTR | DRBG_STRENGTH128,
 121                 .statelen = 32, /* 256 bits as defined in 10.2.1 */
 122                 .blocklen_bytes = 16,
 123                 .cra_name = "ctr_aes128",
 124                 .backend_cra_name = "aes",
 125         }, {
 126                 .flags = DRBG_CTR | DRBG_STRENGTH192,
 127                 .statelen = 40, /* 320 bits as defined in 10.2.1 */
 128                 .blocklen_bytes = 16,
 129                 .cra_name = "ctr_aes192",
 130                 .backend_cra_name = "aes",
 131         }, {
 132                 .flags = DRBG_CTR | DRBG_STRENGTH256,
 133                 .statelen = 48, /* 384 bits as defined in 10.2.1 */
 134                 .blocklen_bytes = 16,
 135                 .cra_name = "ctr_aes256",
 136                 .backend_cra_name = "aes",
 137         },
 138 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 139 #ifdef CONFIG_CRYPTO_DRBG_HASH
 140         {
 141                 .flags = DRBG_HASH | DRBG_STRENGTH128,
 142                 .statelen = 55, /* 440 bits */
 143                 .blocklen_bytes = 20,
 144                 .cra_name = "sha1",
 145                 .backend_cra_name = "sha1",
 146         }, {
 147                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 148                 .statelen = 111, /* 888 bits */
 149                 .blocklen_bytes = 48,
 150                 .cra_name = "sha384",
 151                 .backend_cra_name = "sha384",
 152         }, {
 153                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 154                 .statelen = 111, /* 888 bits */
 155                 .blocklen_bytes = 64,
 156                 .cra_name = "sha512",
 157                 .backend_cra_name = "sha512",
 158         }, {
 159                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 160                 .statelen = 55, /* 440 bits */
 161                 .blocklen_bytes = 32,
 162                 .cra_name = "sha256",
 163                 .backend_cra_name = "sha256",
 164         },
 165 #endif /* CONFIG_CRYPTO_DRBG_HASH */
 166 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 167         {
 168                 .flags = DRBG_HMAC | DRBG_STRENGTH128,
 169                 .statelen = 20, /* block length of cipher */
 170                 .blocklen_bytes = 20,
 171                 .cra_name = "hmac_sha1",
 172                 .backend_cra_name = "hmac(sha1)",
 173         }, {
 174                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 175                 .statelen = 48, /* block length of cipher */
 176                 .blocklen_bytes = 48,
 177                 .cra_name = "hmac_sha384",
 178                 .backend_cra_name = "hmac(sha384)",
 179         }, {
 180                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 181                 .statelen = 32, /* block length of cipher */
 182                 .blocklen_bytes = 32,
 183                 .cra_name = "hmac_sha256",
 184                 .backend_cra_name = "hmac(sha256)",
 185         }, {
 186                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 187                 .statelen = 64, /* block length of cipher */
 188                 .blocklen_bytes = 64,
 189                 .cra_name = "hmac_sha512",
 190                 .backend_cra_name = "hmac(sha512)",
 191         },
 192 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 193 };
 194
 195 static int drbg_uninstantiate(struct drbg_state *drbg);
 196
 197 /******************************************************************
 198  * Generic helper functions
 199  ******************************************************************/
 200
 201 /*
 202  * Return strength of DRBG according to SP800-90A section 8.4
 203  *
 204  * @flags DRBG flags reference
 205  *
 206  * Return: normalized strength in *bytes* value or 32 as default
 207  *         to counter programming errors
 208  */
 209 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
 210 {
 211         switch (flags & DRBG_STRENGTH_MASK) {
 212         case DRBG_STRENGTH128:
 213                 return 16;
 214         case DRBG_STRENGTH192:
 215                 return 24;
 216         case DRBG_STRENGTH256:
 217                 return 32;
 218         default:
 219                 return 32;
 220         }
 221 }
 222
 223 /*
 224  * FIPS 140-2 continuous self test for the noise source
 225  * The test is performed on the noise source input data. Thus, the function
 226  * implicitly knows the size of the buffer to be equal to the security
 227  * strength.
 228  *
 229  * Note, this function disregards the nonce trailing the entropy data during
 230  * initial seeding.
 231  *
 232  * drbg->drbg_mutex must have been taken.
 233  *
 234  * @drbg DRBG handle
 235  * @entropy buffer of seed data to be checked
 236  *
 237  * return:
 238  *      0 on success
 239  *      -EAGAIN on when the CTRNG is not yet primed
 240  *      < 0 on error
 241  */
 242 static int drbg_fips_continuous_test(struct drbg_state *drbg,
 243                                      const unsigned char *entropy)
 244 {
 245         unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
 246         int ret = 0;
 247
 248         if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
 249                 return 0;
 250
 251         /* skip test if we test the overall system */
 252         if (list_empty(&drbg->test_data.list))
 253                 return 0;
 254         /* only perform test in FIPS mode */
 255         if (!fips_enabled)
 256                 return 0;
 257
 258         if (!drbg->fips_primed) {
 259                 /* Priming of FIPS test */
 260                 memcpy(drbg->prev, entropy, entropylen);
 261                 drbg->fips_primed = true;
 262                 /* priming: another round is needed */
 263                 return -EAGAIN;
 264         }
 265         ret = memcmp(drbg->prev, entropy, entropylen);
 266         if (!ret)
 267                 panic("DRBG continuous self test failed\n");
 268         memcpy(drbg->prev, entropy, entropylen);
 269
 270         /* the test shall pass when the two values are not equal */
 271         return 0;
 272 }
 273
 274 /*
 275  * Convert an integer into a byte representation of this integer.
 276  * The byte representation is big-endian
 277  *
 278  * @val value to be converted
 279  * @buf buffer holding the converted integer -- caller must ensure that
 280  *      buffer size is at least 32 bit
 281  */
 282 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
 283 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
 284 {
 285         struct s {
 286                 __be32 conv;
 287         };
 288         struct s *conversion = (struct s *) buf;
 289
 290         conversion->conv = cpu_to_be32(val);
 291 }
 292 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
 293
 294 /******************************************************************
 295  * CTR DRBG callback functions
 296  ******************************************************************/
 297
 298 #ifdef CONFIG_CRYPTO_DRBG_CTR
 299 #define CRYPTO_DRBG_CTR_STRING "CTR "
 300 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
 301 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
 302 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
 303 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
 304 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
 305 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
 306
 307 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
 308                                  const unsigned char *key);
 309 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
 310                           const struct drbg_string *in);
 311 static int drbg_init_sym_kernel(struct drbg_state *drbg);
 312 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
 313 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
 314                               u8 *inbuf, u32 inbuflen,
 315                               u8 *outbuf, u32 outlen);
 316 #define DRBG_OUTSCRATCHLEN 256
 317
 318 /* BCC function for CTR DRBG as defined in 10.4.3 */
 319 static int drbg_ctr_bcc(struct drbg_state *drbg,
 320                         unsigned char *out, const unsigned char *key,
 321                         struct list_head *in)
 322 {
 323         int ret = 0;
 324         struct drbg_string *curr = NULL;
 325         struct drbg_string data;
 326         short cnt = 0;
 327
 328         drbg_string_fill(&data, out, drbg_blocklen(drbg));
 329
 330         /* 10.4.3 step 2 / 4 */
 331         drbg_kcapi_symsetkey(drbg, key);
 332         list_for_each_entry(curr, in, list) {
 333                 const unsigned char *pos = curr->buf;
 334                 size_t len = curr->len;
 335                 /* 10.4.3 step 4.1 */
 336                 while (len) {
 337                         /* 10.4.3 step 4.2 */
 338                         if (drbg_blocklen(drbg) == cnt) {
 339                                 cnt = 0;
 340                                 ret = drbg_kcapi_sym(drbg, out, &data);
 341                                 if (ret)
 342                                         return ret;
 343                         }
 344                         out[cnt] ^= *pos;
 345                         pos++;
 346                         cnt++;
 347                         len--;
 348                 }
 349         }
 350         /* 10.4.3 step 4.2 for last block */
 351         if (cnt)
 352                 ret = drbg_kcapi_sym(drbg, out, &data);
 353
 354         return ret;
 355 }
 356
 357 /*
 358  * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
 359  * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
 360  * the scratchpad is used as follows:
 361  * drbg_ctr_update:
 362  *      temp
 363  *              start: drbg->scratchpad
 364  *              length: drbg_statelen(drbg) + drbg_blocklen(drbg)
 365  *                      note: the cipher writing into this variable works
 366  *                      blocklen-wise. Now, when the statelen is not a multiple
 367  *                      of blocklen, the generateion loop below "spills over"
 368  *                      by at most blocklen. Thus, we need to give sufficient
 369  *                      memory.
 370  *      df_data
 371  *              start: drbg->scratchpad +
 372  *                              drbg_statelen(drbg) + drbg_blocklen(drbg)
 373  *              length: drbg_statelen(drbg)
 374  *
 375  * drbg_ctr_df:
 376  *      pad
 377  *              start: df_data + drbg_statelen(drbg)
 378  *              length: drbg_blocklen(drbg)
 379  *      iv
 380  *              start: pad + drbg_blocklen(drbg)
 381  *              length: drbg_blocklen(drbg)
 382  *      temp
 383  *              start: iv + drbg_blocklen(drbg)
 384  *              length: drbg_satelen(drbg) + drbg_blocklen(drbg)
 385  *                      note: temp is the buffer that the BCC function operates
 386  *                      on. BCC operates blockwise. drbg_statelen(drbg)
 387  *                      is sufficient when the DRBG state length is a multiple
 388  *                      of the block size. For AES192 (and maybe other ciphers)
 389  *                      this is not correct and the length for temp is
 390  *                      insufficient (yes, that also means for such ciphers,
 391  *                      the final output of all BCC rounds are truncated).
 392  *                      Therefore, add drbg_blocklen(drbg) to cover all
 393  *                      possibilities.
 394  */
 395
 396 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
 397 static int drbg_ctr_df(struct drbg_state *drbg,
 398                        unsigned char *df_data, size_t bytes_to_return,
 399                        struct list_head *seedlist)
 400 {
 401         int ret = -EFAULT;
 402         unsigned char L_N[8];
 403         /* S3 is input */
 404         struct drbg_string S1, S2, S4, cipherin;
 405         LIST_HEAD(bcc_list);
 406         unsigned char *pad = df_data + drbg_statelen(drbg);
 407         unsigned char *iv = pad + drbg_blocklen(drbg);
 408         unsigned char *temp = iv + drbg_blocklen(drbg);
 409         size_t padlen = 0;
 410         unsigned int templen = 0;
 411         /* 10.4.2 step 7 */
 412         unsigned int i = 0;
 413         /* 10.4.2 step 8 */
 414         const unsigned char *K = (unsigned char *)
 415                            "\x00\x01\x02\x03\x04\x05\x06\x07"
 416                            "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 417                            "\x10\x11\x12\x13\x14\x15\x16\x17"
 418                            "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
 419         unsigned char *X;
 420         size_t generated_len = 0;
 421         size_t inputlen = 0;
 422         struct drbg_string *seed = NULL;
 423
 424         memset(pad, 0, drbg_blocklen(drbg));
 425         memset(iv, 0, drbg_blocklen(drbg));
 426
 427         /* 10.4.2 step 1 is implicit as we work byte-wise */
 428
 429         /* 10.4.2 step 2 */
 430         if ((512/8) < bytes_to_return)
 431                 return -EINVAL;
 432
 433         /* 10.4.2 step 2 -- calculate the entire length of all input data */
 434         list_for_each_entry(seed, seedlist, list)
 435                 inputlen += seed->len;
 436         drbg_cpu_to_be32(inputlen, &L_N[0]);
 437
 438         /* 10.4.2 step 3 */
 439         drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
 440
 441         /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
 442         padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
 443         /* wrap the padlen appropriately */
 444         if (padlen)
 445                 padlen = drbg_blocklen(drbg) - padlen;
 446         /*
 447          * pad / padlen contains the 0x80 byte and the following zero bytes.
 448          * As the calculated padlen value only covers the number of zero
 449          * bytes, this value has to be incremented by one for the 0x80 byte.
 450          */
 451         padlen++;
 452         pad[0] = 0x80;
 453
 454         /* 10.4.2 step 4 -- first fill the linked list and then order it */
 455         drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
 456         list_add_tail(&S1.list, &bcc_list);
 457         drbg_string_fill(&S2, L_N, sizeof(L_N));
 458         list_add_tail(&S2.list, &bcc_list);
 459         list_splice_tail(seedlist, &bcc_list);
 460         drbg_string_fill(&S4, pad, padlen);
 461         list_add_tail(&S4.list, &bcc_list);
 462
 463         /* 10.4.2 step 9 */
 464         while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
 465                 /*
 466                  * 10.4.2 step 9.1 - the padding is implicit as the buffer
 467                  * holds zeros after allocation -- even the increment of i
 468                  * is irrelevant as the increment remains within length of i
 469                  */
 470                 drbg_cpu_to_be32(i, iv);
 471                 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
 472                 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
 473                 if (ret)
 474                         goto out;
 475                 /* 10.4.2 step 9.3 */
 476                 i++;
 477                 templen += drbg_blocklen(drbg);
 478         }
 479
 480         /* 10.4.2 step 11 */
 481         X = temp + (drbg_keylen(drbg));
 482         drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
 483
 484         /* 10.4.2 step 12: overwriting of outval is implemented in next step */
 485
 486         /* 10.4.2 step 13 */
 487         drbg_kcapi_symsetkey(drbg, temp);
 488         while (generated_len < bytes_to_return) {
 489                 short blocklen = 0;
 490                 /*
 491                  * 10.4.2 step 13.1: the truncation of the key length is
 492                  * implicit as the key is only drbg_blocklen in size based on
 493                  * the implementation of the cipher function callback
 494                  */
 495                 ret = drbg_kcapi_sym(drbg, X, &cipherin);
 496                 if (ret)
 497                         goto out;
 498                 blocklen = (drbg_blocklen(drbg) <
 499                                 (bytes_to_return - generated_len)) ?
 500                             drbg_blocklen(drbg) :
 501                                 (bytes_to_return - generated_len);
 502                 /* 10.4.2 step 13.2 and 14 */
 503                 memcpy(df_data + generated_len, X, blocklen);
 504                 generated_len += blocklen;
 505         }
 506
 507         ret = 0;
 508
 509 out:
 510         memset(iv, 0, drbg_blocklen(drbg));
 511         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 512         memset(pad, 0, drbg_blocklen(drbg));
 513         return ret;
 514 }
 515
 516 /*
 517  * update function of CTR DRBG as defined in 10.2.1.2
 518  *
 519  * The reseed variable has an enhanced meaning compared to the update
 520  * functions of the other DRBGs as follows:
 521  * 0 => initial seed from initialization
 522  * 1 => reseed via drbg_seed
 523  * 2 => first invocation from drbg_ctr_update when addtl is present. In
 524  *      this case, the df_data scratchpad is not deleted so that it is
 525  *      available for another calls to prevent calling the DF function
 526  *      again.
 527  * 3 => second invocation from drbg_ctr_update. When the update function
 528  *      was called with addtl, the df_data memory already contains the
 529  *      DFed addtl information and we do not need to call DF again.
 530  */
 531 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
 532                            int reseed)
 533 {
 534         int ret = -EFAULT;
 535         /* 10.2.1.2 step 1 */
 536         unsigned char *temp = drbg->scratchpad;
 537         unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
 538                                  drbg_blocklen(drbg);
 539
 540         if (3 > reseed)
 541                 memset(df_data, 0, drbg_statelen(drbg));
 542
 543         if (!reseed) {
 544                 /*
 545                  * The DRBG uses the CTR mode of the underlying AES cipher. The
 546                  * CTR mode increments the counter value after the AES operation
 547                  * but SP800-90A requires that the counter is incremented before
 548                  * the AES operation. Hence, we increment it at the time we set
 549                  * it by one.
 550                  */
 551                 crypto_inc(drbg->V, drbg_blocklen(drbg));
 552
 553                 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
 554                                              drbg_keylen(drbg));
 555                 if (ret)
 556                         goto out;
 557         }
 558
 559         /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
 560         if (seed) {
 561                 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
 562                 if (ret)
 563                         goto out;
 564         }
 565
 566         ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
 567                                  temp, drbg_statelen(drbg));
 568         if (ret)
 569                 return ret;
 570
 571         /* 10.2.1.2 step 5 */
 572         ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
 573                                      drbg_keylen(drbg));
 574         if (ret)
 575                 goto out;
 576         /* 10.2.1.2 step 6 */
 577         memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
 578         /* See above: increment counter by one to compensate timing of CTR op */
 579         crypto_inc(drbg->V, drbg_blocklen(drbg));
 580         ret = 0;
 581
 582 out:
 583         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 584         if (2 != reseed)
 585                 memset(df_data, 0, drbg_statelen(drbg));
 586         return ret;
 587 }
 588
 589 /*
 590  * scratchpad use: drbg_ctr_update is called independently from
 591  * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
 592  */
 593 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
 594 static int drbg_ctr_generate(struct drbg_state *drbg,
 595                              unsigned char *buf, unsigned int buflen,
 596                              struct list_head *addtl)
 597 {
 598         int ret;
 599         int len = min_t(int, buflen, INT_MAX);
 600
 601         /* 10.2.1.5.2 step 2 */
 602         if (addtl && !list_empty(addtl)) {
 603                 ret = drbg_ctr_update(drbg, addtl, 2);
 604                 if (ret)
 605                         return 0;
 606         }
 607
 608         /* 10.2.1.5.2 step 4.1 */
 609         ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len);
 610         if (ret)
 611                 return ret;
 612
 613         /* 10.2.1.5.2 step 6 */
 614         ret = drbg_ctr_update(drbg, NULL, 3);
 615         if (ret)
 616                 len = ret;
 617
 618         return len;
 619 }
 620
 621 static const struct drbg_state_ops drbg_ctr_ops = {
 622         .update         = drbg_ctr_update,
 623         .generate       = drbg_ctr_generate,
 624         .crypto_init    = drbg_init_sym_kernel,
 625         .crypto_fini    = drbg_fini_sym_kernel,
 626 };
 627 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 628
 629 /******************************************************************
 630  * HMAC DRBG callback functions
 631  ******************************************************************/
 632
 633 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
 634 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
 635                            const struct list_head *in);
 636 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
 637                                   const unsigned char *key);
 638 static int drbg_init_hash_kernel(struct drbg_state *drbg);
 639 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
 640 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
 641
 642 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 643 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
 644 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
 645 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
 646 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
 647 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
 648 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
 649 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
 650 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
 651 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
 652
 653 /* update function of HMAC DRBG as defined in 10.1.2.2 */
 654 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 655                             int reseed)
 656 {
 657         int ret = -EFAULT;
 658         int i = 0;
 659         struct drbg_string seed1, seed2, vdata;
 660         LIST_HEAD(seedlist);
 661         LIST_HEAD(vdatalist);
 662
 663         if (!reseed) {
 664                 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
 665                 memset(drbg->V, 1, drbg_statelen(drbg));
 666                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 667         }
 668
 669         drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
 670         list_add_tail(&seed1.list, &seedlist);
 671         /* buffer of seed2 will be filled in for loop below with one byte */
 672         drbg_string_fill(&seed2, NULL, 1);
 673         list_add_tail(&seed2.list, &seedlist);
 674         /* input data of seed is allowed to be NULL at this point */
 675         if (seed)
 676                 list_splice_tail(seed, &seedlist);
 677
 678         drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
 679         list_add_tail(&vdata.list, &vdatalist);
 680         for (i = 2; 0 < i; i--) {
 681                 /* first round uses 0x0, second 0x1 */
 682                 unsigned char prefix = DRBG_PREFIX0;
 683                 if (1 == i)
 684                         prefix = DRBG_PREFIX1;
 685                 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
 686                 seed2.buf = &prefix;
 687                 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
 688                 if (ret)
 689                         return ret;
 690                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 691
 692                 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
 693                 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
 694                 if (ret)
 695                         return ret;
 696
 697                 /* 10.1.2.2 step 3 */
 698                 if (!seed)
 699                         return ret;
 700         }
 701
 702         return 0;
 703 }
 704
 705 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
 706 static int drbg_hmac_generate(struct drbg_state *drbg,
 707                               unsigned char *buf,
 708                               unsigned int buflen,
 709                               struct list_head *addtl)
 710 {
 711         int len = 0;
 712         int ret = 0;
 713         struct drbg_string data;
 714         LIST_HEAD(datalist);
 715
 716         /* 10.1.2.5 step 2 */
 717         if (addtl && !list_empty(addtl)) {
 718                 ret = drbg_hmac_update(drbg, addtl, 1);
 719                 if (ret)
 720                         return ret;
 721         }
 722
 723         drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
 724         list_add_tail(&data.list, &datalist);
 725         while (len < buflen) {
 726                 unsigned int outlen = 0;
 727                 /* 10.1.2.5 step 4.1 */
 728                 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
 729                 if (ret)
 730                         return ret;
 731                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 732                           drbg_blocklen(drbg) : (buflen - len);
 733
 734                 /* 10.1.2.5 step 4.2 */
 735                 memcpy(buf + len, drbg->V, outlen);
 736                 len += outlen;
 737         }
 738
 739         /* 10.1.2.5 step 6 */
 740         if (addtl && !list_empty(addtl))
 741                 ret = drbg_hmac_update(drbg, addtl, 1);
 742         else
 743                 ret = drbg_hmac_update(drbg, NULL, 1);
 744         if (ret)
 745                 return ret;
 746
 747         return len;
 748 }
 749
 750 static const struct drbg_state_ops drbg_hmac_ops = {
 751         .update         = drbg_hmac_update,
 752         .generate       = drbg_hmac_generate,
 753         .crypto_init    = drbg_init_hash_kernel,
 754         .crypto_fini    = drbg_fini_hash_kernel,
 755 };
 756 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 757
 758 /******************************************************************
 759  * Hash DRBG callback functions
 760  ******************************************************************/
 761
 762 #ifdef CONFIG_CRYPTO_DRBG_HASH
 763 #define CRYPTO_DRBG_HASH_STRING "HASH "
 764 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
 765 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
 766 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
 767 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
 768 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
 769 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
 770 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
 771 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
 772
 773 /*
 774  * Increment buffer
 775  *
 776  * @dst buffer to increment
 777  * @add value to add
 778  */
 779 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
 780                                 const unsigned char *add, size_t addlen)
 781 {
 782         /* implied: dstlen > addlen */
 783         unsigned char *dstptr;
 784         const unsigned char *addptr;
 785         unsigned int remainder = 0;
 786         size_t len = addlen;
 787
 788         dstptr = dst + (dstlen-1);
 789         addptr = add + (addlen-1);
 790         while (len) {
 791                 remainder += *dstptr + *addptr;
 792                 *dstptr = remainder & 0xff;
 793                 remainder >>= 8;
 794                 len--; dstptr--; addptr--;
 795         }
 796         len = dstlen - addlen;
 797         while (len && remainder > 0) {
 798                 remainder = *dstptr + 1;
 799                 *dstptr = remainder & 0xff;
 800                 remainder >>= 8;
 801                 len--; dstptr--;
 802         }
 803 }
 804
 805 /*
 806  * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
 807  * interlinked, the scratchpad is used as follows:
 808  * drbg_hash_update
 809  *      start: drbg->scratchpad
 810  *      length: drbg_statelen(drbg)
 811  * drbg_hash_df:
 812  *      start: drbg->scratchpad + drbg_statelen(drbg)
 813  *      length: drbg_blocklen(drbg)
 814  *
 815  * drbg_hash_process_addtl uses the scratchpad, but fully completes
 816  * before either of the functions mentioned before are invoked. Therefore,
 817  * drbg_hash_process_addtl does not need to be specifically considered.
 818  */
 819
 820 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
 821 static int drbg_hash_df(struct drbg_state *drbg,
 822                         unsigned char *outval, size_t outlen,
 823                         struct list_head *entropylist)
 824 {
 825         int ret = 0;
 826         size_t len = 0;
 827         unsigned char input[5];
 828         unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
 829         struct drbg_string data;
 830
 831         /* 10.4.1 step 3 */
 832         input[0] = 1;
 833         drbg_cpu_to_be32((outlen * 8), &input[1]);
 834
 835         /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
 836         drbg_string_fill(&data, input, 5);
 837         list_add(&data.list, entropylist);
 838
 839         /* 10.4.1 step 4 */
 840         while (len < outlen) {
 841                 short blocklen = 0;
 842                 /* 10.4.1 step 4.1 */
 843                 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
 844                 if (ret)
 845                         goto out;
 846                 /* 10.4.1 step 4.2 */
 847                 input[0]++;
 848                 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
 849                             drbg_blocklen(drbg) : (outlen - len);
 850                 memcpy(outval + len, tmp, blocklen);
 851                 len += blocklen;
 852         }
 853
 854 out:
 855         memset(tmp, 0, drbg_blocklen(drbg));
 856         return ret;
 857 }
 858
 859 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
 860 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
 861                             int reseed)
 862 {
 863         int ret = 0;
 864         struct drbg_string data1, data2;
 865         LIST_HEAD(datalist);
 866         LIST_HEAD(datalist2);
 867         unsigned char *V = drbg->scratchpad;
 868         unsigned char prefix = DRBG_PREFIX1;
 869
 870         if (!seed)
 871                 return -EINVAL;
 872
 873         if (reseed) {
 874                 /* 10.1.1.3 step 1 */
 875                 memcpy(V, drbg->V, drbg_statelen(drbg));
 876                 drbg_string_fill(&data1, &prefix, 1);
 877                 list_add_tail(&data1.list, &datalist);
 878                 drbg_string_fill(&data2, V, drbg_statelen(drbg));
 879                 list_add_tail(&data2.list, &datalist);
 880         }
 881         list_splice_tail(seed, &datalist);
 882
 883         /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
 884         ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
 885         if (ret)
 886                 goto out;
 887
 888         /* 10.1.1.2 / 10.1.1.3 step 4  */
 889         prefix = DRBG_PREFIX0;
 890         drbg_string_fill(&data1, &prefix, 1);
 891         list_add_tail(&data1.list, &datalist2);
 892         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 893         list_add_tail(&data2.list, &datalist2);
 894         /* 10.1.1.2 / 10.1.1.3 step 4 */
 895         ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 896
 897 out:
 898         memset(drbg->scratchpad, 0, drbg_statelen(drbg));
 899         return ret;
 900 }
 901
 902 /* processing of additional information string for Hash DRBG */
 903 static int drbg_hash_process_addtl(struct drbg_state *drbg,
 904                                    struct list_head *addtl)
 905 {
 906         int ret = 0;
 907         struct drbg_string data1, data2;
 908         LIST_HEAD(datalist);
 909         unsigned char prefix = DRBG_PREFIX2;
 910
 911         /* 10.1.1.4 step 2 */
 912         if (!addtl || list_empty(addtl))
 913                 return 0;
 914
 915         /* 10.1.1.4 step 2a */
 916         drbg_string_fill(&data1, &prefix, 1);
 917         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 918         list_add_tail(&data1.list, &datalist);
 919         list_add_tail(&data2.list, &datalist);
 920         list_splice_tail(addtl, &datalist);
 921         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 922         if (ret)
 923                 goto out;
 924
 925         /* 10.1.1.4 step 2b */
 926         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 927                      drbg->scratchpad, drbg_blocklen(drbg));
 928
 929 out:
 930         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 931         return ret;
 932 }
 933
 934 /* Hashgen defined in 10.1.1.4 */
 935 static int drbg_hash_hashgen(struct drbg_state *drbg,
 936                              unsigned char *buf,
 937                              unsigned int buflen)
 938 {
 939         int len = 0;
 940         int ret = 0;
 941         unsigned char *src = drbg->scratchpad;
 942         unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
 943         struct drbg_string data;
 944         LIST_HEAD(datalist);
 945
 946         /* 10.1.1.4 step hashgen 2 */
 947         memcpy(src, drbg->V, drbg_statelen(drbg));
 948
 949         drbg_string_fill(&data, src, drbg_statelen(drbg));
 950         list_add_tail(&data.list, &datalist);
 951         while (len < buflen) {
 952                 unsigned int outlen = 0;
 953                 /* 10.1.1.4 step hashgen 4.1 */
 954                 ret = drbg_kcapi_hash(drbg, dst, &datalist);
 955                 if (ret) {
 956                         len = ret;
 957                         goto out;
 958                 }
 959                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 960                           drbg_blocklen(drbg) : (buflen - len);
 961                 /* 10.1.1.4 step hashgen 4.2 */
 962                 memcpy(buf + len, dst, outlen);
 963                 len += outlen;
 964                 /* 10.1.1.4 hashgen step 4.3 */
 965                 if (len < buflen)
 966                         crypto_inc(src, drbg_statelen(drbg));
 967         }
 968
 969 out:
 970         memset(drbg->scratchpad, 0,
 971                (drbg_statelen(drbg) + drbg_blocklen(drbg)));
 972         return len;
 973 }
 974
 975 /* generate function for Hash DRBG as defined in  10.1.1.4 */
 976 static int drbg_hash_generate(struct drbg_state *drbg,
 977                               unsigned char *buf, unsigned int buflen,
 978                               struct list_head *addtl)
 979 {
 980         int len = 0;
 981         int ret = 0;
 982         union {
 983                 unsigned char req[8];
 984                 __be64 req_int;
 985         } u;
 986         unsigned char prefix = DRBG_PREFIX3;
 987         struct drbg_string data1, data2;
 988         LIST_HEAD(datalist);
 989
 990         /* 10.1.1.4 step 2 */
 991         ret = drbg_hash_process_addtl(drbg, addtl);
 992         if (ret)
 993                 return ret;
 994         /* 10.1.1.4 step 3 */
 995         len = drbg_hash_hashgen(drbg, buf, buflen);
 996
 997         /* this is the value H as documented in 10.1.1.4 */
 998         /* 10.1.1.4 step 4 */
 999         drbg_string_fill(&data1, &prefix, 1);
1000         list_add_tail(&data1.list, &datalist);
1001         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
1002         list_add_tail(&data2.list, &datalist);
1003         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
1004         if (ret) {
1005                 len = ret;
1006                 goto out;
1007         }
1008
1009         /* 10.1.1.4 step 5 */
1010         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1011                      drbg->scratchpad, drbg_blocklen(drbg));
1012         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1013                      drbg->C, drbg_statelen(drbg));
1014         u.req_int = cpu_to_be64(drbg->reseed_ctr);
1015         drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1016
1017 out:
1018         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1019         return len;
1020 }
1021
1022 /*
1023  * scratchpad usage: as update and generate are used isolated, both
1024  * can use the scratchpad
1025  */
1026 static const struct drbg_state_ops drbg_hash_ops = {
1027         .update         = drbg_hash_update,
1028         .generate       = drbg_hash_generate,
1029         .crypto_init    = drbg_init_hash_kernel,
1030         .crypto_fini    = drbg_fini_hash_kernel,
1031 };
1032 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1033
1034 /******************************************************************
1035  * Functions common for DRBG implementations
1036  ******************************************************************/
1037
1038 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1039                               int reseed, enum drbg_seed_state new_seed_state)
1040 {
1041         int ret = drbg->d_ops->update(drbg, seed, reseed);
1042
1043         if (ret)
1044                 return ret;
1045
1046         drbg->seeded = new_seed_state;
1047         /* 10.1.1.2 / 10.1.1.3 step 5 */
1048         drbg->reseed_ctr = 1;
1049
1050         switch (drbg->seeded) {
1051         case DRBG_SEED_STATE_UNSEEDED:
1052                 /* Impossible, but handle it to silence compiler warnings. */
1053                 fallthrough;
1054         case DRBG_SEED_STATE_PARTIAL:
1055                 /*
1056                  * Require frequent reseeds until the seed source is
1057                  * fully initialized.
1058                  */
1059                 drbg->reseed_threshold = 50;
1060                 break;
1061
1062         case DRBG_SEED_STATE_FULL:
1063                 /*
1064                  * Seed source has become fully initialized, frequent
1065                  * reseeds no longer required.
1066                  */
1067                 drbg->reseed_threshold = drbg_max_requests(drbg);
1068                 break;
1069         }
1070
1071         return ret;
1072 }
1073
1074 static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1075                                         unsigned char *entropy,
1076                                         unsigned int entropylen)
1077 {
1078         int ret;
1079
1080         do {
1081                 get_random_bytes(entropy, entropylen);
1082                 ret = drbg_fips_continuous_test(drbg, entropy);
1083                 if (ret && ret != -EAGAIN)
1084                         return ret;
1085         } while (ret);
1086
1087         return 0;
1088 }
1089
1090 static int drbg_seed_from_random(struct drbg_state *drbg)
1091 {
1092         struct drbg_string data;
1093         LIST_HEAD(seedlist);
1094         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1095         unsigned char entropy[32];
1096         int ret;
1097
1098         BUG_ON(!entropylen);
1099         BUG_ON(entropylen > sizeof(entropy));
1100
1101         drbg_string_fill(&data, entropy, entropylen);
1102         list_add_tail(&data.list, &seedlist);
1103
1104         ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1105         if (ret)
1106                 goto out;
1107
1108         ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
1109
1110 out:
1111         memzero_explicit(entropy, entropylen);
1112         return ret;
1113 }
1114
1115 /*
1116  * Seeding or reseeding of the DRBG
1117  *
1118  * @drbg: DRBG state struct
1119  * @pers: personalization / additional information buffer
1120  * @reseed: 0 for initial seed process, 1 for reseeding
1121  *
1122  * return:
1123  *      0 on success
1124  *      error value otherwise
1125  */
1126 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1127                      bool reseed)
1128 {
1129         int ret;
1130         unsigned char entropy[((32 + 16) * 2)];
1131         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1132         struct drbg_string data1;
1133         LIST_HEAD(seedlist);
1134         enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
1135
1136         /* 9.1 / 9.2 / 9.3.1 step 3 */
1137         if (pers && pers->len > (drbg_max_addtl(drbg))) {
1138                 pr_devel("DRBG: personalization string too long %zu\n",
1139                          pers->len);
1140                 return -EINVAL;
1141         }
1142
1143         if (list_empty(&drbg->test_data.list)) {
1144                 drbg_string_fill(&data1, drbg->test_data.buf,
1145                                  drbg->test_data.len);
1146                 pr_devel("DRBG: using test entropy\n");
1147         } else {
1148                 /*
1149                  * Gather entropy equal to the security strength of the DRBG.
1150                  * With a derivation function, a nonce is required in addition
1151                  * to the entropy. A nonce must be at least 1/2 of the security
1152                  * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1153                  * of the strength. The consideration of a nonce is only
1154                  * applicable during initial seeding.
1155                  */
1156                 BUG_ON(!entropylen);
1157                 if (!reseed)
1158                         entropylen = ((entropylen + 1) / 2) * 3;
1159                 BUG_ON((entropylen * 2) > sizeof(entropy));
1160
1161                 /* Get seed from in-kernel /dev/urandom */
1162                 if (!rng_is_initialized())
1163                         new_seed_state = DRBG_SEED_STATE_PARTIAL;
1164
1165                 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1166                 if (ret)
1167                         goto out;
1168
1169                 if (!drbg->jent) {
1170                         drbg_string_fill(&data1, entropy, entropylen);
1171                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1172                                  entropylen);
1173                 } else {
1174                         /* Get seed from Jitter RNG */
1175                         ret = crypto_rng_get_bytes(drbg->jent,
1176                                                    entropy + entropylen,
1177                                                    entropylen);
1178                         if (ret) {
1179                                 pr_devel("DRBG: jent failed with %d\n", ret);
1180
1181                                 /*
1182                                  * Do not treat the transient failure of the
1183                                  * Jitter RNG as an error that needs to be
1184                                  * reported. The combined number of the
1185                                  * maximum reseed threshold times the maximum
1186                                  * number of Jitter RNG transient errors is
1187                                  * less than the reseed threshold required by
1188                                  * SP800-90A allowing us to treat the
1189                                  * transient errors as such.
1190                                  *
1191                                  * However, we mandate that at least the first
1192                                  * seeding operation must succeed with the
1193                                  * Jitter RNG.
1194                                  */
1195                                 if (!reseed || ret != -EAGAIN)
1196                                         goto out;
1197                         }
1198
1199                         drbg_string_fill(&data1, entropy, entropylen * 2);
1200                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1201                                  entropylen * 2);
1202                 }
1203         }
1204         list_add_tail(&data1.list, &seedlist);
1205
1206         /*
1207          * concatenation of entropy with personalization str / addtl input)
1208          * the variable pers is directly handed in by the caller, so check its
1209          * contents whether it is appropriate
1210          */
1211         if (pers && pers->buf && 0 < pers->len) {
1212                 list_add_tail(&pers->list, &seedlist);
1213                 pr_devel("DRBG: using personalization string\n");
1214         }
1215
1216         if (!reseed) {
1217                 memset(drbg->V, 0, drbg_statelen(drbg));
1218                 memset(drbg->C, 0, drbg_statelen(drbg));
1219         }
1220
1221         ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
1222
1223 out:
1224         memzero_explicit(entropy, entropylen * 2);
1225
1226         return ret;
1227 }
1228
1229 /* Free all substructures in a DRBG state without the DRBG state structure */
1230 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1231 {
1232         if (!drbg)
1233                 return;
1234         kfree_sensitive(drbg->Vbuf);
1235         drbg->Vbuf = NULL;
1236         drbg->V = NULL;
1237         kfree_sensitive(drbg->Cbuf);
1238         drbg->Cbuf = NULL;
1239         drbg->C = NULL;
1240         kfree_sensitive(drbg->scratchpadbuf);
1241         drbg->scratchpadbuf = NULL;
1242         drbg->reseed_ctr = 0;
1243         drbg->d_ops = NULL;
1244         drbg->core = NULL;
1245         if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1246                 kfree_sensitive(drbg->prev);
1247                 drbg->prev = NULL;
1248                 drbg->fips_primed = false;
1249         }
1250 }
1251
1252 /*
1253  * Allocate all sub-structures for a DRBG state.
1254  * The DRBG state structure must already be allocated.
1255  */
1256 static inline int drbg_alloc_state(struct drbg_state *drbg)
1257 {
1258         int ret = -ENOMEM;
1259         unsigned int sb_size = 0;
1260
1261         switch (drbg->core->flags & DRBG_TYPE_MASK) {
1262 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1263         case DRBG_HMAC:
1264                 drbg->d_ops = &drbg_hmac_ops;
1265                 break;
1266 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1267 #ifdef CONFIG_CRYPTO_DRBG_HASH
1268         case DRBG_HASH:
1269                 drbg->d_ops = &drbg_hash_ops;
1270                 break;
1271 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1272 #ifdef CONFIG_CRYPTO_DRBG_CTR
1273         case DRBG_CTR:
1274                 drbg->d_ops = &drbg_ctr_ops;
1275                 break;
1276 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1277         default:
1278                 ret = -EOPNOTSUPP;
1279                 goto err;
1280         }
1281
1282         ret = drbg->d_ops->crypto_init(drbg);
1283         if (ret < 0)
1284                 goto err;
1285
1286         drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1287         if (!drbg->Vbuf) {
1288                 ret = -ENOMEM;
1289                 goto fini;
1290         }
1291         drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1292         drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1293         if (!drbg->Cbuf) {
1294                 ret = -ENOMEM;
1295                 goto fini;
1296         }
1297         drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1298         /* scratchpad is only generated for CTR and Hash */
1299         if (drbg->core->flags & DRBG_HMAC)
1300                 sb_size = 0;
1301         else if (drbg->core->flags & DRBG_CTR)
1302                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1303                           drbg_statelen(drbg) + /* df_data */
1304                           drbg_blocklen(drbg) + /* pad */
1305                           drbg_blocklen(drbg) + /* iv */
1306                           drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1307         else
1308                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1309
1310         if (0 < sb_size) {
1311                 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1312                 if (!drbg->scratchpadbuf) {
1313                         ret = -ENOMEM;
1314                         goto fini;
1315                 }
1316                 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1317         }
1318
1319         if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1320                 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1321                                      GFP_KERNEL);
1322                 if (!drbg->prev) {
1323                         ret = -ENOMEM;
1324                         goto fini;
1325                 }
1326                 drbg->fips_primed = false;
1327         }
1328
1329         return 0;
1330
1331 fini:
1332         drbg->d_ops->crypto_fini(drbg);
1333 err:
1334         drbg_dealloc_state(drbg);
1335         return ret;
1336 }
1337
1338 /*************************************************************************
1339  * DRBG interface functions
1340  *************************************************************************/
1341
1342 /*
1343  * DRBG generate function as required by SP800-90A - this function
1344  * generates random numbers
1345  *
1346  * @drbg DRBG state handle
1347  * @buf Buffer where to store the random numbers -- the buffer must already
1348  *      be pre-allocated by caller
1349  * @buflen Length of output buffer - this value defines the number of random
1350  *         bytes pulled from DRBG
1351  * @addtl Additional input that is mixed into state, may be NULL -- note
1352  *        the entropy is pulled by the DRBG internally unconditionally
1353  *        as defined in SP800-90A. The additional input is mixed into
1354  *        the state in addition to the pulled entropy.
1355  *
1356  * return: 0 when all bytes are generated; < 0 in case of an error
1357  */
1358 static int drbg_generate(struct drbg_state *drbg,
1359                          unsigned char *buf, unsigned int buflen,
1360                          struct drbg_string *addtl)
1361 {
1362         int len = 0;
1363         LIST_HEAD(addtllist);
1364
1365         if (!drbg->core) {
1366                 pr_devel("DRBG: not yet seeded\n");
1367                 return -EINVAL;
1368         }
1369         if (0 == buflen || !buf) {
1370                 pr_devel("DRBG: no output buffer provided\n");
1371                 return -EINVAL;
1372         }
1373         if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1374                 pr_devel("DRBG: wrong format of additional information\n");
1375                 return -EINVAL;
1376         }
1377
1378         /* 9.3.1 step 2 */
1379         len = -EINVAL;
1380         if (buflen > (drbg_max_request_bytes(drbg))) {
1381                 pr_devel("DRBG: requested random numbers too large %u\n",
1382                          buflen);
1383                 goto err;
1384         }
1385
1386         /* 9.3.1 step 3 is implicit with the chosen DRBG */
1387
1388         /* 9.3.1 step 4 */
1389         if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1390                 pr_devel("DRBG: additional information string too long %zu\n",
1391                          addtl->len);
1392                 goto err;
1393         }
1394         /* 9.3.1 step 5 is implicit with the chosen DRBG */
1395
1396         /*
1397          * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1398          * here. The spec is a bit convoluted here, we make it simpler.
1399          */
1400         if (drbg->reseed_threshold < drbg->reseed_ctr)
1401                 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1402
1403         if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
1404                 pr_devel("DRBG: reseeding before generation (prediction "
1405                          "resistance: %s, state %s)\n",
1406                          drbg->pr ? "true" : "false",
1407                          (drbg->seeded ==  DRBG_SEED_STATE_FULL ?
1408                           "seeded" : "unseeded"));
1409                 /* 9.3.1 steps 7.1 through 7.3 */
1410                 len = drbg_seed(drbg, addtl, true);
1411                 if (len)
1412                         goto err;
1413                 /* 9.3.1 step 7.4 */
1414                 addtl = NULL;
1415         } else if (rng_is_initialized() &&
1416                    drbg->seeded == DRBG_SEED_STATE_PARTIAL) {
1417                 len = drbg_seed_from_random(drbg);
1418                 if (len)
1419                         goto err;
1420         }
1421
1422         if (addtl && 0 < addtl->len)
1423                 list_add_tail(&addtl->list, &addtllist);
1424         /* 9.3.1 step 8 and 10 */
1425         len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1426
1427         /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1428         drbg->reseed_ctr++;
1429         if (0 >= len)
1430                 goto err;
1431
1432         /*
1433          * Section 11.3.3 requires to re-perform self tests after some
1434          * generated random numbers. The chosen value after which self
1435          * test is performed is arbitrary, but it should be reasonable.
1436          * However, we do not perform the self tests because of the following
1437          * reasons: it is mathematically impossible that the initial self tests
1438          * were successfully and the following are not. If the initial would
1439          * pass and the following would not, the kernel integrity is violated.
1440          * In this case, the entire kernel operation is questionable and it
1441          * is unlikely that the integrity violation only affects the
1442          * correct operation of the DRBG.
1443          *
1444          * Albeit the following code is commented out, it is provided in
1445          * case somebody has a need to implement the test of 11.3.3.
1446          */
1447 #if 0
1448         if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1449                 int err = 0;
1450                 pr_devel("DRBG: start to perform self test\n");
1451                 if (drbg->core->flags & DRBG_HMAC)
1452                         err = alg_test("drbg_pr_hmac_sha256",
1453                                        "drbg_pr_hmac_sha256", 0, 0);
1454                 else if (drbg->core->flags & DRBG_CTR)
1455                         err = alg_test("drbg_pr_ctr_aes128",
1456                                        "drbg_pr_ctr_aes128", 0, 0);
1457                 else
1458                         err = alg_test("drbg_pr_sha256",
1459                                        "drbg_pr_sha256", 0, 0);
1460                 if (err) {
1461                         pr_err("DRBG: periodical self test failed\n");
1462                         /*
1463                          * uninstantiate implies that from now on, only errors
1464                          * are returned when reusing this DRBG cipher handle
1465                          */
1466                         drbg_uninstantiate(drbg);
1467                         return 0;
1468                 } else {
1469                         pr_devel("DRBG: self test successful\n");
1470                 }
1471         }
1472 #endif
1473
1474         /*
1475          * All operations were successful, return 0 as mandated by
1476          * the kernel crypto API interface.
1477          */
1478         len = 0;
1479 err:
1480         return len;
1481 }
1482
1483 /*
1484  * Wrapper around drbg_generate which can pull arbitrary long strings
1485  * from the DRBG without hitting the maximum request limitation.
1486  *
1487  * Parameters: see drbg_generate
1488  * Return codes: see drbg_generate -- if one drbg_generate request fails,
1489  *               the entire drbg_generate_long request fails
1490  */
1491 static int drbg_generate_long(struct drbg_state *drbg,
1492                               unsigned char *buf, unsigned int buflen,
1493                               struct drbg_string *addtl)
1494 {
1495         unsigned int len = 0;
1496         unsigned int slice = 0;
1497         do {
1498                 int err = 0;
1499                 unsigned int chunk = 0;
1500                 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1501                 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1502                 mutex_lock(&drbg->drbg_mutex);
1503                 err = drbg_generate(drbg, buf + len, chunk, addtl);
1504                 mutex_unlock(&drbg->drbg_mutex);
1505                 if (0 > err)
1506                         return err;
1507                 len += chunk;
1508         } while (slice > 0 && (len < buflen));
1509         return 0;
1510 }
1511
1512 static int drbg_prepare_hrng(struct drbg_state *drbg)
1513 {
1514         /* We do not need an HRNG in test mode. */
1515         if (list_empty(&drbg->test_data.list))
1516                 return 0;
1517
1518         drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1519
1520         return 0;
1521 }
1522
1523 /*
1524  * DRBG instantiation function as required by SP800-90A - this function
1525  * sets up the DRBG handle, performs the initial seeding and all sanity
1526  * checks required by SP800-90A
1527  *
1528  * @drbg memory of state -- if NULL, new memory is allocated
1529  * @pers Personalization string that is mixed into state, may be NULL -- note
1530  *       the entropy is pulled by the DRBG internally unconditionally
1531  *       as defined in SP800-90A. The additional input is mixed into
1532  *       the state in addition to the pulled entropy.
1533  * @coreref reference to core
1534  * @pr prediction resistance enabled
1535  *
1536  * return
1537  *      0 on success
1538  *      error value otherwise
1539  */
1540 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1541                             int coreref, bool pr)
1542 {
1543         int ret;
1544         bool reseed = true;
1545
1546         pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1547                  "%s\n", coreref, pr ? "enabled" : "disabled");
1548         mutex_lock(&drbg->drbg_mutex);
1549
1550         /* 9.1 step 1 is implicit with the selected DRBG type */
1551
1552         /*
1553          * 9.1 step 2 is implicit as caller can select prediction resistance
1554          * and the flag is copied into drbg->flags --
1555          * all DRBG types support prediction resistance
1556          */
1557
1558         /* 9.1 step 4 is implicit in  drbg_sec_strength */
1559
1560         if (!drbg->core) {
1561                 drbg->core = &drbg_cores[coreref];
1562                 drbg->pr = pr;
1563                 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1564                 drbg->reseed_threshold = drbg_max_requests(drbg);
1565
1566                 ret = drbg_alloc_state(drbg);
1567                 if (ret)
1568                         goto unlock;
1569
1570                 ret = drbg_prepare_hrng(drbg);
1571                 if (ret)
1572                         goto free_everything;
1573
1574                 if (IS_ERR(drbg->jent)) {
1575                         ret = PTR_ERR(drbg->jent);
1576                         drbg->jent = NULL;
1577                         if (fips_enabled || ret != -ENOENT)
1578                                 goto free_everything;
1579                         pr_info("DRBG: Continuing without Jitter RNG\n");
1580                 }
1581
1582                 reseed = false;
1583         }
1584
1585         ret = drbg_seed(drbg, pers, reseed);
1586
1587         if (ret && !reseed)
1588                 goto free_everything;
1589
1590         mutex_unlock(&drbg->drbg_mutex);
1591         return ret;
1592
1593 unlock:
1594         mutex_unlock(&drbg->drbg_mutex);
1595         return ret;
1596
1597 free_everything:
1598         mutex_unlock(&drbg->drbg_mutex);
1599         drbg_uninstantiate(drbg);
1600         return ret;
1601 }
1602
1603 /*
1604  * DRBG uninstantiate function as required by SP800-90A - this function
1605  * frees all buffers and the DRBG handle
1606  *
1607  * @drbg DRBG state handle
1608  *
1609  * return
1610  *      0 on success
1611  */
1612 static int drbg_uninstantiate(struct drbg_state *drbg)
1613 {
1614         if (!IS_ERR_OR_NULL(drbg->jent))
1615                 crypto_free_rng(drbg->jent);
1616         drbg->jent = NULL;
1617
1618         if (drbg->d_ops)
1619                 drbg->d_ops->crypto_fini(drbg);
1620         drbg_dealloc_state(drbg);
1621         /* no scrubbing of test_data -- this shall survive an uninstantiate */
1622         return 0;
1623 }
1624
1625 /*
1626  * Helper function for setting the test data in the DRBG
1627  *
1628  * @drbg DRBG state handle
1629  * @data test data
1630  * @len test data length
1631  */
1632 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1633                                    const u8 *data, unsigned int len)
1634 {
1635         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1636
1637         mutex_lock(&drbg->drbg_mutex);
1638         drbg_string_fill(&drbg->test_data, data, len);
1639         mutex_unlock(&drbg->drbg_mutex);
1640 }
1641
1642 /***************************************************************
1643  * Kernel crypto API cipher invocations requested by DRBG
1644  ***************************************************************/
1645
1646 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1647 struct sdesc {
1648         struct shash_desc shash;
1649         char ctx[];
1650 };
1651
1652 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1653 {
1654         struct sdesc *sdesc;
1655         struct crypto_shash *tfm;
1656
1657         tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1658         if (IS_ERR(tfm)) {
1659                 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1660                                 drbg->core->backend_cra_name);
1661                 return PTR_ERR(tfm);
1662         }
1663         BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1664         sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1665                         GFP_KERNEL);
1666         if (!sdesc) {
1667                 crypto_free_shash(tfm);
1668                 return -ENOMEM;
1669         }
1670
1671         sdesc->shash.tfm = tfm;
1672         drbg->priv_data = sdesc;
1673
1674         return crypto_shash_alignmask(tfm);
1675 }
1676
1677 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1678 {
1679         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1680         if (sdesc) {
1681                 crypto_free_shash(sdesc->shash.tfm);
1682                 kfree_sensitive(sdesc);
1683         }
1684         drbg->priv_data = NULL;
1685         return 0;
1686 }
1687
1688 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1689                                   const unsigned char *key)
1690 {
1691         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1692
1693         crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1694 }
1695
1696 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1697                            const struct list_head *in)
1698 {
1699         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1700         struct drbg_string *input = NULL;
1701
1702         crypto_shash_init(&sdesc->shash);
1703         list_for_each_entry(input, in, list)
1704                 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1705         return crypto_shash_final(&sdesc->shash, outval);
1706 }
1707 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1708
1709 #ifdef CONFIG_CRYPTO_DRBG_CTR
1710 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1711 {
1712         struct crypto_cipher *tfm =
1713                 (struct crypto_cipher *)drbg->priv_data;
1714         if (tfm)
1715                 crypto_free_cipher(tfm);
1716         drbg->priv_data = NULL;
1717
1718         if (drbg->ctr_handle)
1719                 crypto_free_skcipher(drbg->ctr_handle);
1720         drbg->ctr_handle = NULL;
1721
1722         if (drbg->ctr_req)
1723                 skcipher_request_free(drbg->ctr_req);
1724         drbg->ctr_req = NULL;
1725
1726         kfree(drbg->outscratchpadbuf);
1727         drbg->outscratchpadbuf = NULL;
1728
1729         return 0;
1730 }
1731
1732 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1733 {
1734         struct crypto_cipher *tfm;
1735         struct crypto_skcipher *sk_tfm;
1736         struct skcipher_request *req;
1737         unsigned int alignmask;
1738         char ctr_name[CRYPTO_MAX_ALG_NAME];
1739
1740         tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1741         if (IS_ERR(tfm)) {
1742                 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1743                                 drbg->core->backend_cra_name);
1744                 return PTR_ERR(tfm);
1745         }
1746         BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1747         drbg->priv_data = tfm;
1748
1749         if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1750             drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1751                 drbg_fini_sym_kernel(drbg);
1752                 return -EINVAL;
1753         }
1754         sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1755         if (IS_ERR(sk_tfm)) {
1756                 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1757                                 ctr_name);
1758                 drbg_fini_sym_kernel(drbg);
1759                 return PTR_ERR(sk_tfm);
1760         }
1761         drbg->ctr_handle = sk_tfm;
1762         crypto_init_wait(&drbg->ctr_wait);
1763
1764         req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1765         if (!req) {
1766                 pr_info("DRBG: could not allocate request queue\n");
1767                 drbg_fini_sym_kernel(drbg);
1768                 return -ENOMEM;
1769         }
1770         drbg->ctr_req = req;
1771         skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
1772                                                 CRYPTO_TFM_REQ_MAY_SLEEP,
1773                                         crypto_req_done, &drbg->ctr_wait);
1774
1775         alignmask = crypto_skcipher_alignmask(sk_tfm);
1776         drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1777                                          GFP_KERNEL);
1778         if (!drbg->outscratchpadbuf) {
1779                 drbg_fini_sym_kernel(drbg);
1780                 return -ENOMEM;
1781         }
1782         drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1783                                               alignmask + 1);
1784
1785         sg_init_table(&drbg->sg_in, 1);
1786         sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1787
1788         return alignmask;
1789 }
1790
1791 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1792                                  const unsigned char *key)
1793 {
1794         struct crypto_cipher *tfm =
1795                 (struct crypto_cipher *)drbg->priv_data;
1796
1797         crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1798 }
1799
1800 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1801                           const struct drbg_string *in)
1802 {
1803         struct crypto_cipher *tfm =
1804                 (struct crypto_cipher *)drbg->priv_data;
1805
1806         /* there is only component in *in */
1807         BUG_ON(in->len < drbg_blocklen(drbg));
1808         crypto_cipher_encrypt_one(tfm, outval, in->buf);
1809         return 0;
1810 }
1811
1812 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1813                               u8 *inbuf, u32 inlen,
1814                               u8 *outbuf, u32 outlen)
1815 {
1816         struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out;
1817         u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN);
1818         int ret;
1819
1820         if (inbuf) {
1821                 /* Use caller-provided input buffer */
1822                 sg_set_buf(sg_in, inbuf, inlen);
1823         } else {
1824                 /* Use scratchpad for in-place operation */
1825                 inlen = scratchpad_use;
1826                 memset(drbg->outscratchpad, 0, scratchpad_use);
1827                 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
1828         }
1829
1830         while (outlen) {
1831                 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1832
1833                 /* Output buffer may not be valid for SGL, use scratchpad */
1834                 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out,
1835                                            cryptlen, drbg->V);
1836                 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req),
1837                                         &drbg->ctr_wait);
1838                 if (ret)
1839                         goto out;
1840
1841                 crypto_init_wait(&drbg->ctr_wait);
1842
1843                 memcpy(outbuf, drbg->outscratchpad, cryptlen);
1844                 memzero_explicit(drbg->outscratchpad, cryptlen);
1845
1846                 outlen -= cryptlen;
1847                 outbuf += cryptlen;
1848         }
1849         ret = 0;
1850
1851 out:
1852         return ret;
1853 }
1854 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1855
1856 /***************************************************************
1857  * Kernel crypto API interface to register DRBG
1858  ***************************************************************/
1859
1860 /*
1861  * Look up the DRBG flags by given kernel crypto API cra_name
1862  * The code uses the drbg_cores definition to do this
1863  *
1864  * @cra_name kernel crypto API cra_name
1865  * @coreref reference to integer which is filled with the pointer to
1866  *  the applicable core
1867  * @pr reference for setting prediction resistance
1868  *
1869  * return: flags
1870  */
1871 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1872                                          int *coreref, bool *pr)
1873 {
1874         int i = 0;
1875         size_t start = 0;
1876         int len = 0;
1877
1878         *pr = true;
1879         /* disassemble the names */
1880         if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1881                 start = 10;
1882                 *pr = false;
1883         } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1884                 start = 8;
1885         } else {
1886                 return;
1887         }
1888
1889         /* remove the first part */
1890         len = strlen(cra_driver_name) - start;
1891         for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1892                 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1893                             len)) {
1894                         *coreref = i;
1895                         return;
1896                 }
1897         }
1898 }
1899
1900 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1901 {
1902         struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1903
1904         mutex_init(&drbg->drbg_mutex);
1905
1906         return 0;
1907 }
1908
1909 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1910 {
1911         drbg_uninstantiate(crypto_tfm_ctx(tfm));
1912 }
1913
1914 /*
1915  * Generate random numbers invoked by the kernel crypto API:
1916  * The API of the kernel crypto API is extended as follows:
1917  *
1918  * src is additional input supplied to the RNG.
1919  * slen is the length of src.
1920  * dst is the output buffer where random data is to be stored.
1921  * dlen is the length of dst.
1922  */
1923 static int drbg_kcapi_random(struct crypto_rng *tfm,
1924                              const u8 *src, unsigned int slen,
1925                              u8 *dst, unsigned int dlen)
1926 {
1927         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1928         struct drbg_string *addtl = NULL;
1929         struct drbg_string string;
1930
1931         if (slen) {
1932                 /* linked list variable is now local to allow modification */
1933                 drbg_string_fill(&string, src, slen);
1934                 addtl = &string;
1935         }
1936
1937         return drbg_generate_long(drbg, dst, dlen, addtl);
1938 }
1939
1940 /*
1941  * Seed the DRBG invoked by the kernel crypto API
1942  */
1943 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1944                            const u8 *seed, unsigned int slen)
1945 {
1946         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1947         struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1948         bool pr = false;
1949         struct drbg_string string;
1950         struct drbg_string *seed_string = NULL;
1951         int coreref = 0;
1952
1953         drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1954                               &pr);
1955         if (0 < slen) {
1956                 drbg_string_fill(&string, seed, slen);
1957                 seed_string = &string;
1958         }
1959
1960         return drbg_instantiate(drbg, seed_string, coreref, pr);
1961 }
1962
1963 /***************************************************************
1964  * Kernel module: code to load the module
1965  ***************************************************************/
1966
1967 /*
1968  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1969  * of the error handling.
1970  *
1971  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1972  * as seed source of get_random_bytes does not fail.
1973  *
1974  * Note 2: There is no sensible way of testing the reseed counter
1975  * enforcement, so skip it.
1976  */
1977 static inline int __init drbg_healthcheck_sanity(void)
1978 {
1979         int len = 0;
1980 #define OUTBUFLEN 16
1981         unsigned char buf[OUTBUFLEN];
1982         struct drbg_state *drbg = NULL;
1983         int ret = -EFAULT;
1984         int rc = -EFAULT;
1985         bool pr = false;
1986         int coreref = 0;
1987         struct drbg_string addtl;
1988         size_t max_addtllen, max_request_bytes;
1989
1990         /* only perform test in FIPS mode */
1991         if (!fips_enabled)
1992                 return 0;
1993
1994 #ifdef CONFIG_CRYPTO_DRBG_CTR
1995         drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
1996 #elif defined CONFIG_CRYPTO_DRBG_HASH
1997         drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
1998 #else
1999         drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
2000 #endif
2001
2002         drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
2003         if (!drbg)
2004                 return -ENOMEM;
2005
2006         mutex_init(&drbg->drbg_mutex);
2007         drbg->core = &drbg_cores[coreref];
2008         drbg->reseed_threshold = drbg_max_requests(drbg);
2009
2010         /*
2011          * if the following tests fail, it is likely that there is a buffer
2012          * overflow as buf is much smaller than the requested or provided
2013          * string lengths -- in case the error handling does not succeed
2014          * we may get an OOPS. And we want to get an OOPS as this is a
2015          * grave bug.
2016          */
2017
2018         max_addtllen = drbg_max_addtl(drbg);
2019         max_request_bytes = drbg_max_request_bytes(drbg);
2020         drbg_string_fill(&addtl, buf, max_addtllen + 1);
2021         /* overflow addtllen with additonal info string */
2022         len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
2023         BUG_ON(0 < len);
2024         /* overflow max_bits */
2025         len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
2026         BUG_ON(0 < len);
2027
2028         /* overflow max addtllen with personalization string */
2029         ret = drbg_seed(drbg, &addtl, false);
2030         BUG_ON(0 == ret);
2031         /* all tests passed */
2032         rc = 0;
2033
2034         pr_devel("DRBG: Sanity tests for failure code paths successfully "
2035                  "completed\n");
2036
2037         kfree(drbg);
2038         return rc;
2039 }
2040
2041 static struct rng_alg drbg_algs[22];
2042
2043 /*
2044  * Fill the array drbg_algs used to register the different DRBGs
2045  * with the kernel crypto API. To fill the array, the information
2046  * from drbg_cores[] is used.
2047  */
2048 static inline void __init drbg_fill_array(struct rng_alg *alg,
2049                                           const struct drbg_core *core, int pr)
2050 {
2051         int pos = 0;
2052         static int priority = 200;
2053
2054         memcpy(alg->base.cra_name, "stdrng", 6);
2055         if (pr) {
2056                 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
2057                 pos = 8;
2058         } else {
2059                 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
2060                 pos = 10;
2061         }
2062         memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2063                strlen(core->cra_name));
2064
2065         alg->base.cra_priority = priority;
2066         priority++;
2067         /*
2068          * If FIPS mode enabled, the selected DRBG shall have the
2069          * highest cra_priority over other stdrng instances to ensure
2070          * it is selected.
2071          */
2072         if (fips_enabled)
2073                 alg->base.cra_priority += 200;
2074
2075         alg->base.cra_ctxsize   = sizeof(struct drbg_state);
2076         alg->base.cra_module    = THIS_MODULE;
2077         alg->base.cra_init      = drbg_kcapi_init;
2078         alg->base.cra_exit      = drbg_kcapi_cleanup;
2079         alg->generate           = drbg_kcapi_random;
2080         alg->seed               = drbg_kcapi_seed;
2081         alg->set_ent            = drbg_kcapi_set_entropy;
2082         alg->seedsize           = 0;
2083 }
2084
2085 static int __init drbg_init(void)
2086 {
2087         unsigned int i = 0; /* pointer to drbg_algs */
2088         unsigned int j = 0; /* pointer to drbg_cores */
2089         int ret;
2090
2091         ret = drbg_healthcheck_sanity();
2092         if (ret)
2093                 return ret;
2094
2095         if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2096                 pr_info("DRBG: Cannot register all DRBG types"
2097                         "(slots needed: %zu, slots available: %zu)\n",
2098                         ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2099                 return -EFAULT;
2100         }
2101
2102         /*
2103          * each DRBG definition can be used with PR and without PR, thus
2104          * we instantiate each DRBG in drbg_cores[] twice.
2105          *
2106          * As the order of placing them into the drbg_algs array matters
2107          * (the later DRBGs receive a higher cra_priority) we register the
2108          * prediction resistance DRBGs first as the should not be too
2109          * interesting.
2110          */
2111         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2112                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2113         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2114                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2115         return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2116 }
2117
2118 static void __exit drbg_exit(void)
2119 {
2120         crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2121 }
2122
2123 subsys_initcall(drbg_init);
2124 module_exit(drbg_exit);
2125 #ifndef CRYPTO_DRBG_HASH_STRING
2126 #define CRYPTO_DRBG_HASH_STRING ""
2127 #endif
2128 #ifndef CRYPTO_DRBG_HMAC_STRING
2129 #define CRYPTO_DRBG_HMAC_STRING ""
2130 #endif
2131 #ifndef CRYPTO_DRBG_CTR_STRING
2132 #define CRYPTO_DRBG_CTR_STRING ""
2133 #endif
2134 MODULE_LICENSE("GPL");
2135 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2136 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2137                    "using following cores: "
2138                    CRYPTO_DRBG_HASH_STRING
2139                    CRYPTO_DRBG_HMAC_STRING
2140                    CRYPTO_DRBG_CTR_STRING);
2141 MODULE_ALIAS_CRYPTO("stdrng");
2142 MODULE_IMPORT_NS(CRYPTO_INTERNAL);