1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * s390 arch random implementation.
4 *
5 * Copyright IBM Corp. 2017, 2018
6 * Author(s): Harald Freudenberger
7 *
8 * The s390_arch_random_generate() function may be called from random.c
9 * in interrupt context. So this implementation does the best to be very
10 * fast. There is a buffer of random data which is asynchronously checked
11 * and filled by a workqueue thread.
12 * If there are enough bytes in the buffer the s390_arch_random_generate()
13 * just delivers these bytes. Otherwise false is returned until the
14 * worker thread refills the buffer.
15 * The worker fills the rng buffer by pulling fresh entropy from the
16 * high quality (but slow) true hardware random generator. This entropy
17 * is then spread over the buffer with an pseudo random generator PRNG.
18 * As the arch_get_random_seed_long() fetches 8 bytes and the calling
19 * function add_interrupt_randomness() counts this as 1 bit entropy the
20 * distribution needs to make sure there is in fact 1 bit entropy contained
21 * in 8 bytes of the buffer. The current values pull 32 byte entropy
22 * and scatter this into a 2048 byte buffer. So 8 byte in the buffer
23 * will contain 1 bit of entropy.
24 * The worker thread is rescheduled based on the charge level of the
25 * buffer but at least with 500 ms delay to avoid too much CPU consumption.
26 * So the max. amount of rng data delivered via arch_get_random_seed is
27 * limited to 4k bytes per second.
28 */
29
30 #include <linux/kernel.h>
31 #include <linux/atomic.h>
32 #include <linux/random.h>
33 #include <linux/slab.h>
34 #include <linux/static_key.h>
35 #include <linux/workqueue.h>
36 #include <asm/cpacf.h>
37
38 DEFINE_STATIC_KEY_FALSE(s390_arch_random_available);
39
40 atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0);
41 EXPORT_SYMBOL(s390_arch_random_counter);
42
43 #define ARCH_REFILL_TICKS (HZ/2)
44 #define ARCH_PRNG_SEED_SIZE 32
45 #define ARCH_RNG_BUF_SIZE 2048
46
47 static DEFINE_SPINLOCK(arch_rng_lock);
48 static u8 *arch_rng_buf;
49 static unsigned int arch_rng_buf_idx;
50
51 static void arch_rng_refill_buffer(struct work_struct *);
52 static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer);
53
s390_arch_random_generate(u8 * buf,unsigned int nbytes)54 bool s390_arch_random_generate(u8 *buf, unsigned int nbytes)
55 {
56 /* max hunk is ARCH_RNG_BUF_SIZE */
57 if (nbytes > ARCH_RNG_BUF_SIZE)
58 return false;
59
60 /* lock rng buffer */
61 if (!spin_trylock(&arch_rng_lock))
62 return false;
63
64 /* try to resolve the requested amount of bytes from the buffer */
65 arch_rng_buf_idx -= nbytes;
66 if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) {
67 memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes);
68 atomic64_add(nbytes, &s390_arch_random_counter);
69 spin_unlock(&arch_rng_lock);
70 return true;
71 }
72
73 /* not enough bytes in rng buffer, refill is done asynchronously */
74 spin_unlock(&arch_rng_lock);
75
76 return false;
77 }
78 EXPORT_SYMBOL(s390_arch_random_generate);
79
arch_rng_refill_buffer(struct work_struct * unused)80 static void arch_rng_refill_buffer(struct work_struct *unused)
81 {
82 unsigned int delay = ARCH_REFILL_TICKS;
83
84 spin_lock(&arch_rng_lock);
85 if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) {
86 /* buffer is exhausted and needs refill */
87 u8 seed[ARCH_PRNG_SEED_SIZE];
88 u8 prng_wa[240];
89 /* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */
90 cpacf_trng(NULL, 0, seed, sizeof(seed));
91 /* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */
92 memset(prng_wa, 0, sizeof(prng_wa));
93 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
94 &prng_wa, NULL, 0, seed, sizeof(seed));
95 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
96 &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0);
97 arch_rng_buf_idx = ARCH_RNG_BUF_SIZE;
98 }
99 delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE;
100 spin_unlock(&arch_rng_lock);
101
102 /* kick next check */
103 queue_delayed_work(system_long_wq, &arch_rng_work, delay);
104 }
105
s390_arch_random_init(void)106 static int __init s390_arch_random_init(void)
107 {
108 /* all the needed PRNO subfunctions available ? */
109 if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) &&
110 cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
111
112 /* alloc arch random working buffer */
113 arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL);
114 if (!arch_rng_buf)
115 return -ENOMEM;
116
117 /* kick worker queue job to fill the random buffer */
118 queue_delayed_work(system_long_wq,
119 &arch_rng_work, ARCH_REFILL_TICKS);
120
121 /* enable arch random to the outside world */
122 static_branch_enable(&s390_arch_random_available);
123 }
124
125 return 0;
126 }
127 arch_initcall(s390_arch_random_init);
128