crypto/drbg.c

   1 /*
   2  * DRBG: Deterministic Random Bits Generator
   3  *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
   4  *       properties:
   5  *              * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
   6  *              * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   7  *              * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   8  *              * with and without prediction resistance
   9  *
  10  * Copyright Stephan Mueller <smueller@chronox.de>, 2014
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, and the entire permission notice in its entirety,
  17  *    including the disclaimer of warranties.
  18  * 2. Redistributions in binary form must reproduce the above copyright
  19  *    notice, this list of conditions and the following disclaimer in the
  20  *    documentation and/or other materials provided with the distribution.
  21  * 3. The name of the author may not be used to endorse or promote
  22  *    products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * ALTERNATIVELY, this product may be distributed under the terms of
  26  * the GNU General Public License, in which case the provisions of the GPL are
  27  * required INSTEAD OF the above restrictions.  (This clause is
  28  * necessary due to a potential bad interaction between the GPL and
  29  * the restrictions contained in a BSD-style copyright.)
  30  *
  31  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34  * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
  35  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41  * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42  * DAMAGE.
  43  *
  44  * DRBG Usage
  45  * ==========
  46  * The SP 800-90A DRBG allows the user to specify a personalization string
  47  * for initialization as well as an additional information string for each
  48  * random number request. The following code fragments show how a caller
  49  * uses the kernel crypto API to use the full functionality of the DRBG.
  50  *
  51  * Usage without any additional data
  52  * ---------------------------------
  53  * struct crypto_rng *drng;
  54  * int err;
  55  * char data[DATALEN];
  56  *
  57  * drng = crypto_alloc_rng(drng_name, 0, 0);
  58  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59  * crypto_free_rng(drng);
  60  *
  61  *
  62  * Usage with personalization string during initialization
  63  * -------------------------------------------------------
  64  * struct crypto_rng *drng;
  65  * int err;
  66  * char data[DATALEN];
  67  * struct drbg_string pers;
  68  * char personalization[11] = "some-string";
  69  *
  70  * drbg_string_fill(&pers, personalization, strlen(personalization));
  71  * drng = crypto_alloc_rng(drng_name, 0, 0);
  72  * // The reset completely re-initializes the DRBG with the provided
  73  * // personalization string
  74  * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76  * crypto_free_rng(drng);
  77  *
  78  *
  79  * Usage with additional information string during random number request
  80  * ---------------------------------------------------------------------
  81  * struct crypto_rng *drng;
  82  * int err;
  83  * char data[DATALEN];
  84  * char addtl_string[11] = "some-string";
  85  * string drbg_string addtl;
  86  *
  87  * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88  * drng = crypto_alloc_rng(drng_name, 0, 0);
  89  * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90  * // the same error codes.
  91  * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92  * crypto_free_rng(drng);
  93  *
  94  *
  95  * Usage with personalization and additional information strings
  96  * -------------------------------------------------------------
  97  * Just mix both scenarios above.
  98  */
  99
 100 #include <crypto/drbg.h>
 101
 102 /***************************************************************
 103  * Backend cipher definitions available to DRBG
 104  ***************************************************************/
 105
 106 /*
 107  * The order of the DRBG definitions here matter: every DRBG is registered
 108  * as stdrng. Each DRBG receives an increasing cra_priority values the later
 109  * they are defined in this array (see drbg_fill_array).
 110  *
 111  * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
 112  * the SHA256 / AES 256 over other ciphers. Thus, the favored
 113  * DRBGs are the latest entries in this array.
 114  */
 115 static const struct drbg_core drbg_cores[] = {
 116 #ifdef CONFIG_CRYPTO_DRBG_CTR
 117         {
 118                 .flags = DRBG_CTR | DRBG_STRENGTH128,
 119                 .statelen = 32, /* 256 bits as defined in 10.2.1 */
 120                 .blocklen_bytes = 16,
 121                 .cra_name = "ctr_aes128",
 122                 .backend_cra_name = "aes",
 123         }, {
 124                 .flags = DRBG_CTR | DRBG_STRENGTH192,
 125                 .statelen = 40, /* 320 bits as defined in 10.2.1 */
 126                 .blocklen_bytes = 16,
 127                 .cra_name = "ctr_aes192",
 128                 .backend_cra_name = "aes",
 129         }, {
 130                 .flags = DRBG_CTR | DRBG_STRENGTH256,
 131                 .statelen = 48, /* 384 bits as defined in 10.2.1 */
 132                 .blocklen_bytes = 16,
 133                 .cra_name = "ctr_aes256",
 134                 .backend_cra_name = "aes",
 135         },
 136 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 137 #ifdef CONFIG_CRYPTO_DRBG_HASH
 138         {
 139                 .flags = DRBG_HASH | DRBG_STRENGTH128,
 140                 .statelen = 55, /* 440 bits */
 141                 .blocklen_bytes = 20,
 142                 .cra_name = "sha1",
 143                 .backend_cra_name = "sha1",
 144         }, {
 145                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 146                 .statelen = 111, /* 888 bits */
 147                 .blocklen_bytes = 48,
 148                 .cra_name = "sha384",
 149                 .backend_cra_name = "sha384",
 150         }, {
 151                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 152                 .statelen = 111, /* 888 bits */
 153                 .blocklen_bytes = 64,
 154                 .cra_name = "sha512",
 155                 .backend_cra_name = "sha512",
 156         }, {
 157                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 158                 .statelen = 55, /* 440 bits */
 159                 .blocklen_bytes = 32,
 160                 .cra_name = "sha256",
 161                 .backend_cra_name = "sha256",
 162         },
 163 #endif /* CONFIG_CRYPTO_DRBG_HASH */
 164 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 165         {
 166                 .flags = DRBG_HMAC | DRBG_STRENGTH128,
 167                 .statelen = 20, /* block length of cipher */
 168                 .blocklen_bytes = 20,
 169                 .cra_name = "hmac_sha1",
 170                 .backend_cra_name = "hmac(sha1)",
 171         }, {
 172                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 173                 .statelen = 48, /* block length of cipher */
 174                 .blocklen_bytes = 48,
 175                 .cra_name = "hmac_sha384",
 176                 .backend_cra_name = "hmac(sha384)",
 177         }, {
 178                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 179                 .statelen = 64, /* block length of cipher */
 180                 .blocklen_bytes = 64,
 181                 .cra_name = "hmac_sha512",
 182                 .backend_cra_name = "hmac(sha512)",
 183         }, {
 184                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 185                 .statelen = 32, /* block length of cipher */
 186                 .blocklen_bytes = 32,
 187                 .cra_name = "hmac_sha256",
 188                 .backend_cra_name = "hmac(sha256)",
 189         },
 190 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 191 };
 192
 193 /******************************************************************
 194  * Generic helper functions
 195  ******************************************************************/
 196
 197 /*
 198  * Return strength of DRBG according to SP800-90A section 8.4
 199  *
 200  * @flags DRBG flags reference
 201  *
 202  * Return: normalized strength in *bytes* value or 32 as default
 203  *         to counter programming errors
 204  */
 205 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
 206 {
 207         switch (flags & DRBG_STRENGTH_MASK) {
 208         case DRBG_STRENGTH128:
 209                 return 16;
 210         case DRBG_STRENGTH192:
 211                 return 24;
 212         case DRBG_STRENGTH256:
 213                 return 32;
 214         default:
 215                 return 32;
 216         }
 217 }
 218
 219 /*
 220  * FIPS 140-2 continuous self test
 221  * The test is performed on the result of one round of the output
 222  * function. Thus, the function implicitly knows the size of the
 223  * buffer.
 224  *
 225  * @drbg DRBG handle
 226  * @buf output buffer of random data to be checked
 227  *
 228  * return:
 229  *      true on success
 230  *      false on error
 231  */
 232 static bool drbg_fips_continuous_test(struct drbg_state *drbg,
 233                                       const unsigned char *buf)
 234 {
 235 #ifdef CONFIG_CRYPTO_FIPS
 236         int ret = 0;
 237         /* skip test if we test the overall system */
 238         if (list_empty(&drbg->test_data.list))
 239                 return true;
 240         /* only perform test in FIPS mode */
 241         if (0 == fips_enabled)
 242                 return true;
 243         if (!drbg->fips_primed) {
 244                 /* Priming of FIPS test */
 245                 memcpy(drbg->prev, buf, drbg_blocklen(drbg));
 246                 drbg->fips_primed = true;
 247                 /* return false due to priming, i.e. another round is needed */
 248                 return false;
 249         }
 250         ret = memcmp(drbg->prev, buf, drbg_blocklen(drbg));
 251         if (!ret)
 252                 panic("DRBG continuous self test failed\n");
 253         memcpy(drbg->prev, buf, drbg_blocklen(drbg));
 254         /* the test shall pass when the two compared values are not equal */
 255         return ret != 0;
 256 #else
 257         return true;
 258 #endif /* CONFIG_CRYPTO_FIPS */
 259 }
 260
 261 /*
 262  * Convert an integer into a byte representation of this integer.
 263  * The byte representation is big-endian
 264  *
 265  * @val value to be converted
 266  * @buf buffer holding the converted integer -- caller must ensure that
 267  *      buffer size is at least 32 bit
 268  */
 269 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
 270 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
 271 {
 272         struct s {
 273                 __be32 conv;
 274         };
 275         struct s *conversion = (struct s *) buf;
 276
 277         conversion->conv = cpu_to_be32(val);
 278 }
 279 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
 280
 281 /******************************************************************
 282  * CTR DRBG callback functions
 283  ******************************************************************/
 284
 285 #ifdef CONFIG_CRYPTO_DRBG_CTR
 286 #define CRYPTO_DRBG_CTR_STRING "CTR "
 287 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
 288 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
 289 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
 290 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
 291 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
 292 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
 293
 294 static int drbg_kcapi_sym(struct drbg_state *drbg, const unsigned char *key,
 295                           unsigned char *outval, const struct drbg_string *in);
 296 static int drbg_init_sym_kernel(struct drbg_state *drbg);
 297 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
 298
 299 /* BCC function for CTR DRBG as defined in 10.4.3 */
 300 static int drbg_ctr_bcc(struct drbg_state *drbg,
 301                         unsigned char *out, const unsigned char *key,
 302                         struct list_head *in)
 303 {
 304         int ret = 0;
 305         struct drbg_string *curr = NULL;
 306         struct drbg_string data;
 307         short cnt = 0;
 308
 309         drbg_string_fill(&data, out, drbg_blocklen(drbg));
 310
 311         /* 10.4.3 step 2 / 4 */
 312         list_for_each_entry(curr, in, list) {
 313                 const unsigned char *pos = curr->buf;
 314                 size_t len = curr->len;
 315                 /* 10.4.3 step 4.1 */
 316                 while (len) {
 317                         /* 10.4.3 step 4.2 */
 318                         if (drbg_blocklen(drbg) == cnt) {
 319                                 cnt = 0;
 320                                 ret = drbg_kcapi_sym(drbg, key, out, &data);
 321                                 if (ret)
 322                                         return ret;
 323                         }
 324                         out[cnt] ^= *pos;
 325                         pos++;
 326                         cnt++;
 327                         len--;
 328                 }
 329         }
 330         /* 10.4.3 step 4.2 for last block */
 331         if (cnt)
 332                 ret = drbg_kcapi_sym(drbg, key, out, &data);
 333
 334         return ret;
 335 }
 336
 337 /*
 338  * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
 339  * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
 340  * the scratchpad is used as follows:
 341  * drbg_ctr_update:
 342  *      temp
 343  *              start: drbg->scratchpad
 344  *              length: drbg_statelen(drbg) + drbg_blocklen(drbg)
 345  *                      note: the cipher writing into this variable works
 346  *                      blocklen-wise. Now, when the statelen is not a multiple
 347  *                      of blocklen, the generateion loop below "spills over"
 348  *                      by at most blocklen. Thus, we need to give sufficient
 349  *                      memory.
 350  *      df_data
 351  *              start: drbg->scratchpad +
 352  *                              drbg_statelen(drbg) + drbg_blocklen(drbg)
 353  *              length: drbg_statelen(drbg)
 354  *
 355  * drbg_ctr_df:
 356  *      pad
 357  *              start: df_data + drbg_statelen(drbg)
 358  *              length: drbg_blocklen(drbg)
 359  *      iv
 360  *              start: pad + drbg_blocklen(drbg)
 361  *              length: drbg_blocklen(drbg)
 362  *      temp
 363  *              start: iv + drbg_blocklen(drbg)
 364  *              length: drbg_satelen(drbg) + drbg_blocklen(drbg)
 365  *                      note: temp is the buffer that the BCC function operates
 366  *                      on. BCC operates blockwise. drbg_statelen(drbg)
 367  *                      is sufficient when the DRBG state length is a multiple
 368  *                      of the block size. For AES192 (and maybe other ciphers)
 369  *                      this is not correct and the length for temp is
 370  *                      insufficient (yes, that also means for such ciphers,
 371  *                      the final output of all BCC rounds are truncated).
 372  *                      Therefore, add drbg_blocklen(drbg) to cover all
 373  *                      possibilities.
 374  */
 375
 376 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
 377 static int drbg_ctr_df(struct drbg_state *drbg,
 378                        unsigned char *df_data, size_t bytes_to_return,
 379                        struct list_head *seedlist)
 380 {
 381         int ret = -EFAULT;
 382         unsigned char L_N[8];
 383         /* S3 is input */
 384         struct drbg_string S1, S2, S4, cipherin;
 385         LIST_HEAD(bcc_list);
 386         unsigned char *pad = df_data + drbg_statelen(drbg);
 387         unsigned char *iv = pad + drbg_blocklen(drbg);
 388         unsigned char *temp = iv + drbg_blocklen(drbg);
 389         size_t padlen = 0;
 390         unsigned int templen = 0;
 391         /* 10.4.2 step 7 */
 392         unsigned int i = 0;
 393         /* 10.4.2 step 8 */
 394         const unsigned char *K = (unsigned char *)
 395                            "\x00\x01\x02\x03\x04\x05\x06\x07"
 396                            "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 397                            "\x10\x11\x12\x13\x14\x15\x16\x17"
 398                            "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
 399         unsigned char *X;
 400         size_t generated_len = 0;
 401         size_t inputlen = 0;
 402         struct drbg_string *seed = NULL;
 403
 404         memset(pad, 0, drbg_blocklen(drbg));
 405         memset(iv, 0, drbg_blocklen(drbg));
 406
 407         /* 10.4.2 step 1 is implicit as we work byte-wise */
 408
 409         /* 10.4.2 step 2 */
 410         if ((512/8) < bytes_to_return)
 411                 return -EINVAL;
 412
 413         /* 10.4.2 step 2 -- calculate the entire length of all input data */
 414         list_for_each_entry(seed, seedlist, list)
 415                 inputlen += seed->len;
 416         drbg_cpu_to_be32(inputlen, &L_N[0]);
 417
 418         /* 10.4.2 step 3 */
 419         drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
 420
 421         /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
 422         padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
 423         /* wrap the padlen appropriately */
 424         if (padlen)
 425                 padlen = drbg_blocklen(drbg) - padlen;
 426         /*
 427          * pad / padlen contains the 0x80 byte and the following zero bytes.
 428          * As the calculated padlen value only covers the number of zero
 429          * bytes, this value has to be incremented by one for the 0x80 byte.
 430          */
 431         padlen++;
 432         pad[0] = 0x80;
 433
 434         /* 10.4.2 step 4 -- first fill the linked list and then order it */
 435         drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
 436         list_add_tail(&S1.list, &bcc_list);
 437         drbg_string_fill(&S2, L_N, sizeof(L_N));
 438         list_add_tail(&S2.list, &bcc_list);
 439         list_splice_tail(seedlist, &bcc_list);
 440         drbg_string_fill(&S4, pad, padlen);
 441         list_add_tail(&S4.list, &bcc_list);
 442
 443         /* 10.4.2 step 9 */
 444         while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
 445                 /*
 446                  * 10.4.2 step 9.1 - the padding is implicit as the buffer
 447                  * holds zeros after allocation -- even the increment of i
 448                  * is irrelevant as the increment remains within length of i
 449                  */
 450                 drbg_cpu_to_be32(i, iv);
 451                 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
 452                 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
 453                 if (ret)
 454                         goto out;
 455                 /* 10.4.2 step 9.3 */
 456                 i++;
 457                 templen += drbg_blocklen(drbg);
 458         }
 459
 460         /* 10.4.2 step 11 */
 461         X = temp + (drbg_keylen(drbg));
 462         drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
 463
 464         /* 10.4.2 step 12: overwriting of outval is implemented in next step */
 465
 466         /* 10.4.2 step 13 */
 467         while (generated_len < bytes_to_return) {
 468                 short blocklen = 0;
 469                 /*
 470                  * 10.4.2 step 13.1: the truncation of the key length is
 471                  * implicit as the key is only drbg_blocklen in size based on
 472                  * the implementation of the cipher function callback
 473                  */
 474                 ret = drbg_kcapi_sym(drbg, temp, X, &cipherin);
 475                 if (ret)
 476                         goto out;
 477                 blocklen = (drbg_blocklen(drbg) <
 478                                 (bytes_to_return - generated_len)) ?
 479                             drbg_blocklen(drbg) :
 480                                 (bytes_to_return - generated_len);
 481                 /* 10.4.2 step 13.2 and 14 */
 482                 memcpy(df_data + generated_len, X, blocklen);
 483                 generated_len += blocklen;
 484         }
 485
 486         ret = 0;
 487
 488 out:
 489         memset(iv, 0, drbg_blocklen(drbg));
 490         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 491         memset(pad, 0, drbg_blocklen(drbg));
 492         return ret;
 493 }
 494
 495 /*
 496  * update function of CTR DRBG as defined in 10.2.1.2
 497  *
 498  * The reseed variable has an enhanced meaning compared to the update
 499  * functions of the other DRBGs as follows:
 500  * 0 => initial seed from initialization
 501  * 1 => reseed via drbg_seed
 502  * 2 => first invocation from drbg_ctr_update when addtl is present. In
 503  *      this case, the df_data scratchpad is not deleted so that it is
 504  *      available for another calls to prevent calling the DF function
 505  *      again.
 506  * 3 => second invocation from drbg_ctr_update. When the update function
 507  *      was called with addtl, the df_data memory already contains the
 508  *      DFed addtl information and we do not need to call DF again.
 509  */
 510 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
 511                            int reseed)
 512 {
 513         int ret = -EFAULT;
 514         /* 10.2.1.2 step 1 */
 515         unsigned char *temp = drbg->scratchpad;
 516         unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
 517                                  drbg_blocklen(drbg);
 518         unsigned char *temp_p, *df_data_p; /* pointer to iterate over buffers */
 519         unsigned int len = 0;
 520         struct drbg_string cipherin;
 521
 522         if (3 > reseed)
 523                 memset(df_data, 0, drbg_statelen(drbg));
 524
 525         /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
 526         if (seed) {
 527                 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
 528                 if (ret)
 529                         goto out;
 530         }
 531
 532         drbg_string_fill(&cipherin, drbg->V, drbg_blocklen(drbg));
 533         /*
 534          * 10.2.1.3.2 steps 2 and 3 are already covered as the allocation
 535          * zeroizes all memory during initialization
 536          */
 537         while (len < (drbg_statelen(drbg))) {
 538                 /* 10.2.1.2 step 2.1 */
 539                 crypto_inc(drbg->V, drbg_blocklen(drbg));
 540                 /*
 541                  * 10.2.1.2 step 2.2 */
 542                 ret = drbg_kcapi_sym(drbg, drbg->C, temp + len, &cipherin);
 543                 if (ret)
 544                         goto out;
 545                 /* 10.2.1.2 step 2.3 and 3 */
 546                 len += drbg_blocklen(drbg);
 547         }
 548
 549         /* 10.2.1.2 step 4 */
 550         temp_p = temp;
 551         df_data_p = df_data;
 552         for (len = 0; len < drbg_statelen(drbg); len++) {
 553                 *temp_p ^= *df_data_p;
 554                 df_data_p++; temp_p++;
 555         }
 556
 557         /* 10.2.1.2 step 5 */
 558         memcpy(drbg->C, temp, drbg_keylen(drbg));
 559         /* 10.2.1.2 step 6 */
 560         memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
 561         ret = 0;
 562
 563 out:
 564         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 565         if (2 != reseed)
 566                 memset(df_data, 0, drbg_statelen(drbg));
 567         return ret;
 568 }
 569
 570 /*
 571  * scratchpad use: drbg_ctr_update is called independently from
 572  * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
 573  */
 574 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
 575 static int drbg_ctr_generate(struct drbg_state *drbg,
 576                              unsigned char *buf, unsigned int buflen,
 577                              struct list_head *addtl)
 578 {
 579         int len = 0;
 580         int ret = 0;
 581         struct drbg_string data;
 582
 583         /* 10.2.1.5.2 step 2 */
 584         if (addtl && !list_empty(addtl)) {
 585                 ret = drbg_ctr_update(drbg, addtl, 2);
 586                 if (ret)
 587                         return 0;
 588         }
 589
 590         /* 10.2.1.5.2 step 4.1 */
 591         crypto_inc(drbg->V, drbg_blocklen(drbg));
 592         drbg_string_fill(&data, drbg->V, drbg_blocklen(drbg));
 593         while (len < buflen) {
 594                 int outlen = 0;
 595                 /* 10.2.1.5.2 step 4.2 */
 596                 ret = drbg_kcapi_sym(drbg, drbg->C, drbg->scratchpad, &data);
 597                 if (ret) {
 598                         len = ret;
 599                         goto out;
 600                 }
 601                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 602                           drbg_blocklen(drbg) : (buflen - len);
 603                 if (!drbg_fips_continuous_test(drbg, drbg->scratchpad)) {
 604                         /* 10.2.1.5.2 step 6 */
 605                         crypto_inc(drbg->V, drbg_blocklen(drbg));
 606                         continue;
 607                 }
 608                 /* 10.2.1.5.2 step 4.3 */
 609                 memcpy(buf + len, drbg->scratchpad, outlen);
 610                 len += outlen;
 611                 /* 10.2.1.5.2 step 6 */
 612                 if (len < buflen)
 613                         crypto_inc(drbg->V, drbg_blocklen(drbg));
 614         }
 615
 616         /* 10.2.1.5.2 step 6 */
 617         ret = drbg_ctr_update(drbg, NULL, 3);
 618         if (ret)
 619                 len = ret;
 620
 621 out:
 622         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 623         return len;
 624 }
 625
 626 static struct drbg_state_ops drbg_ctr_ops = {
 627         .update         = drbg_ctr_update,
 628         .generate       = drbg_ctr_generate,
 629         .crypto_init    = drbg_init_sym_kernel,
 630         .crypto_fini    = drbg_fini_sym_kernel,
 631 };
 632 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 633
 634 /******************************************************************
 635  * HMAC DRBG callback functions
 636  ******************************************************************/
 637
 638 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
 639 static int drbg_kcapi_hash(struct drbg_state *drbg, const unsigned char *key,
 640                            unsigned char *outval, const struct list_head *in);
 641 static int drbg_init_hash_kernel(struct drbg_state *drbg);
 642 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
 643 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
 644
 645 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 646 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
 647 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
 648 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
 649 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
 650 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
 651 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
 652 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
 653 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
 654 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
 655
 656 /* update function of HMAC DRBG as defined in 10.1.2.2 */
 657 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 658                             int reseed)
 659 {
 660         int ret = -EFAULT;
 661         int i = 0;
 662         struct drbg_string seed1, seed2, vdata;
 663         LIST_HEAD(seedlist);
 664         LIST_HEAD(vdatalist);
 665
 666         if (!reseed)
 667                 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
 668                 memset(drbg->V, 1, drbg_statelen(drbg));
 669
 670         drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
 671         list_add_tail(&seed1.list, &seedlist);
 672         /* buffer of seed2 will be filled in for loop below with one byte */
 673         drbg_string_fill(&seed2, NULL, 1);
 674         list_add_tail(&seed2.list, &seedlist);
 675         /* input data of seed is allowed to be NULL at this point */
 676         if (seed)
 677                 list_splice_tail(seed, &seedlist);
 678
 679         drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
 680         list_add_tail(&vdata.list, &vdatalist);
 681         for (i = 2; 0 < i; i--) {
 682                 /* first round uses 0x0, second 0x1 */
 683                 unsigned char prefix = DRBG_PREFIX0;
 684                 if (1 == i)
 685                         prefix = DRBG_PREFIX1;
 686                 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
 687                 seed2.buf = &prefix;
 688                 ret = drbg_kcapi_hash(drbg, drbg->C, drbg->C, &seedlist);
 689                 if (ret)
 690                         return ret;
 691
 692                 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
 693                 ret = drbg_kcapi_hash(drbg, drbg->C, drbg->V, &vdatalist);
 694                 if (ret)
 695                         return ret;
 696
 697                 /* 10.1.2.2 step 3 */
 698                 if (!seed)
 699                         return ret;
 700         }
 701
 702         return 0;
 703 }
 704
 705 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
 706 static int drbg_hmac_generate(struct drbg_state *drbg,
 707                               unsigned char *buf,
 708                               unsigned int buflen,
 709                               struct list_head *addtl)
 710 {
 711         int len = 0;
 712         int ret = 0;
 713         struct drbg_string data;
 714         LIST_HEAD(datalist);
 715
 716         /* 10.1.2.5 step 2 */
 717         if (addtl && !list_empty(addtl)) {
 718                 ret = drbg_hmac_update(drbg, addtl, 1);
 719                 if (ret)
 720                         return ret;
 721         }
 722
 723         drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
 724         list_add_tail(&data.list, &datalist);
 725         while (len < buflen) {
 726                 unsigned int outlen = 0;
 727                 /* 10.1.2.5 step 4.1 */
 728                 ret = drbg_kcapi_hash(drbg, drbg->C, drbg->V, &datalist);
 729                 if (ret)
 730                         return ret;
 731                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 732                           drbg_blocklen(drbg) : (buflen - len);
 733                 if (!drbg_fips_continuous_test(drbg, drbg->V))
 734                         continue;
 735
 736                 /* 10.1.2.5 step 4.2 */
 737                 memcpy(buf + len, drbg->V, outlen);
 738                 len += outlen;
 739         }
 740
 741         /* 10.1.2.5 step 6 */
 742         if (addtl && !list_empty(addtl))
 743                 ret = drbg_hmac_update(drbg, addtl, 1);
 744         else
 745                 ret = drbg_hmac_update(drbg, NULL, 1);
 746         if (ret)
 747                 return ret;
 748
 749         return len;
 750 }
 751
 752 static struct drbg_state_ops drbg_hmac_ops = {
 753         .update         = drbg_hmac_update,
 754         .generate       = drbg_hmac_generate,
 755         .crypto_init    = drbg_init_hash_kernel,
 756         .crypto_fini    = drbg_fini_hash_kernel,
 757 };
 758 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 759
 760 /******************************************************************
 761  * Hash DRBG callback functions
 762  ******************************************************************/
 763
 764 #ifdef CONFIG_CRYPTO_DRBG_HASH
 765 #define CRYPTO_DRBG_HASH_STRING "HASH "
 766 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
 767 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
 768 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
 769 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
 770 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
 771 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
 772 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
 773 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
 774
 775 /*
 776  * Increment buffer
 777  *
 778  * @dst buffer to increment
 779  * @add value to add
 780  */
 781 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
 782                                 const unsigned char *add, size_t addlen)
 783 {
 784         /* implied: dstlen > addlen */
 785         unsigned char *dstptr;
 786         const unsigned char *addptr;
 787         unsigned int remainder = 0;
 788         size_t len = addlen;
 789
 790         dstptr = dst + (dstlen-1);
 791         addptr = add + (addlen-1);
 792         while (len) {
 793                 remainder += *dstptr + *addptr;
 794                 *dstptr = remainder & 0xff;
 795                 remainder >>= 8;
 796                 len--; dstptr--; addptr--;
 797         }
 798         len = dstlen - addlen;
 799         while (len && remainder > 0) {
 800                 remainder = *dstptr + 1;
 801                 *dstptr = remainder & 0xff;
 802                 remainder >>= 8;
 803                 len--; dstptr--;
 804         }
 805 }
 806
 807 /*
 808  * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
 809  * interlinked, the scratchpad is used as follows:
 810  * drbg_hash_update
 811  *      start: drbg->scratchpad
 812  *      length: drbg_statelen(drbg)
 813  * drbg_hash_df:
 814  *      start: drbg->scratchpad + drbg_statelen(drbg)
 815  *      length: drbg_blocklen(drbg)
 816  *
 817  * drbg_hash_process_addtl uses the scratchpad, but fully completes
 818  * before either of the functions mentioned before are invoked. Therefore,
 819  * drbg_hash_process_addtl does not need to be specifically considered.
 820  */
 821
 822 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
 823 static int drbg_hash_df(struct drbg_state *drbg,
 824                         unsigned char *outval, size_t outlen,
 825                         struct list_head *entropylist)
 826 {
 827         int ret = 0;
 828         size_t len = 0;
 829         unsigned char input[5];
 830         unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
 831         struct drbg_string data;
 832
 833         /* 10.4.1 step 3 */
 834         input[0] = 1;
 835         drbg_cpu_to_be32((outlen * 8), &input[1]);
 836
 837         /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
 838         drbg_string_fill(&data, input, 5);
 839         list_add(&data.list, entropylist);
 840
 841         /* 10.4.1 step 4 */
 842         while (len < outlen) {
 843                 short blocklen = 0;
 844                 /* 10.4.1 step 4.1 */
 845                 ret = drbg_kcapi_hash(drbg, NULL, tmp, entropylist);
 846                 if (ret)
 847                         goto out;
 848                 /* 10.4.1 step 4.2 */
 849                 input[0]++;
 850                 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
 851                             drbg_blocklen(drbg) : (outlen - len);
 852                 memcpy(outval + len, tmp, blocklen);
 853                 len += blocklen;
 854         }
 855
 856 out:
 857         memset(tmp, 0, drbg_blocklen(drbg));
 858         return ret;
 859 }
 860
 861 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
 862 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
 863                             int reseed)
 864 {
 865         int ret = 0;
 866         struct drbg_string data1, data2;
 867         LIST_HEAD(datalist);
 868         LIST_HEAD(datalist2);
 869         unsigned char *V = drbg->scratchpad;
 870         unsigned char prefix = DRBG_PREFIX1;
 871
 872         if (!seed)
 873                 return -EINVAL;
 874
 875         if (reseed) {
 876                 /* 10.1.1.3 step 1 */
 877                 memcpy(V, drbg->V, drbg_statelen(drbg));
 878                 drbg_string_fill(&data1, &prefix, 1);
 879                 list_add_tail(&data1.list, &datalist);
 880                 drbg_string_fill(&data2, V, drbg_statelen(drbg));
 881                 list_add_tail(&data2.list, &datalist);
 882         }
 883         list_splice_tail(seed, &datalist);
 884
 885         /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
 886         ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
 887         if (ret)
 888                 goto out;
 889
 890         /* 10.1.1.2 / 10.1.1.3 step 4  */
 891         prefix = DRBG_PREFIX0;
 892         drbg_string_fill(&data1, &prefix, 1);
 893         list_add_tail(&data1.list, &datalist2);
 894         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 895         list_add_tail(&data2.list, &datalist2);
 896         /* 10.1.1.2 / 10.1.1.3 step 4 */
 897         ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 898
 899 out:
 900         memset(drbg->scratchpad, 0, drbg_statelen(drbg));
 901         return ret;
 902 }
 903
 904 /* processing of additional information string for Hash DRBG */
 905 static int drbg_hash_process_addtl(struct drbg_state *drbg,
 906                                    struct list_head *addtl)
 907 {
 908         int ret = 0;
 909         struct drbg_string data1, data2;
 910         LIST_HEAD(datalist);
 911         unsigned char prefix = DRBG_PREFIX2;
 912
 913         /* 10.1.1.4 step 2 */
 914         if (!addtl || list_empty(addtl))
 915                 return 0;
 916
 917         /* 10.1.1.4 step 2a */
 918         drbg_string_fill(&data1, &prefix, 1);
 919         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 920         list_add_tail(&data1.list, &datalist);
 921         list_add_tail(&data2.list, &datalist);
 922         list_splice_tail(addtl, &datalist);
 923         ret = drbg_kcapi_hash(drbg, NULL, drbg->scratchpad, &datalist);
 924         if (ret)
 925                 goto out;
 926
 927         /* 10.1.1.4 step 2b */
 928         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 929                      drbg->scratchpad, drbg_blocklen(drbg));
 930
 931 out:
 932         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 933         return ret;
 934 }
 935
 936 /* Hashgen defined in 10.1.1.4 */
 937 static int drbg_hash_hashgen(struct drbg_state *drbg,
 938                              unsigned char *buf,
 939                              unsigned int buflen)
 940 {
 941         int len = 0;
 942         int ret = 0;
 943         unsigned char *src = drbg->scratchpad;
 944         unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
 945         struct drbg_string data;
 946         LIST_HEAD(datalist);
 947
 948         /* 10.1.1.4 step hashgen 2 */
 949         memcpy(src, drbg->V, drbg_statelen(drbg));
 950
 951         drbg_string_fill(&data, src, drbg_statelen(drbg));
 952         list_add_tail(&data.list, &datalist);
 953         while (len < buflen) {
 954                 unsigned int outlen = 0;
 955                 /* 10.1.1.4 step hashgen 4.1 */
 956                 ret = drbg_kcapi_hash(drbg, NULL, dst, &datalist);
 957                 if (ret) {
 958                         len = ret;
 959                         goto out;
 960                 }
 961                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 962                           drbg_blocklen(drbg) : (buflen - len);
 963                 if (!drbg_fips_continuous_test(drbg, dst)) {
 964                         crypto_inc(src, drbg_statelen(drbg));
 965                         continue;
 966                 }
 967                 /* 10.1.1.4 step hashgen 4.2 */
 968                 memcpy(buf + len, dst, outlen);
 969                 len += outlen;
 970                 /* 10.1.1.4 hashgen step 4.3 */
 971                 if (len < buflen)
 972                         crypto_inc(src, drbg_statelen(drbg));
 973         }
 974
 975 out:
 976         memset(drbg->scratchpad, 0,
 977                (drbg_statelen(drbg) + drbg_blocklen(drbg)));
 978         return len;
 979 }
 980
 981 /* generate function for Hash DRBG as defined in  10.1.1.4 */
 982 static int drbg_hash_generate(struct drbg_state *drbg,
 983                               unsigned char *buf, unsigned int buflen,
 984                               struct list_head *addtl)
 985 {
 986         int len = 0;
 987         int ret = 0;
 988         union {
 989                 unsigned char req[8];
 990                 __be64 req_int;
 991         } u;
 992         unsigned char prefix = DRBG_PREFIX3;
 993         struct drbg_string data1, data2;
 994         LIST_HEAD(datalist);
 995
 996         /* 10.1.1.4 step 2 */
 997         ret = drbg_hash_process_addtl(drbg, addtl);
 998         if (ret)
 999                 return ret;
1000         /* 10.1.1.4 step 3 */
1001         len = drbg_hash_hashgen(drbg, buf, buflen);
1002
1003         /* this is the value H as documented in 10.1.1.4 */
1004         /* 10.1.1.4 step 4 */
1005         drbg_string_fill(&data1, &prefix, 1);
1006         list_add_tail(&data1.list, &datalist);
1007         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
1008         list_add_tail(&data2.list, &datalist);
1009         ret = drbg_kcapi_hash(drbg, NULL, drbg->scratchpad, &datalist);
1010         if (ret) {
1011                 len = ret;
1012                 goto out;
1013         }
1014
1015         /* 10.1.1.4 step 5 */
1016         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1017                      drbg->scratchpad, drbg_blocklen(drbg));
1018         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1019                      drbg->C, drbg_statelen(drbg));
1020         u.req_int = cpu_to_be64(drbg->reseed_ctr);
1021         drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1022
1023 out:
1024         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1025         return len;
1026 }
1027
1028 /*
1029  * scratchpad usage: as update and generate are used isolated, both
1030  * can use the scratchpad
1031  */
1032 static struct drbg_state_ops drbg_hash_ops = {
1033         .update         = drbg_hash_update,
1034         .generate       = drbg_hash_generate,
1035         .crypto_init    = drbg_init_hash_kernel,
1036         .crypto_fini    = drbg_fini_hash_kernel,
1037 };
1038 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1039
1040 /******************************************************************
1041  * Functions common for DRBG implementations
1042  ******************************************************************/
1043
1044 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1045                               int reseed)
1046 {
1047         int ret = drbg->d_ops->update(drbg, seed, reseed);
1048
1049         if (ret)
1050                 return ret;
1051
1052         drbg->seeded = true;
1053         /* 10.1.1.2 / 10.1.1.3 step 5 */
1054         drbg->reseed_ctr = 1;
1055
1056         return ret;
1057 }
1058
1059 static void drbg_async_seed(struct work_struct *work)
1060 {
1061         struct drbg_string data;
1062         LIST_HEAD(seedlist);
1063         struct drbg_state *drbg = container_of(work, struct drbg_state,
1064                                                seed_work);
1065         int ret;
1066
1067         get_blocking_random_bytes(drbg->seed_buf, drbg->seed_buf_len);
1068
1069         drbg_string_fill(&data, drbg->seed_buf, drbg->seed_buf_len);
1070         list_add_tail(&data.list, &seedlist);
1071         mutex_lock(&drbg->drbg_mutex);
1072         ret = __drbg_seed(drbg, &seedlist, true);
1073         if (!ret && drbg->jent) {
1074                 crypto_free_rng(drbg->jent);
1075                 drbg->jent = NULL;
1076         }
1077         memzero_explicit(drbg->seed_buf, drbg->seed_buf_len);
1078         mutex_unlock(&drbg->drbg_mutex);
1079 }
1080
1081 /*
1082  * Seeding or reseeding of the DRBG
1083  *
1084  * @drbg: DRBG state struct
1085  * @pers: personalization / additional information buffer
1086  * @reseed: 0 for initial seed process, 1 for reseeding
1087  *
1088  * return:
1089  *      0 on success
1090  *      error value otherwise
1091  */
1092 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1093                      bool reseed)
1094 {
1095         int ret = 0;
1096         struct drbg_string data1;
1097         LIST_HEAD(seedlist);
1098
1099         /* 9.1 / 9.2 / 9.3.1 step 3 */
1100         if (pers && pers->len > (drbg_max_addtl(drbg))) {
1101                 pr_devel("DRBG: personalization string too long %zu\n",
1102                          pers->len);
1103                 return -EINVAL;
1104         }
1105
1106         if (list_empty(&drbg->test_data.list)) {
1107                 drbg_string_fill(&data1, drbg->test_data.buf,
1108                                  drbg->test_data.len);
1109                 pr_devel("DRBG: using test entropy\n");
1110         } else {
1111                 /* Get seed from in-kernel /dev/urandom */
1112                 get_random_bytes(drbg->seed_buf, drbg->seed_buf_len);
1113
1114                 /* Get seed from Jitter RNG */
1115                 if (!drbg->jent ||
1116                     crypto_rng_get_bytes(drbg->jent,
1117                                          drbg->seed_buf + drbg->seed_buf_len,
1118                                          drbg->seed_buf_len)) {
1119                         drbg_string_fill(&data1, drbg->seed_buf,
1120                                          drbg->seed_buf_len);
1121                         pr_devel("DRBG: (re)seeding with %zu bytes of entropy\n",
1122                                  drbg->seed_buf_len);
1123                 } else {
1124                         drbg_string_fill(&data1, drbg->seed_buf,
1125                                          drbg->seed_buf_len * 2);
1126                         pr_devel("DRBG: (re)seeding with %zu bytes of entropy\n",
1127                                  drbg->seed_buf_len * 2);
1128                 }
1129         }
1130         list_add_tail(&data1.list, &seedlist);
1131
1132         /*
1133          * concatenation of entropy with personalization str / addtl input)
1134          * the variable pers is directly handed in by the caller, so check its
1135          * contents whether it is appropriate
1136          */
1137         if (pers && pers->buf && 0 < pers->len) {
1138                 list_add_tail(&pers->list, &seedlist);
1139                 pr_devel("DRBG: using personalization string\n");
1140         }
1141
1142         if (!reseed) {
1143                 memset(drbg->V, 0, drbg_statelen(drbg));
1144                 memset(drbg->C, 0, drbg_statelen(drbg));
1145         }
1146
1147         ret = __drbg_seed(drbg, &seedlist, reseed);
1148
1149         /*
1150          * Clear the initial entropy buffer as the async call may not overwrite
1151          * that buffer for quite some time.
1152          */
1153         memzero_explicit(drbg->seed_buf, drbg->seed_buf_len * 2);
1154         if (ret)
1155                 goto out;
1156         /*
1157          * For all subsequent seeding calls, we only need the seed buffer
1158          * equal to the security strength of the DRBG. We undo the calculation
1159          * in drbg_alloc_state.
1160          */
1161         if (!reseed)
1162                 drbg->seed_buf_len = drbg->seed_buf_len / 3 * 2;
1163
1164         /* Invoke asynchronous seeding unless DRBG is in test mode. */
1165         if (!list_empty(&drbg->test_data.list) && !reseed)
1166                 schedule_work(&drbg->seed_work);
1167
1168 out:
1169         return ret;
1170 }
1171
1172 /* Free all substructures in a DRBG state without the DRBG state structure */
1173 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1174 {
1175         if (!drbg)
1176                 return;
1177         kzfree(drbg->V);
1178         drbg->V = NULL;
1179         kzfree(drbg->C);
1180         drbg->C = NULL;
1181         kzfree(drbg->scratchpad);
1182         drbg->scratchpad = NULL;
1183         drbg->reseed_ctr = 0;
1184         drbg->d_ops = NULL;
1185         drbg->core = NULL;
1186 #ifdef CONFIG_CRYPTO_FIPS
1187         kzfree(drbg->prev);
1188         drbg->prev = NULL;
1189         drbg->fips_primed = false;
1190 #endif
1191         kzfree(drbg->seed_buf);
1192         drbg->seed_buf = NULL;
1193         if (drbg->jent) {
1194                 crypto_free_rng(drbg->jent);
1195                 drbg->jent = NULL;
1196         }
1197 }
1198
1199 /*
1200  * Allocate all sub-structures for a DRBG state.
1201  * The DRBG state structure must already be allocated.
1202  */
1203 static inline int drbg_alloc_state(struct drbg_state *drbg)
1204 {
1205         int ret = -ENOMEM;
1206         unsigned int sb_size = 0;
1207
1208         switch (drbg->core->flags & DRBG_TYPE_MASK) {
1209 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1210         case DRBG_HMAC:
1211                 drbg->d_ops = &drbg_hmac_ops;
1212                 break;
1213 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1214 #ifdef CONFIG_CRYPTO_DRBG_HASH
1215         case DRBG_HASH:
1216                 drbg->d_ops = &drbg_hash_ops;
1217                 break;
1218 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1219 #ifdef CONFIG_CRYPTO_DRBG_CTR
1220         case DRBG_CTR:
1221                 drbg->d_ops = &drbg_ctr_ops;
1222                 break;
1223 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1224         default:
1225                 ret = -EOPNOTSUPP;
1226                 goto err;
1227         }
1228
1229         drbg->V = kmalloc(drbg_statelen(drbg), GFP_KERNEL);
1230         if (!drbg->V)
1231                 goto err;
1232         drbg->C = kmalloc(drbg_statelen(drbg), GFP_KERNEL);
1233         if (!drbg->C)
1234                 goto err;
1235 #ifdef CONFIG_CRYPTO_FIPS
1236         drbg->prev = kmalloc(drbg_blocklen(drbg), GFP_KERNEL);
1237         if (!drbg->prev)
1238                 goto err;
1239         drbg->fips_primed = false;
1240 #endif
1241         /* scratchpad is only generated for CTR and Hash */
1242         if (drbg->core->flags & DRBG_HMAC)
1243                 sb_size = 0;
1244         else if (drbg->core->flags & DRBG_CTR)
1245                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1246                           drbg_statelen(drbg) + /* df_data */
1247                           drbg_blocklen(drbg) + /* pad */
1248                           drbg_blocklen(drbg) + /* iv */
1249                           drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1250         else
1251                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1252
1253         if (0 < sb_size) {
1254                 drbg->scratchpad = kzalloc(sb_size, GFP_KERNEL);
1255                 if (!drbg->scratchpad)
1256                         goto err;
1257         }
1258
1259         /*
1260          * Gather entropy equal to the security strength of the DRBG.
1261          * With a derivation function, a nonce is required in addition
1262          * to the entropy. A nonce must be at least 1/2 of the security
1263          * strength of the DRBG in size. Thus, entropy * nonce is 3/2
1264          * of the strength. The consideration of a nonce is only
1265          * applicable during initial seeding.
1266          */
1267         drbg->seed_buf_len = drbg_sec_strength(drbg->core->flags);
1268         if (!drbg->seed_buf_len) {
1269                 ret = -EFAULT;
1270                 goto err;
1271         }
1272         /*
1273          * Ensure we have sufficient buffer space for initial seed which
1274          * consists of the seed from get_random_bytes and the Jitter RNG.
1275          */
1276         drbg->seed_buf_len = ((drbg->seed_buf_len + 1) / 2) * 3;
1277         drbg->seed_buf = kzalloc(drbg->seed_buf_len * 2, GFP_KERNEL);
1278         if (!drbg->seed_buf)
1279                 goto err;
1280
1281         INIT_WORK(&drbg->seed_work, drbg_async_seed);
1282
1283         drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1284         if(IS_ERR(drbg->jent))
1285         {
1286                 pr_info("DRBG: could not allocate Jitter RNG handle for seeding\n");
1287                 /*
1288                  * As the Jitter RNG is a module that may not be present, we
1289                  * continue with the operation and do not fully tie the DRBG
1290                  * to the Jitter RNG.
1291                  */
1292                 drbg->jent = NULL;
1293         }
1294
1295         return 0;
1296
1297 err:
1298         drbg_dealloc_state(drbg);
1299         return ret;
1300 }
1301
1302 /*************************************************************************
1303  * DRBG interface functions
1304  *************************************************************************/
1305
1306 /*
1307  * DRBG generate function as required by SP800-90A - this function
1308  * generates random numbers
1309  *
1310  * @drbg DRBG state handle
1311  * @buf Buffer where to store the random numbers -- the buffer must already
1312  *      be pre-allocated by caller
1313  * @buflen Length of output buffer - this value defines the number of random
1314  *         bytes pulled from DRBG
1315  * @addtl Additional input that is mixed into state, may be NULL -- note
1316  *        the entropy is pulled by the DRBG internally unconditionally
1317  *        as defined in SP800-90A. The additional input is mixed into
1318  *        the state in addition to the pulled entropy.
1319  *
1320  * return: 0 when all bytes are generated; < 0 in case of an error
1321  */
1322 static int drbg_generate(struct drbg_state *drbg,
1323                          unsigned char *buf, unsigned int buflen,
1324                          struct drbg_string *addtl)
1325 {
1326         int len = 0;
1327         LIST_HEAD(addtllist);
1328
1329         if (!drbg->core) {
1330                 pr_devel("DRBG: not yet seeded\n");
1331                 return -EINVAL;
1332         }
1333         if (0 == buflen || !buf) {
1334                 pr_devel("DRBG: no output buffer provided\n");
1335                 return -EINVAL;
1336         }
1337         if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1338                 pr_devel("DRBG: wrong format of additional information\n");
1339                 return -EINVAL;
1340         }
1341
1342         /* 9.3.1 step 2 */
1343         len = -EINVAL;
1344         if (buflen > (drbg_max_request_bytes(drbg))) {
1345                 pr_devel("DRBG: requested random numbers too large %u\n",
1346                          buflen);
1347                 goto err;
1348         }
1349
1350         /* 9.3.1 step 3 is implicit with the chosen DRBG */
1351
1352         /* 9.3.1 step 4 */
1353         if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1354                 pr_devel("DRBG: additional information string too long %zu\n",
1355                          addtl->len);
1356                 goto err;
1357         }
1358         /* 9.3.1 step 5 is implicit with the chosen DRBG */
1359
1360         /*
1361          * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1362          * here. The spec is a bit convoluted here, we make it simpler.
1363          */
1364         if ((drbg_max_requests(drbg)) < drbg->reseed_ctr)
1365                 drbg->seeded = false;
1366
1367         if (drbg->pr || !drbg->seeded) {
1368                 pr_devel("DRBG: reseeding before generation (prediction "
1369                          "resistance: %s, state %s)\n",
1370                          drbg->pr ? "true" : "false",
1371                          drbg->seeded ? "seeded" : "unseeded");
1372                 /* 9.3.1 steps 7.1 through 7.3 */
1373                 len = drbg_seed(drbg, addtl, true);
1374                 if (len)
1375                         goto err;
1376                 /* 9.3.1 step 7.4 */
1377                 addtl = NULL;
1378         }
1379
1380         if (addtl && 0 < addtl->len)
1381                 list_add_tail(&addtl->list, &addtllist);
1382         /* 9.3.1 step 8 and 10 */
1383         len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1384
1385         /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1386         drbg->reseed_ctr++;
1387         if (0 >= len)
1388                 goto err;
1389
1390         /*
1391          * Section 11.3.3 requires to re-perform self tests after some
1392          * generated random numbers. The chosen value after which self
1393          * test is performed is arbitrary, but it should be reasonable.
1394          * However, we do not perform the self tests because of the following
1395          * reasons: it is mathematically impossible that the initial self tests
1396          * were successfully and the following are not. If the initial would
1397          * pass and the following would not, the kernel integrity is violated.
1398          * In this case, the entire kernel operation is questionable and it
1399          * is unlikely that the integrity violation only affects the
1400          * correct operation of the DRBG.
1401          *
1402          * Albeit the following code is commented out, it is provided in
1403          * case somebody has a need to implement the test of 11.3.3.
1404          */
1405 #if 0
1406         if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1407                 int err = 0;
1408                 pr_devel("DRBG: start to perform self test\n");
1409                 if (drbg->core->flags & DRBG_HMAC)
1410                         err = alg_test("drbg_pr_hmac_sha256",
1411                                        "drbg_pr_hmac_sha256", 0, 0);
1412                 else if (drbg->core->flags & DRBG_CTR)
1413                         err = alg_test("drbg_pr_ctr_aes128",
1414                                        "drbg_pr_ctr_aes128", 0, 0);
1415                 else
1416                         err = alg_test("drbg_pr_sha256",
1417                                        "drbg_pr_sha256", 0, 0);
1418                 if (err) {
1419                         pr_err("DRBG: periodical self test failed\n");
1420                         /*
1421                          * uninstantiate implies that from now on, only errors
1422                          * are returned when reusing this DRBG cipher handle
1423                          */
1424                         drbg_uninstantiate(drbg);
1425                         return 0;
1426                 } else {
1427                         pr_devel("DRBG: self test successful\n");
1428                 }
1429         }
1430 #endif
1431
1432         /*
1433          * All operations were successful, return 0 as mandated by
1434          * the kernel crypto API interface.
1435          */
1436         len = 0;
1437 err:
1438         return len;
1439 }
1440
1441 /*
1442  * Wrapper around drbg_generate which can pull arbitrary long strings
1443  * from the DRBG without hitting the maximum request limitation.
1444  *
1445  * Parameters: see drbg_generate
1446  * Return codes: see drbg_generate -- if one drbg_generate request fails,
1447  *               the entire drbg_generate_long request fails
1448  */
1449 static int drbg_generate_long(struct drbg_state *drbg,
1450                               unsigned char *buf, unsigned int buflen,
1451                               struct drbg_string *addtl)
1452 {
1453         unsigned int len = 0;
1454         unsigned int slice = 0;
1455         do {
1456                 int err = 0;
1457                 unsigned int chunk = 0;
1458                 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1459                 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1460                 mutex_lock(&drbg->drbg_mutex);
1461                 err = drbg_generate(drbg, buf + len, chunk, addtl);
1462                 mutex_unlock(&drbg->drbg_mutex);
1463                 if (0 > err)
1464                         return err;
1465                 len += chunk;
1466         } while (slice > 0 && (len < buflen));
1467         return 0;
1468 }
1469
1470 /*
1471  * DRBG instantiation function as required by SP800-90A - this function
1472  * sets up the DRBG handle, performs the initial seeding and all sanity
1473  * checks required by SP800-90A
1474  *
1475  * @drbg memory of state -- if NULL, new memory is allocated
1476  * @pers Personalization string that is mixed into state, may be NULL -- note
1477  *       the entropy is pulled by the DRBG internally unconditionally
1478  *       as defined in SP800-90A. The additional input is mixed into
1479  *       the state in addition to the pulled entropy.
1480  * @coreref reference to core
1481  * @pr prediction resistance enabled
1482  *
1483  * return
1484  *      0 on success
1485  *      error value otherwise
1486  */
1487 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1488                             int coreref, bool pr)
1489 {
1490         int ret;
1491         bool reseed = true;
1492
1493         pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1494                  "%s\n", coreref, pr ? "enabled" : "disabled");
1495         mutex_lock(&drbg->drbg_mutex);
1496
1497         /* 9.1 step 1 is implicit with the selected DRBG type */
1498
1499         /*
1500          * 9.1 step 2 is implicit as caller can select prediction resistance
1501          * and the flag is copied into drbg->flags --
1502          * all DRBG types support prediction resistance
1503          */
1504
1505         /* 9.1 step 4 is implicit in  drbg_sec_strength */
1506
1507         if (!drbg->core) {
1508                 drbg->core = &drbg_cores[coreref];
1509                 drbg->pr = pr;
1510                 drbg->seeded = false;
1511
1512                 ret = drbg_alloc_state(drbg);
1513                 if (ret)
1514                         goto unlock;
1515
1516                 ret = -EFAULT;
1517                 if (drbg->d_ops->crypto_init(drbg))
1518                         goto err;
1519
1520                 reseed = false;
1521         }
1522
1523         ret = drbg_seed(drbg, pers, reseed);
1524
1525         if (ret && !reseed) {
1526                 drbg->d_ops->crypto_fini(drbg);
1527                 goto err;
1528         }
1529
1530         mutex_unlock(&drbg->drbg_mutex);
1531         return ret;
1532
1533 err:
1534         drbg_dealloc_state(drbg);
1535 unlock:
1536         mutex_unlock(&drbg->drbg_mutex);
1537         return ret;
1538 }
1539
1540 /*
1541  * DRBG uninstantiate function as required by SP800-90A - this function
1542  * frees all buffers and the DRBG handle
1543  *
1544  * @drbg DRBG state handle
1545  *
1546  * return
1547  *      0 on success
1548  */
1549 static int drbg_uninstantiate(struct drbg_state *drbg)
1550 {
1551         cancel_work_sync(&drbg->seed_work);
1552         if (drbg->d_ops)
1553                 drbg->d_ops->crypto_fini(drbg);
1554         drbg_dealloc_state(drbg);
1555         /* no scrubbing of test_data -- this shall survive an uninstantiate */
1556         return 0;
1557 }
1558
1559 /*
1560  * Helper function for setting the test data in the DRBG
1561  *
1562  * @drbg DRBG state handle
1563  * @data test data
1564  * @len test data length
1565  */
1566 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1567                                    const u8 *data, unsigned int len)
1568 {
1569         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1570
1571         mutex_lock(&drbg->drbg_mutex);
1572         drbg_string_fill(&drbg->test_data, data, len);
1573         mutex_unlock(&drbg->drbg_mutex);
1574 }
1575
1576 /***************************************************************
1577  * Kernel crypto API cipher invocations requested by DRBG
1578  ***************************************************************/
1579
1580 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1581 struct sdesc {
1582         struct shash_desc shash;
1583         char ctx[];
1584 };
1585
1586 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1587 {
1588         struct sdesc *sdesc;
1589         struct crypto_shash *tfm;
1590
1591         tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1592         if (IS_ERR(tfm)) {
1593                 pr_info("DRBG: could not allocate digest TFM handle\n");
1594                 return PTR_ERR(tfm);
1595         }
1596         BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1597         sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1598                         GFP_KERNEL);
1599         if (!sdesc) {
1600                 crypto_free_shash(tfm);
1601                 return -ENOMEM;
1602         }
1603
1604         sdesc->shash.tfm = tfm;
1605         sdesc->shash.flags = 0;
1606         drbg->priv_data = sdesc;
1607         return 0;
1608 }
1609
1610 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1611 {
1612         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1613         if (sdesc) {
1614                 crypto_free_shash(sdesc->shash.tfm);
1615                 kzfree(sdesc);
1616         }
1617         drbg->priv_data = NULL;
1618         return 0;
1619 }
1620
1621 static int drbg_kcapi_hash(struct drbg_state *drbg, const unsigned char *key,
1622                            unsigned char *outval, const struct list_head *in)
1623 {
1624         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1625         struct drbg_string *input = NULL;
1626
1627         if (key)
1628                 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1629         crypto_shash_init(&sdesc->shash);
1630         list_for_each_entry(input, in, list)
1631                 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1632         return crypto_shash_final(&sdesc->shash, outval);
1633 }
1634 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1635
1636 #ifdef CONFIG_CRYPTO_DRBG_CTR
1637 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1638 {
1639         int ret = 0;
1640         struct crypto_cipher *tfm;
1641
1642         tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1643         if (IS_ERR(tfm)) {
1644                 pr_info("DRBG: could not allocate cipher TFM handle\n");
1645                 return PTR_ERR(tfm);
1646         }
1647         BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1648         drbg->priv_data = tfm;
1649         return ret;
1650 }
1651
1652 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1653 {
1654         struct crypto_cipher *tfm =
1655                 (struct crypto_cipher *)drbg->priv_data;
1656         if (tfm)
1657                 crypto_free_cipher(tfm);
1658         drbg->priv_data = NULL;
1659         return 0;
1660 }
1661
1662 static int drbg_kcapi_sym(struct drbg_state *drbg, const unsigned char *key,
1663                           unsigned char *outval, const struct drbg_string *in)
1664 {
1665         struct crypto_cipher *tfm =
1666                 (struct crypto_cipher *)drbg->priv_data;
1667
1668         crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1669         /* there is only component in *in */
1670         BUG_ON(in->len < drbg_blocklen(drbg));
1671         crypto_cipher_encrypt_one(tfm, outval, in->buf);
1672         return 0;
1673 }
1674 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1675
1676 /***************************************************************
1677  * Kernel crypto API interface to register DRBG
1678  ***************************************************************/
1679
1680 /*
1681  * Look up the DRBG flags by given kernel crypto API cra_name
1682  * The code uses the drbg_cores definition to do this
1683  *
1684  * @cra_name kernel crypto API cra_name
1685  * @coreref reference to integer which is filled with the pointer to
1686  *  the applicable core
1687  * @pr reference for setting prediction resistance
1688  *
1689  * return: flags
1690  */
1691 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1692                                          int *coreref, bool *pr)
1693 {
1694         int i = 0;
1695         size_t start = 0;
1696         int len = 0;
1697
1698         *pr = true;
1699         /* disassemble the names */
1700         if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1701                 start = 10;
1702                 *pr = false;
1703         } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1704                 start = 8;
1705         } else {
1706                 return;
1707         }
1708
1709         /* remove the first part */
1710         len = strlen(cra_driver_name) - start;
1711         for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1712                 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1713                             len)) {
1714                         *coreref = i;
1715                         return;
1716                 }
1717         }
1718 }
1719
1720 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1721 {
1722         struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1723
1724         mutex_init(&drbg->drbg_mutex);
1725
1726         return 0;
1727 }
1728
1729 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1730 {
1731         drbg_uninstantiate(crypto_tfm_ctx(tfm));
1732 }
1733
1734 /*
1735  * Generate random numbers invoked by the kernel crypto API:
1736  * The API of the kernel crypto API is extended as follows:
1737  *
1738  * src is additional input supplied to the RNG.
1739  * slen is the length of src.
1740  * dst is the output buffer where random data is to be stored.
1741  * dlen is the length of dst.
1742  */
1743 static int drbg_kcapi_random(struct crypto_rng *tfm,
1744                              const u8 *src, unsigned int slen,
1745                              u8 *dst, unsigned int dlen)
1746 {
1747         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1748         struct drbg_string *addtl = NULL;
1749         struct drbg_string string;
1750
1751         if (slen) {
1752                 /* linked list variable is now local to allow modification */
1753                 drbg_string_fill(&string, src, slen);
1754                 addtl = &string;
1755         }
1756
1757         return drbg_generate_long(drbg, dst, dlen, addtl);
1758 }
1759
1760 /*
1761  * Seed the DRBG invoked by the kernel crypto API
1762  */
1763 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1764                            const u8 *seed, unsigned int slen)
1765 {
1766         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1767         struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1768         bool pr = false;
1769         struct drbg_string string;
1770         struct drbg_string *seed_string = NULL;
1771         int coreref = 0;
1772
1773         drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1774                               &pr);
1775         if (0 < slen) {
1776                 drbg_string_fill(&string, seed, slen);
1777                 seed_string = &string;
1778         }
1779
1780         return drbg_instantiate(drbg, seed_string, coreref, pr);
1781 }
1782
1783 /***************************************************************
1784  * Kernel module: code to load the module
1785  ***************************************************************/
1786
1787 /*
1788  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1789  * of the error handling.
1790  *
1791  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1792  * as seed source of get_random_bytes does not fail.
1793  *
1794  * Note 2: There is no sensible way of testing the reseed counter
1795  * enforcement, so skip it.
1796  */
1797 static inline int __init drbg_healthcheck_sanity(void)
1798 {
1799         int len = 0;
1800 #define OUTBUFLEN 16
1801         unsigned char buf[OUTBUFLEN];
1802         struct drbg_state *drbg = NULL;
1803         int ret = -EFAULT;
1804         int rc = -EFAULT;
1805         bool pr = false;
1806         int coreref = 0;
1807         struct drbg_string addtl;
1808         size_t max_addtllen, max_request_bytes;
1809
1810         /* only perform test in FIPS mode */
1811         if (!fips_enabled)
1812                 return 0;
1813
1814 #ifdef CONFIG_CRYPTO_DRBG_CTR
1815         drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
1816 #elif defined CONFIG_CRYPTO_DRBG_HASH
1817         drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
1818 #else
1819         drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
1820 #endif
1821
1822         drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
1823         if (!drbg)
1824                 return -ENOMEM;
1825
1826         mutex_init(&drbg->drbg_mutex);
1827
1828         /*
1829          * if the following tests fail, it is likely that there is a buffer
1830          * overflow as buf is much smaller than the requested or provided
1831          * string lengths -- in case the error handling does not succeed
1832          * we may get an OOPS. And we want to get an OOPS as this is a
1833          * grave bug.
1834          */
1835
1836         /* get a valid instance of DRBG for following tests */
1837         ret = drbg_instantiate(drbg, NULL, coreref, pr);
1838         if (ret) {
1839                 rc = ret;
1840                 goto outbuf;
1841         }
1842         max_addtllen = drbg_max_addtl(drbg);
1843         max_request_bytes = drbg_max_request_bytes(drbg);
1844         drbg_string_fill(&addtl, buf, max_addtllen + 1);
1845         /* overflow addtllen with additonal info string */
1846         len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
1847         BUG_ON(0 < len);
1848         /* overflow max_bits */
1849         len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
1850         BUG_ON(0 < len);
1851         drbg_uninstantiate(drbg);
1852
1853         /* overflow max addtllen with personalization string */
1854         ret = drbg_instantiate(drbg, &addtl, coreref, pr);
1855         BUG_ON(0 == ret);
1856         /* all tests passed */
1857         rc = 0;
1858
1859         pr_devel("DRBG: Sanity tests for failure code paths successfully "
1860                  "completed\n");
1861
1862         drbg_uninstantiate(drbg);
1863 outbuf:
1864         kzfree(drbg);
1865         return rc;
1866 }
1867
1868 static struct rng_alg drbg_algs[22];
1869
1870 /*
1871  * Fill the array drbg_algs used to register the different DRBGs
1872  * with the kernel crypto API. To fill the array, the information
1873  * from drbg_cores[] is used.
1874  */
1875 static inline void __init drbg_fill_array(struct rng_alg *alg,
1876                                           const struct drbg_core *core, int pr)
1877 {
1878         int pos = 0;
1879         static int priority = 100;
1880
1881         memcpy(alg->base.cra_name, "stdrng", 6);
1882         if (pr) {
1883                 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
1884                 pos = 8;
1885         } else {
1886                 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
1887                 pos = 10;
1888         }
1889         memcpy(alg->base.cra_driver_name + pos, core->cra_name,
1890                strlen(core->cra_name));
1891
1892         alg->base.cra_priority = priority;
1893         priority++;
1894         /*
1895          * If FIPS mode enabled, the selected DRBG shall have the
1896          * highest cra_priority over other stdrng instances to ensure
1897          * it is selected.
1898          */
1899         if (fips_enabled)
1900                 alg->base.cra_priority += 200;
1901
1902         alg->base.cra_ctxsize   = sizeof(struct drbg_state);
1903         alg->base.cra_module    = THIS_MODULE;
1904         alg->base.cra_init      = drbg_kcapi_init;
1905         alg->base.cra_exit      = drbg_kcapi_cleanup;
1906         alg->generate           = drbg_kcapi_random;
1907         alg->seed               = drbg_kcapi_seed;
1908         alg->set_ent            = drbg_kcapi_set_entropy;
1909         alg->seedsize           = 0;
1910 }
1911
1912 static int __init drbg_init(void)
1913 {
1914         unsigned int i = 0; /* pointer to drbg_algs */
1915         unsigned int j = 0; /* pointer to drbg_cores */
1916         int ret = -EFAULT;
1917
1918         ret = drbg_healthcheck_sanity();
1919         if (ret)
1920                 return ret;
1921
1922         if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
1923                 pr_info("DRBG: Cannot register all DRBG types"
1924                         "(slots needed: %zu, slots available: %zu)\n",
1925                         ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
1926                 return ret;
1927         }
1928
1929         /*
1930          * each DRBG definition can be used with PR and without PR, thus
1931          * we instantiate each DRBG in drbg_cores[] twice.
1932          *
1933          * As the order of placing them into the drbg_algs array matters
1934          * (the later DRBGs receive a higher cra_priority) we register the
1935          * prediction resistance DRBGs first as the should not be too
1936          * interesting.
1937          */
1938         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
1939                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
1940         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
1941                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
1942         return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
1943 }
1944
1945 static void __exit drbg_exit(void)
1946 {
1947         crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
1948 }
1949
1950 module_init(drbg_init);
1951 module_exit(drbg_exit);
1952 #ifndef CRYPTO_DRBG_HASH_STRING
1953 #define CRYPTO_DRBG_HASH_STRING ""
1954 #endif
1955 #ifndef CRYPTO_DRBG_HMAC_STRING
1956 #define CRYPTO_DRBG_HMAC_STRING ""
1957 #endif
1958 #ifndef CRYPTO_DRBG_CTR_STRING
1959 #define CRYPTO_DRBG_CTR_STRING ""
1960 #endif
1961 MODULE_LICENSE("GPL");
1962 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
1963 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
1964                    "using following cores: "
1965                    CRYPTO_DRBG_HASH_STRING
1966                    CRYPTO_DRBG_HMAC_STRING
1967                    CRYPTO_DRBG_CTR_STRING);