1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * s390 arch random implementation. 4 * 5 * Copyright IBM Corp. 2017, 2018 6 * Author(s): Harald Freudenberger 7 * 8 * The s390_arch_random_generate() function may be called from random.c 9 * in interrupt context. So this implementation does the best to be very 10 * fast. There is a buffer of random data which is asynchronously checked 11 * and filled by a workqueue thread. 12 * If there are enough bytes in the buffer the s390_arch_random_generate() 13 * just delivers these bytes. Otherwise false is returned until the 14 * worker thread refills the buffer. 15 * The worker fills the rng buffer by pulling fresh entropy from the 16 * high quality (but slow) true hardware random generator. This entropy 17 * is then spread over the buffer with an pseudo random generator PRNG. 18 * As the arch_get_random_seed_long() fetches 8 bytes and the calling 19 * function add_interrupt_randomness() counts this as 1 bit entropy the 20 * distribution needs to make sure there is in fact 1 bit entropy contained 21 * in 8 bytes of the buffer. The current values pull 32 byte entropy 22 * and scatter this into a 2048 byte buffer. So 8 byte in the buffer 23 * will contain 1 bit of entropy. 24 * The worker thread is rescheduled based on the charge level of the 25 * buffer but at least with 500 ms delay to avoid too much CPU consumption. 26 * So the max. amount of rng data delivered via arch_get_random_seed is 27 * limited to 4k bytes per second. 28 */ 29 30 #include <linux/kernel.h> 31 #include <linux/atomic.h> 32 #include <linux/random.h> 33 #include <linux/slab.h> 34 #include <linux/static_key.h> 35 #include <linux/workqueue.h> 36 #include <asm/cpacf.h> 37 38 DEFINE_STATIC_KEY_FALSE(s390_arch_random_available); 39 40 atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0); 41 EXPORT_SYMBOL(s390_arch_random_counter); 42 43 #define ARCH_REFILL_TICKS (HZ/2) 44 #define ARCH_PRNG_SEED_SIZE 32 45 #define ARCH_RNG_BUF_SIZE 2048 46 47 static DEFINE_SPINLOCK(arch_rng_lock); 48 static u8 *arch_rng_buf; 49 static unsigned int arch_rng_buf_idx; 50 51 static void arch_rng_refill_buffer(struct work_struct *); 52 static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer); 53 54 bool s390_arch_random_generate(u8 *buf, unsigned int nbytes) 55 { 56 /* lock rng buffer */ 57 if (!spin_trylock(&arch_rng_lock)) 58 return false; 59 60 /* try to resolve the requested amount of bytes from the buffer */ 61 arch_rng_buf_idx -= nbytes; 62 if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) { 63 memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes); 64 atomic64_add(nbytes, &s390_arch_random_counter); 65 spin_unlock(&arch_rng_lock); 66 return true; 67 } 68 69 /* not enough bytes in rng buffer, refill is done asynchronously */ 70 spin_unlock(&arch_rng_lock); 71 72 return false; 73 } 74 EXPORT_SYMBOL(s390_arch_random_generate); 75 76 static void arch_rng_refill_buffer(struct work_struct *unused) 77 { 78 unsigned int delay = ARCH_REFILL_TICKS; 79 80 spin_lock(&arch_rng_lock); 81 if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) { 82 /* buffer is exhausted and needs refill */ 83 u8 seed[ARCH_PRNG_SEED_SIZE]; 84 u8 prng_wa[240]; 85 /* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */ 86 cpacf_trng(NULL, 0, seed, sizeof(seed)); 87 /* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */ 88 memset(prng_wa, 0, sizeof(prng_wa)); 89 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 90 &prng_wa, NULL, 0, seed, sizeof(seed)); 91 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 92 &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0); 93 arch_rng_buf_idx = ARCH_RNG_BUF_SIZE; 94 } 95 delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE; 96 spin_unlock(&arch_rng_lock); 97 98 /* kick next check */ 99 queue_delayed_work(system_long_wq, &arch_rng_work, delay); 100 } 101 102 static int __init s390_arch_random_init(void) 103 { 104 /* all the needed PRNO subfunctions available ? */ 105 if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) && 106 cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { 107 108 /* alloc arch random working buffer */ 109 arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL); 110 if (!arch_rng_buf) 111 return -ENOMEM; 112 113 /* kick worker queue job to fill the random buffer */ 114 queue_delayed_work(system_long_wq, 115 &arch_rng_work, ARCH_REFILL_TICKS); 116 117 /* enable arch random to the outside world */ 118 static_branch_enable(&s390_arch_random_available); 119 } 120 121 return 0; 122 } 123 arch_initcall(s390_arch_random_init); 124