mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-03 17:40:04 +00:00
![Brian Masney](/assets/img/avatar_default.png)
The generate function in struct rng_alg expects that the destination
buffer is completely filled if the function returns 0. qcom_rng_read()
can run into a situation where the buffer is partially filled with
randomness and the remaining part of the buffer is zeroed since
qcom_rng_generate() doesn't check the return value. This issue can
be reproduced by running the following from libkcapi:
kcapi-rng -b 9000000 > OUTFILE
The generated OUTFILE will have three huge sections that contain all
zeros, and this is caused by the code where the test
'val & PRNG_STATUS_DATA_AVAIL' fails.
Let's fix this issue by ensuring that qcom_rng_read() always returns
with a full buffer if the function returns success. Let's also have
qcom_rng_generate() return the correct value.
Here's some statistics from the ent project
(https://www.fourmilab.ch/random/) that shows information about the
quality of the generated numbers:
$ ent -c qcom-random-before
Value Char Occurrences Fraction
0 606748 0.067416
1 33104 0.003678
2 33001 0.003667
...
253 � 32883 0.003654
254 � 33035 0.003671
255 � 33239 0.003693
Total: 9000000 1.000000
Entropy = 7.811590 bits per byte.
Optimum compression would reduce the size
of this 9000000 byte file by 2 percent.
Chi square distribution for 9000000 samples is 9329962.81, and
randomly would exceed this value less than 0.01 percent of the
times.
Arithmetic mean value of data bytes is 119.3731 (127.5 = random).
Monte Carlo value for Pi is 3.197293333 (error 1.77 percent).
Serial correlation coefficient is 0.159130 (totally uncorrelated =
0.0).
Without this patch, the results of the chi-square test is 0.01%, and
the numbers are certainly not random according to ent's project page.
The results improve with this patch:
$ ent -c qcom-random-after
Value Char Occurrences Fraction
0 35432 0.003937
1 35127 0.003903
2 35424 0.003936
...
253 � 35201 0.003911
254 � 34835 0.003871
255 � 35368 0.003930
Total: 9000000 1.000000
Entropy = 7.999979 bits per byte.
Optimum compression would reduce the size
of this 9000000 byte file by 0 percent.
Chi square distribution for 9000000 samples is 258.77, and randomly
would exceed this value 42.24 percent of the times.
Arithmetic mean value of data bytes is 127.5006 (127.5 = random).
Monte Carlo value for Pi is 3.141277333 (error 0.01 percent).
Serial correlation coefficient is 0.000468 (totally uncorrelated =
0.0).
This change was tested on a Nexus 5 phone (msm8974 SoC).
Signed-off-by: Brian Masney <bmasney@redhat.com>
Fixes: ceec5f5b59
("crypto: qcom-rng - Add Qcom prng driver")
Cc: stable@vger.kernel.org # 4.19+
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
231 lines
5 KiB
C
231 lines
5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
// Copyright (c) 2017-18 Linaro Limited
|
|
//
|
|
// Based on msm-rng.c and downstream driver
|
|
|
|
#include <crypto/internal/rng.h>
|
|
#include <linux/acpi.h>
|
|
#include <linux/clk.h>
|
|
#include <linux/crypto.h>
|
|
#include <linux/io.h>
|
|
#include <linux/iopoll.h>
|
|
#include <linux/module.h>
|
|
#include <linux/of.h>
|
|
#include <linux/platform_device.h>
|
|
|
|
/* Device specific register offsets */
|
|
#define PRNG_DATA_OUT 0x0000
|
|
#define PRNG_STATUS 0x0004
|
|
#define PRNG_LFSR_CFG 0x0100
|
|
#define PRNG_CONFIG 0x0104
|
|
|
|
/* Device specific register masks and config values */
|
|
#define PRNG_LFSR_CFG_MASK 0x0000ffff
|
|
#define PRNG_LFSR_CFG_CLOCKS 0x0000dddd
|
|
#define PRNG_CONFIG_HW_ENABLE BIT(1)
|
|
#define PRNG_STATUS_DATA_AVAIL BIT(0)
|
|
|
|
#define WORD_SZ 4
|
|
|
|
struct qcom_rng {
|
|
struct mutex lock;
|
|
void __iomem *base;
|
|
struct clk *clk;
|
|
unsigned int skip_init;
|
|
};
|
|
|
|
struct qcom_rng_ctx {
|
|
struct qcom_rng *rng;
|
|
};
|
|
|
|
static struct qcom_rng *qcom_rng_dev;
|
|
|
|
static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max)
|
|
{
|
|
unsigned int currsize = 0;
|
|
u32 val;
|
|
int ret;
|
|
|
|
/* read random data from hardware */
|
|
do {
|
|
ret = readl_poll_timeout(rng->base + PRNG_STATUS, val,
|
|
val & PRNG_STATUS_DATA_AVAIL,
|
|
200, 10000);
|
|
if (ret)
|
|
return ret;
|
|
|
|
val = readl_relaxed(rng->base + PRNG_DATA_OUT);
|
|
if (!val)
|
|
return -EINVAL;
|
|
|
|
if ((max - currsize) >= WORD_SZ) {
|
|
memcpy(data, &val, WORD_SZ);
|
|
data += WORD_SZ;
|
|
currsize += WORD_SZ;
|
|
} else {
|
|
/* copy only remaining bytes */
|
|
memcpy(data, &val, max - currsize);
|
|
}
|
|
} while (currsize < max);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int qcom_rng_generate(struct crypto_rng *tfm,
|
|
const u8 *src, unsigned int slen,
|
|
u8 *dstn, unsigned int dlen)
|
|
{
|
|
struct qcom_rng_ctx *ctx = crypto_rng_ctx(tfm);
|
|
struct qcom_rng *rng = ctx->rng;
|
|
int ret;
|
|
|
|
ret = clk_prepare_enable(rng->clk);
|
|
if (ret)
|
|
return ret;
|
|
|
|
mutex_lock(&rng->lock);
|
|
|
|
ret = qcom_rng_read(rng, dstn, dlen);
|
|
|
|
mutex_unlock(&rng->lock);
|
|
clk_disable_unprepare(rng->clk);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int qcom_rng_seed(struct crypto_rng *tfm, const u8 *seed,
|
|
unsigned int slen)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static int qcom_rng_enable(struct qcom_rng *rng)
|
|
{
|
|
u32 val;
|
|
int ret;
|
|
|
|
ret = clk_prepare_enable(rng->clk);
|
|
if (ret)
|
|
return ret;
|
|
|
|
/* Enable PRNG only if it is not already enabled */
|
|
val = readl_relaxed(rng->base + PRNG_CONFIG);
|
|
if (val & PRNG_CONFIG_HW_ENABLE)
|
|
goto already_enabled;
|
|
|
|
val = readl_relaxed(rng->base + PRNG_LFSR_CFG);
|
|
val &= ~PRNG_LFSR_CFG_MASK;
|
|
val |= PRNG_LFSR_CFG_CLOCKS;
|
|
writel(val, rng->base + PRNG_LFSR_CFG);
|
|
|
|
val = readl_relaxed(rng->base + PRNG_CONFIG);
|
|
val |= PRNG_CONFIG_HW_ENABLE;
|
|
writel(val, rng->base + PRNG_CONFIG);
|
|
|
|
already_enabled:
|
|
clk_disable_unprepare(rng->clk);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int qcom_rng_init(struct crypto_tfm *tfm)
|
|
{
|
|
struct qcom_rng_ctx *ctx = crypto_tfm_ctx(tfm);
|
|
|
|
ctx->rng = qcom_rng_dev;
|
|
|
|
if (!ctx->rng->skip_init)
|
|
return qcom_rng_enable(ctx->rng);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct rng_alg qcom_rng_alg = {
|
|
.generate = qcom_rng_generate,
|
|
.seed = qcom_rng_seed,
|
|
.seedsize = 0,
|
|
.base = {
|
|
.cra_name = "stdrng",
|
|
.cra_driver_name = "qcom-rng",
|
|
.cra_flags = CRYPTO_ALG_TYPE_RNG,
|
|
.cra_priority = 300,
|
|
.cra_ctxsize = sizeof(struct qcom_rng_ctx),
|
|
.cra_module = THIS_MODULE,
|
|
.cra_init = qcom_rng_init,
|
|
}
|
|
};
|
|
|
|
static int qcom_rng_probe(struct platform_device *pdev)
|
|
{
|
|
struct qcom_rng *rng;
|
|
int ret;
|
|
|
|
rng = devm_kzalloc(&pdev->dev, sizeof(*rng), GFP_KERNEL);
|
|
if (!rng)
|
|
return -ENOMEM;
|
|
|
|
platform_set_drvdata(pdev, rng);
|
|
mutex_init(&rng->lock);
|
|
|
|
rng->base = devm_platform_ioremap_resource(pdev, 0);
|
|
if (IS_ERR(rng->base))
|
|
return PTR_ERR(rng->base);
|
|
|
|
/* ACPI systems have clk already on, so skip clk_get */
|
|
if (!has_acpi_companion(&pdev->dev)) {
|
|
rng->clk = devm_clk_get(&pdev->dev, "core");
|
|
if (IS_ERR(rng->clk))
|
|
return PTR_ERR(rng->clk);
|
|
}
|
|
|
|
|
|
rng->skip_init = (unsigned long)device_get_match_data(&pdev->dev);
|
|
|
|
qcom_rng_dev = rng;
|
|
ret = crypto_register_rng(&qcom_rng_alg);
|
|
if (ret) {
|
|
dev_err(&pdev->dev, "Register crypto rng failed: %d\n", ret);
|
|
qcom_rng_dev = NULL;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int qcom_rng_remove(struct platform_device *pdev)
|
|
{
|
|
crypto_unregister_rng(&qcom_rng_alg);
|
|
|
|
qcom_rng_dev = NULL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
#if IS_ENABLED(CONFIG_ACPI)
|
|
static const struct acpi_device_id qcom_rng_acpi_match[] = {
|
|
{ .id = "QCOM8160", .driver_data = 1 },
|
|
{}
|
|
};
|
|
MODULE_DEVICE_TABLE(acpi, qcom_rng_acpi_match);
|
|
#endif
|
|
|
|
static const struct of_device_id qcom_rng_of_match[] = {
|
|
{ .compatible = "qcom,prng", .data = (void *)0},
|
|
{ .compatible = "qcom,prng-ee", .data = (void *)1},
|
|
{}
|
|
};
|
|
MODULE_DEVICE_TABLE(of, qcom_rng_of_match);
|
|
|
|
static struct platform_driver qcom_rng_driver = {
|
|
.probe = qcom_rng_probe,
|
|
.remove = qcom_rng_remove,
|
|
.driver = {
|
|
.name = KBUILD_MODNAME,
|
|
.of_match_table = of_match_ptr(qcom_rng_of_match),
|
|
.acpi_match_table = ACPI_PTR(qcom_rng_acpi_match),
|
|
}
|
|
};
|
|
module_platform_driver(qcom_rng_driver);
|
|
|
|
MODULE_ALIAS("platform:" KBUILD_MODNAME);
|
|
MODULE_DESCRIPTION("Qualcomm random number generator driver");
|
|
MODULE_LICENSE("GPL v2");
|