fips140-alg-registration.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Block crypto operations until tests complete
  4. *
  5. * Copyright 2021 Google LLC
  6. *
  7. * This file defines the fips140_crypto_register_*() functions, to which all
  8. * calls to crypto_register_*() in the module are redirected. These functions
  9. * override the tfm initialization function of each algorithm to insert a wait
  10. * for the module having completed its self-tests and integrity check.
  11. *
  12. * The exact field that we override depends on the algorithm type. For
  13. * algorithm types that have a strongly-typed initialization function pointer
  14. * (e.g. skcipher), we must override that, since cra_init isn't guaranteed to be
  15. * called for those despite the field being present in the base struct. For the
  16. * other algorithm types (e.g. "cipher") we must override cra_init.
  17. *
  18. * All of this applies to both normal algorithms and template instances.
  19. *
  20. * The purpose of all of this is to meet a FIPS requirement where the module
  21. * must not produce any output from cryptographic algorithms until it completes
  22. * its tests. Technically this is impossible, but this solution meets the
  23. * intent of the requirement, assuming the user makes a supported sequence of
  24. * API calls. Note that we can't simply run the tests before registering the
  25. * algorithms, as the algorithms must be registered in order to run the tests.
  26. *
  27. * It would be much easier to handle this in the kernel's crypto API framework.
  28. * Unfortunately, that was deemed insufficient because the module itself is
  29. * required to do the enforcement. What is *actually* required is still very
  30. * vague, but the approach implemented here should meet the requirement.
  31. */
  32. /*
  33. * This file is the one place in fips140.ko that needs to call the kernel's real
  34. * algorithm registration functions, so #undefine all the macros from
  35. * fips140-defs.h so that the "fips140_" prefix doesn't automatically get added.
  36. */
  37. #undef aead_register_instance
  38. #undef ahash_register_instance
  39. #undef crypto_register_aead
  40. #undef crypto_register_aeads
  41. #undef crypto_register_ahash
  42. #undef crypto_register_ahashes
  43. #undef crypto_register_alg
  44. #undef crypto_register_algs
  45. #undef crypto_register_rng
  46. #undef crypto_register_rngs
  47. #undef crypto_register_shash
  48. #undef crypto_register_shashes
  49. #undef crypto_register_skcipher
  50. #undef crypto_register_skciphers
  51. #undef shash_register_instance
  52. #undef skcipher_register_instance
  53. #include <crypto/algapi.h>
  54. #include <crypto/internal/aead.h>
  55. #include <crypto/internal/hash.h>
  56. #include <crypto/internal/rng.h>
  57. #include <crypto/internal/skcipher.h>
  58. #include <linux/xarray.h>
  59. #include "fips140-module.h"
  60. /* Indicates whether the self-tests and integrity check have completed */
  61. DECLARE_COMPLETION(fips140_tests_done);
  62. /* The thread running the self-tests and integrity check */
  63. struct task_struct *fips140_init_thread;
  64. /*
  65. * Map from crypto_alg to original initialization function (possibly NULL)
  66. *
  67. * Note: unregistering an algorithm will leak its map entry, as we don't bother
  68. * to remove it. This should be fine since fips140.ko can't be unloaded. The
  69. * proper solution would be to store the original function pointer in a new
  70. * field in 'struct crypto_alg', but that would require kernel support.
  71. */
  72. static DEFINE_XARRAY(fips140_init_func_map);
  73. static bool fips140_ready(void)
  74. {
  75. return completion_done(&fips140_tests_done);
  76. }
  77. /*
  78. * Wait until crypto operations are allowed to proceed. Return true if the
  79. * tests are done, or false if the caller is the thread running the tests so it
  80. * is allowed to proceed anyway.
  81. */
  82. static bool fips140_wait_until_ready(struct crypto_alg *alg)
  83. {
  84. if (fips140_ready())
  85. return true;
  86. /*
  87. * The thread running the tests must not wait. Since tfms can only be
  88. * allocated in task context, we can reliably determine whether the
  89. * invocation is from that thread or not by checking 'current'.
  90. */
  91. if (current == fips140_init_thread)
  92. return false;
  93. pr_info("blocking user of %s until tests complete\n",
  94. alg->cra_driver_name);
  95. wait_for_completion(&fips140_tests_done);
  96. pr_info("tests done, allowing %s to proceed\n", alg->cra_driver_name);
  97. return true;
  98. }
  99. static int fips140_store_init_function(struct crypto_alg *alg, void *func)
  100. {
  101. void *ret;
  102. /*
  103. * The XArray API requires 4-byte aligned values. Although function
  104. * pointers in general aren't guaranteed to be 4-byte aligned, it should
  105. * be the case for the platforms this module is used on.
  106. */
  107. if (WARN_ON((unsigned long)func & 3))
  108. return -EINVAL;
  109. ret = xa_store(&fips140_init_func_map, (unsigned long)alg, func,
  110. GFP_KERNEL);
  111. return xa_err(ret);
  112. }
  113. /* Get the algorithm's original initialization function (possibly NULL) */
  114. static void *fips140_load_init_function(struct crypto_alg *alg)
  115. {
  116. return xa_load(&fips140_init_func_map, (unsigned long)alg);
  117. }
  118. /* tfm initialization function overrides */
  119. static int fips140_alg_init_tfm(struct crypto_tfm *tfm)
  120. {
  121. struct crypto_alg *alg = tfm->__crt_alg;
  122. int (*cra_init)(struct crypto_tfm *tfm) =
  123. fips140_load_init_function(alg);
  124. if (fips140_wait_until_ready(alg))
  125. WRITE_ONCE(alg->cra_init, cra_init);
  126. return cra_init ? cra_init(tfm) : 0;
  127. }
  128. static int fips140_aead_init_tfm(struct crypto_aead *tfm)
  129. {
  130. struct aead_alg *alg = crypto_aead_alg(tfm);
  131. int (*init)(struct crypto_aead *tfm) =
  132. fips140_load_init_function(&alg->base);
  133. if (fips140_wait_until_ready(&alg->base))
  134. WRITE_ONCE(alg->init, init);
  135. return init ? init(tfm) : 0;
  136. }
  137. static int fips140_ahash_init_tfm(struct crypto_ahash *tfm)
  138. {
  139. struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
  140. struct ahash_alg *alg = container_of(halg, struct ahash_alg, halg);
  141. int (*init_tfm)(struct crypto_ahash *tfm) =
  142. fips140_load_init_function(&halg->base);
  143. if (fips140_wait_until_ready(&halg->base))
  144. WRITE_ONCE(alg->init_tfm, init_tfm);
  145. return init_tfm ? init_tfm(tfm) : 0;
  146. }
  147. static int fips140_shash_init_tfm(struct crypto_shash *tfm)
  148. {
  149. struct shash_alg *alg = crypto_shash_alg(tfm);
  150. int (*init_tfm)(struct crypto_shash *tfm) =
  151. fips140_load_init_function(&alg->base);
  152. if (fips140_wait_until_ready(&alg->base))
  153. WRITE_ONCE(alg->init_tfm, init_tfm);
  154. return init_tfm ? init_tfm(tfm) : 0;
  155. }
  156. static int fips140_skcipher_init_tfm(struct crypto_skcipher *tfm)
  157. {
  158. struct skcipher_alg *alg = crypto_skcipher_alg(tfm);
  159. int (*init)(struct crypto_skcipher *tfm) =
  160. fips140_load_init_function(&alg->base);
  161. if (fips140_wait_until_ready(&alg->base))
  162. WRITE_ONCE(alg->init, init);
  163. return init ? init(tfm) : 0;
  164. }
  165. /* Single algorithm registration */
  166. #define prepare_alg(alg, base_alg, field, wrapper_func) \
  167. ({ \
  168. int err = 0; \
  169. \
  170. if (!fips140_ready() && alg->field != wrapper_func) { \
  171. err = fips140_store_init_function(base_alg, alg->field);\
  172. if (err == 0) \
  173. alg->field = wrapper_func; \
  174. } \
  175. err; \
  176. })
  177. static int fips140_prepare_alg(struct crypto_alg *alg)
  178. {
  179. /*
  180. * Override cra_init. This is only for algorithm types like cipher and
  181. * rng that don't have a strongly-typed initialization function.
  182. */
  183. return prepare_alg(alg, alg, cra_init, fips140_alg_init_tfm);
  184. }
  185. static int fips140_prepare_aead_alg(struct aead_alg *alg)
  186. {
  187. return prepare_alg(alg, &alg->base, init, fips140_aead_init_tfm);
  188. }
  189. static int fips140_prepare_ahash_alg(struct ahash_alg *alg)
  190. {
  191. return prepare_alg(alg, &alg->halg.base, init_tfm,
  192. fips140_ahash_init_tfm);
  193. }
  194. static int fips140_prepare_rng_alg(struct rng_alg *alg)
  195. {
  196. /*
  197. * rng doesn't have a strongly-typed initialization function, so we must
  198. * treat rng algorithms as "generic" algorithms.
  199. */
  200. return fips140_prepare_alg(&alg->base);
  201. }
  202. static int fips140_prepare_shash_alg(struct shash_alg *alg)
  203. {
  204. return prepare_alg(alg, &alg->base, init_tfm, fips140_shash_init_tfm);
  205. }
  206. static int fips140_prepare_skcipher_alg(struct skcipher_alg *alg)
  207. {
  208. return prepare_alg(alg, &alg->base, init, fips140_skcipher_init_tfm);
  209. }
  210. int fips140_crypto_register_alg(struct crypto_alg *alg)
  211. {
  212. return fips140_prepare_alg(alg) ?: crypto_register_alg(alg);
  213. }
  214. int fips140_crypto_register_aead(struct aead_alg *alg)
  215. {
  216. return fips140_prepare_aead_alg(alg) ?: crypto_register_aead(alg);
  217. }
  218. int fips140_crypto_register_ahash(struct ahash_alg *alg)
  219. {
  220. return fips140_prepare_ahash_alg(alg) ?: crypto_register_ahash(alg);
  221. }
  222. int fips140_crypto_register_rng(struct rng_alg *alg)
  223. {
  224. return fips140_prepare_rng_alg(alg) ?: crypto_register_rng(alg);
  225. }
  226. int fips140_crypto_register_shash(struct shash_alg *alg)
  227. {
  228. return fips140_prepare_shash_alg(alg) ?: crypto_register_shash(alg);
  229. }
  230. int fips140_crypto_register_skcipher(struct skcipher_alg *alg)
  231. {
  232. return fips140_prepare_skcipher_alg(alg) ?:
  233. crypto_register_skcipher(alg);
  234. }
  235. /* Instance registration */
  236. int fips140_aead_register_instance(struct crypto_template *tmpl,
  237. struct aead_instance *inst)
  238. {
  239. return fips140_prepare_aead_alg(&inst->alg) ?:
  240. aead_register_instance(tmpl, inst);
  241. }
  242. int fips140_ahash_register_instance(struct crypto_template *tmpl,
  243. struct ahash_instance *inst)
  244. {
  245. return fips140_prepare_ahash_alg(&inst->alg) ?:
  246. ahash_register_instance(tmpl, inst);
  247. }
  248. int fips140_shash_register_instance(struct crypto_template *tmpl,
  249. struct shash_instance *inst)
  250. {
  251. return fips140_prepare_shash_alg(&inst->alg) ?:
  252. shash_register_instance(tmpl, inst);
  253. }
  254. int fips140_skcipher_register_instance(struct crypto_template *tmpl,
  255. struct skcipher_instance *inst)
  256. {
  257. return fips140_prepare_skcipher_alg(&inst->alg) ?:
  258. skcipher_register_instance(tmpl, inst);
  259. }
  260. /* Bulk algorithm registration */
  261. int fips140_crypto_register_algs(struct crypto_alg *algs, int count)
  262. {
  263. int i;
  264. int err;
  265. for (i = 0; i < count; i++) {
  266. err = fips140_prepare_alg(&algs[i]);
  267. if (err)
  268. return err;
  269. }
  270. return crypto_register_algs(algs, count);
  271. }
  272. int fips140_crypto_register_aeads(struct aead_alg *algs, int count)
  273. {
  274. int i;
  275. int err;
  276. for (i = 0; i < count; i++) {
  277. err = fips140_prepare_aead_alg(&algs[i]);
  278. if (err)
  279. return err;
  280. }
  281. return crypto_register_aeads(algs, count);
  282. }
  283. int fips140_crypto_register_ahashes(struct ahash_alg *algs, int count)
  284. {
  285. int i;
  286. int err;
  287. for (i = 0; i < count; i++) {
  288. err = fips140_prepare_ahash_alg(&algs[i]);
  289. if (err)
  290. return err;
  291. }
  292. return crypto_register_ahashes(algs, count);
  293. }
  294. int fips140_crypto_register_rngs(struct rng_alg *algs, int count)
  295. {
  296. int i;
  297. int err;
  298. for (i = 0; i < count; i++) {
  299. err = fips140_prepare_rng_alg(&algs[i]);
  300. if (err)
  301. return err;
  302. }
  303. return crypto_register_rngs(algs, count);
  304. }
  305. int fips140_crypto_register_shashes(struct shash_alg *algs, int count)
  306. {
  307. int i;
  308. int err;
  309. for (i = 0; i < count; i++) {
  310. err = fips140_prepare_shash_alg(&algs[i]);
  311. if (err)
  312. return err;
  313. }
  314. return crypto_register_shashes(algs, count);
  315. }
  316. int fips140_crypto_register_skciphers(struct skcipher_alg *algs, int count)
  317. {
  318. int i;
  319. int err;
  320. for (i = 0; i < count; i++) {
  321. err = fips140_prepare_skcipher_alg(&algs[i]);
  322. if (err)
  323. return err;
  324. }
  325. return crypto_register_skciphers(algs, count);
  326. }