1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright IBM Corp. 2006, 2015 4 * Author(s): Jan Glauber <jan.glauber@de.ibm.com> 5 * Harald Freudenberger <freude@de.ibm.com> 6 * Driver for the s390 pseudo random number generator 7 */ 8 9 #define KMSG_COMPONENT "prng" 10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 11 12 #include <linux/fs.h> 13 #include <linux/fips.h> 14 #include <linux/init.h> 15 #include <linux/kernel.h> 16 #include <linux/device.h> 17 #include <linux/miscdevice.h> 18 #include <linux/module.h> 19 #include <linux/moduleparam.h> 20 #include <linux/mutex.h> 21 #include <linux/cpufeature.h> 22 #include <linux/random.h> 23 #include <linux/slab.h> 24 #include <linux/sched/signal.h> 25 26 #include <asm/debug.h> 27 #include <linux/uaccess.h> 28 #include <asm/timex.h> 29 #include <asm/cpacf.h> 30 31 MODULE_LICENSE("GPL"); 32 MODULE_AUTHOR("IBM Corporation"); 33 MODULE_DESCRIPTION("s390 PRNG interface"); 34 35 36 #define PRNG_MODE_AUTO 0 37 #define PRNG_MODE_TDES 1 38 #define PRNG_MODE_SHA512 2 39 40 static unsigned int prng_mode = PRNG_MODE_AUTO; 41 module_param_named(mode, prng_mode, int, 0); 42 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); 43 44 45 #define PRNG_CHUNKSIZE_TDES_MIN 8 46 #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) 47 #define PRNG_CHUNKSIZE_SHA512_MIN 64 48 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) 49 50 static unsigned int prng_chunk_size = 256; 51 module_param_named(chunksize, prng_chunk_size, int, 0); 52 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); 53 54 55 #define PRNG_RESEED_LIMIT_TDES 4096 56 #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 57 #define PRNG_RESEED_LIMIT_SHA512 100000 58 #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 59 60 static unsigned int prng_reseed_limit; 61 module_param_named(reseed_limit, prng_reseed_limit, int, 0); 62 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); 63 64 65 /* 66 * Any one who considers arithmetical methods of producing random digits is, 67 * of course, in a state of sin. -- John von Neumann 68 */ 69 70 static int prng_errorflag; 71 72 #define PRNG_GEN_ENTROPY_FAILED 1 73 #define PRNG_SELFTEST_FAILED 2 74 #define PRNG_INSTANTIATE_FAILED 3 75 #define PRNG_SEED_FAILED 4 76 #define PRNG_RESEED_FAILED 5 77 #define PRNG_GEN_FAILED 6 78 79 struct prng_ws_s { 80 u8 parm_block[32]; 81 u32 reseed_counter; 82 u64 byte_counter; 83 }; 84 85 struct prno_ws_s { 86 u32 res; 87 u32 reseed_counter; 88 u64 stream_bytes; 89 u8 V[112]; 90 u8 C[112]; 91 }; 92 93 struct prng_data_s { 94 struct mutex mutex; 95 union { 96 struct prng_ws_s prngws; 97 struct prno_ws_s prnows; 98 }; 99 u8 *buf; 100 u32 rest; 101 u8 *prev; 102 }; 103 104 static struct prng_data_s *prng_data; 105 106 /* initial parameter block for tdes mode, copied from libica */ 107 static const u8 initial_parm_block[32] __initconst = { 108 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, 109 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, 110 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, 111 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; 112 113 114 /*** helper functions ***/ 115 116 /* 117 * generate_entropy: 118 * This algorithm produces 64 bytes of entropy data based on 1024 119 * individual stckf() invocations assuming that each stckf() value 120 * contributes 0.25 bits of entropy. So the caller gets 256 bit 121 * entropy per 64 byte or 4 bits entropy per byte. 122 */ 123 static int generate_entropy(u8 *ebuf, size_t nbytes) 124 { 125 int n, ret = 0; 126 u8 *pg, *h, hash[64]; 127 128 /* allocate 2 pages */ 129 pg = (u8 *) __get_free_pages(GFP_KERNEL, 1); 130 if (!pg) { 131 prng_errorflag = PRNG_GEN_ENTROPY_FAILED; 132 return -ENOMEM; 133 } 134 135 while (nbytes) { 136 /* fill pages with urandom bytes */ 137 get_random_bytes(pg, 2*PAGE_SIZE); 138 /* exor pages with 1024 stckf values */ 139 for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) { 140 u64 *p = ((u64 *)pg) + n; 141 *p ^= get_tod_clock_fast(); 142 } 143 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); 144 if (n < sizeof(hash)) 145 h = hash; 146 else 147 h = ebuf; 148 /* hash over the filled pages */ 149 cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE); 150 if (n < sizeof(hash)) 151 memcpy(ebuf, hash, n); 152 ret += n; 153 ebuf += n; 154 nbytes -= n; 155 } 156 157 free_pages((unsigned long)pg, 1); 158 return ret; 159 } 160 161 162 /*** tdes functions ***/ 163 164 static void prng_tdes_add_entropy(void) 165 { 166 __u64 entropy[4]; 167 unsigned int i; 168 169 for (i = 0; i < 16; i++) { 170 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 171 (char *) entropy, (char *) entropy, 172 sizeof(entropy)); 173 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); 174 } 175 } 176 177 178 static void prng_tdes_seed(int nbytes) 179 { 180 char buf[16]; 181 int i = 0; 182 183 BUG_ON(nbytes > sizeof(buf)); 184 185 get_random_bytes(buf, nbytes); 186 187 /* Add the entropy */ 188 while (nbytes >= 8) { 189 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); 190 prng_tdes_add_entropy(); 191 i += 8; 192 nbytes -= 8; 193 } 194 prng_tdes_add_entropy(); 195 prng_data->prngws.reseed_counter = 0; 196 } 197 198 199 static int __init prng_tdes_instantiate(void) 200 { 201 int datalen; 202 203 pr_debug("prng runs in TDES mode with " 204 "chunksize=%d and reseed_limit=%u\n", 205 prng_chunk_size, prng_reseed_limit); 206 207 /* memory allocation, prng_data struct init, mutex init */ 208 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 209 prng_data = kzalloc(datalen, GFP_KERNEL); 210 if (!prng_data) { 211 prng_errorflag = PRNG_INSTANTIATE_FAILED; 212 return -ENOMEM; 213 } 214 mutex_init(&prng_data->mutex); 215 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 216 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); 217 218 /* initialize the PRNG, add 128 bits of entropy */ 219 prng_tdes_seed(16); 220 221 return 0; 222 } 223 224 225 static void prng_tdes_deinstantiate(void) 226 { 227 pr_debug("The prng module stopped " 228 "after running in triple DES mode\n"); 229 kzfree(prng_data); 230 } 231 232 233 /*** sha512 functions ***/ 234 235 static int __init prng_sha512_selftest(void) 236 { 237 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ 238 static const u8 seed[] __initconst = { 239 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, 240 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, 241 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, 242 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, 243 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, 244 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; 245 static const u8 V0[] __initconst = { 246 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, 247 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, 248 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, 249 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, 250 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, 251 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, 252 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, 253 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, 254 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, 255 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, 256 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, 257 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, 258 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, 259 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; 260 static const u8 C0[] __initconst = { 261 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, 262 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, 263 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, 264 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, 265 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, 266 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, 267 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, 268 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, 269 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, 270 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, 271 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, 272 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, 273 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, 274 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; 275 static const u8 random[] __initconst = { 276 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, 277 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, 278 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, 279 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, 280 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, 281 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, 282 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, 283 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, 284 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, 285 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, 286 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, 287 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, 288 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, 289 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, 290 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, 291 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, 292 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, 293 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, 294 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, 295 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, 296 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, 297 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, 298 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, 299 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, 300 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, 301 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, 302 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, 303 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, 304 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, 305 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, 306 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, 307 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; 308 309 u8 buf[sizeof(random)]; 310 struct prno_ws_s ws; 311 312 memset(&ws, 0, sizeof(ws)); 313 314 /* initial seed */ 315 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 316 &ws, NULL, 0, seed, sizeof(seed)); 317 318 /* check working states V and C */ 319 if (memcmp(ws.V, V0, sizeof(V0)) != 0 320 || memcmp(ws.C, C0, sizeof(C0)) != 0) { 321 pr_err("The prng self test state test " 322 "for the SHA-512 mode failed\n"); 323 prng_errorflag = PRNG_SELFTEST_FAILED; 324 return -EIO; 325 } 326 327 /* generate random bytes */ 328 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 329 &ws, buf, sizeof(buf), NULL, 0); 330 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 331 &ws, buf, sizeof(buf), NULL, 0); 332 333 /* check against expected data */ 334 if (memcmp(buf, random, sizeof(random)) != 0) { 335 pr_err("The prng self test data test " 336 "for the SHA-512 mode failed\n"); 337 prng_errorflag = PRNG_SELFTEST_FAILED; 338 return -EIO; 339 } 340 341 return 0; 342 } 343 344 345 static int __init prng_sha512_instantiate(void) 346 { 347 int ret, datalen; 348 u8 seed[64 + 32 + 16]; 349 350 pr_debug("prng runs in SHA-512 mode " 351 "with chunksize=%d and reseed_limit=%u\n", 352 prng_chunk_size, prng_reseed_limit); 353 354 /* memory allocation, prng_data struct init, mutex init */ 355 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 356 if (fips_enabled) 357 datalen += prng_chunk_size; 358 prng_data = kzalloc(datalen, GFP_KERNEL); 359 if (!prng_data) { 360 prng_errorflag = PRNG_INSTANTIATE_FAILED; 361 return -ENOMEM; 362 } 363 mutex_init(&prng_data->mutex); 364 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 365 366 /* selftest */ 367 ret = prng_sha512_selftest(); 368 if (ret) 369 goto outfree; 370 371 /* generate initial seed bytestring, with 256 + 128 bits entropy */ 372 ret = generate_entropy(seed, 64 + 32); 373 if (ret != 64 + 32) 374 goto outfree; 375 /* followed by 16 bytes of unique nonce */ 376 get_tod_clock_ext(seed + 64 + 32); 377 378 /* initial seed of the prno drng */ 379 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 380 &prng_data->prnows, NULL, 0, seed, sizeof(seed)); 381 382 /* if fips mode is enabled, generate a first block of random 383 bytes for the FIPS 140-2 Conditional Self Test */ 384 if (fips_enabled) { 385 prng_data->prev = prng_data->buf + prng_chunk_size; 386 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 387 &prng_data->prnows, 388 prng_data->prev, prng_chunk_size, NULL, 0); 389 } 390 391 return 0; 392 393 outfree: 394 kfree(prng_data); 395 return ret; 396 } 397 398 399 static void prng_sha512_deinstantiate(void) 400 { 401 pr_debug("The prng module stopped after running in SHA-512 mode\n"); 402 kzfree(prng_data); 403 } 404 405 406 static int prng_sha512_reseed(void) 407 { 408 int ret; 409 u8 seed[64]; 410 411 /* fetch 256 bits of fresh entropy */ 412 ret = generate_entropy(seed, sizeof(seed)); 413 if (ret != sizeof(seed)) 414 return ret; 415 416 /* do a reseed of the prno drng with this bytestring */ 417 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 418 &prng_data->prnows, NULL, 0, seed, sizeof(seed)); 419 420 return 0; 421 } 422 423 424 static int prng_sha512_generate(u8 *buf, size_t nbytes) 425 { 426 int ret; 427 428 /* reseed needed ? */ 429 if (prng_data->prnows.reseed_counter > prng_reseed_limit) { 430 ret = prng_sha512_reseed(); 431 if (ret) 432 return ret; 433 } 434 435 /* PRNO generate */ 436 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 437 &prng_data->prnows, buf, nbytes, NULL, 0); 438 439 /* FIPS 140-2 Conditional Self Test */ 440 if (fips_enabled) { 441 if (!memcmp(prng_data->prev, buf, nbytes)) { 442 prng_errorflag = PRNG_GEN_FAILED; 443 return -EILSEQ; 444 } 445 memcpy(prng_data->prev, buf, nbytes); 446 } 447 448 return nbytes; 449 } 450 451 452 /*** file io functions ***/ 453 454 static int prng_open(struct inode *inode, struct file *file) 455 { 456 return nonseekable_open(inode, file); 457 } 458 459 460 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, 461 size_t nbytes, loff_t *ppos) 462 { 463 int chunk, n, ret = 0; 464 465 /* lock prng_data struct */ 466 if (mutex_lock_interruptible(&prng_data->mutex)) 467 return -ERESTARTSYS; 468 469 while (nbytes) { 470 if (need_resched()) { 471 if (signal_pending(current)) { 472 if (ret == 0) 473 ret = -ERESTARTSYS; 474 break; 475 } 476 /* give mutex free before calling schedule() */ 477 mutex_unlock(&prng_data->mutex); 478 schedule(); 479 /* occopy mutex again */ 480 if (mutex_lock_interruptible(&prng_data->mutex)) { 481 if (ret == 0) 482 ret = -ERESTARTSYS; 483 return ret; 484 } 485 } 486 487 /* 488 * we lose some random bytes if an attacker issues 489 * reads < 8 bytes, but we don't care 490 */ 491 chunk = min_t(int, nbytes, prng_chunk_size); 492 493 /* PRNG only likes multiples of 8 bytes */ 494 n = (chunk + 7) & -8; 495 496 if (prng_data->prngws.reseed_counter > prng_reseed_limit) 497 prng_tdes_seed(8); 498 499 /* if the CPU supports PRNG stckf is present too */ 500 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); 501 502 /* 503 * Beside the STCKF the input for the TDES-EDE is the output 504 * of the last operation. We differ here from X9.17 since we 505 * only store one timestamp into the buffer. Padding the whole 506 * buffer with timestamps does not improve security, since 507 * successive stckf have nearly constant offsets. 508 * If an attacker knows the first timestamp it would be 509 * trivial to guess the additional values. One timestamp 510 * is therefore enough and still guarantees unique input values. 511 * 512 * Note: you can still get strict X9.17 conformity by setting 513 * prng_chunk_size to 8 bytes. 514 */ 515 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 516 prng_data->buf, prng_data->buf, n); 517 518 prng_data->prngws.byte_counter += n; 519 prng_data->prngws.reseed_counter += n; 520 521 if (copy_to_user(ubuf, prng_data->buf, chunk)) { 522 ret = -EFAULT; 523 break; 524 } 525 526 nbytes -= chunk; 527 ret += chunk; 528 ubuf += chunk; 529 } 530 531 /* unlock prng_data struct */ 532 mutex_unlock(&prng_data->mutex); 533 534 return ret; 535 } 536 537 538 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, 539 size_t nbytes, loff_t *ppos) 540 { 541 int n, ret = 0; 542 u8 *p; 543 544 /* if errorflag is set do nothing and return 'broken pipe' */ 545 if (prng_errorflag) 546 return -EPIPE; 547 548 /* lock prng_data struct */ 549 if (mutex_lock_interruptible(&prng_data->mutex)) 550 return -ERESTARTSYS; 551 552 while (nbytes) { 553 if (need_resched()) { 554 if (signal_pending(current)) { 555 if (ret == 0) 556 ret = -ERESTARTSYS; 557 break; 558 } 559 /* give mutex free before calling schedule() */ 560 mutex_unlock(&prng_data->mutex); 561 schedule(); 562 /* occopy mutex again */ 563 if (mutex_lock_interruptible(&prng_data->mutex)) { 564 if (ret == 0) 565 ret = -ERESTARTSYS; 566 return ret; 567 } 568 } 569 if (prng_data->rest) { 570 /* push left over random bytes from the previous read */ 571 p = prng_data->buf + prng_chunk_size - prng_data->rest; 572 n = (nbytes < prng_data->rest) ? 573 nbytes : prng_data->rest; 574 prng_data->rest -= n; 575 } else { 576 /* generate one chunk of random bytes into read buf */ 577 p = prng_data->buf; 578 n = prng_sha512_generate(p, prng_chunk_size); 579 if (n < 0) { 580 ret = n; 581 break; 582 } 583 if (nbytes < prng_chunk_size) { 584 n = nbytes; 585 prng_data->rest = prng_chunk_size - n; 586 } else { 587 n = prng_chunk_size; 588 prng_data->rest = 0; 589 } 590 } 591 if (copy_to_user(ubuf, p, n)) { 592 ret = -EFAULT; 593 break; 594 } 595 ubuf += n; 596 nbytes -= n; 597 ret += n; 598 } 599 600 /* unlock prng_data struct */ 601 mutex_unlock(&prng_data->mutex); 602 603 return ret; 604 } 605 606 607 /*** sysfs stuff ***/ 608 609 static const struct file_operations prng_sha512_fops = { 610 .owner = THIS_MODULE, 611 .open = &prng_open, 612 .release = NULL, 613 .read = &prng_sha512_read, 614 .llseek = noop_llseek, 615 }; 616 static const struct file_operations prng_tdes_fops = { 617 .owner = THIS_MODULE, 618 .open = &prng_open, 619 .release = NULL, 620 .read = &prng_tdes_read, 621 .llseek = noop_llseek, 622 }; 623 624 static struct miscdevice prng_sha512_dev = { 625 .name = "prandom", 626 .minor = MISC_DYNAMIC_MINOR, 627 .mode = 0644, 628 .fops = &prng_sha512_fops, 629 }; 630 static struct miscdevice prng_tdes_dev = { 631 .name = "prandom", 632 .minor = MISC_DYNAMIC_MINOR, 633 .mode = 0644, 634 .fops = &prng_tdes_fops, 635 }; 636 637 638 /* chunksize attribute (ro) */ 639 static ssize_t prng_chunksize_show(struct device *dev, 640 struct device_attribute *attr, 641 char *buf) 642 { 643 return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); 644 } 645 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); 646 647 /* counter attribute (ro) */ 648 static ssize_t prng_counter_show(struct device *dev, 649 struct device_attribute *attr, 650 char *buf) 651 { 652 u64 counter; 653 654 if (mutex_lock_interruptible(&prng_data->mutex)) 655 return -ERESTARTSYS; 656 if (prng_mode == PRNG_MODE_SHA512) 657 counter = prng_data->prnows.stream_bytes; 658 else 659 counter = prng_data->prngws.byte_counter; 660 mutex_unlock(&prng_data->mutex); 661 662 return snprintf(buf, PAGE_SIZE, "%llu\n", counter); 663 } 664 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); 665 666 /* errorflag attribute (ro) */ 667 static ssize_t prng_errorflag_show(struct device *dev, 668 struct device_attribute *attr, 669 char *buf) 670 { 671 return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); 672 } 673 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); 674 675 /* mode attribute (ro) */ 676 static ssize_t prng_mode_show(struct device *dev, 677 struct device_attribute *attr, 678 char *buf) 679 { 680 if (prng_mode == PRNG_MODE_TDES) 681 return snprintf(buf, PAGE_SIZE, "TDES\n"); 682 else 683 return snprintf(buf, PAGE_SIZE, "SHA512\n"); 684 } 685 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); 686 687 /* reseed attribute (w) */ 688 static ssize_t prng_reseed_store(struct device *dev, 689 struct device_attribute *attr, 690 const char *buf, size_t count) 691 { 692 if (mutex_lock_interruptible(&prng_data->mutex)) 693 return -ERESTARTSYS; 694 prng_sha512_reseed(); 695 mutex_unlock(&prng_data->mutex); 696 697 return count; 698 } 699 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); 700 701 /* reseed limit attribute (rw) */ 702 static ssize_t prng_reseed_limit_show(struct device *dev, 703 struct device_attribute *attr, 704 char *buf) 705 { 706 return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); 707 } 708 static ssize_t prng_reseed_limit_store(struct device *dev, 709 struct device_attribute *attr, 710 const char *buf, size_t count) 711 { 712 unsigned limit; 713 714 if (sscanf(buf, "%u\n", &limit) != 1) 715 return -EINVAL; 716 717 if (prng_mode == PRNG_MODE_SHA512) { 718 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 719 return -EINVAL; 720 } else { 721 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) 722 return -EINVAL; 723 } 724 725 prng_reseed_limit = limit; 726 727 return count; 728 } 729 static DEVICE_ATTR(reseed_limit, 0644, 730 prng_reseed_limit_show, prng_reseed_limit_store); 731 732 /* strength attribute (ro) */ 733 static ssize_t prng_strength_show(struct device *dev, 734 struct device_attribute *attr, 735 char *buf) 736 { 737 return snprintf(buf, PAGE_SIZE, "256\n"); 738 } 739 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); 740 741 static struct attribute *prng_sha512_dev_attrs[] = { 742 &dev_attr_errorflag.attr, 743 &dev_attr_chunksize.attr, 744 &dev_attr_byte_counter.attr, 745 &dev_attr_mode.attr, 746 &dev_attr_reseed.attr, 747 &dev_attr_reseed_limit.attr, 748 &dev_attr_strength.attr, 749 NULL 750 }; 751 static struct attribute *prng_tdes_dev_attrs[] = { 752 &dev_attr_chunksize.attr, 753 &dev_attr_byte_counter.attr, 754 &dev_attr_mode.attr, 755 NULL 756 }; 757 758 static struct attribute_group prng_sha512_dev_attr_group = { 759 .attrs = prng_sha512_dev_attrs 760 }; 761 static struct attribute_group prng_tdes_dev_attr_group = { 762 .attrs = prng_tdes_dev_attrs 763 }; 764 765 766 /*** module init and exit ***/ 767 768 static int __init prng_init(void) 769 { 770 int ret; 771 772 /* check if the CPU has a PRNG */ 773 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG)) 774 return -EOPNOTSUPP; 775 776 /* choose prng mode */ 777 if (prng_mode != PRNG_MODE_TDES) { 778 /* check for MSA5 support for PRNO operations */ 779 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { 780 if (prng_mode == PRNG_MODE_SHA512) { 781 pr_err("The prng module cannot " 782 "start in SHA-512 mode\n"); 783 return -EOPNOTSUPP; 784 } 785 prng_mode = PRNG_MODE_TDES; 786 } else 787 prng_mode = PRNG_MODE_SHA512; 788 } 789 790 if (prng_mode == PRNG_MODE_SHA512) { 791 792 /* SHA512 mode */ 793 794 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN 795 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) 796 return -EINVAL; 797 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; 798 799 if (prng_reseed_limit == 0) 800 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; 801 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 802 return -EINVAL; 803 804 ret = prng_sha512_instantiate(); 805 if (ret) 806 goto out; 807 808 ret = misc_register(&prng_sha512_dev); 809 if (ret) { 810 prng_sha512_deinstantiate(); 811 goto out; 812 } 813 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, 814 &prng_sha512_dev_attr_group); 815 if (ret) { 816 misc_deregister(&prng_sha512_dev); 817 prng_sha512_deinstantiate(); 818 goto out; 819 } 820 821 } else { 822 823 /* TDES mode */ 824 825 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN 826 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) 827 return -EINVAL; 828 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; 829 830 if (prng_reseed_limit == 0) 831 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; 832 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) 833 return -EINVAL; 834 835 ret = prng_tdes_instantiate(); 836 if (ret) 837 goto out; 838 839 ret = misc_register(&prng_tdes_dev); 840 if (ret) { 841 prng_tdes_deinstantiate(); 842 goto out; 843 } 844 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, 845 &prng_tdes_dev_attr_group); 846 if (ret) { 847 misc_deregister(&prng_tdes_dev); 848 prng_tdes_deinstantiate(); 849 goto out; 850 } 851 852 } 853 854 out: 855 return ret; 856 } 857 858 859 static void __exit prng_exit(void) 860 { 861 if (prng_mode == PRNG_MODE_SHA512) { 862 sysfs_remove_group(&prng_sha512_dev.this_device->kobj, 863 &prng_sha512_dev_attr_group); 864 misc_deregister(&prng_sha512_dev); 865 prng_sha512_deinstantiate(); 866 } else { 867 sysfs_remove_group(&prng_tdes_dev.this_device->kobj, 868 &prng_tdes_dev_attr_group); 869 misc_deregister(&prng_tdes_dev); 870 prng_tdes_deinstantiate(); 871 } 872 } 873 874 module_cpu_feature_match(MSA, prng_init); 875 module_exit(prng_exit); 876