1 /* 2 * Copyright IBM Corp. 2006, 2015 3 * Author(s): Jan Glauber <jan.glauber@de.ibm.com> 4 * Harald Freudenberger <freude@de.ibm.com> 5 * Driver for the s390 pseudo random number generator 6 */ 7 8 #define KMSG_COMPONENT "prng" 9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 10 11 #include <linux/fs.h> 12 #include <linux/fips.h> 13 #include <linux/init.h> 14 #include <linux/kernel.h> 15 #include <linux/device.h> 16 #include <linux/miscdevice.h> 17 #include <linux/module.h> 18 #include <linux/moduleparam.h> 19 #include <linux/mutex.h> 20 #include <linux/cpufeature.h> 21 #include <linux/random.h> 22 #include <linux/slab.h> 23 #include <asm/debug.h> 24 #include <asm/uaccess.h> 25 #include <asm/timex.h> 26 27 #include "crypt_s390.h" 28 29 MODULE_LICENSE("GPL"); 30 MODULE_AUTHOR("IBM Corporation"); 31 MODULE_DESCRIPTION("s390 PRNG interface"); 32 33 34 #define PRNG_MODE_AUTO 0 35 #define PRNG_MODE_TDES 1 36 #define PRNG_MODE_SHA512 2 37 38 static unsigned int prng_mode = PRNG_MODE_AUTO; 39 module_param_named(mode, prng_mode, int, 0); 40 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); 41 42 43 #define PRNG_CHUNKSIZE_TDES_MIN 8 44 #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) 45 #define PRNG_CHUNKSIZE_SHA512_MIN 64 46 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) 47 48 static unsigned int prng_chunk_size = 256; 49 module_param_named(chunksize, prng_chunk_size, int, 0); 50 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); 51 52 53 #define PRNG_RESEED_LIMIT_TDES 4096 54 #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 55 #define PRNG_RESEED_LIMIT_SHA512 100000 56 #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 57 58 static unsigned int prng_reseed_limit; 59 module_param_named(reseed_limit, prng_reseed_limit, int, 0); 60 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); 61 62 63 /* 64 * Any one who considers arithmetical methods of producing random digits is, 65 * of course, in a state of sin. -- John von Neumann 66 */ 67 68 static int prng_errorflag; 69 70 #define PRNG_GEN_ENTROPY_FAILED 1 71 #define PRNG_SELFTEST_FAILED 2 72 #define PRNG_INSTANTIATE_FAILED 3 73 #define PRNG_SEED_FAILED 4 74 #define PRNG_RESEED_FAILED 5 75 #define PRNG_GEN_FAILED 6 76 77 struct prng_ws_s { 78 u8 parm_block[32]; 79 u32 reseed_counter; 80 u64 byte_counter; 81 }; 82 83 struct ppno_ws_s { 84 u32 res; 85 u32 reseed_counter; 86 u64 stream_bytes; 87 u8 V[112]; 88 u8 C[112]; 89 }; 90 91 struct prng_data_s { 92 struct mutex mutex; 93 union { 94 struct prng_ws_s prngws; 95 struct ppno_ws_s ppnows; 96 }; 97 u8 *buf; 98 u32 rest; 99 u8 *prev; 100 }; 101 102 static struct prng_data_s *prng_data; 103 104 /* initial parameter block for tdes mode, copied from libica */ 105 static const u8 initial_parm_block[32] __initconst = { 106 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, 107 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, 108 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, 109 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; 110 111 112 /*** helper functions ***/ 113 114 static int generate_entropy(u8 *ebuf, size_t nbytes) 115 { 116 int n, ret = 0; 117 u8 *pg, *h, hash[32]; 118 119 pg = (u8 *) __get_free_page(GFP_KERNEL); 120 if (!pg) { 121 prng_errorflag = PRNG_GEN_ENTROPY_FAILED; 122 return -ENOMEM; 123 } 124 125 while (nbytes) { 126 /* fill page with urandom bytes */ 127 get_random_bytes(pg, PAGE_SIZE); 128 /* exor page with stckf values */ 129 for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) { 130 u64 *p = ((u64 *)pg) + n; 131 *p ^= get_tod_clock_fast(); 132 } 133 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); 134 if (n < sizeof(hash)) 135 h = hash; 136 else 137 h = ebuf; 138 /* generate sha256 from this page */ 139 if (crypt_s390_kimd(KIMD_SHA_256, h, 140 pg, PAGE_SIZE) != PAGE_SIZE) { 141 prng_errorflag = PRNG_GEN_ENTROPY_FAILED; 142 ret = -EIO; 143 goto out; 144 } 145 if (n < sizeof(hash)) 146 memcpy(ebuf, hash, n); 147 ret += n; 148 ebuf += n; 149 nbytes -= n; 150 } 151 152 out: 153 free_page((unsigned long)pg); 154 return ret; 155 } 156 157 158 /*** tdes functions ***/ 159 160 static void prng_tdes_add_entropy(void) 161 { 162 __u64 entropy[4]; 163 unsigned int i; 164 int ret; 165 166 for (i = 0; i < 16; i++) { 167 ret = crypt_s390_kmc(KMC_PRNG, prng_data->prngws.parm_block, 168 (char *)entropy, (char *)entropy, 169 sizeof(entropy)); 170 BUG_ON(ret < 0 || ret != sizeof(entropy)); 171 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); 172 } 173 } 174 175 176 static void prng_tdes_seed(int nbytes) 177 { 178 char buf[16]; 179 int i = 0; 180 181 BUG_ON(nbytes > sizeof(buf)); 182 183 get_random_bytes(buf, nbytes); 184 185 /* Add the entropy */ 186 while (nbytes >= 8) { 187 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); 188 prng_tdes_add_entropy(); 189 i += 8; 190 nbytes -= 8; 191 } 192 prng_tdes_add_entropy(); 193 prng_data->prngws.reseed_counter = 0; 194 } 195 196 197 static int __init prng_tdes_instantiate(void) 198 { 199 int datalen; 200 201 pr_debug("prng runs in TDES mode with " 202 "chunksize=%d and reseed_limit=%u\n", 203 prng_chunk_size, prng_reseed_limit); 204 205 /* memory allocation, prng_data struct init, mutex init */ 206 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 207 prng_data = kzalloc(datalen, GFP_KERNEL); 208 if (!prng_data) { 209 prng_errorflag = PRNG_INSTANTIATE_FAILED; 210 return -ENOMEM; 211 } 212 mutex_init(&prng_data->mutex); 213 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 214 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); 215 216 /* initialize the PRNG, add 128 bits of entropy */ 217 prng_tdes_seed(16); 218 219 return 0; 220 } 221 222 223 static void prng_tdes_deinstantiate(void) 224 { 225 pr_debug("The prng module stopped " 226 "after running in triple DES mode\n"); 227 kzfree(prng_data); 228 } 229 230 231 /*** sha512 functions ***/ 232 233 static int __init prng_sha512_selftest(void) 234 { 235 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ 236 static const u8 seed[] __initconst = { 237 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, 238 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, 239 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, 240 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, 241 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, 242 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; 243 static const u8 V0[] __initconst = { 244 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, 245 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, 246 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, 247 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, 248 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, 249 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, 250 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, 251 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, 252 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, 253 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, 254 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, 255 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, 256 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, 257 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; 258 static const u8 C0[] __initconst = { 259 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, 260 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, 261 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, 262 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, 263 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, 264 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, 265 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, 266 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, 267 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, 268 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, 269 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, 270 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, 271 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, 272 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; 273 static const u8 random[] __initconst = { 274 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, 275 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, 276 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, 277 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, 278 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, 279 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, 280 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, 281 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, 282 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, 283 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, 284 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, 285 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, 286 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, 287 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, 288 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, 289 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, 290 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, 291 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, 292 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, 293 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, 294 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, 295 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, 296 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, 297 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, 298 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, 299 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, 300 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, 301 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, 302 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, 303 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, 304 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, 305 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; 306 307 int ret = 0; 308 u8 buf[sizeof(random)]; 309 struct ppno_ws_s ws; 310 311 memset(&ws, 0, sizeof(ws)); 312 313 /* initial seed */ 314 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, 315 &ws, NULL, 0, 316 seed, sizeof(seed)); 317 if (ret < 0) { 318 pr_err("The prng self test seed operation for the " 319 "SHA-512 mode failed with rc=%d\n", ret); 320 prng_errorflag = PRNG_SELFTEST_FAILED; 321 return -EIO; 322 } 323 324 /* check working states V and C */ 325 if (memcmp(ws.V, V0, sizeof(V0)) != 0 326 || memcmp(ws.C, C0, sizeof(C0)) != 0) { 327 pr_err("The prng self test state test " 328 "for the SHA-512 mode failed\n"); 329 prng_errorflag = PRNG_SELFTEST_FAILED; 330 return -EIO; 331 } 332 333 /* generate random bytes */ 334 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, 335 &ws, buf, sizeof(buf), 336 NULL, 0); 337 if (ret < 0) { 338 pr_err("The prng self test generate operation for " 339 "the SHA-512 mode failed with rc=%d\n", ret); 340 prng_errorflag = PRNG_SELFTEST_FAILED; 341 return -EIO; 342 } 343 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, 344 &ws, buf, sizeof(buf), 345 NULL, 0); 346 if (ret < 0) { 347 pr_err("The prng self test generate operation for " 348 "the SHA-512 mode failed with rc=%d\n", ret); 349 prng_errorflag = PRNG_SELFTEST_FAILED; 350 return -EIO; 351 } 352 353 /* check against expected data */ 354 if (memcmp(buf, random, sizeof(random)) != 0) { 355 pr_err("The prng self test data test " 356 "for the SHA-512 mode failed\n"); 357 prng_errorflag = PRNG_SELFTEST_FAILED; 358 return -EIO; 359 } 360 361 return 0; 362 } 363 364 365 static int __init prng_sha512_instantiate(void) 366 { 367 int ret, datalen; 368 u8 seed[64]; 369 370 pr_debug("prng runs in SHA-512 mode " 371 "with chunksize=%d and reseed_limit=%u\n", 372 prng_chunk_size, prng_reseed_limit); 373 374 /* memory allocation, prng_data struct init, mutex init */ 375 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 376 if (fips_enabled) 377 datalen += prng_chunk_size; 378 prng_data = kzalloc(datalen, GFP_KERNEL); 379 if (!prng_data) { 380 prng_errorflag = PRNG_INSTANTIATE_FAILED; 381 return -ENOMEM; 382 } 383 mutex_init(&prng_data->mutex); 384 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 385 386 /* selftest */ 387 ret = prng_sha512_selftest(); 388 if (ret) 389 goto outfree; 390 391 /* generate initial seed bytestring, first 48 bytes of entropy */ 392 ret = generate_entropy(seed, 48); 393 if (ret != 48) 394 goto outfree; 395 /* followed by 16 bytes of unique nonce */ 396 get_tod_clock_ext(seed + 48); 397 398 /* initial seed of the ppno drng */ 399 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, 400 &prng_data->ppnows, NULL, 0, 401 seed, sizeof(seed)); 402 if (ret < 0) { 403 prng_errorflag = PRNG_SEED_FAILED; 404 ret = -EIO; 405 goto outfree; 406 } 407 408 /* if fips mode is enabled, generate a first block of random 409 bytes for the FIPS 140-2 Conditional Self Test */ 410 if (fips_enabled) { 411 prng_data->prev = prng_data->buf + prng_chunk_size; 412 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, 413 &prng_data->ppnows, 414 prng_data->prev, 415 prng_chunk_size, 416 NULL, 0); 417 if (ret < 0 || ret != prng_chunk_size) { 418 prng_errorflag = PRNG_GEN_FAILED; 419 ret = -EIO; 420 goto outfree; 421 } 422 } 423 424 return 0; 425 426 outfree: 427 kfree(prng_data); 428 return ret; 429 } 430 431 432 static void prng_sha512_deinstantiate(void) 433 { 434 pr_debug("The prng module stopped after running in SHA-512 mode\n"); 435 kzfree(prng_data); 436 } 437 438 439 static int prng_sha512_reseed(void) 440 { 441 int ret; 442 u8 seed[32]; 443 444 /* generate 32 bytes of fresh entropy */ 445 ret = generate_entropy(seed, sizeof(seed)); 446 if (ret != sizeof(seed)) 447 return ret; 448 449 /* do a reseed of the ppno drng with this bytestring */ 450 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, 451 &prng_data->ppnows, NULL, 0, 452 seed, sizeof(seed)); 453 if (ret) { 454 prng_errorflag = PRNG_RESEED_FAILED; 455 return -EIO; 456 } 457 458 return 0; 459 } 460 461 462 static int prng_sha512_generate(u8 *buf, size_t nbytes) 463 { 464 int ret; 465 466 /* reseed needed ? */ 467 if (prng_data->ppnows.reseed_counter > prng_reseed_limit) { 468 ret = prng_sha512_reseed(); 469 if (ret) 470 return ret; 471 } 472 473 /* PPNO generate */ 474 ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, 475 &prng_data->ppnows, buf, nbytes, 476 NULL, 0); 477 if (ret < 0 || ret != nbytes) { 478 prng_errorflag = PRNG_GEN_FAILED; 479 return -EIO; 480 } 481 482 /* FIPS 140-2 Conditional Self Test */ 483 if (fips_enabled) { 484 if (!memcmp(prng_data->prev, buf, nbytes)) { 485 prng_errorflag = PRNG_GEN_FAILED; 486 return -EILSEQ; 487 } 488 memcpy(prng_data->prev, buf, nbytes); 489 } 490 491 return ret; 492 } 493 494 495 /*** file io functions ***/ 496 497 static int prng_open(struct inode *inode, struct file *file) 498 { 499 return nonseekable_open(inode, file); 500 } 501 502 503 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, 504 size_t nbytes, loff_t *ppos) 505 { 506 int chunk, n, tmp, ret = 0; 507 508 /* lock prng_data struct */ 509 if (mutex_lock_interruptible(&prng_data->mutex)) 510 return -ERESTARTSYS; 511 512 while (nbytes) { 513 if (need_resched()) { 514 if (signal_pending(current)) { 515 if (ret == 0) 516 ret = -ERESTARTSYS; 517 break; 518 } 519 /* give mutex free before calling schedule() */ 520 mutex_unlock(&prng_data->mutex); 521 schedule(); 522 /* occopy mutex again */ 523 if (mutex_lock_interruptible(&prng_data->mutex)) { 524 if (ret == 0) 525 ret = -ERESTARTSYS; 526 return ret; 527 } 528 } 529 530 /* 531 * we lose some random bytes if an attacker issues 532 * reads < 8 bytes, but we don't care 533 */ 534 chunk = min_t(int, nbytes, prng_chunk_size); 535 536 /* PRNG only likes multiples of 8 bytes */ 537 n = (chunk + 7) & -8; 538 539 if (prng_data->prngws.reseed_counter > prng_reseed_limit) 540 prng_tdes_seed(8); 541 542 /* if the CPU supports PRNG stckf is present too */ 543 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); 544 545 /* 546 * Beside the STCKF the input for the TDES-EDE is the output 547 * of the last operation. We differ here from X9.17 since we 548 * only store one timestamp into the buffer. Padding the whole 549 * buffer with timestamps does not improve security, since 550 * successive stckf have nearly constant offsets. 551 * If an attacker knows the first timestamp it would be 552 * trivial to guess the additional values. One timestamp 553 * is therefore enough and still guarantees unique input values. 554 * 555 * Note: you can still get strict X9.17 conformity by setting 556 * prng_chunk_size to 8 bytes. 557 */ 558 tmp = crypt_s390_kmc(KMC_PRNG, prng_data->prngws.parm_block, 559 prng_data->buf, prng_data->buf, n); 560 if (tmp < 0 || tmp != n) { 561 ret = -EIO; 562 break; 563 } 564 565 prng_data->prngws.byte_counter += n; 566 prng_data->prngws.reseed_counter += n; 567 568 if (copy_to_user(ubuf, prng_data->buf, chunk)) 569 return -EFAULT; 570 571 nbytes -= chunk; 572 ret += chunk; 573 ubuf += chunk; 574 } 575 576 /* unlock prng_data struct */ 577 mutex_unlock(&prng_data->mutex); 578 579 return ret; 580 } 581 582 583 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, 584 size_t nbytes, loff_t *ppos) 585 { 586 int n, ret = 0; 587 u8 *p; 588 589 /* if errorflag is set do nothing and return 'broken pipe' */ 590 if (prng_errorflag) 591 return -EPIPE; 592 593 /* lock prng_data struct */ 594 if (mutex_lock_interruptible(&prng_data->mutex)) 595 return -ERESTARTSYS; 596 597 while (nbytes) { 598 if (need_resched()) { 599 if (signal_pending(current)) { 600 if (ret == 0) 601 ret = -ERESTARTSYS; 602 break; 603 } 604 /* give mutex free before calling schedule() */ 605 mutex_unlock(&prng_data->mutex); 606 schedule(); 607 /* occopy mutex again */ 608 if (mutex_lock_interruptible(&prng_data->mutex)) { 609 if (ret == 0) 610 ret = -ERESTARTSYS; 611 return ret; 612 } 613 } 614 if (prng_data->rest) { 615 /* push left over random bytes from the previous read */ 616 p = prng_data->buf + prng_chunk_size - prng_data->rest; 617 n = (nbytes < prng_data->rest) ? 618 nbytes : prng_data->rest; 619 prng_data->rest -= n; 620 } else { 621 /* generate one chunk of random bytes into read buf */ 622 p = prng_data->buf; 623 n = prng_sha512_generate(p, prng_chunk_size); 624 if (n < 0) { 625 ret = n; 626 break; 627 } 628 if (nbytes < prng_chunk_size) { 629 n = nbytes; 630 prng_data->rest = prng_chunk_size - n; 631 } else { 632 n = prng_chunk_size; 633 prng_data->rest = 0; 634 } 635 } 636 if (copy_to_user(ubuf, p, n)) { 637 ret = -EFAULT; 638 break; 639 } 640 ubuf += n; 641 nbytes -= n; 642 ret += n; 643 } 644 645 /* unlock prng_data struct */ 646 mutex_unlock(&prng_data->mutex); 647 648 return ret; 649 } 650 651 652 /*** sysfs stuff ***/ 653 654 static const struct file_operations prng_sha512_fops = { 655 .owner = THIS_MODULE, 656 .open = &prng_open, 657 .release = NULL, 658 .read = &prng_sha512_read, 659 .llseek = noop_llseek, 660 }; 661 static const struct file_operations prng_tdes_fops = { 662 .owner = THIS_MODULE, 663 .open = &prng_open, 664 .release = NULL, 665 .read = &prng_tdes_read, 666 .llseek = noop_llseek, 667 }; 668 669 static struct miscdevice prng_sha512_dev = { 670 .name = "prandom", 671 .minor = MISC_DYNAMIC_MINOR, 672 .fops = &prng_sha512_fops, 673 }; 674 static struct miscdevice prng_tdes_dev = { 675 .name = "prandom", 676 .minor = MISC_DYNAMIC_MINOR, 677 .fops = &prng_tdes_fops, 678 }; 679 680 681 /* chunksize attribute (ro) */ 682 static ssize_t prng_chunksize_show(struct device *dev, 683 struct device_attribute *attr, 684 char *buf) 685 { 686 return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); 687 } 688 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); 689 690 /* counter attribute (ro) */ 691 static ssize_t prng_counter_show(struct device *dev, 692 struct device_attribute *attr, 693 char *buf) 694 { 695 u64 counter; 696 697 if (mutex_lock_interruptible(&prng_data->mutex)) 698 return -ERESTARTSYS; 699 if (prng_mode == PRNG_MODE_SHA512) 700 counter = prng_data->ppnows.stream_bytes; 701 else 702 counter = prng_data->prngws.byte_counter; 703 mutex_unlock(&prng_data->mutex); 704 705 return snprintf(buf, PAGE_SIZE, "%llu\n", counter); 706 } 707 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); 708 709 /* errorflag attribute (ro) */ 710 static ssize_t prng_errorflag_show(struct device *dev, 711 struct device_attribute *attr, 712 char *buf) 713 { 714 return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); 715 } 716 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); 717 718 /* mode attribute (ro) */ 719 static ssize_t prng_mode_show(struct device *dev, 720 struct device_attribute *attr, 721 char *buf) 722 { 723 if (prng_mode == PRNG_MODE_TDES) 724 return snprintf(buf, PAGE_SIZE, "TDES\n"); 725 else 726 return snprintf(buf, PAGE_SIZE, "SHA512\n"); 727 } 728 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); 729 730 /* reseed attribute (w) */ 731 static ssize_t prng_reseed_store(struct device *dev, 732 struct device_attribute *attr, 733 const char *buf, size_t count) 734 { 735 if (mutex_lock_interruptible(&prng_data->mutex)) 736 return -ERESTARTSYS; 737 prng_sha512_reseed(); 738 mutex_unlock(&prng_data->mutex); 739 740 return count; 741 } 742 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); 743 744 /* reseed limit attribute (rw) */ 745 static ssize_t prng_reseed_limit_show(struct device *dev, 746 struct device_attribute *attr, 747 char *buf) 748 { 749 return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); 750 } 751 static ssize_t prng_reseed_limit_store(struct device *dev, 752 struct device_attribute *attr, 753 const char *buf, size_t count) 754 { 755 unsigned limit; 756 757 if (sscanf(buf, "%u\n", &limit) != 1) 758 return -EINVAL; 759 760 if (prng_mode == PRNG_MODE_SHA512) { 761 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 762 return -EINVAL; 763 } else { 764 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) 765 return -EINVAL; 766 } 767 768 prng_reseed_limit = limit; 769 770 return count; 771 } 772 static DEVICE_ATTR(reseed_limit, 0644, 773 prng_reseed_limit_show, prng_reseed_limit_store); 774 775 /* strength attribute (ro) */ 776 static ssize_t prng_strength_show(struct device *dev, 777 struct device_attribute *attr, 778 char *buf) 779 { 780 return snprintf(buf, PAGE_SIZE, "256\n"); 781 } 782 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); 783 784 static struct attribute *prng_sha512_dev_attrs[] = { 785 &dev_attr_errorflag.attr, 786 &dev_attr_chunksize.attr, 787 &dev_attr_byte_counter.attr, 788 &dev_attr_mode.attr, 789 &dev_attr_reseed.attr, 790 &dev_attr_reseed_limit.attr, 791 &dev_attr_strength.attr, 792 NULL 793 }; 794 static struct attribute *prng_tdes_dev_attrs[] = { 795 &dev_attr_chunksize.attr, 796 &dev_attr_byte_counter.attr, 797 &dev_attr_mode.attr, 798 NULL 799 }; 800 801 static struct attribute_group prng_sha512_dev_attr_group = { 802 .attrs = prng_sha512_dev_attrs 803 }; 804 static struct attribute_group prng_tdes_dev_attr_group = { 805 .attrs = prng_tdes_dev_attrs 806 }; 807 808 809 /*** module init and exit ***/ 810 811 static int __init prng_init(void) 812 { 813 int ret; 814 815 /* check if the CPU has a PRNG */ 816 if (!crypt_s390_func_available(KMC_PRNG, CRYPT_S390_MSA)) 817 return -EOPNOTSUPP; 818 819 /* choose prng mode */ 820 if (prng_mode != PRNG_MODE_TDES) { 821 /* check for MSA5 support for PPNO operations */ 822 if (!crypt_s390_func_available(PPNO_SHA512_DRNG_GEN, 823 CRYPT_S390_MSA5)) { 824 if (prng_mode == PRNG_MODE_SHA512) { 825 pr_err("The prng module cannot " 826 "start in SHA-512 mode\n"); 827 return -EOPNOTSUPP; 828 } 829 prng_mode = PRNG_MODE_TDES; 830 } else 831 prng_mode = PRNG_MODE_SHA512; 832 } 833 834 if (prng_mode == PRNG_MODE_SHA512) { 835 836 /* SHA512 mode */ 837 838 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN 839 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) 840 return -EINVAL; 841 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; 842 843 if (prng_reseed_limit == 0) 844 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; 845 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 846 return -EINVAL; 847 848 ret = prng_sha512_instantiate(); 849 if (ret) 850 goto out; 851 852 ret = misc_register(&prng_sha512_dev); 853 if (ret) { 854 prng_sha512_deinstantiate(); 855 goto out; 856 } 857 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, 858 &prng_sha512_dev_attr_group); 859 if (ret) { 860 misc_deregister(&prng_sha512_dev); 861 prng_sha512_deinstantiate(); 862 goto out; 863 } 864 865 } else { 866 867 /* TDES mode */ 868 869 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN 870 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) 871 return -EINVAL; 872 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; 873 874 if (prng_reseed_limit == 0) 875 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; 876 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) 877 return -EINVAL; 878 879 ret = prng_tdes_instantiate(); 880 if (ret) 881 goto out; 882 883 ret = misc_register(&prng_tdes_dev); 884 if (ret) { 885 prng_tdes_deinstantiate(); 886 goto out; 887 } 888 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, 889 &prng_tdes_dev_attr_group); 890 if (ret) { 891 misc_deregister(&prng_tdes_dev); 892 prng_tdes_deinstantiate(); 893 goto out; 894 } 895 896 } 897 898 out: 899 return ret; 900 } 901 902 903 static void __exit prng_exit(void) 904 { 905 if (prng_mode == PRNG_MODE_SHA512) { 906 sysfs_remove_group(&prng_sha512_dev.this_device->kobj, 907 &prng_sha512_dev_attr_group); 908 misc_deregister(&prng_sha512_dev); 909 prng_sha512_deinstantiate(); 910 } else { 911 sysfs_remove_group(&prng_tdes_dev.this_device->kobj, 912 &prng_tdes_dev_attr_group); 913 misc_deregister(&prng_tdes_dev); 914 prng_tdes_deinstantiate(); 915 } 916 } 917 918 module_cpu_feature_match(MSA, prng_init); 919 module_exit(prng_exit); 920