1 /* 2 * Copyright IBM Corp. 2006, 2015 3 * Author(s): Jan Glauber <jan.glauber@de.ibm.com> 4 * Harald Freudenberger <freude@de.ibm.com> 5 * Driver for the s390 pseudo random number generator 6 */ 7 8 #define KMSG_COMPONENT "prng" 9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 10 11 #include <linux/fs.h> 12 #include <linux/fips.h> 13 #include <linux/init.h> 14 #include <linux/kernel.h> 15 #include <linux/device.h> 16 #include <linux/miscdevice.h> 17 #include <linux/module.h> 18 #include <linux/moduleparam.h> 19 #include <linux/mutex.h> 20 #include <linux/cpufeature.h> 21 #include <linux/random.h> 22 #include <linux/slab.h> 23 #include <asm/debug.h> 24 #include <asm/uaccess.h> 25 #include <asm/timex.h> 26 #include <asm/cpacf.h> 27 28 MODULE_LICENSE("GPL"); 29 MODULE_AUTHOR("IBM Corporation"); 30 MODULE_DESCRIPTION("s390 PRNG interface"); 31 32 33 #define PRNG_MODE_AUTO 0 34 #define PRNG_MODE_TDES 1 35 #define PRNG_MODE_SHA512 2 36 37 static unsigned int prng_mode = PRNG_MODE_AUTO; 38 module_param_named(mode, prng_mode, int, 0); 39 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); 40 41 42 #define PRNG_CHUNKSIZE_TDES_MIN 8 43 #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) 44 #define PRNG_CHUNKSIZE_SHA512_MIN 64 45 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) 46 47 static unsigned int prng_chunk_size = 256; 48 module_param_named(chunksize, prng_chunk_size, int, 0); 49 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); 50 51 52 #define PRNG_RESEED_LIMIT_TDES 4096 53 #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 54 #define PRNG_RESEED_LIMIT_SHA512 100000 55 #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 56 57 static unsigned int prng_reseed_limit; 58 module_param_named(reseed_limit, prng_reseed_limit, int, 0); 59 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); 60 61 62 /* 63 * Any one who considers arithmetical methods of producing random digits is, 64 * of course, in a state of sin. -- John von Neumann 65 */ 66 67 static int prng_errorflag; 68 69 #define PRNG_GEN_ENTROPY_FAILED 1 70 #define PRNG_SELFTEST_FAILED 2 71 #define PRNG_INSTANTIATE_FAILED 3 72 #define PRNG_SEED_FAILED 4 73 #define PRNG_RESEED_FAILED 5 74 #define PRNG_GEN_FAILED 6 75 76 struct prng_ws_s { 77 u8 parm_block[32]; 78 u32 reseed_counter; 79 u64 byte_counter; 80 }; 81 82 struct ppno_ws_s { 83 u32 res; 84 u32 reseed_counter; 85 u64 stream_bytes; 86 u8 V[112]; 87 u8 C[112]; 88 }; 89 90 struct prng_data_s { 91 struct mutex mutex; 92 union { 93 struct prng_ws_s prngws; 94 struct ppno_ws_s ppnows; 95 }; 96 u8 *buf; 97 u32 rest; 98 u8 *prev; 99 }; 100 101 static struct prng_data_s *prng_data; 102 103 /* initial parameter block for tdes mode, copied from libica */ 104 static const u8 initial_parm_block[32] __initconst = { 105 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, 106 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, 107 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, 108 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; 109 110 111 /*** helper functions ***/ 112 113 static int generate_entropy(u8 *ebuf, size_t nbytes) 114 { 115 int n, ret = 0; 116 u8 *pg, *h, hash[32]; 117 118 pg = (u8 *) __get_free_page(GFP_KERNEL); 119 if (!pg) { 120 prng_errorflag = PRNG_GEN_ENTROPY_FAILED; 121 return -ENOMEM; 122 } 123 124 while (nbytes) { 125 /* fill page with urandom bytes */ 126 get_random_bytes(pg, PAGE_SIZE); 127 /* exor page with stckf values */ 128 for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) { 129 u64 *p = ((u64 *)pg) + n; 130 *p ^= get_tod_clock_fast(); 131 } 132 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); 133 if (n < sizeof(hash)) 134 h = hash; 135 else 136 h = ebuf; 137 /* generate sha256 from this page */ 138 cpacf_kimd(CPACF_KIMD_SHA_256, h, pg, PAGE_SIZE); 139 if (n < sizeof(hash)) 140 memcpy(ebuf, hash, n); 141 ret += n; 142 ebuf += n; 143 nbytes -= n; 144 } 145 146 free_page((unsigned long)pg); 147 return ret; 148 } 149 150 151 /*** tdes functions ***/ 152 153 static void prng_tdes_add_entropy(void) 154 { 155 __u64 entropy[4]; 156 unsigned int i; 157 158 for (i = 0; i < 16; i++) { 159 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 160 (char *) entropy, (char *) entropy, 161 sizeof(entropy)); 162 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); 163 } 164 } 165 166 167 static void prng_tdes_seed(int nbytes) 168 { 169 char buf[16]; 170 int i = 0; 171 172 BUG_ON(nbytes > sizeof(buf)); 173 174 get_random_bytes(buf, nbytes); 175 176 /* Add the entropy */ 177 while (nbytes >= 8) { 178 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); 179 prng_tdes_add_entropy(); 180 i += 8; 181 nbytes -= 8; 182 } 183 prng_tdes_add_entropy(); 184 prng_data->prngws.reseed_counter = 0; 185 } 186 187 188 static int __init prng_tdes_instantiate(void) 189 { 190 int datalen; 191 192 pr_debug("prng runs in TDES mode with " 193 "chunksize=%d and reseed_limit=%u\n", 194 prng_chunk_size, prng_reseed_limit); 195 196 /* memory allocation, prng_data struct init, mutex init */ 197 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 198 prng_data = kzalloc(datalen, GFP_KERNEL); 199 if (!prng_data) { 200 prng_errorflag = PRNG_INSTANTIATE_FAILED; 201 return -ENOMEM; 202 } 203 mutex_init(&prng_data->mutex); 204 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 205 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); 206 207 /* initialize the PRNG, add 128 bits of entropy */ 208 prng_tdes_seed(16); 209 210 return 0; 211 } 212 213 214 static void prng_tdes_deinstantiate(void) 215 { 216 pr_debug("The prng module stopped " 217 "after running in triple DES mode\n"); 218 kzfree(prng_data); 219 } 220 221 222 /*** sha512 functions ***/ 223 224 static int __init prng_sha512_selftest(void) 225 { 226 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ 227 static const u8 seed[] __initconst = { 228 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, 229 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, 230 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, 231 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, 232 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, 233 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; 234 static const u8 V0[] __initconst = { 235 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, 236 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, 237 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, 238 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, 239 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, 240 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, 241 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, 242 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, 243 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, 244 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, 245 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, 246 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, 247 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, 248 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; 249 static const u8 C0[] __initconst = { 250 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, 251 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, 252 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, 253 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, 254 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, 255 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, 256 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, 257 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, 258 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, 259 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, 260 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, 261 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, 262 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, 263 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; 264 static const u8 random[] __initconst = { 265 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, 266 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, 267 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, 268 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, 269 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, 270 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, 271 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, 272 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, 273 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, 274 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, 275 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, 276 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, 277 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, 278 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, 279 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, 280 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, 281 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, 282 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, 283 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, 284 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, 285 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, 286 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, 287 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, 288 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, 289 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, 290 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, 291 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, 292 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, 293 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, 294 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, 295 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, 296 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; 297 298 u8 buf[sizeof(random)]; 299 struct ppno_ws_s ws; 300 301 memset(&ws, 0, sizeof(ws)); 302 303 /* initial seed */ 304 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, 305 &ws, NULL, 0, seed, sizeof(seed)); 306 307 /* check working states V and C */ 308 if (memcmp(ws.V, V0, sizeof(V0)) != 0 309 || memcmp(ws.C, C0, sizeof(C0)) != 0) { 310 pr_err("The prng self test state test " 311 "for the SHA-512 mode failed\n"); 312 prng_errorflag = PRNG_SELFTEST_FAILED; 313 return -EIO; 314 } 315 316 /* generate random bytes */ 317 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, 318 &ws, buf, sizeof(buf), NULL, 0); 319 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, 320 &ws, buf, sizeof(buf), NULL, 0); 321 322 /* check against expected data */ 323 if (memcmp(buf, random, sizeof(random)) != 0) { 324 pr_err("The prng self test data test " 325 "for the SHA-512 mode failed\n"); 326 prng_errorflag = PRNG_SELFTEST_FAILED; 327 return -EIO; 328 } 329 330 return 0; 331 } 332 333 334 static int __init prng_sha512_instantiate(void) 335 { 336 int ret, datalen; 337 u8 seed[64]; 338 339 pr_debug("prng runs in SHA-512 mode " 340 "with chunksize=%d and reseed_limit=%u\n", 341 prng_chunk_size, prng_reseed_limit); 342 343 /* memory allocation, prng_data struct init, mutex init */ 344 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 345 if (fips_enabled) 346 datalen += prng_chunk_size; 347 prng_data = kzalloc(datalen, GFP_KERNEL); 348 if (!prng_data) { 349 prng_errorflag = PRNG_INSTANTIATE_FAILED; 350 return -ENOMEM; 351 } 352 mutex_init(&prng_data->mutex); 353 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 354 355 /* selftest */ 356 ret = prng_sha512_selftest(); 357 if (ret) 358 goto outfree; 359 360 /* generate initial seed bytestring, first 48 bytes of entropy */ 361 ret = generate_entropy(seed, 48); 362 if (ret != 48) 363 goto outfree; 364 /* followed by 16 bytes of unique nonce */ 365 get_tod_clock_ext(seed + 48); 366 367 /* initial seed of the ppno drng */ 368 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, 369 &prng_data->ppnows, NULL, 0, seed, sizeof(seed)); 370 371 /* if fips mode is enabled, generate a first block of random 372 bytes for the FIPS 140-2 Conditional Self Test */ 373 if (fips_enabled) { 374 prng_data->prev = prng_data->buf + prng_chunk_size; 375 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, 376 &prng_data->ppnows, 377 prng_data->prev, prng_chunk_size, NULL, 0); 378 } 379 380 return 0; 381 382 outfree: 383 kfree(prng_data); 384 return ret; 385 } 386 387 388 static void prng_sha512_deinstantiate(void) 389 { 390 pr_debug("The prng module stopped after running in SHA-512 mode\n"); 391 kzfree(prng_data); 392 } 393 394 395 static int prng_sha512_reseed(void) 396 { 397 int ret; 398 u8 seed[32]; 399 400 /* generate 32 bytes of fresh entropy */ 401 ret = generate_entropy(seed, sizeof(seed)); 402 if (ret != sizeof(seed)) 403 return ret; 404 405 /* do a reseed of the ppno drng with this bytestring */ 406 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, 407 &prng_data->ppnows, NULL, 0, seed, sizeof(seed)); 408 409 return 0; 410 } 411 412 413 static int prng_sha512_generate(u8 *buf, size_t nbytes) 414 { 415 int ret; 416 417 /* reseed needed ? */ 418 if (prng_data->ppnows.reseed_counter > prng_reseed_limit) { 419 ret = prng_sha512_reseed(); 420 if (ret) 421 return ret; 422 } 423 424 /* PPNO generate */ 425 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, 426 &prng_data->ppnows, buf, nbytes, NULL, 0); 427 428 /* FIPS 140-2 Conditional Self Test */ 429 if (fips_enabled) { 430 if (!memcmp(prng_data->prev, buf, nbytes)) { 431 prng_errorflag = PRNG_GEN_FAILED; 432 return -EILSEQ; 433 } 434 memcpy(prng_data->prev, buf, nbytes); 435 } 436 437 return nbytes; 438 } 439 440 441 /*** file io functions ***/ 442 443 static int prng_open(struct inode *inode, struct file *file) 444 { 445 return nonseekable_open(inode, file); 446 } 447 448 449 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, 450 size_t nbytes, loff_t *ppos) 451 { 452 int chunk, n, ret = 0; 453 454 /* lock prng_data struct */ 455 if (mutex_lock_interruptible(&prng_data->mutex)) 456 return -ERESTARTSYS; 457 458 while (nbytes) { 459 if (need_resched()) { 460 if (signal_pending(current)) { 461 if (ret == 0) 462 ret = -ERESTARTSYS; 463 break; 464 } 465 /* give mutex free before calling schedule() */ 466 mutex_unlock(&prng_data->mutex); 467 schedule(); 468 /* occopy mutex again */ 469 if (mutex_lock_interruptible(&prng_data->mutex)) { 470 if (ret == 0) 471 ret = -ERESTARTSYS; 472 return ret; 473 } 474 } 475 476 /* 477 * we lose some random bytes if an attacker issues 478 * reads < 8 bytes, but we don't care 479 */ 480 chunk = min_t(int, nbytes, prng_chunk_size); 481 482 /* PRNG only likes multiples of 8 bytes */ 483 n = (chunk + 7) & -8; 484 485 if (prng_data->prngws.reseed_counter > prng_reseed_limit) 486 prng_tdes_seed(8); 487 488 /* if the CPU supports PRNG stckf is present too */ 489 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); 490 491 /* 492 * Beside the STCKF the input for the TDES-EDE is the output 493 * of the last operation. We differ here from X9.17 since we 494 * only store one timestamp into the buffer. Padding the whole 495 * buffer with timestamps does not improve security, since 496 * successive stckf have nearly constant offsets. 497 * If an attacker knows the first timestamp it would be 498 * trivial to guess the additional values. One timestamp 499 * is therefore enough and still guarantees unique input values. 500 * 501 * Note: you can still get strict X9.17 conformity by setting 502 * prng_chunk_size to 8 bytes. 503 */ 504 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 505 prng_data->buf, prng_data->buf, n); 506 507 prng_data->prngws.byte_counter += n; 508 prng_data->prngws.reseed_counter += n; 509 510 if (copy_to_user(ubuf, prng_data->buf, chunk)) 511 return -EFAULT; 512 513 nbytes -= chunk; 514 ret += chunk; 515 ubuf += chunk; 516 } 517 518 /* unlock prng_data struct */ 519 mutex_unlock(&prng_data->mutex); 520 521 return ret; 522 } 523 524 525 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, 526 size_t nbytes, loff_t *ppos) 527 { 528 int n, ret = 0; 529 u8 *p; 530 531 /* if errorflag is set do nothing and return 'broken pipe' */ 532 if (prng_errorflag) 533 return -EPIPE; 534 535 /* lock prng_data struct */ 536 if (mutex_lock_interruptible(&prng_data->mutex)) 537 return -ERESTARTSYS; 538 539 while (nbytes) { 540 if (need_resched()) { 541 if (signal_pending(current)) { 542 if (ret == 0) 543 ret = -ERESTARTSYS; 544 break; 545 } 546 /* give mutex free before calling schedule() */ 547 mutex_unlock(&prng_data->mutex); 548 schedule(); 549 /* occopy mutex again */ 550 if (mutex_lock_interruptible(&prng_data->mutex)) { 551 if (ret == 0) 552 ret = -ERESTARTSYS; 553 return ret; 554 } 555 } 556 if (prng_data->rest) { 557 /* push left over random bytes from the previous read */ 558 p = prng_data->buf + prng_chunk_size - prng_data->rest; 559 n = (nbytes < prng_data->rest) ? 560 nbytes : prng_data->rest; 561 prng_data->rest -= n; 562 } else { 563 /* generate one chunk of random bytes into read buf */ 564 p = prng_data->buf; 565 n = prng_sha512_generate(p, prng_chunk_size); 566 if (n < 0) { 567 ret = n; 568 break; 569 } 570 if (nbytes < prng_chunk_size) { 571 n = nbytes; 572 prng_data->rest = prng_chunk_size - n; 573 } else { 574 n = prng_chunk_size; 575 prng_data->rest = 0; 576 } 577 } 578 if (copy_to_user(ubuf, p, n)) { 579 ret = -EFAULT; 580 break; 581 } 582 ubuf += n; 583 nbytes -= n; 584 ret += n; 585 } 586 587 /* unlock prng_data struct */ 588 mutex_unlock(&prng_data->mutex); 589 590 return ret; 591 } 592 593 594 /*** sysfs stuff ***/ 595 596 static const struct file_operations prng_sha512_fops = { 597 .owner = THIS_MODULE, 598 .open = &prng_open, 599 .release = NULL, 600 .read = &prng_sha512_read, 601 .llseek = noop_llseek, 602 }; 603 static const struct file_operations prng_tdes_fops = { 604 .owner = THIS_MODULE, 605 .open = &prng_open, 606 .release = NULL, 607 .read = &prng_tdes_read, 608 .llseek = noop_llseek, 609 }; 610 611 static struct miscdevice prng_sha512_dev = { 612 .name = "prandom", 613 .minor = MISC_DYNAMIC_MINOR, 614 .mode = 0644, 615 .fops = &prng_sha512_fops, 616 }; 617 static struct miscdevice prng_tdes_dev = { 618 .name = "prandom", 619 .minor = MISC_DYNAMIC_MINOR, 620 .mode = 0644, 621 .fops = &prng_tdes_fops, 622 }; 623 624 625 /* chunksize attribute (ro) */ 626 static ssize_t prng_chunksize_show(struct device *dev, 627 struct device_attribute *attr, 628 char *buf) 629 { 630 return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); 631 } 632 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); 633 634 /* counter attribute (ro) */ 635 static ssize_t prng_counter_show(struct device *dev, 636 struct device_attribute *attr, 637 char *buf) 638 { 639 u64 counter; 640 641 if (mutex_lock_interruptible(&prng_data->mutex)) 642 return -ERESTARTSYS; 643 if (prng_mode == PRNG_MODE_SHA512) 644 counter = prng_data->ppnows.stream_bytes; 645 else 646 counter = prng_data->prngws.byte_counter; 647 mutex_unlock(&prng_data->mutex); 648 649 return snprintf(buf, PAGE_SIZE, "%llu\n", counter); 650 } 651 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); 652 653 /* errorflag attribute (ro) */ 654 static ssize_t prng_errorflag_show(struct device *dev, 655 struct device_attribute *attr, 656 char *buf) 657 { 658 return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); 659 } 660 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); 661 662 /* mode attribute (ro) */ 663 static ssize_t prng_mode_show(struct device *dev, 664 struct device_attribute *attr, 665 char *buf) 666 { 667 if (prng_mode == PRNG_MODE_TDES) 668 return snprintf(buf, PAGE_SIZE, "TDES\n"); 669 else 670 return snprintf(buf, PAGE_SIZE, "SHA512\n"); 671 } 672 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); 673 674 /* reseed attribute (w) */ 675 static ssize_t prng_reseed_store(struct device *dev, 676 struct device_attribute *attr, 677 const char *buf, size_t count) 678 { 679 if (mutex_lock_interruptible(&prng_data->mutex)) 680 return -ERESTARTSYS; 681 prng_sha512_reseed(); 682 mutex_unlock(&prng_data->mutex); 683 684 return count; 685 } 686 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); 687 688 /* reseed limit attribute (rw) */ 689 static ssize_t prng_reseed_limit_show(struct device *dev, 690 struct device_attribute *attr, 691 char *buf) 692 { 693 return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); 694 } 695 static ssize_t prng_reseed_limit_store(struct device *dev, 696 struct device_attribute *attr, 697 const char *buf, size_t count) 698 { 699 unsigned limit; 700 701 if (sscanf(buf, "%u\n", &limit) != 1) 702 return -EINVAL; 703 704 if (prng_mode == PRNG_MODE_SHA512) { 705 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 706 return -EINVAL; 707 } else { 708 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) 709 return -EINVAL; 710 } 711 712 prng_reseed_limit = limit; 713 714 return count; 715 } 716 static DEVICE_ATTR(reseed_limit, 0644, 717 prng_reseed_limit_show, prng_reseed_limit_store); 718 719 /* strength attribute (ro) */ 720 static ssize_t prng_strength_show(struct device *dev, 721 struct device_attribute *attr, 722 char *buf) 723 { 724 return snprintf(buf, PAGE_SIZE, "256\n"); 725 } 726 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); 727 728 static struct attribute *prng_sha512_dev_attrs[] = { 729 &dev_attr_errorflag.attr, 730 &dev_attr_chunksize.attr, 731 &dev_attr_byte_counter.attr, 732 &dev_attr_mode.attr, 733 &dev_attr_reseed.attr, 734 &dev_attr_reseed_limit.attr, 735 &dev_attr_strength.attr, 736 NULL 737 }; 738 static struct attribute *prng_tdes_dev_attrs[] = { 739 &dev_attr_chunksize.attr, 740 &dev_attr_byte_counter.attr, 741 &dev_attr_mode.attr, 742 NULL 743 }; 744 745 static struct attribute_group prng_sha512_dev_attr_group = { 746 .attrs = prng_sha512_dev_attrs 747 }; 748 static struct attribute_group prng_tdes_dev_attr_group = { 749 .attrs = prng_tdes_dev_attrs 750 }; 751 752 753 /*** module init and exit ***/ 754 755 static int __init prng_init(void) 756 { 757 int ret; 758 759 /* check if the CPU has a PRNG */ 760 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG)) 761 return -EOPNOTSUPP; 762 763 /* choose prng mode */ 764 if (prng_mode != PRNG_MODE_TDES) { 765 /* check for MSA5 support for PPNO operations */ 766 if (!cpacf_query_func(CPACF_PPNO, CPACF_PPNO_SHA512_DRNG_GEN)) { 767 if (prng_mode == PRNG_MODE_SHA512) { 768 pr_err("The prng module cannot " 769 "start in SHA-512 mode\n"); 770 return -EOPNOTSUPP; 771 } 772 prng_mode = PRNG_MODE_TDES; 773 } else 774 prng_mode = PRNG_MODE_SHA512; 775 } 776 777 if (prng_mode == PRNG_MODE_SHA512) { 778 779 /* SHA512 mode */ 780 781 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN 782 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) 783 return -EINVAL; 784 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; 785 786 if (prng_reseed_limit == 0) 787 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; 788 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 789 return -EINVAL; 790 791 ret = prng_sha512_instantiate(); 792 if (ret) 793 goto out; 794 795 ret = misc_register(&prng_sha512_dev); 796 if (ret) { 797 prng_sha512_deinstantiate(); 798 goto out; 799 } 800 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, 801 &prng_sha512_dev_attr_group); 802 if (ret) { 803 misc_deregister(&prng_sha512_dev); 804 prng_sha512_deinstantiate(); 805 goto out; 806 } 807 808 } else { 809 810 /* TDES mode */ 811 812 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN 813 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) 814 return -EINVAL; 815 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; 816 817 if (prng_reseed_limit == 0) 818 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; 819 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) 820 return -EINVAL; 821 822 ret = prng_tdes_instantiate(); 823 if (ret) 824 goto out; 825 826 ret = misc_register(&prng_tdes_dev); 827 if (ret) { 828 prng_tdes_deinstantiate(); 829 goto out; 830 } 831 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, 832 &prng_tdes_dev_attr_group); 833 if (ret) { 834 misc_deregister(&prng_tdes_dev); 835 prng_tdes_deinstantiate(); 836 goto out; 837 } 838 839 } 840 841 out: 842 return ret; 843 } 844 845 846 static void __exit prng_exit(void) 847 { 848 if (prng_mode == PRNG_MODE_SHA512) { 849 sysfs_remove_group(&prng_sha512_dev.this_device->kobj, 850 &prng_sha512_dev_attr_group); 851 misc_deregister(&prng_sha512_dev); 852 prng_sha512_deinstantiate(); 853 } else { 854 sysfs_remove_group(&prng_tdes_dev.this_device->kobj, 855 &prng_tdes_dev_attr_group); 856 misc_deregister(&prng_tdes_dev); 857 prng_tdes_deinstantiate(); 858 } 859 } 860 861 module_cpu_feature_match(MSA, prng_init); 862 module_exit(prng_exit); 863