1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright IBM Corp. 2006, 2015
4 * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
5 * Harald Freudenberger <freude@de.ibm.com>
6 * Driver for the s390 pseudo random number generator
7 */
8
9 #define KMSG_COMPONENT "prng"
10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12 #include <linux/fs.h>
13 #include <linux/fips.h>
14 #include <linux/init.h>
15 #include <linux/kernel.h>
16 #include <linux/device.h>
17 #include <linux/miscdevice.h>
18 #include <linux/module.h>
19 #include <linux/moduleparam.h>
20 #include <linux/mutex.h>
21 #include <linux/cpufeature.h>
22 #include <linux/random.h>
23 #include <linux/slab.h>
24 #include <linux/sched/signal.h>
25
26 #include <asm/debug.h>
27 #include <linux/uaccess.h>
28 #include <asm/timex.h>
29 #include <asm/cpacf.h>
30
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("IBM Corporation");
33 MODULE_DESCRIPTION("s390 PRNG interface");
34
35
36 #define PRNG_MODE_AUTO 0
37 #define PRNG_MODE_TDES 1
38 #define PRNG_MODE_SHA512 2
39
40 static unsigned int prng_mode = PRNG_MODE_AUTO;
41 module_param_named(mode, prng_mode, int, 0);
42 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
43
44
45 #define PRNG_CHUNKSIZE_TDES_MIN 8
46 #define PRNG_CHUNKSIZE_TDES_MAX (64*1024)
47 #define PRNG_CHUNKSIZE_SHA512_MIN 64
48 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
49
50 static unsigned int prng_chunk_size = 256;
51 module_param_named(chunksize, prng_chunk_size, int, 0);
52 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
53
54
55 #define PRNG_RESEED_LIMIT_TDES 4096
56 #define PRNG_RESEED_LIMIT_TDES_LOWER 4096
57 #define PRNG_RESEED_LIMIT_SHA512 100000
58 #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000
59
60 static unsigned int prng_reseed_limit;
61 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
62 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
63
64
65 /*
66 * Any one who considers arithmetical methods of producing random digits is,
67 * of course, in a state of sin. -- John von Neumann
68 */
69
70 static int prng_errorflag;
71
72 #define PRNG_GEN_ENTROPY_FAILED 1
73 #define PRNG_SELFTEST_FAILED 2
74 #define PRNG_INSTANTIATE_FAILED 3
75 #define PRNG_SEED_FAILED 4
76 #define PRNG_RESEED_FAILED 5
77 #define PRNG_GEN_FAILED 6
78
79 struct prng_ws_s {
80 u8 parm_block[32];
81 u32 reseed_counter;
82 u64 byte_counter;
83 };
84
85 struct prno_ws_s {
86 u32 res;
87 u32 reseed_counter;
88 u64 stream_bytes;
89 u8 V[112];
90 u8 C[112];
91 };
92
93 struct prng_data_s {
94 struct mutex mutex;
95 union {
96 struct prng_ws_s prngws;
97 struct prno_ws_s prnows;
98 };
99 u8 *buf;
100 u32 rest;
101 u8 *prev;
102 };
103
104 static struct prng_data_s *prng_data;
105
106 /* initial parameter block for tdes mode, copied from libica */
107 static const u8 initial_parm_block[32] __initconst = {
108 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
109 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
110 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
111 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
112
113
114 /*** helper functions ***/
115
116 /*
117 * generate_entropy:
118 * This algorithm produces 64 bytes of entropy data based on 1024
119 * individual stckf() invocations assuming that each stckf() value
120 * contributes 0.25 bits of entropy. So the caller gets 256 bit
121 * entropy per 64 byte or 4 bits entropy per byte.
122 */
generate_entropy(u8 * ebuf,size_t nbytes)123 static int generate_entropy(u8 *ebuf, size_t nbytes)
124 {
125 int n, ret = 0;
126 u8 *pg, *h, hash[64];
127
128 /* allocate 2 pages */
129 pg = (u8 *) __get_free_pages(GFP_KERNEL, 1);
130 if (!pg) {
131 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
132 return -ENOMEM;
133 }
134
135 while (nbytes) {
136 /* fill pages with urandom bytes */
137 get_random_bytes(pg, 2*PAGE_SIZE);
138 /* exor pages with 1024 stckf values */
139 for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) {
140 u64 *p = ((u64 *)pg) + n;
141 *p ^= get_tod_clock_fast();
142 }
143 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
144 if (n < sizeof(hash))
145 h = hash;
146 else
147 h = ebuf;
148 /* hash over the filled pages */
149 cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE);
150 if (n < sizeof(hash))
151 memcpy(ebuf, hash, n);
152 ret += n;
153 ebuf += n;
154 nbytes -= n;
155 }
156
157 free_pages((unsigned long)pg, 1);
158 return ret;
159 }
160
161
162 /*** tdes functions ***/
163
prng_tdes_add_entropy(void)164 static void prng_tdes_add_entropy(void)
165 {
166 __u64 entropy[4];
167 unsigned int i;
168
169 for (i = 0; i < 16; i++) {
170 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
171 (char *) entropy, (char *) entropy,
172 sizeof(entropy));
173 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
174 }
175 }
176
177
prng_tdes_seed(int nbytes)178 static void prng_tdes_seed(int nbytes)
179 {
180 char buf[16];
181 int i = 0;
182
183 BUG_ON(nbytes > sizeof(buf));
184
185 get_random_bytes(buf, nbytes);
186
187 /* Add the entropy */
188 while (nbytes >= 8) {
189 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
190 prng_tdes_add_entropy();
191 i += 8;
192 nbytes -= 8;
193 }
194 prng_tdes_add_entropy();
195 prng_data->prngws.reseed_counter = 0;
196 }
197
198
prng_tdes_instantiate(void)199 static int __init prng_tdes_instantiate(void)
200 {
201 int datalen;
202
203 pr_debug("prng runs in TDES mode with "
204 "chunksize=%d and reseed_limit=%u\n",
205 prng_chunk_size, prng_reseed_limit);
206
207 /* memory allocation, prng_data struct init, mutex init */
208 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
209 prng_data = kzalloc(datalen, GFP_KERNEL);
210 if (!prng_data) {
211 prng_errorflag = PRNG_INSTANTIATE_FAILED;
212 return -ENOMEM;
213 }
214 mutex_init(&prng_data->mutex);
215 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
216 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
217
218 /* initialize the PRNG, add 128 bits of entropy */
219 prng_tdes_seed(16);
220
221 return 0;
222 }
223
224
prng_tdes_deinstantiate(void)225 static void prng_tdes_deinstantiate(void)
226 {
227 pr_debug("The prng module stopped "
228 "after running in triple DES mode\n");
229 kzfree(prng_data);
230 }
231
232
233 /*** sha512 functions ***/
234
prng_sha512_selftest(void)235 static int __init prng_sha512_selftest(void)
236 {
237 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
238 static const u8 seed[] __initconst = {
239 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
240 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
241 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
242 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
243 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
244 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
245 static const u8 V0[] __initconst = {
246 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
247 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
248 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
249 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
250 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
251 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
252 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
253 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
254 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
255 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
256 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
257 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
258 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
259 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
260 static const u8 C0[] __initconst = {
261 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
262 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
263 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
264 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
265 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
266 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
267 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
268 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
269 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
270 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
271 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
272 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
273 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
274 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
275 static const u8 random[] __initconst = {
276 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
277 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
278 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
279 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
280 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
281 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
282 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
283 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
284 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
285 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
286 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
287 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
288 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
289 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
290 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
291 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
292 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
293 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
294 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
295 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
296 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
297 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
298 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
299 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
300 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
301 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
302 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
303 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
304 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
305 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
306 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
307 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
308
309 u8 buf[sizeof(random)];
310 struct prno_ws_s ws;
311
312 memset(&ws, 0, sizeof(ws));
313
314 /* initial seed */
315 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
316 &ws, NULL, 0, seed, sizeof(seed));
317
318 /* check working states V and C */
319 if (memcmp(ws.V, V0, sizeof(V0)) != 0
320 || memcmp(ws.C, C0, sizeof(C0)) != 0) {
321 pr_err("The prng self test state test "
322 "for the SHA-512 mode failed\n");
323 prng_errorflag = PRNG_SELFTEST_FAILED;
324 return -EIO;
325 }
326
327 /* generate random bytes */
328 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
329 &ws, buf, sizeof(buf), NULL, 0);
330 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
331 &ws, buf, sizeof(buf), NULL, 0);
332
333 /* check against expected data */
334 if (memcmp(buf, random, sizeof(random)) != 0) {
335 pr_err("The prng self test data test "
336 "for the SHA-512 mode failed\n");
337 prng_errorflag = PRNG_SELFTEST_FAILED;
338 return -EIO;
339 }
340
341 return 0;
342 }
343
344
prng_sha512_instantiate(void)345 static int __init prng_sha512_instantiate(void)
346 {
347 int ret, datalen;
348 u8 seed[64 + 32 + 16];
349
350 pr_debug("prng runs in SHA-512 mode "
351 "with chunksize=%d and reseed_limit=%u\n",
352 prng_chunk_size, prng_reseed_limit);
353
354 /* memory allocation, prng_data struct init, mutex init */
355 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
356 if (fips_enabled)
357 datalen += prng_chunk_size;
358 prng_data = kzalloc(datalen, GFP_KERNEL);
359 if (!prng_data) {
360 prng_errorflag = PRNG_INSTANTIATE_FAILED;
361 return -ENOMEM;
362 }
363 mutex_init(&prng_data->mutex);
364 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
365
366 /* selftest */
367 ret = prng_sha512_selftest();
368 if (ret)
369 goto outfree;
370
371 /* generate initial seed bytestring, with 256 + 128 bits entropy */
372 ret = generate_entropy(seed, 64 + 32);
373 if (ret != 64 + 32)
374 goto outfree;
375 /* followed by 16 bytes of unique nonce */
376 get_tod_clock_ext(seed + 64 + 32);
377
378 /* initial seed of the prno drng */
379 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
380 &prng_data->prnows, NULL, 0, seed, sizeof(seed));
381
382 /* if fips mode is enabled, generate a first block of random
383 bytes for the FIPS 140-2 Conditional Self Test */
384 if (fips_enabled) {
385 prng_data->prev = prng_data->buf + prng_chunk_size;
386 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
387 &prng_data->prnows,
388 prng_data->prev, prng_chunk_size, NULL, 0);
389 }
390
391 return 0;
392
393 outfree:
394 kfree(prng_data);
395 return ret;
396 }
397
398
prng_sha512_deinstantiate(void)399 static void prng_sha512_deinstantiate(void)
400 {
401 pr_debug("The prng module stopped after running in SHA-512 mode\n");
402 kzfree(prng_data);
403 }
404
405
prng_sha512_reseed(void)406 static int prng_sha512_reseed(void)
407 {
408 int ret;
409 u8 seed[64];
410
411 /* fetch 256 bits of fresh entropy */
412 ret = generate_entropy(seed, sizeof(seed));
413 if (ret != sizeof(seed))
414 return ret;
415
416 /* do a reseed of the prno drng with this bytestring */
417 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
418 &prng_data->prnows, NULL, 0, seed, sizeof(seed));
419
420 return 0;
421 }
422
423
prng_sha512_generate(u8 * buf,size_t nbytes)424 static int prng_sha512_generate(u8 *buf, size_t nbytes)
425 {
426 int ret;
427
428 /* reseed needed ? */
429 if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
430 ret = prng_sha512_reseed();
431 if (ret)
432 return ret;
433 }
434
435 /* PRNO generate */
436 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
437 &prng_data->prnows, buf, nbytes, NULL, 0);
438
439 /* FIPS 140-2 Conditional Self Test */
440 if (fips_enabled) {
441 if (!memcmp(prng_data->prev, buf, nbytes)) {
442 prng_errorflag = PRNG_GEN_FAILED;
443 return -EILSEQ;
444 }
445 memcpy(prng_data->prev, buf, nbytes);
446 }
447
448 return nbytes;
449 }
450
451
452 /*** file io functions ***/
453
prng_open(struct inode * inode,struct file * file)454 static int prng_open(struct inode *inode, struct file *file)
455 {
456 return nonseekable_open(inode, file);
457 }
458
459
prng_tdes_read(struct file * file,char __user * ubuf,size_t nbytes,loff_t * ppos)460 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
461 size_t nbytes, loff_t *ppos)
462 {
463 int chunk, n, ret = 0;
464
465 /* lock prng_data struct */
466 if (mutex_lock_interruptible(&prng_data->mutex))
467 return -ERESTARTSYS;
468
469 while (nbytes) {
470 if (need_resched()) {
471 if (signal_pending(current)) {
472 if (ret == 0)
473 ret = -ERESTARTSYS;
474 break;
475 }
476 /* give mutex free before calling schedule() */
477 mutex_unlock(&prng_data->mutex);
478 schedule();
479 /* occopy mutex again */
480 if (mutex_lock_interruptible(&prng_data->mutex)) {
481 if (ret == 0)
482 ret = -ERESTARTSYS;
483 return ret;
484 }
485 }
486
487 /*
488 * we lose some random bytes if an attacker issues
489 * reads < 8 bytes, but we don't care
490 */
491 chunk = min_t(int, nbytes, prng_chunk_size);
492
493 /* PRNG only likes multiples of 8 bytes */
494 n = (chunk + 7) & -8;
495
496 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
497 prng_tdes_seed(8);
498
499 /* if the CPU supports PRNG stckf is present too */
500 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
501
502 /*
503 * Beside the STCKF the input for the TDES-EDE is the output
504 * of the last operation. We differ here from X9.17 since we
505 * only store one timestamp into the buffer. Padding the whole
506 * buffer with timestamps does not improve security, since
507 * successive stckf have nearly constant offsets.
508 * If an attacker knows the first timestamp it would be
509 * trivial to guess the additional values. One timestamp
510 * is therefore enough and still guarantees unique input values.
511 *
512 * Note: you can still get strict X9.17 conformity by setting
513 * prng_chunk_size to 8 bytes.
514 */
515 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
516 prng_data->buf, prng_data->buf, n);
517
518 prng_data->prngws.byte_counter += n;
519 prng_data->prngws.reseed_counter += n;
520
521 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
522 ret = -EFAULT;
523 break;
524 }
525
526 nbytes -= chunk;
527 ret += chunk;
528 ubuf += chunk;
529 }
530
531 /* unlock prng_data struct */
532 mutex_unlock(&prng_data->mutex);
533
534 return ret;
535 }
536
537
prng_sha512_read(struct file * file,char __user * ubuf,size_t nbytes,loff_t * ppos)538 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
539 size_t nbytes, loff_t *ppos)
540 {
541 int n, ret = 0;
542 u8 *p;
543
544 /* if errorflag is set do nothing and return 'broken pipe' */
545 if (prng_errorflag)
546 return -EPIPE;
547
548 /* lock prng_data struct */
549 if (mutex_lock_interruptible(&prng_data->mutex))
550 return -ERESTARTSYS;
551
552 while (nbytes) {
553 if (need_resched()) {
554 if (signal_pending(current)) {
555 if (ret == 0)
556 ret = -ERESTARTSYS;
557 break;
558 }
559 /* give mutex free before calling schedule() */
560 mutex_unlock(&prng_data->mutex);
561 schedule();
562 /* occopy mutex again */
563 if (mutex_lock_interruptible(&prng_data->mutex)) {
564 if (ret == 0)
565 ret = -ERESTARTSYS;
566 return ret;
567 }
568 }
569 if (prng_data->rest) {
570 /* push left over random bytes from the previous read */
571 p = prng_data->buf + prng_chunk_size - prng_data->rest;
572 n = (nbytes < prng_data->rest) ?
573 nbytes : prng_data->rest;
574 prng_data->rest -= n;
575 } else {
576 /* generate one chunk of random bytes into read buf */
577 p = prng_data->buf;
578 n = prng_sha512_generate(p, prng_chunk_size);
579 if (n < 0) {
580 ret = n;
581 break;
582 }
583 if (nbytes < prng_chunk_size) {
584 n = nbytes;
585 prng_data->rest = prng_chunk_size - n;
586 } else {
587 n = prng_chunk_size;
588 prng_data->rest = 0;
589 }
590 }
591 if (copy_to_user(ubuf, p, n)) {
592 ret = -EFAULT;
593 break;
594 }
595 ubuf += n;
596 nbytes -= n;
597 ret += n;
598 }
599
600 /* unlock prng_data struct */
601 mutex_unlock(&prng_data->mutex);
602
603 return ret;
604 }
605
606
607 /*** sysfs stuff ***/
608
609 static const struct file_operations prng_sha512_fops = {
610 .owner = THIS_MODULE,
611 .open = &prng_open,
612 .release = NULL,
613 .read = &prng_sha512_read,
614 .llseek = noop_llseek,
615 };
616 static const struct file_operations prng_tdes_fops = {
617 .owner = THIS_MODULE,
618 .open = &prng_open,
619 .release = NULL,
620 .read = &prng_tdes_read,
621 .llseek = noop_llseek,
622 };
623
624 static struct miscdevice prng_sha512_dev = {
625 .name = "prandom",
626 .minor = MISC_DYNAMIC_MINOR,
627 .mode = 0644,
628 .fops = &prng_sha512_fops,
629 };
630 static struct miscdevice prng_tdes_dev = {
631 .name = "prandom",
632 .minor = MISC_DYNAMIC_MINOR,
633 .mode = 0644,
634 .fops = &prng_tdes_fops,
635 };
636
637
638 /* chunksize attribute (ro) */
prng_chunksize_show(struct device * dev,struct device_attribute * attr,char * buf)639 static ssize_t prng_chunksize_show(struct device *dev,
640 struct device_attribute *attr,
641 char *buf)
642 {
643 return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
644 }
645 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
646
647 /* counter attribute (ro) */
prng_counter_show(struct device * dev,struct device_attribute * attr,char * buf)648 static ssize_t prng_counter_show(struct device *dev,
649 struct device_attribute *attr,
650 char *buf)
651 {
652 u64 counter;
653
654 if (mutex_lock_interruptible(&prng_data->mutex))
655 return -ERESTARTSYS;
656 if (prng_mode == PRNG_MODE_SHA512)
657 counter = prng_data->prnows.stream_bytes;
658 else
659 counter = prng_data->prngws.byte_counter;
660 mutex_unlock(&prng_data->mutex);
661
662 return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
663 }
664 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
665
666 /* errorflag attribute (ro) */
prng_errorflag_show(struct device * dev,struct device_attribute * attr,char * buf)667 static ssize_t prng_errorflag_show(struct device *dev,
668 struct device_attribute *attr,
669 char *buf)
670 {
671 return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
672 }
673 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
674
675 /* mode attribute (ro) */
prng_mode_show(struct device * dev,struct device_attribute * attr,char * buf)676 static ssize_t prng_mode_show(struct device *dev,
677 struct device_attribute *attr,
678 char *buf)
679 {
680 if (prng_mode == PRNG_MODE_TDES)
681 return snprintf(buf, PAGE_SIZE, "TDES\n");
682 else
683 return snprintf(buf, PAGE_SIZE, "SHA512\n");
684 }
685 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
686
687 /* reseed attribute (w) */
prng_reseed_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)688 static ssize_t prng_reseed_store(struct device *dev,
689 struct device_attribute *attr,
690 const char *buf, size_t count)
691 {
692 if (mutex_lock_interruptible(&prng_data->mutex))
693 return -ERESTARTSYS;
694 prng_sha512_reseed();
695 mutex_unlock(&prng_data->mutex);
696
697 return count;
698 }
699 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
700
701 /* reseed limit attribute (rw) */
prng_reseed_limit_show(struct device * dev,struct device_attribute * attr,char * buf)702 static ssize_t prng_reseed_limit_show(struct device *dev,
703 struct device_attribute *attr,
704 char *buf)
705 {
706 return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
707 }
prng_reseed_limit_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)708 static ssize_t prng_reseed_limit_store(struct device *dev,
709 struct device_attribute *attr,
710 const char *buf, size_t count)
711 {
712 unsigned limit;
713
714 if (sscanf(buf, "%u\n", &limit) != 1)
715 return -EINVAL;
716
717 if (prng_mode == PRNG_MODE_SHA512) {
718 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
719 return -EINVAL;
720 } else {
721 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
722 return -EINVAL;
723 }
724
725 prng_reseed_limit = limit;
726
727 return count;
728 }
729 static DEVICE_ATTR(reseed_limit, 0644,
730 prng_reseed_limit_show, prng_reseed_limit_store);
731
732 /* strength attribute (ro) */
prng_strength_show(struct device * dev,struct device_attribute * attr,char * buf)733 static ssize_t prng_strength_show(struct device *dev,
734 struct device_attribute *attr,
735 char *buf)
736 {
737 return snprintf(buf, PAGE_SIZE, "256\n");
738 }
739 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
740
741 static struct attribute *prng_sha512_dev_attrs[] = {
742 &dev_attr_errorflag.attr,
743 &dev_attr_chunksize.attr,
744 &dev_attr_byte_counter.attr,
745 &dev_attr_mode.attr,
746 &dev_attr_reseed.attr,
747 &dev_attr_reseed_limit.attr,
748 &dev_attr_strength.attr,
749 NULL
750 };
751 static struct attribute *prng_tdes_dev_attrs[] = {
752 &dev_attr_chunksize.attr,
753 &dev_attr_byte_counter.attr,
754 &dev_attr_mode.attr,
755 NULL
756 };
757
758 static struct attribute_group prng_sha512_dev_attr_group = {
759 .attrs = prng_sha512_dev_attrs
760 };
761 static struct attribute_group prng_tdes_dev_attr_group = {
762 .attrs = prng_tdes_dev_attrs
763 };
764
765
766 /*** module init and exit ***/
767
prng_init(void)768 static int __init prng_init(void)
769 {
770 int ret;
771
772 /* check if the CPU has a PRNG */
773 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
774 return -EOPNOTSUPP;
775
776 /* choose prng mode */
777 if (prng_mode != PRNG_MODE_TDES) {
778 /* check for MSA5 support for PRNO operations */
779 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
780 if (prng_mode == PRNG_MODE_SHA512) {
781 pr_err("The prng module cannot "
782 "start in SHA-512 mode\n");
783 return -EOPNOTSUPP;
784 }
785 prng_mode = PRNG_MODE_TDES;
786 } else
787 prng_mode = PRNG_MODE_SHA512;
788 }
789
790 if (prng_mode == PRNG_MODE_SHA512) {
791
792 /* SHA512 mode */
793
794 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
795 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
796 return -EINVAL;
797 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
798
799 if (prng_reseed_limit == 0)
800 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
801 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
802 return -EINVAL;
803
804 ret = prng_sha512_instantiate();
805 if (ret)
806 goto out;
807
808 ret = misc_register(&prng_sha512_dev);
809 if (ret) {
810 prng_sha512_deinstantiate();
811 goto out;
812 }
813 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
814 &prng_sha512_dev_attr_group);
815 if (ret) {
816 misc_deregister(&prng_sha512_dev);
817 prng_sha512_deinstantiate();
818 goto out;
819 }
820
821 } else {
822
823 /* TDES mode */
824
825 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
826 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
827 return -EINVAL;
828 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
829
830 if (prng_reseed_limit == 0)
831 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
832 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
833 return -EINVAL;
834
835 ret = prng_tdes_instantiate();
836 if (ret)
837 goto out;
838
839 ret = misc_register(&prng_tdes_dev);
840 if (ret) {
841 prng_tdes_deinstantiate();
842 goto out;
843 }
844 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
845 &prng_tdes_dev_attr_group);
846 if (ret) {
847 misc_deregister(&prng_tdes_dev);
848 prng_tdes_deinstantiate();
849 goto out;
850 }
851
852 }
853
854 out:
855 return ret;
856 }
857
858
prng_exit(void)859 static void __exit prng_exit(void)
860 {
861 if (prng_mode == PRNG_MODE_SHA512) {
862 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
863 &prng_sha512_dev_attr_group);
864 misc_deregister(&prng_sha512_dev);
865 prng_sha512_deinstantiate();
866 } else {
867 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
868 &prng_tdes_dev_attr_group);
869 misc_deregister(&prng_tdes_dev);
870 prng_tdes_deinstantiate();
871 }
872 }
873
874 module_cpu_feature_match(MSA, prng_init);
875 module_exit(prng_exit);
876
