Commit | Line | Data |
---|---|---|
1b278294 | 1 | /* |
57127645 | 2 | * Copyright IBM Corp. 2006, 2015 |
1b278294 | 3 | * Author(s): Jan Glauber <jan.glauber@de.ibm.com> |
57127645 | 4 | * Harald Freudenberger <freude@de.ibm.com> |
1b278294 JG |
5 | * Driver for the s390 pseudo random number generator |
6 | */ | |
57127645 HF |
7 | |
8 | #define KMSG_COMPONENT "prng" | |
9 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
10 | ||
1b278294 | 11 | #include <linux/fs.h> |
57127645 | 12 | #include <linux/fips.h> |
1b278294 JG |
13 | #include <linux/init.h> |
14 | #include <linux/kernel.h> | |
57127645 | 15 | #include <linux/device.h> |
1b278294 JG |
16 | #include <linux/miscdevice.h> |
17 | #include <linux/module.h> | |
18 | #include <linux/moduleparam.h> | |
57127645 | 19 | #include <linux/mutex.h> |
d05377c1 | 20 | #include <linux/cpufeature.h> |
1b278294 | 21 | #include <linux/random.h> |
5a0e3ad6 | 22 | #include <linux/slab.h> |
1b278294 JG |
23 | #include <asm/debug.h> |
24 | #include <asm/uaccess.h> | |
57127645 | 25 | #include <asm/timex.h> |
c7d4d259 | 26 | #include <asm/cpacf.h> |
1b278294 JG |
27 | |
28 | MODULE_LICENSE("GPL"); | |
57127645 | 29 | MODULE_AUTHOR("IBM Corporation"); |
1b278294 JG |
30 | MODULE_DESCRIPTION("s390 PRNG interface"); |
31 | ||
57127645 HF |
32 | |
33 | #define PRNG_MODE_AUTO 0 | |
34 | #define PRNG_MODE_TDES 1 | |
35 | #define PRNG_MODE_SHA512 2 | |
36 | ||
37 | static unsigned int prng_mode = PRNG_MODE_AUTO; | |
38 | module_param_named(mode, prng_mode, int, 0); | |
39 | MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); | |
40 | ||
41 | ||
42 | #define PRNG_CHUNKSIZE_TDES_MIN 8 | |
43 | #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) | |
44 | #define PRNG_CHUNKSIZE_SHA512_MIN 64 | |
45 | #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) | |
46 | ||
47 | static unsigned int prng_chunk_size = 256; | |
48 | module_param_named(chunksize, prng_chunk_size, int, 0); | |
1b278294 JG |
49 | MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); |
50 | ||
57127645 HF |
51 | |
52 | #define PRNG_RESEED_LIMIT_TDES 4096 | |
53 | #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 | |
54 | #define PRNG_RESEED_LIMIT_SHA512 100000 | |
55 | #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 | |
56 | ||
57 | static unsigned int prng_reseed_limit; | |
58 | module_param_named(reseed_limit, prng_reseed_limit, int, 0); | |
59 | MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); | |
60 | ||
1b278294 JG |
61 | |
62 | /* | |
63 | * Any one who considers arithmetical methods of producing random digits is, | |
64 | * of course, in a state of sin. -- John von Neumann | |
65 | */ | |
66 | ||
57127645 HF |
67 | static int prng_errorflag; |
68 | ||
69 | #define PRNG_GEN_ENTROPY_FAILED 1 | |
70 | #define PRNG_SELFTEST_FAILED 2 | |
71 | #define PRNG_INSTANTIATE_FAILED 3 | |
72 | #define PRNG_SEED_FAILED 4 | |
73 | #define PRNG_RESEED_FAILED 5 | |
74 | #define PRNG_GEN_FAILED 6 | |
75 | ||
76 | struct prng_ws_s { | |
77 | u8 parm_block[32]; | |
78 | u32 reseed_counter; | |
79 | u64 byte_counter; | |
1b278294 JG |
80 | }; |
81 | ||
57127645 HF |
82 | struct ppno_ws_s { |
83 | u32 res; | |
84 | u32 reseed_counter; | |
85 | u64 stream_bytes; | |
86 | u8 V[112]; | |
87 | u8 C[112]; | |
88 | }; | |
1b278294 | 89 | |
57127645 HF |
90 | struct prng_data_s { |
91 | struct mutex mutex; | |
92 | union { | |
93 | struct prng_ws_s prngws; | |
94 | struct ppno_ws_s ppnows; | |
95 | }; | |
96 | u8 *buf; | |
97 | u32 rest; | |
98 | u8 *prev; | |
1b278294 JG |
99 | }; |
100 | ||
57127645 HF |
101 | static struct prng_data_s *prng_data; |
102 | ||
103 | /* initial parameter block for tdes mode, copied from libica */ | |
104 | static const u8 initial_parm_block[32] __initconst = { | |
105 | 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, | |
106 | 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, | |
107 | 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, | |
108 | 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; | |
109 | ||
110 | ||
111 | /*** helper functions ***/ | |
112 | ||
113 | static int generate_entropy(u8 *ebuf, size_t nbytes) | |
1b278294 | 114 | { |
57127645 HF |
115 | int n, ret = 0; |
116 | u8 *pg, *h, hash[32]; | |
117 | ||
118 | pg = (u8 *) __get_free_page(GFP_KERNEL); | |
119 | if (!pg) { | |
120 | prng_errorflag = PRNG_GEN_ENTROPY_FAILED; | |
121 | return -ENOMEM; | |
122 | } | |
123 | ||
124 | while (nbytes) { | |
125 | /* fill page with urandom bytes */ | |
126 | get_random_bytes(pg, PAGE_SIZE); | |
127 | /* exor page with stckf values */ | |
c431761d | 128 | for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) { |
57127645 HF |
129 | u64 *p = ((u64 *)pg) + n; |
130 | *p ^= get_tod_clock_fast(); | |
131 | } | |
132 | n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); | |
133 | if (n < sizeof(hash)) | |
134 | h = hash; | |
135 | else | |
136 | h = ebuf; | |
137 | /* generate sha256 from this page */ | |
c7d4d259 MS |
138 | if (cpacf_kimd(CPACF_KIMD_SHA_256, h, |
139 | pg, PAGE_SIZE) != PAGE_SIZE) { | |
57127645 HF |
140 | prng_errorflag = PRNG_GEN_ENTROPY_FAILED; |
141 | ret = -EIO; | |
142 | goto out; | |
143 | } | |
144 | if (n < sizeof(hash)) | |
145 | memcpy(ebuf, hash, n); | |
146 | ret += n; | |
147 | ebuf += n; | |
148 | nbytes -= n; | |
149 | } | |
150 | ||
151 | out: | |
152 | free_page((unsigned long)pg); | |
153 | return ret; | |
1b278294 JG |
154 | } |
155 | ||
57127645 HF |
156 | |
157 | /*** tdes functions ***/ | |
158 | ||
159 | static void prng_tdes_add_entropy(void) | |
1b278294 JG |
160 | { |
161 | __u64 entropy[4]; | |
162 | unsigned int i; | |
163 | int ret; | |
164 | ||
165 | for (i = 0; i < 16; i++) { | |
c7d4d259 MS |
166 | ret = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, |
167 | (char *)entropy, (char *)entropy, | |
168 | sizeof(entropy)); | |
1b278294 | 169 | BUG_ON(ret < 0 || ret != sizeof(entropy)); |
57127645 | 170 | memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); |
1b278294 JG |
171 | } |
172 | } | |
173 | ||
57127645 HF |
174 | |
175 | static void prng_tdes_seed(int nbytes) | |
1b278294 JG |
176 | { |
177 | char buf[16]; | |
178 | int i = 0; | |
179 | ||
57127645 HF |
180 | BUG_ON(nbytes > sizeof(buf)); |
181 | ||
1b278294 JG |
182 | get_random_bytes(buf, nbytes); |
183 | ||
184 | /* Add the entropy */ | |
185 | while (nbytes >= 8) { | |
57127645 HF |
186 | *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); |
187 | prng_tdes_add_entropy(); | |
1b278294 JG |
188 | i += 8; |
189 | nbytes -= 8; | |
190 | } | |
57127645 HF |
191 | prng_tdes_add_entropy(); |
192 | prng_data->prngws.reseed_counter = 0; | |
193 | } | |
194 | ||
195 | ||
196 | static int __init prng_tdes_instantiate(void) | |
197 | { | |
198 | int datalen; | |
199 | ||
200 | pr_debug("prng runs in TDES mode with " | |
201 | "chunksize=%d and reseed_limit=%u\n", | |
202 | prng_chunk_size, prng_reseed_limit); | |
203 | ||
204 | /* memory allocation, prng_data struct init, mutex init */ | |
205 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
206 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
207 | if (!prng_data) { | |
208 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
209 | return -ENOMEM; | |
210 | } | |
211 | mutex_init(&prng_data->mutex); | |
212 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
213 | memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); | |
214 | ||
215 | /* initialize the PRNG, add 128 bits of entropy */ | |
216 | prng_tdes_seed(16); | |
217 | ||
218 | return 0; | |
1b278294 JG |
219 | } |
220 | ||
57127645 HF |
221 | |
222 | static void prng_tdes_deinstantiate(void) | |
223 | { | |
224 | pr_debug("The prng module stopped " | |
225 | "after running in triple DES mode\n"); | |
226 | kzfree(prng_data); | |
227 | } | |
228 | ||
229 | ||
230 | /*** sha512 functions ***/ | |
231 | ||
232 | static int __init prng_sha512_selftest(void) | |
1b278294 | 233 | { |
57127645 HF |
234 | /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ |
235 | static const u8 seed[] __initconst = { | |
236 | 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, | |
237 | 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, | |
238 | 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, | |
239 | 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, | |
240 | 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, | |
241 | 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; | |
242 | static const u8 V0[] __initconst = { | |
243 | 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, | |
244 | 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, | |
245 | 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, | |
246 | 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, | |
247 | 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, | |
248 | 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, | |
249 | 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, | |
250 | 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, | |
251 | 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, | |
252 | 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, | |
253 | 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, | |
254 | 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, | |
255 | 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, | |
256 | 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; | |
257 | static const u8 C0[] __initconst = { | |
258 | 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, | |
259 | 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, | |
260 | 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, | |
261 | 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, | |
262 | 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, | |
263 | 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, | |
264 | 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, | |
265 | 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, | |
266 | 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, | |
267 | 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, | |
268 | 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, | |
269 | 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, | |
270 | 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, | |
271 | 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; | |
272 | static const u8 random[] __initconst = { | |
273 | 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, | |
274 | 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, | |
275 | 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, | |
276 | 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, | |
277 | 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, | |
278 | 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, | |
279 | 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, | |
280 | 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, | |
281 | 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, | |
282 | 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, | |
283 | 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, | |
284 | 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, | |
285 | 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, | |
286 | 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, | |
287 | 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, | |
288 | 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, | |
289 | 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, | |
290 | 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, | |
291 | 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, | |
292 | 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, | |
293 | 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, | |
294 | 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, | |
295 | 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, | |
296 | 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, | |
297 | 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, | |
298 | 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, | |
299 | 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, | |
300 | 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, | |
301 | 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, | |
302 | 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, | |
303 | 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, | |
304 | 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; | |
305 | ||
1b278294 | 306 | int ret = 0; |
57127645 HF |
307 | u8 buf[sizeof(random)]; |
308 | struct ppno_ws_s ws; | |
309 | ||
310 | memset(&ws, 0, sizeof(ws)); | |
311 | ||
312 | /* initial seed */ | |
c7d4d259 MS |
313 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, &ws, NULL, 0, |
314 | seed, sizeof(seed)); | |
57127645 HF |
315 | if (ret < 0) { |
316 | pr_err("The prng self test seed operation for the " | |
317 | "SHA-512 mode failed with rc=%d\n", ret); | |
318 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
319 | return -EIO; | |
320 | } | |
321 | ||
322 | /* check working states V and C */ | |
323 | if (memcmp(ws.V, V0, sizeof(V0)) != 0 | |
324 | || memcmp(ws.C, C0, sizeof(C0)) != 0) { | |
325 | pr_err("The prng self test state test " | |
326 | "for the SHA-512 mode failed\n"); | |
327 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
328 | return -EIO; | |
329 | } | |
330 | ||
331 | /* generate random bytes */ | |
c7d4d259 MS |
332 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, |
333 | &ws, buf, sizeof(buf), NULL, 0); | |
57127645 HF |
334 | if (ret < 0) { |
335 | pr_err("The prng self test generate operation for " | |
336 | "the SHA-512 mode failed with rc=%d\n", ret); | |
337 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
338 | return -EIO; | |
339 | } | |
c7d4d259 MS |
340 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, |
341 | &ws, buf, sizeof(buf), NULL, 0); | |
57127645 HF |
342 | if (ret < 0) { |
343 | pr_err("The prng self test generate operation for " | |
344 | "the SHA-512 mode failed with rc=%d\n", ret); | |
345 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
346 | return -EIO; | |
347 | } | |
348 | ||
349 | /* check against expected data */ | |
350 | if (memcmp(buf, random, sizeof(random)) != 0) { | |
351 | pr_err("The prng self test data test " | |
352 | "for the SHA-512 mode failed\n"); | |
353 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
354 | return -EIO; | |
355 | } | |
356 | ||
357 | return 0; | |
358 | } | |
359 | ||
360 | ||
361 | static int __init prng_sha512_instantiate(void) | |
362 | { | |
363 | int ret, datalen; | |
364 | u8 seed[64]; | |
365 | ||
366 | pr_debug("prng runs in SHA-512 mode " | |
367 | "with chunksize=%d and reseed_limit=%u\n", | |
368 | prng_chunk_size, prng_reseed_limit); | |
369 | ||
370 | /* memory allocation, prng_data struct init, mutex init */ | |
371 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
372 | if (fips_enabled) | |
373 | datalen += prng_chunk_size; | |
374 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
375 | if (!prng_data) { | |
376 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
377 | return -ENOMEM; | |
378 | } | |
379 | mutex_init(&prng_data->mutex); | |
380 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
381 | ||
382 | /* selftest */ | |
383 | ret = prng_sha512_selftest(); | |
384 | if (ret) | |
385 | goto outfree; | |
386 | ||
387 | /* generate initial seed bytestring, first 48 bytes of entropy */ | |
388 | ret = generate_entropy(seed, 48); | |
389 | if (ret != 48) | |
390 | goto outfree; | |
391 | /* followed by 16 bytes of unique nonce */ | |
392 | get_tod_clock_ext(seed + 48); | |
393 | ||
394 | /* initial seed of the ppno drng */ | |
c7d4d259 MS |
395 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, |
396 | &prng_data->ppnows, NULL, 0, seed, sizeof(seed)); | |
57127645 HF |
397 | if (ret < 0) { |
398 | prng_errorflag = PRNG_SEED_FAILED; | |
399 | ret = -EIO; | |
400 | goto outfree; | |
401 | } | |
402 | ||
403 | /* if fips mode is enabled, generate a first block of random | |
404 | bytes for the FIPS 140-2 Conditional Self Test */ | |
405 | if (fips_enabled) { | |
406 | prng_data->prev = prng_data->buf + prng_chunk_size; | |
c7d4d259 MS |
407 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, |
408 | &prng_data->ppnows, | |
409 | prng_data->prev, prng_chunk_size, NULL, 0); | |
57127645 HF |
410 | if (ret < 0 || ret != prng_chunk_size) { |
411 | prng_errorflag = PRNG_GEN_FAILED; | |
412 | ret = -EIO; | |
413 | goto outfree; | |
414 | } | |
415 | } | |
416 | ||
417 | return 0; | |
418 | ||
419 | outfree: | |
420 | kfree(prng_data); | |
421 | return ret; | |
422 | } | |
423 | ||
424 | ||
425 | static void prng_sha512_deinstantiate(void) | |
426 | { | |
427 | pr_debug("The prng module stopped after running in SHA-512 mode\n"); | |
428 | kzfree(prng_data); | |
429 | } | |
430 | ||
431 | ||
432 | static int prng_sha512_reseed(void) | |
433 | { | |
434 | int ret; | |
435 | u8 seed[32]; | |
436 | ||
437 | /* generate 32 bytes of fresh entropy */ | |
438 | ret = generate_entropy(seed, sizeof(seed)); | |
439 | if (ret != sizeof(seed)) | |
440 | return ret; | |
441 | ||
442 | /* do a reseed of the ppno drng with this bytestring */ | |
c7d4d259 MS |
443 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, |
444 | &prng_data->ppnows, NULL, 0, seed, sizeof(seed)); | |
57127645 HF |
445 | if (ret) { |
446 | prng_errorflag = PRNG_RESEED_FAILED; | |
447 | return -EIO; | |
448 | } | |
449 | ||
450 | return 0; | |
451 | } | |
452 | ||
453 | ||
454 | static int prng_sha512_generate(u8 *buf, size_t nbytes) | |
455 | { | |
456 | int ret; | |
457 | ||
458 | /* reseed needed ? */ | |
459 | if (prng_data->ppnows.reseed_counter > prng_reseed_limit) { | |
460 | ret = prng_sha512_reseed(); | |
461 | if (ret) | |
462 | return ret; | |
463 | } | |
464 | ||
465 | /* PPNO generate */ | |
c7d4d259 MS |
466 | ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN, |
467 | &prng_data->ppnows, buf, nbytes, NULL, 0); | |
57127645 HF |
468 | if (ret < 0 || ret != nbytes) { |
469 | prng_errorflag = PRNG_GEN_FAILED; | |
470 | return -EIO; | |
471 | } | |
472 | ||
473 | /* FIPS 140-2 Conditional Self Test */ | |
474 | if (fips_enabled) { | |
475 | if (!memcmp(prng_data->prev, buf, nbytes)) { | |
476 | prng_errorflag = PRNG_GEN_FAILED; | |
477 | return -EILSEQ; | |
478 | } | |
479 | memcpy(prng_data->prev, buf, nbytes); | |
480 | } | |
481 | ||
482 | return ret; | |
483 | } | |
484 | ||
485 | ||
486 | /*** file io functions ***/ | |
487 | ||
488 | static int prng_open(struct inode *inode, struct file *file) | |
489 | { | |
490 | return nonseekable_open(inode, file); | |
491 | } | |
492 | ||
493 | ||
494 | static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, | |
495 | size_t nbytes, loff_t *ppos) | |
496 | { | |
497 | int chunk, n, tmp, ret = 0; | |
498 | ||
499 | /* lock prng_data struct */ | |
500 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
501 | return -ERESTARTSYS; | |
1b278294 | 502 | |
1b278294 | 503 | while (nbytes) { |
1b278294 JG |
504 | if (need_resched()) { |
505 | if (signal_pending(current)) { | |
506 | if (ret == 0) | |
507 | ret = -ERESTARTSYS; | |
508 | break; | |
509 | } | |
57127645 HF |
510 | /* give mutex free before calling schedule() */ |
511 | mutex_unlock(&prng_data->mutex); | |
1b278294 | 512 | schedule(); |
57127645 HF |
513 | /* occopy mutex again */ |
514 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
515 | if (ret == 0) | |
516 | ret = -ERESTARTSYS; | |
517 | return ret; | |
518 | } | |
1b278294 JG |
519 | } |
520 | ||
521 | /* | |
522 | * we lose some random bytes if an attacker issues | |
523 | * reads < 8 bytes, but we don't care | |
524 | */ | |
525 | chunk = min_t(int, nbytes, prng_chunk_size); | |
526 | ||
527 | /* PRNG only likes multiples of 8 bytes */ | |
528 | n = (chunk + 7) & -8; | |
529 | ||
57127645 HF |
530 | if (prng_data->prngws.reseed_counter > prng_reseed_limit) |
531 | prng_tdes_seed(8); | |
1b278294 JG |
532 | |
533 | /* if the CPU supports PRNG stckf is present too */ | |
57127645 | 534 | *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); |
1b278294 JG |
535 | |
536 | /* | |
537 | * Beside the STCKF the input for the TDES-EDE is the output | |
538 | * of the last operation. We differ here from X9.17 since we | |
539 | * only store one timestamp into the buffer. Padding the whole | |
540 | * buffer with timestamps does not improve security, since | |
541 | * successive stckf have nearly constant offsets. | |
542 | * If an attacker knows the first timestamp it would be | |
543 | * trivial to guess the additional values. One timestamp | |
544 | * is therefore enough and still guarantees unique input values. | |
545 | * | |
546 | * Note: you can still get strict X9.17 conformity by setting | |
547 | * prng_chunk_size to 8 bytes. | |
548 | */ | |
c7d4d259 MS |
549 | tmp = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, |
550 | prng_data->buf, prng_data->buf, n); | |
57127645 HF |
551 | if (tmp < 0 || tmp != n) { |
552 | ret = -EIO; | |
553 | break; | |
554 | } | |
1b278294 | 555 | |
57127645 HF |
556 | prng_data->prngws.byte_counter += n; |
557 | prng_data->prngws.reseed_counter += n; | |
1b278294 | 558 | |
57127645 | 559 | if (copy_to_user(ubuf, prng_data->buf, chunk)) |
1b278294 JG |
560 | return -EFAULT; |
561 | ||
562 | nbytes -= chunk; | |
563 | ret += chunk; | |
564 | ubuf += chunk; | |
565 | } | |
57127645 HF |
566 | |
567 | /* unlock prng_data struct */ | |
568 | mutex_unlock(&prng_data->mutex); | |
569 | ||
1b278294 JG |
570 | return ret; |
571 | } | |
572 | ||
57127645 HF |
573 | |
574 | static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, | |
575 | size_t nbytes, loff_t *ppos) | |
576 | { | |
577 | int n, ret = 0; | |
578 | u8 *p; | |
579 | ||
580 | /* if errorflag is set do nothing and return 'broken pipe' */ | |
581 | if (prng_errorflag) | |
582 | return -EPIPE; | |
583 | ||
584 | /* lock prng_data struct */ | |
585 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
586 | return -ERESTARTSYS; | |
587 | ||
588 | while (nbytes) { | |
589 | if (need_resched()) { | |
590 | if (signal_pending(current)) { | |
591 | if (ret == 0) | |
592 | ret = -ERESTARTSYS; | |
593 | break; | |
594 | } | |
595 | /* give mutex free before calling schedule() */ | |
596 | mutex_unlock(&prng_data->mutex); | |
597 | schedule(); | |
598 | /* occopy mutex again */ | |
599 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
600 | if (ret == 0) | |
601 | ret = -ERESTARTSYS; | |
602 | return ret; | |
603 | } | |
604 | } | |
605 | if (prng_data->rest) { | |
606 | /* push left over random bytes from the previous read */ | |
607 | p = prng_data->buf + prng_chunk_size - prng_data->rest; | |
608 | n = (nbytes < prng_data->rest) ? | |
609 | nbytes : prng_data->rest; | |
610 | prng_data->rest -= n; | |
611 | } else { | |
612 | /* generate one chunk of random bytes into read buf */ | |
613 | p = prng_data->buf; | |
614 | n = prng_sha512_generate(p, prng_chunk_size); | |
615 | if (n < 0) { | |
616 | ret = n; | |
617 | break; | |
618 | } | |
619 | if (nbytes < prng_chunk_size) { | |
620 | n = nbytes; | |
621 | prng_data->rest = prng_chunk_size - n; | |
622 | } else { | |
623 | n = prng_chunk_size; | |
624 | prng_data->rest = 0; | |
625 | } | |
626 | } | |
627 | if (copy_to_user(ubuf, p, n)) { | |
628 | ret = -EFAULT; | |
629 | break; | |
630 | } | |
631 | ubuf += n; | |
632 | nbytes -= n; | |
633 | ret += n; | |
634 | } | |
635 | ||
636 | /* unlock prng_data struct */ | |
637 | mutex_unlock(&prng_data->mutex); | |
638 | ||
639 | return ret; | |
640 | } | |
641 | ||
642 | ||
643 | /*** sysfs stuff ***/ | |
644 | ||
645 | static const struct file_operations prng_sha512_fops = { | |
646 | .owner = THIS_MODULE, | |
647 | .open = &prng_open, | |
648 | .release = NULL, | |
649 | .read = &prng_sha512_read, | |
650 | .llseek = noop_llseek, | |
651 | }; | |
652 | static const struct file_operations prng_tdes_fops = { | |
1b278294 JG |
653 | .owner = THIS_MODULE, |
654 | .open = &prng_open, | |
655 | .release = NULL, | |
57127645 | 656 | .read = &prng_tdes_read, |
6038f373 | 657 | .llseek = noop_llseek, |
1b278294 JG |
658 | }; |
659 | ||
57127645 HF |
660 | static struct miscdevice prng_sha512_dev = { |
661 | .name = "prandom", | |
662 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 663 | .mode = 0644, |
57127645 HF |
664 | .fops = &prng_sha512_fops, |
665 | }; | |
666 | static struct miscdevice prng_tdes_dev = { | |
1b278294 JG |
667 | .name = "prandom", |
668 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 669 | .mode = 0644, |
57127645 | 670 | .fops = &prng_tdes_fops, |
1b278294 JG |
671 | }; |
672 | ||
57127645 HF |
673 | |
674 | /* chunksize attribute (ro) */ | |
675 | static ssize_t prng_chunksize_show(struct device *dev, | |
676 | struct device_attribute *attr, | |
677 | char *buf) | |
678 | { | |
679 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); | |
680 | } | |
681 | static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); | |
682 | ||
683 | /* counter attribute (ro) */ | |
684 | static ssize_t prng_counter_show(struct device *dev, | |
685 | struct device_attribute *attr, | |
686 | char *buf) | |
687 | { | |
688 | u64 counter; | |
689 | ||
690 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
691 | return -ERESTARTSYS; | |
692 | if (prng_mode == PRNG_MODE_SHA512) | |
693 | counter = prng_data->ppnows.stream_bytes; | |
694 | else | |
695 | counter = prng_data->prngws.byte_counter; | |
696 | mutex_unlock(&prng_data->mutex); | |
697 | ||
698 | return snprintf(buf, PAGE_SIZE, "%llu\n", counter); | |
699 | } | |
700 | static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); | |
701 | ||
702 | /* errorflag attribute (ro) */ | |
703 | static ssize_t prng_errorflag_show(struct device *dev, | |
704 | struct device_attribute *attr, | |
705 | char *buf) | |
706 | { | |
707 | return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); | |
708 | } | |
709 | static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); | |
710 | ||
711 | /* mode attribute (ro) */ | |
712 | static ssize_t prng_mode_show(struct device *dev, | |
713 | struct device_attribute *attr, | |
714 | char *buf) | |
715 | { | |
716 | if (prng_mode == PRNG_MODE_TDES) | |
717 | return snprintf(buf, PAGE_SIZE, "TDES\n"); | |
718 | else | |
719 | return snprintf(buf, PAGE_SIZE, "SHA512\n"); | |
720 | } | |
721 | static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); | |
722 | ||
723 | /* reseed attribute (w) */ | |
724 | static ssize_t prng_reseed_store(struct device *dev, | |
725 | struct device_attribute *attr, | |
726 | const char *buf, size_t count) | |
727 | { | |
728 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
729 | return -ERESTARTSYS; | |
730 | prng_sha512_reseed(); | |
731 | mutex_unlock(&prng_data->mutex); | |
732 | ||
733 | return count; | |
734 | } | |
735 | static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); | |
736 | ||
737 | /* reseed limit attribute (rw) */ | |
738 | static ssize_t prng_reseed_limit_show(struct device *dev, | |
739 | struct device_attribute *attr, | |
740 | char *buf) | |
741 | { | |
742 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); | |
743 | } | |
744 | static ssize_t prng_reseed_limit_store(struct device *dev, | |
745 | struct device_attribute *attr, | |
746 | const char *buf, size_t count) | |
747 | { | |
748 | unsigned limit; | |
749 | ||
750 | if (sscanf(buf, "%u\n", &limit) != 1) | |
751 | return -EINVAL; | |
752 | ||
753 | if (prng_mode == PRNG_MODE_SHA512) { | |
754 | if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
755 | return -EINVAL; | |
756 | } else { | |
757 | if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
758 | return -EINVAL; | |
759 | } | |
760 | ||
761 | prng_reseed_limit = limit; | |
762 | ||
763 | return count; | |
764 | } | |
765 | static DEVICE_ATTR(reseed_limit, 0644, | |
766 | prng_reseed_limit_show, prng_reseed_limit_store); | |
767 | ||
768 | /* strength attribute (ro) */ | |
769 | static ssize_t prng_strength_show(struct device *dev, | |
770 | struct device_attribute *attr, | |
771 | char *buf) | |
772 | { | |
773 | return snprintf(buf, PAGE_SIZE, "256\n"); | |
774 | } | |
775 | static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); | |
776 | ||
777 | static struct attribute *prng_sha512_dev_attrs[] = { | |
778 | &dev_attr_errorflag.attr, | |
779 | &dev_attr_chunksize.attr, | |
780 | &dev_attr_byte_counter.attr, | |
781 | &dev_attr_mode.attr, | |
782 | &dev_attr_reseed.attr, | |
783 | &dev_attr_reseed_limit.attr, | |
784 | &dev_attr_strength.attr, | |
785 | NULL | |
786 | }; | |
787 | static struct attribute *prng_tdes_dev_attrs[] = { | |
788 | &dev_attr_chunksize.attr, | |
789 | &dev_attr_byte_counter.attr, | |
790 | &dev_attr_mode.attr, | |
791 | NULL | |
792 | }; | |
793 | ||
794 | static struct attribute_group prng_sha512_dev_attr_group = { | |
795 | .attrs = prng_sha512_dev_attrs | |
796 | }; | |
797 | static struct attribute_group prng_tdes_dev_attr_group = { | |
798 | .attrs = prng_tdes_dev_attrs | |
799 | }; | |
800 | ||
801 | ||
802 | /*** module init and exit ***/ | |
803 | ||
1b278294 JG |
804 | static int __init prng_init(void) |
805 | { | |
806 | int ret; | |
807 | ||
808 | /* check if the CPU has a PRNG */ | |
c7d4d259 | 809 | if (!cpacf_query(CPACF_KMC, CPACF_KMC_PRNG)) |
1b278294 JG |
810 | return -EOPNOTSUPP; |
811 | ||
57127645 HF |
812 | /* choose prng mode */ |
813 | if (prng_mode != PRNG_MODE_TDES) { | |
814 | /* check for MSA5 support for PPNO operations */ | |
c7d4d259 | 815 | if (!cpacf_query(CPACF_PPNO, CPACF_PPNO_SHA512_DRNG_GEN)) { |
57127645 HF |
816 | if (prng_mode == PRNG_MODE_SHA512) { |
817 | pr_err("The prng module cannot " | |
818 | "start in SHA-512 mode\n"); | |
819 | return -EOPNOTSUPP; | |
820 | } | |
821 | prng_mode = PRNG_MODE_TDES; | |
822 | } else | |
823 | prng_mode = PRNG_MODE_SHA512; | |
824 | } | |
1b278294 | 825 | |
57127645 | 826 | if (prng_mode == PRNG_MODE_SHA512) { |
1b278294 | 827 | |
57127645 | 828 | /* SHA512 mode */ |
1b278294 | 829 | |
57127645 HF |
830 | if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN |
831 | || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) | |
832 | return -EINVAL; | |
833 | prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; | |
1b278294 | 834 | |
57127645 HF |
835 | if (prng_reseed_limit == 0) |
836 | prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; | |
837 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
838 | return -EINVAL; | |
839 | ||
840 | ret = prng_sha512_instantiate(); | |
841 | if (ret) | |
842 | goto out; | |
843 | ||
844 | ret = misc_register(&prng_sha512_dev); | |
845 | if (ret) { | |
846 | prng_sha512_deinstantiate(); | |
847 | goto out; | |
848 | } | |
849 | ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, | |
850 | &prng_sha512_dev_attr_group); | |
851 | if (ret) { | |
852 | misc_deregister(&prng_sha512_dev); | |
853 | prng_sha512_deinstantiate(); | |
854 | goto out; | |
855 | } | |
1b278294 | 856 | |
57127645 HF |
857 | } else { |
858 | ||
859 | /* TDES mode */ | |
860 | ||
861 | if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN | |
862 | || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) | |
863 | return -EINVAL; | |
864 | prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; | |
865 | ||
866 | if (prng_reseed_limit == 0) | |
867 | prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; | |
868 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
869 | return -EINVAL; | |
870 | ||
871 | ret = prng_tdes_instantiate(); | |
872 | if (ret) | |
873 | goto out; | |
874 | ||
875 | ret = misc_register(&prng_tdes_dev); | |
876 | if (ret) { | |
877 | prng_tdes_deinstantiate(); | |
878 | goto out; | |
879 | } | |
880 | ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, | |
881 | &prng_tdes_dev_attr_group); | |
882 | if (ret) { | |
883 | misc_deregister(&prng_tdes_dev); | |
884 | prng_tdes_deinstantiate(); | |
885 | goto out; | |
886 | } | |
887 | ||
888 | } | |
889 | ||
890 | out: | |
1b278294 JG |
891 | return ret; |
892 | } | |
893 | ||
57127645 | 894 | |
1b278294 JG |
895 | static void __exit prng_exit(void) |
896 | { | |
57127645 HF |
897 | if (prng_mode == PRNG_MODE_SHA512) { |
898 | sysfs_remove_group(&prng_sha512_dev.this_device->kobj, | |
899 | &prng_sha512_dev_attr_group); | |
900 | misc_deregister(&prng_sha512_dev); | |
901 | prng_sha512_deinstantiate(); | |
902 | } else { | |
903 | sysfs_remove_group(&prng_tdes_dev.this_device->kobj, | |
904 | &prng_tdes_dev_attr_group); | |
905 | misc_deregister(&prng_tdes_dev); | |
906 | prng_tdes_deinstantiate(); | |
907 | } | |
1b278294 JG |
908 | } |
909 | ||
d05377c1 | 910 | module_cpu_feature_match(MSA, prng_init); |
1b278294 | 911 | module_exit(prng_exit); |