Commit | Line | Data |
---|---|---|
1b278294 | 1 | /* |
57127645 | 2 | * Copyright IBM Corp. 2006, 2015 |
1b278294 | 3 | * Author(s): Jan Glauber <jan.glauber@de.ibm.com> |
57127645 | 4 | * Harald Freudenberger <freude@de.ibm.com> |
1b278294 JG |
5 | * Driver for the s390 pseudo random number generator |
6 | */ | |
57127645 HF |
7 | |
8 | #define KMSG_COMPONENT "prng" | |
9 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
10 | ||
1b278294 | 11 | #include <linux/fs.h> |
57127645 | 12 | #include <linux/fips.h> |
1b278294 JG |
13 | #include <linux/init.h> |
14 | #include <linux/kernel.h> | |
57127645 | 15 | #include <linux/device.h> |
1b278294 JG |
16 | #include <linux/miscdevice.h> |
17 | #include <linux/module.h> | |
18 | #include <linux/moduleparam.h> | |
57127645 | 19 | #include <linux/mutex.h> |
d05377c1 | 20 | #include <linux/cpufeature.h> |
1b278294 | 21 | #include <linux/random.h> |
5a0e3ad6 | 22 | #include <linux/slab.h> |
1b278294 JG |
23 | #include <asm/debug.h> |
24 | #include <asm/uaccess.h> | |
57127645 | 25 | #include <asm/timex.h> |
1b278294 JG |
26 | |
27 | #include "crypt_s390.h" | |
28 | ||
29 | MODULE_LICENSE("GPL"); | |
57127645 | 30 | MODULE_AUTHOR("IBM Corporation"); |
1b278294 JG |
31 | MODULE_DESCRIPTION("s390 PRNG interface"); |
32 | ||
57127645 HF |
33 | |
34 | #define PRNG_MODE_AUTO 0 | |
35 | #define PRNG_MODE_TDES 1 | |
36 | #define PRNG_MODE_SHA512 2 | |
37 | ||
38 | static unsigned int prng_mode = PRNG_MODE_AUTO; | |
39 | module_param_named(mode, prng_mode, int, 0); | |
40 | MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); | |
41 | ||
42 | ||
43 | #define PRNG_CHUNKSIZE_TDES_MIN 8 | |
44 | #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) | |
45 | #define PRNG_CHUNKSIZE_SHA512_MIN 64 | |
46 | #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) | |
47 | ||
48 | static unsigned int prng_chunk_size = 256; | |
49 | module_param_named(chunksize, prng_chunk_size, int, 0); | |
1b278294 JG |
50 | MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); |
51 | ||
57127645 HF |
52 | |
53 | #define PRNG_RESEED_LIMIT_TDES 4096 | |
54 | #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 | |
55 | #define PRNG_RESEED_LIMIT_SHA512 100000 | |
56 | #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 | |
57 | ||
58 | static unsigned int prng_reseed_limit; | |
59 | module_param_named(reseed_limit, prng_reseed_limit, int, 0); | |
60 | MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); | |
61 | ||
1b278294 JG |
62 | |
63 | /* | |
64 | * Any one who considers arithmetical methods of producing random digits is, | |
65 | * of course, in a state of sin. -- John von Neumann | |
66 | */ | |
67 | ||
57127645 HF |
68 | static int prng_errorflag; |
69 | ||
70 | #define PRNG_GEN_ENTROPY_FAILED 1 | |
71 | #define PRNG_SELFTEST_FAILED 2 | |
72 | #define PRNG_INSTANTIATE_FAILED 3 | |
73 | #define PRNG_SEED_FAILED 4 | |
74 | #define PRNG_RESEED_FAILED 5 | |
75 | #define PRNG_GEN_FAILED 6 | |
76 | ||
77 | struct prng_ws_s { | |
78 | u8 parm_block[32]; | |
79 | u32 reseed_counter; | |
80 | u64 byte_counter; | |
1b278294 JG |
81 | }; |
82 | ||
57127645 HF |
83 | struct ppno_ws_s { |
84 | u32 res; | |
85 | u32 reseed_counter; | |
86 | u64 stream_bytes; | |
87 | u8 V[112]; | |
88 | u8 C[112]; | |
89 | }; | |
1b278294 | 90 | |
57127645 HF |
91 | struct prng_data_s { |
92 | struct mutex mutex; | |
93 | union { | |
94 | struct prng_ws_s prngws; | |
95 | struct ppno_ws_s ppnows; | |
96 | }; | |
97 | u8 *buf; | |
98 | u32 rest; | |
99 | u8 *prev; | |
1b278294 JG |
100 | }; |
101 | ||
57127645 HF |
102 | static struct prng_data_s *prng_data; |
103 | ||
104 | /* initial parameter block for tdes mode, copied from libica */ | |
105 | static const u8 initial_parm_block[32] __initconst = { | |
106 | 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, | |
107 | 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, | |
108 | 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, | |
109 | 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; | |
110 | ||
111 | ||
112 | /*** helper functions ***/ | |
113 | ||
114 | static int generate_entropy(u8 *ebuf, size_t nbytes) | |
1b278294 | 115 | { |
57127645 HF |
116 | int n, ret = 0; |
117 | u8 *pg, *h, hash[32]; | |
118 | ||
119 | pg = (u8 *) __get_free_page(GFP_KERNEL); | |
120 | if (!pg) { | |
121 | prng_errorflag = PRNG_GEN_ENTROPY_FAILED; | |
122 | return -ENOMEM; | |
123 | } | |
124 | ||
125 | while (nbytes) { | |
126 | /* fill page with urandom bytes */ | |
127 | get_random_bytes(pg, PAGE_SIZE); | |
128 | /* exor page with stckf values */ | |
c431761d | 129 | for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) { |
57127645 HF |
130 | u64 *p = ((u64 *)pg) + n; |
131 | *p ^= get_tod_clock_fast(); | |
132 | } | |
133 | n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); | |
134 | if (n < sizeof(hash)) | |
135 | h = hash; | |
136 | else | |
137 | h = ebuf; | |
138 | /* generate sha256 from this page */ | |
139 | if (crypt_s390_kimd(KIMD_SHA_256, h, | |
140 | pg, PAGE_SIZE) != PAGE_SIZE) { | |
141 | prng_errorflag = PRNG_GEN_ENTROPY_FAILED; | |
142 | ret = -EIO; | |
143 | goto out; | |
144 | } | |
145 | if (n < sizeof(hash)) | |
146 | memcpy(ebuf, hash, n); | |
147 | ret += n; | |
148 | ebuf += n; | |
149 | nbytes -= n; | |
150 | } | |
151 | ||
152 | out: | |
153 | free_page((unsigned long)pg); | |
154 | return ret; | |
1b278294 JG |
155 | } |
156 | ||
57127645 HF |
157 | |
158 | /*** tdes functions ***/ | |
159 | ||
160 | static void prng_tdes_add_entropy(void) | |
1b278294 JG |
161 | { |
162 | __u64 entropy[4]; | |
163 | unsigned int i; | |
164 | int ret; | |
165 | ||
166 | for (i = 0; i < 16; i++) { | |
57127645 HF |
167 | ret = crypt_s390_kmc(KMC_PRNG, prng_data->prngws.parm_block, |
168 | (char *)entropy, (char *)entropy, | |
169 | sizeof(entropy)); | |
1b278294 | 170 | BUG_ON(ret < 0 || ret != sizeof(entropy)); |
57127645 | 171 | memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); |
1b278294 JG |
172 | } |
173 | } | |
174 | ||
57127645 HF |
175 | |
176 | static void prng_tdes_seed(int nbytes) | |
1b278294 JG |
177 | { |
178 | char buf[16]; | |
179 | int i = 0; | |
180 | ||
57127645 HF |
181 | BUG_ON(nbytes > sizeof(buf)); |
182 | ||
1b278294 JG |
183 | get_random_bytes(buf, nbytes); |
184 | ||
185 | /* Add the entropy */ | |
186 | while (nbytes >= 8) { | |
57127645 HF |
187 | *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); |
188 | prng_tdes_add_entropy(); | |
1b278294 JG |
189 | i += 8; |
190 | nbytes -= 8; | |
191 | } | |
57127645 HF |
192 | prng_tdes_add_entropy(); |
193 | prng_data->prngws.reseed_counter = 0; | |
194 | } | |
195 | ||
196 | ||
197 | static int __init prng_tdes_instantiate(void) | |
198 | { | |
199 | int datalen; | |
200 | ||
201 | pr_debug("prng runs in TDES mode with " | |
202 | "chunksize=%d and reseed_limit=%u\n", | |
203 | prng_chunk_size, prng_reseed_limit); | |
204 | ||
205 | /* memory allocation, prng_data struct init, mutex init */ | |
206 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
207 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
208 | if (!prng_data) { | |
209 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
210 | return -ENOMEM; | |
211 | } | |
212 | mutex_init(&prng_data->mutex); | |
213 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
214 | memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); | |
215 | ||
216 | /* initialize the PRNG, add 128 bits of entropy */ | |
217 | prng_tdes_seed(16); | |
218 | ||
219 | return 0; | |
1b278294 JG |
220 | } |
221 | ||
57127645 HF |
222 | |
223 | static void prng_tdes_deinstantiate(void) | |
224 | { | |
225 | pr_debug("The prng module stopped " | |
226 | "after running in triple DES mode\n"); | |
227 | kzfree(prng_data); | |
228 | } | |
229 | ||
230 | ||
231 | /*** sha512 functions ***/ | |
232 | ||
233 | static int __init prng_sha512_selftest(void) | |
1b278294 | 234 | { |
57127645 HF |
235 | /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ |
236 | static const u8 seed[] __initconst = { | |
237 | 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, | |
238 | 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, | |
239 | 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, | |
240 | 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, | |
241 | 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, | |
242 | 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; | |
243 | static const u8 V0[] __initconst = { | |
244 | 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, | |
245 | 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, | |
246 | 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, | |
247 | 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, | |
248 | 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, | |
249 | 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, | |
250 | 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, | |
251 | 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, | |
252 | 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, | |
253 | 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, | |
254 | 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, | |
255 | 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, | |
256 | 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, | |
257 | 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; | |
258 | static const u8 C0[] __initconst = { | |
259 | 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, | |
260 | 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, | |
261 | 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, | |
262 | 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, | |
263 | 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, | |
264 | 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, | |
265 | 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, | |
266 | 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, | |
267 | 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, | |
268 | 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, | |
269 | 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, | |
270 | 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, | |
271 | 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, | |
272 | 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; | |
273 | static const u8 random[] __initconst = { | |
274 | 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, | |
275 | 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, | |
276 | 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, | |
277 | 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, | |
278 | 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, | |
279 | 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, | |
280 | 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, | |
281 | 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, | |
282 | 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, | |
283 | 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, | |
284 | 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, | |
285 | 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, | |
286 | 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, | |
287 | 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, | |
288 | 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, | |
289 | 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, | |
290 | 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, | |
291 | 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, | |
292 | 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, | |
293 | 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, | |
294 | 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, | |
295 | 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, | |
296 | 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, | |
297 | 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, | |
298 | 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, | |
299 | 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, | |
300 | 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, | |
301 | 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, | |
302 | 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, | |
303 | 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, | |
304 | 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, | |
305 | 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; | |
306 | ||
1b278294 | 307 | int ret = 0; |
57127645 HF |
308 | u8 buf[sizeof(random)]; |
309 | struct ppno_ws_s ws; | |
310 | ||
311 | memset(&ws, 0, sizeof(ws)); | |
312 | ||
313 | /* initial seed */ | |
314 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, | |
315 | &ws, NULL, 0, | |
316 | seed, sizeof(seed)); | |
317 | if (ret < 0) { | |
318 | pr_err("The prng self test seed operation for the " | |
319 | "SHA-512 mode failed with rc=%d\n", ret); | |
320 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
321 | return -EIO; | |
322 | } | |
323 | ||
324 | /* check working states V and C */ | |
325 | if (memcmp(ws.V, V0, sizeof(V0)) != 0 | |
326 | || memcmp(ws.C, C0, sizeof(C0)) != 0) { | |
327 | pr_err("The prng self test state test " | |
328 | "for the SHA-512 mode failed\n"); | |
329 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
330 | return -EIO; | |
331 | } | |
332 | ||
333 | /* generate random bytes */ | |
334 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, | |
335 | &ws, buf, sizeof(buf), | |
336 | NULL, 0); | |
337 | if (ret < 0) { | |
338 | pr_err("The prng self test generate operation for " | |
339 | "the SHA-512 mode failed with rc=%d\n", ret); | |
340 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
341 | return -EIO; | |
342 | } | |
343 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, | |
344 | &ws, buf, sizeof(buf), | |
345 | NULL, 0); | |
346 | if (ret < 0) { | |
347 | pr_err("The prng self test generate operation for " | |
348 | "the SHA-512 mode failed with rc=%d\n", ret); | |
349 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
350 | return -EIO; | |
351 | } | |
352 | ||
353 | /* check against expected data */ | |
354 | if (memcmp(buf, random, sizeof(random)) != 0) { | |
355 | pr_err("The prng self test data test " | |
356 | "for the SHA-512 mode failed\n"); | |
357 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
358 | return -EIO; | |
359 | } | |
360 | ||
361 | return 0; | |
362 | } | |
363 | ||
364 | ||
365 | static int __init prng_sha512_instantiate(void) | |
366 | { | |
367 | int ret, datalen; | |
368 | u8 seed[64]; | |
369 | ||
370 | pr_debug("prng runs in SHA-512 mode " | |
371 | "with chunksize=%d and reseed_limit=%u\n", | |
372 | prng_chunk_size, prng_reseed_limit); | |
373 | ||
374 | /* memory allocation, prng_data struct init, mutex init */ | |
375 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
376 | if (fips_enabled) | |
377 | datalen += prng_chunk_size; | |
378 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
379 | if (!prng_data) { | |
380 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
381 | return -ENOMEM; | |
382 | } | |
383 | mutex_init(&prng_data->mutex); | |
384 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
385 | ||
386 | /* selftest */ | |
387 | ret = prng_sha512_selftest(); | |
388 | if (ret) | |
389 | goto outfree; | |
390 | ||
391 | /* generate initial seed bytestring, first 48 bytes of entropy */ | |
392 | ret = generate_entropy(seed, 48); | |
393 | if (ret != 48) | |
394 | goto outfree; | |
395 | /* followed by 16 bytes of unique nonce */ | |
396 | get_tod_clock_ext(seed + 48); | |
397 | ||
398 | /* initial seed of the ppno drng */ | |
399 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, | |
400 | &prng_data->ppnows, NULL, 0, | |
401 | seed, sizeof(seed)); | |
402 | if (ret < 0) { | |
403 | prng_errorflag = PRNG_SEED_FAILED; | |
404 | ret = -EIO; | |
405 | goto outfree; | |
406 | } | |
407 | ||
408 | /* if fips mode is enabled, generate a first block of random | |
409 | bytes for the FIPS 140-2 Conditional Self Test */ | |
410 | if (fips_enabled) { | |
411 | prng_data->prev = prng_data->buf + prng_chunk_size; | |
412 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, | |
413 | &prng_data->ppnows, | |
414 | prng_data->prev, | |
415 | prng_chunk_size, | |
416 | NULL, 0); | |
417 | if (ret < 0 || ret != prng_chunk_size) { | |
418 | prng_errorflag = PRNG_GEN_FAILED; | |
419 | ret = -EIO; | |
420 | goto outfree; | |
421 | } | |
422 | } | |
423 | ||
424 | return 0; | |
425 | ||
426 | outfree: | |
427 | kfree(prng_data); | |
428 | return ret; | |
429 | } | |
430 | ||
431 | ||
432 | static void prng_sha512_deinstantiate(void) | |
433 | { | |
434 | pr_debug("The prng module stopped after running in SHA-512 mode\n"); | |
435 | kzfree(prng_data); | |
436 | } | |
437 | ||
438 | ||
439 | static int prng_sha512_reseed(void) | |
440 | { | |
441 | int ret; | |
442 | u8 seed[32]; | |
443 | ||
444 | /* generate 32 bytes of fresh entropy */ | |
445 | ret = generate_entropy(seed, sizeof(seed)); | |
446 | if (ret != sizeof(seed)) | |
447 | return ret; | |
448 | ||
449 | /* do a reseed of the ppno drng with this bytestring */ | |
450 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_SEED, | |
451 | &prng_data->ppnows, NULL, 0, | |
452 | seed, sizeof(seed)); | |
453 | if (ret) { | |
454 | prng_errorflag = PRNG_RESEED_FAILED; | |
455 | return -EIO; | |
456 | } | |
457 | ||
458 | return 0; | |
459 | } | |
460 | ||
461 | ||
462 | static int prng_sha512_generate(u8 *buf, size_t nbytes) | |
463 | { | |
464 | int ret; | |
465 | ||
466 | /* reseed needed ? */ | |
467 | if (prng_data->ppnows.reseed_counter > prng_reseed_limit) { | |
468 | ret = prng_sha512_reseed(); | |
469 | if (ret) | |
470 | return ret; | |
471 | } | |
472 | ||
473 | /* PPNO generate */ | |
474 | ret = crypt_s390_ppno(PPNO_SHA512_DRNG_GEN, | |
475 | &prng_data->ppnows, buf, nbytes, | |
476 | NULL, 0); | |
477 | if (ret < 0 || ret != nbytes) { | |
478 | prng_errorflag = PRNG_GEN_FAILED; | |
479 | return -EIO; | |
480 | } | |
481 | ||
482 | /* FIPS 140-2 Conditional Self Test */ | |
483 | if (fips_enabled) { | |
484 | if (!memcmp(prng_data->prev, buf, nbytes)) { | |
485 | prng_errorflag = PRNG_GEN_FAILED; | |
486 | return -EILSEQ; | |
487 | } | |
488 | memcpy(prng_data->prev, buf, nbytes); | |
489 | } | |
490 | ||
491 | return ret; | |
492 | } | |
493 | ||
494 | ||
495 | /*** file io functions ***/ | |
496 | ||
497 | static int prng_open(struct inode *inode, struct file *file) | |
498 | { | |
499 | return nonseekable_open(inode, file); | |
500 | } | |
501 | ||
502 | ||
503 | static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, | |
504 | size_t nbytes, loff_t *ppos) | |
505 | { | |
506 | int chunk, n, tmp, ret = 0; | |
507 | ||
508 | /* lock prng_data struct */ | |
509 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
510 | return -ERESTARTSYS; | |
1b278294 | 511 | |
1b278294 | 512 | while (nbytes) { |
1b278294 JG |
513 | if (need_resched()) { |
514 | if (signal_pending(current)) { | |
515 | if (ret == 0) | |
516 | ret = -ERESTARTSYS; | |
517 | break; | |
518 | } | |
57127645 HF |
519 | /* give mutex free before calling schedule() */ |
520 | mutex_unlock(&prng_data->mutex); | |
1b278294 | 521 | schedule(); |
57127645 HF |
522 | /* occopy mutex again */ |
523 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
524 | if (ret == 0) | |
525 | ret = -ERESTARTSYS; | |
526 | return ret; | |
527 | } | |
1b278294 JG |
528 | } |
529 | ||
530 | /* | |
531 | * we lose some random bytes if an attacker issues | |
532 | * reads < 8 bytes, but we don't care | |
533 | */ | |
534 | chunk = min_t(int, nbytes, prng_chunk_size); | |
535 | ||
536 | /* PRNG only likes multiples of 8 bytes */ | |
537 | n = (chunk + 7) & -8; | |
538 | ||
57127645 HF |
539 | if (prng_data->prngws.reseed_counter > prng_reseed_limit) |
540 | prng_tdes_seed(8); | |
1b278294 JG |
541 | |
542 | /* if the CPU supports PRNG stckf is present too */ | |
57127645 | 543 | *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); |
1b278294 JG |
544 | |
545 | /* | |
546 | * Beside the STCKF the input for the TDES-EDE is the output | |
547 | * of the last operation. We differ here from X9.17 since we | |
548 | * only store one timestamp into the buffer. Padding the whole | |
549 | * buffer with timestamps does not improve security, since | |
550 | * successive stckf have nearly constant offsets. | |
551 | * If an attacker knows the first timestamp it would be | |
552 | * trivial to guess the additional values. One timestamp | |
553 | * is therefore enough and still guarantees unique input values. | |
554 | * | |
555 | * Note: you can still get strict X9.17 conformity by setting | |
556 | * prng_chunk_size to 8 bytes. | |
557 | */ | |
57127645 HF |
558 | tmp = crypt_s390_kmc(KMC_PRNG, prng_data->prngws.parm_block, |
559 | prng_data->buf, prng_data->buf, n); | |
560 | if (tmp < 0 || tmp != n) { | |
561 | ret = -EIO; | |
562 | break; | |
563 | } | |
1b278294 | 564 | |
57127645 HF |
565 | prng_data->prngws.byte_counter += n; |
566 | prng_data->prngws.reseed_counter += n; | |
1b278294 | 567 | |
57127645 | 568 | if (copy_to_user(ubuf, prng_data->buf, chunk)) |
1b278294 JG |
569 | return -EFAULT; |
570 | ||
571 | nbytes -= chunk; | |
572 | ret += chunk; | |
573 | ubuf += chunk; | |
574 | } | |
57127645 HF |
575 | |
576 | /* unlock prng_data struct */ | |
577 | mutex_unlock(&prng_data->mutex); | |
578 | ||
1b278294 JG |
579 | return ret; |
580 | } | |
581 | ||
57127645 HF |
582 | |
583 | static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, | |
584 | size_t nbytes, loff_t *ppos) | |
585 | { | |
586 | int n, ret = 0; | |
587 | u8 *p; | |
588 | ||
589 | /* if errorflag is set do nothing and return 'broken pipe' */ | |
590 | if (prng_errorflag) | |
591 | return -EPIPE; | |
592 | ||
593 | /* lock prng_data struct */ | |
594 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
595 | return -ERESTARTSYS; | |
596 | ||
597 | while (nbytes) { | |
598 | if (need_resched()) { | |
599 | if (signal_pending(current)) { | |
600 | if (ret == 0) | |
601 | ret = -ERESTARTSYS; | |
602 | break; | |
603 | } | |
604 | /* give mutex free before calling schedule() */ | |
605 | mutex_unlock(&prng_data->mutex); | |
606 | schedule(); | |
607 | /* occopy mutex again */ | |
608 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
609 | if (ret == 0) | |
610 | ret = -ERESTARTSYS; | |
611 | return ret; | |
612 | } | |
613 | } | |
614 | if (prng_data->rest) { | |
615 | /* push left over random bytes from the previous read */ | |
616 | p = prng_data->buf + prng_chunk_size - prng_data->rest; | |
617 | n = (nbytes < prng_data->rest) ? | |
618 | nbytes : prng_data->rest; | |
619 | prng_data->rest -= n; | |
620 | } else { | |
621 | /* generate one chunk of random bytes into read buf */ | |
622 | p = prng_data->buf; | |
623 | n = prng_sha512_generate(p, prng_chunk_size); | |
624 | if (n < 0) { | |
625 | ret = n; | |
626 | break; | |
627 | } | |
628 | if (nbytes < prng_chunk_size) { | |
629 | n = nbytes; | |
630 | prng_data->rest = prng_chunk_size - n; | |
631 | } else { | |
632 | n = prng_chunk_size; | |
633 | prng_data->rest = 0; | |
634 | } | |
635 | } | |
636 | if (copy_to_user(ubuf, p, n)) { | |
637 | ret = -EFAULT; | |
638 | break; | |
639 | } | |
640 | ubuf += n; | |
641 | nbytes -= n; | |
642 | ret += n; | |
643 | } | |
644 | ||
645 | /* unlock prng_data struct */ | |
646 | mutex_unlock(&prng_data->mutex); | |
647 | ||
648 | return ret; | |
649 | } | |
650 | ||
651 | ||
652 | /*** sysfs stuff ***/ | |
653 | ||
654 | static const struct file_operations prng_sha512_fops = { | |
655 | .owner = THIS_MODULE, | |
656 | .open = &prng_open, | |
657 | .release = NULL, | |
658 | .read = &prng_sha512_read, | |
659 | .llseek = noop_llseek, | |
660 | }; | |
661 | static const struct file_operations prng_tdes_fops = { | |
1b278294 JG |
662 | .owner = THIS_MODULE, |
663 | .open = &prng_open, | |
664 | .release = NULL, | |
57127645 | 665 | .read = &prng_tdes_read, |
6038f373 | 666 | .llseek = noop_llseek, |
1b278294 JG |
667 | }; |
668 | ||
57127645 HF |
669 | static struct miscdevice prng_sha512_dev = { |
670 | .name = "prandom", | |
671 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 672 | .mode = 0644, |
57127645 HF |
673 | .fops = &prng_sha512_fops, |
674 | }; | |
675 | static struct miscdevice prng_tdes_dev = { | |
1b278294 JG |
676 | .name = "prandom", |
677 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 678 | .mode = 0644, |
57127645 | 679 | .fops = &prng_tdes_fops, |
1b278294 JG |
680 | }; |
681 | ||
57127645 HF |
682 | |
683 | /* chunksize attribute (ro) */ | |
684 | static ssize_t prng_chunksize_show(struct device *dev, | |
685 | struct device_attribute *attr, | |
686 | char *buf) | |
687 | { | |
688 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); | |
689 | } | |
690 | static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); | |
691 | ||
692 | /* counter attribute (ro) */ | |
693 | static ssize_t prng_counter_show(struct device *dev, | |
694 | struct device_attribute *attr, | |
695 | char *buf) | |
696 | { | |
697 | u64 counter; | |
698 | ||
699 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
700 | return -ERESTARTSYS; | |
701 | if (prng_mode == PRNG_MODE_SHA512) | |
702 | counter = prng_data->ppnows.stream_bytes; | |
703 | else | |
704 | counter = prng_data->prngws.byte_counter; | |
705 | mutex_unlock(&prng_data->mutex); | |
706 | ||
707 | return snprintf(buf, PAGE_SIZE, "%llu\n", counter); | |
708 | } | |
709 | static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); | |
710 | ||
711 | /* errorflag attribute (ro) */ | |
712 | static ssize_t prng_errorflag_show(struct device *dev, | |
713 | struct device_attribute *attr, | |
714 | char *buf) | |
715 | { | |
716 | return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); | |
717 | } | |
718 | static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); | |
719 | ||
720 | /* mode attribute (ro) */ | |
721 | static ssize_t prng_mode_show(struct device *dev, | |
722 | struct device_attribute *attr, | |
723 | char *buf) | |
724 | { | |
725 | if (prng_mode == PRNG_MODE_TDES) | |
726 | return snprintf(buf, PAGE_SIZE, "TDES\n"); | |
727 | else | |
728 | return snprintf(buf, PAGE_SIZE, "SHA512\n"); | |
729 | } | |
730 | static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); | |
731 | ||
732 | /* reseed attribute (w) */ | |
733 | static ssize_t prng_reseed_store(struct device *dev, | |
734 | struct device_attribute *attr, | |
735 | const char *buf, size_t count) | |
736 | { | |
737 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
738 | return -ERESTARTSYS; | |
739 | prng_sha512_reseed(); | |
740 | mutex_unlock(&prng_data->mutex); | |
741 | ||
742 | return count; | |
743 | } | |
744 | static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); | |
745 | ||
746 | /* reseed limit attribute (rw) */ | |
747 | static ssize_t prng_reseed_limit_show(struct device *dev, | |
748 | struct device_attribute *attr, | |
749 | char *buf) | |
750 | { | |
751 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); | |
752 | } | |
753 | static ssize_t prng_reseed_limit_store(struct device *dev, | |
754 | struct device_attribute *attr, | |
755 | const char *buf, size_t count) | |
756 | { | |
757 | unsigned limit; | |
758 | ||
759 | if (sscanf(buf, "%u\n", &limit) != 1) | |
760 | return -EINVAL; | |
761 | ||
762 | if (prng_mode == PRNG_MODE_SHA512) { | |
763 | if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
764 | return -EINVAL; | |
765 | } else { | |
766 | if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
767 | return -EINVAL; | |
768 | } | |
769 | ||
770 | prng_reseed_limit = limit; | |
771 | ||
772 | return count; | |
773 | } | |
774 | static DEVICE_ATTR(reseed_limit, 0644, | |
775 | prng_reseed_limit_show, prng_reseed_limit_store); | |
776 | ||
777 | /* strength attribute (ro) */ | |
778 | static ssize_t prng_strength_show(struct device *dev, | |
779 | struct device_attribute *attr, | |
780 | char *buf) | |
781 | { | |
782 | return snprintf(buf, PAGE_SIZE, "256\n"); | |
783 | } | |
784 | static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); | |
785 | ||
786 | static struct attribute *prng_sha512_dev_attrs[] = { | |
787 | &dev_attr_errorflag.attr, | |
788 | &dev_attr_chunksize.attr, | |
789 | &dev_attr_byte_counter.attr, | |
790 | &dev_attr_mode.attr, | |
791 | &dev_attr_reseed.attr, | |
792 | &dev_attr_reseed_limit.attr, | |
793 | &dev_attr_strength.attr, | |
794 | NULL | |
795 | }; | |
796 | static struct attribute *prng_tdes_dev_attrs[] = { | |
797 | &dev_attr_chunksize.attr, | |
798 | &dev_attr_byte_counter.attr, | |
799 | &dev_attr_mode.attr, | |
800 | NULL | |
801 | }; | |
802 | ||
803 | static struct attribute_group prng_sha512_dev_attr_group = { | |
804 | .attrs = prng_sha512_dev_attrs | |
805 | }; | |
806 | static struct attribute_group prng_tdes_dev_attr_group = { | |
807 | .attrs = prng_tdes_dev_attrs | |
808 | }; | |
809 | ||
810 | ||
811 | /*** module init and exit ***/ | |
812 | ||
1b278294 JG |
813 | static int __init prng_init(void) |
814 | { | |
815 | int ret; | |
816 | ||
817 | /* check if the CPU has a PRNG */ | |
1822bc90 | 818 | if (!crypt_s390_func_available(KMC_PRNG, CRYPT_S390_MSA)) |
1b278294 JG |
819 | return -EOPNOTSUPP; |
820 | ||
57127645 HF |
821 | /* choose prng mode */ |
822 | if (prng_mode != PRNG_MODE_TDES) { | |
823 | /* check for MSA5 support for PPNO operations */ | |
824 | if (!crypt_s390_func_available(PPNO_SHA512_DRNG_GEN, | |
825 | CRYPT_S390_MSA5)) { | |
826 | if (prng_mode == PRNG_MODE_SHA512) { | |
827 | pr_err("The prng module cannot " | |
828 | "start in SHA-512 mode\n"); | |
829 | return -EOPNOTSUPP; | |
830 | } | |
831 | prng_mode = PRNG_MODE_TDES; | |
832 | } else | |
833 | prng_mode = PRNG_MODE_SHA512; | |
834 | } | |
1b278294 | 835 | |
57127645 | 836 | if (prng_mode == PRNG_MODE_SHA512) { |
1b278294 | 837 | |
57127645 | 838 | /* SHA512 mode */ |
1b278294 | 839 | |
57127645 HF |
840 | if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN |
841 | || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) | |
842 | return -EINVAL; | |
843 | prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; | |
1b278294 | 844 | |
57127645 HF |
845 | if (prng_reseed_limit == 0) |
846 | prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; | |
847 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
848 | return -EINVAL; | |
849 | ||
850 | ret = prng_sha512_instantiate(); | |
851 | if (ret) | |
852 | goto out; | |
853 | ||
854 | ret = misc_register(&prng_sha512_dev); | |
855 | if (ret) { | |
856 | prng_sha512_deinstantiate(); | |
857 | goto out; | |
858 | } | |
859 | ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, | |
860 | &prng_sha512_dev_attr_group); | |
861 | if (ret) { | |
862 | misc_deregister(&prng_sha512_dev); | |
863 | prng_sha512_deinstantiate(); | |
864 | goto out; | |
865 | } | |
1b278294 | 866 | |
57127645 HF |
867 | } else { |
868 | ||
869 | /* TDES mode */ | |
870 | ||
871 | if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN | |
872 | || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) | |
873 | return -EINVAL; | |
874 | prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; | |
875 | ||
876 | if (prng_reseed_limit == 0) | |
877 | prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; | |
878 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
879 | return -EINVAL; | |
880 | ||
881 | ret = prng_tdes_instantiate(); | |
882 | if (ret) | |
883 | goto out; | |
884 | ||
885 | ret = misc_register(&prng_tdes_dev); | |
886 | if (ret) { | |
887 | prng_tdes_deinstantiate(); | |
888 | goto out; | |
889 | } | |
890 | ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, | |
891 | &prng_tdes_dev_attr_group); | |
892 | if (ret) { | |
893 | misc_deregister(&prng_tdes_dev); | |
894 | prng_tdes_deinstantiate(); | |
895 | goto out; | |
896 | } | |
897 | ||
898 | } | |
899 | ||
900 | out: | |
1b278294 JG |
901 | return ret; |
902 | } | |
903 | ||
57127645 | 904 | |
1b278294 JG |
905 | static void __exit prng_exit(void) |
906 | { | |
57127645 HF |
907 | if (prng_mode == PRNG_MODE_SHA512) { |
908 | sysfs_remove_group(&prng_sha512_dev.this_device->kobj, | |
909 | &prng_sha512_dev_attr_group); | |
910 | misc_deregister(&prng_sha512_dev); | |
911 | prng_sha512_deinstantiate(); | |
912 | } else { | |
913 | sysfs_remove_group(&prng_tdes_dev.this_device->kobj, | |
914 | &prng_tdes_dev_attr_group); | |
915 | misc_deregister(&prng_tdes_dev); | |
916 | prng_tdes_deinstantiate(); | |
917 | } | |
1b278294 JG |
918 | } |
919 | ||
d05377c1 | 920 | module_cpu_feature_match(MSA, prng_init); |
1b278294 | 921 | module_exit(prng_exit); |