arch/s390/crypto/prng.c

   1 /*
   2  * Copyright IBM Corp. 2006, 2015
   3  * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
   4  *            Harald Freudenberger <freude@de.ibm.com>
   5  * Driver for the s390 pseudo random number generator
   6  */
   7
   8 #define KMSG_COMPONENT "prng"
   9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  10
  11 #include <linux/fs.h>
  12 #include <linux/fips.h>
  13 #include <linux/init.h>
  14 #include <linux/kernel.h>
  15 #include <linux/device.h>
  16 #include <linux/miscdevice.h>
  17 #include <linux/module.h>
  18 #include <linux/moduleparam.h>
  19 #include <linux/mutex.h>
  20 #include <linux/cpufeature.h>
  21 #include <linux/random.h>
  22 #include <linux/slab.h>
  23 #include <asm/debug.h>
  24 #include <asm/uaccess.h>
  25 #include <asm/timex.h>
  26 #include <asm/cpacf.h>
  27
  28 MODULE_LICENSE("GPL");
  29 MODULE_AUTHOR("IBM Corporation");
  30 MODULE_DESCRIPTION("s390 PRNG interface");
  31
  32
  33 #define PRNG_MODE_AUTO    0
  34 #define PRNG_MODE_TDES    1
  35 #define PRNG_MODE_SHA512  2
  36
  37 static unsigned int prng_mode = PRNG_MODE_AUTO;
  38 module_param_named(mode, prng_mode, int, 0);
  39 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
  40
  41
  42 #define PRNG_CHUNKSIZE_TDES_MIN   8
  43 #define PRNG_CHUNKSIZE_TDES_MAX   (64*1024)
  44 #define PRNG_CHUNKSIZE_SHA512_MIN 64
  45 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
  46
  47 static unsigned int prng_chunk_size = 256;
  48 module_param_named(chunksize, prng_chunk_size, int, 0);
  49 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
  50
  51
  52 #define PRNG_RESEED_LIMIT_TDES           4096
  53 #define PRNG_RESEED_LIMIT_TDES_LOWER     4096
  54 #define PRNG_RESEED_LIMIT_SHA512       100000
  55 #define PRNG_RESEED_LIMIT_SHA512_LOWER  10000
  56
  57 static unsigned int prng_reseed_limit;
  58 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
  59 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
  60
  61
  62 /*
  63  * Any one who considers arithmetical methods of producing random digits is,
  64  * of course, in a state of sin. -- John von Neumann
  65  */
  66
  67 static int prng_errorflag;
  68
  69 #define PRNG_GEN_ENTROPY_FAILED  1
  70 #define PRNG_SELFTEST_FAILED     2
  71 #define PRNG_INSTANTIATE_FAILED  3
  72 #define PRNG_SEED_FAILED         4
  73 #define PRNG_RESEED_FAILED       5
  74 #define PRNG_GEN_FAILED          6
  75
  76 struct prng_ws_s {
  77         u8  parm_block[32];
  78         u32 reseed_counter;
  79         u64 byte_counter;
  80 };
  81
  82 struct ppno_ws_s {
  83         u32 res;
  84         u32 reseed_counter;
  85         u64 stream_bytes;
  86         u8  V[112];
  87         u8  C[112];
  88 };
  89
  90 struct prng_data_s {
  91         struct mutex mutex;
  92         union {
  93                 struct prng_ws_s prngws;
  94                 struct ppno_ws_s ppnows;
  95         };
  96         u8 *buf;
  97         u32 rest;
  98         u8 *prev;
  99 };
 100
 101 static struct prng_data_s *prng_data;
 102
 103 /* initial parameter block for tdes mode, copied from libica */
 104 static const u8 initial_parm_block[32] __initconst = {
 105         0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
 106         0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
 107         0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
 108         0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
 109
 110
 111 /*** helper functions ***/
 112
 113 static int generate_entropy(u8 *ebuf, size_t nbytes)
 114 {
 115         int n, ret = 0;
 116         u8 *pg, *h, hash[32];
 117
 118         pg = (u8 *) __get_free_page(GFP_KERNEL);
 119         if (!pg) {
 120                 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
 121                 return -ENOMEM;
 122         }
 123
 124         while (nbytes) {
 125                 /* fill page with urandom bytes */
 126                 get_random_bytes(pg, PAGE_SIZE);
 127                 /* exor page with stckf values */
 128                 for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) {
 129                         u64 *p = ((u64 *)pg) + n;
 130                         *p ^= get_tod_clock_fast();
 131                 }
 132                 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
 133                 if (n < sizeof(hash))
 134                         h = hash;
 135                 else
 136                         h = ebuf;
 137                 /* generate sha256 from this page */
 138                 if (cpacf_kimd(CPACF_KIMD_SHA_256, h,
 139                                pg, PAGE_SIZE) != PAGE_SIZE) {
 140                         prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
 141                         ret = -EIO;
 142                         goto out;
 143                 }
 144                 if (n < sizeof(hash))
 145                         memcpy(ebuf, hash, n);
 146                 ret += n;
 147                 ebuf += n;
 148                 nbytes -= n;
 149         }
 150
 151 out:
 152         free_page((unsigned long)pg);
 153         return ret;
 154 }
 155
 156
 157 /*** tdes functions ***/
 158
 159 static void prng_tdes_add_entropy(void)
 160 {
 161         __u64 entropy[4];
 162         unsigned int i;
 163         int ret;
 164
 165         for (i = 0; i < 16; i++) {
 166                 ret = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 167                                 (char *)entropy, (char *)entropy,
 168                                 sizeof(entropy));
 169                 BUG_ON(ret < 0 || ret != sizeof(entropy));
 170                 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
 171         }
 172 }
 173
 174
 175 static void prng_tdes_seed(int nbytes)
 176 {
 177         char buf[16];
 178         int i = 0;
 179
 180         BUG_ON(nbytes > sizeof(buf));
 181
 182         get_random_bytes(buf, nbytes);
 183
 184         /* Add the entropy */
 185         while (nbytes >= 8) {
 186                 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
 187                 prng_tdes_add_entropy();
 188                 i += 8;
 189                 nbytes -= 8;
 190         }
 191         prng_tdes_add_entropy();
 192         prng_data->prngws.reseed_counter = 0;
 193 }
 194
 195
 196 static int __init prng_tdes_instantiate(void)
 197 {
 198         int datalen;
 199
 200         pr_debug("prng runs in TDES mode with "
 201                  "chunksize=%d and reseed_limit=%u\n",
 202                  prng_chunk_size, prng_reseed_limit);
 203
 204         /* memory allocation, prng_data struct init, mutex init */
 205         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 206         prng_data = kzalloc(datalen, GFP_KERNEL);
 207         if (!prng_data) {
 208                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 209                 return -ENOMEM;
 210         }
 211         mutex_init(&prng_data->mutex);
 212         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 213         memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
 214
 215         /* initialize the PRNG, add 128 bits of entropy */
 216         prng_tdes_seed(16);
 217
 218         return 0;
 219 }
 220
 221
 222 static void prng_tdes_deinstantiate(void)
 223 {
 224         pr_debug("The prng module stopped "
 225                  "after running in triple DES mode\n");
 226         kzfree(prng_data);
 227 }
 228
 229
 230 /*** sha512 functions ***/
 231
 232 static int __init prng_sha512_selftest(void)
 233 {
 234         /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
 235         static const u8 seed[] __initconst = {
 236                 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
 237                 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
 238                 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
 239                 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
 240                 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
 241                 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
 242         static const u8 V0[] __initconst = {
 243                 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
 244                 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
 245                 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
 246                 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
 247                 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
 248                 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
 249                 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
 250                 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
 251                 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
 252                 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
 253                 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
 254                 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
 255                 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
 256                 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
 257         static const u8 C0[] __initconst = {
 258                 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
 259                 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
 260                 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
 261                 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
 262                 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
 263                 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
 264                 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
 265                 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
 266                 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
 267                 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
 268                 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
 269                 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
 270                 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
 271                 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
 272         static const u8 random[] __initconst = {
 273                 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
 274                 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
 275                 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
 276                 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
 277                 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
 278                 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
 279                 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
 280                 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
 281                 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
 282                 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
 283                 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
 284                 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
 285                 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
 286                 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
 287                 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
 288                 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
 289                 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
 290                 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
 291                 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
 292                 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
 293                 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
 294                 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
 295                 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
 296                 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
 297                 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
 298                 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
 299                 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
 300                 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
 301                 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
 302                 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
 303                 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
 304                 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
 305
 306         int ret = 0;
 307         u8 buf[sizeof(random)];
 308         struct ppno_ws_s ws;
 309
 310         memset(&ws, 0, sizeof(ws));
 311
 312         /* initial seed */
 313         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, &ws, NULL, 0,
 314                          seed, sizeof(seed));
 315         if (ret < 0) {
 316                 pr_err("The prng self test seed operation for the "
 317                        "SHA-512 mode failed with rc=%d\n", ret);
 318                 prng_errorflag = PRNG_SELFTEST_FAILED;
 319                 return -EIO;
 320         }
 321
 322         /* check working states V and C */
 323         if (memcmp(ws.V, V0, sizeof(V0)) != 0
 324             || memcmp(ws.C, C0, sizeof(C0)) != 0) {
 325                 pr_err("The prng self test state test "
 326                        "for the SHA-512 mode failed\n");
 327                 prng_errorflag = PRNG_SELFTEST_FAILED;
 328                 return -EIO;
 329         }
 330
 331         /* generate random bytes */
 332         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
 333                          &ws, buf, sizeof(buf), NULL, 0);
 334         if (ret < 0) {
 335                 pr_err("The prng self test generate operation for "
 336                        "the SHA-512 mode failed with rc=%d\n", ret);
 337                 prng_errorflag = PRNG_SELFTEST_FAILED;
 338                 return -EIO;
 339         }
 340         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
 341                          &ws, buf, sizeof(buf), NULL, 0);
 342         if (ret < 0) {
 343                 pr_err("The prng self test generate operation for "
 344                        "the SHA-512 mode failed with rc=%d\n", ret);
 345                 prng_errorflag = PRNG_SELFTEST_FAILED;
 346                 return -EIO;
 347         }
 348
 349         /* check against expected data */
 350         if (memcmp(buf, random, sizeof(random)) != 0) {
 351                 pr_err("The prng self test data test "
 352                        "for the SHA-512 mode failed\n");
 353                 prng_errorflag = PRNG_SELFTEST_FAILED;
 354                 return -EIO;
 355         }
 356
 357         return 0;
 358 }
 359
 360
 361 static int __init prng_sha512_instantiate(void)
 362 {
 363         int ret, datalen;
 364         u8 seed[64];
 365
 366         pr_debug("prng runs in SHA-512 mode "
 367                  "with chunksize=%d and reseed_limit=%u\n",
 368                  prng_chunk_size, prng_reseed_limit);
 369
 370         /* memory allocation, prng_data struct init, mutex init */
 371         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 372         if (fips_enabled)
 373                 datalen += prng_chunk_size;
 374         prng_data = kzalloc(datalen, GFP_KERNEL);
 375         if (!prng_data) {
 376                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 377                 return -ENOMEM;
 378         }
 379         mutex_init(&prng_data->mutex);
 380         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 381
 382         /* selftest */
 383         ret = prng_sha512_selftest();
 384         if (ret)
 385                 goto outfree;
 386
 387         /* generate initial seed bytestring, first 48 bytes of entropy */
 388         ret = generate_entropy(seed, 48);
 389         if (ret != 48)
 390                 goto outfree;
 391         /* followed by 16 bytes of unique nonce */
 392         get_tod_clock_ext(seed + 48);
 393
 394         /* initial seed of the ppno drng */
 395         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
 396                          &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
 397         if (ret < 0) {
 398                 prng_errorflag = PRNG_SEED_FAILED;
 399                 ret = -EIO;
 400                 goto outfree;
 401         }
 402
 403         /* if fips mode is enabled, generate a first block of random
 404            bytes for the FIPS 140-2 Conditional Self Test */
 405         if (fips_enabled) {
 406                 prng_data->prev = prng_data->buf + prng_chunk_size;
 407                 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
 408                                  &prng_data->ppnows,
 409                                  prng_data->prev, prng_chunk_size, NULL, 0);
 410                 if (ret < 0 || ret != prng_chunk_size) {
 411                         prng_errorflag = PRNG_GEN_FAILED;
 412                         ret = -EIO;
 413                         goto outfree;
 414                 }
 415         }
 416
 417         return 0;
 418
 419 outfree:
 420         kfree(prng_data);
 421         return ret;
 422 }
 423
 424
 425 static void prng_sha512_deinstantiate(void)
 426 {
 427         pr_debug("The prng module stopped after running in SHA-512 mode\n");
 428         kzfree(prng_data);
 429 }
 430
 431
 432 static int prng_sha512_reseed(void)
 433 {
 434         int ret;
 435         u8 seed[32];
 436
 437         /* generate 32 bytes of fresh entropy */
 438         ret = generate_entropy(seed, sizeof(seed));
 439         if (ret != sizeof(seed))
 440                 return ret;
 441
 442         /* do a reseed of the ppno drng with this bytestring */
 443         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
 444                          &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
 445         if (ret) {
 446                 prng_errorflag = PRNG_RESEED_FAILED;
 447                 return -EIO;
 448         }
 449
 450         return 0;
 451 }
 452
 453
 454 static int prng_sha512_generate(u8 *buf, size_t nbytes)
 455 {
 456         int ret;
 457
 458         /* reseed needed ? */
 459         if (prng_data->ppnows.reseed_counter > prng_reseed_limit) {
 460                 ret = prng_sha512_reseed();
 461                 if (ret)
 462                         return ret;
 463         }
 464
 465         /* PPNO generate */
 466         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
 467                          &prng_data->ppnows, buf, nbytes, NULL, 0);
 468         if (ret < 0 || ret != nbytes) {
 469                 prng_errorflag = PRNG_GEN_FAILED;
 470                 return -EIO;
 471         }
 472
 473         /* FIPS 140-2 Conditional Self Test */
 474         if (fips_enabled) {
 475                 if (!memcmp(prng_data->prev, buf, nbytes)) {
 476                         prng_errorflag = PRNG_GEN_FAILED;
 477                         return -EILSEQ;
 478                 }
 479                 memcpy(prng_data->prev, buf, nbytes);
 480         }
 481
 482         return ret;
 483 }
 484
 485
 486 /*** file io functions ***/
 487
 488 static int prng_open(struct inode *inode, struct file *file)
 489 {
 490         return nonseekable_open(inode, file);
 491 }
 492
 493
 494 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
 495                               size_t nbytes, loff_t *ppos)
 496 {
 497         int chunk, n, tmp, ret = 0;
 498
 499         /* lock prng_data struct */
 500         if (mutex_lock_interruptible(&prng_data->mutex))
 501                 return -ERESTARTSYS;
 502
 503         while (nbytes) {
 504                 if (need_resched()) {
 505                         if (signal_pending(current)) {
 506                                 if (ret == 0)
 507                                         ret = -ERESTARTSYS;
 508                                 break;
 509                         }
 510                         /* give mutex free before calling schedule() */
 511                         mutex_unlock(&prng_data->mutex);
 512                         schedule();
 513                         /* occopy mutex again */
 514                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 515                                 if (ret == 0)
 516                                         ret = -ERESTARTSYS;
 517                                 return ret;
 518                         }
 519                 }
 520
 521                 /*
 522                  * we lose some random bytes if an attacker issues
 523                  * reads < 8 bytes, but we don't care
 524                  */
 525                 chunk = min_t(int, nbytes, prng_chunk_size);
 526
 527                 /* PRNG only likes multiples of 8 bytes */
 528                 n = (chunk + 7) & -8;
 529
 530                 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
 531                         prng_tdes_seed(8);
 532
 533                 /* if the CPU supports PRNG stckf is present too */
 534                 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
 535
 536                 /*
 537                  * Beside the STCKF the input for the TDES-EDE is the output
 538                  * of the last operation. We differ here from X9.17 since we
 539                  * only store one timestamp into the buffer. Padding the whole
 540                  * buffer with timestamps does not improve security, since
 541                  * successive stckf have nearly constant offsets.
 542                  * If an attacker knows the first timestamp it would be
 543                  * trivial to guess the additional values. One timestamp
 544                  * is therefore enough and still guarantees unique input values.
 545                  *
 546                  * Note: you can still get strict X9.17 conformity by setting
 547                  * prng_chunk_size to 8 bytes.
 548                 */
 549                 tmp = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 550                                 prng_data->buf, prng_data->buf, n);
 551                 if (tmp < 0 || tmp != n) {
 552                         ret = -EIO;
 553                         break;
 554                 }
 555
 556                 prng_data->prngws.byte_counter += n;
 557                 prng_data->prngws.reseed_counter += n;
 558
 559                 if (copy_to_user(ubuf, prng_data->buf, chunk))
 560                         return -EFAULT;
 561
 562                 nbytes -= chunk;
 563                 ret += chunk;
 564                 ubuf += chunk;
 565         }
 566
 567         /* unlock prng_data struct */
 568         mutex_unlock(&prng_data->mutex);
 569
 570         return ret;
 571 }
 572
 573
 574 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
 575                                 size_t nbytes, loff_t *ppos)
 576 {
 577         int n, ret = 0;
 578         u8 *p;
 579
 580         /* if errorflag is set do nothing and return 'broken pipe' */
 581         if (prng_errorflag)
 582                 return -EPIPE;
 583
 584         /* lock prng_data struct */
 585         if (mutex_lock_interruptible(&prng_data->mutex))
 586                 return -ERESTARTSYS;
 587
 588         while (nbytes) {
 589                 if (need_resched()) {
 590                         if (signal_pending(current)) {
 591                                 if (ret == 0)
 592                                         ret = -ERESTARTSYS;
 593                                 break;
 594                         }
 595                         /* give mutex free before calling schedule() */
 596                         mutex_unlock(&prng_data->mutex);
 597                         schedule();
 598                         /* occopy mutex again */
 599                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 600                                 if (ret == 0)
 601                                         ret = -ERESTARTSYS;
 602                                 return ret;
 603                         }
 604                 }
 605                 if (prng_data->rest) {
 606                         /* push left over random bytes from the previous read */
 607                         p = prng_data->buf + prng_chunk_size - prng_data->rest;
 608                         n = (nbytes < prng_data->rest) ?
 609                                 nbytes : prng_data->rest;
 610                         prng_data->rest -= n;
 611                 } else {
 612                         /* generate one chunk of random bytes into read buf */
 613                         p = prng_data->buf;
 614                         n = prng_sha512_generate(p, prng_chunk_size);
 615                         if (n < 0) {
 616                                 ret = n;
 617                                 break;
 618                         }
 619                         if (nbytes < prng_chunk_size) {
 620                                 n = nbytes;
 621                                 prng_data->rest = prng_chunk_size - n;
 622                         } else {
 623                                 n = prng_chunk_size;
 624                                 prng_data->rest = 0;
 625                         }
 626                 }
 627                 if (copy_to_user(ubuf, p, n)) {
 628                         ret = -EFAULT;
 629                         break;
 630                 }
 631                 ubuf += n;
 632                 nbytes -= n;
 633                 ret += n;
 634         }
 635
 636         /* unlock prng_data struct */
 637         mutex_unlock(&prng_data->mutex);
 638
 639         return ret;
 640 }
 641
 642
 643 /*** sysfs stuff ***/
 644
 645 static const struct file_operations prng_sha512_fops = {
 646         .owner          = THIS_MODULE,
 647         .open           = &prng_open,
 648         .release        = NULL,
 649         .read           = &prng_sha512_read,
 650         .llseek         = noop_llseek,
 651 };
 652 static const struct file_operations prng_tdes_fops = {
 653         .owner          = THIS_MODULE,
 654         .open           = &prng_open,
 655         .release        = NULL,
 656         .read           = &prng_tdes_read,
 657         .llseek         = noop_llseek,
 658 };
 659
 660 static struct miscdevice prng_sha512_dev = {
 661         .name   = "prandom",
 662         .minor  = MISC_DYNAMIC_MINOR,
 663         .mode   = 0644,
 664         .fops   = &prng_sha512_fops,
 665 };
 666 static struct miscdevice prng_tdes_dev = {
 667         .name   = "prandom",
 668         .minor  = MISC_DYNAMIC_MINOR,
 669         .mode   = 0644,
 670         .fops   = &prng_tdes_fops,
 671 };
 672
 673
 674 /* chunksize attribute (ro) */
 675 static ssize_t prng_chunksize_show(struct device *dev,
 676                                    struct device_attribute *attr,
 677                                    char *buf)
 678 {
 679         return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
 680 }
 681 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
 682
 683 /* counter attribute (ro) */
 684 static ssize_t prng_counter_show(struct device *dev,
 685                                  struct device_attribute *attr,
 686                                  char *buf)
 687 {
 688         u64 counter;
 689
 690         if (mutex_lock_interruptible(&prng_data->mutex))
 691                 return -ERESTARTSYS;
 692         if (prng_mode == PRNG_MODE_SHA512)
 693                 counter = prng_data->ppnows.stream_bytes;
 694         else
 695                 counter = prng_data->prngws.byte_counter;
 696         mutex_unlock(&prng_data->mutex);
 697
 698         return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
 699 }
 700 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
 701
 702 /* errorflag attribute (ro) */
 703 static ssize_t prng_errorflag_show(struct device *dev,
 704                                    struct device_attribute *attr,
 705                                    char *buf)
 706 {
 707         return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
 708 }
 709 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
 710
 711 /* mode attribute (ro) */
 712 static ssize_t prng_mode_show(struct device *dev,
 713                               struct device_attribute *attr,
 714                               char *buf)
 715 {
 716         if (prng_mode == PRNG_MODE_TDES)
 717                 return snprintf(buf, PAGE_SIZE, "TDES\n");
 718         else
 719                 return snprintf(buf, PAGE_SIZE, "SHA512\n");
 720 }
 721 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
 722
 723 /* reseed attribute (w) */
 724 static ssize_t prng_reseed_store(struct device *dev,
 725                                  struct device_attribute *attr,
 726                                  const char *buf, size_t count)
 727 {
 728         if (mutex_lock_interruptible(&prng_data->mutex))
 729                 return -ERESTARTSYS;
 730         prng_sha512_reseed();
 731         mutex_unlock(&prng_data->mutex);
 732
 733         return count;
 734 }
 735 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
 736
 737 /* reseed limit attribute (rw) */
 738 static ssize_t prng_reseed_limit_show(struct device *dev,
 739                                       struct device_attribute *attr,
 740                                       char *buf)
 741 {
 742         return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
 743 }
 744 static ssize_t prng_reseed_limit_store(struct device *dev,
 745                                        struct device_attribute *attr,
 746                                        const char *buf, size_t count)
 747 {
 748         unsigned limit;
 749
 750         if (sscanf(buf, "%u\n", &limit) != 1)
 751                 return -EINVAL;
 752
 753         if (prng_mode == PRNG_MODE_SHA512) {
 754                 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 755                         return -EINVAL;
 756         } else {
 757                 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 758                         return -EINVAL;
 759         }
 760
 761         prng_reseed_limit = limit;
 762
 763         return count;
 764 }
 765 static DEVICE_ATTR(reseed_limit, 0644,
 766                    prng_reseed_limit_show, prng_reseed_limit_store);
 767
 768 /* strength attribute (ro) */
 769 static ssize_t prng_strength_show(struct device *dev,
 770                                   struct device_attribute *attr,
 771                                   char *buf)
 772 {
 773         return snprintf(buf, PAGE_SIZE, "256\n");
 774 }
 775 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
 776
 777 static struct attribute *prng_sha512_dev_attrs[] = {
 778         &dev_attr_errorflag.attr,
 779         &dev_attr_chunksize.attr,
 780         &dev_attr_byte_counter.attr,
 781         &dev_attr_mode.attr,
 782         &dev_attr_reseed.attr,
 783         &dev_attr_reseed_limit.attr,
 784         &dev_attr_strength.attr,
 785         NULL
 786 };
 787 static struct attribute *prng_tdes_dev_attrs[] = {
 788         &dev_attr_chunksize.attr,
 789         &dev_attr_byte_counter.attr,
 790         &dev_attr_mode.attr,
 791         NULL
 792 };
 793
 794 static struct attribute_group prng_sha512_dev_attr_group = {
 795         .attrs = prng_sha512_dev_attrs
 796 };
 797 static struct attribute_group prng_tdes_dev_attr_group = {
 798         .attrs = prng_tdes_dev_attrs
 799 };
 800
 801
 802 /*** module init and exit ***/
 803
 804 static int __init prng_init(void)
 805 {
 806         int ret;
 807
 808         /* check if the CPU has a PRNG */
 809         if (!cpacf_query(CPACF_KMC, CPACF_KMC_PRNG))
 810                 return -EOPNOTSUPP;
 811
 812         /* choose prng mode */
 813         if (prng_mode != PRNG_MODE_TDES) {
 814                 /* check for MSA5 support for PPNO operations */
 815                 if (!cpacf_query(CPACF_PPNO, CPACF_PPNO_SHA512_DRNG_GEN)) {
 816                         if (prng_mode == PRNG_MODE_SHA512) {
 817                                 pr_err("The prng module cannot "
 818                                        "start in SHA-512 mode\n");
 819                                 return -EOPNOTSUPP;
 820                         }
 821                         prng_mode = PRNG_MODE_TDES;
 822                 } else
 823                         prng_mode = PRNG_MODE_SHA512;
 824         }
 825
 826         if (prng_mode == PRNG_MODE_SHA512) {
 827
 828                 /* SHA512 mode */
 829
 830                 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
 831                     || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
 832                         return -EINVAL;
 833                 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
 834
 835                 if (prng_reseed_limit == 0)
 836                         prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
 837                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 838                         return -EINVAL;
 839
 840                 ret = prng_sha512_instantiate();
 841                 if (ret)
 842                         goto out;
 843
 844                 ret = misc_register(&prng_sha512_dev);
 845                 if (ret) {
 846                         prng_sha512_deinstantiate();
 847                         goto out;
 848                 }
 849                 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
 850                                          &prng_sha512_dev_attr_group);
 851                 if (ret) {
 852                         misc_deregister(&prng_sha512_dev);
 853                         prng_sha512_deinstantiate();
 854                         goto out;
 855                 }
 856
 857         } else {
 858
 859                 /* TDES mode */
 860
 861                 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
 862                     || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
 863                         return -EINVAL;
 864                 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
 865
 866                 if (prng_reseed_limit == 0)
 867                         prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
 868                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 869                         return -EINVAL;
 870
 871                 ret = prng_tdes_instantiate();
 872                 if (ret)
 873                         goto out;
 874
 875                 ret = misc_register(&prng_tdes_dev);
 876                 if (ret) {
 877                         prng_tdes_deinstantiate();
 878                         goto out;
 879                 }
 880                 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
 881                                          &prng_tdes_dev_attr_group);
 882                 if (ret) {
 883                         misc_deregister(&prng_tdes_dev);
 884                         prng_tdes_deinstantiate();
 885                         goto out;
 886                 }
 887
 888         }
 889
 890 out:
 891         return ret;
 892 }
 893
 894
 895 static void __exit prng_exit(void)
 896 {
 897         if (prng_mode == PRNG_MODE_SHA512) {
 898                 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
 899                                    &prng_sha512_dev_attr_group);
 900                 misc_deregister(&prng_sha512_dev);
 901                 prng_sha512_deinstantiate();
 902         } else {
 903                 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
 904                                    &prng_tdes_dev_attr_group);
 905                 misc_deregister(&prng_tdes_dev);
 906                 prng_tdes_deinstantiate();
 907         }
 908 }
 909
 910 module_cpu_feature_match(MSA, prng_init);
 911 module_exit(prng_exit);