]>
Commit | Line | Data |
---|---|---|
20a884f5 | 1 | // SPDX-License-Identifier: GPL-2.0 |
1b278294 | 2 | /* |
57127645 | 3 | * Copyright IBM Corp. 2006, 2015 |
1b278294 | 4 | * Author(s): Jan Glauber <jan.glauber@de.ibm.com> |
57127645 | 5 | * Harald Freudenberger <freude@de.ibm.com> |
1b278294 JG |
6 | * Driver for the s390 pseudo random number generator |
7 | */ | |
57127645 HF |
8 | |
9 | #define KMSG_COMPONENT "prng" | |
10 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
11 | ||
1b278294 | 12 | #include <linux/fs.h> |
57127645 | 13 | #include <linux/fips.h> |
1b278294 JG |
14 | #include <linux/init.h> |
15 | #include <linux/kernel.h> | |
57127645 | 16 | #include <linux/device.h> |
1b278294 JG |
17 | #include <linux/miscdevice.h> |
18 | #include <linux/module.h> | |
19 | #include <linux/moduleparam.h> | |
57127645 | 20 | #include <linux/mutex.h> |
d05377c1 | 21 | #include <linux/cpufeature.h> |
1b278294 | 22 | #include <linux/random.h> |
5a0e3ad6 | 23 | #include <linux/slab.h> |
174cd4b1 IM |
24 | #include <linux/sched/signal.h> |
25 | ||
1b278294 | 26 | #include <asm/debug.h> |
7c0f6ba6 | 27 | #include <linux/uaccess.h> |
57127645 | 28 | #include <asm/timex.h> |
c7d4d259 | 29 | #include <asm/cpacf.h> |
1b278294 JG |
30 | |
31 | MODULE_LICENSE("GPL"); | |
57127645 | 32 | MODULE_AUTHOR("IBM Corporation"); |
1b278294 JG |
33 | MODULE_DESCRIPTION("s390 PRNG interface"); |
34 | ||
57127645 HF |
35 | |
36 | #define PRNG_MODE_AUTO 0 | |
37 | #define PRNG_MODE_TDES 1 | |
38 | #define PRNG_MODE_SHA512 2 | |
39 | ||
40 | static unsigned int prng_mode = PRNG_MODE_AUTO; | |
41 | module_param_named(mode, prng_mode, int, 0); | |
42 | MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); | |
43 | ||
44 | ||
45 | #define PRNG_CHUNKSIZE_TDES_MIN 8 | |
46 | #define PRNG_CHUNKSIZE_TDES_MAX (64*1024) | |
47 | #define PRNG_CHUNKSIZE_SHA512_MIN 64 | |
48 | #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) | |
49 | ||
50 | static unsigned int prng_chunk_size = 256; | |
51 | module_param_named(chunksize, prng_chunk_size, int, 0); | |
1b278294 JG |
52 | MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); |
53 | ||
57127645 HF |
54 | |
55 | #define PRNG_RESEED_LIMIT_TDES 4096 | |
56 | #define PRNG_RESEED_LIMIT_TDES_LOWER 4096 | |
57 | #define PRNG_RESEED_LIMIT_SHA512 100000 | |
58 | #define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 | |
59 | ||
60 | static unsigned int prng_reseed_limit; | |
61 | module_param_named(reseed_limit, prng_reseed_limit, int, 0); | |
62 | MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); | |
63 | ||
1b278294 JG |
64 | |
65 | /* | |
66 | * Any one who considers arithmetical methods of producing random digits is, | |
67 | * of course, in a state of sin. -- John von Neumann | |
68 | */ | |
69 | ||
57127645 HF |
70 | static int prng_errorflag; |
71 | ||
72 | #define PRNG_GEN_ENTROPY_FAILED 1 | |
73 | #define PRNG_SELFTEST_FAILED 2 | |
74 | #define PRNG_INSTANTIATE_FAILED 3 | |
75 | #define PRNG_SEED_FAILED 4 | |
76 | #define PRNG_RESEED_FAILED 5 | |
77 | #define PRNG_GEN_FAILED 6 | |
78 | ||
79 | struct prng_ws_s { | |
80 | u8 parm_block[32]; | |
81 | u32 reseed_counter; | |
82 | u64 byte_counter; | |
1b278294 JG |
83 | }; |
84 | ||
985a9d20 | 85 | struct prno_ws_s { |
57127645 HF |
86 | u32 res; |
87 | u32 reseed_counter; | |
88 | u64 stream_bytes; | |
89 | u8 V[112]; | |
90 | u8 C[112]; | |
91 | }; | |
1b278294 | 92 | |
57127645 HF |
93 | struct prng_data_s { |
94 | struct mutex mutex; | |
95 | union { | |
96 | struct prng_ws_s prngws; | |
985a9d20 | 97 | struct prno_ws_s prnows; |
57127645 HF |
98 | }; |
99 | u8 *buf; | |
100 | u32 rest; | |
101 | u8 *prev; | |
1b278294 JG |
102 | }; |
103 | ||
57127645 HF |
104 | static struct prng_data_s *prng_data; |
105 | ||
106 | /* initial parameter block for tdes mode, copied from libica */ | |
107 | static const u8 initial_parm_block[32] __initconst = { | |
108 | 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, | |
109 | 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, | |
110 | 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, | |
111 | 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; | |
112 | ||
113 | ||
114 | /*** helper functions ***/ | |
115 | ||
d34b1acb HF |
116 | /* |
117 | * generate_entropy: | |
118 | * This algorithm produces 64 bytes of entropy data based on 1024 | |
119 | * individual stckf() invocations assuming that each stckf() value | |
120 | * contributes 0.25 bits of entropy. So the caller gets 256 bit | |
121 | * entropy per 64 byte or 4 bits entropy per byte. | |
122 | */ | |
57127645 | 123 | static int generate_entropy(u8 *ebuf, size_t nbytes) |
1b278294 | 124 | { |
57127645 | 125 | int n, ret = 0; |
d34b1acb | 126 | u8 *pg, *h, hash[64]; |
57127645 | 127 | |
d34b1acb HF |
128 | /* allocate 2 pages */ |
129 | pg = (u8 *) __get_free_pages(GFP_KERNEL, 1); | |
57127645 HF |
130 | if (!pg) { |
131 | prng_errorflag = PRNG_GEN_ENTROPY_FAILED; | |
132 | return -ENOMEM; | |
133 | } | |
134 | ||
135 | while (nbytes) { | |
d34b1acb HF |
136 | /* fill pages with urandom bytes */ |
137 | get_random_bytes(pg, 2*PAGE_SIZE); | |
138 | /* exor pages with 1024 stckf values */ | |
139 | for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) { | |
57127645 HF |
140 | u64 *p = ((u64 *)pg) + n; |
141 | *p ^= get_tod_clock_fast(); | |
142 | } | |
143 | n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash); | |
144 | if (n < sizeof(hash)) | |
145 | h = hash; | |
146 | else | |
147 | h = ebuf; | |
d34b1acb HF |
148 | /* hash over the filled pages */ |
149 | cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE); | |
57127645 HF |
150 | if (n < sizeof(hash)) |
151 | memcpy(ebuf, hash, n); | |
152 | ret += n; | |
153 | ebuf += n; | |
154 | nbytes -= n; | |
155 | } | |
156 | ||
d34b1acb | 157 | free_pages((unsigned long)pg, 1); |
57127645 | 158 | return ret; |
1b278294 JG |
159 | } |
160 | ||
57127645 HF |
161 | |
162 | /*** tdes functions ***/ | |
163 | ||
164 | static void prng_tdes_add_entropy(void) | |
1b278294 JG |
165 | { |
166 | __u64 entropy[4]; | |
167 | unsigned int i; | |
1b278294 JG |
168 | |
169 | for (i = 0; i < 16; i++) { | |
0177db01 MS |
170 | cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, |
171 | (char *) entropy, (char *) entropy, | |
172 | sizeof(entropy)); | |
57127645 | 173 | memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); |
1b278294 JG |
174 | } |
175 | } | |
176 | ||
57127645 HF |
177 | |
178 | static void prng_tdes_seed(int nbytes) | |
1b278294 JG |
179 | { |
180 | char buf[16]; | |
181 | int i = 0; | |
182 | ||
57127645 HF |
183 | BUG_ON(nbytes > sizeof(buf)); |
184 | ||
1b278294 JG |
185 | get_random_bytes(buf, nbytes); |
186 | ||
187 | /* Add the entropy */ | |
188 | while (nbytes >= 8) { | |
57127645 HF |
189 | *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); |
190 | prng_tdes_add_entropy(); | |
1b278294 JG |
191 | i += 8; |
192 | nbytes -= 8; | |
193 | } | |
57127645 HF |
194 | prng_tdes_add_entropy(); |
195 | prng_data->prngws.reseed_counter = 0; | |
196 | } | |
197 | ||
198 | ||
199 | static int __init prng_tdes_instantiate(void) | |
200 | { | |
201 | int datalen; | |
202 | ||
203 | pr_debug("prng runs in TDES mode with " | |
204 | "chunksize=%d and reseed_limit=%u\n", | |
205 | prng_chunk_size, prng_reseed_limit); | |
206 | ||
207 | /* memory allocation, prng_data struct init, mutex init */ | |
208 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
209 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
210 | if (!prng_data) { | |
211 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
212 | return -ENOMEM; | |
213 | } | |
214 | mutex_init(&prng_data->mutex); | |
215 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
216 | memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); | |
217 | ||
218 | /* initialize the PRNG, add 128 bits of entropy */ | |
219 | prng_tdes_seed(16); | |
220 | ||
221 | return 0; | |
1b278294 JG |
222 | } |
223 | ||
57127645 HF |
224 | |
225 | static void prng_tdes_deinstantiate(void) | |
226 | { | |
227 | pr_debug("The prng module stopped " | |
228 | "after running in triple DES mode\n"); | |
229 | kzfree(prng_data); | |
230 | } | |
231 | ||
232 | ||
233 | /*** sha512 functions ***/ | |
234 | ||
235 | static int __init prng_sha512_selftest(void) | |
1b278294 | 236 | { |
57127645 HF |
237 | /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ |
238 | static const u8 seed[] __initconst = { | |
239 | 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, | |
240 | 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, | |
241 | 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, | |
242 | 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, | |
243 | 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, | |
244 | 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; | |
245 | static const u8 V0[] __initconst = { | |
246 | 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, | |
247 | 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, | |
248 | 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, | |
249 | 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, | |
250 | 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, | |
251 | 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, | |
252 | 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, | |
253 | 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, | |
254 | 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, | |
255 | 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, | |
256 | 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, | |
257 | 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, | |
258 | 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, | |
259 | 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; | |
260 | static const u8 C0[] __initconst = { | |
261 | 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, | |
262 | 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, | |
263 | 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, | |
264 | 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, | |
265 | 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, | |
266 | 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, | |
267 | 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, | |
268 | 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, | |
269 | 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, | |
270 | 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, | |
271 | 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, | |
272 | 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, | |
273 | 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, | |
274 | 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; | |
275 | static const u8 random[] __initconst = { | |
276 | 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, | |
277 | 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, | |
278 | 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, | |
279 | 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, | |
280 | 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, | |
281 | 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, | |
282 | 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, | |
283 | 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, | |
284 | 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, | |
285 | 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, | |
286 | 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, | |
287 | 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, | |
288 | 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, | |
289 | 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, | |
290 | 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, | |
291 | 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, | |
292 | 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, | |
293 | 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, | |
294 | 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, | |
295 | 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, | |
296 | 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, | |
297 | 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, | |
298 | 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, | |
299 | 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, | |
300 | 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, | |
301 | 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, | |
302 | 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, | |
303 | 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, | |
304 | 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, | |
305 | 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, | |
306 | 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, | |
307 | 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; | |
308 | ||
57127645 | 309 | u8 buf[sizeof(random)]; |
985a9d20 | 310 | struct prno_ws_s ws; |
57127645 HF |
311 | |
312 | memset(&ws, 0, sizeof(ws)); | |
313 | ||
314 | /* initial seed */ | |
985a9d20 | 315 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, |
0177db01 | 316 | &ws, NULL, 0, seed, sizeof(seed)); |
57127645 HF |
317 | |
318 | /* check working states V and C */ | |
319 | if (memcmp(ws.V, V0, sizeof(V0)) != 0 | |
320 | || memcmp(ws.C, C0, sizeof(C0)) != 0) { | |
321 | pr_err("The prng self test state test " | |
322 | "for the SHA-512 mode failed\n"); | |
323 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
324 | return -EIO; | |
325 | } | |
326 | ||
327 | /* generate random bytes */ | |
985a9d20 | 328 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, |
0177db01 | 329 | &ws, buf, sizeof(buf), NULL, 0); |
985a9d20 | 330 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, |
0177db01 | 331 | &ws, buf, sizeof(buf), NULL, 0); |
57127645 HF |
332 | |
333 | /* check against expected data */ | |
334 | if (memcmp(buf, random, sizeof(random)) != 0) { | |
335 | pr_err("The prng self test data test " | |
336 | "for the SHA-512 mode failed\n"); | |
337 | prng_errorflag = PRNG_SELFTEST_FAILED; | |
338 | return -EIO; | |
339 | } | |
340 | ||
341 | return 0; | |
342 | } | |
343 | ||
344 | ||
345 | static int __init prng_sha512_instantiate(void) | |
346 | { | |
347 | int ret, datalen; | |
d34b1acb | 348 | u8 seed[64 + 32 + 16]; |
57127645 HF |
349 | |
350 | pr_debug("prng runs in SHA-512 mode " | |
351 | "with chunksize=%d and reseed_limit=%u\n", | |
352 | prng_chunk_size, prng_reseed_limit); | |
353 | ||
354 | /* memory allocation, prng_data struct init, mutex init */ | |
355 | datalen = sizeof(struct prng_data_s) + prng_chunk_size; | |
356 | if (fips_enabled) | |
357 | datalen += prng_chunk_size; | |
358 | prng_data = kzalloc(datalen, GFP_KERNEL); | |
359 | if (!prng_data) { | |
360 | prng_errorflag = PRNG_INSTANTIATE_FAILED; | |
361 | return -ENOMEM; | |
362 | } | |
363 | mutex_init(&prng_data->mutex); | |
364 | prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); | |
365 | ||
366 | /* selftest */ | |
367 | ret = prng_sha512_selftest(); | |
368 | if (ret) | |
369 | goto outfree; | |
370 | ||
d34b1acb HF |
371 | /* generate initial seed bytestring, with 256 + 128 bits entropy */ |
372 | ret = generate_entropy(seed, 64 + 32); | |
373 | if (ret != 64 + 32) | |
57127645 HF |
374 | goto outfree; |
375 | /* followed by 16 bytes of unique nonce */ | |
d34b1acb | 376 | get_tod_clock_ext(seed + 64 + 32); |
57127645 | 377 | |
985a9d20 HF |
378 | /* initial seed of the prno drng */ |
379 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, | |
380 | &prng_data->prnows, NULL, 0, seed, sizeof(seed)); | |
57127645 HF |
381 | |
382 | /* if fips mode is enabled, generate a first block of random | |
383 | bytes for the FIPS 140-2 Conditional Self Test */ | |
384 | if (fips_enabled) { | |
385 | prng_data->prev = prng_data->buf + prng_chunk_size; | |
985a9d20 HF |
386 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, |
387 | &prng_data->prnows, | |
0177db01 | 388 | prng_data->prev, prng_chunk_size, NULL, 0); |
57127645 HF |
389 | } |
390 | ||
391 | return 0; | |
392 | ||
393 | outfree: | |
394 | kfree(prng_data); | |
395 | return ret; | |
396 | } | |
397 | ||
398 | ||
399 | static void prng_sha512_deinstantiate(void) | |
400 | { | |
401 | pr_debug("The prng module stopped after running in SHA-512 mode\n"); | |
402 | kzfree(prng_data); | |
403 | } | |
404 | ||
405 | ||
406 | static int prng_sha512_reseed(void) | |
407 | { | |
408 | int ret; | |
d34b1acb | 409 | u8 seed[64]; |
57127645 | 410 | |
d34b1acb | 411 | /* fetch 256 bits of fresh entropy */ |
57127645 HF |
412 | ret = generate_entropy(seed, sizeof(seed)); |
413 | if (ret != sizeof(seed)) | |
414 | return ret; | |
415 | ||
985a9d20 HF |
416 | /* do a reseed of the prno drng with this bytestring */ |
417 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, | |
418 | &prng_data->prnows, NULL, 0, seed, sizeof(seed)); | |
57127645 HF |
419 | |
420 | return 0; | |
421 | } | |
422 | ||
423 | ||
424 | static int prng_sha512_generate(u8 *buf, size_t nbytes) | |
425 | { | |
426 | int ret; | |
427 | ||
428 | /* reseed needed ? */ | |
985a9d20 | 429 | if (prng_data->prnows.reseed_counter > prng_reseed_limit) { |
57127645 HF |
430 | ret = prng_sha512_reseed(); |
431 | if (ret) | |
432 | return ret; | |
433 | } | |
434 | ||
985a9d20 HF |
435 | /* PRNO generate */ |
436 | cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, | |
437 | &prng_data->prnows, buf, nbytes, NULL, 0); | |
57127645 HF |
438 | |
439 | /* FIPS 140-2 Conditional Self Test */ | |
440 | if (fips_enabled) { | |
441 | if (!memcmp(prng_data->prev, buf, nbytes)) { | |
442 | prng_errorflag = PRNG_GEN_FAILED; | |
443 | return -EILSEQ; | |
444 | } | |
445 | memcpy(prng_data->prev, buf, nbytes); | |
446 | } | |
447 | ||
6512391a | 448 | return nbytes; |
57127645 HF |
449 | } |
450 | ||
451 | ||
452 | /*** file io functions ***/ | |
453 | ||
454 | static int prng_open(struct inode *inode, struct file *file) | |
455 | { | |
456 | return nonseekable_open(inode, file); | |
457 | } | |
458 | ||
459 | ||
460 | static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, | |
461 | size_t nbytes, loff_t *ppos) | |
462 | { | |
0177db01 | 463 | int chunk, n, ret = 0; |
57127645 HF |
464 | |
465 | /* lock prng_data struct */ | |
466 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
467 | return -ERESTARTSYS; | |
1b278294 | 468 | |
1b278294 | 469 | while (nbytes) { |
1b278294 JG |
470 | if (need_resched()) { |
471 | if (signal_pending(current)) { | |
472 | if (ret == 0) | |
473 | ret = -ERESTARTSYS; | |
474 | break; | |
475 | } | |
57127645 HF |
476 | /* give mutex free before calling schedule() */ |
477 | mutex_unlock(&prng_data->mutex); | |
1b278294 | 478 | schedule(); |
57127645 HF |
479 | /* occopy mutex again */ |
480 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
481 | if (ret == 0) | |
482 | ret = -ERESTARTSYS; | |
483 | return ret; | |
484 | } | |
1b278294 JG |
485 | } |
486 | ||
487 | /* | |
488 | * we lose some random bytes if an attacker issues | |
489 | * reads < 8 bytes, but we don't care | |
490 | */ | |
491 | chunk = min_t(int, nbytes, prng_chunk_size); | |
492 | ||
493 | /* PRNG only likes multiples of 8 bytes */ | |
494 | n = (chunk + 7) & -8; | |
495 | ||
57127645 HF |
496 | if (prng_data->prngws.reseed_counter > prng_reseed_limit) |
497 | prng_tdes_seed(8); | |
1b278294 JG |
498 | |
499 | /* if the CPU supports PRNG stckf is present too */ | |
57127645 | 500 | *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); |
1b278294 JG |
501 | |
502 | /* | |
503 | * Beside the STCKF the input for the TDES-EDE is the output | |
504 | * of the last operation. We differ here from X9.17 since we | |
505 | * only store one timestamp into the buffer. Padding the whole | |
506 | * buffer with timestamps does not improve security, since | |
507 | * successive stckf have nearly constant offsets. | |
508 | * If an attacker knows the first timestamp it would be | |
509 | * trivial to guess the additional values. One timestamp | |
510 | * is therefore enough and still guarantees unique input values. | |
511 | * | |
512 | * Note: you can still get strict X9.17 conformity by setting | |
513 | * prng_chunk_size to 8 bytes. | |
0177db01 MS |
514 | */ |
515 | cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, | |
516 | prng_data->buf, prng_data->buf, n); | |
1b278294 | 517 | |
57127645 HF |
518 | prng_data->prngws.byte_counter += n; |
519 | prng_data->prngws.reseed_counter += n; | |
1b278294 | 520 | |
9e6e7c74 DC |
521 | if (copy_to_user(ubuf, prng_data->buf, chunk)) { |
522 | ret = -EFAULT; | |
523 | break; | |
524 | } | |
1b278294 JG |
525 | |
526 | nbytes -= chunk; | |
527 | ret += chunk; | |
528 | ubuf += chunk; | |
529 | } | |
57127645 HF |
530 | |
531 | /* unlock prng_data struct */ | |
532 | mutex_unlock(&prng_data->mutex); | |
533 | ||
1b278294 JG |
534 | return ret; |
535 | } | |
536 | ||
57127645 HF |
537 | |
538 | static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, | |
539 | size_t nbytes, loff_t *ppos) | |
540 | { | |
541 | int n, ret = 0; | |
542 | u8 *p; | |
543 | ||
544 | /* if errorflag is set do nothing and return 'broken pipe' */ | |
545 | if (prng_errorflag) | |
546 | return -EPIPE; | |
547 | ||
548 | /* lock prng_data struct */ | |
549 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
550 | return -ERESTARTSYS; | |
551 | ||
552 | while (nbytes) { | |
553 | if (need_resched()) { | |
554 | if (signal_pending(current)) { | |
555 | if (ret == 0) | |
556 | ret = -ERESTARTSYS; | |
557 | break; | |
558 | } | |
559 | /* give mutex free before calling schedule() */ | |
560 | mutex_unlock(&prng_data->mutex); | |
561 | schedule(); | |
562 | /* occopy mutex again */ | |
563 | if (mutex_lock_interruptible(&prng_data->mutex)) { | |
564 | if (ret == 0) | |
565 | ret = -ERESTARTSYS; | |
566 | return ret; | |
567 | } | |
568 | } | |
569 | if (prng_data->rest) { | |
570 | /* push left over random bytes from the previous read */ | |
571 | p = prng_data->buf + prng_chunk_size - prng_data->rest; | |
572 | n = (nbytes < prng_data->rest) ? | |
573 | nbytes : prng_data->rest; | |
574 | prng_data->rest -= n; | |
575 | } else { | |
576 | /* generate one chunk of random bytes into read buf */ | |
577 | p = prng_data->buf; | |
578 | n = prng_sha512_generate(p, prng_chunk_size); | |
579 | if (n < 0) { | |
580 | ret = n; | |
581 | break; | |
582 | } | |
583 | if (nbytes < prng_chunk_size) { | |
584 | n = nbytes; | |
585 | prng_data->rest = prng_chunk_size - n; | |
586 | } else { | |
587 | n = prng_chunk_size; | |
588 | prng_data->rest = 0; | |
589 | } | |
590 | } | |
591 | if (copy_to_user(ubuf, p, n)) { | |
592 | ret = -EFAULT; | |
593 | break; | |
594 | } | |
595 | ubuf += n; | |
596 | nbytes -= n; | |
597 | ret += n; | |
598 | } | |
599 | ||
600 | /* unlock prng_data struct */ | |
601 | mutex_unlock(&prng_data->mutex); | |
602 | ||
603 | return ret; | |
604 | } | |
605 | ||
606 | ||
607 | /*** sysfs stuff ***/ | |
608 | ||
609 | static const struct file_operations prng_sha512_fops = { | |
610 | .owner = THIS_MODULE, | |
611 | .open = &prng_open, | |
612 | .release = NULL, | |
613 | .read = &prng_sha512_read, | |
614 | .llseek = noop_llseek, | |
615 | }; | |
616 | static const struct file_operations prng_tdes_fops = { | |
1b278294 JG |
617 | .owner = THIS_MODULE, |
618 | .open = &prng_open, | |
619 | .release = NULL, | |
57127645 | 620 | .read = &prng_tdes_read, |
6038f373 | 621 | .llseek = noop_llseek, |
1b278294 JG |
622 | }; |
623 | ||
57127645 HF |
624 | static struct miscdevice prng_sha512_dev = { |
625 | .name = "prandom", | |
626 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 627 | .mode = 0644, |
57127645 HF |
628 | .fops = &prng_sha512_fops, |
629 | }; | |
630 | static struct miscdevice prng_tdes_dev = { | |
1b278294 JG |
631 | .name = "prandom", |
632 | .minor = MISC_DYNAMIC_MINOR, | |
74b2375e | 633 | .mode = 0644, |
57127645 | 634 | .fops = &prng_tdes_fops, |
1b278294 JG |
635 | }; |
636 | ||
57127645 HF |
637 | |
638 | /* chunksize attribute (ro) */ | |
639 | static ssize_t prng_chunksize_show(struct device *dev, | |
640 | struct device_attribute *attr, | |
641 | char *buf) | |
642 | { | |
643 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size); | |
644 | } | |
645 | static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); | |
646 | ||
647 | /* counter attribute (ro) */ | |
648 | static ssize_t prng_counter_show(struct device *dev, | |
649 | struct device_attribute *attr, | |
650 | char *buf) | |
651 | { | |
652 | u64 counter; | |
653 | ||
654 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
655 | return -ERESTARTSYS; | |
656 | if (prng_mode == PRNG_MODE_SHA512) | |
985a9d20 | 657 | counter = prng_data->prnows.stream_bytes; |
57127645 HF |
658 | else |
659 | counter = prng_data->prngws.byte_counter; | |
660 | mutex_unlock(&prng_data->mutex); | |
661 | ||
662 | return snprintf(buf, PAGE_SIZE, "%llu\n", counter); | |
663 | } | |
664 | static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); | |
665 | ||
666 | /* errorflag attribute (ro) */ | |
667 | static ssize_t prng_errorflag_show(struct device *dev, | |
668 | struct device_attribute *attr, | |
669 | char *buf) | |
670 | { | |
671 | return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag); | |
672 | } | |
673 | static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); | |
674 | ||
675 | /* mode attribute (ro) */ | |
676 | static ssize_t prng_mode_show(struct device *dev, | |
677 | struct device_attribute *attr, | |
678 | char *buf) | |
679 | { | |
680 | if (prng_mode == PRNG_MODE_TDES) | |
681 | return snprintf(buf, PAGE_SIZE, "TDES\n"); | |
682 | else | |
683 | return snprintf(buf, PAGE_SIZE, "SHA512\n"); | |
684 | } | |
685 | static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); | |
686 | ||
687 | /* reseed attribute (w) */ | |
688 | static ssize_t prng_reseed_store(struct device *dev, | |
689 | struct device_attribute *attr, | |
690 | const char *buf, size_t count) | |
691 | { | |
692 | if (mutex_lock_interruptible(&prng_data->mutex)) | |
693 | return -ERESTARTSYS; | |
694 | prng_sha512_reseed(); | |
695 | mutex_unlock(&prng_data->mutex); | |
696 | ||
697 | return count; | |
698 | } | |
699 | static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); | |
700 | ||
701 | /* reseed limit attribute (rw) */ | |
702 | static ssize_t prng_reseed_limit_show(struct device *dev, | |
703 | struct device_attribute *attr, | |
704 | char *buf) | |
705 | { | |
706 | return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit); | |
707 | } | |
708 | static ssize_t prng_reseed_limit_store(struct device *dev, | |
709 | struct device_attribute *attr, | |
710 | const char *buf, size_t count) | |
711 | { | |
712 | unsigned limit; | |
713 | ||
714 | if (sscanf(buf, "%u\n", &limit) != 1) | |
715 | return -EINVAL; | |
716 | ||
717 | if (prng_mode == PRNG_MODE_SHA512) { | |
718 | if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
719 | return -EINVAL; | |
720 | } else { | |
721 | if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
722 | return -EINVAL; | |
723 | } | |
724 | ||
725 | prng_reseed_limit = limit; | |
726 | ||
727 | return count; | |
728 | } | |
729 | static DEVICE_ATTR(reseed_limit, 0644, | |
730 | prng_reseed_limit_show, prng_reseed_limit_store); | |
731 | ||
732 | /* strength attribute (ro) */ | |
733 | static ssize_t prng_strength_show(struct device *dev, | |
734 | struct device_attribute *attr, | |
735 | char *buf) | |
736 | { | |
737 | return snprintf(buf, PAGE_SIZE, "256\n"); | |
738 | } | |
739 | static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); | |
740 | ||
741 | static struct attribute *prng_sha512_dev_attrs[] = { | |
742 | &dev_attr_errorflag.attr, | |
743 | &dev_attr_chunksize.attr, | |
744 | &dev_attr_byte_counter.attr, | |
745 | &dev_attr_mode.attr, | |
746 | &dev_attr_reseed.attr, | |
747 | &dev_attr_reseed_limit.attr, | |
748 | &dev_attr_strength.attr, | |
749 | NULL | |
750 | }; | |
751 | static struct attribute *prng_tdes_dev_attrs[] = { | |
752 | &dev_attr_chunksize.attr, | |
753 | &dev_attr_byte_counter.attr, | |
754 | &dev_attr_mode.attr, | |
755 | NULL | |
756 | }; | |
757 | ||
758 | static struct attribute_group prng_sha512_dev_attr_group = { | |
759 | .attrs = prng_sha512_dev_attrs | |
760 | }; | |
761 | static struct attribute_group prng_tdes_dev_attr_group = { | |
762 | .attrs = prng_tdes_dev_attrs | |
763 | }; | |
764 | ||
765 | ||
766 | /*** module init and exit ***/ | |
767 | ||
1b278294 JG |
768 | static int __init prng_init(void) |
769 | { | |
770 | int ret; | |
771 | ||
772 | /* check if the CPU has a PRNG */ | |
69c0e360 | 773 | if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG)) |
1b278294 JG |
774 | return -EOPNOTSUPP; |
775 | ||
57127645 HF |
776 | /* choose prng mode */ |
777 | if (prng_mode != PRNG_MODE_TDES) { | |
985a9d20 HF |
778 | /* check for MSA5 support for PRNO operations */ |
779 | if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { | |
57127645 HF |
780 | if (prng_mode == PRNG_MODE_SHA512) { |
781 | pr_err("The prng module cannot " | |
782 | "start in SHA-512 mode\n"); | |
783 | return -EOPNOTSUPP; | |
784 | } | |
785 | prng_mode = PRNG_MODE_TDES; | |
786 | } else | |
787 | prng_mode = PRNG_MODE_SHA512; | |
788 | } | |
1b278294 | 789 | |
57127645 | 790 | if (prng_mode == PRNG_MODE_SHA512) { |
1b278294 | 791 | |
57127645 | 792 | /* SHA512 mode */ |
1b278294 | 793 | |
57127645 HF |
794 | if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN |
795 | || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) | |
796 | return -EINVAL; | |
797 | prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; | |
1b278294 | 798 | |
57127645 HF |
799 | if (prng_reseed_limit == 0) |
800 | prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; | |
801 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) | |
802 | return -EINVAL; | |
803 | ||
804 | ret = prng_sha512_instantiate(); | |
805 | if (ret) | |
806 | goto out; | |
807 | ||
808 | ret = misc_register(&prng_sha512_dev); | |
809 | if (ret) { | |
810 | prng_sha512_deinstantiate(); | |
811 | goto out; | |
812 | } | |
813 | ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj, | |
814 | &prng_sha512_dev_attr_group); | |
815 | if (ret) { | |
816 | misc_deregister(&prng_sha512_dev); | |
817 | prng_sha512_deinstantiate(); | |
818 | goto out; | |
819 | } | |
1b278294 | 820 | |
57127645 HF |
821 | } else { |
822 | ||
823 | /* TDES mode */ | |
824 | ||
825 | if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN | |
826 | || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) | |
827 | return -EINVAL; | |
828 | prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; | |
829 | ||
830 | if (prng_reseed_limit == 0) | |
831 | prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; | |
832 | else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) | |
833 | return -EINVAL; | |
834 | ||
835 | ret = prng_tdes_instantiate(); | |
836 | if (ret) | |
837 | goto out; | |
838 | ||
839 | ret = misc_register(&prng_tdes_dev); | |
840 | if (ret) { | |
841 | prng_tdes_deinstantiate(); | |
842 | goto out; | |
843 | } | |
844 | ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj, | |
845 | &prng_tdes_dev_attr_group); | |
846 | if (ret) { | |
847 | misc_deregister(&prng_tdes_dev); | |
848 | prng_tdes_deinstantiate(); | |
849 | goto out; | |
850 | } | |
851 | ||
852 | } | |
853 | ||
854 | out: | |
1b278294 JG |
855 | return ret; |
856 | } | |
857 | ||
57127645 | 858 | |
1b278294 JG |
859 | static void __exit prng_exit(void) |
860 | { | |
57127645 HF |
861 | if (prng_mode == PRNG_MODE_SHA512) { |
862 | sysfs_remove_group(&prng_sha512_dev.this_device->kobj, | |
863 | &prng_sha512_dev_attr_group); | |
864 | misc_deregister(&prng_sha512_dev); | |
865 | prng_sha512_deinstantiate(); | |
866 | } else { | |
867 | sysfs_remove_group(&prng_tdes_dev.this_device->kobj, | |
868 | &prng_tdes_dev_attr_group); | |
869 | misc_deregister(&prng_tdes_dev); | |
870 | prng_tdes_deinstantiate(); | |
871 | } | |
1b278294 JG |
872 | } |
873 | ||
d05377c1 | 874 | module_cpu_feature_match(MSA, prng_init); |
1b278294 | 875 | module_exit(prng_exit); |