FILE
prng.c
File preview with syntax highlighting.
linux-6.19.14/arch/s390/crypto/prng.c
1// SPDX-License-Identifier: GPL-2.0 2/* 3 * Copyright IBM Corp. 2006, 2015 4 * Author(s): Jan Glauber <jan.glauber@de.ibm.com> 5 * Harald Freudenberger <freude@de.ibm.com> 6 * Driver for the s390 pseudo random number generator 7 */ 8 9#define pr_fmt(fmt) "prng: " fmt 10 11#include <linux/fs.h> 12#include <linux/fips.h> 13#include <linux/init.h> 14#include <linux/kernel.h> 15#include <linux/device.h> 16#include <linux/miscdevice.h> 17#include <linux/module.h> 18#include <linux/moduleparam.h> 19#include <linux/mutex.h> 20#include <linux/cpufeature.h> 21#include <linux/random.h> 22#include <linux/slab.h> 23#include <linux/sched/signal.h> 24 25#include <asm/debug.h> 26#include <linux/uaccess.h> 27#include <asm/timex.h> 28#include <asm/cpacf.h> 29 30MODULE_LICENSE("GPL"); 31MODULE_AUTHOR("IBM Corporation"); 32MODULE_DESCRIPTION("s390 PRNG interface"); 33 34 35#define PRNG_MODE_AUTO 0 36#define PRNG_MODE_TDES 1 37#define PRNG_MODE_SHA512 2 38 39static unsigned int prng_mode = PRNG_MODE_AUTO; 40module_param_named(mode, prng_mode, int, 0); 41MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512"); 42 43 44#define PRNG_CHUNKSIZE_TDES_MIN 8 45#define PRNG_CHUNKSIZE_TDES_MAX (64*1024) 46#define PRNG_CHUNKSIZE_SHA512_MIN 64 47#define PRNG_CHUNKSIZE_SHA512_MAX (64*1024) 48 49static unsigned int prng_chunk_size = 256; 50module_param_named(chunksize, prng_chunk_size, int, 0); 51MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes"); 52 53 54#define PRNG_RESEED_LIMIT_TDES 4096 55#define PRNG_RESEED_LIMIT_TDES_LOWER 4096 56#define PRNG_RESEED_LIMIT_SHA512 100000 57#define PRNG_RESEED_LIMIT_SHA512_LOWER 10000 58 59static unsigned int prng_reseed_limit; 60module_param_named(reseed_limit, prng_reseed_limit, int, 0); 61MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit"); 62 63static bool trng_available; 64 65/* 66 * Any one who considers arithmetical methods of producing random digits is, 67 * of course, in a state of sin. -- John von Neumann 68 */ 69 70static int prng_errorflag; 71 72#define PRNG_GEN_ENTROPY_FAILED 1 73#define PRNG_SELFTEST_FAILED 2 74#define PRNG_INSTANTIATE_FAILED 3 75#define PRNG_SEED_FAILED 4 76#define PRNG_RESEED_FAILED 5 77#define PRNG_GEN_FAILED 6 78 79struct prng_ws_s { 80 u8 parm_block[32]; 81 u32 reseed_counter; 82 u64 byte_counter; 83}; 84 85struct prno_ws_s { 86 u32 res; 87 u32 reseed_counter; 88 u64 stream_bytes; 89 u8 V[112]; 90 u8 C[112]; 91}; 92 93struct prng_data_s { 94 struct mutex mutex; 95 union { 96 struct prng_ws_s prngws; 97 struct prno_ws_s prnows; 98 }; 99 u8 *buf; 100 u32 rest; 101 u8 *prev; 102}; 103 104static struct prng_data_s *prng_data; 105 106/* initial parameter block for tdes mode, copied from libica */ 107static const u8 initial_parm_block[32] __initconst = { 108 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52, 109 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4, 110 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF, 111 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 }; 112 113 114/*** helper functions ***/ 115 116/* 117 * generate_entropy: 118 * This function fills a given buffer with random bytes. The entropy within 119 * the random bytes given back is assumed to have at least 50% - meaning 120 * a 64 bytes buffer has at least 64 * 8 / 2 = 256 bits of entropy. 121 * Within the function the entropy generation is done in junks of 64 bytes. 122 * So the caller should also ask for buffer fill in multiples of 64 bytes. 123 * The generation of the entropy is based on the assumption that every stckf() 124 * invocation produces 0.5 bits of entropy. To accumulate 256 bits of entropy 125 * at least 512 stckf() values are needed. The entropy relevant part of the 126 * stckf value is bit 51 (counting starts at the left with bit nr 0) so 127 * here we use the lower 4 bytes and exor the values into 2k of bufferspace. 128 * To be on the save side, if there is ever a problem with stckf() the 129 * other half of the page buffer is filled with bytes from urandom via 130 * get_random_bytes(), so this function consumes 2k of urandom for each 131 * requested 64 bytes output data. Finally the buffer page is condensed into 132 * a 64 byte value by hashing with a SHA512 hash. 133 */ 134static int generate_entropy(u8 *ebuf, size_t nbytes) 135{ 136 int n, ret = 0; 137 u8 *pg, pblock[80] = { 138 /* 8 x 64 bit init values */ 139 0x6A, 0x09, 0xE6, 0x67, 0xF3, 0xBC, 0xC9, 0x08, 140 0xBB, 0x67, 0xAE, 0x85, 0x84, 0xCA, 0xA7, 0x3B, 141 0x3C, 0x6E, 0xF3, 0x72, 0xFE, 0x94, 0xF8, 0x2B, 142 0xA5, 0x4F, 0xF5, 0x3A, 0x5F, 0x1D, 0x36, 0xF1, 143 0x51, 0x0E, 0x52, 0x7F, 0xAD, 0xE6, 0x82, 0xD1, 144 0x9B, 0x05, 0x68, 0x8C, 0x2B, 0x3E, 0x6C, 0x1F, 145 0x1F, 0x83, 0xD9, 0xAB, 0xFB, 0x41, 0xBD, 0x6B, 146 0x5B, 0xE0, 0xCD, 0x19, 0x13, 0x7E, 0x21, 0x79, 147 /* 128 bit counter total message bit length */ 148 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 149 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 }; 150 151 /* allocate one page stckf buffer */ 152 pg = (u8 *) __get_free_page(GFP_KERNEL); 153 if (!pg) { 154 prng_errorflag = PRNG_GEN_ENTROPY_FAILED; 155 return -ENOMEM; 156 } 157 158 /* fill the ebuf in chunks of 64 byte each */ 159 while (nbytes) { 160 /* fill lower 2k with urandom bytes */ 161 get_random_bytes(pg, PAGE_SIZE / 2); 162 /* exor upper 2k with 512 stckf values, offset 4 bytes each */ 163 for (n = 0; n < 512; n++) { 164 int offset = (PAGE_SIZE / 2) + (n * 4) - 4; 165 u64 *p = (u64 *)(pg + offset); 166 *p ^= get_tod_clock_fast(); 167 } 168 /* hash over the filled page */ 169 cpacf_klmd(CPACF_KLMD_SHA_512, pblock, pg, PAGE_SIZE); 170 n = (nbytes < 64) ? nbytes : 64; 171 memcpy(ebuf, pblock, n); 172 ret += n; 173 ebuf += n; 174 nbytes -= n; 175 } 176 177 memzero_explicit(pblock, sizeof(pblock)); 178 memzero_explicit(pg, PAGE_SIZE); 179 free_page((unsigned long)pg); 180 return ret; 181} 182 183 184/*** tdes functions ***/ 185 186static void prng_tdes_add_entropy(void) 187{ 188 __u64 entropy[4]; 189 unsigned int i; 190 191 for (i = 0; i < 16; i++) { 192 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 193 (char *) entropy, (char *) entropy, 194 sizeof(entropy)); 195 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy)); 196 } 197} 198 199 200static void prng_tdes_seed(int nbytes) 201{ 202 char buf[16]; 203 int i = 0; 204 205 BUG_ON(nbytes > sizeof(buf)); 206 207 get_random_bytes(buf, nbytes); 208 209 /* Add the entropy */ 210 while (nbytes >= 8) { 211 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i)); 212 prng_tdes_add_entropy(); 213 i += 8; 214 nbytes -= 8; 215 } 216 prng_tdes_add_entropy(); 217 prng_data->prngws.reseed_counter = 0; 218} 219 220 221static int __init prng_tdes_instantiate(void) 222{ 223 int datalen; 224 225 pr_debug("prng runs in TDES mode with " 226 "chunksize=%d and reseed_limit=%u\n", 227 prng_chunk_size, prng_reseed_limit); 228 229 /* memory allocation, prng_data struct init, mutex init */ 230 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 231 prng_data = kzalloc(datalen, GFP_KERNEL); 232 if (!prng_data) { 233 prng_errorflag = PRNG_INSTANTIATE_FAILED; 234 return -ENOMEM; 235 } 236 mutex_init(&prng_data->mutex); 237 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 238 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32); 239 240 /* initialize the PRNG, add 128 bits of entropy */ 241 prng_tdes_seed(16); 242 243 return 0; 244} 245 246 247static void prng_tdes_deinstantiate(void) 248{ 249 pr_debug("The prng module stopped " 250 "after running in triple DES mode\n"); 251 kfree_sensitive(prng_data); 252} 253 254 255/*** sha512 functions ***/ 256 257static int __init prng_sha512_selftest(void) 258{ 259 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */ 260 static const u8 seed[] __initconst = { 261 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a, 262 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22, 263 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b, 264 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c, 265 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa, 266 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 }; 267 static const u8 V0[] __initconst = { 268 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76, 269 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22, 270 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60, 271 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1, 272 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95, 273 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b, 274 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79, 275 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03, 276 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd, 277 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36, 278 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0, 279 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e, 280 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea, 281 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 }; 282 static const u8 C0[] __initconst = { 283 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95, 284 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e, 285 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94, 286 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86, 287 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50, 288 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f, 289 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9, 290 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43, 291 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee, 292 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a, 293 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9, 294 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09, 295 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc, 296 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e }; 297 static const u8 random[] __initconst = { 298 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57, 299 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6, 300 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d, 301 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf, 302 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26, 303 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64, 304 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55, 305 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a, 306 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78, 307 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e, 308 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb, 309 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30, 310 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19, 311 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f, 312 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d, 313 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a, 314 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2, 315 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd, 316 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd, 317 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2, 318 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b, 319 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1, 320 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99, 321 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e, 322 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3, 323 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67, 324 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3, 325 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d, 326 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b, 327 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13, 328 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c, 329 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 }; 330 331 u8 buf[sizeof(random)]; 332 struct prno_ws_s ws; 333 334 memset(&ws, 0, sizeof(ws)); 335 336 /* initial seed */ 337 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 338 &ws, NULL, 0, seed, sizeof(seed)); 339 340 /* check working states V and C */ 341 if (memcmp(ws.V, V0, sizeof(V0)) != 0 342 || memcmp(ws.C, C0, sizeof(C0)) != 0) { 343 pr_err("The prng self test state test " 344 "for the SHA-512 mode failed\n"); 345 prng_errorflag = PRNG_SELFTEST_FAILED; 346 return -EIO; 347 } 348 349 /* generate random bytes */ 350 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 351 &ws, buf, sizeof(buf), NULL, 0); 352 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 353 &ws, buf, sizeof(buf), NULL, 0); 354 355 /* check against expected data */ 356 if (memcmp(buf, random, sizeof(random)) != 0) { 357 pr_err("The prng self test data test " 358 "for the SHA-512 mode failed\n"); 359 prng_errorflag = PRNG_SELFTEST_FAILED; 360 return -EIO; 361 } 362 363 return 0; 364} 365 366 367static int __init prng_sha512_instantiate(void) 368{ 369 int ret, datalen, seedlen; 370 u8 seed[128 + 16]; 371 372 pr_debug("prng runs in SHA-512 mode " 373 "with chunksize=%d and reseed_limit=%u\n", 374 prng_chunk_size, prng_reseed_limit); 375 376 /* memory allocation, prng_data struct init, mutex init */ 377 datalen = sizeof(struct prng_data_s) + prng_chunk_size; 378 if (fips_enabled) 379 datalen += prng_chunk_size; 380 prng_data = kzalloc(datalen, GFP_KERNEL); 381 if (!prng_data) { 382 prng_errorflag = PRNG_INSTANTIATE_FAILED; 383 return -ENOMEM; 384 } 385 mutex_init(&prng_data->mutex); 386 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s); 387 388 /* selftest */ 389 ret = prng_sha512_selftest(); 390 if (ret) 391 goto outfree; 392 393 /* generate initial seed, we need at least 256 + 128 bits entropy. */ 394 if (trng_available) { 395 /* 396 * Trng available, so use it. The trng works in chunks of 397 * 32 bytes and produces 100% entropy. So we pull 64 bytes 398 * which gives us 512 bits entropy. 399 */ 400 seedlen = 2 * 32; 401 cpacf_trng(NULL, 0, seed, seedlen); 402 } else { 403 /* 404 * No trng available, so use the generate_entropy() function. 405 * This function works in 64 byte junks and produces 406 * 50% entropy. So we pull 2*64 bytes which gives us 512 bits 407 * of entropy. 408 */ 409 seedlen = 2 * 64; 410 ret = generate_entropy(seed, seedlen); 411 if (ret != seedlen) 412 goto outfree; 413 } 414 415 /* append the seed by 16 bytes of unique nonce */ 416 store_tod_clock_ext((union tod_clock *)(seed + seedlen)); 417 seedlen += 16; 418 419 /* now initial seed of the prno drng */ 420 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 421 &prng_data->prnows, NULL, 0, seed, seedlen); 422 memzero_explicit(seed, sizeof(seed)); 423 424 /* if fips mode is enabled, generate a first block of random 425 bytes for the FIPS 140-2 Conditional Self Test */ 426 if (fips_enabled) { 427 prng_data->prev = prng_data->buf + prng_chunk_size; 428 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 429 &prng_data->prnows, 430 prng_data->prev, prng_chunk_size, NULL, 0); 431 } 432 433 return 0; 434 435outfree: 436 kfree(prng_data); 437 return ret; 438} 439 440 441static void prng_sha512_deinstantiate(void) 442{ 443 pr_debug("The prng module stopped after running in SHA-512 mode\n"); 444 kfree_sensitive(prng_data); 445} 446 447 448static int prng_sha512_reseed(void) 449{ 450 int ret, seedlen; 451 u8 seed[64]; 452 453 /* We need at least 256 bits of fresh entropy for reseeding */ 454 if (trng_available) { 455 /* trng produces 256 bits entropy in 32 bytes */ 456 seedlen = 32; 457 cpacf_trng(NULL, 0, seed, seedlen); 458 } else { 459 /* generate_entropy() produces 256 bits entropy in 64 bytes */ 460 seedlen = 64; 461 ret = generate_entropy(seed, seedlen); 462 if (ret != sizeof(seed)) 463 return ret; 464 } 465 466 /* do a reseed of the prno drng with this bytestring */ 467 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, 468 &prng_data->prnows, NULL, 0, seed, seedlen); 469 memzero_explicit(seed, sizeof(seed)); 470 471 return 0; 472} 473 474 475static int prng_sha512_generate(u8 *buf, size_t nbytes) 476{ 477 int ret; 478 479 /* reseed needed ? */ 480 if (prng_data->prnows.reseed_counter > prng_reseed_limit) { 481 ret = prng_sha512_reseed(); 482 if (ret) 483 return ret; 484 } 485 486 /* PRNO generate */ 487 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, 488 &prng_data->prnows, buf, nbytes, NULL, 0); 489 490 /* FIPS 140-2 Conditional Self Test */ 491 if (fips_enabled) { 492 if (!memcmp(prng_data->prev, buf, nbytes)) { 493 prng_errorflag = PRNG_GEN_FAILED; 494 return -EILSEQ; 495 } 496 memcpy(prng_data->prev, buf, nbytes); 497 } 498 499 return nbytes; 500} 501 502 503/*** file io functions ***/ 504 505static int prng_open(struct inode *inode, struct file *file) 506{ 507 return nonseekable_open(inode, file); 508} 509 510 511static ssize_t prng_tdes_read(struct file *file, char __user *ubuf, 512 size_t nbytes, loff_t *ppos) 513{ 514 int chunk, n, ret = 0; 515 516 /* lock prng_data struct */ 517 if (mutex_lock_interruptible(&prng_data->mutex)) 518 return -ERESTARTSYS; 519 520 while (nbytes) { 521 if (need_resched()) { 522 if (signal_pending(current)) { 523 if (ret == 0) 524 ret = -ERESTARTSYS; 525 break; 526 } 527 /* give mutex free before calling schedule() */ 528 mutex_unlock(&prng_data->mutex); 529 schedule(); 530 /* occupy mutex again */ 531 if (mutex_lock_interruptible(&prng_data->mutex)) { 532 if (ret == 0) 533 ret = -ERESTARTSYS; 534 return ret; 535 } 536 } 537 538 /* 539 * we lose some random bytes if an attacker issues 540 * reads < 8 bytes, but we don't care 541 */ 542 chunk = min_t(int, nbytes, prng_chunk_size); 543 544 /* PRNG only likes multiples of 8 bytes */ 545 n = (chunk + 7) & -8; 546 547 if (prng_data->prngws.reseed_counter > prng_reseed_limit) 548 prng_tdes_seed(8); 549 550 /* if the CPU supports PRNG stckf is present too */ 551 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast(); 552 553 /* 554 * Beside the STCKF the input for the TDES-EDE is the output 555 * of the last operation. We differ here from X9.17 since we 556 * only store one timestamp into the buffer. Padding the whole 557 * buffer with timestamps does not improve security, since 558 * successive stckf have nearly constant offsets. 559 * If an attacker knows the first timestamp it would be 560 * trivial to guess the additional values. One timestamp 561 * is therefore enough and still guarantees unique input values. 562 * 563 * Note: you can still get strict X9.17 conformity by setting 564 * prng_chunk_size to 8 bytes. 565 */ 566 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block, 567 prng_data->buf, prng_data->buf, n); 568 569 prng_data->prngws.byte_counter += n; 570 prng_data->prngws.reseed_counter += n; 571 572 if (copy_to_user(ubuf, prng_data->buf, chunk)) { 573 ret = -EFAULT; 574 break; 575 } 576 577 nbytes -= chunk; 578 ret += chunk; 579 ubuf += chunk; 580 } 581 582 /* unlock prng_data struct */ 583 mutex_unlock(&prng_data->mutex); 584 585 return ret; 586} 587 588 589static ssize_t prng_sha512_read(struct file *file, char __user *ubuf, 590 size_t nbytes, loff_t *ppos) 591{ 592 int n, ret = 0; 593 u8 *p; 594 595 /* if errorflag is set do nothing and return 'broken pipe' */ 596 if (prng_errorflag) 597 return -EPIPE; 598 599 /* lock prng_data struct */ 600 if (mutex_lock_interruptible(&prng_data->mutex)) 601 return -ERESTARTSYS; 602 603 while (nbytes) { 604 if (need_resched()) { 605 if (signal_pending(current)) { 606 if (ret == 0) 607 ret = -ERESTARTSYS; 608 break; 609 } 610 /* give mutex free before calling schedule() */ 611 mutex_unlock(&prng_data->mutex); 612 schedule(); 613 /* occopy mutex again */ 614 if (mutex_lock_interruptible(&prng_data->mutex)) { 615 if (ret == 0) 616 ret = -ERESTARTSYS; 617 return ret; 618 } 619 } 620 if (prng_data->rest) { 621 /* push left over random bytes from the previous read */ 622 p = prng_data->buf + prng_chunk_size - prng_data->rest; 623 n = (nbytes < prng_data->rest) ? 624 nbytes : prng_data->rest; 625 prng_data->rest -= n; 626 } else { 627 /* generate one chunk of random bytes into read buf */ 628 p = prng_data->buf; 629 n = prng_sha512_generate(p, prng_chunk_size); 630 if (n < 0) { 631 ret = n; 632 break; 633 } 634 if (nbytes < prng_chunk_size) { 635 n = nbytes; 636 prng_data->rest = prng_chunk_size - n; 637 } else { 638 n = prng_chunk_size; 639 prng_data->rest = 0; 640 } 641 } 642 if (copy_to_user(ubuf, p, n)) { 643 ret = -EFAULT; 644 break; 645 } 646 memzero_explicit(p, n); 647 ubuf += n; 648 nbytes -= n; 649 ret += n; 650 } 651 652 /* unlock prng_data struct */ 653 mutex_unlock(&prng_data->mutex); 654 655 return ret; 656} 657 658 659/*** sysfs stuff ***/ 660 661static const struct file_operations prng_sha512_fops = { 662 .owner = THIS_MODULE, 663 .open = &prng_open, 664 .release = NULL, 665 .read = &prng_sha512_read, 666 .llseek = noop_llseek, 667}; 668static const struct file_operations prng_tdes_fops = { 669 .owner = THIS_MODULE, 670 .open = &prng_open, 671 .release = NULL, 672 .read = &prng_tdes_read, 673 .llseek = noop_llseek, 674}; 675 676/* chunksize attribute (ro) */ 677static ssize_t prng_chunksize_show(struct device *dev, 678 struct device_attribute *attr, 679 char *buf) 680{ 681 return sysfs_emit(buf, "%u\n", prng_chunk_size); 682} 683static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL); 684 685/* counter attribute (ro) */ 686static ssize_t prng_counter_show(struct device *dev, 687 struct device_attribute *attr, 688 char *buf) 689{ 690 u64 counter; 691 692 if (mutex_lock_interruptible(&prng_data->mutex)) 693 return -ERESTARTSYS; 694 if (prng_mode == PRNG_MODE_SHA512) 695 counter = prng_data->prnows.stream_bytes; 696 else 697 counter = prng_data->prngws.byte_counter; 698 mutex_unlock(&prng_data->mutex); 699 700 return sysfs_emit(buf, "%llu\n", counter); 701} 702static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL); 703 704/* errorflag attribute (ro) */ 705static ssize_t prng_errorflag_show(struct device *dev, 706 struct device_attribute *attr, 707 char *buf) 708{ 709 return sysfs_emit(buf, "%d\n", prng_errorflag); 710} 711static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL); 712 713/* mode attribute (ro) */ 714static ssize_t prng_mode_show(struct device *dev, 715 struct device_attribute *attr, 716 char *buf) 717{ 718 if (prng_mode == PRNG_MODE_TDES) 719 return sysfs_emit(buf, "TDES\n"); 720 else 721 return sysfs_emit(buf, "SHA512\n"); 722} 723static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL); 724 725/* reseed attribute (w) */ 726static ssize_t prng_reseed_store(struct device *dev, 727 struct device_attribute *attr, 728 const char *buf, size_t count) 729{ 730 if (mutex_lock_interruptible(&prng_data->mutex)) 731 return -ERESTARTSYS; 732 prng_sha512_reseed(); 733 mutex_unlock(&prng_data->mutex); 734 735 return count; 736} 737static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store); 738 739/* reseed limit attribute (rw) */ 740static ssize_t prng_reseed_limit_show(struct device *dev, 741 struct device_attribute *attr, 742 char *buf) 743{ 744 return sysfs_emit(buf, "%u\n", prng_reseed_limit); 745} 746static ssize_t prng_reseed_limit_store(struct device *dev, 747 struct device_attribute *attr, 748 const char *buf, size_t count) 749{ 750 unsigned limit; 751 752 if (sscanf(buf, "%u\n", &limit) != 1) 753 return -EINVAL; 754 755 if (prng_mode == PRNG_MODE_SHA512) { 756 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 757 return -EINVAL; 758 } else { 759 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER) 760 return -EINVAL; 761 } 762 763 prng_reseed_limit = limit; 764 765 return count; 766} 767static DEVICE_ATTR(reseed_limit, 0644, 768 prng_reseed_limit_show, prng_reseed_limit_store); 769 770/* strength attribute (ro) */ 771static ssize_t prng_strength_show(struct device *dev, 772 struct device_attribute *attr, 773 char *buf) 774{ 775 return sysfs_emit(buf, "256\n"); 776} 777static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL); 778 779static struct attribute *prng_sha512_dev_attrs[] = { 780 &dev_attr_errorflag.attr, 781 &dev_attr_chunksize.attr, 782 &dev_attr_byte_counter.attr, 783 &dev_attr_mode.attr, 784 &dev_attr_reseed.attr, 785 &dev_attr_reseed_limit.attr, 786 &dev_attr_strength.attr, 787 NULL 788}; 789ATTRIBUTE_GROUPS(prng_sha512_dev); 790 791static struct attribute *prng_tdes_dev_attrs[] = { 792 &dev_attr_chunksize.attr, 793 &dev_attr_byte_counter.attr, 794 &dev_attr_mode.attr, 795 NULL 796}; 797ATTRIBUTE_GROUPS(prng_tdes_dev); 798 799static struct miscdevice prng_sha512_dev = { 800 .name = "prandom", 801 .minor = MISC_DYNAMIC_MINOR, 802 .mode = 0644, 803 .fops = &prng_sha512_fops, 804 .groups = prng_sha512_dev_groups, 805}; 806 807static struct miscdevice prng_tdes_dev = { 808 .name = "prandom", 809 .minor = MISC_DYNAMIC_MINOR, 810 .mode = 0644, 811 .fops = &prng_tdes_fops, 812 .groups = prng_tdes_dev_groups, 813}; 814 815 816/*** module init and exit ***/ 817 818static int __init prng_init(void) 819{ 820 int ret; 821 822 /* check if the CPU has a PRNG */ 823 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG)) 824 return -ENODEV; 825 826 /* check if TRNG subfunction is available */ 827 if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG)) 828 trng_available = true; 829 830 /* choose prng mode */ 831 if (prng_mode != PRNG_MODE_TDES) { 832 /* check for MSA5 support for PRNO operations */ 833 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) { 834 if (prng_mode == PRNG_MODE_SHA512) { 835 pr_err("The prng module cannot " 836 "start in SHA-512 mode\n"); 837 return -ENODEV; 838 } 839 prng_mode = PRNG_MODE_TDES; 840 } else 841 prng_mode = PRNG_MODE_SHA512; 842 } 843 844 if (prng_mode == PRNG_MODE_SHA512) { 845 846 /* SHA512 mode */ 847 848 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN 849 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX) 850 return -EINVAL; 851 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f; 852 853 if (prng_reseed_limit == 0) 854 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512; 855 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER) 856 return -EINVAL; 857 858 ret = prng_sha512_instantiate(); 859 if (ret) 860 goto out; 861 862 ret = misc_register(&prng_sha512_dev); 863 if (ret) { 864 prng_sha512_deinstantiate(); 865 goto out; 866 } 867 868 } else { 869 870 /* TDES mode */ 871 872 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN 873 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX) 874 return -EINVAL; 875 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07; 876 877 if (prng_reseed_limit == 0) 878 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES; 879 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER) 880 return -EINVAL; 881 882 ret = prng_tdes_instantiate(); 883 if (ret) 884 goto out; 885 886 ret = misc_register(&prng_tdes_dev); 887 if (ret) { 888 prng_tdes_deinstantiate(); 889 goto out; 890 } 891 } 892 893out: 894 return ret; 895} 896 897 898static void __exit prng_exit(void) 899{ 900 if (prng_mode == PRNG_MODE_SHA512) { 901 misc_deregister(&prng_sha512_dev); 902 prng_sha512_deinstantiate(); 903 } else { 904 misc_deregister(&prng_tdes_dev); 905 prng_tdes_deinstantiate(); 906 } 907} 908 909module_cpu_feature_match(S390_CPU_FEATURE_MSA, prng_init); 910module_exit(prng_exit);
~/
Read-only file preview.