~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/arch/s390/crypto/prng.c

Version: ~ [ linux-5.6-rc3 ] ~ [ linux-5.5.6 ] ~ [ linux-5.4.22 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.106 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.171 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.214 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.214 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright IBM Corp. 2006, 2015
  3  * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
  4  *            Harald Freudenberger <freude@de.ibm.com>
  5  * Driver for the s390 pseudo random number generator
  6  */
  7 
  8 #define KMSG_COMPONENT "prng"
  9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 10 
 11 #include <linux/fs.h>
 12 #include <linux/fips.h>
 13 #include <linux/init.h>
 14 #include <linux/kernel.h>
 15 #include <linux/device.h>
 16 #include <linux/miscdevice.h>
 17 #include <linux/module.h>
 18 #include <linux/moduleparam.h>
 19 #include <linux/mutex.h>
 20 #include <linux/cpufeature.h>
 21 #include <linux/random.h>
 22 #include <linux/slab.h>
 23 #include <asm/debug.h>
 24 #include <asm/uaccess.h>
 25 #include <asm/timex.h>
 26 #include <asm/cpacf.h>
 27 
 28 MODULE_LICENSE("GPL");
 29 MODULE_AUTHOR("IBM Corporation");
 30 MODULE_DESCRIPTION("s390 PRNG interface");
 31 
 32 
 33 #define PRNG_MODE_AUTO    0
 34 #define PRNG_MODE_TDES    1
 35 #define PRNG_MODE_SHA512  2
 36 
 37 static unsigned int prng_mode = PRNG_MODE_AUTO;
 38 module_param_named(mode, prng_mode, int, 0);
 39 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
 40 
 41 
 42 #define PRNG_CHUNKSIZE_TDES_MIN   8
 43 #define PRNG_CHUNKSIZE_TDES_MAX   (64*1024)
 44 #define PRNG_CHUNKSIZE_SHA512_MIN 64
 45 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
 46 
 47 static unsigned int prng_chunk_size = 256;
 48 module_param_named(chunksize, prng_chunk_size, int, 0);
 49 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
 50 
 51 
 52 #define PRNG_RESEED_LIMIT_TDES           4096
 53 #define PRNG_RESEED_LIMIT_TDES_LOWER     4096
 54 #define PRNG_RESEED_LIMIT_SHA512       100000
 55 #define PRNG_RESEED_LIMIT_SHA512_LOWER  10000
 56 
 57 static unsigned int prng_reseed_limit;
 58 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
 59 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
 60 
 61 
 62 /*
 63  * Any one who considers arithmetical methods of producing random digits is,
 64  * of course, in a state of sin. -- John von Neumann
 65  */
 66 
 67 static int prng_errorflag;
 68 
 69 #define PRNG_GEN_ENTROPY_FAILED  1
 70 #define PRNG_SELFTEST_FAILED     2
 71 #define PRNG_INSTANTIATE_FAILED  3
 72 #define PRNG_SEED_FAILED         4
 73 #define PRNG_RESEED_FAILED       5
 74 #define PRNG_GEN_FAILED          6
 75 
 76 struct prng_ws_s {
 77         u8  parm_block[32];
 78         u32 reseed_counter;
 79         u64 byte_counter;
 80 };
 81 
 82 struct ppno_ws_s {
 83         u32 res;
 84         u32 reseed_counter;
 85         u64 stream_bytes;
 86         u8  V[112];
 87         u8  C[112];
 88 };
 89 
 90 struct prng_data_s {
 91         struct mutex mutex;
 92         union {
 93                 struct prng_ws_s prngws;
 94                 struct ppno_ws_s ppnows;
 95         };
 96         u8 *buf;
 97         u32 rest;
 98         u8 *prev;
 99 };
100 
101 static struct prng_data_s *prng_data;
102 
103 /* initial parameter block for tdes mode, copied from libica */
104 static const u8 initial_parm_block[32] __initconst = {
105         0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
106         0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
107         0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
108         0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
109 
110 
111 /*** helper functions ***/
112 
113 static int generate_entropy(u8 *ebuf, size_t nbytes)
114 {
115         int n, ret = 0;
116         u8 *pg, *h, hash[32];
117 
118         pg = (u8 *) __get_free_page(GFP_KERNEL);
119         if (!pg) {
120                 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
121                 return -ENOMEM;
122         }
123 
124         while (nbytes) {
125                 /* fill page with urandom bytes */
126                 get_random_bytes(pg, PAGE_SIZE);
127                 /* exor page with stckf values */
128                 for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) {
129                         u64 *p = ((u64 *)pg) + n;
130                         *p ^= get_tod_clock_fast();
131                 }
132                 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
133                 if (n < sizeof(hash))
134                         h = hash;
135                 else
136                         h = ebuf;
137                 /* generate sha256 from this page */
138                 if (cpacf_kimd(CPACF_KIMD_SHA_256, h,
139                                pg, PAGE_SIZE) != PAGE_SIZE) {
140                         prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
141                         ret = -EIO;
142                         goto out;
143                 }
144                 if (n < sizeof(hash))
145                         memcpy(ebuf, hash, n);
146                 ret += n;
147                 ebuf += n;
148                 nbytes -= n;
149         }
150 
151 out:
152         free_page((unsigned long)pg);
153         return ret;
154 }
155 
156 
157 /*** tdes functions ***/
158 
159 static void prng_tdes_add_entropy(void)
160 {
161         __u64 entropy[4];
162         unsigned int i;
163         int ret;
164 
165         for (i = 0; i < 16; i++) {
166                 ret = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
167                                 (char *)entropy, (char *)entropy,
168                                 sizeof(entropy));
169                 BUG_ON(ret < 0 || ret != sizeof(entropy));
170                 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
171         }
172 }
173 
174 
175 static void prng_tdes_seed(int nbytes)
176 {
177         char buf[16];
178         int i = 0;
179 
180         BUG_ON(nbytes > sizeof(buf));
181 
182         get_random_bytes(buf, nbytes);
183 
184         /* Add the entropy */
185         while (nbytes >= 8) {
186                 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
187                 prng_tdes_add_entropy();
188                 i += 8;
189                 nbytes -= 8;
190         }
191         prng_tdes_add_entropy();
192         prng_data->prngws.reseed_counter = 0;
193 }
194 
195 
196 static int __init prng_tdes_instantiate(void)
197 {
198         int datalen;
199 
200         pr_debug("prng runs in TDES mode with "
201                  "chunksize=%d and reseed_limit=%u\n",
202                  prng_chunk_size, prng_reseed_limit);
203 
204         /* memory allocation, prng_data struct init, mutex init */
205         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
206         prng_data = kzalloc(datalen, GFP_KERNEL);
207         if (!prng_data) {
208                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
209                 return -ENOMEM;
210         }
211         mutex_init(&prng_data->mutex);
212         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
213         memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
214 
215         /* initialize the PRNG, add 128 bits of entropy */
216         prng_tdes_seed(16);
217 
218         return 0;
219 }
220 
221 
222 static void prng_tdes_deinstantiate(void)
223 {
224         pr_debug("The prng module stopped "
225                  "after running in triple DES mode\n");
226         kzfree(prng_data);
227 }
228 
229 
230 /*** sha512 functions ***/
231 
232 static int __init prng_sha512_selftest(void)
233 {
234         /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
235         static const u8 seed[] __initconst = {
236                 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
237                 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
238                 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
239                 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
240                 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
241                 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
242         static const u8 V0[] __initconst = {
243                 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
244                 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
245                 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
246                 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
247                 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
248                 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
249                 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
250                 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
251                 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
252                 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
253                 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
254                 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
255                 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
256                 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
257         static const u8 C0[] __initconst = {
258                 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
259                 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
260                 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
261                 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
262                 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
263                 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
264                 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
265                 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
266                 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
267                 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
268                 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
269                 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
270                 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
271                 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
272         static const u8 random[] __initconst = {
273                 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
274                 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
275                 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
276                 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
277                 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
278                 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
279                 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
280                 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
281                 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
282                 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
283                 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
284                 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
285                 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
286                 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
287                 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
288                 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
289                 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
290                 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
291                 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
292                 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
293                 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
294                 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
295                 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
296                 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
297                 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
298                 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
299                 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
300                 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
301                 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
302                 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
303                 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
304                 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
305 
306         int ret = 0;
307         u8 buf[sizeof(random)];
308         struct ppno_ws_s ws;
309 
310         memset(&ws, 0, sizeof(ws));
311 
312         /* initial seed */
313         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, &ws, NULL, 0,
314                          seed, sizeof(seed));
315         if (ret < 0) {
316                 pr_err("The prng self test seed operation for the "
317                        "SHA-512 mode failed with rc=%d\n", ret);
318                 prng_errorflag = PRNG_SELFTEST_FAILED;
319                 return -EIO;
320         }
321 
322         /* check working states V and C */
323         if (memcmp(ws.V, V0, sizeof(V0)) != 0
324             || memcmp(ws.C, C0, sizeof(C0)) != 0) {
325                 pr_err("The prng self test state test "
326                        "for the SHA-512 mode failed\n");
327                 prng_errorflag = PRNG_SELFTEST_FAILED;
328                 return -EIO;
329         }
330 
331         /* generate random bytes */
332         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
333                          &ws, buf, sizeof(buf), NULL, 0);
334         if (ret < 0) {
335                 pr_err("The prng self test generate operation for "
336                        "the SHA-512 mode failed with rc=%d\n", ret);
337                 prng_errorflag = PRNG_SELFTEST_FAILED;
338                 return -EIO;
339         }
340         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
341                          &ws, buf, sizeof(buf), NULL, 0);
342         if (ret < 0) {
343                 pr_err("The prng self test generate operation for "
344                        "the SHA-512 mode failed with rc=%d\n", ret);
345                 prng_errorflag = PRNG_SELFTEST_FAILED;
346                 return -EIO;
347         }
348 
349         /* check against expected data */
350         if (memcmp(buf, random, sizeof(random)) != 0) {
351                 pr_err("The prng self test data test "
352                        "for the SHA-512 mode failed\n");
353                 prng_errorflag = PRNG_SELFTEST_FAILED;
354                 return -EIO;
355         }
356 
357         return 0;
358 }
359 
360 
361 static int __init prng_sha512_instantiate(void)
362 {
363         int ret, datalen;
364         u8 seed[64];
365 
366         pr_debug("prng runs in SHA-512 mode "
367                  "with chunksize=%d and reseed_limit=%u\n",
368                  prng_chunk_size, prng_reseed_limit);
369 
370         /* memory allocation, prng_data struct init, mutex init */
371         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
372         if (fips_enabled)
373                 datalen += prng_chunk_size;
374         prng_data = kzalloc(datalen, GFP_KERNEL);
375         if (!prng_data) {
376                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
377                 return -ENOMEM;
378         }
379         mutex_init(&prng_data->mutex);
380         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
381 
382         /* selftest */
383         ret = prng_sha512_selftest();
384         if (ret)
385                 goto outfree;
386 
387         /* generate initial seed bytestring, first 48 bytes of entropy */
388         ret = generate_entropy(seed, 48);
389         if (ret != 48)
390                 goto outfree;
391         /* followed by 16 bytes of unique nonce */
392         get_tod_clock_ext(seed + 48);
393 
394         /* initial seed of the ppno drng */
395         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
396                          &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
397         if (ret < 0) {
398                 prng_errorflag = PRNG_SEED_FAILED;
399                 ret = -EIO;
400                 goto outfree;
401         }
402 
403         /* if fips mode is enabled, generate a first block of random
404            bytes for the FIPS 140-2 Conditional Self Test */
405         if (fips_enabled) {
406                 prng_data->prev = prng_data->buf + prng_chunk_size;
407                 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
408                                  &prng_data->ppnows,
409                                  prng_data->prev, prng_chunk_size, NULL, 0);
410                 if (ret < 0 || ret != prng_chunk_size) {
411                         prng_errorflag = PRNG_GEN_FAILED;
412                         ret = -EIO;
413                         goto outfree;
414                 }
415         }
416 
417         return 0;
418 
419 outfree:
420         kfree(prng_data);
421         return ret;
422 }
423 
424 
425 static void prng_sha512_deinstantiate(void)
426 {
427         pr_debug("The prng module stopped after running in SHA-512 mode\n");
428         kzfree(prng_data);
429 }
430 
431 
432 static int prng_sha512_reseed(void)
433 {
434         int ret;
435         u8 seed[32];
436 
437         /* generate 32 bytes of fresh entropy */
438         ret = generate_entropy(seed, sizeof(seed));
439         if (ret != sizeof(seed))
440                 return ret;
441 
442         /* do a reseed of the ppno drng with this bytestring */
443         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
444                          &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
445         if (ret) {
446                 prng_errorflag = PRNG_RESEED_FAILED;
447                 return -EIO;
448         }
449 
450         return 0;
451 }
452 
453 
454 static int prng_sha512_generate(u8 *buf, size_t nbytes)
455 {
456         int ret;
457 
458         /* reseed needed ? */
459         if (prng_data->ppnows.reseed_counter > prng_reseed_limit) {
460                 ret = prng_sha512_reseed();
461                 if (ret)
462                         return ret;
463         }
464 
465         /* PPNO generate */
466         ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
467                          &prng_data->ppnows, buf, nbytes, NULL, 0);
468         if (ret < 0 || ret != nbytes) {
469                 prng_errorflag = PRNG_GEN_FAILED;
470                 return -EIO;
471         }
472 
473         /* FIPS 140-2 Conditional Self Test */
474         if (fips_enabled) {
475                 if (!memcmp(prng_data->prev, buf, nbytes)) {
476                         prng_errorflag = PRNG_GEN_FAILED;
477                         return -EILSEQ;
478                 }
479                 memcpy(prng_data->prev, buf, nbytes);
480         }
481 
482         return ret;
483 }
484 
485 
486 /*** file io functions ***/
487 
488 static int prng_open(struct inode *inode, struct file *file)
489 {
490         return nonseekable_open(inode, file);
491 }
492 
493 
494 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
495                               size_t nbytes, loff_t *ppos)
496 {
497         int chunk, n, tmp, ret = 0;
498 
499         /* lock prng_data struct */
500         if (mutex_lock_interruptible(&prng_data->mutex))
501                 return -ERESTARTSYS;
502 
503         while (nbytes) {
504                 if (need_resched()) {
505                         if (signal_pending(current)) {
506                                 if (ret == 0)
507                                         ret = -ERESTARTSYS;
508                                 break;
509                         }
510                         /* give mutex free before calling schedule() */
511                         mutex_unlock(&prng_data->mutex);
512                         schedule();
513                         /* occopy mutex again */
514                         if (mutex_lock_interruptible(&prng_data->mutex)) {
515                                 if (ret == 0)
516                                         ret = -ERESTARTSYS;
517                                 return ret;
518                         }
519                 }
520 
521                 /*
522                  * we lose some random bytes if an attacker issues
523                  * reads < 8 bytes, but we don't care
524                  */
525                 chunk = min_t(int, nbytes, prng_chunk_size);
526 
527                 /* PRNG only likes multiples of 8 bytes */
528                 n = (chunk + 7) & -8;
529 
530                 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
531                         prng_tdes_seed(8);
532 
533                 /* if the CPU supports PRNG stckf is present too */
534                 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
535 
536                 /*
537                  * Beside the STCKF the input for the TDES-EDE is the output
538                  * of the last operation. We differ here from X9.17 since we
539                  * only store one timestamp into the buffer. Padding the whole
540                  * buffer with timestamps does not improve security, since
541                  * successive stckf have nearly constant offsets.
542                  * If an attacker knows the first timestamp it would be
543                  * trivial to guess the additional values. One timestamp
544                  * is therefore enough and still guarantees unique input values.
545                  *
546                  * Note: you can still get strict X9.17 conformity by setting
547                  * prng_chunk_size to 8 bytes.
548                 */
549                 tmp = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
550                                 prng_data->buf, prng_data->buf, n);
551                 if (tmp < 0 || tmp != n) {
552                         ret = -EIO;
553                         break;
554                 }
555 
556                 prng_data->prngws.byte_counter += n;
557                 prng_data->prngws.reseed_counter += n;
558 
559                 if (copy_to_user(ubuf, prng_data->buf, chunk))
560                         return -EFAULT;
561 
562                 nbytes -= chunk;
563                 ret += chunk;
564                 ubuf += chunk;
565         }
566 
567         /* unlock prng_data struct */
568         mutex_unlock(&prng_data->mutex);
569 
570         return ret;
571 }
572 
573 
574 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
575                                 size_t nbytes, loff_t *ppos)
576 {
577         int n, ret = 0;
578         u8 *p;
579 
580         /* if errorflag is set do nothing and return 'broken pipe' */
581         if (prng_errorflag)
582                 return -EPIPE;
583 
584         /* lock prng_data struct */
585         if (mutex_lock_interruptible(&prng_data->mutex))
586                 return -ERESTARTSYS;
587 
588         while (nbytes) {
589                 if (need_resched()) {
590                         if (signal_pending(current)) {
591                                 if (ret == 0)
592                                         ret = -ERESTARTSYS;
593                                 break;
594                         }
595                         /* give mutex free before calling schedule() */
596                         mutex_unlock(&prng_data->mutex);
597                         schedule();
598                         /* occopy mutex again */
599                         if (mutex_lock_interruptible(&prng_data->mutex)) {
600                                 if (ret == 0)
601                                         ret = -ERESTARTSYS;
602                                 return ret;
603                         }
604                 }
605                 if (prng_data->rest) {
606                         /* push left over random bytes from the previous read */
607                         p = prng_data->buf + prng_chunk_size - prng_data->rest;
608                         n = (nbytes < prng_data->rest) ?
609                                 nbytes : prng_data->rest;
610                         prng_data->rest -= n;
611                 } else {
612                         /* generate one chunk of random bytes into read buf */
613                         p = prng_data->buf;
614                         n = prng_sha512_generate(p, prng_chunk_size);
615                         if (n < 0) {
616                                 ret = n;
617                                 break;
618                         }
619                         if (nbytes < prng_chunk_size) {
620                                 n = nbytes;
621                                 prng_data->rest = prng_chunk_size - n;
622                         } else {
623                                 n = prng_chunk_size;
624                                 prng_data->rest = 0;
625                         }
626                 }
627                 if (copy_to_user(ubuf, p, n)) {
628                         ret = -EFAULT;
629                         break;
630                 }
631                 ubuf += n;
632                 nbytes -= n;
633                 ret += n;
634         }
635 
636         /* unlock prng_data struct */
637         mutex_unlock(&prng_data->mutex);
638 
639         return ret;
640 }
641 
642 
643 /*** sysfs stuff ***/
644 
645 static const struct file_operations prng_sha512_fops = {
646         .owner          = THIS_MODULE,
647         .open           = &prng_open,
648         .release        = NULL,
649         .read           = &prng_sha512_read,
650         .llseek         = noop_llseek,
651 };
652 static const struct file_operations prng_tdes_fops = {
653         .owner          = THIS_MODULE,
654         .open           = &prng_open,
655         .release        = NULL,
656         .read           = &prng_tdes_read,
657         .llseek         = noop_llseek,
658 };
659 
660 static struct miscdevice prng_sha512_dev = {
661         .name   = "prandom",
662         .minor  = MISC_DYNAMIC_MINOR,
663         .mode   = 0644,
664         .fops   = &prng_sha512_fops,
665 };
666 static struct miscdevice prng_tdes_dev = {
667         .name   = "prandom",
668         .minor  = MISC_DYNAMIC_MINOR,
669         .mode   = 0644,
670         .fops   = &prng_tdes_fops,
671 };
672 
673 
674 /* chunksize attribute (ro) */
675 static ssize_t prng_chunksize_show(struct device *dev,
676                                    struct device_attribute *attr,
677                                    char *buf)
678 {
679         return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
680 }
681 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
682 
683 /* counter attribute (ro) */
684 static ssize_t prng_counter_show(struct device *dev,
685                                  struct device_attribute *attr,
686                                  char *buf)
687 {
688         u64 counter;
689 
690         if (mutex_lock_interruptible(&prng_data->mutex))
691                 return -ERESTARTSYS;
692         if (prng_mode == PRNG_MODE_SHA512)
693                 counter = prng_data->ppnows.stream_bytes;
694         else
695                 counter = prng_data->prngws.byte_counter;
696         mutex_unlock(&prng_data->mutex);
697 
698         return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
699 }
700 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
701 
702 /* errorflag attribute (ro) */
703 static ssize_t prng_errorflag_show(struct device *dev,
704                                    struct device_attribute *attr,
705                                    char *buf)
706 {
707         return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
708 }
709 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
710 
711 /* mode attribute (ro) */
712 static ssize_t prng_mode_show(struct device *dev,
713                               struct device_attribute *attr,
714                               char *buf)
715 {
716         if (prng_mode == PRNG_MODE_TDES)
717                 return snprintf(buf, PAGE_SIZE, "TDES\n");
718         else
719                 return snprintf(buf, PAGE_SIZE, "SHA512\n");
720 }
721 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
722 
723 /* reseed attribute (w) */
724 static ssize_t prng_reseed_store(struct device *dev,
725                                  struct device_attribute *attr,
726                                  const char *buf, size_t count)
727 {
728         if (mutex_lock_interruptible(&prng_data->mutex))
729                 return -ERESTARTSYS;
730         prng_sha512_reseed();
731         mutex_unlock(&prng_data->mutex);
732 
733         return count;
734 }
735 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
736 
737 /* reseed limit attribute (rw) */
738 static ssize_t prng_reseed_limit_show(struct device *dev,
739                                       struct device_attribute *attr,
740                                       char *buf)
741 {
742         return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
743 }
744 static ssize_t prng_reseed_limit_store(struct device *dev,
745                                        struct device_attribute *attr,
746                                        const char *buf, size_t count)
747 {
748         unsigned limit;
749 
750         if (sscanf(buf, "%u\n", &limit) != 1)
751                 return -EINVAL;
752 
753         if (prng_mode == PRNG_MODE_SHA512) {
754                 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
755                         return -EINVAL;
756         } else {
757                 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
758                         return -EINVAL;
759         }
760 
761         prng_reseed_limit = limit;
762 
763         return count;
764 }
765 static DEVICE_ATTR(reseed_limit, 0644,
766                    prng_reseed_limit_show, prng_reseed_limit_store);
767 
768 /* strength attribute (ro) */
769 static ssize_t prng_strength_show(struct device *dev,
770                                   struct device_attribute *attr,
771                                   char *buf)
772 {
773         return snprintf(buf, PAGE_SIZE, "256\n");
774 }
775 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
776 
777 static struct attribute *prng_sha512_dev_attrs[] = {
778         &dev_attr_errorflag.attr,
779         &dev_attr_chunksize.attr,
780         &dev_attr_byte_counter.attr,
781         &dev_attr_mode.attr,
782         &dev_attr_reseed.attr,
783         &dev_attr_reseed_limit.attr,
784         &dev_attr_strength.attr,
785         NULL
786 };
787 static struct attribute *prng_tdes_dev_attrs[] = {
788         &dev_attr_chunksize.attr,
789         &dev_attr_byte_counter.attr,
790         &dev_attr_mode.attr,
791         NULL
792 };
793 
794 static struct attribute_group prng_sha512_dev_attr_group = {
795         .attrs = prng_sha512_dev_attrs
796 };
797 static struct attribute_group prng_tdes_dev_attr_group = {
798         .attrs = prng_tdes_dev_attrs
799 };
800 
801 
802 /*** module init and exit ***/
803 
804 static int __init prng_init(void)
805 {
806         int ret;
807 
808         /* check if the CPU has a PRNG */
809         if (!cpacf_query(CPACF_KMC, CPACF_KMC_PRNG))
810                 return -EOPNOTSUPP;
811 
812         /* choose prng mode */
813         if (prng_mode != PRNG_MODE_TDES) {
814                 /* check for MSA5 support for PPNO operations */
815                 if (!cpacf_query(CPACF_PPNO, CPACF_PPNO_SHA512_DRNG_GEN)) {
816                         if (prng_mode == PRNG_MODE_SHA512) {
817                                 pr_err("The prng module cannot "
818                                        "start in SHA-512 mode\n");
819                                 return -EOPNOTSUPP;
820                         }
821                         prng_mode = PRNG_MODE_TDES;
822                 } else
823                         prng_mode = PRNG_MODE_SHA512;
824         }
825 
826         if (prng_mode == PRNG_MODE_SHA512) {
827 
828                 /* SHA512 mode */
829 
830                 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
831                     || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
832                         return -EINVAL;
833                 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
834 
835                 if (prng_reseed_limit == 0)
836                         prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
837                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
838                         return -EINVAL;
839 
840                 ret = prng_sha512_instantiate();
841                 if (ret)
842                         goto out;
843 
844                 ret = misc_register(&prng_sha512_dev);
845                 if (ret) {
846                         prng_sha512_deinstantiate();
847                         goto out;
848                 }
849                 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
850                                          &prng_sha512_dev_attr_group);
851                 if (ret) {
852                         misc_deregister(&prng_sha512_dev);
853                         prng_sha512_deinstantiate();
854                         goto out;
855                 }
856 
857         } else {
858 
859                 /* TDES mode */
860 
861                 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
862                     || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
863                         return -EINVAL;
864                 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
865 
866                 if (prng_reseed_limit == 0)
867                         prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
868                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
869                         return -EINVAL;
870 
871                 ret = prng_tdes_instantiate();
872                 if (ret)
873                         goto out;
874 
875                 ret = misc_register(&prng_tdes_dev);
876                 if (ret) {
877                         prng_tdes_deinstantiate();
878                         goto out;
879                 }
880                 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
881                                          &prng_tdes_dev_attr_group);
882                 if (ret) {
883                         misc_deregister(&prng_tdes_dev);
884                         prng_tdes_deinstantiate();
885                         goto out;
886                 }
887 
888         }
889 
890 out:
891         return ret;
892 }
893 
894 
895 static void __exit prng_exit(void)
896 {
897         if (prng_mode == PRNG_MODE_SHA512) {
898                 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
899                                    &prng_sha512_dev_attr_group);
900                 misc_deregister(&prng_sha512_dev);
901                 prng_sha512_deinstantiate();
902         } else {
903                 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
904                                    &prng_tdes_dev_attr_group);
905                 misc_deregister(&prng_tdes_dev);
906                 prng_tdes_deinstantiate();
907         }
908 }
909 
910 module_cpu_feature_match(MSA, prng_init);
911 module_exit(prng_exit);
912 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp