~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/arch/s390/crypto/prng.c

Version: ~ [ linux-5.19-rc3 ] ~ [ linux-5.18.5 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.48 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.123 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.199 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.248 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.284 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.319 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0
  2 /*
  3  * Copyright IBM Corp. 2006, 2015
  4  * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
  5  *            Harald Freudenberger <freude@de.ibm.com>
  6  * Driver for the s390 pseudo random number generator
  7  */
  8 
  9 #define KMSG_COMPONENT "prng"
 10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 11 
 12 #include <linux/fs.h>
 13 #include <linux/fips.h>
 14 #include <linux/init.h>
 15 #include <linux/kernel.h>
 16 #include <linux/device.h>
 17 #include <linux/miscdevice.h>
 18 #include <linux/module.h>
 19 #include <linux/moduleparam.h>
 20 #include <linux/mutex.h>
 21 #include <linux/cpufeature.h>
 22 #include <linux/random.h>
 23 #include <linux/slab.h>
 24 #include <linux/sched/signal.h>
 25 
 26 #include <asm/debug.h>
 27 #include <linux/uaccess.h>
 28 #include <asm/timex.h>
 29 #include <asm/cpacf.h>
 30 
 31 MODULE_LICENSE("GPL");
 32 MODULE_AUTHOR("IBM Corporation");
 33 MODULE_DESCRIPTION("s390 PRNG interface");
 34 
 35 
 36 #define PRNG_MODE_AUTO    0
 37 #define PRNG_MODE_TDES    1
 38 #define PRNG_MODE_SHA512  2
 39 
 40 static unsigned int prng_mode = PRNG_MODE_AUTO;
 41 module_param_named(mode, prng_mode, int, 0);
 42 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
 43 
 44 
 45 #define PRNG_CHUNKSIZE_TDES_MIN   8
 46 #define PRNG_CHUNKSIZE_TDES_MAX   (64*1024)
 47 #define PRNG_CHUNKSIZE_SHA512_MIN 64
 48 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
 49 
 50 static unsigned int prng_chunk_size = 256;
 51 module_param_named(chunksize, prng_chunk_size, int, 0);
 52 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
 53 
 54 
 55 #define PRNG_RESEED_LIMIT_TDES           4096
 56 #define PRNG_RESEED_LIMIT_TDES_LOWER     4096
 57 #define PRNG_RESEED_LIMIT_SHA512       100000
 58 #define PRNG_RESEED_LIMIT_SHA512_LOWER  10000
 59 
 60 static unsigned int prng_reseed_limit;
 61 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
 62 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
 63 
 64 static bool trng_available;
 65 
 66 /*
 67  * Any one who considers arithmetical methods of producing random digits is,
 68  * of course, in a state of sin. -- John von Neumann
 69  */
 70 
 71 static int prng_errorflag;
 72 
 73 #define PRNG_GEN_ENTROPY_FAILED  1
 74 #define PRNG_SELFTEST_FAILED     2
 75 #define PRNG_INSTANTIATE_FAILED  3
 76 #define PRNG_SEED_FAILED         4
 77 #define PRNG_RESEED_FAILED       5
 78 #define PRNG_GEN_FAILED          6
 79 
 80 struct prng_ws_s {
 81         u8  parm_block[32];
 82         u32 reseed_counter;
 83         u64 byte_counter;
 84 };
 85 
 86 struct prno_ws_s {
 87         u32 res;
 88         u32 reseed_counter;
 89         u64 stream_bytes;
 90         u8  V[112];
 91         u8  C[112];
 92 };
 93 
 94 struct prng_data_s {
 95         struct mutex mutex;
 96         union {
 97                 struct prng_ws_s prngws;
 98                 struct prno_ws_s prnows;
 99         };
100         u8 *buf;
101         u32 rest;
102         u8 *prev;
103 };
104 
105 static struct prng_data_s *prng_data;
106 
107 /* initial parameter block for tdes mode, copied from libica */
108 static const u8 initial_parm_block[32] __initconst = {
109         0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
110         0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
111         0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
112         0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
113 
114 
115 /*** helper functions ***/
116 
117 /*
118  * generate_entropy:
119  * This function fills a given buffer with random bytes. The entropy within
120  * the random bytes given back is assumed to have at least 50% - meaning
121  * a 64 bytes buffer has at least 64 * 8 / 2 = 256 bits of entropy.
122  * Within the function the entropy generation is done in junks of 64 bytes.
123  * So the caller should also ask for buffer fill in multiples of 64 bytes.
124  * The generation of the entropy is based on the assumption that every stckf()
125  * invocation produces 0.5 bits of entropy. To accumulate 256 bits of entropy
126  * at least 512 stckf() values are needed. The entropy relevant part of the
127  * stckf value is bit 51 (counting starts at the left with bit nr 0) so
128  * here we use the lower 4 bytes and exor the values into 2k of bufferspace.
129  * To be on the save side, if there is ever a problem with stckf() the
130  * other half of the page buffer is filled with bytes from urandom via
131  * get_random_bytes(), so this function consumes 2k of urandom for each
132  * requested 64 bytes output data. Finally the buffer page is condensed into
133  * a 64 byte value by hashing with a SHA512 hash.
134  */
135 static int generate_entropy(u8 *ebuf, size_t nbytes)
136 {
137         int n, ret = 0;
138         u8 *pg, pblock[80] = {
139                 /* 8 x 64 bit init values */
140                 0x6A, 0x09, 0xE6, 0x67, 0xF3, 0xBC, 0xC9, 0x08,
141                 0xBB, 0x67, 0xAE, 0x85, 0x84, 0xCA, 0xA7, 0x3B,
142                 0x3C, 0x6E, 0xF3, 0x72, 0xFE, 0x94, 0xF8, 0x2B,
143                 0xA5, 0x4F, 0xF5, 0x3A, 0x5F, 0x1D, 0x36, 0xF1,
144                 0x51, 0x0E, 0x52, 0x7F, 0xAD, 0xE6, 0x82, 0xD1,
145                 0x9B, 0x05, 0x68, 0x8C, 0x2B, 0x3E, 0x6C, 0x1F,
146                 0x1F, 0x83, 0xD9, 0xAB, 0xFB, 0x41, 0xBD, 0x6B,
147                 0x5B, 0xE0, 0xCD, 0x19, 0x13, 0x7E, 0x21, 0x79,
148                 /* 128 bit counter total message bit length */
149                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
150                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 };
151 
152         /* allocate one page stckf buffer */
153         pg = (u8 *) __get_free_page(GFP_KERNEL);
154         if (!pg) {
155                 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
156                 return -ENOMEM;
157         }
158 
159         /* fill the ebuf in chunks of 64 byte each */
160         while (nbytes) {
161                 /* fill lower 2k with urandom bytes */
162                 get_random_bytes(pg, PAGE_SIZE / 2);
163                 /* exor upper 2k with 512 stckf values, offset 4 bytes each */
164                 for (n = 0; n < 512; n++) {
165                         int offset = (PAGE_SIZE / 2) + (n * 4) - 4;
166                         u64 *p = (u64 *)(pg + offset);
167                         *p ^= get_tod_clock_fast();
168                 }
169                 /* hash over the filled page */
170                 cpacf_klmd(CPACF_KLMD_SHA_512, pblock, pg, PAGE_SIZE);
171                 n = (nbytes < 64) ? nbytes : 64;
172                 memcpy(ebuf, pblock, n);
173                 ret += n;
174                 ebuf += n;
175                 nbytes -= n;
176         }
177 
178         memzero_explicit(pblock, sizeof(pblock));
179         memzero_explicit(pg, PAGE_SIZE);
180         free_page((unsigned long)pg);
181         return ret;
182 }
183 
184 
185 /*** tdes functions ***/
186 
187 static void prng_tdes_add_entropy(void)
188 {
189         __u64 entropy[4];
190         unsigned int i;
191 
192         for (i = 0; i < 16; i++) {
193                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
194                           (char *) entropy, (char *) entropy,
195                           sizeof(entropy));
196                 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
197         }
198 }
199 
200 
201 static void prng_tdes_seed(int nbytes)
202 {
203         char buf[16];
204         int i = 0;
205 
206         BUG_ON(nbytes > sizeof(buf));
207 
208         get_random_bytes(buf, nbytes);
209 
210         /* Add the entropy */
211         while (nbytes >= 8) {
212                 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
213                 prng_tdes_add_entropy();
214                 i += 8;
215                 nbytes -= 8;
216         }
217         prng_tdes_add_entropy();
218         prng_data->prngws.reseed_counter = 0;
219 }
220 
221 
222 static int __init prng_tdes_instantiate(void)
223 {
224         int datalen;
225 
226         pr_debug("prng runs in TDES mode with "
227                  "chunksize=%d and reseed_limit=%u\n",
228                  prng_chunk_size, prng_reseed_limit);
229 
230         /* memory allocation, prng_data struct init, mutex init */
231         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
232         prng_data = kzalloc(datalen, GFP_KERNEL);
233         if (!prng_data) {
234                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
235                 return -ENOMEM;
236         }
237         mutex_init(&prng_data->mutex);
238         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
239         memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
240 
241         /* initialize the PRNG, add 128 bits of entropy */
242         prng_tdes_seed(16);
243 
244         return 0;
245 }
246 
247 
248 static void prng_tdes_deinstantiate(void)
249 {
250         pr_debug("The prng module stopped "
251                  "after running in triple DES mode\n");
252         kzfree(prng_data);
253 }
254 
255 
256 /*** sha512 functions ***/
257 
258 static int __init prng_sha512_selftest(void)
259 {
260         /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
261         static const u8 seed[] __initconst = {
262                 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
263                 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
264                 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
265                 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
266                 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
267                 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
268         static const u8 V0[] __initconst = {
269                 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
270                 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
271                 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
272                 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
273                 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
274                 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
275                 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
276                 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
277                 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
278                 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
279                 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
280                 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
281                 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
282                 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
283         static const u8 C0[] __initconst = {
284                 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
285                 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
286                 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
287                 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
288                 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
289                 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
290                 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
291                 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
292                 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
293                 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
294                 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
295                 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
296                 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
297                 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
298         static const u8 random[] __initconst = {
299                 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
300                 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
301                 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
302                 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
303                 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
304                 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
305                 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
306                 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
307                 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
308                 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
309                 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
310                 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
311                 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
312                 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
313                 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
314                 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
315                 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
316                 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
317                 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
318                 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
319                 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
320                 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
321                 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
322                 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
323                 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
324                 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
325                 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
326                 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
327                 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
328                 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
329                 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
330                 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
331 
332         u8 buf[sizeof(random)];
333         struct prno_ws_s ws;
334 
335         memset(&ws, 0, sizeof(ws));
336 
337         /* initial seed */
338         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
339                    &ws, NULL, 0, seed, sizeof(seed));
340 
341         /* check working states V and C */
342         if (memcmp(ws.V, V0, sizeof(V0)) != 0
343             || memcmp(ws.C, C0, sizeof(C0)) != 0) {
344                 pr_err("The prng self test state test "
345                        "for the SHA-512 mode failed\n");
346                 prng_errorflag = PRNG_SELFTEST_FAILED;
347                 return -EIO;
348         }
349 
350         /* generate random bytes */
351         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
352                    &ws, buf, sizeof(buf), NULL, 0);
353         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
354                    &ws, buf, sizeof(buf), NULL, 0);
355 
356         /* check against expected data */
357         if (memcmp(buf, random, sizeof(random)) != 0) {
358                 pr_err("The prng self test data test "
359                        "for the SHA-512 mode failed\n");
360                 prng_errorflag = PRNG_SELFTEST_FAILED;
361                 return -EIO;
362         }
363 
364         return 0;
365 }
366 
367 
368 static int __init prng_sha512_instantiate(void)
369 {
370         int ret, datalen, seedlen;
371         u8 seed[128 + 16];
372 
373         pr_debug("prng runs in SHA-512 mode "
374                  "with chunksize=%d and reseed_limit=%u\n",
375                  prng_chunk_size, prng_reseed_limit);
376 
377         /* memory allocation, prng_data struct init, mutex init */
378         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
379         if (fips_enabled)
380                 datalen += prng_chunk_size;
381         prng_data = kzalloc(datalen, GFP_KERNEL);
382         if (!prng_data) {
383                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
384                 return -ENOMEM;
385         }
386         mutex_init(&prng_data->mutex);
387         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
388 
389         /* selftest */
390         ret = prng_sha512_selftest();
391         if (ret)
392                 goto outfree;
393 
394         /* generate initial seed, we need at least  256 + 128 bits entropy. */
395         if (trng_available) {
396                 /*
397                  * Trng available, so use it. The trng works in chunks of
398                  * 32 bytes and produces 100% entropy. So we pull 64 bytes
399                  * which gives us 512 bits entropy.
400                  */
401                 seedlen = 2 * 32;
402                 cpacf_trng(NULL, 0, seed, seedlen);
403         } else {
404                 /*
405                  * No trng available, so use the generate_entropy() function.
406                  * This function works in 64 byte junks and produces
407                  * 50% entropy. So we pull 2*64 bytes which gives us 512 bits
408                  * of entropy.
409                  */
410                 seedlen = 2 * 64;
411                 ret = generate_entropy(seed, seedlen);
412                 if (ret != seedlen)
413                         goto outfree;
414         }
415 
416         /* append the seed by 16 bytes of unique nonce */
417         get_tod_clock_ext(seed + seedlen);
418         seedlen += 16;
419 
420         /* now initial seed of the prno drng */
421         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
422                    &prng_data->prnows, NULL, 0, seed, seedlen);
423         memzero_explicit(seed, sizeof(seed));
424 
425         /* if fips mode is enabled, generate a first block of random
426            bytes for the FIPS 140-2 Conditional Self Test */
427         if (fips_enabled) {
428                 prng_data->prev = prng_data->buf + prng_chunk_size;
429                 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
430                            &prng_data->prnows,
431                            prng_data->prev, prng_chunk_size, NULL, 0);
432         }
433 
434         return 0;
435 
436 outfree:
437         kfree(prng_data);
438         return ret;
439 }
440 
441 
442 static void prng_sha512_deinstantiate(void)
443 {
444         pr_debug("The prng module stopped after running in SHA-512 mode\n");
445         kzfree(prng_data);
446 }
447 
448 
449 static int prng_sha512_reseed(void)
450 {
451         int ret, seedlen;
452         u8 seed[64];
453 
454         /* We need at least 256 bits of fresh entropy for reseeding */
455         if (trng_available) {
456                 /* trng produces 256 bits entropy in 32 bytes */
457                 seedlen = 32;
458                 cpacf_trng(NULL, 0, seed, seedlen);
459         } else {
460                 /* generate_entropy() produces 256 bits entropy in 64 bytes */
461                 seedlen = 64;
462                 ret = generate_entropy(seed, seedlen);
463                 if (ret != sizeof(seed))
464                         return ret;
465         }
466 
467         /* do a reseed of the prno drng with this bytestring */
468         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
469                    &prng_data->prnows, NULL, 0, seed, seedlen);
470         memzero_explicit(seed, sizeof(seed));
471 
472         return 0;
473 }
474 
475 
476 static int prng_sha512_generate(u8 *buf, size_t nbytes)
477 {
478         int ret;
479 
480         /* reseed needed ? */
481         if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
482                 ret = prng_sha512_reseed();
483                 if (ret)
484                         return ret;
485         }
486 
487         /* PRNO generate */
488         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
489                    &prng_data->prnows, buf, nbytes, NULL, 0);
490 
491         /* FIPS 140-2 Conditional Self Test */
492         if (fips_enabled) {
493                 if (!memcmp(prng_data->prev, buf, nbytes)) {
494                         prng_errorflag = PRNG_GEN_FAILED;
495                         return -EILSEQ;
496                 }
497                 memcpy(prng_data->prev, buf, nbytes);
498         }
499 
500         return nbytes;
501 }
502 
503 
504 /*** file io functions ***/
505 
506 static int prng_open(struct inode *inode, struct file *file)
507 {
508         return nonseekable_open(inode, file);
509 }
510 
511 
512 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
513                               size_t nbytes, loff_t *ppos)
514 {
515         int chunk, n, ret = 0;
516 
517         /* lock prng_data struct */
518         if (mutex_lock_interruptible(&prng_data->mutex))
519                 return -ERESTARTSYS;
520 
521         while (nbytes) {
522                 if (need_resched()) {
523                         if (signal_pending(current)) {
524                                 if (ret == 0)
525                                         ret = -ERESTARTSYS;
526                                 break;
527                         }
528                         /* give mutex free before calling schedule() */
529                         mutex_unlock(&prng_data->mutex);
530                         schedule();
531                         /* occopy mutex again */
532                         if (mutex_lock_interruptible(&prng_data->mutex)) {
533                                 if (ret == 0)
534                                         ret = -ERESTARTSYS;
535                                 return ret;
536                         }
537                 }
538 
539                 /*
540                  * we lose some random bytes if an attacker issues
541                  * reads < 8 bytes, but we don't care
542                  */
543                 chunk = min_t(int, nbytes, prng_chunk_size);
544 
545                 /* PRNG only likes multiples of 8 bytes */
546                 n = (chunk + 7) & -8;
547 
548                 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
549                         prng_tdes_seed(8);
550 
551                 /* if the CPU supports PRNG stckf is present too */
552                 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
553 
554                 /*
555                  * Beside the STCKF the input for the TDES-EDE is the output
556                  * of the last operation. We differ here from X9.17 since we
557                  * only store one timestamp into the buffer. Padding the whole
558                  * buffer with timestamps does not improve security, since
559                  * successive stckf have nearly constant offsets.
560                  * If an attacker knows the first timestamp it would be
561                  * trivial to guess the additional values. One timestamp
562                  * is therefore enough and still guarantees unique input values.
563                  *
564                  * Note: you can still get strict X9.17 conformity by setting
565                  * prng_chunk_size to 8 bytes.
566                  */
567                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
568                           prng_data->buf, prng_data->buf, n);
569 
570                 prng_data->prngws.byte_counter += n;
571                 prng_data->prngws.reseed_counter += n;
572 
573                 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
574                         ret = -EFAULT;
575                         break;
576                 }
577 
578                 nbytes -= chunk;
579                 ret += chunk;
580                 ubuf += chunk;
581         }
582 
583         /* unlock prng_data struct */
584         mutex_unlock(&prng_data->mutex);
585 
586         return ret;
587 }
588 
589 
590 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
591                                 size_t nbytes, loff_t *ppos)
592 {
593         int n, ret = 0;
594         u8 *p;
595 
596         /* if errorflag is set do nothing and return 'broken pipe' */
597         if (prng_errorflag)
598                 return -EPIPE;
599 
600         /* lock prng_data struct */
601         if (mutex_lock_interruptible(&prng_data->mutex))
602                 return -ERESTARTSYS;
603 
604         while (nbytes) {
605                 if (need_resched()) {
606                         if (signal_pending(current)) {
607                                 if (ret == 0)
608                                         ret = -ERESTARTSYS;
609                                 break;
610                         }
611                         /* give mutex free before calling schedule() */
612                         mutex_unlock(&prng_data->mutex);
613                         schedule();
614                         /* occopy mutex again */
615                         if (mutex_lock_interruptible(&prng_data->mutex)) {
616                                 if (ret == 0)
617                                         ret = -ERESTARTSYS;
618                                 return ret;
619                         }
620                 }
621                 if (prng_data->rest) {
622                         /* push left over random bytes from the previous read */
623                         p = prng_data->buf + prng_chunk_size - prng_data->rest;
624                         n = (nbytes < prng_data->rest) ?
625                                 nbytes : prng_data->rest;
626                         prng_data->rest -= n;
627                 } else {
628                         /* generate one chunk of random bytes into read buf */
629                         p = prng_data->buf;
630                         n = prng_sha512_generate(p, prng_chunk_size);
631                         if (n < 0) {
632                                 ret = n;
633                                 break;
634                         }
635                         if (nbytes < prng_chunk_size) {
636                                 n = nbytes;
637                                 prng_data->rest = prng_chunk_size - n;
638                         } else {
639                                 n = prng_chunk_size;
640                                 prng_data->rest = 0;
641                         }
642                 }
643                 if (copy_to_user(ubuf, p, n)) {
644                         ret = -EFAULT;
645                         break;
646                 }
647                 memzero_explicit(p, n);
648                 ubuf += n;
649                 nbytes -= n;
650                 ret += n;
651         }
652 
653         /* unlock prng_data struct */
654         mutex_unlock(&prng_data->mutex);
655 
656         return ret;
657 }
658 
659 
660 /*** sysfs stuff ***/
661 
662 static const struct file_operations prng_sha512_fops = {
663         .owner          = THIS_MODULE,
664         .open           = &prng_open,
665         .release        = NULL,
666         .read           = &prng_sha512_read,
667         .llseek         = noop_llseek,
668 };
669 static const struct file_operations prng_tdes_fops = {
670         .owner          = THIS_MODULE,
671         .open           = &prng_open,
672         .release        = NULL,
673         .read           = &prng_tdes_read,
674         .llseek         = noop_llseek,
675 };
676 
677 static struct miscdevice prng_sha512_dev = {
678         .name   = "prandom",
679         .minor  = MISC_DYNAMIC_MINOR,
680         .mode   = 0644,
681         .fops   = &prng_sha512_fops,
682 };
683 static struct miscdevice prng_tdes_dev = {
684         .name   = "prandom",
685         .minor  = MISC_DYNAMIC_MINOR,
686         .mode   = 0644,
687         .fops   = &prng_tdes_fops,
688 };
689 
690 
691 /* chunksize attribute (ro) */
692 static ssize_t prng_chunksize_show(struct device *dev,
693                                    struct device_attribute *attr,
694                                    char *buf)
695 {
696         return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
697 }
698 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
699 
700 /* counter attribute (ro) */
701 static ssize_t prng_counter_show(struct device *dev,
702                                  struct device_attribute *attr,
703                                  char *buf)
704 {
705         u64 counter;
706 
707         if (mutex_lock_interruptible(&prng_data->mutex))
708                 return -ERESTARTSYS;
709         if (prng_mode == PRNG_MODE_SHA512)
710                 counter = prng_data->prnows.stream_bytes;
711         else
712                 counter = prng_data->prngws.byte_counter;
713         mutex_unlock(&prng_data->mutex);
714 
715         return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
716 }
717 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
718 
719 /* errorflag attribute (ro) */
720 static ssize_t prng_errorflag_show(struct device *dev,
721                                    struct device_attribute *attr,
722                                    char *buf)
723 {
724         return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
725 }
726 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
727 
728 /* mode attribute (ro) */
729 static ssize_t prng_mode_show(struct device *dev,
730                               struct device_attribute *attr,
731                               char *buf)
732 {
733         if (prng_mode == PRNG_MODE_TDES)
734                 return snprintf(buf, PAGE_SIZE, "TDES\n");
735         else
736                 return snprintf(buf, PAGE_SIZE, "SHA512\n");
737 }
738 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
739 
740 /* reseed attribute (w) */
741 static ssize_t prng_reseed_store(struct device *dev,
742                                  struct device_attribute *attr,
743                                  const char *buf, size_t count)
744 {
745         if (mutex_lock_interruptible(&prng_data->mutex))
746                 return -ERESTARTSYS;
747         prng_sha512_reseed();
748         mutex_unlock(&prng_data->mutex);
749 
750         return count;
751 }
752 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
753 
754 /* reseed limit attribute (rw) */
755 static ssize_t prng_reseed_limit_show(struct device *dev,
756                                       struct device_attribute *attr,
757                                       char *buf)
758 {
759         return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
760 }
761 static ssize_t prng_reseed_limit_store(struct device *dev,
762                                        struct device_attribute *attr,
763                                        const char *buf, size_t count)
764 {
765         unsigned limit;
766 
767         if (sscanf(buf, "%u\n", &limit) != 1)
768                 return -EINVAL;
769 
770         if (prng_mode == PRNG_MODE_SHA512) {
771                 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
772                         return -EINVAL;
773         } else {
774                 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
775                         return -EINVAL;
776         }
777 
778         prng_reseed_limit = limit;
779 
780         return count;
781 }
782 static DEVICE_ATTR(reseed_limit, 0644,
783                    prng_reseed_limit_show, prng_reseed_limit_store);
784 
785 /* strength attribute (ro) */
786 static ssize_t prng_strength_show(struct device *dev,
787                                   struct device_attribute *attr,
788                                   char *buf)
789 {
790         return snprintf(buf, PAGE_SIZE, "256\n");
791 }
792 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
793 
794 static struct attribute *prng_sha512_dev_attrs[] = {
795         &dev_attr_errorflag.attr,
796         &dev_attr_chunksize.attr,
797         &dev_attr_byte_counter.attr,
798         &dev_attr_mode.attr,
799         &dev_attr_reseed.attr,
800         &dev_attr_reseed_limit.attr,
801         &dev_attr_strength.attr,
802         NULL
803 };
804 static struct attribute *prng_tdes_dev_attrs[] = {
805         &dev_attr_chunksize.attr,
806         &dev_attr_byte_counter.attr,
807         &dev_attr_mode.attr,
808         NULL
809 };
810 
811 static struct attribute_group prng_sha512_dev_attr_group = {
812         .attrs = prng_sha512_dev_attrs
813 };
814 static struct attribute_group prng_tdes_dev_attr_group = {
815         .attrs = prng_tdes_dev_attrs
816 };
817 
818 
819 /*** module init and exit ***/
820 
821 static int __init prng_init(void)
822 {
823         int ret;
824 
825         /* check if the CPU has a PRNG */
826         if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
827                 return -ENODEV;
828 
829         /* check if TRNG subfunction is available */
830         if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG))
831                 trng_available = true;
832 
833         /* choose prng mode */
834         if (prng_mode != PRNG_MODE_TDES) {
835                 /* check for MSA5 support for PRNO operations */
836                 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
837                         if (prng_mode == PRNG_MODE_SHA512) {
838                                 pr_err("The prng module cannot "
839                                        "start in SHA-512 mode\n");
840                                 return -ENODEV;
841                         }
842                         prng_mode = PRNG_MODE_TDES;
843                 } else
844                         prng_mode = PRNG_MODE_SHA512;
845         }
846 
847         if (prng_mode == PRNG_MODE_SHA512) {
848 
849                 /* SHA512 mode */
850 
851                 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
852                     || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
853                         return -EINVAL;
854                 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
855 
856                 if (prng_reseed_limit == 0)
857                         prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
858                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
859                         return -EINVAL;
860 
861                 ret = prng_sha512_instantiate();
862                 if (ret)
863                         goto out;
864 
865                 ret = misc_register(&prng_sha512_dev);
866                 if (ret) {
867                         prng_sha512_deinstantiate();
868                         goto out;
869                 }
870                 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
871                                          &prng_sha512_dev_attr_group);
872                 if (ret) {
873                         misc_deregister(&prng_sha512_dev);
874                         prng_sha512_deinstantiate();
875                         goto out;
876                 }
877 
878         } else {
879 
880                 /* TDES mode */
881 
882                 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
883                     || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
884                         return -EINVAL;
885                 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
886 
887                 if (prng_reseed_limit == 0)
888                         prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
889                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
890                         return -EINVAL;
891 
892                 ret = prng_tdes_instantiate();
893                 if (ret)
894                         goto out;
895 
896                 ret = misc_register(&prng_tdes_dev);
897                 if (ret) {
898                         prng_tdes_deinstantiate();
899                         goto out;
900                 }
901                 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
902                                          &prng_tdes_dev_attr_group);
903                 if (ret) {
904                         misc_deregister(&prng_tdes_dev);
905                         prng_tdes_deinstantiate();
906                         goto out;
907                 }
908 
909         }
910 
911 out:
912         return ret;
913 }
914 
915 
916 static void __exit prng_exit(void)
917 {
918         if (prng_mode == PRNG_MODE_SHA512) {
919                 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
920                                    &prng_sha512_dev_attr_group);
921                 misc_deregister(&prng_sha512_dev);
922                 prng_sha512_deinstantiate();
923         } else {
924                 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
925                                    &prng_tdes_dev_attr_group);
926                 misc_deregister(&prng_tdes_dev);
927                 prng_tdes_deinstantiate();
928         }
929 }
930 
931 module_cpu_feature_match(MSA, prng_init);
932 module_exit(prng_exit);
933 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp