Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright IBM Corp. 2006, 2015
4 * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
5 * Harald Freudenberger <freude@de.ibm.com>
6 * Driver for the s390 pseudo random number generator
7 */
8
9#define KMSG_COMPONENT "prng"
10#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12#include <linux/fs.h>
13#include <linux/fips.h>
14#include <linux/init.h>
15#include <linux/kernel.h>
16#include <linux/device.h>
17#include <linux/miscdevice.h>
18#include <linux/module.h>
19#include <linux/moduleparam.h>
20#include <linux/mutex.h>
21#include <linux/cpufeature.h>
22#include <linux/random.h>
23#include <linux/slab.h>
24#include <linux/sched/signal.h>
25
26#include <asm/debug.h>
27#include <linux/uaccess.h>
28#include <asm/timex.h>
29#include <asm/cpacf.h>
30
31MODULE_LICENSE("GPL");
32MODULE_AUTHOR("IBM Corporation");
33MODULE_DESCRIPTION("s390 PRNG interface");
34
35
36#define PRNG_MODE_AUTO 0
37#define PRNG_MODE_TDES 1
38#define PRNG_MODE_SHA512 2
39
40static unsigned int prng_mode = PRNG_MODE_AUTO;
41module_param_named(mode, prng_mode, int, 0);
42MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
43
44
45#define PRNG_CHUNKSIZE_TDES_MIN 8
46#define PRNG_CHUNKSIZE_TDES_MAX (64*1024)
47#define PRNG_CHUNKSIZE_SHA512_MIN 64
48#define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
49
50static unsigned int prng_chunk_size = 256;
51module_param_named(chunksize, prng_chunk_size, int, 0);
52MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
53
54
55#define PRNG_RESEED_LIMIT_TDES 4096
56#define PRNG_RESEED_LIMIT_TDES_LOWER 4096
57#define PRNG_RESEED_LIMIT_SHA512 100000
58#define PRNG_RESEED_LIMIT_SHA512_LOWER 10000
59
60static unsigned int prng_reseed_limit;
61module_param_named(reseed_limit, prng_reseed_limit, int, 0);
62MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
63
64static bool trng_available;
65
66/*
67 * Any one who considers arithmetical methods of producing random digits is,
68 * of course, in a state of sin. -- John von Neumann
69 */
70
71static int prng_errorflag;
72
73#define PRNG_GEN_ENTROPY_FAILED 1
74#define PRNG_SELFTEST_FAILED 2
75#define PRNG_INSTANTIATE_FAILED 3
76#define PRNG_SEED_FAILED 4
77#define PRNG_RESEED_FAILED 5
78#define PRNG_GEN_FAILED 6
79
80struct prng_ws_s {
81 u8 parm_block[32];
82 u32 reseed_counter;
83 u64 byte_counter;
84};
85
86struct prno_ws_s {
87 u32 res;
88 u32 reseed_counter;
89 u64 stream_bytes;
90 u8 V[112];
91 u8 C[112];
92};
93
94struct prng_data_s {
95 struct mutex mutex;
96 union {
97 struct prng_ws_s prngws;
98 struct prno_ws_s prnows;
99 };
100 u8 *buf;
101 u32 rest;
102 u8 *prev;
103};
104
105static struct prng_data_s *prng_data;
106
107/* initial parameter block for tdes mode, copied from libica */
108static const u8 initial_parm_block[32] __initconst = {
109 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
110 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
111 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
112 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
113
114
115/*** helper functions ***/
116
117/*
118 * generate_entropy:
119 * This function fills a given buffer with random bytes. The entropy within
120 * the random bytes given back is assumed to have at least 50% - meaning
121 * a 64 bytes buffer has at least 64 * 8 / 2 = 256 bits of entropy.
122 * Within the function the entropy generation is done in junks of 64 bytes.
123 * So the caller should also ask for buffer fill in multiples of 64 bytes.
124 * The generation of the entropy is based on the assumption that every stckf()
125 * invocation produces 0.5 bits of entropy. To accumulate 256 bits of entropy
126 * at least 512 stckf() values are needed. The entropy relevant part of the
127 * stckf value is bit 51 (counting starts at the left with bit nr 0) so
128 * here we use the lower 4 bytes and exor the values into 2k of bufferspace.
129 * To be on the save side, if there is ever a problem with stckf() the
130 * other half of the page buffer is filled with bytes from urandom via
131 * get_random_bytes(), so this function consumes 2k of urandom for each
132 * requested 64 bytes output data. Finally the buffer page is condensed into
133 * a 64 byte value by hashing with a SHA512 hash.
134 */
135static int generate_entropy(u8 *ebuf, size_t nbytes)
136{
137 int n, ret = 0;
138 u8 *pg, pblock[80] = {
139 /* 8 x 64 bit init values */
140 0x6A, 0x09, 0xE6, 0x67, 0xF3, 0xBC, 0xC9, 0x08,
141 0xBB, 0x67, 0xAE, 0x85, 0x84, 0xCA, 0xA7, 0x3B,
142 0x3C, 0x6E, 0xF3, 0x72, 0xFE, 0x94, 0xF8, 0x2B,
143 0xA5, 0x4F, 0xF5, 0x3A, 0x5F, 0x1D, 0x36, 0xF1,
144 0x51, 0x0E, 0x52, 0x7F, 0xAD, 0xE6, 0x82, 0xD1,
145 0x9B, 0x05, 0x68, 0x8C, 0x2B, 0x3E, 0x6C, 0x1F,
146 0x1F, 0x83, 0xD9, 0xAB, 0xFB, 0x41, 0xBD, 0x6B,
147 0x5B, 0xE0, 0xCD, 0x19, 0x13, 0x7E, 0x21, 0x79,
148 /* 128 bit counter total message bit length */
149 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
150 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 };
151
152 /* allocate one page stckf buffer */
153 pg = (u8 *) __get_free_page(GFP_KERNEL);
154 if (!pg) {
155 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
156 return -ENOMEM;
157 }
158
159 /* fill the ebuf in chunks of 64 byte each */
160 while (nbytes) {
161 /* fill lower 2k with urandom bytes */
162 get_random_bytes(pg, PAGE_SIZE / 2);
163 /* exor upper 2k with 512 stckf values, offset 4 bytes each */
164 for (n = 0; n < 512; n++) {
165 int offset = (PAGE_SIZE / 2) + (n * 4) - 4;
166 u64 *p = (u64 *)(pg + offset);
167 *p ^= get_tod_clock_fast();
168 }
169 /* hash over the filled page */
170 cpacf_klmd(CPACF_KLMD_SHA_512, pblock, pg, PAGE_SIZE);
171 n = (nbytes < 64) ? nbytes : 64;
172 memcpy(ebuf, pblock, n);
173 ret += n;
174 ebuf += n;
175 nbytes -= n;
176 }
177
178 memzero_explicit(pblock, sizeof(pblock));
179 memzero_explicit(pg, PAGE_SIZE);
180 free_page((unsigned long)pg);
181 return ret;
182}
183
184
185/*** tdes functions ***/
186
187static void prng_tdes_add_entropy(void)
188{
189 __u64 entropy[4];
190 unsigned int i;
191
192 for (i = 0; i < 16; i++) {
193 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
194 (char *) entropy, (char *) entropy,
195 sizeof(entropy));
196 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
197 }
198}
199
200
201static void prng_tdes_seed(int nbytes)
202{
203 char buf[16];
204 int i = 0;
205
206 BUG_ON(nbytes > sizeof(buf));
207
208 get_random_bytes(buf, nbytes);
209
210 /* Add the entropy */
211 while (nbytes >= 8) {
212 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
213 prng_tdes_add_entropy();
214 i += 8;
215 nbytes -= 8;
216 }
217 prng_tdes_add_entropy();
218 prng_data->prngws.reseed_counter = 0;
219}
220
221
222static int __init prng_tdes_instantiate(void)
223{
224 int datalen;
225
226 pr_debug("prng runs in TDES mode with "
227 "chunksize=%d and reseed_limit=%u\n",
228 prng_chunk_size, prng_reseed_limit);
229
230 /* memory allocation, prng_data struct init, mutex init */
231 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
232 prng_data = kzalloc(datalen, GFP_KERNEL);
233 if (!prng_data) {
234 prng_errorflag = PRNG_INSTANTIATE_FAILED;
235 return -ENOMEM;
236 }
237 mutex_init(&prng_data->mutex);
238 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
239 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
240
241 /* initialize the PRNG, add 128 bits of entropy */
242 prng_tdes_seed(16);
243
244 return 0;
245}
246
247
248static void prng_tdes_deinstantiate(void)
249{
250 pr_debug("The prng module stopped "
251 "after running in triple DES mode\n");
252 kfree_sensitive(prng_data);
253}
254
255
256/*** sha512 functions ***/
257
258static int __init prng_sha512_selftest(void)
259{
260 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
261 static const u8 seed[] __initconst = {
262 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
263 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
264 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
265 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
266 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
267 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
268 static const u8 V0[] __initconst = {
269 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
270 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
271 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
272 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
273 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
274 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
275 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
276 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
277 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
278 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
279 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
280 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
281 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
282 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
283 static const u8 C0[] __initconst = {
284 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
285 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
286 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
287 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
288 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
289 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
290 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
291 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
292 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
293 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
294 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
295 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
296 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
297 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
298 static const u8 random[] __initconst = {
299 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
300 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
301 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
302 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
303 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
304 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
305 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
306 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
307 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
308 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
309 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
310 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
311 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
312 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
313 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
314 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
315 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
316 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
317 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
318 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
319 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
320 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
321 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
322 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
323 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
324 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
325 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
326 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
327 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
328 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
329 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
330 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
331
332 u8 buf[sizeof(random)];
333 struct prno_ws_s ws;
334
335 memset(&ws, 0, sizeof(ws));
336
337 /* initial seed */
338 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
339 &ws, NULL, 0, seed, sizeof(seed));
340
341 /* check working states V and C */
342 if (memcmp(ws.V, V0, sizeof(V0)) != 0
343 || memcmp(ws.C, C0, sizeof(C0)) != 0) {
344 pr_err("The prng self test state test "
345 "for the SHA-512 mode failed\n");
346 prng_errorflag = PRNG_SELFTEST_FAILED;
347 return -EIO;
348 }
349
350 /* generate random bytes */
351 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
352 &ws, buf, sizeof(buf), NULL, 0);
353 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
354 &ws, buf, sizeof(buf), NULL, 0);
355
356 /* check against expected data */
357 if (memcmp(buf, random, sizeof(random)) != 0) {
358 pr_err("The prng self test data test "
359 "for the SHA-512 mode failed\n");
360 prng_errorflag = PRNG_SELFTEST_FAILED;
361 return -EIO;
362 }
363
364 return 0;
365}
366
367
368static int __init prng_sha512_instantiate(void)
369{
370 int ret, datalen, seedlen;
371 u8 seed[128 + 16];
372
373 pr_debug("prng runs in SHA-512 mode "
374 "with chunksize=%d and reseed_limit=%u\n",
375 prng_chunk_size, prng_reseed_limit);
376
377 /* memory allocation, prng_data struct init, mutex init */
378 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
379 if (fips_enabled)
380 datalen += prng_chunk_size;
381 prng_data = kzalloc(datalen, GFP_KERNEL);
382 if (!prng_data) {
383 prng_errorflag = PRNG_INSTANTIATE_FAILED;
384 return -ENOMEM;
385 }
386 mutex_init(&prng_data->mutex);
387 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
388
389 /* selftest */
390 ret = prng_sha512_selftest();
391 if (ret)
392 goto outfree;
393
394 /* generate initial seed, we need at least 256 + 128 bits entropy. */
395 if (trng_available) {
396 /*
397 * Trng available, so use it. The trng works in chunks of
398 * 32 bytes and produces 100% entropy. So we pull 64 bytes
399 * which gives us 512 bits entropy.
400 */
401 seedlen = 2 * 32;
402 cpacf_trng(NULL, 0, seed, seedlen);
403 } else {
404 /*
405 * No trng available, so use the generate_entropy() function.
406 * This function works in 64 byte junks and produces
407 * 50% entropy. So we pull 2*64 bytes which gives us 512 bits
408 * of entropy.
409 */
410 seedlen = 2 * 64;
411 ret = generate_entropy(seed, seedlen);
412 if (ret != seedlen)
413 goto outfree;
414 }
415
416 /* append the seed by 16 bytes of unique nonce */
417 store_tod_clock_ext((union tod_clock *)(seed + seedlen));
418 seedlen += 16;
419
420 /* now initial seed of the prno drng */
421 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
422 &prng_data->prnows, NULL, 0, seed, seedlen);
423 memzero_explicit(seed, sizeof(seed));
424
425 /* if fips mode is enabled, generate a first block of random
426 bytes for the FIPS 140-2 Conditional Self Test */
427 if (fips_enabled) {
428 prng_data->prev = prng_data->buf + prng_chunk_size;
429 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
430 &prng_data->prnows,
431 prng_data->prev, prng_chunk_size, NULL, 0);
432 }
433
434 return 0;
435
436outfree:
437 kfree(prng_data);
438 return ret;
439}
440
441
442static void prng_sha512_deinstantiate(void)
443{
444 pr_debug("The prng module stopped after running in SHA-512 mode\n");
445 kfree_sensitive(prng_data);
446}
447
448
449static int prng_sha512_reseed(void)
450{
451 int ret, seedlen;
452 u8 seed[64];
453
454 /* We need at least 256 bits of fresh entropy for reseeding */
455 if (trng_available) {
456 /* trng produces 256 bits entropy in 32 bytes */
457 seedlen = 32;
458 cpacf_trng(NULL, 0, seed, seedlen);
459 } else {
460 /* generate_entropy() produces 256 bits entropy in 64 bytes */
461 seedlen = 64;
462 ret = generate_entropy(seed, seedlen);
463 if (ret != sizeof(seed))
464 return ret;
465 }
466
467 /* do a reseed of the prno drng with this bytestring */
468 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
469 &prng_data->prnows, NULL, 0, seed, seedlen);
470 memzero_explicit(seed, sizeof(seed));
471
472 return 0;
473}
474
475
476static int prng_sha512_generate(u8 *buf, size_t nbytes)
477{
478 int ret;
479
480 /* reseed needed ? */
481 if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
482 ret = prng_sha512_reseed();
483 if (ret)
484 return ret;
485 }
486
487 /* PRNO generate */
488 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
489 &prng_data->prnows, buf, nbytes, NULL, 0);
490
491 /* FIPS 140-2 Conditional Self Test */
492 if (fips_enabled) {
493 if (!memcmp(prng_data->prev, buf, nbytes)) {
494 prng_errorflag = PRNG_GEN_FAILED;
495 return -EILSEQ;
496 }
497 memcpy(prng_data->prev, buf, nbytes);
498 }
499
500 return nbytes;
501}
502
503
504/*** file io functions ***/
505
506static int prng_open(struct inode *inode, struct file *file)
507{
508 return nonseekable_open(inode, file);
509}
510
511
512static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
513 size_t nbytes, loff_t *ppos)
514{
515 int chunk, n, ret = 0;
516
517 /* lock prng_data struct */
518 if (mutex_lock_interruptible(&prng_data->mutex))
519 return -ERESTARTSYS;
520
521 while (nbytes) {
522 if (need_resched()) {
523 if (signal_pending(current)) {
524 if (ret == 0)
525 ret = -ERESTARTSYS;
526 break;
527 }
528 /* give mutex free before calling schedule() */
529 mutex_unlock(&prng_data->mutex);
530 schedule();
531 /* occupy mutex again */
532 if (mutex_lock_interruptible(&prng_data->mutex)) {
533 if (ret == 0)
534 ret = -ERESTARTSYS;
535 return ret;
536 }
537 }
538
539 /*
540 * we lose some random bytes if an attacker issues
541 * reads < 8 bytes, but we don't care
542 */
543 chunk = min_t(int, nbytes, prng_chunk_size);
544
545 /* PRNG only likes multiples of 8 bytes */
546 n = (chunk + 7) & -8;
547
548 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
549 prng_tdes_seed(8);
550
551 /* if the CPU supports PRNG stckf is present too */
552 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
553
554 /*
555 * Beside the STCKF the input for the TDES-EDE is the output
556 * of the last operation. We differ here from X9.17 since we
557 * only store one timestamp into the buffer. Padding the whole
558 * buffer with timestamps does not improve security, since
559 * successive stckf have nearly constant offsets.
560 * If an attacker knows the first timestamp it would be
561 * trivial to guess the additional values. One timestamp
562 * is therefore enough and still guarantees unique input values.
563 *
564 * Note: you can still get strict X9.17 conformity by setting
565 * prng_chunk_size to 8 bytes.
566 */
567 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
568 prng_data->buf, prng_data->buf, n);
569
570 prng_data->prngws.byte_counter += n;
571 prng_data->prngws.reseed_counter += n;
572
573 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
574 ret = -EFAULT;
575 break;
576 }
577
578 nbytes -= chunk;
579 ret += chunk;
580 ubuf += chunk;
581 }
582
583 /* unlock prng_data struct */
584 mutex_unlock(&prng_data->mutex);
585
586 return ret;
587}
588
589
590static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
591 size_t nbytes, loff_t *ppos)
592{
593 int n, ret = 0;
594 u8 *p;
595
596 /* if errorflag is set do nothing and return 'broken pipe' */
597 if (prng_errorflag)
598 return -EPIPE;
599
600 /* lock prng_data struct */
601 if (mutex_lock_interruptible(&prng_data->mutex))
602 return -ERESTARTSYS;
603
604 while (nbytes) {
605 if (need_resched()) {
606 if (signal_pending(current)) {
607 if (ret == 0)
608 ret = -ERESTARTSYS;
609 break;
610 }
611 /* give mutex free before calling schedule() */
612 mutex_unlock(&prng_data->mutex);
613 schedule();
614 /* occopy mutex again */
615 if (mutex_lock_interruptible(&prng_data->mutex)) {
616 if (ret == 0)
617 ret = -ERESTARTSYS;
618 return ret;
619 }
620 }
621 if (prng_data->rest) {
622 /* push left over random bytes from the previous read */
623 p = prng_data->buf + prng_chunk_size - prng_data->rest;
624 n = (nbytes < prng_data->rest) ?
625 nbytes : prng_data->rest;
626 prng_data->rest -= n;
627 } else {
628 /* generate one chunk of random bytes into read buf */
629 p = prng_data->buf;
630 n = prng_sha512_generate(p, prng_chunk_size);
631 if (n < 0) {
632 ret = n;
633 break;
634 }
635 if (nbytes < prng_chunk_size) {
636 n = nbytes;
637 prng_data->rest = prng_chunk_size - n;
638 } else {
639 n = prng_chunk_size;
640 prng_data->rest = 0;
641 }
642 }
643 if (copy_to_user(ubuf, p, n)) {
644 ret = -EFAULT;
645 break;
646 }
647 memzero_explicit(p, n);
648 ubuf += n;
649 nbytes -= n;
650 ret += n;
651 }
652
653 /* unlock prng_data struct */
654 mutex_unlock(&prng_data->mutex);
655
656 return ret;
657}
658
659
660/*** sysfs stuff ***/
661
662static const struct file_operations prng_sha512_fops = {
663 .owner = THIS_MODULE,
664 .open = &prng_open,
665 .release = NULL,
666 .read = &prng_sha512_read,
667 .llseek = noop_llseek,
668};
669static const struct file_operations prng_tdes_fops = {
670 .owner = THIS_MODULE,
671 .open = &prng_open,
672 .release = NULL,
673 .read = &prng_tdes_read,
674 .llseek = noop_llseek,
675};
676
677/* chunksize attribute (ro) */
678static ssize_t prng_chunksize_show(struct device *dev,
679 struct device_attribute *attr,
680 char *buf)
681{
682 return sysfs_emit(buf, "%u\n", prng_chunk_size);
683}
684static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
685
686/* counter attribute (ro) */
687static ssize_t prng_counter_show(struct device *dev,
688 struct device_attribute *attr,
689 char *buf)
690{
691 u64 counter;
692
693 if (mutex_lock_interruptible(&prng_data->mutex))
694 return -ERESTARTSYS;
695 if (prng_mode == PRNG_MODE_SHA512)
696 counter = prng_data->prnows.stream_bytes;
697 else
698 counter = prng_data->prngws.byte_counter;
699 mutex_unlock(&prng_data->mutex);
700
701 return sysfs_emit(buf, "%llu\n", counter);
702}
703static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
704
705/* errorflag attribute (ro) */
706static ssize_t prng_errorflag_show(struct device *dev,
707 struct device_attribute *attr,
708 char *buf)
709{
710 return sysfs_emit(buf, "%d\n", prng_errorflag);
711}
712static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
713
714/* mode attribute (ro) */
715static ssize_t prng_mode_show(struct device *dev,
716 struct device_attribute *attr,
717 char *buf)
718{
719 if (prng_mode == PRNG_MODE_TDES)
720 return sysfs_emit(buf, "TDES\n");
721 else
722 return sysfs_emit(buf, "SHA512\n");
723}
724static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
725
726/* reseed attribute (w) */
727static ssize_t prng_reseed_store(struct device *dev,
728 struct device_attribute *attr,
729 const char *buf, size_t count)
730{
731 if (mutex_lock_interruptible(&prng_data->mutex))
732 return -ERESTARTSYS;
733 prng_sha512_reseed();
734 mutex_unlock(&prng_data->mutex);
735
736 return count;
737}
738static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
739
740/* reseed limit attribute (rw) */
741static ssize_t prng_reseed_limit_show(struct device *dev,
742 struct device_attribute *attr,
743 char *buf)
744{
745 return sysfs_emit(buf, "%u\n", prng_reseed_limit);
746}
747static ssize_t prng_reseed_limit_store(struct device *dev,
748 struct device_attribute *attr,
749 const char *buf, size_t count)
750{
751 unsigned limit;
752
753 if (sscanf(buf, "%u\n", &limit) != 1)
754 return -EINVAL;
755
756 if (prng_mode == PRNG_MODE_SHA512) {
757 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
758 return -EINVAL;
759 } else {
760 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
761 return -EINVAL;
762 }
763
764 prng_reseed_limit = limit;
765
766 return count;
767}
768static DEVICE_ATTR(reseed_limit, 0644,
769 prng_reseed_limit_show, prng_reseed_limit_store);
770
771/* strength attribute (ro) */
772static ssize_t prng_strength_show(struct device *dev,
773 struct device_attribute *attr,
774 char *buf)
775{
776 return sysfs_emit(buf, "256\n");
777}
778static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
779
780static struct attribute *prng_sha512_dev_attrs[] = {
781 &dev_attr_errorflag.attr,
782 &dev_attr_chunksize.attr,
783 &dev_attr_byte_counter.attr,
784 &dev_attr_mode.attr,
785 &dev_attr_reseed.attr,
786 &dev_attr_reseed_limit.attr,
787 &dev_attr_strength.attr,
788 NULL
789};
790ATTRIBUTE_GROUPS(prng_sha512_dev);
791
792static struct attribute *prng_tdes_dev_attrs[] = {
793 &dev_attr_chunksize.attr,
794 &dev_attr_byte_counter.attr,
795 &dev_attr_mode.attr,
796 NULL
797};
798ATTRIBUTE_GROUPS(prng_tdes_dev);
799
800static struct miscdevice prng_sha512_dev = {
801 .name = "prandom",
802 .minor = MISC_DYNAMIC_MINOR,
803 .mode = 0644,
804 .fops = &prng_sha512_fops,
805 .groups = prng_sha512_dev_groups,
806};
807
808static struct miscdevice prng_tdes_dev = {
809 .name = "prandom",
810 .minor = MISC_DYNAMIC_MINOR,
811 .mode = 0644,
812 .fops = &prng_tdes_fops,
813 .groups = prng_tdes_dev_groups,
814};
815
816
817/*** module init and exit ***/
818
819static int __init prng_init(void)
820{
821 int ret;
822
823 /* check if the CPU has a PRNG */
824 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
825 return -ENODEV;
826
827 /* check if TRNG subfunction is available */
828 if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG))
829 trng_available = true;
830
831 /* choose prng mode */
832 if (prng_mode != PRNG_MODE_TDES) {
833 /* check for MSA5 support for PRNO operations */
834 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
835 if (prng_mode == PRNG_MODE_SHA512) {
836 pr_err("The prng module cannot "
837 "start in SHA-512 mode\n");
838 return -ENODEV;
839 }
840 prng_mode = PRNG_MODE_TDES;
841 } else
842 prng_mode = PRNG_MODE_SHA512;
843 }
844
845 if (prng_mode == PRNG_MODE_SHA512) {
846
847 /* SHA512 mode */
848
849 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
850 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
851 return -EINVAL;
852 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
853
854 if (prng_reseed_limit == 0)
855 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
856 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
857 return -EINVAL;
858
859 ret = prng_sha512_instantiate();
860 if (ret)
861 goto out;
862
863 ret = misc_register(&prng_sha512_dev);
864 if (ret) {
865 prng_sha512_deinstantiate();
866 goto out;
867 }
868
869 } else {
870
871 /* TDES mode */
872
873 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
874 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
875 return -EINVAL;
876 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
877
878 if (prng_reseed_limit == 0)
879 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
880 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
881 return -EINVAL;
882
883 ret = prng_tdes_instantiate();
884 if (ret)
885 goto out;
886
887 ret = misc_register(&prng_tdes_dev);
888 if (ret) {
889 prng_tdes_deinstantiate();
890 goto out;
891 }
892 }
893
894out:
895 return ret;
896}
897
898
899static void __exit prng_exit(void)
900{
901 if (prng_mode == PRNG_MODE_SHA512) {
902 misc_deregister(&prng_sha512_dev);
903 prng_sha512_deinstantiate();
904 } else {
905 misc_deregister(&prng_tdes_dev);
906 prng_tdes_deinstantiate();
907 }
908}
909
910module_cpu_feature_match(S390_CPU_FEATURE_MSA, prng_init);
911module_exit(prng_exit);
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright IBM Corp. 2006, 2015
4 * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
5 * Harald Freudenberger <freude@de.ibm.com>
6 * Driver for the s390 pseudo random number generator
7 */
8
9#define KMSG_COMPONENT "prng"
10#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12#include <linux/fs.h>
13#include <linux/fips.h>
14#include <linux/init.h>
15#include <linux/kernel.h>
16#include <linux/device.h>
17#include <linux/miscdevice.h>
18#include <linux/module.h>
19#include <linux/moduleparam.h>
20#include <linux/mutex.h>
21#include <linux/cpufeature.h>
22#include <linux/random.h>
23#include <linux/slab.h>
24#include <linux/sched/signal.h>
25
26#include <asm/debug.h>
27#include <linux/uaccess.h>
28#include <asm/timex.h>
29#include <asm/cpacf.h>
30
31MODULE_LICENSE("GPL");
32MODULE_AUTHOR("IBM Corporation");
33MODULE_DESCRIPTION("s390 PRNG interface");
34
35
36#define PRNG_MODE_AUTO 0
37#define PRNG_MODE_TDES 1
38#define PRNG_MODE_SHA512 2
39
40static unsigned int prng_mode = PRNG_MODE_AUTO;
41module_param_named(mode, prng_mode, int, 0);
42MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
43
44
45#define PRNG_CHUNKSIZE_TDES_MIN 8
46#define PRNG_CHUNKSIZE_TDES_MAX (64*1024)
47#define PRNG_CHUNKSIZE_SHA512_MIN 64
48#define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
49
50static unsigned int prng_chunk_size = 256;
51module_param_named(chunksize, prng_chunk_size, int, 0);
52MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
53
54
55#define PRNG_RESEED_LIMIT_TDES 4096
56#define PRNG_RESEED_LIMIT_TDES_LOWER 4096
57#define PRNG_RESEED_LIMIT_SHA512 100000
58#define PRNG_RESEED_LIMIT_SHA512_LOWER 10000
59
60static unsigned int prng_reseed_limit;
61module_param_named(reseed_limit, prng_reseed_limit, int, 0);
62MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
63
64
65/*
66 * Any one who considers arithmetical methods of producing random digits is,
67 * of course, in a state of sin. -- John von Neumann
68 */
69
70static int prng_errorflag;
71
72#define PRNG_GEN_ENTROPY_FAILED 1
73#define PRNG_SELFTEST_FAILED 2
74#define PRNG_INSTANTIATE_FAILED 3
75#define PRNG_SEED_FAILED 4
76#define PRNG_RESEED_FAILED 5
77#define PRNG_GEN_FAILED 6
78
79struct prng_ws_s {
80 u8 parm_block[32];
81 u32 reseed_counter;
82 u64 byte_counter;
83};
84
85struct prno_ws_s {
86 u32 res;
87 u32 reseed_counter;
88 u64 stream_bytes;
89 u8 V[112];
90 u8 C[112];
91};
92
93struct prng_data_s {
94 struct mutex mutex;
95 union {
96 struct prng_ws_s prngws;
97 struct prno_ws_s prnows;
98 };
99 u8 *buf;
100 u32 rest;
101 u8 *prev;
102};
103
104static struct prng_data_s *prng_data;
105
106/* initial parameter block for tdes mode, copied from libica */
107static const u8 initial_parm_block[32] __initconst = {
108 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
109 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
110 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
111 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
112
113
114/*** helper functions ***/
115
116/*
117 * generate_entropy:
118 * This algorithm produces 64 bytes of entropy data based on 1024
119 * individual stckf() invocations assuming that each stckf() value
120 * contributes 0.25 bits of entropy. So the caller gets 256 bit
121 * entropy per 64 byte or 4 bits entropy per byte.
122 */
123static int generate_entropy(u8 *ebuf, size_t nbytes)
124{
125 int n, ret = 0;
126 u8 *pg, *h, hash[64];
127
128 /* allocate 2 pages */
129 pg = (u8 *) __get_free_pages(GFP_KERNEL, 1);
130 if (!pg) {
131 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
132 return -ENOMEM;
133 }
134
135 while (nbytes) {
136 /* fill pages with urandom bytes */
137 get_random_bytes(pg, 2*PAGE_SIZE);
138 /* exor pages with 1024 stckf values */
139 for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) {
140 u64 *p = ((u64 *)pg) + n;
141 *p ^= get_tod_clock_fast();
142 }
143 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
144 if (n < sizeof(hash))
145 h = hash;
146 else
147 h = ebuf;
148 /* hash over the filled pages */
149 cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE);
150 if (n < sizeof(hash))
151 memcpy(ebuf, hash, n);
152 ret += n;
153 ebuf += n;
154 nbytes -= n;
155 }
156
157 free_pages((unsigned long)pg, 1);
158 return ret;
159}
160
161
162/*** tdes functions ***/
163
164static void prng_tdes_add_entropy(void)
165{
166 __u64 entropy[4];
167 unsigned int i;
168
169 for (i = 0; i < 16; i++) {
170 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
171 (char *) entropy, (char *) entropy,
172 sizeof(entropy));
173 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
174 }
175}
176
177
178static void prng_tdes_seed(int nbytes)
179{
180 char buf[16];
181 int i = 0;
182
183 BUG_ON(nbytes > sizeof(buf));
184
185 get_random_bytes(buf, nbytes);
186
187 /* Add the entropy */
188 while (nbytes >= 8) {
189 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
190 prng_tdes_add_entropy();
191 i += 8;
192 nbytes -= 8;
193 }
194 prng_tdes_add_entropy();
195 prng_data->prngws.reseed_counter = 0;
196}
197
198
199static int __init prng_tdes_instantiate(void)
200{
201 int datalen;
202
203 pr_debug("prng runs in TDES mode with "
204 "chunksize=%d and reseed_limit=%u\n",
205 prng_chunk_size, prng_reseed_limit);
206
207 /* memory allocation, prng_data struct init, mutex init */
208 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
209 prng_data = kzalloc(datalen, GFP_KERNEL);
210 if (!prng_data) {
211 prng_errorflag = PRNG_INSTANTIATE_FAILED;
212 return -ENOMEM;
213 }
214 mutex_init(&prng_data->mutex);
215 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
216 memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
217
218 /* initialize the PRNG, add 128 bits of entropy */
219 prng_tdes_seed(16);
220
221 return 0;
222}
223
224
225static void prng_tdes_deinstantiate(void)
226{
227 pr_debug("The prng module stopped "
228 "after running in triple DES mode\n");
229 kzfree(prng_data);
230}
231
232
233/*** sha512 functions ***/
234
235static int __init prng_sha512_selftest(void)
236{
237 /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
238 static const u8 seed[] __initconst = {
239 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
240 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
241 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
242 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
243 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
244 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
245 static const u8 V0[] __initconst = {
246 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
247 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
248 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
249 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
250 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
251 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
252 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
253 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
254 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
255 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
256 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
257 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
258 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
259 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
260 static const u8 C0[] __initconst = {
261 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
262 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
263 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
264 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
265 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
266 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
267 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
268 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
269 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
270 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
271 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
272 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
273 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
274 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
275 static const u8 random[] __initconst = {
276 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
277 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
278 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
279 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
280 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
281 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
282 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
283 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
284 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
285 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
286 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
287 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
288 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
289 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
290 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
291 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
292 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
293 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
294 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
295 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
296 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
297 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
298 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
299 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
300 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
301 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
302 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
303 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
304 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
305 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
306 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
307 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
308
309 u8 buf[sizeof(random)];
310 struct prno_ws_s ws;
311
312 memset(&ws, 0, sizeof(ws));
313
314 /* initial seed */
315 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
316 &ws, NULL, 0, seed, sizeof(seed));
317
318 /* check working states V and C */
319 if (memcmp(ws.V, V0, sizeof(V0)) != 0
320 || memcmp(ws.C, C0, sizeof(C0)) != 0) {
321 pr_err("The prng self test state test "
322 "for the SHA-512 mode failed\n");
323 prng_errorflag = PRNG_SELFTEST_FAILED;
324 return -EIO;
325 }
326
327 /* generate random bytes */
328 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
329 &ws, buf, sizeof(buf), NULL, 0);
330 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
331 &ws, buf, sizeof(buf), NULL, 0);
332
333 /* check against expected data */
334 if (memcmp(buf, random, sizeof(random)) != 0) {
335 pr_err("The prng self test data test "
336 "for the SHA-512 mode failed\n");
337 prng_errorflag = PRNG_SELFTEST_FAILED;
338 return -EIO;
339 }
340
341 return 0;
342}
343
344
345static int __init prng_sha512_instantiate(void)
346{
347 int ret, datalen;
348 u8 seed[64 + 32 + 16];
349
350 pr_debug("prng runs in SHA-512 mode "
351 "with chunksize=%d and reseed_limit=%u\n",
352 prng_chunk_size, prng_reseed_limit);
353
354 /* memory allocation, prng_data struct init, mutex init */
355 datalen = sizeof(struct prng_data_s) + prng_chunk_size;
356 if (fips_enabled)
357 datalen += prng_chunk_size;
358 prng_data = kzalloc(datalen, GFP_KERNEL);
359 if (!prng_data) {
360 prng_errorflag = PRNG_INSTANTIATE_FAILED;
361 return -ENOMEM;
362 }
363 mutex_init(&prng_data->mutex);
364 prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
365
366 /* selftest */
367 ret = prng_sha512_selftest();
368 if (ret)
369 goto outfree;
370
371 /* generate initial seed bytestring, with 256 + 128 bits entropy */
372 ret = generate_entropy(seed, 64 + 32);
373 if (ret != 64 + 32)
374 goto outfree;
375 /* followed by 16 bytes of unique nonce */
376 get_tod_clock_ext(seed + 64 + 32);
377
378 /* initial seed of the prno drng */
379 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
380 &prng_data->prnows, NULL, 0, seed, sizeof(seed));
381
382 /* if fips mode is enabled, generate a first block of random
383 bytes for the FIPS 140-2 Conditional Self Test */
384 if (fips_enabled) {
385 prng_data->prev = prng_data->buf + prng_chunk_size;
386 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
387 &prng_data->prnows,
388 prng_data->prev, prng_chunk_size, NULL, 0);
389 }
390
391 return 0;
392
393outfree:
394 kfree(prng_data);
395 return ret;
396}
397
398
399static void prng_sha512_deinstantiate(void)
400{
401 pr_debug("The prng module stopped after running in SHA-512 mode\n");
402 kzfree(prng_data);
403}
404
405
406static int prng_sha512_reseed(void)
407{
408 int ret;
409 u8 seed[64];
410
411 /* fetch 256 bits of fresh entropy */
412 ret = generate_entropy(seed, sizeof(seed));
413 if (ret != sizeof(seed))
414 return ret;
415
416 /* do a reseed of the prno drng with this bytestring */
417 cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
418 &prng_data->prnows, NULL, 0, seed, sizeof(seed));
419
420 return 0;
421}
422
423
424static int prng_sha512_generate(u8 *buf, size_t nbytes)
425{
426 int ret;
427
428 /* reseed needed ? */
429 if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
430 ret = prng_sha512_reseed();
431 if (ret)
432 return ret;
433 }
434
435 /* PRNO generate */
436 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
437 &prng_data->prnows, buf, nbytes, NULL, 0);
438
439 /* FIPS 140-2 Conditional Self Test */
440 if (fips_enabled) {
441 if (!memcmp(prng_data->prev, buf, nbytes)) {
442 prng_errorflag = PRNG_GEN_FAILED;
443 return -EILSEQ;
444 }
445 memcpy(prng_data->prev, buf, nbytes);
446 }
447
448 return nbytes;
449}
450
451
452/*** file io functions ***/
453
454static int prng_open(struct inode *inode, struct file *file)
455{
456 return nonseekable_open(inode, file);
457}
458
459
460static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
461 size_t nbytes, loff_t *ppos)
462{
463 int chunk, n, ret = 0;
464
465 /* lock prng_data struct */
466 if (mutex_lock_interruptible(&prng_data->mutex))
467 return -ERESTARTSYS;
468
469 while (nbytes) {
470 if (need_resched()) {
471 if (signal_pending(current)) {
472 if (ret == 0)
473 ret = -ERESTARTSYS;
474 break;
475 }
476 /* give mutex free before calling schedule() */
477 mutex_unlock(&prng_data->mutex);
478 schedule();
479 /* occopy mutex again */
480 if (mutex_lock_interruptible(&prng_data->mutex)) {
481 if (ret == 0)
482 ret = -ERESTARTSYS;
483 return ret;
484 }
485 }
486
487 /*
488 * we lose some random bytes if an attacker issues
489 * reads < 8 bytes, but we don't care
490 */
491 chunk = min_t(int, nbytes, prng_chunk_size);
492
493 /* PRNG only likes multiples of 8 bytes */
494 n = (chunk + 7) & -8;
495
496 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
497 prng_tdes_seed(8);
498
499 /* if the CPU supports PRNG stckf is present too */
500 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
501
502 /*
503 * Beside the STCKF the input for the TDES-EDE is the output
504 * of the last operation. We differ here from X9.17 since we
505 * only store one timestamp into the buffer. Padding the whole
506 * buffer with timestamps does not improve security, since
507 * successive stckf have nearly constant offsets.
508 * If an attacker knows the first timestamp it would be
509 * trivial to guess the additional values. One timestamp
510 * is therefore enough and still guarantees unique input values.
511 *
512 * Note: you can still get strict X9.17 conformity by setting
513 * prng_chunk_size to 8 bytes.
514 */
515 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
516 prng_data->buf, prng_data->buf, n);
517
518 prng_data->prngws.byte_counter += n;
519 prng_data->prngws.reseed_counter += n;
520
521 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
522 ret = -EFAULT;
523 break;
524 }
525
526 nbytes -= chunk;
527 ret += chunk;
528 ubuf += chunk;
529 }
530
531 /* unlock prng_data struct */
532 mutex_unlock(&prng_data->mutex);
533
534 return ret;
535}
536
537
538static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
539 size_t nbytes, loff_t *ppos)
540{
541 int n, ret = 0;
542 u8 *p;
543
544 /* if errorflag is set do nothing and return 'broken pipe' */
545 if (prng_errorflag)
546 return -EPIPE;
547
548 /* lock prng_data struct */
549 if (mutex_lock_interruptible(&prng_data->mutex))
550 return -ERESTARTSYS;
551
552 while (nbytes) {
553 if (need_resched()) {
554 if (signal_pending(current)) {
555 if (ret == 0)
556 ret = -ERESTARTSYS;
557 break;
558 }
559 /* give mutex free before calling schedule() */
560 mutex_unlock(&prng_data->mutex);
561 schedule();
562 /* occopy mutex again */
563 if (mutex_lock_interruptible(&prng_data->mutex)) {
564 if (ret == 0)
565 ret = -ERESTARTSYS;
566 return ret;
567 }
568 }
569 if (prng_data->rest) {
570 /* push left over random bytes from the previous read */
571 p = prng_data->buf + prng_chunk_size - prng_data->rest;
572 n = (nbytes < prng_data->rest) ?
573 nbytes : prng_data->rest;
574 prng_data->rest -= n;
575 } else {
576 /* generate one chunk of random bytes into read buf */
577 p = prng_data->buf;
578 n = prng_sha512_generate(p, prng_chunk_size);
579 if (n < 0) {
580 ret = n;
581 break;
582 }
583 if (nbytes < prng_chunk_size) {
584 n = nbytes;
585 prng_data->rest = prng_chunk_size - n;
586 } else {
587 n = prng_chunk_size;
588 prng_data->rest = 0;
589 }
590 }
591 if (copy_to_user(ubuf, p, n)) {
592 ret = -EFAULT;
593 break;
594 }
595 ubuf += n;
596 nbytes -= n;
597 ret += n;
598 }
599
600 /* unlock prng_data struct */
601 mutex_unlock(&prng_data->mutex);
602
603 return ret;
604}
605
606
607/*** sysfs stuff ***/
608
609static const struct file_operations prng_sha512_fops = {
610 .owner = THIS_MODULE,
611 .open = &prng_open,
612 .release = NULL,
613 .read = &prng_sha512_read,
614 .llseek = noop_llseek,
615};
616static const struct file_operations prng_tdes_fops = {
617 .owner = THIS_MODULE,
618 .open = &prng_open,
619 .release = NULL,
620 .read = &prng_tdes_read,
621 .llseek = noop_llseek,
622};
623
624static struct miscdevice prng_sha512_dev = {
625 .name = "prandom",
626 .minor = MISC_DYNAMIC_MINOR,
627 .mode = 0644,
628 .fops = &prng_sha512_fops,
629};
630static struct miscdevice prng_tdes_dev = {
631 .name = "prandom",
632 .minor = MISC_DYNAMIC_MINOR,
633 .mode = 0644,
634 .fops = &prng_tdes_fops,
635};
636
637
638/* chunksize attribute (ro) */
639static ssize_t prng_chunksize_show(struct device *dev,
640 struct device_attribute *attr,
641 char *buf)
642{
643 return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
644}
645static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
646
647/* counter attribute (ro) */
648static ssize_t prng_counter_show(struct device *dev,
649 struct device_attribute *attr,
650 char *buf)
651{
652 u64 counter;
653
654 if (mutex_lock_interruptible(&prng_data->mutex))
655 return -ERESTARTSYS;
656 if (prng_mode == PRNG_MODE_SHA512)
657 counter = prng_data->prnows.stream_bytes;
658 else
659 counter = prng_data->prngws.byte_counter;
660 mutex_unlock(&prng_data->mutex);
661
662 return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
663}
664static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
665
666/* errorflag attribute (ro) */
667static ssize_t prng_errorflag_show(struct device *dev,
668 struct device_attribute *attr,
669 char *buf)
670{
671 return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
672}
673static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
674
675/* mode attribute (ro) */
676static ssize_t prng_mode_show(struct device *dev,
677 struct device_attribute *attr,
678 char *buf)
679{
680 if (prng_mode == PRNG_MODE_TDES)
681 return snprintf(buf, PAGE_SIZE, "TDES\n");
682 else
683 return snprintf(buf, PAGE_SIZE, "SHA512\n");
684}
685static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
686
687/* reseed attribute (w) */
688static ssize_t prng_reseed_store(struct device *dev,
689 struct device_attribute *attr,
690 const char *buf, size_t count)
691{
692 if (mutex_lock_interruptible(&prng_data->mutex))
693 return -ERESTARTSYS;
694 prng_sha512_reseed();
695 mutex_unlock(&prng_data->mutex);
696
697 return count;
698}
699static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
700
701/* reseed limit attribute (rw) */
702static ssize_t prng_reseed_limit_show(struct device *dev,
703 struct device_attribute *attr,
704 char *buf)
705{
706 return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
707}
708static ssize_t prng_reseed_limit_store(struct device *dev,
709 struct device_attribute *attr,
710 const char *buf, size_t count)
711{
712 unsigned limit;
713
714 if (sscanf(buf, "%u\n", &limit) != 1)
715 return -EINVAL;
716
717 if (prng_mode == PRNG_MODE_SHA512) {
718 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
719 return -EINVAL;
720 } else {
721 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
722 return -EINVAL;
723 }
724
725 prng_reseed_limit = limit;
726
727 return count;
728}
729static DEVICE_ATTR(reseed_limit, 0644,
730 prng_reseed_limit_show, prng_reseed_limit_store);
731
732/* strength attribute (ro) */
733static ssize_t prng_strength_show(struct device *dev,
734 struct device_attribute *attr,
735 char *buf)
736{
737 return snprintf(buf, PAGE_SIZE, "256\n");
738}
739static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
740
741static struct attribute *prng_sha512_dev_attrs[] = {
742 &dev_attr_errorflag.attr,
743 &dev_attr_chunksize.attr,
744 &dev_attr_byte_counter.attr,
745 &dev_attr_mode.attr,
746 &dev_attr_reseed.attr,
747 &dev_attr_reseed_limit.attr,
748 &dev_attr_strength.attr,
749 NULL
750};
751static struct attribute *prng_tdes_dev_attrs[] = {
752 &dev_attr_chunksize.attr,
753 &dev_attr_byte_counter.attr,
754 &dev_attr_mode.attr,
755 NULL
756};
757
758static struct attribute_group prng_sha512_dev_attr_group = {
759 .attrs = prng_sha512_dev_attrs
760};
761static struct attribute_group prng_tdes_dev_attr_group = {
762 .attrs = prng_tdes_dev_attrs
763};
764
765
766/*** module init and exit ***/
767
768static int __init prng_init(void)
769{
770 int ret;
771
772 /* check if the CPU has a PRNG */
773 if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
774 return -EOPNOTSUPP;
775
776 /* choose prng mode */
777 if (prng_mode != PRNG_MODE_TDES) {
778 /* check for MSA5 support for PRNO operations */
779 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
780 if (prng_mode == PRNG_MODE_SHA512) {
781 pr_err("The prng module cannot "
782 "start in SHA-512 mode\n");
783 return -EOPNOTSUPP;
784 }
785 prng_mode = PRNG_MODE_TDES;
786 } else
787 prng_mode = PRNG_MODE_SHA512;
788 }
789
790 if (prng_mode == PRNG_MODE_SHA512) {
791
792 /* SHA512 mode */
793
794 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
795 || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
796 return -EINVAL;
797 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
798
799 if (prng_reseed_limit == 0)
800 prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
801 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
802 return -EINVAL;
803
804 ret = prng_sha512_instantiate();
805 if (ret)
806 goto out;
807
808 ret = misc_register(&prng_sha512_dev);
809 if (ret) {
810 prng_sha512_deinstantiate();
811 goto out;
812 }
813 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
814 &prng_sha512_dev_attr_group);
815 if (ret) {
816 misc_deregister(&prng_sha512_dev);
817 prng_sha512_deinstantiate();
818 goto out;
819 }
820
821 } else {
822
823 /* TDES mode */
824
825 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
826 || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
827 return -EINVAL;
828 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
829
830 if (prng_reseed_limit == 0)
831 prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
832 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
833 return -EINVAL;
834
835 ret = prng_tdes_instantiate();
836 if (ret)
837 goto out;
838
839 ret = misc_register(&prng_tdes_dev);
840 if (ret) {
841 prng_tdes_deinstantiate();
842 goto out;
843 }
844 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
845 &prng_tdes_dev_attr_group);
846 if (ret) {
847 misc_deregister(&prng_tdes_dev);
848 prng_tdes_deinstantiate();
849 goto out;
850 }
851
852 }
853
854out:
855 return ret;
856}
857
858
859static void __exit prng_exit(void)
860{
861 if (prng_mode == PRNG_MODE_SHA512) {
862 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
863 &prng_sha512_dev_attr_group);
864 misc_deregister(&prng_sha512_dev);
865 prng_sha512_deinstantiate();
866 } else {
867 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
868 &prng_tdes_dev_attr_group);
869 misc_deregister(&prng_tdes_dev);
870 prng_tdes_deinstantiate();
871 }
872}
873
874module_cpu_feature_match(MSA, prng_init);
875module_exit(prng_exit);