arch/s390/crypto/prng.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright IBM Corp. 2006, 2015
   4  * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
   5  *            Harald Freudenberger <freude@de.ibm.com>
   6  * Driver for the s390 pseudo random number generator
   7  */
   8
   9 #define KMSG_COMPONENT "prng"
  10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  11
  12 #include <linux/fs.h>
  13 #include <linux/fips.h>
  14 #include <linux/init.h>
  15 #include <linux/kernel.h>
  16 #include <linux/device.h>
  17 #include <linux/miscdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/moduleparam.h>
  20 #include <linux/mutex.h>
  21 #include <linux/cpufeature.h>
  22 #include <linux/random.h>
  23 #include <linux/slab.h>
  24 #include <linux/sched/signal.h>
  25
  26 #include <asm/debug.h>
  27 #include <linux/uaccess.h>
  28 #include <asm/timex.h>
  29 #include <asm/cpacf.h>
  30
  31 MODULE_LICENSE("GPL");
  32 MODULE_AUTHOR("IBM Corporation");
  33 MODULE_DESCRIPTION("s390 PRNG interface");
  34
  35
  36 #define PRNG_MODE_AUTO    0
  37 #define PRNG_MODE_TDES    1
  38 #define PRNG_MODE_SHA512  2
  39
  40 static unsigned int prng_mode = PRNG_MODE_AUTO;
  41 module_param_named(mode, prng_mode, int, 0);
  42 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
  43
  44
  45 #define PRNG_CHUNKSIZE_TDES_MIN   8
  46 #define PRNG_CHUNKSIZE_TDES_MAX   (64*1024)
  47 #define PRNG_CHUNKSIZE_SHA512_MIN 64
  48 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
  49
  50 static unsigned int prng_chunk_size = 256;
  51 module_param_named(chunksize, prng_chunk_size, int, 0);
  52 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
  53
  54
  55 #define PRNG_RESEED_LIMIT_TDES           4096
  56 #define PRNG_RESEED_LIMIT_TDES_LOWER     4096
  57 #define PRNG_RESEED_LIMIT_SHA512       100000
  58 #define PRNG_RESEED_LIMIT_SHA512_LOWER  10000
  59
  60 static unsigned int prng_reseed_limit;
  61 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
  62 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
  63
  64
  65 /*
  66  * Any one who considers arithmetical methods of producing random digits is,
  67  * of course, in a state of sin. -- John von Neumann
  68  */
  69
  70 static int prng_errorflag;
  71
  72 #define PRNG_GEN_ENTROPY_FAILED  1
  73 #define PRNG_SELFTEST_FAILED     2
  74 #define PRNG_INSTANTIATE_FAILED  3
  75 #define PRNG_SEED_FAILED         4
  76 #define PRNG_RESEED_FAILED       5
  77 #define PRNG_GEN_FAILED          6
  78
  79 struct prng_ws_s {
  80         u8  parm_block[32];
  81         u32 reseed_counter;
  82         u64 byte_counter;
  83 };
  84
  85 struct prno_ws_s {
  86         u32 res;
  87         u32 reseed_counter;
  88         u64 stream_bytes;
  89         u8  V[112];
  90         u8  C[112];
  91 };
  92
  93 struct prng_data_s {
  94         struct mutex mutex;
  95         union {
  96                 struct prng_ws_s prngws;
  97                 struct prno_ws_s prnows;
  98         };
  99         u8 *buf;
 100         u32 rest;
 101         u8 *prev;
 102 };
 103
 104 static struct prng_data_s *prng_data;
 105
 106 /* initial parameter block for tdes mode, copied from libica */
 107 static const u8 initial_parm_block[32] __initconst = {
 108         0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
 109         0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
 110         0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
 111         0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
 112
 113
 114 /*** helper functions ***/
 115
 116 /*
 117  * generate_entropy:
 118  * This algorithm produces 64 bytes of entropy data based on 1024
 119  * individual stckf() invocations assuming that each stckf() value
 120  * contributes 0.25 bits of entropy. So the caller gets 256 bit
 121  * entropy per 64 byte or 4 bits entropy per byte.
 122  */
 123 static int generate_entropy(u8 *ebuf, size_t nbytes)
 124 {
 125         int n, ret = 0;
 126         u8 *pg, *h, hash[64];
 127
 128         /* allocate 2 pages */
 129         pg = (u8 *) __get_free_pages(GFP_KERNEL, 1);
 130         if (!pg) {
 131                 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
 132                 return -ENOMEM;
 133         }
 134
 135         while (nbytes) {
 136                 /* fill pages with urandom bytes */
 137                 get_random_bytes(pg, 2*PAGE_SIZE);
 138                 /* exor pages with 1024 stckf values */
 139                 for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) {
 140                         u64 *p = ((u64 *)pg) + n;
 141                         *p ^= get_tod_clock_fast();
 142                 }
 143                 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
 144                 if (n < sizeof(hash))
 145                         h = hash;
 146                 else
 147                         h = ebuf;
 148                 /* hash over the filled pages */
 149                 cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE);
 150                 if (n < sizeof(hash))
 151                         memcpy(ebuf, hash, n);
 152                 ret += n;
 153                 ebuf += n;
 154                 nbytes -= n;
 155         }
 156
 157         free_pages((unsigned long)pg, 1);
 158         return ret;
 159 }
 160
 161
 162 /*** tdes functions ***/
 163
 164 static void prng_tdes_add_entropy(void)
 165 {
 166         __u64 entropy[4];
 167         unsigned int i;
 168
 169         for (i = 0; i < 16; i++) {
 170                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 171                           (char *) entropy, (char *) entropy,
 172                           sizeof(entropy));
 173                 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
 174         }
 175 }
 176
 177
 178 static void prng_tdes_seed(int nbytes)
 179 {
 180         char buf[16];
 181         int i = 0;
 182
 183         BUG_ON(nbytes > sizeof(buf));
 184
 185         get_random_bytes(buf, nbytes);
 186
 187         /* Add the entropy */
 188         while (nbytes >= 8) {
 189                 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
 190                 prng_tdes_add_entropy();
 191                 i += 8;
 192                 nbytes -= 8;
 193         }
 194         prng_tdes_add_entropy();
 195         prng_data->prngws.reseed_counter = 0;
 196 }
 197
 198
 199 static int __init prng_tdes_instantiate(void)
 200 {
 201         int datalen;
 202
 203         pr_debug("prng runs in TDES mode with "
 204                  "chunksize=%d and reseed_limit=%u\n",
 205                  prng_chunk_size, prng_reseed_limit);
 206
 207         /* memory allocation, prng_data struct init, mutex init */
 208         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 209         prng_data = kzalloc(datalen, GFP_KERNEL);
 210         if (!prng_data) {
 211                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 212                 return -ENOMEM;
 213         }
 214         mutex_init(&prng_data->mutex);
 215         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 216         memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
 217
 218         /* initialize the PRNG, add 128 bits of entropy */
 219         prng_tdes_seed(16);
 220
 221         return 0;
 222 }
 223
 224
 225 static void prng_tdes_deinstantiate(void)
 226 {
 227         pr_debug("The prng module stopped "
 228                  "after running in triple DES mode\n");
 229         kzfree(prng_data);
 230 }
 231
 232
 233 /*** sha512 functions ***/
 234
 235 static int __init prng_sha512_selftest(void)
 236 {
 237         /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
 238         static const u8 seed[] __initconst = {
 239                 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
 240                 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
 241                 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
 242                 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
 243                 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
 244                 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
 245         static const u8 V0[] __initconst = {
 246                 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
 247                 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
 248                 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
 249                 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
 250                 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
 251                 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
 252                 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
 253                 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
 254                 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
 255                 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
 256                 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
 257                 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
 258                 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
 259                 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
 260         static const u8 C0[] __initconst = {
 261                 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
 262                 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
 263                 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
 264                 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
 265                 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
 266                 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
 267                 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
 268                 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
 269                 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
 270                 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
 271                 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
 272                 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
 273                 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
 274                 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
 275         static const u8 random[] __initconst = {
 276                 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
 277                 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
 278                 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
 279                 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
 280                 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
 281                 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
 282                 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
 283                 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
 284                 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
 285                 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
 286                 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
 287                 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
 288                 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
 289                 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
 290                 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
 291                 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
 292                 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
 293                 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
 294                 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
 295                 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
 296                 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
 297                 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
 298                 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
 299                 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
 300                 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
 301                 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
 302                 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
 303                 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
 304                 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
 305                 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
 306                 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
 307                 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
 308
 309         u8 buf[sizeof(random)];
 310         struct prno_ws_s ws;
 311
 312         memset(&ws, 0, sizeof(ws));
 313
 314         /* initial seed */
 315         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 316                    &ws, NULL, 0, seed, sizeof(seed));
 317
 318         /* check working states V and C */
 319         if (memcmp(ws.V, V0, sizeof(V0)) != 0
 320             || memcmp(ws.C, C0, sizeof(C0)) != 0) {
 321                 pr_err("The prng self test state test "
 322                        "for the SHA-512 mode failed\n");
 323                 prng_errorflag = PRNG_SELFTEST_FAILED;
 324                 return -EIO;
 325         }
 326
 327         /* generate random bytes */
 328         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 329                    &ws, buf, sizeof(buf), NULL, 0);
 330         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 331                    &ws, buf, sizeof(buf), NULL, 0);
 332
 333         /* check against expected data */
 334         if (memcmp(buf, random, sizeof(random)) != 0) {
 335                 pr_err("The prng self test data test "
 336                        "for the SHA-512 mode failed\n");
 337                 prng_errorflag = PRNG_SELFTEST_FAILED;
 338                 return -EIO;
 339         }
 340
 341         return 0;
 342 }
 343
 344
 345 static int __init prng_sha512_instantiate(void)
 346 {
 347         int ret, datalen;
 348         u8 seed[64 + 32 + 16];
 349
 350         pr_debug("prng runs in SHA-512 mode "
 351                  "with chunksize=%d and reseed_limit=%u\n",
 352                  prng_chunk_size, prng_reseed_limit);
 353
 354         /* memory allocation, prng_data struct init, mutex init */
 355         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 356         if (fips_enabled)
 357                 datalen += prng_chunk_size;
 358         prng_data = kzalloc(datalen, GFP_KERNEL);
 359         if (!prng_data) {
 360                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 361                 return -ENOMEM;
 362         }
 363         mutex_init(&prng_data->mutex);
 364         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 365
 366         /* selftest */
 367         ret = prng_sha512_selftest();
 368         if (ret)
 369                 goto outfree;
 370
 371         /* generate initial seed bytestring, with 256 + 128 bits entropy */
 372         ret = generate_entropy(seed, 64 + 32);
 373         if (ret != 64 + 32)
 374                 goto outfree;
 375         /* followed by 16 bytes of unique nonce */
 376         get_tod_clock_ext(seed + 64 + 32);
 377
 378         /* initial seed of the prno drng */
 379         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 380                    &prng_data->prnows, NULL, 0, seed, sizeof(seed));
 381
 382         /* if fips mode is enabled, generate a first block of random
 383            bytes for the FIPS 140-2 Conditional Self Test */
 384         if (fips_enabled) {
 385                 prng_data->prev = prng_data->buf + prng_chunk_size;
 386                 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 387                            &prng_data->prnows,
 388                            prng_data->prev, prng_chunk_size, NULL, 0);
 389         }
 390
 391         return 0;
 392
 393 outfree:
 394         kfree(prng_data);
 395         return ret;
 396 }
 397
 398
 399 static void prng_sha512_deinstantiate(void)
 400 {
 401         pr_debug("The prng module stopped after running in SHA-512 mode\n");
 402         kzfree(prng_data);
 403 }
 404
 405
 406 static int prng_sha512_reseed(void)
 407 {
 408         int ret;
 409         u8 seed[64];
 410
 411         /* fetch 256 bits of fresh entropy */
 412         ret = generate_entropy(seed, sizeof(seed));
 413         if (ret != sizeof(seed))
 414                 return ret;
 415
 416         /* do a reseed of the prno drng with this bytestring */
 417         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 418                    &prng_data->prnows, NULL, 0, seed, sizeof(seed));
 419
 420         return 0;
 421 }
 422
 423
 424 static int prng_sha512_generate(u8 *buf, size_t nbytes)
 425 {
 426         int ret;
 427
 428         /* reseed needed ? */
 429         if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
 430                 ret = prng_sha512_reseed();
 431                 if (ret)
 432                         return ret;
 433         }
 434
 435         /* PRNO generate */
 436         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 437                    &prng_data->prnows, buf, nbytes, NULL, 0);
 438
 439         /* FIPS 140-2 Conditional Self Test */
 440         if (fips_enabled) {
 441                 if (!memcmp(prng_data->prev, buf, nbytes)) {
 442                         prng_errorflag = PRNG_GEN_FAILED;
 443                         return -EILSEQ;
 444                 }
 445                 memcpy(prng_data->prev, buf, nbytes);
 446         }
 447
 448         return nbytes;
 449 }
 450
 451
 452 /*** file io functions ***/
 453
 454 static int prng_open(struct inode *inode, struct file *file)
 455 {
 456         return nonseekable_open(inode, file);
 457 }
 458
 459
 460 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
 461                               size_t nbytes, loff_t *ppos)
 462 {
 463         int chunk, n, ret = 0;
 464
 465         /* lock prng_data struct */
 466         if (mutex_lock_interruptible(&prng_data->mutex))
 467                 return -ERESTARTSYS;
 468
 469         while (nbytes) {
 470                 if (need_resched()) {
 471                         if (signal_pending(current)) {
 472                                 if (ret == 0)
 473                                         ret = -ERESTARTSYS;
 474                                 break;
 475                         }
 476                         /* give mutex free before calling schedule() */
 477                         mutex_unlock(&prng_data->mutex);
 478                         schedule();
 479                         /* occopy mutex again */
 480                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 481                                 if (ret == 0)
 482                                         ret = -ERESTARTSYS;
 483                                 return ret;
 484                         }
 485                 }
 486
 487                 /*
 488                  * we lose some random bytes if an attacker issues
 489                  * reads < 8 bytes, but we don't care
 490                  */
 491                 chunk = min_t(int, nbytes, prng_chunk_size);
 492
 493                 /* PRNG only likes multiples of 8 bytes */
 494                 n = (chunk + 7) & -8;
 495
 496                 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
 497                         prng_tdes_seed(8);
 498
 499                 /* if the CPU supports PRNG stckf is present too */
 500                 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
 501
 502                 /*
 503                  * Beside the STCKF the input for the TDES-EDE is the output
 504                  * of the last operation. We differ here from X9.17 since we
 505                  * only store one timestamp into the buffer. Padding the whole
 506                  * buffer with timestamps does not improve security, since
 507                  * successive stckf have nearly constant offsets.
 508                  * If an attacker knows the first timestamp it would be
 509                  * trivial to guess the additional values. One timestamp
 510                  * is therefore enough and still guarantees unique input values.
 511                  *
 512                  * Note: you can still get strict X9.17 conformity by setting
 513                  * prng_chunk_size to 8 bytes.
 514                  */
 515                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 516                           prng_data->buf, prng_data->buf, n);
 517
 518                 prng_data->prngws.byte_counter += n;
 519                 prng_data->prngws.reseed_counter += n;
 520
 521                 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
 522                         ret = -EFAULT;
 523                         break;
 524                 }
 525
 526                 nbytes -= chunk;
 527                 ret += chunk;
 528                 ubuf += chunk;
 529         }
 530
 531         /* unlock prng_data struct */
 532         mutex_unlock(&prng_data->mutex);
 533
 534         return ret;
 535 }
 536
 537
 538 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
 539                                 size_t nbytes, loff_t *ppos)
 540 {
 541         int n, ret = 0;
 542         u8 *p;
 543
 544         /* if errorflag is set do nothing and return 'broken pipe' */
 545         if (prng_errorflag)
 546                 return -EPIPE;
 547
 548         /* lock prng_data struct */
 549         if (mutex_lock_interruptible(&prng_data->mutex))
 550                 return -ERESTARTSYS;
 551
 552         while (nbytes) {
 553                 if (need_resched()) {
 554                         if (signal_pending(current)) {
 555                                 if (ret == 0)
 556                                         ret = -ERESTARTSYS;
 557                                 break;
 558                         }
 559                         /* give mutex free before calling schedule() */
 560                         mutex_unlock(&prng_data->mutex);
 561                         schedule();
 562                         /* occopy mutex again */
 563                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 564                                 if (ret == 0)
 565                                         ret = -ERESTARTSYS;
 566                                 return ret;
 567                         }
 568                 }
 569                 if (prng_data->rest) {
 570                         /* push left over random bytes from the previous read */
 571                         p = prng_data->buf + prng_chunk_size - prng_data->rest;
 572                         n = (nbytes < prng_data->rest) ?
 573                                 nbytes : prng_data->rest;
 574                         prng_data->rest -= n;
 575                 } else {
 576                         /* generate one chunk of random bytes into read buf */
 577                         p = prng_data->buf;
 578                         n = prng_sha512_generate(p, prng_chunk_size);
 579                         if (n < 0) {
 580                                 ret = n;
 581                                 break;
 582                         }
 583                         if (nbytes < prng_chunk_size) {
 584                                 n = nbytes;
 585                                 prng_data->rest = prng_chunk_size - n;
 586                         } else {
 587                                 n = prng_chunk_size;
 588                                 prng_data->rest = 0;
 589                         }
 590                 }
 591                 if (copy_to_user(ubuf, p, n)) {
 592                         ret = -EFAULT;
 593                         break;
 594                 }
 595                 ubuf += n;
 596                 nbytes -= n;
 597                 ret += n;
 598         }
 599
 600         /* unlock prng_data struct */
 601         mutex_unlock(&prng_data->mutex);
 602
 603         return ret;
 604 }
 605
 606
 607 /*** sysfs stuff ***/
 608
 609 static const struct file_operations prng_sha512_fops = {
 610         .owner          = THIS_MODULE,
 611         .open           = &prng_open,
 612         .release        = NULL,
 613         .read           = &prng_sha512_read,
 614         .llseek         = noop_llseek,
 615 };
 616 static const struct file_operations prng_tdes_fops = {
 617         .owner          = THIS_MODULE,
 618         .open           = &prng_open,
 619         .release        = NULL,
 620         .read           = &prng_tdes_read,
 621         .llseek         = noop_llseek,
 622 };
 623
 624 static struct miscdevice prng_sha512_dev = {
 625         .name   = "prandom",
 626         .minor  = MISC_DYNAMIC_MINOR,
 627         .mode   = 0644,
 628         .fops   = &prng_sha512_fops,
 629 };
 630 static struct miscdevice prng_tdes_dev = {
 631         .name   = "prandom",
 632         .minor  = MISC_DYNAMIC_MINOR,
 633         .mode   = 0644,
 634         .fops   = &prng_tdes_fops,
 635 };
 636
 637
 638 /* chunksize attribute (ro) */
 639 static ssize_t prng_chunksize_show(struct device *dev,
 640                                    struct device_attribute *attr,
 641                                    char *buf)
 642 {
 643         return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
 644 }
 645 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
 646
 647 /* counter attribute (ro) */
 648 static ssize_t prng_counter_show(struct device *dev,
 649                                  struct device_attribute *attr,
 650                                  char *buf)
 651 {
 652         u64 counter;
 653
 654         if (mutex_lock_interruptible(&prng_data->mutex))
 655                 return -ERESTARTSYS;
 656         if (prng_mode == PRNG_MODE_SHA512)
 657                 counter = prng_data->prnows.stream_bytes;
 658         else
 659                 counter = prng_data->prngws.byte_counter;
 660         mutex_unlock(&prng_data->mutex);
 661
 662         return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
 663 }
 664 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
 665
 666 /* errorflag attribute (ro) */
 667 static ssize_t prng_errorflag_show(struct device *dev,
 668                                    struct device_attribute *attr,
 669                                    char *buf)
 670 {
 671         return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
 672 }
 673 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
 674
 675 /* mode attribute (ro) */
 676 static ssize_t prng_mode_show(struct device *dev,
 677                               struct device_attribute *attr,
 678                               char *buf)
 679 {
 680         if (prng_mode == PRNG_MODE_TDES)
 681                 return snprintf(buf, PAGE_SIZE, "TDES\n");
 682         else
 683                 return snprintf(buf, PAGE_SIZE, "SHA512\n");
 684 }
 685 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
 686
 687 /* reseed attribute (w) */
 688 static ssize_t prng_reseed_store(struct device *dev,
 689                                  struct device_attribute *attr,
 690                                  const char *buf, size_t count)
 691 {
 692         if (mutex_lock_interruptible(&prng_data->mutex))
 693                 return -ERESTARTSYS;
 694         prng_sha512_reseed();
 695         mutex_unlock(&prng_data->mutex);
 696
 697         return count;
 698 }
 699 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
 700
 701 /* reseed limit attribute (rw) */
 702 static ssize_t prng_reseed_limit_show(struct device *dev,
 703                                       struct device_attribute *attr,
 704                                       char *buf)
 705 {
 706         return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
 707 }
 708 static ssize_t prng_reseed_limit_store(struct device *dev,
 709                                        struct device_attribute *attr,
 710                                        const char *buf, size_t count)
 711 {
 712         unsigned limit;
 713
 714         if (sscanf(buf, "%u\n", &limit) != 1)
 715                 return -EINVAL;
 716
 717         if (prng_mode == PRNG_MODE_SHA512) {
 718                 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 719                         return -EINVAL;
 720         } else {
 721                 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 722                         return -EINVAL;
 723         }
 724
 725         prng_reseed_limit = limit;
 726
 727         return count;
 728 }
 729 static DEVICE_ATTR(reseed_limit, 0644,
 730                    prng_reseed_limit_show, prng_reseed_limit_store);
 731
 732 /* strength attribute (ro) */
 733 static ssize_t prng_strength_show(struct device *dev,
 734                                   struct device_attribute *attr,
 735                                   char *buf)
 736 {
 737         return snprintf(buf, PAGE_SIZE, "256\n");
 738 }
 739 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
 740
 741 static struct attribute *prng_sha512_dev_attrs[] = {
 742         &dev_attr_errorflag.attr,
 743         &dev_attr_chunksize.attr,
 744         &dev_attr_byte_counter.attr,
 745         &dev_attr_mode.attr,
 746         &dev_attr_reseed.attr,
 747         &dev_attr_reseed_limit.attr,
 748         &dev_attr_strength.attr,
 749         NULL
 750 };
 751 static struct attribute *prng_tdes_dev_attrs[] = {
 752         &dev_attr_chunksize.attr,
 753         &dev_attr_byte_counter.attr,
 754         &dev_attr_mode.attr,
 755         NULL
 756 };
 757
 758 static struct attribute_group prng_sha512_dev_attr_group = {
 759         .attrs = prng_sha512_dev_attrs
 760 };
 761 static struct attribute_group prng_tdes_dev_attr_group = {
 762         .attrs = prng_tdes_dev_attrs
 763 };
 764
 765
 766 /*** module init and exit ***/
 767
 768 static int __init prng_init(void)
 769 {
 770         int ret;
 771
 772         /* check if the CPU has a PRNG */
 773         if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
 774                 return -EOPNOTSUPP;
 775
 776         /* choose prng mode */
 777         if (prng_mode != PRNG_MODE_TDES) {
 778                 /* check for MSA5 support for PRNO operations */
 779                 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
 780                         if (prng_mode == PRNG_MODE_SHA512) {
 781                                 pr_err("The prng module cannot "
 782                                        "start in SHA-512 mode\n");
 783                                 return -EOPNOTSUPP;
 784                         }
 785                         prng_mode = PRNG_MODE_TDES;
 786                 } else
 787                         prng_mode = PRNG_MODE_SHA512;
 788         }
 789
 790         if (prng_mode == PRNG_MODE_SHA512) {
 791
 792                 /* SHA512 mode */
 793
 794                 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
 795                     || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
 796                         return -EINVAL;
 797                 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
 798
 799                 if (prng_reseed_limit == 0)
 800                         prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
 801                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 802                         return -EINVAL;
 803
 804                 ret = prng_sha512_instantiate();
 805                 if (ret)
 806                         goto out;
 807
 808                 ret = misc_register(&prng_sha512_dev);
 809                 if (ret) {
 810                         prng_sha512_deinstantiate();
 811                         goto out;
 812                 }
 813                 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
 814                                          &prng_sha512_dev_attr_group);
 815                 if (ret) {
 816                         misc_deregister(&prng_sha512_dev);
 817                         prng_sha512_deinstantiate();
 818                         goto out;
 819                 }
 820
 821         } else {
 822
 823                 /* TDES mode */
 824
 825                 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
 826                     || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
 827                         return -EINVAL;
 828                 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
 829
 830                 if (prng_reseed_limit == 0)
 831                         prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
 832                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 833                         return -EINVAL;
 834
 835                 ret = prng_tdes_instantiate();
 836                 if (ret)
 837                         goto out;
 838
 839                 ret = misc_register(&prng_tdes_dev);
 840                 if (ret) {
 841                         prng_tdes_deinstantiate();
 842                         goto out;
 843                 }
 844                 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
 845                                          &prng_tdes_dev_attr_group);
 846                 if (ret) {
 847                         misc_deregister(&prng_tdes_dev);
 848                         prng_tdes_deinstantiate();
 849                         goto out;
 850                 }
 851
 852         }
 853
 854 out:
 855         return ret;
 856 }
 857
 858
 859 static void __exit prng_exit(void)
 860 {
 861         if (prng_mode == PRNG_MODE_SHA512) {
 862                 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
 863                                    &prng_sha512_dev_attr_group);
 864                 misc_deregister(&prng_sha512_dev);
 865                 prng_sha512_deinstantiate();
 866         } else {
 867                 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
 868                                    &prng_tdes_dev_attr_group);
 869                 misc_deregister(&prng_tdes_dev);
 870                 prng_tdes_deinstantiate();
 871         }
 872 }
 873
 874 module_cpu_feature_match(MSA, prng_init);
 875 module_exit(prng_exit);