arch/s390/crypto/prng.c

   1 /*
   2  * Copyright IBM Corp. 2006, 2015
   3  * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
   4  *            Harald Freudenberger <freude@de.ibm.com>
   5  * Driver for the s390 pseudo random number generator
   6  */
   7
   8 #define KMSG_COMPONENT "prng"
   9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  10
  11 #include <linux/fs.h>
  12 #include <linux/fips.h>
  13 #include <linux/init.h>
  14 #include <linux/kernel.h>
  15 #include <linux/device.h>
  16 #include <linux/miscdevice.h>
  17 #include <linux/module.h>
  18 #include <linux/moduleparam.h>
  19 #include <linux/mutex.h>
  20 #include <linux/cpufeature.h>
  21 #include <linux/random.h>
  22 #include <linux/slab.h>
  23 #include <linux/sched/signal.h>
  24
  25 #include <asm/debug.h>
  26 #include <linux/uaccess.h>
  27 #include <asm/timex.h>
  28 #include <asm/cpacf.h>
  29
  30 MODULE_LICENSE("GPL");
  31 MODULE_AUTHOR("IBM Corporation");
  32 MODULE_DESCRIPTION("s390 PRNG interface");
  33
  34
  35 #define PRNG_MODE_AUTO    0
  36 #define PRNG_MODE_TDES    1
  37 #define PRNG_MODE_SHA512  2
  38
  39 static unsigned int prng_mode = PRNG_MODE_AUTO;
  40 module_param_named(mode, prng_mode, int, 0);
  41 MODULE_PARM_DESC(prng_mode, "PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512");
  42
  43
  44 #define PRNG_CHUNKSIZE_TDES_MIN   8
  45 #define PRNG_CHUNKSIZE_TDES_MAX   (64*1024)
  46 #define PRNG_CHUNKSIZE_SHA512_MIN 64
  47 #define PRNG_CHUNKSIZE_SHA512_MAX (64*1024)
  48
  49 static unsigned int prng_chunk_size = 256;
  50 module_param_named(chunksize, prng_chunk_size, int, 0);
  51 MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
  52
  53
  54 #define PRNG_RESEED_LIMIT_TDES           4096
  55 #define PRNG_RESEED_LIMIT_TDES_LOWER     4096
  56 #define PRNG_RESEED_LIMIT_SHA512       100000
  57 #define PRNG_RESEED_LIMIT_SHA512_LOWER  10000
  58
  59 static unsigned int prng_reseed_limit;
  60 module_param_named(reseed_limit, prng_reseed_limit, int, 0);
  61 MODULE_PARM_DESC(prng_reseed_limit, "PRNG reseed limit");
  62
  63
  64 /*
  65  * Any one who considers arithmetical methods of producing random digits is,
  66  * of course, in a state of sin. -- John von Neumann
  67  */
  68
  69 static int prng_errorflag;
  70
  71 #define PRNG_GEN_ENTROPY_FAILED  1
  72 #define PRNG_SELFTEST_FAILED     2
  73 #define PRNG_INSTANTIATE_FAILED  3
  74 #define PRNG_SEED_FAILED         4
  75 #define PRNG_RESEED_FAILED       5
  76 #define PRNG_GEN_FAILED          6
  77
  78 struct prng_ws_s {
  79         u8  parm_block[32];
  80         u32 reseed_counter;
  81         u64 byte_counter;
  82 };
  83
  84 struct prno_ws_s {
  85         u32 res;
  86         u32 reseed_counter;
  87         u64 stream_bytes;
  88         u8  V[112];
  89         u8  C[112];
  90 };
  91
  92 struct prng_data_s {
  93         struct mutex mutex;
  94         union {
  95                 struct prng_ws_s prngws;
  96                 struct prno_ws_s prnows;
  97         };
  98         u8 *buf;
  99         u32 rest;
 100         u8 *prev;
 101 };
 102
 103 static struct prng_data_s *prng_data;
 104
 105 /* initial parameter block for tdes mode, copied from libica */
 106 static const u8 initial_parm_block[32] __initconst = {
 107         0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
 108         0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
 109         0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
 110         0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0 };
 111
 112
 113 /*** helper functions ***/
 114
 115 /*
 116  * generate_entropy:
 117  * This algorithm produces 64 bytes of entropy data based on 1024
 118  * individual stckf() invocations assuming that each stckf() value
 119  * contributes 0.25 bits of entropy. So the caller gets 256 bit
 120  * entropy per 64 byte or 4 bits entropy per byte.
 121  */
 122 static int generate_entropy(u8 *ebuf, size_t nbytes)
 123 {
 124         int n, ret = 0;
 125         u8 *pg, *h, hash[64];
 126
 127         /* allocate 2 pages */
 128         pg = (u8 *) __get_free_pages(GFP_KERNEL, 1);
 129         if (!pg) {
 130                 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
 131                 return -ENOMEM;
 132         }
 133
 134         while (nbytes) {
 135                 /* fill pages with urandom bytes */
 136                 get_random_bytes(pg, 2*PAGE_SIZE);
 137                 /* exor pages with 1024 stckf values */
 138                 for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) {
 139                         u64 *p = ((u64 *)pg) + n;
 140                         *p ^= get_tod_clock_fast();
 141                 }
 142                 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
 143                 if (n < sizeof(hash))
 144                         h = hash;
 145                 else
 146                         h = ebuf;
 147                 /* hash over the filled pages */
 148                 cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE);
 149                 if (n < sizeof(hash))
 150                         memcpy(ebuf, hash, n);
 151                 ret += n;
 152                 ebuf += n;
 153                 nbytes -= n;
 154         }
 155
 156         free_pages((unsigned long)pg, 1);
 157         return ret;
 158 }
 159
 160
 161 /*** tdes functions ***/
 162
 163 static void prng_tdes_add_entropy(void)
 164 {
 165         __u64 entropy[4];
 166         unsigned int i;
 167
 168         for (i = 0; i < 16; i++) {
 169                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 170                           (char *) entropy, (char *) entropy,
 171                           sizeof(entropy));
 172                 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
 173         }
 174 }
 175
 176
 177 static void prng_tdes_seed(int nbytes)
 178 {
 179         char buf[16];
 180         int i = 0;
 181
 182         BUG_ON(nbytes > sizeof(buf));
 183
 184         get_random_bytes(buf, nbytes);
 185
 186         /* Add the entropy */
 187         while (nbytes >= 8) {
 188                 *((__u64 *)prng_data->prngws.parm_block) ^= *((__u64 *)(buf+i));
 189                 prng_tdes_add_entropy();
 190                 i += 8;
 191                 nbytes -= 8;
 192         }
 193         prng_tdes_add_entropy();
 194         prng_data->prngws.reseed_counter = 0;
 195 }
 196
 197
 198 static int __init prng_tdes_instantiate(void)
 199 {
 200         int datalen;
 201
 202         pr_debug("prng runs in TDES mode with "
 203                  "chunksize=%d and reseed_limit=%u\n",
 204                  prng_chunk_size, prng_reseed_limit);
 205
 206         /* memory allocation, prng_data struct init, mutex init */
 207         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 208         prng_data = kzalloc(datalen, GFP_KERNEL);
 209         if (!prng_data) {
 210                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 211                 return -ENOMEM;
 212         }
 213         mutex_init(&prng_data->mutex);
 214         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 215         memcpy(prng_data->prngws.parm_block, initial_parm_block, 32);
 216
 217         /* initialize the PRNG, add 128 bits of entropy */
 218         prng_tdes_seed(16);
 219
 220         return 0;
 221 }
 222
 223
 224 static void prng_tdes_deinstantiate(void)
 225 {
 226         pr_debug("The prng module stopped "
 227                  "after running in triple DES mode\n");
 228         kzfree(prng_data);
 229 }
 230
 231
 232 /*** sha512 functions ***/
 233
 234 static int __init prng_sha512_selftest(void)
 235 {
 236         /* NIST DRBG testvector for Hash Drbg, Sha-512, Count #0 */
 237         static const u8 seed[] __initconst = {
 238                 0x6b, 0x50, 0xa7, 0xd8, 0xf8, 0xa5, 0x5d, 0x7a,
 239                 0x3d, 0xf8, 0xbb, 0x40, 0xbc, 0xc3, 0xb7, 0x22,
 240                 0xd8, 0x70, 0x8d, 0xe6, 0x7f, 0xda, 0x01, 0x0b,
 241                 0x03, 0xc4, 0xc8, 0x4d, 0x72, 0x09, 0x6f, 0x8c,
 242                 0x3e, 0xc6, 0x49, 0xcc, 0x62, 0x56, 0xd9, 0xfa,
 243                 0x31, 0xdb, 0x7a, 0x29, 0x04, 0xaa, 0xf0, 0x25 };
 244         static const u8 V0[] __initconst = {
 245                 0x00, 0xad, 0xe3, 0x6f, 0x9a, 0x01, 0xc7, 0x76,
 246                 0x61, 0x34, 0x35, 0xf5, 0x4e, 0x24, 0x74, 0x22,
 247                 0x21, 0x9a, 0x29, 0x89, 0xc7, 0x93, 0x2e, 0x60,
 248                 0x1e, 0xe8, 0x14, 0x24, 0x8d, 0xd5, 0x03, 0xf1,
 249                 0x65, 0x5d, 0x08, 0x22, 0x72, 0xd5, 0xad, 0x95,
 250                 0xe1, 0x23, 0x1e, 0x8a, 0xa7, 0x13, 0xd9, 0x2b,
 251                 0x5e, 0xbc, 0xbb, 0x80, 0xab, 0x8d, 0xe5, 0x79,
 252                 0xab, 0x5b, 0x47, 0x4e, 0xdd, 0xee, 0x6b, 0x03,
 253                 0x8f, 0x0f, 0x5c, 0x5e, 0xa9, 0x1a, 0x83, 0xdd,
 254                 0xd3, 0x88, 0xb2, 0x75, 0x4b, 0xce, 0x83, 0x36,
 255                 0x57, 0x4b, 0xf1, 0x5c, 0xca, 0x7e, 0x09, 0xc0,
 256                 0xd3, 0x89, 0xc6, 0xe0, 0xda, 0xc4, 0x81, 0x7e,
 257                 0x5b, 0xf9, 0xe1, 0x01, 0xc1, 0x92, 0x05, 0xea,
 258                 0xf5, 0x2f, 0xc6, 0xc6, 0xc7, 0x8f, 0xbc, 0xf4 };
 259         static const u8 C0[] __initconst = {
 260                 0x00, 0xf4, 0xa3, 0xe5, 0xa0, 0x72, 0x63, 0x95,
 261                 0xc6, 0x4f, 0x48, 0xd0, 0x8b, 0x5b, 0x5f, 0x8e,
 262                 0x6b, 0x96, 0x1f, 0x16, 0xed, 0xbc, 0x66, 0x94,
 263                 0x45, 0x31, 0xd7, 0x47, 0x73, 0x22, 0xa5, 0x86,
 264                 0xce, 0xc0, 0x4c, 0xac, 0x63, 0xb8, 0x39, 0x50,
 265                 0xbf, 0xe6, 0x59, 0x6c, 0x38, 0x58, 0x99, 0x1f,
 266                 0x27, 0xa7, 0x9d, 0x71, 0x2a, 0xb3, 0x7b, 0xf9,
 267                 0xfb, 0x17, 0x86, 0xaa, 0x99, 0x81, 0xaa, 0x43,
 268                 0xe4, 0x37, 0xd3, 0x1e, 0x6e, 0xe5, 0xe6, 0xee,
 269                 0xc2, 0xed, 0x95, 0x4f, 0x53, 0x0e, 0x46, 0x8a,
 270                 0xcc, 0x45, 0xa5, 0xdb, 0x69, 0x0d, 0x81, 0xc9,
 271                 0x32, 0x92, 0xbc, 0x8f, 0x33, 0xe6, 0xf6, 0x09,
 272                 0x7c, 0x8e, 0x05, 0x19, 0x0d, 0xf1, 0xb6, 0xcc,
 273                 0xf3, 0x02, 0x21, 0x90, 0x25, 0xec, 0xed, 0x0e };
 274         static const u8 random[] __initconst = {
 275                 0x95, 0xb7, 0xf1, 0x7e, 0x98, 0x02, 0xd3, 0x57,
 276                 0x73, 0x92, 0xc6, 0xa9, 0xc0, 0x80, 0x83, 0xb6,
 277                 0x7d, 0xd1, 0x29, 0x22, 0x65, 0xb5, 0xf4, 0x2d,
 278                 0x23, 0x7f, 0x1c, 0x55, 0xbb, 0x9b, 0x10, 0xbf,
 279                 0xcf, 0xd8, 0x2c, 0x77, 0xa3, 0x78, 0xb8, 0x26,
 280                 0x6a, 0x00, 0x99, 0x14, 0x3b, 0x3c, 0x2d, 0x64,
 281                 0x61, 0x1e, 0xee, 0xb6, 0x9a, 0xcd, 0xc0, 0x55,
 282                 0x95, 0x7c, 0x13, 0x9e, 0x8b, 0x19, 0x0c, 0x7a,
 283                 0x06, 0x95, 0x5f, 0x2c, 0x79, 0x7c, 0x27, 0x78,
 284                 0xde, 0x94, 0x03, 0x96, 0xa5, 0x01, 0xf4, 0x0e,
 285                 0x91, 0x39, 0x6a, 0xcf, 0x8d, 0x7e, 0x45, 0xeb,
 286                 0xdb, 0xb5, 0x3b, 0xbf, 0x8c, 0x97, 0x52, 0x30,
 287                 0xd2, 0xf0, 0xff, 0x91, 0x06, 0xc7, 0x61, 0x19,
 288                 0xae, 0x49, 0x8e, 0x7f, 0xbc, 0x03, 0xd9, 0x0f,
 289                 0x8e, 0x4c, 0x51, 0x62, 0x7a, 0xed, 0x5c, 0x8d,
 290                 0x42, 0x63, 0xd5, 0xd2, 0xb9, 0x78, 0x87, 0x3a,
 291                 0x0d, 0xe5, 0x96, 0xee, 0x6d, 0xc7, 0xf7, 0xc2,
 292                 0x9e, 0x37, 0xee, 0xe8, 0xb3, 0x4c, 0x90, 0xdd,
 293                 0x1c, 0xf6, 0xa9, 0xdd, 0xb2, 0x2b, 0x4c, 0xbd,
 294                 0x08, 0x6b, 0x14, 0xb3, 0x5d, 0xe9, 0x3d, 0xa2,
 295                 0xd5, 0xcb, 0x18, 0x06, 0x69, 0x8c, 0xbd, 0x7b,
 296                 0xbb, 0x67, 0xbf, 0xe3, 0xd3, 0x1f, 0xd2, 0xd1,
 297                 0xdb, 0xd2, 0xa1, 0xe0, 0x58, 0xa3, 0xeb, 0x99,
 298                 0xd7, 0xe5, 0x1f, 0x1a, 0x93, 0x8e, 0xed, 0x5e,
 299                 0x1c, 0x1d, 0xe2, 0x3a, 0x6b, 0x43, 0x45, 0xd3,
 300                 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
 301                 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
 302                 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
 303                 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
 304                 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
 305                 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
 306                 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
 307
 308         u8 buf[sizeof(random)];
 309         struct prno_ws_s ws;
 310
 311         memset(&ws, 0, sizeof(ws));
 312
 313         /* initial seed */
 314         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 315                    &ws, NULL, 0, seed, sizeof(seed));
 316
 317         /* check working states V and C */
 318         if (memcmp(ws.V, V0, sizeof(V0)) != 0
 319             || memcmp(ws.C, C0, sizeof(C0)) != 0) {
 320                 pr_err("The prng self test state test "
 321                        "for the SHA-512 mode failed\n");
 322                 prng_errorflag = PRNG_SELFTEST_FAILED;
 323                 return -EIO;
 324         }
 325
 326         /* generate random bytes */
 327         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 328                    &ws, buf, sizeof(buf), NULL, 0);
 329         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 330                    &ws, buf, sizeof(buf), NULL, 0);
 331
 332         /* check against expected data */
 333         if (memcmp(buf, random, sizeof(random)) != 0) {
 334                 pr_err("The prng self test data test "
 335                        "for the SHA-512 mode failed\n");
 336                 prng_errorflag = PRNG_SELFTEST_FAILED;
 337                 return -EIO;
 338         }
 339
 340         return 0;
 341 }
 342
 343
 344 static int __init prng_sha512_instantiate(void)
 345 {
 346         int ret, datalen;
 347         u8 seed[64 + 32 + 16];
 348
 349         pr_debug("prng runs in SHA-512 mode "
 350                  "with chunksize=%d and reseed_limit=%u\n",
 351                  prng_chunk_size, prng_reseed_limit);
 352
 353         /* memory allocation, prng_data struct init, mutex init */
 354         datalen = sizeof(struct prng_data_s) + prng_chunk_size;
 355         if (fips_enabled)
 356                 datalen += prng_chunk_size;
 357         prng_data = kzalloc(datalen, GFP_KERNEL);
 358         if (!prng_data) {
 359                 prng_errorflag = PRNG_INSTANTIATE_FAILED;
 360                 return -ENOMEM;
 361         }
 362         mutex_init(&prng_data->mutex);
 363         prng_data->buf = ((u8 *)prng_data) + sizeof(struct prng_data_s);
 364
 365         /* selftest */
 366         ret = prng_sha512_selftest();
 367         if (ret)
 368                 goto outfree;
 369
 370         /* generate initial seed bytestring, with 256 + 128 bits entropy */
 371         ret = generate_entropy(seed, 64 + 32);
 372         if (ret != 64 + 32)
 373                 goto outfree;
 374         /* followed by 16 bytes of unique nonce */
 375         get_tod_clock_ext(seed + 64 + 32);
 376
 377         /* initial seed of the prno drng */
 378         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 379                    &prng_data->prnows, NULL, 0, seed, sizeof(seed));
 380
 381         /* if fips mode is enabled, generate a first block of random
 382            bytes for the FIPS 140-2 Conditional Self Test */
 383         if (fips_enabled) {
 384                 prng_data->prev = prng_data->buf + prng_chunk_size;
 385                 cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 386                            &prng_data->prnows,
 387                            prng_data->prev, prng_chunk_size, NULL, 0);
 388         }
 389
 390         return 0;
 391
 392 outfree:
 393         kfree(prng_data);
 394         return ret;
 395 }
 396
 397
 398 static void prng_sha512_deinstantiate(void)
 399 {
 400         pr_debug("The prng module stopped after running in SHA-512 mode\n");
 401         kzfree(prng_data);
 402 }
 403
 404
 405 static int prng_sha512_reseed(void)
 406 {
 407         int ret;
 408         u8 seed[64];
 409
 410         /* fetch 256 bits of fresh entropy */
 411         ret = generate_entropy(seed, sizeof(seed));
 412         if (ret != sizeof(seed))
 413                 return ret;
 414
 415         /* do a reseed of the prno drng with this bytestring */
 416         cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
 417                    &prng_data->prnows, NULL, 0, seed, sizeof(seed));
 418
 419         return 0;
 420 }
 421
 422
 423 static int prng_sha512_generate(u8 *buf, size_t nbytes)
 424 {
 425         int ret;
 426
 427         /* reseed needed ? */
 428         if (prng_data->prnows.reseed_counter > prng_reseed_limit) {
 429                 ret = prng_sha512_reseed();
 430                 if (ret)
 431                         return ret;
 432         }
 433
 434         /* PRNO generate */
 435         cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
 436                    &prng_data->prnows, buf, nbytes, NULL, 0);
 437
 438         /* FIPS 140-2 Conditional Self Test */
 439         if (fips_enabled) {
 440                 if (!memcmp(prng_data->prev, buf, nbytes)) {
 441                         prng_errorflag = PRNG_GEN_FAILED;
 442                         return -EILSEQ;
 443                 }
 444                 memcpy(prng_data->prev, buf, nbytes);
 445         }
 446
 447         return nbytes;
 448 }
 449
 450
 451 /*** file io functions ***/
 452
 453 static int prng_open(struct inode *inode, struct file *file)
 454 {
 455         return nonseekable_open(inode, file);
 456 }
 457
 458
 459 static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
 460                               size_t nbytes, loff_t *ppos)
 461 {
 462         int chunk, n, ret = 0;
 463
 464         /* lock prng_data struct */
 465         if (mutex_lock_interruptible(&prng_data->mutex))
 466                 return -ERESTARTSYS;
 467
 468         while (nbytes) {
 469                 if (need_resched()) {
 470                         if (signal_pending(current)) {
 471                                 if (ret == 0)
 472                                         ret = -ERESTARTSYS;
 473                                 break;
 474                         }
 475                         /* give mutex free before calling schedule() */
 476                         mutex_unlock(&prng_data->mutex);
 477                         schedule();
 478                         /* occopy mutex again */
 479                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 480                                 if (ret == 0)
 481                                         ret = -ERESTARTSYS;
 482                                 return ret;
 483                         }
 484                 }
 485
 486                 /*
 487                  * we lose some random bytes if an attacker issues
 488                  * reads < 8 bytes, but we don't care
 489                  */
 490                 chunk = min_t(int, nbytes, prng_chunk_size);
 491
 492                 /* PRNG only likes multiples of 8 bytes */
 493                 n = (chunk + 7) & -8;
 494
 495                 if (prng_data->prngws.reseed_counter > prng_reseed_limit)
 496                         prng_tdes_seed(8);
 497
 498                 /* if the CPU supports PRNG stckf is present too */
 499                 *((unsigned long long *)prng_data->buf) = get_tod_clock_fast();
 500
 501                 /*
 502                  * Beside the STCKF the input for the TDES-EDE is the output
 503                  * of the last operation. We differ here from X9.17 since we
 504                  * only store one timestamp into the buffer. Padding the whole
 505                  * buffer with timestamps does not improve security, since
 506                  * successive stckf have nearly constant offsets.
 507                  * If an attacker knows the first timestamp it would be
 508                  * trivial to guess the additional values. One timestamp
 509                  * is therefore enough and still guarantees unique input values.
 510                  *
 511                  * Note: you can still get strict X9.17 conformity by setting
 512                  * prng_chunk_size to 8 bytes.
 513                  */
 514                 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
 515                           prng_data->buf, prng_data->buf, n);
 516
 517                 prng_data->prngws.byte_counter += n;
 518                 prng_data->prngws.reseed_counter += n;
 519
 520                 if (copy_to_user(ubuf, prng_data->buf, chunk)) {
 521                         ret = -EFAULT;
 522                         break;
 523                 }
 524
 525                 nbytes -= chunk;
 526                 ret += chunk;
 527                 ubuf += chunk;
 528         }
 529
 530         /* unlock prng_data struct */
 531         mutex_unlock(&prng_data->mutex);
 532
 533         return ret;
 534 }
 535
 536
 537 static ssize_t prng_sha512_read(struct file *file, char __user *ubuf,
 538                                 size_t nbytes, loff_t *ppos)
 539 {
 540         int n, ret = 0;
 541         u8 *p;
 542
 543         /* if errorflag is set do nothing and return 'broken pipe' */
 544         if (prng_errorflag)
 545                 return -EPIPE;
 546
 547         /* lock prng_data struct */
 548         if (mutex_lock_interruptible(&prng_data->mutex))
 549                 return -ERESTARTSYS;
 550
 551         while (nbytes) {
 552                 if (need_resched()) {
 553                         if (signal_pending(current)) {
 554                                 if (ret == 0)
 555                                         ret = -ERESTARTSYS;
 556                                 break;
 557                         }
 558                         /* give mutex free before calling schedule() */
 559                         mutex_unlock(&prng_data->mutex);
 560                         schedule();
 561                         /* occopy mutex again */
 562                         if (mutex_lock_interruptible(&prng_data->mutex)) {
 563                                 if (ret == 0)
 564                                         ret = -ERESTARTSYS;
 565                                 return ret;
 566                         }
 567                 }
 568                 if (prng_data->rest) {
 569                         /* push left over random bytes from the previous read */
 570                         p = prng_data->buf + prng_chunk_size - prng_data->rest;
 571                         n = (nbytes < prng_data->rest) ?
 572                                 nbytes : prng_data->rest;
 573                         prng_data->rest -= n;
 574                 } else {
 575                         /* generate one chunk of random bytes into read buf */
 576                         p = prng_data->buf;
 577                         n = prng_sha512_generate(p, prng_chunk_size);
 578                         if (n < 0) {
 579                                 ret = n;
 580                                 break;
 581                         }
 582                         if (nbytes < prng_chunk_size) {
 583                                 n = nbytes;
 584                                 prng_data->rest = prng_chunk_size - n;
 585                         } else {
 586                                 n = prng_chunk_size;
 587                                 prng_data->rest = 0;
 588                         }
 589                 }
 590                 if (copy_to_user(ubuf, p, n)) {
 591                         ret = -EFAULT;
 592                         break;
 593                 }
 594                 ubuf += n;
 595                 nbytes -= n;
 596                 ret += n;
 597         }
 598
 599         /* unlock prng_data struct */
 600         mutex_unlock(&prng_data->mutex);
 601
 602         return ret;
 603 }
 604
 605
 606 /*** sysfs stuff ***/
 607
 608 static const struct file_operations prng_sha512_fops = {
 609         .owner          = THIS_MODULE,
 610         .open           = &prng_open,
 611         .release        = NULL,
 612         .read           = &prng_sha512_read,
 613         .llseek         = noop_llseek,
 614 };
 615 static const struct file_operations prng_tdes_fops = {
 616         .owner          = THIS_MODULE,
 617         .open           = &prng_open,
 618         .release        = NULL,
 619         .read           = &prng_tdes_read,
 620         .llseek         = noop_llseek,
 621 };
 622
 623 static struct miscdevice prng_sha512_dev = {
 624         .name   = "prandom",
 625         .minor  = MISC_DYNAMIC_MINOR,
 626         .mode   = 0644,
 627         .fops   = &prng_sha512_fops,
 628 };
 629 static struct miscdevice prng_tdes_dev = {
 630         .name   = "prandom",
 631         .minor  = MISC_DYNAMIC_MINOR,
 632         .mode   = 0644,
 633         .fops   = &prng_tdes_fops,
 634 };
 635
 636
 637 /* chunksize attribute (ro) */
 638 static ssize_t prng_chunksize_show(struct device *dev,
 639                                    struct device_attribute *attr,
 640                                    char *buf)
 641 {
 642         return snprintf(buf, PAGE_SIZE, "%u\n", prng_chunk_size);
 643 }
 644 static DEVICE_ATTR(chunksize, 0444, prng_chunksize_show, NULL);
 645
 646 /* counter attribute (ro) */
 647 static ssize_t prng_counter_show(struct device *dev,
 648                                  struct device_attribute *attr,
 649                                  char *buf)
 650 {
 651         u64 counter;
 652
 653         if (mutex_lock_interruptible(&prng_data->mutex))
 654                 return -ERESTARTSYS;
 655         if (prng_mode == PRNG_MODE_SHA512)
 656                 counter = prng_data->prnows.stream_bytes;
 657         else
 658                 counter = prng_data->prngws.byte_counter;
 659         mutex_unlock(&prng_data->mutex);
 660
 661         return snprintf(buf, PAGE_SIZE, "%llu\n", counter);
 662 }
 663 static DEVICE_ATTR(byte_counter, 0444, prng_counter_show, NULL);
 664
 665 /* errorflag attribute (ro) */
 666 static ssize_t prng_errorflag_show(struct device *dev,
 667                                    struct device_attribute *attr,
 668                                    char *buf)
 669 {
 670         return snprintf(buf, PAGE_SIZE, "%d\n", prng_errorflag);
 671 }
 672 static DEVICE_ATTR(errorflag, 0444, prng_errorflag_show, NULL);
 673
 674 /* mode attribute (ro) */
 675 static ssize_t prng_mode_show(struct device *dev,
 676                               struct device_attribute *attr,
 677                               char *buf)
 678 {
 679         if (prng_mode == PRNG_MODE_TDES)
 680                 return snprintf(buf, PAGE_SIZE, "TDES\n");
 681         else
 682                 return snprintf(buf, PAGE_SIZE, "SHA512\n");
 683 }
 684 static DEVICE_ATTR(mode, 0444, prng_mode_show, NULL);
 685
 686 /* reseed attribute (w) */
 687 static ssize_t prng_reseed_store(struct device *dev,
 688                                  struct device_attribute *attr,
 689                                  const char *buf, size_t count)
 690 {
 691         if (mutex_lock_interruptible(&prng_data->mutex))
 692                 return -ERESTARTSYS;
 693         prng_sha512_reseed();
 694         mutex_unlock(&prng_data->mutex);
 695
 696         return count;
 697 }
 698 static DEVICE_ATTR(reseed, 0200, NULL, prng_reseed_store);
 699
 700 /* reseed limit attribute (rw) */
 701 static ssize_t prng_reseed_limit_show(struct device *dev,
 702                                       struct device_attribute *attr,
 703                                       char *buf)
 704 {
 705         return snprintf(buf, PAGE_SIZE, "%u\n", prng_reseed_limit);
 706 }
 707 static ssize_t prng_reseed_limit_store(struct device *dev,
 708                                        struct device_attribute *attr,
 709                                        const char *buf, size_t count)
 710 {
 711         unsigned limit;
 712
 713         if (sscanf(buf, "%u\n", &limit) != 1)
 714                 return -EINVAL;
 715
 716         if (prng_mode == PRNG_MODE_SHA512) {
 717                 if (limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 718                         return -EINVAL;
 719         } else {
 720                 if (limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 721                         return -EINVAL;
 722         }
 723
 724         prng_reseed_limit = limit;
 725
 726         return count;
 727 }
 728 static DEVICE_ATTR(reseed_limit, 0644,
 729                    prng_reseed_limit_show, prng_reseed_limit_store);
 730
 731 /* strength attribute (ro) */
 732 static ssize_t prng_strength_show(struct device *dev,
 733                                   struct device_attribute *attr,
 734                                   char *buf)
 735 {
 736         return snprintf(buf, PAGE_SIZE, "256\n");
 737 }
 738 static DEVICE_ATTR(strength, 0444, prng_strength_show, NULL);
 739
 740 static struct attribute *prng_sha512_dev_attrs[] = {
 741         &dev_attr_errorflag.attr,
 742         &dev_attr_chunksize.attr,
 743         &dev_attr_byte_counter.attr,
 744         &dev_attr_mode.attr,
 745         &dev_attr_reseed.attr,
 746         &dev_attr_reseed_limit.attr,
 747         &dev_attr_strength.attr,
 748         NULL
 749 };
 750 static struct attribute *prng_tdes_dev_attrs[] = {
 751         &dev_attr_chunksize.attr,
 752         &dev_attr_byte_counter.attr,
 753         &dev_attr_mode.attr,
 754         NULL
 755 };
 756
 757 static struct attribute_group prng_sha512_dev_attr_group = {
 758         .attrs = prng_sha512_dev_attrs
 759 };
 760 static struct attribute_group prng_tdes_dev_attr_group = {
 761         .attrs = prng_tdes_dev_attrs
 762 };
 763
 764
 765 /*** module init and exit ***/
 766
 767 static int __init prng_init(void)
 768 {
 769         int ret;
 770
 771         /* check if the CPU has a PRNG */
 772         if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
 773                 return -EOPNOTSUPP;
 774
 775         /* choose prng mode */
 776         if (prng_mode != PRNG_MODE_TDES) {
 777                 /* check for MSA5 support for PRNO operations */
 778                 if (!cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
 779                         if (prng_mode == PRNG_MODE_SHA512) {
 780                                 pr_err("The prng module cannot "
 781                                        "start in SHA-512 mode\n");
 782                                 return -EOPNOTSUPP;
 783                         }
 784                         prng_mode = PRNG_MODE_TDES;
 785                 } else
 786                         prng_mode = PRNG_MODE_SHA512;
 787         }
 788
 789         if (prng_mode == PRNG_MODE_SHA512) {
 790
 791                 /* SHA512 mode */
 792
 793                 if (prng_chunk_size < PRNG_CHUNKSIZE_SHA512_MIN
 794                     || prng_chunk_size > PRNG_CHUNKSIZE_SHA512_MAX)
 795                         return -EINVAL;
 796                 prng_chunk_size = (prng_chunk_size + 0x3f) & ~0x3f;
 797
 798                 if (prng_reseed_limit == 0)
 799                         prng_reseed_limit = PRNG_RESEED_LIMIT_SHA512;
 800                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_SHA512_LOWER)
 801                         return -EINVAL;
 802
 803                 ret = prng_sha512_instantiate();
 804                 if (ret)
 805                         goto out;
 806
 807                 ret = misc_register(&prng_sha512_dev);
 808                 if (ret) {
 809                         prng_sha512_deinstantiate();
 810                         goto out;
 811                 }
 812                 ret = sysfs_create_group(&prng_sha512_dev.this_device->kobj,
 813                                          &prng_sha512_dev_attr_group);
 814                 if (ret) {
 815                         misc_deregister(&prng_sha512_dev);
 816                         prng_sha512_deinstantiate();
 817                         goto out;
 818                 }
 819
 820         } else {
 821
 822                 /* TDES mode */
 823
 824                 if (prng_chunk_size < PRNG_CHUNKSIZE_TDES_MIN
 825                     || prng_chunk_size > PRNG_CHUNKSIZE_TDES_MAX)
 826                         return -EINVAL;
 827                 prng_chunk_size = (prng_chunk_size + 0x07) & ~0x07;
 828
 829                 if (prng_reseed_limit == 0)
 830                         prng_reseed_limit = PRNG_RESEED_LIMIT_TDES;
 831                 else if (prng_reseed_limit < PRNG_RESEED_LIMIT_TDES_LOWER)
 832                         return -EINVAL;
 833
 834                 ret = prng_tdes_instantiate();
 835                 if (ret)
 836                         goto out;
 837
 838                 ret = misc_register(&prng_tdes_dev);
 839                 if (ret) {
 840                         prng_tdes_deinstantiate();
 841                         goto out;
 842                 }
 843                 ret = sysfs_create_group(&prng_tdes_dev.this_device->kobj,
 844                                          &prng_tdes_dev_attr_group);
 845                 if (ret) {
 846                         misc_deregister(&prng_tdes_dev);
 847                         prng_tdes_deinstantiate();
 848                         goto out;
 849                 }
 850
 851         }
 852
 853 out:
 854         return ret;
 855 }
 856
 857
 858 static void __exit prng_exit(void)
 859 {
 860         if (prng_mode == PRNG_MODE_SHA512) {
 861                 sysfs_remove_group(&prng_sha512_dev.this_device->kobj,
 862                                    &prng_sha512_dev_attr_group);
 863                 misc_deregister(&prng_sha512_dev);
 864                 prng_sha512_deinstantiate();
 865         } else {
 866                 sysfs_remove_group(&prng_tdes_dev.this_device->kobj,
 867                                    &prng_tdes_dev_attr_group);
 868                 misc_deregister(&prng_tdes_dev);
 869                 prng_tdes_deinstantiate();
 870         }
 871 }
 872
 873 module_cpu_feature_match(MSA, prng_init);
 874 module_exit(prng_exit);