prng.c 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
  1. /*
  2. * Copyright IBM Corp. 2006,2007
  3. * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
  4. * Driver for the s390 pseudo random number generator
  5. */
  6. #include <linux/fs.h>
  7. #include <linux/init.h>
  8. #include <linux/kernel.h>
  9. #include <linux/miscdevice.h>
  10. #include <linux/module.h>
  11. #include <linux/moduleparam.h>
  12. #include <linux/random.h>
  13. #include <asm/debug.h>
  14. #include <asm/uaccess.h>
  15. #include "crypt_s390.h"
  16. MODULE_LICENSE("GPL");
  17. MODULE_AUTHOR("Jan Glauber <jan.glauber@de.ibm.com>");
  18. MODULE_DESCRIPTION("s390 PRNG interface");
  19. static int prng_chunk_size = 256;
  20. module_param(prng_chunk_size, int, S_IRUSR | S_IRGRP | S_IROTH);
  21. MODULE_PARM_DESC(prng_chunk_size, "PRNG read chunk size in bytes");
  22. static int prng_entropy_limit = 4096;
  23. module_param(prng_entropy_limit, int, S_IRUSR | S_IRGRP | S_IROTH | S_IWUSR);
  24. MODULE_PARM_DESC(prng_entropy_limit,
  25. "PRNG add entropy after that much bytes were produced");
  26. /*
  27. * Any one who considers arithmetical methods of producing random digits is,
  28. * of course, in a state of sin. -- John von Neumann
  29. */
  30. struct s390_prng_data {
  31. unsigned long count; /* how many bytes were produced */
  32. char *buf;
  33. };
  34. static struct s390_prng_data *p;
  35. /* copied from libica, use a non-zero initial parameter block */
  36. static unsigned char parm_block[32] = {
  37. 0x0F,0x2B,0x8E,0x63,0x8C,0x8E,0xD2,0x52,0x64,0xB7,0xA0,0x7B,0x75,0x28,0xB8,0xF4,
  38. 0x75,0x5F,0xD2,0xA6,0x8D,0x97,0x11,0xFF,0x49,0xD8,0x23,0xF3,0x7E,0x21,0xEC,0xA0,
  39. };
  40. static int prng_open(struct inode *inode, struct file *file)
  41. {
  42. return nonseekable_open(inode, file);
  43. }
  44. static void prng_add_entropy(void)
  45. {
  46. __u64 entropy[4];
  47. unsigned int i;
  48. int ret;
  49. for (i = 0; i < 16; i++) {
  50. ret = crypt_s390_kmc(KMC_PRNG, parm_block, (char *)entropy,
  51. (char *)entropy, sizeof(entropy));
  52. BUG_ON(ret < 0 || ret != sizeof(entropy));
  53. memcpy(parm_block, entropy, sizeof(entropy));
  54. }
  55. }
  56. static void prng_seed(int nbytes)
  57. {
  58. char buf[16];
  59. int i = 0;
  60. BUG_ON(nbytes > 16);
  61. get_random_bytes(buf, nbytes);
  62. /* Add the entropy */
  63. while (nbytes >= 8) {
  64. *((__u64 *)parm_block) ^= *((__u64 *)buf+i*8);
  65. prng_add_entropy();
  66. i += 8;
  67. nbytes -= 8;
  68. }
  69. prng_add_entropy();
  70. }
  71. static ssize_t prng_read(struct file *file, char __user *ubuf, size_t nbytes,
  72. loff_t *ppos)
  73. {
  74. int chunk, n;
  75. int ret = 0;
  76. int tmp;
  77. /* nbytes can be arbitrary long, we spilt it into chunks */
  78. while (nbytes) {
  79. /* same as in extract_entropy_user in random.c */
  80. if (need_resched()) {
  81. if (signal_pending(current)) {
  82. if (ret == 0)
  83. ret = -ERESTARTSYS;
  84. break;
  85. }
  86. schedule();
  87. }
  88. /*
  89. * we lose some random bytes if an attacker issues
  90. * reads < 8 bytes, but we don't care
  91. */
  92. chunk = min_t(int, nbytes, prng_chunk_size);
  93. /* PRNG only likes multiples of 8 bytes */
  94. n = (chunk + 7) & -8;
  95. if (p->count > prng_entropy_limit)
  96. prng_seed(8);
  97. /* if the CPU supports PRNG stckf is present too */
  98. asm volatile(".insn s,0xb27c0000,%0"
  99. : "=m" (*((unsigned long long *)p->buf)) : : "cc");
  100. /*
  101. * Beside the STCKF the input for the TDES-EDE is the output
  102. * of the last operation. We differ here from X9.17 since we
  103. * only store one timestamp into the buffer. Padding the whole
  104. * buffer with timestamps does not improve security, since
  105. * successive stckf have nearly constant offsets.
  106. * If an attacker knows the first timestamp it would be
  107. * trivial to guess the additional values. One timestamp
  108. * is therefore enough and still guarantees unique input values.
  109. *
  110. * Note: you can still get strict X9.17 conformity by setting
  111. * prng_chunk_size to 8 bytes.
  112. */
  113. tmp = crypt_s390_kmc(KMC_PRNG, parm_block, p->buf, p->buf, n);
  114. BUG_ON((tmp < 0) || (tmp != n));
  115. p->count += n;
  116. if (copy_to_user(ubuf, p->buf, chunk))
  117. return -EFAULT;
  118. nbytes -= chunk;
  119. ret += chunk;
  120. ubuf += chunk;
  121. }
  122. return ret;
  123. }
  124. static struct file_operations prng_fops = {
  125. .owner = THIS_MODULE,
  126. .open = &prng_open,
  127. .release = NULL,
  128. .read = &prng_read,
  129. };
  130. static struct miscdevice prng_dev = {
  131. .name = "prandom",
  132. .minor = MISC_DYNAMIC_MINOR,
  133. .fops = &prng_fops,
  134. };
  135. static int __init prng_init(void)
  136. {
  137. int ret;
  138. /* check if the CPU has a PRNG */
  139. if (!crypt_s390_func_available(KMC_PRNG))
  140. return -EOPNOTSUPP;
  141. if (prng_chunk_size < 8)
  142. return -EINVAL;
  143. p = kmalloc(sizeof(struct s390_prng_data), GFP_KERNEL);
  144. if (!p)
  145. return -ENOMEM;
  146. p->count = 0;
  147. p->buf = kmalloc(prng_chunk_size, GFP_KERNEL);
  148. if (!p->buf) {
  149. ret = -ENOMEM;
  150. goto out_free;
  151. }
  152. /* initialize the PRNG, add 128 bits of entropy */
  153. prng_seed(16);
  154. ret = misc_register(&prng_dev);
  155. if (ret) {
  156. printk(KERN_WARNING
  157. "Could not register misc device for PRNG.\n");
  158. goto out_buf;
  159. }
  160. return 0;
  161. out_buf:
  162. kfree(p->buf);
  163. out_free:
  164. kfree(p);
  165. return ret;
  166. }
  167. static void __exit prng_exit(void)
  168. {
  169. /* wipe me */
  170. memset(p->buf, 0, prng_chunk_size);
  171. kfree(p->buf);
  172. kfree(p);
  173. misc_deregister(&prng_dev);
  174. }
  175. module_init(prng_init);
  176. module_exit(prng_exit);