Skip to contentSkip to conversation

CEX2C hardware random numbers.

PATCH In review Martin Schwidefsky 3 participants 9 messages Mar 14, 2008 – Mar 31, 2008

Subsystems (4)
Crypto API s390 Hardware random number generator core s390 zcrypt and pkey driver and AP bus
lore
Share & tools
lore

Martin Schwidefsky

author
#0 lore raw

cover CEX2C hardware random numbers.

Greetings,
the two patches in this set allow Linux on System z to access the hardware random generator on the CEX2C crypto cards. Patch #1 adds error checking to the hwrng core to deal with i/o errors. Patch #2 adds the actual CEX2C support.

Signature · 4 lines
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.
author
#1 lore raw

PATCH 1/2 hw_random: allow rng_dev_read() to return hardware errors.

From: Ralph Wuerthner <[email protected]>

The api for hardware random number generators is currently limited to devices that never fail. If the hardware is registered as a source for random numbers it has to work. This prevents the use of i/o based random number devices where the i/o might fail.

Add a check for errors after the read from a hardware random number device.

This patch is required to support large random numbers retrieved from the CEX2C cards on System z.

Signed-off-by Ralph Wuerthner <[email protected]>
Signed-off-by Martin Schwidefsky <[email protected]>

---

 drivers/char/hw_random/core.c |    4 ++++
 1 file changed, 4 insertions(+)
drivers/char/hw_random/core.c +4 -0
Index: quilt-2.6/drivers/char/hw_random/core.c
===================================================================
@@ -116,6 +116,10 @@ static ssize_t rng_dev_read(struct file 
 		err = -EAGAIN;
 		if (!bytes_read && (filp->f_flags & O_NONBLOCK))
 			goto out;
+		if (bytes_read < 0) {
+			err = bytes_read;
+			goto out;
+		}
 
 		err = -EFAULT;
 		while (bytes_read && size) {
Signature · 4 lines
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.
maintainer
#2 lore raw

Re: [patch 1/2] hw_random: allow rng_dev_read() to return hardware errors.

Quoted 7 lines · Martin Schwidefsky

From: Ralph Wuerthner <[email protected]>

The api for hardware random number generators is currently limited to devices that never fail. If the hardware is registered as a source for random numbers it has to work. This prevents the use of i/o based random number devices where the i/o might fail.

Quoted 7 lines

Add a check for errors after the read from a hardware random number device.

This patch is required to support large random numbers retrieved from the CEX2C cards on System z.

Signed-off-by Ralph Wuerthner <[email protected]>
Signed-off-by Martin Schwidefsky <[email protected]>

Thanks for the patch. I'll pick this up in cryptodev-2.6.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#3 lore raw

PATCH 2/2 zcrypt: add support for large random numbers

In reply to Martin Schwidefsky

From: Ralph Wuerthner <[email protected]>

This patch allows user space applications to access large amounts of truly random data. The random data source is the build-in hardware random number generator on the CEX2C cards.

Signed-off-by Ralph Wuerthner <[email protected]>
Signed-off-by Martin Schwidefsky <[email protected]>

---

 drivers/crypto/Kconfig              |    1 
 drivers/s390/crypto/zcrypt_api.c    |  120 +++++++++++++++++++++
 drivers/s390/crypto/zcrypt_api.h    |    8 +
 drivers/s390/crypto/zcrypt_pcixcc.c |  199 +++++++++++++++++++++++++++++++++++-
 4 files changed, 327 insertions(+), 1 deletion(-)
drivers/crypto/Kconfig +1 -0
Index: quilt-2.6/drivers/crypto/Kconfig
===================================================================
@@ -64,6 +64,7 @@ config ZCRYPT
 	tristate "Support for PCI-attached cryptographic adapters"
 	depends on S390
 	select ZCRYPT_MONOLITHIC if ZCRYPT="y"
+	select HW_RANDOM
 	help
 	  Select this option if you want to use a PCI-attached cryptographic
 	  adapter like:
drivers/s390/crypto/zcrypt_api.c +120 -0

156 lines not on this page · raw message

drivers/s390/crypto/zcrypt_api.h +8 -0
Index: quilt-2.6/drivers/s390/crypto/zcrypt_api.h
===================================================================
@@ -100,6 +100,13 @@ struct ica_z90_status {
 #define ZCRYPT_CEX2C		5
 #define ZCRYPT_CEX2A		6
 
+/**
+ * Large random numbers are pulled in 4096 byte chunks from the crypto cards
+ * and stored in a page. Be carefull when increasing this buffer due to size
+ * limitations for AP requests.
+ */
+#define ZCRYPT_RNG_BUFFER_SIZE	4096
+
 struct zcrypt_device;
 
 struct zcrypt_ops {

@@ -107,6 +114,7 @@ struct zcrypt_ops {
 	long (*rsa_modexpo_crt)(struct zcrypt_device *,
 				struct ica_rsa_modexpo_crt *);
 	long (*send_cprb)(struct zcrypt_device *, struct ica_xcRB *);
+	long (*rng)(struct zcrypt_device *, char *);
 };
 
 struct zcrypt_device {
drivers/s390/crypto/zcrypt_pcixcc.c +198 -1

247 lines not on this page · raw message

Signature · 4 lines
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.
#4 lore raw

Re: [patch 2/2] zcrypt: add support for large random numbers

Quoted 31 lines · On Fri, 14 Mar 2008 10:25:25 +0100 Martin Schwidefsky wrote:

This patch allows user space applications to access large amounts of truly random data. The random data source is the build-in hardware random number generator on the CEX2C cards.
---

 drivers/crypto/Kconfig              |    1 
 drivers/s390/crypto/zcrypt_api.c    |  120 +++++++++++++++++++++
 drivers/s390/crypto/zcrypt_api.h    |    8 +
 drivers/s390/crypto/zcrypt_pcixcc.c |  199 +++++++++++++++++++++++++++++++++++-
 4 files changed, 327 insertions(+), 1 deletion(-)

Index: quilt-2.6/drivers/s390/crypto/zcrypt_api.c
===================================================================

drivers/s390/crypto/zcrypt_api.c +4 -0
@@ -36,6 +36,7 @@
 #include <linux/compat.h>
 #include <asm/atomic.h>
 #include <asm/uaccess.h>
+#include <linux/hw_random.h>
 
 #include "zcrypt_api.h"
 

@@ -1041,6 +1094,73 @@ out:
 	return count;
 }
 
+static int zcrypt_rng_device_count;
+static u32 *zcrypt_rng_buffer;
+static int zcrypt_rng_buffer_index;

drivers/s390/crypto/zcrypt_api.c out: · line 1109

Quoted 10 lines
drivers/s390/crypto/zcrypt_api.c +10 -0
+static DEFINE_MUTEX(zcrypt_rng_mutex);
+
+static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
+{
+	int rc;
+
+	/**
+	 * We don't need locking here because the RNG API guarantees serialized
+	 * read method calls.
+	 */

Hi,
Linux kernel uses "/**" to indicate the beginning of kernel-doc notation, so when the comment block is not kernel-doc, please don't use that /** to begin the comment block.
(multiple occurrences of this)

Quoted 17 lines
drivers/s390/crypto/zcrypt_api.c +17 -0
+	if (zcrypt_rng_buffer_index == 0) {
+		rc = zcrypt_rng((char *) zcrypt_rng_buffer);
+		if (rc < 0)
+			return -EIO;
+		zcrypt_rng_buffer_index = rc / sizeof *data;
+	}
+	*data = zcrypt_rng_buffer[--zcrypt_rng_buffer_index];
+	return sizeof *data;
+}
+
+static struct hwrng zcrypt_rng_dev = {
+	.name		= "zcrypt",
+	.data_read	= zcrypt_rng_data_read,
+};
+
+static int zcrypt_rng_device_add(void)
+{

...

Quoted 8 lines

+}

Index: quilt-2.6/drivers/s390/crypto/zcrypt_pcixcc.c
===================================================================

drivers/s390/crypto/zcrypt_pcixcc.c static int XCRB_msg_to_type6CPRB_msgX(st · line 363

Quoted 8 lines
drivers/s390/crypto/zcrypt_pcixcc.c +5 -0
@@ -356,6 +356,55 @@ static int XCRB_msg_to_type6CPRB_msgX(st
 }
 
 /**
+ * Prepare a type6 CPRB message for random number generation
+ *
+ * @ap_dev: AP device pointer
+ * @ap_msg: pointer to AP message
+ */

This one is almost kernel-doc. Just put the function name plus a hyphen/dash on the first line and remove the almost-blank line:

/**
* rng_type6CPRB_msgX - Prepare a type6 CPRB message for random number generation
* @ap_dev: AP device pointer
* @ap_msg: pointer to AP message
*/

See Documentation/kernel-doc-nano-HOWTO.txt for more info/details, or ask me/lkml.

Quoted 4 lines
drivers/s390/crypto/zcrypt_pcixcc.c +4 -0
+static void rng_type6CPRB_msgX(struct ap_device *ap_dev,
+			       struct ap_message *ap_msg,
+			       unsigned random_number_length)
+{

...

Quoted 21 lines
drivers/s390/crypto/zcrypt_pcixcc.c +13 -0
+}
+
+/**
  * Copy results from a type 86 ICA reply message back to user space.
  *
  * @zdev: crypto device pointer

@@ -736,6 +830,42 @@ out_free:
 }
 
 /**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to generate random data.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *	  PCIXCC/CEX2C device to the request distributor
+ * @buffer: pointer to a memory page to return random data
+ */
+
+static long zcrypt_pcixcc_rng(struct zcrypt_device *zdev,
+				    char *buffer)
+{

...

Quoted 18 lines
drivers/s390/crypto/zcrypt_pcixcc.c +11 -0
+}
+
+/**
  * The crypto operations for a PCIXCC/CEX2C card.
  */
 static struct zcrypt_ops zcrypt_pcixcc_ops = {

@@ -859,6 +996,58 @@ out_free:
 }
 
 /**
+ * Large random number detection function. Its sends a message to a pcixcc
+ * card to find out if large random numbers are supported.
+ * @ap_dev: pointer to the AP device.
+ *
+ * Returns 1 if large random numbers are supported, 0 if not and < 0 on error.
+ */
+static int zcrypt_pcixcc_rng_supported(struct ap_device *ap_dev)
+{

...

Quoted 1 line

+}

---
~Randy

author
#5 lore raw

Re: [patch 2/2] zcrypt: add support for large random numbers

Quoted 4 lines · Randy Dunlap

Linux kernel uses "/**" to indicate the beginning of kernel-doc notation, so when the comment block is not kernel-doc, please don't use that /** to begin the comment block.
(multiple occurrences of this)

True. This is done consistently wrong in the zcrypt driver. I would prefer to do a separate kernel-doc cleanup patch and leave this patch as it is. Ok ?

Signature · 4 lines
blue skies,
  Martin.

"Reality continues to ruin my life." - Calvin.
#6 lore raw

Re: [patch 2/2] zcrypt: add support for large random numbers

Quoted 9 lines · Martin Schwidefsky
Quoted 4 lines · Randy Dunlap

Linux kernel uses "/**" to indicate the beginning of kernel-doc notation, so when the comment block is not kernel-doc, please don't use that /** to begin the comment block.
(multiple occurrences of this)

True. This is done consistently wrong in the zcrypt driver. I would prefer to do a separate kernel-doc cleanup patch and leave this patch as it is. Ok ?

Sure. Thanks.

Signature · 1 line
~Randy
maintainer
#7 lore raw

Re: [patch 2/2] zcrypt: add support for large random numbers

In reply to Martin Schwidefsky
Quoted 8 lines · Martin Schwidefsky

From: Ralph Wuerthner <[email protected]>

This patch allows user space applications to access large amounts of truly random data. The random data source is the build-in hardware random number generator on the CEX2C cards.

Signed-off-by Ralph Wuerthner <[email protected]>
Signed-off-by Martin Schwidefsky <[email protected]>

The patch looks OK.

Are you guys going to carry this patch in the s390 tree?

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#8 lore raw

Re: [patch 2/2] zcrypt: add support for large random numbers

Quoted 10 lines · Herbert Xu
Quoted 6 lines

This patch allows user space applications to access large amounts of truly random data. The random data source is the build-in hardware random number generator on the CEX2C cards.

Signed-off-by Ralph Wuerthner <[email protected]>
Signed-off-by Martin Schwidefsky <[email protected]>

The patch looks OK.

Are you guys going to carry this patch in the s390 tree?

Yes, this patch should go in over git390.

Signature · 4 lines
blue skies,
  Martin.

"Reality continues to ruin my life." - Calvin.