* [PATCH] s390/zcrypt: enable s390 hwrng to seed kernel entropy
@ 2014-07-30 12:17 Ingo Tuchscherer
2014-08-11 13:56 ` Torsten Duwe
0 siblings, 1 reply; 3+ messages in thread
From: Ingo Tuchscherer @ 2014-07-30 12:17 UTC (permalink / raw)
To: linux-kernel, Theodore Ts'o
Cc: Martin Schwidefsky, Gerald Schaefer, Heiko Carstens, Torsten Duwe,
Hendrik Brueckner, Matt Mackall, Herbert Xu, Harald Freudenberger,
Ingo Tuchscherer, Ingo Tuchscherer
Set the 'quality' property in the zcrypt rng device structure to enable the
zcrypt hwrng device to take part in the kernel entropy seeding process.
A module parameter named hwrng_seed will be introduced to disable the
participation. By default this parameter is set to 1 (enabled).
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
---
drivers/s390/crypto/ap_bus.c | 5 +++++
drivers/s390/crypto/ap_bus.h | 1 +
drivers/s390/crypto/zcrypt_api.c | 3 +++
3 files changed, 9 insertions(+)
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 4038437..19fac5f 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -85,6 +85,11 @@ static int ap_thread_flag = 0;
module_param_named(poll_thread, ap_thread_flag, int, S_IRUSR|S_IRGRP);
MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
+int ap_hwrng_seed = 1;
+EXPORT_SYMBOL(ap_hwrng_seed);
+module_param_named(hwrng_seed, ap_hwrng_seed, int, S_IRUSR|S_IRGRP);
+MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
+
static struct device *ap_root_device = NULL;
static struct ap_config_info *ap_configuration;
static DEFINE_SPINLOCK(ap_device_list_lock);
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 6405ae2..b0be09a 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -38,6 +38,7 @@
#define AP_POLL_TIME 1 /* Time in ticks between receive polls. */
extern int ap_domain_index;
+extern int ap_hwrng_seed;
/**
* The ap_qid_t identifier of an ap queue. It contains a
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 0e18c5d..ed91665 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -1374,6 +1374,7 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
static struct hwrng zcrypt_rng_dev = {
.name = "zcrypt",
.data_read = zcrypt_rng_data_read,
+ .quality = 990,
};
static int zcrypt_rng_device_add(void)
@@ -1388,6 +1389,8 @@ static int zcrypt_rng_device_add(void)
goto out;
}
zcrypt_rng_buffer_index = 0;
+ if (!ap_hwrng_seed)
+ zcrypt_rng_dev.quality = 0;
rc = hwrng_register(&zcrypt_rng_dev);
if (rc)
goto out_free;
--
1.8.5.5
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] s390/zcrypt: enable s390 hwrng to seed kernel entropy
2014-07-30 12:17 [PATCH] s390/zcrypt: enable s390 hwrng to seed kernel entropy Ingo Tuchscherer
@ 2014-08-11 13:56 ` Torsten Duwe
2014-08-11 15:11 ` Ingo Tuchscherer
0 siblings, 1 reply; 3+ messages in thread
From: Torsten Duwe @ 2014-08-11 13:56 UTC (permalink / raw)
To: Ingo Tuchscherer
Cc: linux-kernel, Theodore Ts'o, Martin Schwidefsky,
Gerald Schaefer, Heiko Carstens, Hendrik Brueckner, Matt Mackall,
Herbert Xu, Harald Freudenberger, Ingo Tuchscherer
On Wed, Jul 30, 2014 at 02:17:36PM +0200, Ingo Tuchscherer wrote:
> Set the 'quality' property in the zcrypt rng device structure to enable the
> zcrypt hwrng device to take part in the kernel entropy seeding process.
> A module parameter named hwrng_seed will be introduced to disable the
> participation. By default this parameter is set to 1 (enabled).
I only had a one-liner that simply enabled it. I guess the extra switch
is for certification scenarios? Anyway,
Acked-by: Torsten Duwe <duwe@suse.de>
>
> Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
> ---
> drivers/s390/crypto/ap_bus.c | 5 +++++
> drivers/s390/crypto/ap_bus.h | 1 +
> drivers/s390/crypto/zcrypt_api.c | 3 +++
> 3 files changed, 9 insertions(+)
>
> diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
> index 4038437..19fac5f 100644
> --- a/drivers/s390/crypto/ap_bus.c
> +++ b/drivers/s390/crypto/ap_bus.c
> @@ -85,6 +85,11 @@ static int ap_thread_flag = 0;
> module_param_named(poll_thread, ap_thread_flag, int, S_IRUSR|S_IRGRP);
> MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
>
> +int ap_hwrng_seed = 1;
> +EXPORT_SYMBOL(ap_hwrng_seed);
> +module_param_named(hwrng_seed, ap_hwrng_seed, int, S_IRUSR|S_IRGRP);
> +MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
> +
> static struct device *ap_root_device = NULL;
> static struct ap_config_info *ap_configuration;
> static DEFINE_SPINLOCK(ap_device_list_lock);
> diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
> index 6405ae2..b0be09a 100644
> --- a/drivers/s390/crypto/ap_bus.h
> +++ b/drivers/s390/crypto/ap_bus.h
> @@ -38,6 +38,7 @@
> #define AP_POLL_TIME 1 /* Time in ticks between receive polls. */
>
> extern int ap_domain_index;
> +extern int ap_hwrng_seed;
>
> /**
> * The ap_qid_t identifier of an ap queue. It contains a
> diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
> index 0e18c5d..ed91665 100644
> --- a/drivers/s390/crypto/zcrypt_api.c
> +++ b/drivers/s390/crypto/zcrypt_api.c
> @@ -1374,6 +1374,7 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
> static struct hwrng zcrypt_rng_dev = {
> .name = "zcrypt",
> .data_read = zcrypt_rng_data_read,
> + .quality = 990,
> };
>
> static int zcrypt_rng_device_add(void)
> @@ -1388,6 +1389,8 @@ static int zcrypt_rng_device_add(void)
> goto out;
> }
> zcrypt_rng_buffer_index = 0;
> + if (!ap_hwrng_seed)
> + zcrypt_rng_dev.quality = 0;
> rc = hwrng_register(&zcrypt_rng_dev);
> if (rc)
> goto out_free;
> --
> 1.8.5.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] s390/zcrypt: enable s390 hwrng to seed kernel entropy
2014-08-11 13:56 ` Torsten Duwe
@ 2014-08-11 15:11 ` Ingo Tuchscherer
0 siblings, 0 replies; 3+ messages in thread
From: Ingo Tuchscherer @ 2014-08-11 15:11 UTC (permalink / raw)
To: Torsten Duwe, Ingo Tuchscherer
Cc: linux-kernel, Theodore Ts'o, Martin Schwidefsky,
Gerald Schaefer, Heiko Carstens, Hendrik Brueckner, Matt Mackall,
Herbert Xu, Harald Freudenberger
On 08/11/2014 03:56 PM, Torsten Duwe wrote:
> On Wed, Jul 30, 2014 at 02:17:36PM +0200, Ingo Tuchscherer wrote:
>> Set the 'quality' property in the zcrypt rng device structure to enable the
>> zcrypt hwrng device to take part in the kernel entropy seeding process.
>> A module parameter named hwrng_seed will be introduced to disable the
>> participation. By default this parameter is set to 1 (enabled).
> I only had a one-liner that simply enabled it. I guess the extra switch
> is for certification scenarios?
I introduced this switch for several reasons. I would like to have the
possibility to prevent the card from being interrupted with rng queries
(in case of heavy workload) or card verification/certification or other
measurement processes.
Last but not least we are able to deactivate this feature in case of any
failures/attacks.
> Anyway,
>
> Acked-by: Torsten Duwe <duwe@suse.de>
>> Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
>> ---
>> drivers/s390/crypto/ap_bus.c | 5 +++++
>> drivers/s390/crypto/ap_bus.h | 1 +
>> drivers/s390/crypto/zcrypt_api.c | 3 +++
>> 3 files changed, 9 insertions(+)
>>
>> diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
>> index 4038437..19fac5f 100644
>> --- a/drivers/s390/crypto/ap_bus.c
>> +++ b/drivers/s390/crypto/ap_bus.c
>> @@ -85,6 +85,11 @@ static int ap_thread_flag = 0;
>> module_param_named(poll_thread, ap_thread_flag, int, S_IRUSR|S_IRGRP);
>> MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
>>
>> +int ap_hwrng_seed = 1;
>> +EXPORT_SYMBOL(ap_hwrng_seed);
>> +module_param_named(hwrng_seed, ap_hwrng_seed, int, S_IRUSR|S_IRGRP);
>> +MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
>> +
>> static struct device *ap_root_device = NULL;
>> static struct ap_config_info *ap_configuration;
>> static DEFINE_SPINLOCK(ap_device_list_lock);
>> diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
>> index 6405ae2..b0be09a 100644
>> --- a/drivers/s390/crypto/ap_bus.h
>> +++ b/drivers/s390/crypto/ap_bus.h
>> @@ -38,6 +38,7 @@
>> #define AP_POLL_TIME 1 /* Time in ticks between receive polls. */
>>
>> extern int ap_domain_index;
>> +extern int ap_hwrng_seed;
>>
>> /**
>> * The ap_qid_t identifier of an ap queue. It contains a
>> diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
>> index 0e18c5d..ed91665 100644
>> --- a/drivers/s390/crypto/zcrypt_api.c
>> +++ b/drivers/s390/crypto/zcrypt_api.c
>> @@ -1374,6 +1374,7 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
>> static struct hwrng zcrypt_rng_dev = {
>> .name = "zcrypt",
>> .data_read = zcrypt_rng_data_read,
>> + .quality = 990,
>> };
>>
>> static int zcrypt_rng_device_add(void)
>> @@ -1388,6 +1389,8 @@ static int zcrypt_rng_device_add(void)
>> goto out;
>> }
>> zcrypt_rng_buffer_index = 0;
>> + if (!ap_hwrng_seed)
>> + zcrypt_rng_dev.quality = 0;
>> rc = hwrng_register(&zcrypt_rng_dev);
>> if (rc)
>> goto out_free;
>> --
>> 1.8.5.5
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>> Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-08-11 15:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-07-30 12:17 [PATCH] s390/zcrypt: enable s390 hwrng to seed kernel entropy Ingo Tuchscherer
2014-08-11 13:56 ` Torsten Duwe
2014-08-11 15:11 ` Ingo Tuchscherer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox