1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright IBM Corp. 2019
4 * Author(s): Harald Freudenberger <freude@linux.ibm.com>
5 * Ingo Franzki <ifranzki@linux.ibm.com>
6 *
7 * Collection of CCA misc functions used by zcrypt and pkey
8 */
9
10 #define pr_fmt(fmt) "zcrypt: " fmt
11
12 #include <linux/export.h>
13 #include <linux/init.h>
14 #include <linux/mempool.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/random.h>
18 #include <linux/align.h>
19 #include <asm/zcrypt.h>
20 #include <asm/pkey.h>
21
22 #include "ap_bus.h"
23 #include "zcrypt_api.h"
24 #include "zcrypt_debug.h"
25 #include "zcrypt_msgtype6.h"
26 #include "zcrypt_ccamisc.h"
27
28 /* Size of parameter block used for all cca requests/replies */
29 #define PARMBSIZE 512
30
31 /* Size of vardata block used for some of the cca requests/replies */
32 #define VARDATASIZE 4096
33
34 /*
35 * Cprb memory pool held for urgent cases where no memory
36 * can be allocated via kmalloc. This pool is only used
37 * when alloc_and_prep_cprbmem() is called with the xflag
38 * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold
39 * space for request AND reply!
40 */
41 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024)
42 static mempool_t *cprb_mempool;
43
44 /*
45 * This is a pre-allocated memory for the device status array
46 * used within the findcard() functions. It is currently
47 * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is
48 * controlled via dev_status_mem_mutex. Needs adaption if more
49 * than 128 cards or domains to be are supported.
50 */
51 #define ZCRYPT_DEV_STATUS_CARD_MAX 128
52 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128
53 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \
54 ZCRYPT_DEV_STATUS_QUEUE_MAX)
55 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \
56 sizeof(struct zcrypt_device_status_ext))
57 static void *dev_status_mem;
58 static DEFINE_MUTEX(dev_status_mem_mutex);
59
60 /*
61 * Simple check if the token is a valid CCA secure AES data key
62 * token. If keybitsize is given, the bitsize of the key is
63 * also checked. Returns 0 on success or errno value on failure.
64 */
cca_check_secaeskeytoken(debug_info_t * dbg,int dbflvl,const u8 * token,u32 keysize,int keybitsize)65 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
66 const u8 *token, u32 keysize, int keybitsize)
67 {
68 struct secaeskeytoken *t = (struct secaeskeytoken *)token;
69
70 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
71
72 if (keysize < sizeof(*t)) {
73 if (dbg)
74 DBF("%s keysize %u < min token size %zu\n",
75 __func__, keysize, sizeof(*t));
76 return -EINVAL;
77 }
78 if (t->type != TOKTYPE_CCA_INTERNAL) {
79 if (dbg)
80 DBF("%s token check failed, type 0x%02x != 0x%02x\n",
81 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
82 return -EINVAL;
83 }
84 if (t->version != TOKVER_CCA_AES) {
85 if (dbg)
86 DBF("%s token check failed, version 0x%02x != 0x%02x\n",
87 __func__, (int)t->version, TOKVER_CCA_AES);
88 return -EINVAL;
89 }
90 if (keybitsize > 0 && t->bitsize != keybitsize) {
91 if (dbg)
92 DBF("%s token check failed, bitsize %d != %d\n",
93 __func__, (int)t->bitsize, keybitsize);
94 return -EINVAL;
95 }
96
97 #undef DBF
98
99 return 0;
100 }
101 EXPORT_SYMBOL(cca_check_secaeskeytoken);
102
103 /*
104 * Simple check if the token is a valid CCA secure AES cipher key
105 * token. If keybitsize is given, the bitsize of the key is
106 * also checked. If checkcpacfexport is enabled, the key is also
107 * checked for the export flag to allow CPACF export.
108 * Returns 0 on success or errno value on failure.
109 */
cca_check_secaescipherkey(debug_info_t * dbg,int dbflvl,const u8 * token,u32 keysize,int keybitsize,int checkcpacfexport)110 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl,
111 const u8 *token, u32 keysize,
112 int keybitsize, int checkcpacfexport)
113 {
114 struct cipherkeytoken *t = (struct cipherkeytoken *)token;
115 bool keybitsizeok = true;
116
117 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
118
119 if (keysize < sizeof(*t)) {
120 if (dbg)
121 DBF("%s keysize %u < min token size %zu\n",
122 __func__, keysize, sizeof(*t));
123 return -EINVAL;
124 }
125 if (t->type != TOKTYPE_CCA_INTERNAL) {
126 if (dbg)
127 DBF("%s token check failed, type 0x%02x != 0x%02x\n",
128 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
129 return -EINVAL;
130 }
131 if (t->version != TOKVER_CCA_VLSC) {
132 if (dbg)
133 DBF("%s token check failed, version 0x%02x != 0x%02x\n",
134 __func__, (int)t->version, TOKVER_CCA_VLSC);
135 return -EINVAL;
136 }
137 if (t->len > keysize) {
138 if (dbg)
139 DBF("%s token check failed, len %d > keysize %u\n",
140 __func__, (int)t->len, keysize);
141 return -EINVAL;
142 }
143 if (t->len < sizeof(*t)) {
144 if (dbg)
145 DBF("%s token check failed, len %d < min token size %zu\n",
146 __func__, (int)t->len, sizeof(*t));
147 return -EINVAL;
148 }
149 if (t->algtype != 0x02) {
150 if (dbg)
151 DBF("%s token check failed, algtype 0x%02x != 0x02\n",
152 __func__, (int)t->algtype);
153 return -EINVAL;
154 }
155 if (t->keytype != 0x0001) {
156 if (dbg)
157 DBF("%s token check failed, keytype 0x%04x != 0x0001\n",
158 __func__, (int)t->keytype);
159 return -EINVAL;
160 }
161 if (t->plfver != 0x00 && t->plfver != 0x01) {
162 if (dbg)
163 DBF("%s token check failed, unknown plfver 0x%02x\n",
164 __func__, (int)t->plfver);
165 return -EINVAL;
166 }
167 if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) {
168 if (dbg)
169 DBF("%s token check failed, unknown wpllen %d\n",
170 __func__, (int)t->wpllen);
171 return -EINVAL;
172 }
173 if (keybitsize > 0) {
174 switch (keybitsize) {
175 case 128:
176 if (t->wpllen != (t->plfver ? 640 : 512))
177 keybitsizeok = false;
178 break;
179 case 192:
180 if (t->wpllen != (t->plfver ? 640 : 576))
181 keybitsizeok = false;
182 break;
183 case 256:
184 if (t->wpllen != 640)
185 keybitsizeok = false;
186 break;
187 default:
188 keybitsizeok = false;
189 break;
190 }
191 if (!keybitsizeok) {
192 if (dbg)
193 DBF("%s token check failed, bitsize %d\n",
194 __func__, keybitsize);
195 return -EINVAL;
196 }
197 }
198 if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) {
199 if (dbg)
200 DBF("%s token check failed, XPRT_CPAC bit is 0\n",
201 __func__);
202 return -EINVAL;
203 }
204
205 #undef DBF
206
207 return 0;
208 }
209 EXPORT_SYMBOL(cca_check_secaescipherkey);
210
211 /*
212 * Simple check if the token is a valid CCA secure ECC private
213 * key token. Returns 0 on success or errno value on failure.
214 */
cca_check_sececckeytoken(debug_info_t * dbg,int dbflvl,const u8 * token,u32 keysize,int checkcpacfexport)215 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl,
216 const u8 *token, u32 keysize,
217 int checkcpacfexport)
218 {
219 struct eccprivkeytoken *t = (struct eccprivkeytoken *)token;
220
221 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
222
223 if (keysize < sizeof(*t)) {
224 if (dbg)
225 DBF("%s keysize %u < min token size %zu\n",
226 __func__, keysize, sizeof(*t));
227 return -EINVAL;
228 }
229 if (t->type != TOKTYPE_CCA_INTERNAL_PKA) {
230 if (dbg)
231 DBF("%s token check failed, type 0x%02x != 0x%02x\n",
232 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA);
233 return -EINVAL;
234 }
235 if (t->len > keysize) {
236 if (dbg)
237 DBF("%s token check failed, len %d > keysize %u\n",
238 __func__, (int)t->len, keysize);
239 return -EINVAL;
240 }
241 if (t->len < sizeof(*t)) {
242 if (dbg)
243 DBF("%s token check failed, len %d < min token size %zu\n",
244 __func__, (int)t->len, sizeof(*t));
245 return -EINVAL;
246 }
247 if (t->secid != 0x20) {
248 if (dbg)
249 DBF("%s token check failed, secid 0x%02x != 0x20\n",
250 __func__, (int)t->secid);
251 return -EINVAL;
252 }
253 if (checkcpacfexport && !(t->kutc & 0x01)) {
254 if (dbg)
255 DBF("%s token check failed, XPRTCPAC bit is 0\n",
256 __func__);
257 return -EINVAL;
258 }
259
260 #undef DBF
261
262 return 0;
263 }
264 EXPORT_SYMBOL(cca_check_sececckeytoken);
265
266 /*
267 * Allocate consecutive memory for request CPRB, request param
268 * block, reply CPRB and reply param block and fill in values
269 * for the common fields. Returns 0 on success or errno value
270 * on failure.
271 * It is guaranteed that request and a possible param block
272 * are aligned to a 4 byte boundary. Furthermore if a param
273 * block is used, the memory allocated for this is rounded up to
274 * the next multiple of 4 bytes.
275 */
alloc_and_prep_cprbmem(size_t paramblen,u8 ** p_cprb_mem,struct CPRBX ** p_req_cprb,struct CPRBX ** p_rep_cprb,u32 xflags)276 static int alloc_and_prep_cprbmem(size_t paramblen,
277 u8 **p_cprb_mem,
278 struct CPRBX **p_req_cprb,
279 struct CPRBX **p_rep_cprb,
280 u32 xflags)
281 {
282 u8 *cprbmem = NULL;
283 size_t cprbplusparamblen =
284 ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
285 size_t len = 2 * cprbplusparamblen;
286 struct CPRBX *preqcblk, *prepcblk;
287
288 /*
289 * allocate consecutive memory for request CPRB, request param
290 * block, reply CPRB and reply param block
291 */
292 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) {
293 if (len <= CPRB_MEMPOOL_ITEM_SIZE)
294 cprbmem = mempool_alloc_preallocated(cprb_mempool);
295 } else {
296 cprbmem = kmalloc(len, GFP_KERNEL);
297 }
298 if (!cprbmem)
299 return -ENOMEM;
300 memset(cprbmem, 0, len);
301
302 preqcblk = (struct CPRBX *)cprbmem;
303 prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen);
304
305 /* fill request cprb struct */
306 preqcblk->cprb_len = sizeof(struct CPRBX);
307 preqcblk->cprb_ver_id = 0x02;
308 memcpy(preqcblk->func_id, "T2", 2);
309 preqcblk->rpl_msgbl = cprbplusparamblen;
310 if (paramblen) {
311 preqcblk->req_parmb = ((u8 __user *)preqcblk) +
312 ALIGN(sizeof(struct CPRBX), 4);
313 preqcblk->rpl_parmb = ((u8 __user *)prepcblk) +
314 ALIGN(sizeof(struct CPRBX), 4);
315 }
316
317 *p_cprb_mem = cprbmem;
318 *p_req_cprb = preqcblk;
319 *p_rep_cprb = prepcblk;
320
321 return 0;
322 }
323
324 /*
325 * Free the cprb memory allocated with the function above.
326 * If the scrub value is not zero, the memory is filled
327 * with zeros before freeing (useful if there was some
328 * clear key material in there).
329 */
free_cprbmem(void * mem,size_t paramblen,bool scrub,u32 xflags)330 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags)
331 {
332 size_t cprblen = ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
333
334 if (mem && scrub)
335 memzero_explicit(mem, 2 * cprblen);
336
337 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC)
338 mempool_free(mem, cprb_mempool);
339 else
340 kfree(mem);
341 }
342
343 /*
344 * Helper function to prepare the xcrb struct
345 */
prep_xcrb(struct ica_xcRB * pxcrb,u16 cardnr,struct CPRBX * preqcblk,struct CPRBX * prepcblk)346 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
347 u16 cardnr,
348 struct CPRBX *preqcblk,
349 struct CPRBX *prepcblk)
350 {
351 memset(pxcrb, 0, sizeof(*pxcrb));
352 memcpy(&pxcrb->agent_ID, "CA", 2);
353 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
354 pxcrb->request_control_blk_length =
355 preqcblk->cprb_len + preqcblk->req_parml;
356 pxcrb->request_control_blk_addr = (void __user *)preqcblk;
357 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
358 pxcrb->reply_control_blk_addr = (void __user *)prepcblk;
359 }
360
361 /*
362 * Generate (random) CCA AES DATA secure key.
363 */
cca_genseckey(u16 cardnr,u16 domain,u32 keybitsize,u8 * seckey,u32 xflags)364 int cca_genseckey(u16 cardnr, u16 domain,
365 u32 keybitsize, u8 *seckey, u32 xflags)
366 {
367 int i, rc, keysize;
368 int seckeysize;
369 u8 *mem, *ptr;
370 struct CPRBX *preqcblk, *prepcblk;
371 struct ica_xcRB xcrb;
372 struct kgreqparm {
373 u8 subfunc_code[2];
374 u16 rule_array_len;
375 struct lv1 {
376 u16 len;
377 char key_form[8];
378 char key_length[8];
379 char key_type1[8];
380 char key_type2[8];
381 } lv1;
382 struct lv2 {
383 u16 len;
384 struct keyid {
385 u16 len;
386 u16 attr;
387 u8 data[SECKEYBLOBSIZE];
388 } keyid[6];
389 } lv2;
390 } __packed * preqparm;
391 struct kgrepparm {
392 u8 subfunc_code[2];
393 u16 rule_array_len;
394 struct lv3 {
395 u16 len;
396 u16 keyblocklen;
397 struct {
398 u16 toklen;
399 u16 tokattr;
400 u8 tok[];
401 /* ... some more data ... */
402 } keyblock;
403 } lv3;
404 } __packed * prepparm;
405
406 /* get already prepared memory for 2 cprbs with param block each */
407 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
408 &preqcblk, &prepcblk, xflags);
409 if (rc)
410 return rc;
411
412 /* fill request cprb struct */
413 preqcblk->domain = domain;
414
415 /* fill request cprb param block with KG request */
416 preqparm = (struct kgreqparm __force *)preqcblk->req_parmb;
417 memcpy(preqparm->subfunc_code, "KG", 2);
418 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
419 preqparm->lv1.len = sizeof(struct lv1);
420 memcpy(preqparm->lv1.key_form, "OP ", 8);
421 switch (keybitsize) {
422 case PKEY_SIZE_AES_128:
423 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
424 keysize = 16;
425 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
426 break;
427 case PKEY_SIZE_AES_192:
428 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
429 keysize = 24;
430 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
431 break;
432 case PKEY_SIZE_AES_256:
433 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
434 keysize = 32;
435 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
436 break;
437 default:
438 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
439 __func__, keybitsize);
440 rc = -EINVAL;
441 goto out;
442 }
443 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
444 preqparm->lv2.len = sizeof(struct lv2);
445 for (i = 0; i < 6; i++) {
446 preqparm->lv2.keyid[i].len = sizeof(struct keyid);
447 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
448 }
449 preqcblk->req_parml = sizeof(struct kgreqparm);
450
451 /* fill xcrb struct */
452 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
453
454 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
455 rc = zcrypt_send_cprb(&xcrb, xflags);
456 if (rc) {
457 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
458 __func__, (int)cardnr, (int)domain, rc);
459 goto out;
460 }
461
462 /* check response returncode and reasoncode */
463 if (prepcblk->ccp_rtcode != 0) {
464 ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n",
465 __func__,
466 (int)prepcblk->ccp_rtcode,
467 (int)prepcblk->ccp_rscode);
468 rc = -EIO;
469 goto out;
470 }
471
472 /* process response cprb param block */
473 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
474 prepcblk->rpl_parmb = (u8 __user *)ptr;
475 prepparm = (struct kgrepparm *)ptr;
476
477 /* check length of the returned secure key token */
478 seckeysize = prepparm->lv3.keyblock.toklen
479 - sizeof(prepparm->lv3.keyblock.toklen)
480 - sizeof(prepparm->lv3.keyblock.tokattr);
481 if (seckeysize != SECKEYBLOBSIZE) {
482 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
483 __func__, seckeysize, SECKEYBLOBSIZE);
484 rc = -EIO;
485 goto out;
486 }
487
488 /* check secure key token */
489 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
490 prepparm->lv3.keyblock.tok,
491 seckeysize, 8 * keysize);
492 if (rc) {
493 rc = -EIO;
494 goto out;
495 }
496
497 /* copy the generated secure key token */
498 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
499
500 out:
501 free_cprbmem(mem, PARMBSIZE, false, xflags);
502 return rc;
503 }
504 EXPORT_SYMBOL(cca_genseckey);
505
506 /*
507 * Generate an CCA AES DATA secure key with given key value.
508 */
cca_clr2seckey(u16 cardnr,u16 domain,u32 keybitsize,const u8 * clrkey,u8 * seckey,u32 xflags)509 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize,
510 const u8 *clrkey, u8 *seckey, u32 xflags)
511 {
512 int rc, keysize, seckeysize;
513 u8 *mem, *ptr;
514 struct CPRBX *preqcblk, *prepcblk;
515 struct ica_xcRB xcrb;
516 struct cmreqparm {
517 u8 subfunc_code[2];
518 u16 rule_array_len;
519 char rule_array[8];
520 struct lv1 {
521 u16 len;
522 u8 clrkey[];
523 } lv1;
524 /* followed by struct lv2 */
525 } __packed * preqparm;
526 struct lv2 {
527 u16 len;
528 struct keyid {
529 u16 len;
530 u16 attr;
531 u8 data[SECKEYBLOBSIZE];
532 } keyid;
533 } __packed * plv2;
534 struct cmrepparm {
535 u8 subfunc_code[2];
536 u16 rule_array_len;
537 struct lv3 {
538 u16 len;
539 u16 keyblocklen;
540 struct {
541 u16 toklen;
542 u16 tokattr;
543 u8 tok[];
544 /* ... some more data ... */
545 } keyblock;
546 } lv3;
547 } __packed * prepparm;
548
549 /* get already prepared memory for 2 cprbs with param block each */
550 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
551 &preqcblk, &prepcblk, xflags);
552 if (rc)
553 return rc;
554
555 /* fill request cprb struct */
556 preqcblk->domain = domain;
557
558 /* fill request cprb param block with CM request */
559 preqparm = (struct cmreqparm __force *)preqcblk->req_parmb;
560 memcpy(preqparm->subfunc_code, "CM", 2);
561 memcpy(preqparm->rule_array, "AES ", 8);
562 preqparm->rule_array_len =
563 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
564 switch (keybitsize) {
565 case PKEY_SIZE_AES_128:
566 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
567 keysize = 16;
568 break;
569 case PKEY_SIZE_AES_192:
570 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
571 keysize = 24;
572 break;
573 case PKEY_SIZE_AES_256:
574 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
575 keysize = 32;
576 break;
577 default:
578 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
579 __func__, keybitsize);
580 rc = -EINVAL;
581 goto out;
582 }
583 preqparm->lv1.len = sizeof(struct lv1) + keysize;
584 memcpy(preqparm->lv1.clrkey, clrkey, keysize);
585 plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize);
586 plv2->len = sizeof(struct lv2);
587 plv2->keyid.len = sizeof(struct keyid);
588 plv2->keyid.attr = 0x30;
589 preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2);
590
591 /* fill xcrb struct */
592 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
593
594 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
595 rc = zcrypt_send_cprb(&xcrb, xflags);
596 if (rc) {
597 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
598 __func__, (int)cardnr, (int)domain, rc);
599 goto out;
600 }
601
602 /* check response returncode and reasoncode */
603 if (prepcblk->ccp_rtcode != 0) {
604 ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n",
605 __func__,
606 (int)prepcblk->ccp_rtcode,
607 (int)prepcblk->ccp_rscode);
608 rc = -EIO;
609 goto out;
610 }
611
612 /* process response cprb param block */
613 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
614 prepcblk->rpl_parmb = (u8 __user *)ptr;
615 prepparm = (struct cmrepparm *)ptr;
616
617 /* check length of the returned secure key token */
618 seckeysize = prepparm->lv3.keyblock.toklen
619 - sizeof(prepparm->lv3.keyblock.toklen)
620 - sizeof(prepparm->lv3.keyblock.tokattr);
621 if (seckeysize != SECKEYBLOBSIZE) {
622 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
623 __func__, seckeysize, SECKEYBLOBSIZE);
624 rc = -EIO;
625 goto out;
626 }
627
628 /* check secure key token */
629 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
630 prepparm->lv3.keyblock.tok,
631 seckeysize, 8 * keysize);
632 if (rc) {
633 rc = -EIO;
634 goto out;
635 }
636
637 /* copy the generated secure key token */
638 if (seckey)
639 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
640
641 out:
642 free_cprbmem(mem, PARMBSIZE, true, xflags);
643 return rc;
644 }
645 EXPORT_SYMBOL(cca_clr2seckey);
646
647 /*
648 * Derive proteced key from an CCA AES DATA secure key.
649 */
cca_sec2protkey(u16 cardnr,u16 domain,const u8 * seckey,u8 * protkey,u32 * protkeylen,u32 * protkeytype,u32 xflags)650 int cca_sec2protkey(u16 cardnr, u16 domain,
651 const u8 *seckey, u8 *protkey, u32 *protkeylen,
652 u32 *protkeytype, u32 xflags)
653 {
654 int rc;
655 u8 *mem, *ptr;
656 struct CPRBX *preqcblk, *prepcblk;
657 struct ica_xcRB xcrb;
658 struct uskreqparm {
659 u8 subfunc_code[2];
660 u16 rule_array_len;
661 struct lv1 {
662 u16 len;
663 u16 attr_len;
664 u16 attr_flags;
665 } lv1;
666 struct lv2 {
667 u16 len;
668 u16 attr_len;
669 u16 attr_flags;
670 u8 token[]; /* cca secure key token */
671 } lv2;
672 } __packed * preqparm;
673 struct uskrepparm {
674 u8 subfunc_code[2];
675 u16 rule_array_len;
676 struct lv3 {
677 u16 len;
678 u16 attr_len;
679 u16 attr_flags;
680 struct cpacfkeyblock {
681 u8 version; /* version of this struct */
682 u8 flags[2];
683 u8 algo;
684 u8 form;
685 u8 pad1[3];
686 u16 len;
687 u8 key[64]; /* the key (len bytes) */
688 u16 keyattrlen;
689 u8 keyattr[32];
690 u8 pad2[1];
691 u8 vptype;
692 u8 vp[32]; /* verification pattern */
693 } ckb;
694 } lv3;
695 } __packed * prepparm;
696
697 /* get already prepared memory for 2 cprbs with param block each */
698 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
699 &preqcblk, &prepcblk, xflags);
700 if (rc)
701 return rc;
702
703 /* fill request cprb struct */
704 preqcblk->domain = domain;
705
706 /* fill request cprb param block with USK request */
707 preqparm = (struct uskreqparm __force *)preqcblk->req_parmb;
708 memcpy(preqparm->subfunc_code, "US", 2);
709 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
710 preqparm->lv1.len = sizeof(struct lv1);
711 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
712 preqparm->lv1.attr_flags = 0x0001;
713 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
714 preqparm->lv2.attr_len = sizeof(struct lv2)
715 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
716 preqparm->lv2.attr_flags = 0x0000;
717 memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
718 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
719
720 /* fill xcrb struct */
721 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
722
723 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
724 rc = zcrypt_send_cprb(&xcrb, xflags);
725 if (rc) {
726 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
727 __func__, (int)cardnr, (int)domain, rc);
728 goto out;
729 }
730
731 /* check response returncode and reasoncode */
732 if (prepcblk->ccp_rtcode != 0) {
733 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
734 __func__,
735 (int)prepcblk->ccp_rtcode,
736 (int)prepcblk->ccp_rscode);
737 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
738 rc = -EBUSY;
739 else
740 rc = -EIO;
741 goto out;
742 }
743 if (prepcblk->ccp_rscode != 0) {
744 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
745 __func__,
746 (int)prepcblk->ccp_rtcode,
747 (int)prepcblk->ccp_rscode);
748 }
749
750 /* process response cprb param block */
751 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
752 prepcblk->rpl_parmb = (u8 __user *)ptr;
753 prepparm = (struct uskrepparm *)ptr;
754
755 /* check the returned keyblock */
756 if (prepparm->lv3.ckb.version != 0x01 &&
757 prepparm->lv3.ckb.version != 0x02) {
758 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
759 __func__, (int)prepparm->lv3.ckb.version);
760 rc = -EIO;
761 goto out;
762 }
763
764 /* copy the translated protected key */
765 switch (prepparm->lv3.ckb.len) {
766 case 16 + 32:
767 /* AES 128 protected key */
768 if (protkeytype)
769 *protkeytype = PKEY_KEYTYPE_AES_128;
770 break;
771 case 24 + 32:
772 /* AES 192 protected key */
773 if (protkeytype)
774 *protkeytype = PKEY_KEYTYPE_AES_192;
775 break;
776 case 32 + 32:
777 /* AES 256 protected key */
778 if (protkeytype)
779 *protkeytype = PKEY_KEYTYPE_AES_256;
780 break;
781 default:
782 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
783 __func__, prepparm->lv3.ckb.len);
784 rc = -EIO;
785 goto out;
786 }
787 memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len);
788 if (protkeylen)
789 *protkeylen = prepparm->lv3.ckb.len;
790
791 out:
792 free_cprbmem(mem, PARMBSIZE, true, xflags);
793 return rc;
794 }
795 EXPORT_SYMBOL(cca_sec2protkey);
796
797 /*
798 * AES cipher key skeleton created with CSNBKTB2 with these flags:
799 * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY,
800 * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA
801 * used by cca_gencipherkey() and cca_clr2cipherkey().
802 */
803 static const u8 aes_cipher_key_skeleton[] = {
804 0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00,
805 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
806 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
807 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
808 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
809 0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff,
810 0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 };
811 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton))
812
813 /*
814 * Generate (random) CCA AES CIPHER secure key.
815 */
cca_gencipherkey(u16 cardnr,u16 domain,u32 keybitsize,u32 keygenflags,u8 * keybuf,u32 * keybufsize,u32 xflags)816 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
817 u8 *keybuf, u32 *keybufsize, u32 xflags)
818 {
819 int rc;
820 u8 *mem, *ptr;
821 struct CPRBX *preqcblk, *prepcblk;
822 struct ica_xcRB xcrb;
823 struct gkreqparm {
824 u8 subfunc_code[2];
825 u16 rule_array_len;
826 char rule_array[2 * 8];
827 struct {
828 u16 len;
829 u8 key_type_1[8];
830 u8 key_type_2[8];
831 u16 clear_key_bit_len;
832 u16 key_name_1_len;
833 u16 key_name_2_len;
834 u16 user_data_1_len;
835 u16 user_data_2_len;
836 /* u8 key_name_1[]; */
837 /* u8 key_name_2[]; */
838 /* u8 user_data_1[]; */
839 /* u8 user_data_2[]; */
840 } vud;
841 struct {
842 u16 len;
843 struct {
844 u16 len;
845 u16 flag;
846 /* u8 kek_id_1[]; */
847 } tlv1;
848 struct {
849 u16 len;
850 u16 flag;
851 /* u8 kek_id_2[]; */
852 } tlv2;
853 struct {
854 u16 len;
855 u16 flag;
856 u8 gen_key_id_1[SIZEOF_SKELETON];
857 } tlv3;
858 struct {
859 u16 len;
860 u16 flag;
861 /* u8 gen_key_id_1_label[]; */
862 } tlv4;
863 struct {
864 u16 len;
865 u16 flag;
866 /* u8 gen_key_id_2[]; */
867 } tlv5;
868 struct {
869 u16 len;
870 u16 flag;
871 /* u8 gen_key_id_2_label[]; */
872 } tlv6;
873 } kb;
874 } __packed * preqparm;
875 struct gkrepparm {
876 u8 subfunc_code[2];
877 u16 rule_array_len;
878 struct {
879 u16 len;
880 } vud;
881 struct {
882 u16 len;
883 struct {
884 u16 len;
885 u16 flag;
886 u8 gen_key[]; /* 120-136 bytes */
887 } tlv1;
888 } kb;
889 } __packed * prepparm;
890 struct cipherkeytoken *t;
891 u32 keybuflen;
892
893 /* get already prepared memory for 2 cprbs with param block each */
894 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
895 &preqcblk, &prepcblk, xflags);
896 if (rc)
897 return rc;
898
899 /* fill request cprb struct */
900 preqcblk->domain = domain;
901 preqcblk->req_parml = sizeof(struct gkreqparm);
902
903 /* prepare request param block with GK request */
904 preqparm = (struct gkreqparm __force *)preqcblk->req_parmb;
905 memcpy(preqparm->subfunc_code, "GK", 2);
906 preqparm->rule_array_len = sizeof(uint16_t) + 2 * 8;
907 memcpy(preqparm->rule_array, "AES OP ", 2 * 8);
908
909 /* prepare vud block */
910 preqparm->vud.len = sizeof(preqparm->vud);
911 switch (keybitsize) {
912 case 128:
913 case 192:
914 case 256:
915 break;
916 default:
917 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
918 __func__, keybitsize);
919 rc = -EINVAL;
920 goto out;
921 }
922 preqparm->vud.clear_key_bit_len = keybitsize;
923 memcpy(preqparm->vud.key_type_1, "TOKEN ", 8);
924 memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2));
925
926 /* prepare kb block */
927 preqparm->kb.len = sizeof(preqparm->kb);
928 preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1);
929 preqparm->kb.tlv1.flag = 0x0030;
930 preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2);
931 preqparm->kb.tlv2.flag = 0x0030;
932 preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3);
933 preqparm->kb.tlv3.flag = 0x0030;
934 memcpy(preqparm->kb.tlv3.gen_key_id_1,
935 aes_cipher_key_skeleton, SIZEOF_SKELETON);
936 preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4);
937 preqparm->kb.tlv4.flag = 0x0030;
938 preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5);
939 preqparm->kb.tlv5.flag = 0x0030;
940 preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6);
941 preqparm->kb.tlv6.flag = 0x0030;
942
943 /* patch the skeleton key token export flags inside the kb block */
944 if (keygenflags) {
945 t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1;
946 t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
947 t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
948 }
949
950 /* prepare xcrb struct */
951 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
952
953 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
954 rc = zcrypt_send_cprb(&xcrb, xflags);
955 if (rc) {
956 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
957 __func__, (int)cardnr, (int)domain, rc);
958 goto out;
959 }
960
961 /* check response returncode and reasoncode */
962 if (prepcblk->ccp_rtcode != 0) {
963 ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n",
964 __func__,
965 (int)prepcblk->ccp_rtcode,
966 (int)prepcblk->ccp_rscode);
967 rc = -EIO;
968 goto out;
969 }
970
971 /* process response cprb param block */
972 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
973 prepcblk->rpl_parmb = (u8 __user *)ptr;
974 prepparm = (struct gkrepparm *)ptr;
975
976 /* do some plausibility checks on the key block */
977 if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
978 prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
979 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
980 __func__);
981 rc = -EIO;
982 goto out;
983 }
984
985 /* and some checks on the generated key */
986 t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key;
987 if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) {
988 rc = -EIO;
989 goto out;
990 }
991 keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t);
992 rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR,
993 prepparm->kb.tlv1.gen_key,
994 keybuflen, keybitsize, 1);
995 if (rc) {
996 rc = -EIO;
997 goto out;
998 }
999
1000 /* copy the generated vlsc key token */
1001 if (keybuf) {
1002 if (*keybufsize >= keybuflen)
1003 memcpy(keybuf, t, keybuflen);
1004 else
1005 rc = -EINVAL;
1006 }
1007 *keybufsize = keybuflen;
1008
1009 out:
1010 free_cprbmem(mem, PARMBSIZE, false, xflags);
1011 return rc;
1012 }
1013 EXPORT_SYMBOL(cca_gencipherkey);
1014
1015 /*
1016 * Helper function, does a the CSNBKPI2 CPRB.
1017 */
_ip_cprb_helper(u16 cardnr,u16 domain,const char * rule_array_1,const char * rule_array_2,const char * rule_array_3,const u8 * clr_key_value,int clr_key_bit_size,u8 * key_token,int * key_token_size,u32 xflags,bool scrub)1018 static int _ip_cprb_helper(u16 cardnr, u16 domain,
1019 const char *rule_array_1,
1020 const char *rule_array_2,
1021 const char *rule_array_3,
1022 const u8 *clr_key_value,
1023 int clr_key_bit_size,
1024 u8 *key_token,
1025 int *key_token_size,
1026 u32 xflags,
1027 bool scrub)
1028 {
1029 int rc, n;
1030 u8 *mem, *ptr;
1031 struct CPRBX *preqcblk, *prepcblk;
1032 struct ica_xcRB xcrb;
1033 struct rule_array_block {
1034 u8 subfunc_code[2];
1035 u16 rule_array_len;
1036 char rule_array[];
1037 } __packed * preq_ra_block;
1038 struct vud_block {
1039 u16 len;
1040 struct {
1041 u16 len;
1042 u16 flag; /* 0x0064 */
1043 u16 clr_key_bit_len;
1044 } tlv1;
1045 struct {
1046 u16 len;
1047 u16 flag; /* 0x0063 */
1048 u8 clr_key[]; /* clear key value bytes */
1049 } tlv2;
1050 } __packed * preq_vud_block;
1051 struct key_block {
1052 u16 len;
1053 struct {
1054 u16 len;
1055 u16 flag; /* 0x0030 */
1056 u8 key_token[]; /* key skeleton */
1057 } tlv1;
1058 } __packed * preq_key_block;
1059 struct iprepparm {
1060 u8 subfunc_code[2];
1061 u16 rule_array_len;
1062 struct {
1063 u16 len;
1064 } vud;
1065 struct {
1066 u16 len;
1067 struct {
1068 u16 len;
1069 u16 flag; /* 0x0030 */
1070 u8 key_token[]; /* key token */
1071 } tlv1;
1072 } kb;
1073 } __packed * prepparm;
1074 struct cipherkeytoken *t;
1075 int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1;
1076
1077 /* get already prepared memory for 2 cprbs with param block each */
1078 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1079 &preqcblk, &prepcblk, xflags);
1080 if (rc)
1081 return rc;
1082
1083 /* fill request cprb struct */
1084 preqcblk->domain = domain;
1085 preqcblk->req_parml = 0;
1086
1087 /* prepare request param block with IP request */
1088 preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb;
1089 memcpy(preq_ra_block->subfunc_code, "IP", 2);
1090 preq_ra_block->rule_array_len = sizeof(uint16_t) + 2 * 8;
1091 memcpy(preq_ra_block->rule_array, rule_array_1, 8);
1092 memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8);
1093 preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8;
1094 if (rule_array_3) {
1095 preq_ra_block->rule_array_len += 8;
1096 memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8);
1097 preqcblk->req_parml += 8;
1098 }
1099
1100 /* prepare vud block */
1101 preq_vud_block = (struct vud_block __force *)
1102 (preqcblk->req_parmb + preqcblk->req_parml);
1103 n = complete ? 0 : (clr_key_bit_size + 7) / 8;
1104 preq_vud_block->len = sizeof(struct vud_block) + n;
1105 preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1);
1106 preq_vud_block->tlv1.flag = 0x0064;
1107 preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size;
1108 preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n;
1109 preq_vud_block->tlv2.flag = 0x0063;
1110 if (!complete)
1111 memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n);
1112 preqcblk->req_parml += preq_vud_block->len;
1113
1114 /* prepare key block */
1115 preq_key_block = (struct key_block __force *)
1116 (preqcblk->req_parmb + preqcblk->req_parml);
1117 n = *key_token_size;
1118 preq_key_block->len = sizeof(struct key_block) + n;
1119 preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n;
1120 preq_key_block->tlv1.flag = 0x0030;
1121 memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size);
1122 preqcblk->req_parml += preq_key_block->len;
1123
1124 /* prepare xcrb struct */
1125 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1126
1127 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1128 rc = zcrypt_send_cprb(&xcrb, xflags);
1129 if (rc) {
1130 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1131 __func__, (int)cardnr, (int)domain, rc);
1132 goto out;
1133 }
1134
1135 /* check response returncode and reasoncode */
1136 if (prepcblk->ccp_rtcode != 0) {
1137 ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n",
1138 __func__,
1139 (int)prepcblk->ccp_rtcode,
1140 (int)prepcblk->ccp_rscode);
1141 rc = -EIO;
1142 goto out;
1143 }
1144
1145 /* process response cprb param block */
1146 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1147 prepcblk->rpl_parmb = (u8 __user *)ptr;
1148 prepparm = (struct iprepparm *)ptr;
1149
1150 /* do some plausibility checks on the key block */
1151 if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
1152 prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
1153 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
1154 __func__);
1155 rc = -EIO;
1156 goto out;
1157 }
1158
1159 /* do not check the key here, it may be incomplete */
1160
1161 /*
1162 * Copy the vlsc key token back.
1163 * The available space in the destination (key_token) and the source
1164 * (t) buffer is always larger as the valid range of prepparm->kb.len.
1165 * Validate t->len by comparing it with the length information in the
1166 * param block of the request (prepparm->kb.len)
1167 * The value range of prepparm->kb.len has been checked above.
1168 */
1169 t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
1170 if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) {
1171 ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n",
1172 __func__, t->len);
1173 rc = -EIO;
1174 goto out;
1175 }
1176 memcpy(key_token, t, t->len);
1177 *key_token_size = t->len;
1178
1179 out:
1180 free_cprbmem(mem, PARMBSIZE, scrub, xflags);
1181 return rc;
1182 }
1183
1184 /*
1185 * Build CCA AES CIPHER secure key with a given clear key value.
1186 */
cca_clr2cipherkey(u16 card,u16 dom,u32 keybitsize,u32 keygenflags,const u8 * clrkey,u8 * keybuf,u32 * keybufsize,u32 xflags)1187 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
1188 const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags)
1189 {
1190 int rc;
1191 void *mem;
1192 int tokensize;
1193 u8 *token, exorbuf[32];
1194 struct cipherkeytoken *t;
1195
1196 /* fill exorbuf with random data */
1197 get_random_bytes(exorbuf, sizeof(exorbuf));
1198
1199 /*
1200 * Allocate space for the key token to build.
1201 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this
1202 * we use the already existing cprb mempool to solve this
1203 * short term memory requirement.
1204 */
1205 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1206 mempool_alloc_preallocated(cprb_mempool) :
1207 mempool_alloc(cprb_mempool, GFP_KERNEL);
1208 if (!mem)
1209 return -ENOMEM;
1210
1211 /* prepare the token with the key skeleton */
1212 token = (u8 *)mem;
1213 tokensize = SIZEOF_SKELETON;
1214 memcpy(token, aes_cipher_key_skeleton, tokensize);
1215
1216 /* patch the skeleton key token export flags */
1217 if (keygenflags) {
1218 t = (struct cipherkeytoken *)token;
1219 t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
1220 t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
1221 }
1222
1223 /*
1224 * Do the key import with the clear key value in 4 steps:
1225 * 1/4 FIRST import with only random data
1226 * 2/4 EXOR the clear key
1227 * 3/4 EXOR the very same random data again
1228 * 4/4 COMPLETE the secure cipher key import
1229 */
1230 rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
1231 exorbuf, keybitsize, token, &tokensize,
1232 xflags, true);
1233 if (rc) {
1234 ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
1235 __func__, rc);
1236 goto out;
1237 }
1238 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
1239 clrkey, keybitsize, token, &tokensize,
1240 xflags, true);
1241 if (rc) {
1242 ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
1243 __func__, rc);
1244 goto out;
1245 }
1246 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
1247 exorbuf, keybitsize, token, &tokensize,
1248 xflags, true);
1249 if (rc) {
1250 ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
1251 __func__, rc);
1252 goto out;
1253 }
1254 rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
1255 NULL, keybitsize, token, &tokensize,
1256 xflags, true);
1257 if (rc) {
1258 ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
1259 __func__, rc);
1260 goto out;
1261 }
1262
1263 /* copy the generated key token */
1264 if (keybuf) {
1265 if (tokensize > *keybufsize)
1266 rc = -EINVAL;
1267 else
1268 memcpy(keybuf, token, tokensize);
1269 }
1270 *keybufsize = tokensize;
1271
1272 out:
1273 memzero_explicit(exorbuf, sizeof(exorbuf));
1274 memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE);
1275 mempool_free(mem, cprb_mempool);
1276 return rc;
1277 }
1278 EXPORT_SYMBOL(cca_clr2cipherkey);
1279
1280 /*
1281 * Derive proteced key from CCA AES cipher secure key.
1282 */
cca_cipher2protkey(u16 cardnr,u16 domain,const u8 * ckey,u8 * protkey,u32 * protkeylen,u32 * protkeytype,u32 xflags)1283 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
1284 u8 *protkey, u32 *protkeylen, u32 *protkeytype,
1285 u32 xflags)
1286 {
1287 int rc;
1288 u8 *mem, *ptr;
1289 struct CPRBX *preqcblk, *prepcblk;
1290 struct ica_xcRB xcrb;
1291 struct aureqparm {
1292 u8 subfunc_code[2];
1293 u16 rule_array_len;
1294 u8 rule_array[8];
1295 struct {
1296 u16 len;
1297 u16 tk_blob_len;
1298 u16 tk_blob_tag;
1299 u8 tk_blob[66];
1300 } vud;
1301 struct {
1302 u16 len;
1303 u16 cca_key_token_len;
1304 u16 cca_key_token_flags;
1305 u8 cca_key_token[]; /* 64 or more */
1306 } kb;
1307 } __packed * preqparm;
1308 struct aurepparm {
1309 u8 subfunc_code[2];
1310 u16 rule_array_len;
1311 struct {
1312 u16 len;
1313 u16 sublen;
1314 u16 tag;
1315 struct cpacfkeyblock {
1316 u8 version; /* version of this struct */
1317 u8 flags[2];
1318 u8 algo;
1319 u8 form;
1320 u8 pad1[3];
1321 u16 keylen;
1322 u8 key[64]; /* the key (keylen bytes) */
1323 u16 keyattrlen;
1324 u8 keyattr[32];
1325 u8 pad2[1];
1326 u8 vptype;
1327 u8 vp[32]; /* verification pattern */
1328 } ckb;
1329 } vud;
1330 struct {
1331 u16 len;
1332 } kb;
1333 } __packed * prepparm;
1334 int keytoklen = ((struct cipherkeytoken *)ckey)->len;
1335
1336 if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
1337 return -EINVAL;
1338
1339 /* get already prepared memory for 2 cprbs with param block each */
1340 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1341 &preqcblk, &prepcblk, xflags);
1342 if (rc)
1343 return rc;
1344
1345 /* fill request cprb struct */
1346 preqcblk->domain = domain;
1347
1348 /* fill request cprb param block with AU request */
1349 preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1350 memcpy(preqparm->subfunc_code, "AU", 2);
1351 preqparm->rule_array_len =
1352 sizeof(preqparm->rule_array_len)
1353 + sizeof(preqparm->rule_array);
1354 memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1355 /* vud, tk blob */
1356 preqparm->vud.len = sizeof(preqparm->vud);
1357 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1358 + 2 * sizeof(uint16_t);
1359 preqparm->vud.tk_blob_tag = 0x00C2;
1360 /* kb, cca token */
1361 preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t);
1362 preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t);
1363 memcpy(preqparm->kb.cca_key_token, ckey, keytoklen);
1364 /* now fill length of param block into cprb */
1365 preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen;
1366
1367 /* fill xcrb struct */
1368 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1369
1370 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1371 rc = zcrypt_send_cprb(&xcrb, xflags);
1372 if (rc) {
1373 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1374 __func__, (int)cardnr, (int)domain, rc);
1375 goto out;
1376 }
1377
1378 /* check response returncode and reasoncode */
1379 if (prepcblk->ccp_rtcode != 0) {
1380 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1381 __func__,
1382 (int)prepcblk->ccp_rtcode,
1383 (int)prepcblk->ccp_rscode);
1384 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1385 rc = -EBUSY;
1386 else
1387 rc = -EIO;
1388 goto out;
1389 }
1390 if (prepcblk->ccp_rscode != 0) {
1391 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1392 __func__,
1393 (int)prepcblk->ccp_rtcode,
1394 (int)prepcblk->ccp_rscode);
1395 }
1396
1397 /* process response cprb param block */
1398 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1399 prepcblk->rpl_parmb = (u8 __user *)ptr;
1400 prepparm = (struct aurepparm *)ptr;
1401
1402 /* check the returned keyblock */
1403 if (prepparm->vud.ckb.version != 0x01 &&
1404 prepparm->vud.ckb.version != 0x02) {
1405 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
1406 __func__, (int)prepparm->vud.ckb.version);
1407 rc = -EIO;
1408 goto out;
1409 }
1410 if (prepparm->vud.ckb.algo != 0x02) {
1411 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
1412 __func__, (int)prepparm->vud.ckb.algo);
1413 rc = -EIO;
1414 goto out;
1415 }
1416
1417 /* copy the translated protected key */
1418 switch (prepparm->vud.ckb.keylen) {
1419 case 16 + 32:
1420 /* AES 128 protected key */
1421 if (protkeytype)
1422 *protkeytype = PKEY_KEYTYPE_AES_128;
1423 break;
1424 case 24 + 32:
1425 /* AES 192 protected key */
1426 if (protkeytype)
1427 *protkeytype = PKEY_KEYTYPE_AES_192;
1428 break;
1429 case 32 + 32:
1430 /* AES 256 protected key */
1431 if (protkeytype)
1432 *protkeytype = PKEY_KEYTYPE_AES_256;
1433 break;
1434 default:
1435 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
1436 __func__, prepparm->vud.ckb.keylen);
1437 rc = -EIO;
1438 goto out;
1439 }
1440 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1441 if (protkeylen)
1442 *protkeylen = prepparm->vud.ckb.keylen;
1443
1444 out:
1445 free_cprbmem(mem, PARMBSIZE, true, xflags);
1446 return rc;
1447 }
1448 EXPORT_SYMBOL(cca_cipher2protkey);
1449
1450 /*
1451 * Derive protected key from CCA ECC secure private key.
1452 */
cca_ecc2protkey(u16 cardnr,u16 domain,const u8 * key,u8 * protkey,u32 * protkeylen,u32 * protkeytype,u32 xflags)1453 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
1454 u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags)
1455 {
1456 int rc;
1457 u8 *mem, *ptr;
1458 struct CPRBX *preqcblk, *prepcblk;
1459 struct ica_xcRB xcrb;
1460 struct aureqparm {
1461 u8 subfunc_code[2];
1462 u16 rule_array_len;
1463 u8 rule_array[8];
1464 struct {
1465 u16 len;
1466 u16 tk_blob_len;
1467 u16 tk_blob_tag;
1468 u8 tk_blob[66];
1469 } vud;
1470 struct {
1471 u16 len;
1472 u16 cca_key_token_len;
1473 u16 cca_key_token_flags;
1474 u8 cca_key_token[];
1475 } kb;
1476 } __packed * preqparm;
1477 struct aurepparm {
1478 u8 subfunc_code[2];
1479 u16 rule_array_len;
1480 struct {
1481 u16 len;
1482 u16 sublen;
1483 u16 tag;
1484 struct cpacfkeyblock {
1485 u8 version; /* version of this struct */
1486 u8 flags[2];
1487 u8 algo;
1488 u8 form;
1489 u8 pad1[3];
1490 u16 keylen;
1491 u8 key[]; /* the key (keylen bytes) */
1492 /* u16 keyattrlen; */
1493 /* u8 keyattr[32]; */
1494 /* u8 pad2[1]; */
1495 /* u8 vptype; */
1496 /* u8 vp[32]; verification pattern */
1497 } ckb;
1498 } vud;
1499 /* followed by a key block */
1500 } __packed * prepparm;
1501 int keylen = ((struct eccprivkeytoken *)key)->len;
1502
1503 if (keylen > PARMBSIZE - sizeof(struct aureqparm))
1504 return -EINVAL;
1505
1506 /* get already prepared memory for 2 cprbs with param block each */
1507 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1508 &preqcblk, &prepcblk, xflags);
1509 if (rc)
1510 return rc;
1511
1512 /* fill request cprb struct */
1513 preqcblk->domain = domain;
1514
1515 /* fill request cprb param block with AU request */
1516 preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1517 memcpy(preqparm->subfunc_code, "AU", 2);
1518 preqparm->rule_array_len =
1519 sizeof(preqparm->rule_array_len)
1520 + sizeof(preqparm->rule_array);
1521 memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1522 /* vud, tk blob */
1523 preqparm->vud.len = sizeof(preqparm->vud);
1524 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1525 + 2 * sizeof(uint16_t);
1526 preqparm->vud.tk_blob_tag = 0x00C2;
1527 /* kb, cca token */
1528 preqparm->kb.len = keylen + 3 * sizeof(uint16_t);
1529 preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t);
1530 memcpy(preqparm->kb.cca_key_token, key, keylen);
1531 /* now fill length of param block into cprb */
1532 preqcblk->req_parml = sizeof(struct aureqparm) + keylen;
1533
1534 /* fill xcrb struct */
1535 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1536
1537 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1538 rc = zcrypt_send_cprb(&xcrb, xflags);
1539 if (rc) {
1540 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1541 __func__, (int)cardnr, (int)domain, rc);
1542 goto out;
1543 }
1544
1545 /* check response returncode and reasoncode */
1546 if (prepcblk->ccp_rtcode != 0) {
1547 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1548 __func__,
1549 (int)prepcblk->ccp_rtcode,
1550 (int)prepcblk->ccp_rscode);
1551 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1552 rc = -EBUSY;
1553 else
1554 rc = -EIO;
1555 goto out;
1556 }
1557 if (prepcblk->ccp_rscode != 0) {
1558 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1559 __func__,
1560 (int)prepcblk->ccp_rtcode,
1561 (int)prepcblk->ccp_rscode);
1562 }
1563
1564 /* process response cprb param block */
1565 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1566 prepcblk->rpl_parmb = (u8 __user *)ptr;
1567 prepparm = (struct aurepparm *)ptr;
1568
1569 /* check the returned keyblock */
1570 if (prepparm->vud.ckb.version != 0x02) {
1571 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
1572 __func__, (int)prepparm->vud.ckb.version);
1573 rc = -EIO;
1574 goto out;
1575 }
1576 if (prepparm->vud.ckb.algo != 0x81) {
1577 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
1578 __func__, (int)prepparm->vud.ckb.algo);
1579 rc = -EIO;
1580 goto out;
1581 }
1582
1583 /* copy the translated protected key */
1584 if (prepparm->vud.ckb.keylen > *protkeylen) {
1585 ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n",
1586 __func__, prepparm->vud.ckb.keylen, *protkeylen);
1587 rc = -EIO;
1588 goto out;
1589 }
1590 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1591 *protkeylen = prepparm->vud.ckb.keylen;
1592 if (protkeytype)
1593 *protkeytype = PKEY_KEYTYPE_ECC;
1594
1595 out:
1596 free_cprbmem(mem, PARMBSIZE, true, xflags);
1597 return rc;
1598 }
1599 EXPORT_SYMBOL(cca_ecc2protkey);
1600
1601 /*
1602 * query cryptographic facility from CCA adapter
1603 */
cca_query_crypto_facility(u16 cardnr,u16 domain,const char * keyword,u8 * rarray,size_t * rarraylen,u8 * varray,size_t * varraylen,u32 xflags)1604 int cca_query_crypto_facility(u16 cardnr, u16 domain,
1605 const char *keyword,
1606 u8 *rarray, size_t *rarraylen,
1607 u8 *varray, size_t *varraylen,
1608 u32 xflags)
1609 {
1610 int rc;
1611 u16 len;
1612 u8 *mem, *ptr;
1613 struct CPRBX *preqcblk, *prepcblk;
1614 struct ica_xcRB xcrb;
1615 struct fqreqparm {
1616 u8 subfunc_code[2];
1617 u16 rule_array_len;
1618 char rule_array[8];
1619 struct lv1 {
1620 u16 len;
1621 u8 data[VARDATASIZE];
1622 } lv1;
1623 u16 dummylen;
1624 } __packed * preqparm;
1625 size_t parmbsize = sizeof(struct fqreqparm);
1626 struct fqrepparm {
1627 u8 subfunc_code[2];
1628 u8 lvdata[];
1629 } __packed * prepparm;
1630
1631 /* get already prepared memory for 2 cprbs with param block each */
1632 rc = alloc_and_prep_cprbmem(parmbsize, &mem,
1633 &preqcblk, &prepcblk, xflags);
1634 if (rc)
1635 return rc;
1636
1637 /* fill request cprb struct */
1638 preqcblk->domain = domain;
1639
1640 /* fill request cprb param block with FQ request */
1641 preqparm = (struct fqreqparm __force *)preqcblk->req_parmb;
1642 memcpy(preqparm->subfunc_code, "FQ", 2);
1643 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
1644 preqparm->rule_array_len =
1645 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
1646 preqparm->lv1.len = sizeof(preqparm->lv1);
1647 preqparm->dummylen = sizeof(preqparm->dummylen);
1648 preqcblk->req_parml = parmbsize;
1649
1650 /* fill xcrb struct */
1651 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1652
1653 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1654 rc = zcrypt_send_cprb(&xcrb, xflags);
1655 if (rc) {
1656 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1657 __func__, (int)cardnr, (int)domain, rc);
1658 goto out;
1659 }
1660
1661 /* check response returncode and reasoncode */
1662 if (prepcblk->ccp_rtcode != 0) {
1663 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1664 __func__,
1665 (int)prepcblk->ccp_rtcode,
1666 (int)prepcblk->ccp_rscode);
1667 rc = -EIO;
1668 goto out;
1669 }
1670
1671 /* process response cprb param block */
1672 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1673 prepcblk->rpl_parmb = (u8 __user *)ptr;
1674 prepparm = (struct fqrepparm *)ptr;
1675 ptr = prepparm->lvdata;
1676
1677 /* check and possibly copy reply rule array */
1678 len = *((u16 *)ptr);
1679 if (len > sizeof(u16)) {
1680 ptr += sizeof(u16);
1681 len -= sizeof(u16);
1682 if (rarray && rarraylen && *rarraylen > 0) {
1683 *rarraylen = (len > *rarraylen ? *rarraylen : len);
1684 memcpy(rarray, ptr, *rarraylen);
1685 }
1686 ptr += len;
1687 }
1688 /* check and possible copy reply var array */
1689 len = *((u16 *)ptr);
1690 if (len > sizeof(u16)) {
1691 ptr += sizeof(u16);
1692 len -= sizeof(u16);
1693 if (varray && varraylen && *varraylen > 0) {
1694 *varraylen = (len > *varraylen ? *varraylen : len);
1695 memcpy(varray, ptr, *varraylen);
1696 }
1697 ptr += len;
1698 }
1699
1700 out:
1701 free_cprbmem(mem, parmbsize, false, xflags);
1702 return rc;
1703 }
1704 EXPORT_SYMBOL(cca_query_crypto_facility);
1705
1706 /*
1707 * Fetch cca_info values about a CCA queue via
1708 * query_crypto_facility from adapter.
1709 */
cca_get_info(u16 cardnr,u16 domain,struct cca_info * ci,u32 xflags)1710 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags)
1711 {
1712 void *mem;
1713 int rc, found = 0;
1714 size_t rlen, vlen;
1715 u8 *rarray, *varray;
1716 struct zcrypt_device_status_ext devstat;
1717
1718 memset(ci, 0, sizeof(*ci));
1719
1720 /* if specific domain given, fetch status and hw info for this apqn */
1721 if (domain != AUTOSEL_DOM) {
1722 rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
1723 if (rc)
1724 return rc;
1725 ci->hwtype = devstat.hwtype;
1726 }
1727
1728 /*
1729 * Prep memory for rule array and var array use.
1730 * Use the cprb mempool for this.
1731 */
1732 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1733 mempool_alloc_preallocated(cprb_mempool) :
1734 mempool_alloc(cprb_mempool, GFP_KERNEL);
1735 if (!mem)
1736 return -ENOMEM;
1737 rarray = (u8 *)mem;
1738 varray = (u8 *)mem + PAGE_SIZE / 2;
1739 rlen = vlen = PAGE_SIZE / 2;
1740
1741 /* QF for this card/domain */
1742 rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
1743 rarray, &rlen, varray, &vlen, xflags);
1744 if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) {
1745 memcpy(ci->serial, rarray, 8);
1746 ci->new_asym_mk_state = (char)rarray[4 * 8];
1747 ci->cur_asym_mk_state = (char)rarray[5 * 8];
1748 ci->old_asym_mk_state = (char)rarray[6 * 8];
1749 if (ci->old_asym_mk_state == '2')
1750 memcpy(ci->old_asym_mkvp, varray + 64, 16);
1751 if (ci->cur_asym_mk_state == '2')
1752 memcpy(ci->cur_asym_mkvp, varray + 84, 16);
1753 if (ci->new_asym_mk_state == '3')
1754 memcpy(ci->new_asym_mkvp, varray + 104, 16);
1755 ci->new_aes_mk_state = (char)rarray[7 * 8];
1756 ci->cur_aes_mk_state = (char)rarray[8 * 8];
1757 ci->old_aes_mk_state = (char)rarray[9 * 8];
1758 if (ci->old_aes_mk_state == '2')
1759 memcpy(&ci->old_aes_mkvp, varray + 172, 8);
1760 if (ci->cur_aes_mk_state == '2')
1761 memcpy(&ci->cur_aes_mkvp, varray + 184, 8);
1762 if (ci->new_aes_mk_state == '3')
1763 memcpy(&ci->new_aes_mkvp, varray + 196, 8);
1764 found++;
1765 }
1766 if (!found)
1767 goto out;
1768 rlen = vlen = PAGE_SIZE / 2;
1769 rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
1770 rarray, &rlen, varray, &vlen, xflags);
1771 if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) {
1772 ci->new_apka_mk_state = (char)rarray[10 * 8];
1773 ci->cur_apka_mk_state = (char)rarray[11 * 8];
1774 ci->old_apka_mk_state = (char)rarray[12 * 8];
1775 if (ci->old_apka_mk_state == '2')
1776 memcpy(&ci->old_apka_mkvp, varray + 208, 8);
1777 if (ci->cur_apka_mk_state == '2')
1778 memcpy(&ci->cur_apka_mkvp, varray + 220, 8);
1779 if (ci->new_apka_mk_state == '3')
1780 memcpy(&ci->new_apka_mkvp, varray + 232, 8);
1781 found++;
1782 }
1783
1784 out:
1785 mempool_free(mem, cprb_mempool);
1786 return found == 2 ? 0 : -ENOENT;
1787 }
1788 EXPORT_SYMBOL(cca_get_info);
1789
cca_findcard2(u32 * apqns,u32 * nr_apqns,u16 cardnr,u16 domain,int minhwtype,int mktype,const u8 * ptr_cur_mkvp,const u8 * ptr_old_mkvp,u32 xflags)1790 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
1791 int minhwtype, int mktype,
1792 const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags)
1793 {
1794 struct zcrypt_device_status_ext *device_status;
1795 int i, card, dom, curmatch, oldmatch;
1796 struct cca_info ci;
1797 u32 _nr_apqns = 0;
1798
1799 /* occupy the device status memory */
1800 mutex_lock(&dev_status_mem_mutex);
1801 memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE);
1802 device_status = (struct zcrypt_device_status_ext *)dev_status_mem;
1803
1804 /* fetch crypto device status into this struct */
1805 zcrypt_device_status_mask_ext(device_status,
1806 ZCRYPT_DEV_STATUS_CARD_MAX,
1807 ZCRYPT_DEV_STATUS_QUEUE_MAX);
1808
1809 /* walk through all the crypto apqnss */
1810 for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) {
1811 card = AP_QID_CARD(device_status[i].qid);
1812 dom = AP_QID_QUEUE(device_status[i].qid);
1813 /* check online state */
1814 if (!device_status[i].online)
1815 continue;
1816 /* check for cca functions */
1817 if (!(device_status[i].functions & 0x04))
1818 continue;
1819 /* check cardnr */
1820 if (cardnr != 0xFFFF && card != cardnr)
1821 continue;
1822 /* check domain */
1823 if (domain != 0xFFFF && dom != domain)
1824 continue;
1825 /* get cca info on this apqn */
1826 if (cca_get_info(card, dom, &ci, xflags))
1827 continue;
1828 /* current master key needs to be valid */
1829 if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2')
1830 continue;
1831 if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2')
1832 continue;
1833 /* check min hardware type */
1834 if (minhwtype > 0 && minhwtype > ci.hwtype)
1835 continue;
1836 if (ptr_cur_mkvp || ptr_old_mkvp) {
1837 /* check mkvps */
1838 curmatch = oldmatch = 0;
1839 if (mktype == AES_MK_SET) {
1840 if (ptr_cur_mkvp &&
1841 !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp,
1842 sizeof(ci.cur_aes_mkvp)))
1843 curmatch = 1;
1844 if (ptr_old_mkvp &&
1845 ci.old_aes_mk_state == '2' &&
1846 !memcmp(ptr_old_mkvp, ci.old_aes_mkvp,
1847 sizeof(ci.old_aes_mkvp)))
1848 oldmatch = 1;
1849 } else {
1850 if (ptr_cur_mkvp &&
1851 !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp,
1852 sizeof(ci.cur_apka_mkvp)))
1853 curmatch = 1;
1854 if (ptr_old_mkvp &&
1855 ci.old_apka_mk_state == '2' &&
1856 !memcmp(ptr_old_mkvp, ci.old_apka_mkvp,
1857 sizeof(ci.old_apka_mkvp)))
1858 oldmatch = 1;
1859 }
1860 if (curmatch + oldmatch < 1)
1861 continue;
1862 }
1863 /* apqn passed all filtering criterons, add to the array */
1864 if (_nr_apqns < *nr_apqns)
1865 apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom);
1866 }
1867
1868 *nr_apqns = _nr_apqns;
1869
1870 /* release the device status memory */
1871 mutex_unlock(&dev_status_mem_mutex);
1872
1873 return _nr_apqns ? 0 : -ENODEV;
1874 }
1875 EXPORT_SYMBOL(cca_findcard2);
1876
zcrypt_ccamisc_init(void)1877 int __init zcrypt_ccamisc_init(void)
1878 {
1879 /* Pre-allocate a small memory pool for cca cprbs. */
1880 cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold,
1881 CPRB_MEMPOOL_ITEM_SIZE);
1882 if (!cprb_mempool)
1883 return -ENOMEM;
1884
1885 /* Pre-allocate one crypto status card struct used in findcard() */
1886 dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL);
1887 if (!dev_status_mem) {
1888 mempool_destroy(cprb_mempool);
1889 return -ENOMEM;
1890 }
1891
1892 return 0;
1893 }
1894
zcrypt_ccamisc_exit(void)1895 void zcrypt_ccamisc_exit(void)
1896 {
1897 mutex_lock(&dev_status_mem_mutex);
1898 kvfree(dev_status_mem);
1899 mutex_unlock(&dev_status_mem_mutex);
1900 mempool_destroy(cprb_mempool);
1901 }
1902