1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright IBM Corp. 2019 4 * Author(s): Harald Freudenberger <freude@linux.ibm.com> 5 * Ingo Franzki <ifranzki@linux.ibm.com> 6 * 7 * Collection of CCA misc functions used by zcrypt and pkey 8 */ 9 10 #define pr_fmt(fmt) "zcrypt: " fmt 11 12 #include <linux/export.h> 13 #include <linux/init.h> 14 #include <linux/mempool.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/random.h> 18 #include <linux/align.h> 19 #include <asm/zcrypt.h> 20 #include <asm/pkey.h> 21 22 #include "ap_bus.h" 23 #include "zcrypt_api.h" 24 #include "zcrypt_debug.h" 25 #include "zcrypt_msgtype6.h" 26 #include "zcrypt_ccamisc.h" 27 28 /* Size of parameter block used for all cca requests/replies */ 29 #define PARMBSIZE 512 30 31 /* Size of vardata block used for some of the cca requests/replies */ 32 #define VARDATASIZE 4096 33 34 /* 35 * Cprb memory pool held for urgent cases where no memory 36 * can be allocated via kmalloc. This pool is only used 37 * when alloc_and_prep_cprbmem() is called with the xflag 38 * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold 39 * space for request AND reply! 40 */ 41 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024) 42 static mempool_t *cprb_mempool; 43 44 /* 45 * This is a pre-allocated memory for the device status array 46 * used within the findcard() functions. It is currently 47 * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is 48 * controlled via dev_status_mem_mutex. Needs adaption if more 49 * than 128 cards or domains to be are supported. 50 */ 51 #define ZCRYPT_DEV_STATUS_CARD_MAX 128 52 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128 53 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \ 54 ZCRYPT_DEV_STATUS_QUEUE_MAX) 55 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \ 56 sizeof(struct zcrypt_device_status_ext)) 57 static void *dev_status_mem; 58 static DEFINE_MUTEX(dev_status_mem_mutex); 59 60 /* 61 * Simple check if the token is a valid CCA secure AES data key 62 * token. If keybitsize is given, the bitsize of the key is 63 * also checked. Returns 0 on success or errno value on failure. 64 */ 65 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl, 66 const u8 *token, u32 keysize, int keybitsize) 67 { 68 struct secaeskeytoken *t = (struct secaeskeytoken *)token; 69 70 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 71 72 if (keysize < sizeof(*t)) { 73 if (dbg) 74 DBF("%s keysize %u < min token size %zu\n", 75 __func__, keysize, sizeof(*t)); 76 return -EINVAL; 77 } 78 if (t->type != TOKTYPE_CCA_INTERNAL) { 79 if (dbg) 80 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 81 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 82 return -EINVAL; 83 } 84 if (t->version != TOKVER_CCA_AES) { 85 if (dbg) 86 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 87 __func__, (int)t->version, TOKVER_CCA_AES); 88 return -EINVAL; 89 } 90 if (keybitsize > 0 && t->bitsize != keybitsize) { 91 if (dbg) 92 DBF("%s token check failed, bitsize %d != %d\n", 93 __func__, (int)t->bitsize, keybitsize); 94 return -EINVAL; 95 } 96 97 #undef DBF 98 99 return 0; 100 } 101 EXPORT_SYMBOL(cca_check_secaeskeytoken); 102 103 /* 104 * Simple check if the token is a valid CCA secure AES cipher key 105 * token. If keybitsize is given, the bitsize of the key is 106 * also checked. If checkcpacfexport is enabled, the key is also 107 * checked for the export flag to allow CPACF export. 108 * Returns 0 on success or errno value on failure. 109 */ 110 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl, 111 const u8 *token, u32 keysize, 112 int keybitsize, int checkcpacfexport) 113 { 114 struct cipherkeytoken *t = (struct cipherkeytoken *)token; 115 bool keybitsizeok = true; 116 117 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 118 119 if (keysize < sizeof(*t)) { 120 if (dbg) 121 DBF("%s keysize %u < min token size %zu\n", 122 __func__, keysize, sizeof(*t)); 123 return -EINVAL; 124 } 125 if (t->type != TOKTYPE_CCA_INTERNAL) { 126 if (dbg) 127 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 128 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 129 return -EINVAL; 130 } 131 if (t->version != TOKVER_CCA_VLSC) { 132 if (dbg) 133 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 134 __func__, (int)t->version, TOKVER_CCA_VLSC); 135 return -EINVAL; 136 } 137 if (t->len > keysize) { 138 if (dbg) 139 DBF("%s token check failed, len %d > keysize %u\n", 140 __func__, (int)t->len, keysize); 141 return -EINVAL; 142 } 143 if (t->len < sizeof(*t)) { 144 if (dbg) 145 DBF("%s token check failed, len %d < min token size %zu\n", 146 __func__, (int)t->len, sizeof(*t)); 147 return -EINVAL; 148 } 149 if (t->algtype != 0x02) { 150 if (dbg) 151 DBF("%s token check failed, algtype 0x%02x != 0x02\n", 152 __func__, (int)t->algtype); 153 return -EINVAL; 154 } 155 if (t->keytype != 0x0001) { 156 if (dbg) 157 DBF("%s token check failed, keytype 0x%04x != 0x0001\n", 158 __func__, (int)t->keytype); 159 return -EINVAL; 160 } 161 if (t->plfver != 0x00 && t->plfver != 0x01) { 162 if (dbg) 163 DBF("%s token check failed, unknown plfver 0x%02x\n", 164 __func__, (int)t->plfver); 165 return -EINVAL; 166 } 167 if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) { 168 if (dbg) 169 DBF("%s token check failed, unknown wpllen %d\n", 170 __func__, (int)t->wpllen); 171 return -EINVAL; 172 } 173 if (keybitsize > 0) { 174 switch (keybitsize) { 175 case 128: 176 if (t->wpllen != (t->plfver ? 640 : 512)) 177 keybitsizeok = false; 178 break; 179 case 192: 180 if (t->wpllen != (t->plfver ? 640 : 576)) 181 keybitsizeok = false; 182 break; 183 case 256: 184 if (t->wpllen != 640) 185 keybitsizeok = false; 186 break; 187 default: 188 keybitsizeok = false; 189 break; 190 } 191 if (!keybitsizeok) { 192 if (dbg) 193 DBF("%s token check failed, bitsize %d\n", 194 __func__, keybitsize); 195 return -EINVAL; 196 } 197 } 198 if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) { 199 if (dbg) 200 DBF("%s token check failed, XPRT_CPAC bit is 0\n", 201 __func__); 202 return -EINVAL; 203 } 204 205 #undef DBF 206 207 return 0; 208 } 209 EXPORT_SYMBOL(cca_check_secaescipherkey); 210 211 /* 212 * Simple check if the token is a valid CCA secure ECC private 213 * key token. Returns 0 on success or errno value on failure. 214 */ 215 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl, 216 const u8 *token, u32 keysize, 217 int checkcpacfexport) 218 { 219 struct eccprivkeytoken *t = (struct eccprivkeytoken *)token; 220 221 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 222 223 if (keysize < sizeof(*t)) { 224 if (dbg) 225 DBF("%s keysize %u < min token size %zu\n", 226 __func__, keysize, sizeof(*t)); 227 return -EINVAL; 228 } 229 if (t->type != TOKTYPE_CCA_INTERNAL_PKA) { 230 if (dbg) 231 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 232 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA); 233 return -EINVAL; 234 } 235 if (t->len > keysize) { 236 if (dbg) 237 DBF("%s token check failed, len %d > keysize %u\n", 238 __func__, (int)t->len, keysize); 239 return -EINVAL; 240 } 241 if (t->len < sizeof(*t)) { 242 if (dbg) 243 DBF("%s token check failed, len %d < min token size %zu\n", 244 __func__, (int)t->len, sizeof(*t)); 245 return -EINVAL; 246 } 247 if (t->secid != 0x20) { 248 if (dbg) 249 DBF("%s token check failed, secid 0x%02x != 0x20\n", 250 __func__, (int)t->secid); 251 return -EINVAL; 252 } 253 if (checkcpacfexport && !(t->kutc & 0x01)) { 254 if (dbg) 255 DBF("%s token check failed, XPRTCPAC bit is 0\n", 256 __func__); 257 return -EINVAL; 258 } 259 260 #undef DBF 261 262 return 0; 263 } 264 EXPORT_SYMBOL(cca_check_sececckeytoken); 265 266 /* 267 * Allocate consecutive memory for request CPRB, request param 268 * block, reply CPRB and reply param block and fill in values 269 * for the common fields. Returns 0 on success or errno value 270 * on failure. 271 * It is guaranteed that request and a possible param block 272 * are aligned to a 4 byte boundary. Furthermore if a param 273 * block is used, the memory allocated for this is rounded up to 274 * the next multiple of 4 bytes. 275 */ 276 static int alloc_and_prep_cprbmem(size_t paramblen, 277 u8 **p_cprb_mem, 278 struct CPRBX **p_req_cprb, 279 struct CPRBX **p_rep_cprb, 280 u32 xflags) 281 { 282 u8 *cprbmem = NULL; 283 size_t cprbplusparamblen = 284 ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4); 285 size_t len = 2 * cprbplusparamblen; 286 struct CPRBX *preqcblk, *prepcblk; 287 288 /* 289 * allocate consecutive memory for request CPRB, request param 290 * block, reply CPRB and reply param block 291 */ 292 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) { 293 if (len <= CPRB_MEMPOOL_ITEM_SIZE) 294 cprbmem = mempool_alloc_preallocated(cprb_mempool); 295 } else { 296 cprbmem = kmalloc(len, GFP_KERNEL); 297 } 298 if (!cprbmem) 299 return -ENOMEM; 300 memset(cprbmem, 0, len); 301 302 preqcblk = (struct CPRBX *)cprbmem; 303 prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen); 304 305 /* fill request cprb struct */ 306 preqcblk->cprb_len = sizeof(struct CPRBX); 307 preqcblk->cprb_ver_id = 0x02; 308 memcpy(preqcblk->func_id, "T2", 2); 309 preqcblk->rpl_msgbl = cprbplusparamblen; 310 if (paramblen) { 311 preqcblk->req_parmb = ((u8 __user *)preqcblk) + 312 ALIGN(sizeof(struct CPRBX), 4); 313 preqcblk->rpl_parmb = ((u8 __user *)prepcblk) + 314 ALIGN(sizeof(struct CPRBX), 4); 315 } 316 317 *p_cprb_mem = cprbmem; 318 *p_req_cprb = preqcblk; 319 *p_rep_cprb = prepcblk; 320 321 return 0; 322 } 323 324 /* 325 * Free the cprb memory allocated with the function above. 326 * If the scrub value is not zero, the memory is filled 327 * with zeros before freeing (useful if there was some 328 * clear key material in there). 329 */ 330 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags) 331 { 332 size_t cprblen = ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4); 333 334 if (mem && scrub) 335 memzero_explicit(mem, 2 * cprblen); 336 337 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) 338 mempool_free(mem, cprb_mempool); 339 else 340 kfree(mem); 341 } 342 343 /* 344 * Helper function to prepare the xcrb struct 345 */ 346 static inline void prep_xcrb(struct ica_xcRB *pxcrb, 347 u16 cardnr, 348 struct CPRBX *preqcblk, 349 struct CPRBX *prepcblk) 350 { 351 memset(pxcrb, 0, sizeof(*pxcrb)); 352 memcpy(&pxcrb->agent_ID, "CA", 2); 353 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr); 354 pxcrb->request_control_blk_length = 355 preqcblk->cprb_len + preqcblk->req_parml; 356 pxcrb->request_control_blk_addr = (void __user *)preqcblk; 357 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl; 358 pxcrb->reply_control_blk_addr = (void __user *)prepcblk; 359 } 360 361 /* 362 * Generate (random) CCA AES DATA secure key. 363 */ 364 int cca_genseckey(u16 cardnr, u16 domain, 365 u32 keybitsize, u8 *seckey, u32 xflags) 366 { 367 int i, rc, keysize; 368 int seckeysize; 369 u8 *mem, *ptr; 370 struct CPRBX *preqcblk, *prepcblk; 371 struct ica_xcRB xcrb; 372 struct kgreqparm { 373 u8 subfunc_code[2]; 374 u16 rule_array_len; 375 struct lv1 { 376 u16 len; 377 char key_form[8]; 378 char key_length[8]; 379 char key_type1[8]; 380 char key_type2[8]; 381 } lv1; 382 struct lv2 { 383 u16 len; 384 struct keyid { 385 u16 len; 386 u16 attr; 387 u8 data[SECKEYBLOBSIZE]; 388 } keyid[6]; 389 } lv2; 390 } __packed * preqparm; 391 struct kgrepparm { 392 u8 subfunc_code[2]; 393 u16 rule_array_len; 394 struct lv3 { 395 u16 len; 396 u16 keyblocklen; 397 struct { 398 u16 toklen; 399 u16 tokattr; 400 u8 tok[]; 401 /* ... some more data ... */ 402 } keyblock; 403 } lv3; 404 } __packed * prepparm; 405 406 /* get already prepared memory for 2 cprbs with param block each */ 407 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 408 &preqcblk, &prepcblk, xflags); 409 if (rc) 410 return rc; 411 412 /* fill request cprb struct */ 413 preqcblk->domain = domain; 414 415 /* fill request cprb param block with KG request */ 416 preqparm = (struct kgreqparm __force *)preqcblk->req_parmb; 417 memcpy(preqparm->subfunc_code, "KG", 2); 418 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 419 preqparm->lv1.len = sizeof(struct lv1); 420 memcpy(preqparm->lv1.key_form, "OP ", 8); 421 switch (keybitsize) { 422 case PKEY_SIZE_AES_128: 423 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 424 keysize = 16; 425 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8); 426 break; 427 case PKEY_SIZE_AES_192: 428 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 429 keysize = 24; 430 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8); 431 break; 432 case PKEY_SIZE_AES_256: 433 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 434 keysize = 32; 435 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8); 436 break; 437 default: 438 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 439 __func__, keybitsize); 440 rc = -EINVAL; 441 goto out; 442 } 443 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8); 444 preqparm->lv2.len = sizeof(struct lv2); 445 for (i = 0; i < 6; i++) { 446 preqparm->lv2.keyid[i].len = sizeof(struct keyid); 447 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10); 448 } 449 preqcblk->req_parml = sizeof(struct kgreqparm); 450 451 /* fill xcrb struct */ 452 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 453 454 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 455 rc = zcrypt_send_cprb(&xcrb, xflags); 456 if (rc) { 457 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n", 458 __func__, (int)cardnr, (int)domain, rc); 459 goto out; 460 } 461 462 /* check response returncode and reasoncode */ 463 if (prepcblk->ccp_rtcode != 0) { 464 ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n", 465 __func__, 466 (int)prepcblk->ccp_rtcode, 467 (int)prepcblk->ccp_rscode); 468 rc = -EIO; 469 goto out; 470 } 471 472 /* process response cprb param block */ 473 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 474 prepcblk->rpl_parmb = (u8 __user *)ptr; 475 prepparm = (struct kgrepparm *)ptr; 476 477 /* check length of the returned secure key token */ 478 seckeysize = prepparm->lv3.keyblock.toklen 479 - sizeof(prepparm->lv3.keyblock.toklen) 480 - sizeof(prepparm->lv3.keyblock.tokattr); 481 if (seckeysize != SECKEYBLOBSIZE) { 482 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 483 __func__, seckeysize, SECKEYBLOBSIZE); 484 rc = -EIO; 485 goto out; 486 } 487 488 /* check secure key token */ 489 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 490 prepparm->lv3.keyblock.tok, 491 seckeysize, 8 * keysize); 492 if (rc) { 493 rc = -EIO; 494 goto out; 495 } 496 497 /* copy the generated secure key token */ 498 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 499 500 out: 501 free_cprbmem(mem, PARMBSIZE, false, xflags); 502 return rc; 503 } 504 EXPORT_SYMBOL(cca_genseckey); 505 506 /* 507 * Generate an CCA AES DATA secure key with given key value. 508 */ 509 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize, 510 const u8 *clrkey, u8 *seckey, u32 xflags) 511 { 512 int rc, keysize, seckeysize; 513 u8 *mem, *ptr; 514 struct CPRBX *preqcblk, *prepcblk; 515 struct ica_xcRB xcrb; 516 struct cmreqparm { 517 u8 subfunc_code[2]; 518 u16 rule_array_len; 519 char rule_array[8]; 520 struct lv1 { 521 u16 len; 522 u8 clrkey[]; 523 } lv1; 524 /* followed by struct lv2 */ 525 } __packed * preqparm; 526 struct lv2 { 527 u16 len; 528 struct keyid { 529 u16 len; 530 u16 attr; 531 u8 data[SECKEYBLOBSIZE]; 532 } keyid; 533 } __packed * plv2; 534 struct cmrepparm { 535 u8 subfunc_code[2]; 536 u16 rule_array_len; 537 struct lv3 { 538 u16 len; 539 u16 keyblocklen; 540 struct { 541 u16 toklen; 542 u16 tokattr; 543 u8 tok[]; 544 /* ... some more data ... */ 545 } keyblock; 546 } lv3; 547 } __packed * prepparm; 548 549 /* get already prepared memory for 2 cprbs with param block each */ 550 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 551 &preqcblk, &prepcblk, xflags); 552 if (rc) 553 return rc; 554 555 /* fill request cprb struct */ 556 preqcblk->domain = domain; 557 558 /* fill request cprb param block with CM request */ 559 preqparm = (struct cmreqparm __force *)preqcblk->req_parmb; 560 memcpy(preqparm->subfunc_code, "CM", 2); 561 memcpy(preqparm->rule_array, "AES ", 8); 562 preqparm->rule_array_len = 563 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 564 switch (keybitsize) { 565 case PKEY_SIZE_AES_128: 566 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 567 keysize = 16; 568 break; 569 case PKEY_SIZE_AES_192: 570 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 571 keysize = 24; 572 break; 573 case PKEY_SIZE_AES_256: 574 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 575 keysize = 32; 576 break; 577 default: 578 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 579 __func__, keybitsize); 580 rc = -EINVAL; 581 goto out; 582 } 583 preqparm->lv1.len = sizeof(struct lv1) + keysize; 584 memcpy(preqparm->lv1.clrkey, clrkey, keysize); 585 plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize); 586 plv2->len = sizeof(struct lv2); 587 plv2->keyid.len = sizeof(struct keyid); 588 plv2->keyid.attr = 0x30; 589 preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2); 590 591 /* fill xcrb struct */ 592 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 593 594 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 595 rc = zcrypt_send_cprb(&xcrb, xflags); 596 if (rc) { 597 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 598 __func__, (int)cardnr, (int)domain, rc); 599 goto out; 600 } 601 602 /* check response returncode and reasoncode */ 603 if (prepcblk->ccp_rtcode != 0) { 604 ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n", 605 __func__, 606 (int)prepcblk->ccp_rtcode, 607 (int)prepcblk->ccp_rscode); 608 rc = -EIO; 609 goto out; 610 } 611 612 /* process response cprb param block */ 613 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 614 prepcblk->rpl_parmb = (u8 __user *)ptr; 615 prepparm = (struct cmrepparm *)ptr; 616 617 /* check length of the returned secure key token */ 618 seckeysize = prepparm->lv3.keyblock.toklen 619 - sizeof(prepparm->lv3.keyblock.toklen) 620 - sizeof(prepparm->lv3.keyblock.tokattr); 621 if (seckeysize != SECKEYBLOBSIZE) { 622 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 623 __func__, seckeysize, SECKEYBLOBSIZE); 624 rc = -EIO; 625 goto out; 626 } 627 628 /* check secure key token */ 629 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 630 prepparm->lv3.keyblock.tok, 631 seckeysize, 8 * keysize); 632 if (rc) { 633 rc = -EIO; 634 goto out; 635 } 636 637 /* copy the generated secure key token */ 638 if (seckey) 639 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 640 641 out: 642 free_cprbmem(mem, PARMBSIZE, true, xflags); 643 return rc; 644 } 645 EXPORT_SYMBOL(cca_clr2seckey); 646 647 /* 648 * Derive proteced key from an CCA AES DATA secure key. 649 */ 650 int cca_sec2protkey(u16 cardnr, u16 domain, 651 const u8 *seckey, u8 *protkey, u32 *protkeylen, 652 u32 *protkeytype, u32 xflags) 653 { 654 int rc; 655 u8 *mem, *ptr; 656 struct CPRBX *preqcblk, *prepcblk; 657 struct ica_xcRB xcrb; 658 struct uskreqparm { 659 u8 subfunc_code[2]; 660 u16 rule_array_len; 661 struct lv1 { 662 u16 len; 663 u16 attr_len; 664 u16 attr_flags; 665 } lv1; 666 struct lv2 { 667 u16 len; 668 u16 attr_len; 669 u16 attr_flags; 670 u8 token[]; /* cca secure key token */ 671 } lv2; 672 } __packed * preqparm; 673 struct uskrepparm { 674 u8 subfunc_code[2]; 675 u16 rule_array_len; 676 struct lv3 { 677 u16 len; 678 u16 attr_len; 679 u16 attr_flags; 680 struct cpacfkeyblock { 681 u8 version; /* version of this struct */ 682 u8 flags[2]; 683 u8 algo; 684 u8 form; 685 u8 pad1[3]; 686 u16 len; 687 u8 key[64]; /* the key (len bytes) */ 688 u16 keyattrlen; 689 u8 keyattr[32]; 690 u8 pad2[1]; 691 u8 vptype; 692 u8 vp[32]; /* verification pattern */ 693 } ckb; 694 } lv3; 695 } __packed * prepparm; 696 697 /* get already prepared memory for 2 cprbs with param block each */ 698 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 699 &preqcblk, &prepcblk, xflags); 700 if (rc) 701 return rc; 702 703 /* fill request cprb struct */ 704 preqcblk->domain = domain; 705 706 /* fill request cprb param block with USK request */ 707 preqparm = (struct uskreqparm __force *)preqcblk->req_parmb; 708 memcpy(preqparm->subfunc_code, "US", 2); 709 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 710 preqparm->lv1.len = sizeof(struct lv1); 711 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len); 712 preqparm->lv1.attr_flags = 0x0001; 713 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE; 714 preqparm->lv2.attr_len = sizeof(struct lv2) 715 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE; 716 preqparm->lv2.attr_flags = 0x0000; 717 memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE); 718 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE; 719 720 /* fill xcrb struct */ 721 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 722 723 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 724 rc = zcrypt_send_cprb(&xcrb, xflags); 725 if (rc) { 726 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 727 __func__, (int)cardnr, (int)domain, rc); 728 goto out; 729 } 730 731 /* check response returncode and reasoncode */ 732 if (prepcblk->ccp_rtcode != 0) { 733 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 734 __func__, 735 (int)prepcblk->ccp_rtcode, 736 (int)prepcblk->ccp_rscode); 737 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 738 rc = -EBUSY; 739 else 740 rc = -EIO; 741 goto out; 742 } 743 if (prepcblk->ccp_rscode != 0) { 744 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 745 __func__, 746 (int)prepcblk->ccp_rtcode, 747 (int)prepcblk->ccp_rscode); 748 } 749 750 /* process response cprb param block */ 751 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 752 prepcblk->rpl_parmb = (u8 __user *)ptr; 753 prepparm = (struct uskrepparm *)ptr; 754 755 /* check the returned keyblock */ 756 if (prepparm->lv3.ckb.version != 0x01 && 757 prepparm->lv3.ckb.version != 0x02) { 758 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 759 __func__, (int)prepparm->lv3.ckb.version); 760 rc = -EIO; 761 goto out; 762 } 763 764 /* copy the translated protected key */ 765 switch (prepparm->lv3.ckb.len) { 766 case 16 + 32: 767 /* AES 128 protected key */ 768 if (protkeytype) 769 *protkeytype = PKEY_KEYTYPE_AES_128; 770 break; 771 case 24 + 32: 772 /* AES 192 protected key */ 773 if (protkeytype) 774 *protkeytype = PKEY_KEYTYPE_AES_192; 775 break; 776 case 32 + 32: 777 /* AES 256 protected key */ 778 if (protkeytype) 779 *protkeytype = PKEY_KEYTYPE_AES_256; 780 break; 781 default: 782 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 783 __func__, prepparm->lv3.ckb.len); 784 rc = -EIO; 785 goto out; 786 } 787 memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len); 788 if (protkeylen) 789 *protkeylen = prepparm->lv3.ckb.len; 790 791 out: 792 free_cprbmem(mem, PARMBSIZE, true, xflags); 793 return rc; 794 } 795 EXPORT_SYMBOL(cca_sec2protkey); 796 797 /* 798 * AES cipher key skeleton created with CSNBKTB2 with these flags: 799 * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY, 800 * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA 801 * used by cca_gencipherkey() and cca_clr2cipherkey(). 802 */ 803 static const u8 aes_cipher_key_skeleton[] = { 804 0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00, 805 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 806 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 807 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 808 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 809 0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff, 810 0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 }; 811 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton)) 812 813 /* 814 * Generate (random) CCA AES CIPHER secure key. 815 */ 816 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags, 817 u8 *keybuf, u32 *keybufsize, u32 xflags) 818 { 819 int rc; 820 u8 *mem, *ptr; 821 struct CPRBX *preqcblk, *prepcblk; 822 struct ica_xcRB xcrb; 823 struct gkreqparm { 824 u8 subfunc_code[2]; 825 u16 rule_array_len; 826 char rule_array[2 * 8]; 827 struct { 828 u16 len; 829 u8 key_type_1[8]; 830 u8 key_type_2[8]; 831 u16 clear_key_bit_len; 832 u16 key_name_1_len; 833 u16 key_name_2_len; 834 u16 user_data_1_len; 835 u16 user_data_2_len; 836 /* u8 key_name_1[]; */ 837 /* u8 key_name_2[]; */ 838 /* u8 user_data_1[]; */ 839 /* u8 user_data_2[]; */ 840 } vud; 841 struct { 842 u16 len; 843 struct { 844 u16 len; 845 u16 flag; 846 /* u8 kek_id_1[]; */ 847 } tlv1; 848 struct { 849 u16 len; 850 u16 flag; 851 /* u8 kek_id_2[]; */ 852 } tlv2; 853 struct { 854 u16 len; 855 u16 flag; 856 u8 gen_key_id_1[SIZEOF_SKELETON]; 857 } tlv3; 858 struct { 859 u16 len; 860 u16 flag; 861 /* u8 gen_key_id_1_label[]; */ 862 } tlv4; 863 struct { 864 u16 len; 865 u16 flag; 866 /* u8 gen_key_id_2[]; */ 867 } tlv5; 868 struct { 869 u16 len; 870 u16 flag; 871 /* u8 gen_key_id_2_label[]; */ 872 } tlv6; 873 } kb; 874 } __packed * preqparm; 875 struct gkrepparm { 876 u8 subfunc_code[2]; 877 u16 rule_array_len; 878 struct { 879 u16 len; 880 } vud; 881 struct { 882 u16 len; 883 struct { 884 u16 len; 885 u16 flag; 886 u8 gen_key[]; /* 120-136 bytes */ 887 } tlv1; 888 } kb; 889 } __packed * prepparm; 890 struct cipherkeytoken *t; 891 u32 keybuflen; 892 893 /* get already prepared memory for 2 cprbs with param block each */ 894 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 895 &preqcblk, &prepcblk, xflags); 896 if (rc) 897 return rc; 898 899 /* fill request cprb struct */ 900 preqcblk->domain = domain; 901 preqcblk->req_parml = sizeof(struct gkreqparm); 902 903 /* prepare request param block with GK request */ 904 preqparm = (struct gkreqparm __force *)preqcblk->req_parmb; 905 memcpy(preqparm->subfunc_code, "GK", 2); 906 preqparm->rule_array_len = sizeof(uint16_t) + 2 * 8; 907 memcpy(preqparm->rule_array, "AES OP ", 2 * 8); 908 909 /* prepare vud block */ 910 preqparm->vud.len = sizeof(preqparm->vud); 911 switch (keybitsize) { 912 case 128: 913 case 192: 914 case 256: 915 break; 916 default: 917 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 918 __func__, keybitsize); 919 rc = -EINVAL; 920 goto out; 921 } 922 preqparm->vud.clear_key_bit_len = keybitsize; 923 memcpy(preqparm->vud.key_type_1, "TOKEN ", 8); 924 memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2)); 925 926 /* prepare kb block */ 927 preqparm->kb.len = sizeof(preqparm->kb); 928 preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1); 929 preqparm->kb.tlv1.flag = 0x0030; 930 preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2); 931 preqparm->kb.tlv2.flag = 0x0030; 932 preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3); 933 preqparm->kb.tlv3.flag = 0x0030; 934 memcpy(preqparm->kb.tlv3.gen_key_id_1, 935 aes_cipher_key_skeleton, SIZEOF_SKELETON); 936 preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4); 937 preqparm->kb.tlv4.flag = 0x0030; 938 preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5); 939 preqparm->kb.tlv5.flag = 0x0030; 940 preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6); 941 preqparm->kb.tlv6.flag = 0x0030; 942 943 /* patch the skeleton key token export flags inside the kb block */ 944 if (keygenflags) { 945 t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1; 946 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 947 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 948 } 949 950 /* prepare xcrb struct */ 951 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 952 953 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 954 rc = zcrypt_send_cprb(&xcrb, xflags); 955 if (rc) { 956 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 957 __func__, (int)cardnr, (int)domain, rc); 958 goto out; 959 } 960 961 /* check response returncode and reasoncode */ 962 if (prepcblk->ccp_rtcode != 0) { 963 ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n", 964 __func__, 965 (int)prepcblk->ccp_rtcode, 966 (int)prepcblk->ccp_rscode); 967 rc = -EIO; 968 goto out; 969 } 970 971 /* process response cprb param block */ 972 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 973 prepcblk->rpl_parmb = (u8 __user *)ptr; 974 prepparm = (struct gkrepparm *)ptr; 975 976 /* do some plausibility checks on the key block */ 977 if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) || 978 prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) { 979 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 980 __func__); 981 rc = -EIO; 982 goto out; 983 } 984 985 /* and some checks on the generated key */ 986 t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key; 987 if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) { 988 rc = -EIO; 989 goto out; 990 } 991 keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t); 992 rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR, 993 prepparm->kb.tlv1.gen_key, 994 keybuflen, keybitsize, 1); 995 if (rc) { 996 rc = -EIO; 997 goto out; 998 } 999 1000 /* copy the generated vlsc key token */ 1001 if (keybuf) { 1002 if (*keybufsize >= keybuflen) 1003 memcpy(keybuf, t, keybuflen); 1004 else 1005 rc = -EINVAL; 1006 } 1007 *keybufsize = keybuflen; 1008 1009 out: 1010 free_cprbmem(mem, PARMBSIZE, false, xflags); 1011 return rc; 1012 } 1013 EXPORT_SYMBOL(cca_gencipherkey); 1014 1015 /* 1016 * Helper function, does a the CSNBKPI2 CPRB. 1017 */ 1018 static int _ip_cprb_helper(u16 cardnr, u16 domain, 1019 const char *rule_array_1, 1020 const char *rule_array_2, 1021 const char *rule_array_3, 1022 const u8 *clr_key_value, 1023 int clr_key_bit_size, 1024 u8 *key_token, 1025 int *key_token_size, 1026 u32 xflags, 1027 bool scrub) 1028 { 1029 int rc, n; 1030 u8 *mem, *ptr; 1031 struct CPRBX *preqcblk, *prepcblk; 1032 struct ica_xcRB xcrb; 1033 struct rule_array_block { 1034 u8 subfunc_code[2]; 1035 u16 rule_array_len; 1036 char rule_array[]; 1037 } __packed * preq_ra_block; 1038 struct vud_block { 1039 u16 len; 1040 struct { 1041 u16 len; 1042 u16 flag; /* 0x0064 */ 1043 u16 clr_key_bit_len; 1044 } tlv1; 1045 struct { 1046 u16 len; 1047 u16 flag; /* 0x0063 */ 1048 u8 clr_key[]; /* clear key value bytes */ 1049 } tlv2; 1050 } __packed * preq_vud_block; 1051 struct key_block { 1052 u16 len; 1053 struct { 1054 u16 len; 1055 u16 flag; /* 0x0030 */ 1056 u8 key_token[]; /* key skeleton */ 1057 } tlv1; 1058 } __packed * preq_key_block; 1059 struct iprepparm { 1060 u8 subfunc_code[2]; 1061 u16 rule_array_len; 1062 struct { 1063 u16 len; 1064 } vud; 1065 struct { 1066 u16 len; 1067 struct { 1068 u16 len; 1069 u16 flag; /* 0x0030 */ 1070 u8 key_token[]; /* key token */ 1071 } tlv1; 1072 } kb; 1073 } __packed * prepparm; 1074 struct cipherkeytoken *t; 1075 int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1; 1076 1077 /* get already prepared memory for 2 cprbs with param block each */ 1078 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1079 &preqcblk, &prepcblk, xflags); 1080 if (rc) 1081 return rc; 1082 1083 /* fill request cprb struct */ 1084 preqcblk->domain = domain; 1085 preqcblk->req_parml = 0; 1086 1087 /* prepare request param block with IP request */ 1088 preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb; 1089 memcpy(preq_ra_block->subfunc_code, "IP", 2); 1090 preq_ra_block->rule_array_len = sizeof(uint16_t) + 2 * 8; 1091 memcpy(preq_ra_block->rule_array, rule_array_1, 8); 1092 memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8); 1093 preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8; 1094 if (rule_array_3) { 1095 preq_ra_block->rule_array_len += 8; 1096 memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8); 1097 preqcblk->req_parml += 8; 1098 } 1099 1100 /* prepare vud block */ 1101 preq_vud_block = (struct vud_block __force *) 1102 (preqcblk->req_parmb + preqcblk->req_parml); 1103 n = complete ? 0 : (clr_key_bit_size + 7) / 8; 1104 preq_vud_block->len = sizeof(struct vud_block) + n; 1105 preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1); 1106 preq_vud_block->tlv1.flag = 0x0064; 1107 preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size; 1108 preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n; 1109 preq_vud_block->tlv2.flag = 0x0063; 1110 if (!complete) 1111 memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n); 1112 preqcblk->req_parml += preq_vud_block->len; 1113 1114 /* prepare key block */ 1115 preq_key_block = (struct key_block __force *) 1116 (preqcblk->req_parmb + preqcblk->req_parml); 1117 n = *key_token_size; 1118 preq_key_block->len = sizeof(struct key_block) + n; 1119 preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n; 1120 preq_key_block->tlv1.flag = 0x0030; 1121 memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size); 1122 preqcblk->req_parml += preq_key_block->len; 1123 1124 /* prepare xcrb struct */ 1125 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1126 1127 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1128 rc = zcrypt_send_cprb(&xcrb, xflags); 1129 if (rc) { 1130 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1131 __func__, (int)cardnr, (int)domain, rc); 1132 goto out; 1133 } 1134 1135 /* check response returncode and reasoncode */ 1136 if (prepcblk->ccp_rtcode != 0) { 1137 ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n", 1138 __func__, 1139 (int)prepcblk->ccp_rtcode, 1140 (int)prepcblk->ccp_rscode); 1141 rc = -EIO; 1142 goto out; 1143 } 1144 1145 /* process response cprb param block */ 1146 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1147 prepcblk->rpl_parmb = (u8 __user *)ptr; 1148 prepparm = (struct iprepparm *)ptr; 1149 1150 /* do some plausibility checks on the key block */ 1151 if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) || 1152 prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) { 1153 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 1154 __func__); 1155 rc = -EIO; 1156 goto out; 1157 } 1158 1159 /* do not check the key here, it may be incomplete */ 1160 1161 /* 1162 * Copy the vlsc key token back. 1163 * The available space in the destination (key_token) and the source 1164 * (t) buffer is always larger as the valid range of prepparm->kb.len. 1165 * Validate t->len by comparing it with the length information in the 1166 * param block of the request (prepparm->kb.len) 1167 * The value range of prepparm->kb.len has been checked above. 1168 */ 1169 t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token; 1170 if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) { 1171 ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n", 1172 __func__, t->len); 1173 rc = -EIO; 1174 goto out; 1175 } 1176 memcpy(key_token, t, t->len); 1177 *key_token_size = t->len; 1178 1179 out: 1180 free_cprbmem(mem, PARMBSIZE, scrub, xflags); 1181 return rc; 1182 } 1183 1184 /* 1185 * Build CCA AES CIPHER secure key with a given clear key value. 1186 */ 1187 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, 1188 const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags) 1189 { 1190 int rc; 1191 void *mem; 1192 int tokensize; 1193 u8 *token, exorbuf[32]; 1194 struct cipherkeytoken *t; 1195 1196 /* fill exorbuf with random data */ 1197 get_random_bytes(exorbuf, sizeof(exorbuf)); 1198 1199 /* 1200 * Allocate space for the key token to build. 1201 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this 1202 * we use the already existing cprb mempool to solve this 1203 * short term memory requirement. 1204 */ 1205 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1206 mempool_alloc_preallocated(cprb_mempool) : 1207 mempool_alloc(cprb_mempool, GFP_KERNEL); 1208 if (!mem) 1209 return -ENOMEM; 1210 1211 /* prepare the token with the key skeleton */ 1212 token = (u8 *)mem; 1213 tokensize = SIZEOF_SKELETON; 1214 memcpy(token, aes_cipher_key_skeleton, tokensize); 1215 1216 /* patch the skeleton key token export flags */ 1217 if (keygenflags) { 1218 t = (struct cipherkeytoken *)token; 1219 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 1220 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 1221 } 1222 1223 /* 1224 * Do the key import with the clear key value in 4 steps: 1225 * 1/4 FIRST import with only random data 1226 * 2/4 EXOR the clear key 1227 * 3/4 EXOR the very same random data again 1228 * 4/4 COMPLETE the secure cipher key import 1229 */ 1230 rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", 1231 exorbuf, keybitsize, token, &tokensize, 1232 xflags, true); 1233 if (rc) { 1234 ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", 1235 __func__, rc); 1236 goto out; 1237 } 1238 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1239 clrkey, keybitsize, token, &tokensize, 1240 xflags, true); 1241 if (rc) { 1242 ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", 1243 __func__, rc); 1244 goto out; 1245 } 1246 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1247 exorbuf, keybitsize, token, &tokensize, 1248 xflags, true); 1249 if (rc) { 1250 ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", 1251 __func__, rc); 1252 goto out; 1253 } 1254 rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, 1255 NULL, keybitsize, token, &tokensize, 1256 xflags, true); 1257 if (rc) { 1258 ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", 1259 __func__, rc); 1260 goto out; 1261 } 1262 1263 /* copy the generated key token */ 1264 if (keybuf) { 1265 if (tokensize > *keybufsize) 1266 rc = -EINVAL; 1267 else 1268 memcpy(keybuf, token, tokensize); 1269 } 1270 *keybufsize = tokensize; 1271 1272 out: 1273 memzero_explicit(exorbuf, sizeof(exorbuf)); 1274 memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE); 1275 mempool_free(mem, cprb_mempool); 1276 return rc; 1277 } 1278 EXPORT_SYMBOL(cca_clr2cipherkey); 1279 1280 /* 1281 * Derive proteced key from CCA AES cipher secure key. 1282 */ 1283 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey, 1284 u8 *protkey, u32 *protkeylen, u32 *protkeytype, 1285 u32 xflags) 1286 { 1287 int rc; 1288 u8 *mem, *ptr; 1289 struct CPRBX *preqcblk, *prepcblk; 1290 struct ica_xcRB xcrb; 1291 struct aureqparm { 1292 u8 subfunc_code[2]; 1293 u16 rule_array_len; 1294 u8 rule_array[8]; 1295 struct { 1296 u16 len; 1297 u16 tk_blob_len; 1298 u16 tk_blob_tag; 1299 u8 tk_blob[66]; 1300 } vud; 1301 struct { 1302 u16 len; 1303 u16 cca_key_token_len; 1304 u16 cca_key_token_flags; 1305 u8 cca_key_token[]; /* 64 or more */ 1306 } kb; 1307 } __packed * preqparm; 1308 struct aurepparm { 1309 u8 subfunc_code[2]; 1310 u16 rule_array_len; 1311 struct { 1312 u16 len; 1313 u16 sublen; 1314 u16 tag; 1315 struct cpacfkeyblock { 1316 u8 version; /* version of this struct */ 1317 u8 flags[2]; 1318 u8 algo; 1319 u8 form; 1320 u8 pad1[3]; 1321 u16 keylen; 1322 u8 key[64]; /* the key (keylen bytes) */ 1323 u16 keyattrlen; 1324 u8 keyattr[32]; 1325 u8 pad2[1]; 1326 u8 vptype; 1327 u8 vp[32]; /* verification pattern */ 1328 } ckb; 1329 } vud; 1330 struct { 1331 u16 len; 1332 } kb; 1333 } __packed * prepparm; 1334 int keytoklen = ((struct cipherkeytoken *)ckey)->len; 1335 1336 if (keytoklen > PARMBSIZE - sizeof(struct aureqparm)) 1337 return -EINVAL; 1338 1339 /* get already prepared memory for 2 cprbs with param block each */ 1340 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1341 &preqcblk, &prepcblk, xflags); 1342 if (rc) 1343 return rc; 1344 1345 /* fill request cprb struct */ 1346 preqcblk->domain = domain; 1347 1348 /* fill request cprb param block with AU request */ 1349 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1350 memcpy(preqparm->subfunc_code, "AU", 2); 1351 preqparm->rule_array_len = 1352 sizeof(preqparm->rule_array_len) 1353 + sizeof(preqparm->rule_array); 1354 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1355 /* vud, tk blob */ 1356 preqparm->vud.len = sizeof(preqparm->vud); 1357 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1358 + 2 * sizeof(uint16_t); 1359 preqparm->vud.tk_blob_tag = 0x00C2; 1360 /* kb, cca token */ 1361 preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t); 1362 preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t); 1363 memcpy(preqparm->kb.cca_key_token, ckey, keytoklen); 1364 /* now fill length of param block into cprb */ 1365 preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen; 1366 1367 /* fill xcrb struct */ 1368 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1369 1370 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1371 rc = zcrypt_send_cprb(&xcrb, xflags); 1372 if (rc) { 1373 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1374 __func__, (int)cardnr, (int)domain, rc); 1375 goto out; 1376 } 1377 1378 /* check response returncode and reasoncode */ 1379 if (prepcblk->ccp_rtcode != 0) { 1380 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1381 __func__, 1382 (int)prepcblk->ccp_rtcode, 1383 (int)prepcblk->ccp_rscode); 1384 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1385 rc = -EBUSY; 1386 else 1387 rc = -EIO; 1388 goto out; 1389 } 1390 if (prepcblk->ccp_rscode != 0) { 1391 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1392 __func__, 1393 (int)prepcblk->ccp_rtcode, 1394 (int)prepcblk->ccp_rscode); 1395 } 1396 1397 /* process response cprb param block */ 1398 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1399 prepcblk->rpl_parmb = (u8 __user *)ptr; 1400 prepparm = (struct aurepparm *)ptr; 1401 1402 /* check the returned keyblock */ 1403 if (prepparm->vud.ckb.version != 0x01 && 1404 prepparm->vud.ckb.version != 0x02) { 1405 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 1406 __func__, (int)prepparm->vud.ckb.version); 1407 rc = -EIO; 1408 goto out; 1409 } 1410 if (prepparm->vud.ckb.algo != 0x02) { 1411 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n", 1412 __func__, (int)prepparm->vud.ckb.algo); 1413 rc = -EIO; 1414 goto out; 1415 } 1416 1417 /* copy the translated protected key */ 1418 switch (prepparm->vud.ckb.keylen) { 1419 case 16 + 32: 1420 /* AES 128 protected key */ 1421 if (protkeytype) 1422 *protkeytype = PKEY_KEYTYPE_AES_128; 1423 break; 1424 case 24 + 32: 1425 /* AES 192 protected key */ 1426 if (protkeytype) 1427 *protkeytype = PKEY_KEYTYPE_AES_192; 1428 break; 1429 case 32 + 32: 1430 /* AES 256 protected key */ 1431 if (protkeytype) 1432 *protkeytype = PKEY_KEYTYPE_AES_256; 1433 break; 1434 default: 1435 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 1436 __func__, prepparm->vud.ckb.keylen); 1437 rc = -EIO; 1438 goto out; 1439 } 1440 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1441 if (protkeylen) 1442 *protkeylen = prepparm->vud.ckb.keylen; 1443 1444 out: 1445 free_cprbmem(mem, PARMBSIZE, true, xflags); 1446 return rc; 1447 } 1448 EXPORT_SYMBOL(cca_cipher2protkey); 1449 1450 /* 1451 * Derive protected key from CCA ECC secure private key. 1452 */ 1453 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key, 1454 u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags) 1455 { 1456 int rc; 1457 u8 *mem, *ptr; 1458 struct CPRBX *preqcblk, *prepcblk; 1459 struct ica_xcRB xcrb; 1460 struct aureqparm { 1461 u8 subfunc_code[2]; 1462 u16 rule_array_len; 1463 u8 rule_array[8]; 1464 struct { 1465 u16 len; 1466 u16 tk_blob_len; 1467 u16 tk_blob_tag; 1468 u8 tk_blob[66]; 1469 } vud; 1470 struct { 1471 u16 len; 1472 u16 cca_key_token_len; 1473 u16 cca_key_token_flags; 1474 u8 cca_key_token[]; 1475 } kb; 1476 } __packed * preqparm; 1477 struct aurepparm { 1478 u8 subfunc_code[2]; 1479 u16 rule_array_len; 1480 struct { 1481 u16 len; 1482 u16 sublen; 1483 u16 tag; 1484 struct cpacfkeyblock { 1485 u8 version; /* version of this struct */ 1486 u8 flags[2]; 1487 u8 algo; 1488 u8 form; 1489 u8 pad1[3]; 1490 u16 keylen; 1491 u8 key[]; /* the key (keylen bytes) */ 1492 /* u16 keyattrlen; */ 1493 /* u8 keyattr[32]; */ 1494 /* u8 pad2[1]; */ 1495 /* u8 vptype; */ 1496 /* u8 vp[32]; verification pattern */ 1497 } ckb; 1498 } vud; 1499 /* followed by a key block */ 1500 } __packed * prepparm; 1501 int keylen = ((struct eccprivkeytoken *)key)->len; 1502 1503 if (keylen > PARMBSIZE - sizeof(struct aureqparm)) 1504 return -EINVAL; 1505 1506 /* get already prepared memory for 2 cprbs with param block each */ 1507 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1508 &preqcblk, &prepcblk, xflags); 1509 if (rc) 1510 return rc; 1511 1512 /* fill request cprb struct */ 1513 preqcblk->domain = domain; 1514 1515 /* fill request cprb param block with AU request */ 1516 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1517 memcpy(preqparm->subfunc_code, "AU", 2); 1518 preqparm->rule_array_len = 1519 sizeof(preqparm->rule_array_len) 1520 + sizeof(preqparm->rule_array); 1521 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1522 /* vud, tk blob */ 1523 preqparm->vud.len = sizeof(preqparm->vud); 1524 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1525 + 2 * sizeof(uint16_t); 1526 preqparm->vud.tk_blob_tag = 0x00C2; 1527 /* kb, cca token */ 1528 preqparm->kb.len = keylen + 3 * sizeof(uint16_t); 1529 preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t); 1530 memcpy(preqparm->kb.cca_key_token, key, keylen); 1531 /* now fill length of param block into cprb */ 1532 preqcblk->req_parml = sizeof(struct aureqparm) + keylen; 1533 1534 /* fill xcrb struct */ 1535 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1536 1537 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1538 rc = zcrypt_send_cprb(&xcrb, xflags); 1539 if (rc) { 1540 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1541 __func__, (int)cardnr, (int)domain, rc); 1542 goto out; 1543 } 1544 1545 /* check response returncode and reasoncode */ 1546 if (prepcblk->ccp_rtcode != 0) { 1547 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1548 __func__, 1549 (int)prepcblk->ccp_rtcode, 1550 (int)prepcblk->ccp_rscode); 1551 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1552 rc = -EBUSY; 1553 else 1554 rc = -EIO; 1555 goto out; 1556 } 1557 if (prepcblk->ccp_rscode != 0) { 1558 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1559 __func__, 1560 (int)prepcblk->ccp_rtcode, 1561 (int)prepcblk->ccp_rscode); 1562 } 1563 1564 /* process response cprb param block */ 1565 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1566 prepcblk->rpl_parmb = (u8 __user *)ptr; 1567 prepparm = (struct aurepparm *)ptr; 1568 1569 /* check the returned keyblock */ 1570 if (prepparm->vud.ckb.version != 0x02) { 1571 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n", 1572 __func__, (int)prepparm->vud.ckb.version); 1573 rc = -EIO; 1574 goto out; 1575 } 1576 if (prepparm->vud.ckb.algo != 0x81) { 1577 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n", 1578 __func__, (int)prepparm->vud.ckb.algo); 1579 rc = -EIO; 1580 goto out; 1581 } 1582 1583 /* copy the translated protected key */ 1584 if (prepparm->vud.ckb.keylen > *protkeylen) { 1585 ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n", 1586 __func__, prepparm->vud.ckb.keylen, *protkeylen); 1587 rc = -EIO; 1588 goto out; 1589 } 1590 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1591 *protkeylen = prepparm->vud.ckb.keylen; 1592 if (protkeytype) 1593 *protkeytype = PKEY_KEYTYPE_ECC; 1594 1595 out: 1596 free_cprbmem(mem, PARMBSIZE, true, xflags); 1597 return rc; 1598 } 1599 EXPORT_SYMBOL(cca_ecc2protkey); 1600 1601 /* 1602 * query cryptographic facility from CCA adapter 1603 */ 1604 int cca_query_crypto_facility(u16 cardnr, u16 domain, 1605 const char *keyword, 1606 u8 *rarray, size_t *rarraylen, 1607 u8 *varray, size_t *varraylen, 1608 u32 xflags) 1609 { 1610 int rc; 1611 u16 len; 1612 u8 *mem, *ptr; 1613 struct CPRBX *preqcblk, *prepcblk; 1614 struct ica_xcRB xcrb; 1615 struct fqreqparm { 1616 u8 subfunc_code[2]; 1617 u16 rule_array_len; 1618 char rule_array[8]; 1619 struct lv1 { 1620 u16 len; 1621 u8 data[VARDATASIZE]; 1622 } lv1; 1623 u16 dummylen; 1624 } __packed * preqparm; 1625 size_t parmbsize = sizeof(struct fqreqparm); 1626 struct fqrepparm { 1627 u8 subfunc_code[2]; 1628 u8 lvdata[]; 1629 } __packed * prepparm; 1630 size_t datalen; 1631 1632 /* get already prepared memory for 2 cprbs with param block each */ 1633 rc = alloc_and_prep_cprbmem(parmbsize, &mem, 1634 &preqcblk, &prepcblk, xflags); 1635 if (rc) 1636 return rc; 1637 1638 /* fill request cprb struct */ 1639 preqcblk->domain = domain; 1640 1641 /* fill request cprb param block with FQ request */ 1642 preqparm = (struct fqreqparm __force *)preqcblk->req_parmb; 1643 memcpy(preqparm->subfunc_code, "FQ", 2); 1644 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array)); 1645 preqparm->rule_array_len = 1646 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 1647 preqparm->lv1.len = sizeof(preqparm->lv1); 1648 preqparm->dummylen = sizeof(preqparm->dummylen); 1649 preqcblk->req_parml = parmbsize; 1650 1651 /* fill xcrb struct */ 1652 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1653 1654 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1655 rc = zcrypt_send_cprb(&xcrb, xflags); 1656 if (rc) { 1657 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1658 __func__, (int)cardnr, (int)domain, rc); 1659 goto out; 1660 } 1661 1662 /* check response returncode and reasoncode */ 1663 if (prepcblk->ccp_rtcode != 0) { 1664 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1665 __func__, 1666 (int)prepcblk->ccp_rtcode, 1667 (int)prepcblk->ccp_rscode); 1668 rc = -EIO; 1669 goto out; 1670 } 1671 1672 /* process response cprb param block */ 1673 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1674 prepcblk->rpl_parmb = (u8 __user *)ptr; 1675 prepparm = (struct fqrepparm *)ptr; 1676 ptr = prepparm->lvdata; 1677 datalen = parmbsize - 2 * sizeof(u8); 1678 1679 /* check and possibly copy reply rule array */ 1680 len = *((u16 *)ptr); 1681 if (len > datalen) { 1682 ZCRYPT_DBF_ERR("%s reply rule array len %u exceeds datalen %zu\n", 1683 __func__, len, datalen); 1684 rc = -EIO; 1685 goto out; 1686 } 1687 datalen -= sizeof(u16); 1688 ptr += sizeof(u16); 1689 if (len > sizeof(u16)) { 1690 len -= sizeof(u16); 1691 if (rarray && rarraylen && *rarraylen > 0) { 1692 *rarraylen = (len > *rarraylen ? *rarraylen : len); 1693 memcpy(rarray, ptr, *rarraylen); 1694 } 1695 datalen -= len; 1696 ptr += len; 1697 } 1698 /* check and possible copy reply var array */ 1699 len = *((u16 *)ptr); 1700 if (len > datalen) { 1701 ZCRYPT_DBF_ERR("%s reply var array len %u exceeds datalen %zu\n", 1702 __func__, len, datalen); 1703 rc = -EIO; 1704 goto out; 1705 } 1706 datalen -= sizeof(u16); 1707 ptr += sizeof(u16); 1708 if (len > sizeof(u16)) { 1709 len -= sizeof(u16); 1710 if (varray && varraylen && *varraylen > 0) { 1711 *varraylen = (len > *varraylen ? *varraylen : len); 1712 memcpy(varray, ptr, *varraylen); 1713 } 1714 datalen -= len; 1715 ptr += len; 1716 } 1717 1718 out: 1719 free_cprbmem(mem, parmbsize, false, xflags); 1720 return rc; 1721 } 1722 EXPORT_SYMBOL(cca_query_crypto_facility); 1723 1724 /* 1725 * Fetch cca_info values about a CCA queue via 1726 * query_crypto_facility from adapter. 1727 */ 1728 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags) 1729 { 1730 void *mem; 1731 int rc, found = 0; 1732 size_t rlen, vlen; 1733 u8 *rarray, *varray; 1734 struct zcrypt_device_status_ext devstat; 1735 1736 memset(ci, 0, sizeof(*ci)); 1737 1738 /* if specific domain given, fetch status and hw info for this apqn */ 1739 if (domain != AUTOSEL_DOM) { 1740 rc = zcrypt_device_status_ext(cardnr, domain, &devstat); 1741 if (rc) 1742 return rc; 1743 ci->hwtype = devstat.hwtype; 1744 } 1745 1746 /* 1747 * Prep memory for rule array and var array use. 1748 * Use the cprb mempool for this. 1749 */ 1750 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1751 mempool_alloc_preallocated(cprb_mempool) : 1752 mempool_alloc(cprb_mempool, GFP_KERNEL); 1753 if (!mem) 1754 return -ENOMEM; 1755 rarray = (u8 *)mem; 1756 varray = (u8 *)mem + PAGE_SIZE / 2; 1757 rlen = vlen = PAGE_SIZE / 2; 1758 1759 /* QF for this card/domain */ 1760 rc = cca_query_crypto_facility(cardnr, domain, "STATICSA", 1761 rarray, &rlen, varray, &vlen, xflags); 1762 if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) { 1763 memcpy(ci->serial, rarray, 8); 1764 ci->new_asym_mk_state = (char)rarray[4 * 8]; 1765 ci->cur_asym_mk_state = (char)rarray[5 * 8]; 1766 ci->old_asym_mk_state = (char)rarray[6 * 8]; 1767 if (ci->old_asym_mk_state == '2') 1768 memcpy(ci->old_asym_mkvp, varray + 64, 16); 1769 if (ci->cur_asym_mk_state == '2') 1770 memcpy(ci->cur_asym_mkvp, varray + 84, 16); 1771 if (ci->new_asym_mk_state == '3') 1772 memcpy(ci->new_asym_mkvp, varray + 104, 16); 1773 ci->new_aes_mk_state = (char)rarray[7 * 8]; 1774 ci->cur_aes_mk_state = (char)rarray[8 * 8]; 1775 ci->old_aes_mk_state = (char)rarray[9 * 8]; 1776 if (ci->old_aes_mk_state == '2') 1777 memcpy(&ci->old_aes_mkvp, varray + 172, 8); 1778 if (ci->cur_aes_mk_state == '2') 1779 memcpy(&ci->cur_aes_mkvp, varray + 184, 8); 1780 if (ci->new_aes_mk_state == '3') 1781 memcpy(&ci->new_aes_mkvp, varray + 196, 8); 1782 found++; 1783 } 1784 if (!found) 1785 goto out; 1786 rlen = vlen = PAGE_SIZE / 2; 1787 rc = cca_query_crypto_facility(cardnr, domain, "STATICSB", 1788 rarray, &rlen, varray, &vlen, xflags); 1789 if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) { 1790 ci->new_apka_mk_state = (char)rarray[10 * 8]; 1791 ci->cur_apka_mk_state = (char)rarray[11 * 8]; 1792 ci->old_apka_mk_state = (char)rarray[12 * 8]; 1793 if (ci->old_apka_mk_state == '2') 1794 memcpy(&ci->old_apka_mkvp, varray + 208, 8); 1795 if (ci->cur_apka_mk_state == '2') 1796 memcpy(&ci->cur_apka_mkvp, varray + 220, 8); 1797 if (ci->new_apka_mk_state == '3') 1798 memcpy(&ci->new_apka_mkvp, varray + 232, 8); 1799 found++; 1800 } 1801 1802 out: 1803 mempool_free(mem, cprb_mempool); 1804 return found == 2 ? 0 : -ENOENT; 1805 } 1806 EXPORT_SYMBOL(cca_get_info); 1807 1808 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain, 1809 int minhwtype, int mktype, 1810 const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags) 1811 { 1812 struct zcrypt_device_status_ext *device_status; 1813 int i, card, dom, curmatch, oldmatch; 1814 struct cca_info ci; 1815 u32 _nr_apqns = 0; 1816 1817 /* occupy the device status memory */ 1818 mutex_lock(&dev_status_mem_mutex); 1819 memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE); 1820 device_status = (struct zcrypt_device_status_ext *)dev_status_mem; 1821 1822 /* fetch crypto device status into this struct */ 1823 zcrypt_device_status_mask_ext(device_status, 1824 ZCRYPT_DEV_STATUS_CARD_MAX, 1825 ZCRYPT_DEV_STATUS_QUEUE_MAX); 1826 1827 /* walk through all the crypto apqnss */ 1828 for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) { 1829 card = AP_QID_CARD(device_status[i].qid); 1830 dom = AP_QID_QUEUE(device_status[i].qid); 1831 /* check online state */ 1832 if (!device_status[i].online) 1833 continue; 1834 /* check for cca functions */ 1835 if (!(device_status[i].functions & 0x04)) 1836 continue; 1837 /* check cardnr */ 1838 if (cardnr != 0xFFFF && card != cardnr) 1839 continue; 1840 /* check domain */ 1841 if (domain != 0xFFFF && dom != domain) 1842 continue; 1843 /* get cca info on this apqn */ 1844 if (cca_get_info(card, dom, &ci, xflags)) 1845 continue; 1846 /* current master key needs to be valid */ 1847 if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2') 1848 continue; 1849 if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2') 1850 continue; 1851 /* check min hardware type */ 1852 if (minhwtype > 0 && minhwtype > ci.hwtype) 1853 continue; 1854 if (ptr_cur_mkvp || ptr_old_mkvp) { 1855 /* check mkvps */ 1856 curmatch = oldmatch = 0; 1857 if (mktype == AES_MK_SET) { 1858 if (ptr_cur_mkvp && 1859 !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp, 1860 sizeof(ci.cur_aes_mkvp))) 1861 curmatch = 1; 1862 if (ptr_old_mkvp && 1863 ci.old_aes_mk_state == '2' && 1864 !memcmp(ptr_old_mkvp, ci.old_aes_mkvp, 1865 sizeof(ci.old_aes_mkvp))) 1866 oldmatch = 1; 1867 } else { 1868 if (ptr_cur_mkvp && 1869 !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp, 1870 sizeof(ci.cur_apka_mkvp))) 1871 curmatch = 1; 1872 if (ptr_old_mkvp && 1873 ci.old_apka_mk_state == '2' && 1874 !memcmp(ptr_old_mkvp, ci.old_apka_mkvp, 1875 sizeof(ci.old_apka_mkvp))) 1876 oldmatch = 1; 1877 } 1878 if (curmatch + oldmatch < 1) 1879 continue; 1880 } 1881 /* apqn passed all filtering criterons, add to the array */ 1882 if (_nr_apqns < *nr_apqns) 1883 apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom); 1884 } 1885 1886 *nr_apqns = _nr_apqns; 1887 1888 /* release the device status memory */ 1889 mutex_unlock(&dev_status_mem_mutex); 1890 1891 return _nr_apqns ? 0 : -ENODEV; 1892 } 1893 EXPORT_SYMBOL(cca_findcard2); 1894 1895 int __init zcrypt_ccamisc_init(void) 1896 { 1897 /* Pre-allocate a small memory pool for cca cprbs. */ 1898 cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold, 1899 CPRB_MEMPOOL_ITEM_SIZE); 1900 if (!cprb_mempool) 1901 return -ENOMEM; 1902 1903 /* Pre-allocate one crypto status card struct used in findcard() */ 1904 dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL); 1905 if (!dev_status_mem) { 1906 mempool_destroy(cprb_mempool); 1907 return -ENOMEM; 1908 } 1909 1910 return 0; 1911 } 1912 1913 void zcrypt_ccamisc_exit(void) 1914 { 1915 mutex_lock(&dev_status_mem_mutex); 1916 kvfree(dev_status_mem); 1917 mutex_unlock(&dev_status_mem_mutex); 1918 mempool_destroy(cprb_mempool); 1919 } 1920