1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright IBM Corp. 2001, 2023
4 * Author(s): Robert Burroughs
5 * Eric Rossman (edrossma@us.ibm.com)
6 *
7 * Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
8 * Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
9 * Ralph Wuerthner <rwuerthn@de.ibm.com>
10 * MSGTYPE restruct: Holger Dengler <hd@linux.vnet.ibm.com>
11 */
12
13 #define pr_fmt(fmt) "zcrypt: " fmt
14
15 #include <linux/module.h>
16 #include <linux/init.h>
17 #include <linux/err.h>
18 #include <linux/delay.h>
19 #include <linux/slab.h>
20 #include <linux/atomic.h>
21 #include <linux/uaccess.h>
22 #include <linux/unaligned.h>
23
24 #include "ap_bus.h"
25 #include "zcrypt_api.h"
26 #include "zcrypt_error.h"
27 #include "zcrypt_msgtype6.h"
28 #include "zcrypt_cca_key.h"
29
30 #define CEXXC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply */
31
32 #define CEIL4(x) ((((x) + 3) / 4) * 4)
33
34 #define CEXXC_RESPONSE_TYPE_ICA 0
35 #define CEXXC_RESPONSE_TYPE_XCRB 1
36 #define CEXXC_RESPONSE_TYPE_EP11 2
37
38 /* smallest possible EP11 payload size */
39 #define MIN_EP11_PAYLOAD_SIZE 5
40
41 MODULE_AUTHOR("IBM Corporation");
42 MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
43 "Copyright IBM Corp. 2001, 2023");
44 MODULE_LICENSE("GPL");
45
46 struct function_and_rules_block {
47 unsigned char function_code[2];
48 unsigned short ulen;
49 unsigned char only_rule[8];
50 } __packed;
51
52 /*
53 * The following is used to initialize the CPRBX passed to the CEXxC/CEXxP
54 * card in a type6 message. The 3 fields that must be filled in at execution
55 * time are req_parml, rpl_parml and usage_domain.
56 * Everything about this interface is ascii/big-endian, since the
57 * device does *not* have 'Intel inside'.
58 *
59 * The CPRBX is followed immediately by the parm block.
60 * The parm block contains:
61 * - function code ('PD' 0x5044 or 'PK' 0x504B)
62 * - rule block (one of:)
63 * + 0x000A 'PKCS-1.2' (MCL2 'PD')
64 * + 0x000A 'ZERO-PAD' (MCL2 'PK')
65 * + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
66 * + 0x000A 'MRP ' (MCL3 'PK' or CEX2C 'PK')
67 * - VUD block
68 */
69 static const struct CPRBX static_cprbx = {
70 .cprb_len = 0x00DC,
71 .cprb_ver_id = 0x02,
72 .func_id = {'T', '2'},
73 };
74
speed_idx_cca(int req_type)75 int speed_idx_cca(int req_type)
76 {
77 switch (req_type) {
78 case 0x4142:
79 case 0x4149:
80 case 0x414D:
81 case 0x4341:
82 case 0x4344:
83 case 0x4354:
84 case 0x4358:
85 case 0x444B:
86 case 0x4558:
87 case 0x4643:
88 case 0x4651:
89 case 0x4C47:
90 case 0x4C4B:
91 case 0x4C51:
92 case 0x4F48:
93 case 0x504F:
94 case 0x5053:
95 case 0x5058:
96 case 0x5343:
97 case 0x5344:
98 case 0x5345:
99 case 0x5350:
100 return LOW;
101 case 0x414B:
102 case 0x4345:
103 case 0x4349:
104 case 0x434D:
105 case 0x4847:
106 case 0x4849:
107 case 0x484D:
108 case 0x4850:
109 case 0x4851:
110 case 0x4954:
111 case 0x4958:
112 case 0x4B43:
113 case 0x4B44:
114 case 0x4B45:
115 case 0x4B47:
116 case 0x4B48:
117 case 0x4B49:
118 case 0x4B4E:
119 case 0x4B50:
120 case 0x4B52:
121 case 0x4B54:
122 case 0x4B58:
123 case 0x4D50:
124 case 0x4D53:
125 case 0x4D56:
126 case 0x4D58:
127 case 0x5044:
128 case 0x5045:
129 case 0x5046:
130 case 0x5047:
131 case 0x5049:
132 case 0x504B:
133 case 0x504D:
134 case 0x5254:
135 case 0x5347:
136 case 0x5349:
137 case 0x534B:
138 case 0x534D:
139 case 0x5356:
140 case 0x5358:
141 case 0x5443:
142 case 0x544B:
143 case 0x5647:
144 return HIGH;
145 default:
146 return MEDIUM;
147 }
148 }
149
speed_idx_ep11(int req_type)150 int speed_idx_ep11(int req_type)
151 {
152 switch (req_type) {
153 case 1:
154 case 2:
155 case 36:
156 case 37:
157 case 38:
158 case 39:
159 case 40:
160 return LOW;
161 case 17:
162 case 18:
163 case 19:
164 case 20:
165 case 21:
166 case 22:
167 case 26:
168 case 30:
169 case 31:
170 case 32:
171 case 33:
172 case 34:
173 case 35:
174 return HIGH;
175 default:
176 return MEDIUM;
177 }
178 }
179
180 /*
181 * Convert a ICAMEX message to a type6 MEX message.
182 *
183 * @zq: crypto device pointer
184 * @ap_msg: pointer to AP message
185 * @mex: pointer to user input data
186 *
187 * Returns 0 on success or negative errno value.
188 */
icamex_msg_to_type6mex_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo * mex)189 static int icamex_msg_to_type6mex_msgx(struct zcrypt_queue *zq,
190 struct ap_message *ap_msg,
191 struct ica_rsa_modexpo *mex)
192 {
193 static struct type6_hdr static_type6_hdrX = {
194 .type = 0x06,
195 .offset1 = 0x00000058,
196 .agent_id = {'C', 'A',},
197 .function_code = {'P', 'K'},
198 };
199 static struct function_and_rules_block static_pke_fnr = {
200 .function_code = {'P', 'K'},
201 .ulen = 10,
202 .only_rule = {'M', 'R', 'P', ' ', ' ', ' ', ' ', ' '}
203 };
204 struct {
205 struct type6_hdr hdr;
206 struct CPRBX cprbx;
207 struct function_and_rules_block fr;
208 unsigned short length;
209 char text[];
210 } __packed * msg = ap_msg->msg;
211 int size;
212
213 /*
214 * The inputdatalength was a selection criteria in the dispatching
215 * function zcrypt_rsa_modexpo(). However, make sure the following
216 * copy_from_user() never exceeds the allocated buffer space.
217 */
218 if (WARN_ON_ONCE(mex->inputdatalength > PAGE_SIZE))
219 return -EINVAL;
220
221 /* VUD.ciphertext */
222 msg->length = mex->inputdatalength + 2;
223 if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
224 return -EFAULT;
225
226 /* Set up key which is located after the variable length text. */
227 size = zcrypt_type6_mex_key_en(mex, msg->text + mex->inputdatalength);
228 if (size < 0)
229 return size;
230 size += sizeof(*msg) + mex->inputdatalength;
231
232 /* message header, cprbx and f&r */
233 msg->hdr = static_type6_hdrX;
234 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
235 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
236
237 msg->cprbx = static_cprbx;
238 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
239 msg->cprbx.rpl_msgbl = msg->hdr.fromcardlen1;
240
241 msg->fr = static_pke_fnr;
242
243 msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
244
245 ap_msg->len = size;
246 return 0;
247 }
248
249 /*
250 * Convert a ICACRT message to a type6 CRT message.
251 *
252 * @zq: crypto device pointer
253 * @ap_msg: pointer to AP message
254 * @crt: pointer to user input data
255 *
256 * Returns 0 on success or negative errno value.
257 */
icacrt_msg_to_type6crt_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo_crt * crt)258 static int icacrt_msg_to_type6crt_msgx(struct zcrypt_queue *zq,
259 struct ap_message *ap_msg,
260 struct ica_rsa_modexpo_crt *crt)
261 {
262 static struct type6_hdr static_type6_hdrX = {
263 .type = 0x06,
264 .offset1 = 0x00000058,
265 .agent_id = {'C', 'A',},
266 .function_code = {'P', 'D'},
267 };
268 static struct function_and_rules_block static_pkd_fnr = {
269 .function_code = {'P', 'D'},
270 .ulen = 10,
271 .only_rule = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
272 };
273
274 struct {
275 struct type6_hdr hdr;
276 struct CPRBX cprbx;
277 struct function_and_rules_block fr;
278 unsigned short length;
279 char text[];
280 } __packed * msg = ap_msg->msg;
281 int size;
282
283 /*
284 * The inputdatalength was a selection criteria in the dispatching
285 * function zcrypt_rsa_crt(). However, make sure the following
286 * copy_from_user() never exceeds the allocated buffer space.
287 */
288 if (WARN_ON_ONCE(crt->inputdatalength > PAGE_SIZE))
289 return -EINVAL;
290
291 /* VUD.ciphertext */
292 msg->length = crt->inputdatalength + 2;
293 if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
294 return -EFAULT;
295
296 /* Set up key which is located after the variable length text. */
297 size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength);
298 if (size < 0)
299 return size;
300 size += sizeof(*msg) + crt->inputdatalength; /* total size of msg */
301
302 /* message header, cprbx and f&r */
303 msg->hdr = static_type6_hdrX;
304 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
305 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
306
307 msg->cprbx = static_cprbx;
308 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
309 msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
310 size - sizeof(msg->hdr) - sizeof(msg->cprbx);
311
312 msg->fr = static_pkd_fnr;
313
314 ap_msg->len = size;
315 return 0;
316 }
317
318 /*
319 * Convert a XCRB message to a type6 CPRB message.
320 *
321 * @zq: crypto device pointer
322 * @ap_msg: pointer to AP message
323 * @xcRB: pointer to user input data
324 *
325 * Returns 0 on success or -EFAULT, -EINVAL.
326 */
327 struct type86_fmt2_msg {
328 struct type86_hdr hdr;
329 struct type86_fmt2_ext fmt2;
330 } __packed;
331
xcrb_msg_to_type6cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ica_xcRB * xcrb,unsigned int * fcode,unsigned int * domain)332 static int xcrb_msg_to_type6cprb_msgx(bool userspace, struct ap_message *ap_msg,
333 struct ica_xcRB *xcrb,
334 unsigned int *fcode,
335 unsigned int *domain)
336 {
337 static struct type6_hdr static_type6_hdrX = {
338 .type = 0x06,
339 .offset1 = 0x00000058,
340 };
341 struct {
342 struct type6_hdr hdr;
343 union {
344 struct CPRBX cprbx;
345 DECLARE_FLEX_ARRAY(u8, userdata);
346 };
347 } __packed * msg = ap_msg->msg;
348
349 size_t req_cblen, rep_cblen, req_sumlen, rep_sumlen;
350 char *function_code, *req_data;
351
352 /* request length and overflow checks */
353 if (xcrb->request_control_blk_length < sizeof(struct CPRBX))
354 return -EINVAL;
355 req_cblen = CEIL4((size_t)xcrb->request_control_blk_length);
356 if (req_cblen > U32_MAX)
357 return -EINVAL;
358 req_sumlen = req_cblen + xcrb->request_data_length;
359 if (req_sumlen > U32_MAX)
360 return -EINVAL;
361 ap_msg->len = sizeof(struct type6_hdr) + req_sumlen;
362 if (ap_msg->len > ap_msg->bufsize)
363 return -EINVAL;
364 if (req_cblen <= xcrb->request_data_length ?
365 req_sumlen < xcrb->request_data_length :
366 req_sumlen < req_cblen) {
367 return -EINVAL;
368 }
369
370 /* reply length and overflow checks */
371 if (xcrb->reply_control_blk_length < sizeof(struct CPRBX))
372 return -EINVAL;
373 rep_cblen = CEIL4((size_t)xcrb->reply_control_blk_length);
374 if (rep_cblen > U32_MAX)
375 return -EINVAL;
376 rep_sumlen = rep_cblen + xcrb->reply_data_length;
377 if (rep_sumlen > U32_MAX)
378 return -EINVAL;
379 if (rep_cblen <= xcrb->reply_data_length ?
380 rep_sumlen < xcrb->reply_data_length :
381 rep_sumlen < rep_cblen) {
382 return -EINVAL;
383 }
384
385 /* prepare type6 header */
386 msg->hdr = static_type6_hdrX;
387 memcpy(msg->hdr.agent_id, &xcrb->agent_ID, sizeof(xcrb->agent_ID));
388 msg->hdr.tocardlen1 = xcrb->request_control_blk_length;
389 if (xcrb->request_data_length) {
390 msg->hdr.offset2 = msg->hdr.offset1 + req_cblen;
391 msg->hdr.tocardlen2 = xcrb->request_data_length;
392 }
393 msg->hdr.fromcardlen1 = xcrb->reply_control_blk_length;
394 msg->hdr.fromcardlen2 = xcrb->reply_data_length;
395
396 /* prepare CPRB */
397 if (z_copy_from_user(userspace, msg->userdata,
398 xcrb->request_control_blk_addr,
399 xcrb->request_control_blk_length))
400 return -EFAULT;
401 /* pad tail with 0 up to req_cblen */
402 if (xcrb->request_control_blk_length < req_cblen)
403 memset(msg->userdata + xcrb->request_control_blk_length,
404 0, req_cblen - xcrb->request_control_blk_length);
405 /* copy subfunction code into AP msg type 6 function code field */
406 if (msg->cprbx.cprb_len > req_cblen - sizeof(msg->hdr.function_code))
407 return -EINVAL;
408 function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
409 memcpy(msg->hdr.function_code, function_code,
410 sizeof(msg->hdr.function_code));
411
412 *fcode = (msg->hdr.function_code[0] << 8) | msg->hdr.function_code[1];
413 if (domain)
414 *domain = msg->cprbx.domain;
415
416 /* check subfunction, US and AU need special flag with NQAP */
417 if (memcmp(function_code, "US", 2) == 0 ||
418 memcmp(function_code, "AU", 2) == 0)
419 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
420
421 /* check CPRB minor version, set info bits in ap_message flag field */
422 switch (*(unsigned short *)(&msg->cprbx.func_id[0])) {
423 case 0x5432: /* "T2" */
424 ap_msg->flags |= AP_MSG_FLAG_USAGE;
425 break;
426 case 0x5433: /* "T3" */
427 case 0x5435: /* "T5" */
428 case 0x5436: /* "T6" */
429 case 0x5437: /* "T7" */
430 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
431 break;
432 default:
433 pr_debug("unknown CPRB minor version '%c%c'\n",
434 msg->cprbx.func_id[0], msg->cprbx.func_id[1]);
435 }
436
437 /* copy data block */
438 if (xcrb->request_data_length) {
439 req_data = ap_msg->msg + sizeof(struct type6_hdr) + req_cblen;
440 if (z_copy_from_user(userspace, req_data,
441 xcrb->request_data_address,
442 xcrb->request_data_length))
443 return -EFAULT;
444 }
445
446 return 0;
447 }
448
449 /*
450 * Simple asn1 int reader/decoder helper function
451 * Returns number of bytes processed or < 0 on failure
452 * Only accepts int length values of 1, 2 or 4.
453 */
asn1_int_decode(const u8 * buf,size_t intlen,u32 * u)454 static inline int asn1_int_decode(const u8 *buf, size_t intlen, u32 *u)
455 {
456 switch (intlen) {
457 case 1:
458 *u = (u32)(*buf);
459 return 1;
460 case 2:
461 *u = (u32)get_unaligned_be16(buf);
462 return 2;
463 case 4:
464 *u = (u32)get_unaligned_be32(buf);
465 return 4;
466 default:
467 return -EINVAL;
468 }
469 }
470
471 /*
472 * Simple asn1 length parse helper function
473 * Returns number of bytes processed or < 0 on failure
474 * Only accepts length encoded within the length octet
475 * or for long form 1, 2 or 4 octet length bytes.
476 */
asn1_length_decode(const u8 * buf,size_t buflen,u32 * u)477 static inline int asn1_length_decode(const u8 *buf, size_t buflen, u32 *u)
478 {
479 int i;
480
481 if (buflen < 1)
482 return -EINVAL;
483
484 if (*buf < 128) {
485 *u = (u32)(*buf & 0x7F);
486 return 1;
487 }
488
489 i = *buf & 0x7F;
490 if (--buflen < i)
491 return -EINVAL;
492 i = asn1_int_decode(++buf, i, u);
493
494 return i < 0 ? i : i + 1;
495 }
496
xcrb_msg_to_type6_ep11cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ep11_urb * xcrb,unsigned int * fcode,unsigned int * domain)497 static int xcrb_msg_to_type6_ep11cprb_msgx(bool userspace, struct ap_message *ap_msg,
498 struct ep11_urb *xcrb,
499 unsigned int *fcode,
500 unsigned int *domain)
501 {
502 static struct type6_hdr static_type6_ep11_hdr = {
503 .type = 0x06,
504 .rqid = {0x00, 0x01},
505 .function_code = {0x00, 0x00},
506 .agent_id = {'X', 'C'},
507 .offset1 = 0x00000058,
508 };
509
510 struct {
511 struct type6_hdr hdr;
512 union {
513 struct ep11_cprb cprbx;
514 DECLARE_FLEX_ARRAY(u8, userdata);
515 };
516 } __packed * msg = ap_msg->msg;
517
518 size_t req_len, rep_len, pld_len;
519 unsigned char *pld;
520 int offs = 0, i;
521 unsigned int u;
522
523 /* request length and overflow checks */
524 if (xcrb->req_len < sizeof(struct ep11_cprb) + MIN_EP11_PAYLOAD_SIZE)
525 return -EINVAL;
526 req_len = CEIL4(xcrb->req_len);
527 if (req_len < xcrb->req_len || req_len > U32_MAX)
528 return -EINVAL;
529 ap_msg->len = sizeof(struct type6_hdr) + req_len;
530 if (ap_msg->len > ap_msg->bufsize)
531 return -EINVAL;
532
533 /* reply length and overflow checks */
534 if (xcrb->resp_len < sizeof(struct ep11_cprb))
535 return -EINVAL;
536 rep_len = CEIL4(xcrb->resp_len);
537 if (rep_len < xcrb->resp_len || rep_len > U32_MAX)
538 return -EINVAL;
539
540 /* prepare type6 header */
541 msg->hdr = static_type6_ep11_hdr;
542 msg->hdr.tocardlen1 = xcrb->req_len;
543 msg->hdr.fromcardlen1 = xcrb->resp_len;
544
545 /* Import CPRB data from the ioctl input parameter */
546 if (z_copy_from_user(userspace, msg->userdata,
547 (char __force __user *)xcrb->req, xcrb->req_len))
548 return -EFAULT;
549 /* pad tail with 0 up to req_len */
550 if (xcrb->req_len < req_len)
551 memset(msg->userdata + xcrb->req_len, 0,
552 req_len - xcrb->req_len);
553
554 pld = msg->userdata + sizeof(struct ep11_cprb);
555 pld_len = msg->cprbx.payload_len;
556 if (pld_len != xcrb->req_len - sizeof(struct ep11_cprb))
557 return -EINVAL;
558 /*
559 * At this point pld_len is always >= MIN_EP11_PAYLOAD_SIZE
560 * and the smallest supported asn1 payload is:
561 * payload tag (1 octet)
562 * payload length (1-5 octets)
563 * function tag (1 octet)
564 * function length (1-5 octets)
565 * function value (1-4 octets)
566 */
567
568 /* payload tag */
569 if (pld[offs++] != 0x30)
570 return -EINVAL;
571 /* payload length field */
572 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
573 if (i < 0)
574 return -EINVAL;
575 offs += i;
576 if (offs >= pld_len || u > pld_len - offs)
577 return -EINVAL;
578 /* function tag */
579 if (pld[offs++] != 0x04)
580 return -EINVAL;
581 /* function length */
582 if (offs >= pld_len)
583 return -EINVAL;
584 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
585 if (i < 0)
586 return -EINVAL;
587 offs += i;
588 if (offs >= pld_len || u > pld_len - offs)
589 return -EINVAL;
590 /* function value */
591 i = asn1_int_decode(pld + offs, u, &u);
592 if (i < 0)
593 return -EINVAL;
594 offs += i;
595 *fcode = 0xFFFF & u;
596
597 /* enable special processing based on the cprbs flags special bit */
598 if (msg->cprbx.flags & 0x20)
599 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
600
601 /* set info bits in ap_message flag field */
602 if (msg->cprbx.flags & 0x80)
603 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
604 else
605 ap_msg->flags |= AP_MSG_FLAG_USAGE;
606
607 if (domain)
608 *domain = msg->cprbx.target_id;
609
610 return 0;
611 }
612
613 /*
614 * Copy results from a type 86 ICA reply message back to user space.
615 *
616 * @zq: crypto device pointer
617 * @reply: reply AP message.
618 * @data: pointer to user output data
619 * @length: size of user output data
620 *
621 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
622 */
623 struct type86x_reply {
624 struct type86_hdr hdr;
625 struct type86_fmt2_ext fmt2;
626 struct CPRBX cprbx;
627 unsigned char pad[4]; /* 4 byte function code/rules block ? */
628 unsigned short length; /* length of data including length field size */
629 char data[];
630 } __packed;
631
632 struct type86_ep11_reply {
633 struct type86_hdr hdr;
634 struct type86_fmt2_ext fmt2;
635 struct ep11_cprb cprbx;
636 } __packed;
637
convert_type86_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)638 static int convert_type86_ica(struct zcrypt_queue *zq,
639 struct ap_message *reply,
640 char __user *outputdata,
641 unsigned int outputdatalength)
642 {
643 struct type86x_reply *msg = reply->msg;
644 unsigned short service_rc, service_rs;
645 unsigned int data_len;
646
647 service_rc = msg->cprbx.ccp_rtcode;
648 if (unlikely(service_rc != 0)) {
649 service_rs = msg->cprbx.ccp_rscode;
650 if ((service_rc == 8 && service_rs == 66) ||
651 (service_rc == 8 && service_rs == 65) ||
652 (service_rc == 8 && service_rs == 72) ||
653 (service_rc == 8 && service_rs == 770) ||
654 (service_rc == 12 && service_rs == 769)) {
655 ZCRYPT_DBF_WARN("%s dev=%02x.%04x rc/rs=%d/%d => rc=EINVAL\n",
656 __func__, AP_QID_CARD(zq->queue->qid),
657 AP_QID_QUEUE(zq->queue->qid),
658 (int)service_rc, (int)service_rs);
659 return -EINVAL;
660 }
661 zq->online = 0;
662 pr_err("Crypto dev=%02x.%04x rc/rs=%d/%d online=0 rc=EAGAIN\n",
663 AP_QID_CARD(zq->queue->qid),
664 AP_QID_QUEUE(zq->queue->qid),
665 (int)service_rc, (int)service_rs);
666 ZCRYPT_DBF_ERR("%s dev=%02x.%04x rc/rs=%d/%d => online=0 rc=EAGAIN\n",
667 __func__, AP_QID_CARD(zq->queue->qid),
668 AP_QID_QUEUE(zq->queue->qid),
669 (int)service_rc, (int)service_rs);
670 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
671 return -EAGAIN;
672 }
673 data_len = msg->length - sizeof(msg->length);
674 if (data_len > outputdatalength)
675 return -EMSGSIZE;
676
677 /* Copy the crypto response to user space. */
678 if (copy_to_user(outputdata, msg->data, data_len))
679 return -EFAULT;
680 return 0;
681 }
682
683 /*
684 * Copy results from a type 86 XCRB reply message back to user space.
685 *
686 * @zq: crypto device pointer
687 * @reply: reply AP message.
688 * @xcrb: pointer to XCRB
689 *
690 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
691 */
convert_type86_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)692 static int convert_type86_xcrb(bool userspace, struct zcrypt_queue *zq,
693 struct ap_message *reply,
694 struct ica_xcRB *xcrb)
695 {
696 struct type86_fmt2_msg *msg = reply->msg;
697 char *data = reply->msg;
698
699 /* Copy CPRB to user */
700 if (xcrb->reply_control_blk_length < msg->fmt2.count1) {
701 pr_debug("reply_control_blk_length %u < required %u => EMSGSIZE\n",
702 xcrb->reply_control_blk_length, msg->fmt2.count1);
703 return -EMSGSIZE;
704 }
705 if (z_copy_to_user(userspace, xcrb->reply_control_blk_addr,
706 data + msg->fmt2.offset1, msg->fmt2.count1))
707 return -EFAULT;
708 xcrb->reply_control_blk_length = msg->fmt2.count1;
709
710 /* Copy data buffer to user */
711 if (msg->fmt2.count2) {
712 if (xcrb->reply_data_length < msg->fmt2.count2) {
713 pr_debug("reply_data_length %u < required %u => EMSGSIZE\n",
714 xcrb->reply_data_length, msg->fmt2.count2);
715 return -EMSGSIZE;
716 }
717 if (z_copy_to_user(userspace, xcrb->reply_data_addr,
718 data + msg->fmt2.offset2, msg->fmt2.count2))
719 return -EFAULT;
720 }
721 xcrb->reply_data_length = msg->fmt2.count2;
722
723 return 0;
724 }
725
726 /*
727 * Copy results from a type 86 EP11 XCRB reply message back to user space.
728 *
729 * @zq: crypto device pointer
730 * @reply: reply AP message.
731 * @xcrb: pointer to EP11 user request block
732 *
733 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
734 */
convert_type86_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)735 static int convert_type86_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
736 struct ap_message *reply,
737 struct ep11_urb *xcrb)
738 {
739 struct type86_fmt2_msg *msg = reply->msg;
740 char *data = reply->msg;
741
742 if (xcrb->resp_len < msg->fmt2.count1) {
743 pr_debug("resp_len %u < required %u => EMSGSIZE\n",
744 (unsigned int)xcrb->resp_len, msg->fmt2.count1);
745 return -EMSGSIZE;
746 }
747
748 /* Copy response CPRB to user */
749 if (z_copy_to_user(userspace, (char __force __user *)xcrb->resp,
750 data + msg->fmt2.offset1, msg->fmt2.count1))
751 return -EFAULT;
752 xcrb->resp_len = msg->fmt2.count1;
753 return 0;
754 }
755
convert_type86_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * buffer)756 static int convert_type86_rng(struct zcrypt_queue *zq,
757 struct ap_message *reply,
758 char *buffer)
759 {
760 struct {
761 struct type86_hdr hdr;
762 struct type86_fmt2_ext fmt2;
763 struct CPRBX cprbx;
764 } __packed * msg = reply->msg;
765 char *data = reply->msg;
766
767 if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
768 return -EINVAL;
769 /*
770 * Note that offset2 and count2 have already been checked in
771 * zcrypt_msgtype6_receive(). So only check for valid count2
772 * and for not exceeding the hard coded rng buffer size.
773 */
774 if (!msg->fmt2.count2)
775 return -EINVAL;
776 if (msg->fmt2.count2 > ZCRYPT_RNG_BUFFER_SIZE)
777 return -EMSGSIZE;
778 memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
779 return msg->fmt2.count2;
780 }
781
convert_response_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)782 static int convert_response_ica(struct zcrypt_queue *zq,
783 struct ap_message *reply,
784 char __user *outputdata,
785 unsigned int outputdatalength)
786 {
787 struct type86x_reply *msg = reply->msg;
788
789 /* reply->len is always >= sizeof(struct error_hdr) here */
790
791 switch (msg->hdr.type) {
792 case TYPE82_RSP_CODE:
793 case TYPE88_RSP_CODE:
794 return convert_error(zq, reply);
795 case TYPE86_RSP_CODE:
796 if (msg->hdr.reply_code)
797 return convert_error(zq, reply);
798 if (reply->len < sizeof(struct type86x_reply))
799 return -EINVAL;
800 if (msg->cprbx.ccp_rtcode &&
801 msg->cprbx.ccp_rscode == 0x14f &&
802 outputdatalength > 256) {
803 if (zq->zcard->max_exp_bit_length <= 17) {
804 zq->zcard->max_exp_bit_length = 17;
805 return -EAGAIN;
806 } else {
807 return -EINVAL;
808 }
809 }
810 if (msg->cprbx.cprb_ver_id == 0x02)
811 return convert_type86_ica(zq, reply,
812 outputdata, outputdatalength);
813 fallthrough; /* wrong cprb version is an unknown response */
814 default:
815 /* Unknown response type, this should NEVER EVER happen */
816 zq->online = 0;
817 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
818 AP_QID_CARD(zq->queue->qid),
819 AP_QID_QUEUE(zq->queue->qid),
820 (int)msg->hdr.type);
821 ZCRYPT_DBF_ERR(
822 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
823 __func__, AP_QID_CARD(zq->queue->qid),
824 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
825 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
826 return -EAGAIN;
827 }
828 }
829
convert_response_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)830 static int convert_response_xcrb(bool userspace, struct zcrypt_queue *zq,
831 struct ap_message *reply,
832 struct ica_xcRB *xcrb)
833 {
834 struct type86x_reply *msg = reply->msg;
835
836 /* reply->len is always >= sizeof(struct error_hdr) here */
837
838 switch (msg->hdr.type) {
839 case TYPE82_RSP_CODE:
840 case TYPE88_RSP_CODE:
841 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
842 return convert_error(zq, reply);
843 case TYPE86_RSP_CODE:
844 if (msg->hdr.reply_code) {
845 if (reply->len < sizeof(struct type86_fmt2_msg))
846 xcrb->status = 0x0008044DL;
847 else
848 xcrb->status = msg->fmt2.apfs;
849 return convert_error(zq, reply);
850 }
851 if (reply->len < sizeof(struct type86_fmt2_msg) +
852 offsetof(struct CPRBX, cprb_ver_id) +
853 sizeof(msg->cprbx.cprb_ver_id))
854 return -EINVAL;
855 if (msg->cprbx.cprb_ver_id == 0x02)
856 return convert_type86_xcrb(userspace, zq, reply, xcrb);
857 fallthrough; /* wrong cprb version is an unknown response */
858 default: /* Unknown response type, this should NEVER EVER happen */
859 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
860 zq->online = 0;
861 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
862 AP_QID_CARD(zq->queue->qid),
863 AP_QID_QUEUE(zq->queue->qid),
864 (int)msg->hdr.type);
865 ZCRYPT_DBF_ERR(
866 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
867 __func__, AP_QID_CARD(zq->queue->qid),
868 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
869 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
870 return -EAGAIN;
871 }
872 }
873
convert_response_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)874 static int convert_response_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
875 struct ap_message *reply, struct ep11_urb *xcrb)
876 {
877 struct type86_ep11_reply *msg = reply->msg;
878
879 /* reply->len is always >= sizeof(struct error_hdr) here */
880
881 switch (msg->hdr.type) {
882 case TYPE82_RSP_CODE:
883 case TYPE87_RSP_CODE:
884 return convert_error(zq, reply);
885 case TYPE86_RSP_CODE:
886 if (msg->hdr.reply_code)
887 return convert_error(zq, reply);
888 if (reply->len < sizeof(struct type86_ep11_reply))
889 return -EINVAL;
890 if (msg->cprbx.cprb_ver_id == 0x04)
891 return convert_type86_ep11_xcrb(userspace, zq, reply, xcrb);
892 fallthrough; /* wrong cprb version is an unknown resp */
893 default: /* Unknown response type, this should NEVER EVER happen */
894 zq->online = 0;
895 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
896 AP_QID_CARD(zq->queue->qid),
897 AP_QID_QUEUE(zq->queue->qid),
898 (int)msg->hdr.type);
899 ZCRYPT_DBF_ERR(
900 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
901 __func__, AP_QID_CARD(zq->queue->qid),
902 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
903 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
904 return -EAGAIN;
905 }
906 }
907
convert_response_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * data)908 static int convert_response_rng(struct zcrypt_queue *zq,
909 struct ap_message *reply,
910 char *data)
911 {
912 struct type86x_reply *msg = reply->msg;
913
914 /* reply->len is always >= sizeof(struct error_hdr) here */
915
916 switch (msg->hdr.type) {
917 case TYPE82_RSP_CODE:
918 case TYPE88_RSP_CODE:
919 return -EINVAL;
920 case TYPE86_RSP_CODE:
921 if (msg->hdr.reply_code)
922 return -EINVAL;
923 if (reply->len < sizeof(struct type86x_reply))
924 return -EINVAL;
925 if (msg->cprbx.cprb_ver_id == 0x02)
926 return convert_type86_rng(zq, reply, data);
927 fallthrough; /* wrong cprb version is an unknown response */
928 default: /* Unknown response type, this should NEVER EVER happen */
929 zq->online = 0;
930 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
931 AP_QID_CARD(zq->queue->qid),
932 AP_QID_QUEUE(zq->queue->qid),
933 (int)msg->hdr.type);
934 ZCRYPT_DBF_ERR(
935 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
936 __func__, AP_QID_CARD(zq->queue->qid),
937 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
938 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
939 return -EAGAIN;
940 }
941 }
942
943 /*
944 * This function is called from the AP bus code after a crypto request
945 * "msg" has finished with the reply message "reply".
946 * It is called from tasklet context.
947 * @aq: pointer to the AP queue
948 * @msg: pointer to the AP message
949 * @reply: pointer to the AP reply message
950 */
zcrypt_msgtype6_receive(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)951 static void zcrypt_msgtype6_receive(struct ap_queue *aq,
952 struct ap_message *msg,
953 struct ap_message *reply)
954 {
955 static struct error_hdr error_reply = {
956 .type = TYPE82_RSP_CODE,
957 .reply_code = REP82_ERROR_MACHINE_FAILURE,
958 };
959 struct ap_response_type *resp_type = &msg->response;
960 struct type86x_reply *t86r;
961 size_t minlen, len;
962
963 /* Copy the reply message to the request message buffer. */
964 if (!reply)
965 goto out; /* ap_msg->rc indicates the error */
966
967 t86r = reply->msg;
968 minlen = sizeof(t86r->hdr) + sizeof(t86r->fmt2) +
969 offsetof(struct CPRBX, cprb_ver_id) +
970 sizeof(t86r->cprbx.cprb_ver_id);
971
972 if (reply->len < minlen ||
973 t86r->hdr.type != TYPE86_RSP_CODE ||
974 t86r->cprbx.cprb_ver_id != 0x02) {
975 if (reply->len < sizeof(error_reply)) {
976 /* total broken reply, use static error reply instead */
977 memcpy(msg->msg, &error_reply, sizeof(error_reply));
978 msg->len = sizeof(error_reply);
979 goto out;
980 } else {
981 /* malformed reply, convert function will handle this */
982 len = reply->len;
983 goto copy_len_and_out;
984 }
985 }
986
987 switch (resp_type->type) {
988 case CEXXC_RESPONSE_TYPE_ICA:
989 if (reply->len < sizeof(struct type86x_reply)) {
990 msg->rc = -EMSGSIZE;
991 pr_debug("rpl.len %zu < struct type86_reply, msg.rc=%d\n",
992 reply->len, msg->rc);
993 goto out;
994 }
995 len = sizeof(struct type86x_reply) + (size_t)t86r->length;
996 break;
997 case CEXXC_RESPONSE_TYPE_XCRB:
998 len = (size_t)t86r->fmt2.offset1 + (size_t)t86r->fmt2.count1;
999 if (len > reply->len) {
1000 msg->rc = -EMSGSIZE;
1001 pr_debug("offset1 %u count1 %u rpl.len %zu mismatch, msg.rc=%d\n",
1002 t86r->fmt2.offset1, t86r->fmt2.count1,
1003 reply->len, msg->rc);
1004 goto out;
1005 }
1006 if (t86r->fmt2.count2) {
1007 len = (size_t)t86r->fmt2.offset2 +
1008 (size_t)t86r->fmt2.count2;
1009 if (len > reply->len) {
1010 msg->rc = -EMSGSIZE;
1011 pr_debug("offset2 %u count2 %u rpl.len %zu mismatch, msg.rc=%d\n",
1012 t86r->fmt2.offset2, t86r->fmt2.count2,
1013 reply->len, msg->rc);
1014 goto out;
1015 }
1016 }
1017 break;
1018 default:
1019 memcpy(msg->msg, &error_reply, sizeof(error_reply));
1020 msg->len = sizeof(error_reply);
1021 goto out;
1022 }
1023
1024 copy_len_and_out:
1025 if (len != reply->len) {
1026 msg->rc = -EMSGSIZE;
1027 pr_debug("len %zu rpl.len %zu mismatch, msg.rc=%d\n",
1028 len, reply->len, msg->rc);
1029 goto out;
1030 }
1031 if (len > reply->bufsize || len > msg->bufsize) {
1032 msg->rc = -EMSGSIZE;
1033 pr_debug("len %zu exceeds buf %zu/%zu, msg.rc=%d\n",
1034 len, reply->bufsize, msg->bufsize, msg->rc);
1035 goto out;
1036 }
1037 memcpy(msg->msg, reply->msg, len);
1038 msg->len = len;
1039
1040 out:
1041 complete(&resp_type->work);
1042 }
1043
1044 /*
1045 * This function is called from the AP bus code after a crypto request
1046 * "msg" has finished with the reply message "reply".
1047 * It is called from tasklet context.
1048 * @aq: pointer to the AP queue
1049 * @msg: pointer to the AP message
1050 * @reply: pointer to the AP reply message
1051 */
zcrypt_msgtype6_receive_ep11(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)1052 static void zcrypt_msgtype6_receive_ep11(struct ap_queue *aq,
1053 struct ap_message *msg,
1054 struct ap_message *reply)
1055 {
1056 static struct error_hdr error_reply = {
1057 .type = TYPE82_RSP_CODE,
1058 .reply_code = REP82_ERROR_MACHINE_FAILURE,
1059 };
1060 struct ap_response_type *resp_type = &msg->response;
1061 struct type86_ep11_reply *t86r;
1062 size_t minlen, len;
1063
1064 /* Copy the reply message to the request message buffer. */
1065 if (!reply)
1066 goto out; /* ap_msg->rc indicates the error */
1067
1068 t86r = reply->msg;
1069 minlen = sizeof(t86r->hdr) + sizeof(t86r->fmt2) +
1070 offsetof(struct ep11_cprb, cprb_ver_id) +
1071 sizeof(t86r->cprbx.cprb_ver_id);
1072
1073 if (reply->len < minlen ||
1074 t86r->hdr.type != TYPE86_RSP_CODE ||
1075 t86r->cprbx.cprb_ver_id != 0x04) {
1076 if (reply->len < sizeof(error_reply)) {
1077 /* total broken reply, use static error reply instead */
1078 memcpy(msg->msg, &error_reply, sizeof(error_reply));
1079 msg->len = sizeof(error_reply);
1080 goto out;
1081 } else {
1082 /* malformed reply, convert function will handle this */
1083 len = reply->len;
1084 goto copy_len_and_out;
1085 }
1086 }
1087
1088 switch (resp_type->type) {
1089 case CEXXC_RESPONSE_TYPE_EP11:
1090 len = (size_t)t86r->fmt2.offset1 + (size_t)t86r->fmt2.count1;
1091 if (len > reply->len) {
1092 msg->rc = -EMSGSIZE;
1093 pr_debug("offset1 %u count1 %u rpl.len %zu mismatch, msg.rc=%d\n",
1094 t86r->fmt2.offset1, t86r->fmt2.count1,
1095 reply->len, msg->rc);
1096 goto out;
1097 }
1098 break;
1099 default:
1100 memcpy(msg->msg, &error_reply, sizeof(error_reply));
1101 msg->len = sizeof(error_reply);
1102 goto out;
1103 }
1104
1105 copy_len_and_out:
1106 if (len != reply->len) {
1107 msg->rc = -EMSGSIZE;
1108 pr_debug("len %zu rpl.len %zu mismatch, msg.rc=%d\n",
1109 len, reply->len, msg->rc);
1110 goto out;
1111 }
1112 if (len > reply->bufsize || len > msg->bufsize) {
1113 msg->rc = -EMSGSIZE;
1114 pr_debug("len %zu exceeds buf %zu/%zu, msg.rc=%d\n",
1115 len, reply->bufsize, msg->bufsize, msg->rc);
1116 goto out;
1117 }
1118 memcpy(msg->msg, reply->msg, len);
1119 msg->len = len;
1120
1121 out:
1122 complete(&resp_type->work);
1123 }
1124
1125 static atomic_t zcrypt_step = ATOMIC_INIT(0);
1126
1127 /*
1128 * The request distributor calls this function if it picked the CEXxC
1129 * device to handle a modexpo request.
1130 * This function assumes that ap_msg has been initialized with
1131 * ap_init_apmsg() and thus a valid buffer with the size of
1132 * ap_msg->bufsize is available within ap_msg. Also the caller has
1133 * to make sure ap_release_apmsg() is always called even on failure.
1134 * @zq: pointer to zcrypt_queue structure that identifies the
1135 * CEXxC device to the request distributor
1136 * @mex: pointer to the modexpo request buffer
1137 */
zcrypt_msgtype6_modexpo(struct zcrypt_queue * zq,struct ica_rsa_modexpo * mex,struct ap_message * ap_msg)1138 static long zcrypt_msgtype6_modexpo(struct zcrypt_queue *zq,
1139 struct ica_rsa_modexpo *mex,
1140 struct ap_message *ap_msg)
1141 {
1142 struct ap_response_type *resp_type = &ap_msg->response;
1143 int rc;
1144
1145 ap_msg->receive = zcrypt_msgtype6_receive;
1146 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1147 atomic_inc_return(&zcrypt_step);
1148 rc = icamex_msg_to_type6mex_msgx(zq, ap_msg, mex);
1149 if (rc)
1150 goto out;
1151 resp_type->type = CEXXC_RESPONSE_TYPE_ICA;
1152 init_completion(&resp_type->work);
1153 rc = ap_queue_message(zq->queue, ap_msg);
1154 if (rc)
1155 goto out;
1156 rc = wait_for_completion_interruptible(&resp_type->work);
1157 if (rc == 0) {
1158 rc = ap_msg->rc;
1159 if (rc == 0)
1160 rc = convert_response_ica(zq, ap_msg,
1161 mex->outputdata,
1162 mex->outputdatalength);
1163 } else {
1164 /* Signal pending. */
1165 ap_cancel_message(zq->queue, ap_msg);
1166 }
1167
1168 out:
1169 return rc;
1170 }
1171
1172 /*
1173 * The request distributor calls this function if it picked the CEXxC
1174 * device to handle a modexpo_crt request.
1175 * This function assumes that ap_msg has been initialized with
1176 * ap_init_apmsg() and thus a valid buffer with the size of
1177 * ap_msg->bufsize is available within ap_msg. Also the caller has
1178 * to make sure ap_release_apmsg() is always called even on failure.
1179 * @zq: pointer to zcrypt_queue structure that identifies the
1180 * CEXxC device to the request distributor
1181 * @crt: pointer to the modexpoc_crt request buffer
1182 */
zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue * zq,struct ica_rsa_modexpo_crt * crt,struct ap_message * ap_msg)1183 static long zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue *zq,
1184 struct ica_rsa_modexpo_crt *crt,
1185 struct ap_message *ap_msg)
1186 {
1187 struct ap_response_type *resp_type = &ap_msg->response;
1188 int rc;
1189
1190 ap_msg->receive = zcrypt_msgtype6_receive;
1191 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1192 atomic_inc_return(&zcrypt_step);
1193 rc = icacrt_msg_to_type6crt_msgx(zq, ap_msg, crt);
1194 if (rc)
1195 goto out;
1196 resp_type->type = CEXXC_RESPONSE_TYPE_ICA;
1197 init_completion(&resp_type->work);
1198 rc = ap_queue_message(zq->queue, ap_msg);
1199 if (rc)
1200 goto out;
1201 rc = wait_for_completion_interruptible(&resp_type->work);
1202 if (rc == 0) {
1203 rc = ap_msg->rc;
1204 if (rc == 0)
1205 rc = convert_response_ica(zq, ap_msg,
1206 crt->outputdata,
1207 crt->outputdatalength);
1208 } else {
1209 /* Signal pending. */
1210 ap_cancel_message(zq->queue, ap_msg);
1211 }
1212
1213 out:
1214 return rc;
1215 }
1216
1217 /*
1218 * Prepare a CCA AP msg request.
1219 * Prepare a CCA AP msg: fetch the required data from userspace,
1220 * prepare the AP msg, fill some info into the ap_message struct,
1221 * extract some data from the CPRB and give back to the caller.
1222 * This function assumes that ap_msg has been initialized with
1223 * ap_init_apmsg() and thus a valid buffer with the size of
1224 * ap_msg->bufsize is available within ap_msg. Also the caller has
1225 * to make sure ap_release_apmsg() is always called even on failure.
1226 */
prep_cca_ap_msg(bool userspace,struct ica_xcRB * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned int * domain)1227 int prep_cca_ap_msg(bool userspace, struct ica_xcRB *xcrb,
1228 struct ap_message *ap_msg,
1229 unsigned int *func_code, unsigned int *domain)
1230 {
1231 struct ap_response_type *resp_type = &ap_msg->response;
1232
1233 ap_msg->receive = zcrypt_msgtype6_receive;
1234 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1235 atomic_inc_return(&zcrypt_step);
1236 resp_type->type = CEXXC_RESPONSE_TYPE_XCRB;
1237 return xcrb_msg_to_type6cprb_msgx(userspace, ap_msg,
1238 xcrb, func_code, domain);
1239 }
1240
1241 /*
1242 * The request distributor calls this function if it picked the CEXxC
1243 * device to handle a send_cprb request.
1244 * @zq: pointer to zcrypt_queue structure that identifies the
1245 * CEXxC device to the request distributor
1246 * @xcrb: pointer to the send_cprb request buffer
1247 */
zcrypt_msgtype6_send_cprb(bool userspace,struct zcrypt_queue * zq,struct ica_xcRB * xcrb,struct ap_message * ap_msg)1248 static long zcrypt_msgtype6_send_cprb(bool userspace, struct zcrypt_queue *zq,
1249 struct ica_xcRB *xcrb,
1250 struct ap_message *ap_msg)
1251 {
1252 struct ap_response_type *resp_type = &ap_msg->response;
1253 struct {
1254 struct type6_hdr hdr;
1255 struct CPRBX cprbx;
1256 /* ... more data blocks ... */
1257 } __packed * msg = ap_msg->msg;
1258 unsigned int max_payload_size;
1259 int rc, delta;
1260
1261 /* calculate maximum payload for this card and msg type */
1262 max_payload_size = zq->reply.bufsize - sizeof(struct type86_fmt2_msg);
1263
1264 /* limit each of the two from fields to the maximum payload size */
1265 msg->hdr.fromcardlen1 = min(msg->hdr.fromcardlen1, max_payload_size);
1266 msg->hdr.fromcardlen2 = min(msg->hdr.fromcardlen2, max_payload_size);
1267
1268 /* calculate delta if the sum of both exceeds max payload size */
1269 delta = msg->hdr.fromcardlen1 + msg->hdr.fromcardlen2
1270 - max_payload_size;
1271 if (delta > 0) {
1272 /*
1273 * Sum exceeds maximum payload size, prune fromcardlen1
1274 * (always trust fromcardlen2)
1275 */
1276 if (delta > msg->hdr.fromcardlen1) {
1277 rc = -EINVAL;
1278 goto out;
1279 }
1280 msg->hdr.fromcardlen1 -= delta;
1281 }
1282
1283 /* update domain field within the CPRB struct */
1284 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
1285
1286 init_completion(&resp_type->work);
1287 rc = ap_queue_message(zq->queue, ap_msg);
1288 if (rc)
1289 goto out;
1290 rc = wait_for_completion_interruptible(&resp_type->work);
1291 if (rc == 0) {
1292 rc = ap_msg->rc;
1293 if (rc == 0)
1294 rc = convert_response_xcrb(userspace, zq, ap_msg, xcrb);
1295 } else {
1296 /* Signal pending. */
1297 ap_cancel_message(zq->queue, ap_msg);
1298 }
1299
1300 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1301 rc = -EIO; /* do not retry administrative requests */
1302
1303 out:
1304 if (rc)
1305 pr_debug("send cprb at dev=%02x.%04x rc=%d\n",
1306 AP_QID_CARD(zq->queue->qid),
1307 AP_QID_QUEUE(zq->queue->qid), rc);
1308 return rc;
1309 }
1310
1311 /*
1312 * Prepare an EP11 AP msg request.
1313 * Prepare an EP11 AP msg: fetch the required data from userspace,
1314 * prepare the AP msg, fill some info into the ap_message struct,
1315 * extract some data from the CPRB and give back to the caller.
1316 * This function assumes that ap_msg has been initialized with
1317 * ap_init_apmsg() and thus a valid buffer with the size of
1318 * ap_msg->bufsize is available within ap_msg. Also the caller has
1319 * to make sure ap_release_apmsg() is always called even on failure.
1320 */
prep_ep11_ap_msg(bool userspace,struct ep11_urb * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned int * domain)1321 int prep_ep11_ap_msg(bool userspace, struct ep11_urb *xcrb,
1322 struct ap_message *ap_msg,
1323 unsigned int *func_code, unsigned int *domain)
1324 {
1325 struct ap_response_type *resp_type = &ap_msg->response;
1326
1327 ap_msg->receive = zcrypt_msgtype6_receive_ep11;
1328 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1329 atomic_inc_return(&zcrypt_step);
1330 resp_type->type = CEXXC_RESPONSE_TYPE_EP11;
1331 return xcrb_msg_to_type6_ep11cprb_msgx(userspace, ap_msg, xcrb,
1332 func_code, domain);
1333 }
1334
1335 /*
1336 * Simple asn1 int writer/encoder helper function
1337 * Returns number of bytes processed or < 0 on failure
1338 * Only accepts int length values of 1, 2 or 4.
1339 */
asn1_int_encode(u8 * buf,size_t intlen,u32 u)1340 static inline int asn1_int_encode(u8 *buf, size_t intlen, u32 u)
1341 {
1342 switch (intlen) {
1343 case 1:
1344 *buf = (u8)u;
1345 return 1;
1346 case 2:
1347 put_unaligned_be16((u16)u, buf);
1348 return 2;
1349 case 4:
1350 put_unaligned_be32((u32)u, buf);
1351 return 4;
1352 default:
1353 return -EINVAL;
1354 }
1355 }
1356
1357 /*
1358 * The request distributor calls this function if it picked the CEX4P
1359 * device to handle a send_ep11_cprb request.
1360 * @zq: pointer to zcrypt_queue structure that identifies the
1361 * CEX4P device to the request distributor
1362 * @xcrb: pointer to the ep11 user request block
1363 */
zcrypt_msgtype6_send_ep11_cprb(bool userspace,struct zcrypt_queue * zq,struct ep11_urb * xcrb,struct ap_message * ap_msg)1364 static long zcrypt_msgtype6_send_ep11_cprb(bool userspace, struct zcrypt_queue *zq,
1365 struct ep11_urb *xcrb,
1366 struct ap_message *ap_msg)
1367 {
1368 int rc;
1369 struct ap_response_type *resp_type = &ap_msg->response;
1370 struct {
1371 struct type6_hdr hdr;
1372 struct ep11_cprb cprbx;
1373 } __packed * msg = ap_msg->msg;
1374
1375 /*
1376 * The target domain field within the cprb body/payload block will be
1377 * replaced by the usage domain for non-management commands only.
1378 * Therefore we check the first bit of the 'flags' parameter for
1379 * management command indication.
1380 */
1381 if (!(msg->cprbx.flags & 0x80)) {
1382 int i, offs = 0;
1383 size_t pld_len;
1384 u8 *pld;
1385 u32 u;
1386
1387 /* update target field in ep11_cprb */
1388 msg->cprbx.target_id = (u32)AP_QID_QUEUE(zq->queue->qid);
1389
1390 /* ptr and length to payload */
1391 pld = ap_msg->msg +
1392 sizeof(struct type6_hdr) + sizeof(struct ep11_cprb);
1393 pld_len = msg->cprbx.payload_len;
1394 if (pld_len < MIN_EP11_PAYLOAD_SIZE)
1395 return -EINVAL;
1396
1397 /*
1398 * Parse the asn1 payload, at least we have
1399 * pld tag (1 octet)
1400 * payload length (1-5 octets)
1401 * function tag (1 octet)
1402 * function length (1-5 octets)
1403 * function value (1-4 octets)
1404 * ----- optional fields -----
1405 * domain tag (1 octet)
1406 * domain length (1-5 octets)
1407 * domain value (1-4 octets)
1408 * ... maybe much more data ...
1409 */
1410
1411 /* payload tag */
1412 if (pld[offs++] != 0x30)
1413 return -EINVAL;
1414 /* payload length field */
1415 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1416 if (i < 0)
1417 return -EINVAL;
1418 offs += i;
1419 if (offs >= pld_len || u > pld_len - offs)
1420 return -EINVAL;
1421 /* function tag */
1422 if (pld[offs++] != 0x04)
1423 return -EINVAL;
1424 /* function length */
1425 if (offs >= pld_len)
1426 return -EINVAL;
1427 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1428 if (i < 0)
1429 return -EINVAL;
1430 offs += i;
1431 if (u > pld_len - offs)
1432 return -EINVAL;
1433 /* skip over the function value */
1434 offs += u;
1435 /* is there some payload left which could hold a domain value ? */
1436 if (offs < pld_len && pld_len - offs >= 3) {
1437 /* domain tag */
1438 if (pld[offs++] != 0x04)
1439 return -EINVAL;
1440 /* domain length */
1441 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1442 if (i < 0)
1443 return -EINVAL;
1444 offs += i;
1445 if (offs >= pld_len || u > pld_len - offs)
1446 return -EINVAL;
1447 /*
1448 * pld[offs] is now at the start of the domain value
1449 * with the value sprawled in u octets.
1450 */
1451 i = asn1_int_encode(pld + offs, u,
1452 AP_QID_QUEUE(zq->queue->qid));
1453 if (i < 0)
1454 return -EINVAL;
1455 offs += i;
1456 }
1457 }
1458
1459 /*
1460 * Set the queue's reply buffer length minus the two prepend headers
1461 * as reply limit for the card firmware.
1462 */
1463 msg->hdr.fromcardlen1 = zq->reply.bufsize -
1464 sizeof(struct type86_hdr) - sizeof(struct type86_fmt2_ext);
1465
1466 init_completion(&resp_type->work);
1467 rc = ap_queue_message(zq->queue, ap_msg);
1468 if (rc)
1469 goto out;
1470 rc = wait_for_completion_interruptible(&resp_type->work);
1471 if (rc == 0) {
1472 rc = ap_msg->rc;
1473 if (rc == 0)
1474 rc = convert_response_ep11_xcrb(userspace, zq, ap_msg, xcrb);
1475 } else {
1476 /* Signal pending. */
1477 ap_cancel_message(zq->queue, ap_msg);
1478 }
1479
1480 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1481 rc = -EIO; /* do not retry administrative requests */
1482
1483 out:
1484 if (rc)
1485 pr_debug("send cprb at dev=%02x.%04x rc=%d\n",
1486 AP_QID_CARD(zq->queue->qid),
1487 AP_QID_QUEUE(zq->queue->qid), rc);
1488 return rc;
1489 }
1490
1491 /*
1492 * Prepare a type6 CPRB message for random number generation
1493 *
1494 * @ap_dev: AP device pointer
1495 * @ap_msg: pointer to AP message
1496 */
rng_type6cprb_msgx(struct ap_message * ap_msg,unsigned int random_number_length,unsigned int * domain)1497 static inline void rng_type6cprb_msgx(struct ap_message *ap_msg,
1498 unsigned int random_number_length,
1499 unsigned int *domain)
1500 {
1501 struct {
1502 struct type6_hdr hdr;
1503 struct CPRBX cprbx;
1504 char function_code[2];
1505 short int rule_length;
1506 char rule[8];
1507 short int verb_length;
1508 short int key_length;
1509 } __packed * msg = ap_msg->msg;
1510 static struct type6_hdr static_type6_hdrX = {
1511 .type = 0x06,
1512 .offset1 = 0x00000058,
1513 .agent_id = {'C', 'A'},
1514 .function_code = {'R', 'L'},
1515 .tocardlen1 = sizeof(*msg) - sizeof(msg->hdr),
1516 .fromcardlen1 = sizeof(*msg) - sizeof(msg->hdr),
1517 };
1518 static struct CPRBX local_cprbx = {
1519 .cprb_len = 0x00dc,
1520 .cprb_ver_id = 0x02,
1521 .func_id = {'T', '2'},
1522 .req_parml = sizeof(*msg) - sizeof(msg->hdr) -
1523 sizeof(msg->cprbx),
1524 .rpl_msgbl = sizeof(*msg) - sizeof(msg->hdr),
1525 };
1526
1527 msg->hdr = static_type6_hdrX;
1528 msg->hdr.fromcardlen2 = random_number_length;
1529 msg->cprbx = local_cprbx;
1530 msg->cprbx.rpl_datal = random_number_length;
1531 memcpy(msg->function_code, msg->hdr.function_code, 0x02);
1532 msg->rule_length = 0x0a;
1533 memcpy(msg->rule, "RANDOM ", 8);
1534 msg->verb_length = 0x02;
1535 msg->key_length = 0x02;
1536 ap_msg->len = sizeof(*msg);
1537 if (domain)
1538 *domain = msg->cprbx.domain;
1539 }
1540
1541 /*
1542 * Prepare a CEXXC get random request ap message.
1543 * This function assumes that ap_msg has been initialized with
1544 * ap_init_apmsg() and thus a valid buffer with the size of
1545 * ap_max_msg_size is available within ap_msg. Also the caller has
1546 * to make sure ap_release_apmsg() is always called even on failure.
1547 */
prep_rng_ap_msg(struct ap_message * ap_msg,int * func_code,unsigned int * domain)1548 int prep_rng_ap_msg(struct ap_message *ap_msg, int *func_code,
1549 unsigned int *domain)
1550 {
1551 struct ap_response_type *resp_type = &ap_msg->response;
1552
1553 if (ap_msg->bufsize < AP_DEFAULT_MAX_MSG_SIZE)
1554 return -EMSGSIZE;
1555 ap_msg->receive = zcrypt_msgtype6_receive;
1556 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1557 atomic_inc_return(&zcrypt_step);
1558
1559 resp_type->type = CEXXC_RESPONSE_TYPE_XCRB;
1560
1561 rng_type6cprb_msgx(ap_msg, ZCRYPT_RNG_BUFFER_SIZE, domain);
1562
1563 *func_code = HWRNG;
1564 return 0;
1565 }
1566
1567 /*
1568 * The request distributor calls this function if it picked the CEXxC
1569 * device to generate random data.
1570 * @zq: pointer to zcrypt_queue structure that identifies the
1571 * CEXxC device to the request distributor
1572 * @buffer: pointer to a memory page to return random data
1573 */
zcrypt_msgtype6_rng(struct zcrypt_queue * zq,char * buffer,struct ap_message * ap_msg)1574 static long zcrypt_msgtype6_rng(struct zcrypt_queue *zq,
1575 char *buffer, struct ap_message *ap_msg)
1576 {
1577 struct {
1578 struct type6_hdr hdr;
1579 struct CPRBX cprbx;
1580 char function_code[2];
1581 short int rule_length;
1582 char rule[8];
1583 short int verb_length;
1584 short int key_length;
1585 } __packed * msg = ap_msg->msg;
1586 struct ap_response_type *resp_type = &ap_msg->response;
1587 int rc;
1588
1589 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
1590
1591 init_completion(&resp_type->work);
1592 rc = ap_queue_message(zq->queue, ap_msg);
1593 if (rc)
1594 goto out;
1595 rc = wait_for_completion_interruptible(&resp_type->work);
1596 if (rc == 0) {
1597 rc = ap_msg->rc;
1598 if (rc == 0)
1599 rc = convert_response_rng(zq, ap_msg, buffer);
1600 } else {
1601 /* Signal pending. */
1602 ap_cancel_message(zq->queue, ap_msg);
1603 }
1604 out:
1605 return rc;
1606 }
1607
1608 /*
1609 * The crypto operations for a CEXxC card.
1610 */
1611
1612 static struct zcrypt_ops zcrypt_msgtype6_ops = {
1613 .owner = THIS_MODULE,
1614 .name = MSGTYPE06_NAME,
1615 .variant = MSGTYPE06_VARIANT_DEFAULT,
1616 .rsa_modexpo = zcrypt_msgtype6_modexpo,
1617 .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
1618 .send_cprb = zcrypt_msgtype6_send_cprb,
1619 .rng = zcrypt_msgtype6_rng,
1620 };
1621
1622 static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
1623 .owner = THIS_MODULE,
1624 .name = MSGTYPE06_NAME,
1625 .variant = MSGTYPE06_VARIANT_EP11,
1626 .rsa_modexpo = NULL,
1627 .rsa_modexpo_crt = NULL,
1628 .send_ep11_cprb = zcrypt_msgtype6_send_ep11_cprb,
1629 };
1630
zcrypt_msgtype6_init(void)1631 void __init zcrypt_msgtype6_init(void)
1632 {
1633 zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
1634 zcrypt_msgtype_register(&zcrypt_msgtype6_ep11_ops);
1635 }
1636
zcrypt_msgtype6_exit(void)1637 void __exit zcrypt_msgtype6_exit(void)
1638 {
1639 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
1640 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ep11_ops);
1641 }
1642