1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright IBM Corp. 2001, 2023
4 * Author(s): Robert Burroughs
5 * Eric Rossman (edrossma@us.ibm.com)
6 *
7 * Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
8 * Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
9 * Ralph Wuerthner <rwuerthn@de.ibm.com>
10 * MSGTYPE restruct: Holger Dengler <hd@linux.vnet.ibm.com>
11 */
12
13 #define pr_fmt(fmt) "zcrypt: " fmt
14
15 #include <linux/module.h>
16 #include <linux/init.h>
17 #include <linux/err.h>
18 #include <linux/delay.h>
19 #include <linux/slab.h>
20 #include <linux/atomic.h>
21 #include <linux/uaccess.h>
22 #include <linux/unaligned.h>
23
24 #include "ap_bus.h"
25 #include "zcrypt_api.h"
26 #include "zcrypt_error.h"
27 #include "zcrypt_msgtype6.h"
28 #include "zcrypt_cca_key.h"
29
30 #define CEXXC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply */
31
32 #define CEIL4(x) ((((x) + 3) / 4) * 4)
33
34 #define CEXXC_RESPONSE_TYPE_ICA 0
35 #define CEXXC_RESPONSE_TYPE_XCRB 1
36 #define CEXXC_RESPONSE_TYPE_EP11 2
37
38 /* smallest possible EP11 payload size */
39 #define MIN_EP11_PAYLOAD_SIZE 5
40
41 MODULE_AUTHOR("IBM Corporation");
42 MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
43 "Copyright IBM Corp. 2001, 2023");
44 MODULE_LICENSE("GPL");
45
46 struct function_and_rules_block {
47 unsigned char function_code[2];
48 unsigned short ulen;
49 unsigned char only_rule[8];
50 } __packed;
51
52 /*
53 * The following is used to initialize the CPRBX passed to the CEXxC/CEXxP
54 * card in a type6 message. The 3 fields that must be filled in at execution
55 * time are req_parml, rpl_parml and usage_domain.
56 * Everything about this interface is ascii/big-endian, since the
57 * device does *not* have 'Intel inside'.
58 *
59 * The CPRBX is followed immediately by the parm block.
60 * The parm block contains:
61 * - function code ('PD' 0x5044 or 'PK' 0x504B)
62 * - rule block (one of:)
63 * + 0x000A 'PKCS-1.2' (MCL2 'PD')
64 * + 0x000A 'ZERO-PAD' (MCL2 'PK')
65 * + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
66 * + 0x000A 'MRP ' (MCL3 'PK' or CEX2C 'PK')
67 * - VUD block
68 */
69 static const struct CPRBX static_cprbx = {
70 .cprb_len = 0x00DC,
71 .cprb_ver_id = 0x02,
72 .func_id = {'T', '2'},
73 };
74
speed_idx_cca(int req_type)75 int speed_idx_cca(int req_type)
76 {
77 switch (req_type) {
78 case 0x4142:
79 case 0x4149:
80 case 0x414D:
81 case 0x4341:
82 case 0x4344:
83 case 0x4354:
84 case 0x4358:
85 case 0x444B:
86 case 0x4558:
87 case 0x4643:
88 case 0x4651:
89 case 0x4C47:
90 case 0x4C4B:
91 case 0x4C51:
92 case 0x4F48:
93 case 0x504F:
94 case 0x5053:
95 case 0x5058:
96 case 0x5343:
97 case 0x5344:
98 case 0x5345:
99 case 0x5350:
100 return LOW;
101 case 0x414B:
102 case 0x4345:
103 case 0x4349:
104 case 0x434D:
105 case 0x4847:
106 case 0x4849:
107 case 0x484D:
108 case 0x4850:
109 case 0x4851:
110 case 0x4954:
111 case 0x4958:
112 case 0x4B43:
113 case 0x4B44:
114 case 0x4B45:
115 case 0x4B47:
116 case 0x4B48:
117 case 0x4B49:
118 case 0x4B4E:
119 case 0x4B50:
120 case 0x4B52:
121 case 0x4B54:
122 case 0x4B58:
123 case 0x4D50:
124 case 0x4D53:
125 case 0x4D56:
126 case 0x4D58:
127 case 0x5044:
128 case 0x5045:
129 case 0x5046:
130 case 0x5047:
131 case 0x5049:
132 case 0x504B:
133 case 0x504D:
134 case 0x5254:
135 case 0x5347:
136 case 0x5349:
137 case 0x534B:
138 case 0x534D:
139 case 0x5356:
140 case 0x5358:
141 case 0x5443:
142 case 0x544B:
143 case 0x5647:
144 return HIGH;
145 default:
146 return MEDIUM;
147 }
148 }
149
speed_idx_ep11(int req_type)150 int speed_idx_ep11(int req_type)
151 {
152 switch (req_type) {
153 case 1:
154 case 2:
155 case 36:
156 case 37:
157 case 38:
158 case 39:
159 case 40:
160 return LOW;
161 case 17:
162 case 18:
163 case 19:
164 case 20:
165 case 21:
166 case 22:
167 case 26:
168 case 30:
169 case 31:
170 case 32:
171 case 33:
172 case 34:
173 case 35:
174 return HIGH;
175 default:
176 return MEDIUM;
177 }
178 }
179
180 /*
181 * Convert a ICAMEX message to a type6 MEX message.
182 *
183 * @zq: crypto device pointer
184 * @ap_msg: pointer to AP message
185 * @mex: pointer to user input data
186 *
187 * Returns 0 on success or negative errno value.
188 */
icamex_msg_to_type6mex_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo * mex)189 static int icamex_msg_to_type6mex_msgx(struct zcrypt_queue *zq,
190 struct ap_message *ap_msg,
191 struct ica_rsa_modexpo *mex)
192 {
193 static struct type6_hdr static_type6_hdrX = {
194 .type = 0x06,
195 .offset1 = 0x00000058,
196 .agent_id = {'C', 'A',},
197 .function_code = {'P', 'K'},
198 };
199 static struct function_and_rules_block static_pke_fnr = {
200 .function_code = {'P', 'K'},
201 .ulen = 10,
202 .only_rule = {'M', 'R', 'P', ' ', ' ', ' ', ' ', ' '}
203 };
204 struct {
205 struct type6_hdr hdr;
206 struct CPRBX cprbx;
207 struct function_and_rules_block fr;
208 unsigned short length;
209 char text[];
210 } __packed * msg = ap_msg->msg;
211 int size;
212
213 /*
214 * The inputdatalength was a selection criteria in the dispatching
215 * function zcrypt_rsa_modexpo(). However, make sure the following
216 * copy_from_user() never exceeds the allocated buffer space.
217 */
218 if (WARN_ON_ONCE(mex->inputdatalength > PAGE_SIZE))
219 return -EINVAL;
220
221 /* VUD.ciphertext */
222 msg->length = mex->inputdatalength + 2;
223 if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
224 return -EFAULT;
225
226 /* Set up key which is located after the variable length text. */
227 size = zcrypt_type6_mex_key_en(mex, msg->text + mex->inputdatalength);
228 if (size < 0)
229 return size;
230 size += sizeof(*msg) + mex->inputdatalength;
231
232 /* message header, cprbx and f&r */
233 msg->hdr = static_type6_hdrX;
234 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
235 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
236
237 msg->cprbx = static_cprbx;
238 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
239 msg->cprbx.rpl_msgbl = msg->hdr.fromcardlen1;
240
241 msg->fr = static_pke_fnr;
242
243 msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
244
245 ap_msg->len = size;
246 return 0;
247 }
248
249 /*
250 * Convert a ICACRT message to a type6 CRT message.
251 *
252 * @zq: crypto device pointer
253 * @ap_msg: pointer to AP message
254 * @crt: pointer to user input data
255 *
256 * Returns 0 on success or negative errno value.
257 */
icacrt_msg_to_type6crt_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo_crt * crt)258 static int icacrt_msg_to_type6crt_msgx(struct zcrypt_queue *zq,
259 struct ap_message *ap_msg,
260 struct ica_rsa_modexpo_crt *crt)
261 {
262 static struct type6_hdr static_type6_hdrX = {
263 .type = 0x06,
264 .offset1 = 0x00000058,
265 .agent_id = {'C', 'A',},
266 .function_code = {'P', 'D'},
267 };
268 static struct function_and_rules_block static_pkd_fnr = {
269 .function_code = {'P', 'D'},
270 .ulen = 10,
271 .only_rule = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
272 };
273
274 struct {
275 struct type6_hdr hdr;
276 struct CPRBX cprbx;
277 struct function_and_rules_block fr;
278 unsigned short length;
279 char text[];
280 } __packed * msg = ap_msg->msg;
281 int size;
282
283 /*
284 * The inputdatalength was a selection criteria in the dispatching
285 * function zcrypt_rsa_crt(). However, make sure the following
286 * copy_from_user() never exceeds the allocated buffer space.
287 */
288 if (WARN_ON_ONCE(crt->inputdatalength > PAGE_SIZE))
289 return -EINVAL;
290
291 /* VUD.ciphertext */
292 msg->length = crt->inputdatalength + 2;
293 if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
294 return -EFAULT;
295
296 /* Set up key which is located after the variable length text. */
297 size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength);
298 if (size < 0)
299 return size;
300 size += sizeof(*msg) + crt->inputdatalength; /* total size of msg */
301
302 /* message header, cprbx and f&r */
303 msg->hdr = static_type6_hdrX;
304 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
305 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
306
307 msg->cprbx = static_cprbx;
308 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
309 msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
310 size - sizeof(msg->hdr) - sizeof(msg->cprbx);
311
312 msg->fr = static_pkd_fnr;
313
314 ap_msg->len = size;
315 return 0;
316 }
317
318 /*
319 * Convert a XCRB message to a type6 CPRB message.
320 *
321 * @zq: crypto device pointer
322 * @ap_msg: pointer to AP message
323 * @xcRB: pointer to user input data
324 *
325 * Returns 0 on success or -EFAULT, -EINVAL.
326 */
327 struct type86_fmt2_msg {
328 struct type86_hdr hdr;
329 struct type86_fmt2_ext fmt2;
330 } __packed;
331
xcrb_msg_to_type6cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ica_xcRB * xcrb,unsigned int * fcode,unsigned int * domain)332 static int xcrb_msg_to_type6cprb_msgx(bool userspace, struct ap_message *ap_msg,
333 struct ica_xcRB *xcrb,
334 unsigned int *fcode,
335 unsigned int *domain)
336 {
337 static struct type6_hdr static_type6_hdrX = {
338 .type = 0x06,
339 .offset1 = 0x00000058,
340 };
341 struct {
342 struct type6_hdr hdr;
343 union {
344 struct CPRBX cprbx;
345 DECLARE_FLEX_ARRAY(u8, userdata);
346 };
347 } __packed * msg = ap_msg->msg;
348
349 size_t req_cblen, rep_cblen, req_sumlen, rep_sumlen;
350 char *function_code, *req_data;
351
352 /* request length and overflow checks */
353 if (xcrb->request_control_blk_length < sizeof(struct CPRBX))
354 return -EINVAL;
355 req_cblen = CEIL4((size_t)xcrb->request_control_blk_length);
356 if (req_cblen > U32_MAX)
357 return -EINVAL;
358 req_sumlen = req_cblen + xcrb->request_data_length;
359 if (req_sumlen > U32_MAX)
360 return -EINVAL;
361 ap_msg->len = sizeof(struct type6_hdr) + req_sumlen;
362 if (ap_msg->len > ap_msg->bufsize)
363 return -EINVAL;
364 if (req_cblen <= xcrb->request_data_length ?
365 req_sumlen < xcrb->request_data_length :
366 req_sumlen < req_cblen) {
367 return -EINVAL;
368 }
369
370 /* reply length and overflow checks */
371 if (xcrb->reply_control_blk_length < sizeof(struct CPRBX))
372 return -EINVAL;
373 rep_cblen = CEIL4((size_t)xcrb->reply_control_blk_length);
374 if (rep_cblen > U32_MAX)
375 return -EINVAL;
376 rep_sumlen = rep_cblen + xcrb->reply_data_length;
377 if (rep_sumlen > U32_MAX)
378 return -EINVAL;
379 if (rep_cblen <= xcrb->reply_data_length ?
380 rep_sumlen < xcrb->reply_data_length :
381 rep_sumlen < rep_cblen) {
382 return -EINVAL;
383 }
384
385 /* prepare type6 header */
386 msg->hdr = static_type6_hdrX;
387 memcpy(msg->hdr.agent_id, &xcrb->agent_ID, sizeof(xcrb->agent_ID));
388 msg->hdr.tocardlen1 = xcrb->request_control_blk_length;
389 if (xcrb->request_data_length) {
390 msg->hdr.offset2 = msg->hdr.offset1 + req_cblen;
391 msg->hdr.tocardlen2 = xcrb->request_data_length;
392 }
393 msg->hdr.fromcardlen1 = xcrb->reply_control_blk_length;
394 msg->hdr.fromcardlen2 = xcrb->reply_data_length;
395
396 /* prepare CPRB */
397 if (z_copy_from_user(userspace, msg->userdata,
398 xcrb->request_control_blk_addr,
399 xcrb->request_control_blk_length))
400 return -EFAULT;
401 /* pad tail with 0 up to req_cblen */
402 if (xcrb->request_control_blk_length < req_cblen)
403 memset(msg->userdata + xcrb->request_control_blk_length,
404 0, req_cblen - xcrb->request_control_blk_length);
405 /* copy subfunction code into AP msg type 6 function code field */
406 if (msg->cprbx.cprb_len > req_cblen - sizeof(msg->hdr.function_code))
407 return -EINVAL;
408 function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
409 memcpy(msg->hdr.function_code, function_code,
410 sizeof(msg->hdr.function_code));
411
412 *fcode = (msg->hdr.function_code[0] << 8) | msg->hdr.function_code[1];
413 if (domain)
414 *domain = msg->cprbx.domain;
415
416 /* check subfunction, US and AU need special flag with NQAP */
417 if (memcmp(function_code, "US", 2) == 0 ||
418 memcmp(function_code, "AU", 2) == 0)
419 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
420
421 /* check CPRB minor version, set info bits in ap_message flag field */
422 switch (*(unsigned short *)(&msg->cprbx.func_id[0])) {
423 case 0x5432: /* "T2" */
424 ap_msg->flags |= AP_MSG_FLAG_USAGE;
425 break;
426 case 0x5433: /* "T3" */
427 case 0x5435: /* "T5" */
428 case 0x5436: /* "T6" */
429 case 0x5437: /* "T7" */
430 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
431 break;
432 default:
433 pr_debug("unknown CPRB minor version '%c%c'\n",
434 msg->cprbx.func_id[0], msg->cprbx.func_id[1]);
435 }
436
437 /* copy data block */
438 if (xcrb->request_data_length) {
439 req_data = ap_msg->msg + sizeof(struct type6_hdr) + req_cblen;
440 if (z_copy_from_user(userspace, req_data,
441 xcrb->request_data_address,
442 xcrb->request_data_length))
443 return -EFAULT;
444 }
445
446 return 0;
447 }
448
449 /*
450 * Simple asn1 int reader/decoder helper function
451 * Returns number of bytes processed or < 0 on failure
452 * Only accepts int length values of 1, 2 or 4.
453 */
asn1_int_decode(const u8 * buf,size_t intlen,u32 * u)454 static inline int asn1_int_decode(const u8 *buf, size_t intlen, u32 *u)
455 {
456 switch (intlen) {
457 case 1:
458 *u = (u32)(*buf);
459 return 1;
460 case 2:
461 *u = (u32)get_unaligned_be16(buf);
462 return 2;
463 case 4:
464 *u = (u32)get_unaligned_be32(buf);
465 return 4;
466 default:
467 return -EINVAL;
468 }
469 }
470
471 /*
472 * Simple asn1 length parse helper function
473 * Returns number of bytes processed or < 0 on failure
474 * Only accepts length encoded within the length octet
475 * or for long form 1, 2 or 4 octet length bytes.
476 */
asn1_length_decode(const u8 * buf,size_t buflen,u32 * u)477 static inline int asn1_length_decode(const u8 *buf, size_t buflen, u32 *u)
478 {
479 int i;
480
481 if (buflen < 1)
482 return -EINVAL;
483
484 if (*buf < 128) {
485 *u = (u32)(*buf & 0x7F);
486 return 1;
487 }
488
489 i = *buf & 0x7F;
490 if (--buflen < i)
491 return -EINVAL;
492 i = asn1_int_decode(++buf, i, u);
493
494 return i < 0 ? i : i + 1;
495 }
496
xcrb_msg_to_type6_ep11cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ep11_urb * xcrb,unsigned int * fcode,unsigned int * domain)497 static int xcrb_msg_to_type6_ep11cprb_msgx(bool userspace, struct ap_message *ap_msg,
498 struct ep11_urb *xcrb,
499 unsigned int *fcode,
500 unsigned int *domain)
501 {
502 static struct type6_hdr static_type6_ep11_hdr = {
503 .type = 0x06,
504 .rqid = {0x00, 0x01},
505 .function_code = {0x00, 0x00},
506 .agent_id = {'X', 'C'},
507 .offset1 = 0x00000058,
508 };
509
510 struct {
511 struct type6_hdr hdr;
512 union {
513 struct ep11_cprb cprbx;
514 DECLARE_FLEX_ARRAY(u8, userdata);
515 };
516 } __packed * msg = ap_msg->msg;
517
518 size_t req_len, rep_len, pld_len;
519 unsigned char *pld;
520 int offs = 0, i;
521 unsigned int u;
522
523 /* request length and overflow checks */
524 if (xcrb->req_len < sizeof(struct ep11_cprb) + MIN_EP11_PAYLOAD_SIZE)
525 return -EINVAL;
526 req_len = CEIL4(xcrb->req_len);
527 if (req_len < xcrb->req_len || req_len > U32_MAX)
528 return -EINVAL;
529 ap_msg->len = sizeof(struct type6_hdr) + req_len;
530 if (ap_msg->len > ap_msg->bufsize)
531 return -EINVAL;
532
533 /* reply length and overflow checks */
534 if (xcrb->resp_len < sizeof(struct ep11_cprb))
535 return -EINVAL;
536 rep_len = CEIL4(xcrb->resp_len);
537 if (rep_len < xcrb->resp_len || rep_len > U32_MAX)
538 return -EINVAL;
539
540 /* prepare type6 header */
541 msg->hdr = static_type6_ep11_hdr;
542 msg->hdr.tocardlen1 = xcrb->req_len;
543 msg->hdr.fromcardlen1 = xcrb->resp_len;
544
545 /* Import CPRB data from the ioctl input parameter */
546 if (z_copy_from_user(userspace, msg->userdata,
547 (char __force __user *)xcrb->req, xcrb->req_len))
548 return -EFAULT;
549 /* pad tail with 0 up to req_len */
550 if (xcrb->req_len < req_len)
551 memset(msg->userdata + xcrb->req_len, 0,
552 req_len - xcrb->req_len);
553
554 pld = msg->userdata + sizeof(struct ep11_cprb);
555 pld_len = msg->cprbx.payload_len;
556 if (pld_len != xcrb->req_len - sizeof(struct ep11_cprb))
557 return -EINVAL;
558 /*
559 * At this point pld_len is always >= MIN_EP11_PAYLOAD_SIZE
560 * and the smallest supported asn1 payload is:
561 * payload tag (1 octet)
562 * payload length (1-5 octets)
563 * function tag (1 octet)
564 * function length (1-5 octets)
565 * function value (1-4 octets)
566 */
567
568 /* payload tag */
569 if (pld[offs++] != 0x30)
570 return -EINVAL;
571 /* payload length field */
572 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
573 if (i < 0)
574 return -EINVAL;
575 offs += i;
576 if (offs >= pld_len || u > pld_len - offs)
577 return -EINVAL;
578 /* function tag */
579 if (pld[offs++] != 0x04)
580 return -EINVAL;
581 /* function length */
582 if (offs >= pld_len)
583 return -EINVAL;
584 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
585 if (i < 0)
586 return -EINVAL;
587 offs += i;
588 if (offs >= pld_len || u > pld_len - offs)
589 return -EINVAL;
590 /* function value */
591 i = asn1_int_decode(pld + offs, u, &u);
592 if (i < 0)
593 return -EINVAL;
594 offs += i;
595 *fcode = 0xFFFF & u;
596
597 /* enable special processing based on the cprbs flags special bit */
598 if (msg->cprbx.flags & 0x20)
599 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
600
601 /* set info bits in ap_message flag field */
602 if (msg->cprbx.flags & 0x80)
603 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
604 else
605 ap_msg->flags |= AP_MSG_FLAG_USAGE;
606
607 if (domain)
608 *domain = msg->cprbx.target_id;
609
610 return 0;
611 }
612
613 /*
614 * Copy results from a type 86 ICA reply message back to user space.
615 *
616 * @zq: crypto device pointer
617 * @reply: reply AP message.
618 * @data: pointer to user output data
619 * @length: size of user output data
620 *
621 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
622 */
623 struct type86x_reply {
624 struct type86_hdr hdr;
625 struct type86_fmt2_ext fmt2;
626 struct CPRBX cprbx;
627 unsigned char pad[4]; /* 4 byte function code/rules block ? */
628 unsigned short length; /* length of data including length field size */
629 char data[];
630 } __packed;
631
632 struct type86_ep11_reply {
633 struct type86_hdr hdr;
634 struct type86_fmt2_ext fmt2;
635 struct ep11_cprb cprbx;
636 } __packed;
637
convert_type86_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)638 static int convert_type86_ica(struct zcrypt_queue *zq,
639 struct ap_message *reply,
640 char __user *outputdata,
641 unsigned int outputdatalength)
642 {
643 struct type86x_reply *msg = reply->msg;
644 unsigned short service_rc, service_rs;
645 unsigned int data_len;
646
647 service_rc = msg->cprbx.ccp_rtcode;
648 if (unlikely(service_rc != 0)) {
649 service_rs = msg->cprbx.ccp_rscode;
650 if ((service_rc == 8 && service_rs == 66) ||
651 (service_rc == 8 && service_rs == 65) ||
652 (service_rc == 8 && service_rs == 72) ||
653 (service_rc == 8 && service_rs == 770) ||
654 (service_rc == 12 && service_rs == 769)) {
655 ZCRYPT_DBF_WARN("%s dev=%02x.%04x rc/rs=%d/%d => rc=EINVAL\n",
656 __func__, AP_QID_CARD(zq->queue->qid),
657 AP_QID_QUEUE(zq->queue->qid),
658 (int)service_rc, (int)service_rs);
659 return -EINVAL;
660 }
661 zq->online = 0;
662 pr_err("Crypto dev=%02x.%04x rc/rs=%d/%d online=0 rc=EAGAIN\n",
663 AP_QID_CARD(zq->queue->qid),
664 AP_QID_QUEUE(zq->queue->qid),
665 (int)service_rc, (int)service_rs);
666 ZCRYPT_DBF_ERR("%s dev=%02x.%04x rc/rs=%d/%d => online=0 rc=EAGAIN\n",
667 __func__, AP_QID_CARD(zq->queue->qid),
668 AP_QID_QUEUE(zq->queue->qid),
669 (int)service_rc, (int)service_rs);
670 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
671 return -EAGAIN;
672 }
673 data_len = msg->length - sizeof(msg->length);
674 if (data_len > outputdatalength)
675 return -EMSGSIZE;
676
677 /* Copy the crypto response to user space. */
678 if (copy_to_user(outputdata, msg->data, data_len))
679 return -EFAULT;
680 return 0;
681 }
682
683 /*
684 * Copy results from a type 86 XCRB reply message back to user space.
685 *
686 * @zq: crypto device pointer
687 * @reply: reply AP message.
688 * @xcrb: pointer to XCRB
689 *
690 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
691 */
convert_type86_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)692 static int convert_type86_xcrb(bool userspace, struct zcrypt_queue *zq,
693 struct ap_message *reply,
694 struct ica_xcRB *xcrb)
695 {
696 struct type86_fmt2_msg *msg = reply->msg;
697 char *data = reply->msg;
698
699 /* Copy CPRB to user */
700 if (xcrb->reply_control_blk_length < msg->fmt2.count1) {
701 pr_debug("reply_control_blk_length %u < required %u => EMSGSIZE\n",
702 xcrb->reply_control_blk_length, msg->fmt2.count1);
703 return -EMSGSIZE;
704 }
705 if (z_copy_to_user(userspace, xcrb->reply_control_blk_addr,
706 data + msg->fmt2.offset1, msg->fmt2.count1))
707 return -EFAULT;
708 xcrb->reply_control_blk_length = msg->fmt2.count1;
709
710 /* Copy data buffer to user */
711 if (msg->fmt2.count2) {
712 if (xcrb->reply_data_length < msg->fmt2.count2) {
713 pr_debug("reply_data_length %u < required %u => EMSGSIZE\n",
714 xcrb->reply_data_length, msg->fmt2.count2);
715 return -EMSGSIZE;
716 }
717 if (z_copy_to_user(userspace, xcrb->reply_data_addr,
718 data + msg->fmt2.offset2, msg->fmt2.count2))
719 return -EFAULT;
720 }
721 xcrb->reply_data_length = msg->fmt2.count2;
722
723 return 0;
724 }
725
726 /*
727 * Copy results from a type 86 EP11 XCRB reply message back to user space.
728 *
729 * @zq: crypto device pointer
730 * @reply: reply AP message.
731 * @xcrb: pointer to EP11 user request block
732 *
733 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
734 */
convert_type86_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)735 static int convert_type86_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
736 struct ap_message *reply,
737 struct ep11_urb *xcrb)
738 {
739 struct type86_fmt2_msg *msg = reply->msg;
740 char *data = reply->msg;
741
742 if (xcrb->resp_len < msg->fmt2.count1) {
743 pr_debug("resp_len %u < required %u => EMSGSIZE\n",
744 (unsigned int)xcrb->resp_len, msg->fmt2.count1);
745 return -EMSGSIZE;
746 }
747
748 /* Copy response CPRB to user */
749 if (z_copy_to_user(userspace, (char __force __user *)xcrb->resp,
750 data + msg->fmt2.offset1, msg->fmt2.count1))
751 return -EFAULT;
752 xcrb->resp_len = msg->fmt2.count1;
753 return 0;
754 }
755
convert_type86_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * buffer)756 static int convert_type86_rng(struct zcrypt_queue *zq,
757 struct ap_message *reply,
758 char *buffer)
759 {
760 struct {
761 struct type86_hdr hdr;
762 struct type86_fmt2_ext fmt2;
763 struct CPRBX cprbx;
764 } __packed * msg = reply->msg;
765 char *data = reply->msg;
766
767 if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
768 return -EINVAL;
769 memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
770 return msg->fmt2.count2;
771 }
772
convert_response_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)773 static int convert_response_ica(struct zcrypt_queue *zq,
774 struct ap_message *reply,
775 char __user *outputdata,
776 unsigned int outputdatalength)
777 {
778 struct type86x_reply *msg = reply->msg;
779
780 switch (msg->hdr.type) {
781 case TYPE82_RSP_CODE:
782 case TYPE88_RSP_CODE:
783 return convert_error(zq, reply);
784 case TYPE86_RSP_CODE:
785 if (msg->cprbx.ccp_rtcode &&
786 msg->cprbx.ccp_rscode == 0x14f &&
787 outputdatalength > 256) {
788 if (zq->zcard->max_exp_bit_length <= 17) {
789 zq->zcard->max_exp_bit_length = 17;
790 return -EAGAIN;
791 } else {
792 return -EINVAL;
793 }
794 }
795 if (msg->hdr.reply_code)
796 return convert_error(zq, reply);
797 if (msg->cprbx.cprb_ver_id == 0x02)
798 return convert_type86_ica(zq, reply,
799 outputdata, outputdatalength);
800 fallthrough; /* wrong cprb version is an unknown response */
801 default:
802 /* Unknown response type, this should NEVER EVER happen */
803 zq->online = 0;
804 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
805 AP_QID_CARD(zq->queue->qid),
806 AP_QID_QUEUE(zq->queue->qid),
807 (int)msg->hdr.type);
808 ZCRYPT_DBF_ERR(
809 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
810 __func__, AP_QID_CARD(zq->queue->qid),
811 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
812 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
813 return -EAGAIN;
814 }
815 }
816
convert_response_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)817 static int convert_response_xcrb(bool userspace, struct zcrypt_queue *zq,
818 struct ap_message *reply,
819 struct ica_xcRB *xcrb)
820 {
821 struct type86x_reply *msg = reply->msg;
822
823 switch (msg->hdr.type) {
824 case TYPE82_RSP_CODE:
825 case TYPE88_RSP_CODE:
826 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
827 return convert_error(zq, reply);
828 case TYPE86_RSP_CODE:
829 if (msg->hdr.reply_code) {
830 xcrb->status = msg->fmt2.apfs;
831 return convert_error(zq, reply);
832 }
833 if (msg->cprbx.cprb_ver_id == 0x02)
834 return convert_type86_xcrb(userspace, zq, reply, xcrb);
835 fallthrough; /* wrong cprb version is an unknown response */
836 default: /* Unknown response type, this should NEVER EVER happen */
837 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
838 zq->online = 0;
839 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
840 AP_QID_CARD(zq->queue->qid),
841 AP_QID_QUEUE(zq->queue->qid),
842 (int)msg->hdr.type);
843 ZCRYPT_DBF_ERR(
844 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
845 __func__, AP_QID_CARD(zq->queue->qid),
846 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
847 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
848 return -EAGAIN;
849 }
850 }
851
convert_response_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)852 static int convert_response_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
853 struct ap_message *reply, struct ep11_urb *xcrb)
854 {
855 struct type86_ep11_reply *msg = reply->msg;
856
857 switch (msg->hdr.type) {
858 case TYPE82_RSP_CODE:
859 case TYPE87_RSP_CODE:
860 return convert_error(zq, reply);
861 case TYPE86_RSP_CODE:
862 if (msg->hdr.reply_code)
863 return convert_error(zq, reply);
864 if (msg->cprbx.cprb_ver_id == 0x04)
865 return convert_type86_ep11_xcrb(userspace, zq, reply, xcrb);
866 fallthrough; /* wrong cprb version is an unknown resp */
867 default: /* Unknown response type, this should NEVER EVER happen */
868 zq->online = 0;
869 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
870 AP_QID_CARD(zq->queue->qid),
871 AP_QID_QUEUE(zq->queue->qid),
872 (int)msg->hdr.type);
873 ZCRYPT_DBF_ERR(
874 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
875 __func__, AP_QID_CARD(zq->queue->qid),
876 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
877 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
878 return -EAGAIN;
879 }
880 }
881
convert_response_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * data)882 static int convert_response_rng(struct zcrypt_queue *zq,
883 struct ap_message *reply,
884 char *data)
885 {
886 struct type86x_reply *msg = reply->msg;
887
888 switch (msg->hdr.type) {
889 case TYPE82_RSP_CODE:
890 case TYPE88_RSP_CODE:
891 return -EINVAL;
892 case TYPE86_RSP_CODE:
893 if (msg->hdr.reply_code)
894 return -EINVAL;
895 if (msg->cprbx.cprb_ver_id == 0x02)
896 return convert_type86_rng(zq, reply, data);
897 fallthrough; /* wrong cprb version is an unknown response */
898 default: /* Unknown response type, this should NEVER EVER happen */
899 zq->online = 0;
900 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
901 AP_QID_CARD(zq->queue->qid),
902 AP_QID_QUEUE(zq->queue->qid),
903 (int)msg->hdr.type);
904 ZCRYPT_DBF_ERR(
905 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
906 __func__, AP_QID_CARD(zq->queue->qid),
907 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
908 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
909 return -EAGAIN;
910 }
911 }
912
913 /*
914 * This function is called from the AP bus code after a crypto request
915 * "msg" has finished with the reply message "reply".
916 * It is called from tasklet context.
917 * @aq: pointer to the AP queue
918 * @msg: pointer to the AP message
919 * @reply: pointer to the AP reply message
920 */
zcrypt_msgtype6_receive(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)921 static void zcrypt_msgtype6_receive(struct ap_queue *aq,
922 struct ap_message *msg,
923 struct ap_message *reply)
924 {
925 static struct error_hdr error_reply = {
926 .type = TYPE82_RSP_CODE,
927 .reply_code = REP82_ERROR_MACHINE_FAILURE,
928 };
929 struct ap_response_type *resp_type = &msg->response;
930 struct type86x_reply *t86r;
931 int len;
932
933 /* Copy the reply message to the request message buffer. */
934 if (!reply)
935 goto out; /* ap_msg->rc indicates the error */
936 t86r = reply->msg;
937 if (t86r->hdr.type == TYPE86_RSP_CODE &&
938 t86r->cprbx.cprb_ver_id == 0x02) {
939 switch (resp_type->type) {
940 case CEXXC_RESPONSE_TYPE_ICA:
941 len = sizeof(struct type86x_reply) + t86r->length;
942 if (len > reply->bufsize || len > msg->bufsize ||
943 len != reply->len) {
944 pr_debug("len mismatch => EMSGSIZE\n");
945 msg->rc = -EMSGSIZE;
946 goto out;
947 }
948 memcpy(msg->msg, reply->msg, len);
949 msg->len = len;
950 break;
951 case CEXXC_RESPONSE_TYPE_XCRB:
952 if (t86r->fmt2.count2)
953 len = t86r->fmt2.offset2 + t86r->fmt2.count2;
954 else
955 len = t86r->fmt2.offset1 + t86r->fmt2.count1;
956 if (len > reply->bufsize || len > msg->bufsize ||
957 len != reply->len) {
958 pr_debug("len mismatch => EMSGSIZE\n");
959 msg->rc = -EMSGSIZE;
960 goto out;
961 }
962 memcpy(msg->msg, reply->msg, len);
963 msg->len = len;
964 break;
965 default:
966 memcpy(msg->msg, &error_reply, sizeof(error_reply));
967 msg->len = sizeof(error_reply);
968 }
969 } else {
970 memcpy(msg->msg, reply->msg, sizeof(error_reply));
971 msg->len = sizeof(error_reply);
972 }
973 out:
974 complete(&resp_type->work);
975 }
976
977 /*
978 * This function is called from the AP bus code after a crypto request
979 * "msg" has finished with the reply message "reply".
980 * It is called from tasklet context.
981 * @aq: pointer to the AP queue
982 * @msg: pointer to the AP message
983 * @reply: pointer to the AP reply message
984 */
zcrypt_msgtype6_receive_ep11(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)985 static void zcrypt_msgtype6_receive_ep11(struct ap_queue *aq,
986 struct ap_message *msg,
987 struct ap_message *reply)
988 {
989 static struct error_hdr error_reply = {
990 .type = TYPE82_RSP_CODE,
991 .reply_code = REP82_ERROR_MACHINE_FAILURE,
992 };
993 struct ap_response_type *resp_type = &msg->response;
994 struct type86_ep11_reply *t86r;
995 int len;
996
997 /* Copy the reply message to the request message buffer. */
998 if (!reply)
999 goto out; /* ap_msg->rc indicates the error */
1000 t86r = reply->msg;
1001 if (t86r->hdr.type == TYPE86_RSP_CODE &&
1002 t86r->cprbx.cprb_ver_id == 0x04) {
1003 switch (resp_type->type) {
1004 case CEXXC_RESPONSE_TYPE_EP11:
1005 len = t86r->fmt2.offset1 + t86r->fmt2.count1;
1006 if (len > reply->bufsize || len > msg->bufsize ||
1007 len != reply->len) {
1008 pr_debug("len mismatch => EMSGSIZE\n");
1009 msg->rc = -EMSGSIZE;
1010 goto out;
1011 }
1012 memcpy(msg->msg, reply->msg, len);
1013 msg->len = len;
1014 break;
1015 default:
1016 memcpy(msg->msg, &error_reply, sizeof(error_reply));
1017 msg->len = sizeof(error_reply);
1018 }
1019 } else {
1020 memcpy(msg->msg, reply->msg, sizeof(error_reply));
1021 msg->len = sizeof(error_reply);
1022 }
1023 out:
1024 complete(&resp_type->work);
1025 }
1026
1027 static atomic_t zcrypt_step = ATOMIC_INIT(0);
1028
1029 /*
1030 * The request distributor calls this function if it picked the CEXxC
1031 * device to handle a modexpo request.
1032 * This function assumes that ap_msg has been initialized with
1033 * ap_init_apmsg() and thus a valid buffer with the size of
1034 * ap_msg->bufsize is available within ap_msg. Also the caller has
1035 * to make sure ap_release_apmsg() is always called even on failure.
1036 * @zq: pointer to zcrypt_queue structure that identifies the
1037 * CEXxC device to the request distributor
1038 * @mex: pointer to the modexpo request buffer
1039 */
zcrypt_msgtype6_modexpo(struct zcrypt_queue * zq,struct ica_rsa_modexpo * mex,struct ap_message * ap_msg)1040 static long zcrypt_msgtype6_modexpo(struct zcrypt_queue *zq,
1041 struct ica_rsa_modexpo *mex,
1042 struct ap_message *ap_msg)
1043 {
1044 struct ap_response_type *resp_type = &ap_msg->response;
1045 int rc;
1046
1047 ap_msg->receive = zcrypt_msgtype6_receive;
1048 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1049 atomic_inc_return(&zcrypt_step);
1050 rc = icamex_msg_to_type6mex_msgx(zq, ap_msg, mex);
1051 if (rc)
1052 goto out;
1053 resp_type->type = CEXXC_RESPONSE_TYPE_ICA;
1054 init_completion(&resp_type->work);
1055 rc = ap_queue_message(zq->queue, ap_msg);
1056 if (rc)
1057 goto out;
1058 rc = wait_for_completion_interruptible(&resp_type->work);
1059 if (rc == 0) {
1060 rc = ap_msg->rc;
1061 if (rc == 0)
1062 rc = convert_response_ica(zq, ap_msg,
1063 mex->outputdata,
1064 mex->outputdatalength);
1065 } else {
1066 /* Signal pending. */
1067 ap_cancel_message(zq->queue, ap_msg);
1068 }
1069
1070 out:
1071 return rc;
1072 }
1073
1074 /*
1075 * The request distributor calls this function if it picked the CEXxC
1076 * device to handle a modexpo_crt request.
1077 * This function assumes that ap_msg has been initialized with
1078 * ap_init_apmsg() and thus a valid buffer with the size of
1079 * ap_msg->bufsize is available within ap_msg. Also the caller has
1080 * to make sure ap_release_apmsg() is always called even on failure.
1081 * @zq: pointer to zcrypt_queue structure that identifies the
1082 * CEXxC device to the request distributor
1083 * @crt: pointer to the modexpoc_crt request buffer
1084 */
zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue * zq,struct ica_rsa_modexpo_crt * crt,struct ap_message * ap_msg)1085 static long zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue *zq,
1086 struct ica_rsa_modexpo_crt *crt,
1087 struct ap_message *ap_msg)
1088 {
1089 struct ap_response_type *resp_type = &ap_msg->response;
1090 int rc;
1091
1092 ap_msg->receive = zcrypt_msgtype6_receive;
1093 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1094 atomic_inc_return(&zcrypt_step);
1095 rc = icacrt_msg_to_type6crt_msgx(zq, ap_msg, crt);
1096 if (rc)
1097 goto out;
1098 resp_type->type = CEXXC_RESPONSE_TYPE_ICA;
1099 init_completion(&resp_type->work);
1100 rc = ap_queue_message(zq->queue, ap_msg);
1101 if (rc)
1102 goto out;
1103 rc = wait_for_completion_interruptible(&resp_type->work);
1104 if (rc == 0) {
1105 rc = ap_msg->rc;
1106 if (rc == 0)
1107 rc = convert_response_ica(zq, ap_msg,
1108 crt->outputdata,
1109 crt->outputdatalength);
1110 } else {
1111 /* Signal pending. */
1112 ap_cancel_message(zq->queue, ap_msg);
1113 }
1114
1115 out:
1116 return rc;
1117 }
1118
1119 /*
1120 * Prepare a CCA AP msg request.
1121 * Prepare a CCA AP msg: fetch the required data from userspace,
1122 * prepare the AP msg, fill some info into the ap_message struct,
1123 * extract some data from the CPRB and give back to the caller.
1124 * This function assumes that ap_msg has been initialized with
1125 * ap_init_apmsg() and thus a valid buffer with the size of
1126 * ap_msg->bufsize is available within ap_msg. Also the caller has
1127 * to make sure ap_release_apmsg() is always called even on failure.
1128 */
prep_cca_ap_msg(bool userspace,struct ica_xcRB * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned int * domain)1129 int prep_cca_ap_msg(bool userspace, struct ica_xcRB *xcrb,
1130 struct ap_message *ap_msg,
1131 unsigned int *func_code, unsigned int *domain)
1132 {
1133 struct ap_response_type *resp_type = &ap_msg->response;
1134
1135 ap_msg->receive = zcrypt_msgtype6_receive;
1136 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1137 atomic_inc_return(&zcrypt_step);
1138 resp_type->type = CEXXC_RESPONSE_TYPE_XCRB;
1139 return xcrb_msg_to_type6cprb_msgx(userspace, ap_msg,
1140 xcrb, func_code, domain);
1141 }
1142
1143 /*
1144 * The request distributor calls this function if it picked the CEXxC
1145 * device to handle a send_cprb request.
1146 * @zq: pointer to zcrypt_queue structure that identifies the
1147 * CEXxC device to the request distributor
1148 * @xcrb: pointer to the send_cprb request buffer
1149 */
zcrypt_msgtype6_send_cprb(bool userspace,struct zcrypt_queue * zq,struct ica_xcRB * xcrb,struct ap_message * ap_msg)1150 static long zcrypt_msgtype6_send_cprb(bool userspace, struct zcrypt_queue *zq,
1151 struct ica_xcRB *xcrb,
1152 struct ap_message *ap_msg)
1153 {
1154 struct ap_response_type *resp_type = &ap_msg->response;
1155 struct {
1156 struct type6_hdr hdr;
1157 struct CPRBX cprbx;
1158 /* ... more data blocks ... */
1159 } __packed * msg = ap_msg->msg;
1160 unsigned int max_payload_size;
1161 int rc, delta;
1162
1163 /* calculate maximum payload for this card and msg type */
1164 max_payload_size = zq->reply.bufsize - sizeof(struct type86_fmt2_msg);
1165
1166 /* limit each of the two from fields to the maximum payload size */
1167 msg->hdr.fromcardlen1 = min(msg->hdr.fromcardlen1, max_payload_size);
1168 msg->hdr.fromcardlen2 = min(msg->hdr.fromcardlen2, max_payload_size);
1169
1170 /* calculate delta if the sum of both exceeds max payload size */
1171 delta = msg->hdr.fromcardlen1 + msg->hdr.fromcardlen2
1172 - max_payload_size;
1173 if (delta > 0) {
1174 /*
1175 * Sum exceeds maximum payload size, prune fromcardlen1
1176 * (always trust fromcardlen2)
1177 */
1178 if (delta > msg->hdr.fromcardlen1) {
1179 rc = -EINVAL;
1180 goto out;
1181 }
1182 msg->hdr.fromcardlen1 -= delta;
1183 }
1184
1185 /* update domain field within the CPRB struct */
1186 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
1187
1188 init_completion(&resp_type->work);
1189 rc = ap_queue_message(zq->queue, ap_msg);
1190 if (rc)
1191 goto out;
1192 rc = wait_for_completion_interruptible(&resp_type->work);
1193 if (rc == 0) {
1194 rc = ap_msg->rc;
1195 if (rc == 0)
1196 rc = convert_response_xcrb(userspace, zq, ap_msg, xcrb);
1197 } else {
1198 /* Signal pending. */
1199 ap_cancel_message(zq->queue, ap_msg);
1200 }
1201
1202 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1203 rc = -EIO; /* do not retry administrative requests */
1204
1205 out:
1206 if (rc)
1207 pr_debug("send cprb at dev=%02x.%04x rc=%d\n",
1208 AP_QID_CARD(zq->queue->qid),
1209 AP_QID_QUEUE(zq->queue->qid), rc);
1210 return rc;
1211 }
1212
1213 /*
1214 * Prepare an EP11 AP msg request.
1215 * Prepare an EP11 AP msg: fetch the required data from userspace,
1216 * prepare the AP msg, fill some info into the ap_message struct,
1217 * extract some data from the CPRB and give back to the caller.
1218 * This function assumes that ap_msg has been initialized with
1219 * ap_init_apmsg() and thus a valid buffer with the size of
1220 * ap_msg->bufsize is available within ap_msg. Also the caller has
1221 * to make sure ap_release_apmsg() is always called even on failure.
1222 */
prep_ep11_ap_msg(bool userspace,struct ep11_urb * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned int * domain)1223 int prep_ep11_ap_msg(bool userspace, struct ep11_urb *xcrb,
1224 struct ap_message *ap_msg,
1225 unsigned int *func_code, unsigned int *domain)
1226 {
1227 struct ap_response_type *resp_type = &ap_msg->response;
1228
1229 ap_msg->receive = zcrypt_msgtype6_receive_ep11;
1230 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1231 atomic_inc_return(&zcrypt_step);
1232 resp_type->type = CEXXC_RESPONSE_TYPE_EP11;
1233 return xcrb_msg_to_type6_ep11cprb_msgx(userspace, ap_msg, xcrb,
1234 func_code, domain);
1235 }
1236
1237 /*
1238 * Simple asn1 int writer/encoder helper function
1239 * Returns number of bytes processed or < 0 on failure
1240 * Only accepts int length values of 1, 2 or 4.
1241 */
asn1_int_encode(u8 * buf,size_t intlen,u32 u)1242 static inline int asn1_int_encode(u8 *buf, size_t intlen, u32 u)
1243 {
1244 switch (intlen) {
1245 case 1:
1246 *buf = (u8)u;
1247 return 1;
1248 case 2:
1249 put_unaligned_be16((u16)u, buf);
1250 return 2;
1251 case 4:
1252 put_unaligned_be32((u32)u, buf);
1253 return 4;
1254 default:
1255 return -EINVAL;
1256 }
1257 }
1258
1259 /*
1260 * The request distributor calls this function if it picked the CEX4P
1261 * device to handle a send_ep11_cprb request.
1262 * @zq: pointer to zcrypt_queue structure that identifies the
1263 * CEX4P device to the request distributor
1264 * @xcrb: pointer to the ep11 user request block
1265 */
zcrypt_msgtype6_send_ep11_cprb(bool userspace,struct zcrypt_queue * zq,struct ep11_urb * xcrb,struct ap_message * ap_msg)1266 static long zcrypt_msgtype6_send_ep11_cprb(bool userspace, struct zcrypt_queue *zq,
1267 struct ep11_urb *xcrb,
1268 struct ap_message *ap_msg)
1269 {
1270 int rc;
1271 struct ap_response_type *resp_type = &ap_msg->response;
1272 struct {
1273 struct type6_hdr hdr;
1274 struct ep11_cprb cprbx;
1275 } __packed * msg = ap_msg->msg;
1276
1277 /*
1278 * The target domain field within the cprb body/payload block will be
1279 * replaced by the usage domain for non-management commands only.
1280 * Therefore we check the first bit of the 'flags' parameter for
1281 * management command indication.
1282 */
1283 if (!(msg->cprbx.flags & 0x80)) {
1284 int i, offs = 0;
1285 size_t pld_len;
1286 u8 *pld;
1287 u32 u;
1288
1289 /* update target field in ep11_cprb */
1290 msg->cprbx.target_id = (u32)AP_QID_QUEUE(zq->queue->qid);
1291
1292 /* ptr and length to payload */
1293 pld = ap_msg->msg +
1294 sizeof(struct type6_hdr) + sizeof(struct ep11_cprb);
1295 pld_len = msg->cprbx.payload_len;
1296 if (pld_len < MIN_EP11_PAYLOAD_SIZE)
1297 return -EINVAL;
1298
1299 /*
1300 * Parse the asn1 payload, at least we have
1301 * pld tag (1 octet)
1302 * payload length (1-5 octets)
1303 * function tag (1 octet)
1304 * function length (1-5 octets)
1305 * function value (1-4 octets)
1306 * ----- optional fields -----
1307 * domain tag (1 octet)
1308 * domain length (1-5 octets)
1309 * domain value (1-4 octets)
1310 * ... maybe much more data ...
1311 */
1312
1313 /* payload tag */
1314 if (pld[offs++] != 0x30)
1315 return -EINVAL;
1316 /* payload length field */
1317 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1318 if (i < 0)
1319 return -EINVAL;
1320 offs += i;
1321 if (offs >= pld_len || u > pld_len - offs)
1322 return -EINVAL;
1323 /* function tag */
1324 if (pld[offs++] != 0x04)
1325 return -EINVAL;
1326 /* function length */
1327 if (offs >= pld_len)
1328 return -EINVAL;
1329 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1330 if (i < 0)
1331 return -EINVAL;
1332 offs += i;
1333 if (u > pld_len - offs)
1334 return -EINVAL;
1335 /* skip over the function value */
1336 offs += u;
1337 /* is there some payload left which could hold a domain value ? */
1338 if (offs < pld_len && pld_len - offs >= 3) {
1339 /* domain tag */
1340 if (pld[offs++] != 0x04)
1341 return -EINVAL;
1342 /* domain length */
1343 i = asn1_length_decode(pld + offs, pld_len - offs, &u);
1344 if (i < 0)
1345 return -EINVAL;
1346 offs += i;
1347 if (offs >= pld_len || u > pld_len - offs)
1348 return -EINVAL;
1349 /*
1350 * pld[offs] is now at the start of the domain value
1351 * with the value sprawled in u octets.
1352 */
1353 i = asn1_int_encode(pld + offs, u,
1354 AP_QID_QUEUE(zq->queue->qid));
1355 if (i < 0)
1356 return -EINVAL;
1357 offs += i;
1358 }
1359 }
1360
1361 /*
1362 * Set the queue's reply buffer length minus the two prepend headers
1363 * as reply limit for the card firmware.
1364 */
1365 msg->hdr.fromcardlen1 = zq->reply.bufsize -
1366 sizeof(struct type86_hdr) - sizeof(struct type86_fmt2_ext);
1367
1368 init_completion(&resp_type->work);
1369 rc = ap_queue_message(zq->queue, ap_msg);
1370 if (rc)
1371 goto out;
1372 rc = wait_for_completion_interruptible(&resp_type->work);
1373 if (rc == 0) {
1374 rc = ap_msg->rc;
1375 if (rc == 0)
1376 rc = convert_response_ep11_xcrb(userspace, zq, ap_msg, xcrb);
1377 } else {
1378 /* Signal pending. */
1379 ap_cancel_message(zq->queue, ap_msg);
1380 }
1381
1382 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1383 rc = -EIO; /* do not retry administrative requests */
1384
1385 out:
1386 if (rc)
1387 pr_debug("send cprb at dev=%02x.%04x rc=%d\n",
1388 AP_QID_CARD(zq->queue->qid),
1389 AP_QID_QUEUE(zq->queue->qid), rc);
1390 return rc;
1391 }
1392
1393 /*
1394 * Prepare a type6 CPRB message for random number generation
1395 *
1396 * @ap_dev: AP device pointer
1397 * @ap_msg: pointer to AP message
1398 */
rng_type6cprb_msgx(struct ap_message * ap_msg,unsigned int random_number_length,unsigned int * domain)1399 static inline void rng_type6cprb_msgx(struct ap_message *ap_msg,
1400 unsigned int random_number_length,
1401 unsigned int *domain)
1402 {
1403 struct {
1404 struct type6_hdr hdr;
1405 struct CPRBX cprbx;
1406 char function_code[2];
1407 short int rule_length;
1408 char rule[8];
1409 short int verb_length;
1410 short int key_length;
1411 } __packed * msg = ap_msg->msg;
1412 static struct type6_hdr static_type6_hdrX = {
1413 .type = 0x06,
1414 .offset1 = 0x00000058,
1415 .agent_id = {'C', 'A'},
1416 .function_code = {'R', 'L'},
1417 .tocardlen1 = sizeof(*msg) - sizeof(msg->hdr),
1418 .fromcardlen1 = sizeof(*msg) - sizeof(msg->hdr),
1419 };
1420 static struct CPRBX local_cprbx = {
1421 .cprb_len = 0x00dc,
1422 .cprb_ver_id = 0x02,
1423 .func_id = {'T', '2'},
1424 .req_parml = sizeof(*msg) - sizeof(msg->hdr) -
1425 sizeof(msg->cprbx),
1426 .rpl_msgbl = sizeof(*msg) - sizeof(msg->hdr),
1427 };
1428
1429 msg->hdr = static_type6_hdrX;
1430 msg->hdr.fromcardlen2 = random_number_length;
1431 msg->cprbx = local_cprbx;
1432 msg->cprbx.rpl_datal = random_number_length;
1433 memcpy(msg->function_code, msg->hdr.function_code, 0x02);
1434 msg->rule_length = 0x0a;
1435 memcpy(msg->rule, "RANDOM ", 8);
1436 msg->verb_length = 0x02;
1437 msg->key_length = 0x02;
1438 ap_msg->len = sizeof(*msg);
1439 if (domain)
1440 *domain = msg->cprbx.domain;
1441 }
1442
1443 /*
1444 * Prepare a CEXXC get random request ap message.
1445 * This function assumes that ap_msg has been initialized with
1446 * ap_init_apmsg() and thus a valid buffer with the size of
1447 * ap_max_msg_size is available within ap_msg. Also the caller has
1448 * to make sure ap_release_apmsg() is always called even on failure.
1449 */
prep_rng_ap_msg(struct ap_message * ap_msg,int * func_code,unsigned int * domain)1450 int prep_rng_ap_msg(struct ap_message *ap_msg, int *func_code,
1451 unsigned int *domain)
1452 {
1453 struct ap_response_type *resp_type = &ap_msg->response;
1454
1455 if (ap_msg->bufsize < AP_DEFAULT_MAX_MSG_SIZE)
1456 return -EMSGSIZE;
1457 ap_msg->receive = zcrypt_msgtype6_receive;
1458 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1459 atomic_inc_return(&zcrypt_step);
1460
1461 resp_type->type = CEXXC_RESPONSE_TYPE_XCRB;
1462
1463 rng_type6cprb_msgx(ap_msg, ZCRYPT_RNG_BUFFER_SIZE, domain);
1464
1465 *func_code = HWRNG;
1466 return 0;
1467 }
1468
1469 /*
1470 * The request distributor calls this function if it picked the CEXxC
1471 * device to generate random data.
1472 * @zq: pointer to zcrypt_queue structure that identifies the
1473 * CEXxC device to the request distributor
1474 * @buffer: pointer to a memory page to return random data
1475 */
zcrypt_msgtype6_rng(struct zcrypt_queue * zq,char * buffer,struct ap_message * ap_msg)1476 static long zcrypt_msgtype6_rng(struct zcrypt_queue *zq,
1477 char *buffer, struct ap_message *ap_msg)
1478 {
1479 struct {
1480 struct type6_hdr hdr;
1481 struct CPRBX cprbx;
1482 char function_code[2];
1483 short int rule_length;
1484 char rule[8];
1485 short int verb_length;
1486 short int key_length;
1487 } __packed * msg = ap_msg->msg;
1488 struct ap_response_type *resp_type = &ap_msg->response;
1489 int rc;
1490
1491 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
1492
1493 init_completion(&resp_type->work);
1494 rc = ap_queue_message(zq->queue, ap_msg);
1495 if (rc)
1496 goto out;
1497 rc = wait_for_completion_interruptible(&resp_type->work);
1498 if (rc == 0) {
1499 rc = ap_msg->rc;
1500 if (rc == 0)
1501 rc = convert_response_rng(zq, ap_msg, buffer);
1502 } else {
1503 /* Signal pending. */
1504 ap_cancel_message(zq->queue, ap_msg);
1505 }
1506 out:
1507 return rc;
1508 }
1509
1510 /*
1511 * The crypto operations for a CEXxC card.
1512 */
1513
1514 static struct zcrypt_ops zcrypt_msgtype6_ops = {
1515 .owner = THIS_MODULE,
1516 .name = MSGTYPE06_NAME,
1517 .variant = MSGTYPE06_VARIANT_DEFAULT,
1518 .rsa_modexpo = zcrypt_msgtype6_modexpo,
1519 .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
1520 .send_cprb = zcrypt_msgtype6_send_cprb,
1521 .rng = zcrypt_msgtype6_rng,
1522 };
1523
1524 static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
1525 .owner = THIS_MODULE,
1526 .name = MSGTYPE06_NAME,
1527 .variant = MSGTYPE06_VARIANT_EP11,
1528 .rsa_modexpo = NULL,
1529 .rsa_modexpo_crt = NULL,
1530 .send_ep11_cprb = zcrypt_msgtype6_send_ep11_cprb,
1531 };
1532
zcrypt_msgtype6_init(void)1533 void __init zcrypt_msgtype6_init(void)
1534 {
1535 zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
1536 zcrypt_msgtype_register(&zcrypt_msgtype6_ep11_ops);
1537 }
1538
zcrypt_msgtype6_exit(void)1539 void __exit zcrypt_msgtype6_exit(void)
1540 {
1541 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
1542 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ep11_ops);
1543 }
1544