1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * pkey device driver 4 * 5 * Copyright IBM Corp. 2017, 2023 6 * 7 * Author(s): Harald Freudenberger 8 */ 9 10 #define pr_fmt(fmt) "pkey: " fmt 11 12 #include <linux/init.h> 13 #include <linux/miscdevice.h> 14 #include <linux/export.h> 15 #include <linux/slab.h> 16 17 #include "zcrypt_api.h" 18 #include "zcrypt_ccamisc.h" 19 20 #include "pkey_base.h" 21 22 /* 23 * Helper functions 24 */ 25 static int key2protkey(const struct pkey_apqn *apqns, size_t nr_apqns, 26 const u8 *key, size_t keylen, 27 u8 *protkey, u32 *protkeylen, u32 *protkeytype, 28 u32 xflags) 29 { 30 int rc; 31 32 /* try the direct way */ 33 rc = pkey_handler_key_to_protkey(apqns, nr_apqns, 34 key, keylen, 35 protkey, protkeylen, 36 protkeytype, xflags); 37 38 /* if this did not work, try the slowpath way */ 39 if (rc == -ENODEV) { 40 rc = pkey_handler_slowpath_key_to_protkey(apqns, nr_apqns, 41 key, keylen, 42 protkey, protkeylen, 43 protkeytype, xflags); 44 if (rc) 45 rc = -ENODEV; 46 } 47 48 pr_debug("rc=%d\n", rc); 49 return rc; 50 } 51 52 /* 53 * In-Kernel function: Transform a key blob (of any type) into a protected key 54 */ 55 int pkey_key2protkey(const u8 *key, u32 keylen, 56 u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags) 57 { 58 int rc; 59 60 rc = key2protkey(NULL, 0, key, keylen, 61 protkey, protkeylen, protkeytype, xflags); 62 if (rc == -ENODEV) { 63 pkey_handler_request_modules(); 64 rc = key2protkey(NULL, 0, key, keylen, 65 protkey, protkeylen, protkeytype, xflags); 66 } 67 68 return rc; 69 } 70 EXPORT_SYMBOL(pkey_key2protkey); 71 72 /* 73 * Ioctl functions 74 */ 75 76 static void *_copy_key_from_user(void __user *ukey, size_t keylen) 77 { 78 if (!ukey || keylen < MINKEYBLOBBUFSIZE || keylen > KEYBLOBBUFSIZE) 79 return ERR_PTR(-EINVAL); 80 81 return memdup_user(ukey, keylen); 82 } 83 84 static void *_copy_apqns_from_user(void __user *uapqns, size_t nr_apqns) 85 { 86 if (!uapqns || nr_apqns == 0) 87 return NULL; 88 89 return memdup_array_user(uapqns, nr_apqns, sizeof(struct pkey_apqn)); 90 } 91 92 static int pkey_ioctl_genseck(struct pkey_genseck __user *ugs) 93 { 94 struct pkey_genseck kgs; 95 struct pkey_apqn apqn; 96 u32 keybuflen; 97 int rc; 98 99 if (copy_from_user(&kgs, ugs, sizeof(kgs))) 100 return -EFAULT; 101 102 apqn.card = kgs.cardnr; 103 apqn.domain = kgs.domain; 104 keybuflen = sizeof(kgs.seckey.seckey); 105 rc = pkey_handler_gen_key(&apqn, 1, 106 kgs.keytype, PKEY_TYPE_CCA_DATA, 0, 0, 107 kgs.seckey.seckey, &keybuflen, NULL, 0); 108 pr_debug("gen_key()=%d\n", rc); 109 if (!rc && copy_to_user(ugs, &kgs, sizeof(kgs))) 110 rc = -EFAULT; 111 memzero_explicit(&kgs, sizeof(kgs)); 112 113 return rc; 114 } 115 116 static int pkey_ioctl_clr2seck(struct pkey_clr2seck __user *ucs) 117 { 118 struct pkey_clr2seck kcs; 119 struct pkey_apqn apqn; 120 u32 keybuflen; 121 int rc; 122 123 if (copy_from_user(&kcs, ucs, sizeof(kcs))) 124 return -EFAULT; 125 126 apqn.card = kcs.cardnr; 127 apqn.domain = kcs.domain; 128 keybuflen = sizeof(kcs.seckey.seckey); 129 rc = pkey_handler_clr_to_key(&apqn, 1, 130 kcs.keytype, PKEY_TYPE_CCA_DATA, 0, 0, 131 kcs.clrkey.clrkey, 132 pkey_keytype_aes_to_size(kcs.keytype), 133 kcs.seckey.seckey, &keybuflen, NULL, 0); 134 pr_debug("clr_to_key()=%d\n", rc); 135 if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs))) 136 rc = -EFAULT; 137 memzero_explicit(&kcs, sizeof(kcs)); 138 139 return rc; 140 } 141 142 static int pkey_ioctl_sec2protk(struct pkey_sec2protk __user *usp) 143 { 144 struct pkey_sec2protk ksp; 145 struct pkey_apqn apqn; 146 int rc; 147 148 if (copy_from_user(&ksp, usp, sizeof(ksp))) 149 return -EFAULT; 150 151 apqn.card = ksp.cardnr; 152 apqn.domain = ksp.domain; 153 ksp.protkey.len = sizeof(ksp.protkey.protkey); 154 rc = pkey_handler_key_to_protkey(&apqn, 1, 155 ksp.seckey.seckey, 156 sizeof(ksp.seckey.seckey), 157 ksp.protkey.protkey, 158 &ksp.protkey.len, &ksp.protkey.type, 159 0); 160 pr_debug("key_to_protkey()=%d\n", rc); 161 if (!rc && copy_to_user(usp, &ksp, sizeof(ksp))) 162 rc = -EFAULT; 163 memzero_explicit(&ksp, sizeof(ksp)); 164 165 return rc; 166 } 167 168 static int pkey_ioctl_clr2protk(struct pkey_clr2protk __user *ucp) 169 { 170 struct pkey_clr2protk kcp; 171 struct clearkeytoken *t; 172 u32 keylen; 173 u8 *tmpbuf; 174 int rc; 175 176 if (copy_from_user(&kcp, ucp, sizeof(kcp))) 177 return -EFAULT; 178 179 /* build a 'clear key token' from the clear key value */ 180 keylen = pkey_keytype_aes_to_size(kcp.keytype); 181 if (!keylen) { 182 PKEY_DBF_ERR("%s unknown/unsupported keytype %u\n", 183 __func__, kcp.keytype); 184 memzero_explicit(&kcp, sizeof(kcp)); 185 return -EINVAL; 186 } 187 tmpbuf = kzalloc(sizeof(*t) + keylen, GFP_KERNEL); 188 if (!tmpbuf) { 189 memzero_explicit(&kcp, sizeof(kcp)); 190 return -ENOMEM; 191 } 192 t = (struct clearkeytoken *)tmpbuf; 193 t->type = TOKTYPE_NON_CCA; 194 t->version = TOKVER_CLEAR_KEY; 195 t->keytype = (keylen - 8) >> 3; 196 t->len = keylen; 197 memcpy(t->clearkey, kcp.clrkey.clrkey, keylen); 198 kcp.protkey.len = sizeof(kcp.protkey.protkey); 199 200 rc = key2protkey(NULL, 0, 201 tmpbuf, sizeof(*t) + keylen, 202 kcp.protkey.protkey, 203 &kcp.protkey.len, &kcp.protkey.type, 0); 204 pr_debug("key2protkey()=%d\n", rc); 205 206 kfree_sensitive(tmpbuf); 207 208 if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp))) 209 rc = -EFAULT; 210 memzero_explicit(&kcp, sizeof(kcp)); 211 212 return rc; 213 } 214 215 static int pkey_ioctl_findcard(struct pkey_findcard __user *ufc) 216 { 217 struct pkey_findcard kfc; 218 struct pkey_apqn *apqns; 219 size_t nr_apqns; 220 int rc; 221 222 if (copy_from_user(&kfc, ufc, sizeof(kfc))) 223 return -EFAULT; 224 225 nr_apqns = MAXAPQNSINLIST; 226 apqns = kmalloc_objs(struct pkey_apqn, nr_apqns); 227 if (!apqns) 228 return -ENOMEM; 229 230 rc = pkey_handler_apqns_for_key(kfc.seckey.seckey, 231 sizeof(kfc.seckey.seckey), 232 PKEY_FLAGS_MATCH_CUR_MKVP, 233 apqns, &nr_apqns, 0); 234 if (rc == -ENODEV) 235 rc = pkey_handler_apqns_for_key(kfc.seckey.seckey, 236 sizeof(kfc.seckey.seckey), 237 PKEY_FLAGS_MATCH_ALT_MKVP, 238 apqns, &nr_apqns, 0); 239 pr_debug("apqns_for_key()=%d\n", rc); 240 if (rc) { 241 kfree(apqns); 242 return rc; 243 } 244 kfc.cardnr = apqns[0].card; 245 kfc.domain = apqns[0].domain; 246 kfree(apqns); 247 if (copy_to_user(ufc, &kfc, sizeof(kfc))) 248 return -EFAULT; 249 250 return 0; 251 } 252 253 static int pkey_ioctl_skey2pkey(struct pkey_skey2pkey __user *usp) 254 { 255 struct pkey_skey2pkey ksp; 256 int rc; 257 258 if (copy_from_user(&ksp, usp, sizeof(ksp))) 259 return -EFAULT; 260 261 ksp.protkey.len = sizeof(ksp.protkey.protkey); 262 rc = pkey_handler_key_to_protkey(NULL, 0, 263 ksp.seckey.seckey, 264 sizeof(ksp.seckey.seckey), 265 ksp.protkey.protkey, 266 &ksp.protkey.len, 267 &ksp.protkey.type, 0); 268 pr_debug("key_to_protkey()=%d\n", rc); 269 if (!rc && copy_to_user(usp, &ksp, sizeof(ksp))) 270 rc = -EFAULT; 271 memzero_explicit(&ksp, sizeof(ksp)); 272 273 return rc; 274 } 275 276 static int pkey_ioctl_verifykey(struct pkey_verifykey __user *uvk) 277 { 278 u32 keytype, keybitsize, flags; 279 struct pkey_verifykey kvk; 280 int rc; 281 282 if (copy_from_user(&kvk, uvk, sizeof(kvk))) 283 return -EFAULT; 284 285 kvk.cardnr = 0xFFFF; 286 kvk.domain = 0xFFFF; 287 rc = pkey_handler_verify_key(kvk.seckey.seckey, 288 sizeof(kvk.seckey.seckey), 289 &kvk.cardnr, &kvk.domain, 290 &keytype, &keybitsize, &flags, 0); 291 pr_debug("verify_key()=%d\n", rc); 292 if (!rc && keytype != PKEY_TYPE_CCA_DATA) 293 rc = -EINVAL; 294 kvk.attributes = PKEY_VERIFY_ATTR_AES; 295 kvk.keysize = (u16)keybitsize; 296 if (flags & PKEY_FLAGS_MATCH_ALT_MKVP) 297 kvk.attributes |= PKEY_VERIFY_ATTR_OLD_MKVP; 298 if (!rc && copy_to_user(uvk, &kvk, sizeof(kvk))) 299 rc = -EFAULT; 300 memzero_explicit(&kvk, sizeof(kvk)); 301 302 return rc; 303 } 304 305 static int pkey_ioctl_genprotk(struct pkey_genprotk __user *ugp) 306 { 307 struct pkey_genprotk kgp; 308 int rc; 309 310 if (copy_from_user(&kgp, ugp, sizeof(kgp))) 311 return -EFAULT; 312 313 kgp.protkey.len = sizeof(kgp.protkey.protkey); 314 rc = pkey_handler_gen_key(NULL, 0, kgp.keytype, 315 PKEY_TYPE_PROTKEY, 0, 0, 316 kgp.protkey.protkey, &kgp.protkey.len, 317 &kgp.protkey.type, 0); 318 pr_debug("gen_key()=%d\n", rc); 319 if (!rc && copy_to_user(ugp, &kgp, sizeof(kgp))) 320 rc = -EFAULT; 321 memzero_explicit(&kgp, sizeof(kgp)); 322 323 return rc; 324 } 325 326 static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp) 327 { 328 struct pkey_verifyprotk kvp; 329 struct protaeskeytoken *t; 330 u8 *tmpbuf; 331 int rc; 332 333 if (copy_from_user(&kvp, uvp, sizeof(kvp))) 334 return -EFAULT; 335 336 if (kvp.protkey.len > sizeof(kvp.protkey.protkey)) { 337 PKEY_DBF_ERR("%s protkey length %u exceeds protkey buffer size\n", 338 __func__, kvp.protkey.len); 339 memzero_explicit(&kvp, sizeof(kvp)); 340 return -EINVAL; 341 } 342 343 /* build a 'protected key token' from the raw protected key */ 344 tmpbuf = kzalloc(sizeof(*t), GFP_KERNEL); 345 if (!tmpbuf) { 346 memzero_explicit(&kvp, sizeof(kvp)); 347 return -ENOMEM; 348 } 349 t = (struct protaeskeytoken *)tmpbuf; 350 t->type = TOKTYPE_NON_CCA; 351 t->version = TOKVER_PROTECTED_KEY; 352 t->keytype = kvp.protkey.type; 353 t->len = kvp.protkey.len; 354 memcpy(t->protkey, kvp.protkey.protkey, kvp.protkey.len); 355 356 rc = pkey_handler_verify_key(tmpbuf, sizeof(*t), 357 NULL, NULL, NULL, NULL, NULL, 0); 358 pr_debug("verify_key()=%d\n", rc); 359 360 kfree_sensitive(tmpbuf); 361 memzero_explicit(&kvp, sizeof(kvp)); 362 363 return rc; 364 } 365 366 static int pkey_ioctl_kblob2protk(struct pkey_kblob2pkey __user *utp) 367 { 368 struct pkey_kblob2pkey ktp; 369 u8 *kkey; 370 int rc; 371 372 if (copy_from_user(&ktp, utp, sizeof(ktp))) 373 return -EFAULT; 374 kkey = _copy_key_from_user(ktp.key, ktp.keylen); 375 if (IS_ERR(kkey)) 376 return PTR_ERR(kkey); 377 ktp.protkey.len = sizeof(ktp.protkey.protkey); 378 rc = key2protkey(NULL, 0, kkey, ktp.keylen, 379 ktp.protkey.protkey, &ktp.protkey.len, 380 &ktp.protkey.type, 0); 381 pr_debug("key2protkey()=%d\n", rc); 382 kfree_sensitive(kkey); 383 if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) 384 rc = -EFAULT; 385 memzero_explicit(&ktp, sizeof(ktp)); 386 387 return rc; 388 } 389 390 static int pkey_ioctl_genseck2(struct pkey_genseck2 __user *ugs) 391 { 392 u32 klen = KEYBLOBBUFSIZE; 393 struct pkey_genseck2 kgs; 394 struct pkey_apqn *apqns; 395 u8 *kkey; 396 int rc; 397 u32 u; 398 399 if (copy_from_user(&kgs, ugs, sizeof(kgs))) 400 return -EFAULT; 401 u = pkey_aes_bitsize_to_keytype(kgs.size); 402 if (!u) { 403 PKEY_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 404 __func__, kgs.size); 405 return -EINVAL; 406 } 407 apqns = _copy_apqns_from_user(kgs.apqns, kgs.apqn_entries); 408 if (IS_ERR(apqns)) 409 return PTR_ERR(apqns); 410 kkey = kzalloc(klen, GFP_KERNEL); 411 if (!kkey) { 412 kfree(apqns); 413 return -ENOMEM; 414 } 415 rc = pkey_handler_gen_key(apqns, kgs.apqn_entries, 416 u, kgs.type, kgs.size, kgs.keygenflags, 417 kkey, &klen, NULL, 0); 418 pr_debug("gen_key()=%d\n", rc); 419 kfree(apqns); 420 if (rc) { 421 kfree_sensitive(kkey); 422 return rc; 423 } 424 if (kgs.key) { 425 if (kgs.keylen < klen) { 426 kfree_sensitive(kkey); 427 return -EINVAL; 428 } 429 if (copy_to_user(kgs.key, kkey, klen)) { 430 kfree_sensitive(kkey); 431 return -EFAULT; 432 } 433 } 434 kgs.keylen = klen; 435 if (copy_to_user(ugs, &kgs, sizeof(kgs))) 436 rc = -EFAULT; 437 kfree_sensitive(kkey); 438 439 return rc; 440 } 441 442 static int pkey_ioctl_clr2seck2(struct pkey_clr2seck2 __user *ucs) 443 { 444 u32 klen = KEYBLOBBUFSIZE; 445 struct pkey_clr2seck2 kcs; 446 struct pkey_apqn *apqns; 447 u8 *kkey; 448 int rc; 449 u32 u; 450 451 if (copy_from_user(&kcs, ucs, sizeof(kcs))) 452 return -EFAULT; 453 u = pkey_aes_bitsize_to_keytype(kcs.size); 454 if (!u) { 455 PKEY_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 456 __func__, kcs.size); 457 memzero_explicit(&kcs, sizeof(kcs)); 458 return -EINVAL; 459 } 460 apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries); 461 if (IS_ERR(apqns)) { 462 memzero_explicit(&kcs, sizeof(kcs)); 463 return PTR_ERR(apqns); 464 } 465 kkey = kzalloc(klen, GFP_KERNEL); 466 if (!kkey) { 467 kfree(apqns); 468 memzero_explicit(&kcs, sizeof(kcs)); 469 return -ENOMEM; 470 } 471 rc = pkey_handler_clr_to_key(apqns, kcs.apqn_entries, 472 u, kcs.type, kcs.size, kcs.keygenflags, 473 kcs.clrkey.clrkey, kcs.size / 8, 474 kkey, &klen, NULL, 0); 475 pr_debug("clr_to_key()=%d\n", rc); 476 kfree(apqns); 477 if (rc) { 478 kfree_sensitive(kkey); 479 memzero_explicit(&kcs, sizeof(kcs)); 480 return rc; 481 } 482 if (kcs.key) { 483 if (kcs.keylen < klen) { 484 kfree_sensitive(kkey); 485 memzero_explicit(&kcs, sizeof(kcs)); 486 return -EINVAL; 487 } 488 if (copy_to_user(kcs.key, kkey, klen)) { 489 kfree_sensitive(kkey); 490 memzero_explicit(&kcs, sizeof(kcs)); 491 return -EFAULT; 492 } 493 } 494 kcs.keylen = klen; 495 if (copy_to_user(ucs, &kcs, sizeof(kcs))) 496 rc = -EFAULT; 497 memzero_explicit(&kcs, sizeof(kcs)); 498 kfree_sensitive(kkey); 499 500 return rc; 501 } 502 503 static int pkey_ioctl_verifykey2(struct pkey_verifykey2 __user *uvk) 504 { 505 struct pkey_verifykey2 kvk; 506 u8 *kkey; 507 int rc; 508 509 if (copy_from_user(&kvk, uvk, sizeof(kvk))) 510 return -EFAULT; 511 kkey = _copy_key_from_user(kvk.key, kvk.keylen); 512 if (IS_ERR(kkey)) 513 return PTR_ERR(kkey); 514 515 rc = pkey_handler_verify_key(kkey, kvk.keylen, 516 &kvk.cardnr, &kvk.domain, 517 &kvk.type, &kvk.size, &kvk.flags, 0); 518 pr_debug("verify_key()=%d\n", rc); 519 520 kfree_sensitive(kkey); 521 if (!rc && copy_to_user(uvk, &kvk, sizeof(kvk))) 522 return -EFAULT; 523 524 return rc; 525 } 526 527 static int pkey_ioctl_kblob2protk2(struct pkey_kblob2pkey2 __user *utp) 528 { 529 struct pkey_apqn *apqns = NULL; 530 struct pkey_kblob2pkey2 ktp; 531 u8 *kkey; 532 int rc; 533 534 if (copy_from_user(&ktp, utp, sizeof(ktp))) 535 return -EFAULT; 536 apqns = _copy_apqns_from_user(ktp.apqns, ktp.apqn_entries); 537 if (IS_ERR(apqns)) 538 return PTR_ERR(apqns); 539 kkey = _copy_key_from_user(ktp.key, ktp.keylen); 540 if (IS_ERR(kkey)) { 541 kfree(apqns); 542 return PTR_ERR(kkey); 543 } 544 ktp.protkey.len = sizeof(ktp.protkey.protkey); 545 rc = key2protkey(apqns, ktp.apqn_entries, kkey, ktp.keylen, 546 ktp.protkey.protkey, &ktp.protkey.len, 547 &ktp.protkey.type, 0); 548 pr_debug("key2protkey()=%d\n", rc); 549 kfree(apqns); 550 kfree_sensitive(kkey); 551 if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) 552 rc = -EFAULT; 553 memzero_explicit(&ktp, sizeof(ktp)); 554 555 return rc; 556 } 557 558 static int pkey_ioctl_apqns4k(struct pkey_apqns4key __user *uak) 559 { 560 struct pkey_apqn *apqns = NULL; 561 struct pkey_apqns4key kak; 562 size_t nr_apqns, len; 563 u8 *kkey; 564 int rc; 565 566 if (copy_from_user(&kak, uak, sizeof(kak))) 567 return -EFAULT; 568 nr_apqns = kak.apqn_entries; 569 if (nr_apqns) { 570 apqns = kmalloc_objs(struct pkey_apqn, nr_apqns); 571 if (!apqns) 572 return -ENOMEM; 573 } 574 kkey = _copy_key_from_user(kak.key, kak.keylen); 575 if (IS_ERR(kkey)) { 576 kfree(apqns); 577 return PTR_ERR(kkey); 578 } 579 rc = pkey_handler_apqns_for_key(kkey, kak.keylen, kak.flags, 580 apqns, &nr_apqns, 0); 581 pr_debug("apqns_for_key()=%d\n", rc); 582 kfree_sensitive(kkey); 583 if (rc && rc != -ENOSPC) { 584 kfree(apqns); 585 return rc; 586 } 587 if (!rc && kak.apqns) { 588 if (nr_apqns > kak.apqn_entries) { 589 kfree(apqns); 590 return -EINVAL; 591 } 592 len = nr_apqns * sizeof(struct pkey_apqn); 593 if (len) { 594 if (copy_to_user(kak.apqns, apqns, len)) { 595 kfree(apqns); 596 return -EFAULT; 597 } 598 } 599 } 600 kak.apqn_entries = nr_apqns; 601 if (copy_to_user(uak, &kak, sizeof(kak))) 602 rc = -EFAULT; 603 kfree(apqns); 604 605 return rc; 606 } 607 608 static int pkey_ioctl_apqns4kt(struct pkey_apqns4keytype __user *uat) 609 { 610 struct pkey_apqn *apqns = NULL; 611 struct pkey_apqns4keytype kat; 612 size_t nr_apqns, len; 613 int rc; 614 615 if (copy_from_user(&kat, uat, sizeof(kat))) 616 return -EFAULT; 617 nr_apqns = kat.apqn_entries; 618 if (nr_apqns) { 619 apqns = kmalloc_objs(struct pkey_apqn, nr_apqns); 620 if (!apqns) 621 return -ENOMEM; 622 } 623 rc = pkey_handler_apqns_for_keytype(kat.type, 624 kat.cur_mkvp, kat.alt_mkvp, 625 kat.flags, apqns, &nr_apqns, 0); 626 pr_debug("apqns_for_keytype()=%d\n", rc); 627 if (rc && rc != -ENOSPC) { 628 kfree(apqns); 629 return rc; 630 } 631 if (!rc && kat.apqns) { 632 if (nr_apqns > kat.apqn_entries) { 633 kfree(apqns); 634 return -EINVAL; 635 } 636 len = nr_apqns * sizeof(struct pkey_apqn); 637 if (len) { 638 if (copy_to_user(kat.apqns, apqns, len)) { 639 kfree(apqns); 640 return -EFAULT; 641 } 642 } 643 } 644 kat.apqn_entries = nr_apqns; 645 if (copy_to_user(uat, &kat, sizeof(kat))) 646 rc = -EFAULT; 647 kfree(apqns); 648 649 return rc; 650 } 651 652 static int pkey_ioctl_kblob2protk3(struct pkey_kblob2pkey3 __user *utp) 653 { 654 u32 protkeylen = PROTKEYBLOBBUFSIZE; 655 struct pkey_apqn *apqns = NULL; 656 struct pkey_kblob2pkey3 ktp; 657 u8 *kkey, *protkey; 658 int rc; 659 660 if (copy_from_user(&ktp, utp, sizeof(ktp))) 661 return -EFAULT; 662 apqns = _copy_apqns_from_user(ktp.apqns, ktp.apqn_entries); 663 if (IS_ERR(apqns)) 664 return PTR_ERR(apqns); 665 kkey = _copy_key_from_user(ktp.key, ktp.keylen); 666 if (IS_ERR(kkey)) { 667 kfree(apqns); 668 return PTR_ERR(kkey); 669 } 670 protkey = kmalloc(protkeylen, GFP_KERNEL); 671 if (!protkey) { 672 kfree(apqns); 673 kfree_sensitive(kkey); 674 return -ENOMEM; 675 } 676 rc = key2protkey(apqns, ktp.apqn_entries, kkey, ktp.keylen, 677 protkey, &protkeylen, &ktp.pkeytype, 0); 678 pr_debug("key2protkey()=%d\n", rc); 679 kfree(apqns); 680 kfree_sensitive(kkey); 681 if (rc) { 682 kfree_sensitive(protkey); 683 return rc; 684 } 685 if (ktp.pkey && ktp.pkeylen) { 686 if (protkeylen > ktp.pkeylen) { 687 kfree_sensitive(protkey); 688 return -EINVAL; 689 } 690 if (copy_to_user(ktp.pkey, protkey, protkeylen)) { 691 kfree_sensitive(protkey); 692 return -EFAULT; 693 } 694 } 695 kfree_sensitive(protkey); 696 ktp.pkeylen = protkeylen; 697 if (copy_to_user(utp, &ktp, sizeof(ktp))) 698 return -EFAULT; 699 700 return 0; 701 } 702 703 static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, 704 unsigned long arg) 705 { 706 int rc; 707 708 switch (cmd) { 709 case PKEY_GENSECK: 710 rc = pkey_ioctl_genseck((struct pkey_genseck __user *)arg); 711 break; 712 case PKEY_CLR2SECK: 713 rc = pkey_ioctl_clr2seck((struct pkey_clr2seck __user *)arg); 714 break; 715 case PKEY_SEC2PROTK: 716 rc = pkey_ioctl_sec2protk((struct pkey_sec2protk __user *)arg); 717 break; 718 case PKEY_CLR2PROTK: 719 rc = pkey_ioctl_clr2protk((struct pkey_clr2protk __user *)arg); 720 break; 721 case PKEY_FINDCARD: 722 rc = pkey_ioctl_findcard((struct pkey_findcard __user *)arg); 723 break; 724 case PKEY_SKEY2PKEY: 725 rc = pkey_ioctl_skey2pkey((struct pkey_skey2pkey __user *)arg); 726 break; 727 case PKEY_VERIFYKEY: 728 rc = pkey_ioctl_verifykey((struct pkey_verifykey __user *)arg); 729 break; 730 case PKEY_GENPROTK: 731 rc = pkey_ioctl_genprotk((struct pkey_genprotk __user *)arg); 732 break; 733 case PKEY_VERIFYPROTK: 734 rc = pkey_ioctl_verifyprotk((struct pkey_verifyprotk __user *)arg); 735 break; 736 case PKEY_KBLOB2PROTK: 737 rc = pkey_ioctl_kblob2protk((struct pkey_kblob2pkey __user *)arg); 738 break; 739 case PKEY_GENSECK2: 740 rc = pkey_ioctl_genseck2((struct pkey_genseck2 __user *)arg); 741 break; 742 case PKEY_CLR2SECK2: 743 rc = pkey_ioctl_clr2seck2((struct pkey_clr2seck2 __user *)arg); 744 break; 745 case PKEY_VERIFYKEY2: 746 rc = pkey_ioctl_verifykey2((struct pkey_verifykey2 __user *)arg); 747 break; 748 case PKEY_KBLOB2PROTK2: 749 rc = pkey_ioctl_kblob2protk2((struct pkey_kblob2pkey2 __user *)arg); 750 break; 751 case PKEY_APQNS4K: 752 rc = pkey_ioctl_apqns4k((struct pkey_apqns4key __user *)arg); 753 break; 754 case PKEY_APQNS4KT: 755 rc = pkey_ioctl_apqns4kt((struct pkey_apqns4keytype __user *)arg); 756 break; 757 case PKEY_KBLOB2PROTK3: 758 rc = pkey_ioctl_kblob2protk3((struct pkey_kblob2pkey3 __user *)arg); 759 break; 760 default: 761 /* unknown/unsupported ioctl cmd */ 762 return -ENOTTY; 763 } 764 765 return rc; 766 } 767 768 /* 769 * File io operations 770 */ 771 772 static const struct file_operations pkey_fops = { 773 .owner = THIS_MODULE, 774 .open = nonseekable_open, 775 .unlocked_ioctl = pkey_unlocked_ioctl, 776 }; 777 778 static struct miscdevice pkey_dev = { 779 .name = "pkey", 780 .minor = MISC_DYNAMIC_MINOR, 781 .mode = 0666, 782 .fops = &pkey_fops, 783 .groups = pkey_attr_groups, 784 }; 785 786 int __init pkey_api_init(void) 787 { 788 /* register as a misc device */ 789 return misc_register(&pkey_dev); 790 } 791 792 void __exit pkey_api_exit(void) 793 { 794 misc_deregister(&pkey_dev); 795 } 796