1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright IBM Corp. 2019 4 * Author(s): Harald Freudenberger <freude@linux.ibm.com> 5 * Ingo Franzki <ifranzki@linux.ibm.com> 6 * 7 * Collection of CCA misc functions used by zcrypt and pkey 8 */ 9 10 #define pr_fmt(fmt) "zcrypt: " fmt 11 12 #include <linux/export.h> 13 #include <linux/init.h> 14 #include <linux/mempool.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/random.h> 18 #include <asm/zcrypt.h> 19 #include <asm/pkey.h> 20 21 #include "ap_bus.h" 22 #include "zcrypt_api.h" 23 #include "zcrypt_debug.h" 24 #include "zcrypt_msgtype6.h" 25 #include "zcrypt_ccamisc.h" 26 27 /* Size of parameter block used for all cca requests/replies */ 28 #define PARMBSIZE 512 29 30 /* Size of vardata block used for some of the cca requests/replies */ 31 #define VARDATASIZE 4096 32 33 /* 34 * Cprb memory pool held for urgent cases where no memory 35 * can be allocated via kmalloc. This pool is only used 36 * when alloc_and_prep_cprbmem() is called with the xflag 37 * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold 38 * space for request AND reply! 39 */ 40 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024) 41 static mempool_t *cprb_mempool; 42 43 /* 44 * This is a pre-allocated memory for the device status array 45 * used within the findcard() functions. It is currently 46 * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is 47 * controlled via dev_status_mem_mutex. Needs adaption if more 48 * than 128 cards or domains to be are supported. 49 */ 50 #define ZCRYPT_DEV_STATUS_CARD_MAX 128 51 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128 52 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \ 53 ZCRYPT_DEV_STATUS_QUEUE_MAX) 54 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \ 55 sizeof(struct zcrypt_device_status_ext)) 56 static void *dev_status_mem; 57 static DEFINE_MUTEX(dev_status_mem_mutex); 58 59 /* 60 * Simple check if the token is a valid CCA secure AES data key 61 * token. If keybitsize is given, the bitsize of the key is 62 * also checked. Returns 0 on success or errno value on failure. 63 */ 64 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl, 65 const u8 *token, u32 keysize, int keybitsize) 66 { 67 struct secaeskeytoken *t = (struct secaeskeytoken *)token; 68 69 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 70 71 if (keysize < sizeof(*t)) { 72 if (dbg) 73 DBF("%s keysize %u < min token size %zu\n", 74 __func__, keysize, sizeof(*t)); 75 return -EINVAL; 76 } 77 if (t->type != TOKTYPE_CCA_INTERNAL) { 78 if (dbg) 79 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 80 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 81 return -EINVAL; 82 } 83 if (t->version != TOKVER_CCA_AES) { 84 if (dbg) 85 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 86 __func__, (int)t->version, TOKVER_CCA_AES); 87 return -EINVAL; 88 } 89 if (keybitsize > 0 && t->bitsize != keybitsize) { 90 if (dbg) 91 DBF("%s token check failed, bitsize %d != %d\n", 92 __func__, (int)t->bitsize, keybitsize); 93 return -EINVAL; 94 } 95 96 #undef DBF 97 98 return 0; 99 } 100 EXPORT_SYMBOL(cca_check_secaeskeytoken); 101 102 /* 103 * Simple check if the token is a valid CCA secure AES cipher key 104 * token. If keybitsize is given, the bitsize of the key is 105 * also checked. If checkcpacfexport is enabled, the key is also 106 * checked for the export flag to allow CPACF export. 107 * Returns 0 on success or errno value on failure. 108 */ 109 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl, 110 const u8 *token, u32 keysize, 111 int keybitsize, int checkcpacfexport) 112 { 113 struct cipherkeytoken *t = (struct cipherkeytoken *)token; 114 bool keybitsizeok = true; 115 116 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 117 118 if (keysize < sizeof(*t)) { 119 if (dbg) 120 DBF("%s keysize %u < min token size %zu\n", 121 __func__, keysize, sizeof(*t)); 122 return -EINVAL; 123 } 124 if (t->type != TOKTYPE_CCA_INTERNAL) { 125 if (dbg) 126 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 127 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 128 return -EINVAL; 129 } 130 if (t->version != TOKVER_CCA_VLSC) { 131 if (dbg) 132 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 133 __func__, (int)t->version, TOKVER_CCA_VLSC); 134 return -EINVAL; 135 } 136 if (t->len > keysize) { 137 if (dbg) 138 DBF("%s token check failed, len %d > keysize %u\n", 139 __func__, (int)t->len, keysize); 140 return -EINVAL; 141 } 142 if (t->len < sizeof(*t)) { 143 if (dbg) 144 DBF("%s token check failed, len %d < min token size %zu\n", 145 __func__, (int)t->len, sizeof(*t)); 146 return -EINVAL; 147 } 148 if (t->algtype != 0x02) { 149 if (dbg) 150 DBF("%s token check failed, algtype 0x%02x != 0x02\n", 151 __func__, (int)t->algtype); 152 return -EINVAL; 153 } 154 if (t->keytype != 0x0001) { 155 if (dbg) 156 DBF("%s token check failed, keytype 0x%04x != 0x0001\n", 157 __func__, (int)t->keytype); 158 return -EINVAL; 159 } 160 if (t->plfver != 0x00 && t->plfver != 0x01) { 161 if (dbg) 162 DBF("%s token check failed, unknown plfver 0x%02x\n", 163 __func__, (int)t->plfver); 164 return -EINVAL; 165 } 166 if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) { 167 if (dbg) 168 DBF("%s token check failed, unknown wpllen %d\n", 169 __func__, (int)t->wpllen); 170 return -EINVAL; 171 } 172 if (keybitsize > 0) { 173 switch (keybitsize) { 174 case 128: 175 if (t->wpllen != (t->plfver ? 640 : 512)) 176 keybitsizeok = false; 177 break; 178 case 192: 179 if (t->wpllen != (t->plfver ? 640 : 576)) 180 keybitsizeok = false; 181 break; 182 case 256: 183 if (t->wpllen != 640) 184 keybitsizeok = false; 185 break; 186 default: 187 keybitsizeok = false; 188 break; 189 } 190 if (!keybitsizeok) { 191 if (dbg) 192 DBF("%s token check failed, bitsize %d\n", 193 __func__, keybitsize); 194 return -EINVAL; 195 } 196 } 197 if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) { 198 if (dbg) 199 DBF("%s token check failed, XPRT_CPAC bit is 0\n", 200 __func__); 201 return -EINVAL; 202 } 203 204 #undef DBF 205 206 return 0; 207 } 208 EXPORT_SYMBOL(cca_check_secaescipherkey); 209 210 /* 211 * Simple check if the token is a valid CCA secure ECC private 212 * key token. Returns 0 on success or errno value on failure. 213 */ 214 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl, 215 const u8 *token, u32 keysize, 216 int checkcpacfexport) 217 { 218 struct eccprivkeytoken *t = (struct eccprivkeytoken *)token; 219 220 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 221 222 if (keysize < sizeof(*t)) { 223 if (dbg) 224 DBF("%s keysize %u < min token size %zu\n", 225 __func__, keysize, sizeof(*t)); 226 return -EINVAL; 227 } 228 if (t->type != TOKTYPE_CCA_INTERNAL_PKA) { 229 if (dbg) 230 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 231 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA); 232 return -EINVAL; 233 } 234 if (t->len > keysize) { 235 if (dbg) 236 DBF("%s token check failed, len %d > keysize %u\n", 237 __func__, (int)t->len, keysize); 238 return -EINVAL; 239 } 240 if (t->len < sizeof(*t)) { 241 if (dbg) 242 DBF("%s token check failed, len %d < min token size %zu\n", 243 __func__, (int)t->len, sizeof(*t)); 244 return -EINVAL; 245 } 246 if (t->secid != 0x20) { 247 if (dbg) 248 DBF("%s token check failed, secid 0x%02x != 0x20\n", 249 __func__, (int)t->secid); 250 return -EINVAL; 251 } 252 if (checkcpacfexport && !(t->kutc & 0x01)) { 253 if (dbg) 254 DBF("%s token check failed, XPRTCPAC bit is 0\n", 255 __func__); 256 return -EINVAL; 257 } 258 259 #undef DBF 260 261 return 0; 262 } 263 EXPORT_SYMBOL(cca_check_sececckeytoken); 264 265 /* 266 * Allocate consecutive memory for request CPRB, request param 267 * block, reply CPRB and reply param block and fill in values 268 * for the common fields. Returns 0 on success or errno value 269 * on failure. 270 */ 271 static int alloc_and_prep_cprbmem(size_t paramblen, 272 u8 **p_cprb_mem, 273 struct CPRBX **p_req_cprb, 274 struct CPRBX **p_rep_cprb, 275 u32 xflags) 276 { 277 u8 *cprbmem = NULL; 278 size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen; 279 size_t len = 2 * cprbplusparamblen; 280 struct CPRBX *preqcblk, *prepcblk; 281 282 /* 283 * allocate consecutive memory for request CPRB, request param 284 * block, reply CPRB and reply param block 285 */ 286 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) { 287 if (len <= CPRB_MEMPOOL_ITEM_SIZE) 288 cprbmem = mempool_alloc_preallocated(cprb_mempool); 289 } else { 290 cprbmem = kmalloc(len, GFP_KERNEL); 291 } 292 if (!cprbmem) 293 return -ENOMEM; 294 memset(cprbmem, 0, len); 295 296 preqcblk = (struct CPRBX *)cprbmem; 297 prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen); 298 299 /* fill request cprb struct */ 300 preqcblk->cprb_len = sizeof(struct CPRBX); 301 preqcblk->cprb_ver_id = 0x02; 302 memcpy(preqcblk->func_id, "T2", 2); 303 preqcblk->rpl_msgbl = cprbplusparamblen; 304 if (paramblen) { 305 preqcblk->req_parmb = 306 ((u8 __user *)preqcblk) + sizeof(struct CPRBX); 307 preqcblk->rpl_parmb = 308 ((u8 __user *)prepcblk) + sizeof(struct CPRBX); 309 } 310 311 *p_cprb_mem = cprbmem; 312 *p_req_cprb = preqcblk; 313 *p_rep_cprb = prepcblk; 314 315 return 0; 316 } 317 318 /* 319 * Free the cprb memory allocated with the function above. 320 * If the scrub value is not zero, the memory is filled 321 * with zeros before freeing (useful if there was some 322 * clear key material in there). 323 */ 324 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags) 325 { 326 if (mem && scrub) 327 memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen)); 328 329 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) 330 mempool_free(mem, cprb_mempool); 331 else 332 kfree(mem); 333 } 334 335 /* 336 * Helper function to prepare the xcrb struct 337 */ 338 static inline void prep_xcrb(struct ica_xcRB *pxcrb, 339 u16 cardnr, 340 struct CPRBX *preqcblk, 341 struct CPRBX *prepcblk) 342 { 343 memset(pxcrb, 0, sizeof(*pxcrb)); 344 memcpy(&pxcrb->agent_ID, "CA", 2); 345 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr); 346 pxcrb->request_control_blk_length = 347 preqcblk->cprb_len + preqcblk->req_parml; 348 pxcrb->request_control_blk_addr = (void __user *)preqcblk; 349 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl; 350 pxcrb->reply_control_blk_addr = (void __user *)prepcblk; 351 } 352 353 /* 354 * Generate (random) CCA AES DATA secure key. 355 */ 356 int cca_genseckey(u16 cardnr, u16 domain, 357 u32 keybitsize, u8 *seckey, u32 xflags) 358 { 359 int i, rc, keysize; 360 int seckeysize; 361 u8 *mem, *ptr; 362 struct CPRBX *preqcblk, *prepcblk; 363 struct ica_xcRB xcrb; 364 struct kgreqparm { 365 u8 subfunc_code[2]; 366 u16 rule_array_len; 367 struct lv1 { 368 u16 len; 369 char key_form[8]; 370 char key_length[8]; 371 char key_type1[8]; 372 char key_type2[8]; 373 } lv1; 374 struct lv2 { 375 u16 len; 376 struct keyid { 377 u16 len; 378 u16 attr; 379 u8 data[SECKEYBLOBSIZE]; 380 } keyid[6]; 381 } lv2; 382 } __packed * preqparm; 383 struct kgrepparm { 384 u8 subfunc_code[2]; 385 u16 rule_array_len; 386 struct lv3 { 387 u16 len; 388 u16 keyblocklen; 389 struct { 390 u16 toklen; 391 u16 tokattr; 392 u8 tok[]; 393 /* ... some more data ... */ 394 } keyblock; 395 } lv3; 396 } __packed * prepparm; 397 398 /* get already prepared memory for 2 cprbs with param block each */ 399 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 400 &preqcblk, &prepcblk, xflags); 401 if (rc) 402 return rc; 403 404 /* fill request cprb struct */ 405 preqcblk->domain = domain; 406 407 /* fill request cprb param block with KG request */ 408 preqparm = (struct kgreqparm __force *)preqcblk->req_parmb; 409 memcpy(preqparm->subfunc_code, "KG", 2); 410 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 411 preqparm->lv1.len = sizeof(struct lv1); 412 memcpy(preqparm->lv1.key_form, "OP ", 8); 413 switch (keybitsize) { 414 case PKEY_SIZE_AES_128: 415 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 416 keysize = 16; 417 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8); 418 break; 419 case PKEY_SIZE_AES_192: 420 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 421 keysize = 24; 422 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8); 423 break; 424 case PKEY_SIZE_AES_256: 425 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 426 keysize = 32; 427 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8); 428 break; 429 default: 430 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 431 __func__, keybitsize); 432 rc = -EINVAL; 433 goto out; 434 } 435 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8); 436 preqparm->lv2.len = sizeof(struct lv2); 437 for (i = 0; i < 6; i++) { 438 preqparm->lv2.keyid[i].len = sizeof(struct keyid); 439 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10); 440 } 441 preqcblk->req_parml = sizeof(struct kgreqparm); 442 443 /* fill xcrb struct */ 444 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 445 446 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 447 rc = zcrypt_send_cprb(&xcrb, xflags); 448 if (rc) { 449 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n", 450 __func__, (int)cardnr, (int)domain, rc); 451 goto out; 452 } 453 454 /* check response returncode and reasoncode */ 455 if (prepcblk->ccp_rtcode != 0) { 456 ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n", 457 __func__, 458 (int)prepcblk->ccp_rtcode, 459 (int)prepcblk->ccp_rscode); 460 rc = -EIO; 461 goto out; 462 } 463 464 /* process response cprb param block */ 465 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 466 prepcblk->rpl_parmb = (u8 __user *)ptr; 467 prepparm = (struct kgrepparm *)ptr; 468 469 /* check length of the returned secure key token */ 470 seckeysize = prepparm->lv3.keyblock.toklen 471 - sizeof(prepparm->lv3.keyblock.toklen) 472 - sizeof(prepparm->lv3.keyblock.tokattr); 473 if (seckeysize != SECKEYBLOBSIZE) { 474 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 475 __func__, seckeysize, SECKEYBLOBSIZE); 476 rc = -EIO; 477 goto out; 478 } 479 480 /* check secure key token */ 481 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 482 prepparm->lv3.keyblock.tok, 483 seckeysize, 8 * keysize); 484 if (rc) { 485 rc = -EIO; 486 goto out; 487 } 488 489 /* copy the generated secure key token */ 490 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 491 492 out: 493 free_cprbmem(mem, PARMBSIZE, false, xflags); 494 return rc; 495 } 496 EXPORT_SYMBOL(cca_genseckey); 497 498 /* 499 * Generate an CCA AES DATA secure key with given key value. 500 */ 501 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize, 502 const u8 *clrkey, u8 *seckey, u32 xflags) 503 { 504 int rc, keysize, seckeysize; 505 u8 *mem, *ptr; 506 struct CPRBX *preqcblk, *prepcblk; 507 struct ica_xcRB xcrb; 508 struct cmreqparm { 509 u8 subfunc_code[2]; 510 u16 rule_array_len; 511 char rule_array[8]; 512 struct lv1 { 513 u16 len; 514 u8 clrkey[]; 515 } lv1; 516 /* followed by struct lv2 */ 517 } __packed * preqparm; 518 struct lv2 { 519 u16 len; 520 struct keyid { 521 u16 len; 522 u16 attr; 523 u8 data[SECKEYBLOBSIZE]; 524 } keyid; 525 } __packed * plv2; 526 struct cmrepparm { 527 u8 subfunc_code[2]; 528 u16 rule_array_len; 529 struct lv3 { 530 u16 len; 531 u16 keyblocklen; 532 struct { 533 u16 toklen; 534 u16 tokattr; 535 u8 tok[]; 536 /* ... some more data ... */ 537 } keyblock; 538 } lv3; 539 } __packed * prepparm; 540 541 /* get already prepared memory for 2 cprbs with param block each */ 542 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 543 &preqcblk, &prepcblk, xflags); 544 if (rc) 545 return rc; 546 547 /* fill request cprb struct */ 548 preqcblk->domain = domain; 549 550 /* fill request cprb param block with CM request */ 551 preqparm = (struct cmreqparm __force *)preqcblk->req_parmb; 552 memcpy(preqparm->subfunc_code, "CM", 2); 553 memcpy(preqparm->rule_array, "AES ", 8); 554 preqparm->rule_array_len = 555 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 556 switch (keybitsize) { 557 case PKEY_SIZE_AES_128: 558 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 559 keysize = 16; 560 break; 561 case PKEY_SIZE_AES_192: 562 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 563 keysize = 24; 564 break; 565 case PKEY_SIZE_AES_256: 566 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 567 keysize = 32; 568 break; 569 default: 570 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 571 __func__, keybitsize); 572 rc = -EINVAL; 573 goto out; 574 } 575 preqparm->lv1.len = sizeof(struct lv1) + keysize; 576 memcpy(preqparm->lv1.clrkey, clrkey, keysize); 577 plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize); 578 plv2->len = sizeof(struct lv2); 579 plv2->keyid.len = sizeof(struct keyid); 580 plv2->keyid.attr = 0x30; 581 preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2); 582 583 /* fill xcrb struct */ 584 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 585 586 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 587 rc = zcrypt_send_cprb(&xcrb, xflags); 588 if (rc) { 589 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 590 __func__, (int)cardnr, (int)domain, rc); 591 goto out; 592 } 593 594 /* check response returncode and reasoncode */ 595 if (prepcblk->ccp_rtcode != 0) { 596 ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n", 597 __func__, 598 (int)prepcblk->ccp_rtcode, 599 (int)prepcblk->ccp_rscode); 600 rc = -EIO; 601 goto out; 602 } 603 604 /* process response cprb param block */ 605 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 606 prepcblk->rpl_parmb = (u8 __user *)ptr; 607 prepparm = (struct cmrepparm *)ptr; 608 609 /* check length of the returned secure key token */ 610 seckeysize = prepparm->lv3.keyblock.toklen 611 - sizeof(prepparm->lv3.keyblock.toklen) 612 - sizeof(prepparm->lv3.keyblock.tokattr); 613 if (seckeysize != SECKEYBLOBSIZE) { 614 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 615 __func__, seckeysize, SECKEYBLOBSIZE); 616 rc = -EIO; 617 goto out; 618 } 619 620 /* check secure key token */ 621 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 622 prepparm->lv3.keyblock.tok, 623 seckeysize, 8 * keysize); 624 if (rc) { 625 rc = -EIO; 626 goto out; 627 } 628 629 /* copy the generated secure key token */ 630 if (seckey) 631 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 632 633 out: 634 free_cprbmem(mem, PARMBSIZE, true, xflags); 635 return rc; 636 } 637 EXPORT_SYMBOL(cca_clr2seckey); 638 639 /* 640 * Derive proteced key from an CCA AES DATA secure key. 641 */ 642 int cca_sec2protkey(u16 cardnr, u16 domain, 643 const u8 *seckey, u8 *protkey, u32 *protkeylen, 644 u32 *protkeytype, u32 xflags) 645 { 646 int rc; 647 u8 *mem, *ptr; 648 struct CPRBX *preqcblk, *prepcblk; 649 struct ica_xcRB xcrb; 650 struct uskreqparm { 651 u8 subfunc_code[2]; 652 u16 rule_array_len; 653 struct lv1 { 654 u16 len; 655 u16 attr_len; 656 u16 attr_flags; 657 } lv1; 658 struct lv2 { 659 u16 len; 660 u16 attr_len; 661 u16 attr_flags; 662 u8 token[]; /* cca secure key token */ 663 } lv2; 664 } __packed * preqparm; 665 struct uskrepparm { 666 u8 subfunc_code[2]; 667 u16 rule_array_len; 668 struct lv3 { 669 u16 len; 670 u16 attr_len; 671 u16 attr_flags; 672 struct cpacfkeyblock { 673 u8 version; /* version of this struct */ 674 u8 flags[2]; 675 u8 algo; 676 u8 form; 677 u8 pad1[3]; 678 u16 len; 679 u8 key[64]; /* the key (len bytes) */ 680 u16 keyattrlen; 681 u8 keyattr[32]; 682 u8 pad2[1]; 683 u8 vptype; 684 u8 vp[32]; /* verification pattern */ 685 } ckb; 686 } lv3; 687 } __packed * prepparm; 688 689 /* get already prepared memory for 2 cprbs with param block each */ 690 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 691 &preqcblk, &prepcblk, xflags); 692 if (rc) 693 return rc; 694 695 /* fill request cprb struct */ 696 preqcblk->domain = domain; 697 698 /* fill request cprb param block with USK request */ 699 preqparm = (struct uskreqparm __force *)preqcblk->req_parmb; 700 memcpy(preqparm->subfunc_code, "US", 2); 701 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 702 preqparm->lv1.len = sizeof(struct lv1); 703 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len); 704 preqparm->lv1.attr_flags = 0x0001; 705 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE; 706 preqparm->lv2.attr_len = sizeof(struct lv2) 707 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE; 708 preqparm->lv2.attr_flags = 0x0000; 709 memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE); 710 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE; 711 712 /* fill xcrb struct */ 713 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 714 715 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 716 rc = zcrypt_send_cprb(&xcrb, xflags); 717 if (rc) { 718 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 719 __func__, (int)cardnr, (int)domain, rc); 720 goto out; 721 } 722 723 /* check response returncode and reasoncode */ 724 if (prepcblk->ccp_rtcode != 0) { 725 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 726 __func__, 727 (int)prepcblk->ccp_rtcode, 728 (int)prepcblk->ccp_rscode); 729 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 730 rc = -EBUSY; 731 else 732 rc = -EIO; 733 goto out; 734 } 735 if (prepcblk->ccp_rscode != 0) { 736 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 737 __func__, 738 (int)prepcblk->ccp_rtcode, 739 (int)prepcblk->ccp_rscode); 740 } 741 742 /* process response cprb param block */ 743 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 744 prepcblk->rpl_parmb = (u8 __user *)ptr; 745 prepparm = (struct uskrepparm *)ptr; 746 747 /* check the returned keyblock */ 748 if (prepparm->lv3.ckb.version != 0x01 && 749 prepparm->lv3.ckb.version != 0x02) { 750 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 751 __func__, (int)prepparm->lv3.ckb.version); 752 rc = -EIO; 753 goto out; 754 } 755 756 /* copy the translated protected key */ 757 switch (prepparm->lv3.ckb.len) { 758 case 16 + 32: 759 /* AES 128 protected key */ 760 if (protkeytype) 761 *protkeytype = PKEY_KEYTYPE_AES_128; 762 break; 763 case 24 + 32: 764 /* AES 192 protected key */ 765 if (protkeytype) 766 *protkeytype = PKEY_KEYTYPE_AES_192; 767 break; 768 case 32 + 32: 769 /* AES 256 protected key */ 770 if (protkeytype) 771 *protkeytype = PKEY_KEYTYPE_AES_256; 772 break; 773 default: 774 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 775 __func__, prepparm->lv3.ckb.len); 776 rc = -EIO; 777 goto out; 778 } 779 memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len); 780 if (protkeylen) 781 *protkeylen = prepparm->lv3.ckb.len; 782 783 out: 784 free_cprbmem(mem, PARMBSIZE, true, xflags); 785 return rc; 786 } 787 EXPORT_SYMBOL(cca_sec2protkey); 788 789 /* 790 * AES cipher key skeleton created with CSNBKTB2 with these flags: 791 * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY, 792 * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA 793 * used by cca_gencipherkey() and cca_clr2cipherkey(). 794 */ 795 static const u8 aes_cipher_key_skeleton[] = { 796 0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00, 797 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 798 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 799 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 800 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 801 0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff, 802 0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 }; 803 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton)) 804 805 /* 806 * Generate (random) CCA AES CIPHER secure key. 807 */ 808 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags, 809 u8 *keybuf, u32 *keybufsize, u32 xflags) 810 { 811 int rc; 812 u8 *mem, *ptr; 813 struct CPRBX *preqcblk, *prepcblk; 814 struct ica_xcRB xcrb; 815 struct gkreqparm { 816 u8 subfunc_code[2]; 817 u16 rule_array_len; 818 char rule_array[2 * 8]; 819 struct { 820 u16 len; 821 u8 key_type_1[8]; 822 u8 key_type_2[8]; 823 u16 clear_key_bit_len; 824 u16 key_name_1_len; 825 u16 key_name_2_len; 826 u16 user_data_1_len; 827 u16 user_data_2_len; 828 /* u8 key_name_1[]; */ 829 /* u8 key_name_2[]; */ 830 /* u8 user_data_1[]; */ 831 /* u8 user_data_2[]; */ 832 } vud; 833 struct { 834 u16 len; 835 struct { 836 u16 len; 837 u16 flag; 838 /* u8 kek_id_1[]; */ 839 } tlv1; 840 struct { 841 u16 len; 842 u16 flag; 843 /* u8 kek_id_2[]; */ 844 } tlv2; 845 struct { 846 u16 len; 847 u16 flag; 848 u8 gen_key_id_1[SIZEOF_SKELETON]; 849 } tlv3; 850 struct { 851 u16 len; 852 u16 flag; 853 /* u8 gen_key_id_1_label[]; */ 854 } tlv4; 855 struct { 856 u16 len; 857 u16 flag; 858 /* u8 gen_key_id_2[]; */ 859 } tlv5; 860 struct { 861 u16 len; 862 u16 flag; 863 /* u8 gen_key_id_2_label[]; */ 864 } tlv6; 865 } kb; 866 } __packed * preqparm; 867 struct gkrepparm { 868 u8 subfunc_code[2]; 869 u16 rule_array_len; 870 struct { 871 u16 len; 872 } vud; 873 struct { 874 u16 len; 875 struct { 876 u16 len; 877 u16 flag; 878 u8 gen_key[]; /* 120-136 bytes */ 879 } tlv1; 880 } kb; 881 } __packed * prepparm; 882 struct cipherkeytoken *t; 883 u32 keybuflen; 884 885 /* get already prepared memory for 2 cprbs with param block each */ 886 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 887 &preqcblk, &prepcblk, xflags); 888 if (rc) 889 return rc; 890 891 /* fill request cprb struct */ 892 preqcblk->domain = domain; 893 preqcblk->req_parml = sizeof(struct gkreqparm); 894 895 /* prepare request param block with GK request */ 896 preqparm = (struct gkreqparm __force *)preqcblk->req_parmb; 897 memcpy(preqparm->subfunc_code, "GK", 2); 898 preqparm->rule_array_len = sizeof(uint16_t) + 2 * 8; 899 memcpy(preqparm->rule_array, "AES OP ", 2 * 8); 900 901 /* prepare vud block */ 902 preqparm->vud.len = sizeof(preqparm->vud); 903 switch (keybitsize) { 904 case 128: 905 case 192: 906 case 256: 907 break; 908 default: 909 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 910 __func__, keybitsize); 911 rc = -EINVAL; 912 goto out; 913 } 914 preqparm->vud.clear_key_bit_len = keybitsize; 915 memcpy(preqparm->vud.key_type_1, "TOKEN ", 8); 916 memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2)); 917 918 /* prepare kb block */ 919 preqparm->kb.len = sizeof(preqparm->kb); 920 preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1); 921 preqparm->kb.tlv1.flag = 0x0030; 922 preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2); 923 preqparm->kb.tlv2.flag = 0x0030; 924 preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3); 925 preqparm->kb.tlv3.flag = 0x0030; 926 memcpy(preqparm->kb.tlv3.gen_key_id_1, 927 aes_cipher_key_skeleton, SIZEOF_SKELETON); 928 preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4); 929 preqparm->kb.tlv4.flag = 0x0030; 930 preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5); 931 preqparm->kb.tlv5.flag = 0x0030; 932 preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6); 933 preqparm->kb.tlv6.flag = 0x0030; 934 935 /* patch the skeleton key token export flags inside the kb block */ 936 if (keygenflags) { 937 t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1; 938 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 939 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 940 } 941 942 /* prepare xcrb struct */ 943 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 944 945 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 946 rc = zcrypt_send_cprb(&xcrb, xflags); 947 if (rc) { 948 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 949 __func__, (int)cardnr, (int)domain, rc); 950 goto out; 951 } 952 953 /* check response returncode and reasoncode */ 954 if (prepcblk->ccp_rtcode != 0) { 955 ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n", 956 __func__, 957 (int)prepcblk->ccp_rtcode, 958 (int)prepcblk->ccp_rscode); 959 rc = -EIO; 960 goto out; 961 } 962 963 /* process response cprb param block */ 964 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 965 prepcblk->rpl_parmb = (u8 __user *)ptr; 966 prepparm = (struct gkrepparm *)ptr; 967 968 /* do some plausibility checks on the key block */ 969 if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) || 970 prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) { 971 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 972 __func__); 973 rc = -EIO; 974 goto out; 975 } 976 977 /* and some checks on the generated key */ 978 t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key; 979 if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) { 980 rc = -EIO; 981 goto out; 982 } 983 keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t); 984 rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR, 985 prepparm->kb.tlv1.gen_key, 986 keybuflen, keybitsize, 1); 987 if (rc) { 988 rc = -EIO; 989 goto out; 990 } 991 992 /* copy the generated vlsc key token */ 993 if (keybuf) { 994 if (*keybufsize >= keybuflen) 995 memcpy(keybuf, t, keybuflen); 996 else 997 rc = -EINVAL; 998 } 999 *keybufsize = keybuflen; 1000 1001 out: 1002 free_cprbmem(mem, PARMBSIZE, false, xflags); 1003 return rc; 1004 } 1005 EXPORT_SYMBOL(cca_gencipherkey); 1006 1007 /* 1008 * Helper function, does a the CSNBKPI2 CPRB. 1009 */ 1010 static int _ip_cprb_helper(u16 cardnr, u16 domain, 1011 const char *rule_array_1, 1012 const char *rule_array_2, 1013 const char *rule_array_3, 1014 const u8 *clr_key_value, 1015 int clr_key_bit_size, 1016 u8 *key_token, 1017 int *key_token_size, 1018 u32 xflags, 1019 bool scrub) 1020 { 1021 int rc, n; 1022 u8 *mem, *ptr; 1023 struct CPRBX *preqcblk, *prepcblk; 1024 struct ica_xcRB xcrb; 1025 struct rule_array_block { 1026 u8 subfunc_code[2]; 1027 u16 rule_array_len; 1028 char rule_array[]; 1029 } __packed * preq_ra_block; 1030 struct vud_block { 1031 u16 len; 1032 struct { 1033 u16 len; 1034 u16 flag; /* 0x0064 */ 1035 u16 clr_key_bit_len; 1036 } tlv1; 1037 struct { 1038 u16 len; 1039 u16 flag; /* 0x0063 */ 1040 u8 clr_key[]; /* clear key value bytes */ 1041 } tlv2; 1042 } __packed * preq_vud_block; 1043 struct key_block { 1044 u16 len; 1045 struct { 1046 u16 len; 1047 u16 flag; /* 0x0030 */ 1048 u8 key_token[]; /* key skeleton */ 1049 } tlv1; 1050 } __packed * preq_key_block; 1051 struct iprepparm { 1052 u8 subfunc_code[2]; 1053 u16 rule_array_len; 1054 struct { 1055 u16 len; 1056 } vud; 1057 struct { 1058 u16 len; 1059 struct { 1060 u16 len; 1061 u16 flag; /* 0x0030 */ 1062 u8 key_token[]; /* key token */ 1063 } tlv1; 1064 } kb; 1065 } __packed * prepparm; 1066 struct cipherkeytoken *t; 1067 int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1; 1068 1069 /* get already prepared memory for 2 cprbs with param block each */ 1070 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1071 &preqcblk, &prepcblk, xflags); 1072 if (rc) 1073 return rc; 1074 1075 /* fill request cprb struct */ 1076 preqcblk->domain = domain; 1077 preqcblk->req_parml = 0; 1078 1079 /* prepare request param block with IP request */ 1080 preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb; 1081 memcpy(preq_ra_block->subfunc_code, "IP", 2); 1082 preq_ra_block->rule_array_len = sizeof(uint16_t) + 2 * 8; 1083 memcpy(preq_ra_block->rule_array, rule_array_1, 8); 1084 memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8); 1085 preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8; 1086 if (rule_array_3) { 1087 preq_ra_block->rule_array_len += 8; 1088 memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8); 1089 preqcblk->req_parml += 8; 1090 } 1091 1092 /* prepare vud block */ 1093 preq_vud_block = (struct vud_block __force *) 1094 (preqcblk->req_parmb + preqcblk->req_parml); 1095 n = complete ? 0 : (clr_key_bit_size + 7) / 8; 1096 preq_vud_block->len = sizeof(struct vud_block) + n; 1097 preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1); 1098 preq_vud_block->tlv1.flag = 0x0064; 1099 preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size; 1100 preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n; 1101 preq_vud_block->tlv2.flag = 0x0063; 1102 if (!complete) 1103 memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n); 1104 preqcblk->req_parml += preq_vud_block->len; 1105 1106 /* prepare key block */ 1107 preq_key_block = (struct key_block __force *) 1108 (preqcblk->req_parmb + preqcblk->req_parml); 1109 n = *key_token_size; 1110 preq_key_block->len = sizeof(struct key_block) + n; 1111 preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n; 1112 preq_key_block->tlv1.flag = 0x0030; 1113 memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size); 1114 preqcblk->req_parml += preq_key_block->len; 1115 1116 /* prepare xcrb struct */ 1117 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1118 1119 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1120 rc = zcrypt_send_cprb(&xcrb, xflags); 1121 if (rc) { 1122 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1123 __func__, (int)cardnr, (int)domain, rc); 1124 goto out; 1125 } 1126 1127 /* check response returncode and reasoncode */ 1128 if (prepcblk->ccp_rtcode != 0) { 1129 ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n", 1130 __func__, 1131 (int)prepcblk->ccp_rtcode, 1132 (int)prepcblk->ccp_rscode); 1133 rc = -EIO; 1134 goto out; 1135 } 1136 1137 /* process response cprb param block */ 1138 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1139 prepcblk->rpl_parmb = (u8 __user *)ptr; 1140 prepparm = (struct iprepparm *)ptr; 1141 1142 /* do some plausibility checks on the key block */ 1143 if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) || 1144 prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) { 1145 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 1146 __func__); 1147 rc = -EIO; 1148 goto out; 1149 } 1150 1151 /* do not check the key here, it may be incomplete */ 1152 1153 /* copy the vlsc key token back */ 1154 t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token; 1155 memcpy(key_token, t, t->len); 1156 *key_token_size = t->len; 1157 1158 out: 1159 free_cprbmem(mem, PARMBSIZE, scrub, xflags); 1160 return rc; 1161 } 1162 1163 /* 1164 * Build CCA AES CIPHER secure key with a given clear key value. 1165 */ 1166 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, 1167 const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags) 1168 { 1169 int rc; 1170 void *mem; 1171 int tokensize; 1172 u8 *token, exorbuf[32]; 1173 struct cipherkeytoken *t; 1174 1175 /* fill exorbuf with random data */ 1176 get_random_bytes(exorbuf, sizeof(exorbuf)); 1177 1178 /* 1179 * Allocate space for the key token to build. 1180 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this 1181 * we use the already existing cprb mempool to solve this 1182 * short term memory requirement. 1183 */ 1184 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1185 mempool_alloc_preallocated(cprb_mempool) : 1186 mempool_alloc(cprb_mempool, GFP_KERNEL); 1187 if (!mem) 1188 return -ENOMEM; 1189 1190 /* prepare the token with the key skeleton */ 1191 token = (u8 *)mem; 1192 tokensize = SIZEOF_SKELETON; 1193 memcpy(token, aes_cipher_key_skeleton, tokensize); 1194 1195 /* patch the skeleton key token export flags */ 1196 if (keygenflags) { 1197 t = (struct cipherkeytoken *)token; 1198 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 1199 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 1200 } 1201 1202 /* 1203 * Do the key import with the clear key value in 4 steps: 1204 * 1/4 FIRST import with only random data 1205 * 2/4 EXOR the clear key 1206 * 3/4 EXOR the very same random data again 1207 * 4/4 COMPLETE the secure cipher key import 1208 */ 1209 rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", 1210 exorbuf, keybitsize, token, &tokensize, 1211 xflags, true); 1212 if (rc) { 1213 ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", 1214 __func__, rc); 1215 goto out; 1216 } 1217 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1218 clrkey, keybitsize, token, &tokensize, 1219 xflags, true); 1220 if (rc) { 1221 ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", 1222 __func__, rc); 1223 goto out; 1224 } 1225 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1226 exorbuf, keybitsize, token, &tokensize, 1227 xflags, true); 1228 if (rc) { 1229 ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", 1230 __func__, rc); 1231 goto out; 1232 } 1233 rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, 1234 NULL, keybitsize, token, &tokensize, 1235 xflags, true); 1236 if (rc) { 1237 ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", 1238 __func__, rc); 1239 goto out; 1240 } 1241 1242 /* copy the generated key token */ 1243 if (keybuf) { 1244 if (tokensize > *keybufsize) 1245 rc = -EINVAL; 1246 else 1247 memcpy(keybuf, token, tokensize); 1248 } 1249 *keybufsize = tokensize; 1250 1251 out: 1252 memzero_explicit(exorbuf, sizeof(exorbuf)); 1253 memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE); 1254 mempool_free(mem, cprb_mempool); 1255 return rc; 1256 } 1257 EXPORT_SYMBOL(cca_clr2cipherkey); 1258 1259 /* 1260 * Derive proteced key from CCA AES cipher secure key. 1261 */ 1262 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey, 1263 u8 *protkey, u32 *protkeylen, u32 *protkeytype, 1264 u32 xflags) 1265 { 1266 int rc; 1267 u8 *mem, *ptr; 1268 struct CPRBX *preqcblk, *prepcblk; 1269 struct ica_xcRB xcrb; 1270 struct aureqparm { 1271 u8 subfunc_code[2]; 1272 u16 rule_array_len; 1273 u8 rule_array[8]; 1274 struct { 1275 u16 len; 1276 u16 tk_blob_len; 1277 u16 tk_blob_tag; 1278 u8 tk_blob[66]; 1279 } vud; 1280 struct { 1281 u16 len; 1282 u16 cca_key_token_len; 1283 u16 cca_key_token_flags; 1284 u8 cca_key_token[]; /* 64 or more */ 1285 } kb; 1286 } __packed * preqparm; 1287 struct aurepparm { 1288 u8 subfunc_code[2]; 1289 u16 rule_array_len; 1290 struct { 1291 u16 len; 1292 u16 sublen; 1293 u16 tag; 1294 struct cpacfkeyblock { 1295 u8 version; /* version of this struct */ 1296 u8 flags[2]; 1297 u8 algo; 1298 u8 form; 1299 u8 pad1[3]; 1300 u16 keylen; 1301 u8 key[64]; /* the key (keylen bytes) */ 1302 u16 keyattrlen; 1303 u8 keyattr[32]; 1304 u8 pad2[1]; 1305 u8 vptype; 1306 u8 vp[32]; /* verification pattern */ 1307 } ckb; 1308 } vud; 1309 struct { 1310 u16 len; 1311 } kb; 1312 } __packed * prepparm; 1313 int keytoklen = ((struct cipherkeytoken *)ckey)->len; 1314 1315 if (keytoklen > PARMBSIZE - sizeof(struct aureqparm)) 1316 return -EINVAL; 1317 1318 /* get already prepared memory for 2 cprbs with param block each */ 1319 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1320 &preqcblk, &prepcblk, xflags); 1321 if (rc) 1322 return rc; 1323 1324 /* fill request cprb struct */ 1325 preqcblk->domain = domain; 1326 1327 /* fill request cprb param block with AU request */ 1328 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1329 memcpy(preqparm->subfunc_code, "AU", 2); 1330 preqparm->rule_array_len = 1331 sizeof(preqparm->rule_array_len) 1332 + sizeof(preqparm->rule_array); 1333 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1334 /* vud, tk blob */ 1335 preqparm->vud.len = sizeof(preqparm->vud); 1336 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1337 + 2 * sizeof(uint16_t); 1338 preqparm->vud.tk_blob_tag = 0x00C2; 1339 /* kb, cca token */ 1340 preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t); 1341 preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t); 1342 memcpy(preqparm->kb.cca_key_token, ckey, keytoklen); 1343 /* now fill length of param block into cprb */ 1344 preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen; 1345 1346 /* fill xcrb struct */ 1347 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1348 1349 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1350 rc = zcrypt_send_cprb(&xcrb, xflags); 1351 if (rc) { 1352 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1353 __func__, (int)cardnr, (int)domain, rc); 1354 goto out; 1355 } 1356 1357 /* check response returncode and reasoncode */ 1358 if (prepcblk->ccp_rtcode != 0) { 1359 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1360 __func__, 1361 (int)prepcblk->ccp_rtcode, 1362 (int)prepcblk->ccp_rscode); 1363 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1364 rc = -EBUSY; 1365 else 1366 rc = -EIO; 1367 goto out; 1368 } 1369 if (prepcblk->ccp_rscode != 0) { 1370 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1371 __func__, 1372 (int)prepcblk->ccp_rtcode, 1373 (int)prepcblk->ccp_rscode); 1374 } 1375 1376 /* process response cprb param block */ 1377 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1378 prepcblk->rpl_parmb = (u8 __user *)ptr; 1379 prepparm = (struct aurepparm *)ptr; 1380 1381 /* check the returned keyblock */ 1382 if (prepparm->vud.ckb.version != 0x01 && 1383 prepparm->vud.ckb.version != 0x02) { 1384 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 1385 __func__, (int)prepparm->vud.ckb.version); 1386 rc = -EIO; 1387 goto out; 1388 } 1389 if (prepparm->vud.ckb.algo != 0x02) { 1390 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n", 1391 __func__, (int)prepparm->vud.ckb.algo); 1392 rc = -EIO; 1393 goto out; 1394 } 1395 1396 /* copy the translated protected key */ 1397 switch (prepparm->vud.ckb.keylen) { 1398 case 16 + 32: 1399 /* AES 128 protected key */ 1400 if (protkeytype) 1401 *protkeytype = PKEY_KEYTYPE_AES_128; 1402 break; 1403 case 24 + 32: 1404 /* AES 192 protected key */ 1405 if (protkeytype) 1406 *protkeytype = PKEY_KEYTYPE_AES_192; 1407 break; 1408 case 32 + 32: 1409 /* AES 256 protected key */ 1410 if (protkeytype) 1411 *protkeytype = PKEY_KEYTYPE_AES_256; 1412 break; 1413 default: 1414 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 1415 __func__, prepparm->vud.ckb.keylen); 1416 rc = -EIO; 1417 goto out; 1418 } 1419 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1420 if (protkeylen) 1421 *protkeylen = prepparm->vud.ckb.keylen; 1422 1423 out: 1424 free_cprbmem(mem, PARMBSIZE, true, xflags); 1425 return rc; 1426 } 1427 EXPORT_SYMBOL(cca_cipher2protkey); 1428 1429 /* 1430 * Derive protected key from CCA ECC secure private key. 1431 */ 1432 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key, 1433 u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags) 1434 { 1435 int rc; 1436 u8 *mem, *ptr; 1437 struct CPRBX *preqcblk, *prepcblk; 1438 struct ica_xcRB xcrb; 1439 struct aureqparm { 1440 u8 subfunc_code[2]; 1441 u16 rule_array_len; 1442 u8 rule_array[8]; 1443 struct { 1444 u16 len; 1445 u16 tk_blob_len; 1446 u16 tk_blob_tag; 1447 u8 tk_blob[66]; 1448 } vud; 1449 struct { 1450 u16 len; 1451 u16 cca_key_token_len; 1452 u16 cca_key_token_flags; 1453 u8 cca_key_token[]; 1454 } kb; 1455 } __packed * preqparm; 1456 struct aurepparm { 1457 u8 subfunc_code[2]; 1458 u16 rule_array_len; 1459 struct { 1460 u16 len; 1461 u16 sublen; 1462 u16 tag; 1463 struct cpacfkeyblock { 1464 u8 version; /* version of this struct */ 1465 u8 flags[2]; 1466 u8 algo; 1467 u8 form; 1468 u8 pad1[3]; 1469 u16 keylen; 1470 u8 key[]; /* the key (keylen bytes) */ 1471 /* u16 keyattrlen; */ 1472 /* u8 keyattr[32]; */ 1473 /* u8 pad2[1]; */ 1474 /* u8 vptype; */ 1475 /* u8 vp[32]; verification pattern */ 1476 } ckb; 1477 } vud; 1478 /* followed by a key block */ 1479 } __packed * prepparm; 1480 int keylen = ((struct eccprivkeytoken *)key)->len; 1481 1482 if (keylen > PARMBSIZE - sizeof(struct aureqparm)) 1483 return -EINVAL; 1484 1485 /* get already prepared memory for 2 cprbs with param block each */ 1486 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1487 &preqcblk, &prepcblk, xflags); 1488 if (rc) 1489 return rc; 1490 1491 /* fill request cprb struct */ 1492 preqcblk->domain = domain; 1493 1494 /* fill request cprb param block with AU request */ 1495 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1496 memcpy(preqparm->subfunc_code, "AU", 2); 1497 preqparm->rule_array_len = 1498 sizeof(preqparm->rule_array_len) 1499 + sizeof(preqparm->rule_array); 1500 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1501 /* vud, tk blob */ 1502 preqparm->vud.len = sizeof(preqparm->vud); 1503 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1504 + 2 * sizeof(uint16_t); 1505 preqparm->vud.tk_blob_tag = 0x00C2; 1506 /* kb, cca token */ 1507 preqparm->kb.len = keylen + 3 * sizeof(uint16_t); 1508 preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t); 1509 memcpy(preqparm->kb.cca_key_token, key, keylen); 1510 /* now fill length of param block into cprb */ 1511 preqcblk->req_parml = sizeof(struct aureqparm) + keylen; 1512 1513 /* fill xcrb struct */ 1514 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1515 1516 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1517 rc = zcrypt_send_cprb(&xcrb, xflags); 1518 if (rc) { 1519 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1520 __func__, (int)cardnr, (int)domain, rc); 1521 goto out; 1522 } 1523 1524 /* check response returncode and reasoncode */ 1525 if (prepcblk->ccp_rtcode != 0) { 1526 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1527 __func__, 1528 (int)prepcblk->ccp_rtcode, 1529 (int)prepcblk->ccp_rscode); 1530 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1531 rc = -EBUSY; 1532 else 1533 rc = -EIO; 1534 goto out; 1535 } 1536 if (prepcblk->ccp_rscode != 0) { 1537 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1538 __func__, 1539 (int)prepcblk->ccp_rtcode, 1540 (int)prepcblk->ccp_rscode); 1541 } 1542 1543 /* process response cprb param block */ 1544 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1545 prepcblk->rpl_parmb = (u8 __user *)ptr; 1546 prepparm = (struct aurepparm *)ptr; 1547 1548 /* check the returned keyblock */ 1549 if (prepparm->vud.ckb.version != 0x02) { 1550 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n", 1551 __func__, (int)prepparm->vud.ckb.version); 1552 rc = -EIO; 1553 goto out; 1554 } 1555 if (prepparm->vud.ckb.algo != 0x81) { 1556 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n", 1557 __func__, (int)prepparm->vud.ckb.algo); 1558 rc = -EIO; 1559 goto out; 1560 } 1561 1562 /* copy the translated protected key */ 1563 if (prepparm->vud.ckb.keylen > *protkeylen) { 1564 ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n", 1565 __func__, prepparm->vud.ckb.keylen, *protkeylen); 1566 rc = -EIO; 1567 goto out; 1568 } 1569 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1570 *protkeylen = prepparm->vud.ckb.keylen; 1571 if (protkeytype) 1572 *protkeytype = PKEY_KEYTYPE_ECC; 1573 1574 out: 1575 free_cprbmem(mem, PARMBSIZE, true, xflags); 1576 return rc; 1577 } 1578 EXPORT_SYMBOL(cca_ecc2protkey); 1579 1580 /* 1581 * query cryptographic facility from CCA adapter 1582 */ 1583 int cca_query_crypto_facility(u16 cardnr, u16 domain, 1584 const char *keyword, 1585 u8 *rarray, size_t *rarraylen, 1586 u8 *varray, size_t *varraylen, 1587 u32 xflags) 1588 { 1589 int rc; 1590 u16 len; 1591 u8 *mem, *ptr; 1592 struct CPRBX *preqcblk, *prepcblk; 1593 struct ica_xcRB xcrb; 1594 struct fqreqparm { 1595 u8 subfunc_code[2]; 1596 u16 rule_array_len; 1597 char rule_array[8]; 1598 struct lv1 { 1599 u16 len; 1600 u8 data[VARDATASIZE]; 1601 } lv1; 1602 u16 dummylen; 1603 } __packed * preqparm; 1604 size_t parmbsize = sizeof(struct fqreqparm); 1605 struct fqrepparm { 1606 u8 subfunc_code[2]; 1607 u8 lvdata[]; 1608 } __packed * prepparm; 1609 1610 /* get already prepared memory for 2 cprbs with param block each */ 1611 rc = alloc_and_prep_cprbmem(parmbsize, &mem, 1612 &preqcblk, &prepcblk, xflags); 1613 if (rc) 1614 return rc; 1615 1616 /* fill request cprb struct */ 1617 preqcblk->domain = domain; 1618 1619 /* fill request cprb param block with FQ request */ 1620 preqparm = (struct fqreqparm __force *)preqcblk->req_parmb; 1621 memcpy(preqparm->subfunc_code, "FQ", 2); 1622 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array)); 1623 preqparm->rule_array_len = 1624 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 1625 preqparm->lv1.len = sizeof(preqparm->lv1); 1626 preqparm->dummylen = sizeof(preqparm->dummylen); 1627 preqcblk->req_parml = parmbsize; 1628 1629 /* fill xcrb struct */ 1630 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1631 1632 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1633 rc = zcrypt_send_cprb(&xcrb, xflags); 1634 if (rc) { 1635 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1636 __func__, (int)cardnr, (int)domain, rc); 1637 goto out; 1638 } 1639 1640 /* check response returncode and reasoncode */ 1641 if (prepcblk->ccp_rtcode != 0) { 1642 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1643 __func__, 1644 (int)prepcblk->ccp_rtcode, 1645 (int)prepcblk->ccp_rscode); 1646 rc = -EIO; 1647 goto out; 1648 } 1649 1650 /* process response cprb param block */ 1651 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1652 prepcblk->rpl_parmb = (u8 __user *)ptr; 1653 prepparm = (struct fqrepparm *)ptr; 1654 ptr = prepparm->lvdata; 1655 1656 /* check and possibly copy reply rule array */ 1657 len = *((u16 *)ptr); 1658 if (len > sizeof(u16)) { 1659 ptr += sizeof(u16); 1660 len -= sizeof(u16); 1661 if (rarray && rarraylen && *rarraylen > 0) { 1662 *rarraylen = (len > *rarraylen ? *rarraylen : len); 1663 memcpy(rarray, ptr, *rarraylen); 1664 } 1665 ptr += len; 1666 } 1667 /* check and possible copy reply var array */ 1668 len = *((u16 *)ptr); 1669 if (len > sizeof(u16)) { 1670 ptr += sizeof(u16); 1671 len -= sizeof(u16); 1672 if (varray && varraylen && *varraylen > 0) { 1673 *varraylen = (len > *varraylen ? *varraylen : len); 1674 memcpy(varray, ptr, *varraylen); 1675 } 1676 ptr += len; 1677 } 1678 1679 out: 1680 free_cprbmem(mem, parmbsize, false, xflags); 1681 return rc; 1682 } 1683 EXPORT_SYMBOL(cca_query_crypto_facility); 1684 1685 /* 1686 * Fetch cca_info values about a CCA queue via 1687 * query_crypto_facility from adapter. 1688 */ 1689 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags) 1690 { 1691 void *mem; 1692 int rc, found = 0; 1693 size_t rlen, vlen; 1694 u8 *rarray, *varray; 1695 struct zcrypt_device_status_ext devstat; 1696 1697 memset(ci, 0, sizeof(*ci)); 1698 1699 /* if specific domain given, fetch status and hw info for this apqn */ 1700 if (domain != AUTOSEL_DOM) { 1701 rc = zcrypt_device_status_ext(cardnr, domain, &devstat); 1702 if (rc) 1703 return rc; 1704 ci->hwtype = devstat.hwtype; 1705 } 1706 1707 /* 1708 * Prep memory for rule array and var array use. 1709 * Use the cprb mempool for this. 1710 */ 1711 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1712 mempool_alloc_preallocated(cprb_mempool) : 1713 mempool_alloc(cprb_mempool, GFP_KERNEL); 1714 if (!mem) 1715 return -ENOMEM; 1716 rarray = (u8 *)mem; 1717 varray = (u8 *)mem + PAGE_SIZE / 2; 1718 rlen = vlen = PAGE_SIZE / 2; 1719 1720 /* QF for this card/domain */ 1721 rc = cca_query_crypto_facility(cardnr, domain, "STATICSA", 1722 rarray, &rlen, varray, &vlen, xflags); 1723 if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) { 1724 memcpy(ci->serial, rarray, 8); 1725 ci->new_asym_mk_state = (char)rarray[4 * 8]; 1726 ci->cur_asym_mk_state = (char)rarray[5 * 8]; 1727 ci->old_asym_mk_state = (char)rarray[6 * 8]; 1728 if (ci->old_asym_mk_state == '2') 1729 memcpy(ci->old_asym_mkvp, varray + 64, 16); 1730 if (ci->cur_asym_mk_state == '2') 1731 memcpy(ci->cur_asym_mkvp, varray + 84, 16); 1732 if (ci->new_asym_mk_state == '3') 1733 memcpy(ci->new_asym_mkvp, varray + 104, 16); 1734 ci->new_aes_mk_state = (char)rarray[7 * 8]; 1735 ci->cur_aes_mk_state = (char)rarray[8 * 8]; 1736 ci->old_aes_mk_state = (char)rarray[9 * 8]; 1737 if (ci->old_aes_mk_state == '2') 1738 memcpy(&ci->old_aes_mkvp, varray + 172, 8); 1739 if (ci->cur_aes_mk_state == '2') 1740 memcpy(&ci->cur_aes_mkvp, varray + 184, 8); 1741 if (ci->new_aes_mk_state == '3') 1742 memcpy(&ci->new_aes_mkvp, varray + 196, 8); 1743 found++; 1744 } 1745 if (!found) 1746 goto out; 1747 rlen = vlen = PAGE_SIZE / 2; 1748 rc = cca_query_crypto_facility(cardnr, domain, "STATICSB", 1749 rarray, &rlen, varray, &vlen, xflags); 1750 if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) { 1751 ci->new_apka_mk_state = (char)rarray[10 * 8]; 1752 ci->cur_apka_mk_state = (char)rarray[11 * 8]; 1753 ci->old_apka_mk_state = (char)rarray[12 * 8]; 1754 if (ci->old_apka_mk_state == '2') 1755 memcpy(&ci->old_apka_mkvp, varray + 208, 8); 1756 if (ci->cur_apka_mk_state == '2') 1757 memcpy(&ci->cur_apka_mkvp, varray + 220, 8); 1758 if (ci->new_apka_mk_state == '3') 1759 memcpy(&ci->new_apka_mkvp, varray + 232, 8); 1760 found++; 1761 } 1762 1763 out: 1764 mempool_free(mem, cprb_mempool); 1765 return found == 2 ? 0 : -ENOENT; 1766 } 1767 EXPORT_SYMBOL(cca_get_info); 1768 1769 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain, 1770 int minhwtype, int mktype, 1771 const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags) 1772 { 1773 struct zcrypt_device_status_ext *device_status; 1774 int i, card, dom, curmatch, oldmatch; 1775 struct cca_info ci; 1776 u32 _nr_apqns = 0; 1777 1778 /* occupy the device status memory */ 1779 mutex_lock(&dev_status_mem_mutex); 1780 memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE); 1781 device_status = (struct zcrypt_device_status_ext *)dev_status_mem; 1782 1783 /* fetch crypto device status into this struct */ 1784 zcrypt_device_status_mask_ext(device_status, 1785 ZCRYPT_DEV_STATUS_CARD_MAX, 1786 ZCRYPT_DEV_STATUS_QUEUE_MAX); 1787 1788 /* walk through all the crypto apqnss */ 1789 for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) { 1790 card = AP_QID_CARD(device_status[i].qid); 1791 dom = AP_QID_QUEUE(device_status[i].qid); 1792 /* check online state */ 1793 if (!device_status[i].online) 1794 continue; 1795 /* check for cca functions */ 1796 if (!(device_status[i].functions & 0x04)) 1797 continue; 1798 /* check cardnr */ 1799 if (cardnr != 0xFFFF && card != cardnr) 1800 continue; 1801 /* check domain */ 1802 if (domain != 0xFFFF && dom != domain) 1803 continue; 1804 /* get cca info on this apqn */ 1805 if (cca_get_info(card, dom, &ci, xflags)) 1806 continue; 1807 /* current master key needs to be valid */ 1808 if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2') 1809 continue; 1810 if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2') 1811 continue; 1812 /* check min hardware type */ 1813 if (minhwtype > 0 && minhwtype > ci.hwtype) 1814 continue; 1815 if (ptr_cur_mkvp || ptr_old_mkvp) { 1816 /* check mkvps */ 1817 curmatch = oldmatch = 0; 1818 if (mktype == AES_MK_SET) { 1819 if (ptr_cur_mkvp && 1820 !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp, 1821 sizeof(ci.cur_aes_mkvp))) 1822 curmatch = 1; 1823 if (ptr_old_mkvp && 1824 ci.old_aes_mk_state == '2' && 1825 !memcmp(ptr_old_mkvp, ci.old_aes_mkvp, 1826 sizeof(ci.old_aes_mkvp))) 1827 oldmatch = 1; 1828 } else { 1829 if (ptr_cur_mkvp && 1830 !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp, 1831 sizeof(ci.cur_apka_mkvp))) 1832 curmatch = 1; 1833 if (ptr_old_mkvp && 1834 ci.old_apka_mk_state == '2' && 1835 !memcmp(ptr_old_mkvp, ci.old_apka_mkvp, 1836 sizeof(ci.old_apka_mkvp))) 1837 oldmatch = 1; 1838 } 1839 if (curmatch + oldmatch < 1) 1840 continue; 1841 } 1842 /* apqn passed all filtering criterons, add to the array */ 1843 if (_nr_apqns < *nr_apqns) 1844 apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom); 1845 } 1846 1847 *nr_apqns = _nr_apqns; 1848 1849 /* release the device status memory */ 1850 mutex_unlock(&dev_status_mem_mutex); 1851 1852 return _nr_apqns ? 0 : -ENODEV; 1853 } 1854 EXPORT_SYMBOL(cca_findcard2); 1855 1856 int __init zcrypt_ccamisc_init(void) 1857 { 1858 /* Pre-allocate a small memory pool for cca cprbs. */ 1859 cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold, 1860 CPRB_MEMPOOL_ITEM_SIZE); 1861 if (!cprb_mempool) 1862 return -ENOMEM; 1863 1864 /* Pre-allocate one crypto status card struct used in findcard() */ 1865 dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL); 1866 if (!dev_status_mem) { 1867 mempool_destroy(cprb_mempool); 1868 return -ENOMEM; 1869 } 1870 1871 return 0; 1872 } 1873 1874 void zcrypt_ccamisc_exit(void) 1875 { 1876 mutex_lock(&dev_status_mem_mutex); 1877 kvfree(dev_status_mem); 1878 mutex_unlock(&dev_status_mem_mutex); 1879 mempool_destroy(cprb_mempool); 1880 } 1881