xref: /linux/drivers/s390/crypto/zcrypt_ccamisc.c (revision 9d19ca5d0e8b4a3f4b2eaa14e86a25f1c93ff35b)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  *  Copyright IBM Corp. 2019
4  *  Author(s): Harald Freudenberger <freude@linux.ibm.com>
5  *	       Ingo Franzki <ifranzki@linux.ibm.com>
6  *
7  *  Collection of CCA misc functions used by zcrypt and pkey
8  */
9 
10 #define pr_fmt(fmt) "zcrypt: " fmt
11 
12 #include <linux/export.h>
13 #include <linux/init.h>
14 #include <linux/mempool.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/random.h>
18 #include <asm/zcrypt.h>
19 #include <asm/pkey.h>
20 
21 #include "ap_bus.h"
22 #include "zcrypt_api.h"
23 #include "zcrypt_debug.h"
24 #include "zcrypt_msgtype6.h"
25 #include "zcrypt_ccamisc.h"
26 
27 /* Size of parameter block used for all cca requests/replies */
28 #define PARMBSIZE 512
29 
30 /* Size of vardata block used for some of the cca requests/replies */
31 #define VARDATASIZE 4096
32 
33 /*
34  * Cprb memory pool held for urgent cases where no memory
35  * can be allocated via kmalloc. This pool is only used
36  * when alloc_and_prep_cprbmem() is called with the xflag
37  * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold
38  * space for request AND reply!
39  */
40 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024)
41 static mempool_t *cprb_mempool;
42 
43 /*
44  * This is a pre-allocated memory for the device status array
45  * used within the findcard() functions. It is currently
46  * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is
47  * controlled via dev_status_mem_mutex. Needs adaption if more
48  * than 128 cards or domains to be are supported.
49  */
50 #define ZCRYPT_DEV_STATUS_CARD_MAX 128
51 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128
52 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \
53 				   ZCRYPT_DEV_STATUS_QUEUE_MAX)
54 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \
55 		sizeof(struct zcrypt_device_status_ext))
56 static void *dev_status_mem;
57 static DEFINE_MUTEX(dev_status_mem_mutex);
58 
59 /*
60  * Simple check if the token is a valid CCA secure AES data key
61  * token. If keybitsize is given, the bitsize of the key is
62  * also checked. Returns 0 on success or errno value on failure.
63  */
64 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
65 			     const u8 *token, u32 keysize, int keybitsize)
66 {
67 	struct secaeskeytoken *t = (struct secaeskeytoken *)token;
68 
69 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
70 
71 	if (keysize < sizeof(*t)) {
72 		if (dbg)
73 			DBF("%s keysize %u < min token size %zu\n",
74 			    __func__, keysize, sizeof(*t));
75 		return -EINVAL;
76 	}
77 	if (t->type != TOKTYPE_CCA_INTERNAL) {
78 		if (dbg)
79 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
80 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
81 		return -EINVAL;
82 	}
83 	if (t->version != TOKVER_CCA_AES) {
84 		if (dbg)
85 			DBF("%s token check failed, version 0x%02x != 0x%02x\n",
86 			    __func__, (int)t->version, TOKVER_CCA_AES);
87 		return -EINVAL;
88 	}
89 	if (keybitsize > 0 && t->bitsize != keybitsize) {
90 		if (dbg)
91 			DBF("%s token check failed, bitsize %d != %d\n",
92 			    __func__, (int)t->bitsize, keybitsize);
93 		return -EINVAL;
94 	}
95 
96 #undef DBF
97 
98 	return 0;
99 }
100 EXPORT_SYMBOL(cca_check_secaeskeytoken);
101 
102 /*
103  * Simple check if the token is a valid CCA secure AES cipher key
104  * token. If keybitsize is given, the bitsize of the key is
105  * also checked. If checkcpacfexport is enabled, the key is also
106  * checked for the export flag to allow CPACF export.
107  * Returns 0 on success or errno value on failure.
108  */
109 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl,
110 			      const u8 *token, u32 keysize,
111 			      int keybitsize, int checkcpacfexport)
112 {
113 	struct cipherkeytoken *t = (struct cipherkeytoken *)token;
114 	bool keybitsizeok = true;
115 
116 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
117 
118 	if (keysize < sizeof(*t)) {
119 		if (dbg)
120 			DBF("%s keysize %u < min token size %zu\n",
121 			    __func__, keysize, sizeof(*t));
122 		return -EINVAL;
123 	}
124 	if (t->type != TOKTYPE_CCA_INTERNAL) {
125 		if (dbg)
126 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
127 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
128 		return -EINVAL;
129 	}
130 	if (t->version != TOKVER_CCA_VLSC) {
131 		if (dbg)
132 			DBF("%s token check failed, version 0x%02x != 0x%02x\n",
133 			    __func__, (int)t->version, TOKVER_CCA_VLSC);
134 		return -EINVAL;
135 	}
136 	if (t->len > keysize) {
137 		if (dbg)
138 			DBF("%s token check failed, len %d > keysize %u\n",
139 			    __func__, (int)t->len, keysize);
140 		return -EINVAL;
141 	}
142 	if (t->len < sizeof(*t)) {
143 		if (dbg)
144 			DBF("%s token check failed, len %d < min token size %zu\n",
145 			    __func__, (int)t->len, sizeof(*t));
146 		return -EINVAL;
147 	}
148 	if (t->algtype != 0x02) {
149 		if (dbg)
150 			DBF("%s token check failed, algtype 0x%02x != 0x02\n",
151 			    __func__, (int)t->algtype);
152 		return -EINVAL;
153 	}
154 	if (t->keytype != 0x0001) {
155 		if (dbg)
156 			DBF("%s token check failed, keytype 0x%04x != 0x0001\n",
157 			    __func__, (int)t->keytype);
158 		return -EINVAL;
159 	}
160 	if (t->plfver != 0x00 && t->plfver != 0x01) {
161 		if (dbg)
162 			DBF("%s token check failed, unknown plfver 0x%02x\n",
163 			    __func__, (int)t->plfver);
164 		return -EINVAL;
165 	}
166 	if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) {
167 		if (dbg)
168 			DBF("%s token check failed, unknown wpllen %d\n",
169 			    __func__, (int)t->wpllen);
170 		return -EINVAL;
171 	}
172 	if (keybitsize > 0) {
173 		switch (keybitsize) {
174 		case 128:
175 			if (t->wpllen != (t->plfver ? 640 : 512))
176 				keybitsizeok = false;
177 			break;
178 		case 192:
179 			if (t->wpllen != (t->plfver ? 640 : 576))
180 				keybitsizeok = false;
181 			break;
182 		case 256:
183 			if (t->wpllen != 640)
184 				keybitsizeok = false;
185 			break;
186 		default:
187 			keybitsizeok = false;
188 			break;
189 		}
190 		if (!keybitsizeok) {
191 			if (dbg)
192 				DBF("%s token check failed, bitsize %d\n",
193 				    __func__, keybitsize);
194 			return -EINVAL;
195 		}
196 	}
197 	if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) {
198 		if (dbg)
199 			DBF("%s token check failed, XPRT_CPAC bit is 0\n",
200 			    __func__);
201 		return -EINVAL;
202 	}
203 
204 #undef DBF
205 
206 	return 0;
207 }
208 EXPORT_SYMBOL(cca_check_secaescipherkey);
209 
210 /*
211  * Simple check if the token is a valid CCA secure ECC private
212  * key token. Returns 0 on success or errno value on failure.
213  */
214 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl,
215 			     const u8 *token, u32 keysize,
216 			     int checkcpacfexport)
217 {
218 	struct eccprivkeytoken *t = (struct eccprivkeytoken *)token;
219 
220 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
221 
222 	if (keysize < sizeof(*t)) {
223 		if (dbg)
224 			DBF("%s keysize %u < min token size %zu\n",
225 			    __func__, keysize, sizeof(*t));
226 		return -EINVAL;
227 	}
228 	if (t->type != TOKTYPE_CCA_INTERNAL_PKA) {
229 		if (dbg)
230 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
231 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA);
232 		return -EINVAL;
233 	}
234 	if (t->len > keysize) {
235 		if (dbg)
236 			DBF("%s token check failed, len %d > keysize %u\n",
237 			    __func__, (int)t->len, keysize);
238 		return -EINVAL;
239 	}
240 	if (t->len < sizeof(*t)) {
241 		if (dbg)
242 			DBF("%s token check failed, len %d < min token size %zu\n",
243 			    __func__, (int)t->len, sizeof(*t));
244 		return -EINVAL;
245 	}
246 	if (t->secid != 0x20) {
247 		if (dbg)
248 			DBF("%s token check failed, secid 0x%02x != 0x20\n",
249 			    __func__, (int)t->secid);
250 		return -EINVAL;
251 	}
252 	if (checkcpacfexport && !(t->kutc & 0x01)) {
253 		if (dbg)
254 			DBF("%s token check failed, XPRTCPAC bit is 0\n",
255 			    __func__);
256 		return -EINVAL;
257 	}
258 
259 #undef DBF
260 
261 	return 0;
262 }
263 EXPORT_SYMBOL(cca_check_sececckeytoken);
264 
265 /*
266  * Allocate consecutive memory for request CPRB, request param
267  * block, reply CPRB and reply param block and fill in values
268  * for the common fields. Returns 0 on success or errno value
269  * on failure.
270  */
271 static int alloc_and_prep_cprbmem(size_t paramblen,
272 				  u8 **p_cprb_mem,
273 				  struct CPRBX **p_req_cprb,
274 				  struct CPRBX **p_rep_cprb,
275 				  u32 xflags)
276 {
277 	u8 *cprbmem = NULL;
278 	size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
279 	size_t len = 2 * cprbplusparamblen;
280 	struct CPRBX *preqcblk, *prepcblk;
281 
282 	/*
283 	 * allocate consecutive memory for request CPRB, request param
284 	 * block, reply CPRB and reply param block
285 	 */
286 	if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) {
287 		if (len <= CPRB_MEMPOOL_ITEM_SIZE)
288 			cprbmem = mempool_alloc_preallocated(cprb_mempool);
289 	} else {
290 		cprbmem = kmalloc(len, GFP_KERNEL);
291 	}
292 	if (!cprbmem)
293 		return -ENOMEM;
294 	memset(cprbmem, 0, len);
295 
296 	preqcblk = (struct CPRBX *)cprbmem;
297 	prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen);
298 
299 	/* fill request cprb struct */
300 	preqcblk->cprb_len = sizeof(struct CPRBX);
301 	preqcblk->cprb_ver_id = 0x02;
302 	memcpy(preqcblk->func_id, "T2", 2);
303 	preqcblk->rpl_msgbl = cprbplusparamblen;
304 	if (paramblen) {
305 		preqcblk->req_parmb =
306 			((u8 __user *)preqcblk) + sizeof(struct CPRBX);
307 		preqcblk->rpl_parmb =
308 			((u8 __user *)prepcblk) + sizeof(struct CPRBX);
309 	}
310 
311 	*p_cprb_mem = cprbmem;
312 	*p_req_cprb = preqcblk;
313 	*p_rep_cprb = prepcblk;
314 
315 	return 0;
316 }
317 
318 /*
319  * Free the cprb memory allocated with the function above.
320  * If the scrub value is not zero, the memory is filled
321  * with zeros before freeing (useful if there was some
322  * clear key material in there).
323  */
324 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags)
325 {
326 	if (mem && scrub)
327 		memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
328 
329 	if (xflags & ZCRYPT_XFLAG_NOMEMALLOC)
330 		mempool_free(mem, cprb_mempool);
331 	else
332 		kfree(mem);
333 }
334 
335 /*
336  * Helper function to prepare the xcrb struct
337  */
338 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
339 			     u16 cardnr,
340 			     struct CPRBX *preqcblk,
341 			     struct CPRBX *prepcblk)
342 {
343 	memset(pxcrb, 0, sizeof(*pxcrb));
344 	memcpy(&pxcrb->agent_ID, "CA", 2);
345 	pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
346 	pxcrb->request_control_blk_length =
347 		preqcblk->cprb_len + preqcblk->req_parml;
348 	pxcrb->request_control_blk_addr = (void __user *)preqcblk;
349 	pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
350 	pxcrb->reply_control_blk_addr = (void __user *)prepcblk;
351 }
352 
353 /*
354  * Generate (random) CCA AES DATA secure key.
355  */
356 int cca_genseckey(u16 cardnr, u16 domain,
357 		  u32 keybitsize, u8 *seckey, u32 xflags)
358 {
359 	int i, rc, keysize;
360 	int seckeysize;
361 	u8 *mem, *ptr;
362 	struct CPRBX *preqcblk, *prepcblk;
363 	struct ica_xcRB xcrb;
364 	struct kgreqparm {
365 		u8  subfunc_code[2];
366 		u16 rule_array_len;
367 		struct lv1 {
368 			u16 len;
369 			char  key_form[8];
370 			char  key_length[8];
371 			char  key_type1[8];
372 			char  key_type2[8];
373 		} lv1;
374 		struct lv2 {
375 			u16 len;
376 			struct keyid {
377 				u16 len;
378 				u16 attr;
379 				u8  data[SECKEYBLOBSIZE];
380 			} keyid[6];
381 		} lv2;
382 	} __packed * preqparm;
383 	struct kgrepparm {
384 		u8  subfunc_code[2];
385 		u16 rule_array_len;
386 		struct lv3 {
387 			u16 len;
388 			u16 keyblocklen;
389 			struct {
390 				u16 toklen;
391 				u16 tokattr;
392 				u8  tok[];
393 				/* ... some more data ... */
394 			} keyblock;
395 		} lv3;
396 	} __packed * prepparm;
397 
398 	/* get already prepared memory for 2 cprbs with param block each */
399 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
400 				    &preqcblk, &prepcblk, xflags);
401 	if (rc)
402 		return rc;
403 
404 	/* fill request cprb struct */
405 	preqcblk->domain = domain;
406 
407 	/* fill request cprb param block with KG request */
408 	preqparm = (struct kgreqparm __force *)preqcblk->req_parmb;
409 	memcpy(preqparm->subfunc_code, "KG", 2);
410 	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
411 	preqparm->lv1.len = sizeof(struct lv1);
412 	memcpy(preqparm->lv1.key_form,	 "OP      ", 8);
413 	switch (keybitsize) {
414 	case PKEY_SIZE_AES_128:
415 	case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
416 		keysize = 16;
417 		memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
418 		break;
419 	case PKEY_SIZE_AES_192:
420 	case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
421 		keysize = 24;
422 		memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
423 		break;
424 	case PKEY_SIZE_AES_256:
425 	case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
426 		keysize = 32;
427 		memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
428 		break;
429 	default:
430 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
431 			       __func__, keybitsize);
432 		rc = -EINVAL;
433 		goto out;
434 	}
435 	memcpy(preqparm->lv1.key_type1,  "AESDATA ", 8);
436 	preqparm->lv2.len = sizeof(struct lv2);
437 	for (i = 0; i < 6; i++) {
438 		preqparm->lv2.keyid[i].len = sizeof(struct keyid);
439 		preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
440 	}
441 	preqcblk->req_parml = sizeof(struct kgreqparm);
442 
443 	/* fill xcrb struct */
444 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
445 
446 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
447 	rc = zcrypt_send_cprb(&xcrb, xflags);
448 	if (rc) {
449 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
450 			       __func__, (int)cardnr, (int)domain, rc);
451 		goto out;
452 	}
453 
454 	/* check response returncode and reasoncode */
455 	if (prepcblk->ccp_rtcode != 0) {
456 		ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n",
457 			       __func__,
458 			  (int)prepcblk->ccp_rtcode,
459 			  (int)prepcblk->ccp_rscode);
460 		rc = -EIO;
461 		goto out;
462 	}
463 
464 	/* process response cprb param block */
465 	ptr =  ((u8 *)prepcblk) + sizeof(struct CPRBX);
466 	prepcblk->rpl_parmb = (u8 __user *)ptr;
467 	prepparm = (struct kgrepparm *)ptr;
468 
469 	/* check length of the returned secure key token */
470 	seckeysize = prepparm->lv3.keyblock.toklen
471 		- sizeof(prepparm->lv3.keyblock.toklen)
472 		- sizeof(prepparm->lv3.keyblock.tokattr);
473 	if (seckeysize != SECKEYBLOBSIZE) {
474 		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
475 			       __func__, seckeysize, SECKEYBLOBSIZE);
476 		rc = -EIO;
477 		goto out;
478 	}
479 
480 	/* check secure key token */
481 	rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
482 				      prepparm->lv3.keyblock.tok,
483 				      seckeysize, 8 * keysize);
484 	if (rc) {
485 		rc = -EIO;
486 		goto out;
487 	}
488 
489 	/* copy the generated secure key token */
490 	memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
491 
492 out:
493 	free_cprbmem(mem, PARMBSIZE, false, xflags);
494 	return rc;
495 }
496 EXPORT_SYMBOL(cca_genseckey);
497 
498 /*
499  * Generate an CCA AES DATA secure key with given key value.
500  */
501 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize,
502 		   const u8 *clrkey, u8 *seckey, u32 xflags)
503 {
504 	int rc, keysize, seckeysize;
505 	u8 *mem, *ptr;
506 	struct CPRBX *preqcblk, *prepcblk;
507 	struct ica_xcRB xcrb;
508 	struct cmreqparm {
509 		u8  subfunc_code[2];
510 		u16 rule_array_len;
511 		char  rule_array[8];
512 		struct lv1 {
513 			u16 len;
514 			u8  clrkey[];
515 		} lv1;
516 		/* followed by struct lv2 */
517 	} __packed * preqparm;
518 	struct lv2 {
519 		u16 len;
520 		struct keyid {
521 			u16 len;
522 			u16 attr;
523 			u8  data[SECKEYBLOBSIZE];
524 		} keyid;
525 	} __packed * plv2;
526 	struct cmrepparm {
527 		u8  subfunc_code[2];
528 		u16 rule_array_len;
529 		struct lv3 {
530 			u16 len;
531 			u16 keyblocklen;
532 			struct {
533 				u16 toklen;
534 				u16 tokattr;
535 				u8  tok[];
536 				/* ... some more data ... */
537 			} keyblock;
538 		} lv3;
539 	} __packed * prepparm;
540 
541 	/* get already prepared memory for 2 cprbs with param block each */
542 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
543 				    &preqcblk, &prepcblk, xflags);
544 	if (rc)
545 		return rc;
546 
547 	/* fill request cprb struct */
548 	preqcblk->domain = domain;
549 
550 	/* fill request cprb param block with CM request */
551 	preqparm = (struct cmreqparm __force *)preqcblk->req_parmb;
552 	memcpy(preqparm->subfunc_code, "CM", 2);
553 	memcpy(preqparm->rule_array, "AES     ", 8);
554 	preqparm->rule_array_len =
555 		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
556 	switch (keybitsize) {
557 	case PKEY_SIZE_AES_128:
558 	case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
559 		keysize = 16;
560 		break;
561 	case PKEY_SIZE_AES_192:
562 	case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
563 		keysize = 24;
564 		break;
565 	case PKEY_SIZE_AES_256:
566 	case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
567 		keysize = 32;
568 		break;
569 	default:
570 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
571 			       __func__, keybitsize);
572 		rc = -EINVAL;
573 		goto out;
574 	}
575 	preqparm->lv1.len = sizeof(struct lv1) + keysize;
576 	memcpy(preqparm->lv1.clrkey, clrkey, keysize);
577 	plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize);
578 	plv2->len = sizeof(struct lv2);
579 	plv2->keyid.len = sizeof(struct keyid);
580 	plv2->keyid.attr = 0x30;
581 	preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2);
582 
583 	/* fill xcrb struct */
584 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
585 
586 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
587 	rc = zcrypt_send_cprb(&xcrb, xflags);
588 	if (rc) {
589 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
590 			       __func__, (int)cardnr, (int)domain, rc);
591 		goto out;
592 	}
593 
594 	/* check response returncode and reasoncode */
595 	if (prepcblk->ccp_rtcode != 0) {
596 		ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n",
597 			       __func__,
598 			       (int)prepcblk->ccp_rtcode,
599 			       (int)prepcblk->ccp_rscode);
600 		rc = -EIO;
601 		goto out;
602 	}
603 
604 	/* process response cprb param block */
605 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
606 	prepcblk->rpl_parmb = (u8 __user *)ptr;
607 	prepparm = (struct cmrepparm *)ptr;
608 
609 	/* check length of the returned secure key token */
610 	seckeysize = prepparm->lv3.keyblock.toklen
611 		- sizeof(prepparm->lv3.keyblock.toklen)
612 		- sizeof(prepparm->lv3.keyblock.tokattr);
613 	if (seckeysize != SECKEYBLOBSIZE) {
614 		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
615 			       __func__, seckeysize, SECKEYBLOBSIZE);
616 		rc = -EIO;
617 		goto out;
618 	}
619 
620 	/* check secure key token */
621 	rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
622 				      prepparm->lv3.keyblock.tok,
623 				      seckeysize, 8 * keysize);
624 	if (rc) {
625 		rc = -EIO;
626 		goto out;
627 	}
628 
629 	/* copy the generated secure key token */
630 	if (seckey)
631 		memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
632 
633 out:
634 	free_cprbmem(mem, PARMBSIZE, true, xflags);
635 	return rc;
636 }
637 EXPORT_SYMBOL(cca_clr2seckey);
638 
639 /*
640  * Derive proteced key from an CCA AES DATA secure key.
641  */
642 int cca_sec2protkey(u16 cardnr, u16 domain,
643 		    const u8 *seckey, u8 *protkey, u32 *protkeylen,
644 		    u32 *protkeytype, u32 xflags)
645 {
646 	int rc;
647 	u8 *mem, *ptr;
648 	struct CPRBX *preqcblk, *prepcblk;
649 	struct ica_xcRB xcrb;
650 	struct uskreqparm {
651 		u8  subfunc_code[2];
652 		u16 rule_array_len;
653 		struct lv1 {
654 			u16 len;
655 			u16 attr_len;
656 			u16 attr_flags;
657 		} lv1;
658 		struct lv2 {
659 			u16 len;
660 			u16 attr_len;
661 			u16 attr_flags;
662 			u8  token[];	      /* cca secure key token */
663 		} lv2;
664 	} __packed * preqparm;
665 	struct uskrepparm {
666 		u8  subfunc_code[2];
667 		u16 rule_array_len;
668 		struct lv3 {
669 			u16 len;
670 			u16 attr_len;
671 			u16 attr_flags;
672 			struct cpacfkeyblock {
673 				u8  version;  /* version of this struct */
674 				u8  flags[2];
675 				u8  algo;
676 				u8  form;
677 				u8  pad1[3];
678 				u16 len;
679 				u8  key[64];  /* the key (len bytes) */
680 				u16 keyattrlen;
681 				u8  keyattr[32];
682 				u8  pad2[1];
683 				u8  vptype;
684 				u8  vp[32];  /* verification pattern */
685 			} ckb;
686 		} lv3;
687 	} __packed * prepparm;
688 
689 	/* get already prepared memory for 2 cprbs with param block each */
690 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
691 				    &preqcblk, &prepcblk, xflags);
692 	if (rc)
693 		return rc;
694 
695 	/* fill request cprb struct */
696 	preqcblk->domain = domain;
697 
698 	/* fill request cprb param block with USK request */
699 	preqparm = (struct uskreqparm __force *)preqcblk->req_parmb;
700 	memcpy(preqparm->subfunc_code, "US", 2);
701 	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
702 	preqparm->lv1.len = sizeof(struct lv1);
703 	preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
704 	preqparm->lv1.attr_flags = 0x0001;
705 	preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
706 	preqparm->lv2.attr_len = sizeof(struct lv2)
707 		- sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
708 	preqparm->lv2.attr_flags = 0x0000;
709 	memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
710 	preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
711 
712 	/* fill xcrb struct */
713 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
714 
715 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
716 	rc = zcrypt_send_cprb(&xcrb, xflags);
717 	if (rc) {
718 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
719 			       __func__, (int)cardnr, (int)domain, rc);
720 		goto out;
721 	}
722 
723 	/* check response returncode and reasoncode */
724 	if (prepcblk->ccp_rtcode != 0) {
725 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
726 			       __func__,
727 			       (int)prepcblk->ccp_rtcode,
728 			       (int)prepcblk->ccp_rscode);
729 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
730 			rc = -EBUSY;
731 		else
732 			rc = -EIO;
733 		goto out;
734 	}
735 	if (prepcblk->ccp_rscode != 0) {
736 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
737 				__func__,
738 				(int)prepcblk->ccp_rtcode,
739 				(int)prepcblk->ccp_rscode);
740 	}
741 
742 	/* process response cprb param block */
743 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
744 	prepcblk->rpl_parmb = (u8 __user *)ptr;
745 	prepparm = (struct uskrepparm *)ptr;
746 
747 	/* check the returned keyblock */
748 	if (prepparm->lv3.ckb.version != 0x01 &&
749 	    prepparm->lv3.ckb.version != 0x02) {
750 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
751 			       __func__, (int)prepparm->lv3.ckb.version);
752 		rc = -EIO;
753 		goto out;
754 	}
755 
756 	/* copy the translated protected key */
757 	switch (prepparm->lv3.ckb.len) {
758 	case 16 + 32:
759 		/* AES 128 protected key */
760 		if (protkeytype)
761 			*protkeytype = PKEY_KEYTYPE_AES_128;
762 		break;
763 	case 24 + 32:
764 		/* AES 192 protected key */
765 		if (protkeytype)
766 			*protkeytype = PKEY_KEYTYPE_AES_192;
767 		break;
768 	case 32 + 32:
769 		/* AES 256 protected key */
770 		if (protkeytype)
771 			*protkeytype = PKEY_KEYTYPE_AES_256;
772 		break;
773 	default:
774 		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
775 			       __func__, prepparm->lv3.ckb.len);
776 		rc = -EIO;
777 		goto out;
778 	}
779 	memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len);
780 	if (protkeylen)
781 		*protkeylen = prepparm->lv3.ckb.len;
782 
783 out:
784 	free_cprbmem(mem, PARMBSIZE, true, xflags);
785 	return rc;
786 }
787 EXPORT_SYMBOL(cca_sec2protkey);
788 
789 /*
790  * AES cipher key skeleton created with CSNBKTB2 with these flags:
791  * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY,
792  * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA
793  * used by cca_gencipherkey() and cca_clr2cipherkey().
794  */
795 static const u8 aes_cipher_key_skeleton[] = {
796 	0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00,
797 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
798 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
799 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
800 	0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
801 	0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff,
802 	0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 };
803 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton))
804 
805 /*
806  * Generate (random) CCA AES CIPHER secure key.
807  */
808 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
809 		     u8 *keybuf, u32 *keybufsize, u32 xflags)
810 {
811 	int rc;
812 	u8 *mem, *ptr;
813 	struct CPRBX *preqcblk, *prepcblk;
814 	struct ica_xcRB xcrb;
815 	struct gkreqparm {
816 		u8  subfunc_code[2];
817 		u16 rule_array_len;
818 		char rule_array[2 * 8];
819 		struct {
820 			u16 len;
821 			u8  key_type_1[8];
822 			u8  key_type_2[8];
823 			u16 clear_key_bit_len;
824 			u16 key_name_1_len;
825 			u16 key_name_2_len;
826 			u16 user_data_1_len;
827 			u16 user_data_2_len;
828 			/* u8  key_name_1[]; */
829 			/* u8  key_name_2[]; */
830 			/* u8  user_data_1[]; */
831 			/* u8  user_data_2[]; */
832 		} vud;
833 		struct {
834 			u16 len;
835 			struct {
836 				u16 len;
837 				u16 flag;
838 				/* u8  kek_id_1[]; */
839 			} tlv1;
840 			struct {
841 				u16 len;
842 				u16 flag;
843 				/* u8  kek_id_2[]; */
844 			} tlv2;
845 			struct {
846 				u16 len;
847 				u16 flag;
848 				u8  gen_key_id_1[SIZEOF_SKELETON];
849 			} tlv3;
850 			struct {
851 				u16 len;
852 				u16 flag;
853 				/* u8  gen_key_id_1_label[]; */
854 			} tlv4;
855 			struct {
856 				u16 len;
857 				u16 flag;
858 				/* u8  gen_key_id_2[]; */
859 			} tlv5;
860 			struct {
861 				u16 len;
862 				u16 flag;
863 				/* u8  gen_key_id_2_label[]; */
864 			} tlv6;
865 		} kb;
866 	} __packed * preqparm;
867 	struct gkrepparm {
868 		u8  subfunc_code[2];
869 		u16 rule_array_len;
870 		struct {
871 			u16 len;
872 		} vud;
873 		struct {
874 			u16 len;
875 			struct {
876 				u16 len;
877 				u16 flag;
878 				u8  gen_key[]; /* 120-136 bytes */
879 			} tlv1;
880 		} kb;
881 	} __packed * prepparm;
882 	struct cipherkeytoken *t;
883 	u32 keybuflen;
884 
885 	/* get already prepared memory for 2 cprbs with param block each */
886 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
887 				    &preqcblk, &prepcblk, xflags);
888 	if (rc)
889 		return rc;
890 
891 	/* fill request cprb struct */
892 	preqcblk->domain = domain;
893 	preqcblk->req_parml = sizeof(struct gkreqparm);
894 
895 	/* prepare request param block with GK request */
896 	preqparm = (struct gkreqparm __force *)preqcblk->req_parmb;
897 	memcpy(preqparm->subfunc_code, "GK", 2);
898 	preqparm->rule_array_len =  sizeof(uint16_t) + 2 * 8;
899 	memcpy(preqparm->rule_array, "AES     OP      ", 2 * 8);
900 
901 	/* prepare vud block */
902 	preqparm->vud.len = sizeof(preqparm->vud);
903 	switch (keybitsize) {
904 	case 128:
905 	case 192:
906 	case 256:
907 		break;
908 	default:
909 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
910 			       __func__, keybitsize);
911 		rc = -EINVAL;
912 		goto out;
913 	}
914 	preqparm->vud.clear_key_bit_len = keybitsize;
915 	memcpy(preqparm->vud.key_type_1, "TOKEN   ", 8);
916 	memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2));
917 
918 	/* prepare kb block */
919 	preqparm->kb.len = sizeof(preqparm->kb);
920 	preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1);
921 	preqparm->kb.tlv1.flag = 0x0030;
922 	preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2);
923 	preqparm->kb.tlv2.flag = 0x0030;
924 	preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3);
925 	preqparm->kb.tlv3.flag = 0x0030;
926 	memcpy(preqparm->kb.tlv3.gen_key_id_1,
927 	       aes_cipher_key_skeleton, SIZEOF_SKELETON);
928 	preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4);
929 	preqparm->kb.tlv4.flag = 0x0030;
930 	preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5);
931 	preqparm->kb.tlv5.flag = 0x0030;
932 	preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6);
933 	preqparm->kb.tlv6.flag = 0x0030;
934 
935 	/* patch the skeleton key token export flags inside the kb block */
936 	if (keygenflags) {
937 		t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1;
938 		t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
939 		t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
940 	}
941 
942 	/* prepare xcrb struct */
943 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
944 
945 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
946 	rc = zcrypt_send_cprb(&xcrb, xflags);
947 	if (rc) {
948 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
949 			       __func__, (int)cardnr, (int)domain, rc);
950 		goto out;
951 	}
952 
953 	/* check response returncode and reasoncode */
954 	if (prepcblk->ccp_rtcode != 0) {
955 		ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n",
956 			       __func__,
957 			       (int)prepcblk->ccp_rtcode,
958 			       (int)prepcblk->ccp_rscode);
959 		rc = -EIO;
960 		goto out;
961 	}
962 
963 	/* process response cprb param block */
964 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
965 	prepcblk->rpl_parmb = (u8 __user *)ptr;
966 	prepparm = (struct gkrepparm *)ptr;
967 
968 	/* do some plausibility checks on the key block */
969 	if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
970 	    prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
971 		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
972 			       __func__);
973 		rc = -EIO;
974 		goto out;
975 	}
976 
977 	/* and some checks on the generated key */
978 	t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key;
979 	if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) {
980 		rc = -EIO;
981 		goto out;
982 	}
983 	keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t);
984 	rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR,
985 				       prepparm->kb.tlv1.gen_key,
986 				       keybuflen, keybitsize, 1);
987 	if (rc) {
988 		rc = -EIO;
989 		goto out;
990 	}
991 
992 	/* copy the generated vlsc key token */
993 	if (keybuf) {
994 		if (*keybufsize >= keybuflen)
995 			memcpy(keybuf, t, keybuflen);
996 		else
997 			rc = -EINVAL;
998 	}
999 	*keybufsize = keybuflen;
1000 
1001 out:
1002 	free_cprbmem(mem, PARMBSIZE, false, xflags);
1003 	return rc;
1004 }
1005 EXPORT_SYMBOL(cca_gencipherkey);
1006 
1007 /*
1008  * Helper function, does a the CSNBKPI2 CPRB.
1009  */
1010 static int _ip_cprb_helper(u16 cardnr, u16 domain,
1011 			   const char *rule_array_1,
1012 			   const char *rule_array_2,
1013 			   const char *rule_array_3,
1014 			   const u8 *clr_key_value,
1015 			   int clr_key_bit_size,
1016 			   u8 *key_token,
1017 			   int *key_token_size,
1018 			   u32 xflags,
1019 			   bool scrub)
1020 {
1021 	int rc, n;
1022 	u8 *mem, *ptr;
1023 	struct CPRBX *preqcblk, *prepcblk;
1024 	struct ica_xcRB xcrb;
1025 	struct rule_array_block {
1026 		u8  subfunc_code[2];
1027 		u16 rule_array_len;
1028 		char rule_array[];
1029 	} __packed * preq_ra_block;
1030 	struct vud_block {
1031 		u16 len;
1032 		struct {
1033 			u16 len;
1034 			u16 flag;	     /* 0x0064 */
1035 			u16 clr_key_bit_len;
1036 		} tlv1;
1037 		struct {
1038 			u16 len;
1039 			u16 flag;	/* 0x0063 */
1040 			u8  clr_key[];	/* clear key value bytes */
1041 		} tlv2;
1042 	} __packed * preq_vud_block;
1043 	struct key_block {
1044 		u16 len;
1045 		struct {
1046 			u16 len;
1047 			u16 flag;	  /* 0x0030 */
1048 			u8  key_token[];  /* key skeleton */
1049 		} tlv1;
1050 	} __packed * preq_key_block;
1051 	struct iprepparm {
1052 		u8  subfunc_code[2];
1053 		u16 rule_array_len;
1054 		struct {
1055 			u16 len;
1056 		} vud;
1057 		struct {
1058 			u16 len;
1059 			struct {
1060 				u16 len;
1061 				u16 flag;	  /* 0x0030 */
1062 				u8  key_token[];  /* key token */
1063 			} tlv1;
1064 		} kb;
1065 	} __packed * prepparm;
1066 	struct cipherkeytoken *t;
1067 	int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1;
1068 
1069 	/* get already prepared memory for 2 cprbs with param block each */
1070 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1071 				    &preqcblk, &prepcblk, xflags);
1072 	if (rc)
1073 		return rc;
1074 
1075 	/* fill request cprb struct */
1076 	preqcblk->domain = domain;
1077 	preqcblk->req_parml = 0;
1078 
1079 	/* prepare request param block with IP request */
1080 	preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb;
1081 	memcpy(preq_ra_block->subfunc_code, "IP", 2);
1082 	preq_ra_block->rule_array_len =  sizeof(uint16_t) + 2 * 8;
1083 	memcpy(preq_ra_block->rule_array, rule_array_1, 8);
1084 	memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8);
1085 	preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8;
1086 	if (rule_array_3) {
1087 		preq_ra_block->rule_array_len += 8;
1088 		memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8);
1089 		preqcblk->req_parml += 8;
1090 	}
1091 
1092 	/* prepare vud block */
1093 	preq_vud_block = (struct vud_block __force *)
1094 		(preqcblk->req_parmb + preqcblk->req_parml);
1095 	n = complete ? 0 : (clr_key_bit_size + 7) / 8;
1096 	preq_vud_block->len = sizeof(struct vud_block) + n;
1097 	preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1);
1098 	preq_vud_block->tlv1.flag = 0x0064;
1099 	preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size;
1100 	preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n;
1101 	preq_vud_block->tlv2.flag = 0x0063;
1102 	if (!complete)
1103 		memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n);
1104 	preqcblk->req_parml += preq_vud_block->len;
1105 
1106 	/* prepare key block */
1107 	preq_key_block = (struct key_block __force *)
1108 		(preqcblk->req_parmb + preqcblk->req_parml);
1109 	n = *key_token_size;
1110 	preq_key_block->len = sizeof(struct key_block) + n;
1111 	preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n;
1112 	preq_key_block->tlv1.flag = 0x0030;
1113 	memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size);
1114 	preqcblk->req_parml += preq_key_block->len;
1115 
1116 	/* prepare xcrb struct */
1117 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1118 
1119 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1120 	rc = zcrypt_send_cprb(&xcrb, xflags);
1121 	if (rc) {
1122 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1123 			       __func__, (int)cardnr, (int)domain, rc);
1124 		goto out;
1125 	}
1126 
1127 	/* check response returncode and reasoncode */
1128 	if (prepcblk->ccp_rtcode != 0) {
1129 		ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n",
1130 			       __func__,
1131 			       (int)prepcblk->ccp_rtcode,
1132 			       (int)prepcblk->ccp_rscode);
1133 		rc = -EIO;
1134 		goto out;
1135 	}
1136 
1137 	/* process response cprb param block */
1138 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1139 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1140 	prepparm = (struct iprepparm *)ptr;
1141 
1142 	/* do some plausibility checks on the key block */
1143 	if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
1144 	    prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
1145 		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
1146 			       __func__);
1147 		rc = -EIO;
1148 		goto out;
1149 	}
1150 
1151 	/* do not check the key here, it may be incomplete */
1152 
1153 	/* copy the vlsc key token back */
1154 	t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
1155 	memcpy(key_token, t, t->len);
1156 	*key_token_size = t->len;
1157 
1158 out:
1159 	free_cprbmem(mem, PARMBSIZE, scrub, xflags);
1160 	return rc;
1161 }
1162 
1163 /*
1164  * Build CCA AES CIPHER secure key with a given clear key value.
1165  */
1166 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
1167 		      const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags)
1168 {
1169 	int rc;
1170 	void *mem;
1171 	int tokensize;
1172 	u8 *token, exorbuf[32];
1173 	struct cipherkeytoken *t;
1174 
1175 	/* fill exorbuf with random data */
1176 	get_random_bytes(exorbuf, sizeof(exorbuf));
1177 
1178 	/*
1179 	 * Allocate space for the key token to build.
1180 	 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this
1181 	 * we use the already existing cprb mempool to solve this
1182 	 * short term memory requirement.
1183 	 */
1184 	mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1185 		mempool_alloc_preallocated(cprb_mempool) :
1186 		mempool_alloc(cprb_mempool, GFP_KERNEL);
1187 	if (!mem)
1188 		return -ENOMEM;
1189 
1190 	/* prepare the token with the key skeleton */
1191 	token = (u8 *)mem;
1192 	tokensize = SIZEOF_SKELETON;
1193 	memcpy(token, aes_cipher_key_skeleton, tokensize);
1194 
1195 	/* patch the skeleton key token export flags */
1196 	if (keygenflags) {
1197 		t = (struct cipherkeytoken *)token;
1198 		t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
1199 		t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
1200 	}
1201 
1202 	/*
1203 	 * Do the key import with the clear key value in 4 steps:
1204 	 * 1/4 FIRST import with only random data
1205 	 * 2/4 EXOR the clear key
1206 	 * 3/4 EXOR the very same random data again
1207 	 * 4/4 COMPLETE the secure cipher key import
1208 	 */
1209 	rc = _ip_cprb_helper(card, dom, "AES     ", "FIRST   ", "MIN3PART",
1210 			     exorbuf, keybitsize, token, &tokensize,
1211 			     xflags, true);
1212 	if (rc) {
1213 		ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
1214 			       __func__, rc);
1215 		goto out;
1216 	}
1217 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1218 			     clrkey, keybitsize, token, &tokensize,
1219 			     xflags, true);
1220 	if (rc) {
1221 		ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
1222 			       __func__, rc);
1223 		goto out;
1224 	}
1225 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1226 			     exorbuf, keybitsize, token, &tokensize,
1227 			     xflags, true);
1228 	if (rc) {
1229 		ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
1230 			       __func__, rc);
1231 		goto out;
1232 	}
1233 	rc = _ip_cprb_helper(card, dom, "AES     ", "COMPLETE", NULL,
1234 			     NULL, keybitsize, token, &tokensize,
1235 			     xflags, true);
1236 	if (rc) {
1237 		ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
1238 			       __func__, rc);
1239 		goto out;
1240 	}
1241 
1242 	/* copy the generated key token */
1243 	if (keybuf) {
1244 		if (tokensize > *keybufsize)
1245 			rc = -EINVAL;
1246 		else
1247 			memcpy(keybuf, token, tokensize);
1248 	}
1249 	*keybufsize = tokensize;
1250 
1251 out:
1252 	memzero_explicit(exorbuf, sizeof(exorbuf));
1253 	memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE);
1254 	mempool_free(mem, cprb_mempool);
1255 	return rc;
1256 }
1257 EXPORT_SYMBOL(cca_clr2cipherkey);
1258 
1259 /*
1260  * Derive proteced key from CCA AES cipher secure key.
1261  */
1262 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
1263 		       u8 *protkey, u32 *protkeylen, u32 *protkeytype,
1264 		       u32 xflags)
1265 {
1266 	int rc;
1267 	u8 *mem, *ptr;
1268 	struct CPRBX *preqcblk, *prepcblk;
1269 	struct ica_xcRB xcrb;
1270 	struct aureqparm {
1271 		u8  subfunc_code[2];
1272 		u16 rule_array_len;
1273 		u8  rule_array[8];
1274 		struct {
1275 			u16 len;
1276 			u16 tk_blob_len;
1277 			u16 tk_blob_tag;
1278 			u8  tk_blob[66];
1279 		} vud;
1280 		struct {
1281 			u16 len;
1282 			u16 cca_key_token_len;
1283 			u16 cca_key_token_flags;
1284 			u8  cca_key_token[]; /* 64 or more */
1285 		} kb;
1286 	} __packed * preqparm;
1287 	struct aurepparm {
1288 		u8  subfunc_code[2];
1289 		u16 rule_array_len;
1290 		struct {
1291 			u16 len;
1292 			u16 sublen;
1293 			u16 tag;
1294 			struct cpacfkeyblock {
1295 				u8  version;  /* version of this struct */
1296 				u8  flags[2];
1297 				u8  algo;
1298 				u8  form;
1299 				u8  pad1[3];
1300 				u16 keylen;
1301 				u8  key[64];  /* the key (keylen bytes) */
1302 				u16 keyattrlen;
1303 				u8  keyattr[32];
1304 				u8  pad2[1];
1305 				u8  vptype;
1306 				u8  vp[32];  /* verification pattern */
1307 			} ckb;
1308 		} vud;
1309 		struct {
1310 			u16 len;
1311 		} kb;
1312 	} __packed * prepparm;
1313 	int keytoklen = ((struct cipherkeytoken *)ckey)->len;
1314 
1315 	if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
1316 		return -EINVAL;
1317 
1318 	/* get already prepared memory for 2 cprbs with param block each */
1319 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1320 				    &preqcblk, &prepcblk, xflags);
1321 	if (rc)
1322 		return rc;
1323 
1324 	/* fill request cprb struct */
1325 	preqcblk->domain = domain;
1326 
1327 	/* fill request cprb param block with AU request */
1328 	preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1329 	memcpy(preqparm->subfunc_code, "AU", 2);
1330 	preqparm->rule_array_len =
1331 		sizeof(preqparm->rule_array_len)
1332 		+ sizeof(preqparm->rule_array);
1333 	memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1334 	/* vud, tk blob */
1335 	preqparm->vud.len = sizeof(preqparm->vud);
1336 	preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1337 		+ 2 * sizeof(uint16_t);
1338 	preqparm->vud.tk_blob_tag = 0x00C2;
1339 	/* kb, cca token */
1340 	preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t);
1341 	preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t);
1342 	memcpy(preqparm->kb.cca_key_token, ckey, keytoklen);
1343 	/* now fill length of param block into cprb */
1344 	preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen;
1345 
1346 	/* fill xcrb struct */
1347 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1348 
1349 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1350 	rc = zcrypt_send_cprb(&xcrb, xflags);
1351 	if (rc) {
1352 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1353 			       __func__, (int)cardnr, (int)domain, rc);
1354 		goto out;
1355 	}
1356 
1357 	/* check response returncode and reasoncode */
1358 	if (prepcblk->ccp_rtcode != 0) {
1359 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1360 			       __func__,
1361 			       (int)prepcblk->ccp_rtcode,
1362 			       (int)prepcblk->ccp_rscode);
1363 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1364 			rc = -EBUSY;
1365 		else
1366 			rc = -EIO;
1367 		goto out;
1368 	}
1369 	if (prepcblk->ccp_rscode != 0) {
1370 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1371 				__func__,
1372 				(int)prepcblk->ccp_rtcode,
1373 				(int)prepcblk->ccp_rscode);
1374 	}
1375 
1376 	/* process response cprb param block */
1377 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1378 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1379 	prepparm = (struct aurepparm *)ptr;
1380 
1381 	/* check the returned keyblock */
1382 	if (prepparm->vud.ckb.version != 0x01 &&
1383 	    prepparm->vud.ckb.version != 0x02) {
1384 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
1385 			       __func__, (int)prepparm->vud.ckb.version);
1386 		rc = -EIO;
1387 		goto out;
1388 	}
1389 	if (prepparm->vud.ckb.algo != 0x02) {
1390 		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
1391 			       __func__, (int)prepparm->vud.ckb.algo);
1392 		rc = -EIO;
1393 		goto out;
1394 	}
1395 
1396 	/* copy the translated protected key */
1397 	switch (prepparm->vud.ckb.keylen) {
1398 	case 16 + 32:
1399 		/* AES 128 protected key */
1400 		if (protkeytype)
1401 			*protkeytype = PKEY_KEYTYPE_AES_128;
1402 		break;
1403 	case 24 + 32:
1404 		/* AES 192 protected key */
1405 		if (protkeytype)
1406 			*protkeytype = PKEY_KEYTYPE_AES_192;
1407 		break;
1408 	case 32 + 32:
1409 		/* AES 256 protected key */
1410 		if (protkeytype)
1411 			*protkeytype = PKEY_KEYTYPE_AES_256;
1412 		break;
1413 	default:
1414 		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
1415 			       __func__, prepparm->vud.ckb.keylen);
1416 		rc = -EIO;
1417 		goto out;
1418 	}
1419 	memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1420 	if (protkeylen)
1421 		*protkeylen = prepparm->vud.ckb.keylen;
1422 
1423 out:
1424 	free_cprbmem(mem, PARMBSIZE, true, xflags);
1425 	return rc;
1426 }
1427 EXPORT_SYMBOL(cca_cipher2protkey);
1428 
1429 /*
1430  * Derive protected key from CCA ECC secure private key.
1431  */
1432 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
1433 		    u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags)
1434 {
1435 	int rc;
1436 	u8 *mem, *ptr;
1437 	struct CPRBX *preqcblk, *prepcblk;
1438 	struct ica_xcRB xcrb;
1439 	struct aureqparm {
1440 		u8  subfunc_code[2];
1441 		u16 rule_array_len;
1442 		u8  rule_array[8];
1443 		struct {
1444 			u16 len;
1445 			u16 tk_blob_len;
1446 			u16 tk_blob_tag;
1447 			u8  tk_blob[66];
1448 		} vud;
1449 		struct {
1450 			u16 len;
1451 			u16 cca_key_token_len;
1452 			u16 cca_key_token_flags;
1453 			u8  cca_key_token[];
1454 		} kb;
1455 	} __packed * preqparm;
1456 	struct aurepparm {
1457 		u8  subfunc_code[2];
1458 		u16 rule_array_len;
1459 		struct {
1460 			u16 len;
1461 			u16 sublen;
1462 			u16 tag;
1463 			struct cpacfkeyblock {
1464 				u8  version;  /* version of this struct */
1465 				u8  flags[2];
1466 				u8  algo;
1467 				u8  form;
1468 				u8  pad1[3];
1469 				u16 keylen;
1470 				u8  key[];  /* the key (keylen bytes) */
1471 				/* u16 keyattrlen; */
1472 				/* u8  keyattr[32]; */
1473 				/* u8  pad2[1]; */
1474 				/* u8  vptype; */
1475 				/* u8  vp[32];	verification pattern */
1476 			} ckb;
1477 		} vud;
1478 		/* followed by a key block */
1479 	} __packed * prepparm;
1480 	int keylen = ((struct eccprivkeytoken *)key)->len;
1481 
1482 	if (keylen > PARMBSIZE - sizeof(struct aureqparm))
1483 		return -EINVAL;
1484 
1485 	/* get already prepared memory for 2 cprbs with param block each */
1486 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1487 				    &preqcblk, &prepcblk, xflags);
1488 	if (rc)
1489 		return rc;
1490 
1491 	/* fill request cprb struct */
1492 	preqcblk->domain = domain;
1493 
1494 	/* fill request cprb param block with AU request */
1495 	preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1496 	memcpy(preqparm->subfunc_code, "AU", 2);
1497 	preqparm->rule_array_len =
1498 		sizeof(preqparm->rule_array_len)
1499 		+ sizeof(preqparm->rule_array);
1500 	memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1501 	/* vud, tk blob */
1502 	preqparm->vud.len = sizeof(preqparm->vud);
1503 	preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1504 		+ 2 * sizeof(uint16_t);
1505 	preqparm->vud.tk_blob_tag = 0x00C2;
1506 	/* kb, cca token */
1507 	preqparm->kb.len = keylen + 3 * sizeof(uint16_t);
1508 	preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t);
1509 	memcpy(preqparm->kb.cca_key_token, key, keylen);
1510 	/* now fill length of param block into cprb */
1511 	preqcblk->req_parml = sizeof(struct aureqparm) + keylen;
1512 
1513 	/* fill xcrb struct */
1514 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1515 
1516 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1517 	rc = zcrypt_send_cprb(&xcrb, xflags);
1518 	if (rc) {
1519 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1520 			       __func__, (int)cardnr, (int)domain, rc);
1521 		goto out;
1522 	}
1523 
1524 	/* check response returncode and reasoncode */
1525 	if (prepcblk->ccp_rtcode != 0) {
1526 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1527 			       __func__,
1528 			       (int)prepcblk->ccp_rtcode,
1529 			       (int)prepcblk->ccp_rscode);
1530 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1531 			rc = -EBUSY;
1532 		else
1533 			rc = -EIO;
1534 		goto out;
1535 	}
1536 	if (prepcblk->ccp_rscode != 0) {
1537 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1538 				__func__,
1539 				(int)prepcblk->ccp_rtcode,
1540 				(int)prepcblk->ccp_rscode);
1541 	}
1542 
1543 	/* process response cprb param block */
1544 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1545 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1546 	prepparm = (struct aurepparm *)ptr;
1547 
1548 	/* check the returned keyblock */
1549 	if (prepparm->vud.ckb.version != 0x02) {
1550 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
1551 			       __func__, (int)prepparm->vud.ckb.version);
1552 		rc = -EIO;
1553 		goto out;
1554 	}
1555 	if (prepparm->vud.ckb.algo != 0x81) {
1556 		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
1557 			       __func__, (int)prepparm->vud.ckb.algo);
1558 		rc = -EIO;
1559 		goto out;
1560 	}
1561 
1562 	/* copy the translated protected key */
1563 	if (prepparm->vud.ckb.keylen > *protkeylen) {
1564 		ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n",
1565 			       __func__, prepparm->vud.ckb.keylen, *protkeylen);
1566 		rc = -EIO;
1567 		goto out;
1568 	}
1569 	memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1570 	*protkeylen = prepparm->vud.ckb.keylen;
1571 	if (protkeytype)
1572 		*protkeytype = PKEY_KEYTYPE_ECC;
1573 
1574 out:
1575 	free_cprbmem(mem, PARMBSIZE, true, xflags);
1576 	return rc;
1577 }
1578 EXPORT_SYMBOL(cca_ecc2protkey);
1579 
1580 /*
1581  * query cryptographic facility from CCA adapter
1582  */
1583 int cca_query_crypto_facility(u16 cardnr, u16 domain,
1584 			      const char *keyword,
1585 			      u8 *rarray, size_t *rarraylen,
1586 			      u8 *varray, size_t *varraylen,
1587 			      u32 xflags)
1588 {
1589 	int rc;
1590 	u16 len;
1591 	u8 *mem, *ptr;
1592 	struct CPRBX *preqcblk, *prepcblk;
1593 	struct ica_xcRB xcrb;
1594 	struct fqreqparm {
1595 		u8  subfunc_code[2];
1596 		u16 rule_array_len;
1597 		char  rule_array[8];
1598 		struct lv1 {
1599 			u16 len;
1600 			u8  data[VARDATASIZE];
1601 		} lv1;
1602 		u16 dummylen;
1603 	} __packed * preqparm;
1604 	size_t parmbsize = sizeof(struct fqreqparm);
1605 	struct fqrepparm {
1606 		u8  subfunc_code[2];
1607 		u8  lvdata[];
1608 	} __packed * prepparm;
1609 
1610 	/* get already prepared memory for 2 cprbs with param block each */
1611 	rc = alloc_and_prep_cprbmem(parmbsize, &mem,
1612 				    &preqcblk, &prepcblk, xflags);
1613 	if (rc)
1614 		return rc;
1615 
1616 	/* fill request cprb struct */
1617 	preqcblk->domain = domain;
1618 
1619 	/* fill request cprb param block with FQ request */
1620 	preqparm = (struct fqreqparm __force *)preqcblk->req_parmb;
1621 	memcpy(preqparm->subfunc_code, "FQ", 2);
1622 	memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
1623 	preqparm->rule_array_len =
1624 		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
1625 	preqparm->lv1.len = sizeof(preqparm->lv1);
1626 	preqparm->dummylen = sizeof(preqparm->dummylen);
1627 	preqcblk->req_parml = parmbsize;
1628 
1629 	/* fill xcrb struct */
1630 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1631 
1632 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1633 	rc = zcrypt_send_cprb(&xcrb, xflags);
1634 	if (rc) {
1635 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1636 			       __func__, (int)cardnr, (int)domain, rc);
1637 		goto out;
1638 	}
1639 
1640 	/* check response returncode and reasoncode */
1641 	if (prepcblk->ccp_rtcode != 0) {
1642 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1643 			       __func__,
1644 			       (int)prepcblk->ccp_rtcode,
1645 			       (int)prepcblk->ccp_rscode);
1646 		rc = -EIO;
1647 		goto out;
1648 	}
1649 
1650 	/* process response cprb param block */
1651 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1652 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1653 	prepparm = (struct fqrepparm *)ptr;
1654 	ptr = prepparm->lvdata;
1655 
1656 	/* check and possibly copy reply rule array */
1657 	len = *((u16 *)ptr);
1658 	if (len > sizeof(u16)) {
1659 		ptr += sizeof(u16);
1660 		len -= sizeof(u16);
1661 		if (rarray && rarraylen && *rarraylen > 0) {
1662 			*rarraylen = (len > *rarraylen ? *rarraylen : len);
1663 			memcpy(rarray, ptr, *rarraylen);
1664 		}
1665 		ptr += len;
1666 	}
1667 	/* check and possible copy reply var array */
1668 	len = *((u16 *)ptr);
1669 	if (len > sizeof(u16)) {
1670 		ptr += sizeof(u16);
1671 		len -= sizeof(u16);
1672 		if (varray && varraylen && *varraylen > 0) {
1673 			*varraylen = (len > *varraylen ? *varraylen : len);
1674 			memcpy(varray, ptr, *varraylen);
1675 		}
1676 		ptr += len;
1677 	}
1678 
1679 out:
1680 	free_cprbmem(mem, parmbsize, false, xflags);
1681 	return rc;
1682 }
1683 EXPORT_SYMBOL(cca_query_crypto_facility);
1684 
1685 /*
1686  * Fetch cca_info values about a CCA queue via
1687  * query_crypto_facility from adapter.
1688  */
1689 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags)
1690 {
1691 	void *mem;
1692 	int rc, found = 0;
1693 	size_t rlen, vlen;
1694 	u8 *rarray, *varray;
1695 	struct zcrypt_device_status_ext devstat;
1696 
1697 	memset(ci, 0, sizeof(*ci));
1698 
1699 	/* if specific domain given, fetch status and hw info for this apqn */
1700 	if (domain != AUTOSEL_DOM) {
1701 		rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
1702 		if (rc)
1703 			return rc;
1704 		ci->hwtype = devstat.hwtype;
1705 	}
1706 
1707 	/*
1708 	 * Prep memory for rule array and var array use.
1709 	 * Use the cprb mempool for this.
1710 	 */
1711 	mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1712 		mempool_alloc_preallocated(cprb_mempool) :
1713 		mempool_alloc(cprb_mempool, GFP_KERNEL);
1714 	if (!mem)
1715 		return -ENOMEM;
1716 	rarray = (u8 *)mem;
1717 	varray = (u8 *)mem + PAGE_SIZE / 2;
1718 	rlen = vlen = PAGE_SIZE / 2;
1719 
1720 	/* QF for this card/domain */
1721 	rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
1722 				       rarray, &rlen, varray, &vlen, xflags);
1723 	if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) {
1724 		memcpy(ci->serial, rarray, 8);
1725 		ci->new_asym_mk_state = (char)rarray[4 * 8];
1726 		ci->cur_asym_mk_state = (char)rarray[5 * 8];
1727 		ci->old_asym_mk_state = (char)rarray[6 * 8];
1728 		if (ci->old_asym_mk_state == '2')
1729 			memcpy(ci->old_asym_mkvp, varray + 64, 16);
1730 		if (ci->cur_asym_mk_state == '2')
1731 			memcpy(ci->cur_asym_mkvp, varray + 84, 16);
1732 		if (ci->new_asym_mk_state == '3')
1733 			memcpy(ci->new_asym_mkvp, varray + 104, 16);
1734 		ci->new_aes_mk_state = (char)rarray[7 * 8];
1735 		ci->cur_aes_mk_state = (char)rarray[8 * 8];
1736 		ci->old_aes_mk_state = (char)rarray[9 * 8];
1737 		if (ci->old_aes_mk_state == '2')
1738 			memcpy(&ci->old_aes_mkvp, varray + 172, 8);
1739 		if (ci->cur_aes_mk_state == '2')
1740 			memcpy(&ci->cur_aes_mkvp, varray + 184, 8);
1741 		if (ci->new_aes_mk_state == '3')
1742 			memcpy(&ci->new_aes_mkvp, varray + 196, 8);
1743 		found++;
1744 	}
1745 	if (!found)
1746 		goto out;
1747 	rlen = vlen = PAGE_SIZE / 2;
1748 	rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
1749 				       rarray, &rlen, varray, &vlen, xflags);
1750 	if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) {
1751 		ci->new_apka_mk_state = (char)rarray[10 * 8];
1752 		ci->cur_apka_mk_state = (char)rarray[11 * 8];
1753 		ci->old_apka_mk_state = (char)rarray[12 * 8];
1754 		if (ci->old_apka_mk_state == '2')
1755 			memcpy(&ci->old_apka_mkvp, varray + 208, 8);
1756 		if (ci->cur_apka_mk_state == '2')
1757 			memcpy(&ci->cur_apka_mkvp, varray + 220, 8);
1758 		if (ci->new_apka_mk_state == '3')
1759 			memcpy(&ci->new_apka_mkvp, varray + 232, 8);
1760 		found++;
1761 	}
1762 
1763 out:
1764 	mempool_free(mem, cprb_mempool);
1765 	return found == 2 ? 0 : -ENOENT;
1766 }
1767 EXPORT_SYMBOL(cca_get_info);
1768 
1769 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
1770 		  int minhwtype, int mktype,
1771 		  const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags)
1772 {
1773 	struct zcrypt_device_status_ext *device_status;
1774 	int i, card, dom, curmatch, oldmatch;
1775 	struct cca_info ci;
1776 	u32 _nr_apqns = 0;
1777 
1778 	/* occupy the device status memory */
1779 	mutex_lock(&dev_status_mem_mutex);
1780 	memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE);
1781 	device_status = (struct zcrypt_device_status_ext *)dev_status_mem;
1782 
1783 	/* fetch crypto device status into this struct */
1784 	zcrypt_device_status_mask_ext(device_status,
1785 				      ZCRYPT_DEV_STATUS_CARD_MAX,
1786 				      ZCRYPT_DEV_STATUS_QUEUE_MAX);
1787 
1788 	/* walk through all the crypto apqnss */
1789 	for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) {
1790 		card = AP_QID_CARD(device_status[i].qid);
1791 		dom = AP_QID_QUEUE(device_status[i].qid);
1792 		/* check online state */
1793 		if (!device_status[i].online)
1794 			continue;
1795 		/* check for cca functions */
1796 		if (!(device_status[i].functions & 0x04))
1797 			continue;
1798 		/* check cardnr */
1799 		if (cardnr != 0xFFFF && card != cardnr)
1800 			continue;
1801 		/* check domain */
1802 		if (domain != 0xFFFF && dom != domain)
1803 			continue;
1804 		/* get cca info on this apqn */
1805 		if (cca_get_info(card, dom, &ci, xflags))
1806 			continue;
1807 		/* current master key needs to be valid */
1808 		if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2')
1809 			continue;
1810 		if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2')
1811 			continue;
1812 		/* check min hardware type */
1813 		if (minhwtype > 0 && minhwtype > ci.hwtype)
1814 			continue;
1815 		if (ptr_cur_mkvp || ptr_old_mkvp) {
1816 			/* check mkvps */
1817 			curmatch = oldmatch = 0;
1818 			if (mktype == AES_MK_SET) {
1819 				if (ptr_cur_mkvp &&
1820 				    !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp,
1821 					    sizeof(ci.cur_aes_mkvp)))
1822 					curmatch = 1;
1823 				if (ptr_old_mkvp &&
1824 				    ci.old_aes_mk_state == '2' &&
1825 				    !memcmp(ptr_old_mkvp, ci.old_aes_mkvp,
1826 					    sizeof(ci.old_aes_mkvp)))
1827 					oldmatch = 1;
1828 			} else {
1829 				if (ptr_cur_mkvp &&
1830 				    !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp,
1831 					    sizeof(ci.cur_apka_mkvp)))
1832 					curmatch = 1;
1833 				if (ptr_old_mkvp &&
1834 				    ci.old_apka_mk_state == '2' &&
1835 				    !memcmp(ptr_old_mkvp, ci.old_apka_mkvp,
1836 					    sizeof(ci.old_apka_mkvp)))
1837 					oldmatch = 1;
1838 			}
1839 			if (curmatch + oldmatch < 1)
1840 				continue;
1841 		}
1842 		/* apqn passed all filtering criterons, add to the array */
1843 		if (_nr_apqns < *nr_apqns)
1844 			apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom);
1845 	}
1846 
1847 	*nr_apqns = _nr_apqns;
1848 
1849 	/* release the device status memory */
1850 	mutex_unlock(&dev_status_mem_mutex);
1851 
1852 	return _nr_apqns ? 0 : -ENODEV;
1853 }
1854 EXPORT_SYMBOL(cca_findcard2);
1855 
1856 int __init zcrypt_ccamisc_init(void)
1857 {
1858 	/* Pre-allocate a small memory pool for cca cprbs. */
1859 	cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold,
1860 						   CPRB_MEMPOOL_ITEM_SIZE);
1861 	if (!cprb_mempool)
1862 		return -ENOMEM;
1863 
1864 	/* Pre-allocate one crypto status card struct used in findcard() */
1865 	dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL);
1866 	if (!dev_status_mem) {
1867 		mempool_destroy(cprb_mempool);
1868 		return -ENOMEM;
1869 	}
1870 
1871 	return 0;
1872 }
1873 
1874 void zcrypt_ccamisc_exit(void)
1875 {
1876 	mutex_lock(&dev_status_mem_mutex);
1877 	kvfree(dev_status_mem);
1878 	mutex_unlock(&dev_status_mem_mutex);
1879 	mempool_destroy(cprb_mempool);
1880 }
1881