xref: /linux/drivers/s390/crypto/zcrypt_ccamisc.c (revision c36461825469a9ceee2346a2e89286c522525da7)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  *  Copyright IBM Corp. 2019
4  *  Author(s): Harald Freudenberger <freude@linux.ibm.com>
5  *	       Ingo Franzki <ifranzki@linux.ibm.com>
6  *
7  *  Collection of CCA misc functions used by zcrypt and pkey
8  */
9 
10 #define pr_fmt(fmt) "zcrypt: " fmt
11 
12 #include <linux/export.h>
13 #include <linux/init.h>
14 #include <linux/mempool.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/random.h>
18 #include <linux/align.h>
19 #include <asm/zcrypt.h>
20 #include <asm/pkey.h>
21 
22 #include "ap_bus.h"
23 #include "zcrypt_api.h"
24 #include "zcrypt_debug.h"
25 #include "zcrypt_msgtype6.h"
26 #include "zcrypt_ccamisc.h"
27 
28 /* Size of parameter block used for all cca requests/replies */
29 #define PARMBSIZE 512
30 
31 /* Size of vardata block used for some of the cca requests/replies */
32 #define VARDATASIZE 4096
33 
34 /*
35  * Cprb memory pool held for urgent cases where no memory
36  * can be allocated via kmalloc. This pool is only used
37  * when alloc_and_prep_cprbmem() is called with the xflag
38  * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold
39  * space for request AND reply!
40  */
41 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024)
42 static mempool_t *cprb_mempool;
43 
44 /*
45  * This is a pre-allocated memory for the device status array
46  * used within the findcard() functions. It is currently
47  * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is
48  * controlled via dev_status_mem_mutex. Needs adaption if more
49  * than 128 cards or domains to be are supported.
50  */
51 #define ZCRYPT_DEV_STATUS_CARD_MAX 128
52 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128
53 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \
54 				   ZCRYPT_DEV_STATUS_QUEUE_MAX)
55 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \
56 		sizeof(struct zcrypt_device_status_ext))
57 static void *dev_status_mem;
58 static DEFINE_MUTEX(dev_status_mem_mutex);
59 
60 /*
61  * Simple check if the token is a valid CCA secure AES data key
62  * token. If keybitsize is given, the bitsize of the key is
63  * also checked. Returns 0 on success or errno value on failure.
64  */
65 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
66 			     const u8 *token, u32 keysize, int keybitsize)
67 {
68 	struct secaeskeytoken *t = (struct secaeskeytoken *)token;
69 
70 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
71 
72 	if (keysize < sizeof(*t)) {
73 		if (dbg)
74 			DBF("%s keysize %u < min token size %zu\n",
75 			    __func__, keysize, sizeof(*t));
76 		return -EINVAL;
77 	}
78 	if (t->type != TOKTYPE_CCA_INTERNAL) {
79 		if (dbg)
80 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
81 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
82 		return -EINVAL;
83 	}
84 	if (t->version != TOKVER_CCA_AES) {
85 		if (dbg)
86 			DBF("%s token check failed, version 0x%02x != 0x%02x\n",
87 			    __func__, (int)t->version, TOKVER_CCA_AES);
88 		return -EINVAL;
89 	}
90 	if (keybitsize > 0 && t->bitsize != keybitsize) {
91 		if (dbg)
92 			DBF("%s token check failed, bitsize %d != %d\n",
93 			    __func__, (int)t->bitsize, keybitsize);
94 		return -EINVAL;
95 	}
96 
97 #undef DBF
98 
99 	return 0;
100 }
101 EXPORT_SYMBOL(cca_check_secaeskeytoken);
102 
103 /*
104  * Simple check if the token is a valid CCA secure AES cipher key
105  * token. If keybitsize is given, the bitsize of the key is
106  * also checked. If checkcpacfexport is enabled, the key is also
107  * checked for the export flag to allow CPACF export.
108  * Returns 0 on success or errno value on failure.
109  */
110 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl,
111 			      const u8 *token, u32 keysize,
112 			      int keybitsize, int checkcpacfexport)
113 {
114 	struct cipherkeytoken *t = (struct cipherkeytoken *)token;
115 	bool keybitsizeok = true;
116 
117 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
118 
119 	if (keysize < sizeof(*t)) {
120 		if (dbg)
121 			DBF("%s keysize %u < min token size %zu\n",
122 			    __func__, keysize, sizeof(*t));
123 		return -EINVAL;
124 	}
125 	if (t->type != TOKTYPE_CCA_INTERNAL) {
126 		if (dbg)
127 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
128 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
129 		return -EINVAL;
130 	}
131 	if (t->version != TOKVER_CCA_VLSC) {
132 		if (dbg)
133 			DBF("%s token check failed, version 0x%02x != 0x%02x\n",
134 			    __func__, (int)t->version, TOKVER_CCA_VLSC);
135 		return -EINVAL;
136 	}
137 	if (t->len > keysize) {
138 		if (dbg)
139 			DBF("%s token check failed, len %d > keysize %u\n",
140 			    __func__, (int)t->len, keysize);
141 		return -EINVAL;
142 	}
143 	if (t->len < sizeof(*t)) {
144 		if (dbg)
145 			DBF("%s token check failed, len %d < min token size %zu\n",
146 			    __func__, (int)t->len, sizeof(*t));
147 		return -EINVAL;
148 	}
149 	if (t->algtype != 0x02) {
150 		if (dbg)
151 			DBF("%s token check failed, algtype 0x%02x != 0x02\n",
152 			    __func__, (int)t->algtype);
153 		return -EINVAL;
154 	}
155 	if (t->keytype != 0x0001) {
156 		if (dbg)
157 			DBF("%s token check failed, keytype 0x%04x != 0x0001\n",
158 			    __func__, (int)t->keytype);
159 		return -EINVAL;
160 	}
161 	if (t->plfver != 0x00 && t->plfver != 0x01) {
162 		if (dbg)
163 			DBF("%s token check failed, unknown plfver 0x%02x\n",
164 			    __func__, (int)t->plfver);
165 		return -EINVAL;
166 	}
167 	if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) {
168 		if (dbg)
169 			DBF("%s token check failed, unknown wpllen %d\n",
170 			    __func__, (int)t->wpllen);
171 		return -EINVAL;
172 	}
173 	if (keybitsize > 0) {
174 		switch (keybitsize) {
175 		case 128:
176 			if (t->wpllen != (t->plfver ? 640 : 512))
177 				keybitsizeok = false;
178 			break;
179 		case 192:
180 			if (t->wpllen != (t->plfver ? 640 : 576))
181 				keybitsizeok = false;
182 			break;
183 		case 256:
184 			if (t->wpllen != 640)
185 				keybitsizeok = false;
186 			break;
187 		default:
188 			keybitsizeok = false;
189 			break;
190 		}
191 		if (!keybitsizeok) {
192 			if (dbg)
193 				DBF("%s token check failed, bitsize %d\n",
194 				    __func__, keybitsize);
195 			return -EINVAL;
196 		}
197 	}
198 	if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) {
199 		if (dbg)
200 			DBF("%s token check failed, XPRT_CPAC bit is 0\n",
201 			    __func__);
202 		return -EINVAL;
203 	}
204 
205 #undef DBF
206 
207 	return 0;
208 }
209 EXPORT_SYMBOL(cca_check_secaescipherkey);
210 
211 /*
212  * Simple check if the token is a valid CCA secure ECC private
213  * key token. Returns 0 on success or errno value on failure.
214  */
215 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl,
216 			     const u8 *token, u32 keysize,
217 			     int checkcpacfexport)
218 {
219 	struct eccprivkeytoken *t = (struct eccprivkeytoken *)token;
220 
221 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
222 
223 	if (keysize < sizeof(*t)) {
224 		if (dbg)
225 			DBF("%s keysize %u < min token size %zu\n",
226 			    __func__, keysize, sizeof(*t));
227 		return -EINVAL;
228 	}
229 	if (t->type != TOKTYPE_CCA_INTERNAL_PKA) {
230 		if (dbg)
231 			DBF("%s token check failed, type 0x%02x != 0x%02x\n",
232 			    __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA);
233 		return -EINVAL;
234 	}
235 	if (t->len > keysize) {
236 		if (dbg)
237 			DBF("%s token check failed, len %d > keysize %u\n",
238 			    __func__, (int)t->len, keysize);
239 		return -EINVAL;
240 	}
241 	if (t->len < sizeof(*t)) {
242 		if (dbg)
243 			DBF("%s token check failed, len %d < min token size %zu\n",
244 			    __func__, (int)t->len, sizeof(*t));
245 		return -EINVAL;
246 	}
247 	if (t->secid != 0x20) {
248 		if (dbg)
249 			DBF("%s token check failed, secid 0x%02x != 0x20\n",
250 			    __func__, (int)t->secid);
251 		return -EINVAL;
252 	}
253 	if (checkcpacfexport && !(t->kutc & 0x01)) {
254 		if (dbg)
255 			DBF("%s token check failed, XPRTCPAC bit is 0\n",
256 			    __func__);
257 		return -EINVAL;
258 	}
259 
260 #undef DBF
261 
262 	return 0;
263 }
264 EXPORT_SYMBOL(cca_check_sececckeytoken);
265 
266 /*
267  * Allocate consecutive memory for request CPRB, request param
268  * block, reply CPRB and reply param block and fill in values
269  * for the common fields. Returns 0 on success or errno value
270  * on failure.
271  * It is guaranteed that request and a possible param block
272  * are aligned to a 4 byte boundary. Furthermore if a param
273  * block is used, the memory allocated for this is rounded up to
274  * the next multiple of 4 bytes.
275  */
276 static int alloc_and_prep_cprbmem(size_t paramblen,
277 				  u8 **p_cprb_mem,
278 				  struct CPRBX **p_req_cprb,
279 				  struct CPRBX **p_rep_cprb,
280 				  u32 xflags)
281 {
282 	u8 *cprbmem = NULL;
283 	size_t cprbplusparamblen =
284 		ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
285 	size_t len = 2 * cprbplusparamblen;
286 	struct CPRBX *preqcblk, *prepcblk;
287 
288 	/*
289 	 * allocate consecutive memory for request CPRB, request param
290 	 * block, reply CPRB and reply param block
291 	 */
292 	if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) {
293 		if (len <= CPRB_MEMPOOL_ITEM_SIZE)
294 			cprbmem = mempool_alloc_preallocated(cprb_mempool);
295 	} else {
296 		cprbmem = kmalloc(len, GFP_KERNEL);
297 	}
298 	if (!cprbmem)
299 		return -ENOMEM;
300 	memset(cprbmem, 0, len);
301 
302 	preqcblk = (struct CPRBX *)cprbmem;
303 	prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen);
304 
305 	/* fill request cprb struct */
306 	preqcblk->cprb_len = sizeof(struct CPRBX);
307 	preqcblk->cprb_ver_id = 0x02;
308 	memcpy(preqcblk->func_id, "T2", 2);
309 	preqcblk->rpl_msgbl = cprbplusparamblen;
310 	if (paramblen) {
311 		preqcblk->req_parmb = ((u8 __user *)preqcblk) +
312 			ALIGN(sizeof(struct CPRBX), 4);
313 		preqcblk->rpl_parmb = ((u8 __user *)prepcblk) +
314 			ALIGN(sizeof(struct CPRBX), 4);
315 	}
316 
317 	*p_cprb_mem = cprbmem;
318 	*p_req_cprb = preqcblk;
319 	*p_rep_cprb = prepcblk;
320 
321 	return 0;
322 }
323 
324 /*
325  * Free the cprb memory allocated with the function above.
326  * If the scrub value is not zero, the memory is filled
327  * with zeros before freeing (useful if there was some
328  * clear key material in there).
329  */
330 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags)
331 {
332 	size_t cprblen = ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
333 
334 	if (mem && scrub)
335 		memzero_explicit(mem, 2 * cprblen);
336 
337 	if (xflags & ZCRYPT_XFLAG_NOMEMALLOC)
338 		mempool_free(mem, cprb_mempool);
339 	else
340 		kfree(mem);
341 }
342 
343 /*
344  * Helper function to prepare the xcrb struct
345  */
346 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
347 			     u16 cardnr,
348 			     struct CPRBX *preqcblk,
349 			     struct CPRBX *prepcblk)
350 {
351 	memset(pxcrb, 0, sizeof(*pxcrb));
352 	memcpy(&pxcrb->agent_ID, "CA", 2);
353 	pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
354 	pxcrb->request_control_blk_length =
355 		preqcblk->cprb_len + preqcblk->req_parml;
356 	pxcrb->request_control_blk_addr = (void __user *)preqcblk;
357 	pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
358 	pxcrb->reply_control_blk_addr = (void __user *)prepcblk;
359 }
360 
361 /*
362  * Generate (random) CCA AES DATA secure key.
363  */
364 int cca_genseckey(u16 cardnr, u16 domain,
365 		  u32 keybitsize, u8 *seckey, u32 xflags)
366 {
367 	int i, rc, keysize;
368 	int seckeysize;
369 	u8 *mem, *ptr;
370 	struct CPRBX *preqcblk, *prepcblk;
371 	struct ica_xcRB xcrb;
372 	struct kgreqparm {
373 		u8  subfunc_code[2];
374 		u16 rule_array_len;
375 		struct lv1 {
376 			u16 len;
377 			char  key_form[8];
378 			char  key_length[8];
379 			char  key_type1[8];
380 			char  key_type2[8];
381 		} lv1;
382 		struct lv2 {
383 			u16 len;
384 			struct keyid {
385 				u16 len;
386 				u16 attr;
387 				u8  data[SECKEYBLOBSIZE];
388 			} keyid[6];
389 		} lv2;
390 	} __packed * preqparm;
391 	struct kgrepparm {
392 		u8  subfunc_code[2];
393 		u16 rule_array_len;
394 		struct lv3 {
395 			u16 len;
396 			u16 keyblocklen;
397 			struct {
398 				u16 toklen;
399 				u16 tokattr;
400 				u8  tok[];
401 				/* ... some more data ... */
402 			} keyblock;
403 		} lv3;
404 	} __packed * prepparm;
405 
406 	/* get already prepared memory for 2 cprbs with param block each */
407 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
408 				    &preqcblk, &prepcblk, xflags);
409 	if (rc)
410 		return rc;
411 
412 	/* fill request cprb struct */
413 	preqcblk->domain = domain;
414 
415 	/* fill request cprb param block with KG request */
416 	preqparm = (struct kgreqparm __force *)preqcblk->req_parmb;
417 	memcpy(preqparm->subfunc_code, "KG", 2);
418 	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
419 	preqparm->lv1.len = sizeof(struct lv1);
420 	memcpy(preqparm->lv1.key_form,	 "OP      ", 8);
421 	switch (keybitsize) {
422 	case PKEY_SIZE_AES_128:
423 	case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
424 		keysize = 16;
425 		memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
426 		break;
427 	case PKEY_SIZE_AES_192:
428 	case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
429 		keysize = 24;
430 		memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
431 		break;
432 	case PKEY_SIZE_AES_256:
433 	case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
434 		keysize = 32;
435 		memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
436 		break;
437 	default:
438 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
439 			       __func__, keybitsize);
440 		rc = -EINVAL;
441 		goto out;
442 	}
443 	memcpy(preqparm->lv1.key_type1,  "AESDATA ", 8);
444 	preqparm->lv2.len = sizeof(struct lv2);
445 	for (i = 0; i < 6; i++) {
446 		preqparm->lv2.keyid[i].len = sizeof(struct keyid);
447 		preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
448 	}
449 	preqcblk->req_parml = sizeof(struct kgreqparm);
450 
451 	/* fill xcrb struct */
452 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
453 
454 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
455 	rc = zcrypt_send_cprb(&xcrb, xflags);
456 	if (rc) {
457 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
458 			       __func__, (int)cardnr, (int)domain, rc);
459 		goto out;
460 	}
461 
462 	/* check response returncode and reasoncode */
463 	if (prepcblk->ccp_rtcode != 0) {
464 		ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n",
465 			       __func__,
466 			  (int)prepcblk->ccp_rtcode,
467 			  (int)prepcblk->ccp_rscode);
468 		rc = -EIO;
469 		goto out;
470 	}
471 
472 	/* process response cprb param block */
473 	ptr =  ((u8 *)prepcblk) + sizeof(struct CPRBX);
474 	prepcblk->rpl_parmb = (u8 __user *)ptr;
475 	prepparm = (struct kgrepparm *)ptr;
476 
477 	/* check length of the returned secure key token */
478 	seckeysize = prepparm->lv3.keyblock.toklen
479 		- sizeof(prepparm->lv3.keyblock.toklen)
480 		- sizeof(prepparm->lv3.keyblock.tokattr);
481 	if (seckeysize != SECKEYBLOBSIZE) {
482 		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
483 			       __func__, seckeysize, SECKEYBLOBSIZE);
484 		rc = -EIO;
485 		goto out;
486 	}
487 
488 	/* check secure key token */
489 	rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
490 				      prepparm->lv3.keyblock.tok,
491 				      seckeysize, 8 * keysize);
492 	if (rc) {
493 		rc = -EIO;
494 		goto out;
495 	}
496 
497 	/* copy the generated secure key token */
498 	memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
499 
500 out:
501 	free_cprbmem(mem, PARMBSIZE, false, xflags);
502 	return rc;
503 }
504 EXPORT_SYMBOL(cca_genseckey);
505 
506 /*
507  * Generate an CCA AES DATA secure key with given key value.
508  */
509 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize,
510 		   const u8 *clrkey, u8 *seckey, u32 xflags)
511 {
512 	int rc, keysize, seckeysize;
513 	u8 *mem, *ptr;
514 	struct CPRBX *preqcblk, *prepcblk;
515 	struct ica_xcRB xcrb;
516 	struct cmreqparm {
517 		u8  subfunc_code[2];
518 		u16 rule_array_len;
519 		char  rule_array[8];
520 		struct lv1 {
521 			u16 len;
522 			u8  clrkey[];
523 		} lv1;
524 		/* followed by struct lv2 */
525 	} __packed * preqparm;
526 	struct lv2 {
527 		u16 len;
528 		struct keyid {
529 			u16 len;
530 			u16 attr;
531 			u8  data[SECKEYBLOBSIZE];
532 		} keyid;
533 	} __packed * plv2;
534 	struct cmrepparm {
535 		u8  subfunc_code[2];
536 		u16 rule_array_len;
537 		struct lv3 {
538 			u16 len;
539 			u16 keyblocklen;
540 			struct {
541 				u16 toklen;
542 				u16 tokattr;
543 				u8  tok[];
544 				/* ... some more data ... */
545 			} keyblock;
546 		} lv3;
547 	} __packed * prepparm;
548 
549 	/* get already prepared memory for 2 cprbs with param block each */
550 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
551 				    &preqcblk, &prepcblk, xflags);
552 	if (rc)
553 		return rc;
554 
555 	/* fill request cprb struct */
556 	preqcblk->domain = domain;
557 
558 	/* fill request cprb param block with CM request */
559 	preqparm = (struct cmreqparm __force *)preqcblk->req_parmb;
560 	memcpy(preqparm->subfunc_code, "CM", 2);
561 	memcpy(preqparm->rule_array, "AES     ", 8);
562 	preqparm->rule_array_len =
563 		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
564 	switch (keybitsize) {
565 	case PKEY_SIZE_AES_128:
566 	case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
567 		keysize = 16;
568 		break;
569 	case PKEY_SIZE_AES_192:
570 	case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
571 		keysize = 24;
572 		break;
573 	case PKEY_SIZE_AES_256:
574 	case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
575 		keysize = 32;
576 		break;
577 	default:
578 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
579 			       __func__, keybitsize);
580 		rc = -EINVAL;
581 		goto out;
582 	}
583 	preqparm->lv1.len = sizeof(struct lv1) + keysize;
584 	memcpy(preqparm->lv1.clrkey, clrkey, keysize);
585 	plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize);
586 	plv2->len = sizeof(struct lv2);
587 	plv2->keyid.len = sizeof(struct keyid);
588 	plv2->keyid.attr = 0x30;
589 	preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2);
590 
591 	/* fill xcrb struct */
592 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
593 
594 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
595 	rc = zcrypt_send_cprb(&xcrb, xflags);
596 	if (rc) {
597 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
598 			       __func__, (int)cardnr, (int)domain, rc);
599 		goto out;
600 	}
601 
602 	/* check response returncode and reasoncode */
603 	if (prepcblk->ccp_rtcode != 0) {
604 		ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n",
605 			       __func__,
606 			       (int)prepcblk->ccp_rtcode,
607 			       (int)prepcblk->ccp_rscode);
608 		rc = -EIO;
609 		goto out;
610 	}
611 
612 	/* process response cprb param block */
613 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
614 	prepcblk->rpl_parmb = (u8 __user *)ptr;
615 	prepparm = (struct cmrepparm *)ptr;
616 
617 	/* check length of the returned secure key token */
618 	seckeysize = prepparm->lv3.keyblock.toklen
619 		- sizeof(prepparm->lv3.keyblock.toklen)
620 		- sizeof(prepparm->lv3.keyblock.tokattr);
621 	if (seckeysize != SECKEYBLOBSIZE) {
622 		ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n",
623 			       __func__, seckeysize, SECKEYBLOBSIZE);
624 		rc = -EIO;
625 		goto out;
626 	}
627 
628 	/* check secure key token */
629 	rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
630 				      prepparm->lv3.keyblock.tok,
631 				      seckeysize, 8 * keysize);
632 	if (rc) {
633 		rc = -EIO;
634 		goto out;
635 	}
636 
637 	/* copy the generated secure key token */
638 	if (seckey)
639 		memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
640 
641 out:
642 	free_cprbmem(mem, PARMBSIZE, true, xflags);
643 	return rc;
644 }
645 EXPORT_SYMBOL(cca_clr2seckey);
646 
647 /*
648  * Derive proteced key from an CCA AES DATA secure key.
649  */
650 int cca_sec2protkey(u16 cardnr, u16 domain,
651 		    const u8 *seckey, u8 *protkey, u32 *protkeylen,
652 		    u32 *protkeytype, u32 xflags)
653 {
654 	int rc;
655 	u8 *mem, *ptr;
656 	struct CPRBX *preqcblk, *prepcblk;
657 	struct ica_xcRB xcrb;
658 	struct uskreqparm {
659 		u8  subfunc_code[2];
660 		u16 rule_array_len;
661 		struct lv1 {
662 			u16 len;
663 			u16 attr_len;
664 			u16 attr_flags;
665 		} lv1;
666 		struct lv2 {
667 			u16 len;
668 			u16 attr_len;
669 			u16 attr_flags;
670 			u8  token[];	      /* cca secure key token */
671 		} lv2;
672 	} __packed * preqparm;
673 	struct uskrepparm {
674 		u8  subfunc_code[2];
675 		u16 rule_array_len;
676 		struct lv3 {
677 			u16 len;
678 			u16 attr_len;
679 			u16 attr_flags;
680 			struct cpacfkeyblock {
681 				u8  version;  /* version of this struct */
682 				u8  flags[2];
683 				u8  algo;
684 				u8  form;
685 				u8  pad1[3];
686 				u16 len;
687 				u8  key[64];  /* the key (len bytes) */
688 				u16 keyattrlen;
689 				u8  keyattr[32];
690 				u8  pad2[1];
691 				u8  vptype;
692 				u8  vp[32];  /* verification pattern */
693 			} ckb;
694 		} lv3;
695 	} __packed * prepparm;
696 
697 	/* get already prepared memory for 2 cprbs with param block each */
698 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
699 				    &preqcblk, &prepcblk, xflags);
700 	if (rc)
701 		return rc;
702 
703 	/* fill request cprb struct */
704 	preqcblk->domain = domain;
705 
706 	/* fill request cprb param block with USK request */
707 	preqparm = (struct uskreqparm __force *)preqcblk->req_parmb;
708 	memcpy(preqparm->subfunc_code, "US", 2);
709 	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
710 	preqparm->lv1.len = sizeof(struct lv1);
711 	preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
712 	preqparm->lv1.attr_flags = 0x0001;
713 	preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
714 	preqparm->lv2.attr_len = sizeof(struct lv2)
715 		- sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
716 	preqparm->lv2.attr_flags = 0x0000;
717 	memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
718 	preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
719 
720 	/* fill xcrb struct */
721 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
722 
723 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
724 	rc = zcrypt_send_cprb(&xcrb, xflags);
725 	if (rc) {
726 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
727 			       __func__, (int)cardnr, (int)domain, rc);
728 		goto out;
729 	}
730 
731 	/* check response returncode and reasoncode */
732 	if (prepcblk->ccp_rtcode != 0) {
733 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
734 			       __func__,
735 			       (int)prepcblk->ccp_rtcode,
736 			       (int)prepcblk->ccp_rscode);
737 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
738 			rc = -EBUSY;
739 		else
740 			rc = -EIO;
741 		goto out;
742 	}
743 	if (prepcblk->ccp_rscode != 0) {
744 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
745 				__func__,
746 				(int)prepcblk->ccp_rtcode,
747 				(int)prepcblk->ccp_rscode);
748 	}
749 
750 	/* process response cprb param block */
751 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
752 	prepcblk->rpl_parmb = (u8 __user *)ptr;
753 	prepparm = (struct uskrepparm *)ptr;
754 
755 	/* check the returned keyblock */
756 	if (prepparm->lv3.ckb.version != 0x01 &&
757 	    prepparm->lv3.ckb.version != 0x02) {
758 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
759 			       __func__, (int)prepparm->lv3.ckb.version);
760 		rc = -EIO;
761 		goto out;
762 	}
763 
764 	/* copy the translated protected key */
765 	switch (prepparm->lv3.ckb.len) {
766 	case 16 + 32:
767 		/* AES 128 protected key */
768 		if (protkeytype)
769 			*protkeytype = PKEY_KEYTYPE_AES_128;
770 		break;
771 	case 24 + 32:
772 		/* AES 192 protected key */
773 		if (protkeytype)
774 			*protkeytype = PKEY_KEYTYPE_AES_192;
775 		break;
776 	case 32 + 32:
777 		/* AES 256 protected key */
778 		if (protkeytype)
779 			*protkeytype = PKEY_KEYTYPE_AES_256;
780 		break;
781 	default:
782 		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
783 			       __func__, prepparm->lv3.ckb.len);
784 		rc = -EIO;
785 		goto out;
786 	}
787 	memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len);
788 	if (protkeylen)
789 		*protkeylen = prepparm->lv3.ckb.len;
790 
791 out:
792 	free_cprbmem(mem, PARMBSIZE, true, xflags);
793 	return rc;
794 }
795 EXPORT_SYMBOL(cca_sec2protkey);
796 
797 /*
798  * AES cipher key skeleton created with CSNBKTB2 with these flags:
799  * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY,
800  * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA
801  * used by cca_gencipherkey() and cca_clr2cipherkey().
802  */
803 static const u8 aes_cipher_key_skeleton[] = {
804 	0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00,
805 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
806 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
807 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
808 	0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
809 	0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff,
810 	0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 };
811 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton))
812 
813 /*
814  * Generate (random) CCA AES CIPHER secure key.
815  */
816 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
817 		     u8 *keybuf, u32 *keybufsize, u32 xflags)
818 {
819 	int rc;
820 	u8 *mem, *ptr;
821 	struct CPRBX *preqcblk, *prepcblk;
822 	struct ica_xcRB xcrb;
823 	struct gkreqparm {
824 		u8  subfunc_code[2];
825 		u16 rule_array_len;
826 		char rule_array[2 * 8];
827 		struct {
828 			u16 len;
829 			u8  key_type_1[8];
830 			u8  key_type_2[8];
831 			u16 clear_key_bit_len;
832 			u16 key_name_1_len;
833 			u16 key_name_2_len;
834 			u16 user_data_1_len;
835 			u16 user_data_2_len;
836 			/* u8  key_name_1[]; */
837 			/* u8  key_name_2[]; */
838 			/* u8  user_data_1[]; */
839 			/* u8  user_data_2[]; */
840 		} vud;
841 		struct {
842 			u16 len;
843 			struct {
844 				u16 len;
845 				u16 flag;
846 				/* u8  kek_id_1[]; */
847 			} tlv1;
848 			struct {
849 				u16 len;
850 				u16 flag;
851 				/* u8  kek_id_2[]; */
852 			} tlv2;
853 			struct {
854 				u16 len;
855 				u16 flag;
856 				u8  gen_key_id_1[SIZEOF_SKELETON];
857 			} tlv3;
858 			struct {
859 				u16 len;
860 				u16 flag;
861 				/* u8  gen_key_id_1_label[]; */
862 			} tlv4;
863 			struct {
864 				u16 len;
865 				u16 flag;
866 				/* u8  gen_key_id_2[]; */
867 			} tlv5;
868 			struct {
869 				u16 len;
870 				u16 flag;
871 				/* u8  gen_key_id_2_label[]; */
872 			} tlv6;
873 		} kb;
874 	} __packed * preqparm;
875 	struct gkrepparm {
876 		u8  subfunc_code[2];
877 		u16 rule_array_len;
878 		struct {
879 			u16 len;
880 		} vud;
881 		struct {
882 			u16 len;
883 			struct {
884 				u16 len;
885 				u16 flag;
886 				u8  gen_key[]; /* 120-136 bytes */
887 			} tlv1;
888 		} kb;
889 	} __packed * prepparm;
890 	struct cipherkeytoken *t;
891 	u32 keybuflen;
892 
893 	/* get already prepared memory for 2 cprbs with param block each */
894 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
895 				    &preqcblk, &prepcblk, xflags);
896 	if (rc)
897 		return rc;
898 
899 	/* fill request cprb struct */
900 	preqcblk->domain = domain;
901 	preqcblk->req_parml = sizeof(struct gkreqparm);
902 
903 	/* prepare request param block with GK request */
904 	preqparm = (struct gkreqparm __force *)preqcblk->req_parmb;
905 	memcpy(preqparm->subfunc_code, "GK", 2);
906 	preqparm->rule_array_len =  sizeof(uint16_t) + 2 * 8;
907 	memcpy(preqparm->rule_array, "AES     OP      ", 2 * 8);
908 
909 	/* prepare vud block */
910 	preqparm->vud.len = sizeof(preqparm->vud);
911 	switch (keybitsize) {
912 	case 128:
913 	case 192:
914 	case 256:
915 		break;
916 	default:
917 		ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n",
918 			       __func__, keybitsize);
919 		rc = -EINVAL;
920 		goto out;
921 	}
922 	preqparm->vud.clear_key_bit_len = keybitsize;
923 	memcpy(preqparm->vud.key_type_1, "TOKEN   ", 8);
924 	memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2));
925 
926 	/* prepare kb block */
927 	preqparm->kb.len = sizeof(preqparm->kb);
928 	preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1);
929 	preqparm->kb.tlv1.flag = 0x0030;
930 	preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2);
931 	preqparm->kb.tlv2.flag = 0x0030;
932 	preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3);
933 	preqparm->kb.tlv3.flag = 0x0030;
934 	memcpy(preqparm->kb.tlv3.gen_key_id_1,
935 	       aes_cipher_key_skeleton, SIZEOF_SKELETON);
936 	preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4);
937 	preqparm->kb.tlv4.flag = 0x0030;
938 	preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5);
939 	preqparm->kb.tlv5.flag = 0x0030;
940 	preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6);
941 	preqparm->kb.tlv6.flag = 0x0030;
942 
943 	/* patch the skeleton key token export flags inside the kb block */
944 	if (keygenflags) {
945 		t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1;
946 		t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
947 		t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
948 	}
949 
950 	/* prepare xcrb struct */
951 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
952 
953 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
954 	rc = zcrypt_send_cprb(&xcrb, xflags);
955 	if (rc) {
956 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
957 			       __func__, (int)cardnr, (int)domain, rc);
958 		goto out;
959 	}
960 
961 	/* check response returncode and reasoncode */
962 	if (prepcblk->ccp_rtcode != 0) {
963 		ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n",
964 			       __func__,
965 			       (int)prepcblk->ccp_rtcode,
966 			       (int)prepcblk->ccp_rscode);
967 		rc = -EIO;
968 		goto out;
969 	}
970 
971 	/* process response cprb param block */
972 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
973 	prepcblk->rpl_parmb = (u8 __user *)ptr;
974 	prepparm = (struct gkrepparm *)ptr;
975 
976 	/* do some plausibility checks on the key block */
977 	if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
978 	    prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
979 		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
980 			       __func__);
981 		rc = -EIO;
982 		goto out;
983 	}
984 
985 	/* and some checks on the generated key */
986 	t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key;
987 	if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) {
988 		rc = -EIO;
989 		goto out;
990 	}
991 	keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t);
992 	rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR,
993 				       prepparm->kb.tlv1.gen_key,
994 				       keybuflen, keybitsize, 1);
995 	if (rc) {
996 		rc = -EIO;
997 		goto out;
998 	}
999 
1000 	/* copy the generated vlsc key token */
1001 	if (keybuf) {
1002 		if (*keybufsize >= keybuflen)
1003 			memcpy(keybuf, t, keybuflen);
1004 		else
1005 			rc = -EINVAL;
1006 	}
1007 	*keybufsize = keybuflen;
1008 
1009 out:
1010 	free_cprbmem(mem, PARMBSIZE, false, xflags);
1011 	return rc;
1012 }
1013 EXPORT_SYMBOL(cca_gencipherkey);
1014 
1015 /*
1016  * Helper function, does a the CSNBKPI2 CPRB.
1017  */
1018 static int _ip_cprb_helper(u16 cardnr, u16 domain,
1019 			   const char *rule_array_1,
1020 			   const char *rule_array_2,
1021 			   const char *rule_array_3,
1022 			   const u8 *clr_key_value,
1023 			   int clr_key_bit_size,
1024 			   u8 *key_token,
1025 			   int *key_token_size,
1026 			   u32 xflags,
1027 			   bool scrub)
1028 {
1029 	int rc, n;
1030 	u8 *mem, *ptr;
1031 	struct CPRBX *preqcblk, *prepcblk;
1032 	struct ica_xcRB xcrb;
1033 	struct rule_array_block {
1034 		u8  subfunc_code[2];
1035 		u16 rule_array_len;
1036 		char rule_array[];
1037 	} __packed * preq_ra_block;
1038 	struct vud_block {
1039 		u16 len;
1040 		struct {
1041 			u16 len;
1042 			u16 flag;	     /* 0x0064 */
1043 			u16 clr_key_bit_len;
1044 		} tlv1;
1045 		struct {
1046 			u16 len;
1047 			u16 flag;	/* 0x0063 */
1048 			u8  clr_key[];	/* clear key value bytes */
1049 		} tlv2;
1050 	} __packed * preq_vud_block;
1051 	struct key_block {
1052 		u16 len;
1053 		struct {
1054 			u16 len;
1055 			u16 flag;	  /* 0x0030 */
1056 			u8  key_token[];  /* key skeleton */
1057 		} tlv1;
1058 	} __packed * preq_key_block;
1059 	struct iprepparm {
1060 		u8  subfunc_code[2];
1061 		u16 rule_array_len;
1062 		struct {
1063 			u16 len;
1064 		} vud;
1065 		struct {
1066 			u16 len;
1067 			struct {
1068 				u16 len;
1069 				u16 flag;	  /* 0x0030 */
1070 				u8  key_token[];  /* key token */
1071 			} tlv1;
1072 		} kb;
1073 	} __packed * prepparm;
1074 	struct cipherkeytoken *t;
1075 	int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1;
1076 
1077 	/* get already prepared memory for 2 cprbs with param block each */
1078 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1079 				    &preqcblk, &prepcblk, xflags);
1080 	if (rc)
1081 		return rc;
1082 
1083 	/* fill request cprb struct */
1084 	preqcblk->domain = domain;
1085 	preqcblk->req_parml = 0;
1086 
1087 	/* prepare request param block with IP request */
1088 	preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb;
1089 	memcpy(preq_ra_block->subfunc_code, "IP", 2);
1090 	preq_ra_block->rule_array_len =  sizeof(uint16_t) + 2 * 8;
1091 	memcpy(preq_ra_block->rule_array, rule_array_1, 8);
1092 	memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8);
1093 	preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8;
1094 	if (rule_array_3) {
1095 		preq_ra_block->rule_array_len += 8;
1096 		memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8);
1097 		preqcblk->req_parml += 8;
1098 	}
1099 
1100 	/* prepare vud block */
1101 	preq_vud_block = (struct vud_block __force *)
1102 		(preqcblk->req_parmb + preqcblk->req_parml);
1103 	n = complete ? 0 : (clr_key_bit_size + 7) / 8;
1104 	preq_vud_block->len = sizeof(struct vud_block) + n;
1105 	preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1);
1106 	preq_vud_block->tlv1.flag = 0x0064;
1107 	preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size;
1108 	preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n;
1109 	preq_vud_block->tlv2.flag = 0x0063;
1110 	if (!complete)
1111 		memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n);
1112 	preqcblk->req_parml += preq_vud_block->len;
1113 
1114 	/* prepare key block */
1115 	preq_key_block = (struct key_block __force *)
1116 		(preqcblk->req_parmb + preqcblk->req_parml);
1117 	n = *key_token_size;
1118 	preq_key_block->len = sizeof(struct key_block) + n;
1119 	preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n;
1120 	preq_key_block->tlv1.flag = 0x0030;
1121 	memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size);
1122 	preqcblk->req_parml += preq_key_block->len;
1123 
1124 	/* prepare xcrb struct */
1125 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1126 
1127 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1128 	rc = zcrypt_send_cprb(&xcrb, xflags);
1129 	if (rc) {
1130 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1131 			       __func__, (int)cardnr, (int)domain, rc);
1132 		goto out;
1133 	}
1134 
1135 	/* check response returncode and reasoncode */
1136 	if (prepcblk->ccp_rtcode != 0) {
1137 		ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n",
1138 			       __func__,
1139 			       (int)prepcblk->ccp_rtcode,
1140 			       (int)prepcblk->ccp_rscode);
1141 		rc = -EIO;
1142 		goto out;
1143 	}
1144 
1145 	/* process response cprb param block */
1146 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1147 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1148 	prepparm = (struct iprepparm *)ptr;
1149 
1150 	/* do some plausibility checks on the key block */
1151 	if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
1152 	    prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
1153 		ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n",
1154 			       __func__);
1155 		rc = -EIO;
1156 		goto out;
1157 	}
1158 
1159 	/* do not check the key here, it may be incomplete */
1160 
1161 	/* copy the vlsc key token back */
1162 	t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
1163 	memcpy(key_token, t, t->len);
1164 	*key_token_size = t->len;
1165 
1166 out:
1167 	free_cprbmem(mem, PARMBSIZE, scrub, xflags);
1168 	return rc;
1169 }
1170 
1171 /*
1172  * Build CCA AES CIPHER secure key with a given clear key value.
1173  */
1174 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
1175 		      const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags)
1176 {
1177 	int rc;
1178 	void *mem;
1179 	int tokensize;
1180 	u8 *token, exorbuf[32];
1181 	struct cipherkeytoken *t;
1182 
1183 	/* fill exorbuf with random data */
1184 	get_random_bytes(exorbuf, sizeof(exorbuf));
1185 
1186 	/*
1187 	 * Allocate space for the key token to build.
1188 	 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this
1189 	 * we use the already existing cprb mempool to solve this
1190 	 * short term memory requirement.
1191 	 */
1192 	mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1193 		mempool_alloc_preallocated(cprb_mempool) :
1194 		mempool_alloc(cprb_mempool, GFP_KERNEL);
1195 	if (!mem)
1196 		return -ENOMEM;
1197 
1198 	/* prepare the token with the key skeleton */
1199 	token = (u8 *)mem;
1200 	tokensize = SIZEOF_SKELETON;
1201 	memcpy(token, aes_cipher_key_skeleton, tokensize);
1202 
1203 	/* patch the skeleton key token export flags */
1204 	if (keygenflags) {
1205 		t = (struct cipherkeytoken *)token;
1206 		t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
1207 		t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
1208 	}
1209 
1210 	/*
1211 	 * Do the key import with the clear key value in 4 steps:
1212 	 * 1/4 FIRST import with only random data
1213 	 * 2/4 EXOR the clear key
1214 	 * 3/4 EXOR the very same random data again
1215 	 * 4/4 COMPLETE the secure cipher key import
1216 	 */
1217 	rc = _ip_cprb_helper(card, dom, "AES     ", "FIRST   ", "MIN3PART",
1218 			     exorbuf, keybitsize, token, &tokensize,
1219 			     xflags, true);
1220 	if (rc) {
1221 		ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
1222 			       __func__, rc);
1223 		goto out;
1224 	}
1225 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1226 			     clrkey, keybitsize, token, &tokensize,
1227 			     xflags, true);
1228 	if (rc) {
1229 		ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
1230 			       __func__, rc);
1231 		goto out;
1232 	}
1233 	rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1234 			     exorbuf, keybitsize, token, &tokensize,
1235 			     xflags, true);
1236 	if (rc) {
1237 		ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
1238 			       __func__, rc);
1239 		goto out;
1240 	}
1241 	rc = _ip_cprb_helper(card, dom, "AES     ", "COMPLETE", NULL,
1242 			     NULL, keybitsize, token, &tokensize,
1243 			     xflags, true);
1244 	if (rc) {
1245 		ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
1246 			       __func__, rc);
1247 		goto out;
1248 	}
1249 
1250 	/* copy the generated key token */
1251 	if (keybuf) {
1252 		if (tokensize > *keybufsize)
1253 			rc = -EINVAL;
1254 		else
1255 			memcpy(keybuf, token, tokensize);
1256 	}
1257 	*keybufsize = tokensize;
1258 
1259 out:
1260 	memzero_explicit(exorbuf, sizeof(exorbuf));
1261 	memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE);
1262 	mempool_free(mem, cprb_mempool);
1263 	return rc;
1264 }
1265 EXPORT_SYMBOL(cca_clr2cipherkey);
1266 
1267 /*
1268  * Derive proteced key from CCA AES cipher secure key.
1269  */
1270 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
1271 		       u8 *protkey, u32 *protkeylen, u32 *protkeytype,
1272 		       u32 xflags)
1273 {
1274 	int rc;
1275 	u8 *mem, *ptr;
1276 	struct CPRBX *preqcblk, *prepcblk;
1277 	struct ica_xcRB xcrb;
1278 	struct aureqparm {
1279 		u8  subfunc_code[2];
1280 		u16 rule_array_len;
1281 		u8  rule_array[8];
1282 		struct {
1283 			u16 len;
1284 			u16 tk_blob_len;
1285 			u16 tk_blob_tag;
1286 			u8  tk_blob[66];
1287 		} vud;
1288 		struct {
1289 			u16 len;
1290 			u16 cca_key_token_len;
1291 			u16 cca_key_token_flags;
1292 			u8  cca_key_token[]; /* 64 or more */
1293 		} kb;
1294 	} __packed * preqparm;
1295 	struct aurepparm {
1296 		u8  subfunc_code[2];
1297 		u16 rule_array_len;
1298 		struct {
1299 			u16 len;
1300 			u16 sublen;
1301 			u16 tag;
1302 			struct cpacfkeyblock {
1303 				u8  version;  /* version of this struct */
1304 				u8  flags[2];
1305 				u8  algo;
1306 				u8  form;
1307 				u8  pad1[3];
1308 				u16 keylen;
1309 				u8  key[64];  /* the key (keylen bytes) */
1310 				u16 keyattrlen;
1311 				u8  keyattr[32];
1312 				u8  pad2[1];
1313 				u8  vptype;
1314 				u8  vp[32];  /* verification pattern */
1315 			} ckb;
1316 		} vud;
1317 		struct {
1318 			u16 len;
1319 		} kb;
1320 	} __packed * prepparm;
1321 	int keytoklen = ((struct cipherkeytoken *)ckey)->len;
1322 
1323 	if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
1324 		return -EINVAL;
1325 
1326 	/* get already prepared memory for 2 cprbs with param block each */
1327 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1328 				    &preqcblk, &prepcblk, xflags);
1329 	if (rc)
1330 		return rc;
1331 
1332 	/* fill request cprb struct */
1333 	preqcblk->domain = domain;
1334 
1335 	/* fill request cprb param block with AU request */
1336 	preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1337 	memcpy(preqparm->subfunc_code, "AU", 2);
1338 	preqparm->rule_array_len =
1339 		sizeof(preqparm->rule_array_len)
1340 		+ sizeof(preqparm->rule_array);
1341 	memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1342 	/* vud, tk blob */
1343 	preqparm->vud.len = sizeof(preqparm->vud);
1344 	preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1345 		+ 2 * sizeof(uint16_t);
1346 	preqparm->vud.tk_blob_tag = 0x00C2;
1347 	/* kb, cca token */
1348 	preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t);
1349 	preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t);
1350 	memcpy(preqparm->kb.cca_key_token, ckey, keytoklen);
1351 	/* now fill length of param block into cprb */
1352 	preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen;
1353 
1354 	/* fill xcrb struct */
1355 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1356 
1357 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1358 	rc = zcrypt_send_cprb(&xcrb, xflags);
1359 	if (rc) {
1360 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1361 			       __func__, (int)cardnr, (int)domain, rc);
1362 		goto out;
1363 	}
1364 
1365 	/* check response returncode and reasoncode */
1366 	if (prepcblk->ccp_rtcode != 0) {
1367 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1368 			       __func__,
1369 			       (int)prepcblk->ccp_rtcode,
1370 			       (int)prepcblk->ccp_rscode);
1371 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1372 			rc = -EBUSY;
1373 		else
1374 			rc = -EIO;
1375 		goto out;
1376 	}
1377 	if (prepcblk->ccp_rscode != 0) {
1378 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1379 				__func__,
1380 				(int)prepcblk->ccp_rtcode,
1381 				(int)prepcblk->ccp_rscode);
1382 	}
1383 
1384 	/* process response cprb param block */
1385 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1386 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1387 	prepparm = (struct aurepparm *)ptr;
1388 
1389 	/* check the returned keyblock */
1390 	if (prepparm->vud.ckb.version != 0x01 &&
1391 	    prepparm->vud.ckb.version != 0x02) {
1392 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n",
1393 			       __func__, (int)prepparm->vud.ckb.version);
1394 		rc = -EIO;
1395 		goto out;
1396 	}
1397 	if (prepparm->vud.ckb.algo != 0x02) {
1398 		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
1399 			       __func__, (int)prepparm->vud.ckb.algo);
1400 		rc = -EIO;
1401 		goto out;
1402 	}
1403 
1404 	/* copy the translated protected key */
1405 	switch (prepparm->vud.ckb.keylen) {
1406 	case 16 + 32:
1407 		/* AES 128 protected key */
1408 		if (protkeytype)
1409 			*protkeytype = PKEY_KEYTYPE_AES_128;
1410 		break;
1411 	case 24 + 32:
1412 		/* AES 192 protected key */
1413 		if (protkeytype)
1414 			*protkeytype = PKEY_KEYTYPE_AES_192;
1415 		break;
1416 	case 32 + 32:
1417 		/* AES 256 protected key */
1418 		if (protkeytype)
1419 			*protkeytype = PKEY_KEYTYPE_AES_256;
1420 		break;
1421 	default:
1422 		ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n",
1423 			       __func__, prepparm->vud.ckb.keylen);
1424 		rc = -EIO;
1425 		goto out;
1426 	}
1427 	memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1428 	if (protkeylen)
1429 		*protkeylen = prepparm->vud.ckb.keylen;
1430 
1431 out:
1432 	free_cprbmem(mem, PARMBSIZE, true, xflags);
1433 	return rc;
1434 }
1435 EXPORT_SYMBOL(cca_cipher2protkey);
1436 
1437 /*
1438  * Derive protected key from CCA ECC secure private key.
1439  */
1440 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
1441 		    u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags)
1442 {
1443 	int rc;
1444 	u8 *mem, *ptr;
1445 	struct CPRBX *preqcblk, *prepcblk;
1446 	struct ica_xcRB xcrb;
1447 	struct aureqparm {
1448 		u8  subfunc_code[2];
1449 		u16 rule_array_len;
1450 		u8  rule_array[8];
1451 		struct {
1452 			u16 len;
1453 			u16 tk_blob_len;
1454 			u16 tk_blob_tag;
1455 			u8  tk_blob[66];
1456 		} vud;
1457 		struct {
1458 			u16 len;
1459 			u16 cca_key_token_len;
1460 			u16 cca_key_token_flags;
1461 			u8  cca_key_token[];
1462 		} kb;
1463 	} __packed * preqparm;
1464 	struct aurepparm {
1465 		u8  subfunc_code[2];
1466 		u16 rule_array_len;
1467 		struct {
1468 			u16 len;
1469 			u16 sublen;
1470 			u16 tag;
1471 			struct cpacfkeyblock {
1472 				u8  version;  /* version of this struct */
1473 				u8  flags[2];
1474 				u8  algo;
1475 				u8  form;
1476 				u8  pad1[3];
1477 				u16 keylen;
1478 				u8  key[];  /* the key (keylen bytes) */
1479 				/* u16 keyattrlen; */
1480 				/* u8  keyattr[32]; */
1481 				/* u8  pad2[1]; */
1482 				/* u8  vptype; */
1483 				/* u8  vp[32];	verification pattern */
1484 			} ckb;
1485 		} vud;
1486 		/* followed by a key block */
1487 	} __packed * prepparm;
1488 	int keylen = ((struct eccprivkeytoken *)key)->len;
1489 
1490 	if (keylen > PARMBSIZE - sizeof(struct aureqparm))
1491 		return -EINVAL;
1492 
1493 	/* get already prepared memory for 2 cprbs with param block each */
1494 	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
1495 				    &preqcblk, &prepcblk, xflags);
1496 	if (rc)
1497 		return rc;
1498 
1499 	/* fill request cprb struct */
1500 	preqcblk->domain = domain;
1501 
1502 	/* fill request cprb param block with AU request */
1503 	preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1504 	memcpy(preqparm->subfunc_code, "AU", 2);
1505 	preqparm->rule_array_len =
1506 		sizeof(preqparm->rule_array_len)
1507 		+ sizeof(preqparm->rule_array);
1508 	memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1509 	/* vud, tk blob */
1510 	preqparm->vud.len = sizeof(preqparm->vud);
1511 	preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1512 		+ 2 * sizeof(uint16_t);
1513 	preqparm->vud.tk_blob_tag = 0x00C2;
1514 	/* kb, cca token */
1515 	preqparm->kb.len = keylen + 3 * sizeof(uint16_t);
1516 	preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t);
1517 	memcpy(preqparm->kb.cca_key_token, key, keylen);
1518 	/* now fill length of param block into cprb */
1519 	preqcblk->req_parml = sizeof(struct aureqparm) + keylen;
1520 
1521 	/* fill xcrb struct */
1522 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1523 
1524 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1525 	rc = zcrypt_send_cprb(&xcrb, xflags);
1526 	if (rc) {
1527 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1528 			       __func__, (int)cardnr, (int)domain, rc);
1529 		goto out;
1530 	}
1531 
1532 	/* check response returncode and reasoncode */
1533 	if (prepcblk->ccp_rtcode != 0) {
1534 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1535 			       __func__,
1536 			       (int)prepcblk->ccp_rtcode,
1537 			       (int)prepcblk->ccp_rscode);
1538 		if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1539 			rc = -EBUSY;
1540 		else
1541 			rc = -EIO;
1542 		goto out;
1543 	}
1544 	if (prepcblk->ccp_rscode != 0) {
1545 		ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n",
1546 				__func__,
1547 				(int)prepcblk->ccp_rtcode,
1548 				(int)prepcblk->ccp_rscode);
1549 	}
1550 
1551 	/* process response cprb param block */
1552 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1553 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1554 	prepparm = (struct aurepparm *)ptr;
1555 
1556 	/* check the returned keyblock */
1557 	if (prepparm->vud.ckb.version != 0x02) {
1558 		ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
1559 			       __func__, (int)prepparm->vud.ckb.version);
1560 		rc = -EIO;
1561 		goto out;
1562 	}
1563 	if (prepparm->vud.ckb.algo != 0x81) {
1564 		ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
1565 			       __func__, (int)prepparm->vud.ckb.algo);
1566 		rc = -EIO;
1567 		goto out;
1568 	}
1569 
1570 	/* copy the translated protected key */
1571 	if (prepparm->vud.ckb.keylen > *protkeylen) {
1572 		ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n",
1573 			       __func__, prepparm->vud.ckb.keylen, *protkeylen);
1574 		rc = -EIO;
1575 		goto out;
1576 	}
1577 	memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1578 	*protkeylen = prepparm->vud.ckb.keylen;
1579 	if (protkeytype)
1580 		*protkeytype = PKEY_KEYTYPE_ECC;
1581 
1582 out:
1583 	free_cprbmem(mem, PARMBSIZE, true, xflags);
1584 	return rc;
1585 }
1586 EXPORT_SYMBOL(cca_ecc2protkey);
1587 
1588 /*
1589  * query cryptographic facility from CCA adapter
1590  */
1591 int cca_query_crypto_facility(u16 cardnr, u16 domain,
1592 			      const char *keyword,
1593 			      u8 *rarray, size_t *rarraylen,
1594 			      u8 *varray, size_t *varraylen,
1595 			      u32 xflags)
1596 {
1597 	int rc;
1598 	u16 len;
1599 	u8 *mem, *ptr;
1600 	struct CPRBX *preqcblk, *prepcblk;
1601 	struct ica_xcRB xcrb;
1602 	struct fqreqparm {
1603 		u8  subfunc_code[2];
1604 		u16 rule_array_len;
1605 		char  rule_array[8];
1606 		struct lv1 {
1607 			u16 len;
1608 			u8  data[VARDATASIZE];
1609 		} lv1;
1610 		u16 dummylen;
1611 	} __packed * preqparm;
1612 	size_t parmbsize = sizeof(struct fqreqparm);
1613 	struct fqrepparm {
1614 		u8  subfunc_code[2];
1615 		u8  lvdata[];
1616 	} __packed * prepparm;
1617 
1618 	/* get already prepared memory for 2 cprbs with param block each */
1619 	rc = alloc_and_prep_cprbmem(parmbsize, &mem,
1620 				    &preqcblk, &prepcblk, xflags);
1621 	if (rc)
1622 		return rc;
1623 
1624 	/* fill request cprb struct */
1625 	preqcblk->domain = domain;
1626 
1627 	/* fill request cprb param block with FQ request */
1628 	preqparm = (struct fqreqparm __force *)preqcblk->req_parmb;
1629 	memcpy(preqparm->subfunc_code, "FQ", 2);
1630 	memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
1631 	preqparm->rule_array_len =
1632 		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
1633 	preqparm->lv1.len = sizeof(preqparm->lv1);
1634 	preqparm->dummylen = sizeof(preqparm->dummylen);
1635 	preqcblk->req_parml = parmbsize;
1636 
1637 	/* fill xcrb struct */
1638 	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1639 
1640 	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1641 	rc = zcrypt_send_cprb(&xcrb, xflags);
1642 	if (rc) {
1643 		ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1644 			       __func__, (int)cardnr, (int)domain, rc);
1645 		goto out;
1646 	}
1647 
1648 	/* check response returncode and reasoncode */
1649 	if (prepcblk->ccp_rtcode != 0) {
1650 		ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n",
1651 			       __func__,
1652 			       (int)prepcblk->ccp_rtcode,
1653 			       (int)prepcblk->ccp_rscode);
1654 		rc = -EIO;
1655 		goto out;
1656 	}
1657 
1658 	/* process response cprb param block */
1659 	ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1660 	prepcblk->rpl_parmb = (u8 __user *)ptr;
1661 	prepparm = (struct fqrepparm *)ptr;
1662 	ptr = prepparm->lvdata;
1663 
1664 	/* check and possibly copy reply rule array */
1665 	len = *((u16 *)ptr);
1666 	if (len > sizeof(u16)) {
1667 		ptr += sizeof(u16);
1668 		len -= sizeof(u16);
1669 		if (rarray && rarraylen && *rarraylen > 0) {
1670 			*rarraylen = (len > *rarraylen ? *rarraylen : len);
1671 			memcpy(rarray, ptr, *rarraylen);
1672 		}
1673 		ptr += len;
1674 	}
1675 	/* check and possible copy reply var array */
1676 	len = *((u16 *)ptr);
1677 	if (len > sizeof(u16)) {
1678 		ptr += sizeof(u16);
1679 		len -= sizeof(u16);
1680 		if (varray && varraylen && *varraylen > 0) {
1681 			*varraylen = (len > *varraylen ? *varraylen : len);
1682 			memcpy(varray, ptr, *varraylen);
1683 		}
1684 		ptr += len;
1685 	}
1686 
1687 out:
1688 	free_cprbmem(mem, parmbsize, false, xflags);
1689 	return rc;
1690 }
1691 EXPORT_SYMBOL(cca_query_crypto_facility);
1692 
1693 /*
1694  * Fetch cca_info values about a CCA queue via
1695  * query_crypto_facility from adapter.
1696  */
1697 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags)
1698 {
1699 	void *mem;
1700 	int rc, found = 0;
1701 	size_t rlen, vlen;
1702 	u8 *rarray, *varray;
1703 	struct zcrypt_device_status_ext devstat;
1704 
1705 	memset(ci, 0, sizeof(*ci));
1706 
1707 	/* if specific domain given, fetch status and hw info for this apqn */
1708 	if (domain != AUTOSEL_DOM) {
1709 		rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
1710 		if (rc)
1711 			return rc;
1712 		ci->hwtype = devstat.hwtype;
1713 	}
1714 
1715 	/*
1716 	 * Prep memory for rule array and var array use.
1717 	 * Use the cprb mempool for this.
1718 	 */
1719 	mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ?
1720 		mempool_alloc_preallocated(cprb_mempool) :
1721 		mempool_alloc(cprb_mempool, GFP_KERNEL);
1722 	if (!mem)
1723 		return -ENOMEM;
1724 	rarray = (u8 *)mem;
1725 	varray = (u8 *)mem + PAGE_SIZE / 2;
1726 	rlen = vlen = PAGE_SIZE / 2;
1727 
1728 	/* QF for this card/domain */
1729 	rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
1730 				       rarray, &rlen, varray, &vlen, xflags);
1731 	if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) {
1732 		memcpy(ci->serial, rarray, 8);
1733 		ci->new_asym_mk_state = (char)rarray[4 * 8];
1734 		ci->cur_asym_mk_state = (char)rarray[5 * 8];
1735 		ci->old_asym_mk_state = (char)rarray[6 * 8];
1736 		if (ci->old_asym_mk_state == '2')
1737 			memcpy(ci->old_asym_mkvp, varray + 64, 16);
1738 		if (ci->cur_asym_mk_state == '2')
1739 			memcpy(ci->cur_asym_mkvp, varray + 84, 16);
1740 		if (ci->new_asym_mk_state == '3')
1741 			memcpy(ci->new_asym_mkvp, varray + 104, 16);
1742 		ci->new_aes_mk_state = (char)rarray[7 * 8];
1743 		ci->cur_aes_mk_state = (char)rarray[8 * 8];
1744 		ci->old_aes_mk_state = (char)rarray[9 * 8];
1745 		if (ci->old_aes_mk_state == '2')
1746 			memcpy(&ci->old_aes_mkvp, varray + 172, 8);
1747 		if (ci->cur_aes_mk_state == '2')
1748 			memcpy(&ci->cur_aes_mkvp, varray + 184, 8);
1749 		if (ci->new_aes_mk_state == '3')
1750 			memcpy(&ci->new_aes_mkvp, varray + 196, 8);
1751 		found++;
1752 	}
1753 	if (!found)
1754 		goto out;
1755 	rlen = vlen = PAGE_SIZE / 2;
1756 	rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
1757 				       rarray, &rlen, varray, &vlen, xflags);
1758 	if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) {
1759 		ci->new_apka_mk_state = (char)rarray[10 * 8];
1760 		ci->cur_apka_mk_state = (char)rarray[11 * 8];
1761 		ci->old_apka_mk_state = (char)rarray[12 * 8];
1762 		if (ci->old_apka_mk_state == '2')
1763 			memcpy(&ci->old_apka_mkvp, varray + 208, 8);
1764 		if (ci->cur_apka_mk_state == '2')
1765 			memcpy(&ci->cur_apka_mkvp, varray + 220, 8);
1766 		if (ci->new_apka_mk_state == '3')
1767 			memcpy(&ci->new_apka_mkvp, varray + 232, 8);
1768 		found++;
1769 	}
1770 
1771 out:
1772 	mempool_free(mem, cprb_mempool);
1773 	return found == 2 ? 0 : -ENOENT;
1774 }
1775 EXPORT_SYMBOL(cca_get_info);
1776 
1777 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
1778 		  int minhwtype, int mktype,
1779 		  const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags)
1780 {
1781 	struct zcrypt_device_status_ext *device_status;
1782 	int i, card, dom, curmatch, oldmatch;
1783 	struct cca_info ci;
1784 	u32 _nr_apqns = 0;
1785 
1786 	/* occupy the device status memory */
1787 	mutex_lock(&dev_status_mem_mutex);
1788 	memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE);
1789 	device_status = (struct zcrypt_device_status_ext *)dev_status_mem;
1790 
1791 	/* fetch crypto device status into this struct */
1792 	zcrypt_device_status_mask_ext(device_status,
1793 				      ZCRYPT_DEV_STATUS_CARD_MAX,
1794 				      ZCRYPT_DEV_STATUS_QUEUE_MAX);
1795 
1796 	/* walk through all the crypto apqnss */
1797 	for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) {
1798 		card = AP_QID_CARD(device_status[i].qid);
1799 		dom = AP_QID_QUEUE(device_status[i].qid);
1800 		/* check online state */
1801 		if (!device_status[i].online)
1802 			continue;
1803 		/* check for cca functions */
1804 		if (!(device_status[i].functions & 0x04))
1805 			continue;
1806 		/* check cardnr */
1807 		if (cardnr != 0xFFFF && card != cardnr)
1808 			continue;
1809 		/* check domain */
1810 		if (domain != 0xFFFF && dom != domain)
1811 			continue;
1812 		/* get cca info on this apqn */
1813 		if (cca_get_info(card, dom, &ci, xflags))
1814 			continue;
1815 		/* current master key needs to be valid */
1816 		if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2')
1817 			continue;
1818 		if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2')
1819 			continue;
1820 		/* check min hardware type */
1821 		if (minhwtype > 0 && minhwtype > ci.hwtype)
1822 			continue;
1823 		if (ptr_cur_mkvp || ptr_old_mkvp) {
1824 			/* check mkvps */
1825 			curmatch = oldmatch = 0;
1826 			if (mktype == AES_MK_SET) {
1827 				if (ptr_cur_mkvp &&
1828 				    !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp,
1829 					    sizeof(ci.cur_aes_mkvp)))
1830 					curmatch = 1;
1831 				if (ptr_old_mkvp &&
1832 				    ci.old_aes_mk_state == '2' &&
1833 				    !memcmp(ptr_old_mkvp, ci.old_aes_mkvp,
1834 					    sizeof(ci.old_aes_mkvp)))
1835 					oldmatch = 1;
1836 			} else {
1837 				if (ptr_cur_mkvp &&
1838 				    !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp,
1839 					    sizeof(ci.cur_apka_mkvp)))
1840 					curmatch = 1;
1841 				if (ptr_old_mkvp &&
1842 				    ci.old_apka_mk_state == '2' &&
1843 				    !memcmp(ptr_old_mkvp, ci.old_apka_mkvp,
1844 					    sizeof(ci.old_apka_mkvp)))
1845 					oldmatch = 1;
1846 			}
1847 			if (curmatch + oldmatch < 1)
1848 				continue;
1849 		}
1850 		/* apqn passed all filtering criterons, add to the array */
1851 		if (_nr_apqns < *nr_apqns)
1852 			apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom);
1853 	}
1854 
1855 	*nr_apqns = _nr_apqns;
1856 
1857 	/* release the device status memory */
1858 	mutex_unlock(&dev_status_mem_mutex);
1859 
1860 	return _nr_apqns ? 0 : -ENODEV;
1861 }
1862 EXPORT_SYMBOL(cca_findcard2);
1863 
1864 int __init zcrypt_ccamisc_init(void)
1865 {
1866 	/* Pre-allocate a small memory pool for cca cprbs. */
1867 	cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold,
1868 						   CPRB_MEMPOOL_ITEM_SIZE);
1869 	if (!cprb_mempool)
1870 		return -ENOMEM;
1871 
1872 	/* Pre-allocate one crypto status card struct used in findcard() */
1873 	dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL);
1874 	if (!dev_status_mem) {
1875 		mempool_destroy(cprb_mempool);
1876 		return -ENOMEM;
1877 	}
1878 
1879 	return 0;
1880 }
1881 
1882 void zcrypt_ccamisc_exit(void)
1883 {
1884 	mutex_lock(&dev_status_mem_mutex);
1885 	kvfree(dev_status_mem);
1886 	mutex_unlock(&dev_status_mem_mutex);
1887 	mempool_destroy(cprb_mempool);
1888 }
1889