1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright IBM Corp. 2019 4 * Author(s): Harald Freudenberger <freude@linux.ibm.com> 5 * Ingo Franzki <ifranzki@linux.ibm.com> 6 * 7 * Collection of CCA misc functions used by zcrypt and pkey 8 */ 9 10 #define pr_fmt(fmt) "zcrypt: " fmt 11 12 #include <linux/export.h> 13 #include <linux/init.h> 14 #include <linux/mempool.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/random.h> 18 #include <linux/align.h> 19 #include <asm/zcrypt.h> 20 #include <asm/pkey.h> 21 22 #include "ap_bus.h" 23 #include "zcrypt_api.h" 24 #include "zcrypt_debug.h" 25 #include "zcrypt_msgtype6.h" 26 #include "zcrypt_ccamisc.h" 27 28 /* Size of parameter block used for all cca requests/replies */ 29 #define PARMBSIZE 512 30 31 /* Size of vardata block used for some of the cca requests/replies */ 32 #define VARDATASIZE 4096 33 34 /* 35 * Cprb memory pool held for urgent cases where no memory 36 * can be allocated via kmalloc. This pool is only used 37 * when alloc_and_prep_cprbmem() is called with the xflag 38 * ZCRYPT_XFLAG_NOMEMALLOC. The cprb memory needs to hold 39 * space for request AND reply! 40 */ 41 #define CPRB_MEMPOOL_ITEM_SIZE (16 * 1024) 42 static mempool_t *cprb_mempool; 43 44 /* 45 * This is a pre-allocated memory for the device status array 46 * used within the findcard() functions. It is currently 47 * 128 * 128 * 4 bytes = 64 KB big. Usage of this memory is 48 * controlled via dev_status_mem_mutex. Needs adaption if more 49 * than 128 cards or domains to be are supported. 50 */ 51 #define ZCRYPT_DEV_STATUS_CARD_MAX 128 52 #define ZCRYPT_DEV_STATUS_QUEUE_MAX 128 53 #define ZCRYPT_DEV_STATUS_ENTRIES (ZCRYPT_DEV_STATUS_CARD_MAX * \ 54 ZCRYPT_DEV_STATUS_QUEUE_MAX) 55 #define ZCRYPT_DEV_STATUS_EXT_SIZE (ZCRYPT_DEV_STATUS_ENTRIES * \ 56 sizeof(struct zcrypt_device_status_ext)) 57 static void *dev_status_mem; 58 static DEFINE_MUTEX(dev_status_mem_mutex); 59 60 /* 61 * Simple check if the token is a valid CCA secure AES data key 62 * token. If keybitsize is given, the bitsize of the key is 63 * also checked. Returns 0 on success or errno value on failure. 64 */ 65 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl, 66 const u8 *token, u32 keysize, int keybitsize) 67 { 68 struct secaeskeytoken *t = (struct secaeskeytoken *)token; 69 70 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 71 72 if (keysize < sizeof(*t)) { 73 if (dbg) 74 DBF("%s keysize %u < min token size %zu\n", 75 __func__, keysize, sizeof(*t)); 76 return -EINVAL; 77 } 78 if (t->type != TOKTYPE_CCA_INTERNAL) { 79 if (dbg) 80 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 81 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 82 return -EINVAL; 83 } 84 if (t->version != TOKVER_CCA_AES) { 85 if (dbg) 86 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 87 __func__, (int)t->version, TOKVER_CCA_AES); 88 return -EINVAL; 89 } 90 if (keybitsize > 0 && t->bitsize != keybitsize) { 91 if (dbg) 92 DBF("%s token check failed, bitsize %d != %d\n", 93 __func__, (int)t->bitsize, keybitsize); 94 return -EINVAL; 95 } 96 97 #undef DBF 98 99 return 0; 100 } 101 EXPORT_SYMBOL(cca_check_secaeskeytoken); 102 103 /* 104 * Simple check if the token is a valid CCA secure AES cipher key 105 * token. If keybitsize is given, the bitsize of the key is 106 * also checked. If checkcpacfexport is enabled, the key is also 107 * checked for the export flag to allow CPACF export. 108 * Returns 0 on success or errno value on failure. 109 */ 110 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl, 111 const u8 *token, u32 keysize, 112 int keybitsize, int checkcpacfexport) 113 { 114 struct cipherkeytoken *t = (struct cipherkeytoken *)token; 115 bool keybitsizeok = true; 116 117 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 118 119 if (keysize < sizeof(*t)) { 120 if (dbg) 121 DBF("%s keysize %u < min token size %zu\n", 122 __func__, keysize, sizeof(*t)); 123 return -EINVAL; 124 } 125 if (t->type != TOKTYPE_CCA_INTERNAL) { 126 if (dbg) 127 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 128 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL); 129 return -EINVAL; 130 } 131 if (t->version != TOKVER_CCA_VLSC) { 132 if (dbg) 133 DBF("%s token check failed, version 0x%02x != 0x%02x\n", 134 __func__, (int)t->version, TOKVER_CCA_VLSC); 135 return -EINVAL; 136 } 137 if (t->len > keysize) { 138 if (dbg) 139 DBF("%s token check failed, len %d > keysize %u\n", 140 __func__, (int)t->len, keysize); 141 return -EINVAL; 142 } 143 if (t->len < sizeof(*t)) { 144 if (dbg) 145 DBF("%s token check failed, len %d < min token size %zu\n", 146 __func__, (int)t->len, sizeof(*t)); 147 return -EINVAL; 148 } 149 if (t->algtype != 0x02) { 150 if (dbg) 151 DBF("%s token check failed, algtype 0x%02x != 0x02\n", 152 __func__, (int)t->algtype); 153 return -EINVAL; 154 } 155 if (t->keytype != 0x0001) { 156 if (dbg) 157 DBF("%s token check failed, keytype 0x%04x != 0x0001\n", 158 __func__, (int)t->keytype); 159 return -EINVAL; 160 } 161 if (t->plfver != 0x00 && t->plfver != 0x01) { 162 if (dbg) 163 DBF("%s token check failed, unknown plfver 0x%02x\n", 164 __func__, (int)t->plfver); 165 return -EINVAL; 166 } 167 if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) { 168 if (dbg) 169 DBF("%s token check failed, unknown wpllen %d\n", 170 __func__, (int)t->wpllen); 171 return -EINVAL; 172 } 173 if (keybitsize > 0) { 174 switch (keybitsize) { 175 case 128: 176 if (t->wpllen != (t->plfver ? 640 : 512)) 177 keybitsizeok = false; 178 break; 179 case 192: 180 if (t->wpllen != (t->plfver ? 640 : 576)) 181 keybitsizeok = false; 182 break; 183 case 256: 184 if (t->wpllen != 640) 185 keybitsizeok = false; 186 break; 187 default: 188 keybitsizeok = false; 189 break; 190 } 191 if (!keybitsizeok) { 192 if (dbg) 193 DBF("%s token check failed, bitsize %d\n", 194 __func__, keybitsize); 195 return -EINVAL; 196 } 197 } 198 if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) { 199 if (dbg) 200 DBF("%s token check failed, XPRT_CPAC bit is 0\n", 201 __func__); 202 return -EINVAL; 203 } 204 205 #undef DBF 206 207 return 0; 208 } 209 EXPORT_SYMBOL(cca_check_secaescipherkey); 210 211 /* 212 * Simple check if the token is a valid CCA secure ECC private 213 * key token. Returns 0 on success or errno value on failure. 214 */ 215 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl, 216 const u8 *token, u32 keysize, 217 int checkcpacfexport) 218 { 219 struct eccprivkeytoken *t = (struct eccprivkeytoken *)token; 220 221 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__) 222 223 if (keysize < sizeof(*t)) { 224 if (dbg) 225 DBF("%s keysize %u < min token size %zu\n", 226 __func__, keysize, sizeof(*t)); 227 return -EINVAL; 228 } 229 if (t->type != TOKTYPE_CCA_INTERNAL_PKA) { 230 if (dbg) 231 DBF("%s token check failed, type 0x%02x != 0x%02x\n", 232 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA); 233 return -EINVAL; 234 } 235 if (t->len > keysize) { 236 if (dbg) 237 DBF("%s token check failed, len %d > keysize %u\n", 238 __func__, (int)t->len, keysize); 239 return -EINVAL; 240 } 241 if (t->len < sizeof(*t)) { 242 if (dbg) 243 DBF("%s token check failed, len %d < min token size %zu\n", 244 __func__, (int)t->len, sizeof(*t)); 245 return -EINVAL; 246 } 247 if (t->secid != 0x20) { 248 if (dbg) 249 DBF("%s token check failed, secid 0x%02x != 0x20\n", 250 __func__, (int)t->secid); 251 return -EINVAL; 252 } 253 if (checkcpacfexport && !(t->kutc & 0x01)) { 254 if (dbg) 255 DBF("%s token check failed, XPRTCPAC bit is 0\n", 256 __func__); 257 return -EINVAL; 258 } 259 260 #undef DBF 261 262 return 0; 263 } 264 EXPORT_SYMBOL(cca_check_sececckeytoken); 265 266 /* 267 * Allocate consecutive memory for request CPRB, request param 268 * block, reply CPRB and reply param block and fill in values 269 * for the common fields. Returns 0 on success or errno value 270 * on failure. 271 * It is guaranteed that request and a possible param block 272 * are aligned to a 4 byte boundary. Furthermore if a param 273 * block is used, the memory allocated for this is rounded up to 274 * the next multiple of 4 bytes. 275 */ 276 static int alloc_and_prep_cprbmem(size_t paramblen, 277 u8 **p_cprb_mem, 278 struct CPRBX **p_req_cprb, 279 struct CPRBX **p_rep_cprb, 280 u32 xflags) 281 { 282 u8 *cprbmem = NULL; 283 size_t cprbplusparamblen = 284 ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4); 285 size_t len = 2 * cprbplusparamblen; 286 struct CPRBX *preqcblk, *prepcblk; 287 288 /* 289 * allocate consecutive memory for request CPRB, request param 290 * block, reply CPRB and reply param block 291 */ 292 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) { 293 if (len <= CPRB_MEMPOOL_ITEM_SIZE) 294 cprbmem = mempool_alloc_preallocated(cprb_mempool); 295 } else { 296 cprbmem = kmalloc(len, GFP_KERNEL); 297 } 298 if (!cprbmem) 299 return -ENOMEM; 300 memset(cprbmem, 0, len); 301 302 preqcblk = (struct CPRBX *)cprbmem; 303 prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen); 304 305 /* fill request cprb struct */ 306 preqcblk->cprb_len = sizeof(struct CPRBX); 307 preqcblk->cprb_ver_id = 0x02; 308 memcpy(preqcblk->func_id, "T2", 2); 309 preqcblk->rpl_msgbl = cprbplusparamblen; 310 if (paramblen) { 311 preqcblk->req_parmb = ((u8 __user *)preqcblk) + 312 ALIGN(sizeof(struct CPRBX), 4); 313 preqcblk->rpl_parmb = ((u8 __user *)prepcblk) + 314 ALIGN(sizeof(struct CPRBX), 4); 315 } 316 317 *p_cprb_mem = cprbmem; 318 *p_req_cprb = preqcblk; 319 *p_rep_cprb = prepcblk; 320 321 return 0; 322 } 323 324 /* 325 * Free the cprb memory allocated with the function above. 326 * If the scrub value is not zero, the memory is filled 327 * with zeros before freeing (useful if there was some 328 * clear key material in there). 329 */ 330 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags) 331 { 332 size_t cprblen = ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4); 333 334 if (mem && scrub) 335 memzero_explicit(mem, 2 * cprblen); 336 337 if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) 338 mempool_free(mem, cprb_mempool); 339 else 340 kfree(mem); 341 } 342 343 /* 344 * Helper function to prepare the xcrb struct 345 */ 346 static inline void prep_xcrb(struct ica_xcRB *pxcrb, 347 u16 cardnr, 348 struct CPRBX *preqcblk, 349 struct CPRBX *prepcblk) 350 { 351 memset(pxcrb, 0, sizeof(*pxcrb)); 352 memcpy(&pxcrb->agent_ID, "CA", 2); 353 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr); 354 pxcrb->request_control_blk_length = 355 preqcblk->cprb_len + preqcblk->req_parml; 356 pxcrb->request_control_blk_addr = (void __user *)preqcblk; 357 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl; 358 pxcrb->reply_control_blk_addr = (void __user *)prepcblk; 359 } 360 361 /* 362 * Generate (random) CCA AES DATA secure key. 363 */ 364 int cca_genseckey(u16 cardnr, u16 domain, 365 u32 keybitsize, u8 *seckey, u32 xflags) 366 { 367 int i, rc, keysize; 368 int seckeysize; 369 u8 *mem, *ptr; 370 struct CPRBX *preqcblk, *prepcblk; 371 struct ica_xcRB xcrb; 372 struct kgreqparm { 373 u8 subfunc_code[2]; 374 u16 rule_array_len; 375 struct lv1 { 376 u16 len; 377 char key_form[8]; 378 char key_length[8]; 379 char key_type1[8]; 380 char key_type2[8]; 381 } lv1; 382 struct lv2 { 383 u16 len; 384 struct keyid { 385 u16 len; 386 u16 attr; 387 u8 data[SECKEYBLOBSIZE]; 388 } keyid[6]; 389 } lv2; 390 } __packed * preqparm; 391 struct kgrepparm { 392 u8 subfunc_code[2]; 393 u16 rule_array_len; 394 struct lv3 { 395 u16 len; 396 u16 keyblocklen; 397 struct { 398 u16 toklen; 399 u16 tokattr; 400 u8 tok[]; 401 /* ... some more data ... */ 402 } keyblock; 403 } lv3; 404 } __packed * prepparm; 405 406 /* get already prepared memory for 2 cprbs with param block each */ 407 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 408 &preqcblk, &prepcblk, xflags); 409 if (rc) 410 return rc; 411 412 /* fill request cprb struct */ 413 preqcblk->domain = domain; 414 415 /* fill request cprb param block with KG request */ 416 preqparm = (struct kgreqparm __force *)preqcblk->req_parmb; 417 memcpy(preqparm->subfunc_code, "KG", 2); 418 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 419 preqparm->lv1.len = sizeof(struct lv1); 420 memcpy(preqparm->lv1.key_form, "OP ", 8); 421 switch (keybitsize) { 422 case PKEY_SIZE_AES_128: 423 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 424 keysize = 16; 425 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8); 426 break; 427 case PKEY_SIZE_AES_192: 428 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 429 keysize = 24; 430 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8); 431 break; 432 case PKEY_SIZE_AES_256: 433 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 434 keysize = 32; 435 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8); 436 break; 437 default: 438 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 439 __func__, keybitsize); 440 rc = -EINVAL; 441 goto out; 442 } 443 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8); 444 preqparm->lv2.len = sizeof(struct lv2); 445 for (i = 0; i < 6; i++) { 446 preqparm->lv2.keyid[i].len = sizeof(struct keyid); 447 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10); 448 } 449 preqcblk->req_parml = sizeof(struct kgreqparm); 450 451 /* fill xcrb struct */ 452 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 453 454 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 455 rc = zcrypt_send_cprb(&xcrb, xflags); 456 if (rc) { 457 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n", 458 __func__, (int)cardnr, (int)domain, rc); 459 goto out; 460 } 461 462 /* check response returncode and reasoncode */ 463 if (prepcblk->ccp_rtcode != 0) { 464 ZCRYPT_DBF_ERR("%s secure key generate failure, card response %d/%d\n", 465 __func__, 466 (int)prepcblk->ccp_rtcode, 467 (int)prepcblk->ccp_rscode); 468 rc = -EIO; 469 goto out; 470 } 471 472 /* process response cprb param block */ 473 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 474 prepcblk->rpl_parmb = (u8 __user *)ptr; 475 prepparm = (struct kgrepparm *)ptr; 476 477 /* check length of the returned secure key token */ 478 seckeysize = prepparm->lv3.keyblock.toklen 479 - sizeof(prepparm->lv3.keyblock.toklen) 480 - sizeof(prepparm->lv3.keyblock.tokattr); 481 if (seckeysize != SECKEYBLOBSIZE) { 482 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 483 __func__, seckeysize, SECKEYBLOBSIZE); 484 rc = -EIO; 485 goto out; 486 } 487 488 /* check secure key token */ 489 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 490 prepparm->lv3.keyblock.tok, 491 seckeysize, 8 * keysize); 492 if (rc) { 493 rc = -EIO; 494 goto out; 495 } 496 497 /* copy the generated secure key token */ 498 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 499 500 out: 501 free_cprbmem(mem, PARMBSIZE, false, xflags); 502 return rc; 503 } 504 EXPORT_SYMBOL(cca_genseckey); 505 506 /* 507 * Generate an CCA AES DATA secure key with given key value. 508 */ 509 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize, 510 const u8 *clrkey, u8 *seckey, u32 xflags) 511 { 512 int rc, keysize, seckeysize; 513 u8 *mem, *ptr; 514 struct CPRBX *preqcblk, *prepcblk; 515 struct ica_xcRB xcrb; 516 struct cmreqparm { 517 u8 subfunc_code[2]; 518 u16 rule_array_len; 519 char rule_array[8]; 520 struct lv1 { 521 u16 len; 522 u8 clrkey[]; 523 } lv1; 524 /* followed by struct lv2 */ 525 } __packed * preqparm; 526 struct lv2 { 527 u16 len; 528 struct keyid { 529 u16 len; 530 u16 attr; 531 u8 data[SECKEYBLOBSIZE]; 532 } keyid; 533 } __packed * plv2; 534 struct cmrepparm { 535 u8 subfunc_code[2]; 536 u16 rule_array_len; 537 struct lv3 { 538 u16 len; 539 u16 keyblocklen; 540 struct { 541 u16 toklen; 542 u16 tokattr; 543 u8 tok[]; 544 /* ... some more data ... */ 545 } keyblock; 546 } lv3; 547 } __packed * prepparm; 548 549 /* get already prepared memory for 2 cprbs with param block each */ 550 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 551 &preqcblk, &prepcblk, xflags); 552 if (rc) 553 return rc; 554 555 /* fill request cprb struct */ 556 preqcblk->domain = domain; 557 558 /* fill request cprb param block with CM request */ 559 preqparm = (struct cmreqparm __force *)preqcblk->req_parmb; 560 memcpy(preqparm->subfunc_code, "CM", 2); 561 memcpy(preqparm->rule_array, "AES ", 8); 562 preqparm->rule_array_len = 563 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 564 switch (keybitsize) { 565 case PKEY_SIZE_AES_128: 566 case PKEY_KEYTYPE_AES_128: /* older ioctls used this */ 567 keysize = 16; 568 break; 569 case PKEY_SIZE_AES_192: 570 case PKEY_KEYTYPE_AES_192: /* older ioctls used this */ 571 keysize = 24; 572 break; 573 case PKEY_SIZE_AES_256: 574 case PKEY_KEYTYPE_AES_256: /* older ioctls used this */ 575 keysize = 32; 576 break; 577 default: 578 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 579 __func__, keybitsize); 580 rc = -EINVAL; 581 goto out; 582 } 583 preqparm->lv1.len = sizeof(struct lv1) + keysize; 584 memcpy(preqparm->lv1.clrkey, clrkey, keysize); 585 plv2 = (struct lv2 *)(((u8 *)preqparm) + sizeof(*preqparm) + keysize); 586 plv2->len = sizeof(struct lv2); 587 plv2->keyid.len = sizeof(struct keyid); 588 plv2->keyid.attr = 0x30; 589 preqcblk->req_parml = sizeof(*preqparm) + keysize + sizeof(*plv2); 590 591 /* fill xcrb struct */ 592 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 593 594 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 595 rc = zcrypt_send_cprb(&xcrb, xflags); 596 if (rc) { 597 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 598 __func__, (int)cardnr, (int)domain, rc); 599 goto out; 600 } 601 602 /* check response returncode and reasoncode */ 603 if (prepcblk->ccp_rtcode != 0) { 604 ZCRYPT_DBF_ERR("%s clear key import failure, card response %d/%d\n", 605 __func__, 606 (int)prepcblk->ccp_rtcode, 607 (int)prepcblk->ccp_rscode); 608 rc = -EIO; 609 goto out; 610 } 611 612 /* process response cprb param block */ 613 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 614 prepcblk->rpl_parmb = (u8 __user *)ptr; 615 prepparm = (struct cmrepparm *)ptr; 616 617 /* check length of the returned secure key token */ 618 seckeysize = prepparm->lv3.keyblock.toklen 619 - sizeof(prepparm->lv3.keyblock.toklen) 620 - sizeof(prepparm->lv3.keyblock.tokattr); 621 if (seckeysize != SECKEYBLOBSIZE) { 622 ZCRYPT_DBF_ERR("%s secure token size mismatch %d != %d bytes\n", 623 __func__, seckeysize, SECKEYBLOBSIZE); 624 rc = -EIO; 625 goto out; 626 } 627 628 /* check secure key token */ 629 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR, 630 prepparm->lv3.keyblock.tok, 631 seckeysize, 8 * keysize); 632 if (rc) { 633 rc = -EIO; 634 goto out; 635 } 636 637 /* copy the generated secure key token */ 638 if (seckey) 639 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 640 641 out: 642 free_cprbmem(mem, PARMBSIZE, true, xflags); 643 return rc; 644 } 645 EXPORT_SYMBOL(cca_clr2seckey); 646 647 /* 648 * Derive proteced key from an CCA AES DATA secure key. 649 */ 650 int cca_sec2protkey(u16 cardnr, u16 domain, 651 const u8 *seckey, u8 *protkey, u32 *protkeylen, 652 u32 *protkeytype, u32 xflags) 653 { 654 int rc; 655 u8 *mem, *ptr; 656 struct CPRBX *preqcblk, *prepcblk; 657 struct ica_xcRB xcrb; 658 struct uskreqparm { 659 u8 subfunc_code[2]; 660 u16 rule_array_len; 661 struct lv1 { 662 u16 len; 663 u16 attr_len; 664 u16 attr_flags; 665 } lv1; 666 struct lv2 { 667 u16 len; 668 u16 attr_len; 669 u16 attr_flags; 670 u8 token[]; /* cca secure key token */ 671 } lv2; 672 } __packed * preqparm; 673 struct uskrepparm { 674 u8 subfunc_code[2]; 675 u16 rule_array_len; 676 struct lv3 { 677 u16 len; 678 u16 attr_len; 679 u16 attr_flags; 680 struct cpacfkeyblock { 681 u8 version; /* version of this struct */ 682 u8 flags[2]; 683 u8 algo; 684 u8 form; 685 u8 pad1[3]; 686 u16 len; 687 u8 key[64]; /* the key (len bytes) */ 688 u16 keyattrlen; 689 u8 keyattr[32]; 690 u8 pad2[1]; 691 u8 vptype; 692 u8 vp[32]; /* verification pattern */ 693 } ckb; 694 } lv3; 695 } __packed * prepparm; 696 697 /* get already prepared memory for 2 cprbs with param block each */ 698 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 699 &preqcblk, &prepcblk, xflags); 700 if (rc) 701 return rc; 702 703 /* fill request cprb struct */ 704 preqcblk->domain = domain; 705 706 /* fill request cprb param block with USK request */ 707 preqparm = (struct uskreqparm __force *)preqcblk->req_parmb; 708 memcpy(preqparm->subfunc_code, "US", 2); 709 preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 710 preqparm->lv1.len = sizeof(struct lv1); 711 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len); 712 preqparm->lv1.attr_flags = 0x0001; 713 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE; 714 preqparm->lv2.attr_len = sizeof(struct lv2) 715 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE; 716 preqparm->lv2.attr_flags = 0x0000; 717 memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE); 718 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE; 719 720 /* fill xcrb struct */ 721 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 722 723 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 724 rc = zcrypt_send_cprb(&xcrb, xflags); 725 if (rc) { 726 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 727 __func__, (int)cardnr, (int)domain, rc); 728 goto out; 729 } 730 731 /* check response returncode and reasoncode */ 732 if (prepcblk->ccp_rtcode != 0) { 733 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 734 __func__, 735 (int)prepcblk->ccp_rtcode, 736 (int)prepcblk->ccp_rscode); 737 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 738 rc = -EBUSY; 739 else 740 rc = -EIO; 741 goto out; 742 } 743 if (prepcblk->ccp_rscode != 0) { 744 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 745 __func__, 746 (int)prepcblk->ccp_rtcode, 747 (int)prepcblk->ccp_rscode); 748 } 749 750 /* process response cprb param block */ 751 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 752 prepcblk->rpl_parmb = (u8 __user *)ptr; 753 prepparm = (struct uskrepparm *)ptr; 754 755 /* check the returned keyblock */ 756 if (prepparm->lv3.ckb.version != 0x01 && 757 prepparm->lv3.ckb.version != 0x02) { 758 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 759 __func__, (int)prepparm->lv3.ckb.version); 760 rc = -EIO; 761 goto out; 762 } 763 764 /* copy the translated protected key */ 765 switch (prepparm->lv3.ckb.len) { 766 case 16 + 32: 767 /* AES 128 protected key */ 768 if (protkeytype) 769 *protkeytype = PKEY_KEYTYPE_AES_128; 770 break; 771 case 24 + 32: 772 /* AES 192 protected key */ 773 if (protkeytype) 774 *protkeytype = PKEY_KEYTYPE_AES_192; 775 break; 776 case 32 + 32: 777 /* AES 256 protected key */ 778 if (protkeytype) 779 *protkeytype = PKEY_KEYTYPE_AES_256; 780 break; 781 default: 782 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 783 __func__, prepparm->lv3.ckb.len); 784 rc = -EIO; 785 goto out; 786 } 787 memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len); 788 if (protkeylen) 789 *protkeylen = prepparm->lv3.ckb.len; 790 791 out: 792 free_cprbmem(mem, PARMBSIZE, true, xflags); 793 return rc; 794 } 795 EXPORT_SYMBOL(cca_sec2protkey); 796 797 /* 798 * AES cipher key skeleton created with CSNBKTB2 with these flags: 799 * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY, 800 * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA 801 * used by cca_gencipherkey() and cca_clr2cipherkey(). 802 */ 803 static const u8 aes_cipher_key_skeleton[] = { 804 0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00, 805 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 806 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 807 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 808 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 809 0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff, 810 0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 }; 811 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton)) 812 813 /* 814 * Generate (random) CCA AES CIPHER secure key. 815 */ 816 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags, 817 u8 *keybuf, u32 *keybufsize, u32 xflags) 818 { 819 int rc; 820 u8 *mem, *ptr; 821 struct CPRBX *preqcblk, *prepcblk; 822 struct ica_xcRB xcrb; 823 struct gkreqparm { 824 u8 subfunc_code[2]; 825 u16 rule_array_len; 826 char rule_array[2 * 8]; 827 struct { 828 u16 len; 829 u8 key_type_1[8]; 830 u8 key_type_2[8]; 831 u16 clear_key_bit_len; 832 u16 key_name_1_len; 833 u16 key_name_2_len; 834 u16 user_data_1_len; 835 u16 user_data_2_len; 836 /* u8 key_name_1[]; */ 837 /* u8 key_name_2[]; */ 838 /* u8 user_data_1[]; */ 839 /* u8 user_data_2[]; */ 840 } vud; 841 struct { 842 u16 len; 843 struct { 844 u16 len; 845 u16 flag; 846 /* u8 kek_id_1[]; */ 847 } tlv1; 848 struct { 849 u16 len; 850 u16 flag; 851 /* u8 kek_id_2[]; */ 852 } tlv2; 853 struct { 854 u16 len; 855 u16 flag; 856 u8 gen_key_id_1[SIZEOF_SKELETON]; 857 } tlv3; 858 struct { 859 u16 len; 860 u16 flag; 861 /* u8 gen_key_id_1_label[]; */ 862 } tlv4; 863 struct { 864 u16 len; 865 u16 flag; 866 /* u8 gen_key_id_2[]; */ 867 } tlv5; 868 struct { 869 u16 len; 870 u16 flag; 871 /* u8 gen_key_id_2_label[]; */ 872 } tlv6; 873 } kb; 874 } __packed * preqparm; 875 struct gkrepparm { 876 u8 subfunc_code[2]; 877 u16 rule_array_len; 878 struct { 879 u16 len; 880 } vud; 881 struct { 882 u16 len; 883 struct { 884 u16 len; 885 u16 flag; 886 u8 gen_key[]; /* 120-136 bytes */ 887 } tlv1; 888 } kb; 889 } __packed * prepparm; 890 struct cipherkeytoken *t; 891 u32 keybuflen; 892 893 /* get already prepared memory for 2 cprbs with param block each */ 894 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 895 &preqcblk, &prepcblk, xflags); 896 if (rc) 897 return rc; 898 899 /* fill request cprb struct */ 900 preqcblk->domain = domain; 901 preqcblk->req_parml = sizeof(struct gkreqparm); 902 903 /* prepare request param block with GK request */ 904 preqparm = (struct gkreqparm __force *)preqcblk->req_parmb; 905 memcpy(preqparm->subfunc_code, "GK", 2); 906 preqparm->rule_array_len = sizeof(uint16_t) + 2 * 8; 907 memcpy(preqparm->rule_array, "AES OP ", 2 * 8); 908 909 /* prepare vud block */ 910 preqparm->vud.len = sizeof(preqparm->vud); 911 switch (keybitsize) { 912 case 128: 913 case 192: 914 case 256: 915 break; 916 default: 917 ZCRYPT_DBF_ERR("%s unknown/unsupported keybitsize %d\n", 918 __func__, keybitsize); 919 rc = -EINVAL; 920 goto out; 921 } 922 preqparm->vud.clear_key_bit_len = keybitsize; 923 memcpy(preqparm->vud.key_type_1, "TOKEN ", 8); 924 memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2)); 925 926 /* prepare kb block */ 927 preqparm->kb.len = sizeof(preqparm->kb); 928 preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1); 929 preqparm->kb.tlv1.flag = 0x0030; 930 preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2); 931 preqparm->kb.tlv2.flag = 0x0030; 932 preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3); 933 preqparm->kb.tlv3.flag = 0x0030; 934 memcpy(preqparm->kb.tlv3.gen_key_id_1, 935 aes_cipher_key_skeleton, SIZEOF_SKELETON); 936 preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4); 937 preqparm->kb.tlv4.flag = 0x0030; 938 preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5); 939 preqparm->kb.tlv5.flag = 0x0030; 940 preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6); 941 preqparm->kb.tlv6.flag = 0x0030; 942 943 /* patch the skeleton key token export flags inside the kb block */ 944 if (keygenflags) { 945 t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1; 946 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 947 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 948 } 949 950 /* prepare xcrb struct */ 951 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 952 953 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 954 rc = zcrypt_send_cprb(&xcrb, xflags); 955 if (rc) { 956 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 957 __func__, (int)cardnr, (int)domain, rc); 958 goto out; 959 } 960 961 /* check response returncode and reasoncode */ 962 if (prepcblk->ccp_rtcode != 0) { 963 ZCRYPT_DBF_ERR("%s cipher key generate failure, card response %d/%d\n", 964 __func__, 965 (int)prepcblk->ccp_rtcode, 966 (int)prepcblk->ccp_rscode); 967 rc = -EIO; 968 goto out; 969 } 970 971 /* process response cprb param block */ 972 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 973 prepcblk->rpl_parmb = (u8 __user *)ptr; 974 prepparm = (struct gkrepparm *)ptr; 975 976 /* do some plausibility checks on the key block */ 977 if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) || 978 prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) { 979 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 980 __func__); 981 rc = -EIO; 982 goto out; 983 } 984 985 /* and some checks on the generated key */ 986 t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key; 987 if (prepparm->kb.tlv1.len < 2 * sizeof(uint16_t) + sizeof(*t)) { 988 rc = -EIO; 989 goto out; 990 } 991 keybuflen = prepparm->kb.tlv1.len - 2 * sizeof(uint16_t); 992 rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR, 993 prepparm->kb.tlv1.gen_key, 994 keybuflen, keybitsize, 1); 995 if (rc) { 996 rc = -EIO; 997 goto out; 998 } 999 1000 /* copy the generated vlsc key token */ 1001 if (keybuf) { 1002 if (*keybufsize >= keybuflen) 1003 memcpy(keybuf, t, keybuflen); 1004 else 1005 rc = -EINVAL; 1006 } 1007 *keybufsize = keybuflen; 1008 1009 out: 1010 free_cprbmem(mem, PARMBSIZE, false, xflags); 1011 return rc; 1012 } 1013 EXPORT_SYMBOL(cca_gencipherkey); 1014 1015 /* 1016 * Helper function, does a the CSNBKPI2 CPRB. 1017 */ 1018 static int _ip_cprb_helper(u16 cardnr, u16 domain, 1019 const char *rule_array_1, 1020 const char *rule_array_2, 1021 const char *rule_array_3, 1022 const u8 *clr_key_value, 1023 int clr_key_bit_size, 1024 u8 *key_token, 1025 int *key_token_size, 1026 u32 xflags, 1027 bool scrub) 1028 { 1029 int rc, n; 1030 u8 *mem, *ptr; 1031 struct CPRBX *preqcblk, *prepcblk; 1032 struct ica_xcRB xcrb; 1033 struct rule_array_block { 1034 u8 subfunc_code[2]; 1035 u16 rule_array_len; 1036 char rule_array[]; 1037 } __packed * preq_ra_block; 1038 struct vud_block { 1039 u16 len; 1040 struct { 1041 u16 len; 1042 u16 flag; /* 0x0064 */ 1043 u16 clr_key_bit_len; 1044 } tlv1; 1045 struct { 1046 u16 len; 1047 u16 flag; /* 0x0063 */ 1048 u8 clr_key[]; /* clear key value bytes */ 1049 } tlv2; 1050 } __packed * preq_vud_block; 1051 struct key_block { 1052 u16 len; 1053 struct { 1054 u16 len; 1055 u16 flag; /* 0x0030 */ 1056 u8 key_token[]; /* key skeleton */ 1057 } tlv1; 1058 } __packed * preq_key_block; 1059 struct iprepparm { 1060 u8 subfunc_code[2]; 1061 u16 rule_array_len; 1062 struct { 1063 u16 len; 1064 } vud; 1065 struct { 1066 u16 len; 1067 struct { 1068 u16 len; 1069 u16 flag; /* 0x0030 */ 1070 u8 key_token[]; /* key token */ 1071 } tlv1; 1072 } kb; 1073 } __packed * prepparm; 1074 struct cipherkeytoken *t; 1075 int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1; 1076 1077 /* get already prepared memory for 2 cprbs with param block each */ 1078 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1079 &preqcblk, &prepcblk, xflags); 1080 if (rc) 1081 return rc; 1082 1083 /* fill request cprb struct */ 1084 preqcblk->domain = domain; 1085 preqcblk->req_parml = 0; 1086 1087 /* prepare request param block with IP request */ 1088 preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb; 1089 memcpy(preq_ra_block->subfunc_code, "IP", 2); 1090 preq_ra_block->rule_array_len = sizeof(uint16_t) + 2 * 8; 1091 memcpy(preq_ra_block->rule_array, rule_array_1, 8); 1092 memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8); 1093 preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8; 1094 if (rule_array_3) { 1095 preq_ra_block->rule_array_len += 8; 1096 memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8); 1097 preqcblk->req_parml += 8; 1098 } 1099 1100 /* prepare vud block */ 1101 preq_vud_block = (struct vud_block __force *) 1102 (preqcblk->req_parmb + preqcblk->req_parml); 1103 n = complete ? 0 : (clr_key_bit_size + 7) / 8; 1104 preq_vud_block->len = sizeof(struct vud_block) + n; 1105 preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1); 1106 preq_vud_block->tlv1.flag = 0x0064; 1107 preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size; 1108 preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n; 1109 preq_vud_block->tlv2.flag = 0x0063; 1110 if (!complete) 1111 memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n); 1112 preqcblk->req_parml += preq_vud_block->len; 1113 1114 /* prepare key block */ 1115 preq_key_block = (struct key_block __force *) 1116 (preqcblk->req_parmb + preqcblk->req_parml); 1117 n = *key_token_size; 1118 preq_key_block->len = sizeof(struct key_block) + n; 1119 preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n; 1120 preq_key_block->tlv1.flag = 0x0030; 1121 memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size); 1122 preqcblk->req_parml += preq_key_block->len; 1123 1124 /* prepare xcrb struct */ 1125 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1126 1127 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1128 rc = zcrypt_send_cprb(&xcrb, xflags); 1129 if (rc) { 1130 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1131 __func__, (int)cardnr, (int)domain, rc); 1132 goto out; 1133 } 1134 1135 /* check response returncode and reasoncode */ 1136 if (prepcblk->ccp_rtcode != 0) { 1137 ZCRYPT_DBF_ERR("%s CSNBKPI2 failure, card response %d/%d\n", 1138 __func__, 1139 (int)prepcblk->ccp_rtcode, 1140 (int)prepcblk->ccp_rscode); 1141 rc = -EIO; 1142 goto out; 1143 } 1144 1145 /* process response cprb param block */ 1146 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1147 prepcblk->rpl_parmb = (u8 __user *)ptr; 1148 prepparm = (struct iprepparm *)ptr; 1149 1150 /* do some plausibility checks on the key block */ 1151 if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) || 1152 prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) { 1153 ZCRYPT_DBF_ERR("%s reply with invalid or unknown key block\n", 1154 __func__); 1155 rc = -EIO; 1156 goto out; 1157 } 1158 1159 /* do not check the key here, it may be incomplete */ 1160 1161 /* copy the vlsc key token back */ 1162 t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token; 1163 memcpy(key_token, t, t->len); 1164 *key_token_size = t->len; 1165 1166 out: 1167 free_cprbmem(mem, PARMBSIZE, scrub, xflags); 1168 return rc; 1169 } 1170 1171 /* 1172 * Build CCA AES CIPHER secure key with a given clear key value. 1173 */ 1174 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, 1175 const u8 *clrkey, u8 *keybuf, u32 *keybufsize, u32 xflags) 1176 { 1177 int rc; 1178 void *mem; 1179 int tokensize; 1180 u8 *token, exorbuf[32]; 1181 struct cipherkeytoken *t; 1182 1183 /* fill exorbuf with random data */ 1184 get_random_bytes(exorbuf, sizeof(exorbuf)); 1185 1186 /* 1187 * Allocate space for the key token to build. 1188 * Also we only need up to MAXCCAVLSCTOKENSIZE bytes for this 1189 * we use the already existing cprb mempool to solve this 1190 * short term memory requirement. 1191 */ 1192 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1193 mempool_alloc_preallocated(cprb_mempool) : 1194 mempool_alloc(cprb_mempool, GFP_KERNEL); 1195 if (!mem) 1196 return -ENOMEM; 1197 1198 /* prepare the token with the key skeleton */ 1199 token = (u8 *)mem; 1200 tokensize = SIZEOF_SKELETON; 1201 memcpy(token, aes_cipher_key_skeleton, tokensize); 1202 1203 /* patch the skeleton key token export flags */ 1204 if (keygenflags) { 1205 t = (struct cipherkeytoken *)token; 1206 t->kmf1 |= (u16)(keygenflags & 0x0000FF00); 1207 t->kmf1 &= (u16)~(keygenflags & 0x000000FF); 1208 } 1209 1210 /* 1211 * Do the key import with the clear key value in 4 steps: 1212 * 1/4 FIRST import with only random data 1213 * 2/4 EXOR the clear key 1214 * 3/4 EXOR the very same random data again 1215 * 4/4 COMPLETE the secure cipher key import 1216 */ 1217 rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", 1218 exorbuf, keybitsize, token, &tokensize, 1219 xflags, true); 1220 if (rc) { 1221 ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", 1222 __func__, rc); 1223 goto out; 1224 } 1225 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1226 clrkey, keybitsize, token, &tokensize, 1227 xflags, true); 1228 if (rc) { 1229 ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", 1230 __func__, rc); 1231 goto out; 1232 } 1233 rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, 1234 exorbuf, keybitsize, token, &tokensize, 1235 xflags, true); 1236 if (rc) { 1237 ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", 1238 __func__, rc); 1239 goto out; 1240 } 1241 rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, 1242 NULL, keybitsize, token, &tokensize, 1243 xflags, true); 1244 if (rc) { 1245 ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", 1246 __func__, rc); 1247 goto out; 1248 } 1249 1250 /* copy the generated key token */ 1251 if (keybuf) { 1252 if (tokensize > *keybufsize) 1253 rc = -EINVAL; 1254 else 1255 memcpy(keybuf, token, tokensize); 1256 } 1257 *keybufsize = tokensize; 1258 1259 out: 1260 memzero_explicit(exorbuf, sizeof(exorbuf)); 1261 memzero_explicit(mem, CPRB_MEMPOOL_ITEM_SIZE); 1262 mempool_free(mem, cprb_mempool); 1263 return rc; 1264 } 1265 EXPORT_SYMBOL(cca_clr2cipherkey); 1266 1267 /* 1268 * Derive proteced key from CCA AES cipher secure key. 1269 */ 1270 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey, 1271 u8 *protkey, u32 *protkeylen, u32 *protkeytype, 1272 u32 xflags) 1273 { 1274 int rc; 1275 u8 *mem, *ptr; 1276 struct CPRBX *preqcblk, *prepcblk; 1277 struct ica_xcRB xcrb; 1278 struct aureqparm { 1279 u8 subfunc_code[2]; 1280 u16 rule_array_len; 1281 u8 rule_array[8]; 1282 struct { 1283 u16 len; 1284 u16 tk_blob_len; 1285 u16 tk_blob_tag; 1286 u8 tk_blob[66]; 1287 } vud; 1288 struct { 1289 u16 len; 1290 u16 cca_key_token_len; 1291 u16 cca_key_token_flags; 1292 u8 cca_key_token[]; /* 64 or more */ 1293 } kb; 1294 } __packed * preqparm; 1295 struct aurepparm { 1296 u8 subfunc_code[2]; 1297 u16 rule_array_len; 1298 struct { 1299 u16 len; 1300 u16 sublen; 1301 u16 tag; 1302 struct cpacfkeyblock { 1303 u8 version; /* version of this struct */ 1304 u8 flags[2]; 1305 u8 algo; 1306 u8 form; 1307 u8 pad1[3]; 1308 u16 keylen; 1309 u8 key[64]; /* the key (keylen bytes) */ 1310 u16 keyattrlen; 1311 u8 keyattr[32]; 1312 u8 pad2[1]; 1313 u8 vptype; 1314 u8 vp[32]; /* verification pattern */ 1315 } ckb; 1316 } vud; 1317 struct { 1318 u16 len; 1319 } kb; 1320 } __packed * prepparm; 1321 int keytoklen = ((struct cipherkeytoken *)ckey)->len; 1322 1323 if (keytoklen > PARMBSIZE - sizeof(struct aureqparm)) 1324 return -EINVAL; 1325 1326 /* get already prepared memory for 2 cprbs with param block each */ 1327 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1328 &preqcblk, &prepcblk, xflags); 1329 if (rc) 1330 return rc; 1331 1332 /* fill request cprb struct */ 1333 preqcblk->domain = domain; 1334 1335 /* fill request cprb param block with AU request */ 1336 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1337 memcpy(preqparm->subfunc_code, "AU", 2); 1338 preqparm->rule_array_len = 1339 sizeof(preqparm->rule_array_len) 1340 + sizeof(preqparm->rule_array); 1341 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1342 /* vud, tk blob */ 1343 preqparm->vud.len = sizeof(preqparm->vud); 1344 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1345 + 2 * sizeof(uint16_t); 1346 preqparm->vud.tk_blob_tag = 0x00C2; 1347 /* kb, cca token */ 1348 preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t); 1349 preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t); 1350 memcpy(preqparm->kb.cca_key_token, ckey, keytoklen); 1351 /* now fill length of param block into cprb */ 1352 preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen; 1353 1354 /* fill xcrb struct */ 1355 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1356 1357 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1358 rc = zcrypt_send_cprb(&xcrb, xflags); 1359 if (rc) { 1360 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1361 __func__, (int)cardnr, (int)domain, rc); 1362 goto out; 1363 } 1364 1365 /* check response returncode and reasoncode */ 1366 if (prepcblk->ccp_rtcode != 0) { 1367 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1368 __func__, 1369 (int)prepcblk->ccp_rtcode, 1370 (int)prepcblk->ccp_rscode); 1371 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1372 rc = -EBUSY; 1373 else 1374 rc = -EIO; 1375 goto out; 1376 } 1377 if (prepcblk->ccp_rscode != 0) { 1378 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1379 __func__, 1380 (int)prepcblk->ccp_rtcode, 1381 (int)prepcblk->ccp_rscode); 1382 } 1383 1384 /* process response cprb param block */ 1385 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1386 prepcblk->rpl_parmb = (u8 __user *)ptr; 1387 prepparm = (struct aurepparm *)ptr; 1388 1389 /* check the returned keyblock */ 1390 if (prepparm->vud.ckb.version != 0x01 && 1391 prepparm->vud.ckb.version != 0x02) { 1392 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x\n", 1393 __func__, (int)prepparm->vud.ckb.version); 1394 rc = -EIO; 1395 goto out; 1396 } 1397 if (prepparm->vud.ckb.algo != 0x02) { 1398 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x02\n", 1399 __func__, (int)prepparm->vud.ckb.algo); 1400 rc = -EIO; 1401 goto out; 1402 } 1403 1404 /* copy the translated protected key */ 1405 switch (prepparm->vud.ckb.keylen) { 1406 case 16 + 32: 1407 /* AES 128 protected key */ 1408 if (protkeytype) 1409 *protkeytype = PKEY_KEYTYPE_AES_128; 1410 break; 1411 case 24 + 32: 1412 /* AES 192 protected key */ 1413 if (protkeytype) 1414 *protkeytype = PKEY_KEYTYPE_AES_192; 1415 break; 1416 case 32 + 32: 1417 /* AES 256 protected key */ 1418 if (protkeytype) 1419 *protkeytype = PKEY_KEYTYPE_AES_256; 1420 break; 1421 default: 1422 ZCRYPT_DBF_ERR("%s unknown/unsupported keylen %d\n", 1423 __func__, prepparm->vud.ckb.keylen); 1424 rc = -EIO; 1425 goto out; 1426 } 1427 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1428 if (protkeylen) 1429 *protkeylen = prepparm->vud.ckb.keylen; 1430 1431 out: 1432 free_cprbmem(mem, PARMBSIZE, true, xflags); 1433 return rc; 1434 } 1435 EXPORT_SYMBOL(cca_cipher2protkey); 1436 1437 /* 1438 * Derive protected key from CCA ECC secure private key. 1439 */ 1440 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key, 1441 u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags) 1442 { 1443 int rc; 1444 u8 *mem, *ptr; 1445 struct CPRBX *preqcblk, *prepcblk; 1446 struct ica_xcRB xcrb; 1447 struct aureqparm { 1448 u8 subfunc_code[2]; 1449 u16 rule_array_len; 1450 u8 rule_array[8]; 1451 struct { 1452 u16 len; 1453 u16 tk_blob_len; 1454 u16 tk_blob_tag; 1455 u8 tk_blob[66]; 1456 } vud; 1457 struct { 1458 u16 len; 1459 u16 cca_key_token_len; 1460 u16 cca_key_token_flags; 1461 u8 cca_key_token[]; 1462 } kb; 1463 } __packed * preqparm; 1464 struct aurepparm { 1465 u8 subfunc_code[2]; 1466 u16 rule_array_len; 1467 struct { 1468 u16 len; 1469 u16 sublen; 1470 u16 tag; 1471 struct cpacfkeyblock { 1472 u8 version; /* version of this struct */ 1473 u8 flags[2]; 1474 u8 algo; 1475 u8 form; 1476 u8 pad1[3]; 1477 u16 keylen; 1478 u8 key[]; /* the key (keylen bytes) */ 1479 /* u16 keyattrlen; */ 1480 /* u8 keyattr[32]; */ 1481 /* u8 pad2[1]; */ 1482 /* u8 vptype; */ 1483 /* u8 vp[32]; verification pattern */ 1484 } ckb; 1485 } vud; 1486 /* followed by a key block */ 1487 } __packed * prepparm; 1488 int keylen = ((struct eccprivkeytoken *)key)->len; 1489 1490 if (keylen > PARMBSIZE - sizeof(struct aureqparm)) 1491 return -EINVAL; 1492 1493 /* get already prepared memory for 2 cprbs with param block each */ 1494 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, 1495 &preqcblk, &prepcblk, xflags); 1496 if (rc) 1497 return rc; 1498 1499 /* fill request cprb struct */ 1500 preqcblk->domain = domain; 1501 1502 /* fill request cprb param block with AU request */ 1503 preqparm = (struct aureqparm __force *)preqcblk->req_parmb; 1504 memcpy(preqparm->subfunc_code, "AU", 2); 1505 preqparm->rule_array_len = 1506 sizeof(preqparm->rule_array_len) 1507 + sizeof(preqparm->rule_array); 1508 memcpy(preqparm->rule_array, "EXPT-SK ", 8); 1509 /* vud, tk blob */ 1510 preqparm->vud.len = sizeof(preqparm->vud); 1511 preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob) 1512 + 2 * sizeof(uint16_t); 1513 preqparm->vud.tk_blob_tag = 0x00C2; 1514 /* kb, cca token */ 1515 preqparm->kb.len = keylen + 3 * sizeof(uint16_t); 1516 preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t); 1517 memcpy(preqparm->kb.cca_key_token, key, keylen); 1518 /* now fill length of param block into cprb */ 1519 preqcblk->req_parml = sizeof(struct aureqparm) + keylen; 1520 1521 /* fill xcrb struct */ 1522 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1523 1524 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1525 rc = zcrypt_send_cprb(&xcrb, xflags); 1526 if (rc) { 1527 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1528 __func__, (int)cardnr, (int)domain, rc); 1529 goto out; 1530 } 1531 1532 /* check response returncode and reasoncode */ 1533 if (prepcblk->ccp_rtcode != 0) { 1534 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1535 __func__, 1536 (int)prepcblk->ccp_rtcode, 1537 (int)prepcblk->ccp_rscode); 1538 if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290) 1539 rc = -EBUSY; 1540 else 1541 rc = -EIO; 1542 goto out; 1543 } 1544 if (prepcblk->ccp_rscode != 0) { 1545 ZCRYPT_DBF_WARN("%s unwrap secure key warning, card response %d/%d\n", 1546 __func__, 1547 (int)prepcblk->ccp_rtcode, 1548 (int)prepcblk->ccp_rscode); 1549 } 1550 1551 /* process response cprb param block */ 1552 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1553 prepcblk->rpl_parmb = (u8 __user *)ptr; 1554 prepparm = (struct aurepparm *)ptr; 1555 1556 /* check the returned keyblock */ 1557 if (prepparm->vud.ckb.version != 0x02) { 1558 ZCRYPT_DBF_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n", 1559 __func__, (int)prepparm->vud.ckb.version); 1560 rc = -EIO; 1561 goto out; 1562 } 1563 if (prepparm->vud.ckb.algo != 0x81) { 1564 ZCRYPT_DBF_ERR("%s reply param keyblock algo mismatch 0x%02x != 0x81\n", 1565 __func__, (int)prepparm->vud.ckb.algo); 1566 rc = -EIO; 1567 goto out; 1568 } 1569 1570 /* copy the translated protected key */ 1571 if (prepparm->vud.ckb.keylen > *protkeylen) { 1572 ZCRYPT_DBF_ERR("%s prot keylen mismatch %d > buffersize %u\n", 1573 __func__, prepparm->vud.ckb.keylen, *protkeylen); 1574 rc = -EIO; 1575 goto out; 1576 } 1577 memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen); 1578 *protkeylen = prepparm->vud.ckb.keylen; 1579 if (protkeytype) 1580 *protkeytype = PKEY_KEYTYPE_ECC; 1581 1582 out: 1583 free_cprbmem(mem, PARMBSIZE, true, xflags); 1584 return rc; 1585 } 1586 EXPORT_SYMBOL(cca_ecc2protkey); 1587 1588 /* 1589 * query cryptographic facility from CCA adapter 1590 */ 1591 int cca_query_crypto_facility(u16 cardnr, u16 domain, 1592 const char *keyword, 1593 u8 *rarray, size_t *rarraylen, 1594 u8 *varray, size_t *varraylen, 1595 u32 xflags) 1596 { 1597 int rc; 1598 u16 len; 1599 u8 *mem, *ptr; 1600 struct CPRBX *preqcblk, *prepcblk; 1601 struct ica_xcRB xcrb; 1602 struct fqreqparm { 1603 u8 subfunc_code[2]; 1604 u16 rule_array_len; 1605 char rule_array[8]; 1606 struct lv1 { 1607 u16 len; 1608 u8 data[VARDATASIZE]; 1609 } lv1; 1610 u16 dummylen; 1611 } __packed * preqparm; 1612 size_t parmbsize = sizeof(struct fqreqparm); 1613 struct fqrepparm { 1614 u8 subfunc_code[2]; 1615 u8 lvdata[]; 1616 } __packed * prepparm; 1617 1618 /* get already prepared memory for 2 cprbs with param block each */ 1619 rc = alloc_and_prep_cprbmem(parmbsize, &mem, 1620 &preqcblk, &prepcblk, xflags); 1621 if (rc) 1622 return rc; 1623 1624 /* fill request cprb struct */ 1625 preqcblk->domain = domain; 1626 1627 /* fill request cprb param block with FQ request */ 1628 preqparm = (struct fqreqparm __force *)preqcblk->req_parmb; 1629 memcpy(preqparm->subfunc_code, "FQ", 2); 1630 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array)); 1631 preqparm->rule_array_len = 1632 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 1633 preqparm->lv1.len = sizeof(preqparm->lv1); 1634 preqparm->dummylen = sizeof(preqparm->dummylen); 1635 preqcblk->req_parml = parmbsize; 1636 1637 /* fill xcrb struct */ 1638 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 1639 1640 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 1641 rc = zcrypt_send_cprb(&xcrb, xflags); 1642 if (rc) { 1643 ZCRYPT_DBF_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n", 1644 __func__, (int)cardnr, (int)domain, rc); 1645 goto out; 1646 } 1647 1648 /* check response returncode and reasoncode */ 1649 if (prepcblk->ccp_rtcode != 0) { 1650 ZCRYPT_DBF_ERR("%s unwrap secure key failure, card response %d/%d\n", 1651 __func__, 1652 (int)prepcblk->ccp_rtcode, 1653 (int)prepcblk->ccp_rscode); 1654 rc = -EIO; 1655 goto out; 1656 } 1657 1658 /* process response cprb param block */ 1659 ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX); 1660 prepcblk->rpl_parmb = (u8 __user *)ptr; 1661 prepparm = (struct fqrepparm *)ptr; 1662 ptr = prepparm->lvdata; 1663 1664 /* check and possibly copy reply rule array */ 1665 len = *((u16 *)ptr); 1666 if (len > sizeof(u16)) { 1667 ptr += sizeof(u16); 1668 len -= sizeof(u16); 1669 if (rarray && rarraylen && *rarraylen > 0) { 1670 *rarraylen = (len > *rarraylen ? *rarraylen : len); 1671 memcpy(rarray, ptr, *rarraylen); 1672 } 1673 ptr += len; 1674 } 1675 /* check and possible copy reply var array */ 1676 len = *((u16 *)ptr); 1677 if (len > sizeof(u16)) { 1678 ptr += sizeof(u16); 1679 len -= sizeof(u16); 1680 if (varray && varraylen && *varraylen > 0) { 1681 *varraylen = (len > *varraylen ? *varraylen : len); 1682 memcpy(varray, ptr, *varraylen); 1683 } 1684 ptr += len; 1685 } 1686 1687 out: 1688 free_cprbmem(mem, parmbsize, false, xflags); 1689 return rc; 1690 } 1691 EXPORT_SYMBOL(cca_query_crypto_facility); 1692 1693 /* 1694 * Fetch cca_info values about a CCA queue via 1695 * query_crypto_facility from adapter. 1696 */ 1697 int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags) 1698 { 1699 void *mem; 1700 int rc, found = 0; 1701 size_t rlen, vlen; 1702 u8 *rarray, *varray; 1703 struct zcrypt_device_status_ext devstat; 1704 1705 memset(ci, 0, sizeof(*ci)); 1706 1707 /* if specific domain given, fetch status and hw info for this apqn */ 1708 if (domain != AUTOSEL_DOM) { 1709 rc = zcrypt_device_status_ext(cardnr, domain, &devstat); 1710 if (rc) 1711 return rc; 1712 ci->hwtype = devstat.hwtype; 1713 } 1714 1715 /* 1716 * Prep memory for rule array and var array use. 1717 * Use the cprb mempool for this. 1718 */ 1719 mem = (xflags & ZCRYPT_XFLAG_NOMEMALLOC) ? 1720 mempool_alloc_preallocated(cprb_mempool) : 1721 mempool_alloc(cprb_mempool, GFP_KERNEL); 1722 if (!mem) 1723 return -ENOMEM; 1724 rarray = (u8 *)mem; 1725 varray = (u8 *)mem + PAGE_SIZE / 2; 1726 rlen = vlen = PAGE_SIZE / 2; 1727 1728 /* QF for this card/domain */ 1729 rc = cca_query_crypto_facility(cardnr, domain, "STATICSA", 1730 rarray, &rlen, varray, &vlen, xflags); 1731 if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) { 1732 memcpy(ci->serial, rarray, 8); 1733 ci->new_asym_mk_state = (char)rarray[4 * 8]; 1734 ci->cur_asym_mk_state = (char)rarray[5 * 8]; 1735 ci->old_asym_mk_state = (char)rarray[6 * 8]; 1736 if (ci->old_asym_mk_state == '2') 1737 memcpy(ci->old_asym_mkvp, varray + 64, 16); 1738 if (ci->cur_asym_mk_state == '2') 1739 memcpy(ci->cur_asym_mkvp, varray + 84, 16); 1740 if (ci->new_asym_mk_state == '3') 1741 memcpy(ci->new_asym_mkvp, varray + 104, 16); 1742 ci->new_aes_mk_state = (char)rarray[7 * 8]; 1743 ci->cur_aes_mk_state = (char)rarray[8 * 8]; 1744 ci->old_aes_mk_state = (char)rarray[9 * 8]; 1745 if (ci->old_aes_mk_state == '2') 1746 memcpy(&ci->old_aes_mkvp, varray + 172, 8); 1747 if (ci->cur_aes_mk_state == '2') 1748 memcpy(&ci->cur_aes_mkvp, varray + 184, 8); 1749 if (ci->new_aes_mk_state == '3') 1750 memcpy(&ci->new_aes_mkvp, varray + 196, 8); 1751 found++; 1752 } 1753 if (!found) 1754 goto out; 1755 rlen = vlen = PAGE_SIZE / 2; 1756 rc = cca_query_crypto_facility(cardnr, domain, "STATICSB", 1757 rarray, &rlen, varray, &vlen, xflags); 1758 if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) { 1759 ci->new_apka_mk_state = (char)rarray[10 * 8]; 1760 ci->cur_apka_mk_state = (char)rarray[11 * 8]; 1761 ci->old_apka_mk_state = (char)rarray[12 * 8]; 1762 if (ci->old_apka_mk_state == '2') 1763 memcpy(&ci->old_apka_mkvp, varray + 208, 8); 1764 if (ci->cur_apka_mk_state == '2') 1765 memcpy(&ci->cur_apka_mkvp, varray + 220, 8); 1766 if (ci->new_apka_mk_state == '3') 1767 memcpy(&ci->new_apka_mkvp, varray + 232, 8); 1768 found++; 1769 } 1770 1771 out: 1772 mempool_free(mem, cprb_mempool); 1773 return found == 2 ? 0 : -ENOENT; 1774 } 1775 EXPORT_SYMBOL(cca_get_info); 1776 1777 int cca_findcard2(u32 *apqns, u32 *nr_apqns, u16 cardnr, u16 domain, 1778 int minhwtype, int mktype, 1779 const u8 *ptr_cur_mkvp, const u8 *ptr_old_mkvp, u32 xflags) 1780 { 1781 struct zcrypt_device_status_ext *device_status; 1782 int i, card, dom, curmatch, oldmatch; 1783 struct cca_info ci; 1784 u32 _nr_apqns = 0; 1785 1786 /* occupy the device status memory */ 1787 mutex_lock(&dev_status_mem_mutex); 1788 memset(dev_status_mem, 0, ZCRYPT_DEV_STATUS_EXT_SIZE); 1789 device_status = (struct zcrypt_device_status_ext *)dev_status_mem; 1790 1791 /* fetch crypto device status into this struct */ 1792 zcrypt_device_status_mask_ext(device_status, 1793 ZCRYPT_DEV_STATUS_CARD_MAX, 1794 ZCRYPT_DEV_STATUS_QUEUE_MAX); 1795 1796 /* walk through all the crypto apqnss */ 1797 for (i = 0; i < ZCRYPT_DEV_STATUS_ENTRIES; i++) { 1798 card = AP_QID_CARD(device_status[i].qid); 1799 dom = AP_QID_QUEUE(device_status[i].qid); 1800 /* check online state */ 1801 if (!device_status[i].online) 1802 continue; 1803 /* check for cca functions */ 1804 if (!(device_status[i].functions & 0x04)) 1805 continue; 1806 /* check cardnr */ 1807 if (cardnr != 0xFFFF && card != cardnr) 1808 continue; 1809 /* check domain */ 1810 if (domain != 0xFFFF && dom != domain) 1811 continue; 1812 /* get cca info on this apqn */ 1813 if (cca_get_info(card, dom, &ci, xflags)) 1814 continue; 1815 /* current master key needs to be valid */ 1816 if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2') 1817 continue; 1818 if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2') 1819 continue; 1820 /* check min hardware type */ 1821 if (minhwtype > 0 && minhwtype > ci.hwtype) 1822 continue; 1823 if (ptr_cur_mkvp || ptr_old_mkvp) { 1824 /* check mkvps */ 1825 curmatch = oldmatch = 0; 1826 if (mktype == AES_MK_SET) { 1827 if (ptr_cur_mkvp && 1828 !memcmp(ptr_cur_mkvp, ci.cur_aes_mkvp, 1829 sizeof(ci.cur_aes_mkvp))) 1830 curmatch = 1; 1831 if (ptr_old_mkvp && 1832 ci.old_aes_mk_state == '2' && 1833 !memcmp(ptr_old_mkvp, ci.old_aes_mkvp, 1834 sizeof(ci.old_aes_mkvp))) 1835 oldmatch = 1; 1836 } else { 1837 if (ptr_cur_mkvp && 1838 !memcmp(ptr_cur_mkvp, ci.cur_apka_mkvp, 1839 sizeof(ci.cur_apka_mkvp))) 1840 curmatch = 1; 1841 if (ptr_old_mkvp && 1842 ci.old_apka_mk_state == '2' && 1843 !memcmp(ptr_old_mkvp, ci.old_apka_mkvp, 1844 sizeof(ci.old_apka_mkvp))) 1845 oldmatch = 1; 1846 } 1847 if (curmatch + oldmatch < 1) 1848 continue; 1849 } 1850 /* apqn passed all filtering criterons, add to the array */ 1851 if (_nr_apqns < *nr_apqns) 1852 apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom); 1853 } 1854 1855 *nr_apqns = _nr_apqns; 1856 1857 /* release the device status memory */ 1858 mutex_unlock(&dev_status_mem_mutex); 1859 1860 return _nr_apqns ? 0 : -ENODEV; 1861 } 1862 EXPORT_SYMBOL(cca_findcard2); 1863 1864 int __init zcrypt_ccamisc_init(void) 1865 { 1866 /* Pre-allocate a small memory pool for cca cprbs. */ 1867 cprb_mempool = mempool_create_kmalloc_pool(zcrypt_mempool_threshold, 1868 CPRB_MEMPOOL_ITEM_SIZE); 1869 if (!cprb_mempool) 1870 return -ENOMEM; 1871 1872 /* Pre-allocate one crypto status card struct used in findcard() */ 1873 dev_status_mem = kvmalloc(ZCRYPT_DEV_STATUS_EXT_SIZE, GFP_KERNEL); 1874 if (!dev_status_mem) { 1875 mempool_destroy(cprb_mempool); 1876 return -ENOMEM; 1877 } 1878 1879 return 0; 1880 } 1881 1882 void zcrypt_ccamisc_exit(void) 1883 { 1884 mutex_lock(&dev_status_mem_mutex); 1885 kvfree(dev_status_mem); 1886 mutex_unlock(&dev_status_mem_mutex); 1887 mempool_destroy(cprb_mempool); 1888 } 1889