1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright IBM Corp. 2001, 2023
4 * Author(s): Robert Burroughs
5 * Eric Rossman (edrossma@us.ibm.com)
6 *
7 * Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
8 * Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
9 * Ralph Wuerthner <rwuerthn@de.ibm.com>
10 * MSGTYPE restruct: Holger Dengler <hd@linux.vnet.ibm.com>
11 */
12
13 #define KMSG_COMPONENT "zcrypt"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
15
16 #include <linux/module.h>
17 #include <linux/init.h>
18 #include <linux/err.h>
19 #include <linux/delay.h>
20 #include <linux/slab.h>
21 #include <linux/atomic.h>
22 #include <linux/uaccess.h>
23
24 #include "ap_bus.h"
25 #include "zcrypt_api.h"
26 #include "zcrypt_error.h"
27 #include "zcrypt_msgtype6.h"
28 #include "zcrypt_cca_key.h"
29
30 #define CEXXC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply */
31
32 #define CEIL4(x) ((((x) + 3) / 4) * 4)
33
34 struct response_type {
35 struct completion work;
36 int type;
37 };
38
39 #define CEXXC_RESPONSE_TYPE_ICA 0
40 #define CEXXC_RESPONSE_TYPE_XCRB 1
41 #define CEXXC_RESPONSE_TYPE_EP11 2
42
43 MODULE_AUTHOR("IBM Corporation");
44 MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
45 "Copyright IBM Corp. 2001, 2023");
46 MODULE_LICENSE("GPL");
47
48 struct function_and_rules_block {
49 unsigned char function_code[2];
50 unsigned short ulen;
51 unsigned char only_rule[8];
52 } __packed;
53
54 /*
55 * The following is used to initialize the CPRBX passed to the CEXxC/CEXxP
56 * card in a type6 message. The 3 fields that must be filled in at execution
57 * time are req_parml, rpl_parml and usage_domain.
58 * Everything about this interface is ascii/big-endian, since the
59 * device does *not* have 'Intel inside'.
60 *
61 * The CPRBX is followed immediately by the parm block.
62 * The parm block contains:
63 * - function code ('PD' 0x5044 or 'PK' 0x504B)
64 * - rule block (one of:)
65 * + 0x000A 'PKCS-1.2' (MCL2 'PD')
66 * + 0x000A 'ZERO-PAD' (MCL2 'PK')
67 * + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
68 * + 0x000A 'MRP ' (MCL3 'PK' or CEX2C 'PK')
69 * - VUD block
70 */
71 static const struct CPRBX static_cprbx = {
72 .cprb_len = 0x00DC,
73 .cprb_ver_id = 0x02,
74 .func_id = {0x54, 0x32},
75 };
76
speed_idx_cca(int req_type)77 int speed_idx_cca(int req_type)
78 {
79 switch (req_type) {
80 case 0x4142:
81 case 0x4149:
82 case 0x414D:
83 case 0x4341:
84 case 0x4344:
85 case 0x4354:
86 case 0x4358:
87 case 0x444B:
88 case 0x4558:
89 case 0x4643:
90 case 0x4651:
91 case 0x4C47:
92 case 0x4C4B:
93 case 0x4C51:
94 case 0x4F48:
95 case 0x504F:
96 case 0x5053:
97 case 0x5058:
98 case 0x5343:
99 case 0x5344:
100 case 0x5345:
101 case 0x5350:
102 return LOW;
103 case 0x414B:
104 case 0x4345:
105 case 0x4349:
106 case 0x434D:
107 case 0x4847:
108 case 0x4849:
109 case 0x484D:
110 case 0x4850:
111 case 0x4851:
112 case 0x4954:
113 case 0x4958:
114 case 0x4B43:
115 case 0x4B44:
116 case 0x4B45:
117 case 0x4B47:
118 case 0x4B48:
119 case 0x4B49:
120 case 0x4B4E:
121 case 0x4B50:
122 case 0x4B52:
123 case 0x4B54:
124 case 0x4B58:
125 case 0x4D50:
126 case 0x4D53:
127 case 0x4D56:
128 case 0x4D58:
129 case 0x5044:
130 case 0x5045:
131 case 0x5046:
132 case 0x5047:
133 case 0x5049:
134 case 0x504B:
135 case 0x504D:
136 case 0x5254:
137 case 0x5347:
138 case 0x5349:
139 case 0x534B:
140 case 0x534D:
141 case 0x5356:
142 case 0x5358:
143 case 0x5443:
144 case 0x544B:
145 case 0x5647:
146 return HIGH;
147 default:
148 return MEDIUM;
149 }
150 }
151
speed_idx_ep11(int req_type)152 int speed_idx_ep11(int req_type)
153 {
154 switch (req_type) {
155 case 1:
156 case 2:
157 case 36:
158 case 37:
159 case 38:
160 case 39:
161 case 40:
162 return LOW;
163 case 17:
164 case 18:
165 case 19:
166 case 20:
167 case 21:
168 case 22:
169 case 26:
170 case 30:
171 case 31:
172 case 32:
173 case 33:
174 case 34:
175 case 35:
176 return HIGH;
177 default:
178 return MEDIUM;
179 }
180 }
181
182 /*
183 * Convert a ICAMEX message to a type6 MEX message.
184 *
185 * @zq: crypto device pointer
186 * @ap_msg: pointer to AP message
187 * @mex: pointer to user input data
188 *
189 * Returns 0 on success or negative errno value.
190 */
icamex_msg_to_type6mex_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo * mex)191 static int icamex_msg_to_type6mex_msgx(struct zcrypt_queue *zq,
192 struct ap_message *ap_msg,
193 struct ica_rsa_modexpo *mex)
194 {
195 static struct type6_hdr static_type6_hdrX = {
196 .type = 0x06,
197 .offset1 = 0x00000058,
198 .agent_id = {'C', 'A',},
199 .function_code = {'P', 'K'},
200 };
201 static struct function_and_rules_block static_pke_fnr = {
202 .function_code = {'P', 'K'},
203 .ulen = 10,
204 .only_rule = {'M', 'R', 'P', ' ', ' ', ' ', ' ', ' '}
205 };
206 struct {
207 struct type6_hdr hdr;
208 struct CPRBX cprbx;
209 struct function_and_rules_block fr;
210 unsigned short length;
211 char text[];
212 } __packed * msg = ap_msg->msg;
213 int size;
214
215 /*
216 * The inputdatalength was a selection criteria in the dispatching
217 * function zcrypt_rsa_modexpo(). However, make sure the following
218 * copy_from_user() never exceeds the allocated buffer space.
219 */
220 if (WARN_ON_ONCE(mex->inputdatalength > PAGE_SIZE))
221 return -EINVAL;
222
223 /* VUD.ciphertext */
224 msg->length = mex->inputdatalength + 2;
225 if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
226 return -EFAULT;
227
228 /* Set up key which is located after the variable length text. */
229 size = zcrypt_type6_mex_key_en(mex, msg->text + mex->inputdatalength);
230 if (size < 0)
231 return size;
232 size += sizeof(*msg) + mex->inputdatalength;
233
234 /* message header, cprbx and f&r */
235 msg->hdr = static_type6_hdrX;
236 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
237 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
238
239 msg->cprbx = static_cprbx;
240 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
241 msg->cprbx.rpl_msgbl = msg->hdr.fromcardlen1;
242
243 msg->fr = static_pke_fnr;
244
245 msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
246
247 ap_msg->len = size;
248 return 0;
249 }
250
251 /*
252 * Convert a ICACRT message to a type6 CRT message.
253 *
254 * @zq: crypto device pointer
255 * @ap_msg: pointer to AP message
256 * @crt: pointer to user input data
257 *
258 * Returns 0 on success or negative errno value.
259 */
icacrt_msg_to_type6crt_msgx(struct zcrypt_queue * zq,struct ap_message * ap_msg,struct ica_rsa_modexpo_crt * crt)260 static int icacrt_msg_to_type6crt_msgx(struct zcrypt_queue *zq,
261 struct ap_message *ap_msg,
262 struct ica_rsa_modexpo_crt *crt)
263 {
264 static struct type6_hdr static_type6_hdrX = {
265 .type = 0x06,
266 .offset1 = 0x00000058,
267 .agent_id = {'C', 'A',},
268 .function_code = {'P', 'D'},
269 };
270 static struct function_and_rules_block static_pkd_fnr = {
271 .function_code = {'P', 'D'},
272 .ulen = 10,
273 .only_rule = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
274 };
275
276 struct {
277 struct type6_hdr hdr;
278 struct CPRBX cprbx;
279 struct function_and_rules_block fr;
280 unsigned short length;
281 char text[];
282 } __packed * msg = ap_msg->msg;
283 int size;
284
285 /*
286 * The inputdatalength was a selection criteria in the dispatching
287 * function zcrypt_rsa_crt(). However, make sure the following
288 * copy_from_user() never exceeds the allocated buffer space.
289 */
290 if (WARN_ON_ONCE(crt->inputdatalength > PAGE_SIZE))
291 return -EINVAL;
292
293 /* VUD.ciphertext */
294 msg->length = crt->inputdatalength + 2;
295 if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
296 return -EFAULT;
297
298 /* Set up key which is located after the variable length text. */
299 size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength);
300 if (size < 0)
301 return size;
302 size += sizeof(*msg) + crt->inputdatalength; /* total size of msg */
303
304 /* message header, cprbx and f&r */
305 msg->hdr = static_type6_hdrX;
306 msg->hdr.tocardlen1 = size - sizeof(msg->hdr);
307 msg->hdr.fromcardlen1 = CEXXC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
308
309 msg->cprbx = static_cprbx;
310 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
311 msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
312 size - sizeof(msg->hdr) - sizeof(msg->cprbx);
313
314 msg->fr = static_pkd_fnr;
315
316 ap_msg->len = size;
317 return 0;
318 }
319
320 /*
321 * Convert a XCRB message to a type6 CPRB message.
322 *
323 * @zq: crypto device pointer
324 * @ap_msg: pointer to AP message
325 * @xcRB: pointer to user input data
326 *
327 * Returns 0 on success or -EFAULT, -EINVAL.
328 */
329 struct type86_fmt2_msg {
330 struct type86_hdr hdr;
331 struct type86_fmt2_ext fmt2;
332 } __packed;
333
xcrb_msg_to_type6cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ica_xcRB * xcrb,unsigned int * fcode,unsigned short ** dom)334 static int xcrb_msg_to_type6cprb_msgx(bool userspace, struct ap_message *ap_msg,
335 struct ica_xcRB *xcrb,
336 unsigned int *fcode,
337 unsigned short **dom)
338 {
339 static struct type6_hdr static_type6_hdrX = {
340 .type = 0x06,
341 .offset1 = 0x00000058,
342 };
343 struct {
344 struct type6_hdr hdr;
345 union {
346 struct CPRBX cprbx;
347 DECLARE_FLEX_ARRAY(u8, userdata);
348 };
349 } __packed * msg = ap_msg->msg;
350
351 int rcblen = CEIL4(xcrb->request_control_blk_length);
352 int req_sumlen, resp_sumlen;
353 char *req_data = ap_msg->msg + sizeof(struct type6_hdr) + rcblen;
354 char *function_code;
355
356 if (CEIL4(xcrb->request_control_blk_length) <
357 xcrb->request_control_blk_length)
358 return -EINVAL; /* overflow after alignment*/
359
360 /* length checks */
361 ap_msg->len = sizeof(struct type6_hdr) +
362 CEIL4(xcrb->request_control_blk_length) +
363 xcrb->request_data_length;
364 if (ap_msg->len > ap_msg->bufsize)
365 return -EINVAL;
366
367 /*
368 * Overflow check
369 * sum must be greater (or equal) than the largest operand
370 */
371 req_sumlen = CEIL4(xcrb->request_control_blk_length) +
372 xcrb->request_data_length;
373 if ((CEIL4(xcrb->request_control_blk_length) <=
374 xcrb->request_data_length) ?
375 req_sumlen < xcrb->request_data_length :
376 req_sumlen < CEIL4(xcrb->request_control_blk_length)) {
377 return -EINVAL;
378 }
379
380 if (CEIL4(xcrb->reply_control_blk_length) <
381 xcrb->reply_control_blk_length)
382 return -EINVAL; /* overflow after alignment*/
383
384 /*
385 * Overflow check
386 * sum must be greater (or equal) than the largest operand
387 */
388 resp_sumlen = CEIL4(xcrb->reply_control_blk_length) +
389 xcrb->reply_data_length;
390 if ((CEIL4(xcrb->reply_control_blk_length) <=
391 xcrb->reply_data_length) ?
392 resp_sumlen < xcrb->reply_data_length :
393 resp_sumlen < CEIL4(xcrb->reply_control_blk_length)) {
394 return -EINVAL;
395 }
396
397 /* prepare type6 header */
398 msg->hdr = static_type6_hdrX;
399 memcpy(msg->hdr.agent_id, &xcrb->agent_ID, sizeof(xcrb->agent_ID));
400 msg->hdr.tocardlen1 = xcrb->request_control_blk_length;
401 if (xcrb->request_data_length) {
402 msg->hdr.offset2 = msg->hdr.offset1 + rcblen;
403 msg->hdr.tocardlen2 = xcrb->request_data_length;
404 }
405 msg->hdr.fromcardlen1 = xcrb->reply_control_blk_length;
406 msg->hdr.fromcardlen2 = xcrb->reply_data_length;
407
408 /* prepare CPRB */
409 if (z_copy_from_user(userspace, msg->userdata,
410 xcrb->request_control_blk_addr,
411 xcrb->request_control_blk_length))
412 return -EFAULT;
413 if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
414 xcrb->request_control_blk_length)
415 return -EINVAL;
416 function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
417 memcpy(msg->hdr.function_code, function_code,
418 sizeof(msg->hdr.function_code));
419
420 *fcode = (msg->hdr.function_code[0] << 8) | msg->hdr.function_code[1];
421 *dom = (unsigned short *)&msg->cprbx.domain;
422
423 /* check subfunction, US and AU need special flag with NQAP */
424 if (memcmp(function_code, "US", 2) == 0 ||
425 memcmp(function_code, "AU", 2) == 0)
426 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
427
428 /* check CPRB minor version, set info bits in ap_message flag field */
429 switch (*(unsigned short *)(&msg->cprbx.func_id[0])) {
430 case 0x5432: /* "T2" */
431 ap_msg->flags |= AP_MSG_FLAG_USAGE;
432 break;
433 case 0x5433: /* "T3" */
434 case 0x5435: /* "T5" */
435 case 0x5436: /* "T6" */
436 case 0x5437: /* "T7" */
437 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
438 break;
439 default:
440 ZCRYPT_DBF_DBG("%s unknown CPRB minor version '%c%c'\n",
441 __func__, msg->cprbx.func_id[0],
442 msg->cprbx.func_id[1]);
443 }
444
445 /* copy data block */
446 if (xcrb->request_data_length &&
447 z_copy_from_user(userspace, req_data, xcrb->request_data_address,
448 xcrb->request_data_length))
449 return -EFAULT;
450
451 return 0;
452 }
453
xcrb_msg_to_type6_ep11cprb_msgx(bool userspace,struct ap_message * ap_msg,struct ep11_urb * xcrb,unsigned int * fcode,unsigned int * domain)454 static int xcrb_msg_to_type6_ep11cprb_msgx(bool userspace, struct ap_message *ap_msg,
455 struct ep11_urb *xcrb,
456 unsigned int *fcode,
457 unsigned int *domain)
458 {
459 unsigned int lfmt;
460 static struct type6_hdr static_type6_ep11_hdr = {
461 .type = 0x06,
462 .rqid = {0x00, 0x01},
463 .function_code = {0x00, 0x00},
464 .agent_id[0] = 0x58, /* {'X'} */
465 .agent_id[1] = 0x43, /* {'C'} */
466 .offset1 = 0x00000058,
467 };
468
469 struct {
470 struct type6_hdr hdr;
471 union {
472 struct {
473 struct ep11_cprb cprbx;
474 unsigned char pld_tag; /* fixed value 0x30 */
475 unsigned char pld_lenfmt; /* length format */
476 } __packed;
477 DECLARE_FLEX_ARRAY(u8, userdata);
478 };
479 } __packed * msg = ap_msg->msg;
480
481 struct pld_hdr {
482 unsigned char func_tag; /* fixed value 0x4 */
483 unsigned char func_len; /* fixed value 0x4 */
484 unsigned int func_val; /* function ID */
485 unsigned char dom_tag; /* fixed value 0x4 */
486 unsigned char dom_len; /* fixed value 0x4 */
487 unsigned int dom_val; /* domain id */
488 } __packed * payload_hdr = NULL;
489
490 if (CEIL4(xcrb->req_len) < xcrb->req_len)
491 return -EINVAL; /* overflow after alignment*/
492
493 /* length checks */
494 ap_msg->len = sizeof(struct type6_hdr) + CEIL4(xcrb->req_len);
495 if (ap_msg->len > ap_msg->bufsize)
496 return -EINVAL;
497
498 if (CEIL4(xcrb->resp_len) < xcrb->resp_len)
499 return -EINVAL; /* overflow after alignment*/
500
501 /* prepare type6 header */
502 msg->hdr = static_type6_ep11_hdr;
503 msg->hdr.tocardlen1 = xcrb->req_len;
504 msg->hdr.fromcardlen1 = xcrb->resp_len;
505
506 /* Import CPRB data from the ioctl input parameter */
507 if (z_copy_from_user(userspace, msg->userdata,
508 (char __force __user *)xcrb->req, xcrb->req_len)) {
509 return -EFAULT;
510 }
511
512 if ((msg->pld_lenfmt & 0x80) == 0x80) { /*ext.len.fmt 2 or 3*/
513 switch (msg->pld_lenfmt & 0x03) {
514 case 1:
515 lfmt = 2;
516 break;
517 case 2:
518 lfmt = 3;
519 break;
520 default:
521 return -EINVAL;
522 }
523 } else {
524 lfmt = 1; /* length format #1 */
525 }
526 payload_hdr = (struct pld_hdr *)((&msg->pld_lenfmt) + lfmt);
527 *fcode = payload_hdr->func_val & 0xFFFF;
528
529 /* enable special processing based on the cprbs flags special bit */
530 if (msg->cprbx.flags & 0x20)
531 ap_msg->flags |= AP_MSG_FLAG_SPECIAL;
532
533 /* set info bits in ap_message flag field */
534 if (msg->cprbx.flags & 0x80)
535 ap_msg->flags |= AP_MSG_FLAG_ADMIN;
536 else
537 ap_msg->flags |= AP_MSG_FLAG_USAGE;
538
539 *domain = msg->cprbx.target_id;
540
541 return 0;
542 }
543
544 /*
545 * Copy results from a type 86 ICA reply message back to user space.
546 *
547 * @zq: crypto device pointer
548 * @reply: reply AP message.
549 * @data: pointer to user output data
550 * @length: size of user output data
551 *
552 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
553 */
554 struct type86x_reply {
555 struct type86_hdr hdr;
556 struct type86_fmt2_ext fmt2;
557 struct CPRBX cprbx;
558 unsigned char pad[4]; /* 4 byte function code/rules block ? */
559 unsigned short length; /* length of data including length field size */
560 char data[];
561 } __packed;
562
563 struct type86_ep11_reply {
564 struct type86_hdr hdr;
565 struct type86_fmt2_ext fmt2;
566 struct ep11_cprb cprbx;
567 } __packed;
568
convert_type86_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)569 static int convert_type86_ica(struct zcrypt_queue *zq,
570 struct ap_message *reply,
571 char __user *outputdata,
572 unsigned int outputdatalength)
573 {
574 struct type86x_reply *msg = reply->msg;
575 unsigned short service_rc, service_rs;
576 unsigned int data_len;
577
578 service_rc = msg->cprbx.ccp_rtcode;
579 if (unlikely(service_rc != 0)) {
580 service_rs = msg->cprbx.ccp_rscode;
581 if ((service_rc == 8 && service_rs == 66) ||
582 (service_rc == 8 && service_rs == 65) ||
583 (service_rc == 8 && service_rs == 72) ||
584 (service_rc == 8 && service_rs == 770) ||
585 (service_rc == 12 && service_rs == 769)) {
586 ZCRYPT_DBF_WARN("%s dev=%02x.%04x rc/rs=%d/%d => rc=EINVAL\n",
587 __func__, AP_QID_CARD(zq->queue->qid),
588 AP_QID_QUEUE(zq->queue->qid),
589 (int)service_rc, (int)service_rs);
590 return -EINVAL;
591 }
592 zq->online = 0;
593 pr_err("Crypto dev=%02x.%04x rc/rs=%d/%d online=0 rc=EAGAIN\n",
594 AP_QID_CARD(zq->queue->qid),
595 AP_QID_QUEUE(zq->queue->qid),
596 (int)service_rc, (int)service_rs);
597 ZCRYPT_DBF_ERR("%s dev=%02x.%04x rc/rs=%d/%d => online=0 rc=EAGAIN\n",
598 __func__, AP_QID_CARD(zq->queue->qid),
599 AP_QID_QUEUE(zq->queue->qid),
600 (int)service_rc, (int)service_rs);
601 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
602 return -EAGAIN;
603 }
604 data_len = msg->length - sizeof(msg->length);
605 if (data_len > outputdatalength)
606 return -EMSGSIZE;
607
608 /* Copy the crypto response to user space. */
609 if (copy_to_user(outputdata, msg->data, data_len))
610 return -EFAULT;
611 return 0;
612 }
613
614 /*
615 * Copy results from a type 86 XCRB reply message back to user space.
616 *
617 * @zq: crypto device pointer
618 * @reply: reply AP message.
619 * @xcrb: pointer to XCRB
620 *
621 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
622 */
convert_type86_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)623 static int convert_type86_xcrb(bool userspace, struct zcrypt_queue *zq,
624 struct ap_message *reply,
625 struct ica_xcRB *xcrb)
626 {
627 struct type86_fmt2_msg *msg = reply->msg;
628 char *data = reply->msg;
629
630 /* Copy CPRB to user */
631 if (xcrb->reply_control_blk_length < msg->fmt2.count1) {
632 ZCRYPT_DBF_DBG("%s reply_control_blk_length %u < required %u => EMSGSIZE\n",
633 __func__, xcrb->reply_control_blk_length,
634 msg->fmt2.count1);
635 return -EMSGSIZE;
636 }
637 if (z_copy_to_user(userspace, xcrb->reply_control_blk_addr,
638 data + msg->fmt2.offset1, msg->fmt2.count1))
639 return -EFAULT;
640 xcrb->reply_control_blk_length = msg->fmt2.count1;
641
642 /* Copy data buffer to user */
643 if (msg->fmt2.count2) {
644 if (xcrb->reply_data_length < msg->fmt2.count2) {
645 ZCRYPT_DBF_DBG("%s reply_data_length %u < required %u => EMSGSIZE\n",
646 __func__, xcrb->reply_data_length,
647 msg->fmt2.count2);
648 return -EMSGSIZE;
649 }
650 if (z_copy_to_user(userspace, xcrb->reply_data_addr,
651 data + msg->fmt2.offset2, msg->fmt2.count2))
652 return -EFAULT;
653 }
654 xcrb->reply_data_length = msg->fmt2.count2;
655
656 return 0;
657 }
658
659 /*
660 * Copy results from a type 86 EP11 XCRB reply message back to user space.
661 *
662 * @zq: crypto device pointer
663 * @reply: reply AP message.
664 * @xcrb: pointer to EP11 user request block
665 *
666 * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
667 */
convert_type86_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)668 static int convert_type86_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
669 struct ap_message *reply,
670 struct ep11_urb *xcrb)
671 {
672 struct type86_fmt2_msg *msg = reply->msg;
673 char *data = reply->msg;
674
675 if (xcrb->resp_len < msg->fmt2.count1) {
676 ZCRYPT_DBF_DBG("%s resp_len %u < required %u => EMSGSIZE\n",
677 __func__, (unsigned int)xcrb->resp_len,
678 msg->fmt2.count1);
679 return -EMSGSIZE;
680 }
681
682 /* Copy response CPRB to user */
683 if (z_copy_to_user(userspace, (char __force __user *)xcrb->resp,
684 data + msg->fmt2.offset1, msg->fmt2.count1))
685 return -EFAULT;
686 xcrb->resp_len = msg->fmt2.count1;
687 return 0;
688 }
689
convert_type86_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * buffer)690 static int convert_type86_rng(struct zcrypt_queue *zq,
691 struct ap_message *reply,
692 char *buffer)
693 {
694 struct {
695 struct type86_hdr hdr;
696 struct type86_fmt2_ext fmt2;
697 struct CPRBX cprbx;
698 } __packed * msg = reply->msg;
699 char *data = reply->msg;
700
701 if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
702 return -EINVAL;
703 memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
704 return msg->fmt2.count2;
705 }
706
convert_response_ica(struct zcrypt_queue * zq,struct ap_message * reply,char __user * outputdata,unsigned int outputdatalength)707 static int convert_response_ica(struct zcrypt_queue *zq,
708 struct ap_message *reply,
709 char __user *outputdata,
710 unsigned int outputdatalength)
711 {
712 struct type86x_reply *msg = reply->msg;
713
714 switch (msg->hdr.type) {
715 case TYPE82_RSP_CODE:
716 case TYPE88_RSP_CODE:
717 return convert_error(zq, reply);
718 case TYPE86_RSP_CODE:
719 if (msg->cprbx.ccp_rtcode &&
720 msg->cprbx.ccp_rscode == 0x14f &&
721 outputdatalength > 256) {
722 if (zq->zcard->max_exp_bit_length <= 17) {
723 zq->zcard->max_exp_bit_length = 17;
724 return -EAGAIN;
725 } else {
726 return -EINVAL;
727 }
728 }
729 if (msg->hdr.reply_code)
730 return convert_error(zq, reply);
731 if (msg->cprbx.cprb_ver_id == 0x02)
732 return convert_type86_ica(zq, reply,
733 outputdata, outputdatalength);
734 fallthrough; /* wrong cprb version is an unknown response */
735 default:
736 /* Unknown response type, this should NEVER EVER happen */
737 zq->online = 0;
738 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
739 AP_QID_CARD(zq->queue->qid),
740 AP_QID_QUEUE(zq->queue->qid),
741 (int)msg->hdr.type);
742 ZCRYPT_DBF_ERR(
743 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
744 __func__, AP_QID_CARD(zq->queue->qid),
745 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
746 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
747 return -EAGAIN;
748 }
749 }
750
convert_response_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ica_xcRB * xcrb)751 static int convert_response_xcrb(bool userspace, struct zcrypt_queue *zq,
752 struct ap_message *reply,
753 struct ica_xcRB *xcrb)
754 {
755 struct type86x_reply *msg = reply->msg;
756
757 switch (msg->hdr.type) {
758 case TYPE82_RSP_CODE:
759 case TYPE88_RSP_CODE:
760 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
761 return convert_error(zq, reply);
762 case TYPE86_RSP_CODE:
763 if (msg->hdr.reply_code) {
764 memcpy(&xcrb->status, msg->fmt2.apfs, sizeof(u32));
765 return convert_error(zq, reply);
766 }
767 if (msg->cprbx.cprb_ver_id == 0x02)
768 return convert_type86_xcrb(userspace, zq, reply, xcrb);
769 fallthrough; /* wrong cprb version is an unknown response */
770 default: /* Unknown response type, this should NEVER EVER happen */
771 xcrb->status = 0x0008044DL; /* HDD_InvalidParm */
772 zq->online = 0;
773 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
774 AP_QID_CARD(zq->queue->qid),
775 AP_QID_QUEUE(zq->queue->qid),
776 (int)msg->hdr.type);
777 ZCRYPT_DBF_ERR(
778 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
779 __func__, AP_QID_CARD(zq->queue->qid),
780 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
781 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
782 return -EAGAIN;
783 }
784 }
785
convert_response_ep11_xcrb(bool userspace,struct zcrypt_queue * zq,struct ap_message * reply,struct ep11_urb * xcrb)786 static int convert_response_ep11_xcrb(bool userspace, struct zcrypt_queue *zq,
787 struct ap_message *reply, struct ep11_urb *xcrb)
788 {
789 struct type86_ep11_reply *msg = reply->msg;
790
791 switch (msg->hdr.type) {
792 case TYPE82_RSP_CODE:
793 case TYPE87_RSP_CODE:
794 return convert_error(zq, reply);
795 case TYPE86_RSP_CODE:
796 if (msg->hdr.reply_code)
797 return convert_error(zq, reply);
798 if (msg->cprbx.cprb_ver_id == 0x04)
799 return convert_type86_ep11_xcrb(userspace, zq, reply, xcrb);
800 fallthrough; /* wrong cprb version is an unknown resp */
801 default: /* Unknown response type, this should NEVER EVER happen */
802 zq->online = 0;
803 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
804 AP_QID_CARD(zq->queue->qid),
805 AP_QID_QUEUE(zq->queue->qid),
806 (int)msg->hdr.type);
807 ZCRYPT_DBF_ERR(
808 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
809 __func__, AP_QID_CARD(zq->queue->qid),
810 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
811 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
812 return -EAGAIN;
813 }
814 }
815
convert_response_rng(struct zcrypt_queue * zq,struct ap_message * reply,char * data)816 static int convert_response_rng(struct zcrypt_queue *zq,
817 struct ap_message *reply,
818 char *data)
819 {
820 struct type86x_reply *msg = reply->msg;
821
822 switch (msg->hdr.type) {
823 case TYPE82_RSP_CODE:
824 case TYPE88_RSP_CODE:
825 return -EINVAL;
826 case TYPE86_RSP_CODE:
827 if (msg->hdr.reply_code)
828 return -EINVAL;
829 if (msg->cprbx.cprb_ver_id == 0x02)
830 return convert_type86_rng(zq, reply, data);
831 fallthrough; /* wrong cprb version is an unknown response */
832 default: /* Unknown response type, this should NEVER EVER happen */
833 zq->online = 0;
834 pr_err("Crypto dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
835 AP_QID_CARD(zq->queue->qid),
836 AP_QID_QUEUE(zq->queue->qid),
837 (int)msg->hdr.type);
838 ZCRYPT_DBF_ERR(
839 "%s dev=%02x.%04x unknown response type 0x%02x => online=0 rc=EAGAIN\n",
840 __func__, AP_QID_CARD(zq->queue->qid),
841 AP_QID_QUEUE(zq->queue->qid), (int)msg->hdr.type);
842 ap_send_online_uevent(&zq->queue->ap_dev, zq->online);
843 return -EAGAIN;
844 }
845 }
846
847 /*
848 * This function is called from the AP bus code after a crypto request
849 * "msg" has finished with the reply message "reply".
850 * It is called from tasklet context.
851 * @aq: pointer to the AP queue
852 * @msg: pointer to the AP message
853 * @reply: pointer to the AP reply message
854 */
zcrypt_msgtype6_receive(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)855 static void zcrypt_msgtype6_receive(struct ap_queue *aq,
856 struct ap_message *msg,
857 struct ap_message *reply)
858 {
859 static struct error_hdr error_reply = {
860 .type = TYPE82_RSP_CODE,
861 .reply_code = REP82_ERROR_MACHINE_FAILURE,
862 };
863 struct response_type *resp_type = msg->private;
864 struct type86x_reply *t86r;
865 int len;
866
867 /* Copy the reply message to the request message buffer. */
868 if (!reply)
869 goto out; /* ap_msg->rc indicates the error */
870 t86r = reply->msg;
871 if (t86r->hdr.type == TYPE86_RSP_CODE &&
872 t86r->cprbx.cprb_ver_id == 0x02) {
873 switch (resp_type->type) {
874 case CEXXC_RESPONSE_TYPE_ICA:
875 len = sizeof(struct type86x_reply) + t86r->length;
876 if (len > reply->bufsize || len > msg->bufsize ||
877 len != reply->len) {
878 ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
879 msg->rc = -EMSGSIZE;
880 goto out;
881 }
882 memcpy(msg->msg, reply->msg, len);
883 msg->len = len;
884 break;
885 case CEXXC_RESPONSE_TYPE_XCRB:
886 if (t86r->fmt2.count2)
887 len = t86r->fmt2.offset2 + t86r->fmt2.count2;
888 else
889 len = t86r->fmt2.offset1 + t86r->fmt2.count1;
890 if (len > reply->bufsize || len > msg->bufsize ||
891 len != reply->len) {
892 ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
893 msg->rc = -EMSGSIZE;
894 goto out;
895 }
896 memcpy(msg->msg, reply->msg, len);
897 msg->len = len;
898 break;
899 default:
900 memcpy(msg->msg, &error_reply, sizeof(error_reply));
901 msg->len = sizeof(error_reply);
902 }
903 } else {
904 memcpy(msg->msg, reply->msg, sizeof(error_reply));
905 msg->len = sizeof(error_reply);
906 }
907 out:
908 complete(&resp_type->work);
909 }
910
911 /*
912 * This function is called from the AP bus code after a crypto request
913 * "msg" has finished with the reply message "reply".
914 * It is called from tasklet context.
915 * @aq: pointer to the AP queue
916 * @msg: pointer to the AP message
917 * @reply: pointer to the AP reply message
918 */
zcrypt_msgtype6_receive_ep11(struct ap_queue * aq,struct ap_message * msg,struct ap_message * reply)919 static void zcrypt_msgtype6_receive_ep11(struct ap_queue *aq,
920 struct ap_message *msg,
921 struct ap_message *reply)
922 {
923 static struct error_hdr error_reply = {
924 .type = TYPE82_RSP_CODE,
925 .reply_code = REP82_ERROR_MACHINE_FAILURE,
926 };
927 struct response_type *resp_type = msg->private;
928 struct type86_ep11_reply *t86r;
929 int len;
930
931 /* Copy the reply message to the request message buffer. */
932 if (!reply)
933 goto out; /* ap_msg->rc indicates the error */
934 t86r = reply->msg;
935 if (t86r->hdr.type == TYPE86_RSP_CODE &&
936 t86r->cprbx.cprb_ver_id == 0x04) {
937 switch (resp_type->type) {
938 case CEXXC_RESPONSE_TYPE_EP11:
939 len = t86r->fmt2.offset1 + t86r->fmt2.count1;
940 if (len > reply->bufsize || len > msg->bufsize ||
941 len != reply->len) {
942 ZCRYPT_DBF_DBG("%s len mismatch => EMSGSIZE\n", __func__);
943 msg->rc = -EMSGSIZE;
944 goto out;
945 }
946 memcpy(msg->msg, reply->msg, len);
947 msg->len = len;
948 break;
949 default:
950 memcpy(msg->msg, &error_reply, sizeof(error_reply));
951 msg->len = sizeof(error_reply);
952 }
953 } else {
954 memcpy(msg->msg, reply->msg, sizeof(error_reply));
955 msg->len = sizeof(error_reply);
956 }
957 out:
958 complete(&resp_type->work);
959 }
960
961 static atomic_t zcrypt_step = ATOMIC_INIT(0);
962
963 /*
964 * The request distributor calls this function if it picked the CEXxC
965 * device to handle a modexpo request.
966 * @zq: pointer to zcrypt_queue structure that identifies the
967 * CEXxC device to the request distributor
968 * @mex: pointer to the modexpo request buffer
969 */
zcrypt_msgtype6_modexpo(struct zcrypt_queue * zq,struct ica_rsa_modexpo * mex,struct ap_message * ap_msg)970 static long zcrypt_msgtype6_modexpo(struct zcrypt_queue *zq,
971 struct ica_rsa_modexpo *mex,
972 struct ap_message *ap_msg)
973 {
974 struct response_type resp_type = {
975 .type = CEXXC_RESPONSE_TYPE_ICA,
976 };
977 int rc;
978
979 ap_msg->msg = (void *)get_zeroed_page(GFP_KERNEL);
980 if (!ap_msg->msg)
981 return -ENOMEM;
982 ap_msg->bufsize = PAGE_SIZE;
983 ap_msg->receive = zcrypt_msgtype6_receive;
984 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
985 atomic_inc_return(&zcrypt_step);
986 ap_msg->private = &resp_type;
987 rc = icamex_msg_to_type6mex_msgx(zq, ap_msg, mex);
988 if (rc)
989 goto out_free;
990 init_completion(&resp_type.work);
991 rc = ap_queue_message(zq->queue, ap_msg);
992 if (rc)
993 goto out_free;
994 rc = wait_for_completion_interruptible(&resp_type.work);
995 if (rc == 0) {
996 rc = ap_msg->rc;
997 if (rc == 0)
998 rc = convert_response_ica(zq, ap_msg,
999 mex->outputdata,
1000 mex->outputdatalength);
1001 } else {
1002 /* Signal pending. */
1003 ap_cancel_message(zq->queue, ap_msg);
1004 }
1005
1006 out_free:
1007 free_page((unsigned long)ap_msg->msg);
1008 ap_msg->private = NULL;
1009 ap_msg->msg = NULL;
1010 return rc;
1011 }
1012
1013 /*
1014 * The request distributor calls this function if it picked the CEXxC
1015 * device to handle a modexpo_crt request.
1016 * @zq: pointer to zcrypt_queue structure that identifies the
1017 * CEXxC device to the request distributor
1018 * @crt: pointer to the modexpoc_crt request buffer
1019 */
zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue * zq,struct ica_rsa_modexpo_crt * crt,struct ap_message * ap_msg)1020 static long zcrypt_msgtype6_modexpo_crt(struct zcrypt_queue *zq,
1021 struct ica_rsa_modexpo_crt *crt,
1022 struct ap_message *ap_msg)
1023 {
1024 struct response_type resp_type = {
1025 .type = CEXXC_RESPONSE_TYPE_ICA,
1026 };
1027 int rc;
1028
1029 ap_msg->msg = (void *)get_zeroed_page(GFP_KERNEL);
1030 if (!ap_msg->msg)
1031 return -ENOMEM;
1032 ap_msg->bufsize = PAGE_SIZE;
1033 ap_msg->receive = zcrypt_msgtype6_receive;
1034 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1035 atomic_inc_return(&zcrypt_step);
1036 ap_msg->private = &resp_type;
1037 rc = icacrt_msg_to_type6crt_msgx(zq, ap_msg, crt);
1038 if (rc)
1039 goto out_free;
1040 init_completion(&resp_type.work);
1041 rc = ap_queue_message(zq->queue, ap_msg);
1042 if (rc)
1043 goto out_free;
1044 rc = wait_for_completion_interruptible(&resp_type.work);
1045 if (rc == 0) {
1046 rc = ap_msg->rc;
1047 if (rc == 0)
1048 rc = convert_response_ica(zq, ap_msg,
1049 crt->outputdata,
1050 crt->outputdatalength);
1051 } else {
1052 /* Signal pending. */
1053 ap_cancel_message(zq->queue, ap_msg);
1054 }
1055
1056 out_free:
1057 free_page((unsigned long)ap_msg->msg);
1058 ap_msg->private = NULL;
1059 ap_msg->msg = NULL;
1060 return rc;
1061 }
1062
1063 /*
1064 * Prepare a CCA AP msg request.
1065 * Prepare a CCA AP msg: fetch the required data from userspace,
1066 * prepare the AP msg, fill some info into the ap_message struct,
1067 * extract some data from the CPRB and give back to the caller.
1068 * This function allocates memory and needs an ap_msg prepared
1069 * by the caller with ap_init_message(). Also the caller has to
1070 * make sure ap_release_message() is always called even on failure.
1071 */
prep_cca_ap_msg(bool userspace,struct ica_xcRB * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned short ** dom)1072 int prep_cca_ap_msg(bool userspace, struct ica_xcRB *xcrb,
1073 struct ap_message *ap_msg,
1074 unsigned int *func_code, unsigned short **dom)
1075 {
1076 struct response_type resp_type = {
1077 .type = CEXXC_RESPONSE_TYPE_XCRB,
1078 };
1079
1080 ap_msg->bufsize = atomic_read(&ap_max_msg_size);
1081 ap_msg->msg = kmalloc(ap_msg->bufsize, GFP_KERNEL);
1082 if (!ap_msg->msg)
1083 return -ENOMEM;
1084 ap_msg->receive = zcrypt_msgtype6_receive;
1085 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1086 atomic_inc_return(&zcrypt_step);
1087 ap_msg->private = kmemdup(&resp_type, sizeof(resp_type), GFP_KERNEL);
1088 if (!ap_msg->private)
1089 return -ENOMEM;
1090 return xcrb_msg_to_type6cprb_msgx(userspace, ap_msg, xcrb, func_code, dom);
1091 }
1092
1093 /*
1094 * The request distributor calls this function if it picked the CEXxC
1095 * device to handle a send_cprb request.
1096 * @zq: pointer to zcrypt_queue structure that identifies the
1097 * CEXxC device to the request distributor
1098 * @xcrb: pointer to the send_cprb request buffer
1099 */
zcrypt_msgtype6_send_cprb(bool userspace,struct zcrypt_queue * zq,struct ica_xcRB * xcrb,struct ap_message * ap_msg)1100 static long zcrypt_msgtype6_send_cprb(bool userspace, struct zcrypt_queue *zq,
1101 struct ica_xcRB *xcrb,
1102 struct ap_message *ap_msg)
1103 {
1104 struct response_type *rtype = ap_msg->private;
1105 struct {
1106 struct type6_hdr hdr;
1107 struct CPRBX cprbx;
1108 /* ... more data blocks ... */
1109 } __packed * msg = ap_msg->msg;
1110 unsigned int max_payload_size;
1111 int rc, delta;
1112
1113 /* calculate maximum payload for this card and msg type */
1114 max_payload_size = zq->reply.bufsize - sizeof(struct type86_fmt2_msg);
1115
1116 /* limit each of the two from fields to the maximum payload size */
1117 msg->hdr.fromcardlen1 = min(msg->hdr.fromcardlen1, max_payload_size);
1118 msg->hdr.fromcardlen2 = min(msg->hdr.fromcardlen2, max_payload_size);
1119
1120 /* calculate delta if the sum of both exceeds max payload size */
1121 delta = msg->hdr.fromcardlen1 + msg->hdr.fromcardlen2
1122 - max_payload_size;
1123 if (delta > 0) {
1124 /*
1125 * Sum exceeds maximum payload size, prune fromcardlen1
1126 * (always trust fromcardlen2)
1127 */
1128 if (delta > msg->hdr.fromcardlen1) {
1129 rc = -EINVAL;
1130 goto out;
1131 }
1132 msg->hdr.fromcardlen1 -= delta;
1133 }
1134
1135 init_completion(&rtype->work);
1136 rc = ap_queue_message(zq->queue, ap_msg);
1137 if (rc)
1138 goto out;
1139 rc = wait_for_completion_interruptible(&rtype->work);
1140 if (rc == 0) {
1141 rc = ap_msg->rc;
1142 if (rc == 0)
1143 rc = convert_response_xcrb(userspace, zq, ap_msg, xcrb);
1144 } else {
1145 /* Signal pending. */
1146 ap_cancel_message(zq->queue, ap_msg);
1147 }
1148
1149 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1150 rc = -EIO; /* do not retry administrative requests */
1151
1152 out:
1153 if (rc)
1154 ZCRYPT_DBF_DBG("%s send cprb at dev=%02x.%04x rc=%d\n",
1155 __func__, AP_QID_CARD(zq->queue->qid),
1156 AP_QID_QUEUE(zq->queue->qid), rc);
1157 return rc;
1158 }
1159
1160 /*
1161 * Prepare an EP11 AP msg request.
1162 * Prepare an EP11 AP msg: fetch the required data from userspace,
1163 * prepare the AP msg, fill some info into the ap_message struct,
1164 * extract some data from the CPRB and give back to the caller.
1165 * This function allocates memory and needs an ap_msg prepared
1166 * by the caller with ap_init_message(). Also the caller has to
1167 * make sure ap_release_message() is always called even on failure.
1168 */
prep_ep11_ap_msg(bool userspace,struct ep11_urb * xcrb,struct ap_message * ap_msg,unsigned int * func_code,unsigned int * domain)1169 int prep_ep11_ap_msg(bool userspace, struct ep11_urb *xcrb,
1170 struct ap_message *ap_msg,
1171 unsigned int *func_code, unsigned int *domain)
1172 {
1173 struct response_type resp_type = {
1174 .type = CEXXC_RESPONSE_TYPE_EP11,
1175 };
1176
1177 ap_msg->bufsize = atomic_read(&ap_max_msg_size);
1178 ap_msg->msg = kmalloc(ap_msg->bufsize, GFP_KERNEL);
1179 if (!ap_msg->msg)
1180 return -ENOMEM;
1181 ap_msg->receive = zcrypt_msgtype6_receive_ep11;
1182 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1183 atomic_inc_return(&zcrypt_step);
1184 ap_msg->private = kmemdup(&resp_type, sizeof(resp_type), GFP_KERNEL);
1185 if (!ap_msg->private)
1186 return -ENOMEM;
1187 return xcrb_msg_to_type6_ep11cprb_msgx(userspace, ap_msg, xcrb,
1188 func_code, domain);
1189 }
1190
1191 /*
1192 * The request distributor calls this function if it picked the CEX4P
1193 * device to handle a send_ep11_cprb request.
1194 * @zq: pointer to zcrypt_queue structure that identifies the
1195 * CEX4P device to the request distributor
1196 * @xcrb: pointer to the ep11 user request block
1197 */
zcrypt_msgtype6_send_ep11_cprb(bool userspace,struct zcrypt_queue * zq,struct ep11_urb * xcrb,struct ap_message * ap_msg)1198 static long zcrypt_msgtype6_send_ep11_cprb(bool userspace, struct zcrypt_queue *zq,
1199 struct ep11_urb *xcrb,
1200 struct ap_message *ap_msg)
1201 {
1202 int rc;
1203 unsigned int lfmt;
1204 struct response_type *rtype = ap_msg->private;
1205 struct {
1206 struct type6_hdr hdr;
1207 struct ep11_cprb cprbx;
1208 unsigned char pld_tag; /* fixed value 0x30 */
1209 unsigned char pld_lenfmt; /* payload length format */
1210 } __packed * msg = ap_msg->msg;
1211 struct pld_hdr {
1212 unsigned char func_tag; /* fixed value 0x4 */
1213 unsigned char func_len; /* fixed value 0x4 */
1214 unsigned int func_val; /* function ID */
1215 unsigned char dom_tag; /* fixed value 0x4 */
1216 unsigned char dom_len; /* fixed value 0x4 */
1217 unsigned int dom_val; /* domain id */
1218 } __packed * payload_hdr = NULL;
1219
1220 /*
1221 * The target domain field within the cprb body/payload block will be
1222 * replaced by the usage domain for non-management commands only.
1223 * Therefore we check the first bit of the 'flags' parameter for
1224 * management command indication.
1225 * 0 - non management command
1226 * 1 - management command
1227 */
1228 if (!((msg->cprbx.flags & 0x80) == 0x80)) {
1229 msg->cprbx.target_id = (unsigned int)
1230 AP_QID_QUEUE(zq->queue->qid);
1231
1232 if ((msg->pld_lenfmt & 0x80) == 0x80) { /*ext.len.fmt 2 or 3*/
1233 switch (msg->pld_lenfmt & 0x03) {
1234 case 1:
1235 lfmt = 2;
1236 break;
1237 case 2:
1238 lfmt = 3;
1239 break;
1240 default:
1241 return -EINVAL;
1242 }
1243 } else {
1244 lfmt = 1; /* length format #1 */
1245 }
1246 payload_hdr = (struct pld_hdr *)((&msg->pld_lenfmt) + lfmt);
1247 payload_hdr->dom_val = (unsigned int)
1248 AP_QID_QUEUE(zq->queue->qid);
1249 }
1250
1251 /*
1252 * Set the queue's reply buffer length minus the two prepend headers
1253 * as reply limit for the card firmware.
1254 */
1255 msg->hdr.fromcardlen1 = zq->reply.bufsize -
1256 sizeof(struct type86_hdr) - sizeof(struct type86_fmt2_ext);
1257
1258 init_completion(&rtype->work);
1259 rc = ap_queue_message(zq->queue, ap_msg);
1260 if (rc)
1261 goto out;
1262 rc = wait_for_completion_interruptible(&rtype->work);
1263 if (rc == 0) {
1264 rc = ap_msg->rc;
1265 if (rc == 0)
1266 rc = convert_response_ep11_xcrb(userspace, zq, ap_msg, xcrb);
1267 } else {
1268 /* Signal pending. */
1269 ap_cancel_message(zq->queue, ap_msg);
1270 }
1271
1272 if (rc == -EAGAIN && ap_msg->flags & AP_MSG_FLAG_ADMIN)
1273 rc = -EIO; /* do not retry administrative requests */
1274
1275 out:
1276 if (rc)
1277 ZCRYPT_DBF_DBG("%s send cprb at dev=%02x.%04x rc=%d\n",
1278 __func__, AP_QID_CARD(zq->queue->qid),
1279 AP_QID_QUEUE(zq->queue->qid), rc);
1280 return rc;
1281 }
1282
prep_rng_ap_msg(struct ap_message * ap_msg,int * func_code,unsigned int * domain)1283 int prep_rng_ap_msg(struct ap_message *ap_msg, int *func_code,
1284 unsigned int *domain)
1285 {
1286 struct response_type resp_type = {
1287 .type = CEXXC_RESPONSE_TYPE_XCRB,
1288 };
1289
1290 ap_msg->bufsize = AP_DEFAULT_MAX_MSG_SIZE;
1291 ap_msg->msg = kmalloc(ap_msg->bufsize, GFP_KERNEL);
1292 if (!ap_msg->msg)
1293 return -ENOMEM;
1294 ap_msg->receive = zcrypt_msgtype6_receive;
1295 ap_msg->psmid = (((unsigned long)current->pid) << 32) +
1296 atomic_inc_return(&zcrypt_step);
1297 ap_msg->private = kmemdup(&resp_type, sizeof(resp_type), GFP_KERNEL);
1298 if (!ap_msg->private)
1299 return -ENOMEM;
1300
1301 rng_type6cprb_msgx(ap_msg, ZCRYPT_RNG_BUFFER_SIZE, domain);
1302
1303 *func_code = HWRNG;
1304 return 0;
1305 }
1306
1307 /*
1308 * The request distributor calls this function if it picked the CEXxC
1309 * device to generate random data.
1310 * @zq: pointer to zcrypt_queue structure that identifies the
1311 * CEXxC device to the request distributor
1312 * @buffer: pointer to a memory page to return random data
1313 */
zcrypt_msgtype6_rng(struct zcrypt_queue * zq,char * buffer,struct ap_message * ap_msg)1314 static long zcrypt_msgtype6_rng(struct zcrypt_queue *zq,
1315 char *buffer, struct ap_message *ap_msg)
1316 {
1317 struct {
1318 struct type6_hdr hdr;
1319 struct CPRBX cprbx;
1320 char function_code[2];
1321 short int rule_length;
1322 char rule[8];
1323 short int verb_length;
1324 short int key_length;
1325 } __packed * msg = ap_msg->msg;
1326 struct response_type *rtype = ap_msg->private;
1327 int rc;
1328
1329 msg->cprbx.domain = AP_QID_QUEUE(zq->queue->qid);
1330
1331 init_completion(&rtype->work);
1332 rc = ap_queue_message(zq->queue, ap_msg);
1333 if (rc)
1334 goto out;
1335 rc = wait_for_completion_interruptible(&rtype->work);
1336 if (rc == 0) {
1337 rc = ap_msg->rc;
1338 if (rc == 0)
1339 rc = convert_response_rng(zq, ap_msg, buffer);
1340 } else {
1341 /* Signal pending. */
1342 ap_cancel_message(zq->queue, ap_msg);
1343 }
1344 out:
1345 return rc;
1346 }
1347
1348 /*
1349 * The crypto operations for a CEXxC card.
1350 */
1351
1352 static struct zcrypt_ops zcrypt_msgtype6_ops = {
1353 .owner = THIS_MODULE,
1354 .name = MSGTYPE06_NAME,
1355 .variant = MSGTYPE06_VARIANT_DEFAULT,
1356 .rsa_modexpo = zcrypt_msgtype6_modexpo,
1357 .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
1358 .send_cprb = zcrypt_msgtype6_send_cprb,
1359 .rng = zcrypt_msgtype6_rng,
1360 };
1361
1362 static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
1363 .owner = THIS_MODULE,
1364 .name = MSGTYPE06_NAME,
1365 .variant = MSGTYPE06_VARIANT_EP11,
1366 .rsa_modexpo = NULL,
1367 .rsa_modexpo_crt = NULL,
1368 .send_ep11_cprb = zcrypt_msgtype6_send_ep11_cprb,
1369 };
1370
zcrypt_msgtype6_init(void)1371 void __init zcrypt_msgtype6_init(void)
1372 {
1373 zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
1374 zcrypt_msgtype_register(&zcrypt_msgtype6_ep11_ops);
1375 }
1376
zcrypt_msgtype6_exit(void)1377 void __exit zcrypt_msgtype6_exit(void)
1378 {
1379 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
1380 zcrypt_msgtype_unregister(&zcrypt_msgtype6_ep11_ops);
1381 }
1382