1 // SPDX-License-Identifier: GPL-2.0
3  * DIAG 0x320 support and certificate store handling
16 #include <linux/key-type.h>
25 #include <keys/user-type.h>
27 #include <asm/diag.h>
65 	u8  version;  member
114 	u8  version;  member
140 	strscpy(ascii, key->description, sizeof(ascii));  in cert_store_key_describe()
144 	seq_puts(m, &key->description[VC_NAME_LEN_BYTES]);  in cert_store_key_describe()
146 		seq_printf(m, ": %u", key->datalen);  in cert_store_key_describe()
168 	pr_dbf_msg("vcb_input_length: %d", b->vcb_hdr.vcb_input_length);  in pr_dbf_vcb()
169 	pr_dbf_msg("first_vc_index: %d", b->vcb_hdr.first_vc_index);  in pr_dbf_vcb()
170 	pr_dbf_msg("last_vc_index: %d", b->vcb_hdr.last_vc_index);  in pr_dbf_vcb()
171 	pr_dbf_msg("cs_token: %d", b->vcb_hdr.cs_token);  in pr_dbf_vcb()
172 	pr_dbf_msg("vcb_output_length: %d", b->vcb_hdr.vcb_output_length);  in pr_dbf_vcb()
173 	pr_dbf_msg("version: %d", b->vcb_hdr.version);  in pr_dbf_vcb()
174 	pr_dbf_msg("stored_vc_count: %d", b->vcb_hdr.stored_vc_count);  in pr_dbf_vcb()
175 	pr_dbf_msg("remaining_vc_count: %d", b->vcb_hdr.remaining_vc_count);  in pr_dbf_vcb()
184 	pr_dbf_msg("vce_hdr.vce_length: %d", e->vce_hdr.vce_length);  in pr_dbf_vce()
185 	pr_dbf_msg("vce_hdr.flags: %d", e->vce_hdr.flags);  in pr_dbf_vce()
186 	pr_dbf_msg("vce_hdr.key_type: %d", e->vce_hdr.key_type);  in pr_dbf_vce()
187 	pr_dbf_msg("vce_hdr.vc_index: %d", e->vce_hdr.vc_index);  in pr_dbf_vce()
188 	pr_dbf_msg("vce_hdr.vc_format: %d", e->vce_hdr.vc_format);  in pr_dbf_vce()
189 	pr_dbf_msg("vce_hdr.key_id_length: %d", e->vce_hdr.key_id_length);  in pr_dbf_vce()
190 	pr_dbf_msg("vce_hdr.vc_hash_type: %d", e->vce_hdr.vc_hash_type);  in pr_dbf_vce()
191 	pr_dbf_msg("vce_hdr.vc_hash_length: %d", e->vce_hdr.vc_hash_length);  in pr_dbf_vce()
192 	pr_dbf_msg("vce_hdr.vc_hash_offset: %d", e->vce_hdr.vc_hash_offset);  in pr_dbf_vce()
193 	pr_dbf_msg("vce_hdr.vc_length: %d", e->vce_hdr.vc_length);  in pr_dbf_vce()
194 	pr_dbf_msg("vce_hdr.vc_offset: %d", e->vce_hdr.vc_offset);  in pr_dbf_vce()
197 	memcpy(vc_name, e->vce_hdr.vc_name, VC_NAME_LEN_BYTES);  in pr_dbf_vce()
203 		 e->vce_hdr.vc_index, vc_name);  in pr_dbf_vce()
208 	debug_event(cert_store_hexdump, 3, (u8 *)e->cert_data_buf, 128);  in pr_dbf_vce()
211 		    (u8 *)e->cert_data_buf + e->vce_hdr.vce_length - 128, 128);  in pr_dbf_vce()
220 	pr_dbf_msg("vcssb_length: %u", s->vcssb_length);  in pr_dbf_vcssb()
221 	pr_dbf_msg("version: %u", s->version);  in pr_dbf_vcssb()
222 	pr_dbf_msg("cs_token: %u", s->cs_token);  in pr_dbf_vcssb()
223 	pr_dbf_msg("total_vc_index_count: %u", s->total_vc_index_count);  in pr_dbf_vcssb()
224 	pr_dbf_msg("max_vc_index_count: %u", s->max_vc_index_count);  in pr_dbf_vcssb()
225 	pr_dbf_msg("max_vce_length: %u", s->max_vce_length);  in pr_dbf_vcssb()
226 	pr_dbf_msg("max_vcxe_length: %u", s->max_vce_length);  in pr_dbf_vcssb()
227 	pr_dbf_msg("max_single_vcb_length: %u", s->max_single_vcb_length);  in pr_dbf_vcssb()
228 	pr_dbf_msg("total_vcb_length: %u", s->total_vcb_length);  in pr_dbf_vcssb()
229 	pr_dbf_msg("max_single_vcxb_length: %u", s->max_single_vcxb_length);  in pr_dbf_vcssb()
230 	pr_dbf_msg("total_vcxb_length: %u", s->total_vcxb_length);  in pr_dbf_vcssb()
238 		"	diag	%[rp],%[subcode],0x320\n"  in __diag320()
257  * VCE. Return -EINVAL if hashes don't match.
265 	vce_hash = (u8 *)vce + vce->vce_hdr.vc_hash_offset;  in check_certificate_hash()
266 	vc_hash_length = vce->vce_hdr.vc_hash_length;  in check_certificate_hash()
267 	sha256((u8 *)vce + vce->vce_hdr.vc_offset, vce->vce_hdr.vc_length, hash);  in check_certificate_hash()
277 	return -EINVAL;  in check_certificate_hash()
282 	if (!(vce->vce_hdr.flags & VCE_FLAGS_VALID_MASK)) {  in check_certificate_valid()
284 		return -EINVAL;  in check_certificate_valid()
286 	if (vce->vce_hdr.vc_format != 1) {  in check_certificate_valid()
288 		return -EINVAL;  in check_certificate_valid()
290 	if (vce->vce_hdr.vc_hash_type != 1) {  in check_certificate_valid()
292 		return -EINVAL;  in check_certificate_valid()
307 		return ERR_PTR(-ENOKEY);  in get_user_session_keyring()
326 		return -ENOMEM;  in invalidate_keyring_keys()
336 		pr_dbf_msg("Invalidating key %08x", current_key->serial);  in invalidate_keyring_keys()
342 			pr_dbf_msg("Couldn't unlink key %08x: %d", current_key->serial, rc);  in invalidate_keyring_keys()
411 	pr_dbf_msg("Successfully allocated cert_store keyring: %08x", cs_keyring->serial);  in create_cs_keyring()
414 	 * In case a previous clean-up ran into an  in create_cs_keyring()
434 	cs_token = vcssb->cs_token;  in get_key_description()
436 	name_len = sizeof(vce->vce_hdr.vc_name);  in get_key_description()
442 	memcpy(desc, vce->vce_hdr.vc_name, name_len);  in get_key_description()
443 	snprintf(desc + name_len, len - name_len, ":%05u:%010u",  in get_key_description()
444 		 vce->vce_hdr.vc_index, cs_token);  in get_key_description()
462 		return -ENOMEM;  in create_key_from_vce()
466 		desc, (u8 *)vce + vce->vce_hdr.vc_offset,  in create_key_from_vce()
467 		vce->vce_hdr.vc_length,  in create_key_from_vce()
474 		rc = -ENOKEY;  in create_key_from_vce()
490 	vcssb->vcssb_length = VCSSB_LEN_BYTES;  in get_vcssb()
495 		pr_dbf_msg("Diag 320 Subcode 1 returned bad RC: %04x", diag320_rc);  in get_vcssb()
496 		return -EIO;  in get_vcssb()
498 	if (vcssb->vcssb_length == VCSSB_LEN_NO_CERTS) {  in get_vcssb()
500 		return -ENOKEY;  in get_vcssb()
508 	return round_up(vcssb->max_single_vcb_length, PAGE_SIZE);  in get_4k_mult_vcb_size()
511 /* Fill input fields of single-entry VCB that will be read by LPAR. */
515 	vcb->vcb_hdr.vcb_input_length = get_4k_mult_vcb_size(vcssb);  in fill_vcb_input()
516 	vcb->vcb_hdr.cs_token = vcssb->cs_token;  in fill_vcb_input()
519 	vcb->vcb_hdr.first_vc_index = index;  in fill_vcb_input()
520 	vcb->vcb_hdr.last_vc_index = index;  in fill_vcb_input()
527 	extracted_vce = (struct vce *)vcb->vcb_buf;  in extract_vce_from_sevcb()
528 	memcpy(vce, vcb->vcb_buf, extracted_vce->vce_hdr.vce_length);  in extract_vce_from_sevcb()
539 	pr_dbf_msg("Diag 320 Subcode2 RC %2x", diag320_rc);  in get_sevcb()
545 		if (vcb->vcb_hdr.vcb_output_length == VCB_LEN_NO_CERTS) {  in get_sevcb()
547 			rc = -ENOKEY;  in get_sevcb()
548 		} else if (vcb->vcb_hdr.remaining_vc_count != 0) {  in get_sevcb()
551 			rc = -EAGAIN;  in get_sevcb()
556 		rc = -EAGAIN;  in get_sevcb()
559 		pr_dbf_msg("Diag 320 Subcode2 returned bad rc (0x%4x)", diag320_rc);  in get_sevcb()
560 		rc = -EINVAL;  in get_sevcb()
568  * Allocate memory for single-entry VCB, get VCB via DIAG320 subcode 2 call,
578 	rc = -ENOMEM;  in create_key_from_sevcb()
580 	vce = vmalloc(vcssb->max_single_vcb_length - sizeof(vcb->vcb_hdr));  in create_key_from_sevcb()
605  * Request a single-entry VCB for each VCE available for the partition.
607  * could be created (i.e. VCEs were invalid) return -ENOKEY.
616 	for (index = 1; index < vcssb->total_vc_index_count + 1; index++) {  in add_certificates_to_keyring()
621 		if (rc == -EAGAIN)  in add_certificates_to_keyring()
632 		return -ENOKEY;  in add_certificates_to_keyring()
650  * Return -ENOENT if subcodes 1 or 2 are not available.
660 		return -ENOENT;  in query_diag320_subcodes()
668 		return -ENOENT;  in query_diag320_subcodes()
687 	rc = -ENOMEM;  in fill_cs_keyring()
692 	rc = -ENOENT;  in fill_cs_keyring()
706 	rc = -ENOMEM;  in fill_cs_keyring()
727 static int cs_status_val = -1;
732 	if (cs_status_val == -1)  in cs_status_show()
757 		if (rc != -EAGAIN)  in refresh_store()
778 	int rc = -ENOMEM;  in cert_store_init()