1812141a9SGreg Kroah-Hartman // SPDX-License-Identifier: GPL-2.0 2e80d4af0SHarald Freudenberger /* 3e80d4af0SHarald Freudenberger * pkey device driver 4e80d4af0SHarald Freudenberger * 5e80d4af0SHarald Freudenberger * Copyright IBM Corp. 2017 6e80d4af0SHarald Freudenberger * Author(s): Harald Freudenberger 7e80d4af0SHarald Freudenberger */ 8e80d4af0SHarald Freudenberger 9e80d4af0SHarald Freudenberger #define KMSG_COMPONENT "pkey" 10e80d4af0SHarald Freudenberger #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 11e80d4af0SHarald Freudenberger 12e80d4af0SHarald Freudenberger #include <linux/fs.h> 13e80d4af0SHarald Freudenberger #include <linux/init.h> 14e80d4af0SHarald Freudenberger #include <linux/miscdevice.h> 15e80d4af0SHarald Freudenberger #include <linux/module.h> 16e80d4af0SHarald Freudenberger #include <linux/slab.h> 17e80d4af0SHarald Freudenberger #include <linux/kallsyms.h> 18e80d4af0SHarald Freudenberger #include <linux/debugfs.h> 19e80d4af0SHarald Freudenberger #include <asm/zcrypt.h> 20e80d4af0SHarald Freudenberger #include <asm/cpacf.h> 21e80d4af0SHarald Freudenberger #include <asm/pkey.h> 22e80d4af0SHarald Freudenberger 23e80d4af0SHarald Freudenberger #include "zcrypt_api.h" 24e80d4af0SHarald Freudenberger 25e80d4af0SHarald Freudenberger MODULE_LICENSE("GPL"); 26e80d4af0SHarald Freudenberger MODULE_AUTHOR("IBM Corporation"); 27e80d4af0SHarald Freudenberger MODULE_DESCRIPTION("s390 protected key interface"); 28e80d4af0SHarald Freudenberger 29e80d4af0SHarald Freudenberger /* Size of parameter block used for all cca requests/replies */ 30e80d4af0SHarald Freudenberger #define PARMBSIZE 512 31e80d4af0SHarald Freudenberger 32e80d4af0SHarald Freudenberger /* Size of vardata block used for some of the cca requests/replies */ 33e80d4af0SHarald Freudenberger #define VARDATASIZE 4096 34e80d4af0SHarald Freudenberger 35e80d4af0SHarald Freudenberger /* 36e80d4af0SHarald Freudenberger * debug feature data and functions 37e80d4af0SHarald Freudenberger */ 38e80d4af0SHarald Freudenberger 39e80d4af0SHarald Freudenberger static debug_info_t *debug_info; 40e80d4af0SHarald Freudenberger 41e80d4af0SHarald Freudenberger #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__) 42e80d4af0SHarald Freudenberger #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__) 43e80d4af0SHarald Freudenberger #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__) 44e80d4af0SHarald Freudenberger #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__) 45e80d4af0SHarald Freudenberger 46e80d4af0SHarald Freudenberger static void __init pkey_debug_init(void) 47e80d4af0SHarald Freudenberger { 48e80d4af0SHarald Freudenberger debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long)); 49e80d4af0SHarald Freudenberger debug_register_view(debug_info, &debug_sprintf_view); 50e80d4af0SHarald Freudenberger debug_set_level(debug_info, 3); 51e80d4af0SHarald Freudenberger } 52e80d4af0SHarald Freudenberger 53e80d4af0SHarald Freudenberger static void __exit pkey_debug_exit(void) 54e80d4af0SHarald Freudenberger { 55e80d4af0SHarald Freudenberger debug_unregister(debug_info); 56e80d4af0SHarald Freudenberger } 57e80d4af0SHarald Freudenberger 58e80d4af0SHarald Freudenberger /* inside view of a secure key token (only type 0x01 version 0x04) */ 59e80d4af0SHarald Freudenberger struct secaeskeytoken { 60e80d4af0SHarald Freudenberger u8 type; /* 0x01 for internal key token */ 61e80d4af0SHarald Freudenberger u8 res0[3]; 62e80d4af0SHarald Freudenberger u8 version; /* should be 0x04 */ 63e80d4af0SHarald Freudenberger u8 res1[1]; 64e80d4af0SHarald Freudenberger u8 flag; /* key flags */ 65e80d4af0SHarald Freudenberger u8 res2[1]; 66e80d4af0SHarald Freudenberger u64 mkvp; /* master key verification pattern */ 67e80d4af0SHarald Freudenberger u8 key[32]; /* key value (encrypted) */ 68e80d4af0SHarald Freudenberger u8 cv[8]; /* control vector */ 69e80d4af0SHarald Freudenberger u16 bitsize; /* key bit size */ 70e80d4af0SHarald Freudenberger u16 keysize; /* key byte size */ 71e80d4af0SHarald Freudenberger u8 tvv[4]; /* token validation value */ 72e80d4af0SHarald Freudenberger } __packed; 73e80d4af0SHarald Freudenberger 74e80d4af0SHarald Freudenberger /* 75e80d4af0SHarald Freudenberger * Simple check if the token is a valid CCA secure AES key 76e80d4af0SHarald Freudenberger * token. If keybitsize is given, the bitsize of the key is 77e80d4af0SHarald Freudenberger * also checked. Returns 0 on success or errno value on failure. 78e80d4af0SHarald Freudenberger */ 79e61a6134SHarald Freudenberger static int check_secaeskeytoken(const u8 *token, int keybitsize) 80e80d4af0SHarald Freudenberger { 81e80d4af0SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) token; 82e80d4af0SHarald Freudenberger 83e80d4af0SHarald Freudenberger if (t->type != 0x01) { 84e80d4af0SHarald Freudenberger DEBUG_ERR( 85*ac2b96f3SHarald Freudenberger "%s secure token check failed, type mismatch 0x%02x != 0x01\n", 86*ac2b96f3SHarald Freudenberger __func__, (int) t->type); 87e80d4af0SHarald Freudenberger return -EINVAL; 88e80d4af0SHarald Freudenberger } 89e80d4af0SHarald Freudenberger if (t->version != 0x04) { 90e80d4af0SHarald Freudenberger DEBUG_ERR( 91*ac2b96f3SHarald Freudenberger "%s secure token check failed, version mismatch 0x%02x != 0x04\n", 92*ac2b96f3SHarald Freudenberger __func__, (int) t->version); 93e80d4af0SHarald Freudenberger return -EINVAL; 94e80d4af0SHarald Freudenberger } 95e80d4af0SHarald Freudenberger if (keybitsize > 0 && t->bitsize != keybitsize) { 96e80d4af0SHarald Freudenberger DEBUG_ERR( 97*ac2b96f3SHarald Freudenberger "%s secure token check failed, bitsize mismatch %d != %d\n", 98*ac2b96f3SHarald Freudenberger __func__, (int) t->bitsize, keybitsize); 99e80d4af0SHarald Freudenberger return -EINVAL; 100e80d4af0SHarald Freudenberger } 101e80d4af0SHarald Freudenberger 102e80d4af0SHarald Freudenberger return 0; 103e80d4af0SHarald Freudenberger } 104e80d4af0SHarald Freudenberger 105e80d4af0SHarald Freudenberger /* 106e80d4af0SHarald Freudenberger * Allocate consecutive memory for request CPRB, request param 107e80d4af0SHarald Freudenberger * block, reply CPRB and reply param block and fill in values 108e80d4af0SHarald Freudenberger * for the common fields. Returns 0 on success or errno value 109e80d4af0SHarald Freudenberger * on failure. 110e80d4af0SHarald Freudenberger */ 111e80d4af0SHarald Freudenberger static int alloc_and_prep_cprbmem(size_t paramblen, 112e80d4af0SHarald Freudenberger u8 **pcprbmem, 113e80d4af0SHarald Freudenberger struct CPRBX **preqCPRB, 114e80d4af0SHarald Freudenberger struct CPRBX **prepCPRB) 115e80d4af0SHarald Freudenberger { 116e80d4af0SHarald Freudenberger u8 *cprbmem; 117e80d4af0SHarald Freudenberger size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen; 118e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 119e80d4af0SHarald Freudenberger 120e80d4af0SHarald Freudenberger /* 121e80d4af0SHarald Freudenberger * allocate consecutive memory for request CPRB, request param 122e80d4af0SHarald Freudenberger * block, reply CPRB and reply param block 123e80d4af0SHarald Freudenberger */ 1246396bb22SKees Cook cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL); 125e80d4af0SHarald Freudenberger if (!cprbmem) 126e80d4af0SHarald Freudenberger return -ENOMEM; 127e80d4af0SHarald Freudenberger 128e80d4af0SHarald Freudenberger preqcblk = (struct CPRBX *) cprbmem; 129e80d4af0SHarald Freudenberger prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen); 130e80d4af0SHarald Freudenberger 131e80d4af0SHarald Freudenberger /* fill request cprb struct */ 132e80d4af0SHarald Freudenberger preqcblk->cprb_len = sizeof(struct CPRBX); 133e80d4af0SHarald Freudenberger preqcblk->cprb_ver_id = 0x02; 134e80d4af0SHarald Freudenberger memcpy(preqcblk->func_id, "T2", 2); 135e80d4af0SHarald Freudenberger preqcblk->rpl_msgbl = cprbplusparamblen; 136e80d4af0SHarald Freudenberger if (paramblen) { 137e80d4af0SHarald Freudenberger preqcblk->req_parmb = 138e80d4af0SHarald Freudenberger ((u8 *) preqcblk) + sizeof(struct CPRBX); 139e80d4af0SHarald Freudenberger preqcblk->rpl_parmb = 140e80d4af0SHarald Freudenberger ((u8 *) prepcblk) + sizeof(struct CPRBX); 141e80d4af0SHarald Freudenberger } 142e80d4af0SHarald Freudenberger 143e80d4af0SHarald Freudenberger *pcprbmem = cprbmem; 144e80d4af0SHarald Freudenberger *preqCPRB = preqcblk; 145e80d4af0SHarald Freudenberger *prepCPRB = prepcblk; 146e80d4af0SHarald Freudenberger 147e80d4af0SHarald Freudenberger return 0; 148e80d4af0SHarald Freudenberger } 149e80d4af0SHarald Freudenberger 150e80d4af0SHarald Freudenberger /* 151e80d4af0SHarald Freudenberger * Free the cprb memory allocated with the function above. 152e80d4af0SHarald Freudenberger * If the scrub value is not zero, the memory is filled 153e80d4af0SHarald Freudenberger * with zeros before freeing (useful if there was some 154e80d4af0SHarald Freudenberger * clear key material in there). 155e80d4af0SHarald Freudenberger */ 156e80d4af0SHarald Freudenberger static void free_cprbmem(void *mem, size_t paramblen, int scrub) 157e80d4af0SHarald Freudenberger { 158e80d4af0SHarald Freudenberger if (scrub) 159e80d4af0SHarald Freudenberger memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen)); 160e80d4af0SHarald Freudenberger kfree(mem); 161e80d4af0SHarald Freudenberger } 162e80d4af0SHarald Freudenberger 163e80d4af0SHarald Freudenberger /* 164e80d4af0SHarald Freudenberger * Helper function to prepare the xcrb struct 165e80d4af0SHarald Freudenberger */ 166e80d4af0SHarald Freudenberger static inline void prep_xcrb(struct ica_xcRB *pxcrb, 167e80d4af0SHarald Freudenberger u16 cardnr, 168e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, 169e80d4af0SHarald Freudenberger struct CPRBX *prepcblk) 170e80d4af0SHarald Freudenberger { 171e80d4af0SHarald Freudenberger memset(pxcrb, 0, sizeof(*pxcrb)); 172e80d4af0SHarald Freudenberger pxcrb->agent_ID = 0x4341; /* 'CA' */ 173e80d4af0SHarald Freudenberger pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr); 174e80d4af0SHarald Freudenberger pxcrb->request_control_blk_length = 175e80d4af0SHarald Freudenberger preqcblk->cprb_len + preqcblk->req_parml; 1767a003637SHeiko Carstens pxcrb->request_control_blk_addr = (void __user *) preqcblk; 177e80d4af0SHarald Freudenberger pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl; 1787a003637SHeiko Carstens pxcrb->reply_control_blk_addr = (void __user *) prepcblk; 179e80d4af0SHarald Freudenberger } 180e80d4af0SHarald Freudenberger 181e80d4af0SHarald Freudenberger /* 182e80d4af0SHarald Freudenberger * Helper function which calls zcrypt_send_cprb with 183e80d4af0SHarald Freudenberger * memory management segment adjusted to kernel space 184e80d4af0SHarald Freudenberger * so that the copy_from_user called within this 185e80d4af0SHarald Freudenberger * function do in fact copy from kernel space. 186e80d4af0SHarald Freudenberger */ 187e80d4af0SHarald Freudenberger static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb) 188e80d4af0SHarald Freudenberger { 189e80d4af0SHarald Freudenberger int rc; 190e80d4af0SHarald Freudenberger mm_segment_t old_fs = get_fs(); 191e80d4af0SHarald Freudenberger 192e80d4af0SHarald Freudenberger set_fs(KERNEL_DS); 193e80d4af0SHarald Freudenberger rc = zcrypt_send_cprb(xcrb); 194e80d4af0SHarald Freudenberger set_fs(old_fs); 195e80d4af0SHarald Freudenberger 196e80d4af0SHarald Freudenberger return rc; 197e80d4af0SHarald Freudenberger } 198e80d4af0SHarald Freudenberger 199e80d4af0SHarald Freudenberger /* 200e80d4af0SHarald Freudenberger * Generate (random) AES secure key. 201e80d4af0SHarald Freudenberger */ 202e80d4af0SHarald Freudenberger int pkey_genseckey(u16 cardnr, u16 domain, 203e80d4af0SHarald Freudenberger u32 keytype, struct pkey_seckey *seckey) 204e80d4af0SHarald Freudenberger { 205e80d4af0SHarald Freudenberger int i, rc, keysize; 206e80d4af0SHarald Freudenberger int seckeysize; 207e80d4af0SHarald Freudenberger u8 *mem; 208e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 209e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 210e80d4af0SHarald Freudenberger struct kgreqparm { 211e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 212e80d4af0SHarald Freudenberger u16 rule_array_len; 213e80d4af0SHarald Freudenberger struct lv1 { 214e80d4af0SHarald Freudenberger u16 len; 215e80d4af0SHarald Freudenberger char key_form[8]; 216e80d4af0SHarald Freudenberger char key_length[8]; 217e80d4af0SHarald Freudenberger char key_type1[8]; 218e80d4af0SHarald Freudenberger char key_type2[8]; 219e80d4af0SHarald Freudenberger } lv1; 220e80d4af0SHarald Freudenberger struct lv2 { 221e80d4af0SHarald Freudenberger u16 len; 222e80d4af0SHarald Freudenberger struct keyid { 223e80d4af0SHarald Freudenberger u16 len; 224e80d4af0SHarald Freudenberger u16 attr; 225e80d4af0SHarald Freudenberger u8 data[SECKEYBLOBSIZE]; 226e80d4af0SHarald Freudenberger } keyid[6]; 227e80d4af0SHarald Freudenberger } lv2; 228e80d4af0SHarald Freudenberger } *preqparm; 229e80d4af0SHarald Freudenberger struct kgrepparm { 230e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 231e80d4af0SHarald Freudenberger u16 rule_array_len; 232e80d4af0SHarald Freudenberger struct lv3 { 233e80d4af0SHarald Freudenberger u16 len; 234e80d4af0SHarald Freudenberger u16 keyblocklen; 235e80d4af0SHarald Freudenberger struct { 236e80d4af0SHarald Freudenberger u16 toklen; 237e80d4af0SHarald Freudenberger u16 tokattr; 238e80d4af0SHarald Freudenberger u8 tok[0]; 239e80d4af0SHarald Freudenberger /* ... some more data ... */ 240e80d4af0SHarald Freudenberger } keyblock; 241e80d4af0SHarald Freudenberger } lv3; 242e80d4af0SHarald Freudenberger } *prepparm; 243e80d4af0SHarald Freudenberger 244e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 245e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 246e80d4af0SHarald Freudenberger if (rc) 247e80d4af0SHarald Freudenberger return rc; 248e80d4af0SHarald Freudenberger 249e80d4af0SHarald Freudenberger /* fill request cprb struct */ 250e80d4af0SHarald Freudenberger preqcblk->domain = domain; 251e80d4af0SHarald Freudenberger 252e80d4af0SHarald Freudenberger /* fill request cprb param block with KG request */ 253e80d4af0SHarald Freudenberger preqparm = (struct kgreqparm *) preqcblk->req_parmb; 254e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "KG", 2); 255e80d4af0SHarald Freudenberger preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 256e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1); 257e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_form, "OP ", 8); 258e80d4af0SHarald Freudenberger switch (keytype) { 259e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 260e80d4af0SHarald Freudenberger keysize = 16; 261e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8); 262e80d4af0SHarald Freudenberger break; 263e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 264e80d4af0SHarald Freudenberger keysize = 24; 265e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8); 266e80d4af0SHarald Freudenberger break; 267e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 268e80d4af0SHarald Freudenberger keysize = 32; 269e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8); 270e80d4af0SHarald Freudenberger break; 271e80d4af0SHarald Freudenberger default: 272e80d4af0SHarald Freudenberger DEBUG_ERR( 273*ac2b96f3SHarald Freudenberger "%s unknown/unsupported keytype %d\n", 274*ac2b96f3SHarald Freudenberger __func__, keytype); 275e80d4af0SHarald Freudenberger rc = -EINVAL; 276e80d4af0SHarald Freudenberger goto out; 277e80d4af0SHarald Freudenberger } 278e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_type1, "AESDATA ", 8); 279e80d4af0SHarald Freudenberger preqparm->lv2.len = sizeof(struct lv2); 280e80d4af0SHarald Freudenberger for (i = 0; i < 6; i++) { 281e80d4af0SHarald Freudenberger preqparm->lv2.keyid[i].len = sizeof(struct keyid); 282e80d4af0SHarald Freudenberger preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10); 283e80d4af0SHarald Freudenberger } 284e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct kgreqparm); 285e80d4af0SHarald Freudenberger 286e80d4af0SHarald Freudenberger /* fill xcrb struct */ 287e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 288e80d4af0SHarald Freudenberger 289e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 290e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 291e80d4af0SHarald Freudenberger if (rc) { 292e80d4af0SHarald Freudenberger DEBUG_ERR( 293*ac2b96f3SHarald Freudenberger "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 294*ac2b96f3SHarald Freudenberger __func__, (int) cardnr, (int) domain, rc); 295e80d4af0SHarald Freudenberger goto out; 296e80d4af0SHarald Freudenberger } 297e80d4af0SHarald Freudenberger 298e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 299e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 300e80d4af0SHarald Freudenberger DEBUG_ERR( 301*ac2b96f3SHarald Freudenberger "%s secure key generate failure, card response %d/%d\n", 302*ac2b96f3SHarald Freudenberger __func__, 303e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 304e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 305e80d4af0SHarald Freudenberger rc = -EIO; 306e80d4af0SHarald Freudenberger goto out; 307e80d4af0SHarald Freudenberger } 308e80d4af0SHarald Freudenberger 309e80d4af0SHarald Freudenberger /* process response cprb param block */ 310e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 311e80d4af0SHarald Freudenberger prepparm = (struct kgrepparm *) prepcblk->rpl_parmb; 312e80d4af0SHarald Freudenberger 313e80d4af0SHarald Freudenberger /* check length of the returned secure key token */ 314e80d4af0SHarald Freudenberger seckeysize = prepparm->lv3.keyblock.toklen 315e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.toklen) 316e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.tokattr); 317e80d4af0SHarald Freudenberger if (seckeysize != SECKEYBLOBSIZE) { 318e80d4af0SHarald Freudenberger DEBUG_ERR( 319*ac2b96f3SHarald Freudenberger "%s secure token size mismatch %d != %d bytes\n", 320*ac2b96f3SHarald Freudenberger __func__, seckeysize, SECKEYBLOBSIZE); 321e80d4af0SHarald Freudenberger rc = -EIO; 322e80d4af0SHarald Freudenberger goto out; 323e80d4af0SHarald Freudenberger } 324e80d4af0SHarald Freudenberger 325e80d4af0SHarald Freudenberger /* check secure key token */ 326e80d4af0SHarald Freudenberger rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize); 327e80d4af0SHarald Freudenberger if (rc) { 328e80d4af0SHarald Freudenberger rc = -EIO; 329e80d4af0SHarald Freudenberger goto out; 330e80d4af0SHarald Freudenberger } 331e80d4af0SHarald Freudenberger 332e80d4af0SHarald Freudenberger /* copy the generated secure key token */ 333e80d4af0SHarald Freudenberger memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 334e80d4af0SHarald Freudenberger 335e80d4af0SHarald Freudenberger out: 336e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 0); 337e80d4af0SHarald Freudenberger return rc; 338e80d4af0SHarald Freudenberger } 339e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_genseckey); 340e80d4af0SHarald Freudenberger 341e80d4af0SHarald Freudenberger /* 342e80d4af0SHarald Freudenberger * Generate an AES secure key with given key value. 343e80d4af0SHarald Freudenberger */ 344e80d4af0SHarald Freudenberger int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype, 345e80d4af0SHarald Freudenberger const struct pkey_clrkey *clrkey, 346e80d4af0SHarald Freudenberger struct pkey_seckey *seckey) 347e80d4af0SHarald Freudenberger { 348e80d4af0SHarald Freudenberger int rc, keysize, seckeysize; 349e80d4af0SHarald Freudenberger u8 *mem; 350e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 351e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 352e80d4af0SHarald Freudenberger struct cmreqparm { 353e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 354e80d4af0SHarald Freudenberger u16 rule_array_len; 355e80d4af0SHarald Freudenberger char rule_array[8]; 356e80d4af0SHarald Freudenberger struct lv1 { 357e80d4af0SHarald Freudenberger u16 len; 358e80d4af0SHarald Freudenberger u8 clrkey[0]; 359e80d4af0SHarald Freudenberger } lv1; 360e80d4af0SHarald Freudenberger struct lv2 { 361e80d4af0SHarald Freudenberger u16 len; 362e80d4af0SHarald Freudenberger struct keyid { 363e80d4af0SHarald Freudenberger u16 len; 364e80d4af0SHarald Freudenberger u16 attr; 365e80d4af0SHarald Freudenberger u8 data[SECKEYBLOBSIZE]; 366e80d4af0SHarald Freudenberger } keyid; 367e80d4af0SHarald Freudenberger } lv2; 368e80d4af0SHarald Freudenberger } *preqparm; 369e80d4af0SHarald Freudenberger struct lv2 *plv2; 370e80d4af0SHarald Freudenberger struct cmrepparm { 371e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 372e80d4af0SHarald Freudenberger u16 rule_array_len; 373e80d4af0SHarald Freudenberger struct lv3 { 374e80d4af0SHarald Freudenberger u16 len; 375e80d4af0SHarald Freudenberger u16 keyblocklen; 376e80d4af0SHarald Freudenberger struct { 377e80d4af0SHarald Freudenberger u16 toklen; 378e80d4af0SHarald Freudenberger u16 tokattr; 379e80d4af0SHarald Freudenberger u8 tok[0]; 380e80d4af0SHarald Freudenberger /* ... some more data ... */ 381e80d4af0SHarald Freudenberger } keyblock; 382e80d4af0SHarald Freudenberger } lv3; 383e80d4af0SHarald Freudenberger } *prepparm; 384e80d4af0SHarald Freudenberger 385e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 386e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 387e80d4af0SHarald Freudenberger if (rc) 388e80d4af0SHarald Freudenberger return rc; 389e80d4af0SHarald Freudenberger 390e80d4af0SHarald Freudenberger /* fill request cprb struct */ 391e80d4af0SHarald Freudenberger preqcblk->domain = domain; 392e80d4af0SHarald Freudenberger 393e80d4af0SHarald Freudenberger /* fill request cprb param block with CM request */ 394e80d4af0SHarald Freudenberger preqparm = (struct cmreqparm *) preqcblk->req_parmb; 395e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "CM", 2); 396e80d4af0SHarald Freudenberger memcpy(preqparm->rule_array, "AES ", 8); 397e80d4af0SHarald Freudenberger preqparm->rule_array_len = 398e80d4af0SHarald Freudenberger sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 399e80d4af0SHarald Freudenberger switch (keytype) { 400e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 401e80d4af0SHarald Freudenberger keysize = 16; 402e80d4af0SHarald Freudenberger break; 403e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 404e80d4af0SHarald Freudenberger keysize = 24; 405e80d4af0SHarald Freudenberger break; 406e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 407e80d4af0SHarald Freudenberger keysize = 32; 408e80d4af0SHarald Freudenberger break; 409e80d4af0SHarald Freudenberger default: 410e80d4af0SHarald Freudenberger DEBUG_ERR( 411*ac2b96f3SHarald Freudenberger "%s unknown/unsupported keytype %d\n", 412*ac2b96f3SHarald Freudenberger __func__, keytype); 413e80d4af0SHarald Freudenberger rc = -EINVAL; 414e80d4af0SHarald Freudenberger goto out; 415e80d4af0SHarald Freudenberger } 416e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1) + keysize; 417e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize); 418e80d4af0SHarald Freudenberger plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize); 419e80d4af0SHarald Freudenberger plv2->len = sizeof(struct lv2); 420e80d4af0SHarald Freudenberger plv2->keyid.len = sizeof(struct keyid); 421e80d4af0SHarald Freudenberger plv2->keyid.attr = 0x30; 422e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct cmreqparm) + keysize; 423e80d4af0SHarald Freudenberger 424e80d4af0SHarald Freudenberger /* fill xcrb struct */ 425e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 426e80d4af0SHarald Freudenberger 427e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 428e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 429e80d4af0SHarald Freudenberger if (rc) { 430e80d4af0SHarald Freudenberger DEBUG_ERR( 431*ac2b96f3SHarald Freudenberger "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 432*ac2b96f3SHarald Freudenberger __func__, (int) cardnr, (int) domain, rc); 433e80d4af0SHarald Freudenberger goto out; 434e80d4af0SHarald Freudenberger } 435e80d4af0SHarald Freudenberger 436e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 437e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 438e80d4af0SHarald Freudenberger DEBUG_ERR( 439*ac2b96f3SHarald Freudenberger "%s clear key import failure, card response %d/%d\n", 440*ac2b96f3SHarald Freudenberger __func__, 441e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 442e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 443e80d4af0SHarald Freudenberger rc = -EIO; 444e80d4af0SHarald Freudenberger goto out; 445e80d4af0SHarald Freudenberger } 446e80d4af0SHarald Freudenberger 447e80d4af0SHarald Freudenberger /* process response cprb param block */ 448e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 449e80d4af0SHarald Freudenberger prepparm = (struct cmrepparm *) prepcblk->rpl_parmb; 450e80d4af0SHarald Freudenberger 451e80d4af0SHarald Freudenberger /* check length of the returned secure key token */ 452e80d4af0SHarald Freudenberger seckeysize = prepparm->lv3.keyblock.toklen 453e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.toklen) 454e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.tokattr); 455e80d4af0SHarald Freudenberger if (seckeysize != SECKEYBLOBSIZE) { 456e80d4af0SHarald Freudenberger DEBUG_ERR( 457*ac2b96f3SHarald Freudenberger "%s secure token size mismatch %d != %d bytes\n", 458*ac2b96f3SHarald Freudenberger __func__, seckeysize, SECKEYBLOBSIZE); 459e80d4af0SHarald Freudenberger rc = -EIO; 460e80d4af0SHarald Freudenberger goto out; 461e80d4af0SHarald Freudenberger } 462e80d4af0SHarald Freudenberger 463e80d4af0SHarald Freudenberger /* check secure key token */ 464e80d4af0SHarald Freudenberger rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize); 465e80d4af0SHarald Freudenberger if (rc) { 466e80d4af0SHarald Freudenberger rc = -EIO; 467e80d4af0SHarald Freudenberger goto out; 468e80d4af0SHarald Freudenberger } 469e80d4af0SHarald Freudenberger 470e80d4af0SHarald Freudenberger /* copy the generated secure key token */ 471e80d4af0SHarald Freudenberger memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 472e80d4af0SHarald Freudenberger 473e80d4af0SHarald Freudenberger out: 474e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 1); 475e80d4af0SHarald Freudenberger return rc; 476e80d4af0SHarald Freudenberger } 477e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_clr2seckey); 478e80d4af0SHarald Freudenberger 479e80d4af0SHarald Freudenberger /* 480e80d4af0SHarald Freudenberger * Derive a proteced key from the secure key blob. 481e80d4af0SHarald Freudenberger */ 482e80d4af0SHarald Freudenberger int pkey_sec2protkey(u16 cardnr, u16 domain, 483e80d4af0SHarald Freudenberger const struct pkey_seckey *seckey, 484e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 485e80d4af0SHarald Freudenberger { 486e80d4af0SHarald Freudenberger int rc; 487e80d4af0SHarald Freudenberger u8 *mem; 488e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 489e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 490e80d4af0SHarald Freudenberger struct uskreqparm { 491e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 492e80d4af0SHarald Freudenberger u16 rule_array_len; 493e80d4af0SHarald Freudenberger struct lv1 { 494e80d4af0SHarald Freudenberger u16 len; 495e80d4af0SHarald Freudenberger u16 attr_len; 496e80d4af0SHarald Freudenberger u16 attr_flags; 497e80d4af0SHarald Freudenberger } lv1; 498e80d4af0SHarald Freudenberger struct lv2 { 499e80d4af0SHarald Freudenberger u16 len; 500e80d4af0SHarald Freudenberger u16 attr_len; 501e80d4af0SHarald Freudenberger u16 attr_flags; 502e80d4af0SHarald Freudenberger u8 token[0]; /* cca secure key token */ 503e80d4af0SHarald Freudenberger } lv2 __packed; 504e80d4af0SHarald Freudenberger } *preqparm; 505e80d4af0SHarald Freudenberger struct uskrepparm { 506e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 507e80d4af0SHarald Freudenberger u16 rule_array_len; 508e80d4af0SHarald Freudenberger struct lv3 { 509e80d4af0SHarald Freudenberger u16 len; 510e80d4af0SHarald Freudenberger u16 attr_len; 511e80d4af0SHarald Freudenberger u16 attr_flags; 512e80d4af0SHarald Freudenberger struct cpacfkeyblock { 513e80d4af0SHarald Freudenberger u8 version; /* version of this struct */ 514e80d4af0SHarald Freudenberger u8 flags[2]; 515e80d4af0SHarald Freudenberger u8 algo; 516e80d4af0SHarald Freudenberger u8 form; 517e80d4af0SHarald Freudenberger u8 pad1[3]; 518e80d4af0SHarald Freudenberger u16 keylen; 519e80d4af0SHarald Freudenberger u8 key[64]; /* the key (keylen bytes) */ 520e80d4af0SHarald Freudenberger u16 keyattrlen; 521e80d4af0SHarald Freudenberger u8 keyattr[32]; 522e80d4af0SHarald Freudenberger u8 pad2[1]; 523e80d4af0SHarald Freudenberger u8 vptype; 524e80d4af0SHarald Freudenberger u8 vp[32]; /* verification pattern */ 525e80d4af0SHarald Freudenberger } keyblock; 526e80d4af0SHarald Freudenberger } lv3 __packed; 527e80d4af0SHarald Freudenberger } *prepparm; 528e80d4af0SHarald Freudenberger 529e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 530e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 531e80d4af0SHarald Freudenberger if (rc) 532e80d4af0SHarald Freudenberger return rc; 533e80d4af0SHarald Freudenberger 534e80d4af0SHarald Freudenberger /* fill request cprb struct */ 535e80d4af0SHarald Freudenberger preqcblk->domain = domain; 536e80d4af0SHarald Freudenberger 537e80d4af0SHarald Freudenberger /* fill request cprb param block with USK request */ 538e80d4af0SHarald Freudenberger preqparm = (struct uskreqparm *) preqcblk->req_parmb; 539e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "US", 2); 540e80d4af0SHarald Freudenberger preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 541e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1); 542e80d4af0SHarald Freudenberger preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len); 543e80d4af0SHarald Freudenberger preqparm->lv1.attr_flags = 0x0001; 544e80d4af0SHarald Freudenberger preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE; 545e80d4af0SHarald Freudenberger preqparm->lv2.attr_len = sizeof(struct lv2) 546e80d4af0SHarald Freudenberger - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE; 547e80d4af0SHarald Freudenberger preqparm->lv2.attr_flags = 0x0000; 548e80d4af0SHarald Freudenberger memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE); 549e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE; 550e80d4af0SHarald Freudenberger 551e80d4af0SHarald Freudenberger /* fill xcrb struct */ 552e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 553e80d4af0SHarald Freudenberger 554e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 555e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 556e80d4af0SHarald Freudenberger if (rc) { 557e80d4af0SHarald Freudenberger DEBUG_ERR( 558*ac2b96f3SHarald Freudenberger "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 559*ac2b96f3SHarald Freudenberger __func__, (int) cardnr, (int) domain, rc); 560e80d4af0SHarald Freudenberger goto out; 561e80d4af0SHarald Freudenberger } 562e80d4af0SHarald Freudenberger 563e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 564e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 565e80d4af0SHarald Freudenberger DEBUG_ERR( 566*ac2b96f3SHarald Freudenberger "%s unwrap secure key failure, card response %d/%d\n", 567*ac2b96f3SHarald Freudenberger __func__, 568e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 569e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 570e80d4af0SHarald Freudenberger rc = -EIO; 571e80d4af0SHarald Freudenberger goto out; 572e80d4af0SHarald Freudenberger } 573ca681ec8SHarald Freudenberger if (prepcblk->ccp_rscode != 0) { 574ca681ec8SHarald Freudenberger DEBUG_WARN( 575*ac2b96f3SHarald Freudenberger "%s unwrap secure key warning, card response %d/%d\n", 576*ac2b96f3SHarald Freudenberger __func__, 577ca681ec8SHarald Freudenberger (int) prepcblk->ccp_rtcode, 578ca681ec8SHarald Freudenberger (int) prepcblk->ccp_rscode); 579ca681ec8SHarald Freudenberger } 580e80d4af0SHarald Freudenberger 581e80d4af0SHarald Freudenberger /* process response cprb param block */ 582e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 583e80d4af0SHarald Freudenberger prepparm = (struct uskrepparm *) prepcblk->rpl_parmb; 584e80d4af0SHarald Freudenberger 585e80d4af0SHarald Freudenberger /* check the returned keyblock */ 586e80d4af0SHarald Freudenberger if (prepparm->lv3.keyblock.version != 0x01) { 587e80d4af0SHarald Freudenberger DEBUG_ERR( 588*ac2b96f3SHarald Freudenberger "%s reply param keyblock version mismatch 0x%02x != 0x01\n", 589*ac2b96f3SHarald Freudenberger __func__, (int) prepparm->lv3.keyblock.version); 590e80d4af0SHarald Freudenberger rc = -EIO; 591e80d4af0SHarald Freudenberger goto out; 592e80d4af0SHarald Freudenberger } 593e80d4af0SHarald Freudenberger 594e80d4af0SHarald Freudenberger /* copy the tanslated protected key */ 595e80d4af0SHarald Freudenberger switch (prepparm->lv3.keyblock.keylen) { 596e80d4af0SHarald Freudenberger case 16+32: 597e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_128; 598e80d4af0SHarald Freudenberger break; 599e80d4af0SHarald Freudenberger case 24+32: 600e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_192; 601e80d4af0SHarald Freudenberger break; 602e80d4af0SHarald Freudenberger case 32+32: 603e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_256; 604e80d4af0SHarald Freudenberger break; 605e80d4af0SHarald Freudenberger default: 606*ac2b96f3SHarald Freudenberger DEBUG_ERR("%s unknown/unsupported keytype %d\n", 607*ac2b96f3SHarald Freudenberger __func__, prepparm->lv3.keyblock.keylen); 608e80d4af0SHarald Freudenberger rc = -EIO; 609e80d4af0SHarald Freudenberger goto out; 610e80d4af0SHarald Freudenberger } 611e80d4af0SHarald Freudenberger protkey->len = prepparm->lv3.keyblock.keylen; 612e80d4af0SHarald Freudenberger memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len); 613e80d4af0SHarald Freudenberger 614e80d4af0SHarald Freudenberger out: 615e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 0); 616e80d4af0SHarald Freudenberger return rc; 617e80d4af0SHarald Freudenberger } 618e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_sec2protkey); 619e80d4af0SHarald Freudenberger 620e80d4af0SHarald Freudenberger /* 621e80d4af0SHarald Freudenberger * Create a protected key from a clear key value. 622e80d4af0SHarald Freudenberger */ 623e80d4af0SHarald Freudenberger int pkey_clr2protkey(u32 keytype, 624e80d4af0SHarald Freudenberger const struct pkey_clrkey *clrkey, 625e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 626e80d4af0SHarald Freudenberger { 627e80d4af0SHarald Freudenberger long fc; 628e80d4af0SHarald Freudenberger int keysize; 629e80d4af0SHarald Freudenberger u8 paramblock[64]; 630e80d4af0SHarald Freudenberger 631e80d4af0SHarald Freudenberger switch (keytype) { 632e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 633e80d4af0SHarald Freudenberger keysize = 16; 634e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_128_KEY; 635e80d4af0SHarald Freudenberger break; 636e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 637e80d4af0SHarald Freudenberger keysize = 24; 638e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_192_KEY; 639e80d4af0SHarald Freudenberger break; 640e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 641e80d4af0SHarald Freudenberger keysize = 32; 642e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_256_KEY; 643e80d4af0SHarald Freudenberger break; 644e80d4af0SHarald Freudenberger default: 645*ac2b96f3SHarald Freudenberger DEBUG_ERR("%s unknown/unsupported keytype %d\n", 646*ac2b96f3SHarald Freudenberger __func__, keytype); 647e80d4af0SHarald Freudenberger return -EINVAL; 648e80d4af0SHarald Freudenberger } 649e80d4af0SHarald Freudenberger 650e80d4af0SHarald Freudenberger /* prepare param block */ 651e80d4af0SHarald Freudenberger memset(paramblock, 0, sizeof(paramblock)); 652e80d4af0SHarald Freudenberger memcpy(paramblock, clrkey->clrkey, keysize); 653e80d4af0SHarald Freudenberger 654e80d4af0SHarald Freudenberger /* call the pckmo instruction */ 655e80d4af0SHarald Freudenberger cpacf_pckmo(fc, paramblock); 656e80d4af0SHarald Freudenberger 657e80d4af0SHarald Freudenberger /* copy created protected key */ 658e80d4af0SHarald Freudenberger protkey->type = keytype; 659e80d4af0SHarald Freudenberger protkey->len = keysize + 32; 660e80d4af0SHarald Freudenberger memcpy(protkey->protkey, paramblock, keysize + 32); 661e80d4af0SHarald Freudenberger 662e80d4af0SHarald Freudenberger return 0; 663e80d4af0SHarald Freudenberger } 664e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_clr2protkey); 665e80d4af0SHarald Freudenberger 666e80d4af0SHarald Freudenberger /* 667e80d4af0SHarald Freudenberger * query cryptographic facility from adapter 668e80d4af0SHarald Freudenberger */ 669e80d4af0SHarald Freudenberger static int query_crypto_facility(u16 cardnr, u16 domain, 670e80d4af0SHarald Freudenberger const char *keyword, 671e80d4af0SHarald Freudenberger u8 *rarray, size_t *rarraylen, 672e80d4af0SHarald Freudenberger u8 *varray, size_t *varraylen) 673e80d4af0SHarald Freudenberger { 674e80d4af0SHarald Freudenberger int rc; 675e80d4af0SHarald Freudenberger u16 len; 676e80d4af0SHarald Freudenberger u8 *mem, *ptr; 677e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 678e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 679e80d4af0SHarald Freudenberger struct fqreqparm { 680e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 681e80d4af0SHarald Freudenberger u16 rule_array_len; 682e80d4af0SHarald Freudenberger char rule_array[8]; 683e80d4af0SHarald Freudenberger struct lv1 { 684e80d4af0SHarald Freudenberger u16 len; 685e80d4af0SHarald Freudenberger u8 data[VARDATASIZE]; 686e80d4af0SHarald Freudenberger } lv1; 687e80d4af0SHarald Freudenberger u16 dummylen; 688e80d4af0SHarald Freudenberger } *preqparm; 689e80d4af0SHarald Freudenberger size_t parmbsize = sizeof(struct fqreqparm); 690e80d4af0SHarald Freudenberger struct fqrepparm { 691e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 692e80d4af0SHarald Freudenberger u8 lvdata[0]; 693e80d4af0SHarald Freudenberger } *prepparm; 694e80d4af0SHarald Freudenberger 695e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 696e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk); 697e80d4af0SHarald Freudenberger if (rc) 698e80d4af0SHarald Freudenberger return rc; 699e80d4af0SHarald Freudenberger 700e80d4af0SHarald Freudenberger /* fill request cprb struct */ 701e80d4af0SHarald Freudenberger preqcblk->domain = domain; 702e80d4af0SHarald Freudenberger 703e80d4af0SHarald Freudenberger /* fill request cprb param block with FQ request */ 704e80d4af0SHarald Freudenberger preqparm = (struct fqreqparm *) preqcblk->req_parmb; 705e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "FQ", 2); 706a09baa95SVasily Gorbik memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array)); 707e80d4af0SHarald Freudenberger preqparm->rule_array_len = 708e80d4af0SHarald Freudenberger sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 709e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(preqparm->lv1); 710e80d4af0SHarald Freudenberger preqparm->dummylen = sizeof(preqparm->dummylen); 711e80d4af0SHarald Freudenberger preqcblk->req_parml = parmbsize; 712e80d4af0SHarald Freudenberger 713e80d4af0SHarald Freudenberger /* fill xcrb struct */ 714e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 715e80d4af0SHarald Freudenberger 716e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 717e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 718e80d4af0SHarald Freudenberger if (rc) { 719e80d4af0SHarald Freudenberger DEBUG_ERR( 720*ac2b96f3SHarald Freudenberger "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 721*ac2b96f3SHarald Freudenberger __func__, (int) cardnr, (int) domain, rc); 722e80d4af0SHarald Freudenberger goto out; 723e80d4af0SHarald Freudenberger } 724e80d4af0SHarald Freudenberger 725e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 726e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 727e80d4af0SHarald Freudenberger DEBUG_ERR( 728*ac2b96f3SHarald Freudenberger "%s unwrap secure key failure, card response %d/%d\n", 729*ac2b96f3SHarald Freudenberger __func__, 730e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 731e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 732e80d4af0SHarald Freudenberger rc = -EIO; 733e80d4af0SHarald Freudenberger goto out; 734e80d4af0SHarald Freudenberger } 735e80d4af0SHarald Freudenberger 736e80d4af0SHarald Freudenberger /* process response cprb param block */ 737e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 738e80d4af0SHarald Freudenberger prepparm = (struct fqrepparm *) prepcblk->rpl_parmb; 739e80d4af0SHarald Freudenberger ptr = prepparm->lvdata; 740e80d4af0SHarald Freudenberger 741e80d4af0SHarald Freudenberger /* check and possibly copy reply rule array */ 742e80d4af0SHarald Freudenberger len = *((u16 *) ptr); 743e80d4af0SHarald Freudenberger if (len > sizeof(u16)) { 744e80d4af0SHarald Freudenberger ptr += sizeof(u16); 745e80d4af0SHarald Freudenberger len -= sizeof(u16); 746e80d4af0SHarald Freudenberger if (rarray && rarraylen && *rarraylen > 0) { 747e80d4af0SHarald Freudenberger *rarraylen = (len > *rarraylen ? *rarraylen : len); 748e80d4af0SHarald Freudenberger memcpy(rarray, ptr, *rarraylen); 749e80d4af0SHarald Freudenberger } 750e80d4af0SHarald Freudenberger ptr += len; 751e80d4af0SHarald Freudenberger } 752e80d4af0SHarald Freudenberger /* check and possible copy reply var array */ 753e80d4af0SHarald Freudenberger len = *((u16 *) ptr); 754e80d4af0SHarald Freudenberger if (len > sizeof(u16)) { 755e80d4af0SHarald Freudenberger ptr += sizeof(u16); 756e80d4af0SHarald Freudenberger len -= sizeof(u16); 757e80d4af0SHarald Freudenberger if (varray && varraylen && *varraylen > 0) { 758e80d4af0SHarald Freudenberger *varraylen = (len > *varraylen ? *varraylen : len); 759e80d4af0SHarald Freudenberger memcpy(varray, ptr, *varraylen); 760e80d4af0SHarald Freudenberger } 761e80d4af0SHarald Freudenberger ptr += len; 762e80d4af0SHarald Freudenberger } 763e80d4af0SHarald Freudenberger 764e80d4af0SHarald Freudenberger out: 765e80d4af0SHarald Freudenberger free_cprbmem(mem, parmbsize, 0); 766e80d4af0SHarald Freudenberger return rc; 767e80d4af0SHarald Freudenberger } 768e80d4af0SHarald Freudenberger 769e80d4af0SHarald Freudenberger /* 770ca681ec8SHarald Freudenberger * Fetch the current and old mkvp values via 771ca681ec8SHarald Freudenberger * query_crypto_facility from adapter. 772e80d4af0SHarald Freudenberger */ 773ca681ec8SHarald Freudenberger static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2]) 774e80d4af0SHarald Freudenberger { 775e80d4af0SHarald Freudenberger int rc, found = 0; 776e80d4af0SHarald Freudenberger size_t rlen, vlen; 777e80d4af0SHarald Freudenberger u8 *rarray, *varray, *pg; 778e80d4af0SHarald Freudenberger 779e80d4af0SHarald Freudenberger pg = (u8 *) __get_free_page(GFP_KERNEL); 780e80d4af0SHarald Freudenberger if (!pg) 781e80d4af0SHarald Freudenberger return -ENOMEM; 782e80d4af0SHarald Freudenberger rarray = pg; 783e80d4af0SHarald Freudenberger varray = pg + PAGE_SIZE/2; 784e80d4af0SHarald Freudenberger rlen = vlen = PAGE_SIZE/2; 785e80d4af0SHarald Freudenberger 786e80d4af0SHarald Freudenberger rc = query_crypto_facility(cardnr, domain, "STATICSA", 787e80d4af0SHarald Freudenberger rarray, &rlen, varray, &vlen); 788e80d4af0SHarald Freudenberger if (rc == 0 && rlen > 8*8 && vlen > 184+8) { 789ca681ec8SHarald Freudenberger if (rarray[8*8] == '2') { 790e80d4af0SHarald Freudenberger /* current master key state is valid */ 791ca681ec8SHarald Freudenberger mkvp[0] = *((u64 *)(varray + 184)); 792ca681ec8SHarald Freudenberger mkvp[1] = *((u64 *)(varray + 172)); 793e80d4af0SHarald Freudenberger found = 1; 794e80d4af0SHarald Freudenberger } 795e80d4af0SHarald Freudenberger } 796e80d4af0SHarald Freudenberger 797e80d4af0SHarald Freudenberger free_page((unsigned long) pg); 798e80d4af0SHarald Freudenberger 799e80d4af0SHarald Freudenberger return found ? 0 : -ENOENT; 800e80d4af0SHarald Freudenberger } 801e80d4af0SHarald Freudenberger 802e80d4af0SHarald Freudenberger /* struct to hold cached mkvp info for each card/domain */ 803e80d4af0SHarald Freudenberger struct mkvp_info { 804e80d4af0SHarald Freudenberger struct list_head list; 805e80d4af0SHarald Freudenberger u16 cardnr; 806e80d4af0SHarald Freudenberger u16 domain; 807ca681ec8SHarald Freudenberger u64 mkvp[2]; 808e80d4af0SHarald Freudenberger }; 809e80d4af0SHarald Freudenberger 810e80d4af0SHarald Freudenberger /* a list with mkvp_info entries */ 811e80d4af0SHarald Freudenberger static LIST_HEAD(mkvp_list); 812e80d4af0SHarald Freudenberger static DEFINE_SPINLOCK(mkvp_list_lock); 813e80d4af0SHarald Freudenberger 814ca681ec8SHarald Freudenberger static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2]) 815e80d4af0SHarald Freudenberger { 816e80d4af0SHarald Freudenberger int rc = -ENOENT; 817e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 818e80d4af0SHarald Freudenberger 819e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 820e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 821e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 822e80d4af0SHarald Freudenberger ptr->domain == domain) { 823ca681ec8SHarald Freudenberger memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64)); 824e80d4af0SHarald Freudenberger rc = 0; 825e80d4af0SHarald Freudenberger break; 826e80d4af0SHarald Freudenberger } 827e80d4af0SHarald Freudenberger } 828e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 829e80d4af0SHarald Freudenberger 830e80d4af0SHarald Freudenberger return rc; 831e80d4af0SHarald Freudenberger } 832e80d4af0SHarald Freudenberger 833ca681ec8SHarald Freudenberger static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2]) 834e80d4af0SHarald Freudenberger { 835e80d4af0SHarald Freudenberger int found = 0; 836e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 837e80d4af0SHarald Freudenberger 838e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 839e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 840e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 841e80d4af0SHarald Freudenberger ptr->domain == domain) { 842ca681ec8SHarald Freudenberger memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64)); 843e80d4af0SHarald Freudenberger found = 1; 844e80d4af0SHarald Freudenberger break; 845e80d4af0SHarald Freudenberger } 846e80d4af0SHarald Freudenberger } 847e80d4af0SHarald Freudenberger if (!found) { 848e80d4af0SHarald Freudenberger ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC); 849e80d4af0SHarald Freudenberger if (!ptr) { 850e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 851e80d4af0SHarald Freudenberger return; 852e80d4af0SHarald Freudenberger } 853e80d4af0SHarald Freudenberger ptr->cardnr = cardnr; 854e80d4af0SHarald Freudenberger ptr->domain = domain; 855ca681ec8SHarald Freudenberger memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64)); 856e80d4af0SHarald Freudenberger list_add(&ptr->list, &mkvp_list); 857e80d4af0SHarald Freudenberger } 858e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 859e80d4af0SHarald Freudenberger } 860e80d4af0SHarald Freudenberger 861e80d4af0SHarald Freudenberger static void mkvp_cache_scrub(u16 cardnr, u16 domain) 862e80d4af0SHarald Freudenberger { 863e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 864e80d4af0SHarald Freudenberger 865e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 866e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 867e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 868e80d4af0SHarald Freudenberger ptr->domain == domain) { 869e80d4af0SHarald Freudenberger list_del(&ptr->list); 870e80d4af0SHarald Freudenberger kfree(ptr); 871e80d4af0SHarald Freudenberger break; 872e80d4af0SHarald Freudenberger } 873e80d4af0SHarald Freudenberger } 874e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 875e80d4af0SHarald Freudenberger } 876e80d4af0SHarald Freudenberger 877e80d4af0SHarald Freudenberger static void __exit mkvp_cache_free(void) 878e80d4af0SHarald Freudenberger { 879e80d4af0SHarald Freudenberger struct mkvp_info *ptr, *pnext; 880e80d4af0SHarald Freudenberger 881e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 882e80d4af0SHarald Freudenberger list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) { 883e80d4af0SHarald Freudenberger list_del(&ptr->list); 884e80d4af0SHarald Freudenberger kfree(ptr); 885e80d4af0SHarald Freudenberger } 886e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 887e80d4af0SHarald Freudenberger } 888e80d4af0SHarald Freudenberger 889e80d4af0SHarald Freudenberger /* 890e80d4af0SHarald Freudenberger * Search for a matching crypto card based on the Master Key 891e80d4af0SHarald Freudenberger * Verification Pattern provided inside a secure key. 892e80d4af0SHarald Freudenberger */ 893e80d4af0SHarald Freudenberger int pkey_findcard(const struct pkey_seckey *seckey, 894e80d4af0SHarald Freudenberger u16 *pcardnr, u16 *pdomain, int verify) 895e80d4af0SHarald Freudenberger { 896e80d4af0SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) seckey; 897af4a7227SHarald Freudenberger struct zcrypt_device_status_ext *device_status; 898e80d4af0SHarald Freudenberger u16 card, dom; 899ca681ec8SHarald Freudenberger u64 mkvp[2]; 900ca681ec8SHarald Freudenberger int i, rc, oi = -1; 901e80d4af0SHarald Freudenberger 902e80d4af0SHarald Freudenberger /* mkvp must not be zero */ 903e80d4af0SHarald Freudenberger if (t->mkvp == 0) 904e80d4af0SHarald Freudenberger return -EINVAL; 905e80d4af0SHarald Freudenberger 906e80d4af0SHarald Freudenberger /* fetch status of all crypto cards */ 9076da2ec56SKees Cook device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT, 9086da2ec56SKees Cook sizeof(struct zcrypt_device_status_ext), 909e80d4af0SHarald Freudenberger GFP_KERNEL); 910af4a7227SHarald Freudenberger if (!device_status) 911e80d4af0SHarald Freudenberger return -ENOMEM; 912af4a7227SHarald Freudenberger zcrypt_device_status_mask_ext(device_status); 913e80d4af0SHarald Freudenberger 914e80d4af0SHarald Freudenberger /* walk through all crypto cards */ 915af4a7227SHarald Freudenberger for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) { 916af4a7227SHarald Freudenberger card = AP_QID_CARD(device_status[i].qid); 917af4a7227SHarald Freudenberger dom = AP_QID_QUEUE(device_status[i].qid); 918af4a7227SHarald Freudenberger if (device_status[i].online && 919af4a7227SHarald Freudenberger device_status[i].functions & 0x04) { 920e80d4af0SHarald Freudenberger /* an enabled CCA Coprocessor card */ 921e80d4af0SHarald Freudenberger /* try cached mkvp */ 922ca681ec8SHarald Freudenberger if (mkvp_cache_fetch(card, dom, mkvp) == 0 && 923ca681ec8SHarald Freudenberger t->mkvp == mkvp[0]) { 924e80d4af0SHarald Freudenberger if (!verify) 925e80d4af0SHarald Freudenberger break; 926e80d4af0SHarald Freudenberger /* verify: fetch mkvp from adapter */ 927ca681ec8SHarald Freudenberger if (fetch_mkvp(card, dom, mkvp) == 0) { 928e80d4af0SHarald Freudenberger mkvp_cache_update(card, dom, mkvp); 929ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[0]) 930e80d4af0SHarald Freudenberger break; 931e80d4af0SHarald Freudenberger } 932e80d4af0SHarald Freudenberger } 933e80d4af0SHarald Freudenberger } else { 934e80d4af0SHarald Freudenberger /* Card is offline and/or not a CCA card. */ 935e80d4af0SHarald Freudenberger /* del mkvp entry from cache if it exists */ 936e80d4af0SHarald Freudenberger mkvp_cache_scrub(card, dom); 937e80d4af0SHarald Freudenberger } 938e80d4af0SHarald Freudenberger } 939af4a7227SHarald Freudenberger if (i >= MAX_ZDEV_ENTRIES_EXT) { 940e80d4af0SHarald Freudenberger /* nothing found, so this time without cache */ 941af4a7227SHarald Freudenberger for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) { 942af4a7227SHarald Freudenberger if (!(device_status[i].online && 943af4a7227SHarald Freudenberger device_status[i].functions & 0x04)) 944e80d4af0SHarald Freudenberger continue; 945af4a7227SHarald Freudenberger card = AP_QID_CARD(device_status[i].qid); 946af4a7227SHarald Freudenberger dom = AP_QID_QUEUE(device_status[i].qid); 947e80d4af0SHarald Freudenberger /* fresh fetch mkvp from adapter */ 948ca681ec8SHarald Freudenberger if (fetch_mkvp(card, dom, mkvp) == 0) { 949e80d4af0SHarald Freudenberger mkvp_cache_update(card, dom, mkvp); 950ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[0]) 951e80d4af0SHarald Freudenberger break; 952ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[1] && oi < 0) 953ca681ec8SHarald Freudenberger oi = i; 954e80d4af0SHarald Freudenberger } 955e80d4af0SHarald Freudenberger } 956af4a7227SHarald Freudenberger if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) { 957ca681ec8SHarald Freudenberger /* old mkvp matched, use this card then */ 958af4a7227SHarald Freudenberger card = AP_QID_CARD(device_status[oi].qid); 959af4a7227SHarald Freudenberger dom = AP_QID_QUEUE(device_status[oi].qid); 960e80d4af0SHarald Freudenberger } 961ca681ec8SHarald Freudenberger } 962af4a7227SHarald Freudenberger if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) { 963e80d4af0SHarald Freudenberger if (pcardnr) 964e80d4af0SHarald Freudenberger *pcardnr = card; 965e80d4af0SHarald Freudenberger if (pdomain) 966e80d4af0SHarald Freudenberger *pdomain = dom; 967e80d4af0SHarald Freudenberger rc = 0; 968e80d4af0SHarald Freudenberger } else 969e80d4af0SHarald Freudenberger rc = -ENODEV; 970e80d4af0SHarald Freudenberger 971af4a7227SHarald Freudenberger kfree(device_status); 972e80d4af0SHarald Freudenberger return rc; 973e80d4af0SHarald Freudenberger } 974e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_findcard); 975e80d4af0SHarald Freudenberger 976e80d4af0SHarald Freudenberger /* 977e80d4af0SHarald Freudenberger * Find card and transform secure key into protected key. 978e80d4af0SHarald Freudenberger */ 979e80d4af0SHarald Freudenberger int pkey_skey2pkey(const struct pkey_seckey *seckey, 980e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 981e80d4af0SHarald Freudenberger { 982e80d4af0SHarald Freudenberger u16 cardnr, domain; 983e80d4af0SHarald Freudenberger int rc, verify; 984e80d4af0SHarald Freudenberger 985e80d4af0SHarald Freudenberger /* 986e80d4af0SHarald Freudenberger * The pkey_sec2protkey call may fail when a card has been 987e80d4af0SHarald Freudenberger * addressed where the master key was changed after last fetch 988e80d4af0SHarald Freudenberger * of the mkvp into the cache. So first try without verify then 989e80d4af0SHarald Freudenberger * with verify enabled (thus refreshing the mkvp for each card). 990e80d4af0SHarald Freudenberger */ 991e80d4af0SHarald Freudenberger for (verify = 0; verify < 2; verify++) { 992e80d4af0SHarald Freudenberger rc = pkey_findcard(seckey, &cardnr, &domain, verify); 993e80d4af0SHarald Freudenberger if (rc) 994e80d4af0SHarald Freudenberger continue; 995e80d4af0SHarald Freudenberger rc = pkey_sec2protkey(cardnr, domain, seckey, protkey); 996e80d4af0SHarald Freudenberger if (rc == 0) 997e80d4af0SHarald Freudenberger break; 998e80d4af0SHarald Freudenberger } 999e80d4af0SHarald Freudenberger 1000e80d4af0SHarald Freudenberger if (rc) 1001*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s failed rc=%d\n", __func__, rc); 1002e80d4af0SHarald Freudenberger 1003e80d4af0SHarald Freudenberger return rc; 1004e80d4af0SHarald Freudenberger } 1005e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_skey2pkey); 1006e80d4af0SHarald Freudenberger 1007e80d4af0SHarald Freudenberger /* 1008e61a6134SHarald Freudenberger * Verify key and give back some info about the key. 1009e61a6134SHarald Freudenberger */ 1010e61a6134SHarald Freudenberger int pkey_verifykey(const struct pkey_seckey *seckey, 1011e61a6134SHarald Freudenberger u16 *pcardnr, u16 *pdomain, 1012e61a6134SHarald Freudenberger u16 *pkeysize, u32 *pattributes) 1013e61a6134SHarald Freudenberger { 1014e61a6134SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) seckey; 1015e61a6134SHarald Freudenberger u16 cardnr, domain; 1016e61a6134SHarald Freudenberger u64 mkvp[2]; 1017e61a6134SHarald Freudenberger int rc; 1018e61a6134SHarald Freudenberger 1019e61a6134SHarald Freudenberger /* check the secure key for valid AES secure key */ 1020e61a6134SHarald Freudenberger rc = check_secaeskeytoken((u8 *) seckey, 0); 1021e61a6134SHarald Freudenberger if (rc) 1022e61a6134SHarald Freudenberger goto out; 1023e61a6134SHarald Freudenberger if (pattributes) 1024e61a6134SHarald Freudenberger *pattributes = PKEY_VERIFY_ATTR_AES; 1025e61a6134SHarald Freudenberger if (pkeysize) 1026e61a6134SHarald Freudenberger *pkeysize = t->bitsize; 1027e61a6134SHarald Freudenberger 1028e61a6134SHarald Freudenberger /* try to find a card which can handle this key */ 1029e61a6134SHarald Freudenberger rc = pkey_findcard(seckey, &cardnr, &domain, 1); 1030e61a6134SHarald Freudenberger if (rc) 1031e61a6134SHarald Freudenberger goto out; 1032e61a6134SHarald Freudenberger 1033e61a6134SHarald Freudenberger /* check mkvp for old mkvp match */ 1034e61a6134SHarald Freudenberger rc = mkvp_cache_fetch(cardnr, domain, mkvp); 1035e61a6134SHarald Freudenberger if (rc) 1036e61a6134SHarald Freudenberger goto out; 1037e61a6134SHarald Freudenberger if (t->mkvp == mkvp[1]) { 1038*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s secure key has old mkvp\n", __func__); 1039e61a6134SHarald Freudenberger if (pattributes) 1040e61a6134SHarald Freudenberger *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP; 1041e61a6134SHarald Freudenberger } 1042e61a6134SHarald Freudenberger 1043e61a6134SHarald Freudenberger if (pcardnr) 1044e61a6134SHarald Freudenberger *pcardnr = cardnr; 1045e61a6134SHarald Freudenberger if (pdomain) 1046e61a6134SHarald Freudenberger *pdomain = domain; 1047e61a6134SHarald Freudenberger 1048e61a6134SHarald Freudenberger out: 1049*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s rc=%d\n", __func__, rc); 1050e61a6134SHarald Freudenberger return rc; 1051e61a6134SHarald Freudenberger } 1052e61a6134SHarald Freudenberger EXPORT_SYMBOL(pkey_verifykey); 1053e61a6134SHarald Freudenberger 1054e61a6134SHarald Freudenberger /* 1055e80d4af0SHarald Freudenberger * File io functions 1056e80d4af0SHarald Freudenberger */ 1057e80d4af0SHarald Freudenberger 1058e80d4af0SHarald Freudenberger static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, 1059e80d4af0SHarald Freudenberger unsigned long arg) 1060e80d4af0SHarald Freudenberger { 1061e80d4af0SHarald Freudenberger int rc; 1062e80d4af0SHarald Freudenberger 1063e80d4af0SHarald Freudenberger switch (cmd) { 1064e80d4af0SHarald Freudenberger case PKEY_GENSECK: { 1065e80d4af0SHarald Freudenberger struct pkey_genseck __user *ugs = (void __user *) arg; 1066e80d4af0SHarald Freudenberger struct pkey_genseck kgs; 1067e80d4af0SHarald Freudenberger 1068e80d4af0SHarald Freudenberger if (copy_from_user(&kgs, ugs, sizeof(kgs))) 1069e80d4af0SHarald Freudenberger return -EFAULT; 1070e80d4af0SHarald Freudenberger rc = pkey_genseckey(kgs.cardnr, kgs.domain, 1071e80d4af0SHarald Freudenberger kgs.keytype, &kgs.seckey); 1072*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_genseckey()=%d\n", __func__, rc); 1073e80d4af0SHarald Freudenberger if (rc) 1074e80d4af0SHarald Freudenberger break; 1075e80d4af0SHarald Freudenberger if (copy_to_user(ugs, &kgs, sizeof(kgs))) 1076e80d4af0SHarald Freudenberger return -EFAULT; 1077e80d4af0SHarald Freudenberger break; 1078e80d4af0SHarald Freudenberger } 1079e80d4af0SHarald Freudenberger case PKEY_CLR2SECK: { 1080e80d4af0SHarald Freudenberger struct pkey_clr2seck __user *ucs = (void __user *) arg; 1081e80d4af0SHarald Freudenberger struct pkey_clr2seck kcs; 1082e80d4af0SHarald Freudenberger 1083e80d4af0SHarald Freudenberger if (copy_from_user(&kcs, ucs, sizeof(kcs))) 1084e80d4af0SHarald Freudenberger return -EFAULT; 1085e80d4af0SHarald Freudenberger rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype, 1086e80d4af0SHarald Freudenberger &kcs.clrkey, &kcs.seckey); 1087*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_clr2seckey()=%d\n", __func__, rc); 1088e80d4af0SHarald Freudenberger if (rc) 1089e80d4af0SHarald Freudenberger break; 1090e80d4af0SHarald Freudenberger if (copy_to_user(ucs, &kcs, sizeof(kcs))) 1091e80d4af0SHarald Freudenberger return -EFAULT; 1092e80d4af0SHarald Freudenberger memzero_explicit(&kcs, sizeof(kcs)); 1093e80d4af0SHarald Freudenberger break; 1094e80d4af0SHarald Freudenberger } 1095e80d4af0SHarald Freudenberger case PKEY_SEC2PROTK: { 1096e80d4af0SHarald Freudenberger struct pkey_sec2protk __user *usp = (void __user *) arg; 1097e80d4af0SHarald Freudenberger struct pkey_sec2protk ksp; 1098e80d4af0SHarald Freudenberger 1099e80d4af0SHarald Freudenberger if (copy_from_user(&ksp, usp, sizeof(ksp))) 1100e80d4af0SHarald Freudenberger return -EFAULT; 1101e80d4af0SHarald Freudenberger rc = pkey_sec2protkey(ksp.cardnr, ksp.domain, 1102e80d4af0SHarald Freudenberger &ksp.seckey, &ksp.protkey); 1103*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_sec2protkey()=%d\n", __func__, rc); 1104e80d4af0SHarald Freudenberger if (rc) 1105e80d4af0SHarald Freudenberger break; 1106e80d4af0SHarald Freudenberger if (copy_to_user(usp, &ksp, sizeof(ksp))) 1107e80d4af0SHarald Freudenberger return -EFAULT; 1108e80d4af0SHarald Freudenberger break; 1109e80d4af0SHarald Freudenberger } 1110e80d4af0SHarald Freudenberger case PKEY_CLR2PROTK: { 1111e80d4af0SHarald Freudenberger struct pkey_clr2protk __user *ucp = (void __user *) arg; 1112e80d4af0SHarald Freudenberger struct pkey_clr2protk kcp; 1113e80d4af0SHarald Freudenberger 1114e80d4af0SHarald Freudenberger if (copy_from_user(&kcp, ucp, sizeof(kcp))) 1115e80d4af0SHarald Freudenberger return -EFAULT; 1116e80d4af0SHarald Freudenberger rc = pkey_clr2protkey(kcp.keytype, 1117e80d4af0SHarald Freudenberger &kcp.clrkey, &kcp.protkey); 1118*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc); 1119e80d4af0SHarald Freudenberger if (rc) 1120e80d4af0SHarald Freudenberger break; 1121e80d4af0SHarald Freudenberger if (copy_to_user(ucp, &kcp, sizeof(kcp))) 1122e80d4af0SHarald Freudenberger return -EFAULT; 1123e80d4af0SHarald Freudenberger memzero_explicit(&kcp, sizeof(kcp)); 1124e80d4af0SHarald Freudenberger break; 1125e80d4af0SHarald Freudenberger } 1126e80d4af0SHarald Freudenberger case PKEY_FINDCARD: { 1127e80d4af0SHarald Freudenberger struct pkey_findcard __user *ufc = (void __user *) arg; 1128e80d4af0SHarald Freudenberger struct pkey_findcard kfc; 1129e80d4af0SHarald Freudenberger 1130e80d4af0SHarald Freudenberger if (copy_from_user(&kfc, ufc, sizeof(kfc))) 1131e80d4af0SHarald Freudenberger return -EFAULT; 1132e80d4af0SHarald Freudenberger rc = pkey_findcard(&kfc.seckey, 1133e80d4af0SHarald Freudenberger &kfc.cardnr, &kfc.domain, 1); 1134*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_findcard()=%d\n", __func__, rc); 1135e80d4af0SHarald Freudenberger if (rc) 1136e80d4af0SHarald Freudenberger break; 1137e80d4af0SHarald Freudenberger if (copy_to_user(ufc, &kfc, sizeof(kfc))) 1138e80d4af0SHarald Freudenberger return -EFAULT; 1139e80d4af0SHarald Freudenberger break; 1140e80d4af0SHarald Freudenberger } 1141e80d4af0SHarald Freudenberger case PKEY_SKEY2PKEY: { 1142e80d4af0SHarald Freudenberger struct pkey_skey2pkey __user *usp = (void __user *) arg; 1143e80d4af0SHarald Freudenberger struct pkey_skey2pkey ksp; 1144e80d4af0SHarald Freudenberger 1145e80d4af0SHarald Freudenberger if (copy_from_user(&ksp, usp, sizeof(ksp))) 1146e80d4af0SHarald Freudenberger return -EFAULT; 1147e80d4af0SHarald Freudenberger rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey); 1148*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_skey2pkey()=%d\n", __func__, rc); 1149e80d4af0SHarald Freudenberger if (rc) 1150e80d4af0SHarald Freudenberger break; 1151e80d4af0SHarald Freudenberger if (copy_to_user(usp, &ksp, sizeof(ksp))) 1152e80d4af0SHarald Freudenberger return -EFAULT; 1153e80d4af0SHarald Freudenberger break; 1154e80d4af0SHarald Freudenberger } 1155e61a6134SHarald Freudenberger case PKEY_VERIFYKEY: { 1156e61a6134SHarald Freudenberger struct pkey_verifykey __user *uvk = (void __user *) arg; 1157e61a6134SHarald Freudenberger struct pkey_verifykey kvk; 1158e61a6134SHarald Freudenberger 1159e61a6134SHarald Freudenberger if (copy_from_user(&kvk, uvk, sizeof(kvk))) 1160e61a6134SHarald Freudenberger return -EFAULT; 1161e61a6134SHarald Freudenberger rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain, 1162e61a6134SHarald Freudenberger &kvk.keysize, &kvk.attributes); 1163*ac2b96f3SHarald Freudenberger DEBUG_DBG("%s pkey_verifykey()=%d\n", __func__, rc); 1164e61a6134SHarald Freudenberger if (rc) 1165e61a6134SHarald Freudenberger break; 1166e61a6134SHarald Freudenberger if (copy_to_user(uvk, &kvk, sizeof(kvk))) 1167e61a6134SHarald Freudenberger return -EFAULT; 1168e61a6134SHarald Freudenberger break; 1169e61a6134SHarald Freudenberger } 1170e80d4af0SHarald Freudenberger default: 1171e80d4af0SHarald Freudenberger /* unknown/unsupported ioctl cmd */ 1172e80d4af0SHarald Freudenberger return -ENOTTY; 1173e80d4af0SHarald Freudenberger } 1174e80d4af0SHarald Freudenberger 1175e80d4af0SHarald Freudenberger return rc; 1176e80d4af0SHarald Freudenberger } 1177e80d4af0SHarald Freudenberger 1178e80d4af0SHarald Freudenberger /* 1179e80d4af0SHarald Freudenberger * Sysfs and file io operations 1180e80d4af0SHarald Freudenberger */ 1181e80d4af0SHarald Freudenberger static const struct file_operations pkey_fops = { 1182e80d4af0SHarald Freudenberger .owner = THIS_MODULE, 1183e80d4af0SHarald Freudenberger .open = nonseekable_open, 1184e80d4af0SHarald Freudenberger .llseek = no_llseek, 1185e80d4af0SHarald Freudenberger .unlocked_ioctl = pkey_unlocked_ioctl, 1186e80d4af0SHarald Freudenberger }; 1187e80d4af0SHarald Freudenberger 1188e80d4af0SHarald Freudenberger static struct miscdevice pkey_dev = { 1189e80d4af0SHarald Freudenberger .name = "pkey", 1190e80d4af0SHarald Freudenberger .minor = MISC_DYNAMIC_MINOR, 1191e80d4af0SHarald Freudenberger .mode = 0666, 1192e80d4af0SHarald Freudenberger .fops = &pkey_fops, 1193e80d4af0SHarald Freudenberger }; 1194e80d4af0SHarald Freudenberger 1195e80d4af0SHarald Freudenberger /* 1196e80d4af0SHarald Freudenberger * Module init 1197e80d4af0SHarald Freudenberger */ 1198cb4ef3c2SHeiko Carstens static int __init pkey_init(void) 1199e80d4af0SHarald Freudenberger { 1200e80d4af0SHarald Freudenberger cpacf_mask_t pckmo_functions; 1201e80d4af0SHarald Freudenberger 1202e80d4af0SHarald Freudenberger /* check for pckmo instructions available */ 1203e80d4af0SHarald Freudenberger if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) 1204e80d4af0SHarald Freudenberger return -EOPNOTSUPP; 1205e80d4af0SHarald Freudenberger if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) || 1206e80d4af0SHarald Freudenberger !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) || 1207e80d4af0SHarald Freudenberger !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY)) 1208e80d4af0SHarald Freudenberger return -EOPNOTSUPP; 1209e80d4af0SHarald Freudenberger 1210e80d4af0SHarald Freudenberger pkey_debug_init(); 1211e80d4af0SHarald Freudenberger 1212e80d4af0SHarald Freudenberger return misc_register(&pkey_dev); 1213e80d4af0SHarald Freudenberger } 1214e80d4af0SHarald Freudenberger 1215e80d4af0SHarald Freudenberger /* 1216e80d4af0SHarald Freudenberger * Module exit 1217e80d4af0SHarald Freudenberger */ 1218e80d4af0SHarald Freudenberger static void __exit pkey_exit(void) 1219e80d4af0SHarald Freudenberger { 1220e80d4af0SHarald Freudenberger misc_deregister(&pkey_dev); 1221e80d4af0SHarald Freudenberger mkvp_cache_free(); 1222e80d4af0SHarald Freudenberger pkey_debug_exit(); 1223e80d4af0SHarald Freudenberger } 1224e80d4af0SHarald Freudenberger 1225e80d4af0SHarald Freudenberger module_init(pkey_init); 1226e80d4af0SHarald Freudenberger module_exit(pkey_exit); 1227