1e80d4af0SHarald Freudenberger /* 2e80d4af0SHarald Freudenberger * pkey device driver 3e80d4af0SHarald Freudenberger * 4e80d4af0SHarald Freudenberger * Copyright IBM Corp. 2017 5e80d4af0SHarald Freudenberger * Author(s): Harald Freudenberger 6e80d4af0SHarald Freudenberger * 7e80d4af0SHarald Freudenberger * This program is free software; you can redistribute it and/or modify 8e80d4af0SHarald Freudenberger * it under the terms of the GNU General Public License (version 2 only) 9e80d4af0SHarald Freudenberger * as published by the Free Software Foundation. 10e80d4af0SHarald Freudenberger * 11e80d4af0SHarald Freudenberger */ 12e80d4af0SHarald Freudenberger 13e80d4af0SHarald Freudenberger #define KMSG_COMPONENT "pkey" 14e80d4af0SHarald Freudenberger #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 15e80d4af0SHarald Freudenberger 16e80d4af0SHarald Freudenberger #include <linux/fs.h> 17e80d4af0SHarald Freudenberger #include <linux/init.h> 18e80d4af0SHarald Freudenberger #include <linux/miscdevice.h> 19e80d4af0SHarald Freudenberger #include <linux/module.h> 20e80d4af0SHarald Freudenberger #include <linux/slab.h> 21e80d4af0SHarald Freudenberger #include <linux/kallsyms.h> 22e80d4af0SHarald Freudenberger #include <linux/debugfs.h> 23e80d4af0SHarald Freudenberger #include <asm/zcrypt.h> 24e80d4af0SHarald Freudenberger #include <asm/cpacf.h> 25e80d4af0SHarald Freudenberger #include <asm/pkey.h> 26e80d4af0SHarald Freudenberger 27e80d4af0SHarald Freudenberger #include "zcrypt_api.h" 28e80d4af0SHarald Freudenberger 29e80d4af0SHarald Freudenberger MODULE_LICENSE("GPL"); 30e80d4af0SHarald Freudenberger MODULE_AUTHOR("IBM Corporation"); 31e80d4af0SHarald Freudenberger MODULE_DESCRIPTION("s390 protected key interface"); 32e80d4af0SHarald Freudenberger 33e80d4af0SHarald Freudenberger /* Size of parameter block used for all cca requests/replies */ 34e80d4af0SHarald Freudenberger #define PARMBSIZE 512 35e80d4af0SHarald Freudenberger 36e80d4af0SHarald Freudenberger /* Size of vardata block used for some of the cca requests/replies */ 37e80d4af0SHarald Freudenberger #define VARDATASIZE 4096 38e80d4af0SHarald Freudenberger 39e80d4af0SHarald Freudenberger /* 40e80d4af0SHarald Freudenberger * debug feature data and functions 41e80d4af0SHarald Freudenberger */ 42e80d4af0SHarald Freudenberger 43e80d4af0SHarald Freudenberger static debug_info_t *debug_info; 44e80d4af0SHarald Freudenberger 45e80d4af0SHarald Freudenberger #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__) 46e80d4af0SHarald Freudenberger #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__) 47e80d4af0SHarald Freudenberger #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__) 48e80d4af0SHarald Freudenberger #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__) 49e80d4af0SHarald Freudenberger 50e80d4af0SHarald Freudenberger static void __init pkey_debug_init(void) 51e80d4af0SHarald Freudenberger { 52e80d4af0SHarald Freudenberger debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long)); 53e80d4af0SHarald Freudenberger debug_register_view(debug_info, &debug_sprintf_view); 54e80d4af0SHarald Freudenberger debug_set_level(debug_info, 3); 55e80d4af0SHarald Freudenberger } 56e80d4af0SHarald Freudenberger 57e80d4af0SHarald Freudenberger static void __exit pkey_debug_exit(void) 58e80d4af0SHarald Freudenberger { 59e80d4af0SHarald Freudenberger debug_unregister(debug_info); 60e80d4af0SHarald Freudenberger } 61e80d4af0SHarald Freudenberger 62e80d4af0SHarald Freudenberger /* inside view of a secure key token (only type 0x01 version 0x04) */ 63e80d4af0SHarald Freudenberger struct secaeskeytoken { 64e80d4af0SHarald Freudenberger u8 type; /* 0x01 for internal key token */ 65e80d4af0SHarald Freudenberger u8 res0[3]; 66e80d4af0SHarald Freudenberger u8 version; /* should be 0x04 */ 67e80d4af0SHarald Freudenberger u8 res1[1]; 68e80d4af0SHarald Freudenberger u8 flag; /* key flags */ 69e80d4af0SHarald Freudenberger u8 res2[1]; 70e80d4af0SHarald Freudenberger u64 mkvp; /* master key verification pattern */ 71e80d4af0SHarald Freudenberger u8 key[32]; /* key value (encrypted) */ 72e80d4af0SHarald Freudenberger u8 cv[8]; /* control vector */ 73e80d4af0SHarald Freudenberger u16 bitsize; /* key bit size */ 74e80d4af0SHarald Freudenberger u16 keysize; /* key byte size */ 75e80d4af0SHarald Freudenberger u8 tvv[4]; /* token validation value */ 76e80d4af0SHarald Freudenberger } __packed; 77e80d4af0SHarald Freudenberger 78e80d4af0SHarald Freudenberger /* 79e80d4af0SHarald Freudenberger * Simple check if the token is a valid CCA secure AES key 80e80d4af0SHarald Freudenberger * token. If keybitsize is given, the bitsize of the key is 81e80d4af0SHarald Freudenberger * also checked. Returns 0 on success or errno value on failure. 82e80d4af0SHarald Freudenberger */ 83e61a6134SHarald Freudenberger static int check_secaeskeytoken(const u8 *token, int keybitsize) 84e80d4af0SHarald Freudenberger { 85e80d4af0SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) token; 86e80d4af0SHarald Freudenberger 87e80d4af0SHarald Freudenberger if (t->type != 0x01) { 88e80d4af0SHarald Freudenberger DEBUG_ERR( 89e80d4af0SHarald Freudenberger "check_secaeskeytoken secure token check failed, type mismatch 0x%02x != 0x01\n", 90e80d4af0SHarald Freudenberger (int) t->type); 91e80d4af0SHarald Freudenberger return -EINVAL; 92e80d4af0SHarald Freudenberger } 93e80d4af0SHarald Freudenberger if (t->version != 0x04) { 94e80d4af0SHarald Freudenberger DEBUG_ERR( 95e80d4af0SHarald Freudenberger "check_secaeskeytoken secure token check failed, version mismatch 0x%02x != 0x04\n", 96e80d4af0SHarald Freudenberger (int) t->version); 97e80d4af0SHarald Freudenberger return -EINVAL; 98e80d4af0SHarald Freudenberger } 99e80d4af0SHarald Freudenberger if (keybitsize > 0 && t->bitsize != keybitsize) { 100e80d4af0SHarald Freudenberger DEBUG_ERR( 101e80d4af0SHarald Freudenberger "check_secaeskeytoken secure token check failed, bitsize mismatch %d != %d\n", 102e80d4af0SHarald Freudenberger (int) t->bitsize, keybitsize); 103e80d4af0SHarald Freudenberger return -EINVAL; 104e80d4af0SHarald Freudenberger } 105e80d4af0SHarald Freudenberger 106e80d4af0SHarald Freudenberger return 0; 107e80d4af0SHarald Freudenberger } 108e80d4af0SHarald Freudenberger 109e80d4af0SHarald Freudenberger /* 110e80d4af0SHarald Freudenberger * Allocate consecutive memory for request CPRB, request param 111e80d4af0SHarald Freudenberger * block, reply CPRB and reply param block and fill in values 112e80d4af0SHarald Freudenberger * for the common fields. Returns 0 on success or errno value 113e80d4af0SHarald Freudenberger * on failure. 114e80d4af0SHarald Freudenberger */ 115e80d4af0SHarald Freudenberger static int alloc_and_prep_cprbmem(size_t paramblen, 116e80d4af0SHarald Freudenberger u8 **pcprbmem, 117e80d4af0SHarald Freudenberger struct CPRBX **preqCPRB, 118e80d4af0SHarald Freudenberger struct CPRBX **prepCPRB) 119e80d4af0SHarald Freudenberger { 120e80d4af0SHarald Freudenberger u8 *cprbmem; 121e80d4af0SHarald Freudenberger size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen; 122e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 123e80d4af0SHarald Freudenberger 124e80d4af0SHarald Freudenberger /* 125e80d4af0SHarald Freudenberger * allocate consecutive memory for request CPRB, request param 126e80d4af0SHarald Freudenberger * block, reply CPRB and reply param block 127e80d4af0SHarald Freudenberger */ 1280bb6bba5SVasyl Gomonovych cprbmem = kzalloc(2 * cprbplusparamblen, GFP_KERNEL); 129e80d4af0SHarald Freudenberger if (!cprbmem) 130e80d4af0SHarald Freudenberger return -ENOMEM; 131e80d4af0SHarald Freudenberger 132e80d4af0SHarald Freudenberger preqcblk = (struct CPRBX *) cprbmem; 133e80d4af0SHarald Freudenberger prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen); 134e80d4af0SHarald Freudenberger 135e80d4af0SHarald Freudenberger /* fill request cprb struct */ 136e80d4af0SHarald Freudenberger preqcblk->cprb_len = sizeof(struct CPRBX); 137e80d4af0SHarald Freudenberger preqcblk->cprb_ver_id = 0x02; 138e80d4af0SHarald Freudenberger memcpy(preqcblk->func_id, "T2", 2); 139e80d4af0SHarald Freudenberger preqcblk->rpl_msgbl = cprbplusparamblen; 140e80d4af0SHarald Freudenberger if (paramblen) { 141e80d4af0SHarald Freudenberger preqcblk->req_parmb = 142e80d4af0SHarald Freudenberger ((u8 *) preqcblk) + sizeof(struct CPRBX); 143e80d4af0SHarald Freudenberger preqcblk->rpl_parmb = 144e80d4af0SHarald Freudenberger ((u8 *) prepcblk) + sizeof(struct CPRBX); 145e80d4af0SHarald Freudenberger } 146e80d4af0SHarald Freudenberger 147e80d4af0SHarald Freudenberger *pcprbmem = cprbmem; 148e80d4af0SHarald Freudenberger *preqCPRB = preqcblk; 149e80d4af0SHarald Freudenberger *prepCPRB = prepcblk; 150e80d4af0SHarald Freudenberger 151e80d4af0SHarald Freudenberger return 0; 152e80d4af0SHarald Freudenberger } 153e80d4af0SHarald Freudenberger 154e80d4af0SHarald Freudenberger /* 155e80d4af0SHarald Freudenberger * Free the cprb memory allocated with the function above. 156e80d4af0SHarald Freudenberger * If the scrub value is not zero, the memory is filled 157e80d4af0SHarald Freudenberger * with zeros before freeing (useful if there was some 158e80d4af0SHarald Freudenberger * clear key material in there). 159e80d4af0SHarald Freudenberger */ 160e80d4af0SHarald Freudenberger static void free_cprbmem(void *mem, size_t paramblen, int scrub) 161e80d4af0SHarald Freudenberger { 162e80d4af0SHarald Freudenberger if (scrub) 163e80d4af0SHarald Freudenberger memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen)); 164e80d4af0SHarald Freudenberger kfree(mem); 165e80d4af0SHarald Freudenberger } 166e80d4af0SHarald Freudenberger 167e80d4af0SHarald Freudenberger /* 168e80d4af0SHarald Freudenberger * Helper function to prepare the xcrb struct 169e80d4af0SHarald Freudenberger */ 170e80d4af0SHarald Freudenberger static inline void prep_xcrb(struct ica_xcRB *pxcrb, 171e80d4af0SHarald Freudenberger u16 cardnr, 172e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, 173e80d4af0SHarald Freudenberger struct CPRBX *prepcblk) 174e80d4af0SHarald Freudenberger { 175e80d4af0SHarald Freudenberger memset(pxcrb, 0, sizeof(*pxcrb)); 176e80d4af0SHarald Freudenberger pxcrb->agent_ID = 0x4341; /* 'CA' */ 177e80d4af0SHarald Freudenberger pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr); 178e80d4af0SHarald Freudenberger pxcrb->request_control_blk_length = 179e80d4af0SHarald Freudenberger preqcblk->cprb_len + preqcblk->req_parml; 1807a003637SHeiko Carstens pxcrb->request_control_blk_addr = (void __user *) preqcblk; 181e80d4af0SHarald Freudenberger pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl; 1827a003637SHeiko Carstens pxcrb->reply_control_blk_addr = (void __user *) prepcblk; 183e80d4af0SHarald Freudenberger } 184e80d4af0SHarald Freudenberger 185e80d4af0SHarald Freudenberger /* 186e80d4af0SHarald Freudenberger * Helper function which calls zcrypt_send_cprb with 187e80d4af0SHarald Freudenberger * memory management segment adjusted to kernel space 188e80d4af0SHarald Freudenberger * so that the copy_from_user called within this 189e80d4af0SHarald Freudenberger * function do in fact copy from kernel space. 190e80d4af0SHarald Freudenberger */ 191e80d4af0SHarald Freudenberger static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb) 192e80d4af0SHarald Freudenberger { 193e80d4af0SHarald Freudenberger int rc; 194e80d4af0SHarald Freudenberger mm_segment_t old_fs = get_fs(); 195e80d4af0SHarald Freudenberger 196e80d4af0SHarald Freudenberger set_fs(KERNEL_DS); 197e80d4af0SHarald Freudenberger rc = zcrypt_send_cprb(xcrb); 198e80d4af0SHarald Freudenberger set_fs(old_fs); 199e80d4af0SHarald Freudenberger 200e80d4af0SHarald Freudenberger return rc; 201e80d4af0SHarald Freudenberger } 202e80d4af0SHarald Freudenberger 203e80d4af0SHarald Freudenberger /* 204e80d4af0SHarald Freudenberger * Generate (random) AES secure key. 205e80d4af0SHarald Freudenberger */ 206e80d4af0SHarald Freudenberger int pkey_genseckey(u16 cardnr, u16 domain, 207e80d4af0SHarald Freudenberger u32 keytype, struct pkey_seckey *seckey) 208e80d4af0SHarald Freudenberger { 209e80d4af0SHarald Freudenberger int i, rc, keysize; 210e80d4af0SHarald Freudenberger int seckeysize; 211e80d4af0SHarald Freudenberger u8 *mem; 212e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 213e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 214e80d4af0SHarald Freudenberger struct kgreqparm { 215e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 216e80d4af0SHarald Freudenberger u16 rule_array_len; 217e80d4af0SHarald Freudenberger struct lv1 { 218e80d4af0SHarald Freudenberger u16 len; 219e80d4af0SHarald Freudenberger char key_form[8]; 220e80d4af0SHarald Freudenberger char key_length[8]; 221e80d4af0SHarald Freudenberger char key_type1[8]; 222e80d4af0SHarald Freudenberger char key_type2[8]; 223e80d4af0SHarald Freudenberger } lv1; 224e80d4af0SHarald Freudenberger struct lv2 { 225e80d4af0SHarald Freudenberger u16 len; 226e80d4af0SHarald Freudenberger struct keyid { 227e80d4af0SHarald Freudenberger u16 len; 228e80d4af0SHarald Freudenberger u16 attr; 229e80d4af0SHarald Freudenberger u8 data[SECKEYBLOBSIZE]; 230e80d4af0SHarald Freudenberger } keyid[6]; 231e80d4af0SHarald Freudenberger } lv2; 232e80d4af0SHarald Freudenberger } *preqparm; 233e80d4af0SHarald Freudenberger struct kgrepparm { 234e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 235e80d4af0SHarald Freudenberger u16 rule_array_len; 236e80d4af0SHarald Freudenberger struct lv3 { 237e80d4af0SHarald Freudenberger u16 len; 238e80d4af0SHarald Freudenberger u16 keyblocklen; 239e80d4af0SHarald Freudenberger struct { 240e80d4af0SHarald Freudenberger u16 toklen; 241e80d4af0SHarald Freudenberger u16 tokattr; 242e80d4af0SHarald Freudenberger u8 tok[0]; 243e80d4af0SHarald Freudenberger /* ... some more data ... */ 244e80d4af0SHarald Freudenberger } keyblock; 245e80d4af0SHarald Freudenberger } lv3; 246e80d4af0SHarald Freudenberger } *prepparm; 247e80d4af0SHarald Freudenberger 248e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 249e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 250e80d4af0SHarald Freudenberger if (rc) 251e80d4af0SHarald Freudenberger return rc; 252e80d4af0SHarald Freudenberger 253e80d4af0SHarald Freudenberger /* fill request cprb struct */ 254e80d4af0SHarald Freudenberger preqcblk->domain = domain; 255e80d4af0SHarald Freudenberger 256e80d4af0SHarald Freudenberger /* fill request cprb param block with KG request */ 257e80d4af0SHarald Freudenberger preqparm = (struct kgreqparm *) preqcblk->req_parmb; 258e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "KG", 2); 259e80d4af0SHarald Freudenberger preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 260e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1); 261e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_form, "OP ", 8); 262e80d4af0SHarald Freudenberger switch (keytype) { 263e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 264e80d4af0SHarald Freudenberger keysize = 16; 265e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8); 266e80d4af0SHarald Freudenberger break; 267e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 268e80d4af0SHarald Freudenberger keysize = 24; 269e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8); 270e80d4af0SHarald Freudenberger break; 271e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 272e80d4af0SHarald Freudenberger keysize = 32; 273e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8); 274e80d4af0SHarald Freudenberger break; 275e80d4af0SHarald Freudenberger default: 276e80d4af0SHarald Freudenberger DEBUG_ERR( 277e80d4af0SHarald Freudenberger "pkey_genseckey unknown/unsupported keytype %d\n", 278e80d4af0SHarald Freudenberger keytype); 279e80d4af0SHarald Freudenberger rc = -EINVAL; 280e80d4af0SHarald Freudenberger goto out; 281e80d4af0SHarald Freudenberger } 282e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.key_type1, "AESDATA ", 8); 283e80d4af0SHarald Freudenberger preqparm->lv2.len = sizeof(struct lv2); 284e80d4af0SHarald Freudenberger for (i = 0; i < 6; i++) { 285e80d4af0SHarald Freudenberger preqparm->lv2.keyid[i].len = sizeof(struct keyid); 286e80d4af0SHarald Freudenberger preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10); 287e80d4af0SHarald Freudenberger } 288e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct kgreqparm); 289e80d4af0SHarald Freudenberger 290e80d4af0SHarald Freudenberger /* fill xcrb struct */ 291e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 292e80d4af0SHarald Freudenberger 293e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 294e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 295e80d4af0SHarald Freudenberger if (rc) { 296e80d4af0SHarald Freudenberger DEBUG_ERR( 297e80d4af0SHarald Freudenberger "pkey_genseckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 298e80d4af0SHarald Freudenberger (int) cardnr, (int) domain, rc); 299e80d4af0SHarald Freudenberger goto out; 300e80d4af0SHarald Freudenberger } 301e80d4af0SHarald Freudenberger 302e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 303e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 304e80d4af0SHarald Freudenberger DEBUG_ERR( 305e80d4af0SHarald Freudenberger "pkey_genseckey secure key generate failure, card response %d/%d\n", 306e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 307e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 308e80d4af0SHarald Freudenberger rc = -EIO; 309e80d4af0SHarald Freudenberger goto out; 310e80d4af0SHarald Freudenberger } 311e80d4af0SHarald Freudenberger 312e80d4af0SHarald Freudenberger /* process response cprb param block */ 313e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 314e80d4af0SHarald Freudenberger prepparm = (struct kgrepparm *) prepcblk->rpl_parmb; 315e80d4af0SHarald Freudenberger 316e80d4af0SHarald Freudenberger /* check length of the returned secure key token */ 317e80d4af0SHarald Freudenberger seckeysize = prepparm->lv3.keyblock.toklen 318e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.toklen) 319e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.tokattr); 320e80d4af0SHarald Freudenberger if (seckeysize != SECKEYBLOBSIZE) { 321e80d4af0SHarald Freudenberger DEBUG_ERR( 322e80d4af0SHarald Freudenberger "pkey_genseckey secure token size mismatch %d != %d bytes\n", 323e80d4af0SHarald Freudenberger seckeysize, SECKEYBLOBSIZE); 324e80d4af0SHarald Freudenberger rc = -EIO; 325e80d4af0SHarald Freudenberger goto out; 326e80d4af0SHarald Freudenberger } 327e80d4af0SHarald Freudenberger 328e80d4af0SHarald Freudenberger /* check secure key token */ 329e80d4af0SHarald Freudenberger rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize); 330e80d4af0SHarald Freudenberger if (rc) { 331e80d4af0SHarald Freudenberger rc = -EIO; 332e80d4af0SHarald Freudenberger goto out; 333e80d4af0SHarald Freudenberger } 334e80d4af0SHarald Freudenberger 335e80d4af0SHarald Freudenberger /* copy the generated secure key token */ 336e80d4af0SHarald Freudenberger memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 337e80d4af0SHarald Freudenberger 338e80d4af0SHarald Freudenberger out: 339e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 0); 340e80d4af0SHarald Freudenberger return rc; 341e80d4af0SHarald Freudenberger } 342e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_genseckey); 343e80d4af0SHarald Freudenberger 344e80d4af0SHarald Freudenberger /* 345e80d4af0SHarald Freudenberger * Generate an AES secure key with given key value. 346e80d4af0SHarald Freudenberger */ 347e80d4af0SHarald Freudenberger int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype, 348e80d4af0SHarald Freudenberger const struct pkey_clrkey *clrkey, 349e80d4af0SHarald Freudenberger struct pkey_seckey *seckey) 350e80d4af0SHarald Freudenberger { 351e80d4af0SHarald Freudenberger int rc, keysize, seckeysize; 352e80d4af0SHarald Freudenberger u8 *mem; 353e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 354e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 355e80d4af0SHarald Freudenberger struct cmreqparm { 356e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 357e80d4af0SHarald Freudenberger u16 rule_array_len; 358e80d4af0SHarald Freudenberger char rule_array[8]; 359e80d4af0SHarald Freudenberger struct lv1 { 360e80d4af0SHarald Freudenberger u16 len; 361e80d4af0SHarald Freudenberger u8 clrkey[0]; 362e80d4af0SHarald Freudenberger } lv1; 363e80d4af0SHarald Freudenberger struct lv2 { 364e80d4af0SHarald Freudenberger u16 len; 365e80d4af0SHarald Freudenberger struct keyid { 366e80d4af0SHarald Freudenberger u16 len; 367e80d4af0SHarald Freudenberger u16 attr; 368e80d4af0SHarald Freudenberger u8 data[SECKEYBLOBSIZE]; 369e80d4af0SHarald Freudenberger } keyid; 370e80d4af0SHarald Freudenberger } lv2; 371e80d4af0SHarald Freudenberger } *preqparm; 372e80d4af0SHarald Freudenberger struct lv2 *plv2; 373e80d4af0SHarald Freudenberger struct cmrepparm { 374e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 375e80d4af0SHarald Freudenberger u16 rule_array_len; 376e80d4af0SHarald Freudenberger struct lv3 { 377e80d4af0SHarald Freudenberger u16 len; 378e80d4af0SHarald Freudenberger u16 keyblocklen; 379e80d4af0SHarald Freudenberger struct { 380e80d4af0SHarald Freudenberger u16 toklen; 381e80d4af0SHarald Freudenberger u16 tokattr; 382e80d4af0SHarald Freudenberger u8 tok[0]; 383e80d4af0SHarald Freudenberger /* ... some more data ... */ 384e80d4af0SHarald Freudenberger } keyblock; 385e80d4af0SHarald Freudenberger } lv3; 386e80d4af0SHarald Freudenberger } *prepparm; 387e80d4af0SHarald Freudenberger 388e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 389e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 390e80d4af0SHarald Freudenberger if (rc) 391e80d4af0SHarald Freudenberger return rc; 392e80d4af0SHarald Freudenberger 393e80d4af0SHarald Freudenberger /* fill request cprb struct */ 394e80d4af0SHarald Freudenberger preqcblk->domain = domain; 395e80d4af0SHarald Freudenberger 396e80d4af0SHarald Freudenberger /* fill request cprb param block with CM request */ 397e80d4af0SHarald Freudenberger preqparm = (struct cmreqparm *) preqcblk->req_parmb; 398e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "CM", 2); 399e80d4af0SHarald Freudenberger memcpy(preqparm->rule_array, "AES ", 8); 400e80d4af0SHarald Freudenberger preqparm->rule_array_len = 401e80d4af0SHarald Freudenberger sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 402e80d4af0SHarald Freudenberger switch (keytype) { 403e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 404e80d4af0SHarald Freudenberger keysize = 16; 405e80d4af0SHarald Freudenberger break; 406e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 407e80d4af0SHarald Freudenberger keysize = 24; 408e80d4af0SHarald Freudenberger break; 409e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 410e80d4af0SHarald Freudenberger keysize = 32; 411e80d4af0SHarald Freudenberger break; 412e80d4af0SHarald Freudenberger default: 413e80d4af0SHarald Freudenberger DEBUG_ERR( 414e80d4af0SHarald Freudenberger "pkey_clr2seckey unknown/unsupported keytype %d\n", 415e80d4af0SHarald Freudenberger keytype); 416e80d4af0SHarald Freudenberger rc = -EINVAL; 417e80d4af0SHarald Freudenberger goto out; 418e80d4af0SHarald Freudenberger } 419e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1) + keysize; 420e80d4af0SHarald Freudenberger memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize); 421e80d4af0SHarald Freudenberger plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize); 422e80d4af0SHarald Freudenberger plv2->len = sizeof(struct lv2); 423e80d4af0SHarald Freudenberger plv2->keyid.len = sizeof(struct keyid); 424e80d4af0SHarald Freudenberger plv2->keyid.attr = 0x30; 425e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct cmreqparm) + keysize; 426e80d4af0SHarald Freudenberger 427e80d4af0SHarald Freudenberger /* fill xcrb struct */ 428e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 429e80d4af0SHarald Freudenberger 430e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 431e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 432e80d4af0SHarald Freudenberger if (rc) { 433e80d4af0SHarald Freudenberger DEBUG_ERR( 434e80d4af0SHarald Freudenberger "pkey_clr2seckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 435e80d4af0SHarald Freudenberger (int) cardnr, (int) domain, rc); 436e80d4af0SHarald Freudenberger goto out; 437e80d4af0SHarald Freudenberger } 438e80d4af0SHarald Freudenberger 439e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 440e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 441e80d4af0SHarald Freudenberger DEBUG_ERR( 442e80d4af0SHarald Freudenberger "pkey_clr2seckey clear key import failure, card response %d/%d\n", 443e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 444e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 445e80d4af0SHarald Freudenberger rc = -EIO; 446e80d4af0SHarald Freudenberger goto out; 447e80d4af0SHarald Freudenberger } 448e80d4af0SHarald Freudenberger 449e80d4af0SHarald Freudenberger /* process response cprb param block */ 450e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 451e80d4af0SHarald Freudenberger prepparm = (struct cmrepparm *) prepcblk->rpl_parmb; 452e80d4af0SHarald Freudenberger 453e80d4af0SHarald Freudenberger /* check length of the returned secure key token */ 454e80d4af0SHarald Freudenberger seckeysize = prepparm->lv3.keyblock.toklen 455e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.toklen) 456e80d4af0SHarald Freudenberger - sizeof(prepparm->lv3.keyblock.tokattr); 457e80d4af0SHarald Freudenberger if (seckeysize != SECKEYBLOBSIZE) { 458e80d4af0SHarald Freudenberger DEBUG_ERR( 459e80d4af0SHarald Freudenberger "pkey_clr2seckey secure token size mismatch %d != %d bytes\n", 460e80d4af0SHarald Freudenberger seckeysize, SECKEYBLOBSIZE); 461e80d4af0SHarald Freudenberger rc = -EIO; 462e80d4af0SHarald Freudenberger goto out; 463e80d4af0SHarald Freudenberger } 464e80d4af0SHarald Freudenberger 465e80d4af0SHarald Freudenberger /* check secure key token */ 466e80d4af0SHarald Freudenberger rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize); 467e80d4af0SHarald Freudenberger if (rc) { 468e80d4af0SHarald Freudenberger rc = -EIO; 469e80d4af0SHarald Freudenberger goto out; 470e80d4af0SHarald Freudenberger } 471e80d4af0SHarald Freudenberger 472e80d4af0SHarald Freudenberger /* copy the generated secure key token */ 473e80d4af0SHarald Freudenberger memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE); 474e80d4af0SHarald Freudenberger 475e80d4af0SHarald Freudenberger out: 476e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 1); 477e80d4af0SHarald Freudenberger return rc; 478e80d4af0SHarald Freudenberger } 479e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_clr2seckey); 480e80d4af0SHarald Freudenberger 481e80d4af0SHarald Freudenberger /* 482e80d4af0SHarald Freudenberger * Derive a proteced key from the secure key blob. 483e80d4af0SHarald Freudenberger */ 484e80d4af0SHarald Freudenberger int pkey_sec2protkey(u16 cardnr, u16 domain, 485e80d4af0SHarald Freudenberger const struct pkey_seckey *seckey, 486e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 487e80d4af0SHarald Freudenberger { 488e80d4af0SHarald Freudenberger int rc; 489e80d4af0SHarald Freudenberger u8 *mem; 490e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 491e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 492e80d4af0SHarald Freudenberger struct uskreqparm { 493e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 494e80d4af0SHarald Freudenberger u16 rule_array_len; 495e80d4af0SHarald Freudenberger struct lv1 { 496e80d4af0SHarald Freudenberger u16 len; 497e80d4af0SHarald Freudenberger u16 attr_len; 498e80d4af0SHarald Freudenberger u16 attr_flags; 499e80d4af0SHarald Freudenberger } lv1; 500e80d4af0SHarald Freudenberger struct lv2 { 501e80d4af0SHarald Freudenberger u16 len; 502e80d4af0SHarald Freudenberger u16 attr_len; 503e80d4af0SHarald Freudenberger u16 attr_flags; 504e80d4af0SHarald Freudenberger u8 token[0]; /* cca secure key token */ 505e80d4af0SHarald Freudenberger } lv2 __packed; 506e80d4af0SHarald Freudenberger } *preqparm; 507e80d4af0SHarald Freudenberger struct uskrepparm { 508e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 509e80d4af0SHarald Freudenberger u16 rule_array_len; 510e80d4af0SHarald Freudenberger struct lv3 { 511e80d4af0SHarald Freudenberger u16 len; 512e80d4af0SHarald Freudenberger u16 attr_len; 513e80d4af0SHarald Freudenberger u16 attr_flags; 514e80d4af0SHarald Freudenberger struct cpacfkeyblock { 515e80d4af0SHarald Freudenberger u8 version; /* version of this struct */ 516e80d4af0SHarald Freudenberger u8 flags[2]; 517e80d4af0SHarald Freudenberger u8 algo; 518e80d4af0SHarald Freudenberger u8 form; 519e80d4af0SHarald Freudenberger u8 pad1[3]; 520e80d4af0SHarald Freudenberger u16 keylen; 521e80d4af0SHarald Freudenberger u8 key[64]; /* the key (keylen bytes) */ 522e80d4af0SHarald Freudenberger u16 keyattrlen; 523e80d4af0SHarald Freudenberger u8 keyattr[32]; 524e80d4af0SHarald Freudenberger u8 pad2[1]; 525e80d4af0SHarald Freudenberger u8 vptype; 526e80d4af0SHarald Freudenberger u8 vp[32]; /* verification pattern */ 527e80d4af0SHarald Freudenberger } keyblock; 528e80d4af0SHarald Freudenberger } lv3 __packed; 529e80d4af0SHarald Freudenberger } *prepparm; 530e80d4af0SHarald Freudenberger 531e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 532e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); 533e80d4af0SHarald Freudenberger if (rc) 534e80d4af0SHarald Freudenberger return rc; 535e80d4af0SHarald Freudenberger 536e80d4af0SHarald Freudenberger /* fill request cprb struct */ 537e80d4af0SHarald Freudenberger preqcblk->domain = domain; 538e80d4af0SHarald Freudenberger 539e80d4af0SHarald Freudenberger /* fill request cprb param block with USK request */ 540e80d4af0SHarald Freudenberger preqparm = (struct uskreqparm *) preqcblk->req_parmb; 541e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "US", 2); 542e80d4af0SHarald Freudenberger preqparm->rule_array_len = sizeof(preqparm->rule_array_len); 543e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(struct lv1); 544e80d4af0SHarald Freudenberger preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len); 545e80d4af0SHarald Freudenberger preqparm->lv1.attr_flags = 0x0001; 546e80d4af0SHarald Freudenberger preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE; 547e80d4af0SHarald Freudenberger preqparm->lv2.attr_len = sizeof(struct lv2) 548e80d4af0SHarald Freudenberger - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE; 549e80d4af0SHarald Freudenberger preqparm->lv2.attr_flags = 0x0000; 550e80d4af0SHarald Freudenberger memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE); 551e80d4af0SHarald Freudenberger preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE; 552e80d4af0SHarald Freudenberger 553e80d4af0SHarald Freudenberger /* fill xcrb struct */ 554e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 555e80d4af0SHarald Freudenberger 556e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 557e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 558e80d4af0SHarald Freudenberger if (rc) { 559e80d4af0SHarald Freudenberger DEBUG_ERR( 560e80d4af0SHarald Freudenberger "pkey_sec2protkey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 561e80d4af0SHarald Freudenberger (int) cardnr, (int) domain, rc); 562e80d4af0SHarald Freudenberger goto out; 563e80d4af0SHarald Freudenberger } 564e80d4af0SHarald Freudenberger 565e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 566e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 567e80d4af0SHarald Freudenberger DEBUG_ERR( 568e80d4af0SHarald Freudenberger "pkey_sec2protkey unwrap secure key failure, card response %d/%d\n", 569e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 570e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 571e80d4af0SHarald Freudenberger rc = -EIO; 572e80d4af0SHarald Freudenberger goto out; 573e80d4af0SHarald Freudenberger } 574ca681ec8SHarald Freudenberger if (prepcblk->ccp_rscode != 0) { 575ca681ec8SHarald Freudenberger DEBUG_WARN( 576ca681ec8SHarald Freudenberger "pkey_sec2protkey unwrap secure key warning, card response %d/%d\n", 577ca681ec8SHarald Freudenberger (int) prepcblk->ccp_rtcode, 578ca681ec8SHarald Freudenberger (int) prepcblk->ccp_rscode); 579ca681ec8SHarald Freudenberger } 580e80d4af0SHarald Freudenberger 581e80d4af0SHarald Freudenberger /* process response cprb param block */ 582e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 583e80d4af0SHarald Freudenberger prepparm = (struct uskrepparm *) prepcblk->rpl_parmb; 584e80d4af0SHarald Freudenberger 585e80d4af0SHarald Freudenberger /* check the returned keyblock */ 586e80d4af0SHarald Freudenberger if (prepparm->lv3.keyblock.version != 0x01) { 587e80d4af0SHarald Freudenberger DEBUG_ERR( 588e80d4af0SHarald Freudenberger "pkey_sec2protkey reply param keyblock version mismatch 0x%02x != 0x01\n", 589e80d4af0SHarald Freudenberger (int) prepparm->lv3.keyblock.version); 590e80d4af0SHarald Freudenberger rc = -EIO; 591e80d4af0SHarald Freudenberger goto out; 592e80d4af0SHarald Freudenberger } 593e80d4af0SHarald Freudenberger 594e80d4af0SHarald Freudenberger /* copy the tanslated protected key */ 595e80d4af0SHarald Freudenberger switch (prepparm->lv3.keyblock.keylen) { 596e80d4af0SHarald Freudenberger case 16+32: 597e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_128; 598e80d4af0SHarald Freudenberger break; 599e80d4af0SHarald Freudenberger case 24+32: 600e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_192; 601e80d4af0SHarald Freudenberger break; 602e80d4af0SHarald Freudenberger case 32+32: 603e80d4af0SHarald Freudenberger protkey->type = PKEY_KEYTYPE_AES_256; 604e80d4af0SHarald Freudenberger break; 605e80d4af0SHarald Freudenberger default: 606e80d4af0SHarald Freudenberger DEBUG_ERR("pkey_sec2protkey unknown/unsupported keytype %d\n", 607e80d4af0SHarald Freudenberger prepparm->lv3.keyblock.keylen); 608e80d4af0SHarald Freudenberger rc = -EIO; 609e80d4af0SHarald Freudenberger goto out; 610e80d4af0SHarald Freudenberger } 611e80d4af0SHarald Freudenberger protkey->len = prepparm->lv3.keyblock.keylen; 612e80d4af0SHarald Freudenberger memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len); 613e80d4af0SHarald Freudenberger 614e80d4af0SHarald Freudenberger out: 615e80d4af0SHarald Freudenberger free_cprbmem(mem, PARMBSIZE, 0); 616e80d4af0SHarald Freudenberger return rc; 617e80d4af0SHarald Freudenberger } 618e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_sec2protkey); 619e80d4af0SHarald Freudenberger 620e80d4af0SHarald Freudenberger /* 621e80d4af0SHarald Freudenberger * Create a protected key from a clear key value. 622e80d4af0SHarald Freudenberger */ 623e80d4af0SHarald Freudenberger int pkey_clr2protkey(u32 keytype, 624e80d4af0SHarald Freudenberger const struct pkey_clrkey *clrkey, 625e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 626e80d4af0SHarald Freudenberger { 627e80d4af0SHarald Freudenberger long fc; 628e80d4af0SHarald Freudenberger int keysize; 629e80d4af0SHarald Freudenberger u8 paramblock[64]; 630e80d4af0SHarald Freudenberger 631e80d4af0SHarald Freudenberger switch (keytype) { 632e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_128: 633e80d4af0SHarald Freudenberger keysize = 16; 634e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_128_KEY; 635e80d4af0SHarald Freudenberger break; 636e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_192: 637e80d4af0SHarald Freudenberger keysize = 24; 638e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_192_KEY; 639e80d4af0SHarald Freudenberger break; 640e80d4af0SHarald Freudenberger case PKEY_KEYTYPE_AES_256: 641e80d4af0SHarald Freudenberger keysize = 32; 642e80d4af0SHarald Freudenberger fc = CPACF_PCKMO_ENC_AES_256_KEY; 643e80d4af0SHarald Freudenberger break; 644e80d4af0SHarald Freudenberger default: 645e80d4af0SHarald Freudenberger DEBUG_ERR("pkey_clr2protkey unknown/unsupported keytype %d\n", 646e80d4af0SHarald Freudenberger keytype); 647e80d4af0SHarald Freudenberger return -EINVAL; 648e80d4af0SHarald Freudenberger } 649e80d4af0SHarald Freudenberger 650e80d4af0SHarald Freudenberger /* prepare param block */ 651e80d4af0SHarald Freudenberger memset(paramblock, 0, sizeof(paramblock)); 652e80d4af0SHarald Freudenberger memcpy(paramblock, clrkey->clrkey, keysize); 653e80d4af0SHarald Freudenberger 654e80d4af0SHarald Freudenberger /* call the pckmo instruction */ 655e80d4af0SHarald Freudenberger cpacf_pckmo(fc, paramblock); 656e80d4af0SHarald Freudenberger 657e80d4af0SHarald Freudenberger /* copy created protected key */ 658e80d4af0SHarald Freudenberger protkey->type = keytype; 659e80d4af0SHarald Freudenberger protkey->len = keysize + 32; 660e80d4af0SHarald Freudenberger memcpy(protkey->protkey, paramblock, keysize + 32); 661e80d4af0SHarald Freudenberger 662e80d4af0SHarald Freudenberger return 0; 663e80d4af0SHarald Freudenberger } 664e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_clr2protkey); 665e80d4af0SHarald Freudenberger 666e80d4af0SHarald Freudenberger /* 667e80d4af0SHarald Freudenberger * query cryptographic facility from adapter 668e80d4af0SHarald Freudenberger */ 669e80d4af0SHarald Freudenberger static int query_crypto_facility(u16 cardnr, u16 domain, 670e80d4af0SHarald Freudenberger const char *keyword, 671e80d4af0SHarald Freudenberger u8 *rarray, size_t *rarraylen, 672e80d4af0SHarald Freudenberger u8 *varray, size_t *varraylen) 673e80d4af0SHarald Freudenberger { 674e80d4af0SHarald Freudenberger int rc; 675e80d4af0SHarald Freudenberger u16 len; 676e80d4af0SHarald Freudenberger u8 *mem, *ptr; 677e80d4af0SHarald Freudenberger struct CPRBX *preqcblk, *prepcblk; 678e80d4af0SHarald Freudenberger struct ica_xcRB xcrb; 679e80d4af0SHarald Freudenberger struct fqreqparm { 680e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 681e80d4af0SHarald Freudenberger u16 rule_array_len; 682e80d4af0SHarald Freudenberger char rule_array[8]; 683e80d4af0SHarald Freudenberger struct lv1 { 684e80d4af0SHarald Freudenberger u16 len; 685e80d4af0SHarald Freudenberger u8 data[VARDATASIZE]; 686e80d4af0SHarald Freudenberger } lv1; 687e80d4af0SHarald Freudenberger u16 dummylen; 688e80d4af0SHarald Freudenberger } *preqparm; 689e80d4af0SHarald Freudenberger size_t parmbsize = sizeof(struct fqreqparm); 690e80d4af0SHarald Freudenberger struct fqrepparm { 691e80d4af0SHarald Freudenberger u8 subfunc_code[2]; 692e80d4af0SHarald Freudenberger u8 lvdata[0]; 693e80d4af0SHarald Freudenberger } *prepparm; 694e80d4af0SHarald Freudenberger 695e80d4af0SHarald Freudenberger /* get already prepared memory for 2 cprbs with param block each */ 696e80d4af0SHarald Freudenberger rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk); 697e80d4af0SHarald Freudenberger if (rc) 698e80d4af0SHarald Freudenberger return rc; 699e80d4af0SHarald Freudenberger 700e80d4af0SHarald Freudenberger /* fill request cprb struct */ 701e80d4af0SHarald Freudenberger preqcblk->domain = domain; 702e80d4af0SHarald Freudenberger 703e80d4af0SHarald Freudenberger /* fill request cprb param block with FQ request */ 704e80d4af0SHarald Freudenberger preqparm = (struct fqreqparm *) preqcblk->req_parmb; 705e80d4af0SHarald Freudenberger memcpy(preqparm->subfunc_code, "FQ", 2); 706e80d4af0SHarald Freudenberger strncpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array)); 707e80d4af0SHarald Freudenberger preqparm->rule_array_len = 708e80d4af0SHarald Freudenberger sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array); 709e80d4af0SHarald Freudenberger preqparm->lv1.len = sizeof(preqparm->lv1); 710e80d4af0SHarald Freudenberger preqparm->dummylen = sizeof(preqparm->dummylen); 711e80d4af0SHarald Freudenberger preqcblk->req_parml = parmbsize; 712e80d4af0SHarald Freudenberger 713e80d4af0SHarald Freudenberger /* fill xcrb struct */ 714e80d4af0SHarald Freudenberger prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk); 715e80d4af0SHarald Freudenberger 716e80d4af0SHarald Freudenberger /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */ 717e80d4af0SHarald Freudenberger rc = _zcrypt_send_cprb(&xcrb); 718e80d4af0SHarald Freudenberger if (rc) { 719e80d4af0SHarald Freudenberger DEBUG_ERR( 720e80d4af0SHarald Freudenberger "query_crypto_facility zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n", 721e80d4af0SHarald Freudenberger (int) cardnr, (int) domain, rc); 722e80d4af0SHarald Freudenberger goto out; 723e80d4af0SHarald Freudenberger } 724e80d4af0SHarald Freudenberger 725e80d4af0SHarald Freudenberger /* check response returncode and reasoncode */ 726e80d4af0SHarald Freudenberger if (prepcblk->ccp_rtcode != 0) { 727e80d4af0SHarald Freudenberger DEBUG_ERR( 728e80d4af0SHarald Freudenberger "query_crypto_facility unwrap secure key failure, card response %d/%d\n", 729e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rtcode, 730e80d4af0SHarald Freudenberger (int) prepcblk->ccp_rscode); 731e80d4af0SHarald Freudenberger rc = -EIO; 732e80d4af0SHarald Freudenberger goto out; 733e80d4af0SHarald Freudenberger } 734e80d4af0SHarald Freudenberger 735e80d4af0SHarald Freudenberger /* process response cprb param block */ 736e80d4af0SHarald Freudenberger prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX); 737e80d4af0SHarald Freudenberger prepparm = (struct fqrepparm *) prepcblk->rpl_parmb; 738e80d4af0SHarald Freudenberger ptr = prepparm->lvdata; 739e80d4af0SHarald Freudenberger 740e80d4af0SHarald Freudenberger /* check and possibly copy reply rule array */ 741e80d4af0SHarald Freudenberger len = *((u16 *) ptr); 742e80d4af0SHarald Freudenberger if (len > sizeof(u16)) { 743e80d4af0SHarald Freudenberger ptr += sizeof(u16); 744e80d4af0SHarald Freudenberger len -= sizeof(u16); 745e80d4af0SHarald Freudenberger if (rarray && rarraylen && *rarraylen > 0) { 746e80d4af0SHarald Freudenberger *rarraylen = (len > *rarraylen ? *rarraylen : len); 747e80d4af0SHarald Freudenberger memcpy(rarray, ptr, *rarraylen); 748e80d4af0SHarald Freudenberger } 749e80d4af0SHarald Freudenberger ptr += len; 750e80d4af0SHarald Freudenberger } 751e80d4af0SHarald Freudenberger /* check and possible copy reply var array */ 752e80d4af0SHarald Freudenberger len = *((u16 *) ptr); 753e80d4af0SHarald Freudenberger if (len > sizeof(u16)) { 754e80d4af0SHarald Freudenberger ptr += sizeof(u16); 755e80d4af0SHarald Freudenberger len -= sizeof(u16); 756e80d4af0SHarald Freudenberger if (varray && varraylen && *varraylen > 0) { 757e80d4af0SHarald Freudenberger *varraylen = (len > *varraylen ? *varraylen : len); 758e80d4af0SHarald Freudenberger memcpy(varray, ptr, *varraylen); 759e80d4af0SHarald Freudenberger } 760e80d4af0SHarald Freudenberger ptr += len; 761e80d4af0SHarald Freudenberger } 762e80d4af0SHarald Freudenberger 763e80d4af0SHarald Freudenberger out: 764e80d4af0SHarald Freudenberger free_cprbmem(mem, parmbsize, 0); 765e80d4af0SHarald Freudenberger return rc; 766e80d4af0SHarald Freudenberger } 767e80d4af0SHarald Freudenberger 768e80d4af0SHarald Freudenberger /* 769ca681ec8SHarald Freudenberger * Fetch the current and old mkvp values via 770ca681ec8SHarald Freudenberger * query_crypto_facility from adapter. 771e80d4af0SHarald Freudenberger */ 772ca681ec8SHarald Freudenberger static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2]) 773e80d4af0SHarald Freudenberger { 774e80d4af0SHarald Freudenberger int rc, found = 0; 775e80d4af0SHarald Freudenberger size_t rlen, vlen; 776e80d4af0SHarald Freudenberger u8 *rarray, *varray, *pg; 777e80d4af0SHarald Freudenberger 778e80d4af0SHarald Freudenberger pg = (u8 *) __get_free_page(GFP_KERNEL); 779e80d4af0SHarald Freudenberger if (!pg) 780e80d4af0SHarald Freudenberger return -ENOMEM; 781e80d4af0SHarald Freudenberger rarray = pg; 782e80d4af0SHarald Freudenberger varray = pg + PAGE_SIZE/2; 783e80d4af0SHarald Freudenberger rlen = vlen = PAGE_SIZE/2; 784e80d4af0SHarald Freudenberger 785e80d4af0SHarald Freudenberger rc = query_crypto_facility(cardnr, domain, "STATICSA", 786e80d4af0SHarald Freudenberger rarray, &rlen, varray, &vlen); 787e80d4af0SHarald Freudenberger if (rc == 0 && rlen > 8*8 && vlen > 184+8) { 788ca681ec8SHarald Freudenberger if (rarray[8*8] == '2') { 789e80d4af0SHarald Freudenberger /* current master key state is valid */ 790ca681ec8SHarald Freudenberger mkvp[0] = *((u64 *)(varray + 184)); 791ca681ec8SHarald Freudenberger mkvp[1] = *((u64 *)(varray + 172)); 792e80d4af0SHarald Freudenberger found = 1; 793e80d4af0SHarald Freudenberger } 794e80d4af0SHarald Freudenberger } 795e80d4af0SHarald Freudenberger 796e80d4af0SHarald Freudenberger free_page((unsigned long) pg); 797e80d4af0SHarald Freudenberger 798e80d4af0SHarald Freudenberger return found ? 0 : -ENOENT; 799e80d4af0SHarald Freudenberger } 800e80d4af0SHarald Freudenberger 801e80d4af0SHarald Freudenberger /* struct to hold cached mkvp info for each card/domain */ 802e80d4af0SHarald Freudenberger struct mkvp_info { 803e80d4af0SHarald Freudenberger struct list_head list; 804e80d4af0SHarald Freudenberger u16 cardnr; 805e80d4af0SHarald Freudenberger u16 domain; 806ca681ec8SHarald Freudenberger u64 mkvp[2]; 807e80d4af0SHarald Freudenberger }; 808e80d4af0SHarald Freudenberger 809e80d4af0SHarald Freudenberger /* a list with mkvp_info entries */ 810e80d4af0SHarald Freudenberger static LIST_HEAD(mkvp_list); 811e80d4af0SHarald Freudenberger static DEFINE_SPINLOCK(mkvp_list_lock); 812e80d4af0SHarald Freudenberger 813ca681ec8SHarald Freudenberger static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2]) 814e80d4af0SHarald Freudenberger { 815e80d4af0SHarald Freudenberger int rc = -ENOENT; 816e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 817e80d4af0SHarald Freudenberger 818e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 819e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 820e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 821e80d4af0SHarald Freudenberger ptr->domain == domain) { 822ca681ec8SHarald Freudenberger memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64)); 823e80d4af0SHarald Freudenberger rc = 0; 824e80d4af0SHarald Freudenberger break; 825e80d4af0SHarald Freudenberger } 826e80d4af0SHarald Freudenberger } 827e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 828e80d4af0SHarald Freudenberger 829e80d4af0SHarald Freudenberger return rc; 830e80d4af0SHarald Freudenberger } 831e80d4af0SHarald Freudenberger 832ca681ec8SHarald Freudenberger static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2]) 833e80d4af0SHarald Freudenberger { 834e80d4af0SHarald Freudenberger int found = 0; 835e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 836e80d4af0SHarald Freudenberger 837e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 838e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 839e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 840e80d4af0SHarald Freudenberger ptr->domain == domain) { 841ca681ec8SHarald Freudenberger memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64)); 842e80d4af0SHarald Freudenberger found = 1; 843e80d4af0SHarald Freudenberger break; 844e80d4af0SHarald Freudenberger } 845e80d4af0SHarald Freudenberger } 846e80d4af0SHarald Freudenberger if (!found) { 847e80d4af0SHarald Freudenberger ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC); 848e80d4af0SHarald Freudenberger if (!ptr) { 849e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 850e80d4af0SHarald Freudenberger return; 851e80d4af0SHarald Freudenberger } 852e80d4af0SHarald Freudenberger ptr->cardnr = cardnr; 853e80d4af0SHarald Freudenberger ptr->domain = domain; 854ca681ec8SHarald Freudenberger memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64)); 855e80d4af0SHarald Freudenberger list_add(&ptr->list, &mkvp_list); 856e80d4af0SHarald Freudenberger } 857e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 858e80d4af0SHarald Freudenberger } 859e80d4af0SHarald Freudenberger 860e80d4af0SHarald Freudenberger static void mkvp_cache_scrub(u16 cardnr, u16 domain) 861e80d4af0SHarald Freudenberger { 862e80d4af0SHarald Freudenberger struct mkvp_info *ptr; 863e80d4af0SHarald Freudenberger 864e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 865e80d4af0SHarald Freudenberger list_for_each_entry(ptr, &mkvp_list, list) { 866e80d4af0SHarald Freudenberger if (ptr->cardnr == cardnr && 867e80d4af0SHarald Freudenberger ptr->domain == domain) { 868e80d4af0SHarald Freudenberger list_del(&ptr->list); 869e80d4af0SHarald Freudenberger kfree(ptr); 870e80d4af0SHarald Freudenberger break; 871e80d4af0SHarald Freudenberger } 872e80d4af0SHarald Freudenberger } 873e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 874e80d4af0SHarald Freudenberger } 875e80d4af0SHarald Freudenberger 876e80d4af0SHarald Freudenberger static void __exit mkvp_cache_free(void) 877e80d4af0SHarald Freudenberger { 878e80d4af0SHarald Freudenberger struct mkvp_info *ptr, *pnext; 879e80d4af0SHarald Freudenberger 880e80d4af0SHarald Freudenberger spin_lock_bh(&mkvp_list_lock); 881e80d4af0SHarald Freudenberger list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) { 882e80d4af0SHarald Freudenberger list_del(&ptr->list); 883e80d4af0SHarald Freudenberger kfree(ptr); 884e80d4af0SHarald Freudenberger } 885e80d4af0SHarald Freudenberger spin_unlock_bh(&mkvp_list_lock); 886e80d4af0SHarald Freudenberger } 887e80d4af0SHarald Freudenberger 888e80d4af0SHarald Freudenberger /* 889e80d4af0SHarald Freudenberger * Search for a matching crypto card based on the Master Key 890e80d4af0SHarald Freudenberger * Verification Pattern provided inside a secure key. 891e80d4af0SHarald Freudenberger */ 892e80d4af0SHarald Freudenberger int pkey_findcard(const struct pkey_seckey *seckey, 893e80d4af0SHarald Freudenberger u16 *pcardnr, u16 *pdomain, int verify) 894e80d4af0SHarald Freudenberger { 895e80d4af0SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) seckey; 896e80d4af0SHarald Freudenberger struct zcrypt_device_matrix *device_matrix; 897e80d4af0SHarald Freudenberger u16 card, dom; 898ca681ec8SHarald Freudenberger u64 mkvp[2]; 899ca681ec8SHarald Freudenberger int i, rc, oi = -1; 900e80d4af0SHarald Freudenberger 901e80d4af0SHarald Freudenberger /* mkvp must not be zero */ 902e80d4af0SHarald Freudenberger if (t->mkvp == 0) 903e80d4af0SHarald Freudenberger return -EINVAL; 904e80d4af0SHarald Freudenberger 905e80d4af0SHarald Freudenberger /* fetch status of all crypto cards */ 906e80d4af0SHarald Freudenberger device_matrix = kmalloc(sizeof(struct zcrypt_device_matrix), 907e80d4af0SHarald Freudenberger GFP_KERNEL); 908e80d4af0SHarald Freudenberger if (!device_matrix) 909e80d4af0SHarald Freudenberger return -ENOMEM; 910e80d4af0SHarald Freudenberger zcrypt_device_status_mask(device_matrix); 911e80d4af0SHarald Freudenberger 912e80d4af0SHarald Freudenberger /* walk through all crypto cards */ 913e80d4af0SHarald Freudenberger for (i = 0; i < MAX_ZDEV_ENTRIES; i++) { 914e80d4af0SHarald Freudenberger card = AP_QID_CARD(device_matrix->device[i].qid); 915e80d4af0SHarald Freudenberger dom = AP_QID_QUEUE(device_matrix->device[i].qid); 916e80d4af0SHarald Freudenberger if (device_matrix->device[i].online && 917e80d4af0SHarald Freudenberger device_matrix->device[i].functions & 0x04) { 918e80d4af0SHarald Freudenberger /* an enabled CCA Coprocessor card */ 919e80d4af0SHarald Freudenberger /* try cached mkvp */ 920ca681ec8SHarald Freudenberger if (mkvp_cache_fetch(card, dom, mkvp) == 0 && 921ca681ec8SHarald Freudenberger t->mkvp == mkvp[0]) { 922e80d4af0SHarald Freudenberger if (!verify) 923e80d4af0SHarald Freudenberger break; 924e80d4af0SHarald Freudenberger /* verify: fetch mkvp from adapter */ 925ca681ec8SHarald Freudenberger if (fetch_mkvp(card, dom, mkvp) == 0) { 926e80d4af0SHarald Freudenberger mkvp_cache_update(card, dom, mkvp); 927ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[0]) 928e80d4af0SHarald Freudenberger break; 929e80d4af0SHarald Freudenberger } 930e80d4af0SHarald Freudenberger } 931e80d4af0SHarald Freudenberger } else { 932e80d4af0SHarald Freudenberger /* Card is offline and/or not a CCA card. */ 933e80d4af0SHarald Freudenberger /* del mkvp entry from cache if it exists */ 934e80d4af0SHarald Freudenberger mkvp_cache_scrub(card, dom); 935e80d4af0SHarald Freudenberger } 936e80d4af0SHarald Freudenberger } 937e80d4af0SHarald Freudenberger if (i >= MAX_ZDEV_ENTRIES) { 938e80d4af0SHarald Freudenberger /* nothing found, so this time without cache */ 939e80d4af0SHarald Freudenberger for (i = 0; i < MAX_ZDEV_ENTRIES; i++) { 940e80d4af0SHarald Freudenberger if (!(device_matrix->device[i].online && 941e80d4af0SHarald Freudenberger device_matrix->device[i].functions & 0x04)) 942e80d4af0SHarald Freudenberger continue; 943e80d4af0SHarald Freudenberger card = AP_QID_CARD(device_matrix->device[i].qid); 944e80d4af0SHarald Freudenberger dom = AP_QID_QUEUE(device_matrix->device[i].qid); 945e80d4af0SHarald Freudenberger /* fresh fetch mkvp from adapter */ 946ca681ec8SHarald Freudenberger if (fetch_mkvp(card, dom, mkvp) == 0) { 947e80d4af0SHarald Freudenberger mkvp_cache_update(card, dom, mkvp); 948ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[0]) 949e80d4af0SHarald Freudenberger break; 950ca681ec8SHarald Freudenberger if (t->mkvp == mkvp[1] && oi < 0) 951ca681ec8SHarald Freudenberger oi = i; 952e80d4af0SHarald Freudenberger } 953e80d4af0SHarald Freudenberger } 954ca681ec8SHarald Freudenberger if (i >= MAX_ZDEV_ENTRIES && oi >= 0) { 955ca681ec8SHarald Freudenberger /* old mkvp matched, use this card then */ 956ca681ec8SHarald Freudenberger card = AP_QID_CARD(device_matrix->device[oi].qid); 957ca681ec8SHarald Freudenberger dom = AP_QID_QUEUE(device_matrix->device[oi].qid); 958e80d4af0SHarald Freudenberger } 959ca681ec8SHarald Freudenberger } 960ca681ec8SHarald Freudenberger if (i < MAX_ZDEV_ENTRIES || oi >= 0) { 961e80d4af0SHarald Freudenberger if (pcardnr) 962e80d4af0SHarald Freudenberger *pcardnr = card; 963e80d4af0SHarald Freudenberger if (pdomain) 964e80d4af0SHarald Freudenberger *pdomain = dom; 965e80d4af0SHarald Freudenberger rc = 0; 966e80d4af0SHarald Freudenberger } else 967e80d4af0SHarald Freudenberger rc = -ENODEV; 968e80d4af0SHarald Freudenberger 969e80d4af0SHarald Freudenberger kfree(device_matrix); 970e80d4af0SHarald Freudenberger return rc; 971e80d4af0SHarald Freudenberger } 972e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_findcard); 973e80d4af0SHarald Freudenberger 974e80d4af0SHarald Freudenberger /* 975e80d4af0SHarald Freudenberger * Find card and transform secure key into protected key. 976e80d4af0SHarald Freudenberger */ 977e80d4af0SHarald Freudenberger int pkey_skey2pkey(const struct pkey_seckey *seckey, 978e80d4af0SHarald Freudenberger struct pkey_protkey *protkey) 979e80d4af0SHarald Freudenberger { 980e80d4af0SHarald Freudenberger u16 cardnr, domain; 981e80d4af0SHarald Freudenberger int rc, verify; 982e80d4af0SHarald Freudenberger 983e80d4af0SHarald Freudenberger /* 984e80d4af0SHarald Freudenberger * The pkey_sec2protkey call may fail when a card has been 985e80d4af0SHarald Freudenberger * addressed where the master key was changed after last fetch 986e80d4af0SHarald Freudenberger * of the mkvp into the cache. So first try without verify then 987e80d4af0SHarald Freudenberger * with verify enabled (thus refreshing the mkvp for each card). 988e80d4af0SHarald Freudenberger */ 989e80d4af0SHarald Freudenberger for (verify = 0; verify < 2; verify++) { 990e80d4af0SHarald Freudenberger rc = pkey_findcard(seckey, &cardnr, &domain, verify); 991e80d4af0SHarald Freudenberger if (rc) 992e80d4af0SHarald Freudenberger continue; 993e80d4af0SHarald Freudenberger rc = pkey_sec2protkey(cardnr, domain, seckey, protkey); 994e80d4af0SHarald Freudenberger if (rc == 0) 995e80d4af0SHarald Freudenberger break; 996e80d4af0SHarald Freudenberger } 997e80d4af0SHarald Freudenberger 998e80d4af0SHarald Freudenberger if (rc) 999e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_skey2pkey failed rc=%d\n", rc); 1000e80d4af0SHarald Freudenberger 1001e80d4af0SHarald Freudenberger return rc; 1002e80d4af0SHarald Freudenberger } 1003e80d4af0SHarald Freudenberger EXPORT_SYMBOL(pkey_skey2pkey); 1004e80d4af0SHarald Freudenberger 1005e80d4af0SHarald Freudenberger /* 1006e61a6134SHarald Freudenberger * Verify key and give back some info about the key. 1007e61a6134SHarald Freudenberger */ 1008e61a6134SHarald Freudenberger int pkey_verifykey(const struct pkey_seckey *seckey, 1009e61a6134SHarald Freudenberger u16 *pcardnr, u16 *pdomain, 1010e61a6134SHarald Freudenberger u16 *pkeysize, u32 *pattributes) 1011e61a6134SHarald Freudenberger { 1012e61a6134SHarald Freudenberger struct secaeskeytoken *t = (struct secaeskeytoken *) seckey; 1013e61a6134SHarald Freudenberger u16 cardnr, domain; 1014e61a6134SHarald Freudenberger u64 mkvp[2]; 1015e61a6134SHarald Freudenberger int rc; 1016e61a6134SHarald Freudenberger 1017e61a6134SHarald Freudenberger /* check the secure key for valid AES secure key */ 1018e61a6134SHarald Freudenberger rc = check_secaeskeytoken((u8 *) seckey, 0); 1019e61a6134SHarald Freudenberger if (rc) 1020e61a6134SHarald Freudenberger goto out; 1021e61a6134SHarald Freudenberger if (pattributes) 1022e61a6134SHarald Freudenberger *pattributes = PKEY_VERIFY_ATTR_AES; 1023e61a6134SHarald Freudenberger if (pkeysize) 1024e61a6134SHarald Freudenberger *pkeysize = t->bitsize; 1025e61a6134SHarald Freudenberger 1026e61a6134SHarald Freudenberger /* try to find a card which can handle this key */ 1027e61a6134SHarald Freudenberger rc = pkey_findcard(seckey, &cardnr, &domain, 1); 1028e61a6134SHarald Freudenberger if (rc) 1029e61a6134SHarald Freudenberger goto out; 1030e61a6134SHarald Freudenberger 1031e61a6134SHarald Freudenberger /* check mkvp for old mkvp match */ 1032e61a6134SHarald Freudenberger rc = mkvp_cache_fetch(cardnr, domain, mkvp); 1033e61a6134SHarald Freudenberger if (rc) 1034e61a6134SHarald Freudenberger goto out; 1035e61a6134SHarald Freudenberger if (t->mkvp == mkvp[1]) { 1036e61a6134SHarald Freudenberger DEBUG_DBG("pkey_verifykey secure key has old mkvp\n"); 1037e61a6134SHarald Freudenberger if (pattributes) 1038e61a6134SHarald Freudenberger *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP; 1039e61a6134SHarald Freudenberger } 1040e61a6134SHarald Freudenberger 1041e61a6134SHarald Freudenberger if (pcardnr) 1042e61a6134SHarald Freudenberger *pcardnr = cardnr; 1043e61a6134SHarald Freudenberger if (pdomain) 1044e61a6134SHarald Freudenberger *pdomain = domain; 1045e61a6134SHarald Freudenberger 1046e61a6134SHarald Freudenberger out: 1047e61a6134SHarald Freudenberger DEBUG_DBG("pkey_verifykey rc=%d\n", rc); 1048e61a6134SHarald Freudenberger return rc; 1049e61a6134SHarald Freudenberger } 1050e61a6134SHarald Freudenberger EXPORT_SYMBOL(pkey_verifykey); 1051e61a6134SHarald Freudenberger 1052e61a6134SHarald Freudenberger /* 1053e80d4af0SHarald Freudenberger * File io functions 1054e80d4af0SHarald Freudenberger */ 1055e80d4af0SHarald Freudenberger 1056e80d4af0SHarald Freudenberger static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, 1057e80d4af0SHarald Freudenberger unsigned long arg) 1058e80d4af0SHarald Freudenberger { 1059e80d4af0SHarald Freudenberger int rc; 1060e80d4af0SHarald Freudenberger 1061e80d4af0SHarald Freudenberger switch (cmd) { 1062e80d4af0SHarald Freudenberger case PKEY_GENSECK: { 1063e80d4af0SHarald Freudenberger struct pkey_genseck __user *ugs = (void __user *) arg; 1064e80d4af0SHarald Freudenberger struct pkey_genseck kgs; 1065e80d4af0SHarald Freudenberger 1066e80d4af0SHarald Freudenberger if (copy_from_user(&kgs, ugs, sizeof(kgs))) 1067e80d4af0SHarald Freudenberger return -EFAULT; 1068e80d4af0SHarald Freudenberger rc = pkey_genseckey(kgs.cardnr, kgs.domain, 1069e80d4af0SHarald Freudenberger kgs.keytype, &kgs.seckey); 1070e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_genseckey()=%d\n", rc); 1071e80d4af0SHarald Freudenberger if (rc) 1072e80d4af0SHarald Freudenberger break; 1073e80d4af0SHarald Freudenberger if (copy_to_user(ugs, &kgs, sizeof(kgs))) 1074e80d4af0SHarald Freudenberger return -EFAULT; 1075e80d4af0SHarald Freudenberger break; 1076e80d4af0SHarald Freudenberger } 1077e80d4af0SHarald Freudenberger case PKEY_CLR2SECK: { 1078e80d4af0SHarald Freudenberger struct pkey_clr2seck __user *ucs = (void __user *) arg; 1079e80d4af0SHarald Freudenberger struct pkey_clr2seck kcs; 1080e80d4af0SHarald Freudenberger 1081e80d4af0SHarald Freudenberger if (copy_from_user(&kcs, ucs, sizeof(kcs))) 1082e80d4af0SHarald Freudenberger return -EFAULT; 1083e80d4af0SHarald Freudenberger rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype, 1084e80d4af0SHarald Freudenberger &kcs.clrkey, &kcs.seckey); 1085e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_clr2seckey()=%d\n", rc); 1086e80d4af0SHarald Freudenberger if (rc) 1087e80d4af0SHarald Freudenberger break; 1088e80d4af0SHarald Freudenberger if (copy_to_user(ucs, &kcs, sizeof(kcs))) 1089e80d4af0SHarald Freudenberger return -EFAULT; 1090e80d4af0SHarald Freudenberger memzero_explicit(&kcs, sizeof(kcs)); 1091e80d4af0SHarald Freudenberger break; 1092e80d4af0SHarald Freudenberger } 1093e80d4af0SHarald Freudenberger case PKEY_SEC2PROTK: { 1094e80d4af0SHarald Freudenberger struct pkey_sec2protk __user *usp = (void __user *) arg; 1095e80d4af0SHarald Freudenberger struct pkey_sec2protk ksp; 1096e80d4af0SHarald Freudenberger 1097e80d4af0SHarald Freudenberger if (copy_from_user(&ksp, usp, sizeof(ksp))) 1098e80d4af0SHarald Freudenberger return -EFAULT; 1099e80d4af0SHarald Freudenberger rc = pkey_sec2protkey(ksp.cardnr, ksp.domain, 1100e80d4af0SHarald Freudenberger &ksp.seckey, &ksp.protkey); 1101e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_sec2protkey()=%d\n", rc); 1102e80d4af0SHarald Freudenberger if (rc) 1103e80d4af0SHarald Freudenberger break; 1104e80d4af0SHarald Freudenberger if (copy_to_user(usp, &ksp, sizeof(ksp))) 1105e80d4af0SHarald Freudenberger return -EFAULT; 1106e80d4af0SHarald Freudenberger break; 1107e80d4af0SHarald Freudenberger } 1108e80d4af0SHarald Freudenberger case PKEY_CLR2PROTK: { 1109e80d4af0SHarald Freudenberger struct pkey_clr2protk __user *ucp = (void __user *) arg; 1110e80d4af0SHarald Freudenberger struct pkey_clr2protk kcp; 1111e80d4af0SHarald Freudenberger 1112e80d4af0SHarald Freudenberger if (copy_from_user(&kcp, ucp, sizeof(kcp))) 1113e80d4af0SHarald Freudenberger return -EFAULT; 1114e80d4af0SHarald Freudenberger rc = pkey_clr2protkey(kcp.keytype, 1115e80d4af0SHarald Freudenberger &kcp.clrkey, &kcp.protkey); 1116e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_clr2protkey()=%d\n", rc); 1117e80d4af0SHarald Freudenberger if (rc) 1118e80d4af0SHarald Freudenberger break; 1119e80d4af0SHarald Freudenberger if (copy_to_user(ucp, &kcp, sizeof(kcp))) 1120e80d4af0SHarald Freudenberger return -EFAULT; 1121e80d4af0SHarald Freudenberger memzero_explicit(&kcp, sizeof(kcp)); 1122e80d4af0SHarald Freudenberger break; 1123e80d4af0SHarald Freudenberger } 1124e80d4af0SHarald Freudenberger case PKEY_FINDCARD: { 1125e80d4af0SHarald Freudenberger struct pkey_findcard __user *ufc = (void __user *) arg; 1126e80d4af0SHarald Freudenberger struct pkey_findcard kfc; 1127e80d4af0SHarald Freudenberger 1128e80d4af0SHarald Freudenberger if (copy_from_user(&kfc, ufc, sizeof(kfc))) 1129e80d4af0SHarald Freudenberger return -EFAULT; 1130e80d4af0SHarald Freudenberger rc = pkey_findcard(&kfc.seckey, 1131e80d4af0SHarald Freudenberger &kfc.cardnr, &kfc.domain, 1); 1132e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_findcard()=%d\n", rc); 1133e80d4af0SHarald Freudenberger if (rc) 1134e80d4af0SHarald Freudenberger break; 1135e80d4af0SHarald Freudenberger if (copy_to_user(ufc, &kfc, sizeof(kfc))) 1136e80d4af0SHarald Freudenberger return -EFAULT; 1137e80d4af0SHarald Freudenberger break; 1138e80d4af0SHarald Freudenberger } 1139e80d4af0SHarald Freudenberger case PKEY_SKEY2PKEY: { 1140e80d4af0SHarald Freudenberger struct pkey_skey2pkey __user *usp = (void __user *) arg; 1141e80d4af0SHarald Freudenberger struct pkey_skey2pkey ksp; 1142e80d4af0SHarald Freudenberger 1143e80d4af0SHarald Freudenberger if (copy_from_user(&ksp, usp, sizeof(ksp))) 1144e80d4af0SHarald Freudenberger return -EFAULT; 1145e80d4af0SHarald Freudenberger rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey); 1146e80d4af0SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_skey2pkey()=%d\n", rc); 1147e80d4af0SHarald Freudenberger if (rc) 1148e80d4af0SHarald Freudenberger break; 1149e80d4af0SHarald Freudenberger if (copy_to_user(usp, &ksp, sizeof(ksp))) 1150e80d4af0SHarald Freudenberger return -EFAULT; 1151e80d4af0SHarald Freudenberger break; 1152e80d4af0SHarald Freudenberger } 1153e61a6134SHarald Freudenberger case PKEY_VERIFYKEY: { 1154e61a6134SHarald Freudenberger struct pkey_verifykey __user *uvk = (void __user *) arg; 1155e61a6134SHarald Freudenberger struct pkey_verifykey kvk; 1156e61a6134SHarald Freudenberger 1157e61a6134SHarald Freudenberger if (copy_from_user(&kvk, uvk, sizeof(kvk))) 1158e61a6134SHarald Freudenberger return -EFAULT; 1159e61a6134SHarald Freudenberger rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain, 1160e61a6134SHarald Freudenberger &kvk.keysize, &kvk.attributes); 1161e61a6134SHarald Freudenberger DEBUG_DBG("pkey_ioctl pkey_verifykey()=%d\n", rc); 1162e61a6134SHarald Freudenberger if (rc) 1163e61a6134SHarald Freudenberger break; 1164e61a6134SHarald Freudenberger if (copy_to_user(uvk, &kvk, sizeof(kvk))) 1165e61a6134SHarald Freudenberger return -EFAULT; 1166e61a6134SHarald Freudenberger break; 1167e61a6134SHarald Freudenberger } 1168e80d4af0SHarald Freudenberger default: 1169e80d4af0SHarald Freudenberger /* unknown/unsupported ioctl cmd */ 1170e80d4af0SHarald Freudenberger return -ENOTTY; 1171e80d4af0SHarald Freudenberger } 1172e80d4af0SHarald Freudenberger 1173e80d4af0SHarald Freudenberger return rc; 1174e80d4af0SHarald Freudenberger } 1175e80d4af0SHarald Freudenberger 1176e80d4af0SHarald Freudenberger /* 1177e80d4af0SHarald Freudenberger * Sysfs and file io operations 1178e80d4af0SHarald Freudenberger */ 1179e80d4af0SHarald Freudenberger static const struct file_operations pkey_fops = { 1180e80d4af0SHarald Freudenberger .owner = THIS_MODULE, 1181e80d4af0SHarald Freudenberger .open = nonseekable_open, 1182e80d4af0SHarald Freudenberger .llseek = no_llseek, 1183e80d4af0SHarald Freudenberger .unlocked_ioctl = pkey_unlocked_ioctl, 1184e80d4af0SHarald Freudenberger }; 1185e80d4af0SHarald Freudenberger 1186e80d4af0SHarald Freudenberger static struct miscdevice pkey_dev = { 1187e80d4af0SHarald Freudenberger .name = "pkey", 1188e80d4af0SHarald Freudenberger .minor = MISC_DYNAMIC_MINOR, 1189e80d4af0SHarald Freudenberger .mode = 0666, 1190e80d4af0SHarald Freudenberger .fops = &pkey_fops, 1191e80d4af0SHarald Freudenberger }; 1192e80d4af0SHarald Freudenberger 1193e80d4af0SHarald Freudenberger /* 1194e80d4af0SHarald Freudenberger * Module init 1195e80d4af0SHarald Freudenberger */ 1196cb4ef3c2SHeiko Carstens static int __init pkey_init(void) 1197e80d4af0SHarald Freudenberger { 1198e80d4af0SHarald Freudenberger cpacf_mask_t pckmo_functions; 1199e80d4af0SHarald Freudenberger 1200e80d4af0SHarald Freudenberger /* check for pckmo instructions available */ 1201e80d4af0SHarald Freudenberger if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) 1202e80d4af0SHarald Freudenberger return -EOPNOTSUPP; 1203e80d4af0SHarald Freudenberger if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) || 1204e80d4af0SHarald Freudenberger !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) || 1205e80d4af0SHarald Freudenberger !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY)) 1206e80d4af0SHarald Freudenberger return -EOPNOTSUPP; 1207e80d4af0SHarald Freudenberger 1208e80d4af0SHarald Freudenberger pkey_debug_init(); 1209e80d4af0SHarald Freudenberger 1210e80d4af0SHarald Freudenberger return misc_register(&pkey_dev); 1211e80d4af0SHarald Freudenberger } 1212e80d4af0SHarald Freudenberger 1213e80d4af0SHarald Freudenberger /* 1214e80d4af0SHarald Freudenberger * Module exit 1215e80d4af0SHarald Freudenberger */ 1216e80d4af0SHarald Freudenberger static void __exit pkey_exit(void) 1217e80d4af0SHarald Freudenberger { 1218e80d4af0SHarald Freudenberger misc_deregister(&pkey_dev); 1219e80d4af0SHarald Freudenberger mkvp_cache_free(); 1220e80d4af0SHarald Freudenberger pkey_debug_exit(); 1221e80d4af0SHarald Freudenberger } 1222e80d4af0SHarald Freudenberger 1223e80d4af0SHarald Freudenberger module_init(pkey_init); 1224e80d4af0SHarald Freudenberger module_exit(pkey_exit); 1225