1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * Copyright IBM Corp. 2019 4 * Author(s): Harald Freudenberger <freude@linux.ibm.com> 5 * 6 * Collection of EP11 misc functions used by zcrypt and pkey 7 */ 8 9 #ifndef _ZCRYPT_EP11MISC_H_ 10 #define _ZCRYPT_EP11MISC_H_ 11 12 #include <asm/zcrypt.h> 13 #include <asm/pkey.h> 14 15 #define TOKVER_EP11_AES 0x03 /* EP11 AES key blob */ 16 17 #define EP11_API_V 4 /* highest known and supported EP11 API version */ 18 19 #define EP11_STRUCT_MAGIC 0x1234 20 #define EP11_BLOB_PKEY_EXTRACTABLE 0x200000 21 22 /* inside view of an EP11 secure key blob */ 23 struct ep11keyblob { 24 union { 25 u8 session[32]; 26 struct { 27 u8 type; /* 0x00 (TOKTYPE_NON_CCA) */ 28 u8 res0; /* unused */ 29 u16 len; /* total length in bytes of this blob */ 30 u8 version; /* 0x06 (TOKVER_EP11_AES) */ 31 u8 res1; /* unused */ 32 u16 keybitlen; /* clear key bit len, 0 for unknown */ 33 } head; 34 }; 35 u8 wkvp[16]; /* wrapping key verification pattern */ 36 u64 attr; /* boolean key attributes */ 37 u64 mode; /* mode bits */ 38 u16 version; /* 0x1234, EP11_STRUCT_MAGIC */ 39 u8 iv[14]; 40 u8 encrypted_key_data[144]; 41 u8 mac[32]; 42 } __packed; 43 44 /* 45 * Simple check if the key blob is a valid EP11 secure AES key. 46 * If keybitsize is given, the bitsize of the key is also checked. 47 * If checkcpacfexport is enabled, the key is also checked for the 48 * attributes needed to export this key for CPACF use. 49 * Returns 0 on success or errno value on failure. 50 */ 51 int ep11_check_aeskeyblob(debug_info_t *dbg, int dbflvl, 52 const u8 *key, int keybitsize, 53 int checkcpacfexport); 54 55 /* EP11 card info struct */ 56 struct ep11_card_info { 57 u32 API_ord_nr; /* API ordinal number */ 58 u16 FW_version; /* Firmware major and minor version */ 59 char serial[16]; /* serial number string (16 ascii, no 0x00 !) */ 60 u64 op_mode; /* card operational mode(s) */ 61 }; 62 63 /* EP11 domain info struct */ 64 struct ep11_domain_info { 65 char cur_wk_state; /* '0' invalid, '1' valid */ 66 char new_wk_state; /* '0' empty, '1' uncommitted, '2' committed */ 67 u8 cur_wkvp[32]; /* current wrapping key verification pattern */ 68 u8 new_wkvp[32]; /* new wrapping key verification pattern */ 69 u64 op_mode; /* domain operational mode(s) */ 70 }; 71 72 /* 73 * Provide information about an EP11 card. 74 */ 75 int ep11_get_card_info(u16 card, struct ep11_card_info *info, int verify); 76 77 /* 78 * Provide information about a domain within an EP11 card. 79 */ 80 int ep11_get_domain_info(u16 card, u16 domain, struct ep11_domain_info *info); 81 82 /* 83 * Generate (random) EP11 AES secure key. 84 */ 85 int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, 86 u8 *keybuf, size_t *keybufsize); 87 88 /* 89 * Generate EP11 AES secure key with given clear key value. 90 */ 91 int ep11_clr2keyblob(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags, 92 const u8 *clrkey, u8 *keybuf, size_t *keybufsize); 93 94 /* 95 * Derive proteced key from EP11 AES secure key blob. 96 */ 97 int ep11_key2protkey(u16 cardnr, u16 domain, const u8 *key, size_t keylen, 98 u8 *protkey, u32 *protkeylen, u32 *protkeytype); 99 100 /* 101 * Build a list of ep11 apqns meeting the following constrains: 102 * - apqn is online and is in fact an EP11 apqn 103 * - if cardnr is not FFFF only apqns with this cardnr 104 * - if domain is not FFFF only apqns with this domainnr 105 * - if minhwtype > 0 only apqns with hwtype >= minhwtype 106 * - if minapi > 0 only apqns with API_ord_nr >= minapi 107 * - if wkvp != NULL only apqns where the wkvp (EP11_WKVPLEN bytes) matches 108 * to the first EP11_WKVPLEN bytes of the wkvp of the current wrapping 109 * key for this domain. When a wkvp is given there will aways be a re-fetch 110 * of the domain info for the potential apqn - so this triggers an request 111 * reply to each apqn eligible. 112 * The array of apqn entries is allocated with kmalloc and returned in *apqns; 113 * the number of apqns stored into the list is returned in *nr_apqns. One apqn 114 * entry is simple a 32 bit value with 16 bit cardnr and 16 bit domain nr and 115 * may be casted to struct pkey_apqn. The return value is either 0 for success 116 * or a negative errno value. If no apqn meeting the criterias is found, 117 * -ENODEV is returned. 118 */ 119 int ep11_findcard2(u32 **apqns, u32 *nr_apqns, u16 cardnr, u16 domain, 120 int minhwtype, int minapi, const u8 *wkvp); 121 122 void zcrypt_ep11misc_exit(void); 123 124 #endif /* _ZCRYPT_EP11MISC_H_ */ 125