zcrypt_ccamisc.c 51 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright IBM Corp. 2019
  4. * Author(s): Harald Freudenberger <freude@linux.ibm.com>
  5. * Ingo Franzki <ifranzki@linux.ibm.com>
  6. *
  7. * Collection of CCA misc functions used by zcrypt and pkey
  8. */
  9. #define KMSG_COMPONENT "zcrypt"
  10. #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  11. #include <linux/init.h>
  12. #include <linux/module.h>
  13. #include <linux/slab.h>
  14. #include <linux/random.h>
  15. #include <asm/zcrypt.h>
  16. #include <asm/pkey.h>
  17. #include "ap_bus.h"
  18. #include "zcrypt_api.h"
  19. #include "zcrypt_debug.h"
  20. #include "zcrypt_msgtype6.h"
  21. #include "zcrypt_ccamisc.h"
  22. #define DEBUG_DBG(...) ZCRYPT_DBF(DBF_DEBUG, ##__VA_ARGS__)
  23. #define DEBUG_INFO(...) ZCRYPT_DBF(DBF_INFO, ##__VA_ARGS__)
  24. #define DEBUG_WARN(...) ZCRYPT_DBF(DBF_WARN, ##__VA_ARGS__)
  25. #define DEBUG_ERR(...) ZCRYPT_DBF(DBF_ERR, ##__VA_ARGS__)
  26. /* Size of parameter block used for all cca requests/replies */
  27. #define PARMBSIZE 512
  28. /* Size of vardata block used for some of the cca requests/replies */
  29. #define VARDATASIZE 4096
  30. struct cca_info_list_entry {
  31. struct list_head list;
  32. u16 cardnr;
  33. u16 domain;
  34. struct cca_info info;
  35. };
  36. /* a list with cca_info_list_entry entries */
  37. static LIST_HEAD(cca_info_list);
  38. static DEFINE_SPINLOCK(cca_info_list_lock);
  39. /*
  40. * Simple check if the token is a valid CCA secure AES data key
  41. * token. If keybitsize is given, the bitsize of the key is
  42. * also checked. Returns 0 on success or errno value on failure.
  43. */
  44. int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
  45. const u8 *token, int keybitsize)
  46. {
  47. struct secaeskeytoken *t = (struct secaeskeytoken *) token;
  48. #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
  49. if (t->type != TOKTYPE_CCA_INTERNAL) {
  50. if (dbg)
  51. DBF("%s token check failed, type 0x%02x != 0x%02x\n",
  52. __func__, (int) t->type, TOKTYPE_CCA_INTERNAL);
  53. return -EINVAL;
  54. }
  55. if (t->version != TOKVER_CCA_AES) {
  56. if (dbg)
  57. DBF("%s token check failed, version 0x%02x != 0x%02x\n",
  58. __func__, (int) t->version, TOKVER_CCA_AES);
  59. return -EINVAL;
  60. }
  61. if (keybitsize > 0 && t->bitsize != keybitsize) {
  62. if (dbg)
  63. DBF("%s token check failed, bitsize %d != %d\n",
  64. __func__, (int) t->bitsize, keybitsize);
  65. return -EINVAL;
  66. }
  67. #undef DBF
  68. return 0;
  69. }
  70. EXPORT_SYMBOL(cca_check_secaeskeytoken);
  71. /*
  72. * Simple check if the token is a valid CCA secure AES cipher key
  73. * token. If keybitsize is given, the bitsize of the key is
  74. * also checked. If checkcpacfexport is enabled, the key is also
  75. * checked for the export flag to allow CPACF export.
  76. * Returns 0 on success or errno value on failure.
  77. */
  78. int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl,
  79. const u8 *token, int keybitsize,
  80. int checkcpacfexport)
  81. {
  82. struct cipherkeytoken *t = (struct cipherkeytoken *) token;
  83. bool keybitsizeok = true;
  84. #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
  85. if (t->type != TOKTYPE_CCA_INTERNAL) {
  86. if (dbg)
  87. DBF("%s token check failed, type 0x%02x != 0x%02x\n",
  88. __func__, (int) t->type, TOKTYPE_CCA_INTERNAL);
  89. return -EINVAL;
  90. }
  91. if (t->version != TOKVER_CCA_VLSC) {
  92. if (dbg)
  93. DBF("%s token check failed, version 0x%02x != 0x%02x\n",
  94. __func__, (int) t->version, TOKVER_CCA_VLSC);
  95. return -EINVAL;
  96. }
  97. if (t->algtype != 0x02) {
  98. if (dbg)
  99. DBF("%s token check failed, algtype 0x%02x != 0x02\n",
  100. __func__, (int) t->algtype);
  101. return -EINVAL;
  102. }
  103. if (t->keytype != 0x0001) {
  104. if (dbg)
  105. DBF("%s token check failed, keytype 0x%04x != 0x0001\n",
  106. __func__, (int) t->keytype);
  107. return -EINVAL;
  108. }
  109. if (t->plfver != 0x00 && t->plfver != 0x01) {
  110. if (dbg)
  111. DBF("%s token check failed, unknown plfver 0x%02x\n",
  112. __func__, (int) t->plfver);
  113. return -EINVAL;
  114. }
  115. if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) {
  116. if (dbg)
  117. DBF("%s token check failed, unknown wpllen %d\n",
  118. __func__, (int) t->wpllen);
  119. return -EINVAL;
  120. }
  121. if (keybitsize > 0) {
  122. switch (keybitsize) {
  123. case 128:
  124. if (t->wpllen != (t->plfver ? 640 : 512))
  125. keybitsizeok = false;
  126. break;
  127. case 192:
  128. if (t->wpllen != (t->plfver ? 640 : 576))
  129. keybitsizeok = false;
  130. break;
  131. case 256:
  132. if (t->wpllen != 640)
  133. keybitsizeok = false;
  134. break;
  135. default:
  136. keybitsizeok = false;
  137. break;
  138. }
  139. if (!keybitsizeok) {
  140. if (dbg)
  141. DBF("%s token check failed, bitsize %d\n",
  142. __func__, keybitsize);
  143. return -EINVAL;
  144. }
  145. }
  146. if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) {
  147. if (dbg)
  148. DBF("%s token check failed, XPRT_CPAC bit is 0\n",
  149. __func__);
  150. return -EINVAL;
  151. }
  152. #undef DBF
  153. return 0;
  154. }
  155. EXPORT_SYMBOL(cca_check_secaescipherkey);
  156. /*
  157. * Simple check if the token is a valid CCA secure ECC private
  158. * key token. Returns 0 on success or errno value on failure.
  159. */
  160. int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl,
  161. const u8 *token, size_t keysize,
  162. int checkcpacfexport)
  163. {
  164. struct eccprivkeytoken *t = (struct eccprivkeytoken *) token;
  165. #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
  166. if (t->type != TOKTYPE_CCA_INTERNAL_PKA) {
  167. if (dbg)
  168. DBF("%s token check failed, type 0x%02x != 0x%02x\n",
  169. __func__, (int) t->type, TOKTYPE_CCA_INTERNAL_PKA);
  170. return -EINVAL;
  171. }
  172. if (t->len > keysize) {
  173. if (dbg)
  174. DBF("%s token check failed, len %d > keysize %zu\n",
  175. __func__, (int) t->len, keysize);
  176. return -EINVAL;
  177. }
  178. if (t->secid != 0x20) {
  179. if (dbg)
  180. DBF("%s token check failed, secid 0x%02x != 0x20\n",
  181. __func__, (int) t->secid);
  182. return -EINVAL;
  183. }
  184. if (checkcpacfexport && !(t->kutc & 0x01)) {
  185. if (dbg)
  186. DBF("%s token check failed, XPRTCPAC bit is 0\n",
  187. __func__);
  188. return -EINVAL;
  189. }
  190. #undef DBF
  191. return 0;
  192. }
  193. EXPORT_SYMBOL(cca_check_sececckeytoken);
  194. /*
  195. * Allocate consecutive memory for request CPRB, request param
  196. * block, reply CPRB and reply param block and fill in values
  197. * for the common fields. Returns 0 on success or errno value
  198. * on failure.
  199. */
  200. static int alloc_and_prep_cprbmem(size_t paramblen,
  201. u8 **pcprbmem,
  202. struct CPRBX **preqCPRB,
  203. struct CPRBX **prepCPRB)
  204. {
  205. u8 *cprbmem;
  206. size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
  207. struct CPRBX *preqcblk, *prepcblk;
  208. /*
  209. * allocate consecutive memory for request CPRB, request param
  210. * block, reply CPRB and reply param block
  211. */
  212. cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
  213. if (!cprbmem)
  214. return -ENOMEM;
  215. preqcblk = (struct CPRBX *) cprbmem;
  216. prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
  217. /* fill request cprb struct */
  218. preqcblk->cprb_len = sizeof(struct CPRBX);
  219. preqcblk->cprb_ver_id = 0x02;
  220. memcpy(preqcblk->func_id, "T2", 2);
  221. preqcblk->rpl_msgbl = cprbplusparamblen;
  222. if (paramblen) {
  223. preqcblk->req_parmb =
  224. ((u8 __user *) preqcblk) + sizeof(struct CPRBX);
  225. preqcblk->rpl_parmb =
  226. ((u8 __user *) prepcblk) + sizeof(struct CPRBX);
  227. }
  228. *pcprbmem = cprbmem;
  229. *preqCPRB = preqcblk;
  230. *prepCPRB = prepcblk;
  231. return 0;
  232. }
  233. /*
  234. * Free the cprb memory allocated with the function above.
  235. * If the scrub value is not zero, the memory is filled
  236. * with zeros before freeing (useful if there was some
  237. * clear key material in there).
  238. */
  239. static void free_cprbmem(void *mem, size_t paramblen, int scrub)
  240. {
  241. if (scrub)
  242. memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
  243. kfree(mem);
  244. }
  245. /*
  246. * Helper function to prepare the xcrb struct
  247. */
  248. static inline void prep_xcrb(struct ica_xcRB *pxcrb,
  249. u16 cardnr,
  250. struct CPRBX *preqcblk,
  251. struct CPRBX *prepcblk)
  252. {
  253. memset(pxcrb, 0, sizeof(*pxcrb));
  254. pxcrb->agent_ID = 0x4341; /* 'CA' */
  255. pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
  256. pxcrb->request_control_blk_length =
  257. preqcblk->cprb_len + preqcblk->req_parml;
  258. pxcrb->request_control_blk_addr = (void __user *) preqcblk;
  259. pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
  260. pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
  261. }
  262. /*
  263. * Generate (random) CCA AES DATA secure key.
  264. */
  265. int cca_genseckey(u16 cardnr, u16 domain,
  266. u32 keybitsize, u8 seckey[SECKEYBLOBSIZE])
  267. {
  268. int i, rc, keysize;
  269. int seckeysize;
  270. u8 *mem, *ptr;
  271. struct CPRBX *preqcblk, *prepcblk;
  272. struct ica_xcRB xcrb;
  273. struct kgreqparm {
  274. u8 subfunc_code[2];
  275. u16 rule_array_len;
  276. struct lv1 {
  277. u16 len;
  278. char key_form[8];
  279. char key_length[8];
  280. char key_type1[8];
  281. char key_type2[8];
  282. } lv1;
  283. struct lv2 {
  284. u16 len;
  285. struct keyid {
  286. u16 len;
  287. u16 attr;
  288. u8 data[SECKEYBLOBSIZE];
  289. } keyid[6];
  290. } lv2;
  291. } __packed * preqparm;
  292. struct kgrepparm {
  293. u8 subfunc_code[2];
  294. u16 rule_array_len;
  295. struct lv3 {
  296. u16 len;
  297. u16 keyblocklen;
  298. struct {
  299. u16 toklen;
  300. u16 tokattr;
  301. u8 tok[0];
  302. /* ... some more data ... */
  303. } keyblock;
  304. } lv3;
  305. } __packed * prepparm;
  306. /* get already prepared memory for 2 cprbs with param block each */
  307. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  308. if (rc)
  309. return rc;
  310. /* fill request cprb struct */
  311. preqcblk->domain = domain;
  312. /* fill request cprb param block with KG request */
  313. preqparm = (struct kgreqparm __force *) preqcblk->req_parmb;
  314. memcpy(preqparm->subfunc_code, "KG", 2);
  315. preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
  316. preqparm->lv1.len = sizeof(struct lv1);
  317. memcpy(preqparm->lv1.key_form, "OP ", 8);
  318. switch (keybitsize) {
  319. case PKEY_SIZE_AES_128:
  320. case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
  321. keysize = 16;
  322. memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
  323. break;
  324. case PKEY_SIZE_AES_192:
  325. case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
  326. keysize = 24;
  327. memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
  328. break;
  329. case PKEY_SIZE_AES_256:
  330. case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
  331. keysize = 32;
  332. memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
  333. break;
  334. default:
  335. DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
  336. __func__, keybitsize);
  337. rc = -EINVAL;
  338. goto out;
  339. }
  340. memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
  341. preqparm->lv2.len = sizeof(struct lv2);
  342. for (i = 0; i < 6; i++) {
  343. preqparm->lv2.keyid[i].len = sizeof(struct keyid);
  344. preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
  345. }
  346. preqcblk->req_parml = sizeof(struct kgreqparm);
  347. /* fill xcrb struct */
  348. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  349. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  350. rc = zcrypt_send_cprb(&xcrb);
  351. if (rc) {
  352. DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
  353. __func__, (int) cardnr, (int) domain, rc);
  354. goto out;
  355. }
  356. /* check response returncode and reasoncode */
  357. if (prepcblk->ccp_rtcode != 0) {
  358. DEBUG_ERR("%s secure key generate failure, card response %d/%d\n",
  359. __func__,
  360. (int) prepcblk->ccp_rtcode,
  361. (int) prepcblk->ccp_rscode);
  362. rc = -EIO;
  363. goto out;
  364. }
  365. /* process response cprb param block */
  366. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  367. prepcblk->rpl_parmb = (u8 __user *) ptr;
  368. prepparm = (struct kgrepparm *) ptr;
  369. /* check length of the returned secure key token */
  370. seckeysize = prepparm->lv3.keyblock.toklen
  371. - sizeof(prepparm->lv3.keyblock.toklen)
  372. - sizeof(prepparm->lv3.keyblock.tokattr);
  373. if (seckeysize != SECKEYBLOBSIZE) {
  374. DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
  375. __func__, seckeysize, SECKEYBLOBSIZE);
  376. rc = -EIO;
  377. goto out;
  378. }
  379. /* check secure key token */
  380. rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
  381. prepparm->lv3.keyblock.tok, 8*keysize);
  382. if (rc) {
  383. rc = -EIO;
  384. goto out;
  385. }
  386. /* copy the generated secure key token */
  387. memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
  388. out:
  389. free_cprbmem(mem, PARMBSIZE, 0);
  390. return rc;
  391. }
  392. EXPORT_SYMBOL(cca_genseckey);
  393. /*
  394. * Generate an CCA AES DATA secure key with given key value.
  395. */
  396. int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize,
  397. const u8 *clrkey, u8 seckey[SECKEYBLOBSIZE])
  398. {
  399. int rc, keysize, seckeysize;
  400. u8 *mem, *ptr;
  401. struct CPRBX *preqcblk, *prepcblk;
  402. struct ica_xcRB xcrb;
  403. struct cmreqparm {
  404. u8 subfunc_code[2];
  405. u16 rule_array_len;
  406. char rule_array[8];
  407. struct lv1 {
  408. u16 len;
  409. u8 clrkey[0];
  410. } lv1;
  411. struct lv2 {
  412. u16 len;
  413. struct keyid {
  414. u16 len;
  415. u16 attr;
  416. u8 data[SECKEYBLOBSIZE];
  417. } keyid;
  418. } lv2;
  419. } __packed * preqparm;
  420. struct lv2 *plv2;
  421. struct cmrepparm {
  422. u8 subfunc_code[2];
  423. u16 rule_array_len;
  424. struct lv3 {
  425. u16 len;
  426. u16 keyblocklen;
  427. struct {
  428. u16 toklen;
  429. u16 tokattr;
  430. u8 tok[0];
  431. /* ... some more data ... */
  432. } keyblock;
  433. } lv3;
  434. } __packed * prepparm;
  435. /* get already prepared memory for 2 cprbs with param block each */
  436. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  437. if (rc)
  438. return rc;
  439. /* fill request cprb struct */
  440. preqcblk->domain = domain;
  441. /* fill request cprb param block with CM request */
  442. preqparm = (struct cmreqparm __force *) preqcblk->req_parmb;
  443. memcpy(preqparm->subfunc_code, "CM", 2);
  444. memcpy(preqparm->rule_array, "AES ", 8);
  445. preqparm->rule_array_len =
  446. sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
  447. switch (keybitsize) {
  448. case PKEY_SIZE_AES_128:
  449. case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
  450. keysize = 16;
  451. break;
  452. case PKEY_SIZE_AES_192:
  453. case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
  454. keysize = 24;
  455. break;
  456. case PKEY_SIZE_AES_256:
  457. case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
  458. keysize = 32;
  459. break;
  460. default:
  461. DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
  462. __func__, keybitsize);
  463. rc = -EINVAL;
  464. goto out;
  465. }
  466. preqparm->lv1.len = sizeof(struct lv1) + keysize;
  467. memcpy(preqparm->lv1.clrkey, clrkey, keysize);
  468. plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
  469. plv2->len = sizeof(struct lv2);
  470. plv2->keyid.len = sizeof(struct keyid);
  471. plv2->keyid.attr = 0x30;
  472. preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
  473. /* fill xcrb struct */
  474. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  475. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  476. rc = zcrypt_send_cprb(&xcrb);
  477. if (rc) {
  478. DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  479. __func__, (int) cardnr, (int) domain, rc);
  480. goto out;
  481. }
  482. /* check response returncode and reasoncode */
  483. if (prepcblk->ccp_rtcode != 0) {
  484. DEBUG_ERR("%s clear key import failure, card response %d/%d\n",
  485. __func__,
  486. (int) prepcblk->ccp_rtcode,
  487. (int) prepcblk->ccp_rscode);
  488. rc = -EIO;
  489. goto out;
  490. }
  491. /* process response cprb param block */
  492. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  493. prepcblk->rpl_parmb = (u8 __user *) ptr;
  494. prepparm = (struct cmrepparm *) ptr;
  495. /* check length of the returned secure key token */
  496. seckeysize = prepparm->lv3.keyblock.toklen
  497. - sizeof(prepparm->lv3.keyblock.toklen)
  498. - sizeof(prepparm->lv3.keyblock.tokattr);
  499. if (seckeysize != SECKEYBLOBSIZE) {
  500. DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
  501. __func__, seckeysize, SECKEYBLOBSIZE);
  502. rc = -EIO;
  503. goto out;
  504. }
  505. /* check secure key token */
  506. rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
  507. prepparm->lv3.keyblock.tok, 8*keysize);
  508. if (rc) {
  509. rc = -EIO;
  510. goto out;
  511. }
  512. /* copy the generated secure key token */
  513. if (seckey)
  514. memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
  515. out:
  516. free_cprbmem(mem, PARMBSIZE, 1);
  517. return rc;
  518. }
  519. EXPORT_SYMBOL(cca_clr2seckey);
  520. /*
  521. * Derive proteced key from an CCA AES DATA secure key.
  522. */
  523. int cca_sec2protkey(u16 cardnr, u16 domain,
  524. const u8 seckey[SECKEYBLOBSIZE],
  525. u8 *protkey, u32 *protkeylen, u32 *protkeytype)
  526. {
  527. int rc;
  528. u8 *mem, *ptr;
  529. struct CPRBX *preqcblk, *prepcblk;
  530. struct ica_xcRB xcrb;
  531. struct uskreqparm {
  532. u8 subfunc_code[2];
  533. u16 rule_array_len;
  534. struct lv1 {
  535. u16 len;
  536. u16 attr_len;
  537. u16 attr_flags;
  538. } lv1;
  539. struct lv2 {
  540. u16 len;
  541. u16 attr_len;
  542. u16 attr_flags;
  543. u8 token[0]; /* cca secure key token */
  544. } lv2;
  545. } __packed * preqparm;
  546. struct uskrepparm {
  547. u8 subfunc_code[2];
  548. u16 rule_array_len;
  549. struct lv3 {
  550. u16 len;
  551. u16 attr_len;
  552. u16 attr_flags;
  553. struct cpacfkeyblock {
  554. u8 version; /* version of this struct */
  555. u8 flags[2];
  556. u8 algo;
  557. u8 form;
  558. u8 pad1[3];
  559. u16 len;
  560. u8 key[64]; /* the key (len bytes) */
  561. u16 keyattrlen;
  562. u8 keyattr[32];
  563. u8 pad2[1];
  564. u8 vptype;
  565. u8 vp[32]; /* verification pattern */
  566. } ckb;
  567. } lv3;
  568. } __packed * prepparm;
  569. /* get already prepared memory for 2 cprbs with param block each */
  570. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  571. if (rc)
  572. return rc;
  573. /* fill request cprb struct */
  574. preqcblk->domain = domain;
  575. /* fill request cprb param block with USK request */
  576. preqparm = (struct uskreqparm __force *) preqcblk->req_parmb;
  577. memcpy(preqparm->subfunc_code, "US", 2);
  578. preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
  579. preqparm->lv1.len = sizeof(struct lv1);
  580. preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
  581. preqparm->lv1.attr_flags = 0x0001;
  582. preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
  583. preqparm->lv2.attr_len = sizeof(struct lv2)
  584. - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
  585. preqparm->lv2.attr_flags = 0x0000;
  586. memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
  587. preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
  588. /* fill xcrb struct */
  589. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  590. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  591. rc = zcrypt_send_cprb(&xcrb);
  592. if (rc) {
  593. DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  594. __func__, (int) cardnr, (int) domain, rc);
  595. goto out;
  596. }
  597. /* check response returncode and reasoncode */
  598. if (prepcblk->ccp_rtcode != 0) {
  599. DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
  600. __func__,
  601. (int) prepcblk->ccp_rtcode,
  602. (int) prepcblk->ccp_rscode);
  603. rc = -EIO;
  604. goto out;
  605. }
  606. if (prepcblk->ccp_rscode != 0) {
  607. DEBUG_WARN("%s unwrap secure key warning, card response %d/%d\n",
  608. __func__,
  609. (int) prepcblk->ccp_rtcode,
  610. (int) prepcblk->ccp_rscode);
  611. }
  612. /* process response cprb param block */
  613. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  614. prepcblk->rpl_parmb = (u8 __user *) ptr;
  615. prepparm = (struct uskrepparm *) ptr;
  616. /* check the returned keyblock */
  617. if (prepparm->lv3.ckb.version != 0x01 &&
  618. prepparm->lv3.ckb.version != 0x02) {
  619. DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
  620. __func__, (int) prepparm->lv3.ckb.version);
  621. rc = -EIO;
  622. goto out;
  623. }
  624. /* copy the tanslated protected key */
  625. switch (prepparm->lv3.ckb.len) {
  626. case 16+32:
  627. /* AES 128 protected key */
  628. if (protkeytype)
  629. *protkeytype = PKEY_KEYTYPE_AES_128;
  630. break;
  631. case 24+32:
  632. /* AES 192 protected key */
  633. if (protkeytype)
  634. *protkeytype = PKEY_KEYTYPE_AES_192;
  635. break;
  636. case 32+32:
  637. /* AES 256 protected key */
  638. if (protkeytype)
  639. *protkeytype = PKEY_KEYTYPE_AES_256;
  640. break;
  641. default:
  642. DEBUG_ERR("%s unknown/unsupported keylen %d\n",
  643. __func__, prepparm->lv3.ckb.len);
  644. rc = -EIO;
  645. goto out;
  646. }
  647. memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len);
  648. if (protkeylen)
  649. *protkeylen = prepparm->lv3.ckb.len;
  650. out:
  651. free_cprbmem(mem, PARMBSIZE, 0);
  652. return rc;
  653. }
  654. EXPORT_SYMBOL(cca_sec2protkey);
  655. /*
  656. * AES cipher key skeleton created with CSNBKTB2 with these flags:
  657. * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY,
  658. * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA
  659. * used by cca_gencipherkey() and cca_clr2cipherkey().
  660. */
  661. static const u8 aes_cipher_key_skeleton[] = {
  662. 0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00,
  663. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  664. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  665. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
  666. 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  667. 0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff,
  668. 0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 };
  669. #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton))
  670. /*
  671. * Generate (random) CCA AES CIPHER secure key.
  672. */
  673. int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
  674. u8 *keybuf, size_t *keybufsize)
  675. {
  676. int rc;
  677. u8 *mem, *ptr;
  678. struct CPRBX *preqcblk, *prepcblk;
  679. struct ica_xcRB xcrb;
  680. struct gkreqparm {
  681. u8 subfunc_code[2];
  682. u16 rule_array_len;
  683. char rule_array[2*8];
  684. struct {
  685. u16 len;
  686. u8 key_type_1[8];
  687. u8 key_type_2[8];
  688. u16 clear_key_bit_len;
  689. u16 key_name_1_len;
  690. u16 key_name_2_len;
  691. u16 user_data_1_len;
  692. u16 user_data_2_len;
  693. u8 key_name_1[0];
  694. u8 key_name_2[0];
  695. u8 user_data_1[0];
  696. u8 user_data_2[0];
  697. } vud;
  698. struct {
  699. u16 len;
  700. struct {
  701. u16 len;
  702. u16 flag;
  703. u8 kek_id_1[0];
  704. } tlv1;
  705. struct {
  706. u16 len;
  707. u16 flag;
  708. u8 kek_id_2[0];
  709. } tlv2;
  710. struct {
  711. u16 len;
  712. u16 flag;
  713. u8 gen_key_id_1[SIZEOF_SKELETON];
  714. } tlv3;
  715. struct {
  716. u16 len;
  717. u16 flag;
  718. u8 gen_key_id_1_label[0];
  719. } tlv4;
  720. struct {
  721. u16 len;
  722. u16 flag;
  723. u8 gen_key_id_2[0];
  724. } tlv5;
  725. struct {
  726. u16 len;
  727. u16 flag;
  728. u8 gen_key_id_2_label[0];
  729. } tlv6;
  730. } kb;
  731. } __packed * preqparm;
  732. struct gkrepparm {
  733. u8 subfunc_code[2];
  734. u16 rule_array_len;
  735. struct {
  736. u16 len;
  737. } vud;
  738. struct {
  739. u16 len;
  740. struct {
  741. u16 len;
  742. u16 flag;
  743. u8 gen_key[0]; /* 120-136 bytes */
  744. } tlv1;
  745. } kb;
  746. } __packed * prepparm;
  747. struct cipherkeytoken *t;
  748. /* get already prepared memory for 2 cprbs with param block each */
  749. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  750. if (rc)
  751. return rc;
  752. /* fill request cprb struct */
  753. preqcblk->domain = domain;
  754. preqcblk->req_parml = sizeof(struct gkreqparm);
  755. /* prepare request param block with GK request */
  756. preqparm = (struct gkreqparm __force *) preqcblk->req_parmb;
  757. memcpy(preqparm->subfunc_code, "GK", 2);
  758. preqparm->rule_array_len = sizeof(uint16_t) + 2 * 8;
  759. memcpy(preqparm->rule_array, "AES OP ", 2*8);
  760. /* prepare vud block */
  761. preqparm->vud.len = sizeof(preqparm->vud);
  762. switch (keybitsize) {
  763. case 128:
  764. case 192:
  765. case 256:
  766. break;
  767. default:
  768. DEBUG_ERR(
  769. "%s unknown/unsupported keybitsize %d\n",
  770. __func__, keybitsize);
  771. rc = -EINVAL;
  772. goto out;
  773. }
  774. preqparm->vud.clear_key_bit_len = keybitsize;
  775. memcpy(preqparm->vud.key_type_1, "TOKEN ", 8);
  776. memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2));
  777. /* prepare kb block */
  778. preqparm->kb.len = sizeof(preqparm->kb);
  779. preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1);
  780. preqparm->kb.tlv1.flag = 0x0030;
  781. preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2);
  782. preqparm->kb.tlv2.flag = 0x0030;
  783. preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3);
  784. preqparm->kb.tlv3.flag = 0x0030;
  785. memcpy(preqparm->kb.tlv3.gen_key_id_1,
  786. aes_cipher_key_skeleton, SIZEOF_SKELETON);
  787. preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4);
  788. preqparm->kb.tlv4.flag = 0x0030;
  789. preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5);
  790. preqparm->kb.tlv5.flag = 0x0030;
  791. preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6);
  792. preqparm->kb.tlv6.flag = 0x0030;
  793. /* patch the skeleton key token export flags inside the kb block */
  794. if (keygenflags) {
  795. t = (struct cipherkeytoken *) preqparm->kb.tlv3.gen_key_id_1;
  796. t->kmf1 |= (u16) (keygenflags & 0x0000FF00);
  797. t->kmf1 &= (u16) ~(keygenflags & 0x000000FF);
  798. }
  799. /* prepare xcrb struct */
  800. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  801. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  802. rc = zcrypt_send_cprb(&xcrb);
  803. if (rc) {
  804. DEBUG_ERR(
  805. "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  806. __func__, (int) cardnr, (int) domain, rc);
  807. goto out;
  808. }
  809. /* check response returncode and reasoncode */
  810. if (prepcblk->ccp_rtcode != 0) {
  811. DEBUG_ERR(
  812. "%s cipher key generate failure, card response %d/%d\n",
  813. __func__,
  814. (int) prepcblk->ccp_rtcode,
  815. (int) prepcblk->ccp_rscode);
  816. rc = -EIO;
  817. goto out;
  818. }
  819. /* process response cprb param block */
  820. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  821. prepcblk->rpl_parmb = (u8 __user *) ptr;
  822. prepparm = (struct gkrepparm *) ptr;
  823. /* do some plausibility checks on the key block */
  824. if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
  825. prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
  826. DEBUG_ERR("%s reply with invalid or unknown key block\n",
  827. __func__);
  828. rc = -EIO;
  829. goto out;
  830. }
  831. /* and some checks on the generated key */
  832. rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR,
  833. prepparm->kb.tlv1.gen_key,
  834. keybitsize, 1);
  835. if (rc) {
  836. rc = -EIO;
  837. goto out;
  838. }
  839. /* copy the generated vlsc key token */
  840. t = (struct cipherkeytoken *) prepparm->kb.tlv1.gen_key;
  841. if (keybuf) {
  842. if (*keybufsize >= t->len)
  843. memcpy(keybuf, t, t->len);
  844. else
  845. rc = -EINVAL;
  846. }
  847. *keybufsize = t->len;
  848. out:
  849. free_cprbmem(mem, PARMBSIZE, 0);
  850. return rc;
  851. }
  852. EXPORT_SYMBOL(cca_gencipherkey);
  853. /*
  854. * Helper function, does a the CSNBKPI2 CPRB.
  855. */
  856. static int _ip_cprb_helper(u16 cardnr, u16 domain,
  857. const char *rule_array_1,
  858. const char *rule_array_2,
  859. const char *rule_array_3,
  860. const u8 *clr_key_value,
  861. int clr_key_bit_size,
  862. u8 *key_token,
  863. int *key_token_size)
  864. {
  865. int rc, n;
  866. u8 *mem, *ptr;
  867. struct CPRBX *preqcblk, *prepcblk;
  868. struct ica_xcRB xcrb;
  869. struct rule_array_block {
  870. u8 subfunc_code[2];
  871. u16 rule_array_len;
  872. char rule_array[0];
  873. } __packed * preq_ra_block;
  874. struct vud_block {
  875. u16 len;
  876. struct {
  877. u16 len;
  878. u16 flag; /* 0x0064 */
  879. u16 clr_key_bit_len;
  880. } tlv1;
  881. struct {
  882. u16 len;
  883. u16 flag; /* 0x0063 */
  884. u8 clr_key[0]; /* clear key value bytes */
  885. } tlv2;
  886. } __packed * preq_vud_block;
  887. struct key_block {
  888. u16 len;
  889. struct {
  890. u16 len;
  891. u16 flag; /* 0x0030 */
  892. u8 key_token[0]; /* key skeleton */
  893. } tlv1;
  894. } __packed * preq_key_block;
  895. struct iprepparm {
  896. u8 subfunc_code[2];
  897. u16 rule_array_len;
  898. struct {
  899. u16 len;
  900. } vud;
  901. struct {
  902. u16 len;
  903. struct {
  904. u16 len;
  905. u16 flag; /* 0x0030 */
  906. u8 key_token[0]; /* key token */
  907. } tlv1;
  908. } kb;
  909. } __packed * prepparm;
  910. struct cipherkeytoken *t;
  911. int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1;
  912. /* get already prepared memory for 2 cprbs with param block each */
  913. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  914. if (rc)
  915. return rc;
  916. /* fill request cprb struct */
  917. preqcblk->domain = domain;
  918. preqcblk->req_parml = 0;
  919. /* prepare request param block with IP request */
  920. preq_ra_block = (struct rule_array_block __force *) preqcblk->req_parmb;
  921. memcpy(preq_ra_block->subfunc_code, "IP", 2);
  922. preq_ra_block->rule_array_len = sizeof(uint16_t) + 2 * 8;
  923. memcpy(preq_ra_block->rule_array, rule_array_1, 8);
  924. memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8);
  925. preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8;
  926. if (rule_array_3) {
  927. preq_ra_block->rule_array_len += 8;
  928. memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8);
  929. preqcblk->req_parml += 8;
  930. }
  931. /* prepare vud block */
  932. preq_vud_block = (struct vud_block __force *)
  933. (preqcblk->req_parmb + preqcblk->req_parml);
  934. n = complete ? 0 : (clr_key_bit_size + 7) / 8;
  935. preq_vud_block->len = sizeof(struct vud_block) + n;
  936. preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1);
  937. preq_vud_block->tlv1.flag = 0x0064;
  938. preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size;
  939. preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n;
  940. preq_vud_block->tlv2.flag = 0x0063;
  941. if (!complete)
  942. memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n);
  943. preqcblk->req_parml += preq_vud_block->len;
  944. /* prepare key block */
  945. preq_key_block = (struct key_block __force *)
  946. (preqcblk->req_parmb + preqcblk->req_parml);
  947. n = *key_token_size;
  948. preq_key_block->len = sizeof(struct key_block) + n;
  949. preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n;
  950. preq_key_block->tlv1.flag = 0x0030;
  951. memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size);
  952. preqcblk->req_parml += preq_key_block->len;
  953. /* prepare xcrb struct */
  954. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  955. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  956. rc = zcrypt_send_cprb(&xcrb);
  957. if (rc) {
  958. DEBUG_ERR(
  959. "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  960. __func__, (int) cardnr, (int) domain, rc);
  961. goto out;
  962. }
  963. /* check response returncode and reasoncode */
  964. if (prepcblk->ccp_rtcode != 0) {
  965. DEBUG_ERR(
  966. "%s CSNBKPI2 failure, card response %d/%d\n",
  967. __func__,
  968. (int) prepcblk->ccp_rtcode,
  969. (int) prepcblk->ccp_rscode);
  970. rc = -EIO;
  971. goto out;
  972. }
  973. /* process response cprb param block */
  974. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  975. prepcblk->rpl_parmb = (u8 __user *) ptr;
  976. prepparm = (struct iprepparm *) ptr;
  977. /* do some plausibility checks on the key block */
  978. if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
  979. prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
  980. DEBUG_ERR("%s reply with invalid or unknown key block\n",
  981. __func__);
  982. rc = -EIO;
  983. goto out;
  984. }
  985. /* do not check the key here, it may be incomplete */
  986. /* copy the vlsc key token back */
  987. t = (struct cipherkeytoken *) prepparm->kb.tlv1.key_token;
  988. memcpy(key_token, t, t->len);
  989. *key_token_size = t->len;
  990. out:
  991. free_cprbmem(mem, PARMBSIZE, 0);
  992. return rc;
  993. }
  994. /*
  995. * Build CCA AES CIPHER secure key with a given clear key value.
  996. */
  997. int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
  998. const u8 *clrkey, u8 *keybuf, size_t *keybufsize)
  999. {
  1000. int rc;
  1001. u8 *token;
  1002. int tokensize;
  1003. u8 exorbuf[32];
  1004. struct cipherkeytoken *t;
  1005. /* fill exorbuf with random data */
  1006. get_random_bytes(exorbuf, sizeof(exorbuf));
  1007. /* allocate space for the key token to build */
  1008. token = kmalloc(MAXCCAVLSCTOKENSIZE, GFP_KERNEL);
  1009. if (!token)
  1010. return -ENOMEM;
  1011. /* prepare the token with the key skeleton */
  1012. tokensize = SIZEOF_SKELETON;
  1013. memcpy(token, aes_cipher_key_skeleton, tokensize);
  1014. /* patch the skeleton key token export flags */
  1015. if (keygenflags) {
  1016. t = (struct cipherkeytoken *) token;
  1017. t->kmf1 |= (u16) (keygenflags & 0x0000FF00);
  1018. t->kmf1 &= (u16) ~(keygenflags & 0x000000FF);
  1019. }
  1020. /*
  1021. * Do the key import with the clear key value in 4 steps:
  1022. * 1/4 FIRST import with only random data
  1023. * 2/4 EXOR the clear key
  1024. * 3/4 EXOR the very same random data again
  1025. * 4/4 COMPLETE the secure cipher key import
  1026. */
  1027. rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
  1028. exorbuf, keybitsize, token, &tokensize);
  1029. if (rc) {
  1030. DEBUG_ERR(
  1031. "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
  1032. __func__, rc);
  1033. goto out;
  1034. }
  1035. rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
  1036. clrkey, keybitsize, token, &tokensize);
  1037. if (rc) {
  1038. DEBUG_ERR(
  1039. "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
  1040. __func__, rc);
  1041. goto out;
  1042. }
  1043. rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
  1044. exorbuf, keybitsize, token, &tokensize);
  1045. if (rc) {
  1046. DEBUG_ERR(
  1047. "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
  1048. __func__, rc);
  1049. goto out;
  1050. }
  1051. rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
  1052. NULL, keybitsize, token, &tokensize);
  1053. if (rc) {
  1054. DEBUG_ERR(
  1055. "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
  1056. __func__, rc);
  1057. goto out;
  1058. }
  1059. /* copy the generated key token */
  1060. if (keybuf) {
  1061. if (tokensize > *keybufsize)
  1062. rc = -EINVAL;
  1063. else
  1064. memcpy(keybuf, token, tokensize);
  1065. }
  1066. *keybufsize = tokensize;
  1067. out:
  1068. kfree(token);
  1069. return rc;
  1070. }
  1071. EXPORT_SYMBOL(cca_clr2cipherkey);
  1072. /*
  1073. * Derive proteced key from CCA AES cipher secure key.
  1074. */
  1075. int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
  1076. u8 *protkey, u32 *protkeylen, u32 *protkeytype)
  1077. {
  1078. int rc;
  1079. u8 *mem, *ptr;
  1080. struct CPRBX *preqcblk, *prepcblk;
  1081. struct ica_xcRB xcrb;
  1082. struct aureqparm {
  1083. u8 subfunc_code[2];
  1084. u16 rule_array_len;
  1085. u8 rule_array[8];
  1086. struct {
  1087. u16 len;
  1088. u16 tk_blob_len;
  1089. u16 tk_blob_tag;
  1090. u8 tk_blob[66];
  1091. } vud;
  1092. struct {
  1093. u16 len;
  1094. u16 cca_key_token_len;
  1095. u16 cca_key_token_flags;
  1096. u8 cca_key_token[0]; // 64 or more
  1097. } kb;
  1098. } __packed * preqparm;
  1099. struct aurepparm {
  1100. u8 subfunc_code[2];
  1101. u16 rule_array_len;
  1102. struct {
  1103. u16 len;
  1104. u16 sublen;
  1105. u16 tag;
  1106. struct cpacfkeyblock {
  1107. u8 version; /* version of this struct */
  1108. u8 flags[2];
  1109. u8 algo;
  1110. u8 form;
  1111. u8 pad1[3];
  1112. u16 keylen;
  1113. u8 key[64]; /* the key (keylen bytes) */
  1114. u16 keyattrlen;
  1115. u8 keyattr[32];
  1116. u8 pad2[1];
  1117. u8 vptype;
  1118. u8 vp[32]; /* verification pattern */
  1119. } ckb;
  1120. } vud;
  1121. struct {
  1122. u16 len;
  1123. } kb;
  1124. } __packed * prepparm;
  1125. int keytoklen = ((struct cipherkeytoken *)ckey)->len;
  1126. /* get already prepared memory for 2 cprbs with param block each */
  1127. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  1128. if (rc)
  1129. return rc;
  1130. /* fill request cprb struct */
  1131. preqcblk->domain = domain;
  1132. /* fill request cprb param block with AU request */
  1133. preqparm = (struct aureqparm __force *) preqcblk->req_parmb;
  1134. memcpy(preqparm->subfunc_code, "AU", 2);
  1135. preqparm->rule_array_len =
  1136. sizeof(preqparm->rule_array_len)
  1137. + sizeof(preqparm->rule_array);
  1138. memcpy(preqparm->rule_array, "EXPT-SK ", 8);
  1139. /* vud, tk blob */
  1140. preqparm->vud.len = sizeof(preqparm->vud);
  1141. preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
  1142. + 2 * sizeof(uint16_t);
  1143. preqparm->vud.tk_blob_tag = 0x00C2;
  1144. /* kb, cca token */
  1145. preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t);
  1146. preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t);
  1147. memcpy(preqparm->kb.cca_key_token, ckey, keytoklen);
  1148. /* now fill length of param block into cprb */
  1149. preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen;
  1150. /* fill xcrb struct */
  1151. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  1152. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  1153. rc = zcrypt_send_cprb(&xcrb);
  1154. if (rc) {
  1155. DEBUG_ERR(
  1156. "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  1157. __func__, (int) cardnr, (int) domain, rc);
  1158. goto out;
  1159. }
  1160. /* check response returncode and reasoncode */
  1161. if (prepcblk->ccp_rtcode != 0) {
  1162. DEBUG_ERR(
  1163. "%s unwrap secure key failure, card response %d/%d\n",
  1164. __func__,
  1165. (int) prepcblk->ccp_rtcode,
  1166. (int) prepcblk->ccp_rscode);
  1167. rc = -EIO;
  1168. goto out;
  1169. }
  1170. if (prepcblk->ccp_rscode != 0) {
  1171. DEBUG_WARN(
  1172. "%s unwrap secure key warning, card response %d/%d\n",
  1173. __func__,
  1174. (int) prepcblk->ccp_rtcode,
  1175. (int) prepcblk->ccp_rscode);
  1176. }
  1177. /* process response cprb param block */
  1178. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  1179. prepcblk->rpl_parmb = (u8 __user *) ptr;
  1180. prepparm = (struct aurepparm *) ptr;
  1181. /* check the returned keyblock */
  1182. if (prepparm->vud.ckb.version != 0x01 &&
  1183. prepparm->vud.ckb.version != 0x02) {
  1184. DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
  1185. __func__, (int) prepparm->vud.ckb.version);
  1186. rc = -EIO;
  1187. goto out;
  1188. }
  1189. if (prepparm->vud.ckb.algo != 0x02) {
  1190. DEBUG_ERR(
  1191. "%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
  1192. __func__, (int) prepparm->vud.ckb.algo);
  1193. rc = -EIO;
  1194. goto out;
  1195. }
  1196. /* copy the translated protected key */
  1197. switch (prepparm->vud.ckb.keylen) {
  1198. case 16+32:
  1199. /* AES 128 protected key */
  1200. if (protkeytype)
  1201. *protkeytype = PKEY_KEYTYPE_AES_128;
  1202. break;
  1203. case 24+32:
  1204. /* AES 192 protected key */
  1205. if (protkeytype)
  1206. *protkeytype = PKEY_KEYTYPE_AES_192;
  1207. break;
  1208. case 32+32:
  1209. /* AES 256 protected key */
  1210. if (protkeytype)
  1211. *protkeytype = PKEY_KEYTYPE_AES_256;
  1212. break;
  1213. default:
  1214. DEBUG_ERR("%s unknown/unsupported keylen %d\n",
  1215. __func__, prepparm->vud.ckb.keylen);
  1216. rc = -EIO;
  1217. goto out;
  1218. }
  1219. memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
  1220. if (protkeylen)
  1221. *protkeylen = prepparm->vud.ckb.keylen;
  1222. out:
  1223. free_cprbmem(mem, PARMBSIZE, 0);
  1224. return rc;
  1225. }
  1226. EXPORT_SYMBOL(cca_cipher2protkey);
  1227. /*
  1228. * Derive protected key from CCA ECC secure private key.
  1229. */
  1230. int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
  1231. u8 *protkey, u32 *protkeylen, u32 *protkeytype)
  1232. {
  1233. int rc;
  1234. u8 *mem, *ptr;
  1235. struct CPRBX *preqcblk, *prepcblk;
  1236. struct ica_xcRB xcrb;
  1237. struct aureqparm {
  1238. u8 subfunc_code[2];
  1239. u16 rule_array_len;
  1240. u8 rule_array[8];
  1241. struct {
  1242. u16 len;
  1243. u16 tk_blob_len;
  1244. u16 tk_blob_tag;
  1245. u8 tk_blob[66];
  1246. } vud;
  1247. struct {
  1248. u16 len;
  1249. u16 cca_key_token_len;
  1250. u16 cca_key_token_flags;
  1251. u8 cca_key_token[0];
  1252. } kb;
  1253. } __packed * preqparm;
  1254. struct aurepparm {
  1255. u8 subfunc_code[2];
  1256. u16 rule_array_len;
  1257. struct {
  1258. u16 len;
  1259. u16 sublen;
  1260. u16 tag;
  1261. struct cpacfkeyblock {
  1262. u8 version; /* version of this struct */
  1263. u8 flags[2];
  1264. u8 algo;
  1265. u8 form;
  1266. u8 pad1[3];
  1267. u16 keylen;
  1268. u8 key[0]; /* the key (keylen bytes) */
  1269. u16 keyattrlen;
  1270. u8 keyattr[32];
  1271. u8 pad2[1];
  1272. u8 vptype;
  1273. u8 vp[32]; /* verification pattern */
  1274. } ckb;
  1275. } vud;
  1276. struct {
  1277. u16 len;
  1278. } kb;
  1279. } __packed * prepparm;
  1280. int keylen = ((struct eccprivkeytoken *)key)->len;
  1281. /* get already prepared memory for 2 cprbs with param block each */
  1282. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  1283. if (rc)
  1284. return rc;
  1285. /* fill request cprb struct */
  1286. preqcblk->domain = domain;
  1287. /* fill request cprb param block with AU request */
  1288. preqparm = (struct aureqparm __force *) preqcblk->req_parmb;
  1289. memcpy(preqparm->subfunc_code, "AU", 2);
  1290. preqparm->rule_array_len =
  1291. sizeof(preqparm->rule_array_len)
  1292. + sizeof(preqparm->rule_array);
  1293. memcpy(preqparm->rule_array, "EXPT-SK ", 8);
  1294. /* vud, tk blob */
  1295. preqparm->vud.len = sizeof(preqparm->vud);
  1296. preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
  1297. + 2 * sizeof(uint16_t);
  1298. preqparm->vud.tk_blob_tag = 0x00C2;
  1299. /* kb, cca token */
  1300. preqparm->kb.len = keylen + 3 * sizeof(uint16_t);
  1301. preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t);
  1302. memcpy(preqparm->kb.cca_key_token, key, keylen);
  1303. /* now fill length of param block into cprb */
  1304. preqcblk->req_parml = sizeof(struct aureqparm) + keylen;
  1305. /* fill xcrb struct */
  1306. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  1307. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  1308. rc = zcrypt_send_cprb(&xcrb);
  1309. if (rc) {
  1310. DEBUG_ERR(
  1311. "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  1312. __func__, (int) cardnr, (int) domain, rc);
  1313. goto out;
  1314. }
  1315. /* check response returncode and reasoncode */
  1316. if (prepcblk->ccp_rtcode != 0) {
  1317. DEBUG_ERR(
  1318. "%s unwrap secure key failure, card response %d/%d\n",
  1319. __func__,
  1320. (int) prepcblk->ccp_rtcode,
  1321. (int) prepcblk->ccp_rscode);
  1322. rc = -EIO;
  1323. goto out;
  1324. }
  1325. if (prepcblk->ccp_rscode != 0) {
  1326. DEBUG_WARN(
  1327. "%s unwrap secure key warning, card response %d/%d\n",
  1328. __func__,
  1329. (int) prepcblk->ccp_rtcode,
  1330. (int) prepcblk->ccp_rscode);
  1331. }
  1332. /* process response cprb param block */
  1333. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  1334. prepcblk->rpl_parmb = (u8 __user *) ptr;
  1335. prepparm = (struct aurepparm *) ptr;
  1336. /* check the returned keyblock */
  1337. if (prepparm->vud.ckb.version != 0x02) {
  1338. DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
  1339. __func__, (int) prepparm->vud.ckb.version);
  1340. rc = -EIO;
  1341. goto out;
  1342. }
  1343. if (prepparm->vud.ckb.algo != 0x81) {
  1344. DEBUG_ERR(
  1345. "%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
  1346. __func__, (int) prepparm->vud.ckb.algo);
  1347. rc = -EIO;
  1348. goto out;
  1349. }
  1350. /* copy the translated protected key */
  1351. if (prepparm->vud.ckb.keylen > *protkeylen) {
  1352. DEBUG_ERR("%s prot keylen mismatch %d > buffersize %u\n",
  1353. __func__, prepparm->vud.ckb.keylen, *protkeylen);
  1354. rc = -EIO;
  1355. goto out;
  1356. }
  1357. memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
  1358. *protkeylen = prepparm->vud.ckb.keylen;
  1359. if (protkeytype)
  1360. *protkeytype = PKEY_KEYTYPE_ECC;
  1361. out:
  1362. free_cprbmem(mem, PARMBSIZE, 0);
  1363. return rc;
  1364. }
  1365. EXPORT_SYMBOL(cca_ecc2protkey);
  1366. /*
  1367. * query cryptographic facility from CCA adapter
  1368. */
  1369. int cca_query_crypto_facility(u16 cardnr, u16 domain,
  1370. const char *keyword,
  1371. u8 *rarray, size_t *rarraylen,
  1372. u8 *varray, size_t *varraylen)
  1373. {
  1374. int rc;
  1375. u16 len;
  1376. u8 *mem, *ptr;
  1377. struct CPRBX *preqcblk, *prepcblk;
  1378. struct ica_xcRB xcrb;
  1379. struct fqreqparm {
  1380. u8 subfunc_code[2];
  1381. u16 rule_array_len;
  1382. char rule_array[8];
  1383. struct lv1 {
  1384. u16 len;
  1385. u8 data[VARDATASIZE];
  1386. } lv1;
  1387. u16 dummylen;
  1388. } __packed * preqparm;
  1389. size_t parmbsize = sizeof(struct fqreqparm);
  1390. struct fqrepparm {
  1391. u8 subfunc_code[2];
  1392. u8 lvdata[0];
  1393. } __packed * prepparm;
  1394. /* get already prepared memory for 2 cprbs with param block each */
  1395. rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
  1396. if (rc)
  1397. return rc;
  1398. /* fill request cprb struct */
  1399. preqcblk->domain = domain;
  1400. /* fill request cprb param block with FQ request */
  1401. preqparm = (struct fqreqparm __force *) preqcblk->req_parmb;
  1402. memcpy(preqparm->subfunc_code, "FQ", 2);
  1403. memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
  1404. preqparm->rule_array_len =
  1405. sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
  1406. preqparm->lv1.len = sizeof(preqparm->lv1);
  1407. preqparm->dummylen = sizeof(preqparm->dummylen);
  1408. preqcblk->req_parml = parmbsize;
  1409. /* fill xcrb struct */
  1410. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  1411. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  1412. rc = zcrypt_send_cprb(&xcrb);
  1413. if (rc) {
  1414. DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
  1415. __func__, (int) cardnr, (int) domain, rc);
  1416. goto out;
  1417. }
  1418. /* check response returncode and reasoncode */
  1419. if (prepcblk->ccp_rtcode != 0) {
  1420. DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
  1421. __func__,
  1422. (int) prepcblk->ccp_rtcode,
  1423. (int) prepcblk->ccp_rscode);
  1424. rc = -EIO;
  1425. goto out;
  1426. }
  1427. /* process response cprb param block */
  1428. ptr = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  1429. prepcblk->rpl_parmb = (u8 __user *) ptr;
  1430. prepparm = (struct fqrepparm *) ptr;
  1431. ptr = prepparm->lvdata;
  1432. /* check and possibly copy reply rule array */
  1433. len = *((u16 *) ptr);
  1434. if (len > sizeof(u16)) {
  1435. ptr += sizeof(u16);
  1436. len -= sizeof(u16);
  1437. if (rarray && rarraylen && *rarraylen > 0) {
  1438. *rarraylen = (len > *rarraylen ? *rarraylen : len);
  1439. memcpy(rarray, ptr, *rarraylen);
  1440. }
  1441. ptr += len;
  1442. }
  1443. /* check and possible copy reply var array */
  1444. len = *((u16 *) ptr);
  1445. if (len > sizeof(u16)) {
  1446. ptr += sizeof(u16);
  1447. len -= sizeof(u16);
  1448. if (varray && varraylen && *varraylen > 0) {
  1449. *varraylen = (len > *varraylen ? *varraylen : len);
  1450. memcpy(varray, ptr, *varraylen);
  1451. }
  1452. ptr += len;
  1453. }
  1454. out:
  1455. free_cprbmem(mem, parmbsize, 0);
  1456. return rc;
  1457. }
  1458. EXPORT_SYMBOL(cca_query_crypto_facility);
  1459. static int cca_info_cache_fetch(u16 cardnr, u16 domain, struct cca_info *ci)
  1460. {
  1461. int rc = -ENOENT;
  1462. struct cca_info_list_entry *ptr;
  1463. spin_lock_bh(&cca_info_list_lock);
  1464. list_for_each_entry(ptr, &cca_info_list, list) {
  1465. if (ptr->cardnr == cardnr && ptr->domain == domain) {
  1466. memcpy(ci, &ptr->info, sizeof(*ci));
  1467. rc = 0;
  1468. break;
  1469. }
  1470. }
  1471. spin_unlock_bh(&cca_info_list_lock);
  1472. return rc;
  1473. }
  1474. static void cca_info_cache_update(u16 cardnr, u16 domain,
  1475. const struct cca_info *ci)
  1476. {
  1477. int found = 0;
  1478. struct cca_info_list_entry *ptr;
  1479. spin_lock_bh(&cca_info_list_lock);
  1480. list_for_each_entry(ptr, &cca_info_list, list) {
  1481. if (ptr->cardnr == cardnr &&
  1482. ptr->domain == domain) {
  1483. memcpy(&ptr->info, ci, sizeof(*ci));
  1484. found = 1;
  1485. break;
  1486. }
  1487. }
  1488. if (!found) {
  1489. ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
  1490. if (!ptr) {
  1491. spin_unlock_bh(&cca_info_list_lock);
  1492. return;
  1493. }
  1494. ptr->cardnr = cardnr;
  1495. ptr->domain = domain;
  1496. memcpy(&ptr->info, ci, sizeof(*ci));
  1497. list_add(&ptr->list, &cca_info_list);
  1498. }
  1499. spin_unlock_bh(&cca_info_list_lock);
  1500. }
  1501. static void cca_info_cache_scrub(u16 cardnr, u16 domain)
  1502. {
  1503. struct cca_info_list_entry *ptr;
  1504. spin_lock_bh(&cca_info_list_lock);
  1505. list_for_each_entry(ptr, &cca_info_list, list) {
  1506. if (ptr->cardnr == cardnr &&
  1507. ptr->domain == domain) {
  1508. list_del(&ptr->list);
  1509. kfree(ptr);
  1510. break;
  1511. }
  1512. }
  1513. spin_unlock_bh(&cca_info_list_lock);
  1514. }
  1515. static void __exit mkvp_cache_free(void)
  1516. {
  1517. struct cca_info_list_entry *ptr, *pnext;
  1518. spin_lock_bh(&cca_info_list_lock);
  1519. list_for_each_entry_safe(ptr, pnext, &cca_info_list, list) {
  1520. list_del(&ptr->list);
  1521. kfree(ptr);
  1522. }
  1523. spin_unlock_bh(&cca_info_list_lock);
  1524. }
  1525. /*
  1526. * Fetch cca_info values via query_crypto_facility from adapter.
  1527. */
  1528. static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci)
  1529. {
  1530. int rc, found = 0;
  1531. size_t rlen, vlen;
  1532. u8 *rarray, *varray, *pg;
  1533. struct zcrypt_device_status_ext devstat;
  1534. memset(ci, 0, sizeof(*ci));
  1535. /* get first info from zcrypt device driver about this apqn */
  1536. rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
  1537. if (rc)
  1538. return rc;
  1539. ci->hwtype = devstat.hwtype;
  1540. /* prep page for rule array and var array use */
  1541. pg = (u8 *) __get_free_page(GFP_KERNEL);
  1542. if (!pg)
  1543. return -ENOMEM;
  1544. rarray = pg;
  1545. varray = pg + PAGE_SIZE/2;
  1546. rlen = vlen = PAGE_SIZE/2;
  1547. /* QF for this card/domain */
  1548. rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
  1549. rarray, &rlen, varray, &vlen);
  1550. if (rc == 0 && rlen >= 10*8 && vlen >= 204) {
  1551. memcpy(ci->serial, rarray, 8);
  1552. ci->new_aes_mk_state = (char) rarray[7*8];
  1553. ci->cur_aes_mk_state = (char) rarray[8*8];
  1554. ci->old_aes_mk_state = (char) rarray[9*8];
  1555. if (ci->old_aes_mk_state == '2')
  1556. memcpy(&ci->old_aes_mkvp, varray + 172, 8);
  1557. if (ci->cur_aes_mk_state == '2')
  1558. memcpy(&ci->cur_aes_mkvp, varray + 184, 8);
  1559. if (ci->new_aes_mk_state == '3')
  1560. memcpy(&ci->new_aes_mkvp, varray + 196, 8);
  1561. found++;
  1562. }
  1563. if (!found)
  1564. goto out;
  1565. rlen = vlen = PAGE_SIZE/2;
  1566. rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
  1567. rarray, &rlen, varray, &vlen);
  1568. if (rc == 0 && rlen >= 13*8 && vlen >= 240) {
  1569. ci->new_apka_mk_state = (char) rarray[10*8];
  1570. ci->cur_apka_mk_state = (char) rarray[11*8];
  1571. ci->old_apka_mk_state = (char) rarray[12*8];
  1572. if (ci->old_apka_mk_state == '2')
  1573. memcpy(&ci->old_apka_mkvp, varray + 208, 8);
  1574. if (ci->cur_apka_mk_state == '2')
  1575. memcpy(&ci->cur_apka_mkvp, varray + 220, 8);
  1576. if (ci->new_apka_mk_state == '3')
  1577. memcpy(&ci->new_apka_mkvp, varray + 232, 8);
  1578. found++;
  1579. }
  1580. out:
  1581. free_page((unsigned long) pg);
  1582. return found == 2 ? 0 : -ENOENT;
  1583. }
  1584. /*
  1585. * Fetch cca information about a CCA queue.
  1586. */
  1587. int cca_get_info(u16 card, u16 dom, struct cca_info *ci, int verify)
  1588. {
  1589. int rc;
  1590. rc = cca_info_cache_fetch(card, dom, ci);
  1591. if (rc || verify) {
  1592. rc = fetch_cca_info(card, dom, ci);
  1593. if (rc == 0)
  1594. cca_info_cache_update(card, dom, ci);
  1595. }
  1596. return rc;
  1597. }
  1598. EXPORT_SYMBOL(cca_get_info);
  1599. /*
  1600. * Search for a matching crypto card based on the
  1601. * Master Key Verification Pattern given.
  1602. */
  1603. static int findcard(u64 mkvp, u16 *pcardnr, u16 *pdomain,
  1604. int verify, int minhwtype)
  1605. {
  1606. struct zcrypt_device_status_ext *device_status;
  1607. u16 card, dom;
  1608. struct cca_info ci;
  1609. int i, rc, oi = -1;
  1610. /* mkvp must not be zero, minhwtype needs to be >= 0 */
  1611. if (mkvp == 0 || minhwtype < 0)
  1612. return -EINVAL;
  1613. /* fetch status of all crypto cards */
  1614. device_status = kvmalloc_array(MAX_ZDEV_ENTRIES_EXT,
  1615. sizeof(struct zcrypt_device_status_ext),
  1616. GFP_KERNEL);
  1617. if (!device_status)
  1618. return -ENOMEM;
  1619. zcrypt_device_status_mask_ext(device_status);
  1620. /* walk through all crypto cards */
  1621. for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
  1622. card = AP_QID_CARD(device_status[i].qid);
  1623. dom = AP_QID_QUEUE(device_status[i].qid);
  1624. if (device_status[i].online &&
  1625. device_status[i].functions & 0x04) {
  1626. /* enabled CCA card, check current mkvp from cache */
  1627. if (cca_info_cache_fetch(card, dom, &ci) == 0 &&
  1628. ci.hwtype >= minhwtype &&
  1629. ci.cur_aes_mk_state == '2' &&
  1630. ci.cur_aes_mkvp == mkvp) {
  1631. if (!verify)
  1632. break;
  1633. /* verify: refresh card info */
  1634. if (fetch_cca_info(card, dom, &ci) == 0) {
  1635. cca_info_cache_update(card, dom, &ci);
  1636. if (ci.hwtype >= minhwtype &&
  1637. ci.cur_aes_mk_state == '2' &&
  1638. ci.cur_aes_mkvp == mkvp)
  1639. break;
  1640. }
  1641. }
  1642. } else {
  1643. /* Card is offline and/or not a CCA card. */
  1644. /* del mkvp entry from cache if it exists */
  1645. cca_info_cache_scrub(card, dom);
  1646. }
  1647. }
  1648. if (i >= MAX_ZDEV_ENTRIES_EXT) {
  1649. /* nothing found, so this time without cache */
  1650. for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
  1651. if (!(device_status[i].online &&
  1652. device_status[i].functions & 0x04))
  1653. continue;
  1654. card = AP_QID_CARD(device_status[i].qid);
  1655. dom = AP_QID_QUEUE(device_status[i].qid);
  1656. /* fresh fetch mkvp from adapter */
  1657. if (fetch_cca_info(card, dom, &ci) == 0) {
  1658. cca_info_cache_update(card, dom, &ci);
  1659. if (ci.hwtype >= minhwtype &&
  1660. ci.cur_aes_mk_state == '2' &&
  1661. ci.cur_aes_mkvp == mkvp)
  1662. break;
  1663. if (ci.hwtype >= minhwtype &&
  1664. ci.old_aes_mk_state == '2' &&
  1665. ci.old_aes_mkvp == mkvp &&
  1666. oi < 0)
  1667. oi = i;
  1668. }
  1669. }
  1670. if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
  1671. /* old mkvp matched, use this card then */
  1672. card = AP_QID_CARD(device_status[oi].qid);
  1673. dom = AP_QID_QUEUE(device_status[oi].qid);
  1674. }
  1675. }
  1676. if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
  1677. if (pcardnr)
  1678. *pcardnr = card;
  1679. if (pdomain)
  1680. *pdomain = dom;
  1681. rc = (i < MAX_ZDEV_ENTRIES_EXT ? 0 : 1);
  1682. } else
  1683. rc = -ENODEV;
  1684. kvfree(device_status);
  1685. return rc;
  1686. }
  1687. /*
  1688. * Search for a matching crypto card based on the Master Key
  1689. * Verification Pattern provided inside a secure key token.
  1690. */
  1691. int cca_findcard(const u8 *key, u16 *pcardnr, u16 *pdomain, int verify)
  1692. {
  1693. u64 mkvp;
  1694. int minhwtype = 0;
  1695. const struct keytoken_header *hdr = (struct keytoken_header *) key;
  1696. if (hdr->type != TOKTYPE_CCA_INTERNAL)
  1697. return -EINVAL;
  1698. switch (hdr->version) {
  1699. case TOKVER_CCA_AES:
  1700. mkvp = ((struct secaeskeytoken *)key)->mkvp;
  1701. break;
  1702. case TOKVER_CCA_VLSC:
  1703. mkvp = ((struct cipherkeytoken *)key)->mkvp0;
  1704. minhwtype = AP_DEVICE_TYPE_CEX6;
  1705. break;
  1706. default:
  1707. return -EINVAL;
  1708. }
  1709. return findcard(mkvp, pcardnr, pdomain, verify, minhwtype);
  1710. }
  1711. EXPORT_SYMBOL(cca_findcard);
  1712. int cca_findcard2(u32 **apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
  1713. int minhwtype, int mktype, u64 cur_mkvp, u64 old_mkvp,
  1714. int verify)
  1715. {
  1716. struct zcrypt_device_status_ext *device_status;
  1717. u32 *_apqns = NULL, _nr_apqns = 0;
  1718. int i, card, dom, curmatch, oldmatch, rc = 0;
  1719. struct cca_info ci;
  1720. /* fetch status of all crypto cards */
  1721. device_status = kvmalloc_array(MAX_ZDEV_ENTRIES_EXT,
  1722. sizeof(struct zcrypt_device_status_ext),
  1723. GFP_KERNEL);
  1724. if (!device_status)
  1725. return -ENOMEM;
  1726. zcrypt_device_status_mask_ext(device_status);
  1727. /* allocate 1k space for up to 256 apqns */
  1728. _apqns = kmalloc_array(256, sizeof(u32), GFP_KERNEL);
  1729. if (!_apqns) {
  1730. kvfree(device_status);
  1731. return -ENOMEM;
  1732. }
  1733. /* walk through all the crypto apqnss */
  1734. for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
  1735. card = AP_QID_CARD(device_status[i].qid);
  1736. dom = AP_QID_QUEUE(device_status[i].qid);
  1737. /* check online state */
  1738. if (!device_status[i].online)
  1739. continue;
  1740. /* check for cca functions */
  1741. if (!(device_status[i].functions & 0x04))
  1742. continue;
  1743. /* check cardnr */
  1744. if (cardnr != 0xFFFF && card != cardnr)
  1745. continue;
  1746. /* check domain */
  1747. if (domain != 0xFFFF && dom != domain)
  1748. continue;
  1749. /* get cca info on this apqn */
  1750. if (cca_get_info(card, dom, &ci, verify))
  1751. continue;
  1752. /* current master key needs to be valid */
  1753. if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2')
  1754. continue;
  1755. if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2')
  1756. continue;
  1757. /* check min hardware type */
  1758. if (minhwtype > 0 && minhwtype > ci.hwtype)
  1759. continue;
  1760. if (cur_mkvp || old_mkvp) {
  1761. /* check mkvps */
  1762. curmatch = oldmatch = 0;
  1763. if (mktype == AES_MK_SET) {
  1764. if (cur_mkvp && cur_mkvp == ci.cur_aes_mkvp)
  1765. curmatch = 1;
  1766. if (old_mkvp && ci.old_aes_mk_state == '2' &&
  1767. old_mkvp == ci.old_aes_mkvp)
  1768. oldmatch = 1;
  1769. } else {
  1770. if (cur_mkvp && cur_mkvp == ci.cur_apka_mkvp)
  1771. curmatch = 1;
  1772. if (old_mkvp && ci.old_apka_mk_state == '2' &&
  1773. old_mkvp == ci.old_apka_mkvp)
  1774. oldmatch = 1;
  1775. }
  1776. if (curmatch + oldmatch < 1)
  1777. continue;
  1778. }
  1779. /* apqn passed all filtering criterons, add to the array */
  1780. if (_nr_apqns < 256)
  1781. _apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16) dom);
  1782. }
  1783. /* nothing found ? */
  1784. if (!_nr_apqns) {
  1785. kfree(_apqns);
  1786. rc = -ENODEV;
  1787. } else {
  1788. /* no re-allocation, simple return the _apqns array */
  1789. *apqns = _apqns;
  1790. *nr_apqns = _nr_apqns;
  1791. rc = 0;
  1792. }
  1793. kvfree(device_status);
  1794. return rc;
  1795. }
  1796. EXPORT_SYMBOL(cca_findcard2);
  1797. void __exit zcrypt_ccamisc_exit(void)
  1798. {
  1799. mkvp_cache_free();
  1800. }