zcrypt_ep11misc.h 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155
  1. /* SPDX-License-Identifier: GPL-2.0+ */
  2. /*
  3. * Copyright IBM Corp. 2019
  4. * Author(s): Harald Freudenberger <freude@linux.ibm.com>
  5. *
  6. * Collection of EP11 misc functions used by zcrypt and pkey
  7. */
  8. #ifndef _ZCRYPT_EP11MISC_H_
  9. #define _ZCRYPT_EP11MISC_H_
  10. #include <asm/zcrypt.h>
  11. #include <asm/pkey.h>
  12. #define EP11_API_V 4 /* highest known and supported EP11 API version */
  13. #define EP11_STRUCT_MAGIC 0x1234
  14. #define EP11_BLOB_PKEY_EXTRACTABLE 0x00200000
  15. /*
  16. * Internal used values for the version field of the key header.
  17. * Should match to the enum pkey_key_type in pkey.h.
  18. */
  19. #define TOKVER_EP11_AES 0x03 /* EP11 AES key blob (old style) */
  20. #define TOKVER_EP11_AES_WITH_HEADER 0x06 /* EP11 AES key blob with header */
  21. #define TOKVER_EP11_ECC_WITH_HEADER 0x07 /* EP11 ECC key blob with header */
  22. /* inside view of an EP11 secure key blob */
  23. struct ep11keyblob {
  24. union {
  25. u8 session[32];
  26. /* only used for PKEY_TYPE_EP11: */
  27. struct {
  28. u8 type; /* 0x00 (TOKTYPE_NON_CCA) */
  29. u8 res0; /* unused */
  30. u16 len; /* total length in bytes of this blob */
  31. u8 version; /* 0x03 (TOKVER_EP11_AES) */
  32. u8 res1; /* unused */
  33. u16 keybitlen; /* clear key bit len, 0 for unknown */
  34. } head;
  35. };
  36. u8 wkvp[16]; /* wrapping key verification pattern */
  37. u64 attr; /* boolean key attributes */
  38. u64 mode; /* mode bits */
  39. u16 version; /* 0x1234, EP11_STRUCT_MAGIC */
  40. u8 iv[14];
  41. u8 encrypted_key_data[144];
  42. u8 mac[32];
  43. } __packed;
  44. /* check ep11 key magic to find out if this is an ep11 key blob */
  45. static inline bool is_ep11_keyblob(const u8 *key)
  46. {
  47. struct ep11keyblob *kb = (struct ep11keyblob *) key;
  48. return (kb->version == EP11_STRUCT_MAGIC);
  49. }
  50. /*
  51. * Simple check if the key blob is a valid EP11 AES key blob with header.
  52. * If checkcpacfexport is enabled, the key is also checked for the
  53. * attributes needed to export this key for CPACF use.
  54. * Returns 0 on success or errno value on failure.
  55. */
  56. int ep11_check_aes_key_with_hdr(debug_info_t *dbg, int dbflvl,
  57. const u8 *key, size_t keylen, int checkcpacfexp);
  58. /*
  59. * Simple check if the key blob is a valid EP11 ECC key blob with header.
  60. * If checkcpacfexport is enabled, the key is also checked for the
  61. * attributes needed to export this key for CPACF use.
  62. * Returns 0 on success or errno value on failure.
  63. */
  64. int ep11_check_ecc_key_with_hdr(debug_info_t *dbg, int dbflvl,
  65. const u8 *key, size_t keylen, int checkcpacfexp);
  66. /*
  67. * Simple check if the key blob is a valid EP11 AES key blob with
  68. * the header in the session field (old style EP11 AES key).
  69. * If checkcpacfexport is enabled, the key is also checked for the
  70. * attributes needed to export this key for CPACF use.
  71. * Returns 0 on success or errno value on failure.
  72. */
  73. int ep11_check_aes_key(debug_info_t *dbg, int dbflvl,
  74. const u8 *key, size_t keylen, int checkcpacfexp);
  75. /* EP11 card info struct */
  76. struct ep11_card_info {
  77. u32 API_ord_nr; /* API ordinal number */
  78. u16 FW_version; /* Firmware major and minor version */
  79. char serial[16]; /* serial number string (16 ascii, no 0x00 !) */
  80. u64 op_mode; /* card operational mode(s) */
  81. };
  82. /* EP11 domain info struct */
  83. struct ep11_domain_info {
  84. char cur_wk_state; /* '0' invalid, '1' valid */
  85. char new_wk_state; /* '0' empty, '1' uncommitted, '2' committed */
  86. u8 cur_wkvp[32]; /* current wrapping key verification pattern */
  87. u8 new_wkvp[32]; /* new wrapping key verification pattern */
  88. u64 op_mode; /* domain operational mode(s) */
  89. };
  90. /*
  91. * Provide information about an EP11 card.
  92. */
  93. int ep11_get_card_info(u16 card, struct ep11_card_info *info, int verify);
  94. /*
  95. * Provide information about a domain within an EP11 card.
  96. */
  97. int ep11_get_domain_info(u16 card, u16 domain, struct ep11_domain_info *info);
  98. /*
  99. * Generate (random) EP11 AES secure key.
  100. */
  101. int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags,
  102. u8 *keybuf, size_t *keybufsize);
  103. /*
  104. * Generate EP11 AES secure key with given clear key value.
  105. */
  106. int ep11_clr2keyblob(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
  107. const u8 *clrkey, u8 *keybuf, size_t *keybufsize);
  108. /*
  109. * Build a list of ep11 apqns meeting the following constrains:
  110. * - apqn is online and is in fact an EP11 apqn
  111. * - if cardnr is not FFFF only apqns with this cardnr
  112. * - if domain is not FFFF only apqns with this domainnr
  113. * - if minhwtype > 0 only apqns with hwtype >= minhwtype
  114. * - if minapi > 0 only apqns with API_ord_nr >= minapi
  115. * - if wkvp != NULL only apqns where the wkvp (EP11_WKVPLEN bytes) matches
  116. * to the first EP11_WKVPLEN bytes of the wkvp of the current wrapping
  117. * key for this domain. When a wkvp is given there will aways be a re-fetch
  118. * of the domain info for the potential apqn - so this triggers an request
  119. * reply to each apqn eligible.
  120. * The array of apqn entries is allocated with kmalloc and returned in *apqns;
  121. * the number of apqns stored into the list is returned in *nr_apqns. One apqn
  122. * entry is simple a 32 bit value with 16 bit cardnr and 16 bit domain nr and
  123. * may be casted to struct pkey_apqn. The return value is either 0 for success
  124. * or a negative errno value. If no apqn meeting the criterias is found,
  125. * -ENODEV is returned.
  126. */
  127. int ep11_findcard2(u32 **apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
  128. int minhwtype, int minapi, const u8 *wkvp);
  129. /*
  130. * Derive proteced key from EP11 key blob (AES and ECC keys).
  131. */
  132. int ep11_kblob2protkey(u16 card, u16 dom, const u8 *key, size_t keylen,
  133. u8 *protkey, u32 *protkeylen, u32 *protkeytype);
  134. void zcrypt_ep11misc_exit(void);
  135. #endif /* _ZCRYPT_EP11MISC_H_ */