Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0+
0002 /*
0003  *  Copyright IBM Corp. 2019
0004  *  Author(s): Harald Freudenberger <freude@linux.ibm.com>
0005  *         Ingo Franzki <ifranzki@linux.ibm.com>
0006  *
0007  *  Collection of CCA misc functions used by zcrypt and pkey
0008  */
0009 
0010 #define KMSG_COMPONENT "zcrypt"
0011 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
0012 
0013 #include <linux/init.h>
0014 #include <linux/module.h>
0015 #include <linux/slab.h>
0016 #include <linux/random.h>
0017 #include <asm/zcrypt.h>
0018 #include <asm/pkey.h>
0019 
0020 #include "ap_bus.h"
0021 #include "zcrypt_api.h"
0022 #include "zcrypt_debug.h"
0023 #include "zcrypt_msgtype6.h"
0024 #include "zcrypt_ccamisc.h"
0025 
0026 #define DEBUG_DBG(...)  ZCRYPT_DBF(DBF_DEBUG, ##__VA_ARGS__)
0027 #define DEBUG_INFO(...) ZCRYPT_DBF(DBF_INFO, ##__VA_ARGS__)
0028 #define DEBUG_WARN(...) ZCRYPT_DBF(DBF_WARN, ##__VA_ARGS__)
0029 #define DEBUG_ERR(...)  ZCRYPT_DBF(DBF_ERR, ##__VA_ARGS__)
0030 
0031 /* Size of parameter block used for all cca requests/replies */
0032 #define PARMBSIZE 512
0033 
0034 /* Size of vardata block used for some of the cca requests/replies */
0035 #define VARDATASIZE 4096
0036 
0037 struct cca_info_list_entry {
0038     struct list_head list;
0039     u16 cardnr;
0040     u16 domain;
0041     struct cca_info info;
0042 };
0043 
0044 /* a list with cca_info_list_entry entries */
0045 static LIST_HEAD(cca_info_list);
0046 static DEFINE_SPINLOCK(cca_info_list_lock);
0047 
0048 /*
0049  * Simple check if the token is a valid CCA secure AES data key
0050  * token. If keybitsize is given, the bitsize of the key is
0051  * also checked. Returns 0 on success or errno value on failure.
0052  */
0053 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
0054                  const u8 *token, int keybitsize)
0055 {
0056     struct secaeskeytoken *t = (struct secaeskeytoken *)token;
0057 
0058 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
0059 
0060     if (t->type != TOKTYPE_CCA_INTERNAL) {
0061         if (dbg)
0062             DBF("%s token check failed, type 0x%02x != 0x%02x\n",
0063                 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
0064         return -EINVAL;
0065     }
0066     if (t->version != TOKVER_CCA_AES) {
0067         if (dbg)
0068             DBF("%s token check failed, version 0x%02x != 0x%02x\n",
0069                 __func__, (int)t->version, TOKVER_CCA_AES);
0070         return -EINVAL;
0071     }
0072     if (keybitsize > 0 && t->bitsize != keybitsize) {
0073         if (dbg)
0074             DBF("%s token check failed, bitsize %d != %d\n",
0075                 __func__, (int)t->bitsize, keybitsize);
0076         return -EINVAL;
0077     }
0078 
0079 #undef DBF
0080 
0081     return 0;
0082 }
0083 EXPORT_SYMBOL(cca_check_secaeskeytoken);
0084 
0085 /*
0086  * Simple check if the token is a valid CCA secure AES cipher key
0087  * token. If keybitsize is given, the bitsize of the key is
0088  * also checked. If checkcpacfexport is enabled, the key is also
0089  * checked for the export flag to allow CPACF export.
0090  * Returns 0 on success or errno value on failure.
0091  */
0092 int cca_check_secaescipherkey(debug_info_t *dbg, int dbflvl,
0093                   const u8 *token, int keybitsize,
0094                   int checkcpacfexport)
0095 {
0096     struct cipherkeytoken *t = (struct cipherkeytoken *)token;
0097     bool keybitsizeok = true;
0098 
0099 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
0100 
0101     if (t->type != TOKTYPE_CCA_INTERNAL) {
0102         if (dbg)
0103             DBF("%s token check failed, type 0x%02x != 0x%02x\n",
0104                 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL);
0105         return -EINVAL;
0106     }
0107     if (t->version != TOKVER_CCA_VLSC) {
0108         if (dbg)
0109             DBF("%s token check failed, version 0x%02x != 0x%02x\n",
0110                 __func__, (int)t->version, TOKVER_CCA_VLSC);
0111         return -EINVAL;
0112     }
0113     if (t->algtype != 0x02) {
0114         if (dbg)
0115             DBF("%s token check failed, algtype 0x%02x != 0x02\n",
0116                 __func__, (int)t->algtype);
0117         return -EINVAL;
0118     }
0119     if (t->keytype != 0x0001) {
0120         if (dbg)
0121             DBF("%s token check failed, keytype 0x%04x != 0x0001\n",
0122                 __func__, (int)t->keytype);
0123         return -EINVAL;
0124     }
0125     if (t->plfver != 0x00 && t->plfver != 0x01) {
0126         if (dbg)
0127             DBF("%s token check failed, unknown plfver 0x%02x\n",
0128                 __func__, (int)t->plfver);
0129         return -EINVAL;
0130     }
0131     if (t->wpllen != 512 && t->wpllen != 576 && t->wpllen != 640) {
0132         if (dbg)
0133             DBF("%s token check failed, unknown wpllen %d\n",
0134                 __func__, (int)t->wpllen);
0135         return -EINVAL;
0136     }
0137     if (keybitsize > 0) {
0138         switch (keybitsize) {
0139         case 128:
0140             if (t->wpllen != (t->plfver ? 640 : 512))
0141                 keybitsizeok = false;
0142             break;
0143         case 192:
0144             if (t->wpllen != (t->plfver ? 640 : 576))
0145                 keybitsizeok = false;
0146             break;
0147         case 256:
0148             if (t->wpllen != 640)
0149                 keybitsizeok = false;
0150             break;
0151         default:
0152             keybitsizeok = false;
0153             break;
0154         }
0155         if (!keybitsizeok) {
0156             if (dbg)
0157                 DBF("%s token check failed, bitsize %d\n",
0158                     __func__, keybitsize);
0159             return -EINVAL;
0160         }
0161     }
0162     if (checkcpacfexport && !(t->kmf1 & KMF1_XPRT_CPAC)) {
0163         if (dbg)
0164             DBF("%s token check failed, XPRT_CPAC bit is 0\n",
0165                 __func__);
0166         return -EINVAL;
0167     }
0168 
0169 #undef DBF
0170 
0171     return 0;
0172 }
0173 EXPORT_SYMBOL(cca_check_secaescipherkey);
0174 
0175 /*
0176  * Simple check if the token is a valid CCA secure ECC private
0177  * key token. Returns 0 on success or errno value on failure.
0178  */
0179 int cca_check_sececckeytoken(debug_info_t *dbg, int dbflvl,
0180                  const u8 *token, size_t keysize,
0181                  int checkcpacfexport)
0182 {
0183     struct eccprivkeytoken *t = (struct eccprivkeytoken *)token;
0184 
0185 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
0186 
0187     if (t->type != TOKTYPE_CCA_INTERNAL_PKA) {
0188         if (dbg)
0189             DBF("%s token check failed, type 0x%02x != 0x%02x\n",
0190                 __func__, (int)t->type, TOKTYPE_CCA_INTERNAL_PKA);
0191         return -EINVAL;
0192     }
0193     if (t->len > keysize) {
0194         if (dbg)
0195             DBF("%s token check failed, len %d > keysize %zu\n",
0196                 __func__, (int)t->len, keysize);
0197         return -EINVAL;
0198     }
0199     if (t->secid != 0x20) {
0200         if (dbg)
0201             DBF("%s token check failed, secid 0x%02x != 0x20\n",
0202                 __func__, (int)t->secid);
0203         return -EINVAL;
0204     }
0205     if (checkcpacfexport && !(t->kutc & 0x01)) {
0206         if (dbg)
0207             DBF("%s token check failed, XPRTCPAC bit is 0\n",
0208                 __func__);
0209         return -EINVAL;
0210     }
0211 
0212 #undef DBF
0213 
0214     return 0;
0215 }
0216 EXPORT_SYMBOL(cca_check_sececckeytoken);
0217 
0218 /*
0219  * Allocate consecutive memory for request CPRB, request param
0220  * block, reply CPRB and reply param block and fill in values
0221  * for the common fields. Returns 0 on success or errno value
0222  * on failure.
0223  */
0224 static int alloc_and_prep_cprbmem(size_t paramblen,
0225                   u8 **p_cprb_mem,
0226                   struct CPRBX **p_req_cprb,
0227                   struct CPRBX **p_rep_cprb)
0228 {
0229     u8 *cprbmem;
0230     size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
0231     struct CPRBX *preqcblk, *prepcblk;
0232 
0233     /*
0234      * allocate consecutive memory for request CPRB, request param
0235      * block, reply CPRB and reply param block
0236      */
0237     cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
0238     if (!cprbmem)
0239         return -ENOMEM;
0240 
0241     preqcblk = (struct CPRBX *)cprbmem;
0242     prepcblk = (struct CPRBX *)(cprbmem + cprbplusparamblen);
0243 
0244     /* fill request cprb struct */
0245     preqcblk->cprb_len = sizeof(struct CPRBX);
0246     preqcblk->cprb_ver_id = 0x02;
0247     memcpy(preqcblk->func_id, "T2", 2);
0248     preqcblk->rpl_msgbl = cprbplusparamblen;
0249     if (paramblen) {
0250         preqcblk->req_parmb =
0251             ((u8 __user *)preqcblk) + sizeof(struct CPRBX);
0252         preqcblk->rpl_parmb =
0253             ((u8 __user *)prepcblk) + sizeof(struct CPRBX);
0254     }
0255 
0256     *p_cprb_mem = cprbmem;
0257     *p_req_cprb = preqcblk;
0258     *p_rep_cprb = prepcblk;
0259 
0260     return 0;
0261 }
0262 
0263 /*
0264  * Free the cprb memory allocated with the function above.
0265  * If the scrub value is not zero, the memory is filled
0266  * with zeros before freeing (useful if there was some
0267  * clear key material in there).
0268  */
0269 static void free_cprbmem(void *mem, size_t paramblen, int scrub)
0270 {
0271     if (scrub)
0272         memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
0273     kfree(mem);
0274 }
0275 
0276 /*
0277  * Helper function to prepare the xcrb struct
0278  */
0279 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
0280                  u16 cardnr,
0281                  struct CPRBX *preqcblk,
0282                  struct CPRBX *prepcblk)
0283 {
0284     memset(pxcrb, 0, sizeof(*pxcrb));
0285     pxcrb->agent_ID = 0x4341; /* 'CA' */
0286     pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
0287     pxcrb->request_control_blk_length =
0288         preqcblk->cprb_len + preqcblk->req_parml;
0289     pxcrb->request_control_blk_addr = (void __user *)preqcblk;
0290     pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
0291     pxcrb->reply_control_blk_addr = (void __user *)prepcblk;
0292 }
0293 
0294 /*
0295  * Generate (random) CCA AES DATA secure key.
0296  */
0297 int cca_genseckey(u16 cardnr, u16 domain,
0298           u32 keybitsize, u8 *seckey)
0299 {
0300     int i, rc, keysize;
0301     int seckeysize;
0302     u8 *mem, *ptr;
0303     struct CPRBX *preqcblk, *prepcblk;
0304     struct ica_xcRB xcrb;
0305     struct kgreqparm {
0306         u8  subfunc_code[2];
0307         u16 rule_array_len;
0308         struct lv1 {
0309             u16 len;
0310             char  key_form[8];
0311             char  key_length[8];
0312             char  key_type1[8];
0313             char  key_type2[8];
0314         } lv1;
0315         struct lv2 {
0316             u16 len;
0317             struct keyid {
0318                 u16 len;
0319                 u16 attr;
0320                 u8  data[SECKEYBLOBSIZE];
0321             } keyid[6];
0322         } lv2;
0323     } __packed * preqparm;
0324     struct kgrepparm {
0325         u8  subfunc_code[2];
0326         u16 rule_array_len;
0327         struct lv3 {
0328             u16 len;
0329             u16 keyblocklen;
0330             struct {
0331                 u16 toklen;
0332                 u16 tokattr;
0333                 u8  tok[];
0334                 /* ... some more data ... */
0335             } keyblock;
0336         } lv3;
0337     } __packed * prepparm;
0338 
0339     /* get already prepared memory for 2 cprbs with param block each */
0340     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
0341     if (rc)
0342         return rc;
0343 
0344     /* fill request cprb struct */
0345     preqcblk->domain = domain;
0346 
0347     /* fill request cprb param block with KG request */
0348     preqparm = (struct kgreqparm __force *)preqcblk->req_parmb;
0349     memcpy(preqparm->subfunc_code, "KG", 2);
0350     preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
0351     preqparm->lv1.len = sizeof(struct lv1);
0352     memcpy(preqparm->lv1.key_form,   "OP      ", 8);
0353     switch (keybitsize) {
0354     case PKEY_SIZE_AES_128:
0355     case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
0356         keysize = 16;
0357         memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
0358         break;
0359     case PKEY_SIZE_AES_192:
0360     case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
0361         keysize = 24;
0362         memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
0363         break;
0364     case PKEY_SIZE_AES_256:
0365     case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
0366         keysize = 32;
0367         memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
0368         break;
0369     default:
0370         DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
0371               __func__, keybitsize);
0372         rc = -EINVAL;
0373         goto out;
0374     }
0375     memcpy(preqparm->lv1.key_type1,  "AESDATA ", 8);
0376     preqparm->lv2.len = sizeof(struct lv2);
0377     for (i = 0; i < 6; i++) {
0378         preqparm->lv2.keyid[i].len = sizeof(struct keyid);
0379         preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
0380     }
0381     preqcblk->req_parml = sizeof(struct kgreqparm);
0382 
0383     /* fill xcrb struct */
0384     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
0385 
0386     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
0387     rc = zcrypt_send_cprb(&xcrb);
0388     if (rc) {
0389         DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
0390               __func__, (int)cardnr, (int)domain, rc);
0391         goto out;
0392     }
0393 
0394     /* check response returncode and reasoncode */
0395     if (prepcblk->ccp_rtcode != 0) {
0396         DEBUG_ERR("%s secure key generate failure, card response %d/%d\n",
0397               __func__,
0398               (int)prepcblk->ccp_rtcode,
0399               (int)prepcblk->ccp_rscode);
0400         rc = -EIO;
0401         goto out;
0402     }
0403 
0404     /* process response cprb param block */
0405     ptr =  ((u8 *)prepcblk) + sizeof(struct CPRBX);
0406     prepcblk->rpl_parmb = (u8 __user *)ptr;
0407     prepparm = (struct kgrepparm *)ptr;
0408 
0409     /* check length of the returned secure key token */
0410     seckeysize = prepparm->lv3.keyblock.toklen
0411         - sizeof(prepparm->lv3.keyblock.toklen)
0412         - sizeof(prepparm->lv3.keyblock.tokattr);
0413     if (seckeysize != SECKEYBLOBSIZE) {
0414         DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
0415               __func__, seckeysize, SECKEYBLOBSIZE);
0416         rc = -EIO;
0417         goto out;
0418     }
0419 
0420     /* check secure key token */
0421     rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
0422                       prepparm->lv3.keyblock.tok, 8 * keysize);
0423     if (rc) {
0424         rc = -EIO;
0425         goto out;
0426     }
0427 
0428     /* copy the generated secure key token */
0429     memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
0430 
0431 out:
0432     free_cprbmem(mem, PARMBSIZE, 0);
0433     return rc;
0434 }
0435 EXPORT_SYMBOL(cca_genseckey);
0436 
0437 /*
0438  * Generate an CCA AES DATA secure key with given key value.
0439  */
0440 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keybitsize,
0441            const u8 *clrkey, u8 *seckey)
0442 {
0443     int rc, keysize, seckeysize;
0444     u8 *mem, *ptr;
0445     struct CPRBX *preqcblk, *prepcblk;
0446     struct ica_xcRB xcrb;
0447     struct cmreqparm {
0448         u8  subfunc_code[2];
0449         u16 rule_array_len;
0450         char  rule_array[8];
0451         struct lv1 {
0452             u16 len;
0453             u8  clrkey[0];
0454         } lv1;
0455         struct lv2 {
0456             u16 len;
0457             struct keyid {
0458                 u16 len;
0459                 u16 attr;
0460                 u8  data[SECKEYBLOBSIZE];
0461             } keyid;
0462         } lv2;
0463     } __packed * preqparm;
0464     struct lv2 *plv2;
0465     struct cmrepparm {
0466         u8  subfunc_code[2];
0467         u16 rule_array_len;
0468         struct lv3 {
0469             u16 len;
0470             u16 keyblocklen;
0471             struct {
0472                 u16 toklen;
0473                 u16 tokattr;
0474                 u8  tok[];
0475                 /* ... some more data ... */
0476             } keyblock;
0477         } lv3;
0478     } __packed * prepparm;
0479 
0480     /* get already prepared memory for 2 cprbs with param block each */
0481     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
0482     if (rc)
0483         return rc;
0484 
0485     /* fill request cprb struct */
0486     preqcblk->domain = domain;
0487 
0488     /* fill request cprb param block with CM request */
0489     preqparm = (struct cmreqparm __force *)preqcblk->req_parmb;
0490     memcpy(preqparm->subfunc_code, "CM", 2);
0491     memcpy(preqparm->rule_array, "AES     ", 8);
0492     preqparm->rule_array_len =
0493         sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
0494     switch (keybitsize) {
0495     case PKEY_SIZE_AES_128:
0496     case PKEY_KEYTYPE_AES_128: /* older ioctls used this */
0497         keysize = 16;
0498         break;
0499     case PKEY_SIZE_AES_192:
0500     case PKEY_KEYTYPE_AES_192: /* older ioctls used this */
0501         keysize = 24;
0502         break;
0503     case PKEY_SIZE_AES_256:
0504     case PKEY_KEYTYPE_AES_256: /* older ioctls used this */
0505         keysize = 32;
0506         break;
0507     default:
0508         DEBUG_ERR("%s unknown/unsupported keybitsize %d\n",
0509               __func__, keybitsize);
0510         rc = -EINVAL;
0511         goto out;
0512     }
0513     preqparm->lv1.len = sizeof(struct lv1) + keysize;
0514     memcpy(preqparm->lv1.clrkey, clrkey, keysize);
0515     plv2 = (struct lv2 *)(((u8 *)&preqparm->lv2) + keysize);
0516     plv2->len = sizeof(struct lv2);
0517     plv2->keyid.len = sizeof(struct keyid);
0518     plv2->keyid.attr = 0x30;
0519     preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
0520 
0521     /* fill xcrb struct */
0522     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
0523 
0524     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
0525     rc = zcrypt_send_cprb(&xcrb);
0526     if (rc) {
0527         DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
0528               __func__, (int)cardnr, (int)domain, rc);
0529         goto out;
0530     }
0531 
0532     /* check response returncode and reasoncode */
0533     if (prepcblk->ccp_rtcode != 0) {
0534         DEBUG_ERR("%s clear key import failure, card response %d/%d\n",
0535               __func__,
0536               (int)prepcblk->ccp_rtcode,
0537               (int)prepcblk->ccp_rscode);
0538         rc = -EIO;
0539         goto out;
0540     }
0541 
0542     /* process response cprb param block */
0543     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
0544     prepcblk->rpl_parmb = (u8 __user *)ptr;
0545     prepparm = (struct cmrepparm *)ptr;
0546 
0547     /* check length of the returned secure key token */
0548     seckeysize = prepparm->lv3.keyblock.toklen
0549         - sizeof(prepparm->lv3.keyblock.toklen)
0550         - sizeof(prepparm->lv3.keyblock.tokattr);
0551     if (seckeysize != SECKEYBLOBSIZE) {
0552         DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
0553               __func__, seckeysize, SECKEYBLOBSIZE);
0554         rc = -EIO;
0555         goto out;
0556     }
0557 
0558     /* check secure key token */
0559     rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
0560                       prepparm->lv3.keyblock.tok, 8 * keysize);
0561     if (rc) {
0562         rc = -EIO;
0563         goto out;
0564     }
0565 
0566     /* copy the generated secure key token */
0567     if (seckey)
0568         memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
0569 
0570 out:
0571     free_cprbmem(mem, PARMBSIZE, 1);
0572     return rc;
0573 }
0574 EXPORT_SYMBOL(cca_clr2seckey);
0575 
0576 /*
0577  * Derive proteced key from an CCA AES DATA secure key.
0578  */
0579 int cca_sec2protkey(u16 cardnr, u16 domain,
0580             const u8 *seckey, u8 *protkey, u32 *protkeylen,
0581             u32 *protkeytype)
0582 {
0583     int rc;
0584     u8 *mem, *ptr;
0585     struct CPRBX *preqcblk, *prepcblk;
0586     struct ica_xcRB xcrb;
0587     struct uskreqparm {
0588         u8  subfunc_code[2];
0589         u16 rule_array_len;
0590         struct lv1 {
0591             u16 len;
0592             u16 attr_len;
0593             u16 attr_flags;
0594         } lv1;
0595         struct lv2 {
0596             u16 len;
0597             u16 attr_len;
0598             u16 attr_flags;
0599             u8  token[];          /* cca secure key token */
0600         } lv2;
0601     } __packed * preqparm;
0602     struct uskrepparm {
0603         u8  subfunc_code[2];
0604         u16 rule_array_len;
0605         struct lv3 {
0606             u16 len;
0607             u16 attr_len;
0608             u16 attr_flags;
0609             struct cpacfkeyblock {
0610                 u8  version;  /* version of this struct */
0611                 u8  flags[2];
0612                 u8  algo;
0613                 u8  form;
0614                 u8  pad1[3];
0615                 u16 len;
0616                 u8  key[64];  /* the key (len bytes) */
0617                 u16 keyattrlen;
0618                 u8  keyattr[32];
0619                 u8  pad2[1];
0620                 u8  vptype;
0621                 u8  vp[32];  /* verification pattern */
0622             } ckb;
0623         } lv3;
0624     } __packed * prepparm;
0625 
0626     /* get already prepared memory for 2 cprbs with param block each */
0627     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
0628     if (rc)
0629         return rc;
0630 
0631     /* fill request cprb struct */
0632     preqcblk->domain = domain;
0633 
0634     /* fill request cprb param block with USK request */
0635     preqparm = (struct uskreqparm __force *)preqcblk->req_parmb;
0636     memcpy(preqparm->subfunc_code, "US", 2);
0637     preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
0638     preqparm->lv1.len = sizeof(struct lv1);
0639     preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
0640     preqparm->lv1.attr_flags = 0x0001;
0641     preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
0642     preqparm->lv2.attr_len = sizeof(struct lv2)
0643         - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
0644     preqparm->lv2.attr_flags = 0x0000;
0645     memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
0646     preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
0647 
0648     /* fill xcrb struct */
0649     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
0650 
0651     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
0652     rc = zcrypt_send_cprb(&xcrb);
0653     if (rc) {
0654         DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
0655               __func__, (int)cardnr, (int)domain, rc);
0656         goto out;
0657     }
0658 
0659     /* check response returncode and reasoncode */
0660     if (prepcblk->ccp_rtcode != 0) {
0661         DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
0662               __func__,
0663               (int)prepcblk->ccp_rtcode,
0664               (int)prepcblk->ccp_rscode);
0665         if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
0666             rc = -EAGAIN;
0667         else
0668             rc = -EIO;
0669         goto out;
0670     }
0671     if (prepcblk->ccp_rscode != 0) {
0672         DEBUG_WARN("%s unwrap secure key warning, card response %d/%d\n",
0673                __func__,
0674                (int)prepcblk->ccp_rtcode,
0675                (int)prepcblk->ccp_rscode);
0676     }
0677 
0678     /* process response cprb param block */
0679     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
0680     prepcblk->rpl_parmb = (u8 __user *)ptr;
0681     prepparm = (struct uskrepparm *)ptr;
0682 
0683     /* check the returned keyblock */
0684     if (prepparm->lv3.ckb.version != 0x01 &&
0685         prepparm->lv3.ckb.version != 0x02) {
0686         DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
0687               __func__, (int)prepparm->lv3.ckb.version);
0688         rc = -EIO;
0689         goto out;
0690     }
0691 
0692     /* copy the tanslated protected key */
0693     switch (prepparm->lv3.ckb.len) {
0694     case 16 + 32:
0695         /* AES 128 protected key */
0696         if (protkeytype)
0697             *protkeytype = PKEY_KEYTYPE_AES_128;
0698         break;
0699     case 24 + 32:
0700         /* AES 192 protected key */
0701         if (protkeytype)
0702             *protkeytype = PKEY_KEYTYPE_AES_192;
0703         break;
0704     case 32 + 32:
0705         /* AES 256 protected key */
0706         if (protkeytype)
0707             *protkeytype = PKEY_KEYTYPE_AES_256;
0708         break;
0709     default:
0710         DEBUG_ERR("%s unknown/unsupported keylen %d\n",
0711               __func__, prepparm->lv3.ckb.len);
0712         rc = -EIO;
0713         goto out;
0714     }
0715     memcpy(protkey, prepparm->lv3.ckb.key, prepparm->lv3.ckb.len);
0716     if (protkeylen)
0717         *protkeylen = prepparm->lv3.ckb.len;
0718 
0719 out:
0720     free_cprbmem(mem, PARMBSIZE, 0);
0721     return rc;
0722 }
0723 EXPORT_SYMBOL(cca_sec2protkey);
0724 
0725 /*
0726  * AES cipher key skeleton created with CSNBKTB2 with these flags:
0727  * INTERNAL, NO-KEY, AES, CIPHER, ANY-MODE, NOEX-SYM, NOEXAASY,
0728  * NOEXUASY, XPRTCPAC, NOEX-RAW, NOEX-DES, NOEX-AES, NOEX-RSA
0729  * used by cca_gencipherkey() and cca_clr2cipherkey().
0730  */
0731 static const u8 aes_cipher_key_skeleton[] = {
0732     0x01, 0x00, 0x00, 0x38, 0x05, 0x00, 0x00, 0x00,
0733     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0734     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0735     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0736     0x00, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0737     0x00, 0x02, 0x00, 0x01, 0x02, 0xc0, 0x00, 0xff,
0738     0x00, 0x03, 0x08, 0xc8, 0x00, 0x00, 0x00, 0x00 };
0739 #define SIZEOF_SKELETON (sizeof(aes_cipher_key_skeleton))
0740 
0741 /*
0742  * Generate (random) CCA AES CIPHER secure key.
0743  */
0744 int cca_gencipherkey(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
0745              u8 *keybuf, size_t *keybufsize)
0746 {
0747     int rc;
0748     u8 *mem, *ptr;
0749     struct CPRBX *preqcblk, *prepcblk;
0750     struct ica_xcRB xcrb;
0751     struct gkreqparm {
0752         u8  subfunc_code[2];
0753         u16 rule_array_len;
0754         char rule_array[2 * 8];
0755         struct {
0756             u16 len;
0757             u8  key_type_1[8];
0758             u8  key_type_2[8];
0759             u16 clear_key_bit_len;
0760             u16 key_name_1_len;
0761             u16 key_name_2_len;
0762             u16 user_data_1_len;
0763             u16 user_data_2_len;
0764             u8  key_name_1[0];
0765             u8  key_name_2[0];
0766             u8  user_data_1[0];
0767             u8  user_data_2[0];
0768         } vud;
0769         struct {
0770             u16 len;
0771             struct {
0772                 u16 len;
0773                 u16 flag;
0774                 u8  kek_id_1[0];
0775             } tlv1;
0776             struct {
0777                 u16 len;
0778                 u16 flag;
0779                 u8  kek_id_2[0];
0780             } tlv2;
0781             struct {
0782                 u16 len;
0783                 u16 flag;
0784                 u8  gen_key_id_1[SIZEOF_SKELETON];
0785             } tlv3;
0786             struct {
0787                 u16 len;
0788                 u16 flag;
0789                 u8  gen_key_id_1_label[0];
0790             } tlv4;
0791             struct {
0792                 u16 len;
0793                 u16 flag;
0794                 u8  gen_key_id_2[0];
0795             } tlv5;
0796             struct {
0797                 u16 len;
0798                 u16 flag;
0799                 u8  gen_key_id_2_label[0];
0800             } tlv6;
0801         } kb;
0802     } __packed * preqparm;
0803     struct gkrepparm {
0804         u8  subfunc_code[2];
0805         u16 rule_array_len;
0806         struct {
0807             u16 len;
0808         } vud;
0809         struct {
0810             u16 len;
0811             struct {
0812                 u16 len;
0813                 u16 flag;
0814                 u8  gen_key[0]; /* 120-136 bytes */
0815             } tlv1;
0816         } kb;
0817     } __packed * prepparm;
0818     struct cipherkeytoken *t;
0819 
0820     /* get already prepared memory for 2 cprbs with param block each */
0821     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
0822     if (rc)
0823         return rc;
0824 
0825     /* fill request cprb struct */
0826     preqcblk->domain = domain;
0827     preqcblk->req_parml = sizeof(struct gkreqparm);
0828 
0829     /* prepare request param block with GK request */
0830     preqparm = (struct gkreqparm __force *)preqcblk->req_parmb;
0831     memcpy(preqparm->subfunc_code, "GK", 2);
0832     preqparm->rule_array_len =  sizeof(uint16_t) + 2 * 8;
0833     memcpy(preqparm->rule_array, "AES     OP      ", 2 * 8);
0834 
0835     /* prepare vud block */
0836     preqparm->vud.len = sizeof(preqparm->vud);
0837     switch (keybitsize) {
0838     case 128:
0839     case 192:
0840     case 256:
0841         break;
0842     default:
0843         DEBUG_ERR(
0844             "%s unknown/unsupported keybitsize %d\n",
0845             __func__, keybitsize);
0846         rc = -EINVAL;
0847         goto out;
0848     }
0849     preqparm->vud.clear_key_bit_len = keybitsize;
0850     memcpy(preqparm->vud.key_type_1, "TOKEN   ", 8);
0851     memset(preqparm->vud.key_type_2, ' ', sizeof(preqparm->vud.key_type_2));
0852 
0853     /* prepare kb block */
0854     preqparm->kb.len = sizeof(preqparm->kb);
0855     preqparm->kb.tlv1.len = sizeof(preqparm->kb.tlv1);
0856     preqparm->kb.tlv1.flag = 0x0030;
0857     preqparm->kb.tlv2.len = sizeof(preqparm->kb.tlv2);
0858     preqparm->kb.tlv2.flag = 0x0030;
0859     preqparm->kb.tlv3.len = sizeof(preqparm->kb.tlv3);
0860     preqparm->kb.tlv3.flag = 0x0030;
0861     memcpy(preqparm->kb.tlv3.gen_key_id_1,
0862            aes_cipher_key_skeleton, SIZEOF_SKELETON);
0863     preqparm->kb.tlv4.len = sizeof(preqparm->kb.tlv4);
0864     preqparm->kb.tlv4.flag = 0x0030;
0865     preqparm->kb.tlv5.len = sizeof(preqparm->kb.tlv5);
0866     preqparm->kb.tlv5.flag = 0x0030;
0867     preqparm->kb.tlv6.len = sizeof(preqparm->kb.tlv6);
0868     preqparm->kb.tlv6.flag = 0x0030;
0869 
0870     /* patch the skeleton key token export flags inside the kb block */
0871     if (keygenflags) {
0872         t = (struct cipherkeytoken *)preqparm->kb.tlv3.gen_key_id_1;
0873         t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
0874         t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
0875     }
0876 
0877     /* prepare xcrb struct */
0878     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
0879 
0880     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
0881     rc = zcrypt_send_cprb(&xcrb);
0882     if (rc) {
0883         DEBUG_ERR(
0884             "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
0885             __func__, (int)cardnr, (int)domain, rc);
0886         goto out;
0887     }
0888 
0889     /* check response returncode and reasoncode */
0890     if (prepcblk->ccp_rtcode != 0) {
0891         DEBUG_ERR(
0892             "%s cipher key generate failure, card response %d/%d\n",
0893             __func__,
0894             (int)prepcblk->ccp_rtcode,
0895             (int)prepcblk->ccp_rscode);
0896         rc = -EIO;
0897         goto out;
0898     }
0899 
0900     /* process response cprb param block */
0901     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
0902     prepcblk->rpl_parmb = (u8 __user *)ptr;
0903     prepparm = (struct gkrepparm *)ptr;
0904 
0905     /* do some plausibility checks on the key block */
0906     if (prepparm->kb.len < 120 + 5 * sizeof(uint16_t) ||
0907         prepparm->kb.len > 136 + 5 * sizeof(uint16_t)) {
0908         DEBUG_ERR("%s reply with invalid or unknown key block\n",
0909               __func__);
0910         rc = -EIO;
0911         goto out;
0912     }
0913 
0914     /* and some checks on the generated key */
0915     rc = cca_check_secaescipherkey(zcrypt_dbf_info, DBF_ERR,
0916                        prepparm->kb.tlv1.gen_key,
0917                        keybitsize, 1);
0918     if (rc) {
0919         rc = -EIO;
0920         goto out;
0921     }
0922 
0923     /* copy the generated vlsc key token */
0924     t = (struct cipherkeytoken *)prepparm->kb.tlv1.gen_key;
0925     if (keybuf) {
0926         if (*keybufsize >= t->len)
0927             memcpy(keybuf, t, t->len);
0928         else
0929             rc = -EINVAL;
0930     }
0931     *keybufsize = t->len;
0932 
0933 out:
0934     free_cprbmem(mem, PARMBSIZE, 0);
0935     return rc;
0936 }
0937 EXPORT_SYMBOL(cca_gencipherkey);
0938 
0939 /*
0940  * Helper function, does a the CSNBKPI2 CPRB.
0941  */
0942 static int _ip_cprb_helper(u16 cardnr, u16 domain,
0943                const char *rule_array_1,
0944                const char *rule_array_2,
0945                const char *rule_array_3,
0946                const u8 *clr_key_value,
0947                int clr_key_bit_size,
0948                u8 *key_token,
0949                int *key_token_size)
0950 {
0951     int rc, n;
0952     u8 *mem, *ptr;
0953     struct CPRBX *preqcblk, *prepcblk;
0954     struct ica_xcRB xcrb;
0955     struct rule_array_block {
0956         u8  subfunc_code[2];
0957         u16 rule_array_len;
0958         char rule_array[0];
0959     } __packed * preq_ra_block;
0960     struct vud_block {
0961         u16 len;
0962         struct {
0963             u16 len;
0964             u16 flag;        /* 0x0064 */
0965             u16 clr_key_bit_len;
0966         } tlv1;
0967         struct {
0968             u16 len;
0969             u16 flag;   /* 0x0063 */
0970             u8  clr_key[0]; /* clear key value bytes */
0971         } tlv2;
0972     } __packed * preq_vud_block;
0973     struct key_block {
0974         u16 len;
0975         struct {
0976             u16 len;
0977             u16 flag;     /* 0x0030 */
0978             u8  key_token[0]; /* key skeleton */
0979         } tlv1;
0980     } __packed * preq_key_block;
0981     struct iprepparm {
0982         u8  subfunc_code[2];
0983         u16 rule_array_len;
0984         struct {
0985             u16 len;
0986         } vud;
0987         struct {
0988             u16 len;
0989             struct {
0990                 u16 len;
0991                 u16 flag;     /* 0x0030 */
0992                 u8  key_token[0]; /* key token */
0993             } tlv1;
0994         } kb;
0995     } __packed * prepparm;
0996     struct cipherkeytoken *t;
0997     int complete = strncmp(rule_array_2, "COMPLETE", 8) ? 0 : 1;
0998 
0999     /* get already prepared memory for 2 cprbs with param block each */
1000     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
1001     if (rc)
1002         return rc;
1003 
1004     /* fill request cprb struct */
1005     preqcblk->domain = domain;
1006     preqcblk->req_parml = 0;
1007 
1008     /* prepare request param block with IP request */
1009     preq_ra_block = (struct rule_array_block __force *)preqcblk->req_parmb;
1010     memcpy(preq_ra_block->subfunc_code, "IP", 2);
1011     preq_ra_block->rule_array_len =  sizeof(uint16_t) + 2 * 8;
1012     memcpy(preq_ra_block->rule_array, rule_array_1, 8);
1013     memcpy(preq_ra_block->rule_array + 8, rule_array_2, 8);
1014     preqcblk->req_parml = sizeof(struct rule_array_block) + 2 * 8;
1015     if (rule_array_3) {
1016         preq_ra_block->rule_array_len += 8;
1017         memcpy(preq_ra_block->rule_array + 16, rule_array_3, 8);
1018         preqcblk->req_parml += 8;
1019     }
1020 
1021     /* prepare vud block */
1022     preq_vud_block = (struct vud_block __force *)
1023         (preqcblk->req_parmb + preqcblk->req_parml);
1024     n = complete ? 0 : (clr_key_bit_size + 7) / 8;
1025     preq_vud_block->len = sizeof(struct vud_block) + n;
1026     preq_vud_block->tlv1.len = sizeof(preq_vud_block->tlv1);
1027     preq_vud_block->tlv1.flag = 0x0064;
1028     preq_vud_block->tlv1.clr_key_bit_len = complete ? 0 : clr_key_bit_size;
1029     preq_vud_block->tlv2.len = sizeof(preq_vud_block->tlv2) + n;
1030     preq_vud_block->tlv2.flag = 0x0063;
1031     if (!complete)
1032         memcpy(preq_vud_block->tlv2.clr_key, clr_key_value, n);
1033     preqcblk->req_parml += preq_vud_block->len;
1034 
1035     /* prepare key block */
1036     preq_key_block = (struct key_block __force *)
1037         (preqcblk->req_parmb + preqcblk->req_parml);
1038     n = *key_token_size;
1039     preq_key_block->len = sizeof(struct key_block) + n;
1040     preq_key_block->tlv1.len = sizeof(preq_key_block->tlv1) + n;
1041     preq_key_block->tlv1.flag = 0x0030;
1042     memcpy(preq_key_block->tlv1.key_token, key_token, *key_token_size);
1043     preqcblk->req_parml += preq_key_block->len;
1044 
1045     /* prepare xcrb struct */
1046     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1047 
1048     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1049     rc = zcrypt_send_cprb(&xcrb);
1050     if (rc) {
1051         DEBUG_ERR(
1052             "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1053             __func__, (int)cardnr, (int)domain, rc);
1054         goto out;
1055     }
1056 
1057     /* check response returncode and reasoncode */
1058     if (prepcblk->ccp_rtcode != 0) {
1059         DEBUG_ERR(
1060             "%s CSNBKPI2 failure, card response %d/%d\n",
1061             __func__,
1062             (int)prepcblk->ccp_rtcode,
1063             (int)prepcblk->ccp_rscode);
1064         rc = -EIO;
1065         goto out;
1066     }
1067 
1068     /* process response cprb param block */
1069     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1070     prepcblk->rpl_parmb = (u8 __user *)ptr;
1071     prepparm = (struct iprepparm *)ptr;
1072 
1073     /* do some plausibility checks on the key block */
1074     if (prepparm->kb.len < 120 + 3 * sizeof(uint16_t) ||
1075         prepparm->kb.len > 136 + 3 * sizeof(uint16_t)) {
1076         DEBUG_ERR("%s reply with invalid or unknown key block\n",
1077               __func__);
1078         rc = -EIO;
1079         goto out;
1080     }
1081 
1082     /* do not check the key here, it may be incomplete */
1083 
1084     /* copy the vlsc key token back */
1085     t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
1086     memcpy(key_token, t, t->len);
1087     *key_token_size = t->len;
1088 
1089 out:
1090     free_cprbmem(mem, PARMBSIZE, 0);
1091     return rc;
1092 }
1093 
1094 /*
1095  * Build CCA AES CIPHER secure key with a given clear key value.
1096  */
1097 int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
1098               const u8 *clrkey, u8 *keybuf, size_t *keybufsize)
1099 {
1100     int rc;
1101     u8 *token;
1102     int tokensize;
1103     u8 exorbuf[32];
1104     struct cipherkeytoken *t;
1105 
1106     /* fill exorbuf with random data */
1107     get_random_bytes(exorbuf, sizeof(exorbuf));
1108 
1109     /* allocate space for the key token to build */
1110     token = kmalloc(MAXCCAVLSCTOKENSIZE, GFP_KERNEL);
1111     if (!token)
1112         return -ENOMEM;
1113 
1114     /* prepare the token with the key skeleton */
1115     tokensize = SIZEOF_SKELETON;
1116     memcpy(token, aes_cipher_key_skeleton, tokensize);
1117 
1118     /* patch the skeleton key token export flags */
1119     if (keygenflags) {
1120         t = (struct cipherkeytoken *)token;
1121         t->kmf1 |= (u16)(keygenflags & 0x0000FF00);
1122         t->kmf1 &= (u16)~(keygenflags & 0x000000FF);
1123     }
1124 
1125     /*
1126      * Do the key import with the clear key value in 4 steps:
1127      * 1/4 FIRST import with only random data
1128      * 2/4 EXOR the clear key
1129      * 3/4 EXOR the very same random data again
1130      * 4/4 COMPLETE the secure cipher key import
1131      */
1132     rc = _ip_cprb_helper(card, dom, "AES     ", "FIRST   ", "MIN3PART",
1133                  exorbuf, keybitsize, token, &tokensize);
1134     if (rc) {
1135         DEBUG_ERR(
1136             "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
1137             __func__, rc);
1138         goto out;
1139     }
1140     rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1141                  clrkey, keybitsize, token, &tokensize);
1142     if (rc) {
1143         DEBUG_ERR(
1144             "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
1145             __func__, rc);
1146         goto out;
1147     }
1148     rc = _ip_cprb_helper(card, dom, "AES     ", "ADD-PART", NULL,
1149                  exorbuf, keybitsize, token, &tokensize);
1150     if (rc) {
1151         DEBUG_ERR(
1152             "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
1153             __func__, rc);
1154         goto out;
1155     }
1156     rc = _ip_cprb_helper(card, dom, "AES     ", "COMPLETE", NULL,
1157                  NULL, keybitsize, token, &tokensize);
1158     if (rc) {
1159         DEBUG_ERR(
1160             "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
1161             __func__, rc);
1162         goto out;
1163     }
1164 
1165     /* copy the generated key token */
1166     if (keybuf) {
1167         if (tokensize > *keybufsize)
1168             rc = -EINVAL;
1169         else
1170             memcpy(keybuf, token, tokensize);
1171     }
1172     *keybufsize = tokensize;
1173 
1174 out:
1175     kfree(token);
1176     return rc;
1177 }
1178 EXPORT_SYMBOL(cca_clr2cipherkey);
1179 
1180 /*
1181  * Derive proteced key from CCA AES cipher secure key.
1182  */
1183 int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
1184                u8 *protkey, u32 *protkeylen, u32 *protkeytype)
1185 {
1186     int rc;
1187     u8 *mem, *ptr;
1188     struct CPRBX *preqcblk, *prepcblk;
1189     struct ica_xcRB xcrb;
1190     struct aureqparm {
1191         u8  subfunc_code[2];
1192         u16 rule_array_len;
1193         u8  rule_array[8];
1194         struct {
1195             u16 len;
1196             u16 tk_blob_len;
1197             u16 tk_blob_tag;
1198             u8  tk_blob[66];
1199         } vud;
1200         struct {
1201             u16 len;
1202             u16 cca_key_token_len;
1203             u16 cca_key_token_flags;
1204             u8  cca_key_token[0]; // 64 or more
1205         } kb;
1206     } __packed * preqparm;
1207     struct aurepparm {
1208         u8  subfunc_code[2];
1209         u16 rule_array_len;
1210         struct {
1211             u16 len;
1212             u16 sublen;
1213             u16 tag;
1214             struct cpacfkeyblock {
1215                 u8  version;  /* version of this struct */
1216                 u8  flags[2];
1217                 u8  algo;
1218                 u8  form;
1219                 u8  pad1[3];
1220                 u16 keylen;
1221                 u8  key[64];  /* the key (keylen bytes) */
1222                 u16 keyattrlen;
1223                 u8  keyattr[32];
1224                 u8  pad2[1];
1225                 u8  vptype;
1226                 u8  vp[32];  /* verification pattern */
1227             } ckb;
1228         } vud;
1229         struct {
1230             u16 len;
1231         } kb;
1232     } __packed * prepparm;
1233     int keytoklen = ((struct cipherkeytoken *)ckey)->len;
1234 
1235     /* get already prepared memory for 2 cprbs with param block each */
1236     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
1237     if (rc)
1238         return rc;
1239 
1240     /* fill request cprb struct */
1241     preqcblk->domain = domain;
1242 
1243     /* fill request cprb param block with AU request */
1244     preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1245     memcpy(preqparm->subfunc_code, "AU", 2);
1246     preqparm->rule_array_len =
1247         sizeof(preqparm->rule_array_len)
1248         + sizeof(preqparm->rule_array);
1249     memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1250     /* vud, tk blob */
1251     preqparm->vud.len = sizeof(preqparm->vud);
1252     preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1253         + 2 * sizeof(uint16_t);
1254     preqparm->vud.tk_blob_tag = 0x00C2;
1255     /* kb, cca token */
1256     preqparm->kb.len = keytoklen + 3 * sizeof(uint16_t);
1257     preqparm->kb.cca_key_token_len = keytoklen + 2 * sizeof(uint16_t);
1258     memcpy(preqparm->kb.cca_key_token, ckey, keytoklen);
1259     /* now fill length of param block into cprb */
1260     preqcblk->req_parml = sizeof(struct aureqparm) + keytoklen;
1261 
1262     /* fill xcrb struct */
1263     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1264 
1265     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1266     rc = zcrypt_send_cprb(&xcrb);
1267     if (rc) {
1268         DEBUG_ERR(
1269             "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1270             __func__, (int)cardnr, (int)domain, rc);
1271         goto out;
1272     }
1273 
1274     /* check response returncode and reasoncode */
1275     if (prepcblk->ccp_rtcode != 0) {
1276         DEBUG_ERR(
1277             "%s unwrap secure key failure, card response %d/%d\n",
1278             __func__,
1279             (int)prepcblk->ccp_rtcode,
1280             (int)prepcblk->ccp_rscode);
1281         if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1282             rc = -EAGAIN;
1283         else
1284             rc = -EIO;
1285         goto out;
1286     }
1287     if (prepcblk->ccp_rscode != 0) {
1288         DEBUG_WARN(
1289             "%s unwrap secure key warning, card response %d/%d\n",
1290             __func__,
1291             (int)prepcblk->ccp_rtcode,
1292             (int)prepcblk->ccp_rscode);
1293     }
1294 
1295     /* process response cprb param block */
1296     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1297     prepcblk->rpl_parmb = (u8 __user *)ptr;
1298     prepparm = (struct aurepparm *)ptr;
1299 
1300     /* check the returned keyblock */
1301     if (prepparm->vud.ckb.version != 0x01 &&
1302         prepparm->vud.ckb.version != 0x02) {
1303         DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x\n",
1304               __func__, (int)prepparm->vud.ckb.version);
1305         rc = -EIO;
1306         goto out;
1307     }
1308     if (prepparm->vud.ckb.algo != 0x02) {
1309         DEBUG_ERR(
1310             "%s reply param keyblock algo mismatch 0x%02x != 0x02\n",
1311             __func__, (int)prepparm->vud.ckb.algo);
1312         rc = -EIO;
1313         goto out;
1314     }
1315 
1316     /* copy the translated protected key */
1317     switch (prepparm->vud.ckb.keylen) {
1318     case 16 + 32:
1319         /* AES 128 protected key */
1320         if (protkeytype)
1321             *protkeytype = PKEY_KEYTYPE_AES_128;
1322         break;
1323     case 24 + 32:
1324         /* AES 192 protected key */
1325         if (protkeytype)
1326             *protkeytype = PKEY_KEYTYPE_AES_192;
1327         break;
1328     case 32 + 32:
1329         /* AES 256 protected key */
1330         if (protkeytype)
1331             *protkeytype = PKEY_KEYTYPE_AES_256;
1332         break;
1333     default:
1334         DEBUG_ERR("%s unknown/unsupported keylen %d\n",
1335               __func__, prepparm->vud.ckb.keylen);
1336         rc = -EIO;
1337         goto out;
1338     }
1339     memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1340     if (protkeylen)
1341         *protkeylen = prepparm->vud.ckb.keylen;
1342 
1343 out:
1344     free_cprbmem(mem, PARMBSIZE, 0);
1345     return rc;
1346 }
1347 EXPORT_SYMBOL(cca_cipher2protkey);
1348 
1349 /*
1350  * Derive protected key from CCA ECC secure private key.
1351  */
1352 int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
1353             u8 *protkey, u32 *protkeylen, u32 *protkeytype)
1354 {
1355     int rc;
1356     u8 *mem, *ptr;
1357     struct CPRBX *preqcblk, *prepcblk;
1358     struct ica_xcRB xcrb;
1359     struct aureqparm {
1360         u8  subfunc_code[2];
1361         u16 rule_array_len;
1362         u8  rule_array[8];
1363         struct {
1364             u16 len;
1365             u16 tk_blob_len;
1366             u16 tk_blob_tag;
1367             u8  tk_blob[66];
1368         } vud;
1369         struct {
1370             u16 len;
1371             u16 cca_key_token_len;
1372             u16 cca_key_token_flags;
1373             u8  cca_key_token[0];
1374         } kb;
1375     } __packed * preqparm;
1376     struct aurepparm {
1377         u8  subfunc_code[2];
1378         u16 rule_array_len;
1379         struct {
1380             u16 len;
1381             u16 sublen;
1382             u16 tag;
1383             struct cpacfkeyblock {
1384                 u8  version;  /* version of this struct */
1385                 u8  flags[2];
1386                 u8  algo;
1387                 u8  form;
1388                 u8  pad1[3];
1389                 u16 keylen;
1390                 u8  key[0];  /* the key (keylen bytes) */
1391                 u16 keyattrlen;
1392                 u8  keyattr[32];
1393                 u8  pad2[1];
1394                 u8  vptype;
1395                 u8  vp[32];  /* verification pattern */
1396             } ckb;
1397         } vud;
1398         struct {
1399             u16 len;
1400         } kb;
1401     } __packed * prepparm;
1402     int keylen = ((struct eccprivkeytoken *)key)->len;
1403 
1404     /* get already prepared memory for 2 cprbs with param block each */
1405     rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
1406     if (rc)
1407         return rc;
1408 
1409     /* fill request cprb struct */
1410     preqcblk->domain = domain;
1411 
1412     /* fill request cprb param block with AU request */
1413     preqparm = (struct aureqparm __force *)preqcblk->req_parmb;
1414     memcpy(preqparm->subfunc_code, "AU", 2);
1415     preqparm->rule_array_len =
1416         sizeof(preqparm->rule_array_len)
1417         + sizeof(preqparm->rule_array);
1418     memcpy(preqparm->rule_array, "EXPT-SK ", 8);
1419     /* vud, tk blob */
1420     preqparm->vud.len = sizeof(preqparm->vud);
1421     preqparm->vud.tk_blob_len = sizeof(preqparm->vud.tk_blob)
1422         + 2 * sizeof(uint16_t);
1423     preqparm->vud.tk_blob_tag = 0x00C2;
1424     /* kb, cca token */
1425     preqparm->kb.len = keylen + 3 * sizeof(uint16_t);
1426     preqparm->kb.cca_key_token_len = keylen + 2 * sizeof(uint16_t);
1427     memcpy(preqparm->kb.cca_key_token, key, keylen);
1428     /* now fill length of param block into cprb */
1429     preqcblk->req_parml = sizeof(struct aureqparm) + keylen;
1430 
1431     /* fill xcrb struct */
1432     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1433 
1434     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1435     rc = zcrypt_send_cprb(&xcrb);
1436     if (rc) {
1437         DEBUG_ERR(
1438             "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1439             __func__, (int)cardnr, (int)domain, rc);
1440         goto out;
1441     }
1442 
1443     /* check response returncode and reasoncode */
1444     if (prepcblk->ccp_rtcode != 0) {
1445         DEBUG_ERR(
1446             "%s unwrap secure key failure, card response %d/%d\n",
1447             __func__,
1448             (int)prepcblk->ccp_rtcode,
1449             (int)prepcblk->ccp_rscode);
1450         if (prepcblk->ccp_rtcode == 8 && prepcblk->ccp_rscode == 2290)
1451             rc = -EAGAIN;
1452         else
1453             rc = -EIO;
1454         goto out;
1455     }
1456     if (prepcblk->ccp_rscode != 0) {
1457         DEBUG_WARN(
1458             "%s unwrap secure key warning, card response %d/%d\n",
1459             __func__,
1460             (int)prepcblk->ccp_rtcode,
1461             (int)prepcblk->ccp_rscode);
1462     }
1463 
1464     /* process response cprb param block */
1465     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1466     prepcblk->rpl_parmb = (u8 __user *)ptr;
1467     prepparm = (struct aurepparm *)ptr;
1468 
1469     /* check the returned keyblock */
1470     if (prepparm->vud.ckb.version != 0x02) {
1471         DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x != 0x02\n",
1472               __func__, (int)prepparm->vud.ckb.version);
1473         rc = -EIO;
1474         goto out;
1475     }
1476     if (prepparm->vud.ckb.algo != 0x81) {
1477         DEBUG_ERR(
1478             "%s reply param keyblock algo mismatch 0x%02x != 0x81\n",
1479             __func__, (int)prepparm->vud.ckb.algo);
1480         rc = -EIO;
1481         goto out;
1482     }
1483 
1484     /* copy the translated protected key */
1485     if (prepparm->vud.ckb.keylen > *protkeylen) {
1486         DEBUG_ERR("%s prot keylen mismatch %d > buffersize %u\n",
1487               __func__, prepparm->vud.ckb.keylen, *protkeylen);
1488         rc = -EIO;
1489         goto out;
1490     }
1491     memcpy(protkey, prepparm->vud.ckb.key, prepparm->vud.ckb.keylen);
1492     *protkeylen = prepparm->vud.ckb.keylen;
1493     if (protkeytype)
1494         *protkeytype = PKEY_KEYTYPE_ECC;
1495 
1496 out:
1497     free_cprbmem(mem, PARMBSIZE, 0);
1498     return rc;
1499 }
1500 EXPORT_SYMBOL(cca_ecc2protkey);
1501 
1502 /*
1503  * query cryptographic facility from CCA adapter
1504  */
1505 int cca_query_crypto_facility(u16 cardnr, u16 domain,
1506                   const char *keyword,
1507                   u8 *rarray, size_t *rarraylen,
1508                   u8 *varray, size_t *varraylen)
1509 {
1510     int rc;
1511     u16 len;
1512     u8 *mem, *ptr;
1513     struct CPRBX *preqcblk, *prepcblk;
1514     struct ica_xcRB xcrb;
1515     struct fqreqparm {
1516         u8  subfunc_code[2];
1517         u16 rule_array_len;
1518         char  rule_array[8];
1519         struct lv1 {
1520             u16 len;
1521             u8  data[VARDATASIZE];
1522         } lv1;
1523         u16 dummylen;
1524     } __packed * preqparm;
1525     size_t parmbsize = sizeof(struct fqreqparm);
1526     struct fqrepparm {
1527         u8  subfunc_code[2];
1528         u8  lvdata[0];
1529     } __packed * prepparm;
1530 
1531     /* get already prepared memory for 2 cprbs with param block each */
1532     rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
1533     if (rc)
1534         return rc;
1535 
1536     /* fill request cprb struct */
1537     preqcblk->domain = domain;
1538 
1539     /* fill request cprb param block with FQ request */
1540     preqparm = (struct fqreqparm __force *)preqcblk->req_parmb;
1541     memcpy(preqparm->subfunc_code, "FQ", 2);
1542     memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
1543     preqparm->rule_array_len =
1544         sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
1545     preqparm->lv1.len = sizeof(preqparm->lv1);
1546     preqparm->dummylen = sizeof(preqparm->dummylen);
1547     preqcblk->req_parml = parmbsize;
1548 
1549     /* fill xcrb struct */
1550     prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
1551 
1552     /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
1553     rc = zcrypt_send_cprb(&xcrb);
1554     if (rc) {
1555         DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
1556               __func__, (int)cardnr, (int)domain, rc);
1557         goto out;
1558     }
1559 
1560     /* check response returncode and reasoncode */
1561     if (prepcblk->ccp_rtcode != 0) {
1562         DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
1563               __func__,
1564               (int)prepcblk->ccp_rtcode,
1565               (int)prepcblk->ccp_rscode);
1566         rc = -EIO;
1567         goto out;
1568     }
1569 
1570     /* process response cprb param block */
1571     ptr = ((u8 *)prepcblk) + sizeof(struct CPRBX);
1572     prepcblk->rpl_parmb = (u8 __user *)ptr;
1573     prepparm = (struct fqrepparm *)ptr;
1574     ptr = prepparm->lvdata;
1575 
1576     /* check and possibly copy reply rule array */
1577     len = *((u16 *)ptr);
1578     if (len > sizeof(u16)) {
1579         ptr += sizeof(u16);
1580         len -= sizeof(u16);
1581         if (rarray && rarraylen && *rarraylen > 0) {
1582             *rarraylen = (len > *rarraylen ? *rarraylen : len);
1583             memcpy(rarray, ptr, *rarraylen);
1584         }
1585         ptr += len;
1586     }
1587     /* check and possible copy reply var array */
1588     len = *((u16 *)ptr);
1589     if (len > sizeof(u16)) {
1590         ptr += sizeof(u16);
1591         len -= sizeof(u16);
1592         if (varray && varraylen && *varraylen > 0) {
1593             *varraylen = (len > *varraylen ? *varraylen : len);
1594             memcpy(varray, ptr, *varraylen);
1595         }
1596         ptr += len;
1597     }
1598 
1599 out:
1600     free_cprbmem(mem, parmbsize, 0);
1601     return rc;
1602 }
1603 EXPORT_SYMBOL(cca_query_crypto_facility);
1604 
1605 static int cca_info_cache_fetch(u16 cardnr, u16 domain, struct cca_info *ci)
1606 {
1607     int rc = -ENOENT;
1608     struct cca_info_list_entry *ptr;
1609 
1610     spin_lock_bh(&cca_info_list_lock);
1611     list_for_each_entry(ptr, &cca_info_list, list) {
1612         if (ptr->cardnr == cardnr && ptr->domain == domain) {
1613             memcpy(ci, &ptr->info, sizeof(*ci));
1614             rc = 0;
1615             break;
1616         }
1617     }
1618     spin_unlock_bh(&cca_info_list_lock);
1619 
1620     return rc;
1621 }
1622 
1623 static void cca_info_cache_update(u16 cardnr, u16 domain,
1624                   const struct cca_info *ci)
1625 {
1626     int found = 0;
1627     struct cca_info_list_entry *ptr;
1628 
1629     spin_lock_bh(&cca_info_list_lock);
1630     list_for_each_entry(ptr, &cca_info_list, list) {
1631         if (ptr->cardnr == cardnr &&
1632             ptr->domain == domain) {
1633             memcpy(&ptr->info, ci, sizeof(*ci));
1634             found = 1;
1635             break;
1636         }
1637     }
1638     if (!found) {
1639         ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
1640         if (!ptr) {
1641             spin_unlock_bh(&cca_info_list_lock);
1642             return;
1643         }
1644         ptr->cardnr = cardnr;
1645         ptr->domain = domain;
1646         memcpy(&ptr->info, ci, sizeof(*ci));
1647         list_add(&ptr->list, &cca_info_list);
1648     }
1649     spin_unlock_bh(&cca_info_list_lock);
1650 }
1651 
1652 static void cca_info_cache_scrub(u16 cardnr, u16 domain)
1653 {
1654     struct cca_info_list_entry *ptr;
1655 
1656     spin_lock_bh(&cca_info_list_lock);
1657     list_for_each_entry(ptr, &cca_info_list, list) {
1658         if (ptr->cardnr == cardnr &&
1659             ptr->domain == domain) {
1660             list_del(&ptr->list);
1661             kfree(ptr);
1662             break;
1663         }
1664     }
1665     spin_unlock_bh(&cca_info_list_lock);
1666 }
1667 
1668 static void __exit mkvp_cache_free(void)
1669 {
1670     struct cca_info_list_entry *ptr, *pnext;
1671 
1672     spin_lock_bh(&cca_info_list_lock);
1673     list_for_each_entry_safe(ptr, pnext, &cca_info_list, list) {
1674         list_del(&ptr->list);
1675         kfree(ptr);
1676     }
1677     spin_unlock_bh(&cca_info_list_lock);
1678 }
1679 
1680 /*
1681  * Fetch cca_info values via query_crypto_facility from adapter.
1682  */
1683 static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci)
1684 {
1685     int rc, found = 0;
1686     size_t rlen, vlen;
1687     u8 *rarray, *varray, *pg;
1688     struct zcrypt_device_status_ext devstat;
1689 
1690     memset(ci, 0, sizeof(*ci));
1691 
1692     /* get first info from zcrypt device driver about this apqn */
1693     rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
1694     if (rc)
1695         return rc;
1696     ci->hwtype = devstat.hwtype;
1697 
1698     /* prep page for rule array and var array use */
1699     pg = (u8 *)__get_free_page(GFP_KERNEL);
1700     if (!pg)
1701         return -ENOMEM;
1702     rarray = pg;
1703     varray = pg + PAGE_SIZE / 2;
1704     rlen = vlen = PAGE_SIZE / 2;
1705 
1706     /* QF for this card/domain */
1707     rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
1708                        rarray, &rlen, varray, &vlen);
1709     if (rc == 0 && rlen >= 10 * 8 && vlen >= 204) {
1710         memcpy(ci->serial, rarray, 8);
1711         ci->new_asym_mk_state = (char)rarray[4 * 8];
1712         ci->cur_asym_mk_state = (char)rarray[5 * 8];
1713         ci->old_asym_mk_state = (char)rarray[6 * 8];
1714         if (ci->old_asym_mk_state == '2')
1715             memcpy(ci->old_asym_mkvp, varray + 64, 16);
1716         if (ci->cur_asym_mk_state == '2')
1717             memcpy(ci->cur_asym_mkvp, varray + 84, 16);
1718         if (ci->new_asym_mk_state == '3')
1719             memcpy(ci->new_asym_mkvp, varray + 104, 16);
1720         ci->new_aes_mk_state = (char)rarray[7 * 8];
1721         ci->cur_aes_mk_state = (char)rarray[8 * 8];
1722         ci->old_aes_mk_state = (char)rarray[9 * 8];
1723         if (ci->old_aes_mk_state == '2')
1724             memcpy(&ci->old_aes_mkvp, varray + 172, 8);
1725         if (ci->cur_aes_mk_state == '2')
1726             memcpy(&ci->cur_aes_mkvp, varray + 184, 8);
1727         if (ci->new_aes_mk_state == '3')
1728             memcpy(&ci->new_aes_mkvp, varray + 196, 8);
1729         found++;
1730     }
1731     if (!found)
1732         goto out;
1733     rlen = vlen = PAGE_SIZE / 2;
1734     rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
1735                        rarray, &rlen, varray, &vlen);
1736     if (rc == 0 && rlen >= 13 * 8 && vlen >= 240) {
1737         ci->new_apka_mk_state = (char)rarray[10 * 8];
1738         ci->cur_apka_mk_state = (char)rarray[11 * 8];
1739         ci->old_apka_mk_state = (char)rarray[12 * 8];
1740         if (ci->old_apka_mk_state == '2')
1741             memcpy(&ci->old_apka_mkvp, varray + 208, 8);
1742         if (ci->cur_apka_mk_state == '2')
1743             memcpy(&ci->cur_apka_mkvp, varray + 220, 8);
1744         if (ci->new_apka_mk_state == '3')
1745             memcpy(&ci->new_apka_mkvp, varray + 232, 8);
1746         found++;
1747     }
1748 
1749 out:
1750     free_page((unsigned long)pg);
1751     return found == 2 ? 0 : -ENOENT;
1752 }
1753 
1754 /*
1755  * Fetch cca information about a CCA queue.
1756  */
1757 int cca_get_info(u16 card, u16 dom, struct cca_info *ci, int verify)
1758 {
1759     int rc;
1760 
1761     rc = cca_info_cache_fetch(card, dom, ci);
1762     if (rc || verify) {
1763         rc = fetch_cca_info(card, dom, ci);
1764         if (rc == 0)
1765             cca_info_cache_update(card, dom, ci);
1766     }
1767 
1768     return rc;
1769 }
1770 EXPORT_SYMBOL(cca_get_info);
1771 
1772 /*
1773  * Search for a matching crypto card based on the
1774  * Master Key Verification Pattern given.
1775  */
1776 static int findcard(u64 mkvp, u16 *pcardnr, u16 *pdomain,
1777             int verify, int minhwtype)
1778 {
1779     struct zcrypt_device_status_ext *device_status;
1780     u16 card, dom;
1781     struct cca_info ci;
1782     int i, rc, oi = -1;
1783 
1784     /* mkvp must not be zero, minhwtype needs to be >= 0 */
1785     if (mkvp == 0 || minhwtype < 0)
1786         return -EINVAL;
1787 
1788     /* fetch status of all crypto cards */
1789     device_status = kvmalloc_array(MAX_ZDEV_ENTRIES_EXT,
1790                        sizeof(struct zcrypt_device_status_ext),
1791                        GFP_KERNEL);
1792     if (!device_status)
1793         return -ENOMEM;
1794     zcrypt_device_status_mask_ext(device_status);
1795 
1796     /* walk through all crypto cards */
1797     for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
1798         card = AP_QID_CARD(device_status[i].qid);
1799         dom = AP_QID_QUEUE(device_status[i].qid);
1800         if (device_status[i].online &&
1801             device_status[i].functions & 0x04) {
1802             /* enabled CCA card, check current mkvp from cache */
1803             if (cca_info_cache_fetch(card, dom, &ci) == 0 &&
1804                 ci.hwtype >= minhwtype &&
1805                 ci.cur_aes_mk_state == '2' &&
1806                 ci.cur_aes_mkvp == mkvp) {
1807                 if (!verify)
1808                     break;
1809                 /* verify: refresh card info */
1810                 if (fetch_cca_info(card, dom, &ci) == 0) {
1811                     cca_info_cache_update(card, dom, &ci);
1812                     if (ci.hwtype >= minhwtype &&
1813                         ci.cur_aes_mk_state == '2' &&
1814                         ci.cur_aes_mkvp == mkvp)
1815                         break;
1816                 }
1817             }
1818         } else {
1819             /* Card is offline and/or not a CCA card. */
1820             /* del mkvp entry from cache if it exists */
1821             cca_info_cache_scrub(card, dom);
1822         }
1823     }
1824     if (i >= MAX_ZDEV_ENTRIES_EXT) {
1825         /* nothing found, so this time without cache */
1826         for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
1827             if (!(device_status[i].online &&
1828                   device_status[i].functions & 0x04))
1829                 continue;
1830             card = AP_QID_CARD(device_status[i].qid);
1831             dom = AP_QID_QUEUE(device_status[i].qid);
1832             /* fresh fetch mkvp from adapter */
1833             if (fetch_cca_info(card, dom, &ci) == 0) {
1834                 cca_info_cache_update(card, dom, &ci);
1835                 if (ci.hwtype >= minhwtype &&
1836                     ci.cur_aes_mk_state == '2' &&
1837                     ci.cur_aes_mkvp == mkvp)
1838                     break;
1839                 if (ci.hwtype >= minhwtype &&
1840                     ci.old_aes_mk_state == '2' &&
1841                     ci.old_aes_mkvp == mkvp &&
1842                     oi < 0)
1843                     oi = i;
1844             }
1845         }
1846         if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
1847             /* old mkvp matched, use this card then */
1848             card = AP_QID_CARD(device_status[oi].qid);
1849             dom = AP_QID_QUEUE(device_status[oi].qid);
1850         }
1851     }
1852     if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
1853         if (pcardnr)
1854             *pcardnr = card;
1855         if (pdomain)
1856             *pdomain = dom;
1857         rc = (i < MAX_ZDEV_ENTRIES_EXT ? 0 : 1);
1858     } else {
1859         rc = -ENODEV;
1860     }
1861 
1862     kvfree(device_status);
1863     return rc;
1864 }
1865 
1866 /*
1867  * Search for a matching crypto card based on the Master Key
1868  * Verification Pattern provided inside a secure key token.
1869  */
1870 int cca_findcard(const u8 *key, u16 *pcardnr, u16 *pdomain, int verify)
1871 {
1872     u64 mkvp;
1873     int minhwtype = 0;
1874     const struct keytoken_header *hdr = (struct keytoken_header *)key;
1875 
1876     if (hdr->type != TOKTYPE_CCA_INTERNAL)
1877         return -EINVAL;
1878 
1879     switch (hdr->version) {
1880     case TOKVER_CCA_AES:
1881         mkvp = ((struct secaeskeytoken *)key)->mkvp;
1882         break;
1883     case TOKVER_CCA_VLSC:
1884         mkvp = ((struct cipherkeytoken *)key)->mkvp0;
1885         minhwtype = AP_DEVICE_TYPE_CEX6;
1886         break;
1887     default:
1888         return -EINVAL;
1889     }
1890 
1891     return findcard(mkvp, pcardnr, pdomain, verify, minhwtype);
1892 }
1893 EXPORT_SYMBOL(cca_findcard);
1894 
1895 int cca_findcard2(u32 **apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
1896           int minhwtype, int mktype, u64 cur_mkvp, u64 old_mkvp,
1897           int verify)
1898 {
1899     struct zcrypt_device_status_ext *device_status;
1900     u32 *_apqns = NULL, _nr_apqns = 0;
1901     int i, card, dom, curmatch, oldmatch, rc = 0;
1902     struct cca_info ci;
1903 
1904     /* fetch status of all crypto cards */
1905     device_status = kvmalloc_array(MAX_ZDEV_ENTRIES_EXT,
1906                        sizeof(struct zcrypt_device_status_ext),
1907                        GFP_KERNEL);
1908     if (!device_status)
1909         return -ENOMEM;
1910     zcrypt_device_status_mask_ext(device_status);
1911 
1912     /* allocate 1k space for up to 256 apqns */
1913     _apqns = kmalloc_array(256, sizeof(u32), GFP_KERNEL);
1914     if (!_apqns) {
1915         kvfree(device_status);
1916         return -ENOMEM;
1917     }
1918 
1919     /* walk through all the crypto apqnss */
1920     for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
1921         card = AP_QID_CARD(device_status[i].qid);
1922         dom = AP_QID_QUEUE(device_status[i].qid);
1923         /* check online state */
1924         if (!device_status[i].online)
1925             continue;
1926         /* check for cca functions */
1927         if (!(device_status[i].functions & 0x04))
1928             continue;
1929         /* check cardnr */
1930         if (cardnr != 0xFFFF && card != cardnr)
1931             continue;
1932         /* check domain */
1933         if (domain != 0xFFFF && dom != domain)
1934             continue;
1935         /* get cca info on this apqn */
1936         if (cca_get_info(card, dom, &ci, verify))
1937             continue;
1938         /* current master key needs to be valid */
1939         if (mktype == AES_MK_SET && ci.cur_aes_mk_state != '2')
1940             continue;
1941         if (mktype == APKA_MK_SET && ci.cur_apka_mk_state != '2')
1942             continue;
1943         /* check min hardware type */
1944         if (minhwtype > 0 && minhwtype > ci.hwtype)
1945             continue;
1946         if (cur_mkvp || old_mkvp) {
1947             /* check mkvps */
1948             curmatch = oldmatch = 0;
1949             if (mktype == AES_MK_SET) {
1950                 if (cur_mkvp && cur_mkvp == ci.cur_aes_mkvp)
1951                     curmatch = 1;
1952                 if (old_mkvp && ci.old_aes_mk_state == '2' &&
1953                     old_mkvp == ci.old_aes_mkvp)
1954                     oldmatch = 1;
1955             } else {
1956                 if (cur_mkvp && cur_mkvp == ci.cur_apka_mkvp)
1957                     curmatch = 1;
1958                 if (old_mkvp && ci.old_apka_mk_state == '2' &&
1959                     old_mkvp == ci.old_apka_mkvp)
1960                     oldmatch = 1;
1961             }
1962             if (curmatch + oldmatch < 1)
1963                 continue;
1964         }
1965         /* apqn passed all filtering criterons, add to the array */
1966         if (_nr_apqns < 256)
1967             _apqns[_nr_apqns++] = (((u16)card) << 16) | ((u16)dom);
1968     }
1969 
1970     /* nothing found ? */
1971     if (!_nr_apqns) {
1972         kfree(_apqns);
1973         rc = -ENODEV;
1974     } else {
1975         /* no re-allocation, simple return the _apqns array */
1976         *apqns = _apqns;
1977         *nr_apqns = _nr_apqns;
1978         rc = 0;
1979     }
1980 
1981     kvfree(device_status);
1982     return rc;
1983 }
1984 EXPORT_SYMBOL(cca_findcard2);
1985 
1986 void __exit zcrypt_ccamisc_exit(void)
1987 {
1988     mkvp_cache_free();
1989 }
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!