?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 4.19.133
[linux/fpc-iii.git] / drivers / s390 / crypto / pkey_api.c
blobb16344479959b6f7e042b7f1ed46a769a1262cb5
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * pkey device driver
4 *
5 * Copyright IBM Corp. 2017
6 * Author(s): Harald Freudenberger
7 */
8
9 #define KMSG_COMPONENT "pkey"
10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12 #include <linux/fs.h>
13 #include <linux/init.h>
14 #include <linux/miscdevice.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/kallsyms.h>
18 #include <linux/debugfs.h>
19 #include <asm/zcrypt.h>
20 #include <asm/cpacf.h>
21 #include <asm/pkey.h>
22
23 #include "zcrypt_api.h"
24
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("IBM Corporation");
27 MODULE_DESCRIPTION("s390 protected key interface");
28
29 /* Size of parameter block used for all cca requests/replies */
30 #define PARMBSIZE 512
31
32 /* Size of vardata block used for some of the cca requests/replies */
33 #define VARDATASIZE 4096
34
35 /*
36 * debug feature data and functions
37 */
38
39 static debug_info_t *debug_info;
40
41 #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__)
42 #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__)
43 #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__)
44 #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__)
45
46 static void __init pkey_debug_init(void)
47 {
48 /* 5 arguments per dbf entry (including the format string ptr) */
49 debug_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
50 debug_register_view(debug_info, &debug_sprintf_view);
51 debug_set_level(debug_info, 3);
52 }
53
54 static void __exit pkey_debug_exit(void)
55 {
56 debug_unregister(debug_info);
57 }
58
59 /* inside view of a secure key token (only type 0x01 version 0x04) */
60 struct secaeskeytoken {
61 u8 type; /* 0x01 for internal key token */
62 u8 res0[3];
63 u8 version; /* should be 0x04 */
64 u8 res1[1];
65 u8 flag; /* key flags */
66 u8 res2[1];
67 u64 mkvp; /* master key verification pattern */
68 u8 key[32]; /* key value (encrypted) */
69 u8 cv[8]; /* control vector */
70 u16 bitsize; /* key bit size */
71 u16 keysize; /* key byte size */
72 u8 tvv[4]; /* token validation value */
73 } __packed;
74
75 /*
76 * Simple check if the token is a valid CCA secure AES key
77 * token. If keybitsize is given, the bitsize of the key is
78 * also checked. Returns 0 on success or errno value on failure.
79 */
80 static int check_secaeskeytoken(const u8 *token, int keybitsize)
81 {
82 struct secaeskeytoken *t = (struct secaeskeytoken *) token;
83
84 if (t->type != 0x01) {
85 DEBUG_ERR(
86 "%s secure token check failed, type mismatch 0x%02x != 0x01\n",
87 __func__, (int) t->type);
88 return -EINVAL;
89 }
90 if (t->version != 0x04) {
91 DEBUG_ERR(
92 "%s secure token check failed, version mismatch 0x%02x != 0x04\n",
93 __func__, (int) t->version);
94 return -EINVAL;
95 }
96 if (keybitsize > 0 && t->bitsize != keybitsize) {
97 DEBUG_ERR(
98 "%s secure token check failed, bitsize mismatch %d != %d\n",
99 __func__, (int) t->bitsize, keybitsize);
100 return -EINVAL;
101 }
102
103 return 0;
104 }
105
106 /*
107 * Allocate consecutive memory for request CPRB, request param
108 * block, reply CPRB and reply param block and fill in values
109 * for the common fields. Returns 0 on success or errno value
110 * on failure.
111 */
112 static int alloc_and_prep_cprbmem(size_t paramblen,
113 u8 **pcprbmem,
114 struct CPRBX **preqCPRB,
115 struct CPRBX **prepCPRB)
116 {
117 u8 *cprbmem;
118 size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
119 struct CPRBX *preqcblk, *prepcblk;
120
121 /*
122 * allocate consecutive memory for request CPRB, request param
123 * block, reply CPRB and reply param block
124 */
125 cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
126 if (!cprbmem)
127 return -ENOMEM;
128
129 preqcblk = (struct CPRBX *) cprbmem;
130 prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
131
132 /* fill request cprb struct */
133 preqcblk->cprb_len = sizeof(struct CPRBX);
134 preqcblk->cprb_ver_id = 0x02;
135 memcpy(preqcblk->func_id, "T2", 2);
136 preqcblk->rpl_msgbl = cprbplusparamblen;
137 if (paramblen) {
138 preqcblk->req_parmb =
139 ((u8 *) preqcblk) + sizeof(struct CPRBX);
140 preqcblk->rpl_parmb =
141 ((u8 *) prepcblk) + sizeof(struct CPRBX);
142 }
143
144 *pcprbmem = cprbmem;
145 *preqCPRB = preqcblk;
146 *prepCPRB = prepcblk;
147
148 return 0;
149 }
150
151 /*
152 * Free the cprb memory allocated with the function above.
153 * If the scrub value is not zero, the memory is filled
154 * with zeros before freeing (useful if there was some
155 * clear key material in there).
156 */
157 static void free_cprbmem(void *mem, size_t paramblen, int scrub)
158 {
159 if (scrub)
160 memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
161 kfree(mem);
162 }
163
164 /*
165 * Helper function to prepare the xcrb struct
166 */
167 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
168 u16 cardnr,
169 struct CPRBX *preqcblk,
170 struct CPRBX *prepcblk)
171 {
172 memset(pxcrb, 0, sizeof(*pxcrb));
173 pxcrb->agent_ID = 0x4341; /* 'CA' */
174 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
175 pxcrb->request_control_blk_length =
176 preqcblk->cprb_len + preqcblk->req_parml;
177 pxcrb->request_control_blk_addr = (void __user *) preqcblk;
178 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
179 pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
180 }
181
182 /*
183 * Helper function which calls zcrypt_send_cprb with
184 * memory management segment adjusted to kernel space
185 * so that the copy_from_user called within this
186 * function do in fact copy from kernel space.
187 */
188 static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
189 {
190 int rc;
191 mm_segment_t old_fs = get_fs();
192
193 set_fs(KERNEL_DS);
194 rc = zcrypt_send_cprb(xcrb);
195 set_fs(old_fs);
196
197 return rc;
198 }
199
200 /*
201 * Generate (random) AES secure key.
202 */
203 int pkey_genseckey(u16 cardnr, u16 domain,
204 u32 keytype, struct pkey_seckey *seckey)
205 {
206 int i, rc, keysize;
207 int seckeysize;
208 u8 *mem;
209 struct CPRBX *preqcblk, *prepcblk;
210 struct ica_xcRB xcrb;
211 struct kgreqparm {
212 u8 subfunc_code[2];
213 u16 rule_array_len;
214 struct lv1 {
215 u16 len;
216 char key_form[8];
217 char key_length[8];
218 char key_type1[8];
219 char key_type2[8];
220 } lv1;
221 struct lv2 {
222 u16 len;
223 struct keyid {
224 u16 len;
225 u16 attr;
226 u8 data[SECKEYBLOBSIZE];
227 } keyid[6];
228 } lv2;
229 } *preqparm;
230 struct kgrepparm {
231 u8 subfunc_code[2];
232 u16 rule_array_len;
233 struct lv3 {
234 u16 len;
235 u16 keyblocklen;
236 struct {
237 u16 toklen;
238 u16 tokattr;
239 u8 tok[0];
240 /* ... some more data ... */
241 } keyblock;
242 } lv3;
243 } *prepparm;
244
245 /* get already prepared memory for 2 cprbs with param block each */
246 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
247 if (rc)
248 return rc;
249
250 /* fill request cprb struct */
251 preqcblk->domain = domain;
252
253 /* fill request cprb param block with KG request */
254 preqparm = (struct kgreqparm *) preqcblk->req_parmb;
255 memcpy(preqparm->subfunc_code, "KG", 2);
256 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
257 preqparm->lv1.len = sizeof(struct lv1);
258 memcpy(preqparm->lv1.key_form, "OP ", 8);
259 switch (keytype) {
260 case PKEY_KEYTYPE_AES_128:
261 keysize = 16;
262 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
263 break;
264 case PKEY_KEYTYPE_AES_192:
265 keysize = 24;
266 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
267 break;
268 case PKEY_KEYTYPE_AES_256:
269 keysize = 32;
270 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
271 break;
272 default:
273 DEBUG_ERR(
274 "%s unknown/unsupported keytype %d\n",
275 __func__, keytype);
276 rc = -EINVAL;
277 goto out;
278 }
279 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
280 preqparm->lv2.len = sizeof(struct lv2);
281 for (i = 0; i < 6; i++) {
282 preqparm->lv2.keyid[i].len = sizeof(struct keyid);
283 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
284 }
285 preqcblk->req_parml = sizeof(struct kgreqparm);
286
287 /* fill xcrb struct */
288 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
289
290 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
291 rc = _zcrypt_send_cprb(&xcrb);
292 if (rc) {
293 DEBUG_ERR(
294 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
295 __func__, (int) cardnr, (int) domain, rc);
296 goto out;
297 }
298
299 /* check response returncode and reasoncode */
300 if (prepcblk->ccp_rtcode != 0) {
301 DEBUG_ERR(
302 "%s secure key generate failure, card response %d/%d\n",
303 __func__,
304 (int) prepcblk->ccp_rtcode,
305 (int) prepcblk->ccp_rscode);
306 rc = -EIO;
307 goto out;
308 }
309
310 /* process response cprb param block */
311 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
312 prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
313
314 /* check length of the returned secure key token */
315 seckeysize = prepparm->lv3.keyblock.toklen
316 - sizeof(prepparm->lv3.keyblock.toklen)
317 - sizeof(prepparm->lv3.keyblock.tokattr);
318 if (seckeysize != SECKEYBLOBSIZE) {
319 DEBUG_ERR(
320 "%s secure token size mismatch %d != %d bytes\n",
321 __func__, seckeysize, SECKEYBLOBSIZE);
322 rc = -EIO;
323 goto out;
324 }
325
326 /* check secure key token */
327 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
328 if (rc) {
329 rc = -EIO;
330 goto out;
331 }
332
333 /* copy the generated secure key token */
334 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
335
336 out:
337 free_cprbmem(mem, PARMBSIZE, 0);
338 return rc;
339 }
340 EXPORT_SYMBOL(pkey_genseckey);
341
342 /*
343 * Generate an AES secure key with given key value.
344 */
345 int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
346 const struct pkey_clrkey *clrkey,
347 struct pkey_seckey *seckey)
348 {
349 int rc, keysize, seckeysize;
350 u8 *mem;
351 struct CPRBX *preqcblk, *prepcblk;
352 struct ica_xcRB xcrb;
353 struct cmreqparm {
354 u8 subfunc_code[2];
355 u16 rule_array_len;
356 char rule_array[8];
357 struct lv1 {
358 u16 len;
359 u8 clrkey[0];
360 } lv1;
361 struct lv2 {
362 u16 len;
363 struct keyid {
364 u16 len;
365 u16 attr;
366 u8 data[SECKEYBLOBSIZE];
367 } keyid;
368 } lv2;
369 } *preqparm;
370 struct lv2 *plv2;
371 struct cmrepparm {
372 u8 subfunc_code[2];
373 u16 rule_array_len;
374 struct lv3 {
375 u16 len;
376 u16 keyblocklen;
377 struct {
378 u16 toklen;
379 u16 tokattr;
380 u8 tok[0];
381 /* ... some more data ... */
382 } keyblock;
383 } lv3;
384 } *prepparm;
385
386 /* get already prepared memory for 2 cprbs with param block each */
387 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
388 if (rc)
389 return rc;
390
391 /* fill request cprb struct */
392 preqcblk->domain = domain;
393
394 /* fill request cprb param block with CM request */
395 preqparm = (struct cmreqparm *) preqcblk->req_parmb;
396 memcpy(preqparm->subfunc_code, "CM", 2);
397 memcpy(preqparm->rule_array, "AES ", 8);
398 preqparm->rule_array_len =
399 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
400 switch (keytype) {
401 case PKEY_KEYTYPE_AES_128:
402 keysize = 16;
403 break;
404 case PKEY_KEYTYPE_AES_192:
405 keysize = 24;
406 break;
407 case PKEY_KEYTYPE_AES_256:
408 keysize = 32;
409 break;
410 default:
411 DEBUG_ERR(
412 "%s unknown/unsupported keytype %d\n",
413 __func__, keytype);
414 rc = -EINVAL;
415 goto out;
416 }
417 preqparm->lv1.len = sizeof(struct lv1) + keysize;
418 memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize);
419 plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
420 plv2->len = sizeof(struct lv2);
421 plv2->keyid.len = sizeof(struct keyid);
422 plv2->keyid.attr = 0x30;
423 preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
424
425 /* fill xcrb struct */
426 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
427
428 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
429 rc = _zcrypt_send_cprb(&xcrb);
430 if (rc) {
431 DEBUG_ERR(
432 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
433 __func__, (int) cardnr, (int) domain, rc);
434 goto out;
435 }
436
437 /* check response returncode and reasoncode */
438 if (prepcblk->ccp_rtcode != 0) {
439 DEBUG_ERR(
440 "%s clear key import failure, card response %d/%d\n",
441 __func__,
442 (int) prepcblk->ccp_rtcode,
443 (int) prepcblk->ccp_rscode);
444 rc = -EIO;
445 goto out;
446 }
447
448 /* process response cprb param block */
449 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
450 prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
451
452 /* check length of the returned secure key token */
453 seckeysize = prepparm->lv3.keyblock.toklen
454 - sizeof(prepparm->lv3.keyblock.toklen)
455 - sizeof(prepparm->lv3.keyblock.tokattr);
456 if (seckeysize != SECKEYBLOBSIZE) {
457 DEBUG_ERR(
458 "%s secure token size mismatch %d != %d bytes\n",
459 __func__, seckeysize, SECKEYBLOBSIZE);
460 rc = -EIO;
461 goto out;
462 }
463
464 /* check secure key token */
465 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
466 if (rc) {
467 rc = -EIO;
468 goto out;
469 }
470
471 /* copy the generated secure key token */
472 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
473
474 out:
475 free_cprbmem(mem, PARMBSIZE, 1);
476 return rc;
477 }
478 EXPORT_SYMBOL(pkey_clr2seckey);
479
480 /*
481 * Derive a proteced key from the secure key blob.
482 */
483 int pkey_sec2protkey(u16 cardnr, u16 domain,
484 const struct pkey_seckey *seckey,
485 struct pkey_protkey *protkey)
486 {
487 int rc;
488 u8 *mem;
489 struct CPRBX *preqcblk, *prepcblk;
490 struct ica_xcRB xcrb;
491 struct uskreqparm {
492 u8 subfunc_code[2];
493 u16 rule_array_len;
494 struct lv1 {
495 u16 len;
496 u16 attr_len;
497 u16 attr_flags;
498 } lv1;
499 struct lv2 {
500 u16 len;
501 u16 attr_len;
502 u16 attr_flags;
503 u8 token[0]; /* cca secure key token */
504 } lv2 __packed;
505 } *preqparm;
506 struct uskrepparm {
507 u8 subfunc_code[2];
508 u16 rule_array_len;
509 struct lv3 {
510 u16 len;
511 u16 attr_len;
512 u16 attr_flags;
513 struct cpacfkeyblock {
514 u8 version; /* version of this struct */
515 u8 flags[2];
516 u8 algo;
517 u8 form;
518 u8 pad1[3];
519 u16 keylen;
520 u8 key[64]; /* the key (keylen bytes) */
521 u16 keyattrlen;
522 u8 keyattr[32];
523 u8 pad2[1];
524 u8 vptype;
525 u8 vp[32]; /* verification pattern */
526 } keyblock;
527 } lv3 __packed;
528 } *prepparm;
529
530 /* get already prepared memory for 2 cprbs with param block each */
531 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
532 if (rc)
533 return rc;
534
535 /* fill request cprb struct */
536 preqcblk->domain = domain;
537
538 /* fill request cprb param block with USK request */
539 preqparm = (struct uskreqparm *) preqcblk->req_parmb;
540 memcpy(preqparm->subfunc_code, "US", 2);
541 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
542 preqparm->lv1.len = sizeof(struct lv1);
543 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
544 preqparm->lv1.attr_flags = 0x0001;
545 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
546 preqparm->lv2.attr_len = sizeof(struct lv2)
547 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
548 preqparm->lv2.attr_flags = 0x0000;
549 memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE);
550 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
551
552 /* fill xcrb struct */
553 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
554
555 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
556 rc = _zcrypt_send_cprb(&xcrb);
557 if (rc) {
558 DEBUG_ERR(
559 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
560 __func__, (int) cardnr, (int) domain, rc);
561 goto out;
562 }
563
564 /* check response returncode and reasoncode */
565 if (prepcblk->ccp_rtcode != 0) {
566 DEBUG_ERR(
567 "%s unwrap secure key failure, card response %d/%d\n",
568 __func__,
569 (int) prepcblk->ccp_rtcode,
570 (int) prepcblk->ccp_rscode);
571 rc = -EIO;
572 goto out;
573 }
574 if (prepcblk->ccp_rscode != 0) {
575 DEBUG_WARN(
576 "%s unwrap secure key warning, card response %d/%d\n",
577 __func__,
578 (int) prepcblk->ccp_rtcode,
579 (int) prepcblk->ccp_rscode);
580 }
581
582 /* process response cprb param block */
583 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
584 prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
585
586 /* check the returned keyblock */
587 if (prepparm->lv3.keyblock.version != 0x01) {
588 DEBUG_ERR(
589 "%s reply param keyblock version mismatch 0x%02x != 0x01\n",
590 __func__, (int) prepparm->lv3.keyblock.version);
591 rc = -EIO;
592 goto out;
593 }
594
595 /* copy the tanslated protected key */
596 switch (prepparm->lv3.keyblock.keylen) {
597 case 16+32:
598 protkey->type = PKEY_KEYTYPE_AES_128;
599 break;
600 case 24+32:
601 protkey->type = PKEY_KEYTYPE_AES_192;
602 break;
603 case 32+32:
604 protkey->type = PKEY_KEYTYPE_AES_256;
605 break;
606 default:
607 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
608 __func__, prepparm->lv3.keyblock.keylen);
609 rc = -EIO;
610 goto out;
611 }
612 protkey->len = prepparm->lv3.keyblock.keylen;
613 memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len);
614
615 out:
616 free_cprbmem(mem, PARMBSIZE, 0);
617 return rc;
618 }
619 EXPORT_SYMBOL(pkey_sec2protkey);
620
621 /*
622 * Create a protected key from a clear key value.
623 */
624 int pkey_clr2protkey(u32 keytype,
625 const struct pkey_clrkey *clrkey,
626 struct pkey_protkey *protkey)
627 {
628 long fc;
629 int keysize;
630 u8 paramblock[64];
631
632 switch (keytype) {
633 case PKEY_KEYTYPE_AES_128:
634 keysize = 16;
635 fc = CPACF_PCKMO_ENC_AES_128_KEY;
636 break;
637 case PKEY_KEYTYPE_AES_192:
638 keysize = 24;
639 fc = CPACF_PCKMO_ENC_AES_192_KEY;
640 break;
641 case PKEY_KEYTYPE_AES_256:
642 keysize = 32;
643 fc = CPACF_PCKMO_ENC_AES_256_KEY;
644 break;
645 default:
646 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
647 __func__, keytype);
648 return -EINVAL;
649 }
650
651 /* prepare param block */
652 memset(paramblock, 0, sizeof(paramblock));
653 memcpy(paramblock, clrkey->clrkey, keysize);
654
655 /* call the pckmo instruction */
656 cpacf_pckmo(fc, paramblock);
657
658 /* copy created protected key */
659 protkey->type = keytype;
660 protkey->len = keysize + 32;
661 memcpy(protkey->protkey, paramblock, keysize + 32);
662
663 return 0;
664 }
665 EXPORT_SYMBOL(pkey_clr2protkey);
666
667 /*
668 * query cryptographic facility from adapter
669 */
670 static int query_crypto_facility(u16 cardnr, u16 domain,
671 const char *keyword,
672 u8 *rarray, size_t *rarraylen,
673 u8 *varray, size_t *varraylen)
674 {
675 int rc;
676 u16 len;
677 u8 *mem, *ptr;
678 struct CPRBX *preqcblk, *prepcblk;
679 struct ica_xcRB xcrb;
680 struct fqreqparm {
681 u8 subfunc_code[2];
682 u16 rule_array_len;
683 char rule_array[8];
684 struct lv1 {
685 u16 len;
686 u8 data[VARDATASIZE];
687 } lv1;
688 u16 dummylen;
689 } *preqparm;
690 size_t parmbsize = sizeof(struct fqreqparm);
691 struct fqrepparm {
692 u8 subfunc_code[2];
693 u8 lvdata[0];
694 } *prepparm;
695
696 /* get already prepared memory for 2 cprbs with param block each */
697 rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
698 if (rc)
699 return rc;
700
701 /* fill request cprb struct */
702 preqcblk->domain = domain;
703
704 /* fill request cprb param block with FQ request */
705 preqparm = (struct fqreqparm *) preqcblk->req_parmb;
706 memcpy(preqparm->subfunc_code, "FQ", 2);
707 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
708 preqparm->rule_array_len =
709 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
710 preqparm->lv1.len = sizeof(preqparm->lv1);
711 preqparm->dummylen = sizeof(preqparm->dummylen);
712 preqcblk->req_parml = parmbsize;
713
714 /* fill xcrb struct */
715 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
716
717 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
718 rc = _zcrypt_send_cprb(&xcrb);
719 if (rc) {
720 DEBUG_ERR(
721 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
722 __func__, (int) cardnr, (int) domain, rc);
723 goto out;
724 }
725
726 /* check response returncode and reasoncode */
727 if (prepcblk->ccp_rtcode != 0) {
728 DEBUG_ERR(
729 "%s unwrap secure key failure, card response %d/%d\n",
730 __func__,
731 (int) prepcblk->ccp_rtcode,
732 (int) prepcblk->ccp_rscode);
733 rc = -EIO;
734 goto out;
735 }
736
737 /* process response cprb param block */
738 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
739 prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
740 ptr = prepparm->lvdata;
741
742 /* check and possibly copy reply rule array */
743 len = *((u16 *) ptr);
744 if (len > sizeof(u16)) {
745 ptr += sizeof(u16);
746 len -= sizeof(u16);
747 if (rarray && rarraylen && *rarraylen > 0) {
748 *rarraylen = (len > *rarraylen ? *rarraylen : len);
749 memcpy(rarray, ptr, *rarraylen);
750 }
751 ptr += len;
752 }
753 /* check and possible copy reply var array */
754 len = *((u16 *) ptr);
755 if (len > sizeof(u16)) {
756 ptr += sizeof(u16);
757 len -= sizeof(u16);
758 if (varray && varraylen && *varraylen > 0) {
759 *varraylen = (len > *varraylen ? *varraylen : len);
760 memcpy(varray, ptr, *varraylen);
761 }
762 ptr += len;
763 }
764
765 out:
766 free_cprbmem(mem, parmbsize, 0);
767 return rc;
768 }
769
770 /*
771 * Fetch the current and old mkvp values via
772 * query_crypto_facility from adapter.
773 */
774 static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
775 {
776 int rc, found = 0;
777 size_t rlen, vlen;
778 u8 *rarray, *varray, *pg;
779
780 pg = (u8 *) __get_free_page(GFP_KERNEL);
781 if (!pg)
782 return -ENOMEM;
783 rarray = pg;
784 varray = pg + PAGE_SIZE/2;
785 rlen = vlen = PAGE_SIZE/2;
786
787 rc = query_crypto_facility(cardnr, domain, "STATICSA",
788 rarray, &rlen, varray, &vlen);
789 if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
790 if (rarray[8*8] == '2') {
791 /* current master key state is valid */
792 mkvp[0] = *((u64 *)(varray + 184));
793 mkvp[1] = *((u64 *)(varray + 172));
794 found = 1;
795 }
796 }
797
798 free_page((unsigned long) pg);
799
800 return found ? 0 : -ENOENT;
801 }
802
803 /* struct to hold cached mkvp info for each card/domain */
804 struct mkvp_info {
805 struct list_head list;
806 u16 cardnr;
807 u16 domain;
808 u64 mkvp[2];
809 };
810
811 /* a list with mkvp_info entries */
812 static LIST_HEAD(mkvp_list);
813 static DEFINE_SPINLOCK(mkvp_list_lock);
814
815 static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
816 {
817 int rc = -ENOENT;
818 struct mkvp_info *ptr;
819
820 spin_lock_bh(&mkvp_list_lock);
821 list_for_each_entry(ptr, &mkvp_list, list) {
822 if (ptr->cardnr == cardnr &&
823 ptr->domain == domain) {
824 memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
825 rc = 0;
826 break;
827 }
828 }
829 spin_unlock_bh(&mkvp_list_lock);
830
831 return rc;
832 }
833
834 static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
835 {
836 int found = 0;
837 struct mkvp_info *ptr;
838
839 spin_lock_bh(&mkvp_list_lock);
840 list_for_each_entry(ptr, &mkvp_list, list) {
841 if (ptr->cardnr == cardnr &&
842 ptr->domain == domain) {
843 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
844 found = 1;
845 break;
846 }
847 }
848 if (!found) {
849 ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
850 if (!ptr) {
851 spin_unlock_bh(&mkvp_list_lock);
852 return;
853 }
854 ptr->cardnr = cardnr;
855 ptr->domain = domain;
856 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
857 list_add(&ptr->list, &mkvp_list);
858 }
859 spin_unlock_bh(&mkvp_list_lock);
860 }
861
862 static void mkvp_cache_scrub(u16 cardnr, u16 domain)
863 {
864 struct mkvp_info *ptr;
865
866 spin_lock_bh(&mkvp_list_lock);
867 list_for_each_entry(ptr, &mkvp_list, list) {
868 if (ptr->cardnr == cardnr &&
869 ptr->domain == domain) {
870 list_del(&ptr->list);
871 kfree(ptr);
872 break;
873 }
874 }
875 spin_unlock_bh(&mkvp_list_lock);
876 }
877
878 static void __exit mkvp_cache_free(void)
879 {
880 struct mkvp_info *ptr, *pnext;
881
882 spin_lock_bh(&mkvp_list_lock);
883 list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) {
884 list_del(&ptr->list);
885 kfree(ptr);
886 }
887 spin_unlock_bh(&mkvp_list_lock);
888 }
889
890 /*
891 * Search for a matching crypto card based on the Master Key
892 * Verification Pattern provided inside a secure key.
893 */
894 int pkey_findcard(const struct pkey_seckey *seckey,
895 u16 *pcardnr, u16 *pdomain, int verify)
896 {
897 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
898 struct zcrypt_device_status_ext *device_status;
899 u16 card, dom;
900 u64 mkvp[2];
901 int i, rc, oi = -1;
902
903 /* mkvp must not be zero */
904 if (t->mkvp == 0)
905 return -EINVAL;
906
907 /* fetch status of all crypto cards */
908 device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
909 sizeof(struct zcrypt_device_status_ext),
910 GFP_KERNEL);
911 if (!device_status)
912 return -ENOMEM;
913 zcrypt_device_status_mask_ext(device_status);
914
915 /* walk through all crypto cards */
916 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
917 card = AP_QID_CARD(device_status[i].qid);
918 dom = AP_QID_QUEUE(device_status[i].qid);
919 if (device_status[i].online &&
920 device_status[i].functions & 0x04) {
921 /* an enabled CCA Coprocessor card */
922 /* try cached mkvp */
923 if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
924 t->mkvp == mkvp[0]) {
925 if (!verify)
926 break;
927 /* verify: fetch mkvp from adapter */
928 if (fetch_mkvp(card, dom, mkvp) == 0) {
929 mkvp_cache_update(card, dom, mkvp);
930 if (t->mkvp == mkvp[0])
931 break;
932 }
933 }
934 } else {
935 /* Card is offline and/or not a CCA card. */
936 /* del mkvp entry from cache if it exists */
937 mkvp_cache_scrub(card, dom);
938 }
939 }
940 if (i >= MAX_ZDEV_ENTRIES_EXT) {
941 /* nothing found, so this time without cache */
942 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
943 if (!(device_status[i].online &&
944 device_status[i].functions & 0x04))
945 continue;
946 card = AP_QID_CARD(device_status[i].qid);
947 dom = AP_QID_QUEUE(device_status[i].qid);
948 /* fresh fetch mkvp from adapter */
949 if (fetch_mkvp(card, dom, mkvp) == 0) {
950 mkvp_cache_update(card, dom, mkvp);
951 if (t->mkvp == mkvp[0])
952 break;
953 if (t->mkvp == mkvp[1] && oi < 0)
954 oi = i;
955 }
956 }
957 if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
958 /* old mkvp matched, use this card then */
959 card = AP_QID_CARD(device_status[oi].qid);
960 dom = AP_QID_QUEUE(device_status[oi].qid);
961 }
962 }
963 if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
964 if (pcardnr)
965 *pcardnr = card;
966 if (pdomain)
967 *pdomain = dom;
968 rc = 0;
969 } else
970 rc = -ENODEV;
971
972 kfree(device_status);
973 return rc;
974 }
975 EXPORT_SYMBOL(pkey_findcard);
976
977 /*
978 * Find card and transform secure key into protected key.
979 */
980 int pkey_skey2pkey(const struct pkey_seckey *seckey,
981 struct pkey_protkey *protkey)
982 {
983 u16 cardnr, domain;
984 int rc, verify;
985
986 /*
987 * The pkey_sec2protkey call may fail when a card has been
988 * addressed where the master key was changed after last fetch
989 * of the mkvp into the cache. So first try without verify then
990 * with verify enabled (thus refreshing the mkvp for each card).
991 */
992 for (verify = 0; verify < 2; verify++) {
993 rc = pkey_findcard(seckey, &cardnr, &domain, verify);
994 if (rc)
995 continue;
996 rc = pkey_sec2protkey(cardnr, domain, seckey, protkey);
997 if (rc == 0)
998 break;
999 }
1000
1001 if (rc)
1002 DEBUG_DBG("%s failed rc=%d\n", __func__, rc);
1003
1004 return rc;
1005 }
1006 EXPORT_SYMBOL(pkey_skey2pkey);
1007
1008 /*
1009 * Verify key and give back some info about the key.
1010 */
1011 int pkey_verifykey(const struct pkey_seckey *seckey,
1012 u16 *pcardnr, u16 *pdomain,
1013 u16 *pkeysize, u32 *pattributes)
1014 {
1015 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
1016 u16 cardnr, domain;
1017 u64 mkvp[2];
1018 int rc;
1019
1020 /* check the secure key for valid AES secure key */
1021 rc = check_secaeskeytoken((u8 *) seckey, 0);
1022 if (rc)
1023 goto out;
1024 if (pattributes)
1025 *pattributes = PKEY_VERIFY_ATTR_AES;
1026 if (pkeysize)
1027 *pkeysize = t->bitsize;
1028
1029 /* try to find a card which can handle this key */
1030 rc = pkey_findcard(seckey, &cardnr, &domain, 1);
1031 if (rc)
1032 goto out;
1033
1034 /* check mkvp for old mkvp match */
1035 rc = mkvp_cache_fetch(cardnr, domain, mkvp);
1036 if (rc)
1037 goto out;
1038 if (t->mkvp == mkvp[1]) {
1039 DEBUG_DBG("%s secure key has old mkvp\n", __func__);
1040 if (pattributes)
1041 *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
1042 }
1043
1044 if (pcardnr)
1045 *pcardnr = cardnr;
1046 if (pdomain)
1047 *pdomain = domain;
1048
1049 out:
1050 DEBUG_DBG("%s rc=%d\n", __func__, rc);
1051 return rc;
1052 }
1053 EXPORT_SYMBOL(pkey_verifykey);
1054
1055 /*
1056 * File io functions
1057 */
1058
1059 static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
1060 unsigned long arg)
1061 {
1062 int rc;
1063
1064 switch (cmd) {
1065 case PKEY_GENSECK: {
1066 struct pkey_genseck __user *ugs = (void __user *) arg;
1067 struct pkey_genseck kgs;
1068
1069 if (copy_from_user(&kgs, ugs, sizeof(kgs)))
1070 return -EFAULT;
1071 rc = pkey_genseckey(kgs.cardnr, kgs.domain,
1072 kgs.keytype, &kgs.seckey);
1073 DEBUG_DBG("%s pkey_genseckey()=%d\n", __func__, rc);
1074 if (rc)
1075 break;
1076 if (copy_to_user(ugs, &kgs, sizeof(kgs)))
1077 return -EFAULT;
1078 break;
1079 }
1080 case PKEY_CLR2SECK: {
1081 struct pkey_clr2seck __user *ucs = (void __user *) arg;
1082 struct pkey_clr2seck kcs;
1083
1084 if (copy_from_user(&kcs, ucs, sizeof(kcs)))
1085 return -EFAULT;
1086 rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
1087 &kcs.clrkey, &kcs.seckey);
1088 DEBUG_DBG("%s pkey_clr2seckey()=%d\n", __func__, rc);
1089 if (rc)
1090 break;
1091 if (copy_to_user(ucs, &kcs, sizeof(kcs)))
1092 return -EFAULT;
1093 memzero_explicit(&kcs, sizeof(kcs));
1094 break;
1095 }
1096 case PKEY_SEC2PROTK: {
1097 struct pkey_sec2protk __user *usp = (void __user *) arg;
1098 struct pkey_sec2protk ksp;
1099
1100 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1101 return -EFAULT;
1102 rc = pkey_sec2protkey(ksp.cardnr, ksp.domain,
1103 &ksp.seckey, &ksp.protkey);
1104 DEBUG_DBG("%s pkey_sec2protkey()=%d\n", __func__, rc);
1105 if (rc)
1106 break;
1107 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1108 return -EFAULT;
1109 break;
1110 }
1111 case PKEY_CLR2PROTK: {
1112 struct pkey_clr2protk __user *ucp = (void __user *) arg;
1113 struct pkey_clr2protk kcp;
1114
1115 if (copy_from_user(&kcp, ucp, sizeof(kcp)))
1116 return -EFAULT;
1117 rc = pkey_clr2protkey(kcp.keytype,
1118 &kcp.clrkey, &kcp.protkey);
1119 DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc);
1120 if (rc)
1121 break;
1122 if (copy_to_user(ucp, &kcp, sizeof(kcp)))
1123 return -EFAULT;
1124 memzero_explicit(&kcp, sizeof(kcp));
1125 break;
1126 }
1127 case PKEY_FINDCARD: {
1128 struct pkey_findcard __user *ufc = (void __user *) arg;
1129 struct pkey_findcard kfc;
1130
1131 if (copy_from_user(&kfc, ufc, sizeof(kfc)))
1132 return -EFAULT;
1133 rc = pkey_findcard(&kfc.seckey,
1134 &kfc.cardnr, &kfc.domain, 1);
1135 DEBUG_DBG("%s pkey_findcard()=%d\n", __func__, rc);
1136 if (rc)
1137 break;
1138 if (copy_to_user(ufc, &kfc, sizeof(kfc)))
1139 return -EFAULT;
1140 break;
1141 }
1142 case PKEY_SKEY2PKEY: {
1143 struct pkey_skey2pkey __user *usp = (void __user *) arg;
1144 struct pkey_skey2pkey ksp;
1145
1146 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1147 return -EFAULT;
1148 rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey);
1149 DEBUG_DBG("%s pkey_skey2pkey()=%d\n", __func__, rc);
1150 if (rc)
1151 break;
1152 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1153 return -EFAULT;
1154 break;
1155 }
1156 case PKEY_VERIFYKEY: {
1157 struct pkey_verifykey __user *uvk = (void __user *) arg;
1158 struct pkey_verifykey kvk;
1159
1160 if (copy_from_user(&kvk, uvk, sizeof(kvk)))
1161 return -EFAULT;
1162 rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
1163 &kvk.keysize, &kvk.attributes);
1164 DEBUG_DBG("%s pkey_verifykey()=%d\n", __func__, rc);
1165 if (rc)
1166 break;
1167 if (copy_to_user(uvk, &kvk, sizeof(kvk)))
1168 return -EFAULT;
1169 break;
1170 }
1171 default:
1172 /* unknown/unsupported ioctl cmd */
1173 return -ENOTTY;
1174 }
1175
1176 return rc;
1177 }
1178
1179 /*
1180 * Sysfs and file io operations
1181 */
1182 static const struct file_operations pkey_fops = {
1183 .owner = THIS_MODULE,
1184 .open = nonseekable_open,
1185 .llseek = no_llseek,
1186 .unlocked_ioctl = pkey_unlocked_ioctl,
1187 };
1188
1189 static struct miscdevice pkey_dev = {
1190 .name = "pkey",
1191 .minor = MISC_DYNAMIC_MINOR,
1192 .mode = 0666,
1193 .fops = &pkey_fops,
1194 };
1195
1196 /*
1197 * Module init
1198 */
1199 static int __init pkey_init(void)
1200 {
1201 cpacf_mask_t pckmo_functions;
1202
1203 /* check for pckmo instructions available */
1204 if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
1205 return -EOPNOTSUPP;
1206 if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) ||
1207 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) ||
1208 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY))
1209 return -EOPNOTSUPP;
1210
1211 pkey_debug_init();
1212
1213 return misc_register(&pkey_dev);
1214 }
1215
1216 /*
1217 * Module exit
1218 */
1219 static void __exit pkey_exit(void)
1220 {
1221 misc_deregister(&pkey_dev);
1222 mkvp_cache_free();
1223 pkey_debug_exit();
1224 }
1225
1226 module_init(pkey_init);
1227 module_exit(pkey_exit);
Linux with added FPC-III support