?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
staging: rtl8188eu: rename HalSetBrateCfg() - style
[linux/fpc-iii.git] / drivers / s390 / crypto / pkey_api.c
blob1b4001e0285fe0a5979558e2e9e2ce8f60e0808e
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * pkey device driver
4 *
5 * Copyright IBM Corp. 2017
6 * Author(s): Harald Freudenberger
7 */
8
9 #define KMSG_COMPONENT "pkey"
10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12 #include <linux/fs.h>
13 #include <linux/init.h>
14 #include <linux/miscdevice.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/kallsyms.h>
18 #include <linux/debugfs.h>
19 #include <asm/zcrypt.h>
20 #include <asm/cpacf.h>
21 #include <asm/pkey.h>
22
23 #include "zcrypt_api.h"
24
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("IBM Corporation");
27 MODULE_DESCRIPTION("s390 protected key interface");
28
29 /* Size of parameter block used for all cca requests/replies */
30 #define PARMBSIZE 512
31
32 /* Size of vardata block used for some of the cca requests/replies */
33 #define VARDATASIZE 4096
34
35 /*
36 * debug feature data and functions
37 */
38
39 static debug_info_t *debug_info;
40
41 #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__)
42 #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__)
43 #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__)
44 #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__)
45
46 static void __init pkey_debug_init(void)
47 {
48 debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long));
49 debug_register_view(debug_info, &debug_sprintf_view);
50 debug_set_level(debug_info, 3);
51 }
52
53 static void __exit pkey_debug_exit(void)
54 {
55 debug_unregister(debug_info);
56 }
57
58 /* inside view of a secure key token (only type 0x01 version 0x04) */
59 struct secaeskeytoken {
60 u8 type; /* 0x01 for internal key token */
61 u8 res0[3];
62 u8 version; /* should be 0x04 */
63 u8 res1[1];
64 u8 flag; /* key flags */
65 u8 res2[1];
66 u64 mkvp; /* master key verification pattern */
67 u8 key[32]; /* key value (encrypted) */
68 u8 cv[8]; /* control vector */
69 u16 bitsize; /* key bit size */
70 u16 keysize; /* key byte size */
71 u8 tvv[4]; /* token validation value */
72 } __packed;
73
74 /*
75 * Simple check if the token is a valid CCA secure AES key
76 * token. If keybitsize is given, the bitsize of the key is
77 * also checked. Returns 0 on success or errno value on failure.
78 */
79 static int check_secaeskeytoken(const u8 *token, int keybitsize)
80 {
81 struct secaeskeytoken *t = (struct secaeskeytoken *) token;
82
83 if (t->type != 0x01) {
84 DEBUG_ERR(
85 "%s secure token check failed, type mismatch 0x%02x != 0x01\n",
86 __func__, (int) t->type);
87 return -EINVAL;
88 }
89 if (t->version != 0x04) {
90 DEBUG_ERR(
91 "%s secure token check failed, version mismatch 0x%02x != 0x04\n",
92 __func__, (int) t->version);
93 return -EINVAL;
94 }
95 if (keybitsize > 0 && t->bitsize != keybitsize) {
96 DEBUG_ERR(
97 "%s secure token check failed, bitsize mismatch %d != %d\n",
98 __func__, (int) t->bitsize, keybitsize);
99 return -EINVAL;
100 }
101
102 return 0;
103 }
104
105 /*
106 * Allocate consecutive memory for request CPRB, request param
107 * block, reply CPRB and reply param block and fill in values
108 * for the common fields. Returns 0 on success or errno value
109 * on failure.
110 */
111 static int alloc_and_prep_cprbmem(size_t paramblen,
112 u8 **pcprbmem,
113 struct CPRBX **preqCPRB,
114 struct CPRBX **prepCPRB)
115 {
116 u8 *cprbmem;
117 size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
118 struct CPRBX *preqcblk, *prepcblk;
119
120 /*
121 * allocate consecutive memory for request CPRB, request param
122 * block, reply CPRB and reply param block
123 */
124 cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
125 if (!cprbmem)
126 return -ENOMEM;
127
128 preqcblk = (struct CPRBX *) cprbmem;
129 prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
130
131 /* fill request cprb struct */
132 preqcblk->cprb_len = sizeof(struct CPRBX);
133 preqcblk->cprb_ver_id = 0x02;
134 memcpy(preqcblk->func_id, "T2", 2);
135 preqcblk->rpl_msgbl = cprbplusparamblen;
136 if (paramblen) {
137 preqcblk->req_parmb =
138 ((u8 *) preqcblk) + sizeof(struct CPRBX);
139 preqcblk->rpl_parmb =
140 ((u8 *) prepcblk) + sizeof(struct CPRBX);
141 }
142
143 *pcprbmem = cprbmem;
144 *preqCPRB = preqcblk;
145 *prepCPRB = prepcblk;
146
147 return 0;
148 }
149
150 /*
151 * Free the cprb memory allocated with the function above.
152 * If the scrub value is not zero, the memory is filled
153 * with zeros before freeing (useful if there was some
154 * clear key material in there).
155 */
156 static void free_cprbmem(void *mem, size_t paramblen, int scrub)
157 {
158 if (scrub)
159 memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
160 kfree(mem);
161 }
162
163 /*
164 * Helper function to prepare the xcrb struct
165 */
166 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
167 u16 cardnr,
168 struct CPRBX *preqcblk,
169 struct CPRBX *prepcblk)
170 {
171 memset(pxcrb, 0, sizeof(*pxcrb));
172 pxcrb->agent_ID = 0x4341; /* 'CA' */
173 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
174 pxcrb->request_control_blk_length =
175 preqcblk->cprb_len + preqcblk->req_parml;
176 pxcrb->request_control_blk_addr = (void __user *) preqcblk;
177 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
178 pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
179 }
180
181 /*
182 * Helper function which calls zcrypt_send_cprb with
183 * memory management segment adjusted to kernel space
184 * so that the copy_from_user called within this
185 * function do in fact copy from kernel space.
186 */
187 static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
188 {
189 int rc;
190 mm_segment_t old_fs = get_fs();
191
192 set_fs(KERNEL_DS);
193 rc = zcrypt_send_cprb(xcrb);
194 set_fs(old_fs);
195
196 return rc;
197 }
198
199 /*
200 * Generate (random) AES secure key.
201 */
202 int pkey_genseckey(u16 cardnr, u16 domain,
203 u32 keytype, struct pkey_seckey *seckey)
204 {
205 int i, rc, keysize;
206 int seckeysize;
207 u8 *mem;
208 struct CPRBX *preqcblk, *prepcblk;
209 struct ica_xcRB xcrb;
210 struct kgreqparm {
211 u8 subfunc_code[2];
212 u16 rule_array_len;
213 struct lv1 {
214 u16 len;
215 char key_form[8];
216 char key_length[8];
217 char key_type1[8];
218 char key_type2[8];
219 } lv1;
220 struct lv2 {
221 u16 len;
222 struct keyid {
223 u16 len;
224 u16 attr;
225 u8 data[SECKEYBLOBSIZE];
226 } keyid[6];
227 } lv2;
228 } *preqparm;
229 struct kgrepparm {
230 u8 subfunc_code[2];
231 u16 rule_array_len;
232 struct lv3 {
233 u16 len;
234 u16 keyblocklen;
235 struct {
236 u16 toklen;
237 u16 tokattr;
238 u8 tok[0];
239 /* ... some more data ... */
240 } keyblock;
241 } lv3;
242 } *prepparm;
243
244 /* get already prepared memory for 2 cprbs with param block each */
245 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
246 if (rc)
247 return rc;
248
249 /* fill request cprb struct */
250 preqcblk->domain = domain;
251
252 /* fill request cprb param block with KG request */
253 preqparm = (struct kgreqparm *) preqcblk->req_parmb;
254 memcpy(preqparm->subfunc_code, "KG", 2);
255 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
256 preqparm->lv1.len = sizeof(struct lv1);
257 memcpy(preqparm->lv1.key_form, "OP ", 8);
258 switch (keytype) {
259 case PKEY_KEYTYPE_AES_128:
260 keysize = 16;
261 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
262 break;
263 case PKEY_KEYTYPE_AES_192:
264 keysize = 24;
265 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
266 break;
267 case PKEY_KEYTYPE_AES_256:
268 keysize = 32;
269 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
270 break;
271 default:
272 DEBUG_ERR(
273 "%s unknown/unsupported keytype %d\n",
274 __func__, keytype);
275 rc = -EINVAL;
276 goto out;
277 }
278 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
279 preqparm->lv2.len = sizeof(struct lv2);
280 for (i = 0; i < 6; i++) {
281 preqparm->lv2.keyid[i].len = sizeof(struct keyid);
282 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
283 }
284 preqcblk->req_parml = sizeof(struct kgreqparm);
285
286 /* fill xcrb struct */
287 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
288
289 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
290 rc = _zcrypt_send_cprb(&xcrb);
291 if (rc) {
292 DEBUG_ERR(
293 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
294 __func__, (int) cardnr, (int) domain, rc);
295 goto out;
296 }
297
298 /* check response returncode and reasoncode */
299 if (prepcblk->ccp_rtcode != 0) {
300 DEBUG_ERR(
301 "%s secure key generate failure, card response %d/%d\n",
302 __func__,
303 (int) prepcblk->ccp_rtcode,
304 (int) prepcblk->ccp_rscode);
305 rc = -EIO;
306 goto out;
307 }
308
309 /* process response cprb param block */
310 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
311 prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
312
313 /* check length of the returned secure key token */
314 seckeysize = prepparm->lv3.keyblock.toklen
315 - sizeof(prepparm->lv3.keyblock.toklen)
316 - sizeof(prepparm->lv3.keyblock.tokattr);
317 if (seckeysize != SECKEYBLOBSIZE) {
318 DEBUG_ERR(
319 "%s secure token size mismatch %d != %d bytes\n",
320 __func__, seckeysize, SECKEYBLOBSIZE);
321 rc = -EIO;
322 goto out;
323 }
324
325 /* check secure key token */
326 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
327 if (rc) {
328 rc = -EIO;
329 goto out;
330 }
331
332 /* copy the generated secure key token */
333 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
334
335 out:
336 free_cprbmem(mem, PARMBSIZE, 0);
337 return rc;
338 }
339 EXPORT_SYMBOL(pkey_genseckey);
340
341 /*
342 * Generate an AES secure key with given key value.
343 */
344 int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
345 const struct pkey_clrkey *clrkey,
346 struct pkey_seckey *seckey)
347 {
348 int rc, keysize, seckeysize;
349 u8 *mem;
350 struct CPRBX *preqcblk, *prepcblk;
351 struct ica_xcRB xcrb;
352 struct cmreqparm {
353 u8 subfunc_code[2];
354 u16 rule_array_len;
355 char rule_array[8];
356 struct lv1 {
357 u16 len;
358 u8 clrkey[0];
359 } lv1;
360 struct lv2 {
361 u16 len;
362 struct keyid {
363 u16 len;
364 u16 attr;
365 u8 data[SECKEYBLOBSIZE];
366 } keyid;
367 } lv2;
368 } *preqparm;
369 struct lv2 *plv2;
370 struct cmrepparm {
371 u8 subfunc_code[2];
372 u16 rule_array_len;
373 struct lv3 {
374 u16 len;
375 u16 keyblocklen;
376 struct {
377 u16 toklen;
378 u16 tokattr;
379 u8 tok[0];
380 /* ... some more data ... */
381 } keyblock;
382 } lv3;
383 } *prepparm;
384
385 /* get already prepared memory for 2 cprbs with param block each */
386 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
387 if (rc)
388 return rc;
389
390 /* fill request cprb struct */
391 preqcblk->domain = domain;
392
393 /* fill request cprb param block with CM request */
394 preqparm = (struct cmreqparm *) preqcblk->req_parmb;
395 memcpy(preqparm->subfunc_code, "CM", 2);
396 memcpy(preqparm->rule_array, "AES ", 8);
397 preqparm->rule_array_len =
398 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
399 switch (keytype) {
400 case PKEY_KEYTYPE_AES_128:
401 keysize = 16;
402 break;
403 case PKEY_KEYTYPE_AES_192:
404 keysize = 24;
405 break;
406 case PKEY_KEYTYPE_AES_256:
407 keysize = 32;
408 break;
409 default:
410 DEBUG_ERR(
411 "%s unknown/unsupported keytype %d\n",
412 __func__, keytype);
413 rc = -EINVAL;
414 goto out;
415 }
416 preqparm->lv1.len = sizeof(struct lv1) + keysize;
417 memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize);
418 plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
419 plv2->len = sizeof(struct lv2);
420 plv2->keyid.len = sizeof(struct keyid);
421 plv2->keyid.attr = 0x30;
422 preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
423
424 /* fill xcrb struct */
425 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
426
427 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
428 rc = _zcrypt_send_cprb(&xcrb);
429 if (rc) {
430 DEBUG_ERR(
431 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
432 __func__, (int) cardnr, (int) domain, rc);
433 goto out;
434 }
435
436 /* check response returncode and reasoncode */
437 if (prepcblk->ccp_rtcode != 0) {
438 DEBUG_ERR(
439 "%s clear key import failure, card response %d/%d\n",
440 __func__,
441 (int) prepcblk->ccp_rtcode,
442 (int) prepcblk->ccp_rscode);
443 rc = -EIO;
444 goto out;
445 }
446
447 /* process response cprb param block */
448 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
449 prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
450
451 /* check length of the returned secure key token */
452 seckeysize = prepparm->lv3.keyblock.toklen
453 - sizeof(prepparm->lv3.keyblock.toklen)
454 - sizeof(prepparm->lv3.keyblock.tokattr);
455 if (seckeysize != SECKEYBLOBSIZE) {
456 DEBUG_ERR(
457 "%s secure token size mismatch %d != %d bytes\n",
458 __func__, seckeysize, SECKEYBLOBSIZE);
459 rc = -EIO;
460 goto out;
461 }
462
463 /* check secure key token */
464 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
465 if (rc) {
466 rc = -EIO;
467 goto out;
468 }
469
470 /* copy the generated secure key token */
471 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
472
473 out:
474 free_cprbmem(mem, PARMBSIZE, 1);
475 return rc;
476 }
477 EXPORT_SYMBOL(pkey_clr2seckey);
478
479 /*
480 * Derive a proteced key from the secure key blob.
481 */
482 int pkey_sec2protkey(u16 cardnr, u16 domain,
483 const struct pkey_seckey *seckey,
484 struct pkey_protkey *protkey)
485 {
486 int rc;
487 u8 *mem;
488 struct CPRBX *preqcblk, *prepcblk;
489 struct ica_xcRB xcrb;
490 struct uskreqparm {
491 u8 subfunc_code[2];
492 u16 rule_array_len;
493 struct lv1 {
494 u16 len;
495 u16 attr_len;
496 u16 attr_flags;
497 } lv1;
498 struct lv2 {
499 u16 len;
500 u16 attr_len;
501 u16 attr_flags;
502 u8 token[0]; /* cca secure key token */
503 } lv2 __packed;
504 } *preqparm;
505 struct uskrepparm {
506 u8 subfunc_code[2];
507 u16 rule_array_len;
508 struct lv3 {
509 u16 len;
510 u16 attr_len;
511 u16 attr_flags;
512 struct cpacfkeyblock {
513 u8 version; /* version of this struct */
514 u8 flags[2];
515 u8 algo;
516 u8 form;
517 u8 pad1[3];
518 u16 keylen;
519 u8 key[64]; /* the key (keylen bytes) */
520 u16 keyattrlen;
521 u8 keyattr[32];
522 u8 pad2[1];
523 u8 vptype;
524 u8 vp[32]; /* verification pattern */
525 } keyblock;
526 } lv3 __packed;
527 } *prepparm;
528
529 /* get already prepared memory for 2 cprbs with param block each */
530 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
531 if (rc)
532 return rc;
533
534 /* fill request cprb struct */
535 preqcblk->domain = domain;
536
537 /* fill request cprb param block with USK request */
538 preqparm = (struct uskreqparm *) preqcblk->req_parmb;
539 memcpy(preqparm->subfunc_code, "US", 2);
540 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
541 preqparm->lv1.len = sizeof(struct lv1);
542 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
543 preqparm->lv1.attr_flags = 0x0001;
544 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
545 preqparm->lv2.attr_len = sizeof(struct lv2)
546 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
547 preqparm->lv2.attr_flags = 0x0000;
548 memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE);
549 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
550
551 /* fill xcrb struct */
552 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
553
554 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
555 rc = _zcrypt_send_cprb(&xcrb);
556 if (rc) {
557 DEBUG_ERR(
558 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
559 __func__, (int) cardnr, (int) domain, rc);
560 goto out;
561 }
562
563 /* check response returncode and reasoncode */
564 if (prepcblk->ccp_rtcode != 0) {
565 DEBUG_ERR(
566 "%s unwrap secure key failure, card response %d/%d\n",
567 __func__,
568 (int) prepcblk->ccp_rtcode,
569 (int) prepcblk->ccp_rscode);
570 rc = -EIO;
571 goto out;
572 }
573 if (prepcblk->ccp_rscode != 0) {
574 DEBUG_WARN(
575 "%s unwrap secure key warning, card response %d/%d\n",
576 __func__,
577 (int) prepcblk->ccp_rtcode,
578 (int) prepcblk->ccp_rscode);
579 }
580
581 /* process response cprb param block */
582 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
583 prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
584
585 /* check the returned keyblock */
586 if (prepparm->lv3.keyblock.version != 0x01) {
587 DEBUG_ERR(
588 "%s reply param keyblock version mismatch 0x%02x != 0x01\n",
589 __func__, (int) prepparm->lv3.keyblock.version);
590 rc = -EIO;
591 goto out;
592 }
593
594 /* copy the tanslated protected key */
595 switch (prepparm->lv3.keyblock.keylen) {
596 case 16+32:
597 protkey->type = PKEY_KEYTYPE_AES_128;
598 break;
599 case 24+32:
600 protkey->type = PKEY_KEYTYPE_AES_192;
601 break;
602 case 32+32:
603 protkey->type = PKEY_KEYTYPE_AES_256;
604 break;
605 default:
606 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
607 __func__, prepparm->lv3.keyblock.keylen);
608 rc = -EIO;
609 goto out;
610 }
611 protkey->len = prepparm->lv3.keyblock.keylen;
612 memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len);
613
614 out:
615 free_cprbmem(mem, PARMBSIZE, 0);
616 return rc;
617 }
618 EXPORT_SYMBOL(pkey_sec2protkey);
619
620 /*
621 * Create a protected key from a clear key value.
622 */
623 int pkey_clr2protkey(u32 keytype,
624 const struct pkey_clrkey *clrkey,
625 struct pkey_protkey *protkey)
626 {
627 long fc;
628 int keysize;
629 u8 paramblock[64];
630
631 switch (keytype) {
632 case PKEY_KEYTYPE_AES_128:
633 keysize = 16;
634 fc = CPACF_PCKMO_ENC_AES_128_KEY;
635 break;
636 case PKEY_KEYTYPE_AES_192:
637 keysize = 24;
638 fc = CPACF_PCKMO_ENC_AES_192_KEY;
639 break;
640 case PKEY_KEYTYPE_AES_256:
641 keysize = 32;
642 fc = CPACF_PCKMO_ENC_AES_256_KEY;
643 break;
644 default:
645 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
646 __func__, keytype);
647 return -EINVAL;
648 }
649
650 /* prepare param block */
651 memset(paramblock, 0, sizeof(paramblock));
652 memcpy(paramblock, clrkey->clrkey, keysize);
653
654 /* call the pckmo instruction */
655 cpacf_pckmo(fc, paramblock);
656
657 /* copy created protected key */
658 protkey->type = keytype;
659 protkey->len = keysize + 32;
660 memcpy(protkey->protkey, paramblock, keysize + 32);
661
662 return 0;
663 }
664 EXPORT_SYMBOL(pkey_clr2protkey);
665
666 /*
667 * query cryptographic facility from adapter
668 */
669 static int query_crypto_facility(u16 cardnr, u16 domain,
670 const char *keyword,
671 u8 *rarray, size_t *rarraylen,
672 u8 *varray, size_t *varraylen)
673 {
674 int rc;
675 u16 len;
676 u8 *mem, *ptr;
677 struct CPRBX *preqcblk, *prepcblk;
678 struct ica_xcRB xcrb;
679 struct fqreqparm {
680 u8 subfunc_code[2];
681 u16 rule_array_len;
682 char rule_array[8];
683 struct lv1 {
684 u16 len;
685 u8 data[VARDATASIZE];
686 } lv1;
687 u16 dummylen;
688 } *preqparm;
689 size_t parmbsize = sizeof(struct fqreqparm);
690 struct fqrepparm {
691 u8 subfunc_code[2];
692 u8 lvdata[0];
693 } *prepparm;
694
695 /* get already prepared memory for 2 cprbs with param block each */
696 rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
697 if (rc)
698 return rc;
699
700 /* fill request cprb struct */
701 preqcblk->domain = domain;
702
703 /* fill request cprb param block with FQ request */
704 preqparm = (struct fqreqparm *) preqcblk->req_parmb;
705 memcpy(preqparm->subfunc_code, "FQ", 2);
706 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
707 preqparm->rule_array_len =
708 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
709 preqparm->lv1.len = sizeof(preqparm->lv1);
710 preqparm->dummylen = sizeof(preqparm->dummylen);
711 preqcblk->req_parml = parmbsize;
712
713 /* fill xcrb struct */
714 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
715
716 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
717 rc = _zcrypt_send_cprb(&xcrb);
718 if (rc) {
719 DEBUG_ERR(
720 "%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
721 __func__, (int) cardnr, (int) domain, rc);
722 goto out;
723 }
724
725 /* check response returncode and reasoncode */
726 if (prepcblk->ccp_rtcode != 0) {
727 DEBUG_ERR(
728 "%s unwrap secure key failure, card response %d/%d\n",
729 __func__,
730 (int) prepcblk->ccp_rtcode,
731 (int) prepcblk->ccp_rscode);
732 rc = -EIO;
733 goto out;
734 }
735
736 /* process response cprb param block */
737 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
738 prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
739 ptr = prepparm->lvdata;
740
741 /* check and possibly copy reply rule array */
742 len = *((u16 *) ptr);
743 if (len > sizeof(u16)) {
744 ptr += sizeof(u16);
745 len -= sizeof(u16);
746 if (rarray && rarraylen && *rarraylen > 0) {
747 *rarraylen = (len > *rarraylen ? *rarraylen : len);
748 memcpy(rarray, ptr, *rarraylen);
749 }
750 ptr += len;
751 }
752 /* check and possible copy reply var array */
753 len = *((u16 *) ptr);
754 if (len > sizeof(u16)) {
755 ptr += sizeof(u16);
756 len -= sizeof(u16);
757 if (varray && varraylen && *varraylen > 0) {
758 *varraylen = (len > *varraylen ? *varraylen : len);
759 memcpy(varray, ptr, *varraylen);
760 }
761 ptr += len;
762 }
763
764 out:
765 free_cprbmem(mem, parmbsize, 0);
766 return rc;
767 }
768
769 /*
770 * Fetch the current and old mkvp values via
771 * query_crypto_facility from adapter.
772 */
773 static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
774 {
775 int rc, found = 0;
776 size_t rlen, vlen;
777 u8 *rarray, *varray, *pg;
778
779 pg = (u8 *) __get_free_page(GFP_KERNEL);
780 if (!pg)
781 return -ENOMEM;
782 rarray = pg;
783 varray = pg + PAGE_SIZE/2;
784 rlen = vlen = PAGE_SIZE/2;
785
786 rc = query_crypto_facility(cardnr, domain, "STATICSA",
787 rarray, &rlen, varray, &vlen);
788 if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
789 if (rarray[8*8] == '2') {
790 /* current master key state is valid */
791 mkvp[0] = *((u64 *)(varray + 184));
792 mkvp[1] = *((u64 *)(varray + 172));
793 found = 1;
794 }
795 }
796
797 free_page((unsigned long) pg);
798
799 return found ? 0 : -ENOENT;
800 }
801
802 /* struct to hold cached mkvp info for each card/domain */
803 struct mkvp_info {
804 struct list_head list;
805 u16 cardnr;
806 u16 domain;
807 u64 mkvp[2];
808 };
809
810 /* a list with mkvp_info entries */
811 static LIST_HEAD(mkvp_list);
812 static DEFINE_SPINLOCK(mkvp_list_lock);
813
814 static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
815 {
816 int rc = -ENOENT;
817 struct mkvp_info *ptr;
818
819 spin_lock_bh(&mkvp_list_lock);
820 list_for_each_entry(ptr, &mkvp_list, list) {
821 if (ptr->cardnr == cardnr &&
822 ptr->domain == domain) {
823 memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
824 rc = 0;
825 break;
826 }
827 }
828 spin_unlock_bh(&mkvp_list_lock);
829
830 return rc;
831 }
832
833 static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
834 {
835 int found = 0;
836 struct mkvp_info *ptr;
837
838 spin_lock_bh(&mkvp_list_lock);
839 list_for_each_entry(ptr, &mkvp_list, list) {
840 if (ptr->cardnr == cardnr &&
841 ptr->domain == domain) {
842 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
843 found = 1;
844 break;
845 }
846 }
847 if (!found) {
848 ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
849 if (!ptr) {
850 spin_unlock_bh(&mkvp_list_lock);
851 return;
852 }
853 ptr->cardnr = cardnr;
854 ptr->domain = domain;
855 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
856 list_add(&ptr->list, &mkvp_list);
857 }
858 spin_unlock_bh(&mkvp_list_lock);
859 }
860
861 static void mkvp_cache_scrub(u16 cardnr, u16 domain)
862 {
863 struct mkvp_info *ptr;
864
865 spin_lock_bh(&mkvp_list_lock);
866 list_for_each_entry(ptr, &mkvp_list, list) {
867 if (ptr->cardnr == cardnr &&
868 ptr->domain == domain) {
869 list_del(&ptr->list);
870 kfree(ptr);
871 break;
872 }
873 }
874 spin_unlock_bh(&mkvp_list_lock);
875 }
876
877 static void __exit mkvp_cache_free(void)
878 {
879 struct mkvp_info *ptr, *pnext;
880
881 spin_lock_bh(&mkvp_list_lock);
882 list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) {
883 list_del(&ptr->list);
884 kfree(ptr);
885 }
886 spin_unlock_bh(&mkvp_list_lock);
887 }
888
889 /*
890 * Search for a matching crypto card based on the Master Key
891 * Verification Pattern provided inside a secure key.
892 */
893 int pkey_findcard(const struct pkey_seckey *seckey,
894 u16 *pcardnr, u16 *pdomain, int verify)
895 {
896 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
897 struct zcrypt_device_status_ext *device_status;
898 u16 card, dom;
899 u64 mkvp[2];
900 int i, rc, oi = -1;
901
902 /* mkvp must not be zero */
903 if (t->mkvp == 0)
904 return -EINVAL;
905
906 /* fetch status of all crypto cards */
907 device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
908 sizeof(struct zcrypt_device_status_ext),
909 GFP_KERNEL);
910 if (!device_status)
911 return -ENOMEM;
912 zcrypt_device_status_mask_ext(device_status);
913
914 /* walk through all crypto cards */
915 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
916 card = AP_QID_CARD(device_status[i].qid);
917 dom = AP_QID_QUEUE(device_status[i].qid);
918 if (device_status[i].online &&
919 device_status[i].functions & 0x04) {
920 /* an enabled CCA Coprocessor card */
921 /* try cached mkvp */
922 if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
923 t->mkvp == mkvp[0]) {
924 if (!verify)
925 break;
926 /* verify: fetch mkvp from adapter */
927 if (fetch_mkvp(card, dom, mkvp) == 0) {
928 mkvp_cache_update(card, dom, mkvp);
929 if (t->mkvp == mkvp[0])
930 break;
931 }
932 }
933 } else {
934 /* Card is offline and/or not a CCA card. */
935 /* del mkvp entry from cache if it exists */
936 mkvp_cache_scrub(card, dom);
937 }
938 }
939 if (i >= MAX_ZDEV_ENTRIES_EXT) {
940 /* nothing found, so this time without cache */
941 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
942 if (!(device_status[i].online &&
943 device_status[i].functions & 0x04))
944 continue;
945 card = AP_QID_CARD(device_status[i].qid);
946 dom = AP_QID_QUEUE(device_status[i].qid);
947 /* fresh fetch mkvp from adapter */
948 if (fetch_mkvp(card, dom, mkvp) == 0) {
949 mkvp_cache_update(card, dom, mkvp);
950 if (t->mkvp == mkvp[0])
951 break;
952 if (t->mkvp == mkvp[1] && oi < 0)
953 oi = i;
954 }
955 }
956 if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
957 /* old mkvp matched, use this card then */
958 card = AP_QID_CARD(device_status[oi].qid);
959 dom = AP_QID_QUEUE(device_status[oi].qid);
960 }
961 }
962 if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
963 if (pcardnr)
964 *pcardnr = card;
965 if (pdomain)
966 *pdomain = dom;
967 rc = 0;
968 } else
969 rc = -ENODEV;
970
971 kfree(device_status);
972 return rc;
973 }
974 EXPORT_SYMBOL(pkey_findcard);
975
976 /*
977 * Find card and transform secure key into protected key.
978 */
979 int pkey_skey2pkey(const struct pkey_seckey *seckey,
980 struct pkey_protkey *protkey)
981 {
982 u16 cardnr, domain;
983 int rc, verify;
984
985 /*
986 * The pkey_sec2protkey call may fail when a card has been
987 * addressed where the master key was changed after last fetch
988 * of the mkvp into the cache. So first try without verify then
989 * with verify enabled (thus refreshing the mkvp for each card).
990 */
991 for (verify = 0; verify < 2; verify++) {
992 rc = pkey_findcard(seckey, &cardnr, &domain, verify);
993 if (rc)
994 continue;
995 rc = pkey_sec2protkey(cardnr, domain, seckey, protkey);
996 if (rc == 0)
997 break;
998 }
999
1000 if (rc)
1001 DEBUG_DBG("%s failed rc=%d\n", __func__, rc);
1002
1003 return rc;
1004 }
1005 EXPORT_SYMBOL(pkey_skey2pkey);
1006
1007 /*
1008 * Verify key and give back some info about the key.
1009 */
1010 int pkey_verifykey(const struct pkey_seckey *seckey,
1011 u16 *pcardnr, u16 *pdomain,
1012 u16 *pkeysize, u32 *pattributes)
1013 {
1014 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
1015 u16 cardnr, domain;
1016 u64 mkvp[2];
1017 int rc;
1018
1019 /* check the secure key for valid AES secure key */
1020 rc = check_secaeskeytoken((u8 *) seckey, 0);
1021 if (rc)
1022 goto out;
1023 if (pattributes)
1024 *pattributes = PKEY_VERIFY_ATTR_AES;
1025 if (pkeysize)
1026 *pkeysize = t->bitsize;
1027
1028 /* try to find a card which can handle this key */
1029 rc = pkey_findcard(seckey, &cardnr, &domain, 1);
1030 if (rc)
1031 goto out;
1032
1033 /* check mkvp for old mkvp match */
1034 rc = mkvp_cache_fetch(cardnr, domain, mkvp);
1035 if (rc)
1036 goto out;
1037 if (t->mkvp == mkvp[1]) {
1038 DEBUG_DBG("%s secure key has old mkvp\n", __func__);
1039 if (pattributes)
1040 *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
1041 }
1042
1043 if (pcardnr)
1044 *pcardnr = cardnr;
1045 if (pdomain)
1046 *pdomain = domain;
1047
1048 out:
1049 DEBUG_DBG("%s rc=%d\n", __func__, rc);
1050 return rc;
1051 }
1052 EXPORT_SYMBOL(pkey_verifykey);
1053
1054 /*
1055 * File io functions
1056 */
1057
1058 static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
1059 unsigned long arg)
1060 {
1061 int rc;
1062
1063 switch (cmd) {
1064 case PKEY_GENSECK: {
1065 struct pkey_genseck __user *ugs = (void __user *) arg;
1066 struct pkey_genseck kgs;
1067
1068 if (copy_from_user(&kgs, ugs, sizeof(kgs)))
1069 return -EFAULT;
1070 rc = pkey_genseckey(kgs.cardnr, kgs.domain,
1071 kgs.keytype, &kgs.seckey);
1072 DEBUG_DBG("%s pkey_genseckey()=%d\n", __func__, rc);
1073 if (rc)
1074 break;
1075 if (copy_to_user(ugs, &kgs, sizeof(kgs)))
1076 return -EFAULT;
1077 break;
1078 }
1079 case PKEY_CLR2SECK: {
1080 struct pkey_clr2seck __user *ucs = (void __user *) arg;
1081 struct pkey_clr2seck kcs;
1082
1083 if (copy_from_user(&kcs, ucs, sizeof(kcs)))
1084 return -EFAULT;
1085 rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
1086 &kcs.clrkey, &kcs.seckey);
1087 DEBUG_DBG("%s pkey_clr2seckey()=%d\n", __func__, rc);
1088 if (rc)
1089 break;
1090 if (copy_to_user(ucs, &kcs, sizeof(kcs)))
1091 return -EFAULT;
1092 memzero_explicit(&kcs, sizeof(kcs));
1093 break;
1094 }
1095 case PKEY_SEC2PROTK: {
1096 struct pkey_sec2protk __user *usp = (void __user *) arg;
1097 struct pkey_sec2protk ksp;
1098
1099 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1100 return -EFAULT;
1101 rc = pkey_sec2protkey(ksp.cardnr, ksp.domain,
1102 &ksp.seckey, &ksp.protkey);
1103 DEBUG_DBG("%s pkey_sec2protkey()=%d\n", __func__, rc);
1104 if (rc)
1105 break;
1106 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1107 return -EFAULT;
1108 break;
1109 }
1110 case PKEY_CLR2PROTK: {
1111 struct pkey_clr2protk __user *ucp = (void __user *) arg;
1112 struct pkey_clr2protk kcp;
1113
1114 if (copy_from_user(&kcp, ucp, sizeof(kcp)))
1115 return -EFAULT;
1116 rc = pkey_clr2protkey(kcp.keytype,
1117 &kcp.clrkey, &kcp.protkey);
1118 DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc);
1119 if (rc)
1120 break;
1121 if (copy_to_user(ucp, &kcp, sizeof(kcp)))
1122 return -EFAULT;
1123 memzero_explicit(&kcp, sizeof(kcp));
1124 break;
1125 }
1126 case PKEY_FINDCARD: {
1127 struct pkey_findcard __user *ufc = (void __user *) arg;
1128 struct pkey_findcard kfc;
1129
1130 if (copy_from_user(&kfc, ufc, sizeof(kfc)))
1131 return -EFAULT;
1132 rc = pkey_findcard(&kfc.seckey,
1133 &kfc.cardnr, &kfc.domain, 1);
1134 DEBUG_DBG("%s pkey_findcard()=%d\n", __func__, rc);
1135 if (rc)
1136 break;
1137 if (copy_to_user(ufc, &kfc, sizeof(kfc)))
1138 return -EFAULT;
1139 break;
1140 }
1141 case PKEY_SKEY2PKEY: {
1142 struct pkey_skey2pkey __user *usp = (void __user *) arg;
1143 struct pkey_skey2pkey ksp;
1144
1145 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1146 return -EFAULT;
1147 rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey);
1148 DEBUG_DBG("%s pkey_skey2pkey()=%d\n", __func__, rc);
1149 if (rc)
1150 break;
1151 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1152 return -EFAULT;
1153 break;
1154 }
1155 case PKEY_VERIFYKEY: {
1156 struct pkey_verifykey __user *uvk = (void __user *) arg;
1157 struct pkey_verifykey kvk;
1158
1159 if (copy_from_user(&kvk, uvk, sizeof(kvk)))
1160 return -EFAULT;
1161 rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
1162 &kvk.keysize, &kvk.attributes);
1163 DEBUG_DBG("%s pkey_verifykey()=%d\n", __func__, rc);
1164 if (rc)
1165 break;
1166 if (copy_to_user(uvk, &kvk, sizeof(kvk)))
1167 return -EFAULT;
1168 break;
1169 }
1170 default:
1171 /* unknown/unsupported ioctl cmd */
1172 return -ENOTTY;
1173 }
1174
1175 return rc;
1176 }
1177
1178 /*
1179 * Sysfs and file io operations
1180 */
1181 static const struct file_operations pkey_fops = {
1182 .owner = THIS_MODULE,
1183 .open = nonseekable_open,
1184 .llseek = no_llseek,
1185 .unlocked_ioctl = pkey_unlocked_ioctl,
1186 };
1187
1188 static struct miscdevice pkey_dev = {
1189 .name = "pkey",
1190 .minor = MISC_DYNAMIC_MINOR,
1191 .mode = 0666,
1192 .fops = &pkey_fops,
1193 };
1194
1195 /*
1196 * Module init
1197 */
1198 static int __init pkey_init(void)
1199 {
1200 cpacf_mask_t pckmo_functions;
1201
1202 /* check for pckmo instructions available */
1203 if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
1204 return -EOPNOTSUPP;
1205 if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) ||
1206 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) ||
1207 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY))
1208 return -EOPNOTSUPP;
1209
1210 pkey_debug_init();
1211
1212 return misc_register(&pkey_dev);
1213 }
1214
1215 /*
1216 * Module exit
1217 */
1218 static void __exit pkey_exit(void)
1219 {
1220 misc_deregister(&pkey_dev);
1221 mkvp_cache_free();
1222 pkey_debug_exit();
1223 }
1224
1225 module_init(pkey_init);
1226 module_exit(pkey_exit);
Linux with added FPC-III support