1 /*
2 * pkey device driver
3 *
4 * Copyright IBM Corp. 2017
5 * Author(s): Harald Freudenberger
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License (version 2 only)
9 * as published by the Free Software Foundation.
10 *
11 */
12
13 #define KMSG_COMPONENT "pkey"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
15
16 #include <linux/fs.h>
17 #include <linux/init.h>
18 #include <linux/miscdevice.h>
19 #include <linux/module.h>
20 #include <linux/slab.h>
21 #include <linux/kallsyms.h>
22 #include <linux/debugfs.h>
23 #include <asm/zcrypt.h>
24 #include <asm/cpacf.h>
25 #include <asm/pkey.h>
26
27 #include "zcrypt_api.h"
28
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("IBM Corporation");
31 MODULE_DESCRIPTION("s390 protected key interface");
32
33 /* Size of parameter block used for all cca requests/replies */
34 #define PARMBSIZE 512
35
36 /* Size of vardata block used for some of the cca requests/replies */
37 #define VARDATASIZE 4096
38
39 /*
40 * debug feature data and functions
41 */
42
43 static debug_info_t *debug_info;
44
45 #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__)
46 #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__)
47 #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__)
48 #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__)
49
pkey_debug_init(void)50 static void __init pkey_debug_init(void)
51 {
52 /* 5 arguments per dbf entry (including the format string ptr) */
53 debug_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
54 debug_register_view(debug_info, &debug_sprintf_view);
55 debug_set_level(debug_info, 3);
56 }
57
pkey_debug_exit(void)58 static void __exit pkey_debug_exit(void)
59 {
60 debug_unregister(debug_info);
61 }
62
63 /* inside view of a secure key token (only type 0x01 version 0x04) */
64 struct secaeskeytoken {
65 u8 type; /* 0x01 for internal key token */
66 u8 res0[3];
67 u8 version; /* should be 0x04 */
68 u8 res1[1];
69 u8 flag; /* key flags */
70 u8 res2[1];
71 u64 mkvp; /* master key verification pattern */
72 u8 key[32]; /* key value (encrypted) */
73 u8 cv[8]; /* control vector */
74 u16 bitsize; /* key bit size */
75 u16 keysize; /* key byte size */
76 u8 tvv[4]; /* token validation value */
77 } __packed;
78
79 /*
80 * Simple check if the token is a valid CCA secure AES key
81 * token. If keybitsize is given, the bitsize of the key is
82 * also checked. Returns 0 on success or errno value on failure.
83 */
check_secaeskeytoken(const u8 * token,int keybitsize)84 static int check_secaeskeytoken(const u8 *token, int keybitsize)
85 {
86 struct secaeskeytoken *t = (struct secaeskeytoken *) token;
87
88 if (t->type != 0x01) {
89 DEBUG_ERR(
90 "check_secaeskeytoken secure token check failed, type mismatch 0x%02x != 0x01\n",
91 (int) t->type);
92 return -EINVAL;
93 }
94 if (t->version != 0x04) {
95 DEBUG_ERR(
96 "check_secaeskeytoken secure token check failed, version mismatch 0x%02x != 0x04\n",
97 (int) t->version);
98 return -EINVAL;
99 }
100 if (keybitsize > 0 && t->bitsize != keybitsize) {
101 DEBUG_ERR(
102 "check_secaeskeytoken secure token check failed, bitsize mismatch %d != %d\n",
103 (int) t->bitsize, keybitsize);
104 return -EINVAL;
105 }
106
107 return 0;
108 }
109
110 /*
111 * Allocate consecutive memory for request CPRB, request param
112 * block, reply CPRB and reply param block and fill in values
113 * for the common fields. Returns 0 on success or errno value
114 * on failure.
115 */
alloc_and_prep_cprbmem(size_t paramblen,u8 ** pcprbmem,struct CPRBX ** preqCPRB,struct CPRBX ** prepCPRB)116 static int alloc_and_prep_cprbmem(size_t paramblen,
117 u8 **pcprbmem,
118 struct CPRBX **preqCPRB,
119 struct CPRBX **prepCPRB)
120 {
121 u8 *cprbmem;
122 size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
123 struct CPRBX *preqcblk, *prepcblk;
124
125 /*
126 * allocate consecutive memory for request CPRB, request param
127 * block, reply CPRB and reply param block
128 */
129 cprbmem = kmalloc(2 * cprbplusparamblen, GFP_KERNEL);
130 if (!cprbmem)
131 return -ENOMEM;
132 memset(cprbmem, 0, 2 * cprbplusparamblen);
133
134 preqcblk = (struct CPRBX *) cprbmem;
135 prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
136
137 /* fill request cprb struct */
138 preqcblk->cprb_len = sizeof(struct CPRBX);
139 preqcblk->cprb_ver_id = 0x02;
140 memcpy(preqcblk->func_id, "T2", 2);
141 preqcblk->rpl_msgbl = cprbplusparamblen;
142 if (paramblen) {
143 preqcblk->req_parmb =
144 ((u8 *) preqcblk) + sizeof(struct CPRBX);
145 preqcblk->rpl_parmb =
146 ((u8 *) prepcblk) + sizeof(struct CPRBX);
147 }
148
149 *pcprbmem = cprbmem;
150 *preqCPRB = preqcblk;
151 *prepCPRB = prepcblk;
152
153 return 0;
154 }
155
156 /*
157 * Free the cprb memory allocated with the function above.
158 * If the scrub value is not zero, the memory is filled
159 * with zeros before freeing (useful if there was some
160 * clear key material in there).
161 */
free_cprbmem(void * mem,size_t paramblen,int scrub)162 static void free_cprbmem(void *mem, size_t paramblen, int scrub)
163 {
164 if (scrub)
165 memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
166 kfree(mem);
167 }
168
169 /*
170 * Helper function to prepare the xcrb struct
171 */
prep_xcrb(struct ica_xcRB * pxcrb,u16 cardnr,struct CPRBX * preqcblk,struct CPRBX * prepcblk)172 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
173 u16 cardnr,
174 struct CPRBX *preqcblk,
175 struct CPRBX *prepcblk)
176 {
177 memset(pxcrb, 0, sizeof(*pxcrb));
178 pxcrb->agent_ID = 0x4341; /* 'CA' */
179 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
180 pxcrb->request_control_blk_length =
181 preqcblk->cprb_len + preqcblk->req_parml;
182 pxcrb->request_control_blk_addr = (void __user *) preqcblk;
183 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
184 pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
185 }
186
187 /*
188 * Helper function which calls zcrypt_send_cprb with
189 * memory management segment adjusted to kernel space
190 * so that the copy_from_user called within this
191 * function do in fact copy from kernel space.
192 */
_zcrypt_send_cprb(struct ica_xcRB * xcrb)193 static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
194 {
195 int rc;
196 mm_segment_t old_fs = get_fs();
197
198 set_fs(KERNEL_DS);
199 rc = zcrypt_send_cprb(xcrb);
200 set_fs(old_fs);
201
202 return rc;
203 }
204
205 /*
206 * Generate (random) AES secure key.
207 */
pkey_genseckey(u16 cardnr,u16 domain,u32 keytype,struct pkey_seckey * seckey)208 int pkey_genseckey(u16 cardnr, u16 domain,
209 u32 keytype, struct pkey_seckey *seckey)
210 {
211 int i, rc, keysize;
212 int seckeysize;
213 u8 *mem;
214 struct CPRBX *preqcblk, *prepcblk;
215 struct ica_xcRB xcrb;
216 struct kgreqparm {
217 u8 subfunc_code[2];
218 u16 rule_array_len;
219 struct lv1 {
220 u16 len;
221 char key_form[8];
222 char key_length[8];
223 char key_type1[8];
224 char key_type2[8];
225 } lv1;
226 struct lv2 {
227 u16 len;
228 struct keyid {
229 u16 len;
230 u16 attr;
231 u8 data[SECKEYBLOBSIZE];
232 } keyid[6];
233 } lv2;
234 } *preqparm;
235 struct kgrepparm {
236 u8 subfunc_code[2];
237 u16 rule_array_len;
238 struct lv3 {
239 u16 len;
240 u16 keyblocklen;
241 struct {
242 u16 toklen;
243 u16 tokattr;
244 u8 tok[0];
245 /* ... some more data ... */
246 } keyblock;
247 } lv3;
248 } *prepparm;
249
250 /* get already prepared memory for 2 cprbs with param block each */
251 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
252 if (rc)
253 return rc;
254
255 /* fill request cprb struct */
256 preqcblk->domain = domain;
257
258 /* fill request cprb param block with KG request */
259 preqparm = (struct kgreqparm *) preqcblk->req_parmb;
260 memcpy(preqparm->subfunc_code, "KG", 2);
261 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
262 preqparm->lv1.len = sizeof(struct lv1);
263 memcpy(preqparm->lv1.key_form, "OP ", 8);
264 switch (keytype) {
265 case PKEY_KEYTYPE_AES_128:
266 keysize = 16;
267 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
268 break;
269 case PKEY_KEYTYPE_AES_192:
270 keysize = 24;
271 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
272 break;
273 case PKEY_KEYTYPE_AES_256:
274 keysize = 32;
275 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
276 break;
277 default:
278 DEBUG_ERR(
279 "pkey_genseckey unknown/unsupported keytype %d\n",
280 keytype);
281 rc = -EINVAL;
282 goto out;
283 }
284 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
285 preqparm->lv2.len = sizeof(struct lv2);
286 for (i = 0; i < 6; i++) {
287 preqparm->lv2.keyid[i].len = sizeof(struct keyid);
288 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
289 }
290 preqcblk->req_parml = sizeof(struct kgreqparm);
291
292 /* fill xcrb struct */
293 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
294
295 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
296 rc = _zcrypt_send_cprb(&xcrb);
297 if (rc) {
298 DEBUG_ERR(
299 "pkey_genseckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
300 (int) cardnr, (int) domain, rc);
301 goto out;
302 }
303
304 /* check response returncode and reasoncode */
305 if (prepcblk->ccp_rtcode != 0) {
306 DEBUG_ERR(
307 "pkey_genseckey secure key generate failure, card response %d/%d\n",
308 (int) prepcblk->ccp_rtcode,
309 (int) prepcblk->ccp_rscode);
310 rc = -EIO;
311 goto out;
312 }
313
314 /* process response cprb param block */
315 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
316 prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
317
318 /* check length of the returned secure key token */
319 seckeysize = prepparm->lv3.keyblock.toklen
320 - sizeof(prepparm->lv3.keyblock.toklen)
321 - sizeof(prepparm->lv3.keyblock.tokattr);
322 if (seckeysize != SECKEYBLOBSIZE) {
323 DEBUG_ERR(
324 "pkey_genseckey secure token size mismatch %d != %d bytes\n",
325 seckeysize, SECKEYBLOBSIZE);
326 rc = -EIO;
327 goto out;
328 }
329
330 /* check secure key token */
331 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
332 if (rc) {
333 rc = -EIO;
334 goto out;
335 }
336
337 /* copy the generated secure key token */
338 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
339
340 out:
341 free_cprbmem(mem, PARMBSIZE, 0);
342 return rc;
343 }
344 EXPORT_SYMBOL(pkey_genseckey);
345
346 /*
347 * Generate an AES secure key with given key value.
348 */
pkey_clr2seckey(u16 cardnr,u16 domain,u32 keytype,const struct pkey_clrkey * clrkey,struct pkey_seckey * seckey)349 int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
350 const struct pkey_clrkey *clrkey,
351 struct pkey_seckey *seckey)
352 {
353 int rc, keysize, seckeysize;
354 u8 *mem;
355 struct CPRBX *preqcblk, *prepcblk;
356 struct ica_xcRB xcrb;
357 struct cmreqparm {
358 u8 subfunc_code[2];
359 u16 rule_array_len;
360 char rule_array[8];
361 struct lv1 {
362 u16 len;
363 u8 clrkey[0];
364 } lv1;
365 struct lv2 {
366 u16 len;
367 struct keyid {
368 u16 len;
369 u16 attr;
370 u8 data[SECKEYBLOBSIZE];
371 } keyid;
372 } lv2;
373 } *preqparm;
374 struct lv2 *plv2;
375 struct cmrepparm {
376 u8 subfunc_code[2];
377 u16 rule_array_len;
378 struct lv3 {
379 u16 len;
380 u16 keyblocklen;
381 struct {
382 u16 toklen;
383 u16 tokattr;
384 u8 tok[0];
385 /* ... some more data ... */
386 } keyblock;
387 } lv3;
388 } *prepparm;
389
390 /* get already prepared memory for 2 cprbs with param block each */
391 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
392 if (rc)
393 return rc;
394
395 /* fill request cprb struct */
396 preqcblk->domain = domain;
397
398 /* fill request cprb param block with CM request */
399 preqparm = (struct cmreqparm *) preqcblk->req_parmb;
400 memcpy(preqparm->subfunc_code, "CM", 2);
401 memcpy(preqparm->rule_array, "AES ", 8);
402 preqparm->rule_array_len =
403 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
404 switch (keytype) {
405 case PKEY_KEYTYPE_AES_128:
406 keysize = 16;
407 break;
408 case PKEY_KEYTYPE_AES_192:
409 keysize = 24;
410 break;
411 case PKEY_KEYTYPE_AES_256:
412 keysize = 32;
413 break;
414 default:
415 DEBUG_ERR(
416 "pkey_clr2seckey unknown/unsupported keytype %d\n",
417 keytype);
418 rc = -EINVAL;
419 goto out;
420 }
421 preqparm->lv1.len = sizeof(struct lv1) + keysize;
422 memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize);
423 plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
424 plv2->len = sizeof(struct lv2);
425 plv2->keyid.len = sizeof(struct keyid);
426 plv2->keyid.attr = 0x30;
427 preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
428
429 /* fill xcrb struct */
430 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
431
432 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
433 rc = _zcrypt_send_cprb(&xcrb);
434 if (rc) {
435 DEBUG_ERR(
436 "pkey_clr2seckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
437 (int) cardnr, (int) domain, rc);
438 goto out;
439 }
440
441 /* check response returncode and reasoncode */
442 if (prepcblk->ccp_rtcode != 0) {
443 DEBUG_ERR(
444 "pkey_clr2seckey clear key import failure, card response %d/%d\n",
445 (int) prepcblk->ccp_rtcode,
446 (int) prepcblk->ccp_rscode);
447 rc = -EIO;
448 goto out;
449 }
450
451 /* process response cprb param block */
452 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
453 prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
454
455 /* check length of the returned secure key token */
456 seckeysize = prepparm->lv3.keyblock.toklen
457 - sizeof(prepparm->lv3.keyblock.toklen)
458 - sizeof(prepparm->lv3.keyblock.tokattr);
459 if (seckeysize != SECKEYBLOBSIZE) {
460 DEBUG_ERR(
461 "pkey_clr2seckey secure token size mismatch %d != %d bytes\n",
462 seckeysize, SECKEYBLOBSIZE);
463 rc = -EIO;
464 goto out;
465 }
466
467 /* check secure key token */
468 rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
469 if (rc) {
470 rc = -EIO;
471 goto out;
472 }
473
474 /* copy the generated secure key token */
475 memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
476
477 out:
478 free_cprbmem(mem, PARMBSIZE, 1);
479 return rc;
480 }
481 EXPORT_SYMBOL(pkey_clr2seckey);
482
483 /*
484 * Derive a proteced key from the secure key blob.
485 */
pkey_sec2protkey(u16 cardnr,u16 domain,const struct pkey_seckey * seckey,struct pkey_protkey * protkey)486 int pkey_sec2protkey(u16 cardnr, u16 domain,
487 const struct pkey_seckey *seckey,
488 struct pkey_protkey *protkey)
489 {
490 int rc;
491 u8 *mem;
492 struct CPRBX *preqcblk, *prepcblk;
493 struct ica_xcRB xcrb;
494 struct uskreqparm {
495 u8 subfunc_code[2];
496 u16 rule_array_len;
497 struct lv1 {
498 u16 len;
499 u16 attr_len;
500 u16 attr_flags;
501 } lv1;
502 struct lv2 {
503 u16 len;
504 u16 attr_len;
505 u16 attr_flags;
506 u8 token[0]; /* cca secure key token */
507 } lv2 __packed;
508 } *preqparm;
509 struct uskrepparm {
510 u8 subfunc_code[2];
511 u16 rule_array_len;
512 struct lv3 {
513 u16 len;
514 u16 attr_len;
515 u16 attr_flags;
516 struct cpacfkeyblock {
517 u8 version; /* version of this struct */
518 u8 flags[2];
519 u8 algo;
520 u8 form;
521 u8 pad1[3];
522 u16 keylen;
523 u8 key[64]; /* the key (keylen bytes) */
524 u16 keyattrlen;
525 u8 keyattr[32];
526 u8 pad2[1];
527 u8 vptype;
528 u8 vp[32]; /* verification pattern */
529 } keyblock;
530 } lv3 __packed;
531 } *prepparm;
532
533 /* get already prepared memory for 2 cprbs with param block each */
534 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
535 if (rc)
536 return rc;
537
538 /* fill request cprb struct */
539 preqcblk->domain = domain;
540
541 /* fill request cprb param block with USK request */
542 preqparm = (struct uskreqparm *) preqcblk->req_parmb;
543 memcpy(preqparm->subfunc_code, "US", 2);
544 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
545 preqparm->lv1.len = sizeof(struct lv1);
546 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
547 preqparm->lv1.attr_flags = 0x0001;
548 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
549 preqparm->lv2.attr_len = sizeof(struct lv2)
550 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
551 preqparm->lv2.attr_flags = 0x0000;
552 memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE);
553 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
554
555 /* fill xcrb struct */
556 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
557
558 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
559 rc = _zcrypt_send_cprb(&xcrb);
560 if (rc) {
561 DEBUG_ERR(
562 "pkey_sec2protkey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
563 (int) cardnr, (int) domain, rc);
564 goto out;
565 }
566
567 /* check response returncode and reasoncode */
568 if (prepcblk->ccp_rtcode != 0) {
569 DEBUG_ERR(
570 "pkey_sec2protkey unwrap secure key failure, card response %d/%d\n",
571 (int) prepcblk->ccp_rtcode,
572 (int) prepcblk->ccp_rscode);
573 rc = -EIO;
574 goto out;
575 }
576 if (prepcblk->ccp_rscode != 0) {
577 DEBUG_WARN(
578 "pkey_sec2protkey unwrap secure key warning, card response %d/%d\n",
579 (int) prepcblk->ccp_rtcode,
580 (int) prepcblk->ccp_rscode);
581 }
582
583 /* process response cprb param block */
584 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
585 prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
586
587 /* check the returned keyblock */
588 if (prepparm->lv3.keyblock.version != 0x01) {
589 DEBUG_ERR(
590 "pkey_sec2protkey reply param keyblock version mismatch 0x%02x != 0x01\n",
591 (int) prepparm->lv3.keyblock.version);
592 rc = -EIO;
593 goto out;
594 }
595
596 /* copy the tanslated protected key */
597 switch (prepparm->lv3.keyblock.keylen) {
598 case 16+32:
599 protkey->type = PKEY_KEYTYPE_AES_128;
600 break;
601 case 24+32:
602 protkey->type = PKEY_KEYTYPE_AES_192;
603 break;
604 case 32+32:
605 protkey->type = PKEY_KEYTYPE_AES_256;
606 break;
607 default:
608 DEBUG_ERR("pkey_sec2protkey unknown/unsupported keytype %d\n",
609 prepparm->lv3.keyblock.keylen);
610 rc = -EIO;
611 goto out;
612 }
613 protkey->len = prepparm->lv3.keyblock.keylen;
614 memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len);
615
616 out:
617 free_cprbmem(mem, PARMBSIZE, 0);
618 return rc;
619 }
620 EXPORT_SYMBOL(pkey_sec2protkey);
621
622 /*
623 * Create a protected key from a clear key value.
624 */
pkey_clr2protkey(u32 keytype,const struct pkey_clrkey * clrkey,struct pkey_protkey * protkey)625 int pkey_clr2protkey(u32 keytype,
626 const struct pkey_clrkey *clrkey,
627 struct pkey_protkey *protkey)
628 {
629 long fc;
630 int keysize;
631 u8 paramblock[64];
632
633 switch (keytype) {
634 case PKEY_KEYTYPE_AES_128:
635 keysize = 16;
636 fc = CPACF_PCKMO_ENC_AES_128_KEY;
637 break;
638 case PKEY_KEYTYPE_AES_192:
639 keysize = 24;
640 fc = CPACF_PCKMO_ENC_AES_192_KEY;
641 break;
642 case PKEY_KEYTYPE_AES_256:
643 keysize = 32;
644 fc = CPACF_PCKMO_ENC_AES_256_KEY;
645 break;
646 default:
647 DEBUG_ERR("pkey_clr2protkey unknown/unsupported keytype %d\n",
648 keytype);
649 return -EINVAL;
650 }
651
652 /* prepare param block */
653 memset(paramblock, 0, sizeof(paramblock));
654 memcpy(paramblock, clrkey->clrkey, keysize);
655
656 /* call the pckmo instruction */
657 cpacf_pckmo(fc, paramblock);
658
659 /* copy created protected key */
660 protkey->type = keytype;
661 protkey->len = keysize + 32;
662 memcpy(protkey->protkey, paramblock, keysize + 32);
663
664 return 0;
665 }
666 EXPORT_SYMBOL(pkey_clr2protkey);
667
668 /*
669 * query cryptographic facility from adapter
670 */
query_crypto_facility(u16 cardnr,u16 domain,const char * keyword,u8 * rarray,size_t * rarraylen,u8 * varray,size_t * varraylen)671 static int query_crypto_facility(u16 cardnr, u16 domain,
672 const char *keyword,
673 u8 *rarray, size_t *rarraylen,
674 u8 *varray, size_t *varraylen)
675 {
676 int rc;
677 u16 len;
678 u8 *mem, *ptr;
679 struct CPRBX *preqcblk, *prepcblk;
680 struct ica_xcRB xcrb;
681 struct fqreqparm {
682 u8 subfunc_code[2];
683 u16 rule_array_len;
684 char rule_array[8];
685 struct lv1 {
686 u16 len;
687 u8 data[VARDATASIZE];
688 } lv1;
689 u16 dummylen;
690 } *preqparm;
691 size_t parmbsize = sizeof(struct fqreqparm);
692 struct fqrepparm {
693 u8 subfunc_code[2];
694 u8 lvdata[0];
695 } *prepparm;
696
697 /* get already prepared memory for 2 cprbs with param block each */
698 rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
699 if (rc)
700 return rc;
701
702 /* fill request cprb struct */
703 preqcblk->domain = domain;
704
705 /* fill request cprb param block with FQ request */
706 preqparm = (struct fqreqparm *) preqcblk->req_parmb;
707 memcpy(preqparm->subfunc_code, "FQ", 2);
708 strncpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
709 preqparm->rule_array_len =
710 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
711 preqparm->lv1.len = sizeof(preqparm->lv1);
712 preqparm->dummylen = sizeof(preqparm->dummylen);
713 preqcblk->req_parml = parmbsize;
714
715 /* fill xcrb struct */
716 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
717
718 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
719 rc = _zcrypt_send_cprb(&xcrb);
720 if (rc) {
721 DEBUG_ERR(
722 "query_crypto_facility zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
723 (int) cardnr, (int) domain, rc);
724 goto out;
725 }
726
727 /* check response returncode and reasoncode */
728 if (prepcblk->ccp_rtcode != 0) {
729 DEBUG_ERR(
730 "query_crypto_facility unwrap secure key failure, card response %d/%d\n",
731 (int) prepcblk->ccp_rtcode,
732 (int) prepcblk->ccp_rscode);
733 rc = -EIO;
734 goto out;
735 }
736
737 /* process response cprb param block */
738 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
739 prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
740 ptr = prepparm->lvdata;
741
742 /* check and possibly copy reply rule array */
743 len = *((u16 *) ptr);
744 if (len > sizeof(u16)) {
745 ptr += sizeof(u16);
746 len -= sizeof(u16);
747 if (rarray && rarraylen && *rarraylen > 0) {
748 *rarraylen = (len > *rarraylen ? *rarraylen : len);
749 memcpy(rarray, ptr, *rarraylen);
750 }
751 ptr += len;
752 }
753 /* check and possible copy reply var array */
754 len = *((u16 *) ptr);
755 if (len > sizeof(u16)) {
756 ptr += sizeof(u16);
757 len -= sizeof(u16);
758 if (varray && varraylen && *varraylen > 0) {
759 *varraylen = (len > *varraylen ? *varraylen : len);
760 memcpy(varray, ptr, *varraylen);
761 }
762 ptr += len;
763 }
764
765 out:
766 free_cprbmem(mem, parmbsize, 0);
767 return rc;
768 }
769
770 /*
771 * Fetch the current and old mkvp values via
772 * query_crypto_facility from adapter.
773 */
fetch_mkvp(u16 cardnr,u16 domain,u64 mkvp[2])774 static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
775 {
776 int rc, found = 0;
777 size_t rlen, vlen;
778 u8 *rarray, *varray, *pg;
779
780 pg = (u8 *) __get_free_page(GFP_KERNEL);
781 if (!pg)
782 return -ENOMEM;
783 rarray = pg;
784 varray = pg + PAGE_SIZE/2;
785 rlen = vlen = PAGE_SIZE/2;
786
787 rc = query_crypto_facility(cardnr, domain, "STATICSA",
788 rarray, &rlen, varray, &vlen);
789 if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
790 if (rarray[8*8] == '2') {
791 /* current master key state is valid */
792 mkvp[0] = *((u64 *)(varray + 184));
793 mkvp[1] = *((u64 *)(varray + 172));
794 found = 1;
795 }
796 }
797
798 free_page((unsigned long) pg);
799
800 return found ? 0 : -ENOENT;
801 }
802
803 /* struct to hold cached mkvp info for each card/domain */
804 struct mkvp_info {
805 struct list_head list;
806 u16 cardnr;
807 u16 domain;
808 u64 mkvp[2];
809 };
810
811 /* a list with mkvp_info entries */
812 static LIST_HEAD(mkvp_list);
813 static DEFINE_SPINLOCK(mkvp_list_lock);
814
mkvp_cache_fetch(u16 cardnr,u16 domain,u64 mkvp[2])815 static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
816 {
817 int rc = -ENOENT;
818 struct mkvp_info *ptr;
819
820 spin_lock_bh(&mkvp_list_lock);
821 list_for_each_entry(ptr, &mkvp_list, list) {
822 if (ptr->cardnr == cardnr &&
823 ptr->domain == domain) {
824 memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
825 rc = 0;
826 break;
827 }
828 }
829 spin_unlock_bh(&mkvp_list_lock);
830
831 return rc;
832 }
833
mkvp_cache_update(u16 cardnr,u16 domain,u64 mkvp[2])834 static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
835 {
836 int found = 0;
837 struct mkvp_info *ptr;
838
839 spin_lock_bh(&mkvp_list_lock);
840 list_for_each_entry(ptr, &mkvp_list, list) {
841 if (ptr->cardnr == cardnr &&
842 ptr->domain == domain) {
843 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
844 found = 1;
845 break;
846 }
847 }
848 if (!found) {
849 ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
850 if (!ptr) {
851 spin_unlock_bh(&mkvp_list_lock);
852 return;
853 }
854 ptr->cardnr = cardnr;
855 ptr->domain = domain;
856 memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
857 list_add(&ptr->list, &mkvp_list);
858 }
859 spin_unlock_bh(&mkvp_list_lock);
860 }
861
mkvp_cache_scrub(u16 cardnr,u16 domain)862 static void mkvp_cache_scrub(u16 cardnr, u16 domain)
863 {
864 struct mkvp_info *ptr;
865
866 spin_lock_bh(&mkvp_list_lock);
867 list_for_each_entry(ptr, &mkvp_list, list) {
868 if (ptr->cardnr == cardnr &&
869 ptr->domain == domain) {
870 list_del(&ptr->list);
871 kfree(ptr);
872 break;
873 }
874 }
875 spin_unlock_bh(&mkvp_list_lock);
876 }
877
mkvp_cache_free(void)878 static void __exit mkvp_cache_free(void)
879 {
880 struct mkvp_info *ptr, *pnext;
881
882 spin_lock_bh(&mkvp_list_lock);
883 list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) {
884 list_del(&ptr->list);
885 kfree(ptr);
886 }
887 spin_unlock_bh(&mkvp_list_lock);
888 }
889
890 /*
891 * Search for a matching crypto card based on the Master Key
892 * Verification Pattern provided inside a secure key.
893 */
pkey_findcard(const struct pkey_seckey * seckey,u16 * pcardnr,u16 * pdomain,int verify)894 int pkey_findcard(const struct pkey_seckey *seckey,
895 u16 *pcardnr, u16 *pdomain, int verify)
896 {
897 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
898 struct zcrypt_device_matrix *device_matrix;
899 u16 card, dom;
900 u64 mkvp[2];
901 int i, rc, oi = -1;
902
903 /* mkvp must not be zero */
904 if (t->mkvp == 0)
905 return -EINVAL;
906
907 /* fetch status of all crypto cards */
908 device_matrix = kmalloc(sizeof(struct zcrypt_device_matrix),
909 GFP_KERNEL);
910 if (!device_matrix)
911 return -ENOMEM;
912 zcrypt_device_status_mask(device_matrix);
913
914 /* walk through all crypto cards */
915 for (i = 0; i < MAX_ZDEV_ENTRIES; i++) {
916 card = AP_QID_CARD(device_matrix->device[i].qid);
917 dom = AP_QID_QUEUE(device_matrix->device[i].qid);
918 if (device_matrix->device[i].online &&
919 device_matrix->device[i].functions & 0x04) {
920 /* an enabled CCA Coprocessor card */
921 /* try cached mkvp */
922 if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
923 t->mkvp == mkvp[0]) {
924 if (!verify)
925 break;
926 /* verify: fetch mkvp from adapter */
927 if (fetch_mkvp(card, dom, mkvp) == 0) {
928 mkvp_cache_update(card, dom, mkvp);
929 if (t->mkvp == mkvp[0])
930 break;
931 }
932 }
933 } else {
934 /* Card is offline and/or not a CCA card. */
935 /* del mkvp entry from cache if it exists */
936 mkvp_cache_scrub(card, dom);
937 }
938 }
939 if (i >= MAX_ZDEV_ENTRIES) {
940 /* nothing found, so this time without cache */
941 for (i = 0; i < MAX_ZDEV_ENTRIES; i++) {
942 if (!(device_matrix->device[i].online &&
943 device_matrix->device[i].functions & 0x04))
944 continue;
945 card = AP_QID_CARD(device_matrix->device[i].qid);
946 dom = AP_QID_QUEUE(device_matrix->device[i].qid);
947 /* fresh fetch mkvp from adapter */
948 if (fetch_mkvp(card, dom, mkvp) == 0) {
949 mkvp_cache_update(card, dom, mkvp);
950 if (t->mkvp == mkvp[0])
951 break;
952 if (t->mkvp == mkvp[1] && oi < 0)
953 oi = i;
954 }
955 }
956 if (i >= MAX_ZDEV_ENTRIES && oi >= 0) {
957 /* old mkvp matched, use this card then */
958 card = AP_QID_CARD(device_matrix->device[oi].qid);
959 dom = AP_QID_QUEUE(device_matrix->device[oi].qid);
960 }
961 }
962 if (i < MAX_ZDEV_ENTRIES || oi >= 0) {
963 if (pcardnr)
964 *pcardnr = card;
965 if (pdomain)
966 *pdomain = dom;
967 rc = 0;
968 } else
969 rc = -ENODEV;
970
971 kfree(device_matrix);
972 return rc;
973 }
974 EXPORT_SYMBOL(pkey_findcard);
975
976 /*
977 * Find card and transform secure key into protected key.
978 */
pkey_skey2pkey(const struct pkey_seckey * seckey,struct pkey_protkey * protkey)979 int pkey_skey2pkey(const struct pkey_seckey *seckey,
980 struct pkey_protkey *protkey)
981 {
982 u16 cardnr, domain;
983 int rc, verify;
984
985 /*
986 * The pkey_sec2protkey call may fail when a card has been
987 * addressed where the master key was changed after last fetch
988 * of the mkvp into the cache. So first try without verify then
989 * with verify enabled (thus refreshing the mkvp for each card).
990 */
991 for (verify = 0; verify < 2; verify++) {
992 rc = pkey_findcard(seckey, &cardnr, &domain, verify);
993 if (rc)
994 continue;
995 rc = pkey_sec2protkey(cardnr, domain, seckey, protkey);
996 if (rc == 0)
997 break;
998 }
999
1000 if (rc)
1001 DEBUG_DBG("pkey_skey2pkey failed rc=%d\n", rc);
1002
1003 return rc;
1004 }
1005 EXPORT_SYMBOL(pkey_skey2pkey);
1006
1007 /*
1008 * Verify key and give back some info about the key.
1009 */
pkey_verifykey(const struct pkey_seckey * seckey,u16 * pcardnr,u16 * pdomain,u16 * pkeysize,u32 * pattributes)1010 int pkey_verifykey(const struct pkey_seckey *seckey,
1011 u16 *pcardnr, u16 *pdomain,
1012 u16 *pkeysize, u32 *pattributes)
1013 {
1014 struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
1015 u16 cardnr, domain;
1016 u64 mkvp[2];
1017 int rc;
1018
1019 /* check the secure key for valid AES secure key */
1020 rc = check_secaeskeytoken((u8 *) seckey, 0);
1021 if (rc)
1022 goto out;
1023 if (pattributes)
1024 *pattributes = PKEY_VERIFY_ATTR_AES;
1025 if (pkeysize)
1026 *pkeysize = t->bitsize;
1027
1028 /* try to find a card which can handle this key */
1029 rc = pkey_findcard(seckey, &cardnr, &domain, 1);
1030 if (rc)
1031 goto out;
1032
1033 /* check mkvp for old mkvp match */
1034 rc = mkvp_cache_fetch(cardnr, domain, mkvp);
1035 if (rc)
1036 goto out;
1037 if (t->mkvp == mkvp[1]) {
1038 DEBUG_DBG("pkey_verifykey secure key has old mkvp\n");
1039 if (pattributes)
1040 *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
1041 }
1042
1043 if (pcardnr)
1044 *pcardnr = cardnr;
1045 if (pdomain)
1046 *pdomain = domain;
1047
1048 out:
1049 DEBUG_DBG("pkey_verifykey rc=%d\n", rc);
1050 return rc;
1051 }
1052 EXPORT_SYMBOL(pkey_verifykey);
1053
1054 /*
1055 * File io functions
1056 */
1057
pkey_unlocked_ioctl(struct file * filp,unsigned int cmd,unsigned long arg)1058 static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
1059 unsigned long arg)
1060 {
1061 int rc;
1062
1063 switch (cmd) {
1064 case PKEY_GENSECK: {
1065 struct pkey_genseck __user *ugs = (void __user *) arg;
1066 struct pkey_genseck kgs;
1067
1068 if (copy_from_user(&kgs, ugs, sizeof(kgs)))
1069 return -EFAULT;
1070 rc = pkey_genseckey(kgs.cardnr, kgs.domain,
1071 kgs.keytype, &kgs.seckey);
1072 DEBUG_DBG("pkey_ioctl pkey_genseckey()=%d\n", rc);
1073 if (rc)
1074 break;
1075 if (copy_to_user(ugs, &kgs, sizeof(kgs)))
1076 return -EFAULT;
1077 break;
1078 }
1079 case PKEY_CLR2SECK: {
1080 struct pkey_clr2seck __user *ucs = (void __user *) arg;
1081 struct pkey_clr2seck kcs;
1082
1083 if (copy_from_user(&kcs, ucs, sizeof(kcs)))
1084 return -EFAULT;
1085 rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
1086 &kcs.clrkey, &kcs.seckey);
1087 DEBUG_DBG("pkey_ioctl pkey_clr2seckey()=%d\n", rc);
1088 if (rc)
1089 break;
1090 if (copy_to_user(ucs, &kcs, sizeof(kcs)))
1091 return -EFAULT;
1092 memzero_explicit(&kcs, sizeof(kcs));
1093 break;
1094 }
1095 case PKEY_SEC2PROTK: {
1096 struct pkey_sec2protk __user *usp = (void __user *) arg;
1097 struct pkey_sec2protk ksp;
1098
1099 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1100 return -EFAULT;
1101 rc = pkey_sec2protkey(ksp.cardnr, ksp.domain,
1102 &ksp.seckey, &ksp.protkey);
1103 DEBUG_DBG("pkey_ioctl pkey_sec2protkey()=%d\n", rc);
1104 if (rc)
1105 break;
1106 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1107 return -EFAULT;
1108 break;
1109 }
1110 case PKEY_CLR2PROTK: {
1111 struct pkey_clr2protk __user *ucp = (void __user *) arg;
1112 struct pkey_clr2protk kcp;
1113
1114 if (copy_from_user(&kcp, ucp, sizeof(kcp)))
1115 return -EFAULT;
1116 rc = pkey_clr2protkey(kcp.keytype,
1117 &kcp.clrkey, &kcp.protkey);
1118 DEBUG_DBG("pkey_ioctl pkey_clr2protkey()=%d\n", rc);
1119 if (rc)
1120 break;
1121 if (copy_to_user(ucp, &kcp, sizeof(kcp)))
1122 return -EFAULT;
1123 memzero_explicit(&kcp, sizeof(kcp));
1124 break;
1125 }
1126 case PKEY_FINDCARD: {
1127 struct pkey_findcard __user *ufc = (void __user *) arg;
1128 struct pkey_findcard kfc;
1129
1130 if (copy_from_user(&kfc, ufc, sizeof(kfc)))
1131 return -EFAULT;
1132 rc = pkey_findcard(&kfc.seckey,
1133 &kfc.cardnr, &kfc.domain, 1);
1134 DEBUG_DBG("pkey_ioctl pkey_findcard()=%d\n", rc);
1135 if (rc)
1136 break;
1137 if (copy_to_user(ufc, &kfc, sizeof(kfc)))
1138 return -EFAULT;
1139 break;
1140 }
1141 case PKEY_SKEY2PKEY: {
1142 struct pkey_skey2pkey __user *usp = (void __user *) arg;
1143 struct pkey_skey2pkey ksp;
1144
1145 if (copy_from_user(&ksp, usp, sizeof(ksp)))
1146 return -EFAULT;
1147 rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey);
1148 DEBUG_DBG("pkey_ioctl pkey_skey2pkey()=%d\n", rc);
1149 if (rc)
1150 break;
1151 if (copy_to_user(usp, &ksp, sizeof(ksp)))
1152 return -EFAULT;
1153 break;
1154 }
1155 case PKEY_VERIFYKEY: {
1156 struct pkey_verifykey __user *uvk = (void __user *) arg;
1157 struct pkey_verifykey kvk;
1158
1159 if (copy_from_user(&kvk, uvk, sizeof(kvk)))
1160 return -EFAULT;
1161 rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
1162 &kvk.keysize, &kvk.attributes);
1163 DEBUG_DBG("pkey_ioctl pkey_verifykey()=%d\n", rc);
1164 if (rc)
1165 break;
1166 if (copy_to_user(uvk, &kvk, sizeof(kvk)))
1167 return -EFAULT;
1168 break;
1169 }
1170 default:
1171 /* unknown/unsupported ioctl cmd */
1172 return -ENOTTY;
1173 }
1174
1175 return rc;
1176 }
1177
1178 /*
1179 * Sysfs and file io operations
1180 */
1181 static const struct file_operations pkey_fops = {
1182 .owner = THIS_MODULE,
1183 .open = nonseekable_open,
1184 .llseek = no_llseek,
1185 .unlocked_ioctl = pkey_unlocked_ioctl,
1186 };
1187
1188 static struct miscdevice pkey_dev = {
1189 .name = "pkey",
1190 .minor = MISC_DYNAMIC_MINOR,
1191 .mode = 0666,
1192 .fops = &pkey_fops,
1193 };
1194
1195 /*
1196 * Module init
1197 */
pkey_init(void)1198 static int __init pkey_init(void)
1199 {
1200 cpacf_mask_t pckmo_functions;
1201
1202 /* check for pckmo instructions available */
1203 if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
1204 return -EOPNOTSUPP;
1205 if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) ||
1206 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) ||
1207 !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY))
1208 return -EOPNOTSUPP;
1209
1210 pkey_debug_init();
1211
1212 return misc_register(&pkey_dev);
1213 }
1214
1215 /*
1216 * Module exit
1217 */
pkey_exit(void)1218 static void __exit pkey_exit(void)
1219 {
1220 misc_deregister(&pkey_dev);
1221 mkvp_cache_free();
1222 pkey_debug_exit();
1223 }
1224
1225 module_init(pkey_init);
1226 module_exit(pkey_exit);
1227