^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* SPDX-License-Identifier: GPL-2.0+ */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Copyright IBM Corp. 2019
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Author(s): Harald Freudenberger <freude@linux.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Collection of EP11 misc functions used by zcrypt and pkey
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #ifndef _ZCRYPT_EP11MISC_H_
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #define _ZCRYPT_EP11MISC_H_
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <asm/zcrypt.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <asm/pkey.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #define EP11_API_V 4 /* highest known and supported EP11 API version */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #define EP11_STRUCT_MAGIC 0x1234
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #define EP11_BLOB_PKEY_EXTRACTABLE 0x00200000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * Internal used values for the version field of the key header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * Should match to the enum pkey_key_type in pkey.h.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #define TOKVER_EP11_AES 0x03 /* EP11 AES key blob (old style) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #define TOKVER_EP11_AES_WITH_HEADER 0x06 /* EP11 AES key blob with header */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #define TOKVER_EP11_ECC_WITH_HEADER 0x07 /* EP11 ECC key blob with header */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) /* inside view of an EP11 secure key blob */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) struct ep11keyblob {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) u8 session[32];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) /* only used for PKEY_TYPE_EP11: */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) u8 type; /* 0x00 (TOKTYPE_NON_CCA) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) u8 res0; /* unused */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) u16 len; /* total length in bytes of this blob */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) u8 version; /* 0x03 (TOKVER_EP11_AES) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) u8 res1; /* unused */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) u16 keybitlen; /* clear key bit len, 0 for unknown */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) } head;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) u8 wkvp[16]; /* wrapping key verification pattern */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) u64 attr; /* boolean key attributes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) u64 mode; /* mode bits */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) u16 version; /* 0x1234, EP11_STRUCT_MAGIC */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) u8 iv[14];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) u8 encrypted_key_data[144];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) u8 mac[32];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) } __packed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) /* check ep11 key magic to find out if this is an ep11 key blob */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) static inline bool is_ep11_keyblob(const u8 *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) struct ep11keyblob *kb = (struct ep11keyblob *) key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) return (kb->version == EP11_STRUCT_MAGIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * Simple check if the key blob is a valid EP11 AES key blob with header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * If checkcpacfexport is enabled, the key is also checked for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * attributes needed to export this key for CPACF use.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * Returns 0 on success or errno value on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) int ep11_check_aes_key_with_hdr(debug_info_t *dbg, int dbflvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) const u8 *key, size_t keylen, int checkcpacfexp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) * Simple check if the key blob is a valid EP11 ECC key blob with header.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) * If checkcpacfexport is enabled, the key is also checked for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * attributes needed to export this key for CPACF use.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) * Returns 0 on success or errno value on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) int ep11_check_ecc_key_with_hdr(debug_info_t *dbg, int dbflvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) const u8 *key, size_t keylen, int checkcpacfexp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) * Simple check if the key blob is a valid EP11 AES key blob with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) * the header in the session field (old style EP11 AES key).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) * If checkcpacfexport is enabled, the key is also checked for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) * attributes needed to export this key for CPACF use.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) * Returns 0 on success or errno value on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) int ep11_check_aes_key(debug_info_t *dbg, int dbflvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) const u8 *key, size_t keylen, int checkcpacfexp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) /* EP11 card info struct */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct ep11_card_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) u32 API_ord_nr; /* API ordinal number */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) u16 FW_version; /* Firmware major and minor version */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) char serial[16]; /* serial number string (16 ascii, no 0x00 !) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) u64 op_mode; /* card operational mode(s) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) /* EP11 domain info struct */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) struct ep11_domain_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) char cur_wk_state; /* '0' invalid, '1' valid */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) char new_wk_state; /* '0' empty, '1' uncommitted, '2' committed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) u8 cur_wkvp[32]; /* current wrapping key verification pattern */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) u8 new_wkvp[32]; /* new wrapping key verification pattern */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) u64 op_mode; /* domain operational mode(s) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) * Provide information about an EP11 card.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) int ep11_get_card_info(u16 card, struct ep11_card_info *info, int verify);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) * Provide information about a domain within an EP11 card.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) int ep11_get_domain_info(u16 card, u16 domain, struct ep11_domain_info *info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) * Generate (random) EP11 AES secure key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) u8 *keybuf, size_t *keybufsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) * Generate EP11 AES secure key with given clear key value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) int ep11_clr2keyblob(u16 cardnr, u16 domain, u32 keybitsize, u32 keygenflags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) const u8 *clrkey, u8 *keybuf, size_t *keybufsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) * Build a list of ep11 apqns meeting the following constrains:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) * - apqn is online and is in fact an EP11 apqn
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) * - if cardnr is not FFFF only apqns with this cardnr
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) * - if domain is not FFFF only apqns with this domainnr
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) * - if minhwtype > 0 only apqns with hwtype >= minhwtype
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) * - if minapi > 0 only apqns with API_ord_nr >= minapi
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) * - if wkvp != NULL only apqns where the wkvp (EP11_WKVPLEN bytes) matches
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) * to the first EP11_WKVPLEN bytes of the wkvp of the current wrapping
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) * key for this domain. When a wkvp is given there will aways be a re-fetch
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) * of the domain info for the potential apqn - so this triggers an request
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) * reply to each apqn eligible.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) * The array of apqn entries is allocated with kmalloc and returned in *apqns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) * the number of apqns stored into the list is returned in *nr_apqns. One apqn
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) * entry is simple a 32 bit value with 16 bit cardnr and 16 bit domain nr and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) * may be casted to struct pkey_apqn. The return value is either 0 for success
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) * or a negative errno value. If no apqn meeting the criterias is found,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) * -ENODEV is returned.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) int ep11_findcard2(u32 **apqns, u32 *nr_apqns, u16 cardnr, u16 domain,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) int minhwtype, int minapi, const u8 *wkvp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) * Derive proteced key from EP11 key blob (AES and ECC keys).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) int ep11_kblob2protkey(u16 card, u16 dom, const u8 *key, size_t keylen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) u8 *protkey, u32 *protkeylen, u32 *protkeytype);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) void zcrypt_ep11misc_exit(void);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) #endif /* _ZCRYPT_EP11MISC_H_ */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags