Commit ea88e171 authored by Harald Freudenberger's avatar Harald Freudenberger Committed by Vasily Gorbik
Browse files

s390/pkey: Unify pkey cca, ep11 and pckmo functions signatures 



As a preparation step for introducing a common function API
between the pkey API module and the handlers (that is the
cca, ep11 and pckmo code) this patch unifies the functions
signatures exposed by the handlers and reworks all the
invocation code of these functions.

Signed-off-by: default avatarHarald Freudenberger <freude@linux.ibm.com>
Reviewed-by: default avatarHolger Dengler <dengler@linux.ibm.com>
Signed-off-by: default avatarVasily Gorbik <gor@linux.ibm.com>
parent 86fbf5e2

drivers/s390/crypto/pkey_api.c

+28 −21
Original line number Diff line number Diff line
@@ -109,7 +109,7 @@ static int genseck2(const struct pkey_apqn *apqns, size_t nr_apqns, 
			rc = pkey_cca_gen_key(apqns[i].card,

					      apqns[i].domain,

					      u, keytype, keybitsize, flags,

					      keybuf, keybuflen);

					      keybuf, keybuflen, NULL);

		}

	} else if (pkey_is_ep11_keytype(keytype)) {

		/* As of now only EP11 AES key generation is supported */
@@ -123,7 +123,7 @@ static int genseck2(const struct pkey_apqn *apqns, size_t nr_apqns, 
			rc = pkey_ep11_gen_key(apqns[i].card,

					       apqns[i].domain,

					       u, keytype, keybitsize, flags,

					       keybuf, keybuflen);

					       keybuf, keybuflen, NULL);

		}

	} else {

		PKEY_DBF_ERR("%s unknown/unsupported keytype %d\n",
@@ -154,7 +154,7 @@ static int clr2seckey2(const struct pkey_apqn *apqns, size_t nr_apqns, 
					      apqns[i].domain,

					      u, keytype, kbitsize, flags,

					      clrkey, kbitsize / 8,

					      keybuf, keybuflen);

					      keybuf, keybuflen, NULL);

		}

	} else if (pkey_is_ep11_keytype(keytype)) {

		/* As of now only EP11 AES key generation is supported */
@@ -169,7 +169,7 @@ static int clr2seckey2(const struct pkey_apqn *apqns, size_t nr_apqns, 
					       apqns[i].domain,

					       u, keytype, kbitsize, flags,

					       clrkey, kbitsize / 8,

					       keybuf, keybuflen);

					       keybuf, keybuflen, NULL);

		}

	} else {

		PKEY_DBF_ERR("%s unknown/unsupported keytype %d\n",
@@ -308,6 +308,7 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
		nr_apqns = MAXAPQNSINLIST;

		rc = pkey_cca_apqns4type(PKEY_TYPE_CCA_DATA,

					 NULL, NULL, 0, apqns, &nr_apqns);

		pr_debug("pkey_cca_apqns4type(CCA_DATA)=%d\n", rc);

		if (rc)

			goto try_via_ep11;

		for (j = 0, rc = -ENODEV; j < nr_apqns && rc; j++) {
@@ -316,7 +317,8 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
					      t->keytype, PKEY_TYPE_CCA_DATA,

					      8 * keysize, 0,

					      t->clearkey, t->len,

					      tmpbuf, &tmplen);

					      tmpbuf, &tmplen, NULL);

			pr_debug("pkey_cca_clr2key()=%d\n", rc);

		}

		if (rc)

			goto try_via_ep11;
@@ -326,6 +328,7 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
						  tmpbuf, tmplen,

						  protkey, protkeylen,

						  protkeytype);

			pr_debug("pkey_cca_key2protkey()=%d\n", rc);

		}

		if (!rc)

			break;
@@ -335,6 +338,7 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
		nr_apqns = MAXAPQNSINLIST;

		rc = pkey_ep11_apqns4type(PKEY_TYPE_EP11_AES,

					  NULL, NULL, 0, apqns, &nr_apqns);

		pr_debug("pkey_ep11_apqns4type(EP11_AES)=%d\n", rc);

		if (rc)

			continue;

		for (j = 0, rc = -ENODEV; j < nr_apqns && rc; j++) {
@@ -343,7 +347,8 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
					       t->keytype, PKEY_TYPE_EP11_AES,

					       8 * keysize, 0,

					       t->clearkey, t->len,

					       tmpbuf, &tmplen);

					       tmpbuf, &tmplen, NULL);

			pr_debug("pkey_ep11_clr2key()=%d\n", rc);

		}

		if (rc)

			continue;
@@ -353,6 +358,7 @@ static int pckmokey2protkey_fallback(const struct clearkeytoken *t, 
						   tmpbuf, tmplen,

						   protkey, protkeylen,

						   protkeytype);

			pr_debug("pkey_ep11_key2protkey()=%d\n", rc);

		}

	}
@@ -367,9 +373,8 @@ static int pckmokey2protkey(const u8 *key, size_t keylen, 
{

	int rc;



	rc = pkey_pckmo_key2protkey(key, keylen,

				    protkey, protkeylen,

				    protkeytype);

	rc = pkey_pckmo_key2protkey(0, 0, key, keylen,

				    protkey, protkeylen, protkeytype);

	if (rc == -ENODEV) {

		struct keytoken_header *hdr = (struct keytoken_header *)key;

		struct clearkeytoken *t = (struct clearkeytoken *)key;
@@ -456,7 +461,7 @@ static int pkey_ioctl_genseck(struct pkey_genseck __user *ugs) 
	keybuflen = sizeof(kgs.seckey.seckey);

	rc = pkey_cca_gen_key(kgs.cardnr, kgs.domain,

			      kgs.keytype, PKEY_TYPE_CCA_DATA, 0, 0,

			      kgs.seckey.seckey, &keybuflen);

			      kgs.seckey.seckey, &keybuflen, NULL);

	pr_debug("pkey_cca_gen_key()=%d\n", rc);

	if (!rc && copy_to_user(ugs, &kgs, sizeof(kgs)))

		rc = -EFAULT;
@@ -478,7 +483,7 @@ static int pkey_ioctl_clr2seck(struct pkey_clr2seck __user *ucs) 
			      kcs.keytype, PKEY_TYPE_CCA_DATA, 0, 0,

			      kcs.clrkey.clrkey,

			      pkey_keytype_aes_to_size(kcs.keytype),

			      kcs.seckey.seckey, &keybuflen);

			      kcs.seckey.seckey, &keybuflen, NULL);

	pr_debug("pkey_cca_clr2key()=%d\n", rc);

	if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs)))

		rc = -EFAULT;
@@ -515,10 +520,11 @@ static int pkey_ioctl_clr2protk(struct pkey_clr2protk __user *ucp) 
	if (copy_from_user(&kcp, ucp, sizeof(kcp)))

		return -EFAULT;

	kcp.protkey.len = sizeof(kcp.protkey.protkey);

	rc = pkey_pckmo_clr2protkey(kcp.keytype, kcp.clrkey.clrkey,

	rc = pkey_pckmo_clr2key(0, 0, kcp.keytype, 0, 0, 0,

				kcp.clrkey.clrkey, 0,

				kcp.protkey.protkey,

				&kcp.protkey.len, &kcp.protkey.type);

	pr_debug("pkey_pckmo_clr2protkey()=%d\n", rc);

	pr_debug("pkey_pckmo_clr2key()=%d\n", rc);

	if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp)))

		rc = -EFAULT;

	memzero_explicit(&kcp, sizeof(kcp));
@@ -643,9 +649,10 @@ static int pkey_ioctl_genprotk(struct pkey_genprotk __user *ugp) 
	if (copy_from_user(&kgp, ugp, sizeof(kgp)))

		return -EFAULT;

	kgp.protkey.len = sizeof(kgp.protkey.protkey);

	rc = pkey_pckmo_gen_protkey(kgp.keytype, kgp.protkey.protkey,

	rc = pkey_pckmo_gen_key(0, 0, kgp.keytype, 0, 0, 0,

				kgp.protkey.protkey,

				&kgp.protkey.len, &kgp.protkey.type);

	pr_debug("pkey_gen_protkey()=%d\n", rc);

	pr_debug("pkey_pckmo_gen_key()=%d\n", rc);

	if (!rc && copy_to_user(ugp, &kgp, sizeof(kgp)))

		rc = -EFAULT;

	memzero_explicit(&kgp, sizeof(kgp));
@@ -660,9 +667,9 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp) 


	if (copy_from_user(&kvp, uvp, sizeof(kvp)))

		return -EFAULT;

	rc = pkey_pckmo_verify_protkey(kvp.protkey.protkey,

				       kvp.protkey.len, kvp.protkey.type);

	pr_debug("pkey_verify_protkey()=%d\n", rc);

	rc = pkey_pckmo_verifykey(kvp.protkey.protkey, kvp.protkey.len,

				  0, 0, &kvp.protkey.type, 0, 0);

	pr_debug("pkey_pckmo_verifykey()=%d\n", rc);

	memzero_explicit(&kvp, sizeof(kvp));



	return rc;

drivers/s390/crypto/pkey_base.h

+18 −11
Original line number Diff line number Diff line
@@ -97,12 +97,12 @@ int pkey_cca_key2protkey(u16 card, u16 dom, 
int pkey_cca_gen_key(u16 card, u16 dom,

		     u32 keytype, u32 keysubtype,

		     u32 keybitsize, u32 flags,

		     u8 *keybuf, u32 *keybuflen);

		     u8 *keybuf, u32 *keybuflen, u32 *_keyinfo);

int pkey_cca_clr2key(u16 card, u16 dom,

		     u32 keytype, u32 keysubtype,

		     u32 keybitsize, u32 flags,

		     const u8 *clrkey, u32 clrkeylen,

		     u8 *keybuf, u32 *keybuflen);

		     u8 *keybuf, u32 *keybuflen, u32 *_keyinfo);

int pkey_cca_verifykey(const u8 *key, u32 keylen,

		       u16 *card, u16 *dom,

		       u32 *keytype, u32 *keybitsize, u32 *flags);
@@ -124,12 +124,12 @@ int pkey_ep11_key2protkey(u16 card, u16 dom, 
int pkey_ep11_gen_key(u16 card, u16 dom,

		      u32 keytype, u32 keysubtype,

		      u32 keybitsize, u32 flags,

		      u8 *keybuf, u32 *keybuflen);

		      u8 *keybuf, u32 *keybuflen, u32 *_keyinfo);

int pkey_ep11_clr2key(u16 card, u16 dom,

		      u32 keytype, u32 keysubtype,

		      u32 keybitsize, u32 flags,

		      const u8 *clrkey, u32 clrkeylen,

		      u8 *keybuf, u32 *keybuflen);

		      u8 *keybuf, u32 *keybuflen, u32 *_keyinfo);

int pkey_ep11_verifykey(const u8 *key, u32 keylen,

			u16 *card, u16 *dom,

			u32 *keytype, u32 *keybitsize, u32 *flags);
@@ -144,14 +144,21 @@ int pkey_ep11_apqns4type(enum pkey_key_type ktype, 
 */



bool pkey_is_pckmo_key(const u8 *key, u32 keylen);

int pkey_pckmo_key2protkey(const u8 *key, u32 keylen,

			   u8 *protkey, u32 *protkeylen, u32 *protkeytype);

int pkey_pckmo_gen_protkey(u32 keytype,

			   u8 *protkey, u32 *protkeylen, u32 *protkeytype);

int pkey_pckmo_clr2protkey(u32 keytype, const u8 *clrkey,

int pkey_pckmo_key2protkey(u16 _card, u16 _dom,

			   const u8 *key, u32 keylen,

			   u8 *protkey, u32 *protkeylen, u32 *protkeytype);

int pkey_pckmo_verify_protkey(const u8 *protkey, u32 protkeylen,

			      u32 protkeytype);

int pkey_pckmo_gen_key(u16 _card, u16 _dom,

		       u32 keytype, u32 _keysubtype,

		       u32 _keybitsize, u32 _flags,

		       u8 *keybuf, u32 *keybuflen, u32 *keyinfo);

int pkey_pckmo_clr2key(u16 _card, u16 _dom,

		       u32 keytype, u32 _keysubtype,

		       u32 _keybitsize, u32 _flags,

		       const u8 *clrkey, u32 clrkeylen,

		       u8 *keybuf, u32 *keybuflen, u32 *keyinfo);

int pkey_pckmo_verifykey(const u8 *key, u32 keylen,

			 u16 *_card, u16 *_dom,

			 u32 *keytype, u32 *_keybitsize, u32 *_flags);



/*

 * pkey_sysfs.c:

drivers/s390/crypto/pkey_cca.c

+2 −2
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ int pkey_cca_key2protkey(u16 card, u16 dom, 
int pkey_cca_gen_key(u16 card, u16 dom,

		     u32 keytype, u32 subtype,

		     u32 keybitsize, u32 flags,

		     u8 *keybuf, u32 *keybuflen)

		     u8 *keybuf, u32 *keybuflen, u32 *_keyinfo)

{

	int len, rc;
@@ -173,7 +173,7 @@ int pkey_cca_clr2key(u16 card, u16 dom, 
		     u32 keytype, u32 subtype,

		     u32 keybitsize, u32 flags,

		     const u8 *clrkey, u32 clrkeylen,

		     u8 *keybuf, u32 *keybuflen)

		     u8 *keybuf, u32 *keybuflen, u32 *_keyinfo)

{

	int len, rc;

drivers/s390/crypto/pkey_ep11.c

+5 −8
Original line number Diff line number Diff line
@@ -71,8 +71,7 @@ int pkey_ep11_key2protkey(u16 card, u16 dom, 
						3, key, keylen, 1))

			return -EINVAL;

		rc = ep11_kblob2protkey(card, dom, key, hdr->len,

					protkey, protkeylen,

					protkeytype);

					protkey, protkeylen, protkeytype);

	} else if (hdr->type == TOKTYPE_NON_CCA &&

		   hdr->version == TOKVER_EP11_ECC_WITH_HEADER &&

		   is_ep11_keyblob(key + sizeof(struct ep11kblob_header))) {
@@ -81,8 +80,7 @@ int pkey_ep11_key2protkey(u16 card, u16 dom, 
						3, key, keylen, 1))

			return -EINVAL;

		rc = ep11_kblob2protkey(card, dom, key, hdr->len,

					protkey, protkeylen,

					protkeytype);

					protkey, protkeylen, protkeytype);

	} else if (hdr->type == TOKTYPE_NON_CCA &&

		   hdr->version == TOKVER_EP11_AES &&

		   is_ep11_keyblob(key)) {
@@ -90,8 +88,7 @@ int pkey_ep11_key2protkey(u16 card, u16 dom, 
		if (ep11_check_aes_key(pkey_dbf_info, 3, key, keylen, 1))

			return -EINVAL;

		rc = ep11_kblob2protkey(card, dom, key, hdr->len,

					protkey, protkeylen,

					protkeytype);

					protkey, protkeylen, protkeytype);

	} else {

		PKEY_DBF_ERR("%s unknown/unsupported blob type %d version %d\n",

			     __func__, hdr->type, hdr->version);
@@ -114,7 +111,7 @@ int pkey_ep11_key2protkey(u16 card, u16 dom, 
int pkey_ep11_gen_key(u16 card, u16 dom,

		      u32 keytype, u32 subtype,

		      u32 keybitsize, u32 flags,

		      u8 *keybuf, u32 *keybuflen)

		      u8 *keybuf, u32 *keybuflen, u32 *_keyinfo)

{

	int len, rc;
@@ -171,7 +168,7 @@ int pkey_ep11_clr2key(u16 card, u16 dom, 
		      u32 keytype, u32 subtype,

		      u32 keybitsize, u32 flags,

		      const u8 *clrkey, u32 clrkeylen,

		      u8 *keybuf, u32 *keybuflen)

		      u8 *keybuf, u32 *keybuflen, u32 *_keyinfo)

{

	int len, rc;

drivers/s390/crypto/pkey_pckmo.c

+76 −15
Original line number Diff line number Diff line
@@ -18,9 +18,66 @@ 
#include "pkey_base.h"



/*

 * Check key blob for known and supported here.

 * Prototypes

 */



static bool is_pckmo_key(const u8 *key, u32 keylen);

static int pckmo_key2protkey(const u8 *key, u32 keylen,

			     u8 *protkey, u32 *protkeylen, u32 *protkeytype);

static int pckmo_gen_protkey(u32 keytype,

			     u8 *protkey, u32 *protkeylen, u32 *protkeytype);

static int pckmo_clr2protkey(u32 keytype, const u8 *clrkey, u32 clrkeylen,

			     u8 *protkey, u32 *protkeylen, u32 *protkeytype);

static int pckmo_verify_protkey(const u8 *protkey, u32 protkeylen,

				u32 protkeytype);



/*

 * Wrapper functions

 */



bool pkey_is_pckmo_key(const u8 *key, u32 keylen)

{

	return is_pckmo_key(key, keylen);

}



int pkey_pckmo_key2protkey(u16 _card, u16 _dom,

			   const u8 *key, u32 keylen,

			   u8 *protkey, u32 *protkeylen, u32 *keyinfo)

{

	return pckmo_key2protkey(key, keylen,

				 protkey, protkeylen, keyinfo);

}



int pkey_pckmo_gen_key(u16 _card, u16 _dom,

		       u32 keytype, u32 _keysubtype,

		       u32 _keybitsize, u32 _flags,

		       u8 *keybuf, u32 *keybuflen, u32 *keyinfo)

{

	return pckmo_gen_protkey(keytype,

				 keybuf, keybuflen, keyinfo);

}



int pkey_pckmo_clr2key(u16 _card, u16 _dom,

		       u32 keytype, u32 _keysubtype,

		       u32 _keybitsize, u32 _flags,

		       const u8 *clrkey, u32 clrkeylen,

		       u8 *keybuf, u32 *keybuflen, u32 *keyinfo)

{

	return pckmo_clr2protkey(keytype, clrkey, clrkeylen,

				 keybuf, keybuflen, keyinfo);

}



int pkey_pckmo_verifykey(const u8 *key, u32 keylen,

			 u16 *_card, u16 *_dom,

			 u32 *keytype, u32 *_keybitsize, u32 *_flags)

{

	return pckmo_verify_protkey(key, keylen, *keytype);

}



/*

 * Check key blob for known and supported here.

 */

static bool is_pckmo_key(const u8 *key, u32 keylen)

{

	struct keytoken_header *hdr = (struct keytoken_header *)key;

	struct clearkeytoken *t = (struct clearkeytoken *)key;
@@ -55,7 +112,7 @@ bool pkey_is_pckmo_key(const u8 *key, u32 keylen) 
	}

}



int pkey_pckmo_key2protkey(const u8 *key, u32 keylen,

static int pckmo_key2protkey(const u8 *key, u32 keylen,

			     u8 *protkey, u32 *protkeylen, u32 *protkeytype)

{

	struct keytoken_header *hdr = (struct keytoken_header *)key;
@@ -73,8 +130,7 @@ int pkey_pckmo_key2protkey(const u8 *key, u32 keylen, 
		if (keylen != sizeof(struct protaeskeytoken))

			goto out;

		t = (struct protaeskeytoken *)key;

		rc = pkey_pckmo_verify_protkey(t->protkey, t->len,

					       t->keytype);

		rc = pckmo_verify_protkey(t->protkey, t->len, t->keytype);

		if (rc)

			goto out;

		memcpy(protkey, t->protkey, t->len);
@@ -123,7 +179,7 @@ int pkey_pckmo_key2protkey(const u8 *key, u32 keylen, 
				     __func__, t->len);

			goto out;

		}

		rc = pkey_pckmo_clr2protkey(t->keytype, t->clearkey,

		rc = pckmo_clr2protkey(t->keytype, t->clearkey, t->len,

				       protkey, protkeylen, protkeytype);

		break;

	}
@@ -143,7 +199,7 @@ int pkey_pckmo_key2protkey(const u8 *key, u32 keylen, 
 * Currently only the generation of AES protected keys

 * is supported.

 */

int pkey_pckmo_gen_protkey(u32 keytype, u8 *protkey,

static int pckmo_gen_protkey(u32 keytype, u8 *protkey,

			     u32 *protkeylen, u32 *protkeytype)

{

	u8 clrkey[32];
@@ -161,7 +217,7 @@ int pkey_pckmo_gen_protkey(u32 keytype, u8 *protkey, 
	get_random_bytes(clrkey, keysize);



	/* convert it to a dummy protected key */

	rc = pkey_pckmo_clr2protkey(keytype, clrkey,

	rc = pckmo_clr2protkey(keytype, clrkey, keysize,

			       protkey, protkeylen, protkeytype);

	if (rc)

		goto out;
@@ -177,7 +233,7 @@ int pkey_pckmo_gen_protkey(u32 keytype, u8 *protkey, 
/*

 * Create a protected key from a clear key value via PCKMO instruction.

 */

int pkey_pckmo_clr2protkey(u32 keytype, const u8 *clrkey,

static int pckmo_clr2protkey(u32 keytype, const u8 *clrkey, u32 clrkeylen,

			     u8 *protkey, u32 *protkeylen, u32 *protkeytype)

{

	/* mask of available pckmo subfunctions */
@@ -243,6 +299,11 @@ int pkey_pckmo_clr2protkey(u32 keytype, const u8 *clrkey, 
		goto out;

	}



	if (clrkeylen && clrkeylen < keysize) {

		PKEY_DBF_ERR("%s clear key size too small: %u < %d\n",

			     __func__, clrkeylen, keysize);

		goto out;

	}

	if (*protkeylen < keysize + AES_WK_VP_SIZE) {

		PKEY_DBF_ERR("%s prot key buffer size too small: %u < %d\n",

			     __func__, *protkeylen, keysize + AES_WK_VP_SIZE);
@@ -288,7 +349,7 @@ int pkey_pckmo_clr2protkey(u32 keytype, const u8 *clrkey, 
 * Verify a protected key blob.

 * Currently only AES protected keys are supported.

 */

int pkey_pckmo_verify_protkey(const u8 *protkey, u32 protkeylen,

static int pckmo_verify_protkey(const u8 *protkey, u32 protkeylen,

				u32 protkeytype)

{

	struct {