2017-11-14 10:38:01 -07:00
|
|
|
// SPDX-License-Identifier: GPL-2.0+
|
2006-09-20 07:58:27 -06:00
|
|
|
/*
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
* Copyright IBM Corp. 2001, 2018
|
2006-09-20 07:58:27 -06:00
|
|
|
* Author(s): Robert Burroughs
|
|
|
|
* Eric Rossman (edrossma@us.ibm.com)
|
|
|
|
* Cornelia Huck <cornelia.huck@de.ibm.com>
|
|
|
|
*
|
|
|
|
* Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
|
|
|
|
* Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
|
|
|
|
* Ralph Wuerthner <rwuerthn@de.ibm.com>
|
2012-08-28 08:45:36 -06:00
|
|
|
* MSGTYPE restruct: Holger Dengler <hd@linux.vnet.ibm.com>
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
* Multiple device nodes: Harald Freudenberger <freude@linux.ibm.com>
|
2006-09-20 07:58:27 -06:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/interrupt.h>
|
|
|
|
#include <linux/miscdevice.h>
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/compat.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 02:04:11 -06:00
|
|
|
#include <linux/slab.h>
|
2011-07-26 17:09:06 -06:00
|
|
|
#include <linux/atomic.h>
|
2016-12-24 12:46:01 -07:00
|
|
|
#include <linux/uaccess.h>
|
2008-04-16 23:46:15 -06:00
|
|
|
#include <linux/hw_random.h>
|
2012-09-10 13:34:26 -06:00
|
|
|
#include <linux/debugfs.h>
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
#include <linux/cdev.h>
|
|
|
|
#include <linux/ctype.h>
|
2012-09-10 13:34:26 -06:00
|
|
|
#include <asm/debug.h>
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
#define CREATE_TRACE_POINTS
|
|
|
|
#include <asm/trace/zcrypt.h>
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
#include "zcrypt_api.h"
|
2016-11-23 22:45:21 -07:00
|
|
|
#include "zcrypt_debug.h"
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2013-11-20 02:47:13 -07:00
|
|
|
#include "zcrypt_msgtype6.h"
|
2016-08-25 03:11:30 -06:00
|
|
|
#include "zcrypt_msgtype50.h"
|
2013-11-20 02:47:13 -07:00
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* Module description.
|
|
|
|
*/
|
|
|
|
MODULE_AUTHOR("IBM Corporation");
|
2012-08-28 08:45:36 -06:00
|
|
|
MODULE_DESCRIPTION("Cryptographic Coprocessor interface, " \
|
|
|
|
"Copyright IBM Corp. 2001, 2012");
|
2006-09-20 07:58:27 -06:00
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
/*
|
|
|
|
* zcrypt tracepoint functions
|
|
|
|
*/
|
|
|
|
EXPORT_TRACEPOINT_SYMBOL(s390_zcrypt_req);
|
|
|
|
EXPORT_TRACEPOINT_SYMBOL(s390_zcrypt_rep);
|
|
|
|
|
2015-03-17 09:02:20 -06:00
|
|
|
static int zcrypt_hwrng_seed = 1;
|
2018-08-17 04:36:01 -06:00
|
|
|
module_param_named(hwrng_seed, zcrypt_hwrng_seed, int, 0440);
|
2015-03-17 09:02:20 -06:00
|
|
|
MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
|
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
DEFINE_SPINLOCK(zcrypt_list_lock);
|
|
|
|
LIST_HEAD(zcrypt_card_list);
|
|
|
|
int zcrypt_device_count;
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
static atomic_t zcrypt_open_count = ATOMIC_INIT(0);
|
2012-09-10 13:34:26 -06:00
|
|
|
static atomic_t zcrypt_rescan_count = ATOMIC_INIT(0);
|
|
|
|
|
|
|
|
atomic_t zcrypt_rescan_req = ATOMIC_INIT(0);
|
|
|
|
EXPORT_SYMBOL(zcrypt_rescan_req);
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2012-08-28 08:45:36 -06:00
|
|
|
static LIST_HEAD(zcrypt_ops_list);
|
|
|
|
|
2016-11-23 22:45:21 -07:00
|
|
|
/* Zcrypt related debug feature stuff. */
|
|
|
|
debug_info_t *zcrypt_dbf_info;
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2012-09-10 13:34:26 -06:00
|
|
|
/**
|
|
|
|
* Process a rescan of the transport layer.
|
|
|
|
*
|
|
|
|
* Returns 1, if the rescan has been processed, otherwise 0.
|
|
|
|
*/
|
|
|
|
static inline int zcrypt_process_rescan(void)
|
|
|
|
{
|
|
|
|
if (atomic_read(&zcrypt_rescan_req)) {
|
|
|
|
atomic_set(&zcrypt_rescan_req, 0);
|
|
|
|
atomic_inc(&zcrypt_rescan_count);
|
|
|
|
ap_bus_force_rescan();
|
2017-06-29 01:44:11 -06:00
|
|
|
ZCRYPT_DBF(DBF_INFO, "rescan count=%07d\n",
|
2016-11-23 22:45:21 -07:00
|
|
|
atomic_inc_return(&zcrypt_rescan_count));
|
2012-09-10 13:34:26 -06:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2012-08-28 08:45:36 -06:00
|
|
|
void zcrypt_msgtype_register(struct zcrypt_ops *zops)
|
|
|
|
{
|
s390/zcrypt: Fix initialisation when zcrypt is built-in
ap_bus and zcrypt_api assumed module information to always be present
and initialisation to be done in module loading order (symbol
dependencies). These assumptions don't hold if zcrypt is built-in;
THIS_MODULE will be NULL in this case and init call order is linker
order, i.e. Makefile order.
Fix initialisation order by ordering the object files in the Makefile
according to their dependencies, like the module loader would do.
Fix message type registration by using a dedicated "name" field rather
than piggy-backing on the module ("owner") information. There's no
change to the requirement that module name and msgtype name are
identical. The existing name macros are used.
We don't need any special code for dealing with the drivers being
built-in; the generic module support code already does the right
thing.
Test results:
1. CONFIG_MODULES=y, CONFIG_ZCRYPT=y
KVM: boots, no /sys/bus/ap (expected)
LPAR with CEX5: boots, /sys/bus/ap/devices/card*/type present
2. CONFIG_MODULES=y, CONFIG_ZCRYPT=m=:
KVM: boots, loading zcrypt_cex4 (and ap) fails (expected)
LPAR with CEX5: boots, loading =zcrypt_cex4= succeeds,
/sys/bus/ap/devices/card*/type present after explicit module
loading
3. CONFIG_MODULES unset, CONFIG_ZCRYPT=y:
KVM: boots, no /sys/bus/ap (expected)
LPAR with CEX5: boots, /sys/bus/ap/devices/card*/type present
No further testing (user-space functionality) was done.
Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2015-10-28 04:06:08 -06:00
|
|
|
list_add_tail(&zops->list, &zcrypt_ops_list);
|
2012-08-28 08:45:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
void zcrypt_msgtype_unregister(struct zcrypt_ops *zops)
|
|
|
|
{
|
|
|
|
list_del_init(&zops->list);
|
|
|
|
}
|
|
|
|
|
2016-09-02 07:21:45 -06:00
|
|
|
struct zcrypt_ops *zcrypt_msgtype(unsigned char *name, int variant)
|
2012-08-28 08:45:36 -06:00
|
|
|
{
|
|
|
|
struct zcrypt_ops *zops;
|
|
|
|
|
2016-09-02 07:21:45 -06:00
|
|
|
list_for_each_entry(zops, &zcrypt_ops_list, list)
|
2012-08-28 08:45:36 -06:00
|
|
|
if ((zops->variant == variant) &&
|
2016-09-02 07:21:45 -06:00
|
|
|
(!strncmp(zops->name, name, sizeof(zops->name))))
|
|
|
|
return zops;
|
|
|
|
return NULL;
|
2012-08-28 08:45:36 -06:00
|
|
|
}
|
2016-09-02 07:21:45 -06:00
|
|
|
EXPORT_SYMBOL(zcrypt_msgtype);
|
2012-08-28 08:45:36 -06:00
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/*
|
|
|
|
* Multi device nodes extension functions.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
|
|
|
|
struct zcdn_device;
|
|
|
|
|
|
|
|
static struct class *zcrypt_class;
|
|
|
|
static dev_t zcrypt_devt;
|
|
|
|
static struct cdev zcrypt_cdev;
|
|
|
|
|
|
|
|
struct zcdn_device {
|
|
|
|
struct device device;
|
|
|
|
struct ap_perms perms;
|
|
|
|
};
|
|
|
|
|
|
|
|
#define to_zcdn_dev(x) container_of((x), struct zcdn_device, device)
|
|
|
|
|
|
|
|
#define ZCDN_MAX_NAME 32
|
|
|
|
|
|
|
|
static int zcdn_create(const char *name);
|
|
|
|
static int zcdn_destroy(const char *name);
|
|
|
|
|
|
|
|
/* helper function, matches the name for find_zcdndev_by_name() */
|
|
|
|
static int __match_zcdn_name(struct device *dev, const void *data)
|
|
|
|
{
|
|
|
|
return strcmp(dev_name(dev), (const char *)data) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* helper function, matches the devt value for find_zcdndev_by_devt() */
|
|
|
|
static int __match_zcdn_devt(struct device *dev, const void *data)
|
|
|
|
{
|
|
|
|
return dev->devt == *((dev_t *) data);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Find zcdn device by name.
|
|
|
|
* Returns reference to the zcdn device which needs to be released
|
|
|
|
* with put_device() after use.
|
|
|
|
*/
|
|
|
|
static inline struct zcdn_device *find_zcdndev_by_name(const char *name)
|
|
|
|
{
|
|
|
|
struct device *dev =
|
|
|
|
class_find_device(zcrypt_class, NULL,
|
|
|
|
(void *) name,
|
|
|
|
__match_zcdn_name);
|
|
|
|
|
|
|
|
return dev ? to_zcdn_dev(dev) : NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Find zcdn device by devt value.
|
|
|
|
* Returns reference to the zcdn device which needs to be released
|
|
|
|
* with put_device() after use.
|
|
|
|
*/
|
|
|
|
static inline struct zcdn_device *find_zcdndev_by_devt(dev_t devt)
|
|
|
|
{
|
|
|
|
struct device *dev =
|
|
|
|
class_find_device(zcrypt_class, NULL,
|
|
|
|
(void *) &devt,
|
|
|
|
__match_zcdn_devt);
|
|
|
|
|
|
|
|
return dev ? to_zcdn_dev(dev) : NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t ioctlmask_show(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
char *buf)
|
|
|
|
{
|
|
|
|
int i, rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
|
|
|
|
buf[0] = '0';
|
|
|
|
buf[1] = 'x';
|
|
|
|
for (i = 0; i < sizeof(zcdndev->perms.ioctlm) / sizeof(long); i++)
|
|
|
|
snprintf(buf + 2 + 2 * i * sizeof(long),
|
|
|
|
PAGE_SIZE - 2 - 2 * i * sizeof(long),
|
|
|
|
"%016lx", zcdndev->perms.ioctlm[i]);
|
|
|
|
buf[2 + 2 * i * sizeof(long)] = '\n';
|
|
|
|
buf[2 + 2 * i * sizeof(long) + 1] = '\0';
|
|
|
|
rc = 2 + 2 * i * sizeof(long) + 1;
|
|
|
|
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t ioctlmask_store(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
const char *buf, size_t count)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
rc = ap_parse_mask_str(buf, zcdndev->perms.ioctlm,
|
|
|
|
AP_IOCTLS, &ap_perms_mutex);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static DEVICE_ATTR_RW(ioctlmask);
|
|
|
|
|
|
|
|
static ssize_t apmask_show(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
char *buf)
|
|
|
|
{
|
|
|
|
int i, rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
|
|
|
|
buf[0] = '0';
|
|
|
|
buf[1] = 'x';
|
|
|
|
for (i = 0; i < sizeof(zcdndev->perms.apm) / sizeof(long); i++)
|
|
|
|
snprintf(buf + 2 + 2 * i * sizeof(long),
|
|
|
|
PAGE_SIZE - 2 - 2 * i * sizeof(long),
|
|
|
|
"%016lx", zcdndev->perms.apm[i]);
|
|
|
|
buf[2 + 2 * i * sizeof(long)] = '\n';
|
|
|
|
buf[2 + 2 * i * sizeof(long) + 1] = '\0';
|
|
|
|
rc = 2 + 2 * i * sizeof(long) + 1;
|
|
|
|
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t apmask_store(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
const char *buf, size_t count)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
rc = ap_parse_mask_str(buf, zcdndev->perms.apm,
|
|
|
|
AP_DEVICES, &ap_perms_mutex);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static DEVICE_ATTR_RW(apmask);
|
|
|
|
|
|
|
|
static ssize_t aqmask_show(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
char *buf)
|
|
|
|
{
|
|
|
|
int i, rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
|
|
|
|
buf[0] = '0';
|
|
|
|
buf[1] = 'x';
|
|
|
|
for (i = 0; i < sizeof(zcdndev->perms.aqm) / sizeof(long); i++)
|
|
|
|
snprintf(buf + 2 + 2 * i * sizeof(long),
|
|
|
|
PAGE_SIZE - 2 - 2 * i * sizeof(long),
|
|
|
|
"%016lx", zcdndev->perms.aqm[i]);
|
|
|
|
buf[2 + 2 * i * sizeof(long)] = '\n';
|
|
|
|
buf[2 + 2 * i * sizeof(long) + 1] = '\0';
|
|
|
|
rc = 2 + 2 * i * sizeof(long) + 1;
|
|
|
|
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t aqmask_store(struct device *dev,
|
|
|
|
struct device_attribute *attr,
|
|
|
|
const char *buf, size_t count)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
rc = ap_parse_mask_str(buf, zcdndev->perms.aqm,
|
|
|
|
AP_DOMAINS, &ap_perms_mutex);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static DEVICE_ATTR_RW(aqmask);
|
|
|
|
|
|
|
|
static struct attribute *zcdn_dev_attrs[] = {
|
|
|
|
&dev_attr_ioctlmask.attr,
|
|
|
|
&dev_attr_apmask.attr,
|
|
|
|
&dev_attr_aqmask.attr,
|
|
|
|
NULL
|
|
|
|
};
|
|
|
|
|
|
|
|
static struct attribute_group zcdn_dev_attr_group = {
|
|
|
|
.attrs = zcdn_dev_attrs
|
|
|
|
};
|
|
|
|
|
|
|
|
static const struct attribute_group *zcdn_dev_attr_groups[] = {
|
|
|
|
&zcdn_dev_attr_group,
|
|
|
|
NULL
|
|
|
|
};
|
|
|
|
|
|
|
|
static ssize_t zcdn_create_store(struct class *class,
|
|
|
|
struct class_attribute *attr,
|
|
|
|
const char *buf, size_t count)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
char name[ZCDN_MAX_NAME];
|
|
|
|
|
|
|
|
strncpy(name, skip_spaces(buf), sizeof(name));
|
|
|
|
name[sizeof(name) - 1] = '\0';
|
|
|
|
|
|
|
|
rc = zcdn_create(strim(name));
|
|
|
|
|
|
|
|
return rc ? rc : count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct class_attribute class_attr_zcdn_create =
|
|
|
|
__ATTR(create, 0600, NULL, zcdn_create_store);
|
|
|
|
|
|
|
|
static ssize_t zcdn_destroy_store(struct class *class,
|
|
|
|
struct class_attribute *attr,
|
|
|
|
const char *buf, size_t count)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
char name[ZCDN_MAX_NAME];
|
|
|
|
|
|
|
|
strncpy(name, skip_spaces(buf), sizeof(name));
|
|
|
|
name[sizeof(name) - 1] = '\0';
|
|
|
|
|
|
|
|
rc = zcdn_destroy(strim(name));
|
|
|
|
|
|
|
|
return rc ? rc : count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct class_attribute class_attr_zcdn_destroy =
|
|
|
|
__ATTR(destroy, 0600, NULL, zcdn_destroy_store);
|
|
|
|
|
|
|
|
static void zcdn_device_release(struct device *dev)
|
|
|
|
{
|
|
|
|
struct zcdn_device *zcdndev = to_zcdn_dev(dev);
|
|
|
|
|
|
|
|
ZCRYPT_DBF(DBF_INFO, "releasing zcdn device %d:%d\n",
|
|
|
|
MAJOR(dev->devt), MINOR(dev->devt));
|
|
|
|
|
|
|
|
kfree(zcdndev);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int zcdn_create(const char *name)
|
|
|
|
{
|
|
|
|
dev_t devt;
|
|
|
|
int i, rc = 0;
|
|
|
|
char nodename[ZCDN_MAX_NAME];
|
|
|
|
struct zcdn_device *zcdndev;
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
|
|
|
|
/* check if device node with this name already exists */
|
|
|
|
if (name[0]) {
|
|
|
|
zcdndev = find_zcdndev_by_name(name);
|
|
|
|
if (zcdndev) {
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
rc = -EEXIST;
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* find an unused minor number */
|
|
|
|
for (i = 0; i < ZCRYPT_MAX_MINOR_NODES; i++) {
|
|
|
|
devt = MKDEV(MAJOR(zcrypt_devt), MINOR(zcrypt_devt) + i);
|
|
|
|
zcdndev = find_zcdndev_by_devt(devt);
|
|
|
|
if (zcdndev)
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
else
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (i == ZCRYPT_MAX_MINOR_NODES) {
|
|
|
|
rc = -ENOSPC;
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* alloc and prepare a new zcdn device */
|
|
|
|
zcdndev = kzalloc(sizeof(*zcdndev), GFP_KERNEL);
|
|
|
|
if (!zcdndev) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
zcdndev->device.release = zcdn_device_release;
|
|
|
|
zcdndev->device.class = zcrypt_class;
|
|
|
|
zcdndev->device.devt = devt;
|
|
|
|
zcdndev->device.groups = zcdn_dev_attr_groups;
|
|
|
|
if (name[0])
|
|
|
|
strncpy(nodename, name, sizeof(nodename));
|
|
|
|
else
|
|
|
|
snprintf(nodename, sizeof(nodename),
|
|
|
|
ZCRYPT_NAME "_%d", (int) MINOR(devt));
|
|
|
|
nodename[sizeof(nodename)-1] = '\0';
|
|
|
|
if (dev_set_name(&zcdndev->device, nodename)) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
rc = device_register(&zcdndev->device);
|
|
|
|
if (rc) {
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
|
|
|
|
ZCRYPT_DBF(DBF_INFO, "created zcdn device %d:%d\n",
|
|
|
|
MAJOR(devt), MINOR(devt));
|
|
|
|
|
|
|
|
unlockout:
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int zcdn_destroy(const char *name)
|
|
|
|
{
|
|
|
|
int rc = 0;
|
|
|
|
struct zcdn_device *zcdndev;
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
|
|
|
|
/* try to find this zcdn device */
|
|
|
|
zcdndev = find_zcdndev_by_name(name);
|
|
|
|
if (!zcdndev) {
|
|
|
|
rc = -ENOENT;
|
|
|
|
goto unlockout;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The zcdn device is not hard destroyed. It is subject to
|
|
|
|
* reference counting and thus just needs to be unregistered.
|
|
|
|
*/
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
device_unregister(&zcdndev->device);
|
|
|
|
|
|
|
|
unlockout:
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void zcdn_destroy_all(void)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
dev_t devt;
|
|
|
|
struct zcdn_device *zcdndev;
|
|
|
|
|
|
|
|
mutex_lock(&ap_perms_mutex);
|
|
|
|
for (i = 0; i < ZCRYPT_MAX_MINOR_NODES; i++) {
|
|
|
|
devt = MKDEV(MAJOR(zcrypt_devt), MINOR(zcrypt_devt) + i);
|
|
|
|
zcdndev = find_zcdndev_by_devt(devt);
|
|
|
|
if (zcdndev) {
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
device_unregister(&zcdndev->device);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
/**
|
2008-04-16 23:46:28 -06:00
|
|
|
* zcrypt_read (): Not supported beyond zcrypt 1.3.1.
|
|
|
|
*
|
|
|
|
* This function is not supported beyond zcrypt 1.3.1.
|
2006-09-20 07:58:27 -06:00
|
|
|
*/
|
|
|
|
static ssize_t zcrypt_read(struct file *filp, char __user *buf,
|
|
|
|
size_t count, loff_t *f_pos)
|
|
|
|
{
|
|
|
|
return -EPERM;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2008-04-16 23:46:28 -06:00
|
|
|
* zcrypt_write(): Not allowed.
|
|
|
|
*
|
2006-09-20 07:58:27 -06:00
|
|
|
* Write is is not allowed
|
|
|
|
*/
|
|
|
|
static ssize_t zcrypt_write(struct file *filp, const char __user *buf,
|
|
|
|
size_t count, loff_t *f_pos)
|
|
|
|
{
|
|
|
|
return -EPERM;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2008-04-16 23:46:28 -06:00
|
|
|
* zcrypt_open(): Count number of users.
|
|
|
|
*
|
|
|
|
* Device open function to count number of users.
|
2006-09-20 07:58:27 -06:00
|
|
|
*/
|
|
|
|
static int zcrypt_open(struct inode *inode, struct file *filp)
|
|
|
|
{
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
struct ap_perms *perms = &ap_perms;
|
|
|
|
|
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
if (filp->f_inode->i_cdev == &zcrypt_cdev) {
|
|
|
|
struct zcdn_device *zcdndev;
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
zcdndev = find_zcdndev_by_devt(filp->f_inode->i_rdev);
|
|
|
|
/* find returns a reference, no get_device() needed */
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
if (zcdndev)
|
|
|
|
perms = &zcdndev->perms;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
filp->private_data = (void *) perms;
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
atomic_inc(&zcrypt_open_count);
|
2010-05-17 02:00:07 -06:00
|
|
|
return nonseekable_open(inode, filp);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/**
|
|
|
|
* zcrypt_release(): Count number of users.
|
|
|
|
*
|
|
|
|
* Device close function to count number of users.
|
|
|
|
*/
|
2006-09-20 07:58:27 -06:00
|
|
|
static int zcrypt_release(struct inode *inode, struct file *filp)
|
|
|
|
{
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
if (filp->f_inode->i_cdev == &zcrypt_cdev) {
|
|
|
|
struct zcdn_device *zcdndev;
|
|
|
|
|
|
|
|
if (mutex_lock_interruptible(&ap_perms_mutex))
|
|
|
|
return -ERESTARTSYS;
|
|
|
|
zcdndev = find_zcdndev_by_devt(filp->f_inode->i_rdev);
|
|
|
|
mutex_unlock(&ap_perms_mutex);
|
|
|
|
if (zcdndev) {
|
|
|
|
/* 2 puts here: one for find, one for open */
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
put_device(&zcdndev->device);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
atomic_dec(&zcrypt_open_count);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static inline int zcrypt_check_ioctl(struct ap_perms *perms,
|
|
|
|
unsigned int cmd)
|
|
|
|
{
|
|
|
|
int rc = -EPERM;
|
|
|
|
int ioctlnr = (cmd & _IOC_NRMASK) >> _IOC_NRSHIFT;
|
|
|
|
|
|
|
|
if (ioctlnr > 0 && ioctlnr < AP_IOCTLS) {
|
|
|
|
if (test_bit_inv(ioctlnr, perms->ioctlm))
|
|
|
|
rc = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (rc)
|
|
|
|
ZCRYPT_DBF(DBF_WARN,
|
|
|
|
"ioctl check failed: ioctlnr=0x%04x rc=%d\n",
|
|
|
|
ioctlnr, rc);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool zcrypt_check_card(struct ap_perms *perms, int card)
|
|
|
|
{
|
|
|
|
return test_bit_inv(card, perms->apm) ? true : false;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool zcrypt_check_queue(struct ap_perms *perms, int queue)
|
|
|
|
{
|
|
|
|
return test_bit_inv(queue, perms->aqm) ? true : false;
|
|
|
|
}
|
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc,
|
|
|
|
struct zcrypt_queue *zq,
|
|
|
|
unsigned int weight)
|
|
|
|
{
|
|
|
|
if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner))
|
|
|
|
return NULL;
|
|
|
|
zcrypt_queue_get(zq);
|
|
|
|
get_device(&zq->queue->ap_dev.device);
|
|
|
|
atomic_add(weight, &zc->load);
|
|
|
|
atomic_add(weight, &zq->load);
|
|
|
|
zq->request_count++;
|
|
|
|
return zq;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void zcrypt_drop_queue(struct zcrypt_card *zc,
|
|
|
|
struct zcrypt_queue *zq,
|
|
|
|
unsigned int weight)
|
|
|
|
{
|
|
|
|
struct module *mod = zq->queue->ap_dev.drv->driver.owner;
|
|
|
|
|
|
|
|
zq->request_count--;
|
|
|
|
atomic_sub(weight, &zc->load);
|
|
|
|
atomic_sub(weight, &zq->load);
|
|
|
|
put_device(&zq->queue->ap_dev.device);
|
|
|
|
zcrypt_queue_put(zq);
|
|
|
|
module_put(mod);
|
|
|
|
}
|
|
|
|
|
2016-10-14 06:34:51 -06:00
|
|
|
static inline bool zcrypt_card_compare(struct zcrypt_card *zc,
|
|
|
|
struct zcrypt_card *pref_zc,
|
2018-08-17 04:36:01 -06:00
|
|
|
unsigned int weight,
|
|
|
|
unsigned int pref_weight)
|
2016-10-14 06:34:51 -06:00
|
|
|
{
|
|
|
|
if (!pref_zc)
|
2017-01-02 01:59:40 -07:00
|
|
|
return false;
|
2016-10-14 06:34:51 -06:00
|
|
|
weight += atomic_read(&zc->load);
|
|
|
|
pref_weight += atomic_read(&pref_zc->load);
|
|
|
|
if (weight == pref_weight)
|
|
|
|
return atomic_read(&zc->card->total_request_count) >
|
|
|
|
atomic_read(&pref_zc->card->total_request_count);
|
|
|
|
return weight > pref_weight;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool zcrypt_queue_compare(struct zcrypt_queue *zq,
|
|
|
|
struct zcrypt_queue *pref_zq,
|
2018-08-17 04:36:01 -06:00
|
|
|
unsigned int weight,
|
|
|
|
unsigned int pref_weight)
|
2016-10-14 06:34:51 -06:00
|
|
|
{
|
|
|
|
if (!pref_zq)
|
2017-01-02 01:59:40 -07:00
|
|
|
return false;
|
2016-10-14 06:34:51 -06:00
|
|
|
weight += atomic_read(&zq->load);
|
|
|
|
pref_weight += atomic_read(&pref_zq->load);
|
|
|
|
if (weight == pref_weight)
|
2017-11-17 08:32:22 -07:00
|
|
|
return zq->queue->total_request_count >
|
|
|
|
pref_zq->queue->total_request_count;
|
2016-10-14 06:34:51 -06:00
|
|
|
return weight > pref_weight;
|
|
|
|
}
|
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* zcrypt ioctls.
|
|
|
|
*/
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long zcrypt_rsa_modexpo(struct ap_perms *perms,
|
|
|
|
struct ica_rsa_modexpo *mex)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc, *pref_zc;
|
|
|
|
struct zcrypt_queue *zq, *pref_zq;
|
|
|
|
unsigned int weight, pref_weight;
|
|
|
|
unsigned int func_code;
|
2016-11-25 10:04:56 -07:00
|
|
|
int qid = 0, rc = -ENODEV;
|
|
|
|
|
|
|
|
trace_s390_zcrypt_req(mex, TP_ICARSAMODEXPO);
|
|
|
|
|
|
|
|
if (mex->outputdatalength < mex->inputdatalength) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
goto out;
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* As long as outputdatalength is big enough, we can set the
|
|
|
|
* outputdatalength equal to the inputdatalength, since that is the
|
|
|
|
* number of bytes we will copy in any case
|
|
|
|
*/
|
|
|
|
mex->outputdatalength = mex->inputdatalength;
|
|
|
|
|
2016-08-25 03:14:15 -06:00
|
|
|
rc = get_rsa_modex_fc(mex, &func_code);
|
|
|
|
if (rc)
|
2016-11-25 10:04:56 -07:00
|
|
|
goto out;
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zc = NULL;
|
|
|
|
pref_zq = NULL;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
/* Check for online accelarator and CCA cards */
|
|
|
|
if (!zc->online || !(zc->card->functions & 0x18000000))
|
2006-09-20 07:58:27 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* Check for size limits */
|
|
|
|
if (zc->min_mod_size > mex->inputdatalength ||
|
|
|
|
zc->max_mod_size < mex->inputdatalength)
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this card */
|
|
|
|
if (!zcrypt_check_card(perms, zc->card->id))
|
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* get weight index of the card device */
|
|
|
|
weight = zc->speed_rating[func_code];
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_card_compare(zc, pref_zc, weight, pref_weight))
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
/* check if device is online and eligible */
|
2016-10-27 00:57:39 -06:00
|
|
|
if (!zq->online || !zq->ops->rsa_modexpo)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this queue */
|
|
|
|
if (!zcrypt_check_queue(perms,
|
|
|
|
AP_QID_QUEUE(zq->queue->qid)))
|
|
|
|
continue;
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_queue_compare(zq, pref_zq,
|
|
|
|
weight, pref_weight))
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
pref_zc = zc;
|
|
|
|
pref_zq = zq;
|
|
|
|
pref_weight = weight;
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2016-08-25 03:14:15 -06:00
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
if (!pref_zq) {
|
|
|
|
rc = -ENODEV;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
qid = pref_zq->queue->qid;
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = pref_zq->ops->rsa_modexpo(pref_zq, mex);
|
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
zcrypt_drop_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
out:
|
|
|
|
trace_s390_zcrypt_rep(mex, func_code, rc,
|
|
|
|
AP_QID_CARD(qid), AP_QID_QUEUE(qid));
|
2016-08-25 03:14:15 -06:00
|
|
|
return rc;
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long zcrypt_rsa_crt(struct ap_perms *perms,
|
|
|
|
struct ica_rsa_modexpo_crt *crt)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc, *pref_zc;
|
|
|
|
struct zcrypt_queue *zq, *pref_zq;
|
|
|
|
unsigned int weight, pref_weight;
|
|
|
|
unsigned int func_code;
|
2016-11-25 10:04:56 -07:00
|
|
|
int qid = 0, rc = -ENODEV;
|
|
|
|
|
|
|
|
trace_s390_zcrypt_req(crt, TP_ICARSACRT);
|
|
|
|
|
|
|
|
if (crt->outputdatalength < crt->inputdatalength) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
goto out;
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* As long as outputdatalength is big enough, we can set the
|
|
|
|
* outputdatalength equal to the inputdatalength, since that is the
|
|
|
|
* number of bytes we will copy in any case
|
|
|
|
*/
|
|
|
|
crt->outputdatalength = crt->inputdatalength;
|
|
|
|
|
2016-08-25 03:14:15 -06:00
|
|
|
rc = get_rsa_crt_fc(crt, &func_code);
|
|
|
|
if (rc)
|
2016-11-25 10:04:56 -07:00
|
|
|
goto out;
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zc = NULL;
|
|
|
|
pref_zq = NULL;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
/* Check for online accelarator and CCA cards */
|
|
|
|
if (!zc->online || !(zc->card->functions & 0x18000000))
|
2006-09-20 07:58:27 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* Check for size limits */
|
|
|
|
if (zc->min_mod_size > crt->inputdatalength ||
|
|
|
|
zc->max_mod_size < crt->inputdatalength)
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this card */
|
|
|
|
if (!zcrypt_check_card(perms, zc->card->id))
|
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* get weight index of the card device */
|
|
|
|
weight = zc->speed_rating[func_code];
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_card_compare(zc, pref_zc, weight, pref_weight))
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
/* check if device is online and eligible */
|
2016-10-27 00:57:39 -06:00
|
|
|
if (!zq->online || !zq->ops->rsa_modexpo_crt)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this queue */
|
|
|
|
if (!zcrypt_check_queue(perms,
|
|
|
|
AP_QID_QUEUE(zq->queue->qid)))
|
|
|
|
continue;
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_queue_compare(zq, pref_zq,
|
|
|
|
weight, pref_weight))
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
pref_zc = zc;
|
|
|
|
pref_zq = zq;
|
|
|
|
pref_weight = weight;
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2016-08-25 03:14:15 -06:00
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
if (!pref_zq) {
|
|
|
|
rc = -ENODEV;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
qid = pref_zq->queue->qid;
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = pref_zq->ops->rsa_modexpo_crt(pref_zq, crt);
|
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
zcrypt_drop_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
out:
|
|
|
|
trace_s390_zcrypt_rep(crt, func_code, rc,
|
|
|
|
AP_QID_CARD(qid), AP_QID_QUEUE(qid));
|
2016-08-25 03:14:15 -06:00
|
|
|
return rc;
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long _zcrypt_send_cprb(struct ap_perms *perms,
|
|
|
|
struct ica_xcRB *xcRB)
|
2006-09-20 07:58:36 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc, *pref_zc;
|
|
|
|
struct zcrypt_queue *zq, *pref_zq;
|
2016-08-25 03:14:15 -06:00
|
|
|
struct ap_message ap_msg;
|
2016-08-25 03:16:03 -06:00
|
|
|
unsigned int weight, pref_weight;
|
|
|
|
unsigned int func_code;
|
|
|
|
unsigned short *domain;
|
2016-11-25 10:04:56 -07:00
|
|
|
int qid = 0, rc = -ENODEV;
|
|
|
|
|
|
|
|
trace_s390_zcrypt_req(xcRB, TB_ZSECSENDCPRB);
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_init_message(&ap_msg);
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = get_cprb_fc(xcRB, &ap_msg, &func_code, &domain);
|
2016-08-25 03:14:15 -06:00
|
|
|
if (rc)
|
2016-11-25 10:04:56 -07:00
|
|
|
goto out;
|
2006-09-20 07:58:36 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zc = NULL;
|
|
|
|
pref_zq = NULL;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
/* Check for online CCA cards */
|
|
|
|
if (!zc->online || !(zc->card->functions & 0x10000000))
|
2006-09-20 07:58:36 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* Check for user selected CCA card */
|
|
|
|
if (xcRB->user_defined != AUTOSELECT &&
|
|
|
|
xcRB->user_defined != zc->card->id)
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this card */
|
|
|
|
if (!zcrypt_check_card(perms, zc->card->id))
|
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* get weight index of the card device */
|
|
|
|
weight = speed_idx_cca(func_code) * zc->speed_rating[SECKEY];
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_card_compare(zc, pref_zc, weight, pref_weight))
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
/* check if device is online and eligible */
|
|
|
|
if (!zq->online ||
|
2016-10-27 00:57:39 -06:00
|
|
|
!zq->ops->send_cprb ||
|
2016-08-25 03:16:03 -06:00
|
|
|
((*domain != (unsigned short) AUTOSELECT) &&
|
|
|
|
(*domain != AP_QID_QUEUE(zq->queue->qid))))
|
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this queue */
|
|
|
|
if (!zcrypt_check_queue(perms,
|
|
|
|
AP_QID_QUEUE(zq->queue->qid)))
|
|
|
|
continue;
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_queue_compare(zq, pref_zq,
|
|
|
|
weight, pref_weight))
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
pref_zc = zc;
|
|
|
|
pref_zq = zq;
|
|
|
|
pref_weight = weight;
|
2006-09-20 07:58:36 -06:00
|
|
|
}
|
2016-08-25 03:14:15 -06:00
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
if (!pref_zq) {
|
|
|
|
rc = -ENODEV;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
|
|
|
|
/* in case of auto select, provide the correct domain */
|
2016-11-25 10:04:56 -07:00
|
|
|
qid = pref_zq->queue->qid;
|
2016-08-25 03:16:03 -06:00
|
|
|
if (*domain == (unsigned short) AUTOSELECT)
|
2016-11-25 10:04:56 -07:00
|
|
|
*domain = AP_QID_QUEUE(qid);
|
2016-08-25 03:16:03 -06:00
|
|
|
|
|
|
|
rc = pref_zq->ops->send_cprb(pref_zq, xcRB, &ap_msg);
|
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
zcrypt_drop_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2016-11-25 10:04:56 -07:00
|
|
|
|
|
|
|
out:
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_release_message(&ap_msg);
|
2016-11-25 10:04:56 -07:00
|
|
|
trace_s390_zcrypt_rep(xcRB, func_code, rc,
|
|
|
|
AP_QID_CARD(qid), AP_QID_QUEUE(qid));
|
2016-08-25 03:14:15 -06:00
|
|
|
return rc;
|
2006-09-20 07:58:36 -06:00
|
|
|
}
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
|
|
|
|
long zcrypt_send_cprb(struct ica_xcRB *xcRB)
|
|
|
|
{
|
|
|
|
return _zcrypt_send_cprb(NULL, xcRB);
|
|
|
|
}
|
2016-11-02 07:32:32 -06:00
|
|
|
EXPORT_SYMBOL(zcrypt_send_cprb);
|
2006-09-20 07:58:36 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
static bool is_desired_ep11_card(unsigned int dev_id,
|
|
|
|
unsigned short target_num,
|
|
|
|
struct ep11_target_dev *targets)
|
2013-11-20 02:47:13 -07:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
while (target_num-- > 0) {
|
|
|
|
if (dev_id == targets->ap_id)
|
|
|
|
return true;
|
|
|
|
targets++;
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
2013-11-20 02:47:13 -07:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
static bool is_desired_ep11_queue(unsigned int dev_qid,
|
|
|
|
unsigned short target_num,
|
|
|
|
struct ep11_target_dev *targets)
|
|
|
|
{
|
|
|
|
while (target_num-- > 0) {
|
|
|
|
if (AP_MKQID(targets->ap_id, targets->dom_id) == dev_qid)
|
2013-11-20 02:47:13 -07:00
|
|
|
return true;
|
2016-08-25 03:16:03 -06:00
|
|
|
targets++;
|
2013-11-20 02:47:13 -07:00
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long zcrypt_send_ep11_cprb(struct ap_perms *perms,
|
|
|
|
struct ep11_urb *xcrb)
|
2013-11-20 02:47:13 -07:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc, *pref_zc;
|
|
|
|
struct zcrypt_queue *zq, *pref_zq;
|
|
|
|
struct ep11_target_dev *targets;
|
|
|
|
unsigned short target_num;
|
|
|
|
unsigned int weight, pref_weight;
|
|
|
|
unsigned int func_code;
|
2016-08-25 03:14:15 -06:00
|
|
|
struct ap_message ap_msg;
|
2016-11-25 10:04:56 -07:00
|
|
|
int qid = 0, rc = -ENODEV;
|
|
|
|
|
|
|
|
trace_s390_zcrypt_req(xcrb, TP_ZSENDEP11CPRB);
|
2013-11-20 02:47:13 -07:00
|
|
|
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_init_message(&ap_msg);
|
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
target_num = (unsigned short) xcrb->targets_num;
|
2013-11-20 02:47:13 -07:00
|
|
|
|
|
|
|
/* empty list indicates autoselect (all available targets) */
|
2016-08-25 03:16:03 -06:00
|
|
|
targets = NULL;
|
|
|
|
if (target_num != 0) {
|
|
|
|
struct ep11_target_dev __user *uptr;
|
|
|
|
|
|
|
|
targets = kcalloc(target_num, sizeof(*targets), GFP_KERNEL);
|
2016-11-25 10:04:56 -07:00
|
|
|
if (!targets) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out;
|
|
|
|
}
|
2013-11-20 02:47:13 -07:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
uptr = (struct ep11_target_dev __force __user *) xcrb->targets;
|
|
|
|
if (copy_from_user(targets, uptr,
|
2016-11-25 10:04:56 -07:00
|
|
|
target_num * sizeof(*targets))) {
|
|
|
|
rc = -EFAULT;
|
2018-05-28 05:00:42 -06:00
|
|
|
goto out_free;
|
2016-11-25 10:04:56 -07:00
|
|
|
}
|
2013-11-20 02:47:13 -07:00
|
|
|
}
|
|
|
|
|
2016-08-25 03:14:15 -06:00
|
|
|
rc = get_ep11cprb_fc(xcrb, &ap_msg, &func_code);
|
|
|
|
if (rc)
|
2016-08-25 03:16:03 -06:00
|
|
|
goto out_free;
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zc = NULL;
|
|
|
|
pref_zq = NULL;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
/* Check for online EP11 cards */
|
|
|
|
if (!zc->online || !(zc->card->functions & 0x04000000))
|
2013-11-20 02:47:13 -07:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* Check for user selected EP11 card */
|
|
|
|
if (targets &&
|
|
|
|
!is_desired_ep11_card(zc->card->id, target_num, targets))
|
2013-11-20 02:47:13 -07:00
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this card */
|
|
|
|
if (!zcrypt_check_card(perms, zc->card->id))
|
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* get weight index of the card device */
|
|
|
|
weight = speed_idx_ep11(func_code) * zc->speed_rating[SECKEY];
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_card_compare(zc, pref_zc, weight, pref_weight))
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
/* check if device is online and eligible */
|
|
|
|
if (!zq->online ||
|
2016-10-27 00:57:39 -06:00
|
|
|
!zq->ops->send_ep11_cprb ||
|
2016-08-25 03:16:03 -06:00
|
|
|
(targets &&
|
|
|
|
!is_desired_ep11_queue(zq->queue->qid,
|
|
|
|
target_num, targets)))
|
|
|
|
continue;
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
/* check if device node has admission for this queue */
|
|
|
|
if (!zcrypt_check_queue(perms,
|
|
|
|
AP_QID_QUEUE(zq->queue->qid)))
|
|
|
|
continue;
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_queue_compare(zq, pref_zq,
|
|
|
|
weight, pref_weight))
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
pref_zc = zc;
|
|
|
|
pref_zq = zq;
|
2016-08-25 03:14:15 -06:00
|
|
|
pref_weight = weight;
|
|
|
|
}
|
2013-11-20 02:47:13 -07:00
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
if (!pref_zq) {
|
|
|
|
rc = -ENODEV;
|
|
|
|
goto out_free;
|
2016-08-25 03:14:15 -06:00
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
qid = pref_zq->queue->qid;
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = pref_zq->ops->send_ep11_cprb(pref_zq, xcrb, &ap_msg);
|
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
zcrypt_drop_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
|
|
|
out_free:
|
|
|
|
kfree(targets);
|
2016-11-25 10:04:56 -07:00
|
|
|
out:
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_release_message(&ap_msg);
|
2016-11-25 10:04:56 -07:00
|
|
|
trace_s390_zcrypt_rep(xcrb, func_code, rc,
|
|
|
|
AP_QID_CARD(qid), AP_QID_QUEUE(qid));
|
2016-08-25 03:14:15 -06:00
|
|
|
return rc;
|
2013-11-20 02:47:13 -07:00
|
|
|
}
|
|
|
|
|
2008-04-16 23:46:15 -06:00
|
|
|
static long zcrypt_rng(char *buffer)
|
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc, *pref_zc;
|
|
|
|
struct zcrypt_queue *zq, *pref_zq;
|
|
|
|
unsigned int weight, pref_weight;
|
|
|
|
unsigned int func_code;
|
2016-08-25 03:14:15 -06:00
|
|
|
struct ap_message ap_msg;
|
2016-08-25 03:16:03 -06:00
|
|
|
unsigned int domain;
|
2016-11-25 10:04:56 -07:00
|
|
|
int qid = 0, rc = -ENODEV;
|
|
|
|
|
|
|
|
trace_s390_zcrypt_req(buffer, TP_HWRNGCPRB);
|
2008-04-16 23:46:15 -06:00
|
|
|
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_init_message(&ap_msg);
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = get_rng_fc(&ap_msg, &func_code, &domain);
|
2016-08-25 03:14:15 -06:00
|
|
|
if (rc)
|
2016-11-25 10:04:56 -07:00
|
|
|
goto out;
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zc = NULL;
|
|
|
|
pref_zq = NULL;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
/* Check for online CCA cards */
|
|
|
|
if (!zc->online || !(zc->card->functions & 0x10000000))
|
2008-04-16 23:46:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
/* get weight index of the card device */
|
|
|
|
weight = zc->speed_rating[func_code];
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_card_compare(zc, pref_zc, weight, pref_weight))
|
2016-08-25 03:14:15 -06:00
|
|
|
continue;
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
/* check if device is online and eligible */
|
2016-10-27 00:57:39 -06:00
|
|
|
if (!zq->online || !zq->ops->rng)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
2016-10-14 06:34:51 -06:00
|
|
|
if (zcrypt_queue_compare(zq, pref_zq,
|
|
|
|
weight, pref_weight))
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
pref_zc = zc;
|
|
|
|
pref_zq = zq;
|
2016-08-25 03:14:15 -06:00
|
|
|
pref_weight = weight;
|
|
|
|
}
|
|
|
|
}
|
2016-08-25 03:16:03 -06:00
|
|
|
pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
|
2018-05-28 05:00:42 -06:00
|
|
|
if (!pref_zq) {
|
|
|
|
rc = -ENODEV;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-08-25 03:14:15 -06:00
|
|
|
|
2016-11-25 10:04:56 -07:00
|
|
|
qid = pref_zq->queue->qid;
|
2016-08-25 03:16:03 -06:00
|
|
|
rc = pref_zq->ops->rng(pref_zq, buffer, &ap_msg);
|
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
zcrypt_drop_queue(pref_zc, pref_zq, weight);
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2016-11-25 10:04:56 -07:00
|
|
|
|
|
|
|
out:
|
2018-05-28 05:00:42 -06:00
|
|
|
ap_release_message(&ap_msg);
|
2016-11-25 10:04:56 -07:00
|
|
|
trace_s390_zcrypt_rep(buffer, func_code, rc,
|
|
|
|
AP_QID_CARD(qid), AP_QID_QUEUE(qid));
|
2016-08-25 03:14:15 -06:00
|
|
|
return rc;
|
2008-04-16 23:46:15 -06:00
|
|
|
}
|
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
static void zcrypt_device_status_mask(struct zcrypt_device_status *devstatus)
|
2016-08-25 03:19:58 -06:00
|
|
|
{
|
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
|
|
|
struct zcrypt_device_status *stat;
|
2018-04-09 08:18:37 -06:00
|
|
|
int card, queue;
|
|
|
|
|
|
|
|
memset(devstatus, 0, MAX_ZDEV_ENTRIES
|
|
|
|
* sizeof(struct zcrypt_device_status));
|
2016-08-25 03:19:58 -06:00
|
|
|
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
2018-04-09 08:18:37 -06:00
|
|
|
card = AP_QID_CARD(zq->queue->qid);
|
|
|
|
if (card >= MAX_ZDEV_CARDIDS)
|
|
|
|
continue;
|
|
|
|
queue = AP_QID_QUEUE(zq->queue->qid);
|
|
|
|
stat = &devstatus[card * AP_DOMAINS + queue];
|
2016-08-25 03:19:58 -06:00
|
|
|
stat->hwtype = zc->card->ap_dev.device_type;
|
|
|
|
stat->functions = zc->card->functions >> 26;
|
|
|
|
stat->qid = zq->queue->qid;
|
|
|
|
stat->online = zq->online ? 0x01 : 0x00;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
}
|
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
void zcrypt_device_status_mask_ext(struct zcrypt_device_status_ext *devstatus)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
2018-04-09 08:18:37 -06:00
|
|
|
struct zcrypt_device_status_ext *stat;
|
|
|
|
int card, queue;
|
|
|
|
|
|
|
|
memset(devstatus, 0, MAX_ZDEV_ENTRIES_EXT
|
|
|
|
* sizeof(struct zcrypt_device_status_ext));
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
2018-04-09 08:18:37 -06:00
|
|
|
card = AP_QID_CARD(zq->queue->qid);
|
|
|
|
queue = AP_QID_QUEUE(zq->queue->qid);
|
|
|
|
stat = &devstatus[card * AP_DOMAINS + queue];
|
|
|
|
stat->hwtype = zc->card->ap_dev.device_type;
|
|
|
|
stat->functions = zc->card->functions >> 26;
|
|
|
|
stat->qid = zq->queue->qid;
|
|
|
|
stat->online = zq->online ? 0x01 : 0x00;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(zcrypt_device_status_mask_ext);
|
|
|
|
|
|
|
|
static void zcrypt_status_mask(char status[], size_t max_adapters)
|
|
|
|
{
|
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
|
|
|
int card;
|
|
|
|
|
|
|
|
memset(status, 0, max_adapters);
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
card = AP_QID_CARD(zq->queue->qid);
|
|
|
|
if (AP_QID_QUEUE(zq->queue->qid) != ap_domain_index
|
|
|
|
|| card >= max_adapters)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
2018-04-09 08:18:37 -06:00
|
|
|
status[card] = zc->online ? zc->user_space_type : 0x0d;
|
2016-08-25 03:16:03 -06:00
|
|
|
}
|
|
|
|
}
|
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
static void zcrypt_qdepth_mask(char qdepth[], size_t max_adapters)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
2018-04-09 08:18:37 -06:00
|
|
|
int card;
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
memset(qdepth, 0, max_adapters);
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_lock(&zcrypt_list_lock);
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_disable();
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
2018-04-09 08:18:37 -06:00
|
|
|
card = AP_QID_CARD(zq->queue->qid);
|
|
|
|
if (AP_QID_QUEUE(zq->queue->qid) != ap_domain_index
|
|
|
|
|| card >= max_adapters)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
spin_lock(&zq->queue->lock);
|
2018-04-09 08:18:37 -06:00
|
|
|
qdepth[card] =
|
2016-08-25 03:16:03 -06:00
|
|
|
zq->queue->pendingq_count +
|
|
|
|
zq->queue->requestq_count;
|
|
|
|
spin_unlock(&zq->queue->lock);
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_enable();
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
2018-04-09 08:18:37 -06:00
|
|
|
int card;
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
memset(reqcnt, 0, sizeof(int) * max_adapters);
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_lock(&zcrypt_list_lock);
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_disable();
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
2018-04-09 08:18:37 -06:00
|
|
|
card = AP_QID_CARD(zq->queue->qid);
|
|
|
|
if (AP_QID_QUEUE(zq->queue->qid) != ap_domain_index
|
|
|
|
|| card >= max_adapters)
|
2016-08-25 03:16:03 -06:00
|
|
|
continue;
|
|
|
|
spin_lock(&zq->queue->lock);
|
2018-04-09 08:18:37 -06:00
|
|
|
reqcnt[card] = zq->queue->total_request_count;
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_unlock(&zq->queue->lock);
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_enable();
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static int zcrypt_pendingq_count(void)
|
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
|
|
|
int pendingq_count;
|
|
|
|
|
|
|
|
pendingq_count = 0;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_disable();
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
if (AP_QID_QUEUE(zq->queue->qid) != ap_domain_index)
|
|
|
|
continue;
|
|
|
|
spin_lock(&zq->queue->lock);
|
|
|
|
pendingq_count += zq->queue->pendingq_count;
|
|
|
|
spin_unlock(&zq->queue->lock);
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_enable();
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2006-09-20 07:58:27 -06:00
|
|
|
return pendingq_count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int zcrypt_requestq_count(void)
|
|
|
|
{
|
2016-08-25 03:16:03 -06:00
|
|
|
struct zcrypt_card *zc;
|
|
|
|
struct zcrypt_queue *zq;
|
|
|
|
int requestq_count;
|
|
|
|
|
|
|
|
requestq_count = 0;
|
|
|
|
spin_lock(&zcrypt_list_lock);
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_disable();
|
2016-08-25 03:16:03 -06:00
|
|
|
for_each_zcrypt_card(zc) {
|
|
|
|
for_each_zcrypt_queue(zq, zc) {
|
|
|
|
if (AP_QID_QUEUE(zq->queue->qid) != ap_domain_index)
|
|
|
|
continue;
|
|
|
|
spin_lock(&zq->queue->lock);
|
|
|
|
requestq_count += zq->queue->requestq_count;
|
|
|
|
spin_unlock(&zq->queue->lock);
|
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
2017-01-16 01:43:29 -07:00
|
|
|
local_bh_enable();
|
2016-08-25 03:16:03 -06:00
|
|
|
spin_unlock(&zcrypt_list_lock);
|
2006-09-20 07:58:27 -06:00
|
|
|
return requestq_count;
|
|
|
|
}
|
|
|
|
|
|
|
|
static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
|
|
|
|
unsigned long arg)
|
|
|
|
{
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
int rc;
|
|
|
|
struct ap_perms *perms =
|
|
|
|
(struct ap_perms *) filp->private_data;
|
|
|
|
|
|
|
|
rc = zcrypt_check_ioctl(perms, cmd);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
2006-09-20 07:58:27 -06:00
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case ICARSAMODEXPO: {
|
|
|
|
struct ica_rsa_modexpo __user *umex = (void __user *) arg;
|
|
|
|
struct ica_rsa_modexpo mex;
|
2018-08-17 04:36:01 -06:00
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
if (copy_from_user(&mex, umex, sizeof(mex)))
|
|
|
|
return -EFAULT;
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_modexpo(perms, &mex);
|
2006-09-20 07:58:27 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_modexpo(perms, &mex);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2017-05-12 10:53:41 -06:00
|
|
|
if (rc) {
|
2017-06-29 01:44:11 -06:00
|
|
|
ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSAMODEXPO rc=%d\n", rc);
|
2006-09-20 07:58:27 -06:00
|
|
|
return rc;
|
2017-05-12 10:53:41 -06:00
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
return put_user(mex.outputdatalength, &umex->outputdatalength);
|
|
|
|
}
|
|
|
|
case ICARSACRT: {
|
|
|
|
struct ica_rsa_modexpo_crt __user *ucrt = (void __user *) arg;
|
|
|
|
struct ica_rsa_modexpo_crt crt;
|
2018-08-17 04:36:01 -06:00
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
if (copy_from_user(&crt, ucrt, sizeof(crt)))
|
|
|
|
return -EFAULT;
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_crt(perms, &crt);
|
2006-09-20 07:58:27 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_crt(perms, &crt);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2017-05-12 10:53:41 -06:00
|
|
|
if (rc) {
|
2017-06-29 01:44:11 -06:00
|
|
|
ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSACRT rc=%d\n", rc);
|
2006-09-20 07:58:27 -06:00
|
|
|
return rc;
|
2017-05-12 10:53:41 -06:00
|
|
|
}
|
2006-09-20 07:58:27 -06:00
|
|
|
return put_user(crt.outputdatalength, &ucrt->outputdatalength);
|
|
|
|
}
|
2006-09-20 07:58:36 -06:00
|
|
|
case ZSECSENDCPRB: {
|
|
|
|
struct ica_xcRB __user *uxcRB = (void __user *) arg;
|
|
|
|
struct ica_xcRB xcRB;
|
2018-08-17 04:36:01 -06:00
|
|
|
|
2006-09-20 07:58:36 -06:00
|
|
|
if (copy_from_user(&xcRB, uxcRB, sizeof(xcRB)))
|
|
|
|
return -EFAULT;
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = _zcrypt_send_cprb(perms, &xcRB);
|
2006-09-20 07:58:36 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = _zcrypt_send_cprb(perms, &xcRB);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2017-05-12 10:53:41 -06:00
|
|
|
if (rc)
|
2017-06-29 01:44:11 -06:00
|
|
|
ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDCPRB rc=%d\n", rc);
|
2006-09-20 07:58:36 -06:00
|
|
|
if (copy_to_user(uxcRB, &xcRB, sizeof(xcRB)))
|
|
|
|
return -EFAULT;
|
|
|
|
return rc;
|
|
|
|
}
|
2013-11-20 02:47:13 -07:00
|
|
|
case ZSENDEP11CPRB: {
|
|
|
|
struct ep11_urb __user *uxcrb = (void __user *)arg;
|
|
|
|
struct ep11_urb xcrb;
|
2018-08-17 04:36:01 -06:00
|
|
|
|
2013-11-20 02:47:13 -07:00
|
|
|
if (copy_from_user(&xcrb, uxcrb, sizeof(xcrb)))
|
|
|
|
return -EFAULT;
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_send_ep11_cprb(perms, &xcrb);
|
2013-11-20 02:47:13 -07:00
|
|
|
} while (rc == -EAGAIN);
|
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_send_ep11_cprb(perms, &xcrb);
|
2013-11-20 02:47:13 -07:00
|
|
|
} while (rc == -EAGAIN);
|
2017-05-12 10:53:41 -06:00
|
|
|
if (rc)
|
2017-06-29 01:44:11 -06:00
|
|
|
ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDEP11CPRB rc=%d\n", rc);
|
2013-11-20 02:47:13 -07:00
|
|
|
if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
|
|
|
|
return -EFAULT;
|
|
|
|
return rc;
|
|
|
|
}
|
2018-04-09 08:18:37 -06:00
|
|
|
case ZCRYPT_DEVICE_STATUS: {
|
|
|
|
struct zcrypt_device_status_ext *device_status;
|
|
|
|
size_t total_size = MAX_ZDEV_ENTRIES_EXT
|
|
|
|
* sizeof(struct zcrypt_device_status_ext);
|
2016-08-25 03:19:58 -06:00
|
|
|
|
2018-04-09 08:18:37 -06:00
|
|
|
device_status = kzalloc(total_size, GFP_KERNEL);
|
2016-08-25 03:19:58 -06:00
|
|
|
if (!device_status)
|
|
|
|
return -ENOMEM;
|
2018-04-09 08:18:37 -06:00
|
|
|
zcrypt_device_status_mask_ext(device_status);
|
2016-08-25 03:19:58 -06:00
|
|
|
if (copy_to_user((char __user *) arg, device_status,
|
2018-04-09 08:18:37 -06:00
|
|
|
total_size))
|
|
|
|
rc = -EFAULT;
|
2016-08-25 03:19:58 -06:00
|
|
|
kfree(device_status);
|
2018-04-09 08:18:37 -06:00
|
|
|
return rc;
|
2016-08-25 03:19:58 -06:00
|
|
|
}
|
2018-04-09 08:18:37 -06:00
|
|
|
case ZCRYPT_STATUS_MASK: {
|
2006-09-20 07:58:27 -06:00
|
|
|
char status[AP_DEVICES];
|
2018-04-09 08:18:37 -06:00
|
|
|
|
|
|
|
zcrypt_status_mask(status, AP_DEVICES);
|
|
|
|
if (copy_to_user((char __user *) arg, status, sizeof(status)))
|
2006-09-20 07:58:27 -06:00
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
2018-04-09 08:18:37 -06:00
|
|
|
case ZCRYPT_QDEPTH_MASK: {
|
2006-09-20 07:58:27 -06:00
|
|
|
char qdepth[AP_DEVICES];
|
2018-04-09 08:18:37 -06:00
|
|
|
|
|
|
|
zcrypt_qdepth_mask(qdepth, AP_DEVICES);
|
|
|
|
if (copy_to_user((char __user *) arg, qdepth, sizeof(qdepth)))
|
2006-09-20 07:58:27 -06:00
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
2018-04-09 08:18:37 -06:00
|
|
|
case ZCRYPT_PERDEV_REQCNT: {
|
|
|
|
int *reqcnt;
|
|
|
|
|
|
|
|
reqcnt = kcalloc(AP_DEVICES, sizeof(int), GFP_KERNEL);
|
|
|
|
if (!reqcnt)
|
|
|
|
return -ENOMEM;
|
|
|
|
zcrypt_perdev_reqcnt(reqcnt, AP_DEVICES);
|
|
|
|
if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
|
|
|
|
rc = -EFAULT;
|
|
|
|
kfree(reqcnt);
|
|
|
|
return rc;
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
case Z90STAT_REQUESTQ_COUNT:
|
|
|
|
return put_user(zcrypt_requestq_count(), (int __user *) arg);
|
|
|
|
case Z90STAT_PENDINGQ_COUNT:
|
|
|
|
return put_user(zcrypt_pendingq_count(), (int __user *) arg);
|
|
|
|
case Z90STAT_TOTALOPEN_COUNT:
|
|
|
|
return put_user(atomic_read(&zcrypt_open_count),
|
|
|
|
(int __user *) arg);
|
|
|
|
case Z90STAT_DOMAIN_INDEX:
|
|
|
|
return put_user(ap_domain_index, (int __user *) arg);
|
2018-04-09 08:18:37 -06:00
|
|
|
/*
|
|
|
|
* Deprecated ioctls
|
|
|
|
*/
|
|
|
|
case ZDEVICESTATUS: {
|
|
|
|
/* the old ioctl supports only 64 adapters */
|
|
|
|
struct zcrypt_device_status *device_status;
|
|
|
|
size_t total_size = MAX_ZDEV_ENTRIES
|
|
|
|
* sizeof(struct zcrypt_device_status);
|
|
|
|
|
|
|
|
device_status = kzalloc(total_size, GFP_KERNEL);
|
|
|
|
if (!device_status)
|
|
|
|
return -ENOMEM;
|
|
|
|
zcrypt_device_status_mask(device_status);
|
|
|
|
if (copy_to_user((char __user *) arg, device_status,
|
|
|
|
total_size))
|
|
|
|
rc = -EFAULT;
|
|
|
|
kfree(device_status);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
case Z90STAT_STATUS_MASK: {
|
|
|
|
/* the old ioctl supports only 64 adapters */
|
|
|
|
char status[MAX_ZDEV_CARDIDS];
|
|
|
|
|
|
|
|
zcrypt_status_mask(status, MAX_ZDEV_CARDIDS);
|
|
|
|
if (copy_to_user((char __user *) arg, status, sizeof(status)))
|
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
case Z90STAT_QDEPTH_MASK: {
|
|
|
|
/* the old ioctl supports only 64 adapters */
|
|
|
|
char qdepth[MAX_ZDEV_CARDIDS];
|
|
|
|
|
|
|
|
zcrypt_qdepth_mask(qdepth, MAX_ZDEV_CARDIDS);
|
|
|
|
if (copy_to_user((char __user *) arg, qdepth, sizeof(qdepth)))
|
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
case Z90STAT_PERDEV_REQCNT: {
|
|
|
|
/* the old ioctl supports only 64 adapters */
|
|
|
|
int reqcnt[MAX_ZDEV_CARDIDS];
|
|
|
|
|
|
|
|
zcrypt_perdev_reqcnt(reqcnt, MAX_ZDEV_CARDIDS);
|
|
|
|
if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
|
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
2018-04-04 05:25:40 -06:00
|
|
|
/* unknown ioctl number */
|
2006-09-20 07:58:27 -06:00
|
|
|
default:
|
2018-04-09 08:18:37 -06:00
|
|
|
ZCRYPT_DBF(DBF_DEBUG, "unknown ioctl 0x%08x\n", cmd);
|
2006-09-20 07:58:27 -06:00
|
|
|
return -ENOIOCTLCMD;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef CONFIG_COMPAT
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* ioctl32 conversion routines
|
|
|
|
*/
|
|
|
|
struct compat_ica_rsa_modexpo {
|
|
|
|
compat_uptr_t inputdata;
|
|
|
|
unsigned int inputdatalength;
|
|
|
|
compat_uptr_t outputdata;
|
|
|
|
unsigned int outputdatalength;
|
|
|
|
compat_uptr_t b_key;
|
|
|
|
compat_uptr_t n_modulus;
|
|
|
|
};
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long trans_modexpo32(struct ap_perms *perms, struct file *filp,
|
|
|
|
unsigned int cmd, unsigned long arg)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
|
|
|
struct compat_ica_rsa_modexpo __user *umex32 = compat_ptr(arg);
|
|
|
|
struct compat_ica_rsa_modexpo mex32;
|
|
|
|
struct ica_rsa_modexpo mex64;
|
|
|
|
long rc;
|
|
|
|
|
|
|
|
if (copy_from_user(&mex32, umex32, sizeof(mex32)))
|
|
|
|
return -EFAULT;
|
|
|
|
mex64.inputdata = compat_ptr(mex32.inputdata);
|
|
|
|
mex64.inputdatalength = mex32.inputdatalength;
|
|
|
|
mex64.outputdata = compat_ptr(mex32.outputdata);
|
|
|
|
mex64.outputdatalength = mex32.outputdatalength;
|
|
|
|
mex64.b_key = compat_ptr(mex32.b_key);
|
|
|
|
mex64.n_modulus = compat_ptr(mex32.n_modulus);
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_modexpo(perms, &mex64);
|
2006-09-20 07:58:27 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_modexpo(perms, &mex64);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
return put_user(mex64.outputdatalength,
|
|
|
|
&umex32->outputdatalength);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
struct compat_ica_rsa_modexpo_crt {
|
|
|
|
compat_uptr_t inputdata;
|
|
|
|
unsigned int inputdatalength;
|
|
|
|
compat_uptr_t outputdata;
|
|
|
|
unsigned int outputdatalength;
|
|
|
|
compat_uptr_t bp_key;
|
|
|
|
compat_uptr_t bq_key;
|
|
|
|
compat_uptr_t np_prime;
|
|
|
|
compat_uptr_t nq_prime;
|
|
|
|
compat_uptr_t u_mult_inv;
|
|
|
|
};
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long trans_modexpo_crt32(struct ap_perms *perms, struct file *filp,
|
|
|
|
unsigned int cmd, unsigned long arg)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
|
|
|
struct compat_ica_rsa_modexpo_crt __user *ucrt32 = compat_ptr(arg);
|
|
|
|
struct compat_ica_rsa_modexpo_crt crt32;
|
|
|
|
struct ica_rsa_modexpo_crt crt64;
|
|
|
|
long rc;
|
|
|
|
|
|
|
|
if (copy_from_user(&crt32, ucrt32, sizeof(crt32)))
|
|
|
|
return -EFAULT;
|
|
|
|
crt64.inputdata = compat_ptr(crt32.inputdata);
|
|
|
|
crt64.inputdatalength = crt32.inputdatalength;
|
2018-08-17 04:36:01 -06:00
|
|
|
crt64.outputdata = compat_ptr(crt32.outputdata);
|
2006-09-20 07:58:27 -06:00
|
|
|
crt64.outputdatalength = crt32.outputdatalength;
|
|
|
|
crt64.bp_key = compat_ptr(crt32.bp_key);
|
|
|
|
crt64.bq_key = compat_ptr(crt32.bq_key);
|
|
|
|
crt64.np_prime = compat_ptr(crt32.np_prime);
|
|
|
|
crt64.nq_prime = compat_ptr(crt32.nq_prime);
|
|
|
|
crt64.u_mult_inv = compat_ptr(crt32.u_mult_inv);
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_crt(perms, &crt64);
|
2006-09-20 07:58:27 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = zcrypt_rsa_crt(perms, &crt64);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
return put_user(crt64.outputdatalength,
|
|
|
|
&ucrt32->outputdatalength);
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
2006-09-20 07:58:36 -06:00
|
|
|
struct compat_ica_xcRB {
|
|
|
|
unsigned short agent_ID;
|
|
|
|
unsigned int user_defined;
|
|
|
|
unsigned short request_ID;
|
|
|
|
unsigned int request_control_blk_length;
|
2018-08-17 04:36:01 -06:00
|
|
|
unsigned char padding1[16 - sizeof(compat_uptr_t)];
|
2006-09-20 07:58:36 -06:00
|
|
|
compat_uptr_t request_control_blk_addr;
|
|
|
|
unsigned int request_data_length;
|
2018-08-17 04:36:01 -06:00
|
|
|
char padding2[16 - sizeof(compat_uptr_t)];
|
2006-09-20 07:58:36 -06:00
|
|
|
compat_uptr_t request_data_address;
|
|
|
|
unsigned int reply_control_blk_length;
|
2018-08-17 04:36:01 -06:00
|
|
|
char padding3[16 - sizeof(compat_uptr_t)];
|
2006-09-20 07:58:36 -06:00
|
|
|
compat_uptr_t reply_control_blk_addr;
|
|
|
|
unsigned int reply_data_length;
|
2018-08-17 04:36:01 -06:00
|
|
|
char padding4[16 - sizeof(compat_uptr_t)];
|
2006-09-20 07:58:36 -06:00
|
|
|
compat_uptr_t reply_data_addr;
|
|
|
|
unsigned short priority_window;
|
|
|
|
unsigned int status;
|
2018-08-17 04:36:01 -06:00
|
|
|
} __packed;
|
2006-09-20 07:58:36 -06:00
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
static long trans_xcRB32(struct ap_perms *perms, struct file *filp,
|
|
|
|
unsigned int cmd, unsigned long arg)
|
2006-09-20 07:58:36 -06:00
|
|
|
{
|
|
|
|
struct compat_ica_xcRB __user *uxcRB32 = compat_ptr(arg);
|
|
|
|
struct compat_ica_xcRB xcRB32;
|
|
|
|
struct ica_xcRB xcRB64;
|
|
|
|
long rc;
|
|
|
|
|
|
|
|
if (copy_from_user(&xcRB32, uxcRB32, sizeof(xcRB32)))
|
|
|
|
return -EFAULT;
|
|
|
|
xcRB64.agent_ID = xcRB32.agent_ID;
|
|
|
|
xcRB64.user_defined = xcRB32.user_defined;
|
|
|
|
xcRB64.request_ID = xcRB32.request_ID;
|
|
|
|
xcRB64.request_control_blk_length =
|
|
|
|
xcRB32.request_control_blk_length;
|
|
|
|
xcRB64.request_control_blk_addr =
|
|
|
|
compat_ptr(xcRB32.request_control_blk_addr);
|
|
|
|
xcRB64.request_data_length =
|
|
|
|
xcRB32.request_data_length;
|
|
|
|
xcRB64.request_data_address =
|
|
|
|
compat_ptr(xcRB32.request_data_address);
|
|
|
|
xcRB64.reply_control_blk_length =
|
|
|
|
xcRB32.reply_control_blk_length;
|
|
|
|
xcRB64.reply_control_blk_addr =
|
|
|
|
compat_ptr(xcRB32.reply_control_blk_addr);
|
|
|
|
xcRB64.reply_data_length = xcRB32.reply_data_length;
|
|
|
|
xcRB64.reply_data_addr =
|
|
|
|
compat_ptr(xcRB32.reply_data_addr);
|
|
|
|
xcRB64.priority_window = xcRB32.priority_window;
|
|
|
|
xcRB64.status = xcRB32.status;
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = _zcrypt_send_cprb(perms, &xcRB64);
|
2006-09-20 07:58:36 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
do {
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
rc = _zcrypt_send_cprb(perms, &xcRB64);
|
2012-09-10 13:34:26 -06:00
|
|
|
} while (rc == -EAGAIN);
|
2006-09-20 07:58:36 -06:00
|
|
|
xcRB32.reply_control_blk_length = xcRB64.reply_control_blk_length;
|
|
|
|
xcRB32.reply_data_length = xcRB64.reply_data_length;
|
|
|
|
xcRB32.status = xcRB64.status;
|
|
|
|
if (copy_to_user(uxcRB32, &xcRB32, sizeof(xcRB32)))
|
2018-08-17 04:36:01 -06:00
|
|
|
return -EFAULT;
|
2006-09-20 07:58:36 -06:00
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2007-02-05 13:16:47 -07:00
|
|
|
static long zcrypt_compat_ioctl(struct file *filp, unsigned int cmd,
|
2006-09-20 07:58:27 -06:00
|
|
|
unsigned long arg)
|
|
|
|
{
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
int rc;
|
|
|
|
struct ap_perms *perms =
|
|
|
|
(struct ap_perms *) filp->private_data;
|
|
|
|
|
|
|
|
rc = zcrypt_check_ioctl(perms, cmd);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
if (cmd == ICARSAMODEXPO)
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
return trans_modexpo32(perms, filp, cmd, arg);
|
2006-09-20 07:58:27 -06:00
|
|
|
if (cmd == ICARSACRT)
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
return trans_modexpo_crt32(perms, filp, cmd, arg);
|
2006-09-20 07:58:36 -06:00
|
|
|
if (cmd == ZSECSENDCPRB)
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
return trans_xcRB32(perms, filp, cmd, arg);
|
2006-09-20 07:58:27 -06:00
|
|
|
return zcrypt_unlocked_ioctl(filp, cmd, arg);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* Misc device file operations.
|
|
|
|
*/
|
2007-02-12 01:55:34 -07:00
|
|
|
static const struct file_operations zcrypt_fops = {
|
2006-09-20 07:58:27 -06:00
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.read = zcrypt_read,
|
|
|
|
.write = zcrypt_write,
|
|
|
|
.unlocked_ioctl = zcrypt_unlocked_ioctl,
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
|
|
.compat_ioctl = zcrypt_compat_ioctl,
|
|
|
|
#endif
|
|
|
|
.open = zcrypt_open,
|
llseek: automatically add .llseek fop
All file_operations should get a .llseek operation so we can make
nonseekable_open the default for future file operations without a
.llseek pointer.
The three cases that we can automatically detect are no_llseek, seq_lseek
and default_llseek. For cases where we can we can automatically prove that
the file offset is always ignored, we use noop_llseek, which maintains
the current behavior of not returning an error from a seek.
New drivers should normally not use noop_llseek but instead use no_llseek
and call nonseekable_open at open time. Existing drivers can be converted
to do the same when the maintainer knows for certain that no user code
relies on calling seek on the device file.
The generated code is often incorrectly indented and right now contains
comments that clarify for each added line why a specific variant was
chosen. In the version that gets submitted upstream, the comments will
be gone and I will manually fix the indentation, because there does not
seem to be a way to do that using coccinelle.
Some amount of new code is currently sitting in linux-next that should get
the same modifications, which I will do at the end of the merge window.
Many thanks to Julia Lawall for helping me learn to write a semantic
patch that does all this.
===== begin semantic patch =====
// This adds an llseek= method to all file operations,
// as a preparation for making no_llseek the default.
//
// The rules are
// - use no_llseek explicitly if we do nonseekable_open
// - use seq_lseek for sequential files
// - use default_llseek if we know we access f_pos
// - use noop_llseek if we know we don't access f_pos,
// but we still want to allow users to call lseek
//
@ open1 exists @
identifier nested_open;
@@
nested_open(...)
{
<+...
nonseekable_open(...)
...+>
}
@ open exists@
identifier open_f;
identifier i, f;
identifier open1.nested_open;
@@
int open_f(struct inode *i, struct file *f)
{
<+...
(
nonseekable_open(...)
|
nested_open(...)
)
...+>
}
@ read disable optional_qualifier exists @
identifier read_f;
identifier f, p, s, off;
type ssize_t, size_t, loff_t;
expression E;
identifier func;
@@
ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
{
<+...
(
*off = E
|
*off += E
|
func(..., off, ...)
|
E = *off
)
...+>
}
@ read_no_fpos disable optional_qualifier exists @
identifier read_f;
identifier f, p, s, off;
type ssize_t, size_t, loff_t;
@@
ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
{
... when != off
}
@ write @
identifier write_f;
identifier f, p, s, off;
type ssize_t, size_t, loff_t;
expression E;
identifier func;
@@
ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
{
<+...
(
*off = E
|
*off += E
|
func(..., off, ...)
|
E = *off
)
...+>
}
@ write_no_fpos @
identifier write_f;
identifier f, p, s, off;
type ssize_t, size_t, loff_t;
@@
ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
{
... when != off
}
@ fops0 @
identifier fops;
@@
struct file_operations fops = {
...
};
@ has_llseek depends on fops0 @
identifier fops0.fops;
identifier llseek_f;
@@
struct file_operations fops = {
...
.llseek = llseek_f,
...
};
@ has_read depends on fops0 @
identifier fops0.fops;
identifier read_f;
@@
struct file_operations fops = {
...
.read = read_f,
...
};
@ has_write depends on fops0 @
identifier fops0.fops;
identifier write_f;
@@
struct file_operations fops = {
...
.write = write_f,
...
};
@ has_open depends on fops0 @
identifier fops0.fops;
identifier open_f;
@@
struct file_operations fops = {
...
.open = open_f,
...
};
// use no_llseek if we call nonseekable_open
////////////////////////////////////////////
@ nonseekable1 depends on !has_llseek && has_open @
identifier fops0.fops;
identifier nso ~= "nonseekable_open";
@@
struct file_operations fops = {
... .open = nso, ...
+.llseek = no_llseek, /* nonseekable */
};
@ nonseekable2 depends on !has_llseek @
identifier fops0.fops;
identifier open.open_f;
@@
struct file_operations fops = {
... .open = open_f, ...
+.llseek = no_llseek, /* open uses nonseekable */
};
// use seq_lseek for sequential files
/////////////////////////////////////
@ seq depends on !has_llseek @
identifier fops0.fops;
identifier sr ~= "seq_read";
@@
struct file_operations fops = {
... .read = sr, ...
+.llseek = seq_lseek, /* we have seq_read */
};
// use default_llseek if there is a readdir
///////////////////////////////////////////
@ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier readdir_e;
@@
// any other fop is used that changes pos
struct file_operations fops = {
... .readdir = readdir_e, ...
+.llseek = default_llseek, /* readdir is present */
};
// use default_llseek if at least one of read/write touches f_pos
/////////////////////////////////////////////////////////////////
@ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier read.read_f;
@@
// read fops use offset
struct file_operations fops = {
... .read = read_f, ...
+.llseek = default_llseek, /* read accesses f_pos */
};
@ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier write.write_f;
@@
// write fops use offset
struct file_operations fops = {
... .write = write_f, ...
+ .llseek = default_llseek, /* write accesses f_pos */
};
// Use noop_llseek if neither read nor write accesses f_pos
///////////////////////////////////////////////////////////
@ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier read_no_fpos.read_f;
identifier write_no_fpos.write_f;
@@
// write fops use offset
struct file_operations fops = {
...
.write = write_f,
.read = read_f,
...
+.llseek = noop_llseek, /* read and write both use no f_pos */
};
@ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier write_no_fpos.write_f;
@@
struct file_operations fops = {
... .write = write_f, ...
+.llseek = noop_llseek, /* write uses no f_pos */
};
@ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
identifier read_no_fpos.read_f;
@@
struct file_operations fops = {
... .read = read_f, ...
+.llseek = noop_llseek, /* read uses no f_pos */
};
@ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
identifier fops0.fops;
@@
struct file_operations fops = {
...
+.llseek = noop_llseek, /* no read or write fn */
};
===== End semantic patch =====
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Julia Lawall <julia@diku.dk>
Cc: Christoph Hellwig <hch@infradead.org>
2010-08-15 10:52:59 -06:00
|
|
|
.release = zcrypt_release,
|
|
|
|
.llseek = no_llseek,
|
2006-09-20 07:58:27 -06:00
|
|
|
};
|
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2006-09-20 07:58:27 -06:00
|
|
|
* Misc device.
|
|
|
|
*/
|
|
|
|
static struct miscdevice zcrypt_misc_device = {
|
|
|
|
.minor = MISC_DYNAMIC_MINOR,
|
|
|
|
.name = "z90crypt",
|
|
|
|
.fops = &zcrypt_fops,
|
|
|
|
};
|
|
|
|
|
2008-04-16 23:46:15 -06:00
|
|
|
static int zcrypt_rng_device_count;
|
|
|
|
static u32 *zcrypt_rng_buffer;
|
|
|
|
static int zcrypt_rng_buffer_index;
|
|
|
|
static DEFINE_MUTEX(zcrypt_rng_mutex);
|
|
|
|
|
|
|
|
static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
2008-04-16 23:46:28 -06:00
|
|
|
/*
|
2008-04-16 23:46:15 -06:00
|
|
|
* We don't need locking here because the RNG API guarantees serialized
|
|
|
|
* read method calls.
|
|
|
|
*/
|
|
|
|
if (zcrypt_rng_buffer_index == 0) {
|
|
|
|
rc = zcrypt_rng((char *) zcrypt_rng_buffer);
|
2012-09-10 13:34:26 -06:00
|
|
|
/* on failure: retry once again after a requested rescan */
|
|
|
|
if ((rc == -ENODEV) && (zcrypt_process_rescan()))
|
|
|
|
rc = zcrypt_rng((char *) zcrypt_rng_buffer);
|
2008-04-16 23:46:15 -06:00
|
|
|
if (rc < 0)
|
|
|
|
return -EIO;
|
2018-08-17 04:36:01 -06:00
|
|
|
zcrypt_rng_buffer_index = rc / sizeof(*data);
|
2008-04-16 23:46:15 -06:00
|
|
|
}
|
|
|
|
*data = zcrypt_rng_buffer[--zcrypt_rng_buffer_index];
|
2018-08-17 04:36:01 -06:00
|
|
|
return sizeof(*data);
|
2008-04-16 23:46:15 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static struct hwrng zcrypt_rng_dev = {
|
|
|
|
.name = "zcrypt",
|
|
|
|
.data_read = zcrypt_rng_data_read,
|
2015-03-17 09:02:20 -06:00
|
|
|
.quality = 990,
|
2008-04-16 23:46:15 -06:00
|
|
|
};
|
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
int zcrypt_rng_device_add(void)
|
2008-04-16 23:46:15 -06:00
|
|
|
{
|
|
|
|
int rc = 0;
|
|
|
|
|
|
|
|
mutex_lock(&zcrypt_rng_mutex);
|
|
|
|
if (zcrypt_rng_device_count == 0) {
|
|
|
|
zcrypt_rng_buffer = (u32 *) get_zeroed_page(GFP_KERNEL);
|
|
|
|
if (!zcrypt_rng_buffer) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
zcrypt_rng_buffer_index = 0;
|
2015-03-17 09:02:20 -06:00
|
|
|
if (!zcrypt_hwrng_seed)
|
|
|
|
zcrypt_rng_dev.quality = 0;
|
2008-04-16 23:46:15 -06:00
|
|
|
rc = hwrng_register(&zcrypt_rng_dev);
|
|
|
|
if (rc)
|
|
|
|
goto out_free;
|
|
|
|
zcrypt_rng_device_count = 1;
|
|
|
|
} else
|
|
|
|
zcrypt_rng_device_count++;
|
|
|
|
mutex_unlock(&zcrypt_rng_mutex);
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
out_free:
|
|
|
|
free_page((unsigned long) zcrypt_rng_buffer);
|
|
|
|
out:
|
|
|
|
mutex_unlock(&zcrypt_rng_mutex);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2016-08-25 03:16:03 -06:00
|
|
|
void zcrypt_rng_device_remove(void)
|
2008-04-16 23:46:15 -06:00
|
|
|
{
|
|
|
|
mutex_lock(&zcrypt_rng_mutex);
|
|
|
|
zcrypt_rng_device_count--;
|
|
|
|
if (zcrypt_rng_device_count == 0) {
|
|
|
|
hwrng_unregister(&zcrypt_rng_dev);
|
|
|
|
free_page((unsigned long) zcrypt_rng_buffer);
|
|
|
|
}
|
|
|
|
mutex_unlock(&zcrypt_rng_mutex);
|
|
|
|
}
|
|
|
|
|
2012-09-10 13:34:26 -06:00
|
|
|
int __init zcrypt_debug_init(void)
|
|
|
|
{
|
2016-11-23 22:45:21 -07:00
|
|
|
zcrypt_dbf_info = debug_register("zcrypt", 1, 1,
|
|
|
|
DBF_MAX_SPRINTF_ARGS * sizeof(long));
|
|
|
|
debug_register_view(zcrypt_dbf_info, &debug_sprintf_view);
|
|
|
|
debug_set_level(zcrypt_dbf_info, DBF_ERR);
|
2016-08-25 03:16:03 -06:00
|
|
|
|
2012-09-10 13:34:26 -06:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
void zcrypt_debug_exit(void)
|
|
|
|
{
|
2016-11-23 22:45:21 -07:00
|
|
|
debug_unregister(zcrypt_dbf_info);
|
2012-09-10 13:34:26 -06:00
|
|
|
}
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
|
|
|
|
static int __init zcdn_init(void)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
/* create a new class 'zcrypt' */
|
|
|
|
zcrypt_class = class_create(THIS_MODULE, ZCRYPT_NAME);
|
|
|
|
if (IS_ERR(zcrypt_class)) {
|
|
|
|
rc = PTR_ERR(zcrypt_class);
|
|
|
|
goto out_class_create_failed;
|
|
|
|
}
|
|
|
|
zcrypt_class->dev_release = zcdn_device_release;
|
|
|
|
|
|
|
|
/* alloc device minor range */
|
|
|
|
rc = alloc_chrdev_region(&zcrypt_devt,
|
|
|
|
0, ZCRYPT_MAX_MINOR_NODES,
|
|
|
|
ZCRYPT_NAME);
|
|
|
|
if (rc)
|
|
|
|
goto out_alloc_chrdev_failed;
|
|
|
|
|
|
|
|
cdev_init(&zcrypt_cdev, &zcrypt_fops);
|
|
|
|
zcrypt_cdev.owner = THIS_MODULE;
|
|
|
|
rc = cdev_add(&zcrypt_cdev, zcrypt_devt, ZCRYPT_MAX_MINOR_NODES);
|
|
|
|
if (rc)
|
|
|
|
goto out_cdev_add_failed;
|
|
|
|
|
|
|
|
/* need some class specific sysfs attributes */
|
|
|
|
rc = class_create_file(zcrypt_class, &class_attr_zcdn_create);
|
|
|
|
if (rc)
|
|
|
|
goto out_class_create_file_1_failed;
|
|
|
|
rc = class_create_file(zcrypt_class, &class_attr_zcdn_destroy);
|
|
|
|
if (rc)
|
|
|
|
goto out_class_create_file_2_failed;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
out_class_create_file_2_failed:
|
|
|
|
class_remove_file(zcrypt_class, &class_attr_zcdn_create);
|
|
|
|
out_class_create_file_1_failed:
|
|
|
|
cdev_del(&zcrypt_cdev);
|
|
|
|
out_cdev_add_failed:
|
|
|
|
unregister_chrdev_region(zcrypt_devt, ZCRYPT_MAX_MINOR_NODES);
|
|
|
|
out_alloc_chrdev_failed:
|
|
|
|
class_destroy(zcrypt_class);
|
|
|
|
out_class_create_failed:
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void zcdn_exit(void)
|
|
|
|
{
|
|
|
|
class_remove_file(zcrypt_class, &class_attr_zcdn_create);
|
|
|
|
class_remove_file(zcrypt_class, &class_attr_zcdn_destroy);
|
|
|
|
zcdn_destroy_all();
|
|
|
|
cdev_del(&zcrypt_cdev);
|
|
|
|
unregister_chrdev_region(zcrypt_devt, ZCRYPT_MAX_MINOR_NODES);
|
|
|
|
class_destroy(zcrypt_class);
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
/**
|
2008-04-16 23:46:28 -06:00
|
|
|
* zcrypt_api_init(): Module initialization.
|
|
|
|
*
|
2006-09-20 07:58:27 -06:00
|
|
|
* The module initialization code.
|
|
|
|
*/
|
|
|
|
int __init zcrypt_api_init(void)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
2012-09-10 13:34:26 -06:00
|
|
|
rc = zcrypt_debug_init();
|
|
|
|
if (rc)
|
|
|
|
goto out;
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
rc = zcdn_init();
|
|
|
|
if (rc)
|
|
|
|
goto out;
|
|
|
|
#endif
|
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
/* Register the request sprayer. */
|
|
|
|
rc = misc_register(&zcrypt_misc_device);
|
2008-07-14 01:59:27 -06:00
|
|
|
if (rc < 0)
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
goto out_misc_register_failed;
|
2006-09-20 07:58:27 -06:00
|
|
|
|
2016-08-25 03:11:30 -06:00
|
|
|
zcrypt_msgtype6_init();
|
|
|
|
zcrypt_msgtype50_init();
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
|
2006-09-20 07:58:27 -06:00
|
|
|
return 0;
|
|
|
|
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
out_misc_register_failed:
|
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
zcdn_exit();
|
|
|
|
#endif
|
|
|
|
zcrypt_debug_exit();
|
2006-09-20 07:58:27 -06:00
|
|
|
out:
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2008-04-16 23:46:28 -06:00
|
|
|
* zcrypt_api_exit(): Module termination.
|
|
|
|
*
|
2006-09-20 07:58:27 -06:00
|
|
|
* The module termination code.
|
|
|
|
*/
|
2016-08-25 03:11:30 -06:00
|
|
|
void __exit zcrypt_api_exit(void)
|
2006-09-20 07:58:27 -06:00
|
|
|
{
|
s390/zcrypt: multiple zcrypt device nodes support
This patch is an extension to the zcrypt device driver to provide,
support and maintain multiple zcrypt device nodes. The individual
zcrypt device nodes can be restricted in terms of crypto cards,
domains and available ioctls. Such a device node can be used as a
base for container solutions like docker to control and restrict
the access to crypto resources.
The handling is done with a new sysfs subdir /sys/class/zcrypt.
Echoing a name (or an empty sting) into the attribute "create" creates
a new zcrypt device node. In /sys/class/zcrypt a new link will appear
which points to the sysfs device tree of this new device. The
attribute files "ioctlmask", "apmask" and "aqmask" in this directory
are used to customize this new zcrypt device node instance. Finally
the zcrypt device node can be destroyed by echoing the name into
/sys/class/zcrypt/destroy. The internal structs holding the device
info are reference counted - so a destroy will not hard remove a
device but only marks it as removable when the reference counter drops
to zero.
The mask values are bitmaps in big endian order starting with bit 0.
So adapter number 0 is the leftmost bit, mask is 0x8000... The sysfs
attributes accept 2 different formats:
* Absolute hex string starting with 0x like "0x12345678" does set
the mask starting from left to right. If the given string is shorter
than the mask it is padded with 0s on the right. If the string is
longer than the mask an error comes back (EINVAL).
* Relative format - a concatenation (done with ',') of the
terms +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]. <bitnr> may be any
valid number (hex, decimal or octal) in the range 0...255. Here are
some examples:
"+0-15,+32,-128,-0xFF"
"-0-255,+1-16,+0x128"
"+1,+2,+3,+4,-5,-7-10"
A simple usage examples:
# create new zcrypt device 'my_zcrypt':
echo "my_zcrypt" >/sys/class/zcrypt/create
# go into the device dir of this new device
echo "my_zcrypt" >create
cd my_zcrypt/
ls -l
total 0
-rw-r--r-- 1 root root 4096 Jul 20 15:23 apmask
-rw-r--r-- 1 root root 4096 Jul 20 15:23 aqmask
-r--r--r-- 1 root root 4096 Jul 20 15:23 dev
-rw-r--r-- 1 root root 4096 Jul 20 15:23 ioctlmask
lrwxrwxrwx 1 root root 0 Jul 20 15:23 subsystem -> ../../../../class/zcrypt
...
# customize this zcrypt node clone
# enable only adapter 0 and 2
echo "0xa0" >apmask
# enable only domain 6
echo "+6" >aqmask
# enable all 256 ioctls
echo "+0-255" >ioctls
# now the /dev/my_zcrypt may be used
# finally destroy it
echo "my_zcrypt" >/sys/class/zcrypt/destroy
Please note that a very similar 'filtering behavior' also applies to
the parent z90crypt device. The two mask attributes apmask and aqmask
in /sys/bus/ap act the very same for the z90crypt device node. However
the implementation here is totally different as the ap bus acts on
bind/unbind of queue devices and associated drivers but the effect is
still the same. So there are two filters active for each additional
zcrypt device node: The adapter/domain needs to be enabled on the ap
bus level and it needs to be active on the zcrypt device node level.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-09-17 08:18:41 -06:00
|
|
|
#ifdef CONFIG_ZCRYPT_MULTIDEVNODES
|
|
|
|
zcdn_exit();
|
|
|
|
#endif
|
2006-09-20 07:58:27 -06:00
|
|
|
misc_deregister(&zcrypt_misc_device);
|
2016-08-25 03:11:30 -06:00
|
|
|
zcrypt_msgtype6_exit();
|
|
|
|
zcrypt_msgtype50_exit();
|
2016-11-23 22:45:21 -07:00
|
|
|
zcrypt_debug_exit();
|
2006-09-20 07:58:27 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
module_init(zcrypt_api_init);
|
|
|
|
module_exit(zcrypt_api_exit);
|