drivers/crypto/dpaa2_sec/hw/rta/protocol_cmd.h

   1 /*
   2  * Copyright 2008-2016 Freescale Semiconductor, Inc.
   3  *
   4  * SPDX-License-Identifier: BSD-3-Clause or GPL-2.0+
   5  */
   6
   7 #ifndef __RTA_PROTOCOL_CMD_H__
   8 #define __RTA_PROTOCOL_CMD_H__
   9
  10 extern enum rta_sec_era rta_sec_era;
  11
  12 static inline int
  13 __rta_ssl_proto(uint16_t protoinfo)
  14 {
  15         switch (protoinfo) {
  16         case OP_PCL_SSL30_RC4_40_MD5_2:
  17         case OP_PCL_SSL30_RC4_128_MD5_2:
  18         case OP_PCL_SSL30_RC4_128_SHA_5:
  19         case OP_PCL_SSL30_RC4_40_MD5_3:
  20         case OP_PCL_SSL30_RC4_128_MD5_3:
  21         case OP_PCL_SSL30_RC4_128_SHA:
  22         case OP_PCL_SSL30_RC4_128_MD5:
  23         case OP_PCL_SSL30_RC4_40_SHA:
  24         case OP_PCL_SSL30_RC4_40_MD5:
  25         case OP_PCL_SSL30_RC4_128_SHA_2:
  26         case OP_PCL_SSL30_RC4_128_SHA_3:
  27         case OP_PCL_SSL30_RC4_128_SHA_4:
  28         case OP_PCL_SSL30_RC4_128_SHA_6:
  29         case OP_PCL_SSL30_RC4_128_SHA_7:
  30         case OP_PCL_SSL30_RC4_128_SHA_8:
  31         case OP_PCL_SSL30_RC4_128_SHA_9:
  32         case OP_PCL_SSL30_RC4_128_SHA_10:
  33         case OP_PCL_TLS_ECDHE_PSK_RC4_128_SHA:
  34                 if (rta_sec_era == RTA_SEC_ERA_7)
  35                         return -EINVAL;
  36                 /* fall through if not Era 7 */
  37         case OP_PCL_SSL30_DES40_CBC_SHA:
  38         case OP_PCL_SSL30_DES_CBC_SHA_2:
  39         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_5:
  40         case OP_PCL_SSL30_DES40_CBC_SHA_2:
  41         case OP_PCL_SSL30_DES_CBC_SHA_3:
  42         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_6:
  43         case OP_PCL_SSL30_DES40_CBC_SHA_3:
  44         case OP_PCL_SSL30_DES_CBC_SHA_4:
  45         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_7:
  46         case OP_PCL_SSL30_DES40_CBC_SHA_4:
  47         case OP_PCL_SSL30_DES_CBC_SHA_5:
  48         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_8:
  49         case OP_PCL_SSL30_DES40_CBC_SHA_5:
  50         case OP_PCL_SSL30_DES_CBC_SHA_6:
  51         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_9:
  52         case OP_PCL_SSL30_DES40_CBC_SHA_6:
  53         case OP_PCL_SSL30_DES_CBC_SHA_7:
  54         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_10:
  55         case OP_PCL_SSL30_DES_CBC_SHA:
  56         case OP_PCL_SSL30_3DES_EDE_CBC_SHA:
  57         case OP_PCL_SSL30_DES_CBC_MD5:
  58         case OP_PCL_SSL30_3DES_EDE_CBC_MD5:
  59         case OP_PCL_SSL30_DES40_CBC_SHA_7:
  60         case OP_PCL_SSL30_DES40_CBC_MD5:
  61         case OP_PCL_SSL30_AES_128_CBC_SHA:
  62         case OP_PCL_SSL30_AES_128_CBC_SHA_2:
  63         case OP_PCL_SSL30_AES_128_CBC_SHA_3:
  64         case OP_PCL_SSL30_AES_128_CBC_SHA_4:
  65         case OP_PCL_SSL30_AES_128_CBC_SHA_5:
  66         case OP_PCL_SSL30_AES_128_CBC_SHA_6:
  67         case OP_PCL_SSL30_AES_256_CBC_SHA:
  68         case OP_PCL_SSL30_AES_256_CBC_SHA_2:
  69         case OP_PCL_SSL30_AES_256_CBC_SHA_3:
  70         case OP_PCL_SSL30_AES_256_CBC_SHA_4:
  71         case OP_PCL_SSL30_AES_256_CBC_SHA_5:
  72         case OP_PCL_SSL30_AES_256_CBC_SHA_6:
  73         case OP_PCL_TLS12_AES_128_CBC_SHA256_2:
  74         case OP_PCL_TLS12_AES_128_CBC_SHA256_3:
  75         case OP_PCL_TLS12_AES_128_CBC_SHA256_4:
  76         case OP_PCL_TLS12_AES_128_CBC_SHA256_5:
  77         case OP_PCL_TLS12_AES_256_CBC_SHA256_2:
  78         case OP_PCL_TLS12_AES_256_CBC_SHA256_3:
  79         case OP_PCL_TLS12_AES_256_CBC_SHA256_4:
  80         case OP_PCL_TLS12_AES_256_CBC_SHA256_5:
  81         case OP_PCL_TLS12_AES_128_CBC_SHA256_6:
  82         case OP_PCL_TLS12_AES_256_CBC_SHA256_6:
  83         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_2:
  84         case OP_PCL_SSL30_AES_128_CBC_SHA_7:
  85         case OP_PCL_SSL30_AES_256_CBC_SHA_7:
  86         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_3:
  87         case OP_PCL_SSL30_AES_128_CBC_SHA_8:
  88         case OP_PCL_SSL30_AES_256_CBC_SHA_8:
  89         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_4:
  90         case OP_PCL_SSL30_AES_128_CBC_SHA_9:
  91         case OP_PCL_SSL30_AES_256_CBC_SHA_9:
  92         case OP_PCL_SSL30_AES_128_GCM_SHA256_1:
  93         case OP_PCL_SSL30_AES_256_GCM_SHA384_1:
  94         case OP_PCL_SSL30_AES_128_GCM_SHA256_2:
  95         case OP_PCL_SSL30_AES_256_GCM_SHA384_2:
  96         case OP_PCL_SSL30_AES_128_GCM_SHA256_3:
  97         case OP_PCL_SSL30_AES_256_GCM_SHA384_3:
  98         case OP_PCL_SSL30_AES_128_GCM_SHA256_4:
  99         case OP_PCL_SSL30_AES_256_GCM_SHA384_4:
 100         case OP_PCL_SSL30_AES_128_GCM_SHA256_5:
 101         case OP_PCL_SSL30_AES_256_GCM_SHA384_5:
 102         case OP_PCL_SSL30_AES_128_GCM_SHA256_6:
 103         case OP_PCL_TLS_DH_ANON_AES_256_GCM_SHA384:
 104         case OP_PCL_TLS_PSK_AES_128_GCM_SHA256:
 105         case OP_PCL_TLS_PSK_AES_256_GCM_SHA384:
 106         case OP_PCL_TLS_DHE_PSK_AES_128_GCM_SHA256:
 107         case OP_PCL_TLS_DHE_PSK_AES_256_GCM_SHA384:
 108         case OP_PCL_TLS_RSA_PSK_AES_128_GCM_SHA256:
 109         case OP_PCL_TLS_RSA_PSK_AES_256_GCM_SHA384:
 110         case OP_PCL_TLS_PSK_AES_128_CBC_SHA256:
 111         case OP_PCL_TLS_PSK_AES_256_CBC_SHA384:
 112         case OP_PCL_TLS_DHE_PSK_AES_128_CBC_SHA256:
 113         case OP_PCL_TLS_DHE_PSK_AES_256_CBC_SHA384:
 114         case OP_PCL_TLS_RSA_PSK_AES_128_CBC_SHA256:
 115         case OP_PCL_TLS_RSA_PSK_AES_256_CBC_SHA384:
 116         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_11:
 117         case OP_PCL_SSL30_AES_128_CBC_SHA_10:
 118         case OP_PCL_SSL30_AES_256_CBC_SHA_10:
 119         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_12:
 120         case OP_PCL_SSL30_AES_128_CBC_SHA_11:
 121         case OP_PCL_SSL30_AES_256_CBC_SHA_11:
 122         case OP_PCL_SSL30_AES_128_CBC_SHA_12:
 123         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_13:
 124         case OP_PCL_SSL30_AES_256_CBC_SHA_12:
 125         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_14:
 126         case OP_PCL_SSL30_AES_128_CBC_SHA_13:
 127         case OP_PCL_SSL30_AES_256_CBC_SHA_13:
 128         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_15:
 129         case OP_PCL_SSL30_AES_128_CBC_SHA_14:
 130         case OP_PCL_SSL30_AES_256_CBC_SHA_14:
 131         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_16:
 132         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_17:
 133         case OP_PCL_SSL30_3DES_EDE_CBC_SHA_18:
 134         case OP_PCL_SSL30_AES_128_CBC_SHA_15:
 135         case OP_PCL_SSL30_AES_128_CBC_SHA_16:
 136         case OP_PCL_SSL30_AES_128_CBC_SHA_17:
 137         case OP_PCL_SSL30_AES_256_CBC_SHA_15:
 138         case OP_PCL_SSL30_AES_256_CBC_SHA_16:
 139         case OP_PCL_SSL30_AES_256_CBC_SHA_17:
 140         case OP_PCL_TLS_ECDHE_ECDSA_AES_128_CBC_SHA256:
 141         case OP_PCL_TLS_ECDHE_ECDSA_AES_256_CBC_SHA384:
 142         case OP_PCL_TLS_ECDH_ECDSA_AES_128_CBC_SHA256:
 143         case OP_PCL_TLS_ECDH_ECDSA_AES_256_CBC_SHA384:
 144         case OP_PCL_TLS_ECDHE_RSA_AES_128_CBC_SHA256:
 145         case OP_PCL_TLS_ECDHE_RSA_AES_256_CBC_SHA384:
 146         case OP_PCL_TLS_ECDH_RSA_AES_128_CBC_SHA256:
 147         case OP_PCL_TLS_ECDH_RSA_AES_256_CBC_SHA384:
 148         case OP_PCL_TLS_ECDHE_ECDSA_AES_128_GCM_SHA256:
 149         case OP_PCL_TLS_ECDHE_ECDSA_AES_256_GCM_SHA384:
 150         case OP_PCL_TLS_ECDH_ECDSA_AES_128_GCM_SHA256:
 151         case OP_PCL_TLS_ECDH_ECDSA_AES_256_GCM_SHA384:
 152         case OP_PCL_TLS_ECDHE_RSA_AES_128_GCM_SHA256:
 153         case OP_PCL_TLS_ECDHE_RSA_AES_256_GCM_SHA384:
 154         case OP_PCL_TLS_ECDH_RSA_AES_128_GCM_SHA256:
 155         case OP_PCL_TLS_ECDH_RSA_AES_256_GCM_SHA384:
 156         case OP_PCL_TLS_ECDHE_PSK_3DES_EDE_CBC_SHA:
 157         case OP_PCL_TLS_ECDHE_PSK_AES_128_CBC_SHA:
 158         case OP_PCL_TLS_ECDHE_PSK_AES_256_CBC_SHA:
 159         case OP_PCL_TLS_ECDHE_PSK_AES_128_CBC_SHA256:
 160         case OP_PCL_TLS_ECDHE_PSK_AES_256_CBC_SHA384:
 161         case OP_PCL_TLS12_3DES_EDE_CBC_MD5:
 162         case OP_PCL_TLS12_3DES_EDE_CBC_SHA160:
 163         case OP_PCL_TLS12_3DES_EDE_CBC_SHA224:
 164         case OP_PCL_TLS12_3DES_EDE_CBC_SHA256:
 165         case OP_PCL_TLS12_3DES_EDE_CBC_SHA384:
 166         case OP_PCL_TLS12_3DES_EDE_CBC_SHA512:
 167         case OP_PCL_TLS12_AES_128_CBC_SHA160:
 168         case OP_PCL_TLS12_AES_128_CBC_SHA224:
 169         case OP_PCL_TLS12_AES_128_CBC_SHA256:
 170         case OP_PCL_TLS12_AES_128_CBC_SHA384:
 171         case OP_PCL_TLS12_AES_128_CBC_SHA512:
 172         case OP_PCL_TLS12_AES_192_CBC_SHA160:
 173         case OP_PCL_TLS12_AES_192_CBC_SHA224:
 174         case OP_PCL_TLS12_AES_192_CBC_SHA256:
 175         case OP_PCL_TLS12_AES_192_CBC_SHA512:
 176         case OP_PCL_TLS12_AES_256_CBC_SHA160:
 177         case OP_PCL_TLS12_AES_256_CBC_SHA224:
 178         case OP_PCL_TLS12_AES_256_CBC_SHA256:
 179         case OP_PCL_TLS12_AES_256_CBC_SHA384:
 180         case OP_PCL_TLS12_AES_256_CBC_SHA512:
 181         case OP_PCL_TLS_PVT_AES_192_CBC_SHA160:
 182         case OP_PCL_TLS_PVT_AES_192_CBC_SHA384:
 183         case OP_PCL_TLS_PVT_AES_192_CBC_SHA224:
 184         case OP_PCL_TLS_PVT_AES_192_CBC_SHA512:
 185         case OP_PCL_TLS_PVT_AES_192_CBC_SHA256:
 186         case OP_PCL_TLS_PVT_MASTER_SECRET_PRF_FE:
 187         case OP_PCL_TLS_PVT_MASTER_SECRET_PRF_FF:
 188                 return 0;
 189         }
 190
 191         return -EINVAL;
 192 }
 193
 194 static inline int
 195 __rta_ike_proto(uint16_t protoinfo)
 196 {
 197         switch (protoinfo) {
 198         case OP_PCL_IKE_HMAC_MD5:
 199         case OP_PCL_IKE_HMAC_SHA1:
 200         case OP_PCL_IKE_HMAC_AES128_CBC:
 201         case OP_PCL_IKE_HMAC_SHA256:
 202         case OP_PCL_IKE_HMAC_SHA384:
 203         case OP_PCL_IKE_HMAC_SHA512:
 204         case OP_PCL_IKE_HMAC_AES128_CMAC:
 205                 return 0;
 206         }
 207
 208         return -EINVAL;
 209 }
 210
 211 static inline int
 212 __rta_ipsec_proto(uint16_t protoinfo)
 213 {
 214         uint16_t proto_cls1 = protoinfo & OP_PCL_IPSEC_CIPHER_MASK;
 215         uint16_t proto_cls2 = protoinfo & OP_PCL_IPSEC_AUTH_MASK;
 216
 217         switch (proto_cls1) {
 218         case OP_PCL_IPSEC_AES_NULL_WITH_GMAC:
 219                 if (rta_sec_era < RTA_SEC_ERA_2)
 220                         return -EINVAL;
 221                 /* no break */
 222         case OP_PCL_IPSEC_AES_CCM8:
 223         case OP_PCL_IPSEC_AES_CCM12:
 224         case OP_PCL_IPSEC_AES_CCM16:
 225         case OP_PCL_IPSEC_AES_GCM8:
 226         case OP_PCL_IPSEC_AES_GCM12:
 227         case OP_PCL_IPSEC_AES_GCM16:
 228                 /* CCM, GCM, GMAC require PROTINFO[7:0] = 0 */
 229                 if (proto_cls2 == OP_PCL_IPSEC_HMAC_NULL)
 230                         return 0;
 231                 return -EINVAL;
 232         case OP_PCL_IPSEC_NULL:
 233                 if (rta_sec_era < RTA_SEC_ERA_2)
 234                         return -EINVAL;
 235                 /* no break */
 236         case OP_PCL_IPSEC_DES_IV64:
 237         case OP_PCL_IPSEC_DES:
 238         case OP_PCL_IPSEC_3DES:
 239         case OP_PCL_IPSEC_AES_CBC:
 240         case OP_PCL_IPSEC_AES_CTR:
 241                 break;
 242         default:
 243                 return -EINVAL;
 244         }
 245
 246         switch (proto_cls2) {
 247         case OP_PCL_IPSEC_HMAC_NULL:
 248         case OP_PCL_IPSEC_HMAC_MD5_96:
 249         case OP_PCL_IPSEC_HMAC_SHA1_96:
 250         case OP_PCL_IPSEC_AES_XCBC_MAC_96:
 251         case OP_PCL_IPSEC_HMAC_MD5_128:
 252         case OP_PCL_IPSEC_HMAC_SHA1_160:
 253         case OP_PCL_IPSEC_AES_CMAC_96:
 254         case OP_PCL_IPSEC_HMAC_SHA2_256_128:
 255         case OP_PCL_IPSEC_HMAC_SHA2_384_192:
 256         case OP_PCL_IPSEC_HMAC_SHA2_512_256:
 257                 return 0;
 258         }
 259
 260         return -EINVAL;
 261 }
 262
 263 static inline int
 264 __rta_srtp_proto(uint16_t protoinfo)
 265 {
 266         uint16_t proto_cls1 = protoinfo & OP_PCL_SRTP_CIPHER_MASK;
 267         uint16_t proto_cls2 = protoinfo & OP_PCL_SRTP_AUTH_MASK;
 268
 269         switch (proto_cls1) {
 270         case OP_PCL_SRTP_AES_CTR:
 271                 switch (proto_cls2) {
 272                 case OP_PCL_SRTP_HMAC_SHA1_160:
 273                         return 0;
 274                 }
 275                 /* no break */
 276         }
 277
 278         return -EINVAL;
 279 }
 280
 281 static inline int
 282 __rta_macsec_proto(uint16_t protoinfo)
 283 {
 284         switch (protoinfo) {
 285         case OP_PCL_MACSEC:
 286                 return 0;
 287         }
 288
 289         return -EINVAL;
 290 }
 291
 292 static inline int
 293 __rta_wifi_proto(uint16_t protoinfo)
 294 {
 295         switch (protoinfo) {
 296         case OP_PCL_WIFI:
 297                 return 0;
 298         }
 299
 300         return -EINVAL;
 301 }
 302
 303 static inline int
 304 __rta_wimax_proto(uint16_t protoinfo)
 305 {
 306         switch (protoinfo) {
 307         case OP_PCL_WIMAX_OFDM:
 308         case OP_PCL_WIMAX_OFDMA:
 309                 return 0;
 310         }
 311
 312         return -EINVAL;
 313 }
 314
 315 /* Allowed blob proto flags for each SEC Era */
 316 static const uint32_t proto_blob_flags[] = {
 317         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK,
 318         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 319                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK,
 320         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 321                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK,
 322         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 323                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 324         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 325                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM
 326 };
 327
 328 static inline int
 329 __rta_blob_proto(uint16_t protoinfo)
 330 {
 331         if (protoinfo & ~proto_blob_flags[rta_sec_era])
 332                 return -EINVAL;
 333
 334         switch (protoinfo & OP_PCL_BLOB_FORMAT_MASK) {
 335         case OP_PCL_BLOB_FORMAT_NORMAL:
 336         case OP_PCL_BLOB_FORMAT_MASTER_VER:
 337         case OP_PCL_BLOB_FORMAT_TEST:
 338                 break;
 339         default:
 340                 return -EINVAL;
 341         }
 342
 343         switch (protoinfo & OP_PCL_BLOB_REG_MASK) {
 344         case OP_PCL_BLOB_AFHA_SBOX:
 345                 if (rta_sec_era < RTA_SEC_ERA_3)
 346                         return -EINVAL;
 347                 /* no break */
 348         case OP_PCL_BLOB_REG_MEMORY:
 349         case OP_PCL_BLOB_REG_KEY1:
 350         case OP_PCL_BLOB_REG_KEY2:
 351         case OP_PCL_BLOB_REG_SPLIT:
 352         case OP_PCL_BLOB_REG_PKE:
 353                 return 0;
 354         }
 355
 356         return -EINVAL;
 357 }
 358
 359 static inline int
 360 __rta_dlc_proto(uint16_t protoinfo)
 361 {
 362         if ((rta_sec_era < RTA_SEC_ERA_2) &&
 363             (protoinfo & (OP_PCL_PKPROT_DSA_MSG | OP_PCL_PKPROT_HASH_MASK |
 364              OP_PCL_PKPROT_EKT_Z | OP_PCL_PKPROT_DECRYPT_Z |
 365              OP_PCL_PKPROT_DECRYPT_PRI)))
 366                 return -EINVAL;
 367
 368         switch (protoinfo & OP_PCL_PKPROT_HASH_MASK) {
 369         case OP_PCL_PKPROT_HASH_MD5:
 370         case OP_PCL_PKPROT_HASH_SHA1:
 371         case OP_PCL_PKPROT_HASH_SHA224:
 372         case OP_PCL_PKPROT_HASH_SHA256:
 373         case OP_PCL_PKPROT_HASH_SHA384:
 374         case OP_PCL_PKPROT_HASH_SHA512:
 375                 break;
 376         default:
 377                 return -EINVAL;
 378         }
 379
 380         return 0;
 381 }
 382
 383 static inline int
 384 __rta_rsa_enc_proto(uint16_t protoinfo)
 385 {
 386         switch (protoinfo & OP_PCL_RSAPROT_OP_MASK) {
 387         case OP_PCL_RSAPROT_OP_ENC_F_IN:
 388                 if ((protoinfo & OP_PCL_RSAPROT_FFF_MASK) !=
 389                     OP_PCL_RSAPROT_FFF_RED)
 390                         return -EINVAL;
 391                 break;
 392         case OP_PCL_RSAPROT_OP_ENC_F_OUT:
 393                 switch (protoinfo & OP_PCL_RSAPROT_FFF_MASK) {
 394                 case OP_PCL_RSAPROT_FFF_RED:
 395                 case OP_PCL_RSAPROT_FFF_ENC:
 396                 case OP_PCL_RSAPROT_FFF_EKT:
 397                 case OP_PCL_RSAPROT_FFF_TK_ENC:
 398                 case OP_PCL_RSAPROT_FFF_TK_EKT:
 399                         break;
 400                 default:
 401                         return -EINVAL;
 402                 }
 403                 break;
 404         default:
 405                 return -EINVAL;
 406         }
 407
 408         return 0;
 409 }
 410
 411 static inline int
 412 __rta_rsa_dec_proto(uint16_t protoinfo)
 413 {
 414         switch (protoinfo & OP_PCL_RSAPROT_OP_MASK) {
 415         case OP_PCL_RSAPROT_OP_DEC_ND:
 416         case OP_PCL_RSAPROT_OP_DEC_PQD:
 417         case OP_PCL_RSAPROT_OP_DEC_PQDPDQC:
 418                 break;
 419         default:
 420                 return -EINVAL;
 421         }
 422
 423         switch (protoinfo & OP_PCL_RSAPROT_PPP_MASK) {
 424         case OP_PCL_RSAPROT_PPP_RED:
 425         case OP_PCL_RSAPROT_PPP_ENC:
 426         case OP_PCL_RSAPROT_PPP_EKT:
 427         case OP_PCL_RSAPROT_PPP_TK_ENC:
 428         case OP_PCL_RSAPROT_PPP_TK_EKT:
 429                 break;
 430         default:
 431                 return -EINVAL;
 432         }
 433
 434         if (protoinfo & OP_PCL_RSAPROT_FMT_PKCSV15)
 435                 switch (protoinfo & OP_PCL_RSAPROT_FFF_MASK) {
 436                 case OP_PCL_RSAPROT_FFF_RED:
 437                 case OP_PCL_RSAPROT_FFF_ENC:
 438                 case OP_PCL_RSAPROT_FFF_EKT:
 439                 case OP_PCL_RSAPROT_FFF_TK_ENC:
 440                 case OP_PCL_RSAPROT_FFF_TK_EKT:
 441                         break;
 442                 default:
 443                         return -EINVAL;
 444                 }
 445
 446         return 0;
 447 }
 448
 449 /*
 450  * DKP Protocol - Restrictions on key (SRC,DST) combinations
 451  * For e.g. key_in_out[0][0] = 1 means (SRC=IMM,DST=IMM) combination is allowed
 452  */
 453 static const uint8_t key_in_out[4][4] = { {1, 0, 0, 0},
 454                                           {1, 1, 1, 1},
 455                                           {1, 0, 1, 0},
 456                                           {1, 0, 0, 1} };
 457
 458 static inline int
 459 __rta_dkp_proto(uint16_t protoinfo)
 460 {
 461         int key_src = (protoinfo & OP_PCL_DKP_SRC_MASK) >> OP_PCL_DKP_SRC_SHIFT;
 462         int key_dst = (protoinfo & OP_PCL_DKP_DST_MASK) >> OP_PCL_DKP_DST_SHIFT;
 463
 464         if (!key_in_out[key_src][key_dst]) {
 465                 pr_err("PROTO_DESC: Invalid DKP key (SRC,DST)\n");
 466                 return -EINVAL;
 467         }
 468
 469         return 0;
 470 }
 471
 472
 473 static inline int
 474 __rta_3g_dcrc_proto(uint16_t protoinfo)
 475 {
 476         if (rta_sec_era == RTA_SEC_ERA_7)
 477                 return -EINVAL;
 478
 479         switch (protoinfo) {
 480         case OP_PCL_3G_DCRC_CRC7:
 481         case OP_PCL_3G_DCRC_CRC11:
 482                 return 0;
 483         }
 484
 485         return -EINVAL;
 486 }
 487
 488 static inline int
 489 __rta_3g_rlc_proto(uint16_t protoinfo)
 490 {
 491         if (rta_sec_era == RTA_SEC_ERA_7)
 492                 return -EINVAL;
 493
 494         switch (protoinfo) {
 495         case OP_PCL_3G_RLC_NULL:
 496         case OP_PCL_3G_RLC_KASUMI:
 497         case OP_PCL_3G_RLC_SNOW:
 498                 return 0;
 499         }
 500
 501         return -EINVAL;
 502 }
 503
 504 static inline int
 505 __rta_lte_pdcp_proto(uint16_t protoinfo)
 506 {
 507         if (rta_sec_era == RTA_SEC_ERA_7)
 508                 return -EINVAL;
 509
 510         switch (protoinfo) {
 511         case OP_PCL_LTE_ZUC:
 512                 if (rta_sec_era < RTA_SEC_ERA_5)
 513                         break;
 514         case OP_PCL_LTE_NULL:
 515         case OP_PCL_LTE_SNOW:
 516         case OP_PCL_LTE_AES:
 517                 return 0;
 518         }
 519
 520         return -EINVAL;
 521 }
 522
 523 static inline int
 524 __rta_lte_pdcp_mixed_proto(uint16_t protoinfo)
 525 {
 526         switch (protoinfo & OP_PCL_LTE_MIXED_AUTH_MASK) {
 527         case OP_PCL_LTE_MIXED_AUTH_NULL:
 528         case OP_PCL_LTE_MIXED_AUTH_SNOW:
 529         case OP_PCL_LTE_MIXED_AUTH_AES:
 530         case OP_PCL_LTE_MIXED_AUTH_ZUC:
 531                 break;
 532         default:
 533                 return -EINVAL;
 534         }
 535
 536         switch (protoinfo & OP_PCL_LTE_MIXED_ENC_MASK) {
 537         case OP_PCL_LTE_MIXED_ENC_NULL:
 538         case OP_PCL_LTE_MIXED_ENC_SNOW:
 539         case OP_PCL_LTE_MIXED_ENC_AES:
 540         case OP_PCL_LTE_MIXED_ENC_ZUC:
 541                 return 0;
 542         }
 543
 544         return -EINVAL;
 545 }
 546
 547 struct proto_map {
 548         uint32_t optype;
 549         uint32_t protid;
 550         int (*protoinfo_func)(uint16_t);
 551 };
 552
 553 static const struct proto_map proto_table[] = {
 554 /*1*/   {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_SSL30_PRF,     __rta_ssl_proto},
 555         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS10_PRF,     __rta_ssl_proto},
 556         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS11_PRF,     __rta_ssl_proto},
 557         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS12_PRF,     __rta_ssl_proto},
 558         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DTLS10_PRF,    __rta_ssl_proto},
 559         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_IKEV1_PRF,     __rta_ike_proto},
 560         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_IKEV2_PRF,     __rta_ike_proto},
 561         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_PUBLICKEYPAIR, __rta_dlc_proto},
 562         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DSASIGN,       __rta_dlc_proto},
 563         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DSAVERIFY,     __rta_dlc_proto},
 564         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_IPSEC,         __rta_ipsec_proto},
 565         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_SRTP,          __rta_srtp_proto},
 566         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_SSL30,         __rta_ssl_proto},
 567         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS10,         __rta_ssl_proto},
 568         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS11,         __rta_ssl_proto},
 569         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS12,         __rta_ssl_proto},
 570         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_DTLS10,        __rta_ssl_proto},
 571         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_MACSEC,        __rta_macsec_proto},
 572         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_WIFI,          __rta_wifi_proto},
 573         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_WIMAX,         __rta_wimax_proto},
 574 /*21*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_BLOB,          __rta_blob_proto},
 575         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DIFFIEHELLMAN, __rta_dlc_proto},
 576         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_RSAENCRYPT,    __rta_rsa_enc_proto},
 577         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_RSADECRYPT,    __rta_rsa_dec_proto},
 578         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_DCRC,       __rta_3g_dcrc_proto},
 579         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_RLC_PDU,    __rta_3g_rlc_proto},
 580         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_RLC_SDU,    __rta_3g_rlc_proto},
 581         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_USER, __rta_lte_pdcp_proto},
 582 /*29*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_CTRL, __rta_lte_pdcp_proto},
 583         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_MD5,       __rta_dkp_proto},
 584         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA1,      __rta_dkp_proto},
 585         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA224,    __rta_dkp_proto},
 586         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA256,    __rta_dkp_proto},
 587         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA384,    __rta_dkp_proto},
 588 /*35*/  {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA512,    __rta_dkp_proto},
 589         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_PUBLICKEYPAIR, __rta_dlc_proto},
 590 /*37*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_DSASIGN,       __rta_dlc_proto},
 591 /*38*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_CTRL_MIXED,
 592          __rta_lte_pdcp_mixed_proto},
 593         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_IPSEC_NEW,     __rta_ipsec_proto},
 594 };
 595
 596 /*
 597  * Allowed OPERATION protocols for each SEC Era.
 598  * Values represent the number of entries from proto_table[] that are supported.
 599  */
 600 static const unsigned int proto_table_sz[] = {21, 29, 29, 29, 29, 35, 37, 39};
 601
 602 static inline int
 603 rta_proto_operation(struct program *program, uint32_t optype,
 604                                       uint32_t protid, uint16_t protoinfo)
 605 {
 606         uint32_t opcode = CMD_OPERATION;
 607         unsigned int i, found = 0;
 608         uint32_t optype_tmp = optype;
 609         unsigned int start_pc = program->current_pc;
 610         int ret = -EINVAL;
 611
 612         for (i = 0; i < proto_table_sz[rta_sec_era]; i++) {
 613                 /* clear last bit in optype to match also decap proto */
 614                 optype_tmp &= (uint32_t)~(1 << OP_TYPE_SHIFT);
 615                 if (optype_tmp == proto_table[i].optype) {
 616                         if (proto_table[i].protid == protid) {
 617                                 /* nothing else to verify */
 618                                 if (proto_table[i].protoinfo_func == NULL) {
 619                                         found = 1;
 620                                         break;
 621                                 }
 622                                 /* check protoinfo */
 623                                 ret = (*proto_table[i].protoinfo_func)
 624                                                 (protoinfo);
 625                                 if (ret < 0) {
 626                                         pr_err("PROTO_DESC: Bad PROTO Type. SEC Program Line: %d\n",
 627                                                program->current_pc);
 628                                         goto err;
 629                                 }
 630                                 found = 1;
 631                                 break;
 632                         }
 633                 }
 634         }
 635         if (!found) {
 636                 pr_err("PROTO_DESC: Operation Type Mismatch. SEC Program Line: %d\n",
 637                        program->current_pc);
 638                 goto err;
 639         }
 640
 641         __rta_out32(program, opcode | optype | protid | protoinfo);
 642         program->current_instruction++;
 643         return (int)start_pc;
 644
 645  err:
 646         program->first_error_pc = start_pc;
 647         program->current_instruction++;
 648         return ret;
 649 }
 650
 651 static inline int
 652 rta_dkp_proto(struct program *program, uint32_t protid,
 653                                 uint16_t key_src, uint16_t key_dst,
 654                                 uint16_t keylen, uint64_t key,
 655                                 enum rta_data_type key_type)
 656 {
 657         unsigned int start_pc = program->current_pc;
 658         unsigned int in_words = 0, out_words = 0;
 659         int ret;
 660
 661         key_src &= OP_PCL_DKP_SRC_MASK;
 662         key_dst &= OP_PCL_DKP_DST_MASK;
 663         keylen &= OP_PCL_DKP_KEY_MASK;
 664
 665         ret = rta_proto_operation(program, OP_TYPE_UNI_PROTOCOL, protid,
 666                                   key_src | key_dst | keylen);
 667         if (ret < 0)
 668                 return ret;
 669
 670         if ((key_src == OP_PCL_DKP_SRC_PTR) ||
 671             (key_src == OP_PCL_DKP_SRC_SGF)) {
 672                 __rta_out64(program, program->ps, key);
 673                 in_words = program->ps ? 2 : 1;
 674         } else if (key_src == OP_PCL_DKP_SRC_IMM) {
 675                 __rta_inline_data(program, key, inline_flags(key_type), keylen);
 676                 in_words = (unsigned int)((keylen + 3) / 4);
 677         }
 678
 679         if ((key_dst == OP_PCL_DKP_DST_PTR) ||
 680             (key_dst == OP_PCL_DKP_DST_SGF)) {
 681                 out_words = in_words;
 682         } else  if (key_dst == OP_PCL_DKP_DST_IMM) {
 683                 out_words = split_key_len(protid) / 4;
 684         }
 685
 686         if (out_words < in_words) {
 687                 pr_err("PROTO_DESC: DKP doesn't currently support a smaller descriptor\n");
 688                 program->first_error_pc = start_pc;
 689                 return -EINVAL;
 690         }
 691
 692         /* If needed, reserve space in resulting descriptor for derived key */
 693         program->current_pc += (out_words - in_words);
 694
 695         return (int)start_pc;
 696 }
 697
 698 #endif /* __RTA_PROTOCOL_CMD_H__ */