drivers/crypto/dpaa2_sec/hw/rta/protocol_cmd.h

   1 /* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0)
   2  *
   3  * Copyright 2008-2016 Freescale Semiconductor Inc.
   4  * Copyright 2016,2019 NXP
   5  *
   6  */
   7
   8 #ifndef __RTA_PROTOCOL_CMD_H__
   9 #define __RTA_PROTOCOL_CMD_H__
  10
  11 extern enum rta_sec_era rta_sec_era;
  12
  13 static inline int
  14 __rta_ssl_proto(uint16_t protoinfo)
  15 {
  16         switch (protoinfo) {
  17         case OP_PCL_TLS_RSA_EXPORT_WITH_RC4_40_MD5:
  18         case OP_PCL_TLS_RSA_WITH_RC4_128_MD5:
  19         case OP_PCL_TLS_RSA_WITH_RC4_128_SHA:
  20         case OP_PCL_TLS_DH_anon_EXPORT_WITH_RC4_40_MD5:
  21         case OP_PCL_TLS_DH_anon_WITH_RC4_128_MD5:
  22         case OP_PCL_TLS_KRB5_WITH_RC4_128_SHA:
  23         case OP_PCL_TLS_KRB5_WITH_RC4_128_MD5:
  24         case OP_PCL_TLS_KRB5_EXPORT_WITH_RC4_40_SHA:
  25         case OP_PCL_TLS_KRB5_EXPORT_WITH_RC4_40_MD5:
  26         case OP_PCL_TLS_PSK_WITH_RC4_128_SHA:
  27         case OP_PCL_TLS_DHE_PSK_WITH_RC4_128_SHA:
  28         case OP_PCL_TLS_RSA_PSK_WITH_RC4_128_SHA:
  29         case OP_PCL_TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
  30         case OP_PCL_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
  31         case OP_PCL_TLS_ECDH_RSA_WITH_RC4_128_SHA:
  32         case OP_PCL_TLS_ECDHE_RSA_WITH_RC4_128_SHA:
  33         case OP_PCL_TLS_ECDH_anon_WITH_RC4_128_SHA:
  34         case OP_PCL_TLS_ECDHE_PSK_WITH_RC4_128_SHA:
  35                 if (rta_sec_era == RTA_SEC_ERA_7)
  36                         return -EINVAL;
  37                 /* fall through if not Era 7 */
  38         case OP_PCL_TLS_RSA_EXPORT_WITH_DES40_CBC_SHA:
  39         case OP_PCL_TLS_RSA_WITH_DES_CBC_SHA:
  40         case OP_PCL_TLS_RSA_WITH_3DES_EDE_CBC_SHA:
  41         case OP_PCL_TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
  42         case OP_PCL_TLS_DH_DSS_WITH_DES_CBC_SHA:
  43         case OP_PCL_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:
  44         case OP_PCL_TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
  45         case OP_PCL_TLS_DH_RSA_WITH_DES_CBC_SHA:
  46         case OP_PCL_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:
  47         case OP_PCL_TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
  48         case OP_PCL_TLS_DHE_DSS_WITH_DES_CBC_SHA:
  49         case OP_PCL_TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
  50         case OP_PCL_TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
  51         case OP_PCL_TLS_DHE_RSA_WITH_DES_CBC_SHA:
  52         case OP_PCL_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
  53         case OP_PCL_TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
  54         case OP_PCL_TLS_DH_anon_WITH_DES_CBC_SHA:
  55         case OP_PCL_TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:
  56         case OP_PCL_TLS_KRB5_WITH_DES_CBC_SHA:
  57         case OP_PCL_TLS_KRB5_WITH_3DES_EDE_CBC_SHA:
  58         case OP_PCL_TLS_KRB5_WITH_DES_CBC_MD5:
  59         case OP_PCL_TLS_KRB5_WITH_3DES_EDE_CBC_MD5:
  60         case OP_PCL_TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA:
  61         case OP_PCL_TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5:
  62         case OP_PCL_TLS_RSA_WITH_AES_128_CBC_SHA:
  63         case OP_PCL_TLS_DH_DSS_WITH_AES_128_CBC_SHA:
  64         case OP_PCL_TLS_DH_RSA_WITH_AES_128_CBC_SHA:
  65         case OP_PCL_TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
  66         case OP_PCL_TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
  67         case OP_PCL_TLS_DH_anon_WITH_AES_128_CBC_SHA:
  68         case OP_PCL_TLS_RSA_WITH_AES_256_CBC_SHA:
  69         case OP_PCL_TLS_DH_DSS_WITH_AES_256_CBC_SHA:
  70         case OP_PCL_TLS_DH_RSA_WITH_AES_256_CBC_SHA:
  71         case OP_PCL_TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
  72         case OP_PCL_TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
  73         case OP_PCL_TLS_DH_anon_WITH_AES_256_CBC_SHA:
  74         case OP_PCL_TLS_DH_DSS_WITH_AES_128_CBC_SHA256:
  75         case OP_PCL_TLS_DH_RSA_WITH_AES_128_CBC_SHA256:
  76         case OP_PCL_TLS_DHE_DSS_WITH_AES_128_CBC_SHA256:
  77         case OP_PCL_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
  78         case OP_PCL_TLS_DH_DSS_WITH_AES_256_CBC_SHA256:
  79         case OP_PCL_TLS_DH_RSA_WITH_AES_256_CBC_SHA256:
  80         case OP_PCL_TLS_DHE_DSS_WITH_AES_256_CBC_SHA256:
  81         case OP_PCL_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
  82         case OP_PCL_TLS_DH_anon_WITH_AES_128_CBC_SHA256:
  83         case OP_PCL_TLS_DH_anon_WITH_AES_256_CBC_SHA256:
  84         case OP_PCL_TLS_PSK_WITH_3DES_EDE_CBC_SHA:
  85         case OP_PCL_TLS_PSK_WITH_AES_128_CBC_SHA:
  86         case OP_PCL_TLS_PSK_WITH_AES_256_CBC_SHA:
  87         case OP_PCL_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA:
  88         case OP_PCL_TLS_DHE_PSK_WITH_AES_128_CBC_SHA:
  89         case OP_PCL_TLS_DHE_PSK_WITH_AES_256_CBC_SHA:
  90         case OP_PCL_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA:
  91         case OP_PCL_TLS_RSA_PSK_WITH_AES_128_CBC_SHA:
  92         case OP_PCL_TLS_RSA_PSK_WITH_AES_256_CBC_SHA:
  93         case OP_PCL_TLS_RSA_WITH_AES_128_GCM_SHA256:
  94         case OP_PCL_TLS_RSA_WITH_AES_256_GCM_SHA384:
  95         case OP_PCL_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
  96         case OP_PCL_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
  97         case OP_PCL_TLS_DH_RSA_WITH_AES_128_GCM_SHA256:
  98         case OP_PCL_TLS_DH_RSA_WITH_AES_256_GCM_SHA384:
  99         case OP_PCL_TLS_DHE_DSS_WITH_AES_128_GCM_SHA256:
 100         case OP_PCL_TLS_DHE_DSS_WITH_AES_256_GCM_SHA384:
 101         case OP_PCL_TLS_DH_DSS_WITH_AES_128_GCM_SHA256:
 102         case OP_PCL_TLS_DH_DSS_WITH_AES_256_GCM_SHA384:
 103         case OP_PCL_TLS_DH_anon_WITH_AES_128_GCM_SHA256:
 104         case OP_PCL_TLS_DH_anon_WITH_AES_256_GCM_SHA384:
 105         case OP_PCL_TLS_PSK_WITH_AES_128_GCM_SHA256:
 106         case OP_PCL_TLS_PSK_WITH_AES_256_GCM_SHA384:
 107         case OP_PCL_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256:
 108         case OP_PCL_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384:
 109         case OP_PCL_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256:
 110         case OP_PCL_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384:
 111         case OP_PCL_TLS_PSK_WITH_AES_128_CBC_SHA256:
 112         case OP_PCL_TLS_PSK_WITH_AES_256_CBC_SHA384:
 113         case OP_PCL_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256:
 114         case OP_PCL_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384:
 115         case OP_PCL_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256:
 116         case OP_PCL_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384:
 117         case OP_PCL_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
 118         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
 119         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
 120         case OP_PCL_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
 121         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
 122         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
 123         case OP_PCL_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
 124         case OP_PCL_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
 125         case OP_PCL_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
 126         case OP_PCL_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
 127         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
 128         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
 129         case OP_PCL_TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA:
 130         case OP_PCL_TLS_ECDH_anon_WITH_AES_128_CBC_SHA:
 131         case OP_PCL_TLS_ECDH_anon_WITH_AES_256_CBC_SHA:
 132         case OP_PCL_TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA:
 133         case OP_PCL_TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA:
 134         case OP_PCL_TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA:
 135         case OP_PCL_TLS_SRP_SHA_WITH_AES_128_CBC_SHA:
 136         case OP_PCL_TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA:
 137         case OP_PCL_TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA:
 138         case OP_PCL_TLS_SRP_SHA_WITH_AES_256_CBC_SHA:
 139         case OP_PCL_TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA:
 140         case OP_PCL_TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA:
 141         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
 142         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
 143         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256:
 144         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384:
 145         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
 146         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:
 147         case OP_PCL_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256:
 148         case OP_PCL_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384:
 149         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
 150         case OP_PCL_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
 151         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256:
 152         case OP_PCL_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384:
 153         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
 154         case OP_PCL_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
 155         case OP_PCL_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256:
 156         case OP_PCL_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384:
 157         case OP_PCL_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA:
 158         case OP_PCL_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA:
 159         case OP_PCL_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA:
 160         case OP_PCL_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256:
 161         case OP_PCL_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384:
 162         case OP_PCL_TLS_RSA_WITH_AES_128_CBC_SHA256:
 163         case OP_PCL_TLS_RSA_WITH_AES_256_CBC_SHA256:
 164         case OP_PCL_PVT_TLS_3DES_EDE_CBC_MD5:
 165         case OP_PCL_PVT_TLS_3DES_EDE_CBC_SHA160:
 166         case OP_PCL_PVT_TLS_3DES_EDE_CBC_SHA224:
 167         case OP_PCL_PVT_TLS_3DES_EDE_CBC_SHA256:
 168         case OP_PCL_PVT_TLS_3DES_EDE_CBC_SHA384:
 169         case OP_PCL_PVT_TLS_3DES_EDE_CBC_SHA512:
 170         case OP_PCL_PVT_TLS_AES_128_CBC_SHA160:
 171         case OP_PCL_PVT_TLS_AES_128_CBC_SHA224:
 172         case OP_PCL_PVT_TLS_AES_128_CBC_SHA256:
 173         case OP_PCL_PVT_TLS_AES_128_CBC_SHA384:
 174         case OP_PCL_PVT_TLS_AES_128_CBC_SHA512:
 175         case OP_PCL_PVT_TLS_AES_192_CBC_SHA160:
 176         case OP_PCL_PVT_TLS_AES_192_CBC_SHA224:
 177         case OP_PCL_PVT_TLS_AES_192_CBC_SHA256:
 178         case OP_PCL_PVT_TLS_AES_192_CBC_SHA512:
 179         case OP_PCL_PVT_TLS_AES_256_CBC_SHA160:
 180         case OP_PCL_PVT_TLS_AES_256_CBC_SHA224:
 181         case OP_PCL_PVT_TLS_AES_256_CBC_SHA384:
 182         case OP_PCL_PVT_TLS_AES_256_CBC_SHA512:
 183         case OP_PCL_PVT_TLS_AES_256_CBC_SHA256:
 184         case OP_PCL_PVT_TLS_AES_192_CBC_SHA384:
 185         case OP_PCL_PVT_TLS_MASTER_SECRET_PRF_FE:
 186         case OP_PCL_PVT_TLS_MASTER_SECRET_PRF_FF:
 187                 return 0;
 188         }
 189
 190         return -EINVAL;
 191 }
 192
 193 static inline int
 194 __rta_ike_proto(uint16_t protoinfo)
 195 {
 196         switch (protoinfo) {
 197         case OP_PCL_IKE_HMAC_MD5:
 198         case OP_PCL_IKE_HMAC_SHA1:
 199         case OP_PCL_IKE_HMAC_AES128_CBC:
 200         case OP_PCL_IKE_HMAC_SHA256:
 201         case OP_PCL_IKE_HMAC_SHA384:
 202         case OP_PCL_IKE_HMAC_SHA512:
 203         case OP_PCL_IKE_HMAC_AES128_CMAC:
 204                 return 0;
 205         }
 206
 207         return -EINVAL;
 208 }
 209
 210 static inline int
 211 __rta_ipsec_proto(uint16_t protoinfo)
 212 {
 213         uint16_t proto_cls1 = protoinfo & OP_PCL_IPSEC_CIPHER_MASK;
 214         uint16_t proto_cls2 = protoinfo & OP_PCL_IPSEC_AUTH_MASK;
 215
 216         switch (proto_cls1) {
 217         case OP_PCL_IPSEC_AES_NULL_WITH_GMAC:
 218                 if (rta_sec_era < RTA_SEC_ERA_2)
 219                         return -EINVAL;
 220                 /* no break */
 221         case OP_PCL_IPSEC_AES_CCM8:
 222         case OP_PCL_IPSEC_AES_CCM12:
 223         case OP_PCL_IPSEC_AES_CCM16:
 224         case OP_PCL_IPSEC_AES_GCM8:
 225         case OP_PCL_IPSEC_AES_GCM12:
 226         case OP_PCL_IPSEC_AES_GCM16:
 227                 /* CCM, GCM, GMAC require PROTINFO[7:0] = 0 */
 228                 if (proto_cls2 == OP_PCL_IPSEC_HMAC_NULL)
 229                         return 0;
 230                 return -EINVAL;
 231         case OP_PCL_IPSEC_NULL:
 232                 if (rta_sec_era < RTA_SEC_ERA_2)
 233                         return -EINVAL;
 234                 /* no break */
 235         case OP_PCL_IPSEC_DES_IV64:
 236         case OP_PCL_IPSEC_DES:
 237         case OP_PCL_IPSEC_3DES:
 238         case OP_PCL_IPSEC_AES_CBC:
 239         case OP_PCL_IPSEC_AES_CTR:
 240                 break;
 241         default:
 242                 return -EINVAL;
 243         }
 244
 245         switch (proto_cls2) {
 246         case OP_PCL_IPSEC_HMAC_NULL:
 247         case OP_PCL_IPSEC_HMAC_MD5_96:
 248         case OP_PCL_IPSEC_HMAC_SHA1_96:
 249         case OP_PCL_IPSEC_AES_XCBC_MAC_96:
 250         case OP_PCL_IPSEC_HMAC_MD5_128:
 251         case OP_PCL_IPSEC_HMAC_SHA1_160:
 252         case OP_PCL_IPSEC_AES_CMAC_96:
 253         case OP_PCL_IPSEC_HMAC_SHA2_256_128:
 254         case OP_PCL_IPSEC_HMAC_SHA2_384_192:
 255         case OP_PCL_IPSEC_HMAC_SHA2_512_256:
 256                 return 0;
 257         }
 258
 259         return -EINVAL;
 260 }
 261
 262 static inline int
 263 __rta_srtp_proto(uint16_t protoinfo)
 264 {
 265         uint16_t proto_cls1 = protoinfo & OP_PCL_SRTP_CIPHER_MASK;
 266         uint16_t proto_cls2 = protoinfo & OP_PCL_SRTP_AUTH_MASK;
 267
 268         switch (proto_cls1) {
 269         case OP_PCL_SRTP_AES_CTR:
 270                 switch (proto_cls2) {
 271                 case OP_PCL_SRTP_HMAC_SHA1_160:
 272                         return 0;
 273                 }
 274                 /* no break */
 275         }
 276
 277         return -EINVAL;
 278 }
 279
 280 static inline int
 281 __rta_macsec_proto(uint16_t protoinfo)
 282 {
 283         switch (protoinfo) {
 284         case OP_PCL_MACSEC:
 285                 return 0;
 286         }
 287
 288         return -EINVAL;
 289 }
 290
 291 static inline int
 292 __rta_wifi_proto(uint16_t protoinfo)
 293 {
 294         switch (protoinfo) {
 295         case OP_PCL_WIFI:
 296                 return 0;
 297         }
 298
 299         return -EINVAL;
 300 }
 301
 302 static inline int
 303 __rta_wimax_proto(uint16_t protoinfo)
 304 {
 305         switch (protoinfo) {
 306         case OP_PCL_WIMAX_OFDM:
 307         case OP_PCL_WIMAX_OFDMA:
 308                 return 0;
 309         }
 310
 311         return -EINVAL;
 312 }
 313
 314 /* Allowed blob proto flags for each SEC Era */
 315 static const uint32_t proto_blob_flags[] = {
 316         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK,
 317         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 318                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK,
 319         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 320                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK,
 321         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 322                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 323         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 324                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 325         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 326                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 327         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 328                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 329         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 330                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 331         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 332                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM,
 333         OP_PCL_BLOB_FORMAT_MASK | OP_PCL_BLOB_BLACK | OP_PCL_BLOB_TKEK |
 334                 OP_PCL_BLOB_EKT | OP_PCL_BLOB_REG_MASK | OP_PCL_BLOB_SEC_MEM
 335 };
 336
 337 static inline int
 338 __rta_blob_proto(uint16_t protoinfo)
 339 {
 340         if (protoinfo & ~proto_blob_flags[rta_sec_era])
 341                 return -EINVAL;
 342
 343         switch (protoinfo & OP_PCL_BLOB_FORMAT_MASK) {
 344         case OP_PCL_BLOB_FORMAT_NORMAL:
 345         case OP_PCL_BLOB_FORMAT_MASTER_VER:
 346         case OP_PCL_BLOB_FORMAT_TEST:
 347                 break;
 348         default:
 349                 return -EINVAL;
 350         }
 351
 352         switch (protoinfo & OP_PCL_BLOB_REG_MASK) {
 353         case OP_PCL_BLOB_AFHA_SBOX:
 354                 if (rta_sec_era < RTA_SEC_ERA_3)
 355                         return -EINVAL;
 356                 /* no break */
 357         case OP_PCL_BLOB_REG_MEMORY:
 358         case OP_PCL_BLOB_REG_KEY1:
 359         case OP_PCL_BLOB_REG_KEY2:
 360         case OP_PCL_BLOB_REG_SPLIT:
 361         case OP_PCL_BLOB_REG_PKE:
 362                 return 0;
 363         }
 364
 365         return -EINVAL;
 366 }
 367
 368 static inline int
 369 __rta_dlc_proto(uint16_t protoinfo)
 370 {
 371         if ((rta_sec_era < RTA_SEC_ERA_2) &&
 372             (protoinfo & (OP_PCL_PKPROT_DSA_MSG | OP_PCL_PKPROT_HASH_MASK |
 373              OP_PCL_PKPROT_EKT_Z | OP_PCL_PKPROT_DECRYPT_Z |
 374              OP_PCL_PKPROT_DECRYPT_PRI)))
 375                 return -EINVAL;
 376
 377         switch (protoinfo & OP_PCL_PKPROT_HASH_MASK) {
 378         case OP_PCL_PKPROT_HASH_MD5:
 379         case OP_PCL_PKPROT_HASH_SHA1:
 380         case OP_PCL_PKPROT_HASH_SHA224:
 381         case OP_PCL_PKPROT_HASH_SHA256:
 382         case OP_PCL_PKPROT_HASH_SHA384:
 383         case OP_PCL_PKPROT_HASH_SHA512:
 384                 break;
 385         default:
 386                 return -EINVAL;
 387         }
 388
 389         return 0;
 390 }
 391
 392 static inline int
 393 __rta_rsa_enc_proto(uint16_t protoinfo)
 394 {
 395         switch (protoinfo & OP_PCL_RSAPROT_OP_MASK) {
 396         case OP_PCL_RSAPROT_OP_ENC_F_IN:
 397                 if ((protoinfo & OP_PCL_RSAPROT_FFF_MASK) !=
 398                     OP_PCL_RSAPROT_FFF_RED)
 399                         return -EINVAL;
 400                 break;
 401         case OP_PCL_RSAPROT_OP_ENC_F_OUT:
 402                 switch (protoinfo & OP_PCL_RSAPROT_FFF_MASK) {
 403                 case OP_PCL_RSAPROT_FFF_RED:
 404                 case OP_PCL_RSAPROT_FFF_ENC:
 405                 case OP_PCL_RSAPROT_FFF_EKT:
 406                 case OP_PCL_RSAPROT_FFF_TK_ENC:
 407                 case OP_PCL_RSAPROT_FFF_TK_EKT:
 408                         break;
 409                 default:
 410                         return -EINVAL;
 411                 }
 412                 break;
 413         default:
 414                 return -EINVAL;
 415         }
 416
 417         return 0;
 418 }
 419
 420 static inline int
 421 __rta_rsa_dec_proto(uint16_t protoinfo)
 422 {
 423         switch (protoinfo & OP_PCL_RSAPROT_OP_MASK) {
 424         case OP_PCL_RSAPROT_OP_DEC_ND:
 425         case OP_PCL_RSAPROT_OP_DEC_PQD:
 426         case OP_PCL_RSAPROT_OP_DEC_PQDPDQC:
 427                 break;
 428         default:
 429                 return -EINVAL;
 430         }
 431
 432         switch (protoinfo & OP_PCL_RSAPROT_PPP_MASK) {
 433         case OP_PCL_RSAPROT_PPP_RED:
 434         case OP_PCL_RSAPROT_PPP_ENC:
 435         case OP_PCL_RSAPROT_PPP_EKT:
 436         case OP_PCL_RSAPROT_PPP_TK_ENC:
 437         case OP_PCL_RSAPROT_PPP_TK_EKT:
 438                 break;
 439         default:
 440                 return -EINVAL;
 441         }
 442
 443         if (protoinfo & OP_PCL_RSAPROT_FMT_PKCSV15)
 444                 switch (protoinfo & OP_PCL_RSAPROT_FFF_MASK) {
 445                 case OP_PCL_RSAPROT_FFF_RED:
 446                 case OP_PCL_RSAPROT_FFF_ENC:
 447                 case OP_PCL_RSAPROT_FFF_EKT:
 448                 case OP_PCL_RSAPROT_FFF_TK_ENC:
 449                 case OP_PCL_RSAPROT_FFF_TK_EKT:
 450                         break;
 451                 default:
 452                         return -EINVAL;
 453                 }
 454
 455         return 0;
 456 }
 457
 458 /*
 459  * DKP Protocol - Restrictions on key (SRC,DST) combinations
 460  * For e.g. key_in_out[0][0] = 1 means (SRC=IMM,DST=IMM) combination is allowed
 461  */
 462 static const uint8_t key_in_out[4][4] = { {1, 0, 0, 0},
 463                                           {1, 1, 1, 1},
 464                                           {1, 0, 1, 0},
 465                                           {1, 0, 0, 1} };
 466
 467 static inline int
 468 __rta_dkp_proto(uint16_t protoinfo)
 469 {
 470         int key_src = (protoinfo & OP_PCL_DKP_SRC_MASK) >> OP_PCL_DKP_SRC_SHIFT;
 471         int key_dst = (protoinfo & OP_PCL_DKP_DST_MASK) >> OP_PCL_DKP_DST_SHIFT;
 472
 473         if (!key_in_out[key_src][key_dst]) {
 474                 pr_err("PROTO_DESC: Invalid DKP key (SRC,DST)\n");
 475                 return -EINVAL;
 476         }
 477
 478         return 0;
 479 }
 480
 481
 482 static inline int
 483 __rta_3g_dcrc_proto(uint16_t protoinfo)
 484 {
 485         if (rta_sec_era == RTA_SEC_ERA_7)
 486                 return -EINVAL;
 487
 488         switch (protoinfo) {
 489         case OP_PCL_3G_DCRC_CRC7:
 490         case OP_PCL_3G_DCRC_CRC11:
 491                 return 0;
 492         }
 493
 494         return -EINVAL;
 495 }
 496
 497 static inline int
 498 __rta_3g_rlc_proto(uint16_t protoinfo)
 499 {
 500         if (rta_sec_era == RTA_SEC_ERA_7)
 501                 return -EINVAL;
 502
 503         switch (protoinfo) {
 504         case OP_PCL_3G_RLC_NULL:
 505         case OP_PCL_3G_RLC_KASUMI:
 506         case OP_PCL_3G_RLC_SNOW:
 507                 return 0;
 508         }
 509
 510         return -EINVAL;
 511 }
 512
 513 static inline int
 514 __rta_lte_pdcp_proto(uint16_t protoinfo)
 515 {
 516         if (rta_sec_era == RTA_SEC_ERA_7)
 517                 return -EINVAL;
 518
 519         switch (protoinfo) {
 520         case OP_PCL_LTE_ZUC:
 521                 if (rta_sec_era < RTA_SEC_ERA_5)
 522                         break;
 523         case OP_PCL_LTE_NULL:
 524         case OP_PCL_LTE_SNOW:
 525         case OP_PCL_LTE_AES:
 526                 return 0;
 527         }
 528
 529         return -EINVAL;
 530 }
 531
 532 static inline int
 533 __rta_lte_pdcp_mixed_proto(uint16_t protoinfo)
 534 {
 535         switch (protoinfo & OP_PCL_LTE_MIXED_AUTH_MASK) {
 536         case OP_PCL_LTE_MIXED_AUTH_NULL:
 537         case OP_PCL_LTE_MIXED_AUTH_SNOW:
 538         case OP_PCL_LTE_MIXED_AUTH_AES:
 539         case OP_PCL_LTE_MIXED_AUTH_ZUC:
 540                 break;
 541         default:
 542                 return -EINVAL;
 543         }
 544
 545         switch (protoinfo & OP_PCL_LTE_MIXED_ENC_MASK) {
 546         case OP_PCL_LTE_MIXED_ENC_NULL:
 547         case OP_PCL_LTE_MIXED_ENC_SNOW:
 548         case OP_PCL_LTE_MIXED_ENC_AES:
 549         case OP_PCL_LTE_MIXED_ENC_ZUC:
 550                 return 0;
 551         }
 552
 553         return -EINVAL;
 554 }
 555
 556 struct proto_map {
 557         uint32_t optype;
 558         uint32_t protid;
 559         int (*protoinfo_func)(uint16_t);
 560 };
 561
 562 static const struct proto_map proto_table[] = {
 563 /*1*/   {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_SSL30_PRF,     __rta_ssl_proto},
 564         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS10_PRF,     __rta_ssl_proto},
 565         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS11_PRF,     __rta_ssl_proto},
 566         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_TLS12_PRF,     __rta_ssl_proto},
 567         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DTLS_PRF,      __rta_ssl_proto},
 568         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_IKEV1_PRF,     __rta_ike_proto},
 569         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_IKEV2_PRF,     __rta_ike_proto},
 570         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_PUBLICKEYPAIR, __rta_dlc_proto},
 571         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DSASIGN,       __rta_dlc_proto},
 572         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DSAVERIFY,     __rta_dlc_proto},
 573         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_IPSEC,         __rta_ipsec_proto},
 574         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_SRTP,          __rta_srtp_proto},
 575         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_SSL30,         __rta_ssl_proto},
 576         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS10,         __rta_ssl_proto},
 577         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS11,         __rta_ssl_proto},
 578         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_TLS12,         __rta_ssl_proto},
 579         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_DTLS,          __rta_ssl_proto},
 580         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_MACSEC,        __rta_macsec_proto},
 581         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_WIFI,          __rta_wifi_proto},
 582         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_WIMAX,         __rta_wimax_proto},
 583 /*21*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_BLOB,          __rta_blob_proto},
 584         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DIFFIEHELLMAN, __rta_dlc_proto},
 585         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_RSAENCRYPT,    __rta_rsa_enc_proto},
 586         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_RSADECRYPT,    __rta_rsa_dec_proto},
 587         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_DCRC,       __rta_3g_dcrc_proto},
 588         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_RLC_PDU,    __rta_3g_rlc_proto},
 589         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_3G_RLC_SDU,    __rta_3g_rlc_proto},
 590         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_USER, __rta_lte_pdcp_proto},
 591 /*29*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_CTRL, __rta_lte_pdcp_proto},
 592         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_MD5,       __rta_dkp_proto},
 593         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA1,      __rta_dkp_proto},
 594         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA224,    __rta_dkp_proto},
 595         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA256,    __rta_dkp_proto},
 596         {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA384,    __rta_dkp_proto},
 597 /*35*/  {OP_TYPE_UNI_PROTOCOL,   OP_PCLID_DKP_SHA512,    __rta_dkp_proto},
 598         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_PUBLICKEYPAIR, __rta_dlc_proto},
 599 /*37*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_DSASIGN,       __rta_dlc_proto},
 600 /*38*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_CTRL_MIXED,
 601          __rta_lte_pdcp_mixed_proto},
 602         {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_IPSEC_NEW,     __rta_ipsec_proto},
 603 /*40*/  {OP_TYPE_DECAP_PROTOCOL, OP_PCLID_LTE_PDCP_USER_RN,
 604         __rta_lte_pdcp_mixed_proto},
 605 };
 606
 607 /*
 608  * Allowed OPERATION protocols for each SEC Era.
 609  * Values represent the number of entries from proto_table[] that are supported.
 610  */
 611 static const unsigned int proto_table_sz[] = {21, 29, 29, 29, 29, 35, 37,
 612                                                 40, 40, 40};
 613
 614 static inline int
 615 rta_proto_operation(struct program *program, uint32_t optype,
 616                                       uint32_t protid, uint16_t protoinfo)
 617 {
 618         uint32_t opcode = CMD_OPERATION;
 619         unsigned int i, found = 0;
 620         uint32_t optype_tmp = optype;
 621         unsigned int start_pc = program->current_pc;
 622         int ret = -EINVAL;
 623
 624         for (i = 0; i < proto_table_sz[rta_sec_era]; i++) {
 625                 /* clear last bit in optype to match also decap proto */
 626                 optype_tmp &= (uint32_t)~(1 << OP_TYPE_SHIFT);
 627                 if (optype_tmp == proto_table[i].optype) {
 628                         if (proto_table[i].protid == protid) {
 629                                 /* nothing else to verify */
 630                                 if (proto_table[i].protoinfo_func == NULL) {
 631                                         found = 1;
 632                                         break;
 633                                 }
 634                                 /* check protoinfo */
 635                                 ret = (*proto_table[i].protoinfo_func)
 636                                                 (protoinfo);
 637                                 if (ret < 0) {
 638                                         pr_err("PROTO_DESC: Bad PROTO Type. SEC Program Line: %d\n",
 639                                                program->current_pc);
 640                                         goto err;
 641                                 }
 642                                 found = 1;
 643                                 break;
 644                         }
 645                 }
 646         }
 647         if (!found) {
 648                 pr_err("PROTO_DESC: Operation Type Mismatch. SEC Program Line: %d\n",
 649                        program->current_pc);
 650                 goto err;
 651         }
 652
 653         __rta_out32(program, opcode | optype | protid | protoinfo);
 654         program->current_instruction++;
 655         return (int)start_pc;
 656
 657  err:
 658         program->first_error_pc = start_pc;
 659         program->current_instruction++;
 660         return ret;
 661 }
 662
 663 static inline int
 664 rta_dkp_proto(struct program *program, uint32_t protid,
 665                                 uint16_t key_src, uint16_t key_dst,
 666                                 uint16_t keylen, uint64_t key,
 667                                 enum rta_data_type key_type)
 668 {
 669         unsigned int start_pc = program->current_pc;
 670         unsigned int in_words = 0, out_words = 0;
 671         int ret;
 672
 673         key_src &= OP_PCL_DKP_SRC_MASK;
 674         key_dst &= OP_PCL_DKP_DST_MASK;
 675         keylen &= OP_PCL_DKP_KEY_MASK;
 676
 677         ret = rta_proto_operation(program, OP_TYPE_UNI_PROTOCOL, protid,
 678                                   key_src | key_dst | keylen);
 679         if (ret < 0)
 680                 return ret;
 681
 682         if ((key_src == OP_PCL_DKP_SRC_PTR) ||
 683             (key_src == OP_PCL_DKP_SRC_SGF)) {
 684                 __rta_out64(program, program->ps, key);
 685                 in_words = program->ps ? 2 : 1;
 686         } else if (key_src == OP_PCL_DKP_SRC_IMM) {
 687                 __rta_inline_data(program, key, inline_flags(key_type), keylen);
 688                 in_words = (unsigned int)((keylen + 3) / 4);
 689         }
 690
 691         if ((key_dst == OP_PCL_DKP_DST_PTR) ||
 692             (key_dst == OP_PCL_DKP_DST_SGF)) {
 693                 out_words = in_words;
 694         } else  if (key_dst == OP_PCL_DKP_DST_IMM) {
 695                 out_words = split_key_len(protid) / 4;
 696         }
 697
 698         if (out_words < in_words) {
 699                 pr_err("PROTO_DESC: DKP doesn't currently support a smaller descriptor\n");
 700                 program->first_error_pc = start_pc;
 701                 return -EINVAL;
 702         }
 703
 704         /* If needed, reserve space in resulting descriptor for derived key */
 705         program->current_pc += (out_words - in_words);
 706
 707         return (int)start_pc;
 708 }
 709
 710 #endif /* __RTA_PROTOCOL_CMD_H__ */