// SPDX-License-Identifier: GPL-2.0

#include <linux/slab.h>
#include <linux/fs.h>
#include "eip123.h"

#define NUM_MINOR 1
#define ROOTKEY_IDX 42

#define cdev_to_eip123(ptr) ({ container_of(ptr, struct eip123, cdev); })

static const u8 ASEC_ASSOC_KDK[64] = {
	0x3f, 0x9a, 0xb1, 0x54, 0x87, 0xdf, 0x14, 0x4c, 0xda, 0xb1, 0x9e, 0x50,
	0x3c, 0xc6, 0x31, 0x20, 0x53, 0x2b, 0x08, 0x96, 0x17, 0xf4, 0xd7, 0x0f,
	0x2d, 0x22, 0xe8, 0x3e, 0xea, 0xd5, 0xe5, 0x0f, 0xc9, 0xb1, 0xd2, 0x7d,
	0x51, 0xf5, 0x2b, 0xf7, 0x96, 0x90, 0xed, 0x9e, 0x64, 0x8d, 0x07, 0x44,
	0x7e, 0xaa, 0xb1, 0x0f, 0x67, 0xdf, 0x75, 0x5d, 0x0e, 0xae, 0x4a, 0x76,
	0xcf, 0x89, 0x37, 0x43
};
static const u8 ASEC_ASSOC_ENC[64] = {
	0x81, 0xa9, 0xbe, 0x31, 0xf6, 0x80, 0x56, 0x46, 0x65, 0x62, 0xc9, 0xfd,
	0xbd, 0xb0, 0x92, 0x1b, 0x74, 0x31, 0x41, 0x80, 0xbc, 0x8d, 0x8e, 0xf0,
	0x0b, 0x70, 0x9a, 0x48, 0x24, 0x1b, 0x65, 0xc2, 0x7d, 0xf0, 0xe8, 0xa9,
	0xc1, 0xf8, 0xe9, 0xcc, 0xe2, 0x43, 0xcb, 0xd1, 0x43, 0x81, 0x77, 0x12,
	0xa5, 0xf9, 0xa4, 0x37, 0x0f, 0x61, 0xe4, 0x71, 0xb9, 0xa1, 0x7c, 0xdf,
	0xdc, 0xba, 0x82, 0xd1
};
static const u8 ASEC_PLAIN[32] = {
	0x4c, 0xa5, 0xbd, 0x22, 0x84, 0xec, 0x1b, 0x0c, 0x65, 0xf1, 0xd8, 0x81,
	0xd7, 0x48, 0xd2, 0xcc, 0xf3, 0xab, 0xdc, 0x54, 0x6c, 0xef, 0x9a, 0xb1,
	0xe7, 0xdd, 0xb5, 0x90, 0xab, 0xf6, 0xa6, 0xf7
};
static const u8 ASEC_IV[16] = {
	0x5c, 0xb2, 0x50, 0x3e, 0xda, 0xfb, 0x26, 0x27, 0xb6, 0x27, 0x30, 0x28,
	0x52, 0xf1, 0x89, 0x30
};

static int derive_asecdbkey(struct eip123 *eip)
{
	struct device *dev = eip->dev;
	struct eip123_result result;
	struct eip123_asset root = {}, kdk = {}, enc = {};
	void *src = NULL, *dst = NULL;
	int ret = 0;

	src = kmalloc(sizeof(ASEC_PLAIN), GFP_KERNEL | GFP_DMA);
	if (!src) {
		ret = -EFAULT;
		goto out;
	}

	dst = kzalloc(sizeof(ASEC_PLAIN), GFP_KERNEL | GFP_DMA);
	if (!dst) {
		ret = -EFAULT;
		goto free_src;
	}

	result = eip123_hw_asset_search(eip->hw, ROOTKEY_IDX, &root);
	if (result.error) {
		dev_err(dev, "Could not find rootkey in OTP\n");
		ret = -ENOENT;
		goto free_dst;
	}

	kdk.len = 32;
	result = eip123_hw_asset_create(eip->hw, POLICY_SECURE_OP_KDK, &kdk);
	if (result.error) {
		dev_err(dev, "Could not create kdk asset\n");
		ret = -EFAULT;
		goto free_dst;
	}

	enc.len = 32;
	result = eip123_hw_asset_create(
		eip->hw, POLICY_CRYPTO_KEY_AES | POLICY_CRYPTO_OP_ENCRYPT,
		&enc);
	if (result.error) {
		dev_err(dev, "Could not create enc asset\n");
		ret = -EFAULT;
		goto free_kdk;
	}

	result = eip123_hw_asset_derive(eip->hw, &kdk, &root, ASEC_ASSOC_KDK,
					sizeof(ASEC_ASSOC_KDK));
	if (result.error) {
		dev_err(dev, "Could not derive kdk key\n");
		ret = -EFAULT;
		goto free_enc;
	}

	result = eip123_hw_asset_derive(eip->hw, &enc, &kdk, ASEC_ASSOC_ENC,
					sizeof(ASEC_ASSOC_ENC));
	if (result.error) {
		dev_err(dev, "Could not derive enc key\n");
		ret = -EFAULT;
		goto free_enc;
	}

	memcpy(src, ASEC_PLAIN, sizeof(ASEC_PLAIN));
	result = eip123_hw_crypt_aes(eip->hw, EIP123_AES_CBC, &enc, NULL,
				     EIP123_AES_256, src, dst,
				     sizeof(ASEC_PLAIN), true, ASEC_IV);
	if (result.error) {
		dev_err(dev, "Could not encrypt: %d\n", result.error);
		ret = -EFAULT;
		goto free_enc;
	}
	memcpy(eip->asecdbkey, dst, sizeof(eip->asecdbkey));
free_enc:
	WARN_ON(eip123_hw_asset_delete(eip->hw, &enc).error);
free_kdk:
	WARN_ON(eip123_hw_asset_delete(eip->hw, &kdk).error);
free_dst:
	kfree(dst);
free_src:
	kfree(src);
out:
	return ret;
}

static ssize_t asecdbkey_read(struct file *file, char __user *buf, size_t count,
			      loff_t *pos)
{
	const struct eip123 *eip = cdev_to_eip123(file->f_inode->i_cdev);

	if (!eip->has_asecdbkey)
		return -ENOENT;

	return simple_read_from_buffer(buf, count, pos, eip->asecdbkey,
				       sizeof(eip->asecdbkey));
}

static const struct file_operations eip123_fops = {
	.read = asecdbkey_read,
};

int eip123_char_init(struct eip123 *eip, struct class *class)
{
	struct device *dev;
	dev_t dev_num;
	int ret;

	/* SOCs with empty OTP fail to derive an asecdbkey */
	ret = derive_asecdbkey(eip);
	eip->has_asecdbkey = ret == 0;

	ret = alloc_chrdev_region(&dev_num, 0, NUM_MINOR, MODULE_NAME);
	if (ret)
		goto out;

	cdev_init(&eip->cdev, &eip123_fops);
	eip->cdev.owner = THIS_MODULE;
	ret = cdev_add(&eip->cdev, dev_num, NUM_MINOR);
	if (ret)
		goto free_region;

	dev = device_create(class, eip->dev, dev_num, NULL, "asecdbkey");
	if (IS_ERR(dev)) {
		ret = PTR_ERR(dev);
		goto free_cdev;
	}

	return 0;
free_cdev:
	cdev_del(&eip->cdev);
free_region:
	unregister_chrdev_region(dev_num, NUM_MINOR);
out:
	return ret;
}

void eip123_char_exit(struct eip123 *eip, struct class *class)
{
	device_destroy(class, eip->cdev.dev);
	cdev_del(&eip->cdev);
	unregister_chrdev_region(eip->cdev.dev, NUM_MINOR);
}