1 /* 2 * Kernelspace interface to the pkey device driver 3 * 4 * Copyright IBM Corp. 2016 5 * 6 * Author: Harald Freudenberger <freude@de.ibm.com> 7 * 8 */ 9 10 #ifndef _KAPI_PKEY_H 11 #define _KAPI_PKEY_H 12 13 #include <linux/ioctl.h> 14 #include <linux/types.h> 15 #include <uapi/asm/pkey.h> 16 17 /* 18 * Generate (AES) random secure key. 19 * @param cardnr may be -1 (use default card) 20 * @param domain may be -1 (use default domain) 21 * @param keytype one of the PKEY_KEYTYPE values 22 * @param seckey pointer to buffer receiving the secure key 23 * @return 0 on success, negative errno value on failure 24 */ 25 int pkey_genseckey(__u16 cardnr, __u16 domain, 26 __u32 keytype, struct pkey_seckey *seckey); 27 28 /* 29 * Generate (AES) secure key with given key value. 30 * @param cardnr may be -1 (use default card) 31 * @param domain may be -1 (use default domain) 32 * @param keytype one of the PKEY_KEYTYPE values 33 * @param clrkey pointer to buffer with clear key data 34 * @param seckey pointer to buffer receiving the secure key 35 * @return 0 on success, negative errno value on failure 36 */ 37 int pkey_clr2seckey(__u16 cardnr, __u16 domain, __u32 keytype, 38 const struct pkey_clrkey *clrkey, 39 struct pkey_seckey *seckey); 40 41 /* 42 * Derive (AES) proteced key from the (AES) secure key blob. 43 * @param cardnr may be -1 (use default card) 44 * @param domain may be -1 (use default domain) 45 * @param seckey pointer to buffer with the input secure key 46 * @param protkey pointer to buffer receiving the protected key and 47 * additional info (type, length) 48 * @return 0 on success, negative errno value on failure 49 */ 50 int pkey_sec2protkey(__u16 cardnr, __u16 domain, 51 const struct pkey_seckey *seckey, 52 struct pkey_protkey *protkey); 53 54 /* 55 * Derive (AES) protected key from a given clear key value. 56 * @param keytype one of the PKEY_KEYTYPE values 57 * @param clrkey pointer to buffer with clear key data 58 * @param protkey pointer to buffer receiving the protected key and 59 * additional info (type, length) 60 * @return 0 on success, negative errno value on failure 61 */ 62 int pkey_clr2protkey(__u32 keytype, 63 const struct pkey_clrkey *clrkey, 64 struct pkey_protkey *protkey); 65 66 /* 67 * Search for a matching crypto card based on the Master Key 68 * Verification Pattern provided inside a secure key. 69 * @param seckey pointer to buffer with the input secure key 70 * @param cardnr pointer to cardnr, receives the card number on success 71 * @param domain pointer to domain, receives the domain number on success 72 * @param verify if set, always verify by fetching verification pattern 73 * from card 74 * @return 0 on success, negative errno value on failure. If no card could be 75 * found, -ENODEV is returned. 76 */ 77 int pkey_findcard(const struct pkey_seckey *seckey, 78 __u16 *cardnr, __u16 *domain, int verify); 79 80 /* 81 * Find card and transform secure key to protected key. 82 * @param seckey pointer to buffer with the input secure key 83 * @param protkey pointer to buffer receiving the protected key and 84 * additional info (type, length) 85 * @return 0 on success, negative errno value on failure 86 */ 87 int pkey_skey2pkey(const struct pkey_seckey *seckey, 88 struct pkey_protkey *protkey); 89 90 #endif /* _KAPI_PKEY_H */ 91