1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * Userspace interface to the pkey device driver 4 * 5 * Copyright IBM Corp. 2017 6 * 7 * Author: Harald Freudenberger <freude@de.ibm.com> 8 * 9 */ 10 11 #ifndef _UAPI_PKEY_H 12 #define _UAPI_PKEY_H 13 14 #include <linux/ioctl.h> 15 #include <linux/types.h> 16 17 /* 18 * Ioctl calls supported by the pkey device driver 19 */ 20 21 #define PKEY_IOCTL_MAGIC 'p' 22 23 #define SECKEYBLOBSIZE 64 /* secure key blob size is always 64 bytes */ 24 #define PROTKEYBLOBSIZE 80 /* protected key blob size is always 80 bytes */ 25 #define MAXPROTKEYSIZE 64 /* a protected key blob may be up to 64 bytes */ 26 #define MAXCLRKEYSIZE 32 /* a clear key value may be up to 32 bytes */ 27 28 #define MINKEYBLOBSIZE SECKEYBLOBSIZE /* Minimum size of a key blob */ 29 #define MAXKEYBLOBSIZE PROTKEYBLOBSIZE /* Maximum size of a key blob */ 30 31 /* defines for the type field within the pkey_protkey struct */ 32 #define PKEY_KEYTYPE_AES_128 1 33 #define PKEY_KEYTYPE_AES_192 2 34 #define PKEY_KEYTYPE_AES_256 3 35 36 /* Struct to hold a secure key blob */ 37 struct pkey_seckey { 38 __u8 seckey[SECKEYBLOBSIZE]; /* the secure key blob */ 39 }; 40 41 /* Struct to hold protected key and length info */ 42 struct pkey_protkey { 43 __u32 type; /* key type, one of the PKEY_KEYTYPE values */ 44 __u32 len; /* bytes actually stored in protkey[] */ 45 __u8 protkey[MAXPROTKEYSIZE]; /* the protected key blob */ 46 }; 47 48 /* Struct to hold a clear key value */ 49 struct pkey_clrkey { 50 __u8 clrkey[MAXCLRKEYSIZE]; /* 16, 24, or 32 byte clear key value */ 51 }; 52 53 /* 54 * Generate secure key 55 */ 56 struct pkey_genseck { 57 __u16 cardnr; /* in: card to use or FFFF for any */ 58 __u16 domain; /* in: domain or FFFF for any */ 59 __u32 keytype; /* in: key type to generate */ 60 struct pkey_seckey seckey; /* out: the secure key blob */ 61 }; 62 #define PKEY_GENSECK _IOWR(PKEY_IOCTL_MAGIC, 0x01, struct pkey_genseck) 63 64 /* 65 * Construct secure key from clear key value 66 */ 67 struct pkey_clr2seck { 68 __u16 cardnr; /* in: card to use or FFFF for any */ 69 __u16 domain; /* in: domain or FFFF for any */ 70 __u32 keytype; /* in: key type to generate */ 71 struct pkey_clrkey clrkey; /* in: the clear key value */ 72 struct pkey_seckey seckey; /* out: the secure key blob */ 73 }; 74 #define PKEY_CLR2SECK _IOWR(PKEY_IOCTL_MAGIC, 0x02, struct pkey_clr2seck) 75 76 /* 77 * Fabricate protected key from a secure key 78 */ 79 struct pkey_sec2protk { 80 __u16 cardnr; /* in: card to use or FFFF for any */ 81 __u16 domain; /* in: domain or FFFF for any */ 82 struct pkey_seckey seckey; /* in: the secure key blob */ 83 struct pkey_protkey protkey; /* out: the protected key */ 84 }; 85 #define PKEY_SEC2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x03, struct pkey_sec2protk) 86 87 /* 88 * Fabricate protected key from an clear key value 89 */ 90 struct pkey_clr2protk { 91 __u32 keytype; /* in: key type to generate */ 92 struct pkey_clrkey clrkey; /* in: the clear key value */ 93 struct pkey_protkey protkey; /* out: the protected key */ 94 }; 95 #define PKEY_CLR2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x04, struct pkey_clr2protk) 96 97 /* 98 * Search for matching crypto card based on the Master Key 99 * Verification Pattern provided inside a secure key. 100 */ 101 struct pkey_findcard { 102 struct pkey_seckey seckey; /* in: the secure key blob */ 103 __u16 cardnr; /* out: card number */ 104 __u16 domain; /* out: domain number */ 105 }; 106 #define PKEY_FINDCARD _IOWR(PKEY_IOCTL_MAGIC, 0x05, struct pkey_findcard) 107 108 /* 109 * Combined together: findcard + sec2prot 110 */ 111 struct pkey_skey2pkey { 112 struct pkey_seckey seckey; /* in: the secure key blob */ 113 struct pkey_protkey protkey; /* out: the protected key */ 114 }; 115 #define PKEY_SKEY2PKEY _IOWR(PKEY_IOCTL_MAGIC, 0x06, struct pkey_skey2pkey) 116 117 /* 118 * Verify the given secure key for being able to be useable with 119 * the pkey module. Check for correct key type and check for having at 120 * least one crypto card being able to handle this key (master key 121 * or old master key verification pattern matches). 122 * Return some info about the key: keysize in bits, keytype (currently 123 * only AES), flag if key is wrapped with an old MKVP. 124 */ 125 struct pkey_verifykey { 126 struct pkey_seckey seckey; /* in: the secure key blob */ 127 __u16 cardnr; /* out: card number */ 128 __u16 domain; /* out: domain number */ 129 __u16 keysize; /* out: key size in bits */ 130 __u32 attributes; /* out: attribute bits */ 131 }; 132 #define PKEY_VERIFYKEY _IOWR(PKEY_IOCTL_MAGIC, 0x07, struct pkey_verifykey) 133 #define PKEY_VERIFY_ATTR_AES 0x00000001 /* key is an AES key */ 134 #define PKEY_VERIFY_ATTR_OLD_MKVP 0x00000100 /* key has old MKVP value */ 135 136 /* 137 * Generate (AES) random protected key. 138 */ 139 struct pkey_genprotk { 140 __u32 keytype; /* in: key type to generate */ 141 struct pkey_protkey protkey; /* out: the protected key */ 142 }; 143 144 #define PKEY_GENPROTK _IOWR(PKEY_IOCTL_MAGIC, 0x08, struct pkey_genprotk) 145 146 /* 147 * Verify an (AES) protected key. 148 */ 149 struct pkey_verifyprotk { 150 struct pkey_protkey protkey; /* in: the protected key to verify */ 151 }; 152 153 #define PKEY_VERIFYPROTK _IOW(PKEY_IOCTL_MAGIC, 0x09, struct pkey_verifyprotk) 154 155 /* 156 * Transform an key blob (of any type) into a protected key 157 */ 158 struct pkey_kblob2pkey { 159 __u8 __user *key; /* in: the key blob */ 160 __u32 keylen; /* in: the key blob length */ 161 struct pkey_protkey protkey; /* out: the protected key */ 162 }; 163 164 #define PKEY_KBLOB2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x0A, struct pkey_kblob2pkey) 165 166 #endif /* _UAPI_PKEY_H */ 167