1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * Userspace interface to the pkey device driver 4 * 5 * Copyright IBM Corp. 2017 6 * 7 * Author: Harald Freudenberger <freude@de.ibm.com> 8 * 9 */ 10 11 #ifndef _UAPI_PKEY_H 12 #define _UAPI_PKEY_H 13 14 #include <linux/ioctl.h> 15 #include <linux/types.h> 16 17 /* 18 * Ioctl calls supported by the pkey device driver 19 */ 20 21 #define PKEY_IOCTL_MAGIC 'p' 22 23 #define SECKEYBLOBSIZE 64 /* secure key blob size is always 64 bytes */ 24 #define MAXPROTKEYSIZE 64 /* a protected key blob may be up to 64 bytes */ 25 #define MAXCLRKEYSIZE 32 /* a clear key value may be up to 32 bytes */ 26 27 /* defines for the type field within the pkey_protkey struct */ 28 #define PKEY_KEYTYPE_AES_128 1 29 #define PKEY_KEYTYPE_AES_192 2 30 #define PKEY_KEYTYPE_AES_256 3 31 32 /* Struct to hold a secure key blob */ 33 struct pkey_seckey { 34 __u8 seckey[SECKEYBLOBSIZE]; /* the secure key blob */ 35 }; 36 37 /* Struct to hold protected key and length info */ 38 struct pkey_protkey { 39 __u32 type; /* key type, one of the PKEY_KEYTYPE values */ 40 __u32 len; /* bytes actually stored in protkey[] */ 41 __u8 protkey[MAXPROTKEYSIZE]; /* the protected key blob */ 42 }; 43 44 /* Struct to hold a clear key value */ 45 struct pkey_clrkey { 46 __u8 clrkey[MAXCLRKEYSIZE]; /* 16, 24, or 32 byte clear key value */ 47 }; 48 49 /* 50 * Generate secure key 51 */ 52 struct pkey_genseck { 53 __u16 cardnr; /* in: card to use or FFFF for any */ 54 __u16 domain; /* in: domain or FFFF for any */ 55 __u32 keytype; /* in: key type to generate */ 56 struct pkey_seckey seckey; /* out: the secure key blob */ 57 }; 58 #define PKEY_GENSECK _IOWR(PKEY_IOCTL_MAGIC, 0x01, struct pkey_genseck) 59 60 /* 61 * Construct secure key from clear key value 62 */ 63 struct pkey_clr2seck { 64 __u16 cardnr; /* in: card to use or FFFF for any */ 65 __u16 domain; /* in: domain or FFFF for any */ 66 __u32 keytype; /* in: key type to generate */ 67 struct pkey_clrkey clrkey; /* in: the clear key value */ 68 struct pkey_seckey seckey; /* out: the secure key blob */ 69 }; 70 #define PKEY_CLR2SECK _IOWR(PKEY_IOCTL_MAGIC, 0x02, struct pkey_clr2seck) 71 72 /* 73 * Fabricate protected key from a secure key 74 */ 75 struct pkey_sec2protk { 76 __u16 cardnr; /* in: card to use or FFFF for any */ 77 __u16 domain; /* in: domain or FFFF for any */ 78 struct pkey_seckey seckey; /* in: the secure key blob */ 79 struct pkey_protkey protkey; /* out: the protected key */ 80 }; 81 #define PKEY_SEC2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x03, struct pkey_sec2protk) 82 83 /* 84 * Fabricate protected key from an clear key value 85 */ 86 struct pkey_clr2protk { 87 __u32 keytype; /* in: key type to generate */ 88 struct pkey_clrkey clrkey; /* in: the clear key value */ 89 struct pkey_protkey protkey; /* out: the protected key */ 90 }; 91 #define PKEY_CLR2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x04, struct pkey_clr2protk) 92 93 /* 94 * Search for matching crypto card based on the Master Key 95 * Verification Pattern provided inside a secure key. 96 */ 97 struct pkey_findcard { 98 struct pkey_seckey seckey; /* in: the secure key blob */ 99 __u16 cardnr; /* out: card number */ 100 __u16 domain; /* out: domain number */ 101 }; 102 #define PKEY_FINDCARD _IOWR(PKEY_IOCTL_MAGIC, 0x05, struct pkey_findcard) 103 104 /* 105 * Combined together: findcard + sec2prot 106 */ 107 struct pkey_skey2pkey { 108 struct pkey_seckey seckey; /* in: the secure key blob */ 109 struct pkey_protkey protkey; /* out: the protected key */ 110 }; 111 #define PKEY_SKEY2PKEY _IOWR(PKEY_IOCTL_MAGIC, 0x06, struct pkey_skey2pkey) 112 113 /* 114 * Verify the given secure key for being able to be useable with 115 * the pkey module. Check for correct key type and check for having at 116 * least one crypto card being able to handle this key (master key 117 * or old master key verification pattern matches). 118 * Return some info about the key: keysize in bits, keytype (currently 119 * only AES), flag if key is wrapped with an old MKVP. 120 */ 121 struct pkey_verifykey { 122 struct pkey_seckey seckey; /* in: the secure key blob */ 123 __u16 cardnr; /* out: card number */ 124 __u16 domain; /* out: domain number */ 125 __u16 keysize; /* out: key size in bits */ 126 __u32 attributes; /* out: attribute bits */ 127 }; 128 #define PKEY_VERIFYKEY _IOWR(PKEY_IOCTL_MAGIC, 0x07, struct pkey_verifykey) 129 #define PKEY_VERIFY_ATTR_AES 0x00000001 /* key is an AES key */ 130 #define PKEY_VERIFY_ATTR_OLD_MKVP 0x00000100 /* key has old MKVP value */ 131 132 #endif /* _UAPI_PKEY_H */ 133