Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 | /* * Userspace interface to the pkey device driver * * Copyright IBM Corp. 2017 * * Author: Harald Freudenberger <freude@de.ibm.com> * */ #ifndef _UAPI_PKEY_H #define _UAPI_PKEY_H #include <linux/ioctl.h> #include <linux/types.h> /* * Ioctl calls supported by the pkey device driver */ #define PKEY_IOCTL_MAGIC 'p' #define SECKEYBLOBSIZE 64 /* secure key blob size is always 64 bytes */ #define MAXPROTKEYSIZE 64 /* a protected key blob may be up to 64 bytes */ #define MAXCLRKEYSIZE 32 /* a clear key value may be up to 32 bytes */ /* defines for the type field within the pkey_protkey struct */ #define PKEY_KEYTYPE_AES_128 1 #define PKEY_KEYTYPE_AES_192 2 #define PKEY_KEYTYPE_AES_256 3 /* Struct to hold a secure key blob */ struct pkey_seckey { __u8 seckey[SECKEYBLOBSIZE]; /* the secure key blob */ }; /* Struct to hold protected key and length info */ struct pkey_protkey { __u32 type; /* key type, one of the PKEY_KEYTYPE values */ __u32 len; /* bytes actually stored in protkey[] */ __u8 protkey[MAXPROTKEYSIZE]; /* the protected key blob */ }; /* Struct to hold a clear key value */ struct pkey_clrkey { __u8 clrkey[MAXCLRKEYSIZE]; /* 16, 24, or 32 byte clear key value */ }; /* * Generate secure key */ struct pkey_genseck { __u16 cardnr; /* in: card to use or FFFF for any */ __u16 domain; /* in: domain or FFFF for any */ __u32 keytype; /* in: key type to generate */ struct pkey_seckey seckey; /* out: the secure key blob */ }; #define PKEY_GENSECK _IOWR(PKEY_IOCTL_MAGIC, 0x01, struct pkey_genseck) /* * Construct secure key from clear key value */ struct pkey_clr2seck { __u16 cardnr; /* in: card to use or FFFF for any */ __u16 domain; /* in: domain or FFFF for any */ __u32 keytype; /* in: key type to generate */ struct pkey_clrkey clrkey; /* in: the clear key value */ struct pkey_seckey seckey; /* out: the secure key blob */ }; #define PKEY_CLR2SECK _IOWR(PKEY_IOCTL_MAGIC, 0x02, struct pkey_clr2seck) /* * Fabricate protected key from a secure key */ struct pkey_sec2protk { __u16 cardnr; /* in: card to use or FFFF for any */ __u16 domain; /* in: domain or FFFF for any */ struct pkey_seckey seckey; /* in: the secure key blob */ struct pkey_protkey protkey; /* out: the protected key */ }; #define PKEY_SEC2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x03, struct pkey_sec2protk) /* * Fabricate protected key from an clear key value */ struct pkey_clr2protk { __u32 keytype; /* in: key type to generate */ struct pkey_clrkey clrkey; /* in: the clear key value */ struct pkey_protkey protkey; /* out: the protected key */ }; #define PKEY_CLR2PROTK _IOWR(PKEY_IOCTL_MAGIC, 0x04, struct pkey_clr2protk) /* * Search for matching crypto card based on the Master Key * Verification Pattern provided inside a secure key. */ struct pkey_findcard { struct pkey_seckey seckey; /* in: the secure key blob */ __u16 cardnr; /* out: card number */ __u16 domain; /* out: domain number */ }; #define PKEY_FINDCARD _IOWR(PKEY_IOCTL_MAGIC, 0x05, struct pkey_findcard) /* * Combined together: findcard + sec2prot */ struct pkey_skey2pkey { struct pkey_seckey seckey; /* in: the secure key blob */ struct pkey_protkey protkey; /* out: the protected key */ }; #define PKEY_SKEY2PKEY _IOWR(PKEY_IOCTL_MAGIC, 0x06, struct pkey_skey2pkey) /* * Verify the given secure key for being able to be useable with * the pkey module. Check for correct key type and check for having at * least one crypto card being able to handle this key (master key * or old master key verification pattern matches). * Return some info about the key: keysize in bits, keytype (currently * only AES), flag if key is wrapped with an old MKVP. */ struct pkey_verifykey { struct pkey_seckey seckey; /* in: the secure key blob */ __u16 cardnr; /* out: card number */ __u16 domain; /* out: domain number */ __u16 keysize; /* out: key size in bits */ __u32 attributes; /* out: attribute bits */ }; #define PKEY_VERIFYKEY _IOWR(PKEY_IOCTL_MAGIC, 0x07, struct pkey_verifykey) #define PKEY_VERIFY_ATTR_AES 0x00000001 /* key is an AES key */ #define PKEY_VERIFY_ATTR_OLD_MKVP 0x00000100 /* key has old MKVP value */ #endif /* _UAPI_PKEY_H */ |