summaryrefslogtreecommitdiff
path: root/arch/s390/include/asm/pkey.h
blob: b48aef4188f6b23ba803feedc2b93339cc4eed02 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
/*
 * Kernelspace interface to the pkey device driver
 *
 * Copyright IBM Corp. 2016
 *
 * Author: Harald Freudenberger <freude@de.ibm.com>
 *
 */

#ifndef _KAPI_PKEY_H
#define _KAPI_PKEY_H

#include <linux/ioctl.h>
#include <linux/types.h>
#include <uapi/asm/pkey.h>

/*
 * Generate (AES) random secure key.
 * @param cardnr may be -1 (use default card)
 * @param domain may be -1 (use default domain)
 * @param keytype one of the PKEY_KEYTYPE values
 * @param seckey pointer to buffer receiving the secure key
 * @return 0 on success, negative errno value on failure
 */
int pkey_genseckey(__u16 cardnr, __u16 domain,
		   __u32 keytype, struct pkey_seckey *seckey);

/*
 * Generate (AES) secure key with given key value.
 * @param cardnr may be -1 (use default card)
 * @param domain may be -1 (use default domain)
 * @param keytype one of the PKEY_KEYTYPE values
 * @param clrkey pointer to buffer with clear key data
 * @param seckey pointer to buffer receiving the secure key
 * @return 0 on success, negative errno value on failure
 */
int pkey_clr2seckey(__u16 cardnr, __u16 domain, __u32 keytype,
		    const struct pkey_clrkey *clrkey,
		    struct pkey_seckey *seckey);

/*
 * Derive (AES) proteced key from the (AES) secure key blob.
 * @param cardnr may be -1 (use default card)
 * @param domain may be -1 (use default domain)
 * @param seckey pointer to buffer with the input secure key
 * @param protkey pointer to buffer receiving the protected key and
 *	  additional info (type, length)
 * @return 0 on success, negative errno value on failure
 */
int pkey_sec2protkey(__u16 cardnr, __u16 domain,
		     const struct pkey_seckey *seckey,
		     struct pkey_protkey *protkey);

/*
 * Derive (AES) protected key from a given clear key value.
 * @param keytype one of the PKEY_KEYTYPE values
 * @param clrkey pointer to buffer with clear key data
 * @param protkey pointer to buffer receiving the protected key and
 *	  additional info (type, length)
 * @return 0 on success, negative errno value on failure
 */
int pkey_clr2protkey(__u32 keytype,
		     const struct pkey_clrkey *clrkey,
		     struct pkey_protkey *protkey);

/*
 * Search for a matching crypto card based on the Master Key
 * Verification Pattern provided inside a secure key.
 * @param seckey pointer to buffer with the input secure key
 * @param cardnr pointer to cardnr, receives the card number on success
 * @param domain pointer to domain, receives the domain number on success
 * @param verify if set, always verify by fetching verification pattern
 *	  from card
 * @return 0 on success, negative errno value on failure. If no card could be
 *	   found, -ENODEV is returned.
 */
int pkey_findcard(const struct pkey_seckey *seckey,
		  __u16 *cardnr, __u16 *domain, int verify);

/*
 * Find card and transform secure key to protected key.
 * @param seckey pointer to buffer with the input secure key
 * @param protkey pointer to buffer receiving the protected key and
 *	  additional info (type, length)
 * @return 0 on success, negative errno value on failure
 */
int pkey_skey2pkey(const struct pkey_seckey *seckey,
		   struct pkey_protkey *protkey);

#endif /* _KAPI_PKEY_H */