pkey_base.h

  1/* SPDX-License-Identifier: GPL-2.0+ */
  2/*
  3 * Copyright IBM Corp. 2024
  4 *
  5 * Pkey base: debug feature, defines and structs
  6 * common to all pkey code.
  7 */
  8
  9#ifndef _PKEY_BASE_H_
 10#define _PKEY_BASE_H_
 11
 12#include <linux/types.h>
 13#include <asm/debug.h>
 14#include <asm/pkey.h>
 15
 16/*
 17 * pkey debug feature
 18 */
 19
 20extern debug_info_t *pkey_dbf_info;
 21
 22#define PKEY_DBF_INFO(...) debug_sprintf_event(pkey_dbf_info, 5, ##__VA_ARGS__)
 23#define PKEY_DBF_WARN(...) debug_sprintf_event(pkey_dbf_info, 4, ##__VA_ARGS__)
 24#define PKEY_DBF_ERR(...)  debug_sprintf_event(pkey_dbf_info, 3, ##__VA_ARGS__)
 25
 26/*
 27 * common defines and common structs
 28 */
 29
 30#define KEYBLOBBUFSIZE 8192	/* key buffer size used for internal processing */
 31#define MINKEYBLOBBUFSIZE (sizeof(struct keytoken_header))
 32#define PROTKEYBLOBBUFSIZE 256	/* protected key buffer size used internal */
 33#define MAXAPQNSINLIST 64	/* max 64 apqns within a apqn list */
 34#define AES_WK_VP_SIZE 32	/* Size of WK VP block appended to a prot key */
 35
 36/* inside view of a generic protected key token */
 37struct protkeytoken {
 38	u8  type;     /* 0x00 for PAES specific key tokens */
 39	u8  res0[3];
 40	u8  version;  /* should be 0x01 for protected key token */
 41	u8  res1[3];
 42	u32 keytype;  /* key type, one of the PKEY_KEYTYPE values */
 43	u32 len;      /* bytes actually stored in protkey[] */
 44	u8  protkey[]; /* the protected key blob */
 45} __packed;
 46
 47/* inside view of a protected AES key token */
 48struct protaeskeytoken {
 49	u8  type;     /* 0x00 for PAES specific key tokens */
 50	u8  res0[3];
 51	u8  version;  /* should be 0x01 for protected key token */
 52	u8  res1[3];
 53	u32 keytype;  /* key type, one of the PKEY_KEYTYPE values */
 54	u32 len;      /* bytes actually stored in protkey[] */
 55	u8  protkey[MAXPROTKEYSIZE]; /* the protected key blob */
 56} __packed;
 57
 58/* inside view of a clear key token (type 0x00 version 0x02) */
 59struct clearkeytoken {
 60	u8  type;	/* 0x00 for PAES specific key tokens */
 61	u8  res0[3];
 62	u8  version;	/* 0x02 for clear key token */
 63	u8  res1[3];
 64	u32 keytype;	/* key type, one of the PKEY_KEYTYPE_* values */
 65	u32 len;	/* bytes actually stored in clearkey[] */
 66	u8  clearkey[]; /* clear key value */
 67} __packed;
 68
 69/* helper function which translates the PKEY_KEYTYPE_AES_* to their keysize */
 70static inline u32 pkey_keytype_aes_to_size(u32 keytype)
 71{
 72	switch (keytype) {
 73	case PKEY_KEYTYPE_AES_128:
 74		return 16;
 75	case PKEY_KEYTYPE_AES_192:
 76		return 24;
 77	case PKEY_KEYTYPE_AES_256:
 78		return 32;
 79	default:
 80		return 0;
 81	}
 82}
 83
 84/* helper function which translates AES key bit size into PKEY_KEYTYPE_AES_* */
 85static inline u32 pkey_aes_bitsize_to_keytype(u32 keybitsize)
 86{
 87	switch (keybitsize) {
 88	case 128:
 89		return PKEY_KEYTYPE_AES_128;
 90	case 192:
 91		return PKEY_KEYTYPE_AES_192;
 92	case 256:
 93		return PKEY_KEYTYPE_AES_256;
 94	default:
 95		return 0;
 96	}
 97}
 98
 99/*
100 * helper function which translates the PKEY_KEYTYPE_*
101 * to the protected key size minus the WK VP length
102 */
103static inline u32 pkey_keytype_to_size(u32 keytype)
104{
105	switch (keytype) {
106	case PKEY_KEYTYPE_AES_128:
107		return 16;
108	case PKEY_KEYTYPE_AES_192:
109		return 24;
110	case PKEY_KEYTYPE_AES_256:
111		return 32;
112	case PKEY_KEYTYPE_ECC_P256:
113		return 32;
114	case PKEY_KEYTYPE_ECC_P384:
115		return 48;
116	case PKEY_KEYTYPE_ECC_P521:
117		return 80;
118	case PKEY_KEYTYPE_ECC_ED25519:
119		return 32;
120	case PKEY_KEYTYPE_ECC_ED448:
121		return 54;
122	case PKEY_KEYTYPE_AES_XTS_128:
123		return 32;
124	case PKEY_KEYTYPE_AES_XTS_256:
125		return 64;
126	case PKEY_KEYTYPE_HMAC_512:
127		return 64;
128	case PKEY_KEYTYPE_HMAC_1024:
129		return 128;
130	default:
131		return 0;
132	}
133}
134
135/*
136 * pkey_api.c:
137 */
138int __init pkey_api_init(void);
139void __exit pkey_api_exit(void);
140
141/*
142 * pkey_sysfs.c:
143 */
144
145extern const struct attribute_group *pkey_attr_groups[];
146
147/*
148 * pkey handler registry
149 */
150
151struct pkey_handler {
152	struct module *module;
153	const char *name;
154	/*
155	 * is_supported_key() and is_supported_keytype() are called
156	 * within an rcu_read_lock() scope and thus must not sleep!
157	 */
158	bool (*is_supported_key)(const u8 *key, u32 keylen);
159	bool (*is_supported_keytype)(enum pkey_key_type);
160	int (*key_to_protkey)(const struct pkey_apqn *apqns, size_t nr_apqns,
161			      const u8 *key, u32 keylen,
162			      u8 *protkey, u32 *protkeylen, u32 *protkeytype,
163			      u32 xflags);
164	int (*slowpath_key_to_protkey)(const struct pkey_apqn *apqns,
165				       size_t nr_apqns,
166				       const u8 *key, u32 keylen,
167				       u8 *protkey, u32 *protkeylen,
168				       u32 *protkeytype, u32 xflags);
169	int (*gen_key)(const struct pkey_apqn *apqns, size_t nr_apqns,
170		       u32 keytype, u32 keysubtype,
171		       u32 keybitsize, u32 flags,
172		       u8 *keybuf, u32 *keybuflen, u32 *keyinfo, u32 xflags);
173	int (*clr_to_key)(const struct pkey_apqn *apqns, size_t nr_apqns,
174			  u32 keytype, u32 keysubtype,
175			  u32 keybitsize, u32 flags,
176			  const u8 *clrkey, u32 clrkeylen,
177			  u8 *keybuf, u32 *keybuflen, u32 *keyinfo, u32 xflags);
178	int (*verify_key)(const u8 *key, u32 keylen,
179			  u16 *card, u16 *dom,
180			  u32 *keytype, u32 *keybitsize, u32 *flags,
181			  u32 xflags);
182	int (*apqns_for_key)(const u8 *key, u32 keylen, u32 flags,
183			     struct pkey_apqn *apqns, size_t *nr_apqns,
184			     u32 xflags);
185	int (*apqns_for_keytype)(enum pkey_key_type ktype,
186				 u8 cur_mkvp[32], u8 alt_mkvp[32], u32 flags,
187				 struct pkey_apqn *apqns, size_t *nr_apqns,
188				 u32 xflags);
189	/* used internal by pkey base */
190	struct list_head list;
191};
192
193int pkey_handler_register(struct pkey_handler *handler);
194int pkey_handler_unregister(struct pkey_handler *handler);
195
196/*
197 * invocation function for the registered pkey handlers
198 */
199
200const struct pkey_handler *pkey_handler_get_keybased(const u8 *key, u32 keylen);
201const struct pkey_handler *pkey_handler_get_keytypebased(enum pkey_key_type kt);
202void pkey_handler_put(const struct pkey_handler *handler);
203
204int pkey_handler_key_to_protkey(const struct pkey_apqn *apqns, size_t nr_apqns,
205				const u8 *key, u32 keylen,
206				u8 *protkey, u32 *protkeylen, u32 *protkeytype,
207				u32 xflags);
208int pkey_handler_slowpath_key_to_protkey(const struct pkey_apqn *apqns,
209					 size_t nr_apqns,
210					 const u8 *key, u32 keylen,
211					 u8 *protkey, u32 *protkeylen,
212					 u32 *protkeytype, u32 xflags);
213int pkey_handler_gen_key(const struct pkey_apqn *apqns, size_t nr_apqns,
214			 u32 keytype, u32 keysubtype,
215			 u32 keybitsize, u32 flags,
216			 u8 *keybuf, u32 *keybuflen, u32 *keyinfo, u32 xflags);
217int pkey_handler_clr_to_key(const struct pkey_apqn *apqns, size_t nr_apqns,
218			    u32 keytype, u32 keysubtype,
219			    u32 keybitsize, u32 flags,
220			    const u8 *clrkey, u32 clrkeylen,
221			    u8 *keybuf, u32 *keybuflen, u32 *keyinfo,
222			    u32 xflags);
223int pkey_handler_verify_key(const u8 *key, u32 keylen,
224			    u16 *card, u16 *dom,
225			    u32 *keytype, u32 *keybitsize, u32 *flags,
226			    u32 xflags);
227int pkey_handler_apqns_for_key(const u8 *key, u32 keylen, u32 flags,
228			       struct pkey_apqn *apqns, size_t *nr_apqns,
229			       u32 xflags);
230int pkey_handler_apqns_for_keytype(enum pkey_key_type ktype,
231				   u8 cur_mkvp[32], u8 alt_mkvp[32], u32 flags,
232				   struct pkey_apqn *apqns, size_t *nr_apqns,
233				   u32 xflags);
234
235/*
236 * Unconditional try to load all handler modules
237 */
238void pkey_handler_request_modules(void);
239
240#endif /* _PKEY_BASE_H_ */