pkey_api.c 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * pkey device driver
  4. *
  5. * Copyright IBM Corp. 2017
  6. * Author(s): Harald Freudenberger
  7. */
  8. #define KMSG_COMPONENT "pkey"
  9. #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  10. #include <linux/fs.h>
  11. #include <linux/init.h>
  12. #include <linux/miscdevice.h>
  13. #include <linux/module.h>
  14. #include <linux/slab.h>
  15. #include <linux/kallsyms.h>
  16. #include <linux/debugfs.h>
  17. #include <asm/zcrypt.h>
  18. #include <asm/cpacf.h>
  19. #include <asm/pkey.h>
  20. #include "zcrypt_api.h"
  21. MODULE_LICENSE("GPL");
  22. MODULE_AUTHOR("IBM Corporation");
  23. MODULE_DESCRIPTION("s390 protected key interface");
  24. /* Size of parameter block used for all cca requests/replies */
  25. #define PARMBSIZE 512
  26. /* Size of vardata block used for some of the cca requests/replies */
  27. #define VARDATASIZE 4096
  28. /*
  29. * debug feature data and functions
  30. */
  31. static debug_info_t *debug_info;
  32. #define DEBUG_DBG(...) debug_sprintf_event(debug_info, 6, ##__VA_ARGS__)
  33. #define DEBUG_INFO(...) debug_sprintf_event(debug_info, 5, ##__VA_ARGS__)
  34. #define DEBUG_WARN(...) debug_sprintf_event(debug_info, 4, ##__VA_ARGS__)
  35. #define DEBUG_ERR(...) debug_sprintf_event(debug_info, 3, ##__VA_ARGS__)
  36. static void __init pkey_debug_init(void)
  37. {
  38. debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long));
  39. debug_register_view(debug_info, &debug_sprintf_view);
  40. debug_set_level(debug_info, 3);
  41. }
  42. static void __exit pkey_debug_exit(void)
  43. {
  44. debug_unregister(debug_info);
  45. }
  46. /* inside view of a secure key token (only type 0x01 version 0x04) */
  47. struct secaeskeytoken {
  48. u8 type; /* 0x01 for internal key token */
  49. u8 res0[3];
  50. u8 version; /* should be 0x04 */
  51. u8 res1[1];
  52. u8 flag; /* key flags */
  53. u8 res2[1];
  54. u64 mkvp; /* master key verification pattern */
  55. u8 key[32]; /* key value (encrypted) */
  56. u8 cv[8]; /* control vector */
  57. u16 bitsize; /* key bit size */
  58. u16 keysize; /* key byte size */
  59. u8 tvv[4]; /* token validation value */
  60. } __packed;
  61. /*
  62. * Simple check if the token is a valid CCA secure AES key
  63. * token. If keybitsize is given, the bitsize of the key is
  64. * also checked. Returns 0 on success or errno value on failure.
  65. */
  66. static int check_secaeskeytoken(const u8 *token, int keybitsize)
  67. {
  68. struct secaeskeytoken *t = (struct secaeskeytoken *) token;
  69. if (t->type != 0x01) {
  70. DEBUG_ERR(
  71. "check_secaeskeytoken secure token check failed, type mismatch 0x%02x != 0x01\n",
  72. (int) t->type);
  73. return -EINVAL;
  74. }
  75. if (t->version != 0x04) {
  76. DEBUG_ERR(
  77. "check_secaeskeytoken secure token check failed, version mismatch 0x%02x != 0x04\n",
  78. (int) t->version);
  79. return -EINVAL;
  80. }
  81. if (keybitsize > 0 && t->bitsize != keybitsize) {
  82. DEBUG_ERR(
  83. "check_secaeskeytoken secure token check failed, bitsize mismatch %d != %d\n",
  84. (int) t->bitsize, keybitsize);
  85. return -EINVAL;
  86. }
  87. return 0;
  88. }
  89. /*
  90. * Allocate consecutive memory for request CPRB, request param
  91. * block, reply CPRB and reply param block and fill in values
  92. * for the common fields. Returns 0 on success or errno value
  93. * on failure.
  94. */
  95. static int alloc_and_prep_cprbmem(size_t paramblen,
  96. u8 **pcprbmem,
  97. struct CPRBX **preqCPRB,
  98. struct CPRBX **prepCPRB)
  99. {
  100. u8 *cprbmem;
  101. size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
  102. struct CPRBX *preqcblk, *prepcblk;
  103. /*
  104. * allocate consecutive memory for request CPRB, request param
  105. * block, reply CPRB and reply param block
  106. */
  107. cprbmem = kzalloc(2 * cprbplusparamblen, GFP_KERNEL);
  108. if (!cprbmem)
  109. return -ENOMEM;
  110. preqcblk = (struct CPRBX *) cprbmem;
  111. prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
  112. /* fill request cprb struct */
  113. preqcblk->cprb_len = sizeof(struct CPRBX);
  114. preqcblk->cprb_ver_id = 0x02;
  115. memcpy(preqcblk->func_id, "T2", 2);
  116. preqcblk->rpl_msgbl = cprbplusparamblen;
  117. if (paramblen) {
  118. preqcblk->req_parmb =
  119. ((u8 *) preqcblk) + sizeof(struct CPRBX);
  120. preqcblk->rpl_parmb =
  121. ((u8 *) prepcblk) + sizeof(struct CPRBX);
  122. }
  123. *pcprbmem = cprbmem;
  124. *preqCPRB = preqcblk;
  125. *prepCPRB = prepcblk;
  126. return 0;
  127. }
  128. /*
  129. * Free the cprb memory allocated with the function above.
  130. * If the scrub value is not zero, the memory is filled
  131. * with zeros before freeing (useful if there was some
  132. * clear key material in there).
  133. */
  134. static void free_cprbmem(void *mem, size_t paramblen, int scrub)
  135. {
  136. if (scrub)
  137. memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
  138. kfree(mem);
  139. }
  140. /*
  141. * Helper function to prepare the xcrb struct
  142. */
  143. static inline void prep_xcrb(struct ica_xcRB *pxcrb,
  144. u16 cardnr,
  145. struct CPRBX *preqcblk,
  146. struct CPRBX *prepcblk)
  147. {
  148. memset(pxcrb, 0, sizeof(*pxcrb));
  149. pxcrb->agent_ID = 0x4341; /* 'CA' */
  150. pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
  151. pxcrb->request_control_blk_length =
  152. preqcblk->cprb_len + preqcblk->req_parml;
  153. pxcrb->request_control_blk_addr = (void __user *) preqcblk;
  154. pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
  155. pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
  156. }
  157. /*
  158. * Helper function which calls zcrypt_send_cprb with
  159. * memory management segment adjusted to kernel space
  160. * so that the copy_from_user called within this
  161. * function do in fact copy from kernel space.
  162. */
  163. static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
  164. {
  165. int rc;
  166. mm_segment_t old_fs = get_fs();
  167. set_fs(KERNEL_DS);
  168. rc = zcrypt_send_cprb(xcrb);
  169. set_fs(old_fs);
  170. return rc;
  171. }
  172. /*
  173. * Generate (random) AES secure key.
  174. */
  175. int pkey_genseckey(u16 cardnr, u16 domain,
  176. u32 keytype, struct pkey_seckey *seckey)
  177. {
  178. int i, rc, keysize;
  179. int seckeysize;
  180. u8 *mem;
  181. struct CPRBX *preqcblk, *prepcblk;
  182. struct ica_xcRB xcrb;
  183. struct kgreqparm {
  184. u8 subfunc_code[2];
  185. u16 rule_array_len;
  186. struct lv1 {
  187. u16 len;
  188. char key_form[8];
  189. char key_length[8];
  190. char key_type1[8];
  191. char key_type2[8];
  192. } lv1;
  193. struct lv2 {
  194. u16 len;
  195. struct keyid {
  196. u16 len;
  197. u16 attr;
  198. u8 data[SECKEYBLOBSIZE];
  199. } keyid[6];
  200. } lv2;
  201. } *preqparm;
  202. struct kgrepparm {
  203. u8 subfunc_code[2];
  204. u16 rule_array_len;
  205. struct lv3 {
  206. u16 len;
  207. u16 keyblocklen;
  208. struct {
  209. u16 toklen;
  210. u16 tokattr;
  211. u8 tok[0];
  212. /* ... some more data ... */
  213. } keyblock;
  214. } lv3;
  215. } *prepparm;
  216. /* get already prepared memory for 2 cprbs with param block each */
  217. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  218. if (rc)
  219. return rc;
  220. /* fill request cprb struct */
  221. preqcblk->domain = domain;
  222. /* fill request cprb param block with KG request */
  223. preqparm = (struct kgreqparm *) preqcblk->req_parmb;
  224. memcpy(preqparm->subfunc_code, "KG", 2);
  225. preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
  226. preqparm->lv1.len = sizeof(struct lv1);
  227. memcpy(preqparm->lv1.key_form, "OP ", 8);
  228. switch (keytype) {
  229. case PKEY_KEYTYPE_AES_128:
  230. keysize = 16;
  231. memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
  232. break;
  233. case PKEY_KEYTYPE_AES_192:
  234. keysize = 24;
  235. memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
  236. break;
  237. case PKEY_KEYTYPE_AES_256:
  238. keysize = 32;
  239. memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
  240. break;
  241. default:
  242. DEBUG_ERR(
  243. "pkey_genseckey unknown/unsupported keytype %d\n",
  244. keytype);
  245. rc = -EINVAL;
  246. goto out;
  247. }
  248. memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
  249. preqparm->lv2.len = sizeof(struct lv2);
  250. for (i = 0; i < 6; i++) {
  251. preqparm->lv2.keyid[i].len = sizeof(struct keyid);
  252. preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
  253. }
  254. preqcblk->req_parml = sizeof(struct kgreqparm);
  255. /* fill xcrb struct */
  256. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  257. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  258. rc = _zcrypt_send_cprb(&xcrb);
  259. if (rc) {
  260. DEBUG_ERR(
  261. "pkey_genseckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
  262. (int) cardnr, (int) domain, rc);
  263. goto out;
  264. }
  265. /* check response returncode and reasoncode */
  266. if (prepcblk->ccp_rtcode != 0) {
  267. DEBUG_ERR(
  268. "pkey_genseckey secure key generate failure, card response %d/%d\n",
  269. (int) prepcblk->ccp_rtcode,
  270. (int) prepcblk->ccp_rscode);
  271. rc = -EIO;
  272. goto out;
  273. }
  274. /* process response cprb param block */
  275. prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  276. prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
  277. /* check length of the returned secure key token */
  278. seckeysize = prepparm->lv3.keyblock.toklen
  279. - sizeof(prepparm->lv3.keyblock.toklen)
  280. - sizeof(prepparm->lv3.keyblock.tokattr);
  281. if (seckeysize != SECKEYBLOBSIZE) {
  282. DEBUG_ERR(
  283. "pkey_genseckey secure token size mismatch %d != %d bytes\n",
  284. seckeysize, SECKEYBLOBSIZE);
  285. rc = -EIO;
  286. goto out;
  287. }
  288. /* check secure key token */
  289. rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
  290. if (rc) {
  291. rc = -EIO;
  292. goto out;
  293. }
  294. /* copy the generated secure key token */
  295. memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
  296. out:
  297. free_cprbmem(mem, PARMBSIZE, 0);
  298. return rc;
  299. }
  300. EXPORT_SYMBOL(pkey_genseckey);
  301. /*
  302. * Generate an AES secure key with given key value.
  303. */
  304. int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
  305. const struct pkey_clrkey *clrkey,
  306. struct pkey_seckey *seckey)
  307. {
  308. int rc, keysize, seckeysize;
  309. u8 *mem;
  310. struct CPRBX *preqcblk, *prepcblk;
  311. struct ica_xcRB xcrb;
  312. struct cmreqparm {
  313. u8 subfunc_code[2];
  314. u16 rule_array_len;
  315. char rule_array[8];
  316. struct lv1 {
  317. u16 len;
  318. u8 clrkey[0];
  319. } lv1;
  320. struct lv2 {
  321. u16 len;
  322. struct keyid {
  323. u16 len;
  324. u16 attr;
  325. u8 data[SECKEYBLOBSIZE];
  326. } keyid;
  327. } lv2;
  328. } *preqparm;
  329. struct lv2 *plv2;
  330. struct cmrepparm {
  331. u8 subfunc_code[2];
  332. u16 rule_array_len;
  333. struct lv3 {
  334. u16 len;
  335. u16 keyblocklen;
  336. struct {
  337. u16 toklen;
  338. u16 tokattr;
  339. u8 tok[0];
  340. /* ... some more data ... */
  341. } keyblock;
  342. } lv3;
  343. } *prepparm;
  344. /* get already prepared memory for 2 cprbs with param block each */
  345. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  346. if (rc)
  347. return rc;
  348. /* fill request cprb struct */
  349. preqcblk->domain = domain;
  350. /* fill request cprb param block with CM request */
  351. preqparm = (struct cmreqparm *) preqcblk->req_parmb;
  352. memcpy(preqparm->subfunc_code, "CM", 2);
  353. memcpy(preqparm->rule_array, "AES ", 8);
  354. preqparm->rule_array_len =
  355. sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
  356. switch (keytype) {
  357. case PKEY_KEYTYPE_AES_128:
  358. keysize = 16;
  359. break;
  360. case PKEY_KEYTYPE_AES_192:
  361. keysize = 24;
  362. break;
  363. case PKEY_KEYTYPE_AES_256:
  364. keysize = 32;
  365. break;
  366. default:
  367. DEBUG_ERR(
  368. "pkey_clr2seckey unknown/unsupported keytype %d\n",
  369. keytype);
  370. rc = -EINVAL;
  371. goto out;
  372. }
  373. preqparm->lv1.len = sizeof(struct lv1) + keysize;
  374. memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize);
  375. plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
  376. plv2->len = sizeof(struct lv2);
  377. plv2->keyid.len = sizeof(struct keyid);
  378. plv2->keyid.attr = 0x30;
  379. preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
  380. /* fill xcrb struct */
  381. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  382. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  383. rc = _zcrypt_send_cprb(&xcrb);
  384. if (rc) {
  385. DEBUG_ERR(
  386. "pkey_clr2seckey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
  387. (int) cardnr, (int) domain, rc);
  388. goto out;
  389. }
  390. /* check response returncode and reasoncode */
  391. if (prepcblk->ccp_rtcode != 0) {
  392. DEBUG_ERR(
  393. "pkey_clr2seckey clear key import failure, card response %d/%d\n",
  394. (int) prepcblk->ccp_rtcode,
  395. (int) prepcblk->ccp_rscode);
  396. rc = -EIO;
  397. goto out;
  398. }
  399. /* process response cprb param block */
  400. prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  401. prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
  402. /* check length of the returned secure key token */
  403. seckeysize = prepparm->lv3.keyblock.toklen
  404. - sizeof(prepparm->lv3.keyblock.toklen)
  405. - sizeof(prepparm->lv3.keyblock.tokattr);
  406. if (seckeysize != SECKEYBLOBSIZE) {
  407. DEBUG_ERR(
  408. "pkey_clr2seckey secure token size mismatch %d != %d bytes\n",
  409. seckeysize, SECKEYBLOBSIZE);
  410. rc = -EIO;
  411. goto out;
  412. }
  413. /* check secure key token */
  414. rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
  415. if (rc) {
  416. rc = -EIO;
  417. goto out;
  418. }
  419. /* copy the generated secure key token */
  420. memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
  421. out:
  422. free_cprbmem(mem, PARMBSIZE, 1);
  423. return rc;
  424. }
  425. EXPORT_SYMBOL(pkey_clr2seckey);
  426. /*
  427. * Derive a proteced key from the secure key blob.
  428. */
  429. int pkey_sec2protkey(u16 cardnr, u16 domain,
  430. const struct pkey_seckey *seckey,
  431. struct pkey_protkey *protkey)
  432. {
  433. int rc;
  434. u8 *mem;
  435. struct CPRBX *preqcblk, *prepcblk;
  436. struct ica_xcRB xcrb;
  437. struct uskreqparm {
  438. u8 subfunc_code[2];
  439. u16 rule_array_len;
  440. struct lv1 {
  441. u16 len;
  442. u16 attr_len;
  443. u16 attr_flags;
  444. } lv1;
  445. struct lv2 {
  446. u16 len;
  447. u16 attr_len;
  448. u16 attr_flags;
  449. u8 token[0]; /* cca secure key token */
  450. } lv2 __packed;
  451. } *preqparm;
  452. struct uskrepparm {
  453. u8 subfunc_code[2];
  454. u16 rule_array_len;
  455. struct lv3 {
  456. u16 len;
  457. u16 attr_len;
  458. u16 attr_flags;
  459. struct cpacfkeyblock {
  460. u8 version; /* version of this struct */
  461. u8 flags[2];
  462. u8 algo;
  463. u8 form;
  464. u8 pad1[3];
  465. u16 keylen;
  466. u8 key[64]; /* the key (keylen bytes) */
  467. u16 keyattrlen;
  468. u8 keyattr[32];
  469. u8 pad2[1];
  470. u8 vptype;
  471. u8 vp[32]; /* verification pattern */
  472. } keyblock;
  473. } lv3 __packed;
  474. } *prepparm;
  475. /* get already prepared memory for 2 cprbs with param block each */
  476. rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
  477. if (rc)
  478. return rc;
  479. /* fill request cprb struct */
  480. preqcblk->domain = domain;
  481. /* fill request cprb param block with USK request */
  482. preqparm = (struct uskreqparm *) preqcblk->req_parmb;
  483. memcpy(preqparm->subfunc_code, "US", 2);
  484. preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
  485. preqparm->lv1.len = sizeof(struct lv1);
  486. preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
  487. preqparm->lv1.attr_flags = 0x0001;
  488. preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
  489. preqparm->lv2.attr_len = sizeof(struct lv2)
  490. - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
  491. preqparm->lv2.attr_flags = 0x0000;
  492. memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE);
  493. preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
  494. /* fill xcrb struct */
  495. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  496. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  497. rc = _zcrypt_send_cprb(&xcrb);
  498. if (rc) {
  499. DEBUG_ERR(
  500. "pkey_sec2protkey zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
  501. (int) cardnr, (int) domain, rc);
  502. goto out;
  503. }
  504. /* check response returncode and reasoncode */
  505. if (prepcblk->ccp_rtcode != 0) {
  506. DEBUG_ERR(
  507. "pkey_sec2protkey unwrap secure key failure, card response %d/%d\n",
  508. (int) prepcblk->ccp_rtcode,
  509. (int) prepcblk->ccp_rscode);
  510. rc = -EIO;
  511. goto out;
  512. }
  513. if (prepcblk->ccp_rscode != 0) {
  514. DEBUG_WARN(
  515. "pkey_sec2protkey unwrap secure key warning, card response %d/%d\n",
  516. (int) prepcblk->ccp_rtcode,
  517. (int) prepcblk->ccp_rscode);
  518. }
  519. /* process response cprb param block */
  520. prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  521. prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
  522. /* check the returned keyblock */
  523. if (prepparm->lv3.keyblock.version != 0x01) {
  524. DEBUG_ERR(
  525. "pkey_sec2protkey reply param keyblock version mismatch 0x%02x != 0x01\n",
  526. (int) prepparm->lv3.keyblock.version);
  527. rc = -EIO;
  528. goto out;
  529. }
  530. /* copy the tanslated protected key */
  531. switch (prepparm->lv3.keyblock.keylen) {
  532. case 16+32:
  533. protkey->type = PKEY_KEYTYPE_AES_128;
  534. break;
  535. case 24+32:
  536. protkey->type = PKEY_KEYTYPE_AES_192;
  537. break;
  538. case 32+32:
  539. protkey->type = PKEY_KEYTYPE_AES_256;
  540. break;
  541. default:
  542. DEBUG_ERR("pkey_sec2protkey unknown/unsupported keytype %d\n",
  543. prepparm->lv3.keyblock.keylen);
  544. rc = -EIO;
  545. goto out;
  546. }
  547. protkey->len = prepparm->lv3.keyblock.keylen;
  548. memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len);
  549. out:
  550. free_cprbmem(mem, PARMBSIZE, 0);
  551. return rc;
  552. }
  553. EXPORT_SYMBOL(pkey_sec2protkey);
  554. /*
  555. * Create a protected key from a clear key value.
  556. */
  557. int pkey_clr2protkey(u32 keytype,
  558. const struct pkey_clrkey *clrkey,
  559. struct pkey_protkey *protkey)
  560. {
  561. long fc;
  562. int keysize;
  563. u8 paramblock[64];
  564. switch (keytype) {
  565. case PKEY_KEYTYPE_AES_128:
  566. keysize = 16;
  567. fc = CPACF_PCKMO_ENC_AES_128_KEY;
  568. break;
  569. case PKEY_KEYTYPE_AES_192:
  570. keysize = 24;
  571. fc = CPACF_PCKMO_ENC_AES_192_KEY;
  572. break;
  573. case PKEY_KEYTYPE_AES_256:
  574. keysize = 32;
  575. fc = CPACF_PCKMO_ENC_AES_256_KEY;
  576. break;
  577. default:
  578. DEBUG_ERR("pkey_clr2protkey unknown/unsupported keytype %d\n",
  579. keytype);
  580. return -EINVAL;
  581. }
  582. /* prepare param block */
  583. memset(paramblock, 0, sizeof(paramblock));
  584. memcpy(paramblock, clrkey->clrkey, keysize);
  585. /* call the pckmo instruction */
  586. cpacf_pckmo(fc, paramblock);
  587. /* copy created protected key */
  588. protkey->type = keytype;
  589. protkey->len = keysize + 32;
  590. memcpy(protkey->protkey, paramblock, keysize + 32);
  591. return 0;
  592. }
  593. EXPORT_SYMBOL(pkey_clr2protkey);
  594. /*
  595. * query cryptographic facility from adapter
  596. */
  597. static int query_crypto_facility(u16 cardnr, u16 domain,
  598. const char *keyword,
  599. u8 *rarray, size_t *rarraylen,
  600. u8 *varray, size_t *varraylen)
  601. {
  602. int rc;
  603. u16 len;
  604. u8 *mem, *ptr;
  605. struct CPRBX *preqcblk, *prepcblk;
  606. struct ica_xcRB xcrb;
  607. struct fqreqparm {
  608. u8 subfunc_code[2];
  609. u16 rule_array_len;
  610. char rule_array[8];
  611. struct lv1 {
  612. u16 len;
  613. u8 data[VARDATASIZE];
  614. } lv1;
  615. u16 dummylen;
  616. } *preqparm;
  617. size_t parmbsize = sizeof(struct fqreqparm);
  618. struct fqrepparm {
  619. u8 subfunc_code[2];
  620. u8 lvdata[0];
  621. } *prepparm;
  622. /* get already prepared memory for 2 cprbs with param block each */
  623. rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
  624. if (rc)
  625. return rc;
  626. /* fill request cprb struct */
  627. preqcblk->domain = domain;
  628. /* fill request cprb param block with FQ request */
  629. preqparm = (struct fqreqparm *) preqcblk->req_parmb;
  630. memcpy(preqparm->subfunc_code, "FQ", 2);
  631. strncpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
  632. preqparm->rule_array_len =
  633. sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
  634. preqparm->lv1.len = sizeof(preqparm->lv1);
  635. preqparm->dummylen = sizeof(preqparm->dummylen);
  636. preqcblk->req_parml = parmbsize;
  637. /* fill xcrb struct */
  638. prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
  639. /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
  640. rc = _zcrypt_send_cprb(&xcrb);
  641. if (rc) {
  642. DEBUG_ERR(
  643. "query_crypto_facility zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
  644. (int) cardnr, (int) domain, rc);
  645. goto out;
  646. }
  647. /* check response returncode and reasoncode */
  648. if (prepcblk->ccp_rtcode != 0) {
  649. DEBUG_ERR(
  650. "query_crypto_facility unwrap secure key failure, card response %d/%d\n",
  651. (int) prepcblk->ccp_rtcode,
  652. (int) prepcblk->ccp_rscode);
  653. rc = -EIO;
  654. goto out;
  655. }
  656. /* process response cprb param block */
  657. prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
  658. prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
  659. ptr = prepparm->lvdata;
  660. /* check and possibly copy reply rule array */
  661. len = *((u16 *) ptr);
  662. if (len > sizeof(u16)) {
  663. ptr += sizeof(u16);
  664. len -= sizeof(u16);
  665. if (rarray && rarraylen && *rarraylen > 0) {
  666. *rarraylen = (len > *rarraylen ? *rarraylen : len);
  667. memcpy(rarray, ptr, *rarraylen);
  668. }
  669. ptr += len;
  670. }
  671. /* check and possible copy reply var array */
  672. len = *((u16 *) ptr);
  673. if (len > sizeof(u16)) {
  674. ptr += sizeof(u16);
  675. len -= sizeof(u16);
  676. if (varray && varraylen && *varraylen > 0) {
  677. *varraylen = (len > *varraylen ? *varraylen : len);
  678. memcpy(varray, ptr, *varraylen);
  679. }
  680. ptr += len;
  681. }
  682. out:
  683. free_cprbmem(mem, parmbsize, 0);
  684. return rc;
  685. }
  686. /*
  687. * Fetch the current and old mkvp values via
  688. * query_crypto_facility from adapter.
  689. */
  690. static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
  691. {
  692. int rc, found = 0;
  693. size_t rlen, vlen;
  694. u8 *rarray, *varray, *pg;
  695. pg = (u8 *) __get_free_page(GFP_KERNEL);
  696. if (!pg)
  697. return -ENOMEM;
  698. rarray = pg;
  699. varray = pg + PAGE_SIZE/2;
  700. rlen = vlen = PAGE_SIZE/2;
  701. rc = query_crypto_facility(cardnr, domain, "STATICSA",
  702. rarray, &rlen, varray, &vlen);
  703. if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
  704. if (rarray[8*8] == '2') {
  705. /* current master key state is valid */
  706. mkvp[0] = *((u64 *)(varray + 184));
  707. mkvp[1] = *((u64 *)(varray + 172));
  708. found = 1;
  709. }
  710. }
  711. free_page((unsigned long) pg);
  712. return found ? 0 : -ENOENT;
  713. }
  714. /* struct to hold cached mkvp info for each card/domain */
  715. struct mkvp_info {
  716. struct list_head list;
  717. u16 cardnr;
  718. u16 domain;
  719. u64 mkvp[2];
  720. };
  721. /* a list with mkvp_info entries */
  722. static LIST_HEAD(mkvp_list);
  723. static DEFINE_SPINLOCK(mkvp_list_lock);
  724. static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
  725. {
  726. int rc = -ENOENT;
  727. struct mkvp_info *ptr;
  728. spin_lock_bh(&mkvp_list_lock);
  729. list_for_each_entry(ptr, &mkvp_list, list) {
  730. if (ptr->cardnr == cardnr &&
  731. ptr->domain == domain) {
  732. memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
  733. rc = 0;
  734. break;
  735. }
  736. }
  737. spin_unlock_bh(&mkvp_list_lock);
  738. return rc;
  739. }
  740. static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
  741. {
  742. int found = 0;
  743. struct mkvp_info *ptr;
  744. spin_lock_bh(&mkvp_list_lock);
  745. list_for_each_entry(ptr, &mkvp_list, list) {
  746. if (ptr->cardnr == cardnr &&
  747. ptr->domain == domain) {
  748. memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
  749. found = 1;
  750. break;
  751. }
  752. }
  753. if (!found) {
  754. ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
  755. if (!ptr) {
  756. spin_unlock_bh(&mkvp_list_lock);
  757. return;
  758. }
  759. ptr->cardnr = cardnr;
  760. ptr->domain = domain;
  761. memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
  762. list_add(&ptr->list, &mkvp_list);
  763. }
  764. spin_unlock_bh(&mkvp_list_lock);
  765. }
  766. static void mkvp_cache_scrub(u16 cardnr, u16 domain)
  767. {
  768. struct mkvp_info *ptr;
  769. spin_lock_bh(&mkvp_list_lock);
  770. list_for_each_entry(ptr, &mkvp_list, list) {
  771. if (ptr->cardnr == cardnr &&
  772. ptr->domain == domain) {
  773. list_del(&ptr->list);
  774. kfree(ptr);
  775. break;
  776. }
  777. }
  778. spin_unlock_bh(&mkvp_list_lock);
  779. }
  780. static void __exit mkvp_cache_free(void)
  781. {
  782. struct mkvp_info *ptr, *pnext;
  783. spin_lock_bh(&mkvp_list_lock);
  784. list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) {
  785. list_del(&ptr->list);
  786. kfree(ptr);
  787. }
  788. spin_unlock_bh(&mkvp_list_lock);
  789. }
  790. /*
  791. * Search for a matching crypto card based on the Master Key
  792. * Verification Pattern provided inside a secure key.
  793. */
  794. int pkey_findcard(const struct pkey_seckey *seckey,
  795. u16 *pcardnr, u16 *pdomain, int verify)
  796. {
  797. struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
  798. struct zcrypt_device_status_ext *device_status;
  799. u16 card, dom;
  800. u64 mkvp[2];
  801. int i, rc, oi = -1;
  802. /* mkvp must not be zero */
  803. if (t->mkvp == 0)
  804. return -EINVAL;
  805. /* fetch status of all crypto cards */
  806. device_status = kmalloc(MAX_ZDEV_ENTRIES_EXT
  807. * sizeof(struct zcrypt_device_status_ext),
  808. GFP_KERNEL);
  809. if (!device_status)
  810. return -ENOMEM;
  811. zcrypt_device_status_mask_ext(device_status);
  812. /* walk through all crypto cards */
  813. for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
  814. card = AP_QID_CARD(device_status[i].qid);
  815. dom = AP_QID_QUEUE(device_status[i].qid);
  816. if (device_status[i].online &&
  817. device_status[i].functions & 0x04) {
  818. /* an enabled CCA Coprocessor card */
  819. /* try cached mkvp */
  820. if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
  821. t->mkvp == mkvp[0]) {
  822. if (!verify)
  823. break;
  824. /* verify: fetch mkvp from adapter */
  825. if (fetch_mkvp(card, dom, mkvp) == 0) {
  826. mkvp_cache_update(card, dom, mkvp);
  827. if (t->mkvp == mkvp[0])
  828. break;
  829. }
  830. }
  831. } else {
  832. /* Card is offline and/or not a CCA card. */
  833. /* del mkvp entry from cache if it exists */
  834. mkvp_cache_scrub(card, dom);
  835. }
  836. }
  837. if (i >= MAX_ZDEV_ENTRIES_EXT) {
  838. /* nothing found, so this time without cache */
  839. for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
  840. if (!(device_status[i].online &&
  841. device_status[i].functions & 0x04))
  842. continue;
  843. card = AP_QID_CARD(device_status[i].qid);
  844. dom = AP_QID_QUEUE(device_status[i].qid);
  845. /* fresh fetch mkvp from adapter */
  846. if (fetch_mkvp(card, dom, mkvp) == 0) {
  847. mkvp_cache_update(card, dom, mkvp);
  848. if (t->mkvp == mkvp[0])
  849. break;
  850. if (t->mkvp == mkvp[1] && oi < 0)
  851. oi = i;
  852. }
  853. }
  854. if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
  855. /* old mkvp matched, use this card then */
  856. card = AP_QID_CARD(device_status[oi].qid);
  857. dom = AP_QID_QUEUE(device_status[oi].qid);
  858. }
  859. }
  860. if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
  861. if (pcardnr)
  862. *pcardnr = card;
  863. if (pdomain)
  864. *pdomain = dom;
  865. rc = 0;
  866. } else
  867. rc = -ENODEV;
  868. kfree(device_status);
  869. return rc;
  870. }
  871. EXPORT_SYMBOL(pkey_findcard);
  872. /*
  873. * Find card and transform secure key into protected key.
  874. */
  875. int pkey_skey2pkey(const struct pkey_seckey *seckey,
  876. struct pkey_protkey *protkey)
  877. {
  878. u16 cardnr, domain;
  879. int rc, verify;
  880. /*
  881. * The pkey_sec2protkey call may fail when a card has been
  882. * addressed where the master key was changed after last fetch
  883. * of the mkvp into the cache. So first try without verify then
  884. * with verify enabled (thus refreshing the mkvp for each card).
  885. */
  886. for (verify = 0; verify < 2; verify++) {
  887. rc = pkey_findcard(seckey, &cardnr, &domain, verify);
  888. if (rc)
  889. continue;
  890. rc = pkey_sec2protkey(cardnr, domain, seckey, protkey);
  891. if (rc == 0)
  892. break;
  893. }
  894. if (rc)
  895. DEBUG_DBG("pkey_skey2pkey failed rc=%d\n", rc);
  896. return rc;
  897. }
  898. EXPORT_SYMBOL(pkey_skey2pkey);
  899. /*
  900. * Verify key and give back some info about the key.
  901. */
  902. int pkey_verifykey(const struct pkey_seckey *seckey,
  903. u16 *pcardnr, u16 *pdomain,
  904. u16 *pkeysize, u32 *pattributes)
  905. {
  906. struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
  907. u16 cardnr, domain;
  908. u64 mkvp[2];
  909. int rc;
  910. /* check the secure key for valid AES secure key */
  911. rc = check_secaeskeytoken((u8 *) seckey, 0);
  912. if (rc)
  913. goto out;
  914. if (pattributes)
  915. *pattributes = PKEY_VERIFY_ATTR_AES;
  916. if (pkeysize)
  917. *pkeysize = t->bitsize;
  918. /* try to find a card which can handle this key */
  919. rc = pkey_findcard(seckey, &cardnr, &domain, 1);
  920. if (rc)
  921. goto out;
  922. /* check mkvp for old mkvp match */
  923. rc = mkvp_cache_fetch(cardnr, domain, mkvp);
  924. if (rc)
  925. goto out;
  926. if (t->mkvp == mkvp[1]) {
  927. DEBUG_DBG("pkey_verifykey secure key has old mkvp\n");
  928. if (pattributes)
  929. *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
  930. }
  931. if (pcardnr)
  932. *pcardnr = cardnr;
  933. if (pdomain)
  934. *pdomain = domain;
  935. out:
  936. DEBUG_DBG("pkey_verifykey rc=%d\n", rc);
  937. return rc;
  938. }
  939. EXPORT_SYMBOL(pkey_verifykey);
  940. /*
  941. * File io functions
  942. */
  943. static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
  944. unsigned long arg)
  945. {
  946. int rc;
  947. switch (cmd) {
  948. case PKEY_GENSECK: {
  949. struct pkey_genseck __user *ugs = (void __user *) arg;
  950. struct pkey_genseck kgs;
  951. if (copy_from_user(&kgs, ugs, sizeof(kgs)))
  952. return -EFAULT;
  953. rc = pkey_genseckey(kgs.cardnr, kgs.domain,
  954. kgs.keytype, &kgs.seckey);
  955. DEBUG_DBG("pkey_ioctl pkey_genseckey()=%d\n", rc);
  956. if (rc)
  957. break;
  958. if (copy_to_user(ugs, &kgs, sizeof(kgs)))
  959. return -EFAULT;
  960. break;
  961. }
  962. case PKEY_CLR2SECK: {
  963. struct pkey_clr2seck __user *ucs = (void __user *) arg;
  964. struct pkey_clr2seck kcs;
  965. if (copy_from_user(&kcs, ucs, sizeof(kcs)))
  966. return -EFAULT;
  967. rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
  968. &kcs.clrkey, &kcs.seckey);
  969. DEBUG_DBG("pkey_ioctl pkey_clr2seckey()=%d\n", rc);
  970. if (rc)
  971. break;
  972. if (copy_to_user(ucs, &kcs, sizeof(kcs)))
  973. return -EFAULT;
  974. memzero_explicit(&kcs, sizeof(kcs));
  975. break;
  976. }
  977. case PKEY_SEC2PROTK: {
  978. struct pkey_sec2protk __user *usp = (void __user *) arg;
  979. struct pkey_sec2protk ksp;
  980. if (copy_from_user(&ksp, usp, sizeof(ksp)))
  981. return -EFAULT;
  982. rc = pkey_sec2protkey(ksp.cardnr, ksp.domain,
  983. &ksp.seckey, &ksp.protkey);
  984. DEBUG_DBG("pkey_ioctl pkey_sec2protkey()=%d\n", rc);
  985. if (rc)
  986. break;
  987. if (copy_to_user(usp, &ksp, sizeof(ksp)))
  988. return -EFAULT;
  989. break;
  990. }
  991. case PKEY_CLR2PROTK: {
  992. struct pkey_clr2protk __user *ucp = (void __user *) arg;
  993. struct pkey_clr2protk kcp;
  994. if (copy_from_user(&kcp, ucp, sizeof(kcp)))
  995. return -EFAULT;
  996. rc = pkey_clr2protkey(kcp.keytype,
  997. &kcp.clrkey, &kcp.protkey);
  998. DEBUG_DBG("pkey_ioctl pkey_clr2protkey()=%d\n", rc);
  999. if (rc)
  1000. break;
  1001. if (copy_to_user(ucp, &kcp, sizeof(kcp)))
  1002. return -EFAULT;
  1003. memzero_explicit(&kcp, sizeof(kcp));
  1004. break;
  1005. }
  1006. case PKEY_FINDCARD: {
  1007. struct pkey_findcard __user *ufc = (void __user *) arg;
  1008. struct pkey_findcard kfc;
  1009. if (copy_from_user(&kfc, ufc, sizeof(kfc)))
  1010. return -EFAULT;
  1011. rc = pkey_findcard(&kfc.seckey,
  1012. &kfc.cardnr, &kfc.domain, 1);
  1013. DEBUG_DBG("pkey_ioctl pkey_findcard()=%d\n", rc);
  1014. if (rc)
  1015. break;
  1016. if (copy_to_user(ufc, &kfc, sizeof(kfc)))
  1017. return -EFAULT;
  1018. break;
  1019. }
  1020. case PKEY_SKEY2PKEY: {
  1021. struct pkey_skey2pkey __user *usp = (void __user *) arg;
  1022. struct pkey_skey2pkey ksp;
  1023. if (copy_from_user(&ksp, usp, sizeof(ksp)))
  1024. return -EFAULT;
  1025. rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey);
  1026. DEBUG_DBG("pkey_ioctl pkey_skey2pkey()=%d\n", rc);
  1027. if (rc)
  1028. break;
  1029. if (copy_to_user(usp, &ksp, sizeof(ksp)))
  1030. return -EFAULT;
  1031. break;
  1032. }
  1033. case PKEY_VERIFYKEY: {
  1034. struct pkey_verifykey __user *uvk = (void __user *) arg;
  1035. struct pkey_verifykey kvk;
  1036. if (copy_from_user(&kvk, uvk, sizeof(kvk)))
  1037. return -EFAULT;
  1038. rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
  1039. &kvk.keysize, &kvk.attributes);
  1040. DEBUG_DBG("pkey_ioctl pkey_verifykey()=%d\n", rc);
  1041. if (rc)
  1042. break;
  1043. if (copy_to_user(uvk, &kvk, sizeof(kvk)))
  1044. return -EFAULT;
  1045. break;
  1046. }
  1047. default:
  1048. /* unknown/unsupported ioctl cmd */
  1049. return -ENOTTY;
  1050. }
  1051. return rc;
  1052. }
  1053. /*
  1054. * Sysfs and file io operations
  1055. */
  1056. static const struct file_operations pkey_fops = {
  1057. .owner = THIS_MODULE,
  1058. .open = nonseekable_open,
  1059. .llseek = no_llseek,
  1060. .unlocked_ioctl = pkey_unlocked_ioctl,
  1061. };
  1062. static struct miscdevice pkey_dev = {
  1063. .name = "pkey",
  1064. .minor = MISC_DYNAMIC_MINOR,
  1065. .mode = 0666,
  1066. .fops = &pkey_fops,
  1067. };
  1068. /*
  1069. * Module init
  1070. */
  1071. static int __init pkey_init(void)
  1072. {
  1073. cpacf_mask_t pckmo_functions;
  1074. /* check for pckmo instructions available */
  1075. if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
  1076. return -EOPNOTSUPP;
  1077. if (!cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_128_KEY) ||
  1078. !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_192_KEY) ||
  1079. !cpacf_test_func(&pckmo_functions, CPACF_PCKMO_ENC_AES_256_KEY))
  1080. return -EOPNOTSUPP;
  1081. pkey_debug_init();
  1082. return misc_register(&pkey_dev);
  1083. }
  1084. /*
  1085. * Module exit
  1086. */
  1087. static void __exit pkey_exit(void)
  1088. {
  1089. misc_deregister(&pkey_dev);
  1090. mkvp_cache_free();
  1091. pkey_debug_exit();
  1092. }
  1093. module_init(pkey_init);
  1094. module_exit(pkey_exit);