1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright IBM Corp. 2019
4 * Author(s): Harald Freudenberger <freude@linux.ibm.com>
5 * Ingo Franzki <ifranzki@linux.ibm.com>
7 * Collection of CCA misc functions used by zcrypt and pkey
10 #define KMSG_COMPONENT "zcrypt"
11 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/slab.h>
16 #include <asm/zcrypt.h>
20 #include "zcrypt_api.h"
21 #include "zcrypt_debug.h"
22 #include "zcrypt_msgtype6.h"
23 #include "zcrypt_ccamisc.h"
25 #define DEBUG_DBG(...) ZCRYPT_DBF(DBF_DEBUG, ##__VA_ARGS__)
26 #define DEBUG_INFO(...) ZCRYPT_DBF(DBF_INFO, ##__VA_ARGS__)
27 #define DEBUG_WARN(...) ZCRYPT_DBF(DBF_WARN, ##__VA_ARGS__)
28 #define DEBUG_ERR(...) ZCRYPT_DBF(DBF_ERR, ##__VA_ARGS__)
30 /* Size of parameter block used for all cca requests/replies */
33 /* Size of vardata block used for some of the cca requests/replies */
34 #define VARDATASIZE 4096
36 struct cca_info_list_entry {
37 struct list_head list;
43 /* a list with cca_info_list_entry entries */
44 static LIST_HEAD(cca_info_list);
45 static DEFINE_SPINLOCK(cca_info_list_lock);
48 * Simple check if the token is a valid CCA secure AES key
49 * token. If keybitsize is given, the bitsize of the key is
50 * also checked. Returns 0 on success or errno value on failure.
52 int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,
53 const u8 *token, int keybitsize)
56 struct secaeskeytoken *t = (struct secaeskeytoken *) token;
58 #define DBF(...) debug_sprintf_event(dbg, dbflvl, ##__VA_ARGS__)
60 if (t->type != TOKTYPE_CCA_INTERNAL) {
62 DBF("%s token check failed, type 0x%02x != 0x%02x\n",
63 __func__, (int) t->type, TOKTYPE_CCA_INTERNAL);
66 if (t->version != TOKVER_CCA_AES) {
68 DBF("%s token check failed, version 0x%02x != 0x%02x\n",
69 __func__, (int) t->version, TOKVER_CCA_AES);
72 if (keybitsize > 0 && t->bitsize != keybitsize) {
74 DBF("%s token check failed, bitsize %d != %d\n",
75 __func__, (int) t->bitsize, keybitsize);
83 EXPORT_SYMBOL(cca_check_secaeskeytoken);
86 * Allocate consecutive memory for request CPRB, request param
87 * block, reply CPRB and reply param block and fill in values
88 * for the common fields. Returns 0 on success or errno value
91 static int alloc_and_prep_cprbmem(size_t paramblen,
93 struct CPRBX **preqCPRB,
94 struct CPRBX **prepCPRB)
97 size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
98 struct CPRBX *preqcblk, *prepcblk;
101 * allocate consecutive memory for request CPRB, request param
102 * block, reply CPRB and reply param block
104 cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
108 preqcblk = (struct CPRBX *) cprbmem;
109 prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
111 /* fill request cprb struct */
112 preqcblk->cprb_len = sizeof(struct CPRBX);
113 preqcblk->cprb_ver_id = 0x02;
114 memcpy(preqcblk->func_id, "T2", 2);
115 preqcblk->rpl_msgbl = cprbplusparamblen;
117 preqcblk->req_parmb =
118 ((u8 *) preqcblk) + sizeof(struct CPRBX);
119 preqcblk->rpl_parmb =
120 ((u8 *) prepcblk) + sizeof(struct CPRBX);
124 *preqCPRB = preqcblk;
125 *prepCPRB = prepcblk;
131 * Free the cprb memory allocated with the function above.
132 * If the scrub value is not zero, the memory is filled
133 * with zeros before freeing (useful if there was some
134 * clear key material in there).
136 static void free_cprbmem(void *mem, size_t paramblen, int scrub)
139 memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
144 * Helper function to prepare the xcrb struct
146 static inline void prep_xcrb(struct ica_xcRB *pxcrb,
148 struct CPRBX *preqcblk,
149 struct CPRBX *prepcblk)
151 memset(pxcrb, 0, sizeof(*pxcrb));
152 pxcrb->agent_ID = 0x4341; /* 'CA' */
153 pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
154 pxcrb->request_control_blk_length =
155 preqcblk->cprb_len + preqcblk->req_parml;
156 pxcrb->request_control_blk_addr = (void __user *) preqcblk;
157 pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
158 pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
162 * Helper function which calls zcrypt_send_cprb with
163 * memory management segment adjusted to kernel space
164 * so that the copy_from_user called within this
165 * function do in fact copy from kernel space.
167 static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
170 mm_segment_t old_fs = get_fs();
173 rc = zcrypt_send_cprb(xcrb);
180 * Generate (random) CCA AES DATA secure key.
182 int cca_genseckey(u16 cardnr, u16 domain,
183 u32 keytype, u8 seckey[SECKEYBLOBSIZE])
188 struct CPRBX *preqcblk, *prepcblk;
189 struct ica_xcRB xcrb;
205 u8 data[SECKEYBLOBSIZE];
208 } __packed * preqparm;
219 /* ... some more data ... */
222 } __packed * prepparm;
224 /* get already prepared memory for 2 cprbs with param block each */
225 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
229 /* fill request cprb struct */
230 preqcblk->domain = domain;
232 /* fill request cprb param block with KG request */
233 preqparm = (struct kgreqparm *) preqcblk->req_parmb;
234 memcpy(preqparm->subfunc_code, "KG", 2);
235 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
236 preqparm->lv1.len = sizeof(struct lv1);
237 memcpy(preqparm->lv1.key_form, "OP ", 8);
239 case PKEY_KEYTYPE_AES_128:
241 memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
243 case PKEY_KEYTYPE_AES_192:
245 memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
247 case PKEY_KEYTYPE_AES_256:
249 memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
252 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
257 memcpy(preqparm->lv1.key_type1, "AESDATA ", 8);
258 preqparm->lv2.len = sizeof(struct lv2);
259 for (i = 0; i < 6; i++) {
260 preqparm->lv2.keyid[i].len = sizeof(struct keyid);
261 preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
263 preqcblk->req_parml = sizeof(struct kgreqparm);
265 /* fill xcrb struct */
266 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
268 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
269 rc = _zcrypt_send_cprb(&xcrb);
271 DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, errno %d\n",
272 __func__, (int) cardnr, (int) domain, rc);
276 /* check response returncode and reasoncode */
277 if (prepcblk->ccp_rtcode != 0) {
278 DEBUG_ERR("%s secure key generate failure, card response %d/%d\n",
280 (int) prepcblk->ccp_rtcode,
281 (int) prepcblk->ccp_rscode);
286 /* process response cprb param block */
287 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
288 prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
290 /* check length of the returned secure key token */
291 seckeysize = prepparm->lv3.keyblock.toklen
292 - sizeof(prepparm->lv3.keyblock.toklen)
293 - sizeof(prepparm->lv3.keyblock.tokattr);
294 if (seckeysize != SECKEYBLOBSIZE) {
295 DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
296 __func__, seckeysize, SECKEYBLOBSIZE);
301 /* check secure key token */
302 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
303 prepparm->lv3.keyblock.tok, 8*keysize);
309 /* copy the generated secure key token */
310 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
313 free_cprbmem(mem, PARMBSIZE, 0);
316 EXPORT_SYMBOL(cca_genseckey);
319 * Generate an CCA AES DATA secure key with given key value.
321 int cca_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
322 const u8 *clrkey, u8 seckey[SECKEYBLOBSIZE])
324 int rc, keysize, seckeysize;
326 struct CPRBX *preqcblk, *prepcblk;
327 struct ica_xcRB xcrb;
341 u8 data[SECKEYBLOBSIZE];
344 } __packed * preqparm;
356 /* ... some more data ... */
359 } __packed * prepparm;
361 /* get already prepared memory for 2 cprbs with param block each */
362 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
366 /* fill request cprb struct */
367 preqcblk->domain = domain;
369 /* fill request cprb param block with CM request */
370 preqparm = (struct cmreqparm *) preqcblk->req_parmb;
371 memcpy(preqparm->subfunc_code, "CM", 2);
372 memcpy(preqparm->rule_array, "AES ", 8);
373 preqparm->rule_array_len =
374 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
376 case PKEY_KEYTYPE_AES_128:
379 case PKEY_KEYTYPE_AES_192:
382 case PKEY_KEYTYPE_AES_256:
386 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
391 preqparm->lv1.len = sizeof(struct lv1) + keysize;
392 memcpy(preqparm->lv1.clrkey, clrkey, keysize);
393 plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
394 plv2->len = sizeof(struct lv2);
395 plv2->keyid.len = sizeof(struct keyid);
396 plv2->keyid.attr = 0x30;
397 preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
399 /* fill xcrb struct */
400 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
402 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
403 rc = _zcrypt_send_cprb(&xcrb);
405 DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
406 __func__, (int) cardnr, (int) domain, rc);
410 /* check response returncode and reasoncode */
411 if (prepcblk->ccp_rtcode != 0) {
412 DEBUG_ERR("%s clear key import failure, card response %d/%d\n",
414 (int) prepcblk->ccp_rtcode,
415 (int) prepcblk->ccp_rscode);
420 /* process response cprb param block */
421 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
422 prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
424 /* check length of the returned secure key token */
425 seckeysize = prepparm->lv3.keyblock.toklen
426 - sizeof(prepparm->lv3.keyblock.toklen)
427 - sizeof(prepparm->lv3.keyblock.tokattr);
428 if (seckeysize != SECKEYBLOBSIZE) {
429 DEBUG_ERR("%s secure token size mismatch %d != %d bytes\n",
430 __func__, seckeysize, SECKEYBLOBSIZE);
435 /* check secure key token */
436 rc = cca_check_secaeskeytoken(zcrypt_dbf_info, DBF_ERR,
437 prepparm->lv3.keyblock.tok, 8*keysize);
443 /* copy the generated secure key token */
444 memcpy(seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
447 free_cprbmem(mem, PARMBSIZE, 1);
450 EXPORT_SYMBOL(cca_clr2seckey);
453 * Derive proteced key from an CCA AES DATA secure key.
455 int cca_sec2protkey(u16 cardnr, u16 domain,
456 const u8 seckey[SECKEYBLOBSIZE],
457 u8 *protkey, u32 *protkeylen,
462 struct CPRBX *preqcblk, *prepcblk;
463 struct ica_xcRB xcrb;
476 u8 token[0]; /* cca secure key token */
478 } __packed * preqparm;
486 struct cpacfkeyblock {
487 u8 version; /* version of this struct */
493 u8 key[64]; /* the key (len bytes) */
498 u8 vp[32]; /* verification pattern */
501 } __packed * prepparm;
503 /* get already prepared memory for 2 cprbs with param block each */
504 rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
508 /* fill request cprb struct */
509 preqcblk->domain = domain;
511 /* fill request cprb param block with USK request */
512 preqparm = (struct uskreqparm *) preqcblk->req_parmb;
513 memcpy(preqparm->subfunc_code, "US", 2);
514 preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
515 preqparm->lv1.len = sizeof(struct lv1);
516 preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
517 preqparm->lv1.attr_flags = 0x0001;
518 preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
519 preqparm->lv2.attr_len = sizeof(struct lv2)
520 - sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
521 preqparm->lv2.attr_flags = 0x0000;
522 memcpy(preqparm->lv2.token, seckey, SECKEYBLOBSIZE);
523 preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
525 /* fill xcrb struct */
526 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
528 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
529 rc = _zcrypt_send_cprb(&xcrb);
531 DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
532 __func__, (int) cardnr, (int) domain, rc);
536 /* check response returncode and reasoncode */
537 if (prepcblk->ccp_rtcode != 0) {
538 DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
540 (int) prepcblk->ccp_rtcode,
541 (int) prepcblk->ccp_rscode);
545 if (prepcblk->ccp_rscode != 0) {
546 DEBUG_WARN("%s unwrap secure key warning, card response %d/%d\n",
548 (int) prepcblk->ccp_rtcode,
549 (int) prepcblk->ccp_rscode);
552 /* process response cprb param block */
553 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
554 prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
556 /* check the returned keyblock */
557 if (prepparm->lv3.keyblock.version != 0x01) {
558 DEBUG_ERR("%s reply param keyblock version mismatch 0x%02x != 0x01\n",
559 __func__, (int) prepparm->lv3.keyblock.version);
564 /* copy the tanslated protected key */
565 switch (prepparm->lv3.keyblock.len) {
567 /* AES 128 protected key */
569 *keytype = PKEY_KEYTYPE_AES_128;
572 /* AES 192 protected key */
574 *keytype = PKEY_KEYTYPE_AES_192;
577 /* AES 256 protected key */
579 *keytype = PKEY_KEYTYPE_AES_256;
582 DEBUG_ERR("%s unknown/unsupported keytype %d\n",
583 __func__, prepparm->lv3.keyblock.len);
587 memcpy(protkey, prepparm->lv3.keyblock.key, prepparm->lv3.keyblock.len);
589 *protkeylen = prepparm->lv3.keyblock.len;
592 free_cprbmem(mem, PARMBSIZE, 0);
595 EXPORT_SYMBOL(cca_sec2protkey);
598 * query cryptographic facility from CCA adapter
600 int cca_query_crypto_facility(u16 cardnr, u16 domain,
602 u8 *rarray, size_t *rarraylen,
603 u8 *varray, size_t *varraylen)
608 struct CPRBX *preqcblk, *prepcblk;
609 struct ica_xcRB xcrb;
616 u8 data[VARDATASIZE];
619 } __packed * preqparm;
620 size_t parmbsize = sizeof(struct fqreqparm);
624 } __packed * prepparm;
626 /* get already prepared memory for 2 cprbs with param block each */
627 rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
631 /* fill request cprb struct */
632 preqcblk->domain = domain;
634 /* fill request cprb param block with FQ request */
635 preqparm = (struct fqreqparm *) preqcblk->req_parmb;
636 memcpy(preqparm->subfunc_code, "FQ", 2);
637 memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
638 preqparm->rule_array_len =
639 sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
640 preqparm->lv1.len = sizeof(preqparm->lv1);
641 preqparm->dummylen = sizeof(preqparm->dummylen);
642 preqcblk->req_parml = parmbsize;
644 /* fill xcrb struct */
645 prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
647 /* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
648 rc = _zcrypt_send_cprb(&xcrb);
650 DEBUG_ERR("%s zcrypt_send_cprb (cardnr=%d domain=%d) failed, rc=%d\n",
651 __func__, (int) cardnr, (int) domain, rc);
655 /* check response returncode and reasoncode */
656 if (prepcblk->ccp_rtcode != 0) {
657 DEBUG_ERR("%s unwrap secure key failure, card response %d/%d\n",
659 (int) prepcblk->ccp_rtcode,
660 (int) prepcblk->ccp_rscode);
665 /* process response cprb param block */
666 prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
667 prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
668 ptr = prepparm->lvdata;
670 /* check and possibly copy reply rule array */
671 len = *((u16 *) ptr);
672 if (len > sizeof(u16)) {
675 if (rarray && rarraylen && *rarraylen > 0) {
676 *rarraylen = (len > *rarraylen ? *rarraylen : len);
677 memcpy(rarray, ptr, *rarraylen);
681 /* check and possible copy reply var array */
682 len = *((u16 *) ptr);
683 if (len > sizeof(u16)) {
686 if (varray && varraylen && *varraylen > 0) {
687 *varraylen = (len > *varraylen ? *varraylen : len);
688 memcpy(varray, ptr, *varraylen);
694 free_cprbmem(mem, parmbsize, 0);
697 EXPORT_SYMBOL(cca_query_crypto_facility);
699 static int cca_info_cache_fetch(u16 cardnr, u16 domain, struct cca_info *ci)
702 struct cca_info_list_entry *ptr;
704 spin_lock_bh(&cca_info_list_lock);
705 list_for_each_entry(ptr, &cca_info_list, list) {
706 if (ptr->cardnr == cardnr && ptr->domain == domain) {
707 memcpy(ci, &ptr->info, sizeof(*ci));
712 spin_unlock_bh(&cca_info_list_lock);
717 static void cca_info_cache_update(u16 cardnr, u16 domain,
718 const struct cca_info *ci)
721 struct cca_info_list_entry *ptr;
723 spin_lock_bh(&cca_info_list_lock);
724 list_for_each_entry(ptr, &cca_info_list, list) {
725 if (ptr->cardnr == cardnr &&
726 ptr->domain == domain) {
727 memcpy(&ptr->info, ci, sizeof(*ci));
733 ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
735 spin_unlock_bh(&cca_info_list_lock);
738 ptr->cardnr = cardnr;
739 ptr->domain = domain;
740 memcpy(&ptr->info, ci, sizeof(*ci));
741 list_add(&ptr->list, &cca_info_list);
743 spin_unlock_bh(&cca_info_list_lock);
746 static void cca_info_cache_scrub(u16 cardnr, u16 domain)
748 struct cca_info_list_entry *ptr;
750 spin_lock_bh(&cca_info_list_lock);
751 list_for_each_entry(ptr, &cca_info_list, list) {
752 if (ptr->cardnr == cardnr &&
753 ptr->domain == domain) {
754 list_del(&ptr->list);
759 spin_unlock_bh(&cca_info_list_lock);
762 static void __exit mkvp_cache_free(void)
764 struct cca_info_list_entry *ptr, *pnext;
766 spin_lock_bh(&cca_info_list_lock);
767 list_for_each_entry_safe(ptr, pnext, &cca_info_list, list) {
768 list_del(&ptr->list);
771 spin_unlock_bh(&cca_info_list_lock);
775 * Fetch cca_info values via query_crypto_facility from adapter.
777 static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci)
781 u8 *rarray, *varray, *pg;
782 struct zcrypt_device_status_ext devstat;
784 memset(ci, 0, sizeof(*ci));
786 /* get first info from zcrypt device driver about this apqn */
787 rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
790 ci->hwtype = devstat.hwtype;
792 /* prep page for rule array and var array use */
793 pg = (u8 *) __get_free_page(GFP_KERNEL);
797 varray = pg + PAGE_SIZE/2;
798 rlen = vlen = PAGE_SIZE/2;
800 /* QF for this card/domain */
801 rc = cca_query_crypto_facility(cardnr, domain, "STATICSA",
802 rarray, &rlen, varray, &vlen);
803 if (rc == 0 && rlen >= 10*8 && vlen >= 204) {
804 memcpy(ci->serial, rarray, 8);
805 ci->new_mk_state = (char) rarray[7*8];
806 ci->cur_mk_state = (char) rarray[8*8];
807 ci->old_mk_state = (char) rarray[9*8];
808 if (ci->old_mk_state == '2')
809 memcpy(&ci->old_mkvp, varray + 172, 8);
810 if (ci->cur_mk_state == '2')
811 memcpy(&ci->cur_mkvp, varray + 184, 8);
812 if (ci->new_mk_state == '3')
813 memcpy(&ci->new_mkvp, varray + 196, 8);
817 free_page((unsigned long) pg);
819 return found ? 0 : -ENOENT;
823 * Fetch cca information about a CCA queue.
825 int cca_get_info(u16 card, u16 dom, struct cca_info *ci, int verify)
829 rc = cca_info_cache_fetch(card, dom, ci);
831 rc = fetch_cca_info(card, dom, ci);
833 cca_info_cache_update(card, dom, ci);
838 EXPORT_SYMBOL(cca_get_info);
841 * Search for a matching crypto card based on the
842 * Master Key Verification Pattern given.
844 static int findcard(u64 mkvp, u16 *pcardnr, u16 *pdomain,
845 int verify, int minhwtype)
847 struct zcrypt_device_status_ext *device_status;
852 /* mkvp must not be zero, minhwtype needs to be >= 0 */
853 if (mkvp == 0 || minhwtype < 0)
856 /* fetch status of all crypto cards */
857 device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
858 sizeof(struct zcrypt_device_status_ext),
862 zcrypt_device_status_mask_ext(device_status);
864 /* walk through all crypto cards */
865 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
866 card = AP_QID_CARD(device_status[i].qid);
867 dom = AP_QID_QUEUE(device_status[i].qid);
868 if (device_status[i].online &&
869 device_status[i].functions & 0x04) {
870 /* enabled CCA card, check current mkvp from cache */
871 if (cca_info_cache_fetch(card, dom, &ci) == 0 &&
872 ci.hwtype >= minhwtype &&
873 ci.cur_mk_state == '2' &&
874 ci.cur_mkvp == mkvp) {
877 /* verify: refresh card info */
878 if (fetch_cca_info(card, dom, &ci) == 0) {
879 cca_info_cache_update(card, dom, &ci);
880 if (ci.hwtype >= minhwtype &&
881 ci.cur_mk_state == '2' &&
887 /* Card is offline and/or not a CCA card. */
888 /* del mkvp entry from cache if it exists */
889 cca_info_cache_scrub(card, dom);
892 if (i >= MAX_ZDEV_ENTRIES_EXT) {
893 /* nothing found, so this time without cache */
894 for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
895 if (!(device_status[i].online &&
896 device_status[i].functions & 0x04))
898 card = AP_QID_CARD(device_status[i].qid);
899 dom = AP_QID_QUEUE(device_status[i].qid);
900 /* fresh fetch mkvp from adapter */
901 if (fetch_cca_info(card, dom, &ci) == 0) {
902 cca_info_cache_update(card, dom, &ci);
903 if (ci.hwtype >= minhwtype &&
904 ci.cur_mk_state == '2' &&
907 if (ci.hwtype >= minhwtype &&
908 ci.old_mk_state == '2' &&
909 ci.old_mkvp == mkvp &&
914 if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
915 /* old mkvp matched, use this card then */
916 card = AP_QID_CARD(device_status[oi].qid);
917 dom = AP_QID_QUEUE(device_status[oi].qid);
920 if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
925 rc = (i < MAX_ZDEV_ENTRIES_EXT ? 0 : 1);
929 kfree(device_status);
934 * Search for a matching crypto card based on the Master Key
935 * Verification Pattern provided inside a secure key token.
937 int cca_findcard(const u8 *key, u16 *pcardnr, u16 *pdomain, int verify)
940 const struct keytoken_header *hdr = (struct keytoken_header *) key;
942 if (hdr->type != TOKTYPE_CCA_INTERNAL)
945 switch (hdr->version) {
947 mkvp = ((struct secaeskeytoken *)key)->mkvp;
953 return findcard(mkvp, pcardnr, pdomain, verify, 0);
955 EXPORT_SYMBOL(cca_findcard);
957 void __exit zcrypt_ccamisc_exit(void)