Merge tag 'v5.4-rc5' into next

Sync up with mainline.

1 files changed, 783 insertions, 968 deletions

diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 7f418d2d8cdf..9de3d46b3253 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -2,7 +2,7 @@
 /*
  *  pkey device driver
  *
- *  Copyright IBM Corp. 2017
+ *  Copyright IBM Corp. 2017,2019
  *  Author(s): Harald Freudenberger
  */
 
@@ -24,16 +24,14 @@
 #include <crypto/aes.h>
 
 #include "zcrypt_api.h"
+#include "zcrypt_ccamisc.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("IBM Corporation");
 MODULE_DESCRIPTION("s390 protected key interface");
 
-/* Size of parameter block used for all cca requests/replies */
-#define PARMBSIZE 512
-
-/* Size of vardata block used for some of the cca requests/replies */
-#define VARDATASIZE 4096
+#define KEYBLOBBUFSIZE 8192  /* key buffer size used for internal processing */
+#define MAXAPQNSINLIST 64    /* max 64 apqns within a apqn list */
 
 /* mask of available pckmo subfunctions, fetched once at module init */
 static cpacf_mask_t pckmo_functions;
@@ -62,40 +60,6 @@ static void __exit pkey_debug_exit(void)
 	debug_unregister(debug_info);
 }
 
-/* Key token types */
-#define TOKTYPE_NON_CCA		0x00 /* Non-CCA key token */
-#define TOKTYPE_CCA_INTERNAL	0x01 /* CCA internal key token */
-
-/* For TOKTYPE_NON_CCA: */
-#define TOKVER_PROTECTED_KEY	0x01 /* Protected key token */
-
-/* For TOKTYPE_CCA_INTERNAL: */
-#define TOKVER_CCA_AES		0x04 /* CCA AES key token */
-
-/* header part of a key token */
-struct keytoken_header {
-	u8  type;     /* one of the TOKTYPE values */
-	u8  res0[3];
-	u8  version;  /* one of the TOKVER values */
-	u8  res1[3];
-} __packed;
-
-/* inside view of a secure key token (only type 0x01 version 0x04) */
-struct secaeskeytoken {
-	u8  type;     /* 0x01 for internal key token */
-	u8  res0[3];
-	u8  version;  /* should be 0x04 */
-	u8  res1[1];
-	u8  flag;     /* key flags */
-	u8  res2[1];
-	u64 mkvp;     /* master key verification pattern */
-	u8  key[32];  /* key value (encrypted) */
-	u8  cv[8];    /* control vector */
-	u16 bitsize;  /* key bit size */
-	u16 keysize;  /* key byte size */
-	u8  tvv[4];   /* token validation value */
-} __packed;
-
 /* inside view of a protected key token (only type 0x00 version 0x01) */
 struct protaeskeytoken {
 	u8  type;     /* 0x00 for PAES specific key tokens */
@@ -108,557 +72,11 @@ struct protaeskeytoken {
 } __packed;
 
 /*
- * Simple check if the token is a valid CCA secure AES key
- * token. If keybitsize is given, the bitsize of the key is
- * also checked. Returns 0 on success or errno value on failure.
- */
-static int check_secaeskeytoken(const u8 *token, int keybitsize)
-{
-	struct secaeskeytoken *t = (struct secaeskeytoken *) token;
-
-	if (t->type != TOKTYPE_CCA_INTERNAL) {
-		DEBUG_ERR(
-			"%s secure token check failed, type mismatch 0x%02x != 0x%02x\n",
-			__func__, (int) t->type, TOKTYPE_CCA_INTERNAL);
-		return -EINVAL;
-	}
-	if (t->version != TOKVER_CCA_AES) {
-		DEBUG_ERR(
-			"%s secure token check failed, version mismatch 0x%02x != 0x%02x\n",
-			__func__, (int) t->version, TOKVER_CCA_AES);
-		return -EINVAL;
-	}
-	if (keybitsize > 0 && t->bitsize != keybitsize) {
-		DEBUG_ERR(
-			"%s secure token check failed, bitsize mismatch %d != %d\n",
-			__func__, (int) t->bitsize, keybitsize);
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
-/*
- * Allocate consecutive memory for request CPRB, request param
- * block, reply CPRB and reply param block and fill in values
- * for the common fields. Returns 0 on success or errno value
- * on failure.
- */
-static int alloc_and_prep_cprbmem(size_t paramblen,
-				  u8 **pcprbmem,
-				  struct CPRBX **preqCPRB,
-				  struct CPRBX **prepCPRB)
-{
-	u8 *cprbmem;
-	size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
-	struct CPRBX *preqcblk, *prepcblk;
-
-	/*
-	 * allocate consecutive memory for request CPRB, request param
-	 * block, reply CPRB and reply param block
-	 */
-	cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
-	if (!cprbmem)
-		return -ENOMEM;
-
-	preqcblk = (struct CPRBX *) cprbmem;
-	prepcblk = (struct CPRBX *) (cprbmem + cprbplusparamblen);
-
-	/* fill request cprb struct */
-	preqcblk->cprb_len = sizeof(struct CPRBX);
-	preqcblk->cprb_ver_id = 0x02;
-	memcpy(preqcblk->func_id, "T2", 2);
-	preqcblk->rpl_msgbl = cprbplusparamblen;
-	if (paramblen) {
-		preqcblk->req_parmb =
-			((u8 *) preqcblk) + sizeof(struct CPRBX);
-		preqcblk->rpl_parmb =
-			((u8 *) prepcblk) + sizeof(struct CPRBX);
-	}
-
-	*pcprbmem = cprbmem;
-	*preqCPRB = preqcblk;
-	*prepCPRB = prepcblk;
-
-	return 0;
-}
-
-/*
- * Free the cprb memory allocated with the function above.
- * If the scrub value is not zero, the memory is filled
- * with zeros before freeing (useful if there was some
- * clear key material in there).
- */
-static void free_cprbmem(void *mem, size_t paramblen, int scrub)
-{
-	if (scrub)
-		memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
-	kfree(mem);
-}
-
-/*
- * Helper function to prepare the xcrb struct
- */
-static inline void prep_xcrb(struct ica_xcRB *pxcrb,
-			     u16 cardnr,
-			     struct CPRBX *preqcblk,
-			     struct CPRBX *prepcblk)
-{
-	memset(pxcrb, 0, sizeof(*pxcrb));
-	pxcrb->agent_ID = 0x4341; /* 'CA' */
-	pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
-	pxcrb->request_control_blk_length =
-		preqcblk->cprb_len + preqcblk->req_parml;
-	pxcrb->request_control_blk_addr = (void __user *) preqcblk;
-	pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
-	pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
-}
-
-/*
- * Helper function which calls zcrypt_send_cprb with
- * memory management segment adjusted to kernel space
- * so that the copy_from_user called within this
- * function do in fact copy from kernel space.
- */
-static inline int _zcrypt_send_cprb(struct ica_xcRB *xcrb)
-{
-	int rc;
-	mm_segment_t old_fs = get_fs();
-
-	set_fs(KERNEL_DS);
-	rc = zcrypt_send_cprb(xcrb);
-	set_fs(old_fs);
-
-	return rc;
-}
-
-/*
- * Generate (random) AES secure key.
- */
-int pkey_genseckey(u16 cardnr, u16 domain,
-		   u32 keytype, struct pkey_seckey *seckey)
-{
-	int i, rc, keysize;
-	int seckeysize;
-	u8 *mem;
-	struct CPRBX *preqcblk, *prepcblk;
-	struct ica_xcRB xcrb;
-	struct kgreqparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		struct lv1 {
-			u16 len;
-			char  key_form[8];
-			char  key_length[8];
-			char  key_type1[8];
-			char  key_type2[8];
-		} lv1;
-		struct lv2 {
-			u16 len;
-			struct keyid {
-				u16 len;
-				u16 attr;
-				u8  data[SECKEYBLOBSIZE];
-			} keyid[6];
-		} lv2;
-	} *preqparm;
-	struct kgrepparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		struct lv3 {
-			u16 len;
-			u16 keyblocklen;
-			struct {
-				u16 toklen;
-				u16 tokattr;
-				u8  tok[0];
-				/* ... some more data ... */
-			} keyblock;
-		} lv3;
-	} *prepparm;
-
-	/* get already prepared memory for 2 cprbs with param block each */
-	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
-	if (rc)
-		return rc;
-
-	/* fill request cprb struct */
-	preqcblk->domain = domain;
-
-	/* fill request cprb param block with KG request */
-	preqparm = (struct kgreqparm *) preqcblk->req_parmb;
-	memcpy(preqparm->subfunc_code, "KG", 2);
-	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
-	preqparm->lv1.len = sizeof(struct lv1);
-	memcpy(preqparm->lv1.key_form,	 "OP      ", 8);
-	switch (keytype) {
-	case PKEY_KEYTYPE_AES_128:
-		keysize = 16;
-		memcpy(preqparm->lv1.key_length, "KEYLN16 ", 8);
-		break;
-	case PKEY_KEYTYPE_AES_192:
-		keysize = 24;
-		memcpy(preqparm->lv1.key_length, "KEYLN24 ", 8);
-		break;
-	case PKEY_KEYTYPE_AES_256:
-		keysize = 32;
-		memcpy(preqparm->lv1.key_length, "KEYLN32 ", 8);
-		break;
-	default:
-		DEBUG_ERR(
-			"%s unknown/unsupported keytype %d\n",
-			__func__, keytype);
-		rc = -EINVAL;
-		goto out;
-	}
-	memcpy(preqparm->lv1.key_type1,  "AESDATA ", 8);
-	preqparm->lv2.len = sizeof(struct lv2);
-	for (i = 0; i < 6; i++) {
-		preqparm->lv2.keyid[i].len = sizeof(struct keyid);
-		preqparm->lv2.keyid[i].attr = (i == 2 ? 0x30 : 0x10);
-	}
-	preqcblk->req_parml = sizeof(struct kgreqparm);
-
-	/* fill xcrb struct */
-	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
-
-	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
-	rc = _zcrypt_send_cprb(&xcrb);
-	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
-			__func__, (int) cardnr, (int) domain, rc);
-		goto out;
-	}
-
-	/* check response returncode and reasoncode */
-	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s secure key generate failure, card response %d/%d\n",
-			__func__,
-			(int) prepcblk->ccp_rtcode,
-			(int) prepcblk->ccp_rscode);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* process response cprb param block */
-	prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
-	prepparm = (struct kgrepparm *) prepcblk->rpl_parmb;
-
-	/* check length of the returned secure key token */
-	seckeysize = prepparm->lv3.keyblock.toklen
-		- sizeof(prepparm->lv3.keyblock.toklen)
-		- sizeof(prepparm->lv3.keyblock.tokattr);
-	if (seckeysize != SECKEYBLOBSIZE) {
-		DEBUG_ERR(
-			"%s secure token size mismatch %d != %d bytes\n",
-			__func__, seckeysize, SECKEYBLOBSIZE);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* check secure key token */
-	rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
-	if (rc) {
-		rc = -EIO;
-		goto out;
-	}
-
-	/* copy the generated secure key token */
-	memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
-
-out:
-	free_cprbmem(mem, PARMBSIZE, 0);
-	return rc;
-}
-EXPORT_SYMBOL(pkey_genseckey);
-
-/*
- * Generate an AES secure key with given key value.
- */
-int pkey_clr2seckey(u16 cardnr, u16 domain, u32 keytype,
-		    const struct pkey_clrkey *clrkey,
-		    struct pkey_seckey *seckey)
-{
-	int rc, keysize, seckeysize;
-	u8 *mem;
-	struct CPRBX *preqcblk, *prepcblk;
-	struct ica_xcRB xcrb;
-	struct cmreqparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		char  rule_array[8];
-		struct lv1 {
-			u16 len;
-			u8  clrkey[0];
-		} lv1;
-		struct lv2 {
-			u16 len;
-			struct keyid {
-				u16 len;
-				u16 attr;
-				u8  data[SECKEYBLOBSIZE];
-			} keyid;
-		} lv2;
-	} *preqparm;
-	struct lv2 *plv2;
-	struct cmrepparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		struct lv3 {
-			u16 len;
-			u16 keyblocklen;
-			struct {
-				u16 toklen;
-				u16 tokattr;
-				u8  tok[0];
-				/* ... some more data ... */
-			} keyblock;
-		} lv3;
-	} *prepparm;
-
-	/* get already prepared memory for 2 cprbs with param block each */
-	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
-	if (rc)
-		return rc;
-
-	/* fill request cprb struct */
-	preqcblk->domain = domain;
-
-	/* fill request cprb param block with CM request */
-	preqparm = (struct cmreqparm *) preqcblk->req_parmb;
-	memcpy(preqparm->subfunc_code, "CM", 2);
-	memcpy(preqparm->rule_array, "AES     ", 8);
-	preqparm->rule_array_len =
-		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
-	switch (keytype) {
-	case PKEY_KEYTYPE_AES_128:
-		keysize = 16;
-		break;
-	case PKEY_KEYTYPE_AES_192:
-		keysize = 24;
-		break;
-	case PKEY_KEYTYPE_AES_256:
-		keysize = 32;
-		break;
-	default:
-		DEBUG_ERR(
-			"%s unknown/unsupported keytype %d\n",
-			__func__, keytype);
-		rc = -EINVAL;
-		goto out;
-	}
-	preqparm->lv1.len = sizeof(struct lv1) + keysize;
-	memcpy(preqparm->lv1.clrkey, clrkey->clrkey, keysize);
-	plv2 = (struct lv2 *) (((u8 *) &preqparm->lv2) + keysize);
-	plv2->len = sizeof(struct lv2);
-	plv2->keyid.len = sizeof(struct keyid);
-	plv2->keyid.attr = 0x30;
-	preqcblk->req_parml = sizeof(struct cmreqparm) + keysize;
-
-	/* fill xcrb struct */
-	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
-
-	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
-	rc = _zcrypt_send_cprb(&xcrb);
-	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
-			__func__, (int) cardnr, (int) domain, rc);
-		goto out;
-	}
-
-	/* check response returncode and reasoncode */
-	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s clear key import failure, card response %d/%d\n",
-			__func__,
-			(int) prepcblk->ccp_rtcode,
-			(int) prepcblk->ccp_rscode);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* process response cprb param block */
-	prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
-	prepparm = (struct cmrepparm *) prepcblk->rpl_parmb;
-
-	/* check length of the returned secure key token */
-	seckeysize = prepparm->lv3.keyblock.toklen
-		- sizeof(prepparm->lv3.keyblock.toklen)
-		- sizeof(prepparm->lv3.keyblock.tokattr);
-	if (seckeysize != SECKEYBLOBSIZE) {
-		DEBUG_ERR(
-			"%s secure token size mismatch %d != %d bytes\n",
-			__func__, seckeysize, SECKEYBLOBSIZE);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* check secure key token */
-	rc = check_secaeskeytoken(prepparm->lv3.keyblock.tok, 8*keysize);
-	if (rc) {
-		rc = -EIO;
-		goto out;
-	}
-
-	/* copy the generated secure key token */
-	memcpy(seckey->seckey, prepparm->lv3.keyblock.tok, SECKEYBLOBSIZE);
-
-out:
-	free_cprbmem(mem, PARMBSIZE, 1);
-	return rc;
-}
-EXPORT_SYMBOL(pkey_clr2seckey);
-
-/*
- * Derive a proteced key from the secure key blob.
- */
-int pkey_sec2protkey(u16 cardnr, u16 domain,
-		     const struct pkey_seckey *seckey,
-		     struct pkey_protkey *protkey)
-{
-	int rc;
-	u8 *mem;
-	struct CPRBX *preqcblk, *prepcblk;
-	struct ica_xcRB xcrb;
-	struct uskreqparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		struct lv1 {
-			u16 len;
-			u16 attr_len;
-			u16 attr_flags;
-		} lv1;
-		struct lv2 {
-			u16 len;
-			u16 attr_len;
-			u16 attr_flags;
-			u8  token[0];	      /* cca secure key token */
-		} lv2 __packed;
-	} *preqparm;
-	struct uskrepparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		struct lv3 {
-			u16 len;
-			u16 attr_len;
-			u16 attr_flags;
-			struct cpacfkeyblock {
-				u8  version;  /* version of this struct */
-				u8  flags[2];
-				u8  algo;
-				u8  form;
-				u8  pad1[3];
-				u16 keylen;
-				u8  key[64];  /* the key (keylen bytes) */
-				u16 keyattrlen;
-				u8  keyattr[32];
-				u8  pad2[1];
-				u8  vptype;
-				u8  vp[32];  /* verification pattern */
-			} keyblock;
-		} lv3 __packed;
-	} *prepparm;
-
-	/* get already prepared memory for 2 cprbs with param block each */
-	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
-	if (rc)
-		return rc;
-
-	/* fill request cprb struct */
-	preqcblk->domain = domain;
-
-	/* fill request cprb param block with USK request */
-	preqparm = (struct uskreqparm *) preqcblk->req_parmb;
-	memcpy(preqparm->subfunc_code, "US", 2);
-	preqparm->rule_array_len = sizeof(preqparm->rule_array_len);
-	preqparm->lv1.len = sizeof(struct lv1);
-	preqparm->lv1.attr_len = sizeof(struct lv1) - sizeof(preqparm->lv1.len);
-	preqparm->lv1.attr_flags = 0x0001;
-	preqparm->lv2.len = sizeof(struct lv2) + SECKEYBLOBSIZE;
-	preqparm->lv2.attr_len = sizeof(struct lv2)
-		- sizeof(preqparm->lv2.len) + SECKEYBLOBSIZE;
-	preqparm->lv2.attr_flags = 0x0000;
-	memcpy(preqparm->lv2.token, seckey->seckey, SECKEYBLOBSIZE);
-	preqcblk->req_parml = sizeof(struct uskreqparm) + SECKEYBLOBSIZE;
-
-	/* fill xcrb struct */
-	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
-
-	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
-	rc = _zcrypt_send_cprb(&xcrb);
-	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
-			__func__, (int) cardnr, (int) domain, rc);
-		goto out;
-	}
-
-	/* check response returncode and reasoncode */
-	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s unwrap secure key failure, card response %d/%d\n",
-			__func__,
-			(int) prepcblk->ccp_rtcode,
-			(int) prepcblk->ccp_rscode);
-		rc = -EIO;
-		goto out;
-	}
-	if (prepcblk->ccp_rscode != 0) {
-		DEBUG_WARN(
-			"%s unwrap secure key warning, card response %d/%d\n",
-			__func__,
-			(int) prepcblk->ccp_rtcode,
-			(int) prepcblk->ccp_rscode);
-	}
-
-	/* process response cprb param block */
-	prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
-	prepparm = (struct uskrepparm *) prepcblk->rpl_parmb;
-
-	/* check the returned keyblock */
-	if (prepparm->lv3.keyblock.version != 0x01) {
-		DEBUG_ERR(
-			"%s reply param keyblock version mismatch 0x%02x != 0x01\n",
-			__func__, (int) prepparm->lv3.keyblock.version);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* copy the tanslated protected key */
-	switch (prepparm->lv3.keyblock.keylen) {
-	case 16+32:
-		protkey->type = PKEY_KEYTYPE_AES_128;
-		break;
-	case 24+32:
-		protkey->type = PKEY_KEYTYPE_AES_192;
-		break;
-	case 32+32:
-		protkey->type = PKEY_KEYTYPE_AES_256;
-		break;
-	default:
-		DEBUG_ERR("%s unknown/unsupported keytype %d\n",
-			  __func__, prepparm->lv3.keyblock.keylen);
-		rc = -EIO;
-		goto out;
-	}
-	protkey->len = prepparm->lv3.keyblock.keylen;
-	memcpy(protkey->protkey, prepparm->lv3.keyblock.key, protkey->len);
-
-out:
-	free_cprbmem(mem, PARMBSIZE, 0);
-	return rc;
-}
-EXPORT_SYMBOL(pkey_sec2protkey);
-
-/*
  * Create a protected key from a clear key value.
  */
-int pkey_clr2protkey(u32 keytype,
-		     const struct pkey_clrkey *clrkey,
-		     struct pkey_protkey *protkey)
+static int pkey_clr2protkey(u32 keytype,
+			    const struct pkey_clrkey *clrkey,
+			    struct pkey_protkey *protkey)
 {
 	long fc;
 	int keysize;
@@ -707,338 +125,43 @@ int pkey_clr2protkey(u32 keytype,
 
 	return 0;
 }
-EXPORT_SYMBOL(pkey_clr2protkey);
-
-/*
- * query cryptographic facility from adapter
- */
-static int query_crypto_facility(u16 cardnr, u16 domain,
-				 const char *keyword,
-				 u8 *rarray, size_t *rarraylen,
-				 u8 *varray, size_t *varraylen)
-{
-	int rc;
-	u16 len;
-	u8 *mem, *ptr;
-	struct CPRBX *preqcblk, *prepcblk;
-	struct ica_xcRB xcrb;
-	struct fqreqparm {
-		u8  subfunc_code[2];
-		u16 rule_array_len;
-		char  rule_array[8];
-		struct lv1 {
-			u16 len;
-			u8  data[VARDATASIZE];
-		} lv1;
-		u16 dummylen;
-	} *preqparm;
-	size_t parmbsize = sizeof(struct fqreqparm);
-	struct fqrepparm {
-		u8  subfunc_code[2];
-		u8  lvdata[0];
-	} *prepparm;
-
-	/* get already prepared memory for 2 cprbs with param block each */
-	rc = alloc_and_prep_cprbmem(parmbsize, &mem, &preqcblk, &prepcblk);
-	if (rc)
-		return rc;
-
-	/* fill request cprb struct */
-	preqcblk->domain = domain;
-
-	/* fill request cprb param block with FQ request */
-	preqparm = (struct fqreqparm *) preqcblk->req_parmb;
-	memcpy(preqparm->subfunc_code, "FQ", 2);
-	memcpy(preqparm->rule_array, keyword, sizeof(preqparm->rule_array));
-	preqparm->rule_array_len =
-		sizeof(preqparm->rule_array_len) + sizeof(preqparm->rule_array);
-	preqparm->lv1.len = sizeof(preqparm->lv1);
-	preqparm->dummylen = sizeof(preqparm->dummylen);
-	preqcblk->req_parml = parmbsize;
-
-	/* fill xcrb struct */
-	prep_xcrb(&xcrb, cardnr, preqcblk, prepcblk);
-
-	/* forward xcrb with request CPRB and reply CPRB to zcrypt dd */
-	rc = _zcrypt_send_cprb(&xcrb);
-	if (rc) {
-		DEBUG_ERR(
-			"%s zcrypt_send_cprb (cardnr=%d domain=%d) failed with errno %d\n",
-			__func__, (int) cardnr, (int) domain, rc);
-		goto out;
-	}
-
-	/* check response returncode and reasoncode */
-	if (prepcblk->ccp_rtcode != 0) {
-		DEBUG_ERR(
-			"%s unwrap secure key failure, card response %d/%d\n",
-			__func__,
-			(int) prepcblk->ccp_rtcode,
-			(int) prepcblk->ccp_rscode);
-		rc = -EIO;
-		goto out;
-	}
-
-	/* process response cprb param block */
-	prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
-	prepparm = (struct fqrepparm *) prepcblk->rpl_parmb;
-	ptr = prepparm->lvdata;
-
-	/* check and possibly copy reply rule array */
-	len = *((u16 *) ptr);
-	if (len > sizeof(u16)) {
-		ptr += sizeof(u16);
-		len -= sizeof(u16);
-		if (rarray && rarraylen && *rarraylen > 0) {
-			*rarraylen = (len > *rarraylen ? *rarraylen : len);
-			memcpy(rarray, ptr, *rarraylen);
-		}
-		ptr += len;
-	}
-	/* check and possible copy reply var array */
-	len = *((u16 *) ptr);
-	if (len > sizeof(u16)) {
-		ptr += sizeof(u16);
-		len -= sizeof(u16);
-		if (varray && varraylen && *varraylen > 0) {
-			*varraylen = (len > *varraylen ? *varraylen : len);
-			memcpy(varray, ptr, *varraylen);
-		}
-		ptr += len;
-	}
-
-out:
-	free_cprbmem(mem, parmbsize, 0);
-	return rc;
-}
-
-/*
- * Fetch the current and old mkvp values via
- * query_crypto_facility from adapter.
- */
-static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
-{
-	int rc, found = 0;
-	size_t rlen, vlen;
-	u8 *rarray, *varray, *pg;
-
-	pg = (u8 *) __get_free_page(GFP_KERNEL);
-	if (!pg)
-		return -ENOMEM;
-	rarray = pg;
-	varray = pg + PAGE_SIZE/2;
-	rlen = vlen = PAGE_SIZE/2;
-
-	rc = query_crypto_facility(cardnr, domain, "STATICSA",
-				   rarray, &rlen, varray, &vlen);
-	if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
-		if (rarray[8*8] == '2') {
-			/* current master key state is valid */
-			mkvp[0] = *((u64 *)(varray + 184));
-			mkvp[1] = *((u64 *)(varray + 172));
-			found = 1;
-		}
-	}
-
-	free_page((unsigned long) pg);
-
-	return found ? 0 : -ENOENT;
-}
-
-/* struct to hold cached mkvp info for each card/domain */
-struct mkvp_info {
-	struct list_head list;
-	u16 cardnr;
-	u16 domain;
-	u64 mkvp[2];
-};
-
-/* a list with mkvp_info entries */
-static LIST_HEAD(mkvp_list);
-static DEFINE_SPINLOCK(mkvp_list_lock);
-
-static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
-{
-	int rc = -ENOENT;
-	struct mkvp_info *ptr;
-
-	spin_lock_bh(&mkvp_list_lock);
-	list_for_each_entry(ptr, &mkvp_list, list) {
-		if (ptr->cardnr == cardnr &&
-		    ptr->domain == domain) {
-			memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
-			rc = 0;
-			break;
-		}
-	}
-	spin_unlock_bh(&mkvp_list_lock);
-
-	return rc;
-}
-
-static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
-{
-	int found = 0;
-	struct mkvp_info *ptr;
-
-	spin_lock_bh(&mkvp_list_lock);
-	list_for_each_entry(ptr, &mkvp_list, list) {
-		if (ptr->cardnr == cardnr &&
-		    ptr->domain == domain) {
-			memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
-			found = 1;
-			break;
-		}
-	}
-	if (!found) {
-		ptr = kmalloc(sizeof(*ptr), GFP_ATOMIC);
-		if (!ptr) {
-			spin_unlock_bh(&mkvp_list_lock);
-			return;
-		}
-		ptr->cardnr = cardnr;
-		ptr->domain = domain;
-		memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
-		list_add(&ptr->list, &mkvp_list);
-	}
-	spin_unlock_bh(&mkvp_list_lock);
-}
-
-static void mkvp_cache_scrub(u16 cardnr, u16 domain)
-{
-	struct mkvp_info *ptr;
-
-	spin_lock_bh(&mkvp_list_lock);
-	list_for_each_entry(ptr, &mkvp_list, list) {
-		if (ptr->cardnr == cardnr &&
-		    ptr->domain == domain) {
-			list_del(&ptr->list);
-			kfree(ptr);
-			break;
-		}
-	}
-	spin_unlock_bh(&mkvp_list_lock);
-}
-
-static void __exit mkvp_cache_free(void)
-{
-	struct mkvp_info *ptr, *pnext;
-
-	spin_lock_bh(&mkvp_list_lock);
-	list_for_each_entry_safe(ptr, pnext, &mkvp_list, list) {
-		list_del(&ptr->list);
-		kfree(ptr);
-	}
-	spin_unlock_bh(&mkvp_list_lock);
-}
-
-/*
- * Search for a matching crypto card based on the Master Key
- * Verification Pattern provided inside a secure key.
- */
-int pkey_findcard(const struct pkey_seckey *seckey,
-		  u16 *pcardnr, u16 *pdomain, int verify)
-{
-	struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
-	struct zcrypt_device_status_ext *device_status;
-	u16 card, dom;
-	u64 mkvp[2];
-	int i, rc, oi = -1;
-
-	/* mkvp must not be zero */
-	if (t->mkvp == 0)
-		return -EINVAL;
-
-	/* fetch status of all crypto cards */
-	device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
-				      sizeof(struct zcrypt_device_status_ext),
-				      GFP_KERNEL);
-	if (!device_status)
-		return -ENOMEM;
-	zcrypt_device_status_mask_ext(device_status);
-
-	/* walk through all crypto cards */
-	for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
-		card = AP_QID_CARD(device_status[i].qid);
-		dom = AP_QID_QUEUE(device_status[i].qid);
-		if (device_status[i].online &&
-		    device_status[i].functions & 0x04) {
-			/* an enabled CCA Coprocessor card */
-			/* try cached mkvp */
-			if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
-			    t->mkvp == mkvp[0]) {
-				if (!verify)
-					break;
-				/* verify: fetch mkvp from adapter */
-				if (fetch_mkvp(card, dom, mkvp) == 0) {
-					mkvp_cache_update(card, dom, mkvp);
-					if (t->mkvp == mkvp[0])
-						break;
-				}
-			}
-		} else {
-			/* Card is offline and/or not a CCA card. */
-			/* del mkvp entry from cache if it exists */
-			mkvp_cache_scrub(card, dom);
-		}
-	}
-	if (i >= MAX_ZDEV_ENTRIES_EXT) {
-		/* nothing found, so this time without cache */
-		for (i = 0; i < MAX_ZDEV_ENTRIES_EXT; i++) {
-			if (!(device_status[i].online &&
-			      device_status[i].functions & 0x04))
-				continue;
-			card = AP_QID_CARD(device_status[i].qid);
-			dom = AP_QID_QUEUE(device_status[i].qid);
-			/* fresh fetch mkvp from adapter */
-			if (fetch_mkvp(card, dom, mkvp) == 0) {
-				mkvp_cache_update(card, dom, mkvp);
-				if (t->mkvp == mkvp[0])
-					break;
-				if (t->mkvp == mkvp[1] && oi < 0)
-					oi = i;
-			}
-		}
-		if (i >= MAX_ZDEV_ENTRIES_EXT && oi >= 0) {
-			/* old mkvp matched, use this card then */
-			card = AP_QID_CARD(device_status[oi].qid);
-			dom = AP_QID_QUEUE(device_status[oi].qid);
-		}
-	}
-	if (i < MAX_ZDEV_ENTRIES_EXT || oi >= 0) {
-		if (pcardnr)
-			*pcardnr = card;
-		if (pdomain)
-			*pdomain = dom;
-		rc = 0;
-	} else
-		rc = -ENODEV;
-
-	kfree(device_status);
-	return rc;
-}
-EXPORT_SYMBOL(pkey_findcard);
 
 /*
  * Find card and transform secure key into protected key.
  */
-int pkey_skey2pkey(const struct pkey_seckey *seckey,
-		   struct pkey_protkey *protkey)
+static int pkey_skey2pkey(const u8 *key, struct pkey_protkey *pkey)
 {
-	u16 cardnr, domain;
 	int rc, verify;
+	u16 cardnr, domain;
+	struct keytoken_header *hdr = (struct keytoken_header *)key;
 
 	/*
-	 * The pkey_sec2protkey call may fail when a card has been
+	 * The cca_xxx2protkey call may fail when a card has been
 	 * addressed where the master key was changed after last fetch
-	 * of the mkvp into the cache. So first try without verify then
-	 * with verify enabled (thus refreshing the mkvp for each card).
+	 * of the mkvp into the cache. Try 3 times: First witout verify
+	 * then with verify and last round with verify and old master
+	 * key verification pattern match not ignored.
 	 */
-	for (verify = 0; verify < 2; verify++) {
-		rc = pkey_findcard(seckey, &cardnr, &domain, verify);
-		if (rc)
+	for (verify = 0; verify < 3; verify++) {
+		rc = cca_findcard(key, &cardnr, &domain, verify);
+		if (rc < 0)
+			continue;
+		if (rc > 0 && verify < 2)
 			continue;
-		rc = pkey_sec2protkey(cardnr, domain, seckey, protkey);
+		switch (hdr->version) {
+		case TOKVER_CCA_AES:
+			rc = cca_sec2protkey(cardnr, domain,
+					     key, pkey->protkey,
+					     &pkey->len, &pkey->type);
+			break;
+		case TOKVER_CCA_VLSC:
+			rc = cca_cipher2protkey(cardnr, domain,
+						key, pkey->protkey,
+						&pkey->len, &pkey->type);
+			break;
+		default:
+			return -EINVAL;
+		}
 		if (rc == 0)
 			break;
 	}
@@ -1048,22 +171,20 @@ int pkey_skey2pkey(const struct pkey_seckey *seckey,
 
 	return rc;
 }
-EXPORT_SYMBOL(pkey_skey2pkey);
 
 /*
  * Verify key and give back some info about the key.
  */
-int pkey_verifykey(const struct pkey_seckey *seckey,
-		   u16 *pcardnr, u16 *pdomain,
-		   u16 *pkeysize, u32 *pattributes)
+static int pkey_verifykey(const struct pkey_seckey *seckey,
+			  u16 *pcardnr, u16 *pdomain,
+			  u16 *pkeysize, u32 *pattributes)
 {
 	struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
 	u16 cardnr, domain;
-	u64 mkvp[2];
 	int rc;
 
 	/* check the secure key for valid AES secure key */
-	rc = check_secaeskeytoken((u8 *) seckey, 0);
+	rc = cca_check_secaeskeytoken(debug_info, 3, (u8 *) seckey, 0);
 	if (rc)
 		goto out;
 	if (pattributes)
@@ -1072,18 +193,16 @@ int pkey_verifykey(const struct pkey_seckey *seckey,
 		*pkeysize = t->bitsize;
 
 	/* try to find a card which can handle this key */
-	rc = pkey_findcard(seckey, &cardnr, &domain, 1);
-	if (rc)
+	rc = cca_findcard(seckey->seckey, &cardnr, &domain, 1);
+	if (rc < 0)
 		goto out;
 
-	/* check mkvp for old mkvp match */
-	rc = mkvp_cache_fetch(cardnr, domain, mkvp);
-	if (rc)
-		goto out;
-	if (t->mkvp == mkvp[1] && t->mkvp != mkvp[0]) {
+	if (rc > 0) {
+		/* key mkvp matches to old master key mkvp */
 		DEBUG_DBG("%s secure key has old mkvp\n", __func__);
 		if (pattributes)
 			*pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;
+		rc = 0;
 	}
 
 	if (pcardnr)
@@ -1095,12 +214,11 @@ out:
 	DEBUG_DBG("%s rc=%d\n", __func__, rc);
 	return rc;
 }
-EXPORT_SYMBOL(pkey_verifykey);
 
 /*
  * Generate a random protected key
  */
-int pkey_genprotkey(__u32 keytype, struct pkey_protkey *protkey)
+static int pkey_genprotkey(u32 keytype, struct pkey_protkey *protkey)
 {
 	struct pkey_clrkey clrkey;
 	int keysize;
@@ -1135,12 +253,11 @@ int pkey_genprotkey(__u32 keytype, struct pkey_protkey *protkey)
 
 	return 0;
 }
-EXPORT_SYMBOL(pkey_genprotkey);
 
 /*
  * Verify if a protected key is still valid
  */
-int pkey_verifyprotkey(const struct pkey_protkey *protkey)
+static int pkey_verifyprotkey(const struct pkey_protkey *protkey)
 {
 	unsigned long fc;
 	struct {
@@ -1181,12 +298,11 @@ int pkey_verifyprotkey(const struct pkey_protkey *protkey)
 
 	return 0;
 }
-EXPORT_SYMBOL(pkey_verifyprotkey);
 
 /*
  * Transform a non-CCA key token into a protected key
  */
-static int pkey_nonccatok2pkey(const __u8 *key, __u32 keylen,
+static int pkey_nonccatok2pkey(const u8 *key, u32 keylen,
 			       struct pkey_protkey *protkey)
 {
 	struct keytoken_header *hdr = (struct keytoken_header *)key;
@@ -1214,7 +330,7 @@ static int pkey_nonccatok2pkey(const __u8 *key, __u32 keylen,
 /*
  * Transform a CCA internal key token into a protected key
  */
-static int pkey_ccainttok2pkey(const __u8 *key, __u32 keylen,
+static int pkey_ccainttok2pkey(const u8 *key, u32 keylen,
 			       struct pkey_protkey *protkey)
 {
 	struct keytoken_header *hdr = (struct keytoken_header *)key;
@@ -1223,44 +339,414 @@ static int pkey_ccainttok2pkey(const __u8 *key, __u32 keylen,
 	case TOKVER_CCA_AES:
 		if (keylen != sizeof(struct secaeskeytoken))
 			return -EINVAL;
-
-		return pkey_skey2pkey((struct pkey_seckey *)key,
-				      protkey);
+		break;
+	case TOKVER_CCA_VLSC:
+		if (keylen < hdr->len || keylen > MAXCCAVLSCTOKENSIZE)
+			return -EINVAL;
+		break;
 	default:
 		DEBUG_ERR("%s unknown/unsupported CCA internal token version %d\n",
 			  __func__, hdr->version);
 		return -EINVAL;
 	}
+
+	return pkey_skey2pkey(key, protkey);
 }
 
 /*
  * Transform a key blob (of any type) into a protected key
  */
-int pkey_keyblob2pkey(const __u8 *key, __u32 keylen,
+int pkey_keyblob2pkey(const u8 *key, u32 keylen,
 		      struct pkey_protkey *protkey)
 {
+	int rc;
 	struct keytoken_header *hdr = (struct keytoken_header *)key;
 
-	if (keylen < sizeof(struct keytoken_header))
+	if (keylen < sizeof(struct keytoken_header)) {
+		DEBUG_ERR("%s invalid keylen %d\n", __func__, keylen);
 		return -EINVAL;
+	}
 
 	switch (hdr->type) {
 	case TOKTYPE_NON_CCA:
-		return pkey_nonccatok2pkey(key, keylen, protkey);
+		rc = pkey_nonccatok2pkey(key, keylen, protkey);
+		break;
 	case TOKTYPE_CCA_INTERNAL:
-		return pkey_ccainttok2pkey(key, keylen, protkey);
+		rc = pkey_ccainttok2pkey(key, keylen, protkey);
+		break;
 	default:
-		DEBUG_ERR("%s unknown/unsupported blob type %d\n", __func__,
-			  hdr->type);
+		DEBUG_ERR("%s unknown/unsupported blob type %d\n",
+			  __func__, hdr->type);
 		return -EINVAL;
 	}
+
+	DEBUG_DBG("%s rc=%d\n", __func__, rc);
+	return rc;
+
 }
 EXPORT_SYMBOL(pkey_keyblob2pkey);
 
+static int pkey_genseckey2(const struct pkey_apqn *apqns, size_t nr_apqns,
+			   enum pkey_key_type ktype, enum pkey_key_size ksize,
+			   u32 kflags, u8 *keybuf, size_t *keybufsize)
+{
+	int i, card, dom, rc;
+
+	/* check for at least one apqn given */
+	if (!apqns || !nr_apqns)
+		return -EINVAL;
+
+	/* check key type and size */
+	switch (ktype) {
+	case PKEY_TYPE_CCA_DATA:
+	case PKEY_TYPE_CCA_CIPHER:
+		if (*keybufsize < SECKEYBLOBSIZE)
+			return -EINVAL;
+		break;
+	default:
+		return -EINVAL;
+	}
+	switch (ksize) {
+	case PKEY_SIZE_AES_128:
+	case PKEY_SIZE_AES_192:
+	case PKEY_SIZE_AES_256:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* simple try all apqns from the list */
+	for (i = 0, rc = -ENODEV; i < nr_apqns; i++) {
+		card = apqns[i].card;
+		dom = apqns[i].domain;
+		if (ktype == PKEY_TYPE_CCA_DATA) {
+			rc = cca_genseckey(card, dom, ksize, keybuf);
+			*keybufsize = (rc ? 0 : SECKEYBLOBSIZE);
+		} else /* TOKVER_CCA_VLSC */
+			rc = cca_gencipherkey(card, dom, ksize, kflags,
+					      keybuf, keybufsize);
+		if (rc == 0)
+			break;
+	}
+
+	return rc;
+}
+
+static int pkey_clr2seckey2(const struct pkey_apqn *apqns, size_t nr_apqns,
+			    enum pkey_key_type ktype, enum pkey_key_size ksize,
+			    u32 kflags, const u8 *clrkey,
+			    u8 *keybuf, size_t *keybufsize)
+{
+	int i, card, dom, rc;
+
+	/* check for at least one apqn given */
+	if (!apqns || !nr_apqns)
+		return -EINVAL;
+
+	/* check key type and size */
+	switch (ktype) {
+	case PKEY_TYPE_CCA_DATA:
+	case PKEY_TYPE_CCA_CIPHER:
+		if (*keybufsize < SECKEYBLOBSIZE)
+			return -EINVAL;
+		break;
+	default:
+		return -EINVAL;
+	}
+	switch (ksize) {
+	case PKEY_SIZE_AES_128:
+	case PKEY_SIZE_AES_192:
+	case PKEY_SIZE_AES_256:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* simple try all apqns from the list */
+	for (i = 0, rc = -ENODEV; i < nr_apqns; i++) {
+		card = apqns[i].card;
+		dom = apqns[i].domain;
+		if (ktype == PKEY_TYPE_CCA_DATA) {
+			rc = cca_clr2seckey(card, dom, ksize,
+					    clrkey, keybuf);
+			*keybufsize = (rc ? 0 : SECKEYBLOBSIZE);
+		} else /* TOKVER_CCA_VLSC */
+			rc = cca_clr2cipherkey(card, dom, ksize, kflags,
+					       clrkey, keybuf, keybufsize);
+		if (rc == 0)
+			break;
+	}
+
+	return rc;
+}
+
+static int pkey_verifykey2(const u8 *key, size_t keylen,
+			   u16 *cardnr, u16 *domain,
+			   enum pkey_key_type *ktype,
+			   enum pkey_key_size *ksize, u32 *flags)
+{
+	int rc;
+	u32 _nr_apqns, *_apqns = NULL;
+	struct keytoken_header *hdr = (struct keytoken_header *)key;
+
+	if (keylen < sizeof(struct keytoken_header) ||
+	    hdr->type != TOKTYPE_CCA_INTERNAL)
+		return -EINVAL;
+
+	if (hdr->version == TOKVER_CCA_AES) {
+		struct secaeskeytoken *t = (struct secaeskeytoken *)key;
+
+		rc = cca_check_secaeskeytoken(debug_info, 3, key, 0);
+		if (rc)
+			goto out;
+		if (ktype)
+			*ktype = PKEY_TYPE_CCA_DATA;
+		if (ksize)
+			*ksize = (enum pkey_key_size) t->bitsize;
+
+		rc = cca_findcard2(&_apqns, &_nr_apqns, *cardnr, *domain,
+				   ZCRYPT_CEX3C, t->mkvp, 0, 1);
+		if (rc == 0 && flags)
+			*flags = PKEY_FLAGS_MATCH_CUR_MKVP;
+		if (rc == -ENODEV) {
+			rc = cca_findcard2(&_apqns, &_nr_apqns,
+					   *cardnr, *domain,
+					   ZCRYPT_CEX3C, 0, t->mkvp, 1);
+			if (rc == 0 && flags)
+				*flags = PKEY_FLAGS_MATCH_ALT_MKVP;
+		}
+		if (rc)
+			goto out;
+
+		*cardnr = ((struct pkey_apqn *)_apqns)->card;
+		*domain = ((struct pkey_apqn *)_apqns)->domain;
+
+	} else if (hdr->version == TOKVER_CCA_VLSC) {
+		struct cipherkeytoken *t = (struct cipherkeytoken *)key;
+
+		rc = cca_check_secaescipherkey(debug_info, 3, key, 0, 1);
+		if (rc)
+			goto out;
+		if (ktype)
+			*ktype = PKEY_TYPE_CCA_CIPHER;
+		if (ksize) {
+			*ksize = PKEY_SIZE_UNKNOWN;
+			if (!t->plfver && t->wpllen == 512)
+				*ksize = PKEY_SIZE_AES_128;
+			else if (!t->plfver && t->wpllen == 576)
+				*ksize = PKEY_SIZE_AES_192;
+			else if (!t->plfver && t->wpllen == 640)
+				*ksize = PKEY_SIZE_AES_256;
+		}
+
+		rc = cca_findcard2(&_apqns, &_nr_apqns, *cardnr, *domain,
+				   ZCRYPT_CEX6, t->mkvp0, 0, 1);
+		if (rc == 0 && flags)
+			*flags = PKEY_FLAGS_MATCH_CUR_MKVP;
+		if (rc == -ENODEV) {
+			rc = cca_findcard2(&_apqns, &_nr_apqns,
+					   *cardnr, *domain,
+					   ZCRYPT_CEX6, 0, t->mkvp0, 1);
+			if (rc == 0 && flags)
+				*flags = PKEY_FLAGS_MATCH_ALT_MKVP;
+		}
+		if (rc)
+			goto out;
+
+		*cardnr = ((struct pkey_apqn *)_apqns)->card;
+		*domain = ((struct pkey_apqn *)_apqns)->domain;
+
+	} else
+		rc = -EINVAL;
+
+out:
+	kfree(_apqns);
+	return rc;
+}
+
+static int pkey_keyblob2pkey2(const struct pkey_apqn *apqns, size_t nr_apqns,
+			      const u8 *key, size_t keylen,
+			      struct pkey_protkey *pkey)
+{
+	int i, card, dom, rc;
+	struct keytoken_header *hdr = (struct keytoken_header *)key;
+
+	/* check for at least one apqn given */
+	if (!apqns || !nr_apqns)
+		return -EINVAL;
+
+	if (keylen < sizeof(struct keytoken_header))
+		return -EINVAL;
+
+	switch (hdr->type) {
+	case TOKTYPE_NON_CCA:
+		return pkey_nonccatok2pkey(key, keylen, pkey);
+	case TOKTYPE_CCA_INTERNAL:
+		switch (hdr->version) {
+		case TOKVER_CCA_AES:
+			if (keylen != sizeof(struct secaeskeytoken))
+				return -EINVAL;
+			if (cca_check_secaeskeytoken(debug_info, 3, key, 0))
+				return -EINVAL;
+			break;
+		case TOKVER_CCA_VLSC:
+			if (keylen < hdr->len || keylen > MAXCCAVLSCTOKENSIZE)
+				return -EINVAL;
+			if (cca_check_secaescipherkey(debug_info, 3, key, 0, 1))
+				return -EINVAL;
+			break;
+		default:
+			DEBUG_ERR("%s unknown CCA internal token version %d\n",
+				  __func__, hdr->version);
+			return -EINVAL;
+		}
+		break;
+	default:
+		DEBUG_ERR("%s unknown/unsupported blob type %d\n",
+			  __func__, hdr->type);
+		return -EINVAL;
+	}
+
+	/* simple try all apqns from the list */
+	for (i = 0, rc = -ENODEV; i < nr_apqns; i++) {
+		card = apqns[i].card;
+		dom = apqns[i].domain;
+		if (hdr->version == TOKVER_CCA_AES)
+			rc = cca_sec2protkey(card, dom, key, pkey->protkey,
+					     &pkey->len, &pkey->type);
+		else /* TOKVER_CCA_VLSC */
+			rc = cca_cipher2protkey(card, dom, key, pkey->protkey,
+						&pkey->len, &pkey->type);
+		if (rc == 0)
+			break;
+	}
+
+	return rc;
+}
+
+static int pkey_apqns4key(const u8 *key, size_t keylen, u32 flags,
+			  struct pkey_apqn *apqns, size_t *nr_apqns)
+{
+	int rc = EINVAL;
+	u32 _nr_apqns, *_apqns = NULL;
+	struct keytoken_header *hdr = (struct keytoken_header *)key;
+
+	if (keylen < sizeof(struct keytoken_header) ||
+	    hdr->type != TOKTYPE_CCA_INTERNAL ||
+	    flags == 0)
+		return -EINVAL;
+
+	if (hdr->version == TOKVER_CCA_AES || hdr->version == TOKVER_CCA_VLSC) {
+		int minhwtype = ZCRYPT_CEX3C;
+		u64 cur_mkvp = 0, old_mkvp = 0;
+
+		if (hdr->version == TOKVER_CCA_AES) {
+			struct secaeskeytoken *t = (struct secaeskeytoken *)key;
+
+			if (flags & PKEY_FLAGS_MATCH_CUR_MKVP)
+				cur_mkvp = t->mkvp;
+			if (flags & PKEY_FLAGS_MATCH_ALT_MKVP)
+				old_mkvp = t->mkvp;
+		} else {
+			struct cipherkeytoken *t = (struct cipherkeytoken *)key;
+
+			minhwtype = ZCRYPT_CEX6;
+			if (flags & PKEY_FLAGS_MATCH_CUR_MKVP)
+				cur_mkvp = t->mkvp0;
+			if (flags & PKEY_FLAGS_MATCH_ALT_MKVP)
+				old_mkvp = t->mkvp0;
+		}
+		rc = cca_findcard2(&_apqns, &_nr_apqns, 0xFFFF, 0xFFFF,
+				   minhwtype, cur_mkvp, old_mkvp, 1);
+		if (rc)
+			goto out;
+		if (apqns) {
+			if (*nr_apqns < _nr_apqns)
+				rc = -ENOSPC;
+			else
+				memcpy(apqns, _apqns, _nr_apqns * sizeof(u32));
+		}
+		*nr_apqns = _nr_apqns;
+	}
+
+out:
+	kfree(_apqns);
+	return rc;
+}
+
+static int pkey_apqns4keytype(enum pkey_key_type ktype,
+			      u8 cur_mkvp[32], u8 alt_mkvp[32], u32 flags,
+			      struct pkey_apqn *apqns, size_t *nr_apqns)
+{
+	int rc = -EINVAL;
+	u32 _nr_apqns, *_apqns = NULL;
+
+	if (ktype == PKEY_TYPE_CCA_DATA || ktype == PKEY_TYPE_CCA_CIPHER) {
+		u64 cur_mkvp = 0, old_mkvp = 0;
+		int minhwtype = ZCRYPT_CEX3C;
+
+		if (flags & PKEY_FLAGS_MATCH_CUR_MKVP)
+			cur_mkvp = *((u64 *) cur_mkvp);
+		if (flags & PKEY_FLAGS_MATCH_ALT_MKVP)
+			old_mkvp = *((u64 *) alt_mkvp);
+		if (ktype == PKEY_TYPE_CCA_CIPHER)
+			minhwtype = ZCRYPT_CEX6;
+		rc = cca_findcard2(&_apqns, &_nr_apqns, 0xFFFF, 0xFFFF,
+				   minhwtype, cur_mkvp, old_mkvp, 1);
+		if (rc)
+			goto out;
+		if (apqns) {
+			if (*nr_apqns < _nr_apqns)
+				rc = -ENOSPC;
+			else
+				memcpy(apqns, _apqns, _nr_apqns * sizeof(u32));
+		}
+		*nr_apqns = _nr_apqns;
+	}
+
+out:
+	kfree(_apqns);
+	return rc;
+}
+
 /*
  * File io functions
  */
 
+static void *_copy_key_from_user(void __user *ukey, size_t keylen)
+{
+	void *kkey;
+
+	if (!ukey || keylen < MINKEYBLOBSIZE || keylen > KEYBLOBBUFSIZE)
+		return ERR_PTR(-EINVAL);
+	kkey = kmalloc(keylen, GFP_KERNEL);
+	if (!kkey)
+		return ERR_PTR(-ENOMEM);
+	if (copy_from_user(kkey, ukey, keylen)) {
+		kfree(kkey);
+		return ERR_PTR(-EFAULT);
+	}
+
+	return kkey;
+}
+
+static void *_copy_apqns_from_user(void __user *uapqns, size_t nr_apqns)
+{
+	void *kapqns = NULL;
+	size_t nbytes;
+
+	if (uapqns && nr_apqns > 0) {
+		nbytes = nr_apqns * sizeof(struct pkey_apqn);
+		kapqns = kmalloc(nbytes, GFP_KERNEL);
+		if (!kapqns)
+			return ERR_PTR(-ENOMEM);
+		if (copy_from_user(kapqns, uapqns, nbytes))
+			return ERR_PTR(-EFAULT);
+	}
+
+	return kapqns;
+}
+
 static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 				unsigned long arg)
 {
@@ -1273,9 +759,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 
 		if (copy_from_user(&kgs, ugs, sizeof(kgs)))
 			return -EFAULT;
-		rc = pkey_genseckey(kgs.cardnr, kgs.domain,
-				    kgs.keytype, &kgs.seckey);
-		DEBUG_DBG("%s pkey_genseckey()=%d\n", __func__, rc);
+		rc = cca_genseckey(kgs.cardnr, kgs.domain,
+				   kgs.keytype, kgs.seckey.seckey);
+		DEBUG_DBG("%s cca_genseckey()=%d\n", __func__, rc);
 		if (rc)
 			break;
 		if (copy_to_user(ugs, &kgs, sizeof(kgs)))
@@ -1288,9 +774,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 
 		if (copy_from_user(&kcs, ucs, sizeof(kcs)))
 			return -EFAULT;
-		rc = pkey_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
-				     &kcs.clrkey, &kcs.seckey);
-		DEBUG_DBG("%s pkey_clr2seckey()=%d\n", __func__, rc);
+		rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
+				    kcs.clrkey.clrkey, kcs.seckey.seckey);
+		DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc);
 		if (rc)
 			break;
 		if (copy_to_user(ucs, &kcs, sizeof(kcs)))
@@ -1304,9 +790,10 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 
 		if (copy_from_user(&ksp, usp, sizeof(ksp)))
 			return -EFAULT;
-		rc = pkey_sec2protkey(ksp.cardnr, ksp.domain,
-				      &ksp.seckey, &ksp.protkey);
-		DEBUG_DBG("%s pkey_sec2protkey()=%d\n", __func__, rc);
+		rc = cca_sec2protkey(ksp.cardnr, ksp.domain,
+				     ksp.seckey.seckey, ksp.protkey.protkey,
+				     NULL, &ksp.protkey.type);
+		DEBUG_DBG("%s cca_sec2protkey()=%d\n", __func__, rc);
 		if (rc)
 			break;
 		if (copy_to_user(usp, &ksp, sizeof(ksp)))
@@ -1335,10 +822,10 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 
 		if (copy_from_user(&kfc, ufc, sizeof(kfc)))
 			return -EFAULT;
-		rc = pkey_findcard(&kfc.seckey,
-				   &kfc.cardnr, &kfc.domain, 1);
-		DEBUG_DBG("%s pkey_findcard()=%d\n", __func__, rc);
-		if (rc)
+		rc = cca_findcard(kfc.seckey.seckey,
+				  &kfc.cardnr, &kfc.domain, 1);
+		DEBUG_DBG("%s cca_findcard()=%d\n", __func__, rc);
+		if (rc < 0)
 			break;
 		if (copy_to_user(ufc, &kfc, sizeof(kfc)))
 			return -EFAULT;
@@ -1350,7 +837,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 
 		if (copy_from_user(&ksp, usp, sizeof(ksp)))
 			return -EFAULT;
-		rc = pkey_skey2pkey(&ksp.seckey, &ksp.protkey);
+		rc = pkey_skey2pkey(ksp.seckey.seckey, &ksp.protkey);
 		DEBUG_DBG("%s pkey_skey2pkey()=%d\n", __func__, rc);
 		if (rc)
 			break;
@@ -1400,24 +887,148 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 	case PKEY_KBLOB2PROTK: {
 		struct pkey_kblob2pkey __user *utp = (void __user *) arg;
 		struct pkey_kblob2pkey ktp;
-		__u8 __user *ukey;
-		__u8 *kkey;
+		u8 *kkey;
 
 		if (copy_from_user(&ktp, utp, sizeof(ktp)))
 			return -EFAULT;
-		if (ktp.keylen < MINKEYBLOBSIZE ||
-		    ktp.keylen > MAXKEYBLOBSIZE)
-			return -EINVAL;
-		ukey = ktp.key;
-		kkey = kmalloc(ktp.keylen, GFP_KERNEL);
-		if (kkey == NULL)
+		kkey = _copy_key_from_user(ktp.key, ktp.keylen);
+		if (IS_ERR(kkey))
+			return PTR_ERR(kkey);
+		rc = pkey_keyblob2pkey(kkey, ktp.keylen, &ktp.protkey);
+		DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
+		kfree(kkey);
+		if (rc)
+			break;
+		if (copy_to_user(utp, &ktp, sizeof(ktp)))
+			return -EFAULT;
+		break;
+	}
+	case PKEY_GENSECK2: {
+		struct pkey_genseck2 __user *ugs = (void __user *) arg;
+		struct pkey_genseck2 kgs;
+		struct pkey_apqn *apqns;
+		size_t klen = KEYBLOBBUFSIZE;
+		u8 *kkey;
+
+		if (copy_from_user(&kgs, ugs, sizeof(kgs)))
+			return -EFAULT;
+		apqns = _copy_apqns_from_user(kgs.apqns, kgs.apqn_entries);
+		if (IS_ERR(apqns))
+			return PTR_ERR(apqns);
+		kkey = kmalloc(klen, GFP_KERNEL);
+		if (!kkey) {
+			kfree(apqns);
+			return -ENOMEM;
+		}
+		rc = pkey_genseckey2(apqns, kgs.apqn_entries,
+				     kgs.type, kgs.size, kgs.keygenflags,
+				     kkey, &klen);
+		DEBUG_DBG("%s pkey_genseckey2()=%d\n", __func__, rc);
+		kfree(apqns);
+		if (rc) {
+			kfree(kkey);
+			break;
+		}
+		if (kgs.key) {
+			if (kgs.keylen < klen) {
+				kfree(kkey);
+				return -EINVAL;
+			}
+			if (copy_to_user(kgs.key, kkey, klen)) {
+				kfree(kkey);
+				return -EFAULT;
+			}
+		}
+		kgs.keylen = klen;
+		if (copy_to_user(ugs, &kgs, sizeof(kgs)))
+			rc = -EFAULT;
+		kfree(kkey);
+		break;
+	}
+	case PKEY_CLR2SECK2: {
+		struct pkey_clr2seck2 __user *ucs = (void __user *) arg;
+		struct pkey_clr2seck2 kcs;
+		struct pkey_apqn *apqns;
+		size_t klen = KEYBLOBBUFSIZE;
+		u8 *kkey;
+
+		if (copy_from_user(&kcs, ucs, sizeof(kcs)))
+			return -EFAULT;
+		apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries);
+		if (IS_ERR(apqns))
+			return PTR_ERR(apqns);
+		kkey = kmalloc(klen, GFP_KERNEL);
+		if (!kkey) {
+			kfree(apqns);
 			return -ENOMEM;
-		if (copy_from_user(kkey, ukey, ktp.keylen)) {
+		}
+		rc = pkey_clr2seckey2(apqns, kcs.apqn_entries,
+				      kcs.type, kcs.size, kcs.keygenflags,
+				      kcs.clrkey.clrkey, kkey, &klen);
+		DEBUG_DBG("%s pkey_clr2seckey2()=%d\n", __func__, rc);
+		kfree(apqns);
+		if (rc) {
 			kfree(kkey);
+			break;
+		}
+		if (kcs.key) {
+			if (kcs.keylen < klen) {
+				kfree(kkey);
+				return -EINVAL;
+			}
+			if (copy_to_user(kcs.key, kkey, klen)) {
+				kfree(kkey);
+				return -EFAULT;
+			}
+		}
+		kcs.keylen = klen;
+		if (copy_to_user(ucs, &kcs, sizeof(kcs)))
+			rc = -EFAULT;
+		memzero_explicit(&kcs, sizeof(kcs));
+		kfree(kkey);
+		break;
+	}
+	case PKEY_VERIFYKEY2: {
+		struct pkey_verifykey2 __user *uvk = (void __user *) arg;
+		struct pkey_verifykey2 kvk;
+		u8 *kkey;
+
+		if (copy_from_user(&kvk, uvk, sizeof(kvk)))
+			return -EFAULT;
+		kkey = _copy_key_from_user(kvk.key, kvk.keylen);
+		if (IS_ERR(kkey))
+			return PTR_ERR(kkey);
+		rc = pkey_verifykey2(kkey, kvk.keylen,
+				     &kvk.cardnr, &kvk.domain,
+				     &kvk.type, &kvk.size, &kvk.flags);
+		DEBUG_DBG("%s pkey_verifykey2()=%d\n", __func__, rc);
+		kfree(kkey);
+		if (rc)
+			break;
+		if (copy_to_user(uvk, &kvk, sizeof(kvk)))
+			return -EFAULT;
+		break;
+	}
+	case PKEY_KBLOB2PROTK2: {
+		struct pkey_kblob2pkey2 __user *utp = (void __user *) arg;
+		struct pkey_kblob2pkey2 ktp;
+		struct pkey_apqn *apqns = NULL;
+		u8 *kkey;
+
+		if (copy_from_user(&ktp, utp, sizeof(ktp)))
 			return -EFAULT;
+		apqns = _copy_apqns_from_user(ktp.apqns, ktp.apqn_entries);
+		if (IS_ERR(apqns))
+			return PTR_ERR(apqns);
+		kkey = _copy_key_from_user(ktp.key, ktp.keylen);
+		if (IS_ERR(kkey)) {
+			kfree(apqns);
+			return PTR_ERR(kkey);
 		}
-		rc = pkey_keyblob2pkey(kkey, ktp.keylen, &ktp.protkey);
-		DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
+		rc = pkey_keyblob2pkey2(apqns, ktp.apqn_entries,
+					kkey, ktp.keylen, &ktp.protkey);
+		DEBUG_DBG("%s pkey_keyblob2pkey2()=%d\n", __func__, rc);
+		kfree(apqns);
 		kfree(kkey);
 		if (rc)
 			break;
@@ -1425,6 +1036,97 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 			return -EFAULT;
 		break;
 	}
+	case PKEY_APQNS4K: {
+		struct pkey_apqns4key __user *uak = (void __user *) arg;
+		struct pkey_apqns4key kak;
+		struct pkey_apqn *apqns = NULL;
+		size_t nr_apqns, len;
+		u8 *kkey;
+
+		if (copy_from_user(&kak, uak, sizeof(kak)))
+			return -EFAULT;
+		nr_apqns = kak.apqn_entries;
+		if (nr_apqns) {
+			apqns = kmalloc_array(nr_apqns,
+					      sizeof(struct pkey_apqn),
+					      GFP_KERNEL);
+			if (!apqns)
+				return -ENOMEM;
+		}
+		kkey = _copy_key_from_user(kak.key, kak.keylen);
+		if (IS_ERR(kkey)) {
+			kfree(apqns);
+			return PTR_ERR(kkey);
+		}
+		rc = pkey_apqns4key(kkey, kak.keylen, kak.flags,
+				    apqns, &nr_apqns);
+		DEBUG_DBG("%s pkey_apqns4key()=%d\n", __func__, rc);
+		kfree(kkey);
+		if (rc && rc != -ENOSPC) {
+			kfree(apqns);
+			break;
+		}
+		if (!rc && kak.apqns) {
+			if (nr_apqns > kak.apqn_entries) {
+				kfree(apqns);
+				return -EINVAL;
+			}
+			len = nr_apqns * sizeof(struct pkey_apqn);
+			if (len) {
+				if (copy_to_user(kak.apqns, apqns, len)) {
+					kfree(apqns);
+					return -EFAULT;
+				}
+			}
+		}
+		kak.apqn_entries = nr_apqns;
+		if (copy_to_user(uak, &kak, sizeof(kak)))
+			rc = -EFAULT;
+		kfree(apqns);
+		break;
+	}
+	case PKEY_APQNS4KT: {
+		struct pkey_apqns4keytype __user *uat = (void __user *) arg;
+		struct pkey_apqns4keytype kat;
+		struct pkey_apqn *apqns = NULL;
+		size_t nr_apqns, len;
+
+		if (copy_from_user(&kat, uat, sizeof(kat)))
+			return -EFAULT;
+		nr_apqns = kat.apqn_entries;
+		if (nr_apqns) {
+			apqns = kmalloc_array(nr_apqns,
+					      sizeof(struct pkey_apqn),
+					      GFP_KERNEL);
+			if (!apqns)
+				return -ENOMEM;
+		}
+		rc = pkey_apqns4keytype(kat.type, kat.cur_mkvp, kat.alt_mkvp,
+					kat.flags, apqns, &nr_apqns);
+		DEBUG_DBG("%s pkey_apqns4keytype()=%d\n", __func__, rc);
+		if (rc && rc != -ENOSPC) {
+			kfree(apqns);
+			break;
+		}
+		if (!rc && kat.apqns) {
+			if (nr_apqns > kat.apqn_entries) {
+				kfree(apqns);
+				return -EINVAL;
+			}
+			len = nr_apqns * sizeof(struct pkey_apqn);
+			if (len) {
+				if (copy_to_user(kat.apqns, apqns, len)) {
+					kfree(apqns);
+					return -EFAULT;
+				}
+			}
+		}
+		kat.apqn_entries = nr_apqns;
+		if (copy_to_user(uat, &kat, sizeof(kat)))
+			rc = -EFAULT;
+		kfree(apqns);
+		break;
+	}
 	default:
 		/* unknown/unsupported ioctl cmd */
 		return -ENOTTY;
@@ -1567,6 +1269,7 @@ static ssize_t pkey_ccadata_aes_attr_read(u32 keytype, bool is_xts, char *buf,
 					  loff_t off, size_t count)
 {
 	int rc;
+	struct pkey_seckey *seckey = (struct pkey_seckey *) buf;
 
 	if (off != 0 || count < sizeof(struct secaeskeytoken))
 		return -EINVAL;
@@ -1574,13 +1277,13 @@ static ssize_t pkey_ccadata_aes_attr_read(u32 keytype, bool is_xts, char *buf,
 		if (count < 2 * sizeof(struct secaeskeytoken))
 			return -EINVAL;
 
-	rc = pkey_genseckey(-1, -1, keytype, (struct pkey_seckey *)buf);
+	rc = cca_genseckey(-1, -1, keytype, seckey->seckey);
 	if (rc)
 		return rc;
 
 	if (is_xts) {
-		buf += sizeof(struct pkey_seckey);
-		rc = pkey_genseckey(-1, -1, keytype, (struct pkey_seckey *)buf);
+		seckey++;
+		rc = cca_genseckey(-1, -1, keytype, seckey->seckey);
 		if (rc)
 			return rc;
 
@@ -1660,9 +1363,122 @@ static struct attribute_group ccadata_attr_group = {
 	.bin_attrs = ccadata_attrs,
 };
 
+#define CCACIPHERTOKENSIZE	(sizeof(struct cipherkeytoken) + 80)
+
+/*
+ * Sysfs attribute read function for all secure key ccacipher binary attributes.
+ * The implementation can not deal with partial reads, because a new random
+ * secure key blob is generated with each read. In case of partial reads
+ * (i.e. off != 0 or count < key blob size) -EINVAL is returned.
+ */
+static ssize_t pkey_ccacipher_aes_attr_read(enum pkey_key_size keybits,
+					    bool is_xts, char *buf, loff_t off,
+					    size_t count)
+{
+	size_t keysize;
+	int rc;
+
+	if (off != 0 || count < CCACIPHERTOKENSIZE)
+		return -EINVAL;
+	if (is_xts)
+		if (count < 2 * CCACIPHERTOKENSIZE)
+			return -EINVAL;
+
+	keysize = CCACIPHERTOKENSIZE;
+	rc = cca_gencipherkey(-1, -1, keybits, 0, buf, &keysize);
+	if (rc)
+		return rc;
+	memset(buf + keysize, 0, CCACIPHERTOKENSIZE - keysize);
+
+	if (is_xts) {
+		keysize = CCACIPHERTOKENSIZE;
+		rc = cca_gencipherkey(-1, -1, keybits, 0,
+				      buf + CCACIPHERTOKENSIZE, &keysize);
+		if (rc)
+			return rc;
+		memset(buf + CCACIPHERTOKENSIZE + keysize, 0,
+		       CCACIPHERTOKENSIZE - keysize);
+
+		return 2 * CCACIPHERTOKENSIZE;
+	}
+
+	return CCACIPHERTOKENSIZE;
+}
+
+static ssize_t ccacipher_aes_128_read(struct file *filp,
+				      struct kobject *kobj,
+				      struct bin_attribute *attr,
+				      char *buf, loff_t off,
+				      size_t count)
+{
+	return pkey_ccacipher_aes_attr_read(PKEY_SIZE_AES_128, false, buf,
+					    off, count);
+}
+
+static ssize_t ccacipher_aes_192_read(struct file *filp,
+				      struct kobject *kobj,
+				      struct bin_attribute *attr,
+				      char *buf, loff_t off,
+				      size_t count)
+{
+	return pkey_ccacipher_aes_attr_read(PKEY_SIZE_AES_192, false, buf,
+					    off, count);
+}
+
+static ssize_t ccacipher_aes_256_read(struct file *filp,
+				      struct kobject *kobj,
+				      struct bin_attribute *attr,
+				      char *buf, loff_t off,
+				      size_t count)
+{
+	return pkey_ccacipher_aes_attr_read(PKEY_SIZE_AES_256, false, buf,
+					    off, count);
+}
+
+static ssize_t ccacipher_aes_128_xts_read(struct file *filp,
+					  struct kobject *kobj,
+					  struct bin_attribute *attr,
+					  char *buf, loff_t off,
+					  size_t count)
+{
+	return pkey_ccacipher_aes_attr_read(PKEY_SIZE_AES_128, true, buf,
+					    off, count);
+}
+
+static ssize_t ccacipher_aes_256_xts_read(struct file *filp,
+					  struct kobject *kobj,
+					  struct bin_attribute *attr,
+					  char *buf, loff_t off,
+					  size_t count)
+{
+	return pkey_ccacipher_aes_attr_read(PKEY_SIZE_AES_256, true, buf,
+					    off, count);
+}
+
+static BIN_ATTR_RO(ccacipher_aes_128, CCACIPHERTOKENSIZE);
+static BIN_ATTR_RO(ccacipher_aes_192, CCACIPHERTOKENSIZE);
+static BIN_ATTR_RO(ccacipher_aes_256, CCACIPHERTOKENSIZE);
+static BIN_ATTR_RO(ccacipher_aes_128_xts, 2 * CCACIPHERTOKENSIZE);
+static BIN_ATTR_RO(ccacipher_aes_256_xts, 2 * CCACIPHERTOKENSIZE);
+
+static struct bin_attribute *ccacipher_attrs[] = {
+	&bin_attr_ccacipher_aes_128,
+	&bin_attr_ccacipher_aes_192,
+	&bin_attr_ccacipher_aes_256,
+	&bin_attr_ccacipher_aes_128_xts,
+	&bin_attr_ccacipher_aes_256_xts,
+	NULL
+};
+
+static struct attribute_group ccacipher_attr_group = {
+	.name	   = "ccacipher",
+	.bin_attrs = ccacipher_attrs,
+};
+
 static const struct attribute_group *pkey_attr_groups[] = {
 	&protkey_attr_group,
 	&ccadata_attr_group,
+	&ccacipher_attr_group,
 	NULL,
 };
 
@@ -1716,7 +1532,6 @@ static int __init pkey_init(void)
 static void __exit pkey_exit(void)
 {
 	misc_deregister(&pkey_dev);
-	mkvp_cache_free();
 	pkey_debug_exit();
 }