Re: [PATCH v4 24/24] s390/pkey/crypto: Introduce xflags param for pkey in-kernel API

[Holger Dengler <dengler@linux.ibm.com>]

On 09/04/2025 16:03, Harald Freudenberger wrote:
> Add a new parameter xflags to the in-kernel API function
> pkey_key2protkey(). Currently there is only one flag supported:
> 
> * PKEY_XFLAG_NOMEMALLOC:
>   If this flag is given in the xflags parameter, the pkey
>   implementation is not allowed to allocate memory but instead should
>   fall back to use preallocated memory or simple fail with -ENOMEM.
>   This flag is for protected key derive within a cipher or similar
>   which must not allocate memory which would cause io operations - see
>   also the CRYPTO_ALG_ALLOCATES_MEMORY flag in crypto.h.
> 
> The one and only user of this in-kernel API - the skcipher
> implementations PAES in paes_s390.c set this flag upon request
> to derive a protected key from the given raw key material.
> 
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Reviewed-by: Holger Dengler <dengler@linux.ibm.com>

See one last comment below.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>

> ---
>  arch/s390/crypto/paes_s390.c   |  6 +++---
>  arch/s390/include/asm/pkey.h   | 15 ++++++++++++++-
>  drivers/s390/crypto/pkey_api.c | 11 +++++++----
>  3 files changed, 24 insertions(+), 8 deletions(-)
> 
[...]
> diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
> index 55a4e70b866b..c46b57001550 100644
> --- a/drivers/s390/crypto/pkey_api.c
> +++ b/drivers/s390/crypto/pkey_api.c
> @@ -53,17 +53,20 @@ static int key2protkey(const struct pkey_apqn *apqns, size_t nr_apqns,
>   * In-Kernel function: Transform a key blob (of any type) into a protected key
>   */
>  int pkey_key2protkey(const u8 *key, u32 keylen,
> -		     u8 *protkey, u32 *protkeylen, u32 *protkeytype)
> +		     u8 *protkey, u32 *protkeylen, u32 *protkeytype, u32 xflags)
>  {
> +	u32 flags;
>  	int rc;
> -	const u32 xflags = 0;
> +
> +	/* as of now only the NOMEMALLOC flag is supported */
> +	flags = xflags & PKEY_XFLAG_NOMEMALLOC ? ZCRYPT_XFLAG_NOMEMALLOC : 0;

Please move the mapping of the flags to the implementation of the pkey handlers. The pkey layer should stay independant to any hander implementation and should not know about any of the ZCRYPT_XFLAGs.

[...]

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler
--
IBM Systems, Linux on IBM Z Development
dengler@linux.ibm.com