Return and reason codes for the CSFEUTIL program

When you invoke the CSFEUTIL program as a batch job, you receive the return code in a message when the job completes. The meanings of the return codes are:
Return Code
Meaning
0
Process successful.
4
Parameters are incorrect.
8
RACF authorization check failed.
12
Process unsuccessful.
68 or 72
CKDS processing has failed. An error was detected in the new KDS.
84 or 116
CKDS processing encountered an abnormal end while processing a CKDS. When the return code is 84 the error occurred while processing the new CKDS. When the return code is 116 the error occurred while processing the old CKDS. View the SYSTRACE at the time of the error for an indication of the abend that was encountered.
100 or 104
CKDS processing has failed. An error was detected in the old KDS.
101 or 105
CKDS processing has failed. An error occurred while processing a KDS record. For a 101 return code, consult the Return Code 8 reason codes in the z/OS Cryptographic Services ICSF Application Programmer's Guide. For a 105 return code, consult the Return Code 12 reason codes in the z/OS Cryptographic Services ICSF Application Programmer's Guide.

When the program is invoked from another program, the invoking program receives the reason code in General Register 0 along with the return code in General Register 15. The following list describes the meaning of the reason codes. If a particular reason code is not listed, refer to the listing of ICSF and TSS return and reason codes in the z/OS Cryptographic Services ICSF Application Programmer's Guide.

Return code 0 has these reason codes:
Reason Code
Meaning
36132
CKDS reencipher/Change MK processed only tokens encrypted under the DES master key.
36136
CKDS reencipher/Change MK processed only tokens encrypted under the AES master key.
36140
CKDS reencipher/Change MK processed tokens encrypted under the DES and AES master key.
Return code 8 has these reason codes:
Reason Code
Meaning
3114
Another refresh utility request is executing, and this utility request will not be allowed to run.
16000
Invoker has insufficient RACF access authority to perform function.
Return code 12 has these reason codes:
Reason Code
Meaning
36000
Unable to change master key. Check hardware status.
36020
Input CKDS is empty or not initialized (authentication pattern in the control record is invalid).
36060
The new master key register or registers are not full.
36068
The input KDS is not enciphered under the current master key.
36084
The master key register cannot be changed since ICSF is running in compatibility mode.
36104
Option not available. There were no Cryptographic Coprocessors available to perform the service that was attempted.
36160
The attempt to reencipher the CKDS failed because there is an enhanced token in the CKDS.
36168
The LRECL attribute of the input CKDS doesn’t match the LRECL of the output CKDS.
36211
A request was made to load a key data set (CKDS, PKDS or TKDS)which has records which are in KDSR format. This level of ICSF does not support KDSR format records
Return code 72 or 104 has these reason codes:
Reason Code
Meaning
6008
A service routine has failed.
The service routines that may be called are:
CSFMGN
MAC generation
CSFMVR
MAC verification
CSFMKVR
Master key verification
6012
The Single-record, read-write installation exit (CSFSRRW) returned a return code greater than 4.
6016
An I/O error occurred reading or writing the CKDS.
6020
The CSFSRRW installation exit abended and the installation options EXIT keyword specifies that the invoking service should end.
6024
The CSFSRRW installation exit abended and the installation options EXIT keyword specifies that ICSF should end.
6028
The CKDS access routine could not establish the ESTAE environment.
6040
The CSFSRRW installation exit could not be loaded and is required.
6044
Information necessary to set up CSFSRRW installation exit processing could not be obtained.
6048
The system keys cannot be found while attempting to write a complete CKDS data set.
6052
For a write CKDS record request, the current master key verification pattern (MKVP) does not match the CKDS header record MKVP.
6056
The output CKDS is not empty.
36001
A variable-length record format CKDS cannot be used on a system with a Cryptographic Coprocessor Feature.
36168
The LRECL attribute of the input CKDS doesn’t match the LRECL of the output CKDS.
Note: It is possible that you will receive MVS reason codes rather than ICSF reason codes, for example, if the reason code indicates a dynamic allocation failure. For an explanation of Dynamic Allocation reason codes, see z/OS MVS Programming: Authorized Assembler Services Guide.