Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AES XCBC routines supporting the Power 7+ Nest Accelerators driver
4 *
5 * Copyright (C) 2011-2012 International Business Machines Inc.
6 *
7 * Author: Kent Yoder <yoder1@us.ibm.com>
8 */
9
10#include <crypto/aes.h>
11#include <crypto/internal/hash.h>
12#include <linux/atomic.h>
13#include <linux/errno.h>
14#include <linux/kernel.h>
15#include <linux/module.h>
16#include <linux/spinlock.h>
17#include <linux/string.h>
18
19#include "nx_csbcpb.h"
20#include "nx.h"
21
22
23struct xcbc_state {
24 u8 state[AES_BLOCK_SIZE];
25};
26
27static int nx_xcbc_set_key(struct crypto_shash *desc,
28 const u8 *in_key,
29 unsigned int key_len)
30{
31 struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc);
32 struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
33
34 switch (key_len) {
35 case AES_KEYSIZE_128:
36 nx_ctx->ap = &nx_ctx->props[NX_PROPS_AES_128];
37 break;
38 default:
39 return -EINVAL;
40 }
41
42 memcpy(csbcpb->cpb.aes_xcbc.key, in_key, key_len);
43
44 return 0;
45}
46
47/*
48 * Based on RFC 3566, for a zero-length message:
49 *
50 * n = 1
51 * K1 = E(K, 0x01010101010101010101010101010101)
52 * K3 = E(K, 0x03030303030303030303030303030303)
53 * E[0] = 0x00000000000000000000000000000000
54 * M[1] = 0x80000000000000000000000000000000 (0 length message with padding)
55 * E[1] = (K1, M[1] ^ E[0] ^ K3)
56 * Tag = M[1]
57 */
58static int nx_xcbc_empty(struct shash_desc *desc, u8 *out)
59{
60 struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc->tfm);
61 struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
62 struct nx_sg *in_sg, *out_sg;
63 u8 keys[2][AES_BLOCK_SIZE];
64 u8 key[32];
65 int rc = 0;
66 int len;
67
68 /* Change to ECB mode */
69 csbcpb->cpb.hdr.mode = NX_MODE_AES_ECB;
70 memcpy(key, csbcpb->cpb.aes_xcbc.key, AES_BLOCK_SIZE);
71 memcpy(csbcpb->cpb.aes_ecb.key, key, AES_BLOCK_SIZE);
72 NX_CPB_FDM(csbcpb) |= NX_FDM_ENDE_ENCRYPT;
73
74 /* K1 and K3 base patterns */
75 memset(keys[0], 0x01, sizeof(keys[0]));
76 memset(keys[1], 0x03, sizeof(keys[1]));
77
78 len = sizeof(keys);
79 /* Generate K1 and K3 encrypting the patterns */
80 in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *) keys, &len,
81 nx_ctx->ap->sglen);
82
83 if (len != sizeof(keys))
84 return -EINVAL;
85
86 out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *) keys, &len,
87 nx_ctx->ap->sglen);
88
89 if (len != sizeof(keys))
90 return -EINVAL;
91
92 nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
93 nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
94
95 rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, 0);
96 if (rc)
97 goto out;
98 atomic_inc(&(nx_ctx->stats->aes_ops));
99
100 /* XOr K3 with the padding for a 0 length message */
101 keys[1][0] ^= 0x80;
102
103 len = sizeof(keys[1]);
104
105 /* Encrypt the final result */
106 memcpy(csbcpb->cpb.aes_ecb.key, keys[0], AES_BLOCK_SIZE);
107 in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *) keys[1], &len,
108 nx_ctx->ap->sglen);
109
110 if (len != sizeof(keys[1]))
111 return -EINVAL;
112
113 len = AES_BLOCK_SIZE;
114 out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len,
115 nx_ctx->ap->sglen);
116
117 if (len != AES_BLOCK_SIZE)
118 return -EINVAL;
119
120 nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
121 nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
122
123 rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, 0);
124 if (rc)
125 goto out;
126 atomic_inc(&(nx_ctx->stats->aes_ops));
127
128out:
129 /* Restore XCBC mode */
130 csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC;
131 memcpy(csbcpb->cpb.aes_xcbc.key, key, AES_BLOCK_SIZE);
132 NX_CPB_FDM(csbcpb) &= ~NX_FDM_ENDE_ENCRYPT;
133
134 return rc;
135}
136
137static int nx_crypto_ctx_aes_xcbc_init2(struct crypto_shash *tfm)
138{
139 struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(tfm);
140 struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
141 int err;
142
143 err = nx_crypto_ctx_aes_xcbc_init(tfm);
144 if (err)
145 return err;
146
147 nx_ctx_init(nx_ctx, HCOP_FC_AES);
148
149 NX_CPB_SET_KEY_SIZE(csbcpb, NX_KS_AES_128);
150 csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC;
151
152 return 0;
153}
154
155static int nx_xcbc_init(struct shash_desc *desc)
156{
157 struct xcbc_state *sctx = shash_desc_ctx(desc);
158
159 memset(sctx, 0, sizeof *sctx);
160
161 return 0;
162}
163
164static int nx_xcbc_update(struct shash_desc *desc,
165 const u8 *data,
166 unsigned int len)
167{
168 struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc->tfm);
169 struct xcbc_state *sctx = shash_desc_ctx(desc);
170 struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
171 struct nx_sg *in_sg;
172 struct nx_sg *out_sg;
173 unsigned int max_sg_len;
174 unsigned long irq_flags;
175 u32 to_process, total;
176 int rc = 0;
177 int data_len;
178
179 spin_lock_irqsave(&nx_ctx->lock, irq_flags);
180
181 memcpy(csbcpb->cpb.aes_xcbc.out_cv_mac, sctx->state, AES_BLOCK_SIZE);
182 NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE;
183 NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION;
184
185 total = len;
186
187 in_sg = nx_ctx->in_sg;
188 max_sg_len = min_t(u64, nx_driver.of.max_sg_len/sizeof(struct nx_sg),
189 nx_ctx->ap->sglen);
190 max_sg_len = min_t(u64, max_sg_len,
191 nx_ctx->ap->databytelen/NX_PAGE_SIZE);
192
193 data_len = AES_BLOCK_SIZE;
194 out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
195 &data_len, nx_ctx->ap->sglen);
196
197 if (data_len != AES_BLOCK_SIZE) {
198 rc = -EINVAL;
199 goto out;
200 }
201
202 nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
203
204 do {
205 to_process = total & ~(AES_BLOCK_SIZE - 1);
206
207 in_sg = nx_build_sg_list(in_sg,
208 (u8 *) data,
209 &to_process,
210 max_sg_len);
211
212 nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) *
213 sizeof(struct nx_sg);
214
215 /* we've hit the nx chip previously and we're updating again,
216 * so copy over the partial digest */
217 memcpy(csbcpb->cpb.aes_xcbc.cv,
218 csbcpb->cpb.aes_xcbc.out_cv_mac, AES_BLOCK_SIZE);
219
220 if (!nx_ctx->op.inlen || !nx_ctx->op.outlen) {
221 rc = -EINVAL;
222 goto out;
223 }
224
225 rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, 0);
226 if (rc)
227 goto out;
228
229 atomic_inc(&(nx_ctx->stats->aes_ops));
230
231 total -= to_process;
232 data += to_process;
233 in_sg = nx_ctx->in_sg;
234 } while (total >= AES_BLOCK_SIZE);
235
236 rc = total;
237 memcpy(sctx->state, csbcpb->cpb.aes_xcbc.out_cv_mac, AES_BLOCK_SIZE);
238
239out:
240 spin_unlock_irqrestore(&nx_ctx->lock, irq_flags);
241 return rc;
242}
243
244static int nx_xcbc_finup(struct shash_desc *desc, const u8 *src,
245 unsigned int nbytes, u8 *out)
246{
247 struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc->tfm);
248 struct xcbc_state *sctx = shash_desc_ctx(desc);
249 struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
250 struct nx_sg *in_sg, *out_sg;
251 unsigned long irq_flags;
252 int rc = 0;
253 int len;
254
255 spin_lock_irqsave(&nx_ctx->lock, irq_flags);
256
257 if (nbytes) {
258 /* non-zero final, so copy over the partial digest */
259 memcpy(csbcpb->cpb.aes_xcbc.cv, sctx->state, AES_BLOCK_SIZE);
260 } else {
261 /*
262 * we've never seen an update, so this is a 0 byte op. The
263 * hardware cannot handle a 0 byte op, so just ECB to
264 * generate the hash.
265 */
266 rc = nx_xcbc_empty(desc, out);
267 goto out;
268 }
269
270 /* final is represented by continuing the operation and indicating that
271 * this is not an intermediate operation */
272 NX_CPB_FDM(csbcpb) &= ~NX_FDM_INTERMEDIATE;
273
274 len = nbytes;
275 in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *)src, &len,
276 nx_ctx->ap->sglen);
277
278 if (len != nbytes) {
279 rc = -EINVAL;
280 goto out;
281 }
282
283 len = AES_BLOCK_SIZE;
284 out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len,
285 nx_ctx->ap->sglen);
286
287 if (len != AES_BLOCK_SIZE) {
288 rc = -EINVAL;
289 goto out;
290 }
291
292 nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
293 nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
294
295 if (!nx_ctx->op.outlen) {
296 rc = -EINVAL;
297 goto out;
298 }
299
300 rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, 0);
301 if (rc)
302 goto out;
303
304 atomic_inc(&(nx_ctx->stats->aes_ops));
305
306 memcpy(out, csbcpb->cpb.aes_xcbc.out_cv_mac, AES_BLOCK_SIZE);
307out:
308 spin_unlock_irqrestore(&nx_ctx->lock, irq_flags);
309 return rc;
310}
311
312struct shash_alg nx_shash_aes_xcbc_alg = {
313 .digestsize = AES_BLOCK_SIZE,
314 .init = nx_xcbc_init,
315 .update = nx_xcbc_update,
316 .finup = nx_xcbc_finup,
317 .setkey = nx_xcbc_set_key,
318 .descsize = sizeof(struct xcbc_state),
319 .init_tfm = nx_crypto_ctx_aes_xcbc_init2,
320 .exit_tfm = nx_crypto_ctx_shash_exit,
321 .base = {
322 .cra_name = "xcbc(aes)",
323 .cra_driver_name = "xcbc-aes-nx",
324 .cra_priority = 300,
325 .cra_flags = CRYPTO_AHASH_ALG_BLOCK_ONLY |
326 CRYPTO_AHASH_ALG_FINAL_NONZERO,
327 .cra_blocksize = AES_BLOCK_SIZE,
328 .cra_module = THIS_MODULE,
329 .cra_ctxsize = sizeof(struct nx_crypto_ctx),
330 }
331};