2 * AES XCBC routines supporting the Power 7+ Nest Accelerators driver
4 * Copyright (C) 2011-2012 International Business Machines Inc.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; version 2 only.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 * Author: Kent Yoder <yoder1@us.ibm.com>
22 #include <crypto/internal/hash.h>
23 #include <crypto/aes.h>
24 #include <crypto/algapi.h>
25 #include <linux/module.h>
26 #include <linux/types.h>
27 #include <linux/crypto.h>
30 #include "nx_csbcpb.h"
35 u8 state
[AES_BLOCK_SIZE
];
37 u8 buffer
[AES_BLOCK_SIZE
];
40 static int nx_xcbc_set_key(struct crypto_shash
*desc
,
44 struct nx_crypto_ctx
*nx_ctx
= crypto_shash_ctx(desc
);
48 nx_ctx
->ap
= &nx_ctx
->props
[NX_PROPS_AES_128
];
54 memcpy(nx_ctx
->priv
.xcbc
.key
, in_key
, key_len
);
60 * Based on RFC 3566, for a zero-length message:
63 * K1 = E(K, 0x01010101010101010101010101010101)
64 * K3 = E(K, 0x03030303030303030303030303030303)
65 * E[0] = 0x00000000000000000000000000000000
66 * M[1] = 0x80000000000000000000000000000000 (0 length message with padding)
67 * E[1] = (K1, M[1] ^ E[0] ^ K3)
70 static int nx_xcbc_empty(struct shash_desc
*desc
, u8
*out
)
72 struct nx_crypto_ctx
*nx_ctx
= crypto_tfm_ctx(&desc
->tfm
->base
);
73 struct nx_csbcpb
*csbcpb
= nx_ctx
->csbcpb
;
74 struct nx_sg
*in_sg
, *out_sg
;
75 u8 keys
[2][AES_BLOCK_SIZE
];
80 /* Change to ECB mode */
81 csbcpb
->cpb
.hdr
.mode
= NX_MODE_AES_ECB
;
82 memcpy(key
, csbcpb
->cpb
.aes_xcbc
.key
, AES_BLOCK_SIZE
);
83 memcpy(csbcpb
->cpb
.aes_ecb
.key
, key
, AES_BLOCK_SIZE
);
84 NX_CPB_FDM(csbcpb
) |= NX_FDM_ENDE_ENCRYPT
;
86 /* K1 and K3 base patterns */
87 memset(keys
[0], 0x01, sizeof(keys
[0]));
88 memset(keys
[1], 0x03, sizeof(keys
[1]));
91 /* Generate K1 and K3 encrypting the patterns */
92 in_sg
= nx_build_sg_list(nx_ctx
->in_sg
, (u8
*) keys
, &len
,
95 if (len
!= sizeof(keys
))
98 out_sg
= nx_build_sg_list(nx_ctx
->out_sg
, (u8
*) keys
, &len
,
101 if (len
!= sizeof(keys
))
104 nx_ctx
->op
.inlen
= (nx_ctx
->in_sg
- in_sg
) * sizeof(struct nx_sg
);
105 nx_ctx
->op
.outlen
= (nx_ctx
->out_sg
- out_sg
) * sizeof(struct nx_sg
);
107 rc
= nx_hcall_sync(nx_ctx
, &nx_ctx
->op
,
108 desc
->flags
& CRYPTO_TFM_REQ_MAY_SLEEP
);
111 atomic_inc(&(nx_ctx
->stats
->aes_ops
));
113 /* XOr K3 with the padding for a 0 length message */
116 len
= sizeof(keys
[1]);
118 /* Encrypt the final result */
119 memcpy(csbcpb
->cpb
.aes_ecb
.key
, keys
[0], AES_BLOCK_SIZE
);
120 in_sg
= nx_build_sg_list(nx_ctx
->in_sg
, (u8
*) keys
[1], &len
,
123 if (len
!= sizeof(keys
[1]))
126 len
= AES_BLOCK_SIZE
;
127 out_sg
= nx_build_sg_list(nx_ctx
->out_sg
, out
, &len
,
130 if (len
!= AES_BLOCK_SIZE
)
133 nx_ctx
->op
.inlen
= (nx_ctx
->in_sg
- in_sg
) * sizeof(struct nx_sg
);
134 nx_ctx
->op
.outlen
= (nx_ctx
->out_sg
- out_sg
) * sizeof(struct nx_sg
);
136 rc
= nx_hcall_sync(nx_ctx
, &nx_ctx
->op
,
137 desc
->flags
& CRYPTO_TFM_REQ_MAY_SLEEP
);
140 atomic_inc(&(nx_ctx
->stats
->aes_ops
));
143 /* Restore XCBC mode */
144 csbcpb
->cpb
.hdr
.mode
= NX_MODE_AES_XCBC_MAC
;
145 memcpy(csbcpb
->cpb
.aes_xcbc
.key
, key
, AES_BLOCK_SIZE
);
146 NX_CPB_FDM(csbcpb
) &= ~NX_FDM_ENDE_ENCRYPT
;
151 static int nx_xcbc_init(struct shash_desc
*desc
)
153 struct xcbc_state
*sctx
= shash_desc_ctx(desc
);
154 struct nx_crypto_ctx
*nx_ctx
= crypto_tfm_ctx(&desc
->tfm
->base
);
155 struct nx_csbcpb
*csbcpb
= nx_ctx
->csbcpb
;
156 struct nx_sg
*out_sg
;
159 nx_ctx_init(nx_ctx
, HCOP_FC_AES
);
161 memset(sctx
, 0, sizeof *sctx
);
163 NX_CPB_SET_KEY_SIZE(csbcpb
, NX_KS_AES_128
);
164 csbcpb
->cpb
.hdr
.mode
= NX_MODE_AES_XCBC_MAC
;
166 memcpy(csbcpb
->cpb
.aes_xcbc
.key
, nx_ctx
->priv
.xcbc
.key
, AES_BLOCK_SIZE
);
167 memset(nx_ctx
->priv
.xcbc
.key
, 0, sizeof *nx_ctx
->priv
.xcbc
.key
);
169 len
= AES_BLOCK_SIZE
;
170 out_sg
= nx_build_sg_list(nx_ctx
->out_sg
, (u8
*)sctx
->state
,
171 &len
, nx_ctx
->ap
->sglen
);
173 if (len
!= AES_BLOCK_SIZE
)
176 nx_ctx
->op
.outlen
= (nx_ctx
->out_sg
- out_sg
) * sizeof(struct nx_sg
);
181 static int nx_xcbc_update(struct shash_desc
*desc
,
185 struct xcbc_state
*sctx
= shash_desc_ctx(desc
);
186 struct nx_crypto_ctx
*nx_ctx
= crypto_tfm_ctx(&desc
->tfm
->base
);
187 struct nx_csbcpb
*csbcpb
= nx_ctx
->csbcpb
;
189 u32 to_process
= 0, leftover
, total
;
190 unsigned int max_sg_len
;
191 unsigned long irq_flags
;
195 spin_lock_irqsave(&nx_ctx
->lock
, irq_flags
);
198 total
= sctx
->count
+ len
;
200 /* 2 cases for total data len:
201 * 1: <= AES_BLOCK_SIZE: copy into state, return 0
202 * 2: > AES_BLOCK_SIZE: process X blocks, copy in leftover
204 if (total
<= AES_BLOCK_SIZE
) {
205 memcpy(sctx
->buffer
+ sctx
->count
, data
, len
);
210 in_sg
= nx_ctx
->in_sg
;
211 max_sg_len
= min_t(u64
, nx_driver
.of
.max_sg_len
/sizeof(struct nx_sg
),
213 max_sg_len
= min_t(u64
, max_sg_len
,
214 nx_ctx
->ap
->databytelen
/NX_PAGE_SIZE
);
217 to_process
= total
- to_process
;
218 to_process
= to_process
& ~(AES_BLOCK_SIZE
- 1);
220 leftover
= total
- to_process
;
222 /* the hardware will not accept a 0 byte operation for this
223 * algorithm and the operation MUST be finalized to be correct.
224 * So if we happen to get an update that falls on a block sized
225 * boundary, we must save off the last block to finalize with
228 to_process
-= AES_BLOCK_SIZE
;
229 leftover
= AES_BLOCK_SIZE
;
233 data_len
= sctx
->count
;
234 in_sg
= nx_build_sg_list(nx_ctx
->in_sg
,
238 if (data_len
!= sctx
->count
)
242 data_len
= to_process
- sctx
->count
;
243 in_sg
= nx_build_sg_list(in_sg
,
248 if (data_len
!= to_process
- sctx
->count
)
251 nx_ctx
->op
.inlen
= (nx_ctx
->in_sg
- in_sg
) *
252 sizeof(struct nx_sg
);
254 /* we've hit the nx chip previously and we're updating again,
255 * so copy over the partial digest */
256 if (NX_CPB_FDM(csbcpb
) & NX_FDM_CONTINUATION
) {
257 memcpy(csbcpb
->cpb
.aes_xcbc
.cv
,
258 csbcpb
->cpb
.aes_xcbc
.out_cv_mac
,
262 NX_CPB_FDM(csbcpb
) |= NX_FDM_INTERMEDIATE
;
263 if (!nx_ctx
->op
.inlen
|| !nx_ctx
->op
.outlen
) {
268 rc
= nx_hcall_sync(nx_ctx
, &nx_ctx
->op
,
269 desc
->flags
& CRYPTO_TFM_REQ_MAY_SLEEP
);
273 atomic_inc(&(nx_ctx
->stats
->aes_ops
));
275 /* everything after the first update is continuation */
276 NX_CPB_FDM(csbcpb
) |= NX_FDM_CONTINUATION
;
279 data
+= to_process
- sctx
->count
;
281 in_sg
= nx_ctx
->in_sg
;
282 } while (leftover
> AES_BLOCK_SIZE
);
284 /* copy the leftover back into the state struct */
285 memcpy(sctx
->buffer
, data
, leftover
);
286 sctx
->count
= leftover
;
289 spin_unlock_irqrestore(&nx_ctx
->lock
, irq_flags
);
293 static int nx_xcbc_final(struct shash_desc
*desc
, u8
*out
)
295 struct xcbc_state
*sctx
= shash_desc_ctx(desc
);
296 struct nx_crypto_ctx
*nx_ctx
= crypto_tfm_ctx(&desc
->tfm
->base
);
297 struct nx_csbcpb
*csbcpb
= nx_ctx
->csbcpb
;
298 struct nx_sg
*in_sg
, *out_sg
;
299 unsigned long irq_flags
;
303 spin_lock_irqsave(&nx_ctx
->lock
, irq_flags
);
305 if (NX_CPB_FDM(csbcpb
) & NX_FDM_CONTINUATION
) {
306 /* we've hit the nx chip previously, now we're finalizing,
307 * so copy over the partial digest */
308 memcpy(csbcpb
->cpb
.aes_xcbc
.cv
,
309 csbcpb
->cpb
.aes_xcbc
.out_cv_mac
, AES_BLOCK_SIZE
);
310 } else if (sctx
->count
== 0) {
312 * we've never seen an update, so this is a 0 byte op. The
313 * hardware cannot handle a 0 byte op, so just ECB to
316 rc
= nx_xcbc_empty(desc
, out
);
320 /* final is represented by continuing the operation and indicating that
321 * this is not an intermediate operation */
322 NX_CPB_FDM(csbcpb
) &= ~NX_FDM_INTERMEDIATE
;
325 in_sg
= nx_build_sg_list(nx_ctx
->in_sg
, (u8
*)sctx
->buffer
,
326 &len
, nx_ctx
->ap
->sglen
);
328 if (len
!= sctx
->count
)
331 len
= AES_BLOCK_SIZE
;
332 out_sg
= nx_build_sg_list(nx_ctx
->out_sg
, out
, &len
,
335 if (len
!= AES_BLOCK_SIZE
)
338 nx_ctx
->op
.inlen
= (nx_ctx
->in_sg
- in_sg
) * sizeof(struct nx_sg
);
339 nx_ctx
->op
.outlen
= (nx_ctx
->out_sg
- out_sg
) * sizeof(struct nx_sg
);
341 if (!nx_ctx
->op
.outlen
) {
346 rc
= nx_hcall_sync(nx_ctx
, &nx_ctx
->op
,
347 desc
->flags
& CRYPTO_TFM_REQ_MAY_SLEEP
);
351 atomic_inc(&(nx_ctx
->stats
->aes_ops
));
353 memcpy(out
, csbcpb
->cpb
.aes_xcbc
.out_cv_mac
, AES_BLOCK_SIZE
);
355 spin_unlock_irqrestore(&nx_ctx
->lock
, irq_flags
);
359 struct shash_alg nx_shash_aes_xcbc_alg
= {
360 .digestsize
= AES_BLOCK_SIZE
,
361 .init
= nx_xcbc_init
,
362 .update
= nx_xcbc_update
,
363 .final
= nx_xcbc_final
,
364 .setkey
= nx_xcbc_set_key
,
365 .descsize
= sizeof(struct xcbc_state
),
366 .statesize
= sizeof(struct xcbc_state
),
368 .cra_name
= "xcbc(aes)",
369 .cra_driver_name
= "xcbc-aes-nx",
371 .cra_flags
= CRYPTO_ALG_TYPE_SHASH
,
372 .cra_blocksize
= AES_BLOCK_SIZE
,
373 .cra_module
= THIS_MODULE
,
374 .cra_ctxsize
= sizeof(struct nx_crypto_ctx
),
375 .cra_init
= nx_crypto_ctx_aes_xcbc_init
,
376 .cra_exit
= nx_crypto_ctx_exit
,