Commit | Line | Data |
---|---|---|
6148c1ad KY |
1 | /** |
2 | * AES XCBC routines supporting the Power 7+ Nest Accelerators driver | |
3 | * | |
4 | * Copyright (C) 2011-2012 International Business Machines Inc. | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; version 2 only. | |
9 | * | |
10 | * This program is distributed in the hope that it will be useful, | |
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
13 | * GNU General Public License for more details. | |
14 | * | |
15 | * You should have received a copy of the GNU General Public License | |
16 | * along with this program; if not, write to the Free Software | |
17 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. | |
18 | * | |
19 | * Author: Kent Yoder <yoder1@us.ibm.com> | |
20 | */ | |
21 | ||
22 | #include <crypto/internal/hash.h> | |
23 | #include <crypto/aes.h> | |
24 | #include <crypto/algapi.h> | |
25 | #include <linux/module.h> | |
26 | #include <linux/types.h> | |
27 | #include <linux/crypto.h> | |
28 | #include <asm/vio.h> | |
29 | ||
30 | #include "nx_csbcpb.h" | |
31 | #include "nx.h" | |
32 | ||
33 | ||
34 | struct xcbc_state { | |
35 | u8 state[AES_BLOCK_SIZE]; | |
36 | unsigned int count; | |
37 | u8 buffer[AES_BLOCK_SIZE]; | |
38 | }; | |
39 | ||
40 | static int nx_xcbc_set_key(struct crypto_shash *desc, | |
41 | const u8 *in_key, | |
42 | unsigned int key_len) | |
43 | { | |
44 | struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc); | |
030f4e96 | 45 | struct nx_csbcpb *csbcpb = nx_ctx->csbcpb; |
6148c1ad KY |
46 | |
47 | switch (key_len) { | |
48 | case AES_KEYSIZE_128: | |
49 | nx_ctx->ap = &nx_ctx->props[NX_PROPS_AES_128]; | |
50 | break; | |
51 | default: | |
52 | return -EINVAL; | |
53 | } | |
54 | ||
030f4e96 | 55 | memcpy(csbcpb->cpb.aes_xcbc.key, in_key, key_len); |
6148c1ad KY |
56 | |
57 | return 0; | |
58 | } | |
59 | ||
41e3173d MC |
60 | /* |
61 | * Based on RFC 3566, for a zero-length message: | |
62 | * | |
63 | * n = 1 | |
64 | * K1 = E(K, 0x01010101010101010101010101010101) | |
65 | * K3 = E(K, 0x03030303030303030303030303030303) | |
66 | * E[0] = 0x00000000000000000000000000000000 | |
67 | * M[1] = 0x80000000000000000000000000000000 (0 length message with padding) | |
68 | * E[1] = (K1, M[1] ^ E[0] ^ K3) | |
69 | * Tag = M[1] | |
70 | */ | |
71 | static int nx_xcbc_empty(struct shash_desc *desc, u8 *out) | |
72 | { | |
73 | struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base); | |
74 | struct nx_csbcpb *csbcpb = nx_ctx->csbcpb; | |
75 | struct nx_sg *in_sg, *out_sg; | |
76 | u8 keys[2][AES_BLOCK_SIZE]; | |
77 | u8 key[32]; | |
78 | int rc = 0; | |
5313231a | 79 | int len; |
41e3173d MC |
80 | |
81 | /* Change to ECB mode */ | |
82 | csbcpb->cpb.hdr.mode = NX_MODE_AES_ECB; | |
83 | memcpy(key, csbcpb->cpb.aes_xcbc.key, AES_BLOCK_SIZE); | |
84 | memcpy(csbcpb->cpb.aes_ecb.key, key, AES_BLOCK_SIZE); | |
85 | NX_CPB_FDM(csbcpb) |= NX_FDM_ENDE_ENCRYPT; | |
86 | ||
87 | /* K1 and K3 base patterns */ | |
88 | memset(keys[0], 0x01, sizeof(keys[0])); | |
89 | memset(keys[1], 0x03, sizeof(keys[1])); | |
90 | ||
5313231a | 91 | len = sizeof(keys); |
41e3173d | 92 | /* Generate K1 and K3 encrypting the patterns */ |
5313231a | 93 | in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *) keys, &len, |
41e3173d | 94 | nx_ctx->ap->sglen); |
5313231a LB |
95 | |
96 | if (len != sizeof(keys)) | |
97 | return -EINVAL; | |
98 | ||
99 | out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *) keys, &len, | |
41e3173d | 100 | nx_ctx->ap->sglen); |
5313231a LB |
101 | |
102 | if (len != sizeof(keys)) | |
103 | return -EINVAL; | |
104 | ||
41e3173d MC |
105 | nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg); |
106 | nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg); | |
107 | ||
108 | rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, | |
109 | desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP); | |
110 | if (rc) | |
111 | goto out; | |
112 | atomic_inc(&(nx_ctx->stats->aes_ops)); | |
113 | ||
114 | /* XOr K3 with the padding for a 0 length message */ | |
115 | keys[1][0] ^= 0x80; | |
116 | ||
5313231a LB |
117 | len = sizeof(keys[1]); |
118 | ||
41e3173d MC |
119 | /* Encrypt the final result */ |
120 | memcpy(csbcpb->cpb.aes_ecb.key, keys[0], AES_BLOCK_SIZE); | |
5313231a | 121 | in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *) keys[1], &len, |
41e3173d | 122 | nx_ctx->ap->sglen); |
5313231a LB |
123 | |
124 | if (len != sizeof(keys[1])) | |
125 | return -EINVAL; | |
126 | ||
127 | len = AES_BLOCK_SIZE; | |
128 | out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len, | |
41e3173d | 129 | nx_ctx->ap->sglen); |
5313231a LB |
130 | |
131 | if (len != AES_BLOCK_SIZE) | |
132 | return -EINVAL; | |
133 | ||
41e3173d MC |
134 | nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg); |
135 | nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg); | |
136 | ||
137 | rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, | |
138 | desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP); | |
139 | if (rc) | |
140 | goto out; | |
141 | atomic_inc(&(nx_ctx->stats->aes_ops)); | |
142 | ||
143 | out: | |
144 | /* Restore XCBC mode */ | |
145 | csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC; | |
146 | memcpy(csbcpb->cpb.aes_xcbc.key, key, AES_BLOCK_SIZE); | |
147 | NX_CPB_FDM(csbcpb) &= ~NX_FDM_ENDE_ENCRYPT; | |
148 | ||
149 | return rc; | |
150 | } | |
151 | ||
030f4e96 | 152 | static int nx_crypto_ctx_aes_xcbc_init2(struct crypto_tfm *tfm) |
6148c1ad | 153 | { |
030f4e96 | 154 | struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm); |
6148c1ad | 155 | struct nx_csbcpb *csbcpb = nx_ctx->csbcpb; |
030f4e96 | 156 | int err; |
6148c1ad | 157 | |
030f4e96 HX |
158 | err = nx_crypto_ctx_aes_xcbc_init(tfm); |
159 | if (err) | |
160 | return err; | |
6148c1ad | 161 | |
030f4e96 | 162 | nx_ctx_init(nx_ctx, HCOP_FC_AES); |
6148c1ad KY |
163 | |
164 | NX_CPB_SET_KEY_SIZE(csbcpb, NX_KS_AES_128); | |
165 | csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC; | |
166 | ||
030f4e96 HX |
167 | return 0; |
168 | } | |
5313231a | 169 | |
030f4e96 HX |
170 | static int nx_xcbc_init(struct shash_desc *desc) |
171 | { | |
172 | struct xcbc_state *sctx = shash_desc_ctx(desc); | |
5313231a | 173 | |
030f4e96 | 174 | memset(sctx, 0, sizeof *sctx); |
6148c1ad KY |
175 | |
176 | return 0; | |
177 | } | |
178 | ||
179 | static int nx_xcbc_update(struct shash_desc *desc, | |
180 | const u8 *data, | |
181 | unsigned int len) | |
182 | { | |
183 | struct xcbc_state *sctx = shash_desc_ctx(desc); | |
184 | struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base); | |
185 | struct nx_csbcpb *csbcpb = nx_ctx->csbcpb; | |
186 | struct nx_sg *in_sg; | |
030f4e96 | 187 | struct nx_sg *out_sg; |
5313231a LB |
188 | u32 to_process = 0, leftover, total; |
189 | unsigned int max_sg_len; | |
c849163b | 190 | unsigned long irq_flags; |
6148c1ad | 191 | int rc = 0; |
5313231a | 192 | int data_len; |
6148c1ad | 193 | |
c849163b MC |
194 | spin_lock_irqsave(&nx_ctx->lock, irq_flags); |
195 | ||
9d6f1a82 FG |
196 | |
197 | total = sctx->count + len; | |
6148c1ad KY |
198 | |
199 | /* 2 cases for total data len: | |
200 | * 1: <= AES_BLOCK_SIZE: copy into state, return 0 | |
201 | * 2: > AES_BLOCK_SIZE: process X blocks, copy in leftover | |
202 | */ | |
9d6f1a82 | 203 | if (total <= AES_BLOCK_SIZE) { |
6148c1ad KY |
204 | memcpy(sctx->buffer + sctx->count, data, len); |
205 | sctx->count += len; | |
206 | goto out; | |
207 | } | |
208 | ||
9d6f1a82 | 209 | in_sg = nx_ctx->in_sg; |
5313231a | 210 | max_sg_len = min_t(u64, nx_driver.of.max_sg_len/sizeof(struct nx_sg), |
9d6f1a82 | 211 | nx_ctx->ap->sglen); |
5313231a LB |
212 | max_sg_len = min_t(u64, max_sg_len, |
213 | nx_ctx->ap->databytelen/NX_PAGE_SIZE); | |
9d6f1a82 | 214 | |
030f4e96 HX |
215 | data_len = AES_BLOCK_SIZE; |
216 | out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state, | |
217 | &len, nx_ctx->ap->sglen); | |
218 | ||
219 | if (data_len != AES_BLOCK_SIZE) { | |
220 | rc = -EINVAL; | |
221 | goto out; | |
222 | } | |
223 | ||
224 | nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg); | |
225 | ||
9d6f1a82 | 226 | do { |
5313231a | 227 | to_process = total - to_process; |
9d6f1a82 | 228 | to_process = to_process & ~(AES_BLOCK_SIZE - 1); |
5313231a | 229 | |
9d6f1a82 FG |
230 | leftover = total - to_process; |
231 | ||
232 | /* the hardware will not accept a 0 byte operation for this | |
233 | * algorithm and the operation MUST be finalized to be correct. | |
234 | * So if we happen to get an update that falls on a block sized | |
235 | * boundary, we must save off the last block to finalize with | |
236 | * later. */ | |
237 | if (!leftover) { | |
238 | to_process -= AES_BLOCK_SIZE; | |
239 | leftover = AES_BLOCK_SIZE; | |
240 | } | |
241 | ||
242 | if (sctx->count) { | |
5313231a | 243 | data_len = sctx->count; |
9d6f1a82 FG |
244 | in_sg = nx_build_sg_list(nx_ctx->in_sg, |
245 | (u8 *) sctx->buffer, | |
5313231a | 246 | &data_len, |
9d6f1a82 | 247 | max_sg_len); |
030f4e96 HX |
248 | if (data_len != sctx->count) { |
249 | rc = -EINVAL; | |
250 | goto out; | |
251 | } | |
9d6f1a82 | 252 | } |
5313231a LB |
253 | |
254 | data_len = to_process - sctx->count; | |
9d6f1a82 FG |
255 | in_sg = nx_build_sg_list(in_sg, |
256 | (u8 *) data, | |
5313231a | 257 | &data_len, |
9d6f1a82 | 258 | max_sg_len); |
5313231a | 259 | |
030f4e96 HX |
260 | if (data_len != to_process - sctx->count) { |
261 | rc = -EINVAL; | |
262 | goto out; | |
263 | } | |
5313231a | 264 | |
6148c1ad KY |
265 | nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * |
266 | sizeof(struct nx_sg); | |
6148c1ad | 267 | |
9d6f1a82 FG |
268 | /* we've hit the nx chip previously and we're updating again, |
269 | * so copy over the partial digest */ | |
270 | if (NX_CPB_FDM(csbcpb) & NX_FDM_CONTINUATION) { | |
271 | memcpy(csbcpb->cpb.aes_xcbc.cv, | |
272 | csbcpb->cpb.aes_xcbc.out_cv_mac, | |
273 | AES_BLOCK_SIZE); | |
274 | } | |
275 | ||
276 | NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE; | |
277 | if (!nx_ctx->op.inlen || !nx_ctx->op.outlen) { | |
278 | rc = -EINVAL; | |
279 | goto out; | |
280 | } | |
281 | ||
282 | rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, | |
283 | desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP); | |
284 | if (rc) | |
285 | goto out; | |
6148c1ad | 286 | |
9d6f1a82 | 287 | atomic_inc(&(nx_ctx->stats->aes_ops)); |
6148c1ad | 288 | |
9d6f1a82 FG |
289 | /* everything after the first update is continuation */ |
290 | NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION; | |
6148c1ad | 291 | |
9d6f1a82 FG |
292 | total -= to_process; |
293 | data += to_process - sctx->count; | |
294 | sctx->count = 0; | |
295 | in_sg = nx_ctx->in_sg; | |
296 | } while (leftover > AES_BLOCK_SIZE); | |
6148c1ad KY |
297 | |
298 | /* copy the leftover back into the state struct */ | |
9d6f1a82 | 299 | memcpy(sctx->buffer, data, leftover); |
6148c1ad KY |
300 | sctx->count = leftover; |
301 | ||
6148c1ad | 302 | out: |
c849163b | 303 | spin_unlock_irqrestore(&nx_ctx->lock, irq_flags); |
6148c1ad KY |
304 | return rc; |
305 | } | |
306 | ||
307 | static int nx_xcbc_final(struct shash_desc *desc, u8 *out) | |
308 | { | |
309 | struct xcbc_state *sctx = shash_desc_ctx(desc); | |
310 | struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base); | |
311 | struct nx_csbcpb *csbcpb = nx_ctx->csbcpb; | |
312 | struct nx_sg *in_sg, *out_sg; | |
c849163b | 313 | unsigned long irq_flags; |
6148c1ad | 314 | int rc = 0; |
5313231a | 315 | int len; |
6148c1ad | 316 | |
c849163b MC |
317 | spin_lock_irqsave(&nx_ctx->lock, irq_flags); |
318 | ||
6148c1ad KY |
319 | if (NX_CPB_FDM(csbcpb) & NX_FDM_CONTINUATION) { |
320 | /* we've hit the nx chip previously, now we're finalizing, | |
321 | * so copy over the partial digest */ | |
322 | memcpy(csbcpb->cpb.aes_xcbc.cv, | |
323 | csbcpb->cpb.aes_xcbc.out_cv_mac, AES_BLOCK_SIZE); | |
324 | } else if (sctx->count == 0) { | |
41e3173d MC |
325 | /* |
326 | * we've never seen an update, so this is a 0 byte op. The | |
327 | * hardware cannot handle a 0 byte op, so just ECB to | |
328 | * generate the hash. | |
329 | */ | |
330 | rc = nx_xcbc_empty(desc, out); | |
6148c1ad KY |
331 | goto out; |
332 | } | |
333 | ||
334 | /* final is represented by continuing the operation and indicating that | |
335 | * this is not an intermediate operation */ | |
336 | NX_CPB_FDM(csbcpb) &= ~NX_FDM_INTERMEDIATE; | |
337 | ||
5313231a | 338 | len = sctx->count; |
6148c1ad | 339 | in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *)sctx->buffer, |
5313231a LB |
340 | &len, nx_ctx->ap->sglen); |
341 | ||
030f4e96 HX |
342 | if (len != sctx->count) { |
343 | rc = -EINVAL; | |
344 | goto out; | |
345 | } | |
5313231a LB |
346 | |
347 | len = AES_BLOCK_SIZE; | |
348 | out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len, | |
6148c1ad KY |
349 | nx_ctx->ap->sglen); |
350 | ||
030f4e96 HX |
351 | if (len != AES_BLOCK_SIZE) { |
352 | rc = -EINVAL; | |
353 | goto out; | |
354 | } | |
5313231a | 355 | |
6148c1ad KY |
356 | nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg); |
357 | nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg); | |
358 | ||
359 | if (!nx_ctx->op.outlen) { | |
360 | rc = -EINVAL; | |
361 | goto out; | |
362 | } | |
363 | ||
364 | rc = nx_hcall_sync(nx_ctx, &nx_ctx->op, | |
365 | desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP); | |
366 | if (rc) | |
367 | goto out; | |
368 | ||
369 | atomic_inc(&(nx_ctx->stats->aes_ops)); | |
370 | ||
371 | memcpy(out, csbcpb->cpb.aes_xcbc.out_cv_mac, AES_BLOCK_SIZE); | |
372 | out: | |
c849163b | 373 | spin_unlock_irqrestore(&nx_ctx->lock, irq_flags); |
6148c1ad KY |
374 | return rc; |
375 | } | |
376 | ||
377 | struct shash_alg nx_shash_aes_xcbc_alg = { | |
378 | .digestsize = AES_BLOCK_SIZE, | |
379 | .init = nx_xcbc_init, | |
380 | .update = nx_xcbc_update, | |
381 | .final = nx_xcbc_final, | |
382 | .setkey = nx_xcbc_set_key, | |
383 | .descsize = sizeof(struct xcbc_state), | |
384 | .statesize = sizeof(struct xcbc_state), | |
385 | .base = { | |
386 | .cra_name = "xcbc(aes)", | |
387 | .cra_driver_name = "xcbc-aes-nx", | |
388 | .cra_priority = 300, | |
389 | .cra_flags = CRYPTO_ALG_TYPE_SHASH, | |
390 | .cra_blocksize = AES_BLOCK_SIZE, | |
391 | .cra_module = THIS_MODULE, | |
392 | .cra_ctxsize = sizeof(struct nx_crypto_ctx), | |
030f4e96 | 393 | .cra_init = nx_crypto_ctx_aes_xcbc_init2, |
6148c1ad KY |
394 | .cra_exit = nx_crypto_ctx_exit, |
395 | } | |
396 | }; |