[deliverable/linux.git] / drivers / crypto / padlock-aes.c

/* 
 * Cryptographic API.
 *
 * Support for VIA PadLock hardware crypto engine.
 *
 * Copyright (c) 2004  Michal Ludvig <michal@logix.cz>
 *
 */

#include <crypto/algapi.h>
#include <crypto/aes.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/types.h>
#include <linux/errno.h>
#include <linux/interrupt.h>
#include <linux/kernel.h>
#include <linux/percpu.h>
#include <linux/smp.h>
#include <asm/byteorder.h>
#include <asm/i387.h>
#include "padlock.h"

/* Control word. */
struct cword {
	unsigned int __attribute__ ((__packed__))
		rounds:4,
		algo:3,
		keygen:1,
		interm:1,
		encdec:1,
		ksize:2;
} __attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));

/* Whenever making any changes to the following
 * structure *make sure* you keep E, d_data
 * and cword aligned on 16 Bytes boundaries and
 * the Hardware can access 16 * 16 bytes of E and d_data
 * (only the first 15 * 16 bytes matter but the HW reads
 * more).
 */
struct aes_ctx {
	u32 E[AES_MAX_KEYLENGTH_U32]
		__attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
	u32 d_data[AES_MAX_KEYLENGTH_U32]
		__attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
	struct {
		struct cword encrypt;
		struct cword decrypt;
	} cword;
	u32 *D;
};

static DEFINE_PER_CPU(struct cword *, last_cword);

/* Tells whether the ACE is capable to generate
   the extended key for a given key_len. */
static inline int
aes_hw_extkey_available(uint8_t key_len)
{
	/* TODO: We should check the actual CPU model/stepping
	         as it's possible that the capability will be
	         added in the next CPU revisions. */
	if (key_len == 16)
		return 1;
	return 0;
}

static inline struct aes_ctx *aes_ctx_common(void *ctx)
{
	unsigned long addr = (unsigned long)ctx;
	unsigned long align = PADLOCK_ALIGNMENT;

	if (align <= crypto_tfm_ctx_alignment())
		align = 1;
	return (struct aes_ctx *)ALIGN(addr, align);
}

static inline struct aes_ctx *aes_ctx(struct crypto_tfm *tfm)
{
	return aes_ctx_common(crypto_tfm_ctx(tfm));
}

static inline struct aes_ctx *blk_aes_ctx(struct crypto_blkcipher *tfm)
{
	return aes_ctx_common(crypto_blkcipher_ctx(tfm));
}

static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
		       unsigned int key_len)
{
	struct aes_ctx *ctx = aes_ctx(tfm);
	const __le32 *key = (const __le32 *)in_key;
	u32 *flags = &tfm->crt_flags;
	struct crypto_aes_ctx gen_aes;
	int cpu;

	if (key_len % 8) {
		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
		return -EINVAL;
	}

	/*
	 * If the hardware is capable of generating the extended key
	 * itself we must supply the plain key for both encryption
	 * and decryption.
	 */
	ctx->D = ctx->E;

	ctx->E[0] = le32_to_cpu(key[0]);
	ctx->E[1] = le32_to_cpu(key[1]);
	ctx->E[2] = le32_to_cpu(key[2]);
	ctx->E[3] = le32_to_cpu(key[3]);

	/* Prepare control words. */
	memset(&ctx->cword, 0, sizeof(ctx->cword));

	ctx->cword.decrypt.encdec = 1;
	ctx->cword.encrypt.rounds = 10 + (key_len - 16) / 4;
	ctx->cword.decrypt.rounds = ctx->cword.encrypt.rounds;
	ctx->cword.encrypt.ksize = (key_len - 16) / 8;
	ctx->cword.decrypt.ksize = ctx->cword.encrypt.ksize;

	/* Don't generate extended keys if the hardware can do it. */
	if (aes_hw_extkey_available(key_len))
		goto ok;

	ctx->D = ctx->d_data;
	ctx->cword.encrypt.keygen = 1;
	ctx->cword.decrypt.keygen = 1;

	if (crypto_aes_expand_key(&gen_aes, in_key, key_len)) {
		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
		return -EINVAL;
	}

	memcpy(ctx->E, gen_aes.key_enc, AES_MAX_KEYLENGTH);
	memcpy(ctx->D, gen_aes.key_dec, AES_MAX_KEYLENGTH);

ok:
	for_each_online_cpu(cpu)
		if (&ctx->cword.encrypt == per_cpu(last_cword, cpu) ||
		    &ctx->cword.decrypt == per_cpu(last_cword, cpu))
			per_cpu(last_cword, cpu) = NULL;

	return 0;
}

/* ====== Encryption/decryption routines ====== */

/* These are the real call to PadLock. */
static inline void padlock_reset_key(struct cword *cword)
{
	int cpu = raw_smp_processor_id();

	if (cword != per_cpu(last_cword, cpu))
#ifndef CONFIG_X86_64
		asm volatile ("pushfl; popfl");
#else
		asm volatile ("pushfq; popfq");
#endif
}

static inline void padlock_store_cword(struct cword *cword)
{
	per_cpu(last_cword, raw_smp_processor_id()) = cword;
}

/*
 * While the padlock instructions don't use FP/SSE registers, they
 * generate a spurious DNA fault when cr0.ts is '1'. These instructions
 * should be used only inside the irq_ts_save/restore() context
 */

static inline void padlock_xcrypt(const u8 *input, u8 *output, void *key,
				  struct cword *control_word)
{
	asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"	/* rep xcryptecb */
		      : "+S"(input), "+D"(output)
		      : "d"(control_word), "b"(key), "c"(1));
}

static void aes_crypt_copy(const u8 *in, u8 *out, u32 *key, struct cword *cword)
{
	u8 buf[AES_BLOCK_SIZE * 2 + PADLOCK_ALIGNMENT - 1];
	u8 *tmp = PTR_ALIGN(&buf[0], PADLOCK_ALIGNMENT);

	memcpy(tmp, in, AES_BLOCK_SIZE);
	padlock_xcrypt(tmp, out, key, cword);
}

static inline void aes_crypt(const u8 *in, u8 *out, u32 *key,
			     struct cword *cword)
{
	/* padlock_xcrypt requires at least two blocks of data. */
	if (unlikely(!(((unsigned long)in ^ (PAGE_SIZE - AES_BLOCK_SIZE)) &
		       (PAGE_SIZE - 1)))) {
		aes_crypt_copy(in, out, key, cword);
		return;
	}

	padlock_xcrypt(in, out, key, cword);
}

static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
				      void *control_word, u32 count)
{
	if (count == 1) {
		aes_crypt(input, output, key, control_word);
		return;
	}

	asm volatile ("test $1, %%cl;"
		      "je 1f;"
#ifndef CONFIG_X86_64
		      "lea -1(%%ecx), %%eax;"
		      "mov $1, %%ecx;"
#else
		      "lea -1(%%rcx), %%rax;"
		      "mov $1, %%rcx;"
#endif
		      ".byte 0xf3,0x0f,0xa7,0xc8;"	/* rep xcryptecb */
#ifndef CONFIG_X86_64
		      "mov %%eax, %%ecx;"
#else
		      "mov %%rax, %%rcx;"
#endif
		      "1:"
		      ".byte 0xf3,0x0f,0xa7,0xc8"	/* rep xcryptecb */
		      : "+S"(input), "+D"(output)
		      : "d"(control_word), "b"(key), "c"(count)
		      : "ax");
}

static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
				     u8 *iv, void *control_word, u32 count)
{
	/* rep xcryptcbc */
	asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"
		      : "+S" (input), "+D" (output), "+a" (iv)
		      : "d" (control_word), "b" (key), "c" (count));
	return iv;
}

static void aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
{
	struct aes_ctx *ctx = aes_ctx(tfm);
	int ts_state;

	padlock_reset_key(&ctx->cword.encrypt);
	ts_state = irq_ts_save();
	aes_crypt(in, out, ctx->E, &ctx->cword.encrypt);
	irq_ts_restore(ts_state);
	padlock_store_cword(&ctx->cword.encrypt);
}

static void aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
{
	struct aes_ctx *ctx = aes_ctx(tfm);
	int ts_state;

	padlock_reset_key(&ctx->cword.encrypt);
	ts_state = irq_ts_save();
	aes_crypt(in, out, ctx->D, &ctx->cword.decrypt);
	irq_ts_restore(ts_state);
	padlock_store_cword(&ctx->cword.encrypt);
}

static struct crypto_alg aes_alg = {
	.cra_name		=	"aes",
	.cra_driver_name	=	"aes-padlock",
	.cra_priority		=	PADLOCK_CRA_PRIORITY,
	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
	.cra_blocksize		=	AES_BLOCK_SIZE,
	.cra_ctxsize		=	sizeof(struct aes_ctx),
	.cra_alignmask		=	PADLOCK_ALIGNMENT - 1,
	.cra_module		=	THIS_MODULE,
	.cra_list		=	LIST_HEAD_INIT(aes_alg.cra_list),
	.cra_u			=	{
		.cipher = {
			.cia_min_keysize	=	AES_MIN_KEY_SIZE,
			.cia_max_keysize	=	AES_MAX_KEY_SIZE,
			.cia_setkey	   	= 	aes_set_key,
			.cia_encrypt	 	=	aes_encrypt,
			.cia_decrypt	  	=	aes_decrypt,
		}
	}
};

static int ecb_aes_encrypt(struct blkcipher_desc *desc,
			   struct scatterlist *dst, struct scatterlist *src,
			   unsigned int nbytes)
{
	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	struct blkcipher_walk walk;
	int err;
	int ts_state;

	padlock_reset_key(&ctx->cword.encrypt);

	blkcipher_walk_init(&walk, dst, src, nbytes);
	err = blkcipher_walk_virt(desc, &walk);

	ts_state = irq_ts_save();
	while ((nbytes = walk.nbytes)) {
		padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
				   ctx->E, &ctx->cword.encrypt,
				   nbytes / AES_BLOCK_SIZE);
		nbytes &= AES_BLOCK_SIZE - 1;
		err = blkcipher_walk_done(desc, &walk, nbytes);
	}
	irq_ts_restore(ts_state);

	padlock_store_cword(&ctx->cword.encrypt);

	return err;
}

static int ecb_aes_decrypt(struct blkcipher_desc *desc,
			   struct scatterlist *dst, struct scatterlist *src,
			   unsigned int nbytes)
{
	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	struct blkcipher_walk walk;
	int err;
	int ts_state;

	padlock_reset_key(&ctx->cword.decrypt);

	blkcipher_walk_init(&walk, dst, src, nbytes);
	err = blkcipher_walk_virt(desc, &walk);

	ts_state = irq_ts_save();
	while ((nbytes = walk.nbytes)) {
		padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
				   ctx->D, &ctx->cword.decrypt,
				   nbytes / AES_BLOCK_SIZE);
		nbytes &= AES_BLOCK_SIZE - 1;
		err = blkcipher_walk_done(desc, &walk, nbytes);
	}
	irq_ts_restore(ts_state);

	padlock_store_cword(&ctx->cword.encrypt);

	return err;
}

static struct crypto_alg ecb_aes_alg = {
	.cra_name		=	"ecb(aes)",
	.cra_driver_name	=	"ecb-aes-padlock",
	.cra_priority		=	PADLOCK_COMPOSITE_PRIORITY,
	.cra_flags		=	CRYPTO_ALG_TYPE_BLKCIPHER,
	.cra_blocksize		=	AES_BLOCK_SIZE,
	.cra_ctxsize		=	sizeof(struct aes_ctx),
	.cra_alignmask		=	PADLOCK_ALIGNMENT - 1,
	.cra_type		=	&crypto_blkcipher_type,
	.cra_module		=	THIS_MODULE,
	.cra_list		=	LIST_HEAD_INIT(ecb_aes_alg.cra_list),
	.cra_u			=	{
		.blkcipher = {
			.min_keysize		=	AES_MIN_KEY_SIZE,
			.max_keysize		=	AES_MAX_KEY_SIZE,
			.setkey	   		= 	aes_set_key,
			.encrypt		=	ecb_aes_encrypt,
			.decrypt		=	ecb_aes_decrypt,
		}
	}
};

static int cbc_aes_encrypt(struct blkcipher_desc *desc,
			   struct scatterlist *dst, struct scatterlist *src,
			   unsigned int nbytes)
{
	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	struct blkcipher_walk walk;
	int err;
	int ts_state;

	padlock_reset_key(&ctx->cword.encrypt);

	blkcipher_walk_init(&walk, dst, src, nbytes);
	err = blkcipher_walk_virt(desc, &walk);

	ts_state = irq_ts_save();
	while ((nbytes = walk.nbytes)) {
		u8 *iv = padlock_xcrypt_cbc(walk.src.virt.addr,
					    walk.dst.virt.addr, ctx->E,
					    walk.iv, &ctx->cword.encrypt,
					    nbytes / AES_BLOCK_SIZE);
		memcpy(walk.iv, iv, AES_BLOCK_SIZE);
		nbytes &= AES_BLOCK_SIZE - 1;
		err = blkcipher_walk_done(desc, &walk, nbytes);
	}
	irq_ts_restore(ts_state);

	padlock_store_cword(&ctx->cword.decrypt);

	return err;
}

static int cbc_aes_decrypt(struct blkcipher_desc *desc,
			   struct scatterlist *dst, struct scatterlist *src,
			   unsigned int nbytes)
{
	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	struct blkcipher_walk walk;
	int err;
	int ts_state;

	padlock_reset_key(&ctx->cword.encrypt);

	blkcipher_walk_init(&walk, dst, src, nbytes);
	err = blkcipher_walk_virt(desc, &walk);

	ts_state = irq_ts_save();
	while ((nbytes = walk.nbytes)) {
		padlock_xcrypt_cbc(walk.src.virt.addr, walk.dst.virt.addr,
				   ctx->D, walk.iv, &ctx->cword.decrypt,
				   nbytes / AES_BLOCK_SIZE);
		nbytes &= AES_BLOCK_SIZE - 1;
		err = blkcipher_walk_done(desc, &walk, nbytes);
	}

	irq_ts_restore(ts_state);

	padlock_store_cword(&ctx->cword.encrypt);

	return err;
}

static struct crypto_alg cbc_aes_alg = {
	.cra_name		=	"cbc(aes)",
	.cra_driver_name	=	"cbc-aes-padlock",
	.cra_priority		=	PADLOCK_COMPOSITE_PRIORITY,
	.cra_flags		=	CRYPTO_ALG_TYPE_BLKCIPHER,
	.cra_blocksize		=	AES_BLOCK_SIZE,
	.cra_ctxsize		=	sizeof(struct aes_ctx),
	.cra_alignmask		=	PADLOCK_ALIGNMENT - 1,
	.cra_type		=	&crypto_blkcipher_type,
	.cra_module		=	THIS_MODULE,
	.cra_list		=	LIST_HEAD_INIT(cbc_aes_alg.cra_list),
	.cra_u			=	{
		.blkcipher = {
			.min_keysize		=	AES_MIN_KEY_SIZE,
			.max_keysize		=	AES_MAX_KEY_SIZE,
			.ivsize			=	AES_BLOCK_SIZE,
			.setkey	   		= 	aes_set_key,
			.encrypt		=	cbc_aes_encrypt,
			.decrypt		=	cbc_aes_decrypt,
		}
	}
};

static int __init padlock_init(void)
{
	int ret;

	if (!cpu_has_xcrypt) {
		printk(KERN_NOTICE PFX "VIA PadLock not detected.\n");
		return -ENODEV;
	}

	if (!cpu_has_xcrypt_enabled) {
		printk(KERN_NOTICE PFX "VIA PadLock detected, but not enabled. Hmm, strange...\n");
		return -ENODEV;
	}

	if ((ret = crypto_register_alg(&aes_alg)))
		goto aes_err;

	if ((ret = crypto_register_alg(&ecb_aes_alg)))
		goto ecb_aes_err;

	if ((ret = crypto_register_alg(&cbc_aes_alg)))
		goto cbc_aes_err;

	printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");

out:
	return ret;

cbc_aes_err:
	crypto_unregister_alg(&ecb_aes_alg);
ecb_aes_err:
	crypto_unregister_alg(&aes_alg);
aes_err:
	printk(KERN_ERR PFX "VIA PadLock AES initialization failed.\n");
	goto out;
}

static void __exit padlock_fini(void)
{
	crypto_unregister_alg(&cbc_aes_alg);
	crypto_unregister_alg(&ecb_aes_alg);
	crypto_unregister_alg(&aes_alg);
}

module_init(padlock_init);
module_exit(padlock_fini);

MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Michal Ludvig");

MODULE_ALIAS("aes");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Cryptographic API.
	3	*
	4	* Support for VIA PadLock hardware crypto engine.
	5	*
	6	* Copyright (c) 2004 Michal Ludvig <michal@logix.cz>
	7	*
1da177e4 LT	8	*/
1da177e4 LT	9
28ce728a	10	#include <crypto/algapi.h>
89e12654	11	#include <crypto/aes.h>
1da177e4 LT	12	#include <linux/module.h>
	13	#include <linux/init.h>
	14	#include <linux/types.h>
	15	#include <linux/errno.h>
1da177e4	16	#include <linux/interrupt.h>
6789b2dc	17	#include <linux/kernel.h>
420a4b20 HX	18	#include <linux/percpu.h>
420a4b20 HX	19	#include <linux/smp.h>
1da177e4	20	#include <asm/byteorder.h>
e4914012	21	#include <asm/i387.h>
1da177e4 LT	22	#include "padlock.h"
1da177e4 LT	23
ccc17c34 ML	24	/* Control word. */
	25	struct cword {
	26	unsigned int __attribute__ ((__packed__))
	27	rounds:4,
	28	algo:3,
	29	keygen:1,
	30	interm:1,
	31	encdec:1,
	32	ksize:2;
	33	} __attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
	34
cc08632f ML	35	/* Whenever making any changes to the following
cc08632f ML	36	* structure make sure you keep E, d_data
7dc748e4 SS	37	* and cword aligned on 16 Bytes boundaries and
	38	* the Hardware can access 16 * 16 bytes of E and d_data
	39	* (only the first 15 * 16 bytes matter but the HW reads
	40	* more).
	41	*/
1da177e4	42	struct aes_ctx {
7dc748e4 SS	43	u32 E[AES_MAX_KEYLENGTH_U32]
	44	__attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
	45	u32 d_data[AES_MAX_KEYLENGTH_U32]
	46	__attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
6789b2dc HX	47	struct {
	48	struct cword encrypt;
	49	struct cword decrypt;
	50	} cword;
82062c72	51	u32 *D;
1da177e4 LT	52	};
1da177e4 LT	53
420a4b20 HX	54	static DEFINE_PER_CPU(struct cword *, last_cword);
420a4b20 HX	55
1da177e4 LT	56	/* Tells whether the ACE is capable to generate
	57	the extended key for a given key_len. */
	58	static inline int
	59	aes_hw_extkey_available(uint8_t key_len)
	60	{
	61	/* TODO: We should check the actual CPU model/stepping
	62	as it's possible that the capability will be
	63	added in the next CPU revisions. */
	64	if (key_len == 16)
	65	return 1;
	66	return 0;
	67	}
	68
28ce728a	69	static inline struct aes_ctx aes_ctx_common(void ctx)
6789b2dc	70	{
28ce728a	71	unsigned long addr = (unsigned long)ctx;
f10b7897 HX	72	unsigned long align = PADLOCK_ALIGNMENT;
	73
	74	if (align <= crypto_tfm_ctx_alignment())
	75	align = 1;
6c2bb98b	76	return (struct aes_ctx *)ALIGN(addr, align);
6789b2dc HX	77	}
6789b2dc HX	78
28ce728a HX	79	static inline struct aes_ctx aes_ctx(struct crypto_tfm tfm)
	80	{
	81	return aes_ctx_common(crypto_tfm_ctx(tfm));
	82	}
	83
	84	static inline struct aes_ctx blk_aes_ctx(struct crypto_blkcipher tfm)
	85	{
	86	return aes_ctx_common(crypto_blkcipher_ctx(tfm));
	87	}
	88
6c2bb98b	89	static int aes_set_key(struct crypto_tfm tfm, const u8 in_key,
560c06ae	90	unsigned int key_len)
1da177e4	91	{
6c2bb98b	92	struct aes_ctx *ctx = aes_ctx(tfm);
06ace7a9	93	const __le32 key = (const __le32 )in_key;
560c06ae	94	u32 *flags = &tfm->crt_flags;
7dc748e4	95	struct crypto_aes_ctx gen_aes;
420a4b20	96	int cpu;
1da177e4	97
560c06ae	98	if (key_len % 8) {
1da177e4 LT	99	*flags \|= CRYPTO_TFM_RES_BAD_KEY_LEN;
	100	return -EINVAL;
	101	}
	102
6789b2dc HX	103	/*
	104	* If the hardware is capable of generating the extended key
	105	* itself we must supply the plain key for both encryption
	106	* and decryption.
	107	*/
82062c72	108	ctx->D = ctx->E;
1da177e4	109
7dc748e4 SS	110	ctx->E[0] = le32_to_cpu(key[0]);
	111	ctx->E[1] = le32_to_cpu(key[1]);
	112	ctx->E[2] = le32_to_cpu(key[2]);
	113	ctx->E[3] = le32_to_cpu(key[3]);
1da177e4	114
6789b2dc HX	115	/* Prepare control words. */
	116	memset(&ctx->cword, 0, sizeof(ctx->cword));
	117
	118	ctx->cword.decrypt.encdec = 1;
	119	ctx->cword.encrypt.rounds = 10 + (key_len - 16) / 4;
	120	ctx->cword.decrypt.rounds = ctx->cword.encrypt.rounds;
	121	ctx->cword.encrypt.ksize = (key_len - 16) / 8;
	122	ctx->cword.decrypt.ksize = ctx->cword.encrypt.ksize;
	123
1da177e4 LT	124	/* Don't generate extended keys if the hardware can do it. */
1da177e4 LT	125	if (aes_hw_extkey_available(key_len))
420a4b20	126	goto ok;
1da177e4	127
6789b2dc HX	128	ctx->D = ctx->d_data;
	129	ctx->cword.encrypt.keygen = 1;
	130	ctx->cword.decrypt.keygen = 1;
	131
7dc748e4 SS	132	if (crypto_aes_expand_key(&gen_aes, in_key, key_len)) {
	133	*flags \|= CRYPTO_TFM_RES_BAD_KEY_LEN;
	134	return -EINVAL;
1da177e4 LT	135	}
1da177e4 LT	136
7dc748e4 SS	137	memcpy(ctx->E, gen_aes.key_enc, AES_MAX_KEYLENGTH);
7dc748e4 SS	138	memcpy(ctx->D, gen_aes.key_dec, AES_MAX_KEYLENGTH);
420a4b20 HX	139
	140	ok:
	141	for_each_online_cpu(cpu)
	142	if (&ctx->cword.encrypt == per_cpu(last_cword, cpu) \|\|
	143	&ctx->cword.decrypt == per_cpu(last_cword, cpu))
	144	per_cpu(last_cword, cpu) = NULL;
	145
1da177e4 LT	146	return 0;
	147	}
	148
	149	/* ====== Encryption/decryption routines ====== */
	150
28e8c3ad	151	/* These are the real call to PadLock. */
420a4b20 HX	152	static inline void padlock_reset_key(struct cword *cword)
	153	{
	154	int cpu = raw_smp_processor_id();
	155
	156	if (cword != per_cpu(last_cword, cpu))
d1c8b0a7	157	#ifndef CONFIG_X86_64
420a4b20	158	asm volatile ("pushfl; popfl");
d1c8b0a7 SAS	159	#else
	160	asm volatile ("pushfq; popfq");
	161	#endif
420a4b20 HX	162	}
	163
	164	static inline void padlock_store_cword(struct cword *cword)
866cd902	165	{
420a4b20	166	per_cpu(last_cword, raw_smp_processor_id()) = cword;
866cd902 HX	167	}
866cd902 HX	168
e4914012 SS	169	/*
	170	* While the padlock instructions don't use FP/SSE registers, they
	171	* generate a spurious DNA fault when cr0.ts is '1'. These instructions
	172	* should be used only inside the irq_ts_save/restore() context
	173	*/
	174
d4a7dd8e	175	static inline void padlock_xcrypt(const u8 input, u8 output, void *key,
420a4b20	176	struct cword *control_word)
d4a7dd8e HX	177	{
	178	asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */
	179	: "+S"(input), "+D"(output)
	180	: "d"(control_word), "b"(key), "c"(1));
	181	}
	182
	183	static void aes_crypt_copy(const u8 in, u8 out, u32 key, struct cword cword)
	184	{
490fe3f0 HX	185	u8 buf[AES_BLOCK_SIZE * 2 + PADLOCK_ALIGNMENT - 1];
490fe3f0 HX	186	u8 *tmp = PTR_ALIGN(&buf[0], PADLOCK_ALIGNMENT);
d4a7dd8e HX	187
	188	memcpy(tmp, in, AES_BLOCK_SIZE);
	189	padlock_xcrypt(tmp, out, key, cword);
	190	}
	191
	192	static inline void aes_crypt(const u8 in, u8 out, u32 *key,
	193	struct cword *cword)
	194	{
d4a7dd8e HX	195	/* padlock_xcrypt requires at least two blocks of data. */
	196	if (unlikely(!(((unsigned long)in ^ (PAGE_SIZE - AES_BLOCK_SIZE)) &
	197	(PAGE_SIZE - 1)))) {
	198	aes_crypt_copy(in, out, key, cword);
	199	return;
	200	}
	201
	202	padlock_xcrypt(in, out, key, cword);
	203	}
	204
6789b2dc HX	205	static inline void padlock_xcrypt_ecb(const u8 input, u8 output, void *key,
6789b2dc HX	206	void *control_word, u32 count)
1da177e4	207	{
d4a7dd8e HX	208	if (count == 1) {
	209	aes_crypt(input, output, key, control_word);
	210	return;
	211	}
	212
d4a7dd8e HX	213	asm volatile ("test $1, %%cl;"
d4a7dd8e HX	214	"je 1f;"
d1c8b0a7	215	#ifndef CONFIG_X86_64
d4a7dd8e HX	216	"lea -1(%%ecx), %%eax;"
d4a7dd8e HX	217	"mov $1, %%ecx;"
d1c8b0a7 SAS	218	#else
	219	"lea -1(%%rcx), %%rax;"
	220	"mov $1, %%rcx;"
	221	#endif
d4a7dd8e	222	".byte 0xf3,0x0f,0xa7,0xc8;" /* rep xcryptecb */
d1c8b0a7	223	#ifndef CONFIG_X86_64
d4a7dd8e	224	"mov %%eax, %%ecx;"
d1c8b0a7 SAS	225	#else
	226	"mov %%rax, %%rcx;"
	227	#endif
d4a7dd8e HX	228	"1:"
d4a7dd8e HX	229	".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */
1da177e4	230	: "+S"(input), "+D"(output)
d4a7dd8e HX	231	: "d"(control_word), "b"(key), "c"(count)
d4a7dd8e HX	232	: "ax");
1da177e4 LT	233	}
1da177e4 LT	234
476df259 HX	235	static inline u8 padlock_xcrypt_cbc(const u8 input, u8 output, void key,
476df259 HX	236	u8 iv, void control_word, u32 count)
28e8c3ad	237	{
28e8c3ad HX	238	/* rep xcryptcbc */
	239	asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"
	240	: "+S" (input), "+D" (output), "+a" (iv)
	241	: "d" (control_word), "b" (key), "c" (count));
476df259	242	return iv;
28e8c3ad HX	243	}
28e8c3ad HX	244
6c2bb98b	245	static void aes_encrypt(struct crypto_tfm tfm, u8 out, const u8 *in)
1da177e4	246	{
6c2bb98b	247	struct aes_ctx *ctx = aes_ctx(tfm);
e4914012	248	int ts_state;
e4914012	249
420a4b20	250	padlock_reset_key(&ctx->cword.encrypt);
e4914012	251	ts_state = irq_ts_save();
d4a7dd8e	252	aes_crypt(in, out, ctx->E, &ctx->cword.encrypt);
e4914012	253	irq_ts_restore(ts_state);
420a4b20	254	padlock_store_cword(&ctx->cword.encrypt);
1da177e4 LT	255	}
1da177e4 LT	256
6c2bb98b	257	static void aes_decrypt(struct crypto_tfm tfm, u8 out, const u8 *in)
1da177e4	258	{
6c2bb98b	259	struct aes_ctx *ctx = aes_ctx(tfm);
e4914012	260	int ts_state;
e4914012	261
420a4b20	262	padlock_reset_key(&ctx->cword.encrypt);
e4914012	263	ts_state = irq_ts_save();
d4a7dd8e	264	aes_crypt(in, out, ctx->D, &ctx->cword.decrypt);
e4914012	265	irq_ts_restore(ts_state);
420a4b20	266	padlock_store_cword(&ctx->cword.encrypt);
1da177e4 LT	267	}
	268
	269	static struct crypto_alg aes_alg = {
	270	.cra_name = "aes",
c8a19c91	271	.cra_driver_name = "aes-padlock",
ccc17c34	272	.cra_priority = PADLOCK_CRA_PRIORITY,
1da177e4 LT	273	.cra_flags = CRYPTO_ALG_TYPE_CIPHER,
1da177e4 LT	274	.cra_blocksize = AES_BLOCK_SIZE,
fbdae9f3	275	.cra_ctxsize = sizeof(struct aes_ctx),
6789b2dc	276	.cra_alignmask = PADLOCK_ALIGNMENT - 1,
1da177e4 LT	277	.cra_module = THIS_MODULE,
	278	.cra_list = LIST_HEAD_INIT(aes_alg.cra_list),
	279	.cra_u = {
	280	.cipher = {
	281	.cia_min_keysize = AES_MIN_KEY_SIZE,
	282	.cia_max_keysize = AES_MAX_KEY_SIZE,
	283	.cia_setkey = aes_set_key,
	284	.cia_encrypt = aes_encrypt,
28e8c3ad	285	.cia_decrypt = aes_decrypt,
1da177e4 LT	286	}
	287	}
	288	};
	289
28ce728a HX	290	static int ecb_aes_encrypt(struct blkcipher_desc *desc,
	291	struct scatterlist dst, struct scatterlist src,
	292	unsigned int nbytes)
	293	{
	294	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	295	struct blkcipher_walk walk;
	296	int err;
e4914012	297	int ts_state;
28ce728a	298
420a4b20	299	padlock_reset_key(&ctx->cword.encrypt);
866cd902	300
28ce728a HX	301	blkcipher_walk_init(&walk, dst, src, nbytes);
	302	err = blkcipher_walk_virt(desc, &walk);
	303
e4914012	304	ts_state = irq_ts_save();
28ce728a HX	305	while ((nbytes = walk.nbytes)) {
	306	padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
	307	ctx->E, &ctx->cword.encrypt,
	308	nbytes / AES_BLOCK_SIZE);
	309	nbytes &= AES_BLOCK_SIZE - 1;
	310	err = blkcipher_walk_done(desc, &walk, nbytes);
	311	}
e4914012	312	irq_ts_restore(ts_state);
28ce728a	313
420a4b20 HX	314	padlock_store_cword(&ctx->cword.encrypt);
420a4b20 HX	315
28ce728a HX	316	return err;
	317	}
	318
	319	static int ecb_aes_decrypt(struct blkcipher_desc *desc,
	320	struct scatterlist dst, struct scatterlist src,
	321	unsigned int nbytes)
	322	{
	323	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	324	struct blkcipher_walk walk;
	325	int err;
e4914012	326	int ts_state;
28ce728a	327
420a4b20	328	padlock_reset_key(&ctx->cword.decrypt);
866cd902	329
28ce728a HX	330	blkcipher_walk_init(&walk, dst, src, nbytes);
	331	err = blkcipher_walk_virt(desc, &walk);
	332
e4914012	333	ts_state = irq_ts_save();
28ce728a HX	334	while ((nbytes = walk.nbytes)) {
	335	padlock_xcrypt_ecb(walk.src.virt.addr, walk.dst.virt.addr,
	336	ctx->D, &ctx->cword.decrypt,
	337	nbytes / AES_BLOCK_SIZE);
	338	nbytes &= AES_BLOCK_SIZE - 1;
	339	err = blkcipher_walk_done(desc, &walk, nbytes);
	340	}
e4914012	341	irq_ts_restore(ts_state);
420a4b20 HX	342
	343	padlock_store_cword(&ctx->cword.encrypt);
	344
28ce728a HX	345	return err;
	346	}
	347
	348	static struct crypto_alg ecb_aes_alg = {
	349	.cra_name = "ecb(aes)",
	350	.cra_driver_name = "ecb-aes-padlock",
	351	.cra_priority = PADLOCK_COMPOSITE_PRIORITY,
	352	.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER,
	353	.cra_blocksize = AES_BLOCK_SIZE,
	354	.cra_ctxsize = sizeof(struct aes_ctx),
	355	.cra_alignmask = PADLOCK_ALIGNMENT - 1,
	356	.cra_type = &crypto_blkcipher_type,
	357	.cra_module = THIS_MODULE,
	358	.cra_list = LIST_HEAD_INIT(ecb_aes_alg.cra_list),
	359	.cra_u = {
	360	.blkcipher = {
	361	.min_keysize = AES_MIN_KEY_SIZE,
	362	.max_keysize = AES_MAX_KEY_SIZE,
	363	.setkey = aes_set_key,
	364	.encrypt = ecb_aes_encrypt,
	365	.decrypt = ecb_aes_decrypt,
	366	}
	367	}
	368	};
	369
	370	static int cbc_aes_encrypt(struct blkcipher_desc *desc,
	371	struct scatterlist dst, struct scatterlist src,
	372	unsigned int nbytes)
	373	{
	374	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	375	struct blkcipher_walk walk;
	376	int err;
e4914012	377	int ts_state;
28ce728a	378
420a4b20	379	padlock_reset_key(&ctx->cword.encrypt);
866cd902	380
28ce728a HX	381	blkcipher_walk_init(&walk, dst, src, nbytes);
	382	err = blkcipher_walk_virt(desc, &walk);
	383
e4914012	384	ts_state = irq_ts_save();
28ce728a HX	385	while ((nbytes = walk.nbytes)) {
	386	u8 *iv = padlock_xcrypt_cbc(walk.src.virt.addr,
	387	walk.dst.virt.addr, ctx->E,
	388	walk.iv, &ctx->cword.encrypt,
	389	nbytes / AES_BLOCK_SIZE);
	390	memcpy(walk.iv, iv, AES_BLOCK_SIZE);
	391	nbytes &= AES_BLOCK_SIZE - 1;
	392	err = blkcipher_walk_done(desc, &walk, nbytes);
	393	}
e4914012	394	irq_ts_restore(ts_state);
28ce728a	395
420a4b20 HX	396	padlock_store_cword(&ctx->cword.decrypt);
420a4b20 HX	397
28ce728a HX	398	return err;
	399	}
	400
	401	static int cbc_aes_decrypt(struct blkcipher_desc *desc,
	402	struct scatterlist dst, struct scatterlist src,
	403	unsigned int nbytes)
	404	{
	405	struct aes_ctx *ctx = blk_aes_ctx(desc->tfm);
	406	struct blkcipher_walk walk;
	407	int err;
e4914012	408	int ts_state;
28ce728a	409
420a4b20	410	padlock_reset_key(&ctx->cword.encrypt);
866cd902	411
28ce728a HX	412	blkcipher_walk_init(&walk, dst, src, nbytes);
	413	err = blkcipher_walk_virt(desc, &walk);
	414
e4914012	415	ts_state = irq_ts_save();
28ce728a HX	416	while ((nbytes = walk.nbytes)) {
	417	padlock_xcrypt_cbc(walk.src.virt.addr, walk.dst.virt.addr,
	418	ctx->D, walk.iv, &ctx->cword.decrypt,
	419	nbytes / AES_BLOCK_SIZE);
	420	nbytes &= AES_BLOCK_SIZE - 1;
	421	err = blkcipher_walk_done(desc, &walk, nbytes);
	422	}
	423
e4914012	424	irq_ts_restore(ts_state);
420a4b20 HX	425
	426	padlock_store_cword(&ctx->cword.encrypt);
	427
28ce728a HX	428	return err;
	429	}
	430
	431	static struct crypto_alg cbc_aes_alg = {
	432	.cra_name = "cbc(aes)",
	433	.cra_driver_name = "cbc-aes-padlock",
	434	.cra_priority = PADLOCK_COMPOSITE_PRIORITY,
	435	.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER,
	436	.cra_blocksize = AES_BLOCK_SIZE,
	437	.cra_ctxsize = sizeof(struct aes_ctx),
	438	.cra_alignmask = PADLOCK_ALIGNMENT - 1,
	439	.cra_type = &crypto_blkcipher_type,
	440	.cra_module = THIS_MODULE,
	441	.cra_list = LIST_HEAD_INIT(cbc_aes_alg.cra_list),
	442	.cra_u = {
	443	.blkcipher = {
	444	.min_keysize = AES_MIN_KEY_SIZE,
	445	.max_keysize = AES_MAX_KEY_SIZE,
	446	.ivsize = AES_BLOCK_SIZE,
	447	.setkey = aes_set_key,
	448	.encrypt = cbc_aes_encrypt,
	449	.decrypt = cbc_aes_decrypt,
	450	}
	451	}
	452	};
	453
1191f0a4	454	static int __init padlock_init(void)
1da177e4	455	{
1191f0a4 ML	456	int ret;
	457
	458	if (!cpu_has_xcrypt) {
b43e726b	459	printk(KERN_NOTICE PFX "VIA PadLock not detected.\n");
1191f0a4 ML	460	return -ENODEV;
	461	}
	462
	463	if (!cpu_has_xcrypt_enabled) {
b43e726b	464	printk(KERN_NOTICE PFX "VIA PadLock detected, but not enabled. Hmm, strange...\n");
1191f0a4 ML	465	return -ENODEV;
1191f0a4 ML	466	}
1da177e4	467
28ce728a HX	468	if ((ret = crypto_register_alg(&aes_alg)))
	469	goto aes_err;
	470
	471	if ((ret = crypto_register_alg(&ecb_aes_alg)))
	472	goto ecb_aes_err;
	473
	474	if ((ret = crypto_register_alg(&cbc_aes_alg)))
	475	goto cbc_aes_err;
1191f0a4 ML	476
	477	printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");
	478
28ce728a	479	out:
1191f0a4	480	return ret;
28ce728a HX	481
	482	cbc_aes_err:
	483	crypto_unregister_alg(&ecb_aes_alg);
	484	ecb_aes_err:
	485	crypto_unregister_alg(&aes_alg);
	486	aes_err:
	487	printk(KERN_ERR PFX "VIA PadLock AES initialization failed.\n");
	488	goto out;
1da177e4 LT	489	}
1da177e4 LT	490
1191f0a4	491	static void __exit padlock_fini(void)
1da177e4	492	{
28ce728a HX	493	crypto_unregister_alg(&cbc_aes_alg);
28ce728a HX	494	crypto_unregister_alg(&ecb_aes_alg);
1da177e4 LT	495	crypto_unregister_alg(&aes_alg);
1da177e4 LT	496	}
1191f0a4 ML	497
	498	module_init(padlock_init);
	499	module_exit(padlock_fini);
	500
	501	MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
	502	MODULE_LICENSE("GPL");
	503	MODULE_AUTHOR("Michal Ludvig");
	504
acd246b7	505	MODULE_ALIAS("aes");