2 * AMD Cryptographic Coprocessor (CCP) AES CMAC crypto API support
4 * Copyright (C) 2013 Advanced Micro Devices, Inc.
6 * Author: Tom Lendacky <thomas.lendacky@amd.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #include <linux/module.h>
14 #include <linux/sched.h>
15 #include <linux/delay.h>
16 #include <linux/scatterlist.h>
17 #include <linux/crypto.h>
18 #include <crypto/algapi.h>
19 #include <crypto/aes.h>
20 #include <crypto/hash.h>
21 #include <crypto/internal/hash.h>
22 #include <crypto/scatterwalk.h>
24 #include "ccp-crypto.h"
26 static int ccp_aes_cmac_complete(struct crypto_async_request
*async_req
,
29 struct ahash_request
*req
= ahash_request_cast(async_req
);
30 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
31 struct ccp_aes_cmac_req_ctx
*rctx
= ahash_request_ctx(req
);
32 unsigned int digest_size
= crypto_ahash_digestsize(tfm
);
38 /* Save remaining data to buffer */
39 unsigned int offset
= rctx
->nbytes
- rctx
->hash_rem
;
41 scatterwalk_map_and_copy(rctx
->buf
, rctx
->src
,
42 offset
, rctx
->hash_rem
, 0);
43 rctx
->buf_count
= rctx
->hash_rem
;
48 /* Update result area if supplied */
50 memcpy(req
->result
, rctx
->iv
, digest_size
);
53 sg_free_table(&rctx
->data_sg
);
58 static int ccp_do_cmac_update(struct ahash_request
*req
, unsigned int nbytes
,
61 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
62 struct ccp_ctx
*ctx
= crypto_ahash_ctx(tfm
);
63 struct ccp_aes_cmac_req_ctx
*rctx
= ahash_request_ctx(req
);
64 struct scatterlist
*sg
, *cmac_key_sg
= NULL
;
65 unsigned int block_size
=
66 crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm
));
67 unsigned int need_pad
, sg_count
;
72 if (!ctx
->u
.aes
.key_len
)
78 len
= (u64
)rctx
->buf_count
+ (u64
)nbytes
;
80 if (!final
&& (len
<= block_size
)) {
81 scatterwalk_map_and_copy(rctx
->buf
+ rctx
->buf_count
, req
->src
,
83 rctx
->buf_count
+= nbytes
;
89 rctx
->nbytes
= nbytes
;
92 rctx
->hash_rem
= final
? 0 : len
& (block_size
- 1);
93 rctx
->hash_cnt
= len
- rctx
->hash_rem
;
94 if (!final
&& !rctx
->hash_rem
) {
95 /* CCP can't do zero length final, so keep some data around */
96 rctx
->hash_cnt
-= block_size
;
97 rctx
->hash_rem
= block_size
;
100 if (final
&& (rctx
->null_msg
|| (len
& (block_size
- 1))))
105 sg_init_one(&rctx
->iv_sg
, rctx
->iv
, sizeof(rctx
->iv
));
107 /* Build the data scatterlist table - allocate enough entries for all
108 * possible data pieces (buffer, input data, padding)
110 sg_count
= (nbytes
) ? sg_nents(req
->src
) + 2 : 2;
111 gfp
= req
->base
.flags
& CRYPTO_TFM_REQ_MAY_SLEEP
?
112 GFP_KERNEL
: GFP_ATOMIC
;
113 ret
= sg_alloc_table(&rctx
->data_sg
, sg_count
, gfp
);
118 if (rctx
->buf_count
) {
119 sg_init_one(&rctx
->buf_sg
, rctx
->buf
, rctx
->buf_count
);
120 sg
= ccp_crypto_sg_table_add(&rctx
->data_sg
, &rctx
->buf_sg
);
124 sg
= ccp_crypto_sg_table_add(&rctx
->data_sg
, req
->src
);
127 int pad_length
= block_size
- (len
& (block_size
- 1));
129 rctx
->hash_cnt
+= pad_length
;
131 memset(rctx
->pad
, 0, sizeof(rctx
->pad
));
133 sg_init_one(&rctx
->pad_sg
, rctx
->pad
, pad_length
);
134 sg
= ccp_crypto_sg_table_add(&rctx
->data_sg
, &rctx
->pad_sg
);
138 sg
= rctx
->data_sg
.sgl
;
141 /* Initialize the K1/K2 scatterlist */
143 cmac_key_sg
= (need_pad
) ? &ctx
->u
.aes
.k2_sg
146 memset(&rctx
->cmd
, 0, sizeof(rctx
->cmd
));
147 INIT_LIST_HEAD(&rctx
->cmd
.entry
);
148 rctx
->cmd
.engine
= CCP_ENGINE_AES
;
149 rctx
->cmd
.u
.aes
.type
= ctx
->u
.aes
.type
;
150 rctx
->cmd
.u
.aes
.mode
= ctx
->u
.aes
.mode
;
151 rctx
->cmd
.u
.aes
.action
= CCP_AES_ACTION_ENCRYPT
;
152 rctx
->cmd
.u
.aes
.key
= &ctx
->u
.aes
.key_sg
;
153 rctx
->cmd
.u
.aes
.key_len
= ctx
->u
.aes
.key_len
;
154 rctx
->cmd
.u
.aes
.iv
= &rctx
->iv_sg
;
155 rctx
->cmd
.u
.aes
.iv_len
= AES_BLOCK_SIZE
;
156 rctx
->cmd
.u
.aes
.src
= sg
;
157 rctx
->cmd
.u
.aes
.src_len
= rctx
->hash_cnt
;
158 rctx
->cmd
.u
.aes
.dst
= NULL
;
159 rctx
->cmd
.u
.aes
.cmac_key
= cmac_key_sg
;
160 rctx
->cmd
.u
.aes
.cmac_key_len
= ctx
->u
.aes
.kn_len
;
161 rctx
->cmd
.u
.aes
.cmac_final
= final
;
163 ret
= ccp_crypto_enqueue_request(&req
->base
, &rctx
->cmd
);
168 static int ccp_aes_cmac_init(struct ahash_request
*req
)
170 struct ccp_aes_cmac_req_ctx
*rctx
= ahash_request_ctx(req
);
172 memset(rctx
, 0, sizeof(*rctx
));
179 static int ccp_aes_cmac_update(struct ahash_request
*req
)
181 return ccp_do_cmac_update(req
, req
->nbytes
, 0);
184 static int ccp_aes_cmac_final(struct ahash_request
*req
)
186 return ccp_do_cmac_update(req
, 0, 1);
189 static int ccp_aes_cmac_finup(struct ahash_request
*req
)
191 return ccp_do_cmac_update(req
, req
->nbytes
, 1);
194 static int ccp_aes_cmac_digest(struct ahash_request
*req
)
198 ret
= ccp_aes_cmac_init(req
);
202 return ccp_aes_cmac_finup(req
);
205 static int ccp_aes_cmac_setkey(struct crypto_ahash
*tfm
, const u8
*key
,
206 unsigned int key_len
)
208 struct ccp_ctx
*ctx
= crypto_tfm_ctx(crypto_ahash_tfm(tfm
));
209 struct ccp_crypto_ahash_alg
*alg
=
210 ccp_crypto_ahash_alg(crypto_ahash_tfm(tfm
));
211 u64 k0_hi
, k0_lo
, k1_hi
, k1_lo
, k2_hi
, k2_lo
;
212 u64 rb_hi
= 0x00, rb_lo
= 0x87;
217 case AES_KEYSIZE_128
:
218 ctx
->u
.aes
.type
= CCP_AES_TYPE_128
;
220 case AES_KEYSIZE_192
:
221 ctx
->u
.aes
.type
= CCP_AES_TYPE_192
;
223 case AES_KEYSIZE_256
:
224 ctx
->u
.aes
.type
= CCP_AES_TYPE_256
;
227 crypto_ahash_set_flags(tfm
, CRYPTO_TFM_RES_BAD_KEY_LEN
);
230 ctx
->u
.aes
.mode
= alg
->mode
;
232 /* Set to zero until complete */
233 ctx
->u
.aes
.key_len
= 0;
235 /* Set the key for the AES cipher used to generate the keys */
236 ret
= crypto_cipher_setkey(ctx
->u
.aes
.tfm_cipher
, key
, key_len
);
240 /* Encrypt a block of zeroes - use key area in context */
241 memset(ctx
->u
.aes
.key
, 0, sizeof(ctx
->u
.aes
.key
));
242 crypto_cipher_encrypt_one(ctx
->u
.aes
.tfm_cipher
, ctx
->u
.aes
.key
,
245 /* Generate K1 and K2 */
246 k0_hi
= be64_to_cpu(*((__be64
*)ctx
->u
.aes
.key
));
247 k0_lo
= be64_to_cpu(*((__be64
*)ctx
->u
.aes
.key
+ 1));
249 k1_hi
= (k0_hi
<< 1) | (k0_lo
>> 63);
251 if (ctx
->u
.aes
.key
[0] & 0x80) {
255 gk
= (__be64
*)ctx
->u
.aes
.k1
;
256 *gk
= cpu_to_be64(k1_hi
);
258 *gk
= cpu_to_be64(k1_lo
);
260 k2_hi
= (k1_hi
<< 1) | (k1_lo
>> 63);
262 if (ctx
->u
.aes
.k1
[0] & 0x80) {
266 gk
= (__be64
*)ctx
->u
.aes
.k2
;
267 *gk
= cpu_to_be64(k2_hi
);
269 *gk
= cpu_to_be64(k2_lo
);
271 ctx
->u
.aes
.kn_len
= sizeof(ctx
->u
.aes
.k1
);
272 sg_init_one(&ctx
->u
.aes
.k1_sg
, ctx
->u
.aes
.k1
, sizeof(ctx
->u
.aes
.k1
));
273 sg_init_one(&ctx
->u
.aes
.k2_sg
, ctx
->u
.aes
.k2
, sizeof(ctx
->u
.aes
.k2
));
275 /* Save the supplied key */
276 memset(ctx
->u
.aes
.key
, 0, sizeof(ctx
->u
.aes
.key
));
277 memcpy(ctx
->u
.aes
.key
, key
, key_len
);
278 ctx
->u
.aes
.key_len
= key_len
;
279 sg_init_one(&ctx
->u
.aes
.key_sg
, ctx
->u
.aes
.key
, key_len
);
284 static int ccp_aes_cmac_cra_init(struct crypto_tfm
*tfm
)
286 struct ccp_ctx
*ctx
= crypto_tfm_ctx(tfm
);
287 struct crypto_ahash
*ahash
= __crypto_ahash_cast(tfm
);
288 struct crypto_cipher
*cipher_tfm
;
290 ctx
->complete
= ccp_aes_cmac_complete
;
291 ctx
->u
.aes
.key_len
= 0;
293 crypto_ahash_set_reqsize(ahash
, sizeof(struct ccp_aes_cmac_req_ctx
));
295 cipher_tfm
= crypto_alloc_cipher("aes", 0,
297 CRYPTO_ALG_NEED_FALLBACK
);
298 if (IS_ERR(cipher_tfm
)) {
299 pr_warn("could not load aes cipher driver\n");
300 return PTR_ERR(cipher_tfm
);
302 ctx
->u
.aes
.tfm_cipher
= cipher_tfm
;
307 static void ccp_aes_cmac_cra_exit(struct crypto_tfm
*tfm
)
309 struct ccp_ctx
*ctx
= crypto_tfm_ctx(tfm
);
311 if (ctx
->u
.aes
.tfm_cipher
)
312 crypto_free_cipher(ctx
->u
.aes
.tfm_cipher
);
313 ctx
->u
.aes
.tfm_cipher
= NULL
;
316 int ccp_register_aes_cmac_algs(struct list_head
*head
)
318 struct ccp_crypto_ahash_alg
*ccp_alg
;
319 struct ahash_alg
*alg
;
320 struct hash_alg_common
*halg
;
321 struct crypto_alg
*base
;
324 ccp_alg
= kzalloc(sizeof(*ccp_alg
), GFP_KERNEL
);
328 INIT_LIST_HEAD(&ccp_alg
->entry
);
329 ccp_alg
->mode
= CCP_AES_MODE_CMAC
;
332 alg
->init
= ccp_aes_cmac_init
;
333 alg
->update
= ccp_aes_cmac_update
;
334 alg
->final
= ccp_aes_cmac_final
;
335 alg
->finup
= ccp_aes_cmac_finup
;
336 alg
->digest
= ccp_aes_cmac_digest
;
337 alg
->setkey
= ccp_aes_cmac_setkey
;
340 halg
->digestsize
= AES_BLOCK_SIZE
;
343 snprintf(base
->cra_name
, CRYPTO_MAX_ALG_NAME
, "cmac(aes)");
344 snprintf(base
->cra_driver_name
, CRYPTO_MAX_ALG_NAME
, "cmac-aes-ccp");
345 base
->cra_flags
= CRYPTO_ALG_TYPE_AHASH
| CRYPTO_ALG_ASYNC
|
346 CRYPTO_ALG_KERN_DRIVER_ONLY
|
347 CRYPTO_ALG_NEED_FALLBACK
;
348 base
->cra_blocksize
= AES_BLOCK_SIZE
;
349 base
->cra_ctxsize
= sizeof(struct ccp_ctx
);
350 base
->cra_priority
= CCP_CRA_PRIORITY
;
351 base
->cra_type
= &crypto_ahash_type
;
352 base
->cra_init
= ccp_aes_cmac_cra_init
;
353 base
->cra_exit
= ccp_aes_cmac_cra_exit
;
354 base
->cra_module
= THIS_MODULE
;
356 ret
= crypto_register_ahash(alg
);
358 pr_err("%s ahash algorithm registration error (%d)\n",
359 base
->cra_name
, ret
);
364 list_add(&ccp_alg
->entry
, head
);