* [PATCH 1/4] crypto: ti: Add support for AES-XTS in DTHEv2 driver
2025-09-05 13:27 [PATCH 0/4] Add support for more AES modes in TI DTHEv2 T Pratham
@ 2025-09-05 13:27 ` T Pratham
2025-09-05 13:27 ` [PATCH 2/4] crypto: ti: Add support for AES-CTR " T Pratham
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: T Pratham @ 2025-09-05 13:27 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: Kamlesh Gurudasani, Manorit Chawdhry, Vignesh Raghavendra,
Praneeth Bajjuri, Vishal Mahaveer, Kavitha Malarvizhi,
linux-crypto, linux-kernel
Add support for XTS mode of operation for AES algorithm in the AES
Engine of the DTHEv2 hardware cryptographic engine.
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/Kconfig | 1 +
drivers/crypto/ti/dthev2-aes.c | 73 ++++++++++++++++++++++++++++++-
drivers/crypto/ti/dthev2-common.h | 8 +++-
3 files changed, 80 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig
index 38d22cab05a9..bdb7f652e093 100644
--- a/drivers/crypto/ti/Kconfig
+++ b/drivers/crypto/ti/Kconfig
@@ -6,6 +6,7 @@ config CRYPTO_DEV_TI_DTHEV2
select CRYPTO_SKCIPHER
select CRYPTO_ECB
select CRYPTO_CBC
+ select CRYPTO_XTS
help
This enables support for the TI DTHE V2 hw cryptography engine
which can be found on TI K3 SOCs. Selecting this enables use
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 0431a36d8c4a..21e7e5b8d6da 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -25,6 +25,7 @@
// AES Engine
#define DTHE_P_AES_BASE 0x7000
+
#define DTHE_P_AES_KEY1_0 0x0038
#define DTHE_P_AES_KEY1_1 0x003C
#define DTHE_P_AES_KEY1_2 0x0030
@@ -33,6 +34,16 @@
#define DTHE_P_AES_KEY1_5 0x002C
#define DTHE_P_AES_KEY1_6 0x0020
#define DTHE_P_AES_KEY1_7 0x0024
+
+#define DTHE_P_AES_KEY2_0 0x0018
+#define DTHE_P_AES_KEY2_1 0x001C
+#define DTHE_P_AES_KEY2_2 0x0010
+#define DTHE_P_AES_KEY2_3 0x0014
+#define DTHE_P_AES_KEY2_4 0x0008
+#define DTHE_P_AES_KEY2_5 0x000C
+#define DTHE_P_AES_KEY2_6 0x0000
+#define DTHE_P_AES_KEY2_7 0x0004
+
#define DTHE_P_AES_IV_IN_0 0x0040
#define DTHE_P_AES_IV_IN_1 0x0044
#define DTHE_P_AES_IV_IN_2 0x0048
@@ -52,6 +63,7 @@
enum aes_ctrl_mode_masks {
AES_CTRL_ECB_MASK = 0x00,
AES_CTRL_CBC_MASK = BIT(5),
+ AES_CTRL_XTS_MASK = BIT(12) | BIT(11),
};
#define DTHE_AES_CTRL_MODE_CLEAR_MASK ~GENMASK(28, 5)
@@ -119,6 +131,22 @@ static int dthe_aes_cbc_setkey(struct crypto_skcipher *tfm, const u8 *key, unsig
return dthe_aes_setkey(tfm, key, keylen);
}
+static int dthe_aes_xts_setkey(struct crypto_skcipher *tfm, const u8 *key, unsigned int keylen)
+{
+ struct dthe_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+
+ if (keylen != 2 * AES_KEYSIZE_128 &&
+ keylen != 2 * AES_KEYSIZE_192 &&
+ keylen != 2 * AES_KEYSIZE_256)
+ return -EINVAL;
+
+ ctx->aes_mode = DTHE_AES_XTS;
+ ctx->keylen = keylen / 2;
+ memcpy(ctx->key, key, keylen);
+
+ return 0;
+}
+
static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
struct dthe_aes_req_ctx *rctx,
u32 *iv_in)
@@ -141,6 +169,24 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
writel_relaxed(ctx->key[7], aes_base_reg + DTHE_P_AES_KEY1_7);
}
+ if (ctx->aes_mode == DTHE_AES_XTS) {
+ size_t key2_offset = ctx->keylen / sizeof(u32);
+
+ writel_relaxed(ctx->key[key2_offset + 0], aes_base_reg + DTHE_P_AES_KEY2_0);
+ writel_relaxed(ctx->key[key2_offset + 1], aes_base_reg + DTHE_P_AES_KEY2_1);
+ writel_relaxed(ctx->key[key2_offset + 2], aes_base_reg + DTHE_P_AES_KEY2_2);
+ writel_relaxed(ctx->key[key2_offset + 3], aes_base_reg + DTHE_P_AES_KEY2_3);
+
+ if (ctx->keylen > AES_KEYSIZE_128) {
+ writel_relaxed(ctx->key[key2_offset + 4], aes_base_reg + DTHE_P_AES_KEY2_4);
+ writel_relaxed(ctx->key[key2_offset + 5], aes_base_reg + DTHE_P_AES_KEY2_5);
+ }
+ if (ctx->keylen == AES_KEYSIZE_256) {
+ writel_relaxed(ctx->key[key2_offset + 6], aes_base_reg + DTHE_P_AES_KEY2_6);
+ writel_relaxed(ctx->key[key2_offset + 7], aes_base_reg + DTHE_P_AES_KEY2_7);
+ }
+ }
+
if (rctx->enc)
ctrl_val |= DTHE_AES_CTRL_DIR_ENC;
@@ -160,6 +206,9 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
case DTHE_AES_CBC:
ctrl_val |= AES_CTRL_CBC_MASK;
break;
+ case DTHE_AES_XTS:
+ ctrl_val |= AES_CTRL_XTS_MASK;
+ break;
}
if (iv_in) {
@@ -397,7 +446,29 @@ static struct skcipher_engine_alg cipher_algs[] = {
.cra_module = THIS_MODULE,
},
.op.do_one_request = dthe_aes_run,
- } /* CBC AES */
+ }, /* CBC AES */
+ {
+ .base.init = dthe_cipher_init_tfm,
+ .base.setkey = dthe_aes_xts_setkey,
+ .base.encrypt = dthe_aes_encrypt,
+ .base.decrypt = dthe_aes_decrypt,
+ .base.min_keysize = AES_MIN_KEY_SIZE * 2,
+ .base.max_keysize = AES_MAX_KEY_SIZE * 2,
+ .base.ivsize = AES_IV_SIZE,
+ .base.base = {
+ .cra_name = "xts(aes)",
+ .cra_driver_name = "xts-aes-dthev2",
+ .cra_priority = 299,
+ .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+ .cra_alignmask = AES_BLOCK_SIZE - 1,
+ .cra_blocksize = AES_BLOCK_SIZE,
+ .cra_ctxsize = sizeof(struct dthe_tfm_ctx),
+ .cra_reqsize = sizeof(struct dthe_aes_req_ctx),
+ .cra_module = THIS_MODULE,
+ },
+ .op.do_one_request = dthe_aes_run,
+ }, /* XTS AES */
};
int dthe_register_aes_algs(void)
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index 68c94acda8aa..e2d901e70fcc 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -27,10 +27,16 @@
#define DTHE_REG_SIZE 4
#define DTHE_DMA_TIMEOUT_MS 2000
+/*
+ * Size of largest possible key (of all algorithms) to be stored in dthe_tfm_ctx
+ * This is currently the keysize of XTS-AES-256 which is 512 bits (64 bytes)
+ */
+#define DTHE_MAX_KEYSIZE (AES_KEYSIZE_256 * 2)
enum dthe_aes_mode {
DTHE_AES_ECB = 0,
DTHE_AES_CBC,
+ DTHE_AES_XTS,
};
/* Driver specific struct definitions */
@@ -77,7 +83,7 @@ struct dthe_list {
struct dthe_tfm_ctx {
struct dthe_data *dev_data;
unsigned int keylen;
- u32 key[AES_KEYSIZE_256 / sizeof(u32)];
+ u32 key[DTHE_MAX_KEYSIZE / sizeof(u32)];
enum dthe_aes_mode aes_mode;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 2/4] crypto: ti: Add support for AES-CTR in DTHEv2 driver
2025-09-05 13:27 [PATCH 0/4] Add support for more AES modes in TI DTHEv2 T Pratham
2025-09-05 13:27 ` [PATCH 1/4] crypto: ti: Add support for AES-XTS in DTHEv2 driver T Pratham
@ 2025-09-05 13:27 ` T Pratham
2025-09-05 13:27 ` [PATCH 3/4] crypto: ti: Add support for AES-GCM " T Pratham
2025-09-05 13:27 ` [PATCH 4/4] crypto: ti: Add support for AES-CCM " T Pratham
3 siblings, 0 replies; 7+ messages in thread
From: T Pratham @ 2025-09-05 13:27 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: Kamlesh Gurudasani, Manorit Chawdhry, Vignesh Raghavendra,
Praneeth Bajjuri, Vishal Mahaveer, Kavitha Malarvizhi,
linux-crypto, linux-kernel
Add support for CTR mode of operation for AES algorithm in the AES
Engine of the DTHEv2 hardware cryptographic engine.
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/Kconfig | 1 +
drivers/crypto/ti/dthev2-aes.c | 80 +++++++++++++++++++++++++++++--
drivers/crypto/ti/dthev2-common.c | 19 ++++++++
drivers/crypto/ti/dthev2-common.h | 15 ++++++
4 files changed, 110 insertions(+), 5 deletions(-)
diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig
index bdb7f652e093..b36733a8c734 100644
--- a/drivers/crypto/ti/Kconfig
+++ b/drivers/crypto/ti/Kconfig
@@ -6,6 +6,7 @@ config CRYPTO_DEV_TI_DTHEV2
select CRYPTO_SKCIPHER
select CRYPTO_ECB
select CRYPTO_CBC
+ select CRYPTO_CTR
select CRYPTO_XTS
help
This enables support for the TI DTHE V2 hw cryptography engine
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 21e7e5b8d6da..07787f0ae4fd 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -63,6 +63,7 @@
enum aes_ctrl_mode_masks {
AES_CTRL_ECB_MASK = 0x00,
AES_CTRL_CBC_MASK = BIT(5),
+ AES_CTRL_CTR_MASK = BIT(6),
AES_CTRL_XTS_MASK = BIT(12) | BIT(11),
};
@@ -74,6 +75,8 @@ enum aes_ctrl_mode_masks {
#define DTHE_AES_CTRL_KEYSIZE_24B BIT(4)
#define DTHE_AES_CTRL_KEYSIZE_32B (BIT(3) | BIT(4))
+#define DTHE_AES_CTRL_CTR_WIDTH_128B (BIT(7) | BIT(8))
+
#define DTHE_AES_CTRL_SAVE_CTX_SET BIT(29)
#define DTHE_AES_CTRL_OUTPUT_READY BIT_MASK(0)
@@ -131,6 +134,15 @@ static int dthe_aes_cbc_setkey(struct crypto_skcipher *tfm, const u8 *key, unsig
return dthe_aes_setkey(tfm, key, keylen);
}
+static int dthe_aes_ctr_setkey(struct crypto_skcipher *tfm, const u8 *key, unsigned int keylen)
+{
+ struct dthe_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+
+ ctx->aes_mode = DTHE_AES_CTR;
+
+ return dthe_aes_setkey(tfm, key, keylen);
+}
+
static int dthe_aes_xts_setkey(struct crypto_skcipher *tfm, const u8 *key, unsigned int keylen)
{
struct dthe_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
@@ -206,6 +218,10 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
case DTHE_AES_CBC:
ctrl_val |= AES_CTRL_CBC_MASK;
break;
+ case DTHE_AES_CTR:
+ ctrl_val |= AES_CTRL_CTR_MASK;
+ ctrl_val |= DTHE_AES_CTRL_CTR_WIDTH_128B;
+ break;
case DTHE_AES_XTS:
ctrl_val |= AES_CTRL_XTS_MASK;
break;
@@ -246,6 +262,9 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
int src_mapped_nents;
int dst_mapped_nents;
+ u8 pad_buf[AES_BLOCK_SIZE] = {0};
+ int pad_len = 0;
+
bool diff_dst;
enum dma_data_direction src_dir, dst_dir;
@@ -265,6 +284,29 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
aes_irqenable_val |= DTHE_AES_IRQENABLE_EN_ALL;
writel_relaxed(aes_irqenable_val, aes_base_reg + DTHE_P_AES_IRQENABLE);
+ if (ctx->aes_mode == DTHE_AES_CTR) {
+ /*
+ * CTR mode can operate on any input length, but the hardware
+ * requires input length to be a multiple of the block size.
+ * We need to handle the padding in the driver.
+ */
+ if (req->cryptlen % AES_BLOCK_SIZE) {
+ /* Need to create a new SG list with padding */
+ pad_len = ALIGN(req->cryptlen, AES_BLOCK_SIZE) - req->cryptlen;
+ struct scatterlist *sg;
+
+ src = kmalloc_array((src_nents + 1), sizeof(*src), GFP_KERNEL);
+ if (!src) {
+ ret = -ENOMEM;
+ goto aes_alloc_err;
+ }
+ sg_init_table(src, src_nents + 1);
+ sg = dthe_copy_sg(src, req->src, req->cryptlen);
+ sg_set_buf(sg, pad_buf, pad_len);
+ src_nents++;
+ }
+ }
+
if (src == dst) {
diff_dst = false;
src_dir = DMA_BIDIRECTIONAL;
@@ -281,7 +323,7 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
src_mapped_nents = dma_map_sg(tx_dev, src, src_nents, src_dir);
if (src_mapped_nents == 0) {
ret = -EINVAL;
- goto aes_err;
+ goto aes_map_src_err;
}
if (!diff_dst) {
@@ -293,7 +335,7 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
if (dst_mapped_nents == 0) {
dma_unmap_sg(tx_dev, src, src_nents, src_dir);
ret = -EINVAL;
- goto aes_err;
+ goto aes_map_dst_err;
}
}
@@ -356,11 +398,16 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
}
aes_prep_err:
- dma_unmap_sg(tx_dev, src, src_nents, src_dir);
if (dst_dir != DMA_BIDIRECTIONAL)
dma_unmap_sg(rx_dev, dst, dst_nents, dst_dir);
+aes_map_dst_err:
+ dma_unmap_sg(tx_dev, src, src_nents, src_dir);
-aes_err:
+aes_map_src_err:
+ if (ctx->aes_mode == DTHE_AES_CTR && req->cryptlen % AES_BLOCK_SIZE)
+ kfree(src);
+
+aes_alloc_err:
local_bh_disable();
crypto_finalize_skcipher_request(dev_data->engine, req, ret);
local_bh_enable();
@@ -375,9 +422,10 @@ static int dthe_aes_crypt(struct skcipher_request *req)
/*
* If data is not a multiple of AES_BLOCK_SIZE, need to return -EINVAL
+ * except in CTR mode, where any length is supported.
* If data length input is zero, no need to do any operation.
*/
- if (req->cryptlen % AES_BLOCK_SIZE)
+ if (req->cryptlen % AES_BLOCK_SIZE && ctx->aes_mode != DTHE_AES_CTR)
return -EINVAL;
if (req->cryptlen == 0)
@@ -447,6 +495,28 @@ static struct skcipher_engine_alg cipher_algs[] = {
},
.op.do_one_request = dthe_aes_run,
}, /* CBC AES */
+ {
+ .base.init = dthe_cipher_init_tfm,
+ .base.setkey = dthe_aes_ctr_setkey,
+ .base.encrypt = dthe_aes_encrypt,
+ .base.decrypt = dthe_aes_decrypt,
+ .base.min_keysize = AES_MIN_KEY_SIZE,
+ .base.max_keysize = AES_MAX_KEY_SIZE,
+ .base.ivsize = AES_IV_SIZE,
+ .base.base = {
+ .cra_name = "ctr(aes)",
+ .cra_driver_name = "ctr-aes-dthev2",
+ .cra_priority = 299,
+ .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+ .cra_alignmask = AES_BLOCK_SIZE - 1,
+ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct dthe_tfm_ctx),
+ .cra_reqsize = sizeof(struct dthe_aes_req_ctx),
+ .cra_module = THIS_MODULE,
+ },
+ .op.do_one_request = dthe_aes_run,
+ }, /* CTR AES */
{
.base.init = dthe_cipher_init_tfm,
.base.setkey = dthe_aes_xts_setkey,
diff --git a/drivers/crypto/ti/dthev2-common.c b/drivers/crypto/ti/dthev2-common.c
index c39d37933b9e..a2ad79bec105 100644
--- a/drivers/crypto/ti/dthev2-common.c
+++ b/drivers/crypto/ti/dthev2-common.c
@@ -48,6 +48,25 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx)
return dev_data;
}
+struct scatterlist *dthe_copy_sg(struct scatterlist *dst,
+ struct scatterlist *src,
+ int buflen)
+{
+ struct scatterlist *from_sg, *to_sg;
+ int sglen;
+
+ for (to_sg = dst, from_sg = src; buflen && from_sg; buflen -= sglen) {
+ sglen = from_sg->length;
+ if (sglen > buflen)
+ sglen = buflen;
+ sg_set_buf(to_sg, sg_virt(from_sg), sglen);
+ from_sg = sg_next(from_sg);
+ to_sg = sg_next(to_sg);
+ }
+
+ return to_sg;
+}
+
static int dthe_dma_init(struct dthe_data *dev_data)
{
int ret;
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index e2d901e70fcc..629f45a3ab33 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -36,6 +36,7 @@
enum dthe_aes_mode {
DTHE_AES_ECB = 0,
DTHE_AES_CBC,
+ DTHE_AES_CTR,
DTHE_AES_XTS,
};
@@ -101,6 +102,20 @@ struct dthe_aes_req_ctx {
struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx);
+/**
+ * dthe_copy_sg - Copy sg entries from src to dst
+ * @dst: Destination sg to be filled
+ * @src: Source sg to be copied from
+ * @buflen: Number of bytes to be copied
+ *
+ * Description:
+ * Copy buflen bytes of data from src to dst.
+ *
+ **/
+struct scatterlist *dthe_copy_sg(struct scatterlist *dst,
+ struct scatterlist *src,
+ int buflen);
+
int dthe_register_aes_algs(void);
void dthe_unregister_aes_algs(void);
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 3/4] crypto: ti: Add support for AES-GCM in DTHEv2 driver
2025-09-05 13:27 [PATCH 0/4] Add support for more AES modes in TI DTHEv2 T Pratham
2025-09-05 13:27 ` [PATCH 1/4] crypto: ti: Add support for AES-XTS in DTHEv2 driver T Pratham
2025-09-05 13:27 ` [PATCH 2/4] crypto: ti: Add support for AES-CTR " T Pratham
@ 2025-09-05 13:27 ` T Pratham
2025-09-06 17:02 ` kernel test robot
2025-09-05 13:27 ` [PATCH 4/4] crypto: ti: Add support for AES-CCM " T Pratham
3 siblings, 1 reply; 7+ messages in thread
From: T Pratham @ 2025-09-05 13:27 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: Kamlesh Gurudasani, Manorit Chawdhry, Vignesh Raghavendra,
Praneeth Bajjuri, Vishal Mahaveer, Kavitha Malarvizhi,
linux-crypto, linux-kernel
AES-GCM is an AEAD algorithm supporting both encryption and
authentication of data. This patch introduces support for AES-GCM as the
first AEAD algorithm supported by the DTHEv2 driver.
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/Kconfig | 2 +
drivers/crypto/ti/dthev2-aes.c | 575 +++++++++++++++++++++++++++++-
drivers/crypto/ti/dthev2-common.h | 6 +
3 files changed, 582 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig
index b36733a8c734..e1ef84b39267 100644
--- a/drivers/crypto/ti/Kconfig
+++ b/drivers/crypto/ti/Kconfig
@@ -8,6 +8,8 @@ config CRYPTO_DEV_TI_DTHEV2
select CRYPTO_CBC
select CRYPTO_CTR
select CRYPTO_XTS
+ select CRYPTO_GCM
+ select SG_SPLIT
help
This enables support for the TI DTHE V2 hw cryptography engine
which can be found on TI K3 SOCs. Selecting this enables use
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 07787f0ae4fd..6a3447846fbb 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -10,6 +10,7 @@
#include <crypto/aes.h>
#include <crypto/algapi.h>
#include <crypto/engine.h>
+#include <crypto/gcm.h>
#include <crypto/internal/aead.h>
#include <crypto/internal/skcipher.h>
@@ -53,6 +54,7 @@
#define DTHE_P_AES_C_LENGTH_1 0x0058
#define DTHE_P_AES_AUTH_LENGTH 0x005C
#define DTHE_P_AES_DATA_IN_OUT 0x0060
+#define DTHE_P_AES_TAG_OUT 0x0070
#define DTHE_P_AES_SYSCONFIG 0x0084
#define DTHE_P_AES_IRQSTATUS 0x008C
@@ -65,6 +67,7 @@ enum aes_ctrl_mode_masks {
AES_CTRL_CBC_MASK = BIT(5),
AES_CTRL_CTR_MASK = BIT(6),
AES_CTRL_XTS_MASK = BIT(12) | BIT(11),
+ AES_CTRL_GCM_MASK = BIT(17) | BIT(16) | BIT(6),
};
#define DTHE_AES_CTRL_MODE_CLEAR_MASK ~GENMASK(28, 5)
@@ -91,6 +94,7 @@ enum aes_ctrl_mode_masks {
#define AES_IV_SIZE AES_BLOCK_SIZE
#define AES_BLOCK_WORDS (AES_BLOCK_SIZE / sizeof(u32))
#define AES_IV_WORDS AES_BLOCK_WORDS
+#define DTHE_AES_GCM_AAD_MAXLEN (BIT_ULL(32) - 1)
static int dthe_cipher_init_tfm(struct crypto_skcipher *tfm)
{
@@ -225,6 +229,9 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
case DTHE_AES_XTS:
ctrl_val |= AES_CTRL_XTS_MASK;
break;
+ case DTHE_AES_GCM:
+ ctrl_val |= AES_CTRL_GCM_MASK;
+ break;
}
if (iv_in) {
@@ -451,6 +458,538 @@ static int dthe_aes_decrypt(struct skcipher_request *req)
return dthe_aes_crypt(req);
}
+static int dthe_aead_init_tfm(struct crypto_aead *tfm)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+ struct dthe_data *dev_data = dthe_get_dev(ctx);
+
+ memzero_explicit(ctx, sizeof(*ctx));
+ ctx->dev_data = dev_data;
+
+ const char *alg_name = crypto_tfm_alg_name(&tfm->base);
+
+ ctx->aead_fb = crypto_alloc_aead(alg_name, 0,
+ CRYPTO_ALG_NEED_FALLBACK);
+ if (IS_ERR(ctx->aead_fb)) {
+ dev_err(dev_data->dev, "fallback driver %s couldn't be loaded\n",
+ alg_name);
+ return PTR_ERR(ctx->aead_fb);
+ }
+
+ return 0;
+}
+
+static void dthe_aead_exit_tfm(struct crypto_aead *tfm)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+ crypto_free_aead(ctx->aead_fb);
+}
+
+/**
+ * dthe_aead_prep_src - Prepare source scatterlist for AEAD from input req->src
+ * @sg: Input req->src scatterlist
+ * @assoclen: Input req->assoclen
+ * @cryptlen: Input req->cryptlen (minus the size of TAG in decryption)
+ *
+ * Description:
+ * For modes with authentication, DTHEv2 hardware requires the input AAD and
+ * plaintext/ciphertext to be individually aligned to AES_BLOCK_SIZE. However,
+ * linux crypto's aead_request provides the input with AAD and plaintext/ciphertext
+ * contiguously in a single scatterlist.
+ *
+ * This helper function takes the input scatterlist and splits it into separate
+ * scatterlists for AAD and plaintext/ciphertext, ensuring each is aligned to
+ * AES_BLOCK_SIZE, and then merges the aligned scatterlists back into a single
+ * scatterlist for processing. The return value is a pointer to the merged
+ * scatterlist, or NULL on failure.
+ **/
+static struct scatterlist *dthe_aead_prep_src(struct scatterlist *sg,
+ unsigned int assoclen,
+ unsigned int cryptlen)
+{
+ struct scatterlist *in_sg[2];
+ struct scatterlist *to_sg;
+ struct scatterlist *src, *ret;
+ size_t split_sizes[2] = {assoclen, cryptlen};
+ int out_mapped_nents[2];
+ int crypt_nents = 0, assoc_nents = 0, src_nents = 0;
+
+ /* sg_split does not work properly if one of the split_sizes is 0 */
+ if (cryptlen == 0 || assoclen == 0) {
+ /*
+ * Assigning both to sg does not matter as assoclen = 0 or cryptlen = 0
+ * being passed to dthe_copy_sg will take care to copy the sg correctly
+ */
+ in_sg[0] = sg;
+ in_sg[1] = sg;
+
+ src_nents = sg_nents_for_len(sg, assoclen + cryptlen);
+ } else {
+ sg_split(sg, 0, 0, 2, split_sizes, in_sg, out_mapped_nents, GFP_KERNEL);
+ assoc_nents = sg_nents_for_len(in_sg[0], assoclen);
+ crypt_nents = sg_nents_for_len(in_sg[1], cryptlen);
+
+ src_nents = assoc_nents + crypt_nents;
+ }
+
+ if (assoclen % AES_BLOCK_SIZE)
+ src_nents++;
+ if (cryptlen % AES_BLOCK_SIZE)
+ src_nents++;
+
+ src = kmalloc_array(src_nents, sizeof(struct scatterlist), GFP_KERNEL);
+ if (!src) {
+ ret = NULL;
+ goto dthe_aead_prep_src_mem_err;
+ }
+
+ sg_init_table(src, src_nents);
+ to_sg = src;
+ ret = src;
+
+ to_sg = dthe_copy_sg(to_sg, in_sg[0], assoclen);
+ if (assoclen % AES_BLOCK_SIZE) {
+ unsigned int pad_len = AES_BLOCK_SIZE - (assoclen % AES_BLOCK_SIZE);
+ u8 *pad_buf = kzalloc(sizeof(u8) * pad_len, GFP_KERNEL);
+
+ if (!pad_buf) {
+ kfree(src);
+ ret = NULL;
+ goto dthe_aead_prep_src_mem_err;
+ }
+
+ sg_set_buf(to_sg, pad_buf, pad_len);
+ to_sg = sg_next(to_sg);
+ }
+
+ to_sg = dthe_copy_sg(to_sg, in_sg[1], cryptlen);
+ if (cryptlen % AES_BLOCK_SIZE) {
+ unsigned int pad_len = AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE);
+ u8 *pad_buf = kzalloc(sizeof(u8) * pad_len, GFP_KERNEL);
+
+ if (!pad_buf) {
+ kfree(src);
+ ret = NULL;
+ goto dthe_aead_prep_src_mem_err;
+ }
+
+ sg_set_buf(to_sg, pad_buf, pad_len);
+ to_sg = sg_next(to_sg);
+ }
+
+dthe_aead_prep_src_mem_err:
+ if (cryptlen != 0 && assoclen != 0) {
+ kfree(in_sg[0]);
+ kfree(in_sg[1]);
+ }
+
+ return ret;
+}
+
+/**
+ * dthe_aead_prep_dst - Prepare destination scatterlist for AEAD from input req->dst
+ * @sg: Input req->dst scatterlist
+ * @assoclen: Input req->assoclen
+ * @cryptlen: Input req->cryptlen (minus the size of TAG in decryption)
+ *
+ * Description:
+ * For modes with authentication, DTHEv2 hardware returns encrypted ciphertext/decrypted
+ * plaintext through DMA and TAG through MMRs. However, the dst scatterlist in linux
+ * crypto's aead_request is allocated same as input req->src scatterlist. That is, it
+ * contains space for AAD in the beginning and ciphertext/plaintext at the end, with no
+ * alignment padding. This causes issues with DMA engine and DTHEv2 hardware.
+ *
+ * This helper function takes the output scatterlist and maps the part of the buffer
+ * which holds only the ciphertext/plaintext to a new scatterlist. It also adds a padding
+ * to align it with AES_BLOCK_SIZE. The return value is a pointer to the trimmed
+ * scatterlist, or NULL on failure.
+ **/
+static struct scatterlist *dthe_aead_prep_dst(struct scatterlist *sg,
+ unsigned int assoclen,
+ unsigned int cryptlen)
+{
+ struct scatterlist *out_sg[1];
+ struct scatterlist *dst;
+ struct scatterlist *to_sg;
+ size_t split_sizes[1] = {cryptlen};
+ int out_mapped_nents[1];
+ int dst_nents = 0;
+
+ sg_split(sg, 0, assoclen, 1, split_sizes, out_sg, out_mapped_nents, GFP_KERNEL);
+ dst_nents = sg_nents_for_len(out_sg[0], cryptlen);
+ if (cryptlen % AES_BLOCK_SIZE)
+ dst_nents++;
+
+ dst = kmalloc_array(dst_nents, sizeof(struct scatterlist), GFP_KERNEL);
+ if (!dst) {
+ kfree(out_sg[0]);
+ return NULL;
+ }
+ sg_init_table(dst, dst_nents);
+
+ to_sg = dthe_copy_sg(dst, out_sg[0], cryptlen);
+ if (cryptlen % AES_BLOCK_SIZE) {
+ unsigned int pad_len = AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE);
+ u8 *pad_buf = kzalloc(sizeof(u8) * pad_len, GFP_KERNEL);
+
+ if (!pad_buf) {
+ kfree(dst);
+ kfree(out_sg[0]);
+ return NULL;
+ }
+
+ sg_set_buf(to_sg, pad_buf, pad_len);
+ to_sg = sg_next(to_sg);
+ }
+
+ kfree(out_sg[0]);
+
+ return dst;
+}
+
+static void dthe_aead_read_tag(struct dthe_tfm_ctx *ctx, u32 *tag)
+{
+ struct dthe_data *dev_data = dthe_get_dev(ctx);
+ void __iomem *aes_base_reg = dev_data->regs + DTHE_P_AES_BASE;
+
+ for (int i = 0; i < 1024; ++i) {
+ if (readl_relaxed(aes_base_reg + DTHE_P_AES_CTRL) & BIT(30))
+ break;
+ }
+
+ for (int i = 0; i < AES_BLOCK_WORDS; ++i)
+ tag[i] = readl_relaxed(aes_base_reg +
+ DTHE_P_AES_TAG_OUT +
+ DTHE_REG_SIZE * i);
+}
+
+static void dthe_aead_enc_get_tag(struct aead_request *req)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
+ u32 tag[AES_BLOCK_WORDS];
+ int nents;
+
+ dthe_aead_read_tag(ctx, tag);
+
+ nents = sg_nents_for_len(req->dst, req->cryptlen + req->assoclen + ctx->authsize);
+
+ sg_pcopy_from_buffer(req->dst, nents, tag, ctx->authsize,
+ req->assoclen + req->cryptlen);
+}
+
+static int dthe_aead_dec_verify_tag(struct aead_request *req)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
+ u32 tag_out[AES_BLOCK_WORDS];
+ u32 tag_in[AES_BLOCK_WORDS];
+ int nents;
+
+ dthe_aead_read_tag(ctx, tag_out);
+
+ nents = sg_nents_for_len(req->src, req->assoclen + req->cryptlen);
+
+ sg_pcopy_to_buffer(req->src, nents, tag_in, ctx->authsize,
+ req->assoclen + req->cryptlen - ctx->authsize);
+
+ if (memcmp(tag_in, tag_out, ctx->authsize))
+ return -EBADMSG;
+ else
+ return 0;
+}
+
+static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int keylen)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+ if (keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_192 && keylen != AES_KEYSIZE_256)
+ return -EINVAL;
+
+ ctx->aes_mode = DTHE_AES_GCM;
+ ctx->keylen = keylen;
+ memcpy(ctx->key, key, keylen);
+
+ crypto_aead_clear_flags(ctx->aead_fb, CRYPTO_TFM_REQ_MASK);
+ crypto_aead_set_flags(ctx->aead_fb,
+ crypto_aead_get_flags(tfm) &
+ CRYPTO_TFM_REQ_MASK);
+
+ return crypto_aead_setkey(ctx->aead_fb, key, keylen);
+}
+
+static int dthe_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+ /* Invalid auth size will be handled by crypto_aead_setauthsize() */
+ ctx->authsize = authsize;
+
+ return crypto_aead_setauthsize(ctx->aead_fb, authsize);
+}
+
+static void dthe_aead_dma_in_callback(void *data)
+{
+ struct aead_request *req = (struct aead_request *)data;
+ struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
+
+ complete(&rctx->aes_compl);
+}
+
+static int dthe_aead_run(struct crypto_engine *engine, void *areq)
+{
+ struct aead_request *req = container_of(areq, struct aead_request, base);
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
+ struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
+ struct dthe_data *dev_data = dthe_get_dev(ctx);
+
+ unsigned int cryptlen = req->cryptlen;
+ unsigned int assoclen = req->assoclen;
+ unsigned int authsize = ctx->authsize;
+ unsigned int unpadded_cryptlen;
+ struct scatterlist *src = req->src;
+ struct scatterlist *dst = req->dst;
+
+ int src_nents;
+ int dst_nents;
+ int src_mapped_nents, dst_mapped_nents;
+
+ enum dma_data_direction src_dir, dst_dir;
+
+ struct device *tx_dev, *rx_dev;
+ struct dma_async_tx_descriptor *desc_in, *desc_out;
+
+ int ret;
+
+ void __iomem *aes_base_reg = dev_data->regs + DTHE_P_AES_BASE;
+
+ u32 aes_irqenable_val = readl_relaxed(aes_base_reg + DTHE_P_AES_IRQENABLE);
+ u32 aes_sysconfig_val = readl_relaxed(aes_base_reg + DTHE_P_AES_SYSCONFIG);
+
+ aes_sysconfig_val |= DTHE_AES_SYSCONFIG_DMA_DATA_IN_OUT_EN;
+ writel_relaxed(aes_sysconfig_val, aes_base_reg + DTHE_P_AES_SYSCONFIG);
+
+ aes_irqenable_val |= DTHE_AES_IRQENABLE_EN_ALL;
+ writel_relaxed(aes_irqenable_val, aes_base_reg + DTHE_P_AES_IRQENABLE);
+
+ /* In decryption, the last authsize bytes are the TAG */
+ if (!rctx->enc)
+ cryptlen -= authsize;
+
+ // Prep src and dst scatterlists
+ src = dthe_aead_prep_src(req->src, req->assoclen, cryptlen);
+ if (!src) {
+ ret = -ENOMEM;
+ goto aead_err;
+ }
+
+ if (cryptlen != 0) {
+ dst = dthe_aead_prep_dst(req->dst, req->assoclen, cryptlen);
+ if (!dst) {
+ ret = -ENOMEM;
+ goto aead_prep_dst_err;
+ }
+ }
+
+ unpadded_cryptlen = cryptlen;
+
+ if (req->assoclen % AES_BLOCK_SIZE)
+ assoclen += AES_BLOCK_SIZE - (req->assoclen % AES_BLOCK_SIZE);
+ if (cryptlen % AES_BLOCK_SIZE)
+ cryptlen += AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE);
+
+ src_nents = sg_nents_for_len(src, assoclen + cryptlen);
+ dst_nents = sg_nents_for_len(dst, cryptlen);
+
+ // Prep finished
+
+ src_dir = DMA_TO_DEVICE;
+ dst_dir = DMA_FROM_DEVICE;
+
+ tx_dev = dmaengine_get_dma_device(dev_data->dma_aes_tx);
+ rx_dev = dmaengine_get_dma_device(dev_data->dma_aes_rx);
+
+ src_mapped_nents = dma_map_sg(tx_dev, src, src_nents, src_dir);
+ if (src_mapped_nents == 0) {
+ ret = -EINVAL;
+ goto aead_dma_map_src_err;
+ }
+
+ desc_out = dmaengine_prep_slave_sg(dev_data->dma_aes_tx, src, src_mapped_nents,
+ DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_out) {
+ ret = -EINVAL;
+ goto aead_dma_prep_src_err;
+ }
+
+ desc_out->callback = dthe_aead_dma_in_callback;
+ desc_out->callback_param = req;
+
+ if (cryptlen != 0) {
+ dst_mapped_nents = dma_map_sg(rx_dev, dst, dst_nents, dst_dir);
+ if (dst_mapped_nents == 0) {
+ ret = -EINVAL;
+ goto aead_dma_prep_src_err;
+ }
+
+ desc_in = dmaengine_prep_slave_sg(dev_data->dma_aes_rx, dst,
+ dst_mapped_nents, DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_in) {
+ ret = -EINVAL;
+ goto aead_dma_prep_dst_err;
+ }
+ }
+
+ init_completion(&rctx->aes_compl);
+
+ /*
+ * HACK: There is an unknown hw issue where if the previous operation had alen = 0 and
+ * plen != 0, the current operation's tag calculation is incorrect in the case where
+ * plen = 0 and alen != 0 currently. This is a workaround for now which somwhow works;
+ * by resetting the context by writing a 1 to the C_LENGTH_0 and AUTH_LENGTH registers.
+ */
+ if (cryptlen == 0) {
+ writel_relaxed(1, aes_base_reg + DTHE_P_AES_C_LENGTH_0);
+ writel_relaxed(1, aes_base_reg + DTHE_P_AES_AUTH_LENGTH);
+ }
+
+ u32 iv_in[AES_IV_WORDS];
+
+ if (req->iv) {
+ memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
+ } else {
+ iv_in[0] = 0;
+ iv_in[1] = 0;
+ iv_in[2] = 0;
+ }
+ iv_in[3] = 0x01000000;
+
+ // Clear key2 to reset previous GHASH intermediate data
+ for (int i = 0; i < AES_KEYSIZE_256 / sizeof(u32); ++i)
+ writel_relaxed(0, aes_base_reg + DTHE_P_AES_KEY2_6 + DTHE_REG_SIZE * i);
+
+ dthe_aes_set_ctrl_key(ctx, rctx, iv_in);
+
+ writel_relaxed(lower_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AES_C_LENGTH_0);
+ writel_relaxed(upper_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AES_C_LENGTH_1);
+ writel_relaxed(req->assoclen, aes_base_reg + DTHE_P_AES_AUTH_LENGTH);
+
+ if (cryptlen != 0)
+ dmaengine_submit(desc_in);
+ dmaengine_submit(desc_out);
+
+ if (cryptlen != 0)
+ dma_async_issue_pending(dev_data->dma_aes_rx);
+ dma_async_issue_pending(dev_data->dma_aes_tx);
+
+ // Need to do a timeout to ensure mutex gets unlocked if DMA callback fails for any reason
+ ret = wait_for_completion_timeout(&rctx->aes_compl, msecs_to_jiffies(DTHE_DMA_TIMEOUT_MS));
+ if (!ret) {
+ ret = -ETIMEDOUT;
+ if (cryptlen != 0)
+ dmaengine_terminate_sync(dev_data->dma_aes_rx);
+ dmaengine_terminate_sync(dev_data->dma_aes_tx);
+
+ for (int i = 0; i < AES_BLOCK_SIZE / sizeof(int); ++i)
+ readl_relaxed(aes_base_reg + DTHE_P_AES_DATA_IN_OUT + DTHE_REG_SIZE * i);
+ } else {
+ ret = 0;
+ }
+
+ if (cryptlen != 0)
+ dma_sync_sg_for_cpu(rx_dev, dst, dst_nents, dst_dir);
+ if (rctx->enc) {
+ dthe_aead_enc_get_tag(req);
+ ret = 0;
+ } else {
+ ret = dthe_aead_dec_verify_tag(req);
+ }
+
+aead_dma_prep_dst_err:
+ if (cryptlen != 0)
+ dma_unmap_sg(rx_dev, dst, dst_nents, dst_dir);
+aead_dma_prep_src_err:
+ dma_unmap_sg(tx_dev, src, src_nents, src_dir);
+
+aead_dma_map_src_err:
+ if (unpadded_cryptlen % AES_BLOCK_SIZE && cryptlen != 0)
+ kfree(sg_virt(&dst[dst_nents - 1]));
+
+ if (cryptlen != 0)
+ kfree(dst);
+
+aead_prep_dst_err:
+ if (req->assoclen % AES_BLOCK_SIZE) {
+ int assoc_nents = sg_nents_for_len(src, req->assoclen);
+
+ kfree(sg_virt(&src[assoc_nents]));
+ }
+ if (unpadded_cryptlen % AES_BLOCK_SIZE)
+ kfree(sg_virt(&src[src_nents - 1]));
+
+ kfree(src);
+
+aead_err:
+ local_bh_disable();
+ crypto_finalize_aead_request(dev_data->engine, req, ret);
+ local_bh_enable();
+ return ret;
+}
+
+static int dthe_aead_crypt(struct aead_request *req)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
+ struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
+ struct dthe_data *dev_data = dthe_get_dev(ctx);
+ struct crypto_engine *engine;
+ unsigned int cryptlen = req->cryptlen;
+
+ // In decryption, last authsize bytes are the TAG
+ if (!rctx->enc)
+ cryptlen -= ctx->authsize;
+
+ /* Need to fallback to software in the following cases due to HW restrictions:
+ * - Both AAD and plaintext/ciphertext are zero length
+ * - AAD length is more than 2^32 - 1 bytes
+ */
+ if ((req->assoclen == 0 && cryptlen == 0) ||
+ req->assoclen > DTHE_AES_GCM_AAD_MAXLEN) {
+ struct aead_request *subreq = &rctx->fb_req;
+ int ret;
+
+ aead_request_set_tfm(subreq, ctx->aead_fb);
+ aead_request_set_callback(subreq, req->base.flags,
+ req->base.complete, req->base.data);
+ aead_request_set_crypt(subreq, req->src, req->dst,
+ req->cryptlen, req->iv);
+ aead_request_set_ad(subreq, req->assoclen);
+
+ ret = rctx->enc ? crypto_aead_encrypt(subreq) :
+ crypto_aead_decrypt(subreq);
+
+ return ret;
+ }
+
+ engine = dev_data->engine;
+ return crypto_transfer_aead_request_to_engine(engine, req);
+}
+
+static int dthe_aead_encrypt(struct aead_request *req)
+{
+ struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
+
+ rctx->enc = 1;
+ return dthe_aead_crypt(req);
+}
+
+static int dthe_aead_decrypt(struct aead_request *req)
+{
+ struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
+
+ rctx->enc = 0;
+ return dthe_aead_crypt(req);
+}
+
static struct skcipher_engine_alg cipher_algs[] = {
{
.base.init = dthe_cipher_init_tfm,
@@ -541,12 +1080,46 @@ static struct skcipher_engine_alg cipher_algs[] = {
}, /* XTS AES */
};
+static struct aead_engine_alg aead_algs[] = {
+ {
+ .base.init = dthe_aead_init_tfm,
+ .base.exit = dthe_aead_exit_tfm,
+ .base.setkey = dthe_aead_setkey,
+ .base.setauthsize = dthe_aead_setauthsize,
+ .base.maxauthsize = AES_BLOCK_SIZE,
+ .base.encrypt = dthe_aead_encrypt,
+ .base.decrypt = dthe_aead_decrypt,
+ .base.chunksize = AES_BLOCK_SIZE,
+ .base.ivsize = GCM_AES_IV_SIZE,
+ .base.base = {
+ .cra_name = "gcm(aes)",
+ .cra_driver_name = "gcm-aes-dthev2",
+ .cra_priority = 299,
+ .cra_flags = CRYPTO_ALG_TYPE_AEAD |
+ CRYPTO_ALG_KERN_DRIVER_ONLY |
+ CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_NEED_FALLBACK,
+ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct dthe_tfm_ctx),
+ .cra_reqsize = sizeof(struct dthe_aes_req_ctx),
+ .cra_module = THIS_MODULE,
+ },
+ .op.do_one_request = dthe_aead_run,
+ }, /* GCM AES */
+};
+
int dthe_register_aes_algs(void)
{
- return crypto_engine_register_skciphers(cipher_algs, ARRAY_SIZE(cipher_algs));
+ int ret = 0;
+
+ ret |= crypto_engine_register_skciphers(cipher_algs, ARRAY_SIZE(cipher_algs));
+ ret |= crypto_engine_register_aeads(aead_algs, ARRAY_SIZE(aead_algs));
+
+ return ret;
}
void dthe_unregister_aes_algs(void)
{
crypto_engine_unregister_skciphers(cipher_algs, ARRAY_SIZE(cipher_algs));
+ crypto_engine_unregister_aeads(aead_algs, ARRAY_SIZE(aead_algs));
}
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index 629f45a3ab33..3c9fe0633cca 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -38,6 +38,7 @@ enum dthe_aes_mode {
DTHE_AES_CBC,
DTHE_AES_CTR,
DTHE_AES_XTS,
+ DTHE_AES_GCM,
};
/* Driver specific struct definitions */
@@ -78,14 +79,18 @@ struct dthe_list {
* struct dthe_tfm_ctx - Transform ctx struct containing ctx for all sub-components of DTHE V2
* @dev_data: Device data struct pointer
* @keylen: AES key length
+ * @authsize: Authentication size for modes with authentication
* @key: AES key
* @aes_mode: AES mode
+ * @aead_fb: Fallback crypto aead instance for GCM mode
*/
struct dthe_tfm_ctx {
struct dthe_data *dev_data;
unsigned int keylen;
+ unsigned int authsize;
u32 key[DTHE_MAX_KEYSIZE / sizeof(u32)];
enum dthe_aes_mode aes_mode;
+ struct crypto_aead *aead_fb;
};
/**
@@ -96,6 +101,7 @@ struct dthe_tfm_ctx {
struct dthe_aes_req_ctx {
int enc;
struct completion aes_compl;
+ struct aead_request fb_req;
};
/* Struct definitions end */
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 3/4] crypto: ti: Add support for AES-GCM in DTHEv2 driver
2025-09-05 13:27 ` [PATCH 3/4] crypto: ti: Add support for AES-GCM " T Pratham
@ 2025-09-06 17:02 ` kernel test robot
0 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2025-09-06 17:02 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: llvm, oe-kbuild-all, netdev, Kamlesh Gurudasani, Manorit Chawdhry,
Vignesh Raghavendra, Praneeth Bajjuri, Vishal Mahaveer,
Kavitha Malarvizhi, linux-crypto, linux-kernel
Hi Pratham,
kernel test robot noticed the following build warnings:
[auto build test WARNING on herbert-cryptodev-2.6/master]
[also build test WARNING on next-20250905]
[cannot apply to herbert-crypto-2.6/master linus/master v6.17-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/T-Pratham/crypto-ti-Add-support-for-AES-XTS-in-DTHEv2-driver/20250905-214245
base: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link: https://lore.kernel.org/r/20250905133504.2348972-7-t-pratham%40ti.com
patch subject: [PATCH 3/4] crypto: ti: Add support for AES-GCM in DTHEv2 driver
config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250907/202509070015.xKJCeXKj-lkp@intel.com/config)
compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250907/202509070015.xKJCeXKj-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509070015.xKJCeXKj-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/crypto/ti/dthev2-aes.c:787:7: warning: variable 'unpadded_cryptlen' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
787 | if (!dst) {
| ^~~~
drivers/crypto/ti/dthev2-aes.c:927:6: note: uninitialized use occurs here
927 | if (unpadded_cryptlen % AES_BLOCK_SIZE)
| ^~~~~~~~~~~~~~~~~
drivers/crypto/ti/dthev2-aes.c:787:3: note: remove the 'if' if its condition is always false
787 | if (!dst) {
| ^~~~~~~~~~~
788 | ret = -ENOMEM;
| ~~~~~~~~~~~~~~
789 | goto aead_prep_dst_err;
| ~~~~~~~~~~~~~~~~~~~~~~~
790 | }
| ~
drivers/crypto/ti/dthev2-aes.c:748:32: note: initialize the variable 'unpadded_cryptlen' to silence this warning
748 | unsigned int unpadded_cryptlen;
| ^
| = 0
1 warning generated.
vim +787 drivers/crypto/ti/dthev2-aes.c
737
738 static int dthe_aead_run(struct crypto_engine *engine, void *areq)
739 {
740 struct aead_request *req = container_of(areq, struct aead_request, base);
741 struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
742 struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
743 struct dthe_data *dev_data = dthe_get_dev(ctx);
744
745 unsigned int cryptlen = req->cryptlen;
746 unsigned int assoclen = req->assoclen;
747 unsigned int authsize = ctx->authsize;
748 unsigned int unpadded_cryptlen;
749 struct scatterlist *src = req->src;
750 struct scatterlist *dst = req->dst;
751
752 int src_nents;
753 int dst_nents;
754 int src_mapped_nents, dst_mapped_nents;
755
756 enum dma_data_direction src_dir, dst_dir;
757
758 struct device *tx_dev, *rx_dev;
759 struct dma_async_tx_descriptor *desc_in, *desc_out;
760
761 int ret;
762
763 void __iomem *aes_base_reg = dev_data->regs + DTHE_P_AES_BASE;
764
765 u32 aes_irqenable_val = readl_relaxed(aes_base_reg + DTHE_P_AES_IRQENABLE);
766 u32 aes_sysconfig_val = readl_relaxed(aes_base_reg + DTHE_P_AES_SYSCONFIG);
767
768 aes_sysconfig_val |= DTHE_AES_SYSCONFIG_DMA_DATA_IN_OUT_EN;
769 writel_relaxed(aes_sysconfig_val, aes_base_reg + DTHE_P_AES_SYSCONFIG);
770
771 aes_irqenable_val |= DTHE_AES_IRQENABLE_EN_ALL;
772 writel_relaxed(aes_irqenable_val, aes_base_reg + DTHE_P_AES_IRQENABLE);
773
774 /* In decryption, the last authsize bytes are the TAG */
775 if (!rctx->enc)
776 cryptlen -= authsize;
777
778 // Prep src and dst scatterlists
779 src = dthe_aead_prep_src(req->src, req->assoclen, cryptlen);
780 if (!src) {
781 ret = -ENOMEM;
782 goto aead_err;
783 }
784
785 if (cryptlen != 0) {
786 dst = dthe_aead_prep_dst(req->dst, req->assoclen, cryptlen);
> 787 if (!dst) {
788 ret = -ENOMEM;
789 goto aead_prep_dst_err;
790 }
791 }
792
793 unpadded_cryptlen = cryptlen;
794
795 if (req->assoclen % AES_BLOCK_SIZE)
796 assoclen += AES_BLOCK_SIZE - (req->assoclen % AES_BLOCK_SIZE);
797 if (cryptlen % AES_BLOCK_SIZE)
798 cryptlen += AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE);
799
800 src_nents = sg_nents_for_len(src, assoclen + cryptlen);
801 dst_nents = sg_nents_for_len(dst, cryptlen);
802
803 // Prep finished
804
805 src_dir = DMA_TO_DEVICE;
806 dst_dir = DMA_FROM_DEVICE;
807
808 tx_dev = dmaengine_get_dma_device(dev_data->dma_aes_tx);
809 rx_dev = dmaengine_get_dma_device(dev_data->dma_aes_rx);
810
811 src_mapped_nents = dma_map_sg(tx_dev, src, src_nents, src_dir);
812 if (src_mapped_nents == 0) {
813 ret = -EINVAL;
814 goto aead_dma_map_src_err;
815 }
816
817 desc_out = dmaengine_prep_slave_sg(dev_data->dma_aes_tx, src, src_mapped_nents,
818 DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
819 if (!desc_out) {
820 ret = -EINVAL;
821 goto aead_dma_prep_src_err;
822 }
823
824 desc_out->callback = dthe_aead_dma_in_callback;
825 desc_out->callback_param = req;
826
827 if (cryptlen != 0) {
828 dst_mapped_nents = dma_map_sg(rx_dev, dst, dst_nents, dst_dir);
829 if (dst_mapped_nents == 0) {
830 ret = -EINVAL;
831 goto aead_dma_prep_src_err;
832 }
833
834 desc_in = dmaengine_prep_slave_sg(dev_data->dma_aes_rx, dst,
835 dst_mapped_nents, DMA_DEV_TO_MEM,
836 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
837 if (!desc_in) {
838 ret = -EINVAL;
839 goto aead_dma_prep_dst_err;
840 }
841 }
842
843 init_completion(&rctx->aes_compl);
844
845 /*
846 * HACK: There is an unknown hw issue where if the previous operation had alen = 0 and
847 * plen != 0, the current operation's tag calculation is incorrect in the case where
848 * plen = 0 and alen != 0 currently. This is a workaround for now which somwhow works;
849 * by resetting the context by writing a 1 to the C_LENGTH_0 and AUTH_LENGTH registers.
850 */
851 if (cryptlen == 0) {
852 writel_relaxed(1, aes_base_reg + DTHE_P_AES_C_LENGTH_0);
853 writel_relaxed(1, aes_base_reg + DTHE_P_AES_AUTH_LENGTH);
854 }
855
856 u32 iv_in[AES_IV_WORDS];
857
858 if (req->iv) {
859 memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
860 } else {
861 iv_in[0] = 0;
862 iv_in[1] = 0;
863 iv_in[2] = 0;
864 }
865 iv_in[3] = 0x01000000;
866
867 // Clear key2 to reset previous GHASH intermediate data
868 for (int i = 0; i < AES_KEYSIZE_256 / sizeof(u32); ++i)
869 writel_relaxed(0, aes_base_reg + DTHE_P_AES_KEY2_6 + DTHE_REG_SIZE * i);
870
871 dthe_aes_set_ctrl_key(ctx, rctx, iv_in);
872
873 writel_relaxed(lower_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AES_C_LENGTH_0);
874 writel_relaxed(upper_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AES_C_LENGTH_1);
875 writel_relaxed(req->assoclen, aes_base_reg + DTHE_P_AES_AUTH_LENGTH);
876
877 if (cryptlen != 0)
878 dmaengine_submit(desc_in);
879 dmaengine_submit(desc_out);
880
881 if (cryptlen != 0)
882 dma_async_issue_pending(dev_data->dma_aes_rx);
883 dma_async_issue_pending(dev_data->dma_aes_tx);
884
885 // Need to do a timeout to ensure mutex gets unlocked if DMA callback fails for any reason
886 ret = wait_for_completion_timeout(&rctx->aes_compl, msecs_to_jiffies(DTHE_DMA_TIMEOUT_MS));
887 if (!ret) {
888 ret = -ETIMEDOUT;
889 if (cryptlen != 0)
890 dmaengine_terminate_sync(dev_data->dma_aes_rx);
891 dmaengine_terminate_sync(dev_data->dma_aes_tx);
892
893 for (int i = 0; i < AES_BLOCK_SIZE / sizeof(int); ++i)
894 readl_relaxed(aes_base_reg + DTHE_P_AES_DATA_IN_OUT + DTHE_REG_SIZE * i);
895 } else {
896 ret = 0;
897 }
898
899 if (cryptlen != 0)
900 dma_sync_sg_for_cpu(rx_dev, dst, dst_nents, dst_dir);
901 if (rctx->enc) {
902 dthe_aead_enc_get_tag(req);
903 ret = 0;
904 } else {
905 ret = dthe_aead_dec_verify_tag(req);
906 }
907
908 aead_dma_prep_dst_err:
909 if (cryptlen != 0)
910 dma_unmap_sg(rx_dev, dst, dst_nents, dst_dir);
911 aead_dma_prep_src_err:
912 dma_unmap_sg(tx_dev, src, src_nents, src_dir);
913
914 aead_dma_map_src_err:
915 if (unpadded_cryptlen % AES_BLOCK_SIZE && cryptlen != 0)
916 kfree(sg_virt(&dst[dst_nents - 1]));
917
918 if (cryptlen != 0)
919 kfree(dst);
920
921 aead_prep_dst_err:
922 if (req->assoclen % AES_BLOCK_SIZE) {
923 int assoc_nents = sg_nents_for_len(src, req->assoclen);
924
925 kfree(sg_virt(&src[assoc_nents]));
926 }
927 if (unpadded_cryptlen % AES_BLOCK_SIZE)
928 kfree(sg_virt(&src[src_nents - 1]));
929
930 kfree(src);
931
932 aead_err:
933 local_bh_disable();
934 crypto_finalize_aead_request(dev_data->engine, req, ret);
935 local_bh_enable();
936 return ret;
937 }
938
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 4/4] crypto: ti: Add support for AES-CCM in DTHEv2 driver
2025-09-05 13:27 [PATCH 0/4] Add support for more AES modes in TI DTHEv2 T Pratham
` (2 preceding siblings ...)
2025-09-05 13:27 ` [PATCH 3/4] crypto: ti: Add support for AES-GCM " T Pratham
@ 2025-09-05 13:27 ` T Pratham
2025-09-06 19:21 ` kernel test robot
3 siblings, 1 reply; 7+ messages in thread
From: T Pratham @ 2025-09-05 13:27 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: Kamlesh Gurudasani, Manorit Chawdhry, Vignesh Raghavendra,
Praneeth Bajjuri, Vishal Mahaveer, Kavitha Malarvizhi,
linux-crypto, linux-kernel
AES-CCM is an AEAD algorithm supporting both encryption and
authentication of data. This patch introduces support for AES-CCM AEAD
algorithm in the DTHEv2 driver.
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/Kconfig | 1 +
drivers/crypto/ti/dthev2-aes.c | 90 ++++++++++++++++++++++++++-----
drivers/crypto/ti/dthev2-common.h | 1 +
3 files changed, 79 insertions(+), 13 deletions(-)
diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig
index e1ef84b39267..02eff4f0e04b 100644
--- a/drivers/crypto/ti/Kconfig
+++ b/drivers/crypto/ti/Kconfig
@@ -9,6 +9,7 @@ config CRYPTO_DEV_TI_DTHEV2
select CRYPTO_CTR
select CRYPTO_XTS
select CRYPTO_GCM
+ select CRYPTO_CCM
select SG_SPLIT
help
This enables support for the TI DTHE V2 hw cryptography engine
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 6a3447846fbb..a40c6ea811c1 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -68,6 +68,7 @@ enum aes_ctrl_mode_masks {
AES_CTRL_CTR_MASK = BIT(6),
AES_CTRL_XTS_MASK = BIT(12) | BIT(11),
AES_CTRL_GCM_MASK = BIT(17) | BIT(16) | BIT(6),
+ AES_CTRL_CCM_MASK = BIT(18) | BIT(6),
};
#define DTHE_AES_CTRL_MODE_CLEAR_MASK ~GENMASK(28, 5)
@@ -80,6 +81,10 @@ enum aes_ctrl_mode_masks {
#define DTHE_AES_CTRL_CTR_WIDTH_128B (BIT(7) | BIT(8))
+#define DTHE_AES_CCM_L_FROM_IV_MASK GENMASK(2, 0)
+#define DTHE_AES_CTRL_CCM_L_MASK GENMASK(21, 19)
+#define DTHE_AES_CTRL_CCM_M_MAXVAL GENMASK(24, 22)
+
#define DTHE_AES_CTRL_SAVE_CTX_SET BIT(29)
#define DTHE_AES_CTRL_OUTPUT_READY BIT_MASK(0)
@@ -95,6 +100,8 @@ enum aes_ctrl_mode_masks {
#define AES_BLOCK_WORDS (AES_BLOCK_SIZE / sizeof(u32))
#define AES_IV_WORDS AES_BLOCK_WORDS
#define DTHE_AES_GCM_AAD_MAXLEN (BIT_ULL(32) - 1)
+#define DTHE_AES_CCM_AAD_MAXLEN (BIT(16) - BIT(8))
+#define DTHE_AES_CCM_CRYPT_MAXLEN (BIT_ULL(61) - 1)
static int dthe_cipher_init_tfm(struct crypto_skcipher *tfm)
{
@@ -232,6 +239,12 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
case DTHE_AES_GCM:
ctrl_val |= AES_CTRL_GCM_MASK;
break;
+ case DTHE_AES_CCM:
+ ctrl_val |= AES_CTRL_CCM_MASK;
+ ctrl_val |= FIELD_PREP(DTHE_AES_CTRL_CCM_L_MASK,
+ (iv_in[0] & DTHE_AES_CCM_L_FROM_IV_MASK));
+ ctrl_val |= DTHE_AES_CTRL_CCM_M_MAXVAL;
+ break;
}
if (iv_in) {
@@ -705,10 +718,6 @@ static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int
if (keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_192 && keylen != AES_KEYSIZE_256)
return -EINVAL;
- ctx->aes_mode = DTHE_AES_GCM;
- ctx->keylen = keylen;
- memcpy(ctx->key, key, keylen);
-
crypto_aead_clear_flags(ctx->aead_fb, CRYPTO_TFM_REQ_MASK);
crypto_aead_set_flags(ctx->aead_fb,
crypto_aead_get_flags(tfm) &
@@ -717,6 +726,28 @@ static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int
return crypto_aead_setkey(ctx->aead_fb, key, keylen);
}
+static int dthe_gcm_aes_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int keylen)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+ ctx->aes_mode = DTHE_AES_GCM;
+ ctx->keylen = keylen;
+ memcpy(ctx->key, key, keylen);
+
+ return dthe_aead_setkey(tfm, key, keylen);
+}
+
+static int dthe_ccm_aes_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int keylen)
+{
+ struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+ ctx->aes_mode = DTHE_AES_CCM;
+ ctx->keylen = keylen;
+ memcpy(ctx->key, key, keylen);
+
+ return dthe_aead_setkey(tfm, key, keylen);
+}
+
static int dthe_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
{
struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
@@ -855,14 +886,18 @@ static int dthe_aead_run(struct crypto_engine *engine, void *areq)
u32 iv_in[AES_IV_WORDS];
- if (req->iv) {
- memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
+ if (ctx->aes_mode == DTHE_AES_GCM) {
+ if (req->iv) {
+ memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
+ } else {
+ iv_in[0] = 0;
+ iv_in[1] = 0;
+ iv_in[2] = 0;
+ }
+ iv_in[3] = 0x01000000;
} else {
- iv_in[0] = 0;
- iv_in[1] = 0;
- iv_in[2] = 0;
+ memcpy(iv_in, req->iv, AES_IV_SIZE);
}
- iv_in[3] = 0x01000000;
// Clear key2 to reset previous GHASH intermediate data
for (int i = 0; i < AES_KEYSIZE_256 / sizeof(u32); ++i)
@@ -950,10 +985,14 @@ static int dthe_aead_crypt(struct aead_request *req)
/* Need to fallback to software in the following cases due to HW restrictions:
* - Both AAD and plaintext/ciphertext are zero length
- * - AAD length is more than 2^32 - 1 bytes
+ * - For AES-GCM, AAD length is more than 2^32 - 1 bytes
+ * - For AES-CCM, AAD length is more than 2^16 - 2^8 bytes
+ * - For AES-CCM, ciphertext length is more than 2^61 - 1 bytes
*/
if ((req->assoclen == 0 && cryptlen == 0) ||
- req->assoclen > DTHE_AES_GCM_AAD_MAXLEN) {
+ (ctx->aes_mode == DTHE_AES_GCM && req->assoclen > DTHE_AES_GCM_AAD_MAXLEN) ||
+ (ctx->aes_mode == DTHE_AES_CCM && req->assoclen > DTHE_AES_CCM_AAD_MAXLEN) ||
+ (ctx->aes_mode == DTHE_AES_CCM && cryptlen > DTHE_AES_CCM_CRYPT_MAXLEN)) {
struct aead_request *subreq = &rctx->fb_req;
int ret;
@@ -1084,7 +1123,7 @@ static struct aead_engine_alg aead_algs[] = {
{
.base.init = dthe_aead_init_tfm,
.base.exit = dthe_aead_exit_tfm,
- .base.setkey = dthe_aead_setkey,
+ .base.setkey = dthe_gcm_aes_setkey,
.base.setauthsize = dthe_aead_setauthsize,
.base.maxauthsize = AES_BLOCK_SIZE,
.base.encrypt = dthe_aead_encrypt,
@@ -1106,6 +1145,31 @@ static struct aead_engine_alg aead_algs[] = {
},
.op.do_one_request = dthe_aead_run,
}, /* GCM AES */
+ {
+ .base.init = dthe_aead_init_tfm,
+ .base.exit = dthe_aead_exit_tfm,
+ .base.setkey = dthe_ccm_aes_setkey,
+ .base.setauthsize = dthe_aead_setauthsize,
+ .base.maxauthsize = AES_BLOCK_SIZE,
+ .base.encrypt = dthe_aead_encrypt,
+ .base.decrypt = dthe_aead_decrypt,
+ .base.chunksize = AES_BLOCK_SIZE,
+ .base.ivsize = AES_IV_SIZE,
+ .base.base = {
+ .cra_name = "ccm(aes)",
+ .cra_driver_name = "ccm-aes-dthev2",
+ .cra_priority = 299,
+ .cra_flags = CRYPTO_ALG_TYPE_AEAD |
+ CRYPTO_ALG_KERN_DRIVER_ONLY |
+ CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_NEED_FALLBACK,
+ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct dthe_tfm_ctx),
+ .cra_reqsize = sizeof(struct dthe_aes_req_ctx),
+ .cra_module = THIS_MODULE,
+ },
+ .op.do_one_request = dthe_aead_run,
+ }, /* CCM AES */
};
int dthe_register_aes_algs(void)
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index 3c9fe0633cca..3b3b133fc984 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -39,6 +39,7 @@ enum dthe_aes_mode {
DTHE_AES_CTR,
DTHE_AES_XTS,
DTHE_AES_GCM,
+ DTHE_AES_CCM,
};
/* Driver specific struct definitions */
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 4/4] crypto: ti: Add support for AES-CCM in DTHEv2 driver
2025-09-05 13:27 ` [PATCH 4/4] crypto: ti: Add support for AES-CCM " T Pratham
@ 2025-09-06 19:21 ` kernel test robot
0 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2025-09-06 19:21 UTC (permalink / raw)
To: T Pratham, Herbert Xu, David S. Miller
Cc: llvm, oe-kbuild-all, netdev, Kamlesh Gurudasani, Manorit Chawdhry,
Vignesh Raghavendra, Praneeth Bajjuri, Vishal Mahaveer,
Kavitha Malarvizhi, linux-crypto, linux-kernel
Hi Pratham,
kernel test robot noticed the following build warnings:
[auto build test WARNING on herbert-cryptodev-2.6/master]
[also build test WARNING on next-20250905]
[cannot apply to herbert-crypto-2.6/master linus/master v6.17-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/T-Pratham/crypto-ti-Add-support-for-AES-XTS-in-DTHEv2-driver/20250905-214245
base: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link: https://lore.kernel.org/r/20250905133504.2348972-8-t-pratham%40ti.com
patch subject: [PATCH 4/4] crypto: ti: Add support for AES-CCM in DTHEv2 driver
config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250907/202509070251.7MfOWGUB-lkp@intel.com/config)
compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250907/202509070251.7MfOWGUB-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509070251.7MfOWGUB-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/crypto/ti/dthev2-aes.c:818:7: warning: variable 'unpadded_cryptlen' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
818 | if (!dst) {
| ^~~~
drivers/crypto/ti/dthev2-aes.c:962:6: note: uninitialized use occurs here
962 | if (unpadded_cryptlen % AES_BLOCK_SIZE)
| ^~~~~~~~~~~~~~~~~
drivers/crypto/ti/dthev2-aes.c:818:3: note: remove the 'if' if its condition is always false
818 | if (!dst) {
| ^~~~~~~~~~~
819 | ret = -ENOMEM;
| ~~~~~~~~~~~~~~
820 | goto aead_prep_dst_err;
| ~~~~~~~~~~~~~~~~~~~~~~~
821 | }
| ~
drivers/crypto/ti/dthev2-aes.c:779:32: note: initialize the variable 'unpadded_cryptlen' to silence this warning
779 | unsigned int unpadded_cryptlen;
| ^
| = 0
>> drivers/crypto/ti/dthev2-aes.c:995:49: warning: result of comparison of constant 2305843009213693951 with expression of type 'unsigned int' is always false [-Wtautological-constant-out-of-range-compare]
995 | (ctx->aes_mode == DTHE_AES_CCM && cryptlen > DTHE_AES_CCM_CRYPT_MAXLEN)) {
| ~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
vim +995 drivers/crypto/ti/dthev2-aes.c
973
974 static int dthe_aead_crypt(struct aead_request *req)
975 {
976 struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
977 struct dthe_aes_req_ctx *rctx = aead_request_ctx(req);
978 struct dthe_data *dev_data = dthe_get_dev(ctx);
979 struct crypto_engine *engine;
980 unsigned int cryptlen = req->cryptlen;
981
982 // In decryption, last authsize bytes are the TAG
983 if (!rctx->enc)
984 cryptlen -= ctx->authsize;
985
986 /* Need to fallback to software in the following cases due to HW restrictions:
987 * - Both AAD and plaintext/ciphertext are zero length
988 * - For AES-GCM, AAD length is more than 2^32 - 1 bytes
989 * - For AES-CCM, AAD length is more than 2^16 - 2^8 bytes
990 * - For AES-CCM, ciphertext length is more than 2^61 - 1 bytes
991 */
992 if ((req->assoclen == 0 && cryptlen == 0) ||
993 (ctx->aes_mode == DTHE_AES_GCM && req->assoclen > DTHE_AES_GCM_AAD_MAXLEN) ||
994 (ctx->aes_mode == DTHE_AES_CCM && req->assoclen > DTHE_AES_CCM_AAD_MAXLEN) ||
> 995 (ctx->aes_mode == DTHE_AES_CCM && cryptlen > DTHE_AES_CCM_CRYPT_MAXLEN)) {
996 struct aead_request *subreq = &rctx->fb_req;
997 int ret;
998
999 aead_request_set_tfm(subreq, ctx->aead_fb);
1000 aead_request_set_callback(subreq, req->base.flags,
1001 req->base.complete, req->base.data);
1002 aead_request_set_crypt(subreq, req->src, req->dst,
1003 req->cryptlen, req->iv);
1004 aead_request_set_ad(subreq, req->assoclen);
1005
1006 ret = rctx->enc ? crypto_aead_encrypt(subreq) :
1007 crypto_aead_decrypt(subreq);
1008
1009 return ret;
1010 }
1011
1012 engine = dev_data->engine;
1013 return crypto_transfer_aead_request_to_engine(engine, req);
1014 }
1015
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread