* [PATCH 7/7] crypto: doc - clarify AEAD memory structure
From: Stephan Mueller @ 2016-10-16 3:22 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto, linux-doc, Harsh Jain
In-Reply-To: <2721226.4nLlHD9uQ6@positron.chronox.de>
The previous description have been misleading and partially incorrect.
Reported-by: Harsh Jain <harshjain.prof@gmail.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
crypto/algif_aead.c | 14 ++------------
include/crypto/aead.h | 35 +++++++++++------------------------
2 files changed, 13 insertions(+), 36 deletions(-)
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 80a0f1a..a0d8377 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -551,18 +551,8 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
lock_sock(sk);
/*
- * AEAD memory structure: For encryption, the tag is appended to the
- * ciphertext which implies that the memory allocated for the ciphertext
- * must be increased by the tag length. For decryption, the tag
- * is expected to be concatenated to the ciphertext. The plaintext
- * therefore has a memory size of the ciphertext minus the tag length.
- *
- * The memory structure for cipher operation has the following
- * structure:
- * AEAD encryption input: assoc data || plaintext
- * AEAD encryption output: cipherntext || auth tag
- * AEAD decryption input: assoc data || ciphertext || auth tag
- * AEAD decryption output: plaintext
+ * Please see documentation of aead_request_set_crypt for the
+ * description of the AEAD memory structure expected from the caller.
*/
if (ctx->more) {
diff --git a/include/crypto/aead.h b/include/crypto/aead.h
index 1bd3a2f..b7f3373 100644
--- a/include/crypto/aead.h
+++ b/include/crypto/aead.h
@@ -483,30 +483,17 @@ static inline void aead_request_set_callback(struct aead_request *req,
* destination is the ciphertext. For a decryption operation, the use is
* reversed - the source is the ciphertext and the destination is the plaintext.
*
- * For both src/dst the layout is associated data, plain/cipher text,
- * authentication tag.
- *
- * The content of the AD in the destination buffer after processing
- * will either be untouched, or it will contain a copy of the AD
- * from the source buffer. In order to ensure that it always has
- * a copy of the AD, the user must copy the AD over either before
- * or after processing. Of course this is not relevant if the user
- * is doing in-place processing where src == dst.
- *
- * IMPORTANT NOTE AEAD requires an authentication tag (MAC). For decryption,
- * the caller must concatenate the ciphertext followed by the
- * authentication tag and provide the entire data stream to the
- * decryption operation (i.e. the data length used for the
- * initialization of the scatterlist and the data length for the
- * decryption operation is identical). For encryption, however,
- * the authentication tag is created while encrypting the data.
- * The destination buffer must hold sufficient space for the
- * ciphertext and the authentication tag while the encryption
- * invocation must only point to the plaintext data size. The
- * following code snippet illustrates the memory usage
- * buffer = kmalloc(ptbuflen + (enc ? authsize : 0));
- * sg_init_one(&sg, buffer, ptbuflen + (enc ? authsize : 0));
- * aead_request_set_crypt(req, &sg, &sg, ptbuflen, iv);
+ * The memory structure for cipher operation has the following structure:
+ * AEAD encryption input: assoc data || plaintext
+ * AEAD encryption output: assoc data || cipherntext || auth tag
+ * AEAD decryption input: assoc data || ciphertext || auth tag
+ * AEAD decryption output: assoc data || plaintext
+ *
+ * Albeit the kernel requires the presence of the AAD buffer, however,
+ * the kernel does not fill the AAD buffer in the output case. If the
+ * caller wants to have that data buffer filled, the caller must either
+ * use an in-place cipher operation (i.e. same memory location for
+ * input/output memory location).
*/
static inline void aead_request_set_crypt(struct aead_request *req,
struct scatterlist *src,
--
2.7.4
^ permalink raw reply related
* [PATCH 6/7] crypto: doc - remove crypto_alloc_ablkcipher
From: Stephan Mueller @ 2016-10-16 3:19 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto, linux-doc
In-Reply-To: <2721226.4nLlHD9uQ6@positron.chronox.de>
Remove the documentation reference to crypto_alloc_ablkcipher as the API
function call was removed.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
Documentation/crypto/api-skcipher.rst | 3 ---
1 file changed, 3 deletions(-)
diff --git a/Documentation/crypto/api-skcipher.rst b/Documentation/crypto/api-skcipher.rst
index eabd369..cd8830b 100644
--- a/Documentation/crypto/api-skcipher.rst
+++ b/Documentation/crypto/api-skcipher.rst
@@ -107,9 +107,6 @@ Asynchronous Block Cipher API - Deprecated
:doc: Asynchronous Block Cipher API
.. kernel-doc:: include/linux/crypto.h
- :functions: crypto_alloc_ablkcipher
-
-.. kernel-doc:: include/linux/crypto.h
:functions: crypto_free_ablkcipher
.. kernel-doc:: include/linux/crypto.h
--
2.7.4
^ permalink raw reply related
* [PATCH 5/7] crypto: doc - add KPP documentation
From: Stephan Mueller @ 2016-10-16 3:19 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto, linux-doc
In-Reply-To: <2721226.4nLlHD9uQ6@positron.chronox.de>
Add the KPP API documentation to the kernel crypto API Sphinx
documentation. This addition includes the documentation of the
ECDH and DH helpers which are needed to create the approrpiate input
data for the crypto_kpp_set_secret function.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
Documentation/crypto/api-kpp.rst | 92 +++++++++++++++++++++++++++++++++++
Documentation/crypto/api.rst | 1 +
Documentation/crypto/architecture.rst | 6 +++
include/crypto/dh.h | 58 ++++++++++++++++++++++
include/crypto/ecdh.h | 58 ++++++++++++++++++++++
include/crypto/kpp.h | 15 ++++--
6 files changed, 227 insertions(+), 3 deletions(-)
create mode 100644 Documentation/crypto/api-kpp.rst
diff --git a/Documentation/crypto/api-kpp.rst b/Documentation/crypto/api-kpp.rst
new file mode 100644
index 0000000..d87be92
--- /dev/null
+++ b/Documentation/crypto/api-kpp.rst
@@ -0,0 +1,92 @@
+Key-agreement Protocol Primitives (KPP) Cipher Algorithm Definitions
+--------------------------------------------------------------------
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_kpp
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_alg
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_secret
+
+Key-agreement Protocol Primitives (KPP) Cipher API
+--------------------------------------------------
+
+.. kernel-doc:: include/crypto/kpp.h
+ :doc: Generic Key-agreement Protocol Primitives API
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_alloc_kpp
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_free_kpp
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_kpp_set_secret
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_kpp_generate_public_key
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_kpp_compute_shared_secret
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: crypto_kpp_maxsize
+
+Key-agreement Protocol Primitives (KPP) Cipher Request Handle
+-------------------------------------------------------------
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request_alloc
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request_free
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request_set_callback
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request_set_input
+
+.. kernel-doc:: include/crypto/kpp.h
+ :functions: kpp_request_set_output
+
+ECDH Helper Functions
+---------------------
+
+.. kernel-doc:: include/crypto/ecdh.h
+ :doc: ECDH Helper Functions
+
+.. kernel-doc:: include/crypto/ecdh.h
+ :functions: ecdh
+
+.. kernel-doc:: include/crypto/ecdh.h
+ :functions: crypto_ecdh_key_len
+
+.. kernel-doc:: include/crypto/ecdh.h
+ :functions: crypto_ecdh_encode_key
+
+.. kernel-doc:: include/crypto/ecdh.h
+ :functions: crypto_ecdh_decode_key
+
+DH Helper Functions
+-------------------
+
+.. kernel-doc:: include/crypto/dh.h
+ :doc: DH Helper Functions
+
+.. kernel-doc:: include/crypto/dh.h
+ :functions: dh
+
+.. kernel-doc:: include/crypto/dh.h
+ :functions: crypto_dh_key_len
+
+.. kernel-doc:: include/crypto/dh.h
+ :functions: crypto_dh_encode_key
+
+.. kernel-doc:: include/crypto/dh.h
+ :functions: crypto_dh_decode_key
diff --git a/Documentation/crypto/api.rst b/Documentation/crypto/api.rst
index f2bbeb0..2e51919 100644
--- a/Documentation/crypto/api.rst
+++ b/Documentation/crypto/api.rst
@@ -22,3 +22,4 @@ the IV. Different IV generators are available.
api-digest
api-rng
api-akcipher
+ api-kpp
diff --git a/Documentation/crypto/architecture.rst b/Documentation/crypto/architecture.rst
index 34e396b..ca2d09b 100644
--- a/Documentation/crypto/architecture.rst
+++ b/Documentation/crypto/architecture.rst
@@ -161,6 +161,9 @@ applicable to a cipher, it is not displayed:
entry below for the specification of the IV generator type used by
the cipher implementation)
+ - kpp for a Key-agreement Protocol Primitive (KPP) cipher such as
+ an ECDH or DH implementation
+
- blocksize: blocksize of cipher in bytes
- keysize: key size in bytes
@@ -219,6 +222,9 @@ the aforementioned cipher types:
together with an IV generator (see geniv field in the /proc/crypto
listing for the known IV generators)
+- CRYPTO_ALG_TYPE_KPP Key-agreement Protocol Primitive (KPP) such as
+ an ECDH or DH implementation
+
- CRYPTO_ALG_TYPE_DIGEST Raw message digest
- CRYPTO_ALG_TYPE_HASH Alias for CRYPTO_ALG_TYPE_DIGEST
diff --git a/include/crypto/dh.h b/include/crypto/dh.h
index 5102a8f..6b424ad 100644
--- a/include/crypto/dh.h
+++ b/include/crypto/dh.h
@@ -13,6 +13,27 @@
#ifndef _CRYPTO_DH_
#define _CRYPTO_DH_
+/**
+ * DOC: DH Helper Functions
+ *
+ * To use DH with the KPP cipher API, the following data structure and
+ * functions should be used.
+ *
+ * To use DH with KPP, the following functions should be used to operate on
+ * a DH private key. The packet private key that can be set with
+ * the KPP API function call of crypto_kpp_set_secret.
+ */
+
+/**
+ * struct dh - define a DH private key
+ *
+ * @key: Private DH key
+ * @p: Diffie-Hellman parameter P
+ * @g: Diffie-Hellman generator G
+ * @key_size: Size of the private DH key
+ * @p_size: Size of DH parameter P
+ * @g_size: Size of DH generator G
+ */
struct dh {
void *key;
void *p;
@@ -22,8 +43,45 @@ struct dh {
unsigned int g_size;
};
+/**
+ * crypto_dh_key_len() - Obtain the size of the private DH key
+ * @params: private DH key
+ *
+ * This function returns the packet DH key size. A caller can use that
+ * with the provided DH private key reference to obtain the required
+ * memory size to hold a packet key.
+ *
+ * Return: size of the key in bytes
+ */
int crypto_dh_key_len(const struct dh *params);
+
+/**
+ * crypto_dh_encode_key() - encode the private key
+ * @buf: Buffer allocated by the caller to hold the packet DH
+ * private key. The buffer should be at least crypto_dh_key_len
+ * bytes in size.
+ * @len: Length of the packet private key buffer
+ * @params: Buffer with the caller-specified private key
+ *
+ * The DH implementations operate on a packet representation of the private
+ * key.
+ *
+ * Return: -EINVAL if buffer has insufficient size, 0 on success
+ */
int crypto_dh_encode_key(char *buf, unsigned int len, const struct dh *params);
+
+/**
+ * crypto_dh_decode_key() - decode a private key
+ * @buf: Buffer holding a packet key that should be decoded
+ * @len: Lenth of the packet private key buffer
+ * @params: Buffer allocated by the caller that is filled with the
+ * unpacket DH private key.
+ *
+ * The unpacking obtains the private key by pointing @p to the correct location
+ * in @buf. Thus, both pointers refer to the same memory.
+ *
+ * Return: -EINVAL if buffer has insufficient size, 0 on success
+ */
int crypto_dh_decode_key(const char *buf, unsigned int len, struct dh *params);
#endif
diff --git a/include/crypto/ecdh.h b/include/crypto/ecdh.h
index 84bad54..03a64f6 100644
--- a/include/crypto/ecdh.h
+++ b/include/crypto/ecdh.h
@@ -13,18 +13,76 @@
#ifndef _CRYPTO_ECDH_
#define _CRYPTO_ECDH_
+/**
+ * DOC: ECDH Helper Functions
+ *
+ * To use ECDH with the KPP cipher API, the following data structure and
+ * functions should be used.
+ *
+ * The ECC curves known to the ECDH implementation are specified in this
+ * header file.
+ *
+ * To use ECDH with KPP, the following functions should be used to operate on
+ * an ECDH private key. The packet private key that can be set with
+ * the KPP API function call of crypto_kpp_set_secret.
+ */
+
/* Curves IDs */
#define ECC_CURVE_NIST_P192 0x0001
#define ECC_CURVE_NIST_P256 0x0002
+/**
+ * struct ecdh - define an ECDH private key
+ *
+ * @curve_id: ECC curve the key is based on.
+ * @key: Private ECDH key
+ * @key_size: Size of the private ECDH key
+ */
struct ecdh {
unsigned short curve_id;
char *key;
unsigned short key_size;
};
+/**
+ * crypto_ecdh_key_len() - Obtain the size of the private ECDH key
+ * @params: private ECDH key
+ *
+ * This function returns the packet ECDH key size. A caller can use that
+ * with the provided ECDH private key reference to obtain the required
+ * memory size to hold a packet key.
+ *
+ * Return: size of the key in bytes
+ */
int crypto_ecdh_key_len(const struct ecdh *params);
+
+/**
+ * crypto_ecdh_encode_key() - encode the private key
+ * @buf: Buffer allocated by the caller to hold the packet ECDH
+ * private key. The buffer should be at least crypto_ecdh_key_len
+ * bytes in size.
+ * @len: Length of the packet private key buffer
+ * @p: Buffer with the caller-specified private key
+ *
+ * The ECDH implementations operate on a packet representation of the private
+ * key.
+ *
+ * Return: -EINVAL if buffer has insufficient size, 0 on success
+ */
int crypto_ecdh_encode_key(char *buf, unsigned int len, const struct ecdh *p);
+
+/**
+ * crypto_ecdh_decode_key() - decode a private key
+ * @buf: Buffer holding a packet key that should be decoded
+ * @len: Lenth of the packet private key buffer
+ * @p: Buffer allocated by the caller that is filled with the
+ * unpacket ECDH private key.
+ *
+ * The unpacking obtains the private key by pointing @p to the correct location
+ * in @buf. Thus, both pointers refer to the same memory.
+ *
+ * Return: -EINVAL if buffer has insufficient size, 0 on success
+ */
int crypto_ecdh_decode_key(const char *buf, unsigned int len, struct ecdh *p);
#endif
diff --git a/include/crypto/kpp.h b/include/crypto/kpp.h
index 30791f7..4307a2f 100644
--- a/include/crypto/kpp.h
+++ b/include/crypto/kpp.h
@@ -71,7 +71,7 @@ struct crypto_kpp {
*
* @reqsize: Request context size required by algorithm
* implementation
- * @base Common crypto API algorithm data structure
+ * @base: Common crypto API algorithm data structure
*/
struct kpp_alg {
int (*set_secret)(struct crypto_kpp *tfm, void *buffer,
@@ -89,7 +89,7 @@ struct kpp_alg {
};
/**
- * DOC: Generic Key-agreement Protocol Primitevs API
+ * DOC: Generic Key-agreement Protocol Primitives API
*
* The KPP API is used with the algorithm type
* CRYPTO_ALG_TYPE_KPP (listed as type "kpp" in /proc/crypto)
@@ -264,6 +264,12 @@ struct kpp_secret {
* Function invokes the specific kpp operation for a given alg.
*
* @tfm: tfm handle
+ * @buffer: Buffer holding the packet representation of the private
+ * key. The structure of the packet key depends on the particular
+ * KPP implementation. Packing and unpacking helpers are provided
+ * for ECDH and DH (see the respective header files for those
+ * implementations).
+ * @len: Length of the packet private key buffer.
*
* Return: zero on success; error code in case of error
*/
@@ -279,7 +285,10 @@ static inline int crypto_kpp_set_secret(struct crypto_kpp *tfm, void *buffer,
* crypto_kpp_generate_public_key() - Invoke kpp operation
*
* Function invokes the specific kpp operation for generating the public part
- * for a given kpp algorithm
+ * for a given kpp algorithm.
+ *
+ * To generate a private key, the caller should use a random number generator.
+ * The output of the requested length serves as the private key.
*
* @req: kpp key request
*
--
2.7.4
^ permalink raw reply related
* [PATCH 4/7] crypto: doc - fix separation of cipher / req API
From: Stephan Mueller @ 2016-10-16 3:18 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto, linux-doc
In-Reply-To: <2721226.4nLlHD9uQ6@positron.chronox.de>
Keep the cipher API and the request API function documentation in
separate sections.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
Documentation/crypto/api-akcipher.rst | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/Documentation/crypto/api-akcipher.rst b/Documentation/crypto/api-akcipher.rst
index 305e616..0d5899f 100644
--- a/Documentation/crypto/api-akcipher.rst
+++ b/Documentation/crypto/api-akcipher.rst
@@ -25,32 +25,32 @@ Asymmetric Cipher API
.. kernel-doc:: include/crypto/akcipher.h
:functions: crypto_akcipher_set_priv_key
-Asymmetric Cipher Request Handle
---------------------------------
-
.. kernel-doc:: include/crypto/akcipher.h
- :functions: akcipher_request_alloc
+ :functions: crypto_akcipher_maxsize
.. kernel-doc:: include/crypto/akcipher.h
- :functions: akcipher_request_free
+ :functions: crypto_akcipher_encrypt
.. kernel-doc:: include/crypto/akcipher.h
- :functions: akcipher_request_set_callback
+ :functions: crypto_akcipher_decrypt
.. kernel-doc:: include/crypto/akcipher.h
- :functions: akcipher_request_set_crypt
+ :functions: crypto_akcipher_sign
.. kernel-doc:: include/crypto/akcipher.h
- :functions: crypto_akcipher_maxsize
+ :functions: crypto_akcipher_verify
+
+Asymmetric Cipher Request Handle
+--------------------------------
.. kernel-doc:: include/crypto/akcipher.h
- :functions: crypto_akcipher_encrypt
+ :functions: akcipher_request_alloc
.. kernel-doc:: include/crypto/akcipher.h
- :functions: crypto_akcipher_decrypt
+ :functions: akcipher_request_free
.. kernel-doc:: include/crypto/akcipher.h
- :functions: crypto_akcipher_sign
+ :functions: akcipher_request_set_callback
.. kernel-doc:: include/crypto/akcipher.h
- :functions: crypto_akcipher_verify
+ :functions: akcipher_request_set_crypt
--
2.7.4
^ permalink raw reply related
* [PATCH 3/7] crypto: doc - fix source comments for Sphinx
From: Stephan Mueller @ 2016-10-16 3:18 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto, linux-doc
In-Reply-To: <2721226.4nLlHD9uQ6@positron.chronox.de>
Update comments to avoid any complaints from Sphinx during compilation.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
include/crypto/aead.h | 14 +++++++-------
include/crypto/hash.h | 2 +-
include/crypto/skcipher.h | 4 ++--
include/linux/crypto.h | 4 ++--
4 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/include/crypto/aead.h b/include/crypto/aead.h
index 12f8432..1bd3a2f 100644
--- a/include/crypto/aead.h
+++ b/include/crypto/aead.h
@@ -55,14 +55,14 @@
* The scatter list pointing to the input data must contain:
*
* * for RFC4106 ciphers, the concatenation of
- * associated authentication data || IV || plaintext or ciphertext. Note, the
- * same IV (buffer) is also set with the aead_request_set_crypt call. Note,
- * the API call of aead_request_set_ad must provide the length of the AAD and
- * the IV. The API call of aead_request_set_crypt only points to the size of
- * the input plaintext or ciphertext.
+ * associated authentication data || IV || plaintext or ciphertext. Note, the
+ * same IV (buffer) is also set with the aead_request_set_crypt call. Note,
+ * the API call of aead_request_set_ad must provide the length of the AAD and
+ * the IV. The API call of aead_request_set_crypt only points to the size of
+ * the input plaintext or ciphertext.
*
* * for "normal" AEAD ciphers, the concatenation of
- * associated authentication data || plaintext or ciphertext.
+ * associated authentication data || plaintext or ciphertext.
*
* It is important to note that if multiple scatter gather list entries form
* the input data mentioned above, the first entry must not point to a NULL
@@ -454,7 +454,7 @@ static inline void aead_request_free(struct aead_request *req)
* The callback function is registered with the aead_request handle and
* must comply with the following template
*
- * void callback_function(struct crypto_async_request *req, int error)
+ * void callback_function(struct crypto_async_request \*req, int error)
*/
static inline void aead_request_set_callback(struct aead_request *req,
u32 flags,
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index 2660588..23f15d0 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -607,7 +607,7 @@ static inline struct ahash_request *ahash_request_cast(
* The callback function is registered with the &ahash_request handle and
* must comply with the following template
*
- * void callback_function(struct crypto_async_request *req, int error)
+ * void callback_function(struct crypto_async_request \*req, int error)
*/
static inline void ahash_request_set_callback(struct ahash_request *req,
u32 flags,
diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h
index cc4d98a..78a1de0 100644
--- a/include/crypto/skcipher.h
+++ b/include/crypto/skcipher.h
@@ -516,7 +516,7 @@ static inline void skcipher_request_zero(struct skcipher_request *req)
* skcipher_request_set_callback() - set asynchronous callback function
* @req: request handle
* @flags: specify zero or an ORing of the flags
- * CRYPTO_TFM_REQ_MAY_BACKLOG the request queue may back log and
+ * CRYPTO_TFM_REQ_MAY_BACKLOG the request queue may back log and
* increase the wait queue beyond the initial maximum size;
* CRYPTO_TFM_REQ_MAY_SLEEP the request processing may sleep
* @compl: callback function pointer to be registered with the request handle
@@ -535,7 +535,7 @@ static inline void skcipher_request_zero(struct skcipher_request *req)
* The callback function is registered with the skcipher_request handle and
* must comply with the following template
*
- * void callback_function(struct crypto_async_request *req, int error)
+ * void callback_function(struct crypto_async_request \*req, int error)
*/
static inline void skcipher_request_set_callback(struct skcipher_request *req,
u32 flags,
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 7cee555..615a326 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -960,7 +960,7 @@ static inline void ablkcipher_request_free(struct ablkcipher_request *req)
* ablkcipher_request_set_callback() - set asynchronous callback function
* @req: request handle
* @flags: specify zero or an ORing of the flags
- * CRYPTO_TFM_REQ_MAY_BACKLOG the request queue may back log and
+ * CRYPTO_TFM_REQ_MAY_BACKLOG the request queue may back log and
* increase the wait queue beyond the initial maximum size;
* CRYPTO_TFM_REQ_MAY_SLEEP the request processing may sleep
* @compl: callback function pointer to be registered with the request handle
@@ -979,7 +979,7 @@ static inline void ablkcipher_request_free(struct ablkcipher_request *req)
* The callback function is registered with the ablkcipher_request handle and
* must comply with the following template
*
- * void callback_function(struct crypto_async_request *req, int error)
+ * void callback_function(struct crypto_async_request \*req, int error)
*/
static inline void ablkcipher_request_set_callback(
struct ablkcipher_request *req,
--
2.7.4
^ permalink raw reply related
* virtio-rng scatterlist null pointer dereference with VMAP_STACK=y
From: Matt Mullins @ 2016-10-16 0:21 UTC (permalink / raw)
To: linux-kernel
Cc: Andy Lutomirski, linux-crypto, Matt Mackall, Herbert Xu,
Rusty Russell, Jens Axboe, Dave Gordon
With VMAP_STACK=y and HW_RANDOM_VIRTIO=y, I get the following crash:
[ 1.470437] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 1.473350] IP: [<ffffffff812f7c35>] sg_init_one+0x65/0x90
[ 1.474658] PGD 0
[ 1.475169] Oops: 0000 [#1] SMP
Entering kdb (current=0xffff880069b0c980, pid 1) on processor 1 Oops: (null)
due to oops @ 0xffffffff812f7c35
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.8.0-08682-g41844e3 #246
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069b0c980 task.stack: ffffc90000c54000
RIP: 0010:[<ffffffff812f7c35>] [<ffffffff812f7c35>] sg_init_one+0x65/0x90
RSP: 0000:ffffc90000c57d00 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffc90000c57d20 RCX: 0000000000082000
RDX: 0000000000000d68 RSI: 0000000410000c57 RDI: ffffc90000c57d40
RBP: 0000000000000820 R08: 0000000000000000 R09: ffffc90000c57d20
R10: 0000000000019228 R11: ffff88017fff8500 R12: 0000000000000010
R13: 0000000000000010 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000001806000 CR4: 00000000001406a0
Stack:
ffff8800694bf500 0000000000000001 ffffc90000c57d68 ffffffff8138286f
0000000000000002 0000000000000000 0000000000000000 0000000000000000
ffff8800694bf500 ffffc90000c57d68 ffff8800694bf500 0000000000000000
Call Trace:
[<ffffffff8138286f>] ? virtio_read+0x9f/0xe0
[<ffffffff81381ade>] ? add_early_randomness+0x3e/0xa0
[<ffffffff813820af>] ? set_current_rng+0x3f/0x160
[<ffffffff81382416>] ? hwrng_register+0x186/0x1d0
[<ffffffff81382620>] ? virtrng_scan+0x10/0x20
[<ffffffff8135790e>] ? virtio_dev_probe+0x21e/0x2b0
[<ffffffff8138789e>] ? really_probe+0x14e/0x250
[<ffffffff81387a22>] ? __driver_attach+0x82/0xa0
[<ffffffff813879a0>] ? really_probe+0x250/0x250
[<ffffffff81385d22>] ? bus_for_each_dev+0x52/0x80
[<ffffffff81387093>] ? bus_add_driver+0x1a3/0x220
[<ffffffff818b0634>] ? hwrng_modinit+0xc/0xc
[<ffffffff81388046>] ? driver_register+0x56/0xd0
[<ffffffff818b0634>] ? hwrng_modinit+0xc/0xc
[<ffffffff810003c2>] ? do_one_initcall+0x32/0x150
[<ffffffff81095900>] ? parse_args+0x170/0x390
[<ffffffff8188a188>] ? kernel_init_freeable+0x11e/0x1a3
[<ffffffff818898f4>] ? set_debug_rodata+0xc/0xc
[<ffffffff8157d930>] ? rest_init+0x70/0x70
[<ffffffff8157d935>] ? kernel_init+0x5/0x100
[<ffffffff81582625>] ? ret_from_fork+0x25/0x30
Code: 01 c5 48 89 ee 48 89 e9 48 c1 ed 23 48 8b 04 ed c0 49 9c 81 48 c1 ee 0c
48 c1 e9 1b 48 85 c0 74 0a 0f b6 c9 48 c1 e1 04 48 01 c8 <48> 8b 08 48 89 f0 89
53 08 48 c1 e0 06 44 89 63 0c 48 83 e1 fc
It looks like add_early_randomness() uses a buffer on the stack, which (with
VMAP_STACK) fails to be added to a scatterlist due to use of virt_to_page in
sg_set_buf().
None of this looks obviously wrong to me, but in combination it is not
functional. Hence, I don't have a particular fix in mind, and I've CC'ed folks
from both the hw_random and scatterlist history.
^ permalink raw reply
* Re: SPHINX: no structured comments
From: Stephan Mueller @ 2016-10-15 22:12 UTC (permalink / raw)
To: Markus Heiser; +Cc: linux-doc, linux-crypto
In-Reply-To: <D10CA7D8-CE8A-4C32-BDA8-1641D166649C@darmarit.de>
Am Samstag, 15. Oktober 2016, 18:12:36 CEST schrieb Markus Heiser:
Hi Markus,
> I suppose you have a typo in one of your kernel-doc
> directives. E.g.::
>
> .. kernel-doc:: include/linux/crypto.h
>
> :functions: fooTypo
>
> will produce those error messages:
>
> $ ./scripts/kernel-doc -function fooTypo -rst ./include/linux/crypto.h
> ./include/linux/crypto.h:1: warning: no structured comments found
>
> hope that helps.
Thanks for the hint. The issue was a removed API call.
...
>
> The next hint might be a bit to late for you, but there is a
> *automatic* DocBook to reST migration of the crypto API:
>
> https://github.com/return42/sphkerneldoc/tree/master/doc/Documentation/book
> s_migrated/crypto-API
Thanks for the hint. You are right, it is a bit late, but the DocBook to
Sphinx converter helped me.
With Sphinx now, I also split up the document into more manageable chunks and
fixed some small issues.
Thanks for your help.
Ciao
Stephan
^ permalink raw reply
* Re: SPHINX: no structured comments
From: Markus Heiser @ 2016-10-15 16:12 UTC (permalink / raw)
To: Stephan Mueller; +Cc: linux-doc, linux-crypto
In-Reply-To: <1730886.FCUxIFiraa@positron.chronox.de>
Am 15.10.2016 um 17:05 schrieb Stephan Mueller <smueller@chronox.de>:
> Hi,
>
> I am converting the kernel crypto API DocBook into Sphinx. The conversion is
> complete, but I am having difficulties finding the cause for the following
> notification obtained during the Sphinx compilation:
>
> ./include/linux/crypto.h:1: warning: no structured comments found
>
> I am unsure what is wrong in line 1 of the mentioned header.
>
> Thanks a lot
> Stephan
Hi Stephan,
I suppose you have a typo in one of your kernel-doc
directives. E.g.::
.. kernel-doc:: include/linux/crypto.h
:functions: fooTypo
will produce those error messages:
$ ./scripts/kernel-doc -function fooTypo -rst ./include/linux/crypto.h
./include/linux/crypto.h:1: warning: no structured comments found
hope that helps.
FYI:
IMO the kernel-doc parser in the kernel sources is lazy. In my
linuxdoc project you will find a more enthusiastic one with a
lint command.
https://return42.github.io/linuxdoc
Even if this kernel-doc parser is not (yet) a part of the kernel
source tree, the kernel-lintdoc command might be helpful
finding (more) issues
https://return42.github.io/linuxdoc/cmd-line.html#kernel-lintdoc
The installation is quite simple:
pip install git+http://github.com/return42/linuxdoc.git
The next hint might be a bit to late for you, but there is a
*automatic* DocBook to reST migration of the crypto API:
https://github.com/return42/sphkerneldoc/tree/master/doc/Documentation/books_migrated/crypto-API
This migration is done with the my dbxm2rst project:
https://return42.github.io/dbxml2rst/
If you need more help or want to migrate more DocBook
documentation to reST ... don't hesitate to contact me
(on the ML or directly / de-de ;-)
-- Markus --
^ permalink raw reply
* SPHINX: no structured comments
From: Stephan Mueller @ 2016-10-15 15:05 UTC (permalink / raw)
To: linux-doc; +Cc: linux-crypto
Hi,
I am converting the kernel crypto API DocBook into Sphinx. The conversion is
complete, but I am having difficulties finding the cause for the following
notification obtained during the Sphinx compilation:
./include/linux/crypto.h:1: warning: no structured comments found
I am unsure what is wrong in line 1 of the mentioned header.
Thanks a lot
Stephan
^ permalink raw reply
* [PATCH] crypto: Move RSA+MPI constructs into an #include file
From: Gary R Hook @ 2016-10-14 19:36 UTC (permalink / raw)
To: linux-crypto; +Cc: thomas.lendacky, herbert, davem
Move RSA support of general use into internal/rsa.h.
This allows reuse of, e.g. RSA MPI keys and support
functions.
Signed-off-by: Gary R Hook <gary.hook@amd.com>
---
crypto/rsa.c | 16 ----------------
include/crypto/internal/rsa.h | 17 +++++++++++++++++
2 files changed, 17 insertions(+), 16 deletions(-)
diff --git a/crypto/rsa.c b/crypto/rsa.c
index 4c280b6..15e9220 100644
--- a/crypto/rsa.c
+++ b/crypto/rsa.c
@@ -16,12 +16,6 @@
#include <crypto/akcipher.h>
#include <crypto/algapi.h>
-struct rsa_mpi_key {
- MPI n;
- MPI e;
- MPI d;
-};
-
/*
* RSAEP function [RFC3447 sec 5.1.1]
* c = m^e mod n;
@@ -240,16 +234,6 @@ err_free_m:
return ret;
}
-static void rsa_free_mpi_key(struct rsa_mpi_key *key)
-{
- mpi_free(key->d);
- mpi_free(key->e);
- mpi_free(key->n);
- key->d = NULL;
- key->e = NULL;
- key->n = NULL;
-}
-
static int rsa_check_key_length(unsigned int len)
{
switch (len) {
diff --git a/include/crypto/internal/rsa.h b/include/crypto/internal/rsa.h
index 9e8f159..253b275 100644
--- a/include/crypto/internal/rsa.h
+++ b/include/crypto/internal/rsa.h
@@ -13,6 +13,7 @@
#ifndef _RSA_HELPER_
#define _RSA_HELPER_
#include <linux/types.h>
+#include <linux/mpi.h>
/**
* rsa_key - RSA key structure
@@ -52,6 +53,22 @@ struct rsa_key {
size_t qinv_sz;
};
+struct rsa_mpi_key {
+ MPI n;
+ MPI e;
+ MPI d;
+};
+
+static inline void rsa_free_mpi_key(struct rsa_mpi_key *key)
+{
+ mpi_free(key->d);
+ mpi_free(key->e);
+ mpi_free(key->n);
+ key->d = NULL;
+ key->e = NULL;
+ key->n = NULL;
+}
+
int rsa_parse_pub_key(struct rsa_key *rsa_key, const void *key,
unsigned int key_len);
^ permalink raw reply related
* Re: [PATCH 6/6] Add support for AEAD algos.
From: Stephan Mueller @ 2016-10-14 14:24 UTC (permalink / raw)
To: Harsh Jain
Cc: dan.carpenter, herbert, linux-crypto, jlulla, atul.gupta,
yeshaswi, hariprasad
In-Reply-To: <6a957e083297221dc2810a3efd17f936dad2475e.1476263960.git.harsh@chelsio.com>
Am Donnerstag, 13. Oktober 2016, 16:39:39 CEST schrieb Harsh Jain:
Hi Harsh,
> Add support for following AEAD algos.
> GCM,CCM,RFC4106,RFC4309,authenc(hmac(shaXXX),cbc(aes)).
>
> Signed-off-by: Harsh Jain <harsh@chelsio.com>
> ---
> drivers/crypto/chelsio/Kconfig | 1 +
> drivers/crypto/chelsio/chcr_algo.c | 1466
> +++++++++++++++++++++++++++++++++- drivers/crypto/chelsio/chcr_algo.h |
> 16 +-
> drivers/crypto/chelsio/chcr_core.c | 8 +-
> drivers/crypto/chelsio/chcr_core.h | 2 -
> drivers/crypto/chelsio/chcr_crypto.h | 90 ++-
> 6 files changed, 1541 insertions(+), 42 deletions(-)
>
> diff --git a/drivers/crypto/chelsio/Kconfig b/drivers/crypto/chelsio/Kconfig
> index 4ce67fb..3e104f5 100644
> --- a/drivers/crypto/chelsio/Kconfig
> +++ b/drivers/crypto/chelsio/Kconfig
> @@ -4,6 +4,7 @@ config CRYPTO_DEV_CHELSIO
> select CRYPTO_SHA1
> select CRYPTO_SHA256
> select CRYPTO_SHA512
> + select CRYPTO_AUTHENC
> ---help---
> The Chelsio Crypto Co-processor driver for T6 adapters.
>
> diff --git a/drivers/crypto/chelsio/chcr_algo.c
> b/drivers/crypto/chelsio/chcr_algo.c index 18385d6..cffc38f 100644
> --- a/drivers/crypto/chelsio/chcr_algo.c
> +++ b/drivers/crypto/chelsio/chcr_algo.c
> @@ -54,6 +54,12 @@
> #include <crypto/algapi.h>
> #include <crypto/hash.h>
> #include <crypto/sha.h>
> +#include <crypto/authenc.h>
> +#include <crypto/internal/aead.h>
> +#include <crypto/null.h>
> +#include <crypto/internal/skcipher.h>
> +#include <crypto/aead.h>
> +#include <crypto/scatterwalk.h>
> #include <crypto/internal/hash.h>
>
> #include "t4fw_api.h"
> @@ -62,6 +68,11 @@
> #include "chcr_algo.h"
> #include "chcr_crypto.h"
>
> +static inline struct chcr_aead_ctx *AEAD_CTX(struct chcr_context *ctx)
> +{
> + return ctx->crypto_ctx->aeadctx;
> +}
> +
> static inline struct ablk_ctx *ABLK_CTX(struct chcr_context *ctx)
> {
> return ctx->crypto_ctx->ablkctx;
> @@ -72,6 +83,16 @@ static inline struct hmac_ctx *HMAC_CTX(struct
> chcr_context *ctx) return ctx->crypto_ctx->hmacctx;
> }
>
> +static inline struct chcr_gcm_ctx *GCM_CTX(struct chcr_aead_ctx *gctx)
> +{
> + return gctx->ctx->gcm;
> +}
> +
> +static inline struct chcr_authenc_ctx *AUTHENC_CTX(struct chcr_aead_ctx
> *gctx) +{
> + return gctx->ctx->authenc;
> +}
> +
> static inline struct uld_ctx *ULD_CTX(struct chcr_context *ctx)
> {
> return ctx->dev->u_ctx;
> @@ -94,12 +115,37 @@ static inline unsigned int sgl_len(unsigned int n)
> return (3 * n) / 2 + (n & 1) + 2;
> }
>
> +static void chcr_verify_tag(struct aead_request *req, u8 *input, int *err)
> +{
> + u8 temp[SHA512_DIGEST_SIZE];
> + struct crypto_aead *tfm = crypto_aead_reqtfm(req);
> + int authsize = crypto_aead_authsize(tfm);
> + struct cpl_fw6_pld *fw6_pld;
> + int cmp = 0;
> +
> + fw6_pld = (struct cpl_fw6_pld *)input;
> + if ((get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106) ||
> + (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_GCM)) {
> + cmp = memcmp(&fw6_pld->data[2], (fw6_pld + 1), authsize);
> + } else {
> +
> + sg_pcopy_to_buffer(req->src, sg_nents(req->src), temp,
> + authsize, req->assoclen +
> + req->cryptlen - authsize);
I am wondering whether the math is correct here in any case. It is permissible
that we have an AAD size of 0 and even a zero-sized ciphertext. How is such
scenario covered here?
> + cmp = memcmp(temp, (fw6_pld + 1), authsize);
I would guess in both cases memcmp should be replaced with crypto_memneq
> + }
> + if (cmp)
> + *err = -EBADMSG;
> + else
> + *err = 0;
What do you think about memzero_explicit(tmp)?
> +}
> +
> /*
> * chcr_handle_resp - Unmap the DMA buffers associated with the request
> * @req: crypto request
> */
> int chcr_handle_resp(struct crypto_async_request *req, unsigned char
> *input, - int error_status)
> + int err)
> {
> struct crypto_tfm *tfm = req->tfm;
> struct chcr_context *ctx = crypto_tfm_ctx(tfm);
> @@ -109,11 +155,27 @@ int chcr_handle_resp(struct crypto_async_request *req,
> unsigned char *input, unsigned int digestsize, updated_digestsize;
>
> switch (tfm->__crt_alg->cra_flags & CRYPTO_ALG_TYPE_MASK) {
> + case CRYPTO_ALG_TYPE_AEAD:
> + ctx_req.req.aead_req = (struct aead_request *)req;
> + ctx_req.ctx.reqctx = aead_request_ctx(ctx_req.req.aead_req);
> + dma_unmap_sg(&u_ctx->lldi.pdev->dev, ctx_req.req.aead_req->dst,
> + ctx_req.ctx.reqctx->dst_nents, DMA_FROM_DEVICE);
> + if (ctx_req.ctx.reqctx->skb) {
> + kfree_skb(ctx_req.ctx.reqctx->skb);
> + ctx_req.ctx.reqctx->skb = NULL;
> + }
> + if (ctx_req.ctx.reqctx->verify == VERIFY_SW) {
> + chcr_verify_tag(ctx_req.req.aead_req, input,
> + &err);
> + ctx_req.ctx.reqctx->verify = VERIFY_HW;
> + }
> + break;
> +
> case CRYPTO_ALG_TYPE_BLKCIPHER:
> ctx_req.req.ablk_req = (struct ablkcipher_request *)req;
> ctx_req.ctx.ablk_ctx =
> ablkcipher_request_ctx(ctx_req.req.ablk_req);
> - if (!error_status) {
> + if (!err) {
> fw6_pld = (struct cpl_fw6_pld *)input;
> memcpy(ctx_req.req.ablk_req->info, &fw6_pld->data[2],
> AES_BLOCK_SIZE);
> @@ -154,7 +216,7 @@ int chcr_handle_resp(struct crypto_async_request *req,
> unsigned char *input, }
> break;
> }
> - return 0;
> + return err;
> }
>
> /*
> @@ -380,6 +442,14 @@ static inline int map_writesg_phys_cpl(struct device
> *dev, return 0;
> }
>
> +static inline int get_aead_subtype(struct crypto_aead *aead)
> +{
> + struct aead_alg *alg = crypto_aead_alg(aead);
> + struct chcr_alg_template *chcr_crypto_alg =
> + container_of(alg, struct chcr_alg_template, alg.aead);
> + return chcr_crypto_alg->type & CRYPTO_ALG_SUB_TYPE_MASK;
> +}
> +
> static inline int get_cryptoalg_subtype(struct crypto_tfm *tfm)
> {
> struct crypto_alg *alg = tfm->__crt_alg;
> @@ -447,7 +517,8 @@ static inline void create_wreq(struct chcr_context *ctx,
> struct chcr_wr *chcr_req,
> void *req, struct sk_buff *skb,
> int kctx_len, int hash_sz,
> - unsigned int phys_dsgl)
> + int is_iv,
> + unsigned int sc_len)
> {
> struct uld_ctx *u_ctx = ULD_CTX(ctx);
> int iv_loc = IV_DSGL;
> @@ -472,7 +543,7 @@ static inline void create_wreq(struct chcr_context *ctx,
> chcr_req->wreq.cookie = cpu_to_be64((uintptr_t)req);
> chcr_req->wreq.rx_chid_to_rx_q_id =
> FILL_WR_RX_Q_ID(ctx->dev->tx_channel_id, qid,
> - (hash_sz) ? IV_NOP : iv_loc);
> + is_iv ? iv_loc : IV_NOP);
>
> chcr_req->ulptx.cmd_dest = FILL_ULPTX_CMD_DEST(ctx->dev->tx_channel_id);
> chcr_req->ulptx.len = htonl((DIV_ROUND_UP((calc_tx_flits_ofld(skb) * 8),
> @@ -481,10 +552,7 @@ static inline void create_wreq(struct chcr_context
> *ctx, chcr_req->sc_imm.cmd_more = FILL_CMD_MORE(immdatalen);
> chcr_req->sc_imm.len = cpu_to_be32(sizeof(struct cpl_tx_sec_pdu) +
> sizeof(chcr_req->key_ctx) +
> - kctx_len +
> - ((hash_sz) ? DUMMY_BYTES :
> - (sizeof(struct cpl_rx_phys_dsgl) +
> - phys_dsgl)) + immdatalen);
> + kctx_len + sc_len + immdatalen);
> }
>
> /**
> @@ -582,7 +650,8 @@ static struct sk_buff
> memcpy(reqctx->iv, req->info, ivsize);
> write_buffer_to_skb(skb, &frags, reqctx->iv, ivsize);
> write_sg_to_skb(skb, &frags, req->src, req->nbytes);
> - create_wreq(ctx, chcr_req, req, skb, kctx_len, 0, phys_dsgl);
> + create_wreq(ctx, chcr_req, req, skb, kctx_len, 0, 1,
> + sizeof(struct cpl_rx_phys_dsgl) + phys_dsgl);
> reqctx->skb = skb;
> skb_get(skb);
> return skb;
> @@ -706,11 +775,11 @@ static int chcr_device_init(struct chcr_context *ctx)
> }
> u_ctx = ULD_CTX(ctx);
> rxq_perchan = u_ctx->lldi.nrxq / u_ctx->lldi.nchan;
> - ctx->dev->tx_channel_id = 0;
> rxq_idx = ctx->dev->tx_channel_id * rxq_perchan;
> rxq_idx += id % rxq_perchan;
> spin_lock(&ctx->dev->lock_chcr_dev);
> ctx->tx_channel_id = rxq_idx;
> + ctx->dev->tx_channel_id = !ctx->dev->tx_channel_id;
> spin_unlock(&ctx->dev->lock_chcr_dev);
> }
> out:
> @@ -769,7 +838,7 @@ static inline void chcr_free_shash(struct crypto_shash
> *base_hash) * @req - Cipher req base
> */
> static struct sk_buff *create_hash_wr(struct ahash_request *req,
> - struct hash_wr_param *param)
> + struct hash_wr_param *param)
> {
> struct chcr_ahash_req_ctx *req_ctx = ahash_request_ctx(req);
> struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
> @@ -840,8 +909,8 @@ static struct sk_buff *create_hash_wr(struct
> ahash_request *req, if (param->sg_len != 0)
> write_sg_to_skb(skb, &frags, req->src, param->sg_len);
>
> - create_wreq(ctx, chcr_req, req, skb, kctx_len, hash_size_in_response,
> - 0);
> + create_wreq(ctx, chcr_req, req, skb, kctx_len, hash_size_in_response, 0,
> + DUMMY_BYTES);
> req_ctx->skb = skb;
> skb_get(skb);
> return skb;
> @@ -1249,6 +1318,1149 @@ static void chcr_hmac_cra_exit(struct crypto_tfm
> *tfm) }
> }
>
> +static int chcr_copy_assoc(struct aead_request *req,
> + struct chcr_aead_ctx *ctx)
> +{
> + SKCIPHER_REQUEST_ON_STACK(skreq, ctx->null);
> +
> + skcipher_request_set_tfm(skreq, ctx->null);
> + skcipher_request_set_callback(skreq, aead_request_flags(req),
> + NULL, NULL);
> + skcipher_request_set_crypt(skreq, req->src, req->dst, req->assoclen,
> + NULL);
> +
> + return crypto_skcipher_encrypt(skreq);
> +}
> +
> +static unsigned char get_hmac(unsigned int authsize)
> +{
> + switch (authsize) {
> + case ICV_8:
> + return CHCR_SCMD_HMAC_CTRL_PL1;
> + case ICV_10:
> + return CHCR_SCMD_HMAC_CTRL_TRUNC_RFC4366;
> + case ICV_12:
> + return CHCR_SCMD_HMAC_CTRL_IPSEC_96BIT;
> + }
> + return CHCR_SCMD_HMAC_CTRL_NO_TRUNC;
> +}
> +
> +
> +static struct sk_buff *create_authenc_wr(struct aead_request *req,
> + unsigned short qid,
> + int size,
> + unsigned short op_type)
> +{
> + struct crypto_aead *tfm = crypto_aead_reqtfm(req);
> + struct chcr_context *ctx = crypto_aead_ctx(tfm);
> + struct uld_ctx *u_ctx = ULD_CTX(ctx);
> + struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx);
> + struct chcr_authenc_ctx *actx = AUTHENC_CTX(aeadctx);
> + struct chcr_aead_reqctx *reqctx = aead_request_ctx(req);
> + struct sk_buff *skb = NULL;
> + struct chcr_wr *chcr_req;
> + struct cpl_rx_phys_dsgl *phys_cpl;
> + struct phys_sge_parm sg_param;
> + struct scatterlist *src, *dst;
> + struct scatterlist src_sg[2], dst_sg[2];
> + unsigned int frags = 0, transhdr_len;
> + unsigned int ivsize = crypto_aead_ivsize(tfm), dst_size = 0;
> + unsigned int kctx_len = 0;
> + unsigned short stop_offset = 0;
> + unsigned int assoclen = req->assoclen;
> + unsigned int authsize = crypto_aead_authsize(tfm);
> + int err = 0;
> + int null = 0;
> + gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL :
> + GFP_ATOMIC;
> +
> + if (aeadctx->enckey_len == 0 || (req->cryptlen <= 0))
> + goto err;
> + src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
> + dst = src;
> + if (req->src != req->dst) {
> + err = chcr_copy_assoc(req, aeadctx);
> + if (err)
> + return ERR_PTR(err);
> + dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
> + }
> + if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_NULL) {
> + null = 1;
> + assoclen = 0;
> + }
> + reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
> + (op_type ? -authsize : authsize));
> + if (reqctx->dst_nents <= 0) {
> + pr_err("AUTHENC:Invalid Destination sg entries\n");
> + goto err;
> + }
> + dst_size = get_space_for_phys_dsgl(reqctx->dst_nents);
> + kctx_len = (ntohl(KEY_CONTEXT_CTX_LEN_V(aeadctx->key_ctx_hdr)) << 4)
> + - sizeof(chcr_req->key_ctx);
> + transhdr_len = CIPHER_TRANSHDR_SIZE(kctx_len, dst_size);
> + skb = alloc_skb((transhdr_len + sizeof(struct sge_opaque_hdr)), flags);
> + if (!skb)
> + goto err;
> +
> + /* LLD is going to write the sge hdr. */
> + skb_reserve(skb, sizeof(struct sge_opaque_hdr));
> +
> + /* Write WR */
> + chcr_req = (struct chcr_wr *) __skb_put(skb, transhdr_len);
> + memset(chcr_req, 0, transhdr_len);
> +
> + stop_offset = (op_type == CHCR_ENCRYPT_OP) ? 0 : authsize;
> +
> + /*
> + * Input order is AAD,IV and Payload. where IV should be included as
> + * the part of authdata. All other fields should be filled according
> + * to the hardware spec
> + */
> + chcr_req->sec_cpl.op_ivinsrtofst =
> + FILL_SEC_CPL_OP_IVINSR(ctx->dev->tx_channel_id, 2,
> + (ivsize ? (assoclen + 1) : 0));
> + chcr_req->sec_cpl.pldlen = htonl(assoclen + ivsize + req->cryptlen);
> + chcr_req->sec_cpl.aadstart_cipherstop_hi = FILL_SEC_CPL_CIPHERSTOP_HI(
> + assoclen ? 1 : 0, assoclen,
> + assoclen + ivsize + 1,
> + (stop_offset & 0x1F0) >> 4);
> + chcr_req->sec_cpl.cipherstop_lo_authinsert = FILL_SEC_CPL_AUTHINSERT(
> + stop_offset & 0xF,
> + null ? 0 : assoclen + ivsize + 1,
> + stop_offset, stop_offset);
> + chcr_req->sec_cpl.seqno_numivs = FILL_SEC_CPL_SCMD0_SEQNO(op_type,
> + (op_type == CHCR_ENCRYPT_OP) ? 1 : 0,
> + CHCR_SCMD_CIPHER_MODE_AES_CBC,
> + actx->auth_mode, aeadctx->hmac_ctrl,
> + ivsize >> 1);
> + chcr_req->sec_cpl.ivgen_hdrlen = FILL_SEC_CPL_IVGEN_HDRLEN(0, 0, 1,
> + 0, 1, dst_size);
> +
> + chcr_req->key_ctx.ctx_hdr = aeadctx->key_ctx_hdr;
> + if (op_type == CHCR_ENCRYPT_OP)
> + memcpy(chcr_req->key_ctx.key, aeadctx->key,
> + aeadctx->enckey_len);
> + else
> + memcpy(chcr_req->key_ctx.key, actx->dec_rrkey,
> + aeadctx->enckey_len);
> +
> + memcpy(chcr_req->key_ctx.key + (DIV_ROUND_UP(aeadctx->enckey_len, 16) <<
> + 4), actx->h_iopad, kctx_len -
> + (DIV_ROUND_UP(aeadctx->enckey_len, 16) << 4));
> +
> + phys_cpl = (struct cpl_rx_phys_dsgl *)((u8 *)(chcr_req + 1) + kctx_len);
> + sg_param.nents = reqctx->dst_nents;
> + sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
Just like above: is it ensured that we cannot have negative results here in
case cryptlen is less than authsize?
Ciao
Stephan
^ permalink raw reply
* Re: [PATCH v4 2/2] crypto: marvell - Don't break chain for computable last ahash requests
From: Boris Brezillon @ 2016-10-14 10:40 UTC (permalink / raw)
To: Romain Perier
Cc: Arnaud Ebalard, David S. Miller, Herbert Xu, Thomas Petazzoni,
Jason Cooper, Andrew Lunn, Sebastian Hesselbarth, Gregory Clement,
Nadav Haklai, Ofer Heifetz, linux-crypto, linux-arm-kernel
In-Reply-To: <20161005075633.12711-3-romain.perier@free-electrons.com>
On Wed, 5 Oct 2016 09:56:33 +0200
Romain Perier <romain.perier@free-electrons.com> wrote:
> Currently, the driver breaks chain for all kind of hash requests in order to
> don't override intermediate states of partial ahash updates. However, some final
> ahash requests can be directly processed by the engine, and so without
> intermediate state. This is typically the case for most for the HMAC requests
> processed via IPSec.
>
> This commits adds a TDMA descriptor to copy context for these of requests
> into the "op" dma pool, then it allow to chain these requests at the DMA level.
> The 'complete' operation is also updated to retrieve the MAC digest from the
> right location.
>
> Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Minor comments below, otherwise it looks good.
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
> ---
>
> Changes in v4:
> - Remove the dummy descriptor at the end of the chain, when a TDMA_RESULT
> is present. So, we re-wrote a bit the code of ahash_complete accordingly.
>
> Changes in v3:
> - Copy the whole context back to RAM and not just the digest. Also
> fixed a rebase issue ^^ (whoops)
>
> Changes in v2:
> - Replaced BUG_ON by an error
> - Add a variable "break_chain", with "type" to break the chain
>
> drivers/crypto/marvell/hash.c | 65 ++++++++++++++++++++++++++++++++-----------
> 1 file changed, 49 insertions(+), 16 deletions(-)
>
> diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
> index 9f28468..2a92605 100644
> --- a/drivers/crypto/marvell/hash.c
> +++ b/drivers/crypto/marvell/hash.c
> @@ -312,24 +312,40 @@ static void mv_cesa_ahash_complete(struct crypto_async_request *req)
> int i;
>
> digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(ahashreq));
> - for (i = 0; i < digsize / 4; i++)
> - creq->state[i] = readl_relaxed(engine->regs + CESA_IVDIG(i));
>
> - if (creq->last_req) {
> + if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ &&
> + (creq->base.chain.last->flags & CESA_TDMA_TYPE_MSK) == CESA_TDMA_RESULT) {
Maybe it's time to create an helper to extract the TDMA desc type (as
you did for the CESA req type with mv_cesa_req_get_type()).
> + __le32 *data = NULL;
> +
> /*
> - * Hardware's MD5 digest is in little endian format, but
> - * SHA in big endian format
> + * Result is already in the correct endianess when the SA is
> + * used
> */
> - if (creq->algo_le) {
> - __le32 *result = (void *)ahashreq->result;
> + data = creq->base.chain.last->op->ctx.hash.hash;
> + for (i = 0; i < digsize / 4; i++)
> + creq->state[i] = cpu_to_le32(data[i]);
>
> - for (i = 0; i < digsize / 4; i++)
> - result[i] = cpu_to_le32(creq->state[i]);
> - } else {
> - __be32 *result = (void *)ahashreq->result;
> + memcpy(ahashreq->result, data, digsize);
> + } else {
> + for (i = 0; i < digsize / 4; i++)
> + creq->state[i] = readl_relaxed(engine->regs +
> + CESA_IVDIG(i));
> + if (creq->last_req) {
> + /*
> + * Hardware's MD5 digest is in little endian format, but
> + * SHA in big endian format
> + */
> + if (creq->algo_le) {
> + __le32 *result = (void *)ahashreq->result;
> +
> + for (i = 0; i < digsize / 4; i++)
> + result[i] = cpu_to_le32(creq->state[i]);
> + } else {
> + __be32 *result = (void *)ahashreq->result;
>
> - for (i = 0; i < digsize / 4; i++)
> - result[i] = cpu_to_be32(creq->state[i]);
> + for (i = 0; i < digsize / 4; i++)
> + result[i] = cpu_to_be32(creq->state[i]);
> + }
> }
> }
>
> @@ -504,6 +520,12 @@ mv_cesa_ahash_dma_last_req(struct mv_cesa_tdma_chain *chain,
> CESA_SA_DESC_CFG_LAST_FRAG,
> CESA_SA_DESC_CFG_FRAG_MSK);
>
> + ret = mv_cesa_dma_add_result_op(chain,
> + CESA_SA_CFG_SRAM_OFFSET,
> + CESA_SA_DATA_SRAM_OFFSET,
> + CESA_TDMA_SRC_IN_SRAM, flags);
> + if (ret)
> + return ERR_PTR(-ENOMEM);
> return op;
> }
>
> @@ -564,6 +586,7 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
> struct mv_cesa_op_ctx *op = NULL;
> unsigned int frag_len;
> int ret;
> + u32 type;
>
> basereq->chain.first = NULL;
> basereq->chain.last = NULL;
> @@ -635,7 +658,15 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
> goto err_free_tdma;
> }
>
> - if (op) {
> + /*
> + * If results are copied via DMA, this means that this
> + * request can be directly processed by the engine,
> + * without partial updates. So we can chain it at the
> + * DMA level with other requests.
> + */
Can you move this comment where it really belongs: when you
conditionally set the CESA_TDMA_BREAK_CHAIN flag.
> + type = basereq->chain.last->flags & CESA_TDMA_TYPE_MSK;
> +
> + if (op && type != CESA_TDMA_RESULT) {
> /* Add dummy desc to wait for crypto operation end */
> ret = mv_cesa_dma_add_dummy_end(&basereq->chain, flags);
> if (ret)
> @@ -648,8 +679,10 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
> else
> creq->cache_ptr = 0;
>
> - basereq->chain.last->flags |= (CESA_TDMA_END_OF_REQ |
> - CESA_TDMA_BREAK_CHAIN);
> + basereq->chain.last->flags |= CESA_TDMA_END_OF_REQ;
> +
> + if (type != CESA_TDMA_RESULT)
> + basereq->chain.last->flags |= CESA_TDMA_BREAK_CHAIN;
>
> return 0;
>
^ permalink raw reply
* Re: [PATCH 2/6] crypto: ccp - Remove unneeded sign-extension support
From: Tom Lendacky @ 2016-10-13 19:57 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145300.19759.14061.stgit@taos>
On 10/13/2016 09:53 AM, Gary R Hook wrote:
> The reverse-get/set functions can be simplified by
> eliminating unused code.
>
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/ccp-ops.c | 145 +++++++++++++++++-------------------------
> 1 file changed, 59 insertions(+), 86 deletions(-)
>
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 8fedb14..82cc637 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -198,62 +198,46 @@ static void ccp_get_dm_area(struct ccp_dm_workarea *wa, unsigned int wa_offset,
> }
>
> static int ccp_reverse_set_dm_area(struct ccp_dm_workarea *wa,
> + unsigned int wa_offset,
> struct scatterlist *sg,
> - unsigned int len, unsigned int se_len,
> - bool sign_extend)
> + unsigned int sg_offset,
> + unsigned int len)
> {
> - unsigned int nbytes, sg_offset, dm_offset, sb_len, i;
> - u8 buffer[CCP_REVERSE_BUF_SIZE];
> -
> - if (WARN_ON(se_len > sizeof(buffer)))
> - return -EINVAL;
> -
> - sg_offset = len;
> - dm_offset = 0;
> - nbytes = len;
> - while (nbytes) {
> - sb_len = min_t(unsigned int, nbytes, se_len);
> - sg_offset -= sb_len;
> -
> - scatterwalk_map_and_copy(buffer, sg, sg_offset, sb_len, 0);
> - for (i = 0; i < sb_len; i++)
> - wa->address[dm_offset + i] = buffer[sb_len - i - 1];
> -
> - dm_offset += sb_len;
> - nbytes -= sb_len;
> -
> - if ((sb_len != se_len) && sign_extend) {
> - /* Must sign-extend to nearest sign-extend length */
> - if (wa->address[dm_offset - 1] & 0x80)
> - memset(wa->address + dm_offset, 0xff,
> - se_len - sb_len);
> - }
> + u8 *p, *q;
> +
> + ccp_set_dm_area(wa, wa_offset, sg, sg_offset, len);
> +
> + p = wa->address + wa_offset;
> + q = p + len - 1;
> + while (p < q) {
> + *p = *p ^ *q;
> + *q = *p ^ *q;
> + *p = *p ^ *q;
> + p++;
> + q--;
> }
> -
> return 0;
> }
>
> static void ccp_reverse_get_dm_area(struct ccp_dm_workarea *wa,
> + unsigned int wa_offset,
> struct scatterlist *sg,
> + unsigned int sg_offset,
> unsigned int len)
> {
> - unsigned int nbytes, sg_offset, dm_offset, sb_len, i;
> - u8 buffer[CCP_REVERSE_BUF_SIZE];
> -
> - sg_offset = 0;
> - dm_offset = len;
> - nbytes = len;
> - while (nbytes) {
> - sb_len = min_t(unsigned int, nbytes, sizeof(buffer));
> - dm_offset -= sb_len;
> -
> - for (i = 0; i < sb_len; i++)
> - buffer[sb_len - i - 1] = wa->address[dm_offset + i];
> - scatterwalk_map_and_copy(buffer, sg, sg_offset, sb_len, 1);
> -
> - sg_offset += sb_len;
> - nbytes -= sb_len;
> + u8 *p, *q;
> +
> + p = wa->address + wa_offset;
> + q = p + len - 1;
> + while (p < q) {
> + *p = *p ^ *q;
> + *q = *p ^ *q;
> + *p = *p ^ *q;
> + p++;
> + q--;
> }
> +
> + ccp_get_dm_area(wa, wa_offset, sg, sg_offset, len);
> }
>
> static void ccp_free_data(struct ccp_data *data, struct ccp_cmd_queue *cmd_q)
> @@ -1294,7 +1278,9 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> struct ccp_data dst;
> struct ccp_op op;
> unsigned int sb_count, i_len, o_len;
> - int ret;
> + unsigned int dm_offset;
> + int i = 0;
Is "dm_offset" and "i" used anywhere? I don't see them used in this
function...
> + int ret = 0;
No need to change this, is there?
Thanks,
Tom
^ permalink raw reply
* Re: [PATCH 3/6] crypto: ccp - Add support for RSA on the CCP
From: Gary R Hook @ 2016-10-13 20:08 UTC (permalink / raw)
To: Stephan Mueller, Gary R Hook
Cc: linux-crypto, thomas.lendacky, herbert, davem
In-Reply-To: <1603902.uM94ZuZj0Q@tauon.atsec.com>
On 10/13/2016 01:25 PM, Stephan Mueller wrote:
> Am Donnerstag, 13. Oktober 2016, 09:53:09 CEST schrieb Gary R Hook:
>
> Hi Gary,
>
>> Wire up the v3 CCP as a cipher provider.
>>
>> Signed-off-by: Gary R Hook <gary.hook@amd.com>
>> ---
>>
>> ...snip...
>>
>> +}
>> +
>> +static void ccp_free_mpi_key(struct ccp_rsa_key *key)
>> +{
>> + mpi_free(key->d);
>> + key->d = NULL;
>> + mpi_free(key->e);
>> + key->e = NULL;
>> + mpi_free(key->n);
>> + key->n = NULL;
>> +}
>
> Could you please see whether that function can be turned into a common
> function call? crypto/rsa.c implements the same code in rsa_free_mpi_key.
I am happy to do so, but was unsure of protocol. rsa.c is in a module, which
makes my module depend upon another. I do not want to do that. And moving
this function elsewhere makes no sense.
I would go with an inline function, but there's no obvious place for it.
The RSA software implementation uses the MPI library, but there's no
requirement to do so (witness the qat driver). Thus, an inline function
can't
be put in internal/rsa.h without moving the rsa_mpi_key definition and
referencing mpi.h.
I think that RSA+MPI things, such as rsa_mpi_key and this function, could go
into internal/rsa.h, but it would be necessary to #include mpi.h.
Or: create a new include file that contains these (and any other) RSA/MPI
amalgams.
Which would you prefer?
>> +
>> +static int ccp_check_key_length(unsigned int len)
>> +{
>> + /* In bits */
>> + if (len < 8 || len > 16384)
>> + return -EINVAL;
>> + return 0;
>> +}
>> +
>> +static void ccp_rsa_free_key_bufs(struct ccp_ctx *ctx)
>> +{
>> + /* Clean up old key data */
>> + kfree(ctx->u.rsa.e_buf);
>> + ctx->u.rsa.e_buf = NULL;
>> + ctx->u.rsa.e_len = 0;
>> + kfree(ctx->u.rsa.n_buf);
>> + ctx->u.rsa.n_buf = NULL;
>> + ctx->u.rsa.n_len = 0;
>> + kfree(ctx->u.rsa.d_buf);
>
> kzfree, please.
Of course. Done.
>>
>> ...snip...
>>
>> +}
>> +
>> +static struct akcipher_alg rsa = {
>> + .encrypt = ccp_rsa_encrypt,
>> + .decrypt = ccp_rsa_decrypt,
>> + .sign = NULL,
>> + .verify = NULL,
>> + .set_pub_key = ccp_rsa_setpubkey,
>> + .set_priv_key = ccp_rsa_setprivkey,
>> + .max_size = ccp_rsa_maxsize,
>> + .init = ccp_rsa_init_tfm,
>> + .exit = ccp_rsa_exit_tfm,
>> + .reqsize = sizeof(struct ccp_rsa_req_ctx),
>> + .base = {
>> + .cra_name = "rsa",
>> + .cra_driver_name = "rsa-ccp",
>> + .cra_priority = 100,
>
> Are you sure you want to leave it at 100? With this value, it will content
> with the C implementation.
No, I don't. Our other functions are at 300 (CCP_CRA_PRIORITY), which is
what
this should be.
>
>> + .cra_module = THIS_MODULE,
>> + .cra_ctxsize = sizeof(struct ccp_ctx),
>> + },
>> +};
>> +
>> ...snip...
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
>
> Ciao
> Stephan
>
Thank you. I hope snipping is acceptable...
--
This is my day job. Follow me at:
IG/Twitter/Facebook: @grhookphoto
IG/Twitter/Facebook: @grhphotographer
^ permalink raw reply
* Re: [PATCH 6/6] crypto: ccp - Enable 3DES function on v5 CCPs
From: Tom Lendacky @ 2016-10-13 22:13 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145343.19759.84415.stgit@taos>
On 10/13/2016 09:53 AM, Gary R Hook wrote:
> Wire up support for Triple DES in ECB mode.
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/Makefile | 1
> drivers/crypto/ccp/ccp-crypto-des3.c | 254 ++++++++++++++++++++++++++++++++++
> drivers/crypto/ccp/ccp-crypto-main.c | 10 +
> drivers/crypto/ccp/ccp-crypto.h | 25 +++
> drivers/crypto/ccp/ccp-dev-v3.c | 1
> drivers/crypto/ccp/ccp-dev-v5.c | 65 ++++++++-
> drivers/crypto/ccp/ccp-dev.h | 18 ++
> drivers/crypto/ccp/ccp-ops.c | 201 +++++++++++++++++++++++++++
> drivers/crypto/ccp/ccp-pci.c | 2
> include/linux/ccp.h | 57 +++++++-
> 10 files changed, 624 insertions(+), 10 deletions(-)
> create mode 100644 drivers/crypto/ccp/ccp-crypto-des3.c
>
... <SNIP> ...
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -26,6 +26,8 @@
> #include <crypto/sha.h>
> #include <crypto/internal/rsa.h>
>
> +#define CCP_LOG_LEVEL KERN_INFO
> +
Not used anywhere that I can tell.
> #define CCP_CRA_PRIORITY 300
>
> struct ccp_crypto_ablkcipher_alg {
> @@ -151,7 +153,26 @@ struct ccp_aes_cmac_exp_ctx {
> u8 buf[AES_BLOCK_SIZE];
> };
>
> -/* SHA-related defines
> +/***** 3DES related defines *****/
> +struct ccp_des3_ctx {
> + enum ccp_engine engine;
> + enum ccp_des3_type type;
> + enum ccp_des3_mode mode;
> +
> + struct scatterlist key_sg;
> + unsigned int key_len;
> + u8 key[AES_MAX_KEY_SIZE];
> +};
> +
> +struct ccp_des3_req_ctx {
> + struct scatterlist iv_sg;
> + u8 iv[AES_BLOCK_SIZE];
> +
> + struct ccp_cmd cmd;
> +};
> +
> +/*
> + * SHA-related defines
> * These values must be large enough to accommodate any variant
> */
> #define MAX_SHA_CONTEXT_SIZE SHA512_DIGEST_SIZE
> @@ -236,6 +257,7 @@ struct ccp_ctx {
> struct ccp_aes_ctx aes;
> struct ccp_rsa_ctx rsa;
> struct ccp_sha_ctx sha;
> + struct ccp_des3_ctx des3;
> } u;
> };
>
> @@ -251,5 +273,6 @@ int ccp_register_aes_aeads(struct list_head *head);
> int ccp_register_sha_algs(struct list_head *head);
> int ccp_register_rsa_algs(void);
> void ccp_unregister_rsa_algs(void);
> +int ccp_register_des3_algs(struct list_head *head);
>
> #endif
> diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
> index 75a0978..fccca16 100644
> --- a/drivers/crypto/ccp/ccp-dev-v3.c
> +++ b/drivers/crypto/ccp/ccp-dev-v3.c
> @@ -595,6 +595,7 @@ static irqreturn_t ccp_irq_handler(int irq, void *data)
> static const struct ccp_actions ccp3_actions = {
> .aes = ccp_perform_aes,
> .xts_aes = ccp_perform_xts_aes,
> + .des3 = NULL,
> .sha = ccp_perform_sha,
> .rsa = ccp_perform_rsa,
> .passthru = ccp_perform_passthru,
> diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
> index dcae391..85387dc 100644
> --- a/drivers/crypto/ccp/ccp-dev-v5.c
> +++ b/drivers/crypto/ccp/ccp-dev-v5.c
> @@ -101,6 +101,12 @@ union ccp_function {
> u16 type:2;
> } aes_xts;
> struct {
> + u16 size:7;
> + u16 encrypt:1;
> + u16 mode:5;
> + u16 type:2;
> + } des3;
> + struct {
> u16 rsvd1:10;
> u16 type:4;
> u16 rsvd2:1;
> @@ -132,6 +138,10 @@ union ccp_function {
> #define CCP_AES_TYPE(p) ((p)->aes.type)
> #define CCP_XTS_SIZE(p) ((p)->aes_xts.size)
> #define CCP_XTS_ENCRYPT(p) ((p)->aes_xts.encrypt)
> +#define CCP_DES3_SIZE(p) ((p)->des3.size)
> +#define CCP_DES3_ENCRYPT(p) ((p)->des3.encrypt)
> +#define CCP_DES3_MODE(p) ((p)->des3.mode)
> +#define CCP_DES3_TYPE(p) ((p)->des3.type)
> #define CCP_SHA_TYPE(p) ((p)->sha.type)
> #define CCP_RSA_SIZE(p) ((p)->rsa.size)
> #define CCP_PT_BYTESWAP(p) ((p)->pt.byteswap)
> @@ -242,13 +252,16 @@ static int ccp5_do_cmd(struct ccp5_desc *desc,
> /* Wait for the job to complete */
> ret = wait_event_interruptible(cmd_q->int_queue,
> cmd_q->int_rcvd);
> - if (ret || cmd_q->cmd_error) {
> + if (cmd_q->cmd_error) {
> + /*
> + * Log the error and flush the queue by
> + * moving the head pointer
> + */
I don't think you wanted to remove the check for ret in the if
statement above.
> if (cmd_q->cmd_error)
> ccp_log_error(cmd_q->ccp,
> cmd_q->cmd_error);
> - /* A version 5 device doesn't use Job IDs... */
> - if (!ret)
> - ret = -EIO;
> + iowrite32(tail, cmd_q->reg_head_lo);
> + ret = -EIO;
> }
Hmmm... I think this block needs to be looked at some more.
> cmd_q->int_rcvd = 0;
> }
> @@ -381,6 +394,47 @@ static int ccp5_perform_sha(struct ccp_op *op)
> return ccp5_do_cmd(&desc, op->cmd_q);
> }
>
> +static int ccp5_perform_des3(struct ccp_op *op)
> +{
> + struct ccp5_desc desc;
> + union ccp_function function;
> + u32 key_addr = op->sb_key * LSB_ITEM_SIZE;
> +
> + /* Zero out all the fields of the command desc */
> + memset(&desc, 0, sizeof(struct ccp5_desc));
> +
> + CCP5_CMD_ENGINE(&desc) = CCP_ENGINE_DES3;
> +
> + CCP5_CMD_SOC(&desc) = op->soc;
> + CCP5_CMD_IOC(&desc) = 1;
> + CCP5_CMD_INIT(&desc) = op->init;
> + CCP5_CMD_EOM(&desc) = op->eom;
> + CCP5_CMD_PROT(&desc) = 0;
> +
> + function.raw = 0;
> + CCP_DES3_ENCRYPT(&function) = op->u.des3.action;
> + CCP_DES3_MODE(&function) = op->u.des3.mode;
> + CCP_DES3_TYPE(&function) = op->u.des3.type;
> + CCP5_CMD_FUNCTION(&desc) = cpu_to_le32(function.raw);
> +
> + CCP5_CMD_LEN(&desc) = cpu_to_le32(op->src.u.dma.length);
> +
> + CCP5_CMD_SRC_LO(&desc) = cpu_to_le32(ccp_addr_lo(&op->src.u.dma));
> + CCP5_CMD_SRC_HI(&desc) = cpu_to_le32(ccp_addr_hi(&op->src.u.dma));
> + CCP5_CMD_SRC_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SYSTEM);
> +
> + CCP5_CMD_DST_LO(&desc) = cpu_to_le32(ccp_addr_lo(&op->dst.u.dma));
> + CCP5_CMD_DST_HI(&desc) = cpu_to_le32(ccp_addr_hi(&op->dst.u.dma));
> + CCP5_CMD_DST_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SYSTEM);
> +
> + CCP5_CMD_KEY_LO(&desc) = cpu_to_le32(lower_32_bits(key_addr));
> + CCP5_CMD_KEY_HI(&desc) = 0;
> + CCP5_CMD_KEY_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SB);
> + CCP5_CMD_LSB_ID(&desc) = cpu_to_le32(op->sb_ctx);
> +
> + return ccp5_do_cmd(&desc, op->cmd_q);
> +}
> +
> static int ccp5_perform_rsa(struct ccp_op *op)
> {
> struct ccp5_desc desc;
> @@ -428,6 +482,7 @@ static int ccp5_perform_passthru(struct ccp_op *op)
> struct ccp_dma_info *saddr = &op->src.u.dma;
> struct ccp_dma_info *daddr = &op->dst.u.dma;
>
> +
Extra blank line.
> memset(&desc, 0, Q_DESC_SIZE);
>
> CCP5_CMD_ENGINE(&desc) = CCP_ENGINE_PASSTHRU;
> @@ -722,6 +777,7 @@ static int ccp5_init(struct ccp_device *ccp)
>
> dev_dbg(dev, "queue #%u available\n", i);
> }
> +
Not needed for this patch.
> if (ccp->cmd_q_count == 0) {
> dev_notice(dev, "no command queues available\n");
> ret = -EIO;
> @@ -991,6 +1047,7 @@ static const struct ccp_actions ccp5_actions = {
> .aes = ccp5_perform_aes,
> .xts_aes = ccp5_perform_xts_aes,
> .sha = ccp5_perform_sha,
> + .des3 = ccp5_perform_des3,
> .rsa = ccp5_perform_rsa,
> .passthru = ccp5_perform_passthru,
> .ecc = ccp5_perform_ecc,
> diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
> index a2214ac..12a92d5 100644
> --- a/drivers/crypto/ccp/ccp-dev.h
> +++ b/drivers/crypto/ccp/ccp-dev.h
> @@ -27,6 +27,10 @@
> #include <linux/irqreturn.h>
> #include <linux/dmaengine.h>
>
> +#ifndef CCP_LOG_LEVEL
> +#define CCP_LOG_LEVEL KERN_INFO
> +#endif
> +
Not used anywhere that I can tell.
> #define MAX_CCP_NAME_LEN 16
> #define MAX_DMAPOOL_NAME_LEN 32
>
> @@ -190,6 +194,9 @@
> #define CCP_XTS_AES_KEY_SB_COUNT 1
> #define CCP_XTS_AES_CTX_SB_COUNT 1
>
> +#define CCP_DES3_KEY_SB_COUNT 1
> +#define CCP_DES3_CTX_SB_COUNT 1
> +
> #define CCP_SHA_SB_COUNT 1
>
> #define CCP_RSA_MAX_WIDTH 4096
> @@ -475,6 +482,12 @@ struct ccp_xts_aes_op {
> enum ccp_xts_aes_unit_size unit_size;
> };
>
> +struct ccp_des3_op {
> + enum ccp_des3_type type;
> + enum ccp_des3_mode mode;
> + enum ccp_des3_action action;
> +};
> +
> struct ccp_sha_op {
> enum ccp_sha_type type;
> u64 msg_bits;
> @@ -512,6 +525,7 @@ struct ccp_op {
> union {
> struct ccp_aes_op aes;
> struct ccp_xts_aes_op xts;
> + struct ccp_des3_op des3;
> struct ccp_sha_op sha;
> struct ccp_rsa_op rsa;
> struct ccp_passthru_op passthru;
> @@ -620,13 +634,13 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp);
> struct ccp_actions {
> int (*aes)(struct ccp_op *);
> int (*xts_aes)(struct ccp_op *);
> + int (*des3)(struct ccp_op *);
> int (*sha)(struct ccp_op *);
> int (*rsa)(struct ccp_op *);
> int (*passthru)(struct ccp_op *);
> int (*ecc)(struct ccp_op *);
> u32 (*sballoc)(struct ccp_cmd_queue *, unsigned int);
> - void (*sbfree)(struct ccp_cmd_queue *, unsigned int,
> - unsigned int);
> + void (*sbfree)(struct ccp_cmd_queue *, unsigned int, unsigned int);
> unsigned int (*get_free_slots)(struct ccp_cmd_queue *);
> int (*init)(struct ccp_device *);
> void (*destroy)(struct ccp_device *);
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index de28867..f9543f7 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -16,6 +16,7 @@
> #include <linux/pci.h>
> #include <linux/interrupt.h>
> #include <crypto/scatterwalk.h>
> +#include <crypto/des.h>
> #include <linux/ccp.h>
> #include <linux/delay.h>
>
> @@ -882,8 +883,7 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> return -EINVAL;
>
> if (((aes->mode == CCP_AES_MODE_ECB) ||
> - (aes->mode == CCP_AES_MODE_CBC) ||
> - (aes->mode == CCP_AES_MODE_CFB)) &&
> + (aes->mode == CCP_AES_MODE_CBC)) &&
Why are you removing AES modes?
> (aes->src_len & (AES_BLOCK_SIZE - 1)))
> return -EINVAL;
>
> @@ -1194,6 +1194,200 @@ e_key:
> return ret;
> }
>
> +static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> +{
> + struct ccp_des3_engine *des3 = &cmd->u.des3;
> +
> + struct ccp_dm_workarea key, ctx;
> + struct ccp_data src, dst;
> + struct ccp_op op;
> + unsigned int dm_offset;
> + unsigned int len_singlekey;
> + bool in_place = false;
> + int ret;
> +
> + /* Error checks */
> + if (!cmd_q->ccp->vdata->perform->des3)
> + return -EINVAL;
> +
> + if (des3->key_len != DES3_EDE_KEY_SIZE)
> + return -EINVAL;
> +
> + if (((des3->mode == CCP_DES3_MODE_ECB) ||
> + (des3->mode == CCP_DES3_MODE_CBC)) &&
> + (des3->src_len & (DES3_EDE_BLOCK_SIZE - 1)))
These need to be lined up with the first if condition.
> + return -EINVAL;
> +
> + if (!des3->key || !des3->src || !des3->dst)
> + return -EINVAL;
> +
> + if (des3->mode != CCP_DES3_MODE_ECB) {
> + if (des3->iv_len != DES3_EDE_BLOCK_SIZE)
> + return -EINVAL;
> +
> + if (!des3->iv)
> + return -EINVAL;
> + }
> +
> + ret = -EIO;
Not needed since it will be immediately overwritten in the operation
below.
> + /* Zero out all the fields of the command desc */
> + memset(&op, 0, sizeof(op));
> +
> + /* Set up the Function field */
> + op.cmd_q = cmd_q;
> + op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
> + op.sb_key = cmd_q->sb_key;
> +
> + op.init = (des3->mode == CCP_DES3_MODE_ECB) ? 0 : 1;
> + op.u.des3.type = des3->type;
> + op.u.des3.mode = des3->mode;
> + op.u.des3.action = des3->action;
> +
> + /*
> + * All supported key sizes fit in a single (32-byte) KSB entry and
> + * (like AES) must be in little endian format. Use the 256-bit byte
> + * swap passthru option to convert from big endian to little endian.
> + */
> + ret = ccp_init_dm_workarea(&key, cmd_q,
> + CCP_DES3_KEY_SB_COUNT * CCP_SB_BYTES,
> + DMA_TO_DEVICE);
> + if (ret)
> + return ret;
> +
> + /*
> + * The contents of the key triplet are in the reverse order of what
> + * is required by the engine. Copy the 3 pieces individually to put
> + * them where they belong.
> + */
> + dm_offset = CCP_SB_BYTES - des3->key_len; /* Basic offset */
> +
> + len_singlekey = des3->key_len / 3;
> + ccp_set_dm_area(&key, dm_offset + 2 * len_singlekey,
> + des3->key, 0, len_singlekey);
> + ccp_set_dm_area(&key, dm_offset + len_singlekey,
> + des3->key, len_singlekey, len_singlekey);
> + ccp_set_dm_area(&key, dm_offset,
> + des3->key, 2 * len_singlekey, len_singlekey);
> +
> + /* Copy the key to the SB */
> + ret = ccp_copy_to_sb(cmd_q, &key, op.jobid, op.sb_key,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_key;
> + }
> +
> + /*
> + * The DES3 context fits in a single (32-byte) KSB entry and
> + * must be in little endian format. Use the 256-bit byte swap
> + * passthru option to convert from big endian to little endian.
> + */
> + if (des3->mode != CCP_DES3_MODE_ECB) {
> + u32 load_mode;
> +
> + op.sb_ctx = cmd_q->sb_ctx;
> +
> + ret = ccp_init_dm_workarea(&ctx, cmd_q,
> + CCP_DES3_CTX_SB_COUNT * CCP_SB_BYTES,
> + DMA_BIDIRECTIONAL);
> + if (ret)
> + goto e_key;
> +
> + /* Load the context into the LSB */
> + dm_offset = CCP_SB_BYTES - des3->iv_len;
> + ccp_set_dm_area(&ctx, dm_offset, des3->iv, 0, des3->iv_len);
> +
> + if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
> + load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
> + else
> + load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
> + ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
> + load_mode);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_ctx;
> + }
> + }
> +
> + /*
> + * Prepare the input and output data workareas. For in-place
> + * operations we need to set the dma direction to BIDIRECTIONAL
> + * and copy the src workarea to the dst workarea.
> + */
> + if (sg_virt(des3->src) == sg_virt(des3->dst))
> + in_place = true;
> +
> + ret = ccp_init_data(&src, cmd_q, des3->src, des3->src_len,
> + DES3_EDE_BLOCK_SIZE,
> + in_place ? DMA_BIDIRECTIONAL : DMA_TO_DEVICE);
> + if (ret)
> + goto e_ctx;
> +
> + if (in_place)
> + dst = src;
> + else {
> + ret = ccp_init_data(&dst, cmd_q, des3->dst, des3->src_len,
> + DES3_EDE_BLOCK_SIZE, DMA_FROM_DEVICE);
> + if (ret)
> + goto e_src;
> + }
> +
> + /* Send data to the CCP DES3 engine */
> + while (src.sg_wa.bytes_left) {
> + ccp_prepare_data(&src, &dst, &op, DES3_EDE_BLOCK_SIZE, true);
> + if (!src.sg_wa.bytes_left) {
> + op.eom = 1;
> +
> + /* Since we don't retrieve the context in ECB mode
> + * we have to wait for the operation to complete
> + * on the last piece of data
> + */
> + op.soc = 0;
> + }
> +
> + ret = cmd_q->ccp->vdata->perform->des3(&op);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_dst;
> + }
> +
> + ccp_process_data(&src, &dst, &op);
> + }
> +
> + if (des3->mode != CCP_DES3_MODE_ECB) {
> + /* Retrieve the context and make BE */
> + ret = ccp_copy_from_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_dst;
> + }
> +
> + /* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
> + if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
V3 doesn't support des3 and has a perform_des3 of NULL so can never get
here. Just use an offset of 0 in the ccp_get_dm_area() call.
Thanks,
Tom
> + dm_offset = CCP_SB_BYTES - des3->iv_len;
> + else
> + dm_offset = 0;
> + ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
> + DES3_EDE_BLOCK_SIZE);
> + }
> +e_dst:
> + if (!in_place)
> + ccp_free_data(&dst, cmd_q);
> +
> +e_src:
> + ccp_free_data(&src, cmd_q);
> +
> +e_ctx:
> + if (des3->mode != CCP_DES3_MODE_ECB)
> + ccp_dm_free(&ctx);
> +
> +e_key:
> + ccp_dm_free(&key);
> +
> + return ret;
> +}
> +
> static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> {
> struct ccp_sha_engine *sha = &cmd->u.sha;
> @@ -2190,6 +2384,9 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> case CCP_ENGINE_XTS_AES_128:
> ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
> break;
> + case CCP_ENGINE_DES3:
> + ret = ccp_run_des3_cmd(cmd_q, cmd);
> + break;
> case CCP_ENGINE_SHA:
> ret = ccp_run_sha_cmd(cmd_q, cmd);
> break;
> diff --git a/drivers/crypto/ccp/ccp-pci.c b/drivers/crypto/ccp/ccp-pci.c
> index 28a9996..e9bdf6f 100644
> --- a/drivers/crypto/ccp/ccp-pci.c
> +++ b/drivers/crypto/ccp/ccp-pci.c
> @@ -230,9 +230,11 @@ static int ccp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>
> dev_set_drvdata(dev, ccp);
>
> + /* Instance-specific required setup */
> if (ccp->vdata->setup)
> ccp->vdata->setup(ccp);
>
> + /* Initialize the CCP device */
> ret = ccp->vdata->perform->init(ccp);
> if (ret)
> goto e_iomap;
> diff --git a/include/linux/ccp.h b/include/linux/ccp.h
> index f90f8ba..e7acc37 100644
> --- a/include/linux/ccp.h
> +++ b/include/linux/ccp.h
> @@ -303,6 +303,60 @@ struct ccp_sha_engine {
> * final sha cmd */
> };
>
> +/***** 3DES engine *****/
> +enum ccp_des3_mode {
> + CCP_DES3_MODE_ECB = 0,
> + CCP_DES3_MODE_CBC,
> + CCP_DES3_MODE_CFB,
> + CCP_DES3_MODE__LAST,
> +};
> +
> +enum ccp_des3_type {
> + CCP_DES3_TYPE_168 = 1,
> + CCP_DES3_TYPE__LAST,
> + };
> +
> +enum ccp_des3_action {
> + CCP_DES3_ACTION_DECRYPT = 0,
> + CCP_DES3_ACTION_ENCRYPT,
> + CCP_DES3_ACTION__LAST,
> +};
> +
> +/**
> + * struct ccp_des3_engine - CCP SHA operation
> + * @type: Type of 3DES operation
> + * @mode: cipher mode
> + * @action: 3DES operation (decrypt/encrypt)
> + * @key: key to be used for this 3DES operation
> + * @key_len: length of key (in bytes)
> + * @iv: IV to be used for this AES operation
> + * @iv_len: length in bytes of iv
> + * @src: input data to be used for this operation
> + * @src_len: length of input data used for this operation (in bytes)
> + * @dst: output data produced by this operation
> + *
> + * Variables required to be set when calling ccp_enqueue_cmd():
> + * - type, mode, action, key, key_len, src, dst, src_len
> + * - iv, iv_len for any mode other than ECB
> + *
> + * The iv variable is used as both input and output. On completion of the
> + * 3DES operation the new IV overwrites the old IV.
> + */
> +struct ccp_des3_engine {
> + enum ccp_des3_type type;
> + enum ccp_des3_mode mode;
> + enum ccp_des3_action action;
> +
> + struct scatterlist *key;
> + u32 key_len; /* In bytes */
> +
> + struct scatterlist *iv;
> + u32 iv_len; /* In bytes */
> +
> + struct scatterlist *src, *dst;
> + u64 src_len; /* In bytes */
> +};
> +
> /**
> * ccp_rsa_type - mode of RSA operation
> *
> @@ -583,7 +637,7 @@ struct ccp_ecc_engine {
> enum ccp_engine {
> CCP_ENGINE_AES = 0,
> CCP_ENGINE_XTS_AES_128,
> - CCP_ENGINE_RSVD1,
> + CCP_ENGINE_DES3,
> CCP_ENGINE_SHA,
> CCP_ENGINE_RSA,
> CCP_ENGINE_PASSTHRU,
> @@ -631,6 +685,7 @@ struct ccp_cmd {
> union {
> struct ccp_aes_engine aes;
> struct ccp_xts_aes_engine xts;
> + struct ccp_des3_engine des3;
> struct ccp_sha_engine sha;
> struct ccp_rsa_engine rsa;
> struct ccp_passthru_engine passthru;
>
^ permalink raw reply
* Re: [PATCH 5/6] crypto: ccp - Enable support for AES GCM on v5 CCPs
From: Tom Lendacky @ 2016-10-13 21:54 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145331.19759.26881.stgit@taos>
On 10/13/2016 09:53 AM, Gary R Hook wrote:
> A version 5 device provides the primitive commands
> required for AES GCM. This patch adds support for
> en/decryption.
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/Makefile | 1
> drivers/crypto/ccp/ccp-crypto-aes-galois.c | 252 +++++++++++++++++++++++++++
> drivers/crypto/ccp/ccp-crypto-main.c | 12 +
> drivers/crypto/ccp/ccp-crypto.h | 14 +
> drivers/crypto/ccp/ccp-dev-v5.c | 2
> drivers/crypto/ccp/ccp-dev.h | 1
> drivers/crypto/ccp/ccp-ops.c | 262 ++++++++++++++++++++++++++++
> include/linux/ccp.h | 9 +
> 8 files changed, 553 insertions(+)
> create mode 100644 drivers/crypto/ccp/ccp-crypto-aes-galois.c
>
> diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile
> index 23f89b7..fd77225 100644
> --- a/drivers/crypto/ccp/Makefile
> +++ b/drivers/crypto/ccp/Makefile
> @@ -13,4 +13,5 @@ ccp-crypto-objs := ccp-crypto-main.o \
> ccp-crypto-aes-cmac.o \
> ccp-crypto-aes-xts.o \
> ccp-crypto-rsa.o \
> + ccp-crypto-aes-galois.o \
> ccp-crypto-sha.o
> diff --git a/drivers/crypto/ccp/ccp-crypto-aes-galois.c b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
> new file mode 100644
> index 0000000..5da324f
> --- /dev/null
> +++ b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
> @@ -0,0 +1,252 @@
> +/*
> + * AMD Cryptographic Coprocessor (CCP) AES crypto API support
> + *
> + * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
> + *
> + * Author: Tom Lendacky <thomas.lendacky@amd.com>
Maybe put your name here...
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/module.h>
> +#include <linux/sched.h>
> +#include <linux/delay.h>
> +#include <linux/scatterlist.h>
> +#include <linux/crypto.h>
> +#include <crypto/internal/aead.h>
> +#include <crypto/algapi.h>
> +#include <crypto/aes.h>
> +#include <crypto/ctr.h>
> +#include <crypto/scatterwalk.h>
> +#include <linux/delay.h>
> +
> +#include "ccp-crypto.h"
> +
> +#define AES_GCM_IVSIZE 12
> +
> +static int ccp_aes_gcm_complete(struct crypto_async_request *async_req, int ret)
> +{
> + return ret;
> +}
> +
> +static int ccp_aes_gcm_setkey(struct crypto_aead *tfm, const u8 *key,
> + unsigned int key_len)
> +{
> + struct ccp_ctx *ctx = crypto_aead_ctx(tfm);
> +
> + switch (key_len) {
> + case AES_KEYSIZE_128:
> + ctx->u.aes.type = CCP_AES_TYPE_128;
> + break;
> + case AES_KEYSIZE_192:
> + ctx->u.aes.type = CCP_AES_TYPE_192;
> + break;
> + case AES_KEYSIZE_256:
> + ctx->u.aes.type = CCP_AES_TYPE_256;
> + break;
> + default:
> + crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
> + return -EINVAL;
> + }
> +
> + ctx->u.aes.mode = CCP_AES_MODE_GCM;
> + ctx->u.aes.key_len = key_len;
> +
> + memcpy(ctx->u.aes.key, key, key_len);
> + sg_init_one(&ctx->u.aes.key_sg, ctx->u.aes.key, key_len);
> +
> + return 0;
> +}
> +
> +static int ccp_aes_gcm_setauthsize(struct crypto_aead *tfm,
> + unsigned int authsize)
> +{
> + return 0;
> +}
> +
> +static int ccp_aes_gcm_crypt(struct aead_request *req, bool encrypt)
> +{
> + struct crypto_aead *tfm = crypto_aead_reqtfm(req);
> + struct ccp_ctx *ctx = crypto_aead_ctx(tfm);
> + struct ccp_aes_req_ctx *rctx = aead_request_ctx(req);
> + struct scatterlist *iv_sg = NULL;
> + unsigned int iv_len = 0;
> + int i;
> + int ret = 0;
> +
> + if (!ctx->u.aes.key_len)
> + return -EINVAL;
> +
> + if (ctx->u.aes.mode != CCP_AES_MODE_GCM)
> + return -EINVAL;
> +
> + if (!req->iv)
> + return -EINVAL;
> +
> + /*
> + * 5 parts:
> + * plaintext/ciphertext input
> + * AAD
> + * key
> + * IV
> + * Destination+tag buffer
> + */
> +
> + /* Copy the IV and initialize a scatterlist */
> + memset(rctx->iv, 0, AES_BLOCK_SIZE);
> + memcpy(rctx->iv, req->iv, AES_GCM_IVSIZE);
> + for (i = 0; i < 3; i++)
> + rctx->iv[i + AES_GCM_IVSIZE] = 0;
Is this needed if you did the memset to zero above?
> + rctx->iv[AES_BLOCK_SIZE - 1] = 1;
> + iv_sg = &rctx->iv_sg;
> + iv_len = AES_BLOCK_SIZE;
> + sg_init_one(iv_sg, rctx->iv, iv_len);
> +
> + /* The AAD + plaintext are concatenated in the src buffer */
> + memset(&rctx->cmd, 0, sizeof(rctx->cmd));
> + INIT_LIST_HEAD(&rctx->cmd.entry);
> + rctx->cmd.engine = CCP_ENGINE_AES;
> + rctx->cmd.u.aes.type = ctx->u.aes.type;
> + rctx->cmd.u.aes.mode = ctx->u.aes.mode;
> + rctx->cmd.u.aes.action =
> + (encrypt) ? CCP_AES_ACTION_ENCRYPT : CCP_AES_ACTION_DECRYPT;
> + rctx->cmd.u.aes.key = &ctx->u.aes.key_sg;
> + rctx->cmd.u.aes.key_len = ctx->u.aes.key_len;
> + rctx->cmd.u.aes.iv = iv_sg;
> + rctx->cmd.u.aes.iv_len = iv_len;
> + rctx->cmd.u.aes.src = req->src;
> + rctx->cmd.u.aes.src_len = req->cryptlen;
> + rctx->cmd.u.aes.aad_len = req->assoclen;
> +
> + /* The cipher text + the tag are in the dst buffer */
> + rctx->cmd.u.aes.dst = req->dst;
> +
> + ret = ccp_crypto_enqueue_request(&req->base, &rctx->cmd);
> +
> + return ret;
> +}
> +
> +static int ccp_aes_gcm_encrypt(struct aead_request *req)
> +{
> + return ccp_aes_gcm_crypt(req, true);
> +}
> +
> +static int ccp_aes_gcm_decrypt(struct aead_request *req)
> +{
> + return ccp_aes_gcm_crypt(req, false);
> +}
> +
> +static int ccp_aes_gcm_cra_init(struct crypto_aead *tfm)
> +{
> + struct ccp_ctx *ctx = crypto_aead_ctx(tfm);
> +
> + ctx->complete = ccp_aes_gcm_complete;
> + ctx->u.aes.key_len = 0;
> +
> + crypto_aead_set_reqsize(tfm, sizeof(struct ccp_aes_req_ctx));
> +
> + return 0;
> +}
> +
> +static void ccp_aes_gcm_cra_exit(struct crypto_tfm *tfm)
> +{
> +}
> +
> +static struct aead_alg ccp_aes_gcm_defaults = {
> + .setkey = ccp_aes_gcm_setkey,
> + .setauthsize = ccp_aes_gcm_setauthsize,
> + .encrypt = ccp_aes_gcm_encrypt,
> + .decrypt = ccp_aes_gcm_decrypt,
> + .init = ccp_aes_gcm_cra_init,
> + .ivsize = AES_GCM_IVSIZE,
> + .maxauthsize = AES_BLOCK_SIZE,
> + .base = {
> + .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
> + CRYPTO_ALG_ASYNC |
> + CRYPTO_ALG_KERN_DRIVER_ONLY |
> + CRYPTO_ALG_NEED_FALLBACK,
> + .cra_blocksize = AES_BLOCK_SIZE,
> + .cra_ctxsize = sizeof(struct ccp_ctx),
> + .cra_priority = CCP_CRA_PRIORITY,
> + .cra_type = &crypto_ablkcipher_type,
> + .cra_exit = ccp_aes_gcm_cra_exit,
> + .cra_module = THIS_MODULE,
> + },
> +};
> +
> +struct ccp_aes_aead_def {
> + enum ccp_aes_mode mode;
> + unsigned int version;
> + const char *name;
> + const char *driver_name;
> + unsigned int blocksize;
> + unsigned int ivsize;
> + struct aead_alg *alg_defaults;
> +};
> +
> +static struct ccp_aes_aead_def aes_aead_algs[] = {
> + {
> + .mode = CCP_AES_MODE_GHASH,
> + .version = CCP_VERSION(5, 0),
> + .name = "gcm(aes)",
> + .driver_name = "gcm-aes-ccp",
> + .blocksize = 1,
> + .ivsize = AES_BLOCK_SIZE,
> + .alg_defaults = &ccp_aes_gcm_defaults,
> + },
> +};
> +
> +static int ccp_register_aes_aead(struct list_head *head,
> + const struct ccp_aes_aead_def *def)
> +{
> + struct ccp_crypto_aead *ccp_aead;
> + struct aead_alg *alg;
> + int ret;
> +
> + ccp_aead = kzalloc(sizeof(*ccp_aead), GFP_KERNEL);
> + if (!ccp_aead)
> + return -ENOMEM;
> +
> + INIT_LIST_HEAD(&ccp_aead->entry);
> +
> + ccp_aead->mode = def->mode;
> +
> + /* Copy the defaults and override as necessary */
> + alg = &ccp_aead->alg;
> + *alg = *def->alg_defaults;
> + snprintf(alg->base.cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name);
> + snprintf(alg->base.cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
> + def->driver_name);
> + alg->base.cra_blocksize = def->blocksize;
> + alg->base.cra_ablkcipher.ivsize = def->ivsize;
> +
> + ret = crypto_register_aead(alg);
> + if (ret) {
> + pr_err("%s ablkcipher algorithm registration error (%d)\n",
> + alg->base.cra_name, ret);
> + kfree(ccp_aead);
> + return ret;
> + }
> +
> + list_add(&ccp_aead->entry, head);
> +
> + return 0;
> +}
> +
> +int ccp_register_aes_aeads(struct list_head *head)
> +{
> + int i, ret;
> + unsigned int ccpversion = ccp_version();
> +
> + for (i = 0; i < ARRAY_SIZE(aes_aead_algs); i++) {
> + if (aes_aead_algs[i].version > ccpversion)
> + continue;
> + ret = ccp_register_aes_aead(head, &aes_aead_algs[i]);
> + if (ret)
> + return ret;
> + }
> +
> + return 0;
> +}
> diff --git a/drivers/crypto/ccp/ccp-crypto-main.c b/drivers/crypto/ccp/ccp-crypto-main.c
> index f3c4c25..103a7b3 100644
> --- a/drivers/crypto/ccp/ccp-crypto-main.c
> +++ b/drivers/crypto/ccp/ccp-crypto-main.c
> @@ -40,6 +40,7 @@ MODULE_PARM_DESC(rsa_disable, "Disable use of RSA - any non-zero value");
> /* List heads for the supported algorithms */
> static LIST_HEAD(hash_algs);
> static LIST_HEAD(cipher_algs);
> +static LIST_HEAD(aead_algs);
>
> /* For any tfm, requests for that tfm must be returned on the order
> * received. With multiple queues available, the CCP can process more
> @@ -339,6 +340,10 @@ static int ccp_register_algs(void)
> ret = ccp_register_aes_xts_algs(&cipher_algs);
> if (ret)
> return ret;
> +
> + ret = ccp_register_aes_aeads(&aead_algs);
> + if (ret)
> + return ret;
> }
>
> if (!sha_disable) {
> @@ -362,6 +367,7 @@ static void ccp_unregister_algs(void)
> {
> struct ccp_crypto_ahash_alg *ahash_alg, *ahash_tmp;
> struct ccp_crypto_ablkcipher_alg *ablk_alg, *ablk_tmp;
> + struct ccp_crypto_aead *aead_alg, *aead_tmp;
>
> list_for_each_entry_safe(ahash_alg, ahash_tmp, &hash_algs, entry) {
> crypto_unregister_ahash(&ahash_alg->alg);
> @@ -377,6 +383,12 @@ static void ccp_unregister_algs(void)
>
> if (!rsa_disable)
> ccp_unregister_rsa_algs();
> +
> + list_for_each_entry_safe(aead_alg, aead_tmp, &aead_algs, entry) {
> + crypto_unregister_aead(&aead_alg->alg);
> + list_del(&aead_alg->entry);
> + kfree(aead_alg);
> + }
> }
>
> static int ccp_crypto_init(void)
> diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
> index c6cf318..b2918f6 100644
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -19,6 +19,8 @@
> #include <linux/ccp.h>
> #include <crypto/algapi.h>
> #include <crypto/aes.h>
> +#include <crypto/internal/aead.h>
> +#include <crypto/aead.h>
> #include <crypto/ctr.h>
> #include <crypto/hash.h>
> #include <crypto/sha.h>
> @@ -34,6 +36,14 @@ struct ccp_crypto_ablkcipher_alg {
> struct crypto_alg alg;
> };
>
> +struct ccp_crypto_aead {
> + struct list_head entry;
> +
> + u32 mode;
> +
> + struct aead_alg alg;
> +};
> +
> struct ccp_crypto_ahash_alg {
> struct list_head entry;
>
> @@ -96,6 +106,9 @@ struct ccp_aes_req_ctx {
> struct scatterlist iv_sg;
> u8 iv[AES_BLOCK_SIZE];
>
> + struct scatterlist tag_sg;
> + u8 tag[AES_BLOCK_SIZE];
> +
> /* Fields used for RFC3686 requests */
> u8 *rfc3686_info;
> u8 rfc3686_iv[AES_BLOCK_SIZE];
> @@ -234,6 +247,7 @@ struct scatterlist *ccp_crypto_sg_table_add(struct sg_table *table,
> int ccp_register_aes_algs(struct list_head *head);
> int ccp_register_aes_cmac_algs(struct list_head *head);
> int ccp_register_aes_xts_algs(struct list_head *head);
> +int ccp_register_aes_aeads(struct list_head *head);
> int ccp_register_sha_algs(struct list_head *head);
> int ccp_register_rsa_algs(void);
> void ccp_unregister_rsa_algs(void);
> diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
> index faf3cb3..dcae391 100644
> --- a/drivers/crypto/ccp/ccp-dev-v5.c
> +++ b/drivers/crypto/ccp/ccp-dev-v5.c
> @@ -279,6 +279,8 @@ static int ccp5_perform_aes(struct ccp_op *op)
> CCP_AES_TYPE(&function) = op->u.aes.type;
> if (op->u.aes.mode == CCP_AES_MODE_CFB)
> CCP_AES_SIZE(&function) = 0x7f;
> + if ((op->u.aes.mode == CCP_AES_MODE_GCTR) && op->eom)
> + CCP_AES_SIZE(&function) = op->u.aes.size;
>
> CCP5_CMD_FUNCTION(&desc) = function.raw;
>
> diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
> index 143f00f..a2214ac 100644
> --- a/drivers/crypto/ccp/ccp-dev.h
> +++ b/drivers/crypto/ccp/ccp-dev.h
> @@ -467,6 +467,7 @@ struct ccp_aes_op {
> enum ccp_aes_type type;
> enum ccp_aes_mode mode;
> enum ccp_aes_action action;
> + unsigned int size;
> };
>
> struct ccp_xts_aes_op {
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 07b8dfb..de28867 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -601,6 +601,265 @@ e_key:
> return ret;
> }
>
> +static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
> + struct ccp_cmd *cmd)
> +{
> + struct ccp_aes_engine *aes = &cmd->u.aes;
> + struct ccp_dm_workarea key, ctx, final_wa, tag;
> + struct ccp_data src, dst;
> + struct ccp_data aad;
> + struct ccp_op op;
> +
> + unsigned long long *final;
> + unsigned int dm_offset;
> + unsigned int ilen;
> + bool in_place = true; /* Default value */
> + int ret;
> +
> + struct scatterlist *p_inp, sg_inp[2];
> + struct scatterlist *p_tag, sg_tag[2];
> + struct scatterlist *p_outp, sg_outp[2];
> + struct scatterlist *p_aad;
> +
> + if (!aes->iv)
> + return -EINVAL;
> +
> + if (!((aes->key_len == AES_KEYSIZE_128) ||
> + (aes->key_len == AES_KEYSIZE_192) ||
> + (aes->key_len == AES_KEYSIZE_256)))
> + return -EINVAL;
> +
> + if (!aes->key) /* Gotta have a key SGL */
> + return -EINVAL;
> +
> + /* First, decompose the source buffer into AAD & PT,
> + * and the destination buffer into AAD, CT & tag, or
> + * the input into CT & tag.
> + * It is expected that the input and output SGs will
> + * be valid, even if the AAD and input lengths are 0.
> + */
> + p_aad = aes->src;
> + p_inp = scatterwalk_ffwd(sg_inp, aes->src, aes->aad_len);
> + p_outp = scatterwalk_ffwd(sg_outp, aes->dst, aes->aad_len);
> + if (aes->action == CCP_AES_ACTION_ENCRYPT) {
> + ilen = aes->src_len;
> + p_tag = scatterwalk_ffwd(sg_tag, p_outp, ilen);
> + } else {
> + /* Input length for decryption includes tag */
> + ilen = aes->src_len - AES_BLOCK_SIZE;
> + p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
> + }
> +
> + ret = -EIO;
No need to set ret here since it will be overwritten immediately below.
> + memset(&op, 0, sizeof(op));
> + op.cmd_q = cmd_q;
> + op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
> + op.sb_key = cmd_q->sb_key; /* Pre-allocated */
> + op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
> + op.init = 1;
> + op.u.aes.type = aes->type;
> +
> + /* Copy the key to the LSB */
> + ret = ccp_init_dm_workarea(&key, cmd_q,
> + CCP_AES_CTX_SB_COUNT * CCP_SB_BYTES,
> + DMA_TO_DEVICE);
> + if (ret)
> + return ret;
> +
> + dm_offset = CCP_SB_BYTES - aes->key_len;
> + ccp_set_dm_area(&key, dm_offset, aes->key, 0, aes->key_len);
> + ret = ccp_copy_to_sb(cmd_q, &key, op.jobid, op.sb_key,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_key;
> + }
> +
> + /* Copy the context (IV) to the LSB.
> + * There is an assumption here that the IV is 96 bits in length, plus
> + * a nonce of 32 bits. If no IV is present, use a zeroed buffer.
> + */
> + ret = ccp_init_dm_workarea(&ctx, cmd_q,
> + CCP_AES_CTX_SB_COUNT * CCP_SB_BYTES,
> + DMA_BIDIRECTIONAL);
> + if (ret)
> + goto e_key;
> +
> + dm_offset = CCP_AES_CTX_SB_COUNT * CCP_SB_BYTES - aes->iv_len;
> + ccp_set_dm_area(&ctx, dm_offset, aes->iv, 0, aes->iv_len);
> +
> + ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_ctx;
> + }
> +
> + op.init = 1;
> + if (aes->aad_len > 0) {
> + /* Step 1: Run a GHASH over the Additional Authenticated Data */
> + ret = ccp_init_data(&aad, cmd_q, p_aad, aes->aad_len,
> + AES_BLOCK_SIZE,
> + DMA_TO_DEVICE);
> + if (ret)
> + goto e_ctx;
> +
> + op.u.aes.mode = CCP_AES_MODE_GHASH;
> + op.u.aes.action = CCP_AES_GHASHAAD;
> +
> + while (aad.sg_wa.bytes_left) {
> + ccp_prepare_data(&aad, NULL, &op, AES_BLOCK_SIZE, true);
> +
> + ret = cmd_q->ccp->vdata->perform->aes(&op);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_aad;
> + }
> +
> + ccp_process_data(&aad, NULL, &op);
> + op.init = 0;
> + }
> + }
> +
> + op.u.aes.mode = CCP_AES_MODE_GCTR;
> + if (aes->action == CCP_AES_ACTION_ENCRYPT)
> + op.u.aes.action = CCP_AES_ACTION_ENCRYPT;
> + else
> + op.u.aes.action = CCP_AES_ACTION_DECRYPT;
Can't you just do op.u.aes.action = aes->action?
> +
> + if (ilen > 0) {
> + /* Step 2: Run a GCTR over the plaintext */
> + in_place = (sg_virt(p_inp) == sg_virt(p_outp)) ? true : false;
> +
> +
Extra blank line.
> + ret = ccp_init_data(&dst, cmd_q, p_outp, ilen,
> + AES_BLOCK_SIZE, DMA_FROM_DEVICE);
> + if (ret)
> + goto e_src;
I don't think you want this here since you do it again below if
!in_place.
Thanks,
Tom
> +
> + ret = ccp_init_data(&src, cmd_q, p_inp, ilen,
> + AES_BLOCK_SIZE,
> + in_place ? DMA_BIDIRECTIONAL
> + : DMA_TO_DEVICE);
> + if (ret)
> + goto e_ctx;
> +
> + if (in_place) {
> + dst = src;
> + } else {
> + ret = ccp_init_data(&dst, cmd_q, p_outp, ilen,
> + AES_BLOCK_SIZE, DMA_FROM_DEVICE);
> + if (ret)
> + goto e_src;
> + }
> +
> + op.soc = 0;
> + op.eom = 0;
> + op.init = 1;
> + while (src.sg_wa.bytes_left) {
> + ccp_prepare_data(&src, &dst, &op, AES_BLOCK_SIZE, true);
> + if (!src.sg_wa.bytes_left) {
> + unsigned int nbytes = aes->src_len
> + % AES_BLOCK_SIZE;
> +
> + if (nbytes) {
> + op.eom = 1;
> + op.u.aes.size = (nbytes * 8) - 1;
> + }
> + }
> +
> + ret = cmd_q->ccp->vdata->perform->aes(&op);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_dst;
> + }
> +
> + ccp_process_data(&src, &dst, &op);
> + op.init = 0;
> + }
> + }
> +
> + /* Step 3: Update the IV portion of the context with the original IV */
> + ret = ccp_copy_from_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_dst;
> + }
> +
> + ccp_set_dm_area(&ctx, dm_offset, aes->iv, 0, aes->iv_len);
> +
> + ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
> + CCP_PASSTHRU_BYTESWAP_256BIT);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_dst;
> + }
> +
> + /* Step 4: Concatenate the lengths of the AAD and source, and
> + * hash that 16 byte buffer.
> + */
> + ret = ccp_init_dm_workarea(&final_wa, cmd_q, AES_BLOCK_SIZE,
> + DMA_BIDIRECTIONAL);
> + if (ret)
> + goto e_dst;
> + final = (unsigned long long *) final_wa.address;
> + final[0] = cpu_to_be64(aes->aad_len * 8);
> + final[1] = cpu_to_be64(ilen * 8);
> +
> + op.u.aes.mode = CCP_AES_MODE_GHASH;
> + op.u.aes.action = CCP_AES_GHASHFINAL;
> + op.src.type = CCP_MEMTYPE_SYSTEM;
> + op.src.u.dma.address = final_wa.dma.address;
> + op.src.u.dma.length = AES_BLOCK_SIZE;
> + op.dst.type = CCP_MEMTYPE_SYSTEM;
> + op.dst.u.dma.address = final_wa.dma.address;
> + op.dst.u.dma.length = AES_BLOCK_SIZE;
> + op.eom = 1;
> + op.u.aes.size = 0;
> + ret = cmd_q->ccp->vdata->perform->aes(&op);
> + if (ret)
> + goto e_dst;
> +
> + if (aes->action == CCP_AES_ACTION_ENCRYPT) {
> + /* Put the ciphered tag after the ciphertext. */
> + ccp_get_dm_area(&final_wa, 0, p_tag, 0, AES_BLOCK_SIZE);
> + } else {
> + /* Does this ciphered tag match the input? */
> + ret = ccp_init_dm_workarea(&tag, cmd_q, AES_BLOCK_SIZE,
> + DMA_BIDIRECTIONAL);
> + if (ret)
> + goto e_tag;
> + ccp_set_dm_area(&tag, 0, p_tag, 0, AES_BLOCK_SIZE);
> +
> + ret = memcmp(tag.address, final_wa.address, AES_BLOCK_SIZE);
> + ccp_dm_free(&tag);
> + }
> +
> +e_tag:
> + ccp_dm_free(&final_wa);
> +
> +e_dst:
> + if (aes->src_len && !in_place)
> + ccp_free_data(&dst, cmd_q);
> +
> +e_src:
> + if (aes->src_len)
> + ccp_free_data(&src, cmd_q);
> +
> +e_aad:
> + if (aes->aad_len)
> + ccp_free_data(&aad, cmd_q);
> +
> +e_ctx:
> + ccp_dm_free(&ctx);
> +
> +e_key:
> + ccp_dm_free(&key);
> +
> + return ret;
> +}
> +
> static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> {
> struct ccp_aes_engine *aes = &cmd->u.aes;
> @@ -614,6 +873,9 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> if (aes->mode == CCP_AES_MODE_CMAC)
> return ccp_run_aes_cmac_cmd(cmd_q, cmd);
>
> + if (aes->mode == CCP_AES_MODE_GCM)
> + return ccp_run_aes_gcm_cmd(cmd_q, cmd);
> +
> if (!((aes->key_len == AES_KEYSIZE_128) ||
> (aes->key_len == AES_KEYSIZE_192) ||
> (aes->key_len == AES_KEYSIZE_256)))
> diff --git a/include/linux/ccp.h b/include/linux/ccp.h
> index d634565..f90f8ba 100644
> --- a/include/linux/ccp.h
> +++ b/include/linux/ccp.h
> @@ -124,6 +124,10 @@ enum ccp_aes_mode {
> CCP_AES_MODE_CFB,
> CCP_AES_MODE_CTR,
> CCP_AES_MODE_CMAC,
> + CCP_AES_MODE_GHASH,
> + CCP_AES_MODE_GCTR,
> + CCP_AES_MODE_GCM,
> + CCP_AES_MODE_GMAC,
> CCP_AES_MODE__LAST,
> };
>
> @@ -138,6 +142,9 @@ enum ccp_aes_action {
> CCP_AES_ACTION_ENCRYPT,
> CCP_AES_ACTION__LAST,
> };
> +/* Overloaded field */
> +#define CCP_AES_GHASHAAD CCP_AES_ACTION_DECRYPT
> +#define CCP_AES_GHASHFINAL CCP_AES_ACTION_ENCRYPT
>
> /**
> * struct ccp_aes_engine - CCP AES operation
> @@ -182,6 +189,8 @@ struct ccp_aes_engine {
> struct scatterlist *cmac_key; /* K1/K2 cmac key required for
> * final cmac cmd */
> u32 cmac_key_len; /* In bytes */
> +
> + u32 aad_len; /* In bytes */
> };
>
> /***** XTS-AES engine *****/
>
^ permalink raw reply
* Re: [PATCH 4/6] crypto: ccp - Add RSA support for a v5 ccp
From: Tom Lendacky @ 2016-10-13 21:23 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145319.19759.70911.stgit@taos>
On 10/13/2016 09:53 AM, Gary R Hook wrote:
> Take into account device implementation differences for
> RSA.
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/ccp-crypto-rsa.c | 14 +++--
> drivers/crypto/ccp/ccp-crypto.h | 3 -
> drivers/crypto/ccp/ccp-dev.h | 2 -
> drivers/crypto/ccp/ccp-ops.c | 97 +++++++++++++++++++++++------------
> 4 files changed, 73 insertions(+), 43 deletions(-)
>
> diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c
> index 7dab43b..94411de 100644
> --- a/drivers/crypto/ccp/ccp-crypto-rsa.c
> +++ b/drivers/crypto/ccp/ccp-crypto-rsa.c
> @@ -125,7 +125,7 @@ static void ccp_rsa_free_key_bufs(struct ccp_ctx *ctx)
> }
>
> static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
> - unsigned int keylen, bool public)
> + unsigned int keylen, bool private)
> {
> struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> struct rsa_key raw_key;
> @@ -139,10 +139,10 @@ static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
> memset(&raw_key, 0, sizeof(raw_key));
>
> /* Code borrowed from crypto/rsa.c */
> - if (public)
> - ret = rsa_parse_pub_key(&raw_key, key, keylen);
> - else
> + if (private)
> ret = rsa_parse_priv_key(&raw_key, key, keylen);
> + else
> + ret = rsa_parse_pub_key(&raw_key, key, keylen);
> if (ret)
> goto e_ret;
>
> @@ -169,7 +169,7 @@ static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
> goto e_nkey;
> sg_init_one(&ctx->u.rsa.n_sg, ctx->u.rsa.n_buf, ctx->u.rsa.n_len);
>
> - if (!public) {
> + if (private) {
> ctx->u.rsa.pkey.d = mpi_read_raw_data(raw_key.d, raw_key.d_sz);
> if (!ctx->u.rsa.pkey.d)
> goto e_nkey;
> @@ -196,13 +196,13 @@ e_ret:
> static int ccp_rsa_setprivkey(struct crypto_akcipher *tfm, const void *key,
> unsigned int keylen)
> {
> - return ccp_rsa_setkey(tfm, key, keylen, false);
> + return ccp_rsa_setkey(tfm, key, keylen, true);
> }
>
> static int ccp_rsa_setpubkey(struct crypto_akcipher *tfm, const void *key,
> unsigned int keylen)
> {
> - return ccp_rsa_setkey(tfm, key, keylen, true);
> + return ccp_rsa_setkey(tfm, key, keylen, false);
> }
>
> static int ccp_rsa_init_tfm(struct crypto_akcipher *tfm)
> diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
> index 4a1d206..c6cf318 100644
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -138,8 +138,7 @@ struct ccp_aes_cmac_exp_ctx {
> u8 buf[AES_BLOCK_SIZE];
> };
>
> -/*
> - * SHA-related defines
> +/* SHA-related defines
Shouldn't be part of this patch.
> * These values must be large enough to accommodate any variant
> */
> #define MAX_SHA_CONTEXT_SIZE SHA512_DIGEST_SIZE
> diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
> index 0d996fe..143f00f 100644
> --- a/drivers/crypto/ccp/ccp-dev.h
> +++ b/drivers/crypto/ccp/ccp-dev.h
> @@ -193,6 +193,7 @@
> #define CCP_SHA_SB_COUNT 1
>
> #define CCP_RSA_MAX_WIDTH 4096
> +#define CCP5_RSA_MAX_WIDTH 16384
>
> #define CCP_PASSTHRU_BLOCKSIZE 256
> #define CCP_PASSTHRU_MASKSIZE 32
> @@ -515,7 +516,6 @@ struct ccp_op {
> struct ccp_passthru_op passthru;
> struct ccp_ecc_op ecc;
> } u;
> - struct ccp_mem key;
This should probably be part of a cleanup patch.
> };
>
> static inline u32 ccp_addr_lo(struct ccp_dma_info *info)
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 826782d..07b8dfb 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -1283,49 +1283,72 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> int i = 0;
> int ret = 0;
>
> - if (rsa->key_size > CCP_RSA_MAX_WIDTH)
> - return -EINVAL;
> + if (cmd_q->ccp->vdata->version < CCP_VERSION(4, 0)) {
> + if (rsa->key_size > CCP_RSA_MAX_WIDTH)
> + return -EINVAL;
> + } else {
> + if (rsa->key_size > CCP5_RSA_MAX_WIDTH)
> + return -EINVAL;
> + }
Might be able to actually add the max supported key size to the
version data and simplify the check here.
>
> if (!rsa->exp || !rsa->mod || !rsa->src || !rsa->dst)
> return -EINVAL;
>
> - /* The RSA modulus must precede the message being acted upon, so
> - * it must be copied to a DMA area where the message and the
> - * modulus can be concatenated. Therefore the input buffer
> - * length required is twice the output buffer length (which
> - * must be a multiple of 256-bits).
> - */
> - o_len = ((rsa->key_size + 255) / 256) * 32;
> - i_len = o_len * 2;
> -
> - sb_count = o_len / CCP_SB_BYTES;
> -
> memset(&op, 0, sizeof(op));
> op.cmd_q = cmd_q;
> - op.jobid = ccp_gen_jobid(cmd_q->ccp);
> - op.sb_key = cmd_q->ccp->vdata->perform->sballoc(cmd_q, sb_count);
> + op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
>
> - if (!op.sb_key)
> - return -EIO;
> + if (cmd_q->ccp->vdata->version < CCP_VERSION(4, 0)) {
> + /* The RSA modulus must precede the message being acted upon, so
> + * it must be copied to a DMA area where the message and the
> + * modulus can be concatenated. Therefore the input buffer
> + * length required is twice the output buffer length (which
> + * must be a multiple of 256-bits).
> + */
> + sb_count = (rsa->key_size + CCP_SB_BYTES - 1) / CCP_SB_BYTES;
> + o_len = sb_count * 32; /* bytes */
> + i_len = o_len * 2; /* bytes */
> +
> + op.sb_key = cmd_q->ccp->vdata->perform->sballoc(cmd_q,
> + sb_count);
> + if (!op.sb_key)
> + return -EIO;
> + } else {
> + /* A version 5 device allows the key to be in memory */
> + o_len = rsa->mod_len;
> + i_len = o_len * 2; /* bytes */
> + op.sb_key = cmd_q->sb_key;
> + }
>
> - /* The RSA exponent may span multiple (32-byte) SB entries and must
> - * be in little endian format. Reverse copy each 32-byte chunk
> - * of the exponent (En chunk to E0 chunk, E(n-1) chunk to E1 chunk)
> - * and each byte within that chunk and do not perform any byte swap
> - * operations on the passthru operation.
> - */
> ret = ccp_init_dm_workarea(&exp, cmd_q, o_len, DMA_TO_DEVICE);
> if (ret)
> goto e_sb;
>
> - ret = ccp_reverse_set_dm_area(&exp, 0, rsa->exp, 0, rsa->exp_len);
> + if (rsa->mode == CCP_RSA_ENCRYPT)
> + ret = ccp_reverse_set_dm_area(&exp, 0, rsa->exp, 0,
> + rsa->exp_len);
> + else
> + ret = ccp_reverse_set_dm_area(&exp, 0, rsa->d_sg, 0,
> + rsa->d_len);
This goes with the comment in the previous patch where you just need to
pass in one of these - the one to be used in the operation.
> if (ret)
> goto e_exp;
> - ret = ccp_copy_to_sb(cmd_q, &exp, op.jobid, op.sb_key,
> - CCP_PASSTHRU_BYTESWAP_NOOP);
> - if (ret) {
> - cmd->engine_error = cmd_q->cmd_error;
> - goto e_exp;
> +
> + if (cmd_q->ccp->vdata->version < CCP_VERSION(4, 0)) {
> + /* The RSA exponent may span multiple (32-byte) KSB entries and
> + * must be in little endian format. Reverse copy each 32-byte
> + * chunk of the exponent (En chunk to E0 chunk, E(n-1) chunk to
> + * E1 chunk) and each byte within that chunk and do not perform
> + * any byte swap operations on the passthru operation.
> + */
> + ret = ccp_copy_to_sb(cmd_q, &exp, op.jobid, op.sb_key,
> + CCP_PASSTHRU_BYTESWAP_NOOP);
> + if (ret) {
> + cmd->engine_error = cmd_q->cmd_error;
> + goto e_exp;
> + }
> + } else {
> + op.exp.u.dma.address = exp.dma.address;
> + op.exp.u.dma.offset = 0;
> }
>
> /* Concatenate the modulus and the message. Both the modulus and
> @@ -1345,7 +1368,7 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> src.address -= o_len; /* Reset the address to original value */
>
> /* Prepare the output area for the operation */
> - ret = ccp_init_data(&dst, cmd_q, rsa->dst, rsa->mod_len,
> + ret = ccp_init_data(&dst, cmd_q, rsa->dst, rsa->dst_len,
> o_len, DMA_FROM_DEVICE);
> if (ret)
> goto e_src;
> @@ -1358,7 +1381,10 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> op.dst.u.dma.offset = 0;
> op.dst.u.dma.length = o_len;
>
> - op.u.rsa.mod_size = rsa->key_size;
> + if (cmd_q->ccp->vdata->version < CCP_VERSION(4, 0))
> + op.u.rsa.mod_size = rsa->key_size * 8; /* In bits */
> + else
> + op.u.rsa.mod_size = rsa->key_size;
> op.u.rsa.input_len = i_len;
>
> ret = cmd_q->ccp->vdata->perform->rsa(&op);
> @@ -1366,8 +1392,12 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> cmd->engine_error = cmd_q->cmd_error;
> goto e_dst;
> }
> + /* Return the length of the result, too */
> + for (i = o_len; !dst.dm_wa.address[--i]; )
> + ;
> + rsa->d_len = i + 1;
The output length will always be o_len in size. If the crypto api
requires the removal of leading zeroes you should do that at the
ccp crypto api layer.
Thanks,
Tom
>
> - ccp_reverse_get_dm_area(&dst.dm_wa, 0, rsa->dst, 0, rsa->mod_len);
> + ccp_reverse_get_dm_area(&dst.dm_wa, 0, rsa->dst, 0, rsa->d_len);
>
> e_dst:
> ccp_free_data(&dst, cmd_q);
> @@ -1379,7 +1409,8 @@ e_exp:
> ccp_dm_free(&exp);
>
> e_sb:
> - cmd_q->ccp->vdata->perform->sbfree(cmd_q, op.sb_key, sb_count);
> + if (cmd_q->ccp->vdata->version < CCP_VERSION(4, 0))
> + cmd_q->ccp->vdata->perform->sbfree(cmd_q, op.sb_key, sb_count);
>
> return ret;
> }
>
^ permalink raw reply
* Re: [PATCH 3/6] crypto: ccp - Add support for RSA on the CCP
From: Tom Lendacky @ 2016-10-13 21:06 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145309.19759.18493.stgit@taos>
On 10/13/2016 09:53 AM, Gary R Hook wrote:
> Wire up the v3 CCP as a cipher provider.
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/Makefile | 1
> drivers/crypto/ccp/ccp-crypto-main.c | 15 ++
> drivers/crypto/ccp/ccp-crypto-rsa.c | 258 ++++++++++++++++++++++++++++++++++
> drivers/crypto/ccp/ccp-crypto.h | 24 +++
> drivers/crypto/ccp/ccp-dev-v3.c | 38 +++++
> drivers/crypto/ccp/ccp-ops.c | 1
> include/linux/ccp.h | 34 ++++
> 7 files changed, 370 insertions(+), 1 deletion(-)
> create mode 100644 drivers/crypto/ccp/ccp-crypto-rsa.c
>
> diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile
> index 346ceb8..23f89b7 100644
> --- a/drivers/crypto/ccp/Makefile
> +++ b/drivers/crypto/ccp/Makefile
> @@ -12,4 +12,5 @@ ccp-crypto-objs := ccp-crypto-main.o \
> ccp-crypto-aes.o \
> ccp-crypto-aes-cmac.o \
> ccp-crypto-aes-xts.o \
> + ccp-crypto-rsa.o \
> ccp-crypto-sha.o
> diff --git a/drivers/crypto/ccp/ccp-crypto-main.c b/drivers/crypto/ccp/ccp-crypto-main.c
> index e0380e5..f3c4c25 100644
> --- a/drivers/crypto/ccp/ccp-crypto-main.c
> +++ b/drivers/crypto/ccp/ccp-crypto-main.c
> @@ -33,6 +33,10 @@ static unsigned int sha_disable;
> module_param(sha_disable, uint, 0444);
> MODULE_PARM_DESC(sha_disable, "Disable use of SHA - any non-zero value");
>
> +static unsigned int rsa_disable;
> +module_param(rsa_disable, uint, 0444);
> +MODULE_PARM_DESC(rsa_disable, "Disable use of RSA - any non-zero value");
> +
> /* List heads for the supported algorithms */
> static LIST_HEAD(hash_algs);
> static LIST_HEAD(cipher_algs);
> @@ -343,6 +347,14 @@ static int ccp_register_algs(void)
> return ret;
> }
>
> + if (!rsa_disable) {
> + ret = ccp_register_rsa_algs();
> + if (ret) {
> + rsa_disable = 1;
> + return ret;
> + }
> + }
> +
> return 0;
> }
>
> @@ -362,6 +374,9 @@ static void ccp_unregister_algs(void)
> list_del(&ablk_alg->entry);
> kfree(ablk_alg);
> }
> +
> + if (!rsa_disable)
> + ccp_unregister_rsa_algs();
> }
>
> static int ccp_crypto_init(void)
> diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c
> new file mode 100644
> index 0000000..7dab43b
> --- /dev/null
> +++ b/drivers/crypto/ccp/ccp-crypto-rsa.c
> @@ -0,0 +1,258 @@
> +/*
> + * AMD Cryptographic Coprocessor (CCP) RSA crypto API support
> + *
> + * Copyright (C) 2016 Advanced Micro Devices, Inc.
> + *
> + * Author: Gary R Hook <gary.hook@amd.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/module.h>
> +#include <linux/sched.h>
> +#include <linux/mpi.h>
> +#include <linux/scatterlist.h>
> +#include <linux/crypto.h>
> +#include <crypto/algapi.h>
> +#include <crypto/internal/akcipher.h>
> +#include <crypto/akcipher.h>
> +#include <crypto/scatterwalk.h>
> +
> +#include "ccp-crypto.h"
> +
> +static inline struct akcipher_request *akcipher_request_cast(
> + struct crypto_async_request *req)
> +{
> + return container_of(req, struct akcipher_request, base);
> +}
> +
> +static int ccp_rsa_complete(struct crypto_async_request *async_req, int ret)
> +{
> + struct akcipher_request *req = akcipher_request_cast(async_req);
> + struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
> +
> + if (!ret)
> + req->dst_len = rctx->cmd.u.rsa.d_len;
> +
> + ret = 0;
> +
> + return ret;
> +}
> +
> +static int ccp_rsa_maxsize(struct crypto_akcipher *tfm)
> +{
> + return CCP_RSA_MAXMOD;
> +}
> +
> +static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt)
> +{
> + struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> + struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
> + int ret = 0;
> +
> + if (!ctx->u.rsa.pkey.d && !ctx->u.rsa.pkey.e)
> + return -EINVAL;
> +
> + memset(&rctx->cmd, 0, sizeof(rctx->cmd));
> + INIT_LIST_HEAD(&rctx->cmd.entry);
> + rctx->cmd.engine = CCP_ENGINE_RSA;
> + rctx->cmd.u.rsa.mode = encrypt ? CCP_RSA_ENCRYPT : CCP_RSA_DECRYPT;
> +
> + rctx->cmd.u.rsa.pkey = ctx->u.rsa.pkey;
> + rctx->cmd.u.rsa.key_size = ctx->u.rsa.key_len;
The existing interface expects the key_size to be in bits, so you'll
need to multiply this by 8.
> + rctx->cmd.u.rsa.exp = &ctx->u.rsa.e_sg;
> + rctx->cmd.u.rsa.exp_len = ctx->u.rsa.e_len;
> + rctx->cmd.u.rsa.mod = &ctx->u.rsa.n_sg;
> + rctx->cmd.u.rsa.mod_len = ctx->u.rsa.n_len;
> + if (ctx->u.rsa.pkey.d) {
> + rctx->cmd.u.rsa.d_sg = &ctx->u.rsa.d_sg;
> + rctx->cmd.u.rsa.d_len = ctx->u.rsa.d_len;
> + }
> +
> + rctx->cmd.u.rsa.src = req->src;
> + rctx->cmd.u.rsa.src_len = req->src_len;
> + rctx->cmd.u.rsa.dst = req->dst;
> + rctx->cmd.u.rsa.dst_len = req->dst_len;
So rsa.pkey, rsa.d_sg and rsa.d_len have been added and are being set,
but the ccp-ops function hasn't been updated to use them (yet). Will
this be successful then? Will pkey be needed in the request context?
If the only difference between encrypt and decrypt is what key to
use, then the rsa request context doesn't need to change at all. Just
set the appropriate key at this layer.
> +
> + ret = ccp_crypto_enqueue_request(&req->base, &rctx->cmd);
> +
> + return ret;
> +}
> +
> +static int ccp_rsa_encrypt(struct akcipher_request *req)
> +{
> + return ccp_rsa_crypt(req, true);
> +}
> +
> +static int ccp_rsa_decrypt(struct akcipher_request *req)
> +{
> + return ccp_rsa_crypt(req, false);
> +}
> +
> +static void ccp_free_mpi_key(struct ccp_rsa_key *key)
> +{
> + mpi_free(key->d);
> + key->d = NULL;
> + mpi_free(key->e);
> + key->e = NULL;
> + mpi_free(key->n);
> + key->n = NULL;
> +}
> +
> +static int ccp_check_key_length(unsigned int len)
> +{
> + /* In bits */
> + if (len < 8 || len > 16384)
> + return -EINVAL;
> + return 0;
> +}
> +
> +static void ccp_rsa_free_key_bufs(struct ccp_ctx *ctx)
> +{
> + /* Clean up old key data */
> + kfree(ctx->u.rsa.e_buf);
> + ctx->u.rsa.e_buf = NULL;
> + ctx->u.rsa.e_len = 0;
> + kfree(ctx->u.rsa.n_buf);
> + ctx->u.rsa.n_buf = NULL;
> + ctx->u.rsa.n_len = 0;
> + kfree(ctx->u.rsa.d_buf);
> + ctx->u.rsa.d_buf = NULL;
> + ctx->u.rsa.d_len = 0;
> +}
> +
> +static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen, bool public)
> +{
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> + struct rsa_key raw_key;
> + unsigned int n_size;
> + int ret;
> +
> + if (!ctx)
> + return -EINVAL;
> +
> + ccp_rsa_free_key_bufs(ctx);
> + memset(&raw_key, 0, sizeof(raw_key));
> +
> + /* Code borrowed from crypto/rsa.c */
> + if (public)
> + ret = rsa_parse_pub_key(&raw_key, key, keylen);
> + else
> + ret = rsa_parse_priv_key(&raw_key, key, keylen);
> + if (ret)
> + goto e_ret;
> +
> + ret = -EINVAL;
> +
> + ctx->u.rsa.pkey.e = mpi_read_raw_data(raw_key.e, raw_key.e_sz);
> + if (!ctx->u.rsa.pkey.e)
> + goto e_ret;
> + ctx->u.rsa.e_buf = mpi_get_buffer(ctx->u.rsa.pkey.e,
> + &ctx->u.rsa.e_len, NULL);
> + if (!ctx->u.rsa.e_buf)
> + goto e_key;
> + sg_init_one(&ctx->u.rsa.e_sg, ctx->u.rsa.e_buf, ctx->u.rsa.e_len);
> +
> +
Extra blank line.
> + ctx->u.rsa.pkey.n = mpi_read_raw_data(raw_key.n, raw_key.n_sz);
> + n_size = mpi_get_size(ctx->u.rsa.pkey.n);
> + if (ccp_check_key_length(n_size << 3))
> + goto e_key;
Should this be goto e_nkey?
> + ctx->u.rsa.key_len = n_size;
> + ctx->u.rsa.n_buf = mpi_get_buffer(ctx->u.rsa.pkey.n,
> + &ctx->u.rsa.n_len, NULL);
> + if (!ctx->u.rsa.n_buf)
> + goto e_nkey;
> + sg_init_one(&ctx->u.rsa.n_sg, ctx->u.rsa.n_buf, ctx->u.rsa.n_len);
> +
> + if (!public) {
> + ctx->u.rsa.pkey.d = mpi_read_raw_data(raw_key.d, raw_key.d_sz);
> + if (!ctx->u.rsa.pkey.d)
> + goto e_nkey;
Should this be goto e_dkey?
> + ctx->u.rsa.d_buf = mpi_get_buffer(ctx->u.rsa.pkey.d,
> + &ctx->u.rsa.d_len, NULL);
> + if (!ctx->u.rsa.d_buf)
> + goto e_dkey;
> + sg_init_one(&ctx->u.rsa.d_sg, ctx->u.rsa.d_buf,
> + ctx->u.rsa.d_len);
> + }
> +
> + return 0;
> +
> +e_dkey:
> + kfree(ctx->u.rsa.n_buf);
> +e_nkey:
> + kfree(ctx->u.rsa.e_buf);
> +e_key:
> + ccp_free_mpi_key(&ctx->u.rsa.pkey);
> +e_ret:
> + return ret;
> +}
> +
> +static int ccp_rsa_setprivkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen)
> +{
> + return ccp_rsa_setkey(tfm, key, keylen, false);
> +}
> +
> +static int ccp_rsa_setpubkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen)
> +{
> + return ccp_rsa_setkey(tfm, key, keylen, true);
> +}
> +
> +static int ccp_rsa_init_tfm(struct crypto_akcipher *tfm)
> +{
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> +
> + ctx->complete = ccp_rsa_complete;
> +
> + return 0;
> +}
> +
> +static void ccp_rsa_exit_tfm(struct crypto_akcipher *tfm)
> +{
> + struct ccp_ctx *ctx = crypto_tfm_ctx(&tfm->base);
> +
> + ccp_rsa_free_key_bufs(ctx);
> +}
> +
> +static struct akcipher_alg rsa = {
> + .encrypt = ccp_rsa_encrypt,
> + .decrypt = ccp_rsa_decrypt,
> + .sign = NULL,
> + .verify = NULL,
> + .set_pub_key = ccp_rsa_setpubkey,
> + .set_priv_key = ccp_rsa_setprivkey,
> + .max_size = ccp_rsa_maxsize,
> + .init = ccp_rsa_init_tfm,
> + .exit = ccp_rsa_exit_tfm,
> + .reqsize = sizeof(struct ccp_rsa_req_ctx),
> + .base = {
> + .cra_name = "rsa",
> + .cra_driver_name = "rsa-ccp",
> + .cra_priority = 100,
> + .cra_module = THIS_MODULE,
> + .cra_ctxsize = sizeof(struct ccp_ctx),
> + },
> +};
> +
> +int ccp_register_rsa_algs(void)
> +{
> + int ret;
> +
> + /* Register the RSA algorithm in standard mode
> + * This works for CCP v3 and later
> + */
> + ret = crypto_register_akcipher(&rsa);
> + return ret;
> +}
> +
> +void ccp_unregister_rsa_algs(void)
> +{
> + crypto_unregister_akcipher(&rsa);
> +}
> diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
> index ae442ac..4a1d206 100644
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -22,6 +22,7 @@
> #include <crypto/ctr.h>
> #include <crypto/hash.h>
> #include <crypto/sha.h>
> +#include <crypto/internal/rsa.h>
>
> #define CCP_CRA_PRIORITY 300
>
> @@ -155,6 +156,26 @@ struct ccp_sha_ctx {
> struct crypto_shash *hmac_tfm;
> };
>
> +/***** RSA related defines *****/
> +
> +struct ccp_rsa_ctx {
> + unsigned int key_len; /* in bytes */
> + struct ccp_rsa_key pkey;
> + struct scatterlist e_sg;
> + u8 *e_buf;
> + unsigned int e_len;
> + struct scatterlist n_sg;
> + u8 *n_buf;
> + unsigned int n_len;
> + struct scatterlist d_sg;
> + u8 *d_buf;
> + unsigned int d_len;
> +};
> +
> +struct ccp_rsa_req_ctx {
> + struct ccp_cmd cmd;
> +};
> +
Is this block of RSA info dropped in the middle of the SHA
related info?
> struct ccp_sha_req_ctx {
> enum ccp_sha_type type;
>
> @@ -201,6 +222,7 @@ struct ccp_ctx {
>
> union {
> struct ccp_aes_ctx aes;
> + struct ccp_rsa_ctx rsa;
> struct ccp_sha_ctx sha;
> } u;
> };
> @@ -214,5 +236,7 @@ int ccp_register_aes_algs(struct list_head *head);
> int ccp_register_aes_cmac_algs(struct list_head *head);
> int ccp_register_aes_xts_algs(struct list_head *head);
> int ccp_register_sha_algs(struct list_head *head);
> +int ccp_register_rsa_algs(void);
> +void ccp_unregister_rsa_algs(void);
>
> #endif
> diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
> index 8d2dbac..75a0978 100644
> --- a/drivers/crypto/ccp/ccp-dev-v3.c
> +++ b/drivers/crypto/ccp/ccp-dev-v3.c
> @@ -20,6 +20,43 @@
>
> #include "ccp-dev.h"
>
> +/* CCP version 3: Union to define the function field (cmd_reg1/dword0) */
> +union ccp_function {
> + struct {
> + u16 size:7;
> + u16 encrypt:1;
> + u16 mode:3;
> + u16 type:2;
> + } aes;
> + struct {
> + u16 size:7;
> + u16 encrypt:1;
> + u16 rsvd:5;
> + } aes_xts;
> + struct {
> + u16 rsvd1:11;
> + u16 type:2;
> + } sha;
> + struct {
> + u16 size:13;
> + } rsa;
> + struct {
> + u16 byteswap:2;
> + u16 bitwise:3;
> + u16 rsvd:8;
> + } pt;
> + struct {
> + u16 rsvd:13;
> + } zlib;
> + struct {
> + u16 size:8;
> + u16 mode:3;
> + u16 rsvd1:1;
> + u16 rsvd2:1;
> + } ecc;
> + u16 raw;
> +};
> +
This whole block should be removed.
> static u32 ccp_alloc_ksb(struct ccp_cmd_queue *cmd_q, unsigned int count)
> {
> int start;
> @@ -88,6 +125,7 @@ static int ccp_do_cmd(struct ccp_op *op, u32 *cr, unsigned int cr_count)
> * are actually available, but reading that register resets it
> * and you could lose some error information.
> */
> +
As should this. No changes for ccp-dev-v3.c should be in this patch.
> cmd_q->free_slots--;
>
> cr0 = (cmd_q->id << REQ0_CMD_Q_SHIFT)
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 82cc637..826782d 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -17,6 +17,7 @@
> #include <linux/interrupt.h>
> #include <crypto/scatterwalk.h>
> #include <linux/ccp.h>
> +#include <linux/delay.h>
What's this here for?
>
> #include "ccp-dev.h"
>
> diff --git a/include/linux/ccp.h b/include/linux/ccp.h
> index 1a3e0b5..d634565 100644
> --- a/include/linux/ccp.h
> +++ b/include/linux/ccp.h
> @@ -19,7 +19,8 @@
> #include <linux/list.h>
> #include <crypto/aes.h>
> #include <crypto/sha.h>
> -
> +#include <linux/mpi.h>
> +#include <crypto/internal/rsa.h>
>
> struct ccp_device;
> struct ccp_cmd;
> @@ -293,6 +294,27 @@ struct ccp_sha_engine {
> * final sha cmd */
> };
>
> +/**
> + * ccp_rsa_type - mode of RSA operation
> + *
> + * @CCP_RSA_MODE_STD: standard mode
> + */
> +enum ccp_rsa_mode {
> + CCP_RSA_ENCRYPT = 0,
> + CCP_RSA_DECRYPT,
> + CCP_RSA__LAST,
> +};
> +
> +struct ccp_rsa_key {
> + MPI e;
> + MPI n;
> + MPI d;
> +};
> +
> +#define CCP_RSA_MAXMOD (4 * 1024 / 8)
> +#define CCP5_RSA_MAXMOD (16 * 1024 / 8)
> +#define CCP5_RSA_MINMOD (512 / 8)
> +
> /***** RSA engine *****/
> /**
> * struct ccp_rsa_engine - CCP RSA operation
> @@ -309,16 +331,26 @@ struct ccp_sha_engine {
> * - key_size, exp, exp_len, mod, mod_len, src, dst, src_len
> */
> struct ccp_rsa_engine {
> + enum ccp_rsa_mode mode;
> u32 key_size; /* In bits */
>
> + struct ccp_rsa_key pkey;
> +
> +/* e */
> struct scatterlist *exp;
> u32 exp_len; /* In bytes */
>
> +/* n */
> struct scatterlist *mod;
> u32 mod_len; /* In bytes */
>
> +/* d */
> + struct scatterlist *d_sg;
> + unsigned int d_len;
> +
> struct scatterlist *src, *dst;
> u32 src_len; /* In bytes */
> + u32 dst_len; /* In bytes */
> };
>
As mentioned above, I think you don't need to make any changes to this
request context if you take care of things in ccp crypto api layer
(except for maybe dst_len?).
Thanks,
Tom
> /***** Passthru engine *****/
>
^ permalink raw reply
* Re: [PATCH 3/6] crypto: ccp - Add support for RSA on the CCP
From: Stephan Mueller @ 2016-10-13 20:14 UTC (permalink / raw)
To: Gary R Hook; +Cc: Gary R Hook, linux-crypto, thomas.lendacky, herbert, davem
In-Reply-To: <8b8ed058-6512-ab28-446b-3c32bf91fcb0@amd.com>
Am Donnerstag, 13. Oktober 2016, 15:08:41 CEST schrieb Gary R Hook:
Hi Gary,
> On 10/13/2016 01:25 PM, Stephan Mueller wrote:
> > Am Donnerstag, 13. Oktober 2016, 09:53:09 CEST schrieb Gary R Hook:
> >
> > Hi Gary,
> >
> >> Wire up the v3 CCP as a cipher provider.
> >>
> >> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> >> ---
> >>
> >> ...snip...
> >>
> >> +}
> >> +
> >> +static void ccp_free_mpi_key(struct ccp_rsa_key *key)
> >> +{
> >> + mpi_free(key->d);
> >> + key->d = NULL;
> >> + mpi_free(key->e);
> >> + key->e = NULL;
> >> + mpi_free(key->n);
> >> + key->n = NULL;
> >> +}
> >
> > Could you please see whether that function can be turned into a common
> > function call? crypto/rsa.c implements the same code in rsa_free_mpi_key.
>
> I am happy to do so, but was unsure of protocol. rsa.c is in a module, which
> makes my module depend upon another. I do not want to do that. And moving
> this function elsewhere makes no sense.
>
> I would go with an inline function, but there's no obvious place for it.
> The RSA software implementation uses the MPI library, but there's no
> requirement to do so (witness the qat driver). Thus, an inline function
> can't
> be put in internal/rsa.h without moving the rsa_mpi_key definition and
> referencing mpi.h.
>
> I think that RSA+MPI things, such as rsa_mpi_key and this function, could go
> into internal/rsa.h, but it would be necessary to #include mpi.h.
>
> Or: create a new include file that contains these (and any other) RSA/MPI
> amalgams.
>
> Which would you prefer?
I would guess it should go to include/crypto/internal/rsa.h as an inline
considering that the "internal" header files are for crypto provider code.
Ciao
Stephan
^ permalink raw reply
* Re: [PATCH 1/6] crypto: ccp - Add SHA-2 support
From: Tom Lendacky @ 2016-10-13 19:35 UTC (permalink / raw)
To: Gary R Hook, linux-crypto; +Cc: herbert, davem
In-Reply-To: <20161013145248.19759.23166.stgit@taos>
On 10/13/2016 09:52 AM, Gary R Hook wrote:
> Incorporate 384-bit and 512-bit hashing for a version 5 CCP
> device
>
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/ccp-crypto-sha.c | 22 +++++++++++
> drivers/crypto/ccp/ccp-crypto.h | 9 +++--
> drivers/crypto/ccp/ccp-ops.c | 70 +++++++++++++++++++++++++++++++++++
> include/linux/ccp.h | 3 ++
> 4 files changed, 101 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
> index 84a652b..6b46eea 100644
> --- a/drivers/crypto/ccp/ccp-crypto-sha.c
> +++ b/drivers/crypto/ccp/ccp-crypto-sha.c
> @@ -146,6 +146,12 @@ static int ccp_do_sha_update(struct ahash_request *req, unsigned int nbytes,
> case CCP_SHA_TYPE_256:
> rctx->cmd.u.sha.ctx_len = SHA256_DIGEST_SIZE;
> break;
> + case CCP_SHA_TYPE_384:
> + rctx->cmd.u.sha.ctx_len = SHA384_DIGEST_SIZE;
> + break;
> + case CCP_SHA_TYPE_512:
> + rctx->cmd.u.sha.ctx_len = SHA512_DIGEST_SIZE;
> + break;
> default:
> /* Should never get here */
> break;
> @@ -393,6 +399,22 @@ static struct ccp_sha_def sha_algs[] = {
> .digest_size = SHA256_DIGEST_SIZE,
> .block_size = SHA256_BLOCK_SIZE,
> },
> + {
> + .version = CCP_VERSION(5, 0),
> + .name = "sha384",
> + .drv_name = "sha384-ccp",
> + .type = CCP_SHA_TYPE_384,
> + .digest_size = SHA384_DIGEST_SIZE,
> + .block_size = SHA384_BLOCK_SIZE,
> + },
> + {
> + .version = CCP_VERSION(5, 0),
> + .name = "sha512",
> + .drv_name = "sha512-ccp",
> + .type = CCP_SHA_TYPE_512,
> + .digest_size = SHA512_DIGEST_SIZE,
> + .block_size = SHA512_BLOCK_SIZE,
> + },
> };
>
> static int ccp_register_hmac_alg(struct list_head *head,
> diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
> index 8335b32..ae442ac 100644
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -137,9 +137,12 @@ struct ccp_aes_cmac_exp_ctx {
> u8 buf[AES_BLOCK_SIZE];
> };
>
> -/***** SHA related defines *****/
> -#define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE
> -#define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE
> +/*
> + * SHA-related defines
> + * These values must be large enough to accommodate any variant
> + */
> +#define MAX_SHA_CONTEXT_SIZE SHA512_DIGEST_SIZE
> +#define MAX_SHA_BLOCK_SIZE SHA512_BLOCK_SIZE
>
> struct ccp_sha_ctx {
> struct scatterlist opad_sg;
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 50fae44..8fedb14 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -41,6 +41,20 @@ static const __be32 ccp_sha256_init[SHA256_DIGEST_SIZE / sizeof(__be32)] = {
> cpu_to_be32(SHA256_H6), cpu_to_be32(SHA256_H7),
> };
>
> +static const __be64 ccp_sha384_init[SHA512_DIGEST_SIZE / sizeof(__be64)] = {
> + cpu_to_be64(SHA384_H0), cpu_to_be64(SHA384_H1),
> + cpu_to_be64(SHA384_H2), cpu_to_be64(SHA384_H3),
> + cpu_to_be64(SHA384_H4), cpu_to_be64(SHA384_H5),
> + cpu_to_be64(SHA384_H6), cpu_to_be64(SHA384_H7),
> +};
> +
> +static const __be64 ccp_sha512_init[SHA512_DIGEST_SIZE / sizeof(__be64)] = {
> + cpu_to_be64(SHA512_H0), cpu_to_be64(SHA512_H1),
> + cpu_to_be64(SHA512_H2), cpu_to_be64(SHA512_H3),
> + cpu_to_be64(SHA512_H4), cpu_to_be64(SHA512_H5),
> + cpu_to_be64(SHA512_H6), cpu_to_be64(SHA512_H7),
> +};
> +
> #define CCP_NEW_JOBID(ccp) ((ccp->vdata->version == CCP_VERSION(3, 0)) ? \
> ccp_gen_jobid(ccp) : 0)
>
> @@ -963,6 +977,16 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> return -EINVAL;
> block_size = SHA256_BLOCK_SIZE;
> break;
> + case CCP_SHA_TYPE_384:
> + if (sha->ctx_len < SHA384_DIGEST_SIZE)
> + return -EINVAL;
> + block_size = SHA384_BLOCK_SIZE;
> + break;
> + case CCP_SHA_TYPE_512:
> + if (sha->ctx_len < SHA512_DIGEST_SIZE)
> + return -EINVAL;
> + block_size = SHA512_BLOCK_SIZE;
> + break;
A version 3 CCP won't support these new sizes. You should add a version
check and return an error if v3.
> default:
> return -EINVAL;
> }
> @@ -1050,6 +1074,21 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> sb_count = 1;
> ooffset = ioffset = 0;
> break;
> + case CCP_SHA_TYPE_384:
> + digest_size = SHA384_DIGEST_SIZE;
> + init = (void *) ccp_sha384_init;
> + ctx_size = SHA512_DIGEST_SIZE;
> + sb_count = 2;
> + ioffset = 0;
> + ooffset = 2 * CCP_SB_BYTES - SHA384_DIGEST_SIZE;
> + break;
> + case CCP_SHA_TYPE_512:
> + digest_size = SHA512_DIGEST_SIZE;
> + init = (void *) ccp_sha512_init;
> + ctx_size = SHA512_DIGEST_SIZE;
> + sb_count = 2;
> + ooffset = ioffset = 0;
> + break;
> default:
> ret = -EINVAL;
> goto e_data;
> @@ -1068,6 +1107,11 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> op.u.sha.type = sha->type;
> op.u.sha.msg_bits = sha->msg_bits;
>
> + /* For SHA1/224/256 the context fits in a single (32-byte) SB entry;
> + * SHA384/512 require 2 adjacent SB slots, with the right half in the
> + * first slot, and the left half in the second. Each portion must then
> + * be in little endian format: use the 256-bit byte swap option.
> + */
> ret = ccp_init_dm_workarea(&ctx, cmd_q, sb_count * CCP_SB_BYTES,
> DMA_BIDIRECTIONAL);
> if (ret)
> @@ -1079,6 +1123,13 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> case CCP_SHA_TYPE_256:
> memcpy(ctx.address + ioffset, init, ctx_size);
> break;
> + case CCP_SHA_TYPE_384:
> + case CCP_SHA_TYPE_512:
> + memcpy(ctx.address + ctx_size / 2, init,
> + ctx_size / 2);
> + memcpy(ctx.address, init + ctx_size / 2,
> + ctx_size / 2);
> + break;
> default:
> ret = -EINVAL;
> goto e_ctx;
> @@ -1145,6 +1196,15 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> sha->ctx, 0,
> digest_size);
> break;
> + case CCP_SHA_TYPE_384:
> + case CCP_SHA_TYPE_512:
> + ccp_get_dm_area(&ctx, 0,
> + sha->ctx, LSB_ITEM_SIZE - ooffset,
> + LSB_ITEM_SIZE);
> + ccp_get_dm_area(&ctx, LSB_ITEM_SIZE + ooffset,
> + sha->ctx, 0,
> + LSB_ITEM_SIZE - ooffset);
> + break;
> default:
> ret = -EINVAL;
> goto e_ctx;
> @@ -1182,6 +1242,16 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
> ctx.address + ooffset,
> digest_size);
> break;
> + case CCP_SHA_TYPE_384:
> + case CCP_SHA_TYPE_512:
> + memcpy(hmac_buf + block_size,
> + ctx.address + LSB_ITEM_SIZE + ooffset,
> + LSB_ITEM_SIZE);
> + memcpy(hmac_buf + block_size +
> + (LSB_ITEM_SIZE - ooffset),
> + ctx.address,
> + LSB_ITEM_SIZE);
> + break;
> default:
> ret = -EINVAL;
> goto e_ctx;
> diff --git a/include/linux/ccp.h b/include/linux/ccp.h
> index a765333..1a3e0b5 100644
> --- a/include/linux/ccp.h
> +++ b/include/linux/ccp.h
> @@ -249,8 +249,11 @@ enum ccp_sha_type {
> CCP_SHA_TYPE_1 = 1,
> CCP_SHA_TYPE_224,
> CCP_SHA_TYPE_256,
> + CCP_SHA_TYPE_384,
> + CCP_SHA_TYPE_512,
> CCP_SHA_TYPE__LAST,
> };
> +#define CCP_SHA_CTXSIZE SHA512_DIGEST_SIZE
This doesn't appear to be used anywhere.
Thanks,
Tom
>
> /**
> * struct ccp_sha_engine - CCP SHA operation
>
^ permalink raw reply
* Re: [PATCH 3/6] crypto: ccp - Add support for RSA on the CCP
From: Stephan Mueller @ 2016-10-13 18:25 UTC (permalink / raw)
To: Gary R Hook; +Cc: linux-crypto, thomas.lendacky, herbert, davem
In-Reply-To: <20161013145309.19759.18493.stgit@taos>
Am Donnerstag, 13. Oktober 2016, 09:53:09 CEST schrieb Gary R Hook:
Hi Gary,
> Wire up the v3 CCP as a cipher provider.
>
> Signed-off-by: Gary R Hook <gary.hook@amd.com>
> ---
> drivers/crypto/ccp/Makefile | 1
> drivers/crypto/ccp/ccp-crypto-main.c | 15 ++
> drivers/crypto/ccp/ccp-crypto-rsa.c | 258
> ++++++++++++++++++++++++++++++++++ drivers/crypto/ccp/ccp-crypto.h |
> 24 +++
> drivers/crypto/ccp/ccp-dev-v3.c | 38 +++++
> drivers/crypto/ccp/ccp-ops.c | 1
> include/linux/ccp.h | 34 ++++
> 7 files changed, 370 insertions(+), 1 deletion(-)
> create mode 100644 drivers/crypto/ccp/ccp-crypto-rsa.c
>
> diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile
> index 346ceb8..23f89b7 100644
> --- a/drivers/crypto/ccp/Makefile
> +++ b/drivers/crypto/ccp/Makefile
> @@ -12,4 +12,5 @@ ccp-crypto-objs := ccp-crypto-main.o \
> ccp-crypto-aes.o \
> ccp-crypto-aes-cmac.o \
> ccp-crypto-aes-xts.o \
> + ccp-crypto-rsa.o \
> ccp-crypto-sha.o
> diff --git a/drivers/crypto/ccp/ccp-crypto-main.c
> b/drivers/crypto/ccp/ccp-crypto-main.c index e0380e5..f3c4c25 100644
> --- a/drivers/crypto/ccp/ccp-crypto-main.c
> +++ b/drivers/crypto/ccp/ccp-crypto-main.c
> @@ -33,6 +33,10 @@ static unsigned int sha_disable;
> module_param(sha_disable, uint, 0444);
> MODULE_PARM_DESC(sha_disable, "Disable use of SHA - any non-zero value");
>
> +static unsigned int rsa_disable;
> +module_param(rsa_disable, uint, 0444);
> +MODULE_PARM_DESC(rsa_disable, "Disable use of RSA - any non-zero value");
> +
> /* List heads for the supported algorithms */
> static LIST_HEAD(hash_algs);
> static LIST_HEAD(cipher_algs);
> @@ -343,6 +347,14 @@ static int ccp_register_algs(void)
> return ret;
> }
>
> + if (!rsa_disable) {
> + ret = ccp_register_rsa_algs();
> + if (ret) {
> + rsa_disable = 1;
> + return ret;
> + }
> + }
> +
> return 0;
> }
>
> @@ -362,6 +374,9 @@ static void ccp_unregister_algs(void)
> list_del(&ablk_alg->entry);
> kfree(ablk_alg);
> }
> +
> + if (!rsa_disable)
> + ccp_unregister_rsa_algs();
> }
>
> static int ccp_crypto_init(void)
> diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c
> b/drivers/crypto/ccp/ccp-crypto-rsa.c new file mode 100644
> index 0000000..7dab43b
> --- /dev/null
> +++ b/drivers/crypto/ccp/ccp-crypto-rsa.c
> @@ -0,0 +1,258 @@
> +/*
> + * AMD Cryptographic Coprocessor (CCP) RSA crypto API support
> + *
> + * Copyright (C) 2016 Advanced Micro Devices, Inc.
> + *
> + * Author: Gary R Hook <gary.hook@amd.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/module.h>
> +#include <linux/sched.h>
> +#include <linux/mpi.h>
> +#include <linux/scatterlist.h>
> +#include <linux/crypto.h>
> +#include <crypto/algapi.h>
> +#include <crypto/internal/akcipher.h>
> +#include <crypto/akcipher.h>
> +#include <crypto/scatterwalk.h>
> +
> +#include "ccp-crypto.h"
> +
> +static inline struct akcipher_request *akcipher_request_cast(
> + struct crypto_async_request *req)
> +{
> + return container_of(req, struct akcipher_request, base);
> +}
> +
> +static int ccp_rsa_complete(struct crypto_async_request *async_req, int
> ret) +{
> + struct akcipher_request *req = akcipher_request_cast(async_req);
> + struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
> +
> + if (!ret)
> + req->dst_len = rctx->cmd.u.rsa.d_len;
> +
> + ret = 0;
> +
> + return ret;
> +}
> +
> +static int ccp_rsa_maxsize(struct crypto_akcipher *tfm)
> +{
> + return CCP_RSA_MAXMOD;
> +}
> +
> +static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt)
> +{
> + struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> + struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
> + int ret = 0;
> +
> + if (!ctx->u.rsa.pkey.d && !ctx->u.rsa.pkey.e)
> + return -EINVAL;
> +
> + memset(&rctx->cmd, 0, sizeof(rctx->cmd));
> + INIT_LIST_HEAD(&rctx->cmd.entry);
> + rctx->cmd.engine = CCP_ENGINE_RSA;
> + rctx->cmd.u.rsa.mode = encrypt ? CCP_RSA_ENCRYPT : CCP_RSA_DECRYPT;
> +
> + rctx->cmd.u.rsa.pkey = ctx->u.rsa.pkey;
> + rctx->cmd.u.rsa.key_size = ctx->u.rsa.key_len;
> + rctx->cmd.u.rsa.exp = &ctx->u.rsa.e_sg;
> + rctx->cmd.u.rsa.exp_len = ctx->u.rsa.e_len;
> + rctx->cmd.u.rsa.mod = &ctx->u.rsa.n_sg;
> + rctx->cmd.u.rsa.mod_len = ctx->u.rsa.n_len;
> + if (ctx->u.rsa.pkey.d) {
> + rctx->cmd.u.rsa.d_sg = &ctx->u.rsa.d_sg;
> + rctx->cmd.u.rsa.d_len = ctx->u.rsa.d_len;
> + }
> +
> + rctx->cmd.u.rsa.src = req->src;
> + rctx->cmd.u.rsa.src_len = req->src_len;
> + rctx->cmd.u.rsa.dst = req->dst;
> + rctx->cmd.u.rsa.dst_len = req->dst_len;
> +
> + ret = ccp_crypto_enqueue_request(&req->base, &rctx->cmd);
> +
> + return ret;
> +}
> +
> +static int ccp_rsa_encrypt(struct akcipher_request *req)
> +{
> + return ccp_rsa_crypt(req, true);
> +}
> +
> +static int ccp_rsa_decrypt(struct akcipher_request *req)
> +{
> + return ccp_rsa_crypt(req, false);
> +}
> +
> +static void ccp_free_mpi_key(struct ccp_rsa_key *key)
> +{
> + mpi_free(key->d);
> + key->d = NULL;
> + mpi_free(key->e);
> + key->e = NULL;
> + mpi_free(key->n);
> + key->n = NULL;
> +}
Could you please see whether that function can be turned into a common
function call? crypto/rsa.c implements the same code in rsa_free_mpi_key.
> +
> +static int ccp_check_key_length(unsigned int len)
> +{
> + /* In bits */
> + if (len < 8 || len > 16384)
> + return -EINVAL;
> + return 0;
> +}
> +
> +static void ccp_rsa_free_key_bufs(struct ccp_ctx *ctx)
> +{
> + /* Clean up old key data */
> + kfree(ctx->u.rsa.e_buf);
> + ctx->u.rsa.e_buf = NULL;
> + ctx->u.rsa.e_len = 0;
> + kfree(ctx->u.rsa.n_buf);
> + ctx->u.rsa.n_buf = NULL;
> + ctx->u.rsa.n_len = 0;
> + kfree(ctx->u.rsa.d_buf);
kzfree, please.
> + ctx->u.rsa.d_buf = NULL;
> + ctx->u.rsa.d_len = 0;
> +}
> +
> +static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen, bool public)
> +{
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> + struct rsa_key raw_key;
> + unsigned int n_size;
> + int ret;
> +
> + if (!ctx)
> + return -EINVAL;
> +
> + ccp_rsa_free_key_bufs(ctx);
> + memset(&raw_key, 0, sizeof(raw_key));
> +
> + /* Code borrowed from crypto/rsa.c */
> + if (public)
> + ret = rsa_parse_pub_key(&raw_key, key, keylen);
> + else
> + ret = rsa_parse_priv_key(&raw_key, key, keylen);
> + if (ret)
> + goto e_ret;
> +
> + ret = -EINVAL;
> +
> + ctx->u.rsa.pkey.e = mpi_read_raw_data(raw_key.e, raw_key.e_sz);
> + if (!ctx->u.rsa.pkey.e)
> + goto e_ret;
> + ctx->u.rsa.e_buf = mpi_get_buffer(ctx->u.rsa.pkey.e,
> + &ctx->u.rsa.e_len, NULL);
> + if (!ctx->u.rsa.e_buf)
> + goto e_key;
> + sg_init_one(&ctx->u.rsa.e_sg, ctx->u.rsa.e_buf, ctx->u.rsa.e_len);
> +
> +
> + ctx->u.rsa.pkey.n = mpi_read_raw_data(raw_key.n, raw_key.n_sz);
> + n_size = mpi_get_size(ctx->u.rsa.pkey.n);
> + if (ccp_check_key_length(n_size << 3))
> + goto e_key;
> + ctx->u.rsa.key_len = n_size;
> + ctx->u.rsa.n_buf = mpi_get_buffer(ctx->u.rsa.pkey.n,
> + &ctx->u.rsa.n_len, NULL);
> + if (!ctx->u.rsa.n_buf)
> + goto e_nkey;
> + sg_init_one(&ctx->u.rsa.n_sg, ctx->u.rsa.n_buf, ctx->u.rsa.n_len);
> +
> + if (!public) {
> + ctx->u.rsa.pkey.d = mpi_read_raw_data(raw_key.d, raw_key.d_sz);
> + if (!ctx->u.rsa.pkey.d)
> + goto e_nkey;
> + ctx->u.rsa.d_buf = mpi_get_buffer(ctx->u.rsa.pkey.d,
> + &ctx->u.rsa.d_len, NULL);
> + if (!ctx->u.rsa.d_buf)
> + goto e_dkey;
> + sg_init_one(&ctx->u.rsa.d_sg, ctx->u.rsa.d_buf,
> + ctx->u.rsa.d_len);
> + }
> +
> + return 0;
> +
> +e_dkey:
> + kfree(ctx->u.rsa.n_buf);
> +e_nkey:
> + kfree(ctx->u.rsa.e_buf);
> +e_key:
> + ccp_free_mpi_key(&ctx->u.rsa.pkey);
> +e_ret:
> + return ret;
> +}
> +
> +static int ccp_rsa_setprivkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen)
> +{
> + return ccp_rsa_setkey(tfm, key, keylen, false);
> +}
> +
> +static int ccp_rsa_setpubkey(struct crypto_akcipher *tfm, const void *key,
> + unsigned int keylen)
> +{
> + return ccp_rsa_setkey(tfm, key, keylen, true);
> +}
> +
> +static int ccp_rsa_init_tfm(struct crypto_akcipher *tfm)
> +{
> + struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
> +
> + ctx->complete = ccp_rsa_complete;
> +
> + return 0;
> +}
> +
> +static void ccp_rsa_exit_tfm(struct crypto_akcipher *tfm)
> +{
> + struct ccp_ctx *ctx = crypto_tfm_ctx(&tfm->base);
> +
> + ccp_rsa_free_key_bufs(ctx);
> +}
> +
> +static struct akcipher_alg rsa = {
> + .encrypt = ccp_rsa_encrypt,
> + .decrypt = ccp_rsa_decrypt,
> + .sign = NULL,
> + .verify = NULL,
> + .set_pub_key = ccp_rsa_setpubkey,
> + .set_priv_key = ccp_rsa_setprivkey,
> + .max_size = ccp_rsa_maxsize,
> + .init = ccp_rsa_init_tfm,
> + .exit = ccp_rsa_exit_tfm,
> + .reqsize = sizeof(struct ccp_rsa_req_ctx),
> + .base = {
> + .cra_name = "rsa",
> + .cra_driver_name = "rsa-ccp",
> + .cra_priority = 100,
Are you sure you want to leave it at 100? With this value, it will content
with the C implementation.
> + .cra_module = THIS_MODULE,
> + .cra_ctxsize = sizeof(struct ccp_ctx),
> + },
> +};
> +
> +int ccp_register_rsa_algs(void)
> +{
> + int ret;
> +
> + /* Register the RSA algorithm in standard mode
> + * This works for CCP v3 and later
> + */
> + ret = crypto_register_akcipher(&rsa);
> + return ret;
> +}
> +
> +void ccp_unregister_rsa_algs(void)
> +{
> + crypto_unregister_akcipher(&rsa);
> +}
> diff --git a/drivers/crypto/ccp/ccp-crypto.h
> b/drivers/crypto/ccp/ccp-crypto.h index ae442ac..4a1d206 100644
> --- a/drivers/crypto/ccp/ccp-crypto.h
> +++ b/drivers/crypto/ccp/ccp-crypto.h
> @@ -22,6 +22,7 @@
> #include <crypto/ctr.h>
> #include <crypto/hash.h>
> #include <crypto/sha.h>
> +#include <crypto/internal/rsa.h>
>
> #define CCP_CRA_PRIORITY 300
>
> @@ -155,6 +156,26 @@ struct ccp_sha_ctx {
> struct crypto_shash *hmac_tfm;
> };
>
> +/***** RSA related defines *****/
> +
> +struct ccp_rsa_ctx {
> + unsigned int key_len; /* in bytes */
> + struct ccp_rsa_key pkey;
> + struct scatterlist e_sg;
> + u8 *e_buf;
> + unsigned int e_len;
> + struct scatterlist n_sg;
> + u8 *n_buf;
> + unsigned int n_len;
> + struct scatterlist d_sg;
> + u8 *d_buf;
> + unsigned int d_len;
> +};
> +
> +struct ccp_rsa_req_ctx {
> + struct ccp_cmd cmd;
> +};
> +
> struct ccp_sha_req_ctx {
> enum ccp_sha_type type;
>
> @@ -201,6 +222,7 @@ struct ccp_ctx {
>
> union {
> struct ccp_aes_ctx aes;
> + struct ccp_rsa_ctx rsa;
> struct ccp_sha_ctx sha;
> } u;
> };
> @@ -214,5 +236,7 @@ int ccp_register_aes_algs(struct list_head *head);
> int ccp_register_aes_cmac_algs(struct list_head *head);
> int ccp_register_aes_xts_algs(struct list_head *head);
> int ccp_register_sha_algs(struct list_head *head);
> +int ccp_register_rsa_algs(void);
> +void ccp_unregister_rsa_algs(void);
>
> #endif
> diff --git a/drivers/crypto/ccp/ccp-dev-v3.c
> b/drivers/crypto/ccp/ccp-dev-v3.c index 8d2dbac..75a0978 100644
> --- a/drivers/crypto/ccp/ccp-dev-v3.c
> +++ b/drivers/crypto/ccp/ccp-dev-v3.c
> @@ -20,6 +20,43 @@
>
> #include "ccp-dev.h"
>
> +/* CCP version 3: Union to define the function field (cmd_reg1/dword0) */
> +union ccp_function {
> + struct {
> + u16 size:7;
> + u16 encrypt:1;
> + u16 mode:3;
> + u16 type:2;
> + } aes;
> + struct {
> + u16 size:7;
> + u16 encrypt:1;
> + u16 rsvd:5;
> + } aes_xts;
> + struct {
> + u16 rsvd1:11;
> + u16 type:2;
> + } sha;
> + struct {
> + u16 size:13;
> + } rsa;
> + struct {
> + u16 byteswap:2;
> + u16 bitwise:3;
> + u16 rsvd:8;
> + } pt;
> + struct {
> + u16 rsvd:13;
> + } zlib;
> + struct {
> + u16 size:8;
> + u16 mode:3;
> + u16 rsvd1:1;
> + u16 rsvd2:1;
> + } ecc;
> + u16 raw;
> +};
> +
> static u32 ccp_alloc_ksb(struct ccp_cmd_queue *cmd_q, unsigned int count)
> {
> int start;
> @@ -88,6 +125,7 @@ static int ccp_do_cmd(struct ccp_op *op, u32 *cr,
> unsigned int cr_count) * are actually available, but reading that register
> resets it
> * and you could lose some error information.
> */
> +
> cmd_q->free_slots--;
>
> cr0 = (cmd_q->id << REQ0_CMD_Q_SHIFT)
> diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
> index 82cc637..826782d 100644
> --- a/drivers/crypto/ccp/ccp-ops.c
> +++ b/drivers/crypto/ccp/ccp-ops.c
> @@ -17,6 +17,7 @@
> #include <linux/interrupt.h>
> #include <crypto/scatterwalk.h>
> #include <linux/ccp.h>
> +#include <linux/delay.h>
>
> #include "ccp-dev.h"
>
> diff --git a/include/linux/ccp.h b/include/linux/ccp.h
> index 1a3e0b5..d634565 100644
> --- a/include/linux/ccp.h
> +++ b/include/linux/ccp.h
> @@ -19,7 +19,8 @@
> #include <linux/list.h>
> #include <crypto/aes.h>
> #include <crypto/sha.h>
> -
> +#include <linux/mpi.h>
> +#include <crypto/internal/rsa.h>
>
> struct ccp_device;
> struct ccp_cmd;
> @@ -293,6 +294,27 @@ struct ccp_sha_engine {
> * final sha cmd */
> };
>
> +/**
> + * ccp_rsa_type - mode of RSA operation
> + *
> + * @CCP_RSA_MODE_STD: standard mode
> + */
> +enum ccp_rsa_mode {
> + CCP_RSA_ENCRYPT = 0,
> + CCP_RSA_DECRYPT,
> + CCP_RSA__LAST,
> +};
> +
> +struct ccp_rsa_key {
> + MPI e;
> + MPI n;
> + MPI d;
> +};
> +
> +#define CCP_RSA_MAXMOD (4 * 1024 / 8)
> +#define CCP5_RSA_MAXMOD (16 * 1024 / 8)
> +#define CCP5_RSA_MINMOD (512 / 8)
> +
> /***** RSA engine *****/
> /**
> * struct ccp_rsa_engine - CCP RSA operation
> @@ -309,16 +331,26 @@ struct ccp_sha_engine {
> * - key_size, exp, exp_len, mod, mod_len, src, dst, src_len
> */
> struct ccp_rsa_engine {
> + enum ccp_rsa_mode mode;
> u32 key_size; /* In bits */
>
> + struct ccp_rsa_key pkey;
> +
> +/* e */
> struct scatterlist *exp;
> u32 exp_len; /* In bytes */
>
> +/* n */
> struct scatterlist *mod;
> u32 mod_len; /* In bytes */
>
> +/* d */
> + struct scatterlist *d_sg;
> + unsigned int d_len;
> +
> struct scatterlist *src, *dst;
> u32 src_len; /* In bytes */
> + u32 dst_len; /* In bytes */
> };
>
> /***** Passthru engine *****/
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
Ciao
Stephan
^ permalink raw reply
* [PATCH 6/6] crypto: ccp - Enable 3DES function on v5 CCPs
From: Gary R Hook @ 2016-10-13 14:53 UTC (permalink / raw)
To: linux-crypto; +Cc: thomas.lendacky, herbert, davem
In-Reply-To: <20161013144542.19759.6924.stgit@taos>
Wire up support for Triple DES in ECB mode.
Signed-off-by: Gary R Hook <gary.hook@amd.com>
---
drivers/crypto/ccp/Makefile | 1
drivers/crypto/ccp/ccp-crypto-des3.c | 254 ++++++++++++++++++++++++++++++++++
drivers/crypto/ccp/ccp-crypto-main.c | 10 +
drivers/crypto/ccp/ccp-crypto.h | 25 +++
drivers/crypto/ccp/ccp-dev-v3.c | 1
drivers/crypto/ccp/ccp-dev-v5.c | 65 ++++++++-
drivers/crypto/ccp/ccp-dev.h | 18 ++
drivers/crypto/ccp/ccp-ops.c | 201 +++++++++++++++++++++++++++
drivers/crypto/ccp/ccp-pci.c | 2
include/linux/ccp.h | 57 +++++++-
10 files changed, 624 insertions(+), 10 deletions(-)
create mode 100644 drivers/crypto/ccp/ccp-crypto-des3.c
diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile
index fd77225..563594a 100644
--- a/drivers/crypto/ccp/Makefile
+++ b/drivers/crypto/ccp/Makefile
@@ -14,4 +14,5 @@ ccp-crypto-objs := ccp-crypto-main.o \
ccp-crypto-aes-xts.o \
ccp-crypto-rsa.o \
ccp-crypto-aes-galois.o \
+ ccp-crypto-des3.o \
ccp-crypto-sha.o
diff --git a/drivers/crypto/ccp/ccp-crypto-des3.c b/drivers/crypto/ccp/ccp-crypto-des3.c
new file mode 100644
index 0000000..5af7347
--- /dev/null
+++ b/drivers/crypto/ccp/ccp-crypto-des3.c
@@ -0,0 +1,254 @@
+/*
+ * AMD Cryptographic Coprocessor (CCP) DES3 crypto API support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Gary R Hook <ghook@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/delay.h>
+#include <linux/scatterlist.h>
+#include <linux/crypto.h>
+#include <crypto/algapi.h>
+#include <crypto/scatterwalk.h>
+#include <crypto/des.h>
+
+#include "ccp-crypto.h"
+
+static int ccp_des3_complete(struct crypto_async_request *async_req, int ret)
+{
+ struct ablkcipher_request *req = ablkcipher_request_cast(async_req);
+ struct ccp_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+ struct ccp_des3_req_ctx *rctx = ablkcipher_request_ctx(req);
+
+ if (ret)
+ return ret;
+
+ if (ctx->u.des3.mode != CCP_DES3_MODE_ECB)
+ memcpy(req->info, rctx->iv, DES3_EDE_BLOCK_SIZE);
+
+ return 0;
+}
+
+static int ccp_des3_setkey(struct crypto_ablkcipher *tfm, const u8 *key,
+ unsigned int key_len)
+{
+ struct ccp_ctx *ctx = crypto_tfm_ctx(crypto_ablkcipher_tfm(tfm));
+ struct ccp_crypto_ablkcipher_alg *alg =
+ ccp_crypto_ablkcipher_alg(crypto_ablkcipher_tfm(tfm));
+ u32 *flags = &tfm->base.crt_flags;
+
+
+ /* From des_generic.c:
+ *
+ * RFC2451:
+ * If the first two or last two independent 64-bit keys are
+ * equal (k1 == k2 or k2 == k3), then the DES3 operation is simply the
+ * same as DES. Implementers MUST reject keys that exhibit this
+ * property.
+ */
+ const u32 *K = (const u32 *)key;
+
+ if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
+ !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+ (*flags & CRYPTO_TFM_REQ_WEAK_KEY)) {
+ *flags |= CRYPTO_TFM_RES_WEAK_KEY;
+ return -EINVAL;
+ }
+
+ /* It's not clear that there is any support for a keysize of 112.
+ * If needed, the caller should make K1 == K3
+ */
+ ctx->u.des3.type = CCP_DES3_TYPE_168;
+ ctx->u.des3.mode = alg->mode;
+ ctx->u.des3.key_len = key_len;
+
+ memcpy(ctx->u.des3.key, key, key_len);
+ sg_init_one(&ctx->u.des3.key_sg, ctx->u.des3.key, key_len);
+
+ return 0;
+}
+
+static int ccp_des3_crypt(struct ablkcipher_request *req, bool encrypt)
+{
+ struct ccp_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+ struct ccp_des3_req_ctx *rctx = ablkcipher_request_ctx(req);
+ struct scatterlist *iv_sg = NULL;
+ unsigned int iv_len = 0;
+ int ret;
+
+ if (!ctx->u.des3.key_len)
+ return -EINVAL;
+
+ if (((ctx->u.des3.mode == CCP_DES3_MODE_ECB) ||
+ (ctx->u.des3.mode == CCP_DES3_MODE_CBC)) &&
+ (req->nbytes & (DES3_EDE_BLOCK_SIZE - 1)))
+ return -EINVAL;
+
+ if (ctx->u.des3.mode != CCP_DES3_MODE_ECB) {
+ if (!req->info)
+ return -EINVAL;
+
+ memcpy(rctx->iv, req->info, DES3_EDE_BLOCK_SIZE);
+ iv_sg = &rctx->iv_sg;
+ iv_len = DES3_EDE_BLOCK_SIZE;
+ sg_init_one(iv_sg, rctx->iv, iv_len);
+ }
+
+ memset(&rctx->cmd, 0, sizeof(rctx->cmd));
+ INIT_LIST_HEAD(&rctx->cmd.entry);
+ rctx->cmd.engine = CCP_ENGINE_DES3;
+ rctx->cmd.u.des3.type = ctx->u.des3.type;
+ rctx->cmd.u.des3.mode = ctx->u.des3.mode;
+ rctx->cmd.u.des3.action = (encrypt)
+ ? CCP_DES3_ACTION_ENCRYPT
+ : CCP_DES3_ACTION_DECRYPT;
+ rctx->cmd.u.des3.key = &ctx->u.des3.key_sg;
+ rctx->cmd.u.des3.key_len = ctx->u.des3.key_len;
+ rctx->cmd.u.des3.iv = iv_sg;
+ rctx->cmd.u.des3.iv_len = iv_len;
+ rctx->cmd.u.des3.src = req->src;
+ rctx->cmd.u.des3.src_len = req->nbytes;
+ rctx->cmd.u.des3.dst = req->dst;
+
+ ret = ccp_crypto_enqueue_request(&req->base, &rctx->cmd);
+
+ return ret;
+}
+
+static int ccp_des3_encrypt(struct ablkcipher_request *req)
+{
+ return ccp_des3_crypt(req, true);
+}
+
+static int ccp_des3_decrypt(struct ablkcipher_request *req)
+{
+ return ccp_des3_crypt(req, false);
+}
+
+static int ccp_des3_cra_init(struct crypto_tfm *tfm)
+{
+ struct ccp_ctx *ctx = crypto_tfm_ctx(tfm);
+
+ ctx->complete = ccp_des3_complete;
+ ctx->u.des3.key_len = 0;
+
+ tfm->crt_ablkcipher.reqsize = sizeof(struct ccp_des3_req_ctx);
+
+ return 0;
+}
+
+static void ccp_des3_cra_exit(struct crypto_tfm *tfm)
+{
+}
+
+static struct crypto_alg ccp_des3_defaults = {
+ .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
+ CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_KERN_DRIVER_ONLY |
+ CRYPTO_ALG_NEED_FALLBACK,
+ .cra_blocksize = DES3_EDE_BLOCK_SIZE,
+ .cra_ctxsize = sizeof(struct ccp_ctx),
+ .cra_priority = CCP_CRA_PRIORITY,
+ .cra_type = &crypto_ablkcipher_type,
+ .cra_init = ccp_des3_cra_init,
+ .cra_exit = ccp_des3_cra_exit,
+ .cra_module = THIS_MODULE,
+ .cra_ablkcipher = {
+ .setkey = ccp_des3_setkey,
+ .encrypt = ccp_des3_encrypt,
+ .decrypt = ccp_des3_decrypt,
+ .min_keysize = DES3_EDE_KEY_SIZE,
+ .max_keysize = DES3_EDE_KEY_SIZE,
+ },
+};
+
+struct ccp_des3_def {
+ enum ccp_des3_mode mode;
+ unsigned int version;
+ const char *name;
+ const char *driver_name;
+ unsigned int blocksize;
+ unsigned int ivsize;
+ struct crypto_alg *alg_defaults;
+};
+
+static struct ccp_des3_def des3_algs[] = {
+ {
+ .mode = CCP_DES3_MODE_ECB,
+ .version = CCP_VERSION(5, 0),
+ .name = "ecb(des3_ede)",
+ .driver_name = "ecb-des3-ccp",
+ .blocksize = DES3_EDE_BLOCK_SIZE,
+ .ivsize = 0,
+ .alg_defaults = &ccp_des3_defaults,
+ },
+ {
+ .mode = CCP_DES3_MODE_CBC,
+ .version = CCP_VERSION(5, 0),
+ .name = "cbc(des3_ede)",
+ .driver_name = "cbc-des3-ccp",
+ .blocksize = DES3_EDE_BLOCK_SIZE,
+ .ivsize = DES3_EDE_BLOCK_SIZE,
+ .alg_defaults = &ccp_des3_defaults,
+ },
+};
+
+static int ccp_register_des3_alg(struct list_head *head,
+ const struct ccp_des3_def *def)
+{
+ struct ccp_crypto_ablkcipher_alg *ccp_alg;
+ struct crypto_alg *alg;
+ int ret;
+
+ ccp_alg = kzalloc(sizeof(*ccp_alg), GFP_KERNEL);
+ if (!ccp_alg)
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&ccp_alg->entry);
+
+ ccp_alg->mode = def->mode;
+
+ /* Copy the defaults and override as necessary */
+ alg = &ccp_alg->alg;
+ *alg = *def->alg_defaults;
+ snprintf(alg->cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name);
+ snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
+ def->driver_name);
+ alg->cra_blocksize = def->blocksize;
+ alg->cra_ablkcipher.ivsize = def->ivsize;
+
+ ret = crypto_register_alg(alg);
+ if (ret) {
+ pr_err("%s ablkcipher algorithm registration error (%d)\n",
+ alg->cra_name, ret);
+ kfree(ccp_alg);
+ return ret;
+ }
+
+ list_add(&ccp_alg->entry, head);
+
+ return 0;
+}
+
+int ccp_register_des3_algs(struct list_head *head)
+{
+ int i, ret;
+ unsigned int ccpversion = ccp_version();
+
+ for (i = 0; i < ARRAY_SIZE(des3_algs); i++) {
+ if (des3_algs[i].version > ccpversion)
+ continue;
+ ret = ccp_register_des3_alg(head, &des3_algs[i]);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
diff --git a/drivers/crypto/ccp/ccp-crypto-main.c b/drivers/crypto/ccp/ccp-crypto-main.c
index 103a7b3..4b35329 100644
--- a/drivers/crypto/ccp/ccp-crypto-main.c
+++ b/drivers/crypto/ccp/ccp-crypto-main.c
@@ -37,6 +37,10 @@ static unsigned int rsa_disable;
module_param(rsa_disable, uint, 0444);
MODULE_PARM_DESC(rsa_disable, "Disable use of RSA - any non-zero value");
+static unsigned int des3_disable;
+module_param(des3_disable, uint, 0444);
+MODULE_PARM_DESC(des3_disable, "Disable use of 3DES - any non-zero value");
+
/* List heads for the supported algorithms */
static LIST_HEAD(hash_algs);
static LIST_HEAD(cipher_algs);
@@ -346,6 +350,12 @@ static int ccp_register_algs(void)
return ret;
}
+ if (!des3_disable) {
+ ret = ccp_register_des3_algs(&cipher_algs);
+ if (ret)
+ return ret;
+ }
+
if (!sha_disable) {
ret = ccp_register_sha_algs(&hash_algs);
if (ret)
diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
index b2918f6..7b7f3b2 100644
--- a/drivers/crypto/ccp/ccp-crypto.h
+++ b/drivers/crypto/ccp/ccp-crypto.h
@@ -26,6 +26,8 @@
#include <crypto/sha.h>
#include <crypto/internal/rsa.h>
+#define CCP_LOG_LEVEL KERN_INFO
+
#define CCP_CRA_PRIORITY 300
struct ccp_crypto_ablkcipher_alg {
@@ -151,7 +153,26 @@ struct ccp_aes_cmac_exp_ctx {
u8 buf[AES_BLOCK_SIZE];
};
-/* SHA-related defines
+/***** 3DES related defines *****/
+struct ccp_des3_ctx {
+ enum ccp_engine engine;
+ enum ccp_des3_type type;
+ enum ccp_des3_mode mode;
+
+ struct scatterlist key_sg;
+ unsigned int key_len;
+ u8 key[AES_MAX_KEY_SIZE];
+};
+
+struct ccp_des3_req_ctx {
+ struct scatterlist iv_sg;
+ u8 iv[AES_BLOCK_SIZE];
+
+ struct ccp_cmd cmd;
+};
+
+/*
+ * SHA-related defines
* These values must be large enough to accommodate any variant
*/
#define MAX_SHA_CONTEXT_SIZE SHA512_DIGEST_SIZE
@@ -236,6 +257,7 @@ struct ccp_ctx {
struct ccp_aes_ctx aes;
struct ccp_rsa_ctx rsa;
struct ccp_sha_ctx sha;
+ struct ccp_des3_ctx des3;
} u;
};
@@ -251,5 +273,6 @@ int ccp_register_aes_aeads(struct list_head *head);
int ccp_register_sha_algs(struct list_head *head);
int ccp_register_rsa_algs(void);
void ccp_unregister_rsa_algs(void);
+int ccp_register_des3_algs(struct list_head *head);
#endif
diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
index 75a0978..fccca16 100644
--- a/drivers/crypto/ccp/ccp-dev-v3.c
+++ b/drivers/crypto/ccp/ccp-dev-v3.c
@@ -595,6 +595,7 @@ static irqreturn_t ccp_irq_handler(int irq, void *data)
static const struct ccp_actions ccp3_actions = {
.aes = ccp_perform_aes,
.xts_aes = ccp_perform_xts_aes,
+ .des3 = NULL,
.sha = ccp_perform_sha,
.rsa = ccp_perform_rsa,
.passthru = ccp_perform_passthru,
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index dcae391..85387dc 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -101,6 +101,12 @@ union ccp_function {
u16 type:2;
} aes_xts;
struct {
+ u16 size:7;
+ u16 encrypt:1;
+ u16 mode:5;
+ u16 type:2;
+ } des3;
+ struct {
u16 rsvd1:10;
u16 type:4;
u16 rsvd2:1;
@@ -132,6 +138,10 @@ union ccp_function {
#define CCP_AES_TYPE(p) ((p)->aes.type)
#define CCP_XTS_SIZE(p) ((p)->aes_xts.size)
#define CCP_XTS_ENCRYPT(p) ((p)->aes_xts.encrypt)
+#define CCP_DES3_SIZE(p) ((p)->des3.size)
+#define CCP_DES3_ENCRYPT(p) ((p)->des3.encrypt)
+#define CCP_DES3_MODE(p) ((p)->des3.mode)
+#define CCP_DES3_TYPE(p) ((p)->des3.type)
#define CCP_SHA_TYPE(p) ((p)->sha.type)
#define CCP_RSA_SIZE(p) ((p)->rsa.size)
#define CCP_PT_BYTESWAP(p) ((p)->pt.byteswap)
@@ -242,13 +252,16 @@ static int ccp5_do_cmd(struct ccp5_desc *desc,
/* Wait for the job to complete */
ret = wait_event_interruptible(cmd_q->int_queue,
cmd_q->int_rcvd);
- if (ret || cmd_q->cmd_error) {
+ if (cmd_q->cmd_error) {
+ /*
+ * Log the error and flush the queue by
+ * moving the head pointer
+ */
if (cmd_q->cmd_error)
ccp_log_error(cmd_q->ccp,
cmd_q->cmd_error);
- /* A version 5 device doesn't use Job IDs... */
- if (!ret)
- ret = -EIO;
+ iowrite32(tail, cmd_q->reg_head_lo);
+ ret = -EIO;
}
cmd_q->int_rcvd = 0;
}
@@ -381,6 +394,47 @@ static int ccp5_perform_sha(struct ccp_op *op)
return ccp5_do_cmd(&desc, op->cmd_q);
}
+static int ccp5_perform_des3(struct ccp_op *op)
+{
+ struct ccp5_desc desc;
+ union ccp_function function;
+ u32 key_addr = op->sb_key * LSB_ITEM_SIZE;
+
+ /* Zero out all the fields of the command desc */
+ memset(&desc, 0, sizeof(struct ccp5_desc));
+
+ CCP5_CMD_ENGINE(&desc) = CCP_ENGINE_DES3;
+
+ CCP5_CMD_SOC(&desc) = op->soc;
+ CCP5_CMD_IOC(&desc) = 1;
+ CCP5_CMD_INIT(&desc) = op->init;
+ CCP5_CMD_EOM(&desc) = op->eom;
+ CCP5_CMD_PROT(&desc) = 0;
+
+ function.raw = 0;
+ CCP_DES3_ENCRYPT(&function) = op->u.des3.action;
+ CCP_DES3_MODE(&function) = op->u.des3.mode;
+ CCP_DES3_TYPE(&function) = op->u.des3.type;
+ CCP5_CMD_FUNCTION(&desc) = cpu_to_le32(function.raw);
+
+ CCP5_CMD_LEN(&desc) = cpu_to_le32(op->src.u.dma.length);
+
+ CCP5_CMD_SRC_LO(&desc) = cpu_to_le32(ccp_addr_lo(&op->src.u.dma));
+ CCP5_CMD_SRC_HI(&desc) = cpu_to_le32(ccp_addr_hi(&op->src.u.dma));
+ CCP5_CMD_SRC_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SYSTEM);
+
+ CCP5_CMD_DST_LO(&desc) = cpu_to_le32(ccp_addr_lo(&op->dst.u.dma));
+ CCP5_CMD_DST_HI(&desc) = cpu_to_le32(ccp_addr_hi(&op->dst.u.dma));
+ CCP5_CMD_DST_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SYSTEM);
+
+ CCP5_CMD_KEY_LO(&desc) = cpu_to_le32(lower_32_bits(key_addr));
+ CCP5_CMD_KEY_HI(&desc) = 0;
+ CCP5_CMD_KEY_MEM(&desc) = cpu_to_le32(CCP_MEMTYPE_SB);
+ CCP5_CMD_LSB_ID(&desc) = cpu_to_le32(op->sb_ctx);
+
+ return ccp5_do_cmd(&desc, op->cmd_q);
+}
+
static int ccp5_perform_rsa(struct ccp_op *op)
{
struct ccp5_desc desc;
@@ -428,6 +482,7 @@ static int ccp5_perform_passthru(struct ccp_op *op)
struct ccp_dma_info *saddr = &op->src.u.dma;
struct ccp_dma_info *daddr = &op->dst.u.dma;
+
memset(&desc, 0, Q_DESC_SIZE);
CCP5_CMD_ENGINE(&desc) = CCP_ENGINE_PASSTHRU;
@@ -722,6 +777,7 @@ static int ccp5_init(struct ccp_device *ccp)
dev_dbg(dev, "queue #%u available\n", i);
}
+
if (ccp->cmd_q_count == 0) {
dev_notice(dev, "no command queues available\n");
ret = -EIO;
@@ -991,6 +1047,7 @@ static const struct ccp_actions ccp5_actions = {
.aes = ccp5_perform_aes,
.xts_aes = ccp5_perform_xts_aes,
.sha = ccp5_perform_sha,
+ .des3 = ccp5_perform_des3,
.rsa = ccp5_perform_rsa,
.passthru = ccp5_perform_passthru,
.ecc = ccp5_perform_ecc,
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index a2214ac..12a92d5 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -27,6 +27,10 @@
#include <linux/irqreturn.h>
#include <linux/dmaengine.h>
+#ifndef CCP_LOG_LEVEL
+#define CCP_LOG_LEVEL KERN_INFO
+#endif
+
#define MAX_CCP_NAME_LEN 16
#define MAX_DMAPOOL_NAME_LEN 32
@@ -190,6 +194,9 @@
#define CCP_XTS_AES_KEY_SB_COUNT 1
#define CCP_XTS_AES_CTX_SB_COUNT 1
+#define CCP_DES3_KEY_SB_COUNT 1
+#define CCP_DES3_CTX_SB_COUNT 1
+
#define CCP_SHA_SB_COUNT 1
#define CCP_RSA_MAX_WIDTH 4096
@@ -475,6 +482,12 @@ struct ccp_xts_aes_op {
enum ccp_xts_aes_unit_size unit_size;
};
+struct ccp_des3_op {
+ enum ccp_des3_type type;
+ enum ccp_des3_mode mode;
+ enum ccp_des3_action action;
+};
+
struct ccp_sha_op {
enum ccp_sha_type type;
u64 msg_bits;
@@ -512,6 +525,7 @@ struct ccp_op {
union {
struct ccp_aes_op aes;
struct ccp_xts_aes_op xts;
+ struct ccp_des3_op des3;
struct ccp_sha_op sha;
struct ccp_rsa_op rsa;
struct ccp_passthru_op passthru;
@@ -620,13 +634,13 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp);
struct ccp_actions {
int (*aes)(struct ccp_op *);
int (*xts_aes)(struct ccp_op *);
+ int (*des3)(struct ccp_op *);
int (*sha)(struct ccp_op *);
int (*rsa)(struct ccp_op *);
int (*passthru)(struct ccp_op *);
int (*ecc)(struct ccp_op *);
u32 (*sballoc)(struct ccp_cmd_queue *, unsigned int);
- void (*sbfree)(struct ccp_cmd_queue *, unsigned int,
- unsigned int);
+ void (*sbfree)(struct ccp_cmd_queue *, unsigned int, unsigned int);
unsigned int (*get_free_slots)(struct ccp_cmd_queue *);
int (*init)(struct ccp_device *);
void (*destroy)(struct ccp_device *);
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index de28867..f9543f7 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -16,6 +16,7 @@
#include <linux/pci.h>
#include <linux/interrupt.h>
#include <crypto/scatterwalk.h>
+#include <crypto/des.h>
#include <linux/ccp.h>
#include <linux/delay.h>
@@ -882,8 +883,7 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
return -EINVAL;
if (((aes->mode == CCP_AES_MODE_ECB) ||
- (aes->mode == CCP_AES_MODE_CBC) ||
- (aes->mode == CCP_AES_MODE_CFB)) &&
+ (aes->mode == CCP_AES_MODE_CBC)) &&
(aes->src_len & (AES_BLOCK_SIZE - 1)))
return -EINVAL;
@@ -1194,6 +1194,200 @@ e_key:
return ret;
}
+static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+{
+ struct ccp_des3_engine *des3 = &cmd->u.des3;
+
+ struct ccp_dm_workarea key, ctx;
+ struct ccp_data src, dst;
+ struct ccp_op op;
+ unsigned int dm_offset;
+ unsigned int len_singlekey;
+ bool in_place = false;
+ int ret;
+
+ /* Error checks */
+ if (!cmd_q->ccp->vdata->perform->des3)
+ return -EINVAL;
+
+ if (des3->key_len != DES3_EDE_KEY_SIZE)
+ return -EINVAL;
+
+ if (((des3->mode == CCP_DES3_MODE_ECB) ||
+ (des3->mode == CCP_DES3_MODE_CBC)) &&
+ (des3->src_len & (DES3_EDE_BLOCK_SIZE - 1)))
+ return -EINVAL;
+
+ if (!des3->key || !des3->src || !des3->dst)
+ return -EINVAL;
+
+ if (des3->mode != CCP_DES3_MODE_ECB) {
+ if (des3->iv_len != DES3_EDE_BLOCK_SIZE)
+ return -EINVAL;
+
+ if (!des3->iv)
+ return -EINVAL;
+ }
+
+ ret = -EIO;
+ /* Zero out all the fields of the command desc */
+ memset(&op, 0, sizeof(op));
+
+ /* Set up the Function field */
+ op.cmd_q = cmd_q;
+ op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
+ op.sb_key = cmd_q->sb_key;
+
+ op.init = (des3->mode == CCP_DES3_MODE_ECB) ? 0 : 1;
+ op.u.des3.type = des3->type;
+ op.u.des3.mode = des3->mode;
+ op.u.des3.action = des3->action;
+
+ /*
+ * All supported key sizes fit in a single (32-byte) KSB entry and
+ * (like AES) must be in little endian format. Use the 256-bit byte
+ * swap passthru option to convert from big endian to little endian.
+ */
+ ret = ccp_init_dm_workarea(&key, cmd_q,
+ CCP_DES3_KEY_SB_COUNT * CCP_SB_BYTES,
+ DMA_TO_DEVICE);
+ if (ret)
+ return ret;
+
+ /*
+ * The contents of the key triplet are in the reverse order of what
+ * is required by the engine. Copy the 3 pieces individually to put
+ * them where they belong.
+ */
+ dm_offset = CCP_SB_BYTES - des3->key_len; /* Basic offset */
+
+ len_singlekey = des3->key_len / 3;
+ ccp_set_dm_area(&key, dm_offset + 2 * len_singlekey,
+ des3->key, 0, len_singlekey);
+ ccp_set_dm_area(&key, dm_offset + len_singlekey,
+ des3->key, len_singlekey, len_singlekey);
+ ccp_set_dm_area(&key, dm_offset,
+ des3->key, 2 * len_singlekey, len_singlekey);
+
+ /* Copy the key to the SB */
+ ret = ccp_copy_to_sb(cmd_q, &key, op.jobid, op.sb_key,
+ CCP_PASSTHRU_BYTESWAP_256BIT);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_key;
+ }
+
+ /*
+ * The DES3 context fits in a single (32-byte) KSB entry and
+ * must be in little endian format. Use the 256-bit byte swap
+ * passthru option to convert from big endian to little endian.
+ */
+ if (des3->mode != CCP_DES3_MODE_ECB) {
+ u32 load_mode;
+
+ op.sb_ctx = cmd_q->sb_ctx;
+
+ ret = ccp_init_dm_workarea(&ctx, cmd_q,
+ CCP_DES3_CTX_SB_COUNT * CCP_SB_BYTES,
+ DMA_BIDIRECTIONAL);
+ if (ret)
+ goto e_key;
+
+ /* Load the context into the LSB */
+ dm_offset = CCP_SB_BYTES - des3->iv_len;
+ ccp_set_dm_area(&ctx, dm_offset, des3->iv, 0, des3->iv_len);
+
+ if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+ load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
+ else
+ load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
+ ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
+ load_mode);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_ctx;
+ }
+ }
+
+ /*
+ * Prepare the input and output data workareas. For in-place
+ * operations we need to set the dma direction to BIDIRECTIONAL
+ * and copy the src workarea to the dst workarea.
+ */
+ if (sg_virt(des3->src) == sg_virt(des3->dst))
+ in_place = true;
+
+ ret = ccp_init_data(&src, cmd_q, des3->src, des3->src_len,
+ DES3_EDE_BLOCK_SIZE,
+ in_place ? DMA_BIDIRECTIONAL : DMA_TO_DEVICE);
+ if (ret)
+ goto e_ctx;
+
+ if (in_place)
+ dst = src;
+ else {
+ ret = ccp_init_data(&dst, cmd_q, des3->dst, des3->src_len,
+ DES3_EDE_BLOCK_SIZE, DMA_FROM_DEVICE);
+ if (ret)
+ goto e_src;
+ }
+
+ /* Send data to the CCP DES3 engine */
+ while (src.sg_wa.bytes_left) {
+ ccp_prepare_data(&src, &dst, &op, DES3_EDE_BLOCK_SIZE, true);
+ if (!src.sg_wa.bytes_left) {
+ op.eom = 1;
+
+ /* Since we don't retrieve the context in ECB mode
+ * we have to wait for the operation to complete
+ * on the last piece of data
+ */
+ op.soc = 0;
+ }
+
+ ret = cmd_q->ccp->vdata->perform->des3(&op);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_dst;
+ }
+
+ ccp_process_data(&src, &dst, &op);
+ }
+
+ if (des3->mode != CCP_DES3_MODE_ECB) {
+ /* Retrieve the context and make BE */
+ ret = ccp_copy_from_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
+ CCP_PASSTHRU_BYTESWAP_256BIT);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_dst;
+ }
+
+ /* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
+ if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+ dm_offset = CCP_SB_BYTES - des3->iv_len;
+ else
+ dm_offset = 0;
+ ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
+ DES3_EDE_BLOCK_SIZE);
+ }
+e_dst:
+ if (!in_place)
+ ccp_free_data(&dst, cmd_q);
+
+e_src:
+ ccp_free_data(&src, cmd_q);
+
+e_ctx:
+ if (des3->mode != CCP_DES3_MODE_ECB)
+ ccp_dm_free(&ctx);
+
+e_key:
+ ccp_dm_free(&key);
+
+ return ret;
+}
+
static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
{
struct ccp_sha_engine *sha = &cmd->u.sha;
@@ -2190,6 +2384,9 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
case CCP_ENGINE_XTS_AES_128:
ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
break;
+ case CCP_ENGINE_DES3:
+ ret = ccp_run_des3_cmd(cmd_q, cmd);
+ break;
case CCP_ENGINE_SHA:
ret = ccp_run_sha_cmd(cmd_q, cmd);
break;
diff --git a/drivers/crypto/ccp/ccp-pci.c b/drivers/crypto/ccp/ccp-pci.c
index 28a9996..e9bdf6f 100644
--- a/drivers/crypto/ccp/ccp-pci.c
+++ b/drivers/crypto/ccp/ccp-pci.c
@@ -230,9 +230,11 @@ static int ccp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
dev_set_drvdata(dev, ccp);
+ /* Instance-specific required setup */
if (ccp->vdata->setup)
ccp->vdata->setup(ccp);
+ /* Initialize the CCP device */
ret = ccp->vdata->perform->init(ccp);
if (ret)
goto e_iomap;
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index f90f8ba..e7acc37 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -303,6 +303,60 @@ struct ccp_sha_engine {
* final sha cmd */
};
+/***** 3DES engine *****/
+enum ccp_des3_mode {
+ CCP_DES3_MODE_ECB = 0,
+ CCP_DES3_MODE_CBC,
+ CCP_DES3_MODE_CFB,
+ CCP_DES3_MODE__LAST,
+};
+
+enum ccp_des3_type {
+ CCP_DES3_TYPE_168 = 1,
+ CCP_DES3_TYPE__LAST,
+ };
+
+enum ccp_des3_action {
+ CCP_DES3_ACTION_DECRYPT = 0,
+ CCP_DES3_ACTION_ENCRYPT,
+ CCP_DES3_ACTION__LAST,
+};
+
+/**
+ * struct ccp_des3_engine - CCP SHA operation
+ * @type: Type of 3DES operation
+ * @mode: cipher mode
+ * @action: 3DES operation (decrypt/encrypt)
+ * @key: key to be used for this 3DES operation
+ * @key_len: length of key (in bytes)
+ * @iv: IV to be used for this AES operation
+ * @iv_len: length in bytes of iv
+ * @src: input data to be used for this operation
+ * @src_len: length of input data used for this operation (in bytes)
+ * @dst: output data produced by this operation
+ *
+ * Variables required to be set when calling ccp_enqueue_cmd():
+ * - type, mode, action, key, key_len, src, dst, src_len
+ * - iv, iv_len for any mode other than ECB
+ *
+ * The iv variable is used as both input and output. On completion of the
+ * 3DES operation the new IV overwrites the old IV.
+ */
+struct ccp_des3_engine {
+ enum ccp_des3_type type;
+ enum ccp_des3_mode mode;
+ enum ccp_des3_action action;
+
+ struct scatterlist *key;
+ u32 key_len; /* In bytes */
+
+ struct scatterlist *iv;
+ u32 iv_len; /* In bytes */
+
+ struct scatterlist *src, *dst;
+ u64 src_len; /* In bytes */
+};
+
/**
* ccp_rsa_type - mode of RSA operation
*
@@ -583,7 +637,7 @@ struct ccp_ecc_engine {
enum ccp_engine {
CCP_ENGINE_AES = 0,
CCP_ENGINE_XTS_AES_128,
- CCP_ENGINE_RSVD1,
+ CCP_ENGINE_DES3,
CCP_ENGINE_SHA,
CCP_ENGINE_RSA,
CCP_ENGINE_PASSTHRU,
@@ -631,6 +685,7 @@ struct ccp_cmd {
union {
struct ccp_aes_engine aes;
struct ccp_xts_aes_engine xts;
+ struct ccp_des3_engine des3;
struct ccp_sha_engine sha;
struct ccp_rsa_engine rsa;
struct ccp_passthru_engine passthru;
^ permalink raw reply related
* [PATCH 3/6] crypto: ccp - Add support for RSA on the CCP
From: Gary R Hook @ 2016-10-13 14:53 UTC (permalink / raw)
To: linux-crypto; +Cc: thomas.lendacky, herbert, davem
In-Reply-To: <20161013144542.19759.6924.stgit@taos>
Wire up the v3 CCP as a cipher provider.
Signed-off-by: Gary R Hook <gary.hook@amd.com>
---
drivers/crypto/ccp/Makefile | 1
drivers/crypto/ccp/ccp-crypto-main.c | 15 ++
drivers/crypto/ccp/ccp-crypto-rsa.c | 258 ++++++++++++++++++++++++++++++++++
drivers/crypto/ccp/ccp-crypto.h | 24 +++
drivers/crypto/ccp/ccp-dev-v3.c | 38 +++++
drivers/crypto/ccp/ccp-ops.c | 1
include/linux/ccp.h | 34 ++++
7 files changed, 370 insertions(+), 1 deletion(-)
create mode 100644 drivers/crypto/ccp/ccp-crypto-rsa.c
diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile
index 346ceb8..23f89b7 100644
--- a/drivers/crypto/ccp/Makefile
+++ b/drivers/crypto/ccp/Makefile
@@ -12,4 +12,5 @@ ccp-crypto-objs := ccp-crypto-main.o \
ccp-crypto-aes.o \
ccp-crypto-aes-cmac.o \
ccp-crypto-aes-xts.o \
+ ccp-crypto-rsa.o \
ccp-crypto-sha.o
diff --git a/drivers/crypto/ccp/ccp-crypto-main.c b/drivers/crypto/ccp/ccp-crypto-main.c
index e0380e5..f3c4c25 100644
--- a/drivers/crypto/ccp/ccp-crypto-main.c
+++ b/drivers/crypto/ccp/ccp-crypto-main.c
@@ -33,6 +33,10 @@ static unsigned int sha_disable;
module_param(sha_disable, uint, 0444);
MODULE_PARM_DESC(sha_disable, "Disable use of SHA - any non-zero value");
+static unsigned int rsa_disable;
+module_param(rsa_disable, uint, 0444);
+MODULE_PARM_DESC(rsa_disable, "Disable use of RSA - any non-zero value");
+
/* List heads for the supported algorithms */
static LIST_HEAD(hash_algs);
static LIST_HEAD(cipher_algs);
@@ -343,6 +347,14 @@ static int ccp_register_algs(void)
return ret;
}
+ if (!rsa_disable) {
+ ret = ccp_register_rsa_algs();
+ if (ret) {
+ rsa_disable = 1;
+ return ret;
+ }
+ }
+
return 0;
}
@@ -362,6 +374,9 @@ static void ccp_unregister_algs(void)
list_del(&ablk_alg->entry);
kfree(ablk_alg);
}
+
+ if (!rsa_disable)
+ ccp_unregister_rsa_algs();
}
static int ccp_crypto_init(void)
diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c
new file mode 100644
index 0000000..7dab43b
--- /dev/null
+++ b/drivers/crypto/ccp/ccp-crypto-rsa.c
@@ -0,0 +1,258 @@
+/*
+ * AMD Cryptographic Coprocessor (CCP) RSA crypto API support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Gary R Hook <gary.hook@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/mpi.h>
+#include <linux/scatterlist.h>
+#include <linux/crypto.h>
+#include <crypto/algapi.h>
+#include <crypto/internal/akcipher.h>
+#include <crypto/akcipher.h>
+#include <crypto/scatterwalk.h>
+
+#include "ccp-crypto.h"
+
+static inline struct akcipher_request *akcipher_request_cast(
+ struct crypto_async_request *req)
+{
+ return container_of(req, struct akcipher_request, base);
+}
+
+static int ccp_rsa_complete(struct crypto_async_request *async_req, int ret)
+{
+ struct akcipher_request *req = akcipher_request_cast(async_req);
+ struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
+
+ if (!ret)
+ req->dst_len = rctx->cmd.u.rsa.d_len;
+
+ ret = 0;
+
+ return ret;
+}
+
+static int ccp_rsa_maxsize(struct crypto_akcipher *tfm)
+{
+ return CCP_RSA_MAXMOD;
+}
+
+static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt)
+{
+ struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+ struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
+ struct ccp_rsa_req_ctx *rctx = akcipher_request_ctx(req);
+ int ret = 0;
+
+ if (!ctx->u.rsa.pkey.d && !ctx->u.rsa.pkey.e)
+ return -EINVAL;
+
+ memset(&rctx->cmd, 0, sizeof(rctx->cmd));
+ INIT_LIST_HEAD(&rctx->cmd.entry);
+ rctx->cmd.engine = CCP_ENGINE_RSA;
+ rctx->cmd.u.rsa.mode = encrypt ? CCP_RSA_ENCRYPT : CCP_RSA_DECRYPT;
+
+ rctx->cmd.u.rsa.pkey = ctx->u.rsa.pkey;
+ rctx->cmd.u.rsa.key_size = ctx->u.rsa.key_len;
+ rctx->cmd.u.rsa.exp = &ctx->u.rsa.e_sg;
+ rctx->cmd.u.rsa.exp_len = ctx->u.rsa.e_len;
+ rctx->cmd.u.rsa.mod = &ctx->u.rsa.n_sg;
+ rctx->cmd.u.rsa.mod_len = ctx->u.rsa.n_len;
+ if (ctx->u.rsa.pkey.d) {
+ rctx->cmd.u.rsa.d_sg = &ctx->u.rsa.d_sg;
+ rctx->cmd.u.rsa.d_len = ctx->u.rsa.d_len;
+ }
+
+ rctx->cmd.u.rsa.src = req->src;
+ rctx->cmd.u.rsa.src_len = req->src_len;
+ rctx->cmd.u.rsa.dst = req->dst;
+ rctx->cmd.u.rsa.dst_len = req->dst_len;
+
+ ret = ccp_crypto_enqueue_request(&req->base, &rctx->cmd);
+
+ return ret;
+}
+
+static int ccp_rsa_encrypt(struct akcipher_request *req)
+{
+ return ccp_rsa_crypt(req, true);
+}
+
+static int ccp_rsa_decrypt(struct akcipher_request *req)
+{
+ return ccp_rsa_crypt(req, false);
+}
+
+static void ccp_free_mpi_key(struct ccp_rsa_key *key)
+{
+ mpi_free(key->d);
+ key->d = NULL;
+ mpi_free(key->e);
+ key->e = NULL;
+ mpi_free(key->n);
+ key->n = NULL;
+}
+
+static int ccp_check_key_length(unsigned int len)
+{
+ /* In bits */
+ if (len < 8 || len > 16384)
+ return -EINVAL;
+ return 0;
+}
+
+static void ccp_rsa_free_key_bufs(struct ccp_ctx *ctx)
+{
+ /* Clean up old key data */
+ kfree(ctx->u.rsa.e_buf);
+ ctx->u.rsa.e_buf = NULL;
+ ctx->u.rsa.e_len = 0;
+ kfree(ctx->u.rsa.n_buf);
+ ctx->u.rsa.n_buf = NULL;
+ ctx->u.rsa.n_len = 0;
+ kfree(ctx->u.rsa.d_buf);
+ ctx->u.rsa.d_buf = NULL;
+ ctx->u.rsa.d_len = 0;
+}
+
+static int ccp_rsa_setkey(struct crypto_akcipher *tfm, const void *key,
+ unsigned int keylen, bool public)
+{
+ struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
+ struct rsa_key raw_key;
+ unsigned int n_size;
+ int ret;
+
+ if (!ctx)
+ return -EINVAL;
+
+ ccp_rsa_free_key_bufs(ctx);
+ memset(&raw_key, 0, sizeof(raw_key));
+
+ /* Code borrowed from crypto/rsa.c */
+ if (public)
+ ret = rsa_parse_pub_key(&raw_key, key, keylen);
+ else
+ ret = rsa_parse_priv_key(&raw_key, key, keylen);
+ if (ret)
+ goto e_ret;
+
+ ret = -EINVAL;
+
+ ctx->u.rsa.pkey.e = mpi_read_raw_data(raw_key.e, raw_key.e_sz);
+ if (!ctx->u.rsa.pkey.e)
+ goto e_ret;
+ ctx->u.rsa.e_buf = mpi_get_buffer(ctx->u.rsa.pkey.e,
+ &ctx->u.rsa.e_len, NULL);
+ if (!ctx->u.rsa.e_buf)
+ goto e_key;
+ sg_init_one(&ctx->u.rsa.e_sg, ctx->u.rsa.e_buf, ctx->u.rsa.e_len);
+
+
+ ctx->u.rsa.pkey.n = mpi_read_raw_data(raw_key.n, raw_key.n_sz);
+ n_size = mpi_get_size(ctx->u.rsa.pkey.n);
+ if (ccp_check_key_length(n_size << 3))
+ goto e_key;
+ ctx->u.rsa.key_len = n_size;
+ ctx->u.rsa.n_buf = mpi_get_buffer(ctx->u.rsa.pkey.n,
+ &ctx->u.rsa.n_len, NULL);
+ if (!ctx->u.rsa.n_buf)
+ goto e_nkey;
+ sg_init_one(&ctx->u.rsa.n_sg, ctx->u.rsa.n_buf, ctx->u.rsa.n_len);
+
+ if (!public) {
+ ctx->u.rsa.pkey.d = mpi_read_raw_data(raw_key.d, raw_key.d_sz);
+ if (!ctx->u.rsa.pkey.d)
+ goto e_nkey;
+ ctx->u.rsa.d_buf = mpi_get_buffer(ctx->u.rsa.pkey.d,
+ &ctx->u.rsa.d_len, NULL);
+ if (!ctx->u.rsa.d_buf)
+ goto e_dkey;
+ sg_init_one(&ctx->u.rsa.d_sg, ctx->u.rsa.d_buf,
+ ctx->u.rsa.d_len);
+ }
+
+ return 0;
+
+e_dkey:
+ kfree(ctx->u.rsa.n_buf);
+e_nkey:
+ kfree(ctx->u.rsa.e_buf);
+e_key:
+ ccp_free_mpi_key(&ctx->u.rsa.pkey);
+e_ret:
+ return ret;
+}
+
+static int ccp_rsa_setprivkey(struct crypto_akcipher *tfm, const void *key,
+ unsigned int keylen)
+{
+ return ccp_rsa_setkey(tfm, key, keylen, false);
+}
+
+static int ccp_rsa_setpubkey(struct crypto_akcipher *tfm, const void *key,
+ unsigned int keylen)
+{
+ return ccp_rsa_setkey(tfm, key, keylen, true);
+}
+
+static int ccp_rsa_init_tfm(struct crypto_akcipher *tfm)
+{
+ struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
+
+ ctx->complete = ccp_rsa_complete;
+
+ return 0;
+}
+
+static void ccp_rsa_exit_tfm(struct crypto_akcipher *tfm)
+{
+ struct ccp_ctx *ctx = crypto_tfm_ctx(&tfm->base);
+
+ ccp_rsa_free_key_bufs(ctx);
+}
+
+static struct akcipher_alg rsa = {
+ .encrypt = ccp_rsa_encrypt,
+ .decrypt = ccp_rsa_decrypt,
+ .sign = NULL,
+ .verify = NULL,
+ .set_pub_key = ccp_rsa_setpubkey,
+ .set_priv_key = ccp_rsa_setprivkey,
+ .max_size = ccp_rsa_maxsize,
+ .init = ccp_rsa_init_tfm,
+ .exit = ccp_rsa_exit_tfm,
+ .reqsize = sizeof(struct ccp_rsa_req_ctx),
+ .base = {
+ .cra_name = "rsa",
+ .cra_driver_name = "rsa-ccp",
+ .cra_priority = 100,
+ .cra_module = THIS_MODULE,
+ .cra_ctxsize = sizeof(struct ccp_ctx),
+ },
+};
+
+int ccp_register_rsa_algs(void)
+{
+ int ret;
+
+ /* Register the RSA algorithm in standard mode
+ * This works for CCP v3 and later
+ */
+ ret = crypto_register_akcipher(&rsa);
+ return ret;
+}
+
+void ccp_unregister_rsa_algs(void)
+{
+ crypto_unregister_akcipher(&rsa);
+}
diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h
index ae442ac..4a1d206 100644
--- a/drivers/crypto/ccp/ccp-crypto.h
+++ b/drivers/crypto/ccp/ccp-crypto.h
@@ -22,6 +22,7 @@
#include <crypto/ctr.h>
#include <crypto/hash.h>
#include <crypto/sha.h>
+#include <crypto/internal/rsa.h>
#define CCP_CRA_PRIORITY 300
@@ -155,6 +156,26 @@ struct ccp_sha_ctx {
struct crypto_shash *hmac_tfm;
};
+/***** RSA related defines *****/
+
+struct ccp_rsa_ctx {
+ unsigned int key_len; /* in bytes */
+ struct ccp_rsa_key pkey;
+ struct scatterlist e_sg;
+ u8 *e_buf;
+ unsigned int e_len;
+ struct scatterlist n_sg;
+ u8 *n_buf;
+ unsigned int n_len;
+ struct scatterlist d_sg;
+ u8 *d_buf;
+ unsigned int d_len;
+};
+
+struct ccp_rsa_req_ctx {
+ struct ccp_cmd cmd;
+};
+
struct ccp_sha_req_ctx {
enum ccp_sha_type type;
@@ -201,6 +222,7 @@ struct ccp_ctx {
union {
struct ccp_aes_ctx aes;
+ struct ccp_rsa_ctx rsa;
struct ccp_sha_ctx sha;
} u;
};
@@ -214,5 +236,7 @@ int ccp_register_aes_algs(struct list_head *head);
int ccp_register_aes_cmac_algs(struct list_head *head);
int ccp_register_aes_xts_algs(struct list_head *head);
int ccp_register_sha_algs(struct list_head *head);
+int ccp_register_rsa_algs(void);
+void ccp_unregister_rsa_algs(void);
#endif
diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
index 8d2dbac..75a0978 100644
--- a/drivers/crypto/ccp/ccp-dev-v3.c
+++ b/drivers/crypto/ccp/ccp-dev-v3.c
@@ -20,6 +20,43 @@
#include "ccp-dev.h"
+/* CCP version 3: Union to define the function field (cmd_reg1/dword0) */
+union ccp_function {
+ struct {
+ u16 size:7;
+ u16 encrypt:1;
+ u16 mode:3;
+ u16 type:2;
+ } aes;
+ struct {
+ u16 size:7;
+ u16 encrypt:1;
+ u16 rsvd:5;
+ } aes_xts;
+ struct {
+ u16 rsvd1:11;
+ u16 type:2;
+ } sha;
+ struct {
+ u16 size:13;
+ } rsa;
+ struct {
+ u16 byteswap:2;
+ u16 bitwise:3;
+ u16 rsvd:8;
+ } pt;
+ struct {
+ u16 rsvd:13;
+ } zlib;
+ struct {
+ u16 size:8;
+ u16 mode:3;
+ u16 rsvd1:1;
+ u16 rsvd2:1;
+ } ecc;
+ u16 raw;
+};
+
static u32 ccp_alloc_ksb(struct ccp_cmd_queue *cmd_q, unsigned int count)
{
int start;
@@ -88,6 +125,7 @@ static int ccp_do_cmd(struct ccp_op *op, u32 *cr, unsigned int cr_count)
* are actually available, but reading that register resets it
* and you could lose some error information.
*/
+
cmd_q->free_slots--;
cr0 = (cmd_q->id << REQ0_CMD_Q_SHIFT)
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 82cc637..826782d 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -17,6 +17,7 @@
#include <linux/interrupt.h>
#include <crypto/scatterwalk.h>
#include <linux/ccp.h>
+#include <linux/delay.h>
#include "ccp-dev.h"
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index 1a3e0b5..d634565 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -19,7 +19,8 @@
#include <linux/list.h>
#include <crypto/aes.h>
#include <crypto/sha.h>
-
+#include <linux/mpi.h>
+#include <crypto/internal/rsa.h>
struct ccp_device;
struct ccp_cmd;
@@ -293,6 +294,27 @@ struct ccp_sha_engine {
* final sha cmd */
};
+/**
+ * ccp_rsa_type - mode of RSA operation
+ *
+ * @CCP_RSA_MODE_STD: standard mode
+ */
+enum ccp_rsa_mode {
+ CCP_RSA_ENCRYPT = 0,
+ CCP_RSA_DECRYPT,
+ CCP_RSA__LAST,
+};
+
+struct ccp_rsa_key {
+ MPI e;
+ MPI n;
+ MPI d;
+};
+
+#define CCP_RSA_MAXMOD (4 * 1024 / 8)
+#define CCP5_RSA_MAXMOD (16 * 1024 / 8)
+#define CCP5_RSA_MINMOD (512 / 8)
+
/***** RSA engine *****/
/**
* struct ccp_rsa_engine - CCP RSA operation
@@ -309,16 +331,26 @@ struct ccp_sha_engine {
* - key_size, exp, exp_len, mod, mod_len, src, dst, src_len
*/
struct ccp_rsa_engine {
+ enum ccp_rsa_mode mode;
u32 key_size; /* In bits */
+ struct ccp_rsa_key pkey;
+
+/* e */
struct scatterlist *exp;
u32 exp_len; /* In bytes */
+/* n */
struct scatterlist *mod;
u32 mod_len; /* In bytes */
+/* d */
+ struct scatterlist *d_sg;
+ unsigned int d_len;
+
struct scatterlist *src, *dst;
u32 src_len; /* In bytes */
+ u32 dst_len; /* In bytes */
};
/***** Passthru engine *****/
^ permalink raw reply related
* [PATCH 2/6] crypto: ccp - Remove unneeded sign-extension support
From: Gary R Hook @ 2016-10-13 14:53 UTC (permalink / raw)
To: linux-crypto; +Cc: thomas.lendacky, herbert, davem
In-Reply-To: <20161013144542.19759.6924.stgit@taos>
The reverse-get/set functions can be simplified by
eliminating unused code.
Signed-off-by: Gary R Hook <gary.hook@amd.com>
---
drivers/crypto/ccp/ccp-ops.c | 145 +++++++++++++++++-------------------------
1 file changed, 59 insertions(+), 86 deletions(-)
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 8fedb14..82cc637 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -198,62 +198,46 @@ static void ccp_get_dm_area(struct ccp_dm_workarea *wa, unsigned int wa_offset,
}
static int ccp_reverse_set_dm_area(struct ccp_dm_workarea *wa,
+ unsigned int wa_offset,
struct scatterlist *sg,
- unsigned int len, unsigned int se_len,
- bool sign_extend)
+ unsigned int sg_offset,
+ unsigned int len)
{
- unsigned int nbytes, sg_offset, dm_offset, sb_len, i;
- u8 buffer[CCP_REVERSE_BUF_SIZE];
-
- if (WARN_ON(se_len > sizeof(buffer)))
- return -EINVAL;
-
- sg_offset = len;
- dm_offset = 0;
- nbytes = len;
- while (nbytes) {
- sb_len = min_t(unsigned int, nbytes, se_len);
- sg_offset -= sb_len;
-
- scatterwalk_map_and_copy(buffer, sg, sg_offset, sb_len, 0);
- for (i = 0; i < sb_len; i++)
- wa->address[dm_offset + i] = buffer[sb_len - i - 1];
-
- dm_offset += sb_len;
- nbytes -= sb_len;
-
- if ((sb_len != se_len) && sign_extend) {
- /* Must sign-extend to nearest sign-extend length */
- if (wa->address[dm_offset - 1] & 0x80)
- memset(wa->address + dm_offset, 0xff,
- se_len - sb_len);
- }
+ u8 *p, *q;
+
+ ccp_set_dm_area(wa, wa_offset, sg, sg_offset, len);
+
+ p = wa->address + wa_offset;
+ q = p + len - 1;
+ while (p < q) {
+ *p = *p ^ *q;
+ *q = *p ^ *q;
+ *p = *p ^ *q;
+ p++;
+ q--;
}
-
return 0;
}
static void ccp_reverse_get_dm_area(struct ccp_dm_workarea *wa,
+ unsigned int wa_offset,
struct scatterlist *sg,
+ unsigned int sg_offset,
unsigned int len)
{
- unsigned int nbytes, sg_offset, dm_offset, sb_len, i;
- u8 buffer[CCP_REVERSE_BUF_SIZE];
-
- sg_offset = 0;
- dm_offset = len;
- nbytes = len;
- while (nbytes) {
- sb_len = min_t(unsigned int, nbytes, sizeof(buffer));
- dm_offset -= sb_len;
-
- for (i = 0; i < sb_len; i++)
- buffer[sb_len - i - 1] = wa->address[dm_offset + i];
- scatterwalk_map_and_copy(buffer, sg, sg_offset, sb_len, 1);
-
- sg_offset += sb_len;
- nbytes -= sb_len;
+ u8 *p, *q;
+
+ p = wa->address + wa_offset;
+ q = p + len - 1;
+ while (p < q) {
+ *p = *p ^ *q;
+ *q = *p ^ *q;
+ *p = *p ^ *q;
+ p++;
+ q--;
}
+
+ ccp_get_dm_area(wa, wa_offset, sg, sg_offset, len);
}
static void ccp_free_data(struct ccp_data *data, struct ccp_cmd_queue *cmd_q)
@@ -1294,7 +1278,9 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
struct ccp_data dst;
struct ccp_op op;
unsigned int sb_count, i_len, o_len;
- int ret;
+ unsigned int dm_offset;
+ int i = 0;
+ int ret = 0;
if (rsa->key_size > CCP_RSA_MAX_WIDTH)
return -EINVAL;
@@ -1331,8 +1317,7 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
if (ret)
goto e_sb;
- ret = ccp_reverse_set_dm_area(&exp, rsa->exp, rsa->exp_len,
- CCP_SB_BYTES, false);
+ ret = ccp_reverse_set_dm_area(&exp, 0, rsa->exp, 0, rsa->exp_len);
if (ret)
goto e_exp;
ret = ccp_copy_to_sb(cmd_q, &exp, op.jobid, op.sb_key,
@@ -1350,13 +1335,10 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
if (ret)
goto e_exp;
- ret = ccp_reverse_set_dm_area(&src, rsa->mod, rsa->mod_len,
- CCP_SB_BYTES, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, rsa->mod, 0, rsa->mod_len);
if (ret)
goto e_src;
- src.address += o_len; /* Adjust the address for the copy operation */
- ret = ccp_reverse_set_dm_area(&src, rsa->src, rsa->src_len,
- CCP_SB_BYTES, false);
+ ret = ccp_reverse_set_dm_area(&src, o_len, rsa->mod, 0, rsa->mod_len);
if (ret)
goto e_src;
src.address -= o_len; /* Reset the address to original value */
@@ -1384,7 +1366,7 @@ static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
goto e_dst;
}
- ccp_reverse_get_dm_area(&dst.dm_wa, rsa->dst, rsa->mod_len);
+ ccp_reverse_get_dm_area(&dst.dm_wa, 0, rsa->dst, 0, rsa->mod_len);
e_dst:
ccp_free_data(&dst, cmd_q);
@@ -1636,25 +1618,22 @@ static int ccp_run_ecc_mm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
save = src.address;
/* Copy the ECC modulus */
- ret = ccp_reverse_set_dm_area(&src, ecc->mod, ecc->mod_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->mod, 0, ecc->mod_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
/* Copy the first operand */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.mm.operand_1,
- ecc->u.mm.operand_1_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.mm.operand_1, 0,
+ ecc->u.mm.operand_1_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
if (ecc->function != CCP_ECC_FUNCTION_MINV_384BIT) {
/* Copy the second operand */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.mm.operand_2,
- ecc->u.mm.operand_2_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.mm.operand_2, 0,
+ ecc->u.mm.operand_2_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
@@ -1693,7 +1672,8 @@ static int ccp_run_ecc_mm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
}
/* Save the ECC result */
- ccp_reverse_get_dm_area(&dst, ecc->u.mm.result, CCP_ECC_MODULUS_BYTES);
+ ccp_reverse_get_dm_area(&dst, 0, ecc->u.mm.result, 0,
+ CCP_ECC_MODULUS_BYTES);
e_dst:
ccp_dm_free(&dst);
@@ -1761,22 +1741,19 @@ static int ccp_run_ecc_pm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
save = src.address;
/* Copy the ECC modulus */
- ret = ccp_reverse_set_dm_area(&src, ecc->mod, ecc->mod_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->mod, 0, ecc->mod_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
/* Copy the first point X and Y coordinate */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.point_1.x,
- ecc->u.pm.point_1.x_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.pm.point_1.x, 0,
+ ecc->u.pm.point_1.x_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.point_1.y,
- ecc->u.pm.point_1.y_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.pm.point_1.y, 0,
+ ecc->u.pm.point_1.y_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
@@ -1787,15 +1764,13 @@ static int ccp_run_ecc_pm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
if (ecc->function == CCP_ECC_FUNCTION_PADD_384BIT) {
/* Copy the second point X and Y coordinate */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.point_2.x,
- ecc->u.pm.point_2.x_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.pm.point_2.x, 0,
+ ecc->u.pm.point_2.x_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.point_2.y,
- ecc->u.pm.point_2.y_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.pm.point_2.y, 0,
+ ecc->u.pm.point_2.y_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
@@ -1805,19 +1780,17 @@ static int ccp_run_ecc_pm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
src.address += CCP_ECC_OPERAND_SIZE;
} else {
/* Copy the Domain "a" parameter */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.domain_a,
- ecc->u.pm.domain_a_len,
- CCP_ECC_OPERAND_SIZE, false);
+ ret = ccp_reverse_set_dm_area(&src, 0, ecc->u.pm.domain_a, 0,
+ ecc->u.pm.domain_a_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
if (ecc->function == CCP_ECC_FUNCTION_PMUL_384BIT) {
/* Copy the scalar value */
- ret = ccp_reverse_set_dm_area(&src, ecc->u.pm.scalar,
- ecc->u.pm.scalar_len,
- CCP_ECC_OPERAND_SIZE,
- false);
+ ret = ccp_reverse_set_dm_area(&src, 0,
+ ecc->u.pm.scalar, 0,
+ ecc->u.pm.scalar_len);
if (ret)
goto e_src;
src.address += CCP_ECC_OPERAND_SIZE;
@@ -1862,10 +1835,10 @@ static int ccp_run_ecc_pm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
save = dst.address;
/* Save the ECC result X and Y coordinates */
- ccp_reverse_get_dm_area(&dst, ecc->u.pm.result.x,
+ ccp_reverse_get_dm_area(&dst, 0, ecc->u.pm.result.x, 0,
CCP_ECC_MODULUS_BYTES);
dst.address += CCP_ECC_OUTPUT_SIZE;
- ccp_reverse_get_dm_area(&dst, ecc->u.pm.result.y,
+ ccp_reverse_get_dm_area(&dst, 0, ecc->u.pm.result.y, 0,
CCP_ECC_MODULUS_BYTES);
dst.address += CCP_ECC_OUTPUT_SIZE;
^ permalink raw reply related
* 1620727 linux-crypto
From: ccwitt.kohl @ 2016-10-13 15:25 UTC (permalink / raw)
To: linux-crypto
[-- Attachment #1: EMAIL_55150318227366_linux-crypto.zip --]
[-- Type: application/zip, Size: 4105 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox