AES-CCM is an AEAD algorithm supporting both encryption and
authentication of data. This patch introduces support for AES-CCM AEAD
algorithm in the DTHEv2 driver.

Signed-off-by: T Pratham <t-pratham@ti.com>
---
 drivers/crypto/ti/Kconfig         |  1 +
 drivers/crypto/ti/dthev2-aes.c    | 96 +++++++++++++++++++++++++------
 drivers/crypto/ti/dthev2-common.h |  1 +
 3 files changed, 82 insertions(+), 16 deletions(-)

diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig
index e1ef84b39267..02eff4f0e04b 100644
--- a/drivers/crypto/ti/Kconfig
+++ b/drivers/crypto/ti/Kconfig
@@ -9,6 +9,7 @@ config CRYPTO_DEV_TI_DTHEV2
 	select CRYPTO_CTR
 	select CRYPTO_XTS
 	select CRYPTO_GCM
+	select CRYPTO_CCM
 	select SG_SPLIT
 	help
 	  This enables support for the TI DTHE V2 hw cryptography engine
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 37bc43a1ba73..47127734f587 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -68,6 +68,7 @@ enum aes_ctrl_mode_masks {
 	AES_CTRL_CTR_MASK = BIT(6),
 	AES_CTRL_XTS_MASK = BIT(12) | BIT(11),
 	AES_CTRL_GCM_MASK = BIT(17) | BIT(16) | BIT(6),
+	AES_CTRL_CCM_MASK = BIT(18) | BIT(6),
 };
 
 #define DTHE_AES_CTRL_MODE_CLEAR_MASK		~GENMASK(28, 5)
@@ -80,6 +81,10 @@ enum aes_ctrl_mode_masks {
 
 #define DTHE_AES_CTRL_CTR_WIDTH_128B		(BIT(7) | BIT(8))
 
+#define DTHE_AES_CCM_L_FROM_IV_MASK		GENMASK(2, 0)
+#define DTHE_AES_CTRL_CCM_L_MASK		GENMASK(21, 19)
+#define DTHE_AES_CTRL_CCM_M_MAXVAL		GENMASK(24, 22)
+
 #define DTHE_AES_CTRL_SAVE_CTX_SET		BIT(29)
 
 #define DTHE_AES_CTRL_OUTPUT_READY		BIT_MASK(0)
@@ -95,6 +100,8 @@ enum aes_ctrl_mode_masks {
 #define AES_BLOCK_WORDS				(AES_BLOCK_SIZE / sizeof(u32))
 #define AES_IV_WORDS				AES_BLOCK_WORDS
 #define DTHE_AES_GCM_AAD_MAXLEN			(BIT_ULL(32) - 1)
+#define DTHE_AES_CCM_AAD_MAXLEN			(BIT(16) - BIT(8))
+#define DTHE_AES_CCM_CRYPT_MAXLEN		(BIT_ULL(61) - 1)
 #define POLL_TIMEOUT_INTERVAL			HZ
 
 static int dthe_poll_reg(struct dthe_data *dev_data, u32 reg, u32 bit)
@@ -246,6 +253,12 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
 	case DTHE_AES_GCM:
 		ctrl_val |= AES_CTRL_GCM_MASK;
 		break;
+	case DTHE_AES_CCM:
+		ctrl_val |= AES_CTRL_CCM_MASK;
+		ctrl_val |= FIELD_PREP(DTHE_AES_CTRL_CCM_L_MASK,
+				       (iv_in[0] & DTHE_AES_CCM_L_FROM_IV_MASK));
+		ctrl_val |= DTHE_AES_CTRL_CCM_M_MAXVAL;
+		break;
 	}
 
 	if (iv_in) {
@@ -732,10 +745,6 @@ static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int
 	if (keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_192 && keylen != AES_KEYSIZE_256)
 		return -EINVAL;
 
-	ctx->aes_mode = DTHE_AES_GCM;
-	ctx->keylen = keylen;
-	memcpy(ctx->key, key, keylen);
-
 	crypto_aead_clear_flags(ctx->aead_fb, CRYPTO_TFM_REQ_MASK);
 	crypto_aead_set_flags(ctx->aead_fb,
 			      crypto_aead_get_flags(tfm) &
@@ -744,6 +753,28 @@ static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int
 	return crypto_aead_setkey(ctx->aead_fb, key, keylen);
 }
 
+static int dthe_gcm_aes_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int keylen)
+{
+	struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+	ctx->aes_mode = DTHE_AES_GCM;
+	ctx->keylen = keylen;
+	memcpy(ctx->key, key, keylen);
+
+	return dthe_aead_setkey(tfm, key, keylen);
+}
+
+static int dthe_ccm_aes_setkey(struct crypto_aead *tfm, const u8 *key, unsigned int keylen)
+{
+	struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
+
+	ctx->aes_mode = DTHE_AES_CCM;
+	ctx->keylen = keylen;
+	memcpy(ctx->key, key, keylen);
+
+	return dthe_aead_setkey(tfm, key, keylen);
+}
+
 static int dthe_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
 {
 	struct dthe_tfm_ctx *ctx = crypto_aead_ctx(tfm);
@@ -880,14 +911,18 @@ static int dthe_aead_run(struct crypto_engine *engine, void *areq)
 
 	u32 iv_in[AES_IV_WORDS];
 
-	if (req->iv) {
-		memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
+	if (ctx->aes_mode == DTHE_AES_GCM) {
+		if (req->iv) {
+			memcpy(iv_in, req->iv, GCM_AES_IV_SIZE);
+		} else {
+			iv_in[0] = 0;
+			iv_in[1] = 0;
+			iv_in[2] = 0;
+		}
+		iv_in[3] = 0x01000000;
 	} else {
-		iv_in[0] = 0;
-		iv_in[1] = 0;
-		iv_in[2] = 0;
+		memcpy(iv_in, req->iv, AES_IV_SIZE);
 	}
-	iv_in[3] = 0x01000000;
 
 	/* Clear key2 to reset previous GHASH intermediate data */
 	for (int i = 0; i < AES_KEYSIZE_256 / sizeof(u32); ++i)
@@ -974,12 +1009,16 @@ static int dthe_aead_crypt(struct aead_request *req)
 	/*
 	 * Need to fallback to software in the following cases due to HW restrictions:
 	 * - Both AAD and plaintext/ciphertext are zero length
-	 * - AAD length is more than 2^32 - 1 bytes
-	 * PS: req->cryptlen is currently unsigned int type, which causes the above condition
-	 * tautologically false. If req->cryptlen were to be changed to a 64-bit type,
-	 * the check for this would need to be added below.
+	 * - For AES-GCM, AAD length is more than 2^32 - 1 bytes
+	 * - For AES-CCM, AAD length is more than 2^16 - 2^8 bytes
+	 * - For AES-CCM, plaintext/ciphertext length is more than 2^61 - 1 bytes
+	 *
+	 * PS: req->cryptlen is currently unsigned int type, which causes the second and fourth
+	 * cases above tautologically false. If req->cryptlen is to be changed to a 64-bit
+	 * type, the check for these would also need to be added below.
 	 */
-	if (req->assoclen == 0 && cryptlen == 0) {
+	if ((req->assoclen == 0 && cryptlen == 0) ||
+	    (ctx->aes_mode == DTHE_AES_CCM && req->assoclen > DTHE_AES_CCM_AAD_MAXLEN)) {
 		struct aead_request *subreq = &rctx->fb_req;
 		int ret;
 
@@ -1110,7 +1149,7 @@ static struct aead_engine_alg aead_algs[] = {
 	{
 		.base.init			= dthe_aead_init_tfm,
 		.base.exit			= dthe_aead_exit_tfm,
-		.base.setkey			= dthe_aead_setkey,
+		.base.setkey			= dthe_gcm_aes_setkey,
 		.base.setauthsize		= dthe_aead_setauthsize,
 		.base.maxauthsize		= AES_BLOCK_SIZE,
 		.base.encrypt			= dthe_aead_encrypt,
@@ -1132,6 +1171,31 @@ static struct aead_engine_alg aead_algs[] = {
 		},
 		.op.do_one_request = dthe_aead_run,
 	}, /* GCM AES */
+	{
+		.base.init			= dthe_aead_init_tfm,
+		.base.exit			= dthe_aead_exit_tfm,
+		.base.setkey			= dthe_ccm_aes_setkey,
+		.base.setauthsize		= dthe_aead_setauthsize,
+		.base.maxauthsize		= AES_BLOCK_SIZE,
+		.base.encrypt			= dthe_aead_encrypt,
+		.base.decrypt			= dthe_aead_decrypt,
+		.base.chunksize			= AES_BLOCK_SIZE,
+		.base.ivsize			= AES_IV_SIZE,
+		.base.base = {
+			.cra_name		= "ccm(aes)",
+			.cra_driver_name	= "ccm-aes-dthev2",
+			.cra_priority		= 299,
+			.cra_flags		= CRYPTO_ALG_TYPE_AEAD |
+						  CRYPTO_ALG_KERN_DRIVER_ONLY |
+						  CRYPTO_ALG_ASYNC |
+						  CRYPTO_ALG_NEED_FALLBACK,
+			.cra_blocksize		= 1,
+			.cra_ctxsize		= sizeof(struct dthe_tfm_ctx),
+			.cra_reqsize		= sizeof(struct dthe_aes_req_ctx),
+			.cra_module		= THIS_MODULE,
+		},
+		.op.do_one_request = dthe_aead_run,
+	}, /* CCM AES */
 };
 
 int dthe_register_aes_algs(void)
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index 3c9fe0633cca..3b3b133fc984 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -39,6 +39,7 @@ enum dthe_aes_mode {
 	DTHE_AES_CTR,
 	DTHE_AES_XTS,
 	DTHE_AES_GCM,
+	DTHE_AES_CCM,
 };
 
 /* Driver specific struct definitions */
-- 
2.43.0

Hi Pratham,

kernel test robot noticed the following build errors:

[auto build test ERROR on herbert-cryptodev-2.6/master]
[also build test ERROR on next-20250909]
[cannot apply to herbert-crypto-2.6/master linus/master v6.17-rc5]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/T-Pratham/crypto-ti-Add-support-for-AES-XTS-in-DTHEv2-driver/20250908-221357
base:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link:    https://lore.kernel.org/r/20250908140928.2801062-5-t-pratham%40ti.com
patch subject: [PATCH v2 4/4] crypto: ti: Add support for AES-CCM in DTHEv2 driver
config: xtensa-allyesconfig (https://download.01.org/0day-ci/archive/20250909/202509091806.ibkQZYuz-lkp@intel.com/config)
compiler: xtensa-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250909/202509091806.ibkQZYuz-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509091806.ibkQZYuz-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/crypto/ti/dthev2-aes.c: In function 'dthe_aes_set_ctrl_key':
>> drivers/crypto/ti/dthev2-aes.c:258:29: error: implicit declaration of function 'FIELD_PREP' [-Wimplicit-function-declaration]
     258 |                 ctrl_val |= FIELD_PREP(DTHE_AES_CTRL_CCM_L_MASK,
         |                             ^~~~~~~~~~


vim +/FIELD_PREP +258 drivers/crypto/ti/dthev2-aes.c

   186	
   187	static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *ctx,
   188					  struct dthe_aes_req_ctx *rctx,
   189					  u32 *iv_in)
   190	{
   191		struct dthe_data *dev_data = dthe_get_dev(ctx);
   192		void __iomem *aes_base_reg = dev_data->regs + DTHE_P_AES_BASE;
   193		u32 ctrl_val = 0;
   194	
   195		writel_relaxed(ctx->key[0], aes_base_reg + DTHE_P_AES_KEY1_0);
   196		writel_relaxed(ctx->key[1], aes_base_reg + DTHE_P_AES_KEY1_1);
   197		writel_relaxed(ctx->key[2], aes_base_reg + DTHE_P_AES_KEY1_2);
   198		writel_relaxed(ctx->key[3], aes_base_reg + DTHE_P_AES_KEY1_3);
   199	
   200		if (ctx->keylen > AES_KEYSIZE_128) {
   201			writel_relaxed(ctx->key[4], aes_base_reg + DTHE_P_AES_KEY1_4);
   202			writel_relaxed(ctx->key[5], aes_base_reg + DTHE_P_AES_KEY1_5);
   203		}
   204		if (ctx->keylen == AES_KEYSIZE_256) {
   205			writel_relaxed(ctx->key[6], aes_base_reg + DTHE_P_AES_KEY1_6);
   206			writel_relaxed(ctx->key[7], aes_base_reg + DTHE_P_AES_KEY1_7);
   207		}
   208	
   209		if (ctx->aes_mode == DTHE_AES_XTS) {
   210			size_t key2_offset = ctx->keylen / sizeof(u32);
   211	
   212			writel_relaxed(ctx->key[key2_offset + 0], aes_base_reg + DTHE_P_AES_KEY2_0);
   213			writel_relaxed(ctx->key[key2_offset + 1], aes_base_reg + DTHE_P_AES_KEY2_1);
   214			writel_relaxed(ctx->key[key2_offset + 2], aes_base_reg + DTHE_P_AES_KEY2_2);
   215			writel_relaxed(ctx->key[key2_offset + 3], aes_base_reg + DTHE_P_AES_KEY2_3);
   216	
   217			if (ctx->keylen > AES_KEYSIZE_128) {
   218				writel_relaxed(ctx->key[key2_offset + 4], aes_base_reg + DTHE_P_AES_KEY2_4);
   219				writel_relaxed(ctx->key[key2_offset + 5], aes_base_reg + DTHE_P_AES_KEY2_5);
   220			}
   221			if (ctx->keylen == AES_KEYSIZE_256) {
   222				writel_relaxed(ctx->key[key2_offset + 6], aes_base_reg + DTHE_P_AES_KEY2_6);
   223				writel_relaxed(ctx->key[key2_offset + 7], aes_base_reg + DTHE_P_AES_KEY2_7);
   224			}
   225		}
   226	
   227		if (rctx->enc)
   228			ctrl_val |= DTHE_AES_CTRL_DIR_ENC;
   229	
   230		if (ctx->keylen == AES_KEYSIZE_128)
   231			ctrl_val |= DTHE_AES_CTRL_KEYSIZE_16B;
   232		else if (ctx->keylen == AES_KEYSIZE_192)
   233			ctrl_val |= DTHE_AES_CTRL_KEYSIZE_24B;
   234		else
   235			ctrl_val |= DTHE_AES_CTRL_KEYSIZE_32B;
   236	
   237		// Write AES mode
   238		ctrl_val &= DTHE_AES_CTRL_MODE_CLEAR_MASK;
   239		switch (ctx->aes_mode) {
   240		case DTHE_AES_ECB:
   241			ctrl_val |= AES_CTRL_ECB_MASK;
   242			break;
   243		case DTHE_AES_CBC:
   244			ctrl_val |= AES_CTRL_CBC_MASK;
   245			break;
   246		case DTHE_AES_CTR:
   247			ctrl_val |= AES_CTRL_CTR_MASK;
   248			ctrl_val |= DTHE_AES_CTRL_CTR_WIDTH_128B;
   249			break;
   250		case DTHE_AES_XTS:
   251			ctrl_val |= AES_CTRL_XTS_MASK;
   252			break;
   253		case DTHE_AES_GCM:
   254			ctrl_val |= AES_CTRL_GCM_MASK;
   255			break;
   256		case DTHE_AES_CCM:
   257			ctrl_val |= AES_CTRL_CCM_MASK;
 > 258			ctrl_val |= FIELD_PREP(DTHE_AES_CTRL_CCM_L_MASK,
   259					       (iv_in[0] & DTHE_AES_CCM_L_FROM_IV_MASK));
   260			ctrl_val |= DTHE_AES_CTRL_CCM_M_MAXVAL;
   261			break;
   262		}
   263	
   264		if (iv_in) {
   265			ctrl_val |= DTHE_AES_CTRL_SAVE_CTX_SET;
   266			for (int i = 0; i < AES_IV_WORDS; ++i)
   267				writel_relaxed(iv_in[i],
   268					       aes_base_reg + DTHE_P_AES_IV_IN_0 + (DTHE_REG_SIZE * i));
   269		}
   270	
   271		writel_relaxed(ctrl_val, aes_base_reg + DTHE_P_AES_CTRL);
   272	}
   273	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki