From nobody Mon Dec 1 23:06:44 2025 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013028.outbound.protection.outlook.com [40.93.196.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9787F320A04; Wed, 26 Nov 2025 11:23:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.28 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764156199; cv=fail; b=B7S23JC6D3BjWSoCTtjztz9P1f/nQo68k2SMCOh4ubI4p6HGHrnmHbChwPKwvDwN820fqNZFTPAwe/zNPsO0L4xQ8Rs+mJRNBjMf0RRa5yiC4+Ga7IySvj1YX9OUIRfF5siyi1OffPhfpZ7PwAhCZXNDRvlaleYgEh5H7jmQTr0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764156199; c=relaxed/simple; bh=mQTWKAYncd+BK5gDvPaM1irlP/vdc+5IAdadKToNWBc=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=pPz5cYEMyKNHVAFKJa9ACj9V6gRrqEW4V6p/mXhaHqlZS7ONVldvpHfCAL0lCUxKVnjr8hWN/iYYNDtYgjyln+mSfBUviiFVj7s1kjYCGCdoZy1qylgW3MGnTx35NvaQkuraU9XErV/+d2XIi/n+uZ4DceD+eQhX/6O7OQ+vhVE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ti.com; spf=pass smtp.mailfrom=ti.com; dkim=pass (1024-bit key) header.d=ti.com header.i=@ti.com header.b=K3IjwYTd; arc=fail smtp.client-ip=40.93.196.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ti.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ti.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ti.com header.i=@ti.com header.b="K3IjwYTd" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=gOWsQVnJluO1YsbXll6+Npgj+UJc3tf2bzW/Ka26rG9qyI0zDfrcXyKA2k0R9neWW4cE0CKkl6TOrfGnMzyWi/BlgcLlQwgrk8jWwI/iFTzeq3B8cTlUcOnDAvfu7Q712GvxA0lYUrGVALMB1WzYh9nQZitEfKua0VOys/PIpEN4J9NQFXEgva77B4vSiRAYTsBoVllbc3UfzYSKI6EdeLlY79Ptl2Tebtxtx84bOo2xYDbLMqugo/MVoaIGTcO/NgoMlfKuHb0CqTYgXEdPXjoUp4efvkmXG0sdpU6QKY+O2BE0tSQQxFM5vbpI5zRG4OXTrAX7fvd+f9v/53JCsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PrPyVHF3a0Pxv+SgpA1dZgfHR1MCrLmtXb1i1ux2I70=; b=vNiD2HSpEyVLbwOwVvZYthAPEABT/OQApOxo/KqPpFRKvwJrtxJ2yKJLuZr/JkJYhwsl7ddBaWQ7JfsnV7q6ZMjfJuAAogeo1IXfhmcmvhIOupz+D1xNH3Pg257KVO3eFVVR8Oe0lbTlxS5eoLwxp3qxTFu4IqjMcsH4RJ190IU3QA7wdaNVzaT2AuXnJaIvy4GFqwGWQpyjBrFYi1wnSf3na2Pqmo/8yfyJy4hQUdGJb3j1exmXt3aXjxsJONHFpUjxWloGS6qbFuIsy7uM2+nPXeRgl+gVJrOJip3JyqC1sc7OkiTvCd0PGhUg5s62JJ7Dru27J3ILGpcjnjpJWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.23.194) smtp.rcpttodomain=gondor.apana.org.au smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PrPyVHF3a0Pxv+SgpA1dZgfHR1MCrLmtXb1i1ux2I70=; b=K3IjwYTdX0Kg/HCyNzEQ+5FQSPX5wIEeXfbeFXG6brTpDLleDOGOCxGnE2clqJIJ2h6+TkAMMXx02of0/xmH/CM/5noQ58we3uGNT8PCFocJfOOjcZ9aLwe2dD2ezZA5/N9FyHH2Dn8PWOzlp7UQ9jh9lxoNEhPYnbiwKhpz2tM= Received: from PH1PEPF00013303.namprd07.prod.outlook.com (2603:10b6:518:1::12) by DS4PR10MB997551.namprd10.prod.outlook.com (2603:10b6:8:31a::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.17; Wed, 26 Nov 2025 11:23:12 +0000 Received: from CO1PEPF000044FC.namprd21.prod.outlook.com (2a01:111:f403:c91d::4) by PH1PEPF00013303.outlook.office365.com (2603:1036:903:47::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9343.10 via Frontend Transport; Wed, 26 Nov 2025 11:23:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 198.47.23.194) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.23.194 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.23.194; helo=lewvzet200.ext.ti.com; pr=C Received: from lewvzet200.ext.ti.com (198.47.23.194) by CO1PEPF000044FC.mail.protection.outlook.com (10.167.241.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9388.0 via Frontend Transport; Wed, 26 Nov 2025 11:23:11 +0000 Received: from DLEE211.ent.ti.com (157.170.170.113) by lewvzet200.ext.ti.com (10.4.14.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 26 Nov 2025 05:23:07 -0600 Received: from DLEE206.ent.ti.com (157.170.170.90) by DLEE211.ent.ti.com (157.170.170.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 26 Nov 2025 05:23:07 -0600 Received: from lelvem-mr06.itg.ti.com (10.180.75.8) by DLEE206.ent.ti.com (157.170.170.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20 via Frontend Transport; Wed, 26 Nov 2025 05:23:07 -0600 Received: from pratham-Workstation-PC (pratham-workstation-pc.dhcp.ti.com [10.24.69.191]) by lelvem-mr06.itg.ti.com (8.18.1/8.18.1) with ESMTP id 5AQBN5il1172494; Wed, 26 Nov 2025 05:23:06 -0600 From: T Pratham To: T Pratham , Herbert Xu , "David S. Miller" CC: Manorit Chawdhry , Kamlesh Gurudasani , Shiva Tripathi , Kavitha Malarvizhi , Vishal Mahaveer , Praneeth Bajjuri , , Subject: [PATCH v7 2/3] crypto: ti - Add support for AES-GCM in DTHEv2 driver Date: Wed, 26 Nov 2025 16:46:16 +0530 Message-ID: <20251126112207.4033971-3-t-pratham@ti.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251126112207.4033971-1-t-pratham@ti.com> References: <20251126112207.4033971-1-t-pratham@ti.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-C2ProcessedOrg: 333ef613-75bf-4e12-a4b1-8e3623f5dcea X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1PEPF000044FC:EE_|DS4PR10MB997551:EE_ X-MS-Office365-Filtering-Correlation-Id: 4585ac26-437d-49d7-e65a-08de2cde2edd X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|376014|36860700013; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?OEstYaire9A8mZbPeWEuwMUVDWurCEGP/SCiZCgcdVZvIODc9+uU4mG8ELr7?= =?us-ascii?Q?EHKzMXqiiZR0V/FdBQmwDINX3dsjqYqbrXuM9WzydGa8vH0jOtP++JUcrVUz?= =?us-ascii?Q?+BHCxfHdH2XXk6f1zZ/Wl+oWd+6jvEF5WRiU+Yd4GB749N6Dd6WdzG88bhUy?= =?us-ascii?Q?rl7LYuzyCDTTpsDJ8N1r0fntOICioME1jhxwdonDX0CCnNI1/KoOuL83dkv+?= =?us-ascii?Q?QMNp+XZsZspWgp2OgCIo+67p+A1olz6WKVpXuDvEnCkc0uwu7j/WJGP3ZfXt?= =?us-ascii?Q?z8f7J1QGVeULl8wdMwzX48doOoE4bkPqQOTwHxTxfjptz49DosmxZjChZFul?= =?us-ascii?Q?kQtVl8TNn1/kFj7f2Kzf7P3rD9POEjyz5vhazr8aw/ZJJTy5HgkRy/UHdoFg?= =?us-ascii?Q?KDe/aOqgF5bcKRrqgIb+9/sSsuaD/4PPAOBHpoc1RMBMFcT8jsYNjZ1mQtSt?= =?us-ascii?Q?6FNVnhmE5RxqkEMtTWeCWKTAtrqv2TgpJHqWmoDmcjy1Ebb5BFE5JjU5jfpD?= =?us-ascii?Q?eFN874yO9ToWKyyphkwHcpKSZXlkH9ZM1CL/e1mKMRTkWTVpGZWL+w0usYz9?= =?us-ascii?Q?JRfy4v4eg/mrypwHWWNGhJwCHkqNAN87WaISEjf46P/o7d0Rg8cBC9XI/g0D?= =?us-ascii?Q?5ScMLv6ZtulRFapHis0WxVLONvDvXg07m1W8hK67cPqVX+P8xkOkWePdQRZx?= =?us-ascii?Q?x9rhQY3A4usq9PERUtbQWweqS4mUgcEPBQ48ovbH9i0vL0cijMJjRLOR9zau?= =?us-ascii?Q?Tn5E7luACoZJVXEYbI6rkgOKsGkpkKhz3BCk5govkbDEZHBX/h8vP8YVWE1C?= =?us-ascii?Q?FiTZkA0J12OAQspzpuXzo3zozMQKmciQn99HgTbeUKmS3wveBSb3bGgCPdt1?= =?us-ascii?Q?8ZC/qUTCjEOh73CANVD91tHWpxo0Nx+Z5yq31PiUxQP+9mrMNLoMplFdcvuE?= =?us-ascii?Q?9rxWHY54KRvVvfReELuTqFBmDwARkEWO/Ypaq/DlNyK/B6L6UMbQwcv2L+nl?= =?us-ascii?Q?mcSn1BXkVhbmfQLSb/87qimD/GYY7hsQF/qvH1cZiF+ynAGIwu2sEGokhlb+?= =?us-ascii?Q?mZcI4slNOF0lagaKvhvcY7ZreaiBEQ8Jo71NHuJgMrTF2D4G+azcFNeMBhvv?= =?us-ascii?Q?NWMBRnCVRk/JZ20Pmv740QR3kz5a7SuoWZBl9Lm95pdtPbNJTQlS+z1QTxl1?= =?us-ascii?Q?Ij1OwUmXV+JDYV13Tg8Jm4mJT2S6/l9wxy2ck8vveo/oPBLVCBEBmJT4jczh?= =?us-ascii?Q?Vm1SRArLm9v2w56igz7R4ekCn3VRM07OSXe8LXVuntjpG7g2bdO1oy/zLruQ?= =?us-ascii?Q?LkMNLiOJd1pmvI6i4AekWoov/OigWBrWyUluLv+lv6Zc5o1UG0R58v86dTsa?= =?us-ascii?Q?Jw7//+frPVX1CuygZ69C/rxFl606XzfZuxKeplbo8zCQRW1CAzpKxwp6ZUSY?= =?us-ascii?Q?rh0+SF6I6RBGuDoAWU3YSj7QUMqjrSMcAbgiqLtPib8Cdg7c5+GZAgFv2pKy?= =?us-ascii?Q?sCqWkzGs8vieDom7+QSfeLhtKwBKWjQysvsC6jQmEUy/tDogqBEZegOHipSQ?= =?us-ascii?Q?Zq05Jfw80O0bXSexQfY=3D?= X-Forefront-Antispam-Report: CIP:198.47.23.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:lewvzet200.ext.ti.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(376014)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Nov 2025 11:23:11.2916 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4585ac26-437d-49d7-e65a-08de2cde2edd X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.23.194];Helo=[lewvzet200.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: CO1PEPF000044FC.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS4PR10MB997551 Content-Type: text/plain; charset="utf-8" AES-GCM is an AEAD algorithm supporting both encryption and authentication of data. This patch introduces support for AES-GCM as the first AEAD algorithm supported by the DTHEv2 driver. Signed-off-by: T Pratham --- drivers/crypto/ti/Kconfig | 2 + drivers/crypto/ti/dthev2-aes.c | 595 +++++++++++++++++++++++++++++- drivers/crypto/ti/dthev2-common.c | 19 + drivers/crypto/ti/dthev2-common.h | 25 +- 4 files changed, 638 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/ti/Kconfig b/drivers/crypto/ti/Kconfig index 6027e12de279d..221e483737439 100644 --- a/drivers/crypto/ti/Kconfig +++ b/drivers/crypto/ti/Kconfig @@ -8,6 +8,8 @@ config CRYPTO_DEV_TI_DTHEV2 select CRYPTO_CBC select CRYPTO_CTR select CRYPTO_XTS + select CRYPTO_GCM + select SG_SPLIT help This enables support for the TI DTHE V2 hw cryptography engine which can be found on TI K3 SOCs. Selecting this enables use diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c index 3cffd6b1d33e1..2521e73740e79 100644 --- a/drivers/crypto/ti/dthev2-aes.c +++ b/drivers/crypto/ti/dthev2-aes.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include =20 @@ -19,6 +20,7 @@ #include #include #include +#include #include =20 /* Registers */ @@ -53,6 +55,7 @@ #define DTHE_P_AES_C_LENGTH_1 0x0058 #define DTHE_P_AES_AUTH_LENGTH 0x005C #define DTHE_P_AES_DATA_IN_OUT 0x0060 +#define DTHE_P_AES_TAG_OUT 0x0070 =20 #define DTHE_P_AES_SYSCONFIG 0x0084 #define DTHE_P_AES_IRQSTATUS 0x008C @@ -65,6 +68,7 @@ enum aes_ctrl_mode_masks { AES_CTRL_CBC_MASK =3D BIT(5), AES_CTRL_CTR_MASK =3D BIT(6), AES_CTRL_XTS_MASK =3D BIT(12) | BIT(11), + AES_CTRL_GCM_MASK =3D BIT(17) | BIT(16) | BIT(6), }; =20 #define DTHE_AES_CTRL_MODE_CLEAR_MASK ~GENMASK(28, 5) @@ -91,6 +95,8 @@ enum aes_ctrl_mode_masks { #define AES_IV_SIZE AES_BLOCK_SIZE #define AES_BLOCK_WORDS (AES_BLOCK_SIZE / sizeof(u32)) #define AES_IV_WORDS AES_BLOCK_WORDS +#define DTHE_AES_GCM_AAD_MAXLEN (BIT_ULL(32) - 1) +#define POLL_TIMEOUT_INTERVAL HZ =20 static struct scatterlist *dthe_chain_pad_sg(struct scatterlist *sg, unsigned int nents, @@ -295,6 +301,9 @@ static void dthe_aes_set_ctrl_key(struct dthe_tfm_ctx *= ctx, case DTHE_AES_XTS: ctrl_val |=3D AES_CTRL_XTS_MASK; break; + case DTHE_AES_GCM: + ctrl_val |=3D AES_CTRL_GCM_MASK; + break; } =20 if (iv_in) { @@ -553,6 +562,556 @@ static int dthe_aes_decrypt(struct skcipher_request *= req) return dthe_aes_crypt(req); } =20 +static int dthe_aead_init_tfm(struct crypto_aead *tfm) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(tfm); + struct dthe_data *dev_data =3D dthe_get_dev(ctx); + + ctx->dev_data =3D dev_data; + + const char *alg_name =3D crypto_tfm_alg_name(crypto_aead_tfm(tfm)); + + ctx->aead_fb =3D crypto_alloc_sync_aead(alg_name, 0, + CRYPTO_ALG_NEED_FALLBACK); + if (IS_ERR(ctx->aead_fb)) { + dev_err(dev_data->dev, "fallback driver %s couldn't be loaded\n", + alg_name); + return PTR_ERR(ctx->aead_fb); + } + + return 0; +} + +static void dthe_aead_exit_tfm(struct crypto_aead *tfm) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(tfm); + + crypto_free_sync_aead(ctx->aead_fb); +} + +/** + * dthe_aead_prep_src - Prepare source scatterlist for AEAD from input req= ->src + * @sg: Input req->src scatterlist + * @assoclen: Input req->assoclen + * @cryptlen: Input req->cryptlen (minus the size of TAG in decryption) + * @assoc_pad_buf: Buffer to hold AAD padding if needed + * @crypt_pad_buf: Buffer to hold ciphertext/plaintext padding if needed + * + * Description: + * For modes with authentication, DTHEv2 hardware requires the input AAD= and + * plaintext/ciphertext to be individually aligned to AES_BLOCK_SIZE. If= either is not + * aligned, it needs to be padded with zeros by the software before pass= ing the data to + * the hardware. However, linux crypto's aead_request provides the input= with AAD and + * plaintext/ciphertext contiguously appended together in a single scatt= erlist. + * + * This helper function takes the input scatterlist and splits it into s= eparate + * scatterlists for AAD and plaintext/ciphertext, ensuring each is align= ed to + * AES_BLOCK_SIZE by adding necessary padding, and then merges the align= ed scatterlists + * back into a single scatterlist for processing. + * + * Return: + * Pointer to the merged scatterlist, or ERR_PTR(error) on failure. + * The calling function needs to free the returned scatterlist when done. + **/ +static struct scatterlist *dthe_aead_prep_src(struct scatterlist *sg, + unsigned int assoclen, + unsigned int cryptlen, + u8 *assoc_pad_buf, + u8 *crypt_pad_buf) +{ + struct scatterlist *in_sg[2]; + struct scatterlist *to_sg; + struct scatterlist *src; + size_t split_sizes[2] =3D {assoclen, cryptlen}; + int out_mapped_nents[2]; + int crypt_nents =3D 0, assoc_nents =3D 0, src_nents =3D 0; + int err =3D 0; + + /* sg_split does not work properly if one of the split_sizes is 0 */ + if (cryptlen =3D=3D 0 || assoclen =3D=3D 0) { + /* + * Assigning both to sg does not matter as assoclen =3D 0 or cryptlen = =3D 0 + * being passed to dthe_copy_sg will take care to copy the sg correctly + */ + in_sg[0] =3D sg; + in_sg[1] =3D sg; + + src_nents =3D sg_nents_for_len(sg, assoclen + cryptlen); + } else { + err =3D sg_split(sg, 0, 0, 2, split_sizes, in_sg, out_mapped_nents, GFP_= ATOMIC); + if (err) + goto dthe_aead_prep_src_split_err; + assoc_nents =3D sg_nents_for_len(in_sg[0], assoclen); + crypt_nents =3D sg_nents_for_len(in_sg[1], cryptlen); + + src_nents =3D assoc_nents + crypt_nents; + } + + if (assoclen % AES_BLOCK_SIZE) + src_nents++; + if (cryptlen % AES_BLOCK_SIZE) + src_nents++; + + src =3D kmalloc_array(src_nents, sizeof(struct scatterlist), GFP_ATOMIC); + if (!src) { + err =3D -ENOMEM; + goto dthe_aead_prep_src_mem_err; + } + + sg_init_table(src, src_nents); + to_sg =3D src; + + to_sg =3D dthe_copy_sg(to_sg, in_sg[0], assoclen); + if (assoclen % AES_BLOCK_SIZE) { + unsigned int pad_len =3D AES_BLOCK_SIZE - (assoclen % AES_BLOCK_SIZE); + + sg_set_buf(to_sg, assoc_pad_buf, pad_len); + to_sg =3D sg_next(to_sg); + } + + to_sg =3D dthe_copy_sg(to_sg, in_sg[1], cryptlen); + if (cryptlen % AES_BLOCK_SIZE) { + unsigned int pad_len =3D AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE); + + sg_set_buf(to_sg, crypt_pad_buf, pad_len); + to_sg =3D sg_next(to_sg); + } + +dthe_aead_prep_src_mem_err: + if (cryptlen !=3D 0 && assoclen !=3D 0) { + kfree(in_sg[0]); + kfree(in_sg[1]); + } + +dthe_aead_prep_src_split_err: + if (err) + return ERR_PTR(err); + return src; +} + +/** + * dthe_aead_prep_dst - Prepare destination scatterlist for AEAD from inpu= t req->dst + * @sg: Input req->dst scatterlist + * @assoclen: Input req->assoclen + * @cryptlen: Input req->cryptlen (minus the size of TAG in decryption) + * @pad_buf: Buffer to hold ciphertext/plaintext padding if needed + * + * Description: + * For modes with authentication, DTHEv2 hardware returns encrypted ciph= ertext/decrypted + * plaintext through DMA and TAG through MMRs. However, the dst scatterl= ist in linux + * crypto's aead_request is allocated same as input req->src scatterlist= . That is, it + * contains space for AAD in the beginning and ciphertext/plaintext at t= he end, with no + * alignment padding. This causes issues with DMA engine and DTHEv2 hard= ware. + * + * This helper function takes the output scatterlist and maps the part o= f the buffer + * which holds only the ciphertext/plaintext to a new scatterlist. It al= so adds a padding + * to align it with AES_BLOCK_SIZE. + * + * Return: + * Pointer to the trimmed scatterlist, or ERR_PTR(error) on failure. + * The calling function needs to free the returned scatterlist when done. + **/ +static struct scatterlist *dthe_aead_prep_dst(struct scatterlist *sg, + unsigned int assoclen, + unsigned int cryptlen, + u8 *pad_buf) +{ + struct scatterlist *out_sg[1]; + struct scatterlist *dst; + struct scatterlist *to_sg; + size_t split_sizes[1] =3D {cryptlen}; + int out_mapped_nents[1]; + int dst_nents =3D 0; + int err =3D 0; + + err =3D sg_split(sg, 0, assoclen, 1, split_sizes, out_sg, out_mapped_nent= s, GFP_ATOMIC); + if (err) + goto dthe_aead_prep_dst_split_err; + + dst_nents =3D sg_nents_for_len(out_sg[0], cryptlen); + if (cryptlen % AES_BLOCK_SIZE) + dst_nents++; + + dst =3D kmalloc_array(dst_nents, sizeof(struct scatterlist), GFP_ATOMIC); + if (!dst) { + err =3D -ENOMEM; + goto dthe_aead_prep_dst_mem_err; + } + sg_init_table(dst, dst_nents); + + to_sg =3D dthe_copy_sg(dst, out_sg[0], cryptlen); + if (cryptlen % AES_BLOCK_SIZE) { + unsigned int pad_len =3D AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE); + + sg_set_buf(to_sg, pad_buf, pad_len); + to_sg =3D sg_next(to_sg); + } + +dthe_aead_prep_dst_mem_err: + kfree(out_sg[0]); + +dthe_aead_prep_dst_split_err: + if (err) + return ERR_PTR(err); + return dst; +} + +static int dthe_aead_read_tag(struct dthe_tfm_ctx *ctx, u32 *tag) +{ + struct dthe_data *dev_data =3D dthe_get_dev(ctx); + void __iomem *aes_base_reg =3D dev_data->regs + DTHE_P_AES_BASE; + u32 val; + int ret; + + ret =3D readl_relaxed_poll_timeout(aes_base_reg + DTHE_P_AES_CTRL, val, + (val & DTHE_AES_CTRL_SAVED_CTX_READY), + 0, POLL_TIMEOUT_INTERVAL); + if (ret) + return ret; + + for (int i =3D 0; i < AES_BLOCK_WORDS; ++i) + tag[i] =3D readl_relaxed(aes_base_reg + + DTHE_P_AES_TAG_OUT + + DTHE_REG_SIZE * i); + return 0; +} + +static int dthe_aead_enc_get_tag(struct aead_request *req) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(crypto_aead_reqtfm(req)); + u32 tag[AES_BLOCK_WORDS]; + int nents; + int ret; + + ret =3D dthe_aead_read_tag(ctx, tag); + if (ret) + return ret; + + nents =3D sg_nents_for_len(req->dst, req->cryptlen + req->assoclen + ctx-= >authsize); + + sg_pcopy_from_buffer(req->dst, nents, tag, ctx->authsize, + req->assoclen + req->cryptlen); + + return 0; +} + +static int dthe_aead_dec_verify_tag(struct aead_request *req) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(crypto_aead_reqtfm(req)); + u32 tag_out[AES_BLOCK_WORDS]; + u32 tag_in[AES_BLOCK_WORDS]; + int nents; + int ret; + + ret =3D dthe_aead_read_tag(ctx, tag_out); + if (ret) + return ret; + + nents =3D sg_nents_for_len(req->src, req->assoclen + req->cryptlen); + + sg_pcopy_to_buffer(req->src, nents, tag_in, ctx->authsize, + req->assoclen + req->cryptlen - ctx->authsize); + + if (memcmp(tag_in, tag_out, ctx->authsize)) + return -EBADMSG; + else + return 0; +} + +static int dthe_aead_setkey(struct crypto_aead *tfm, const u8 *key, unsign= ed int keylen) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(tfm); + + if (keylen !=3D AES_KEYSIZE_128 && keylen !=3D AES_KEYSIZE_192 && keylen = !=3D AES_KEYSIZE_256) + return -EINVAL; + + ctx->aes_mode =3D DTHE_AES_GCM; + ctx->keylen =3D keylen; + memcpy(ctx->key, key, keylen); + + crypto_sync_aead_clear_flags(ctx->aead_fb, CRYPTO_TFM_REQ_MASK); + crypto_sync_aead_set_flags(ctx->aead_fb, + crypto_aead_get_flags(tfm) & + CRYPTO_TFM_REQ_MASK); + + return crypto_sync_aead_setkey(ctx->aead_fb, key, keylen); +} + +static int dthe_aead_setauthsize(struct crypto_aead *tfm, unsigned int aut= hsize) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(tfm); + + /* Invalid auth size will be handled by crypto_aead_setauthsize() */ + ctx->authsize =3D authsize; + + return crypto_sync_aead_setauthsize(ctx->aead_fb, authsize); +} + +static int dthe_aead_do_fallback(struct aead_request *req) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(crypto_aead_reqtfm(req)); + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + + SYNC_AEAD_REQUEST_ON_STACK(subreq, ctx->aead_fb); + + aead_request_set_callback(subreq, req->base.flags, + req->base.complete, req->base.data); + aead_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, req->iv= ); + aead_request_set_ad(subreq, req->assoclen); + + return rctx->enc ? crypto_aead_encrypt(subreq) : + crypto_aead_decrypt(subreq); +} + +static void dthe_aead_dma_in_callback(void *data) +{ + struct aead_request *req =3D (struct aead_request *)data; + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + + complete(&rctx->aes_compl); +} + +static int dthe_aead_run(struct crypto_engine *engine, void *areq) +{ + struct aead_request *req =3D container_of(areq, struct aead_request, base= ); + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(crypto_aead_reqtfm(req)); + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + struct dthe_data *dev_data =3D dthe_get_dev(ctx); + + unsigned int cryptlen =3D req->cryptlen; + unsigned int assoclen =3D req->assoclen; + unsigned int authsize =3D ctx->authsize; + unsigned int unpadded_cryptlen; + struct scatterlist *src =3D req->src; + struct scatterlist *dst =3D req->dst; + u32 iv_in[AES_IV_WORDS]; + + int src_nents; + int dst_nents; + int src_mapped_nents, dst_mapped_nents; + + u8 *src_assoc_padbuf =3D rctx->padding; + u8 *src_crypt_padbuf =3D rctx->padding + AES_BLOCK_SIZE; + u8 *dst_crypt_padbuf =3D rctx->padding + (2 * AES_BLOCK_SIZE); + + enum dma_data_direction src_dir, dst_dir; + + struct device *tx_dev, *rx_dev; + struct dma_async_tx_descriptor *desc_in, *desc_out; + + int ret; + + void __iomem *aes_base_reg =3D dev_data->regs + DTHE_P_AES_BASE; + + u32 aes_irqenable_val =3D readl_relaxed(aes_base_reg + DTHE_P_AES_IRQENAB= LE); + u32 aes_sysconfig_val =3D readl_relaxed(aes_base_reg + DTHE_P_AES_SYSCONF= IG); + + aes_sysconfig_val |=3D DTHE_AES_SYSCONFIG_DMA_DATA_IN_OUT_EN; + writel_relaxed(aes_sysconfig_val, aes_base_reg + DTHE_P_AES_SYSCONFIG); + + aes_irqenable_val |=3D DTHE_AES_IRQENABLE_EN_ALL; + writel_relaxed(aes_irqenable_val, aes_base_reg + DTHE_P_AES_IRQENABLE); + + /* In decryption, the last authsize bytes are the TAG */ + if (!rctx->enc) + cryptlen -=3D authsize; + unpadded_cryptlen =3D cryptlen; + + /* Prep src and dst scatterlists */ + memset(src_assoc_padbuf, 0, AES_BLOCK_SIZE); + memset(src_crypt_padbuf, 0, AES_BLOCK_SIZE); + memset(dst_crypt_padbuf, 0, AES_BLOCK_SIZE); + + src =3D dthe_aead_prep_src(req->src, req->assoclen, cryptlen, + src_assoc_padbuf, src_crypt_padbuf); + if (IS_ERR(src)) { + ret =3D PTR_ERR(src); + goto aead_prep_src_err; + } + + if (req->assoclen % AES_BLOCK_SIZE) + assoclen +=3D AES_BLOCK_SIZE - (req->assoclen % AES_BLOCK_SIZE); + if (cryptlen % AES_BLOCK_SIZE) + cryptlen +=3D AES_BLOCK_SIZE - (cryptlen % AES_BLOCK_SIZE); + + src_nents =3D sg_nents_for_len(src, assoclen + cryptlen); + + if (cryptlen !=3D 0) { + dst =3D dthe_aead_prep_dst(req->dst, req->assoclen, unpadded_cryptlen, + dst_crypt_padbuf); + if (IS_ERR(dst)) { + ret =3D PTR_ERR(dst); + goto aead_prep_dst_err; + } + + dst_nents =3D sg_nents_for_len(dst, cryptlen); + } + /* Prep finished */ + + src_dir =3D DMA_TO_DEVICE; + dst_dir =3D DMA_FROM_DEVICE; + + tx_dev =3D dmaengine_get_dma_device(dev_data->dma_aes_tx); + rx_dev =3D dmaengine_get_dma_device(dev_data->dma_aes_rx); + + src_mapped_nents =3D dma_map_sg(tx_dev, src, src_nents, src_dir); + if (src_mapped_nents =3D=3D 0) { + ret =3D -EINVAL; + goto aead_dma_map_src_err; + } + + desc_out =3D dmaengine_prep_slave_sg(dev_data->dma_aes_tx, src, src_mappe= d_nents, + DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_out) { + ret =3D -EINVAL; + goto aead_dma_prep_src_err; + } + + desc_out->callback =3D dthe_aead_dma_in_callback; + desc_out->callback_param =3D req; + + if (cryptlen !=3D 0) { + dst_mapped_nents =3D dma_map_sg(rx_dev, dst, dst_nents, dst_dir); + if (dst_mapped_nents =3D=3D 0) { + ret =3D -EINVAL; + goto aead_dma_prep_src_err; + } + + desc_in =3D dmaengine_prep_slave_sg(dev_data->dma_aes_rx, dst, + dst_mapped_nents, DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_in) { + ret =3D -EINVAL; + goto aead_dma_prep_dst_err; + } + } + + init_completion(&rctx->aes_compl); + + /* + * HACK: There is an unknown hw issue where if the previous operation had= alen =3D 0 and + * plen !=3D 0, the current operation's tag calculation is incorrect in t= he case where + * plen =3D 0 and alen !=3D 0 currently. This is a workaround for now whi= ch somehow works; + * by resetting the context by writing a 1 to the C_LENGTH_0 and AUTH_LEN= GTH registers. + */ + if (cryptlen =3D=3D 0) { + writel_relaxed(1, aes_base_reg + DTHE_P_AES_C_LENGTH_0); + writel_relaxed(1, aes_base_reg + DTHE_P_AES_AUTH_LENGTH); + } + + if (req->iv) { + memcpy(iv_in, req->iv, GCM_AES_IV_SIZE); + } else { + iv_in[0] =3D 0; + iv_in[1] =3D 0; + iv_in[2] =3D 0; + } + iv_in[3] =3D 0x01000000; + + /* Clear key2 to reset previous GHASH intermediate data */ + for (int i =3D 0; i < AES_KEYSIZE_256 / sizeof(u32); ++i) + writel_relaxed(0, aes_base_reg + DTHE_P_AES_KEY2_6 + DTHE_REG_SIZE * i); + + dthe_aes_set_ctrl_key(ctx, rctx, iv_in); + + writel_relaxed(lower_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AE= S_C_LENGTH_0); + writel_relaxed(upper_32_bits(unpadded_cryptlen), aes_base_reg + DTHE_P_AE= S_C_LENGTH_1); + writel_relaxed(req->assoclen, aes_base_reg + DTHE_P_AES_AUTH_LENGTH); + + if (cryptlen !=3D 0) + dmaengine_submit(desc_in); + dmaengine_submit(desc_out); + + if (cryptlen !=3D 0) + dma_async_issue_pending(dev_data->dma_aes_rx); + dma_async_issue_pending(dev_data->dma_aes_tx); + + /* Need to do timeout to ensure finalise gets called if DMA callback fail= s for any reason */ + ret =3D wait_for_completion_timeout(&rctx->aes_compl, msecs_to_jiffies(DT= HE_DMA_TIMEOUT_MS)); + if (!ret) { + ret =3D -ETIMEDOUT; + if (cryptlen !=3D 0) + dmaengine_terminate_sync(dev_data->dma_aes_rx); + dmaengine_terminate_sync(dev_data->dma_aes_tx); + + for (int i =3D 0; i < AES_BLOCK_WORDS; ++i) + readl_relaxed(aes_base_reg + DTHE_P_AES_DATA_IN_OUT + DTHE_REG_SIZE * i= ); + } else { + ret =3D 0; + } + + if (cryptlen !=3D 0) + dma_sync_sg_for_cpu(rx_dev, dst, dst_nents, dst_dir); + if (rctx->enc) + ret =3D dthe_aead_enc_get_tag(req); + else + ret =3D dthe_aead_dec_verify_tag(req); + +aead_dma_prep_dst_err: + if (cryptlen !=3D 0) + dma_unmap_sg(rx_dev, dst, dst_nents, dst_dir); +aead_dma_prep_src_err: + dma_unmap_sg(tx_dev, src, src_nents, src_dir); + +aead_dma_map_src_err: + if (cryptlen !=3D 0) + kfree(dst); + +aead_prep_dst_err: + kfree(src); + +aead_prep_src_err: + if (ret) + ret =3D dthe_aead_do_fallback(req); + local_bh_disable(); + crypto_finalize_aead_request(engine, req, ret); + local_bh_enable(); + return 0; +} + +static int dthe_aead_crypt(struct aead_request *req) +{ + struct dthe_tfm_ctx *ctx =3D crypto_aead_ctx(crypto_aead_reqtfm(req)); + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + struct dthe_data *dev_data =3D dthe_get_dev(ctx); + struct crypto_engine *engine; + unsigned int cryptlen =3D req->cryptlen; + + /* In decryption, last authsize bytes are the TAG */ + if (!rctx->enc) + cryptlen -=3D ctx->authsize; + + /* + * Need to fallback to software in the following cases due to HW restrict= ions: + * - Both AAD and plaintext/ciphertext are zero length + * - AAD length is more than 2^32 - 1 bytes + * PS: req->cryptlen is currently unsigned int type, which causes the abo= ve condition + * tautologically false. If req->cryptlen were to be changed to a 64-bit = type, + * the check for this would need to be added below. + */ + if (req->assoclen =3D=3D 0 && cryptlen =3D=3D 0) + return dthe_aead_do_fallback(req); + + engine =3D dev_data->engine; + return crypto_transfer_aead_request_to_engine(engine, req); +} + +static int dthe_aead_encrypt(struct aead_request *req) +{ + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + + rctx->enc =3D 1; + return dthe_aead_crypt(req); +} + +static int dthe_aead_decrypt(struct aead_request *req) +{ + struct dthe_aes_req_ctx *rctx =3D aead_request_ctx(req); + + rctx->enc =3D 0; + return dthe_aead_crypt(req); +} + static struct skcipher_engine_alg cipher_algs[] =3D { { .base.init =3D dthe_cipher_init_tfm, @@ -649,12 +1208,46 @@ static struct skcipher_engine_alg cipher_algs[] =3D { }, /* XTS AES */ }; =20 +static struct aead_engine_alg aead_algs[] =3D { + { + .base.init =3D dthe_aead_init_tfm, + .base.exit =3D dthe_aead_exit_tfm, + .base.setkey =3D dthe_aead_setkey, + .base.setauthsize =3D dthe_aead_setauthsize, + .base.maxauthsize =3D AES_BLOCK_SIZE, + .base.encrypt =3D dthe_aead_encrypt, + .base.decrypt =3D dthe_aead_decrypt, + .base.chunksize =3D AES_BLOCK_SIZE, + .base.ivsize =3D GCM_AES_IV_SIZE, + .base.base =3D { + .cra_name =3D "gcm(aes)", + .cra_driver_name =3D "gcm-aes-dthev2", + .cra_priority =3D 299, + .cra_flags =3D CRYPTO_ALG_TYPE_AEAD | + CRYPTO_ALG_KERN_DRIVER_ONLY | + CRYPTO_ALG_ASYNC | + CRYPTO_ALG_NEED_FALLBACK, + .cra_blocksize =3D 1, + .cra_ctxsize =3D sizeof(struct dthe_tfm_ctx), + .cra_reqsize =3D sizeof(struct dthe_aes_req_ctx), + .cra_module =3D THIS_MODULE, + }, + .op.do_one_request =3D dthe_aead_run, + }, /* GCM AES */ +}; + int dthe_register_aes_algs(void) { - return crypto_engine_register_skciphers(cipher_algs, ARRAY_SIZE(cipher_al= gs)); + int ret =3D 0; + + ret |=3D crypto_engine_register_skciphers(cipher_algs, ARRAY_SIZE(cipher_= algs)); + ret |=3D crypto_engine_register_aeads(aead_algs, ARRAY_SIZE(aead_algs)); + + return ret; } =20 void dthe_unregister_aes_algs(void) { crypto_engine_unregister_skciphers(cipher_algs, ARRAY_SIZE(cipher_algs)); + crypto_engine_unregister_aeads(aead_algs, ARRAY_SIZE(aead_algs)); } diff --git a/drivers/crypto/ti/dthev2-common.c b/drivers/crypto/ti/dthev2-c= ommon.c index c39d37933b9ee..a2ad79bec105a 100644 --- a/drivers/crypto/ti/dthev2-common.c +++ b/drivers/crypto/ti/dthev2-common.c @@ -48,6 +48,25 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx) return dev_data; } =20 +struct scatterlist *dthe_copy_sg(struct scatterlist *dst, + struct scatterlist *src, + int buflen) +{ + struct scatterlist *from_sg, *to_sg; + int sglen; + + for (to_sg =3D dst, from_sg =3D src; buflen && from_sg; buflen -=3D sglen= ) { + sglen =3D from_sg->length; + if (sglen > buflen) + sglen =3D buflen; + sg_set_buf(to_sg, sg_virt(from_sg), sglen); + from_sg =3D sg_next(from_sg); + to_sg =3D sg_next(to_sg); + } + + return to_sg; +} + static int dthe_dma_init(struct dthe_data *dev_data) { int ret; diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-c= ommon.h index e8841fda9a46f..6a08061f382fe 100644 --- a/drivers/crypto/ti/dthev2-common.h +++ b/drivers/crypto/ti/dthev2-common.h @@ -32,13 +32,14 @@ * This is currently the keysize of XTS-AES-256 which is 512 bits (64 byte= s) */ #define DTHE_MAX_KEYSIZE (AES_MAX_KEY_SIZE * 2) -#define DTHE_MAX_PADSIZE (AES_BLOCK_SIZE) +#define DTHE_MAX_PADSIZE (AES_BLOCK_SIZE * 3) =20 enum dthe_aes_mode { DTHE_AES_ECB =3D 0, DTHE_AES_CBC, DTHE_AES_CTR, DTHE_AES_XTS, + DTHE_AES_GCM, }; =20 /* Driver specific struct definitions */ @@ -79,16 +80,22 @@ struct dthe_list { * struct dthe_tfm_ctx - Transform ctx struct containing ctx for all sub-c= omponents of DTHE V2 * @dev_data: Device data struct pointer * @keylen: AES key length + * @authsize: Authentication size for modes with authentication * @key: AES key * @aes_mode: AES mode + * @aead_fb: Fallback crypto aead handle * @skcipher_fb: Fallback crypto skcipher handle for AES-XTS mode */ struct dthe_tfm_ctx { struct dthe_data *dev_data; unsigned int keylen; + unsigned int authsize; u32 key[DTHE_MAX_KEYSIZE / sizeof(u32)]; enum dthe_aes_mode aes_mode; - struct crypto_sync_skcipher *skcipher_fb; + union { + struct crypto_sync_aead *aead_fb; + struct crypto_sync_skcipher *skcipher_fb; + }; }; =20 /** @@ -107,6 +114,20 @@ struct dthe_aes_req_ctx { =20 struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx); =20 +/** + * dthe_copy_sg - Copy sg entries from src to dst + * @dst: Destination sg to be filled + * @src: Source sg to be copied from + * @buflen: Number of bytes to be copied + * + * Description: + * Copy buflen bytes of data from src to dst. + * + **/ +struct scatterlist *dthe_copy_sg(struct scatterlist *dst, + struct scatterlist *src, + int buflen); + int dthe_register_aes_algs(void); void dthe_unregister_aes_algs(void); =20 --=20 2.43.0