1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright 2016 Broadcom
4 */
5
6 #include <linux/kernel.h>
7 #include <linux/string.h>
8
9 #include "util.h"
10 #include "spu.h"
11 #include "spum.h"
12 #include "cipher.h"
13
14 char *hash_alg_name[] = { "None", "md5", "sha1", "sha224", "sha256", "aes",
15 "sha384", "sha512", "sha3_224", "sha3_256", "sha3_384", "sha3_512" };
16
17 char *aead_alg_name[] = { "ccm(aes)", "gcm(aes)", "authenc" };
18
19 /* Assumes SPU-M messages are in big endian */
spum_dump_msg_hdr(u8 * buf,unsigned int buf_len)20 void spum_dump_msg_hdr(u8 *buf, unsigned int buf_len)
21 {
22 u8 *ptr = buf;
23 struct SPUHEADER *spuh = (struct SPUHEADER *)buf;
24 unsigned int hash_key_len = 0;
25 unsigned int hash_state_len = 0;
26 unsigned int cipher_key_len = 0;
27 unsigned int iv_len;
28 u32 pflags;
29 u32 cflags;
30 u32 ecf;
31 u32 cipher_alg;
32 u32 cipher_mode;
33 u32 cipher_type;
34 u32 hash_alg;
35 u32 hash_mode;
36 u32 hash_type;
37 u32 sctx_size; /* SCTX length in words */
38 u32 sctx_pl_len; /* SCTX payload length in bytes */
39
40 packet_log("\n");
41 packet_log("SPU Message header %p len: %u\n", buf, buf_len);
42
43 /* ========== Decode MH ========== */
44 packet_log(" MH 0x%08x\n", be32_to_cpu(*((u32 *)ptr)));
45 if (spuh->mh.flags & MH_SCTX_PRES)
46 packet_log(" SCTX present\n");
47 if (spuh->mh.flags & MH_BDESC_PRES)
48 packet_log(" BDESC present\n");
49 if (spuh->mh.flags & MH_MFM_PRES)
50 packet_log(" MFM present\n");
51 if (spuh->mh.flags & MH_BD_PRES)
52 packet_log(" BD present\n");
53 if (spuh->mh.flags & MH_HASH_PRES)
54 packet_log(" HASH present\n");
55 if (spuh->mh.flags & MH_SUPDT_PRES)
56 packet_log(" SUPDT present\n");
57 packet_log(" Opcode 0x%02x\n", spuh->mh.op_code);
58
59 ptr += sizeof(spuh->mh) + sizeof(spuh->emh); /* skip emh. unused */
60
61 /* ========== Decode SCTX ========== */
62 if (spuh->mh.flags & MH_SCTX_PRES) {
63 pflags = be32_to_cpu(spuh->sa.proto_flags);
64 packet_log(" SCTX[0] 0x%08x\n", pflags);
65 sctx_size = pflags & SCTX_SIZE;
66 packet_log(" Size %u words\n", sctx_size);
67
68 cflags = be32_to_cpu(spuh->sa.cipher_flags);
69 packet_log(" SCTX[1] 0x%08x\n", cflags);
70 packet_log(" Inbound:%lu (1:decrypt/vrfy 0:encrypt/auth)\n",
71 (cflags & CIPHER_INBOUND) >> CIPHER_INBOUND_SHIFT);
72 packet_log(" Order:%lu (1:AuthFirst 0:EncFirst)\n",
73 (cflags & CIPHER_ORDER) >> CIPHER_ORDER_SHIFT);
74 packet_log(" ICV_IS_512:%lx\n",
75 (cflags & ICV_IS_512) >> ICV_IS_512_SHIFT);
76 cipher_alg = (cflags & CIPHER_ALG) >> CIPHER_ALG_SHIFT;
77 cipher_mode = (cflags & CIPHER_MODE) >> CIPHER_MODE_SHIFT;
78 cipher_type = (cflags & CIPHER_TYPE) >> CIPHER_TYPE_SHIFT;
79 packet_log(" Crypto Alg:%u Mode:%u Type:%u\n",
80 cipher_alg, cipher_mode, cipher_type);
81 hash_alg = (cflags & HASH_ALG) >> HASH_ALG_SHIFT;
82 hash_mode = (cflags & HASH_MODE) >> HASH_MODE_SHIFT;
83 hash_type = (cflags & HASH_TYPE) >> HASH_TYPE_SHIFT;
84 packet_log(" Hash Alg:%x Mode:%x Type:%x\n",
85 hash_alg, hash_mode, hash_type);
86 packet_log(" UPDT_Offset:%u\n", cflags & UPDT_OFST);
87
88 ecf = be32_to_cpu(spuh->sa.ecf);
89 packet_log(" SCTX[2] 0x%08x\n", ecf);
90 packet_log(" WriteICV:%lu CheckICV:%lu ICV_SIZE:%u ",
91 (ecf & INSERT_ICV) >> INSERT_ICV_SHIFT,
92 (ecf & CHECK_ICV) >> CHECK_ICV_SHIFT,
93 (ecf & ICV_SIZE) >> ICV_SIZE_SHIFT);
94 packet_log("BD_SUPPRESS:%lu\n",
95 (ecf & BD_SUPPRESS) >> BD_SUPPRESS_SHIFT);
96 packet_log(" SCTX_IV:%lu ExplicitIV:%lu GenIV:%lu ",
97 (ecf & SCTX_IV) >> SCTX_IV_SHIFT,
98 (ecf & EXPLICIT_IV) >> EXPLICIT_IV_SHIFT,
99 (ecf & GEN_IV) >> GEN_IV_SHIFT);
100 packet_log("IV_OV_OFST:%lu EXP_IV_SIZE:%u\n",
101 (ecf & IV_OFFSET) >> IV_OFFSET_SHIFT,
102 ecf & EXP_IV_SIZE);
103
104 ptr += sizeof(struct SCTX);
105
106 if (hash_alg && hash_mode) {
107 char *name = "NONE";
108
109 switch (hash_alg) {
110 case HASH_ALG_MD5:
111 hash_key_len = 16;
112 name = "MD5";
113 break;
114 case HASH_ALG_SHA1:
115 hash_key_len = 20;
116 name = "SHA1";
117 break;
118 case HASH_ALG_SHA224:
119 hash_key_len = 28;
120 name = "SHA224";
121 break;
122 case HASH_ALG_SHA256:
123 hash_key_len = 32;
124 name = "SHA256";
125 break;
126 case HASH_ALG_SHA384:
127 hash_key_len = 48;
128 name = "SHA384";
129 break;
130 case HASH_ALG_SHA512:
131 hash_key_len = 64;
132 name = "SHA512";
133 break;
134 case HASH_ALG_AES:
135 hash_key_len = 0;
136 name = "AES";
137 break;
138 case HASH_ALG_NONE:
139 break;
140 }
141
142 packet_log(" Auth Key Type:%s Length:%u Bytes\n",
143 name, hash_key_len);
144 packet_dump(" KEY: ", ptr, hash_key_len);
145 ptr += hash_key_len;
146 } else if ((hash_alg == HASH_ALG_AES) &&
147 (hash_mode == HASH_MODE_XCBC)) {
148 char *name = "NONE";
149
150 switch (cipher_type) {
151 case CIPHER_TYPE_AES128:
152 hash_key_len = 16;
153 name = "AES128-XCBC";
154 break;
155 case CIPHER_TYPE_AES192:
156 hash_key_len = 24;
157 name = "AES192-XCBC";
158 break;
159 case CIPHER_TYPE_AES256:
160 hash_key_len = 32;
161 name = "AES256-XCBC";
162 break;
163 }
164 packet_log(" Auth Key Type:%s Length:%u Bytes\n",
165 name, hash_key_len);
166 packet_dump(" KEY: ", ptr, hash_key_len);
167 ptr += hash_key_len;
168 }
169
170 if (hash_alg && (hash_mode == HASH_MODE_NONE) &&
171 (hash_type == HASH_TYPE_UPDT)) {
172 char *name = "NONE";
173
174 switch (hash_alg) {
175 case HASH_ALG_MD5:
176 hash_state_len = 16;
177 name = "MD5";
178 break;
179 case HASH_ALG_SHA1:
180 hash_state_len = 20;
181 name = "SHA1";
182 break;
183 case HASH_ALG_SHA224:
184 hash_state_len = 32;
185 name = "SHA224";
186 break;
187 case HASH_ALG_SHA256:
188 hash_state_len = 32;
189 name = "SHA256";
190 break;
191 case HASH_ALG_SHA384:
192 hash_state_len = 48;
193 name = "SHA384";
194 break;
195 case HASH_ALG_SHA512:
196 hash_state_len = 64;
197 name = "SHA512";
198 break;
199 case HASH_ALG_AES:
200 hash_state_len = 0;
201 name = "AES";
202 break;
203 case HASH_ALG_NONE:
204 break;
205 }
206
207 packet_log(" Auth State Type:%s Length:%u Bytes\n",
208 name, hash_state_len);
209 packet_dump(" State: ", ptr, hash_state_len);
210 ptr += hash_state_len;
211 }
212
213 if (cipher_alg) {
214 char *name = "NONE";
215
216 switch (cipher_alg) {
217 case CIPHER_ALG_DES:
218 cipher_key_len = 8;
219 name = "DES";
220 break;
221 case CIPHER_ALG_3DES:
222 cipher_key_len = 24;
223 name = "3DES";
224 break;
225 case CIPHER_ALG_AES:
226 switch (cipher_type) {
227 case CIPHER_TYPE_AES128:
228 cipher_key_len = 16;
229 name = "AES128";
230 break;
231 case CIPHER_TYPE_AES192:
232 cipher_key_len = 24;
233 name = "AES192";
234 break;
235 case CIPHER_TYPE_AES256:
236 cipher_key_len = 32;
237 name = "AES256";
238 break;
239 }
240 break;
241 case CIPHER_ALG_NONE:
242 break;
243 }
244
245 packet_log(" Cipher Key Type:%s Length:%u Bytes\n",
246 name, cipher_key_len);
247
248 /* XTS has two keys */
249 if (cipher_mode == CIPHER_MODE_XTS) {
250 packet_dump(" KEY2: ", ptr, cipher_key_len);
251 ptr += cipher_key_len;
252 packet_dump(" KEY1: ", ptr, cipher_key_len);
253 ptr += cipher_key_len;
254
255 cipher_key_len *= 2;
256 } else {
257 packet_dump(" KEY: ", ptr, cipher_key_len);
258 ptr += cipher_key_len;
259 }
260
261 if (ecf & SCTX_IV) {
262 sctx_pl_len = sctx_size * sizeof(u32) -
263 sizeof(struct SCTX);
264 iv_len = sctx_pl_len -
265 (hash_key_len + hash_state_len +
266 cipher_key_len);
267 packet_log(" IV Length:%u Bytes\n", iv_len);
268 packet_dump(" IV: ", ptr, iv_len);
269 ptr += iv_len;
270 }
271 }
272 }
273
274 /* ========== Decode BDESC ========== */
275 if (spuh->mh.flags & MH_BDESC_PRES) {
276 #ifdef DEBUG
277 struct BDESC_HEADER *bdesc = (struct BDESC_HEADER *)ptr;
278 #endif
279 packet_log(" BDESC[0] 0x%08x\n", be32_to_cpu(*((u32 *)ptr)));
280 packet_log(" OffsetMAC:%u LengthMAC:%u\n",
281 be16_to_cpu(bdesc->offset_mac),
282 be16_to_cpu(bdesc->length_mac));
283 ptr += sizeof(u32);
284
285 packet_log(" BDESC[1] 0x%08x\n", be32_to_cpu(*((u32 *)ptr)));
286 packet_log(" OffsetCrypto:%u LengthCrypto:%u\n",
287 be16_to_cpu(bdesc->offset_crypto),
288 be16_to_cpu(bdesc->length_crypto));
289 ptr += sizeof(u32);
290
291 packet_log(" BDESC[2] 0x%08x\n", be32_to_cpu(*((u32 *)ptr)));
292 packet_log(" OffsetICV:%u OffsetIV:%u\n",
293 be16_to_cpu(bdesc->offset_icv),
294 be16_to_cpu(bdesc->offset_iv));
295 ptr += sizeof(u32);
296 }
297
298 /* ========== Decode BD ========== */
299 if (spuh->mh.flags & MH_BD_PRES) {
300 #ifdef DEBUG
301 struct BD_HEADER *bd = (struct BD_HEADER *)ptr;
302 #endif
303 packet_log(" BD[0] 0x%08x\n", be32_to_cpu(*((u32 *)ptr)));
304 packet_log(" Size:%ubytes PrevLength:%u\n",
305 be16_to_cpu(bd->size), be16_to_cpu(bd->prev_length));
306 ptr += 4;
307 }
308
309 /* Double check sanity */
310 if (buf + buf_len != ptr) {
311 packet_log(" Packet parsed incorrectly. ");
312 packet_log("buf:%p buf_len:%u buf+buf_len:%p ptr:%p\n",
313 buf, buf_len, buf + buf_len, ptr);
314 }
315
316 packet_log("\n");
317 }
318
319 /**
320 * spum_ns2_ctx_max_payload() - Determine the max length of the payload for a
321 * SPU message for a given cipher and hash alg context.
322 * @cipher_alg: The cipher algorithm
323 * @cipher_mode: The cipher mode
324 * @blocksize: The size of a block of data for this algo
325 *
326 * The max payload must be a multiple of the blocksize so that if a request is
327 * too large to fit in a single SPU message, the request can be broken into
328 * max_payload sized chunks. Each chunk must be a multiple of blocksize.
329 *
330 * Return: Max payload length in bytes
331 */
spum_ns2_ctx_max_payload(enum spu_cipher_alg cipher_alg,enum spu_cipher_mode cipher_mode,unsigned int blocksize)332 u32 spum_ns2_ctx_max_payload(enum spu_cipher_alg cipher_alg,
333 enum spu_cipher_mode cipher_mode,
334 unsigned int blocksize)
335 {
336 u32 max_payload = SPUM_NS2_MAX_PAYLOAD;
337 u32 excess;
338
339 /* In XTS on SPU-M, we'll need to insert tweak before input data */
340 if (cipher_mode == CIPHER_MODE_XTS)
341 max_payload -= SPU_XTS_TWEAK_SIZE;
342
343 excess = max_payload % blocksize;
344
345 return max_payload - excess;
346 }
347
348 /**
349 * spum_nsp_ctx_max_payload() - Determine the max length of the payload for a
350 * SPU message for a given cipher and hash alg context.
351 * @cipher_alg: The cipher algorithm
352 * @cipher_mode: The cipher mode
353 * @blocksize: The size of a block of data for this algo
354 *
355 * The max payload must be a multiple of the blocksize so that if a request is
356 * too large to fit in a single SPU message, the request can be broken into
357 * max_payload sized chunks. Each chunk must be a multiple of blocksize.
358 *
359 * Return: Max payload length in bytes
360 */
spum_nsp_ctx_max_payload(enum spu_cipher_alg cipher_alg,enum spu_cipher_mode cipher_mode,unsigned int blocksize)361 u32 spum_nsp_ctx_max_payload(enum spu_cipher_alg cipher_alg,
362 enum spu_cipher_mode cipher_mode,
363 unsigned int blocksize)
364 {
365 u32 max_payload = SPUM_NSP_MAX_PAYLOAD;
366 u32 excess;
367
368 /* In XTS on SPU-M, we'll need to insert tweak before input data */
369 if (cipher_mode == CIPHER_MODE_XTS)
370 max_payload -= SPU_XTS_TWEAK_SIZE;
371
372 excess = max_payload % blocksize;
373
374 return max_payload - excess;
375 }
376
377 /** spum_payload_length() - Given a SPU-M message header, extract the payload
378 * length.
379 * @spu_hdr: Start of SPU header
380 *
381 * Assumes just MH, EMH, BD (no SCTX, BDESC. Works for response frames.
382 *
383 * Return: payload length in bytes
384 */
spum_payload_length(u8 * spu_hdr)385 u32 spum_payload_length(u8 *spu_hdr)
386 {
387 struct BD_HEADER *bd;
388 u32 pl_len;
389
390 /* Find BD header. skip MH, EMH */
391 bd = (struct BD_HEADER *)(spu_hdr + 8);
392 pl_len = be16_to_cpu(bd->size);
393
394 return pl_len;
395 }
396
397 /**
398 * spum_response_hdr_len() - Given the length of the hash key and encryption
399 * key, determine the expected length of a SPU response header.
400 * @auth_key_len: authentication key length (bytes)
401 * @enc_key_len: encryption key length (bytes)
402 * @is_hash: true if response message is for a hash operation
403 *
404 * Return: length of SPU response header (bytes)
405 */
spum_response_hdr_len(u16 auth_key_len,u16 enc_key_len,bool is_hash)406 u16 spum_response_hdr_len(u16 auth_key_len, u16 enc_key_len, bool is_hash)
407 {
408 if (is_hash)
409 return SPU_HASH_RESP_HDR_LEN;
410 else
411 return SPU_RESP_HDR_LEN;
412 }
413
414 /**
415 * spum_hash_pad_len() - Calculate the length of hash padding required to extend
416 * data to a full block size.
417 * @hash_alg: hash algorithm
418 * @hash_mode: hash mode
419 * @chunksize: length of data, in bytes
420 * @hash_block_size: size of a block of data for hash algorithm
421 *
422 * Reserve space for 1 byte (0x80) start of pad and the total length as u64
423 *
424 * Return: length of hash pad in bytes
425 */
spum_hash_pad_len(enum hash_alg hash_alg,enum hash_mode hash_mode,u32 chunksize,u16 hash_block_size)426 u16 spum_hash_pad_len(enum hash_alg hash_alg, enum hash_mode hash_mode,
427 u32 chunksize, u16 hash_block_size)
428 {
429 unsigned int length_len;
430 unsigned int used_space_last_block;
431 int hash_pad_len;
432
433 /* AES-XCBC hash requires just padding to next block boundary */
434 if ((hash_alg == HASH_ALG_AES) && (hash_mode == HASH_MODE_XCBC)) {
435 used_space_last_block = chunksize % hash_block_size;
436 hash_pad_len = hash_block_size - used_space_last_block;
437 if (hash_pad_len >= hash_block_size)
438 hash_pad_len -= hash_block_size;
439 return hash_pad_len;
440 }
441
442 used_space_last_block = chunksize % hash_block_size + 1;
443 if ((hash_alg == HASH_ALG_SHA384) || (hash_alg == HASH_ALG_SHA512))
444 length_len = 2 * sizeof(u64);
445 else
446 length_len = sizeof(u64);
447
448 used_space_last_block += length_len;
449 hash_pad_len = hash_block_size - used_space_last_block;
450 if (hash_pad_len < 0)
451 hash_pad_len += hash_block_size;
452
453 hash_pad_len += 1 + length_len;
454 return hash_pad_len;
455 }
456
457 /**
458 * spum_gcm_ccm_pad_len() - Determine the required length of GCM or CCM padding.
459 * @cipher_mode: Algo type
460 * @data_size: Length of plaintext (bytes)
461 *
462 * @Return: Length of padding, in bytes
463 */
spum_gcm_ccm_pad_len(enum spu_cipher_mode cipher_mode,unsigned int data_size)464 u32 spum_gcm_ccm_pad_len(enum spu_cipher_mode cipher_mode,
465 unsigned int data_size)
466 {
467 u32 pad_len = 0;
468 u32 m1 = SPU_GCM_CCM_ALIGN - 1;
469
470 if ((cipher_mode == CIPHER_MODE_GCM) ||
471 (cipher_mode == CIPHER_MODE_CCM))
472 pad_len = ((data_size + m1) & ~m1) - data_size;
473
474 return pad_len;
475 }
476
477 /**
478 * spum_assoc_resp_len() - Determine the size of the receive buffer required to
479 * catch associated data.
480 * @cipher_mode: cipher mode
481 * @assoc_len: length of associated data (bytes)
482 * @iv_len: length of IV (bytes)
483 * @is_encrypt: true if encrypting. false if decrypting.
484 *
485 * Return: length of associated data in response message (bytes)
486 */
spum_assoc_resp_len(enum spu_cipher_mode cipher_mode,unsigned int assoc_len,unsigned int iv_len,bool is_encrypt)487 u32 spum_assoc_resp_len(enum spu_cipher_mode cipher_mode,
488 unsigned int assoc_len, unsigned int iv_len,
489 bool is_encrypt)
490 {
491 u32 buflen = 0;
492 u32 pad;
493
494 if (assoc_len)
495 buflen = assoc_len;
496
497 if (cipher_mode == CIPHER_MODE_GCM) {
498 /* AAD needs to be padded in responses too */
499 pad = spum_gcm_ccm_pad_len(cipher_mode, buflen);
500 buflen += pad;
501 }
502 if (cipher_mode == CIPHER_MODE_CCM) {
503 /*
504 * AAD needs to be padded in responses too
505 * for CCM, len + 2 needs to be 128-bit aligned.
506 */
507 pad = spum_gcm_ccm_pad_len(cipher_mode, buflen + 2);
508 buflen += pad;
509 }
510
511 return buflen;
512 }
513
514 /**
515 * spu_aead_ivlen() - Calculate the length of the AEAD IV to be included
516 * in a SPU request after the AAD and before the payload.
517 * @cipher_mode: cipher mode
518 * @iv_ctr_len: initialization vector length in bytes
519 *
520 * In Linux ~4.2 and later, the assoc_data sg includes the IV. So no need
521 * to include the IV as a separate field in the SPU request msg.
522 *
523 * Return: Length of AEAD IV in bytes
524 */
spum_aead_ivlen(enum spu_cipher_mode cipher_mode,u16 iv_len)525 u8 spum_aead_ivlen(enum spu_cipher_mode cipher_mode, u16 iv_len)
526 {
527 return 0;
528 }
529
530 /**
531 * spum_hash_type() - Determine the type of hash operation.
532 * @src_sent: The number of bytes in the current request that have already
533 * been sent to the SPU to be hashed.
534 *
535 * We do not use HASH_TYPE_FULL for requests that fit in a single SPU message.
536 * Using FULL causes failures (such as when the string to be hashed is empty).
537 * For similar reasons, we never use HASH_TYPE_FIN. Instead, submit messages
538 * as INIT or UPDT and do the hash padding in sw.
539 */
spum_hash_type(u32 src_sent)540 enum hash_type spum_hash_type(u32 src_sent)
541 {
542 return src_sent ? HASH_TYPE_UPDT : HASH_TYPE_INIT;
543 }
544
545 /**
546 * spum_digest_size() - Determine the size of a hash digest to expect the SPU to
547 * return.
548 * alg_digest_size: Number of bytes in the final digest for the given algo
549 * alg: The hash algorithm
550 * htype: Type of hash operation (init, update, full, etc)
551 *
552 * When doing incremental hashing for an algorithm with a truncated hash
553 * (e.g., SHA224), the SPU returns the full digest so that it can be fed back as
554 * a partial result for the next chunk.
555 */
spum_digest_size(u32 alg_digest_size,enum hash_alg alg,enum hash_type htype)556 u32 spum_digest_size(u32 alg_digest_size, enum hash_alg alg,
557 enum hash_type htype)
558 {
559 u32 digestsize = alg_digest_size;
560
561 /* SPU returns complete digest when doing incremental hash and truncated
562 * hash algo.
563 */
564 if ((htype == HASH_TYPE_INIT) || (htype == HASH_TYPE_UPDT)) {
565 if (alg == HASH_ALG_SHA224)
566 digestsize = SHA256_DIGEST_SIZE;
567 else if (alg == HASH_ALG_SHA384)
568 digestsize = SHA512_DIGEST_SIZE;
569 }
570 return digestsize;
571 }
572
573 /**
574 * spum_create_request() - Build a SPU request message header, up to and
575 * including the BD header. Construct the message starting at spu_hdr. Caller
576 * should allocate this buffer in DMA-able memory at least SPU_HEADER_ALLOC_LEN
577 * bytes long.
578 * @spu_hdr: Start of buffer where SPU request header is to be written
579 * @req_opts: SPU request message options
580 * @cipher_parms: Parameters related to cipher algorithm
581 * @hash_parms: Parameters related to hash algorithm
582 * @aead_parms: Parameters related to AEAD operation
583 * @data_size: Length of data to be encrypted or authenticated. If AEAD, does
584 * not include length of AAD.
585
586 * Return: the length of the SPU header in bytes. 0 if an error occurs.
587 */
spum_create_request(u8 * spu_hdr,struct spu_request_opts * req_opts,struct spu_cipher_parms * cipher_parms,struct spu_hash_parms * hash_parms,struct spu_aead_parms * aead_parms,unsigned int data_size)588 u32 spum_create_request(u8 *spu_hdr,
589 struct spu_request_opts *req_opts,
590 struct spu_cipher_parms *cipher_parms,
591 struct spu_hash_parms *hash_parms,
592 struct spu_aead_parms *aead_parms,
593 unsigned int data_size)
594 {
595 struct SPUHEADER *spuh;
596 struct BDESC_HEADER *bdesc;
597 struct BD_HEADER *bd;
598
599 u8 *ptr;
600 u32 protocol_bits = 0;
601 u32 cipher_bits = 0;
602 u32 ecf_bits = 0;
603 u8 sctx_words = 0;
604 unsigned int buf_len = 0;
605
606 /* size of the cipher payload */
607 unsigned int cipher_len = hash_parms->prebuf_len + data_size +
608 hash_parms->pad_len;
609
610 /* offset of prebuf or data from end of BD header */
611 unsigned int cipher_offset = aead_parms->assoc_size +
612 aead_parms->iv_len + aead_parms->aad_pad_len;
613
614 /* total size of the DB data (without STAT word padding) */
615 unsigned int real_db_size = spu_real_db_size(aead_parms->assoc_size,
616 aead_parms->iv_len,
617 hash_parms->prebuf_len,
618 data_size,
619 aead_parms->aad_pad_len,
620 aead_parms->data_pad_len,
621 hash_parms->pad_len);
622
623 unsigned int auth_offset = 0;
624 unsigned int offset_iv = 0;
625
626 /* size/offset of the auth payload */
627 unsigned int auth_len;
628
629 auth_len = real_db_size;
630
631 if (req_opts->is_aead && req_opts->is_inbound)
632 cipher_len -= hash_parms->digestsize;
633
634 if (req_opts->is_aead && req_opts->is_inbound)
635 auth_len -= hash_parms->digestsize;
636
637 if ((hash_parms->alg == HASH_ALG_AES) &&
638 (hash_parms->mode == HASH_MODE_XCBC)) {
639 auth_len -= hash_parms->pad_len;
640 cipher_len -= hash_parms->pad_len;
641 }
642
643 flow_log("%s()\n", __func__);
644 flow_log(" in:%u authFirst:%u\n",
645 req_opts->is_inbound, req_opts->auth_first);
646 flow_log(" %s. cipher alg:%u mode:%u type %u\n",
647 spu_alg_name(cipher_parms->alg, cipher_parms->mode),
648 cipher_parms->alg, cipher_parms->mode, cipher_parms->type);
649 flow_log(" key: %d\n", cipher_parms->key_len);
650 flow_dump(" key: ", cipher_parms->key_buf, cipher_parms->key_len);
651 flow_log(" iv: %d\n", cipher_parms->iv_len);
652 flow_dump(" iv: ", cipher_parms->iv_buf, cipher_parms->iv_len);
653 flow_log(" auth alg:%u mode:%u type %u\n",
654 hash_parms->alg, hash_parms->mode, hash_parms->type);
655 flow_log(" digestsize: %u\n", hash_parms->digestsize);
656 flow_log(" authkey: %d\n", hash_parms->key_len);
657 flow_dump(" authkey: ", hash_parms->key_buf, hash_parms->key_len);
658 flow_log(" assoc_size:%u\n", aead_parms->assoc_size);
659 flow_log(" prebuf_len:%u\n", hash_parms->prebuf_len);
660 flow_log(" data_size:%u\n", data_size);
661 flow_log(" hash_pad_len:%u\n", hash_parms->pad_len);
662 flow_log(" real_db_size:%u\n", real_db_size);
663 flow_log(" auth_offset:%u auth_len:%u cipher_offset:%u cipher_len:%u\n",
664 auth_offset, auth_len, cipher_offset, cipher_len);
665 flow_log(" aead_iv: %u\n", aead_parms->iv_len);
666
667 /* starting out: zero the header (plus some) */
668 ptr = spu_hdr;
669 memset(ptr, 0, sizeof(struct SPUHEADER));
670
671 /* format master header word */
672 /* Do not set the next bit even though the datasheet says to */
673 spuh = (struct SPUHEADER *)ptr;
674 ptr += sizeof(struct SPUHEADER);
675 buf_len += sizeof(struct SPUHEADER);
676
677 spuh->mh.op_code = SPU_CRYPTO_OPERATION_GENERIC;
678 spuh->mh.flags |= (MH_SCTX_PRES | MH_BDESC_PRES | MH_BD_PRES);
679
680 /* Format sctx word 0 (protocol_bits) */
681 sctx_words = 3; /* size in words */
682
683 /* Format sctx word 1 (cipher_bits) */
684 if (req_opts->is_inbound)
685 cipher_bits |= CIPHER_INBOUND;
686 if (req_opts->auth_first)
687 cipher_bits |= CIPHER_ORDER;
688
689 /* Set the crypto parameters in the cipher.flags */
690 cipher_bits |= cipher_parms->alg << CIPHER_ALG_SHIFT;
691 cipher_bits |= cipher_parms->mode << CIPHER_MODE_SHIFT;
692 cipher_bits |= cipher_parms->type << CIPHER_TYPE_SHIFT;
693
694 /* Set the auth parameters in the cipher.flags */
695 cipher_bits |= hash_parms->alg << HASH_ALG_SHIFT;
696 cipher_bits |= hash_parms->mode << HASH_MODE_SHIFT;
697 cipher_bits |= hash_parms->type << HASH_TYPE_SHIFT;
698
699 /*
700 * Format sctx extensions if required, and update main fields if
701 * required)
702 */
703 if (hash_parms->alg) {
704 /* Write the authentication key material if present */
705 if (hash_parms->key_len) {
706 memcpy(ptr, hash_parms->key_buf, hash_parms->key_len);
707 ptr += hash_parms->key_len;
708 buf_len += hash_parms->key_len;
709 sctx_words += hash_parms->key_len / 4;
710 }
711
712 if ((cipher_parms->mode == CIPHER_MODE_GCM) ||
713 (cipher_parms->mode == CIPHER_MODE_CCM))
714 /* unpadded length */
715 offset_iv = aead_parms->assoc_size;
716
717 /* if GCM/CCM we need to write ICV into the payload */
718 if (!req_opts->is_inbound) {
719 if ((cipher_parms->mode == CIPHER_MODE_GCM) ||
720 (cipher_parms->mode == CIPHER_MODE_CCM))
721 ecf_bits |= 1 << INSERT_ICV_SHIFT;
722 } else {
723 ecf_bits |= CHECK_ICV;
724 }
725
726 /* Inform the SPU of the ICV size (in words) */
727 if (hash_parms->digestsize == 64)
728 cipher_bits |= ICV_IS_512;
729 else
730 ecf_bits |=
731 (hash_parms->digestsize / 4) << ICV_SIZE_SHIFT;
732 }
733
734 if (req_opts->bd_suppress)
735 ecf_bits |= BD_SUPPRESS;
736
737 /* copy the encryption keys in the SAD entry */
738 if (cipher_parms->alg) {
739 if (cipher_parms->key_len) {
740 memcpy(ptr, cipher_parms->key_buf,
741 cipher_parms->key_len);
742 ptr += cipher_parms->key_len;
743 buf_len += cipher_parms->key_len;
744 sctx_words += cipher_parms->key_len / 4;
745 }
746
747 /*
748 * if encrypting then set IV size, use SCTX IV unless no IV
749 * given here
750 */
751 if (cipher_parms->iv_buf && cipher_parms->iv_len) {
752 /* Use SCTX IV */
753 ecf_bits |= SCTX_IV;
754
755 /* cipher iv provided so put it in here */
756 memcpy(ptr, cipher_parms->iv_buf, cipher_parms->iv_len);
757
758 ptr += cipher_parms->iv_len;
759 buf_len += cipher_parms->iv_len;
760 sctx_words += cipher_parms->iv_len / 4;
761 }
762 }
763
764 /*
765 * RFC4543 (GMAC/ESP) requires data to be sent as part of AAD
766 * so we need to override the BDESC parameters.
767 */
768 if (req_opts->is_rfc4543) {
769 if (req_opts->is_inbound)
770 data_size -= hash_parms->digestsize;
771 offset_iv = aead_parms->assoc_size + data_size;
772 cipher_len = 0;
773 cipher_offset = offset_iv;
774 auth_len = cipher_offset + aead_parms->data_pad_len;
775 }
776
777 /* write in the total sctx length now that we know it */
778 protocol_bits |= sctx_words;
779
780 /* Endian adjust the SCTX */
781 spuh->sa.proto_flags = cpu_to_be32(protocol_bits);
782 spuh->sa.cipher_flags = cpu_to_be32(cipher_bits);
783 spuh->sa.ecf = cpu_to_be32(ecf_bits);
784
785 /* === create the BDESC section === */
786 bdesc = (struct BDESC_HEADER *)ptr;
787
788 bdesc->offset_mac = cpu_to_be16(auth_offset);
789 bdesc->length_mac = cpu_to_be16(auth_len);
790 bdesc->offset_crypto = cpu_to_be16(cipher_offset);
791 bdesc->length_crypto = cpu_to_be16(cipher_len);
792
793 /*
794 * CCM in SPU-M requires that ICV not be in same 32-bit word as data or
795 * padding. So account for padding as necessary.
796 */
797 if (cipher_parms->mode == CIPHER_MODE_CCM)
798 auth_len += spum_wordalign_padlen(auth_len);
799
800 bdesc->offset_icv = cpu_to_be16(auth_len);
801 bdesc->offset_iv = cpu_to_be16(offset_iv);
802
803 ptr += sizeof(struct BDESC_HEADER);
804 buf_len += sizeof(struct BDESC_HEADER);
805
806 /* === no MFM section === */
807
808 /* === create the BD section === */
809
810 /* add the BD header */
811 bd = (struct BD_HEADER *)ptr;
812 bd->size = cpu_to_be16(real_db_size);
813 bd->prev_length = 0;
814
815 ptr += sizeof(struct BD_HEADER);
816 buf_len += sizeof(struct BD_HEADER);
817
818 packet_dump(" SPU request header: ", spu_hdr, buf_len);
819
820 return buf_len;
821 }
822
823 /**
824 * spum_cipher_req_init() - Build a SPU request message header, up to and
825 * including the BD header.
826 * @spu_hdr: Start of SPU request header (MH)
827 * @cipher_parms: Parameters that describe the cipher request
828 *
829 * Construct the message starting at spu_hdr. Caller should allocate this buffer
830 * in DMA-able memory at least SPU_HEADER_ALLOC_LEN bytes long.
831 *
832 * Return: the length of the SPU header in bytes. 0 if an error occurs.
833 */
spum_cipher_req_init(u8 * spu_hdr,struct spu_cipher_parms * cipher_parms)834 u16 spum_cipher_req_init(u8 *spu_hdr, struct spu_cipher_parms *cipher_parms)
835 {
836 struct SPUHEADER *spuh;
837 u32 protocol_bits = 0;
838 u32 cipher_bits = 0;
839 u32 ecf_bits = 0;
840 u8 sctx_words = 0;
841 u8 *ptr = spu_hdr;
842
843 flow_log("%s()\n", __func__);
844 flow_log(" cipher alg:%u mode:%u type %u\n", cipher_parms->alg,
845 cipher_parms->mode, cipher_parms->type);
846 flow_log(" cipher_iv_len: %u\n", cipher_parms->iv_len);
847 flow_log(" key: %d\n", cipher_parms->key_len);
848 flow_dump(" key: ", cipher_parms->key_buf, cipher_parms->key_len);
849
850 /* starting out: zero the header (plus some) */
851 memset(spu_hdr, 0, sizeof(struct SPUHEADER));
852 ptr += sizeof(struct SPUHEADER);
853
854 /* format master header word */
855 /* Do not set the next bit even though the datasheet says to */
856 spuh = (struct SPUHEADER *)spu_hdr;
857
858 spuh->mh.op_code = SPU_CRYPTO_OPERATION_GENERIC;
859 spuh->mh.flags |= (MH_SCTX_PRES | MH_BDESC_PRES | MH_BD_PRES);
860
861 /* Format sctx word 0 (protocol_bits) */
862 sctx_words = 3; /* size in words */
863
864 /* copy the encryption keys in the SAD entry */
865 if (cipher_parms->alg) {
866 if (cipher_parms->key_len) {
867 ptr += cipher_parms->key_len;
868 sctx_words += cipher_parms->key_len / 4;
869 }
870
871 /*
872 * if encrypting then set IV size, use SCTX IV unless no IV
873 * given here
874 */
875 if (cipher_parms->iv_len) {
876 /* Use SCTX IV */
877 ecf_bits |= SCTX_IV;
878 ptr += cipher_parms->iv_len;
879 sctx_words += cipher_parms->iv_len / 4;
880 }
881 }
882
883 /* Set the crypto parameters in the cipher.flags */
884 cipher_bits |= cipher_parms->alg << CIPHER_ALG_SHIFT;
885 cipher_bits |= cipher_parms->mode << CIPHER_MODE_SHIFT;
886 cipher_bits |= cipher_parms->type << CIPHER_TYPE_SHIFT;
887
888 /* copy the encryption keys in the SAD entry */
889 if (cipher_parms->alg && cipher_parms->key_len)
890 memcpy(spuh + 1, cipher_parms->key_buf, cipher_parms->key_len);
891
892 /* write in the total sctx length now that we know it */
893 protocol_bits |= sctx_words;
894
895 /* Endian adjust the SCTX */
896 spuh->sa.proto_flags = cpu_to_be32(protocol_bits);
897
898 /* Endian adjust the SCTX */
899 spuh->sa.cipher_flags = cpu_to_be32(cipher_bits);
900 spuh->sa.ecf = cpu_to_be32(ecf_bits);
901
902 packet_dump(" SPU request header: ", spu_hdr,
903 sizeof(struct SPUHEADER));
904
905 return sizeof(struct SPUHEADER) + cipher_parms->key_len +
906 cipher_parms->iv_len + sizeof(struct BDESC_HEADER) +
907 sizeof(struct BD_HEADER);
908 }
909
910 /**
911 * spum_cipher_req_finish() - Finish building a SPU request message header for a
912 * block cipher request. Assumes much of the header was already filled in at
913 * setkey() time in spu_cipher_req_init().
914 * @spu_hdr: Start of the request message header (MH field)
915 * @spu_req_hdr_len: Length in bytes of the SPU request header
916 * @isInbound: 0 encrypt, 1 decrypt
917 * @cipher_parms: Parameters describing cipher operation to be performed
918 * @data_size: Length of the data in the BD field
919 *
920 * Assumes much of the header was already filled in at setkey() time in
921 * spum_cipher_req_init().
922 * spum_cipher_req_init() fills in the encryption key.
923 */
spum_cipher_req_finish(u8 * spu_hdr,u16 spu_req_hdr_len,unsigned int is_inbound,struct spu_cipher_parms * cipher_parms,unsigned int data_size)924 void spum_cipher_req_finish(u8 *spu_hdr,
925 u16 spu_req_hdr_len,
926 unsigned int is_inbound,
927 struct spu_cipher_parms *cipher_parms,
928 unsigned int data_size)
929 {
930 struct SPUHEADER *spuh;
931 struct BDESC_HEADER *bdesc;
932 struct BD_HEADER *bd;
933 u8 *bdesc_ptr = spu_hdr + spu_req_hdr_len -
934 (sizeof(struct BD_HEADER) + sizeof(struct BDESC_HEADER));
935
936 u32 cipher_bits;
937
938 flow_log("%s()\n", __func__);
939 flow_log(" in: %u\n", is_inbound);
940 flow_log(" cipher alg: %u, cipher_type: %u\n", cipher_parms->alg,
941 cipher_parms->type);
942
943 /*
944 * In XTS mode, API puts "i" parameter (block tweak) in IV. For
945 * SPU-M, should be in start of the BD; tx_sg_create() copies it there.
946 * IV in SPU msg for SPU-M should be 0, since that's the "j" parameter
947 * (block ctr within larger data unit) - given we can send entire disk
948 * block (<= 4KB) in 1 SPU msg, don't need to use this parameter.
949 */
950 if (cipher_parms->mode == CIPHER_MODE_XTS)
951 memset(cipher_parms->iv_buf, 0, cipher_parms->iv_len);
952
953 flow_log(" iv len: %d\n", cipher_parms->iv_len);
954 flow_dump(" iv: ", cipher_parms->iv_buf, cipher_parms->iv_len);
955 flow_log(" data_size: %u\n", data_size);
956
957 /* format master header word */
958 /* Do not set the next bit even though the datasheet says to */
959 spuh = (struct SPUHEADER *)spu_hdr;
960
961 /* cipher_bits was initialized at setkey time */
962 cipher_bits = be32_to_cpu(spuh->sa.cipher_flags);
963
964 /* Format sctx word 1 (cipher_bits) */
965 if (is_inbound)
966 cipher_bits |= CIPHER_INBOUND;
967 else
968 cipher_bits &= ~CIPHER_INBOUND;
969
970 if (cipher_parms->alg && cipher_parms->iv_buf && cipher_parms->iv_len)
971 /* cipher iv provided so put it in here */
972 memcpy(bdesc_ptr - cipher_parms->iv_len, cipher_parms->iv_buf,
973 cipher_parms->iv_len);
974
975 spuh->sa.cipher_flags = cpu_to_be32(cipher_bits);
976
977 /* === create the BDESC section === */
978 bdesc = (struct BDESC_HEADER *)bdesc_ptr;
979 bdesc->offset_mac = 0;
980 bdesc->length_mac = 0;
981 bdesc->offset_crypto = 0;
982
983 /* XTS mode, data_size needs to include tweak parameter */
984 if (cipher_parms->mode == CIPHER_MODE_XTS)
985 bdesc->length_crypto = cpu_to_be16(data_size +
986 SPU_XTS_TWEAK_SIZE);
987 else
988 bdesc->length_crypto = cpu_to_be16(data_size);
989
990 bdesc->offset_icv = 0;
991 bdesc->offset_iv = 0;
992
993 /* === no MFM section === */
994
995 /* === create the BD section === */
996 /* add the BD header */
997 bd = (struct BD_HEADER *)(bdesc_ptr + sizeof(struct BDESC_HEADER));
998 bd->size = cpu_to_be16(data_size);
999
1000 /* XTS mode, data_size needs to include tweak parameter */
1001 if (cipher_parms->mode == CIPHER_MODE_XTS)
1002 bd->size = cpu_to_be16(data_size + SPU_XTS_TWEAK_SIZE);
1003 else
1004 bd->size = cpu_to_be16(data_size);
1005
1006 bd->prev_length = 0;
1007
1008 packet_dump(" SPU request header: ", spu_hdr, spu_req_hdr_len);
1009 }
1010
1011 /**
1012 * spum_request_pad() - Create pad bytes at the end of the data.
1013 * @pad_start: Start of buffer where pad bytes are to be written
1014 * @gcm_ccm_padding: length of GCM/CCM padding, in bytes
1015 * @hash_pad_len: Number of bytes of padding extend data to full block
1016 * @auth_alg: authentication algorithm
1017 * @auth_mode: authentication mode
1018 * @total_sent: length inserted at end of hash pad
1019 * @status_padding: Number of bytes of padding to align STATUS word
1020 *
1021 * There may be three forms of pad:
1022 * 1. GCM/CCM pad - for GCM/CCM mode ciphers, pad to 16-byte alignment
1023 * 2. hash pad - pad to a block length, with 0x80 data terminator and
1024 * size at the end
1025 * 3. STAT pad - to ensure the STAT field is 4-byte aligned
1026 */
spum_request_pad(u8 * pad_start,u32 gcm_ccm_padding,u32 hash_pad_len,enum hash_alg auth_alg,enum hash_mode auth_mode,unsigned int total_sent,u32 status_padding)1027 void spum_request_pad(u8 *pad_start,
1028 u32 gcm_ccm_padding,
1029 u32 hash_pad_len,
1030 enum hash_alg auth_alg,
1031 enum hash_mode auth_mode,
1032 unsigned int total_sent, u32 status_padding)
1033 {
1034 u8 *ptr = pad_start;
1035
1036 /* fix data alignent for GCM/CCM */
1037 if (gcm_ccm_padding > 0) {
1038 flow_log(" GCM: padding to 16 byte alignment: %u bytes\n",
1039 gcm_ccm_padding);
1040 memset(ptr, 0, gcm_ccm_padding);
1041 ptr += gcm_ccm_padding;
1042 }
1043
1044 if (hash_pad_len > 0) {
1045 /* clear the padding section */
1046 memset(ptr, 0, hash_pad_len);
1047
1048 if ((auth_alg == HASH_ALG_AES) &&
1049 (auth_mode == HASH_MODE_XCBC)) {
1050 /* AES/XCBC just requires padding to be 0s */
1051 ptr += hash_pad_len;
1052 } else {
1053 /* terminate the data */
1054 *ptr = 0x80;
1055 ptr += (hash_pad_len - sizeof(u64));
1056
1057 /* add the size at the end as required per alg */
1058 if (auth_alg == HASH_ALG_MD5)
1059 *(u64 *)ptr = cpu_to_le64((u64)total_sent * 8);
1060 else /* SHA1, SHA2-224, SHA2-256 */
1061 *(u64 *)ptr = cpu_to_be64((u64)total_sent * 8);
1062 ptr += sizeof(u64);
1063 }
1064 }
1065
1066 /* pad to a 4byte alignment for STAT */
1067 if (status_padding > 0) {
1068 flow_log(" STAT: padding to 4 byte alignment: %u bytes\n",
1069 status_padding);
1070
1071 memset(ptr, 0, status_padding);
1072 ptr += status_padding;
1073 }
1074 }
1075
1076 /**
1077 * spum_xts_tweak_in_payload() - Indicate that SPUM DOES place the XTS tweak
1078 * field in the packet payload (rather than using IV)
1079 *
1080 * Return: 1
1081 */
spum_xts_tweak_in_payload(void)1082 u8 spum_xts_tweak_in_payload(void)
1083 {
1084 return 1;
1085 }
1086
1087 /**
1088 * spum_tx_status_len() - Return the length of the STATUS field in a SPU
1089 * response message.
1090 *
1091 * Return: Length of STATUS field in bytes.
1092 */
spum_tx_status_len(void)1093 u8 spum_tx_status_len(void)
1094 {
1095 return SPU_TX_STATUS_LEN;
1096 }
1097
1098 /**
1099 * spum_rx_status_len() - Return the length of the STATUS field in a SPU
1100 * response message.
1101 *
1102 * Return: Length of STATUS field in bytes.
1103 */
spum_rx_status_len(void)1104 u8 spum_rx_status_len(void)
1105 {
1106 return SPU_RX_STATUS_LEN;
1107 }
1108
1109 /**
1110 * spum_status_process() - Process the status from a SPU response message.
1111 * @statp: start of STATUS word
1112 * Return:
1113 * 0 - if status is good and response should be processed
1114 * !0 - status indicates an error and response is invalid
1115 */
spum_status_process(u8 * statp)1116 int spum_status_process(u8 *statp)
1117 {
1118 u32 status;
1119
1120 status = __be32_to_cpu(*(__be32 *)statp);
1121 flow_log("SPU response STATUS %#08x\n", status);
1122 if (status & SPU_STATUS_ERROR_FLAG) {
1123 pr_err("%s() Warning: Error result from SPU: %#08x\n",
1124 __func__, status);
1125 if (status & SPU_STATUS_INVALID_ICV)
1126 return SPU_INVALID_ICV;
1127 return -EBADMSG;
1128 }
1129 return 0;
1130 }
1131
1132 /**
1133 * spum_ccm_update_iv() - Update the IV as per the requirements for CCM mode.
1134 *
1135 * @digestsize: Digest size of this request
1136 * @cipher_parms: (pointer to) cipher parmaeters, includes IV buf & IV len
1137 * @assoclen: Length of AAD data
1138 * @chunksize: length of input data to be sent in this req
1139 * @is_encrypt: true if this is an output/encrypt operation
1140 * @is_esp: true if this is an ESP / RFC4309 operation
1141 *
1142 */
spum_ccm_update_iv(unsigned int digestsize,struct spu_cipher_parms * cipher_parms,unsigned int assoclen,unsigned int chunksize,bool is_encrypt,bool is_esp)1143 void spum_ccm_update_iv(unsigned int digestsize,
1144 struct spu_cipher_parms *cipher_parms,
1145 unsigned int assoclen,
1146 unsigned int chunksize,
1147 bool is_encrypt,
1148 bool is_esp)
1149 {
1150 u8 L; /* L from CCM algorithm, length of plaintext data */
1151 u8 mprime; /* M' from CCM algo, (M - 2) / 2, where M=authsize */
1152 u8 adata;
1153
1154 if (cipher_parms->iv_len != CCM_AES_IV_SIZE) {
1155 pr_err("%s(): Invalid IV len %d for CCM mode, should be %d\n",
1156 __func__, cipher_parms->iv_len, CCM_AES_IV_SIZE);
1157 return;
1158 }
1159
1160 /*
1161 * IV needs to be formatted as follows:
1162 *
1163 * | Byte 0 | Bytes 1 - N | Bytes (N+1) - 15 |
1164 * | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | Bits 7 - 0 | Bits 7 - 0 |
1165 * | 0 |Ad?|(M - 2) / 2| L - 1 | Nonce | Plaintext Length |
1166 *
1167 * Ad? = 1 if AAD present, 0 if not present
1168 * M = size of auth field, 8, 12, or 16 bytes (SPU-M) -or-
1169 * 4, 6, 8, 10, 12, 14, 16 bytes (SPU2)
1170 * L = Size of Plaintext Length field; Nonce size = 15 - L
1171 *
1172 * It appears that the crypto API already expects the L-1 portion
1173 * to be set in the first byte of the IV, which implicitly determines
1174 * the nonce size, and also fills in the nonce. But the other bits
1175 * in byte 0 as well as the plaintext length need to be filled in.
1176 *
1177 * In rfc4309/esp mode, L is not already in the supplied IV and
1178 * we need to fill it in, as well as move the IV data to be after
1179 * the salt
1180 */
1181 if (is_esp) {
1182 L = CCM_ESP_L_VALUE; /* RFC4309 has fixed L */
1183 } else {
1184 /* L' = plaintext length - 1 so Plaintext length is L' + 1 */
1185 L = ((cipher_parms->iv_buf[0] & CCM_B0_L_PRIME) >>
1186 CCM_B0_L_PRIME_SHIFT) + 1;
1187 }
1188
1189 mprime = (digestsize - 2) >> 1; /* M' = (M - 2) / 2 */
1190 adata = (assoclen > 0); /* adata = 1 if any associated data */
1191
1192 cipher_parms->iv_buf[0] = (adata << CCM_B0_ADATA_SHIFT) |
1193 (mprime << CCM_B0_M_PRIME_SHIFT) |
1194 ((L - 1) << CCM_B0_L_PRIME_SHIFT);
1195
1196 /* Nonce is already filled in by crypto API, and is 15 - L bytes */
1197
1198 /* Don't include digest in plaintext size when decrypting */
1199 if (!is_encrypt)
1200 chunksize -= digestsize;
1201
1202 /* Fill in length of plaintext, formatted to be L bytes long */
1203 format_value_ccm(chunksize, &cipher_parms->iv_buf[15 - L + 1], L);
1204 }
1205
1206 /**
1207 * spum_wordalign_padlen() - Given the length of a data field, determine the
1208 * padding required to align the data following this field on a 4-byte boundary.
1209 * @data_size: length of data field in bytes
1210 *
1211 * Return: length of status field padding, in bytes
1212 */
spum_wordalign_padlen(u32 data_size)1213 u32 spum_wordalign_padlen(u32 data_size)
1214 {
1215 return ((data_size + 3) & ~3) - data_size;
1216 }
1217