LinuxLists.cc - [PATCH v2 00/12] crypto: caam

2020-09-21 07:33:12

Subject: [PATCH v2 00/12] crypto: caam - xts(aes) updates

From: Andrei Botila <[email protected]>

This patch series fixes some problems in CAAM's implementation of xts(aes):
- CAAM until Era 9 can't process XTS with 16B IV
- CAAM can only process in hardware XTS key lengths of 16B and 32B
- These hardware limitations are resolved through a fallback
- CAAM used to return 0 for XTS block length equal to zero

This patch series also adds a new feature in CAAM's xts(aes):
- CAAM is now able to process XTS with 16B IV in HW

Changes since v1:
- use only get_unaligned() for calculating XTS IV size
- fixed the double calling of crypto_skcipher_set_reqsize() in case of XTS
- added a patch which modifies the return value for XTS when block length
is equal to zero

Andrei Botila (12):
crypto: caam/jr - add fallback for XTS with more than 8B IV
crypto: caam/qi - add fallback for XTS with more than 8B IV
crypto: caam/qi2 - add fallback for XTS with more than 8B IV
crypto: caam/jr - add support for more XTS key lengths
crypto: caam/qi - add support for more XTS key lengths
crypto: caam/qi2 - add support for more XTS key lengths
crypto: caam/jr - add xts check for block length equal to zero
crypto: caam/qi - add xts check for block length equal to zero
crypto: caam/qi2 - add xts check for block length equal to zero
crypto: caam/jr - add support for XTS with 16B IV
crypto: caam/qi - add support for XTS with 16B IV
crypto: caam/qi2 - add support for XTS with 16B IV

drivers/crypto/caam/Kconfig | 3 +
drivers/crypto/caam/caamalg.c | 92 +++++++++++++++++++++---
drivers/crypto/caam/caamalg_desc.c | 27 ++++---
drivers/crypto/caam/caamalg_qi.c | 92 +++++++++++++++++++++---
drivers/crypto/caam/caamalg_qi2.c | 109 ++++++++++++++++++++++++++---
drivers/crypto/caam/caamalg_qi2.h | 2 +
6 files changed, 287 insertions(+), 38 deletions(-)

--
2.17.1

2020-09-21 07:33:26

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 03/12] crypto: caam/qi2 - add fallback for XTS with more than 8B IV

From: Andrei Botila <[email protected]>

A hardware limitation exists for CAAM until Era 9 which restricts
the accelerator to IVs with only 8 bytes. When CAAM has a lower era
a fallback is necessary to process 16 bytes IV.

Fixes: 226853ac3ebe ("crypto: caam/qi2 - add skcipher algorithms")
Cc: <[email protected]> # v4.20+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/Kconfig | 1 +
drivers/crypto/caam/caamalg_qi2.c | 78 +++++++++++++++++++++++++++++--
drivers/crypto/caam/caamalg_qi2.h | 2 +
3 files changed, 76 insertions(+), 5 deletions(-)

diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index 8169e6cd04e6..84ea7cba5ee5 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -167,6 +167,7 @@ config CRYPTO_DEV_FSL_DPAA2_CAAM
select CRYPTO_AEAD
select CRYPTO_HASH
select CRYPTO_DES
+ select CRYPTO_XTS
help
CAAM driver for QorIQ Data Path Acceleration Architecture 2.
It handles DPSECI DPAA2 objects that sit on the Management Complex
diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 66ae1d581168..2e37e6e63c8c 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -19,6 +19,7 @@
#include <linux/fsl/mc.h>
#include <soc/fsl/dpaa2-io.h>
#include <soc/fsl/dpaa2-fd.h>
+#include <asm/unaligned.h>

#define CAAM_CRA_PRIORITY 2000

@@ -80,6 +81,7 @@ struct caam_ctx {
struct alginfo adata;
struct alginfo cdata;
unsigned int authsize;
+ struct crypto_skcipher *fallback;
};

static void *dpaa2_caam_iova_to_virt(struct dpaa2_caam_priv *priv,
@@ -1056,12 +1058,17 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
struct device *dev = ctx->dev;
struct caam_flc *flc;
u32 *desc;
+ int err;

if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
dev_dbg(dev, "key size mismatch\n");
return -EINVAL;
}

+ err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
+ if (err)
+ return err;
+
ctx->cdata.keylen = keylen;
ctx->cdata.key_virt = key;
ctx->cdata.key_inline = true;
@@ -1443,6 +1450,17 @@ static void skcipher_decrypt_done(void *cbk_ctx, u32 status)
skcipher_request_complete(req, ecode);
}

+static bool xts_skcipher_ivsize(struct skcipher_request *req)
+{
+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
+ u64 size = 0;
+
+ size = get_unaligned((u64 *)(req->iv + (ivsize / 2)));
+
+ return !!size;
+}
+
static int skcipher_encrypt(struct skcipher_request *req)
{
struct skcipher_edesc *edesc;
@@ -1454,6 +1472,18 @@ static int skcipher_encrypt(struct skcipher_request *req)
if (!req->cryptlen)
return 0;

+ if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ skcipher_request_set_tfm(&caam_req->fallback_req, ctx->fallback);
+ skcipher_request_set_callback(&caam_req->fallback_req,
+ req->base.flags,
+ req->base.complete,
+ req->base.data);
+ skcipher_request_set_crypt(&caam_req->fallback_req, req->src,
+ req->dst, req->cryptlen, req->iv);
+
+ return crypto_skcipher_encrypt(&caam_req->fallback_req);
+ }
+
/* allocate extended descriptor */
edesc = skcipher_edesc_alloc(req);
if (IS_ERR(edesc))
@@ -1484,6 +1514,19 @@ static int skcipher_decrypt(struct skcipher_request *req)

if (!req->cryptlen)
return 0;
+
+ if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ skcipher_request_set_tfm(&caam_req->fallback_req, ctx->fallback);
+ skcipher_request_set_callback(&caam_req->fallback_req,
+ req->base.flags,
+ req->base.complete,
+ req->base.data);
+ skcipher_request_set_crypt(&caam_req->fallback_req, req->src,
+ req->dst, req->cryptlen, req->iv);
+
+ return crypto_skcipher_decrypt(&caam_req->fallback_req);
+ }
+
/* allocate extended descriptor */
edesc = skcipher_edesc_alloc(req);
if (IS_ERR(edesc))
@@ -1537,9 +1580,29 @@ static int caam_cra_init_skcipher(struct crypto_skcipher *tfm)
struct skcipher_alg *alg = crypto_skcipher_alg(tfm);
struct caam_skcipher_alg *caam_alg =
container_of(alg, typeof(*caam_alg), skcipher);
+ struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
+ u32 alg_aai = caam_alg->caam.class1_alg_type & OP_ALG_AAI_MASK;
+
+ if (alg_aai == OP_ALG_AAI_XTS) {
+ const char *tfm_name = crypto_tfm_alg_name(&tfm->base);
+ struct crypto_skcipher *fallback;
+
+ fallback = crypto_alloc_skcipher(tfm_name, 0,
+ CRYPTO_ALG_NEED_FALLBACK);
+ if (IS_ERR(fallback)) {
+ dev_err(ctx->dev, "Failed to allocate %s fallback: %ld\n",
+ tfm_name, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }

- crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_request));
- return caam_cra_init(crypto_skcipher_ctx(tfm), &caam_alg->caam, false);
+ ctx->fallback = fallback;
+ crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_request) +
+ crypto_skcipher_reqsize(fallback));
+ } else {
+ crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_request));
+ }
+
+ return caam_cra_init(ctx, &caam_alg->caam, false);
}

static int caam_cra_init_aead(struct crypto_aead *tfm)
@@ -1562,7 +1625,11 @@ static void caam_exit_common(struct caam_ctx *ctx)

static void caam_cra_exit(struct crypto_skcipher *tfm)
{
- caam_exit_common(crypto_skcipher_ctx(tfm));
+ struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
+
+ if (ctx->fallback)
+ crypto_free_skcipher(ctx->fallback);
+ caam_exit_common(ctx);
}

static void caam_cra_exit_aead(struct crypto_aead *tfm)
@@ -1665,6 +1732,7 @@ static struct caam_skcipher_alg driver_algs[] = {
.base = {
.cra_name = "xts(aes)",
.cra_driver_name = "xts-aes-caam-qi2",
+ .cra_flags = CRYPTO_ALG_NEED_FALLBACK,
.cra_blocksize = AES_BLOCK_SIZE,
},
.setkey = xts_skcipher_setkey,
@@ -2912,8 +2980,8 @@ static void caam_skcipher_alg_init(struct caam_skcipher_alg *t_alg)
alg->base.cra_module = THIS_MODULE;
alg->base.cra_priority = CAAM_CRA_PRIORITY;
alg->base.cra_ctxsize = sizeof(struct caam_ctx);
- alg->base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY |
- CRYPTO_ALG_KERN_DRIVER_ONLY;
+ alg->base.cra_flags |= (CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY |
+ CRYPTO_ALG_KERN_DRIVER_ONLY);

alg->init = caam_cra_init_skcipher;
alg->exit = caam_cra_exit;
diff --git a/drivers/crypto/caam/caamalg_qi2.h b/drivers/crypto/caam/caamalg_qi2.h
index f29cb7bd7dd3..d35253407ade 100644
--- a/drivers/crypto/caam/caamalg_qi2.h
+++ b/drivers/crypto/caam/caamalg_qi2.h
@@ -13,6 +13,7 @@
#include <linux/netdevice.h>
#include "dpseci.h"
#include "desc_constr.h"
+#include <crypto/skcipher.h>

#define DPAA2_CAAM_STORE_SIZE 16
/* NAPI weight *must* be a multiple of the store size. */
@@ -186,6 +187,7 @@ struct caam_request {
void (*cbk)(void *ctx, u32 err);
void *ctx;
void *edesc;
+ struct skcipher_request fallback_req;
};

/**
--
2.17.1

2020-09-21 07:33:31

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 01/12] crypto: caam/jr - add fallback for XTS with more than 8B IV

From: Andrei Botila <[email protected]>

A hardware limitation exists for CAAM until Era 9 which restricts
the accelerator to IVs with only 8 bytes. When CAAM has a lower era
a fallback is necessary to process 16 bytes IV.

Fixes: c6415a6016bf ("crypto: caam - add support for acipher xts(aes)")
Cc: <[email protected]> # v4.4+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/Kconfig | 1 +
drivers/crypto/caam/caamalg.c | 70 +++++++++++++++++++++++++++++++----
2 files changed, 64 insertions(+), 7 deletions(-)

diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index bc35aa0ec07a..dfeaad8dfe81 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -101,6 +101,7 @@ config CRYPTO_DEV_FSL_CAAM_CRYPTO_API
select CRYPTO_AUTHENC
select CRYPTO_SKCIPHER
select CRYPTO_LIB_DES
+ select CRYPTO_XTS
help
Selecting this will offload crypto for users of the
scatterlist crypto API (such as the linux native IPSec
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 91feda5b63f6..e85e740a5fbc 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -57,6 +57,7 @@
#include "key_gen.h"
#include "caamalg_desc.h"
#include <crypto/engine.h>
+#include <asm/unaligned.h>

/*
* crypto alg
@@ -114,10 +115,12 @@ struct caam_ctx {
struct alginfo adata;
struct alginfo cdata;
unsigned int authsize;
+ struct crypto_skcipher *fallback;
};

struct caam_skcipher_req_ctx {
struct skcipher_edesc *edesc;
+ struct skcipher_request fallback_req;
};

struct caam_aead_req_ctx {
@@ -830,12 +833,17 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher);
struct device *jrdev = ctx->jrdev;
u32 *desc;
+ int err;

if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
dev_dbg(jrdev, "key size mismatch\n");
return -EINVAL;
}

+ err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
+ if (err)
+ return err;
+
ctx->cdata.keylen = keylen;
ctx->cdata.key_virt = key;
ctx->cdata.key_inline = true;
@@ -1755,6 +1763,17 @@ static int skcipher_do_one_req(struct crypto_engine *engine, void *areq)
return ret;
}

+static bool xts_skcipher_ivsize(struct skcipher_request *req)
+{
+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
+ u64 size = 0;
+
+ size = get_unaligned((u64 *)(req->iv + (ivsize / 2)));
+
+ return !!size;
+}
+
static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
{
struct skcipher_edesc *edesc;
@@ -1768,6 +1787,21 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
if (!req->cryptlen)
return 0;

+ if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);
+
+ skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+ skcipher_request_set_callback(&rctx->fallback_req,
+ req->base.flags,
+ req->base.complete,
+ req->base.data);
+ skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+ req->dst, req->cryptlen, req->iv);
+
+ return encrypt ? crypto_skcipher_encrypt(&rctx->fallback_req) :
+ crypto_skcipher_decrypt(&rctx->fallback_req);
+ }
+
/* allocate extended descriptor */
edesc = skcipher_edesc_alloc(req, DESC_JOB_IO_LEN * CAAM_CMD_SZ);
if (IS_ERR(edesc))
@@ -1905,6 +1939,7 @@ static struct caam_skcipher_alg driver_algs[] = {
.base = {
.cra_name = "xts(aes)",
.cra_driver_name = "xts-aes-caam",
+ .cra_flags = CRYPTO_ALG_NEED_FALLBACK,
.cra_blocksize = AES_BLOCK_SIZE,
},
.setkey = xts_skcipher_setkey,
@@ -3344,13 +3379,30 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
struct caam_skcipher_alg *caam_alg =
container_of(alg, typeof(*caam_alg), skcipher);
struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
-
- crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx));
+ u32 alg_aai = caam_alg->caam.class1_alg_type & OP_ALG_AAI_MASK;

ctx->enginectx.op.do_one_request = skcipher_do_one_req;

- return caam_init_common(crypto_skcipher_ctx(tfm), &caam_alg->caam,
- false);
+ if (alg_aai == OP_ALG_AAI_XTS) {
+ const char *tfm_name = crypto_tfm_alg_name(&tfm->base);
+ struct crypto_skcipher *fallback;
+
+ fallback = crypto_alloc_skcipher(tfm_name, 0,
+ CRYPTO_ALG_NEED_FALLBACK);
+ if (IS_ERR(fallback)) {
+ dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
+ tfm_name, PTR_ERR(fallback));
+ return PTR_ERR(fallback);
+ }
+
+ ctx->fallback = fallback;
+ crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx) +
+ crypto_skcipher_reqsize(fallback));
+ } else {
+ crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx));
+ }
+
+ return caam_init_common(ctx, &caam_alg->caam, false);
}

static int caam_aead_init(struct crypto_aead *tfm)
@@ -3378,7 +3430,11 @@ static void caam_exit_common(struct caam_ctx *ctx)

static void caam_cra_exit(struct crypto_skcipher *tfm)
{
- caam_exit_common(crypto_skcipher_ctx(tfm));
+ struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
+
+ if (ctx->fallback)
+ crypto_free_skcipher(ctx->fallback);
+ caam_exit_common(ctx);
}

static void caam_aead_exit(struct crypto_aead *tfm)
@@ -3412,8 +3468,8 @@ static void caam_skcipher_alg_init(struct caam_skcipher_alg *t_alg)
alg->base.cra_module = THIS_MODULE;
alg->base.cra_priority = CAAM_CRA_PRIORITY;
alg->base.cra_ctxsize = sizeof(struct caam_ctx);
- alg->base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY |
- CRYPTO_ALG_KERN_DRIVER_ONLY;
+ alg->base.cra_flags |= (CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY |
+ CRYPTO_ALG_KERN_DRIVER_ONLY);

alg->init = caam_cra_init;
alg->exit = caam_cra_exit;
--
2.17.1

2020-09-21 07:33:50

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 06/12] crypto: caam/qi2 - add support for more XTS key lengths

From: Andrei Botila <[email protected]>

CAAM accelerator only supports XTS-AES-128 and XTS-AES-256 since
it adheres strictly to the standard. All the other key lengths
are accepted and processed through a fallback as long as they pass
the xts_verify_key() checks.

Fixes: 226853ac3ebe ("crypto: caam/qi2 - add skcipher algorithms")
Cc: <[email protected]> # v4.20+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg_qi2.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 2e37e6e63c8c..5d2e554774c9 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -19,6 +19,7 @@
#include <linux/fsl/mc.h>
#include <soc/fsl/dpaa2-io.h>
#include <soc/fsl/dpaa2-fd.h>
+#include <crypto/xts.h>
#include <asm/unaligned.h>

#define CAAM_CRA_PRIORITY 2000
@@ -81,6 +82,7 @@ struct caam_ctx {
struct alginfo adata;
struct alginfo cdata;
unsigned int authsize;
+ bool xts_key_fallback;
struct crypto_skcipher *fallback;
};

@@ -1060,11 +1062,15 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
u32 *desc;
int err;

- if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+ err = xts_verify_key(skcipher, key, keylen);
+ if (err) {
dev_dbg(dev, "key size mismatch\n");
- return -EINVAL;
+ return err;
}

+ if (keylen != 2 * AES_KEYSIZE_128 && keylen != 2 * AES_KEYSIZE_256)
+ ctx->xts_key_fallback = true;
+
err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
if (err)
return err;
@@ -1472,7 +1478,8 @@ static int skcipher_encrypt(struct skcipher_request *req)
if (!req->cryptlen)
return 0;

- if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+ ctx->xts_key_fallback)) {
skcipher_request_set_tfm(&caam_req->fallback_req, ctx->fallback);
skcipher_request_set_callback(&caam_req->fallback_req,
req->base.flags,
@@ -1515,7 +1522,8 @@ static int skcipher_decrypt(struct skcipher_request *req)
if (!req->cryptlen)
return 0;

- if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+ ctx->xts_key_fallback)) {
skcipher_request_set_tfm(&caam_req->fallback_req, ctx->fallback);
skcipher_request_set_callback(&caam_req->fallback_req,
req->base.flags,
--
2.17.1

2020-09-21 07:34:12

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 04/12] crypto: caam/jr - add support for more XTS key lengths

From: Andrei Botila <[email protected]>

CAAM accelerator only supports XTS-AES-128 and XTS-AES-256 since
it adheres strictly to the standard. All the other key lengths
are accepted and processed through a fallback as long as they pass
the xts_verify_key() checks.

Fixes: c6415a6016bf ("crypto: caam - add support for acipher xts(aes)")
Cc: <[email protected]> # v4.4+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index e85e740a5fbc..ba70db61a76d 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -57,6 +57,7 @@
#include "key_gen.h"
#include "caamalg_desc.h"
#include <crypto/engine.h>
+#include <crypto/xts.h>
#include <asm/unaligned.h>

/*
@@ -115,6 +116,7 @@ struct caam_ctx {
struct alginfo adata;
struct alginfo cdata;
unsigned int authsize;
+ bool xts_key_fallback;
struct crypto_skcipher *fallback;
};

@@ -835,11 +837,15 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
u32 *desc;
int err;

- if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+ err = xts_verify_key(skcipher, key, keylen);
+ if (err) {
dev_dbg(jrdev, "key size mismatch\n");
- return -EINVAL;
+ return err;
}

+ if (keylen != 2 * AES_KEYSIZE_128 && keylen != 2 * AES_KEYSIZE_256)
+ ctx->xts_key_fallback = true;
+
err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
if (err)
return err;
@@ -1787,7 +1793,8 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
if (!req->cryptlen)
return 0;

- if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+ ctx->xts_key_fallback)) {
struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);

skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
--
2.17.1

2020-09-21 07:34:15

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 05/12] crypto: caam/qi - add support for more XTS key lengths

From: Andrei Botila <[email protected]>

CAAM accelerator only supports XTS-AES-128 and XTS-AES-256 since
it adheres strictly to the standard. All the other key lengths
are accepted and processed through a fallback as long as they pass
the xts_verify_key() checks.

Fixes: b189817cf789 ("crypto: caam/qi - add ablkcipher and authenc algorithms")
Cc: <[email protected]> # v4.12+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg_qi.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
index 2b5e694fdaf6..ac89d1dc361f 100644
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -18,6 +18,7 @@
#include "qi.h"
#include "jr.h"
#include "caamalg_desc.h"
+#include <crypto/xts.h>
#include <asm/unaligned.h>

/*
@@ -68,6 +69,7 @@ struct caam_ctx {
struct device *qidev;
spinlock_t lock; /* Protects multiple init of driver context */
struct caam_drv_ctx *drv_ctx[NUM_OP];
+ bool xts_key_fallback;
struct crypto_skcipher *fallback;
};

@@ -734,11 +736,15 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
int ret = 0;
int err;

- if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+ err = xts_verify_key(skcipher, key, keylen);
+ if (err) {
dev_dbg(jrdev, "key size mismatch\n");
- return -EINVAL;
+ return err;
}

+ if (keylen != 2 * AES_KEYSIZE_128 && keylen != 2 * AES_KEYSIZE_256)
+ ctx->xts_key_fallback = true;
+
err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
if (err)
return err;
@@ -1405,7 +1411,8 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
if (!req->cryptlen)
return 0;

- if (ctx->fallback && xts_skcipher_ivsize(req)) {
+ if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+ ctx->xts_key_fallback)) {
struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);

skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
--
2.17.1

2020-09-21 07:34:36

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 09/12] crypto: caam/qi2 - add xts check for block length equal to zero

From: Andrei Botila <[email protected]>

XTS should not return succes when dealing with block length equal to zero.
This is different than the rest of the skcipher algorithms.

Fixes: 31bb2f0da1b50 ("crypto: caam - check zero-length input")
Cc: <[email protected]> # v5.4+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg_qi2.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 5d2e554774c9..592f4a0344ff 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -1475,7 +1475,12 @@ static int skcipher_encrypt(struct skcipher_request *req)
struct caam_request *caam_req = skcipher_request_ctx(req);
int ret;

- if (!req->cryptlen)
+ /*
+ * XTS is expected to return an error even for input length = 0
+ * Note that the case input length < block size will be caught during
+ * HW offloading and return an error.
+ */
+ if (!req->cryptlen && !ctx->fallback)
return 0;

if (ctx->fallback && (xts_skcipher_ivsize(req) ||
@@ -1519,7 +1524,12 @@ static int skcipher_decrypt(struct skcipher_request *req)
struct caam_request *caam_req = skcipher_request_ctx(req);
int ret;

- if (!req->cryptlen)
+ /*
+ * XTS is expected to return an error even for input length = 0
+ * Note that the case input length < block size will be caught during
+ * HW offloading and return an error.
+ */
+ if (!req->cryptlen && !ctx->fallback)
return 0;

if (ctx->fallback && (xts_skcipher_ivsize(req) ||
--
2.17.1

2020-09-21 07:34:41

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 10/12] crypto: caam/jr - add support for XTS with 16B IV

From: Andrei Botila <[email protected]>

Newer CAAM versions (Era 9+) support 16B IVs. Since for these devices
the HW limitation is no longer present newer version should process the
requests containing 16B IVs directly in hardware without using a fallback.

Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg.c | 12 ++++++++----
drivers/crypto/caam/caamalg_desc.c | 27 ++++++++++++++++-----------
2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index b5f8823e4300..d7a3b13c0c52 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -834,6 +834,7 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
{
struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher);
struct device *jrdev = ctx->jrdev;
+ struct caam_drv_private *ctrlpriv = dev_get_drvdata(jrdev->parent);
u32 *desc;
int err;

@@ -846,9 +847,11 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
if (keylen != 2 * AES_KEYSIZE_128 && keylen != 2 * AES_KEYSIZE_256)
ctx->xts_key_fallback = true;

- err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
- if (err)
- return err;
+ if (ctrlpriv->era <= 8 || ctx->xts_key_fallback) {
+ err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
+ if (err)
+ return err;
+ }

ctx->cdata.keylen = keylen;
ctx->cdata.key_virt = key;
@@ -1787,6 +1790,7 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher);
struct device *jrdev = ctx->jrdev;
struct caam_drv_private_jr *jrpriv = dev_get_drvdata(jrdev);
+ struct caam_drv_private *ctrlpriv = dev_get_drvdata(jrdev->parent);
u32 *desc;
int ret = 0;

@@ -1798,7 +1802,7 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
if (!req->cryptlen && !ctx->fallback)
return 0;

- if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+ if (ctx->fallback && ((ctrlpriv->era <= 8 && xts_skcipher_ivsize(req)) ||
ctx->xts_key_fallback)) {
struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);

diff --git a/drivers/crypto/caam/caamalg_desc.c b/drivers/crypto/caam/caamalg_desc.c
index d6c58184bb57..433d6d5cd582 100644
--- a/drivers/crypto/caam/caamalg_desc.c
+++ b/drivers/crypto/caam/caamalg_desc.c
@@ -1550,13 +1550,14 @@ void cnstr_shdsc_xts_skcipher_encap(u32 * const desc, struct alginfo *cdata)
set_jump_tgt_here(desc, key_jump_cmd);

/*
- * create sequence for loading the sector index
- * Upper 8B of IV - will be used as sector index
- * Lower 8B of IV - will be discarded
+ * create sequence for loading the sector index / 16B tweak value
+ * Lower 8B of IV - sector index / tweak lower half
+ * Upper 8B of IV - upper half of 16B tweak
*/
append_seq_load(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
(0x20 << LDST_OFFSET_SHIFT));
- append_seq_fifo_load(desc, 8, FIFOLD_CLASS_SKIP);
+ append_seq_load(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
+ (0x30 << LDST_OFFSET_SHIFT));

/* Load operation */
append_operation(desc, cdata->algtype | OP_ALG_AS_INITFINAL |
@@ -1565,9 +1566,11 @@ void cnstr_shdsc_xts_skcipher_encap(u32 * const desc, struct alginfo *cdata)
/* Perform operation */
skcipher_append_src_dst(desc);

- /* Store upper 8B of IV */
+ /* Store lower 8B and upper 8B of IV */
append_seq_store(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
(0x20 << LDST_OFFSET_SHIFT));
+ append_seq_store(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
+ (0x30 << LDST_OFFSET_SHIFT));

print_hex_dump_debug("xts skcipher enc shdesc@" __stringify(__LINE__)
": ", DUMP_PREFIX_ADDRESS, 16, 4,
@@ -1609,23 +1612,25 @@ void cnstr_shdsc_xts_skcipher_decap(u32 * const desc, struct alginfo *cdata)
set_jump_tgt_here(desc, key_jump_cmd);

/*
- * create sequence for loading the sector index
- * Upper 8B of IV - will be used as sector index
- * Lower 8B of IV - will be discarded
+ * create sequence for loading the sector index / 16B tweak value
+ * Lower 8B of IV - sector index / tweak lower half
+ * Upper 8B of IV - upper half of 16B tweak
*/
append_seq_load(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
(0x20 << LDST_OFFSET_SHIFT));
- append_seq_fifo_load(desc, 8, FIFOLD_CLASS_SKIP);
-
+ append_seq_load(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
+ (0x30 << LDST_OFFSET_SHIFT));
/* Load operation */
append_dec_op1(desc, cdata->algtype);

/* Perform operation */
skcipher_append_src_dst(desc);

- /* Store upper 8B of IV */
+ /* Store lower 8B and upper 8B of IV */
append_seq_store(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
(0x20 << LDST_OFFSET_SHIFT));
+ append_seq_store(desc, 8, LDST_SRCDST_BYTE_CONTEXT | LDST_CLASS_1_CCB |
+ (0x30 << LDST_OFFSET_SHIFT));

print_hex_dump_debug("xts skcipher dec shdesc@" __stringify(__LINE__)
": ", DUMP_PREFIX_ADDRESS, 16, 4, desc,
--
2.17.1

2020-09-21 07:34:46

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 12/12] crypto: caam/qi2 - add support for XTS with 16B IV

2020-09-21 07:34:56

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 08/12] crypto: caam/qi - add xts check for block length equal to zero

From: Andrei Botila <[email protected]>

XTS should not return succes when dealing with block length equal to zero.
This is different than the rest of the skcipher algorithms.

Fixes: 31bb2f0da1b50 ("crypto: caam - check zero-length input")
Cc: <[email protected]> # v5.4+
Signed-off-by: Andrei Botila <[email protected]>
---
drivers/crypto/caam/caamalg_qi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
index ac89d1dc361f..a897eea59790 100644
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -1408,7 +1408,12 @@ static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher);
int ret;

- if (!req->cryptlen)
+ /*
+ * XTS is expected to return an error even for input length = 0
+ * Note that the case input length < block size will be caught during
+ * HW offloading and return an error.
+ */
+ if (!req->cryptlen && !ctx->fallback)
return 0;

if (ctx->fallback && (xts_skcipher_ivsize(req) ||
--
2.17.1

2020-09-21 07:35:23

by Andrei Botila

[permalink] [raw]

Subject: [PATCH v2 11/12] crypto: caam/qi - add support for XTS with 16B IV

2020-09-21 11:46:49

by Horia Geanta

[permalink] [raw]

Subject: Re: [PATCH v2 01/12] crypto: caam/jr - add fallback for XTS with more than 8B IV

On 9/21/2020 10:32 AM, Andrei Botila (OSS) wrote:
> +static bool xts_skcipher_ivsize(struct skcipher_request *req)
> +{
> + struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
> + unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
> + u64 size = 0;
> +
> + size = get_unaligned((u64 *)(req->iv + (ivsize / 2)));
> +
> + return !!size;
Just get rid of the "size" local variable and return !!get_unaligned(...).
Also the function should be inline.

> @@ -3344,13 +3379,30 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
> struct caam_skcipher_alg *caam_alg =
> container_of(alg, typeof(*caam_alg), skcipher);
> struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
> -
> - crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx));
> + u32 alg_aai = caam_alg->caam.class1_alg_type & OP_ALG_AAI_MASK;
>
> ctx->enginectx.op.do_one_request = skcipher_do_one_req;
>
> - return caam_init_common(crypto_skcipher_ctx(tfm), &caam_alg->caam,
> - false);
> + if (alg_aai == OP_ALG_AAI_XTS) {
> + const char *tfm_name = crypto_tfm_alg_name(&tfm->base);
> + struct crypto_skcipher *fallback;
> +
> + fallback = crypto_alloc_skcipher(tfm_name, 0,
> + CRYPTO_ALG_NEED_FALLBACK);
> + if (IS_ERR(fallback)) {
> + dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
> + tfm_name, PTR_ERR(fallback));
> + return PTR_ERR(fallback);
> + }
> +
> + ctx->fallback = fallback;
> + crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx) +
> + crypto_skcipher_reqsize(fallback));
> + } else {
> + crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx));
> + }
> +
> + return caam_init_common(ctx, &caam_alg->caam, false);
In case caam_init_common() fails, fallback should be freed for XTS path.

Horia

2020-09-21 11:47:26

by Horia Geanta

[permalink] [raw]

Subject: Re: [PATCH v2 00/12] crypto: caam - xts(aes) updates

On 9/21/2020 10:32 AM, Andrei Botila (OSS) wrote:
> From: Andrei Botila <[email protected]>
>
> This patch series fixes some problems in CAAM's implementation of xts(aes):
> - CAAM until Era 9 can't process XTS with 16B IV
> - CAAM can only process in hardware XTS key lengths of 16B and 32B
> - These hardware limitations are resolved through a fallback
> - CAAM used to return 0 for XTS block length equal to zero
>
> This patch series also adds a new feature in CAAM's xts(aes):
> - CAAM is now able to process XTS with 16B IV in HW
>
> Changes since v1:
> - use only get_unaligned() for calculating XTS IV size
> - fixed the double calling of crypto_skcipher_set_reqsize() in case of XTS
> - added a patch which modifies the return value for XTS when block length
> is equal to zero
>
Nitpick:
The new patches are 7-9/12.
Since they have the same Fixes tag and solve the same issue,
it would probably be better to squash them into a single patch.

Thanks,
Horia