[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / crypto / gcm.c

/*
 * GCM: Galois/Counter Mode.
 *
 * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 as published
 * by the Free Software Foundation.
 */

#include <crypto/algapi.h>
#include <crypto/gf128mul.h>
#include <crypto/scatterwalk.h>
#include <linux/err.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/slab.h>

#include "internal.h"

struct gcm_instance_ctx {
	struct crypto_spawn ctr;
};

struct crypto_gcm_ctx {
	struct crypto_ablkcipher *ctr;
	struct gf128mul_4k *gf128;
};

struct crypto_gcm_ghash_ctx {
	u32 bytes;
	u32 flags;
	struct gf128mul_4k *gf128;
	u8 buffer[16];
};

struct crypto_gcm_req_priv_ctx {
	u8 auth_tag[16];
	u8 iauth_tag[16];
	u8 counter[16];
	struct crypto_gcm_ghash_ctx ghash;
	struct ablkcipher_request abreq;
};

static void crypto_gcm_ghash_init(struct crypto_gcm_ghash_ctx *ctx, u32 flags,
				  struct gf128mul_4k *gf128)
{
	ctx->bytes = 0;
	ctx->flags = flags;
	ctx->gf128 = gf128;
	memset(ctx->buffer, 0, 16);
}

static void crypto_gcm_ghash_update(struct crypto_gcm_ghash_ctx *ctx,
				    const u8 *src, unsigned int srclen)
{
	u8 *dst = ctx->buffer;

	if (ctx->bytes) {
		int n = min(srclen, ctx->bytes);
		u8 *pos = dst + (16 - ctx->bytes);

		ctx->bytes -= n;
		srclen -= n;

		while (n--)
			*pos++ ^= *src++;

		if (!ctx->bytes)
			gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	}

	while (srclen >= 16) {
		crypto_xor(dst, src, 16);
		gf128mul_4k_lle((be128 *)dst, ctx->gf128);
		src += 16;
		srclen -= 16;
	}

	if (srclen) {
		ctx->bytes = 16 - srclen;
		while (srclen--)
			*dst++ ^= *src++;
	}
}

static void crypto_gcm_ghash_update_sg(struct crypto_gcm_ghash_ctx *ctx,
				       struct scatterlist *sg, int len)
{
	struct scatter_walk walk;
	u8 *src;
	int n;

	if (!len)
		return;

	scatterwalk_start(&walk, sg);

	while (len) {
		n = scatterwalk_clamp(&walk, len);

		if (!n) {
			scatterwalk_start(&walk, scatterwalk_sg_next(walk.sg));
			n = scatterwalk_clamp(&walk, len);
		}

		src = scatterwalk_map(&walk, 0);

		crypto_gcm_ghash_update(ctx, src, n);
		len -= n;

		scatterwalk_unmap(src, 0);
		scatterwalk_advance(&walk, n);
		scatterwalk_done(&walk, 0, len);
		if (len)
			crypto_yield(ctx->flags);
	}
}

static void crypto_gcm_ghash_flush(struct crypto_gcm_ghash_ctx *ctx)
{
	u8 *dst = ctx->buffer;

	if (ctx->bytes) {
		u8 *tmp = dst + (16 - ctx->bytes);

		while (ctx->bytes--)
			*tmp++ ^= 0;

		gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	}

	ctx->bytes = 0;
}

static void crypto_gcm_ghash_final_xor(struct crypto_gcm_ghash_ctx *ctx,
				       unsigned int authlen,
				       unsigned int cryptlen, u8 *dst)
{
	u8 *buf = ctx->buffer;
	u128 lengths;

	lengths.a = cpu_to_be64(authlen * 8);
	lengths.b = cpu_to_be64(cryptlen * 8);

	crypto_gcm_ghash_flush(ctx);
	crypto_xor(buf, (u8 *)&lengths, 16);
	gf128mul_4k_lle((be128 *)buf, ctx->gf128);
	crypto_xor(dst, buf, 16);
}

static inline void crypto_gcm_set_counter(u8 *counterblock, u32 value)
{
	*((u32 *)&counterblock[12]) = cpu_to_be32(value);
}

static int crypto_gcm_encrypt_counter(struct crypto_aead *aead, u8 *block,
				       u32 value, const u8 *iv)
{
	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
	struct crypto_ablkcipher *ctr = ctx->ctr;
	struct ablkcipher_request req;
	struct scatterlist sg;
	u8 counterblock[16];

	if (iv == NULL)
		memset(counterblock, 0, 12);
	else
		memcpy(counterblock, iv, 12);

	crypto_gcm_set_counter(counterblock, value);

	sg_init_one(&sg, block, 16);
	ablkcipher_request_set_tfm(&req, ctr);
	ablkcipher_request_set_crypt(&req, &sg, &sg, 16, counterblock);
	ablkcipher_request_set_callback(&req, 0, NULL, NULL);
	memset(block, 0, 16);
	return crypto_ablkcipher_encrypt(&req);
}

static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
			     unsigned int keylen)
{
	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
	struct crypto_ablkcipher *ctr = ctx->ctr;
	int alignmask = crypto_ablkcipher_alignmask(ctr);
	u8 alignbuf[16+alignmask];
	u8 *hash = (u8 *)ALIGN((unsigned long)alignbuf, alignmask+1);
	int err = 0;

	crypto_ablkcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
	crypto_ablkcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
				   CRYPTO_TFM_REQ_MASK);

	err = crypto_ablkcipher_setkey(ctr, key, keylen);
	if (err)
		goto out;

	crypto_aead_set_flags(aead, crypto_ablkcipher_get_flags(ctr) &
				       CRYPTO_TFM_RES_MASK);

	err = crypto_gcm_encrypt_counter(aead, hash, -1, NULL);
	if (err)
		goto out;

	if (ctx->gf128 != NULL)
		gf128mul_free_4k(ctx->gf128);

	ctx->gf128 = gf128mul_init_4k_lle((be128 *)hash);

	if (ctx->gf128 == NULL)
		err = -ENOMEM;

 out:
	return err;
}

static int crypto_gcm_init_crypt(struct ablkcipher_request *ablk_req,
				 struct aead_request *req,
				 unsigned int cryptlen,
				 void (*done)(struct crypto_async_request *,
					      int))
{
	struct crypto_aead *aead = crypto_aead_reqtfm(req);
	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	u32 flags = req->base.tfm->crt_flags;
	u8 *auth_tag = pctx->auth_tag;
	u8 *counter = pctx->counter;
	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;
	int err = 0;

	ablkcipher_request_set_tfm(ablk_req, ctx->ctr);
	ablkcipher_request_set_callback(ablk_req, aead_request_flags(req),
					done, req);
	ablkcipher_request_set_crypt(ablk_req, req->src, req->dst,
				     cryptlen, counter);

	err = crypto_gcm_encrypt_counter(aead, auth_tag, 0, req->iv);
	if (err)
		goto out;

	memcpy(counter, req->iv, 12);
	crypto_gcm_set_counter(counter, 1);

	crypto_gcm_ghash_init(ghash, flags, ctx->gf128);

	crypto_gcm_ghash_update_sg(ghash, req->assoc, req->assoclen);
	crypto_gcm_ghash_flush(ghash);

 out:
	return err;
}

static int crypto_gcm_hash(struct aead_request *req)
{
	struct crypto_aead *aead = crypto_aead_reqtfm(req);
	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	u8 *auth_tag = pctx->auth_tag;
	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;

	crypto_gcm_ghash_update_sg(ghash, req->dst, req->cryptlen);
	crypto_gcm_ghash_final_xor(ghash, req->assoclen, req->cryptlen,
				   auth_tag);

	scatterwalk_map_and_copy(auth_tag, req->dst, req->cryptlen,
				 crypto_aead_authsize(aead), 1);
	return 0;
}

static void crypto_gcm_encrypt_done(struct crypto_async_request *areq, int err)
{
	struct aead_request *req = areq->data;

	if (!err)
		err = crypto_gcm_hash(req);

	aead_request_complete(req, err);
}

static int crypto_gcm_encrypt(struct aead_request *req)
{
	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	struct ablkcipher_request *abreq = &pctx->abreq;
	int err = 0;

	err = crypto_gcm_init_crypt(abreq, req, req->cryptlen,
				    crypto_gcm_encrypt_done);
	if (err)
		return err;

	if (req->cryptlen) {
		err = crypto_ablkcipher_encrypt(abreq);
		if (err)
			return err;
	}

	return crypto_gcm_hash(req);
}

static void crypto_gcm_decrypt_done(struct crypto_async_request *areq, int err)
{
	aead_request_complete(areq->data, err);
}

static int crypto_gcm_decrypt(struct aead_request *req)
{
	struct crypto_aead *aead = crypto_aead_reqtfm(req);
	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	struct ablkcipher_request *abreq = &pctx->abreq;
	u8 *auth_tag = pctx->auth_tag;
	u8 *iauth_tag = pctx->iauth_tag;
	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;
	unsigned int cryptlen = req->cryptlen;
	unsigned int authsize = crypto_aead_authsize(aead);
	int err;

	if (cryptlen < authsize)
		return -EINVAL;
	cryptlen -= authsize;

	err = crypto_gcm_init_crypt(abreq, req, cryptlen,
				    crypto_gcm_decrypt_done);
	if (err)
		return err;

	crypto_gcm_ghash_update_sg(ghash, req->src, cryptlen);
	crypto_gcm_ghash_final_xor(ghash, req->assoclen, cryptlen, auth_tag);

	scatterwalk_map_and_copy(iauth_tag, req->src, cryptlen, authsize, 0);
	if (memcmp(iauth_tag, auth_tag, authsize))
		return -EBADMSG;

	return crypto_ablkcipher_decrypt(abreq);
}

static int crypto_gcm_init_tfm(struct crypto_tfm *tfm)
{
	struct crypto_instance *inst = (void *)tfm->__crt_alg;
	struct gcm_instance_ctx *ictx = crypto_instance_ctx(inst);
	struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
	struct crypto_ablkcipher *ctr;
	unsigned long align;
	int err;

	ctr = crypto_spawn_ablkcipher(&ictx->ctr);
	err = PTR_ERR(ctr);
	if (IS_ERR(ctr))
		return err;

	ctx->ctr = ctr;
	ctx->gf128 = NULL;

	align = max_t(unsigned long, crypto_ablkcipher_alignmask(ctr),
		      __alignof__(u32) - 1);
	align &= ~(crypto_tfm_ctx_alignment() - 1);
	tfm->crt_aead.reqsize = align +
				sizeof(struct crypto_gcm_req_priv_ctx) +
				crypto_ablkcipher_reqsize(ctr);

	return 0;
}

static void crypto_gcm_exit_tfm(struct crypto_tfm *tfm)
{
	struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);

	if (ctx->gf128 != NULL)
		gf128mul_free_4k(ctx->gf128);

	crypto_free_ablkcipher(ctx->ctr);
}

static struct crypto_instance *crypto_gcm_alloc(struct rtattr **tb)
{
	struct crypto_instance *inst;
	struct crypto_alg *ctr;
	struct crypto_alg *cipher;
	struct gcm_instance_ctx *ctx;
	int err;
	char ctr_name[CRYPTO_MAX_ALG_NAME];

	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD);
	if (err)
		return ERR_PTR(err);

	cipher = crypto_attr_alg(tb[1], CRYPTO_ALG_TYPE_CIPHER,
			      CRYPTO_ALG_TYPE_MASK);

	inst = ERR_PTR(PTR_ERR(cipher));
	if (IS_ERR(cipher))
		return inst;

	inst = ERR_PTR(ENAMETOOLONG);
	if (snprintf(
		    ctr_name, CRYPTO_MAX_ALG_NAME,
		    "ctr(%s,0,16,4)", cipher->cra_name) >= CRYPTO_MAX_ALG_NAME)
		return inst;

	ctr = crypto_alg_mod_lookup(ctr_name, CRYPTO_ALG_TYPE_BLKCIPHER,
				    CRYPTO_ALG_TYPE_MASK);

	if (IS_ERR(ctr))
		return ERR_PTR(PTR_ERR(ctr));

	if (cipher->cra_blocksize != 16)
		goto out_put_ctr;

	inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
	err = -ENOMEM;
	if (!inst)
		goto out_put_ctr;

	err = -ENAMETOOLONG;
	if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
		     "gcm(%s)", cipher->cra_name) >= CRYPTO_MAX_ALG_NAME ||
	    snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
		     "gcm(%s)", cipher->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
		goto err_free_inst;


	ctx = crypto_instance_ctx(inst);
	err = crypto_init_spawn(&ctx->ctr, ctr, inst, CRYPTO_ALG_TYPE_MASK);
	if (err)
		goto err_free_inst;

	inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_ASYNC;
	inst->alg.cra_priority = ctr->cra_priority;
	inst->alg.cra_blocksize = 16;
	inst->alg.cra_alignmask = __alignof__(u32) - 1;
	inst->alg.cra_type = &crypto_aead_type;
	inst->alg.cra_aead.ivsize = 12;
	inst->alg.cra_aead.maxauthsize = 16;
	inst->alg.cra_ctxsize = sizeof(struct crypto_gcm_ctx);
	inst->alg.cra_init = crypto_gcm_init_tfm;
	inst->alg.cra_exit = crypto_gcm_exit_tfm;
	inst->alg.cra_aead.setkey = crypto_gcm_setkey;
	inst->alg.cra_aead.encrypt = crypto_gcm_encrypt;
	inst->alg.cra_aead.decrypt = crypto_gcm_decrypt;

out:
	crypto_mod_put(ctr);
	return inst;
err_free_inst:
	kfree(inst);
out_put_ctr:
	inst = ERR_PTR(err);
	goto out;
}

static void crypto_gcm_free(struct crypto_instance *inst)
{
	struct gcm_instance_ctx *ctx = crypto_instance_ctx(inst);

	crypto_drop_spawn(&ctx->ctr);
	kfree(inst);
}

static struct crypto_template crypto_gcm_tmpl = {
	.name = "gcm",
	.alloc = crypto_gcm_alloc,
	.free = crypto_gcm_free,
	.module = THIS_MODULE,
};

static int __init crypto_gcm_module_init(void)
{
	return crypto_register_template(&crypto_gcm_tmpl);
}

static void __exit crypto_gcm_module_exit(void)
{
	crypto_unregister_template(&crypto_gcm_tmpl);
}

module_init(crypto_gcm_module_init);
module_exit(crypto_gcm_module_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Galois/Counter Mode");
MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");
Commit	Line	Data
28db8e3e MH	1	/*
	2	* GCM: Galois/Counter Mode.
	3	*
	4	* Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
	5	*
	6	* This program is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License version 2 as published
	8	* by the Free Software Foundation.
	9	*/
	10
	11	#include <crypto/algapi.h>
	12	#include <crypto/gf128mul.h>
42c271c6	13	#include <crypto/scatterwalk.h>
28db8e3e MH	14	#include <linux/err.h>
	15	#include <linux/init.h>
	16	#include <linux/kernel.h>
	17	#include <linux/module.h>
	18	#include <linux/slab.h>
	19
42c271c6	20	#include "internal.h"
28db8e3e MH	21
	22	struct gcm_instance_ctx {
	23	struct crypto_spawn ctr;
	24	};
	25
	26	struct crypto_gcm_ctx {
	27	struct crypto_ablkcipher *ctr;
	28	struct gf128mul_4k *gf128;
	29	};
	30
	31	struct crypto_gcm_ghash_ctx {
	32	u32 bytes;
	33	u32 flags;
	34	struct gf128mul_4k *gf128;
	35	u8 buffer[16];
	36	};
	37
	38	struct crypto_gcm_req_priv_ctx {
	39	u8 auth_tag[16];
6160b289	40	u8 iauth_tag[16];
28db8e3e MH	41	u8 counter[16];
28db8e3e MH	42	struct crypto_gcm_ghash_ctx ghash;
7f681378	43	struct ablkcipher_request abreq;
28db8e3e MH	44	};
	45
	46	static void crypto_gcm_ghash_init(struct crypto_gcm_ghash_ctx *ctx, u32 flags,
	47	struct gf128mul_4k *gf128)
	48	{
	49	ctx->bytes = 0;
	50	ctx->flags = flags;
	51	ctx->gf128 = gf128;
	52	memset(ctx->buffer, 0, 16);
	53	}
	54
	55	static void crypto_gcm_ghash_update(struct crypto_gcm_ghash_ctx *ctx,
	56	const u8 *src, unsigned int srclen)
	57	{
	58	u8 *dst = ctx->buffer;
	59
	60	if (ctx->bytes) {
	61	int n = min(srclen, ctx->bytes);
	62	u8 *pos = dst + (16 - ctx->bytes);
	63
	64	ctx->bytes -= n;
	65	srclen -= n;
	66
	67	while (n--)
	68	pos++ ^= src++;
	69
	70	if (!ctx->bytes)
	71	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	72	}
	73
	74	while (srclen >= 16) {
	75	crypto_xor(dst, src, 16);
	76	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	77	src += 16;
	78	srclen -= 16;
	79	}
	80
	81	if (srclen) {
	82	ctx->bytes = 16 - srclen;
	83	while (srclen--)
	84	dst++ ^= src++;
	85	}
	86	}
	87
	88	static void crypto_gcm_ghash_update_sg(struct crypto_gcm_ghash_ctx *ctx,
	89	struct scatterlist *sg, int len)
	90	{
	91	struct scatter_walk walk;
	92	u8 *src;
	93	int n;
	94
6160b289 HX	95	if (!len)
	96	return;
	97
28db8e3e MH	98	scatterwalk_start(&walk, sg);
	99
	100	while (len) {
	101	n = scatterwalk_clamp(&walk, len);
	102
	103	if (!n) {
b2ab4a57	104	scatterwalk_start(&walk, scatterwalk_sg_next(walk.sg));
28db8e3e MH	105	n = scatterwalk_clamp(&walk, len);
	106	}
	107
	108	src = scatterwalk_map(&walk, 0);
	109
	110	crypto_gcm_ghash_update(ctx, src, n);
	111	len -= n;
	112
	113	scatterwalk_unmap(src, 0);
	114	scatterwalk_advance(&walk, n);
	115	scatterwalk_done(&walk, 0, len);
	116	if (len)
	117	crypto_yield(ctx->flags);
	118	}
	119	}
	120
	121	static void crypto_gcm_ghash_flush(struct crypto_gcm_ghash_ctx *ctx)
	122	{
	123	u8 *dst = ctx->buffer;
	124
	125	if (ctx->bytes) {
	126	u8 *tmp = dst + (16 - ctx->bytes);
	127
	128	while (ctx->bytes--)
	129	*tmp++ ^= 0;
	130
	131	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	132	}
	133
	134	ctx->bytes = 0;
	135	}
	136
	137	static void crypto_gcm_ghash_final_xor(struct crypto_gcm_ghash_ctx *ctx,
	138	unsigned int authlen,
	139	unsigned int cryptlen, u8 *dst)
	140	{
	141	u8 *buf = ctx->buffer;
	142	u128 lengths;
	143
	144	lengths.a = cpu_to_be64(authlen * 8);
	145	lengths.b = cpu_to_be64(cryptlen * 8);
	146
	147	crypto_gcm_ghash_flush(ctx);
	148	crypto_xor(buf, (u8 *)&lengths, 16);
	149	gf128mul_4k_lle((be128 *)buf, ctx->gf128);
	150	crypto_xor(dst, buf, 16);
	151	}
	152
	153	static inline void crypto_gcm_set_counter(u8 *counterblock, u32 value)
	154	{
	155	((u32 )&counterblock[12]) = cpu_to_be32(value);
	156	}
	157
	158	static int crypto_gcm_encrypt_counter(struct crypto_aead aead, u8 block,
	159	u32 value, const u8 *iv)
	160	{
	161	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
	162	struct crypto_ablkcipher *ctr = ctx->ctr;
	163	struct ablkcipher_request req;
	164	struct scatterlist sg;
	165	u8 counterblock[16];
	166
	167	if (iv == NULL)
	168	memset(counterblock, 0, 12);
169	else
170	memcpy(counterblock, iv, 12);
171
172	crypto_gcm_set_counter(counterblock, value);
173
174	sg_init_one(&sg, block, 16);
175	ablkcipher_request_set_tfm(&req, ctr);
176	ablkcipher_request_set_crypt(&req, &sg, &sg, 16, counterblock);
177	ablkcipher_request_set_callback(&req, 0, NULL, NULL);
178	memset(block, 0, 16);
179	return crypto_ablkcipher_encrypt(&req);
180	}
181
182	static int crypto_gcm_setkey(struct crypto_aead aead, const u8 key,
183	unsigned int keylen)
184	{
185	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
186	struct crypto_ablkcipher *ctr = ctx->ctr;
187	int alignmask = crypto_ablkcipher_alignmask(ctr);
188	u8 alignbuf[16+alignmask];
189	u8 hash = (u8 )ALIGN((unsigned long)alignbuf, alignmask+1);
190	int err = 0;
191
192	crypto_ablkcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
193	crypto_ablkcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
194	CRYPTO_TFM_REQ_MASK);
195
196	err = crypto_ablkcipher_setkey(ctr, key, keylen);
197	if (err)
198	goto out;
199
200	crypto_aead_set_flags(aead, crypto_ablkcipher_get_flags(ctr) &
201	CRYPTO_TFM_RES_MASK);
202
203	err = crypto_gcm_encrypt_counter(aead, hash, -1, NULL);
204	if (err)
205	goto out;
206
207	if (ctx->gf128 != NULL)
208	gf128mul_free_4k(ctx->gf128);
209
210	ctx->gf128 = gf128mul_init_4k_lle((be128 *)hash);
211
212	if (ctx->gf128 == NULL)
213	err = -ENOMEM;
214
215	out:
216	return err;
217	}
218
219	static int crypto_gcm_init_crypt(struct ablkcipher_request *ablk_req,
6160b289 HX	220	struct aead_request *req,
	221	unsigned int cryptlen,
	222	void (done)(struct crypto_async_request ,
	223	int))
28db8e3e MH	224	{
	225	struct crypto_aead *aead = crypto_aead_reqtfm(req);
	226	struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
	227	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	228	u32 flags = req->base.tfm->crt_flags;
	229	u8 *auth_tag = pctx->auth_tag;
	230	u8 *counter = pctx->counter;
	231	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;
	232	int err = 0;
	233
	234	ablkcipher_request_set_tfm(ablk_req, ctx->ctr);
	235	ablkcipher_request_set_callback(ablk_req, aead_request_flags(req),
	236	done, req);
	237	ablkcipher_request_set_crypt(ablk_req, req->src, req->dst,
6160b289	238	cryptlen, counter);
28db8e3e MH	239
	240	err = crypto_gcm_encrypt_counter(aead, auth_tag, 0, req->iv);
	241	if (err)
	242	goto out;
	243
	244	memcpy(counter, req->iv, 12);
	245	crypto_gcm_set_counter(counter, 1);
	246
	247	crypto_gcm_ghash_init(ghash, flags, ctx->gf128);
	248
6160b289 HX	249	crypto_gcm_ghash_update_sg(ghash, req->assoc, req->assoclen);
6160b289 HX	250	crypto_gcm_ghash_flush(ghash);
28db8e3e MH	251
	252	out:
	253	return err;
	254	}
	255
6160b289	256	static int crypto_gcm_hash(struct aead_request *req)
28db8e3e	257	{
6160b289	258	struct crypto_aead *aead = crypto_aead_reqtfm(req);
28db8e3e MH	259	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
	260	u8 *auth_tag = pctx->auth_tag;
	261	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;
	262
	263	crypto_gcm_ghash_update_sg(ghash, req->dst, req->cryptlen);
	264	crypto_gcm_ghash_final_xor(ghash, req->assoclen, req->cryptlen,
	265	auth_tag);
	266
6160b289 HX	267	scatterwalk_map_and_copy(auth_tag, req->dst, req->cryptlen,
	268	crypto_aead_authsize(aead), 1);
	269	return 0;
	270	}
	271
	272	static void crypto_gcm_encrypt_done(struct crypto_async_request *areq, int err)
	273	{
	274	struct aead_request *req = areq->data;
	275
	276	if (!err)
	277	err = crypto_gcm_hash(req);
	278
28db8e3e MH	279	aead_request_complete(req, err);
	280	}
	281
	282	static int crypto_gcm_encrypt(struct aead_request *req)
	283	{
7f681378 HX	284	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
7f681378 HX	285	struct ablkcipher_request *abreq = &pctx->abreq;
28db8e3e MH	286	int err = 0;
28db8e3e MH	287
7f681378	288	err = crypto_gcm_init_crypt(abreq, req, req->cryptlen,
6160b289	289	crypto_gcm_encrypt_done);
28db8e3e MH	290	if (err)
	291	return err;
	292
	293	if (req->cryptlen) {
7f681378	294	err = crypto_ablkcipher_encrypt(abreq);
28db8e3e MH	295	if (err)
28db8e3e MH	296	return err;
28db8e3e MH	297	}
28db8e3e MH	298
6160b289	299	return crypto_gcm_hash(req);
28db8e3e MH	300	}
	301
	302	static void crypto_gcm_decrypt_done(struct crypto_async_request *areq, int err)
	303	{
	304	aead_request_complete(areq->data, err);
	305	}
	306
	307	static int crypto_gcm_decrypt(struct aead_request *req)
	308	{
6160b289	309	struct crypto_aead *aead = crypto_aead_reqtfm(req);
28db8e3e	310	struct crypto_gcm_req_priv_ctx *pctx = aead_request_ctx(req);
7f681378	311	struct ablkcipher_request *abreq = &pctx->abreq;
28db8e3e	312	u8 *auth_tag = pctx->auth_tag;
6160b289	313	u8 *iauth_tag = pctx->iauth_tag;
28db8e3e	314	struct crypto_gcm_ghash_ctx *ghash = &pctx->ghash;
6160b289 HX	315	unsigned int cryptlen = req->cryptlen;
6160b289 HX	316	unsigned int authsize = crypto_aead_authsize(aead);
28db8e3e MH	317	int err;
28db8e3e MH	318
6160b289	319	if (cryptlen < authsize)
28db8e3e	320	return -EINVAL;
6160b289	321	cryptlen -= authsize;
28db8e3e	322
7f681378	323	err = crypto_gcm_init_crypt(abreq, req, cryptlen,
6160b289	324	crypto_gcm_decrypt_done);
28db8e3e MH	325	if (err)
	326	return err;
	327
6160b289 HX	328	crypto_gcm_ghash_update_sg(ghash, req->src, cryptlen);
6160b289 HX	329	crypto_gcm_ghash_final_xor(ghash, req->assoclen, cryptlen, auth_tag);
28db8e3e	330
6160b289 HX	331	scatterwalk_map_and_copy(iauth_tag, req->src, cryptlen, authsize, 0);
6160b289 HX	332	if (memcmp(iauth_tag, auth_tag, authsize))
fe70f5df	333	return -EBADMSG;
28db8e3e	334
7f681378	335	return crypto_ablkcipher_decrypt(abreq);
28db8e3e MH	336	}
	337
	338	static int crypto_gcm_init_tfm(struct crypto_tfm *tfm)
	339	{
	340	struct crypto_instance inst = (void )tfm->__crt_alg;
	341	struct gcm_instance_ctx *ictx = crypto_instance_ctx(inst);
	342	struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
	343	struct crypto_ablkcipher *ctr;
	344	unsigned long align;
	345	int err;
	346
	347	ctr = crypto_spawn_ablkcipher(&ictx->ctr);
	348	err = PTR_ERR(ctr);
	349	if (IS_ERR(ctr))
	350	return err;
	351
	352	ctx->ctr = ctr;
	353	ctx->gf128 = NULL;
	354
	355	align = max_t(unsigned long, crypto_ablkcipher_alignmask(ctr),
	356	__alignof__(u32) - 1);
	357	align &= ~(crypto_tfm_ctx_alignment() - 1);
7f681378 HX	358	tfm->crt_aead.reqsize = align +
	359	sizeof(struct crypto_gcm_req_priv_ctx) +
	360	crypto_ablkcipher_reqsize(ctr);
28db8e3e MH	361
	362	return 0;
	363	}
	364
	365	static void crypto_gcm_exit_tfm(struct crypto_tfm *tfm)
	366	{
	367	struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
	368
	369	if (ctx->gf128 != NULL)
	370	gf128mul_free_4k(ctx->gf128);
	371
	372	crypto_free_ablkcipher(ctx->ctr);
	373	}
	374
	375	static struct crypto_instance crypto_gcm_alloc(struct rtattr *tb)
	376	{
	377	struct crypto_instance *inst;
	378	struct crypto_alg *ctr;
	379	struct crypto_alg *cipher;
	380	struct gcm_instance_ctx *ctx;
	381	int err;
	382	char ctr_name[CRYPTO_MAX_ALG_NAME];
	383
	384	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD);
	385	if (err)
	386	return ERR_PTR(err);
	387
	388	cipher = crypto_attr_alg(tb[1], CRYPTO_ALG_TYPE_CIPHER,
	389	CRYPTO_ALG_TYPE_MASK);
	390
	391	inst = ERR_PTR(PTR_ERR(cipher));
	392	if (IS_ERR(cipher))
	393	return inst;
	394
	395	inst = ERR_PTR(ENAMETOOLONG);
	396	if (snprintf(
	397	ctr_name, CRYPTO_MAX_ALG_NAME,
	398	"ctr(%s,0,16,4)", cipher->cra_name) >= CRYPTO_MAX_ALG_NAME)
	399	return inst;
	400
	401	ctr = crypto_alg_mod_lookup(ctr_name, CRYPTO_ALG_TYPE_BLKCIPHER,
	402	CRYPTO_ALG_TYPE_MASK);
	403
	404	if (IS_ERR(ctr))
	405	return ERR_PTR(PTR_ERR(ctr));
	406
	407	if (cipher->cra_blocksize != 16)
	408	goto out_put_ctr;
	409
	410	inst = kzalloc(sizeof(inst) + sizeof(ctx), GFP_KERNEL);
	411	err = -ENOMEM;
	412	if (!inst)
	413	goto out_put_ctr;
	414
	415	err = -ENAMETOOLONG;
	416	if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
	417	"gcm(%s)", cipher->cra_name) >= CRYPTO_MAX_ALG_NAME \|\|
	418	snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
	419	"gcm(%s)", cipher->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
	420	goto err_free_inst;
	421
	422
	423	ctx = crypto_instance_ctx(inst);
	424	err = crypto_init_spawn(&ctx->ctr, ctr, inst, CRYPTO_ALG_TYPE_MASK);
425	if (err)
426	goto err_free_inst;
427
428	inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD \| CRYPTO_ALG_ASYNC;
429	inst->alg.cra_priority = ctr->cra_priority;
430	inst->alg.cra_blocksize = 16;
431	inst->alg.cra_alignmask = __alignof__(u32) - 1;
432	inst->alg.cra_type = &crypto_aead_type;
433	inst->alg.cra_aead.ivsize = 12;
7ba683a6	434	inst->alg.cra_aead.maxauthsize = 16;
28db8e3e MH	435	inst->alg.cra_ctxsize = sizeof(struct crypto_gcm_ctx);
	436	inst->alg.cra_init = crypto_gcm_init_tfm;
	437	inst->alg.cra_exit = crypto_gcm_exit_tfm;
	438	inst->alg.cra_aead.setkey = crypto_gcm_setkey;
	439	inst->alg.cra_aead.encrypt = crypto_gcm_encrypt;
	440	inst->alg.cra_aead.decrypt = crypto_gcm_decrypt;
	441
	442	out:
	443	crypto_mod_put(ctr);
	444	return inst;
	445	err_free_inst:
	446	kfree(inst);
	447	out_put_ctr:
	448	inst = ERR_PTR(err);
	449	goto out;
	450	}
	451
	452	static void crypto_gcm_free(struct crypto_instance *inst)
	453	{
	454	struct gcm_instance_ctx *ctx = crypto_instance_ctx(inst);
	455
	456	crypto_drop_spawn(&ctx->ctr);
	457	kfree(inst);
	458	}
	459
	460	static struct crypto_template crypto_gcm_tmpl = {
	461	.name = "gcm",
	462	.alloc = crypto_gcm_alloc,
	463	.free = crypto_gcm_free,
	464	.module = THIS_MODULE,
	465	};
	466
	467	static int __init crypto_gcm_module_init(void)
	468	{
	469	return crypto_register_template(&crypto_gcm_tmpl);
	470	}
	471
	472	static void __exit crypto_gcm_module_exit(void)
	473	{
	474	crypto_unregister_template(&crypto_gcm_tmpl);
	475	}
	476
	477	module_init(crypto_gcm_module_init);
	478	module_exit(crypto_gcm_module_exit);
	479
	480	MODULE_LICENSE("GPL");
	481	MODULE_DESCRIPTION("Galois/Counter Mode");
	482	MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");