GitHub/moto-9609/android_kernel_motorola_exynos9610.git
8 years agopowerpc: define FUNC_START/FUNC_END
Anton Blanchard [Thu, 30 Jun 2016 22:19:44 +0000 (08:19 +1000)]
powerpc: define FUNC_START/FUNC_END

gcc provides FUNC_START/FUNC_END macros to help with creating
assembly functions. Mirror these in the kernel so we can more easily
share code between userspace and the kernel. FUNC_END is just a
stub since we don't currently annotate the end of kernel functions.

It might make sense to do a wholesale search and replace, but for
now just create a couple of defines.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Fix regression from leading zeros
Herbert Xu [Sun, 3 Jul 2016 02:46:11 +0000 (10:46 +0800)]
crypto: rsa-pkcs1pad - Fix regression from leading zeros

As the software RSA implementation now produces fixed-length
output, we need to eliminate leading zeros in the calling code
instead.

This patch does just that for pkcs1pad signature verification.

Fixes: 9b45b7bba3d2 ("crypto: rsa - Generate fixed-length output")
Reported-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha3 - Add HMAC-SHA3 test modes and test vectors
raveendra padasalagi [Fri, 1 Jul 2016 05:46:54 +0000 (11:16 +0530)]
crypto: sha3 - Add HMAC-SHA3 test modes and test vectors

This patch adds HMAC-SHA3 test modes in tcrypt module
and related test vectors.

Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: omap-sham - increase cra_proirity to 400
Bin Liu [Thu, 30 Jun 2016 19:04:11 +0000 (14:04 -0500)]
crypto: omap-sham - increase cra_proirity to 400

The arm-neon-sha implementations have cra_priority of 150...300, so
increase omap-sham priority to 400 to ensure it is on top of any
software alg.

Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Do not bail on EINPROGRESS in multibuffer hash test
Herbert Xu [Thu, 30 Jun 2016 03:00:13 +0000 (11:00 +0800)]
crypto: tcrypt - Do not bail on EINPROGRESS in multibuffer hash test

The multibuffer hash speed test is incorrectly bailing because
of an EINPROGRESS return value.  This patch fixes it by setting
ret to zero if it is equal to -EINPROGRESS.

Reported-by: Megha Dey <megha.dey@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Avoid copying output when possible
Herbert Xu [Wed, 29 Jun 2016 11:32:28 +0000 (19:32 +0800)]
crypto: rsa-pkcs1pad - Avoid copying output when possible

In the vast majority of cases (2^-32 on 32-bit and 2^-64 on 64-bit)
cases, the result from encryption/signing will require no padding.

This patch makes these two operations write their output directly
to the final destination.  Only in the exceedingly rare cases where
fixup is needed to we copy it out and back to add the leading zeroes.

This patch also makes use of the crypto_akcipher_set_crypt API
instead of writing the akcipher request directly.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Move key size check to setkey
Herbert Xu [Wed, 29 Jun 2016 11:32:27 +0000 (19:32 +0800)]
crypto: rsa-pkcs1pad - Move key size check to setkey

Rather than repeatedly checking the key size on each operation,
we should be checking it once when the key is set.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Always use GFP_KERNEL
Herbert Xu [Wed, 29 Jun 2016 11:32:26 +0000 (19:32 +0800)]
crypto: rsa-pkcs1pad - Always use GFP_KERNEL

We don't currently support using akcipher in atomic contexts,
so GFP_KERNEL should always be used.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Remove bogus page splitting
Herbert Xu [Wed, 29 Jun 2016 11:32:24 +0000 (19:32 +0800)]
crypto: rsa-pkcs1pad - Remove bogus page splitting

The helper pkcs1pad_sg_set_buf tries to split a buffer that crosses
a page boundary into two SG entries.  This is unnecessary.  This
patch removes that.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa-pkcs1pad - Require hash to be present
Herbert Xu [Wed, 29 Jun 2016 11:32:23 +0000 (19:32 +0800)]
crypto: rsa-pkcs1pad - Require hash to be present

The only user of rsa-pkcs1pad always uses the hash so there is
no reason to support the case of not having a hash.

This patch also changes the digest info lookup so that it is
only done once during template instantiation rather than on each
operation.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agolib/mpi: Do not do sg_virt
Herbert Xu [Wed, 29 Jun 2016 11:32:22 +0000 (19:32 +0800)]
lib/mpi: Do not do sg_virt

Currently the mpi SG helpers use sg_virt which is completely
broken.  It happens to work with normal kernel memory but will
fail with anything that is not linearly mapped.

This patch fixes this by using the SG iterator helpers.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa - Generate fixed-length output
Herbert Xu [Wed, 29 Jun 2016 11:32:21 +0000 (19:32 +0800)]
crypto: rsa - Generate fixed-length output

Every implementation of RSA that we have naturally generates
output with leading zeroes.  The one and only user of RSA,
pkcs1pad wants to have those leading zeroes in place, in fact
because they are currently absent it has to write those zeroes
itself.

So we shouldn't be stripping leading zeroes in the first place.
In fact this patch makes rsa-generic produce output with fixed
length so that pkcs1pad does not need to do any extra work.

This patch also changes DH to use the new interface.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: testmgr - Allow leading zeros in RSA
Herbert Xu [Wed, 29 Jun 2016 11:32:20 +0000 (19:32 +0800)]
crypto: testmgr - Allow leading zeros in RSA

This patch allows RSA implementations to produce output with
leading zeroes.  testmgr will skip leading zeroes when comparing
the output.

This patch also tries to make the RSA test function generic enough
to potentially handle other akcipher algorithms.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Add speed test for cts
Herbert Xu [Wed, 29 Jun 2016 10:04:14 +0000 (18:04 +0800)]
crypto: tcrypt - Add speed test for cts

This patch adds speed tests for cts(cbc(aes)).

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: api - Add crypto_inst_setname
Herbert Xu [Wed, 29 Jun 2016 10:04:13 +0000 (18:04 +0800)]
crypto: api - Add crypto_inst_setname

This patch adds the helper crypto_inst_setname because the current
helper crypto_alloc_instance2 is no longer useful given that we
now look up the algorithm after we allocate the instance object.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: s390/aes - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:07 +0000 (18:04 +0800)]
crypto: s390/aes - Use skcipher for fallback

This patch replaces use of the obsolete blkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sahara - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:05 +0000 (18:04 +0800)]
crypto: sahara - Use skcipher for fallback

This patch replaces use of the obsolete ablkcipher with skcipher.

It also removes shash_fallback which is totally unused.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: qce - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:04 +0000 (18:04 +0800)]
crypto: qce - Use skcipher for fallback

This patch replaces use of the obsolete ablkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: picoxcell - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:03 +0000 (18:04 +0800)]
crypto: picoxcell - Use skcipher for fallback

This patch replaces use of the obsolete ablkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: mxs-dcp - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:02 +0000 (18:04 +0800)]
crypto: mxs-dcp - Use skcipher for fallback

This patch replaces use of the obsolete ablkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ccp - Use skcipher for fallback
Herbert Xu [Wed, 29 Jun 2016 10:04:01 +0000 (18:04 +0800)]
crypto: ccp - Use skcipher for fallback

This patch replaces use of the obsolete ablkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: aesni - Use crypto_cipher to derive rfc4106 subkey
Herbert Xu [Wed, 29 Jun 2016 10:03:59 +0000 (18:03 +0800)]
crypto: aesni - Use crypto_cipher to derive rfc4106 subkey

Currently aesni uses an async ctr(aes) to derive the rfc4106
subkey, which was presumably copied over from the generic rfc4106
code.  Over there it's done that way because we already have a
ctr(aes) spawn.  But it is simply overkill for aesni since we
have to go get a ctr(aes) from scratch anyway.

This patch simplifies the subkey derivation by using a straight
aes cipher instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Use skcipher
Herbert Xu [Wed, 29 Jun 2016 10:03:50 +0000 (18:03 +0800)]
crypto: tcrypt - Use skcipher

This patch converts tcrypt to use the new skcipher interface as
opposed to ablkcipher/blkcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ahash - Add padding in crypto_ahash_extsize
Herbert Xu [Wed, 29 Jun 2016 10:03:47 +0000 (18:03 +0800)]
crypto: ahash - Add padding in crypto_ahash_extsize

The function crypto_ahash_extsize did not include padding when
computing the tfm context size.  This patch fixes this by using
the generic crypto_alg_extsize helper.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: authenc - Consider ahash ASYNC bit
Herbert Xu [Wed, 29 Jun 2016 10:03:46 +0000 (18:03 +0800)]
crypto: authenc - Consider ahash ASYNC bit

As it is, if you get an async ahash with a sync skcipher you'll
end up with a sync authenc, which is wrong.

This patch fixes it by considering the ASYNC bit from ahash as
well.

It also fixes a little bug where if a sync version of authenc
is requested we may still end up using an async ahash.

Neither of them should have any effect as none of the authenc
users can request for a sync authenc.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: authenc - Remove redundant sg_init_table call.
Harsh Jain [Tue, 28 Jun 2016 18:54:43 +0000 (00:24 +0530)]
crypto: authenc - Remove redundant sg_init_table call.

Remove redundant sg_init_table call. scatterwalk_ffwd doing the same.

Signed-off-by: Harsh Jain <harshjain.prof@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Fix memory leaks/crashes in multibuffer hash speed test
Herbert Xu [Tue, 28 Jun 2016 12:33:52 +0000 (20:33 +0800)]
crypto: tcrypt - Fix memory leaks/crashes in multibuffer hash speed test

This patch resolves a number of issues with the mb speed test
function:

* The tfm is never freed.
* Memory is allocated even when we're not using mb.
* When an error occurs we don't wait for completion for other requests.
* When an error occurs during allocation we may leak memory.
* The test function ignores plen but still runs for plen != blen.
* The backlog flag is incorrectly used (may crash).

This patch tries to resolve all these issues as well as making
the code consistent with the existing hash speed testing function.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
8 years agocrypto: tcrypt - Use unsigned long for mb ahash cycle counter
Herbert Xu [Tue, 28 Jun 2016 08:41:38 +0000 (16:41 +0800)]
crypto: tcrypt - Use unsigned long for mb ahash cycle counter

For the timescales we are working against there is no need to
go beyond unsigned long.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Fix mixing printk/pr_err and obvious indentation issues
Krzysztof Kozlowski [Tue, 28 Jun 2016 07:23:06 +0000 (09:23 +0200)]
crypto: tcrypt - Fix mixing printk/pr_err and obvious indentation issues

The recently added test_mb_ahash_speed() has clearly serious coding
style issues. Try to fix some of them:
1. Don't mix pr_err() and printk();
2. Don't wrap strings;
3. Properly align goto statement in if() block;
4. Align wrapped arguments on new line;
5. Don't wrap functions on first argument;

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Add new mode for sha512_mb
Megha Dey [Mon, 27 Jun 2016 17:20:09 +0000 (10:20 -0700)]
crypto: tcrypt - Add new mode for sha512_mb

Add a new mode to calculate the speed of the sha512_mb algorithm

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha512-mb - Crypto computation (x4 AVX2)
Megha Dey [Mon, 27 Jun 2016 17:20:08 +0000 (10:20 -0700)]
crypto: sha512-mb - Crypto computation (x4 AVX2)

This patch introduces the assembly routines to do SHA512 computation on
buffers belonging to several jobs at once. The assembly routines are
optimized with AVX2 instructions that have 4 data lanes and using AVX2
registers.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha512-mb - Algorithm data structures
Megha Dey [Mon, 27 Jun 2016 17:20:07 +0000 (10:20 -0700)]
crypto: sha512-mb - Algorithm data structures

This patch introduces the data structures and prototypes of functions
needed for computing SHA512 hash using multi-buffer. Included are the
structures of the multi-buffer SHA512 job, job scheduler in C and x86
assembly.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha512-mb - submit/flush routines for AVX2
Megha Dey [Mon, 27 Jun 2016 17:20:06 +0000 (10:20 -0700)]
crypto: sha512-mb - submit/flush routines for AVX2

This patch introduces the routines used to submit and flush buffers
belonging to SHA512 crypto jobs to the SHA512 multibuffer algorithm.
It is implemented mostly in assembly optimized with AVX2 instructions.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha512-mb - Enable SHA512 multibuffer support
Megha Dey [Mon, 27 Jun 2016 17:20:05 +0000 (10:20 -0700)]
crypto: sha512-mb - Enable SHA512 multibuffer support

Add the config CRYPTO_SHA512_MB which will enable the computation
using the SHA512 multi-buffer algorithm.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha512-mb - SHA512 multibuffer job manager and glue code
Megha Dey [Mon, 27 Jun 2016 17:20:04 +0000 (10:20 -0700)]
crypto: sha512-mb - SHA512 multibuffer job manager and glue code

This patch introduces the multi-buffer job manager which is responsible
for submitting scatter-gather buffers from several SHA512 jobs to the
multi-buffer algorithm. It also contains the flush routine that's called
by the crypto daemon to complete the job when no new jobs arrive before
the deadline of maximum latency of a SHA512 crypto job.

The SHA512 multi-buffer crypto algorithm is defined and initialized in this
patch.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ux500 - do not build with -O0
Arnd Bergmann [Mon, 27 Jun 2016 09:17:40 +0000 (11:17 +0200)]
crypto: ux500 - do not build with -O0

The ARM allmodconfig build currently warngs because of the
ux500 crypto driver not working well with the jump label
implementation that we started using for dynamic debug, which
breaks building with 'gcc -O0':

In file included from /git/arm-soc/include/linux/jump_label.h:105:0,
                 from /git/arm-soc/include/linux/dynamic_debug.h:5,
                 from /git/arm-soc/include/linux/printk.h:289,
                 from /git/arm-soc/include/linux/kernel.h:13,
                 from /git/arm-soc/include/linux/clk.h:16,
                 from /git/arm-soc/drivers/crypto/ux500/hash/hash_core.c:16:
/git/arm-soc/arch/arm/include/asm/jump_label.h: In function 'hash_set_dma_transfer':
/git/arm-soc/arch/arm/include/asm/jump_label.h:13:7: error: asm operand 0 probably doesn't match constraints [-Werror]
  asm_volatile_goto("1:\n\t"

Turning off compiler optimizations has never really been supported
here, and it's only used when debugging the driver. I have not found
a good reason for doing this here, other than a misguided attempt
to produce more readable assembly output. Also, the driver is only
used in obsolete hardware that almost certainly nobody will spend
time debugging any more.

This just removes the -O0 flag from the compiler options.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: omap - Fix assumption that runtime_get_sync will always succeed
Nishanth Menon [Fri, 24 Jun 2016 16:50:39 +0000 (11:50 -0500)]
hwrng: omap - Fix assumption that runtime_get_sync will always succeed

pm_runtime_get_sync does return a error value that must be checked for
error conditions, else, due to various reasons, the device maynot be
enabled and the system will crash due to lack of clock to the hardware
module.

Before:
12.562784] [00000000] *pgd=fe193835
12.562792] Internal error: : 1406 [#1] SMP ARM
[...]
12.562864] CPU: 1 PID: 241 Comm: modprobe Not tainted 4.7.0-rc4-next-20160624 #2
12.562867] Hardware name: Generic DRA74X (Flattened Device Tree)
12.562872] task: ed51f140 ti: ed44c000 task.ti: ed44c000
12.562886] PC is at omap4_rng_init+0x20/0x84 [omap_rng]
12.562899] LR is at set_current_rng+0xc0/0x154 [rng_core]
[...]

After the proper checks:
[   94.366705] omap_rng 48090000.rng: _od_fail_runtime_resume: FIXME:
missing hwmod/omap_dev info
[   94.375767] omap_rng 48090000.rng: Failed to runtime_get device -19
[   94.382351] omap_rng 48090000.rng: initialization failed.

Fixes: 665d92fa85b5 ("hwrng: OMAP: convert to use runtime PM")
Cc: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agoMAINTAINERS: update maintainer for qat
Tadeusz Struk [Fri, 24 Jun 2016 14:01:33 +0000 (07:01 -0700)]
MAINTAINERS: update maintainer for qat

Add Giovanni and Salvatore who will take over the qat maintenance.

Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha1-mb - rename sha-mb to sha1-mb
Megha Dey [Fri, 24 Jun 2016 01:40:48 +0000 (18:40 -0700)]
crypto: sha1-mb - rename sha-mb to sha1-mb

Until now, there was only support for the SHA1 multibuffer algorithm.
Hence, there was just one sha-mb folder. Now, with the introduction of
the SHA256 multi-buffer algorithm , it is logical to name the existing
folder as sha1-mb.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: tcrypt - Add speed tests for SHA multibuffer algorithms
Megha Dey [Fri, 24 Jun 2016 01:40:47 +0000 (18:40 -0700)]
crypto: tcrypt - Add speed tests for SHA multibuffer algorithms

The existing test suite to calculate the speed of the SHA algorithms
assumes serial (single buffer)) computation of data. With the SHA
multibuffer algorithms, we work on 8 lanes of data in parallel. Hence,
the need to introduce a new test suite to calculate the speed for these
algorithms.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha256-mb - Crypto computation (x8 AVX2)
Megha Dey [Fri, 24 Jun 2016 01:40:46 +0000 (18:40 -0700)]
crypto: sha256-mb - Crypto computation (x8 AVX2)

This patch introduces the assembly routines to do SHA256 computation
on buffers belonging to several jobs at once.  The assembly routines
are optimized with AVX2 instructions that have 8 data lanes and using
AVX2 registers.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha256-mb - Algorithm data structures
Megha Dey [Fri, 24 Jun 2016 01:40:45 +0000 (18:40 -0700)]
crypto: sha256-mb - Algorithm data structures

This patch introduces the data structures and prototypes of
functions needed for computing SHA256 hash using multi-buffer.
Included are the structures of the multi-buffer SHA256 job,
job scheduler in C and x86 assembly.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha256-mb - submit/flush routines for AVX2
Megha Dey [Fri, 24 Jun 2016 01:40:44 +0000 (18:40 -0700)]
crypto: sha256-mb - submit/flush routines for AVX2

This patch introduces the routines used to submit and flush buffers
belonging to SHA256 crypto jobs to the SHA256 multibuffer algorithm. It
is implemented mostly in assembly optimized with AVX2 instructions.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha256-mb - Enable multibuffer support
Megha Dey [Fri, 24 Jun 2016 01:40:43 +0000 (18:40 -0700)]
crypto: sha256-mb - Enable multibuffer support

Add the config CRYPTO_SHA256_MB which will enable the computation using the
SHA256 multi-buffer algorithm.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha256-mb - SHA256 multibuffer job manager and glue code
Megha Dey [Fri, 24 Jun 2016 01:40:42 +0000 (18:40 -0700)]
crypto: sha256-mb - SHA256 multibuffer job manager and glue code

This patch introduces the multi-buffer job manager which is responsible for
submitting scatter-gather buffers from several SHA256 jobs to the
multi-buffer algorithm. It also contains the flush routine to that's
called by the crypto daemon to complete the job when no new jobs arrive
before the deadline of maximum latency of a SHA256 crypto job.

The SHA256 multi-buffer crypto algorithm is defined and initialized in
this patch.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agoDocumentation: devicetree: bindings: Add BCM5301x binding
Florian Fainelli [Thu, 23 Jun 2016 00:27:01 +0000 (17:27 -0700)]
Documentation: devicetree: bindings: Add BCM5301x binding

Document the binding used by the Broadcom BCM5301x (Northstar) SoC
random number generator.

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ecdh - make ecdh_shared_secret unique
Stephen Rothwell [Fri, 24 Jun 2016 06:20:22 +0000 (16:20 +1000)]
crypto: ecdh - make ecdh_shared_secret unique

There is another ecdh_shared_secret in net/bluetooth/ecc.c

Fixes: 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: bcm2835 - Add support for Broadcom BCM5301x
Florian Fainelli [Thu, 23 Jun 2016 00:27:02 +0000 (17:27 -0700)]
hwrng: bcm2835 - Add support for Broadcom BCM5301x

The Broadcom BCM5301x SoCs (Northstar) utilize the same random number
generator peripheral as Northstar Plus and BCM2835, but just like the
NSP SoC, we need to enable the interrupt.

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: jitterentropy - use ktime_get_ns as fallback
Stephan Mueller [Wed, 22 Jun 2016 17:26:06 +0000 (19:26 +0200)]
crypto: jitterentropy - use ktime_get_ns as fallback

As part of the Y2038 development, __getnstimeofday is not supposed to be
used any more. It is now replaced with ktime_get_ns. The Jitter RNG uses
the time stamp to measure the execution time of a given code path and
tries to detect variations in the execution time. Therefore, the only
requirement the Jitter RNG has, is a sufficient high resolution to
detect these variations.

The change was tested on x86 to show an identical behavior as RDTSC. The
used test code simply measures the execution time of the heart of the
RNG:

        jent_get_nstime(&time);
        jent_memaccess(ec, min);
        jent_fold_time(NULL, time, &folded, min);
        jent_get_nstime(&time2);
        return ((time2 - time));

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agoKEYS: Use skcipher for big keys
Herbert Xu [Wed, 22 Jun 2016 14:13:53 +0000 (22:13 +0800)]
KEYS: Use skcipher for big keys

This patch replaces use of the obsolete blkcipher with skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: David Howells <dhowells@redhat.com>
8 years agocrypto: omap-sham - set sw fallback to 240 bytes
Bin Liu [Wed, 22 Jun 2016 13:23:37 +0000 (16:23 +0300)]
crypto: omap-sham - set sw fallback to 240 bytes

Adds software fallback support for small crypto requests. In these cases,
it is undesirable to use DMA, as setting it up itself is rather heavy
operation. Gives about 40% extra performance in ipsec usecase.

Signed-off-by: Bin Liu <b-liu@ti.com>
[t-kristo@ti.com: dropped the extra traces, updated some comments
 on the code]
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: omap - do not call dmaengine_terminate_all
Lokesh Vutla [Wed, 22 Jun 2016 13:23:36 +0000 (16:23 +0300)]
crypto: omap - do not call dmaengine_terminate_all

The extra call to dmaengine_terminate_all is not needed, as the DMA
is not running at this point. This improves performance slightly.

Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: omap-sham - change queue size from 1 to 10
Tero Kristo [Wed, 22 Jun 2016 13:23:35 +0000 (16:23 +0300)]
crypto: omap-sham - change queue size from 1 to 10

Change crypto queue size from 1 to 10 for omap SHA driver. This should
allow clients to enqueue requests more effectively to avoid serializing
whole crypto sequences, giving extra performance.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: omap-sham - use runtime_pm autosuspend for clock handling
Tero Kristo [Wed, 22 Jun 2016 13:23:34 +0000 (16:23 +0300)]
crypto: omap-sham - use runtime_pm autosuspend for clock handling

Calling runtime PM API for every block causes serious performance hit to
crypto operations that are done on a long buffer. As crypto is performed
on a page boundary, encrypting large buffers can cause a series of crypto
operations divided by page. The runtime PM API is also called those many
times.

Convert the driver to use runtime_pm autosuspend instead, with a default
timeout value of 1 second. This results in upto ~50% speedup.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ecdh - Add ECDH software support
Salvatore Benedetto [Wed, 22 Jun 2016 16:49:15 +0000 (17:49 +0100)]
crypto: ecdh - Add ECDH software support

* Implement ECDH under kpp API
 * Provide ECC software support for curve P-192 and
   P-256.
 * Add kpp test for ECDH with data generated by OpenSSL

Signed-off-by: Salvatore Benedetto <salvatore.benedetto@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: dh - Add DH software implementation
Salvatore Benedetto [Wed, 22 Jun 2016 16:49:14 +0000 (17:49 +0100)]
crypto: dh - Add DH software implementation

* Implement MPI based Diffie-Hellman under kpp API
 * Test provided uses data generad by OpenSSL

Signed-off-by: Salvatore Benedetto <salvatore.benedetto@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: kpp - Key-agreement Protocol Primitives API (KPP)
Salvatore Benedetto [Wed, 22 Jun 2016 16:49:13 +0000 (17:49 +0100)]
crypto: kpp - Key-agreement Protocol Primitives API (KPP)

Add key-agreement protocol primitives (kpp) API which allows to
implement primitives required by protocols such as DH and ECDH.
The API is composed mainly by the following functions
 * set_secret() - It allows the user to set his secret, also
   referred to as his private key, along with the parameters
   known to both parties involved in the key-agreement session.
 * generate_public_key() - It generates the public key to be sent to
   the other counterpart involved in the key-agreement session. The
   function has to be called after set_params() and set_secret()
 * generate_secret() - It generates the shared secret for the session

Other functions such as init() and exit() are provided for allowing
cryptographic hardware to be inizialized properly before use

Signed-off-by: Salvatore Benedetto <salvatore.benedetto@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha1-mb - async implementation for sha1-mb
Megha Dey [Wed, 22 Jun 2016 01:21:46 +0000 (18:21 -0700)]
crypto: sha1-mb - async implementation for sha1-mb

Herbert wants the sha1-mb algorithm to have an async implementation:
https://lkml.org/lkml/2016/4/5/286.
Currently, sha1-mb uses an async interface for the outer algorithm
and a sync interface for the inner algorithm. This patch introduces
a async interface for even the inner algorithm.

Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ghash-ce - Fix cryptd reordering
Herbert Xu [Tue, 21 Jun 2016 08:55:17 +0000 (16:55 +0800)]
crypto: ghash-ce - Fix cryptd reordering

This patch fixes an old bug where requests can be reordered because
some are processed by cryptd while others are processed directly
in softirq context.

The fix is to always postpone to cryptd if there are currently
requests outstanding from the same tfm.

This patch also removes the redundant use of cryptd in the async
init function as init never touches the FPU.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ghash-clmulni - Fix cryptd reordering
Herbert Xu [Tue, 21 Jun 2016 08:55:16 +0000 (16:55 +0800)]
crypto: ghash-clmulni - Fix cryptd reordering

This patch fixes an old bug where requests can be reordered because
some are processed by cryptd while others are processed directly
in softirq context.

The fix is to always postpone to cryptd if there are currently
requests outstanding from the same tfm.

This patch also removes the redundant use of cryptd in the async
init function as init never touches the FPU.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: ablk_helper - Fix cryptd reordering
Herbert Xu [Tue, 21 Jun 2016 08:55:15 +0000 (16:55 +0800)]
crypto: ablk_helper - Fix cryptd reordering

This patch fixes an old bug where requests can be reordered because
some are processed by cryptd while others are processed directly
in softirq context.

The fix is to always postpone to cryptd if there are currently
requests outstanding from the same tfm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: aesni - Fix cryptd reordering problem on gcm
Herbert Xu [Tue, 21 Jun 2016 08:55:14 +0000 (16:55 +0800)]
crypto: aesni - Fix cryptd reordering problem on gcm

This patch fixes an old bug where gcm requests can be reordered
because some are processed by cryptd while others are processed
directly in softirq context.

The fix is to always postpone to cryptd if there are currently
requests outstanding from the same tfm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: cryptd - Add helpers to check whether a tfm is queued
Herbert Xu [Tue, 21 Jun 2016 08:55:13 +0000 (16:55 +0800)]
crypto: cryptd - Add helpers to check whether a tfm is queued

This patch adds helpers to check whether a given tfm is currently
queued.  This is meant to be used by ablk_helper and similar
entities to ensure that no reordering is introduced because of
requests queued in cryptd with respect to requests being processed
in softirq context.

The per-cpu queue length limit is also increased to 1000 in line
with network limits.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Increase the size of the crypto queue
Romain Perier [Tue, 21 Jun 2016 08:08:40 +0000 (10:08 +0200)]
crypto: marvell - Increase the size of the crypto queue

Now that crypto requests are chained together at the DMA level, we
increase the size of the crypto queue for each engine. The result is
that as the backlog list is reached later, it does not stop the crypto
stack from sending asychronous requests, so more cryptographic tasks
are processed by the engines.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Add support for chaining crypto requests in TDMA mode
Romain Perier [Tue, 21 Jun 2016 08:08:39 +0000 (10:08 +0200)]
crypto: marvell - Add support for chaining crypto requests in TDMA mode

The Cryptographic Engines and Security Accelerators (CESA) supports the
Multi-Packet Chain Mode. With this mode enabled, multiple tdma requests
can be chained and processed by the hardware without software
intervention. This mode was already activated, however the crypto
requests were not chained together. By doing so, we reduce significantly
the number of IRQs. Instead of being interrupted at the end of each
crypto request, we are interrupted at the end of the last cryptographic
request processed by the engine.

This commits re-factorizes the code, changes the code architecture and
adds the required data structures to chain cryptographic requests
together before sending them to an engine (stopped or possibly already
running).

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Add load balancing between engines
Romain Perier [Tue, 21 Jun 2016 08:08:38 +0000 (10:08 +0200)]
crypto: marvell - Add load balancing between engines

This commits adds support for fine grained load balancing on
multi-engine IPs. The engine is pre-selected based on its current load
and on the weight of the crypto request that is about to be processed.
The global crypto queue is also moved to each engine. These changes are
required to allow chaining crypto requests at the DMA level. By using
a crypto queue per engine, we make sure that we keep the state of the
tdma chain synchronized with the crypto queue. We also reduce contention
on 'cesa_dev->lock' and improve parallelism.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Move SRAM I/O operations to step functions
Romain Perier [Tue, 21 Jun 2016 08:08:37 +0000 (10:08 +0200)]
crypto: marvell - Move SRAM I/O operations to step functions

Currently the crypto requests were sent to engines sequentially.
This commit moves the SRAM I/O operations from the prepare to the step
functions. It provides flexibility for future works and allow to prepare
a request while the engine is running.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Add a complete operation for async requests
Romain Perier [Tue, 21 Jun 2016 08:08:36 +0000 (10:08 +0200)]
crypto: marvell - Add a complete operation for async requests

So far, the 'process' operation was used to check if the current request
was correctly handled by the engine, if it was the case it copied
information from the SRAM to the main memory. Now, we split this
operation. We keep the 'process' operation, which still checks if the
request was correctly handled by the engine or not, then we add a new
operation for completion. The 'complete' method copies the content of
the SRAM to memory. This will soon become useful if we want to call
the process and the complete operations from different locations
depending on the type of the request (different cleanup logic).

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Move tdma chain out of mv_cesa_tdma_req and remove it
Romain Perier [Tue, 21 Jun 2016 08:08:35 +0000 (10:08 +0200)]
crypto: marvell - Move tdma chain out of mv_cesa_tdma_req and remove it

Currently, the only way to access the tdma chain is to use the 'req'
union from a mv_cesa_{ablkcipher,ahash}. This will soon become a problem
if we want to handle the TDMA chaining vs standard/non-DMA processing in
a generic way (with generic functions at the cesa.c level detecting
whether the request should be queued at the DMA level or not). Hence the
decision to move the chain field a the mv_cesa_req level at the expense
of adding 2 void * fields to all request contexts (including non-DMA
ones) and to remove the type completly. To limit the overhead, we get
rid of the type field, which can now be deduced from the req->chain.first
value. Once these changes are done the union is no longer needed, so
remove it and move mv_cesa_ablkcipher_std_req and mv_cesa_req
to mv_cesa_ablkcipher_req directly. There are also no needs to keep the
'base' field into the union of mv_cesa_ahash_req, so move it into the
upper structure.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Copy IV vectors by DMA transfers for acipher requests
Romain Perier [Tue, 21 Jun 2016 08:08:34 +0000 (10:08 +0200)]
crypto: marvell - Copy IV vectors by DMA transfers for acipher requests

Add a TDMA descriptor at the end of the request for copying the
output IV vector via a DMA transfer. This is a good way for offloading
as much as processing as possible to the DMA and the crypto engine.
This is also required for processing multiple cipher requests
in chained mode, otherwise the content of the IV vector would be
overwritten by the last processed request.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Fix wrong type check in dma functions
Romain Perier [Tue, 21 Jun 2016 08:08:33 +0000 (10:08 +0200)]
crypto: marvell - Fix wrong type check in dma functions

So far, the way that the type of a TDMA operation was checked was wrong.
We have to use the type mask in order to get the right part of the flag
containing the type of the operation.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Check engine is not already running when enabling a req
Romain Perier [Tue, 21 Jun 2016 08:08:32 +0000 (10:08 +0200)]
crypto: marvell - Check engine is not already running when enabling a req

Add a BUG_ON() call when the driver tries to launch a crypto request
while the engine is still processing the previous one. This replaces
a silent system hang by a verbose kernel panic with the associated
backtrace to let the user know that something went wrong in the CESA
driver.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: marvell - Add a macro constant for the size of the crypto queue
Romain Perier [Tue, 21 Jun 2016 08:08:31 +0000 (10:08 +0200)]
crypto: marvell - Add a macro constant for the size of the crypto queue

Adding a macro constant to be used for the size of the crypto queue,
instead of using a numeric value directly. It will be easier to
maintain in case we add more than one crypto queue of the same size.

Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: chacha20-simd - Use generic code for small requests
Herbert Xu [Mon, 20 Jun 2016 05:19:17 +0000 (13:19 +0800)]
crypto: chacha20-simd - Use generic code for small requests

On 16-byte requests the optimised version is actually slower than
the generic code, so we should simply use that instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,

8 years agoRevert "crypto: user - no parsing of CRYPTO_MSG_GETALG"
Herbert Xu [Thu, 23 Jun 2016 10:06:02 +0000 (18:06 +0800)]
Revert "crypto: user - no parsing of CRYPTO_MSG_GETALG"

This patch commit eed1e1afd8d542d9644534c1b712599b5d680007 as
it is only a workaround for the real bug and the proper fix has
now been applied as 055ddaace03580455a7b7dbea8e93d62acee61fc
("crypto: user - re-add size check for CRYPTO_MSG_GETALG").

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - fix an error code in drbg_init_sym_kernel()
Dan Carpenter [Fri, 17 Jun 2016 09:16:19 +0000 (12:16 +0300)]
crypto: drbg - fix an error code in drbg_init_sym_kernel()

We accidentally return PTR_ERR(NULL) which is success but we should
return -ENOMEM.

Fixes: 355912852115 ('crypto: drbg - use CTR AES instead of ECB AES')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha3 - Add SHA-3 Test's in tcrypt
raveendra padasalagi [Fri, 17 Jun 2016 05:00:36 +0000 (10:30 +0530)]
crypto: sha3 - Add SHA-3 Test's in tcrypt

Added support for SHA-3 algorithm test's
in tcrypt module and related test vectors.

Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: sha3 - Add SHA-3 hash algorithm
Jeff Garzik [Fri, 17 Jun 2016 05:00:35 +0000 (10:30 +0530)]
crypto: sha3 - Add SHA-3 hash algorithm

This patch adds the implementation of SHA3 algorithm
in software and it's based on original implementation
pushed in patch https://lwn.net/Articles/518415/ with
additional changes to match the padding rules specified
in SHA-3 specification.

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: caam - replace deprecated EXTRA_CFLAGS
Tudor Ambarus [Thu, 16 Jun 2016 13:32:55 +0000 (16:32 +0300)]
crypto: caam - replace deprecated EXTRA_CFLAGS

EXTRA_CFLAGS is still supported but its usage is deprecated.

Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: caam - fix misspelled upper_32_bits
Arnd Bergmann [Thu, 16 Jun 2016 09:05:46 +0000 (11:05 +0200)]
crypto: caam - fix misspelled upper_32_bits

An endianess fix mistakenly used higher_32_bits() instead of
upper_32_bits(), and that doesn't exist:

drivers/crypto/caam/desc_constr.h: In function 'append_ptr':
drivers/crypto/caam/desc_constr.h:84:75: error: implicit declaration of function 'higher_32_bits' [-Werror=implicit-function-declaration]
  *offset = cpu_to_caam_dma(ptr);

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 261ea058f016 ("crypto: caam - handle core endianness != caam endianness")
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: gcm - Filter out async ghash if necessary
Herbert Xu [Wed, 15 Jun 2016 14:27:05 +0000 (22:27 +0800)]
crypto: gcm - Filter out async ghash if necessary

As it is if you ask for a sync gcm you may actually end up with
an async one because it does not filter out async implementations
of ghash.

This patch fixes this by adding the necessary filter when looking
for ghash.

Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - fix semicolon.cocci warnings
Wu Fengguang [Wed, 15 Jun 2016 11:13:25 +0000 (19:13 +0800)]
crypto: drbg - fix semicolon.cocci warnings

crypto/drbg.c:1637:39-40: Unneeded semicolon

 Remove unneeded semicolon.

Generated by: scripts/coccinelle/misc/semicolon.cocci

CC: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: rsa - return raw integers for the ASN.1 parser
Tudor Ambarus [Tue, 14 Jun 2016 13:14:58 +0000 (16:14 +0300)]
crypto: rsa - return raw integers for the ASN.1 parser

Return the raw key with no other processing so that the caller
can copy it or MPI parse it, etc.

The scope is to have only one ANS.1 parser for all RSA
implementations.

Update the RSA software implementation so that it does
the MPI conversion on top.

Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - avoid duplicate maintenance of key
Stephan Mueller [Tue, 14 Jun 2016 05:36:06 +0000 (07:36 +0200)]
crypto: drbg - avoid duplicate maintenance of key

The TFM object maintains the key for the CTR DRBG.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - use full CTR AES for update
Stephan Mueller [Tue, 14 Jun 2016 05:35:37 +0000 (07:35 +0200)]
crypto: drbg - use full CTR AES for update

The CTR DRBG update function performs a full CTR AES operation including
the XOR with "plaintext" data. Hence, remove the XOR from the code and
use the CTR mode to do the XOR.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - use aligned buffers
Stephan Mueller [Tue, 14 Jun 2016 05:35:13 +0000 (07:35 +0200)]
crypto: drbg - use aligned buffers

Hardware cipher implementation may require aligned buffers. All buffers
that potentially are processed with a cipher are now aligned.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: drbg - use CTR AES instead of ECB AES
Stephan Mueller [Tue, 14 Jun 2016 05:34:13 +0000 (07:34 +0200)]
crypto: drbg - use CTR AES instead of ECB AES

The CTR DRBG derives its random data from the CTR that is encrypted with
AES.

This patch now changes the CTR DRBG implementation such that the
CTR AES mode is employed. This allows the use of steamlined CTR AES
implementation such as ctr-aes-aesni.

Unfortunately there are the following subtile changes we need to apply
when using the CTR AES mode:

- the CTR mode increments the counter after the cipher operation, but
  the CTR DRBG requires the increment before the cipher op. Hence, the
  crypto_inc is applied to the counter (drbg->V) once it is
  recalculated.

- the CTR mode wants to encrypt data, but the CTR DRBG is interested in
  the encrypted counter only. The full CTR mode is the XOR of the
  encrypted counter with the plaintext data. To access the encrypted
  counter, the patch uses a NULL data vector as plaintext to be
  "encrypted".

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: meson - Add Amlogic Meson Hardware Random Generator
Neil Armstrong [Fri, 10 Jun 2016 08:21:53 +0000 (10:21 +0200)]
hwrng: meson - Add Amlogic Meson Hardware Random Generator

Add support for the Amlogic Meson SoCs hardware random generator.

Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: exynos - fixup IO accesors
Ben Dooks [Wed, 8 Jun 2016 18:31:09 +0000 (19:31 +0100)]
hwrng: exynos - fixup IO accesors

The __raw IO functions are not endian safe, so use the readl_relaxed
and writel_relaxed versions of these.

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: qat - Remove deprecated create_workqueue
Bhaktipriya Shridhar [Tue, 7 Jun 2016 21:17:47 +0000 (02:47 +0530)]
crypto: qat - Remove deprecated create_workqueue

alloc_workqueue replaces deprecated create_workqueue().

The workqueue device_reset_wq has workitem &reset_data->reset_work per
adf_reset_dev_data. The workqueue  pf2vf_resp_wq is a workqueue for
PF2VF responses has workitem &pf2vf_resp->pf2vf_resp_work per pf2vf_resp.
The workqueue adf_vf_stop_wq is used to call adf_dev_stop()
asynchronously.

Dedicated workqueues have been used in all cases since the workitems
on the workqueues are involved in operation of crypto which can be used in
the IO path which is depended upon during memory reclaim. Hence,
WQ_MEM_RECLAIM has been set to gurantee forward progress under memory
pressure.
Since there are only a fixed number of work items, explicit concurrency
limit is unnecessary.

Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - templates for AEAD using HMAC_SNOOP_NO_AFEU
LEROY Christophe [Mon, 6 Jun 2016 11:20:46 +0000 (13:20 +0200)]
crypto: talitos - templates for AEAD using HMAC_SNOOP_NO_AFEU

This will allow IPSEC on SEC1

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - implement cra_priority
LEROY Christophe [Mon, 6 Jun 2016 11:20:44 +0000 (13:20 +0200)]
crypto: talitos - implement cra_priority

SEC1 doesn't have IPSEC_ESP descriptor type but it is able to perform
IPSEC using HMAC_SNOOP_NO_AFEU, which is also existing on SEC2
In order to be able to define descriptors templates for SEC1 without
breaking SEC2+, we have to give lower priority to HMAC_SNOOP_NO_AFEU
so that SEC2+ selects IPSEC_ESP and not HMAC_SNOOP_NO_AFEU which is
less performant.

This is done by adding a priority field in the template. If the field
is 0, we use the default priority, otherwise we used the one in the
field.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - sg_to_link_tbl() not used anymore, remove it
LEROY Christophe [Mon, 6 Jun 2016 11:20:42 +0000 (13:20 +0200)]
crypto: talitos - sg_to_link_tbl() not used anymore, remove it

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - Implement AEAD for SEC1 using HMAC_SNOOP_NO_AFEU
LEROY Christophe [Mon, 6 Jun 2016 11:20:40 +0000 (13:20 +0200)]
crypto: talitos - Implement AEAD for SEC1 using HMAC_SNOOP_NO_AFEU

This patchs enhances the IPSEC_ESP related functions for them to
also supports the same operations with descriptor type
HMAC_SNOOP_NO_AFEU.

The differences between the two descriptor types are:
* pointeurs 2 and 3 are swaped (Confidentiality key and
    Primary EU Context IN)
* HMAC_SNOOP_NO_AFEU has CICV out in pointer 6
* HMAC_SNOOP_NO_AFEU has no primary EU context out so we get it
from the end of data out

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - making mapping helpers more generic
LEROY Christophe [Mon, 6 Jun 2016 11:20:38 +0000 (13:20 +0200)]
crypto: talitos - making mapping helpers more generic

In preparation of IPSEC for SEC1, first step is to make the mapping
helpers more generic so that they can also be used by AEAD functions.

First, the functions are moved before IPSEC functions in talitos.c

talitos_sg_unmap() and unmap_sg_talitos_ptr() are merged as they
are quite similar, the second one handling the SEC1 case an calling
the first one for SEC2

map_sg_in_talitos_ptr() and map_sg_out_talitos_ptr() are merged
into talitos_sg_map() and enhenced to support offseted zones
as used for AEAD. The actual mapping is now performed outside that
helper. The DMA sync is also done outside to not make it several
times.

talitos_edesc_alloc() size calculation are fixed to also take into
account AEAD specific parts also for SEC1

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - move mapping helpers before IPSEC functions
LEROY Christophe [Mon, 6 Jun 2016 11:20:36 +0000 (13:20 +0200)]
crypto: talitos - move mapping helpers before IPSEC functions

In order to be able to use the mapping/unmapping helpers for IPSEC
it needs to be move upper in the file

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agocrypto: talitos - using helpers for all talitos_ptr operations
LEROY Christophe [Mon, 6 Jun 2016 11:20:34 +0000 (13:20 +0200)]
crypto: talitos - using helpers for all talitos_ptr operations

Use helper for all modifications to talitos_ptr in preparation to
the implementation of AEAD for SEC1

to_talitos_ptr_extent_clear() has been removed in favor of
to_talitos_ptr_ext_set() to set any value and
to_talitos_ptr_ext_or() to or the extent field with a value
name has been shorten to help keeping single lines of 80 chars

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agoarm64: dts: ls1043a: add crypto node
Horia Geantă [Thu, 19 May 2016 15:11:49 +0000 (18:11 +0300)]
arm64: dts: ls1043a: add crypto node

LS1043A has a SEC v5.4 security engine.
For now don't add rtic or sec_mon subnodes, since these features
haven't been tested yet.

Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: chaoskey - Fix URB warning due to timeout on Alea
Bob Ham [Fri, 3 Jun 2016 11:13:08 +0000 (12:13 +0100)]
hwrng: chaoskey - Fix URB warning due to timeout on Alea

The first read on an Alea takes about 1.8 seconds, more than the
timeout value waiting for the read.  As a consequence, later URB reuse
causes the warning given below.  To avoid this, we increase the wait
time for the first read on the Alea.

[   78.293247] WARNING: CPU: 3 PID: 1892 at drivers/usb/core/urb.c:338 usb_submit_urb+0x2b4/0x580 [usbcore]
[   78.293250] URB ffff8802135be3c0 submitted while active
[   78.293252] Modules linked in: chaoskey(+) rng_core rfcomm binfmt_misc bnep cfg80211 nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc bridge stp llc tun snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic iTCO_wdt iTCO_vendor_support nls_utf8 nls_cp437 vfat fat intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel efi_pstore kvm irqbypass pcspkr btusb btrtl btbcm btintel uvcvideo joydev bluetooth videobuf2_vmalloc videobuf2_memops efivars videobuf2_v4l2 serio_raw i2c_i801 videobuf2_core videodev cdc_mbim media lpc_ich shpchp mfd_core cdc_ncm usbnet mii cdc_wdm cdc_acm evdev snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core i915 snd_pcm snd_timer i2c_algo_bit drm_kms_helper wmi thinkpad_acpi drm nvram mei_me mei snd soundcore rfkill ac battery i2c_core
[   78.293335]  video button tpm_tis tpm fuse parport_pc ppdev lp parport autofs4 ext4 crc16 jbd2 mbcache algif_skcipher af_alg hid_generic usbhid hid dm_crypt dm_mod sg sr_mod cdrom sd_mod crct10dif_pclmul crc32_pclmul crc32c_intel jitterentropy_rng sha256_generic hmac drbg aesni_intel xhci_pci aes_x86_64 ahci glue_helper xhci_hcd ehci_pci lrw libahci gf128mul ablk_helper cryptd libata sdhci_pci psmouse sdhci scsi_mod ehci_hcd mmc_core usbcore usb_common thermal
[   78.293402] CPU: 3 PID: 1892 Comm: hwrng Not tainted 4.7.0-rc1-linux-14+ #16
[   78.293405] Hardware name: LENOVO 232577G/232577G, BIOS G2ET92WW (2.52 ) 02/22/2013
[   78.293408]  0000000000000000 ffffffff812dfa0f ffff8801fa5b3d68 0000000000000000
[   78.293413]  ffffffff81072224 ffff8802135be3c0 ffff8801fa5b3db8 ffff880212e44210
[   78.293418]  0000000000000040 ffff880209fb32c0 ffff880212e44200 ffffffff8107228f
[   78.293422] Call Trace:
[   78.293432]  [<ffffffff812dfa0f>] ? dump_stack+0x5c/0x7d
[   78.293437]  [<ffffffff81072224>] ? __warn+0xc4/0xe0
[   78.293441]  [<ffffffff8107228f>] ? warn_slowpath_fmt+0x4f/0x60
[   78.293451]  [<ffffffff810a46a2>] ? enqueue_task_fair+0xcd2/0x1260
[   78.293463]  [<ffffffffa001ec54>] ? usb_submit_urb+0x2b4/0x580 [usbcore]
[   78.293474]  [<ffffffff8140c2e5>] ? __pm_runtime_resume+0x55/0x70
[   78.293484]  [<ffffffffa0825212>] ? _chaoskey_fill+0x132/0x250 [chaoskey]
[   78.293485] usbcore: registered new interface driver chaoskey
[   78.293493]  [<ffffffff810aed50>] ? wait_woken+0x90/0x90
[   78.293500]  [<ffffffffa06448c0>] ? devm_hwrng_register+0x80/0x80 [rng_core]
[   78.293505]  [<ffffffffa0825907>] ? chaoskey_rng_read+0x127/0x140 [chaoskey]
[   78.293511]  [<ffffffffa06448c0>] ? devm_hwrng_register+0x80/0x80 [rng_core]
[   78.293515]  [<ffffffffa064492e>] ? hwrng_fillfn+0x6e/0x120 [rng_core]
[   78.293520]  [<ffffffff8108fb5f>] ? kthread+0xcf/0xf0
[   78.293529]  [<ffffffff81596d5f>] ? ret_from_fork+0x1f/0x40
[   78.293535]  [<ffffffff8108fa90>] ? kthread_park+0x50/0x50

Signed-off-by: Bob Ham <bob.ham@collabora.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
8 years agohwrng: chaoskey - Add support for Araneus Alea I USB RNG
Bob Ham [Fri, 3 Jun 2016 11:13:07 +0000 (12:13 +0100)]
hwrng: chaoskey - Add support for Araneus Alea I USB RNG

Adds support for the Araneus Alea I USB hardware Random Number
Generator which is interfaced with in exactly the same way as the
Altus Metrum ChaosKey.  We just add the appropriate device ID and
modify the config help text.

Signed-off-by: Bob Ham <bob.ham@collabora.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>