xref: /freebsd/sys/crypto/aesni/aesni.c (revision 6ef644f5889afbd0f681b08ed1a2f369524af83e)
1 /*-
2  * Copyright (c) 2005-2008 Pawel Jakub Dawidek <pjd@FreeBSD.org>
3  * Copyright (c) 2010 Konstantin Belousov <kib@FreeBSD.org>
4  * Copyright (c) 2014-2021 The FreeBSD Foundation
5  * Copyright (c) 2017 Conrad Meyer <cem@FreeBSD.org>
6  * All rights reserved.
7  *
8  * Portions of this software were developed by John-Mark Gurney
9  * under sponsorship of the FreeBSD Foundation and
10  * Rubicon Communications, LLC (Netgate).
11  *
12  * Portions of this software were developed by Ararat River
13  * Consulting, LLC under sponsorship of the FreeBSD Foundation.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 #include <sys/param.h>
39 #include <sys/bus.h>
40 #include <sys/kernel.h>
41 #include <sys/kobj.h>
42 #include <sys/libkern.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/module.h>
47 #include <sys/mutex.h>
48 #include <sys/smp.h>
49 #include <sys/systm.h>
50 #include <sys/uio.h>
51 
52 #include <crypto/aesni/aesni.h>
53 #include <crypto/aesni/sha_sse.h>
54 #include <crypto/sha1.h>
55 #include <crypto/sha2/sha224.h>
56 #include <crypto/sha2/sha256.h>
57 
58 #include <opencrypto/cryptodev.h>
59 #include <opencrypto/gmac.h>
60 #include <cryptodev_if.h>
61 
62 #include <machine/md_var.h>
63 #include <machine/specialreg.h>
64 #include <machine/fpu.h>
65 
66 static struct mtx_padalign *ctx_mtx;
67 static struct fpu_kern_ctx **ctx_fpu;
68 
69 struct aesni_softc {
70 	int32_t cid;
71 	bool	has_aes;
72 	bool	has_sha;
73 };
74 
75 #define ACQUIRE_CTX(i, ctx)					\
76 	do {							\
77 		(i) = PCPU_GET(cpuid);				\
78 		mtx_lock(&ctx_mtx[(i)]);			\
79 		(ctx) = ctx_fpu[(i)];				\
80 	} while (0)
81 #define RELEASE_CTX(i, ctx)					\
82 	do {							\
83 		mtx_unlock(&ctx_mtx[(i)]);			\
84 		(i) = -1;					\
85 		(ctx) = NULL;					\
86 	} while (0)
87 
88 static int aesni_cipher_setup(struct aesni_session *ses,
89     const struct crypto_session_params *csp);
90 static int aesni_cipher_process(struct aesni_session *ses, struct cryptop *crp);
91 static int aesni_cipher_crypt(struct aesni_session *ses, struct cryptop *crp,
92     const struct crypto_session_params *csp);
93 static int aesni_cipher_mac(struct aesni_session *ses, struct cryptop *crp,
94     const struct crypto_session_params *csp);
95 
96 MALLOC_DEFINE(M_AESNI, "aesni_data", "AESNI Data");
97 
98 static void
99 aesni_identify(driver_t *drv, device_t parent)
100 {
101 
102 	/* NB: order 10 is so we get attached after h/w devices */
103 	if (device_find_child(parent, "aesni", -1) == NULL &&
104 	    BUS_ADD_CHILD(parent, 10, "aesni", -1) == 0)
105 		panic("aesni: could not attach");
106 }
107 
108 static void
109 detect_cpu_features(bool *has_aes, bool *has_sha)
110 {
111 
112 	*has_aes = ((cpu_feature2 & CPUID2_AESNI) != 0 &&
113 	    (cpu_feature2 & CPUID2_SSE41) != 0);
114 	*has_sha = ((cpu_stdext_feature & CPUID_STDEXT_SHA) != 0 &&
115 	    (cpu_feature2 & CPUID2_SSSE3) != 0);
116 }
117 
118 static int
119 aesni_probe(device_t dev)
120 {
121 	bool has_aes, has_sha;
122 
123 	detect_cpu_features(&has_aes, &has_sha);
124 	if (!has_aes && !has_sha) {
125 		device_printf(dev, "No AES or SHA support.\n");
126 		return (EINVAL);
127 	} else if (has_aes && has_sha)
128 		device_set_desc(dev,
129 		    "AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256");
130 	else if (has_aes)
131 		device_set_desc(dev,
132 		    "AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS");
133 	else
134 		device_set_desc(dev, "SHA1,SHA256");
135 
136 	return (0);
137 }
138 
139 static void
140 aesni_cleanctx(void)
141 {
142 	int i;
143 
144 	/* XXX - no way to return driverid */
145 	CPU_FOREACH(i) {
146 		if (ctx_fpu[i] != NULL) {
147 			mtx_destroy(&ctx_mtx[i]);
148 			fpu_kern_free_ctx(ctx_fpu[i]);
149 		}
150 		ctx_fpu[i] = NULL;
151 	}
152 	free(ctx_mtx, M_AESNI);
153 	ctx_mtx = NULL;
154 	free(ctx_fpu, M_AESNI);
155 	ctx_fpu = NULL;
156 }
157 
158 static int
159 aesni_attach(device_t dev)
160 {
161 	struct aesni_softc *sc;
162 	int i;
163 
164 	sc = device_get_softc(dev);
165 
166 	sc->cid = crypto_get_driverid(dev, sizeof(struct aesni_session),
167 	    CRYPTOCAP_F_SOFTWARE | CRYPTOCAP_F_SYNC |
168 	    CRYPTOCAP_F_ACCEL_SOFTWARE);
169 	if (sc->cid < 0) {
170 		device_printf(dev, "Could not get crypto driver id.\n");
171 		return (ENOMEM);
172 	}
173 
174 	ctx_mtx = malloc(sizeof *ctx_mtx * (mp_maxid + 1), M_AESNI,
175 	    M_WAITOK|M_ZERO);
176 	ctx_fpu = malloc(sizeof *ctx_fpu * (mp_maxid + 1), M_AESNI,
177 	    M_WAITOK|M_ZERO);
178 
179 	CPU_FOREACH(i) {
180 #ifdef __amd64__
181 		ctx_fpu[i] = fpu_kern_alloc_ctx_domain(
182 		    pcpu_find(i)->pc_domain, FPU_KERN_NORMAL);
183 #else
184 		ctx_fpu[i] = fpu_kern_alloc_ctx(FPU_KERN_NORMAL);
185 #endif
186 		mtx_init(&ctx_mtx[i], "anifpumtx", NULL, MTX_DEF|MTX_NEW);
187 	}
188 
189 	detect_cpu_features(&sc->has_aes, &sc->has_sha);
190 	return (0);
191 }
192 
193 static int
194 aesni_detach(device_t dev)
195 {
196 	struct aesni_softc *sc;
197 
198 	sc = device_get_softc(dev);
199 
200 	crypto_unregister_all(sc->cid);
201 
202 	aesni_cleanctx();
203 
204 	return (0);
205 }
206 
207 static bool
208 aesni_auth_supported(struct aesni_softc *sc,
209     const struct crypto_session_params *csp)
210 {
211 
212 	if (!sc->has_sha)
213 		return (false);
214 
215 	switch (csp->csp_auth_alg) {
216 	case CRYPTO_SHA1:
217 	case CRYPTO_SHA2_224:
218 	case CRYPTO_SHA2_256:
219 	case CRYPTO_SHA1_HMAC:
220 	case CRYPTO_SHA2_224_HMAC:
221 	case CRYPTO_SHA2_256_HMAC:
222 		break;
223 	default:
224 		return (false);
225 	}
226 
227 	return (true);
228 }
229 
230 static bool
231 aesni_cipher_supported(struct aesni_softc *sc,
232     const struct crypto_session_params *csp)
233 {
234 
235 	if (!sc->has_aes)
236 		return (false);
237 
238 	switch (csp->csp_cipher_alg) {
239 	case CRYPTO_AES_CBC:
240 	case CRYPTO_AES_ICM:
241 		switch (csp->csp_cipher_klen * 8) {
242 		case 128:
243 		case 192:
244 		case 256:
245 			break;
246 		default:
247 			CRYPTDEB("invalid CBC/ICM key length");
248 			return (false);
249 		}
250 		if (csp->csp_ivlen != AES_BLOCK_LEN)
251 			return (false);
252 		break;
253 	case CRYPTO_AES_XTS:
254 		switch (csp->csp_cipher_klen * 8) {
255 		case 256:
256 		case 512:
257 			break;
258 		default:
259 			CRYPTDEB("invalid XTS key length");
260 			return (false);
261 		}
262 		if (csp->csp_ivlen != AES_XTS_IV_LEN)
263 			return (false);
264 		break;
265 	default:
266 		return (false);
267 	}
268 
269 	return (true);
270 }
271 
272 #define SUPPORTED_SES (CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD | CSP_F_ESN)
273 
274 static int
275 aesni_probesession(device_t dev, const struct crypto_session_params *csp)
276 {
277 	struct aesni_softc *sc;
278 
279 	sc = device_get_softc(dev);
280 	if ((csp->csp_flags & ~(SUPPORTED_SES)) != 0)
281 		return (EINVAL);
282 	switch (csp->csp_mode) {
283 	case CSP_MODE_DIGEST:
284 		if (!aesni_auth_supported(sc, csp))
285 			return (EINVAL);
286 		break;
287 	case CSP_MODE_CIPHER:
288 		if (!aesni_cipher_supported(sc, csp))
289 			return (EINVAL);
290 		break;
291 	case CSP_MODE_AEAD:
292 		switch (csp->csp_cipher_alg) {
293 		case CRYPTO_AES_NIST_GCM_16:
294 			switch (csp->csp_cipher_klen * 8) {
295 			case 128:
296 			case 192:
297 			case 256:
298 				break;
299 			default:
300 				CRYPTDEB("invalid GCM key length");
301 				return (EINVAL);
302 			}
303 			if (csp->csp_auth_mlen != 0 &&
304 			    csp->csp_auth_mlen != GMAC_DIGEST_LEN)
305 				return (EINVAL);
306 			if (!sc->has_aes)
307 				return (EINVAL);
308 			break;
309 		case CRYPTO_AES_CCM_16:
310 			switch (csp->csp_cipher_klen * 8) {
311 			case 128:
312 			case 192:
313 			case 256:
314 				break;
315 			default:
316 				CRYPTDEB("invalid CCM key length");
317 				return (EINVAL);
318 			}
319 			if (!sc->has_aes)
320 				return (EINVAL);
321 			break;
322 		default:
323 			return (EINVAL);
324 		}
325 		break;
326 	case CSP_MODE_ETA:
327 		if (!aesni_auth_supported(sc, csp) ||
328 		    !aesni_cipher_supported(sc, csp))
329 			return (EINVAL);
330 		break;
331 	default:
332 		return (EINVAL);
333 	}
334 
335 	return (CRYPTODEV_PROBE_ACCEL_SOFTWARE);
336 }
337 
338 static int
339 aesni_newsession(device_t dev, crypto_session_t cses,
340     const struct crypto_session_params *csp)
341 {
342 	struct aesni_session *ses;
343 	int error;
344 
345 	ses = crypto_get_driver_session(cses);
346 
347 	switch (csp->csp_mode) {
348 	case CSP_MODE_DIGEST:
349 	case CSP_MODE_CIPHER:
350 	case CSP_MODE_AEAD:
351 	case CSP_MODE_ETA:
352 		break;
353 	default:
354 		return (EINVAL);
355 	}
356 	error = aesni_cipher_setup(ses, csp);
357 	if (error != 0) {
358 		CRYPTDEB("setup failed");
359 		return (error);
360 	}
361 
362 	return (0);
363 }
364 
365 static int
366 aesni_process(device_t dev, struct cryptop *crp, int hint __unused)
367 {
368 	struct aesni_session *ses;
369 	int error;
370 
371 	ses = crypto_get_driver_session(crp->crp_session);
372 
373 	error = aesni_cipher_process(ses, crp);
374 
375 	crp->crp_etype = error;
376 	crypto_done(crp);
377 	return (0);
378 }
379 
380 static uint8_t *
381 aesni_cipher_alloc(struct cryptop *crp, int start, int length, bool *allocated)
382 {
383 	uint8_t *addr;
384 
385 	addr = crypto_contiguous_subsegment(crp, start, length);
386 	if (addr != NULL) {
387 		*allocated = false;
388 		return (addr);
389 	}
390 	addr = malloc(length, M_AESNI, M_NOWAIT);
391 	if (addr != NULL) {
392 		*allocated = true;
393 		crypto_copydata(crp, start, length, addr);
394 	} else
395 		*allocated = false;
396 	return (addr);
397 }
398 
399 static device_method_t aesni_methods[] = {
400 	DEVMETHOD(device_identify, aesni_identify),
401 	DEVMETHOD(device_probe, aesni_probe),
402 	DEVMETHOD(device_attach, aesni_attach),
403 	DEVMETHOD(device_detach, aesni_detach),
404 
405 	DEVMETHOD(cryptodev_probesession, aesni_probesession),
406 	DEVMETHOD(cryptodev_newsession, aesni_newsession),
407 	DEVMETHOD(cryptodev_process, aesni_process),
408 
409 	DEVMETHOD_END
410 };
411 
412 static driver_t aesni_driver = {
413 	"aesni",
414 	aesni_methods,
415 	sizeof(struct aesni_softc),
416 };
417 
418 DRIVER_MODULE(aesni, nexus, aesni_driver, 0, 0);
419 MODULE_VERSION(aesni, 1);
420 MODULE_DEPEND(aesni, crypto, 1, 1, 1);
421 
422 static int
423 intel_sha1_update(void *vctx, const void *vdata, u_int datalen)
424 {
425 	struct sha1_ctxt *ctx = vctx;
426 	const char *data = vdata;
427 	size_t gaplen;
428 	size_t gapstart;
429 	size_t off;
430 	size_t copysiz;
431 	u_int blocks;
432 
433 	off = 0;
434 	/* Do any aligned blocks without redundant copying. */
435 	if (datalen >= 64 && ctx->count % 64 == 0) {
436 		blocks = datalen / 64;
437 		ctx->c.b64[0] += blocks * 64 * 8;
438 		intel_sha1_step(ctx->h.b32, data + off, blocks);
439 		off += blocks * 64;
440 	}
441 
442 	while (off < datalen) {
443 		gapstart = ctx->count % 64;
444 		gaplen = 64 - gapstart;
445 
446 		copysiz = (gaplen < datalen - off) ? gaplen : datalen - off;
447 		bcopy(&data[off], &ctx->m.b8[gapstart], copysiz);
448 		ctx->count += copysiz;
449 		ctx->count %= 64;
450 		ctx->c.b64[0] += copysiz * 8;
451 		if (ctx->count % 64 == 0)
452 			intel_sha1_step(ctx->h.b32, (void *)ctx->m.b8, 1);
453 		off += copysiz;
454 	}
455 
456 	return (0);
457 }
458 
459 static void
460 SHA1_Init_fn(void *ctx)
461 {
462 	sha1_init(ctx);
463 }
464 
465 static void
466 SHA1_Finalize_fn(void *digest, void *ctx)
467 {
468 	sha1_result(ctx, digest);
469 }
470 
471 static int
472 intel_sha256_update(void *vctx, const void *vdata, u_int len)
473 {
474 	SHA256_CTX *ctx = vctx;
475 	uint64_t bitlen;
476 	uint32_t r;
477 	u_int blocks;
478 	const unsigned char *src = vdata;
479 
480 	/* Number of bytes left in the buffer from previous updates */
481 	r = (ctx->count >> 3) & 0x3f;
482 
483 	/* Convert the length into a number of bits */
484 	bitlen = len << 3;
485 
486 	/* Update number of bits */
487 	ctx->count += bitlen;
488 
489 	/* Handle the case where we don't need to perform any transforms */
490 	if (len < 64 - r) {
491 		memcpy(&ctx->buf[r], src, len);
492 		return (0);
493 	}
494 
495 	/* Finish the current block */
496 	memcpy(&ctx->buf[r], src, 64 - r);
497 	intel_sha256_step(ctx->state, ctx->buf, 1);
498 	src += 64 - r;
499 	len -= 64 - r;
500 
501 	/* Perform complete blocks */
502 	if (len >= 64) {
503 		blocks = len / 64;
504 		intel_sha256_step(ctx->state, src, blocks);
505 		src += blocks * 64;
506 		len -= blocks * 64;
507 	}
508 
509 	/* Copy left over data into buffer */
510 	memcpy(ctx->buf, src, len);
511 
512 	return (0);
513 }
514 
515 static void
516 SHA224_Init_fn(void *ctx)
517 {
518 	SHA224_Init(ctx);
519 }
520 
521 static void
522 SHA224_Finalize_fn(void *digest, void *ctx)
523 {
524 	SHA224_Final(digest, ctx);
525 }
526 
527 static void
528 SHA256_Init_fn(void *ctx)
529 {
530 	SHA256_Init(ctx);
531 }
532 
533 static void
534 SHA256_Finalize_fn(void *digest, void *ctx)
535 {
536 	SHA256_Final(digest, ctx);
537 }
538 
539 static int
540 aesni_authprepare(struct aesni_session *ses, int klen)
541 {
542 
543 	if (klen > SHA1_BLOCK_LEN)
544 		return (EINVAL);
545 	if ((ses->hmac && klen == 0) || (!ses->hmac && klen != 0))
546 		return (EINVAL);
547 	return (0);
548 }
549 
550 static int
551 aesni_cipher_setup(struct aesni_session *ses,
552     const struct crypto_session_params *csp)
553 {
554 	struct fpu_kern_ctx *ctx;
555 	uint8_t *schedbase;
556 	int kt, ctxidx, error;
557 
558 	schedbase = (uint8_t *)roundup2((uintptr_t)ses->schedules,
559 	    AES_SCHED_ALIGN);
560 	ses->enc_schedule = schedbase;
561 	ses->dec_schedule = schedbase + AES_SCHED_LEN;
562 	ses->xts_schedule = schedbase + AES_SCHED_LEN * 2;
563 
564 	switch (csp->csp_auth_alg) {
565 	case CRYPTO_SHA1_HMAC:
566 		ses->hmac = true;
567 		/* FALLTHROUGH */
568 	case CRYPTO_SHA1:
569 		ses->hash_len = SHA1_HASH_LEN;
570 		ses->hash_init = SHA1_Init_fn;
571 		ses->hash_update = intel_sha1_update;
572 		ses->hash_finalize = SHA1_Finalize_fn;
573 		break;
574 	case CRYPTO_SHA2_224_HMAC:
575 		ses->hmac = true;
576 		/* FALLTHROUGH */
577 	case CRYPTO_SHA2_224:
578 		ses->hash_len = SHA2_224_HASH_LEN;
579 		ses->hash_init = SHA224_Init_fn;
580 		ses->hash_update = intel_sha256_update;
581 		ses->hash_finalize = SHA224_Finalize_fn;
582 		break;
583 	case CRYPTO_SHA2_256_HMAC:
584 		ses->hmac = true;
585 		/* FALLTHROUGH */
586 	case CRYPTO_SHA2_256:
587 		ses->hash_len = SHA2_256_HASH_LEN;
588 		ses->hash_init = SHA256_Init_fn;
589 		ses->hash_update = intel_sha256_update;
590 		ses->hash_finalize = SHA256_Finalize_fn;
591 		break;
592 	}
593 
594 	if (ses->hash_len != 0) {
595 		if (csp->csp_auth_mlen == 0)
596 			ses->mlen = ses->hash_len;
597 		else
598 			ses->mlen = csp->csp_auth_mlen;
599 
600 		error = aesni_authprepare(ses, csp->csp_auth_klen);
601 		if (error != 0)
602 			return (error);
603 	} else if (csp->csp_cipher_alg == CRYPTO_AES_CCM_16) {
604 		if (csp->csp_auth_mlen == 0)
605 			ses->mlen = AES_CBC_MAC_HASH_LEN;
606 		else
607 			ses->mlen = csp->csp_auth_mlen;
608 	}
609 
610 	kt = is_fpu_kern_thread(0) || (csp->csp_cipher_alg == 0);
611 	if (!kt) {
612 		ACQUIRE_CTX(ctxidx, ctx);
613 		fpu_kern_enter(curthread, ctx,
614 		    FPU_KERN_NORMAL | FPU_KERN_KTHR);
615 	}
616 
617 	error = 0;
618 	if (csp->csp_cipher_key != NULL)
619 		aesni_cipher_setup_common(ses, csp, csp->csp_cipher_key,
620 		    csp->csp_cipher_klen);
621 
622 	if (!kt) {
623 		fpu_kern_leave(curthread, ctx);
624 		RELEASE_CTX(ctxidx, ctx);
625 	}
626 	return (error);
627 }
628 
629 static int
630 aesni_cipher_process(struct aesni_session *ses, struct cryptop *crp)
631 {
632 	const struct crypto_session_params *csp;
633 	struct fpu_kern_ctx *ctx;
634 	int error, ctxidx;
635 	bool kt;
636 
637 	csp = crypto_get_params(crp->crp_session);
638 	switch (csp->csp_cipher_alg) {
639 	case CRYPTO_AES_CCM_16:
640 		if (crp->crp_payload_length > ccm_max_payload_length(csp))
641 			return (EMSGSIZE);
642 		/* FALLTHROUGH */
643 	case CRYPTO_AES_ICM:
644 	case CRYPTO_AES_NIST_GCM_16:
645 		if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
646 			return (EINVAL);
647 		break;
648 	case CRYPTO_AES_CBC:
649 	case CRYPTO_AES_XTS:
650 		/* CBC & XTS can only handle full blocks for now */
651 		if ((crp->crp_payload_length % AES_BLOCK_LEN) != 0)
652 			return (EINVAL);
653 		break;
654 	}
655 
656 	ctx = NULL;
657 	ctxidx = 0;
658 	error = 0;
659 	kt = is_fpu_kern_thread(0);
660 	if (!kt) {
661 		ACQUIRE_CTX(ctxidx, ctx);
662 		fpu_kern_enter(curthread, ctx,
663 		    FPU_KERN_NORMAL | FPU_KERN_KTHR);
664 	}
665 
666 	/* Do work */
667 	if (csp->csp_mode == CSP_MODE_ETA) {
668 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
669 			error = aesni_cipher_crypt(ses, crp, csp);
670 			if (error == 0)
671 				error = aesni_cipher_mac(ses, crp, csp);
672 		} else {
673 			error = aesni_cipher_mac(ses, crp, csp);
674 			if (error == 0)
675 				error = aesni_cipher_crypt(ses, crp, csp);
676 		}
677 	} else if (csp->csp_mode == CSP_MODE_DIGEST)
678 		error = aesni_cipher_mac(ses, crp, csp);
679 	else
680 		error = aesni_cipher_crypt(ses, crp, csp);
681 
682 	if (!kt) {
683 		fpu_kern_leave(curthread, ctx);
684 		RELEASE_CTX(ctxidx, ctx);
685 	}
686 	return (error);
687 }
688 
689 static int
690 aesni_cipher_crypt(struct aesni_session *ses, struct cryptop *crp,
691     const struct crypto_session_params *csp)
692 {
693 	uint8_t iv[AES_BLOCK_LEN], tag[GMAC_DIGEST_LEN];
694 	uint8_t *authbuf, *buf, *outbuf;
695 	int error;
696 	bool encflag, allocated, authallocated, outallocated, outcopy;
697 
698 	if (crp->crp_payload_length == 0) {
699 		buf = NULL;
700 		allocated = false;
701 	} else {
702 		buf = aesni_cipher_alloc(crp, crp->crp_payload_start,
703 		    crp->crp_payload_length, &allocated);
704 		if (buf == NULL)
705 			return (ENOMEM);
706 	}
707 
708 	outallocated = false;
709 	authallocated = false;
710 	authbuf = NULL;
711 	if (csp->csp_cipher_alg == CRYPTO_AES_NIST_GCM_16 ||
712 	    csp->csp_cipher_alg == CRYPTO_AES_CCM_16) {
713 		if (crp->crp_aad_length == 0) {
714 			authbuf = NULL;
715 		} else if (crp->crp_aad != NULL) {
716 			authbuf = crp->crp_aad;
717 		} else {
718 			authbuf = aesni_cipher_alloc(crp, crp->crp_aad_start,
719 			    crp->crp_aad_length, &authallocated);
720 			if (authbuf == NULL) {
721 				error = ENOMEM;
722 				goto out;
723 			}
724 		}
725 	}
726 
727 	if (CRYPTO_HAS_OUTPUT_BUFFER(crp) && crp->crp_payload_length > 0) {
728 		outbuf = crypto_buffer_contiguous_subsegment(&crp->crp_obuf,
729 		    crp->crp_payload_output_start, crp->crp_payload_length);
730 		if (outbuf == NULL) {
731 			outcopy = true;
732 			if (allocated)
733 				outbuf = buf;
734 			else {
735 				outbuf = malloc(crp->crp_payload_length,
736 				    M_AESNI, M_NOWAIT);
737 				if (outbuf == NULL) {
738 					error = ENOMEM;
739 					goto out;
740 				}
741 				outallocated = true;
742 			}
743 		} else
744 			outcopy = false;
745 	} else {
746 		outbuf = buf;
747 		outcopy = allocated;
748 	}
749 
750 	error = 0;
751 	encflag = CRYPTO_OP_IS_ENCRYPT(crp->crp_op);
752 	if (crp->crp_cipher_key != NULL)
753 		aesni_cipher_setup_common(ses, csp, crp->crp_cipher_key,
754 		    csp->csp_cipher_klen);
755 
756 	crypto_read_iv(crp, iv);
757 
758 	switch (csp->csp_cipher_alg) {
759 	case CRYPTO_AES_CBC:
760 		if (encflag)
761 			aesni_encrypt_cbc(ses->rounds, ses->enc_schedule,
762 			    crp->crp_payload_length, buf, outbuf, iv);
763 		else {
764 			if (buf != outbuf)
765 				memcpy(outbuf, buf, crp->crp_payload_length);
766 			aesni_decrypt_cbc(ses->rounds, ses->dec_schedule,
767 			    crp->crp_payload_length, outbuf, iv);
768 		}
769 		break;
770 	case CRYPTO_AES_ICM:
771 		/* encryption & decryption are the same */
772 		aesni_encrypt_icm(ses->rounds, ses->enc_schedule,
773 		    crp->crp_payload_length, buf, outbuf, iv);
774 		break;
775 	case CRYPTO_AES_XTS:
776 		if (encflag)
777 			aesni_encrypt_xts(ses->rounds, ses->enc_schedule,
778 			    ses->xts_schedule, crp->crp_payload_length, buf,
779 			    outbuf, iv);
780 		else
781 			aesni_decrypt_xts(ses->rounds, ses->dec_schedule,
782 			    ses->xts_schedule, crp->crp_payload_length, buf,
783 			    outbuf, iv);
784 		break;
785 	case CRYPTO_AES_NIST_GCM_16:
786 		if (encflag) {
787 			memset(tag, 0, sizeof(tag));
788 			AES_GCM_encrypt(buf, outbuf, authbuf, iv, tag,
789 			    crp->crp_payload_length, crp->crp_aad_length,
790 			    csp->csp_ivlen, ses->enc_schedule, ses->rounds);
791 			crypto_copyback(crp, crp->crp_digest_start, sizeof(tag),
792 			    tag);
793 		} else {
794 			crypto_copydata(crp, crp->crp_digest_start, sizeof(tag),
795 			    tag);
796 			if (!AES_GCM_decrypt(buf, outbuf, authbuf, iv, tag,
797 			    crp->crp_payload_length, crp->crp_aad_length,
798 			    csp->csp_ivlen, ses->enc_schedule, ses->rounds))
799 				error = EBADMSG;
800 		}
801 		break;
802 	case CRYPTO_AES_CCM_16:
803 		if (encflag) {
804 			memset(tag, 0, sizeof(tag));
805 			AES_CCM_encrypt(buf, outbuf, authbuf, iv, tag,
806 			    crp->crp_payload_length, crp->crp_aad_length,
807 			    csp->csp_ivlen, ses->mlen, ses->enc_schedule,
808 			    ses->rounds);
809 			crypto_copyback(crp, crp->crp_digest_start, ses->mlen,
810 			    tag);
811 		} else {
812 			crypto_copydata(crp, crp->crp_digest_start, ses->mlen,
813 			    tag);
814 			if (!AES_CCM_decrypt(buf, outbuf, authbuf, iv, tag,
815 			    crp->crp_payload_length, crp->crp_aad_length,
816 			    csp->csp_ivlen, ses->mlen, ses->enc_schedule,
817 			    ses->rounds))
818 				error = EBADMSG;
819 		}
820 		break;
821 	}
822 	if (outcopy && error == 0)
823 		crypto_copyback(crp, CRYPTO_HAS_OUTPUT_BUFFER(crp) ?
824 		    crp->crp_payload_output_start : crp->crp_payload_start,
825 		    crp->crp_payload_length, outbuf);
826 
827 out:
828 	if (allocated)
829 		zfree(buf, M_AESNI);
830 	if (authallocated)
831 		zfree(authbuf, M_AESNI);
832 	if (outallocated)
833 		zfree(outbuf, M_AESNI);
834 	explicit_bzero(iv, sizeof(iv));
835 	explicit_bzero(tag, sizeof(tag));
836 	return (error);
837 }
838 
839 static int
840 aesni_cipher_mac(struct aesni_session *ses, struct cryptop *crp,
841     const struct crypto_session_params *csp)
842 {
843 	union {
844 		struct SHA256Context sha2 __aligned(16);
845 		struct sha1_ctxt sha1 __aligned(16);
846 	} sctx;
847 	uint32_t res[SHA2_256_HASH_LEN / sizeof(uint32_t)];
848 	const uint8_t *key;
849 	int i, keylen;
850 
851 	if (crp->crp_auth_key != NULL)
852 		key = crp->crp_auth_key;
853 	else
854 		key = csp->csp_auth_key;
855 	keylen = csp->csp_auth_klen;
856 
857 	if (ses->hmac) {
858 		uint8_t hmac_key[SHA1_BLOCK_LEN] __aligned(16);
859 
860 		/* Inner hash: (K ^ IPAD) || data */
861 		ses->hash_init(&sctx);
862 		for (i = 0; i < keylen; i++)
863 			hmac_key[i] = key[i] ^ HMAC_IPAD_VAL;
864 		for (i = keylen; i < sizeof(hmac_key); i++)
865 			hmac_key[i] = 0 ^ HMAC_IPAD_VAL;
866 		ses->hash_update(&sctx, hmac_key, sizeof(hmac_key));
867 
868 		if (crp->crp_aad != NULL)
869 			ses->hash_update(&sctx, crp->crp_aad,
870 			    crp->crp_aad_length);
871 		else
872 			crypto_apply(crp, crp->crp_aad_start,
873 			    crp->crp_aad_length, ses->hash_update, &sctx);
874 		if (CRYPTO_HAS_OUTPUT_BUFFER(crp) &&
875 		    CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
876 			crypto_apply_buf(&crp->crp_obuf,
877 			    crp->crp_payload_output_start,
878 			    crp->crp_payload_length,
879 			    ses->hash_update, &sctx);
880 		else
881 			crypto_apply(crp, crp->crp_payload_start,
882 			    crp->crp_payload_length, ses->hash_update, &sctx);
883 
884 		if (csp->csp_flags & CSP_F_ESN)
885 			ses->hash_update(&sctx, crp->crp_esn, 4);
886 
887 		ses->hash_finalize(res, &sctx);
888 
889 		/* Outer hash: (K ^ OPAD) || inner hash */
890 		ses->hash_init(&sctx);
891 		for (i = 0; i < keylen; i++)
892 			hmac_key[i] = key[i] ^ HMAC_OPAD_VAL;
893 		for (i = keylen; i < sizeof(hmac_key); i++)
894 			hmac_key[i] = 0 ^ HMAC_OPAD_VAL;
895 		ses->hash_update(&sctx, hmac_key, sizeof(hmac_key));
896 		ses->hash_update(&sctx, res, ses->hash_len);
897 		ses->hash_finalize(res, &sctx);
898 		explicit_bzero(hmac_key, sizeof(hmac_key));
899 	} else {
900 		ses->hash_init(&sctx);
901 
902 		if (crp->crp_aad != NULL)
903 			ses->hash_update(&sctx, crp->crp_aad,
904 			    crp->crp_aad_length);
905 		else
906 			crypto_apply(crp, crp->crp_aad_start,
907 			    crp->crp_aad_length, ses->hash_update, &sctx);
908 		if (CRYPTO_HAS_OUTPUT_BUFFER(crp) &&
909 		    CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
910 			crypto_apply_buf(&crp->crp_obuf,
911 			    crp->crp_payload_output_start,
912 			    crp->crp_payload_length,
913 			    ses->hash_update, &sctx);
914 		else
915 			crypto_apply(crp, crp->crp_payload_start,
916 			    crp->crp_payload_length,
917 			    ses->hash_update, &sctx);
918 
919 		ses->hash_finalize(res, &sctx);
920 	}
921 
922 	if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST) {
923 		uint32_t res2[SHA2_256_HASH_LEN / sizeof(uint32_t)];
924 
925 		crypto_copydata(crp, crp->crp_digest_start, ses->mlen, res2);
926 		if (timingsafe_bcmp(res, res2, ses->mlen) != 0)
927 			return (EBADMSG);
928 		explicit_bzero(res2, sizeof(res2));
929 	} else
930 		crypto_copyback(crp, crp->crp_digest_start, ses->mlen, res);
931 	explicit_bzero(res, sizeof(res));
932 	return (0);
933 }
934