1*2874c5fdSThomas Gleixner/* SPDX-License-Identifier: GPL-2.0-or-later */ 2f98992afSMarkus Stockhausen/* 3f98992afSMarkus Stockhausen * Key handling functions for PPC AES implementation 4f98992afSMarkus Stockhausen * 5f98992afSMarkus Stockhausen * Copyright (c) 2015 Markus Stockhausen <stockhausen@collogia.de> 6f98992afSMarkus Stockhausen */ 7f98992afSMarkus Stockhausen 8f98992afSMarkus Stockhausen#include <asm/ppc_asm.h> 9f98992afSMarkus Stockhausen 10f98992afSMarkus Stockhausen#ifdef __BIG_ENDIAN__ 11f98992afSMarkus Stockhausen#define LOAD_KEY(d, s, off) \ 12f98992afSMarkus Stockhausen lwz d,off(s); 13f98992afSMarkus Stockhausen#else 14f98992afSMarkus Stockhausen#define LOAD_KEY(d, s, off) \ 15f98992afSMarkus Stockhausen li r0,off; \ 16f98992afSMarkus Stockhausen lwbrx d,s,r0; 17f98992afSMarkus Stockhausen#endif 18f98992afSMarkus Stockhausen 19f98992afSMarkus Stockhausen#define INITIALIZE_KEY \ 20f98992afSMarkus Stockhausen stwu r1,-32(r1); /* create stack frame */ \ 21f98992afSMarkus Stockhausen stw r14,8(r1); /* save registers */ \ 22f98992afSMarkus Stockhausen stw r15,12(r1); \ 23f98992afSMarkus Stockhausen stw r16,16(r1); 24f98992afSMarkus Stockhausen 25f98992afSMarkus Stockhausen#define FINALIZE_KEY \ 26f98992afSMarkus Stockhausen lwz r14,8(r1); /* restore registers */ \ 27f98992afSMarkus Stockhausen lwz r15,12(r1); \ 28f98992afSMarkus Stockhausen lwz r16,16(r1); \ 29f98992afSMarkus Stockhausen xor r5,r5,r5; /* clear sensitive data */ \ 30f98992afSMarkus Stockhausen xor r6,r6,r6; \ 31f98992afSMarkus Stockhausen xor r7,r7,r7; \ 32f98992afSMarkus Stockhausen xor r8,r8,r8; \ 33f98992afSMarkus Stockhausen xor r9,r9,r9; \ 34f98992afSMarkus Stockhausen xor r10,r10,r10; \ 35f98992afSMarkus Stockhausen xor r11,r11,r11; \ 36f98992afSMarkus Stockhausen xor r12,r12,r12; \ 37f98992afSMarkus Stockhausen addi r1,r1,32; /* cleanup stack */ 38f98992afSMarkus Stockhausen 39f98992afSMarkus Stockhausen#define LS_BOX(r, t1, t2) \ 40f98992afSMarkus Stockhausen lis t2,PPC_AES_4K_ENCTAB@h; \ 41f98992afSMarkus Stockhausen ori t2,t2,PPC_AES_4K_ENCTAB@l; \ 42f98992afSMarkus Stockhausen rlwimi t2,r,4,20,27; \ 43f98992afSMarkus Stockhausen lbz t1,8(t2); \ 44f98992afSMarkus Stockhausen rlwimi r,t1,0,24,31; \ 45f98992afSMarkus Stockhausen rlwimi t2,r,28,20,27; \ 46f98992afSMarkus Stockhausen lbz t1,8(t2); \ 47f98992afSMarkus Stockhausen rlwimi r,t1,8,16,23; \ 48f98992afSMarkus Stockhausen rlwimi t2,r,20,20,27; \ 49f98992afSMarkus Stockhausen lbz t1,8(t2); \ 50f98992afSMarkus Stockhausen rlwimi r,t1,16,8,15; \ 51f98992afSMarkus Stockhausen rlwimi t2,r,12,20,27; \ 52f98992afSMarkus Stockhausen lbz t1,8(t2); \ 53f98992afSMarkus Stockhausen rlwimi r,t1,24,0,7; 54f98992afSMarkus Stockhausen 55f98992afSMarkus Stockhausen#define GF8_MUL(out, in, t1, t2) \ 56f98992afSMarkus Stockhausen lis t1,0x8080; /* multiplication in GF8 */ \ 57f98992afSMarkus Stockhausen ori t1,t1,0x8080; \ 58f98992afSMarkus Stockhausen and t1,t1,in; \ 59f98992afSMarkus Stockhausen srwi t1,t1,7; \ 60f98992afSMarkus Stockhausen mulli t1,t1,0x1b; \ 61f98992afSMarkus Stockhausen lis t2,0x7f7f; \ 62f98992afSMarkus Stockhausen ori t2,t2,0x7f7f; \ 63f98992afSMarkus Stockhausen and t2,t2,in; \ 64f98992afSMarkus Stockhausen slwi t2,t2,1; \ 65f98992afSMarkus Stockhausen xor out,t1,t2; 66f98992afSMarkus Stockhausen 67f98992afSMarkus Stockhausen/* 68f98992afSMarkus Stockhausen * ppc_expand_key_128(u32 *key_enc, const u8 *key) 69f98992afSMarkus Stockhausen * 70f98992afSMarkus Stockhausen * Expand 128 bit key into 176 bytes encryption key. It consists of 71f98992afSMarkus Stockhausen * key itself plus 10 rounds with 16 bytes each 72f98992afSMarkus Stockhausen * 73f98992afSMarkus Stockhausen */ 74f98992afSMarkus Stockhausen_GLOBAL(ppc_expand_key_128) 75f98992afSMarkus Stockhausen INITIALIZE_KEY 76f98992afSMarkus Stockhausen LOAD_KEY(r5,r4,0) 77f98992afSMarkus Stockhausen LOAD_KEY(r6,r4,4) 78f98992afSMarkus Stockhausen LOAD_KEY(r7,r4,8) 79f98992afSMarkus Stockhausen LOAD_KEY(r8,r4,12) 80f98992afSMarkus Stockhausen stw r5,0(r3) /* key[0..3] = input data */ 81f98992afSMarkus Stockhausen stw r6,4(r3) 82f98992afSMarkus Stockhausen stw r7,8(r3) 83f98992afSMarkus Stockhausen stw r8,12(r3) 84f98992afSMarkus Stockhausen li r16,10 /* 10 expansion rounds */ 85f98992afSMarkus Stockhausen lis r0,0x0100 /* RCO(1) */ 86f98992afSMarkus Stockhausenppc_expand_128_loop: 87f98992afSMarkus Stockhausen addi r3,r3,16 88f98992afSMarkus Stockhausen mr r14,r8 /* apply LS_BOX to 4th temp */ 89f98992afSMarkus Stockhausen rotlwi r14,r14,8 90f98992afSMarkus Stockhausen LS_BOX(r14, r15, r4) 91f98992afSMarkus Stockhausen xor r14,r14,r0 92f98992afSMarkus Stockhausen xor r5,r5,r14 /* xor next 4 keys */ 93f98992afSMarkus Stockhausen xor r6,r6,r5 94f98992afSMarkus Stockhausen xor r7,r7,r6 95f98992afSMarkus Stockhausen xor r8,r8,r7 96f98992afSMarkus Stockhausen stw r5,0(r3) /* store next 4 keys */ 97f98992afSMarkus Stockhausen stw r6,4(r3) 98f98992afSMarkus Stockhausen stw r7,8(r3) 99f98992afSMarkus Stockhausen stw r8,12(r3) 100f98992afSMarkus Stockhausen GF8_MUL(r0, r0, r4, r14) /* multiply RCO by 2 in GF */ 101f98992afSMarkus Stockhausen subi r16,r16,1 102f98992afSMarkus Stockhausen cmpwi r16,0 103f98992afSMarkus Stockhausen bt eq,ppc_expand_128_end 104f98992afSMarkus Stockhausen b ppc_expand_128_loop 105f98992afSMarkus Stockhausenppc_expand_128_end: 106f98992afSMarkus Stockhausen FINALIZE_KEY 107f98992afSMarkus Stockhausen blr 108f98992afSMarkus Stockhausen 109f98992afSMarkus Stockhausen/* 110f98992afSMarkus Stockhausen * ppc_expand_key_192(u32 *key_enc, const u8 *key) 111f98992afSMarkus Stockhausen * 112f98992afSMarkus Stockhausen * Expand 192 bit key into 208 bytes encryption key. It consists of key 113f98992afSMarkus Stockhausen * itself plus 12 rounds with 16 bytes each 114f98992afSMarkus Stockhausen * 115f98992afSMarkus Stockhausen */ 116f98992afSMarkus Stockhausen_GLOBAL(ppc_expand_key_192) 117f98992afSMarkus Stockhausen INITIALIZE_KEY 118f98992afSMarkus Stockhausen LOAD_KEY(r5,r4,0) 119f98992afSMarkus Stockhausen LOAD_KEY(r6,r4,4) 120f98992afSMarkus Stockhausen LOAD_KEY(r7,r4,8) 121f98992afSMarkus Stockhausen LOAD_KEY(r8,r4,12) 122f98992afSMarkus Stockhausen LOAD_KEY(r9,r4,16) 123f98992afSMarkus Stockhausen LOAD_KEY(r10,r4,20) 124f98992afSMarkus Stockhausen stw r5,0(r3) 125f98992afSMarkus Stockhausen stw r6,4(r3) 126f98992afSMarkus Stockhausen stw r7,8(r3) 127f98992afSMarkus Stockhausen stw r8,12(r3) 128f98992afSMarkus Stockhausen stw r9,16(r3) 129f98992afSMarkus Stockhausen stw r10,20(r3) 130f98992afSMarkus Stockhausen li r16,8 /* 8 expansion rounds */ 131f98992afSMarkus Stockhausen lis r0,0x0100 /* RCO(1) */ 132f98992afSMarkus Stockhausenppc_expand_192_loop: 133f98992afSMarkus Stockhausen addi r3,r3,24 134f98992afSMarkus Stockhausen mr r14,r10 /* apply LS_BOX to 6th temp */ 135f98992afSMarkus Stockhausen rotlwi r14,r14,8 136f98992afSMarkus Stockhausen LS_BOX(r14, r15, r4) 137f98992afSMarkus Stockhausen xor r14,r14,r0 138f98992afSMarkus Stockhausen xor r5,r5,r14 /* xor next 6 keys */ 139f98992afSMarkus Stockhausen xor r6,r6,r5 140f98992afSMarkus Stockhausen xor r7,r7,r6 141f98992afSMarkus Stockhausen xor r8,r8,r7 142f98992afSMarkus Stockhausen xor r9,r9,r8 143f98992afSMarkus Stockhausen xor r10,r10,r9 144f98992afSMarkus Stockhausen stw r5,0(r3) 145f98992afSMarkus Stockhausen stw r6,4(r3) 146f98992afSMarkus Stockhausen stw r7,8(r3) 147f98992afSMarkus Stockhausen stw r8,12(r3) 148f98992afSMarkus Stockhausen subi r16,r16,1 149f98992afSMarkus Stockhausen cmpwi r16,0 /* last round early kick out */ 150f98992afSMarkus Stockhausen bt eq,ppc_expand_192_end 151f98992afSMarkus Stockhausen stw r9,16(r3) 152f98992afSMarkus Stockhausen stw r10,20(r3) 153f98992afSMarkus Stockhausen GF8_MUL(r0, r0, r4, r14) /* multiply RCO GF8 */ 154f98992afSMarkus Stockhausen b ppc_expand_192_loop 155f98992afSMarkus Stockhausenppc_expand_192_end: 156f98992afSMarkus Stockhausen FINALIZE_KEY 157f98992afSMarkus Stockhausen blr 158f98992afSMarkus Stockhausen 159f98992afSMarkus Stockhausen/* 160f98992afSMarkus Stockhausen * ppc_expand_key_256(u32 *key_enc, const u8 *key) 161f98992afSMarkus Stockhausen * 162f98992afSMarkus Stockhausen * Expand 256 bit key into 240 bytes encryption key. It consists of key 163f98992afSMarkus Stockhausen * itself plus 14 rounds with 16 bytes each 164f98992afSMarkus Stockhausen * 165f98992afSMarkus Stockhausen */ 166f98992afSMarkus Stockhausen_GLOBAL(ppc_expand_key_256) 167f98992afSMarkus Stockhausen INITIALIZE_KEY 168f98992afSMarkus Stockhausen LOAD_KEY(r5,r4,0) 169f98992afSMarkus Stockhausen LOAD_KEY(r6,r4,4) 170f98992afSMarkus Stockhausen LOAD_KEY(r7,r4,8) 171f98992afSMarkus Stockhausen LOAD_KEY(r8,r4,12) 172f98992afSMarkus Stockhausen LOAD_KEY(r9,r4,16) 173f98992afSMarkus Stockhausen LOAD_KEY(r10,r4,20) 174f98992afSMarkus Stockhausen LOAD_KEY(r11,r4,24) 175f98992afSMarkus Stockhausen LOAD_KEY(r12,r4,28) 176f98992afSMarkus Stockhausen stw r5,0(r3) 177f98992afSMarkus Stockhausen stw r6,4(r3) 178f98992afSMarkus Stockhausen stw r7,8(r3) 179f98992afSMarkus Stockhausen stw r8,12(r3) 180f98992afSMarkus Stockhausen stw r9,16(r3) 181f98992afSMarkus Stockhausen stw r10,20(r3) 182f98992afSMarkus Stockhausen stw r11,24(r3) 183f98992afSMarkus Stockhausen stw r12,28(r3) 184f98992afSMarkus Stockhausen li r16,7 /* 7 expansion rounds */ 185f98992afSMarkus Stockhausen lis r0,0x0100 /* RCO(1) */ 186f98992afSMarkus Stockhausenppc_expand_256_loop: 187f98992afSMarkus Stockhausen addi r3,r3,32 188f98992afSMarkus Stockhausen mr r14,r12 /* apply LS_BOX to 8th temp */ 189f98992afSMarkus Stockhausen rotlwi r14,r14,8 190f98992afSMarkus Stockhausen LS_BOX(r14, r15, r4) 191f98992afSMarkus Stockhausen xor r14,r14,r0 192f98992afSMarkus Stockhausen xor r5,r5,r14 /* xor 4 keys */ 193f98992afSMarkus Stockhausen xor r6,r6,r5 194f98992afSMarkus Stockhausen xor r7,r7,r6 195f98992afSMarkus Stockhausen xor r8,r8,r7 196f98992afSMarkus Stockhausen mr r14,r8 197f98992afSMarkus Stockhausen LS_BOX(r14, r15, r4) /* apply LS_BOX to 4th temp */ 198f98992afSMarkus Stockhausen xor r9,r9,r14 /* xor 4 keys */ 199f98992afSMarkus Stockhausen xor r10,r10,r9 200f98992afSMarkus Stockhausen xor r11,r11,r10 201f98992afSMarkus Stockhausen xor r12,r12,r11 202f98992afSMarkus Stockhausen stw r5,0(r3) 203f98992afSMarkus Stockhausen stw r6,4(r3) 204f98992afSMarkus Stockhausen stw r7,8(r3) 205f98992afSMarkus Stockhausen stw r8,12(r3) 206f98992afSMarkus Stockhausen subi r16,r16,1 207f98992afSMarkus Stockhausen cmpwi r16,0 /* last round early kick out */ 208f98992afSMarkus Stockhausen bt eq,ppc_expand_256_end 209f98992afSMarkus Stockhausen stw r9,16(r3) 210f98992afSMarkus Stockhausen stw r10,20(r3) 211f98992afSMarkus Stockhausen stw r11,24(r3) 212f98992afSMarkus Stockhausen stw r12,28(r3) 213f98992afSMarkus Stockhausen GF8_MUL(r0, r0, r4, r14) 214f98992afSMarkus Stockhausen b ppc_expand_256_loop 215f98992afSMarkus Stockhausenppc_expand_256_end: 216f98992afSMarkus Stockhausen FINALIZE_KEY 217f98992afSMarkus Stockhausen blr 218f98992afSMarkus Stockhausen 219f98992afSMarkus Stockhausen/* 220f98992afSMarkus Stockhausen * ppc_generate_decrypt_key: derive decryption key from encryption key 221f98992afSMarkus Stockhausen * number of bytes to handle are calculated from length of key (16/24/32) 222f98992afSMarkus Stockhausen * 223f98992afSMarkus Stockhausen */ 224f98992afSMarkus Stockhausen_GLOBAL(ppc_generate_decrypt_key) 225f98992afSMarkus Stockhausen addi r6,r5,24 226f98992afSMarkus Stockhausen slwi r6,r6,2 227f98992afSMarkus Stockhausen lwzx r7,r4,r6 /* first/last 4 words are same */ 228f98992afSMarkus Stockhausen stw r7,0(r3) 229f98992afSMarkus Stockhausen lwz r7,0(r4) 230f98992afSMarkus Stockhausen stwx r7,r3,r6 231f98992afSMarkus Stockhausen addi r6,r6,4 232f98992afSMarkus Stockhausen lwzx r7,r4,r6 233f98992afSMarkus Stockhausen stw r7,4(r3) 234f98992afSMarkus Stockhausen lwz r7,4(r4) 235f98992afSMarkus Stockhausen stwx r7,r3,r6 236f98992afSMarkus Stockhausen addi r6,r6,4 237f98992afSMarkus Stockhausen lwzx r7,r4,r6 238f98992afSMarkus Stockhausen stw r7,8(r3) 239f98992afSMarkus Stockhausen lwz r7,8(r4) 240f98992afSMarkus Stockhausen stwx r7,r3,r6 241f98992afSMarkus Stockhausen addi r6,r6,4 242f98992afSMarkus Stockhausen lwzx r7,r4,r6 243f98992afSMarkus Stockhausen stw r7,12(r3) 244f98992afSMarkus Stockhausen lwz r7,12(r4) 245f98992afSMarkus Stockhausen stwx r7,r3,r6 246f98992afSMarkus Stockhausen addi r3,r3,16 247f98992afSMarkus Stockhausen add r4,r4,r6 248f98992afSMarkus Stockhausen subi r4,r4,28 249f98992afSMarkus Stockhausen addi r5,r5,20 250f98992afSMarkus Stockhausen srwi r5,r5,2 251f98992afSMarkus Stockhausenppc_generate_decrypt_block: 252f98992afSMarkus Stockhausen li r6,4 253f98992afSMarkus Stockhausen mtctr r6 254f98992afSMarkus Stockhausenppc_generate_decrypt_word: 255f98992afSMarkus Stockhausen lwz r6,0(r4) 256f98992afSMarkus Stockhausen GF8_MUL(r7, r6, r0, r7) 257f98992afSMarkus Stockhausen GF8_MUL(r8, r7, r0, r8) 258f98992afSMarkus Stockhausen GF8_MUL(r9, r8, r0, r9) 259f98992afSMarkus Stockhausen xor r10,r9,r6 260f98992afSMarkus Stockhausen xor r11,r7,r8 261f98992afSMarkus Stockhausen xor r11,r11,r9 262f98992afSMarkus Stockhausen xor r12,r7,r10 263f98992afSMarkus Stockhausen rotrwi r12,r12,24 264f98992afSMarkus Stockhausen xor r11,r11,r12 265f98992afSMarkus Stockhausen xor r12,r8,r10 266f98992afSMarkus Stockhausen rotrwi r12,r12,16 267f98992afSMarkus Stockhausen xor r11,r11,r12 268f98992afSMarkus Stockhausen rotrwi r12,r10,8 269f98992afSMarkus Stockhausen xor r11,r11,r12 270f98992afSMarkus Stockhausen stw r11,0(r3) 271f98992afSMarkus Stockhausen addi r3,r3,4 272f98992afSMarkus Stockhausen addi r4,r4,4 273f98992afSMarkus Stockhausen bdnz ppc_generate_decrypt_word 274f98992afSMarkus Stockhausen subi r4,r4,32 275f98992afSMarkus Stockhausen subi r5,r5,1 276f98992afSMarkus Stockhausen cmpwi r5,0 277f98992afSMarkus Stockhausen bt gt,ppc_generate_decrypt_block 278f98992afSMarkus Stockhausen blr 279