1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Crypto API support for AES block cipher 4 * 5 * Copyright 2026 Google LLC 6 */ 7 8 #include <crypto/aes-cbc-macs.h> 9 #include <crypto/aes-cbc.h> 10 #include <crypto/aes-ccm.h> 11 #include <crypto/aes-ctr.h> 12 #include <crypto/aes-ecb.h> 13 #include <crypto/aes-gcm.h> 14 #include <crypto/aes-xts.h> 15 #include <crypto/aes.h> 16 #include <crypto/algapi.h> 17 #include <crypto/internal/aead.h> 18 #include <crypto/internal/hash.h> 19 #include <crypto/internal/skcipher.h> 20 #include <crypto/scatterwalk.h> 21 #include <linux/module.h> 22 23 static_assert(__alignof__(struct aes_key) <= CRYPTO_MINALIGN); 24 static_assert(__alignof__(struct aes_enckey) <= CRYPTO_MINALIGN); 25 26 static int crypto_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, 27 unsigned int key_len) 28 { 29 struct aes_key *key = crypto_tfm_ctx(tfm); 30 31 return aes_preparekey(key, in_key, key_len); 32 } 33 34 static void crypto_aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 35 { 36 const struct aes_key *key = crypto_tfm_ctx(tfm); 37 38 aes_encrypt(key, out, in); 39 } 40 41 static void crypto_aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 42 { 43 const struct aes_key *key = crypto_tfm_ctx(tfm); 44 45 aes_decrypt(key, out, in); 46 } 47 48 static_assert(__alignof__(struct aes_cmac_key) <= CRYPTO_MINALIGN); 49 #define AES_CMAC_KEY(tfm) ((struct aes_cmac_key *)crypto_shash_ctx(tfm)) 50 #define AES_CMAC_CTX(desc) ((struct aes_cmac_ctx *)shash_desc_ctx(desc)) 51 52 static int __maybe_unused crypto_aes_cmac_setkey(struct crypto_shash *tfm, 53 const u8 *in_key, 54 unsigned int key_len) 55 { 56 return aes_cmac_preparekey(AES_CMAC_KEY(tfm), in_key, key_len); 57 } 58 59 static int __maybe_unused crypto_aes_xcbc_setkey(struct crypto_shash *tfm, 60 const u8 *in_key, 61 unsigned int key_len) 62 { 63 if (key_len != AES_KEYSIZE_128) 64 return -EINVAL; 65 aes_xcbcmac_preparekey(AES_CMAC_KEY(tfm), in_key); 66 return 0; 67 } 68 69 static int __maybe_unused crypto_aes_cmac_init(struct shash_desc *desc) 70 { 71 aes_cmac_init(AES_CMAC_CTX(desc), AES_CMAC_KEY(desc->tfm)); 72 return 0; 73 } 74 75 static int __maybe_unused crypto_aes_cmac_update(struct shash_desc *desc, 76 const u8 *data, 77 unsigned int len) 78 { 79 aes_cmac_update(AES_CMAC_CTX(desc), data, len); 80 return 0; 81 } 82 83 static int __maybe_unused crypto_aes_cmac_final(struct shash_desc *desc, 84 u8 *out) 85 { 86 aes_cmac_final(AES_CMAC_CTX(desc), out); 87 return 0; 88 } 89 90 static int __maybe_unused crypto_aes_cmac_digest(struct shash_desc *desc, 91 const u8 *data, 92 unsigned int len, u8 *out) 93 { 94 aes_cmac(AES_CMAC_KEY(desc->tfm), data, len, out); 95 return 0; 96 } 97 98 #define AES_CBCMAC_KEY(tfm) ((struct aes_enckey *)crypto_shash_ctx(tfm)) 99 #define AES_CBCMAC_CTX(desc) ((struct aes_cbcmac_ctx *)shash_desc_ctx(desc)) 100 101 static int __maybe_unused crypto_aes_cbcmac_setkey(struct crypto_shash *tfm, 102 const u8 *in_key, 103 unsigned int key_len) 104 { 105 return aes_prepareenckey(AES_CBCMAC_KEY(tfm), in_key, key_len); 106 } 107 108 static int __maybe_unused crypto_aes_cbcmac_init(struct shash_desc *desc) 109 { 110 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm)); 111 return 0; 112 } 113 114 static int __maybe_unused crypto_aes_cbcmac_update(struct shash_desc *desc, 115 const u8 *data, 116 unsigned int len) 117 { 118 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len); 119 return 0; 120 } 121 122 static int __maybe_unused crypto_aes_cbcmac_final(struct shash_desc *desc, 123 u8 *out) 124 { 125 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out); 126 return 0; 127 } 128 129 static int __maybe_unused crypto_aes_cbcmac_digest(struct shash_desc *desc, 130 const u8 *data, 131 unsigned int len, u8 *out) 132 { 133 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm)); 134 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len); 135 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out); 136 return 0; 137 } 138 139 static struct crypto_alg alg = { 140 .cra_name = "aes", 141 .cra_driver_name = "aes-lib", 142 .cra_priority = 100, 143 .cra_flags = CRYPTO_ALG_TYPE_CIPHER, 144 .cra_blocksize = AES_BLOCK_SIZE, 145 .cra_ctxsize = sizeof(struct aes_key), 146 .cra_module = THIS_MODULE, 147 .cra_u = { .cipher = { .cia_min_keysize = AES_MIN_KEY_SIZE, 148 .cia_max_keysize = AES_MAX_KEY_SIZE, 149 .cia_setkey = crypto_aes_setkey, 150 .cia_encrypt = crypto_aes_encrypt, 151 .cia_decrypt = crypto_aes_decrypt } } 152 }; 153 154 static struct shash_alg mac_algs[] = { 155 #if IS_ENABLED(CONFIG_CRYPTO_CMAC) 156 { 157 .base.cra_name = "cmac(aes)", 158 .base.cra_driver_name = "cmac-aes-lib", 159 .base.cra_priority = 300, 160 .base.cra_blocksize = AES_BLOCK_SIZE, 161 .base.cra_ctxsize = sizeof(struct aes_cmac_key), 162 .base.cra_module = THIS_MODULE, 163 .digestsize = AES_BLOCK_SIZE, 164 .setkey = crypto_aes_cmac_setkey, 165 .init = crypto_aes_cmac_init, 166 .update = crypto_aes_cmac_update, 167 .final = crypto_aes_cmac_final, 168 .digest = crypto_aes_cmac_digest, 169 .descsize = sizeof(struct aes_cmac_ctx), 170 }, 171 #endif 172 #if IS_ENABLED(CONFIG_CRYPTO_XCBC) 173 { 174 /* 175 * Note that the only difference between xcbc(aes) and cmac(aes) 176 * is the preparekey function. 177 */ 178 .base.cra_name = "xcbc(aes)", 179 .base.cra_driver_name = "xcbc-aes-lib", 180 .base.cra_priority = 300, 181 .base.cra_blocksize = AES_BLOCK_SIZE, 182 .base.cra_ctxsize = sizeof(struct aes_cmac_key), 183 .base.cra_module = THIS_MODULE, 184 .digestsize = AES_BLOCK_SIZE, 185 .setkey = crypto_aes_xcbc_setkey, 186 .init = crypto_aes_cmac_init, 187 .update = crypto_aes_cmac_update, 188 .final = crypto_aes_cmac_final, 189 .digest = crypto_aes_cmac_digest, 190 .descsize = sizeof(struct aes_cmac_ctx), 191 }, 192 #endif 193 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 194 { 195 .base.cra_name = "cbcmac(aes)", 196 .base.cra_driver_name = "cbcmac-aes-lib", 197 .base.cra_priority = 300, 198 .base.cra_blocksize = AES_BLOCK_SIZE, 199 .base.cra_ctxsize = sizeof(struct aes_enckey), 200 .base.cra_module = THIS_MODULE, 201 .digestsize = AES_BLOCK_SIZE, 202 .setkey = crypto_aes_cbcmac_setkey, 203 .init = crypto_aes_cbcmac_init, 204 .update = crypto_aes_cbcmac_update, 205 .final = crypto_aes_cbcmac_final, 206 .digest = crypto_aes_cbcmac_digest, 207 .descsize = sizeof(struct aes_cbcmac_ctx), 208 }, 209 #endif 210 }; 211 212 static __maybe_unused int 213 crypto_aes_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *in_key, 214 unsigned int key_len) 215 { 216 struct aes_key *key = crypto_skcipher_ctx(tfm); 217 218 return aes_preparekey(key, in_key, key_len); 219 } 220 221 static __maybe_unused int 222 crypto_aes_skcipher_setenckey(struct crypto_skcipher *tfm, const u8 *in_key, 223 unsigned int key_len) 224 { 225 struct aes_enckey *key = crypto_skcipher_ctx(tfm); 226 227 return aes_prepareenckey(key, in_key, key_len); 228 } 229 230 /* 231 * Return true if the request uses only a single scatterlist element and high 232 * memory isn't enabled. This assumes that both scatterlists are non-NULL, i.e. 233 * the caller must have handled the cryptlen == 0 case already. 234 */ 235 static inline bool 236 skcipher_request_is_linear_lowmem(const struct skcipher_request *req) 237 { 238 return !IS_ENABLED(CONFIG_HIGHMEM) && 239 req->dst->length >= req->cryptlen && 240 req->src->length >= req->cryptlen; 241 } 242 243 /* 244 * Call crypt_func() (a function that operates on simple virtual addresses) zero 245 * or more times to en/decrypt 'cryptlen' bytes of data from the source 246 * scatterlist 'src' and write it into the destination scatterlist 'dst', 247 * starting at 'start_pos' bytes into both. 248 * 249 * This always calls crypt_func() with a length that's a multiple of 250 * AES_BLOCK_SIZE, except the last call which includes any remainder. This is 251 * implemented by using an on-stack bounce buffer when necessary. The current 252 * implementation also tries to prefer passing at least 4 blocks, so e.g. 253 * scatterlist entries [16,16,16,16] result in a single 64-byte call. 254 * 255 * The scatterlists must describe either entirely different memory 256 * (out-of-place) or entirely the same memory (in-place). In the latter case, 257 * crypt_func() is always called with the source and dest pointers the same. 258 */ 259 #define AES_CRYPT_SG(crypt_func, dst, src, cryptlen, start_pos, ...) \ 260 ({ \ 261 unsigned int remaining = (cryptlen); \ 262 unsigned int spos = (start_pos); \ 263 \ 264 if (remaining != 0) { \ 265 struct scatter_walk dst_walk, src_walk; \ 266 u8 tmp[4 * AES_BLOCK_SIZE] __aligned( \ 267 __alignof__(long)); \ 268 \ 269 scatterwalk_start_at_pos(&dst_walk, (dst), spos); \ 270 scatterwalk_start_at_pos(&src_walk, (src), spos); \ 271 do { \ 272 unsigned int dst_avail = scatterwalk_clamp( \ 273 &dst_walk, remaining); \ 274 unsigned int src_avail = scatterwalk_clamp( \ 275 &src_walk, remaining); \ 276 unsigned int n = min(dst_avail, src_avail); \ 277 u8 *dst_virt; \ 278 const u8 *src_virt; \ 279 \ 280 if (n < remaining) { \ 281 if (n < sizeof(tmp)) { \ 282 n = min(remaining, \ 283 sizeof(tmp)); \ 284 memcpy_from_scatterwalk( \ 285 tmp, &src_walk, n); \ 286 crypt_func(tmp, tmp, n, \ 287 ##__VA_ARGS__); \ 288 memcpy_to_scatterwalk( \ 289 &dst_walk, tmp, n); \ 290 remaining -= n; \ 291 continue; \ 292 } \ 293 n = round_down(n, AES_BLOCK_SIZE); \ 294 } \ 295 \ 296 scatterwalk_map(&dst_walk); \ 297 dst_virt = dst_walk.addr; \ 298 if (IS_ENABLED(CONFIG_HIGHMEM) && \ 299 offset_in_page(src_walk.offset) == \ 300 offset_in_page(dst_walk.offset) && \ 301 sg_page(src_walk.sg) + (src_walk.offset / \ 302 PAGE_SIZE) == \ 303 sg_page(dst_walk.sg) + \ 304 (dst_walk.offset / \ 305 PAGE_SIZE)) { \ 306 src_virt = dst_virt; \ 307 } else { \ 308 scatterwalk_map(&src_walk); \ 309 src_virt = src_walk.addr; \ 310 } \ 311 crypt_func(dst_virt, src_virt, n, \ 312 ##__VA_ARGS__); \ 313 if (src_virt != dst_virt) \ 314 scatterwalk_unmap(&src_walk); \ 315 scatterwalk_advance(&src_walk, n); \ 316 scatterwalk_done_dst(&dst_walk, n); \ 317 remaining -= n; \ 318 } while (remaining); \ 319 memzero_explicit(tmp, sizeof(tmp)); \ 320 } \ 321 }) 322 323 /* 324 * Call ad_func() as needed to process the associated data in the first 325 * 'assoclen' bytes of the scatterlist 'src'. 326 */ 327 #define AES_PROCESS_ASSOC_DATA(ad_func, src, assoclen, ctx) \ 328 ({ \ 329 unsigned int remaining = (assoclen); \ 330 \ 331 if (remaining != 0) { \ 332 struct scatter_walk walk; \ 333 \ 334 scatterwalk_start(&walk, (src)); \ 335 do { \ 336 unsigned int n = \ 337 scatterwalk_next(&walk, remaining); \ 338 \ 339 ad_func((ctx), walk.addr, n); \ 340 scatterwalk_done_src(&walk, n); \ 341 remaining -= n; \ 342 } while (remaining); \ 343 } \ 344 }) 345 346 /* AES-ECB */ 347 348 static __maybe_unused int crypto_aes_ecb_encrypt(struct skcipher_request *req) 349 { 350 const struct aes_key *key = 351 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 352 353 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 354 return -EINVAL; 355 AES_CRYPT_SG(aes_ecb_encrypt, req->dst, req->src, req->cryptlen, 0, 356 key); 357 return 0; 358 } 359 360 static __maybe_unused int crypto_aes_ecb_decrypt(struct skcipher_request *req) 361 { 362 const struct aes_key *key = 363 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 364 365 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 366 return -EINVAL; 367 AES_CRYPT_SG(aes_ecb_decrypt, req->dst, req->src, req->cryptlen, 0, 368 key); 369 return 0; 370 } 371 372 /* AES-CBC */ 373 374 static void crypto_aes_cbc_encrypt_sg(struct skcipher_request *req, 375 unsigned int cryptlen, 376 const struct aes_key *key) 377 { 378 AES_CRYPT_SG(aes_cbc_encrypt, req->dst, req->src, cryptlen, 0, req->iv, 379 key); 380 } 381 382 static void crypto_aes_cbc_decrypt_sg(struct skcipher_request *req, 383 unsigned int cryptlen, 384 const struct aes_key *key) 385 { 386 AES_CRYPT_SG(aes_cbc_decrypt, req->dst, req->src, cryptlen, 0, req->iv, 387 key); 388 } 389 390 static __maybe_unused int crypto_aes_cbc_encrypt(struct skcipher_request *req) 391 { 392 const struct aes_key *key = 393 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 394 395 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 396 return -EINVAL; 397 crypto_aes_cbc_encrypt_sg(req, req->cryptlen, key); 398 return 0; 399 } 400 401 static __maybe_unused int crypto_aes_cbc_decrypt(struct skcipher_request *req) 402 { 403 const struct aes_key *key = 404 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 405 406 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 407 return -EINVAL; 408 crypto_aes_cbc_decrypt_sg(req, req->cryptlen, key); 409 return 0; 410 } 411 412 /* AES-CBC-CTS */ 413 414 /* 415 * This handles AES-CBC-CTS en/decryption requests that use a nonlinear 416 * scatterlist layout or where HIGHMEM is enabled. It is explicitly 'noinline' 417 * to keep the temporary buffer out of the stack frame of the fast path. 418 */ 419 static noinline int 420 crypto_aes_cbc_cts_crypt_nonlinear(struct skcipher_request *req, bool enc) 421 { 422 const struct aes_key *key = 423 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 424 unsigned int main_len = req->cryptlen; 425 unsigned int tail_len; 426 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long)); 427 428 if (main_len == AES_BLOCK_SIZE) { 429 /* Single block is a special case that just does CBC. */ 430 if (enc) 431 crypto_aes_cbc_encrypt_sg(req, main_len, key); 432 else 433 crypto_aes_cbc_decrypt_sg(req, main_len, key); 434 return 0; 435 } 436 /* Just do the last two blocks separately. */ 437 tail_len = AES_BLOCK_SIZE + ((main_len - 1) % AES_BLOCK_SIZE) + 1; 438 main_len -= tail_len; 439 if (enc) 440 crypto_aes_cbc_encrypt_sg(req, main_len, key); 441 else 442 crypto_aes_cbc_decrypt_sg(req, main_len, key); 443 memcpy_from_sglist(tmp, req->src, main_len, tail_len); 444 if (enc) 445 aes_cbc_cts_encrypt(tmp, tmp, tail_len, req->iv, key); 446 else 447 aes_cbc_cts_decrypt(tmp, tmp, tail_len, req->iv, key); 448 memcpy_to_sglist(req->dst, main_len, tmp, tail_len); 449 memzero_explicit(tmp, sizeof(tmp)); 450 return 0; 451 } 452 453 static __maybe_unused int 454 crypto_aes_cbc_cts_encrypt(struct skcipher_request *req) 455 { 456 const struct aes_key *key = 457 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 458 459 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 460 return -EINVAL; 461 if (likely(skcipher_request_is_linear_lowmem(req))) { 462 /* Fast path */ 463 aes_cbc_cts_encrypt(sg_virt(req->dst), sg_virt(req->src), 464 req->cryptlen, req->iv, key); 465 return 0; 466 } 467 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ true); 468 } 469 470 static __maybe_unused int 471 crypto_aes_cbc_cts_decrypt(struct skcipher_request *req) 472 { 473 const struct aes_key *key = 474 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 475 476 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 477 return -EINVAL; 478 if (likely(skcipher_request_is_linear_lowmem(req))) { 479 /* Fast path */ 480 aes_cbc_cts_decrypt(sg_virt(req->dst), sg_virt(req->src), 481 req->cryptlen, req->iv, key); 482 return 0; 483 } 484 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ false); 485 } 486 487 /* AES-CTR */ 488 489 static __maybe_unused int crypto_aes_ctr_crypt(struct skcipher_request *req) 490 { 491 const struct aes_enckey *key = 492 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 493 494 AES_CRYPT_SG(aes_ctr, req->dst, req->src, req->cryptlen, 0, req->iv, 495 key); 496 return 0; 497 } 498 499 /* AES-XCTR */ 500 501 static __maybe_unused int crypto_aes_xctr_crypt(struct skcipher_request *req) 502 { 503 const struct aes_enckey *key = 504 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 505 u64 ctr = 1; 506 507 AES_CRYPT_SG(aes_xctr, req->dst, req->src, req->cryptlen, 0, &ctr, 508 req->iv, key); 509 return 0; 510 } 511 512 /* AES-XTS */ 513 514 static __maybe_unused int crypto_aes_xts_setkey(struct crypto_skcipher *tfm, 515 const u8 *in_key, 516 unsigned int key_len) 517 { 518 struct aes_xts_key *key = crypto_skcipher_ctx(tfm); 519 int flags = (crypto_skcipher_get_flags(tfm) & 520 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS) ? 521 XTS_FORBID_WEAK_KEYS : 522 0; 523 524 return aes_xts_preparekey(key, in_key, key_len, flags); 525 } 526 527 static void aes_xts_crypt_wrapper(u8 *dst, const u8 *src, size_t len, 528 u8 iv[AES_BLOCK_SIZE], 529 const struct aes_xts_key *key, bool enc, 530 bool *cont) 531 { 532 if (enc) 533 aes_xts_encrypt(dst, src, len, iv, key, *cont); 534 else 535 aes_xts_decrypt(dst, src, len, iv, key, *cont); 536 *cont = true; 537 } 538 539 /* 540 * This handles AES-XTS en/decryption requests that use a nonlinear scatterlist 541 * layout or where HIGHMEM is enabled. It is explicitly 'noinline' to keep the 542 * temporary buffer out of the stack frame of the fast path. 543 */ 544 static noinline int crypto_aes_xts_crypt_nonlinear(struct skcipher_request *req, 545 bool enc) 546 { 547 const struct aes_xts_key *key = 548 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 549 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long)); 550 unsigned int main_len = req->cryptlen; 551 unsigned int tail_len = main_len % AES_BLOCK_SIZE; 552 bool cont = false; 553 554 if (unlikely(tail_len)) { 555 /* 556 * Ciphertext stealing is needed. 557 * Just do the last two blocks separately. 558 */ 559 tail_len += AES_BLOCK_SIZE; 560 main_len -= tail_len; 561 } 562 563 AES_CRYPT_SG(aes_xts_crypt_wrapper, req->dst, req->src, main_len, 0, 564 req->iv, key, enc, &cont); 565 566 if (unlikely(tail_len)) { 567 memcpy_from_sglist(tmp, req->src, main_len, tail_len); 568 aes_xts_crypt_wrapper(tmp, tmp, tail_len, req->iv, key, enc, 569 &cont); 570 memcpy_to_sglist(req->dst, main_len, tmp, tail_len); 571 memzero_explicit(tmp, sizeof(tmp)); 572 } 573 return 0; 574 } 575 576 static __maybe_unused int crypto_aes_xts_encrypt(struct skcipher_request *req) 577 { 578 const struct aes_xts_key *key = 579 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 580 581 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 582 return -EINVAL; 583 if (likely(skcipher_request_is_linear_lowmem(req))) { 584 /* Fast path */ 585 aes_xts_encrypt(sg_virt(req->dst), sg_virt(req->src), 586 req->cryptlen, req->iv, key, /* cont= */ false); 587 return 0; 588 } 589 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ true); 590 } 591 592 static __maybe_unused int crypto_aes_xts_decrypt(struct skcipher_request *req) 593 { 594 const struct aes_xts_key *key = 595 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 596 597 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 598 return -EINVAL; 599 if (likely(skcipher_request_is_linear_lowmem(req))) { 600 /* Fast path */ 601 aes_xts_decrypt(sg_virt(req->dst), sg_virt(req->src), 602 req->cryptlen, req->iv, key, /* cont= */ false); 603 return 0; 604 } 605 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ false); 606 } 607 608 static struct skcipher_alg skcipher_algs[] = { 609 #if IS_ENABLED(CONFIG_CRYPTO_ECB) 610 { 611 .base.cra_name = "ecb(aes)", 612 .base.cra_driver_name = "ecb-aes-lib", 613 .base.cra_priority = 110, 614 .base.cra_blocksize = AES_BLOCK_SIZE, 615 .base.cra_ctxsize = sizeof(struct aes_key), 616 .base.cra_module = THIS_MODULE, 617 .min_keysize = AES_MIN_KEY_SIZE, 618 .max_keysize = AES_MAX_KEY_SIZE, 619 .setkey = crypto_aes_skcipher_setkey, 620 .encrypt = crypto_aes_ecb_encrypt, 621 .decrypt = crypto_aes_ecb_decrypt, 622 }, 623 #endif 624 #if IS_ENABLED(CONFIG_CRYPTO_CBC) 625 { 626 .base.cra_name = "cbc(aes)", 627 .base.cra_driver_name = "cbc-aes-lib", 628 .base.cra_priority = 110, 629 .base.cra_blocksize = AES_BLOCK_SIZE, 630 .base.cra_ctxsize = sizeof(struct aes_key), 631 .base.cra_module = THIS_MODULE, 632 .min_keysize = AES_MIN_KEY_SIZE, 633 .max_keysize = AES_MAX_KEY_SIZE, 634 .ivsize = AES_BLOCK_SIZE, 635 .setkey = crypto_aes_skcipher_setkey, 636 .encrypt = crypto_aes_cbc_encrypt, 637 .decrypt = crypto_aes_cbc_decrypt, 638 }, 639 #endif 640 /* 641 * Don't register library-based "cts(cbc(aes))" on architectures where 642 * it might block a "better" implementation from being instantiated via 643 * the "cts" template. These exclusions are temporary and will go away 644 * as the arch-optimized AES code is migrated into the library. 645 */ 646 #if IS_ENABLED(CONFIG_CRYPTO_CTS) && \ 647 !(IS_ENABLED(CONFIG_ARM) || \ 648 IS_ENABLED(CONFIG_ARM64) || \ 649 IS_ENABLED(CONFIG_PPC) || \ 650 IS_ENABLED(CONFIG_S390) || \ 651 IS_ENABLED(CONFIG_SPARC)) 652 { 653 .base.cra_name = "cts(cbc(aes))", 654 .base.cra_driver_name = "cts-cbc-aes-lib", 655 .base.cra_priority = 110, 656 .base.cra_blocksize = AES_BLOCK_SIZE, 657 .base.cra_ctxsize = sizeof(struct aes_key), 658 .base.cra_module = THIS_MODULE, 659 .min_keysize = AES_MIN_KEY_SIZE, 660 .max_keysize = AES_MAX_KEY_SIZE, 661 .ivsize = AES_BLOCK_SIZE, 662 .setkey = crypto_aes_skcipher_setkey, 663 .encrypt = crypto_aes_cbc_cts_encrypt, 664 .decrypt = crypto_aes_cbc_cts_decrypt, 665 }, 666 #endif 667 #if IS_ENABLED(CONFIG_CRYPTO_CTR) 668 { 669 .base.cra_name = "ctr(aes)", 670 .base.cra_driver_name = "ctr-aes-lib", 671 .base.cra_priority = 110, 672 .base.cra_blocksize = 1, 673 .base.cra_ctxsize = sizeof(struct aes_enckey), 674 .base.cra_module = THIS_MODULE, 675 .min_keysize = AES_MIN_KEY_SIZE, 676 .max_keysize = AES_MAX_KEY_SIZE, 677 .ivsize = AES_BLOCK_SIZE, 678 .chunksize = AES_BLOCK_SIZE, 679 .setkey = crypto_aes_skcipher_setenckey, 680 .encrypt = crypto_aes_ctr_crypt, 681 .decrypt = crypto_aes_ctr_crypt, 682 }, 683 #endif 684 #if IS_ENABLED(CONFIG_CRYPTO_XCTR) 685 { 686 .base.cra_name = "xctr(aes)", 687 .base.cra_driver_name = "xctr-aes-lib", 688 .base.cra_priority = 110, 689 .base.cra_blocksize = 1, 690 .base.cra_ctxsize = sizeof(struct aes_enckey), 691 .base.cra_module = THIS_MODULE, 692 .min_keysize = AES_MIN_KEY_SIZE, 693 .max_keysize = AES_MAX_KEY_SIZE, 694 .ivsize = AES_BLOCK_SIZE, 695 .chunksize = AES_BLOCK_SIZE, 696 .setkey = crypto_aes_skcipher_setenckey, 697 .encrypt = crypto_aes_xctr_crypt, 698 .decrypt = crypto_aes_xctr_crypt, 699 }, 700 #endif 701 /* 702 * Don't register library-based "xts(aes)" on architectures where it 703 * might block a "better" implementation from being instantiated via the 704 * "xts" template. This exclusion is temporary and will go away when 705 * the library AES-XTS is optimized for SPARC. 706 */ 707 #if IS_ENABLED(CONFIG_CRYPTO_XTS) && !IS_ENABLED(CONFIG_SPARC) 708 { 709 .base.cra_name = "xts(aes)", 710 .base.cra_driver_name = "xts-aes-lib", 711 .base.cra_priority = 110, 712 .base.cra_blocksize = AES_BLOCK_SIZE, 713 .base.cra_ctxsize = sizeof(struct aes_xts_key), 714 .base.cra_module = THIS_MODULE, 715 .min_keysize = 2 * AES_MIN_KEY_SIZE, 716 .max_keysize = 2 * AES_MAX_KEY_SIZE, 717 .ivsize = AES_BLOCK_SIZE, 718 .setkey = crypto_aes_xts_setkey, 719 .encrypt = crypto_aes_xts_encrypt, 720 .decrypt = crypto_aes_xts_decrypt, 721 }, 722 #endif 723 }; 724 725 /* AES-GCM */ 726 727 static __maybe_unused int crypto_aes_gcm_setkey(struct crypto_aead *tfm, 728 const u8 *in_key, 729 unsigned int key_len) 730 { 731 struct aes_gcm_key *key = crypto_aead_ctx(tfm); 732 733 return aes_gcm_preparekey(key, in_key, key_len, 734 crypto_aead_authsize(tfm)); 735 } 736 737 static __maybe_unused int crypto_aes_gcm_setauthsize(struct crypto_aead *tfm, 738 unsigned int authsize) 739 { 740 struct aes_gcm_key *key = crypto_aead_ctx(tfm); 741 742 if (crypto_gcm_check_authsize(authsize) != 0) 743 return -EINVAL; 744 /* Synchronize the tag length to the struct aes_gcm_key. */ 745 key->authtag_len = authsize; 746 return 0; 747 } 748 749 static void crypto_aes_gcm_auth_update(struct aes_gcm_ctx *ctx, 750 struct scatterlist *src, 751 unsigned int assoclen) 752 { 753 AES_PROCESS_ASSOC_DATA(aes_gcm_auth_update, src, assoclen, ctx); 754 } 755 756 static void aes_gcm_encrypt_update_helper(u8 *dst, const u8 *src, 757 unsigned int len, 758 struct aes_gcm_ctx *ctx) 759 { 760 aes_gcm_encrypt_update(ctx, dst, src, len); 761 } 762 763 static void aes_gcm_decrypt_update_helper(u8 *dst, const u8 *src, 764 unsigned int len, 765 struct aes_gcm_ctx *ctx) 766 { 767 aes_gcm_decrypt_update(ctx, dst, src, len); 768 } 769 770 static int crypto_aes_gcm_encrypt_common(struct aead_request *req, 771 const struct aes_gcm_key *key, 772 u8 iv[12], unsigned int assoclen) 773 { 774 struct aes_gcm_ctx ctx; 775 u8 authtag[16]; 776 777 aes_gcm_init(&ctx, iv, key); 778 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen); 779 AES_CRYPT_SG(aes_gcm_encrypt_update_helper, req->dst, req->src, 780 req->cryptlen, req->assoclen, &ctx); 781 aes_gcm_encrypt_final(&ctx, authtag); 782 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag, 783 key->authtag_len); 784 memzero_explicit(authtag, sizeof(authtag)); 785 return 0; 786 } 787 788 static int crypto_aes_gcm_decrypt_common(struct aead_request *req, 789 const struct aes_gcm_key *key, 790 u8 iv[12], unsigned int assoclen) 791 { 792 struct aes_gcm_ctx ctx; 793 unsigned int data_len; 794 u8 authtag[16]; 795 int err; 796 797 aes_gcm_init(&ctx, iv, key); 798 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen); 799 800 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */ 801 data_len = req->cryptlen - key->authtag_len; 802 AES_CRYPT_SG(aes_gcm_decrypt_update_helper, req->dst, req->src, 803 data_len, req->assoclen, &ctx); 804 805 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len, 806 key->authtag_len); 807 err = aes_gcm_decrypt_final(&ctx, authtag); 808 memzero_explicit(authtag, sizeof(authtag)); 809 return err; 810 } 811 812 static __maybe_unused int crypto_aes_gcm_encrypt(struct aead_request *req) 813 { 814 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 815 const struct aes_gcm_key *key = crypto_aead_ctx(tfm); 816 817 return crypto_aes_gcm_encrypt_common(req, key, req->iv, req->assoclen); 818 } 819 820 static __maybe_unused int crypto_aes_gcm_decrypt(struct aead_request *req) 821 { 822 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 823 const struct aes_gcm_key *key = crypto_aead_ctx(tfm); 824 825 return crypto_aes_gcm_decrypt_common(req, key, req->iv, req->assoclen); 826 } 827 828 struct aes_rfc4106_key { 829 struct aes_gcm_key gcm; 830 u8 nonce[4]; 831 }; 832 833 static __maybe_unused int crypto_aes_rfc4106_setkey(struct crypto_aead *tfm, 834 const u8 *in_key, 835 unsigned int key_len) 836 { 837 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 838 839 if (key_len < 4) 840 return -EINVAL; 841 842 key_len -= 4; 843 memcpy(key->nonce, in_key + key_len, 4); 844 845 return aes_gcm_preparekey(&key->gcm, in_key, key_len, 846 crypto_aead_authsize(tfm)); 847 } 848 849 static __maybe_unused int 850 crypto_aes_rfc4106_setauthsize(struct crypto_aead *tfm, unsigned int authsize) 851 { 852 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 853 854 if (crypto_rfc4106_check_authsize(authsize) != 0) 855 return -EINVAL; 856 857 /* Synchronize the tag length to the struct aes_gcm_key. */ 858 key->gcm.authtag_len = authsize; 859 return 0; 860 } 861 862 static __maybe_unused int crypto_aes_rfc4106_encrypt(struct aead_request *req) 863 { 864 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 865 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 866 u8 iv[12]; 867 868 if (crypto_ipsec_check_assoclen(req->assoclen) != 0) 869 return -EINVAL; 870 memcpy(iv, key->nonce, 4); 871 memcpy(&iv[4], req->iv, 8); 872 873 return crypto_aes_gcm_encrypt_common(req, &key->gcm, iv, 874 req->assoclen - 8); 875 } 876 877 static __maybe_unused int crypto_aes_rfc4106_decrypt(struct aead_request *req) 878 { 879 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 880 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 881 u8 iv[12]; 882 883 if (crypto_ipsec_check_assoclen(req->assoclen) != 0) 884 return -EINVAL; 885 memcpy(iv, key->nonce, 4); 886 memcpy(&iv[4], req->iv, 8); 887 888 return crypto_aes_gcm_decrypt_common(req, &key->gcm, iv, 889 req->assoclen - 8); 890 } 891 892 /* AES-CCM */ 893 894 static __maybe_unused int crypto_aes_ccm_setkey(struct crypto_aead *tfm, 895 const u8 *in_key, 896 unsigned int key_len) 897 { 898 struct aes_ccm_key *key = crypto_aead_ctx(tfm); 899 900 return aes_ccm_preparekey(key, in_key, key_len, 901 crypto_aead_authsize(tfm)); 902 } 903 904 static __maybe_unused int crypto_aes_ccm_setauthsize(struct crypto_aead *tfm, 905 unsigned int authsize) 906 { 907 struct aes_ccm_key *key = crypto_aead_ctx(tfm); 908 909 if (authsize < 4 || authsize > 16 || authsize % 2) 910 return -EINVAL; 911 /* Synchronize the tag length to the struct aes_ccm_key. */ 912 key->authtag_len = authsize; 913 return 0; 914 } 915 916 static int crypto_aes_ccm_init(struct aes_ccm_ctx *ctx, 917 struct aead_request *req, unsigned int data_len, 918 const struct aes_ccm_key *key) 919 { 920 int nonce_len; 921 const u8 *nonce; 922 int err; 923 924 /* 925 * CCM accepts a variable-length nonce between 7 and 13 bytes 926 * inclusively, while crypto_aead assumes a fixed-length IV. This is 927 * worked around by requiring that iv[0] contain '14 - nonce_len' and 928 * iv[1..] contain the actual nonce. Extra bytes at the end are unused. 929 */ 930 nonce_len = 14 - (int)req->iv[0]; 931 if (unlikely(nonce_len < 7 || nonce_len > 13)) 932 return -EINVAL; 933 nonce = &req->iv[1]; 934 err = aes_ccm_init(ctx, data_len, req->assoclen, nonce, nonce_len, key); 935 if (unlikely(err)) 936 return err; 937 AES_PROCESS_ASSOC_DATA(aes_ccm_auth_update, req->src, req->assoclen, 938 ctx); 939 return 0; 940 } 941 942 static void aes_ccm_encrypt_update_helper(u8 *dst, const u8 *src, 943 unsigned int len, 944 struct aes_ccm_ctx *ctx) 945 { 946 aes_ccm_encrypt_update(ctx, dst, src, len); 947 } 948 949 static void aes_ccm_decrypt_update_helper(u8 *dst, const u8 *src, 950 unsigned int len, 951 struct aes_ccm_ctx *ctx) 952 { 953 aes_ccm_decrypt_update(ctx, dst, src, len); 954 } 955 956 static __maybe_unused int crypto_aes_ccm_encrypt(struct aead_request *req) 957 { 958 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 959 const struct aes_ccm_key *key = crypto_aead_ctx(tfm); 960 struct aes_ccm_ctx ctx; 961 u8 authtag[16]; 962 int err; 963 964 err = crypto_aes_ccm_init(&ctx, req, req->cryptlen, key); 965 if (unlikely(err)) 966 return err; 967 AES_CRYPT_SG(aes_ccm_encrypt_update_helper, req->dst, req->src, 968 req->cryptlen, req->assoclen, &ctx); 969 aes_ccm_encrypt_final(&ctx, authtag); 970 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag, 971 key->authtag_len); 972 memzero_explicit(authtag, sizeof(authtag)); 973 return 0; 974 } 975 976 static __maybe_unused int crypto_aes_ccm_decrypt(struct aead_request *req) 977 { 978 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 979 const struct aes_ccm_key *key = crypto_aead_ctx(tfm); 980 unsigned int data_len; 981 struct aes_ccm_ctx ctx; 982 u8 authtag[16]; 983 int err; 984 985 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */ 986 data_len = req->cryptlen - key->authtag_len; 987 err = crypto_aes_ccm_init(&ctx, req, data_len, key); 988 if (unlikely(err)) 989 return err; 990 AES_CRYPT_SG(aes_ccm_decrypt_update_helper, req->dst, req->src, 991 data_len, req->assoclen, &ctx); 992 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len, 993 key->authtag_len); 994 err = aes_ccm_decrypt_final(&ctx, authtag); 995 memzero_explicit(authtag, sizeof(authtag)); 996 return err; 997 } 998 999 static struct aead_alg aead_algs[] = { 1000 /* 1001 * Don't register library-based "gcm(aes)" and "rfc4106(gcm(aes))" on 1002 * architectures where they might block a "better" implementation from 1003 * being instantiated via the "gcm" and "rfc4106" templates. These 1004 * exclusions are temporary and will go away as the arch-optimized AES 1005 * code is migrated into the library. 1006 */ 1007 #if IS_ENABLED(CONFIG_CRYPTO_GCM) && \ 1008 !(IS_ENABLED(CONFIG_ARM) || \ 1009 IS_ENABLED(CONFIG_ARM64) || \ 1010 IS_ENABLED(CONFIG_PPC) || \ 1011 IS_ENABLED(CONFIG_RISCV) || \ 1012 IS_ENABLED(CONFIG_S390) || \ 1013 IS_ENABLED(CONFIG_SPARC)) 1014 { 1015 .base.cra_name = "gcm(aes)", 1016 .base.cra_driver_name = "gcm-aes-lib", 1017 .base.cra_priority = 110, 1018 .base.cra_blocksize = 1, 1019 .base.cra_ctxsize = sizeof(struct aes_gcm_key), 1020 .base.cra_module = THIS_MODULE, 1021 .setkey = crypto_aes_gcm_setkey, 1022 .setauthsize = crypto_aes_gcm_setauthsize, 1023 .encrypt = crypto_aes_gcm_encrypt, 1024 .decrypt = crypto_aes_gcm_decrypt, 1025 .ivsize = GCM_AES_IV_SIZE, 1026 .maxauthsize = AES_BLOCK_SIZE, 1027 .chunksize = AES_BLOCK_SIZE, 1028 }, 1029 { 1030 .base.cra_name = "rfc4106(gcm(aes))", 1031 .base.cra_driver_name = "rfc4106-gcm-aes-lib", 1032 .base.cra_priority = 110, 1033 .base.cra_blocksize = 1, 1034 .base.cra_ctxsize = sizeof(struct aes_rfc4106_key), 1035 .base.cra_module = THIS_MODULE, 1036 .setkey = crypto_aes_rfc4106_setkey, 1037 .setauthsize = crypto_aes_rfc4106_setauthsize, 1038 .encrypt = crypto_aes_rfc4106_encrypt, 1039 .decrypt = crypto_aes_rfc4106_decrypt, 1040 .ivsize = GCM_RFC4106_IV_SIZE, 1041 .maxauthsize = AES_BLOCK_SIZE, 1042 .chunksize = AES_BLOCK_SIZE, 1043 }, 1044 #endif /* CONFIG_CRYPTO_GCM */ 1045 /* 1046 * Don't register library-based "ccm(aes)" on architectures where it 1047 * might block a "better" implementation from being instantiated via the 1048 * "ccm" template. These exclusions are temporary and will go away as 1049 * the arch-optimized AES code is migrated into the library. 1050 */ 1051 #if IS_ENABLED(CONFIG_CRYPTO_CCM) && \ 1052 !(IS_ENABLED(CONFIG_ARM) || \ 1053 IS_ENABLED(CONFIG_ARM64) || \ 1054 IS_ENABLED(CONFIG_PPC) || \ 1055 IS_ENABLED(CONFIG_RISCV) || \ 1056 IS_ENABLED(CONFIG_S390) || \ 1057 IS_ENABLED(CONFIG_SPARC) || \ 1058 IS_ENABLED(CONFIG_X86)) 1059 { 1060 .base.cra_name = "ccm(aes)", 1061 .base.cra_driver_name = "ccm-aes-lib", 1062 .base.cra_priority = 110, 1063 .base.cra_blocksize = 1, 1064 .base.cra_ctxsize = sizeof(struct aes_ccm_key), 1065 .base.cra_module = THIS_MODULE, 1066 .setkey = crypto_aes_ccm_setkey, 1067 .setauthsize = crypto_aes_ccm_setauthsize, 1068 .encrypt = crypto_aes_ccm_encrypt, 1069 .decrypt = crypto_aes_ccm_decrypt, 1070 .ivsize = 16, 1071 .maxauthsize = 16, 1072 .chunksize = AES_BLOCK_SIZE, 1073 }, 1074 #endif /* CONFIG_CRYPTO_CCM */ 1075 }; 1076 1077 static int __init crypto_aes_mod_init(void) 1078 { 1079 int err = crypto_register_alg(&alg); 1080 1081 if (err) 1082 return err; 1083 1084 if (ARRAY_SIZE(mac_algs) > 0) { 1085 err = crypto_register_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1086 if (err) 1087 goto err_unregister_alg; 1088 } /* Else, CONFIG_CRYPTO_HASH might not be enabled. */ 1089 1090 if (ARRAY_SIZE(skcipher_algs) > 0) { 1091 err = crypto_register_skciphers(skcipher_algs, 1092 ARRAY_SIZE(skcipher_algs)); 1093 if (err) 1094 goto err_unregister_macs; 1095 } 1096 1097 if (ARRAY_SIZE(aead_algs) > 0) { 1098 err = crypto_register_aeads(aead_algs, ARRAY_SIZE(aead_algs)); 1099 if (err) 1100 goto err_unregister_skciphers; 1101 } /* Else, CONFIG_CRYPTO_AEAD might not be enabled. */ 1102 return 0; 1103 1104 err_unregister_skciphers: 1105 if (ARRAY_SIZE(skcipher_algs) > 0) 1106 crypto_unregister_skciphers(skcipher_algs, 1107 ARRAY_SIZE(skcipher_algs)); 1108 err_unregister_macs: 1109 if (ARRAY_SIZE(mac_algs) > 0) 1110 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1111 err_unregister_alg: 1112 crypto_unregister_alg(&alg); 1113 return err; 1114 } 1115 module_init(crypto_aes_mod_init); 1116 1117 static void __exit crypto_aes_mod_exit(void) 1118 { 1119 if (ARRAY_SIZE(aead_algs) > 0) 1120 crypto_unregister_aeads(aead_algs, ARRAY_SIZE(aead_algs)); 1121 if (ARRAY_SIZE(skcipher_algs) > 0) 1122 crypto_unregister_skciphers(skcipher_algs, 1123 ARRAY_SIZE(skcipher_algs)); 1124 if (ARRAY_SIZE(mac_algs) > 0) 1125 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1126 crypto_unregister_alg(&alg); 1127 } 1128 module_exit(crypto_aes_mod_exit); 1129 1130 MODULE_DESCRIPTION("Crypto API support for AES block cipher"); 1131 MODULE_IMPORT_NS("CRYPTO_INTERNAL"); 1132 MODULE_LICENSE("GPL"); 1133 MODULE_ALIAS_CRYPTO("aes"); 1134 MODULE_ALIAS_CRYPTO("aes-lib"); 1135 #if IS_ENABLED(CONFIG_CRYPTO_CMAC) 1136 MODULE_ALIAS_CRYPTO("cmac(aes)"); 1137 MODULE_ALIAS_CRYPTO("cmac-aes-lib"); 1138 #endif 1139 #if IS_ENABLED(CONFIG_CRYPTO_XCBC) 1140 MODULE_ALIAS_CRYPTO("xcbc(aes)"); 1141 MODULE_ALIAS_CRYPTO("xcbc-aes-lib"); 1142 #endif 1143 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 1144 MODULE_ALIAS_CRYPTO("cbcmac(aes)"); 1145 MODULE_ALIAS_CRYPTO("cbcmac-aes-lib"); 1146 #endif 1147 #if IS_ENABLED(CONFIG_CRYPTO_ECB) 1148 MODULE_ALIAS_CRYPTO("ecb(aes)"); 1149 MODULE_ALIAS_CRYPTO("ecb-aes-lib"); 1150 #endif 1151 #if IS_ENABLED(CONFIG_CRYPTO_CBC) 1152 MODULE_ALIAS_CRYPTO("cbc(aes)"); 1153 MODULE_ALIAS_CRYPTO("cbc-aes-lib"); 1154 #endif 1155 #if IS_ENABLED(CONFIG_CRYPTO_CTS) 1156 MODULE_ALIAS_CRYPTO("cts(cbc(aes))"); 1157 MODULE_ALIAS_CRYPTO("cts-cbc-aes-lib"); 1158 #endif 1159 #if IS_ENABLED(CONFIG_CRYPTO_CTR) 1160 MODULE_ALIAS_CRYPTO("ctr(aes)"); 1161 MODULE_ALIAS_CRYPTO("ctr-aes-lib"); 1162 #endif 1163 #if IS_ENABLED(CONFIG_CRYPTO_XCTR) 1164 MODULE_ALIAS_CRYPTO("xctr(aes)"); 1165 MODULE_ALIAS_CRYPTO("xctr-aes-lib"); 1166 #endif 1167 #if IS_ENABLED(CONFIG_CRYPTO_XTS) 1168 MODULE_ALIAS_CRYPTO("xts(aes)"); 1169 MODULE_ALIAS_CRYPTO("xts-aes-lib"); 1170 #endif 1171 #if IS_ENABLED(CONFIG_CRYPTO_GCM) 1172 MODULE_ALIAS_CRYPTO("gcm(aes)"); 1173 MODULE_ALIAS_CRYPTO("gcm-aes-lib"); 1174 MODULE_ALIAS_CRYPTO("rfc4106(gcm(aes))"); 1175 MODULE_ALIAS_CRYPTO("rfc4106-gcm-aes-lib"); 1176 #endif 1177 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 1178 MODULE_ALIAS_CRYPTO("ccm(aes)"); 1179 MODULE_ALIAS_CRYPTO("ccm-aes-lib"); 1180 #endif 1181