1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Crypto API support for AES block cipher 4 * 5 * Copyright 2026 Google LLC 6 */ 7 8 #include <crypto/aes-cbc-macs.h> 9 #include <crypto/aes-cbc.h> 10 #include <crypto/aes-ccm.h> 11 #include <crypto/aes-ctr.h> 12 #include <crypto/aes-ecb.h> 13 #include <crypto/aes-gcm.h> 14 #include <crypto/aes-xts.h> 15 #include <crypto/aes.h> 16 #include <crypto/algapi.h> 17 #include <crypto/internal/aead.h> 18 #include <crypto/internal/hash.h> 19 #include <crypto/internal/skcipher.h> 20 #include <crypto/scatterwalk.h> 21 #include <linux/module.h> 22 23 static_assert(__alignof__(struct aes_key) <= CRYPTO_MINALIGN); 24 static_assert(__alignof__(struct aes_enckey) <= CRYPTO_MINALIGN); 25 26 static int crypto_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, 27 unsigned int key_len) 28 { 29 struct aes_key *key = crypto_tfm_ctx(tfm); 30 31 return aes_preparekey(key, in_key, key_len); 32 } 33 34 static void crypto_aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 35 { 36 const struct aes_key *key = crypto_tfm_ctx(tfm); 37 38 aes_encrypt(key, out, in); 39 } 40 41 static void crypto_aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 42 { 43 const struct aes_key *key = crypto_tfm_ctx(tfm); 44 45 aes_decrypt(key, out, in); 46 } 47 48 static_assert(__alignof__(struct aes_cmac_key) <= CRYPTO_MINALIGN); 49 #define AES_CMAC_KEY(tfm) ((struct aes_cmac_key *)crypto_shash_ctx(tfm)) 50 #define AES_CMAC_CTX(desc) ((struct aes_cmac_ctx *)shash_desc_ctx(desc)) 51 52 static int __maybe_unused crypto_aes_cmac_setkey(struct crypto_shash *tfm, 53 const u8 *in_key, 54 unsigned int key_len) 55 { 56 return aes_cmac_preparekey(AES_CMAC_KEY(tfm), in_key, key_len); 57 } 58 59 static int __maybe_unused crypto_aes_xcbc_setkey(struct crypto_shash *tfm, 60 const u8 *in_key, 61 unsigned int key_len) 62 { 63 if (key_len != AES_KEYSIZE_128) 64 return -EINVAL; 65 aes_xcbcmac_preparekey(AES_CMAC_KEY(tfm), in_key); 66 return 0; 67 } 68 69 static int __maybe_unused crypto_aes_cmac_init(struct shash_desc *desc) 70 { 71 aes_cmac_init(AES_CMAC_CTX(desc), AES_CMAC_KEY(desc->tfm)); 72 return 0; 73 } 74 75 static int __maybe_unused crypto_aes_cmac_update(struct shash_desc *desc, 76 const u8 *data, 77 unsigned int len) 78 { 79 aes_cmac_update(AES_CMAC_CTX(desc), data, len); 80 return 0; 81 } 82 83 static int __maybe_unused crypto_aes_cmac_final(struct shash_desc *desc, 84 u8 *out) 85 { 86 aes_cmac_final(AES_CMAC_CTX(desc), out); 87 return 0; 88 } 89 90 static int __maybe_unused crypto_aes_cmac_digest(struct shash_desc *desc, 91 const u8 *data, 92 unsigned int len, u8 *out) 93 { 94 aes_cmac(AES_CMAC_KEY(desc->tfm), data, len, out); 95 return 0; 96 } 97 98 #define AES_CBCMAC_KEY(tfm) ((struct aes_enckey *)crypto_shash_ctx(tfm)) 99 #define AES_CBCMAC_CTX(desc) ((struct aes_cbcmac_ctx *)shash_desc_ctx(desc)) 100 101 static int __maybe_unused crypto_aes_cbcmac_setkey(struct crypto_shash *tfm, 102 const u8 *in_key, 103 unsigned int key_len) 104 { 105 return aes_prepareenckey(AES_CBCMAC_KEY(tfm), in_key, key_len); 106 } 107 108 static int __maybe_unused crypto_aes_cbcmac_init(struct shash_desc *desc) 109 { 110 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm)); 111 return 0; 112 } 113 114 static int __maybe_unused crypto_aes_cbcmac_update(struct shash_desc *desc, 115 const u8 *data, 116 unsigned int len) 117 { 118 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len); 119 return 0; 120 } 121 122 static int __maybe_unused crypto_aes_cbcmac_final(struct shash_desc *desc, 123 u8 *out) 124 { 125 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out); 126 return 0; 127 } 128 129 static int __maybe_unused crypto_aes_cbcmac_digest(struct shash_desc *desc, 130 const u8 *data, 131 unsigned int len, u8 *out) 132 { 133 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm)); 134 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len); 135 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out); 136 return 0; 137 } 138 139 static struct crypto_alg alg = { 140 .cra_name = "aes", 141 .cra_driver_name = "aes-lib", 142 .cra_priority = 100, 143 .cra_flags = CRYPTO_ALG_TYPE_CIPHER, 144 .cra_blocksize = AES_BLOCK_SIZE, 145 .cra_ctxsize = sizeof(struct aes_key), 146 .cra_module = THIS_MODULE, 147 .cra_u = { .cipher = { .cia_min_keysize = AES_MIN_KEY_SIZE, 148 .cia_max_keysize = AES_MAX_KEY_SIZE, 149 .cia_setkey = crypto_aes_setkey, 150 .cia_encrypt = crypto_aes_encrypt, 151 .cia_decrypt = crypto_aes_decrypt } } 152 }; 153 154 static struct shash_alg mac_algs[] = { 155 #if IS_ENABLED(CONFIG_CRYPTO_CMAC) 156 { 157 .base.cra_name = "cmac(aes)", 158 .base.cra_driver_name = "cmac-aes-lib", 159 .base.cra_priority = 300, 160 .base.cra_blocksize = AES_BLOCK_SIZE, 161 .base.cra_ctxsize = sizeof(struct aes_cmac_key), 162 .base.cra_module = THIS_MODULE, 163 .digestsize = AES_BLOCK_SIZE, 164 .setkey = crypto_aes_cmac_setkey, 165 .init = crypto_aes_cmac_init, 166 .update = crypto_aes_cmac_update, 167 .final = crypto_aes_cmac_final, 168 .digest = crypto_aes_cmac_digest, 169 .descsize = sizeof(struct aes_cmac_ctx), 170 }, 171 #endif 172 #if IS_ENABLED(CONFIG_CRYPTO_XCBC) 173 { 174 /* 175 * Note that the only difference between xcbc(aes) and cmac(aes) 176 * is the preparekey function. 177 */ 178 .base.cra_name = "xcbc(aes)", 179 .base.cra_driver_name = "xcbc-aes-lib", 180 .base.cra_priority = 300, 181 .base.cra_blocksize = AES_BLOCK_SIZE, 182 .base.cra_ctxsize = sizeof(struct aes_cmac_key), 183 .base.cra_module = THIS_MODULE, 184 .digestsize = AES_BLOCK_SIZE, 185 .setkey = crypto_aes_xcbc_setkey, 186 .init = crypto_aes_cmac_init, 187 .update = crypto_aes_cmac_update, 188 .final = crypto_aes_cmac_final, 189 .digest = crypto_aes_cmac_digest, 190 .descsize = sizeof(struct aes_cmac_ctx), 191 }, 192 #endif 193 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 194 { 195 .base.cra_name = "cbcmac(aes)", 196 .base.cra_driver_name = "cbcmac-aes-lib", 197 .base.cra_priority = 300, 198 .base.cra_blocksize = AES_BLOCK_SIZE, 199 .base.cra_ctxsize = sizeof(struct aes_enckey), 200 .base.cra_module = THIS_MODULE, 201 .digestsize = AES_BLOCK_SIZE, 202 .setkey = crypto_aes_cbcmac_setkey, 203 .init = crypto_aes_cbcmac_init, 204 .update = crypto_aes_cbcmac_update, 205 .final = crypto_aes_cbcmac_final, 206 .digest = crypto_aes_cbcmac_digest, 207 .descsize = sizeof(struct aes_cbcmac_ctx), 208 }, 209 #endif 210 }; 211 212 static __maybe_unused int 213 crypto_aes_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *in_key, 214 unsigned int key_len) 215 { 216 struct aes_key *key = crypto_skcipher_ctx(tfm); 217 218 return aes_preparekey(key, in_key, key_len); 219 } 220 221 static __maybe_unused int 222 crypto_aes_skcipher_setenckey(struct crypto_skcipher *tfm, const u8 *in_key, 223 unsigned int key_len) 224 { 225 struct aes_enckey *key = crypto_skcipher_ctx(tfm); 226 227 return aes_prepareenckey(key, in_key, key_len); 228 } 229 230 /* 231 * Return true if the request uses only a single scatterlist element and high 232 * memory isn't enabled. This assumes that both scatterlists are non-NULL, i.e. 233 * the caller must have handled the cryptlen == 0 case already. 234 */ 235 static inline bool 236 skcipher_request_is_linear_lowmem(const struct skcipher_request *req) 237 { 238 return !IS_ENABLED(CONFIG_HIGHMEM) && 239 req->dst->length >= req->cryptlen && 240 req->src->length >= req->cryptlen; 241 } 242 243 /* 244 * Call crypt_func() (a function that operates on simple virtual addresses) zero 245 * or more times to en/decrypt 'cryptlen' bytes of data from the source 246 * scatterlist 'src' and write it into the destination scatterlist 'dst', 247 * starting at 'start_pos' bytes into both. 248 * 249 * This always calls crypt_func() with a length that's a multiple of 250 * AES_BLOCK_SIZE, except the last call which includes any remainder. This is 251 * implemented by using an on-stack bounce buffer when necessary. The current 252 * implementation also tries to prefer passing at least 4 blocks, so e.g. 253 * scatterlist entries [16,16,16,16] result in a single 64-byte call. 254 * 255 * The scatterlists must describe either entirely different memory 256 * (out-of-place) or entirely the same memory (in-place). In the latter case, 257 * crypt_func() is always called with the source and dest pointers the same. 258 */ 259 #define AES_CRYPT_SG(crypt_func, dst, src, cryptlen, start_pos, ...) \ 260 ({ \ 261 unsigned int remaining = (cryptlen); \ 262 unsigned int spos = (start_pos); \ 263 \ 264 if (remaining != 0) { \ 265 struct scatter_walk dst_walk, src_walk; \ 266 u8 tmp[4 * AES_BLOCK_SIZE] __aligned( \ 267 __alignof__(long)); \ 268 \ 269 scatterwalk_start_at_pos(&dst_walk, (dst), spos); \ 270 scatterwalk_start_at_pos(&src_walk, (src), spos); \ 271 do { \ 272 unsigned int dst_avail = scatterwalk_clamp( \ 273 &dst_walk, remaining); \ 274 unsigned int src_avail = scatterwalk_clamp( \ 275 &src_walk, remaining); \ 276 unsigned int n = min(dst_avail, src_avail); \ 277 u8 *dst_virt; \ 278 const u8 *src_virt; \ 279 \ 280 if (n < remaining) { \ 281 if (n < sizeof(tmp)) { \ 282 n = min(remaining, \ 283 sizeof(tmp)); \ 284 memcpy_from_scatterwalk( \ 285 tmp, &src_walk, n); \ 286 crypt_func(tmp, tmp, n, \ 287 ##__VA_ARGS__); \ 288 memcpy_to_scatterwalk( \ 289 &dst_walk, tmp, n); \ 290 remaining -= n; \ 291 continue; \ 292 } \ 293 n = round_down(n, AES_BLOCK_SIZE); \ 294 } \ 295 \ 296 scatterwalk_map(&dst_walk); \ 297 dst_virt = dst_walk.addr; \ 298 if (IS_ENABLED(CONFIG_HIGHMEM) && \ 299 offset_in_page(src_walk.offset) == \ 300 offset_in_page(dst_walk.offset) && \ 301 sg_page(src_walk.sg) + (src_walk.offset / \ 302 PAGE_SIZE) == \ 303 sg_page(dst_walk.sg) + \ 304 (dst_walk.offset / \ 305 PAGE_SIZE)) { \ 306 src_virt = dst_virt; \ 307 } else { \ 308 scatterwalk_map(&src_walk); \ 309 src_virt = src_walk.addr; \ 310 } \ 311 crypt_func(dst_virt, src_virt, n, \ 312 ##__VA_ARGS__); \ 313 if (src_virt != dst_virt) \ 314 scatterwalk_unmap(&src_walk); \ 315 scatterwalk_advance(&src_walk, n); \ 316 scatterwalk_done_dst(&dst_walk, n); \ 317 remaining -= n; \ 318 } while (remaining); \ 319 memzero_explicit(tmp, sizeof(tmp)); \ 320 } \ 321 }) 322 323 /* 324 * Call ad_func() as needed to process the associated data in the first 325 * 'assoclen' bytes of the scatterlist 'src'. 326 */ 327 #define AES_PROCESS_ASSOC_DATA(ad_func, src, assoclen, ctx) \ 328 ({ \ 329 unsigned int remaining = (assoclen); \ 330 \ 331 if (remaining != 0) { \ 332 struct scatter_walk walk; \ 333 \ 334 scatterwalk_start(&walk, (src)); \ 335 do { \ 336 unsigned int n = \ 337 scatterwalk_next(&walk, remaining); \ 338 \ 339 ad_func((ctx), walk.addr, n); \ 340 scatterwalk_done_src(&walk, n); \ 341 remaining -= n; \ 342 } while (remaining); \ 343 } \ 344 }) 345 346 /* AES-ECB */ 347 348 static __maybe_unused int crypto_aes_ecb_encrypt(struct skcipher_request *req) 349 { 350 const struct aes_key *key = 351 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 352 353 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 354 return -EINVAL; 355 AES_CRYPT_SG(aes_ecb_encrypt, req->dst, req->src, req->cryptlen, 0, 356 key); 357 return 0; 358 } 359 360 static __maybe_unused int crypto_aes_ecb_decrypt(struct skcipher_request *req) 361 { 362 const struct aes_key *key = 363 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 364 365 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 366 return -EINVAL; 367 AES_CRYPT_SG(aes_ecb_decrypt, req->dst, req->src, req->cryptlen, 0, 368 key); 369 return 0; 370 } 371 372 /* AES-CBC */ 373 374 static void crypto_aes_cbc_encrypt_sg(struct skcipher_request *req, 375 unsigned int cryptlen, 376 const struct aes_key *key) 377 { 378 AES_CRYPT_SG(aes_cbc_encrypt, req->dst, req->src, cryptlen, 0, req->iv, 379 key); 380 } 381 382 static void crypto_aes_cbc_decrypt_sg(struct skcipher_request *req, 383 unsigned int cryptlen, 384 const struct aes_key *key) 385 { 386 AES_CRYPT_SG(aes_cbc_decrypt, req->dst, req->src, cryptlen, 0, req->iv, 387 key); 388 } 389 390 static __maybe_unused int crypto_aes_cbc_encrypt(struct skcipher_request *req) 391 { 392 const struct aes_key *key = 393 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 394 395 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 396 return -EINVAL; 397 crypto_aes_cbc_encrypt_sg(req, req->cryptlen, key); 398 return 0; 399 } 400 401 static __maybe_unused int crypto_aes_cbc_decrypt(struct skcipher_request *req) 402 { 403 const struct aes_key *key = 404 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 405 406 if (unlikely(req->cryptlen % AES_BLOCK_SIZE)) 407 return -EINVAL; 408 crypto_aes_cbc_decrypt_sg(req, req->cryptlen, key); 409 return 0; 410 } 411 412 /* AES-CBC-CTS */ 413 414 /* 415 * This handles AES-CBC-CTS en/decryption requests that use a nonlinear 416 * scatterlist layout or where HIGHMEM is enabled. It is explicitly 'noinline' 417 * to keep the temporary buffer out of the stack frame of the fast path. 418 */ 419 static noinline int 420 crypto_aes_cbc_cts_crypt_nonlinear(struct skcipher_request *req, bool enc) 421 { 422 const struct aes_key *key = 423 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 424 unsigned int main_len = req->cryptlen; 425 unsigned int tail_len; 426 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long)); 427 428 if (main_len == AES_BLOCK_SIZE) { 429 /* Single block is a special case that just does CBC. */ 430 if (enc) 431 crypto_aes_cbc_encrypt_sg(req, main_len, key); 432 else 433 crypto_aes_cbc_decrypt_sg(req, main_len, key); 434 return 0; 435 } 436 /* Just do the last two blocks separately. */ 437 tail_len = AES_BLOCK_SIZE + ((main_len - 1) % AES_BLOCK_SIZE) + 1; 438 main_len -= tail_len; 439 if (enc) 440 crypto_aes_cbc_encrypt_sg(req, main_len, key); 441 else 442 crypto_aes_cbc_decrypt_sg(req, main_len, key); 443 memcpy_from_sglist(tmp, req->src, main_len, tail_len); 444 if (enc) 445 aes_cbc_cts_encrypt(tmp, tmp, tail_len, req->iv, key); 446 else 447 aes_cbc_cts_decrypt(tmp, tmp, tail_len, req->iv, key); 448 memcpy_to_sglist(req->dst, main_len, tmp, tail_len); 449 memzero_explicit(tmp, sizeof(tmp)); 450 return 0; 451 } 452 453 static __maybe_unused int 454 crypto_aes_cbc_cts_encrypt(struct skcipher_request *req) 455 { 456 const struct aes_key *key = 457 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 458 459 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 460 return -EINVAL; 461 if (likely(skcipher_request_is_linear_lowmem(req))) { 462 /* Fast path */ 463 aes_cbc_cts_encrypt(sg_virt(req->dst), sg_virt(req->src), 464 req->cryptlen, req->iv, key); 465 return 0; 466 } 467 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ true); 468 } 469 470 static __maybe_unused int 471 crypto_aes_cbc_cts_decrypt(struct skcipher_request *req) 472 { 473 const struct aes_key *key = 474 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 475 476 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 477 return -EINVAL; 478 if (likely(skcipher_request_is_linear_lowmem(req))) { 479 /* Fast path */ 480 aes_cbc_cts_decrypt(sg_virt(req->dst), sg_virt(req->src), 481 req->cryptlen, req->iv, key); 482 return 0; 483 } 484 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ false); 485 } 486 487 /* AES-CTR */ 488 489 static __maybe_unused int crypto_aes_ctr_crypt(struct skcipher_request *req) 490 { 491 const struct aes_enckey *key = 492 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 493 494 AES_CRYPT_SG(aes_ctr, req->dst, req->src, req->cryptlen, 0, req->iv, 495 key); 496 return 0; 497 } 498 499 /* AES-XCTR */ 500 501 static __maybe_unused int crypto_aes_xctr_crypt(struct skcipher_request *req) 502 { 503 const struct aes_enckey *key = 504 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 505 u64 ctr = 1; 506 507 AES_CRYPT_SG(aes_xctr, req->dst, req->src, req->cryptlen, 0, &ctr, 508 req->iv, key); 509 return 0; 510 } 511 512 /* AES-XTS */ 513 514 static __maybe_unused int crypto_aes_xts_setkey(struct crypto_skcipher *tfm, 515 const u8 *in_key, 516 unsigned int key_len) 517 { 518 struct aes_xts_key *key = crypto_skcipher_ctx(tfm); 519 int flags = (crypto_skcipher_get_flags(tfm) & 520 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS) ? 521 XTS_FORBID_WEAK_KEYS : 522 0; 523 524 return aes_xts_preparekey(key, in_key, key_len, flags); 525 } 526 527 static void aes_xts_crypt_wrapper(u8 *dst, const u8 *src, size_t len, 528 u8 iv[AES_BLOCK_SIZE], 529 const struct aes_xts_key *key, bool enc, 530 bool *cont) 531 { 532 if (enc) 533 aes_xts_encrypt(dst, src, len, iv, key, *cont); 534 else 535 aes_xts_decrypt(dst, src, len, iv, key, *cont); 536 *cont = true; 537 } 538 539 /* 540 * This handles AES-XTS en/decryption requests that use a nonlinear scatterlist 541 * layout or where HIGHMEM is enabled. It is explicitly 'noinline' to keep the 542 * temporary buffer out of the stack frame of the fast path. 543 */ 544 static noinline int crypto_aes_xts_crypt_nonlinear(struct skcipher_request *req, 545 bool enc) 546 { 547 const struct aes_xts_key *key = 548 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 549 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long)); 550 unsigned int main_len = req->cryptlen; 551 unsigned int tail_len = main_len % AES_BLOCK_SIZE; 552 bool cont = false; 553 554 if (unlikely(tail_len)) { 555 /* 556 * Ciphertext stealing is needed. 557 * Just do the last two blocks separately. 558 */ 559 tail_len += AES_BLOCK_SIZE; 560 main_len -= tail_len; 561 } 562 563 AES_CRYPT_SG(aes_xts_crypt_wrapper, req->dst, req->src, main_len, 0, 564 req->iv, key, enc, &cont); 565 566 if (unlikely(tail_len)) { 567 memcpy_from_sglist(tmp, req->src, main_len, tail_len); 568 aes_xts_crypt_wrapper(tmp, tmp, tail_len, req->iv, key, enc, 569 &cont); 570 memcpy_to_sglist(req->dst, main_len, tmp, tail_len); 571 memzero_explicit(tmp, sizeof(tmp)); 572 } 573 return 0; 574 } 575 576 static __maybe_unused int crypto_aes_xts_encrypt(struct skcipher_request *req) 577 { 578 const struct aes_xts_key *key = 579 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 580 581 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 582 return -EINVAL; 583 if (likely(skcipher_request_is_linear_lowmem(req))) { 584 /* Fast path */ 585 aes_xts_encrypt(sg_virt(req->dst), sg_virt(req->src), 586 req->cryptlen, req->iv, key, /* cont= */ false); 587 return 0; 588 } 589 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ true); 590 } 591 592 static __maybe_unused int crypto_aes_xts_decrypt(struct skcipher_request *req) 593 { 594 const struct aes_xts_key *key = 595 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req)); 596 597 if (unlikely(req->cryptlen < AES_BLOCK_SIZE)) 598 return -EINVAL; 599 if (likely(skcipher_request_is_linear_lowmem(req))) { 600 /* Fast path */ 601 aes_xts_decrypt(sg_virt(req->dst), sg_virt(req->src), 602 req->cryptlen, req->iv, key, /* cont= */ false); 603 return 0; 604 } 605 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ false); 606 } 607 608 static struct skcipher_alg skcipher_algs[] = { 609 #if IS_ENABLED(CONFIG_CRYPTO_ECB) 610 { 611 .base.cra_name = "ecb(aes)", 612 .base.cra_driver_name = "ecb-aes-lib", 613 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) || 614 IS_ENABLED(CONFIG_X86)) ? 300 : 110, 615 .base.cra_blocksize = AES_BLOCK_SIZE, 616 .base.cra_ctxsize = sizeof(struct aes_key), 617 .base.cra_module = THIS_MODULE, 618 .min_keysize = AES_MIN_KEY_SIZE, 619 .max_keysize = AES_MAX_KEY_SIZE, 620 .setkey = crypto_aes_skcipher_setkey, 621 .encrypt = crypto_aes_ecb_encrypt, 622 .decrypt = crypto_aes_ecb_decrypt, 623 }, 624 #endif 625 #if IS_ENABLED(CONFIG_CRYPTO_CBC) 626 { 627 .base.cra_name = "cbc(aes)", 628 .base.cra_driver_name = "cbc-aes-lib", 629 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) || 630 IS_ENABLED(CONFIG_X86)) ? 300 : 110, 631 .base.cra_blocksize = AES_BLOCK_SIZE, 632 .base.cra_ctxsize = sizeof(struct aes_key), 633 .base.cra_module = THIS_MODULE, 634 .min_keysize = AES_MIN_KEY_SIZE, 635 .max_keysize = AES_MAX_KEY_SIZE, 636 .ivsize = AES_BLOCK_SIZE, 637 .setkey = crypto_aes_skcipher_setkey, 638 .encrypt = crypto_aes_cbc_encrypt, 639 .decrypt = crypto_aes_cbc_decrypt, 640 }, 641 #endif 642 /* 643 * Don't register library-based "cts(cbc(aes))" on architectures where 644 * it might block a "better" implementation from being instantiated via 645 * the "cts" template. These exclusions are temporary and will go away 646 * as the arch-optimized AES code is migrated into the library. 647 */ 648 #if IS_ENABLED(CONFIG_CRYPTO_CTS) && \ 649 !(IS_ENABLED(CONFIG_ARM) || \ 650 IS_ENABLED(CONFIG_ARM64) || \ 651 IS_ENABLED(CONFIG_PPC) || \ 652 IS_ENABLED(CONFIG_S390) || \ 653 IS_ENABLED(CONFIG_SPARC)) 654 { 655 .base.cra_name = "cts(cbc(aes))", 656 .base.cra_driver_name = "cts-cbc-aes-lib", 657 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) || 658 IS_ENABLED(CONFIG_X86)) ? 300 : 110, 659 .base.cra_blocksize = AES_BLOCK_SIZE, 660 .base.cra_ctxsize = sizeof(struct aes_key), 661 .base.cra_module = THIS_MODULE, 662 .min_keysize = AES_MIN_KEY_SIZE, 663 .max_keysize = AES_MAX_KEY_SIZE, 664 .ivsize = AES_BLOCK_SIZE, 665 .setkey = crypto_aes_skcipher_setkey, 666 .encrypt = crypto_aes_cbc_cts_encrypt, 667 .decrypt = crypto_aes_cbc_cts_decrypt, 668 }, 669 #endif 670 #if IS_ENABLED(CONFIG_CRYPTO_CTR) 671 { 672 .base.cra_name = "ctr(aes)", 673 .base.cra_driver_name = "ctr-aes-lib", 674 .base.cra_priority = IS_ENABLED(CONFIG_X86) ? 300 : 110, 675 .base.cra_blocksize = 1, 676 .base.cra_ctxsize = sizeof(struct aes_enckey), 677 .base.cra_module = THIS_MODULE, 678 .min_keysize = AES_MIN_KEY_SIZE, 679 .max_keysize = AES_MAX_KEY_SIZE, 680 .ivsize = AES_BLOCK_SIZE, 681 .chunksize = AES_BLOCK_SIZE, 682 .setkey = crypto_aes_skcipher_setenckey, 683 .encrypt = crypto_aes_ctr_crypt, 684 .decrypt = crypto_aes_ctr_crypt, 685 }, 686 #endif 687 #if IS_ENABLED(CONFIG_CRYPTO_XCTR) 688 { 689 .base.cra_name = "xctr(aes)", 690 .base.cra_driver_name = "xctr-aes-lib", 691 .base.cra_priority = IS_ENABLED(CONFIG_X86) ? 300 : 110, 692 .base.cra_blocksize = 1, 693 .base.cra_ctxsize = sizeof(struct aes_enckey), 694 .base.cra_module = THIS_MODULE, 695 .min_keysize = AES_MIN_KEY_SIZE, 696 .max_keysize = AES_MAX_KEY_SIZE, 697 .ivsize = AES_BLOCK_SIZE, 698 .chunksize = AES_BLOCK_SIZE, 699 .setkey = crypto_aes_skcipher_setenckey, 700 .encrypt = crypto_aes_xctr_crypt, 701 .decrypt = crypto_aes_xctr_crypt, 702 }, 703 #endif 704 /* 705 * Don't register library-based "xts(aes)" on architectures where it 706 * might block a "better" implementation from being instantiated via the 707 * "xts" template. This exclusion is temporary and will go away when 708 * the library AES-XTS is optimized for SPARC. 709 */ 710 #if IS_ENABLED(CONFIG_CRYPTO_XTS) && !IS_ENABLED(CONFIG_SPARC) 711 { 712 .base.cra_name = "xts(aes)", 713 .base.cra_driver_name = "xts-aes-lib", 714 .base.cra_priority = IS_ENABLED(CONFIG_X86) ? 300 : 110, 715 .base.cra_blocksize = AES_BLOCK_SIZE, 716 .base.cra_ctxsize = sizeof(struct aes_xts_key), 717 .base.cra_module = THIS_MODULE, 718 .min_keysize = 2 * AES_MIN_KEY_SIZE, 719 .max_keysize = 2 * AES_MAX_KEY_SIZE, 720 .ivsize = AES_BLOCK_SIZE, 721 .setkey = crypto_aes_xts_setkey, 722 .encrypt = crypto_aes_xts_encrypt, 723 .decrypt = crypto_aes_xts_decrypt, 724 }, 725 #endif 726 }; 727 728 /* AES-GCM */ 729 730 static __maybe_unused int crypto_aes_gcm_setkey(struct crypto_aead *tfm, 731 const u8 *in_key, 732 unsigned int key_len) 733 { 734 struct aes_gcm_key *key = crypto_aead_ctx(tfm); 735 736 return aes_gcm_preparekey(key, in_key, key_len, 737 crypto_aead_authsize(tfm)); 738 } 739 740 static __maybe_unused int crypto_aes_gcm_setauthsize(struct crypto_aead *tfm, 741 unsigned int authsize) 742 { 743 struct aes_gcm_key *key = crypto_aead_ctx(tfm); 744 745 if (crypto_gcm_check_authsize(authsize) != 0) 746 return -EINVAL; 747 /* Synchronize the tag length to the struct aes_gcm_key. */ 748 key->authtag_len = authsize; 749 return 0; 750 } 751 752 static void crypto_aes_gcm_auth_update(struct aes_gcm_ctx *ctx, 753 struct scatterlist *src, 754 unsigned int assoclen) 755 { 756 AES_PROCESS_ASSOC_DATA(aes_gcm_auth_update, src, assoclen, ctx); 757 } 758 759 static void aes_gcm_encrypt_update_helper(u8 *dst, const u8 *src, 760 unsigned int len, 761 struct aes_gcm_ctx *ctx) 762 { 763 aes_gcm_encrypt_update(ctx, dst, src, len); 764 } 765 766 static void aes_gcm_decrypt_update_helper(u8 *dst, const u8 *src, 767 unsigned int len, 768 struct aes_gcm_ctx *ctx) 769 { 770 aes_gcm_decrypt_update(ctx, dst, src, len); 771 } 772 773 static int crypto_aes_gcm_encrypt_common(struct aead_request *req, 774 const struct aes_gcm_key *key, 775 u8 iv[12], unsigned int assoclen) 776 { 777 struct aes_gcm_ctx ctx; 778 u8 authtag[16]; 779 780 aes_gcm_init(&ctx, iv, key); 781 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen); 782 AES_CRYPT_SG(aes_gcm_encrypt_update_helper, req->dst, req->src, 783 req->cryptlen, req->assoclen, &ctx); 784 aes_gcm_encrypt_final(&ctx, authtag); 785 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag, 786 key->authtag_len); 787 memzero_explicit(authtag, sizeof(authtag)); 788 return 0; 789 } 790 791 static int crypto_aes_gcm_decrypt_common(struct aead_request *req, 792 const struct aes_gcm_key *key, 793 u8 iv[12], unsigned int assoclen) 794 { 795 struct aes_gcm_ctx ctx; 796 unsigned int data_len; 797 u8 authtag[16]; 798 int err; 799 800 aes_gcm_init(&ctx, iv, key); 801 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen); 802 803 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */ 804 data_len = req->cryptlen - key->authtag_len; 805 AES_CRYPT_SG(aes_gcm_decrypt_update_helper, req->dst, req->src, 806 data_len, req->assoclen, &ctx); 807 808 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len, 809 key->authtag_len); 810 err = aes_gcm_decrypt_final(&ctx, authtag); 811 memzero_explicit(authtag, sizeof(authtag)); 812 return err; 813 } 814 815 static __maybe_unused int crypto_aes_gcm_encrypt(struct aead_request *req) 816 { 817 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 818 const struct aes_gcm_key *key = crypto_aead_ctx(tfm); 819 820 return crypto_aes_gcm_encrypt_common(req, key, req->iv, req->assoclen); 821 } 822 823 static __maybe_unused int crypto_aes_gcm_decrypt(struct aead_request *req) 824 { 825 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 826 const struct aes_gcm_key *key = crypto_aead_ctx(tfm); 827 828 return crypto_aes_gcm_decrypt_common(req, key, req->iv, req->assoclen); 829 } 830 831 struct aes_rfc4106_key { 832 struct aes_gcm_key gcm; 833 u8 nonce[4]; 834 }; 835 836 static __maybe_unused int crypto_aes_rfc4106_setkey(struct crypto_aead *tfm, 837 const u8 *in_key, 838 unsigned int key_len) 839 { 840 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 841 842 if (key_len < 4) 843 return -EINVAL; 844 845 key_len -= 4; 846 memcpy(key->nonce, in_key + key_len, 4); 847 848 return aes_gcm_preparekey(&key->gcm, in_key, key_len, 849 crypto_aead_authsize(tfm)); 850 } 851 852 static __maybe_unused int 853 crypto_aes_rfc4106_setauthsize(struct crypto_aead *tfm, unsigned int authsize) 854 { 855 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 856 857 if (crypto_rfc4106_check_authsize(authsize) != 0) 858 return -EINVAL; 859 860 /* Synchronize the tag length to the struct aes_gcm_key. */ 861 key->gcm.authtag_len = authsize; 862 return 0; 863 } 864 865 static __maybe_unused int crypto_aes_rfc4106_encrypt(struct aead_request *req) 866 { 867 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 868 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 869 u8 iv[12]; 870 871 if (crypto_ipsec_check_assoclen(req->assoclen) != 0) 872 return -EINVAL; 873 memcpy(iv, key->nonce, 4); 874 memcpy(&iv[4], req->iv, 8); 875 876 return crypto_aes_gcm_encrypt_common(req, &key->gcm, iv, 877 req->assoclen - 8); 878 } 879 880 static __maybe_unused int crypto_aes_rfc4106_decrypt(struct aead_request *req) 881 { 882 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 883 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm); 884 u8 iv[12]; 885 886 if (crypto_ipsec_check_assoclen(req->assoclen) != 0) 887 return -EINVAL; 888 memcpy(iv, key->nonce, 4); 889 memcpy(&iv[4], req->iv, 8); 890 891 return crypto_aes_gcm_decrypt_common(req, &key->gcm, iv, 892 req->assoclen - 8); 893 } 894 895 /* AES-CCM */ 896 897 static __maybe_unused int crypto_aes_ccm_setkey(struct crypto_aead *tfm, 898 const u8 *in_key, 899 unsigned int key_len) 900 { 901 struct aes_ccm_key *key = crypto_aead_ctx(tfm); 902 903 return aes_ccm_preparekey(key, in_key, key_len, 904 crypto_aead_authsize(tfm)); 905 } 906 907 static __maybe_unused int crypto_aes_ccm_setauthsize(struct crypto_aead *tfm, 908 unsigned int authsize) 909 { 910 struct aes_ccm_key *key = crypto_aead_ctx(tfm); 911 912 if (authsize < 4 || authsize > 16 || authsize % 2) 913 return -EINVAL; 914 /* Synchronize the tag length to the struct aes_ccm_key. */ 915 key->authtag_len = authsize; 916 return 0; 917 } 918 919 static int crypto_aes_ccm_init(struct aes_ccm_ctx *ctx, 920 struct aead_request *req, unsigned int data_len, 921 const struct aes_ccm_key *key) 922 { 923 int nonce_len; 924 const u8 *nonce; 925 int err; 926 927 /* 928 * CCM accepts a variable-length nonce between 7 and 13 bytes 929 * inclusively, while crypto_aead assumes a fixed-length IV. This is 930 * worked around by requiring that iv[0] contain '14 - nonce_len' and 931 * iv[1..] contain the actual nonce. Extra bytes at the end are unused. 932 */ 933 nonce_len = 14 - (int)req->iv[0]; 934 if (unlikely(nonce_len < 7 || nonce_len > 13)) 935 return -EINVAL; 936 nonce = &req->iv[1]; 937 err = aes_ccm_init(ctx, data_len, req->assoclen, nonce, nonce_len, key); 938 if (unlikely(err)) 939 return err; 940 AES_PROCESS_ASSOC_DATA(aes_ccm_auth_update, req->src, req->assoclen, 941 ctx); 942 return 0; 943 } 944 945 static void aes_ccm_encrypt_update_helper(u8 *dst, const u8 *src, 946 unsigned int len, 947 struct aes_ccm_ctx *ctx) 948 { 949 aes_ccm_encrypt_update(ctx, dst, src, len); 950 } 951 952 static void aes_ccm_decrypt_update_helper(u8 *dst, const u8 *src, 953 unsigned int len, 954 struct aes_ccm_ctx *ctx) 955 { 956 aes_ccm_decrypt_update(ctx, dst, src, len); 957 } 958 959 static __maybe_unused int crypto_aes_ccm_encrypt(struct aead_request *req) 960 { 961 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 962 const struct aes_ccm_key *key = crypto_aead_ctx(tfm); 963 struct aes_ccm_ctx ctx; 964 u8 authtag[16]; 965 int err; 966 967 err = crypto_aes_ccm_init(&ctx, req, req->cryptlen, key); 968 if (unlikely(err)) 969 return err; 970 AES_CRYPT_SG(aes_ccm_encrypt_update_helper, req->dst, req->src, 971 req->cryptlen, req->assoclen, &ctx); 972 aes_ccm_encrypt_final(&ctx, authtag); 973 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag, 974 key->authtag_len); 975 memzero_explicit(authtag, sizeof(authtag)); 976 return 0; 977 } 978 979 static __maybe_unused int crypto_aes_ccm_decrypt(struct aead_request *req) 980 { 981 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 982 const struct aes_ccm_key *key = crypto_aead_ctx(tfm); 983 unsigned int data_len; 984 struct aes_ccm_ctx ctx; 985 u8 authtag[16]; 986 int err; 987 988 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */ 989 data_len = req->cryptlen - key->authtag_len; 990 err = crypto_aes_ccm_init(&ctx, req, data_len, key); 991 if (unlikely(err)) 992 return err; 993 AES_CRYPT_SG(aes_ccm_decrypt_update_helper, req->dst, req->src, 994 data_len, req->assoclen, &ctx); 995 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len, 996 key->authtag_len); 997 err = aes_ccm_decrypt_final(&ctx, authtag); 998 memzero_explicit(authtag, sizeof(authtag)); 999 return err; 1000 } 1001 1002 static struct aead_alg aead_algs[] = { 1003 /* 1004 * Don't register library-based "gcm(aes)" and "rfc4106(gcm(aes))" on 1005 * architectures where they might block a "better" implementation from 1006 * being instantiated via the "gcm" and "rfc4106" templates. These 1007 * exclusions are temporary and will go away as the arch-optimized AES 1008 * code is migrated into the library. 1009 */ 1010 #if IS_ENABLED(CONFIG_CRYPTO_GCM) && \ 1011 !(IS_ENABLED(CONFIG_ARM) || \ 1012 IS_ENABLED(CONFIG_ARM64) || \ 1013 IS_ENABLED(CONFIG_PPC) || \ 1014 IS_ENABLED(CONFIG_RISCV) || \ 1015 IS_ENABLED(CONFIG_S390) || \ 1016 IS_ENABLED(CONFIG_SPARC)) 1017 { 1018 .base.cra_name = "gcm(aes)", 1019 .base.cra_driver_name = "gcm-aes-lib", 1020 .base.cra_priority = 110, 1021 .base.cra_blocksize = 1, 1022 .base.cra_ctxsize = sizeof(struct aes_gcm_key), 1023 .base.cra_module = THIS_MODULE, 1024 .setkey = crypto_aes_gcm_setkey, 1025 .setauthsize = crypto_aes_gcm_setauthsize, 1026 .encrypt = crypto_aes_gcm_encrypt, 1027 .decrypt = crypto_aes_gcm_decrypt, 1028 .ivsize = GCM_AES_IV_SIZE, 1029 .maxauthsize = AES_BLOCK_SIZE, 1030 .chunksize = AES_BLOCK_SIZE, 1031 }, 1032 { 1033 .base.cra_name = "rfc4106(gcm(aes))", 1034 .base.cra_driver_name = "rfc4106-gcm-aes-lib", 1035 .base.cra_priority = 110, 1036 .base.cra_blocksize = 1, 1037 .base.cra_ctxsize = sizeof(struct aes_rfc4106_key), 1038 .base.cra_module = THIS_MODULE, 1039 .setkey = crypto_aes_rfc4106_setkey, 1040 .setauthsize = crypto_aes_rfc4106_setauthsize, 1041 .encrypt = crypto_aes_rfc4106_encrypt, 1042 .decrypt = crypto_aes_rfc4106_decrypt, 1043 .ivsize = GCM_RFC4106_IV_SIZE, 1044 .maxauthsize = AES_BLOCK_SIZE, 1045 .chunksize = AES_BLOCK_SIZE, 1046 }, 1047 #endif /* CONFIG_CRYPTO_GCM */ 1048 /* 1049 * Don't register library-based "ccm(aes)" on architectures where it 1050 * might block a "better" implementation from being instantiated via the 1051 * "ccm" template. These exclusions are temporary and will go away as 1052 * the arch-optimized AES code is migrated into the library. 1053 */ 1054 #if IS_ENABLED(CONFIG_CRYPTO_CCM) && \ 1055 !(IS_ENABLED(CONFIG_ARM) || \ 1056 IS_ENABLED(CONFIG_ARM64) || \ 1057 IS_ENABLED(CONFIG_PPC) || \ 1058 IS_ENABLED(CONFIG_RISCV) || \ 1059 IS_ENABLED(CONFIG_S390) || \ 1060 IS_ENABLED(CONFIG_SPARC)) 1061 { 1062 .base.cra_name = "ccm(aes)", 1063 .base.cra_driver_name = "ccm-aes-lib", 1064 .base.cra_priority = 110, 1065 .base.cra_blocksize = 1, 1066 .base.cra_ctxsize = sizeof(struct aes_ccm_key), 1067 .base.cra_module = THIS_MODULE, 1068 .setkey = crypto_aes_ccm_setkey, 1069 .setauthsize = crypto_aes_ccm_setauthsize, 1070 .encrypt = crypto_aes_ccm_encrypt, 1071 .decrypt = crypto_aes_ccm_decrypt, 1072 .ivsize = 16, 1073 .maxauthsize = 16, 1074 .chunksize = AES_BLOCK_SIZE, 1075 }, 1076 #endif /* CONFIG_CRYPTO_CCM */ 1077 }; 1078 1079 static int __init crypto_aes_mod_init(void) 1080 { 1081 int err = crypto_register_alg(&alg); 1082 1083 if (err) 1084 return err; 1085 1086 if (ARRAY_SIZE(mac_algs) > 0) { 1087 err = crypto_register_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1088 if (err) 1089 goto err_unregister_alg; 1090 } /* Else, CONFIG_CRYPTO_HASH might not be enabled. */ 1091 1092 if (ARRAY_SIZE(skcipher_algs) > 0) { 1093 err = crypto_register_skciphers(skcipher_algs, 1094 ARRAY_SIZE(skcipher_algs)); 1095 if (err) 1096 goto err_unregister_macs; 1097 } 1098 1099 if (ARRAY_SIZE(aead_algs) > 0) { 1100 err = crypto_register_aeads(aead_algs, ARRAY_SIZE(aead_algs)); 1101 if (err) 1102 goto err_unregister_skciphers; 1103 } /* Else, CONFIG_CRYPTO_AEAD might not be enabled. */ 1104 return 0; 1105 1106 err_unregister_skciphers: 1107 if (ARRAY_SIZE(skcipher_algs) > 0) 1108 crypto_unregister_skciphers(skcipher_algs, 1109 ARRAY_SIZE(skcipher_algs)); 1110 err_unregister_macs: 1111 if (ARRAY_SIZE(mac_algs) > 0) 1112 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1113 err_unregister_alg: 1114 crypto_unregister_alg(&alg); 1115 return err; 1116 } 1117 module_init(crypto_aes_mod_init); 1118 1119 static void __exit crypto_aes_mod_exit(void) 1120 { 1121 if (ARRAY_SIZE(aead_algs) > 0) 1122 crypto_unregister_aeads(aead_algs, ARRAY_SIZE(aead_algs)); 1123 if (ARRAY_SIZE(skcipher_algs) > 0) 1124 crypto_unregister_skciphers(skcipher_algs, 1125 ARRAY_SIZE(skcipher_algs)); 1126 if (ARRAY_SIZE(mac_algs) > 0) 1127 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs)); 1128 crypto_unregister_alg(&alg); 1129 } 1130 module_exit(crypto_aes_mod_exit); 1131 1132 MODULE_DESCRIPTION("Crypto API support for AES block cipher"); 1133 MODULE_IMPORT_NS("CRYPTO_INTERNAL"); 1134 MODULE_LICENSE("GPL"); 1135 MODULE_ALIAS_CRYPTO("aes"); 1136 MODULE_ALIAS_CRYPTO("aes-lib"); 1137 #if IS_ENABLED(CONFIG_CRYPTO_CMAC) 1138 MODULE_ALIAS_CRYPTO("cmac(aes)"); 1139 MODULE_ALIAS_CRYPTO("cmac-aes-lib"); 1140 #endif 1141 #if IS_ENABLED(CONFIG_CRYPTO_XCBC) 1142 MODULE_ALIAS_CRYPTO("xcbc(aes)"); 1143 MODULE_ALIAS_CRYPTO("xcbc-aes-lib"); 1144 #endif 1145 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 1146 MODULE_ALIAS_CRYPTO("cbcmac(aes)"); 1147 MODULE_ALIAS_CRYPTO("cbcmac-aes-lib"); 1148 #endif 1149 #if IS_ENABLED(CONFIG_CRYPTO_ECB) 1150 MODULE_ALIAS_CRYPTO("ecb(aes)"); 1151 MODULE_ALIAS_CRYPTO("ecb-aes-lib"); 1152 #endif 1153 #if IS_ENABLED(CONFIG_CRYPTO_CBC) 1154 MODULE_ALIAS_CRYPTO("cbc(aes)"); 1155 MODULE_ALIAS_CRYPTO("cbc-aes-lib"); 1156 #endif 1157 #if IS_ENABLED(CONFIG_CRYPTO_CTS) 1158 MODULE_ALIAS_CRYPTO("cts(cbc(aes))"); 1159 MODULE_ALIAS_CRYPTO("cts-cbc-aes-lib"); 1160 #endif 1161 #if IS_ENABLED(CONFIG_CRYPTO_CTR) 1162 MODULE_ALIAS_CRYPTO("ctr(aes)"); 1163 MODULE_ALIAS_CRYPTO("ctr-aes-lib"); 1164 #endif 1165 #if IS_ENABLED(CONFIG_CRYPTO_XCTR) 1166 MODULE_ALIAS_CRYPTO("xctr(aes)"); 1167 MODULE_ALIAS_CRYPTO("xctr-aes-lib"); 1168 #endif 1169 #if IS_ENABLED(CONFIG_CRYPTO_XTS) 1170 MODULE_ALIAS_CRYPTO("xts(aes)"); 1171 MODULE_ALIAS_CRYPTO("xts-aes-lib"); 1172 #endif 1173 #if IS_ENABLED(CONFIG_CRYPTO_GCM) 1174 MODULE_ALIAS_CRYPTO("gcm(aes)"); 1175 MODULE_ALIAS_CRYPTO("gcm-aes-lib"); 1176 MODULE_ALIAS_CRYPTO("rfc4106(gcm(aes))"); 1177 MODULE_ALIAS_CRYPTO("rfc4106-gcm-aes-lib"); 1178 #endif 1179 #if IS_ENABLED(CONFIG_CRYPTO_CCM) 1180 MODULE_ALIAS_CRYPTO("ccm(aes)"); 1181 MODULE_ALIAS_CRYPTO("ccm-aes-lib"); 1182 #endif 1183