xref: /linux/crypto/cipher.c (revision f24e9f586b377749dff37554696cf3a105540c94) 
1 /*
2  * Cryptographic API.
3  *
4  * Cipher operations.
5  *
6  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
7  * Copyright (c) 2005 Herbert Xu <herbert@gondor.apana.org.au>
8  *
9  * This program is free software; you can redistribute it and/or modify it
10  * under the terms of the GNU General Public License as published by the Free
11  * Software Foundation; either version 2 of the License, or (at your option)
12  * any later version.
13  *
14  */
15 #include <linux/compiler.h>
16 #include <linux/kernel.h>
17 #include <linux/crypto.h>
18 #include <linux/errno.h>
19 #include <linux/mm.h>
20 #include <linux/slab.h>
21 #include <linux/string.h>
22 #include <asm/scatterlist.h>
23 #include "internal.h"
24 #include "scatterwalk.h"
25 
26 struct cipher_alg_compat {
27 	unsigned int cia_min_keysize;
28 	unsigned int cia_max_keysize;
29 	int (*cia_setkey)(struct crypto_tfm *tfm, const u8 *key,
30 	                  unsigned int keylen);
31 	void (*cia_encrypt)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
32 	void (*cia_decrypt)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
33 
34 	unsigned int (*cia_encrypt_ecb)(const struct cipher_desc *desc,
35 					u8 *dst, const u8 *src,
36 					unsigned int nbytes);
37 	unsigned int (*cia_decrypt_ecb)(const struct cipher_desc *desc,
38 					u8 *dst, const u8 *src,
39 					unsigned int nbytes);
40 	unsigned int (*cia_encrypt_cbc)(const struct cipher_desc *desc,
41 					u8 *dst, const u8 *src,
42 					unsigned int nbytes);
43 	unsigned int (*cia_decrypt_cbc)(const struct cipher_desc *desc,
44 					u8 *dst, const u8 *src,
45 					unsigned int nbytes);
46 };
47 
48 static inline void xor_64(u8 *a, const u8 *b)
49 {
50 	((u32 *)a)[0] ^= ((u32 *)b)[0];
51 	((u32 *)a)[1] ^= ((u32 *)b)[1];
52 }
53 
54 static inline void xor_128(u8 *a, const u8 *b)
55 {
56 	((u32 *)a)[0] ^= ((u32 *)b)[0];
57 	((u32 *)a)[1] ^= ((u32 *)b)[1];
58 	((u32 *)a)[2] ^= ((u32 *)b)[2];
59 	((u32 *)a)[3] ^= ((u32 *)b)[3];
60 }
61 
62 static unsigned int crypt_slow(const struct cipher_desc *desc,
63 			       struct scatter_walk *in,
64 			       struct scatter_walk *out, unsigned int bsize)
65 {
66 	unsigned long alignmask = crypto_tfm_alg_alignmask(desc->tfm);
67 	u8 buffer[bsize * 2 + alignmask];
68 	u8 *src = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
69 	u8 *dst = src + bsize;
70 
71 	scatterwalk_copychunks(src, in, bsize, 0);
72 	desc->prfn(desc, dst, src, bsize);
73 	scatterwalk_copychunks(dst, out, bsize, 1);
74 
75 	return bsize;
76 }
77 
78 static inline unsigned int crypt_fast(const struct cipher_desc *desc,
79 				      struct scatter_walk *in,
80 				      struct scatter_walk *out,
81 				      unsigned int nbytes, u8 *tmp)
82 {
83 	u8 *src, *dst;
84 	u8 *real_src, *real_dst;
85 
86 	real_src = scatterwalk_map(in, 0);
87 	real_dst = scatterwalk_map(out, 1);
88 
89 	src = real_src;
90 	dst = scatterwalk_samebuf(in, out) ? src : real_dst;
91 
92 	if (tmp) {
93 		memcpy(tmp, src, nbytes);
94 		src = tmp;
95 		dst = tmp;
96 	}
97 
98 	nbytes = desc->prfn(desc, dst, src, nbytes);
99 
100 	if (tmp)
101 		memcpy(real_dst, tmp, nbytes);
102 
103 	scatterwalk_unmap(real_src, 0);
104 	scatterwalk_unmap(real_dst, 1);
105 
106 	scatterwalk_advance(in, nbytes);
107 	scatterwalk_advance(out, nbytes);
108 
109 	return nbytes;
110 }
111 
112 /*
113  * Generic encrypt/decrypt wrapper for ciphers, handles operations across
114  * multiple page boundaries by using temporary blocks.  In user context,
115  * the kernel is given a chance to schedule us once per page.
116  */
117 static int crypt(const struct cipher_desc *desc,
118 		 struct scatterlist *dst,
119 		 struct scatterlist *src,
120 		 unsigned int nbytes)
121 {
122 	struct scatter_walk walk_in, walk_out;
123 	struct crypto_tfm *tfm = desc->tfm;
124 	const unsigned int bsize = crypto_tfm_alg_blocksize(tfm);
125 	unsigned int alignmask = crypto_tfm_alg_alignmask(tfm);
126 	unsigned long buffer = 0;
127 
128 	if (!nbytes)
129 		return 0;
130 
131 	if (nbytes % bsize) {
132 		tfm->crt_flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN;
133 		return -EINVAL;
134 	}
135 
136 	scatterwalk_start(&walk_in, src);
137 	scatterwalk_start(&walk_out, dst);
138 
139 	for(;;) {
140 		unsigned int n = nbytes;
141 		u8 *tmp = NULL;
142 
143 		if (!scatterwalk_aligned(&walk_in, alignmask) ||
144 		    !scatterwalk_aligned(&walk_out, alignmask)) {
145 			if (!buffer) {
146 				buffer = __get_free_page(GFP_ATOMIC);
147 				if (!buffer)
148 					n = 0;
149 			}
150 			tmp = (u8 *)buffer;
151 		}
152 
153 		n = scatterwalk_clamp(&walk_in, n);
154 		n = scatterwalk_clamp(&walk_out, n);
155 
156 		if (likely(n >= bsize))
157 			n = crypt_fast(desc, &walk_in, &walk_out, n, tmp);
158 		else
159 			n = crypt_slow(desc, &walk_in, &walk_out, bsize);
160 
161 		nbytes -= n;
162 
163 		scatterwalk_done(&walk_in, 0, nbytes);
164 		scatterwalk_done(&walk_out, 1, nbytes);
165 
166 		if (!nbytes)
167 			break;
168 
169 		crypto_yield(tfm->crt_flags);
170 	}
171 
172 	if (buffer)
173 		free_page(buffer);
174 
175 	return 0;
176 }
177 
178 static int crypt_iv_unaligned(struct cipher_desc *desc,
179 			      struct scatterlist *dst,
180 			      struct scatterlist *src,
181 			      unsigned int nbytes)
182 {
183 	struct crypto_tfm *tfm = desc->tfm;
184 	unsigned long alignmask = crypto_tfm_alg_alignmask(tfm);
185 	u8 *iv = desc->info;
186 
187 	if (unlikely(((unsigned long)iv & alignmask))) {
188 		unsigned int ivsize = tfm->crt_cipher.cit_ivsize;
189 		u8 buffer[ivsize + alignmask];
190 		u8 *tmp = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
191 		int err;
192 
193 		desc->info = memcpy(tmp, iv, ivsize);
194 		err = crypt(desc, dst, src, nbytes);
195 		memcpy(iv, tmp, ivsize);
196 
197 		return err;
198 	}
199 
200 	return crypt(desc, dst, src, nbytes);
201 }
202 
203 static unsigned int cbc_process_encrypt(const struct cipher_desc *desc,
204 					u8 *dst, const u8 *src,
205 					unsigned int nbytes)
206 {
207 	struct crypto_tfm *tfm = desc->tfm;
208 	void (*xor)(u8 *, const u8 *) = tfm->crt_u.cipher.cit_xor_block;
209 	int bsize = crypto_tfm_alg_blocksize(tfm);
210 
211 	void (*fn)(struct crypto_tfm *, u8 *, const u8 *) = desc->crfn;
212 	u8 *iv = desc->info;
213 	unsigned int done = 0;
214 
215 	nbytes -= bsize;
216 
217 	do {
218 		xor(iv, src);
219 		fn(tfm, dst, iv);
220 		memcpy(iv, dst, bsize);
221 
222 		src += bsize;
223 		dst += bsize;
224 	} while ((done += bsize) <= nbytes);
225 
226 	return done;
227 }
228 
229 static unsigned int cbc_process_decrypt(const struct cipher_desc *desc,
230 					u8 *dst, const u8 *src,
231 					unsigned int nbytes)
232 {
233 	struct crypto_tfm *tfm = desc->tfm;
234 	void (*xor)(u8 *, const u8 *) = tfm->crt_u.cipher.cit_xor_block;
235 	int bsize = crypto_tfm_alg_blocksize(tfm);
236 	unsigned long alignmask = crypto_tfm_alg_alignmask(desc->tfm);
237 
238 	u8 stack[src == dst ? bsize + alignmask : 0];
239 	u8 *buf = (u8 *)ALIGN((unsigned long)stack, alignmask + 1);
240 	u8 **dst_p = src == dst ? &buf : &dst;
241 
242 	void (*fn)(struct crypto_tfm *, u8 *, const u8 *) = desc->crfn;
243 	u8 *iv = desc->info;
244 	unsigned int done = 0;
245 
246 	nbytes -= bsize;
247 
248 	do {
249 		u8 *tmp_dst = *dst_p;
250 
251 		fn(tfm, tmp_dst, src);
252 		xor(tmp_dst, iv);
253 		memcpy(iv, src, bsize);
254 		if (tmp_dst != dst)
255 			memcpy(dst, tmp_dst, bsize);
256 
257 		src += bsize;
258 		dst += bsize;
259 	} while ((done += bsize) <= nbytes);
260 
261 	return done;
262 }
263 
264 static unsigned int ecb_process(const struct cipher_desc *desc, u8 *dst,
265 				const u8 *src, unsigned int nbytes)
266 {
267 	struct crypto_tfm *tfm = desc->tfm;
268 	int bsize = crypto_tfm_alg_blocksize(tfm);
269 	void (*fn)(struct crypto_tfm *, u8 *, const u8 *) = desc->crfn;
270 	unsigned int done = 0;
271 
272 	nbytes -= bsize;
273 
274 	do {
275 		fn(tfm, dst, src);
276 
277 		src += bsize;
278 		dst += bsize;
279 	} while ((done += bsize) <= nbytes);
280 
281 	return done;
282 }
283 
284 static int setkey(struct crypto_tfm *tfm, const u8 *key, unsigned int keylen)
285 {
286 	struct cipher_alg *cia = &tfm->__crt_alg->cra_cipher;
287 
288 	tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
289 	if (keylen < cia->cia_min_keysize || keylen > cia->cia_max_keysize) {
290 		tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
291 		return -EINVAL;
292 	} else
293 		return cia->cia_setkey(tfm, key, keylen);
294 }
295 
296 static int ecb_encrypt(struct crypto_tfm *tfm,
297 		       struct scatterlist *dst,
298                        struct scatterlist *src, unsigned int nbytes)
299 {
300 	struct cipher_desc desc;
301 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
302 
303 	desc.tfm = tfm;
304 	desc.crfn = cipher->cia_encrypt;
305 	desc.prfn = cipher->cia_encrypt_ecb ?: ecb_process;
306 
307 	return crypt(&desc, dst, src, nbytes);
308 }
309 
310 static int ecb_decrypt(struct crypto_tfm *tfm,
311                        struct scatterlist *dst,
312                        struct scatterlist *src,
313 		       unsigned int nbytes)
314 {
315 	struct cipher_desc desc;
316 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
317 
318 	desc.tfm = tfm;
319 	desc.crfn = cipher->cia_decrypt;
320 	desc.prfn = cipher->cia_decrypt_ecb ?: ecb_process;
321 
322 	return crypt(&desc, dst, src, nbytes);
323 }
324 
325 static int cbc_encrypt(struct crypto_tfm *tfm,
326                        struct scatterlist *dst,
327                        struct scatterlist *src,
328 		       unsigned int nbytes)
329 {
330 	struct cipher_desc desc;
331 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
332 
333 	desc.tfm = tfm;
334 	desc.crfn = cipher->cia_encrypt;
335 	desc.prfn = cipher->cia_encrypt_cbc ?: cbc_process_encrypt;
336 	desc.info = tfm->crt_cipher.cit_iv;
337 
338 	return crypt(&desc, dst, src, nbytes);
339 }
340 
341 static int cbc_encrypt_iv(struct crypto_tfm *tfm,
342                           struct scatterlist *dst,
343                           struct scatterlist *src,
344                           unsigned int nbytes, u8 *iv)
345 {
346 	struct cipher_desc desc;
347 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
348 
349 	desc.tfm = tfm;
350 	desc.crfn = cipher->cia_encrypt;
351 	desc.prfn = cipher->cia_encrypt_cbc ?: cbc_process_encrypt;
352 	desc.info = iv;
353 
354 	return crypt_iv_unaligned(&desc, dst, src, nbytes);
355 }
356 
357 static int cbc_decrypt(struct crypto_tfm *tfm,
358                        struct scatterlist *dst,
359                        struct scatterlist *src,
360 		       unsigned int nbytes)
361 {
362 	struct cipher_desc desc;
363 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
364 
365 	desc.tfm = tfm;
366 	desc.crfn = cipher->cia_decrypt;
367 	desc.prfn = cipher->cia_decrypt_cbc ?: cbc_process_decrypt;
368 	desc.info = tfm->crt_cipher.cit_iv;
369 
370 	return crypt(&desc, dst, src, nbytes);
371 }
372 
373 static int cbc_decrypt_iv(struct crypto_tfm *tfm,
374                           struct scatterlist *dst,
375                           struct scatterlist *src,
376                           unsigned int nbytes, u8 *iv)
377 {
378 	struct cipher_desc desc;
379 	struct cipher_alg_compat *cipher = (void *)&tfm->__crt_alg->cra_cipher;
380 
381 	desc.tfm = tfm;
382 	desc.crfn = cipher->cia_decrypt;
383 	desc.prfn = cipher->cia_decrypt_cbc ?: cbc_process_decrypt;
384 	desc.info = iv;
385 
386 	return crypt_iv_unaligned(&desc, dst, src, nbytes);
387 }
388 
389 static int nocrypt(struct crypto_tfm *tfm,
390                    struct scatterlist *dst,
391                    struct scatterlist *src,
392 		   unsigned int nbytes)
393 {
394 	return -ENOSYS;
395 }
396 
397 static int nocrypt_iv(struct crypto_tfm *tfm,
398                       struct scatterlist *dst,
399                       struct scatterlist *src,
400                       unsigned int nbytes, u8 *iv)
401 {
402 	return -ENOSYS;
403 }
404 
405 int crypto_init_cipher_flags(struct crypto_tfm *tfm, u32 flags)
406 {
407 	u32 mode = flags & CRYPTO_TFM_MODE_MASK;
408 	tfm->crt_cipher.cit_mode = mode ? mode : CRYPTO_TFM_MODE_ECB;
409 	return 0;
410 }
411 
412 static void cipher_crypt_unaligned(void (*fn)(struct crypto_tfm *, u8 *,
413 					      const u8 *),
414 				   struct crypto_tfm *tfm,
415 				   u8 *dst, const u8 *src)
416 {
417 	unsigned long alignmask = crypto_tfm_alg_alignmask(tfm);
418 	unsigned int size = crypto_tfm_alg_blocksize(tfm);
419 	u8 buffer[size + alignmask];
420 	u8 *tmp = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
421 
422 	memcpy(tmp, src, size);
423 	fn(tfm, tmp, tmp);
424 	memcpy(dst, tmp, size);
425 }
426 
427 static void cipher_encrypt_unaligned(struct crypto_tfm *tfm,
428 				     u8 *dst, const u8 *src)
429 {
430 	unsigned long alignmask = crypto_tfm_alg_alignmask(tfm);
431 	struct cipher_alg *cipher = &tfm->__crt_alg->cra_cipher;
432 
433 	if (unlikely(((unsigned long)dst | (unsigned long)src) & alignmask)) {
434 		cipher_crypt_unaligned(cipher->cia_encrypt, tfm, dst, src);
435 		return;
436 	}
437 
438 	cipher->cia_encrypt(tfm, dst, src);
439 }
440 
441 static void cipher_decrypt_unaligned(struct crypto_tfm *tfm,
442 				     u8 *dst, const u8 *src)
443 {
444 	unsigned long alignmask = crypto_tfm_alg_alignmask(tfm);
445 	struct cipher_alg *cipher = &tfm->__crt_alg->cra_cipher;
446 
447 	if (unlikely(((unsigned long)dst | (unsigned long)src) & alignmask)) {
448 		cipher_crypt_unaligned(cipher->cia_decrypt, tfm, dst, src);
449 		return;
450 	}
451 
452 	cipher->cia_decrypt(tfm, dst, src);
453 }
454 
455 int crypto_init_cipher_ops(struct crypto_tfm *tfm)
456 {
457 	int ret = 0;
458 	struct cipher_tfm *ops = &tfm->crt_cipher;
459 	struct cipher_alg *cipher = &tfm->__crt_alg->cra_cipher;
460 
461 	ops->cit_setkey = setkey;
462 	ops->cit_encrypt_one = crypto_tfm_alg_alignmask(tfm) ?
463 		cipher_encrypt_unaligned : cipher->cia_encrypt;
464 	ops->cit_decrypt_one = crypto_tfm_alg_alignmask(tfm) ?
465 		cipher_decrypt_unaligned : cipher->cia_decrypt;
466 
467 	switch (tfm->crt_cipher.cit_mode) {
468 	case CRYPTO_TFM_MODE_ECB:
469 		ops->cit_encrypt = ecb_encrypt;
470 		ops->cit_decrypt = ecb_decrypt;
471 		ops->cit_encrypt_iv = nocrypt_iv;
472 		ops->cit_decrypt_iv = nocrypt_iv;
473 		break;
474 
475 	case CRYPTO_TFM_MODE_CBC:
476 		ops->cit_encrypt = cbc_encrypt;
477 		ops->cit_decrypt = cbc_decrypt;
478 		ops->cit_encrypt_iv = cbc_encrypt_iv;
479 		ops->cit_decrypt_iv = cbc_decrypt_iv;
480 		break;
481 
482 	case CRYPTO_TFM_MODE_CFB:
483 		ops->cit_encrypt = nocrypt;
484 		ops->cit_decrypt = nocrypt;
485 		ops->cit_encrypt_iv = nocrypt_iv;
486 		ops->cit_decrypt_iv = nocrypt_iv;
487 		break;
488 
489 	case CRYPTO_TFM_MODE_CTR:
490 		ops->cit_encrypt = nocrypt;
491 		ops->cit_decrypt = nocrypt;
492 		ops->cit_encrypt_iv = nocrypt_iv;
493 		ops->cit_decrypt_iv = nocrypt_iv;
494 		break;
495 
496 	default:
497 		BUG();
498 	}
499 
500 	if (ops->cit_mode == CRYPTO_TFM_MODE_CBC) {
501 		unsigned long align;
502 		unsigned long addr;
503 
504 	    	switch (crypto_tfm_alg_blocksize(tfm)) {
505 	    	case 8:
506 	    		ops->cit_xor_block = xor_64;
507 	    		break;
508 
509 	    	case 16:
510 	    		ops->cit_xor_block = xor_128;
511 	    		break;
512 
513 	    	default:
514 	    		printk(KERN_WARNING "%s: block size %u not supported\n",
515 	    		       crypto_tfm_alg_name(tfm),
516 	    		       crypto_tfm_alg_blocksize(tfm));
517 	    		ret = -EINVAL;
518 	    		goto out;
519 	    	}
520 
521 		ops->cit_ivsize = crypto_tfm_alg_blocksize(tfm);
522 		align = crypto_tfm_alg_alignmask(tfm) + 1;
523 		addr = (unsigned long)crypto_tfm_ctx(tfm);
524 		addr = ALIGN(addr, align);
525 		addr += ALIGN(tfm->__crt_alg->cra_ctxsize, align);
526 		ops->cit_iv = (void *)addr;
527 	}
528 
529 out:
530 	return ret;
531 }
532 
533 void crypto_exit_cipher_ops(struct crypto_tfm *tfm)
534 {
535 }
536