summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-19crypto: hmac - Add export_core and import_coreHerbert Xu
Add export_import and import_core so that hmac can be used as a fallback by block-only drivers. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Zero shash desc in setkeyHerbert Xu
The shash desc needs to be zeroed after use in setkey as it is not finalised (finalisation automatically zeroes it). Also remove the final function as it's been superseded by finup. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ahash - Handle partial blocks in APIHerbert Xu
Provide an option to handle the partial blocks in the ahash API. Almost every hash algorithm has a block size and are only able to hash partial blocks on finalisation. As a first step disable virtual address support for algorithms with state sizes larger than HASH_MAX_STATESIZE. This is OK as virtual addresses are currently only used on synchronous fallbacks. This means ahash_do_req_chain only needs to handle synchronous fallbacks, removing the complexities of saving the request state. Also move the saved request state into the ahash_request object as nesting is no longer possible. Add a scatterlist to ahash_request to store the partial block. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Add export_core and import_core hooksHerbert Xu
Add export_core and import_core hooks. These are intended to be used by algorithms which are wrappers around block-only algorithms, but are not themselves block-only, e.g., hmac. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Move core export and import into internel/hash.hHerbert Xu
The core export and import functions are targeted at implementors so move them into internal/hash.h. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert Marvell CESA to DT schemaRob Herring (Arm)
Convert the Marvell CESA binding to DT schema format. The marvell-cesa.txt and mv_cesa.txt are duplicate bindings. The clock properties are quite varied for each platform hence the if/then schemas. The old binding was fairly accurate with reality. The original binding didn't mention there is 1 interrupt per CESA engine. Based on users, there's a maximum of 2 engines. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert img,hash-accelerator to DT schemaRob Herring (Arm)
Convert the Imagination Technologies hardware hash accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert hisilicon,hip0{6,7}-sec to DT schemaRob Herring (Arm)
Convert the HiSilicon HIP06/7 Security Accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert brcm,spum-crypto to DT schemaRob Herring (Arm)
Convert the Broadcom SPUM/SPU2 binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert axis,artpec6-crypto to DT schemaRob Herring (Arm)
Convert the Axis Crypto engine binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert amd,ccp-seattle-v1a to DT schemaRob Herring (Arm)
Convert the AMD Cryptographic Coprocessor binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Drop obsolete mediatek,eip97-cryptoRob Herring (Arm)
The mediatek,eip97-crypto binding is half abandoned. The driver was dropped in 2020 as the Mediatek platforms use InsideSecure block and the driver for it. All the platforms except MT7623 were updated. A patch to update it was submitted, but never addressed the review comments. Link: https://lore.kernel.org/all/20210303080923.16761-1-vic.wu@mediatek.com/ Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: fsl,sec-v4.0: Add fsl,sec-v6.0Rob Herring (Arm)
The fsl,sec-v6.0 binding is the same as the fsl,sec-v4.0 binding, so add it to the existing schema and drop the old .txt binding. The compatibles in the .txt binding don't match the 1 user. Follow the user for the schema. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable reporting of error counters for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting of error counters through sysfs for QAT GEN6 devices and update the ABI documentation. This enables the reporting of the following: - errors_correctable - hardware correctable errors that allow the system to recover without data loss. - errors_nonfatal: errors that can be isolated to specific in-flight requests. - errors_fatal: errors that cannot be contained to a request, requiring a Function Level Reset (FLR) upon occurrence. Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable RAS support for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting and handling of errors for QAT GEN6 devices. Errors are categorized as correctable, non-fatal, or fatal. Error handling involves reading the error source registers (ERRSOU0 to ERRSOU3) to determine the source of the error and then decoding the actual source reading specific registers. The action taken depends on the error type: - Correctable and Non-Fatal errors. These error are logged, cleared and the corresponding counter is incremented. - Fatal errors. These errors are logged, cleared and a Function Level Reset (FLR) is scheduled. This reports and handles the following errors: - Accelerator engine (AE) correctable errors - Accelerator engine (AE) uncorrectable errors - Chassis push-pull (CPP) errors - Host interface (HI) parity errors - Internal memory parity errors - Receive interface (RI) errors - Transmit interface (TI) errors - Interface for system-on-chip (SoC) fabric (IOSF) primary command parity errors - Shared RAM and slice module (SSM) errors Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ccp - Add support for PCI device 0x17D8John Allen
Add a new CCP/PSP PCI device ID. Signed-off-by: John Allen <john.allen@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-14crypto: marvell/cesa - Avoid empty transfer descriptorHerbert Xu
The user may set req->src even if req->nbytes == 0. If there is no data to hash from req->src, do not generate an empty TDMA descriptor. Fixes: db509a45339f ("crypto: marvell/cesa - add TDMA support") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-14crypto: marvell/cesa - Handle zero-length skcipher requestsHerbert Xu
Do not access random memory for zero-length skcipher requests. Just return 0. Fixes: f63601fd616a ("crypto: marvell/cesa - add a new driver for Marvell's CESA") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-14crypto: powerpc/poly1305 - Add SIMD fallbackHerbert Xu
Add a SIMD fallback path for poly1305-p10 by converting the 2^64 based hash state into a 2^44 base. In order to ensure that the generic fallback is actually 2^44, add ARCH_SUPPORTS_INT128 to powerpc and make poly1305-p10 depend on it. Fixes: ba8f8624fde2 ("crypto: poly1305-p10 - Glue code for optmized Poly1305 implementation for ppc64le") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-14crypto: iaa - Optimize rebalance_wq_table()Yury Norov
The function opencodes for_each_cpu() by using a plain for-loop. The loop calls cpumask_weight() inside the conditional section. Because cpumask_weight() is O(1), the overall complexity of the function is O(node * node_cpus^2). Also, cpumask_nth() internally calls hweight(), which, if not hardware accelerated, is slower than cpumask_next() in for_each_cpu(). If switched to the dedicated for_each_cpu(), the rebalance_wq_table() can drop calling cpumask_weight(), together with some housekeeping code. This makes the overall complexity O(node * node_cpus), or simply speaking O(nr_cpu_ids). While there, fix opencoded for_each_possible_cpu() too. Signed-off-by: Yury Norov <yury.norov@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-14crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe()Dan Carpenter
The pcim_iomap_region() returns error pointers. It doesn't return NULL pointers. Update the check to match. Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: testmgr - enable CRYPTO_MANAGER when CRYPTO_SELFTESTSEric Biggers
crypto/testmgr.c is compiled only when CRYPTO_MANAGER is enabled. To make CRYPTO_SELFTESTS work as expected when CRYPTO_MANAGER doesn't get enabled for another reason, automatically set CRYPTO_MANAGER to the value of CRYPTO_ALGAPI when CRYPTO_SELFTESTS is enabled. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: Kconfig - make CRYPTO_MANAGER a hidden symbolEric Biggers
There is no reason for people configuring the kernel to be asked about CRYPTO_MANAGER, so make it a hidden symbol. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: testmgr - rename noextratests to noslowtestsEric Biggers
Rename the noextratests module parameter to noslowtests, and replace other remaining mentions of "extra" in the code with "slow". This addresses confusion regarding the word "extra" like that seen at https://lore.kernel.org/r/6cecf2de-9aa0-f6ea-0c2d-8e974a1a820b@huawei.com/. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: testmgr - make it easier to enable the full set of testsEric Biggers
Currently the full set of crypto self-tests requires CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y. This is problematic in two ways. First, developers regularly overlook this option. Second, the description of the tests as "extra" sometimes gives the impression that it is not required that all algorithms pass these tests. Given that the main use case for the crypto self-tests is for developers, make enabling CONFIG_CRYPTO_SELFTESTS=y just enable the full set of crypto self-tests by default. The slow tests can still be disabled by adding the command-line parameter cryptomgr.noextratests=1, soon to be renamed to cryptomgr.noslowtests=1. The only known use case for doing this is for people trying to use the crypto self-tests to satisfy the FIPS 140-3 pre-operational self-testing requirements when the kernel is being validated as a FIPS 140-3 cryptographic module. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: testmgr - replace CRYPTO_MANAGER_DISABLE_TESTS with CRYPTO_SELFTESTSEric Biggers
The negative-sense of CRYPTO_MANAGER_DISABLE_TESTS is a longstanding mistake that regularly causes confusion. Especially bad is that you can have CRYPTO=n && CRYPTO_MANAGER_DISABLE_TESTS=n, which is ambiguous. Replace CRYPTO_MANAGER_DISABLE_TESTS with CRYPTO_SELFTESTS which has the expected behavior. The tests continue to be disabled by default. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: testmgr - remove panic_on_failEric Biggers
The cryptomgr.panic_on_fail=1 kernel command-line parameter is not very useful now that the tests have been fixed to WARN on failure, since developers can just use panic_on_warn=1 instead. There's no need for a special option just for the crypto self-tests. Remove it. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: tcrypt - rename CRYPTO_TEST to CRYPTO_BENCHMARKEric Biggers
tcrypt is actually a benchmarking module and not the actual tests. This regularly causes confusion. Update the kconfig option name and help text accordingly. Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: null - use memcpy_sglist()Eric Biggers
Make null_skcipher_crypt() use memcpy_sglist() instead of the skcipher_walk API, as this is simpler. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: null - merge CRYPTO_NULL2 into CRYPTO_NULLEric Biggers
There is no reason to have separate CRYPTO_NULL2 and CRYPTO_NULL options. Just merge them into CRYPTO_NULL. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: null - remove the default null skcipherEric Biggers
crypto_get_default_null_skcipher() and crypto_put_default_null_skcipher() are no longer used, so remove them. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: krb5enc - do not select CRYPTO_NULLEric Biggers
The krb5enc code does not use any of the so-called "null algorithms", so it does not need to select CRYPTO_NULL. Presumably this unused dependency got copied from one of the other kconfig options. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: geniv - use memcpy_sglist() instead of null skcipherEric Biggers
For copying data between two scatterlists, just use memcpy_sglist() instead of the so-called "null skcipher". This is much simpler. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: gcm - use memcpy_sglist() instead of null skcipherEric Biggers
For copying data between two scatterlists, just use memcpy_sglist() instead of the so-called "null skcipher". This is much simpler. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: authenc - use memcpy_sglist() instead of null skcipherEric Biggers
For copying data between two scatterlists, just use memcpy_sglist() instead of the so-called "null skcipher". This is much simpler. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: algif_aead - use memcpy_sglist() instead of null skcipherEric Biggers
For copying data between two scatterlists, just use memcpy_sglist() instead of the so-called "null skcipher". This is much simpler. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: lib/chacha - add array bounds to function prototypesEric Biggers
Add explicit array bounds to the function prototypes for the parameters that didn't already get handled by the conversion to use chacha_state: - chacha_block_*(): Change 'u8 *out' or 'u8 *stream' to u8 out[CHACHA_BLOCK_SIZE]. - hchacha_block_*(): Change 'u32 *out' or 'u32 *stream' to u32 out[HCHACHA_OUT_WORDS]. - chacha_init(): Change 'const u32 *key' to 'const u32 key[CHACHA_KEY_WORDS]'. Change 'const u8 *iv' to 'const u8 iv[CHACHA_IV_SIZE]'. No functional changes. This just makes it clear when fixed-size arrays are expected. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: lib/chacha - add strongly-typed state zeroizationEric Biggers
Now that the ChaCha state matrix is strongly-typed, add a helper function chacha_zeroize_state() which zeroizes it. Then convert all applicable callers to use it instead of direct memzero_explicit. No functional changes. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: lib/chacha - use struct assignment to copy stateEric Biggers
Use struct assignment instead of memcpy() in lib/crypto/chacha.c where appropriate. No functional change. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: lib/chacha - strongly type the ChaCha stateEric Biggers
The ChaCha state matrix is 16 32-bit words. Currently it is represented in the code as a raw u32 array, or even just a pointer to u32. This weak typing is error-prone. Instead, introduce struct chacha_state: struct chacha_state { u32 x[16]; }; Convert all ChaCha and HChaCha functions to use struct chacha_state. No functional changes. Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Kent Overstreet <kent.overstreet@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-12crypto: crypto4xx - Remove ahash-related codeHerbert Xu
The hash implementation in crypto4xx has been disabled since 2009. As nobody has tried to fix this remove all the dead code. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-10crypto: powerpc/poly1305 - Add poly1305_emit_arch wrapperHerbert Xu
Add poly1305_emit_arch with fallback instead of calling assembly directly. This is because the state format differs between p10 and that of the generic implementation. Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Reported-by: Eric Biggers <ebiggers@google.com> Fixes: 14d31979145d ("crypto: powerpc/poly1305 - Add block-only interface") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-08crypto: arm64/sha256 - fix build when CONFIG_PREEMPT_VOLUNTARY=yEric Biggers
Fix the build of sha256-ce.S when CONFIG_PREEMPT_VOLUNTARY=y by passing the correct label to the cond_yield macro. Also adjust the code to execute only one branch instruction when CONFIG_PREEMPT_VOLUNTARY=n. Fixes: 6e36be511d28 ("crypto: arm64/sha256 - implement library instead of shash") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202505071811.yYpLUbav-lkp@intel.com/ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-08crypto: powerpc/poly1305 - Add missing poly1305_emit_archHerbert Xu
Rename poly1305_emit_64 to poly1305_emit_arch to conform with the expectation of the poly1305 library. Reported-by: Thorsten Leemhuis <linux@leemhuis.info> Fixes: 14d31979145d ("crypto: powerpc/poly1305 - Add block-only interface") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Tested-by: Thorsten Leemhuis <linux@leemhuis.info> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-07um: Include linux/types.h in asm/fpu/api.hHerbert Xu
Include linux/types.h before using bool. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202505070045.vWc04ygs-lkp@intel.com/ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-06crypto: lib/poly1305 - Build main library on LIB_POLY1305 and split generic ↵Herbert Xu
code out Split the lib poly1305 code just as was done with sha256. Make the main library code conditional on LIB_POLY1305 instead of LIB_POLY1305_GENERIC. Reported-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Fixes: 10a6d72ea355 ("crypto: lib/poly1305 - Use block-only interface") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-05crypto: s390/sha512 - Initialise upper counter to zero for sha384Herbert Xu
Initialise the high bit counter to zero in sha384_init. Also change the state initialisation to use ctx->sha512.state instead of ctx->state for consistency. Fixes: 572b5c4682c7 ("crypto: s390/sha512 - Use API partial block handling") Reported-by: Ingo Franzki <ifranzki@linux.ibm.com> Reported-by: Harald Freudenberger <freude@linux.ibm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-05crypto: padlock-sha - Use core import and export for fallbackHerbert Xu
As padlock-sha is block-only, it needs to use core import and export on the fallback. Also call sha256_block_init instead of sha256_init although this is harmless as sha256_init doesn't write into the partial block area. Fixes: 63dc06cd12f9 ("crypto: padlock-sha - Use API partial block handling") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-05crypto: ahash - Add HASH_REQUEST_ZEROHerbert Xu
Add a helper to zero hash stack requests that were never cloned off the stack. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-05crypto: ahash - Add core export and importHerbert Xu
Add crypto_ahash_export_core and crypto_ahash_import_core. For now they only differ from the normal export/import functions when going through shash. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-04 23:12:44 +0000