From 295c01f90db2b8b8394e1f7cde59b96d71f98e07 Mon Sep 17 00:00:00 2001 From: Christian Hohnstaedt Date: Sun, 12 Apr 2009 13:01:44 +0800 Subject: crypto: ixp4xx - check firmware for crypto support - the loaded firmware may not support crypto at all or only support DES and 3DES but not AES or support DES, 3DES and AES. - in case of no crypto support of the firmware, the module load will fail. - in case of missing AES support, the AES algorithms are not registered and a warning is printed during module load. Signed-off-by: Christian Hohnstaedt Signed-off-by: Herbert Xu --- drivers/crypto/ixp4xx_crypto.c | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c index af9761ccf9f..9224c1f4931 100644 --- a/drivers/crypto/ixp4xx_crypto.c +++ b/drivers/crypto/ixp4xx_crypto.c @@ -415,6 +415,7 @@ static void crypto_done_action(unsigned long arg) static int init_ixp_crypto(void) { int ret = -ENODEV; + u32 msg[2] = { 0, 0 }; if (! ( ~(*IXP4XX_EXP_CFG2) & (IXP4XX_FEATURE_HASH | IXP4XX_FEATURE_AES | IXP4XX_FEATURE_DES))) { @@ -426,9 +427,35 @@ static int init_ixp_crypto(void) return ret; if (!npe_running(npe_c)) { - npe_load_firmware(npe_c, npe_name(npe_c), dev); + ret = npe_load_firmware(npe_c, npe_name(npe_c), dev); + if (ret) { + return ret; + } + if (npe_recv_message(npe_c, msg, "STATUS_MSG")) + goto npe_error; + } else { + if (npe_send_message(npe_c, msg, "STATUS_MSG")) + goto npe_error; + + if (npe_recv_message(npe_c, msg, "STATUS_MSG")) + goto npe_error; } + switch ((msg[1]>>16) & 0xff) { + case 3: + printk(KERN_WARNING "Firmware of %s lacks AES support\n", + npe_name(npe_c)); + support_aes = 0; + break; + case 4: + case 5: + support_aes = 1; + break; + default: + printk(KERN_ERR "Firmware of %s lacks crypto support\n", + npe_name(npe_c)); + return -ENODEV; + } /* buffer_pool will also be used to sometimes store the hmac, * so assure it is large enough */ @@ -459,6 +486,10 @@ static int init_ixp_crypto(void) qmgr_enable_irq(RECV_QID); return 0; + +npe_error: + printk(KERN_ERR "%s not responding\n", npe_name(npe_c)); + ret = -EIO; err: if (ctx_pool) dma_pool_destroy(ctx_pool); -- cgit v1.2.3 From abe5fa7899fb5809ddc7336d8dd0edd5b2b96665 Mon Sep 17 00:00:00 2001 From: Steffen Klassert Date: Wed, 15 Apr 2009 20:45:03 +0800 Subject: crypto: eseqiv - Fix IV generation for sync algorithms If crypto_ablkcipher_encrypt() returns synchronous, eseqiv_complete2() is called even if req->giv is already the pointer to the generated IV. The generated IV is overwritten with some random data in this case. This patch fixes this by calling eseqiv_complete2() just if the generated IV has to be copied to req->giv. Signed-off-by: Steffen Klassert Signed-off-by: Herbert Xu --- crypto/eseqiv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c index 2a342c8e52b..3ca3b669d5d 100644 --- a/crypto/eseqiv.c +++ b/crypto/eseqiv.c @@ -153,7 +153,8 @@ static int eseqiv_givencrypt(struct skcipher_givcrypt_request *req) if (err) goto out; - eseqiv_complete2(req); + if (giv != req->giv) + eseqiv_complete2(req); out: return err; -- cgit v1.2.3 From 37fc334cc8eb84f5fe0a5a1cbe6a6a68049e142a Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Tue, 21 Apr 2009 13:27:16 +0800 Subject: crypto: api - Fix algorithm module auto-loading The commit a760a6656e6f00bb0144a42a048cf0266646e22c (crypto: api - Fix module load deadlock with fallback algorithms) broke the auto-loading of algorithms that require fallbacks. The problem is that the fallback mask check is missing an and which cauess bits that should be considered to interfere with the result. Reported-by: Chuck Ebbert Signed-off-by: Herbert Xu --- crypto/api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/api.c b/crypto/api.c index 314dab96840..fd2545decb2 100644 --- a/crypto/api.c +++ b/crypto/api.c @@ -221,7 +221,8 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask) request_module(name); - if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask) && + if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask & + CRYPTO_ALG_NEED_FALLBACK) && snprintf(tmp, sizeof(tmp), "%s-all", name) < sizeof(tmp)) request_module(tmp); -- cgit v1.2.3 From acd246b7494c629aa617da49716409566cf52149 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Tue, 21 Apr 2009 13:55:20 +0800 Subject: crypto: padlock - Revert aes-all alias to aes Since the padlock-aes driver doesn't require a fallback (it's only padlock-sha that does), it should use the aes alias rather than aes-all so that ones that do need a fallback can use it. Signed-off-by: Herbert Xu --- drivers/crypto/padlock-aes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c index 3f0fdd18255..856b3cc2558 100644 --- a/drivers/crypto/padlock-aes.c +++ b/drivers/crypto/padlock-aes.c @@ -489,4 +489,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support"); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Michal Ludvig"); -MODULE_ALIAS("aes-all"); +MODULE_ALIAS("aes"); -- cgit v1.2.3