projects/linux·blob 2c455ddc · refs

1177 lines · 35.9 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Crypto API support for AES block cipher
4 *
5 * Copyright 2026 Google LLC
6 */
7
8#include <crypto/aes-cbc-macs.h>
9#include <crypto/aes-cbc.h>
10#include <crypto/aes-ccm.h>
11#include <crypto/aes-ctr.h>
12#include <crypto/aes-ecb.h>
13#include <crypto/aes-gcm.h>
14#include <crypto/aes-xts.h>
15#include <crypto/aes.h>
16#include <crypto/algapi.h>
17#include <crypto/internal/aead.h>
18#include <crypto/internal/hash.h>
19#include <crypto/internal/skcipher.h>
20#include <crypto/scatterwalk.h>
21#include <linux/module.h>
22
23static_assert(__alignof__(struct aes_key) <= CRYPTO_MINALIGN);
24static_assert(__alignof__(struct aes_enckey) <= CRYPTO_MINALIGN);
25
26static int crypto_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key,
27 unsigned int key_len)
28{
29 struct aes_key *key = crypto_tfm_ctx(tfm);
30
31 return aes_preparekey(key, in_key, key_len);
32}
33
34static void crypto_aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
35{
36 const struct aes_key *key = crypto_tfm_ctx(tfm);
37
38 aes_encrypt(key, out, in);
39}
40
41static void crypto_aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
42{
43 const struct aes_key *key = crypto_tfm_ctx(tfm);
44
45 aes_decrypt(key, out, in);
46}
47
48static_assert(__alignof__(struct aes_cmac_key) <= CRYPTO_MINALIGN);
49#define AES_CMAC_KEY(tfm) ((struct aes_cmac_key *)crypto_shash_ctx(tfm))
50#define AES_CMAC_CTX(desc) ((struct aes_cmac_ctx *)shash_desc_ctx(desc))
51
52static int __maybe_unused crypto_aes_cmac_setkey(struct crypto_shash *tfm,
53 const u8 *in_key,
54 unsigned int key_len)
55{
56 return aes_cmac_preparekey(AES_CMAC_KEY(tfm), in_key, key_len);
57}
58
59static int __maybe_unused crypto_aes_xcbc_setkey(struct crypto_shash *tfm,
60 const u8 *in_key,
61 unsigned int key_len)
62{
63 if (key_len != AES_KEYSIZE_128)
64 return -EINVAL;
65 aes_xcbcmac_preparekey(AES_CMAC_KEY(tfm), in_key);
66 return 0;
67}
68
69static int __maybe_unused crypto_aes_cmac_init(struct shash_desc *desc)
70{
71 aes_cmac_init(AES_CMAC_CTX(desc), AES_CMAC_KEY(desc->tfm));
72 return 0;
73}
74
75static int __maybe_unused crypto_aes_cmac_update(struct shash_desc *desc,
76 const u8 *data,
77 unsigned int len)
78{
79 aes_cmac_update(AES_CMAC_CTX(desc), data, len);
80 return 0;
81}
82
83static int __maybe_unused crypto_aes_cmac_final(struct shash_desc *desc,
84 u8 *out)
85{
86 aes_cmac_final(AES_CMAC_CTX(desc), out);
87 return 0;
88}
89
90static int __maybe_unused crypto_aes_cmac_digest(struct shash_desc *desc,
91 const u8 *data,
92 unsigned int len, u8 *out)
93{
94 aes_cmac(AES_CMAC_KEY(desc->tfm), data, len, out);
95 return 0;
96}
97
98#define AES_CBCMAC_KEY(tfm) ((struct aes_enckey *)crypto_shash_ctx(tfm))
99#define AES_CBCMAC_CTX(desc) ((struct aes_cbcmac_ctx *)shash_desc_ctx(desc))
100
101static int __maybe_unused crypto_aes_cbcmac_setkey(struct crypto_shash *tfm,
102 const u8 *in_key,
103 unsigned int key_len)
104{
105 return aes_prepareenckey(AES_CBCMAC_KEY(tfm), in_key, key_len);
106}
107
108static int __maybe_unused crypto_aes_cbcmac_init(struct shash_desc *desc)
109{
110 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm));
111 return 0;
112}
113
114static int __maybe_unused crypto_aes_cbcmac_update(struct shash_desc *desc,
115 const u8 *data,
116 unsigned int len)
117{
118 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len);
119 return 0;
120}
121
122static int __maybe_unused crypto_aes_cbcmac_final(struct shash_desc *desc,
123 u8 *out)
124{
125 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out);
126 return 0;
127}
128
129static int __maybe_unused crypto_aes_cbcmac_digest(struct shash_desc *desc,
130 const u8 *data,
131 unsigned int len, u8 *out)
132{
133 aes_cbcmac_init(AES_CBCMAC_CTX(desc), AES_CBCMAC_KEY(desc->tfm));
134 aes_cbcmac_update(AES_CBCMAC_CTX(desc), data, len);
135 aes_cbcmac_final(AES_CBCMAC_CTX(desc), out);
136 return 0;
137}
138
139static struct crypto_alg alg = {
140 .cra_name = "aes",
141 .cra_driver_name = "aes-lib",
142 .cra_priority = 100,
143 .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
144 .cra_blocksize = AES_BLOCK_SIZE,
145 .cra_ctxsize = sizeof(struct aes_key),
146 .cra_module = THIS_MODULE,
147 .cra_u = { .cipher = { .cia_min_keysize = AES_MIN_KEY_SIZE,
148 .cia_max_keysize = AES_MAX_KEY_SIZE,
149 .cia_setkey = crypto_aes_setkey,
150 .cia_encrypt = crypto_aes_encrypt,
151 .cia_decrypt = crypto_aes_decrypt } }
152};
153
154static struct shash_alg mac_algs[] = {
155#if IS_ENABLED(CONFIG_CRYPTO_CMAC)
156 {
157 .base.cra_name = "cmac(aes)",
158 .base.cra_driver_name = "cmac-aes-lib",
159 .base.cra_priority = 300,
160 .base.cra_blocksize = AES_BLOCK_SIZE,
161 .base.cra_ctxsize = sizeof(struct aes_cmac_key),
162 .base.cra_module = THIS_MODULE,
163 .digestsize = AES_BLOCK_SIZE,
164 .setkey = crypto_aes_cmac_setkey,
165 .init = crypto_aes_cmac_init,
166 .update = crypto_aes_cmac_update,
167 .final = crypto_aes_cmac_final,
168 .digest = crypto_aes_cmac_digest,
169 .descsize = sizeof(struct aes_cmac_ctx),
170 },
171#endif
172#if IS_ENABLED(CONFIG_CRYPTO_XCBC)
173 {
174 /*
175 * Note that the only difference between xcbc(aes) and cmac(aes)
176 * is the preparekey function.
177 */
178 .base.cra_name = "xcbc(aes)",
179 .base.cra_driver_name = "xcbc-aes-lib",
180 .base.cra_priority = 300,
181 .base.cra_blocksize = AES_BLOCK_SIZE,
182 .base.cra_ctxsize = sizeof(struct aes_cmac_key),
183 .base.cra_module = THIS_MODULE,
184 .digestsize = AES_BLOCK_SIZE,
185 .setkey = crypto_aes_xcbc_setkey,
186 .init = crypto_aes_cmac_init,
187 .update = crypto_aes_cmac_update,
188 .final = crypto_aes_cmac_final,
189 .digest = crypto_aes_cmac_digest,
190 .descsize = sizeof(struct aes_cmac_ctx),
191 },
192#endif
193#if IS_ENABLED(CONFIG_CRYPTO_CCM)
194 {
195 .base.cra_name = "cbcmac(aes)",
196 .base.cra_driver_name = "cbcmac-aes-lib",
197 .base.cra_priority = 300,
198 .base.cra_blocksize = AES_BLOCK_SIZE,
199 .base.cra_ctxsize = sizeof(struct aes_enckey),
200 .base.cra_module = THIS_MODULE,
201 .digestsize = AES_BLOCK_SIZE,
202 .setkey = crypto_aes_cbcmac_setkey,
203 .init = crypto_aes_cbcmac_init,
204 .update = crypto_aes_cbcmac_update,
205 .final = crypto_aes_cbcmac_final,
206 .digest = crypto_aes_cbcmac_digest,
207 .descsize = sizeof(struct aes_cbcmac_ctx),
208 },
209#endif
210};
211
212static __maybe_unused int
213crypto_aes_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *in_key,
214 unsigned int key_len)
215{
216 struct aes_key *key = crypto_skcipher_ctx(tfm);
217
218 return aes_preparekey(key, in_key, key_len);
219}
220
221static __maybe_unused int
222crypto_aes_skcipher_setenckey(struct crypto_skcipher *tfm, const u8 *in_key,
223 unsigned int key_len)
224{
225 struct aes_enckey *key = crypto_skcipher_ctx(tfm);
226
227 return aes_prepareenckey(key, in_key, key_len);
228}
229
230/*
231 * Return true if the request uses only a single scatterlist element and high
232 * memory isn't enabled. This assumes that both scatterlists are non-NULL, i.e.
233 * the caller must have handled the cryptlen == 0 case already.
234 */
235static inline bool
236skcipher_request_is_linear_lowmem(const struct skcipher_request *req)
237{
238 return !IS_ENABLED(CONFIG_HIGHMEM) &&
239 req->dst->length >= req->cryptlen &&
240 req->src->length >= req->cryptlen;
241}
242
243/*
244 * Call crypt_func() (a function that operates on simple virtual addresses) zero
245 * or more times to en/decrypt 'cryptlen' bytes of data from the source
246 * scatterlist 'src' and write it into the destination scatterlist 'dst',
247 * starting at 'start_pos' bytes into both.
248 *
249 * This always calls crypt_func() with a length that's a multiple of
250 * AES_BLOCK_SIZE, except the last call which includes any remainder. This is
251 * implemented by using an on-stack bounce buffer when necessary. The current
252 * implementation also tries to prefer passing at least 4 blocks, so e.g.
253 * scatterlist entries [16,16,16,16] result in a single 64-byte call.
254 *
255 * The scatterlists must describe either entirely different memory
256 * (out-of-place) or entirely the same memory (in-place). In the latter case,
257 * crypt_func() is always called with the source and dest pointers the same.
258 */
259#define AES_CRYPT_SG(crypt_func, dst, src, cryptlen, start_pos, ...) \
260 ({ \
261 unsigned int remaining = (cryptlen); \
262 unsigned int spos = (start_pos); \
263 \
264 if (remaining != 0) { \
265 struct scatter_walk dst_walk, src_walk; \
266 u8 tmp[4 * AES_BLOCK_SIZE] __aligned( \
267 __alignof__(long)); \
268 \
269 scatterwalk_start_at_pos(&dst_walk, (dst), spos); \
270 scatterwalk_start_at_pos(&src_walk, (src), spos); \
271 do { \
272 unsigned int dst_avail = scatterwalk_clamp( \
273 &dst_walk, remaining); \
274 unsigned int src_avail = scatterwalk_clamp( \
275 &src_walk, remaining); \
276 unsigned int n = min(dst_avail, src_avail); \
277 u8 *dst_virt; \
278 const u8 *src_virt; \
279 \
280 if (n < remaining) { \
281 if (n < sizeof(tmp)) { \
282 n = min(remaining, \
283 sizeof(tmp)); \
284 memcpy_from_scatterwalk( \
285 tmp, &src_walk, n); \
286 crypt_func(tmp, tmp, n, \
287 ##__VA_ARGS__); \
288 memcpy_to_scatterwalk( \
289 &dst_walk, tmp, n); \
290 remaining -= n; \
291 continue; \
292 } \
293 n = round_down(n, AES_BLOCK_SIZE); \
294 } \
295 \
296 scatterwalk_map(&dst_walk); \
297 dst_virt = dst_walk.addr; \
298 if (IS_ENABLED(CONFIG_HIGHMEM) && \
299 offset_in_page(src_walk.offset) == \
300 offset_in_page(dst_walk.offset) && \
301 sg_page(src_walk.sg) + (src_walk.offset / \
302 PAGE_SIZE) == \
303 sg_page(dst_walk.sg) + \
304 (dst_walk.offset / \
305 PAGE_SIZE)) { \
306 src_virt = dst_virt; \
307 } else { \
308 scatterwalk_map(&src_walk); \
309 src_virt = src_walk.addr; \
310 } \
311 crypt_func(dst_virt, src_virt, n, \
312 ##__VA_ARGS__); \
313 if (src_virt != dst_virt) \
314 scatterwalk_unmap(&src_walk); \
315 scatterwalk_advance(&src_walk, n); \
316 scatterwalk_done_dst(&dst_walk, n); \
317 remaining -= n; \
318 } while (remaining); \
319 memzero_explicit(tmp, sizeof(tmp)); \
320 } \
321 })
322
323/*
324 * Call ad_func() as needed to process the associated data in the first
325 * 'assoclen' bytes of the scatterlist 'src'.
326 */
327#define AES_PROCESS_ASSOC_DATA(ad_func, src, assoclen, ctx) \
328 ({ \
329 unsigned int remaining = (assoclen); \
330 \
331 if (remaining != 0) { \
332 struct scatter_walk walk; \
333 \
334 scatterwalk_start(&walk, (src)); \
335 do { \
336 unsigned int n = \
337 scatterwalk_next(&walk, remaining); \
338 \
339 ad_func((ctx), walk.addr, n); \
340 scatterwalk_done_src(&walk, n); \
341 remaining -= n; \
342 } while (remaining); \
343 } \
344 })
345
346/* AES-ECB */
347
348static __maybe_unused int crypto_aes_ecb_encrypt(struct skcipher_request *req)
349{
350 const struct aes_key *key =
351 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
352
353 if (unlikely(req->cryptlen % AES_BLOCK_SIZE))
354 return -EINVAL;
355 AES_CRYPT_SG(aes_ecb_encrypt, req->dst, req->src, req->cryptlen, 0,
356 key);
357 return 0;
358}
359
360static __maybe_unused int crypto_aes_ecb_decrypt(struct skcipher_request *req)
361{
362 const struct aes_key *key =
363 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
364
365 if (unlikely(req->cryptlen % AES_BLOCK_SIZE))
366 return -EINVAL;
367 AES_CRYPT_SG(aes_ecb_decrypt, req->dst, req->src, req->cryptlen, 0,
368 key);
369 return 0;
370}
371
372/* AES-CBC */
373
374static void crypto_aes_cbc_encrypt_sg(struct skcipher_request *req,
375 unsigned int cryptlen,
376 const struct aes_key *key)
377{
378 AES_CRYPT_SG(aes_cbc_encrypt, req->dst, req->src, cryptlen, 0, req->iv,
379 key);
380}
381
382static void crypto_aes_cbc_decrypt_sg(struct skcipher_request *req,
383 unsigned int cryptlen,
384 const struct aes_key *key)
385{
386 AES_CRYPT_SG(aes_cbc_decrypt, req->dst, req->src, cryptlen, 0, req->iv,
387 key);
388}
389
390static __maybe_unused int crypto_aes_cbc_encrypt(struct skcipher_request *req)
391{
392 const struct aes_key *key =
393 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
394
395 if (unlikely(req->cryptlen % AES_BLOCK_SIZE))
396 return -EINVAL;
397 crypto_aes_cbc_encrypt_sg(req, req->cryptlen, key);
398 return 0;
399}
400
401static __maybe_unused int crypto_aes_cbc_decrypt(struct skcipher_request *req)
402{
403 const struct aes_key *key =
404 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
405
406 if (unlikely(req->cryptlen % AES_BLOCK_SIZE))
407 return -EINVAL;
408 crypto_aes_cbc_decrypt_sg(req, req->cryptlen, key);
409 return 0;
410}
411
412/* AES-CBC-CTS */
413
414/*
415 * This handles AES-CBC-CTS en/decryption requests that use a nonlinear
416 * scatterlist layout or where HIGHMEM is enabled. It is explicitly 'noinline'
417 * to keep the temporary buffer out of the stack frame of the fast path.
418 */
419static noinline int
420crypto_aes_cbc_cts_crypt_nonlinear(struct skcipher_request *req, bool enc)
421{
422 const struct aes_key *key =
423 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
424 unsigned int main_len = req->cryptlen;
425 unsigned int tail_len;
426 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long));
427
428 if (main_len == AES_BLOCK_SIZE) {
429 /* Single block is a special case that just does CBC. */
430 if (enc)
431 crypto_aes_cbc_encrypt_sg(req, main_len, key);
432 else
433 crypto_aes_cbc_decrypt_sg(req, main_len, key);
434 return 0;
435 }
436 /* Just do the last two blocks separately. */
437 tail_len = AES_BLOCK_SIZE + ((main_len - 1) % AES_BLOCK_SIZE) + 1;
438 main_len -= tail_len;
439 if (enc)
440 crypto_aes_cbc_encrypt_sg(req, main_len, key);
441 else
442 crypto_aes_cbc_decrypt_sg(req, main_len, key);
443 memcpy_from_sglist(tmp, req->src, main_len, tail_len);
444 if (enc)
445 aes_cbc_cts_encrypt(tmp, tmp, tail_len, req->iv, key);
446 else
447 aes_cbc_cts_decrypt(tmp, tmp, tail_len, req->iv, key);
448 memcpy_to_sglist(req->dst, main_len, tmp, tail_len);
449 memzero_explicit(tmp, sizeof(tmp));
450 return 0;
451}
452
453static __maybe_unused int
454crypto_aes_cbc_cts_encrypt(struct skcipher_request *req)
455{
456 const struct aes_key *key =
457 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
458
459 if (unlikely(req->cryptlen < AES_BLOCK_SIZE))
460 return -EINVAL;
461 if (likely(skcipher_request_is_linear_lowmem(req))) {
462 /* Fast path */
463 aes_cbc_cts_encrypt(sg_virt(req->dst), sg_virt(req->src),
464 req->cryptlen, req->iv, key);
465 return 0;
466 }
467 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ true);
468}
469
470static __maybe_unused int
471crypto_aes_cbc_cts_decrypt(struct skcipher_request *req)
472{
473 const struct aes_key *key =
474 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
475
476 if (unlikely(req->cryptlen < AES_BLOCK_SIZE))
477 return -EINVAL;
478 if (likely(skcipher_request_is_linear_lowmem(req))) {
479 /* Fast path */
480 aes_cbc_cts_decrypt(sg_virt(req->dst), sg_virt(req->src),
481 req->cryptlen, req->iv, key);
482 return 0;
483 }
484 return crypto_aes_cbc_cts_crypt_nonlinear(req, /* enc= */ false);
485}
486
487/* AES-CTR */
488
489static __maybe_unused int crypto_aes_ctr_crypt(struct skcipher_request *req)
490{
491 const struct aes_enckey *key =
492 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
493
494 AES_CRYPT_SG(aes_ctr, req->dst, req->src, req->cryptlen, 0, req->iv,
495 key);
496 return 0;
497}
498
499/* AES-XCTR */
500
501static __maybe_unused int crypto_aes_xctr_crypt(struct skcipher_request *req)
502{
503 const struct aes_enckey *key =
504 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
505 u64 ctr = 1;
506
507 AES_CRYPT_SG(aes_xctr, req->dst, req->src, req->cryptlen, 0, &ctr,
508 req->iv, key);
509 return 0;
510}
511
512/* AES-XTS */
513
514static __maybe_unused int crypto_aes_xts_setkey(struct crypto_skcipher *tfm,
515 const u8 *in_key,
516 unsigned int key_len)
517{
518 struct aes_xts_key *key = crypto_skcipher_ctx(tfm);
519 int flags = (crypto_skcipher_get_flags(tfm) &
520 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS) ?
521 XTS_FORBID_WEAK_KEYS :
522 0;
523
524 return aes_xts_preparekey(key, in_key, key_len, flags);
525}
526
527static void aes_xts_crypt_wrapper(u8 *dst, const u8 *src, size_t len,
528 u8 iv[AES_BLOCK_SIZE],
529 const struct aes_xts_key *key, bool enc,
530 bool *cont)
531{
532 if (enc)
533 aes_xts_encrypt(dst, src, len, iv, key, *cont);
534 else
535 aes_xts_decrypt(dst, src, len, iv, key, *cont);
536 *cont = true;
537}
538
539/*
540 * This handles AES-XTS en/decryption requests that use a nonlinear scatterlist
541 * layout or where HIGHMEM is enabled. It is explicitly 'noinline' to keep the
542 * temporary buffer out of the stack frame of the fast path.
543 */
544static noinline int crypto_aes_xts_crypt_nonlinear(struct skcipher_request *req,
545 bool enc)
546{
547 const struct aes_xts_key *key =
548 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
549 u8 tmp[2 * AES_BLOCK_SIZE] __aligned(__alignof__(long));
550 unsigned int main_len = req->cryptlen;
551 unsigned int tail_len = main_len % AES_BLOCK_SIZE;
552 bool cont = false;
553
554 if (unlikely(tail_len)) {
555 /*
556 * Ciphertext stealing is needed.
557 * Just do the last two blocks separately.
558 */
559 tail_len += AES_BLOCK_SIZE;
560 main_len -= tail_len;
561 }
562
563 AES_CRYPT_SG(aes_xts_crypt_wrapper, req->dst, req->src, main_len, 0,
564 req->iv, key, enc, &cont);
565
566 if (unlikely(tail_len)) {
567 memcpy_from_sglist(tmp, req->src, main_len, tail_len);
568 aes_xts_crypt_wrapper(tmp, tmp, tail_len, req->iv, key, enc,
569 &cont);
570 memcpy_to_sglist(req->dst, main_len, tmp, tail_len);
571 memzero_explicit(tmp, sizeof(tmp));
572 }
573 return 0;
574}
575
576static __maybe_unused int crypto_aes_xts_encrypt(struct skcipher_request *req)
577{
578 const struct aes_xts_key *key =
579 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
580
581 if (unlikely(req->cryptlen < AES_BLOCK_SIZE))
582 return -EINVAL;
583 if (likely(skcipher_request_is_linear_lowmem(req))) {
584 /* Fast path */
585 aes_xts_encrypt(sg_virt(req->dst), sg_virt(req->src),
586 req->cryptlen, req->iv, key, /* cont= */ false);
587 return 0;
588 }
589 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ true);
590}
591
592static __maybe_unused int crypto_aes_xts_decrypt(struct skcipher_request *req)
593{
594 const struct aes_xts_key *key =
595 crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
596
597 if (unlikely(req->cryptlen < AES_BLOCK_SIZE))
598 return -EINVAL;
599 if (likely(skcipher_request_is_linear_lowmem(req))) {
600 /* Fast path */
601 aes_xts_decrypt(sg_virt(req->dst), sg_virt(req->src),
602 req->cryptlen, req->iv, key, /* cont= */ false);
603 return 0;
604 }
605 return crypto_aes_xts_crypt_nonlinear(req, /* enc= */ false);
606}
607
608static struct skcipher_alg skcipher_algs[] = {
609#if IS_ENABLED(CONFIG_CRYPTO_ECB)
610 {
611 .base.cra_name = "ecb(aes)",
612 .base.cra_driver_name = "ecb-aes-lib",
613 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) ||
614 IS_ENABLED(CONFIG_X86)) ? 500 : 110,
615 .base.cra_blocksize = AES_BLOCK_SIZE,
616 .base.cra_ctxsize = sizeof(struct aes_key),
617 .base.cra_module = THIS_MODULE,
618 .min_keysize = AES_MIN_KEY_SIZE,
619 .max_keysize = AES_MAX_KEY_SIZE,
620 .setkey = crypto_aes_skcipher_setkey,
621 .encrypt = crypto_aes_ecb_encrypt,
622 .decrypt = crypto_aes_ecb_decrypt,
623 },
624#endif
625#if IS_ENABLED(CONFIG_CRYPTO_CBC)
626 {
627 .base.cra_name = "cbc(aes)",
628 .base.cra_driver_name = "cbc-aes-lib",
629 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) ||
630 IS_ENABLED(CONFIG_X86)) ? 500 : 110,
631 .base.cra_blocksize = AES_BLOCK_SIZE,
632 .base.cra_ctxsize = sizeof(struct aes_key),
633 .base.cra_module = THIS_MODULE,
634 .min_keysize = AES_MIN_KEY_SIZE,
635 .max_keysize = AES_MAX_KEY_SIZE,
636 .ivsize = AES_BLOCK_SIZE,
637 .setkey = crypto_aes_skcipher_setkey,
638 .encrypt = crypto_aes_cbc_encrypt,
639 .decrypt = crypto_aes_cbc_decrypt,
640 },
641#endif
642 /*
643 * Don't register library-based "cts(cbc(aes))" on architectures where
644 * it might block a "better" implementation from being instantiated via
645 * the "cts" template. These exclusions are temporary and will go away
646 * as the arch-optimized AES code is migrated into the library.
647 */
648#if IS_ENABLED(CONFIG_CRYPTO_CTS) && \
649 !(IS_ENABLED(CONFIG_ARM) || \
650 IS_ENABLED(CONFIG_ARM64) || \
651 IS_ENABLED(CONFIG_PPC) || \
652 IS_ENABLED(CONFIG_S390) || \
653 IS_ENABLED(CONFIG_SPARC))
654 {
655 .base.cra_name = "cts(cbc(aes))",
656 .base.cra_driver_name = "cts-cbc-aes-lib",
657 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) ||
658 IS_ENABLED(CONFIG_X86)) ? 500 : 110,
659 .base.cra_blocksize = AES_BLOCK_SIZE,
660 .base.cra_ctxsize = sizeof(struct aes_key),
661 .base.cra_module = THIS_MODULE,
662 .min_keysize = AES_MIN_KEY_SIZE,
663 .max_keysize = AES_MAX_KEY_SIZE,
664 .ivsize = AES_BLOCK_SIZE,
665 .setkey = crypto_aes_skcipher_setkey,
666 .encrypt = crypto_aes_cbc_cts_encrypt,
667 .decrypt = crypto_aes_cbc_cts_decrypt,
668 },
669#endif
670#if IS_ENABLED(CONFIG_CRYPTO_CTR)
671 {
672 .base.cra_name = "ctr(aes)",
673 .base.cra_driver_name = "ctr-aes-lib",
674 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) ||
675 IS_ENABLED(CONFIG_X86)) ? 500 : 110,
676 .base.cra_blocksize = 1,
677 .base.cra_ctxsize = sizeof(struct aes_enckey),
678 .base.cra_module = THIS_MODULE,
679 .min_keysize = AES_MIN_KEY_SIZE,
680 .max_keysize = AES_MAX_KEY_SIZE,
681 .ivsize = AES_BLOCK_SIZE,
682 .chunksize = AES_BLOCK_SIZE,
683 .setkey = crypto_aes_skcipher_setenckey,
684 .encrypt = crypto_aes_ctr_crypt,
685 .decrypt = crypto_aes_ctr_crypt,
686 },
687#endif
688#if IS_ENABLED(CONFIG_CRYPTO_XCTR)
689 {
690 .base.cra_name = "xctr(aes)",
691 .base.cra_driver_name = "xctr-aes-lib",
692 .base.cra_priority = IS_ENABLED(CONFIG_X86) ? 500 : 110,
693 .base.cra_blocksize = 1,
694 .base.cra_ctxsize = sizeof(struct aes_enckey),
695 .base.cra_module = THIS_MODULE,
696 .min_keysize = AES_MIN_KEY_SIZE,
697 .max_keysize = AES_MAX_KEY_SIZE,
698 .ivsize = AES_BLOCK_SIZE,
699 .chunksize = AES_BLOCK_SIZE,
700 .setkey = crypto_aes_skcipher_setenckey,
701 .encrypt = crypto_aes_xctr_crypt,
702 .decrypt = crypto_aes_xctr_crypt,
703 },
704#endif
705#if IS_ENABLED(CONFIG_CRYPTO_XTS)
706 {
707 .base.cra_name = "xts(aes)",
708 .base.cra_driver_name = "xts-aes-lib",
709 .base.cra_priority = (IS_ENABLED(CONFIG_RISCV) ||
710 IS_ENABLED(CONFIG_SPARC) ||
711 IS_ENABLED(CONFIG_X86)) ? 500 : 110,
712 .base.cra_blocksize = AES_BLOCK_SIZE,
713 .base.cra_ctxsize = sizeof(struct aes_xts_key),
714 .base.cra_module = THIS_MODULE,
715 .min_keysize = 2 * AES_MIN_KEY_SIZE,
716 .max_keysize = 2 * AES_MAX_KEY_SIZE,
717 .ivsize = AES_BLOCK_SIZE,
718 .setkey = crypto_aes_xts_setkey,
719 .encrypt = crypto_aes_xts_encrypt,
720 .decrypt = crypto_aes_xts_decrypt,
721 },
722#endif
723};
724
725/* AES-GCM */
726
727static __maybe_unused int crypto_aes_gcm_setkey(struct crypto_aead *tfm,
728 const u8 *in_key,
729 unsigned int key_len)
730{
731 struct aes_gcm_key *key = crypto_aead_ctx(tfm);
732
733 return aes_gcm_preparekey(key, in_key, key_len,
734 crypto_aead_authsize(tfm));
735}
736
737static __maybe_unused int crypto_aes_gcm_setauthsize(struct crypto_aead *tfm,
738 unsigned int authsize)
739{
740 struct aes_gcm_key *key = crypto_aead_ctx(tfm);
741
742 if (crypto_gcm_check_authsize(authsize) != 0)
743 return -EINVAL;
744 /* Synchronize the tag length to the struct aes_gcm_key. */
745 key->authtag_len = authsize;
746 return 0;
747}
748
749static void crypto_aes_gcm_auth_update(struct aes_gcm_ctx *ctx,
750 struct scatterlist *src,
751 unsigned int assoclen)
752{
753 AES_PROCESS_ASSOC_DATA(aes_gcm_auth_update, src, assoclen, ctx);
754}
755
756static void aes_gcm_encrypt_update_helper(u8 *dst, const u8 *src,
757 unsigned int len,
758 struct aes_gcm_ctx *ctx)
759{
760 aes_gcm_encrypt_update(ctx, dst, src, len);
761}
762
763static void aes_gcm_decrypt_update_helper(u8 *dst, const u8 *src,
764 unsigned int len,
765 struct aes_gcm_ctx *ctx)
766{
767 aes_gcm_decrypt_update(ctx, dst, src, len);
768}
769
770static int crypto_aes_gcm_encrypt_common(struct aead_request *req,
771 const struct aes_gcm_key *key,
772 u8 iv[12], unsigned int assoclen)
773{
774 struct aes_gcm_ctx ctx;
775 u8 authtag[16];
776
777 aes_gcm_init(&ctx, iv, key);
778 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen);
779 AES_CRYPT_SG(aes_gcm_encrypt_update_helper, req->dst, req->src,
780 req->cryptlen, req->assoclen, &ctx);
781 aes_gcm_encrypt_final(&ctx, authtag);
782 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag,
783 key->authtag_len);
784 memzero_explicit(authtag, sizeof(authtag));
785 return 0;
786}
787
788static int crypto_aes_gcm_decrypt_common(struct aead_request *req,
789 const struct aes_gcm_key *key,
790 u8 iv[12], unsigned int assoclen)
791{
792 struct aes_gcm_ctx ctx;
793 unsigned int data_len;
794 u8 authtag[16];
795 int err;
796
797 aes_gcm_init(&ctx, iv, key);
798 crypto_aes_gcm_auth_update(&ctx, req->src, assoclen);
799
800 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */
801 data_len = req->cryptlen - key->authtag_len;
802 AES_CRYPT_SG(aes_gcm_decrypt_update_helper, req->dst, req->src,
803 data_len, req->assoclen, &ctx);
804
805 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len,
806 key->authtag_len);
807 err = aes_gcm_decrypt_final(&ctx, authtag);
808 memzero_explicit(authtag, sizeof(authtag));
809 return err;
810}
811
812static __maybe_unused int crypto_aes_gcm_encrypt(struct aead_request *req)
813{
814 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
815 const struct aes_gcm_key *key = crypto_aead_ctx(tfm);
816
817 return crypto_aes_gcm_encrypt_common(req, key, req->iv, req->assoclen);
818}
819
820static __maybe_unused int crypto_aes_gcm_decrypt(struct aead_request *req)
821{
822 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
823 const struct aes_gcm_key *key = crypto_aead_ctx(tfm);
824
825 return crypto_aes_gcm_decrypt_common(req, key, req->iv, req->assoclen);
826}
827
828struct aes_rfc4106_key {
829 struct aes_gcm_key gcm;
830 u8 nonce[4];
831};
832
833static __maybe_unused int crypto_aes_rfc4106_setkey(struct crypto_aead *tfm,
834 const u8 *in_key,
835 unsigned int key_len)
836{
837 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm);
838
839 if (key_len < 4)
840 return -EINVAL;
841
842 key_len -= 4;
843 memcpy(key->nonce, in_key + key_len, 4);
844
845 return aes_gcm_preparekey(&key->gcm, in_key, key_len,
846 crypto_aead_authsize(tfm));
847}
848
849static __maybe_unused int
850crypto_aes_rfc4106_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
851{
852 struct aes_rfc4106_key *key = crypto_aead_ctx(tfm);
853
854 if (crypto_rfc4106_check_authsize(authsize) != 0)
855 return -EINVAL;
856
857 /* Synchronize the tag length to the struct aes_gcm_key. */
858 key->gcm.authtag_len = authsize;
859 return 0;
860}
861
862static __maybe_unused int crypto_aes_rfc4106_encrypt(struct aead_request *req)
863{
864 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
865 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm);
866 u8 iv[12];
867
868 if (crypto_ipsec_check_assoclen(req->assoclen) != 0)
869 return -EINVAL;
870 memcpy(iv, key->nonce, 4);
871 memcpy(&iv[4], req->iv, 8);
872
873 return crypto_aes_gcm_encrypt_common(req, &key->gcm, iv,
874 req->assoclen - 8);
875}
876
877static __maybe_unused int crypto_aes_rfc4106_decrypt(struct aead_request *req)
878{
879 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
880 const struct aes_rfc4106_key *key = crypto_aead_ctx(tfm);
881 u8 iv[12];
882
883 if (crypto_ipsec_check_assoclen(req->assoclen) != 0)
884 return -EINVAL;
885 memcpy(iv, key->nonce, 4);
886 memcpy(&iv[4], req->iv, 8);
887
888 return crypto_aes_gcm_decrypt_common(req, &key->gcm, iv,
889 req->assoclen - 8);
890}
891
892/* AES-CCM */
893
894static __maybe_unused int crypto_aes_ccm_setkey(struct crypto_aead *tfm,
895 const u8 *in_key,
896 unsigned int key_len)
897{
898 struct aes_ccm_key *key = crypto_aead_ctx(tfm);
899
900 return aes_ccm_preparekey(key, in_key, key_len,
901 crypto_aead_authsize(tfm));
902}
903
904static __maybe_unused int crypto_aes_ccm_setauthsize(struct crypto_aead *tfm,
905 unsigned int authsize)
906{
907 struct aes_ccm_key *key = crypto_aead_ctx(tfm);
908
909 if (authsize < 4 || authsize > 16 || authsize % 2)
910 return -EINVAL;
911 /* Synchronize the tag length to the struct aes_ccm_key. */
912 key->authtag_len = authsize;
913 return 0;
914}
915
916static int crypto_aes_ccm_init(struct aes_ccm_ctx *ctx,
917 struct aead_request *req, unsigned int data_len,
918 const struct aes_ccm_key *key)
919{
920 int nonce_len;
921 const u8 *nonce;
922 int err;
923
924 /*
925 * CCM accepts a variable-length nonce between 7 and 13 bytes
926 * inclusively, while crypto_aead assumes a fixed-length IV. This is
927 * worked around by requiring that iv[0] contain '14 - nonce_len' and
928 * iv[1..] contain the actual nonce. Extra bytes at the end are unused.
929 */
930 nonce_len = 14 - (int)req->iv[0];
931 if (unlikely(nonce_len < 7 || nonce_len > 13))
932 return -EINVAL;
933 nonce = &req->iv[1];
934 err = aes_ccm_init(ctx, data_len, req->assoclen, nonce, nonce_len, key);
935 if (unlikely(err))
936 return err;
937 AES_PROCESS_ASSOC_DATA(aes_ccm_auth_update, req->src, req->assoclen,
938 ctx);
939 return 0;
940}
941
942static void aes_ccm_encrypt_update_helper(u8 *dst, const u8 *src,
943 unsigned int len,
944 struct aes_ccm_ctx *ctx)
945{
946 aes_ccm_encrypt_update(ctx, dst, src, len);
947}
948
949static void aes_ccm_decrypt_update_helper(u8 *dst, const u8 *src,
950 unsigned int len,
951 struct aes_ccm_ctx *ctx)
952{
953 aes_ccm_decrypt_update(ctx, dst, src, len);
954}
955
956static __maybe_unused int crypto_aes_ccm_encrypt(struct aead_request *req)
957{
958 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
959 const struct aes_ccm_key *key = crypto_aead_ctx(tfm);
960 struct aes_ccm_ctx ctx;
961 u8 authtag[16];
962 int err;
963
964 err = crypto_aes_ccm_init(&ctx, req, req->cryptlen, key);
965 if (unlikely(err))
966 return err;
967 AES_CRYPT_SG(aes_ccm_encrypt_update_helper, req->dst, req->src,
968 req->cryptlen, req->assoclen, &ctx);
969 aes_ccm_encrypt_final(&ctx, authtag);
970 memcpy_to_sglist(req->dst, req->assoclen + req->cryptlen, authtag,
971 key->authtag_len);
972 memzero_explicit(authtag, sizeof(authtag));
973 return 0;
974}
975
976static __maybe_unused int crypto_aes_ccm_decrypt(struct aead_request *req)
977{
978 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
979 const struct aes_ccm_key *key = crypto_aead_ctx(tfm);
980 unsigned int data_len;
981 struct aes_ccm_ctx ctx;
982 u8 authtag[16];
983 int err;
984
985 /* crypto_aead_decrypt() already checked cryptlen >= authtag_len. */
986 data_len = req->cryptlen - key->authtag_len;
987 err = crypto_aes_ccm_init(&ctx, req, data_len, key);
988 if (unlikely(err))
989 return err;
990 AES_CRYPT_SG(aes_ccm_decrypt_update_helper, req->dst, req->src,
991 data_len, req->assoclen, &ctx);
992 memcpy_from_sglist(authtag, req->src, req->assoclen + data_len,
993 key->authtag_len);
994 err = aes_ccm_decrypt_final(&ctx, authtag);
995 memzero_explicit(authtag, sizeof(authtag));
996 return err;
997}
998
999static struct aead_alg aead_algs[] = {
1000 /*
1001 * Don't register library-based "gcm(aes)" and "rfc4106(gcm(aes))" on
1002 * architectures where they might block a "better" implementation from
1003 * being instantiated via the "gcm" and "rfc4106" templates. These
1004 * exclusions are temporary and will go away as the arch-optimized AES
1005 * code is migrated into the library.
1006 */
1007#if IS_ENABLED(CONFIG_CRYPTO_GCM) && \
1008 !(IS_ENABLED(CONFIG_ARM) || \
1009 IS_ENABLED(CONFIG_ARM64) || \
1010 IS_ENABLED(CONFIG_PPC) || \
1011 IS_ENABLED(CONFIG_S390) || \
1012 IS_ENABLED(CONFIG_SPARC))
1013 {
1014 .base.cra_name = "gcm(aes)",
1015 .base.cra_driver_name = "gcm-aes-lib",
1016 .base.cra_priority = 110,
1017 .base.cra_blocksize = 1,
1018 .base.cra_ctxsize = sizeof(struct aes_gcm_key),
1019 .base.cra_module = THIS_MODULE,
1020 .setkey = crypto_aes_gcm_setkey,
1021 .setauthsize = crypto_aes_gcm_setauthsize,
1022 .encrypt = crypto_aes_gcm_encrypt,
1023 .decrypt = crypto_aes_gcm_decrypt,
1024 .ivsize = GCM_AES_IV_SIZE,
1025 .maxauthsize = AES_BLOCK_SIZE,
1026 .chunksize = AES_BLOCK_SIZE,
1027 },
1028 {
1029 .base.cra_name = "rfc4106(gcm(aes))",
1030 .base.cra_driver_name = "rfc4106-gcm-aes-lib",
1031 .base.cra_priority = 110,
1032 .base.cra_blocksize = 1,
1033 .base.cra_ctxsize = sizeof(struct aes_rfc4106_key),
1034 .base.cra_module = THIS_MODULE,
1035 .setkey = crypto_aes_rfc4106_setkey,
1036 .setauthsize = crypto_aes_rfc4106_setauthsize,
1037 .encrypt = crypto_aes_rfc4106_encrypt,
1038 .decrypt = crypto_aes_rfc4106_decrypt,
1039 .ivsize = GCM_RFC4106_IV_SIZE,
1040 .maxauthsize = AES_BLOCK_SIZE,
1041 .chunksize = AES_BLOCK_SIZE,
1042 },
1043#endif /* CONFIG_CRYPTO_GCM */
1044 /*
1045 * Don't register library-based "ccm(aes)" on architectures where it
1046 * might block a "better" implementation from being instantiated via the
1047 * "ccm" template. These exclusions are temporary and will go away as
1048 * the arch-optimized AES code is migrated into the library.
1049 */
1050#if IS_ENABLED(CONFIG_CRYPTO_CCM) && \
1051 !(IS_ENABLED(CONFIG_ARM) || \
1052 IS_ENABLED(CONFIG_ARM64) || \
1053 IS_ENABLED(CONFIG_PPC) || \
1054 IS_ENABLED(CONFIG_S390) || \
1055 IS_ENABLED(CONFIG_SPARC))
1056 {
1057 .base.cra_name = "ccm(aes)",
1058 .base.cra_driver_name = "ccm-aes-lib",
1059 .base.cra_priority = 110,
1060 .base.cra_blocksize = 1,
1061 .base.cra_ctxsize = sizeof(struct aes_ccm_key),
1062 .base.cra_module = THIS_MODULE,
1063 .setkey = crypto_aes_ccm_setkey,
1064 .setauthsize = crypto_aes_ccm_setauthsize,
1065 .encrypt = crypto_aes_ccm_encrypt,
1066 .decrypt = crypto_aes_ccm_decrypt,
1067 .ivsize = 16,
1068 .maxauthsize = 16,
1069 .chunksize = AES_BLOCK_SIZE,
1070 },
1071#endif /* CONFIG_CRYPTO_CCM */
1072};
1073
1074static int __init crypto_aes_mod_init(void)
1075{
1076 int err = crypto_register_alg(&alg);
1077
1078 if (err)
1079 return err;
1080
1081 if (ARRAY_SIZE(mac_algs) > 0) {
1082 err = crypto_register_shashes(mac_algs, ARRAY_SIZE(mac_algs));
1083 if (err)
1084 goto err_unregister_alg;
1085 } /* Else, CONFIG_CRYPTO_HASH might not be enabled. */
1086
1087 if (ARRAY_SIZE(skcipher_algs) > 0) {
1088 err = crypto_register_skciphers(skcipher_algs,
1089 ARRAY_SIZE(skcipher_algs));
1090 if (err)
1091 goto err_unregister_macs;
1092 }
1093
1094 if (ARRAY_SIZE(aead_algs) > 0) {
1095 err = crypto_register_aeads(aead_algs, ARRAY_SIZE(aead_algs));
1096 if (err)
1097 goto err_unregister_skciphers;
1098 } /* Else, CONFIG_CRYPTO_AEAD might not be enabled. */
1099 return 0;
1100
1101err_unregister_skciphers:
1102 if (ARRAY_SIZE(skcipher_algs) > 0)
1103 crypto_unregister_skciphers(skcipher_algs,
1104 ARRAY_SIZE(skcipher_algs));
1105err_unregister_macs:
1106 if (ARRAY_SIZE(mac_algs) > 0)
1107 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs));
1108err_unregister_alg:
1109 crypto_unregister_alg(&alg);
1110 return err;
1111}
1112module_init(crypto_aes_mod_init);
1113
1114static void __exit crypto_aes_mod_exit(void)
1115{
1116 if (ARRAY_SIZE(aead_algs) > 0)
1117 crypto_unregister_aeads(aead_algs, ARRAY_SIZE(aead_algs));
1118 if (ARRAY_SIZE(skcipher_algs) > 0)
1119 crypto_unregister_skciphers(skcipher_algs,
1120 ARRAY_SIZE(skcipher_algs));
1121 if (ARRAY_SIZE(mac_algs) > 0)
1122 crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs));
1123 crypto_unregister_alg(&alg);
1124}
1125module_exit(crypto_aes_mod_exit);
1126
1127MODULE_DESCRIPTION("Crypto API support for AES block cipher");
1128MODULE_IMPORT_NS("CRYPTO_INTERNAL");
1129MODULE_LICENSE("GPL");
1130MODULE_ALIAS_CRYPTO("aes");
1131MODULE_ALIAS_CRYPTO("aes-lib");
1132#if IS_ENABLED(CONFIG_CRYPTO_CMAC)
1133MODULE_ALIAS_CRYPTO("cmac(aes)");
1134MODULE_ALIAS_CRYPTO("cmac-aes-lib");
1135#endif
1136#if IS_ENABLED(CONFIG_CRYPTO_XCBC)
1137MODULE_ALIAS_CRYPTO("xcbc(aes)");
1138MODULE_ALIAS_CRYPTO("xcbc-aes-lib");
1139#endif
1140#if IS_ENABLED(CONFIG_CRYPTO_CCM)
1141MODULE_ALIAS_CRYPTO("cbcmac(aes)");
1142MODULE_ALIAS_CRYPTO("cbcmac-aes-lib");
1143#endif
1144#if IS_ENABLED(CONFIG_CRYPTO_ECB)
1145MODULE_ALIAS_CRYPTO("ecb(aes)");
1146MODULE_ALIAS_CRYPTO("ecb-aes-lib");
1147#endif
1148#if IS_ENABLED(CONFIG_CRYPTO_CBC)
1149MODULE_ALIAS_CRYPTO("cbc(aes)");
1150MODULE_ALIAS_CRYPTO("cbc-aes-lib");
1151#endif
1152#if IS_ENABLED(CONFIG_CRYPTO_CTS)
1153MODULE_ALIAS_CRYPTO("cts(cbc(aes))");
1154MODULE_ALIAS_CRYPTO("cts-cbc-aes-lib");
1155#endif
1156#if IS_ENABLED(CONFIG_CRYPTO_CTR)
1157MODULE_ALIAS_CRYPTO("ctr(aes)");
1158MODULE_ALIAS_CRYPTO("ctr-aes-lib");
1159#endif
1160#if IS_ENABLED(CONFIG_CRYPTO_XCTR)
1161MODULE_ALIAS_CRYPTO("xctr(aes)");
1162MODULE_ALIAS_CRYPTO("xctr-aes-lib");
1163#endif
1164#if IS_ENABLED(CONFIG_CRYPTO_XTS)
1165MODULE_ALIAS_CRYPTO("xts(aes)");
1166MODULE_ALIAS_CRYPTO("xts-aes-lib");
1167#endif
1168#if IS_ENABLED(CONFIG_CRYPTO_GCM)
1169MODULE_ALIAS_CRYPTO("gcm(aes)");
1170MODULE_ALIAS_CRYPTO("gcm-aes-lib");
1171MODULE_ALIAS_CRYPTO("rfc4106(gcm(aes))");
1172MODULE_ALIAS_CRYPTO("rfc4106-gcm-aes-lib");
1173#endif
1174#if IS_ENABLED(CONFIG_CRYPTO_CCM)
1175MODULE_ALIAS_CRYPTO("ccm(aes)");
1176MODULE_ALIAS_CRYPTO("ccm-aes-lib");
1177#endif