arm64: marvell: add cryptographic engine support for 7k/8k

Hi all,

This series adds support for the Inside Secure SafeXcel EIP197 cryptographic engine which can be found on Marvell Armada 7k and 8k boards. A new cryptographic engine driver is added, as well as the relevant device tree definition for the Armada 7040 DB and 8040 DB boards.

This driver needs two firmwares to work correctly. These firmware are usually used for more advanced operations than the ones supported (as of now), but we still need them to pass the data to the internal cryptographic engine.

This series was tested in various ways on both the Armada 7040 DB and the Armada 8040 DB: using the crypto framework self tests, using tcrypt and while performing various transfers with iperf on top of IPsec.

This series is based on top of v4.12-rc1, and is available at:
https://github.com/atenart/linux v4.12-rc1/7k8k-crypto
I can rebase if needed. Patches adding device tree nodes and modifying the arm64 defconfig have been applied to the mvebu tree already.

I'd like to thank Ofer Heifetz and Igal Liberman who helped me to do this driver by adding functionalities, optimizing functions and testing (a lot).

Thanks,
Antoine

Since v4:
- Added a dma-mask property and updated the default DMA mask to 64.
- Replaced all <asm/dma-mapping.h> to <linux/dma-mapping.h>.
- Rebased on top of 4.12-rc1.

Since v3:
- Updated to use the skcipher API instead of the ablkcipher one.
- Added explicit zeroing of the keys.
- Fixed the DMA mask.
- Removed a few remaining phys_addr_t.

Since v2:
- Used sha*_zero_message_hash definitions instead of custom ones.
- Used memzero_explicit() instead of memset() to avoid leaks.
- Misc cosmetic updates.

Since v1:
- Fixed two compilation issues reported by Kbuild.
- Removed all dma_to_phys() calls and used the dma addresses instead.
- Added a call to dma_set_mask_and_coherent() before calling any DMA API helper.
- Removed some DMA free functions to avoid double-freeing.
- Do not rely on sg_nents_for_len() to get the number of sg anymore.
- Added a dedicated kmalloc'ed cache to use for dma_map_single().

Antoine Tenart (4):
Documentation/bindings: Document the SafeXel cryptographic engine
driver
crypto: inside-secure: add SafeXcel EIP197 crypto engine driver
MAINTAINERS: add a maintainer for the Inside Secure crypto driver
arm64: marvell: dts: add dma-mask in crypto nodes for 7k/8k

 .../bindings/crypto/inside-secure-safexcel.txt     |   29 +
 MAINTAINERS                                        |    6 +
 .../boot/dts/marvell/armada-cp110-master.dtsi      |    1 +
 .../arm64/boot/dts/marvell/armada-cp110-slave.dtsi |    1 +
 drivers/crypto/Kconfig                             |   17 +
 drivers/crypto/Makefile                            |    1 +
 drivers/crypto/inside-secure/Makefile              |    2 +
 drivers/crypto/inside-secure/safexcel.c            |  930 +++++++++++++++++
 drivers/crypto/inside-secure/safexcel.h            |  572 +++++++++++
 drivers/crypto/inside-secure/safexcel_cipher.c     |  556 +++++++++++
 drivers/crypto/inside-secure/safexcel_hash.c       | 1045 ++++++++++++++++++++
 drivers/crypto/inside-secure/safexcel_ring.c       |  157 +++
 12 files changed, 3317 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/crypto/inside-secure-safexcel.txt
 create mode 100644 drivers/crypto/inside-secure/Makefile
 create mode 100644 drivers/crypto/inside-secure/safexcel.c
 create mode 100644 drivers/crypto/inside-secure/safexcel.h
 create mode 100644 drivers/crypto/inside-secure/safexcel_cipher.c
 create mode 100644 drivers/crypto/inside-secure/safexcel_hash.c
 create mode 100644 drivers/crypto/inside-secure/safexcel_ring.c

2.9.4

The Inside Secure Safexcel cryptographic engine is found on some Marvell SoCs (7k/8k). Document the bindings used by its driver.

---
 .../bindings/crypto/inside-secure-safexcel.txt     | 29 ++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/crypto/inside-secure-safexcel.txt

new file mode 100644
index 000000000000..37abbb2ca250
@@ -0,0 +1,29 @@
+Inside Secure SafeXcel cryptographic engine
+
+Required properties:
+- compatible: Should be "inside-secure,safexcel-eip197".
+- reg: Base physical address of the engine and length of memory mapped region.
+- interrupts: Interrupt numbers for the rings and engine.
+- interrupt-names: Should be "ring0", "ring1", "ring2", "ring3", "eip", "mem".
+
+Optional properties:
+- clocks: Reference to the crypto engine clock.
+- dma-mask: The address mask limitation. Defaults to 64.
+
+Example:
+
+	crypto: crypto at 800000 {
+		compatible = "inside-secure,safexcel-eip197";
+		reg = <0x800000 0x200000>;
+		interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING | IRQ_TYPE_LEVEL_HIGH)>,
+			     <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "mem", "ring0", "ring1", "ring2", "ring3",
+				  "eip";
+		clocks = <&cpm_syscon0 1 26>;
+		dma-mask = <0xff 0xffffffff>;
+		status = "disabled";
+	};

2.9.4

Hello,

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Hi Thomas,

Sure, I'll fix this and send a new version :)

Thanks,
Antoine

Antoine T?nart, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Add support for Inside Secure SafeXcel EIP197 cryptographic engine, which can be found on Marvell Armada 7k and 8k boards. This driver currently implements: ecb(aes), cbc(aes), sha1, sha224, sha256 and hmac(sah1) algorithms.

Two firmwares are needed for this engine to work. Their are mostly used for more advanced operations than the ones supported (as of now), but we still need them to pass the data to the internal cryptographic engine.

---
 drivers/crypto/Kconfig                         |   17 +
 drivers/crypto/Makefile                        |    1 +
 drivers/crypto/inside-secure/Makefile          |    2 +
 drivers/crypto/inside-secure/safexcel.c        |  930 +++++++++++++++++++++
 drivers/crypto/inside-secure/safexcel.h        |  572 +++++++++++++
 drivers/crypto/inside-secure/safexcel_cipher.c |  556 +++++++++++++
 drivers/crypto/inside-secure/safexcel_hash.c   | 1045 ++++++++++++++++++++++++
 drivers/crypto/inside-secure/safexcel_ring.c   |  157 ++++
 8 files changed, 3280 insertions(+)
 create mode 100644 drivers/crypto/inside-secure/Makefile
 create mode 100644 drivers/crypto/inside-secure/safexcel.c
 create mode 100644 drivers/crypto/inside-secure/safexcel.h
 create mode 100644 drivers/crypto/inside-secure/safexcel_cipher.c
 create mode 100644 drivers/crypto/inside-secure/safexcel_hash.c
 create mode 100644 drivers/crypto/inside-secure/safexcel_ring.c

index fb1e60f5002e..9cf41cc846bb 100644
@@ -643,4 +643,21 @@ config CRYPTO_DEV_BCM_SPU
 
 source "drivers/crypto/stm32/Kconfig"
 
+config CRYPTO_DEV_SAFEXCEL
+	tristate "Inside Secure's SafeXcel cryptographic engine driver"
+	depends on HAS_DMA && OF
+	depends on (ARM64 && ARCH_MVEBU) || (COMPILE_TEST && 64BIT)
+	select CRYPTO_AES
+	select CRYPTO_BLKCIPHER
+	select CRYPTO_HASH
+	select CRYPTO_HMAC
+	select CRYPTO_SHA1
+	select CRYPTO_SHA256
+	select CRYPTO_SHA512
+	help
+	  This driver interfaces with the SafeXcel EIP-197 cryptographic engine
+	  designed by Inside Secure. Select this if you want to use CBC/ECB
+	  chain mode, AES cipher mode and SHA1/SHA224/SHA256/SHA512 hash
+	  algorithms.
+
 endif # CRYPTO_HW

index 463f33592d93..67572e4afaae 100644
@@ -39,3 +39,4 @@ obj-$(CONFIG_CRYPTO_DEV_UX500) += ux500/
 obj-$(CONFIG_CRYPTO_DEV_VIRTIO) += virtio/
 obj-$(CONFIG_CRYPTO_DEV_VMX) += vmx/
 obj-$(CONFIG_CRYPTO_DEV_BCM_SPU) += bcm/
+obj-$(CONFIG_CRYPTO_DEV_SAFEXCEL) += inside-secure/

new file mode 100644
index 000000000000..302f07dde98c
@@ -0,0 +1,2 @@
+obj-$(CONFIG_CRYPTO_DEV_SAFEXCEL) += crypto_safexcel.o
+crypto_safexcel-objs := safexcel.o safexcel_ring.o safexcel_cipher.o safexcel_hash.o

2.9.4

Part of the diff is not shown here. View the raw message.

A new cryptographic engine driver was added in drivers/crypto/inside-secure. Add myself as a maintainer for this driver.

---
 MAINTAINERS | 6 ++++++
 1 file changed, 6 insertions(+)

index f7d568b8f133..1f2017604f16 100644
@@ -6602,6 +6602,12 @@ F:	Documentation/input/multi-touch-protocol.rst
 F:	drivers/input/input-mt.c
 K:	\b(ABS|SYN)_MT_
 
+INSIDE SECURE CRYPTO DRIVER
+M:	Antoine Tenart <[email protected]>
+F:	drivers/crypto/inside-secure/
+S:	Maintained
+L:	linux-crypto at vger.kernel.org
+
 INTEL ASoC BDW/HSW DRIVERS
 M:	Jie Yang <[email protected]>
 L:	alsa-devel at alsa-project.org (moderated for non-subscribers)

2.9.4

The EIP197 cryptographic engine supports 64 bits address width but is limited to 40 bits on 7k/8k. Add a dma-mask property in the cryptographic engine nodes to reflect this.

---
 arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi | 1 +
 arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi  | 1 +
 2 files changed, 2 insertions(+)

index ac8df5201cd6..e040677b67dc 100644
@@ -241,6 +241,7 @@
 				interrupt-names = "mem", "ring0", "ring1",
 				"ring2", "ring3", "eip";
 				clocks = <&cpm_syscon0 1 26>;
+				dma-mask = <0xff 0xffffffff>;
 				status = "disabled";
 			};
 		};

index 7740a75a8230..1a69fb006f16 100644
@@ -231,6 +231,7 @@
 				interrupt-names = "mem", "ring0", "ring1",
 						  "ring2", "ring3", "eip";
 				clocks = <&cps_syscon0 1 26>;
+				dma-mask = <0xff 0xffffffff>;
 				status = "disabled";
 			};
 		};

2.9.4