xref: /openbmc/linux/net/tls/tls_sw.c (revision 71844fac)
1 /*
2  * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved.
3  * Copyright (c) 2016-2017, Dave Watson <davejwatson@fb.com>. All rights reserved.
4  * Copyright (c) 2016-2017, Lance Chao <lancerchao@fb.com>. All rights reserved.
5  * Copyright (c) 2016, Fridolin Pokorny <fridolin.pokorny@gmail.com>. All rights reserved.
6  * Copyright (c) 2016, Nikos Mavrogiannopoulos <nmav@gnutls.org>. All rights reserved.
7  * Copyright (c) 2018, Covalent IO, Inc. http://covalent.io
8  *
9  * This software is available to you under a choice of one of two
10  * licenses.  You may choose to be licensed under the terms of the GNU
11  * General Public License (GPL) Version 2, available from the file
12  * COPYING in the main directory of this source tree, or the
13  * OpenIB.org BSD license below:
14  *
15  *     Redistribution and use in source and binary forms, with or
16  *     without modification, are permitted provided that the following
17  *     conditions are met:
18  *
19  *      - Redistributions of source code must retain the above
20  *        copyright notice, this list of conditions and the following
21  *        disclaimer.
22  *
23  *      - Redistributions in binary form must reproduce the above
24  *        copyright notice, this list of conditions and the following
25  *        disclaimer in the documentation and/or other materials
26  *        provided with the distribution.
27  *
28  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
29  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
30  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
31  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
32  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
33  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
34  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
35  * SOFTWARE.
36  */
37 
38 #include <linux/sched/signal.h>
39 #include <linux/module.h>
40 #include <crypto/aead.h>
41 
42 #include <net/strparser.h>
43 #include <net/tls.h>
44 
45 #define MAX_IV_SIZE	TLS_CIPHER_AES_GCM_128_IV_SIZE
46 
47 static int __skb_nsg(struct sk_buff *skb, int offset, int len,
48                      unsigned int recursion_level)
49 {
50         int start = skb_headlen(skb);
51         int i, chunk = start - offset;
52         struct sk_buff *frag_iter;
53         int elt = 0;
54 
55         if (unlikely(recursion_level >= 24))
56                 return -EMSGSIZE;
57 
58         if (chunk > 0) {
59                 if (chunk > len)
60                         chunk = len;
61                 elt++;
62                 len -= chunk;
63                 if (len == 0)
64                         return elt;
65                 offset += chunk;
66         }
67 
68         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
69                 int end;
70 
71                 WARN_ON(start > offset + len);
72 
73                 end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]);
74                 chunk = end - offset;
75                 if (chunk > 0) {
76                         if (chunk > len)
77                                 chunk = len;
78                         elt++;
79                         len -= chunk;
80                         if (len == 0)
81                                 return elt;
82                         offset += chunk;
83                 }
84                 start = end;
85         }
86 
87         if (unlikely(skb_has_frag_list(skb))) {
88                 skb_walk_frags(skb, frag_iter) {
89                         int end, ret;
90 
91                         WARN_ON(start > offset + len);
92 
93                         end = start + frag_iter->len;
94                         chunk = end - offset;
95                         if (chunk > 0) {
96                                 if (chunk > len)
97                                         chunk = len;
98                                 ret = __skb_nsg(frag_iter, offset - start, chunk,
99                                                 recursion_level + 1);
100                                 if (unlikely(ret < 0))
101                                         return ret;
102                                 elt += ret;
103                                 len -= chunk;
104                                 if (len == 0)
105                                         return elt;
106                                 offset += chunk;
107                         }
108                         start = end;
109                 }
110         }
111         BUG_ON(len);
112         return elt;
113 }
114 
115 /* Return the number of scatterlist elements required to completely map the
116  * skb, or -EMSGSIZE if the recursion depth is exceeded.
117  */
118 static int skb_nsg(struct sk_buff *skb, int offset, int len)
119 {
120         return __skb_nsg(skb, offset, len, 0);
121 }
122 
123 static void tls_decrypt_done(struct crypto_async_request *req, int err)
124 {
125 	struct aead_request *aead_req = (struct aead_request *)req;
126 	struct scatterlist *sgout = aead_req->dst;
127 	struct tls_sw_context_rx *ctx;
128 	struct tls_context *tls_ctx;
129 	struct scatterlist *sg;
130 	struct sk_buff *skb;
131 	unsigned int pages;
132 	int pending;
133 
134 	skb = (struct sk_buff *)req->data;
135 	tls_ctx = tls_get_ctx(skb->sk);
136 	ctx = tls_sw_ctx_rx(tls_ctx);
137 	pending = atomic_dec_return(&ctx->decrypt_pending);
138 
139 	/* Propagate if there was an err */
140 	if (err) {
141 		ctx->async_wait.err = err;
142 		tls_err_abort(skb->sk, err);
143 	}
144 
145 	/* After using skb->sk to propagate sk through crypto async callback
146 	 * we need to NULL it again.
147 	 */
148 	skb->sk = NULL;
149 
150 	/* Release the skb, pages and memory allocated for crypto req */
151 	kfree_skb(skb);
152 
153 	/* Skip the first S/G entry as it points to AAD */
154 	for_each_sg(sg_next(sgout), sg, UINT_MAX, pages) {
155 		if (!sg)
156 			break;
157 		put_page(sg_page(sg));
158 	}
159 
160 	kfree(aead_req);
161 
162 	if (!pending && READ_ONCE(ctx->async_notify))
163 		complete(&ctx->async_wait.completion);
164 }
165 
166 static int tls_do_decryption(struct sock *sk,
167 			     struct sk_buff *skb,
168 			     struct scatterlist *sgin,
169 			     struct scatterlist *sgout,
170 			     char *iv_recv,
171 			     size_t data_len,
172 			     struct aead_request *aead_req,
173 			     bool async)
174 {
175 	struct tls_context *tls_ctx = tls_get_ctx(sk);
176 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
177 	int ret;
178 
179 	aead_request_set_tfm(aead_req, ctx->aead_recv);
180 	aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
181 	aead_request_set_crypt(aead_req, sgin, sgout,
182 			       data_len + tls_ctx->rx.tag_size,
183 			       (u8 *)iv_recv);
184 
185 	if (async) {
186 		/* Using skb->sk to push sk through to crypto async callback
187 		 * handler. This allows propagating errors up to the socket
188 		 * if needed. It _must_ be cleared in the async handler
189 		 * before kfree_skb is called. We _know_ skb->sk is NULL
190 		 * because it is a clone from strparser.
191 		 */
192 		skb->sk = sk;
193 		aead_request_set_callback(aead_req,
194 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
195 					  tls_decrypt_done, skb);
196 		atomic_inc(&ctx->decrypt_pending);
197 	} else {
198 		aead_request_set_callback(aead_req,
199 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
200 					  crypto_req_done, &ctx->async_wait);
201 	}
202 
203 	ret = crypto_aead_decrypt(aead_req);
204 	if (ret == -EINPROGRESS) {
205 		if (async)
206 			return ret;
207 
208 		ret = crypto_wait_req(ret, &ctx->async_wait);
209 	}
210 
211 	if (async)
212 		atomic_dec(&ctx->decrypt_pending);
213 
214 	return ret;
215 }
216 
217 static void tls_trim_both_msgs(struct sock *sk, int target_size)
218 {
219 	struct tls_context *tls_ctx = tls_get_ctx(sk);
220 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
221 	struct tls_rec *rec = ctx->open_rec;
222 
223 	sk_msg_trim(sk, &rec->msg_plaintext, target_size);
224 	if (target_size > 0)
225 		target_size += tls_ctx->tx.overhead_size;
226 	sk_msg_trim(sk, &rec->msg_encrypted, target_size);
227 }
228 
229 static int tls_alloc_encrypted_msg(struct sock *sk, int len)
230 {
231 	struct tls_context *tls_ctx = tls_get_ctx(sk);
232 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
233 	struct tls_rec *rec = ctx->open_rec;
234 	struct sk_msg *msg_en = &rec->msg_encrypted;
235 
236 	return sk_msg_alloc(sk, msg_en, len, 0);
237 }
238 
239 static int tls_clone_plaintext_msg(struct sock *sk, int required)
240 {
241 	struct tls_context *tls_ctx = tls_get_ctx(sk);
242 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
243 	struct tls_rec *rec = ctx->open_rec;
244 	struct sk_msg *msg_pl = &rec->msg_plaintext;
245 	struct sk_msg *msg_en = &rec->msg_encrypted;
246 	int skip, len;
247 
248 	/* We add page references worth len bytes from encrypted sg
249 	 * at the end of plaintext sg. It is guaranteed that msg_en
250 	 * has enough required room (ensured by caller).
251 	 */
252 	len = required - msg_pl->sg.size;
253 
254 	/* Skip initial bytes in msg_en's data to be able to use
255 	 * same offset of both plain and encrypted data.
256 	 */
257 	skip = tls_ctx->tx.prepend_size + msg_pl->sg.size;
258 
259 	return sk_msg_clone(sk, msg_pl, msg_en, skip, len);
260 }
261 
262 static struct tls_rec *tls_get_rec(struct sock *sk)
263 {
264 	struct tls_context *tls_ctx = tls_get_ctx(sk);
265 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
266 	struct sk_msg *msg_pl, *msg_en;
267 	struct tls_rec *rec;
268 	int mem_size;
269 
270 	mem_size = sizeof(struct tls_rec) + crypto_aead_reqsize(ctx->aead_send);
271 
272 	rec = kzalloc(mem_size, sk->sk_allocation);
273 	if (!rec)
274 		return NULL;
275 
276 	msg_pl = &rec->msg_plaintext;
277 	msg_en = &rec->msg_encrypted;
278 
279 	sk_msg_init(msg_pl);
280 	sk_msg_init(msg_en);
281 
282 	sg_init_table(rec->sg_aead_in, 2);
283 	sg_set_buf(&rec->sg_aead_in[0], rec->aad_space,
284 		   sizeof(rec->aad_space));
285 	sg_unmark_end(&rec->sg_aead_in[1]);
286 
287 	sg_init_table(rec->sg_aead_out, 2);
288 	sg_set_buf(&rec->sg_aead_out[0], rec->aad_space,
289 		   sizeof(rec->aad_space));
290 	sg_unmark_end(&rec->sg_aead_out[1]);
291 
292 	return rec;
293 }
294 
295 static void tls_free_rec(struct sock *sk, struct tls_rec *rec)
296 {
297 	sk_msg_free(sk, &rec->msg_encrypted);
298 	sk_msg_free(sk, &rec->msg_plaintext);
299 	kfree(rec);
300 }
301 
302 static void tls_free_open_rec(struct sock *sk)
303 {
304 	struct tls_context *tls_ctx = tls_get_ctx(sk);
305 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
306 	struct tls_rec *rec = ctx->open_rec;
307 
308 	if (rec) {
309 		tls_free_rec(sk, rec);
310 		ctx->open_rec = NULL;
311 	}
312 }
313 
314 int tls_tx_records(struct sock *sk, int flags)
315 {
316 	struct tls_context *tls_ctx = tls_get_ctx(sk);
317 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
318 	struct tls_rec *rec, *tmp;
319 	struct sk_msg *msg_en;
320 	int tx_flags, rc = 0;
321 
322 	if (tls_is_partially_sent_record(tls_ctx)) {
323 		rec = list_first_entry(&ctx->tx_list,
324 				       struct tls_rec, list);
325 
326 		if (flags == -1)
327 			tx_flags = rec->tx_flags;
328 		else
329 			tx_flags = flags;
330 
331 		rc = tls_push_partial_record(sk, tls_ctx, tx_flags);
332 		if (rc)
333 			goto tx_err;
334 
335 		/* Full record has been transmitted.
336 		 * Remove the head of tx_list
337 		 */
338 		list_del(&rec->list);
339 		sk_msg_free(sk, &rec->msg_plaintext);
340 		kfree(rec);
341 	}
342 
343 	/* Tx all ready records */
344 	list_for_each_entry_safe(rec, tmp, &ctx->tx_list, list) {
345 		if (READ_ONCE(rec->tx_ready)) {
346 			if (flags == -1)
347 				tx_flags = rec->tx_flags;
348 			else
349 				tx_flags = flags;
350 
351 			msg_en = &rec->msg_encrypted;
352 			rc = tls_push_sg(sk, tls_ctx,
353 					 &msg_en->sg.data[msg_en->sg.curr],
354 					 0, tx_flags);
355 			if (rc)
356 				goto tx_err;
357 
358 			list_del(&rec->list);
359 			sk_msg_free(sk, &rec->msg_plaintext);
360 			kfree(rec);
361 		} else {
362 			break;
363 		}
364 	}
365 
366 tx_err:
367 	if (rc < 0 && rc != -EAGAIN)
368 		tls_err_abort(sk, EBADMSG);
369 
370 	return rc;
371 }
372 
373 static void tls_encrypt_done(struct crypto_async_request *req, int err)
374 {
375 	struct aead_request *aead_req = (struct aead_request *)req;
376 	struct sock *sk = req->data;
377 	struct tls_context *tls_ctx = tls_get_ctx(sk);
378 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
379 	struct scatterlist *sge;
380 	struct sk_msg *msg_en;
381 	struct tls_rec *rec;
382 	bool ready = false;
383 	int pending;
384 
385 	rec = container_of(aead_req, struct tls_rec, aead_req);
386 	msg_en = &rec->msg_encrypted;
387 
388 	sge = sk_msg_elem(msg_en, msg_en->sg.curr);
389 	sge->offset -= tls_ctx->tx.prepend_size;
390 	sge->length += tls_ctx->tx.prepend_size;
391 
392 	/* Check if error is previously set on socket */
393 	if (err || sk->sk_err) {
394 		rec = NULL;
395 
396 		/* If err is already set on socket, return the same code */
397 		if (sk->sk_err) {
398 			ctx->async_wait.err = sk->sk_err;
399 		} else {
400 			ctx->async_wait.err = err;
401 			tls_err_abort(sk, err);
402 		}
403 	}
404 
405 	if (rec) {
406 		struct tls_rec *first_rec;
407 
408 		/* Mark the record as ready for transmission */
409 		smp_store_mb(rec->tx_ready, true);
410 
411 		/* If received record is at head of tx_list, schedule tx */
412 		first_rec = list_first_entry(&ctx->tx_list,
413 					     struct tls_rec, list);
414 		if (rec == first_rec)
415 			ready = true;
416 	}
417 
418 	pending = atomic_dec_return(&ctx->encrypt_pending);
419 
420 	if (!pending && READ_ONCE(ctx->async_notify))
421 		complete(&ctx->async_wait.completion);
422 
423 	if (!ready)
424 		return;
425 
426 	/* Schedule the transmission */
427 	if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
428 		schedule_delayed_work(&ctx->tx_work.work, 1);
429 }
430 
431 static int tls_do_encryption(struct sock *sk,
432 			     struct tls_context *tls_ctx,
433 			     struct tls_sw_context_tx *ctx,
434 			     struct aead_request *aead_req,
435 			     size_t data_len, u32 start)
436 {
437 	struct tls_rec *rec = ctx->open_rec;
438 	struct sk_msg *msg_en = &rec->msg_encrypted;
439 	struct scatterlist *sge = sk_msg_elem(msg_en, start);
440 	int rc;
441 
442 	sge->offset += tls_ctx->tx.prepend_size;
443 	sge->length -= tls_ctx->tx.prepend_size;
444 
445 	msg_en->sg.curr = start;
446 
447 	aead_request_set_tfm(aead_req, ctx->aead_send);
448 	aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
449 	aead_request_set_crypt(aead_req, rec->sg_aead_in,
450 			       rec->sg_aead_out,
451 			       data_len, tls_ctx->tx.iv);
452 
453 	aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
454 				  tls_encrypt_done, sk);
455 
456 	/* Add the record in tx_list */
457 	list_add_tail((struct list_head *)&rec->list, &ctx->tx_list);
458 	atomic_inc(&ctx->encrypt_pending);
459 
460 	rc = crypto_aead_encrypt(aead_req);
461 	if (!rc || rc != -EINPROGRESS) {
462 		atomic_dec(&ctx->encrypt_pending);
463 		sge->offset -= tls_ctx->tx.prepend_size;
464 		sge->length += tls_ctx->tx.prepend_size;
465 	}
466 
467 	if (!rc) {
468 		WRITE_ONCE(rec->tx_ready, true);
469 	} else if (rc != -EINPROGRESS) {
470 		list_del(&rec->list);
471 		return rc;
472 	}
473 
474 	/* Unhook the record from context if encryption is not failure */
475 	ctx->open_rec = NULL;
476 	tls_advance_record_sn(sk, &tls_ctx->tx);
477 	return rc;
478 }
479 
480 static int tls_split_open_record(struct sock *sk, struct tls_rec *from,
481 				 struct tls_rec **to, struct sk_msg *msg_opl,
482 				 struct sk_msg *msg_oen, u32 split_point,
483 				 u32 tx_overhead_size, u32 *orig_end)
484 {
485 	u32 i, j, bytes = 0, apply = msg_opl->apply_bytes;
486 	struct scatterlist *sge, *osge, *nsge;
487 	u32 orig_size = msg_opl->sg.size;
488 	struct scatterlist tmp = { };
489 	struct sk_msg *msg_npl;
490 	struct tls_rec *new;
491 	int ret;
492 
493 	new = tls_get_rec(sk);
494 	if (!new)
495 		return -ENOMEM;
496 	ret = sk_msg_alloc(sk, &new->msg_encrypted, msg_opl->sg.size +
497 			   tx_overhead_size, 0);
498 	if (ret < 0) {
499 		tls_free_rec(sk, new);
500 		return ret;
501 	}
502 
503 	*orig_end = msg_opl->sg.end;
504 	i = msg_opl->sg.start;
505 	sge = sk_msg_elem(msg_opl, i);
506 	while (apply && sge->length) {
507 		if (sge->length > apply) {
508 			u32 len = sge->length - apply;
509 
510 			get_page(sg_page(sge));
511 			sg_set_page(&tmp, sg_page(sge), len,
512 				    sge->offset + apply);
513 			sge->length = apply;
514 			bytes += apply;
515 			apply = 0;
516 		} else {
517 			apply -= sge->length;
518 			bytes += sge->length;
519 		}
520 
521 		sk_msg_iter_var_next(i);
522 		if (i == msg_opl->sg.end)
523 			break;
524 		sge = sk_msg_elem(msg_opl, i);
525 	}
526 
527 	msg_opl->sg.end = i;
528 	msg_opl->sg.curr = i;
529 	msg_opl->sg.copybreak = 0;
530 	msg_opl->apply_bytes = 0;
531 	msg_opl->sg.size = bytes;
532 
533 	msg_npl = &new->msg_plaintext;
534 	msg_npl->apply_bytes = apply;
535 	msg_npl->sg.size = orig_size - bytes;
536 
537 	j = msg_npl->sg.start;
538 	nsge = sk_msg_elem(msg_npl, j);
539 	if (tmp.length) {
540 		memcpy(nsge, &tmp, sizeof(*nsge));
541 		sk_msg_iter_var_next(j);
542 		nsge = sk_msg_elem(msg_npl, j);
543 	}
544 
545 	osge = sk_msg_elem(msg_opl, i);
546 	while (osge->length) {
547 		memcpy(nsge, osge, sizeof(*nsge));
548 		sg_unmark_end(nsge);
549 		sk_msg_iter_var_next(i);
550 		sk_msg_iter_var_next(j);
551 		if (i == *orig_end)
552 			break;
553 		osge = sk_msg_elem(msg_opl, i);
554 		nsge = sk_msg_elem(msg_npl, j);
555 	}
556 
557 	msg_npl->sg.end = j;
558 	msg_npl->sg.curr = j;
559 	msg_npl->sg.copybreak = 0;
560 
561 	*to = new;
562 	return 0;
563 }
564 
565 static void tls_merge_open_record(struct sock *sk, struct tls_rec *to,
566 				  struct tls_rec *from, u32 orig_end)
567 {
568 	struct sk_msg *msg_npl = &from->msg_plaintext;
569 	struct sk_msg *msg_opl = &to->msg_plaintext;
570 	struct scatterlist *osge, *nsge;
571 	u32 i, j;
572 
573 	i = msg_opl->sg.end;
574 	sk_msg_iter_var_prev(i);
575 	j = msg_npl->sg.start;
576 
577 	osge = sk_msg_elem(msg_opl, i);
578 	nsge = sk_msg_elem(msg_npl, j);
579 
580 	if (sg_page(osge) == sg_page(nsge) &&
581 	    osge->offset + osge->length == nsge->offset) {
582 		osge->length += nsge->length;
583 		put_page(sg_page(nsge));
584 	}
585 
586 	msg_opl->sg.end = orig_end;
587 	msg_opl->sg.curr = orig_end;
588 	msg_opl->sg.copybreak = 0;
589 	msg_opl->apply_bytes = msg_opl->sg.size + msg_npl->sg.size;
590 	msg_opl->sg.size += msg_npl->sg.size;
591 
592 	sk_msg_free(sk, &to->msg_encrypted);
593 	sk_msg_xfer_full(&to->msg_encrypted, &from->msg_encrypted);
594 
595 	kfree(from);
596 }
597 
598 static int tls_push_record(struct sock *sk, int flags,
599 			   unsigned char record_type)
600 {
601 	struct tls_context *tls_ctx = tls_get_ctx(sk);
602 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
603 	struct tls_rec *rec = ctx->open_rec, *tmp = NULL;
604 	u32 i, split_point, uninitialized_var(orig_end);
605 	struct sk_msg *msg_pl, *msg_en;
606 	struct aead_request *req;
607 	bool split;
608 	int rc;
609 
610 	if (!rec)
611 		return 0;
612 
613 	msg_pl = &rec->msg_plaintext;
614 	msg_en = &rec->msg_encrypted;
615 
616 	split_point = msg_pl->apply_bytes;
617 	split = split_point && split_point < msg_pl->sg.size;
618 	if (split) {
619 		rc = tls_split_open_record(sk, rec, &tmp, msg_pl, msg_en,
620 					   split_point, tls_ctx->tx.overhead_size,
621 					   &orig_end);
622 		if (rc < 0)
623 			return rc;
624 		sk_msg_trim(sk, msg_en, msg_pl->sg.size +
625 			    tls_ctx->tx.overhead_size);
626 	}
627 
628 	rec->tx_flags = flags;
629 	req = &rec->aead_req;
630 
631 	i = msg_pl->sg.end;
632 	sk_msg_iter_var_prev(i);
633 	sg_mark_end(sk_msg_elem(msg_pl, i));
634 
635 	i = msg_pl->sg.start;
636 	sg_chain(rec->sg_aead_in, 2, rec->inplace_crypto ?
637 		 &msg_en->sg.data[i] : &msg_pl->sg.data[i]);
638 
639 	i = msg_en->sg.end;
640 	sk_msg_iter_var_prev(i);
641 	sg_mark_end(sk_msg_elem(msg_en, i));
642 
643 	i = msg_en->sg.start;
644 	sg_chain(rec->sg_aead_out, 2, &msg_en->sg.data[i]);
645 
646 	tls_make_aad(rec->aad_space, msg_pl->sg.size,
647 		     tls_ctx->tx.rec_seq, tls_ctx->tx.rec_seq_size,
648 		     record_type);
649 
650 	tls_fill_prepend(tls_ctx,
651 			 page_address(sg_page(&msg_en->sg.data[i])) +
652 			 msg_en->sg.data[i].offset, msg_pl->sg.size,
653 			 record_type);
654 
655 	tls_ctx->pending_open_record_frags = false;
656 
657 	rc = tls_do_encryption(sk, tls_ctx, ctx, req, msg_pl->sg.size, i);
658 	if (rc < 0) {
659 		if (rc != -EINPROGRESS) {
660 			tls_err_abort(sk, EBADMSG);
661 			if (split) {
662 				tls_ctx->pending_open_record_frags = true;
663 				tls_merge_open_record(sk, rec, tmp, orig_end);
664 			}
665 		}
666 		return rc;
667 	} else if (split) {
668 		msg_pl = &tmp->msg_plaintext;
669 		msg_en = &tmp->msg_encrypted;
670 		sk_msg_trim(sk, msg_en, msg_pl->sg.size +
671 			    tls_ctx->tx.overhead_size);
672 		tls_ctx->pending_open_record_frags = true;
673 		ctx->open_rec = tmp;
674 	}
675 
676 	return tls_tx_records(sk, flags);
677 }
678 
679 static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
680 			       bool full_record, u8 record_type,
681 			       size_t *copied, int flags)
682 {
683 	struct tls_context *tls_ctx = tls_get_ctx(sk);
684 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
685 	struct sk_msg msg_redir = { };
686 	struct sk_psock *psock;
687 	struct sock *sk_redir;
688 	struct tls_rec *rec;
689 	int err = 0, send;
690 	u32 delta = 0;
691 	bool enospc;
692 
693 	psock = sk_psock_get(sk);
694 	if (!psock)
695 		return tls_push_record(sk, flags, record_type);
696 more_data:
697 	enospc = sk_msg_full(msg);
698 	if (psock->eval == __SK_NONE) {
699 		delta = msg->sg.size;
700 		psock->eval = sk_psock_msg_verdict(sk, psock, msg);
701 		if (delta < msg->sg.size)
702 			delta -= msg->sg.size;
703 		else
704 			delta = 0;
705 	}
706 	if (msg->cork_bytes && msg->cork_bytes > msg->sg.size &&
707 	    !enospc && !full_record) {
708 		err = -ENOSPC;
709 		goto out_err;
710 	}
711 	msg->cork_bytes = 0;
712 	send = msg->sg.size;
713 	if (msg->apply_bytes && msg->apply_bytes < send)
714 		send = msg->apply_bytes;
715 
716 	switch (psock->eval) {
717 	case __SK_PASS:
718 		err = tls_push_record(sk, flags, record_type);
719 		if (err < 0) {
720 			*copied -= sk_msg_free(sk, msg);
721 			tls_free_open_rec(sk);
722 			goto out_err;
723 		}
724 		break;
725 	case __SK_REDIRECT:
726 		sk_redir = psock->sk_redir;
727 		memcpy(&msg_redir, msg, sizeof(*msg));
728 		if (msg->apply_bytes < send)
729 			msg->apply_bytes = 0;
730 		else
731 			msg->apply_bytes -= send;
732 		sk_msg_return_zero(sk, msg, send);
733 		msg->sg.size -= send;
734 		release_sock(sk);
735 		err = tcp_bpf_sendmsg_redir(sk_redir, &msg_redir, send, flags);
736 		lock_sock(sk);
737 		if (err < 0) {
738 			*copied -= sk_msg_free_nocharge(sk, &msg_redir);
739 			msg->sg.size = 0;
740 		}
741 		if (msg->sg.size == 0)
742 			tls_free_open_rec(sk);
743 		break;
744 	case __SK_DROP:
745 	default:
746 		sk_msg_free_partial(sk, msg, send);
747 		if (msg->apply_bytes < send)
748 			msg->apply_bytes = 0;
749 		else
750 			msg->apply_bytes -= send;
751 		if (msg->sg.size == 0)
752 			tls_free_open_rec(sk);
753 		*copied -= (send + delta);
754 		err = -EACCES;
755 	}
756 
757 	if (likely(!err)) {
758 		bool reset_eval = !ctx->open_rec;
759 
760 		rec = ctx->open_rec;
761 		if (rec) {
762 			msg = &rec->msg_plaintext;
763 			if (!msg->apply_bytes)
764 				reset_eval = true;
765 		}
766 		if (reset_eval) {
767 			psock->eval = __SK_NONE;
768 			if (psock->sk_redir) {
769 				sock_put(psock->sk_redir);
770 				psock->sk_redir = NULL;
771 			}
772 		}
773 		if (rec)
774 			goto more_data;
775 	}
776  out_err:
777 	sk_psock_put(sk, psock);
778 	return err;
779 }
780 
781 static int tls_sw_push_pending_record(struct sock *sk, int flags)
782 {
783 	struct tls_context *tls_ctx = tls_get_ctx(sk);
784 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
785 	struct tls_rec *rec = ctx->open_rec;
786 	struct sk_msg *msg_pl;
787 	size_t copied;
788 
789 	if (!rec)
790 		return 0;
791 
792 	msg_pl = &rec->msg_plaintext;
793 	copied = msg_pl->sg.size;
794 	if (!copied)
795 		return 0;
796 
797 	return bpf_exec_tx_verdict(msg_pl, sk, true, TLS_RECORD_TYPE_DATA,
798 				   &copied, flags);
799 }
800 
801 int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
802 {
803 	long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
804 	struct tls_context *tls_ctx = tls_get_ctx(sk);
805 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
806 	struct crypto_tfm *tfm = crypto_aead_tfm(ctx->aead_send);
807 	bool async_capable = tfm->__crt_alg->cra_flags & CRYPTO_ALG_ASYNC;
808 	unsigned char record_type = TLS_RECORD_TYPE_DATA;
809 	bool is_kvec = iov_iter_is_kvec(&msg->msg_iter);
810 	bool eor = !(msg->msg_flags & MSG_MORE);
811 	size_t try_to_copy, copied = 0;
812 	struct sk_msg *msg_pl, *msg_en;
813 	struct tls_rec *rec;
814 	int required_size;
815 	int num_async = 0;
816 	bool full_record;
817 	int record_room;
818 	int num_zc = 0;
819 	int orig_size;
820 	int ret = 0;
821 
822 	if (msg->msg_flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL))
823 		return -ENOTSUPP;
824 
825 	lock_sock(sk);
826 
827 	/* Wait till there is any pending write on socket */
828 	if (unlikely(sk->sk_write_pending)) {
829 		ret = wait_on_pending_writer(sk, &timeo);
830 		if (unlikely(ret))
831 			goto send_end;
832 	}
833 
834 	if (unlikely(msg->msg_controllen)) {
835 		ret = tls_proccess_cmsg(sk, msg, &record_type);
836 		if (ret) {
837 			if (ret == -EINPROGRESS)
838 				num_async++;
839 			else if (ret != -EAGAIN)
840 				goto send_end;
841 		}
842 	}
843 
844 	while (msg_data_left(msg)) {
845 		if (sk->sk_err) {
846 			ret = -sk->sk_err;
847 			goto send_end;
848 		}
849 
850 		if (ctx->open_rec)
851 			rec = ctx->open_rec;
852 		else
853 			rec = ctx->open_rec = tls_get_rec(sk);
854 		if (!rec) {
855 			ret = -ENOMEM;
856 			goto send_end;
857 		}
858 
859 		msg_pl = &rec->msg_plaintext;
860 		msg_en = &rec->msg_encrypted;
861 
862 		orig_size = msg_pl->sg.size;
863 		full_record = false;
864 		try_to_copy = msg_data_left(msg);
865 		record_room = TLS_MAX_PAYLOAD_SIZE - msg_pl->sg.size;
866 		if (try_to_copy >= record_room) {
867 			try_to_copy = record_room;
868 			full_record = true;
869 		}
870 
871 		required_size = msg_pl->sg.size + try_to_copy +
872 				tls_ctx->tx.overhead_size;
873 
874 		if (!sk_stream_memory_free(sk))
875 			goto wait_for_sndbuf;
876 
877 alloc_encrypted:
878 		ret = tls_alloc_encrypted_msg(sk, required_size);
879 		if (ret) {
880 			if (ret != -ENOSPC)
881 				goto wait_for_memory;
882 
883 			/* Adjust try_to_copy according to the amount that was
884 			 * actually allocated. The difference is due
885 			 * to max sg elements limit
886 			 */
887 			try_to_copy -= required_size - msg_en->sg.size;
888 			full_record = true;
889 		}
890 
891 		if (!is_kvec && (full_record || eor) && !async_capable) {
892 			u32 first = msg_pl->sg.end;
893 
894 			ret = sk_msg_zerocopy_from_iter(sk, &msg->msg_iter,
895 							msg_pl, try_to_copy);
896 			if (ret)
897 				goto fallback_to_reg_send;
898 
899 			rec->inplace_crypto = 0;
900 
901 			num_zc++;
902 			copied += try_to_copy;
903 
904 			sk_msg_sg_copy_set(msg_pl, first);
905 			ret = bpf_exec_tx_verdict(msg_pl, sk, full_record,
906 						  record_type, &copied,
907 						  msg->msg_flags);
908 			if (ret) {
909 				if (ret == -EINPROGRESS)
910 					num_async++;
911 				else if (ret == -ENOMEM)
912 					goto wait_for_memory;
913 				else if (ret == -ENOSPC)
914 					goto rollback_iter;
915 				else if (ret != -EAGAIN)
916 					goto send_end;
917 			}
918 			continue;
919 rollback_iter:
920 			copied -= try_to_copy;
921 			sk_msg_sg_copy_clear(msg_pl, first);
922 			iov_iter_revert(&msg->msg_iter,
923 					msg_pl->sg.size - orig_size);
924 fallback_to_reg_send:
925 			sk_msg_trim(sk, msg_pl, orig_size);
926 		}
927 
928 		required_size = msg_pl->sg.size + try_to_copy;
929 
930 		ret = tls_clone_plaintext_msg(sk, required_size);
931 		if (ret) {
932 			if (ret != -ENOSPC)
933 				goto send_end;
934 
935 			/* Adjust try_to_copy according to the amount that was
936 			 * actually allocated. The difference is due
937 			 * to max sg elements limit
938 			 */
939 			try_to_copy -= required_size - msg_pl->sg.size;
940 			full_record = true;
941 			sk_msg_trim(sk, msg_en, msg_pl->sg.size +
942 				    tls_ctx->tx.overhead_size);
943 		}
944 
945 		ret = sk_msg_memcopy_from_iter(sk, &msg->msg_iter, msg_pl,
946 					       try_to_copy);
947 		if (ret < 0)
948 			goto trim_sgl;
949 
950 		/* Open records defined only if successfully copied, otherwise
951 		 * we would trim the sg but not reset the open record frags.
952 		 */
953 		tls_ctx->pending_open_record_frags = true;
954 		copied += try_to_copy;
955 		if (full_record || eor) {
956 			ret = bpf_exec_tx_verdict(msg_pl, sk, full_record,
957 						  record_type, &copied,
958 						  msg->msg_flags);
959 			if (ret) {
960 				if (ret == -EINPROGRESS)
961 					num_async++;
962 				else if (ret == -ENOMEM)
963 					goto wait_for_memory;
964 				else if (ret != -EAGAIN) {
965 					if (ret == -ENOSPC)
966 						ret = 0;
967 					goto send_end;
968 				}
969 			}
970 		}
971 
972 		continue;
973 
974 wait_for_sndbuf:
975 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
976 wait_for_memory:
977 		ret = sk_stream_wait_memory(sk, &timeo);
978 		if (ret) {
979 trim_sgl:
980 			tls_trim_both_msgs(sk, orig_size);
981 			goto send_end;
982 		}
983 
984 		if (msg_en->sg.size < required_size)
985 			goto alloc_encrypted;
986 	}
987 
988 	if (!num_async) {
989 		goto send_end;
990 	} else if (num_zc) {
991 		/* Wait for pending encryptions to get completed */
992 		smp_store_mb(ctx->async_notify, true);
993 
994 		if (atomic_read(&ctx->encrypt_pending))
995 			crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
996 		else
997 			reinit_completion(&ctx->async_wait.completion);
998 
999 		WRITE_ONCE(ctx->async_notify, false);
1000 
1001 		if (ctx->async_wait.err) {
1002 			ret = ctx->async_wait.err;
1003 			copied = 0;
1004 		}
1005 	}
1006 
1007 	/* Transmit if any encryptions have completed */
1008 	if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
1009 		cancel_delayed_work(&ctx->tx_work.work);
1010 		tls_tx_records(sk, msg->msg_flags);
1011 	}
1012 
1013 send_end:
1014 	ret = sk_stream_error(sk, msg->msg_flags, ret);
1015 
1016 	release_sock(sk);
1017 	return copied ? copied : ret;
1018 }
1019 
1020 int tls_sw_sendpage(struct sock *sk, struct page *page,
1021 		    int offset, size_t size, int flags)
1022 {
1023 	long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
1024 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1025 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
1026 	unsigned char record_type = TLS_RECORD_TYPE_DATA;
1027 	struct sk_msg *msg_pl;
1028 	struct tls_rec *rec;
1029 	int num_async = 0;
1030 	size_t copied = 0;
1031 	bool full_record;
1032 	int record_room;
1033 	int ret = 0;
1034 	bool eor;
1035 
1036 	if (flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL |
1037 		      MSG_SENDPAGE_NOTLAST))
1038 		return -ENOTSUPP;
1039 
1040 	/* No MSG_EOR from splice, only look at MSG_MORE */
1041 	eor = !(flags & (MSG_MORE | MSG_SENDPAGE_NOTLAST));
1042 
1043 	lock_sock(sk);
1044 
1045 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
1046 
1047 	/* Wait till there is any pending write on socket */
1048 	if (unlikely(sk->sk_write_pending)) {
1049 		ret = wait_on_pending_writer(sk, &timeo);
1050 		if (unlikely(ret))
1051 			goto sendpage_end;
1052 	}
1053 
1054 	/* Call the sk_stream functions to manage the sndbuf mem. */
1055 	while (size > 0) {
1056 		size_t copy, required_size;
1057 
1058 		if (sk->sk_err) {
1059 			ret = -sk->sk_err;
1060 			goto sendpage_end;
1061 		}
1062 
1063 		if (ctx->open_rec)
1064 			rec = ctx->open_rec;
1065 		else
1066 			rec = ctx->open_rec = tls_get_rec(sk);
1067 		if (!rec) {
1068 			ret = -ENOMEM;
1069 			goto sendpage_end;
1070 		}
1071 
1072 		msg_pl = &rec->msg_plaintext;
1073 
1074 		full_record = false;
1075 		record_room = TLS_MAX_PAYLOAD_SIZE - msg_pl->sg.size;
1076 		copied = 0;
1077 		copy = size;
1078 		if (copy >= record_room) {
1079 			copy = record_room;
1080 			full_record = true;
1081 		}
1082 
1083 		required_size = msg_pl->sg.size + copy +
1084 				tls_ctx->tx.overhead_size;
1085 
1086 		if (!sk_stream_memory_free(sk))
1087 			goto wait_for_sndbuf;
1088 alloc_payload:
1089 		ret = tls_alloc_encrypted_msg(sk, required_size);
1090 		if (ret) {
1091 			if (ret != -ENOSPC)
1092 				goto wait_for_memory;
1093 
1094 			/* Adjust copy according to the amount that was
1095 			 * actually allocated. The difference is due
1096 			 * to max sg elements limit
1097 			 */
1098 			copy -= required_size - msg_pl->sg.size;
1099 			full_record = true;
1100 		}
1101 
1102 		sk_msg_page_add(msg_pl, page, copy, offset);
1103 		sk_mem_charge(sk, copy);
1104 
1105 		offset += copy;
1106 		size -= copy;
1107 		copied += copy;
1108 
1109 		tls_ctx->pending_open_record_frags = true;
1110 		if (full_record || eor || sk_msg_full(msg_pl)) {
1111 			rec->inplace_crypto = 0;
1112 			ret = bpf_exec_tx_verdict(msg_pl, sk, full_record,
1113 						  record_type, &copied, flags);
1114 			if (ret) {
1115 				if (ret == -EINPROGRESS)
1116 					num_async++;
1117 				else if (ret == -ENOMEM)
1118 					goto wait_for_memory;
1119 				else if (ret != -EAGAIN) {
1120 					if (ret == -ENOSPC)
1121 						ret = 0;
1122 					goto sendpage_end;
1123 				}
1124 			}
1125 		}
1126 		continue;
1127 wait_for_sndbuf:
1128 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
1129 wait_for_memory:
1130 		ret = sk_stream_wait_memory(sk, &timeo);
1131 		if (ret) {
1132 			tls_trim_both_msgs(sk, msg_pl->sg.size);
1133 			goto sendpage_end;
1134 		}
1135 
1136 		goto alloc_payload;
1137 	}
1138 
1139 	if (num_async) {
1140 		/* Transmit if any encryptions have completed */
1141 		if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
1142 			cancel_delayed_work(&ctx->tx_work.work);
1143 			tls_tx_records(sk, flags);
1144 		}
1145 	}
1146 sendpage_end:
1147 	ret = sk_stream_error(sk, flags, ret);
1148 	release_sock(sk);
1149 	return copied ? copied : ret;
1150 }
1151 
1152 static struct sk_buff *tls_wait_data(struct sock *sk, struct sk_psock *psock,
1153 				     int flags, long timeo, int *err)
1154 {
1155 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1156 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1157 	struct sk_buff *skb;
1158 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
1159 
1160 	while (!(skb = ctx->recv_pkt) && sk_psock_queue_empty(psock)) {
1161 		if (sk->sk_err) {
1162 			*err = sock_error(sk);
1163 			return NULL;
1164 		}
1165 
1166 		if (sk->sk_shutdown & RCV_SHUTDOWN)
1167 			return NULL;
1168 
1169 		if (sock_flag(sk, SOCK_DONE))
1170 			return NULL;
1171 
1172 		if ((flags & MSG_DONTWAIT) || !timeo) {
1173 			*err = -EAGAIN;
1174 			return NULL;
1175 		}
1176 
1177 		add_wait_queue(sk_sleep(sk), &wait);
1178 		sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
1179 		sk_wait_event(sk, &timeo,
1180 			      ctx->recv_pkt != skb ||
1181 			      !sk_psock_queue_empty(psock),
1182 			      &wait);
1183 		sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
1184 		remove_wait_queue(sk_sleep(sk), &wait);
1185 
1186 		/* Handle signals */
1187 		if (signal_pending(current)) {
1188 			*err = sock_intr_errno(timeo);
1189 			return NULL;
1190 		}
1191 	}
1192 
1193 	return skb;
1194 }
1195 
1196 static int tls_setup_from_iter(struct sock *sk, struct iov_iter *from,
1197 			       int length, int *pages_used,
1198 			       unsigned int *size_used,
1199 			       struct scatterlist *to,
1200 			       int to_max_pages)
1201 {
1202 	int rc = 0, i = 0, num_elem = *pages_used, maxpages;
1203 	struct page *pages[MAX_SKB_FRAGS];
1204 	unsigned int size = *size_used;
1205 	ssize_t copied, use;
1206 	size_t offset;
1207 
1208 	while (length > 0) {
1209 		i = 0;
1210 		maxpages = to_max_pages - num_elem;
1211 		if (maxpages == 0) {
1212 			rc = -EFAULT;
1213 			goto out;
1214 		}
1215 		copied = iov_iter_get_pages(from, pages,
1216 					    length,
1217 					    maxpages, &offset);
1218 		if (copied <= 0) {
1219 			rc = -EFAULT;
1220 			goto out;
1221 		}
1222 
1223 		iov_iter_advance(from, copied);
1224 
1225 		length -= copied;
1226 		size += copied;
1227 		while (copied) {
1228 			use = min_t(int, copied, PAGE_SIZE - offset);
1229 
1230 			sg_set_page(&to[num_elem],
1231 				    pages[i], use, offset);
1232 			sg_unmark_end(&to[num_elem]);
1233 			/* We do not uncharge memory from this API */
1234 
1235 			offset = 0;
1236 			copied -= use;
1237 
1238 			i++;
1239 			num_elem++;
1240 		}
1241 	}
1242 	/* Mark the end in the last sg entry if newly added */
1243 	if (num_elem > *pages_used)
1244 		sg_mark_end(&to[num_elem - 1]);
1245 out:
1246 	if (rc)
1247 		iov_iter_revert(from, size - *size_used);
1248 	*size_used = size;
1249 	*pages_used = num_elem;
1250 
1251 	return rc;
1252 }
1253 
1254 /* This function decrypts the input skb into either out_iov or in out_sg
1255  * or in skb buffers itself. The input parameter 'zc' indicates if
1256  * zero-copy mode needs to be tried or not. With zero-copy mode, either
1257  * out_iov or out_sg must be non-NULL. In case both out_iov and out_sg are
1258  * NULL, then the decryption happens inside skb buffers itself, i.e.
1259  * zero-copy gets disabled and 'zc' is updated.
1260  */
1261 
1262 static int decrypt_internal(struct sock *sk, struct sk_buff *skb,
1263 			    struct iov_iter *out_iov,
1264 			    struct scatterlist *out_sg,
1265 			    int *chunk, bool *zc)
1266 {
1267 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1268 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1269 	struct strp_msg *rxm = strp_msg(skb);
1270 	int n_sgin, n_sgout, nsg, mem_size, aead_size, err, pages = 0;
1271 	struct aead_request *aead_req;
1272 	struct sk_buff *unused;
1273 	u8 *aad, *iv, *mem = NULL;
1274 	struct scatterlist *sgin = NULL;
1275 	struct scatterlist *sgout = NULL;
1276 	const int data_len = rxm->full_len - tls_ctx->rx.overhead_size;
1277 
1278 	if (*zc && (out_iov || out_sg)) {
1279 		if (out_iov)
1280 			n_sgout = iov_iter_npages(out_iov, INT_MAX) + 1;
1281 		else
1282 			n_sgout = sg_nents(out_sg);
1283 		n_sgin = skb_nsg(skb, rxm->offset + tls_ctx->rx.prepend_size,
1284 				 rxm->full_len - tls_ctx->rx.prepend_size);
1285 	} else {
1286 		n_sgout = 0;
1287 		*zc = false;
1288 		n_sgin = skb_cow_data(skb, 0, &unused);
1289 	}
1290 
1291 	if (n_sgin < 1)
1292 		return -EBADMSG;
1293 
1294 	/* Increment to accommodate AAD */
1295 	n_sgin = n_sgin + 1;
1296 
1297 	nsg = n_sgin + n_sgout;
1298 
1299 	aead_size = sizeof(*aead_req) + crypto_aead_reqsize(ctx->aead_recv);
1300 	mem_size = aead_size + (nsg * sizeof(struct scatterlist));
1301 	mem_size = mem_size + TLS_AAD_SPACE_SIZE;
1302 	mem_size = mem_size + crypto_aead_ivsize(ctx->aead_recv);
1303 
1304 	/* Allocate a single block of memory which contains
1305 	 * aead_req || sgin[] || sgout[] || aad || iv.
1306 	 * This order achieves correct alignment for aead_req, sgin, sgout.
1307 	 */
1308 	mem = kmalloc(mem_size, sk->sk_allocation);
1309 	if (!mem)
1310 		return -ENOMEM;
1311 
1312 	/* Segment the allocated memory */
1313 	aead_req = (struct aead_request *)mem;
1314 	sgin = (struct scatterlist *)(mem + aead_size);
1315 	sgout = sgin + n_sgin;
1316 	aad = (u8 *)(sgout + n_sgout);
1317 	iv = aad + TLS_AAD_SPACE_SIZE;
1318 
1319 	/* Prepare IV */
1320 	err = skb_copy_bits(skb, rxm->offset + TLS_HEADER_SIZE,
1321 			    iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
1322 			    tls_ctx->rx.iv_size);
1323 	if (err < 0) {
1324 		kfree(mem);
1325 		return err;
1326 	}
1327 	memcpy(iv, tls_ctx->rx.iv, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
1328 
1329 	/* Prepare AAD */
1330 	tls_make_aad(aad, rxm->full_len - tls_ctx->rx.overhead_size,
1331 		     tls_ctx->rx.rec_seq, tls_ctx->rx.rec_seq_size,
1332 		     ctx->control);
1333 
1334 	/* Prepare sgin */
1335 	sg_init_table(sgin, n_sgin);
1336 	sg_set_buf(&sgin[0], aad, TLS_AAD_SPACE_SIZE);
1337 	err = skb_to_sgvec(skb, &sgin[1],
1338 			   rxm->offset + tls_ctx->rx.prepend_size,
1339 			   rxm->full_len - tls_ctx->rx.prepend_size);
1340 	if (err < 0) {
1341 		kfree(mem);
1342 		return err;
1343 	}
1344 
1345 	if (n_sgout) {
1346 		if (out_iov) {
1347 			sg_init_table(sgout, n_sgout);
1348 			sg_set_buf(&sgout[0], aad, TLS_AAD_SPACE_SIZE);
1349 
1350 			*chunk = 0;
1351 			err = tls_setup_from_iter(sk, out_iov, data_len,
1352 						  &pages, chunk, &sgout[1],
1353 						  (n_sgout - 1));
1354 			if (err < 0)
1355 				goto fallback_to_reg_recv;
1356 		} else if (out_sg) {
1357 			memcpy(sgout, out_sg, n_sgout * sizeof(*sgout));
1358 		} else {
1359 			goto fallback_to_reg_recv;
1360 		}
1361 	} else {
1362 fallback_to_reg_recv:
1363 		sgout = sgin;
1364 		pages = 0;
1365 		*chunk = 0;
1366 		*zc = false;
1367 	}
1368 
1369 	/* Prepare and submit AEAD request */
1370 	err = tls_do_decryption(sk, skb, sgin, sgout, iv,
1371 				data_len, aead_req, *zc);
1372 	if (err == -EINPROGRESS)
1373 		return err;
1374 
1375 	/* Release the pages in case iov was mapped to pages */
1376 	for (; pages > 0; pages--)
1377 		put_page(sg_page(&sgout[pages]));
1378 
1379 	kfree(mem);
1380 	return err;
1381 }
1382 
1383 static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
1384 			      struct iov_iter *dest, int *chunk, bool *zc)
1385 {
1386 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1387 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1388 	struct strp_msg *rxm = strp_msg(skb);
1389 	int err = 0;
1390 
1391 #ifdef CONFIG_TLS_DEVICE
1392 	err = tls_device_decrypted(sk, skb);
1393 	if (err < 0)
1394 		return err;
1395 #endif
1396 	if (!ctx->decrypted) {
1397 		err = decrypt_internal(sk, skb, dest, NULL, chunk, zc);
1398 		if (err < 0) {
1399 			if (err == -EINPROGRESS)
1400 				tls_advance_record_sn(sk, &tls_ctx->rx);
1401 
1402 			return err;
1403 		}
1404 	} else {
1405 		*zc = false;
1406 	}
1407 
1408 	rxm->offset += tls_ctx->rx.prepend_size;
1409 	rxm->full_len -= tls_ctx->rx.overhead_size;
1410 	tls_advance_record_sn(sk, &tls_ctx->rx);
1411 	ctx->decrypted = true;
1412 	ctx->saved_data_ready(sk);
1413 
1414 	return err;
1415 }
1416 
1417 int decrypt_skb(struct sock *sk, struct sk_buff *skb,
1418 		struct scatterlist *sgout)
1419 {
1420 	bool zc = true;
1421 	int chunk;
1422 
1423 	return decrypt_internal(sk, skb, NULL, sgout, &chunk, &zc);
1424 }
1425 
1426 static bool tls_sw_advance_skb(struct sock *sk, struct sk_buff *skb,
1427 			       unsigned int len)
1428 {
1429 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1430 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1431 
1432 	if (skb) {
1433 		struct strp_msg *rxm = strp_msg(skb);
1434 
1435 		if (len < rxm->full_len) {
1436 			rxm->offset += len;
1437 			rxm->full_len -= len;
1438 			return false;
1439 		}
1440 		kfree_skb(skb);
1441 	}
1442 
1443 	/* Finished with message */
1444 	ctx->recv_pkt = NULL;
1445 	__strp_unpause(&ctx->strp);
1446 
1447 	return true;
1448 }
1449 
1450 int tls_sw_recvmsg(struct sock *sk,
1451 		   struct msghdr *msg,
1452 		   size_t len,
1453 		   int nonblock,
1454 		   int flags,
1455 		   int *addr_len)
1456 {
1457 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1458 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1459 	struct sk_psock *psock;
1460 	unsigned char control;
1461 	struct strp_msg *rxm;
1462 	struct sk_buff *skb;
1463 	ssize_t copied = 0;
1464 	bool cmsg = false;
1465 	int target, err = 0;
1466 	long timeo;
1467 	bool is_kvec = iov_iter_is_kvec(&msg->msg_iter);
1468 	int num_async = 0;
1469 
1470 	flags |= nonblock;
1471 
1472 	if (unlikely(flags & MSG_ERRQUEUE))
1473 		return sock_recv_errqueue(sk, msg, len, SOL_IP, IP_RECVERR);
1474 
1475 	psock = sk_psock_get(sk);
1476 	lock_sock(sk);
1477 
1478 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
1479 	timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
1480 	do {
1481 		bool zc = false;
1482 		bool async = false;
1483 		int chunk = 0;
1484 
1485 		skb = tls_wait_data(sk, psock, flags, timeo, &err);
1486 		if (!skb) {
1487 			if (psock) {
1488 				int ret = __tcp_bpf_recvmsg(sk, psock,
1489 							    msg, len, flags);
1490 
1491 				if (ret > 0) {
1492 					copied += ret;
1493 					len -= ret;
1494 					continue;
1495 				}
1496 			}
1497 			goto recv_end;
1498 		}
1499 
1500 		rxm = strp_msg(skb);
1501 
1502 		if (!cmsg) {
1503 			int cerr;
1504 
1505 			cerr = put_cmsg(msg, SOL_TLS, TLS_GET_RECORD_TYPE,
1506 					sizeof(ctx->control), &ctx->control);
1507 			cmsg = true;
1508 			control = ctx->control;
1509 			if (ctx->control != TLS_RECORD_TYPE_DATA) {
1510 				if (cerr || msg->msg_flags & MSG_CTRUNC) {
1511 					err = -EIO;
1512 					goto recv_end;
1513 				}
1514 			}
1515 		} else if (control != ctx->control) {
1516 			goto recv_end;
1517 		}
1518 
1519 		if (!ctx->decrypted) {
1520 			int to_copy = rxm->full_len - tls_ctx->rx.overhead_size;
1521 
1522 			if (!is_kvec && to_copy <= len &&
1523 			    likely(!(flags & MSG_PEEK)))
1524 				zc = true;
1525 
1526 			err = decrypt_skb_update(sk, skb, &msg->msg_iter,
1527 						 &chunk, &zc);
1528 			if (err < 0 && err != -EINPROGRESS) {
1529 				tls_err_abort(sk, EBADMSG);
1530 				goto recv_end;
1531 			}
1532 
1533 			if (err == -EINPROGRESS) {
1534 				async = true;
1535 				num_async++;
1536 				goto pick_next_record;
1537 			}
1538 
1539 			ctx->decrypted = true;
1540 		}
1541 
1542 		if (!zc) {
1543 			chunk = min_t(unsigned int, rxm->full_len, len);
1544 
1545 			err = skb_copy_datagram_msg(skb, rxm->offset, msg,
1546 						    chunk);
1547 			if (err < 0)
1548 				goto recv_end;
1549 		}
1550 
1551 pick_next_record:
1552 		copied += chunk;
1553 		len -= chunk;
1554 		if (likely(!(flags & MSG_PEEK))) {
1555 			u8 control = ctx->control;
1556 
1557 			/* For async, drop current skb reference */
1558 			if (async)
1559 				skb = NULL;
1560 
1561 			if (tls_sw_advance_skb(sk, skb, chunk)) {
1562 				/* Return full control message to
1563 				 * userspace before trying to parse
1564 				 * another message type
1565 				 */
1566 				msg->msg_flags |= MSG_EOR;
1567 				if (control != TLS_RECORD_TYPE_DATA)
1568 					goto recv_end;
1569 			} else {
1570 				break;
1571 			}
1572 		} else {
1573 			/* MSG_PEEK right now cannot look beyond current skb
1574 			 * from strparser, meaning we cannot advance skb here
1575 			 * and thus unpause strparser since we'd loose original
1576 			 * one.
1577 			 */
1578 			break;
1579 		}
1580 
1581 		/* If we have a new message from strparser, continue now. */
1582 		if (copied >= target && !ctx->recv_pkt)
1583 			break;
1584 	} while (len);
1585 
1586 recv_end:
1587 	if (num_async) {
1588 		/* Wait for all previously submitted records to be decrypted */
1589 		smp_store_mb(ctx->async_notify, true);
1590 		if (atomic_read(&ctx->decrypt_pending)) {
1591 			err = crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
1592 			if (err) {
1593 				/* one of async decrypt failed */
1594 				tls_err_abort(sk, err);
1595 				copied = 0;
1596 			}
1597 		} else {
1598 			reinit_completion(&ctx->async_wait.completion);
1599 		}
1600 		WRITE_ONCE(ctx->async_notify, false);
1601 	}
1602 
1603 	release_sock(sk);
1604 	if (psock)
1605 		sk_psock_put(sk, psock);
1606 	return copied ? : err;
1607 }
1608 
1609 ssize_t tls_sw_splice_read(struct socket *sock,  loff_t *ppos,
1610 			   struct pipe_inode_info *pipe,
1611 			   size_t len, unsigned int flags)
1612 {
1613 	struct tls_context *tls_ctx = tls_get_ctx(sock->sk);
1614 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1615 	struct strp_msg *rxm = NULL;
1616 	struct sock *sk = sock->sk;
1617 	struct sk_buff *skb;
1618 	ssize_t copied = 0;
1619 	int err = 0;
1620 	long timeo;
1621 	int chunk;
1622 	bool zc = false;
1623 
1624 	lock_sock(sk);
1625 
1626 	timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
1627 
1628 	skb = tls_wait_data(sk, NULL, flags, timeo, &err);
1629 	if (!skb)
1630 		goto splice_read_end;
1631 
1632 	/* splice does not support reading control messages */
1633 	if (ctx->control != TLS_RECORD_TYPE_DATA) {
1634 		err = -ENOTSUPP;
1635 		goto splice_read_end;
1636 	}
1637 
1638 	if (!ctx->decrypted) {
1639 		err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc);
1640 
1641 		if (err < 0) {
1642 			tls_err_abort(sk, EBADMSG);
1643 			goto splice_read_end;
1644 		}
1645 		ctx->decrypted = true;
1646 	}
1647 	rxm = strp_msg(skb);
1648 
1649 	chunk = min_t(unsigned int, rxm->full_len, len);
1650 	copied = skb_splice_bits(skb, sk, rxm->offset, pipe, chunk, flags);
1651 	if (copied < 0)
1652 		goto splice_read_end;
1653 
1654 	if (likely(!(flags & MSG_PEEK)))
1655 		tls_sw_advance_skb(sk, skb, copied);
1656 
1657 splice_read_end:
1658 	release_sock(sk);
1659 	return copied ? : err;
1660 }
1661 
1662 bool tls_sw_stream_read(const struct sock *sk)
1663 {
1664 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1665 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1666 	bool ingress_empty = true;
1667 	struct sk_psock *psock;
1668 
1669 	rcu_read_lock();
1670 	psock = sk_psock(sk);
1671 	if (psock)
1672 		ingress_empty = list_empty(&psock->ingress_msg);
1673 	rcu_read_unlock();
1674 
1675 	return !ingress_empty || ctx->recv_pkt;
1676 }
1677 
1678 static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
1679 {
1680 	struct tls_context *tls_ctx = tls_get_ctx(strp->sk);
1681 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1682 	char header[TLS_HEADER_SIZE + MAX_IV_SIZE];
1683 	struct strp_msg *rxm = strp_msg(skb);
1684 	size_t cipher_overhead;
1685 	size_t data_len = 0;
1686 	int ret;
1687 
1688 	/* Verify that we have a full TLS header, or wait for more data */
1689 	if (rxm->offset + tls_ctx->rx.prepend_size > skb->len)
1690 		return 0;
1691 
1692 	/* Sanity-check size of on-stack buffer. */
1693 	if (WARN_ON(tls_ctx->rx.prepend_size > sizeof(header))) {
1694 		ret = -EINVAL;
1695 		goto read_failure;
1696 	}
1697 
1698 	/* Linearize header to local buffer */
1699 	ret = skb_copy_bits(skb, rxm->offset, header, tls_ctx->rx.prepend_size);
1700 
1701 	if (ret < 0)
1702 		goto read_failure;
1703 
1704 	ctx->control = header[0];
1705 
1706 	data_len = ((header[4] & 0xFF) | (header[3] << 8));
1707 
1708 	cipher_overhead = tls_ctx->rx.tag_size + tls_ctx->rx.iv_size;
1709 
1710 	if (data_len > TLS_MAX_PAYLOAD_SIZE + cipher_overhead) {
1711 		ret = -EMSGSIZE;
1712 		goto read_failure;
1713 	}
1714 	if (data_len < cipher_overhead) {
1715 		ret = -EBADMSG;
1716 		goto read_failure;
1717 	}
1718 
1719 	if (header[1] != TLS_VERSION_MINOR(tls_ctx->crypto_recv.info.version) ||
1720 	    header[2] != TLS_VERSION_MAJOR(tls_ctx->crypto_recv.info.version)) {
1721 		ret = -EINVAL;
1722 		goto read_failure;
1723 	}
1724 
1725 #ifdef CONFIG_TLS_DEVICE
1726 	handle_device_resync(strp->sk, TCP_SKB_CB(skb)->seq + rxm->offset,
1727 			     *(u64*)tls_ctx->rx.rec_seq);
1728 #endif
1729 	return data_len + TLS_HEADER_SIZE;
1730 
1731 read_failure:
1732 	tls_err_abort(strp->sk, ret);
1733 
1734 	return ret;
1735 }
1736 
1737 static void tls_queue(struct strparser *strp, struct sk_buff *skb)
1738 {
1739 	struct tls_context *tls_ctx = tls_get_ctx(strp->sk);
1740 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1741 
1742 	ctx->decrypted = false;
1743 
1744 	ctx->recv_pkt = skb;
1745 	strp_pause(strp);
1746 
1747 	ctx->saved_data_ready(strp->sk);
1748 }
1749 
1750 static void tls_data_ready(struct sock *sk)
1751 {
1752 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1753 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1754 	struct sk_psock *psock;
1755 
1756 	strp_data_ready(&ctx->strp);
1757 
1758 	psock = sk_psock_get(sk);
1759 	if (psock && !list_empty(&psock->ingress_msg)) {
1760 		ctx->saved_data_ready(sk);
1761 		sk_psock_put(sk, psock);
1762 	}
1763 }
1764 
1765 void tls_sw_free_resources_tx(struct sock *sk)
1766 {
1767 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1768 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
1769 	struct tls_rec *rec, *tmp;
1770 
1771 	/* Wait for any pending async encryptions to complete */
1772 	smp_store_mb(ctx->async_notify, true);
1773 	if (atomic_read(&ctx->encrypt_pending))
1774 		crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
1775 
1776 	cancel_delayed_work_sync(&ctx->tx_work.work);
1777 
1778 	/* Tx whatever records we can transmit and abandon the rest */
1779 	tls_tx_records(sk, -1);
1780 
1781 	/* Free up un-sent records in tx_list. First, free
1782 	 * the partially sent record if any at head of tx_list.
1783 	 */
1784 	if (tls_ctx->partially_sent_record) {
1785 		struct scatterlist *sg = tls_ctx->partially_sent_record;
1786 
1787 		while (1) {
1788 			put_page(sg_page(sg));
1789 			sk_mem_uncharge(sk, sg->length);
1790 
1791 			if (sg_is_last(sg))
1792 				break;
1793 			sg++;
1794 		}
1795 
1796 		tls_ctx->partially_sent_record = NULL;
1797 
1798 		rec = list_first_entry(&ctx->tx_list,
1799 				       struct tls_rec, list);
1800 		list_del(&rec->list);
1801 		sk_msg_free(sk, &rec->msg_plaintext);
1802 		kfree(rec);
1803 	}
1804 
1805 	list_for_each_entry_safe(rec, tmp, &ctx->tx_list, list) {
1806 		list_del(&rec->list);
1807 		sk_msg_free(sk, &rec->msg_encrypted);
1808 		sk_msg_free(sk, &rec->msg_plaintext);
1809 		kfree(rec);
1810 	}
1811 
1812 	crypto_free_aead(ctx->aead_send);
1813 	tls_free_open_rec(sk);
1814 
1815 	kfree(ctx);
1816 }
1817 
1818 void tls_sw_release_resources_rx(struct sock *sk)
1819 {
1820 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1821 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1822 
1823 	if (ctx->aead_recv) {
1824 		kfree_skb(ctx->recv_pkt);
1825 		ctx->recv_pkt = NULL;
1826 		crypto_free_aead(ctx->aead_recv);
1827 		strp_stop(&ctx->strp);
1828 		write_lock_bh(&sk->sk_callback_lock);
1829 		sk->sk_data_ready = ctx->saved_data_ready;
1830 		write_unlock_bh(&sk->sk_callback_lock);
1831 		release_sock(sk);
1832 		strp_done(&ctx->strp);
1833 		lock_sock(sk);
1834 	}
1835 }
1836 
1837 void tls_sw_free_resources_rx(struct sock *sk)
1838 {
1839 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1840 	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
1841 
1842 	tls_sw_release_resources_rx(sk);
1843 
1844 	kfree(ctx);
1845 }
1846 
1847 /* The work handler to transmitt the encrypted records in tx_list */
1848 static void tx_work_handler(struct work_struct *work)
1849 {
1850 	struct delayed_work *delayed_work = to_delayed_work(work);
1851 	struct tx_work *tx_work = container_of(delayed_work,
1852 					       struct tx_work, work);
1853 	struct sock *sk = tx_work->sk;
1854 	struct tls_context *tls_ctx = tls_get_ctx(sk);
1855 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
1856 
1857 	if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
1858 		return;
1859 
1860 	lock_sock(sk);
1861 	tls_tx_records(sk, -1);
1862 	release_sock(sk);
1863 }
1864 
1865 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
1866 {
1867 	struct tls_crypto_info *crypto_info;
1868 	struct tls12_crypto_info_aes_gcm_128 *gcm_128_info;
1869 	struct tls_sw_context_tx *sw_ctx_tx = NULL;
1870 	struct tls_sw_context_rx *sw_ctx_rx = NULL;
1871 	struct cipher_context *cctx;
1872 	struct crypto_aead **aead;
1873 	struct strp_callbacks cb;
1874 	u16 nonce_size, tag_size, iv_size, rec_seq_size;
1875 	char *iv, *rec_seq;
1876 	int rc = 0;
1877 
1878 	if (!ctx) {
1879 		rc = -EINVAL;
1880 		goto out;
1881 	}
1882 
1883 	if (tx) {
1884 		if (!ctx->priv_ctx_tx) {
1885 			sw_ctx_tx = kzalloc(sizeof(*sw_ctx_tx), GFP_KERNEL);
1886 			if (!sw_ctx_tx) {
1887 				rc = -ENOMEM;
1888 				goto out;
1889 			}
1890 			ctx->priv_ctx_tx = sw_ctx_tx;
1891 		} else {
1892 			sw_ctx_tx =
1893 				(struct tls_sw_context_tx *)ctx->priv_ctx_tx;
1894 		}
1895 	} else {
1896 		if (!ctx->priv_ctx_rx) {
1897 			sw_ctx_rx = kzalloc(sizeof(*sw_ctx_rx), GFP_KERNEL);
1898 			if (!sw_ctx_rx) {
1899 				rc = -ENOMEM;
1900 				goto out;
1901 			}
1902 			ctx->priv_ctx_rx = sw_ctx_rx;
1903 		} else {
1904 			sw_ctx_rx =
1905 				(struct tls_sw_context_rx *)ctx->priv_ctx_rx;
1906 		}
1907 	}
1908 
1909 	if (tx) {
1910 		crypto_init_wait(&sw_ctx_tx->async_wait);
1911 		crypto_info = &ctx->crypto_send.info;
1912 		cctx = &ctx->tx;
1913 		aead = &sw_ctx_tx->aead_send;
1914 		INIT_LIST_HEAD(&sw_ctx_tx->tx_list);
1915 		INIT_DELAYED_WORK(&sw_ctx_tx->tx_work.work, tx_work_handler);
1916 		sw_ctx_tx->tx_work.sk = sk;
1917 	} else {
1918 		crypto_init_wait(&sw_ctx_rx->async_wait);
1919 		crypto_info = &ctx->crypto_recv.info;
1920 		cctx = &ctx->rx;
1921 		aead = &sw_ctx_rx->aead_recv;
1922 	}
1923 
1924 	switch (crypto_info->cipher_type) {
1925 	case TLS_CIPHER_AES_GCM_128: {
1926 		nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
1927 		tag_size = TLS_CIPHER_AES_GCM_128_TAG_SIZE;
1928 		iv_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
1929 		iv = ((struct tls12_crypto_info_aes_gcm_128 *)crypto_info)->iv;
1930 		rec_seq_size = TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE;
1931 		rec_seq =
1932 		 ((struct tls12_crypto_info_aes_gcm_128 *)crypto_info)->rec_seq;
1933 		gcm_128_info =
1934 			(struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
1935 		break;
1936 	}
1937 	default:
1938 		rc = -EINVAL;
1939 		goto free_priv;
1940 	}
1941 
1942 	/* Sanity-check the IV size for stack allocations. */
1943 	if (iv_size > MAX_IV_SIZE || nonce_size > MAX_IV_SIZE) {
1944 		rc = -EINVAL;
1945 		goto free_priv;
1946 	}
1947 
1948 	cctx->prepend_size = TLS_HEADER_SIZE + nonce_size;
1949 	cctx->tag_size = tag_size;
1950 	cctx->overhead_size = cctx->prepend_size + cctx->tag_size;
1951 	cctx->iv_size = iv_size;
1952 	cctx->iv = kmalloc(iv_size + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
1953 			   GFP_KERNEL);
1954 	if (!cctx->iv) {
1955 		rc = -ENOMEM;
1956 		goto free_priv;
1957 	}
1958 	memcpy(cctx->iv, gcm_128_info->salt, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
1959 	memcpy(cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, iv, iv_size);
1960 	cctx->rec_seq_size = rec_seq_size;
1961 	cctx->rec_seq = kmemdup(rec_seq, rec_seq_size, GFP_KERNEL);
1962 	if (!cctx->rec_seq) {
1963 		rc = -ENOMEM;
1964 		goto free_iv;
1965 	}
1966 
1967 	if (!*aead) {
1968 		*aead = crypto_alloc_aead("gcm(aes)", 0, 0);
1969 		if (IS_ERR(*aead)) {
1970 			rc = PTR_ERR(*aead);
1971 			*aead = NULL;
1972 			goto free_rec_seq;
1973 		}
1974 	}
1975 
1976 	ctx->push_pending_record = tls_sw_push_pending_record;
1977 
1978 	rc = crypto_aead_setkey(*aead, gcm_128_info->key,
1979 				TLS_CIPHER_AES_GCM_128_KEY_SIZE);
1980 	if (rc)
1981 		goto free_aead;
1982 
1983 	rc = crypto_aead_setauthsize(*aead, cctx->tag_size);
1984 	if (rc)
1985 		goto free_aead;
1986 
1987 	if (sw_ctx_rx) {
1988 		/* Set up strparser */
1989 		memset(&cb, 0, sizeof(cb));
1990 		cb.rcv_msg = tls_queue;
1991 		cb.parse_msg = tls_read_size;
1992 
1993 		strp_init(&sw_ctx_rx->strp, sk, &cb);
1994 
1995 		write_lock_bh(&sk->sk_callback_lock);
1996 		sw_ctx_rx->saved_data_ready = sk->sk_data_ready;
1997 		sk->sk_data_ready = tls_data_ready;
1998 		write_unlock_bh(&sk->sk_callback_lock);
1999 
2000 		strp_check_rcv(&sw_ctx_rx->strp);
2001 	}
2002 
2003 	goto out;
2004 
2005 free_aead:
2006 	crypto_free_aead(*aead);
2007 	*aead = NULL;
2008 free_rec_seq:
2009 	kfree(cctx->rec_seq);
2010 	cctx->rec_seq = NULL;
2011 free_iv:
2012 	kfree(cctx->iv);
2013 	cctx->iv = NULL;
2014 free_priv:
2015 	if (tx) {
2016 		kfree(ctx->priv_ctx_tx);
2017 		ctx->priv_ctx_tx = NULL;
2018 	} else {
2019 		kfree(ctx->priv_ctx_rx);
2020 		ctx->priv_ctx_rx = NULL;
2021 	}
2022 out:
2023 	return rc;
2024 }
2025