nrf_security: Refactor blkcipher in Cracen

In the Cracen driver the PSA context cracen_cipher_operation_t
already contains a struct sxkeyref and also a struct sxblkcipher
which also contains a sxkeyref struct. Instead of keeping two
instanses of the sxkeyref keep the one in the PSA operation
and convert the other one to pointer and refactor the code
of blkcipher accordingly.

Signed-off-by: Georgios Vasilakis <[email protected]>

Author: Vge0rge

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/cipher.c

@@ -292,24 +292,24 @@ psa_status_t cracen_cipher_encrypt(const psa_key_attributes_t *attributes,
 	 * error and thus we don't need to write an else here.
 	 */
 	if (IS_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES) && alg == PSA_ALG_ECB_NO_PADDING) {
-		struct sxkeyref key;
 
-		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
+		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
+					    &operation.keyref);
 		if (status != PSA_SUCCESS) {
 			return status;
 		}
-		return crypt_ecb(&operation.cipher, &key, input, input_length, output, output_size,
-				 output_length, CRACEN_ENCRYPT);
+
+		return crypt_ecb(&operation.cipher, &operation.keyref, input, input_length, output,
+				 output_size, output_length, CRACEN_ENCRYPT);
 	}
 	if (IS_ENABLED(PSA_NEED_CRACEN_CBC_PKCS7_AES) && alg == PSA_ALG_CBC_PKCS7) {
-		struct sxkeyref key;
-
-		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
+		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
+					    &operation.keyref);
 		if (status != PSA_SUCCESS) {
 			return status;
 		}
-		return encrypt_cbc(&key, input, input_length, output, output_size, output_length,
-				   iv);
+		return encrypt_cbc(&operation.keyref, input, input_length, output, output_size,
+				   output_length, iv);
 	}
 
 	status = setup(CRACEN_ENCRYPT, &operation, attributes, key_buffer, key_buffer_size, alg);
@@ -339,7 +339,6 @@ psa_status_t cracen_cipher_decrypt(const psa_key_attributes_t *attributes,
 	psa_status_t status;
 	/* ChaCha20 only supports 12 bytes IV in the single part decryption function */
 	const size_t iv_size = (alg == PSA_ALG_STREAM_CIPHER) ? 12 : SX_BLKCIPHER_IV_SZ;
-	struct sxkeyref key;
 	*output_length = 0;
 
 	if (input_length == 0) {
@@ -350,20 +349,22 @@ psa_status_t cracen_cipher_decrypt(const psa_key_attributes_t *attributes,
 	 * error and thus we don't need to write an else here.
 	 */
 	if (IS_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES) && alg == PSA_ALG_ECB_NO_PADDING) {
-		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
+		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
+					    &operation.keyref);
 		if (status != PSA_SUCCESS) {
 			return status;
 		}
-		return crypt_ecb(&operation.cipher, &key, input, input_length, output, output_size,
-				 output_length, CRACEN_DECRYPT);
+		return crypt_ecb(&operation.cipher, &operation.keyref, input, input_length, output,
+				 output_size, output_length, CRACEN_DECRYPT);
 	}
 	if (IS_ENABLED(PSA_NEED_CRACEN_CBC_PKCS7_AES) && alg == PSA_ALG_CBC_PKCS7) {
-		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
+		status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
+					    &operation.keyref);
 		if (status != PSA_SUCCESS) {
 			return status;
 		}
-		return decrypt_cbc(&key, input + iv_size, input_length - iv_size, output,
-				   output_size, output_length, input);
+		return decrypt_cbc(&operation.keyref, input + iv_size, input_length - iv_size,
+				   output, output_size, output_length, input);
 	}
 
 	if (input_length < iv_size) {

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/internal.h

@@ -111,7 +111,7 @@ struct sxaead {
  */
 struct sxblkcipher {
 	const struct sx_blkcipher_cmdma_cfg *cfg;
-	struct sxkeyref key;
+	const struct sxkeyref *key;
 	uint32_t textsz;
 	struct sx_dmactl dma;
 	struct sxdesc descs[5];

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/blkcipher.c

@@ -81,8 +81,8 @@ static const struct sx_blkcipher_cmdma_cfg ba411xtscfg = {
 int sx_blkcipher_free(struct sxblkcipher *cipher_ctx)
 {
 	int sx_err = SX_OK;
-	if (cipher_ctx->key.clean_key) {
-		sx_err = cipher_ctx->key.clean_key(cipher_ctx->key.user_data);
+	if (cipher_ctx->key && cipher_ctx->key->clean_key) {
+		sx_err = cipher_ctx->key->clean_key(cipher_ctx->key->user_data);
 	}
 	sx_cmdma_release_hw(&cipher_ctx->dma);
 	return sx_err;
@@ -106,8 +106,8 @@ static int sx_blkcipher_hw_reserve(struct sxblkcipher *cipher_ctx)
 		goto exit;
 	}
 
-	if (cipher_ctx->key.prepare_key) {
-		err = cipher_ctx->key.prepare_key(cipher_ctx->key.user_data);
+	if (cipher_ctx->key && cipher_ctx->key->prepare_key) {
+		err = cipher_ctx->key->prepare_key(cipher_ctx->key->user_data);
 	}
 
 exit:
@@ -140,7 +140,7 @@ static int sx_blkcipher_create_aesxts(struct sxblkcipher *cipher_ctx, const stru
 		}
 	}
 
-	memcpy(&cipher_ctx->key, key1, sizeof(cipher_ctx->key));
+	cipher_ctx->key = key1;
 	err = sx_blkcipher_hw_reserve(cipher_ctx);
 	if (err != SX_OK) {
 		return err;
@@ -207,7 +207,7 @@ static int sx_blkcipher_create_aes_ba411(struct sxblkcipher *cipher_ctx, const s
 		}
 	}
 
-	memcpy(&cipher_ctx->key, key, sizeof(cipher_ctx->key));
+	cipher_ctx->key = key;
 	cipher_ctx->cfg = cfg;
 	cipher_ctx->textsz = 0;
 
@@ -324,8 +324,9 @@ int sx_blkcipher_resume_state(struct sxblkcipher *cipher_ctx)
 	cipher_ctx->dma.dmamem.cfg &= ~(cipher_ctx->cfg->ctxsave);
 	sx_cmdma_newcmd(&cipher_ctx->dma, cipher_ctx->descs, cipher_ctx->dma.dmamem.cfg,
 			cipher_ctx->cfg->dmatags->cfg);
-	if (KEYREF_IS_USR(&cipher_ctx->key)) {
-		ADD_CFGDESC(cipher_ctx->dma, cipher_ctx->key.key, cipher_ctx->key.sz,
+
+	if (cipher_ctx->key && KEYREF_IS_USR(cipher_ctx->key)) {
+		ADD_CFGDESC(cipher_ctx->dma, cipher_ctx->key->key, cipher_ctx->key->sz,
 			    cipher_ctx->cfg->dmatags->key);
 	}
 	/* Context will be transferred in the same place as the IV. However,

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/chachapoly.c

@@ -151,9 +151,9 @@ static int sx_blkcipher_create_chacha20(struct sxblkcipher *cipher_ctx, struct s
 		return SX_ERR_INVALID_KEY_SZ;
 	}
 
-	memcpy(&cipher_ctx->key, key, sizeof(cipher_ctx->key));
 	sx_hw_reserve(&cipher_ctx->dma);
 	cipher_ctx->cfg = &ba417chacha20cfg;
+	cipher_ctx->key = key;
 
 	sx_cmdma_newcmd(&cipher_ctx->dma, cipher_ctx->descs, BA417_MODE_CHACHA20 | dir,
 			cipher_ctx->cfg->dmatags->cfg);