1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  *
5  * Based on public domain code from Daniel J. Bernstein and Peter Schwabe. This
6  * began from SUPERCOP's curve25519/neon2/scalarmult.s, but has subsequently been
7  * manually reworked for use in kernel space.
8  */
9 
10 #include <asm/hwcap.h>
11 #include <asm/neon.h>
12 #include <asm/simd.h>
13 #include <crypto/internal/kpp.h>
14 #include <crypto/internal/simd.h>
15 #include <linux/types.h>
16 #include <linux/module.h>
17 #include <linux/init.h>
18 #include <linux/jump_label.h>
19 #include <crypto/curve25519.h>
20 
21 asmlinkage void curve25519_neon(u8 mypublic[CURVE25519_KEY_SIZE],
22 				const u8 secret[CURVE25519_KEY_SIZE],
23 				const u8 basepoint[CURVE25519_KEY_SIZE]);
24 
25 static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon);
26 
27 void curve25519_arch(u8 out[CURVE25519_KEY_SIZE],
28 		     const u8 scalar[CURVE25519_KEY_SIZE],
29 		     const u8 point[CURVE25519_KEY_SIZE])
30 {
31 	if (static_branch_likely(&have_neon) && crypto_simd_usable()) {
32 		kernel_neon_begin();
33 		curve25519_neon(out, scalar, point);
34 		kernel_neon_end();
35 	} else {
36 		curve25519_generic(out, scalar, point);
37 	}
38 }
39 EXPORT_SYMBOL(curve25519_arch);
40 
41 void curve25519_base_arch(u8 pub[CURVE25519_KEY_SIZE],
42 			  const u8 secret[CURVE25519_KEY_SIZE])
43 {
44 	return curve25519_arch(pub, secret, curve25519_base_point);
45 }
46 EXPORT_SYMBOL(curve25519_base_arch);
47 
48 static int curve25519_set_secret(struct crypto_kpp *tfm, const void *buf,
49 				 unsigned int len)
50 {
51 	u8 *secret = kpp_tfm_ctx(tfm);
52 
53 	if (!len)
54 		curve25519_generate_secret(secret);
55 	else if (len == CURVE25519_KEY_SIZE &&
56 		 crypto_memneq(buf, curve25519_null_point, CURVE25519_KEY_SIZE))
57 		memcpy(secret, buf, CURVE25519_KEY_SIZE);
58 	else
59 		return -EINVAL;
60 	return 0;
61 }
62 
63 static int curve25519_compute_value(struct kpp_request *req)
64 {
65 	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
66 	const u8 *secret = kpp_tfm_ctx(tfm);
67 	u8 public_key[CURVE25519_KEY_SIZE];
68 	u8 buf[CURVE25519_KEY_SIZE];
69 	int copied, nbytes;
70 	u8 const *bp;
71 
72 	if (req->src) {
73 		copied = sg_copy_to_buffer(req->src,
74 					   sg_nents_for_len(req->src,
75 							    CURVE25519_KEY_SIZE),
76 					   public_key, CURVE25519_KEY_SIZE);
77 		if (copied != CURVE25519_KEY_SIZE)
78 			return -EINVAL;
79 		bp = public_key;
80 	} else {
81 		bp = curve25519_base_point;
82 	}
83 
84 	curve25519_arch(buf, secret, bp);
85 
86 	/* might want less than we've got */
87 	nbytes = min_t(size_t, CURVE25519_KEY_SIZE, req->dst_len);
88 	copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst,
89 								nbytes),
90 				     buf, nbytes);
91 	if (copied != nbytes)
92 		return -EINVAL;
93 	return 0;
94 }
95 
96 static unsigned int curve25519_max_size(struct crypto_kpp *tfm)
97 {
98 	return CURVE25519_KEY_SIZE;
99 }
100 
101 static struct kpp_alg curve25519_alg = {
102 	.base.cra_name		= "curve25519",
103 	.base.cra_driver_name	= "curve25519-neon",
104 	.base.cra_priority	= 200,
105 	.base.cra_module	= THIS_MODULE,
106 	.base.cra_ctxsize	= CURVE25519_KEY_SIZE,
107 
108 	.set_secret		= curve25519_set_secret,
109 	.generate_public_key	= curve25519_compute_value,
110 	.compute_shared_secret	= curve25519_compute_value,
111 	.max_size		= curve25519_max_size,
112 };
113 
114 static int __init mod_init(void)
115 {
116 	if (elf_hwcap & HWCAP_NEON) {
117 		static_branch_enable(&have_neon);
118 		return IS_REACHABLE(CONFIG_CRYPTO_KPP) ?
119 			crypto_register_kpp(&curve25519_alg) : 0;
120 	}
121 	return 0;
122 }
123 
124 static void __exit mod_exit(void)
125 {
126 	if (IS_REACHABLE(CONFIG_CRYPTO_KPP) && elf_hwcap & HWCAP_NEON)
127 		crypto_unregister_kpp(&curve25519_alg);
128 }
129 
130 module_init(mod_init);
131 module_exit(mod_exit);
132 
133 MODULE_ALIAS_CRYPTO("curve25519");
134 MODULE_ALIAS_CRYPTO("curve25519-neon");
135 MODULE_LICENSE("GPL v2");
136