1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Cryptographic API. 4 * 5 * s390 implementation of the GHASH algorithm for GCM (Galois/Counter Mode). 6 * 7 * Copyright IBM Corp. 2011 8 * Author(s): Gerald Schaefer <gerald.schaefer@de.ibm.com> 9 */ 10 11 #include <crypto/internal/hash.h> 12 #include <linux/module.h> 13 #include <linux/cpufeature.h> 14 #include <asm/cpacf.h> 15 16 #define GHASH_BLOCK_SIZE 16 17 #define GHASH_DIGEST_SIZE 16 18 19 struct ghash_ctx { 20 u8 key[GHASH_BLOCK_SIZE]; 21 }; 22 23 struct ghash_desc_ctx { 24 u8 icv[GHASH_BLOCK_SIZE]; 25 u8 key[GHASH_BLOCK_SIZE]; 26 u8 buffer[GHASH_BLOCK_SIZE]; 27 u32 bytes; 28 }; 29 30 static int ghash_init(struct shash_desc *desc) 31 { 32 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 33 struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); 34 35 memset(dctx, 0, sizeof(*dctx)); 36 memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); 37 38 return 0; 39 } 40 41 static int ghash_setkey(struct crypto_shash *tfm, 42 const u8 *key, unsigned int keylen) 43 { 44 struct ghash_ctx *ctx = crypto_shash_ctx(tfm); 45 46 if (keylen != GHASH_BLOCK_SIZE) { 47 crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); 48 return -EINVAL; 49 } 50 51 memcpy(ctx->key, key, GHASH_BLOCK_SIZE); 52 53 return 0; 54 } 55 56 static int ghash_update(struct shash_desc *desc, 57 const u8 *src, unsigned int srclen) 58 { 59 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 60 unsigned int n; 61 u8 *buf = dctx->buffer; 62 63 if (dctx->bytes) { 64 u8 *pos = buf + (GHASH_BLOCK_SIZE - dctx->bytes); 65 66 n = min(srclen, dctx->bytes); 67 dctx->bytes -= n; 68 srclen -= n; 69 70 memcpy(pos, src, n); 71 src += n; 72 73 if (!dctx->bytes) { 74 cpacf_kimd(CPACF_KIMD_GHASH, dctx, buf, 75 GHASH_BLOCK_SIZE); 76 } 77 } 78 79 n = srclen & ~(GHASH_BLOCK_SIZE - 1); 80 if (n) { 81 cpacf_kimd(CPACF_KIMD_GHASH, dctx, src, n); 82 src += n; 83 srclen -= n; 84 } 85 86 if (srclen) { 87 dctx->bytes = GHASH_BLOCK_SIZE - srclen; 88 memcpy(buf, src, srclen); 89 } 90 91 return 0; 92 } 93 94 static int ghash_flush(struct ghash_desc_ctx *dctx) 95 { 96 u8 *buf = dctx->buffer; 97 98 if (dctx->bytes) { 99 u8 *pos = buf + (GHASH_BLOCK_SIZE - dctx->bytes); 100 101 memset(pos, 0, dctx->bytes); 102 cpacf_kimd(CPACF_KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); 103 dctx->bytes = 0; 104 } 105 106 return 0; 107 } 108 109 static int ghash_final(struct shash_desc *desc, u8 *dst) 110 { 111 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 112 int ret; 113 114 ret = ghash_flush(dctx); 115 if (!ret) 116 memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); 117 return ret; 118 } 119 120 static struct shash_alg ghash_alg = { 121 .digestsize = GHASH_DIGEST_SIZE, 122 .init = ghash_init, 123 .update = ghash_update, 124 .final = ghash_final, 125 .setkey = ghash_setkey, 126 .descsize = sizeof(struct ghash_desc_ctx), 127 .base = { 128 .cra_name = "ghash", 129 .cra_driver_name = "ghash-s390", 130 .cra_priority = 300, 131 .cra_blocksize = GHASH_BLOCK_SIZE, 132 .cra_ctxsize = sizeof(struct ghash_ctx), 133 .cra_module = THIS_MODULE, 134 }, 135 }; 136 137 static int __init ghash_mod_init(void) 138 { 139 if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_GHASH)) 140 return -ENODEV; 141 142 return crypto_register_shash(&ghash_alg); 143 } 144 145 static void __exit ghash_mod_exit(void) 146 { 147 crypto_unregister_shash(&ghash_alg); 148 } 149 150 module_cpu_feature_match(MSA, ghash_mod_init); 151 module_exit(ghash_mod_exit); 152 153 MODULE_ALIAS_CRYPTO("ghash"); 154 155 MODULE_LICENSE("GPL"); 156 MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation"); 157