1 /* 2 * Cryptographic API. 3 * 4 * s390 implementation of the GHASH algorithm for GCM (Galois/Counter Mode). 5 * 6 * Copyright IBM Corp. 2011 7 * Author(s): Gerald Schaefer <gerald.schaefer@de.ibm.com> 8 */ 9 10 #include <crypto/internal/hash.h> 11 #include <linux/module.h> 12 13 #include "crypt_s390.h" 14 15 #define GHASH_BLOCK_SIZE 16 16 #define GHASH_DIGEST_SIZE 16 17 18 struct ghash_ctx { 19 u8 key[GHASH_BLOCK_SIZE]; 20 }; 21 22 struct ghash_desc_ctx { 23 u8 icv[GHASH_BLOCK_SIZE]; 24 u8 key[GHASH_BLOCK_SIZE]; 25 u8 buffer[GHASH_BLOCK_SIZE]; 26 u32 bytes; 27 }; 28 29 static int ghash_init(struct shash_desc *desc) 30 { 31 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 32 struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); 33 34 memset(dctx, 0, sizeof(*dctx)); 35 memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); 36 37 return 0; 38 } 39 40 static int ghash_setkey(struct crypto_shash *tfm, 41 const u8 *key, unsigned int keylen) 42 { 43 struct ghash_ctx *ctx = crypto_shash_ctx(tfm); 44 45 if (keylen != GHASH_BLOCK_SIZE) { 46 crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); 47 return -EINVAL; 48 } 49 50 memcpy(ctx->key, key, GHASH_BLOCK_SIZE); 51 52 return 0; 53 } 54 55 static int ghash_update(struct shash_desc *desc, 56 const u8 *src, unsigned int srclen) 57 { 58 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 59 unsigned int n; 60 u8 *buf = dctx->buffer; 61 int ret; 62 63 if (dctx->bytes) { 64 u8 *pos = buf + (GHASH_BLOCK_SIZE - dctx->bytes); 65 66 n = min(srclen, dctx->bytes); 67 dctx->bytes -= n; 68 srclen -= n; 69 70 memcpy(pos, src, n); 71 src += n; 72 73 if (!dctx->bytes) { 74 ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, 75 GHASH_BLOCK_SIZE); 76 if (ret != GHASH_BLOCK_SIZE) 77 return -EIO; 78 } 79 } 80 81 n = srclen & ~(GHASH_BLOCK_SIZE - 1); 82 if (n) { 83 ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); 84 if (ret != n) 85 return -EIO; 86 src += n; 87 srclen -= n; 88 } 89 90 if (srclen) { 91 dctx->bytes = GHASH_BLOCK_SIZE - srclen; 92 memcpy(buf, src, srclen); 93 } 94 95 return 0; 96 } 97 98 static int ghash_flush(struct ghash_desc_ctx *dctx) 99 { 100 u8 *buf = dctx->buffer; 101 int ret; 102 103 if (dctx->bytes) { 104 u8 *pos = buf + (GHASH_BLOCK_SIZE - dctx->bytes); 105 106 memset(pos, 0, dctx->bytes); 107 108 ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); 109 if (ret != GHASH_BLOCK_SIZE) 110 return -EIO; 111 112 dctx->bytes = 0; 113 } 114 115 return 0; 116 } 117 118 static int ghash_final(struct shash_desc *desc, u8 *dst) 119 { 120 struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); 121 int ret; 122 123 ret = ghash_flush(dctx); 124 if (!ret) 125 memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); 126 return ret; 127 } 128 129 static struct shash_alg ghash_alg = { 130 .digestsize = GHASH_DIGEST_SIZE, 131 .init = ghash_init, 132 .update = ghash_update, 133 .final = ghash_final, 134 .setkey = ghash_setkey, 135 .descsize = sizeof(struct ghash_desc_ctx), 136 .base = { 137 .cra_name = "ghash", 138 .cra_driver_name = "ghash-s390", 139 .cra_priority = CRYPT_S390_PRIORITY, 140 .cra_flags = CRYPTO_ALG_TYPE_SHASH, 141 .cra_blocksize = GHASH_BLOCK_SIZE, 142 .cra_ctxsize = sizeof(struct ghash_ctx), 143 .cra_module = THIS_MODULE, 144 }, 145 }; 146 147 static int __init ghash_mod_init(void) 148 { 149 if (!crypt_s390_func_available(KIMD_GHASH, 150 CRYPT_S390_MSA | CRYPT_S390_MSA4)) 151 return -EOPNOTSUPP; 152 153 return crypto_register_shash(&ghash_alg); 154 } 155 156 static void __exit ghash_mod_exit(void) 157 { 158 crypto_unregister_shash(&ghash_alg); 159 } 160 161 module_init(ghash_mod_init); 162 module_exit(ghash_mod_exit); 163 164 MODULE_ALIAS_CRYPTO("ghash"); 165 166 MODULE_LICENSE("GPL"); 167 MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation"); 168