1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright IBM Corp. 2024 4 * 5 * s390 specific HMAC support. 6 */ 7 8 #define KMSG_COMPONENT "hmac_s390" 9 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 10 11 #include <asm/cpacf.h> 12 #include <crypto/sha2.h> 13 #include <crypto/internal/hash.h> 14 #include <linux/cpufeature.h> 15 #include <linux/module.h> 16 17 /* 18 * KMAC param block layout for sha2 function codes: 19 * The layout of the param block for the KMAC instruction depends on the 20 * blocksize of the used hashing sha2-algorithm function codes. The param block 21 * contains the hash chaining value (cv), the input message bit-length (imbl) 22 * and the hmac-secret (key). To prevent code duplication, the sizes of all 23 * these are calculated based on the blocksize. 24 * 25 * param-block: 26 * +-------+ 27 * | cv | 28 * +-------+ 29 * | imbl | 30 * +-------+ 31 * | key | 32 * +-------+ 33 * 34 * sizes: 35 * part | sh2-alg | calculation | size | type 36 * -----+---------+-------------+------+-------- 37 * cv | 224/256 | blocksize/2 | 32 | u64[8] 38 * | 384/512 | | 64 | u128[8] 39 * imbl | 224/256 | blocksize/8 | 8 | u64 40 * | 384/512 | | 16 | u128 41 * key | 224/256 | blocksize | 64 | u8[64] 42 * | 384/512 | | 128 | u8[128] 43 */ 44 45 #define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE 46 #define MAX_IMBL_SIZE sizeof(u128) 47 #define MAX_BLOCK_SIZE SHA512_BLOCK_SIZE 48 49 #define SHA2_CV_SIZE(bs) ((bs) >> 1) 50 #define SHA2_IMBL_SIZE(bs) ((bs) >> 3) 51 52 #define SHA2_IMBL_OFFSET(bs) (SHA2_CV_SIZE(bs)) 53 #define SHA2_KEY_OFFSET(bs) (SHA2_CV_SIZE(bs) + SHA2_IMBL_SIZE(bs)) 54 55 struct s390_hmac_ctx { 56 u8 key[MAX_BLOCK_SIZE]; 57 }; 58 59 union s390_kmac_gr0 { 60 unsigned long reg; 61 struct { 62 unsigned long : 48; 63 unsigned long ikp : 1; 64 unsigned long iimp : 1; 65 unsigned long ccup : 1; 66 unsigned long : 6; 67 unsigned long fc : 7; 68 }; 69 }; 70 71 struct s390_kmac_sha2_ctx { 72 u8 param[MAX_DIGEST_SIZE + MAX_IMBL_SIZE + MAX_BLOCK_SIZE]; 73 union s390_kmac_gr0 gr0; 74 u8 buf[MAX_BLOCK_SIZE]; 75 unsigned int buflen; 76 }; 77 78 /* 79 * kmac_sha2_set_imbl - sets the input message bit-length based on the blocksize 80 */ 81 static inline void kmac_sha2_set_imbl(u8 *param, unsigned int buflen, 82 unsigned int blocksize) 83 { 84 u8 *imbl = param + SHA2_IMBL_OFFSET(blocksize); 85 86 switch (blocksize) { 87 case SHA256_BLOCK_SIZE: 88 *(u64 *)imbl = (u64)buflen * BITS_PER_BYTE; 89 break; 90 case SHA512_BLOCK_SIZE: 91 *(u128 *)imbl = (u128)buflen * BITS_PER_BYTE; 92 break; 93 default: 94 break; 95 } 96 } 97 98 static int hash_key(const u8 *in, unsigned int inlen, 99 u8 *digest, unsigned int digestsize) 100 { 101 unsigned long func; 102 union { 103 struct sha256_paramblock { 104 u32 h[8]; 105 u64 mbl; 106 } sha256; 107 struct sha512_paramblock { 108 u64 h[8]; 109 u128 mbl; 110 } sha512; 111 } __packed param; 112 113 #define PARAM_INIT(x, y, z) \ 114 param.sha##x.h[0] = SHA##y ## _H0; \ 115 param.sha##x.h[1] = SHA##y ## _H1; \ 116 param.sha##x.h[2] = SHA##y ## _H2; \ 117 param.sha##x.h[3] = SHA##y ## _H3; \ 118 param.sha##x.h[4] = SHA##y ## _H4; \ 119 param.sha##x.h[5] = SHA##y ## _H5; \ 120 param.sha##x.h[6] = SHA##y ## _H6; \ 121 param.sha##x.h[7] = SHA##y ## _H7; \ 122 param.sha##x.mbl = (z) 123 124 switch (digestsize) { 125 case SHA224_DIGEST_SIZE: 126 func = CPACF_KLMD_SHA_256; 127 PARAM_INIT(256, 224, inlen * 8); 128 break; 129 case SHA256_DIGEST_SIZE: 130 func = CPACF_KLMD_SHA_256; 131 PARAM_INIT(256, 256, inlen * 8); 132 break; 133 case SHA384_DIGEST_SIZE: 134 func = CPACF_KLMD_SHA_512; 135 PARAM_INIT(512, 384, inlen * 8); 136 break; 137 case SHA512_DIGEST_SIZE: 138 func = CPACF_KLMD_SHA_512; 139 PARAM_INIT(512, 512, inlen * 8); 140 break; 141 default: 142 return -EINVAL; 143 } 144 145 #undef PARAM_INIT 146 147 cpacf_klmd(func, ¶m, in, inlen); 148 149 memcpy(digest, ¶m, digestsize); 150 151 return 0; 152 } 153 154 static int s390_hmac_sha2_setkey(struct crypto_shash *tfm, 155 const u8 *key, unsigned int keylen) 156 { 157 struct s390_hmac_ctx *tfm_ctx = crypto_shash_ctx(tfm); 158 unsigned int ds = crypto_shash_digestsize(tfm); 159 unsigned int bs = crypto_shash_blocksize(tfm); 160 161 memset(tfm_ctx, 0, sizeof(*tfm_ctx)); 162 163 if (keylen > bs) 164 return hash_key(key, keylen, tfm_ctx->key, ds); 165 166 memcpy(tfm_ctx->key, key, keylen); 167 return 0; 168 } 169 170 static int s390_hmac_sha2_init(struct shash_desc *desc) 171 { 172 struct s390_hmac_ctx *tfm_ctx = crypto_shash_ctx(desc->tfm); 173 struct s390_kmac_sha2_ctx *ctx = shash_desc_ctx(desc); 174 unsigned int bs = crypto_shash_blocksize(desc->tfm); 175 176 memcpy(ctx->param + SHA2_KEY_OFFSET(bs), 177 tfm_ctx->key, bs); 178 179 ctx->buflen = 0; 180 ctx->gr0.reg = 0; 181 switch (crypto_shash_digestsize(desc->tfm)) { 182 case SHA224_DIGEST_SIZE: 183 ctx->gr0.fc = CPACF_KMAC_HMAC_SHA_224; 184 break; 185 case SHA256_DIGEST_SIZE: 186 ctx->gr0.fc = CPACF_KMAC_HMAC_SHA_256; 187 break; 188 case SHA384_DIGEST_SIZE: 189 ctx->gr0.fc = CPACF_KMAC_HMAC_SHA_384; 190 break; 191 case SHA512_DIGEST_SIZE: 192 ctx->gr0.fc = CPACF_KMAC_HMAC_SHA_512; 193 break; 194 default: 195 return -EINVAL; 196 } 197 198 return 0; 199 } 200 201 static int s390_hmac_sha2_update(struct shash_desc *desc, 202 const u8 *data, unsigned int len) 203 { 204 struct s390_kmac_sha2_ctx *ctx = shash_desc_ctx(desc); 205 unsigned int bs = crypto_shash_blocksize(desc->tfm); 206 unsigned int offset, n; 207 208 /* check current buffer */ 209 offset = ctx->buflen % bs; 210 ctx->buflen += len; 211 if (offset + len < bs) 212 goto store; 213 214 /* process one stored block */ 215 if (offset) { 216 n = bs - offset; 217 memcpy(ctx->buf + offset, data, n); 218 ctx->gr0.iimp = 1; 219 _cpacf_kmac(&ctx->gr0.reg, ctx->param, ctx->buf, bs); 220 data += n; 221 len -= n; 222 offset = 0; 223 } 224 /* process as many blocks as possible */ 225 if (len >= bs) { 226 n = (len / bs) * bs; 227 ctx->gr0.iimp = 1; 228 _cpacf_kmac(&ctx->gr0.reg, ctx->param, data, n); 229 data += n; 230 len -= n; 231 } 232 store: 233 /* store incomplete block in buffer */ 234 if (len) 235 memcpy(ctx->buf + offset, data, len); 236 237 return 0; 238 } 239 240 static int s390_hmac_sha2_final(struct shash_desc *desc, u8 *out) 241 { 242 struct s390_kmac_sha2_ctx *ctx = shash_desc_ctx(desc); 243 unsigned int bs = crypto_shash_blocksize(desc->tfm); 244 245 ctx->gr0.iimp = 0; 246 kmac_sha2_set_imbl(ctx->param, ctx->buflen, bs); 247 _cpacf_kmac(&ctx->gr0.reg, ctx->param, ctx->buf, ctx->buflen % bs); 248 memcpy(out, ctx->param, crypto_shash_digestsize(desc->tfm)); 249 250 return 0; 251 } 252 253 static int s390_hmac_sha2_digest(struct shash_desc *desc, 254 const u8 *data, unsigned int len, u8 *out) 255 { 256 struct s390_kmac_sha2_ctx *ctx = shash_desc_ctx(desc); 257 unsigned int ds = crypto_shash_digestsize(desc->tfm); 258 int rc; 259 260 rc = s390_hmac_sha2_init(desc); 261 if (rc) 262 return rc; 263 264 ctx->gr0.iimp = 0; 265 kmac_sha2_set_imbl(ctx->param, len, 266 crypto_shash_blocksize(desc->tfm)); 267 _cpacf_kmac(&ctx->gr0.reg, ctx->param, data, len); 268 memcpy(out, ctx->param, ds); 269 270 return 0; 271 } 272 273 #define S390_HMAC_SHA2_ALG(x) { \ 274 .fc = CPACF_KMAC_HMAC_SHA_##x, \ 275 .alg = { \ 276 .init = s390_hmac_sha2_init, \ 277 .update = s390_hmac_sha2_update, \ 278 .final = s390_hmac_sha2_final, \ 279 .digest = s390_hmac_sha2_digest, \ 280 .setkey = s390_hmac_sha2_setkey, \ 281 .descsize = sizeof(struct s390_kmac_sha2_ctx), \ 282 .halg = { \ 283 .digestsize = SHA##x##_DIGEST_SIZE, \ 284 .base = { \ 285 .cra_name = "hmac(sha" #x ")", \ 286 .cra_driver_name = "hmac_s390_sha" #x, \ 287 .cra_blocksize = SHA##x##_BLOCK_SIZE, \ 288 .cra_priority = 400, \ 289 .cra_ctxsize = sizeof(struct s390_hmac_ctx), \ 290 .cra_module = THIS_MODULE, \ 291 }, \ 292 }, \ 293 }, \ 294 } 295 296 static struct s390_hmac_alg { 297 bool registered; 298 unsigned int fc; 299 struct shash_alg alg; 300 } s390_hmac_algs[] = { 301 S390_HMAC_SHA2_ALG(224), 302 S390_HMAC_SHA2_ALG(256), 303 S390_HMAC_SHA2_ALG(384), 304 S390_HMAC_SHA2_ALG(512), 305 }; 306 307 static __always_inline void _s390_hmac_algs_unregister(void) 308 { 309 struct s390_hmac_alg *hmac; 310 int i; 311 312 for (i = ARRAY_SIZE(s390_hmac_algs) - 1; i >= 0; i--) { 313 hmac = &s390_hmac_algs[i]; 314 if (!hmac->registered) 315 continue; 316 crypto_unregister_shash(&hmac->alg); 317 } 318 } 319 320 static int __init hmac_s390_init(void) 321 { 322 struct s390_hmac_alg *hmac; 323 int i, rc = -ENODEV; 324 325 if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_256)) 326 return -ENODEV; 327 if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_512)) 328 return -ENODEV; 329 330 for (i = 0; i < ARRAY_SIZE(s390_hmac_algs); i++) { 331 hmac = &s390_hmac_algs[i]; 332 if (!cpacf_query_func(CPACF_KMAC, hmac->fc)) 333 continue; 334 335 rc = crypto_register_shash(&hmac->alg); 336 if (rc) { 337 pr_err("unable to register %s\n", 338 hmac->alg.halg.base.cra_name); 339 goto out; 340 } 341 hmac->registered = true; 342 pr_debug("registered %s\n", hmac->alg.halg.base.cra_name); 343 } 344 return rc; 345 out: 346 _s390_hmac_algs_unregister(); 347 return rc; 348 } 349 350 static void __exit hmac_s390_exit(void) 351 { 352 _s390_hmac_algs_unregister(); 353 } 354 355 module_cpu_feature_match(S390_CPU_FEATURE_MSA, hmac_s390_init); 356 module_exit(hmac_s390_exit); 357 358 MODULE_DESCRIPTION("S390 HMAC driver"); 359 MODULE_LICENSE("GPL"); 360