Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
lib/crypto: blake2s: Rename blake2s_state to blake2s_ctx
For consistency with the SHA-1, SHA-2, SHA-3 (in development), and MD5
library APIs, rename blake2s_state to blake2s_ctx.
As a refresher, the ctx name:
- Is a bit shorter.
- Avoids confusion with the compression function state, which is also
often called the state (but is just part of the full context).
- Is consistent with OpenSSL.
Not a big deal, of course. But consistency is nice. With a BLAKE2b
library API about to be added, this is a convenient time to update this.
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251018043106.375964-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+104
-106
+1
-1
drivers/char/random.c
+1
-1
drivers/char/random.c
+14
-14
drivers/net/wireguard/noise.c
+14
-14
drivers/net/wireguard/noise.c
···
33
33
34
34
void __init wg_noise_init(void)
35
35
{
36
-
struct blake2s_state blake;
36
+
struct blake2s_ctx blake;
37
37
38
38
blake2s(NULL, 0, handshake_name, sizeof(handshake_name),
39
39
handshake_init_chaining_key, NOISE_HASH_LEN);
···
304
304
305
305
static void hmac(u8 *out, const u8 *in, const u8 *key, const size_t inlen, const size_t keylen)
306
306
{
307
-
struct blake2s_state state;
307
+
struct blake2s_ctx blake;
308
308
u8 x_key[BLAKE2S_BLOCK_SIZE] __aligned(__alignof__(u32)) = { 0 };
309
309
u8 i_hash[BLAKE2S_HASH_SIZE] __aligned(__alignof__(u32));
310
310
int i;
311
311
312
312
if (keylen > BLAKE2S_BLOCK_SIZE) {
313
-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
314
-
blake2s_update(&state, key, keylen);
315
-
blake2s_final(&state, x_key);
313
+
blake2s_init(&blake, BLAKE2S_HASH_SIZE);
314
+
blake2s_update(&blake, key, keylen);
315
+
blake2s_final(&blake, x_key);
316
316
} else
317
317
memcpy(x_key, key, keylen);
318
318
319
319
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
320
320
x_key[i] ^= 0x36;
321
321
322
-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
323
-
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
324
-
blake2s_update(&state, in, inlen);
325
-
blake2s_final(&state, i_hash);
322
+
blake2s_init(&blake, BLAKE2S_HASH_SIZE);
323
+
blake2s_update(&blake, x_key, BLAKE2S_BLOCK_SIZE);
324
+
blake2s_update(&blake, in, inlen);
325
+
blake2s_final(&blake, i_hash);
326
326
327
327
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
328
328
x_key[i] ^= 0x5c ^ 0x36;
329
329
330
-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
331
-
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
332
-
blake2s_update(&state, i_hash, BLAKE2S_HASH_SIZE);
333
-
blake2s_final(&state, i_hash);
330
+
blake2s_init(&blake, BLAKE2S_HASH_SIZE);
331
+
blake2s_update(&blake, x_key, BLAKE2S_BLOCK_SIZE);
332
+
blake2s_update(&blake, i_hash, BLAKE2S_HASH_SIZE);
333
+
blake2s_final(&blake, i_hash);
334
334
335
335
memcpy(out, i_hash, BLAKE2S_HASH_SIZE);
336
336
memzero_explicit(x_key, BLAKE2S_BLOCK_SIZE);
···
431
431
432
432
static void mix_hash(u8 hash[NOISE_HASH_LEN], const u8 *src, size_t src_len)
433
433
{
434
-
struct blake2s_state blake;
434
+
struct blake2s_ctx blake;
435
435
436
436
blake2s_init(&blake, NOISE_HASH_LEN);
437
437
blake2s_update(&blake, hash, NOISE_HASH_LEN);
+29
-30
include/crypto/blake2s.h
+29
-30
include/crypto/blake2s.h
···
22
22
BLAKE2S_256_HASH_SIZE = 32,
23
23
};
24
24
25
-
struct blake2s_state {
25
+
struct blake2s_ctx {
26
26
/* 'h', 't', and 'f' are used in assembly code, so keep them as-is. */
27
27
u32 h[8];
28
28
u32 t[2];
···
43
43
BLAKE2S_IV7 = 0x5BE0CD19UL,
44
44
};
45
45
46
-
static inline void __blake2s_init(struct blake2s_state *state, size_t outlen,
46
+
static inline void __blake2s_init(struct blake2s_ctx *ctx, size_t outlen,
47
47
const void *key, size_t keylen)
48
48
{
49
-
state->h[0] = BLAKE2S_IV0 ^ (0x01010000 | keylen << 8 | outlen);
50
-
state->h[1] = BLAKE2S_IV1;
51
-
state->h[2] = BLAKE2S_IV2;
52
-
state->h[3] = BLAKE2S_IV3;
53
-
state->h[4] = BLAKE2S_IV4;
54
-
state->h[5] = BLAKE2S_IV5;
55
-
state->h[6] = BLAKE2S_IV6;
56
-
state->h[7] = BLAKE2S_IV7;
57
-
state->t[0] = 0;
58
-
state->t[1] = 0;
59
-
state->f[0] = 0;
60
-
state->f[1] = 0;
61
-
state->buflen = 0;
62
-
state->outlen = outlen;
49
+
ctx->h[0] = BLAKE2S_IV0 ^ (0x01010000 | keylen << 8 | outlen);
50
+
ctx->h[1] = BLAKE2S_IV1;
51
+
ctx->h[2] = BLAKE2S_IV2;
52
+
ctx->h[3] = BLAKE2S_IV3;
53
+
ctx->h[4] = BLAKE2S_IV4;
54
+
ctx->h[5] = BLAKE2S_IV5;
55
+
ctx->h[6] = BLAKE2S_IV6;
56
+
ctx->h[7] = BLAKE2S_IV7;
57
+
ctx->t[0] = 0;
58
+
ctx->t[1] = 0;
59
+
ctx->f[0] = 0;
60
+
ctx->f[1] = 0;
61
+
ctx->buflen = 0;
62
+
ctx->outlen = outlen;
63
63
if (keylen) {
64
-
memcpy(state->buf, key, keylen);
65
-
memset(&state->buf[keylen], 0, BLAKE2S_BLOCK_SIZE - keylen);
66
-
state->buflen = BLAKE2S_BLOCK_SIZE;
64
+
memcpy(ctx->buf, key, keylen);
65
+
memset(&ctx->buf[keylen], 0, BLAKE2S_BLOCK_SIZE - keylen);
66
+
ctx->buflen = BLAKE2S_BLOCK_SIZE;
67
67
}
68
68
}
69
69
70
-
static inline void blake2s_init(struct blake2s_state *state,
71
-
const size_t outlen)
70
+
static inline void blake2s_init(struct blake2s_ctx *ctx, const size_t outlen)
72
71
{
73
-
__blake2s_init(state, outlen, NULL, 0);
72
+
__blake2s_init(ctx, outlen, NULL, 0);
74
73
}
75
74
76
-
static inline void blake2s_init_key(struct blake2s_state *state,
75
+
static inline void blake2s_init_key(struct blake2s_ctx *ctx,
77
76
const size_t outlen, const void *key,
78
77
const size_t keylen)
79
78
{
80
79
WARN_ON(IS_ENABLED(DEBUG) && (!outlen || outlen > BLAKE2S_HASH_SIZE ||
81
80
!key || !keylen || keylen > BLAKE2S_KEY_SIZE));
82
81
83
-
__blake2s_init(state, outlen, key, keylen);
82
+
__blake2s_init(ctx, outlen, key, keylen);
84
83
}
85
84
86
-
void blake2s_update(struct blake2s_state *state, const u8 *in, size_t inlen);
87
-
void blake2s_final(struct blake2s_state *state, u8 *out);
85
+
void blake2s_update(struct blake2s_ctx *ctx, const u8 *in, size_t inlen);
86
+
void blake2s_final(struct blake2s_ctx *ctx, u8 *out);
88
87
89
88
static inline void blake2s(const u8 *key, const size_t keylen,
90
89
const u8 *in, const size_t inlen,
91
90
u8 *out, const size_t outlen)
92
91
{
93
-
struct blake2s_state state;
92
+
struct blake2s_ctx ctx;
94
93
95
94
WARN_ON(IS_ENABLED(DEBUG) && ((!in && inlen > 0) || !out || !outlen ||
96
95
outlen > BLAKE2S_HASH_SIZE || keylen > BLAKE2S_KEY_SIZE ||
97
96
(!key && keylen)));
98
97
99
-
__blake2s_init(&state, outlen, key, keylen);
100
-
blake2s_update(&state, in, inlen);
101
-
blake2s_final(&state, out);
98
+
__blake2s_init(&ctx, outlen, key, keylen);
99
+
blake2s_update(&ctx, in, inlen);
100
+
blake2s_final(&ctx, out);
102
101
}
103
102
104
103
#endif /* _CRYPTO_BLAKE2S_H */
+5
-5
lib/crypto/arm/blake2s-core.S
+5
-5
lib/crypto/arm/blake2s-core.S
···
170
170
.endm
171
171
172
172
//
173
-
// void blake2s_compress(struct blake2s_state *state,
173
+
// void blake2s_compress(struct blake2s_ctx *ctx,
174
174
// const u8 *block, size_t nblocks, u32 inc);
175
175
//
176
-
// Only the first three fields of struct blake2s_state are used:
176
+
// Only the first three fields of struct blake2s_ctx are used:
177
177
// u32 h[8]; (inout)
178
178
// u32 t[2]; (inout)
179
179
// u32 f[2]; (in)
···
183
183
push {r0-r2,r4-r11,lr} // keep this an even number
184
184
185
185
.Lnext_block:
186
-
// r0 is 'state'
186
+
// r0 is 'ctx'
187
187
// r1 is 'block'
188
188
// r3 is 'inc'
189
189
···
211
211
212
212
// Calculate v[8..15]. Push v[9..15] onto the stack, and leave space
213
213
// for spilling v[8..9]. Leave v[8..9] in r8-r9.
214
-
mov r14, r0 // r14 = state
214
+
mov r14, r0 // r14 = ctx
215
215
adr r12, .Lblake2s_IV
216
216
ldmia r12!, {r8-r9} // load IV[0..1]
217
217
__ldrd r0, r1, r14, 40 // load f[0..1]
···
275
275
// Advance to the next block, if there is one. Note that if there are
276
276
// multiple blocks, then 'inc' (the counter increment amount) must be
277
277
// 64. So we can simply set it to 64 without re-loading it.
278
-
ldm sp, {r0, r1, r2} // load (state, block, nblocks)
278
+
ldm sp, {r0, r1, r2} // load (ctx, block, nblocks)
279
279
mov r3, #64 // set 'inc'
280
280
subs r2, r2, #1 // nblocks--
281
281
str r2, [sp, #8]
+2
-2
lib/crypto/arm/blake2s.h
+2
-2
lib/crypto/arm/blake2s.h
+29
-29
lib/crypto/blake2s.c
+29
-29
lib/crypto/blake2s.c
···
29
29
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
30
30
};
31
31
32
-
static inline void blake2s_increment_counter(struct blake2s_state *state,
32
+
static inline void blake2s_increment_counter(struct blake2s_ctx *ctx,
33
33
const u32 inc)
34
34
{
35
-
state->t[0] += inc;
36
-
state->t[1] += (state->t[0] < inc);
35
+
ctx->t[0] += inc;
36
+
ctx->t[1] += (ctx->t[0] < inc);
37
37
}
38
38
39
39
static void __maybe_unused
40
-
blake2s_compress_generic(struct blake2s_state *state, const u8 *block,
40
+
blake2s_compress_generic(struct blake2s_ctx *ctx, const u8 *block,
41
41
size_t nblocks, const u32 inc)
42
42
{
43
43
u32 m[16];
···
48
48
(nblocks > 1 && inc != BLAKE2S_BLOCK_SIZE));
49
49
50
50
while (nblocks > 0) {
51
-
blake2s_increment_counter(state, inc);
51
+
blake2s_increment_counter(ctx, inc);
52
52
memcpy(m, block, BLAKE2S_BLOCK_SIZE);
53
53
le32_to_cpu_array(m, ARRAY_SIZE(m));
54
-
memcpy(v, state->h, 32);
54
+
memcpy(v, ctx->h, 32);
55
55
v[ 8] = BLAKE2S_IV0;
56
56
v[ 9] = BLAKE2S_IV1;
57
57
v[10] = BLAKE2S_IV2;
58
58
v[11] = BLAKE2S_IV3;
59
-
v[12] = BLAKE2S_IV4 ^ state->t[0];
60
-
v[13] = BLAKE2S_IV5 ^ state->t[1];
61
-
v[14] = BLAKE2S_IV6 ^ state->f[0];
62
-
v[15] = BLAKE2S_IV7 ^ state->f[1];
59
+
v[12] = BLAKE2S_IV4 ^ ctx->t[0];
60
+
v[13] = BLAKE2S_IV5 ^ ctx->t[1];
61
+
v[14] = BLAKE2S_IV6 ^ ctx->f[0];
62
+
v[15] = BLAKE2S_IV7 ^ ctx->f[1];
63
63
64
64
#define G(r, i, a, b, c, d) do { \
65
65
a += b + m[blake2s_sigma[r][2 * i + 0]]; \
···
97
97
#undef ROUND
98
98
99
99
for (i = 0; i < 8; ++i)
100
-
state->h[i] ^= v[i] ^ v[i + 8];
100
+
ctx->h[i] ^= v[i] ^ v[i + 8];
101
101
102
102
block += BLAKE2S_BLOCK_SIZE;
103
103
--nblocks;
···
110
110
#define blake2s_compress blake2s_compress_generic
111
111
#endif
112
112
113
-
static inline void blake2s_set_lastblock(struct blake2s_state *state)
113
+
static inline void blake2s_set_lastblock(struct blake2s_ctx *ctx)
114
114
{
115
-
state->f[0] = -1;
115
+
ctx->f[0] = -1;
116
116
}
117
117
118
-
void blake2s_update(struct blake2s_state *state, const u8 *in, size_t inlen)
118
+
void blake2s_update(struct blake2s_ctx *ctx, const u8 *in, size_t inlen)
119
119
{
120
-
const size_t fill = BLAKE2S_BLOCK_SIZE - state->buflen;
120
+
const size_t fill = BLAKE2S_BLOCK_SIZE - ctx->buflen;
121
121
122
122
if (unlikely(!inlen))
123
123
return;
124
124
if (inlen > fill) {
125
-
memcpy(state->buf + state->buflen, in, fill);
126
-
blake2s_compress(state, state->buf, 1, BLAKE2S_BLOCK_SIZE);
127
-
state->buflen = 0;
125
+
memcpy(ctx->buf + ctx->buflen, in, fill);
126
+
blake2s_compress(ctx, ctx->buf, 1, BLAKE2S_BLOCK_SIZE);
127
+
ctx->buflen = 0;
128
128
in += fill;
129
129
inlen -= fill;
130
130
}
131
131
if (inlen > BLAKE2S_BLOCK_SIZE) {
132
132
const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_SIZE);
133
-
blake2s_compress(state, in, nblocks - 1, BLAKE2S_BLOCK_SIZE);
133
+
blake2s_compress(ctx, in, nblocks - 1, BLAKE2S_BLOCK_SIZE);
134
134
in += BLAKE2S_BLOCK_SIZE * (nblocks - 1);
135
135
inlen -= BLAKE2S_BLOCK_SIZE * (nblocks - 1);
136
136
}
137
-
memcpy(state->buf + state->buflen, in, inlen);
138
-
state->buflen += inlen;
137
+
memcpy(ctx->buf + ctx->buflen, in, inlen);
138
+
ctx->buflen += inlen;
139
139
}
140
140
EXPORT_SYMBOL(blake2s_update);
141
141
142
-
void blake2s_final(struct blake2s_state *state, u8 *out)
142
+
void blake2s_final(struct blake2s_ctx *ctx, u8 *out)
143
143
{
144
144
WARN_ON(IS_ENABLED(DEBUG) && !out);
145
-
blake2s_set_lastblock(state);
146
-
memset(state->buf + state->buflen, 0,
147
-
BLAKE2S_BLOCK_SIZE - state->buflen); /* Padding */
148
-
blake2s_compress(state, state->buf, 1, state->buflen);
149
-
cpu_to_le32_array(state->h, ARRAY_SIZE(state->h));
150
-
memcpy(out, state->h, state->outlen);
151
-
memzero_explicit(state, sizeof(*state));
145
+
blake2s_set_lastblock(ctx);
146
+
memset(ctx->buf + ctx->buflen, 0,
147
+
BLAKE2S_BLOCK_SIZE - ctx->buflen); /* Padding */
148
+
blake2s_compress(ctx, ctx->buf, 1, ctx->buflen);
149
+
cpu_to_le32_array(ctx->h, ARRAY_SIZE(ctx->h));
150
+
memcpy(out, ctx->h, ctx->outlen);
151
+
memzero_explicit(ctx, sizeof(*ctx));
152
152
}
153
153
EXPORT_SYMBOL(blake2s_final);
154
154
+11
-12
lib/crypto/tests/blake2s_kunit.c
+11
-12
lib/crypto/tests/blake2s_kunit.c
···
17
17
blake2s(NULL, 0, data, len, out, BLAKE2S_HASH_SIZE);
18
18
}
19
19
20
-
static void blake2s_init_default(struct blake2s_state *state)
20
+
static void blake2s_init_default(struct blake2s_ctx *ctx)
21
21
{
22
-
blake2s_init(state, BLAKE2S_HASH_SIZE);
22
+
blake2s_init(ctx, BLAKE2S_HASH_SIZE);
23
23
}
24
24
25
25
/*
···
27
27
* with a key length of 0 and a hash length of BLAKE2S_HASH_SIZE.
28
28
*/
29
29
#define HASH blake2s_default
30
-
#define HASH_CTX blake2s_state
30
+
#define HASH_CTX blake2s_ctx
31
31
#define HASH_SIZE BLAKE2S_HASH_SIZE
32
32
#define HASH_INIT blake2s_init_default
33
33
#define HASH_UPDATE blake2s_update
···
44
44
u8 *data = &test_buf[0];
45
45
u8 *key = data + data_len;
46
46
u8 *hash = key + BLAKE2S_KEY_SIZE;
47
-
struct blake2s_state main_state;
47
+
struct blake2s_ctx main_ctx;
48
48
u8 main_hash[BLAKE2S_HASH_SIZE];
49
49
50
50
rand_bytes_seeded_from_len(data, data_len);
51
-
blake2s_init(&main_state, BLAKE2S_HASH_SIZE);
51
+
blake2s_init(&main_ctx, BLAKE2S_HASH_SIZE);
52
52
for (int key_len = 0; key_len <= BLAKE2S_KEY_SIZE; key_len++) {
53
53
rand_bytes_seeded_from_len(key, key_len);
54
54
for (int out_len = 1; out_len <= BLAKE2S_HASH_SIZE; out_len++) {
55
55
blake2s(key, key_len, data, data_len, hash, out_len);
56
-
blake2s_update(&main_state, hash, out_len);
56
+
blake2s_update(&main_ctx, hash, out_len);
57
57
}
58
58
}
59
-
blake2s_final(&main_state, main_hash);
59
+
blake2s_final(&main_ctx, main_hash);
60
60
KUNIT_ASSERT_MEMEQ(test, main_hash, blake2s_keyed_testvec_consolidated,
61
61
BLAKE2S_HASH_SIZE);
62
62
}
···
75
75
u8 *guarded_key = &test_buf[TEST_BUF_LEN - key_len];
76
76
u8 hash1[BLAKE2S_HASH_SIZE];
77
77
u8 hash2[BLAKE2S_HASH_SIZE];
78
-
struct blake2s_state state;
78
+
struct blake2s_ctx ctx;
79
79
80
80
rand_bytes(key, key_len);
81
81
memcpy(guarded_key, key, key_len);
···
86
86
hash2, BLAKE2S_HASH_SIZE);
87
87
KUNIT_ASSERT_MEMEQ(test, hash1, hash2, BLAKE2S_HASH_SIZE);
88
88
89
-
blake2s_init_key(&state, BLAKE2S_HASH_SIZE,
90
-
guarded_key, key_len);
91
-
blake2s_update(&state, test_buf, data_len);
92
-
blake2s_final(&state, hash2);
89
+
blake2s_init_key(&ctx, BLAKE2S_HASH_SIZE, guarded_key, key_len);
90
+
blake2s_update(&ctx, test_buf, data_len);
91
+
blake2s_final(&ctx, hash2);
93
92
KUNIT_ASSERT_MEMEQ(test, hash1, hash2, BLAKE2S_HASH_SIZE);
94
93
}
95
94
}
+6
-6
lib/crypto/x86/blake2s.h
+6
-6
lib/crypto/x86/blake2s.h
···
11
11
#include <linux/kernel.h>
12
12
#include <linux/sizes.h>
13
13
14
-
asmlinkage void blake2s_compress_ssse3(struct blake2s_state *state,
14
+
asmlinkage void blake2s_compress_ssse3(struct blake2s_ctx *ctx,
15
15
const u8 *block, const size_t nblocks,
16
16
const u32 inc);
17
-
asmlinkage void blake2s_compress_avx512(struct blake2s_state *state,
17
+
asmlinkage void blake2s_compress_avx512(struct blake2s_ctx *ctx,
18
18
const u8 *block, const size_t nblocks,
19
19
const u32 inc);
20
20
21
21
static __ro_after_init DEFINE_STATIC_KEY_FALSE(blake2s_use_ssse3);
22
22
static __ro_after_init DEFINE_STATIC_KEY_FALSE(blake2s_use_avx512);
23
23
24
-
static void blake2s_compress(struct blake2s_state *state, const u8 *block,
24
+
static void blake2s_compress(struct blake2s_ctx *ctx, const u8 *block,
25
25
size_t nblocks, const u32 inc)
26
26
{
27
27
/* SIMD disables preemption, so relax after processing each page. */
28
28
BUILD_BUG_ON(SZ_4K / BLAKE2S_BLOCK_SIZE < 8);
29
29
30
30
if (!static_branch_likely(&blake2s_use_ssse3) || !may_use_simd()) {
31
-
blake2s_compress_generic(state, block, nblocks, inc);
31
+
blake2s_compress_generic(ctx, block, nblocks, inc);
32
32
return;
33
33
}
34
34
···
38
38
39
39
kernel_fpu_begin();
40
40
if (static_branch_likely(&blake2s_use_avx512))
41
-
blake2s_compress_avx512(state, block, blocks, inc);
41
+
blake2s_compress_avx512(ctx, block, blocks, inc);
42
42
else
43
-
blake2s_compress_ssse3(state, block, blocks, inc);
43
+
blake2s_compress_ssse3(ctx, block, blocks, inc);
44
44
kernel_fpu_end();
45
45
46
46
nblocks -= blocks;