Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
crypto: arm64/sha3 - Update sha3_ce_transform() to prepare for library
- Use size_t lengths, to match the library.
- Pass the block size instead of digest size, and add support for the
block size that SHAKE128 uses. This allows the code to be used with
SHAKE128 and SHAKE256, which don't have the concept of a digest size.
SHAKE256 has the same block size as SHA3-256, but SHAKE128 has a
unique block size. Thus, there are now 5 supported block sizes.
Don't bother changing the "glue" code arm64_sha3_update() too much, as
it gets deleted when the SHA-3 code is migrated into lib/crypto/ anyway.
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251026055032.1413733-9-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+39
-39
+34
-33
arch/arm64/crypto/sha3-ce-core.S
+34
-33
arch/arm64/crypto/sha3-ce-core.S
···
37
37
.endm
38
38
39
39
/*
40
-
* int sha3_ce_transform(u64 *st, const u8 *data, int blocks, int dg_size)
40
+
* size_t sha3_ce_transform(struct sha3_state *state, const u8 *data,
41
+
* size_t nblocks, size_t block_size)
42
+
*
43
+
* block_size is assumed to be one of 72 (SHA3-512), 104 (SHA3-384), 136
44
+
* (SHA3-256 and SHAKE256), 144 (SHA3-224), or 168 (SHAKE128).
41
45
*/
42
46
.text
43
47
SYM_FUNC_START(sha3_ce_transform)
···
55
51
ld1 {v20.1d-v23.1d}, [x8], #32
56
52
ld1 {v24.1d}, [x8]
57
53
58
-
0: sub w2, w2, #1
54
+
0: sub x2, x2, #1
59
55
mov w8, #24
60
56
adr_l x9, .Lsha3_rcon
61
57
62
58
/* load input */
63
59
ld1 {v25.8b-v28.8b}, [x1], #32
64
-
ld1 {v29.8b-v31.8b}, [x1], #24
60
+
ld1 {v29.8b}, [x1], #8
65
61
eor v0.8b, v0.8b, v25.8b
66
62
eor v1.8b, v1.8b, v26.8b
67
63
eor v2.8b, v2.8b, v27.8b
68
64
eor v3.8b, v3.8b, v28.8b
69
65
eor v4.8b, v4.8b, v29.8b
70
-
eor v5.8b, v5.8b, v30.8b
71
-
eor v6.8b, v6.8b, v31.8b
72
-
73
-
tbnz x3, #6, 2f // SHA3-512
74
66
75
67
ld1 {v25.8b-v28.8b}, [x1], #32
76
-
ld1 {v29.8b-v30.8b}, [x1], #16
77
-
eor v7.8b, v7.8b, v25.8b
78
-
eor v8.8b, v8.8b, v26.8b
79
-
eor v9.8b, v9.8b, v27.8b
80
-
eor v10.8b, v10.8b, v28.8b
81
-
eor v11.8b, v11.8b, v29.8b
82
-
eor v12.8b, v12.8b, v30.8b
68
+
eor v5.8b, v5.8b, v25.8b
69
+
eor v6.8b, v6.8b, v26.8b
70
+
eor v7.8b, v7.8b, v27.8b
71
+
eor v8.8b, v8.8b, v28.8b
72
+
cmp x3, #72
73
+
b.eq 3f /* SHA3-512 (block_size=72)? */
83
74
84
-
tbnz x3, #4, 1f // SHA3-384 or SHA3-224
75
+
ld1 {v25.8b-v28.8b}, [x1], #32
76
+
eor v9.8b, v9.8b, v25.8b
77
+
eor v10.8b, v10.8b, v26.8b
78
+
eor v11.8b, v11.8b, v27.8b
79
+
eor v12.8b, v12.8b, v28.8b
80
+
cmp x3, #104
81
+
b.eq 3f /* SHA3-384 (block_size=104)? */
85
82
86
-
// SHA3-256
87
83
ld1 {v25.8b-v28.8b}, [x1], #32
88
84
eor v13.8b, v13.8b, v25.8b
89
85
eor v14.8b, v14.8b, v26.8b
90
86
eor v15.8b, v15.8b, v27.8b
91
87
eor v16.8b, v16.8b, v28.8b
92
-
b 3f
88
+
cmp x3, #144
89
+
b.lt 3f /* SHA3-256 or SHAKE256 (block_size=136)? */
90
+
b.eq 2f /* SHA3-224 (block_size=144)? */
93
91
94
-
1: tbz x3, #2, 3f // bit 2 cleared? SHA-384
95
-
96
-
// SHA3-224
92
+
/* SHAKE128 (block_size=168) */
97
93
ld1 {v25.8b-v28.8b}, [x1], #32
98
-
ld1 {v29.8b}, [x1], #8
99
-
eor v13.8b, v13.8b, v25.8b
100
-
eor v14.8b, v14.8b, v26.8b
101
-
eor v15.8b, v15.8b, v27.8b
102
-
eor v16.8b, v16.8b, v28.8b
103
-
eor v17.8b, v17.8b, v29.8b
94
+
eor v17.8b, v17.8b, v25.8b
95
+
eor v18.8b, v18.8b, v26.8b
96
+
eor v19.8b, v19.8b, v27.8b
97
+
eor v20.8b, v20.8b, v28.8b
104
98
b 3f
105
-
106
-
// SHA3-512
107
-
2: ld1 {v25.8b-v26.8b}, [x1], #16
108
-
eor v7.8b, v7.8b, v25.8b
109
-
eor v8.8b, v8.8b, v26.8b
99
+
2:
100
+
/* SHA3-224 (block_size=144) */
101
+
ld1 {v25.8b}, [x1], #8
102
+
eor v17.8b, v17.8b, v25.8b
110
103
111
104
3: sub w8, w8, #1
112
105
···
186
185
187
186
cbnz w8, 3b
188
187
cond_yield 4f, x8, x9
189
-
cbnz w2, 0b
188
+
cbnz x2, 0b
190
189
191
190
/* save state */
192
191
4: st1 { v0.1d- v3.1d}, [x0], #32
···
196
195
st1 {v16.1d-v19.1d}, [x0], #32
197
196
st1 {v20.1d-v23.1d}, [x0], #32
198
197
st1 {v24.1d}, [x0]
199
-
mov w0, w2
198
+
mov x0, x2
200
199
ret
201
200
SYM_FUNC_END(sha3_ce_transform)
202
201
+5
-6
arch/arm64/crypto/sha3-ce-glue.c
+5
-6
arch/arm64/crypto/sha3-ce-glue.c
···
28
28
MODULE_ALIAS_CRYPTO("sha3-384");
29
29
MODULE_ALIAS_CRYPTO("sha3-512");
30
30
31
-
asmlinkage int sha3_ce_transform(u64 *st, const u8 *data, int blocks,
32
-
int md_len);
31
+
asmlinkage size_t sha3_ce_transform(struct sha3_state *state, const u8 *data,
32
+
size_t nblocks, size_t block_size);
33
33
34
34
static int arm64_sha3_update(struct shash_desc *desc, const u8 *data,
35
35
unsigned int len)
36
36
{
37
37
struct sha3_state *sctx = shash_desc_ctx(desc);
38
38
struct crypto_shash *tfm = desc->tfm;
39
-
unsigned int bs, ds;
39
+
unsigned int bs;
40
40
int blocks;
41
41
42
-
ds = crypto_shash_digestsize(tfm);
43
42
bs = crypto_shash_blocksize(tfm);
44
43
blocks = len / bs;
45
44
len -= blocks * bs;
···
46
47
int rem;
47
48
48
49
kernel_neon_begin();
49
-
rem = sha3_ce_transform(sctx->st, data, blocks, ds);
50
+
rem = sha3_ce_transform(sctx, data, blocks, bs);
50
51
kernel_neon_end();
51
52
data += (blocks - rem) * bs;
52
53
blocks = rem;
···
73
74
block[bs - 1] |= 0x80;
74
75
75
76
kernel_neon_begin();
76
-
sha3_ce_transform(sctx->st, block, 1, ds);
77
+
sha3_ce_transform(sctx, block, 1, bs);
77
78
kernel_neon_end();
78
79
memzero_explicit(block , sizeof(block));
79
80