New s390 specific protected key hmac

PATCH Superseded Harald Freudenberger 4 participants 8 messages Oct 30, 2024 – Nov 5, 2024

Subsystems (3)

Crypto API s390 s390 crypto modules, prng driver, arch random

lore

Share & tools

lore

Harald Freudenberger

author maintainer

2024-10-30 16:22 UTC #0 lore raw

cover New s390 specific protected key hmac

Add support for protected key hmac ("phmac") for s390 arch.

With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.

This patch adds support via 4 new shashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).

Please note that as of now, there is no selftest enabled for these shashes, but the implementation has been tested with testcases via AF_ALG interface. However, there may come an improvement soon to use the available clear key hmac selftests.

Please note that v1 does not apply to the current crypto-2.6 or linux-next kernel trees: For crypto-2.6 there is a hmac patch in the pipe and for linux-next there is a collision with the s390/configs/*defconfig. However, the hmac code itself is ready for a review cycle.

Holger Dengler (3):
crypto: api - Adjust HASH_MAX_DESCSIZE for phmac context on s390 s390/crypto: Add protected key hmac subfunctions for KMAC s390/crypto: New s390 specific shash phmac

 arch/s390/configs/debug_defconfig |   1 +
 arch/s390/configs/defconfig       |   1 +
 arch/s390/crypto/Makefile         |   1 +
 arch/s390/crypto/phmac_s390.c     | 484 ++++++++++++++++++++++++++++++
 arch/s390/include/asm/cpacf.h     |  20 +-
 drivers/crypto/Kconfig            |  12 +
 include/crypto/hash.h             |   7 +
 7 files changed, 518 insertions(+), 8 deletions(-)
 create mode 100644 arch/s390/crypto/phmac_s390.c

--
2.43.0

Harald Freudenberger

author maintainer

2024-10-30 16:27 UTC #1 lore raw

PATCH 1/3 crypto: api - Adjust HASH_MAX_DESCSIZE for phmac context on s390

From: Holger Dengler <[email protected]>

The phmac context exceeds the generic "worst case". Change this define to cover the s390 "worst case" but only for arch s390 build.

Signed-off-by Holger Dengler <[email protected]>

Signed-off-by Harald Freudenberger <[email protected]>

---
 include/crypto/hash.h | 7 +++++++
 1 file changed, 7 insertions(+)

include/crypto/hash.h +7 -0

index 2d5ea9f9ff43..92f878270a87 100644
@@ -158,11 +158,18 @@ struct shash_desc {
 
 #define HASH_MAX_DIGESTSIZE	 64
 
+#ifdef CONFIG_S390
+/*
+ * The descsize for phmac on s390 exceeds the generic "worst case".
+ */
+#define HASH_MAX_DESCSIZE	384
+#else
 /*
  * Worst case is hmac(sha3-224-generic).  Its context is a nested 'shash_desc'
  * containing a 'struct sha3_state'.
  */
 #define HASH_MAX_DESCSIZE	(sizeof(struct shash_desc) + 360)
+#endif
 
 #define SHASH_DESC_ON_STACK(shash, ctx)					     \
 	char __##shash##_desc[sizeof(struct shash_desc) + HASH_MAX_DESCSIZE] \

Signature · 1 line

2.43.0

Herbert Xu

maintainer

2024-10-31 04:14 UTC #2 lore raw

Re: [PATCH v1 1/3] crypto: api - Adjust HASH_MAX_DESCSIZE for phmac context on s390

include/crypto/hash.h struct shash_desc { · line 172

Quoted 13 lines · Harald Freudenberger

include/crypto/hash.h +7 -0

+#ifdef CONFIG_S390
+/*
+ * The descsize for phmac on s390 exceeds the generic "worst case".
+ */
+#define HASH_MAX_DESCSIZE	384
+#else
 /*
  * Worst case is hmac(sha3-224-generic).  Its context is a nested 'shash_desc'
  * containing a 'struct sha3_state'.
  */
 #define HASH_MAX_DESCSIZE	(sizeof(struct shash_desc) + 360)
+#endif

Why not just increase it everywhere? It's not a big difference.

Thanks,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Harald Freudenberger

author maintainer

2024-10-30 16:22 UTC #3 lore raw

PATCH 2/3 s390/crypto: Add protected key hmac subfunctions for KMAC

In reply to Harald Freudenberger

From: Holger Dengler <[email protected]>

The CPACF KMAC instruction supports new subfunctions for protected key hmac. Add defines for these 4 new subfuctions.

Signed-off-by Holger Dengler <[email protected]>

Signed-off-by Harald Freudenberger <[email protected]>

---
 arch/s390/include/asm/cpacf.h | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

arch/s390/include/asm/cpacf.h +12 -8

index 1d3a4b0c650f..5fcde9a7bc07 100644
@@ -119,14 +119,18 @@
  * function codes for the KMAC (COMPUTE MESSAGE AUTHENTICATION CODE)
  * instruction
  */
-#define CPACF_KMAC_QUERY	0x00
-#define CPACF_KMAC_DEA		0x01
-#define CPACF_KMAC_TDEA_128	0x02
-#define CPACF_KMAC_TDEA_192	0x03
-#define CPACF_KMAC_HMAC_SHA_224	0x70
-#define CPACF_KMAC_HMAC_SHA_256	0x71
-#define CPACF_KMAC_HMAC_SHA_384	0x72
-#define CPACF_KMAC_HMAC_SHA_512	0x73
+#define CPACF_KMAC_QUERY		0x00
+#define CPACF_KMAC_DEA			0x01
+#define CPACF_KMAC_TDEA_128		0x02
+#define CPACF_KMAC_TDEA_192		0x03
+#define CPACF_KMAC_HMAC_SHA_224		0x70
+#define CPACF_KMAC_HMAC_SHA_256		0x71
+#define CPACF_KMAC_HMAC_SHA_384		0x72
+#define CPACF_KMAC_HMAC_SHA_512		0x73
+#define CPACF_KMAC_PHMAC_SHA_224	0x78
+#define CPACF_KMAC_PHMAC_SHA_256	0x79
+#define CPACF_KMAC_PHMAC_SHA_384	0x7a
+#define CPACF_KMAC_PHMAC_SHA_512	0x7b
 
 /*
  * Function codes for the PCKMO (PERFORM CRYPTOGRAPHIC KEY MANAGEMENT)

Signature · 1 line

2.43.0

Harald Freudenberger

author maintainer

2024-10-30 16:22 UTC #4 lore raw

PATCH 3/3 s390/crypto: New s390 specific shash phmac

In reply to Harald Freudenberger

From: Holger Dengler <[email protected]>

Add support for protected key hmac ("phmac") for s390 arch.

This patch adds support via 4 new shashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).

Please note that as of now, there is no selftest enabled for these shashes, but the implementation has been tested with testcases via AF_ALG interface.

Signed-off-by Holger Dengler <[email protected]>

Signed-off-by Harald Freudenberger <[email protected]>

---
 arch/s390/configs/debug_defconfig |   1 +
 arch/s390/configs/defconfig       |   1 +
 arch/s390/crypto/Makefile         |   1 +
 arch/s390/crypto/phmac_s390.c     | 484 ++++++++++++++++++++++++++++++
 drivers/crypto/Kconfig            |  12 +
 5 files changed, 499 insertions(+)
 create mode 100644 arch/s390/crypto/phmac_s390.c

arch/s390/configs/debug_defconfig +1 -0

index fb0e9a1d9be2..bf1ae44e81f1 100644
@@ -811,6 +811,7 @@ CONFIG_PKEY_CCA=m
 CONFIG_PKEY_EP11=m
 CONFIG_PKEY_PCKMO=m
 CONFIG_CRYPTO_PAES_S390=m
+CONFIG_CRYPTO_PHMAC_S390=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_SYSTEM_BLACKLIST_KEYRING=y
 CONFIG_CORDIC=m

arch/s390/configs/defconfig +1 -0

index 88be0a734b60..bc79c0c18d2f 100644
@@ -798,6 +798,7 @@ CONFIG_PKEY_CCA=m
 CONFIG_PKEY_EP11=m
 CONFIG_PKEY_PCKMO=m
 CONFIG_CRYPTO_PAES_S390=m
+CONFIG_CRYPTO_PHMAC_S390=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_SYSTEM_BLACKLIST_KEYRING=y
 CONFIG_CORDIC=m

arch/s390/crypto/Makefile +1 -0

index a0cb96937c3d..47637140b95c 100644
@@ -16,6 +16,7 @@ obj-$(CONFIG_S390_PRNG) += prng.o
 obj-$(CONFIG_CRYPTO_GHASH_S390) += ghash_s390.o
 obj-$(CONFIG_CRYPTO_CRC32_S390) += crc32-vx_s390.o
 obj-$(CONFIG_CRYPTO_HMAC_S390) += hmac_s390.o
+obj-$(CONFIG_CRYPTO_PHMAC_S390) += phmac_s390.o
 obj-y += arch_random.o
 
 crc32-vx_s390-y := crc32-vx.o crc32le-vx.o crc32be-vx.o

arch/s390/crypto/phmac_s390.c new file +484 -0

484 lines not on this page · raw message

drivers/crypto/Kconfig +12 -0

index 08b1238bcd7b..28ed1268de7f 100644
@@ -166,6 +166,18 @@ config CRYPTO_PAES_S390
 	  Select this option if you want to use the paes cipher
 	  for example to use protected key encrypted devices.
 
+config CRYPTO_PHMAC_S390
+	tristate "PHMAC cipher algorithms"
+	depends on S390
+	depends on PKEY
+	select CRYPTO_HASH
+	help
+	  This is the s390 hardware accelerated implementation of the
+	  protected key HMAC support for SHA224, SHA256, SHA384 and SHA512.
+
+	  Select this option if you want to use the phmac digests
+	  for example to use dm-integrity with secure/protected keys.
+
 config S390_PRNG
 	tristate "Pseudo random number generator device driver"
 	depends on S390

Signature · 1 line

2.43.0

kernel test robot

build bot

2024-10-31 22:29 UTC #5 lore raw

Re: [PATCH v1 3/3] s390/crypto: New s390 specific shash phmac

kernel test robot noticed the following build warnings:

Hi Harald,

kernel test robot noticed the following build warnings:

[auto build test WARNING on herbert-cryptodev-2.6/master]
[also build test WARNING on s390/features linus/master v6.12-rc5 next-20241031] [cannot apply to herbert-crypto-2.6/master]
[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Harald-Freudenberger/crypto-api-Adjust-HASH_MAX_DESCSIZE-for-phmac-context-on-s390/20241031-002930
base:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link:    https://lore.kernel.org/r/20241030162235.363533-4-freude%40linux.ibm.com
patch subject: [PATCH v1 3/3] s390/crypto: New s390 specific shash phmac
config: s390-randconfig-r053-20241101 (https://download.01.org/0day-ci/archive/20241101/[email protected]/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

cocci warnings: (new ones prefixed by >>)

>> arch/s390/crypto/phmac_s390.c:165:16-23: WARNING opportunity for kmemdup

vim +165 arch/s390/crypto/phmac_s390.c

152
153 static inline int s390_phmac_sha2_setkey(struct crypto_shash *tfm,
154 const u8 *key, unsigned int keylen)
155 {
156 struct s390_phmac_ctx *tfm_ctx = crypto_shash_ctx(tfm);
157 int rc = -ENOMEM;
158
159 if (tfm_ctx->keylen) {
160 kfree_sensitive(tfm_ctx->key);
161 tfm_ctx->key = NULL;
162 tfm_ctx->keylen = 0;
163 }
164

 > 165		tfm_ctx->key = kmalloc(keylen, GFP_KERNEL);

166 if (!tfm_ctx->key)
167 goto out;
168 memcpy(tfm_ctx->key, key, keylen);
169 tfm_ctx->keylen = keylen;
170
171 rc = phmac_convert_key(tfm_ctx);
172 if (rc)
173 goto out;
174
175 rc = -EINVAL;
176 switch (crypto_shash_digestsize(tfm)) {
177 case SHA224_DIGEST_SIZE:
178 case SHA256_DIGEST_SIZE:
179 if (tfm_ctx->pk.type != PKEY_KEYTYPE_HMAC_512)
180 goto out;
181 break;
182 case SHA384_DIGEST_SIZE:
183 case SHA512_DIGEST_SIZE:
184 if (tfm_ctx->pk.type != PKEY_KEYTYPE_HMAC_1024)
185 goto out;
186 break;
187 default:
188 goto out;
189 }
190 rc = 0;
191
192 out:
193 pr_debug("rc=%d\n", rc);
194 return rc;
195 }
196

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Holger Dengler

maintainer

2024-11-05 13:42 UTC #6 lore raw

Re: [PATCH v1 3/3] s390/crypto: New s390 specific shash phmac

In reply to Harald Freudenberger

Quoted 27 lines · Harald Freudenberger

From: Holger Dengler <[email protected]>
Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new shashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Please note that as of now, there is no selftest enabled for these shashes, but the implementation has been tested with testcases via AF_ALG interface.
Signed-off-by Holger Dengler <[email protected]>
Signed-off-by Harald Freudenberger <[email protected]>
---
 arch/s390/configs/debug_defconfig |   1 +
 arch/s390/configs/defconfig       |   1 +
 arch/s390/crypto/Makefile         |   1 +
 arch/s390/crypto/phmac_s390.c     | 484 ++++++++++++++++++++++++++++++
 drivers/crypto/Kconfig            |  12 +
 5 files changed, 499 insertions(+)
 create mode 100644 arch/s390/crypto/phmac_s390.c

[...]

Quoted 6 lines

arch/s390/crypto/phmac_s390.c new file +0 -0
new file mode 100644
index 000000000000..7f68ba29626f
@@ -0,0 +1,484 @@

[...]

Quoted 8 lines

arch/s390/crypto/phmac_s390.c new file +8 -0

+static int s390_phmac_sha2_clone_tfm(struct crypto_shash *dst,
+				     struct crypto_shash *src)
+{
+	struct s390_phmac_ctx *dst_ctx = crypto_shash_ctx(dst);
+	struct s390_phmac_ctx *src_ctx = crypto_shash_ctx(src);
+	int rc;
+
+	rc = s390_phmac_sha2_init_tfm(dst);

arch/s390/crypto/phmac_s390.c line 389

Quoted 10 lines

arch/s390/crypto/phmac_s390.c new file +10 -0

+	if (rc)
+		return rc;
+
+	if (src_ctx->key && src_ctx->keylen) {
+		dst_ctx->key = kmemdup(src_ctx->key, src_ctx->keylen,
+				       GFP_KERNEL);
+		if (!dst_ctx->key)
+			return -ENOMEM;
+		dst_ctx->keylen = src_ctx->keylen;
+		return phmac_convert_key(dst_ctx);

This will clone only parts of the tfm_ctx, e.g. the function code (fc) is missing. I would highly recommend to just call setkey() here instead.

Quoted 4 lines

arch/s390/crypto/phmac_s390.c new file +4 -0
+	}
+
+	return 0;
+}

[...]

arch/s390/crypto/phmac_s390.c line 453

Quoted 9 lines

arch/s390/crypto/phmac_s390.c new file +9 -0

+static int __init phmac_s390_init(void)
+{
+	struct s390_hmac_alg *hmac;
+	int i, rc = -ENODEV;
+
+	if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_256))
+		return -ENODEV;
+	if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_512))
+		return -ENODEV;

These two check are not neccessary. Please remove them.

[...]

Signature · 5 lines

Mit freundlichen Grüßen / Kind regards
Holger Dengler
--
IBM Systems, Linux on IBM Z Development
[email protected]

Herbert Xu

maintainer

2024-11-05 23:28 UTC #7 lore raw

Re: [PATCH v1 3/3] s390/crypto: New s390 specific shash phmac

In reply to Harald Freudenberger

Quoted 5 lines · Harald Freudenberger

arch/s390/crypto/phmac_s390.c new file +4 -0

+static int s390_phmac_sha2_clone_tfm(struct crypto_shash *dst,
+				     struct crypto_shash *src)
+{
+	struct s390_phmac_ctx *dst_ctx = crypto_shash_ctx(dst);

arch/s390/crypto/phmac_s390.c line 385

Quoted 10 lines

arch/s390/crypto/phmac_s390.c new file +10 -0

+	struct s390_phmac_ctx *src_ctx = crypto_shash_ctx(src);
+	int rc;
+
+	rc = s390_phmac_sha2_init_tfm(dst);
+	if (rc)
+		return rc;
+
+	if (src_ctx->key && src_ctx->keylen) {
+		dst_ctx->key = kmemdup(src_ctx->key, src_ctx->keylen,
+				       GFP_KERNEL);

Any allocations in clone_tfm must be GFP_ATOMIC since this is supposed to be used on paths where we can't sleep (otherwise you could just allocate a new tfm).

Cheers,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt