New s390 specific protected key hmac
Subsystems (4)
Harald Freudenberger
maintainerv11 cover New s390 specific protected key hmac
Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new hashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Changelog:
v1: Initial version
v2: Increase HASH_MAX_DESCSIZE generic (not just for arch s390).
Fix one finding to use kmemdup instead of kmalloc/memcpy from test robot. Remove unneeded cpacf subfunctions checks. Simplify clone_tfm() function. Rebased to s390/features.
v3: Feedback from Herbert: Use GFP_ATOMIC in setkey function.
Feedback from Holger: rework tfm clone function, move convert key invocation from setkey to init function. Rebased to updated s390/features from 11/7/2024. Ready for integration if there are no complains on v3.
v4: Rewind back more or less to v2. Add code to check for non-sleeping
context. Non-sleeping context during attempt to derive the protected key from raw key material is not accepted and -EOPNOTSUPP is returned (also currently all derivation pathes would in fact never sleep). In general the phmac implementation is not to be used within non-sleeping context and the code header mentions this. Tested with (patched) dm-integrity - works fine.
v5: As suggested by Herbert now the shashes have been marked as
'internal' and wrapped by ahashes which use the cryptd if an atomic context is detected. So the visible phmac algorithms are now ahashes. Unfortunately the dm-integrity implementation currently requests and deals only with shashes and this phmac implementation is not fitting to the original goal any more...
v6: As suggested by Herbert now a pure async phmac implementation.
Tested via AF_ALG interface. Untested via dm-integrity as this layer only supports shashes. Maybe I'll develop a patch to switch the dm-integrity to ahash as it is anyway the more flexible interface.
v7: Total rework of the implementation. Now uses workqueues and triggers
asynch requests for key convert, init, update, final and digest. Tested with instrumented code and with a reworked version of dm-integrity which uses asynchronous hashes. A patch for dm-integrity is on the way but yet needs some last hone work.
v8: Added selftest. With the selftest comes some code which wraps the
clear key into a "clear key token" digestible by PKEY. The selftest also uses import() and export(), so these are now also implemented. Furthermore a finup() implementation is now also available. Tested with AF_ALG testcases and dm-integrity, also tested with some instrumented code to check that the asynch workqueue functions do their job correctly. Coding is complete!
v9: As suggested by Herbert use ahash_request_complete() and surround it
with local_bh_disable().
v10: Split the pkey selftest patch into 3 patches. Slight rework of the
setkey function as suggested by Holger: When selftest is running as much as possible of the production code should run. So now the key prep with selftest is one additional if/then block instead of an if/then/else construct.
Code is ready for integration and well tested.
v11: Utterly rework with the insights collected with the paes rework
and the basic work done with the pkey rework over the last 5 month. Note that patch #1 effectively reverts commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") from Eric Biggers.
Harald Freudenberger (5):
crypto: ahash - make hash walk functions from ahash.c public s390/crypto: New s390 specific protected key hash phmac
crypto: api - Add crypto_tfm_alg_get_flags() helper inline function s390/crypto: Add selftest support for phmac
crypto: testmgr - Enable phmac selftest
Holger Dengler (1):
s390/crypto: Add protected key hmac subfunctions for KMAC
arch/s390/configs/debug_defconfig | 1 + arch/s390/configs/defconfig | 1 + arch/s390/crypto/Makefile | 1 + arch/s390/crypto/phmac_s390.c | 1042 +++++++++++++++++++++++++++++ arch/s390/include/asm/cpacf.h | 4 + crypto/ahash.c | 26 +- crypto/testmgr.c | 30 + drivers/crypto/Kconfig | 12 + include/crypto/internal/hash.h | 23 + include/linux/crypto.h | 5 + 10 files changed, 1124 insertions(+), 21 deletions(-) create mode 100644 arch/s390/crypto/phmac_s390.c
base-commit: b5185ea1a6bd35957e556129bb92a64f83aa65e4 --
2.43.0
Harald Freudenberger
maintainerPATCH v11 1/6 crypto: ahash - make hash walk functions from ahash.c public
Make the hash walk functions
crypto_hash_walk_done()
crypto_hash_walk_first()
crypto_hash_walk_last()
public again.
These functions had been removed from the header file include/crypto/internal/hash.h with commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") as there was no crypto algorithm code using them.
With the upcoming crypto implementation for s390 phash these functions will be exploited and thus need to be public within the kernel again.
--- crypto/ahash.c | 26 +++++--------------------- include/crypto/internal/hash.h | 23 +++++++++++++++++++++++ 2 files changed, 28 insertions(+), 21 deletions(-)
crypto/ahash.c +5 -21
@@ -29,19 +29,6 @@#define CRYPTO_ALG_TYPE_AHASH_MASK 0x0000000e -struct crypto_hash_walk { -const char *data; - -unsigned int offset; -unsigned int flags; - -struct page *pg; -unsigned int entrylen; - -unsigned int total; -struct scatterlist *sg; -}; -struct ahash_save_req_state {struct list_head head;struct ahash_request *req0;
@@ -92,8 +79,8 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)return hash_walk_next (walk); } -static int crypto_hash_walk_first (struct ahash_request *req, -struct crypto_hash_walk *walk) +int crypto_hash_walk_first (struct ahash_request *req, +struct crypto_hash_walk *walk) { walk->total = req->nbytes; walk->entrylen =0 ;
@@ -113,8 +100,9 @@ static int crypto_hash_walk_first(struct ahash_request *req,return hash_walk_new_entry (walk); } +EXPORT_SYMBOL_GPL (crypto_hash_walk_first); -static int crypto_hash_walk_done (struct crypto_hash_walk *walk,int err) +int crypto_hash_walk_done (struct crypto_hash_walk *walk,int err) {if ((walk->flags &CRYPTO_AHASH_REQ_VIRT ))return err;
@@ -140,11 +128,7 @@ static int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)return hash_walk_new_entry (walk); } - -static inline int crypto_hash_walk_last (struct crypto_hash_walk *walk) -{ -return !(walk->entrylen | walk->total); -} +EXPORT_SYMBOL_GPL (crypto_hash_walk_done);/* * For an ahash tfm that is using an shash algorithm (instead of an ahash
include/crypto/internal/hash.h +23 -0
@@ -12,6 +12,20 @@#include <crypto/hash.h> struct ahash_request ; +struct scatterlist ; + +struct crypto_hash_walk { +const char *data; + +unsigned int offset; +unsigned int flags; + +struct page *pg; +unsigned int entrylen; + +unsigned int total; +struct scatterlist *sg; +};struct ahash_instance {void (*free)(struct ahash_instance *inst);
@@ -43,6 +57,15 @@ struct crypto_shash_spawn {struct crypto_spawn base; }; +int crypto_hash_walk_done (struct crypto_hash_walk *walk,int err); +int crypto_hash_walk_first (struct ahash_request *req, +struct crypto_hash_walk *walk); + +static inline int crypto_hash_walk_last (struct crypto_hash_walk *walk) +{ +return !(walk->entrylen | walk->total); +} +int crypto_register_ahash (struct ahash_alg *alg);void crypto_unregister_ahash (struct ahash_alg *alg);int crypto_register_ahashes (struct ahash_alg *algs,int count);
Signature · 1 line
2.43.0
Re: [PATCH v11 1/6] crypto: ahash - make hash walk functions from ahash.c public
Quoted 11 lines · Harald Freudenberger
Make the hash walk functions
crypto_hash_walk_done()
crypto_hash_walk_first()
crypto_hash_walk_last()
public again.
These functions had been removed from the header fileinclude/crypto/internal/hash.hwith commit7fa481734016("crypto: ahash - make hash walk functions private toahash.c") as there was no crypto algorithm code using them.With the upcoming crypto implementation for s390 phash
reword: phash -> phmac
Quoted 4 lines
these functions will be exploited and thus need to be public within the kernel again.
Signed-off-by Harald Freudenberger <[email protected]>
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]
Harald Freudenberger
maintainerPATCH v11 2/6 s390/crypto: Add protected key hmac subfunctions for KMAC
In reply to Harald FreudenbergerFrom: Holger Dengler <[email protected]>
The CPACF KMAC instruction supports new subfunctions for protected key hmac. Add defines for these 4 new subfuctions.
--- arch/s390/include/asm/cpacf.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/s390/include/asm/cpacf.h +4 -0
@@ -129,6 +129,10 @@#define CPACF_KMAC_HMAC_SHA_256 0x71#define CPACF_KMAC_HMAC_SHA_384 0x72#define CPACF_KMAC_HMAC_SHA_512 0x73 +#define CPACF_KMAC_PHMAC_SHA_224 0x78 +#define CPACF_KMAC_PHMAC_SHA_256 0x79 +#define CPACF_KMAC_PHMAC_SHA_384 0x7a +#define CPACF_KMAC_PHMAC_SHA_512 0x7b/* * Function codes for the PCKMO (PERFORM CRYPTOGRAPHIC KEY MANAGEMENT)
Signature · 1 line
2.43.0
Re: [PATCH v11 2/6] s390/crypto: Add protected key hmac subfunctions for KMAC
Quoted 7 lines · Harald Freudenberger
From: Holger Dengler <[email protected]>
The CPACF KMAC instruction supports new subfunctions for protected key hmac. Add defines for these 4 new subfuctions.
Signed-off-by Holger Dengler <[email protected]>Signed-off-by Harald Freudenberger <[email protected]>
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]
Harald Freudenberger
maintainerPATCH v11 3/6 s390/crypto: New s390 specific protected key hash phmac
In reply to Harald FreudenbergerAdd support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
--- arch/s390/configs/debug_defconfig | 1 + arch/s390/configs/defconfig | 1 + arch/s390/crypto/Makefile | 1 + arch/s390/crypto/phmac_s390.c | 899 ++++++++++++++++++++++++++++++ drivers/crypto/Kconfig | 12 + 5 files changed, 914 insertions(+) create mode 100644 arch/s390/crypto/phmac_s390.c
arch/s390/configs/debug_defconfig +1 -0
@@ -810,6 +810,7 @@ CONFIG_PKEY_EP11=m CONFIG_PKEY_PCKMO=m CONFIG_PKEY_UV=m CONFIG_CRYPTO_PAES_S390=m +CONFIG_CRYPTO_PHMAC_S390=m CONFIG_CRYPTO_DEV_VIRTIO=m CONFIG_SYSTEM_BLACKLIST_KEYRING=y CONFIG_CORDIC=m
arch/s390/configs/defconfig +1 -0
@@ -797,6 +797,7 @@ CONFIG_PKEY_EP11=m CONFIG_PKEY_PCKMO=m CONFIG_PKEY_UV=m CONFIG_CRYPTO_PAES_S390=m +CONFIG_CRYPTO_PHMAC_S390=m CONFIG_CRYPTO_DEV_VIRTIO=m CONFIG_SYSTEM_BLACKLIST_KEYRING=y CONFIG_CORDIC=m
arch/s390/crypto/Makefile +1 -0
@@ -15,6 +15,7 @@ obj-$(CONFIG_CRYPTO_CHACHA_S390) += chacha_s390.o obj-$(CONFIG_S390_PRNG) += prng.o obj-$(CONFIG_CRYPTO_GHASH_S390) += ghash_s390.o obj-$(CONFIG_CRYPTO_HMAC_S390) += hmac_s390.o +obj-$(CONFIG_CRYPTO_PHMAC_S390) += phmac_s390.o obj-y += arch_random.o chacha_s390-y := chacha-glue.o chacha-s390.o
arch/s390/crypto/phmac_s390.c new file +899 -0
899 lines not on this page · raw message
drivers/crypto/Kconfig +12 -0
@@ -187,6 +187,18 @@ config CRYPTO_PAES_S390 Select this option if you want to use the paes cipher for example to use protected key encrypted devices. +config CRYPTO_PHMAC_S390 + tristate "PHMAC cipher algorithms" + depends on S390 + depends on PKEY + select CRYPTO_HASH + help + This is the s390 hardware accelerated implementation of the + protected key HMAC support for SHA224, SHA256, SHA384 and SHA512. + + Select this option if you want to use the phmac digests + for example to use dm-integrity with secure/protected keys. + config S390_PRNG tristate "Pseudo random number generator device driver" depends on S390
Signature · 1 line
2.43.0
Holger Dengler
maintainerRe: [PATCH v11 3/6] s390/crypto: New s390 specific protected key hash phmac
Quoted 7 lines · Harald Freudenberger
Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
Quoted 5 lines
This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Co-developed-by Holger Dengler <[email protected]>Signed-off-by Harald Freudenberger <[email protected]>
See my comments below. The rest looks good to me.
Quoted 9 lines
--- arch/s390/configs/debug_defconfig | 1 + arch/s390/configs/defconfig | 1 + arch/s390/crypto/Makefile | 1 + arch/s390/crypto/phmac_s390.c | 899 ++++++++++++++++++++++++++++++ drivers/crypto/Kconfig | 12 + 5 files changed, 914 insertions(+) create mode 100644 arch/s390/crypto/phmac_s390.c
[...]
Quoted 6 lines
arch/s390/crypto/phmac_s390.c new file +0
-0@@ -0,0 +1,899 @@
[...]
arch/s390/crypto/phmac_s390.c line 169
Quoted 5 lines
arch/s390/crypto/phmac_s390.c new file +5
-0+struct kmac_sha2_ctx { +u8 param[MAX_DIGEST_SIZE +MAX_IMBL_SIZE +PHMAC_MAX_PK_SIZE ]; +union kmac_gr0 gr0; +u8 buf[MAX_BLOCK_SIZE ]; +unsigned long total;
The clear-key hmac switched to u64[2] instead of unsinged long for total. Please synchronize with clear-key hmac.
Quoted 2 lines
arch/s390/crypto/phmac_s390.c new file +2
-0+}; +
[...]
arch/s390/crypto/phmac_s390.c line 269
Quoted 5 lines
arch/s390/crypto/phmac_s390.c new file +5
-0+/* +* kmac_sha2_set_imbl - sets the input message bit-length based on the blocksize +*/ +static inline void kmac_sha2_set_imbl (u8 *param,unsigned long nbytes, +unsigned int blocksize)
Same here. I would prefer to use this in the phmac as well.
[...]
Quoted 7 lines
arch/s390/crypto/phmac_s390.c new file +7
-0+static void s390_phmac_exit (void ) +{ +struct phmac_alg *phmac; +int i; + +if (phmac_crypto_engine) { +crypto_engine_stop (phmac_crypto_engine);
arch/s390/crypto/phmac_s390.c line 849
Quoted 10 lines
arch/s390/crypto/phmac_s390.c new file +10
-0+crypto_engine_exit (phmac_crypto_engine); + } + +for (i =ARRAY_SIZE (phmac_algs) -1 ; i >=0 ; i--) { + phmac = &phmac_algs[i]; +if (phmac->registered) +crypto_engine_unregister_ahash (&phmac->alg); + } + +misc_deregister (&phmac_dev);
The misc_register() call in module init is missing, see my comment to patch 5/6.
arch/s390/crypto/phmac_s390.c line 856
Quoted 7 lines
arch/s390/crypto/phmac_s390.c new file +7
-0+} + +static int __init s390_phmac_init (void ) +{ +struct phmac_alg *phmac; +int i, rc; +
The misc_regsiter(&phmac_dev) should go here.
[...]
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]
Harald Freudenberger
maintainerRe: [PATCH v11 3/6] s390/crypto: New s390 specific protected key hash phmac
Quoted 34 lines · Holger Dengler
Quoted 7 lines · Harald Freudenberger
Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
Quoted 5 lines
This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Co-developed-by Holger Dengler <[email protected]>Signed-off-by Harald Freudenberger <[email protected]>See my comments below. The rest looks good to me.
Quoted 10 lines
--- arch/s390/configs/debug_defconfig | 1 + arch/s390/configs/defconfig | 1 + arch/s390/crypto/Makefile | 1 + arch/s390/crypto/phmac_s390.c | 899 ++++++++++++++++++++++++++++++ drivers/crypto/Kconfig | 12 + 5 files changed, 914 insertions(+) create mode 100644 arch/s390/crypto/phmac_s390.c[...]
Quoted 6 lines
arch/s390/crypto/phmac_s390.c new file +0
-0@@ -0,0 +1,899 @@[...]
Quoted 9 lines
arch/s390/crypto/phmac_s390.c line 169
Quoted 5 lines
arch/s390/crypto/phmac_s390.c new file +5
-0+struct kmac_sha2_ctx { +u8 param[MAX_DIGEST_SIZE +MAX_IMBL_SIZE +PHMAC_MAX_PK_SIZE ]; +union kmac_gr0 gr0; +u8 buf[MAX_BLOCK_SIZE ]; +unsigned long total;The clear-key hmac switched to u64[2] instead of unsinged long for
total. Please synchronize with clear-key hmac.
I've picked these changes from linux-next and reworked the affected code parts to use a u64 buflen[2] now.
Quoted 25 lines
Quoted 2 lines
arch/s390/crypto/phmac_s390.c new file +2
-0+}; +[...]
arch/s390/crypto/phmac_s390.c line 269
Quoted 7 lines
+/*
+ *kmac_sha2_set_imbl- sets the input message bit-length based on the blocksize
+ */
+static inline void kmac_sha2_set_imbl(u8 *param, unsigned long nbytes,arch/s390/crypto/phmac_s390.c new file +1
-0+ unsigned int blocksize)Same here. I would prefer to use this in the phmac as well.
[...]
Quoted 11 lines
arch/s390/crypto/phmac_s390.c new file +11
-0+static void s390_phmac_exit (void ) +{ +struct phmac_alg *phmac; +int i; + +if (phmac_crypto_engine) { +crypto_engine_stop (phmac_crypto_engine); +crypto_engine_exit (phmac_crypto_engine); + } + +for (i =ARRAY_SIZE (phmac_algs) -1 ; i >=0 ; i--) {
Quoted 9 lines
arch/s390/crypto/phmac_s390.c line 849
Quoted 6 lines
arch/s390/crypto/phmac_s390.c new file +6
-0+ phmac = &phmac_algs[i]; +if (phmac->registered) +crypto_engine_unregister_ahash (&phmac->alg); + } + +misc_deregister (&phmac_dev);The
misc_register()call in module init is missing, see my comment to patch 5/6.
Yea. Somehow this code piece moved into patch #5 instead of #3. Done, see v12.
Quoted 11 lines
arch/s390/crypto/phmac_s390.c line 856
Quoted 7 lines
arch/s390/crypto/phmac_s390.c new file +7
-0+} + +static int __init s390_phmac_init (void ) +{ +struct phmac_alg *phmac; +int i, rc; +The
misc_regsiter(&phmac_dev)should go here.[...]
Harald Freudenberger
maintainerPATCH v11 4/6 crypto: api - Add crypto_tfm_alg_get_flags() helper inline function
In reply to Harald FreudenbergerAdd a little helper inline function
crypto_tfm_alg_get_flags()
to the crypto.h header file to retrieve the alg flags.
--- include/linux/crypto.h | 5 +++++ 1 file changed, 5 insertions(+)
include/linux/crypto.h +5 -0
@@ -452,6 +452,11 @@ static inline unsigned int crypto_tfm_alg_alignmask(struct crypto_tfm *tfm)return tfm->__crt_alg->cra_alignmask; } +static inline u32 crypto_tfm_alg_get_flags (struct crypto_tfm *tfm) +{ +return tfm->__crt_alg->cra_flags; +} +static inline u32 crypto_tfm_get_flags (struct crypto_tfm *tfm) {return tfm->crt_flags;
Signature · 1 line
2.43.0
Holger Dengler
maintainerRe: [PATCH v11 4/6] crypto: api - Add crypto_tfm_alg_get_flags() helper inline function
Quoted 14 lines · Harald Freudenberger
Add a little helper inline function
crypto_tfm_alg_get_flags()
to thecrypto.hheader file to retrieve the alg flags.Signed-off-by Harald Freudenberger <[email protected]>--- include/linux/crypto.h | 5 +++++ 1 file changed, 5 insertions(+)include/linux/crypto.h +0
-0
include/linux/crypto.h static inline unsigned int crypto_tfm_alg_alignmask(struct crypto_tfm *tfm) · line 455
Quoted 4 lines
include/linux/crypto.h +1
-0@@ -452,6 +452,11 @@ static inline unsigned int crypto_tfm_alg_alignmask(struct crypto_tfm *tfm)return tfm->__crt_alg->cra_alignmask; } +static inline u32 crypto_tfm_alg_get_flags (struct crypto_tfm *tfm)
I would vote for Herbert's proposal for the helper name and function (see his comment to patch 5/6).
Quoted 7 lines
include/linux/crypto.h +4
-0+{ +return tfm->__crt_alg->cra_flags; +} +static inline u32 crypto_tfm_get_flags (struct crypto_tfm *tfm) {return tfm->crt_flags;
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]
Harald Freudenberger
maintainerPATCH v11 5/6 s390/crypto: Add selftest support for phmac
In reply to Harald FreudenbergerAdd key preparation code in case of selftest running to the phmac setkey function:
As long as the CRYPTO_ALG_TESTED flag is not set, all setkey() invocations are assumed to carry sheer hmac clear key values and thus need some preparation to work with the phmac implementation. Thus it is possible to use the already available hmac test vectors implemented in the testmanager to test the phmac code.
When the CRYPTO_ALG_TESTED flag is set (after larval state) the phmac code assumes the key material is a blob digestible by the pkey kernel module which converts the blob into a working key for the phmac code.
--- arch/s390/crypto/phmac_s390.c | 143 ++++++++++++++++++++++++++++++++++ 1 file changed, 143 insertions(+)
arch/s390/crypto/phmac_s390.c +143 -0
@@ -176,6 +176,114 @@ struct phmac_req_ctx {bool final; }; +/* +* Pkey 'token' struct used to derive a protected key value from a clear key. +*/ +struct hmac_clrkey_token { +u8 type; +u8 res0[3 ]; +u8 version; +u8 res1[3 ]; +u32 keytype; +u32 len; +u8 key[]; +} __packed; + +static int hash_key (const u8 *in,unsigned int inlen, +u8 *digest,unsigned int digestsize) +{ +unsigned long func; +union { +struct sha256_paramblock { +u32 h[8 ]; +u64 mbl; + } sha256; +struct sha512_paramblock { +u64 h[8 ]; +u128 mbl; + } sha512; + } __packed param; + +#define PARAM_INIT (x, y, z) \ + param.sha##x.h[0] = SHA##y ## _H0; \ + param.sha##x.h[1] = SHA##y ## _H1; \ + param.sha##x.h[2] = SHA##y ## _H2; \ + param.sha##x.h[3] = SHA##y ## _H3; \ + param.sha##x.h[4] = SHA##y ## _H4; \ + param.sha##x.h[5] = SHA##y ## _H5; \ + param.sha##x.h[6] = SHA##y ## _H6; \ + param.sha##x.h[7] = SHA##y ## _H7; \ + param.sha##x.mbl = (z) + +switch (digestsize) { +case SHA224_DIGEST_SIZE : + func =CPACF_KLMD_SHA_256 ; +PARAM_INIT (256 ,224 , inlen *8 ); +break ; +case SHA256_DIGEST_SIZE : + func =CPACF_KLMD_SHA_256 ; +PARAM_INIT (256 ,256 , inlen *8 ); +break ; +case SHA384_DIGEST_SIZE : + func =CPACF_KLMD_SHA_512 ; +PARAM_INIT (512 ,384 , inlen *8 ); +break ; +case SHA512_DIGEST_SIZE : + func =CPACF_KLMD_SHA_512 ; +PARAM_INIT (512 ,512 , inlen *8 ); +break ; +default : +return -EINVAL ; + } + +#undef PARAM_INIT + +cpacf_klmd (func, ¶m, in, inlen); + +memcpy (digest, ¶m, digestsize); + +return 0 ; +} + +/* +* make_clrkey_token() - wrap the clear key into a pkey clearkey token. +*/ +static inline int make_clrkey_token (const u8 *clrkey,size_t clrkeylen, +unsigned int digestsize,u8 *dest) +{ +struct hmac_clrkey_token *token = (struct hmac_clrkey_token *)dest; +unsigned int blocksize; +int rc; + + token->type =0x00 ; + token->version =0x02 ; +switch (digestsize) { +case SHA224_DIGEST_SIZE : +case SHA256_DIGEST_SIZE : + token->keytype =PKEY_KEYTYPE_HMAC_512 ; + blocksize =64 ; +break ; +case SHA384_DIGEST_SIZE : +case SHA512_DIGEST_SIZE : + token->keytype =PKEY_KEYTYPE_HMAC_1024 ; + blocksize =128 ; +break ; +default : +return -EINVAL ; + } + token->len = blocksize; + +if (clrkeylen > blocksize) { + rc =hash_key (clrkey, clrkeylen, token->key, digestsize); +if (rc) +return rc; + }else { +memcpy (token->key, clrkey, clrkeylen); + } + +return 0 ; +} +/* * phmac_tfm_ctx_setkey() - Set key value into tfm context, maybe construct * a clear key token digestible by pkey from a clear key value.
@@ -616,9 +724,32 @@ static int phmac_setkey(struct crypto_ahash *tfm, const u8 *key, unsigned int keylen) {struct phmac_tfm_ctx *tfm_ctx =crypto_ahash_ctx (tfm); +struct crypto_tfm *tfm_base =crypto_ahash_tfm (tfm);unsigned int ds =crypto_ahash_digestsize (tfm); +unsigned int bs =crypto_ahash_blocksize (tfm); +unsigned int tmpkeylen; +u8 *tmpkey =NULL ;int rc =0 ; +if (!(crypto_tfm_alg_get_flags (tfm_base) &CRYPTO_ALG_TESTED )) { +/* +* selftest running: key is a raw hmac clear key and needs +* to get embedded into a 'clear key token' in order to have +* it correctly processed by the pkey module. +*/ + tmpkeylen =sizeof (struct hmac_clrkey_token ) + bs; + tmpkey =kzalloc (tmpkeylen,GFP_KERNEL ); +if (!tmpkey) { + rc = -ENOMEM ; + goto out; + } + rc =make_clrkey_token (key, keylen, ds, tmpkey); +if (rc) + goto out; + keylen = tmpkeylen; + key = tmpkey; + } +/* copy raw key into tfm context */ rc =phmac_tfm_ctx_setkey (tfm_ctx, key, keylen);if (rc)
@@ -661,6 +792,7 @@ static int phmac_setkey(struct crypto_ahash *tfm, } out: +kfree (tmpkey);pr_debug ("rc=%d\n" , rc);return rc; }
@@ -854,6 +986,17 @@ static int __init s390_phmac_init(void)struct phmac_alg *phmac;int i, rc; +/* for selftest cpacf klmd subfunction is needed */ +if (!cpacf_query_func (CPACF_KLMD ,CPACF_KLMD_SHA_256 )) +return -ENODEV ; +if (!cpacf_query_func (CPACF_KLMD ,CPACF_KLMD_SHA_512 )) +return -ENODEV ; + +/* register a simple phmac pseudo misc device */ + rc =misc_register (&phmac_dev); +if (rc) +return rc; +/* with this pseudo device alloc and start a crypto engine */ phmac_crypto_engine = crypto_engine_alloc_init_and_set(phmac_dev.this_device,
Signature · 1 line
2.43.0
Herbert Xu
maintainerRe: [PATCH v11 5/6] s390/crypto: Add selftest support for phmac
arch/s390/crypto/phmac_s390.c static int phmac_setkey(struct crypto_ahash *tfm, · line 734
Quoted 2 lines · Harald Freudenberger
arch/s390/crypto/phmac_s390.c +1
-0+if (!(crypto_tfm_alg_get_flags (tfm_base) &CRYPTO_ALG_TESTED )) {
I think a better helper would be
if (!crypto_ahash_tested(tfm)) {Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Harald Freudenberger
maintainerRe: [PATCH v11 5/6] s390/crypto: Add selftest support for phmac
Quoted 9 lines · Herbert Xu
arch/s390/crypto/phmac_s390.c static int phmac_setkey(struct crypto_ahash *tfm, · line 734
Quoted 2 lines · Harald Freudenberger
arch/s390/crypto/phmac_s390.c +1
-0+if (!(crypto_tfm_alg_get_flags (tfm_base) &CRYPTO_ALG_TESTED )) {I think a better helper would be
if (!crypto_ahash_tested(tfm)) {Thanks,
Done, there is now a new inline function:
static inline bool crypto_ahash_tested(struct crypto_ahash *tfm)
{
struct crypto_tfm *tfm_base = crypto_ahash_tfm(tfm);
return tfm_base->__crt_alg->cra_flags & CRYPTO_ALG_TESTED;
}in include/crypto/internal/hash.h
see v12 of this patch series.
Re: [PATCH v11 5/6] s390/crypto: Add selftest support for phmac
In reply to Harald FreudenbergerQuoted 9 lines · Harald Freudenberger
Add key preparation code in case of selftest running to the phmac setkey function:
As long as the
CRYPTO_ALG_TESTEDflag is not set, allsetkey()invocations are assumed to carry sheer hmac clear key values and thus need some preparation to work with the phmac implementation. Thus it is possible to use the already available hmac test vectors implemented in the testmanager to test the phmac code.
Quoted 5 lines
When the
CRYPTO_ALG_TESTEDflag is set (after larval state) the phmac code assumes the key material is a blob digestible by the pkey kernel module which converts the blob into a working key for the phmac code.Signed-off-by Harald Freudenberger <[email protected]>
For this series, the explicit calls of CPACF for hashing long keys is ok. Long term, I would suggest to switch to introduce library functions for sha224(), sha384() and sha512(), all similar to sha256(), and use them for hashing the clear key. This will remove the hard dependency to CPACF SHA function codes for this module. But we should do this in a separate series and do the same for clear-key hmac.
See another comment below. The rest looks good.
[...]
Quoted 1 line
(quoted diff) +0
-0@@ -854,6 +986,17 @@ static int __init s390_phmac_init(void)
[...]
arch/s390/crypto/phmac_s390.c static int __init s390_phmac_init(void) · line 999
Quoted 5 lines
arch/s390/crypto/phmac_s390.c +5
-0+/* register a simple phmac pseudo misc device */ + rc =misc_register (&phmac_dev); +if (rc) +return rc; +
These 5 lines should go into patch 3/6, as it uses phmac_dev already.
Quoted 3 lines
arch/s390/crypto/phmac_s390.c +0
-0/* with this pseudo device alloc and start a crypto engine */ phmac_crypto_engine = crypto_engine_alloc_init_and_set(phmac_dev.this_device,
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]
Harald Freudenberger
maintainerRe: [PATCH v11 5/6] s390/crypto: Add selftest support for phmac
Quoted 16 lines · Holger Dengler
Quoted 9 lines · Harald Freudenberger
Add key preparation code in case of selftest running to the phmac setkey function:
As long as the
CRYPTO_ALG_TESTEDflag is not set, allsetkey()invocations are assumed to carry sheer hmac clear key values and thus need some preparation to work with the phmac implementation. Thus it is possible to use the already available hmac test vectors implemented in the testmanager to test the phmac code.Quoted 5 lines
When the
CRYPTO_ALG_TESTEDflag is set (after larval state) the phmac code assumes the key material is a blob digestible by the pkey kernel module which converts the blob into a working key for the phmac code.Signed-off-by Harald Freudenberger <[email protected]>
Quoted 8 lines
For this series, the explicit calls of CPACF for hashing long keys is ok. Long term, I would suggest to switch to introduce library functions for
sha224(),sha384()andsha512(), all similar tosha256(), and use them for hashing the clear key. This will remove the hard dependency to CPACF SHA function codes for this module. But we should do this in a separate series and do the same for clear-key hmac.
D'accord - but let's first focus on the real implementation and when all this rework on the next kernel is done, we can start to use the library functions instead.
Quoted 7 lines
See another comment below. The rest looks good.
Reviewed-by Holger Dengler <[email protected]>[...]
Quoted 1 line
(quoted diff) +0
-0@@ -854,6 +986,17 @@ static int __init s390_phmac_init(void)[...]
Quoted 11 lines
arch/s390/crypto/phmac_s390.c static int __init s390_phmac_init(void) · line 999
Quoted 5 lines
arch/s390/crypto/phmac_s390.c +5
-0+/* register a simple phmac pseudo misc device */ + rc =misc_register (&phmac_dev); +if (rc) +return rc; +These 5 lines should go into patch 3/6, as it uses
phmac_devalready.Quoted 3 lines
arch/s390/crypto/phmac_s390.c +0
-0/* with this pseudo device alloc and start a crypto engine */ phmac_crypto_engine = crypto_engine_alloc_init_and_set(phmac_dev.this_device,
Done - this code piece really should have been in patch #3.
Harald Freudenberger
maintainerPATCH v11 6/6 crypto: testmgr - Enable phmac selftest
In reply to Harald FreudenbergerAdd phmac selftest invocation to the crypto testmanager.
--- crypto/testmgr.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
crypto/testmgr.c +30 -0
@@ -5385,6 +5385,36 @@ static const struct alg_test_desc alg_test_descs[] = { .cipher = __VECS(fcrypt_pcbc_tv_template) } }, { +#if IS_ENABLED (CONFIG_CRYPTO_PHMAC_S390 ) + .alg = "phmac(sha224)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha224_tv_template) + } + }, { + .alg = "phmac(sha256)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha256_tv_template) + } + }, { + .alg = "phmac(sha384)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha384_tv_template) + } + }, { + .alg = "phmac(sha512)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha512_tv_template) + } + }, { +#endif .alg = "pkcs1(rsa,none)", .test = alg_test_sig, .suite = {
Signature · 1 line
2.43.0
Re: [PATCH v11 6/6] crypto: testmgr - Enable phmac selftest
Quoted 3 lines · Harald Freudenberger
Add phmac selftest invocation to the crypto testmanager.
Signed-off-by Harald Freudenberger <[email protected]>
Quoted 45 lines
--- crypto/testmgr.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)crypto/testmgr.c +30
-0@@ -5385,6 +5385,36 @@ static const struct alg_test_desc alg_test_descs[] = { .cipher = __VECS(fcrypt_pcbc_tv_template) } }, { +#if IS_ENABLED (CONFIG_CRYPTO_PHMAC_S390 ) + .alg = "phmac(sha224)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha224_tv_template) + } + }, { + .alg = "phmac(sha256)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha256_tv_template) + } + }, { + .alg = "phmac(sha384)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha384_tv_template) + } + }, { + .alg = "phmac(sha512)", + .test = alg_test_hash, + .fips_allowed = 1, + .suite = { + .hash =__VECS (hmac_sha512_tv_template) + } + }, { +#endif .alg = "pkcs1(rsa,none)", .test = alg_test_sig, .suite = {
Signature · 5 lines
Mit freundlichen Grüßen / Kind regards Holger Dengler -- IBM Systems, Linux on IBM Z Development [email protected]