New s390 specific protected key hmac

PATCH In review Harald Freudenberger 4 participants 14 messages Jun 17, 2025 – Jun 26, 2025

Subsystems (4)

Crypto API s390 Arm STM32 s390 crypto modules, prng driver, arch random

lore

Share & tools

lore

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #0 lore raw

v12 cover New s390 specific protected key hmac

Add support for protected key hmac ("phmac") for s390 arch.

With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.

This patch adds support via 4 new hashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).

Changelog:
v1: Initial version
v2: Increase HASH_MAX_DESCSIZE generic (not just for arch s390).
Fix one finding to use kmemdup instead of kmalloc/memcpy from test robot. Remove unneeded cpacf subfunctions checks. Simplify clone_tfm() function. Rebased to s390/features.
v3: Feedback from Herbert: Use GFP_ATOMIC in setkey function.
Feedback from Holger: rework tfm clone function, move convert key invocation from setkey to init function. Rebased to updated s390/features from 11/7/2024. Ready for integration if there are no complains on v3.
v4: Rewind back more or less to v2. Add code to check for non-sleeping
context. Non-sleeping context during attempt to derive the protected key from raw key material is not accepted and -EOPNOTSUPP is returned (also currently all derivation pathes would in fact never sleep). In general the phmac implementation is not to be used within non-sleeping context and the code header mentions this. Tested with (patched) dm-integrity - works fine.
v5: As suggested by Herbert now the shashes have been marked as
'internal' and wrapped by ahashes which use the cryptd if an atomic context is detected. So the visible phmac algorithms are now ahashes. Unfortunately the dm-integrity implementation currently requests and deals only with shashes and this phmac implementation is not fitting to the original goal any more...
v6: As suggested by Herbert now a pure async phmac implementation.
Tested via AF_ALG interface. Untested via dm-integrity as this layer only supports shashes. Maybe I'll develop a patch to switch the dm-integrity to ahash as it is anyway the more flexible interface.
v7: Total rework of the implementation. Now uses workqueues and triggers
asynch requests for key convert, init, update, final and digest. Tested with instrumented code and with a reworked version of dm-integrity which uses asynchronous hashes. A patch for dm-integrity is on the way but yet needs some last hone work.
v8: Added selftest. With the selftest comes some code which wraps the
clear key into a "clear key token" digestible by PKEY. The selftest also uses import() and export(), so these are now also implemented. Furthermore a finup() implementation is now also available. Tested with AF_ALG testcases and dm-integrity, also tested with some instrumented code to check that the asynch workqueue functions do their job correctly. Coding is complete!
v9: As suggested by Herbert use ahash_request_complete() and surround it
with local_bh_disable().
v10: Split the pkey selftest patch into 3 patches. Slight rework of the
setkey function as suggested by Holger: When selftest is running as much as possible of the production code should run. So now the key prep with selftest is one additional if/then block instead of an if/then/else construct.
Code is ready for integration and well tested.
v11: Utterly rework with the insights collected with the paes rework
and the basic work done with the pkey rework over the last 5 month. Note that patch #1 effectively reverts commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") from Eric Biggers.
v12: Fixed some typos, adaptions to 128 bit total counter,
misc_register() invocation was missing in the patches series, added Herbert's proposal for a new function crypto_ahash_tested().

Harald Freudenberger (5):
crypto: ahash - make hash walk functions from ahash.c public s390/crypto: New s390 specific protected key hash phmac
crypto: api - Add crypto_ahash_tested() helper function s390/crypto: Add selftest support for phmac
crypto: testmgr - Enable phmac selftest

Holger Dengler (1):
s390/crypto: Add protected key hmac subfunctions for KMAC

 arch/s390/configs/debug_defconfig |    1 +
 arch/s390/configs/defconfig       |    1 +
 arch/s390/crypto/Makefile         |    1 +
 arch/s390/crypto/phmac_s390.c     | 1048 +++++++++++++++++++++++++++++
 arch/s390/include/asm/cpacf.h     |    4 +
 crypto/ahash.c                    |   26 +-
 crypto/testmgr.c                  |   30 +
 drivers/crypto/Kconfig            |   13 +
 include/crypto/internal/hash.h    |   30 +
 9 files changed, 1133 insertions(+), 21 deletions(-)
 create mode 100644 arch/s390/crypto/phmac_s390.c

base-commit: 1029436218e50168812dbc44b16bca6d35721b0b --
2.43.0

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #1 lore raw

PATCH v12 1/6 crypto: ahash - make hash walk functions from ahash.c public

Make the hash walk functions
crypto_hash_walk_done()
crypto_hash_walk_first()
crypto_hash_walk_last()
public again.
These functions had been removed from the header file include/crypto/internal/hash.h with commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") as there was no crypto algorithm code using them.

With the upcoming crypto implementation for s390 phmac these functions will be exploited and thus need to be public within the kernel again.

Signed-off-by Harald Freudenberger <[email protected]>

Acked-by Holger Dengler <[email protected]>

---
 crypto/ahash.c                 | 26 +++++---------------------
 include/crypto/internal/hash.h | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+), 21 deletions(-)

crypto/ahash.c +5 ~~-21~~

index bd9e49950201..0809ef102ef8 100644
@@ -29,19 +29,6 @@
 
 #define CRYPTO_ALG_TYPE_AHASH_MASK	0x0000000e
 
-struct crypto_hash_walk {
-	const char *data;
-
-	unsigned int offset;
-	unsigned int flags;
-
-	struct page *pg;
-	unsigned int entrylen;
-
-	unsigned int total;
-	struct scatterlist *sg;
-};
-
 static int ahash_def_finup(struct ahash_request *req);
 
 static inline bool crypto_ahash_block_only(struct crypto_ahash *tfm)

@@ -112,8 +99,8 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)
 	return hash_walk_next(walk);
 }
 
-static int crypto_hash_walk_first(struct ahash_request *req,
-				  struct crypto_hash_walk *walk)
+int crypto_hash_walk_first(struct ahash_request *req,
+			   struct crypto_hash_walk *walk)
 {
 	walk->total = req->nbytes;
 	walk->entrylen = 0;

@@ -133,8 +120,9 @@ static int crypto_hash_walk_first(struct ahash_request *req,
 
 	return hash_walk_new_entry(walk);
 }
+EXPORT_SYMBOL_GPL(crypto_hash_walk_first);
 
-static int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
+int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
 {
 	if ((walk->flags & CRYPTO_AHASH_REQ_VIRT))
 		return err;

@@ -160,11 +148,7 @@ static int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
 
 	return hash_walk_new_entry(walk);
 }
-
-static inline int crypto_hash_walk_last(struct crypto_hash_walk *walk)
-{
-	return !(walk->entrylen | walk->total);
-}
+EXPORT_SYMBOL_GPL(crypto_hash_walk_done);
 
 /*
  * For an ahash tfm that is using an shash algorithm (instead of an ahash

include/crypto/internal/hash.h +23 -0

index 0f85c543f80b..ef573545c85d 100644
@@ -30,6 +30,20 @@
                 __##name##_req, (req))
 
 struct ahash_request;
+struct scatterlist;
+
+struct crypto_hash_walk {
+	const char *data;
+
+	unsigned int offset;
+	unsigned int flags;
+
+	struct page *pg;
+	unsigned int entrylen;
+
+	unsigned int total;
+	struct scatterlist *sg;
+};
 
 struct ahash_instance {
 	void (*free)(struct ahash_instance *inst);

@@ -61,6 +75,15 @@ struct crypto_shash_spawn {
 	struct crypto_spawn base;
 };
 
+int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err);
+int crypto_hash_walk_first(struct ahash_request *req,
+			   struct crypto_hash_walk *walk);
+
+static inline int crypto_hash_walk_last(struct crypto_hash_walk *walk)
+{
+	return !(walk->entrylen | walk->total);
+}
+
 int crypto_register_ahash(struct ahash_alg *alg);
 void crypto_unregister_ahash(struct ahash_alg *alg);
 int crypto_register_ahashes(struct ahash_alg *algs, int count);

Signature · 1 line

2.43.0

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #2 lore raw

PATCH v12 2/6 s390/crypto: Add protected key hmac subfunctions for KMAC

In reply to Harald Freudenberger

From: Holger Dengler <[email protected]>

The CPACF KMAC instruction supports new subfunctions for protected key hmac. Add defines for these 4 new subfuctions.

Signed-off-by Holger Dengler <[email protected]>

Signed-off-by Harald Freudenberger <[email protected]>

Reviewed-by Holger Dengler <[email protected]>

---
 arch/s390/include/asm/cpacf.h | 4 ++++
 1 file changed, 4 insertions(+)

arch/s390/include/asm/cpacf.h +4 -0

index 54cb97603ec0..4bc5317fbb12 100644
@@ -129,6 +129,10 @@
 #define CPACF_KMAC_HMAC_SHA_256	0x71
 #define CPACF_KMAC_HMAC_SHA_384	0x72
 #define CPACF_KMAC_HMAC_SHA_512	0x73
+#define CPACF_KMAC_PHMAC_SHA_224	0x78
+#define CPACF_KMAC_PHMAC_SHA_256	0x79
+#define CPACF_KMAC_PHMAC_SHA_384	0x7a
+#define CPACF_KMAC_PHMAC_SHA_512	0x7b
 
 /*
  * Function codes for the PCKMO (PERFORM CRYPTOGRAPHIC KEY MANAGEMENT)

Signature · 1 line

2.43.0

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #3 lore raw

PATCH v12 3/6 s390/crypto: New s390 specific protected key hash phmac

In reply to Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.

This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).

Co-developed-by Holger Dengler <[email protected]>

Signed-off-by Harald Freudenberger <[email protected]>

Reviewed-by Holger Dengler <[email protected]>

---
 arch/s390/configs/debug_defconfig |   1 +
 arch/s390/configs/defconfig       |   1 +
 arch/s390/crypto/Makefile         |   1 +
 arch/s390/crypto/phmac_s390.c     | 911 ++++++++++++++++++++++++++++++
 drivers/crypto/Kconfig            |  13 +
 5 files changed, 927 insertions(+)
 create mode 100644 arch/s390/crypto/phmac_s390.c

arch/s390/configs/debug_defconfig +1 -0

index 8ecad727497e..e91fe6c7832e 100644
@@ -819,6 +819,7 @@ CONFIG_PKEY_EP11=m
 CONFIG_PKEY_PCKMO=m
 CONFIG_PKEY_UV=m
 CONFIG_CRYPTO_PAES_S390=m
+CONFIG_CRYPTO_PHMAC_S390=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_SYSTEM_BLACKLIST_KEYRING=y
 CONFIG_CRYPTO_KRB5=m

arch/s390/configs/defconfig +1 -0

index c13a77765162..fae834beff57 100644
@@ -806,6 +806,7 @@ CONFIG_PKEY_EP11=m
 CONFIG_PKEY_PCKMO=m
 CONFIG_PKEY_UV=m
 CONFIG_CRYPTO_PAES_S390=m
+CONFIG_CRYPTO_PHMAC_S390=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_SYSTEM_BLACKLIST_KEYRING=y
 CONFIG_CRYPTO_KRB5=m

arch/s390/crypto/Makefile +1 -0

index 21757d86cd49..6d1f1df46036 100644
@@ -13,4 +13,5 @@ obj-$(CONFIG_CRYPTO_PAES_S390) += paes_s390.o
 obj-$(CONFIG_S390_PRNG) += prng.o
 obj-$(CONFIG_CRYPTO_GHASH_S390) += ghash_s390.o
 obj-$(CONFIG_CRYPTO_HMAC_S390) += hmac_s390.o
+obj-$(CONFIG_CRYPTO_PHMAC_S390) += phmac_s390.o
 obj-y += arch_random.o

arch/s390/crypto/phmac_s390.c new file +911 -0

911 lines not on this page · raw message

drivers/crypto/Kconfig +13 -0

index 9f8a3a5bed7e..04b4c43b6bae 100644
@@ -188,6 +188,19 @@ config CRYPTO_PAES_S390
 	  Select this option if you want to use the paes cipher
 	  for example to use protected key encrypted devices.
 
+config CRYPTO_PHMAC_S390
+	tristate "PHMAC cipher algorithms"
+	depends on S390
+	depends on PKEY
+	select CRYPTO_HASH
+	select CRYPTO_ENGINE
+	help
+	  This is the s390 hardware accelerated implementation of the
+	  protected key HMAC support for SHA224, SHA256, SHA384 and SHA512.
+
+	  Select this option if you want to use the phmac digests
+	  for example to use dm-integrity with secure/protected keys.
+
 config S390_PRNG
 	tristate "Pseudo random number generator device driver"
 	depends on S390

Signature · 1 line

2.43.0

Holger Dengler

maintainer

2025-06-18 09:21 UTC #4 lore raw

Re: [PATCH v12 3/6] s390/crypto: New s390 specific protected key hash phmac

Quoted 11 lines · Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Co-developed-by Holger Dengler <[email protected]>

According to Documentation/process/maintainer-tip.rst (line 313 ff.), please add my

Signed-off-by Holger Dengler <[email protected]>

Quoted 2 lines

Signed-off-by Harald Freudenberger <[email protected]>
Reviewed-by Holger Dengler <[email protected]>

Signature · 5 lines

Mit freundlichen Grüßen / Kind regards
Holger Dengler
--
IBM Systems, Linux on IBM Z Development
[email protected]

Heiko Carstens

maintainer

2025-06-18 09:29 UTC #5 lore raw

Re: [PATCH v12 3/6] s390/crypto: New s390 specific protected key hash phmac

In reply to Harald Freudenberger

Quoted 7 lines · Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.

Quoted 7 lines

This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Co-developed-by Holger Dengler <[email protected]>
Signed-off-by Harald Freudenberger <[email protected]>
Reviewed-by Holger Dengler <[email protected]>
---

Co-developed-by must come together with a Signed-off-by tag. See Documentation/process/submitting-patches.rst.

Holger, can you provide your Sign-off, please?

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #6 lore raw

PATCH v12 4/6 crypto: api - Add crypto_ahash_tested() helper function

In reply to Harald Freudenberger

Add a little inline helper function
crypto_ahash_tested()
to the internal/hash.h header file to retrieve the tested status (that is the CRYPTO_ALG_TESTED bit in the cra_flags).

Signed-off-by Harald Freudenberger <[email protected]>

---
 include/crypto/internal/hash.h | 7 +++++++
 1 file changed, 7 insertions(+)

include/crypto/internal/hash.h +7 -0

index ef573545c85d..8126254c9255 100644
@@ -190,6 +190,13 @@ static inline void crypto_ahash_set_reqsize(struct crypto_ahash *tfm,
 	tfm->reqsize = reqsize;
 }
 
+static inline bool crypto_ahash_tested(struct crypto_ahash *tfm)
+{
+	struct crypto_tfm *tfm_base = crypto_ahash_tfm(tfm);
+
+	return tfm_base->__crt_alg->cra_flags & CRYPTO_ALG_TESTED;
+}
+
 static inline void crypto_ahash_set_reqsize_dma(struct crypto_ahash *ahash,
 						unsigned int reqsize)
 {

Signature · 1 line

2.43.0

Holger Dengler

maintainer Reviewed-by on v12 4/6

2025-06-18 09:23 UTC #7 lore raw

Re: [PATCH v12 4/6] crypto: api - Add crypto_ahash_tested() helper function

Quoted 7 lines · Harald Freudenberger

Add a little inline helper function
crypto_ahash_tested()
to the internal/hash.h header file to retrieve the tested status (that is the CRYPTO_ALG_TESTED bit in the cra_flags).
Signed-off-by Harald Freudenberger <[email protected]>
Suggested-by Herbert Xu <[email protected]>

Please change the ordering. Suggested-by: first, Signed-off-by: second.

Reviewed-by Holger Dengler <[email protected]>

Signature · 5 lines

Mit freundlichen Grüßen / Kind regards
Holger Dengler
--
IBM Systems, Linux on IBM Z Development
[email protected]

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #8 lore raw

PATCH v12 5/6 s390/crypto: Add selftest support for phmac

In reply to Harald Freudenberger

Add key preparation code in case of selftest running to the phmac setkey function:

As long as crypto_ahash_tested() returns with false, all setkey() invocations are assumed to carry sheer hmac clear key values and thus need some preparation to work with the phmac implementation. Thus it is possible to use the already available hmac test vectors implemented in the testmanager to test the phmac code.

When crypto_ahash_tested() returns true (that is after larval state) the phmac code assumes the key material is a blob digestible by the pkey kernel module which converts the blob into a working key for the phmac code.

Signed-off-by Harald Freudenberger <[email protected]>

Reviewed-by Holger Dengler <[email protected]>

---
 arch/s390/crypto/phmac_s390.c | 137 ++++++++++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)

arch/s390/crypto/phmac_s390.c +137 -0

index 8473af47f5b9..90602f72108f 100644
@@ -176,6 +176,114 @@ struct phmac_req_ctx {
 	bool final;
 };
 
+/*
+ * Pkey 'token' struct used to derive a protected key value from a clear key.
+ */
+struct hmac_clrkey_token {
+	u8  type;
+	u8  res0[3];
+	u8  version;
+	u8  res1[3];
+	u32 keytype;
+	u32 len;
+	u8 key[];
+} __packed;
+
+static int hash_key(const u8 *in, unsigned int inlen,
+		    u8 *digest, unsigned int digestsize)
+{
+	unsigned long func;
+	union {
+		struct sha256_paramblock {
+			u32 h[8];
+			u64 mbl;
+		} sha256;
+		struct sha512_paramblock {
+			u64 h[8];
+			u128 mbl;
+		} sha512;
+	} __packed param;
+
+#define PARAM_INIT(x, y, z)		   \
+	param.sha##x.h[0] = SHA##y ## _H0; \
+	param.sha##x.h[1] = SHA##y ## _H1; \
+	param.sha##x.h[2] = SHA##y ## _H2; \
+	param.sha##x.h[3] = SHA##y ## _H3; \
+	param.sha##x.h[4] = SHA##y ## _H4; \
+	param.sha##x.h[5] = SHA##y ## _H5; \
+	param.sha##x.h[6] = SHA##y ## _H6; \
+	param.sha##x.h[7] = SHA##y ## _H7; \
+	param.sha##x.mbl = (z)
+
+	switch (digestsize) {
+	case SHA224_DIGEST_SIZE:
+		func = CPACF_KLMD_SHA_256;
+		PARAM_INIT(256, 224, inlen * 8);
+		break;
+	case SHA256_DIGEST_SIZE:
+		func = CPACF_KLMD_SHA_256;
+		PARAM_INIT(256, 256, inlen * 8);
+		break;
+	case SHA384_DIGEST_SIZE:
+		func = CPACF_KLMD_SHA_512;
+		PARAM_INIT(512, 384, inlen * 8);
+		break;
+	case SHA512_DIGEST_SIZE:
+		func = CPACF_KLMD_SHA_512;
+		PARAM_INIT(512, 512, inlen * 8);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+#undef PARAM_INIT
+
+	cpacf_klmd(func, &param, in, inlen);
+
+	memcpy(digest, &param, digestsize);
+
+	return 0;
+}
+
+/*
+ * make_clrkey_token() - wrap the clear key into a pkey clearkey token.
+ */
+static inline int make_clrkey_token(const u8 *clrkey, size_t clrkeylen,
+				    unsigned int digestsize, u8 *dest)
+{
+	struct hmac_clrkey_token *token = (struct hmac_clrkey_token *)dest;
+	unsigned int blocksize;
+	int rc;
+
+	token->type = 0x00;
+	token->version = 0x02;
+	switch (digestsize) {
+	case SHA224_DIGEST_SIZE:
+	case SHA256_DIGEST_SIZE:
+		token->keytype = PKEY_KEYTYPE_HMAC_512;
+		blocksize = 64;
+		break;
+	case SHA384_DIGEST_SIZE:
+	case SHA512_DIGEST_SIZE:
+		token->keytype = PKEY_KEYTYPE_HMAC_1024;
+		blocksize = 128;
+		break;
+	default:
+		return -EINVAL;
+	}
+	token->len = blocksize;
+
+	if (clrkeylen > blocksize) {
+		rc = hash_key(clrkey, clrkeylen, token->key, digestsize);
+		if (rc)
+			return rc;
+	} else {
+		memcpy(token->key, clrkey, clrkeylen);
+	}
+
+	return 0;
+}
+
 /*
  * phmac_tfm_ctx_setkey() - Set key value into tfm context, maybe construct
  * a clear key token digestible by pkey from a clear key value.

@@ -623,8 +731,30 @@ static int phmac_setkey(struct crypto_ahash *tfm,
 {
 	struct phmac_tfm_ctx *tfm_ctx = crypto_ahash_ctx(tfm);
 	unsigned int ds = crypto_ahash_digestsize(tfm);
+	unsigned int bs = crypto_ahash_blocksize(tfm);
+	unsigned int tmpkeylen;
+	u8 *tmpkey = NULL;
 	int rc = 0;
 
+	if (!crypto_ahash_tested(tfm)) {
+		/*
+		 * selftest running: key is a raw hmac clear key and needs
+		 * to get embedded into a 'clear key token' in order to have
+		 * it correctly processed by the pkey module.
+		 */
+		tmpkeylen = sizeof(struct hmac_clrkey_token) + bs;
+		tmpkey = kzalloc(tmpkeylen, GFP_KERNEL);
+		if (!tmpkey) {
+			rc = -ENOMEM;
+			goto out;
+		}
+		rc = make_clrkey_token(key, keylen, ds, tmpkey);
+		if (rc)
+			goto out;
+		keylen = tmpkeylen;
+		key = tmpkey;
+	}
+
 	/* copy raw key into tfm context */
 	rc = phmac_tfm_ctx_setkey(tfm_ctx, key, keylen);
 	if (rc)

@@ -667,6 +797,7 @@ static int phmac_setkey(struct crypto_ahash *tfm,
 	}
 
 out:
+	kfree(tmpkey);
 	pr_debug("rc=%d\n", rc);
 	return rc;
 }

@@ -861,6 +992,12 @@ static int __init s390_phmac_init(void)
 	struct phmac_alg *phmac;
 	int i, rc;
 
+	/* for selftest cpacf klmd subfunction is needed */
+	if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_256))
+		return -ENODEV;
+	if (!cpacf_query_func(CPACF_KLMD, CPACF_KLMD_SHA_512))
+		return -ENODEV;
+
 	/* register a simple phmac pseudo misc device */
 	rc = misc_register(&phmac_dev);
 	if (rc)

Signature · 1 line

2.43.0

Harald Freudenberger

author maintainer

2025-06-17 13:44 UTC #9 lore raw

PATCH v12 6/6 crypto: testmgr - Enable phmac selftest

In reply to Harald Freudenberger

Add phmac selftest invocation to the crypto testmanager.

Signed-off-by Harald Freudenberger <[email protected]>

Acked-by Holger Dengler <[email protected]>

---
 crypto/testmgr.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

crypto/testmgr.c +30 -0

index a4ad939e03c9..b42112a208ff 100644
@@ -5306,6 +5306,36 @@ static const struct alg_test_desc alg_test_descs[] = {
 			.cipher = __VECS(fcrypt_pcbc_tv_template)
 		}
 	}, {
+#if IS_ENABLED(CONFIG_CRYPTO_PHMAC_S390)
+		.alg = "phmac(sha224)",
+		.test = alg_test_hash,
+		.fips_allowed = 1,
+		.suite = {
+			.hash = __VECS(hmac_sha224_tv_template)
+		}
+	}, {
+		.alg = "phmac(sha256)",
+		.test = alg_test_hash,
+		.fips_allowed = 1,
+		.suite = {
+			.hash = __VECS(hmac_sha256_tv_template)
+		}
+	}, {
+		.alg = "phmac(sha384)",
+		.test = alg_test_hash,
+		.fips_allowed = 1,
+		.suite = {
+			.hash = __VECS(hmac_sha384_tv_template)
+		}
+	}, {
+		.alg = "phmac(sha512)",
+		.test = alg_test_hash,
+		.fips_allowed = 1,
+		.suite = {
+			.hash = __VECS(hmac_sha512_tv_template)
+		}
+	}, {
+#endif
 		.alg = "pkcs1(rsa,none)",
 		.test = alg_test_sig,
 		.suite = {

Signature · 1 line

2.43.0

Herbert Xu

maintainer Acked-by on the v12 series

2025-06-18 08:58 UTC #10 lore raw

In reply to Harald Freudenberger

Quoted 90 lines · Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new hashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Changelog:
v1: Initial version
v2: Increase HASH_MAX_DESCSIZE generic (not just for arch s390).
Fix one finding to use kmemdup instead of kmalloc/memcpy from test robot. Remove unneeded cpacf subfunctions checks. Simplify clone_tfm() function. Rebased to s390/features.
v3: Feedback from Herbert: Use GFP_ATOMIC in setkey function.
Feedback from Holger: rework tfm clone function, move convert key invocation from setkey to init function. Rebased to updated s390/features from 11/7/2024. Ready for integration if there are no complains on v3.
v4: Rewind back more or less to v2. Add code to check for non-sleeping
context. Non-sleeping context during attempt to derive the protected key from raw key material is not accepted and -EOPNOTSUPP is returned (also currently all derivation pathes would in fact never sleep). In general the phmac implementation is not to be used within non-sleeping context and the code header mentions this. Tested with (patched) dm-integrity - works fine.
v5: As suggested by Herbert now the shashes have been marked as
'internal' and wrapped by ahashes which use the cryptd if an atomic context is detected. So the visible phmac algorithms are now ahashes. Unfortunately the dm-integrity implementation currently requests and deals only with shashes and this phmac implementation is not fitting to the original goal any more...
v6: As suggested by Herbert now a pure async phmac implementation.
Tested via AF_ALG interface. Untested via dm-integrity as this layer only supports shashes. Maybe I'll develop a patch to switch the dm-integrity to ahash as it is anyway the more flexible interface.
v7: Total rework of the implementation. Now uses workqueues and triggers
asynch requests for key convert, init, update, final and digest. Tested with instrumented code and with a reworked version of dm-integrity which uses asynchronous hashes. A patch for dm-integrity is on the way but yet needs some last hone work.
v8: Added selftest. With the selftest comes some code which wraps the
clear key into a "clear key token" digestible by PKEY. The selftest also uses import() and export(), so these are now also implemented. Furthermore a finup() implementation is now also available. Tested with AF_ALG testcases and dm-integrity, also tested with some instrumented code to check that the asynch workqueue functions do their job correctly. Coding is complete!
v9: As suggested by Herbert use ahash_request_complete() and surround it
with local_bh_disable().
v10: Split the pkey selftest patch into 3 patches. Slight rework of the
setkey function as suggested by Holger: When selftest is running as much as possible of the production code should run. So now the key prep with selftest is one additional if/then block instead of an if/then/else construct.
Code is ready for integration and well tested.
v11: Utterly rework with the insights collected with the paes rework
and the basic work done with the pkey rework over the last 5 month. Note that patch #1 effectively reverts commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") from Eric Biggers.
v12: Fixed some typos, adaptions to 128 bit total counter,
misc_register() invocation was missing in the patches series, added Herbert's proposal for a new function crypto_ahash_tested().
Harald Freudenberger (5):
crypto: ahash - make hash walk functions from ahash.c public s390/crypto: New s390 specific protected key hash phmac
crypto: api - Add crypto_ahash_tested() helper function s390/crypto: Add selftest support for phmac
crypto: testmgr - Enable phmac selftest
Holger Dengler (1):
s390/crypto: Add protected key hmac subfunctions for KMAC
 arch/s390/configs/debug_defconfig |    1 +
 arch/s390/configs/defconfig       |    1 +
 arch/s390/crypto/Makefile         |    1 +
 arch/s390/crypto/phmac_s390.c     | 1048 +++++++++++++++++++++++++++++
 arch/s390/include/asm/cpacf.h     |    4 +
 crypto/ahash.c                    |   26 +-
 crypto/testmgr.c                  |   30 +
 drivers/crypto/Kconfig            |   13 +
 include/crypto/internal/hash.h    |   30 +
 9 files changed, 1133 insertions(+), 21 deletions(-)
 create mode 100644 arch/s390/crypto/phmac_s390.c

Quoted 3 lines

base-commit: 1029436218e50168812dbc44b16bca6d35721b0b --
2.43.0

Acked-by Herbert Xu <[email protected]>

Thanks,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Harald Freudenberger

author maintainer

2025-06-24 11:34 UTC #11 lore raw

In reply to Harald Freudenberger

Quoted 93 lines · Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new hashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Changelog:
v1: Initial version
v2: Increase HASH_MAX_DESCSIZE generic (not just for arch s390).
Fix one finding to use kmemdup instead of kmalloc/memcpy from test robot. Remove unneeded cpacf subfunctions checks. Simplify clone_tfm() function. Rebased to s390/features.
v3: Feedback from Herbert: Use GFP_ATOMIC in setkey function.
Feedback from Holger: rework tfm clone function, move convert key invocation from setkey to init function. Rebased to updated s390/features from 11/7/2024. Ready for integration if there are no complains on v3.
v4: Rewind back more or less to v2. Add code to check for non-sleeping
context. Non-sleeping context during attempt to derive the protected key from raw key material is not accepted and -EOPNOTSUPP is returned (also currently all derivation pathes would in fact never sleep). In general the phmac implementation is not to be used within non-sleeping context and the code header mentions this. Tested with (patched) dm-integrity - works fine.
v5: As suggested by Herbert now the shashes have been marked as
'internal' and wrapped by ahashes which use the cryptd if an atomic context is detected. So the visible phmac algorithms are now ahashes. Unfortunately the dm-integrity implementation currently requests and deals only with shashes and this phmac implementation is not fitting to the original goal any more...
v6: As suggested by Herbert now a pure async phmac implementation.
Tested via AF_ALG interface. Untested via dm-integrity as this
layer
only supports shashes. Maybe I'll develop a patch to switch the dm-integrity to ahash as it is anyway the more flexible interface.
v7: Total rework of the implementation. Now uses workqueues and triggers
asynch requests for key convert, init, update, final and digest. Tested with instrumented code and with a reworked version of dm-integrity which uses asynchronous hashes. A patch for
dm-integrity
is on the way but yet needs some last hone work.
v8: Added selftest. With the selftest comes some code which wraps the
clear key into a "clear key token" digestible by PKEY. The selftest also uses import() and export(), so these are now also implemented. Furthermore a finup() implementation is now also available. Tested with AF_ALG testcases and dm-integrity, also tested with some instrumented code to check that the asynch workqueue functions do their job correctly. Coding is complete!
v9: As suggested by Herbert use ahash_request_complete() and surround it
with local_bh_disable().
v10: Split the pkey selftest patch into 3 patches. Slight rework of the
setkey function as suggested by Holger: When selftest is running as much as possible of the production code should run. So now the key prep with selftest is one additional if/then block instead of an if/then/else construct.
Code is ready for integration and well tested.
v11: Utterly rework with the insights collected with the paes rework
and the basic work done with the pkey rework over the last 5
month.
Note that patch #1 effectively reverts commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") from Eric Biggers.
v12: Fixed some typos, adaptions to 128 bit total counter,
misc_register() invocation was missing in the patches series, added Herbert's proposal for a new function crypto_ahash_tested().
Harald Freudenberger (5):
crypto: ahash - make hash walk functions from ahash.c public s390/crypto: New s390 specific protected key hash phmac
crypto: api - Add crypto_ahash_tested() helper function s390/crypto: Add selftest support for phmac
crypto: testmgr - Enable phmac selftest
Holger Dengler (1):
s390/crypto: Add protected key hmac subfunctions for KMAC
 arch/s390/configs/debug_defconfig |    1 +
 arch/s390/configs/defconfig       |    1 +
 arch/s390/crypto/Makefile         |    1 +
 arch/s390/crypto/phmac_s390.c     | 1048 +++++++++++++++++++++++++++++
 arch/s390/include/asm/cpacf.h     |    4 +
 crypto/ahash.c                    |   26 +-
 crypto/testmgr.c                  |   30 +
 drivers/crypto/Kconfig            |   13 +
 include/crypto/internal/hash.h    |   30 +
 9 files changed, 1133 insertions(+), 21 deletions(-)
 create mode 100644 arch/s390/crypto/phmac_s390.c

Quoted 3 lines

base-commit: 1029436218e50168812dbc44b16bca6d35721b0b --
2.43.0

Hi Herbert,

as the phmac implementation uses the newly introduced CRYPTO_ALG_NO_FALLBACK flag, we can't deliver this patch series via s390. I talked with Heiko about that and there are two options:
1) We (s390) pick your patch 4ccd065a69df ("crypto: ahash - Add support for drivers with no fallback") together with my patch series for the next kernel's merge window.
2) You (crypto) pick my patch series into your cryptodev-2.6 for next kernel's merge window.
I would prefer option 2 as most of the patches anyway deal with crypto and Heiko and I do not expect unsolvable merge conflicts with the next kernel's merge.
So what is your opinion?

Thanks,
Harald Freudenberger

Herbert Xu

maintainer

2025-06-24 11:37 UTC #12 lore raw

Quoted 13 lines · Harald Freudenberger

as the phmac implementation uses the newly introduced CRYPTO_ALG_NO_FALLBACK flag, we can't deliver this patch series via s390. I talked with Heiko about that and there are two options:
1) We (s390) pick your patch 4ccd065a69df ("crypto: ahash - Add support for drivers with no fallback") together with my patch series for the next kernel's merge window.
2) You (crypto) pick my patch series into your cryptodev-2.6 for next kernel's merge window.
I would prefer option 2 as most of the patches anyway deal with crypto and Heiko and I do not expect unsolvable merge conflicts with the next kernel's merge.
So what is your opinion?

Sure I can do that if you wish. Is it just that series or are there other dependencies that I need first?

Cheers,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Herbert Xu

maintainer

2025-06-26 10:54 UTC #13 lore raw

In reply to Harald Freudenberger

Quoted 90 lines · Harald Freudenberger

Add support for protected key hmac ("phmac") for s390 arch.
With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac.
This patch adds support via 4 new hashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512).
Changelog:
v1: Initial version
v2: Increase HASH_MAX_DESCSIZE generic (not just for arch s390).
Fix one finding to use kmemdup instead of kmalloc/memcpy from test robot. Remove unneeded cpacf subfunctions checks. Simplify clone_tfm() function. Rebased to s390/features.
v3: Feedback from Herbert: Use GFP_ATOMIC in setkey function.
Feedback from Holger: rework tfm clone function, move convert key invocation from setkey to init function. Rebased to updated s390/features from 11/7/2024. Ready for integration if there are no complains on v3.
v4: Rewind back more or less to v2. Add code to check for non-sleeping
context. Non-sleeping context during attempt to derive the protected key from raw key material is not accepted and -EOPNOTSUPP is returned (also currently all derivation pathes would in fact never sleep). In general the phmac implementation is not to be used within non-sleeping context and the code header mentions this. Tested with (patched) dm-integrity - works fine.
v5: As suggested by Herbert now the shashes have been marked as
'internal' and wrapped by ahashes which use the cryptd if an atomic context is detected. So the visible phmac algorithms are now ahashes. Unfortunately the dm-integrity implementation currently requests and deals only with shashes and this phmac implementation is not fitting to the original goal any more...
v6: As suggested by Herbert now a pure async phmac implementation.
Tested via AF_ALG interface. Untested via dm-integrity as this layer only supports shashes. Maybe I'll develop a patch to switch the dm-integrity to ahash as it is anyway the more flexible interface.
v7: Total rework of the implementation. Now uses workqueues and triggers
asynch requests for key convert, init, update, final and digest. Tested with instrumented code and with a reworked version of dm-integrity which uses asynchronous hashes. A patch for dm-integrity is on the way but yet needs some last hone work.
v8: Added selftest. With the selftest comes some code which wraps the
clear key into a "clear key token" digestible by PKEY. The selftest also uses import() and export(), so these are now also implemented. Furthermore a finup() implementation is now also available. Tested with AF_ALG testcases and dm-integrity, also tested with some instrumented code to check that the asynch workqueue functions do their job correctly. Coding is complete!
v9: As suggested by Herbert use ahash_request_complete() and surround it
with local_bh_disable().
v10: Split the pkey selftest patch into 3 patches. Slight rework of the
setkey function as suggested by Holger: When selftest is running as much as possible of the production code should run. So now the key prep with selftest is one additional if/then block instead of an if/then/else construct.
Code is ready for integration and well tested.
v11: Utterly rework with the insights collected with the paes rework
and the basic work done with the pkey rework over the last 5 month. Note that patch #1 effectively reverts commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") from Eric Biggers.
v12: Fixed some typos, adaptions to 128 bit total counter,
misc_register() invocation was missing in the patches series, added Herbert's proposal for a new function crypto_ahash_tested().
Harald Freudenberger (5):
crypto: ahash - make hash walk functions from ahash.c public s390/crypto: New s390 specific protected key hash phmac
crypto: api - Add crypto_ahash_tested() helper function s390/crypto: Add selftest support for phmac
crypto: testmgr - Enable phmac selftest
Holger Dengler (1):
s390/crypto: Add protected key hmac subfunctions for KMAC
 arch/s390/configs/debug_defconfig |    1 +
 arch/s390/configs/defconfig       |    1 +
 arch/s390/crypto/Makefile         |    1 +
 arch/s390/crypto/phmac_s390.c     | 1048 +++++++++++++++++++++++++++++
 arch/s390/include/asm/cpacf.h     |    4 +
 crypto/ahash.c                    |   26 +-
 crypto/testmgr.c                  |   30 +
 drivers/crypto/Kconfig            |   13 +
 include/crypto/internal/hash.h    |   30 +
 9 files changed, 1133 insertions(+), 21 deletions(-)
 create mode 100644 arch/s390/crypto/phmac_s390.c

Quoted 3 lines

base-commit: 1029436218e50168812dbc44b16bca6d35721b0b --
2.43.0

All applied. Thanks.

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt