SM3 library

PATCH Applied Eric Biggers 2 participants 15 messages Mar 21 – Mar 24

Subsystems (13)

x86 RISC-V Crypto API arm64 +9 more subsystems

lore

Share & tools

lore

Eric Biggers

author maintainer

2026-03-21 04:11 UTC #0 lore raw

cover SM3 library

This series is targeting libcrypto-next. It can also be retrieved from:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git sm3-lib-v1

This series cleans up the kernel's existing SM3 hashing code:

- First, it updates lib/crypto/sm3.c to implement the full SM3 instead of just SM3's compression function.

- Next, it adds a KUnit test suite for the new library API.

- Next, it replaces the "sm3-generic" crypto_shash with a wrapper around the new library API.

- Finally, it accelerates the API using the existing SM3 assembly code for arm64, riscv, and x86. The architecture-specific crypto_shash glue code for SM3 is no longer needed and is removed.

This should look quite boring. It's the same cleanup that I've already done for the other hash functions.

Note: I don't recommend using SM3. There also don't appear to be any immediate candidate users of the SM3 library other than crypto_shash.

Still, this seems like the clear way to go. It's simpler, and it gets the hash algorithms integrated in a consistent way. We won't have to keep track of two quite different ways of doing things. With KUnit the code becomes much easier to test and benchmark, as well.

Eric Biggers (12):
crypto: sm3 - Fold sm3_init() into its caller
crypto: sm3 - Remove sm3_zero_message_hash and SM3_T[1-2]
crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3 lib/crypto: sm3: Add SM3 library API
lib/crypto: tests: Add KUnit tests for SM3
crypto: sm3 - Replace with wrapper around library lib/crypto: arm64/sm3: Migrate optimized code into library lib/crypto: riscv/sm3: Migrate optimized code into library lib/crypto: x86/sm3: Migrate optimized code into library
crypto: sm3 - Remove sm3_base.h
crypto: sm3 - Remove the original "sm3_block_generic()"
crypto: sm3 - Remove 'struct sm3_state'

 arch/arm64/configs/defconfig                  |   2 +-
 arch/arm64/crypto/Kconfig                     |  22 --
 arch/arm64/crypto/Makefile                    |   6 -
 arch/arm64/crypto/sm3-ce-glue.c               |  70 ------
 arch/arm64/crypto/sm3-neon-glue.c             |  67 -----
 arch/loongarch/configs/loongson32_defconfig   |   2 +-
 arch/loongarch/configs/loongson64_defconfig   |   2 +-
 arch/m68k/configs/amiga_defconfig             |   2 +-
 arch/m68k/configs/apollo_defconfig            |   2 +-
 arch/m68k/configs/atari_defconfig             |   2 +-
 arch/m68k/configs/bvme6000_defconfig          |   2 +-
 arch/m68k/configs/hp300_defconfig             |   2 +-
 arch/m68k/configs/mac_defconfig               |   2 +-
 arch/m68k/configs/multi_defconfig             |   2 +-
 arch/m68k/configs/mvme147_defconfig           |   2 +-
 arch/m68k/configs/mvme16x_defconfig           |   2 +-
 arch/m68k/configs/q40_defconfig               |   2 +-
 arch/m68k/configs/sun3_defconfig              |   2 +-
 arch/m68k/configs/sun3x_defconfig             |   2 +-
 arch/riscv/crypto/Kconfig                     |  13 -
 arch/riscv/crypto/Makefile                    |   3 -
 arch/s390/configs/debug_defconfig             |   2 +-
 arch/s390/configs/defconfig                   |   2 +-
 arch/x86/crypto/Kconfig                       |  13 -
 arch/x86/crypto/Makefile                      |   3 -
 arch/x86/crypto/sm3_avx_glue.c                | 100 --------
 crypto/Kconfig                                |   2 +-
 crypto/Makefile                               |   2 +-
 crypto/{sm3_generic.c => sm3.c}               |  89 ++++---
 crypto/testmgr.c                              |   2 +
 drivers/crypto/Kconfig                        |   2 +-
 drivers/crypto/starfive/Kconfig               |   2 +-
 drivers/crypto/starfive/jh7110-hash.c         |   8 +-
 include/crypto/sm3.h                          |  85 ++++---
 include/crypto/sm3_base.h                     |  82 -------
 lib/crypto/.kunitconfig                       |   1 +
 lib/crypto/Kconfig                            |  11 +
 lib/crypto/Makefile                           |  15 +-
 .../crypto => lib/crypto/arm64}/sm3-ce-core.S |  11 +-
 .../crypto/arm64}/sm3-neon-core.S             |   9 +-
 lib/crypto/arm64/sm3.h                        |  41 ++++
 .../crypto/riscv}/sm3-riscv64-zvksh-zvkb.S    |   3 +-
 .../crypto/riscv/sm3.h                        |  84 +------
 lib/crypto/sm3.c                              | 148 +++++++++--
 lib/crypto/tests/Kconfig                      |   9 +
 lib/crypto/tests/Makefile                     |   1 +
 lib/crypto/tests/sm3-testvecs.h               | 231 ++++++++++++++++++
 lib/crypto/tests/sm3_kunit.c                  |  31 +++
 .../crypto/x86}/sm3-avx-asm_64.S              |  13 +-
 lib/crypto/x86/sm3.h                          |  39 +++
 scripts/crypto/gen-hash-testvecs.py           |   3 +
 security/integrity/ima/Kconfig                |   2 +-
 52 files changed, 670 insertions(+), 587 deletions(-)
 delete mode 100644 arch/arm64/crypto/sm3-ce-glue.c
 delete mode 100644 arch/arm64/crypto/sm3-neon-glue.c
 delete mode 100644 arch/x86/crypto/sm3_avx_glue.c
 rename crypto/{sm3_generic.c => sm3.c} (30%)
 delete mode 100644 include/crypto/sm3_base.h
 rename {arch/arm64/crypto => lib/crypto/arm64}/sm3-ce-core.S (93%)
 rename {arch/arm64/crypto => lib/crypto/arm64}/sm3-neon-core.S (98%)
 create mode 100644 lib/crypto/arm64/sm3.h
 rename {arch/riscv/crypto => lib/crypto/riscv}/sm3-riscv64-zvksh-zvkb.S (97%)
 rename arch/riscv/crypto/sm3-riscv64-glue.c => lib/crypto/riscv/sm3.h (18%)
 create mode 100644 lib/crypto/tests/sm3-testvecs.h
 create mode 100644 lib/crypto/tests/sm3_kunit.c
 rename {arch/x86/crypto => lib/crypto/x86}/sm3-avx-asm_64.S (98%)
 create mode 100644 lib/crypto/x86/sm3.h

base-commit: 6bc9effb4cbf9b6eba0f51aba1c8893dfd4c8100

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:11 UTC #1 lore raw

PATCH 1/12 crypto: sm3 - Fold sm3_init() into its caller

Fold sm3_init() into its caller to free up the name for use in a library API mirroring the other hash function APIs.

Signed-off-by Eric Biggers <[email protected]>

---
 include/crypto/sm3.h      | 13 -------------
 include/crypto/sm3_base.h | 12 +++++++++++-
 2 files changed, 11 insertions(+), 14 deletions(-)

include/crypto/sm3.h +0 ~~-13~~

index c8d02c86c298..c09f6bf4c0bf 100644
@@ -44,21 +44,8 @@ struct sm3_state {
  * amounts of data as those APIs may be hw-accelerated.
  *
  * For details see lib/crypto/sm3.c
  */
 
-static inline void sm3_init(struct sm3_state *sctx)
-{
-	sctx->state[0] = SM3_IVA;
-	sctx->state[1] = SM3_IVB;
-	sctx->state[2] = SM3_IVC;
-	sctx->state[3] = SM3_IVD;
-	sctx->state[4] = SM3_IVE;
-	sctx->state[5] = SM3_IVF;
-	sctx->state[6] = SM3_IVG;
-	sctx->state[7] = SM3_IVH;
-	sctx->count = 0;
-}
-
 void sm3_block_generic(struct sm3_state *sctx, u8 const *data, int blocks);
 
 #endif

include/crypto/sm3_base.h +11 -1

index 7c53570bc05e..9fa995617495 100644
@@ -19,11 +19,21 @@
 
 typedef void (sm3_block_fn)(struct sm3_state *sst, u8 const *src, int blocks);
 
 static inline int sm3_base_init(struct shash_desc *desc)
 {
-	sm3_init(shash_desc_ctx(desc));
+	struct sm3_state *sctx = shash_desc_ctx(desc);
+
+	sctx->state[0] = SM3_IVA;
+	sctx->state[1] = SM3_IVB;
+	sctx->state[2] = SM3_IVC;
+	sctx->state[3] = SM3_IVD;
+	sctx->state[4] = SM3_IVE;
+	sctx->state[5] = SM3_IVF;
+	sctx->state[6] = SM3_IVG;
+	sctx->state[7] = SM3_IVH;
+	sctx->count = 0;
 	return 0;
 }
 
 static inline int sm3_base_do_update_blocks(struct shash_desc *desc,
 					    const u8 *data, unsigned int len,

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:11 UTC #2 lore raw

PATCH 2/12 crypto: sm3 - Remove sm3_zero_message_hash and SM3_T[1-2]

In reply to Eric Biggers

Remove these, since they are unused.

Signed-off-by Eric Biggers <[email protected]>

---
 crypto/sm3_generic.c | 8 --------
 include/crypto/sm3.h | 5 -----
 2 files changed, 13 deletions(-)

crypto/sm3_generic.c +0 -8

index 7529139fcc96..0c606f526347 100644
@@ -12,18 +12,10 @@
 #include <crypto/sm3.h>
 #include <crypto/sm3_base.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 
-const u8 sm3_zero_message_hash[SM3_DIGEST_SIZE] = {
-	0x1A, 0xB2, 0x1D, 0x83, 0x55, 0xCF, 0xA1, 0x7F,
-	0x8e, 0x61, 0x19, 0x48, 0x31, 0xE8, 0x1A, 0x8F,
-	0x22, 0xBE, 0xC8, 0xC7, 0x28, 0xFE, 0xFB, 0x74,
-	0x7E, 0xD0, 0x35, 0xEB, 0x50, 0x82, 0xAA, 0x2B
-};
-EXPORT_SYMBOL_GPL(sm3_zero_message_hash);
-
 static int crypto_sm3_update(struct shash_desc *desc, const u8 *data,
 			  unsigned int len)
 {
 	return sm3_base_do_update_blocks(desc, data, len, sm3_block_generic);
 }

include/crypto/sm3.h +0 -5

index c09f6bf4c0bf..918d318795ef 100644
@@ -14,24 +14,19 @@
 
 #define SM3_DIGEST_SIZE	32
 #define SM3_BLOCK_SIZE	64
 #define SM3_STATE_SIZE	40
 
-#define SM3_T1		0x79CC4519
-#define SM3_T2		0x7A879D8A
-
 #define SM3_IVA		0x7380166f
 #define SM3_IVB		0x4914b2b9
 #define SM3_IVC		0x172442d7
 #define SM3_IVD		0xda8a0600
 #define SM3_IVE		0xa96f30bc
 #define SM3_IVF		0x163138aa
 #define SM3_IVG		0xe38dee4d
 #define SM3_IVH		0xb0fb0e4e
 
-extern const u8 sm3_zero_message_hash[SM3_DIGEST_SIZE];
-
 struct sm3_state {
 	u32 state[SM3_DIGEST_SIZE / 4];
 	u64 count;
 	u8 buffer[SM3_BLOCK_SIZE];
 };

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:11 UTC #3 lore raw

PATCH 3/12 crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3

In reply to Eric Biggers

The kconfig options for generic crypto API modules have traditionally *not* had a "_GENERIC" suffix. Also, the "_GENERIC" suffix will make even less sense once the architecture-optimized SM3 code is moved into lib/crypto/ and the "sm3" crypto_shash is reimplemented on top of that.

Thus, rename CRYPTO_SM3_GENERIC to CRYPTO_SM3.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/loongarch/configs/loongson32_defconfig | 2 +-
 arch/loongarch/configs/loongson64_defconfig | 2 +-
 arch/m68k/configs/amiga_defconfig           | 2 +-
 arch/m68k/configs/apollo_defconfig          | 2 +-
 arch/m68k/configs/atari_defconfig           | 2 +-
 arch/m68k/configs/bvme6000_defconfig        | 2 +-
 arch/m68k/configs/hp300_defconfig           | 2 +-
 arch/m68k/configs/mac_defconfig             | 2 +-
 arch/m68k/configs/multi_defconfig           | 2 +-
 arch/m68k/configs/mvme147_defconfig         | 2 +-
 arch/m68k/configs/mvme16x_defconfig         | 2 +-
 arch/m68k/configs/q40_defconfig             | 2 +-
 arch/m68k/configs/sun3_defconfig            | 2 +-
 arch/m68k/configs/sun3x_defconfig           | 2 +-
 arch/s390/configs/debug_defconfig           | 2 +-
 arch/s390/configs/defconfig                 | 2 +-
 crypto/Kconfig                              | 2 +-
 crypto/Makefile                             | 2 +-
 drivers/crypto/Kconfig                      | 2 +-
 drivers/crypto/starfive/Kconfig             | 2 +-
 security/integrity/ima/Kconfig              | 2 +-
 21 files changed, 21 insertions(+), 21 deletions(-)

arch/loongarch/configs/loongson32_defconfig +1 -1

index 276b1577e0be..7abbb21f4f8f 100644
@@ -1078,11 +1078,11 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SM4_GENERIC=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/loongarch/configs/loongson64_defconfig +1 -1

index a14db1a95e7e..51ccd18ecdae 100644
@@ -1111,11 +1111,11 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SM4_GENERIC=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/amiga_defconfig +1 -1

index 31d16cba9879..03a8c192a7a3 100644
@@ -579,11 +579,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/apollo_defconfig +1 -1

index c0c419ec9a9e..0aee1939ac7a 100644
@@ -536,11 +536,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/atari_defconfig +1 -1

index 2b7547ecc4c4..756256770afc 100644
@@ -556,11 +556,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/bvme6000_defconfig +1 -1

index 0b63787cff0d..8cfb75bb0add 100644
@@ -528,11 +528,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/hp300_defconfig +1 -1

index 308836b60bba..b2f5c9749e9b 100644
@@ -538,11 +538,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/mac_defconfig +1 -1

index 97e108c0d24f..c4fddaaa6a86 100644
@@ -555,11 +555,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/multi_defconfig +1 -1

index 7e9f83af9af4..926f12bc3d1d 100644
@@ -642,11 +642,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/mvme147_defconfig +1 -1

index 2fe33271d249..e507012dbbc1 100644
@@ -528,11 +528,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/mvme16x_defconfig +1 -1

index 4308daaa7f74..6195cedd914b 100644
@@ -529,11 +529,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/q40_defconfig +1 -1

index 36eb29ec54ee..9087bd9e3c35 100644
@@ -545,11 +545,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/sun3_defconfig +1 -1

index 524a89fa6953..25115bda7c8a 100644
@@ -526,11 +526,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/m68k/configs/sun3x_defconfig +1 -1

index f4fbc65c52d9..15a086634ba5 100644
@@ -526,11 +526,11 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/s390/configs/debug_defconfig +1 -1

index 98fd0a2f51c6..271d683e7959 100644
@@ -795,11 +795,11 @@ CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

arch/s390/configs/defconfig +1 -1

index 0f4cedcab3ce..e9b64c0d4bcc 100644
@@ -779,11 +779,11 @@ CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_SM3_GENERIC=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m

crypto/Kconfig +1 -1

index b8608ef6823b..79234fd42eb4 100644
@@ -979,11 +979,11 @@ config CRYPTO_SHA3
 	select CRYPTO_HASH
 	select CRYPTO_LIB_SHA3
 	help
 	  SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
 
-config CRYPTO_SM3_GENERIC
+config CRYPTO_SM3
 	tristate "SM3 (ShangMi 3)"
 	select CRYPTO_HASH
 	select CRYPTO_LIB_SM3
 	help
 	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)

crypto/Makefile +1 -1

index 04e269117589..28467f900c9a 100644
@@ -81,11 +81,11 @@ obj-$(CONFIG_CRYPTO_MD5) += md5.o
 obj-$(CONFIG_CRYPTO_RMD160) += rmd160.o
 obj-$(CONFIG_CRYPTO_SHA1) += sha1.o
 obj-$(CONFIG_CRYPTO_SHA256) += sha256.o
 obj-$(CONFIG_CRYPTO_SHA512) += sha512.o
 obj-$(CONFIG_CRYPTO_SHA3) += sha3.o
-obj-$(CONFIG_CRYPTO_SM3_GENERIC) += sm3_generic.o
+obj-$(CONFIG_CRYPTO_SM3) += sm3_generic.o
 obj-$(CONFIG_CRYPTO_STREEBOG) += streebog_generic.o
 obj-$(CONFIG_CRYPTO_WP512) += wp512.o
 CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns)  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
 obj-$(CONFIG_CRYPTO_BLAKE2B) += blake2b.o
 obj-$(CONFIG_CRYPTO_ECB) += ecb.o

drivers/crypto/Kconfig +1 -1

index 8d3b5d2890f8..9960100e6066 100644
@@ -841,11 +841,11 @@ config CRYPTO_DEV_CCREE
 	select CRYPTO_CBC
 	select CRYPTO_ECB
 	select CRYPTO_CTR
 	select CRYPTO_XTS
 	select CRYPTO_SM4_GENERIC
-	select CRYPTO_SM3_GENERIC
+	select CRYPTO_SM3
 	help
 	  Say 'Y' to enable a driver for the REE interface of the Arm
 	  TrustZone CryptoCell family of processors. Currently the
 	  CryptoCell 713, 703, 712, 710 and 630 are supported.
 	  Choose this if you wish to use hardware acceleration of

drivers/crypto/starfive/Kconfig +1 -1

index 0fe389e9f932..11518ca3eea1 100644
@@ -8,11 +8,11 @@ config CRYPTO_DEV_JH7110
 	depends on HAS_DMA
 	select CRYPTO_ENGINE
 	select CRYPTO_HMAC
 	select CRYPTO_SHA256
 	select CRYPTO_SHA512
-	select CRYPTO_SM3_GENERIC
+	select CRYPTO_SM3
 	select CRYPTO_RSA
 	select CRYPTO_AES
 	select CRYPTO_CCM
 	select CRYPTO_GCM
 	select CRYPTO_ECB

security/integrity/ima/Kconfig +1 -1

index 976e75f9b9ba..862fbee2b174 100644
@@ -109,11 +109,11 @@ choice
 		bool "WP512"
 		depends on CRYPTO_WP512=y
 
 	config IMA_DEFAULT_HASH_SM3
 		bool "SM3"
-		depends on CRYPTO_SM3_GENERIC=y
+		depends on CRYPTO_SM3=y
 endchoice
 
 config IMA_DEFAULT_HASH
 	string
 	default "sha1" if IMA_DEFAULT_HASH_SHA1

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:11 UTC #4 lore raw

PATCH 4/12 lib/crypto: sm3: Add SM3 library API

In reply to Eric Biggers

Add a straightforward library API for SM3, mirroring the ones for the other hash algorithms. It uses the existing generic implementation of SM3's compression function in lib/crypto/sm3.c. Hooks are added for architecture-optimized implementations, which later commits will wire up to the existing optimized SM3 code for arm64, riscv, and x86.

Note that the rationale for this is *not* that SM3 should be used, or that any kernel subsystem currently seems like a candidate for switching from the sm3 crypto_shash to SM3 library. (SM3, in fact, shouldn't be used. Likewise you shouldn't use MD5, SHA-1, RC4, etc...)

Rather, it's just that this will simplify how the kernel's existing SM3 code is integrated and make it much easier to maintain and test. SM3 is one of the only hash algorithms with arch-optimized code that is still integrated in the old way. By converting it to the new lib/crypto/ code organization, we'll only have to keep track of one way of doing things. The library will also get a KUnit test suite (as usual for lib/crypto/), so it will become more easily and comprehensively tested as well.

Skip adding functions for HMAC-SM3 for now, though. There's not as much point in adding those right now.

Note: similar to the other hash algorithms, the library API uses 'struct sm3_ctx', not 'struct sm3_state'. The existing 'struct sm3_state' and the sm3_block_generic() function which uses it are temporarily kept around until their users are updated by later commits.

Signed-off-by Eric Biggers <[email protected]>

---
 include/crypto/sm3.h |  70 ++++++++++++++++---
 lib/crypto/Kconfig   |   7 ++
 lib/crypto/sm3.c     | 155 +++++++++++++++++++++++++++++++++++++------
 3 files changed, 203 insertions(+), 29 deletions(-)

include/crypto/sm3.h +60 ~~-10~~

index 918d318795ef..702c5326b4be 100644
@@ -1,8 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Common values for SM3 algorithm
+ * SM3 hash algorithm
  *
  * Copyright (C) 2017 ARM Limited or its affiliates.
  * Copyright (C) 2017 Gilad Ben-Yossef <[email protected]>
  * Copyright (C) 2021 Tianjia Zhang <[email protected]>
  */

@@ -29,18 +29,68 @@ struct sm3_state {
 	u32 state[SM3_DIGEST_SIZE / 4];
 	u64 count;
 	u8 buffer[SM3_BLOCK_SIZE];
 };
 
-/*
- * Stand-alone implementation of the SM3 algorithm. It is designed to
- * have as little dependencies as possible so it can be used in the
- * kexec_file purgatory. In other cases you should generally use the
- * hash APIs from include/crypto/hash.h. Especially when hashing large
- * amounts of data as those APIs may be hw-accelerated.
+void sm3_block_generic(struct sm3_state *sctx, u8 const *data, int blocks);
+
+/* State for the SM3 compression function */
+struct sm3_block_state {
+	u32 h[SM3_DIGEST_SIZE / 4];
+};
+
+/**
+ * struct sm3_ctx - Context for hashing a message with SM3
+ * @state: the compression function state
+ * @bytecount: number of bytes processed so far
+ * @buf: partial block buffer; bytecount % SM3_BLOCK_SIZE bytes are valid
+ */
+struct sm3_ctx {
+	struct sm3_block_state state;
+	u64 bytecount;
+	u8 buf[SM3_BLOCK_SIZE] __aligned(__alignof__(__be64));
+};
+
+/**
+ * sm3_init() - Initialize an SM3 context for a new message
+ * @ctx: the context to initialize
  *
- * For details see lib/crypto/sm3.c
+ * If you don't need incremental computation, consider sm3() instead.
+ *
+ * Context: Any context.
  */
+void sm3_init(struct sm3_ctx *ctx);
 
-void sm3_block_generic(struct sm3_state *sctx, u8 const *data, int blocks);
+/**
+ * sm3_update() - Update an SM3 context with message data
+ * @ctx: the context to update; must have been initialized
+ * @data: the message data
+ * @len: the data length in bytes
+ *
+ * This can be called any number of times.
+ *
+ * Context: Any context.
+ */
+void sm3_update(struct sm3_ctx *ctx, const u8 *data, size_t len);
+
+/**
+ * sm3_final() - Finish computing an SM3 message digest
+ * @ctx: the context to finalize; must have been initialized
+ * @out: (output) the resulting SM3 message digest
+ *
+ * After finishing, this zeroizes @ctx.  So the caller does not need to do it.
+ *
+ * Context: Any context.
+ */
+void sm3_final(struct sm3_ctx *ctx, u8 out[at_least SM3_DIGEST_SIZE]);
+
+/**
+ * sm3() - Compute SM3 message digest in one shot
+ * @data: the message data
+ * @len: the data length in bytes
+ * @out: (output) the resulting SM3 message digest
+ *
+ * Context: Any context.
+ */
+void sm3(const u8 *data, size_t len, u8 out[at_least SM3_DIGEST_SIZE]);
 
-#endif
+#endif /* _CRYPTO_SM3_H */

lib/crypto/Kconfig +7 -0

index 4910fe20e42a..c5819e2518f6 100644
@@ -265,9 +265,16 @@ config CRYPTO_LIB_SHA3_ARCH
 	default y if ARM64
 	default y if S390
 
 config CRYPTO_LIB_SM3
 	tristate
+	help
+	  The SM3 library functions.  Select this if your module uses any of the
+	  functions from <crypto/sm3.h>.
+
+config CRYPTO_LIB_SM3_ARCH
+	bool
+	depends on CRYPTO_LIB_SM3 && !UML
 
 source "lib/crypto/tests/Kconfig"
 
 endmenu

lib/crypto/sm3.c +136 ~~-19~~

201 lines not on this page · raw message

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #5 lore raw

PATCH 5/12 lib/crypto: tests: Add KUnit tests for SM3

In reply to Eric Biggers

Add a KUnit test suite for the SM3 library. It closely mirrors the test suites for the other cryptographic hash functions. The actual test and benchmark logic is already in hash-test-template.h; this just wires it up for SM3 in the usual way.

Signed-off-by Eric Biggers <[email protected]>

---
 lib/crypto/.kunitconfig             |   1 +
 lib/crypto/tests/Kconfig            |   9 ++
 lib/crypto/tests/Makefile           |   1 +
 lib/crypto/tests/sm3-testvecs.h     | 231 ++++++++++++++++++++++++++++
 lib/crypto/tests/sm3_kunit.c        |  31 ++++
 scripts/crypto/gen-hash-testvecs.py |   3 +
 6 files changed, 276 insertions(+)
 create mode 100644 lib/crypto/tests/sm3-testvecs.h
 create mode 100644 lib/crypto/tests/sm3_kunit.c

lib/crypto/.kunitconfig +1 -0

index 63a592731d1d..61f880859526 100644
@@ -13,5 +13,6 @@ CONFIG_CRYPTO_LIB_POLY1305_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_POLYVAL_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_SHA1_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_SHA256_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_SHA512_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_SHA3_KUNIT_TEST=y
+CONFIG_CRYPTO_LIB_SM3_KUNIT_TEST=y

lib/crypto/tests/Kconfig +9 -0

index 42e1770e1883..72d445a7eac5 100644
@@ -114,10 +114,18 @@ config CRYPTO_LIB_SHA3_KUNIT_TEST
 	help
 	  KUnit tests for the SHA3 cryptographic hash and XOF functions,
 	  including SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and
 	  SHAKE256.
 
+config CRYPTO_LIB_SM3_KUNIT_TEST
+	tristate "KUnit tests for SM3" if !KUNIT_ALL_TESTS
+	depends on KUNIT && CRYPTO_LIB_SM3
+	default KUNIT_ALL_TESTS
+	select CRYPTO_LIB_BENCHMARK_VISIBLE
+	help
+	  KUnit tests for the SM3 cryptographic hash function.
+
 config CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT
 	tristate "Enable all crypto library code for KUnit tests"
 	depends on KUNIT
 	select CRYPTO_LIB_AES_CBC_MACS
 	select CRYPTO_LIB_BLAKE2B

@@ -129,10 +137,11 @@ config CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT
 	select CRYPTO_LIB_POLYVAL
 	select CRYPTO_LIB_SHA1
 	select CRYPTO_LIB_SHA256
 	select CRYPTO_LIB_SHA512
 	select CRYPTO_LIB_SHA3
+	select CRYPTO_LIB_SM3
 	help
 	  Enable all the crypto library code that has KUnit tests.
 
 	  Enable this only if you'd like to test all the crypto library code,
 	  even code that wouldn't otherwise need to be built.

lib/crypto/tests/Makefile +1 -0

index f864e0ffbee4..88920fbc4324 100644
@@ -11,5 +11,6 @@ obj-$(CONFIG_CRYPTO_LIB_POLY1305_KUNIT_TEST) += poly1305_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_POLYVAL_KUNIT_TEST) += polyval_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_SHA1_KUNIT_TEST) += sha1_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_SHA256_KUNIT_TEST) += sha224_kunit.o sha256_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_SHA512_KUNIT_TEST) += sha384_kunit.o sha512_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_SHA3_KUNIT_TEST) += sha3_kunit.o
+obj-$(CONFIG_CRYPTO_LIB_SM3_KUNIT_TEST) += sm3_kunit.o

lib/crypto/tests/sm3-testvecs.h new file +231 -0

231 lines not on this page · raw message

lib/crypto/tests/sm3_kunit.c new file +31 -0

new file mode 100644
index 000000000000..dc8136acdff6
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright 2026 Google LLC
+ */
+#include <crypto/sm3.h>
+#include "sm3-testvecs.h"
+
+#define HASH sm3
+#define HASH_CTX sm3_ctx
+#define HASH_SIZE SM3_DIGEST_SIZE
+#define HASH_INIT sm3_init
+#define HASH_UPDATE sm3_update
+#define HASH_FINAL sm3_final
+#include "hash-test-template.h"
+
+static struct kunit_case sm3_test_cases[] = {
+	HASH_KUNIT_CASES,
+	KUNIT_CASE(benchmark_hash),
+	{},
+};
+
+static struct kunit_suite sm3_test_suite = {
+	.name = "sm3",
+	.test_cases = sm3_test_cases,
+	.suite_init = hash_suite_init,
+	.suite_exit = hash_suite_exit,
+};
+kunit_test_suite(sm3_test_suite);
+
+MODULE_DESCRIPTION("KUnit tests and benchmark for SM3");
+MODULE_LICENSE("GPL");

scripts/crypto/gen-hash-testvecs.py +3 -0

index 34b7c48f3456..37fdbc52b2c1 100755
@@ -293,8 +293,11 @@ elif alg == 'sha3':
     print('/* SHA3-256 test vectors */')
     gen_unkeyed_testvecs('sha3-256')
     print()
     print('/* SHAKE test vectors */')
     gen_additional_sha3_testvecs()
+elif alg == 'sm3':
+    gen_unkeyed_testvecs(alg)
+    # Kernel doesn't implement HMAC-SM3 library functions yet.
 else:
     gen_unkeyed_testvecs(alg)
     gen_hmac_testvecs(alg)

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #6 lore raw

PATCH 6/12 crypto: sm3 - Replace with wrapper around library

In reply to Eric Biggers

Reimplement the "sm3" crypto_shash on top of the SM3 library, closely mirroring the other hash algorithms (e.g. SHA-*).

The result, after later commits migrate the architecture-optimized SM3 code into the library as well, is that crypto/sm3.c will be the single point of integration between crypto_shash and the actual SM3 implementations, simplifying the code.

Note: to see the diff from crypto/sm3_generic.c to crypto/sm3.c, view this commit with 'git show -M10'.

Signed-off-by Eric Biggers <[email protected]>

---
 crypto/Makefile                       |  2 +-
 crypto/{sm3_generic.c => sm3.c}       | 83 +++++++++++++++++----------
 crypto/testmgr.c                      |  2 +
 drivers/crypto/starfive/jh7110-hash.c |  4 +-
 4 files changed, 59 insertions(+), 32 deletions(-)
 rename crypto/{sm3_generic.c => sm3.c} (30%)

crypto/Makefile +1 -1

index 28467f900c9a..842dbc459e4b 100644
@@ -81,11 +81,11 @@ obj-$(CONFIG_CRYPTO_MD5) += md5.o
 obj-$(CONFIG_CRYPTO_RMD160) += rmd160.o
 obj-$(CONFIG_CRYPTO_SHA1) += sha1.o
 obj-$(CONFIG_CRYPTO_SHA256) += sha256.o
 obj-$(CONFIG_CRYPTO_SHA512) += sha512.o
 obj-$(CONFIG_CRYPTO_SHA3) += sha3.o
-obj-$(CONFIG_CRYPTO_SM3) += sm3_generic.o
+obj-$(CONFIG_CRYPTO_SM3) += sm3.o
 obj-$(CONFIG_CRYPTO_STREEBOG) += streebog_generic.o
 obj-$(CONFIG_CRYPTO_WP512) += wp512.o
 CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns)  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
 obj-$(CONFIG_CRYPTO_BLAKE2B) += blake2b.o
 obj-$(CONFIG_CRYPTO_ECB) += ecb.o

crypto/sm3.c renamed from crypto/sm3_generic.c +54 ~~-29~~

115 lines not on this page · raw message

crypto/testmgr.c +2 -0

index fec950f1628b..8089e9f04218 100644
@@ -5083,10 +5083,11 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(hmac_sha512_tv_template)
 		}
 	}, {
 		.alg = "hmac(sm3)",
+		.generic_driver = "hmac(sm3-lib)",
 		.test = alg_test_hash,
 		.suite = {
 			.hash = __VECS(hmac_sm3_tv_template)
 		}
 	}, {

@@ -5450,10 +5451,11 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(sha512_tv_template)
 		}
 	}, {
 		.alg = "sm3",
+		.generic_driver = "sm3-lib",
 		.test = alg_test_hash,
 		.suite = {
 			.hash = __VECS(sm3_tv_template)
 		}
 	}, {

drivers/crypto/starfive/jh7110-hash.c +2 -2

index 54b7af4a7aee..742038a5201a 100644
@@ -518,11 +518,11 @@ static int starfive_sha512_init_tfm(struct crypto_ahash *hash)
 				      STARFIVE_HASH_SHA512, 0);
 }
 
 static int starfive_sm3_init_tfm(struct crypto_ahash *hash)
 {
-	return starfive_hash_init_tfm(hash, "sm3-generic",
+	return starfive_hash_init_tfm(hash, "sm3-lib",
 				      STARFIVE_HASH_SM3, 0);
 }
 
 static int starfive_hmac_sha224_init_tfm(struct crypto_ahash *hash)
 {

@@ -548,11 +548,11 @@ static int starfive_hmac_sha512_init_tfm(struct crypto_ahash *hash)
 				      STARFIVE_HASH_SHA512, 1);
 }
 
 static int starfive_hmac_sm3_init_tfm(struct crypto_ahash *hash)
 {
-	return starfive_hash_init_tfm(hash, "hmac(sm3-generic)",
+	return starfive_hash_init_tfm(hash, "hmac(sm3-lib)",
 				      STARFIVE_HASH_SM3, 1);
 }
 
 static struct ahash_engine_alg algs_sha2_sm3[] = {
 {

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #7 lore raw

PATCH 7/12 lib/crypto: arm64/sm3: Migrate optimized code into library

In reply to Eric Biggers

Instead of exposing the arm64-optimized SM3 code via arm64-specific crypto_shash algorithms, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be arm64-optimized, and it fixes the longstanding issue where the arm64-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it.

Tweak the SM3 assembly function prototypes to match what the library expects, including changing the block count from 'int' to 'size_t'. sm3_ce_transform() had to be updated to access 'x2' instead of 'w2', while sm3_neon_transform() already used 'x2'.

Remove the CFI stubs which are no longer needed because the SM3 assembly functions are no longer ever indirectly called.

Remove the dependency on KERNEL_MODE_NEON. It was unnecessary, because KERNEL_MODE_NEON is always enabled on arm64.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/arm64/configs/defconfig                  |  2 +-
 arch/arm64/crypto/Kconfig                     | 22 ------
 arch/arm64/crypto/Makefile                    |  6 --
 arch/arm64/crypto/sm3-ce-glue.c               | 70 -------------------
 arch/arm64/crypto/sm3-neon-glue.c             | 67 ------------------
 lib/crypto/Kconfig                            |  1 +
 lib/crypto/Makefile                           | 13 +++-
 .../crypto => lib/crypto/arm64}/sm3-ce-core.S | 11 ++-
 .../crypto/arm64}/sm3-neon-core.S             |  9 ++-
 lib/crypto/arm64/sm3.h                        | 41 +++++++++++
 10 files changed, 62 insertions(+), 180 deletions(-)
 delete mode 100644 arch/arm64/crypto/sm3-ce-glue.c
 delete mode 100644 arch/arm64/crypto/sm3-neon-glue.c
 rename {arch/arm64/crypto => lib/crypto/arm64}/sm3-ce-core.S (93%)
 rename {arch/arm64/crypto => lib/crypto/arm64}/sm3-neon-core.S (98%)
 create mode 100644 lib/crypto/arm64/sm3.h

arch/arm64/configs/defconfig +1 -1

index b67d5b1fc45b..b4458bee767a 100644
@@ -1914,13 +1914,13 @@ CONFIG_CRYPTO_USER=y
 CONFIG_CRYPTO_CHACHA20=m
 CONFIG_CRYPTO_BENCHMARK=m
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_SHA3=m
+CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_SM3_ARM64_CE=m
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_BS=m
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_DEV_SUN8I_CE=m
 CONFIG_CRYPTO_DEV_FSL_CAAM=m

arch/arm64/crypto/Kconfig +0 ~~-22~~

index 82794afaffc9..b595062fd842 100644
@@ -13,32 +13,10 @@ config CRYPTO_GHASH_ARM64_CE
 	  GCM GHASH function (NIST SP800-38D)
 
 	  Architecture: arm64 using:
 	  - ARMv8 Crypto Extensions
 
-config CRYPTO_SM3_NEON
-	tristate "Hash functions: SM3 (NEON)"
-	depends on KERNEL_MODE_NEON
-	select CRYPTO_HASH
-	select CRYPTO_LIB_SM3
-	help
-	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012)
-
-	  Architecture: arm64 using:
-	  - NEON (Advanced SIMD) extensions
-
-config CRYPTO_SM3_ARM64_CE
-	tristate "Hash functions: SM3 (ARMv8.2 Crypto Extensions)"
-	depends on KERNEL_MODE_NEON
-	select CRYPTO_HASH
-	select CRYPTO_LIB_SM3
-	help
-	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012)
-
-	  Architecture: arm64 using:
-	  - ARMv8.2 Crypto Extensions
-
 config CRYPTO_AES_ARM64_CE_BLK
 	tristate "Ciphers: AES, modes: ECB/CBC/CTR/XTS (ARMv8 Crypto Extensions)"
 	depends on KERNEL_MODE_NEON
 	select CRYPTO_SKCIPHER
 	select CRYPTO_LIB_AES

arch/arm64/crypto/Makefile +0 -6

index 8a8e3e551ed3..a169f9033401 100644
@@ -3,16 +3,10 @@
 # linux/arch/arm64/crypto/Makefile
 #
 # Copyright (C) 2014 Linaro Ltd <[email protected]>
 #
 
-obj-$(CONFIG_CRYPTO_SM3_NEON) += sm3-neon.o
-sm3-neon-y := sm3-neon-glue.o sm3-neon-core.o
-
-obj-$(CONFIG_CRYPTO_SM3_ARM64_CE) += sm3-ce.o
-sm3-ce-y := sm3-ce-glue.o sm3-ce-core.o
-
 obj-$(CONFIG_CRYPTO_SM4_ARM64_CE) += sm4-ce-cipher.o
 sm4-ce-cipher-y := sm4-ce-cipher-glue.o sm4-ce-cipher-core.o
 
 obj-$(CONFIG_CRYPTO_SM4_ARM64_CE_BLK) += sm4-ce.o
 sm4-ce-y := sm4-ce-glue.o sm4-ce-core.o

arch/arm64/crypto/sm3-ce-glue.c deleted +0 ~~-70~~

70 lines not on this page · raw message

arch/arm64/crypto/sm3-neon-glue.c deleted +0 ~~-67~~

67 lines not on this page · raw message

lib/crypto/Kconfig +1 -0

index c5819e2518f6..a4e55b6a03af 100644
@@ -272,9 +272,10 @@ config CRYPTO_LIB_SM3
 	  functions from <crypto/sm3.h>.
 
 config CRYPTO_LIB_SM3_ARCH
 	bool
 	depends on CRYPTO_LIB_SM3 && !UML
+	default y if ARM64
 
 source "lib/crypto/tests/Kconfig"
 
 endmenu

lib/crypto/Makefile +10 -3

index a961615c8c7f..48ed6ee5e3c9 100644
@@ -347,15 +347,22 @@ CFLAGS_sha3.o += -I$(src)/$(SRCARCH)
 libsha3-$(CONFIG_ARM64) += arm64/sha3-ce-core.o
 endif # CONFIG_CRYPTO_LIB_SHA3_ARCH
 
 ################################################################################
 
+obj-$(CONFIG_CRYPTO_LIB_SM3) += libsm3.o
+libsm3-y := sm3.o
+ifeq ($(CONFIG_CRYPTO_LIB_SM3_ARCH),y)
+CFLAGS_sm3.o += -I$(src)/$(SRCARCH)
+libsm3-$(CONFIG_ARM64) += arm64/sm3-ce-core.o \
+			  arm64/sm3-neon-core.o
+endif # CONFIG_CRYPTO_LIB_SM3_ARCH
+
+################################################################################
+
 obj-$(CONFIG_MPILIB) += mpi/
 
 obj-$(CONFIG_CRYPTO_SELFTESTS_FULL)		+= simd.o
 
-obj-$(CONFIG_CRYPTO_LIB_SM3)			+= libsm3.o
-libsm3-y					:= sm3.o
-
 # clean-files must be defined unconditionally
 clean-files += arm/sha256-core.S arm/sha512-core.S
 clean-files += arm64/sha256-core.S arm64/sha512-core.S

lib/crypto/arm64/sm3-ce-core.S renamed from arch/arm64/crypto/sm3-ce-core.S +5 -6

similarity index 93%
rename from arch/arm64/crypto/sm3-ce-core.S
rename to lib/crypto/arm64/sm3-ce-core.S
index ca70cfacd0d0..9cef7ea7f34f 100644
@@ -4,11 +4,10 @@
  *
  * Copyright (C) 2018 Linaro Ltd <[email protected]>
  */
 
 #include <linux/linkage.h>
-#include <linux/cfi_types.h>
 #include <asm/assembler.h>
 
 	.irp		b, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
 	.set		.Lv\b\().4s, \b
 	.endr

@@ -68,15 +67,15 @@
 	sm3partw2	\s4\().4s, v7.4s, v6.4s
 	.endif
 	.endm
 
 	/*
-	 * void sm3_ce_transform(struct sm3_state *sst, u8 const *src,
-	 *                       int blocks)
+	 * void sm3_ce_transform(struct sm3_block_state *state,
+	 *			 const u8 *data, size_t nblocks)
 	 */
 	.text
-SYM_TYPED_FUNC_START(sm3_ce_transform)
+SYM_FUNC_START(sm3_ce_transform)
 	/* load state */
 	ld1		{v8.4s-v9.4s}, [x0]
 	rev64		v8.4s, v8.4s
 	rev64		v9.4s, v9.4s
 	ext		v8.16b, v8.16b, v8.16b, #8

@@ -85,11 +84,11 @@ SYM_TYPED_FUNC_START(sm3_ce_transform)
 	adr_l		x8, .Lt
 	ldp		s13, s14, [x8]
 
 	/* load input */
 0:	ld1		{v0.16b-v3.16b}, [x1], #64
-	sub		w2, w2, #1
+	sub		x2, x2, #1
 
 	mov		v15.16b, v8.16b
 	mov		v16.16b, v9.16b
 
 CPU_LE(	rev32		v0.16b, v0.16b		)

@@ -121,11 +120,11 @@ CPU_LE(	rev32		v3.16b, v3.16b		)
 
 	eor		v8.16b, v8.16b, v15.16b
 	eor		v9.16b, v9.16b, v16.16b
 
 	/* handled all input blocks? */
-	cbnz		w2, 0b
+	cbnz		x2, 0b
 
 	/* save state */
 	rev64		v8.4s, v8.4s
 	rev64		v9.4s, v9.4s
 	ext		v8.16b, v8.16b, v8.16b, #8

lib/crypto/arm64/sm3-neon-core.S renamed from arch/arm64/crypto/sm3-neon-core.S +4 -5

similarity index 98%
rename from arch/arm64/crypto/sm3-neon-core.S
rename to lib/crypto/arm64/sm3-neon-core.S
index 4357e0e51be3..ad874af13802 100644
@@ -7,11 +7,10 @@
  * Copyright (C) 2021 Jussi Kivilinna <[email protected]>
  * Copyright (c) 2022 Tianjia Zhang <[email protected]>
  */
 
 #include <linux/linkage.h>
-#include <linux/cfi_types.h>
 #include <asm/assembler.h>
 
 /* Context structure */
 
 #define state_h0 0

@@ -343,18 +342,18 @@
 #define SCHED_W_W5W0W1W2W3W4_3(iop_num, round) \
 	SCHED_W_3_##iop_num(round, W5, W0, W1, W2, W3, W4)
 
 
 	/*
-	 * Transform blocks*64 bytes (blocks*16 32-bit words) at 'src'.
+	 * Transform nblocks*64 bytes (nblocks*16 32-bit words) at 'data'.
 	 *
-	 * void sm3_neon_transform(struct sm3_state *sst, u8 const *src,
-	 *                         int blocks)
+	 * void sm3_neon_transform(struct sm3_block_state *state,
+	 *			   const u8 *data, size_t nblocks)
 	 */
 	.text
 .align 3
-SYM_TYPED_FUNC_START(sm3_neon_transform)
+SYM_FUNC_START(sm3_neon_transform)
 	ldp		ra, rb, [RSTATE, #0]
 	ldp		rc, rd, [RSTATE, #8]
 	ldp		re, rf, [RSTATE, #16]
 	ldp		rg, rh, [RSTATE, #24]

lib/crypto/arm64/sm3.h new file +41 -0

41 lines not on this page · raw message

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #8 lore raw

PATCH 8/12 lib/crypto: riscv/sm3: Migrate optimized code into library

In reply to Eric Biggers

Instead of exposing the riscv-optimized SM3 code via a riscv-specific crypto_shash algorithm, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be riscv-optimized, and it fixes the longstanding issue where the riscv-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it.

Tweak the prototype of sm3_transform_zvksh_zvkb() to match what the library expects, including changing the block count to size_t. Note that the assembly code already treated it as size_t.

Note: to see the diff from arch/riscv/crypto/sm3-riscv64-glue.c to lib/crypto/riscv/sm3.h, view this commit with 'git show -M10'.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/riscv/crypto/Kconfig                     | 13 ---
 arch/riscv/crypto/Makefile                    |  3 -
 lib/crypto/Kconfig                            |  2 +
 lib/crypto/Makefile                           |  1 +
 .../crypto/riscv}/sm3-riscv64-zvksh-zvkb.S    |  3 +-
 .../crypto/riscv/sm3.h                        | 84 +++----------------
 6 files changed, 18 insertions(+), 88 deletions(-)
 rename {arch/riscv/crypto => lib/crypto/riscv}/sm3-riscv64-zvksh-zvkb.S (97%)
 rename arch/riscv/crypto/sm3-riscv64-glue.c => lib/crypto/riscv/sm3.h (18%)

arch/riscv/crypto/Kconfig +0 ~~-13~~

index 22d4eaab15f3..eefba937b015 100644
@@ -26,23 +26,10 @@ config CRYPTO_GHASH_RISCV64
 	  GCM GHASH function (NIST SP 800-38D)
 
 	  Architecture: riscv64 using:
 	  - Zvkg vector crypto extension
 
-config CRYPTO_SM3_RISCV64
-	tristate "Hash functions: SM3 (ShangMi 3)"
-	depends on 64BIT && TOOLCHAIN_HAS_VECTOR_CRYPTO && \
-		   RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
-	select CRYPTO_HASH
-	select CRYPTO_LIB_SM3
-	help
-	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012)
-
-	  Architecture: riscv64 using:
-	  - Zvksh vector crypto extension
-	  - Zvkb vector crypto extension
-
 config CRYPTO_SM4_RISCV64
 	tristate "Ciphers: SM4 (ShangMi 4)"
 	depends on 64BIT && TOOLCHAIN_HAS_VECTOR_CRYPTO && \
 		   RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
 	select CRYPTO_ALGAPI

arch/riscv/crypto/Makefile +0 -3

index 183495a95cc0..ca9a6c33ad53 100644
@@ -5,10 +5,7 @@ aes-riscv64-y := aes-riscv64-glue.o aes-riscv64-zvkned.o \
 		 aes-riscv64-zvkned-zvbb-zvkg.o aes-riscv64-zvkned-zvkb.o
 
 obj-$(CONFIG_CRYPTO_GHASH_RISCV64) += ghash-riscv64.o
 ghash-riscv64-y := ghash-riscv64-glue.o ghash-riscv64-zvkg.o
 
-obj-$(CONFIG_CRYPTO_SM3_RISCV64) += sm3-riscv64.o
-sm3-riscv64-y := sm3-riscv64-glue.o sm3-riscv64-zvksh-zvkb.o
-
 obj-$(CONFIG_CRYPTO_SM4_RISCV64) += sm4-riscv64.o
 sm4-riscv64-y := sm4-riscv64-glue.o sm4-riscv64-zvksed-zvkb.o

lib/crypto/Kconfig +2 -0

index a4e55b6a03af..b714f9cbd368 100644
@@ -273,9 +273,11 @@ config CRYPTO_LIB_SM3
 
 config CRYPTO_LIB_SM3_ARCH
 	bool
 	depends on CRYPTO_LIB_SM3 && !UML
 	default y if ARM64
+	default y if RISCV && 64BIT && TOOLCHAIN_HAS_VECTOR_CRYPTO && \
+		     RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
 
 source "lib/crypto/tests/Kconfig"
 
 endmenu

lib/crypto/Makefile +1 -0

index 48ed6ee5e3c9..3019e6cbb10d 100644
@@ -353,10 +353,11 @@ obj-$(CONFIG_CRYPTO_LIB_SM3) += libsm3.o
 libsm3-y := sm3.o
 ifeq ($(CONFIG_CRYPTO_LIB_SM3_ARCH),y)
 CFLAGS_sm3.o += -I$(src)/$(SRCARCH)
 libsm3-$(CONFIG_ARM64) += arm64/sm3-ce-core.o \
 			  arm64/sm3-neon-core.o
+libsm3-$(CONFIG_RISCV) += riscv/sm3-riscv64-zvksh-zvkb.o
 endif # CONFIG_CRYPTO_LIB_SM3_ARCH
 
 ################################################################################
 
 obj-$(CONFIG_MPILIB) += mpi/

lib/crypto/riscv/sm3-riscv64-zvksh-zvkb.S renamed from arch/riscv/crypto/sm3-riscv64-zvksh-zvkb.S +2 -1

similarity index 97%
rename from arch/riscv/crypto/sm3-riscv64-zvksh-zvkb.S
rename to lib/crypto/riscv/sm3-riscv64-zvksh-zvkb.S
index 4fe754846f65..a1d4468b0485 100644
@@ -78,11 +78,12 @@
 	vsm3me.vv	\w0, \w1, \w0
 .endif
 	// For the next 8 rounds, w0 and w1 are swapped.
 .endm
 
-// void sm3_transform_zvksh_zvkb(u32 state[8], const u8 *data, int num_blocks);
+// void sm3_transform_zvksh_zvkb(struct sm3_block_state *state,
+//				 const u8 *data, size_t nblocks);
 SYM_FUNC_START(sm3_transform_zvksh_zvkb)
 
 	// Load the state and endian-swap each 32-bit word.
 	vsetivli	zero, 8, e32, m2, ta, ma
 	vle32.v		STATE, (STATEP)

lib/crypto/riscv/sm3.h renamed from arch/riscv/crypto/sm3-riscv64-glue.c +13 ~~-71~~

108 lines not on this page · raw message

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #9 lore raw

PATCH 9/12 lib/crypto: x86/sm3: Migrate optimized code into library

In reply to Eric Biggers

Instead of exposing the x86-optimized SM3 code via an x86-specific crypto_shash algorithm, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be x86-optimized, and it fixes the longstanding issue where the x86-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it.

Tweak the prototype of sm3_transform_avx() to match what the library expects, including changing the block count to size_t. Note that the assembly code actually already treated this argument as size_t.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/x86/crypto/Kconfig                       |  13 ---
 arch/x86/crypto/Makefile                      |   3 -
 arch/x86/crypto/sm3_avx_glue.c                | 100 ------------------
 lib/crypto/Kconfig                            |   1 +
 lib/crypto/Makefile                           |   1 +
 .../crypto/x86}/sm3-avx-asm_64.S              |  13 ++-
 lib/crypto/x86/sm3.h                          |  39 +++++++
 7 files changed, 47 insertions(+), 123 deletions(-)
 delete mode 100644 arch/x86/crypto/sm3_avx_glue.c
 rename {arch/x86/crypto => lib/crypto/x86}/sm3-avx-asm_64.S (98%)
 create mode 100644 lib/crypto/x86/sm3.h

arch/x86/crypto/Kconfig +0 ~~-13~~

index 7fb2319a0916..617494bd019f 100644
@@ -329,23 +329,10 @@ config CRYPTO_AEGIS128_AESNI_SSE2
 
 	  Architecture: x86_64 using:
 	  - AES-NI (AES New Instructions)
 	  - SSE4.1 (Streaming SIMD Extensions 4.1)
 
-config CRYPTO_SM3_AVX_X86_64
-	tristate "Hash functions: SM3 (AVX)"
-	depends on 64BIT
-	select CRYPTO_HASH
-	select CRYPTO_LIB_SM3
-	help
-	  SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3
-
-	  Architecture: x86_64 using:
-	  - AVX (Advanced Vector Extensions)
-
-	  If unsure, say N.
-
 config CRYPTO_GHASH_CLMUL_NI_INTEL
 	tristate "Hash functions: GHASH (CLMUL-NI)"
 	depends on 64BIT
 	select CRYPTO_CRYPTD
 	help

arch/x86/crypto/Makefile +0 -3

index b21ad0978c52..9420b9ff51da 100644
@@ -51,13 +51,10 @@ aesni-intel-$(CONFIG_64BIT) += aes-ctr-avx-x86_64.o \
 			       aes-xts-avx-x86_64.o
 
 obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL) += ghash-clmulni-intel.o
 ghash-clmulni-intel-y := ghash-clmulni-intel_asm.o ghash-clmulni-intel_glue.o
 
-obj-$(CONFIG_CRYPTO_SM3_AVX_X86_64) += sm3-avx-x86_64.o
-sm3-avx-x86_64-y := sm3-avx-asm_64.o sm3_avx_glue.o
-
 obj-$(CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64) += sm4-aesni-avx-x86_64.o
 sm4-aesni-avx-x86_64-y := sm4-aesni-avx-asm_64.o sm4_aesni_avx_glue.o
 
 obj-$(CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64) += sm4-aesni-avx2-x86_64.o
 sm4-aesni-avx2-x86_64-y := sm4-aesni-avx2-asm_64.o sm4_aesni_avx2_glue.o

arch/x86/crypto/sm3_avx_glue.c deleted +0 ~~-100~~

100 lines not on this page · raw message

lib/crypto/Kconfig +1 -0

index b714f9cbd368..2824bfb0e30d 100644
@@ -275,9 +275,10 @@ config CRYPTO_LIB_SM3_ARCH
 	bool
 	depends on CRYPTO_LIB_SM3 && !UML
 	default y if ARM64
 	default y if RISCV && 64BIT && TOOLCHAIN_HAS_VECTOR_CRYPTO && \
 		     RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
+	default y if X86_64
 
 source "lib/crypto/tests/Kconfig"
 
 endmenu

lib/crypto/Makefile +1 -0

index 3019e6cbb10d..308ec3e93b54 100644
@@ -354,10 +354,11 @@ libsm3-y := sm3.o
 ifeq ($(CONFIG_CRYPTO_LIB_SM3_ARCH),y)
 CFLAGS_sm3.o += -I$(src)/$(SRCARCH)
 libsm3-$(CONFIG_ARM64) += arm64/sm3-ce-core.o \
 			  arm64/sm3-neon-core.o
 libsm3-$(CONFIG_RISCV) += riscv/sm3-riscv64-zvksh-zvkb.o
+libsm3-$(CONFIG_X86) += x86/sm3-avx-asm_64.o
 endif # CONFIG_CRYPTO_LIB_SM3_ARCH
 
 ################################################################################
 
 obj-$(CONFIG_MPILIB) += mpi/

lib/crypto/x86/sm3-avx-asm_64.S renamed from arch/x86/crypto/sm3-avx-asm_64.S +6 -7

similarity index 98%
rename from arch/x86/crypto/sm3-avx-asm_64.S
rename to lib/crypto/x86/sm3-avx-asm_64.S
index 503bab450a91..a1925b136010 100644
@@ -10,14 +10,13 @@
 /* Based on SM3 AES/BMI2 accelerated work by libgcrypt at:
  *  https://gnupg.org/software/libgcrypt/index.html
  */
 
 #include <linux/linkage.h>
-#include <linux/cfi_types.h>
 #include <asm/frame.h>
 
-/* Context structure */
+/* State structure */
 
 #define state_h0 0
 #define state_h1 4
 #define state_h2 8
 #define state_h3 12

@@ -323,17 +322,17 @@
 .text
 
 /*
  * Transform nblocks*64 bytes (nblocks*16 32-bit words) at DATA.
  *
- * void sm3_transform_avx(struct sm3_state *state,
- *                        const u8 *data, int nblocks);
+ * void sm3_transform_avx(struct sm3_block_state *state,
+ *                        const u8 *data, size_t nblocks);
  */
-SYM_TYPED_FUNC_START(sm3_transform_avx)
+SYM_FUNC_START(sm3_transform_avx)
 	/* input:
-	 *	%rdi: ctx, CTX
-	 *	%rsi: data (64*nblks bytes)
+	 *	%rdi: state
+	 *	%rsi: data
 	 *	%rdx: nblocks
 	 */
 	vzeroupper;
 
 	pushq %rbp;

lib/crypto/x86/sm3.h new file +39 -0

new file mode 100644
index 000000000000..3834780f2f6a
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * SM3 optimized for x86_64
+ *
+ * Copyright 2026 Google LLC
+ */
+#include <asm/fpu/api.h>
+#include <linux/static_call.h>
+
+asmlinkage void sm3_transform_avx(struct sm3_block_state *state,
+				  const u8 *data, size_t nblocks);
+
+static void sm3_blocks_avx(struct sm3_block_state *state,
+			   const u8 *data, size_t nblocks)
+{
+	if (likely(irq_fpu_usable())) {
+		kernel_fpu_begin();
+		sm3_transform_avx(state, data, nblocks);
+		kernel_fpu_end();
+	} else {
+		sm3_blocks_generic(state, data, nblocks);
+	}
+}
+
+DEFINE_STATIC_CALL(sm3_blocks_x86, sm3_blocks_generic);
+
+static void sm3_blocks(struct sm3_block_state *state,
+		       const u8 *data, size_t nblocks)
+{
+	static_call(sm3_blocks_x86)(state, data, nblocks);
+}
+
+#define sm3_mod_init_arch sm3_mod_init_arch
+static void sm3_mod_init_arch(void)
+{
+	if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_BMI2) &&
+	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
+		static_call_update(sm3_blocks_x86, sm3_blocks_avx);
+}

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #10 lore raw

PATCH 10/12 crypto: sm3 - Remove sm3_base.h

In reply to Eric Biggers

Remove include/crypto/sm3_base.h, since it's no longer used. The corresponding logic was reimplemented in a central place in lib/crypto/.

Signed-off-by Eric Biggers <[email protected]>

---
 include/crypto/sm3_base.h | 92 ---------------------------------------
 1 file changed, 92 deletions(-)
 delete mode 100644 include/crypto/sm3_base.h

include/crypto/sm3_base.h deleted +0 ~~-92~~

deleted file mode 100644
index 9fa995617495..000000000000
@@ -1,92 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * sm3_base.h - core logic for SM3 implementations
- *
- * Copyright (C) 2017 ARM Limited or its affiliates.
- * Written by Gilad Ben-Yossef <[email protected]>
- */
-
-#ifndef _CRYPTO_SM3_BASE_H
-#define _CRYPTO_SM3_BASE_H
-
-#include <crypto/internal/hash.h>
-#include <crypto/sm3.h>
-#include <linux/math.h>
-#include <linux/module.h>
-#include <linux/string.h>
-#include <linux/types.h>
-#include <linux/unaligned.h>
-
-typedef void (sm3_block_fn)(struct sm3_state *sst, u8 const *src, int blocks);
-
-static inline int sm3_base_init(struct shash_desc *desc)
-{
-	struct sm3_state *sctx = shash_desc_ctx(desc);
-
-	sctx->state[0] = SM3_IVA;
-	sctx->state[1] = SM3_IVB;
-	sctx->state[2] = SM3_IVC;
-	sctx->state[3] = SM3_IVD;
-	sctx->state[4] = SM3_IVE;
-	sctx->state[5] = SM3_IVF;
-	sctx->state[6] = SM3_IVG;
-	sctx->state[7] = SM3_IVH;
-	sctx->count = 0;
-	return 0;
-}
-
-static inline int sm3_base_do_update_blocks(struct shash_desc *desc,
-					    const u8 *data, unsigned int len,
-					    sm3_block_fn *block_fn)
-{
-	unsigned int remain = len - round_down(len, SM3_BLOCK_SIZE);
-	struct sm3_state *sctx = shash_desc_ctx(desc);
-
-	sctx->count += len - remain;
-	block_fn(sctx, data, len / SM3_BLOCK_SIZE);
-	return remain;
-}
-
-static inline int sm3_base_do_finup(struct shash_desc *desc,
-				    const u8 *src, unsigned int len,
-				    sm3_block_fn *block_fn)
-{
-	unsigned int bit_offset = SM3_BLOCK_SIZE / 8 - 1;
-	struct sm3_state *sctx = shash_desc_ctx(desc);
-	union {
-		__be64 b64[SM3_BLOCK_SIZE / 4];
-		u8 u8[SM3_BLOCK_SIZE * 2];
-	} block = {};
-
-	if (len >= SM3_BLOCK_SIZE) {
-		int remain;
-
-		remain = sm3_base_do_update_blocks(desc, src, len, block_fn);
-		src += len - remain;
-		len = remain;
-	}
-
-	if (len >= bit_offset * 8)
-		bit_offset += SM3_BLOCK_SIZE / 8;
-	memcpy(&block, src, len);
-	block.u8[len] = 0x80;
-	sctx->count += len;
-	block.b64[bit_offset] = cpu_to_be64(sctx->count << 3);
-	block_fn(sctx, block.u8, (bit_offset + 1) * 8 / SM3_BLOCK_SIZE);
-	memzero_explicit(&block, sizeof(block));
-
-	return 0;
-}
-
-static inline int sm3_base_finish(struct shash_desc *desc, u8 *out)
-{
-	struct sm3_state *sctx = shash_desc_ctx(desc);
-	__be32 *digest = (__be32 *)out;
-	int i;
-
-	for (i = 0; i < SM3_DIGEST_SIZE / sizeof(__be32); i++)
-		put_unaligned_be32(sctx->state[i], digest++);
-	return 0;
-}
-
-#endif /* _CRYPTO_SM3_BASE_H */

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #11 lore raw

PATCH 11/12 crypto: sm3 - Remove the original "sm3_block_generic()"

In reply to Eric Biggers

Since the architecture-optimized SM3 code was migrated into lib/crypto/, sm3_block_generic() is no longer called. Remove it. Then, since this frees up the name, rename sm3_transform() to sm3_block_generic() (matching the naming convention used in other hash algorithms).

Signed-off-by Eric Biggers <[email protected]>

---
 include/crypto/sm3.h |  2 --
 lib/crypto/sm3.c     | 19 +++----------------
 2 files changed, 3 insertions(+), 18 deletions(-)

include/crypto/sm3.h +0 -2

index 702c5326b4be..34d7eb32b7db 100644
@@ -29,12 +29,10 @@ struct sm3_state {
 	u32 state[SM3_DIGEST_SIZE / 4];
 	u64 count;
 	u8 buffer[SM3_BLOCK_SIZE];
 };
 
-void sm3_block_generic(struct sm3_state *sctx, u8 const *data, int blocks);
-
 /* State for the SM3 compression function */
 struct sm3_block_state {
 	u32 h[SM3_DIGEST_SIZE / 4];
 };

lib/crypto/sm3.c +3 ~~-16~~

index 20500cf4b8c0..b02b8a247adf 100644
@@ -77,12 +77,12 @@ static const u32 ____cacheline_aligned K[64] = {
 			^ W[(i-9) & 0x0f]		\
 			^ rol32(W[(i-3) & 0x0f], 15))	\
 		^ rol32(W[(i-13) & 0x0f], 7)		\
 		^ W[(i-6) & 0x0f])
 
-static void sm3_transform(struct sm3_block_state *state,
-			  const u8 data[SM3_BLOCK_SIZE], u32 W[16])
+static void sm3_block_generic(struct sm3_block_state *state,
+			      const u8 data[SM3_BLOCK_SIZE], u32 W[16])
 {
 	u32 a, b, c, d, e, f, g, h, ss1, ss2;
 
 	a = state->h[0];
 	b = state->h[1];

@@ -175,30 +175,17 @@ static void sm3_transform(struct sm3_block_state *state,
 #undef R2
 #undef I
 #undef W1
 #undef W2
 
-void sm3_block_generic(struct sm3_state *sctx, u8 const *data, int blocks)
-{
-	u32 W[16];
-
-	do {
-		sm3_transform((struct sm3_block_state *)sctx->state, data, W);
-		data += SM3_BLOCK_SIZE;
-	} while (--blocks);
-
-	memzero_explicit(W, sizeof(W));
-}
-EXPORT_SYMBOL_GPL(sm3_block_generic);
-
 static void __maybe_unused sm3_blocks_generic(struct sm3_block_state *state,
 					      const u8 *data, size_t nblocks)
 {
 	u32 W[16];
 
 	do {
-		sm3_transform(state, data, W);
+		sm3_block_generic(state, data, W);
 		data += SM3_BLOCK_SIZE;
 	} while (--nblocks);
 
 	memzero_explicit(W, sizeof(W));
 }

Signature · 1 line

2.53.0

Eric Biggers

author maintainer

2026-03-21 04:12 UTC #12 lore raw

PATCH 12/12 crypto: sm3 - Remove 'struct sm3_state'

In reply to Eric Biggers

Update one driver that used sizeof(struct sm3_state) to use sizeof(struct sm3_ctx) instead. Then, remove struct sm3_state and SM3_STATE_SIZE.

This completes the replacement of struct sm3_state with struct sm3_ctx.

Signed-off-by Eric Biggers <[email protected]>

---
 drivers/crypto/starfive/jh7110-hash.c | 4 ++--
 include/crypto/sm3.h                  | 7 -------
 2 files changed, 2 insertions(+), 9 deletions(-)

drivers/crypto/starfive/jh7110-hash.c +2 -2

index 742038a5201a..008a47baa165 100644
@@ -793,11 +793,11 @@ static struct ahash_engine_alg algs_sha2_sm3[] = {
 	.base.import   = starfive_hash_import,
 	.base.init_tfm = starfive_sm3_init_tfm,
 	.base.exit_tfm = starfive_hash_exit_tfm,
 	.base.halg = {
 		.digestsize = SM3_DIGEST_SIZE,
-		.statesize  = sizeof(struct sm3_state),
+		.statesize  = sizeof(struct sm3_ctx),
 		.base = {
 			.cra_name		= "sm3",
 			.cra_driver_name	= "sm3-starfive",
 			.cra_priority		= 200,
 			.cra_flags		= CRYPTO_ALG_ASYNC |

@@ -822,11 +822,11 @@ static struct ahash_engine_alg algs_sha2_sm3[] = {
 	.base.init_tfm = starfive_hmac_sm3_init_tfm,
 	.base.exit_tfm = starfive_hash_exit_tfm,
 	.base.setkey	  = starfive_hash_setkey,
 	.base.halg = {
 		.digestsize = SM3_DIGEST_SIZE,
-		.statesize  = sizeof(struct sm3_state),
+		.statesize  = sizeof(struct sm3_ctx),
 		.base = {
 			.cra_name		= "hmac(sm3)",
 			.cra_driver_name	= "sm3-hmac-starfive",
 			.cra_priority		= 200,
 			.cra_flags		= CRYPTO_ALG_ASYNC |

include/crypto/sm3.h +0 -7

index 34d7eb32b7db..371e8a661705 100644
@@ -12,27 +12,20 @@
 
 #include <linux/types.h>
 
 #define SM3_DIGEST_SIZE	32
 #define SM3_BLOCK_SIZE	64
-#define SM3_STATE_SIZE	40
 
 #define SM3_IVA		0x7380166f
 #define SM3_IVB		0x4914b2b9
 #define SM3_IVC		0x172442d7
 #define SM3_IVD		0xda8a0600
 #define SM3_IVE		0xa96f30bc
 #define SM3_IVF		0x163138aa
 #define SM3_IVG		0xe38dee4d
 #define SM3_IVH		0xb0fb0e4e
 
-struct sm3_state {
-	u32 state[SM3_DIGEST_SIZE / 4];
-	u64 count;
-	u8 buffer[SM3_BLOCK_SIZE];
-};
-
 /* State for the SM3 compression function */
 struct sm3_block_state {
 	u32 h[SM3_DIGEST_SIZE / 4];
 };

Signature · 1 line

2.53.0

Ard Biesheuvel

maintainer Acked-by on the v1 series

2026-03-23 14:13 UTC #13 lore raw

In reply to Eric Biggers

Quoted 31 lines · Eric Biggers

This series is targeting libcrypto-next. It can also be retrieved from:
git fetch
https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git
sm3-lib-v1
This series cleans up the kernel's existing SM3 hashing code:
- First, it updates lib/crypto/sm3.c to implement the full SM3 instead of just SM3's compression function.
- Next, it adds a KUnit test suite for the new library API.
- Next, it replaces the "sm3-generic" crypto_shash with a wrapper around the new library API.
- Finally, it accelerates the API using the existing SM3 assembly code for arm64, riscv, and x86. The architecture-specific crypto_shash glue code for SM3 is no longer needed and is removed.
This should look quite boring. It's the same cleanup that I've already done for the other hash functions.
Note: I don't recommend using SM3. There also don't appear to be any immediate candidate users of the SM3 library other than crypto_shash.
Still, this seems like the clear way to go. It's simpler, and it gets the hash algorithms integrated in a consistent way. We won't have to keep track of two quite different ways of doing things. With KUnit the code becomes much easier to test and benchmark, as well.

Quoted 14 lines

Eric Biggers (12):
crypto: sm3 - Fold sm3_init() into its caller
crypto: sm3 - Remove sm3_zero_message_hash and SM3_T[1-2]
crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3 lib/crypto: sm3: Add SM3 library API
lib/crypto: tests: Add KUnit tests for SM3
crypto: sm3 - Replace with wrapper around library lib/crypto: arm64/sm3: Migrate optimized code into library lib/crypto: riscv/sm3: Migrate optimized code into library lib/crypto: x86/sm3: Migrate optimized code into library
crypto: sm3 - Remove sm3_base.h
crypto: sm3 - Remove the original "sm3_block_generic()"
crypto: sm3 - Remove 'struct sm3_state'

Acked-by Ard Biesheuvel <[email protected]>

Eric Biggers

author maintainer Applied

2026-03-24 23:27 UTC #14 lore raw

In reply to Eric Biggers

Quoted 21 lines · Eric Biggers

This series is targeting libcrypto-next. It can also be retrieved from:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git sm3-lib-v1
This series cleans up the kernel's existing SM3 hashing code:
- First, it updates lib/crypto/sm3.c to implement the full SM3 instead of just SM3's compression function.
- Next, it adds a KUnit test suite for the new library API.
- Next, it replaces the "sm3-generic" crypto_shash with a wrapper around the new library API.
- Finally, it accelerates the API using the existing SM3 assembly code for arm64, riscv, and x86. The architecture-specific crypto_shash glue code for SM3 is no longer needed and is removed.
This should look quite boring. It's the same cleanup that I've already done for the other hash functions.

Quoted 7 lines

Note: I don't recommend using SM3. There also don't appear to be any immediate candidate users of the SM3 library other than crypto_shash.
Still, this seems like the clear way to go. It's simpler, and it gets the hash algorithms integrated in a consistent way. We won't have to keep track of two quite different ways of doing things. With KUnit the code becomes much easier to test and benchmark, as well.

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric