From nobody Wed Oct 1 23:34:19 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9E2A302176 for ; Fri, 26 Sep 2025 14:20:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758896441; cv=none; b=UENvSF29raAgrxUcLWzv7JpAXqQBLPZBiPRl1pVohm5kh7zNmBzo7mmKHAbpM/VhWYnJZYpzZj/UrTXFC3ZNSlsHMUymKIRtlzAWgRyjNH/WWxerRWcZALXwQdBwanQIp6SBJ+PuUG/Gb9eRdKGibmngHHvI2/X7Ayr45nd+YnA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758896441; c=relaxed/simple; bh=gEmtJX2boAjTH7pg8qkCqbmv3qDYkIFzPpRG4+BI1pQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=exQrhn594/WdfRCD6BcG5HtCmwr8RXVJWqhASUmdZMJmo+rKaqoDk5TR7OhpEe5K1ifb8874qN+wx0Al4c21/yaCZf+e/E4j1eHRiZqTZu96b6HouLQwKElOoIYRhkCTESPo8RVuKfE6FCeqAUOoqJGc4O/lVYjd+uCXbDlw7hE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=hIO4rQEy; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="hIO4rQEy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1758896437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=niM2zll9qN3FE5+Kw/1evuO7pOFd4rYAY/Rez06/6Qk=; b=hIO4rQEymtimLsDjFQKxNcvIjn4h11ddMZRxancYqFgexQRMGYI29YqkdfewOJN54qvEOl d+gb+VkvSRvhVucWSHGxM47Toi6amK5V9D7CGTQwapVZejlJvVjYRr5t1KotCoSVvwyQIg khjaAS+wf4J1W6B6+UUJsUYWyOBkGmE= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-639-KJlWO5JEMZSaBvAxBZjHyg-1; Fri, 26 Sep 2025 10:20:34 -0400 X-MC-Unique: KJlWO5JEMZSaBvAxBZjHyg-1 X-Mimecast-MFC-AGG-ID: KJlWO5JEMZSaBvAxBZjHyg_1758896433 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1BFEE1800295; Fri, 26 Sep 2025 14:20:33 +0000 (UTC) Received: from warthog.procyon.org.com (unknown [10.42.28.155]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 843B919560A2; Fri, 26 Sep 2025 14:20:30 +0000 (UTC) From: David Howells To: Cc: David Howells , Eric Biggers , "Jason A . Donenfeld" , Ard Biesheuvel , Herbert Xu , Stephan Mueller , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 6/8] crypto/sha3: Use lib/crypto/sha3 Date: Fri, 26 Sep 2025 15:19:49 +0100 Message-ID: <20250926141959.1272455-7-dhowells@redhat.com> In-Reply-To: <20250926141959.1272455-1-dhowells@redhat.com> References: <20250926141959.1272455-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Switch crypto/sha3_generic.c to use lib/crypto/sha3. Note that this makes use of the internal general API rather implementing a separate set of init/update/finup handlers for each algorithm. Signed-off-by: David Howells cc: Eric Biggers cc: Jason A. Donenfeld cc: Ard Biesheuvel cc: Herbert Xu cc: Stephan Mueller cc: linux-crypto@vger.kernel.org --- Documentation/crypto/sha3.rst | 8 +- arch/arm64/crypto/sha3-ce-glue.c | 25 ++-- crypto/sha3_generic.c | 201 +++---------------------------- include/crypto/sha3.h | 6 +- lib/crypto/sha3.c | 35 +++--- 5 files changed, 52 insertions(+), 223 deletions(-) diff --git a/Documentation/crypto/sha3.rst b/Documentation/crypto/sha3.rst index ae4902895882..82c9abe45614 100644 --- a/Documentation/crypto/sha3.rst +++ b/Documentation/crypto/sha3.rst @@ -157,7 +157,7 @@ further algorithms or APIs as the engine in the same in= all cases. The algorithm APIs all wrap the common context structure:: =20 struct sha3_ctx { - struct sha3_state state; + u64 st[SHA3_STATE_SIZE / 8]; u8 block_size; u8 padding; u8 absorb_offset; @@ -165,13 +165,9 @@ algorithm APIs all wrap the common context structure:: bool end_marked; }; =20 - struct sha3_state { - u64 st[SHA3_STATE_SIZE / 8]; - }; - The fields are as follows: =20 - * ``state.st`` + * ``st`` =20 An array of 25 64-bit state buckets that are used to hold the mathemati= cal state of the Keccak engine. Data is XOR'd onto part of this, the engin= e is diff --git a/arch/arm64/crypto/sha3-ce-glue.c b/arch/arm64/crypto/sha3-ce-g= lue.c index 426d8044535a..f6cdff4cd103 100644 --- a/arch/arm64/crypto/sha3-ce-glue.c +++ b/arch/arm64/crypto/sha3-ce-glue.c @@ -28,13 +28,18 @@ MODULE_ALIAS_CRYPTO("sha3-256"); MODULE_ALIAS_CRYPTO("sha3-384"); MODULE_ALIAS_CRYPTO("sha3-512"); =20 +static struct sha3_ctx *crypto_sha3_desc(struct shash_desc *desc) +{ + return shash_desc_ctx(desc); +} + asmlinkage int sha3_ce_transform(u64 *st, const u8 *data, int blocks, int md_len); =20 static int arm64_sha3_update(struct shash_desc *desc, const u8 *data, unsigned int len) { - struct sha3_state *sctx =3D shash_desc_ctx(desc); + struct sha3_ctx *ctx =3D crypto_sha3_desc(desc); struct crypto_shash *tfm =3D desc->tfm; unsigned int bs, ds; int blocks; @@ -47,7 +52,7 @@ static int arm64_sha3_update(struct shash_desc *desc, con= st u8 *data, int rem; =20 kernel_neon_begin(); - rem =3D sha3_ce_transform(sctx->st, data, blocks, ds); + rem =3D sha3_ce_transform(ctx->state.st, data, blocks, ds); kernel_neon_end(); data +=3D (blocks - rem) * bs; blocks =3D rem; @@ -58,7 +63,7 @@ static int arm64_sha3_update(struct shash_desc *desc, con= st u8 *data, static int arm64_sha3_finup(struct shash_desc *desc, const u8 *src, unsign= ed int len, u8 *out) { - struct sha3_state *sctx =3D shash_desc_ctx(desc); + struct sha3_ctx *ctx =3D crypto_sha3_desc(desc); struct crypto_shash *tfm =3D desc->tfm; __le64 *digest =3D (__le64 *)out; u8 block[SHA3_224_BLOCK_SIZE]; @@ -74,15 +79,15 @@ static int arm64_sha3_finup(struct shash_desc *desc, co= nst u8 *src, unsigned int block[bs - 1] |=3D 0x80; =20 kernel_neon_begin(); - sha3_ce_transform(sctx->st, block, 1, ds); + sha3_ce_transform(sctx->state.st, block, 1, ds); kernel_neon_end(); memzero_explicit(block , sizeof(block)); =20 for (i =3D 0; i < ds / 8; i++) - put_unaligned_le64(sctx->st[i], digest++); + put_unaligned_le64(sctx->state.st[i], digest++); =20 if (ds & 4) - put_unaligned_le32(sctx->st[i], (__le32 *)digest); + put_unaligned_le32(sctx->state.st[i], (__le32 *)digest); =20 return 0; } @@ -92,7 +97,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D arm64_sha3_update, .finup =3D arm64_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-224", .base.cra_driver_name =3D "sha3-224-ce", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -104,7 +109,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D arm64_sha3_update, .finup =3D arm64_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-256", .base.cra_driver_name =3D "sha3-256-ce", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -116,7 +121,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D arm64_sha3_update, .finup =3D arm64_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-384", .base.cra_driver_name =3D "sha3-384-ce", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -128,7 +133,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D arm64_sha3_update, .finup =3D arm64_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-512", .base.cra_driver_name =3D "sha3-512-ce", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c index 41d1e506e6de..6917a1aeb8e5 100644 --- a/crypto/sha3_generic.c +++ b/crypto/sha3_generic.c @@ -13,156 +13,19 @@ #include #include #include -#include =20 -/* - * On some 32-bit architectures (h8300), GCC ends up using - * over 1 KB of stack if we inline the round calculation into the loop - * in keccakf(). On the other hand, on 64-bit architectures with plenty - * of [64-bit wide] general purpose registers, not inlining it severely - * hurts performance. So let's use 64-bitness as a heuristic to decide - * whether to inline or not. - */ -#ifdef CONFIG_64BIT -#define SHA3_INLINE inline -#else -#define SHA3_INLINE noinline -#endif - -#define KECCAK_ROUNDS 24 - -static const u64 keccakf_rndc[24] =3D { - 0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, - 0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL, - 0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL, - 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL, - 0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, - 0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL, - 0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL, - 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL -}; - -/* update the state with given number of rounds */ - -static SHA3_INLINE void keccakf_round(u64 st[25]) -{ - u64 t[5], tt, bc[5]; - - /* Theta */ - bc[0] =3D st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20]; - bc[1] =3D st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21]; - bc[2] =3D st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22]; - bc[3] =3D st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23]; - bc[4] =3D st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24]; - - t[0] =3D bc[4] ^ rol64(bc[1], 1); - t[1] =3D bc[0] ^ rol64(bc[2], 1); - t[2] =3D bc[1] ^ rol64(bc[3], 1); - t[3] =3D bc[2] ^ rol64(bc[4], 1); - t[4] =3D bc[3] ^ rol64(bc[0], 1); - - st[0] ^=3D t[0]; - - /* Rho Pi */ - tt =3D st[1]; - st[ 1] =3D rol64(st[ 6] ^ t[1], 44); - st[ 6] =3D rol64(st[ 9] ^ t[4], 20); - st[ 9] =3D rol64(st[22] ^ t[2], 61); - st[22] =3D rol64(st[14] ^ t[4], 39); - st[14] =3D rol64(st[20] ^ t[0], 18); - st[20] =3D rol64(st[ 2] ^ t[2], 62); - st[ 2] =3D rol64(st[12] ^ t[2], 43); - st[12] =3D rol64(st[13] ^ t[3], 25); - st[13] =3D rol64(st[19] ^ t[4], 8); - st[19] =3D rol64(st[23] ^ t[3], 56); - st[23] =3D rol64(st[15] ^ t[0], 41); - st[15] =3D rol64(st[ 4] ^ t[4], 27); - st[ 4] =3D rol64(st[24] ^ t[4], 14); - st[24] =3D rol64(st[21] ^ t[1], 2); - st[21] =3D rol64(st[ 8] ^ t[3], 55); - st[ 8] =3D rol64(st[16] ^ t[1], 45); - st[16] =3D rol64(st[ 5] ^ t[0], 36); - st[ 5] =3D rol64(st[ 3] ^ t[3], 28); - st[ 3] =3D rol64(st[18] ^ t[3], 21); - st[18] =3D rol64(st[17] ^ t[2], 15); - st[17] =3D rol64(st[11] ^ t[1], 10); - st[11] =3D rol64(st[ 7] ^ t[2], 6); - st[ 7] =3D rol64(st[10] ^ t[0], 3); - st[10] =3D rol64( tt ^ t[1], 1); - - /* Chi */ - bc[ 0] =3D ~st[ 1] & st[ 2]; - bc[ 1] =3D ~st[ 2] & st[ 3]; - bc[ 2] =3D ~st[ 3] & st[ 4]; - bc[ 3] =3D ~st[ 4] & st[ 0]; - bc[ 4] =3D ~st[ 0] & st[ 1]; - st[ 0] ^=3D bc[ 0]; - st[ 1] ^=3D bc[ 1]; - st[ 2] ^=3D bc[ 2]; - st[ 3] ^=3D bc[ 3]; - st[ 4] ^=3D bc[ 4]; - - bc[ 0] =3D ~st[ 6] & st[ 7]; - bc[ 1] =3D ~st[ 7] & st[ 8]; - bc[ 2] =3D ~st[ 8] & st[ 9]; - bc[ 3] =3D ~st[ 9] & st[ 5]; - bc[ 4] =3D ~st[ 5] & st[ 6]; - st[ 5] ^=3D bc[ 0]; - st[ 6] ^=3D bc[ 1]; - st[ 7] ^=3D bc[ 2]; - st[ 8] ^=3D bc[ 3]; - st[ 9] ^=3D bc[ 4]; - - bc[ 0] =3D ~st[11] & st[12]; - bc[ 1] =3D ~st[12] & st[13]; - bc[ 2] =3D ~st[13] & st[14]; - bc[ 3] =3D ~st[14] & st[10]; - bc[ 4] =3D ~st[10] & st[11]; - st[10] ^=3D bc[ 0]; - st[11] ^=3D bc[ 1]; - st[12] ^=3D bc[ 2]; - st[13] ^=3D bc[ 3]; - st[14] ^=3D bc[ 4]; - - bc[ 0] =3D ~st[16] & st[17]; - bc[ 1] =3D ~st[17] & st[18]; - bc[ 2] =3D ~st[18] & st[19]; - bc[ 3] =3D ~st[19] & st[15]; - bc[ 4] =3D ~st[15] & st[16]; - st[15] ^=3D bc[ 0]; - st[16] ^=3D bc[ 1]; - st[17] ^=3D bc[ 2]; - st[18] ^=3D bc[ 3]; - st[19] ^=3D bc[ 4]; - - bc[ 0] =3D ~st[21] & st[22]; - bc[ 1] =3D ~st[22] & st[23]; - bc[ 2] =3D ~st[23] & st[24]; - bc[ 3] =3D ~st[24] & st[20]; - bc[ 4] =3D ~st[20] & st[21]; - st[20] ^=3D bc[ 0]; - st[21] ^=3D bc[ 1]; - st[22] ^=3D bc[ 2]; - st[23] ^=3D bc[ 3]; - st[24] ^=3D bc[ 4]; -} - -static void keccakf(u64 st[25]) +static struct sha3_ctx *crypto_sha3_desc(struct shash_desc *desc) { - int round; - - for (round =3D 0; round < KECCAK_ROUNDS; round++) { - keccakf_round(st); - /* Iota */ - st[0] ^=3D keccakf_rndc[round]; - } + return shash_desc_ctx(desc); } =20 int crypto_sha3_init(struct shash_desc *desc) { - struct sha3_state *sctx =3D shash_desc_ctx(desc); + struct sha3_ctx *ctx =3D crypto_sha3_desc(desc); =20 - memset(sctx->st, 0, sizeof(sctx->st)); + memset(ctx, 0, sizeof(*ctx)); + ctx->block_size =3D crypto_shash_blocksize(desc->tfm); + ctx->padding =3D 0x06; return 0; } EXPORT_SYMBOL(crypto_sha3_init); @@ -170,51 +33,21 @@ EXPORT_SYMBOL(crypto_sha3_init); static int crypto_sha3_update(struct shash_desc *desc, const u8 *data, unsigned int len) { - unsigned int rsiz =3D crypto_shash_blocksize(desc->tfm); - struct sha3_state *sctx =3D shash_desc_ctx(desc); - unsigned int rsizw =3D rsiz / 8; - - do { - int i; + struct sha3_ctx *ctx =3D crypto_sha3_desc(desc); =20 - for (i =3D 0; i < rsizw; i++) - sctx->st[i] ^=3D get_unaligned_le64(data + 8 * i); - keccakf(sctx->st); - - data +=3D rsiz; - len -=3D rsiz; - } while (len >=3D rsiz); + sha3_update(ctx, data, len); return len; } =20 static int crypto_sha3_finup(struct shash_desc *desc, const u8 *src, unsigned int len, u8 *out) { - unsigned int digest_size =3D crypto_shash_digestsize(desc->tfm); - unsigned int rsiz =3D crypto_shash_blocksize(desc->tfm); - struct sha3_state *sctx =3D shash_desc_ctx(desc); - __le64 block[SHA3_224_BLOCK_SIZE / 8] =3D {}; - __le64 *digest =3D (__le64 *)out; - unsigned int rsizw =3D rsiz / 8; - u8 *p; - int i; - - p =3D memcpy(block, src, len); - p[len++] =3D 0x06; - p[rsiz - 1] |=3D 0x80; - - for (i =3D 0; i < rsizw; i++) - sctx->st[i] ^=3D le64_to_cpu(block[i]); - memzero_explicit(block, sizeof(block)); - - keccakf(sctx->st); - - for (i =3D 0; i < digest_size / 8; i++) - put_unaligned_le64(sctx->st[i], digest++); - - if (digest_size & 4) - put_unaligned_le32(sctx->st[i], (__le32 *)digest); + struct sha3_ctx *ctx =3D crypto_sha3_desc(desc); =20 + if (len && src) + sha3_update(ctx, src, len); + sha3_squeeze(ctx, out, crypto_shash_digestsize(desc->tfm)); + sha3_clear(ctx); return 0; } =20 @@ -223,7 +56,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D crypto_sha3_update, .finup =3D crypto_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-224", .base.cra_driver_name =3D "sha3-224-generic", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -234,7 +67,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D crypto_sha3_update, .finup =3D crypto_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-256", .base.cra_driver_name =3D "sha3-256-generic", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -245,7 +78,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D crypto_sha3_update, .finup =3D crypto_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-384", .base.cra_driver_name =3D "sha3-384-generic", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, @@ -256,7 +89,7 @@ static struct shash_alg algs[] =3D { { .init =3D crypto_sha3_init, .update =3D crypto_sha3_update, .finup =3D crypto_sha3_finup, - .descsize =3D SHA3_STATE_SIZE, + .descsize =3D sizeof(struct sha3_ctx), .base.cra_name =3D "sha3-512", .base.cra_driver_name =3D "sha3-512-generic", .base.cra_flags =3D CRYPTO_AHASH_ALG_BLOCK_ONLY, diff --git a/include/crypto/sha3.h b/include/crypto/sha3.h index 41bc211afa0b..183261995fa1 100644 --- a/include/crypto/sha3.h +++ b/include/crypto/sha3.h @@ -38,10 +38,6 @@ =20 struct shash_desc; =20 -struct sha3_state { - u64 st[SHA3_STATE_SIZE / 8]; -}; - /* * The SHA3 context structure and state buffer. * @@ -52,7 +48,7 @@ struct sha3_state { * byteswap step is a no-op. */ struct sha3_ctx { - struct sha3_state state; + u64 st[SHA3_STATE_SIZE / 8]; u8 block_size; /* Block size in bytes */ u8 padding; /* Padding byte */ u8 absorb_offset; /* Next state byte to absorb into */ diff --git a/lib/crypto/sha3.c b/lib/crypto/sha3.c index 227d45bd9680..398669c4d7ca 100644 --- a/lib/crypto/sha3.c +++ b/lib/crypto/sha3.c @@ -48,10 +48,10 @@ static const u64 sha3_keccakf_rndc[24] =3D { /* * Perform a single round of Keccak mixing. */ -static SHA3_INLINE void sha3_keccakf_one_round_generic(struct sha3_state *= state, +static SHA3_INLINE void sha3_keccakf_one_round_generic(struct sha3_ctx *ct= x, int round) { - u64 *st =3D state->st; + u64 *st =3D ctx->st; u64 t[5], tt, bc[5]; =20 /* Theta */ @@ -153,13 +153,13 @@ static SHA3_INLINE void sha3_keccakf_one_round_generi= c(struct sha3_state *state, st[24] ^=3D bc[ 4]; =20 /* Iota */ - state->st[0] ^=3D sha3_keccakf_rndc[round]; + ctx->st[0] ^=3D sha3_keccakf_rndc[round]; } =20 -static void sha3_keccakf_rounds_generic(struct sha3_state *state) +static void sha3_keccakf_rounds_generic(struct sha3_ctx *ctx) { for (int round =3D 0; round < SHA3_KECCAK_ROUNDS; round++) - sha3_keccakf_one_round_generic(state, round); + sha3_keccakf_one_round_generic(ctx, round); } =20 /* @@ -167,25 +167,24 @@ static void sha3_keccakf_rounds_generic(struct sha3_s= tate *state) * machine for the duration of the Keccak mixing function. Note that these * loops are no-ops on LE machines and will be optimised away. */ -static void sha3_keccakf_generic(struct sha3_state *state) +static void sha3_keccakf_generic(struct sha3_ctx *ctx) { - for (int i =3D 0; i < ARRAY_SIZE(state->st); i++) - cpu_to_le64s(&state->st[i]); + for (int i =3D 0; i < ARRAY_SIZE(ctx->st); i++) + cpu_to_le64s(&ctx->st[i]); =20 - sha3_keccakf_rounds_generic(state); + sha3_keccakf_rounds_generic(ctx); =20 - for (int i =3D 0; i < ARRAY_SIZE(state->st); i++) - le64_to_cpus(&state->st[i]); + for (int i =3D 0; i < ARRAY_SIZE(ctx->st); i++) + le64_to_cpus(&ctx->st[i]); } =20 static void sha3_absorb_block_generic(struct sha3_ctx *ctx, const u8 *data) { - struct sha3_state *state =3D &ctx->state; unsigned int bsize =3D ctx->block_size; =20 for (int i =3D 0; i < bsize / 8; i++) - state->st[i] ^=3D get_unaligned((u64 *)(data + 8 * i)); - sha3_keccakf_generic(state); + ctx->st[i] ^=3D get_unaligned((u64 *)(data + 8 * i)); + sha3_keccakf_generic(ctx); } =20 /* @@ -214,7 +213,7 @@ static void sha3_absorb_blocks_generic(struct sha3_ctx = *ctx, static void sha3_absorb_xorle(struct sha3_ctx *ctx, const u8 *data, unsigned int partial, unsigned int len) { - u8 *buf =3D (u8 *)ctx->state.st; + u8 *buf =3D (u8 *)ctx->st; =20 buf +=3D partial; for (int i =3D 0; i < len; i++) @@ -245,7 +244,7 @@ void sha3_update(struct sha3_ctx *ctx, const u8 *data, = unsigned int len) sha3_absorb_xorle(ctx, data, absorb_offset, bsize - absorb_offset); len -=3D bsize - absorb_offset; data +=3D bsize - absorb_offset; - sha3_keccakf(&ctx->state); + sha3_keccakf(ctx); ctx->absorb_offset =3D 0; } =20 @@ -286,7 +285,7 @@ void sha3_squeeze(struct sha3_ctx *ctx, u8 *out, size_t= out_size) { unsigned int squeeze_offset =3D ctx->squeeze_offset; unsigned int bsize =3D ctx->block_size; - u8 *p =3D (u8 *)ctx->state.st, end_marker =3D 0x80; + u8 *p =3D (u8 *)ctx->st, end_marker =3D 0x80; =20 if (!ctx->end_marked) { sha3_absorb_xorle(ctx, &ctx->padding, ctx->absorb_offset, 1); @@ -296,7 +295,7 @@ void sha3_squeeze(struct sha3_ctx *ctx, u8 *out, size_t= out_size) =20 for (;;) { if (squeeze_offset =3D=3D 0) - sha3_keccakf(&ctx->state); + sha3_keccakf(ctx); =20 unsigned int part =3D umin(out_size, bsize - squeeze_offset);