linux-imx

/*

 * Cryptographic API.

 *

 * SHA-3, as specified in

 * http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

 *

 * SHA-3 code by Jeff Garzik <jeff@garzik.org>

 *               Ard Biesheuvel <ard.biesheuvel@linaro.org>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the Free

 * Software Foundation; either version 2 of the License, or (at your option)•

 * any later version.

 *

 */

#include <crypto/internal/hash.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/types.h>

#include <crypto/sha3.h>

#include <asm/unaligned.h>

​

/*

 * On some 32-bit architectures (h8300), GCC ends up using

 * over 1 KB of stack if we inline the round calculation into the loop

 * in keccakf(). On the other hand, on 64-bit architectures with plenty

 * of [64-bit wide] general purpose registers, not inlining it severely

 * hurts performance. So let's use 64-bitness as a heuristic to decide

 * whether to inline or not.

 */

#ifdef CONFIG_64BIT

#define SHA3_INLINE inline

#else

#define SHA3_INLINE noinline

#endif

​

#define KECCAK_ROUNDS 24

​

static const u64 keccakf_rndc[24] = {

    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,

    0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,

    0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,

    0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,

    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,

    0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,

    0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,

    0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL

};

​

/* update the state with given number of rounds */

​

static SHA3_INLINE void keccakf_round(u64 st[25])

{

    u64 t[5], tt, bc[5];

​

    /* Theta */

    bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];

    bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];

    bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];

    bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];

    bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];

​

    t[0] = bc[4] ^ rol64(bc[1], 1);

    t[1] = bc[0] ^ rol64(bc[2], 1);

    t[2] = bc[1] ^ rol64(bc[3], 1);

    t[3] = bc[2] ^ rol64(bc[4], 1);

    t[4] = bc[3] ^ rol64(bc[0], 1);

​

    st[0] ^= t[0];

​

    /* Rho Pi */

    tt = st[1];

    st[ 1] = rol64(st[ 6] ^ t[1], 44);

    st[ 6] = rol64(st[ 9] ^ t[4], 20);

    st[ 9] = rol64(st[22] ^ t[2], 61);

    st[22] = rol64(st[14] ^ t[4], 39);

    st[14] = rol64(st[20] ^ t[0], 18);

    st[20] = rol64(st[ 2] ^ t[2], 62);

    st[ 2] = rol64(st[12] ^ t[2], 43);

    st[12] = rol64(st[13] ^ t[3], 25);

    st[13] = rol64(st[19] ^ t[4],  8);

    st[19] = rol64(st[23] ^ t[3], 56);

    st[23] = rol64(st[15] ^ t[0], 41);

    st[15] = rol64(st[ 4] ^ t[4], 27);

    st[ 4] = rol64(st[24] ^ t[4], 14);

    st[24] = rol64(st[21] ^ t[1],  2);

    st[21] = rol64(st[ 8] ^ t[3], 55);

    st[ 8] = rol64(st[16] ^ t[1], 45);

    st[16] = rol64(st[ 5] ^ t[0], 36);

    st[ 5] = rol64(st[ 3] ^ t[3], 28);

    st[ 3] = rol64(st[18] ^ t[3], 21);

    st[18] = rol64(st[17] ^ t[2], 15);