linux-imx

/*

 * Cryptographic API.

 *

 * SHA-3, as specified in

 * http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

 *

 * SHA-3 code by Jeff Garzik <jeff@garzik.org>

 *               Ard Biesheuvel <ard.biesheuvel@linaro.org>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the Free

 * Software Foundation; either version 2 of the License, or (at your option)•

 * any later version.

 *

 */

#include <crypto/internal/hash.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/types.h>

#include <crypto/sha3.h>

#include <asm/unaligned.h>

​

/*

 * On some 32-bit architectures (h8300), GCC ends up using

 * over 1 KB of stack if we inline the round calculation into the loop

 * in keccakf(). On the other hand, on 64-bit architectures with plenty

 * of [64-bit wide] general purpose registers, not inlining it severely

 * hurts performance. So let's use 64-bitness as a heuristic to decide

 * whether to inline or not.

 */

#ifdef CONFIG_64BIT

#define SHA3_INLINE inline

#else

#define SHA3_INLINE noinline

#endif

​

#define KECCAK_ROUNDS 24

​

static const u64 keccakf_rndc[24] = {

    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,

    0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,

    0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,

    0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,

    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,

    0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,

    0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,

    0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL

};

​

/* update the state with given number of rounds */

​

static SHA3_INLINE void keccakf_round(u64 st[25])

{

    u64 t[5], tt, bc[5];

​

    /* Theta */

    bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];

    bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];

    bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];

    bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];

    bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];

​

    t[0] = bc[4] ^ rol64(bc[1], 1);