linux-imx

// SPDX-License-Identifier: GPL-2.0-or-later

/*

 * SHA-256, as specified in

 * http://csrc.nist.gov/groups/STM/cavp/documents/shs/sha256-384-512.pdf

 *

 * SHA-256 code by Jean-Luc Cooke <jlcooke@certainkey.com>.

 *

 * Copyright (c) Jean-Luc Cooke <jlcooke@certainkey.com>

 * Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>

 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>

 * Copyright (c) 2014 Red Hat Inc.

 */

​

#include <linux/bitops.h>

#include <linux/sha256.h>

#include <linux/string.h>

#include <asm/byteorder.h>

​

static inline u32 Ch(u32 x, u32 y, u32 z)

{

    return z ^ (x & (y ^ z));

}

​

static inline u32 Maj(u32 x, u32 y, u32 z)

{

    return (x & y) | (z & (x | y));

}

​

#define e0(x)       (ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22))

#define e1(x)       (ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25))

#define s0(x)       (ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3))

#define s1(x)       (ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10))

​

static inline void LOAD_OP(int I, u32 *W, const u8 *input)

{

    W[I] = __be32_to_cpu(((__be32 *)(input))[I]);

}

​

static inline void BLEND_OP(int I, u32 *W)

{

    W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];

}

​

static void sha256_transform(u32 *state, const u8 *input)

{

    u32 a, b, c, d, e, f, g, h, t1, t2;

    u32 W[64];

    int i;

​

    /* load the input */

    for (i = 0; i < 16; i++)

        LOAD_OP(i, W, input);

​

    /* now blend */

    for (i = 16; i < 64; i++)

        BLEND_OP(i, W);

​

    /* load the state into our registers */

    a = state[0];  b = state[1];  c = state[2];  d = state[3];

    e = state[4];  f = state[5];  g = state[6];  h = state[7];

​

    /* now iterate */

    t1 = h + e1(e) + Ch(e, f, g) + 0x428a2f98 + W[0];

    t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1 + t2;

    t1 = g + e1(d) + Ch(d, e, f) + 0x71374491 + W[1];

    t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1 + t2;

    t1 = f + e1(c) + Ch(c, d, e) + 0xb5c0fbcf + W[2];

    t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1 + t2;

    t1 = e + e1(b) + Ch(b, c, d) + 0xe9b5dba5 + W[3];

    t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1 + t2;

    t1 = d + e1(a) + Ch(a, b, c) + 0x3956c25b + W[4];

    t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1 + t2;

    t1 = c + e1(h) + Ch(h, a, b) + 0x59f111f1 + W[5];

    t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1 + t2;

    t1 = b + e1(g) + Ch(g, h, a) + 0x923f82a4 + W[6];

    t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1 + t2;

    t1 = a + e1(f) + Ch(f, g, h) + 0xab1c5ed5 + W[7];

    t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1 + t2;

​

    t1 = h + e1(e) + Ch(e, f, g) + 0xd807aa98 + W[8];

    t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1 + t2;

    t1 = g + e1(d) + Ch(d, e, f) + 0x12835b01 + W[9];

    t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1 + t2;

    t1 = f + e1(c) + Ch(c, d, e) + 0x243185be + W[10];

    t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1 + t2;

    t1 = e + e1(b) + Ch(b, c, d) + 0x550c7dc3 + W[11];

    t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1 + t2;

    t1 = d + e1(a) + Ch(a, b, c) + 0x72be5d74 + W[12];

    t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1 + t2;

    t1 = c + e1(h) + Ch(h, a, b) + 0x80deb1fe + W[13];

    t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1 + t2;

    t1 = b + e1(g) + Ch(g, h, a) + 0x9bdc06a7 + W[14];