mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 02:19:51 +00:00
![Heiko Carstens](/assets/img/avatar_default.png)
Commit349d03ffd5
("crypto: s390 - add crypto library interface for ChaCha20") added a library interface to the s390 specific ChaCha20 implementation. However no check was added to verify if the required facilities are installed before branching into the assembler code. If compiled into the kernel, this will lead to the following crash, if vector instructions are not available: data exception: 0007 ilc:3 [#1] SMP Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11 Hardware name: IBM 3931 A01 704 (KVM/Linux) Krnl PSW : 0704e00180000000 000000001857277a (chacha20_vx+0x32/0x818) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000037f0000000a ffffffffffffff60 000000008184b000 0000000019f5c8e6 0000000000000109 0000037fffb13c58 0000037fffb13c78 0000000019bb1780 0000037fffb13c58 0000000019f5c8e6 000000008184b000 0000000000000109 00000000802d8000 0000000000000109 0000000018571ebc 0000037fffb13718 Krnl Code: 000000001857276a: c07000b1f80b larl %r7,0000000019bb1780 0000000018572770: a708000a lhi %r0,10 #0000000018572774: e78950000c36 vlm %v24,%v25,0(%r5),0 >000000001857277a: e7a060000806 vl %v26,0(%r6),0 0000000018572780: e7bf70004c36 vlm %v27,%v31,0(%r7),4 0000000018572786: e70b00000456 vlr %v0,%v27 000000001857278c: e71800000456 vlr %v1,%v24 0000000018572792: e74b00000456 vlr %v4,%v27 Call Trace: [<000000001857277a>] chacha20_vx+0x32/0x818 Last Breaking-Event-Address: [<0000000018571eb6>] chacha20_crypt_s390.constprop.0+0x6e/0xd8 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix this by adding a missing MACHINE_HAS_VX check. Fixes:349d03ffd5
("crypto: s390 - add crypto library interface for ChaCha20") Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com> Cc: <stable@vger.kernel.org> # 5.19+ Reviewed-by: Harald Freudenberger <freude@linux.ibm.com> [agordeev@linux.ibm.com: remove duplicates in commit message] Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
130 lines
3.5 KiB
C
130 lines
3.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* s390 ChaCha stream cipher.
|
|
*
|
|
* Copyright IBM Corp. 2021
|
|
*/
|
|
|
|
#define KMSG_COMPONENT "chacha_s390"
|
|
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
|
|
|
|
#include <crypto/internal/chacha.h>
|
|
#include <crypto/internal/skcipher.h>
|
|
#include <crypto/algapi.h>
|
|
#include <linux/cpufeature.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/sizes.h>
|
|
#include <asm/fpu/api.h>
|
|
#include "chacha-s390.h"
|
|
|
|
static void chacha20_crypt_s390(u32 *state, u8 *dst, const u8 *src,
|
|
unsigned int nbytes, const u32 *key,
|
|
u32 *counter)
|
|
{
|
|
struct kernel_fpu vxstate;
|
|
|
|
kernel_fpu_begin(&vxstate, KERNEL_VXR);
|
|
chacha20_vx(dst, src, nbytes, key, counter);
|
|
kernel_fpu_end(&vxstate, KERNEL_VXR);
|
|
|
|
*counter += round_up(nbytes, CHACHA_BLOCK_SIZE) / CHACHA_BLOCK_SIZE;
|
|
}
|
|
|
|
static int chacha20_s390(struct skcipher_request *req)
|
|
{
|
|
struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
|
|
struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
|
|
u32 state[CHACHA_STATE_WORDS] __aligned(16);
|
|
struct skcipher_walk walk;
|
|
unsigned int nbytes;
|
|
int rc;
|
|
|
|
rc = skcipher_walk_virt(&walk, req, false);
|
|
chacha_init_generic(state, ctx->key, req->iv);
|
|
|
|
while (walk.nbytes > 0) {
|
|
nbytes = walk.nbytes;
|
|
if (nbytes < walk.total)
|
|
nbytes = round_down(nbytes, walk.stride);
|
|
|
|
if (nbytes <= CHACHA_BLOCK_SIZE) {
|
|
chacha_crypt_generic(state, walk.dst.virt.addr,
|
|
walk.src.virt.addr, nbytes,
|
|
ctx->nrounds);
|
|
} else {
|
|
chacha20_crypt_s390(state, walk.dst.virt.addr,
|
|
walk.src.virt.addr, nbytes,
|
|
&state[4], &state[12]);
|
|
}
|
|
rc = skcipher_walk_done(&walk, walk.nbytes - nbytes);
|
|
}
|
|
return rc;
|
|
}
|
|
|
|
void hchacha_block_arch(const u32 *state, u32 *stream, int nrounds)
|
|
{
|
|
/* TODO: implement hchacha_block_arch() in assembly */
|
|
hchacha_block_generic(state, stream, nrounds);
|
|
}
|
|
EXPORT_SYMBOL(hchacha_block_arch);
|
|
|
|
void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv)
|
|
{
|
|
chacha_init_generic(state, key, iv);
|
|
}
|
|
EXPORT_SYMBOL(chacha_init_arch);
|
|
|
|
void chacha_crypt_arch(u32 *state, u8 *dst, const u8 *src,
|
|
unsigned int bytes, int nrounds)
|
|
{
|
|
/* s390 chacha20 implementation has 20 rounds hard-coded,
|
|
* it cannot handle a block of data or less, but otherwise
|
|
* it can handle data of arbitrary size
|
|
*/
|
|
if (bytes <= CHACHA_BLOCK_SIZE || nrounds != 20 || !MACHINE_HAS_VX)
|
|
chacha_crypt_generic(state, dst, src, bytes, nrounds);
|
|
else
|
|
chacha20_crypt_s390(state, dst, src, bytes,
|
|
&state[4], &state[12]);
|
|
}
|
|
EXPORT_SYMBOL(chacha_crypt_arch);
|
|
|
|
static struct skcipher_alg chacha_algs[] = {
|
|
{
|
|
.base.cra_name = "chacha20",
|
|
.base.cra_driver_name = "chacha20-s390",
|
|
.base.cra_priority = 900,
|
|
.base.cra_blocksize = 1,
|
|
.base.cra_ctxsize = sizeof(struct chacha_ctx),
|
|
.base.cra_module = THIS_MODULE,
|
|
|
|
.min_keysize = CHACHA_KEY_SIZE,
|
|
.max_keysize = CHACHA_KEY_SIZE,
|
|
.ivsize = CHACHA_IV_SIZE,
|
|
.chunksize = CHACHA_BLOCK_SIZE,
|
|
.setkey = chacha20_setkey,
|
|
.encrypt = chacha20_s390,
|
|
.decrypt = chacha20_s390,
|
|
}
|
|
};
|
|
|
|
static int __init chacha_mod_init(void)
|
|
{
|
|
return IS_REACHABLE(CONFIG_CRYPTO_SKCIPHER) ?
|
|
crypto_register_skciphers(chacha_algs, ARRAY_SIZE(chacha_algs)) : 0;
|
|
}
|
|
|
|
static void __exit chacha_mod_fini(void)
|
|
{
|
|
if (IS_REACHABLE(CONFIG_CRYPTO_SKCIPHER))
|
|
crypto_unregister_skciphers(chacha_algs, ARRAY_SIZE(chacha_algs));
|
|
}
|
|
|
|
module_cpu_feature_match(S390_CPU_FEATURE_VXRS, chacha_mod_init);
|
|
module_exit(chacha_mod_fini);
|
|
|
|
MODULE_DESCRIPTION("ChaCha20 stream cipher");
|
|
MODULE_LICENSE("GPL v2");
|
|
|
|
MODULE_ALIAS_CRYPTO("chacha20");
|