Remove the dedicated GHASH implementation in GCM, and uses the GHASH
digest algorithm instead. This will make GCM uses hardware accelerated
GHASH implementation automatically if available.

ahash instead of shash interface is used, because some hardware
accelerated GHASH implementation needs asynchronous interface.
Signed-off-by: NHuang Ying <ying.huang@intel.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

GHASH is implemented as a shash algorithm. The actual implementation
is copied from gcm.c. This makes it possible to add
architecture/hardware accelerated GHASH implementation.
Signed-off-by: NHuang Ying <ying.huang@intel.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch converts authenc to the new ahash interface.
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch uses crypto_shash_export/crypto_shash_import to prehash
ipad/opad to speed up hmac.  This is partly based on a similar patch
by Steffen Klassert.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

It's undefined behaviour in C to write outside the bounds of an array.
The key expansion routine takes a shortcut of creating 8 words at a
time, but this creates 4 additional words which don't fit in the array.

As everyone is hopefully now aware, GCC is at liberty to make any
assumptions and optimisations it likes in situations where it can
detect that UB has occured, up to and including nasal demons, and
as the indices being accessed in the array are trivially calculable,
it's rash to invite gcc to do take any liberties at all.
Signed-off-by: NPhil Carmody <ext-phil.2.carmody@nokia.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

crypto_init_shash_ops_async() tests for setkey and not for import
before exporting the algorithms import function to ahash.
This patch fixes this.
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

ahash_op_unaligned() and ahash_def_finup() allocate memory atomically,
regardless whether the request can sleep or not. This patch changes
this to use GFP_KERNEL if the request can sleep.
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch provides a default export/import function for all
shash algorithms.  It simply copies the descriptor context as
is done by sha1_generic.

This in essence means that all existing shash algorithms now
support export/import.  This is something that will be depended
upon in implementations such as hmac.  Therefore all new shash
and ahash implementations must support export/import.

For those that cannot obtain a partial result, padlock-sha's
fallback model should be used so that a partial result is always
available.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch replaces the 32-bit counters in sha512_generic with
64-bit counters.  It also switches the bit count to the simpler
byte count.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch renames struct sha512_ctx and exports it as struct
sha512_state so that other sha512 implementations can use it
as the reference structure for exporting their state.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

Although xcbc was converted to shash, it didn't obey the new
requirement that all hash state must be stored in the descriptor
rather than the transform.

This patch fixes this issue and also optimises away the rekeying
by precomputing K2 and K3 within setkey.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch replaces the local xor function with the generic
crypto_xor function.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch adds the finup/export/import functions to the cryptd
ahash implementation.  We simply invoke the underlying shash
operations.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

When shash_ahash_finup encounters a null request, we end up not
calling the underlying final function.  This patch fixes that.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

When the alignment check was made unconditional for ahash we
may end up crashing on shash algorithms because we're always
calling alg->setkey instead of tfm->setkey.

This patch fixes it.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

If shash_alloc_instance() fails, we return the wrong error value.
This patch fixes it.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

If shash_alloc_instance() fails, we return the wrong error value.
This patch fixes it.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

If cryptd_alloc_instance() fails, the return value is uninitialized.
This patch fixes this by setting the return value.
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch exports the finup operation where available and adds
a default finup operation for ahash.  The operations final, finup
and digest also will now deal with unaligned result pointers by
copying it.  Finally export/import operations are will now be
exported too.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

We currently use GFP_ATOMIC in the unaligned setkey function
to allocate the temporary aligned buffer.  Since setkey must
be called in a sleepable context, we can use GFP_KERNEL instead.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

When we encounter an unaligned pointer we are supposed to copy
it to a temporary aligned location.  However the temporary buffer
isn't aligned properly.  This patch fixes that.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

Some unaligned buffers on the stack weren't zapped properly which
may cause secret data to be leaked.  This patch fixes them by doing
a zero memset.

It is also possible for us to place random kernel stack contents
in the digest buffer if a digest operation fails.  This is fixed
by only copying if the operation succeeded.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

Now that all ahash implementations have been converted to the new
ahash type, we can remove old_ahash_alg and its associated support.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch changes cryptd to use the new style ahash type.  In
particular, the instance is enlarged to encapsulate the new
ahash_alg structure.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch changes cryptd to use the template->create function
instead of alloc in anticipation for the switch to new style
ahash algorithms.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch adds a mask parameter to complement the existing type
parameter.  This is useful when instantiating algorithms that
require a mask other than the default, e.g., ahash algorithms.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch adds support for creating ahash instances and using
ahash as spawns.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch converts crypto_ahash to the new style.  The old ahash
algorithm type is retained until the existing ahash implementations
are also converted.  All ahash users will automatically get the
new crypto_ahash type.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

As the extsize and init_tfm functions belong to the frontend the
frontend argument is superfluous.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch makes cryptd use crypto_ahash_set_reqsize to avoid
accessing crypto_ahash directly.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch changes cryptd to use shash algorithms instead of the
legacy hash interface.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch exports the async functions so that they can be reused
by cryptd when it switches over to using shash.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch removes the implementation of hash and digest now that
no algorithms use them anymore.  The interface though will remain
until the users are converted across.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

Now that there are no more legacy hash implementations we can
remove the reference to crypto_hash.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch converts the xcbc algorithm to the new shash type.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch changes hmac to the new shash interface.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch changes descsize to a run-time attribute so that
implementations can change it in their init functions.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch moves the run-time null setkey check to shash_prepare_alg
just like we did for finup/digest.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch adds export/import support to sha256_generic.  The exported
type is defined by struct sha256_state, which is basically the entire
descriptor state of sha256_generic.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

This patch replaces the two 32-bit counter code in sha256_generic
with the simpler 64-bit counter code from sha1.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>