Re: s390 hmac

[Harald Freudenberger <freude@linux.ibm.com>]

On 2025-03-23 14:13, Herbert Xu wrote:
> Hi Harald:
> 
> I'm working on making the export format of hash algorithms compatible
> so that you can switch between implementations seamlessly.
> 
> I've got a question about the s390 hmac implementation.  How does
> the hardware tell if it's the first update (where the cv from the
> param block contains undefined state) or not? Is it a bit in
> s390_kmac_gr0 or is it the imbl?
> 
> Thanks,

Hi Herbert

that is the ikp bit in the s390_kmac_gr0 struct:

union s390_kmac_gr0 {
	unsigned long reg;
	struct {
		unsigned long		: 48;
		unsigned long ikp	:  1;
		unsigned long iimp	:  1;
		unsigned long ccup	:  1;
		unsigned long		:  6;
		unsigned long fc	:  7;
	};
};

It needs to be initial 0 and the firmware sets it to 1 with
the inner key padding and the hashing done.

Holger's implementation in hmac_s390.c of the clear key hmac
holds this gr0 value as part of the running hash context:

struct s390_kmac_sha2_ctx {
	u8 param[MAX_DIGEST_SIZE + MAX_IMBL_SIZE + MAX_BLOCK_SIZE];
	union s390_kmac_gr0 gr0;
	u8 buf[MAX_BLOCK_SIZE];
	unsigned int buflen;
};