cregit-Linux how code gets into the kernel

Release 4.11 crypto/ecc.c

Directory: crypto
/*
 * Copyright (c) 2013, Kenneth MacKay
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *  * Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *  * Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <linux/random.h>
#include <linux/slab.h>
#include <linux/swab.h>
#include <linux/fips.h>
#include <crypto/ecdh.h>

#include "ecc.h"
#include "ecc_curve_defs.h"

typedef struct {
	
u64 m_low;
	
u64 m_high;
} 
uint128_t;


static inline const struct ecc_curve *ecc_get_curve(unsigned int curve_id) { switch (curve_id) { /* In FIPS mode only allow P256 and higher */ case ECC_CURVE_NIST_P192: return fips_enabled ? NULL : &nist_p192; case ECC_CURVE_NIST_P256: return &nist_p256; default: return NULL; } }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto43100.00%1100.00%
Total43100.00%1100.00%


static u64 *ecc_alloc_digits_space(unsigned int ndigits) { size_t len = ndigits * sizeof(u64); if (!len) return NULL; return kmalloc(len, GFP_KERNEL); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto37100.00%1100.00%
Total37100.00%1100.00%


static void ecc_free_digits_space(u64 *space) { kzfree(space); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto15100.00%1100.00%
Total15100.00%1100.00%


static struct ecc_point *ecc_alloc_point(unsigned int ndigits) { struct ecc_point *p = kmalloc(sizeof(*p), GFP_KERNEL); if (!p) return NULL; p->x = ecc_alloc_digits_space(ndigits); if (!p->x) goto err_alloc_x; p->y = ecc_alloc_digits_space(ndigits); if (!p->y) goto err_alloc_y; p->ndigits = ndigits; return p; err_alloc_y: ecc_free_digits_space(p->x); err_alloc_x: kfree(p); return NULL; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto102100.00%1100.00%
Total102100.00%1100.00%


static void ecc_free_point(struct ecc_point *p) { if (!p) return; kzfree(p->x); kzfree(p->y); kzfree(p); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto36100.00%1100.00%
Total36100.00%1100.00%


static void vli_clear(u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) vli[i] = 0; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto37100.00%1100.00%
Total37100.00%1100.00%

/* Returns true if vli == 0, false otherwise. */
static bool vli_is_zero(const u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) { if (vli[i]) return false; } return true; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto46100.00%1100.00%
Total46100.00%1100.00%

/* Returns nonzero if bit bit of vli is set. */
static u64 vli_test_bit(const u64 *vli, unsigned int bit) { return (vli[bit / 64] & ((u64)1 << (bit % 64))); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto38100.00%1100.00%
Total38100.00%1100.00%

/* Counts the number of 64-bit "digits" in vli. */
static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits) { int i; /* Search from the end until we find a non-zero digit. * We do it in reverse because we expect that most digits will * be nonzero. */ for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--); return (i + 1); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto50100.00%1100.00%
Total50100.00%1100.00%

/* Counts the number of bits required for vli. */
static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits) { unsigned int i, num_digits; u64 digit; num_digits = vli_num_digits(vli, ndigits); if (num_digits == 0) return 0; digit = vli[num_digits - 1]; for (i = 0; digit; i++) digit >>= 1; return ((num_digits - 1) * 64 + i); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto80100.00%1100.00%
Total80100.00%1100.00%

/* Sets dest = src. */
static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) dest[i] = src[i]; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto45100.00%1100.00%
Total45100.00%1100.00%

/* Returns sign of left - right. */
static int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits) { int i; for (i = ndigits - 1; i >= 0; i--) { if (left[i] > right[i]) return 1; else if (left[i] < right[i]) return -1; } return 0; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto75100.00%1100.00%
Total75100.00%1100.00%

/* Computes result = in << c, returning carry. Can modify in place * (if result == in). 0 < shift < 64. */
static u64 vli_lshift(u64 *result, const u64 *in, unsigned int shift, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 temp = in[i]; result[i] = (temp << shift) | carry; carry = temp >> (64 - shift); } return carry; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto80100.00%1100.00%
Total80100.00%1100.00%

/* Computes vli = vli >> 1. */
static void vli_rshift1(u64 *vli, unsigned int ndigits) { u64 *end = vli; u64 carry = 0; vli += ndigits; while (vli-- > end) { u64 temp = *vli; *vli = (temp >> 1) | carry; carry = temp << 63; } }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto61100.00%1100.00%
Total61100.00%1100.00%

/* Computes result = left + right, returning carry. Can modify in place. */
static u64 vli_add(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + right[i] + carry; if (sum != left[i]) carry = (sum < left[i]); result[i] = sum; } return carry; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto94100.00%1100.00%
Total94100.00%1100.00%

/* Computes result = left - right, returning borrow. Can modify in place. */
static u64 vli_sub(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 borrow = 0; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - right[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto94100.00%1100.00%
Total94100.00%1100.00%


static uint128_t mul_64_64(u64 left, u64 right) { u64 a0 = left & 0xffffffffull; u64 a1 = left >> 32; u64 b0 = right & 0xffffffffull; u64 b1 = right >> 32; u64 m0 = a0 * b0; u64 m1 = a0 * b1; u64 m2 = a1 * b0; u64 m3 = a1 * b1; uint128_t result; m2 += (m0 >> 32); m2 += m1; /* Overflow */ if (m2 < m1) m3 += 0x100000000ull; result.m_low = (m0 & 0xffffffffull) | (m2 << 32); result.m_high = m3 + (m2 >> 32); return result; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto125100.00%1100.00%
Total125100.00%1100.00%


static uint128_t add_128_128(uint128_t a, uint128_t b) { uint128_t result; result.m_low = a.m_low + b.m_low; result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low); return result; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto52100.00%1100.00%
Total52100.00%1100.00%


static void vli_mult(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; unsigned int i, k; /* Compute each digit of result in sequence, maintaining the * carries. */ for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i < ndigits; i++) { uint128_t product; product = mul_64_64(left[i], right[k - i]); r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto189100.00%1100.00%
Total189100.00%1100.00%


static void vli_square(u64 *result, const u64 *left, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; int i, k; for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i <= k - i; i++) { uint128_t product; product = mul_64_64(left[i], left[k - i]); if (i < k - i) { r2 += product.m_high >> 63; product.m_high = (product.m_high << 1) | (product.m_low >> 63); product.m_low <<= 1; } r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto228100.00%1100.00%
Total228100.00%1100.00%

/* Computes result = (left + right) % mod. * Assumes that left < mod and right < mod, result != mod. */
static void vli_mod_add(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits) { u64 carry; carry = vli_add(result, left, right, ndigits); /* result > mod (result = mod + remainder), so subtract mod to * get remainder. */ if (carry || vli_cmp(result, mod, ndigits) >= 0) vli_sub(result, result, mod, ndigits); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto72100.00%1100.00%
Total72100.00%1100.00%

/* Computes result = (left - right) % mod. * Assumes that left < mod and right < mod, result != mod. */
static void vli_mod_sub(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits) { u64 borrow = vli_sub(result, left, right, ndigits); /* In this case, p_result == -diff == (max int) - diff. * Since -x % d == d - x, we can get the correct result from * result + mod (with overflow). */ if (borrow) vli_add(result, result, mod, ndigits); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto59100.00%1100.00%
Total59100.00%1100.00%

/* Computes p_result = p_product % curve_p. * See algorithm 5 and 6 from * http://www.isys.uni-klu.ac.at/PDF/2001-0126-MT.pdf */
static void vli_mmod_fast_192(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp) { const unsigned int ndigits = 3; int carry; vli_set(result, product, ndigits); vli_set(tmp, &product[3], ndigits); carry = vli_add(result, result, tmp, ndigits); tmp[0] = 0; tmp[1] = product[3]; tmp[2] = product[4]; carry += vli_add(result, result, tmp, ndigits); tmp[0] = tmp[1] = product[5]; tmp[2] = 0; carry += vli_add(result, result, tmp, ndigits); while (carry || vli_cmp(curve_prime, result, ndigits) != 1) carry -= vli_sub(result, result, curve_prime, ndigits); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto172100.00%1100.00%
Total172100.00%1100.00%

/* Computes result = product % curve_prime * from http://www.nsa.gov/ia/_files/nist-routines.pdf */
static void vli_mmod_fast_256(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp) { int carry; const unsigned int ndigits = 4; /* t */ vli_set(result, product, ndigits); /* s1 */ tmp[0] = 0; tmp[1] = product[5] & 0xffffffff00000000ull; tmp[2] = product[6]; tmp[3] = product[7]; carry = vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s2 */ tmp[1] = product[6] << 32; tmp[2] = (product[6] >> 32) | (product[7] << 32); tmp[3] = product[7] >> 32; carry += vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s3 */ tmp[0] = product[4]; tmp[1] = product[5] & 0xffffffff; tmp[2] = 0; tmp[3] = product[7]; carry += vli_add(result, result, tmp, ndigits); /* s4 */ tmp[0] = (product[4] >> 32) | (product[5] << 32); tmp[1] = (product[5] >> 32) | (product[6] & 0xffffffff00000000ull); tmp[2] = product[7]; tmp[3] = (product[6] >> 32) | (product[4] << 32); carry += vli_add(result, result, tmp, ndigits); /* d1 */ tmp[0] = (product[5] >> 32) | (product[6] << 32); tmp[1] = (product[6] >> 32); tmp[2] = 0; tmp[3] = (product[4] & 0xffffffff) | (product[5] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d2 */ tmp[0] = product[6]; tmp[1] = product[7]; tmp[2] = 0; tmp[3] = (product[4] >> 32) | (product[5] & 0xffffffff00000000ull); carry -= vli_sub(result, result, tmp, ndigits); /* d3 */ tmp[0] = (product[6] >> 32) | (product[7] << 32); tmp[1] = (product[7] >> 32) | (product[4] << 32); tmp[2] = (product[4] >> 32) | (product[5] << 32); tmp[3] = (product[6] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d4 */ tmp[0] = product[7]; tmp[1] = product[4] & 0xffffffff00000000ull; tmp[2] = product[5]; tmp[3] = product[6] & 0xffffffff00000000ull; carry -= vli_sub(result, result, tmp, ndigits); if (carry < 0) { do { carry += vli_add(result, result, curve_prime, ndigits); } while (carry < 0); } else { while (carry || vli_cmp(curve_prime, result, ndigits) != 1) carry -= vli_sub(result, result, curve_prime, ndigits); } }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto692100.00%1100.00%
Total692100.00%1100.00%

/* Computes result = product % curve_prime * from http://www.nsa.gov/ia/_files/nist-routines.pdf */
static bool vli_mmod_fast(u64 *result, u64 *product, const u64 *curve_prime, unsigned int ndigits) { u64 tmp[2 * ndigits]; switch (ndigits) { case 3: vli_mmod_fast_192(result, product, curve_prime, tmp); break; case 4: vli_mmod_fast_256(result, product, curve_prime, tmp); break; default: pr_err("unsupports digits size!\n"); return false; } return true; }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto79100.00%1100.00%
Total79100.00%1100.00%

/* Computes result = (left * right) % curve_prime. */
static void vli_mod_mult_fast(u64 *result, const u64 *left, const u64 *right, const u64 *curve_prime, unsigned int ndigits) { u64 product[2 * ndigits]; vli_mult(product, left, right, ndigits); vli_mmod_fast(result, product, curve_prime, ndigits); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto59100.00%1100.00%
Total59100.00%1100.00%

/* Computes result = left^2 % curve_prime. */
static void vli_mod_square_fast(u64 *result, const u64 *left, const u64 *curve_prime, unsigned int ndigits) { u64 product[2 * ndigits]; vli_square(product, left, ndigits); vli_mmod_fast(result, product, curve_prime, ndigits); }

Contributors

PersonTokensPropCommitsCommitProp
Salvatore Benedetto52100.00%1100.00%
Total52100.00%1100.00%

#define EVEN(vli) (!(vli[0] & 1)) /* Computes result = (1 / p_input) % mod. All VLIs are the same size. * See "From Euclid's GCD to Montgomery Multiplication to the Great Divide" * https://labs.oracle.com/techrep/2001/smli_tr-2001-95.pdf */
static void vli_mod_inv(u64 *result, const u64 *input, const u64 *mod, unsigned int ndigits) { u64 a[ndigits], b[ndigits]; u64 u[ndigits], v[ndigits]; u64 carry; int cmp_result; if (vli_is_zero(input, ndigits)) { vli_clear(result, ndigits); return; } vli_set(a, input, ndigits); vli_set(b, mod, ndigits); vli_clear(u, ndigits); u[0] = 1; vli_clear(v, ndigits); while ((cmp_result = vli_cmp(a, b, ndigits)) != 0) { carry = 0; if (EVEN(a)) { vli_rshift1(a, ndigits); if (!EVEN(u)) carry = vli_add(u, u, mod, ndigits); vli_rshift1(u, ndigits); if (carry) u[ndigits - 1] |= 0x8000000000000000ull; } else if (EVEN(b)) { vli_rshift1(b, ndigits); if (!EVEN(v)) carry = vli_add(v, v, mod, ndigits); vli_rshift1(v, ndigits); if (carry) v[ndigits - 1] |= 0x8000000000000000ull; } else if (cmp_result > 0) { vli_sub(a, a, b, ndigits); vli_rshift1