lib/crypto: gf128hash: Rename polyval module to gf128hash

Currently, the standalone GHASH code is coupled with crypto_shash.  This
has resulted in unnecessary complexity and overhead, as well as the code
being unavailable to library code such as the AES-GCM library.  Like was
done with POLYVAL, it needs to find a new home in lib/crypto/.

GHASH and POLYVAL are closely related and can each be implemented in
terms of each other.  Optimized code for one can be reused with the
other.  But also since GHASH tends to be difficult to implement directly
due to its unnatural bit order, most modern GHASH implementations
(including the existing arm, arm64, powerpc, and x86 optimized GHASH
code, and the new generic GHASH code I'll be adding) actually
reinterpret the GHASH computation as an equivalent POLYVAL computation,
pre and post-processing the inputs and outputs to map to/from POLYVAL.

Given this close relationship, it makes sense to group the GHASH and
POLYVAL code together in the same module.  This gives us a wide range of
options for implementing them, reusing code between the two and properly
utilizing whatever instructions each architecture provides.

Thus, GHASH support will be added to the library module that is
currently called "polyval".  Rename it to an appropriate name:
"gf128hash".  Rename files, options, functions, etc. where appropriate
to reflect the upcoming sharing with GHASH.  (Note: polyval_kunit is not
renamed, as ghash_kunit will be added alongside it instead.)

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260319061723.1140720-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>

diff --git a/crypto/Kconfig b/crypto/Kconfig
index b8608ef6823bf511ac03134c4b1761aeaac52853..5627b36915616186271e2874612baa4ac8303ba3 100644 (file)
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -686,7 +686,7 @@ config CRYPTO_ECB
 config CRYPTO_HCTR2
        tristate "HCTR2"
        select CRYPTO_XCTR
-       select CRYPTO_LIB_POLYVAL
+       select CRYPTO_LIB_GF128HASH
        select CRYPTO_MANAGER
        help
          HCTR2 length-preserving encryption mode

diff --git a/crypto/hctr2.c b/crypto/hctr2.c
index f4cd6c29b4d397d0dd13b5b818e9b37dafeb03aa..ad5edf9366ac82d5065576c4d3d2895602ffe3df 100644 (file)
--- a/crypto/hctr2.c
+++ b/crypto/hctr2.c
@@ -16,9 +16,9 @@
  * (https://eprint.iacr.org/2021/1441.pdf)
  */
 
+#include <crypto/gf128hash.h>
 #include <crypto/internal/cipher.h>
 #include <crypto/internal/skcipher.h>
-#include <crypto/polyval.h>
 #include <crypto/scatterwalk.h>
 #include <linux/module.h>
 

diff --git a/include/crypto/polyval.h b/include/crypto/gf128hash.h
similarity index 94%
rename from include/crypto/polyval.h
rename to include/crypto/gf128hash.h
index b28b8ef113538c456f554e2308698d0c7500e69b..5ffa86f5c13fd0b69e4b339715bc89efe2bfb76e 100644 (file)
--- a/include/crypto/polyval.h
+++ b/include/crypto/gf128hash.h
@@ -1,12 +1,12 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
- * POLYVAL library API
+ * GF(2^128) polynomial hashing: GHASH and POLYVAL
  *
  * Copyright 2025 Google LLC
  */
 
-#ifndef _CRYPTO_POLYVAL_H
-#define _CRYPTO_POLYVAL_H
+#ifndef _CRYPTO_GF128HASH_H
+#define _CRYPTO_GF128HASH_H
 
 #include <linux/string.h>
 #include <linux/types.h>
@@ -44,7 +44,7 @@ struct polyval_elem {
  * exponentiation repeats the POLYVAL dot operation, with its "extra" x^-128.
  */
 struct polyval_key {
-#ifdef CONFIG_CRYPTO_LIB_POLYVAL_ARCH
+#ifdef CONFIG_CRYPTO_LIB_GF128HASH_ARCH
 #ifdef CONFIG_ARM64
        /** @h_powers: Powers of the hash key H^8 through H^1 */
        struct polyval_elem h_powers[8];
@@ -54,10 +54,10 @@ struct polyval_key {
 #else
 #error "Unhandled arch"
 #endif
-#else /* CONFIG_CRYPTO_LIB_POLYVAL_ARCH */
+#else /* CONFIG_CRYPTO_LIB_GF128HASH_ARCH */
        /** @h: The hash key H */
        struct polyval_elem h;
-#endif /* !CONFIG_CRYPTO_LIB_POLYVAL_ARCH */
+#endif /* !CONFIG_CRYPTO_LIB_GF128HASH_ARCH */
 };
 
 /**
@@ -84,7 +84,7 @@ struct polyval_ctx {
  *
  * Context: Any context.
  */
-#ifdef CONFIG_CRYPTO_LIB_POLYVAL_ARCH
+#ifdef CONFIG_CRYPTO_LIB_GF128HASH_ARCH
 void polyval_preparekey(struct polyval_key *key,
                        const u8 raw_key[POLYVAL_BLOCK_SIZE]);
 
@@ -187,4 +187,4 @@ static inline void polyval(const struct polyval_key *key,
        polyval_final(&ctx, out);
 }
 
-#endif /* _CRYPTO_POLYVAL_H */
+#endif /* _CRYPTO_GF128HASH_H */

diff --git a/lib/crypto/Kconfig b/lib/crypto/Kconfig
index 4910fe20e42adcd458728c5695c0c5f0665387d2..98cedd95c2a5f2c251312362dfb3a21884c18f7b 100644 (file)
--- a/lib/crypto/Kconfig
+++ b/lib/crypto/Kconfig
@@ -110,6 +110,18 @@ config CRYPTO_LIB_CURVE25519_GENERIC
 config CRYPTO_LIB_DES
        tristate
 
+config CRYPTO_LIB_GF128HASH
+       tristate
+       help
+         The GHASH and POLYVAL library functions.  Select this if your module
+         uses any of the functions from <crypto/gf128hash.h>.
+
+config CRYPTO_LIB_GF128HASH_ARCH
+       bool
+       depends on CRYPTO_LIB_GF128HASH && !UML
+       default y if ARM64
+       default y if X86_64
+
 config CRYPTO_LIB_MD5
        tristate
        help
@@ -178,18 +190,6 @@ config CRYPTO_LIB_POLY1305_RSIZE
        default 9 if ARM || ARM64
        default 1
 
-config CRYPTO_LIB_POLYVAL
-       tristate
-       help
-         The POLYVAL library functions.  Select this if your module uses any of
-         the functions from <crypto/polyval.h>.
-
-config CRYPTO_LIB_POLYVAL_ARCH
-       bool
-       depends on CRYPTO_LIB_POLYVAL && !UML
-       default y if ARM64
-       default y if X86_64
-
 config CRYPTO_LIB_CHACHA20POLY1305
        tristate
        select CRYPTO_LIB_CHACHA

diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile
index a961615c8c7f288c0c3923c097b2785f1dc05fc6..fc30622123d23631126017424464c2b48bce2a3c 100644 (file)
--- a/lib/crypto/Makefile
+++ b/lib/crypto/Makefile
@@ -154,6 +154,16 @@ libdes-y                                   := des.o
 
 ################################################################################
 
+obj-$(CONFIG_CRYPTO_LIB_GF128HASH) += libgf128hash.o
+libgf128hash-y := gf128hash.o
+ifeq ($(CONFIG_CRYPTO_LIB_GF128HASH_ARCH),y)
+CFLAGS_gf128hash.o += -I$(src)/$(SRCARCH)
+libgf128hash-$(CONFIG_ARM64) += arm64/polyval-ce-core.o
+libgf128hash-$(CONFIG_X86) += x86/polyval-pclmul-avx.o
+endif
+
+################################################################################
+
 obj-$(CONFIG_CRYPTO_LIB_MD5) += libmd5.o
 libmd5-y := md5.o
 ifeq ($(CONFIG_CRYPTO_LIB_MD5_ARCH),y)
@@ -251,16 +261,6 @@ clean-files += arm/poly1305-core.S \
 
 ################################################################################
 
-obj-$(CONFIG_CRYPTO_LIB_POLYVAL) += libpolyval.o
-libpolyval-y := polyval.o
-ifeq ($(CONFIG_CRYPTO_LIB_POLYVAL_ARCH),y)
-CFLAGS_polyval.o += -I$(src)/$(SRCARCH)
-libpolyval-$(CONFIG_ARM64) += arm64/polyval-ce-core.o
-libpolyval-$(CONFIG_X86) += x86/polyval-pclmul-avx.o
-endif
-
-################################################################################
-
 obj-$(CONFIG_CRYPTO_LIB_SHA1) += libsha1.o
 libsha1-y := sha1.o
 ifeq ($(CONFIG_CRYPTO_LIB_SHA1_ARCH),y)

diff --git a/lib/crypto/arm64/polyval.h b/lib/crypto/arm64/gf128hash.h
similarity index 95%
rename from lib/crypto/arm64/polyval.h
rename to lib/crypto/arm64/gf128hash.h
index a39763395e9bf2542229089d85a4f73ce6aad0c2..c1012007adcf3babf3f1a41e7f553d88572d40ec 100644 (file)
--- a/lib/crypto/arm64/polyval.h
+++ b/lib/crypto/arm64/gf128hash.h
@@ -72,8 +72,8 @@ static void polyval_blocks_arch(struct polyval_elem *acc,
        }
 }
 
-#define polyval_mod_init_arch polyval_mod_init_arch
-static void polyval_mod_init_arch(void)
+#define gf128hash_mod_init_arch gf128hash_mod_init_arch
+static void gf128hash_mod_init_arch(void)
 {
        if (cpu_have_named_feature(PMULL))
                static_branch_enable(&have_pmull);

diff --git a/lib/crypto/polyval.c b/lib/crypto/gf128hash.c
similarity index 94%
rename from lib/crypto/polyval.c
rename to lib/crypto/gf128hash.c
index 5796275f574ae657910ac1392c06a3bbec5bd7bd..8bb848bf26b7092881a2c6f1542710da82a7c00c 100644 (file)
--- a/lib/crypto/polyval.c
+++ b/lib/crypto/gf128hash.c
@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 /*
- * POLYVAL library functions
+ * GF(2^128) polynomial hashing: GHASH and POLYVAL
  *
  * Copyright 2025 Google LLC
  */
 
-#include <crypto/polyval.h>
+#include <crypto/gf128hash.h>
 #include <linux/export.h>
 #include <linux/module.h>
 #include <linux/string.h>
@@ -218,8 +218,8 @@ polyval_blocks_generic(struct polyval_elem *acc, const struct polyval_elem *key,
 }
 
 /* Include the arch-optimized implementation of POLYVAL, if one is available. */
-#ifdef CONFIG_CRYPTO_LIB_POLYVAL_ARCH
-#include "polyval.h" /* $(SRCARCH)/polyval.h */
+#ifdef CONFIG_CRYPTO_LIB_GF128HASH_ARCH
+#include "gf128hash.h" /* $(SRCARCH)/gf128hash.h */
 void polyval_preparekey(struct polyval_key *key,
                        const u8 raw_key[POLYVAL_BLOCK_SIZE])
 {
@@ -238,7 +238,7 @@ EXPORT_SYMBOL_GPL(polyval_preparekey);
 
 static void polyval_mul(struct polyval_ctx *ctx)
 {
-#ifdef CONFIG_CRYPTO_LIB_POLYVAL_ARCH
+#ifdef CONFIG_CRYPTO_LIB_GF128HASH_ARCH
        polyval_mul_arch(&ctx->acc, ctx->key);
 #else
        polyval_mul_generic(&ctx->acc, &ctx->key->h);
@@ -248,7 +248,7 @@ static void polyval_mul(struct polyval_ctx *ctx)
 static void polyval_blocks(struct polyval_ctx *ctx,
                           const u8 *data, size_t nblocks)
 {
-#ifdef CONFIG_CRYPTO_LIB_POLYVAL_ARCH
+#ifdef CONFIG_CRYPTO_LIB_GF128HASH_ARCH
        polyval_blocks_arch(&ctx->acc, ctx->key, data, nblocks);
 #else
        polyval_blocks_generic(&ctx->acc, &ctx->key->h, data, nblocks);
@@ -289,19 +289,19 @@ void polyval_final(struct polyval_ctx *ctx, u8 out[POLYVAL_BLOCK_SIZE])
 }
 EXPORT_SYMBOL_GPL(polyval_final);
 
-#ifdef polyval_mod_init_arch
-static int __init polyval_mod_init(void)
+#ifdef gf128hash_mod_init_arch
+static int __init gf128hash_mod_init(void)
 {
-       polyval_mod_init_arch();
+       gf128hash_mod_init_arch();
        return 0;
 }
-subsys_initcall(polyval_mod_init);
+subsys_initcall(gf128hash_mod_init);
 
-static void __exit polyval_mod_exit(void)
+static void __exit gf128hash_mod_exit(void)
 {
 }
-module_exit(polyval_mod_exit);
+module_exit(gf128hash_mod_exit);
 #endif
 
-MODULE_DESCRIPTION("POLYVAL almost-XOR-universal hash function");
+MODULE_DESCRIPTION("GF(2^128) polynomial hashing: GHASH and POLYVAL");
 MODULE_LICENSE("GPL");

diff --git a/lib/crypto/tests/Kconfig b/lib/crypto/tests/Kconfig
index 42e1770e1883bb1248e2b82fa6d701c8c4fb6ea9..aa627b6b98558a3d53620bfecbb7f3099294e005 100644 (file)
--- a/lib/crypto/tests/Kconfig
+++ b/lib/crypto/tests/Kconfig
@@ -69,7 +69,7 @@ config CRYPTO_LIB_POLY1305_KUNIT_TEST
 
 config CRYPTO_LIB_POLYVAL_KUNIT_TEST
        tristate "KUnit tests for POLYVAL" if !KUNIT_ALL_TESTS
-       depends on KUNIT && CRYPTO_LIB_POLYVAL
+       depends on KUNIT && CRYPTO_LIB_GF128HASH
        default KUNIT_ALL_TESTS
        select CRYPTO_LIB_BENCHMARK_VISIBLE
        help
@@ -122,11 +122,11 @@ config CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT
        select CRYPTO_LIB_AES_CBC_MACS
        select CRYPTO_LIB_BLAKE2B
        select CRYPTO_LIB_CURVE25519
+       select CRYPTO_LIB_GF128HASH
        select CRYPTO_LIB_MD5
        select CRYPTO_LIB_MLDSA
        select CRYPTO_LIB_NH
        select CRYPTO_LIB_POLY1305
-       select CRYPTO_LIB_POLYVAL
        select CRYPTO_LIB_SHA1
        select CRYPTO_LIB_SHA256
        select CRYPTO_LIB_SHA512

diff --git a/lib/crypto/tests/polyval_kunit.c b/lib/crypto/tests/polyval_kunit.c
index f47f41a39a4162f8a1df87e86589953a3b88c86a..d1f53a690ab829e25fd2cb3a9ef546c5f091c42a 100644 (file)
--- a/lib/crypto/tests/polyval_kunit.c
+++ b/lib/crypto/tests/polyval_kunit.c
@@ -2,7 +2,7 @@
 /*
  * Copyright 2025 Google LLC
  */
-#include <crypto/polyval.h>
+#include <crypto/gf128hash.h>
 #include "polyval-testvecs.h"
 
 /*

diff --git a/lib/crypto/x86/polyval.h b/lib/crypto/x86/gf128hash.h
similarity index 95%
rename from lib/crypto/x86/polyval.h
rename to lib/crypto/x86/gf128hash.h
index ef879752142013d1530e861fe27fac80d17a43a8..fe506cf6431b2ab53ea00339a2b7d573fc39d5f8 100644 (file)
--- a/lib/crypto/x86/polyval.h
+++ b/lib/crypto/x86/gf128hash.h
@@ -74,8 +74,8 @@ static void polyval_blocks_arch(struct polyval_elem *acc,
        }
 }
 
-#define polyval_mod_init_arch polyval_mod_init_arch
-static void polyval_mod_init_arch(void)
+#define gf128hash_mod_init_arch gf128hash_mod_init_arch
+static void gf128hash_mod_init_arch(void)
 {
        if (boot_cpu_has(X86_FEATURE_PCLMULQDQ) &&
            boot_cpu_has(X86_FEATURE_AVX))