Commit 318c53ae authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: x86/poly1305 - Add block-only interface 



Add block-only interface.

Also remove the unnecessary SIMD fallback path.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 14d31979

arch/x86/lib/crypto/poly1305-x86_64-cryptogams.pl

+23 −10
Original line number Diff line number Diff line
@@ -118,6 +118,19 @@ sub declare_function() { 
	}

}



sub declare_typed_function() {

	my ($name, $align, $nargs) = @_;

	if($kernel) {

		$code .= "SYM_TYPED_FUNC_START($name)\n";

		$code .= ".L$name:\n";

	} else {

		$code .= ".globl	$name\n";

		$code .= ".type	$name,\@function,$nargs\n";

		$code .= ".align	$align\n";

		$code .= "$name:\n";

	}

}



sub end_function() {

	my ($name) = @_;

	if($kernel) {
@@ -128,7 +141,7 @@ sub end_function() { 
}



$code.=<<___ if $kernel;

#include <linux/linkage.h>

#include <linux/cfi_types.h>

___



if ($avx) {
@@ -236,14 +249,14 @@ ___ 
$code.=<<___ if (!$kernel);

.extern	OPENSSL_ia32cap_P



.globl	poly1305_init_x86_64

.hidden	poly1305_init_x86_64

.globl	poly1305_block_init_arch

.hidden	poly1305_block_init_arch

.globl	poly1305_blocks_x86_64

.hidden	poly1305_blocks_x86_64

.globl	poly1305_emit_x86_64

.hidden	poly1305_emit_x86_64

___

&declare_function("poly1305_init_x86_64", 32, 3);

&declare_typed_function("poly1305_block_init_arch", 32, 3);

$code.=<<___;

	xor	%eax,%eax

	mov	%rax,0($ctx)		# initialize hash value
@@ -298,7 +311,7 @@ $code.=<<___; 
.Lno_key:

	RET

___

&end_function("poly1305_init_x86_64");

&end_function("poly1305_block_init_arch");



&declare_function("poly1305_blocks_x86_64", 32, 4);

$code.=<<___;
@@ -4105,9 +4118,9 @@ avx_handler: 


.section	.pdata

.align	4

	.rva	.LSEH_begin_poly1305_init_x86_64

	.rva	.LSEH_end_poly1305_init_x86_64

	.rva	.LSEH_info_poly1305_init_x86_64

	.rva	.LSEH_begin_poly1305_block_init_arch

	.rva	.LSEH_end_poly1305_block_init_arch

	.rva	.LSEH_info_poly1305_block_init_arch



	.rva	.LSEH_begin_poly1305_blocks_x86_64

	.rva	.LSEH_end_poly1305_blocks_x86_64
@@ -4155,10 +4168,10 @@ ___ 
$code.=<<___;

.section	.xdata

.align	8

.LSEH_info_poly1305_init_x86_64:

.LSEH_info_poly1305_block_init_arch:

	.byte	9,0,0,0

	.rva	se_handler

	.rva	.LSEH_begin_poly1305_init_x86_64,.LSEH_begin_poly1305_init_x86_64

	.rva	.LSEH_begin_poly1305_block_init_arch,.LSEH_begin_poly1305_block_init_arch



.LSEH_info_poly1305_blocks_x86_64:

	.byte	9,0,0,0

arch/x86/lib/crypto/poly1305_glue.c

+46 −75
Original line number Diff line number Diff line
@@ -3,34 +3,15 @@ 
 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.

 */



#include <crypto/internal/simd.h>

#include <crypto/poly1305.h>

#include <asm/cpu_device_id.h>

#include <asm/fpu/api.h>

#include <crypto/internal/poly1305.h>

#include <linux/jump_label.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/sizes.h>

#include <linux/string.h>

#include <linux/unaligned.h>

#include <asm/cpu_device_id.h>

#include <asm/simd.h>



asmlinkage void poly1305_init_x86_64(void *ctx,

				     const u8 key[POLY1305_BLOCK_SIZE]);

asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp,

				       const size_t len, const u32 padbit);

asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],

				     const u32 nonce[4]);

asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],

				  const u32 nonce[4]);

asmlinkage void poly1305_blocks_avx(void *ctx, const u8 *inp, const size_t len,

				    const u32 padbit);

asmlinkage void poly1305_blocks_avx2(void *ctx, const u8 *inp, const size_t len,

				     const u32 padbit);

asmlinkage void poly1305_blocks_avx512(void *ctx, const u8 *inp,

				       const size_t len, const u32 padbit);



static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);



struct poly1305_arch_internal {

	union {
@@ -45,64 +26,50 @@ struct poly1305_arch_internal { 
	struct { u32 r2, r1, r4, r3; } rn[9];

};



/* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit

 * the unfortunate situation of using AVX and then having to go back to scalar

 * -- because the user is silly and has called the update function from two

 * separate contexts -- then we need to convert back to the original base before

 * proceeding. It is possible to reason that the initial reduction below is

 * sufficient given the implementation invariants. However, for an avoidance of

 * doubt and because this is not performance critical, we do the full reduction

 * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py

 */

static void convert_to_base2_64(void *ctx)

{

	struct poly1305_arch_internal *state = ctx;

	u32 cy;



	if (!state->is_base2_26)

		return;



	cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy;

	cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy;

	cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy;

	cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy;

	state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0];

	state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12);

	state->hs[2] = state->h[4] >> 24;

#define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))

	cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL);

	state->hs[2] &= 3;

	state->hs[0] += cy;

	state->hs[1] += (cy = ULT(state->hs[0], cy));

	state->hs[2] += ULT(state->hs[1], cy);

#undef ULT

	state->is_base2_26 = 0;

}

asmlinkage void poly1305_block_init_arch(

	struct poly1305_block_state *state,

	const u8 raw_key[POLY1305_BLOCK_SIZE]);

EXPORT_SYMBOL_GPL(poly1305_block_init_arch);

asmlinkage void poly1305_blocks_x86_64(struct poly1305_arch_internal *ctx,

				       const u8 *inp,

				       const size_t len, const u32 padbit);

asmlinkage void poly1305_emit_x86_64(const struct poly1305_state *ctx,

				     u8 mac[POLY1305_DIGEST_SIZE],

				     const u32 nonce[4]);

asmlinkage void poly1305_emit_avx(const struct poly1305_state *ctx,

				  u8 mac[POLY1305_DIGEST_SIZE],

				  const u32 nonce[4]);

asmlinkage void poly1305_blocks_avx(struct poly1305_arch_internal *ctx,

				    const u8 *inp, const size_t len,

				    const u32 padbit);

asmlinkage void poly1305_blocks_avx2(struct poly1305_arch_internal *ctx,

				     const u8 *inp, const size_t len,

				     const u32 padbit);

asmlinkage void poly1305_blocks_avx512(struct poly1305_arch_internal *ctx,

				       const u8 *inp,

				       const size_t len, const u32 padbit);



static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE])

{

	poly1305_init_x86_64(ctx, key);

}

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);



static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len,

				 const u32 padbit)

void poly1305_blocks_arch(struct poly1305_block_state *state, const u8 *inp,

			  unsigned int len, u32 padbit)

{

	struct poly1305_arch_internal *state = ctx;

	struct poly1305_arch_internal *ctx =

		container_of(&state->h.h, struct poly1305_arch_internal, h);



	/* SIMD disables preemption, so relax after processing each page. */

	BUILD_BUG_ON(SZ_4K < POLY1305_BLOCK_SIZE ||

		     SZ_4K % POLY1305_BLOCK_SIZE);



	if (!static_branch_likely(&poly1305_use_avx) ||

	    (len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) ||

	    !crypto_simd_usable()) {

		convert_to_base2_64(ctx);

	if (!static_branch_likely(&poly1305_use_avx)) {

		poly1305_blocks_x86_64(ctx, inp, len, padbit);

		return;

	}



	do {

		const size_t bytes = min_t(size_t, len, SZ_4K);

		const unsigned int bytes = min(len, SZ_4K);



		kernel_fpu_begin();

		if (static_branch_likely(&poly1305_use_avx512))
@@ -117,24 +84,26 @@ static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len, 
		inp += bytes;

	} while (len);

}

EXPORT_SYMBOL_GPL(poly1305_blocks_arch);



static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],

			       const u32 nonce[4])

void poly1305_emit_arch(const struct poly1305_state *ctx,

			u8 mac[POLY1305_DIGEST_SIZE], const u32 nonce[4])

{

	if (!static_branch_likely(&poly1305_use_avx))

		poly1305_emit_x86_64(ctx, mac, nonce);

	else

		poly1305_emit_avx(ctx, mac, nonce);

}

EXPORT_SYMBOL_GPL(poly1305_emit_arch);



void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])

{

	poly1305_simd_init(&dctx->h, key);

	dctx->s[0] = get_unaligned_le32(&key[16]);

	dctx->s[1] = get_unaligned_le32(&key[20]);

	dctx->s[2] = get_unaligned_le32(&key[24]);

	dctx->s[3] = get_unaligned_le32(&key[28]);

	dctx->buflen = 0;

	poly1305_block_init_arch(&dctx->state, key);

}

EXPORT_SYMBOL(poly1305_init_arch);
@@ -151,14 +120,15 @@ void poly1305_update_arch(struct poly1305_desc_ctx *dctx, const u8 *src, 
		dctx->buflen += bytes;



		if (dctx->buflen == POLY1305_BLOCK_SIZE) {

			poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1);

			poly1305_blocks_arch(&dctx->state, dctx->buf,

					     POLY1305_BLOCK_SIZE, 1);

			dctx->buflen = 0;

		}

	}



	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {

		bytes = round_down(srclen, POLY1305_BLOCK_SIZE);

		poly1305_simd_blocks(&dctx->h, src, bytes, 1);

		poly1305_blocks_arch(&dctx->state, src, bytes, 1);

		src += bytes;

		srclen -= bytes;

	}
@@ -176,10 +146,11 @@ void poly1305_final_arch(struct poly1305_desc_ctx *dctx, u8 *dst) 
		dctx->buf[dctx->buflen++] = 1;

		memset(dctx->buf + dctx->buflen, 0,

		       POLY1305_BLOCK_SIZE - dctx->buflen);

		poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0);

		poly1305_blocks_arch(&dctx->state, dctx->buf,

				     POLY1305_BLOCK_SIZE, 0);

	}



	poly1305_simd_emit(&dctx->h, dst, dctx->s);

	poly1305_emit_arch(&dctx->h, dst, dctx->s);

	memzero_explicit(dctx, sizeof(*dctx));

}

EXPORT_SYMBOL(poly1305_final_arch);