crypto: x86 AES-CBC encryption with multibuffer
Subsystems (2)
v2 cover crypto: x86 AES-CBC encryption with multibuffer
In reply to a message not in the archiveIn this patch series, we introduce AES CBC encryption that is parallelized on x86_64 cpu with XMM registers. The multi-buffer technique encrypt 8 data streams in parallel with SIMD instructions. Decryption is handled as in the existing AESNI Intel CBC implementation which can already parallelize decryption even for a single data stream.
Please see the multi-buffer whitepaper for details of the technique:
http://www.intel.com/content/www/us/en/communications/communications-ia-multi-buffer-paper.html
It is important that any driver uses this algorithm properly for scenarios where we have many data streams that can fill up the data lanes most of the time. It shouldn't be used when only a single data stream is expected mostly. Otherwise we may incurr extra delays when we have frequent gaps in data lanes, causing us to wait till data come in to fill the data lanes before initiating encryption. We may have to wait for flush operations to commence when no new data come in after some wait time. However we keep this extra delay to a minimum by opportunistically flushing the unfinished jobs if crypto daemon is the only active task running on a cpu.
By using this technique, we saw a throughput increase of up to 5.8x under optimal conditions when we have fully loaded encryption jobs filling up all the data lanes.
Change Log:
v2
1. Update cpu feature check to make sure SSE is supported
2. Fix up unloading of aes-cbc-mb module to properly free memory
Tim Chen (5):
crypto: Multi-buffer encryptioin infrastructure support
crypto: AES CBC multi-buffer data structures
crypto: AES CBC multi-buffer scheduler
crypto: AES CBC by8 encryption
crypto: AES CBC multi-buffer glue code
arch/x86/crypto/Makefile | 1 + arch/x86/crypto/aes-cbc-mb/Makefile | 22 + arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S | 774 ++++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c | 812 +++++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h | 96 +++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h | 131 ++++ arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c | 145 ++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S | 270 +++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S | 222 ++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S | 416 +++++++++++ arch/x86/crypto/aes-cbc-mb/reg_sizes.S | 125 ++++ crypto/Kconfig | 16 + crypto/blkcipher.c | 29 +- crypto/mcryptd.c | 256 ++++++- crypto/scatterwalk.c | 7 + include/crypto/algapi.h | 1 + include/crypto/mcryptd.h | 36 + include/crypto/scatterwalk.h | 6 + include/linux/crypto.h | 1 + 19 files changed, 3361 insertions(+), 5 deletions(-) create mode 100644 arch/x86/crypto/aes-cbc-mb/Makefile create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/reg_sizes.S
Signature · 1 line
1.7.11.7
PATCH v2 1/5 crypto: Multi-buffer encryptioin infrastructure support
In reply to a message not in the archiveIn this patch, the infrastructure needed to support multibuffer encryption implementation is added:
a) Enhace mcryptd daemon to support blkcipher requests.
b) Update configuration to include multi-buffer encryption build support.
c) Add support to crypto scatterwalk support that can sleep during encryption operation, as we may have buffers for jobs in data lanes that are half-finished, waiting for additional jobs to come to fill empty lanes before we start the encryption again. Therefore, we need to enhance crypto walk with the option to map data buffers non-atomically. This is done by algorithms run from crypto daemon who knows it is safe to do so as it can save and restore FPU state in correct context.
For an introduction to the multi-buffer implementation, please see
http://www.intel.com/content/www/us/en/communications/communications-ia-multi-buffer-paper.html
--- crypto/Kconfig | 16 +++ crypto/blkcipher.c | 29 ++++- crypto/mcryptd.c | 256 ++++++++++++++++++++++++++++++++++++++++++- crypto/scatterwalk.c | 7 ++ include/crypto/algapi.h | 1 + include/crypto/mcryptd.h | 36 ++++++ include/crypto/scatterwalk.h | 6 + include/linux/crypto.h | 1 + 8 files changed, 347 insertions(+), 5 deletions(-)
crypto/Kconfig +16 -0
@@ -888,6 +888,22 @@ config CRYPTO_AES_NI_INTEL ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional acceleration for CTR. +config CRYPTO_AES_CBC_MB + tristate "AES CBC algorithm (x86_64 Multi-Buffer, Experimental)" + depends on X86 && 64BIT + select CRYPTO_ABLK_HELPER + select CRYPTO_MCRYPTD + help + AES CBC encryption implemented using multi-buffer technique. + This algorithm computes on multiple data lanes concurrently with + SIMD instructions for better throughput. It should only be + used when there is significant work to generate many separate + crypto requests that keep all the data lanes filled to get + the performance benefit. If the data lanes are unfilled, a + flush operation will be initiated after some delay to process + the exisiting crypto jobs, adding some extra latency at low + load case. + config CRYPTO_AES_SPARC64 tristate "AES cipher algorithms (SPARC64)" depends on SPARC64
crypto/blkcipher.c +25 -4
@@ -35,6 +35,9 @@ enum {BLKCIPHER_WALK_SLOW =1 <<1 ,BLKCIPHER_WALK_COPY =1 <<2 ,BLKCIPHER_WALK_DIFF =1 <<3 , +/* deal with scenarios where we can sleep during sg walk */ +/* when we process part of a request */ + BLKCIPHER_WALK_MAY_SLEEP = 1 << 4, }; static int blkcipher_walk_next(struct blkcipher_desc *desc,
@@ -44,22 +47,38 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,static inline void blkcipher_map_src (struct blkcipher_walk *walk) { - walk->src.virt.addr =scatterwalk_map (&walk->in); +/* add support for asynchronous requests which need no atomic map */ +if (walk->flags &BLKCIPHER_WALK_MAY_SLEEP ) + walk->src.virt.addr =scatterwalk_map_nonatomic (&walk->in); +else + walk->src.virt.addr =scatterwalk_map (&walk->in); }static inline void blkcipher_map_dst (struct blkcipher_walk *walk) { - walk->dst.virt.addr =scatterwalk_map (&walk->out); +/* add support for asynchronous requests which need no atomic map */ +if (walk->flags &BLKCIPHER_WALK_MAY_SLEEP ) + walk->dst.virt.addr =scatterwalk_map_nonatomic (&walk->out); +else + walk->dst.virt.addr =scatterwalk_map (&walk->out); }static inline void blkcipher_unmap_src (struct blkcipher_walk *walk) { -scatterwalk_unmap (walk->src.virt.addr); +/* add support for asynchronous requests which need no atomic map */ +if (walk->flags &BLKCIPHER_WALK_MAY_SLEEP ) +scatterwalk_unmap_nonatomic (walk->src.virt.addr); +else +scatterwalk_unmap (walk->src.virt.addr); }static inline void blkcipher_unmap_dst (struct blkcipher_walk *walk) { -scatterwalk_unmap (walk->dst.virt.addr); +/* add support for asynchronous requests which need no atomic map */ +if (walk->flags &BLKCIPHER_WALK_MAY_SLEEP ) +scatterwalk_unmap_nonatomic (walk->dst.virt.addr); +else +scatterwalk_unmap (walk->dst.virt.addr); }/* Get a spot of the specified length that does not straddle a page.
@@ -299,6 +318,8 @@ static inline int blkcipher_copy_iv(struct blkcipher_walk *walk)int blkcipher_walk_virt (struct blkcipher_desc *desc,struct blkcipher_walk *walk) { +if (desc->flags &CRYPTO_TFM_SGWALK_MAY_SLEEP ) + walk->flags |=BLKCIPHER_WALK_MAY_SLEEP ; walk->flags &= ~BLKCIPHER_WALK_PHYS ; walk->walk_blocksize =crypto_blkcipher_blocksize (desc->tfm); walk->cipher_blocksize = walk->walk_blocksize;
crypto/mcryptd.c +255 -1
293 lines not on this page · raw message
crypto/scatterwalk.c +7 -0
@@ -47,6 +47,13 @@ void *scatterwalk_map(struct scatter_walk *walk) }EXPORT_SYMBOL_GPL (scatterwalk_map); +void *scatterwalk_map_nonatomic (struct scatter_walk *walk) +{ +return kmap (scatterwalk_page (walk)) + +offset_in_page (walk->offset); +} +EXPORT_SYMBOL_GPL (scatterwalk_map_nonatomic); +static void scatterwalk_pagedone (struct scatter_walk *walk,int out,unsigned int more) {
include/crypto/algapi.h +1 -0
@@ -301,6 +301,7 @@ static inline void blkcipher_walk_init(struct blkcipher_walk *walk, walk->in.sg = src; walk->out.sg = dst; walk->total = nbytes; + walk->flags =0 ; } static inline void ablkcipher_walk_init(struct ablkcipher_walk *walk,
include/crypto/mcryptd.h +36 -0
@@ -13,6 +13,7 @@#include <linux/crypto.h> #include <linux/kernel.h> #include <crypto/hash.h> +#include <crypto/b128ops.h> struct mcryptd_ahash {struct crypto_ahash base;
@@ -95,6 +96,41 @@ struct mcryptd_alg_state {unsigned long (*flusher)(struct mcryptd_alg_cstate *cstate); }; +struct mcryptd_ablkcipher { +struct crypto_ablkcipher base; +}; + +static inline struct mcryptd_ablkcipher *__mcryptd_ablkcipher_cast ( +struct crypto_ablkcipher *tfm) +{ +return (struct mcryptd_ablkcipher *)tfm; +} + +/* alg_name should be algorithm to be cryptd-ed */ +struct mcryptd_ablkcipher *mcryptd_alloc_ablkcipher (const char *alg_name, +u32 type,u32 mask); +struct crypto_blkcipher *mcryptd_ablkcipher_child ( +struct mcryptd_ablkcipher *tfm); +void mcryptd_free_ablkcipher (struct mcryptd_ablkcipher *tfm); + +struct mcryptd_blkcipher_ctx { +struct crypto_blkcipher *child; +struct mcryptd_alg_state *alg_state; +}; + +struct mcryptd_blkcipher_request_ctx { +struct list_head waiter; +crypto_completion_t complete; +struct mcryptd_tag tag; +struct blkcipher_walk walk; +u8 flag; +int nbytes; +int error; +struct blkcipher_desc desc; +void *job; +u128 seq_iv;/* running iv of a sequence */ +}; +/* return delay in jiffies from current time */ static inline unsigned long get_delay (unsigned long t) {
include/crypto/scatterwalk.h +6 -0
@@ -83,10 +83,16 @@ static inline void scatterwalk_unmap(void *vaddr)kunmap_atomic (vaddr); } +static inline void scatterwalk_unmap_nonatomic (void *vaddr) +{ +kunmap (vaddr); +} +void scatterwalk_start (struct scatter_walk *walk,struct scatterlist *sg);void scatterwalk_copychunks (void *buf,struct scatter_walk *walk,size_t nbytes,int out);void *scatterwalk_map (struct scatter_walk *walk); +void *scatterwalk_map_nonatomic (struct scatter_walk *walk);void scatterwalk_done (struct scatter_walk *walk,int out,int more); void scatterwalk_map_and_copy(void *buf, struct scatterlist *sg,
include/linux/crypto.h +1 -0
@@ -115,6 +115,7 @@#define CRYPTO_TFM_RES_BAD_KEY_SCHED 0x00400000#define CRYPTO_TFM_RES_BAD_BLOCK_LEN 0x00800000#define CRYPTO_TFM_RES_BAD_FLAGS 0x01000000 +#define CRYPTO_TFM_SGWALK_MAY_SLEEP 0x02000000/* * Miscellaneous stuff.
Signature · 1 line
1.7.11.7
PATCH v2 2/5 crypto: AES CBC multi-buffer data structures
In reply to a message not in the archiveThis patch introduces the data structures and prototypes of functions needed for doing AES CBC encryption using multi-buffer. Included are the structures of the multi-buffer AES CBC job, job scheduler in C and data structure defines in x86 assembly code.
--- arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h | 96 +++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h | 131 ++++++++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S | 270 +++++++++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/reg_sizes.S | 125 ++++++++++++ 4 files changed, 622 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S create mode 100644 arch/x86/crypto/aes-cbc-mb/reg_sizes.S
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h new file +96 -0
@@ -0,0 +1,96 @@ +/* +* Header file for multi buffer AES CBC algorithm manager +* that deals with 8 buffers at a time +* +* +* This file is provided under a dual BSD/GPLv2 license. When using or +* redistributing this file, you may do so under either license. +* +* GPL LICENSE SUMMARY +* +* Copyright(c) 2015 Intel Corporation. +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of version 2 of the GNU General Public License as +* published by the Free Software Foundation. +* +* This program is distributed in the hope that it will be useful, but +* WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* General Public License for more details. +* +* Contact Information: +* James Guilford <[email protected]> +* Sean Gulley <[email protected]> +* Tim Chen <[email protected]> +* +* BSD LICENSE +* +* Copyright(c) 2015 Intel Corporation. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in +* the documentation and/or other materials provided with the +* distribution. +* Neither the name of Intel Corporation nor the names of its +* contributors may be used to endorse or promote products derived +* from this software without specific prior written permission. +* +* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +* +*/ +#ifndef __AES_CBC_MB_CTX_H +#define __AES_CBC_MB_CTX_H + + +#include <linux/types.h> + +#include "aes_cbc_mb_mgr.h" + +#define CBC_ENCRYPT 0x01 +#define CBC_DECRYPT 0x02 +#define CBC_START 0x04 +#define CBC_DONE 0x08 + +#define CBC_CTX_STS_IDLE 0x00 +#define CBC_CTX_STS_PROCESSING 0x01 +#define CBC_CTX_STS_LAST 0x02 +#define CBC_CTX_STS_COMPLETE 0x04 + +enum cbc_ctx_error { +CBC_CTX_ERROR_NONE =0 , +CBC_CTX_ERROR_INVALID_FLAGS =-1 , +CBC_CTX_ERROR_ALREADY_PROCESSING =-2 , +CBC_CTX_ERROR_ALREADY_COMPLETED =-3 , +}; + +#define cbc_ctx_init (ctx, nbytes, op) \ + do { \ + (ctx)->flag = (op) | CBC_START; \ + (ctx)->nbytes = nbytes; \ + } while (0) + +/* AESNI routines to perform cbc decrypt and key expansion */ + +asmlinkage void aesni_cbc_dec(struct crypto_aes_ctx *ctx, u8 *out, +const u8 *in,unsigned int len,u8 *iv); +asmlinkage int aesni_set_key(struct crypto_aes_ctx *ctx, const u8 *in_key, +unsigned int key_len); + +#endif /* __AES_CBC_MB_CTX_H */
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h new file +131 -0
131 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S new file +270 -0
270 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/reg_sizes.S new file +125 -0
125 lines not on this page · raw message
Signature · 1 line
1.7.11.7
PATCH v2 3/5 crypto: AES CBC multi-buffer scheduler
In reply to a message not in the archiveThis patch implements in-order scheduler for encrypting multiple buffers in parallel supporting AES CBC encryption with key sizes of 128, 192 and 256 bits. It uses 8 data lanes by taking advantage of the SIMD instructions with XMM registers.
The multibuffer manager and scheduler is mostly written in assembly and the initialization support is written C. The AES CBC multibuffer crypto driver support interfaces with the multibuffer manager and scheduler to support AES CBC encryption in parallel. The scheduler supports job submissions, job flushing and and job retrievals after completion.
The basic flow of usage of the CBC multibuffer scheduler is as follows:
- The caller allocates an aes_cbc_mb_mgr_inorder_x8 object and initializes it once by calling aes_cbc_init_mb_mgr_inorder_x8().
- The aes_cbc_mb_mgr_inorder_x8 structure has an array of JOB_AES objects. Allocation and scheduling of JOB_AES objects are managed by the multibuffer scheduler support routines. The caller allocates a JOB_AES using aes_cbc_get_next_job_inorder_x8().
- The returned JOB_AES must be filled in with parameters for CBC encryption (eg: plaintext buffer, ciphertext buffer, key, iv, etc) and submitted to the manager object using aes_cbc_submit_job_inorder_xx().
- If the oldest JOB_AES is completed during a call to aes_cbc_submit_job_inorder_x8(), it is returned. Otherwise, NULL is returned.
- A call to aes_cbc_flush_job_inorder_x8() always returns the oldest job, unless the multibuffer manager is empty of jobs.
- A call to aes_cbc_get_completed_job_inorder_x8() returns a completed job. This routine is useful to process completed jobs instead of waiting for the flusher to engage.
- When a job is returned from submit or flush, the caller extracts the useful data and returns it to the multibuffer manager implicitly by the next call to aes_cbc_get_next_job_xx().
Jobs are always returned from submit or flush routines in the order they were submitted (hence "inorder").A job allocated using aes_cbc_get_next_job_inorder_x8() must be filled in and submitted before another call. A job returned by aes_cbc_submit_job_inorder_x8() or aes_cbc_flush_job_inorder_x8() is 'deallocated' upon the next call to get a job structure. Calls to get_next_job() cannot fail. If all jobs are allocated after a call to get_next_job(), the subsequent call to submit always returns the oldest job in a completed state.
--- arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c | 145 +++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S | 222 +++++++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S | 416 +++++++++++++++++++++ 3 files changed, 783 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S
arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c new file +145 -0
@@ -0,0 +1,145 @@ +/* +* Initialization code for multi buffer AES CBC algorithm +* +* +* This file is provided under a dual BSD/GPLv2 license. When using or +* redistributing this file, you may do so under either license. +* +* GPL LICENSE SUMMARY +* +* Copyright(c) 2015 Intel Corporation. +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of version 2 of the GNU General Public License as +* published by the Free Software Foundation. +* +* This program is distributed in the hope that it will be useful, but +* WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* General Public License for more details. +* +* Contact Information: +* James Guilford <[email protected]> +* Sean Gulley <[email protected]> +* Tim Chen <[email protected]> +* +* BSD LICENSE +* +* Copyright(c) 2015 Intel Corporation. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in +* the documentation and/or other materials provided with the +* distribution. +* Neither the name of Intel Corporation nor the names of its +* contributors may be used to endorse or promote products derived +* from this software without specific prior written permission. +* +* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +* +*/ + +#include "aes_cbc_mb_mgr.h" + +void aes_cbc_init_mb_mgr_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +/* Init "out of order" components */ + state->unused_lanes =0xF76543210 ; + state->job_in_lane[0 ] =NULL ; + state->job_in_lane[1 ] =NULL ; + state->job_in_lane[2 ] =NULL ; + state->job_in_lane[3 ] =NULL ; + state->job_in_lane[4 ] =NULL ; + state->job_in_lane[5 ] =NULL ; + state->job_in_lane[6 ] =NULL ; + state->job_in_lane[7 ] =NULL ; + +/* Init "in order" components */ + state->next_job =0 ; + state->earliest_job =-1 ; + +} + +#define JOBS (offset) ((struct job_aes_cbc *)(((u64)state->jobs)+offset)) + +struct job_aes_cbc * +aes_cbc_get_next_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +return JOBS (state->next_job); +} + +struct job_aes_cbc * +aes_cbc_flush_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +struct job_aes_cbc *job; + +/* checking earliest_job < 0 fails and the code walks over bogus */ +if (state->earliest_job ==-1 ) +return NULL ;/* empty */ + + job =JOBS (state->earliest_job); +while (job->status !=STS_COMPLETED ) { +switch (job->key_len) { +case AES_KEYSIZE_128 : +aes_cbc_flush_job_ooo_128x8 (state); +break ; +case AES_KEYSIZE_192 : +aes_cbc_flush_job_ooo_192x8 (state); +break ; +case AES_KEYSIZE_256 : +aes_cbc_flush_job_ooo_256x8 (state); +break ; +default : +break ; + } + } + +/* advance earliest job */ + state->earliest_job +=sizeof (struct job_aes_cbc ); +if (state->earliest_job ==MAX_AES_JOBS *sizeof (struct job_aes_cbc )) + state->earliest_job =0 ; + +if (state->earliest_job == state->next_job) + state->earliest_job =-1 ; + +return job; +} + +struct job_aes_cbc * +aes_cbc_get_completed_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +struct job_aes_cbc *job; + +if (state->earliest_job ==-1 ) +return NULL ;/* empty */ + + job =JOBS (state->earliest_job); +if (job->status !=STS_COMPLETED ) +return NULL ; + + state->earliest_job +=sizeof (struct job_aes_cbc ); + +if (state->earliest_job ==MAX_AES_JOBS *sizeof (struct job_aes_cbc )) + state->earliest_job =0 ; +if (state->earliest_job == state->next_job) + state->earliest_job =-1 ; + +/* we have a completed job */ +return job; +}
arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S new file +222 -0
222 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S new file +416 -0
416 lines not on this page · raw message
Signature · 1 line
1.7.11.7
PATCH v2 4/5 crypto: AES CBC by8 encryption
In reply to a message not in the archiveThis patch introduces the assembly routine to do a by8 AES CBC encryption in support of the AES CBC multi-buffer implementation.
Encryption of 8 data streams of a key size are done simultaneously.
--- arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S | 774 ++++++++++++++++++++++++++++ 1 file changed, 774 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S
arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S new file +774 -0
@@ -0,0 +1,774 @@ +/* + * AES CBC by8 multibuffer optimization (x86_64) + * This file implements 128/192/256 bit AES CBC encryption + * + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. + * + * GPL LICENSE SUMMARY + * + * Copyright(c) 2015 Intel Corporation. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * Contact Information: + * James Guilford <[email protected]> + * Sean Gulley <[email protected]> + * Tim Chen <[email protected]> + * + * BSD LICENSE + * + * Copyright(c) 2015 Intel Corporation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * Neither the name of Intel Corporation nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ +#include <linux/linkage.h> + +/* stack size needs to be an odd multiple of 8 for alignment */ + +#define AES_KEYSIZE_128 16 +#define AES_KEYSIZE_192 24 +#define AES_KEYSIZE_256 32 + +#define XMM_SAVE_SIZE 16*10 +#define GPR_SAVE_SIZE 8*9 +#define STACK_SIZE (XMM_SAVE_SIZE + GPR_SAVE_SIZE) + +#define GPR_SAVE_REG %rsp +#define GPR_SAVE_AREA %rsp + XMM_SAVE_SIZE +#define LEN_AREA_OFFSET XMM_SAVE_SIZE + 8*8 +#define LEN_AREA_REG %rsp +#define LEN_AREA %rsp + XMM_SAVE_SIZE + 8*8 + +#define IN_OFFSET 0 +#define OUT_OFFSET 8*8 +#define KEYS_OFFSET 16*8 +#define IV_OFFSET 24*8 + + +#define IDX %rax +#define TMP %rbx +#define ARG %rdi +#define LEN %rsi + +#define KEYS0 %r14 +#define KEYS1 %r15 +#define KEYS2 %rbp +#define KEYS3 %rdx +#define KEYS4 %rcx +#define KEYS5 %r8 +#define KEYS6 %r9 +#define KEYS7 %r10 + +#define IN0 %r11 +#define IN2 %r12 +#define IN4 %r13 +#define IN6 LEN + +#define XDATA0 %xmm0 +#define XDATA1 %xmm1 +#define XDATA2 %xmm2 +#define XDATA3 %xmm3 +#define XDATA4 %xmm4 +#define XDATA5 %xmm5 +#define XDATA6 %xmm6 +#define XDATA7 %xmm7 + +#define XKEY0_3 %xmm8 +#define XKEY1_4 %xmm9 +#define XKEY2_5 %xmm10 +#define XKEY3_6 %xmm11 +#define XKEY4_7 %xmm12 +#define XKEY5_8 %xmm13 +#define XKEY6_9 %xmm14 +#define XTMP %xmm15 + +#define MOVDQ movdqu /* assume buffers not aligned */ +#define CONCAT(a, b) a##b +#define INPUT_REG_SUFX 1 /* IN */ +#define XDATA_REG_SUFX 2 /* XDAT */ +#define KEY_REG_SUFX 3 /* KEY */ +#define XMM_REG_SUFX 4 /* XMM */ + +/* + * To avoid positional parameter errors while compiling + * three registers need to be passed + */ +.text + +.macro pxor2 x, y, z + MOVDQ (\x,\y), XTMP + pxor XTMP, \z +.endm + +.macro inreg n + .if (\n == 0) + reg_IN = IN0 + .elseif (\n == 2) + reg_IN = IN2 + .elseif (\n == 4) + reg_IN = IN4 + .elseif (\n == 6) + reg_IN = IN6 + .else + error "inreg: incorrect register number" + .endif +.endm +.macro xdatareg n + .if (\n == 0) + reg_XDAT = XDATA0 + .elseif (\n == 1) + reg_XDAT = XDATA1 + .elseif (\n == 2) + reg_XDAT = XDATA2 + .elseif (\n == 3) + reg_XDAT = XDATA3 + .elseif (\n == 4) + reg_XDAT = XDATA4 + .elseif (\n == 5) + reg_XDAT = XDATA5 + .elseif (\n == 6) + reg_XDAT = XDATA6 + .elseif (\n == 7) + reg_XDAT = XDATA7 + .endif +.endm +.macro xkeyreg n + .if (\n == 0) + reg_KEY = KEYS0 + .elseif (\n == 1) + reg_KEY = KEYS1 + .elseif (\n == 2) + reg_KEY = KEYS2 + .elseif (\n == 3) + reg_KEY = KEYS3 + .elseif (\n == 4) + reg_KEY = KEYS4 + .elseif (\n == 5) + reg_KEY = KEYS5 + .elseif (\n == 6) + reg_KEY = KEYS6 + .elseif (\n == 7) + reg_KEY = KEYS7 + .endif +.endm +.macro xmmreg n + .if (\n >= 0) && (\n < 16) + /* Valid register number */ + reg_XMM = %xmm\n + .else + error "xmmreg: incorrect register number" + .endif +.endm + +/* + * suffix - register suffix + * set up the register name using the loop index I + */ +.macro define_reg suffix +.altmacro + .if (\suffix == INPUT_REG_SUFX) + inreg %I + .elseif (\suffix == XDATA_REG_SUFX) + xdatareg %I + .elseif (\suffix == KEY_REG_SUFX) + xkeyreg %I + .elseif (\suffix == XMM_REG_SUFX) + xmmreg %I + .else + error "define_reg: unknown register suffix" + .endif +.noaltmacro +.endm + +/* + * aes_cbc_enc_x8 key_len + * macro to encode data for 128bit, 192bit and 256bit keys + */ + +.macro aes_cbc_enc_x8 key_len + + sub $STACK_SIZE, %rsp + + mov %rbx, (XMM_SAVE_SIZE + 8*0)(GPR_SAVE_REG) + mov %rbp, (XMM_SAVE_SIZE + 8*3)(GPR_SAVE_REG) + mov %r12, (XMM_SAVE_SIZE + 8*4)(GPR_SAVE_REG) + mov %r13, (XMM_SAVE_SIZE + 8*5)(GPR_SAVE_REG) + mov %r14, (XMM_SAVE_SIZE + 8*6)(GPR_SAVE_REG) + mov %r15, (XMM_SAVE_SIZE + 8*7)(GPR_SAVE_REG) + + mov $16, IDX + shl $4, LEN /* LEN = LEN * 16 */ + /* LEN is now in terms of bytes */ + mov LEN, (LEN_AREA_OFFSET)(LEN_AREA_REG) + + /* Run through storing arguments in IN0,2,4,6 */ + I = 0 + .rept 4 + define_reg INPUT_REG_SUFX + mov (IN_OFFSET + 8*I)(ARG), reg_IN + I = (I + 2) + .endr + + /* load 1 .. 8 blocks of plain text into XDATA0..XDATA7 */ + I = 0 + .rept 4 + mov (IN_OFFSET + 8*(I+1))(ARG), TMP + define_reg INPUT_REG_SUFX + define_reg XDATA_REG_SUFX + /* load first block of plain text */ + MOVDQ (reg_IN), reg_XDAT + I = (I + 1) + define_reg XDATA_REG_SUFX + /* load next block of plain text */ + MOVDQ (TMP), reg_XDAT + I = (I + 1) + .endr + + /* Run through XDATA0 .. XDATA7 to perform plaintext XOR IV */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + pxor (IV_OFFSET + 16*I)(ARG), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 8 + define_reg KEY_REG_SUFX + mov (KEYS_OFFSET + 8*I)(ARG), reg_KEY + I = (I + 1) + .endr + + I = 0 + /* 0..7 ARK */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + pxor 16*0(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + /* 1. ENC */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*1)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + movdqa 16*3(KEYS0), XKEY0_3 /* load round 3 key */ + + I = 0 + /* 2. ENC */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*2)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + movdqa 16*4(KEYS1), XKEY1_4 /* load round 4 key */ + + /* 3. ENC */ + aesenc XKEY0_3, XDATA0 + I = 1 + .rept 7 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*3)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* + * FIXME: + * why can't we reorder encrypt DATA0..DATA7 and load 5th round? + */ + aesenc (16*4)(KEYS0), XDATA0 /* 4. ENC */ + movdqa 16*5(KEYS2), XKEY2_5 /* load round 5 key */ + aesenc XKEY1_4, XDATA1 /* 4. ENC */ + + I = 2 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*4)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + aesenc (16*5)(KEYS0), XDATA0 /* 5. ENC */ + aesenc (16*5)(KEYS1), XDATA1 /* 5. ENC */ + movdqa 16*6(KEYS3), XKEY3_6 /* load round 6 key */ + aesenc XKEY2_5, XDATA2 /* 5. ENC */ + I = 3 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*5)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + aesenc (16*6)(KEYS0), XDATA0 /* 6. ENC */ + aesenc (16*6)(KEYS1), XDATA1 /* 6. ENC */ + aesenc (16*6)(KEYS2), XDATA2 /* 6. ENC */ + movdqa 16*7(KEYS4), XKEY4_7 /* load round 7 key */ + aesenc XKEY3_6, XDATA3 /* 6. ENC */ + + I = 4 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*6)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*7)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + movdqa 16*8(KEYS5), XKEY5_8 /* load round 8 key */ + aesenc XKEY4_7, XDATA4 /* 7. ENC */ + I = 5 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*7)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*8)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + movdqa 16*9(KEYS6), XKEY6_9 /* load round 9 key */ + aesenc XKEY5_8, XDATA5 /* 8. ENC */ + aesenc 16*8(KEYS6), XDATA6 /* 8. ENC */ + aesenc 16*8(KEYS7), XDATA7 /* 8. ENC */ + + I = 0 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*9)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + mov (OUT_OFFSET + 8*0)(ARG), TMP + aesenc XKEY6_9, XDATA6 /* 9. ENC */ + aesenc 16*9(KEYS7), XDATA7 /* 9. ENC */ + + /* 10. ENC (last for 128bit keys) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_128) + aesenclast (16*10)(reg_KEY), reg_XDAT + .else + aesenc (16*10)(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if (\key_len != AES_KEYSIZE_128) + /* 11. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*11)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 12. ENC (last for 192bit key) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_192) + aesenclast (16*12)(reg_KEY), reg_XDAT + .else + aesenc (16*12)(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + /* for 256bit, two more rounds */ + .if \key_len == AES_KEYSIZE_256 + + /* 13. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*13)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 14. ENC last encode for 256bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenclast (16*14)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + .endif + + .endif + + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + MOVDQ reg_XDAT, (TMP) /* write back ciphertext */ + I = (I + 1) + .if (I < 8) + mov (OUT_OFFSET + 8*I)(ARG), TMP + .endif + .endr + + cmp IDX, LEN_AREA_OFFSET(LEN_AREA_REG) + je .Ldone\key_len + +.Lmain_loop\key_len: + mov (IN_OFFSET + 8*1)(ARG), TMP + pxor2 IN0, IDX, XDATA0 /* next block of plain text */ + pxor2 TMP, IDX, XDATA1 /* next block of plain text */ + + mov (IN_OFFSET + 8*3)(ARG), TMP + pxor2 IN2, IDX, XDATA2 /* next block of plain text */ + pxor2 TMP, IDX, XDATA3 /* next block of plain text */ + + mov (IN_OFFSET + 8*5)(ARG), TMP + pxor2 IN4, IDX, XDATA4 /* next block of plain text */ + pxor2 TMP, IDX, XDATA5 /* next block of plain text */ + + mov (IN_OFFSET + 8*7)(ARG), TMP + pxor2 IN6, IDX, XDATA6 /* next block of plain text */ + pxor2 TMP, IDX, XDATA7 /* next block of plain text */ + + /* 0. ARK */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + pxor 16*0(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 1. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*1(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 2. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*2(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 3. ENC */ + aesenc XKEY0_3, XDATA0 /* 3. ENC */ + I = 1 + .rept 7 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*3(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 4. ENC */ + aesenc 16*4(KEYS0), XDATA0 /* 4. ENC */ + aesenc XKEY1_4, XDATA1 /* 4. ENC */ + I = 2 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*4(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 5. ENC */ + aesenc 16*5(KEYS0), XDATA0 /* 5. ENC */ + aesenc 16*5(KEYS1), XDATA1 /* 5. ENC */ + aesenc XKEY2_5, XDATA2 /* 5. ENC */ + + I = 3 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*5(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 6. ENC */ + I = 0 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*6(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY3_6, XDATA3 /* 6. ENC */ + I = 4 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*6(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 7. ENC */ + I = 0 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*7(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY4_7, XDATA4 /* 7. ENC */ + I = 5 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*7(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 8. ENC */ + I = 0 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*8(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY5_8, XDATA5 /* 8. ENC */ + aesenc 16*8(KEYS6), XDATA6 /* 8. ENC */ + aesenc 16*8(KEYS7), XDATA7 /* 8. ENC */ + + /* 9. ENC */ + I = 0 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*9(reg_KEY), reg_XDAT + I = (I + 1) + .endr + mov (OUT_OFFSET + 8*0)(ARG), TMP + aesenc XKEY6_9, XDATA6 /* 9. ENC */ + aesenc 16*9(KEYS7), XDATA7 /* 9. ENC */ + + /* 10. ENC (last for 128 bit key) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_128) + aesenclast 16*10(reg_KEY), reg_XDAT + .else + aesenc 16*10(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if (\key_len != AES_KEYSIZE_128) + /* 11. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*11(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 12. last ENC for 192bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_192) + aesenclast 16*12(reg_KEY), reg_XDAT + .else + aesenc 16*12(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if \key_len == AES_KEYSIZE_256 + /* for 256bit, two more rounds */ + /* 13. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*13(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 14. last ENC for 256bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenclast 16*14(reg_KEY), reg_XDAT + I = (I + 1) + .endr + .endif + .endif + + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + /* write back cipher text */ + MOVDQ reg_XDAT, (TMP , IDX) + I = (I + 1) + .if (I < 8) + mov (OUT_OFFSET + 8*I)(ARG), TMP + .endif + .endr + + add $16, IDX + cmp IDX, LEN_AREA_OFFSET(LEN_AREA_REG) + jne .Lmain_loop\key_len + +.Ldone\key_len: + /* update IV */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + movdqa reg_XDAT, (IV_OFFSET + 16*I)(ARG) + I = (I + 1) + .endr + + /* update IN and OUT */ + movd LEN_AREA_OFFSET(LEN_AREA_REG), %xmm0 + pshufd $0x44, %xmm0, %xmm0 + + I = 1 + .rept 4 + define_reg XMM_REG_SUFX + movdqa (IN_OFFSET + 16*(I-1))(ARG), reg_XMM + I = (I + 1) + .endr + + paddq %xmm0, %xmm1 + paddq %xmm0, %xmm2 + paddq %xmm0, %xmm3 + paddq %xmm0, %xmm4 + + I = 5 + .rept 4 + define_reg XMM_REG_SUFX + movdqa (OUT_OFFSET + 16*(I-5))(ARG), reg_XMM + I = (I + 1) + .endr + + I = 1 + .rept 4 + define_reg XMM_REG_SUFX + movdqa reg_XMM, (IN_OFFSET + 16*(I-1))(ARG) + I = (I + 1) + .endr + + paddq %xmm0, %xmm5 + paddq %xmm0, %xmm6 + paddq %xmm0, %xmm7 + paddq %xmm0, %xmm8 + + I = 5 + .rept 4 + define_reg XMM_REG_SUFX + movdqa reg_XMM, (OUT_OFFSET + 16*(I-5))(ARG) + I = (I + 1) + .endr + + mov (XMM_SAVE_SIZE + 8*0)(GPR_SAVE_REG), %rbx + mov (XMM_SAVE_SIZE + 8*3)(GPR_SAVE_REG), %rbp + mov (XMM_SAVE_SIZE + 8*4)(GPR_SAVE_REG), %r12 + mov (XMM_SAVE_SIZE + 8*5)(GPR_SAVE_REG), %r13 + mov (XMM_SAVE_SIZE + 8*6)(GPR_SAVE_REG), %r14 + mov (XMM_SAVE_SIZE + 8*7)(GPR_SAVE_REG), %r15 + + add $STACK_SIZE, %rsp + + ret +.endm + +/* + * AES CBC encryption routine supporting 128/192/256 bit keys + * + * void aes_cbc_enc_128_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of AES_ARGS_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + * void aes_cbc_enc_192_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of aes_cbc_args_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + * void aes_cbc_enc_256_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of aes_cbc_args_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + */ + +ENTRY(aes_cbc_enc_128_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_128 + +ENDPROC(aes_cbc_enc_128_x8) + +ENTRY(aes_cbc_enc_192_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_192 + +ENDPROC(aes_cbc_enc_192_x8) + +ENTRY(aes_cbc_enc_256_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_256 + +ENDPROC(aes_cbc_enc_256_x8)
Signature · 1 line
1.7.11.7
PATCH v2 5/5 crypto: AES CBC multi-buffer glue code
In reply to a message not in the archiveThis patch introduces the multi-buffer job manager which is responsible for submitting scatter-gather buffers from several AES CBC jobs to the multi-buffer algorithm. The glue code interfaces with the underlying algorithm that handles 8 data streams of AES CBC encryption in parallel. AES key expansion and CBC decryption requests are performed in a manner similar to the existing AESNI Intel glue driver.
The outline of the algorithm for AES CBC encryption requests is sketched below:
Any driver requesting the crypto service will place an async crypto request on the workqueue. The multi-buffer crypto daemon will pull an AES CBC encryption request from work queue and put each request in an empty data lane for multi-buffer crypto computation. When all the empty lanes are filled, computation will commence on the jobs in parallel and the job with the shortest remaining buffer will get completed and be returned. To prevent prolonged stall, when no new jobs arrive, we will flush workqueue of jobs after a maximum allowable delay has elapsed.
To accommodate the fragmented nature of scatter-gather, we will keep submitting the next scatter-buffer fragment for a job for multi-buffer computation until a job is completed and no more buffer fragments remain. At that time we will pull a new job to fill the now empty data slot. We check with the multibuffer scheduler to see if there are other completed jobs to prevent extraneous delay in returning any completed jobs.
This multi-buffer algorithm should be used for cases where we get at least 8 streams of crypto jobs submitted at a reasonably high rate. For low crypto job submission rate and low number of data streams, this algorithm will not be beneficial. The reason is at low rate, we do not fill out the data lanes before flushing the jobs instead of processing them with all the data lanes full. We will miss the benefit of parallel computation, and adding delay to the processing of the crypto job at the same time. Some tuning of the maximum latency parameter may be needed to get the best performance.
--- arch/x86/crypto/Makefile | 1 + arch/x86/crypto/aes-cbc-mb/Makefile | 22 + arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c | 812 ++++++++++++++++++++++++++++++++ 3 files changed, 835 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/Makefile create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c
arch/x86/crypto/Makefile +1 -0
@@ -33,6 +33,7 @@ obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o obj-$(CONFIG_CRYPTO_CRCT10DIF_PCLMUL) += crct10dif-pclmul.o +obj-$(CONFIG_CRYPTO_AES_CBC_MB) += aes-cbc-mb/ obj-$(CONFIG_CRYPTO_POLY1305_X86_64) += poly1305-x86_64.o # These modules require assembler to support AVX.
arch/x86/crypto/aes-cbc-mb/Makefile new file +22 -0
@@ -0,0 +1,22 @@ +# +# Arch-specific CryptoAPI modules. +# + +avx_supported := $(call as-instr,vpxor %xmm0$(comma)%xmm0$(comma)%xmm0,yes,no) + +# we need decryption and key expansion routine symbols +# if either AESNI_NI_INTEL or AES_CBC_MB is a module + +ifeq ($(CONFIG_CRYPTO_AES_NI_INTEL),m) + dec_support := ../aesni-intel_asm.o +endif +ifeq ($(CONFIG_CRYPTO_AES_CBC_MB),m) + dec_support := ../aesni-intel_asm.o +endif + +ifeq ($(avx_supported),yes) + obj-$(CONFIG_CRYPTO_AES_CBC_MB) += aes-cbc-mb.o + aes-cbc-mb-y := $(dec_support) aes_cbc_mb.o aes_mb_mgr_init.o \ + mb_mgr_inorder_x8_asm.o mb_mgr_ooo_x8_asm.o \ + aes_cbc_enc_x8.o +endif
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +812 -0
812 lines not on this page · raw message
Signature · 1 line
1.7.11.7
Herbert Xu
maintainerRe: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
In reply to Tim ChenQuoted 8 lines · Tim Chen
c) Add support to crypto scatterwalk support that can sleep during encryption operation, as we may have buffers for jobs in data lanes that are half-finished, waiting for additional jobs to come to fill empty lanes before we start the encryption again. Therefore, we need to enhance crypto walk with the option to map data buffers non-atomically. This is done by algorithms run from crypto daemon who knows it is safe to do so as it can save and restore FPU state in correct context.
What about the existing ablkcipher scatterwalk helpers?
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 10 lines · Herbert Xu
Quoted 8 lines · Tim Chen
c) Add support to crypto scatterwalk support that can sleep during encryption operation, as we may have buffers for jobs in data lanes that are half-finished, waiting for additional jobs to come to fill empty lanes before we start the encryption again. Therefore, we need to enhance crypto walk with the option to map data buffers non-atomically. This is done by algorithms run from crypto daemon who knows it is safe to do so as it can save and restore FPU state in correct context.
Quoted 3 lines
What about the existing ablkcipher scatterwalk helpers?
Cheers,
I suppose blkcipher was originally used because we were under the impression that there are less buffer copying and less allocation of intermediate buffers
with blkcipher walk.
But looking at the blkcipher walk and ablkcipher
walk code more carefully now, I am not sure that's really true as it seems like ablkcipher keep all intermediate buffers till the end and copy them to destination in one shot while blkcipher does that at walk of every chunk. The advantage of blkcipher is you don't have as many outstanding buffers in a list. If there's really not much speed difference, I can try to use ablkcipher.
Herbert, would you prefer me to use ablkcipher scatter walk instead, assuming the overhead of both walk are about the same?
Thanks.
Tim
Herbert Xu
maintainerRe: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 3 lines · Tim Chen
Herbert, would you prefer me to use ablkcipher scatter walk instead, assuming the overhead of both walk are about the same?
Well since you are going to potentially sleep in the middle of an operation I'd think ablkcipher is required, no?
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 7 lines · Herbert Xu
Quoted 3 lines · Tim Chen
Herbert, would you prefer me to use ablkcipher scatter walk instead, assuming the overhead of both walk are about the same?
Well since you are going to potentially sleep in the middle of an operation I'd think ablkcipher is required, no?
We're using blkcipher walk in the implementation. As long as we use kmap and instead of kmap_atomic, it allows us to sleep in the middle of the walk.
Tim
Herbert Xu
maintainerRe: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 6 lines · Tim Chen
Quoted 5 lines · Herbert Xu
Quoted 3 lines · Tim Chen
Herbert, would you prefer me to use ablkcipher scatter walk instead, assuming the overhead of both walk are about the same?
Quoted 6 lines
Quoted 2 lines
Well since you are going to potentially sleep in the middle of an operation I'd think ablkcipher is required, no?
We're using blkcipher walk in the implementation. As long as we use kmap and instead of
kmap_atomic, it allows us to sleep in the middle of the walk.
What if you were called from an atomic context, such as IPsec?
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 7 lines · Herbert Xu
Quoted 6 lines · Tim Chen
Quoted 5 lines · Herbert Xu
Quoted 3 lines · Tim Chen
Herbert, would you prefer me to use ablkcipher scatter walk instead, assuming the overhead of both walk are about the same?
Quoted 9 lines
Quoted 6 lines
Quoted 2 lines
Well since you are going to potentially sleep in the middle of an operation I'd think ablkcipher is required, no?
We're using blkcipher walk in the implementation. As long as we use kmap and instead of
kmap_atomic, it allows us to sleep in the middle of the walk.What if you were called from an atomic context, such as IPsec?
IPSec will invoke this multi-buffer encrypt with async request. The work is done in crypto daemon, so it wouldn't be in atomic context. But anyway, I'm okay with switching to ablkcipher walk, as long as it doesn't incur too much more overhead than blkcipher walk.
Tim
Herbert Xu
maintainerRe: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 6 lines · Tim Chen
IPSec will invoke this multi-buffer encrypt with async request. The work is done in crypto daemon, so it wouldn't be in atomic context. But anyway, I'm okay with switching to ablkcipher walk, as long as it doesn't incur too much more overhead than blkcipher walk.
What if some other user called the blkcipher interface in an atomic context? You can't guarantee that your algorithm is only picked up through the ablkcipher interface, unless of course you do something like __driver-ctr-aes-aesni.
Hmm I was just looking at the sha_mb code and something doesn't look right. For instance, can sha1_mb_update ever return -EINPROGRESS? This would be wrong as it's registered as an shash algorithm.
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 8 lines · Herbert Xu
Quoted 6 lines · Tim Chen
IPSec will invoke this multi-buffer encrypt with async request. The work is done in crypto daemon, so it wouldn't be in atomic context. But anyway, I'm okay with switching to ablkcipher walk, as long as it doesn't incur too much more overhead than blkcipher walk.
Quoted 4 lines
What if some other user called the blkcipher interface in an atomic context? You can't guarantee that your algorithm is only picked up through the ablkcipher interface, unless of course you do something like __driver-ctr-aes-aesni.
The __cbc-aes-aesni-mb algorithm is marked as internal algorithm with flag CRYPTO_ALG_INTERNAL, so it should not be picked up by other algorithms and should only be invoked from mcryptd.
Anyway, I've udpated the aes_cbc_mb code with ablkcipher helper. So I will be posting the new series with ablkcipher walk after testing is done.
Quoted 5 lines
Hmm I was just looking at the
sha_mbcode and something doesn't look right. For instance, cansha1_mb_updateever return-EINPROGRESS? This would be wrong as it's registered as an shash algorithm.
The __sha1-mb works in tandem with the outer layer of mcryptd aysnc algorithm. It does the completion for the outer
async algorithm. So as far as mcryptd is concerned, the inner algorithm is synchronous in the sense that it is done once it dispatch the job to __sha1-mb and don't have to worry about it. I don't think mcryptd check for the return value from __sha1-mb so it should be okay to return 0 instead of -EINPROGRESS. I'll double check that.
Tim
Herbert Xu
maintainerRe: [PATCH v2 1/5] crypto: Multi-buffer encryptioin infrastructure support
Quoted 4 lines · Tim Chen
The __cbc-aes-aesni-mb algorithm is marked as internal algorithm with flag
CRYPTO_ALG_INTERNAL, so it should not be picked up by other algorithms and should only be invoked from mcryptd.
OK I guess that's fine then.
Quoted 3 lines
Anyway, I've udpated the
aes_cbc_mbcode with ablkcipher helper. So I will be posting the new series with ablkcipher walk after testing is done.
Yes I think what you have is a very special case. As you said the ablkcipher interface should be fairly low in overhead so I think it makes sense to use that instead of blkcipher.
Quoted 8 lines
The __sha1-mb works in tandem with the outer layer of mcryptd aysnc algorithm. It does the completion for the outer
async algorithm. So as far as mcryptd is concerned, the inner algorithm is synchronous in the sense that it is done once it dispatch the job to __sha1-mb and don't have to worry about it. I don't think mcryptd check for the return value from __sha1-mb so it should be okay to return 0 instead of-EINPROGRESS. I'll double check that.
If it can never return EINPROGRESS then we should probably remove the code in it that says "return -EINPROGRESS".
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt