crypto: x86 AES-CBC encryption with multibuffer
Subsystems (2)
A message that is not in the archive (sent off-list or not yet received): [email protected]
v4 cover crypto: x86 AES-CBC encryption with multibuffer
In this patch series, we introduce AES CBC encryption that is parallelized on x86_64 cpu with XMM registers. The multi-buffer technique encrypt 8 data streams in parallel with SIMD instructions. Decryption is handled as in the existing AESNI Intel CBC implementation which can already parallelize decryption even for a single data stream.
Please see the multi-buffer whitepaper for details of the technique:
http://www.intel.com/content/www/us/en/communications/communications-ia-multi-buffer-paper.html
It is important that any driver uses this algorithm properly for scenarios where we have many data streams that can fill up the data lanes most of the time. It shouldn't be used when only a single data stream is expected mostly. Otherwise we may incurr extra delays when we have frequent gaps in data lanes, causing us to wait till data come in to fill the data lanes before initiating encryption. We may have to wait for flush operations to commence when no new data come in after some wait time. However we keep this extra delay to a minimum by opportunistically flushing the unfinished jobs if crypto daemon is the only active task running on a cpu.
By using this technique, we saw a throughput increase of up to 5.7x under optimal conditions when we have fully loaded encryption jobs filling up all the data lanes.
Change Log:
v4
1. Make the decrypt path also use ablkcpher walk.
v3
1. Use ablkcipher_walk helpers to walk the scatter gather list and eliminated needs to modify blkcipher_walk for multibuffer cipher
v2
1. Update cpu feature check to make sure SSE is supported
2. Fix up unloading of aes-cbc-mb module to properly free memory
Tim Chen (5):
crypto: Multi-buffer encryption infrastructure support
crypto: AES CBC multi-buffer data structures
crypto: AES CBC multi-buffer scheduler
crypto: AES CBC by8 encryption
crypto: AES CBC multi-buffer glue code
arch/x86/crypto/Makefile | 1 + arch/x86/crypto/aes-cbc-mb/Makefile | 22 + arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S | 774 +++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c | 835 +++++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h | 96 +++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h | 131 ++++ arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c | 145 ++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S | 270 +++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S | 222 ++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S | 416 ++++++++++ arch/x86/crypto/aes-cbc-mb/reg_sizes.S | 125 +++ crypto/Kconfig | 16 + crypto/mcryptd.c | 256 ++++++- include/crypto/algapi.h | 1 + include/crypto/mcryptd.h | 36 + 15 files changed, 3345 insertions(+), 1 deletion(-) create mode 100644 arch/x86/crypto/aes-cbc-mb/Makefile create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/reg_sizes.S
Signature · 1 line
1.7.11.7
PATCH v4 1/5 crypto: Multi-buffer encryption infrastructure support
In reply to a message not in the archiveIn this patch, the infrastructure needed to support multibuffer encryption implementation is added:
a) Enhace mcryptd daemon to support blkcipher requests.
b) Update configuration to include multi-buffer encryption build support.
For an introduction to the multi-buffer implementation, please see
http://www.intel.com/content/www/us/en/communications/communications-ia-multi-buffer-paper.html
--- crypto/Kconfig | 16 +++ crypto/mcryptd.c | 256 ++++++++++++++++++++++++++++++++++++++++++++++- include/crypto/algapi.h | 1 + include/crypto/mcryptd.h | 36 +++++++ 4 files changed, 308 insertions(+), 1 deletion(-)
crypto/Kconfig +16 -0
@@ -888,6 +888,22 @@ config CRYPTO_AES_NI_INTEL ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional acceleration for CTR. +config CRYPTO_AES_CBC_MB + tristate "AES CBC algorithm (x86_64 Multi-Buffer, Experimental)" + depends on X86 && 64BIT + select CRYPTO_ABLK_HELPER + select CRYPTO_MCRYPTD + help + AES CBC encryption implemented using multi-buffer technique. + This algorithm computes on multiple data lanes concurrently with + SIMD instructions for better throughput. It should only be + used when there is significant work to generate many separate + crypto requests that keep all the data lanes filled to get + the performance benefit. If the data lanes are unfilled, a + flush operation will be initiated after some delay to process + the exisiting crypto jobs, adding some extra latency at low + load case. + config CRYPTO_AES_SPARC64 tristate "AES cipher algorithms (SPARC64)" depends on SPARC64
crypto/mcryptd.c +255 -1
293 lines not on this page · raw message
include/crypto/algapi.h +1 -0
@@ -301,6 +301,7 @@ static inline void blkcipher_walk_init(struct blkcipher_walk *walk, walk->in.sg = src; walk->out.sg = dst; walk->total = nbytes; + walk->flags =0 ; } static inline void ablkcipher_walk_init(struct ablkcipher_walk *walk,
include/crypto/mcryptd.h +36 -0
@@ -13,6 +13,7 @@#include <linux/crypto.h> #include <linux/kernel.h> #include <crypto/hash.h> +#include <crypto/b128ops.h> struct mcryptd_ahash {struct crypto_ahash base;
@@ -95,6 +96,41 @@ struct mcryptd_alg_state {unsigned long (*flusher)(struct mcryptd_alg_cstate *cstate); }; +struct mcryptd_ablkcipher { +struct crypto_ablkcipher base; +}; + +static inline struct mcryptd_ablkcipher *__mcryptd_ablkcipher_cast ( +struct crypto_ablkcipher *tfm) +{ +return (struct mcryptd_ablkcipher *)tfm; +} + +/* alg_name should be algorithm to be cryptd-ed */ +struct mcryptd_ablkcipher *mcryptd_alloc_ablkcipher (const char *alg_name, +u32 type,u32 mask); +struct crypto_blkcipher *mcryptd_ablkcipher_child ( +struct mcryptd_ablkcipher *tfm); +void mcryptd_free_ablkcipher (struct mcryptd_ablkcipher *tfm); + +struct mcryptd_blkcipher_ctx { +struct crypto_blkcipher *child; +struct mcryptd_alg_state *alg_state; +}; + +struct mcryptd_blkcipher_request_ctx { +struct list_head waiter; +crypto_completion_t complete; +struct mcryptd_tag tag; +struct ablkcipher_walk walk; +u8 flag; +int nbytes; +int error; +struct blkcipher_desc desc; +void *job; +u128 seq_iv;/* running iv of a sequence */ +}; +/* return delay in jiffies from current time */ static inline unsigned long get_delay (unsigned long t) {
Signature · 1 line
1.7.11.7
PATCH v4 2/5 crypto: AES CBC multi-buffer data structures
In reply to a message not in the archiveThis patch introduces the data structures and prototypes of functions needed for doing AES CBC encryption using multi-buffer. Included are the structures of the multi-buffer AES CBC job, job scheduler in C and data structure defines in x86 assembly code.
--- arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h | 96 +++++++++ arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h | 131 ++++++++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S | 270 +++++++++++++++++++++++++ arch/x86/crypto/aes-cbc-mb/reg_sizes.S | 125 ++++++++++++ 4 files changed, 622 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S create mode 100644 arch/x86/crypto/aes-cbc-mb/reg_sizes.S
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_ctx.h new file +96 -0
@@ -0,0 +1,96 @@ +/* +* Header file for multi buffer AES CBC algorithm manager +* that deals with 8 buffers at a time +* +* +* This file is provided under a dual BSD/GPLv2 license. When using or +* redistributing this file, you may do so under either license. +* +* GPL LICENSE SUMMARY +* +* Copyright(c) 2015 Intel Corporation. +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of version 2 of the GNU General Public License as +* published by the Free Software Foundation. +* +* This program is distributed in the hope that it will be useful, but +* WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* General Public License for more details. +* +* Contact Information: +* James Guilford <[email protected]> +* Sean Gulley <[email protected]> +* Tim Chen <[email protected]> +* +* BSD LICENSE +* +* Copyright(c) 2015 Intel Corporation. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in +* the documentation and/or other materials provided with the +* distribution. +* Neither the name of Intel Corporation nor the names of its +* contributors may be used to endorse or promote products derived +* from this software without specific prior written permission. +* +* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +* +*/ +#ifndef __AES_CBC_MB_CTX_H +#define __AES_CBC_MB_CTX_H + + +#include <linux/types.h> + +#include "aes_cbc_mb_mgr.h" + +#define CBC_ENCRYPT 0x01 +#define CBC_DECRYPT 0x02 +#define CBC_START 0x04 +#define CBC_DONE 0x08 + +#define CBC_CTX_STS_IDLE 0x00 +#define CBC_CTX_STS_PROCESSING 0x01 +#define CBC_CTX_STS_LAST 0x02 +#define CBC_CTX_STS_COMPLETE 0x04 + +enum cbc_ctx_error { +CBC_CTX_ERROR_NONE =0 , +CBC_CTX_ERROR_INVALID_FLAGS =-1 , +CBC_CTX_ERROR_ALREADY_PROCESSING =-2 , +CBC_CTX_ERROR_ALREADY_COMPLETED =-3 , +}; + +#define cbc_ctx_init (ctx, nbytes, op) \ + do { \ + (ctx)->flag = (op) | CBC_START; \ + (ctx)->nbytes = nbytes; \ + } while (0) + +/* AESNI routines to perform cbc decrypt and key expansion */ + +asmlinkage void aesni_cbc_dec(struct crypto_aes_ctx *ctx, u8 *out, +const u8 *in,unsigned int len,u8 *iv); +asmlinkage int aesni_set_key(struct crypto_aes_ctx *ctx, const u8 *in_key, +unsigned int key_len); + +#endif /* __AES_CBC_MB_CTX_H */
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb_mgr.h new file +131 -0
131 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/mb_mgr_datastruct.S new file +270 -0
270 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/reg_sizes.S new file +125 -0
125 lines not on this page · raw message
Signature · 1 line
1.7.11.7
PATCH v4 3/5 crypto: AES CBC multi-buffer scheduler
In reply to a message not in the archiveThis patch implements in-order scheduler for encrypting multiple buffers in parallel supporting AES CBC encryption with key sizes of 128, 192 and 256 bits. It uses 8 data lanes by taking advantage of the SIMD instructions with XMM registers.
The multibuffer manager and scheduler is mostly written in assembly and the initialization support is written C. The AES CBC multibuffer crypto driver support interfaces with the multibuffer manager and scheduler to support AES CBC encryption in parallel. The scheduler supports job submissions, job flushing and and job retrievals after completion.
The basic flow of usage of the CBC multibuffer scheduler is as follows:
- The caller allocates an aes_cbc_mb_mgr_inorder_x8 object and initializes it once by calling aes_cbc_init_mb_mgr_inorder_x8().
- The aes_cbc_mb_mgr_inorder_x8 structure has an array of JOB_AES objects. Allocation and scheduling of JOB_AES objects are managed by the multibuffer scheduler support routines. The caller allocates a JOB_AES using aes_cbc_get_next_job_inorder_x8().
- The returned JOB_AES must be filled in with parameters for CBC encryption (eg: plaintext buffer, ciphertext buffer, key, iv, etc) and submitted to the manager object using aes_cbc_submit_job_inorder_xx().
- If the oldest JOB_AES is completed during a call to aes_cbc_submit_job_inorder_x8(), it is returned. Otherwise, NULL is returned.
- A call to aes_cbc_flush_job_inorder_x8() always returns the oldest job, unless the multibuffer manager is empty of jobs.
- A call to aes_cbc_get_completed_job_inorder_x8() returns a completed job. This routine is useful to process completed jobs instead of waiting for the flusher to engage.
- When a job is returned from submit or flush, the caller extracts the useful data and returns it to the multibuffer manager implicitly by the next call to aes_cbc_get_next_job_xx().
Jobs are always returned from submit or flush routines in the order they were submitted (hence "inorder").A job allocated using aes_cbc_get_next_job_inorder_x8() must be filled in and submitted before another call. A job returned by aes_cbc_submit_job_inorder_x8() or aes_cbc_flush_job_inorder_x8() is 'deallocated' upon the next call to get a job structure. Calls to get_next_job() cannot fail. If all jobs are allocated after a call to get_next_job(), the subsequent call to submit always returns the oldest job in a completed state.
--- arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c | 145 +++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S | 222 +++++++++++ arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S | 416 +++++++++++++++++++++ 3 files changed, 783 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S create mode 100644 arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S
arch/x86/crypto/aes-cbc-mb/aes_mb_mgr_init.c new file +145 -0
@@ -0,0 +1,145 @@ +/* +* Initialization code for multi buffer AES CBC algorithm +* +* +* This file is provided under a dual BSD/GPLv2 license. When using or +* redistributing this file, you may do so under either license. +* +* GPL LICENSE SUMMARY +* +* Copyright(c) 2015 Intel Corporation. +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of version 2 of the GNU General Public License as +* published by the Free Software Foundation. +* +* This program is distributed in the hope that it will be useful, but +* WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* General Public License for more details. +* +* Contact Information: +* James Guilford <[email protected]> +* Sean Gulley <[email protected]> +* Tim Chen <[email protected]> +* +* BSD LICENSE +* +* Copyright(c) 2015 Intel Corporation. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in +* the documentation and/or other materials provided with the +* distribution. +* Neither the name of Intel Corporation nor the names of its +* contributors may be used to endorse or promote products derived +* from this software without specific prior written permission. +* +* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +* +*/ + +#include "aes_cbc_mb_mgr.h" + +void aes_cbc_init_mb_mgr_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +/* Init "out of order" components */ + state->unused_lanes =0xF76543210 ; + state->job_in_lane[0 ] =NULL ; + state->job_in_lane[1 ] =NULL ; + state->job_in_lane[2 ] =NULL ; + state->job_in_lane[3 ] =NULL ; + state->job_in_lane[4 ] =NULL ; + state->job_in_lane[5 ] =NULL ; + state->job_in_lane[6 ] =NULL ; + state->job_in_lane[7 ] =NULL ; + +/* Init "in order" components */ + state->next_job =0 ; + state->earliest_job =-1 ; + +} + +#define JOBS (offset) ((struct job_aes_cbc *)(((u64)state->jobs)+offset)) + +struct job_aes_cbc * +aes_cbc_get_next_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +return JOBS (state->next_job); +} + +struct job_aes_cbc * +aes_cbc_flush_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +struct job_aes_cbc *job; + +/* checking earliest_job < 0 fails and the code walks over bogus */ +if (state->earliest_job ==-1 ) +return NULL ;/* empty */ + + job =JOBS (state->earliest_job); +while (job->status !=STS_COMPLETED ) { +switch (job->key_len) { +case AES_KEYSIZE_128 : +aes_cbc_flush_job_ooo_128x8 (state); +break ; +case AES_KEYSIZE_192 : +aes_cbc_flush_job_ooo_192x8 (state); +break ; +case AES_KEYSIZE_256 : +aes_cbc_flush_job_ooo_256x8 (state); +break ; +default : +break ; + } + } + +/* advance earliest job */ + state->earliest_job +=sizeof (struct job_aes_cbc ); +if (state->earliest_job ==MAX_AES_JOBS *sizeof (struct job_aes_cbc )) + state->earliest_job =0 ; + +if (state->earliest_job == state->next_job) + state->earliest_job =-1 ; + +return job; +} + +struct job_aes_cbc * +aes_cbc_get_completed_job_inorder_x8 (struct aes_cbc_mb_mgr_inorder_x8 *state) +{ +struct job_aes_cbc *job; + +if (state->earliest_job ==-1 ) +return NULL ;/* empty */ + + job =JOBS (state->earliest_job); +if (job->status !=STS_COMPLETED ) +return NULL ; + + state->earliest_job +=sizeof (struct job_aes_cbc ); + +if (state->earliest_job ==MAX_AES_JOBS *sizeof (struct job_aes_cbc )) + state->earliest_job =0 ; +if (state->earliest_job == state->next_job) + state->earliest_job =-1 ; + +/* we have a completed job */ +return job; +}
arch/x86/crypto/aes-cbc-mb/mb_mgr_inorder_x8_asm.S new file +222 -0
222 lines not on this page · raw message
arch/x86/crypto/aes-cbc-mb/mb_mgr_ooo_x8_asm.S new file +416 -0
416 lines not on this page · raw message
Signature · 1 line
1.7.11.7
PATCH v4 4/5 crypto: AES CBC by8 encryption
In reply to a message not in the archiveThis patch introduces the assembly routine to do a by8 AES CBC encryption in support of the AES CBC multi-buffer implementation.
Encryption of 8 data streams of a key size are done simultaneously.
--- arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S | 774 ++++++++++++++++++++++++++++ 1 file changed, 774 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S
arch/x86/crypto/aes-cbc-mb/aes_cbc_enc_x8.S new file +774 -0
@@ -0,0 +1,774 @@ +/* + * AES CBC by8 multibuffer optimization (x86_64) + * This file implements 128/192/256 bit AES CBC encryption + * + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. + * + * GPL LICENSE SUMMARY + * + * Copyright(c) 2015 Intel Corporation. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * Contact Information: + * James Guilford <[email protected]> + * Sean Gulley <[email protected]> + * Tim Chen <[email protected]> + * + * BSD LICENSE + * + * Copyright(c) 2015 Intel Corporation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * Neither the name of Intel Corporation nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ +#include <linux/linkage.h> + +/* stack size needs to be an odd multiple of 8 for alignment */ + +#define AES_KEYSIZE_128 16 +#define AES_KEYSIZE_192 24 +#define AES_KEYSIZE_256 32 + +#define XMM_SAVE_SIZE 16*10 +#define GPR_SAVE_SIZE 8*9 +#define STACK_SIZE (XMM_SAVE_SIZE + GPR_SAVE_SIZE) + +#define GPR_SAVE_REG %rsp +#define GPR_SAVE_AREA %rsp + XMM_SAVE_SIZE +#define LEN_AREA_OFFSET XMM_SAVE_SIZE + 8*8 +#define LEN_AREA_REG %rsp +#define LEN_AREA %rsp + XMM_SAVE_SIZE + 8*8 + +#define IN_OFFSET 0 +#define OUT_OFFSET 8*8 +#define KEYS_OFFSET 16*8 +#define IV_OFFSET 24*8 + + +#define IDX %rax +#define TMP %rbx +#define ARG %rdi +#define LEN %rsi + +#define KEYS0 %r14 +#define KEYS1 %r15 +#define KEYS2 %rbp +#define KEYS3 %rdx +#define KEYS4 %rcx +#define KEYS5 %r8 +#define KEYS6 %r9 +#define KEYS7 %r10 + +#define IN0 %r11 +#define IN2 %r12 +#define IN4 %r13 +#define IN6 LEN + +#define XDATA0 %xmm0 +#define XDATA1 %xmm1 +#define XDATA2 %xmm2 +#define XDATA3 %xmm3 +#define XDATA4 %xmm4 +#define XDATA5 %xmm5 +#define XDATA6 %xmm6 +#define XDATA7 %xmm7 + +#define XKEY0_3 %xmm8 +#define XKEY1_4 %xmm9 +#define XKEY2_5 %xmm10 +#define XKEY3_6 %xmm11 +#define XKEY4_7 %xmm12 +#define XKEY5_8 %xmm13 +#define XKEY6_9 %xmm14 +#define XTMP %xmm15 + +#define MOVDQ movdqu /* assume buffers not aligned */ +#define CONCAT(a, b) a##b +#define INPUT_REG_SUFX 1 /* IN */ +#define XDATA_REG_SUFX 2 /* XDAT */ +#define KEY_REG_SUFX 3 /* KEY */ +#define XMM_REG_SUFX 4 /* XMM */ + +/* + * To avoid positional parameter errors while compiling + * three registers need to be passed + */ +.text + +.macro pxor2 x, y, z + MOVDQ (\x,\y), XTMP + pxor XTMP, \z +.endm + +.macro inreg n + .if (\n == 0) + reg_IN = IN0 + .elseif (\n == 2) + reg_IN = IN2 + .elseif (\n == 4) + reg_IN = IN4 + .elseif (\n == 6) + reg_IN = IN6 + .else + error "inreg: incorrect register number" + .endif +.endm +.macro xdatareg n + .if (\n == 0) + reg_XDAT = XDATA0 + .elseif (\n == 1) + reg_XDAT = XDATA1 + .elseif (\n == 2) + reg_XDAT = XDATA2 + .elseif (\n == 3) + reg_XDAT = XDATA3 + .elseif (\n == 4) + reg_XDAT = XDATA4 + .elseif (\n == 5) + reg_XDAT = XDATA5 + .elseif (\n == 6) + reg_XDAT = XDATA6 + .elseif (\n == 7) + reg_XDAT = XDATA7 + .endif +.endm +.macro xkeyreg n + .if (\n == 0) + reg_KEY = KEYS0 + .elseif (\n == 1) + reg_KEY = KEYS1 + .elseif (\n == 2) + reg_KEY = KEYS2 + .elseif (\n == 3) + reg_KEY = KEYS3 + .elseif (\n == 4) + reg_KEY = KEYS4 + .elseif (\n == 5) + reg_KEY = KEYS5 + .elseif (\n == 6) + reg_KEY = KEYS6 + .elseif (\n == 7) + reg_KEY = KEYS7 + .endif +.endm +.macro xmmreg n + .if (\n >= 0) && (\n < 16) + /* Valid register number */ + reg_XMM = %xmm\n + .else + error "xmmreg: incorrect register number" + .endif +.endm + +/* + * suffix - register suffix + * set up the register name using the loop index I + */ +.macro define_reg suffix +.altmacro + .if (\suffix == INPUT_REG_SUFX) + inreg %I + .elseif (\suffix == XDATA_REG_SUFX) + xdatareg %I + .elseif (\suffix == KEY_REG_SUFX) + xkeyreg %I + .elseif (\suffix == XMM_REG_SUFX) + xmmreg %I + .else + error "define_reg: unknown register suffix" + .endif +.noaltmacro +.endm + +/* + * aes_cbc_enc_x8 key_len + * macro to encode data for 128bit, 192bit and 256bit keys + */ + +.macro aes_cbc_enc_x8 key_len + + sub $STACK_SIZE, %rsp + + mov %rbx, (XMM_SAVE_SIZE + 8*0)(GPR_SAVE_REG) + mov %rbp, (XMM_SAVE_SIZE + 8*3)(GPR_SAVE_REG) + mov %r12, (XMM_SAVE_SIZE + 8*4)(GPR_SAVE_REG) + mov %r13, (XMM_SAVE_SIZE + 8*5)(GPR_SAVE_REG) + mov %r14, (XMM_SAVE_SIZE + 8*6)(GPR_SAVE_REG) + mov %r15, (XMM_SAVE_SIZE + 8*7)(GPR_SAVE_REG) + + mov $16, IDX + shl $4, LEN /* LEN = LEN * 16 */ + /* LEN is now in terms of bytes */ + mov LEN, (LEN_AREA_OFFSET)(LEN_AREA_REG) + + /* Run through storing arguments in IN0,2,4,6 */ + I = 0 + .rept 4 + define_reg INPUT_REG_SUFX + mov (IN_OFFSET + 8*I)(ARG), reg_IN + I = (I + 2) + .endr + + /* load 1 .. 8 blocks of plain text into XDATA0..XDATA7 */ + I = 0 + .rept 4 + mov (IN_OFFSET + 8*(I+1))(ARG), TMP + define_reg INPUT_REG_SUFX + define_reg XDATA_REG_SUFX + /* load first block of plain text */ + MOVDQ (reg_IN), reg_XDAT + I = (I + 1) + define_reg XDATA_REG_SUFX + /* load next block of plain text */ + MOVDQ (TMP), reg_XDAT + I = (I + 1) + .endr + + /* Run through XDATA0 .. XDATA7 to perform plaintext XOR IV */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + pxor (IV_OFFSET + 16*I)(ARG), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 8 + define_reg KEY_REG_SUFX + mov (KEYS_OFFSET + 8*I)(ARG), reg_KEY + I = (I + 1) + .endr + + I = 0 + /* 0..7 ARK */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + pxor 16*0(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + /* 1. ENC */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*1)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + movdqa 16*3(KEYS0), XKEY0_3 /* load round 3 key */ + + I = 0 + /* 2. ENC */ + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*2)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + movdqa 16*4(KEYS1), XKEY1_4 /* load round 4 key */ + + /* 3. ENC */ + aesenc XKEY0_3, XDATA0 + I = 1 + .rept 7 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*3)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* + * FIXME: + * why can't we reorder encrypt DATA0..DATA7 and load 5th round? + */ + aesenc (16*4)(KEYS0), XDATA0 /* 4. ENC */ + movdqa 16*5(KEYS2), XKEY2_5 /* load round 5 key */ + aesenc XKEY1_4, XDATA1 /* 4. ENC */ + + I = 2 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*4)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + aesenc (16*5)(KEYS0), XDATA0 /* 5. ENC */ + aesenc (16*5)(KEYS1), XDATA1 /* 5. ENC */ + movdqa 16*6(KEYS3), XKEY3_6 /* load round 6 key */ + aesenc XKEY2_5, XDATA2 /* 5. ENC */ + I = 3 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*5)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + aesenc (16*6)(KEYS0), XDATA0 /* 6. ENC */ + aesenc (16*6)(KEYS1), XDATA1 /* 6. ENC */ + aesenc (16*6)(KEYS2), XDATA2 /* 6. ENC */ + movdqa 16*7(KEYS4), XKEY4_7 /* load round 7 key */ + aesenc XKEY3_6, XDATA3 /* 6. ENC */ + + I = 4 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*6)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*7)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + movdqa 16*8(KEYS5), XKEY5_8 /* load round 8 key */ + aesenc XKEY4_7, XDATA4 /* 7. ENC */ + I = 5 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*7)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + I = 0 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*8)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + movdqa 16*9(KEYS6), XKEY6_9 /* load round 9 key */ + aesenc XKEY5_8, XDATA5 /* 8. ENC */ + aesenc 16*8(KEYS6), XDATA6 /* 8. ENC */ + aesenc 16*8(KEYS7), XDATA7 /* 8. ENC */ + + I = 0 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*9)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + mov (OUT_OFFSET + 8*0)(ARG), TMP + aesenc XKEY6_9, XDATA6 /* 9. ENC */ + aesenc 16*9(KEYS7), XDATA7 /* 9. ENC */ + + /* 10. ENC (last for 128bit keys) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_128) + aesenclast (16*10)(reg_KEY), reg_XDAT + .else + aesenc (16*10)(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if (\key_len != AES_KEYSIZE_128) + /* 11. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*11)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 12. ENC (last for 192bit key) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_192) + aesenclast (16*12)(reg_KEY), reg_XDAT + .else + aesenc (16*12)(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + /* for 256bit, two more rounds */ + .if \key_len == AES_KEYSIZE_256 + + /* 13. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc (16*13)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 14. ENC last encode for 256bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenclast (16*14)(reg_KEY), reg_XDAT + I = (I + 1) + .endr + .endif + + .endif + + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + MOVDQ reg_XDAT, (TMP) /* write back ciphertext */ + I = (I + 1) + .if (I < 8) + mov (OUT_OFFSET + 8*I)(ARG), TMP + .endif + .endr + + cmp IDX, LEN_AREA_OFFSET(LEN_AREA_REG) + je .Ldone\key_len + +.Lmain_loop\key_len: + mov (IN_OFFSET + 8*1)(ARG), TMP + pxor2 IN0, IDX, XDATA0 /* next block of plain text */ + pxor2 TMP, IDX, XDATA1 /* next block of plain text */ + + mov (IN_OFFSET + 8*3)(ARG), TMP + pxor2 IN2, IDX, XDATA2 /* next block of plain text */ + pxor2 TMP, IDX, XDATA3 /* next block of plain text */ + + mov (IN_OFFSET + 8*5)(ARG), TMP + pxor2 IN4, IDX, XDATA4 /* next block of plain text */ + pxor2 TMP, IDX, XDATA5 /* next block of plain text */ + + mov (IN_OFFSET + 8*7)(ARG), TMP + pxor2 IN6, IDX, XDATA6 /* next block of plain text */ + pxor2 TMP, IDX, XDATA7 /* next block of plain text */ + + /* 0. ARK */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + pxor 16*0(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 1. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*1(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 2. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*2(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 3. ENC */ + aesenc XKEY0_3, XDATA0 /* 3. ENC */ + I = 1 + .rept 7 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*3(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 4. ENC */ + aesenc 16*4(KEYS0), XDATA0 /* 4. ENC */ + aesenc XKEY1_4, XDATA1 /* 4. ENC */ + I = 2 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*4(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 5. ENC */ + aesenc 16*5(KEYS0), XDATA0 /* 5. ENC */ + aesenc 16*5(KEYS1), XDATA1 /* 5. ENC */ + aesenc XKEY2_5, XDATA2 /* 5. ENC */ + + I = 3 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*5(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 6. ENC */ + I = 0 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*6(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY3_6, XDATA3 /* 6. ENC */ + I = 4 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*6(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 7. ENC */ + I = 0 + .rept 4 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*7(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY4_7, XDATA4 /* 7. ENC */ + I = 5 + .rept 3 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*7(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 8. ENC */ + I = 0 + .rept 5 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*8(reg_KEY), reg_XDAT + I = (I + 1) + .endr + aesenc XKEY5_8, XDATA5 /* 8. ENC */ + aesenc 16*8(KEYS6), XDATA6 /* 8. ENC */ + aesenc 16*8(KEYS7), XDATA7 /* 8. ENC */ + + /* 9. ENC */ + I = 0 + .rept 6 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*9(reg_KEY), reg_XDAT + I = (I + 1) + .endr + mov (OUT_OFFSET + 8*0)(ARG), TMP + aesenc XKEY6_9, XDATA6 /* 9. ENC */ + aesenc 16*9(KEYS7), XDATA7 /* 9. ENC */ + + /* 10. ENC (last for 128 bit key) */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_128) + aesenclast 16*10(reg_KEY), reg_XDAT + .else + aesenc 16*10(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if (\key_len != AES_KEYSIZE_128) + /* 11. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*11(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 12. last ENC for 192bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + .if (\key_len == AES_KEYSIZE_192) + aesenclast 16*12(reg_KEY), reg_XDAT + .else + aesenc 16*12(reg_KEY), reg_XDAT + .endif + I = (I + 1) + .endr + + .if \key_len == AES_KEYSIZE_256 + /* for 256bit, two more rounds */ + /* 13. ENC */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenc 16*13(reg_KEY), reg_XDAT + I = (I + 1) + .endr + + /* 14. last ENC for 256bit key */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + define_reg KEY_REG_SUFX + aesenclast 16*14(reg_KEY), reg_XDAT + I = (I + 1) + .endr + .endif + .endif + + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + /* write back cipher text */ + MOVDQ reg_XDAT, (TMP , IDX) + I = (I + 1) + .if (I < 8) + mov (OUT_OFFSET + 8*I)(ARG), TMP + .endif + .endr + + add $16, IDX + cmp IDX, LEN_AREA_OFFSET(LEN_AREA_REG) + jne .Lmain_loop\key_len + +.Ldone\key_len: + /* update IV */ + I = 0 + .rept 8 + define_reg XDATA_REG_SUFX + movdqa reg_XDAT, (IV_OFFSET + 16*I)(ARG) + I = (I + 1) + .endr + + /* update IN and OUT */ + movd LEN_AREA_OFFSET(LEN_AREA_REG), %xmm0 + pshufd $0x44, %xmm0, %xmm0 + + I = 1 + .rept 4 + define_reg XMM_REG_SUFX + movdqa (IN_OFFSET + 16*(I-1))(ARG), reg_XMM + I = (I + 1) + .endr + + paddq %xmm0, %xmm1 + paddq %xmm0, %xmm2 + paddq %xmm0, %xmm3 + paddq %xmm0, %xmm4 + + I = 5 + .rept 4 + define_reg XMM_REG_SUFX + movdqa (OUT_OFFSET + 16*(I-5))(ARG), reg_XMM + I = (I + 1) + .endr + + I = 1 + .rept 4 + define_reg XMM_REG_SUFX + movdqa reg_XMM, (IN_OFFSET + 16*(I-1))(ARG) + I = (I + 1) + .endr + + paddq %xmm0, %xmm5 + paddq %xmm0, %xmm6 + paddq %xmm0, %xmm7 + paddq %xmm0, %xmm8 + + I = 5 + .rept 4 + define_reg XMM_REG_SUFX + movdqa reg_XMM, (OUT_OFFSET + 16*(I-5))(ARG) + I = (I + 1) + .endr + + mov (XMM_SAVE_SIZE + 8*0)(GPR_SAVE_REG), %rbx + mov (XMM_SAVE_SIZE + 8*3)(GPR_SAVE_REG), %rbp + mov (XMM_SAVE_SIZE + 8*4)(GPR_SAVE_REG), %r12 + mov (XMM_SAVE_SIZE + 8*5)(GPR_SAVE_REG), %r13 + mov (XMM_SAVE_SIZE + 8*6)(GPR_SAVE_REG), %r14 + mov (XMM_SAVE_SIZE + 8*7)(GPR_SAVE_REG), %r15 + + add $STACK_SIZE, %rsp + + ret +.endm + +/* + * AES CBC encryption routine supporting 128/192/256 bit keys + * + * void aes_cbc_enc_128_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of AES_ARGS_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + * void aes_cbc_enc_192_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of aes_cbc_args_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + * void aes_cbc_enc_256_x8(struct aes_cbc_args_x8 *args, u64 len); + * arg 1: rcx : addr of aes_cbc_args_x8 structure + * arg 2: rdx : len (in units of 16-byte blocks) + */ + +ENTRY(aes_cbc_enc_128_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_128 + +ENDPROC(aes_cbc_enc_128_x8) + +ENTRY(aes_cbc_enc_192_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_192 + +ENDPROC(aes_cbc_enc_192_x8) + +ENTRY(aes_cbc_enc_256_x8) + + aes_cbc_enc_x8 AES_KEYSIZE_256 + +ENDPROC(aes_cbc_enc_256_x8)
Signature · 1 line
1.7.11.7
PATCH v4 5/5 crypto: AES CBC multi-buffer glue code
In reply to a message not in the archiveThis patch introduces the multi-buffer job manager which is responsible for submitting scatter-gather buffers from several AES CBC jobs to the multi-buffer algorithm. The glue code interfaces with the underlying algorithm that handles 8 data streams of AES CBC encryption in parallel. AES key expansion and CBC decryption requests are performed in a manner similar to the existing AESNI Intel glue driver.
The outline of the algorithm for AES CBC encryption requests is sketched below:
Any driver requesting the crypto service will place an async crypto request on the workqueue. The multi-buffer crypto daemon will pull an AES CBC encryption request from work queue and put each request in an empty data lane for multi-buffer crypto computation. When all the empty lanes are filled, computation will commence on the jobs in parallel and the job with the shortest remaining buffer will get completed and be returned. To prevent prolonged stall, when no new jobs arrive, we will flush workqueue of jobs after a maximum allowable delay has elapsed.
To accommodate the fragmented nature of scatter-gather, we will keep submitting the next scatter-buffer fragment for a job for multi-buffer computation until a job is completed and no more buffer fragments remain. At that time we will pull a new job to fill the now empty data slot. We check with the multibuffer scheduler to see if there are other completed jobs to prevent extraneous delay in returning any completed jobs.
This multi-buffer algorithm should be used for cases where we get at least 8 streams of crypto jobs submitted at a reasonably high rate. For low crypto job submission rate and low number of data streams, this algorithm will not be beneficial. The reason is at low rate, we do not fill out the data lanes before flushing the jobs instead of processing them with all the data lanes full. We will miss the benefit of parallel computation, and adding delay to the processing of the crypto job at the same time. Some tuning of the maximum latency parameter may be needed to get the best performance.
--- arch/x86/crypto/Makefile | 1 + arch/x86/crypto/aes-cbc-mb/Makefile | 22 + arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c | 835 ++++++++++++++++++++++++++++++++ 3 files changed, 858 insertions(+) create mode 100644 arch/x86/crypto/aes-cbc-mb/Makefile create mode 100644 arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c
arch/x86/crypto/Makefile +1 -0
@@ -33,6 +33,7 @@ obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o obj-$(CONFIG_CRYPTO_CRCT10DIF_PCLMUL) += crct10dif-pclmul.o +obj-$(CONFIG_CRYPTO_AES_CBC_MB) += aes-cbc-mb/ obj-$(CONFIG_CRYPTO_POLY1305_X86_64) += poly1305-x86_64.o # These modules require assembler to support AVX.
arch/x86/crypto/aes-cbc-mb/Makefile new file +22 -0
@@ -0,0 +1,22 @@ +# +# Arch-specific CryptoAPI modules. +# + +avx_supported := $(call as-instr,vpxor %xmm0$(comma)%xmm0$(comma)%xmm0,yes,no) + +# we need decryption and key expansion routine symbols +# if either AESNI_NI_INTEL or AES_CBC_MB is a module + +ifeq ($(CONFIG_CRYPTO_AES_NI_INTEL),m) + dec_support := ../aesni-intel_asm.o +endif +ifeq ($(CONFIG_CRYPTO_AES_CBC_MB),m) + dec_support := ../aesni-intel_asm.o +endif + +ifeq ($(avx_supported),yes) + obj-$(CONFIG_CRYPTO_AES_CBC_MB) += aes-cbc-mb.o + aes-cbc-mb-y := $(dec_support) aes_cbc_mb.o aes_mb_mgr_init.o \ + mb_mgr_inorder_x8_asm.o mb_mgr_ooo_x8_asm.o \ + aes_cbc_enc_x8.o +endif
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +835 -0
835 lines not on this page · raw message
Signature · 1 line
1.7.11.7
Herbert Xu
maintainerRe: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 20 lines · Tim Chen
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +19
-0+/* +* CRYPTO_ALG_ASYNC flag is passed to indicate we have an ablk +* scatter-gather walk. +*/ + +static struct crypto_alg aes_cbc_mb_alg = { + .cra_name ="__cbc-aes-aesni-mb" , + .cra_driver_name ="__driver-cbc-aes-aesni-mb" , + .cra_priority =100 , + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER |CRYPTO_ALG_ASYNC + |CRYPTO_ALG_INTERNAL , + .cra_blocksize =AES_BLOCK_SIZE , + .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + +AESNI_ALIGN -1 , + .cra_alignmask =0 , + .cra_type = &crypto_blkcipher_type, + .cra_module =THIS_MODULE , + .cra_list =LIST_HEAD_INIT (aes_cbc_mb_alg.cra_list), + .cra_u = {
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c line 617
Quoted 10 lines
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +10
-0+ .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, + .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = mb_aes_cbc_encrypt, + .decrypt = mb_aes_cbc_decrypt + }, + }, +};
So why do we still need this? Shouldn't a single ablkcipher cover all the cases?
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 35 lines · Herbert Xu
Quoted 20 lines · Tim Chen
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +19
-0+/* +* CRYPTO_ALG_ASYNC flag is passed to indicate we have an ablk +* scatter-gather walk. +*/ + +static struct crypto_alg aes_cbc_mb_alg = { + .cra_name ="__cbc-aes-aesni-mb" , + .cra_driver_name ="__driver-cbc-aes-aesni-mb" , + .cra_priority =100 , + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER |CRYPTO_ALG_ASYNC + |CRYPTO_ALG_INTERNAL , + .cra_blocksize =AES_BLOCK_SIZE , + .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + +AESNI_ALIGN -1 , + .cra_alignmask =0 , + .cra_type = &crypto_blkcipher_type, + .cra_module =THIS_MODULE , + .cra_list =LIST_HEAD_INIT (aes_cbc_mb_alg.cra_list), + .cra_u = {arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c line 617
Quoted 10 lines
arch/x86/crypto/aes-cbc-mb/aes_cbc_mb.c new file +10
-0+ .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, + .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = mb_aes_cbc_encrypt, + .decrypt = mb_aes_cbc_decrypt + }, + }, +};So why do we still need this? Shouldn't a single ablkcipher cover all the cases?
Quoted 1 line
Thanks,
This is an internal algorithm. We are indeed casting the request to the outer ablkcipher request when we do the async cipher walk.
See
static int mb_aes_cbc_decrypt(struct blkcipher_desc *desc,
struct scatterlist *dst, struct scatterlist *src, unsigned int nbytes)
{
struct crypto_aes_ctx *aesni_ctx;
struct mcryptd_blkcipher_request_ctx *rctx =
container_of(desc, struct mcryptd_blkcipher_request_ctx, desc);
struct ablkcipher_request *req;
bool is_mcryptd_req;
unsigned long src_paddr;
unsigned long dst_paddr;
int err;
/* note here whether it is mcryptd req */
is_mcryptd_req = desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP;
req = cast_mcryptd_ctx_to_req(rctx);
aesni_ctx = aes_ctx(crypto_blkcipher_ctx(desc->tfm));
ablkcipher_walk_init(&rctx->walk, dst, src, nbytes);
err = ablkcipher_walk_phys(req, &rctx->walk);
if (err || !rctx->walk.nbytes)
goto done1;
desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
kernel_fpu_begin();
while ((nbytes = rctx->walk.nbytes)) {
src_paddr = (page_to_phys(rctx->walk.src.page) + rctx->walk.src.offset);
dst_paddr = (page_to_phys(rctx->walk.dst.page) + rctx->walk.dst.offset);
aesni_cbc_dec(aesni_ctx, phys_to_virt(dst_paddr), phys_to_virt(src_paddr),
rctx->walk.nbytes & AES_BLOCK_MASK, rctx->walk.iv);
nbytes &= AES_BLOCK_SIZE - 1;
err = ablkcipher_walk_done(req, &rctx->walk, nbytes);
if (err)
goto done2;
}
done2:
kernel_fpu_end();
done1:
ablkcipher_walk_complete(&rctx->walk);Thanks.
Tim
Herbert Xu
maintainerRe: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 3 lines · Tim Chen
This is an internal algorithm. We are indeed casting the request to the outer ablkcipher request when we do the async cipher walk.
The question remain: why does it have to be a blkcipher rather than an ablkcipher?
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 9 lines · Herbert Xu
Quoted 3 lines · Tim Chen
This is an internal algorithm. We are indeed casting the request to the outer ablkcipher request when we do the async cipher walk.
The question remain: why does it have to be a blkcipher rather than an ablkcipher?
Cheers,
The inner cipher is called synchronously from the outer layer async cipher algorithm in cbc_mb_async_ablk_decrypt via
err = crypto_blkcipher_crt(child_tfm)->decrypt(
&rctx->desc, req->dst, req->src, req->nbytes);or directly by mcrytpd_queue_worker via mcryptd_blkcipher_crypt. We do not allow this operation to return something like EINPROGRESS.
But the walk of the scattered list is done with async walk.
Thanks.
Tim
Herbert Xu
maintainerRe: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 6 lines · Tim Chen
The inner cipher is called synchronously from the outer layer async cipher algorithm in
cbc_mb_async_ablk_decryptviaerr = crypto_blkcipher_crt(child_tfm)->decrypt( &rctx->desc, req->dst, req->src, req->nbytes);
We should avoid bypassing the API and directly calling crypto driver functions like this.
What if you made it a proper ablkcipher and just called it through the API?
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 8 lines · Herbert Xu
Quoted 6 lines · Tim Chen
The inner cipher is called synchronously from the outer layer async cipher algorithm in
cbc_mb_async_ablk_decryptviaerr = crypto_blkcipher_crt(child_tfm)->decrypt( &rctx->desc, req->dst, req->src, req->nbytes);
Quoted 7 lines
We should avoid bypassing the API and directly calling crypto driver functions like this.
What if you made it a proper ablkcipher and just called it through the API?
Thanks,
Direct call I assume have less overhead. Let me think about making the inner cipher ablkcipher. I may need to rewrite a lot of the glue layer :(
Tim
Herbert Xu
maintainerRe: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 1 line · Tim Chen
Direct call I assume have less overhead. Let me think about
static inline int crypto_ablkcipher_encrypt(struct ablkcipher_request *req)
{
struct ablkcipher_tfm *crt =
crypto_ablkcipher_crt(crypto_ablkcipher_reqtfm(req));
return crt->encrypt(req);
}I don't see any overhead there that you could eliminate by calling crt->encrypt directly.
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v4 5/5] crypto: AES CBC multi-buffer glue code
Quoted 10 lines · Herbert Xu
Quoted 1 line · Tim Chen
Direct call I assume have less overhead. Let me think about
static inline int
crypto_ablkcipher_encrypt(struct ablkcipher_request *req){ struct ablkcipher_tfm *crt = crypto_ablkcipher_crt(crypto_ablkcipher_reqtfm(req)); return crt->encrypt(req); }
Quoted 4 lines
I don't see any overhead there that you could eliminate by calling
crt->encryptdirectly.Cheers,
Okay, I'll attempt to convert the inner cipher to ablk. It may take me a bit of time.
Thanks.
Tim