Loading...
1// SPDX-License-Identifier: GPL-2.0 OR MIT
2/*
3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 */
5
6#include <crypto/algapi.h>
7#include <crypto/internal/hash.h>
8#include <crypto/internal/poly1305.h>
9#include <crypto/internal/simd.h>
10#include <linux/crypto.h>
11#include <linux/jump_label.h>
12#include <linux/kernel.h>
13#include <linux/module.h>
14#include <linux/sizes.h>
15#include <asm/cpu_device_id.h>
16#include <asm/simd.h>
17
18asmlinkage void poly1305_init_x86_64(void *ctx,
19 const u8 key[POLY1305_BLOCK_SIZE]);
20asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp,
21 const size_t len, const u32 padbit);
22asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
23 const u32 nonce[4]);
24asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
25 const u32 nonce[4]);
26asmlinkage void poly1305_blocks_avx(void *ctx, const u8 *inp, const size_t len,
27 const u32 padbit);
28asmlinkage void poly1305_blocks_avx2(void *ctx, const u8 *inp, const size_t len,
29 const u32 padbit);
30asmlinkage void poly1305_blocks_avx512(void *ctx, const u8 *inp,
31 const size_t len, const u32 padbit);
32
33static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);
34static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);
35static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);
36
37struct poly1305_arch_internal {
38 union {
39 struct {
40 u32 h[5];
41 u32 is_base2_26;
42 };
43 u64 hs[3];
44 };
45 u64 r[2];
46 u64 pad;
47 struct { u32 r2, r1, r4, r3; } rn[9];
48};
49
50/* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit
51 * the unfortunate situation of using AVX and then having to go back to scalar
52 * -- because the user is silly and has called the update function from two
53 * separate contexts -- then we need to convert back to the original base before
54 * proceeding. It is possible to reason that the initial reduction below is
55 * sufficient given the implementation invariants. However, for an avoidance of
56 * doubt and because this is not performance critical, we do the full reduction
57 * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py
58 */
59static void convert_to_base2_64(void *ctx)
60{
61 struct poly1305_arch_internal *state = ctx;
62 u32 cy;
63
64 if (!state->is_base2_26)
65 return;
66
67 cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy;
68 cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy;
69 cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy;
70 cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy;
71 state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0];
72 state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12);
73 state->hs[2] = state->h[4] >> 24;
74#define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
75 cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL);
76 state->hs[2] &= 3;
77 state->hs[0] += cy;
78 state->hs[1] += (cy = ULT(state->hs[0], cy));
79 state->hs[2] += ULT(state->hs[1], cy);
80#undef ULT
81 state->is_base2_26 = 0;
82}
83
84static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE])
85{
86 poly1305_init_x86_64(ctx, key);
87}
88
89static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len,
90 const u32 padbit)
91{
92 struct poly1305_arch_internal *state = ctx;
93
94 /* SIMD disables preemption, so relax after processing each page. */
95 BUILD_BUG_ON(SZ_4K < POLY1305_BLOCK_SIZE ||
96 SZ_4K % POLY1305_BLOCK_SIZE);
97
98 if (!static_branch_likely(&poly1305_use_avx) ||
99 (len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) ||
100 !crypto_simd_usable()) {
101 convert_to_base2_64(ctx);
102 poly1305_blocks_x86_64(ctx, inp, len, padbit);
103 return;
104 }
105
106 do {
107 const size_t bytes = min_t(size_t, len, SZ_4K);
108
109 kernel_fpu_begin();
110 if (IS_ENABLED(CONFIG_AS_AVX512) && static_branch_likely(&poly1305_use_avx512))
111 poly1305_blocks_avx512(ctx, inp, bytes, padbit);
112 else if (static_branch_likely(&poly1305_use_avx2))
113 poly1305_blocks_avx2(ctx, inp, bytes, padbit);
114 else
115 poly1305_blocks_avx(ctx, inp, bytes, padbit);
116 kernel_fpu_end();
117
118 len -= bytes;
119 inp += bytes;
120 } while (len);
121}
122
123static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
124 const u32 nonce[4])
125{
126 if (!static_branch_likely(&poly1305_use_avx))
127 poly1305_emit_x86_64(ctx, mac, nonce);
128 else
129 poly1305_emit_avx(ctx, mac, nonce);
130}
131
132void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
133{
134 poly1305_simd_init(&dctx->h, key);
135 dctx->s[0] = get_unaligned_le32(&key[16]);
136 dctx->s[1] = get_unaligned_le32(&key[20]);
137 dctx->s[2] = get_unaligned_le32(&key[24]);
138 dctx->s[3] = get_unaligned_le32(&key[28]);
139 dctx->buflen = 0;
140 dctx->sset = true;
141}
142EXPORT_SYMBOL(poly1305_init_arch);
143
144static unsigned int crypto_poly1305_setdctxkey(struct poly1305_desc_ctx *dctx,
145 const u8 *inp, unsigned int len)
146{
147 unsigned int acc = 0;
148 if (unlikely(!dctx->sset)) {
149 if (!dctx->rset && len >= POLY1305_BLOCK_SIZE) {
150 poly1305_simd_init(&dctx->h, inp);
151 inp += POLY1305_BLOCK_SIZE;
152 len -= POLY1305_BLOCK_SIZE;
153 acc += POLY1305_BLOCK_SIZE;
154 dctx->rset = 1;
155 }
156 if (len >= POLY1305_BLOCK_SIZE) {
157 dctx->s[0] = get_unaligned_le32(&inp[0]);
158 dctx->s[1] = get_unaligned_le32(&inp[4]);
159 dctx->s[2] = get_unaligned_le32(&inp[8]);
160 dctx->s[3] = get_unaligned_le32(&inp[12]);
161 acc += POLY1305_BLOCK_SIZE;
162 dctx->sset = true;
163 }
164 }
165 return acc;
166}
167
168void poly1305_update_arch(struct poly1305_desc_ctx *dctx, const u8 *src,
169 unsigned int srclen)
170{
171 unsigned int bytes, used;
172
173 if (unlikely(dctx->buflen)) {
174 bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
175 memcpy(dctx->buf + dctx->buflen, src, bytes);
176 src += bytes;
177 srclen -= bytes;
178 dctx->buflen += bytes;
179
180 if (dctx->buflen == POLY1305_BLOCK_SIZE) {
181 if (likely(!crypto_poly1305_setdctxkey(dctx, dctx->buf, POLY1305_BLOCK_SIZE)))
182 poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1);
183 dctx->buflen = 0;
184 }
185 }
186
187 if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
188 bytes = round_down(srclen, POLY1305_BLOCK_SIZE);
189 srclen -= bytes;
190 used = crypto_poly1305_setdctxkey(dctx, src, bytes);
191 if (likely(bytes - used))
192 poly1305_simd_blocks(&dctx->h, src + used, bytes - used, 1);
193 src += bytes;
194 }
195
196 if (unlikely(srclen)) {
197 dctx->buflen = srclen;
198 memcpy(dctx->buf, src, srclen);
199 }
200}
201EXPORT_SYMBOL(poly1305_update_arch);
202
203void poly1305_final_arch(struct poly1305_desc_ctx *dctx, u8 *dst)
204{
205 if (unlikely(dctx->buflen)) {
206 dctx->buf[dctx->buflen++] = 1;
207 memset(dctx->buf + dctx->buflen, 0,
208 POLY1305_BLOCK_SIZE - dctx->buflen);
209 poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0);
210 }
211
212 poly1305_simd_emit(&dctx->h, dst, dctx->s);
213 memzero_explicit(dctx, sizeof(*dctx));
214}
215EXPORT_SYMBOL(poly1305_final_arch);
216
217static int crypto_poly1305_init(struct shash_desc *desc)
218{
219 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
220
221 *dctx = (struct poly1305_desc_ctx){};
222 return 0;
223}
224
225static int crypto_poly1305_update(struct shash_desc *desc,
226 const u8 *src, unsigned int srclen)
227{
228 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
229
230 poly1305_update_arch(dctx, src, srclen);
231 return 0;
232}
233
234static int crypto_poly1305_final(struct shash_desc *desc, u8 *dst)
235{
236 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
237
238 if (unlikely(!dctx->sset))
239 return -ENOKEY;
240
241 poly1305_final_arch(dctx, dst);
242 return 0;
243}
244
245static struct shash_alg alg = {
246 .digestsize = POLY1305_DIGEST_SIZE,
247 .init = crypto_poly1305_init,
248 .update = crypto_poly1305_update,
249 .final = crypto_poly1305_final,
250 .descsize = sizeof(struct poly1305_desc_ctx),
251 .base = {
252 .cra_name = "poly1305",
253 .cra_driver_name = "poly1305-simd",
254 .cra_priority = 300,
255 .cra_blocksize = POLY1305_BLOCK_SIZE,
256 .cra_module = THIS_MODULE,
257 },
258};
259
260static int __init poly1305_simd_mod_init(void)
261{
262 if (boot_cpu_has(X86_FEATURE_AVX) &&
263 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
264 static_branch_enable(&poly1305_use_avx);
265 if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) &&
266 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
267 static_branch_enable(&poly1305_use_avx2);
268 if (IS_ENABLED(CONFIG_AS_AVX512) && boot_cpu_has(X86_FEATURE_AVX) &&
269 boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_AVX512F) &&
270 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM | XFEATURE_MASK_AVX512, NULL) &&
271 /* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */
272 boot_cpu_data.x86_vfm != INTEL_SKYLAKE_X)
273 static_branch_enable(&poly1305_use_avx512);
274 return IS_REACHABLE(CONFIG_CRYPTO_HASH) ? crypto_register_shash(&alg) : 0;
275}
276
277static void __exit poly1305_simd_mod_exit(void)
278{
279 if (IS_REACHABLE(CONFIG_CRYPTO_HASH))
280 crypto_unregister_shash(&alg);
281}
282
283module_init(poly1305_simd_mod_init);
284module_exit(poly1305_simd_mod_exit);
285
286MODULE_LICENSE("GPL");
287MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
288MODULE_DESCRIPTION("Poly1305 authenticator");
289MODULE_ALIAS_CRYPTO("poly1305");
290MODULE_ALIAS_CRYPTO("poly1305-simd");
1/*
2 * Poly1305 authenticator algorithm, RFC7539, SIMD glue code
3 *
4 * Copyright (C) 2015 Martin Willi
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 */
11
12#include <crypto/algapi.h>
13#include <crypto/internal/hash.h>
14#include <crypto/poly1305.h>
15#include <linux/crypto.h>
16#include <linux/kernel.h>
17#include <linux/module.h>
18#include <asm/fpu/api.h>
19#include <asm/simd.h>
20
21struct poly1305_simd_desc_ctx {
22 struct poly1305_desc_ctx base;
23 /* derived key u set? */
24 bool uset;
25#ifdef CONFIG_AS_AVX2
26 /* derived keys r^3, r^4 set? */
27 bool wset;
28#endif
29 /* derived Poly1305 key r^2 */
30 u32 u[5];
31 /* ... silently appended r^3 and r^4 when using AVX2 */
32};
33
34asmlinkage void poly1305_block_sse2(u32 *h, const u8 *src,
35 const u32 *r, unsigned int blocks);
36asmlinkage void poly1305_2block_sse2(u32 *h, const u8 *src, const u32 *r,
37 unsigned int blocks, const u32 *u);
38#ifdef CONFIG_AS_AVX2
39asmlinkage void poly1305_4block_avx2(u32 *h, const u8 *src, const u32 *r,
40 unsigned int blocks, const u32 *u);
41static bool poly1305_use_avx2;
42#endif
43
44static int poly1305_simd_init(struct shash_desc *desc)
45{
46 struct poly1305_simd_desc_ctx *sctx = shash_desc_ctx(desc);
47
48 sctx->uset = false;
49#ifdef CONFIG_AS_AVX2
50 sctx->wset = false;
51#endif
52
53 return crypto_poly1305_init(desc);
54}
55
56static void poly1305_simd_mult(u32 *a, const u32 *b)
57{
58 u8 m[POLY1305_BLOCK_SIZE];
59
60 memset(m, 0, sizeof(m));
61 /* The poly1305 block function adds a hi-bit to the accumulator which
62 * we don't need for key multiplication; compensate for it. */
63 a[4] -= 1 << 24;
64 poly1305_block_sse2(a, m, b, 1);
65}
66
67static unsigned int poly1305_simd_blocks(struct poly1305_desc_ctx *dctx,
68 const u8 *src, unsigned int srclen)
69{
70 struct poly1305_simd_desc_ctx *sctx;
71 unsigned int blocks, datalen;
72
73 BUILD_BUG_ON(offsetof(struct poly1305_simd_desc_ctx, base));
74 sctx = container_of(dctx, struct poly1305_simd_desc_ctx, base);
75
76 if (unlikely(!dctx->sset)) {
77 datalen = crypto_poly1305_setdesckey(dctx, src, srclen);
78 src += srclen - datalen;
79 srclen = datalen;
80 }
81
82#ifdef CONFIG_AS_AVX2
83 if (poly1305_use_avx2 && srclen >= POLY1305_BLOCK_SIZE * 4) {
84 if (unlikely(!sctx->wset)) {
85 if (!sctx->uset) {
86 memcpy(sctx->u, dctx->r, sizeof(sctx->u));
87 poly1305_simd_mult(sctx->u, dctx->r);
88 sctx->uset = true;
89 }
90 memcpy(sctx->u + 5, sctx->u, sizeof(sctx->u));
91 poly1305_simd_mult(sctx->u + 5, dctx->r);
92 memcpy(sctx->u + 10, sctx->u + 5, sizeof(sctx->u));
93 poly1305_simd_mult(sctx->u + 10, dctx->r);
94 sctx->wset = true;
95 }
96 blocks = srclen / (POLY1305_BLOCK_SIZE * 4);
97 poly1305_4block_avx2(dctx->h, src, dctx->r, blocks, sctx->u);
98 src += POLY1305_BLOCK_SIZE * 4 * blocks;
99 srclen -= POLY1305_BLOCK_SIZE * 4 * blocks;
100 }
101#endif
102 if (likely(srclen >= POLY1305_BLOCK_SIZE * 2)) {
103 if (unlikely(!sctx->uset)) {
104 memcpy(sctx->u, dctx->r, sizeof(sctx->u));
105 poly1305_simd_mult(sctx->u, dctx->r);
106 sctx->uset = true;
107 }
108 blocks = srclen / (POLY1305_BLOCK_SIZE * 2);
109 poly1305_2block_sse2(dctx->h, src, dctx->r, blocks, sctx->u);
110 src += POLY1305_BLOCK_SIZE * 2 * blocks;
111 srclen -= POLY1305_BLOCK_SIZE * 2 * blocks;
112 }
113 if (srclen >= POLY1305_BLOCK_SIZE) {
114 poly1305_block_sse2(dctx->h, src, dctx->r, 1);
115 srclen -= POLY1305_BLOCK_SIZE;
116 }
117 return srclen;
118}
119
120static int poly1305_simd_update(struct shash_desc *desc,
121 const u8 *src, unsigned int srclen)
122{
123 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
124 unsigned int bytes;
125
126 /* kernel_fpu_begin/end is costly, use fallback for small updates */
127 if (srclen <= 288 || !may_use_simd())
128 return crypto_poly1305_update(desc, src, srclen);
129
130 kernel_fpu_begin();
131
132 if (unlikely(dctx->buflen)) {
133 bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
134 memcpy(dctx->buf + dctx->buflen, src, bytes);
135 src += bytes;
136 srclen -= bytes;
137 dctx->buflen += bytes;
138
139 if (dctx->buflen == POLY1305_BLOCK_SIZE) {
140 poly1305_simd_blocks(dctx, dctx->buf,
141 POLY1305_BLOCK_SIZE);
142 dctx->buflen = 0;
143 }
144 }
145
146 if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
147 bytes = poly1305_simd_blocks(dctx, src, srclen);
148 src += srclen - bytes;
149 srclen = bytes;
150 }
151
152 kernel_fpu_end();
153
154 if (unlikely(srclen)) {
155 dctx->buflen = srclen;
156 memcpy(dctx->buf, src, srclen);
157 }
158
159 return 0;
160}
161
162static struct shash_alg alg = {
163 .digestsize = POLY1305_DIGEST_SIZE,
164 .init = poly1305_simd_init,
165 .update = poly1305_simd_update,
166 .final = crypto_poly1305_final,
167 .setkey = crypto_poly1305_setkey,
168 .descsize = sizeof(struct poly1305_simd_desc_ctx),
169 .base = {
170 .cra_name = "poly1305",
171 .cra_driver_name = "poly1305-simd",
172 .cra_priority = 300,
173 .cra_flags = CRYPTO_ALG_TYPE_SHASH,
174 .cra_alignmask = sizeof(u32) - 1,
175 .cra_blocksize = POLY1305_BLOCK_SIZE,
176 .cra_module = THIS_MODULE,
177 },
178};
179
180static int __init poly1305_simd_mod_init(void)
181{
182 if (!cpu_has_xmm2)
183 return -ENODEV;
184
185#ifdef CONFIG_AS_AVX2
186 poly1305_use_avx2 = cpu_has_avx && cpu_has_avx2 &&
187 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL);
188 alg.descsize = sizeof(struct poly1305_simd_desc_ctx);
189 if (poly1305_use_avx2)
190 alg.descsize += 10 * sizeof(u32);
191#endif
192 return crypto_register_shash(&alg);
193}
194
195static void __exit poly1305_simd_mod_exit(void)
196{
197 crypto_unregister_shash(&alg);
198}
199
200module_init(poly1305_simd_mod_init);
201module_exit(poly1305_simd_mod_exit);
202
203MODULE_LICENSE("GPL");
204MODULE_AUTHOR("Martin Willi <martin@strongswan.org>");
205MODULE_DESCRIPTION("Poly1305 authenticator");
206MODULE_ALIAS_CRYPTO("poly1305");
207MODULE_ALIAS_CRYPTO("poly1305-simd");