Re: [PATCH] crypto: aegis: fix badly optimized clang output

From: Joe Perches <joe@perches.com>
To: Arnd Bergmann <arnd@arndb.de>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>
Cc: Ondrej Mosnacek <omosnacek@gmail.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
	clang-built-linux@googlegroups.com
Subject: Re: [PATCH] crypto: aegis: fix badly optimized clang output
Date: Thu, 18 Jul 2019 09:18:35 -0700	[thread overview]
Message-ID: <db0a363fa35f1582f20e529d79927995a5512c0d.camel@perches.com> (raw)
In-Reply-To: <20190718135017.2493006-1-arnd@arndb.de>

On Thu, 2019-07-18 at 15:50 +0200, Arnd Bergmann wrote:
> Clang sometimes makes very different inlining decisions from gcc.
> In case of the aegis crypto algorithms, it decides to turn the innermost
> primitives (and, xor, ...) into separate functions but inline most of
> the rest.

> This results in a huge amount of variables spilled on the stack, leading
> to rather slow execution as well as kernel stack usage beyond the 32-bit
> warning limit when CONFIG_KASAN is enabled:
> 
> crypto/aegis256.c:123:13: warning: stack frame size of 648 bytes in function 'crypto_aegis256_encrypt_chunk' [-Wframe-larger-than=]
> crypto/aegis256.c:366:13: warning: stack frame size of 1264 bytes in function 'crypto_aegis256_crypt' [-Wframe-larger-than=]
> crypto/aegis256.c:187:13: warning: stack frame size of 656 bytes in function 'crypto_aegis256_decrypt_chunk' [-Wframe-larger-than=]
> crypto/aegis128l.c:135:13: warning: stack frame size of 832 bytes in function 'crypto_aegis128l_encrypt_chunk' [-Wframe-larger-than=]
> crypto/aegis128l.c:415:13: warning: stack frame size of 1480 bytes in function 'crypto_aegis128l_crypt' [-Wframe-larger-than=]
> crypto/aegis128l.c:218:13: warning: stack frame size of 848 bytes in function 'crypto_aegis128l_decrypt_chunk' [-Wframe-larger-than=]
> crypto/aegis128.c:116:13: warning: stack frame size of 584 bytes in function 'crypto_aegis128_encrypt_chunk' [-Wframe-larger-than=]
> crypto/aegis128.c:351:13: warning: stack frame size of 1064 bytes in function 'crypto_aegis128_crypt' [-Wframe-larger-than=]
> crypto/aegis128.c:177:13: warning: stack frame size of 592 bytes in function 'crypto_aegis128_decrypt_chunk' [-Wframe-larger-than=]
> 
> Forcing the primitives to all get inlined avoids the issue and the
> resulting code is similar to what gcc produces.

Why weren't these functions in .h files
not always marked with inline?

Are there other static non-inlined function
definitions in .h files that should also get
this inline/__always_inline marking?

I presume there are but can't think of a
reasonable way to find them off the top of
my head.

> 
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  crypto/aegis.h | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/crypto/aegis.h b/crypto/aegis.h
> index 41a3090cda8e..efed7251c49d 100644
> --- a/crypto/aegis.h
> +++ b/crypto/aegis.h
> @@ -34,21 +34,21 @@ static const union aegis_block crypto_aegis_const[2] = {
>  	} },
>  };
>  
> -static void crypto_aegis_block_xor(union aegis_block *dst,
> +static __always_inline void crypto_aegis_block_xor(union aegis_block *dst,
>  				   const union aegis_block *src)
>  {
>  	dst->words64[0] ^= src->words64[0];
>  	dst->words64[1] ^= src->words64[1];
>  }
>  
> -static void crypto_aegis_block_and(union aegis_block *dst,
> +static __always_inline void crypto_aegis_block_and(union aegis_block *dst,
>  				   const union aegis_block *src)
>  {
>  	dst->words64[0] &= src->words64[0];
>  	dst->words64[1] &= src->words64[1];
>  }
>  
> -static void crypto_aegis_aesenc(union aegis_block *dst,
> +static __always_inline void crypto_aegis_aesenc(union aegis_block *dst,
>  				const union aegis_block *src,
>  				const union aegis_block *key)
>  {