From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B2BFC67863 for ; Sat, 20 Oct 2018 03:35:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D2CFE20836 for ; Sat, 20 Oct 2018 03:35:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=linaro.org header.i=@linaro.org header.b="EJR4ssMd" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D2CFE20836 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726566AbeJTLoT (ORCPT ); Sat, 20 Oct 2018 07:44:19 -0400 Received: from mail-it1-f196.google.com ([209.85.166.196]:37842 "EHLO mail-it1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725975AbeJTLoT (ORCPT ); Sat, 20 Oct 2018 07:44:19 -0400 Received: by mail-it1-f196.google.com with SMTP id e74-v6so6759191ita.2 for ; Fri, 19 Oct 2018 20:35:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mCmF0bnFLzFhsHH29nwLxaYL5jvjaMqWX/3lIQPpCGw=; b=EJR4ssMdoC9wQFKRAm1Ra/cnoEI4ZnOsDa0ZQx7vBfs9tHO4eHbgETLdGpfGiKiRkZ +UxvfNlUROBqPpp2FwUz56lXWWs7S6TnOJynOhjfWw2FoMLrbkfvMkbyMpl0QAOS+Nbi +4kz7CVFOzRfu3+3KxGucxSCVAfCfQmrDPkPw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mCmF0bnFLzFhsHH29nwLxaYL5jvjaMqWX/3lIQPpCGw=; b=NkL7q9GdCUH6/kBc9Awns3IpC0zsV+/xHHIxiXLHG9Sce0GM7jr1fx2AVsIKej+UNB by7ExDK8yc7M/Yo7rTiOi7SWwuZXkaaserasO2/HiWkV2NRLDd/RM38z9VsCsUB/J0/w UxArsLlDCruBqPs0X6UXW/DyDFN5rnhFLMJo+o8iSbsNk60reFofT6/UgD4dF9ro+QZj 7HB3BUp5iLuqH5rmfQ1+i0BbJJ1lpSuTTRcO2Wa2GdH/ELPPEd18T1bbuYgnK6BMHmd8 OvivvkUQ140bu2wZ00NZghi73mi/ypAEgyxrH/Cznt8nR9HauahmsH7GYgeg+ecVvQzn Wo+A== X-Gm-Message-State: ABuFfoi4ZDkkjE/YM0s/vjbPbkexqqevJuj39eia+q1v/S80A5szNB7M SvOSoBH+mIafgQA/AcdG1wIy9I8HbzgqYIHD3h5LKw== X-Google-Smtp-Source: ACcGV62AzcjuB1hc0Cbs20f3guQ0UnDrpLZ3ZXDpsL6UH+JfMHLprBaxxXPYpVyvTa8KleRsES9WYkVHOSNUH4fJdAk= X-Received: by 2002:a24:e08f:: with SMTP id c137-v6mr5011186ith.71.1540006523324; Fri, 19 Oct 2018 20:35:23 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a6b:5910:0:0:0:0:0 with HTTP; Fri, 19 Oct 2018 20:35:22 -0700 (PDT) In-Reply-To: <20181015175424.97147-7-ebiggers@kernel.org> References: <20181015175424.97147-1-ebiggers@kernel.org> <20181015175424.97147-7-ebiggers@kernel.org> From: Ard Biesheuvel Date: Sat, 20 Oct 2018 11:35:22 +0800 Message-ID: Subject: Re: [RFC PATCH v2 06/12] crypto: arm/chacha20 - refactor to allow varying number of rounds To: Eric Biggers Cc: "open list:HARDWARE RANDOM NUMBER GENERATOR CORE" , linux-fscrypt@vger.kernel.org, linux-arm-kernel , Linux Kernel Mailing List , Herbert Xu , Paul Crowley , Greg Kaiser , Michael Halcrow , "Jason A . Donenfeld" , Samuel Neves , Tomer Ashur Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 16 October 2018 at 01:54, Eric Biggers wrote: > From: Eric Biggers > > In preparation for adding XChaCha12 support, rename/refactor the NEON > implementation of ChaCha20 to support different numbers of rounds. > > Signed-off-by: Eric Biggers Reviewed-by: Ard Biesheuvel > --- > arch/arm/crypto/Makefile | 4 +- > ...hacha20-neon-core.S => chacha-neon-core.S} | 36 ++++++------ > ...hacha20-neon-glue.c => chacha-neon-glue.c} | 56 ++++++++++--------- > 3 files changed, 52 insertions(+), 44 deletions(-) > rename arch/arm/crypto/{chacha20-neon-core.S => chacha-neon-core.S} (96%) > rename arch/arm/crypto/{chacha20-neon-glue.c => chacha-neon-glue.c} (73%) > > diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile > index bd5bceef0605f..005482ff95047 100644 > --- a/arch/arm/crypto/Makefile > +++ b/arch/arm/crypto/Makefile > @@ -9,7 +9,7 @@ obj-$(CONFIG_CRYPTO_SHA1_ARM) += sha1-arm.o > obj-$(CONFIG_CRYPTO_SHA1_ARM_NEON) += sha1-arm-neon.o > obj-$(CONFIG_CRYPTO_SHA256_ARM) += sha256-arm.o > obj-$(CONFIG_CRYPTO_SHA512_ARM) += sha512-arm.o > -obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o > +obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha-neon.o > I take it you are preserving the Kconfig symbol name to prevent breaking existing configs? If so, we might consider doing something like config CRYPTO_CHACHA20_NEON tristate config CRYPTO_CHACHA_NEON default CRYPTO_CHACHA20_NEON ... the existing kconfig symbol description ... and drop the former at some point in the future? > ce-obj-$(CONFIG_CRYPTO_AES_ARM_CE) += aes-arm-ce.o > ce-obj-$(CONFIG_CRYPTO_SHA1_ARM_CE) += sha1-arm-ce.o > @@ -52,7 +52,7 @@ aes-arm-ce-y := aes-ce-core.o aes-ce-glue.o > ghash-arm-ce-y := ghash-ce-core.o ghash-ce-glue.o > crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o > crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o > -chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o > +chacha-neon-y := chacha-neon-core.o chacha-neon-glue.o > > ifdef REGENERATE_ARM_CRYPTO > quiet_cmd_perl = PERL $@ > diff --git a/arch/arm/crypto/chacha20-neon-core.S b/arch/arm/crypto/chacha-neon-core.S > similarity index 96% > rename from arch/arm/crypto/chacha20-neon-core.S > rename to arch/arm/crypto/chacha-neon-core.S > index db59f1fbc728b..4b12064449f78 100644 > --- a/arch/arm/crypto/chacha20-neon-core.S > +++ b/arch/arm/crypto/chacha-neon-core.S > @@ -1,5 +1,5 @@ > /* > - * ChaCha20 256-bit cipher algorithm, RFC7539, ARM NEON functions > + * ChaCha/XChaCha NEON helper functions > * > * Copyright (C) 2016 Linaro, Ltd. > * > @@ -53,18 +53,19 @@ > .align 5 > > /* > - * _chacha20_permute - permute one block > + * _chacha_permute - permute one block > * > * Permute one 64-byte block where the state matrix is stored in the four NEON > * registers q0-q3. It performs matrix operation on four words in parallel, but > * requires shuffling to rearrange the words after each round. > * > + * The round count is given in r3. > + * > * Clobbers: r3, q4-q5 > */ > -.macro _chacha20_permute > +.macro _chacha_permute > > adr ip, .Lrol8_table > - mov r3, #10 > vld1.8 {d10}, [ip, :64] > > .Ldoubleround_\@: > @@ -128,14 +129,15 @@ > // x3 = shuffle32(x3, MASK(0, 3, 2, 1)) > vext.8 q3, q3, q3, #4 > > - subs r3, r3, #1 > + subs r3, r3, #2 > bne .Ldoubleround_\@ > .endm > > -ENTRY(chacha20_block_xor_neon) > +ENTRY(chacha_block_xor_neon) > // r0: Input state matrix, s > // r1: 1 data block output, o > // r2: 1 data block input, i > + // r3: nrounds > > // x0..3 = s0..3 > add ip, r0, #0x20 > @@ -147,7 +149,7 @@ ENTRY(chacha20_block_xor_neon) > vmov q10, q2 > vmov q11, q3 > > - _chacha20_permute > + _chacha_permute > > add ip, r2, #0x20 > vld1.8 {q4-q5}, [r2] > @@ -174,29 +176,31 @@ ENTRY(chacha20_block_xor_neon) > vst1.8 {q2-q3}, [ip] > > bx lr > -ENDPROC(chacha20_block_xor_neon) > +ENDPROC(chacha_block_xor_neon) > > -ENTRY(hchacha20_block_neon) > +ENTRY(hchacha_block_neon) > // r0: Input state matrix, s > // r1: output (8 32-bit words) > + // r2: nrounds > > vld1.32 {q0-q1}, [r0]! > vld1.32 {q2-q3}, [r0] > > - _chacha20_permute > + mov r3, r2 > + _chacha_permute > > vst1.32 {q0}, [r1]! > vst1.32 {q3}, [r1] > > bx lr > -ENDPROC(hchacha20_block_neon) > +ENDPROC(hchacha_block_neon) > > .align 4 > .Lctrinc: .word 0, 1, 2, 3 > .Lrol8_table: .byte 3, 0, 1, 2, 7, 4, 5, 6 > > .align 5 > -ENTRY(chacha20_4block_xor_neon) > +ENTRY(chacha_4block_xor_neon) > push {r4-r5} > mov r4, sp // preserve the stack pointer > sub ip, sp, #0x20 // allocate a 32 byte buffer > @@ -206,9 +210,10 @@ ENTRY(chacha20_4block_xor_neon) > // r0: Input state matrix, s > // r1: 4 data blocks output, o > // r2: 4 data blocks input, i > + // r3: nrounds > > // > - // This function encrypts four consecutive ChaCha20 blocks by loading > + // This function encrypts four consecutive ChaCha blocks by loading > // the state matrix in NEON registers four times. The algorithm performs > // each operation on the corresponding word of each state matrix, hence > // requires no word shuffling. The words are re-interleaved before the > @@ -241,7 +246,6 @@ ENTRY(chacha20_4block_xor_neon) > vdup.32 q0, d0[0] > > adr ip, .Lrol8_table > - mov r3, #10 > b 1f > > .Ldoubleround4: > @@ -439,7 +443,7 @@ ENTRY(chacha20_4block_xor_neon) > vsri.u32 q5, q8, #25 > vsri.u32 q6, q9, #25 > > - subs r3, r3, #1 > + subs r3, r3, #2 > bne .Ldoubleround4 > > // x0..7[0-3] are in q0-q7, x10..15[0-3] are in q10-q15. > @@ -549,4 +553,4 @@ ENTRY(chacha20_4block_xor_neon) > > pop {r4-r5} > bx lr > -ENDPROC(chacha20_4block_xor_neon) > +ENDPROC(chacha_4block_xor_neon) > diff --git a/arch/arm/crypto/chacha20-neon-glue.c b/arch/arm/crypto/chacha-neon-glue.c > similarity index 73% > rename from arch/arm/crypto/chacha20-neon-glue.c > rename to arch/arm/crypto/chacha-neon-glue.c > index becc7990b1d39..b236af4889c61 100644 > --- a/arch/arm/crypto/chacha20-neon-glue.c > +++ b/arch/arm/crypto/chacha-neon-glue.c > @@ -28,24 +28,26 @@ > #include > #include > > -asmlinkage void chacha20_block_xor_neon(u32 *state, u8 *dst, const u8 *src); > -asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src); > -asmlinkage void hchacha20_block_neon(const u32 *state, u32 *out); > - > -static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src, > - unsigned int bytes) > +asmlinkage void chacha_block_xor_neon(const u32 *state, u8 *dst, const u8 *src, > + int nrounds); > +asmlinkage void chacha_4block_xor_neon(const u32 *state, u8 *dst, const u8 *src, > + int nrounds); > +asmlinkage void hchacha_block_neon(const u32 *state, u32 *out, int nrounds); > + > +static void chacha_doneon(u32 *state, u8 *dst, const u8 *src, > + unsigned int bytes, int nrounds) > { > u8 buf[CHACHA_BLOCK_SIZE]; > > while (bytes >= CHACHA_BLOCK_SIZE * 4) { > - chacha20_4block_xor_neon(state, dst, src); > + chacha_4block_xor_neon(state, dst, src, nrounds); > bytes -= CHACHA_BLOCK_SIZE * 4; > src += CHACHA_BLOCK_SIZE * 4; > dst += CHACHA_BLOCK_SIZE * 4; > state[12] += 4; > } > while (bytes >= CHACHA_BLOCK_SIZE) { > - chacha20_block_xor_neon(state, dst, src); > + chacha_block_xor_neon(state, dst, src, nrounds); > bytes -= CHACHA_BLOCK_SIZE; > src += CHACHA_BLOCK_SIZE; > dst += CHACHA_BLOCK_SIZE; > @@ -53,13 +55,13 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src, > } > if (bytes) { > memcpy(buf, src, bytes); > - chacha20_block_xor_neon(state, buf, buf); > + chacha_block_xor_neon(state, buf, buf, nrounds); > memcpy(dst, buf, bytes); > } > } > > -static int chacha20_neon_stream_xor(struct skcipher_request *req, > - struct chacha_ctx *ctx, u8 *iv) > +static int chacha_neon_stream_xor(struct skcipher_request *req, > + struct chacha_ctx *ctx, u8 *iv) > { > struct skcipher_walk walk; > u32 state[16]; > @@ -75,15 +77,15 @@ static int chacha20_neon_stream_xor(struct skcipher_request *req, > if (nbytes < walk.total) > nbytes = round_down(nbytes, walk.stride); > > - chacha20_doneon(state, walk.dst.virt.addr, walk.src.virt.addr, > - nbytes); > + chacha_doneon(state, walk.dst.virt.addr, walk.src.virt.addr, > + nbytes, ctx->nrounds); > err = skcipher_walk_done(&walk, walk.nbytes - nbytes); > } > > return err; > } > > -static int chacha20_neon(struct skcipher_request *req) > +static int chacha_neon(struct skcipher_request *req) > { > struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); > struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm); > @@ -93,12 +95,12 @@ static int chacha20_neon(struct skcipher_request *req) > return crypto_chacha_crypt(req); > > kernel_neon_begin(); > - err = chacha20_neon_stream_xor(req, ctx, req->iv); > + err = chacha_neon_stream_xor(req, ctx, req->iv); > kernel_neon_end(); > return err; > } > > -static int xchacha20_neon(struct skcipher_request *req) > +static int xchacha_neon(struct skcipher_request *req) > { > struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); > struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm); > @@ -114,10 +116,11 @@ static int xchacha20_neon(struct skcipher_request *req) > > kernel_neon_begin(); > > - hchacha20_block_neon(state, subctx.key); > + hchacha_block_neon(state, subctx.key, ctx->nrounds); > + subctx.nrounds = ctx->nrounds; > memcpy(&real_iv[0], req->iv + 24, 8); > memcpy(&real_iv[8], req->iv + 16, 8); > - err = chacha20_neon_stream_xor(req, &subctx, real_iv); > + err = chacha_neon_stream_xor(req, &subctx, real_iv); > > kernel_neon_end(); > > @@ -139,8 +142,8 @@ static struct skcipher_alg algs[] = { > .chunksize = CHACHA_BLOCK_SIZE, > .walksize = 4 * CHACHA_BLOCK_SIZE, > .setkey = crypto_chacha20_setkey, > - .encrypt = chacha20_neon, > - .decrypt = chacha20_neon, > + .encrypt = chacha_neon, > + .decrypt = chacha_neon, > }, { > .base.cra_name = "xchacha20", > .base.cra_driver_name = "xchacha20-neon", > @@ -155,12 +158,12 @@ static struct skcipher_alg algs[] = { > .chunksize = CHACHA_BLOCK_SIZE, > .walksize = 4 * CHACHA_BLOCK_SIZE, > .setkey = crypto_chacha20_setkey, > - .encrypt = xchacha20_neon, > - .decrypt = xchacha20_neon, > + .encrypt = xchacha_neon, > + .decrypt = xchacha_neon, > } > }; > > -static int __init chacha20_simd_mod_init(void) > +static int __init chacha_simd_mod_init(void) > { > if (!(elf_hwcap & HWCAP_NEON)) > return -ENODEV; > @@ -168,14 +171,15 @@ static int __init chacha20_simd_mod_init(void) > return crypto_register_skciphers(algs, ARRAY_SIZE(algs)); > } > > -static void __exit chacha20_simd_mod_fini(void) > +static void __exit chacha_simd_mod_fini(void) > { > crypto_unregister_skciphers(algs, ARRAY_SIZE(algs)); > } > > -module_init(chacha20_simd_mod_init); > -module_exit(chacha20_simd_mod_fini); > +module_init(chacha_simd_mod_init); > +module_exit(chacha_simd_mod_fini); > > +MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (NEON accelerated)"); > MODULE_AUTHOR("Ard Biesheuvel "); > MODULE_LICENSE("GPL v2"); > MODULE_ALIAS_CRYPTO("chacha20"); > -- > 2.19.1.331.ge82ca0e54c-goog >