qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Alex Bennée" <alex.bennee@linaro.org>
To: qemu-devel@nongnu.org
Cc: "Daniel P. Berrangé" <berrange@redhat.com>,
	"Philippe Mathieu-Daudé" <philmd@redhat.com>,
	"Stefano Garzarella" <sgarzare@redhat.com>
Subject: Re: [PULL 4/4] crypto: add support for nettle's native XTS impl
Date: Wed, 30 Oct 2019 14:21:36 +0000	[thread overview]
Message-ID: <87pnie8gb3.fsf@linaro.org> (raw)
In-Reply-To: <20191028154914.84821-5-berrange@redhat.com>


Daniel P. Berrangé <berrange@redhat.com> writes:

> Nettle 3.5.0 will add support for the XTS mode. Use this because long
> term we wish to delete QEMU's XTS impl to avoid carrying private crypto
> algorithm impls.
>
> Unfortunately this degrades nettle performance from 612 MB/s to 568 MB/s
> as nettle's XTS impl isn't so well optimized yet.

Unfortunately this has broken some of the Travis tests, specifically:

  # QEMU configure log Wed 30 Oct 14:16:57 GMT 2019
  # Configured with: '../../configure' '--disable-tools' '--disable-docs' '--static' '--disable-system'

> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  configure              | 18 ++++++++++++++++++
>  crypto/cipher-nettle.c | 18 ++++++++++++++++++
>  2 files changed, 36 insertions(+)
>
> diff --git a/configure b/configure
> index d1e9e457ce..452c2dfe4e 100755
> --- a/configure
> +++ b/configure
> @@ -472,6 +472,7 @@ gtk_gl="no"
>  tls_priority="NORMAL"
>  gnutls=""
>  nettle=""
> +nettle_xts="no"
>  gcrypt=""
>  gcrypt_hmac="no"
>  gcrypt_xts="no"
> @@ -2871,6 +2872,19 @@ if test "$nettle" != "no"; then
>              pass="yes"
>          fi
>      fi
> +    if test "$pass" = "yes"
> +    then
> +        cat > $TMPC << EOF
> +#include <nettle/xts.h>
> +int main(void) {
> +  return 0;
> +}
> +EOF
> +        if compile_prog "$nettle_cflags" "$nettle_libs" ; then
> +            nettle_xts=yes
> +            qemu_private_xts=no
> +        fi
> +    fi
>      if test "$pass" = "no" && test "$nettle" = "yes"; then
>          feature_not_found "nettle" "Install nettle devel >= 2.7.1"
>      else
> @@ -6346,6 +6360,10 @@ then
>     echo "  XTS             $gcrypt_xts"
>  fi
>  echo "nettle            $nettle $(echo_version $nettle $nettle_version)"
> +if test "$nettle" = "yes"
> +then
> +   echo "  XTS             $nettle_xts"
> +fi
>  echo "libtasn1          $tasn1"
>  echo "PAM               $auth_pam"
>  echo "iconv support     $iconv"
> diff --git a/crypto/cipher-nettle.c b/crypto/cipher-nettle.c
> index d7411bb8ff..7e9a4cc199 100644
> --- a/crypto/cipher-nettle.c
> +++ b/crypto/cipher-nettle.c
> @@ -19,7 +19,9 @@
>   */
>
>  #include "qemu/osdep.h"
> +#ifdef CONFIG_QEMU_PRIVATE_XTS
>  #include "crypto/xts.h"
> +#endif
>  #include "cipherpriv.h"
>
>  #include <nettle/nettle-types.h>
> @@ -30,6 +32,9 @@
>  #include <nettle/serpent.h>
>  #include <nettle/twofish.h>
>  #include <nettle/ctr.h>
> +#ifndef CONFIG_QEMU_PRIVATE_XTS
> +#include <nettle/xts.h>
> +#endif
>
>  typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
>                                                 size_t length,
> @@ -626,9 +631,15 @@ qcrypto_nettle_cipher_encrypt(QCryptoCipher *cipher,
>          break;
>
>      case QCRYPTO_CIPHER_MODE_XTS:
> +#ifdef CONFIG_QEMU_PRIVATE_XTS
>          xts_encrypt(ctx->ctx, ctx->ctx_tweak,
>                      ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
>                      ctx->iv, len, out, in);
> +#else
> +        xts_encrypt_message(ctx->ctx, ctx->ctx_tweak,
> +                            ctx->alg_encrypt_native,
> +                            ctx->iv, len, out, in);
> +#endif
>          break;
>
>      case QCRYPTO_CIPHER_MODE_CTR:
> @@ -673,9 +684,16 @@ qcrypto_nettle_cipher_decrypt(QCryptoCipher *cipher,
>          break;
>
>      case QCRYPTO_CIPHER_MODE_XTS:
> +#ifdef CONFIG_QEMU_PRIVATE_XTS
>          xts_decrypt(ctx->ctx, ctx->ctx_tweak,
>                      ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
>                      ctx->iv, len, out, in);
> +#else
> +        xts_decrypt_message(ctx->ctx, ctx->ctx_tweak,
> +                            ctx->alg_decrypt_native,
> +                            ctx->alg_encrypt_native,
> +                            ctx->iv, len, out, in);
> +#endif
>          break;
>      case QCRYPTO_CIPHER_MODE_CTR:
>          ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,


--
Alex Bennée


  reply	other threads:[~2019-10-30 14:22 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-28 15:49 [PULL 0/4] Crypto luks patches Daniel P. Berrangé
2019-10-28 15:49 ` [PULL 1/4] tests: allow filtering crypto cipher benchmark tests Daniel P. Berrangé
2019-10-28 15:49 ` [PULL 2/4] tests: benchmark crypto with fixed data size, not time period Daniel P. Berrangé
2019-10-28 15:49 ` [PULL 3/4] crypto: add support for gcrypt's native XTS impl Daniel P. Berrangé
2019-10-28 15:49 ` [PULL 4/4] crypto: add support for nettle's " Daniel P. Berrangé
2019-10-30 14:21   ` Alex Bennée [this message]
2019-10-29 16:26 ` [PULL 0/4] Crypto luks patches Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87pnie8gb3.fsf@linaro.org \
    --to=alex.bennee@linaro.org \
    --cc=berrange@redhat.com \
    --cc=philmd@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=sgarzare@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).