1 // SPDX-License-Identifier: GPL-2.0 OR MIT 2 /* 3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 4 */ 5 6 #include <asm/cpu_device_id.h> 7 #include <asm/fpu/api.h> 8 #include <crypto/internal/poly1305.h> 9 #include <linux/jump_label.h> 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/sizes.h> 13 #include <linux/unaligned.h> 14 15 struct poly1305_arch_internal { 16 union { 17 struct { 18 u32 h[5]; 19 u32 is_base2_26; 20 }; 21 u64 hs[3]; 22 }; 23 u64 r[2]; 24 u64 pad; 25 struct { u32 r2, r1, r4, r3; } rn[9]; 26 }; 27 28 /* 29 * The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit 30 * the unfortunate situation of using AVX and then having to go back to scalar 31 * -- because the user is silly and has called the update function from two 32 * separate contexts -- then we need to convert back to the original base before 33 * proceeding. It is possible to reason that the initial reduction below is 34 * sufficient given the implementation invariants. However, for an avoidance of 35 * doubt and because this is not performance critical, we do the full reduction 36 * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py 37 */ 38 static void convert_to_base2_64(void *ctx) 39 { 40 struct poly1305_arch_internal *state = ctx; 41 u32 cy; 42 43 if (!state->is_base2_26) 44 return; 45 46 cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy; 47 cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy; 48 cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy; 49 cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy; 50 state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0]; 51 state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12); 52 state->hs[2] = state->h[4] >> 24; 53 /* Unsigned Less Than: branchlessly produces 1 if a < b, else 0. */ 54 #define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1)) 55 cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL); 56 state->hs[2] &= 3; 57 state->hs[0] += cy; 58 state->hs[1] += (cy = ULT(state->hs[0], cy)); 59 state->hs[2] += ULT(state->hs[1], cy); 60 #undef ULT 61 state->is_base2_26 = 0; 62 } 63 64 asmlinkage void poly1305_block_init_arch( 65 struct poly1305_block_state *state, 66 const u8 raw_key[POLY1305_BLOCK_SIZE]); 67 EXPORT_SYMBOL_GPL(poly1305_block_init_arch); 68 asmlinkage void poly1305_blocks_x86_64(struct poly1305_arch_internal *ctx, 69 const u8 *inp, 70 const size_t len, const u32 padbit); 71 asmlinkage void poly1305_emit_x86_64(const struct poly1305_state *ctx, 72 u8 mac[POLY1305_DIGEST_SIZE], 73 const u32 nonce[4]); 74 asmlinkage void poly1305_emit_avx(const struct poly1305_state *ctx, 75 u8 mac[POLY1305_DIGEST_SIZE], 76 const u32 nonce[4]); 77 asmlinkage void poly1305_blocks_avx(struct poly1305_arch_internal *ctx, 78 const u8 *inp, const size_t len, 79 const u32 padbit); 80 asmlinkage void poly1305_blocks_avx2(struct poly1305_arch_internal *ctx, 81 const u8 *inp, const size_t len, 82 const u32 padbit); 83 asmlinkage void poly1305_blocks_avx512(struct poly1305_arch_internal *ctx, 84 const u8 *inp, 85 const size_t len, const u32 padbit); 86 87 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx); 88 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2); 89 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512); 90 91 void poly1305_blocks_arch(struct poly1305_block_state *state, const u8 *inp, 92 unsigned int len, u32 padbit) 93 { 94 struct poly1305_arch_internal *ctx = 95 container_of(&state->h.h, struct poly1305_arch_internal, h); 96 97 /* SIMD disables preemption, so relax after processing each page. */ 98 BUILD_BUG_ON(SZ_4K < POLY1305_BLOCK_SIZE || 99 SZ_4K % POLY1305_BLOCK_SIZE); 100 101 /* 102 * The AVX implementations have significant setup overhead (e.g. key 103 * power computation, kernel FPU enabling) which makes them slower for 104 * short messages. Fall back to the scalar implementation for messages 105 * shorter than 288 bytes, unless the AVX-specific key setup has already 106 * been performed (indicated by ctx->is_base2_26). 107 */ 108 if (!static_branch_likely(&poly1305_use_avx) || 109 (len < POLY1305_BLOCK_SIZE * 18 && !ctx->is_base2_26) || 110 unlikely(!irq_fpu_usable())) { 111 convert_to_base2_64(ctx); 112 poly1305_blocks_x86_64(ctx, inp, len, padbit); 113 return; 114 } 115 116 do { 117 const unsigned int bytes = min(len, SZ_4K); 118 119 kernel_fpu_begin(); 120 if (static_branch_likely(&poly1305_use_avx512)) 121 poly1305_blocks_avx512(ctx, inp, bytes, padbit); 122 else if (static_branch_likely(&poly1305_use_avx2)) 123 poly1305_blocks_avx2(ctx, inp, bytes, padbit); 124 else 125 poly1305_blocks_avx(ctx, inp, bytes, padbit); 126 kernel_fpu_end(); 127 128 len -= bytes; 129 inp += bytes; 130 } while (len); 131 } 132 EXPORT_SYMBOL_GPL(poly1305_blocks_arch); 133 134 void poly1305_emit_arch(const struct poly1305_state *ctx, 135 u8 mac[POLY1305_DIGEST_SIZE], const u32 nonce[4]) 136 { 137 if (!static_branch_likely(&poly1305_use_avx)) 138 poly1305_emit_x86_64(ctx, mac, nonce); 139 else 140 poly1305_emit_avx(ctx, mac, nonce); 141 } 142 EXPORT_SYMBOL_GPL(poly1305_emit_arch); 143 144 bool poly1305_is_arch_optimized(void) 145 { 146 return static_key_enabled(&poly1305_use_avx); 147 } 148 EXPORT_SYMBOL(poly1305_is_arch_optimized); 149 150 static int __init poly1305_simd_mod_init(void) 151 { 152 if (boot_cpu_has(X86_FEATURE_AVX) && 153 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL)) 154 static_branch_enable(&poly1305_use_avx); 155 if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) && 156 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL)) 157 static_branch_enable(&poly1305_use_avx2); 158 if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) && 159 boot_cpu_has(X86_FEATURE_AVX512F) && 160 cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM | XFEATURE_MASK_AVX512, NULL) && 161 /* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */ 162 boot_cpu_data.x86_vfm != INTEL_SKYLAKE_X) 163 static_branch_enable(&poly1305_use_avx512); 164 return 0; 165 } 166 subsys_initcall(poly1305_simd_mod_init); 167 168 static void __exit poly1305_simd_mod_exit(void) 169 { 170 } 171 module_exit(poly1305_simd_mod_exit); 172 173 MODULE_LICENSE("GPL"); 174 MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>"); 175 MODULE_DESCRIPTION("Poly1305 authenticator"); 176