Commit ba3579e6 authored by Taehee Yoo's avatar Taehee Yoo Committed by Herbert Xu
Browse files

crypto: aria-avx - add AES-NI/AVX/x86_64/GFNI assembler implementation of aria cipher 



The implementation is based on the 32-bit implementation of the aria.
Also, aria-avx process steps are the similar to the camellia-avx.
1. Byteslice(16way)
2. Add-round-key.
3. Sbox
4. Diffusion layer.

Except for s-box, all steps are the same as the aria-generic
implementation. s-box step is very similar to camellia and
sm4 implementation.

There are 2 implementations for s-box step.
One is to use AES-NI and affine transformation, which is the same as
Camellia, sm4, and others.
Another is to use GFNI.
GFNI implementation is faster than AES-NI implementation.
So, it uses GFNI implementation if the running CPU supports GFNI.

There are 4 s-boxes in the ARIA and the 2 s-boxes are the same as
AES's s-boxes.

To calculate the first sbox, it just uses the aesenclast and then
inverts shift_row.
No more process is needed for this job because the first s-box is
the same as the AES encryption s-box.

To calculate the second sbox(invert of s1), it just uses the aesdeclast
and then inverts shift_row.
No more process is needed for this job because the second s-box is
the same as the AES decryption s-box.

To calculate the third s-box, it uses the aesenclast,
then affine transformation, which is combined AES inverse affine and
ARIA S2.

To calculate the last s-box, it uses the aesdeclast,
then affine transformation, which is combined X2 and AES forward affine.

The optimized third and last s-box logic and GFNI s-box logic are
implemented by Jussi Kivilinna.

The aria-generic implementation is based on a 32-bit implementation,
not an 8-bit implementation. the aria-avx Diffusion Layer implementation
is based on aria-generic implementation because 8-bit implementation is
not fit for parallel implementation but 32-bit is enough to fit for this.

Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent a9b0838d

arch/x86/crypto/Kconfig

+18 −0
Original line number Diff line number Diff line
@@ -286,6 +286,24 @@ config CRYPTO_TWOFISH_AVX_X86_64 


	  Processes eight blocks in parallel.



config CRYPTO_ARIA_AESNI_AVX_X86_64

	tristate "Ciphers: ARIA with modes: ECB, CTR (AES-NI/AVX/GFNI)"

	depends on X86 && 64BIT

	select CRYPTO_SKCIPHER

	select CRYPTO_SIMD

	select CRYPTO_ALGAPI

	select CRYPTO_ARIA

	help

	  Length-preserving cipher: ARIA cipher algorithms

	  (RFC 5794) with ECB and CTR modes



	  Architecture: x86_64 using:

	  - AES-NI (AES New Instructions)

	  - AVX (Advanced Vector Extensions)

	  - GFNI (Galois Field New Instructions)



	  Processes 16 blocks in parallel.



config CRYPTO_CHACHA20_X86_64

	tristate "Ciphers: ChaCha20, XChaCha20, XChaCha12 (SSSE3/AVX2/AVX-512VL)"

	depends on X86 && 64BIT

arch/x86/crypto/Makefile

+3 −0
Original line number Diff line number Diff line
@@ -100,6 +100,9 @@ sm4-aesni-avx-x86_64-y := sm4-aesni-avx-asm_64.o sm4_aesni_avx_glue.o 
obj-$(CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64) += sm4-aesni-avx2-x86_64.o

sm4-aesni-avx2-x86_64-y := sm4-aesni-avx2-asm_64.o sm4_aesni_avx2_glue.o



obj-$(CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64) += aria-aesni-avx-x86_64.o

aria-aesni-avx-x86_64-y := aria-aesni-avx-asm_64.o aria_aesni_avx_glue.o



quiet_cmd_perlasm = PERLASM $@

      cmd_perlasm = $(PERL) $< > $@

$(obj)/%.S: $(src)/%.pl FORCE

arch/x86/crypto/aria-aesni-avx-asm_64.S

0 → 100644
+1303 −0

File added.

Preview size limit exceeded, changes collapsed.

arch/x86/crypto/aria-avx.h

0 → 100644
+16 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-or-later */

#ifndef ASM_X86_ARIA_AVX_H

#define ASM_X86_ARIA_AVX_H



#include <linux/types.h>



#define ARIA_AESNI_PARALLEL_BLOCKS 16

#define ARIA_AESNI_PARALLEL_BLOCK_SIZE  (ARIA_BLOCK_SIZE * 16)



struct aria_avx_ops {

	void (*aria_encrypt_16way)(const void *ctx, u8 *dst, const u8 *src);

	void (*aria_decrypt_16way)(const void *ctx, u8 *dst, const u8 *src);

	void (*aria_ctr_crypt_16way)(const void *ctx, u8 *dst, const u8 *src,

				     u8 *keystream, u8 *iv);

};

#endif

arch/x86/crypto/aria_aesni_avx_glue.c

0 → 100644
+213 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-or-later */

/*

 * Glue Code for the AVX/AES-NI/GFNI assembler implementation of the ARIA Cipher

 *

 * Copyright (c) 2022 Taehee Yoo <ap420073@gmail.com>

 */



#include <crypto/algapi.h>

#include <crypto/internal/simd.h>

#include <crypto/aria.h>

#include <linux/crypto.h>

#include <linux/err.h>

#include <linux/module.h>

#include <linux/types.h>



#include "ecb_cbc_helpers.h"

#include "aria-avx.h"



asmlinkage void aria_aesni_avx_encrypt_16way(const void *ctx, u8 *dst,

					     const u8 *src);

asmlinkage void aria_aesni_avx_decrypt_16way(const void *ctx, u8 *dst,

					     const u8 *src);

asmlinkage void aria_aesni_avx_ctr_crypt_16way(const void *ctx, u8 *dst,

					       const u8 *src,

					       u8 *keystream, u8 *iv);

asmlinkage void aria_aesni_avx_gfni_encrypt_16way(const void *ctx, u8 *dst,

						  const u8 *src);

asmlinkage void aria_aesni_avx_gfni_decrypt_16way(const void *ctx, u8 *dst,

						  const u8 *src);

asmlinkage void aria_aesni_avx_gfni_ctr_crypt_16way(const void *ctx, u8 *dst,

						    const u8 *src,

						    u8 *keystream, u8 *iv);



static struct aria_avx_ops aria_ops;



static int ecb_do_encrypt(struct skcipher_request *req, const u32 *rkey)

{

	ECB_WALK_START(req, ARIA_BLOCK_SIZE, ARIA_AESNI_PARALLEL_BLOCKS);

	ECB_BLOCK(ARIA_AESNI_PARALLEL_BLOCKS, aria_ops.aria_encrypt_16way);

	ECB_BLOCK(1, aria_encrypt);

	ECB_WALK_END();

}



static int ecb_do_decrypt(struct skcipher_request *req, const u32 *rkey)

{

	ECB_WALK_START(req, ARIA_BLOCK_SIZE, ARIA_AESNI_PARALLEL_BLOCKS);

	ECB_BLOCK(ARIA_AESNI_PARALLEL_BLOCKS, aria_ops.aria_decrypt_16way);

	ECB_BLOCK(1, aria_decrypt);

	ECB_WALK_END();

}



static int aria_avx_ecb_encrypt(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct aria_ctx *ctx = crypto_skcipher_ctx(tfm);



	return ecb_do_encrypt(req, ctx->enc_key[0]);

}



static int aria_avx_ecb_decrypt(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct aria_ctx *ctx = crypto_skcipher_ctx(tfm);



	return ecb_do_decrypt(req, ctx->dec_key[0]);

}



static int aria_avx_set_key(struct crypto_skcipher *tfm, const u8 *key,

			    unsigned int keylen)

{

	return aria_set_key(&tfm->base, key, keylen);

}



static int aria_avx_ctr_encrypt(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct aria_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct skcipher_walk walk;

	unsigned int nbytes;

	int err;



	err = skcipher_walk_virt(&walk, req, false);



	while ((nbytes = walk.nbytes) > 0) {

		const u8 *src = walk.src.virt.addr;

		u8 *dst = walk.dst.virt.addr;



		while (nbytes >= ARIA_AESNI_PARALLEL_BLOCK_SIZE) {

			u8 keystream[ARIA_AESNI_PARALLEL_BLOCK_SIZE];



			kernel_fpu_begin();

			aria_ops.aria_ctr_crypt_16way(ctx, dst, src, keystream,

						      walk.iv);

			kernel_fpu_end();

			dst += ARIA_AESNI_PARALLEL_BLOCK_SIZE;

			src += ARIA_AESNI_PARALLEL_BLOCK_SIZE;

			nbytes -= ARIA_AESNI_PARALLEL_BLOCK_SIZE;

		}



		while (nbytes >= ARIA_BLOCK_SIZE) {

			u8 keystream[ARIA_BLOCK_SIZE];



			memcpy(keystream, walk.iv, ARIA_BLOCK_SIZE);

			crypto_inc(walk.iv, ARIA_BLOCK_SIZE);



			aria_encrypt(ctx, keystream, keystream);



			crypto_xor_cpy(dst, src, keystream, ARIA_BLOCK_SIZE);

			dst += ARIA_BLOCK_SIZE;

			src += ARIA_BLOCK_SIZE;

			nbytes -= ARIA_BLOCK_SIZE;

		}



		if (walk.nbytes == walk.total && nbytes > 0) {

			u8 keystream[ARIA_BLOCK_SIZE];



			memcpy(keystream, walk.iv, ARIA_BLOCK_SIZE);

			crypto_inc(walk.iv, ARIA_BLOCK_SIZE);



			aria_encrypt(ctx, keystream, keystream);



			crypto_xor_cpy(dst, src, keystream, nbytes);

			dst += nbytes;

			src += nbytes;

			nbytes = 0;

		}

		err = skcipher_walk_done(&walk, nbytes);

	}



	return err;

}



static struct skcipher_alg aria_algs[] = {

	{

		.base.cra_name		= "__ecb(aria)",

		.base.cra_driver_name	= "__ecb-aria-avx",

		.base.cra_priority	= 400,

		.base.cra_flags		= CRYPTO_ALG_INTERNAL,

		.base.cra_blocksize	= ARIA_BLOCK_SIZE,

		.base.cra_ctxsize	= sizeof(struct aria_ctx),

		.base.cra_module	= THIS_MODULE,

		.min_keysize		= ARIA_MIN_KEY_SIZE,

		.max_keysize		= ARIA_MAX_KEY_SIZE,

		.setkey			= aria_avx_set_key,

		.encrypt		= aria_avx_ecb_encrypt,

		.decrypt		= aria_avx_ecb_decrypt,

	}, {

		.base.cra_name		= "__ctr(aria)",

		.base.cra_driver_name	= "__ctr-aria-avx",

		.base.cra_priority	= 400,

		.base.cra_flags		= CRYPTO_ALG_INTERNAL,

		.base.cra_blocksize	= 1,

		.base.cra_ctxsize	= sizeof(struct aria_ctx),

		.base.cra_module	= THIS_MODULE,

		.min_keysize		= ARIA_MIN_KEY_SIZE,

		.max_keysize		= ARIA_MAX_KEY_SIZE,

		.ivsize			= ARIA_BLOCK_SIZE,

		.chunksize		= ARIA_BLOCK_SIZE,

		.walksize		= 16 * ARIA_BLOCK_SIZE,

		.setkey			= aria_avx_set_key,

		.encrypt		= aria_avx_ctr_encrypt,

		.decrypt		= aria_avx_ctr_encrypt,

	}

};



static struct simd_skcipher_alg *aria_simd_algs[ARRAY_SIZE(aria_algs)];



static int __init aria_avx_init(void)

{

	const char *feature_name;



	if (!boot_cpu_has(X86_FEATURE_AVX) ||

	    !boot_cpu_has(X86_FEATURE_AES) ||

	    !boot_cpu_has(X86_FEATURE_OSXSAVE)) {

		pr_info("AVX or AES-NI instructions are not detected.\n");

		return -ENODEV;

	}



	if (!cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM,

				&feature_name)) {

		pr_info("CPU feature '%s' is not supported.\n", feature_name);

		return -ENODEV;

	}



	if (boot_cpu_has(X86_FEATURE_GFNI)) {

		aria_ops.aria_encrypt_16way = aria_aesni_avx_gfni_encrypt_16way;

		aria_ops.aria_decrypt_16way = aria_aesni_avx_gfni_decrypt_16way;

		aria_ops.aria_ctr_crypt_16way = aria_aesni_avx_gfni_ctr_crypt_16way;

	} else {

		aria_ops.aria_encrypt_16way = aria_aesni_avx_encrypt_16way;

		aria_ops.aria_decrypt_16way = aria_aesni_avx_decrypt_16way;

		aria_ops.aria_ctr_crypt_16way = aria_aesni_avx_ctr_crypt_16way;

	}



	return simd_register_skciphers_compat(aria_algs,

					      ARRAY_SIZE(aria_algs),

					      aria_simd_algs);

}



static void __exit aria_avx_exit(void)

{

	simd_unregister_skciphers(aria_algs, ARRAY_SIZE(aria_algs),

				  aria_simd_algs);

}



module_init(aria_avx_init);

module_exit(aria_avx_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Taehee Yoo <ap420073@gmail.com>");

MODULE_DESCRIPTION("ARIA Cipher Algorithm, AVX/AES-NI/GFNI optimized");

MODULE_ALIAS_CRYPTO("aria");

MODULE_ALIAS_CRYPTO("aria-aesni-avx");