1d7d7b853SJason A. Donenfeld // SPDX-License-Identifier: GPL-2.0 OR MIT 2c70f4abeSMartin Willi /* 3d7d7b853SJason A. Donenfeld * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 4c70f4abeSMartin Willi */ 5c70f4abeSMartin Willi 6c70f4abeSMartin Willi #include <crypto/algapi.h> 7c70f4abeSMartin Willi #include <crypto/internal/hash.h> 848ea8c6eSArd Biesheuvel #include <crypto/internal/poly1305.h> 9f2abe0d7SEric Biggers #include <crypto/internal/simd.h> 10c70f4abeSMartin Willi #include <linux/crypto.h> 11f0e89bcfSArd Biesheuvel #include <linux/jump_label.h> 12c70f4abeSMartin Willi #include <linux/kernel.h> 13c70f4abeSMartin Willi #include <linux/module.h> 14d7d7b853SJason A. Donenfeld #include <asm/intel-family.h> 15c70f4abeSMartin Willi #include <asm/simd.h> 16c70f4abeSMartin Willi 17d7d7b853SJason A. Donenfeld asmlinkage void poly1305_init_x86_64(void *ctx, 18d7d7b853SJason A. Donenfeld const u8 key[POLY1305_KEY_SIZE]); 19d7d7b853SJason A. Donenfeld asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp, 20d7d7b853SJason A. Donenfeld const size_t len, const u32 padbit); 21d7d7b853SJason A. Donenfeld asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE], 22d7d7b853SJason A. Donenfeld const u32 nonce[4]); 23d7d7b853SJason A. Donenfeld asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE], 24d7d7b853SJason A. Donenfeld const u32 nonce[4]); 25d7d7b853SJason A. Donenfeld asmlinkage void poly1305_blocks_avx(void *ctx, const u8 *inp, const size_t len, 26d7d7b853SJason A. Donenfeld const u32 padbit); 27d7d7b853SJason A. Donenfeld asmlinkage void poly1305_blocks_avx2(void *ctx, const u8 *inp, const size_t len, 28d7d7b853SJason A. Donenfeld const u32 padbit); 29d7d7b853SJason A. Donenfeld asmlinkage void poly1305_blocks_avx512(void *ctx, const u8 *inp, 30d7d7b853SJason A. Donenfeld const size_t len, const u32 padbit); 31da35b22dSMartin Willi 32d7d7b853SJason A. Donenfeld static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx); 33f0e89bcfSArd Biesheuvel static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2); 34d7d7b853SJason A. Donenfeld static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512); 35da35b22dSMartin Willi 36d7d7b853SJason A. Donenfeld struct poly1305_arch_internal { 37d7d7b853SJason A. Donenfeld union { 38d7d7b853SJason A. Donenfeld struct { 39d7d7b853SJason A. Donenfeld u32 h[5]; 40d7d7b853SJason A. Donenfeld u32 is_base2_26; 41d7d7b853SJason A. Donenfeld }; 42d7d7b853SJason A. Donenfeld u64 hs[3]; 43d7d7b853SJason A. Donenfeld }; 44d7d7b853SJason A. Donenfeld u64 r[2]; 45d7d7b853SJason A. Donenfeld u64 pad; 46d7d7b853SJason A. Donenfeld struct { u32 r2, r1, r4, r3; } rn[9]; 47d7d7b853SJason A. Donenfeld }; 48d7d7b853SJason A. Donenfeld 49d7d7b853SJason A. Donenfeld /* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit 50d7d7b853SJason A. Donenfeld * the unfortunate situation of using AVX and then having to go back to scalar 51d7d7b853SJason A. Donenfeld * -- because the user is silly and has called the update function from two 52d7d7b853SJason A. Donenfeld * separate contexts -- then we need to convert back to the original base before 53d7d7b853SJason A. Donenfeld * proceeding. It is possible to reason that the initial reduction below is 54d7d7b853SJason A. Donenfeld * sufficient given the implementation invariants. However, for an avoidance of 55d7d7b853SJason A. Donenfeld * doubt and because this is not performance critical, we do the full reduction 56d7d7b853SJason A. Donenfeld * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py 57d7d7b853SJason A. Donenfeld */ 58d7d7b853SJason A. Donenfeld static void convert_to_base2_64(void *ctx) 591c08a104SJason A. Donenfeld { 60d7d7b853SJason A. Donenfeld struct poly1305_arch_internal *state = ctx; 61d7d7b853SJason A. Donenfeld u32 cy; 621c08a104SJason A. Donenfeld 63d7d7b853SJason A. Donenfeld if (!state->is_base2_26) 641c08a104SJason A. Donenfeld return; 651c08a104SJason A. Donenfeld 66d7d7b853SJason A. Donenfeld cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy; 67d7d7b853SJason A. Donenfeld cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy; 68d7d7b853SJason A. Donenfeld cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy; 69d7d7b853SJason A. Donenfeld cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy; 70d7d7b853SJason A. Donenfeld state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0]; 71d7d7b853SJason A. Donenfeld state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12); 72d7d7b853SJason A. Donenfeld state->hs[2] = state->h[4] >> 24; 73d7d7b853SJason A. Donenfeld #define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1)) 74d7d7b853SJason A. Donenfeld cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL); 75d7d7b853SJason A. Donenfeld state->hs[2] &= 3; 76d7d7b853SJason A. Donenfeld state->hs[0] += cy; 77d7d7b853SJason A. Donenfeld state->hs[1] += (cy = ULT(state->hs[0], cy)); 78d7d7b853SJason A. Donenfeld state->hs[2] += ULT(state->hs[1], cy); 79d7d7b853SJason A. Donenfeld #undef ULT 80d7d7b853SJason A. Donenfeld state->is_base2_26 = 0; 811c08a104SJason A. Donenfeld } 821c08a104SJason A. Donenfeld 83d7d7b853SJason A. Donenfeld static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_KEY_SIZE]) 841c08a104SJason A. Donenfeld { 85d7d7b853SJason A. Donenfeld poly1305_init_x86_64(ctx, key); 861c08a104SJason A. Donenfeld } 871c08a104SJason A. Donenfeld 88d7d7b853SJason A. Donenfeld static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len, 89d7d7b853SJason A. Donenfeld const u32 padbit) 901c08a104SJason A. Donenfeld { 91d7d7b853SJason A. Donenfeld struct poly1305_arch_internal *state = ctx; 921c08a104SJason A. Donenfeld 93d7d7b853SJason A. Donenfeld /* SIMD disables preemption, so relax after processing each page. */ 94d7d7b853SJason A. Donenfeld BUILD_BUG_ON(PAGE_SIZE < POLY1305_BLOCK_SIZE || 95d7d7b853SJason A. Donenfeld PAGE_SIZE % POLY1305_BLOCK_SIZE); 96d7d7b853SJason A. Donenfeld 9742251572SMasahiro Yamada if (!static_branch_likely(&poly1305_use_avx) || 98d7d7b853SJason A. Donenfeld (len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) || 99d7d7b853SJason A. Donenfeld !crypto_simd_usable()) { 100d7d7b853SJason A. Donenfeld convert_to_base2_64(ctx); 101d7d7b853SJason A. Donenfeld poly1305_blocks_x86_64(ctx, inp, len, padbit); 102d7d7b853SJason A. Donenfeld return; 103d7d7b853SJason A. Donenfeld } 104d7d7b853SJason A. Donenfeld 105d7d7b853SJason A. Donenfeld for (;;) { 106d7d7b853SJason A. Donenfeld const size_t bytes = min_t(size_t, len, PAGE_SIZE); 107d7d7b853SJason A. Donenfeld 108d7d7b853SJason A. Donenfeld kernel_fpu_begin(); 109d7d7b853SJason A. Donenfeld if (IS_ENABLED(CONFIG_AS_AVX512) && static_branch_likely(&poly1305_use_avx512)) 110d7d7b853SJason A. Donenfeld poly1305_blocks_avx512(ctx, inp, bytes, padbit); 111e6abef61SJason A. Donenfeld else if (static_branch_likely(&poly1305_use_avx2)) 112d7d7b853SJason A. Donenfeld poly1305_blocks_avx2(ctx, inp, bytes, padbit); 113d7d7b853SJason A. Donenfeld else 114d7d7b853SJason A. Donenfeld poly1305_blocks_avx(ctx, inp, bytes, padbit); 115d7d7b853SJason A. Donenfeld kernel_fpu_end(); 116d7d7b853SJason A. Donenfeld len -= bytes; 117d7d7b853SJason A. Donenfeld if (!len) 118d7d7b853SJason A. Donenfeld break; 119d7d7b853SJason A. Donenfeld inp += bytes; 120d7d7b853SJason A. Donenfeld } 121d7d7b853SJason A. Donenfeld } 122d7d7b853SJason A. Donenfeld 123d7d7b853SJason A. Donenfeld static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE], 124d7d7b853SJason A. Donenfeld const u32 nonce[4]) 1251c08a104SJason A. Donenfeld { 12642251572SMasahiro Yamada if (!static_branch_likely(&poly1305_use_avx)) 127d7d7b853SJason A. Donenfeld poly1305_emit_x86_64(ctx, mac, nonce); 128f9e7fe32SJason A. Donenfeld else 129d7d7b853SJason A. Donenfeld poly1305_emit_avx(ctx, mac, nonce); 130d7d7b853SJason A. Donenfeld } 131d7d7b853SJason A. Donenfeld 132d7d7b853SJason A. Donenfeld void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key) 133d7d7b853SJason A. Donenfeld { 134d7d7b853SJason A. Donenfeld poly1305_simd_init(&dctx->h, key); 135d7d7b853SJason A. Donenfeld dctx->s[0] = get_unaligned_le32(&key[16]); 136d7d7b853SJason A. Donenfeld dctx->s[1] = get_unaligned_le32(&key[20]); 137d7d7b853SJason A. Donenfeld dctx->s[2] = get_unaligned_le32(&key[24]); 138d7d7b853SJason A. Donenfeld dctx->s[3] = get_unaligned_le32(&key[28]); 139d7d7b853SJason A. Donenfeld dctx->buflen = 0; 140d7d7b853SJason A. Donenfeld dctx->sset = true; 141d7d7b853SJason A. Donenfeld } 142d7d7b853SJason A. Donenfeld EXPORT_SYMBOL(poly1305_init_arch); 143d7d7b853SJason A. Donenfeld 144d7d7b853SJason A. Donenfeld static unsigned int crypto_poly1305_setdctxkey(struct poly1305_desc_ctx *dctx, 145d7d7b853SJason A. Donenfeld const u8 *inp, unsigned int len) 146d7d7b853SJason A. Donenfeld { 147d7d7b853SJason A. Donenfeld unsigned int acc = 0; 148d7d7b853SJason A. Donenfeld if (unlikely(!dctx->sset)) { 149d7d7b853SJason A. Donenfeld if (!dctx->rset && len >= POLY1305_BLOCK_SIZE) { 150d7d7b853SJason A. Donenfeld poly1305_simd_init(&dctx->h, inp); 151d7d7b853SJason A. Donenfeld inp += POLY1305_BLOCK_SIZE; 152d7d7b853SJason A. Donenfeld len -= POLY1305_BLOCK_SIZE; 153d7d7b853SJason A. Donenfeld acc += POLY1305_BLOCK_SIZE; 1541c08a104SJason A. Donenfeld dctx->rset = 1; 1551c08a104SJason A. Donenfeld } 156d7d7b853SJason A. Donenfeld if (len >= POLY1305_BLOCK_SIZE) { 157d7d7b853SJason A. Donenfeld dctx->s[0] = get_unaligned_le32(&inp[0]); 158d7d7b853SJason A. Donenfeld dctx->s[1] = get_unaligned_le32(&inp[4]); 159d7d7b853SJason A. Donenfeld dctx->s[2] = get_unaligned_le32(&inp[8]); 160d7d7b853SJason A. Donenfeld dctx->s[3] = get_unaligned_le32(&inp[12]); 161d7d7b853SJason A. Donenfeld inp += POLY1305_BLOCK_SIZE; 162d7d7b853SJason A. Donenfeld len -= POLY1305_BLOCK_SIZE; 163d7d7b853SJason A. Donenfeld acc += POLY1305_BLOCK_SIZE; 1641c08a104SJason A. Donenfeld dctx->sset = true; 1651c08a104SJason A. Donenfeld } 1661c08a104SJason A. Donenfeld } 167d7d7b853SJason A. Donenfeld return acc; 168c70f4abeSMartin Willi } 169c70f4abeSMartin Willi 170f0e89bcfSArd Biesheuvel void poly1305_update_arch(struct poly1305_desc_ctx *dctx, const u8 *src, 171f0e89bcfSArd Biesheuvel unsigned int srclen) 172f0e89bcfSArd Biesheuvel { 173d7d7b853SJason A. Donenfeld unsigned int bytes, used; 174c70f4abeSMartin Willi 175c70f4abeSMartin Willi if (unlikely(dctx->buflen)) { 176c70f4abeSMartin Willi bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen); 177c70f4abeSMartin Willi memcpy(dctx->buf + dctx->buflen, src, bytes); 178c70f4abeSMartin Willi src += bytes; 179c70f4abeSMartin Willi srclen -= bytes; 180c70f4abeSMartin Willi dctx->buflen += bytes; 181c70f4abeSMartin Willi 182c70f4abeSMartin Willi if (dctx->buflen == POLY1305_BLOCK_SIZE) { 183d7d7b853SJason A. Donenfeld if (likely(!crypto_poly1305_setdctxkey(dctx, dctx->buf, POLY1305_BLOCK_SIZE))) 184d7d7b853SJason A. Donenfeld poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1); 185c70f4abeSMartin Willi dctx->buflen = 0; 186c70f4abeSMartin Willi } 187c70f4abeSMartin Willi } 188c70f4abeSMartin Willi 189c70f4abeSMartin Willi if (likely(srclen >= POLY1305_BLOCK_SIZE)) { 190d7d7b853SJason A. Donenfeld bytes = round_down(srclen, POLY1305_BLOCK_SIZE); 191d7d7b853SJason A. Donenfeld srclen -= bytes; 192d7d7b853SJason A. Donenfeld used = crypto_poly1305_setdctxkey(dctx, src, bytes); 193d7d7b853SJason A. Donenfeld if (likely(bytes - used)) 194d7d7b853SJason A. Donenfeld poly1305_simd_blocks(&dctx->h, src + used, bytes - used, 1); 195d7d7b853SJason A. Donenfeld src += bytes; 196c70f4abeSMartin Willi } 197c70f4abeSMartin Willi 198c70f4abeSMartin Willi if (unlikely(srclen)) { 199c70f4abeSMartin Willi dctx->buflen = srclen; 200c70f4abeSMartin Willi memcpy(dctx->buf, src, srclen); 201c70f4abeSMartin Willi } 2021b2c6a51SArd Biesheuvel } 203f0e89bcfSArd Biesheuvel EXPORT_SYMBOL(poly1305_update_arch); 204f0e89bcfSArd Biesheuvel 205d7d7b853SJason A. Donenfeld void poly1305_final_arch(struct poly1305_desc_ctx *dctx, u8 *dst) 206f0e89bcfSArd Biesheuvel { 207d7d7b853SJason A. Donenfeld if (unlikely(dctx->buflen)) { 208d7d7b853SJason A. Donenfeld dctx->buf[dctx->buflen++] = 1; 209d7d7b853SJason A. Donenfeld memset(dctx->buf + dctx->buflen, 0, 210d7d7b853SJason A. Donenfeld POLY1305_BLOCK_SIZE - dctx->buflen); 211d7d7b853SJason A. Donenfeld poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0); 2121c08a104SJason A. Donenfeld } 2131c08a104SJason A. Donenfeld 214d7d7b853SJason A. Donenfeld poly1305_simd_emit(&dctx->h, dst, dctx->s); 215d7d7b853SJason A. Donenfeld *dctx = (struct poly1305_desc_ctx){}; 216f0e89bcfSArd Biesheuvel } 217f0e89bcfSArd Biesheuvel EXPORT_SYMBOL(poly1305_final_arch); 218c70f4abeSMartin Willi 2191b2c6a51SArd Biesheuvel static int crypto_poly1305_init(struct shash_desc *desc) 2201b2c6a51SArd Biesheuvel { 2211b2c6a51SArd Biesheuvel struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 2221b2c6a51SArd Biesheuvel 223d7d7b853SJason A. Donenfeld *dctx = (struct poly1305_desc_ctx){}; 224d7d7b853SJason A. Donenfeld return 0; 225d7d7b853SJason A. Donenfeld } 2261b2c6a51SArd Biesheuvel 227d7d7b853SJason A. Donenfeld static int crypto_poly1305_update(struct shash_desc *desc, 228d7d7b853SJason A. Donenfeld const u8 *src, unsigned int srclen) 229d7d7b853SJason A. Donenfeld { 230d7d7b853SJason A. Donenfeld struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 231d7d7b853SJason A. Donenfeld 232d7d7b853SJason A. Donenfeld poly1305_update_arch(dctx, src, srclen); 2331b2c6a51SArd Biesheuvel return 0; 2341b2c6a51SArd Biesheuvel } 2351b2c6a51SArd Biesheuvel 2361b2c6a51SArd Biesheuvel static int crypto_poly1305_final(struct shash_desc *desc, u8 *dst) 2371b2c6a51SArd Biesheuvel { 2381b2c6a51SArd Biesheuvel struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 2391b2c6a51SArd Biesheuvel 2401b2c6a51SArd Biesheuvel if (unlikely(!dctx->sset)) 2411b2c6a51SArd Biesheuvel return -ENOKEY; 2421b2c6a51SArd Biesheuvel 2431c08a104SJason A. Donenfeld poly1305_final_arch(dctx, dst); 244c70f4abeSMartin Willi return 0; 245c70f4abeSMartin Willi } 246c70f4abeSMartin Willi 247c70f4abeSMartin Willi static struct shash_alg alg = { 248c70f4abeSMartin Willi .digestsize = POLY1305_DIGEST_SIZE, 249ad8f5b88SArd Biesheuvel .init = crypto_poly1305_init, 250d7d7b853SJason A. Donenfeld .update = crypto_poly1305_update, 251c70f4abeSMartin Willi .final = crypto_poly1305_final, 252ad8f5b88SArd Biesheuvel .descsize = sizeof(struct poly1305_desc_ctx), 253c70f4abeSMartin Willi .base = { 254c70f4abeSMartin Willi .cra_name = "poly1305", 255c70f4abeSMartin Willi .cra_driver_name = "poly1305-simd", 256c70f4abeSMartin Willi .cra_priority = 300, 257c70f4abeSMartin Willi .cra_blocksize = POLY1305_BLOCK_SIZE, 258c70f4abeSMartin Willi .cra_module = THIS_MODULE, 259c70f4abeSMartin Willi }, 260c70f4abeSMartin Willi }; 261c70f4abeSMartin Willi 262c70f4abeSMartin Willi static int __init poly1305_simd_mod_init(void) 263c70f4abeSMartin Willi { 26442251572SMasahiro Yamada if (boot_cpu_has(X86_FEATURE_AVX) && 265d7d7b853SJason A. Donenfeld cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL)) 266d7d7b853SJason A. Donenfeld static_branch_enable(&poly1305_use_avx); 267e6abef61SJason A. Donenfeld if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) && 268f0e89bcfSArd Biesheuvel cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL)) 269f0e89bcfSArd Biesheuvel static_branch_enable(&poly1305_use_avx2); 270d7d7b853SJason A. Donenfeld if (IS_ENABLED(CONFIG_AS_AVX512) && boot_cpu_has(X86_FEATURE_AVX) && 271d7d7b853SJason A. Donenfeld boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_AVX512F) && 272d7d7b853SJason A. Donenfeld cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM | XFEATURE_MASK_AVX512, NULL) && 273d7d7b853SJason A. Donenfeld /* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */ 274d7d7b853SJason A. Donenfeld boot_cpu_data.x86_model != INTEL_FAM6_SKYLAKE_X) 275d7d7b853SJason A. Donenfeld static_branch_enable(&poly1305_use_avx512); 2768394bfecSJason A. Donenfeld return IS_REACHABLE(CONFIG_CRYPTO_HASH) ? crypto_register_shash(&alg) : 0; 277c70f4abeSMartin Willi } 278c70f4abeSMartin Willi 279c70f4abeSMartin Willi static void __exit poly1305_simd_mod_exit(void) 280c70f4abeSMartin Willi { 2818394bfecSJason A. Donenfeld if (IS_REACHABLE(CONFIG_CRYPTO_HASH)) 282c70f4abeSMartin Willi crypto_unregister_shash(&alg); 283c70f4abeSMartin Willi } 284c70f4abeSMartin Willi 285c70f4abeSMartin Willi module_init(poly1305_simd_mod_init); 286c70f4abeSMartin Willi module_exit(poly1305_simd_mod_exit); 287c70f4abeSMartin Willi 288c70f4abeSMartin Willi MODULE_LICENSE("GPL"); 289d7d7b853SJason A. Donenfeld MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>"); 290c70f4abeSMartin Willi MODULE_DESCRIPTION("Poly1305 authenticator"); 291c70f4abeSMartin Willi MODULE_ALIAS_CRYPTO("poly1305"); 292c70f4abeSMartin Willi MODULE_ALIAS_CRYPTO("poly1305-simd"); 293