xref: /openbmc/linux/arch/x86/crypto/poly1305_glue.c (revision b58c6630)
1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  */
5 
6 #include <crypto/algapi.h>
7 #include <crypto/internal/hash.h>
8 #include <crypto/internal/poly1305.h>
9 #include <crypto/internal/simd.h>
10 #include <linux/crypto.h>
11 #include <linux/jump_label.h>
12 #include <linux/kernel.h>
13 #include <linux/module.h>
14 #include <asm/intel-family.h>
15 #include <asm/simd.h>
16 
17 asmlinkage void poly1305_init_x86_64(void *ctx,
18 				     const u8 key[POLY1305_KEY_SIZE]);
19 asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp,
20 				       const size_t len, const u32 padbit);
21 asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
22 				     const u32 nonce[4]);
23 asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
24 				  const u32 nonce[4]);
25 asmlinkage void poly1305_blocks_avx(void *ctx, const u8 *inp, const size_t len,
26 				    const u32 padbit);
27 asmlinkage void poly1305_blocks_avx2(void *ctx, const u8 *inp, const size_t len,
28 				     const u32 padbit);
29 asmlinkage void poly1305_blocks_avx512(void *ctx, const u8 *inp,
30 				       const size_t len, const u32 padbit);
31 
32 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);
33 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);
34 static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);
35 
36 struct poly1305_arch_internal {
37 	union {
38 		struct {
39 			u32 h[5];
40 			u32 is_base2_26;
41 		};
42 		u64 hs[3];
43 	};
44 	u64 r[2];
45 	u64 pad;
46 	struct { u32 r2, r1, r4, r3; } rn[9];
47 };
48 
49 /* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit
50  * the unfortunate situation of using AVX and then having to go back to scalar
51  * -- because the user is silly and has called the update function from two
52  * separate contexts -- then we need to convert back to the original base before
53  * proceeding. It is possible to reason that the initial reduction below is
54  * sufficient given the implementation invariants. However, for an avoidance of
55  * doubt and because this is not performance critical, we do the full reduction
56  * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py
57  */
58 static void convert_to_base2_64(void *ctx)
59 {
60 	struct poly1305_arch_internal *state = ctx;
61 	u32 cy;
62 
63 	if (!state->is_base2_26)
64 		return;
65 
66 	cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy;
67 	cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy;
68 	cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy;
69 	cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy;
70 	state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0];
71 	state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12);
72 	state->hs[2] = state->h[4] >> 24;
73 #define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
74 	cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL);
75 	state->hs[2] &= 3;
76 	state->hs[0] += cy;
77 	state->hs[1] += (cy = ULT(state->hs[0], cy));
78 	state->hs[2] += ULT(state->hs[1], cy);
79 #undef ULT
80 	state->is_base2_26 = 0;
81 }
82 
83 static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_KEY_SIZE])
84 {
85 	poly1305_init_x86_64(ctx, key);
86 }
87 
88 static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len,
89 				 const u32 padbit)
90 {
91 	struct poly1305_arch_internal *state = ctx;
92 
93 	/* SIMD disables preemption, so relax after processing each page. */
94 	BUILD_BUG_ON(PAGE_SIZE < POLY1305_BLOCK_SIZE ||
95 		     PAGE_SIZE % POLY1305_BLOCK_SIZE);
96 
97 	if (!static_branch_likely(&poly1305_use_avx) ||
98 	    (len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) ||
99 	    !crypto_simd_usable()) {
100 		convert_to_base2_64(ctx);
101 		poly1305_blocks_x86_64(ctx, inp, len, padbit);
102 		return;
103 	}
104 
105 	for (;;) {
106 		const size_t bytes = min_t(size_t, len, PAGE_SIZE);
107 
108 		kernel_fpu_begin();
109 		if (IS_ENABLED(CONFIG_AS_AVX512) && static_branch_likely(&poly1305_use_avx512))
110 			poly1305_blocks_avx512(ctx, inp, bytes, padbit);
111 		else if (static_branch_likely(&poly1305_use_avx2))
112 			poly1305_blocks_avx2(ctx, inp, bytes, padbit);
113 		else
114 			poly1305_blocks_avx(ctx, inp, bytes, padbit);
115 		kernel_fpu_end();
116 		len -= bytes;
117 		if (!len)
118 			break;
119 		inp += bytes;
120 	}
121 }
122 
123 static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
124 			       const u32 nonce[4])
125 {
126 	if (!static_branch_likely(&poly1305_use_avx))
127 		poly1305_emit_x86_64(ctx, mac, nonce);
128 	else
129 		poly1305_emit_avx(ctx, mac, nonce);
130 }
131 
132 void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key)
133 {
134 	poly1305_simd_init(&dctx->h, key);
135 	dctx->s[0] = get_unaligned_le32(&key[16]);
136 	dctx->s[1] = get_unaligned_le32(&key[20]);
137 	dctx->s[2] = get_unaligned_le32(&key[24]);
138 	dctx->s[3] = get_unaligned_le32(&key[28]);
139 	dctx->buflen = 0;
140 	dctx->sset = true;
141 }
142 EXPORT_SYMBOL(poly1305_init_arch);
143 
144 static unsigned int crypto_poly1305_setdctxkey(struct poly1305_desc_ctx *dctx,
145 					       const u8 *inp, unsigned int len)
146 {
147 	unsigned int acc = 0;
148 	if (unlikely(!dctx->sset)) {
149 		if (!dctx->rset && len >= POLY1305_BLOCK_SIZE) {
150 			poly1305_simd_init(&dctx->h, inp);
151 			inp += POLY1305_BLOCK_SIZE;
152 			len -= POLY1305_BLOCK_SIZE;
153 			acc += POLY1305_BLOCK_SIZE;
154 			dctx->rset = 1;
155 		}
156 		if (len >= POLY1305_BLOCK_SIZE) {
157 			dctx->s[0] = get_unaligned_le32(&inp[0]);
158 			dctx->s[1] = get_unaligned_le32(&inp[4]);
159 			dctx->s[2] = get_unaligned_le32(&inp[8]);
160 			dctx->s[3] = get_unaligned_le32(&inp[12]);
161 			inp += POLY1305_BLOCK_SIZE;
162 			len -= POLY1305_BLOCK_SIZE;
163 			acc += POLY1305_BLOCK_SIZE;
164 			dctx->sset = true;
165 		}
166 	}
167 	return acc;
168 }
169 
170 void poly1305_update_arch(struct poly1305_desc_ctx *dctx, const u8 *src,
171 			  unsigned int srclen)
172 {
173 	unsigned int bytes, used;
174 
175 	if (unlikely(dctx->buflen)) {
176 		bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
177 		memcpy(dctx->buf + dctx->buflen, src, bytes);
178 		src += bytes;
179 		srclen -= bytes;
180 		dctx->buflen += bytes;
181 
182 		if (dctx->buflen == POLY1305_BLOCK_SIZE) {
183 			if (likely(!crypto_poly1305_setdctxkey(dctx, dctx->buf, POLY1305_BLOCK_SIZE)))
184 				poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1);
185 			dctx->buflen = 0;
186 		}
187 	}
188 
189 	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
190 		bytes = round_down(srclen, POLY1305_BLOCK_SIZE);
191 		srclen -= bytes;
192 		used = crypto_poly1305_setdctxkey(dctx, src, bytes);
193 		if (likely(bytes - used))
194 			poly1305_simd_blocks(&dctx->h, src + used, bytes - used, 1);
195 		src += bytes;
196 	}
197 
198 	if (unlikely(srclen)) {
199 		dctx->buflen = srclen;
200 		memcpy(dctx->buf, src, srclen);
201 	}
202 }
203 EXPORT_SYMBOL(poly1305_update_arch);
204 
205 void poly1305_final_arch(struct poly1305_desc_ctx *dctx, u8 *dst)
206 {
207 	if (unlikely(dctx->buflen)) {
208 		dctx->buf[dctx->buflen++] = 1;
209 		memset(dctx->buf + dctx->buflen, 0,
210 		       POLY1305_BLOCK_SIZE - dctx->buflen);
211 		poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0);
212 	}
213 
214 	poly1305_simd_emit(&dctx->h, dst, dctx->s);
215 	*dctx = (struct poly1305_desc_ctx){};
216 }
217 EXPORT_SYMBOL(poly1305_final_arch);
218 
219 static int crypto_poly1305_init(struct shash_desc *desc)
220 {
221 	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
222 
223 	*dctx = (struct poly1305_desc_ctx){};
224 	return 0;
225 }
226 
227 static int crypto_poly1305_update(struct shash_desc *desc,
228 				  const u8 *src, unsigned int srclen)
229 {
230 	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
231 
232 	poly1305_update_arch(dctx, src, srclen);
233 	return 0;
234 }
235 
236 static int crypto_poly1305_final(struct shash_desc *desc, u8 *dst)
237 {
238 	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
239 
240 	if (unlikely(!dctx->sset))
241 		return -ENOKEY;
242 
243 	poly1305_final_arch(dctx, dst);
244 	return 0;
245 }
246 
247 static struct shash_alg alg = {
248 	.digestsize	= POLY1305_DIGEST_SIZE,
249 	.init		= crypto_poly1305_init,
250 	.update		= crypto_poly1305_update,
251 	.final		= crypto_poly1305_final,
252 	.descsize	= sizeof(struct poly1305_desc_ctx),
253 	.base		= {
254 		.cra_name		= "poly1305",
255 		.cra_driver_name	= "poly1305-simd",
256 		.cra_priority		= 300,
257 		.cra_blocksize		= POLY1305_BLOCK_SIZE,
258 		.cra_module		= THIS_MODULE,
259 	},
260 };
261 
262 static int __init poly1305_simd_mod_init(void)
263 {
264 	if (boot_cpu_has(X86_FEATURE_AVX) &&
265 	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
266 		static_branch_enable(&poly1305_use_avx);
267 	if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) &&
268 	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
269 		static_branch_enable(&poly1305_use_avx2);
270 	if (IS_ENABLED(CONFIG_AS_AVX512) && boot_cpu_has(X86_FEATURE_AVX) &&
271 	    boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_AVX512F) &&
272 	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM | XFEATURE_MASK_AVX512, NULL) &&
273 	    /* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */
274 	    boot_cpu_data.x86_model != INTEL_FAM6_SKYLAKE_X)
275 		static_branch_enable(&poly1305_use_avx512);
276 	return IS_REACHABLE(CONFIG_CRYPTO_HASH) ? crypto_register_shash(&alg) : 0;
277 }
278 
279 static void __exit poly1305_simd_mod_exit(void)
280 {
281 	if (IS_REACHABLE(CONFIG_CRYPTO_HASH))
282 		crypto_unregister_shash(&alg);
283 }
284 
285 module_init(poly1305_simd_mod_init);
286 module_exit(poly1305_simd_mod_exit);
287 
288 MODULE_LICENSE("GPL");
289 MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
290 MODULE_DESCRIPTION("Poly1305 authenticator");
291 MODULE_ALIAS_CRYPTO("poly1305");
292 MODULE_ALIAS_CRYPTO("poly1305-simd");
293