arch/arm64/crypto/chacha-neon-glue.c

   1 /*
   2  * ARM NEON and scalar accelerated ChaCha and XChaCha stream ciphers,
   3  * including ChaCha20 (RFC7539)
   4  *
   5  * Copyright (C) 2016 - 2017 Linaro, Ltd. <ard.biesheuvel@linaro.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Based on:
  12  * ChaCha20 256-bit cipher algorithm, RFC7539, SIMD glue code
  13  *
  14  * Copyright (C) 2015 Martin Willi
  15  *
  16  * This program is free software; you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License as published by
  18  * the Free Software Foundation; either version 2 of the License, or
  19  * (at your option) any later version.
  20  */
  21
  22 #include <crypto/algapi.h>
  23 #include <crypto/internal/chacha.h>
  24 #include <crypto/internal/simd.h>
  25 #include <crypto/internal/skcipher.h>
  26 #include <linux/jump_label.h>
  27 #include <linux/kernel.h>
  28 #include <linux/module.h>
  29
  30 #include <asm/hwcap.h>
  31 #include <asm/neon.h>
  32 #include <asm/simd.h>
  33
  34 asmlinkage void chacha_block_xor_neon(u32 *state, u8 *dst, const u8 *src,
  35                                       int nrounds);
  36 asmlinkage void chacha_4block_xor_neon(u32 *state, u8 *dst, const u8 *src,
  37                                        int nrounds, int bytes);
  38 asmlinkage void hchacha_block_neon(const u32 *state, u32 *out, int nrounds);
  39
  40 static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon);
  41
  42 static void chacha_doneon(u32 *state, u8 *dst, const u8 *src,
  43                           int bytes, int nrounds)
  44 {
  45         while (bytes > 0) {
  46                 int l = min(bytes, CHACHA_BLOCK_SIZE * 5);
  47
  48                 if (l <= CHACHA_BLOCK_SIZE) {
  49                         u8 buf[CHACHA_BLOCK_SIZE];
  50
  51                         memcpy(buf, src, l);
  52                         chacha_block_xor_neon(state, buf, buf, nrounds);
  53                         memcpy(dst, buf, l);
  54                         state[12] += 1;
  55                         break;
  56                 }
  57                 chacha_4block_xor_neon(state, dst, src, nrounds, l);
  58                 bytes -= l;
  59                 src += l;
  60                 dst += l;
  61                 state[12] += DIV_ROUND_UP(l, CHACHA_BLOCK_SIZE);
  62         }
  63 }
  64
  65 void hchacha_block_arch(const u32 *state, u32 *stream, int nrounds)
  66 {
  67         if (!static_branch_likely(&have_neon) || !crypto_simd_usable()) {
  68                 hchacha_block_generic(state, stream, nrounds);
  69         } else {
  70                 kernel_neon_begin();
  71                 hchacha_block_neon(state, stream, nrounds);
  72                 kernel_neon_end();
  73         }
  74 }
  75 EXPORT_SYMBOL(hchacha_block_arch);
  76
  77 void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv)
  78 {
  79         chacha_init_generic(state, key, iv);
  80 }
  81 EXPORT_SYMBOL(chacha_init_arch);
  82
  83 void chacha_crypt_arch(u32 *state, u8 *dst, const u8 *src, unsigned int bytes,
  84                        int nrounds)
  85 {
  86         if (!static_branch_likely(&have_neon) || bytes <= CHACHA_BLOCK_SIZE ||
  87             !crypto_simd_usable())
  88                 return chacha_crypt_generic(state, dst, src, bytes, nrounds);
  89
  90         do {
  91                 unsigned int todo = min_t(unsigned int, bytes, SZ_4K);
  92
  93                 kernel_neon_begin();
  94                 chacha_doneon(state, dst, src, todo, nrounds);
  95                 kernel_neon_end();
  96
  97                 bytes -= todo;
  98                 src += todo;
  99                 dst += todo;
 100         } while (bytes);
 101 }
 102 EXPORT_SYMBOL(chacha_crypt_arch);
 103
 104 static int chacha_neon_stream_xor(struct skcipher_request *req,
 105                                   const struct chacha_ctx *ctx, const u8 *iv)
 106 {
 107         struct skcipher_walk walk;
 108         u32 state[16];
 109         int err;
 110
 111         err = skcipher_walk_virt(&walk, req, false);
 112
 113         chacha_init_generic(state, ctx->key, iv);
 114
 115         while (walk.nbytes > 0) {
 116                 unsigned int nbytes = walk.nbytes;
 117
 118                 if (nbytes < walk.total)
 119                         nbytes = rounddown(nbytes, walk.stride);
 120
 121                 if (!static_branch_likely(&have_neon) ||
 122                     !crypto_simd_usable()) {
 123                         chacha_crypt_generic(state, walk.dst.virt.addr,
 124                                              walk.src.virt.addr, nbytes,
 125                                              ctx->nrounds);
 126                 } else {
 127                         kernel_neon_begin();
 128                         chacha_doneon(state, walk.dst.virt.addr,
 129                                       walk.src.virt.addr, nbytes, ctx->nrounds);
 130                         kernel_neon_end();
 131                 }
 132                 err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
 133         }
 134
 135         return err;
 136 }
 137
 138 static int chacha_neon(struct skcipher_request *req)
 139 {
 140         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 141         struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
 142
 143         return chacha_neon_stream_xor(req, ctx, req->iv);
 144 }
 145
 146 static int xchacha_neon(struct skcipher_request *req)
 147 {
 148         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 149         struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
 150         struct chacha_ctx subctx;
 151         u32 state[16];
 152         u8 real_iv[16];
 153
 154         chacha_init_generic(state, ctx->key, req->iv);
 155         hchacha_block_arch(state, subctx.key, ctx->nrounds);
 156         subctx.nrounds = ctx->nrounds;
 157
 158         memcpy(&real_iv[0], req->iv + 24, 8);
 159         memcpy(&real_iv[8], req->iv + 16, 8);
 160         return chacha_neon_stream_xor(req, &subctx, real_iv);
 161 }
 162
 163 static struct skcipher_alg algs[] = {
 164         {
 165                 .base.cra_name          = "chacha20",
 166                 .base.cra_driver_name   = "chacha20-neon",
 167                 .base.cra_priority      = 300,
 168                 .base.cra_blocksize     = 1,
 169                 .base.cra_ctxsize       = sizeof(struct chacha_ctx),
 170                 .base.cra_module        = THIS_MODULE,
 171
 172                 .min_keysize            = CHACHA_KEY_SIZE,
 173                 .max_keysize            = CHACHA_KEY_SIZE,
 174                 .ivsize                 = CHACHA_IV_SIZE,
 175                 .chunksize              = CHACHA_BLOCK_SIZE,
 176                 .walksize               = 5 * CHACHA_BLOCK_SIZE,
 177                 .setkey                 = chacha20_setkey,
 178                 .encrypt                = chacha_neon,
 179                 .decrypt                = chacha_neon,
 180         }, {
 181                 .base.cra_name          = "xchacha20",
 182                 .base.cra_driver_name   = "xchacha20-neon",
 183                 .base.cra_priority      = 300,
 184                 .base.cra_blocksize     = 1,
 185                 .base.cra_ctxsize       = sizeof(struct chacha_ctx),
 186                 .base.cra_module        = THIS_MODULE,
 187
 188                 .min_keysize            = CHACHA_KEY_SIZE,
 189                 .max_keysize            = CHACHA_KEY_SIZE,
 190                 .ivsize                 = XCHACHA_IV_SIZE,
 191                 .chunksize              = CHACHA_BLOCK_SIZE,
 192                 .walksize               = 5 * CHACHA_BLOCK_SIZE,
 193                 .setkey                 = chacha20_setkey,
 194                 .encrypt                = xchacha_neon,
 195                 .decrypt                = xchacha_neon,
 196         }, {
 197                 .base.cra_name          = "xchacha12",
 198                 .base.cra_driver_name   = "xchacha12-neon",
 199                 .base.cra_priority      = 300,
 200                 .base.cra_blocksize     = 1,
 201                 .base.cra_ctxsize       = sizeof(struct chacha_ctx),
 202                 .base.cra_module        = THIS_MODULE,
 203
 204                 .min_keysize            = CHACHA_KEY_SIZE,
 205                 .max_keysize            = CHACHA_KEY_SIZE,
 206                 .ivsize                 = XCHACHA_IV_SIZE,
 207                 .chunksize              = CHACHA_BLOCK_SIZE,
 208                 .walksize               = 5 * CHACHA_BLOCK_SIZE,
 209                 .setkey                 = chacha12_setkey,
 210                 .encrypt                = xchacha_neon,
 211                 .decrypt                = xchacha_neon,
 212         }
 213 };
 214
 215 static int __init chacha_simd_mod_init(void)
 216 {
 217         if (!cpu_have_named_feature(ASIMD))
 218                 return 0;
 219
 220         static_branch_enable(&have_neon);
 221
 222         return IS_REACHABLE(CONFIG_CRYPTO_SKCIPHER) ?
 223                 crypto_register_skciphers(algs, ARRAY_SIZE(algs)) : 0;
 224 }
 225
 226 static void __exit chacha_simd_mod_fini(void)
 227 {
 228         if (IS_REACHABLE(CONFIG_CRYPTO_SKCIPHER) && cpu_have_named_feature(ASIMD))
 229                 crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
 230 }
 231
 232 module_init(chacha_simd_mod_init);
 233 module_exit(chacha_simd_mod_fini);
 234
 235 MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (NEON accelerated)");
 236 MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
 237 MODULE_LICENSE("GPL v2");
 238 MODULE_ALIAS_CRYPTO("chacha20");
 239 MODULE_ALIAS_CRYPTO("chacha20-neon");
 240 MODULE_ALIAS_CRYPTO("xchacha20");
 241 MODULE_ALIAS_CRYPTO("xchacha20-neon");
 242 MODULE_ALIAS_CRYPTO("xchacha12");
 243 MODULE_ALIAS_CRYPTO("xchacha12-neon");