[linux-2.6-block.git] / arch / x86 / crypto / poly1305_glue.c

// SPDX-License-Identifier: GPL-2.0 OR MIT
/*
 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 */

#include <crypto/algapi.h>
#include <crypto/internal/hash.h>
#include <crypto/internal/poly1305.h>
#include <crypto/internal/simd.h>
#include <linux/crypto.h>
#include <linux/jump_label.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/sizes.h>
#include <asm/intel-family.h>
#include <asm/simd.h>

asmlinkage void poly1305_init_x86_64(void *ctx,
				     const u8 key[POLY1305_BLOCK_SIZE]);
asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp,
				       const size_t len, const u32 padbit);
asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
				     const u32 nonce[4]);
asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
				  const u32 nonce[4]);
asmlinkage void poly1305_blocks_avx(void *ctx, const u8 *inp, const size_t len,
				    const u32 padbit);
asmlinkage void poly1305_blocks_avx2(void *ctx, const u8 *inp, const size_t len,
				     const u32 padbit);
asmlinkage void poly1305_blocks_avx512(void *ctx, const u8 *inp,
				       const size_t len, const u32 padbit);

static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);
static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);
static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);

struct poly1305_arch_internal {
	union {
		struct {
			u32 h[5];
			u32 is_base2_26;
		};
		u64 hs[3];
	};
	u64 r[2];
	u64 pad;
	struct { u32 r2, r1, r4, r3; } rn[9];
};

/* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit
 * the unfortunate situation of using AVX and then having to go back to scalar
 * -- because the user is silly and has called the update function from two
 * separate contexts -- then we need to convert back to the original base before
 * proceeding. It is possible to reason that the initial reduction below is
 * sufficient given the implementation invariants. However, for an avoidance of
 * doubt and because this is not performance critical, we do the full reduction
 * anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py
 */
static void convert_to_base2_64(void *ctx)
{
	struct poly1305_arch_internal *state = ctx;
	u32 cy;

	if (!state->is_base2_26)
		return;

	cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy;
	cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy;
	cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy;
	cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy;
	state->hs[0] = ((u64)state->h[2] << 52) | ((u64)state->h[1] << 26) | state->h[0];
	state->hs[1] = ((u64)state->h[4] << 40) | ((u64)state->h[3] << 14) | (state->h[2] >> 12);
	state->hs[2] = state->h[4] >> 24;
#define ULT(a, b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
	cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL);
	state->hs[2] &= 3;
	state->hs[0] += cy;
	state->hs[1] += (cy = ULT(state->hs[0], cy));
	state->hs[2] += ULT(state->hs[1], cy);
#undef ULT
	state->is_base2_26 = 0;
}

static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE])
{
	poly1305_init_x86_64(ctx, key);
}

static void poly1305_simd_blocks(void *ctx, const u8 *inp, size_t len,
				 const u32 padbit)
{
	struct poly1305_arch_internal *state = ctx;

	/* SIMD disables preemption, so relax after processing each page. */
	BUILD_BUG_ON(SZ_4K < POLY1305_BLOCK_SIZE ||
		     SZ_4K % POLY1305_BLOCK_SIZE);

	if (!static_branch_likely(&poly1305_use_avx) ||
	    (len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) ||
	    !crypto_simd_usable()) {
		convert_to_base2_64(ctx);
		poly1305_blocks_x86_64(ctx, inp, len, padbit);
		return;
	}

	do {
		const size_t bytes = min_t(size_t, len, SZ_4K);

		kernel_fpu_begin();
		if (IS_ENABLED(CONFIG_AS_AVX512) && static_branch_likely(&poly1305_use_avx512))
			poly1305_blocks_avx512(ctx, inp, bytes, padbit);
		else if (static_branch_likely(&poly1305_use_avx2))
			poly1305_blocks_avx2(ctx, inp, bytes, padbit);
		else
			poly1305_blocks_avx(ctx, inp, bytes, padbit);
		kernel_fpu_end();

		len -= bytes;
		inp += bytes;
	} while (len);
}

static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
			       const u32 nonce[4])
{
	if (!static_branch_likely(&poly1305_use_avx))
		poly1305_emit_x86_64(ctx, mac, nonce);
	else
		poly1305_emit_avx(ctx, mac, nonce);
}

void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
{
	poly1305_simd_init(&dctx->h, key);
	dctx->s[0] = get_unaligned_le32(&key[16]);
	dctx->s[1] = get_unaligned_le32(&key[20]);
	dctx->s[2] = get_unaligned_le32(&key[24]);
	dctx->s[3] = get_unaligned_le32(&key[28]);
	dctx->buflen = 0;
	dctx->sset = true;
}
EXPORT_SYMBOL(poly1305_init_arch);

static unsigned int crypto_poly1305_setdctxkey(struct poly1305_desc_ctx *dctx,
					       const u8 *inp, unsigned int len)
{
	unsigned int acc = 0;
	if (unlikely(!dctx->sset)) {
		if (!dctx->rset && len >= POLY1305_BLOCK_SIZE) {
			poly1305_simd_init(&dctx->h, inp);
			inp += POLY1305_BLOCK_SIZE;
			len -= POLY1305_BLOCK_SIZE;
			acc += POLY1305_BLOCK_SIZE;
			dctx->rset = 1;
		}
		if (len >= POLY1305_BLOCK_SIZE) {
			dctx->s[0] = get_unaligned_le32(&inp[0]);
			dctx->s[1] = get_unaligned_le32(&inp[4]);
			dctx->s[2] = get_unaligned_le32(&inp[8]);
			dctx->s[3] = get_unaligned_le32(&inp[12]);
			acc += POLY1305_BLOCK_SIZE;
			dctx->sset = true;
		}
	}
	return acc;
}

void poly1305_update_arch(struct poly1305_desc_ctx *dctx, const u8 *src,
			  unsigned int srclen)
{
	unsigned int bytes, used;

	if (unlikely(dctx->buflen)) {
		bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
		memcpy(dctx->buf + dctx->buflen, src, bytes);
		src += bytes;
		srclen -= bytes;
		dctx->buflen += bytes;

		if (dctx->buflen == POLY1305_BLOCK_SIZE) {
			if (likely(!crypto_poly1305_setdctxkey(dctx, dctx->buf, POLY1305_BLOCK_SIZE)))
				poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1);
			dctx->buflen = 0;
		}
	}

	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
		bytes = round_down(srclen, POLY1305_BLOCK_SIZE);
		srclen -= bytes;
		used = crypto_poly1305_setdctxkey(dctx, src, bytes);
		if (likely(bytes - used))
			poly1305_simd_blocks(&dctx->h, src + used, bytes - used, 1);
		src += bytes;
	}

	if (unlikely(srclen)) {
		dctx->buflen = srclen;
		memcpy(dctx->buf, src, srclen);
	}
}
EXPORT_SYMBOL(poly1305_update_arch);

void poly1305_final_arch(struct poly1305_desc_ctx *dctx, u8 *dst)
{
	if (unlikely(dctx->buflen)) {
		dctx->buf[dctx->buflen++] = 1;
		memset(dctx->buf + dctx->buflen, 0,
		       POLY1305_BLOCK_SIZE - dctx->buflen);
		poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0);
	}

	poly1305_simd_emit(&dctx->h, dst, dctx->s);
	memzero_explicit(dctx, sizeof(*dctx));
}
EXPORT_SYMBOL(poly1305_final_arch);

static int crypto_poly1305_init(struct shash_desc *desc)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);

	*dctx = (struct poly1305_desc_ctx){};
	return 0;
}

static int crypto_poly1305_update(struct shash_desc *desc,
				  const u8 *src, unsigned int srclen)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);

	poly1305_update_arch(dctx, src, srclen);
	return 0;
}

static int crypto_poly1305_final(struct shash_desc *desc, u8 *dst)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);

	if (unlikely(!dctx->sset))
		return -ENOKEY;

	poly1305_final_arch(dctx, dst);
	return 0;
}

static struct shash_alg alg = {
	.digestsize	= POLY1305_DIGEST_SIZE,
	.init		= crypto_poly1305_init,
	.update		= crypto_poly1305_update,
	.final		= crypto_poly1305_final,
	.descsize	= sizeof(struct poly1305_desc_ctx),
	.base		= {
		.cra_name		= "poly1305",
		.cra_driver_name	= "poly1305-simd",
		.cra_priority		= 300,
		.cra_blocksize		= POLY1305_BLOCK_SIZE,
		.cra_module		= THIS_MODULE,
	},
};

static int __init poly1305_simd_mod_init(void)
{
	if (boot_cpu_has(X86_FEATURE_AVX) &&
	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
		static_branch_enable(&poly1305_use_avx);
	if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) &&
	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
		static_branch_enable(&poly1305_use_avx2);
	if (IS_ENABLED(CONFIG_AS_AVX512) && boot_cpu_has(X86_FEATURE_AVX) &&
	    boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_AVX512F) &&
	    cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM | XFEATURE_MASK_AVX512, NULL) &&
	    /* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */
	    boot_cpu_data.x86_model != INTEL_FAM6_SKYLAKE_X)
		static_branch_enable(&poly1305_use_avx512);
	return IS_REACHABLE(CONFIG_CRYPTO_HASH) ? crypto_register_shash(&alg) : 0;
}

static void __exit poly1305_simd_mod_exit(void)
{
	if (IS_REACHABLE(CONFIG_CRYPTO_HASH))
		crypto_unregister_shash(&alg);
}

module_init(poly1305_simd_mod_init);
module_exit(poly1305_simd_mod_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
MODULE_DESCRIPTION("Poly1305 authenticator");
MODULE_ALIAS_CRYPTO("poly1305");
MODULE_ALIAS_CRYPTO("poly1305-simd");
Commit	Line	Data
d7d7b853	1	// SPDX-License-Identifier: GPL-2.0 OR MIT
c70f4abe	2	/*
d7d7b853	3	* Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
c70f4abe MW	4	*/
	5
	6	#include <crypto/algapi.h>
	7	#include <crypto/internal/hash.h>
48ea8c6e	8	#include <crypto/internal/poly1305.h>
f2abe0d7	9	#include <crypto/internal/simd.h>
c70f4abe	10	#include <linux/crypto.h>
f0e89bcf	11	#include <linux/jump_label.h>
c70f4abe MW	12	#include <linux/kernel.h>
c70f4abe MW	13	#include <linux/module.h>
0c3dc787	14	#include <linux/sizes.h>
d7d7b853	15	#include <asm/intel-family.h>
c70f4abe MW	16	#include <asm/simd.h>
c70f4abe MW	17
d7d7b853	18	asmlinkage void poly1305_init_x86_64(void *ctx,
8d195e7a	19	const u8 key[POLY1305_BLOCK_SIZE]);
d7d7b853 JD	20	asmlinkage void poly1305_blocks_x86_64(void ctx, const u8 inp,
	21	const size_t len, const u32 padbit);
	22	asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
	23	const u32 nonce[4]);
	24	asmlinkage void poly1305_emit_avx(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
	25	const u32 nonce[4]);
	26	asmlinkage void poly1305_blocks_avx(void ctx, const u8 inp, const size_t len,
	27	const u32 padbit);
	28	asmlinkage void poly1305_blocks_avx2(void ctx, const u8 inp, const size_t len,
	29	const u32 padbit);
	30	asmlinkage void poly1305_blocks_avx512(void ctx, const u8 inp,
	31	const size_t len, const u32 padbit);
	32
	33	static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx);
f0e89bcf	34	static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx2);
d7d7b853 JD	35	static __ro_after_init DEFINE_STATIC_KEY_FALSE(poly1305_use_avx512);
	36
	37	struct poly1305_arch_internal {
	38	union {
	39	struct {
	40	u32 h[5];
	41	u32 is_base2_26;
	42	};
	43	u64 hs[3];
	44	};
	45	u64 r[2];
	46	u64 pad;
	47	struct { u32 r2, r1, r4, r3; } rn[9];
	48	};
da35b22d	49
d7d7b853 JD	50	/* The AVX code uses base 2^26, while the scalar code uses base 2^64. If we hit
	51	* the unfortunate situation of using AVX and then having to go back to scalar
	52	* -- because the user is silly and has called the update function from two
	53	* separate contexts -- then we need to convert back to the original base before
	54	* proceeding. It is possible to reason that the initial reduction below is
	55	* sufficient given the implementation invariants. However, for an avoidance of
	56	* doubt and because this is not performance critical, we do the full reduction
	57	* anyway. Z3 proof of below function: https://xn--4db.cc/ltPtHCKN/py
	58	*/
	59	static void convert_to_base2_64(void *ctx)
1c08a104	60	{
d7d7b853 JD	61	struct poly1305_arch_internal *state = ctx;
d7d7b853 JD	62	u32 cy;
1c08a104	63
d7d7b853 JD	64	if (!state->is_base2_26)
d7d7b853 JD	65	return;
1c08a104	66
d7d7b853 JD	67	cy = state->h[0] >> 26; state->h[0] &= 0x3ffffff; state->h[1] += cy;
	68	cy = state->h[1] >> 26; state->h[1] &= 0x3ffffff; state->h[2] += cy;
	69	cy = state->h[2] >> 26; state->h[2] &= 0x3ffffff; state->h[3] += cy;
	70	cy = state->h[3] >> 26; state->h[3] &= 0x3ffffff; state->h[4] += cy;
	71	state->hs[0] = ((u64)state->h[2] << 52) \| ((u64)state->h[1] << 26) \| state->h[0];
	72	state->hs[1] = ((u64)state->h[4] << 40) \| ((u64)state->h[3] << 14) \| (state->h[2] >> 12);
	73	state->hs[2] = state->h[4] >> 24;
	74	#define ULT(a, b) ((a ^ ((a ^ b) \| ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
	75	cy = (state->hs[2] >> 2) + (state->hs[2] & ~3ULL);
	76	state->hs[2] &= 3;
	77	state->hs[0] += cy;
	78	state->hs[1] += (cy = ULT(state->hs[0], cy));
	79	state->hs[2] += ULT(state->hs[1], cy);
	80	#undef ULT
	81	state->is_base2_26 = 0;
1c08a104 JD	82	}
1c08a104 JD	83
8d195e7a	84	static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE])
da35b22d	85	{
d7d7b853	86	poly1305_init_x86_64(ctx, key);
da35b22d	87	}
c70f4abe	88
d7d7b853 JD	89	static void poly1305_simd_blocks(void ctx, const u8 inp, size_t len,
d7d7b853 JD	90	const u32 padbit)
1c08a104	91	{
d7d7b853	92	struct poly1305_arch_internal *state = ctx;
1c08a104	93
d7d7b853	94	/* SIMD disables preemption, so relax after processing each page. */
706024a5 JD	95	BUILD_BUG_ON(SZ_4K < POLY1305_BLOCK_SIZE \|\|
706024a5 JD	96	SZ_4K % POLY1305_BLOCK_SIZE);
1c08a104	97
42251572	98	if (!static_branch_likely(&poly1305_use_avx) \|\|
d7d7b853 JD	99	(len < (POLY1305_BLOCK_SIZE * 18) && !state->is_base2_26) \|\|
	100	!crypto_simd_usable()) {
	101	convert_to_base2_64(ctx);
	102	poly1305_blocks_x86_64(ctx, inp, len, padbit);
1c08a104	103	return;
d7d7b853	104	}
1c08a104	105
706024a5 JD	106	do {
706024a5 JD	107	const size_t bytes = min_t(size_t, len, SZ_4K);
d7d7b853 JD	108
	109	kernel_fpu_begin();
	110	if (IS_ENABLED(CONFIG_AS_AVX512) && static_branch_likely(&poly1305_use_avx512))
	111	poly1305_blocks_avx512(ctx, inp, bytes, padbit);
e6abef61	112	else if (static_branch_likely(&poly1305_use_avx2))
d7d7b853 JD	113	poly1305_blocks_avx2(ctx, inp, bytes, padbit);
	114	else
	115	poly1305_blocks_avx(ctx, inp, bytes, padbit);
	116	kernel_fpu_end();
706024a5	117
d7d7b853	118	len -= bytes;
d7d7b853	119	inp += bytes;
706024a5	120	} while (len);
1c08a104 JD	121	}
1c08a104 JD	122
d7d7b853 JD	123	static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE],
d7d7b853 JD	124	const u32 nonce[4])
1c08a104	125	{
42251572	126	if (!static_branch_likely(&poly1305_use_avx))
d7d7b853	127	poly1305_emit_x86_64(ctx, mac, nonce);
f9e7fe32	128	else
d7d7b853	129	poly1305_emit_avx(ctx, mac, nonce);
1c08a104 JD	130	}
1c08a104 JD	131
8d195e7a	132	void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE])
1c08a104	133	{
d7d7b853 JD	134	poly1305_simd_init(&dctx->h, key);
	135	dctx->s[0] = get_unaligned_le32(&key[16]);
	136	dctx->s[1] = get_unaligned_le32(&key[20]);
	137	dctx->s[2] = get_unaligned_le32(&key[24]);
	138	dctx->s[3] = get_unaligned_le32(&key[28]);
	139	dctx->buflen = 0;
	140	dctx->sset = true;
1c08a104	141	}
d7d7b853	142	EXPORT_SYMBOL(poly1305_init_arch);
1c08a104	143
d7d7b853 JD	144	static unsigned int crypto_poly1305_setdctxkey(struct poly1305_desc_ctx *dctx,
d7d7b853 JD	145	const u8 *inp, unsigned int len)
1c08a104	146	{
d7d7b853 JD	147	unsigned int acc = 0;
	148	if (unlikely(!dctx->sset)) {
	149	if (!dctx->rset && len >= POLY1305_BLOCK_SIZE) {
	150	poly1305_simd_init(&dctx->h, inp);
	151	inp += POLY1305_BLOCK_SIZE;
	152	len -= POLY1305_BLOCK_SIZE;
	153	acc += POLY1305_BLOCK_SIZE;
1c08a104 JD	154	dctx->rset = 1;
1c08a104 JD	155	}
d7d7b853 JD	156	if (len >= POLY1305_BLOCK_SIZE) {
	157	dctx->s[0] = get_unaligned_le32(&inp[0]);
	158	dctx->s[1] = get_unaligned_le32(&inp[4]);
	159	dctx->s[2] = get_unaligned_le32(&inp[8]);
	160	dctx->s[3] = get_unaligned_le32(&inp[12]);
c3a98c3a	161	acc += POLY1305_BLOCK_SIZE;
1c08a104 JD	162	dctx->sset = true;
	163	}
	164	}
d7d7b853	165	return acc;
c70f4abe MW	166	}
c70f4abe MW	167
f0e89bcf AB	168	void poly1305_update_arch(struct poly1305_desc_ctx dctx, const u8 src,
f0e89bcf AB	169	unsigned int srclen)
c70f4abe	170	{
d7d7b853	171	unsigned int bytes, used;
c70f4abe	172
c70f4abe MW	173	if (unlikely(dctx->buflen)) {
	174	bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
	175	memcpy(dctx->buf + dctx->buflen, src, bytes);
	176	src += bytes;
	177	srclen -= bytes;
	178	dctx->buflen += bytes;
	179
	180	if (dctx->buflen == POLY1305_BLOCK_SIZE) {
d7d7b853 JD	181	if (likely(!crypto_poly1305_setdctxkey(dctx, dctx->buf, POLY1305_BLOCK_SIZE)))
d7d7b853 JD	182	poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 1);
c70f4abe MW	183	dctx->buflen = 0;
	184	}
	185	}
	186
	187	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
d7d7b853 JD	188	bytes = round_down(srclen, POLY1305_BLOCK_SIZE);
	189	srclen -= bytes;
	190	used = crypto_poly1305_setdctxkey(dctx, src, bytes);
	191	if (likely(bytes - used))
	192	poly1305_simd_blocks(&dctx->h, src + used, bytes - used, 1);
	193	src += bytes;
c70f4abe MW	194	}
c70f4abe MW	195
c70f4abe MW	196	if (unlikely(srclen)) {
	197	dctx->buflen = srclen;
	198	memcpy(dctx->buf, src, srclen);
	199	}
1b2c6a51	200	}
f0e89bcf AB	201	EXPORT_SYMBOL(poly1305_update_arch);
f0e89bcf AB	202
d7d7b853	203	void poly1305_final_arch(struct poly1305_desc_ctx dctx, u8 dst)
f0e89bcf	204	{
d7d7b853 JD	205	if (unlikely(dctx->buflen)) {
	206	dctx->buf[dctx->buflen++] = 1;
	207	memset(dctx->buf + dctx->buflen, 0,
	208	POLY1305_BLOCK_SIZE - dctx->buflen);
	209	poly1305_simd_blocks(&dctx->h, dctx->buf, POLY1305_BLOCK_SIZE, 0);
1c08a104 JD	210	}
1c08a104 JD	211
d7d7b853	212	poly1305_simd_emit(&dctx->h, dst, dctx->s);
458c0480	213	memzero_explicit(dctx, sizeof(*dctx));
f0e89bcf AB	214	}
f0e89bcf AB	215	EXPORT_SYMBOL(poly1305_final_arch);
1b2c6a51 AB	216
	217	static int crypto_poly1305_init(struct shash_desc *desc)
	218	{
	219	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	220
d7d7b853	221	*dctx = (struct poly1305_desc_ctx){};
1b2c6a51 AB	222	return 0;
	223	}
	224
d7d7b853 JD	225	static int crypto_poly1305_update(struct shash_desc *desc,
d7d7b853 JD	226	const u8 *src, unsigned int srclen)
1b2c6a51 AB	227	{
	228	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	229
d7d7b853	230	poly1305_update_arch(dctx, src, srclen);
c70f4abe MW	231	return 0;
	232	}
	233
d7d7b853	234	static int crypto_poly1305_final(struct shash_desc desc, u8 dst)
f0e89bcf AB	235	{
	236	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	237
d7d7b853 JD	238	if (unlikely(!dctx->sset))
	239	return -ENOKEY;
	240
	241	poly1305_final_arch(dctx, dst);
f0e89bcf AB	242	return 0;
	243	}
	244
c70f4abe MW	245	static struct shash_alg alg = {
c70f4abe MW	246	.digestsize = POLY1305_DIGEST_SIZE,
ad8f5b88	247	.init = crypto_poly1305_init,
d7d7b853	248	.update = crypto_poly1305_update,
c70f4abe	249	.final = crypto_poly1305_final,
ad8f5b88	250	.descsize = sizeof(struct poly1305_desc_ctx),
c70f4abe MW	251	.base = {
	252	.cra_name = "poly1305",
	253	.cra_driver_name = "poly1305-simd",
	254	.cra_priority = 300,
c70f4abe MW	255	.cra_blocksize = POLY1305_BLOCK_SIZE,
	256	.cra_module = THIS_MODULE,
	257	},
	258	};
	259
	260	static int __init poly1305_simd_mod_init(void)
	261	{
42251572	262	if (boot_cpu_has(X86_FEATURE_AVX) &&
d7d7b853 JD	263	cpu_has_xfeatures(XFEATURE_MASK_SSE \| XFEATURE_MASK_YMM, NULL))
d7d7b853 JD	264	static_branch_enable(&poly1305_use_avx);
e6abef61	265	if (boot_cpu_has(X86_FEATURE_AVX) && boot_cpu_has(X86_FEATURE_AVX2) &&
f0e89bcf AB	266	cpu_has_xfeatures(XFEATURE_MASK_SSE \| XFEATURE_MASK_YMM, NULL))
f0e89bcf AB	267	static_branch_enable(&poly1305_use_avx2);
d7d7b853 JD	268	if (IS_ENABLED(CONFIG_AS_AVX512) && boot_cpu_has(X86_FEATURE_AVX) &&
	269	boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_AVX512F) &&
	270	cpu_has_xfeatures(XFEATURE_MASK_SSE \| XFEATURE_MASK_YMM \| XFEATURE_MASK_AVX512, NULL) &&
	271	/* Skylake downclocks unacceptably much when using zmm, but later generations are fast. */
	272	boot_cpu_data.x86_model != INTEL_FAM6_SKYLAKE_X)
	273	static_branch_enable(&poly1305_use_avx512);
8394bfec	274	return IS_REACHABLE(CONFIG_CRYPTO_HASH) ? crypto_register_shash(&alg) : 0;
c70f4abe MW	275	}
	276
	277	static void __exit poly1305_simd_mod_exit(void)
	278	{
8394bfec JD	279	if (IS_REACHABLE(CONFIG_CRYPTO_HASH))
8394bfec JD	280	crypto_unregister_shash(&alg);
c70f4abe MW	281	}
	282
	283	module_init(poly1305_simd_mod_init);
	284	module_exit(poly1305_simd_mod_exit);
	285
	286	MODULE_LICENSE("GPL");
d7d7b853	287	MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
c70f4abe MW	288	MODULE_DESCRIPTION("Poly1305 authenticator");
	289	MODULE_ALIAS_CRYPTO("poly1305");
	290	MODULE_ALIAS_CRYPTO("poly1305-simd");