tree 7c3048551627636309011d6156a32016763ed794
parent da215b089b5d4ff30745c59922b54b309d55a5d8
author Eric Biggers <ebiggers@google.com> 1707803682 -0800
committer Palmer Dabbelt <palmer@rivosinc.com> 1710950171 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEKzw3R0RoQ7JKlDp6LhMZ81+7GIkFAmX7BxsTHHBhbG1lckBk
 YWJiZWx0LmNvbQAKCRAuExnzX7sYibrjD/9H/zo5XhM90xZq//uBIkIBxowsy8y/
 WcbVuskB4bmQaSQRgh8CW33JhSDmp2/+QsnX+tSgv5vojgF8aabDdN4sOW+Q1BiO
 Kba6BNH2ZntuxIuSXFpi8zVcoPlaGYCml/DOax64CMtuMDUCFRS0sVaM9GON+gkH
 lWXJx9WsU5/Ucy+brlYVzeF6dqliphppSb1QudWz/lonxOj7G2eGPVAT82IrHJX8
 rc8SjctzvHs6hEjzoeLec+gtnHdHc2mSdDMI5Z4y2a7UCcGjpPQb8Tl2I9v+17qR
 S0mzccepyMIu39KDCQBzYuYpbxAoLuirhLhDxV+616GF1wvmZUyihTfTS9gXSDLO
 /ELTP3Y34fhv1kHi2k4vXzcORnLeJ/5XUZ8u6fpxnFlGm2j1sFZY8BN9tsaCN6k+
 lPSTZA5y/GGAU+nwHxuowLh5OBjXr2KeEcjExo8yb+/vSRJAnLDq7gHPU8GPk9QJ
 dyoT2ipirVl9d2t87/Rc8BNDo7dqQC01+3Ir6KOh/xgqTE3rF4iLzPUChUn3qfG0
 bH4ROXmdfz7tVb4fy+oXtb6KTqGHfopvyAe48Cq3gmRsAL6IZsp5CBAP2tmWEGGu
 GGnZgMWFP9cJKzbjBrtRW0XVygY9HX2UJ9k5JvEzZqu9wkr4L1GYnniZWb8PErvJ
 2n0oFrP4q+YIuw==
 =fBdl
 -----END PGP SIGNATURE-----

crypto: riscv - add vector crypto accelerated AES-CBC-CTS

Add an implementation of cts(cbc(aes)) accelerated using the Zvkned
RISC-V vector crypto extension.  This is mainly useful for fscrypt,
where cts(cbc(aes)) is the "default" filenames encryption algorithm.  In
that use case, typically most messages are short and are block-aligned.
The CBC-CTS variant implemented is CS3; this is the variant Linux uses.

To perform well on short messages, the new implementation processes the
full message in one call to the assembly function if the data is
contiguous.  Otherwise it falls back to CBC operations followed by CTS
at the end.  For decryption, to further improve performance on short
messages, especially block-aligned messages, the CBC-CTS assembly
function parallelizes the AES decryption of all full blocks.  This
improves on the arm64 implementation of cts(cbc(aes)), which always
splits the CBC part(s) from the CTS part, doing the AES decryptions for
the last two blocks serially and usually loading the round keys twice.

Tested in QEMU with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20240213055442.35954-1-ebiggers@kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>