Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230726172958.1215472-1-ardb@kernel.org> <ZMy1DkYRBc1PxC8e@gondor.apana.org.au>
In-Reply-To: <ZMy1DkYRBc1PxC8e@gondor.apana.org.au>
From:   Ard Biesheuvel <ardb@kernel.org>
Date:   Fri, 4 Aug 2023 10:31:22 +0200
Message-ID: <CAMj1kXHCt6DJEZKYVYBXN0QhZ0w2ByCPUK2S2y2T5U06Ztrx9A@mail.gmail.com>
Subject: Re: [PATCH] crypto: riscv/aes - Implement scalar Zkn version for RV32
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     linux-crypto@vger.kernel.org, ebiggers@kernel.org,
        linux-riscv@lists.infradead.org,
        Paul Walmsley <paul.walmsley@sifive.com>,
        Palmer Dabbelt <palmer@dabbelt.com>,
        Albert Ou <aou@eecs.berkeley.edu>,
        =?UTF-8?Q?Christoph_M=C3=BCllner?= <christoph.muellner@vrull.eu>,
        Heiko Stuebner <heiko.stuebner@vrull.eu>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, 4 Aug 2023 at 10:21, Herbert Xu <herbert@gondor.apana.org.au> wrote=
:
>
> On Wed, Jul 26, 2023 at 07:29:58PM +0200, Ard Biesheuvel wrote:
> > The generic AES implementation we rely on if no architecture specific
> > one is available relies on lookup tables that are relatively large with
> > respect to the typical L1 D-cache size, which not only affects
> > performance, it may also result in timing variances that correlate with
> > the encryption keys.
> >
> > So we tend to avoid the generic code if we can, usually by using a
> > driver that makes use of special AES instructions which supplant most o=
f
> > the logic of the table based implementation the AES algorithm.
> >
> > The Zkn RISC-V extension provides another interesting take on this: it
> > defines instructions operating on scalar registers that implement the
> > table lookups without relying on tables in memory. Those tables carry
> > 32-bit quantities, making them a natural fit for a 32-bit architecture.
> > And given the use of scalars, we don't have to rely in in-kernel SIMD,
> > which is a bonus.
> >
> > So let's use the instructions to implement the core AES cipher for RV32=
.
> >
> > Cc: Paul Walmsley <paul.walmsley@sifive.com>
> > Cc: Palmer Dabbelt <palmer@dabbelt.com>
> > Cc: Albert Ou <aou@eecs.berkeley.edu>
> > Cc: Christoph M=C3=BCllner <christoph.muellner@vrull.eu>
> > Cc: Heiko Stuebner <heiko.stuebner@vrull.eu>
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> >  arch/riscv/crypto/Kconfig             |  12 ++
> >  arch/riscv/crypto/Makefile            |   3 +
> >  arch/riscv/crypto/aes-riscv32-glue.c  |  75 ++++++++++++
> >  arch/riscv/crypto/aes-riscv32-zkned.S | 119 ++++++++++++++++++++
> >  4 files changed, 209 insertions(+)
>
> Hi Ard:
>
> Any chance you could postpone this til after I've finished removing
> crypto_cipher?
>

That's fine with me. Do you have an ETA on that? Need any help?

I have implemented the scalar 64-bit counterpart as well in the mean time