Changes in Kconfig

17ec3e71 - crypto: lib/Kconfig - Hide arch options from user

Thu, 27 Feb 2025 07:48:39 +0000

crypto: lib/Kconfig - Hide arch options from userThe ARCH_MAY_HAVE patch missed arm64, mips and s390. But it mayalso lead to arch options being enabled but ineffective becauseof modular/built-in conflicts.As the primary user of all these options wireguard is selectingthe arch options anyway, make the same selections at the lib/cryptooption level and hide the arch options from the user.Instead of selecting them centrally from lib/crypto, simply setthe default of each arch option as suggested by Eric Biggers.Change the Crypto API generic algorithms to select the top-levellib/crypto options instead of the generic one as otherwise thereis no way to enable the arch options (Eric Biggers). Introduce aset of INTERNAL options to work around dependency cycles on theCONFIG_CRYPTO symbol.Fixes: 1047e21aecdf ("crypto: lib/Kconfig - Fix lib built-in failure when arch is modular")Reported-by: kernel test robot Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/oe-kbuild-all/202502232152.JC84YDLp-lkp@intel.com/Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

1047e21a - crypto: lib/Kconfig - Fix lib built-in failure when arch is modular

Wed, 12 Feb 2025 04:48:55 +0000

crypto: lib/Kconfig - Fix lib built-in failure when arch is modularThe HAVE_ARCH Kconfig options in lib/crypto try to solve themodular versus built-in problem, but it still fails when thethe LIB option (e.g., CRYPTO_LIB_CURVE25519) is selected externally.Fix this by introducing a level of indirection with ARCH_MAY_HAVEKconfig options, these then go on to select the ARCH_HAVE optionsif the ARCH Kconfig options matches that of the LIB option.Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202501230223.ikroNDr1-lkp@intel.com/Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

1684e829 - arm/crc-t10dif: expose CRC-T10DIF function through lib

Mon, 02 Dec 2024 01:20:49 +0000

arm/crc-t10dif: expose CRC-T10DIF function through libMove the arm CRC-T10DIF assembly code into the lib directory and wire itup to the library interface. This allows it to be used without goingthrough the crypto API. It remains usable via the crypto API too viathe shash algorithms that use the library interface. Thus all thearch-specific "shash" code becomes unnecessary and is removed.Note: to see the diff from arch/arm/crypto/crct10dif-ce-glue.c toarch/arm/lib/crc-t10dif-glue.c, view this commit with 'git show -M10'.Reviewed-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20241202012056.209768-6-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux-6.15/arch/arm/crypto/Kconfig

1e1b6dbc - arm/crc32: expose CRC32 functions through lib

Mon, 02 Dec 2024 01:08:30 +0000

arm/crc32: expose CRC32 functions through libMove the arm CRC32 assembly code into the lib directory and wire it upto the library interface. This allows it to be used without goingthrough the crypto API. It remains usable via the crypto API too viathe shash algorithms that use the library interface. Thus all thearch-specific "shash" code becomes unnecessary and is removed.Note: to see the diff from arch/arm/crypto/crc32-ce-glue.c toarch/arm/lib/crc32-glue.c, view this commit with 'git show -M10'.Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20241202010844.144356-6-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux-6.15/arch/arm/crypto/Kconfig

f235bc11 - crypto: arm/aes-neonbs - go back to using aes-arm directly

Fri, 09 Aug 2024 23:11:49 +0000

crypto: arm/aes-neonbs - go back to using aes-arm directlyIn aes-neonbs, instead of going through the crypto API for the partsthat the bit-sliced AES code doesn't handle, namely AES-CBC encryptionand single-block AES, just call the ARM scalar AES cipher directly.This basically goes back to the original approach that was used beforecommit b56f5cbc7e08 ("crypto: arm/aes-neonbs - resolve fallback cipherat runtime"). Calling the ARM scalar AES cipher directly is faster,simpler, and avoids any chance of bugs specific to the use of fallbackciphers such as module loading deadlocks which have happened twice. Thedeadlocks turned out to be fixable in other ways, but there's no need torely on anything so fragile in the first place.The rationale for the above-mentioned commit was to allow people tochoose to use a time-invariant AES implementation for the fallbackcipher. There are a couple problems with that rationale, though:- In practice the ARM scalar AES cipher (aes-arm) was used anyway, since it has a higher priority than aes-fixed-time. Users *could* go out of their way to disable or blacklist aes-arm, or to lower its priority using NETLINK_CRYPTO, but very few users customize the crypto API to this extent. Systems with the ARMv8 Crypto Extensions used aes-ce, but the bit-sliced algorithms are irrelevant on such systems anyway.- Since commit 913a3aa07d16 ("crypto: arm/aes - add some hardening against cache-timing attacks"), the ARM scalar AES cipher is partially hardened against cache-timing attacks. It actually works like aes-fixed-time, in that it disables interrupts and prefetches its lookup table. It does use a larger table than aes-fixed-time, but even so, it is not clear that aes-fixed-time is meaningfully more time-invariant than aes-arm. And of course, the real solution for time-invariant AES is to use a CPU that supports AES instructions.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

b575b5a1 - ARM: 9286/1: crypto: Implement fused AES-CTR/GHASH version of GCM

Mon, 16 Jan 2023 11:01:48 +0000

ARM: 9286/1: crypto: Implement fused AES-CTR/GHASH version of GCMOn 32-bit ARM, AES in GCM mode takes full advantage of the ARMv8 CryptoExtensions when available, resulting in a performance of 6-7 cycles perbyte for typical IPsec frames on cores such as Cortex-A53, using thegeneric GCM template encapsulating the accelerated AES-CTR and GHASHimplementations.At such high rates, any time spent copying data or doing other poorlyoptimized work in the generic layer hurts disproportionately, and we canget a significant performance improvement by combining the optimizedAES-CTR and GHASH implementations into a single GCM driver.On Cortex-A53, this results in a performance improvement of around 75%,and AES-256-GCM-128 with RFC4106 encapsulation runs in 4 cycles perbyte.Note that this code takes advantage of the fact that kernel mode NEON isnow supported in softirq context as well, and therefore does not providea non-NEON fallback path at all. (AEADs are only callable in process orsoftirq context)Acked-by: Herbert Xu Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) List of files: /linux-6.15/arch/arm/crypto/Kconfig

61c581a4 - crypto: move gf128mul library into lib/crypto

Thu, 03 Nov 2022 19:22:57 +0000

crypto: move gf128mul library into lib/cryptoThe gf128mul library does not depend on the crypto API at all, so it canbe moved into lib/crypto. This will allow us to use it in other librarycode in a subsequent patch without having to depend on CONFIG_CRYPTO.While at it, change the Kconfig symbol name to align with other cryptolibrary implementations. However, the source file name is retained, asit is reflected in the module .ko filename, and changing this mightbreak things for users.Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

cf514b2a - crypto: Kconfig - simplify cipher entries

Sat, 20 Aug 2022 18:41:50 +0000

crypto: Kconfig - simplify cipher entriesShorten menu titles and make them consistent:- acronym- name- architecture features in parenthesis- no suffixes like " algorithm", "support", or "hardware acceleration", or "optimized"Simplify help text descriptions, update references, and ensure thathttps references are still valid.Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

3f342a23 - crypto: Kconfig - simplify hash entries

Sat, 20 Aug 2022 18:41:48 +0000

crypto: Kconfig - simplify hash entriesShorten menu titles and make them consistent:- acronym- name- architecture features in parenthesis- no suffixes like " algorithm", "support", or "hardware acceleration", or "optimized"Simplify help text descriptions, update references, and ensure thathttps references are still valid.Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

ec84348d - crypto: Kconfig - simplify CRC entries

Sat, 20 Aug 2022 18:41:46 +0000

crypto: Kconfig - simplify CRC entriesShorten menu titles and make them consistent:- acronym- name- architecture features in parenthesis- no suffixes like " algorithm", "support", or "hardware acceleration", or "optimized"Simplify help text descriptions, update references, and ensure thathttps references are still valid.Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

05b37465 - crypto: Kconfig - simplify public-key entries

Sat, 20 Aug 2022 18:41:45 +0000

crypto: Kconfig - simplify public-key entriesShorten menu titles and make them consistent:- acronym- name- architecture features in parenthesis- no suffixes like " algorithm", "support", or "hardware acceleration", or "optimized"Simplify help text descriptions, update references, and ensure thathttps references are still valid.Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

4a95d4ae - crypto: Kconfig - sort the arm entries

Sat, 20 Aug 2022 18:41:43 +0000

crypto: Kconfig - sort the arm entriesSort the arm entries so all like entries are together.Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

4a329fec - crypto: Kconfig - submenus for arm and arm64

Sat, 20 Aug 2022 18:41:41 +0000

crypto: Kconfig - submenus for arm and arm64Move ARM- and ARM64-accelerated menus into a submenu underthe Crypto API menu (paralleling all the architectures).Make each submenu always appear if the corresponding architectureis supported. Get rid of the ARM_CRYPTO and ARM64_CRYPTO symbols.The "ARM Accelerated" or "ARM64 Accelerated" entry disappears from: General setup ---> Platform selection ---> Kernel Features ---> Boot options ---> Power management options ---> CPU Power Management --->[*] ACPI (Advanced Configuration and Power Interface) Support --->[*] Virtualization --->[*] ARM Accelerated Cryptographic Algorithms ---> (or)[*] ARM64 Accelerated Cryptographic Algorithms ---> ...-*- Cryptographic API ---> Library routines ---> Kernel hacking --->and moves into the Cryptographic API menu, which now contains: ... Accelerated Cryptographic Algorithms for CPU (arm) ---> (or) Accelerated Cryptographic Algorithms for CPU (arm64) --->[*] Hardware crypto devices ---> ...Suggested-by: Eric Biggers Signed-off-by: Robert Elliott Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

2d16803c - crypto: blake2s - remove shash module

Sat, 28 May 2022 19:44:07 +0000

crypto: blake2s - remove shash moduleBLAKE2s has no currently known use as an shash. Just remove all of thisunnecessary plumbing. Removing this shash was something we talked aboutback when we were making BLAKE2s a built-in, but I simply never gotaround to doing it. So this completes that project.Importantly, this fixs a bug in which the lib code depends oncrypto_simd_disabled_for_test, causing linker errors.Also add more alignment tests to the selftests and compare SIMD andnon-SIMD compression functions, to make up for what we lose fromtestmgr.c.Reported-by: gaochao Cc: Eric Biggers Cc: Ard Biesheuvel Cc: stable@vger.kernel.orgFixes: 6048fdcc5f26 ("lib/crypto: blake2s: include as built-in")Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

c8bd296c - crypto: arm/aes-neonbs-cbc - Select generic cbc and aes

Wed, 16 Mar 2022 22:55:13 +0000

crypto: arm/aes-neonbs-cbc - Select generic cbc and aesThe algorithm __cbc-aes-neonbs requires a fallback so we needto select the config options for them or otherwise it will failto register on boot-up.Fixes: 00b99ad2bac2 ("crypto: arm/aes-neonbs - Use generic cbc...")Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

1862eb00 - crypto: arm/blake2b - add NEON-accelerated BLAKE2b

Wed, 23 Dec 2020 08:10:03 +0000

crypto: arm/blake2b - add NEON-accelerated BLAKE2bAdd a NEON-accelerated implementation of BLAKE2b.On Cortex-A7 (which these days is the most common ARM processor thatdoesn't have the ARMv8 Crypto Extensions), this is over twice as fast asSHA-256, and slightly faster than SHA-1. It is also almost three timesas fast as the generic implementation of BLAKE2b: Algorithm Cycles per byte (on 4096-byte messages) =================== ======================================= blake2b-256-neon 14.0 sha1-neon 16.3 blake2s-256-arm 18.8 sha1-asm 20.8 blake2s-256-generic 26.0 sha256-neon 28.9 sha256-asm 32.0 blake2b-256-generic 38.9This implementation isn't directly based on any other implementation,but it borrows some ideas from previous NEON code I've written as wellas from chacha-neon-core.S. At least on Cortex-A7, it is faster thanthe other NEON implementations of BLAKE2b I'm aware of (theimplementation in the BLAKE2 official repository using intrinsics, andAndrew Moon's implementation which can be found in SUPERCOP). It doesonly one block at a time, so it performs well on short messages too.NEON-accelerated BLAKE2b is useful because there is interest in usingBLAKE2b-256 for dm-verity on low-end Android devices (specifically,devices that lack the ARMv8 Crypto Extensions) to replace SHA-1. Onthese devices, the performance cost of upgrading to SHA-256 may beunacceptable, whereas BLAKE2b-256 would actually improve performance.Although BLAKE2b is intended for 64-bit platforms (unlike BLAKE2s whichis intended for 32-bit platforms), on 32-bit ARM processors with NEON,BLAKE2b is actually faster than BLAKE2s. This is because NEON supports64-bit operations, and because BLAKE2s's block size is too small forNEON to be helpful for it. The best I've been able to do with BLAKE2son Cortex-A7 is 18.8 cpb with an optimized scalar implementation.(I didn't try BLAKE2sp and BLAKE3, which in theory would be faster, butthey're more complex as they require running multiple hashes at once.Note that BLAKE2b already uses all the NEON bandwidth on the Cortex-A7,so I expect that any speedup from BLAKE2sp or BLAKE3 would come onlyfrom the smaller number of rounds, not from the extra parallelism.)For now this BLAKE2b implementation is only wired up to the shash API,since there is no library API for BLAKE2b yet. However, I've tried tokeep things consistent with BLAKE2s, e.g. by definingblake2b_compress_arch() which is analogous to blake2s_compress_arch()and could be exported for use by the library API later if needed.Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Tested-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

5172d322 - crypto: arm/blake2s - add ARM scalar optimized BLAKE2s

Wed, 23 Dec 2020 08:09:59 +0000

crypto: arm/blake2s - add ARM scalar optimized BLAKE2sAdd an ARM scalar optimized implementation of BLAKE2s.NEON isn't very useful for BLAKE2s because the BLAKE2s block size is toosmall for NEON to help. Each NEON instruction would depend on theprevious one, resulting in poor performance.With scalar instructions, on the other hand, we can take advantage ofARM's "free" rotations (like I did in chacha-scalar-core.S) to get animplementation get runs much faster than the C implementation.Performance results on Cortex-A7 in cycles per byte using the shash API: 4096-byte messages: blake2s-256-arm: 18.8 blake2s-256-generic: 26.0 500-byte messages: blake2s-256-arm: 20.3 blake2s-256-generic: 27.9 100-byte messages: blake2s-256-arm: 29.7 blake2s-256-generic: 39.2 32-byte messages: blake2s-256-arm: 50.6 blake2s-256-generic: 66.2Except on very short messages, this is still slower than the NEONimplementation of BLAKE2b which I've written; that is 14.0, 16.4, 25.8,and 76.1 cpb on 4096, 500, 100, and 32-byte messages, respectively.However, optimized BLAKE2s is useful for cases where BLAKE2s is usedinstead of BLAKE2b, such as WireGuard.This new implementation is added in the form of a new moduleblake2s-arm.ko, which is analogous to blake2s-x86_64.ko in that itprovides blake2s_compress_arch() for use by the library API as well asoptionally register the algorithms with the shash API.Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Tested-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

5429ef62 - compiler/gcc: Raise minimum GCC version for kernel builds to 4.8

Wed, 22 Jan 2020 19:38:21 +0000

compiler/gcc: Raise minimum GCC version for kernel builds to 4.8It is very rare to see versions of GCC prior to 4.8 being used to buildthe mainline kernel. These old compilers are also know to have codegenissues which can lead to silent miscompilation:https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145Raise the minimum GCC version for kernel build to 4.8 and remove sometautological Kconfig dependencies as a consequence.Cc: Masahiro Yamada Acked-by: Arnd Bergmann Reviewed-by: Nick Desaulniers Signed-off-by: Will Deacon List of files: /linux-6.15/arch/arm/crypto/Kconfig

d8f1308a - crypto: arm/curve25519 - wire up NEON implementation

Fri, 08 Nov 2019 12:22:38 +0000

crypto: arm/curve25519 - wire up NEON implementationThis ports the SUPERCOP implementation for usage in kernel space. Inaddition to the usual header, macro, and style changes required forkernel space, it makes a few small changes to the code: - The stack alignment is relaxed to 16 bytes. - Superfluous mov statements have been removed. - ldr for constants has been replaced with movw. - ldreq has been replaced with moveq. - The str epilogue has been made more idiomatic. - SIMD registers are not pushed and popped at the beginning and end. - The prologue and epilogue have been made idiomatic. - A hole has been removed from the stack, saving 32 bytes. - We write-back the base register whenever possible for vld1.8. - Some multiplications have been reordered for better A7 performance.There are more opportunities for cleanup, since this code is from qhasm,which doesn't always do the most opportune thing. But even prior toextensive hand optimizations, this code delivers significant performanceimprovements (given in get_cycles() per call): ----------- ------------- | generic C | this commit | ------------ ----------- ------------- | Cortex-A7 | 49136 | 22395 | ------------ ----------- ------------- | Cortex-A17 | 17326 | 4983 | ------------ ----------- -------------Signed-off-by: Jason A. Donenfeld [ardb: - move to arch/arm/crypto - wire into lib/crypto framework - implement crypto API KPP hooks ]Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig

a6b803b3 - crypto: arm/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementation

Fri, 08 Nov 2019 12:22:25 +0000

crypto: arm/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementationThis is a straight import of the OpenSSL/CRYPTOGAMS Poly1305 implementationfor NEON authored by Andy Polyakov, and contributed by him to the OpenSSLproject. The file 'poly1305-armv4.pl' is taken straight from this upstreamGitHub repository [0] at commit ec55a08dc0244ce570c4fc7cade330c60798952f,and already contains all the changes required to build it as part of aLinux kernel module.[0] https://github.com/dot-asm/cryptogamsCo-developed-by: Andy Polyakov Signed-off-by: Andy Polyakov Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/arch/arm/crypto/Kconfig