From nobody Fri Jan 9 11:50:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DADC932B9AE; Mon, 5 Jan 2026 05:15:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767590107; cv=none; b=I9vmmhijhJlbkO19eI42QDYy2bnU+VdC4sPO/Rytdq06sLfmmAb34JeRWjAFJjT8ULvpzKw/B5VKMAMINHGKD1uUD1LJ3rgQs85dU9lEMuTYa5AoIgIp2tqn7jD4B0wEiKTcqXMn2K0Y7D5Ie92yM0f+kcKapD9J7FlEDFoXIE8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767590107; c=relaxed/simple; bh=X2y6JmsAPpKxGvYBZWX3/Sy84iagH93kp9gxdC5t9Go=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Uw+U7bHymKzrRpnF+xTbVZknpgFo+MoPwAd4brsQA+jGgcHTR8eRk/Je/dmUNwp0PtldUdCA7HcZiVh5mbImtjCUd2fw34DKIs6AIWxwq2NnD9a1r4XuYj8rdqO+PwoXKVKyu4hd62YokdWY6vRCOBzWDkA2gwTfk4CokVET1TU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Rmly392a; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Rmly392a" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F442C4AF09; Mon, 5 Jan 2026 05:15:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1767590106; bh=X2y6JmsAPpKxGvYBZWX3/Sy84iagH93kp9gxdC5t9Go=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rmly392a977vLVI0kfIty/rm8OhHHS/k5IDBLd9WUUdJDGUZk77qfzuOUZOwqSYu0 +ILUM5sQMAanzj4L78EzSjqCPf2HbWVRLYRZqzVH7Cbp9jqwmY6YFz5sK0ZEtElr9u lS8cI0RrtadOm8Rz0A/pLiOBP71fBx2HYzL6NRrvOjx09dXoh5lV+UA3n9zI9RJgC5 E+d33a+vjyQ0RncbIGufV5ni6Frma+umzTnzXfF9wggbwtWr2tyzfNce83TUAEC1sJ HWFMoH7PJKLC4UJAJZrbQppx0tXeDO2LY9c/RAgt/1mvYY0OIen/I21GHPWpt/BLRK Hh9X0ljtBlWDA== From: Eric Biggers To: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Ard Biesheuvel , "Jason A . Donenfeld" , Herbert Xu , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, sparclinux@vger.kernel.org, x86@kernel.org, Holger Dengler , Harald Freudenberger , Eric Biggers Subject: [PATCH 24/36] crypto: arm64/ghash - Use new AES library API Date: Sun, 4 Jan 2026 21:12:57 -0800 Message-ID: <20260105051311.1607207-25-ebiggers@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260105051311.1607207-1-ebiggers@kernel.org> References: <20260105051311.1607207-1-ebiggers@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Switch from the old AES library functions (which use struct crypto_aes_ctx) to the new ones (which use struct aes_enckey). This eliminates the unnecessary computation and caching of the decryption round keys. The new AES en/decryption functions are also much faster and use AES instructions when supported by the CPU. Note: aes_encrypt_new() will be renamed to aes_encrypt() once all callers of the old aes_encrypt() have been updated. Signed-off-by: Eric Biggers --- arch/arm64/crypto/ghash-ce-glue.c | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-) diff --git a/arch/arm64/crypto/ghash-ce-glue.c b/arch/arm64/crypto/ghash-ce= -glue.c index ef249d06c92c..bfd38e485e77 100644 --- a/arch/arm64/crypto/ghash-ce-glue.c +++ b/arch/arm64/crypto/ghash-ce-glue.c @@ -38,11 +38,11 @@ struct ghash_key { struct arm_ghash_desc_ctx { u64 digest[GHASH_DIGEST_SIZE/sizeof(u64)]; }; =20 struct gcm_aes_ctx { - struct crypto_aes_ctx aes_key; + struct aes_enckey aes_key; u8 nonce[RFC4106_NONCE_SIZE]; struct ghash_key ghash_key; }; =20 asmlinkage void pmull_ghash_update_p64(int blocks, u64 dg[], const char *s= rc, @@ -184,35 +184,23 @@ static struct shash_alg ghash_alg =3D { .import =3D ghash_import, .descsize =3D sizeof(struct arm_ghash_desc_ctx), .statesize =3D sizeof(struct ghash_desc_ctx), }; =20 -static int num_rounds(struct crypto_aes_ctx *ctx) -{ - /* - * # of rounds specified by AES: - * 128 bit key 10 rounds - * 192 bit key 12 rounds - * 256 bit key 14 rounds - * =3D> n byte key =3D> 6 + (n/4) rounds - */ - return 6 + ctx->key_length / 4; -} - static int gcm_aes_setkey(struct crypto_aead *tfm, const u8 *inkey, unsigned int keylen) { struct gcm_aes_ctx *ctx =3D crypto_aead_ctx(tfm); u8 key[GHASH_BLOCK_SIZE]; be128 h; int ret; =20 - ret =3D aes_expandkey(&ctx->aes_key, inkey, keylen); + ret =3D aes_prepareenckey(&ctx->aes_key, inkey, keylen); if (ret) return -EINVAL; =20 - aes_encrypt(&ctx->aes_key, key, (u8[AES_BLOCK_SIZE]){}); + aes_encrypt_new(&ctx->aes_key, key, (u8[AES_BLOCK_SIZE]){}); =20 /* needed for the fallback */ memcpy(&ctx->ghash_key.k, key, GHASH_BLOCK_SIZE); =20 ghash_reflect(ctx->ghash_key.h[0], &ctx->ghash_key.k); @@ -294,11 +282,10 @@ static void gcm_calculate_auth_mac(struct aead_reques= t *req, u64 dg[], u32 len) =20 static int gcm_encrypt(struct aead_request *req, char *iv, int assoclen) { struct crypto_aead *aead =3D crypto_aead_reqtfm(req); struct gcm_aes_ctx *ctx =3D crypto_aead_ctx(aead); - int nrounds =3D num_rounds(&ctx->aes_key); struct skcipher_walk walk; u8 buf[AES_BLOCK_SIZE]; u64 dg[2] =3D {}; be128 lengths; u8 *tag; @@ -329,12 +316,12 @@ static int gcm_encrypt(struct aead_request *req, char= *iv, int assoclen) tag =3D NULL; } =20 scoped_ksimd() pmull_gcm_encrypt(nbytes, dst, src, ctx->ghash_key.h, - dg, iv, ctx->aes_key.key_enc, nrounds, - tag); + dg, iv, ctx->aes_key.k.rndkeys, + ctx->aes_key.nrounds, tag); =20 if (unlikely(!nbytes)) break; =20 if (unlikely(nbytes > 0 && nbytes < AES_BLOCK_SIZE)) @@ -357,11 +344,10 @@ static int gcm_encrypt(struct aead_request *req, char= *iv, int assoclen) static int gcm_decrypt(struct aead_request *req, char *iv, int assoclen) { struct crypto_aead *aead =3D crypto_aead_reqtfm(req); struct gcm_aes_ctx *ctx =3D crypto_aead_ctx(aead); unsigned int authsize =3D crypto_aead_authsize(aead); - int nrounds =3D num_rounds(&ctx->aes_key); struct skcipher_walk walk; u8 otag[AES_BLOCK_SIZE]; u8 buf[AES_BLOCK_SIZE]; u64 dg[2] =3D {}; be128 lengths; @@ -399,12 +385,13 @@ static int gcm_decrypt(struct aead_request *req, char= *iv, int assoclen) } =20 scoped_ksimd() ret =3D pmull_gcm_decrypt(nbytes, dst, src, ctx->ghash_key.h, - dg, iv, ctx->aes_key.key_enc, - nrounds, tag, otag, authsize); + dg, iv, ctx->aes_key.k.rndkeys, + ctx->aes_key.nrounds, tag, otag, + authsize); =20 if (unlikely(!nbytes)) break; =20 if (unlikely(nbytes > 0 && nbytes < AES_BLOCK_SIZE)) --=20 2.52.0