Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-16 Thread Ard Biesheuvel
On Sat, 16 Jan 2021 at 06:13, Dave Hansen wrote: > > On 1/15/21 6:04 PM, Eric Biggers wrote: > > On Fri, Jan 15, 2021 at 04:20:44PM -0800, Dave Hansen wrote: > >> On 1/15/21 4:14 PM, Dey, Megha wrote: > >>> Also, I do not know of any cores that implement PCLMULQDQ and not AES-NI. > >> That's

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Dave Hansen
On 1/15/21 6:04 PM, Eric Biggers wrote: > On Fri, Jan 15, 2021 at 04:20:44PM -0800, Dave Hansen wrote: >> On 1/15/21 4:14 PM, Dey, Megha wrote: >>> Also, I do not know of any cores that implement PCLMULQDQ and not AES-NI. >> That's true, bit it's also possible that a hypervisor could enumerate >>

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Dey, Megha
On 1/15/2021 5:43 PM, Eric Biggers wrote: On Fri, Jan 15, 2021 at 04:14:40PM -0800, Dey, Megha wrote: Hello Megha, What is the purpose of this separate GHASH module? GHASH is only used in combination with AES-CTR to produce GCM, and this series already contains a GCM driver. Do cores exist

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Eric Biggers
On Fri, Jan 15, 2021 at 04:20:44PM -0800, Dave Hansen wrote: > On 1/15/21 4:14 PM, Dey, Megha wrote: > > Also, I do not know of any cores that implement PCLMULQDQ and not AES-NI. > > That's true, bit it's also possible that a hypervisor could enumerate > support for PCLMULQDQ and not AES-NI. In

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Eric Biggers
On Fri, Jan 15, 2021 at 04:14:40PM -0800, Dey, Megha wrote: > > Hello Megha, > > > > What is the purpose of this separate GHASH module? GHASH is only used > > in combination with AES-CTR to produce GCM, and this series already > > contains a GCM driver. > > > > Do cores exist that implement

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Dave Hansen
On 1/15/21 4:14 PM, Dey, Megha wrote: > Also, I do not know of any cores that implement PCLMULQDQ and not AES-NI. That's true, bit it's also possible that a hypervisor could enumerate support for PCLMULQDQ and not AES-NI. In general, we've tried to implement x86 CPU features independently, even

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2021-01-15 Thread Dey, Megha
Hi Ard, On 12/19/2020 9:03 AM, Ard Biesheuvel wrote: On Fri, 18 Dec 2020 at 22:07, Megha Dey wrote: From: Kyung Min Park Optimize GHASH computations with the 512 bit wide VPCLMULQDQ instructions. The new instruction allows to work on 4 x 16 byte blocks at the time. For best parallelism and

Re: [RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2020-12-19 Thread Ard Biesheuvel
On Fri, 18 Dec 2020 at 22:07, Megha Dey wrote: > > From: Kyung Min Park > > Optimize GHASH computations with the 512 bit wide VPCLMULQDQ instructions. > The new instruction allows to work on 4 x 16 byte blocks at the time. > For best parallelism and deeper out of order execution, the main loop

[RFC V1 3/7] crypto: ghash - Optimized GHASH computations

2020-12-18 Thread Megha Dey
From: Kyung Min Park Optimize GHASH computations with the 512 bit wide VPCLMULQDQ instructions. The new instruction allows to work on 4 x 16 byte blocks at the time. For best parallelism and deeper out of order execution, the main loop of the code works on 16 x 16 byte blocks at the time and