Re: [PATCH v3] crypto: aes - Fix undesired override of some optimized AES modes

[John Paul Adrian Glaubitz]

Hi Stian,

On Wed, 2026-09-30 at 09:32 +0200, Stian Halseth wrote:
> On Tue, 2026-09-29 at 15:27 -0700, Eric Biggers wrote:
> > The new library APIs for AES encryption modes were wired up to the
> > traditional crypto API via crypto/aes.c.  However, for now the kernel
> > is
> > still in a transitional state where various architectures still have
> > architecture-optimized implementations of AES modes in
> > arch/*/crypto/,
> > wired up to the traditional crypto API only.  Because of that, the
> > crypto/aes.c algorithms were given a cra_priority of only 110 to
> > prevent
> > them from overriding arch/*/crypto/ in the traditional crypto API.
> > 
> > However, because of how the traditional crypto API works, the
> > cra_priority trick doesn't work in cases where the relevant algorithm
> > isn't directly implemented by arch/*/crypto/ but rather is provided
> > by a
> > template instance using other code in arch/*/crypto/.
> > 
> > For example, x86 doesn't have its own "ccm(aes)" but rather relies on
> > the "ccm" template constructing it from the x86-optimized "ctr(aes)".
> > The existence of the library-based "ccm(aes)" prevents that, even
> > though
> > its priority is lower than what the template would produce.
> > 
> > Thus, "ccm(aes)" ends up using the slower single-block AES code.
> > 
> > Therefore, skip wiring up the relevant library-based code to the
> > traditional crypto API on architectures where this problem can occur,
> > as
> > determined by what exists in arch/*/crypto/ for each architecture.
> > 
> > This is ugly, but it's also temporary: these conditions will go away
> > as
> > architecture-optimized implementations of AES modes are migrated into
> > the library.  But until then, we need to prevent performance
> > regressions
> > by ensuring that the optimized code continues to be used.
> > 
> > Fixes: 20df21a482aa ("crypto: aes - Add CBC and CBC-CTS support using
> > library")
> > Fixes: 8ca62072faa1 ("crypto: aes - Add GCM support using library")
> > Fixes: f70ad727d1d6 ("crypto: aes - Add CCM support using library")
> > Fixes: 94efa0c9fb36 ("crypto: aes - Add XTS support using library")
> > Closes: https://github.com/sparclinux/issues/issues/106
> > Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> > ---
> > 
> > This patch is intended to taken through libcrypto-fixes
> > 
> > v3: Also suppress xts(aes) on SPARC, and improved comments
> > v2: Fixed PowerPC config option, and resent as standalone patch
> > 
> > 
> Tested on a SPARC T7-1 (M7) on top of v7.3-rc5. xts(aes) resolves to
> xts(ecb-aes-sparc64) again. cryptsetup benchmark aes-xts goes from
> 152/147 MiB/s back to 429/404 (AES-128/AES-256), the 7.2 figures.
> CRYPTO_SELFTESTS_FULL passes and XTS matches OpenSSL.
> 
> Tested-by: Stian Halseth stian@xxxxxx

Very nice! Do you know which SPARC CPUs support these instructions?

Adrian

> >  crypto/aes.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++---
> > -
> >  1 file changed, 47 insertions(+), 4 deletions(-)
> > 
> > diff --git a/crypto/aes.c b/crypto/aes.c
> > index 94791f481e98..51eee78396ea 100644
> > --- a/crypto/aes.c
> > +++ b/crypto/aes.c
> > @@ -637,7 +637,18 @@ static struct skcipher_alg skcipher_algs[] = {
> >  		.decrypt = crypto_aes_cbc_decrypt,
> >  	},
> >  #endif
> > -#if IS_ENABLED(CONFIG_CRYPTO_CTS)
> > +	/*
> > +	 * Don't register library-based "cts(cbc(aes))" on
> > architectures where
> > +	 * it might block a "better" implementation from being
> > instantiated via
> > +	 * the "cts" template.  These exclusions are temporary and
> > will go away
> > +	 * as the arch-optimized AES code is migrated into the
> > library.
> > +	 */
> > +#if IS_ENABLED(CONFIG_CRYPTO_CTS) && \
> > +	!(IS_ENABLED(CONFIG_ARM) || \
> > +	  IS_ENABLED(CONFIG_ARM64) || \
> > +	  IS_ENABLED(CONFIG_PPC) || \
> > +	  IS_ENABLED(CONFIG_S390) || \
> > +	  IS_ENABLED(CONFIG_SPARC))
> >  	{
> >  		.base.cra_name = "cts(cbc(aes))",
> >  		.base.cra_driver_name = "cts-cbc-aes-lib",
> > @@ -687,7 +698,13 @@ static struct skcipher_alg skcipher_algs[] = {
> >  		.decrypt = crypto_aes_xctr_crypt,
> >  	},
> >  #endif
> > -#if IS_ENABLED(CONFIG_CRYPTO_XTS)
> > +	/*
> > +	 * Don't register library-based "xts(aes)" on architectures
> > where it
> > +	 * might block a "better" implementation from being
> > instantiated via the
> > +	 * "xts" template.  This exclusion is temporary and will go
> > away when
> > +	 * the library AES-XTS is optimized for SPARC.
> > +	 */
> > +#if IS_ENABLED(CONFIG_CRYPTO_XTS) && !IS_ENABLED(CONFIG_SPARC)
> >  	{
> >  		.base.cra_name = "xts(aes)",
> >  		.base.cra_driver_name = "xts-aes-lib",
> > @@ -980,7 +997,20 @@ static __maybe_unused int
> > crypto_aes_ccm_decrypt(struct aead_request *req)
> >  }
> >  
> >  static struct aead_alg aead_algs[] = {
> > -#if IS_ENABLED(CONFIG_CRYPTO_GCM)
> > +	/*
> > +	 * Don't register library-based "gcm(aes)" and
> > "rfc4106(gcm(aes))" on
> > +	 * architectures where they might block a "better"
> > implementation from
> > +	 * being instantiated via the "gcm" and "rfc4106"
> > templates.  These
> > +	 * exclusions are temporary and will go away as the arch-
> > optimized AES
> > +	 * code is migrated into the library.
> > +	 */
> > +#if IS_ENABLED(CONFIG_CRYPTO_GCM) && \
> > +	!(IS_ENABLED(CONFIG_ARM) || \
> > +	  IS_ENABLED(CONFIG_ARM64) || \
> > +	  IS_ENABLED(CONFIG_PPC) || \
> > +	  IS_ENABLED(CONFIG_RISCV) || \
> > +	  IS_ENABLED(CONFIG_S390) || \
> > +	  IS_ENABLED(CONFIG_SPARC))
> >  	{
> >  		.base.cra_name = "gcm(aes)",
> >  		.base.cra_driver_name = "gcm-aes-lib",
> > @@ -1012,7 +1042,20 @@ static struct aead_alg aead_algs[] = {
> >  		.chunksize = AES_BLOCK_SIZE,
> >  	},
> >  #endif /* CONFIG_CRYPTO_GCM */
> > -#if IS_ENABLED(CONFIG_CRYPTO_CCM)
> > +	/*
> > +	 * Don't register library-based "ccm(aes)" on architectures
> > where it
> > +	 * might block a "better" implementation from being
> > instantiated via the
> > +	 * "ccm" template.  These exclusions are temporary and will
> > go away as
> > +	 * the arch-optimized AES code is migrated into the library.
> > +	 */
> > +#if IS_ENABLED(CONFIG_CRYPTO_CCM) && \
> > +	!(IS_ENABLED(CONFIG_ARM) || \
> > +	  IS_ENABLED(CONFIG_ARM64) || \
> > +	  IS_ENABLED(CONFIG_PPC) || \
> > +	  IS_ENABLED(CONFIG_RISCV) || \
> > +	  IS_ENABLED(CONFIG_S390) || \
> > +	  IS_ENABLED(CONFIG_SPARC) || \
> > +	  IS_ENABLED(CONFIG_X86))
> >  	{
> >  		.base.cra_name = "ccm(aes)",
> >  		.base.cra_driver_name = "ccm-aes-lib",
> > 
> > base-commit: 93f51579e7df248780214094418f205253383cc5

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913