linux-kernel - [GIT PULL] AES-GCM optimizations for 6.19

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251130024719.GD12664@sol>
Date: Sat, 29 Nov 2025 18:47:19 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	x86@...nel.org, Ard Biesheuvel <ardb@...nel.org>,
	"Jason A. Donenfeld" <Jason@...c4.com>,
	Herbert Xu <herbert@...dor.apana.org.au>
Subject: [GIT PULL] AES-GCM optimizations for 6.19

The following changes since commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa:

  Linux 6.18-rc3 (2025-10-26 15:59:49 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git tags/aes-gcm-for-linus

for you to fetch changes up to 0e253e250ed0e46f5ff6962c840157da9dab48cd:

  crypto: x86/aes-gcm-vaes-avx2 - initialize full %rax return register (2025-11-03 09:07:57 -0800)

----------------------------------------------------------------

More optimizations and cleanups for the x86_64 AES-GCM code:

- Add a VAES+AVX2 optimized implementation of AES-GCM. This is very
  helpful on CPUs that have VAES but not AVX512, such as AMD Zen 3.

- Make the VAES+AVX512 optimized implementation of AES-GCM handle
  large amounts of associated data efficiently.

- Remove the "avx10_256" implementation of AES-GCM. It's superseded by
  the VAES+AVX2 optimized implementation.

- Rename the "avx10_512" implementation to "avx512".

Overall, this fills in a gap where AES-GCM wasn't fully optimized on
some recent CPUs. It also drops code that won't be as useful as
initially expected due to AVX10/256 being dropped from the AVX10 spec.

----------------------------------------------------------------
Eric Biggers (9):
      crypto: x86/aes-gcm - add VAES+AVX2 optimized code
      crypto: x86/aes-gcm - remove VAES+AVX10/256 optimized code
      crypto: x86/aes-gcm - rename avx10 and avx10_512 to avx512
      crypto: x86/aes-gcm - clean up AVX512 code to assume 512-bit vectors
      crypto: x86/aes-gcm - reorder AVX512 precompute and aad_update functions
      crypto: x86/aes-gcm - revise some comments in AVX512 code
      crypto: x86/aes-gcm - optimize AVX512 precomputation of H^2 from H^1
      crypto: x86/aes-gcm - optimize long AAD processing with AVX512
      crypto: x86/aes-gcm-vaes-avx2 - initialize full %rax return register

 arch/x86/crypto/Makefile                           |    5 +-
 arch/x86/crypto/aes-gcm-aesni-x86_64.S             |   12 +-
 arch/x86/crypto/aes-gcm-vaes-avx2.S                | 1146 ++++++++++++++++++++
 ...es-gcm-avx10-x86_64.S => aes-gcm-vaes-avx512.S} |  722 ++++++------
 arch/x86/crypto/aesni-intel_glue.c                 |  264 +++--
 5 files changed, 1663 insertions(+), 486 deletions(-)
 create mode 100644 arch/x86/crypto/aes-gcm-vaes-avx2.S
 rename arch/x86/crypto/{aes-gcm-avx10-x86_64.S => aes-gcm-vaes-avx512.S} (69%)