Re: [PATCH 2/2] target/arm: Implement an IMPDEF pauth algorithm

[Alex Bennée]

Richard Henderson <richard.henderson@linaro.org> writes:

> On 8/12/20 2:49 AM, Alex Bennée wrote:
>> 
>> Richard Henderson <richard.henderson@linaro.org> writes:
>> 
>>> Without hardware acceleration, a cryptographically strong
>>> algorithm is too expensive for pauth_computepac.
>>>
>>> Even with hardware accel, we are not currently expecting
>>> to link the linux-user binaries to any crypto libraries,
>>> and doing so would generally make the --static build fail.
>>>
>>> So choose XXH64 as a reasonably quick and decent hash.
>>>
>>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>>> ---
>>>  target/arm/pauth_helper.c | 75 ++++++++++++++++++++++++++++++++++++---
>>>  1 file changed, 70 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
>>> index 6dbab03768..f1a4389465 100644
>>> --- a/target/arm/pauth_helper.c
>>> +++ b/target/arm/pauth_helper.c
>>> @@ -207,8 +207,8 @@ static uint64_t tweak_inv_shuffle(uint64_t i)
>>>      return o;
>>>  }
>>>  
>>> -static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
>>> -                                 ARMPACKey key)
>>> +static uint64_t __attribute__((noinline))
>>> +pauth_computepac_architected(uint64_t data, uint64_t modifier, ARMPACKey 
>>> key)
>>>  {
>>>      static const uint64_t RC[5] = {
>>>          0x0000000000000000ull,
>>> @@ -272,6 +272,71 @@ static uint64_t pauth_computepac(uint64_t data, 
>>> uint64_t modifier,
>>>      return workingval;
>>>  }
>>>  
>>> +/*
>>> + * The XXH64 algorithm from
>>> + * https://github.com/Cyan4973/xxHash/blob/v0.8.0/xxhash.h
>>> + */
>>> +#define PRIME64_1   0x9E3779B185EBCA87ULL
>>> +#define PRIME64_2   0xC2B2AE3D27D4EB4FULL
>>> +#define PRIME64_3   0x165667B19E3779F9ULL
>>> +#define PRIME64_4   0x85EBCA77C2B2AE63ULL
>>> +#define PRIME64_5   0x27D4EB2F165667C5ULL
>>> +
>>> +static inline uint64_t XXH64_round(uint64_t acc, uint64_t input)
>>> +{
>>> +    return rol64(acc + input * PRIME64_2, 31) * PRIME64_1;
>>> +}
>>> +
>>> +static inline uint64_t XXH64_mergeround(uint64_t acc, uint64_t val)
>>> +{
>>> +    return (acc ^ XXH64_round(0, val)) * PRIME64_1 + PRIME64_4;
>>> +}
>>> +
>>> +static inline uint64_t XXH64_avalanche(uint64_t h64)
>>> +{
>>> +    h64 ^= h64 >> 33;
>>> +    h64 *= PRIME64_2;
>>> +    h64 ^= h64 >> 29;
>>> +    h64 *= PRIME64_3;
>>> +    /* h64 ^= h64 >> 32; -- does not affect high 64 for pauth */
>>> +    return h64;
>>> +}
>>> +
>>> +static uint64_t __attribute__((noinline))
>>> +pauth_computepac_impdef(uint64_t data, uint64_t modifier, ARMPACKey key)
>>> +{
>>> +    uint64_t v1 = 1 + PRIME64_1 + PRIME64_2;
>>> +    uint64_t v2 = 1 + PRIME64_2;
>>> +    uint64_t v3 = 1 + 0;
>>> +    uint64_t v4 = 1 - PRIME64_1;
>>> +    uint64_t h64;
>>> +
>>> +    v1 = XXH64_round(v1, data);
>>> +    v2 = XXH64_round(v2, modifier);
>>> +    v3 = XXH64_round(v3, key.lo);
>>> +    v4 = XXH64_round(v4, key.hi);
>>> +
>>> +    h64 = rol64(v1, 1) + rol64(v2, 7) + rol64(v3, 12) + rol64(v4, 18);
>>> +    h64 = XXH64_mergeround(h64, v1);
>>> +    h64 = XXH64_mergeround(h64, v2);
>>> +    h64 = XXH64_mergeround(h64, v3);
>>> +    h64 = XXH64_mergeround(h64, v4);
>>> +
>>> +    return XXH64_avalanche(h64);
>>> +}
>> 
>> You might find it easier to #include "qemu/xxhash.h" which we use for tb
>> hashing amongst other things.  
>
> First, that's the 32-bit version, XXH32.

Ahh I missed that detail.

> Second, we define xxhash7 there; we would need xxhash8 here.

We could at least put the code in the header with the others.

>
>
> r~


-- 
Alex Bennée