GeezerVison is showing github.com — CryptoPkg: Enable Openssl native instruction support for AARCH64 by pierregondois · Pull Request #5977 · tianocore/edk2
Conversation
Description
CryptoPkg: Enable Openssl native instruction support for AARCH64
Various OpensslLib implementations are available in edk2. The
OpensslLibAccel.inf and OpensslLibFullAccel.inf ones use
architecture specific instructions, e.g. AESE, PMULL, SHA256H, ...,
allowing to improve speed.
Enable support for Aarch64's native instructions:
- Add ArmReadCntPctReg() and ArmReadIdAA64Isar0Reg() to
Aarch64's BaseLib.
- Generate Aarch64's specific Openssl functions.
- Add a OpensslStub/AArch64Cap.c file to allow Openssl
to probe Aarch64 native instruction support.
This patch-set only enable support for GCC for now (MSFT support
not added).
- Breaking change?
- Breaking change - Does this PR cause a break in build or boot behavior?
- Examples: Does it add a new library class or move a module to a different repo.
- Impacts security?
- Security - Does this PR have a direct security impact?
- Examples: Crypto algorithm change or buffer overflow fix.
- Includes tests?
- Tests - Does this PR include any explicit test code?
- Examples: Unit tests or integration tests.
How This Was Tested
The tests run are based on the TestBaseCryptLibShell module.
Each test is run 100 times, then the first 5 values
(considered as warmup) are removed.
The NoAccel column relies on the OpensslLibFull implementation,
the Accel column relies on the OpensslLibFullAccel implementation.
The 'Improvement' column is computed as:
100 * ('Accel (ns)' - 'NoAccel (ns)') / 'NoAccel (ns)'
The std deviation of the TestVerifyDhGenerateKey is big.
It is due to [1] being called with the 'safe' parameter set, leading
to the prime number taking more time to generate. It requires ~10
iterations when safe=false, ~1000 iterations when safe=true.
The test was run on a Juno-r2. The native Openssl implementation makes
use of the following features (cf. [2]):
- ARMV7_NEON
- ARMV8_AES
- ARMV8_SHA1
- ARMV8_PMULL
- ARMV8_SHA256
and misses:
Note that in order to run the test without exiting too early and actually
see an improvement in the running time, the UT_ASSERT_* macros were bypassed.
See the attached file for the result.
openssl_native_aarch64.txt
Integration Instructions
N/A
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
pierregondois
changed the title
dummy -- Pg/openssl native aarch64
CryptoPkg: Enable Openssl native instruction support for AARCH64
Jul 26, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CryptoPkg part looks good to me.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
To enable AARCH64 native instruction support for Openssl,
some interfaces must be implemented. OPENSSL_rdtsc() requests
an access to a counter to get some non-trusted entropy.
Add ArmReadCntPctReg() to read system count.
A similar ArmReadCntPct() function is available in the ArmPkg,
but the CryptoPkg where OPENSSL_rdtsc will reside cannot rely
on the ArmPkg.
Signed-off-by: Pierre Gondois <[email protected]>
To enable AARCH64 native instruction support for Openssl,
some interfaces must be implemented. OPENSSL_cpuid_setup()
allows to probe the supported features of the platform.
Add ArmReadIdAA64Isar0Reg() to read the AA64Isar0, containing
Arm64 instruction capabilities.
A similar ArmReadIdAA64Isar0() function is available in the ArmPkg,
but the CryptoPkg where OPENSSL_cpuid_setup will reside cannot rely
on the ArmPkg.
Signed-off-by: Pierre Gondois <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
A ArmReadIdAA64Isar0Reg() function was recently added
to BaseLib. Use it instead of its ArmReadIdIsar0() equivalent,
which was private to the BaseRngLib library.
This also allows to avoid the confusion between the following
registers:
- ID_ISAR0_EL1: allows to probe for Divide instructions, Debug
instructions, ...
- ID_AA64ISAR0_EL1: AARCH64 specific register allowing to probe
for AESE, RNDR, ... instructions
Signed-off-by: Pierre Gondois <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Add native instruction support for AARCH64.
Signed-off-by: Pierre Gondois <[email protected]>
Generate AARCH64 related files and update .inf files,
running:
python CryptoPkg/Library/OpensslLib/configure.py
Signed-off-by: Pierre Gondois <[email protected]>
Add AARCH64 specific implementations of:
- OPENSSL_cpuid_setup(), probing hardware capabilitie
(presence of FEAT_AES, etc.)
- OPENSSL_rdtsc(), returning non-trusted entropy by accessing
system counter.
Signed-off-by: Pierre Gondois <[email protected]>
Enable the following modules builds for AARCH64:
- OpensslLibAccel.inf
- OpensslLibFullAccel.inf
Signed-off-by: Pierre Gondois <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Labels
impact:security
This change has a direct security impact such as changing a crypto algorithm.
push
Auto push patch series in PR if all checks pass
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|