Re: lib/crypto: AES-GCM x86 arch hooks: any plan?

[Eric Biggers <ebiggers@kernel.org>]

On Mon, Nov 09, 2026 at 04:47:05PM +0100, Antonio Quartulli wrote:
> Since the commit adding GCM to the library says the arch-optimized code
> will be migrated into it, do you already have work in progress for x86?
> 
> If not, we'd be happy to help there, or to test yours on Zen 5 with ovpn
> as a user.
> 
> One design question I have though: the VAES code needs the hash key
> powers H^16..H^1 (and H^8..H^1 for VAES-AVX2 / AES-NI), while the x86
> ghash_key only holds the PCLMUL state.
> 
> Would you rather extend struct ghash_key on x86, or have an
> arch-specific part in struct aes_gcm_key that aes_gcm_preparekey()
> fills when the arch code is usable?

I'm planning it.  I've just been trying to get other things out of the
way first.  If you're interested you can try to do it; just keep in mind
it will be quite a bit of work to do properly.

The tentative plan is to implement the GHASH and AES-GCM arch hooks that
lib/crypto/aes.c already has in place.  And yes, that would mean that
the x86 AES-GCM code would have to be reorganized to operate on struct
ghash_key (expanded to hold up to 16 key powers) and struct aes_enckey
rather than a combined struct.

That by itself may result in performance regressions on short messages,
though, as each AES-GCM operation would be broken up into multiple calls
to the arch code.  There likely will also need to be new hooks for
one-shot AES-GCM operations to handle them efficiently.

- Eric