mirror of
https://github.com/martijnvanbrummelen/nwipe.git
synced 2026-02-20 13:42:14 +00:00
5af773eaac
Problem
=======
The OpenSSL-based prelimininary, not yet committed userspace PRNG in nwipe
plateaued at ~250 MB/s, becoming the primary bottleneck when wiping modern
NVMe or RAID volumes that sustain gigabytes per second.
Solution
========
Replace the OpenSSL path with a kernel-accelerated AES-256-CTR generator that
streams 16 KiB keystream blocks through the AF_ALG “ctr(aes)” skcipher:
* Added aes_ctr_prng.cpp/.h
• Opens a per-thread AF_ALG operation socket once (lazy init).
• Builds a two-CMSG `sendmsg()` (ALG_SET_OP + ALG_SET_IV) and a single
`read()` per chunk – minimal syscall overhead.
• Public state (aes_ctr_state_t) intentionally remains 256 bit to preserve
ABI compatibility; socket FD is kept thread-local.
• Generates exactly 16 KiB per call, advancing an internal 128-bit counter.
* Comprehensive English comments explain every function, the ABI rationale and
the kernel interaction pattern.
Performance
-----------
On a Ryzen 9 7950X (VAES):
• Old OpenSSL path: ~260 MB/s
• New AF_ALG path : ~6.2 GB/s (≈ 24× faster, CPU-bound at ~7 % load)
Safety & Compatibility
----------------------
* Falls back automatically to the kernel’s software AES if AES-NI/VAES/SVE are
absent – no code changes required.
* No external dependencies beyond standard linux-headers.
* Optional `aes_ctr_prng_shutdown()` closes the FD, though the kernel would
reclaim it on exit anyway.
Testing
-------
* Added unit tests for counter wraparound and deterministic output with a
fixed seed (compared to OpenSSL reference vectors).
* Verified multi-threaded wiping on a 4 × NVMe RAID-0 → sustained device speed,
PRNG never starved the pipeline.
Future work
-----------
* Expose chunk size as a tunable CLI flag.
* Optionally copy keystream directly into the kernel’s page cache via `splice`.
Closes: #559 (Implement High-Quality Random Number Generation Using AES-CTR Mode with OpenSSL and AES-NI Support)
88 lines
2.6 KiB
Plaintext
88 lines
2.6 KiB
Plaintext
# -*- Autoconf -*-
|
|
# Process this file with autoconf to produce a configure script.
|
|
|
|
AC_PREREQ([2.63])
|
|
AC_INIT([nwipe],[0.38],[git@brumit.nl])
|
|
AM_INIT_AUTOMAKE(foreign subdir-objects)
|
|
AC_CONFIG_FILES([Makefile src/Makefile man/Makefile])
|
|
AC_OUTPUT
|
|
AC_CONFIG_SRCDIR([src/nwipe.c])
|
|
AC_CONFIG_HEADERS([config.h])
|
|
|
|
# Checks for programs.
|
|
AC_PROG_CC
|
|
AC_PROG_CXX
|
|
PKG_PROG_PKG_CONFIG
|
|
|
|
# Checks for libraries.
|
|
|
|
PKG_CHECK_MODULES(
|
|
[PANEL],
|
|
[panel],
|
|
[
|
|
CFLAGS="${CFLAGS} ${PANEL_CFLAGS}"
|
|
LIBS="${LIBS} ${PANEL_LIBS}"
|
|
],
|
|
[AC_CHECK_LIB([panel], [main], [
|
|
LIBS="-lpanel $LIBS"
|
|
AC_CHECK_HEADERS(panel.h,, [
|
|
AC_CHECK_HEADERS(ncurses/panel.h, [
|
|
AC_DEFINE([PANEL_IN_SUBDIR], [ncurses/], [Look for ncurses headers in subdir])
|
|
], [AC_MSG_ERROR([ncurses panel headers not found])])
|
|
])
|
|
], [AC_MSG_ERROR([ncurses panel library not found])])]
|
|
)
|
|
|
|
PKG_CHECK_MODULES(
|
|
[NCURSES],
|
|
[ncurses],
|
|
[
|
|
CFLAGS="${CFLAGS} ${NCURSES_CFLAGS}"
|
|
LIBS="${LIBS} ${NCURSES_LIBS}"
|
|
],
|
|
[AC_CHECK_LIB([ncurses], [delscreen], [
|
|
LIBS="-lncurses $LIBS"
|
|
AC_CHECK_HEADERS(ncurses.h,, [
|
|
AC_CHECK_HEADERS(ncurses/ncurses.h, [
|
|
AC_DEFINE([NCURSES_IN_SUBDIR], [ncurses/], [Look for ncurses headers in subdir])
|
|
], [AC_MSG_ERROR([ncurses headers not found])])
|
|
])
|
|
], [AC_MSG_ERROR([ncurses development library not found])]
|
|
)]
|
|
)
|
|
|
|
PKG_CHECK_MODULES(
|
|
[LIBCONFIG],
|
|
[libconfig],
|
|
[
|
|
CFLAGS="${CFLAGS} ${LIBCONFIG_CFLAGS}"
|
|
LIBS="${LIBS} ${LIBCONFIG_LIBS}"
|
|
],
|
|
[AC_CHECK_LIB([libconfig], [main], [
|
|
LIBS="-llibconfig $LIBS"
|
|
AC_CHECK_HEADERS(libconfig.h,, [
|
|
AC_CHECK_HEADERS(libconfig.h, [
|
|
AC_DEFINE([LIBCONFIG_IN_SUBDIR], [libconfig/], [Look for libconfig headers in subdir])
|
|
], [AC_MSG_ERROR([libconfig headers not found])])
|
|
])
|
|
], [AC_MSG_ERROR([libconfig library not found])])]
|
|
)
|
|
|
|
AC_CHECK_LIB([intl], [libintl_dgettext]) # needed to statically link libparted, but not given in its pkgconfig file
|
|
AC_CHECK_LIB([uuid], [uuid_generate]) # needed to statically link libparted, but not given in its pkgconfig file
|
|
PKG_CHECK_MODULES([PARTED], [libparted])
|
|
AC_CHECK_LIB([pthread], [main], ,[AC_MSG_ERROR([pthread development library not found])])
|
|
|
|
# Checks for header files.
|
|
AC_CHECK_HEADERS([libconfig.h fcntl.h inttypes.h netinet/in.h stddef.h stdint.h stdlib.h string.h sys/file.h sys/ioctl.h unistd.h])
|
|
|
|
# Checks for typedefs, structures, and compiler characteristics.
|
|
AC_TYPE_SIZE_T
|
|
AC_CHECK_MEMBERS([struct stat.st_blksize])
|
|
|
|
# Checks for library functions.
|
|
AC_FUNC_MALLOC
|
|
AC_CHECK_FUNCS([fdatasync memset regcomp strdup strerror])
|
|
|
|
AC_OUTPUT
|