Cryptographic counters and events

The PAI facility provides counters for specific cryptographic instructions.

6.14 LPAR mode z/VM guest KVM guest

Listing the cryptographic counters

You can list the available cryptographic counters with the perf list command:

# perf list pmu | egrep -A500 '^pai'

pai:
  IBM_RESERVED1
       [Unit: pai_crypto IBM RESERVED1]
  IBM_RESERVED2
       [Unit: pai_crypto IBM RESERVED2]
  KDSA_ECDSA_SIGN_P256
       [Unit: pai_crypto KDSA ECDSA SIGN P256]
  KDSA_ECDSA_SIGN_P384
       [Unit: pai_crypto KDSA ECDSA SIGN P384]
  KDSA_ECDSA_SIGN_P521
       [Unit: pai_crypto KDSA ECDSA SIGN P521]
  ...

For more information about these counters, see z/Architecture® Principles of Operation, SA22-7832 for your hardware system. This reference manual uses hyphens (-) instead of underscore characters (_) in the counter names.

From Linux®, the counters are accessed through the perf_pai_crypto device driver. This device driver is compiled into the kernel. Apart from the hardware-supplied PAI counters, the perf_pai_crypto device driver provides the CRYPTO_ALL counter, which contains the sum of all PAI counters for cryptographic instructions.

You can list all available cryptographic counters by listing the sysfs attributes at /sys/devices/pai_crypto/events. For example, counter KDSA_ECDSA_SIGN_P256 is represented as /sys/devices/pai_crypto/events/KDSA_ECDSA_SIGN_P256.

Mapping names, event numbers, and counter numbers for cryptographic counters

The sysfs representation of a counter at /sys/devices/pai_crypto/events contains the counter's event number in hexadecimal notation. Subtract 0x1000 from the event number to obtain the counter number.

Example: The event number for counter KDSA_ECDSA_SIGN_P256 is 0x1084.

# cat /sys/devices/pai_crypto/events/KDSA_ECDSA_SIGN_P256
event=0x1084

Hence, the counter number is 0x1084 - 0x1000 = 0x84 in hexadecimal notation, or 132 in decimal notation.