From patchwork Sun Oct 9 17:42:20 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 77408 Delivered-To: patch@linaro.org Received: by 10.140.97.247 with SMTP id m110csp928143qge; Sun, 9 Oct 2016 10:42:42 -0700 (PDT) X-Received: by 10.98.222.3 with SMTP id h3mr47159730pfg.168.1476034962106; Sun, 09 Oct 2016 10:42:42 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r5si16333080pap.347.2016.10.09.10.42.42; Sun, 09 Oct 2016 10:42:42 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=fail (p=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751991AbcJIRmk (ORCPT + 1 other); Sun, 9 Oct 2016 13:42:40 -0400 Received: from mail-lf0-f52.google.com ([209.85.215.52]:35450 "EHLO mail-lf0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751352AbcJIRmi (ORCPT ); Sun, 9 Oct 2016 13:42:38 -0400 Received: by mail-lf0-f52.google.com with SMTP id l131so84192308lfl.2 for ; Sun, 09 Oct 2016 10:42:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nUsx2xeqVT+9joaKdxem/Kts9QmLAXSRW8yBMpmO3Ls=; b=DQug4toetnLeDMWk7FLQPudgFIbk5nwB+HY9yIIyalSTfvAvdOFB8BWuvXojr1mCbS KNPxI/WIW0OlPDFCO4/pACSlXL627JSBmelk/J4igYDBNVAAsgMZCMB5J5k5uvMdleWf KJWTvXUUlxUuyofAx9NJDbd/SokXb2APP0ByA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nUsx2xeqVT+9joaKdxem/Kts9QmLAXSRW8yBMpmO3Ls=; b=VL6o1Gv6SZRipJ/ajwGhhAngJC/YW5/wpJ+a4moNTTFiQV7sVQpUHbEhn6KhaZj6VP rc93DQNCdW6kgzaGbnOkHlgCcpEfrl7lIeSAOKkzsKlPDr9Q7DuTVTmWY6ju8qGbkSEa gCTQG8B6pCjgZpPHsBqMVdv83AhTAYX02No542F+p2fVPlQrT375vc/zyA2dloGoHKrs wON3IwrWdhmxZevvQUo+x40OQN+qaasX9/Li3ztxUH12QBZnmM4t6g0FMIRyGESA7jmJ ncYY3HvEhNJt6yVDCVLEZbSudZpD86k7S6HJmkusIHyr7dpLBGg3LtM0Fg0XLL7fB4nK k98g== X-Gm-Message-State: AA6/9RkURtFZQ8Tty08IqseXMr5az9g5/+/XXoZmVLxIPzilMsPD7+UxOzH56WJcWnln6W55 X-Received: by 10.194.231.99 with SMTP id tf3mr24394661wjc.61.1476034956741; Sun, 09 Oct 2016 10:42:36 -0700 (PDT) Received: from localhost.localdomain ([45.218.219.19]) by smtp.gmail.com with ESMTPSA id uw3sm32503415wjb.21.2016.10.09.10.42.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 09 Oct 2016 10:42:36 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, herbert@gondor.apana.org.au Cc: catalin.marinas@arm.com, will.deacon@arm.com, Ard Biesheuvel Subject: [PATCH 1/6] crypto: arm64/aes-ce - fix for big endian Date: Sun, 9 Oct 2016 18:42:20 +0100 Message-Id: <1476034945-9186-2-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1476034945-9186-1-git-send-email-ard.biesheuvel@linaro.org> References: <1476034945-9186-1-git-send-email-ard.biesheuvel@linaro.org> Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org The core AES cipher implementation that uses ARMv8 Crypto Extensions instructions erroneously loads the round keys as 64-bit quantities, which causes the algorithm to fail when built for big endian. In addition, the key schedule generation routine fails to take endianness into account as well, when loading the combining the input key with the round constants. So fix both issues. Fixes: 12ac3efe74f8 ("arm64/crypto: use crypto instructions to generate AES key schedule") Signed-off-by: Ard Biesheuvel --- arch/arm64/crypto/aes-ce-cipher.c | 25 ++++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c index f7bd9bf0bbb3..50d9fe11d0c8 100644 --- a/arch/arm64/crypto/aes-ce-cipher.c +++ b/arch/arm64/crypto/aes-ce-cipher.c @@ -47,24 +47,24 @@ static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) kernel_neon_begin_partial(4); __asm__(" ld1 {v0.16b}, %[in] ;" - " ld1 {v1.2d}, [%[key]], #16 ;" + " ld1 {v1.16b}, [%[key]], #16 ;" " cmp %w[rounds], #10 ;" " bmi 0f ;" " bne 3f ;" " mov v3.16b, v1.16b ;" " b 2f ;" "0: mov v2.16b, v1.16b ;" - " ld1 {v3.2d}, [%[key]], #16 ;" + " ld1 {v3.16b}, [%[key]], #16 ;" "1: aese v0.16b, v2.16b ;" " aesmc v0.16b, v0.16b ;" - "2: ld1 {v1.2d}, [%[key]], #16 ;" + "2: ld1 {v1.16b}, [%[key]], #16 ;" " aese v0.16b, v3.16b ;" " aesmc v0.16b, v0.16b ;" - "3: ld1 {v2.2d}, [%[key]], #16 ;" + "3: ld1 {v2.16b}, [%[key]], #16 ;" " subs %w[rounds], %w[rounds], #3 ;" " aese v0.16b, v1.16b ;" " aesmc v0.16b, v0.16b ;" - " ld1 {v3.2d}, [%[key]], #16 ;" + " ld1 {v3.16b}, [%[key]], #16 ;" " bpl 1b ;" " aese v0.16b, v2.16b ;" " eor v0.16b, v0.16b, v3.16b ;" @@ -92,24 +92,24 @@ static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) kernel_neon_begin_partial(4); __asm__(" ld1 {v0.16b}, %[in] ;" - " ld1 {v1.2d}, [%[key]], #16 ;" + " ld1 {v1.16b}, [%[key]], #16 ;" " cmp %w[rounds], #10 ;" " bmi 0f ;" " bne 3f ;" " mov v3.16b, v1.16b ;" " b 2f ;" "0: mov v2.16b, v1.16b ;" - " ld1 {v3.2d}, [%[key]], #16 ;" + " ld1 {v3.16b}, [%[key]], #16 ;" "1: aesd v0.16b, v2.16b ;" " aesimc v0.16b, v0.16b ;" - "2: ld1 {v1.2d}, [%[key]], #16 ;" + "2: ld1 {v1.16b}, [%[key]], #16 ;" " aesd v0.16b, v3.16b ;" " aesimc v0.16b, v0.16b ;" - "3: ld1 {v2.2d}, [%[key]], #16 ;" + "3: ld1 {v2.16b}, [%[key]], #16 ;" " subs %w[rounds], %w[rounds], #3 ;" " aesd v0.16b, v1.16b ;" " aesimc v0.16b, v0.16b ;" - " ld1 {v3.2d}, [%[key]], #16 ;" + " ld1 {v3.16b}, [%[key]], #16 ;" " bpl 1b ;" " aesd v0.16b, v2.16b ;" " eor v0.16b, v0.16b, v3.16b ;" @@ -173,7 +173,12 @@ int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, u32 *rki = ctx->key_enc + (i * kwords); u32 *rko = rki + kwords; +#ifndef CONFIG_CPU_BIG_ENDIAN rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; +#else + rko[0] = rol32(aes_sub(rki[kwords - 1]), 8) ^ (rcon[i] << 24) ^ + rki[0]; +#endif rko[1] = rko[0] ^ rki[1]; rko[2] = rko[1] ^ rki[2]; rko[3] = rko[2] ^ rki[3];