DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

crypto: x86/aegis128 - access 32-bit arguments as 32-bit

Browse source 
[ Upstream commit 3b2f2d22fb424e9bebda4dbf6676cbfc7f9f62cd ]

Fix the AEGIS assembly code to access 'unsigned int' arguments as 32-bit
values instead of 64-bit, since the upper bits of the corresponding
64-bit registers are not guaranteed to be zero.

Note: there haven't been any reports of this bug actually causing
incorrect behavior.  Neither gcc nor clang guarantee zero-extension to
64 bits, but zero-extension is likely to happen in practice because most
instructions that operate on 32-bit registers zero-extend to 64 bits.

Fixes: 1d373d4e8e ("crypto: x86 - Add optimized AEGIS implementations")
Cc: stable@vger.kernel.org
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eric Biggers 2024-10-16 17:00:42 -07:00 • committed by Greg Kroah-Hartman
parent 7475e47200
commit eb30e6b51a
1 changed files with 15 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
arch/x86/crypto/aegis128-aesni-asm.S
View file

@ -20,7 +20,7 @@
#define T1 %xmm7
#define STATEP %rdi
#define LEN %rsi
#define LEN %esi
#define SRC %rdx
#define DST %rcx
@ -75,32 +75,32 @@ __load_partial:
xor %r9d, %r9d
pxor MSG, MSG
mov LEN, %r8
mov LEN, %r8d
and $0x1, %r8
jz .Lld_partial_1
mov LEN, %r8
mov LEN, %r8d
and $0x1E, %r8
add SRC, %r8
mov (%r8), %r9b
.Lld_partial_1:
mov LEN, %r8
mov LEN, %r8d
and $0x2, %r8
jz .Lld_partial_2
mov LEN, %r8
mov LEN, %r8d
and $0x1C, %r8
add SRC, %r8
shl $0x10, %r9
mov (%r8), %r9w
.Lld_partial_2:
mov LEN, %r8
mov LEN, %r8d
and $0x4, %r8
jz .Lld_partial_4
mov LEN, %r8
mov LEN, %r8d
and $0x18, %r8
add SRC, %r8
shl $32, %r9
@ -110,11 +110,11 @@ __load_partial:
.Lld_partial_4:
movq %r9, MSG
mov LEN, %r8
mov LEN, %r8d
and $0x8, %r8
jz .Lld_partial_8
mov LEN, %r8
mov LEN, %r8d
and $0x10, %r8
add SRC, %r8
pslldq $8, MSG
@ -138,7 +138,7 @@ ENDPROC(__load_partial)
* %r10
*/
__store_partial:
mov LEN, %r8
mov LEN, %r8d
mov DST, %r9
movq T0, %r10
@ -676,7 +676,7 @@ ENTRY(crypto_aegis128_aesni_dec_tail)
call __store_partial
/* mask with byte count: */
movq LEN, T0
movd LEN, T0
punpcklbw T0, T0
punpcklbw T0, T0
punpcklbw T0, T0
@ -701,7 +701,8 @@ ENDPROC(crypto_aegis128_aesni_dec_tail)
/*
* void crypto_aegis128_aesni_final(void *state, void *tag_xor,
* u64 assoclen, u64 cryptlen);
* unsigned int assoclen,
* unsigned int cryptlen);
*/
ENTRY(crypto_aegis128_aesni_final)
FRAME_BEGIN
@ -714,8 +715,8 @@ ENTRY(crypto_aegis128_aesni_final)
movdqu 0x40(STATEP), STATE4
/* prepare length block: */
movq %rdx, MSG
movq %rcx, T0
movd %edx, MSG
movd %ecx, T0
pslldq $8, T0
pxor T0, MSG
psllq $3, MSG /* multiply by 8 (to get bit count) */