crypto: arm64/aes-ce - deal with oversight in new CTR carry code
Subsystems (2)
PATCH 1/1 crypto: arm64/aes-ce - deal with oversight in new CTR carry code
The new carry handling code in the CTR driver can deal with a carry occurring in the 4x/5x parallel code path, by using a computed goto to jump into the carry sequence at the right place as to only apply the carry to a subset of the blocks being processed.
If the lower half of the counter wraps and ends up at exactly 0x0, a carry needs to be applied to the counter, but not to the counter values taken for the 4x/5x parallel sequence. In this case, the computed goto skips all register assignments, and branches straight to the jump instruction that gets us back to the fast path. This produces the correct result, but due to the fact that this branch target does not carry the correct BTI annotation, this fails when BTI is enabled.
Let's omit the computed goto entirely in this case, and jump straight back to the fast path after applying the carry to the main counter.
--- arch/arm64/crypto/aes-modes.S | 1 + 1 file changed, 1 insertion(+)
arch/arm64/crypto/aes-modes.S +1 -0
@@ -359,6 +359,7 @@ ST5( mov v4.16b, vctr.16b ) ins vctr.d[0], x8 /* apply carry to N counter blocks for N := x12 */ + cbz x12, 2f adr x16, 1f sub x16, x16, x12, lsl #3 br x16
Signature · 1 line
2.31.0.208.g409f899ff0-goog
Herbert Xu
maintainerQuoted 13 lines · Ard Biesheuvel
The new carry handling code in the CTR driver can deal with a carry occurring in the 4x/5x parallel code path, by using a computed goto to jump into the carry sequence at the right place as to only apply the carry to a subset of the blocks being processed.
If the lower half of the counter wraps and ends up at exactly
0x0, a carry needs to be applied to the counter, but not to the counter values taken for the 4x/5x parallel sequence. In this case, the computed goto skips all register assignments, and branches straight to the jump instruction that gets us back to the fast path. This produces the correct result, but due to the fact that this branch target does not carry the correct BTI annotation, this fails when BTI is enabled.
Quoted 8 lines
Let's omit the computed goto entirely in this case, and jump straight back to the fast path after applying the carry to the main counter.
Fixes 5318d3db465d ("crypto: arm64/aes-ctr - improve tail handling")Signed-off-by Ard Biesheuvel <[email protected]>--- arch/arm64/crypto/aes-modes.S | 1 + 1 file changed, 1 insertion(+)
Patch applied. Thanks.
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt