Skip to content

L
linux
Switch branch/tag
  1. 30 Aug, 2024 14 commits
  3. 24 Aug, 2024 19 commits
  5. 17 Aug, 2024 7 commits
    • Kuan-Wei Chiu's avatar
      crypto: octeontx2 - Remove custom swap functions in favor of built-in sort swap · 8e84a650
      Kuan-Wei Chiu authored 
      The custom swap functions used in octeontx2 driver do not perform any
special operations and can be replaced with the built-in swap function
of sort. This change not only reduces code size but also improves
efficiency, especially in scenarios where CONFIG_RETPOLINE is enabled,
as it makes indirect function calls more expensive.

By using the built-in swap, we avoid these costly indirect function
calls, leading to better performance.
Signed-off-by: default avatarKuan-Wei Chiu <visitorckw@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      8e84a650
    • Kuan-Wei Chiu's avatar
      crypto: octeontx - Remove custom swap function in favor of built-in sort swap · a304393a
      Kuan-Wei Chiu authored 
      The custom swap function used in octeontx driver do not perform any
special operations and can be replaced with the built-in swap function
of sort. This change not only reduces code size but also improves
efficiency, especially in scenarios where CONFIG_RETPOLINE is enabled,
as it makes indirect function calls more expensive.

By using the built-in swap, we avoid these costly indirect function
calls, leading to better performance.
Signed-off-by: default avatarKuan-Wei Chiu <visitorckw@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      a304393a
    • Herbert Xu's avatar
      crypto: rsa - Check MPI allocation errors · 5a72a244
      Herbert Xu authored 
      Fixes: 6637e11e ("crypto: rsa - allow only odd e and restrict value in FIPS mode")
Fixes: f145d411 ("crypto: rsa - implement Chinese Remainder Theorem for faster private key operation")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      5a72a244
    • Herbert Xu's avatar
      crypto: dh - Check mpi_rshift errors · 560efa7f
      Herbert Xu authored 
      Now that mpi_rshift can return errors, check them.

Fixes: 35d2bf20 ("crypto: dh - calculate Q from P for the full public key verification")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      560efa7f
    • Herbert Xu's avatar
      crypto: lib/mpi - Add error checks to extension · 8e3a67f2
      Herbert Xu authored 
      The remaining functions added by commit
a8ea8bdd did not check for memory
allocation errors.  Add the checks and change the API to allow errors
to be returned.

Fixes: a8ea8bdd ("lib/mpi: Extend the MPI library")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      8e3a67f2
    • Herbert Xu's avatar
      Revert "lib/mpi: Extend the MPI library" · fca5cb4d
      Herbert Xu authored 
      This partially reverts commit a8ea8bdd.

Most of it is no longer needed since sm2 has been removed.  However,
the following functions have been kept as they have developed other
uses:

mpi_copy

mpi_mod

mpi_test_bit
mpi_set_bit
mpi_rshift

mpi_add
mpi_sub
mpi_addm
mpi_subm

mpi_mul
mpi_mulm

mpi_tdiv_r
mpi_fdiv_r
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      fca5cb4d
    • Eric Biggers's avatar
      crypto: arm/aes-neonbs - go back to using aes-arm directly · f235bc11
      Eric Biggers authored 
      In aes-neonbs, instead of going through the crypto API for the parts
that the bit-sliced AES code doesn't handle, namely AES-CBC encryption
and single-block AES, just call the ARM scalar AES cipher directly.

This basically goes back to the original approach that was used before
commit b56f5cbc ("crypto: arm/aes-neonbs - resolve fallback cipher
at runtime").  Calling the ARM scalar AES cipher directly is faster,
simpler, and avoids any chance of bugs specific to the use of fallback
ciphers such as module loading deadlocks which have happened twice.  The
deadlocks turned out to be fixable in other ways, but there's no need to
rely on anything so fragile in the first place.

The rationale for the above-mentioned commit was to allow people to
choose to use a time-invariant AES implementation for the fallback
cipher.  There are a couple problems with that rationale, though:

- In practice the ARM scalar AES cipher (aes-arm) was used anyway, since
  it has a higher priority than aes-fixed-time.  Users *could* go out of
  their way to disable or blacklist aes-arm, or to lower its priority
  using NETLINK_CRYPTO, but very few users customize the crypto API to
  this extent.  Systems with the ARMv8 Crypto Extensions used aes-ce,
  but the bit-sliced algorithms are irrelevant on such systems anyway.

- Since commit 913a3aa0 ("crypto: arm/aes - add some hardening
  against cache-timing attacks"), the ARM scalar AES cipher is partially
  hardened against cache-timing attacks.  It actually works like
  aes-fixed-time, in that it disables interrupts and prefetches its
  lookup table.  It does use a larger table than aes-fixed-time, but
  even so, it is not clear that aes-fixed-time is meaningfully more
  time-invariant than aes-arm.  And of course, the real solution for
  time-invariant AES is to use a CPU that supports AES instructions.
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      f235bc11
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7