summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-09-06crypto: hisilicon - fix missed error branchYang Shen
If an error occurs in the process after the SGL is mapped successfully, it need to unmap the SGL. Otherwise, memory problems may occur. Signed-off-by: Yang Shen <shenyang39@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-09-06crypto: ccp - do not request interrupt on cmd completion when irqs disabledAmit Shah
While sending a command to the PSP, we always requested an interrupt from the PSP after command completion. This worked for most cases. For the special case of irqs being disabled -- e.g. when running within crashdump or kexec contexts, we should not set the SEV_CMDRESP_IOC flag, so the PSP knows to not attempt interrupt delivery. Fixes: 8ef979584ea8 ("crypto: ccp: Add panic notifier for SEV/SNP firmware shutdown on kdump") Based-on-patch-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Amit Shah <amit.shah@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-09-06crypto: x86/aesni - update docs for aesni-intel moduleEric Biggers
Update the kconfig help and module description to reflect that VAES instructions are now used in some cases. Also fix XTR => XCTR. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-09-06hwrng: mtk - Use devm_pm_runtime_enableGuoqing Jiang
Replace pm_runtime_enable with the devres-enabled version which can trigger pm_runtime_disable. Otherwise, the below appears during reload driver. mtk_rng 1020f000.rng: Unbalanced pm_runtime_enable! Fixes: 81d2b34508c6 ("hwrng: mtk - add runtime PM support") Cc: <stable@vger.kernel.org> Suggested-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-09-04Revert "crypto: spacc - Add SPAcc Skcipher support"Herbert Xu
This reverts the following commits: 87a3fcf5fec5fb59ec8f23d12a56bcf2b2ee6db7 58bf99100a6dfcc53ba4ab547f1394bb6873b2ac 3b1c9df662915a18a86f1a88364ee70875ed3b44 8bc1bfa02e37d63632f0cb65543e3e71acdccafb c32f08d024e275059474b3c11c1fc2bc7f2de990 f036dd566453176d4eafb9701ebd69e7e59d6707 c76c9ec333432088a1c6f52650c149530fc5df5d 5d22d37aa8b93efaad797faf80db40ea59453481 b63483b37e813299445d2719488acab2b3f20544 2d6213bd592b4731b53ece3492f9d1d18e97eb5e fc61c658c94cb7405ca6946d8f2a2b71cef49845 cb67c924b2a7b561bd7f4f2bd66766337c1007b7 06af76b46c78f4729fe2f9712a74502c90d87554 9f1a7ab4d31ef30fbf8adb0985300049469f2270 8ebb14deef0f374f7ca0d34a1ad720ba0a7b79f3 c8981d9230d808e62c65349d0b255c7f4b9087d6 They were submitted with no device tree bindings. Reported-by: Rob Herring <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: hisilicon/zip - Optimize performance by replacing rw_lock with spinlockKuan-Wei Chiu
The req_lock is currently implemented as a rw_lock, but there are no instances where read_lock() is called. This means that the lock is effectively only used by writers, making it functionally equivalent to a simple spinlock. As stated in Documentation/locking/spinlocks.rst: "Reader-writer locks require more atomic memory operations than simple spinlocks. Unless the reader critical section is long, you are better off just using spinlocks." Since the rw_lock in this case incurs additional atomic memory operations without any benefit from reader-writer locking, it is more efficient to replace it with a spinlock. This patch implements that replacement to optimize the driver's performance. Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: img-hash - use devm_clk_get_enabled() helpersChunhai Guo
Simplify the code by replacing devm_clk_get() and clk_prepare_enable() with devm_clk_get_enabled(), which also avoids the call to clk_disable_unprepare(). Signed-off-by: Chunhai Guo <guochunhai@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: atmel - use devm_clk_get_prepared() helpersChunhai Guo
Simplify the code by replacing devm_clk_get() and clk_prepare() with devm_clk_get_prepared(), which also avoids the call to clk_unprepare(). Signed-off-by: Chunhai Guo <guochunhai@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30padata: Honor the caller's alignment in case of chunk_size 0Kamlesh Gurudasani
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment. Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored. While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability. Fixes: 6d45e1c948a8 ("padata: Fix possible divide-by-0 panic in padata_mt_helper()") Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com> Acked-by:  Waiman Long <longman@redhat.com> Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30dt-bindings: crypto: fsl,sec-v4.0: add second register space for rticFrank Li
Add two description for register space of rtic. There are two register space, one is for control and status, the other optional space is recoverable error indication register space. Fix below CHECK_DTBS error: arch/arm64/boot/dts/freescale/fsl-ls1012a-frdm.dtb: crypto@1700000: rtic@60000:reg: [[393216, 256], [396800, 24]] is too long from schema $id: http://devicetree.org/schemas/crypto/fsl,sec-v4.0.yaml# Signed-off-by: Frank Li <Frank.Li@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30hwrng: rockchip - handle devm_pm_runtime_enable errorsMartin Kaiser
It's unlikely that devm_pm_runtime_enable ever fails. Still, it makes sense to read the return value and handle errors. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30hwrng: rockchip - rst is used only during probeMartin Kaiser
The driver uses the rst variable only for an initial reset when the chip is probed. There's no need to store rst in the driver's private data, we can make it a local variable in the probe function. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30hwrng: mxc-rnga - Use devm_clk_get_enabled() helpersHuan Yang
The devm_clk_get_enabled() helpers: - call devm_clk_get() - call clk_prepare_enable() and register what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the calls to clk_disable_unprepare(). Signed-off-by: Huan Yang <link@vivo.com> Reviewed-by: Martin Kaiser <martin@kaiser.cx> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: crypto4xx - Remove unused declaration crypto4xx_free_ctx()Yue Haibing
This function is never implemented and used since introduction in commit 049359d65527 ("crypto: amcc - Add crypt4xx driver"). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: amlogic - Remove unused declaration meson_enqueue()Yue Haibing
This function is never implemented and used since introduction in commit 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL"). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: ccp - Remove unused declaration sp_get_master()Yue Haibing
This function is never implemented and used since introduction in commit 720419f01832 ("crypto: ccp - Introduce the AMD Secure Processor device"). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: octeontx - Remove unused declaration otx_cpt_callback()Yue Haibing
This function is never implemented and used since introduction in commit 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT") Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: sl3516 - Remove unused declaration sl3516_ce_enqueue()Yue Haibing
This function is never implemented and used since introduction in commit 46c5338db7bd ("crypto: sl3516 - Add sl3516 crypto engine") Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: safexcel - Remove unused declaration safexcel_ring_first_rptr()Yue Haibing
Commit 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance") declar this but never implemented. Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: tools/ccp - Remove unused variableZhu Jun
the variable is never referenced in the code, just remove them. Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: jitter - Use min() to simplify jent_read_entropy()Thorsten Blum
Use the min() macro to simplify the jent_read_entropy() function and improve its readability. Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-30crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failurePavan Kumar Paluri
In case of sev PLATFORM_STATUS failure, sev_get_api_version() fails resulting in sev_data field of psp_master nulled out. This later becomes a problem when unloading the ccp module because the device has not been unregistered (via misc_deregister()) before clearing the sev_data field of psp_master. As a result, on reloading the ccp module, a duplicate device issue is encountered as can be seen from the dmesg log below. on reloading ccp module via modprobe ccp Call Trace: <TASK> dump_stack_lvl+0xd7/0xf0 dump_stack+0x10/0x20 sysfs_warn_dup+0x5c/0x70 sysfs_create_dir_ns+0xbc/0xd kobject_add_internal+0xb1/0x2f0 kobject_add+0x7a/0xe0 ? srso_alias_return_thunk+0x5/0xfbef5 ? get_device_parent+0xd4/0x1e0 ? __pfx_klist_children_get+0x10/0x10 device_add+0x121/0x870 ? srso_alias_return_thunk+0x5/0xfbef5 device_create_groups_vargs+0xdc/0x100 device_create_with_groups+0x3f/0x60 misc_register+0x13b/0x1c0 sev_dev_init+0x1d4/0x290 [ccp] psp_dev_init+0x136/0x300 [ccp] sp_init+0x6f/0x80 [ccp] sp_pci_probe+0x2a6/0x310 [ccp] ? srso_alias_return_thunk+0x5/0xfbef5 local_pci_probe+0x4b/0xb0 work_for_cpu_fn+0x1a/0x30 process_one_work+0x203/0x600 worker_thread+0x19e/0x350 ? __pfx_worker_thread+0x10/0x10 kthread+0xeb/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> kobject: kobject_add_internal failed for sev with -EEXIST, don't try to register things with the same name in the same directory. ccp 0000:22:00.1: sev initialization failed ccp 0000:22:00.1: psp initialization failed ccp 0000:a2:00.1: no command queues available ccp 0000:a2:00.1: psp enabled Address this issue by unregistering the /dev/sev before clearing out sev_data in case of PLATFORM_STATUS failure. Fixes: 200664d5237f ("crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support") Cc: stable@vger.kernel.org Signed-off-by: Pavan Kumar Paluri <papaluri@amd.com> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: simd - Do not call crypto_alloc_tfm during registrationHerbert Xu
Algorithm registration is usually carried out during module init, where as little work as possible should be carried out. The SIMD code violated this rule by allocating a tfm, this then triggers a full test of the algorithm which may dead-lock in certain cases. SIMD is only allocating the tfm to get at the alg object, which is in fact already available as it is what we are registering. Use that directly and remove the crypto_alloc_tfm call. Also remove some obsolete and unused SIMD API. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: api - Do not wait for tests during registrationHerbert Xu
As registration is usually carried out during module init, this is a context where as little work as possible should be carried out. Testing may trigger module loads of underlying components, which could even lead back to the module that is registering at the moment. This may lead to dead-locks outside of the Crypto API. Avoid this by not waiting for the tests to complete. They will be scheduled but completion will be asynchronous. Any users will still wait for completion. Reported-by: Russell King <linux@armlinux.org.uk> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: api - Remove instance larval fulfilmentHerbert Xu
In order to allow testing to complete asynchronously after the registration process, instance larvals need to complete prior to having a test result. Support this by redoing the lookup for instance larvals after completion. This should locate the pending test larval and then repeat the wait on that (if it is still pending). As the lookup is now repeated there is no longer any need to compute the fulfilment status and all that code can be removed. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: octeontx2 - Fix authenc setkeyHerbert Xu
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm). Finally accept all hash key lengths by running the digest over extra-long keys. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: octeontx - Fix authenc setkeyHerbert Xu
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm). Finally accept all hash key lengths by running the digest over extra-long keys. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fixed return to CRYPTO_OKPavitrakumar M
Removed CRYPTO_USED_JB and returning CRYPTO_OK instead. Signed-off-by: Bhoomika K <bhoomikak@vayavyalabs.com> Signed-off-by: Pavitrakumar M <pavitrakumarm@vayavyalabs.com> Acked-by: Ruud Derwig <Ruud.Derwig@synopsys.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fix counter width checksPavitrakumar M
This patch fixes counter width checks according to the version extension3 register. The counter widths can be 8, 16, 32 and 64 bits as per the extension3 register. Signed-off-by: Bhoomika K <bhoomikak@vayavyalabs.com> Signed-off-by: Pavitrakumar M <pavitrakumarm@vayavyalabs.com> Acked-by: Ruud Derwig <Ruud.Derwig@synopsys.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: qat - fix "Full Going True" macro definitionSvyatoslav Pankratov
The macro `ADF_RP_INT_SRC_SEL_F_RISE_MASK` is currently set to the value `0100b` which means "Empty Going False". This might cause an incorrect restore of the bank state during live migration. Fix the definition of the macro to properly represent the "Full Going True" state which is encoded as `0011b`. Fixes: bbfdde7d195f ("crypto: qat - add bank save and restore flows") Signed-off-by: Svyatoslav Pankratov <svyatoslav.pankratov@intel.com> Reviewed-by: Xin Zeng <xin.zeng@intel.com> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Check for allocation failure in spacc_skcipher_fallback()Dan Carpenter
Check for crypto_alloc_skcipher() failure. Fixes: c8981d9230d8 ("crypto: spacc - Add SPAcc Skcipher support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fix NULL vs IS_ERR() check in spacc_aead_fallback()Dan Carpenter
The crypto_alloc_aead() function doesn't return NULL pointers, it returns error pointers. Fix the error checking. Fixes: 06af76b46c78 ("crypto: spacc - Add SPAcc aead support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fix uninitialized variable in spacc_aead_process()Dan Carpenter
Smatch complains that: drivers/crypto/dwc-spacc/spacc_aead.c:1031 spacc_aead_process() error: uninitialized symbol 'ptaadsize'. This could happen if, for example, tctx->mode was CRYPTO_MODE_NULL and req->cryptlen was less than icvremove. Fixes: 06af76b46c78 ("crypto: spacc - Add SPAcc aead support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Use crypto_authenc_extractkeysHerbert Xu
Use the crypto_authenc_extractkeys helper rather than ad-hoc parsing. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Add a new line in spacc_open()Dan Carpenter
Put the break statement should be on its own line. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fix off by one in spacc_isenabled()Dan Carpenter
The spacc->config.modes[] array has CRYPTO_MODE_LAST number of elements so this > comparison should be >= to prevent an out of bounds access. Fixes: c8981d9230d8 ("crypto: spacc - Add SPAcc Skcipher support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: spacc - Fix bounds checking on spacc->job[]Dan Carpenter
This bounds checking is off by one. The > should be >=. The spacc->job[] array is allocated in spacc_init() and it has SPACC_MAX_JOBS elements. Fixes: 8ebb14deef0f ("crypto: spacc - Enable SPAcc AUTODETECT") Fixes: c8981d9230d8 ("crypto: spacc - Add SPAcc Skcipher support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: ccp - Add additional information about an SEV firmware upgradeTom Lendacky
Print additional information, in the form of the old and new versions of the SEV firmware, so that it can be seen what the base firmware was before the upgrade. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Ashish Kalra <ashish.kalra@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: x86/sha256 - Add parentheses around macros' single argumentsFangrui Song
The macros FOUR_ROUNDS_AND_SCHED and DO_4ROUNDS rely on an unexpected/undocumented behavior of the GNU assembler, which might change in the future (https://sourceware.org/bugzilla/show_bug.cgi?id=32073). M (1) (2) // 1 arg !? Future: 2 args M 1 + 2 // 1 arg !? Future: 3 args M 1 2 // 2 args Add parentheses around the single arguments to support future GNU assembler and LLVM integrated assembler (when the IsOperator hack from the following link is dropped). Link: https://github.com/llvm/llvm-project/commit/055006475e22014b28a070db1bff41ca15f322f0 Signed-off-by: Fangrui Song <maskray@google.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: keembay - fix module autoloadingLiao Chen
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen <liaochen4@huawei.com> Acked-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-24crypto: jitter - set default OSR to 3Stephan Mueller
The user space Jitter RNG library uses the oversampling rate of 3 which implies that each time stamp is credited with 1/3 bit of entropy. To obtain 256 bits of entropy, 768 time stamps need to be sampled. The increase in OSR is applied based on a report where the Jitter RNG is used on a system exhibiting a challenging environment to collect entropy. This OSR default value is now applied to the Linux kernel version of the Jitter RNG as well. The increase in the OSR from 1 to 3 also implies that the Jitter RNG is now slower by default. Reported-by: Jeff Barnes <jeffbarnes@microsoft.com> Signed-off-by: Stephan Mueller <smueller@chronox.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: octeontx2 - Remove custom swap functions in favor of built-in sort swapKuan-Wei Chiu
The custom swap functions used in octeontx2 driver do not perform any special operations and can be replaced with the built-in swap function of sort. This change not only reduces code size but also improves efficiency, especially in scenarios where CONFIG_RETPOLINE is enabled, as it makes indirect function calls more expensive. By using the built-in swap, we avoid these costly indirect function calls, leading to better performance. Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: octeontx - Remove custom swap function in favor of built-in sort swapKuan-Wei Chiu
The custom swap function used in octeontx driver do not perform any special operations and can be replaced with the built-in swap function of sort. This change not only reduces code size but also improves efficiency, especially in scenarios where CONFIG_RETPOLINE is enabled, as it makes indirect function calls more expensive. By using the built-in swap, we avoid these costly indirect function calls, leading to better performance. Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: rsa - Check MPI allocation errorsHerbert Xu
Fixes: 6637e11e4ad2 ("crypto: rsa - allow only odd e and restrict value in FIPS mode") Fixes: f145d411a67e ("crypto: rsa - implement Chinese Remainder Theorem for faster private key operation") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: dh - Check mpi_rshift errorsHerbert Xu
Now that mpi_rshift can return errors, check them. Fixes: 35d2bf20683f ("crypto: dh - calculate Q from P for the full public key verification") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: lib/mpi - Add error checks to extensionHerbert Xu
The remaining functions added by commit a8ea8bdd9df92a0e5db5b43900abb7a288b8a53e did not check for memory allocation errors. Add the checks and change the API to allow errors to be returned. Fixes: a8ea8bdd9df9 ("lib/mpi: Extend the MPI library") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17Revert "lib/mpi: Extend the MPI library"Herbert Xu
This partially reverts commit a8ea8bdd9df92a0e5db5b43900abb7a288b8a53e. Most of it is no longer needed since sm2 has been removed. However, the following functions have been kept as they have developed other uses: mpi_copy mpi_mod mpi_test_bit mpi_set_bit mpi_rshift mpi_add mpi_sub mpi_addm mpi_subm mpi_mul mpi_mulm mpi_tdiv_r mpi_fdiv_r Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: arm/aes-neonbs - go back to using aes-arm directlyEric Biggers
In aes-neonbs, instead of going through the crypto API for the parts that the bit-sliced AES code doesn't handle, namely AES-CBC encryption and single-block AES, just call the ARM scalar AES cipher directly. This basically goes back to the original approach that was used before commit b56f5cbc7e08 ("crypto: arm/aes-neonbs - resolve fallback cipher at runtime"). Calling the ARM scalar AES cipher directly is faster, simpler, and avoids any chance of bugs specific to the use of fallback ciphers such as module loading deadlocks which have happened twice. The deadlocks turned out to be fixable in other ways, but there's no need to rely on anything so fragile in the first place. The rationale for the above-mentioned commit was to allow people to choose to use a time-invariant AES implementation for the fallback cipher. There are a couple problems with that rationale, though: - In practice the ARM scalar AES cipher (aes-arm) was used anyway, since it has a higher priority than aes-fixed-time. Users *could* go out of their way to disable or blacklist aes-arm, or to lower its priority using NETLINK_CRYPTO, but very few users customize the crypto API to this extent. Systems with the ARMv8 Crypto Extensions used aes-ce, but the bit-sliced algorithms are irrelevant on such systems anyway. - Since commit 913a3aa07d16 ("crypto: arm/aes - add some hardening against cache-timing attacks"), the ARM scalar AES cipher is partially hardened against cache-timing attacks. It actually works like aes-fixed-time, in that it disables interrupts and prefetches its lookup table. It does use a larger table than aes-fixed-time, but even so, it is not clear that aes-fixed-time is meaningfully more time-invariant than aes-arm. And of course, the real solution for time-invariant AES is to use a CPU that supports AES instructions. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17padata: use integer wrap around to prevent deadlock on seq_nr overflowVanGiang Nguyen
When submitting more than 2^32 padata objects to padata_do_serial, the current sorting implementation incorrectly sorts padata objects with overflowed seq_nr, causing them to be placed before existing objects in the reorder list. This leads to a deadlock in the serialization process as padata_find_next cannot match padata->seq_nr and pd->processed because the padata instance with overflowed seq_nr will be selected next. To fix this, we use an unsigned integer wrap around to correctly sort padata objects in scenarios with integer overflow. Fixes: bfde23ce200e ("padata: unbind parallel jobs from specific CPUs") Cc: <stable@vger.kernel.org> Co-developed-by: Christian Gafert <christian.gafert@rohde-schwarz.com> Signed-off-by: Christian Gafert <christian.gafert@rohde-schwarz.com> Co-developed-by: Max Ferger <max.ferger@rohde-schwarz.com> Signed-off-by: Max Ferger <max.ferger@rohde-schwarz.com> Signed-off-by: Van Giang Nguyen <vangiang.nguyen@rohde-schwarz.com> Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-08-17crypto: nx - Use static_assert() to check struct sizesGustavo A. R. Silva
Commit 1e6b251ce175 ("crypto: nx - Avoid -Wflex-array-member-not-at-end warning") introduced tagged `struct nx842_crypto_header_hdr`. We want to ensure that when new members need to be added to the flexible structure, they are always included within this tagged struct. So, we use `static_assert()` to ensure that the memory layout for both the flexible structure and the tagged struct is the same after any changes. Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>