linux-kernel - Re: [PATCH v3 08/14] crypto: caam - update rfc4106 sh desc to support zero length input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Jul 2019 15:44:46 +0000
From:   Horia Geanta <horia.geanta@....com>
To:     Iuliana Prodan <iuliana.prodan@....com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Aymen Sghaier <aymen.sghaier@....com>
CC:     "David S. Miller" <davem@...emloft.net>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        dl-linux-imx <linux-imx@....com>
Subject: Re: [PATCH v3 08/14] crypto: caam - update rfc4106 sh desc to support
 zero length input

On 7/25/2019 4:58 PM, Iuliana Prodan wrote:
> @@ -892,24 +895,26 @@ void cnstr_shdsc_rfc4106_encap(u32 * const desc, struct alginfo *cdata,
>  	append_math_sub_imm_u32(desc, VARSEQINLEN, REG3, IMM, ivsize);
>  	append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
>  
> -	/* Read assoc data */
> -	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS1 | FIFOLDST_VLF |
> -			     FIFOLD_TYPE_AAD | FIFOLD_TYPE_FLUSH1);
> +	/* Skip AAD */
> +	append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
>  
> -	/* Skip IV */
> -	append_seq_fifo_load(desc, ivsize, FIFOLD_CLASS_SKIP);
> +	/* Read cryptlen and set this value into VARSEQOUTLEN */
> +	append_math_sub(desc, VARSEQOUTLEN, SEQINLEN, REG3, CAAM_CMD_SZ);
>  
> -	/* Will read cryptlen bytes */
> -	append_math_sub(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ);
> +	/* If cryptlen is ZERO jump to AAD command */
> +	zero_cryptlen_jump_cmd = append_jump(desc, JUMP_TEST_ALL |
> +					    JUMP_COND_MATH_Z);
>  
>  	/* Workaround for erratum A-005473 (simultaneous SEQ FIFO skips) */
> -	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS1 | FIFOLD_TYPE_MSG);
> +	append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA);
>  
The workaround should be moved further down, just before the "Skip IV".

By moving this instruction as far away as possible from
previous seq fifo store, the chances of DECO stalling are reduced.

> -	/* Skip assoc data */
> -	append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
> +	/* Read AAD data */
> +	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS1 | FIFOLDST_VLF |
> +			     FIFOLD_TYPE_AAD | FIFOLD_TYPE_FLUSH1);
>  
> -	/* cryptlen = seqoutlen - assoclen */
> -	append_math_sub(desc, VARSEQOUTLEN, VARSEQINLEN, REG0, CAAM_CMD_SZ);
> +	/* Skip IV */
> +	append_seq_fifo_load(desc, ivsize, FIFOLD_CLASS_SKIP);
> +	append_math_add(desc, VARSEQINLEN, VARSEQOUTLEN, REG0, CAAM_CMD_SZ);
>  
>  	/* Write encrypted data */
>  	append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | FIFOLDST_VLF);
> @@ -918,6 +923,18 @@ void cnstr_shdsc_rfc4106_encap(u32 * const desc, struct alginfo *cdata,
>  	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS1 | FIFOLDST_VLF |
>  			     FIFOLD_TYPE_MSG | FIFOLD_TYPE_LAST1);
>  
> +	/* Jump instructions to avoid double reading of AAD */
> +	skip_instructions = append_jump(desc, JUMP_TEST_ALL);
> +
> +	/* There is no input data, cryptlen = 0 */
> +	set_jump_tgt_here(desc, zero_cryptlen_jump_cmd);
> +
> +	/* Read AAD */
> +	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS1 | FIFOLDST_VLF |
> +			     FIFOLD_TYPE_AAD | FIFOLD_TYPE_LAST1);
> +
> +	set_jump_tgt_here(desc, skip_instructions);
> +
>  	/* Write ICV */
>  	append_seq_store(desc, icvsize, LDST_CLASS_1_CCB |
>  			 LDST_SRCDST_BYTE_CONTEXT);