linux-kernel - Re: [PATCH 04/13] crypto: arm64/sha256 - implement library instead of shash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXE1BKGspnSmqFJkqLCMMT+j=ZHEngKqcdOJsQ-LkyQdMg@mail.gmail.com>
Date: Sat, 26 Apr 2025 11:07:18 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: Eric Biggers <ebiggers@...nel.org>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-arch@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
	linux-mips@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org, 
	linux-riscv@...ts.infradead.org, sparclinux@...r.kernel.org, 
	linux-s390@...r.kernel.org, x86@...nel.org, 
	"Jason A . Donenfeld" <Jason@...c4.com>, Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 04/13] crypto: arm64/sha256 - implement library instead of shash

On Sat, 26 Apr 2025 at 08:51, Eric Biggers <ebiggers@...nel.org> wrote:
>
> From: Eric Biggers <ebiggers@...gle.com>
>
> Instead of providing crypto_shash algorithms for the arch-optimized
> SHA-256 code, instead implement the SHA-256 library.  This is much
> simpler, it makes the SHA-256 library functions be arch-optimized, and
> it fixes the longstanding issue where the arch-optimized SHA-256 was
> disabled by default.  SHA-256 still remains available through
> crypto_shash, but individual architectures no longer need to handle it.
>
> Remove support for SHA-256 finalization from the ARMv8 CE assembly code,
> since the library does not yet support architecture-specific overrides
> of the finalization.  (Support for that has been omitted for now, for
> simplicity and because usually it isn't performance-critical.)
>

This is fine - when I added this, kernel mode neon on arm64 would
eagerly preserve and restore the FP/SIMD state every time, but this is
no longer the case.


> To match sha256_blocks_arch(), change the type of the nblocks parameter
> of the assembly functions from int or 'unsigned int' to size_t.  Update
> the ARMv8 CE assembly function accordingly.  The scalar and NEON
> assembly functions actually already treated it as size_t.
>
> While renaming the assembly files, also fix the naming quirks where
> "sha2" meant sha256, and "sha512" meant both sha256 and sha512.
>

Good idea. Note that the ARM architecture's SHA2 extension only
supports SHA256 not SHA512 (which is a separate extension), so this is
where the confusion came from.


> Signed-off-by: Eric Biggers <ebiggers@...gle.com>
> ---
>  arch/arm64/configs/defconfig                  |   1 -
>  arch/arm64/crypto/Kconfig                     |  19 ---
>  arch/arm64/crypto/Makefile                    |  13 +-
>  arch/arm64/crypto/sha2-ce-glue.c              | 138 ----------------
>  arch/arm64/crypto/sha256-glue.c               | 156 ------------------
>  arch/arm64/lib/crypto/.gitignore              |   1 +
>  arch/arm64/lib/crypto/Kconfig                 |   5 +
>  arch/arm64/lib/crypto/Makefile                |   9 +-
>  .../crypto/sha2-armv8.pl}                     |   0
>  .../sha2-ce-core.S => lib/crypto/sha256-ce.S} |  36 +---
>  arch/arm64/lib/crypto/sha256.c                |  75 +++++++++
>  11 files changed, 98 insertions(+), 355 deletions(-)
>  delete mode 100644 arch/arm64/crypto/sha2-ce-glue.c
>  delete mode 100644 arch/arm64/crypto/sha256-glue.c
>  rename arch/arm64/{crypto/sha512-armv8.pl => lib/crypto/sha2-armv8.pl} (100%)
>  rename arch/arm64/{crypto/sha2-ce-core.S => lib/crypto/sha256-ce.S} (80%)
>  create mode 100644 arch/arm64/lib/crypto/sha256.c
>

Reviewed-by: Ard Biesheuvel <ardb@...nel.org>