linux-kernel - Re: [PATCH] lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250624024730.GC7127@sol>
Date: Mon, 23 Jun 2025 19:47:30 -0700
From: Eric Biggers <ebiggers@...nel.org>
To: linux-crypto@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>,
	"Jason A . Donenfeld " <Jason@...c4.com>,
	René van Dorst <opensource@...rst.com>,
	linux-mips@...r.kernel.org, llvm@...ts.linux.dev,
	stable@...r.kernel.org, kernel test robot <lkp@...el.com>
Subject: Re: [PATCH] lib/crypto: mips/chacha: Fix clang build and remove
 unneeded byteswap

On Thu, Jun 19, 2025 at 03:55:35PM -0700, Eric Biggers wrote:
> The MIPS32r2 ChaCha code has never been buildable with the clang
> assembler.  First, clang doesn't support the 'rotl' pseudo-instruction:
> 
>     error: unknown instruction, did you mean: rol, rotr?
> 
> Second, clang requires that both operands of the 'wsbh' instruction be
> explicitly given:
> 
>     error: too few operands for instruction
> 
> To fix this, align the code with the real instruction set by (1) using
> the real instruction 'rotr' instead of the nonstandard pseudo-
> instruction 'rotl', and (2) explicitly giving both operands to 'wsbh'.
> 
> To make removing the use of 'rotl' a bit easier, also remove the
> unnecessary special-casing for big endian CPUs at
> .Lchacha_mips_xor_bytes.  The tail handling is actually
> endian-independent since it processes one byte at a time.  On big endian
> CPUs the old code byte-swapped SAVED_X, then iterated through it in
> reverse order.  But the byteswap and reverse iteration canceled out.
> 
> Tested with chacha20poly1305-selftest in QEMU using "-M malta" with both
> little endian and big endian mips32r2 kernels.
> 
> Fixes: 49aa7c00eddf ("crypto: mips/chacha - import 32r2 ChaCha code from Zinc")
> Cc: stable@...r.kernel.org
> Reported-by: kernel test robot <lkp@...el.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202505080409.EujEBwA0-lkp@intel.com/
> Signed-off-by: Eric Biggers <ebiggers@...nel.org>
> ---
> 
> This applies on top of other pending lib/crypto patches and can be
> retrieved from git at:
> 
>     git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git mips-chacha-fix
> 
>  lib/crypto/mips/chacha-core.S | 20 +++++++-------------
>  1 file changed, 7 insertions(+), 13 deletions(-)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric