[PATCH] lib/crypto: powerpc/aes: Fix rndkey_from_vsx() on big endian CPUs

[PATCH] lib/crypto: powerpc/aes: Fix rndkey_from_vsx() on big endian CPUs

[Eric Biggers]

I finally got a big endian PPC64 kernel to boot in QEMU.  The PPC64 VSX
optimized AES library code does work in that case, with the exception of
rndkey_from_vsx() which doesn't take into account that the order in
which the VSX code stores the round key words depends on the endianness.
So fix rndkey_from_vsx() to do the right thing on big endian CPUs.

Fixes: 7cf2082e74ce ("lib/crypto: powerpc/aes: Migrate POWER8 optimized code into library")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/powerpc/aes.h | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/crypto/powerpc/aes.h b/lib/crypto/powerpc/aes.h
index 42e0a993c619..f8cbd3c7578f 100644
--- a/lib/crypto/powerpc/aes.h
+++ b/lib/crypto/powerpc/aes.h
@@ -93,22 +93,24 @@ static inline bool is_vsx_format(const struct p8_aes_key *key)
 {
 	return key->nrounds != 0;
 }
 
 /*
- * Convert a round key from VSX to generic format by reflecting the 16 bytes,
- * and (if apply_inv_mix=true) applying InvMixColumn to each column.
+ * Convert a round key from VSX to generic format by reflecting all 16 bytes (if
+ * little endian) or reflecting each 4-byte word (if big endian), and (if
+ * apply_inv_mix=true) applying InvMixColumn to each column.
  *
  * It would be nice if the VSX and generic key formats would be compatible.  But
  * that's very difficult to do, with the assembly code having been borrowed from
  * OpenSSL and also targeted to POWER8 rather than POWER9.
  *
  * Fortunately, this conversion should only be needed in extremely rare cases,
  * possibly not at all in practice.  It's just included for full correctness.
  */
 static void rndkey_from_vsx(u32 out[4], const u32 in[4], bool apply_inv_mix)
 {
+	const bool be = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN);
 	u32 k0 = swab32(in[0]);
 	u32 k1 = swab32(in[1]);
 	u32 k2 = swab32(in[2]);
 	u32 k3 = swab32(in[3]);
 
@@ -116,14 +118,14 @@ static void rndkey_from_vsx(u32 out[4], const u32 in[4], bool apply_inv_mix)
 		k0 = inv_mix_columns(k0);
 		k1 = inv_mix_columns(k1);
 		k2 = inv_mix_columns(k2);
 		k3 = inv_mix_columns(k3);
 	}
-	out[0] = k3;
-	out[1] = k2;
-	out[2] = k1;
-	out[3] = k0;
+	out[0] = be ? k0 : k3;
+	out[1] = be ? k1 : k2;
+	out[2] = be ? k2 : k1;
+	out[3] = be ? k3 : k0;
 }
 
 static void aes_preparekey_arch(union aes_enckey_arch *k,
 				union aes_invkey_arch *inv_k,
 				const u8 *in_key, int key_len, int nrounds)

base-commit: 64275e9fda3702bfb5ab3b95f7c2b9b414667164
-- 
2.53.0

Re: [PATCH] lib/crypto: powerpc/aes: Fix rndkey_from_vsx() on big endian CPUs

[Eric Biggers]

On Sun, Feb 15, 2026 at 06:21:04PM -0800, Eric Biggers wrote:
> I finally got a big endian PPC64 kernel to boot in QEMU.  The PPC64 VSX
> optimized AES library code does work in that case, with the exception of
> rndkey_from_vsx() which doesn't take into account that the order in
> which the VSX code stores the round key words depends on the endianness.
> So fix rndkey_from_vsx() to do the right thing on big endian CPUs.
> 
> Fixes: 7cf2082e74ce ("lib/crypto: powerpc/aes: Migrate POWER8 optimized code into library")
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/powerpc/aes.h | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
> 

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric