crypto: arm64/ghash-ce - fix for big endian

The GHASH key and digest are both pairs of 64-bit quantities, but the
GHASH code does not always refer to them as such, causing failures when
built for big endian. So replace the 16x1 loads and stores with 2x8 ones.

Fixes: b913a6404ce2 ("arm64/crypto: improve performance of GHASH algorithm")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/arch/arm64/crypto/ghash-ce-core.S b/arch/arm64/crypto/ghash-ce-core.S
index dc457015884e04345ea814d0aa1d274793ad7bc4..f0bb9f0b524fceb8b62ef4be45f57bee3308156e 100644 (file)
--- a/arch/arm64/crypto/ghash-ce-core.S
+++ b/arch/arm64/crypto/ghash-ce-core.S
@@ -29,8 +29,8 @@
         *                         struct ghash_key const *k, const char *head)
         */
 ENTRY(pmull_ghash_update)
-       ld1             {SHASH.16b}, [x3]
-       ld1             {XL.16b}, [x1]
+       ld1             {SHASH.2d}, [x3]
+       ld1             {XL.2d}, [x1]
        movi            MASK.16b, #0xe1
        ext             SHASH2.16b, SHASH.16b, SHASH.16b, #8
        shl             MASK.2d, MASK.2d, #57
@@ -74,6 +74,6 @@ CPU_LE(       rev64           T1.16b, T1.16b  )
 
        cbnz            w0, 0b
 
-       st1             {XL.16b}, [x1]
+       st1             {XL.2d}, [x1]
        ret
 ENDPROC(pmull_ghash_update)