tree b7d22c3a9f80661bd9d7a202d3dc004f462a8de3
parent f8047e2d47386b218204267de2ede43af2931875
author David Benjamin <davidben@google.com> 1606839281 -0500
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1606862493 +0000

aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode

ARM Cortex-A57 and Cortex-A72 cores running in 32-bit mode are affected
by silicon errata #1742098 [0] and #1655431 [1], respectively, where the
second instruction of a AES instruction pair may execute twice if an
interrupt is taken right after the first instruction consumes an input
register of which a single 32-bit lane has been updated the last time it
was modified.

Shuffle the counter assignments around a bit so that the most recent
updates when the AES instruction pair executes are 128-bit wide.

[0] ARM-EPM-049219 v23 Cortex-A57 MPCore Software Developers Errata Notice
[1] ARM-EPM-012079 v11.0 Cortex-A72 MPCore Software Developers Errata Notice

(This is imported from upstream's
409c59e8f44ae56f2587cdd8a7ce611d0e3d91d9.)

The change is applied to both 32-bit and 64-bit for simplicity, but there
was no measurable performance difference, so leaving them aligned is
easiest.

Change-Id: Ic8e5f656f59ae8c2ecb2762a066c2c9064bb34c5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/44284
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>