linux-kernel - Re: [PATCH 1/2] crypto: caam: Change the i.MX8MQ check support all i.MX8M variants

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <VI1PR0402MB34857B8C5560B912B34674AB985B0@VI1PR0402MB3485.eurprd04.prod.outlook.com>
Date:   Tue, 10 Dec 2019 07:56:09 +0000
From:   Horia Geanta <horia.geanta@....com>
To:     Adam Ford <aford173@...il.com>,
        Schrempf Frieder <frieder.schrempf@...tron.de>
CC:     "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Aymen Sghaier <aymen.sghaier@....com>,
        Fabio Estevam <festevam@...il.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Rob Herring <robh+dt@...nel.org>,
        dl-linux-imx <linux-imx@....com>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        Shawn Guo <shawnguo@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH 1/2] crypto: caam: Change the i.MX8MQ check support all
 i.MX8M variants

On 12/6/2019 9:55 PM, Adam Ford wrote:
> On Wed, Dec 4, 2019 at 5:38 AM Schrempf Frieder
> <frieder.schrempf@...tron.de> wrote:
>>
>> Hi Adam,
>>
>> On 30.11.19 23:51, Adam Ford wrote:
>>> The i.MX8M Mini uses the same crypto engine as the i.MX8MQ, but
>>> the driver is restricting the check to just the i.MX8MQ.
>>>
>>> This patch lets the driver support all i.MX8M Variants if enabled.
>>>
>>> Signed-off-by: Adam Ford <aford173@...il.com>
>>
>> What about the following lines in run_descriptor_deco0()? Does this
>> condition also apply to i.MX8MM?
> 
> I think that's a question for NXP.  I am not seeing that in the NXP
> Linux Release, and I don't have an 8MQ to compare.
> 
IIRC the i.MX BSP releases use the JRI for initializing the RNG,
and not the DECO register interface.

> I was able to get the driver working on the i.MXMM with the patch.
> 
You are probably using a newer U-boot, which includes
commit dfaec76029f2 ("crypto/fsl: instantiate all rng state handles")

> NXP  Team,
> 
> Do you have any opinions on this?
> 
Since current U-boot initializes both RNG state handles, practically
instantiate_rng() is a no-op.

A simple experiment is to "lie" about the state_handle_mask, to exercise
the DECO acquire code (or, as mentioned above, to run with an older U-boot):

@@ -268,12 +272,19 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
        struct caam_ctrl __iomem *ctrl;
        u32 *desc, status = 0, rdsta_val;
        int ret = 0, sh_idx;
+       static int force_init = 1;

        ctrl = (struct caam_ctrl __iomem *)ctrlpriv->ctrl;
        desc = kmalloc(CAAM_CMD_SZ * 7, GFP_KERNEL);
        if (!desc)
                return -ENOMEM;

+       if (force_init && (state_handle_mask == 0x3)) {
+               dev_err(ctrldev, "Forcing reinit of RNG state handle 0!\n");
+               force_init = 0;
+               state_handle_mask = 0x2;
+       }
+
        for (sh_idx = 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {
                /*
                 * If the corresponding bit is set, this state handle

In this case boot log confirms the DECO cannot be acquired:
[    2.137101] caam 30900000.crypto: Forcing reinit of RNG state handle 0!
[    2.172293] caam 30900000.crypto: failed to acquire DECO 0
[    2.177786] caam 30900000.crypto: failed to instantiate RNG

To sum up, writing to DECORSR is mandatory.

Horia