lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 22 Sep 2021 18:51:23 +0300
From:   Horia Geantă <>
To:     Michael Walle <>,
        "" <>,
        "" <>
Cc:     Pankaj Gupta <>,
        Herbert Xu <>,
        "David S . Miller" <>
Subject: Re: [PATCH] crypto: caam: disable pkc for non-E SoCs

On 9/16/2021 1:03 AM, Michael Walle wrote:
> On newer CAAM versions, not all accelerators are disabled if the SoC is
> a non-E variant. While the driver checks most of the modules for
> availability, there is one - PKHA - which sticks out. On non-E variants
Currently there's no dedicated support for "partially disabled" non-E
(export-controlled) parts in Linux kernel caam driver(s).

Up until recently firmware (U-boot) was deleting the "crypto" DT node
for all non-E parts [1].
Modifying the f/w indeed triggers changes across the s/w stack.

Since you are modifying only the caam code handling PKHA, is it correct
to assume that everything else is working fine?
For example: is the number of AES accelerators (AESA_VERSION[AESA_NUM])
being reported as 0 on non-E parts?

> it is still reported as available, that is the number of instances is
> non-zero, but it has limited functionality. In particular it doesn't
> support encryption and decryption, but just signing and verifying. This
> is indicated by a bit in the PKHA_MISC field. Take this bit into account
> if we are checking for availablitly.
typo:			 ^ availability
> This will the following error:
> [    8.167817] caam_jr 8020000.jr: 20000b0f: CCB: desc idx 11: : Invalid CHA selected.
> Tested on an NXP LS1028A (non-E) SoC.
Unfortunately I don't have a non-E part to test on.


4eecc6f1a104 ("armv8: layerscape: don't remove crypto node if just partially disabled")

Powered by blists - more mailing lists