- 11 Dec, 2021 13 commits
-
-
Nicolai Stange authored
The jitterentropy collection loop in jent_gen_entropy() can in principle run indefinitely without making any progress if it only receives stuck measurements as determined by jent_stuck(). After 31 consecutive stuck samples, the Repetition Count Test (RCT) would fail anyway and the jitterentropy RNG instances moved into ->health_failure == 1 state. jent_gen_entropy()'s caller, jent_read_entropy() would then check for this ->health_failure condition and return an error if found set. It follows that there's absolutely no point in continuing the collection loop in jent_gen_entropy() once the RCT has failed. Make the jitterentropy collection loop more robust by terminating it upon jent_health_failure() so that it won't continue to run indefinitely without making any progress. Signed-off-by:
Nicolai Stange <nstange@suse.de> Reviewed-by:
Stephan Mueller <smueller@chronox.de> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au>
-
Nicolai Stange authored
The jitterentropy's Repetition Count Test (RCT) as well as the Adaptive Proportion Test (APT) are run unconditionally on any collected samples. However, their result, i.e. ->health_failure, will only get checked if fips_enabled is set, c.f. the jent_health_failure() wrapper. I would argue that a RCT or APT failure indicates that something's seriously off and that this should always be reported as an error, independently of whether FIPS mode is enabled or not: it should be up to callers whether or not and how to handle jitterentropy failures. Make jent_health_failure() to unconditionally return ->health_failure, independent of whether fips_enabled is set. Note that fips_enabled isn't accessed from the jitterentropy code anymore now. Remove the linux/fips.h include as well as the jent_fips_enabled() wrapper. Signed-off-by:
-
Nicolai Stange authored
A subsequent patch will make the jitterentropy RNG to unconditionally report health test errors back to callers, independent of whether fips_enabled is set or not. The DRBG needs access to a functional jitterentropy instance only in FIPS mode (because it's the only SP800-90B compliant entropy source as it currently stands). Thus, it is perfectly fine for the DRBGs to obtain entropy from the jitterentropy source only on a best effort basis if fips_enabled is off. Make the DRBGs to ignore jitterentropy failures if fips_enabled is not set. Signed-off-by:
-
Nicolas Toromanoff authored
The CRYP IP checks the written key depending of the configuration, it's safer to write the whole configuration to hardware then the key to avoid unexpected key rejection. Signed-off-by:
Nicolas Toromanoff <nicolas.toromanoff@foss.st.com> Signed-off-by:
-
Nicolas Toromanoff authored
Extra crypto manager auto test were crashing or failling due to 2 reasons: - block in a dead loop (dues to issues in cipher end process management) - crash due to read/write unmapped memory (this crash was also reported when using openssl afalg engine) Rework interrupt management, interrupts are masked as soon as they are no more used: if input buffer is fully consumed, "Input FIFO not full" interrupt is masked and if output buffer is full, "Output FIFO not empty" interrupt is masked. And crypto request finish when input *and* outpout buffer are fully read/write. About the crash due to unmapped memory, using scatterwalk_copychunks() that will map and copy each block fix the issue. Using this api and copying full block will also fix unaligned data access, avoid early copy of in/out buffer, and make useless the extra alignment constraint. Fixes: 9e054ec2 ("crypto: stm32 - Support for STM32 CRYP crypto module") Reported-by:
Marek Vasut <marex@denx.de> Signed-off-by:
-
Nicolas Toromanoff authored
This fixes the lrw autotest if lrw uses the CRYP as the AES block cipher provider (as ecb(aes)). At end of request, CRYP should not update the IV in case of ECB chaining mode. Indeed the ECB chaining mode never uses the IV, but the software LRW chaining mode uses the IV field as a counter and due to the (unexpected) update done by CRYP while the AES block process, the counter get a wrong value when the IV overflow. Fixes: 5f49f18d ("crypto: stm32/cryp - update to return iv_out") Signed-off-by:
-
Nicolas Toromanoff authored
Delete extraneous lines in probe error handling code: pm was disabled twice. Fixes: 65f9aa36 ("crypto: stm32/cryp - Add power management support") Reported-by:
-
Nicolas Toromanoff authored
Some auto tests failed because driver wasn't returning the expected error with some input size/iv value/tag size. Now: Return 0 early for empty buffer. (We don't need to start the engine for an empty input buffer). Accept any valid authsize for gcm(aes). Return -EINVAL if iv for ccm(aes) is invalid. Return -EINVAL if buffer size is a not a multiple of algorithm block size. Fixes: 9e054ec2 ("crypto: stm32 - Support for STM32 CRYP crypto module") Signed-off-by:
-
Nicolas Toromanoff authored
Don't erase key: If key is erased before the crypto_finalize_.*_request() call, some pending process will run with a key={ 0 }. Moreover if the key is reset at end of request, it breaks xts chaining mode, as for last xts block (in case input len is not a multiple of block) a new AES request is started without calling again set_key(). Fixes: 9e054ec2 ("crypto: stm32 - Support for STM32 CRYP crypto module") Signed-off-by: -
Nicolas Toromanoff authored
STM32 CRYP hardware doesn't manage CTR counter bigger than max U32, as a workaround, at each block the current IV is saved, if the saved IV lower u32 is 0xFFFFFFFF, the full IV is manually incremented, and set in hardware. Fixes: bbb28326 ("crypto: stm32 - Fix sparse warnings") Signed-off-by:
-
Etienne Carriere authored
Change driver to not print an error message when the device probe is deferred for a clock resource. Signed-off-by:
Etienne Carriere <etienne.carriere@foss.st.com> Signed-off-by:
-
Etienne Carriere authored
Change stm32 CRYP driver to defer its probe operation when reset controller device is registered but has not been probed yet. Signed-off-by:
-
Guo Zhengkui authored
Remove a duplicate #include <linux/fips.h>. Signed-off-by:
Guo Zhengkui <guozhengkui@vivo.com> Signed-off-by:
-
- 03 Dec, 2021 3 commits
-
-
Dan Carpenter authored
If kstrtoint() fails then "lfs_num" is uninitialized and the warning doesn't make any sense. Just delete it. Fixes: 8ec8015a ("crypto: octeontx2 - add support to process the crypto request") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Geert Uytterhoeven authored
Use the FIELD_PREP() helper, instead of open-coding the same operation. Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by:
-
Gaurav Jain authored
When caam queue is full (-ENOSPC), caam frees descriptor memory. crypto-engine checks if retry support is true and h/w queue is full(-ENOSPC), then requeue the crypto request. During processing the requested descriptor again, caam gives below error. (caam_jr 30902000.jr: 40000006: DECO: desc idx 0: Invalid KEY Command). This patch adds a check to return when caam input ring is full and retry support is true. so descriptor memory is not freed and requeued request can be processed again. Fixes: 2d653936 ("crypto: caam - enable crypto-engine retry mechanism") Signed-off-by:
Gaurav Jain <gaurav.jain@nxp.com> Reviewed-by:
Horia Geantă <horia.geanta@nxp.com> Signed-off-by:
-
- 26 Nov, 2021 24 commits
-
-
Stephan Müller authored
On Dec 31 2023 NIST sunsets TDES for FIPS use. To prevent FIPS validations to be completed in the future to be affected by the TDES sunsetting, disallow TDES already now. Otherwise a FIPS validation would need to be "touched again" end 2023 to handle TDES accordingly. Signed-off-by:
-
Stephan Müller authored
FIPS disallows DH with keys < 2048 bits. Thus, the kernel should consider the enforcement of this limit. Signed-off-by:
-
Stephan Müller authored
FIPS disallows RSA with keys < 2048 bits. Thus, the kernel should consider the enforcement of this limit. Signed-off-by:
-
Stephan Müller authored
The APT compares the current time stamp with a pre-set value. The current code only considered the 4 LSB only. Yet, after reviews by mathematicians of the user space Jitter RNG version >= 3.1.0, it was concluded that the APT can be calculated on the 32 LSB of the time delta. Thi change is applied to the kernel. This fixes a bug where an AMD EPYC fails this test as its RDTSC value contains zeros in the LSB. The most appropriate fix would have been to apply a GCD calculation and divide the time stamp by the GCD. Yet, this is a significant code change that will be considered for a future update. Note, tests showed that constantly the GCD always was 32 on these systems, i.e. the 5 LSB were always zero (thus failing the APT since it only considered the 4 LSB for its calculation). Signed-off-by:
-
Kai Ye authored
Some optimize for the calculation of qos shaper parameters. and modify the comments. Signed-off-by:
Kai Ye <yekai13@huawei.com> Signed-off-by:
-
Kai Ye authored
1. Optimize overly long functions. 2. Fix the format symbol does not match the actual type. 3. Use the PCI_DEVFN to get the function id. Signed-off-by:
-
Kai Ye authored
The value of qos should be reset after flr resetting or device resetting. So set the max of qos value for every function. Then update the value of qos when user writing the alg_qos. Signed-off-by:
-
Kai Ye authored
Modify the value of type rate from new QM spec. Signed-off-by:
-
Stephan Müller authored
The kernel crypto API provides the SP800-108 counter KDF implementation. Thus, the separate implementation provided as part of the keys subsystem can be replaced with calls to the KDF offered by the kernel crypto API. The keys subsystem uses the counter KDF with a hash primitive. Thus, it only uses the call to crypto_kdf108_ctr_generate. Signed-off-by:
Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by:
-
Stephan Müller authored
Remove the specific code that adds a zero padding that was intended to be invoked when the DH operation result was smaller than the modulus. However, this cannot occur any more these days because the function mpi_write_to_sgl is used in the code path that calculates the shared secret in dh_compute_value. This MPI service function guarantees that leading zeros are introduced as needed to ensure the resulting data is exactly as long as the modulus. This implies that the specific code to add zero padding is dead code which can be safely removed. Signed-off-by:
-
Stephan Müller authored
SP800-108 defines three KDFs - this patch provides the counter KDF implementation. The KDF is implemented as a service function where the caller has to maintain the hash / HMAC state. Apart from this hash/HMAC state, no additional state is required to be maintained by either the caller or the KDF implementation. The key for the KDF is set with the crypto_kdf108_setkey function which is intended to be invoked before the caller requests a key derivation operation via crypto_kdf108_ctr_generate. SP800-108 allows the use of either a HMAC or a hash as crypto primitive for the KDF. When a HMAC primtive is intended to be used, crypto_kdf108_setkey must be used to set the HMAC key. Otherwise, for a hash crypto primitve crypto_kdf108_ctr_generate can be used immediately after allocating the hash handle. Signed-off-by:
-
Stephan Müller authored
As a preparation to add the key derivation implementations, the self-test data structure definition and the common test code is made available. The test framework follows the testing applied by the NIST CAVP test approach. The structure of the test code follows the implementations found in crypto/testmgr.c|h. In case the KDF implementations will be made available via a kernel crypto API templates, the test code is intended to be merged into testmgr.c|h. Signed-off-by:
-
Corentin Labbe authored
The Allwinner D1 SoC has a crypto engine compatible with sun8i-ce. Add support for it. Signed-off-by:
Corentin Labbe <clabbe.montjoie@gmail.com> Signed-off-by:
Samuel Holland <samuel@sholland.org> Signed-off-by:
-
Marco Chiappero authored
Improve and simplify logging of PFVF messages. Signed-off-by:
Marco Chiappero <marco.chiappero@intel.com> Reviewed-by:
Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by:
-
Marco Chiappero authored
PFVF debug messages use a mix of zero and one based VF IDs. Switch to zero based VF numbers in all log messages. Signed-off-by:
-
Marco Chiappero authored
Remove min_iov_compat_ver field as for now all versions are compatible. Compatibility is determined by a series of rules and dynamic conditions such as specific configurations. In any case the minimum version requirement for compatibility is an inadequate and obsolete approach which should be removed. At this time compatibility can be assured across the currently available versions. Signed-off-by:
-
Marco Chiappero authored
Refactor version handling logic for ADF_VF2PF_MSGTYPE_COMPAT_VER_REQ and ADF_VF2PF_MSGTYPE_VERSION_REQ on the PF. Response messages are now filled only after fully parsing the request, in a consisted way with the rest of the PFVF codebase. This patch also fixes a harmless double setting for VERSION in the response for ADF_VF2PF_MSGTYPE_VERSION_REQ. Signed-off-by:
-
Marco Chiappero authored
Currently, any PF response to a VF request is fully parsed during the interrupt handling. This way the individual response values are stored into the accel_dev structure, preventing the caller to access and decode the full response message itself. Change this behavior, by letting the API return back the entire message to the caller, in order to: - keep correlated code together, that is, the (building of the) request and the (decoding of the) response; - avoid polluting the accel_dev data structure with unnecessary and at times temporary values; only the entire message is stored in a temporary buffer. Signed-off-by: -
Marco Chiappero authored
Replace PFVF constants with enumerations for valid protocol codes. Signed-off-by:
-
Marco Chiappero authored
Organize PFVF protocol definitions by type rather than direction, by keeping related fields close. Also, make sure the order is consistent for both PF and VF definitions. Signed-off-by:
-
Marco Chiappero authored
Reorganize the structure of the PFVF code by moving the content of adf_pf2vf_msg.c and adf_vf2pf_msg.c. The logic that handles high level messages has been moved to adf_pfvf_pf_msg.c and adf_pfvf_vf_msg.c. The implementation of low level communication primitives and the protocol is now included in adf_pfvf_pf_proto.c and adf_pfvf_vf_proto.c. In addition, the file adf_pf2vf_msg.h has been renamed in adf_pfvf_msg.h since it common to PF and VF and the copyright date for the touched files has been updated. Signed-off-by:
-
Giovanni Cabiddu authored
Refactor the PFVF receive logic so it is common between PF and VF and make it device specific. This is in preparation for the introduction of PFVF support in the qat_4xxx driver since the receive logic differs between QAT GEN2 and QAT GEN4 devices. Signed-off-by:
-
Marco Chiappero authored
Make the PFVF send function device specific. This is in preparation for the introduction of PFVF support in the qat_4xxx driver since the send logic differs between QAT GEN2 and QAT GEN4 devices. Signed-off-by:
-
Marco Chiappero authored
Add the function get_vf2pf_offset() to adf_pfvf_ops to differentiate the CSRs used for pf2vf and vf2pf. Offsets may or may not be direction specific depending on QAT generation. Since in QAT GEN2 the CSR is not direction specific, i.e. there is a single mailbox register shared for pf2vf and vf2pf, both get_vf2pf_offset() and get_vf2pf_offset() will return the same offset. This change is to make the direction explicit, so it is easier to understand and debug and also in preparation for the introduction of PFVF support in the qat_4xxx driver since QAT GEN4 devices have a separate CSR for pf2vf and vf2pf communications. Signed-off-by:
-
