linux-toradex.git/drivers/crypto/caam/caamalg.c, branch v5.6

crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN

2020-01-09T03:30:53+00:00

The CRYPTO_TFM_RES_BAD_KEY_LEN flag was apparently meant as a way to
make the ->setkey() functions provide more information about errors.

However, no one actually checks for this flag, which makes it pointless.

Also, many algorithms fail to set this flag when given a bad length key.
Reviewing just the generic implementations, this is the case for
aes-fixed-time, cbcmac, echainiv, nhpoly1305, pcrypt, rfc3686, rfc4309,
rfc7539, rfc7539esp, salsa20, seqiv, and xcbc.  But there are probably
many more in arch/*/crypto/ and drivers/crypto/.

Some algorithms can even set this flag when the key is the correct
length.  For example, authenc and authencesn set it when the key payload
is malformed in any way (not just a bad length), the atmel-sha and ccree
drivers can set it if a memory allocation fails, and the chelsio driver
sets it for bad auth tag lengths, not just bad key lengths.

So even if someone actually wanted to start checking this flag (which
seems unlikely, since it's been unused for a long time), there would be
a lot of work needed to get it working correctly.  But it would probably
be much better to go back to the drawing board and just define different
return values, like -EINVAL if the key is invalid for the algorithm vs.
-EKEYREJECTED if the key was rejected by a policy like "no weak keys".
That would be much simpler, less error-prone, and easier to test.

So just remove this flag.

Signed-off-by: Eric Biggers 
Reviewed-by: Horia Geantă 
Signed-off-by: Herbert Xu

crypto: caam - make CAAM_PTR_SZ dynamic

2019-08-30T08:05:30+00:00

In order to be able to configure CAAM pointer size at run-time, which
needed to support i.MX8MQ, which is 64-bit SoC with 32-bit pointer
size, convert CAAM_PTR_SZ to refer to a global variable of the same
name ("caam_ptr_sz") and adjust the rest of the code accordingly. No
functional change intended.

Signed-off-by: Andrey Smirnov 
Cc: Chris Spencer 
Cc: Cory Tusar 
Cc: Chris Healy 
Cc: Lucas Stach 
Cc: Horia Geantă 
Cc: Aymen Sghaier 
Cc: Leonard Crestez 
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu

crypto: caam/des - switch to new verification routines

2019-08-22T04:39:39+00:00

Cc: Horia Geanta 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu

crypto: caam - fix MDHA key derivation for certain user key lengths

2019-08-09T05:11:49+00:00

Fuzz testing uncovered an issue when |user key| > |derived key|.
Derived key generation has to be fixed in two cases:

1. Era >= 6 (DKP is available)
DKP cannot be used with immediate input key if |user key| > |derived key|,
since the resulting descriptor (after DKP execution) would be invalid -
having a few bytes from user key left in descriptor buffer
as incorrect opcodes.

Fix DKP usage both in standalone hmac and in authenc algorithms.
For authenc the logic is simplified, by always storing both virtual
and dma key addresses.

2. Era < 6
The same case (|user key| > |derived key|) fails when DKP
is not available.
Make sure gen_split_key() dma maps max(|user key|, |derived key|),
since this is an in-place (bidirectional) operation.

Signed-off-by: Horia Geantă 
Reviewed-by: Iuliana Prodan 
Signed-off-by: Herbert Xu

crypto: caam - check zero-length input

2019-08-09T05:11:48+00:00

Check zero-length input, for skcipher algorithm, to solve the extra
tests. This is a valid operation, therefore the API will return no error.

Signed-off-by: Iuliana Prodan 
Reviewed-by: Horia Geanta 
Signed-off-by: Herbert Xu

crypto: caam - check assoclen

2019-08-09T05:11:47+00:00

Check assoclen to solve the extra tests that expect -EINVAL to be
returned when the associated data size is not valid.

Validated assoclen for RFC4106 and RFC4543 which expects an assoclen
of 16 or 20.
Based on seqiv, IPsec ESP and RFC4543/RFC4106 the assoclen is sizeof IP
Header (spi, seq_no, extended seq_no) and IV len. This can be 16 or 20
bytes.

Signed-off-by: Iuliana Prodan 
Reviewed-by: Horia Geanta 
Signed-off-by: Herbert Xu

crypto: caam - check authsize

2019-08-09T05:11:46+00:00

Check authsize to solve the extra tests that expect -EINVAL to be
returned when the authentication tag size is not valid.

Validated authsize for GCM, RFC4106 and RFC4543.

Signed-off-by: Iuliana Prodan 
Reviewed-by: Horia Geanta 
Signed-off-by: Herbert Xu

crypto: caam - check key length

2019-08-09T05:11:46+00:00

Check key length to solve the extra tests that expect -EINVAL to be
returned when the key size is not valid.

Validated AES keylen for skcipher, ahash and aead.

Signed-off-by: Iuliana Prodan 
Reviewed-by: Horia Geanta 
Signed-off-by: Herbert Xu

crypto: caam - update IV only when crypto operation succeeds

2019-08-09T05:11:45+00:00

skcipher encryption might fail and in some cases, like (invalid) input
length smaller then block size, updating the IV would lead to a useless
IV copy in case hardware issued an error.

Signed-off-by: Horia Geantă 
Signed-off-by: Iuliana Prodan 
Signed-off-by: Herbert Xu

crypto: caam - fix return code in completion callbacks

2019-08-09T05:11:45+00:00

Modify drive to provide a valid errno (and not the HW error ID)
to the user, via completion callbacks.

A "valid errno" is currently not explicitly mentioned in the docs,
however the error code is expected to match the one returned by the
generic SW implementation.

Note: in most error cases caam/qi and caam/qi2 returned -EIO; align all
caam drivers to return -EINVAL.

While here, ratelimit prints triggered by fuzz testing, such that
console is not flooded.

Signed-off-by: Horia Geantă 
Signed-off-by: Iuliana Prodan 
Signed-off-by: Herbert Xu