Re: [PATCH v11 3/3] crypto: Add Inside Secure SafeXcel EIP-93 crypto engine support

[Christian Marangi (Ansuel)]

Il giorno mar 1 apr 2025 alle ore 12:53 Herbert Xu
<herbert@xxxxxxxxxxxxxxxxxxx> ha scritto:
>
> On Tue, Jan 14, 2025 at 01:36:36PM +0100, Christian Marangi wrote:
> >
> > +static void eip93_hash_export_sa_state(struct ahash_request *req,
> > +                                    struct eip93_hash_export_state *state)
> > +{
> > +     struct eip93_hash_reqctx *rctx = ahash_request_ctx_dma(req);
> > +     struct sa_state *sa_state = &rctx->sa_state;
> > +
> > +     /*
> > +      * EIP93 have special handling for state_byte_cnt in sa_state.
> > +      * Even if a zero packet is passed (and a BADMSG is returned),
> > +      * state_byte_cnt is incremented to the digest handled (with the hash
> > +      * primitive). This is problematic with export/import as EIP93
> > +      * expect 0 state_byte_cnt for the very first iteration.
> > +      */
> > +     if (!rctx->len)
> > +             memset(state->state_len, 0, sizeof(u32) * 2);
>
> I don't understand when this can occur.  As far as I can see,
> zero-length packets are never passed to the hardware for hashing.
>

I did some extra check on this and you are right. This was a leftover
(and discovery) when we were discussing on how to correctly
implement import/export.

My initial idea was to send a zero packet on export to sync and wait
for DMA to finish. But this was scrapped in favor of -EINPROGRESS
in the update function (that wasn't aware of possible)

If you are ok I can send a patch to drop this (and maybe leave the
comment just to document this strange finding)

What do you think?

> > +     else
> > +             memcpy(state->state_len, sa_state->state_byte_cnt,
> > +                    sizeof(u32) * 2);
>
> I need to know the endianness of state_byte_cnt, which I presume
> is the number of bytes that have been hashed into the partial
> hash state.

It's LE.

>
> I need this because I'm changing the export format of all ahash
> algorithms to match that of the generic implementation.  This is
> so that you can seamlessly switch between an async ahash and its
> sync fallback.
>