Re: [PATCH v2 2/2] crypto: caam - Use bounce buffer for unaligned RSA destination buffers

[Stephane Debusne]

Hi Changwei,

On i.MX8M Mini (CAAM era 9, non-coherent DMA, no IOMMU in front of the
CAAM), with both patches of this series applied on 6.18.57, rsa-caam
gives correct results again for callers whose destination buffer
shares a cache line with the request context:

- cfg80211 loads regulatory.db, which was rejected before;
- keyctl padd accepts a valid self-signed certificate, and
  keyctl pkey_verify accepts 20 valid signatures (both failed with
  EINVAL before);
- a test module comparing rsa-caam with rsa-generic over 200 public-key
  operations per case (2048-bit key) reports no wrong result in any
  case, including a destination placed right after the request context
  (in place or not), crypto_akcipher_sync_encrypt() and
  pkcs1(rsa-caam,sha256) verification. Without the series, these cases
  failed in 198 to 200 of 200 operations, with bytes 0 to 23 of the
  output holding stale data.

Only the public-key path was exercised. The requests did not use
CRYPTO_TFM_REQ_MAY_BACKLOG, so the crypto-engine path fixed by patch 1
was not reached.

Tested-by: Stephane Debusne <stephane.debusne@xxxxxxxxxx>

I posted a series that addresses the same corruption on the caller
side, in crypto_akcipher_sync_prep() and rsassa_pkcs1_verify(), which
build these unaligned buffers:
https://lore.kernel.org/linux-crypto/20261016090333.2247764-1-stephane.debusne@xxxxxxxxxx/
The two approaches are complementary: with my series, the buffers from
these two callers are aligned and need no bounce, while your patch
covers any other caller.

Thanks,
Stephane