Re: [PATCH] crypto: qce - Fix HMAC self-test failures for empty messages

[Herbert Xu]

On Fri, Oct 16, 2026 at 04:23:43PM +0200, Bartosz Golaszewski wrote:
> BAM DMA cannot process zero-length transfers, so the driver always holds
> back at least one byte to submit to the engine and only ever finalizes
> with an empty buffer when nothing is left to submit. For plain hashes
> this was handled by returning the precomputed hash of the empty message
> (tmpl->hash_zero), but HMAC's result depends on the key and cannot be
> constant, so hmac(sha256) produced an incorrect digest for an empty
> message and the crypto self-tests failed.
> 
> A zero pending buffer at finalization time does not necessarily mean the
> message itself is empty, though: the caller can also reach it by
> importing a state that already reflects some hashed data with nothing
> currently buffered (crypto_ahash_import() followed directly by
> finalization). Special-casing only a genuinely empty message would
> silently compute the wrong result for an imported state in that
> scenario.
> 
> Handle every zero-length finalization consistently through the software
> fallback ahash instead. When nothing has been processed yet, let the
> fallback compute the result from scratch using the key already propagated
> to it via setkey(). Otherwise, reconstruct the fallback's running hash
> state from the state kept by the driver and finalize from there,
> accounting for the HMAC ipad block that the engine absorbs internally and
> that never goes through update().
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver")
> Tested-by: Kuldeep Singh <kuldeep.singh@xxxxxxxxxxxxxxxx>
> Tested-by: Pankaj Patil <pankaj.patil@xxxxxxxxxxxxxxxx>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>
> ---
> As requested by Herbert: I've split the large series fixing self tests
> into smaller chunks for easier review.
> ---
> Changes in v12:
> - Split out the SHA patch into its own submission
> - Link to v11: https://patch.msgid.link/20261016-qce-fixes-skcipher-v11-0-d13ddfe609a4@xxxxxxxxxxxxxxxx
> 
> Changes in v11:
> - Split out the skcipher patches into a smaller series for easier review
> - Drop patch "crypto: qce - Fix CTR-AES for partial block requests" as a
>   subsequent commit makes this adjustment effectively dead code
> - Fix a mid-series build failure due to an earlier bad rebase
> - Link to v10: https://patch.msgid.link/20261013-qce-fix-self-tests-v10-0-57162a38a554@xxxxxxxxxxxxxxxx
> 
> Changes in v10:
> - don't pass a NULL buffer to sg_init_one()
> - fix byte order of the imported hash state on empty finalization
> - don't recompute the CTR counter in software for every request
> - reject skcipher requests with a too short scatterlist
> - check fragmentation for empty CCM decryption requests too
> - don't use a static loop iterator (duh...)
> - initialize the return value in qce_handle_queue()
> - Link to v9: https://patch.msgid.link/20260922-qce-fix-self-tests-v9-0-b1aa742e79af@xxxxxxxxxxxxxxxx
> 
> Changes in v9:
> - Rebase on top of cryptodev/master
> - Rephrase Kconfig help text changes
> - Link to v8: https://patch.msgid.link/20260921-qce-fix-self-tests-v8-0-107537869a72@xxxxxxxxxxxxxxxx
> 
> Changes in v8:
> - Add a patch making the crypto driver *not* register algos by default
>   but only if the user explicitly requests it with the provided module
>   parameter
> - Use the "offloader" name for the crypto IP instead of "accelerator"
> - Fix device module table issues
> - Make the core driver use a list (despite it only having a single
>   member now) of child auxiliary devices to register to make it clear we
>   have the intention of extending this once we start the work on secure
>   media playback
> - Link to v7: https://patch.msgid.link/20260910-qce-fix-self-tests-v7-0-cdbd2718af14@xxxxxxxxxxxxxxxx
> 
> Changes in v7:
> - Add follow-up changes converting the QCE crypto driver to auxiliary
>   bus, adding the core QCE driver under drivers/soc/ registering the
>   auxiliary device and removing the BROKEN Kconfig label
> - Link to v6: https://patch.msgid.link/20260717-qce-fix-self-tests-v6-0-455775fe5f6c@xxxxxxxxxxxxxxxx
> 
> Changes in v6:
> - Handle all zero-length HMAC finalizations (like imported state with
>   data already hashed), not only the genuinely empty message case
> - Add an additional patch addressing the fragmented skcipher payload
>   issue
> - Link to v5: https://patch.msgid.link/20260706-qce-fix-self-tests-v5-0-86f461ff1829@xxxxxxxxxxxxxxxx
> 
> Changes in v5:
> - Dropped patch 1/8 that's already queued
> - Use the pre-allocated fallback ahash for HMAC transforms (Herbert)
> - Link to v4: https://patch.msgid.link/20260622-qce-fix-self-tests-v4-0-4f82ffa716c6@xxxxxxxxxxxxxxxx
> 
> Changes in v4:
> - Remove remaining ECB and DES3 bits
> - Pick up tags
> - Link to v3: https://patch.msgid.link/20260617-qce-fix-self-tests-v3-0-ecc2b4dedcfd@xxxxxxxxxxxxxxxx
> 
> Changes in v3:
> - Remove even more algorithms and dead code in patch 1/8
> - Link to v2: https://patch.msgid.link/20260615-qce-fix-self-tests-v2-0-dc911f1aad42@xxxxxxxxxxxxxxxx
> 
> Changes in v2:
> - Add fixes for the full suite of crypto self-tests
> - Add Fixes and Cc tags
> - Link to v1: https://patch.msgid.link/20260610-qce_selftest_fix-v1-0-1b0504783a46@xxxxxxxxxxxxxxxx/
> ---
>  drivers/crypto/qce/common.h |  1 -
>  drivers/crypto/qce/sha.c    | 62 ++++++++++++++++++++++++++++++++++-----------
>  2 files changed, 47 insertions(+), 16 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt