Re: Question regarding crypto scatterlists / testmgr

From: Eric Biggers <ebiggers@kernel.org>
To: Pascal Van Leeuwen <pvanleeuwen@insidesecure.com>
Cc: "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
	Herbert Xu <herbert@gondor.apana.org.au>
Subject: Re: Question regarding crypto scatterlists / testmgr
Date: Wed, 17 Apr 2019 13:24:08 -0700	[thread overview]
Message-ID: <20190417202407.GA96242@gmail.com> (raw)
In-Reply-To: <AM6PR09MB352386B26E3F632D6FE2FDDDD2250@AM6PR09MB3523.eurprd09.prod.outlook.com>

Hi Pascal,

On Wed, Apr 17, 2019 at 07:51:08PM +0000, Pascal Van Leeuwen wrote:
> Hi,
> 
> I'm trying to fix the inside-secure driver to pass all testmgr
> tests and I have one final issue remaining with the AEAD ciphers.
> As it was not clear at all what the exact problem was, I spent
> some time reverse engineering testmgr and I got the distinct
> impression that it is using scatter particles that cross page
> boundaries. On purpose, even.
> 
> While the inside-secure driver is built on the premise that
> scatter particles are continuous in device space. As I can't
> think of any reason why you would want to scatter/gather other
> than to handle virtual-to-physical address translation ...
> In any case, this should affect all other other operations as
> well, but maybe those just got "lucky" by getting particles
> that were still contiguous in device space, despite the page
> crossing (to *really* verify this, you would have to fully
> randomize your page allocation!)
> 
> Anyway, assuming that I *should* be able to handle particles
> that are *not* contiguous in device space, then there should
> probably already exist some function in the kernel API that
> converts a scatterlist with non-contiguous particles into a
> scatterlist with contiguous particles, taking into account the
> presence of an IOMMU? Considering pretty much every device
> driver would need to do that?
> Does anyone know which function(s) to use for that?
> 
> Regards,
> Pascal van Leeuwen
> Silicon IP Architect, Multi-Protocol Engines @ Inside Secure
> 

Indeed, since v5.1, testmgr tests scatterlist elements that cross a page.
However, the pages are guaranteed to be *physically* contiguous.  Does
dma_map_sg() not handle this?

BTW, this isn't just a theoretical case.  Many crypto API users do crypto on
kmalloced buffers, and those can cross a page boundary, especially if they are
large.  All software crypto algorithms handle this case.

The fact that these types of issues are just being considered now certainly
isn't raising my confidence in the hardware crypto drivers in the kernel...

- Eric