Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Horia Geanta <horia.geanta@nxp.com>
To:     Andrey Smirnov <andrew.smirnov@gmail.com>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
CC:     Chris Healy <cphealy@gmail.com>,
        Lucas Stach <l.stach@pengutronix.de>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Iuliana Prodan <iuliana.prodan@nxp.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        dl-linux-imx <linux-imx@nxp.com>
Subject: Re: [PATCH v6 6/7] crypto: caam - enable prediction resistance in
 HRWNG
Thread-Topic: [PATCH v6 6/7] crypto: caam - enable prediction resistance in
 HRWNG
Thread-Index: AQHVxjouh/c8xz5csUKnQ9CkhtEExg==
Date:   Mon, 20 Jan 2020 16:38:46 +0000
Message-ID: <VI1PR0402MB3485F1AF6DC4B74FF373B16998320@VI1PR0402MB3485.eurprd04.prod.outlook.com>
References: <20200108154047.12526-1-andrew.smirnov@gmail.com>
 <20200108154047.12526-7-andrew.smirnov@gmail.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: nxp.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 524a99e6-2144-4815-9f8c-08d79dc7386e
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2020 16:38:46.6067
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: SSxL6SarabtX332n4e66BY9j/hIcUR8nYCOrVb4IO6HyGc2Hb2oG9lmTNBUjroB//34HkRwSyfr+vv/QI8COTw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0402MB3744
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On 1/8/2020 5:42 PM, Andrey Smirnov wrote:=0A=
> @@ -275,12 +276,25 @@ static int instantiate_rng(struct device *ctrldev, =
int state_handle_mask,=0A=
>  		return -ENOMEM;=0A=
>  =0A=
>  	for (sh_idx =3D 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {=0A=
> +		const u32 rdsta_if =3D RDSTA_IF0 << sh_idx;=0A=
> +		const u32 rdsta_pr =3D RDSTA_PR0 << sh_idx;=0A=
> +		const u32 rdsta_mask =3D rdsta_if | rdsta_pr;=0A=
>  		/*=0A=
>  		 * If the corresponding bit is set, this state handle=0A=
>  		 * was initialized by somebody else, so it's left alone.=0A=
>  		 */=0A=
> -		if ((1 << sh_idx) & state_handle_mask)=0A=
> -			continue;=0A=
> +		if (rdsta_if & state_handle_mask) {=0A=
> +			if (rdsta_pr & state_handle_mask)=0A=
> +				continue;=0A=
> +=0A=
> +			dev_info(ctrldev,=0A=
> +				 "RNG4 SH%d was previously instantiated without prediction resistanc=
e. Tearing it down\n",=0A=
> +				 sh_idx);=0A=
> +=0A=
> +			ret =3D deinstantiate_rng(ctrldev, rdsta_if);=0A=
> +			if (ret)=0A=
> +				break;=0A=
In case state handle 0 is deinstantiated, its reinstantiation with PR suppo=
rt=0A=
will have the side effect of re-generating JDKEK, TDKEK, TDSK.=0A=
This needs to be avoided, since other SW components (like OP-TEE f/w)=0A=
could have black keys in use. Overwriting the KEK registers would no longer=
=0A=
allow CAAM to decrypt them.=0A=
=0A=
Horia=0A=