RE: [EXT] [PATCH 2/2] crypto: caam - Use bounce buffer for unaligned RSA destination buffers

["Sahil Malhotra (OSS)" <sahil.malhotra@oss.nxp.com>]

Hi Changwei,

Please find my comment inline.


NXP Confidential
> -----Original Message-----
> From: Changwei Zou <changwei.zou@canonical.com>
> Sent: 21 August 2026 10:26
> To: Horia Geanta <horia.geanta@nxp.com>; Pankaj Gupta
> <pankaj.gupta@nxp.com>; gaurav.jain@nxp.com;
> herbert@gondor.apana.org.au; davem@davemloft.net
> Cc: linux-crypto@vger.kernel.org; linux-kernel@vger.kernel.org;
> lukas@wunner.de; changwei.zou@canonical.com
> Subject: [EXT] [PATCH 2/2] crypto: caam - Use bounce buffer for unaligned
> RSA destination buffers
>
> Caution: This is an external email. Please take care when clicking links or
> opening attachments. When in doubt, report the message using the 'Report
> this email' button
>
>
> The rsa-caam driver directly DMA-maps the destination buffer supplied by the
> caller via req->dst without checking whether it meets the cacheline alignment
> requirements of DMA-incoherent hardware such as i.MX8.
>
> On CPUs with non-coherent DMA caches, if the destination buffer shares a
> cacheline with other data (i.e. it is not cacheline-aligned), cache
> writeback/invalidation during DMA can corrupt adjacent memory or cause
> stale data to be read back. This manifests as intermittent -EKEYREJECTED errors
> when loading signed kernel modules.
>
> When any segment of req->dst is not cacheline-aligned in either its start offset
> or length, allocate a single contiguous aligned bounce buffer covering the full
> dst_len rounded up to a cacheline multiple, redirect the operation to it, and
> copy the result back to the original destination once the hardware has
> completed successfully.
>
> Introduce a helper sg_is_dma_aligned() that checks both sg->offset and
> sg->length for cacheline alignment. Checking sg->offset suffices for
> the start address since physical pages are always page-aligned and PAGE_SIZE
> is a multiple of dma_get_cache_alignment(). sg->length is also checked to
> ensure the buffer end does not share a cacheline with adjacent memory.
>
> The intermittent error 'Key was rejected by service' on i.MX8 with CAAM can
> be triggered when loading signed kernel modules:
>
>     for i in $(seq 1 100); do
>         sudo modprobe xfs 2>&1 && echo "SUCCESS on attempt $i" \
>         && sudo rmmod xfs || echo "FAILED on attempt $i"
>     done
>
> Signed-off-by: Changwei Zou <changwei.zou@canonical.com>
> Assisted-by: OpenCode:claude-sonnet-4.6
> ---
>  drivers/crypto/caam/caampkc.c | 77
> ++++++++++++++++++++++++++++++++++-
>  drivers/crypto/caam/caampkc.h |  6 +++
>  2 files changed, 82 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
> index 840271840cce..11c6b07f5dad 100644
> --- a/drivers/crypto/caam/caampkc.c
> +++ b/drivers/crypto/caam/caampkc.c
> @@ -59,6 +59,40 @@ static void rsa_io_unmap(struct device *dev, struct
> rsa_edesc *edesc,
>                                  DMA_TO_DEVICE);  }
>
> +static int do_rsa_bounce_buf(struct akcipher_request *req, int req_err)
> +{
> +       struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req);
> +       int nents, err = 0;
> +
> +       if (!req_ctx->bounce_buf)
> +               return 0;
Please add this check in rsa_bounce_buf_done() and return from there only.
We need not to come here to return.


> +
> +       /* Only copy back to the original destination on success */
> +       if (!req_err) {
> +               nents = sg_nents_for_len(req_ctx->orig_dst, req->dst_len);
> +               if (nents < 0)
> +                       err = nents;
> +               else if (sg_copy_from_buffer(req_ctx->orig_dst, nents,
> +                                            req_ctx->bounce_buf,
> +                                            req->dst_len) != req->dst_len)
> +                       err = -EFAULT;
> +       }
> +