Re: [PATCH v7 00/12] crypto: qce - Fix crypto self-test failures

[Demi Marie Obenour]

On 9/15/26 05:42, Bartosz Golaszewski wrote:
> On Fri, 11 Sep 2026 20:34:39 +0200, Demi Marie Obenour
> <demiobenour@xxxxxxxxx> said:
>> On 9/10/26 09:00, Bartosz Golaszewski wrote:
>>> This iteration - in addition to the previous fixes - proposes to split
>>> the QCE driver into a core part necessary to bind to the QCE DT node and
>>> enable runtime power management in order to allow to drop the
>>> interconnect votes, and the crypto part registering the crypto
>>> algorithms. The core module is then enabled in arm64 defconfig while the
>>> crypto part stays disabled by default.
>>>
>>> The QCE hardware crypto engine has several limitations that cause it to
>>> produce incorrect results or stall on certain inputs. This series fixes
>>> several bugs and adds workaround allowing the deiver to pass crypto
>>> self-tests.
>>>
>>> The failures addressed are:
>>>
>>> - HMAC self-test failures for empty messages
>>> - AES-XTS returning success on zero-length input (should be -EINVAL)
>>> - AES-CTR: partial final block causes the engine to stall, output IV
>>>   derivation was incorrect
>>> - AES-XTS with key1 == key2 is not supported by the CE
>>> - AES-CCM: partial final block and fragmented payload both stall the
>>>   engine
>>>
>>> All fixes were tested on an SM8650 QRD board with
>>> CONFIG_CRYPTO_SELFTESTS=y and CONFIG_CRYPTO_SELFTESTS_FULL=y.
>>>
>>> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>
>> For stable, would it be better to not register the algorithms, thus
>> preventing their use?  Another option would be to replace the whole
>> driver with an always-on stub driver that just does power management.
> 
> A module parameter called: really_register_algos that's disabled by default?
> 
> Bart

Works for me!  If you add that and fix the tests, go ahead and revert
my patch that marked it as BROKEN.  I suggest reverting the defconfig
changes too, for power management reasons.

While the driver is buggy, you might want to add a kernel taint if
the option is set.  There's precedent for that in other parts of the
kernel.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature