From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BAAF1E47CC for ; Mon, 24 Nov 2025 19:03:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764011024; cv=none; b=nrSpeDR4WNos8TGY3Dbc1lHVUVyAXY7CUVOfL7UH/PG8qLz2Bf/4/nNTImz8+iI58LxBq89Fk1JHNZXEEnbTnZgDPybLQRpNr4+myhqb0jpTkSxu82IUSQCExCre5i8M2s4AFhlmTmGPYd5dlgk4gKweyT+P3gATqkiq/N+XINA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764011024; c=relaxed/simple; bh=Zxcm3gNJd0jkM9LAEYuI5gtP/2LeK187+Kz7Qp3lg7g=; h=Message-ID:Subject:From:To:Cc:Date:Content-Type:MIME-Version; b=B59LOuxBnswmgsD8MggLBjiKzB3fFjxOiz8t25XyUlcqZXl+0TcX0XLBCiEjDUBjzIpXE2lZHdSUGcRduKxYdcgKV0/IyKj9Da1+lh4WcakBhBPdxBygxAeD7kjXlWCmy1zwLl5lS1nHk3qeNBT3nxEFkVVToLqMzSroaIlJ79A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IixigsSr; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IixigsSr" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-477a219dbcaso42713455e9.3 for ; Mon, 24 Nov 2025 11:03:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764011021; x=1764615821; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:date:cc:to:from :subject:message-id:from:to:cc:subject:date:message-id:reply-to; bh=Zxcm3gNJd0jkM9LAEYuI5gtP/2LeK187+Kz7Qp3lg7g=; b=IixigsSraEwLjuEp6ow0LL+1Cra4iR5RDoioScaJZW9C8elOqLgDPdOuBgqZy4rDdn PXL6YIG/zjR6ty5J5hmlKGB4s3AzR4XsqOrpsuwX0JXaE+E8CvBAICk76KBf0EHlu9YV jasJJ4EDOpn+hO9JqBidHlrxqL9XDxHkqjqdp99TD+uNlWrRvmAxeNy+Y1TG1oq+80AS cpb2xjiHiDMoaRVW5EIoH2n6HaO1DW9R6rY82GvdDmPr8vhrb/A8Vz3aEY3TG3lDu6jy e5E8mcARMkU64lhlgZ3WpqzFZIm0qhYuhHYyxR/oiLAEcFh0bdPUrA07X96Yz/UMDuc0 Q5ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764011021; x=1764615821; h=mime-version:user-agent:content-transfer-encoding:date:cc:to:from :subject:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=Zxcm3gNJd0jkM9LAEYuI5gtP/2LeK187+Kz7Qp3lg7g=; b=ll/TiOb/rATIZkMRbZClIfs/Mt43LqLHzcGMUelqPr+IaEvApN/7jnO3OxA2r0mnYL hn8oMMpCao4xaMDMHhwtIBEAsmg1Fj94Brj8W9IgUPMNDWfoh+kH28aQ5rUprVtok6TO zD6ZWeBjw0ketT8yNAixZpYSd28ddlRlU3bSxZhYv8vRv4fhMXDvEn/YlBqTrMfnrucB 8b/b3uLFFUVeaFOYuRj8FVFLpC/HkS+MW/xfMH0QYya1gIP99MuBS1Z705IZTogKqFXW b2ySHSoIABDZuMB/z2/Yw/HGtnxYTHEURCvfOufcYQz26BlE164oBO7wwOmPS3x/ZoQg FzaQ== X-Forwarded-Encrypted: i=1; AJvYcCWl+6W3PuO5k16QKbQByaAT6VNySicHmjcAAsN/UjguxvNmCNoqlB6/rzfuJaSPsjhgpsuX+mAsVtLCOG4=@vger.kernel.org X-Gm-Message-State: AOJu0YxdAAUKLagIJ+BsbXjbMvSRkXi5o0jJbWW+rlHySYsDjGGRWgp1 8g3oWoh2K5NakCiky/pbJztG0KZrChc/WxPCyLRe63/iTgpgFLw3uMKu X-Gm-Gg: ASbGncs8RkB2sADKO4FgNKcM17BC70l+4pc6R+ur2wvR3atf9Ja+1HfWGR08ZGH3pLs leZeC2F+HhxK5rJW4DP84aascSx74QpuzgTdQp+SHC4owzOKTE660wFuqNg+hvW61GVMouy2a5D dgMqrIoIpSekpXe26l2yi92zqBB+ADhFoNRZ3DmVM+IjEvE6S04qF4AMkv2Ii8eukFHC/ca/pM2 CMqpZoytieM5PUk0y+pmchsRHeczwKtHb+KqLaMJMLdnN8v2qsXE8vgZ+tzqnYIpcCtvUlQHFYN V173cwUCnciGpQpzZsid52lfE56MEDYwJ0r38pt8NdKcgMlFwqfhcUQikrCUwkN79m9IzG8SULi SlW6BQnmx6a9g0gJ79vW38du2056TOofW4L1+Sz6HpaUFEXb8LqrHFXKVrS5+coT6ErUiiHu8OA 4kF4UFKLx1/BVWZFcq/0vRMt0Q48l2OOYPBQ== X-Google-Smtp-Source: AGHT+IGYLfLoYRrNuhgHIuLc0gBE3x7JrYm7zZUk64MOqkH1xaWYPuIC/hvgzxDAS0QTdrbFY1ZD9A== X-Received: by 2002:a05:600c:45c9:b0:477:af07:dd1c with SMTP id 5b1f17b1804b1-477c0212123mr150189625e9.35.1764011020683; Mon, 24 Nov 2025 11:03:40 -0800 (PST) Received: from vitor-nb.Home (bl19-170-125.dsl.telepac.pt. [2.80.170.125]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-477bf36d1fasm202264565e9.7.2025.11.24.11.03.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Nov 2025 11:03:40 -0800 (PST) Message-ID: Subject: CAAM RSA breaks cfg80211 certificate verification on iMX8QXP From: Vitor Soares To: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Cc: horia.geanta@nxp.com, pankaj.gupta@nxp.com, gaurav.jain@nxp.com, herbert@gondor.apana.org.au, john.ernberg@actia.se, meenakshi.aggarwal@nxp.com Date: Mon, 24 Nov 2025 19:03:38 +0000 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.44.4-0ubuntu2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 I=E2=80=99m currently investigating an issue on our Colibri iMX8QXP SoM run= ning kernel 6.18-rc6 (also reproducible on v6.17), where cfg80211 fails to load the compiled-in X.509 certificates used to verify the regulatory database signa= ture. During boot, I consistently see the following messages: cfg80211: Loading compiled-in X.509 certificates for regulatory database Problem loading in-kernel X.509 certificate (-22) Problem loading in-kernel X.509 certificate (-22) cfg80211: loaded regulatory.db is malformed or signature is missing/invali= d As part of the debugging process, I removed the CAAM crypto drivers and man= ually reloaded cfg80211. In this configuration, the certificates load correctly a= nd the regulatory database is validated with no errors. With additional debugging enabled, I traced the failure to crypto_sig_verif= y(), which returns -22 (EINVAL). At this stage, I=E2=80=99m trying to determine whether: - This is a known issue involving cfg80211 certificate validation when the= CAAM hardware crypto engine is enabled on i.MX SoCs, or - CAAM may be returning unexpected values to the X.509 verification logic. If anyone has encountered similar behavior or can suggest areas to investigate=E2=80=94particularly around CAAM=E2=80=94I would greatly apprec= iate your guidance. Thanks in advance for any insights, V=C3=ADtor Soares