Harden QNX CAAM memory handling - #11346
aidangarske wants to merge 8 commits into
Conversation
aidangarske
commented
Sep 1, 2026
aidangarske
commented
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Hardens QNX CAAM secure-memory handling by tightening partition bounds/ownership checks, hardening request length validation, and adding regression tests to catch oversized/partial request issues.
Changes:
- Add QNX partition bounds helpers and enforce partition ownership checks for READ/WRITE/FREE flows.
- Harden request parsing: validate key modifier length for BLOB, validate AES request sizes and short reads, and clear local shared buffers.
- Add QNX-focused regression tests (shell harness + QNX/host buildable C test scaffolding).
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfssl/wolfcrypt/port/caam/caam_driver.h | Adds QNX partition count constants and a validation macro used by QNX hardening. |
| wolfcrypt/src/port/caam/caam_qnx.c | Adds zeroization helper, stronger size/range checks, and enforces partition ownership for secure memory operations. |
| wolfcrypt/src/port/caam/caam_driver.c | Validates partition indices against hardware-reported partition count in QNX builds. |
| tests/include.am | Ships an additional QNX CAAM regression script in test artifacts. |
| tests/caam_qnx_blob.test | Adds a portable harness that regression-tests the BLOB key modifier bounds check. |
| IDE/QNX/CAAM-DRIVER/test_support/* | Adds host stubs/shims to compile QNX CAAM server code for regression testing off-target. |
| IDE/QNX/CAAM-DRIVER/test_aes_request_length.c | Adds regression coverage for AES short-read, oversize arithmetic, and partition validation/ownership logic. |
| IDE/QNX/CAAM-DRIVER/Makefile | Adds convenience targets to build/run the new AES request-length regression on host and target. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11346
Scan targets checked: wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src
Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
c3b3474 to
cc4bc1b
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11346
Scan targets checked: wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src
Findings: 5
4 finding(s) posted as inline comments (see file-level comments below)
Required changes (1)
Secure-memory ECDSA operations bypass new ownership tracking
File: wolfcrypt/src/port/caam/caam_qnx.c:1116
Function: doECDSA_KEYPAIR / io_devctl
Category: Cryptographic correctness
doECDSA_KEYPAIR() records an OCB owner, but SM-backed sign and ECDH operations never check it. Another client can enumerate the 16 page addresses and use another client's private key. Adjacent to #12310: these are crypto-use paths.
Related known finding #12310 (similar but distinct): Both omit QNX secure-memory ownership enforcement and can expose another client's key material, but #12310 covers read, write, and free partition handlers whereas this covers ECDSA sign/ECDH key-use paths. The faulting operations and checks to add differ, so one patch would not fix both.
Suggested fix: Record the keypair's page mapping, pass ocb to sign/ECDH handlers, and reject SM key addresses not owned by that OCB.
Basis: The PR's ownership invariant binds secure-memory partitions to the requesting iofunc_ocb_t * before permitting partition access.
This review was generated automatically by Fenrir. Reported findings require changes before merge.
philljj
left a comment
philljj
left a comment
There was a problem hiding this comment.
fenrir items looks straightforward, please review
cc4bc1b to
0478c62
Compare
|
Jenkins retest this please |
|
Jenkins retest this |
0478c62 to
f0119a8
Compare
philljj
left a comment
philljj
left a comment
There was a problem hiding this comment.
merge conflict in caam driver
JacobBarthelmeh
left a comment
JacobBarthelmeh
left a comment
There was a problem hiding this comment.
Thanks @aidangarske , I like the host side test!
Host-test run :
$ cd IDE/QNX/CAAM-DRIVER/
Jacobs-MacBook-Pro:CAAM-DRIVER jacob$ make host-test
build/armv7le-debug/test_aes_request_length_host
testRejectIncompleteRequest: PASS
testClearMappedRequest: PASS
testRejectOversizedRequest: PASS
testRejectInvalidPartitionIndex: PASS
testRejectOtherOwnerPartitionAccess: PASS
testPartitionOwnerMapping: PASS
testRejectInvalidPartitionRange: PASS
Tested with QNX 7.1 tool chain (after resolving the minor merge conflict). All warnings are. existing ones :
CC=arm-unknown-nto-qnx7.1.0eabi-gcc make
arm-unknown-nto-qnx7.1.0eabi-gcc -c -Wp,-MMD,build/armv7le-debug/caam_error.d,-MT,build/armv7le-debug/caam_error.o -o build/armv7le-debug/caam_error.o -I../../../ -I../../../wolfssl/wolfcrypt/port/caam/ -Wall -fmessage-length=0 -g -O0 -fno-builtin -O2 -Wall -DWOLFSSL_CAAM_IMX6Q -DWOLFSSL_CUSTOM_CONFIG ../../../wolfcrypt/src/port/caam/caam_error.c
In file included from ../../../wolfcrypt/src/port/caam/caam_error.c:26:
../../../wolfssl/wolfcrypt/settings.h:4999:14: warning: #warning "For timing resistance / side-channel attack prevention consider using harden options" [-Wcpp]
#warning "For timing resistance / side-channel attack prevention consider using harden options"
^~~~~~~
arm-unknown-nto-qnx7.1.0eabi-gcc -c -Wp,-MMD,build/armv7le-debug/caam_driver.d,-MT,build/armv7le-debug/caam_driver.o -o build/armv7le-debug/caam_driver.o -I../../../ -I../../../wolfssl/wolfcrypt/port/caam/ -Wall -fmessage-length=0 -g -O0 -fno-builtin -O2 -Wall -DWOLFSSL_CAAM_IMX6Q -DWOLFSSL_CUSTOM_CONFIG ../../../wolfcrypt/src/port/caam/caam_driver.c
In file included from ../../../wolfcrypt/src/port/caam/caam_driver.c:26:
../../../wolfssl/wolfcrypt/settings.h:4999:14: warning: #warning "For timing resistance / side-channel attack prevention consider using harden options" [-Wcpp]
#warning "For timing resistance / side-channel attack prevention consider using harden options"
^~~~~~~
arm-unknown-nto-qnx7.1.0eabi-gcc -c -Wp,-MMD,build/armv7le-debug/caam_qnx.d,-MT,build/armv7le-debug/caam_qnx.o -o build/armv7le-debug/caam_qnx.o -I../../../ -I../../../wolfssl/wolfcrypt/port/caam/ -Wall -fmessage-length=0 -g -O0 -fno-builtin -O2 -Wall -DWOLFSSL_CAAM_IMX6Q -DWOLFSSL_CUSTOM_CONFIG ../../../wolfcrypt/src/port/caam/caam_qnx.c
../../../wolfcrypt/src/port/caam/caam_qnx.c: In function 'io_devctl':
../../../wolfcrypt/src/port/caam/caam_qnx.c:1728:5: warning: 'iofunc_devctl_verify' is deprecated [-Wdeprecated-declarations]
if ((ret = iofunc_devctl_verify(ctp, msg, ocb,
^~
In file included from ../../../wolfssl/wolfcrypt/port/caam/caam_qnx.h:34,
from ../../../wolfssl/wolfcrypt/port/caam/caam_driver.h:27,
from ../../../wolfcrypt/src/port/caam/caam_qnx.c:35:
/home/boz-amd/qnx710/target/qnx7/usr/include/sys/iofunc.h:530:12: note: declared here
extern int iofunc_devctl_verify(const resmgr_context_t * const ctp, const io_devctl_t * const msg, const iofunc_ocb_t * const ocb, const unsigned requested_checks ) __attribute__ ((deprecated));
^~~~~~~~~~~~~~~~~~~~
arm-unknown-nto-qnx7.1.0eabi-gcc -o build/armv7le-debug/wolfCrypt build/armv7le-debug/caam_error.o build/armv7le-debug/caam_driver.o build/armv7le-debug/caam_qnx.o
