u-boot.git/drivers/crypto/fsl, branch next

crypto: fsl: Select ARCH_MISC_INIT for CAAM driver

2026-04-02T12:07:18+00:00

The CAAM JR driver is initialized from arch_misc_init(). If
ARCH_MISC_INIT is not enabled, the driver is never initialized,
which can lead to crashes or hangs (e.g. during hash operations).

Select ARCH_MISC_INIT when enabling FSL_CAAM to ensure proper
initialization.

Signed-off-by: Heiko Schocher 
Suggested-by: Fabio Estevam 
Reviewed-by: Peng Fan

crypto/rng: double the entropy delay interval for retry

2025-10-10T03:44:27+00:00

During entropy evaluation, if the generated samples fail any statistical test,
then, all of the bits will be discarded, and a second set of samples will be
generated and tested.

Double the ent_delay to give more chance to pass before performing retry.

Signed-off-by: Gaurav Jain 
Signed-off-by: Peng Fan

drivers: crypto: fsl: rng: Reinitialize job ring

2025-08-27T08:12:21+00:00

u-boot internals were being corrupted following an EFI callback to
get_rng(). One of the many footprints was a corruption of the EFI
protocols linked list.

A request for >16 bytes of random data is broken into smaller requests.
Those requests are fed in a loop to the CAAM RNG, which uses a job
queue ring for interaction.

However, the job queue descriptor is created only at probe time. That
descriptor may end up needing an endian swap (LS1046A) before being fed
to the CAAM RNG. This corrupts the descriptor for the next iteration,
since it will be blindly endian swapped yet again.

Two issues arise. The number of words to endian swap is taken from the
input descriptor itself. So on the second iteration, the length has been
corrupted. This results in a corruption past the end of the descriptor:
whatever is after in memory is endian swapped too. Second, some of the
entries in the descriptor are DMA addresses. If the descriptor is still
somehow considered valid after swapping, the data at the corrupted DMA
address is now trampled.

Linux properly initializes the descriptor for each iteration. This is
what is now done with this commit.

Signed-off-by: Anthony Pighin 
Signed-off-by: Peng Fan

crypto: fsl: Only allow these to be chosen on ARM/PowerPC

2025-07-10T14:40:58+00:00

These drivers require various headers which only exist on the ARM /
PowerPC platforms which implement the hardware. Express that requirement
in Kconfig as well.

Reviewed-by: Peng Fan 
Signed-off-by: Tom Rini

Revert "caam: Fix CAAM error on startup"

2025-06-09T17:01:24+00:00

This reverts commit 159b6f0e119962ce5da645f548cefe9196c8778e.

Since commit 159b6f0e1199 ("caam: Fix CAAM error on startup") the following
regression was reported by Tim Harvey:

"I've found that this patch causes a regression on an imx8mm board
(imx8mm_venice_defconfig) where the first call to caam_rng_read fails
here in jr_dequeue but if you call it again it works. With some
debugging added:
SEC0:  RNG instantiated
...
Hit any key to stop autoboot:  0
u-boot=> rng list
RNG #0 - caam-rng
u-boot=> rng 0 10
caam_rng_read caam-rng len=16
run_descriptor_jr_idx idx=0
Error in SEC deq: -1
caam_rng_read_one run_descriptor_jr failed: -1
caam_rng_read caam-rng caam_rng_read_one failed: -5
Reading RNG failed
u-boot=> rng 0 10
caam_rng_read caam-rng len=16
run_descriptor_jr_idx idx=0
00000000: ad 2e ad c0 2a 12 27 c4 65 82 66 19 be ef f6 07  ....*.'.e.f.....

If I revert your patch caam_rng_read works initially and on subsequent
calls."

" I ran into this when I was testing
lwIP HTTPS as it causes anything that uses dm_rng to fail the first
time (such as HTTPS)."

Revert it for now to avoid the regression.

Reported-by: Tim Harvey 
Signed-off-by: Fabio Estevam 
Acked-by: Peng Fan

caam: Fix CAAM error on startup

2025-05-22T12:01:51+00:00

In rare cases U-Boot returns an error message when intantiating the RNG
of the CAAM device:
“SEC0:  RNG4 SH0 instantiation failed with error 0xffffffff”
This  means, that even when the CAAM device reports a finished
descriptor, none is found in the output ring.
This might be caused by a missing cache invalidation before
reading the memory of the output ring
This patch moves the cache invalidation of the output ring from start of
the job to immediately after the notification from hardware where the
output ring will be read.

Signed-off-by: Olaf Baehring 
Signed-off-by: Fabio Estevam

crypto: fsl_hash: fix flush dcache alignment in caam_hash()

2025-03-03T06:18:50+00:00

Loading a FIT kernel image with hash hardware acceleration enabled
(CONFIG_SHA_HW_ACCEL=y) displays the following CACHE warning:

    [...]
    Trying 'kernel-1' kernel subimage
    [...]
    Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [16000128, 1673fae8]
    [...]
    Trying 'ramdisk-1' ramdisk subimage
    [...]
    Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [1676d6d4, 1737a5d4]
    [...]
    Trying 'fdt-imx6q-xxx.dtb' fdt subimage
    [...]
    Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [1673fbdc, 1674b0dc]
    [...]

This patch fixes it.

Tested on:
- i.MX 6 custom board
- LS1021A custom board

Signed-off-by: Benjamin Lemouzy 
Signed-off-by: Peng Fan

crypto: typo volatge

2024-12-24T17:07:53+00:00

%s/volatge/voltage/g

Signed-off-by: Heinrich Schuchardt 
Acked-by: Peng Fan

global: Rename SPL_TPL_ to PHASE_

2024-10-11T17:44:48+00:00

Use PHASE_ as the symbol to select a particular XPL build. This means
that SPL_TPL_ is no-longer set.

Update the comment in bootstage to refer to this symbol, instead of
SPL_

Signed-off-by: Simon Glass

drivers: Use CONFIG_XPL_BUILD instead of CONFIG_SPL_BUILD

2024-10-11T17:44:48+00:00

Use the new symbol to refer to any 'SPL' build, including TPL and VPL

Signed-off-by: Simon Glass