summaryrefslogtreecommitdiff
path: root/drivers/crypto
AgeCommit message (Collapse)AuthorFilesLines
2026-07-27crypto: allwinner - Remove redundant dev_err()Pan Chuang2-6/+2
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: omap-sham - use devm_platform_get_and_ioremap_resourceRosen Penev1-86/+18
Replace the open-coded omap_sham_get_res_of()/omap_sham_get_res_pdev() helpers and the #ifdef CONFIG_OF machinery with the managed devm_platform_get_and_ioremap_resource(), platform_get_irq() and device_get_match_data() helpers. The omap_sham_pdata_omap2 fallback is kept for the non-DT (legacy platform_device) case. This removes the manual resource copy and ioremap, simplifying probe. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: omap-aes - use devm_platform_get_and_ioremap_resourceRosen Penev1-72/+12
Replace the open-coded omap_aes_get_res_of()/omap_aes_get_res_pdev() helpers and the #ifdef CONFIG_OF machinery with the managed devm_platform_get_and_ioremap_resource(), platform_get_irq() and device_get_match_data() helpers. The omap_aes_pdata_omap2 fallback is kept for the non-DT (legacy platform_device) case, and the now-unused err_res label is removed. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: hisilicon/sec - use devm_platform_ioremap_resource in sec_map_ioRosen Penev1-16/+3
Replace the open-coded platform_get_resource() plus devm_ioremap() sequence in the SEC_NUM_ADDR_REGIONS loop with devm_platform_ioremap_resource(), which fetches the resource, requests the region and maps it in one call. Switch the error check to IS_ERR()/PTR_ERR() and drop the now-unused struct resource pointer. The driver only maps indices 0 and 1 (SEC_COMMON, SEC_SAA). On hip07 the corresponding reg regions (0xd0000000, 0xd2000000) are 0x10000 each and disjoint, so the region reservation added by devm_ioremap_resource() is exclusive and does not introduce overlap failures. Built for arm64 (drivers/crypto/hisilicon/sec/sec_drv.o) with LLVM=1. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: keembay - publish OF module alias for OCS AES/SM4Can Peng1-0/+1
The Keem Bay OCS AES/SM4 driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Although the match table lives in keembay-ocs-aes-core.o, that object is part of the composite keembay-ocs-aes module. Add the missing MODULE_DEVICE_TABLE(of, ...) entry so modpost can generate OF module alias information for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4") Signed-off-by: Can Peng <pengcan@kylinos.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: keembay - Initialize completion before requesting IRQLinmao Li1-2/+2
kmb_ocs_aes_probe() requests the device IRQ before initializing irq_completion. Once the handler is registered it can run immediately, and ocs_aes_irq_handler() unconditionally calls complete(). An interrupt in this window would therefore use an uninitialized completion. Initialize the completion before requesting the IRQ, as the sibling OCS HCU and ECC drivers already do. Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-22crypto: ccp: Treat bitmap size as allocation failureYury Norov2-2/+2
bitmap_find_next_zero_area() uses an out-of-range return value to indicate failure. Accept only offsets strictly below the bitmap size so the callers do not depend on the exact failure sentinel. Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-17crypto: qce - Mark QCE as BROKENDemi Marie Obenour1-1/+5
This driver is harmful: - It is much slower than the CPU [1] [2]. - It Has a history of bugs [2] [3]. - It does not have exclusive access to the hardware [4], causing races with the secure world. - It register its implementations with too low a cra_priority for them to be actually used [5]. Therefore, disable it to ensure that nobody builds it into kernels they intend to ship. In the future, the driver will be used for processing restricted media content. However, the kernel does not currently support this. Since the driver will have future uses, allow building it if COMPILE_TEST is enabled. [1]: https://lore.kernel.org/r/20250704070322.20692-1-ebiggers@kernel.org/ [2]: https://lore.kernel.org/r/20250615031807.GA81869@sol/ [3]: https://lore.kernel.org/r/20260706-qce-fix-self-tests-v5-0-86f461ff1829@oss.qualcomm.com/ [4]: https://lore.kernel.org/r/20260629-qcom-qce-cmd-descr-v20-0-56f67da84c05@oss.qualcomm.com/ [5]: https://lore.kernel.org/r/20260524204537.GB110177@quark/ Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver") Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com> Acked-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: aspeed - Propagate platform_get_irq() errorsNarasimharao Vadlamudi2-2/+2
platform_get_irq() returns a positive IRQ number on success and a negative error code on failure. aspeed_acry_probe() and aspeed_hace_probe() already detect negative returns, but both convert every failure to -ENXIO. Return the original error code so callers can handle errors such as -EPROBE_DEFER correctly. Fixes: 2f1cf4e50c95 ("crypto: aspeed - Add ACRY RSA driver") Fixes: 70513e1d6559 ("crypto: aspeed - Fix check for platform_get_irq() errors") Signed-off-by: Narasimharao Vadlamudi <ahmisaranrao@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: sl3516 - drop invalid sg_dma_len checks before DMA mappingThorsten Blum1-8/+0
sg_dma_len() is only valid after mapping the scatterlist with dma_map_sg(). However, sl3516_ce_need_fallback() checks it before the source and destination scatterlists are mapped. Thus, a stale DMA length that is not a multiple of 16 could incorrectly force a software fallback when CONFIG_NEED_SG_DMA_LENGTH=y. Remove the invalid checks; the existing scatterlist length checks are sufficient. Fixes: 46c5338db7bd ("crypto: sl3516 - Add sl3516 crypto engine") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Acked-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-ecc - avoid stale fallback key after set_secret failureThorsten Blum1-4/+4
Clear ->do_fallback before decoding a new ECDH secret and enable it only after the software fallback accepts a caller-provided private key. This avoids using a stale fallback key should crypto_kpp_set_secret() fail. Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-sha204a - clear RNG data from memoryThorsten Blum1-4/+8
In atmel_sha204a_rng_read(), use memzero_explicit() to clear the local stack variable cmd before it goes out of scope, since cmd.data may still hold the last 32 random bytes. Since atmel_sha204a_rng_done() caches work_data in hwrng::priv, and its response data is later used as RNG entropy, use kfree_sensitive() to clear the cached data on transaction failure and device removal. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-tdes - drop redundant if check in crypt_dma_stopThorsten Blum1-17/+14
The call site already checks dd->flags & TDES_FLAGS_DMA before calling atmel_tdes_crypt_dma_stop(). Remove the redundant check, return early on error, and drop the now-obsolete return variable. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-tdes - drop redundant return variable in crypt_pdc_stopThorsten Blum1-4/+2
In atmel_tdes_crypt_pdc_stop(), remove the redundant return variable and return the error directly. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-tdes - use __get_free_page in buff_initThorsten Blum1-2/+2
Replace __get_free_pages(..., 0) with __get_free_page(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: atmel-tdes - simplify fast path in crypt_startThorsten Blum1-15/+9
Fold all fast path conditions into a single boolean expression and drop any redundant checks. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-17crypto: qat - use strscpy_pad to simplify adf_service_string_to_maskThorsten Blum3-11/+8
Use strscpy_pad() to copy buf and zero-pad any trailing bytes instead of zero-initializing the local services buffer and then using strscpy() to copy into it. Also use the strscpy_pad() return value to detect string truncation instead of checking the caller-provided length. Remove the now-unused length parameters from adf_service_string_to_mask() and adf_parse_service_string(). Also remove the redundant strnlen() call in adf_get_service_mask(), which only computed the removed length argument. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-13crypto: keembay - add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-13crypto: ixp4xx - add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-13crypto: ccp - Fix memory leak in SEV INIT_EX pathAtish Patra1-3/+14
allocated pages in _init_ext_path are never freed and sev_init_ex_buffer is left pointing at the leaked memory in case of any failures during the function.. Fix by adding an error path that frees the pages and clears sev_init_ex_buffer. Make sure we only free the memory if the failure happens before the conversion. Otherwise, we may end up trying to free up converted pages in case of reclaim failure. rmp_mark_pages_firmware failures should be rare enough to avoid more code complexity to track down which pages were reclaimed/leaked vs which are not. Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled") Reported-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Atish Patra <atishp@meta.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-13crypto: ccp - Fix possible deadlock in SEV init failure pathAtish Patra1-1/+1
__sev_platform_init_handle_init_ex_path() calls rmp_mark_pages_firmware() with locked=false while the parent function of init_ex_path already acquired the sev_cmd_mutex. In the case of an RMPUPDATE failure for any page after the first, the cleanup path would invoke reclaim pages which would result in a deadlock in sev_do_cmd. Pass locked=true to honor the lock status of the parent function. Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled") Reported-by: Chris Mason <clm@meta.com> Assisted-by: Claude:claude-opus-4-6 Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled") Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Atish Patra <atishp@meta.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: keembay - Fix AEAD unregister count in error pathMyeonghun Pak1-2/+2
register_aes_algs() registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registration with crypto_engine_unregister_aeads(), but it passes ARRAY_SIZE(algs), which is the skcipher table size. Use ARRAY_SIZE(algs_aead) for the AEAD unwind path so the unregister helper iterates over the same table that was registered. Also clarify the nearby comment: the crypto registration helpers clean up algorithms registered within the same call, while this function must still unwind earlier successful registration steps. Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: rk3288 - fail ahash requests on HASH idle timeoutPengpeng Hou1-1/+6
rk_hash_run() waits for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads the digest registers and finalizes the request with the previous success value. Store the poll result and finalize the request with the timeout error before reading the digest registers. Fixes: 37bc22159c45 ("crypto: rockchip - use read_poll_timeout") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qce - Remove unsafe/deprecated algorithmsBartosz Golaszewski7-239/+20
Remove algorithms that are either unsafe or deprecated and have no in-kernel users that cannot be served by the ARM CE implementations. AES-ECB reveals plaintext patterns (identical plaintext blocks produce identical ciphertext blocks) and should not be exposed as a hardware- accelerated primitive. DES, Triple DES and HMAC-SHA1 have been deprecated for years. Remove sha1, ecb(aes), ecb(des), cbc(des), ecb(des3_ede), cbc(des3_ede), hmac(sha1) and all AEAD variants built on these primitives as well as authenc(hmac(sha256),cbc(des)). Also clean up the - now dead - code, flags and constants. Cc: stable@vger.kernel.org Acked-by: Eric Biggers <ebiggers@kernel.org> Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: mxs-dcp - fix source scatterlist length accessThorsten Blum1-1/+1
mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead. Fixes: 15b59e7c3733 ("crypto: mxs - Add Freescale MXS DCP driver") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: sa2ul - stop probe if context pool creation failsPengpeng Hou1-1/+5
sa_ul_probe() calls sa_init_mem() to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA setup, algorithm registration and child population even though later request setup depends on that pool. Stop probing when sa_init_mem() fails, and route that failure to the PM cleanup path without attempting to destroy an uncreated DMA pool. Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: caam - Remove crypto_rng interfaceEric Biggers5-268/+0
Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the CAAM support which is one of the only remaining ones. Note that the CAAM support for hwrng remains in place. That is the interface that actually matters. Note that this code also had several issues, including dlen > 65535 causing corruption of the CAAM descriptor. Cc: Gaurav Jain <gaurav.jain@nxp.com> Cc: Horia Geantă <horia.geanta@nxp.com> Cc: Pankaj Gupta <pankaj.gupta@nxp.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: sun8i-ss - Remove crypto_rng interfaceEric Biggers5-254/+0
Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ss support which is one of the only remaining ones. As usual for crypto_rng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using wait_for_completion_interruptible_timeout() without handling shutting down the DMA operation if a signal is sent. Also, it had a buffer overread bug in the line 'memcpy(ctx->seed, d + dlen, ctx->slen);'. There's no point in fixing these bugs separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable. Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG") Cc: stable@vger.kernel.org Cc: Corentin Labbe <clabbe.montjoie@gmail.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: sun8i-ce - Remove crypto_rng interfaceEric Biggers5-260/+0
Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ce support which is one of the only remaining ones. Note that the sun8i-ce support for hwrng remains in place. That is the interface that actually matters. As usual for crypto_rng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using wait_for_completion_interruptible_timeout() without handling shutting down the DMA operation if a signal is sent. There's no point in fixing this separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable. Fixes: 5eb7e9468884 ("crypto: sun8i-ce - Add support for the PRNG") Cc: stable@vger.kernel.org Cc: Corentin Labbe <clabbe.montjoie@gmail.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: ccp - Introduce SNP_VERIFY_MITIGATION commandPratik R. Sampat2-0/+180
The SEV-SNP firmware provides the SNP_VERIFY_MITIGATION command, which can be used to query the status of currently supported vulnerability mitigations and to initiate mitigations within the firmware. This command is an explicit mechanism to ascertain if a firmware mitigation is applied without needing a full RMP re-build, which is most useful in a live firmware update scenario. The firmware supports two subcommands: STATUS and VERIFY. The STATUS subcommand is used to query the supported and verified mitigation bits. The VERIFY subcommand initiates the mitigation process within the FW for the specified vulnerability. Expose a userspace interface under: /sys/firmware/sev/vulnerabilities/ - supported_mitigations (read-only): supported mitigation vector mask - verified_mitigations (read/write): current verified mask; write a vector to request VERIFY for that bit The behavior of SNP_VERIFY_MITIGATION and the pre-requisites for using it are bug-specific. Information about supported mitigations and its corresponding vector is to be published as part of the AMD Security Bulletin. See SEV-SNP Firmware ABI specifications 1.58, SNP_VERIFY_MITIGATION for more details. Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Pratik R. Sampat <prsampat@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qce - drop unused scatterlist traversal in qce_ahash_updateThorsten Blum1-26/+5
Commit df12ef60c87b ("crypto: qce/sha - Do not modify scatterlist passed along with request") removed the only use of sg_last, rendering the scatterlist traversal useless. Remove it and its local variables. Also remove the redundant hash_later check, inline the source offset, and assign the number of complete blocks directly to req->nbytes. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: crypto4xx - move ioremapping upRosen Penev1-7/+4
There's no need for devm_platform_ioremap_resource() to be so far down. In fact, putting it up allows direct return instead of having to goto some branch. Also, remove the error message as the function complains loudly itself. No need to duplicate. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-sha204a - fix heap info leak on I2C transfer failureLothar Rubusch1-1/+5
The nonblocking RNG path allocates a work_data structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng->priv and later consumed by the read path once the transaction completes. If the underlying I2C transfer fails, the completion callback is invoked with a non-zero status. In this case, the allocated work_data is not usable for producing RNG output and must not remain associated with the hwrng state. Previously, the failure path only logged a warning but left the pointer state uncleared, which can result in subsequent read attempts observing stale state and interpreting it as valid completion data. Fix this by freeing the pending work_data. The I2C transaction reports an error. This ensures that failed requests do not leave residual state behind that could be interpreted as valid RNG data on later reads. Clearing rng->priv is done at the subsequent call to nonblocking read. Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com> Assisted-by: Gemini:1.5 Pro [google] Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-ecc - reject hardware ECDH without a public keyThorsten Blum1-0/+3
The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device. However, the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. atmel_ecdh_generate_public_key() already rejects requests when no public key is cached. Add the same check to atmel_ecdh_compute_shared_secret() to prevent the device from using a private key that was not generated for the current tfm. Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-ecc - drop unused curve id from atmel_ecdh_ctxThorsten Blum1-3/+0
->curve_id is only set once, but never used - remove it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-tdes - use scatterlist length before DMA mappingThorsten Blum1-3/+2
Using sg_dma_len() is only valid after mapping the scatterlist with dma_map_sg(). However, atmel_tdes_crypt_start() uses it before mapping to compare input/output lengths and to compute the transfer count. Use the original scatterlist lengths before DMA mapping to avoid reading stale or uninitialized DMA lengths when CONFIG_NEED_SG_DMA_LENGTH=y. Drop the output scatterlist length in the fast path since it is equal to ->in_sg->length and does not change the transfer count. Fixes: 13802005d8f2 ("crypto: atmel - add Atmel DES/TDES driver") Fixes: 1f858040c2f7 ("crypto: atmel-tdes - add support for latest release of the IP (0x700)") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-ecc - clean up and improve ECDH commentsThorsten Blum1-24/+14
Improve the kerneldoc for struct atmel_ecdh_ctx by removing the stale "unsupported curves" wording, since the device only supports a single curve (P-256), and move the set_secret() constraint to the description. In atmel_ecdh_set_secret(), clarify that the device generates the private key, and drop the redundant "only supports NIST P256" comment. In atmel_ecdh_done() and atmel_ecdh_generate_public_key(), clarify the truncation comments. Also note that a P-256 public key consists of two 32-byte coordinates in atmel_ecdh_compute_shared_secret(), and remove the unnecessary fall-through comment and other redundant comments. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: atmel-i2c - improve comment in atmel_i2c_init_ecdh_cmdThorsten Blum1-3/+2
Clarify that a P-256 public key is encoded as two 32-byte coordinates. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05hwrng: qcom - Move qcom-rng.c into drivers/char/hw_random/Eric Biggers3-182/+0
Since this file just implements a hwrng driver, move it into drivers/char/hw_random/. Rename the kconfig option accordingly as well. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qcom-rng - Remove crypto_rng interfaceEric Biggers2-140/+19
qcom-rng.c exposes the same hardware through two completely separate interfaces, crypto_rng and hwrng. However, the implementation of this is buggy because it permits generation operations from these interfaces to run concurrently with each other, accessing the same registers. That is, qcom_rng_generate() synchronizes with itself but not with qcom_hwrng_read(). This results in potential repetition of output from the RNG, output of non-random values, etc. Fortunately, there's actually no point in hardware RNG drivers implementing the crypto_rng interface. It's not actually used by anything besides the "rng" algorithm type of AF_ALG, which in turn is not actually used in practice. Other crypto_rng hardware drivers are likewise being phased out, leaving just the hwrng support. Thus, remove it to simplify the code and avoid conflict (and confusion) with the hwrng interface which is the one that actually matters. Fixes: f29cd5bb64c2 ("crypto: qcom-rng - Add hw_random interface support") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qcom-rng - Allow zero as a random numberEric Biggers1-2/+0
Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random. Fixes: f29cd5bb64c2 ("crypto: qcom-rng - Add hw_random interface support") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qcom-rng - Enable clock in hwrng caseEric Biggers1-0/+16
Fix qcom-rng.c to enable the clock before accessing the hardware. Fixes: f29cd5bb64c2 ("crypto: qcom-rng - Add hw_random interface support") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qat - clear AES key schedule from stackGiovanni Cabiddu1-0/+1
qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy. Fixes: 5106dfeaeabe ("crypto: qat - add AES-XTS support for QAT GEN4 devices") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qat - cancel work on re-enable SR-IOV timeoutGiovanni Cabiddu1-0/+2
The QAT reset worker queues SR-IOV reenable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. Cancel the work on the device_sriov_wq on timeout before the stack frame unwinds. Fixes: 4469f9b23468 ("crypto: qat - re-enable sriov after pf reset") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: octeontx - use 2-arg strscpy where destination size is knownThorsten Blum2-4/+4
To simplify the code, drop explicit and hard-coded size arguments from strscpy() where the destination buffer has a fixed size and strscpy() can automatically determine it using sizeof(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: qat - use 2-arg strscpy where destination size is knownThorsten Blum5-7/+11
To simplify the code, drop explicit and hard-coded size arguments from strscpy() where the destination buffer has a fixed size and strscpy() can automatically determine it using sizeof(). Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: hisilicon - use 2-arg strscpy where destination size is knownThorsten Blum1-4/+1
To simplify the code, drop explicit and hard-coded size arguments from strscpy() where the destination buffer has a fixed size and strscpy() can automatically determine it using sizeof(). Reviewed-by: Longfang Liu <liulongfang@huawei.com> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: ccp - use 2-arg strscpy where destination size is knownThorsten Blum1-1/+1
To simplify the code, drop explicit and hard-coded size arguments from strscpy() where the destination buffer has a fixed size and strscpy() can automatically determine it using sizeof(). Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-05crypto: cavium - use 2-arg strscpy where destination size is knownThorsten Blum1-1/+2
To simplify the code, drop explicit and hard-coded size arguments from strscpy() where the destination buffer has a fixed size and strscpy() can automatically determine it using sizeof(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-03Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c ↵Uwe Kleine-König (The Capable Hub)12-12/+0
files) Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-21 06:58:30 +0000