[PATCH v3 0/4] crypto: rockchip: Add RK356x/RK3588 cryptographic offloader

[Dawid Olesinski <dawidro@gmail.com>]

This series adds support for the second-generation (V2) Rockchip
cryptographic hardware accelerator found on RK3568 and RK3588 SoCs.

The IP block provides AES (ECB, CBC, XTS) and hash (SHA-1, SHA-256,
SHA-384, SHA-512, MD5, SM3) offload via an LLI-based DMA engine.

The series is ordered as required: binding first, then driver, then
the two DTS nodes that reference the binding.

A prerequisite patch removing SECURECRU reset definitions from the
non-secure CRU driver is sent separately to the clk/reset tree, as it
touches a different subsystem. That patch is not a hard dependency for
the driver to build or load, but it is needed for correctness on RK3588:
those register offsets map into TrustZone-protected MMIO and must not be
accessed directly by Linux.

This work started from unmerged patches by Corentin Labbe
<clabbe@baylibre.com> posted at:
https://patchew.org/linux/20231107155532.3747113-1-clabbe@baylibre.com/

The implementation has been substantially reworked. Notable changes from
Corentin's original series:
  - DMA descriptor race condition and DMA mapping leak on timeout fixed
  - Per-device algorithm copy replaces global device list, removing a
    locking bottleneck and correctly supporting multiple instances
  - Runtime PM autosuspend added; clocks and reset gated between requests
  - Multi-SG hash requests routed to software fallback (hardware padding
    engine requires total message length upfront and cannot maintain
    state across LLI boundaries)
  - Hardware interrupt enable register write corrected to use the
    HIWORD_UPDATE mask that the hardware requires
  - Software fallback for all registered algorithms; statesize promotion
    for export/import compatibility with ARM Crypto Extensions drivers
  - SCMI reset and clock references in DTS corrected for RK3588

Tested-by: Diederik de Haas <diederik@cknow-tech.com>
Quartz64-B (RK3566), NanoPi R5S (RK3568), NanoPC-T6 LTS (RK3588)

Tested on Orange Pi 5 Pro (RK3588S) and Banana Pi R2 Pro (RK3568).

All ten algorithm selftests pass. AES-CBC throughput measured
at ~100 MiB/s with cryptsetup. PM autosuspend/resume verified over 1000
consecutive hash requests with no errors. 20 modprobe/rmmod cycles
produce no DMA coherent memory leaks.

Patch series for the crypto subsystem:
  [1/4] dt-bindings: crypto: rockchip: Add RK356x/RK3588 crypto engine
  binding
  [2/4] crypto: rockchip: Add RK356x/RK3588 cryptographic offloader driver
  [3/4] arm64: dts: rockchip: Add crypto node to rk356x-base
  [4/4] arm64: dts: rockchip: Add crypto node to rk3588-base

Separate patch for clk/reset tree:
  clk: rockchip: rk3588: Remove SECURECRU reset definitions

Changes in v3:
  Device tree binding (Sebastian Reichel, Heiko Stübner, sashiko-bot):
    - Merge the compatibles: rk3588-crypto now falls back to
      rk3568-crypto (oneOf schema). The driver binds only against
      rockchip,rk3568-crypto; the rk3588 string is reserved for future
      quirks.
    - Allow up to three reset lines (core/aclk/hclk) instead of a single
      reset, so a complete node describing the AXI and AHB resets
      validates.
    - Drop "status = disabled" from the crypto nodes in both
      rk356x-base.dtsi and rk3588-base.dtsi; the block needs no
      board-specific resources.

  Driver (sashiko-bot):
    - Add SYSTEM_SLEEP_PM_OPS (pm_runtime_force_suspend /
      pm_runtime_force_resume) so the hardware is suspended correctly
      across system sleep even inside the autosuspend window.
    - Guard the interrupt handler with pm_runtime_get_if_active() and
      balance pm_runtime_put() on all return paths, preventing register
      access to unclocked hardware during the teardown window.
    - Allocate the per-device algorithm array with kmemdup() instead of
      devm_kmemdup() and free it explicitly in remove() after the engine
      is drained and algorithms are unregistered, so the templates
      outlive any in-flight teardown.
    - Drop the explicit crypto_engine_stop() in remove(); rely on
      crypto_engine_exit() to stop and synchronously drain the kworker.
    - On skcipher DMA timeout, assert reset and synchronize_irq() before
      unmapping the scatterlists, so delayed hardware cannot write to
      unmapped memory.
    - Add CRYPTO_ALG_TYPE_AHASH support to rk2_crypto_debugfs_stats_show()
      to print request and fallback counters for hash algorithms.

  Driver - cleanup (Diederik de Haas):
    - Remove the redundant is_xts template field; test
      rk2_mode == RK2_CRYPTO_AES_XTS directly.

  Driver — correctness and robustness (review round 2):
    - Use explicit 32-bit DMA address handling: wrap sg_dma_address()
      and the LLI base in lower_32_bits() for both the skcipher and
      hash descriptor programming, making the hardware's 32-bit
      limitation explicit and silencing sparse on 64-bit builds.
    - Fix AES-XTS IV handling: req->iv is the XTS tweak, not a CBC-style
      chaining IV, so it must not be overwritten with ciphertext. Gate
      the backup_iv save/restore on a single update_iv flag that
      excludes XTS, leaving the tweak untouched across chained requests.
    - Zero ctx->key (memzero_explicit) and reset keylen when the
      fallback setkey fails, for both rk2_aes_setkey() and
      rk2_aes_xts_setkey().
    - Harden the IRQ/PM suspend path: mask and clear DMA interrupts in
      rk2_crypto_pm_suspend() and re-clear/re-enable them in
      rk2_crypto_pm_resume(), so a pending level-triggered interrupt in
      the suspend window cannot storm.
    - Use crypto_skcipher_set_reqsize() / crypto_ahash_set_reqsize()
      instead of assigning tfm->reqsize directly.
    - Align DMA interrupt bit names in rk2_crypto.h (bits 1–6) with the TRM
      v1.0 specification.
    - Update rk2_crypto_irq_handle() inline comment to reference
      DST_ITEM_DONE and SRC_ITEM_DONE.

  Driver — cleanup:
    - Simplify the hash path to a single scatterlist element (multi-SG
      hash already falls back), removing the now-dead LLI loop.
    - Name the AES-192 capability bit (RK2_AES_VER_SUPP_192) and comment
      it, instead of a bare BIT(17) in the debug info dump.

v2: https://lore.kernel.org/r/20260708175837.1718437-1-dawidro@gmail.com

Changes in v2:
 - dt-bindings: wrap example in a bus node with #address/#size-cells = 2
   and add the SCMI clock/reset dt-binding includes so dt_binding_check
   passes (Rob Herring / Krzysztof Kozlowski review).
 - crypto: fix Kconfig to select CRYPTO_SM3 instead of the non-existent
   CRYPTO_SM3_GENERIC.
 - crypto: drop IRQF_SHARED (the line is dedicated) and request the IRQ
   only after clocks are enabled and the completion is initialised;
   reorder probe accordingly.
 - crypto: set a 32-bit DMA mask before allocating the descriptor table.
 - crypto: suspend the device explicitly on removal before disabling
   runtime PM to avoid leaking clocks.
 - crypto: call synchronize_irq() on the DMA timeout paths to close a
   race with delayed interrupts.
 - crypto: convert fallback statistics to atomic_long_t.
 - crypto: use cpu_to_le32() for all LLI descriptor fields (big-endian
   correctness).
 - crypto: read key/IV with get_unaligned_be32() to fix an alignment
   fault and a big-endian double-swap.
 - crypto: fix the CBC/XTS IV backup offset to use the processed length
   instead of the scatterlist capacity.
 - arm64: dts: rk356x: move the crypto node into unit-address order.

v1: https://lore.kernel.org/r/20260530160704.3453555-1-dawidro@gmail.com/

Build/rebase fixes (not from review):
 - crypto: use sizeof(struct sm3_ctx) for the SM3 statesize, as
   struct sm3_state was removed by the lib/crypto SM3 conversion.
 - crypto: add the missing SHA-224 zero-message case.

Dawid Olesinski (4):
  dt-bindings: crypto: rockchip: Add RK356x/RK3588 crypto engine binding
  crypto: rockchip: Add RK356x/RK3588 cryptographic offloader driver
  arm64: dts: rockchip: Add crypto node to rk356x-base
  arm64: dts: rockchip: Add crypto node to rk3588-base

 .../crypto/rockchip,rk3588-crypto.yaml        |  83 ++
 MAINTAINERS                                   |   2 +
 arch/arm64/boot/dts/rockchip/rk356x-base.dtsi |  11 +
 arch/arm64/boot/dts/rockchip/rk3588-base.dtsi |  11 +
 drivers/crypto/Kconfig                        |  32 +
 drivers/crypto/Makefile                       |   1 +
 drivers/crypto/rockchip/Makefile              |   5 +
 drivers/crypto/rockchip/rk2_crypto.c          | 783 ++++++++++++++++++
 drivers/crypto/rockchip/rk2_crypto.h          | 254 ++++++
 drivers/crypto/rockchip/rk2_crypto_ahash.c    | 541 ++++++++++++
 drivers/crypto/rockchip/rk2_crypto_skcipher.c | 740 +++++++++++++++++
 11 files changed, 2463 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/crypto/rockchip,rk3588-crypto.yaml
 create mode 100644 drivers/crypto/rockchip/rk2_crypto.c
 create mode 100644 drivers/crypto/rockchip/rk2_crypto.h
 create mode 100644 drivers/crypto/rockchip/rk2_crypto_ahash.c
 create mode 100644 drivers/crypto/rockchip/rk2_crypto_skcipher.c

-- 
2.47.3