* [PATCH v8 01/14] crypto: qce - Fix HMAC self-test failures for empty messages
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 02/14] crypto: qce - Reject empty messages for AES-XTS Bartosz Golaszewski
` (13 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
BAM DMA cannot process zero-length transfers, so the driver always holds
back at least one byte to submit to the engine and only ever finalizes
with an empty buffer when nothing is left to submit. For plain hashes
this was handled by returning the precomputed hash of the empty message
(tmpl->hash_zero), but HMAC's result depends on the key and cannot be
constant, so hmac(sha256) produced an incorrect digest for an empty
message and the crypto self-tests failed.
A zero pending buffer at finalization time does not necessarily mean the
message itself is empty, though: the caller can also reach it by
importing a state that already reflects some hashed data with nothing
currently buffered (crypto_ahash_import() followed directly by
finalization). Special-casing only a genuinely empty message would
silently compute the wrong result for an imported state in that
scenario.
Handle every zero-length finalization consistently through the software
fallback ahash instead. When nothing has been processed yet, let the
fallback compute the result from scratch using the key already propagated
to it via setkey(). Otherwise, reconstruct the fallback's running hash
state from the state kept by the driver and finalize from there,
accounting for the HMAC ipad block that the engine absorbs internally and
that never goes through update().
Cc: stable@vger.kernel.org
Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/common.h | 1 -
drivers/crypto/qce/sha.c | 58 +++++++++++++++++++++++++++++++++------------
2 files changed, 43 insertions(+), 16 deletions(-)
diff --git a/drivers/crypto/qce/common.h b/drivers/crypto/qce/common.h
index 9cd2e6ed8bbb0f76e24be187d8ae7e2fe2f7b932..587d349da91d1faa2bed7cd488306d4358467b2d 100644
--- a/drivers/crypto/qce/common.h
+++ b/drivers/crypto/qce/common.h
@@ -82,7 +82,6 @@ struct qce_alg_template {
struct aead_alg aead;
} alg;
struct qce_device *qce;
- const u8 *hash_zero;
const u32 digest_size;
};
diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index 406c33532612f0b37300abfc9c8c13e43d0c0392..a9a55bc5bc310d82a52b5637655007990da5b7a8 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -249,18 +249,53 @@ static int qce_ahash_update(struct ahash_request *req)
return qce->async_req_enqueue(tmpl->qce, &req->base);
}
+/*
+ * BAM DMA cannot handle zero-length transfers, so the driver always holds
+ * back at least one byte to submit to the engine. A zero rctx->buflen at
+ * finalization time does not necessarily mean the message is empty: the
+ * caller may have imported a state that already reflects some hashed data
+ * with nothing currently buffered. Handle both cases through the software
+ * fallback: reconstruct the running state when there is one instead of
+ * assuming the message is empty.
+ */
+static int qce_ahash_finalize_zero(struct ahash_request *req)
+{
+ struct qce_sha_reqctx *rctx = ahash_request_ctx_dma(req);
+ HASH_FBREQ_ON_STACK(fbreq, req);
+ struct __sha256_ctx core;
+ struct scatterlist sg;
+ int ret;
+
+ sg_init_one(&sg, NULL, 0);
+ ahash_request_set_crypt(fbreq, &sg, req->result, 0);
+
+ if (rctx->first_blk) {
+ ret = crypto_ahash_init(fbreq) ?: crypto_ahash_finup(fbreq);
+ } else {
+ core = (struct __sha256_ctx){
+ .bytecount = rctx->count,
+ };
+
+ memcpy(&core.state, rctx->digest, sizeof(core.state));
+ if (IS_SHA_HMAC(rctx->flags))
+ core.bytecount += SHA256_BLOCK_SIZE;
+
+ ret = crypto_ahash_import_core(fbreq, &core) ?:
+ crypto_ahash_finup(fbreq);
+ }
+
+ HASH_REQUEST_ZERO(fbreq);
+ return ret;
+}
+
static int qce_ahash_final(struct ahash_request *req)
{
struct qce_sha_reqctx *rctx = ahash_request_ctx_dma(req);
struct qce_alg_template *tmpl = to_ahash_tmpl(req->base.tfm);
struct qce_device *qce = tmpl->qce;
- if (!rctx->buflen) {
- if (tmpl->hash_zero)
- memcpy(req->result, tmpl->hash_zero,
- tmpl->alg.ahash.halg.digestsize);
- return 0;
- }
+ if (!rctx->buflen)
+ return qce_ahash_finalize_zero(req);
rctx->last_blk = true;
@@ -292,12 +327,8 @@ static int qce_ahash_digest(struct ahash_request *req)
rctx->first_blk = true;
rctx->last_blk = true;
- if (!rctx->nbytes_orig) {
- if (tmpl->hash_zero)
- memcpy(req->result, tmpl->hash_zero,
- tmpl->alg.ahash.halg.digestsize);
- return 0;
- }
+ if (!rctx->nbytes_orig)
+ return qce_ahash_finalize_zero(req);
return qce->async_req_enqueue(tmpl->qce, &req->base);
}
@@ -431,9 +462,6 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,
alg->halg.digestsize = def->digestsize;
alg->halg.statesize = def->statesize;
- if (IS_SHA256(def->flags))
- tmpl->hash_zero = sha256_zero_message_hash;
-
base = &alg->halg.base;
base->cra_blocksize = def->blocksize;
base->cra_priority = 400;
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 02/14] crypto: qce - Reject empty messages for AES-XTS
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 01/14] crypto: qce - Fix HMAC self-test failures for empty messages Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 03/14] crypto: qce - Fix CTR-AES for partial block requests Bartosz Golaszewski
` (12 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
XTS is not defined for an empty plaintext: it requires at least one full
block of data. The driver treated a zero-length request as a successful
no-op, so the crypto self-tests "unexpectedly succeeded" when -EINVAL
was expected.
Return -EINVAL for empty XTS requests while keeping the no-op behavior
for the other ciphers, which the crypto engine simply cannot process due
to its DMA not supporting zero-length transfers.
Cc: stable@vger.kernel.org
Fixes: f08789462255 ("crypto: qce - Return error for zero length messages")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/skcipher.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 84263ddbd62733f4d1ed42a2b94ae9f4d0d5c6df..b49c1aeb0d27d4798e3e3d0b30299f48ef8ae453 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -222,8 +222,12 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt)
keylen = IS_XTS(rctx->flags) ? ctx->enc_keylen >> 1 : ctx->enc_keylen;
/* CE does not handle 0 length messages */
- if (!req->cryptlen)
+ if (!req->cryptlen) {
+ /* XTS requires at least one full block of data */
+ if (IS_XTS(rctx->flags))
+ return -EINVAL;
return 0;
+ }
/*
* ECB and CBC algorithms require message lengths to be
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 03/14] crypto: qce - Fix CTR-AES for partial block requests
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 01/14] crypto: qce - Fix HMAC self-test failures for empty messages Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 02/14] crypto: qce - Reject empty messages for AES-XTS Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 04/14] crypto: qce - Use a fallback for AES-CTR with a partial final block Bartosz Golaszewski
` (11 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
From: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
In CTR mode, the IV acts as the initial counter block.
APer NIST SP 800-38A, after a CTR mode operation the next unused counter
value is:
IV_next = IV_in + ceil(cryptlen / AES_BLOCK_SIZE)
The skcipher requires req->iv to hold this updated counter on
completion, ensuring chained requests produce correct results.
Referring to Crypto6.0 documentation, Section 2.2.5 says:
"The count value increments automatically once per block of data (in
AES, a block is 16 bytes) based on the value in the
CRYPTO_ENCR_CNTR_MASK registers."
QCE increments internal counter register once per full 16-byte block(for
ctr-aes) is processed. In case of partial request length, the hardware
uses the current counter to generate keystreams but does not increment
the counter register afterwards. So the counter value written in
CRYPTO_ENCR_CNTRn_IVn later once read by software is one less than the
expected value.
Crypto selftest framework capture this scenario with test vector
4 comprising of a 499-byte payload (31 full blocks + 3 partial bytes).
Error:
[ 5.606169] alg: skcipher: ctr-aes-qce encryption test failed (wrong output IV) on test vector 4, cfg="in-place (one sglist)"
[ 5.606176] 00000000: e7 82 1d b8 53 11 ac 47 e2 7d 18 d6 71 0c a7 61
[ 5.606192] alg: self-tests for ctr(aes) using ctr-aes-qce failed (rc=-22)
Expected iv_out: 0x62 (iv_in + 32)
Obtained iv_out: 0x61 (iv_in + 31, partial block not counted)
To fix this, just increase the counter value for partial block requests
by 1 and for the full block size requests, don't take any action as
expected value is already returned by the hardware.
Cc: stable@vger.kernel.org
Fixes: 3e806a12d10a ("crypto: qce - update the skcipher IV")
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/skcipher.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index b49c1aeb0d27d4798e3e3d0b30299f48ef8ae453..0a872beff4807e6e5af612e336630ea7a36e203e 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -33,6 +33,7 @@ static void qce_skcipher_done(void *data)
struct qce_device *qce = tmpl->qce;
struct qce_result_dump *result_buf = qce->dma.result_buf;
enum dma_data_direction dir_src, dir_dst;
+ unsigned int blocks;
u32 status;
int error;
bool diff_dst;
@@ -56,7 +57,21 @@ static void qce_skcipher_done(void *data)
if (error < 0)
dev_dbg(qce->dev, "skcipher operation error (%x)\n", status);
- memcpy(rctx->iv, result_buf->encr_cntr_iv, rctx->ivsize);
+ if (IS_CTR(rctx->flags)) {
+ /*
+ * QCE hardware does not increment the counter for a partial
+ * final block. Increment it in software so that iv_out
+ * reflects the correct next counter value expected by the CTR
+ * mode.
+ */
+ blocks = DIV_ROUND_UP(rctx->cryptlen, AES_BLOCK_SIZE);
+
+ while (blocks--)
+ crypto_inc(rctx->iv, rctx->ivsize);
+ } else {
+ memcpy(rctx->iv, result_buf->encr_cntr_iv, rctx->ivsize);
+ }
+
qce->async_req_done(tmpl->qce, error);
}
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 04/14] crypto: qce - Use a fallback for AES-CTR with a partial final block
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (2 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 03/14] crypto: qce - Fix CTR-AES for partial block requests Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 05/14] crypto: qce - Use fallback for fragmented skcipher payloads Bartosz Golaszewski
` (10 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
ctr(aes) is registered with a block size of 1, so the crypto API hands
the driver requests whose length is not a multiple of the AES block
size. The crypto engine, however, stalls waiting for a full block of
input in that case, leaving the operation incomplete and failing the
request (and the crypto self-tests) with a hardware operation error.
Route AES-CTR requests with a partial final block to the software
fallback, which already handles the other cases the engine cannot.
Cc: stable@vger.kernel.org
Fixes: bb5c863b3d3c ("crypto: qce - fix ctr-aes-qce block, chunk sizes")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/skcipher.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 0a872beff4807e6e5af612e336630ea7a36e203e..e2ca2f7a6eea1129edb724fe30659d55aaae8190 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -259,9 +259,12 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt)
* AES-XTS request with len > QCE_SECTOR_SIZE and
* is not a multiple of it.(Revisit this condition to check if it is
* needed in all versions of CE)
+ * AES-CTR with a partial final block (the CE stalls waiting for a full
+ * block of input).
*/
if (IS_AES(rctx->flags) &&
((keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_256) ||
+ (IS_CTR(rctx->flags) && !IS_ALIGNED(req->cryptlen, AES_BLOCK_SIZE)) ||
(IS_XTS(rctx->flags) && ((req->cryptlen <= aes_sw_max_len) ||
(req->cryptlen > QCE_SECTOR_SIZE &&
req->cryptlen % QCE_SECTOR_SIZE))))) {
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 05/14] crypto: qce - Use fallback for fragmented skcipher payloads
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (3 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 04/14] crypto: qce - Use a fallback for AES-CTR with a partial final block Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 06/14] crypto: qce - Fix xts-aes-qce for weak keys Bartosz Golaszewski
` (9 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
The crypto engine reliably processes AES requests only when the payload
is a single contiguous buffer. A payload split across multiple
scatterlist entries makes the engine stall waiting for input, failing
the request with a hardware operation error. This was uncovered by the
crypto self-tests, which feed the algorithms randomly fragmented
buffers.
Detect a payload that spans more than one scatterlist entry, in either
the source or the destination, and route the request to the software
fallback.
Cc: stable@vger.kernel.org
Fixes: 25b71d61d631 ("crypto: qce - Improve the conditions for requesting AES fallback cipher")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/skcipher.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index e2ca2f7a6eea1129edb724fe30659d55aaae8190..4b7545e6aed220b7fb5af7dbf20ab47db5d1d180 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -261,13 +261,17 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt)
* needed in all versions of CE)
* AES-CTR with a partial final block (the CE stalls waiting for a full
* block of input).
+ * A payload fragmented across more than one scatterlist entry (the CE
+ * stalls waiting for input in that case too).
*/
if (IS_AES(rctx->flags) &&
((keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_256) ||
(IS_CTR(rctx->flags) && !IS_ALIGNED(req->cryptlen, AES_BLOCK_SIZE)) ||
(IS_XTS(rctx->flags) && ((req->cryptlen <= aes_sw_max_len) ||
(req->cryptlen > QCE_SECTOR_SIZE &&
- req->cryptlen % QCE_SECTOR_SIZE))))) {
+ req->cryptlen % QCE_SECTOR_SIZE))) ||
+ sg_nents_for_len(req->src, req->cryptlen) > 1 ||
+ sg_nents_for_len(req->dst, req->cryptlen) > 1)) {
skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
skcipher_request_set_callback(&rctx->fallback_req,
req->base.flags,
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 06/14] crypto: qce - Fix xts-aes-qce for weak keys
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (4 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 05/14] crypto: qce - Use fallback for fragmented skcipher payloads Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 07/14] crypto: qce - Use a fallback for CCM with a partial final block Bartosz Golaszewski
` (8 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
From: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
The QCE hardware does not support AES XTS mode when key1 and key2 are
equal. The driver was handling this by unconditionally rejecting the
keys with -ENOKEY(-126), regardless of whether FIPS mode is active or
the FORBID_WEAK_KEYS flag is set.
[ 5.599170] alg: skcipher: xts-aes-qce setkey failed on test vector 0; expected_error=0, actual_error=-126, flags=0x1
[ 5.599184] alg: self-tests for xts(aes) using xts-aes-qce failed (rc=-126)
In general for weak keys,
- If FIPS mode is active or FORBID_WEAK_KEYS is set: return -EINVAL.
- In non-FIPS mode, Accept the key and encrypt successfully.
Since QCE was returning -ENOKEY for non-FIPS mode whereas the
expectation is to encrypt content and return success, the selftest saw a
mismatch and failed.
There are two problems in QCE behavior:
* -ENOKEY is returned instead of -EINVAL for the FIPS/weak-key
rejection case.
* key1 == key2 is rejected even in non-FIPS mode
Fix xts-aes-qce behavior by using generic helper xts_verify_key() to
reject keys early with -EINVAL for FIPS mode active(or FORBID_WEAK_KEYS
set). For non-FIPS mode, since QCE hardware cannot accept the keys, use
software fallback mechanism to encrypt the data.
Cc: stable@vger.kernel.org
Fixes: f0d078dd6c49 ("crypto: qce - Return unsupported if key1 and key 2 are same for AES XTS algorithm")
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/cipher.h | 1 +
drivers/crypto/qce/skcipher.c | 18 ++++++++++++------
2 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/qce/cipher.h b/drivers/crypto/qce/cipher.h
index 850f257d00f3aca0397adc1f703aea690c754d60..daea07551118d444d2f749588bdfe2ae2c6c553f 100644
--- a/drivers/crypto/qce/cipher.h
+++ b/drivers/crypto/qce/cipher.h
@@ -14,6 +14,7 @@
struct qce_cipher_ctx {
u8 enc_key[QCE_MAX_KEY_SIZE];
unsigned int enc_keylen;
+ bool use_fallback;
struct crypto_skcipher *fallback;
};
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 4b7545e6aed220b7fb5af7dbf20ab47db5d1d180..35bd59656931c5f12614405490f1e254849b9eb5 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -12,6 +12,7 @@
#include <linux/errno.h>
#include <crypto/aes.h>
#include <crypto/internal/skcipher.h>
+#include <crypto/xts.h>
#include "cipher.h"
@@ -194,14 +195,17 @@ static int qce_skcipher_setkey(struct crypto_skcipher *ablk, const u8 *key,
if (!key || !keylen)
return -EINVAL;
- /*
- * AES XTS key1 = key2 not supported by crypto engine.
- * Revisit to request a fallback cipher in this case.
- */
if (IS_XTS(flags)) {
+ ret = xts_verify_key(ablk, key, keylen);
+ if (ret)
+ return ret;
__keylen = keylen >> 1;
- if (!memcmp(key, key + __keylen, __keylen))
- return -ENOKEY;
+ /*
+ * QCE does not support key1 == key2 for XTS.
+ * Use fallback cipher in this case.
+ */
+ ctx->use_fallback = !crypto_memneq(key, key + __keylen,
+ __keylen);
} else {
__keylen = keylen;
}
@@ -261,6 +265,7 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt)
* needed in all versions of CE)
* AES-CTR with a partial final block (the CE stalls waiting for a full
* block of input).
+ * AES-XTS with key1 == key2 (not supported by the CE).
* A payload fragmented across more than one scatterlist entry (the CE
* stalls waiting for input in that case too).
*/
@@ -270,6 +275,7 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt)
(IS_XTS(rctx->flags) && ((req->cryptlen <= aes_sw_max_len) ||
(req->cryptlen > QCE_SECTOR_SIZE &&
req->cryptlen % QCE_SECTOR_SIZE))) ||
+ (IS_XTS(rctx->flags) && ctx->use_fallback) ||
sg_nents_for_len(req->src, req->cryptlen) > 1 ||
sg_nents_for_len(req->dst, req->cryptlen) > 1)) {
skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 07/14] crypto: qce - Use a fallback for CCM with a partial final block
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (5 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 06/14] crypto: qce - Fix xts-aes-qce for weak keys Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 08/14] crypto: qce - Use fallback for CCM with a fragmented payload Bartosz Golaszewski
` (7 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
CCM builds on AES-CTR for encryption, and the crypto engine stalls on a
partial final block just as it does for plain ctr(aes): a payload whose
length is not a multiple of the AES block size leaves the operation
incomplete and fails with a hardware operation error. This was caught by
the ccm(aes) crypto self-tests.
Force the software fallback for CCM requests whose message length is not
block aligned, reusing the driver's existing need_fallback mechanism.
Cc: stable@vger.kernel.org
Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/aead.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index 2324aeb4d4d90f30f999108be00a0d98e4f67b43..dad2478bae0e2aa70d31c5f3c7b37003e9e15e2b 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -514,6 +514,14 @@ static int qce_aead_crypt(struct aead_request *req, int encrypt)
ctx->need_fallback = true;
}
+ /*
+ * CCM uses AES-CTR internally and the CE stalls on a partial final
+ * block, so a payload that is not a multiple of the block size has to
+ * be handled by the fallback.
+ */
+ if (IS_CCM(rctx->flags) && !IS_ALIGNED(rctx->cryptlen, AES_BLOCK_SIZE))
+ ctx->need_fallback = true;
+
/* If fallback is needed, schedule and exit */
if (ctx->need_fallback) {
/* Reset need_fallback in case the same ctx is used for another transaction */
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 08/14] crypto: qce - Use fallback for CCM with a fragmented payload
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (6 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 07/14] crypto: qce - Use a fallback for CCM with a partial final block Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 09/14] crypto: qce - Only register algos if the user really wants it Bartosz Golaszewski
` (6 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
The crypto engine reliably processes CCM only when the message payload
is a single contiguous buffer. The associated data is already linearized
into a bounce buffer before being submitted, but when the payload itself
is split across multiple scatterlist entries the engine stalls waiting
for input and the request fails with a hardware operation error. This
was uncovered by the crypto self-tests, which feed the algorithms
randomly fragmented buffers.
Detect a payload that spans more than one scatterlist entry (in either
the source or the destination, skipping past the associated data) and
route the request to the software fallback.
Cc: stable@vger.kernel.org
Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
Tested-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/aead.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index dad2478bae0e2aa70d31c5f3c7b37003e9e15e2b..a38f7f9854437a923b8fffb3dbddbfc0e3b44b97 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -498,7 +498,8 @@ static int qce_aead_crypt(struct aead_request *req, int encrypt)
struct qce_aead_reqctx *rctx = aead_request_ctx_dma(req);
struct qce_aead_ctx *ctx = crypto_aead_ctx(tfm);
struct qce_alg_template *tmpl = to_aead_tmpl(tfm);
- unsigned int blocksize = crypto_aead_blocksize(tfm);
+ unsigned int blocksize = crypto_aead_blocksize(tfm), authsize;
+ struct scatterlist __sg[2], *msg_sg;
rctx->flags = tmpl->alg_flags;
rctx->flags |= encrypt ? QCE_ENCRYPT : QCE_DECRYPT;
@@ -522,6 +523,27 @@ static int qce_aead_crypt(struct aead_request *req, int encrypt)
if (IS_CCM(rctx->flags) && !IS_ALIGNED(rctx->cryptlen, AES_BLOCK_SIZE))
ctx->need_fallback = true;
+ /*
+ * The CE reliably processes CCM only when the message payload is a
+ * single contiguous buffer. The associated data is linearized into a
+ * bounce buffer before being handed to the engine, but a fragmented
+ * payload makes the engine stall waiting for input, so route those
+ * requests to the fallback.
+ */
+ if (IS_CCM(rctx->flags) && rctx->cryptlen) {
+ authsize = ctx->authsize;
+
+ msg_sg = scatterwalk_ffwd(__sg, req->src, req->assoclen);
+ if (sg_nents_for_len(msg_sg, rctx->cryptlen +
+ (encrypt ? 0 : authsize)) > 1)
+ ctx->need_fallback = true;
+
+ msg_sg = scatterwalk_ffwd(__sg, req->dst, req->assoclen);
+ if (sg_nents_for_len(msg_sg, rctx->cryptlen +
+ (encrypt ? authsize : 0)) > 1)
+ ctx->need_fallback = true;
+ }
+
/* If fallback is needed, schedule and exit */
if (ctx->need_fallback) {
/* Reset need_fallback in case the same ctx is used for another transaction */
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 09/14] crypto: qce - Only register algos if the user really wants it
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (7 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 08/14] crypto: qce - Use fallback for CCM with a fragmented payload Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN" Bartosz Golaszewski
` (5 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski, stable
This driver's crypto algorithms still have a few issues that need
addressing which don't currently trigger any self-test failures. For
that reason: don't register the algorithms unless the user really wants
it.
Add a module parameter to the QCE driver that by default causes the
driver to *not* register the crypto algorithms. It will only be one if
the user explicitly passes the do_register_algos argument as true.
The power-management part of the driver is kept as is to allow scaling
down of interconnects gating of clocks by runtime PM.
Cc: stable@vger.kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/qce/core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/qce/core.c b/drivers/crypto/qce/core.c
index bf3c1bc3ba7bde5e5d08e06071c67ba77af95695..5b1bf7a50f88c890da1f0820fb9e070b3d3f4708 100644
--- a/drivers/crypto/qce/core.c
+++ b/drivers/crypto/qce/core.c
@@ -10,6 +10,7 @@
#include <linux/interconnect.h>
#include <linux/interrupt.h>
#include <linux/module.h>
+#include <linux/moduleparam.h>
#include <linux/platform_device.h>
#include <linux/pm.h>
#include <linux/pm_runtime.h>
@@ -22,6 +23,9 @@
#include "sha.h"
#include "aead.h"
+static bool do_register_algos;
+module_param(do_register_algos, bool, 0444);
+
#define QCE_QUEUE_LENGTH 1
#define QCE_DEFAULT_MEM_BANDWIDTH 393600
@@ -259,9 +263,11 @@ static int qce_crypto_probe(struct platform_device *pdev)
qce->async_req_enqueue = qce_async_request_enqueue;
qce->async_req_done = qce_async_request_done;
- ret = devm_qce_register_algs(qce);
- if (ret)
- return ret;
+ if (do_register_algos) {
+ ret = devm_qce_register_algs(qce);
+ if (ret)
+ return ret;
+ }
/* Configure autosuspend after successful init */
pm_runtime_set_autosuspend_delay(dev, 100);
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN"
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (8 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 09/14] crypto: qce - Only register algos if the user really wants it Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-22 5:42 ` Demi Marie Obenour
2026-09-21 12:58 ` [PATCH v8 11/14] crypto: qce - convert to auxiliary bus Bartosz Golaszewski
` (4 subsequent siblings)
14 siblings, 1 reply; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski
The self-tests for this driver have been fixed. The crypto algorithms
are only registered if the user explicitly requests it with the provided
module parameter defaulting to false. There's no reason to further keep
it unbuildable with the BROKEN label.
While at it: update the Kconfig description by saying this is an
"offloader" and not an "accelerator".
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
arch/arm/configs/multi_v7_defconfig | 1 +
arch/arm64/configs/defconfig | 1 +
drivers/crypto/Kconfig | 16 ++++++++--------
3 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index f9b8dbf9318c9d4947e56ef0159311634bf0c1ee..2d6292f8cab39596b540084fbd8b30f4c25cd4ff 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -1323,6 +1323,7 @@ CONFIG_CRYPTO_DEV_ATMEL_AES=m
CONFIG_CRYPTO_DEV_ATMEL_TDES=m
CONFIG_CRYPTO_DEV_ATMEL_SHA=m
CONFIG_CRYPTO_DEV_MARVELL_CESA=m
+CONFIG_CRYPTO_DEV_QCE=m
CONFIG_CRYPTO_DEV_ROCKCHIP=m
CONFIG_CRYPTO_DEV_STM32_HASH=m
CONFIG_CRYPTO_DEV_STM32_CRYP=m
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 982ea1758eb667a1949721140961764b3e9be1f6..55a2e8c3ae3522630df8c31cb2b7c7663e973aed 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -1957,6 +1957,7 @@ CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
CONFIG_CRYPTO_DEV_SUN8I_CE=m
CONFIG_CRYPTO_DEV_FSL_CAAM=m
CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=m
+CONFIG_CRYPTO_DEV_QCE=m
CONFIG_CRYPTO_DEV_TEGRA=m
CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
CONFIG_CRYPTO_DEV_ZYNQMP_SHA3=m
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 0189dfdcbbe11098ead0ea194293422a31d8fe65..baf6c4a4c8aed663e89ae2468a7e9ed9dcb66f34 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -527,17 +527,17 @@ source "drivers/crypto/marvell/Kconfig"
source "drivers/crypto/intel/Kconfig"
config CRYPTO_DEV_QCE
- tristate "Qualcomm crypto engine accelerator"
- depends on (BROKEN && ARCH_QCOM) || COMPILE_TEST
+ tristate "Qualcomm crypto engine offloader"
+ depends on ARCH_QCOM || COMPILE_TEST
depends on HAS_IOMEM
help
- This driver supports Qualcomm crypto engine accelerator
- hardware. To compile this driver as a module, choose M here. The
- module will be called qcrypto.
+ This driver supports Qualcomm crypto engine offloader hardware. To
+ compile this driver as a module, choose M here. The module will be
+ called qcrypto.
- This driver does not have exclusive access to the
- hardware, causing races with the secure world. It
- is also slower than the CPU.
+ NOTE: This driver does not have exclusive access to the hardware,
+ causing races with the secure world. It is also *slower* than the
+ CPU for the same algorithms. Use at your own risk!
config CRYPTO_DEV_QCE_SKCIPHER
bool
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* Re: [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN"
2026-09-21 12:58 ` [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN" Bartosz Golaszewski
@ 2026-09-22 5:42 ` Demi Marie Obenour
2026-09-22 8:21 ` Bartosz Golaszewski
2026-09-22 11:58 ` Bartosz Golaszewski
0 siblings, 2 replies; 21+ messages in thread
From: Demi Marie Obenour @ 2026-09-22 5:42 UTC (permalink / raw)
To: Bartosz Golaszewski, Thara Gopinath, Herbert Xu, David S. Miller,
Stanimir Varbanov, Eneas U de Queiroz, Kuldeep Singh,
Eric Biggers, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl, linux-arm-kernel
[-- Attachment #1.1: Type: text/plain, Size: 3652 bytes --]
On 9/21/26 08:58, Bartosz Golaszewski wrote:
> The self-tests for this driver have been fixed. The crypto algorithms
> are only registered if the user explicitly requests it with the provided
> module parameter defaulting to false. There's no reason to further keep
> it unbuildable with the BROKEN label.
>
> While at it: update the Kconfig description by saying this is an
> "offloader" and not an "accelerator".
>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---
> arch/arm/configs/multi_v7_defconfig | 1 +
> arch/arm64/configs/defconfig | 1 +
> drivers/crypto/Kconfig | 16 ++++++++--------
> 3 files changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
> index f9b8dbf9318c9d4947e56ef0159311634bf0c1ee..2d6292f8cab39596b540084fbd8b30f4c25cd4ff 100644
> --- a/arch/arm/configs/multi_v7_defconfig
> +++ b/arch/arm/configs/multi_v7_defconfig
> @@ -1323,6 +1323,7 @@ CONFIG_CRYPTO_DEV_ATMEL_AES=m
> CONFIG_CRYPTO_DEV_ATMEL_TDES=m
> CONFIG_CRYPTO_DEV_ATMEL_SHA=m
> CONFIG_CRYPTO_DEV_MARVELL_CESA=m
> +CONFIG_CRYPTO_DEV_QCE=m
> CONFIG_CRYPTO_DEV_ROCKCHIP=m
> CONFIG_CRYPTO_DEV_STM32_HASH=m
> CONFIG_CRYPTO_DEV_STM32_CRYP=m
> diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
> index 982ea1758eb667a1949721140961764b3e9be1f6..55a2e8c3ae3522630df8c31cb2b7c7663e973aed 100644
> --- a/arch/arm64/configs/defconfig
> +++ b/arch/arm64/configs/defconfig
> @@ -1957,6 +1957,7 @@ CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
> CONFIG_CRYPTO_DEV_SUN8I_CE=m
> CONFIG_CRYPTO_DEV_FSL_CAAM=m
> CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=m
> +CONFIG_CRYPTO_DEV_QCE=m
> CONFIG_CRYPTO_DEV_TEGRA=m
> CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
> CONFIG_CRYPTO_DEV_ZYNQMP_SHA3=m
> diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
> index 0189dfdcbbe11098ead0ea194293422a31d8fe65..baf6c4a4c8aed663e89ae2468a7e9ed9dcb66f34 100644
> --- a/drivers/crypto/Kconfig
> +++ b/drivers/crypto/Kconfig
> @@ -527,17 +527,17 @@ source "drivers/crypto/marvell/Kconfig"
> source "drivers/crypto/intel/Kconfig"
>
> config CRYPTO_DEV_QCE
> - tristate "Qualcomm crypto engine accelerator"
> - depends on (BROKEN && ARCH_QCOM) || COMPILE_TEST
> + tristate "Qualcomm crypto engine offloader"
> + depends on ARCH_QCOM || COMPILE_TEST
> depends on HAS_IOMEM
> help
> - This driver supports Qualcomm crypto engine accelerator
> - hardware. To compile this driver as a module, choose M here. The
> - module will be called qcrypto.
> + This driver supports Qualcomm crypto engine offloader hardware. To
> + compile this driver as a module, choose M here. The module will be
> + called qcrypto.
>
> - This driver does not have exclusive access to the
> - hardware, causing races with the secure world. It
> - is also slower than the CPU.
> + NOTE: This driver does not have exclusive access to the hardware,
> + causing races with the secure world. It is also *slower* than the
> + CPU for the same algorithms. Use at your own risk!
Would it make sense to clarify that this is only an issue if you pass
do_register_algos=1? With do_register_algos=0 (the default), the
driver is perfectly safe (unless you made a mistake elsewhere) and
saves power, so most people want it on.
Also, if I understand your previous messages correctly, Linux currently
doesn't use any of the features that would cause the races with the
secure world.
> config CRYPTO_DEV_QCE_SKCIPHER
> bool
>
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN"
2026-09-22 5:42 ` Demi Marie Obenour
@ 2026-09-22 8:21 ` Bartosz Golaszewski
2026-09-22 11:58 ` Bartosz Golaszewski
1 sibling, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-22 8:21 UTC (permalink / raw)
To: Demi Marie Obenour
Cc: Bartosz Golaszewski, Thara Gopinath, Herbert Xu, David S. Miller,
Stanimir Varbanov, Eneas U de Queiroz, Kuldeep Singh,
Eric Biggers, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa, linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel
On Tue, 22 Sep 2026 07:42:28 +0200, Demi Marie Obenour
<demiobenour@gmail.com> said:
> On 9/21/26 08:58, Bartosz Golaszewski wrote:
>>
>> config CRYPTO_DEV_QCE
>> - tristate "Qualcomm crypto engine accelerator"
>> - depends on (BROKEN && ARCH_QCOM) || COMPILE_TEST
>> + tristate "Qualcomm crypto engine offloader"
>> + depends on ARCH_QCOM || COMPILE_TEST
>> depends on HAS_IOMEM
>> help
>> - This driver supports Qualcomm crypto engine accelerator
>> - hardware. To compile this driver as a module, choose M here. The
>> - module will be called qcrypto.
>> + This driver supports Qualcomm crypto engine offloader hardware. To
>> + compile this driver as a module, choose M here. The module will be
>> + called qcrypto.
>>
>> - This driver does not have exclusive access to the
>> - hardware, causing races with the secure world. It
>> - is also slower than the CPU.
>> + NOTE: This driver does not have exclusive access to the hardware,
>> + causing races with the secure world. It is also *slower* than the
>> + CPU for the same algorithms. Use at your own risk!
>
> Would it make sense to clarify that this is only an issue if you pass
> do_register_algos=1? With do_register_algos=0 (the default), the
> driver is perfectly safe (unless you made a mistake elsewhere) and
> saves power, so most people want it on.
>
> Also, if I understand your previous messages correctly, Linux currently
> doesn't use any of the features that would cause the races with the
> secure world.
>
Yeah, I guess it makes sense. Sashiko still says the series fails to apply, so
I need to see with Herbert if he wants me to resend or if the change you're
requesting should be a follow-up.
Bart
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN"
2026-09-22 5:42 ` Demi Marie Obenour
2026-09-22 8:21 ` Bartosz Golaszewski
@ 2026-09-22 11:58 ` Bartosz Golaszewski
1 sibling, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-22 11:58 UTC (permalink / raw)
To: Demi Marie Obenour
Cc: Bartosz Golaszewski, Thara Gopinath, Herbert Xu, David S. Miller,
Stanimir Varbanov, Eneas U de Queiroz, Kuldeep Singh,
Eric Biggers, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa, linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel
On Tue, 22 Sep 2026 07:42:28 +0200, Demi Marie Obenour
<demiobenour@gmail.com> said:
>
> Also, if I understand your previous messages correctly, Linux currently
> doesn't use any of the features that would cause the races with the
> secure world.
>
Not yet but there's an upcoming driver for OP-TEE[1] that will have the
potential for conflict. And yes: I get that there would be no problem if
we just removed the driver but the long-term plan is to use the IP for secure
media playback and I want to get the BAM pipe locking done before we get there
to get one thing off the TODO list at least. To that end: we'll be testing the
synchronization with the existing crypto algos.
Bart
[1] https://github.com/qualcomm-linux/optee_os/pull/71
^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH v8 11/14] crypto: qce - convert to auxiliary bus
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (9 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 10/14] Revert "crypto: qce - Mark QCE as BROKEN" Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 12/14] soc: qcom: add core driver for the Qualcomm Crypto Engine Bartosz Golaszewski
` (3 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski
This driver is disabled in arm64 defconfig but one of its
functionalities - scaling down the interconnect votes to 0 when unused -
will be moved to an always-enabled core qce driver. This upcoming core
driver will also be in charge of registering the qcrypto device on the
auxiliary bus so that it may be enabled if desired.
As the first step: convert the driver to using the auxiliary bus and
remove the interconnect management from the code. Update the power
management as required and make sure to use the parent struct device
for DMA.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/crypto/Kconfig | 2 +
drivers/crypto/qce/aead.c | 12 +++---
drivers/crypto/qce/core.c | 93 +++++++++++++++++++------------------------
drivers/crypto/qce/core.h | 5 ++-
drivers/crypto/qce/sha.c | 12 +++---
drivers/crypto/qce/skcipher.c | 12 +++---
6 files changed, 66 insertions(+), 70 deletions(-)
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index baf6c4a4c8aed663e89ae2468a7e9ed9dcb66f34..9d42c5f7820dc6ac54d4f2b631a93917d842fcf2 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -530,6 +530,8 @@ config CRYPTO_DEV_QCE
tristate "Qualcomm crypto engine offloader"
depends on ARCH_QCOM || COMPILE_TEST
depends on HAS_IOMEM
+ depends on PM
+ select AUXILIARY_BUS
help
This driver supports Qualcomm crypto engine offloader hardware. To
compile this driver as a module, choose M here. The module will be
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index a38f7f9854437a923b8fffb3dbddbfc0e3b44b97..6f33a89bb38436cc0b0d37b4209010b410e5201c 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -44,9 +44,9 @@ static void qce_aead_done(void *data)
dev_dbg(qce->dev, "aead dma termination error (%d)\n",
error);
if (diff_dst)
- dma_unmap_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src);
+ dma_unmap_sg(qce->dma_dev, rctx->src_sg, rctx->src_nents, dir_src);
- dma_unmap_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dma_unmap_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
if (IS_CCM(rctx->flags)) {
if (req->assoclen) {
@@ -442,14 +442,14 @@ qce_aead_async_req_handle(struct crypto_async_request *async_req)
if (ret)
return ret;
- dst_nents = dma_map_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dst_nents = dma_map_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
if (!dst_nents) {
ret = -EIO;
goto error_free;
}
if (diff_dst) {
- src_nents = dma_map_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src);
+ src_nents = dma_map_sg(qce->dma_dev, rctx->src_sg, rctx->src_nents, dir_src);
if (src_nents < 0) {
ret = src_nents;
goto error_unmap_dst;
@@ -478,9 +478,9 @@ qce_aead_async_req_handle(struct crypto_async_request *async_req)
qce_dma_terminate_all(&qce->dma);
error_unmap_src:
if (diff_dst)
- dma_unmap_sg(qce->dev, req->src, rctx->src_nents, dir_src);
+ dma_unmap_sg(qce->dma_dev, req->src, rctx->src_nents, dir_src);
error_unmap_dst:
- dma_unmap_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dma_unmap_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
error_free:
if (IS_CCM(rctx->flags) && rctx->assoclen) {
sg_free_table(&rctx->src_tbl);
diff --git a/drivers/crypto/qce/core.c b/drivers/crypto/qce/core.c
index 5b1bf7a50f88c890da1f0820fb9e070b3d3f4708..31f1ad8938ab3bbe76b2ae4799eb2797efe704ed 100644
--- a/drivers/crypto/qce/core.c
+++ b/drivers/crypto/qce/core.c
@@ -3,15 +3,16 @@
* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
*/
+#include <linux/auxiliary_bus.h>
#include <linux/cleanup.h>
#include <linux/clk.h>
#include <linux/device.h>
+#include <linux/device-id/auxiliary.h>
#include <linux/dma-mapping.h>
-#include <linux/interconnect.h>
#include <linux/interrupt.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
-#include <linux/platform_device.h>
+#include <linux/of_address.h>
#include <linux/pm.h>
#include <linux/pm_runtime.h>
#include <linux/types.h>
@@ -28,8 +29,6 @@ module_param(do_register_algos, bool, 0444);
#define QCE_QUEUE_LENGTH 1
-#define QCE_DEFAULT_MEM_BANDWIDTH 393600
-
static const struct qce_algo_ops *qce_ops[] = {
#ifdef CONFIG_CRYPTO_DEV_QCE_SKCIPHER
&skcipher_ops,
@@ -93,11 +92,6 @@ static int qce_handle_queue(struct qce_device *qce,
struct crypto_async_request *async_req, *backlog;
int ret, err;
- PM_RUNTIME_ACQUIRE_AUTOSUSPEND(qce->dev, pm);
- ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
- if (ret)
- return ret;
-
scoped_guard(mutex, &qce->lock) {
if (req)
ret = crypto_enqueue_request(&qce->queue, req);
@@ -120,8 +114,21 @@ static int qce_handle_queue(struct qce_device *qce,
crypto_request_complete(backlog, -EINPROGRESS);
}
+ /*
+ * Hold the device resumed across that whole window instead of just
+ * across this function, or autosuspend could gate the engine clocks
+ * while the DMA is still in flight.
+ */
+ err = pm_runtime_resume_and_get(qce->dev);
+ if (err) {
+ qce->result = err;
+ schedule_work(&qce->done_work);
+ return ret;
+ }
+
err = qce_handle_request(async_req);
if (err) {
+ pm_runtime_put_autosuspend(qce->dev);
qce->result = err;
schedule_work(&qce->done_work);
}
@@ -154,6 +161,7 @@ static int qce_async_request_enqueue(struct qce_device *qce,
static void qce_async_request_done(struct qce_device *qce, int ret)
{
+ pm_runtime_put_autosuspend(qce->dev);
qce->result = ret;
schedule_work(&qce->done_work);
}
@@ -194,10 +202,12 @@ static int qce_check_version(struct qce_device *qce)
return 0;
}
-static int qce_crypto_probe(struct platform_device *pdev)
+static int qce_crypto_probe(struct auxiliary_device *auxdev,
+ const struct auxiliary_device_id *id)
{
- struct device *dev = &pdev->dev;
+ struct device *dev = &auxdev->dev;
struct qce_device *qce;
+ struct resource res;
int ret;
qce = devm_kzalloc(dev, sizeof(*qce), GFP_KERNEL);
@@ -205,13 +215,18 @@ static int qce_crypto_probe(struct platform_device *pdev)
return -ENOMEM;
qce->dev = dev;
- platform_set_drvdata(pdev, qce);
+ qce->dma_dev = dev->parent;
+ auxiliary_set_drvdata(auxdev, qce);
+
+ ret = of_address_to_resource(dev->of_node, 0, &res);
+ if (ret)
+ return ret;
- qce->base = devm_platform_ioremap_resource(pdev, 0);
+ qce->base = devm_ioremap_resource(dev, &res);
if (IS_ERR(qce->base))
return PTR_ERR(qce->base);
- ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ ret = dma_set_mask_and_coherent(qce->dma_dev, DMA_BIT_MASK(32));
if (ret < 0)
return ret;
@@ -227,10 +242,6 @@ static int qce_crypto_probe(struct platform_device *pdev)
if (IS_ERR(qce->bus))
return PTR_ERR(qce->bus);
- qce->mem_path = devm_of_icc_get(dev, "memory");
- if (IS_ERR(qce->mem_path))
- return PTR_ERR(qce->mem_path);
-
/*
* Enable runtime PM after clocks and ICC path are acquired so that
* the resume callback can enable clocks and apply the ICC bandwidth
@@ -240,7 +251,10 @@ static int qce_crypto_probe(struct platform_device *pdev)
if (ret)
return ret;
- PM_RUNTIME_ACQUIRE_AUTOSUSPEND(dev, pm);
+ pm_runtime_set_autosuspend_delay(dev, 100);
+ pm_runtime_use_autosuspend(dev);
+
+ PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(dev, pm);
ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
if (ret)
return ret;
@@ -269,31 +283,17 @@ static int qce_crypto_probe(struct platform_device *pdev)
return ret;
}
- /* Configure autosuspend after successful init */
- pm_runtime_set_autosuspend_delay(dev, 100);
- pm_runtime_use_autosuspend(dev);
- pm_runtime_mark_last_busy(dev);
-
return 0;
}
static int qce_runtime_suspend(struct device *dev)
{
struct qce_device *qce = dev_get_drvdata(dev);
- int ret;
clk_disable_unprepare(qce->core);
clk_disable_unprepare(qce->iface);
clk_disable_unprepare(qce->bus);
- ret = icc_set_bw(qce->mem_path, 0, 0);
- if (ret) {
- clk_prepare_enable(qce->bus);
- clk_prepare_enable(qce->iface);
- clk_prepare_enable(qce->core);
- return ret;
- }
-
return 0;
}
@@ -302,14 +302,9 @@ static int qce_runtime_resume(struct device *dev)
struct qce_device *qce = dev_get_drvdata(dev);
int ret;
- ret = icc_set_bw(qce->mem_path, QCE_DEFAULT_MEM_BANDWIDTH,
- QCE_DEFAULT_MEM_BANDWIDTH);
- if (ret)
- return ret;
-
ret = clk_prepare_enable(qce->core);
if (ret)
- goto err_core;
+ return ret;
ret = clk_prepare_enable(qce->iface);
if (ret)
@@ -325,8 +320,7 @@ static int qce_runtime_resume(struct device *dev)
clk_disable_unprepare(qce->iface);
err_iface:
clk_disable_unprepare(qce->core);
-err_core:
- icc_set_bw(qce->mem_path, 0, 0);
+
return ret;
}
@@ -335,25 +329,22 @@ static const struct dev_pm_ops qce_crypto_pm_ops = {
SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
};
-static const struct of_device_id qce_crypto_of_match[] = {
- { .compatible = "qcom,crypto-v5.1", },
- { .compatible = "qcom,crypto-v5.4", },
- { .compatible = "qcom,qce", },
+static const struct auxiliary_device_id qce_crypto_ids[] = {
+ { .name = "qce.crypto", },
{}
};
-MODULE_DEVICE_TABLE(of, qce_crypto_of_match);
+MODULE_DEVICE_TABLE(auxiliary, qce_crypto_ids);
-static struct platform_driver qce_crypto_driver = {
+static struct auxiliary_driver qce_crypto_driver = {
.probe = qce_crypto_probe,
+ .id_table = qce_crypto_ids,
.driver = {
- .name = KBUILD_MODNAME,
- .of_match_table = qce_crypto_of_match,
+ .name = "qce-crypto",
.pm = pm_ptr(&qce_crypto_pm_ops),
},
};
-module_platform_driver(qce_crypto_driver);
+module_auxiliary_driver(qce_crypto_driver);
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Qualcomm crypto engine driver");
-MODULE_ALIAS("platform:" KBUILD_MODNAME);
MODULE_AUTHOR("The Linux Foundation");
diff --git a/drivers/crypto/qce/core.h b/drivers/crypto/qce/core.h
index eb6fa7a8b64a81daf9ad5304a3ae4e5e597a70b8..6eda6e617b811420c0c3cc53988cb15a23abafe2 100644
--- a/drivers/crypto/qce/core.h
+++ b/drivers/crypto/qce/core.h
@@ -20,6 +20,9 @@
* @result: result of current transform
* @base: virtual IO base
* @dev: pointer to device structure
+ * @dma_dev: pointer to the device to use for DMA mapping calls; this is the
+ * auxiliary bus device's parent, which is the one that actually
+ * went through DMA/IOMMU configuration
* @core: core device clock
* @iface: interface clock
* @bus: bus clock
@@ -37,8 +40,8 @@ struct qce_device {
int result;
void __iomem *base;
struct device *dev;
+ struct device *dma_dev;
struct clk *core, *iface, *bus;
- struct icc_path *mem_path;
struct qce_dma_data dma;
int burst_size;
unsigned int pipe_pair_id;
diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index a9a55bc5bc310d82a52b5637655007990da5b7a8..a5b55f5a861d072ac7a82e178f9ab223f892418b 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -47,8 +47,8 @@ static void qce_ahash_done(void *data)
if (error)
dev_dbg(qce->dev, "ahash dma termination error (%d)\n", error);
- dma_unmap_sg(qce->dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
- dma_unmap_sg(qce->dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
+ dma_unmap_sg(qce->dma_dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
+ dma_unmap_sg(qce->dma_dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
memcpy(rctx->digest, result->auth_iv, digestsize);
if (req->result && rctx->last_blk)
@@ -93,13 +93,13 @@ static int qce_ahash_async_req_handle(struct crypto_async_request *async_req)
return rctx->src_nents;
}
- ret = dma_map_sg(qce->dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
+ ret = dma_map_sg(qce->dma_dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
if (!ret)
return -EIO;
sg_init_one(&rctx->result_sg, qce->dma.result_buf, QCE_RESULT_BUF_SZ);
- ret = dma_map_sg(qce->dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
+ ret = dma_map_sg(qce->dma_dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
if (!ret) {
ret = -EIO;
goto error_unmap_src;
@@ -121,9 +121,9 @@ static int qce_ahash_async_req_handle(struct crypto_async_request *async_req)
error_terminate:
qce_dma_terminate_all(&qce->dma);
error_unmap_dst:
- dma_unmap_sg(qce->dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
+ dma_unmap_sg(qce->dma_dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);
error_unmap_src:
- dma_unmap_sg(qce->dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
+ dma_unmap_sg(qce->dma_dev, req->src, rctx->src_nents, DMA_TO_DEVICE);
return ret;
}
diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
index 35bd59656931c5f12614405490f1e254849b9eb5..c77d96e7a7506153bed1447331dec0aba7d56828 100644
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -49,8 +49,8 @@ static void qce_skcipher_done(void *data)
error);
if (diff_dst)
- dma_unmap_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src);
- dma_unmap_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dma_unmap_sg(qce->dma_dev, rctx->src_sg, rctx->src_nents, dir_src);
+ dma_unmap_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
sg_free_table(&rctx->dst_tbl);
@@ -139,14 +139,14 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req)
sg_mark_end(sg);
rctx->dst_sg = rctx->dst_tbl.sgl;
- dst_nents = dma_map_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dst_nents = dma_map_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
if (!dst_nents) {
ret = -EIO;
goto error_free;
}
if (diff_dst) {
- src_nents = dma_map_sg(qce->dev, req->src, rctx->src_nents, dir_src);
+ src_nents = dma_map_sg(qce->dma_dev, req->src, rctx->src_nents, dir_src);
if (!src_nents) {
ret = -EIO;
goto error_unmap_dst;
@@ -175,9 +175,9 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req)
qce_dma_terminate_all(&qce->dma);
error_unmap_src:
if (diff_dst)
- dma_unmap_sg(qce->dev, req->src, rctx->src_nents, dir_src);
+ dma_unmap_sg(qce->dma_dev, req->src, rctx->src_nents, dir_src);
error_unmap_dst:
- dma_unmap_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
+ dma_unmap_sg(qce->dma_dev, rctx->dst_sg, rctx->dst_nents, dir_dst);
error_free:
sg_free_table(&rctx->dst_tbl);
return ret;
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 12/14] soc: qcom: add core driver for the Qualcomm Crypto Engine
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (10 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 11/14] crypto: qce - convert to auxiliary bus Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 13/14] arm64: defconfig: enable the Qualcomm Crypto Engine core driver Bartosz Golaszewski
` (2 subsequent siblings)
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski
Add the core driver for the Qualcomm crypto engine. Its task is to bind
to the qce DT node, set up runtime PM for interconnect down-scaling and
register the auxiliary device using the crypto offloader driver.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/soc/qcom/Kconfig | 11 ++++++
drivers/soc/qcom/Makefile | 1 +
drivers/soc/qcom/qce-core.c | 92 +++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 104 insertions(+)
diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig
index 9f703261d7ac6ccde861b8d29626025bcfdbda8c..81c6634e855be23698591da6d3743ef68b516006 100644
--- a/drivers/soc/qcom/Kconfig
+++ b/drivers/soc/qcom/Kconfig
@@ -121,6 +121,17 @@ config QCOM_PMIC_GLINK
Say yes here to support USB-C and battery status on modern Qualcomm
platforms.
+config QCOM_CRYPTO_CORE
+ tristate "Qualcomm Crypto Engine core driver"
+ depends on PM
+ select AUXILIARY_BUS
+ help
+ Core driver for the Qualcomm Crypto Engine. Say yes here to enable
+ the top-level driver that binds to the devicetree node representing
+ the QCE, registers the sub-devices implementing actual QCE
+ functionalities and sets up runtime PM allowing the interconnects to
+ scale down.
+
config QCOM_RAMP_CTRL
tristate "Qualcomm Ramp Controller driver"
help
diff --git a/drivers/soc/qcom/Makefile b/drivers/soc/qcom/Makefile
index 798643be3590cc8303854658fd483b7807d2230f..33dfef07e7db2c0488b14c78f098afebf689d013 100644
--- a/drivers/soc/qcom/Makefile
+++ b/drivers/soc/qcom/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_QCOM_PMIC_GLINK) += pmic_glink.o
obj-$(CONFIG_QCOM_PMIC_GLINK) += pmic_glink_altmode.o
obj-$(CONFIG_QCOM_PMIC_PDCHARGER_ULOG) += pmic_pdcharger_ulog.o
CFLAGS_pmic_pdcharger_ulog.o := -I$(src)
+obj-$(CONFIG_QCOM_CRYPTO_CORE) += qce-core.o
obj-$(CONFIG_QCOM_QMI_HELPERS) += qmi_helpers.o
qmi_helpers-y += qmi_encdec.o qmi_interface.o
obj-$(CONFIG_QCOM_RAMP_CTRL) += ramp_controller.o
diff --git a/drivers/soc/qcom/qce-core.c b/drivers/soc/qcom/qce-core.c
new file mode 100644
index 0000000000000000000000000000000000000000..8a9d070935cc87eaf20ae2db25f304cf4b2694c0
--- /dev/null
+++ b/drivers/soc/qcom/qce-core.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2026 Qualcomm Technologies, Inc. and/or its subsidiaries
+ */
+
+#include <linux/auxiliary_bus.h>
+#include <linux/device.h>
+#include <linux/device-id/of.h>
+#include <linux/err.h>
+#include <linux/interconnect.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+
+#define QCE_DEFAULT_MEM_BANDWIDTH 393600
+
+static const char *const qce_core_aux_devs[] = { "crypto", NULL };
+
+static int qce_core_probe(struct platform_device *pdev)
+{
+ static const char *const *subdev;
+ struct auxiliary_device *auxdev;
+ struct device *dev = &pdev->dev;
+ struct icc_path *mem_path;
+ int ret;
+
+ mem_path = devm_of_icc_get(&pdev->dev, "memory");
+ if (IS_ERR(mem_path))
+ return PTR_ERR(mem_path);
+
+ dev_set_drvdata(dev, mem_path);
+
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ return ret;
+
+ PM_RUNTIME_ACQUIRE(dev, pm);
+ ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+ if (ret)
+ return ret;
+
+ for (subdev = qce_core_aux_devs; *subdev; subdev++) {
+ auxdev = __devm_auxiliary_device_create(dev, "qce", *subdev, NULL, 0);
+ if (IS_ERR(auxdev))
+ return PTR_ERR(auxdev);
+ }
+
+ return 0;
+}
+
+static int qce_core_runtime_suspend(struct device *dev)
+{
+ struct icc_path *mem_path = dev_get_drvdata(dev);
+
+ return icc_set_bw(mem_path, 0, 0);
+}
+
+static int qce_core_runtime_resume(struct device *dev)
+{
+ struct icc_path *mem_path = dev_get_drvdata(dev);
+
+ return icc_set_bw(mem_path, QCE_DEFAULT_MEM_BANDWIDTH,
+ QCE_DEFAULT_MEM_BANDWIDTH);
+}
+
+static const struct dev_pm_ops qce_core_pm_ops = {
+ RUNTIME_PM_OPS(qce_core_runtime_suspend, qce_core_runtime_resume, NULL)
+ SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+};
+
+static const struct of_device_id qce_core_of_match[] = {
+ { .compatible = "qcom,crypto-v5.1" },
+ { .compatible = "qcom,crypto-v5.4" },
+ { .compatible = "qcom,qce" },
+ { }
+};
+MODULE_DEVICE_TABLE(of, qce_core_of_match);
+
+static struct platform_driver qce_core_driver = {
+ .probe = qce_core_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = qce_core_of_match,
+ .pm = pm_ptr(&qce_core_pm_ops),
+ },
+};
+module_platform_driver(qce_core_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Qualcomm crypto engine core driver");
+MODULE_ALIAS("platform:" KBUILD_MODNAME);
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>");
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 13/14] arm64: defconfig: enable the Qualcomm Crypto Engine core driver
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (11 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 12/14] soc: qcom: add core driver for the Qualcomm Crypto Engine Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-21 12:58 ` [PATCH v8 14/14] arm: multi_v7_defconfig: " Bartosz Golaszewski
2026-09-22 8:22 ` [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski
The QCE core driver should be enabled by default as it binds to the qce
device node and scales down the interconnects if no child auxiliary
driver is using the IP. Add it to the arm64 defconfig. Disable the
crypto part of the driver by default.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
arch/arm64/configs/defconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 55a2e8c3ae3522630df8c31cb2b7c7663e973aed..360d07bfa39a824d13e463912aec15f6fc58e5f2 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -1671,6 +1671,7 @@ CONFIG_QCOM_SMD_RPM=y
CONFIG_QCOM_SMP2P=y
CONFIG_QCOM_SMSM=y
CONFIG_QCOM_SOCINFO=m
+CONFIG_QCOM_CRYPTO_CORE=m
CONFIG_QCOM_SPM=m
CONFIG_QCOM_STATS=m
CONFIG_QCOM_WCNSS_CTRL=m
@@ -1957,7 +1958,6 @@ CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
CONFIG_CRYPTO_DEV_SUN8I_CE=m
CONFIG_CRYPTO_DEV_FSL_CAAM=m
CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=m
-CONFIG_CRYPTO_DEV_QCE=m
CONFIG_CRYPTO_DEV_TEGRA=m
CONFIG_CRYPTO_DEV_ZYNQMP_AES=m
CONFIG_CRYPTO_DEV_ZYNQMP_SHA3=m
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH v8 14/14] arm: multi_v7_defconfig: enable the Qualcomm Crypto Engine core driver
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (12 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 13/14] arm64: defconfig: enable the Qualcomm Crypto Engine core driver Bartosz Golaszewski
@ 2026-09-21 12:58 ` Bartosz Golaszewski
2026-09-22 8:22 ` [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
14 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-21 12:58 UTC (permalink / raw)
To: Thara Gopinath, Herbert Xu, David S. Miller, Stanimir Varbanov,
Eneas U de Queiroz, Kuldeep Singh, Eric Biggers,
Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio, Russell King,
Abel Vesa
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, Bartosz Golaszewski
The QCE core driver should be enabled by default as it binds to the qce
device node and scales down the interconnects if no child auxiliary
driver is using the IP. Add it to the multi_v7_defconfig. Disable the
crypto part of the driver by default.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
arch/arm/configs/multi_v7_defconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 2d6292f8cab39596b540084fbd8b30f4c25cd4ff..7750b11f80312bf6a6f0fb276315f32f8714b4dd 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -1150,6 +1150,7 @@ CONFIG_QCOM_SMD_RPM=y
CONFIG_QCOM_SMP2P=y
CONFIG_QCOM_SMSM=y
CONFIG_QCOM_SOCINFO=m
+CONFIG_QCOM_CRYPTO_CORE=m
CONFIG_QCOM_STATS=m
CONFIG_QCOM_WCNSS_CTRL=m
CONFIG_ROCKCHIP_IODOMAIN=y
@@ -1323,7 +1324,6 @@ CONFIG_CRYPTO_DEV_ATMEL_AES=m
CONFIG_CRYPTO_DEV_ATMEL_TDES=m
CONFIG_CRYPTO_DEV_ATMEL_SHA=m
CONFIG_CRYPTO_DEV_MARVELL_CESA=m
-CONFIG_CRYPTO_DEV_QCE=m
CONFIG_CRYPTO_DEV_ROCKCHIP=m
CONFIG_CRYPTO_DEV_STM32_HASH=m
CONFIG_CRYPTO_DEV_STM32_CRYP=m
--
2.47.3
^ permalink raw reply [flat|nested] 21+ messages in thread* Re: [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures
2026-09-21 12:58 [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
` (13 preceding siblings ...)
2026-09-21 12:58 ` [PATCH v8 14/14] arm: multi_v7_defconfig: " Bartosz Golaszewski
@ 2026-09-22 8:22 ` Bartosz Golaszewski
2026-09-22 9:10 ` Herbert Xu
14 siblings, 1 reply; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-22 8:22 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: linux-crypto, linux-arm-msm, linux-kernel, brgl,
linux-arm-kernel, stable, Thara Gopinath, Herbert Xu,
David S. Miller, Stanimir Varbanov, Eneas U de Queiroz,
Kuldeep Singh, Eric Biggers, Demi Marie Obenour, Bjorn Andersson,
Konrad Dybcio, Russell King, Abel Vesa
On Mon, 21 Sep 2026 14:58:09 +0200, Bartosz Golaszewski
<bartosz.golaszewski@oss.qualcomm.com> said:
> This iteration - in addition to the previous fixes - proposes to split
> the QCE driver into a core part necessary to bind to the QCE DT node and
> enable runtime power management in order to allow to drop the
> interconnect votes, and the crypto part registering the crypto
> algorithms. The core module is then enabled in arm64 defconfig while the
> crypto part stays disabled by default. In addition: the actual
> registration of crypto algos is gated with a module parameter that
> default to false.
>
> Note that remaining reported bugs will still be fixed in follow-up
> series. This series addresses self-tests and disables the algos by
> default.
>
> The QCE hardware crypto engine has several limitations that cause it to
> produce incorrect results or stall on certain inputs. This series fixes
> several bugs and adds workaround allowing the deiver to pass crypto
> self-tests.
>
> The failures addressed are:
>
> - HMAC self-test failures for empty messages
> - AES-XTS returning success on zero-length input (should be -EINVAL)
> - AES-CTR: partial final block causes the engine to stall, output IV
> derivation was incorrect
> - AES-XTS with key1 == key2 is not supported by the CE
> - AES-CCM: partial final block and fragmented payload both stall the
> engine
>
> All fixes were tested on an SM8650 QRD board with
> CONFIG_CRYPTO_SELFTESTS=y and CONFIG_CRYPTO_SELFTESTS_FULL=y.
>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---
Herbert: Sashiko still says it fails to apply. I have no idea why, it applies
fine on top of current linux-next.
Bart
^ permalink raw reply [flat|nested] 21+ messages in thread* Re: [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures
2026-09-22 8:22 ` [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures Bartosz Golaszewski
@ 2026-09-22 9:10 ` Herbert Xu
2026-09-22 11:52 ` Bartosz Golaszewski
0 siblings, 1 reply; 21+ messages in thread
From: Herbert Xu @ 2026-09-22 9:10 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: Bartosz Golaszewski, linux-crypto, linux-arm-msm, linux-kernel,
linux-arm-kernel, stable, Thara Gopinath, David S. Miller,
Stanimir Varbanov, Eneas U de Queiroz, Kuldeep Singh,
Eric Biggers, Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio,
Russell King, Abel Vesa
On Tue, Sep 22, 2026 at 01:22:31AM -0700, Bartosz Golaszewski wrote:
>
> Herbert: Sashiko still says it fails to apply. I have no idea why, it applies
> fine on top of current linux-next.
The first patch doesn't apply for me either using git apply. Please
download the latest cryptodev-2.6 (a9a2152d292fd0bc73814eb4a127278ee7dd3f6a)
and rebase.
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH v8 00/14] crypto: qce - Fix crypto self-test failures
2026-09-22 9:10 ` Herbert Xu
@ 2026-09-22 11:52 ` Bartosz Golaszewski
0 siblings, 0 replies; 21+ messages in thread
From: Bartosz Golaszewski @ 2026-09-22 11:52 UTC (permalink / raw)
To: Herbert Xu
Cc: Bartosz Golaszewski, linux-crypto, linux-arm-msm, linux-kernel,
linux-arm-kernel, stable, Thara Gopinath, David S. Miller,
Stanimir Varbanov, Eneas U de Queiroz, Kuldeep Singh,
Eric Biggers, Demi Marie Obenour, Bjorn Andersson, Konrad Dybcio,
Russell King, Abel Vesa, Bartosz Golaszewski
On Tue, 22 Sep 2026 11:10:26 +0200, Herbert Xu
<herbert@gondor.apana.org.au> said:
> On Tue, Sep 22, 2026 at 01:22:31AM -0700, Bartosz Golaszewski wrote:
>>
>> Herbert: Sashiko still says it fails to apply. I have no idea why, it applies
>> fine on top of current linux-next.
>
> The first patch doesn't apply for me either using git apply. Please
> download the latest cryptodev-2.6 (a9a2152d292fd0bc73814eb4a127278ee7dd3f6a)
> and rebase.
>
Yes, this does help but does it mean changes from cryptodev/master are not fed
into linux-next?
Bartosz
^ permalink raw reply [flat|nested] 21+ messages in thread