crypto: caam - skip RNG selftest when i.MX6 is in normal world

PATCH Applied Ahmad Fatoum 3 participants 4 messages Oct 29, 2025 – Nov 3, 2025

Subsystems (5)

Arm (32-bit) Arm sub-architectures Arm i.MX and Layerscape Crypto API +1 more subsystems

lore

Share & tools

lore

Ahmad Fatoum

author

2025-10-29 07:02 UTC #0 lore raw

PATCH 1/1 crypto: caam - skip RNG selftest when i.MX6 is in normal world

On an i.MX6 running under OP-TEE, the CAAM selftest fails as it needs to run in the secure world[1].

We can detect that barebox is running in the normal world on an i.MX6, so use that info to gracefully skip the test.

This is not enough to get the CAAM working (The DECO registers may not be accessible to barebox), but that is arguably a more useful error message than an -EBUSY.

[1]: Scroll down to "Job Ring TZ assignment issue"
https://community.nxp.com/t5/i-MX-Security/RNG-self-test-errors-on-select-i-MX-device-revisions/ta-p/1102970

Reported-by Fabian Pflug <[email protected]>

Cc Marco Felsch <[email protected]>

Signed-off-by Ahmad Fatoum <[email protected]>

---
 arch/arm/mach-imx/imx6.c            |  2 +-
 drivers/crypto/caam/rng_self_test.c | 13 ++++++++++++-
 include/mach/imx/imx6.h             |  2 ++
 3 files changed, 15 insertions(+), 2 deletions(-)

arch/arm/mach-imx/imx6.c +1 -1

index 0cf2c17d6b90..29a56de56293 100644
@@ -254,7 +254,7 @@ int imx6_devices_init(void)
 	return 0;
 }
 
-static bool imx6_cannot_write_l2x0(void)
+bool imx6_cannot_write_l2x0(void)
 {
 	void __iomem *l2x0_base = IOMEM(0x00a02000);
 	u32 val;

drivers/crypto/caam/rng_self_test.c +12 -1

index 5216ecef4451..a42d9cad1639 100644
@@ -47,6 +47,8 @@
 #include <dma.h>
 #include <common.h>
 #include <linux/kernel.h>
+#include <mach/imx/generic.h>
+#include <mach/imx/imx6.h>
 
 #include "error.h"
 #include "regs.h"

@@ -143,7 +145,7 @@ static void rng_self_test_done(struct device *dev, u32 *desc, u32 err,
  * * i.MX6DLS silicon revision 1.4
  * * i.MX6SX silicon revision 1.4
  * * i.MX6UL silicon revision 1.2
- * * i.MX67SD silicon revision 1.3
+ * * i.MX7SD silicon revision 1.3
  *
  */
 int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,

@@ -176,6 +178,15 @@ int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,
 		return -EINVAL;
 	}
 
+	if (cpu_is_mx6() && imx6_cannot_write_l2x0()) {
+		/* If we enter this if clause, we are likely running
+		 * under OP-TEE, so there is no point in continuing
+		 * and getting -EBUSY waiting for job completion
+		 */
+		pr_info("skipping test in normal world\n");
+		return 0;
+	}
+
 	result = dma_alloc(sizeof(*result) * result_size);
 	desc = dma_alloc(sizeof(*desc) * desc_size);

include/mach/imx/imx6.h +2 -0

index 109df9b811c5..7b3cedd80f66 100644
@@ -135,4 +135,6 @@ int imx6_cpu_revision(void);
 
 u64 imx6_uid(void);
 
+bool imx6_cannot_write_l2x0(void);
+
 #endif /* __MACH_IMX6_H */

Signature · 1 line

2.47.3

Marco Felsch

Reviewed-by on v1 1/1

2025-10-29 09:56 UTC #1 lore raw

Quoted 58 lines · Ahmad Fatoum

On an i.MX6 running under OP-TEE, the CAAM selftest fails as it needs to run in the secure world[1].
We can detect that barebox is running in the normal world on an i.MX6, so use that info to gracefully skip the test.
This is not enough to get the CAAM working (The DECO registers may not be accessible to barebox), but that is arguably a more useful error message than an -EBUSY.
[1]: Scroll down to "Job Ring TZ assignment issue"
https://community.nxp.com/t5/i-MX-Security/RNG-self-test-errors-on-select-i-MX-device-revisions/ta-p/1102970
Reported-by Fabian Pflug <[email protected]>
Cc Marco Felsch <[email protected]>
Signed-off-by Ahmad Fatoum <[email protected]>
---
 arch/arm/mach-imx/imx6.c            |  2 +-
 drivers/crypto/caam/rng_self_test.c | 13 ++++++++++++-
 include/mach/imx/imx6.h             |  2 ++
 3 files changed, 15 insertions(+), 2 deletions(-)
arch/arm/mach-imx/imx6.c +1 -1
index 0cf2c17d6b90..29a56de56293 100644
@@ -254,7 +254,7 @@ int imx6_devices_init(void)
 	return 0;
 }
 
-static bool imx6_cannot_write_l2x0(void)
+bool imx6_cannot_write_l2x0(void)
 {
 	void __iomem *l2x0_base = IOMEM(0x00a02000);
 	u32 val;
drivers/crypto/caam/rng_self_test.c +3 -1
index 5216ecef4451..a42d9cad1639 100644
@@ -47,6 +47,8 @@
 #include <dma.h>
 #include <common.h>
 #include <linux/kernel.h>
+#include <mach/imx/generic.h>
+#include <mach/imx/imx6.h>
 
 #include "error.h"
 #include "regs.h"
@@ -143,7 +145,7 @@ static void rng_self_test_done(struct device *dev, u32 *desc, u32 err,
  * * i.MX6DLS silicon revision 1.4
  * * i.MX6SX silicon revision 1.4
  * * i.MX6UL silicon revision 1.2
- * * i.MX67SD silicon revision 1.3
+ * * i.MX7SD silicon revision 1.3
  *
  */
 int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,

drivers/crypto/caam/rng_self_test.c int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid, · line 181

Quoted 4 lines

drivers/crypto/caam/rng_self_test.c +1 -0

@@ -176,6 +178,15 @@ int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,
 		return -EINVAL;
 	}
 
+	if (cpu_is_mx6() && imx6_cannot_write_l2x0()) {

Nit:
Would be nice to have an in_secure_mode() function to make the purpose more clear. However, change is correct and you added a comment, so

Reviewed-by Marco Felsch <[email protected]>

Quoted 26 lines

drivers/crypto/caam/rng_self_test.c +8 -0

+		/* If we enter this if clause, we are likely running
+		 * under OP-TEE, so there is no point in continuing
+		 * and getting -EBUSY waiting for job completion
+		 */
+		pr_info("skipping test in normal world\n");
+		return 0;
+	}
+
 	result = dma_alloc(sizeof(*result) * result_size);
 	desc = dma_alloc(sizeof(*desc) * desc_size);

include/mach/imx/imx6.h +2 -0

index 109df9b811c5..7b3cedd80f66 100644
@@ -135,4 +135,6 @@ int imx6_cpu_revision(void);
 
 u64 imx6_uid(void);
 
+bool imx6_cannot_write_l2x0(void);
+
 #endif /* __MACH_IMX6_H */

Signature · 1 line

2.47.3

Signature · 7 lines

#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |

Ahmad Fatoum

author

2025-10-29 10:01 UTC #2 lore raw

Hi,

Quoted 62 lines · Marco Felsch

Quoted 61 lines · Ahmad Fatoum
On an i.MX6 running under OP-TEE, the CAAM selftest fails as it needs to run in the secure world[1].
We can detect that barebox is running in the normal world on an i.MX6, so use that info to gracefully skip the test.
This is not enough to get the CAAM working (The DECO registers may not be accessible to barebox), but that is arguably a more useful error message than an -EBUSY.
[1]: Scroll down to "Job Ring TZ assignment issue"
https://community.nxp.com/t5/i-MX-Security/RNG-self-test-errors-on-select-i-MX-device-revisions/ta-p/1102970
Reported-by Fabian Pflug <[email protected]>
Cc Marco Felsch <[email protected]>
Signed-off-by Ahmad Fatoum <[email protected]>
---
 arch/arm/mach-imx/imx6.c            |  2 +-
 drivers/crypto/caam/rng_self_test.c | 13 ++++++++++++-
 include/mach/imx/imx6.h             |  2 ++
 3 files changed, 15 insertions(+), 2 deletions(-)
arch/arm/mach-imx/imx6.c +1 -1
index 0cf2c17d6b90..29a56de56293 100644
@@ -254,7 +254,7 @@ int imx6_devices_init(void)
 	return 0;
 }
 
-static bool imx6_cannot_write_l2x0(void)
+bool imx6_cannot_write_l2x0(void)
 {
 	void __iomem *l2x0_base = IOMEM(0x00a02000);
 	u32 val;
drivers/crypto/caam/rng_self_test.c +3 -1
index 5216ecef4451..a42d9cad1639 100644
@@ -47,6 +47,8 @@
 #include <dma.h>
 #include <common.h>
 #include <linux/kernel.h>
+#include <mach/imx/generic.h>
+#include <mach/imx/imx6.h>
 
 #include "error.h"
 #include "regs.h"
@@ -143,7 +145,7 @@ static void rng_self_test_done(struct device *dev, u32 *desc, u32 err,
  * * i.MX6DLS silicon revision 1.4
  * * i.MX6SX silicon revision 1.4
  * * i.MX6UL silicon revision 1.2
- * * i.MX67SD silicon revision 1.3
+ * * i.MX7SD silicon revision 1.3
  *
  */
 int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,
@@ -176,6 +178,15 @@ int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid,
 		return -EINVAL;
 	}
 

Quoted 7 lines

drivers/crypto/caam/rng_self_test.c int caam_rng_self_test(struct device *dev, const u8 caam_era, const u8 rngvid, · line 181
Quoted 1 line
drivers/crypto/caam/rng_self_test.c +1 -0
+	if (cpu_is_mx6() && imx6_cannot_write_l2x0()) {
Nit:
Would be nice to have an in_secure_mode() function to make the purpose more clear. However, change is correct and you added a comment, so
Reviewed-by Marco Felsch <[email protected]>

A generic in_secure_mode() function must necessarily be tristate for architectural reasons: yes, no, don't know.

I guess we could do that, but yes, out of scope for this fix.

Cheers,
Ahmad

Quoted 29 lines

Quoted 28 lines

drivers/crypto/caam/rng_self_test.c +8 -0

+		/* If we enter this if clause, we are likely running
+		 * under OP-TEE, so there is no point in continuing
+		 * and getting -EBUSY waiting for job completion
+		 */
+		pr_info("skipping test in normal world\n");
+		return 0;
+	}
+
 	result = dma_alloc(sizeof(*result) * result_size);
 	desc = dma_alloc(sizeof(*desc) * desc_size);

include/mach/imx/imx6.h +2 -0

index 109df9b811c5..7b3cedd80f66 100644
@@ -135,4 +135,6 @@ int imx6_cpu_revision(void);
 
 u64 imx6_uid(void);
 
+bool imx6_cannot_write_l2x0(void);
+
 #endif /* __MACH_IMX6_H */

Signature · 1 line

2.47.3

Signature · 4 lines

Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Sascha Hauer

maintainer Applied

2025-11-03 08:44 UTC #3 lore raw

In reply to Ahmad Fatoum

Quoted 11 lines · Ahmad Fatoum

On an i.MX6 running under OP-TEE, the CAAM selftest fails as it needs to run in the secure world[1].
We can detect that barebox is running in the normal world on an i.MX6, so use that info to gracefully skip the test.
This is not enough to get the CAAM working (The DECO registers may not be accessible to barebox), but that is arguably a more useful error message than an -EBUSY.
[...]

Applied, thanks!

[1/1] crypto: caam - skip RNG selftest when i.MX6 is in normal world
https://git.pengutronix.de/cgit/barebox/commit/?id=84e672622f1d (link may not be stable)

Best regards,

Signature · 1 line

Sascha Hauer <[email protected]>