drivers: crypto: Add STM32 HASH hardware driver #93923

bayrem-gharsellaoui · 2025-07-31T12:32:50Z

Summary

This work uses the crypto hash API implementing the STM32 HASH accelerator, initially supporting only STM32U5, with support for SHA-224 and SHA-256 via the Zephyr crypto API.

Supported Hardware

I currently tested this on: nucleo_u575zi_q board (STM32U5 series)
It is designed to be extended to other STM32 families that include the HASH peripheral (the other STM32 families may have a handle structure in their HAL different from the one used in STM32U5)

Testing

Crypto test suite:

I adapted and ran tests/crypto/crypto_hash as an application for nucleo_u575zi_q and it passed

Manual test sample:

I developed this example application to verify:

Correctness of SHA-224 and SHA-256 digests
Multi-session behavior
Thread safety

#include <zephyr/crypto/crypto.h>
#include <zephyr/kernel.h>
#include <zephyr/logging/log.h>
LOG_MODULE_REGISTER(hash_example);

#define SHA256_DIGEST_LEN (32)
#define SHA224_DIGEST_LEN (28)

static const uint8_t test_data_256[] = "Thread1 SHA256 data";
static const uint8_t test_data_224[] = "Thread2 SHA224 data";

static const uint8_t expected_digest_256[SHA256_DIGEST_LEN] = {
    0x1f, 0x1b, 0x55, 0x79, 0x3e, 0x5a, 0x48, 0x42, 0x0a, 0x28, 0xfe,
    0xc7, 0xeb, 0xee, 0x94, 0xcd, 0x7e, 0x25, 0xf9, 0x26, 0x18, 0xe8,
    0x6a, 0xaa, 0xf7, 0x1d, 0x2f, 0x02, 0x86, 0x1c, 0x67, 0xd4};

static const uint8_t expected_digest_224[SHA224_DIGEST_LEN] = {
    0x14, 0xca, 0xee, 0x76, 0xf6, 0x54, 0x95, 0xf3, 0xe9, 0xed,
    0xa9, 0x10, 0xe2, 0x9b, 0x0b, 0x4a, 0x62, 0xe8, 0xf5, 0x67,
    0x12, 0x27, 0xcf, 0x97, 0x1a, 0x4f, 0xe8, 0x8b};

static void do_hashing(enum hash_algo algo, const uint8_t *input, size_t in_len,
                       const uint8_t *expected_digest, size_t digest_len,
                       const char *label) {
  int ret;
  const struct device *dev = DEVICE_DT_GET(DT_NODELABEL(hash));
  struct hash_ctx ctx = {0};
  struct hash_pkt pkt = {0};
  uint8_t digest[SHA256_DIGEST_LEN] = {0};

  ret = hash_begin_session(dev, &ctx, algo);
  if (ret != 0) {
    LOG_ERR("%s: begin_session failed (%d)", label, ret);
    return;
  }

  pkt.in_buf = (uint8_t *)input;
  pkt.in_len = in_len;
  pkt.out_buf = digest;

  ret = hash_compute(&ctx, &pkt);
  if (ret != 0) {
    LOG_ERR("%s: compute failed (%d)", label, ret);
    hash_free_session(dev, &ctx);
    return;
  }

  if (memcmp(digest, expected_digest, digest_len) == 0) {
    LOG_INF("%s: Digest OK", label);
  } else {
    LOG_ERR("%s: Digest MISMATCH", label);
  }

  LOG_HEXDUMP_DBG(digest, digest_len, label);

  ret = hash_free_session(dev, &ctx);
  if (ret != 0) {
    LOG_ERR("%s: free_session failed (%d)", label, ret);
    return;
  }
}

static void thread_sha256(void) {
  do_hashing(CRYPTO_HASH_ALGO_SHA256, test_data_256, sizeof(test_data_256) - 1,
             expected_digest_256, SHA256_DIGEST_LEN, "SHA256-Thread1");
}

static void thread_sha224(void) {
  do_hashing(CRYPTO_HASH_ALGO_SHA224, test_data_224, sizeof(test_data_224) - 1,
             expected_digest_224, SHA224_DIGEST_LEN, "SHA224-Thread2");
}

K_THREAD_DEFINE(sha256_thread, 2048, thread_sha256, NULL, NULL, NULL, 5, 0, 0);
K_THREAD_DEFINE(sha224_thread, 2048, thread_sha224, NULL, NULL, NULL, 5, 0, 0);

Notes

The implementation is very close to drivers/crypto/crypto_stm32.c on purpose for consistency and maintainability.
Currently the driver only supports synchronous operations and single-shot hashing (no interrupts or DMA).
Multipart hash (update / finish) is not yet implemented, but can be added later (using the HAL_HASHEx_xxx_Accumulate() APIs)

Next Steps

Verify driver for the other STM32U5 boards
Extend to other STM32 series (e.g., H5...) once validated.
Add support for multipart hashing.

github-actions · 2025-07-31T12:33:27Z

Hello @bayrem-gharsellaoui, and thank you very much for your first pull request to the Zephyr project!
Our Continuous Integration pipeline will execute a series of checks on your Pull Request commit messages and code, and you are expected to address any failures by updating the PR. Please take a look at our commit message guidelines to find out how to format your commit messages, and at our contribution workflow to understand how to update your Pull Request. If you haven't already, please make sure to review the project's Contributor Expectations and update (by amending and force-pushing the commits) your pull request if necessary.
If you are stuck or need help please join us on Discord and ask your question there. Additionally, you can escalate the review when applicable. 😊

drivers/crypto/crypto_stm32_sha.c

ceolin

It looks good to me.

drivers/crypto/crypto_stm32_sha.c

drivers/crypto/Kconfig.stm32_sha

bayrem-gharsellaoui · 2025-08-04T13:51:28Z

@mathieuchopstm
All discussed changes are applied, can you please take a look again?
Thanks

JarmouniA

tests/crypto/crypto_hash (or another more adequate in-tree test) should be enabled to run with the added driver.

dts/bindings/crypto/st,stm32-hash.yaml

dts/arm/st/u5/stm32u5_crypt.dtsi

boards/st/nucleo_u575zi_q/nucleo_u575zi_q.yaml

GeorgeCGV · 2025-08-06T08:39:22Z

drivers/crypto/crypto_stm32_hash.c

+	return 0;
+}
+
+static const struct crypto_driver_api stm32_hash_api = {


Suggested change

static const struct crypto_driver_api stm32_hash_api = {

static DEVICE_API(crypto, stm32_hash_funcs) = {

GeorgeCGV · 2025-08-06T08:41:19Z

Shouldn't hash be a part of the crypto driver? By implementing required API:
hash_begin_session 
hash_free_session
HASH is a separate IP from CRYP/AES that crypto_stm32.c currently manages so a separate driver seems sensible to me. Maybe I don't understand the architecture of crypto drivers well though.

I see... zephyr offers crypto api that includes both - hash and encryption. However, API topic is out of scope of this PR.

bayrem-gharsellaoui · 2025-08-08T18:07:41Z

Hello @ceolin
Are there anything left to do for this PR,
It is stale as I'm waiting for maintainers review/feedback/approval.
Thanks

JarmouniA · 2025-08-08T18:11:52Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected
https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

bayrem-gharsellaoui · 2025-08-08T19:36:30Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

Can you please run the CI again to check if it passes now ?

bayrem-gharsellaoui · 2025-08-08T20:13:13Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

I'm not sure why this is failing in compliance check:

67d0df09d6d2db413ada91794035509755bcecd5: Signed-off-by line (Signed-off-by: Bayrem Gharsellaoui <[email protected]>) does not follow the syntax: First Last <email>.

Even though I'm following the correct syntax: First Last <email>

Am I missing something ?

JarmouniA · 2025-08-08T21:15:39Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

I'm not sure why this is failing in compliance check:

67d0df09d6d2db413ada91794035509755bcecd5: Signed-off-by line (Signed-off-by: Bayrem Gharsellaoui <[email protected]>) does not follow the syntax: First Last <email>.

Even though I'm following the correct syntax: First Last <email>

Am I missing something ?

Commit author email should be the same as the Signed-off-by one.

bayrem-gharsellaoui · 2025-08-09T09:40:05Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

I'm not sure why this is failing in compliance check:
67d0df09d6d2db413ada91794035509755bcecd5: Signed-off-by line (Signed-off-by: Bayrem Gharsellaoui <[email protected]>) does not follow the syntax: First Last <email>.
Even though I'm following the correct syntax: First Last <email>
Am I missing something ?

Commit author email should be the same as the Signed-off-by one.

It is:

bayrem@debian:~/workspace/zephyr$ git config --global user.email
[email protected]
bayrem@debian:~/workspace/zephyr$ git config --global user.name
bayrem-gharsellaoui

The only thing I have doubt in is that (before the PR I guess) I changed my GitHub email address to be conform with the compliance check

JarmouniA · 2025-08-09T10:05:16Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

I'm not sure why this is failing in compliance check:
67d0df09d6d2db413ada91794035509755bcecd5: Signed-off-by line (Signed-off-by: Bayrem Gharsellaoui <[email protected]>) does not follow the syntax: First Last <email>.
Even though I'm following the correct syntax: First Last <email>
Am I missing something ?

Commit author email should be the same as the Signed-off-by one.

It is:
bayrem@debian:~/workspace/zephyr$ git config --global user.email
[email protected]
bayrem@debian:~/workspace/zephyr$ git config --global user.name
bayrem-gharsellaoui
The only thing I have doubt in is that (before the PR I guess) I changed my GitHub email address to be conform with the compliance check

git user name should not be attached.

bayrem-gharsellaoui · 2025-08-09T10:14:27Z

@bayrem-gharsellaoui you have CI compliance issues that need to be corrected https://github.com/zephyrproject-rtos/zephyr/actions/runs/16774415152/job/47497936949?pr=93923

I'm not sure why this is failing in compliance check:
67d0df09d6d2db413ada91794035509755bcecd5: Signed-off-by line (Signed-off-by: Bayrem Gharsellaoui <[email protected]>) does not follow the syntax: First Last <email>.
Even though I'm following the correct syntax: First Last <email>
Am I missing something ?

Commit author email should be the same as the Signed-off-by one.

It is:
bayrem@debian:~/workspace/zephyr$ git config --global user.email
[email protected]
bayrem@debian:~/workspace/zephyr$ git config --global user.name
bayrem-gharsellaoui
The only thing I have doubt in is that (before the PR I guess) I changed my GitHub email address to be conform with the compliance check
git user name should not be attached.

Should I unset it and push again ?

git config --global --unset user.name

dsseng · 2025-08-09T11:47:30Z

Please set user.name to First Last, as in the sign-off tag. Without email, it goes to user.email

JarmouniA · 2025-08-09T11:57:49Z

set user.name to First Last

Then amend your commits with interactive rebase and git commit --amend --author="Full Name <email>" for each one

Add STM32 HASH driver with SHA-224/256 support for STM32U5 Signed-off-by: Bayrem Gharsellaoui <[email protected]>

Add device tree support for STM32 HASH peripheral on the nucleo_u575zi_q Signed-off-by: Bayrem Gharsellaoui <[email protected]>

Enable crypto.hash test on nucleo_u575zi_q board Signed-off-by: Bayrem Gharsellaoui <[email protected]>

bayrem-gharsellaoui · 2025-08-09T12:21:00Z

set user.name to First Last

Then amend your commits with interactive rebase and git commit --amend --author="Full Name <email>" for each one

@JarmouniA it is Done

sonarqubecloud · 2025-08-09T12:36:33Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

bayrem-gharsellaoui · 2025-08-09T15:55:08Z

set user.name to First Last

Then amend your commits with interactive rebase and git commit --amend --author="Full Name <email>" for each one

@JarmouniA it is Done

All CI checks have passed

dsseng · 2025-08-09T16:06:46Z

set user.name to First Last

Then amend your commits with interactive rebase and git commit --amend --author="Full Name <email>" for each one

@JarmouniA it is Done

All CI checks have passed

Great! This can now wait for approvals from subsys maintainers and then be mergeable

github-actions · 2025-08-15T07:10:54Z

Hi @bayrem-gharsellaoui!
Congratulations on getting your very first Zephyr pull request merged 🎉🥳. This is a fantastic achievement, and we're thrilled to have you as part of our community!

To celebrate this milestone and showcase your contribution, we'd love to award you the Zephyr Technical Contributor badge. If you're interested, please claim your badge by filling out this form: Claim Your Zephyr Badge.

Thank you for your valuable input, and we look forward to seeing more of your contributions in the future! 🪁

zephyrbot added area: Crypto / RNG platform: STM32 ST Micro STM32 labels Jul 31, 2025

zephyrbot requested review from FRASTM, GeorgeCGV, ceolin, djiatsaf-st, erwango, etienne-lms, gautierg-st, marwaiehm-st, mathieuchopstm and valeriosetti July 31, 2025 12:33

zephyrbot assigned ceolin Jul 31, 2025

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch 2 times, most recently from 7a4ca92 to 9d7a770 Compare July 31, 2025 21:06

ceolin reviewed Aug 4, 2025

View reviewed changes

drivers/crypto/crypto_stm32_sha.c Outdated Show resolved Hide resolved

ceolin previously approved these changes Aug 4, 2025

View reviewed changes

bayrem-gharsellaoui dismissed ceolin’s stale review via 16a2dea August 4, 2025 02:59

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch from 9d7a770 to 16a2dea Compare August 4, 2025 02:59

mathieuchopstm reviewed Aug 4, 2025

View reviewed changes

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch from 16a2dea to 7962423 Compare August 4, 2025 13:43

mathieuchopstm previously approved these changes Aug 4, 2025

View reviewed changes

mathieuchopstm requested a review from ceolin August 4, 2025 14:01

valeriosetti previously approved these changes Aug 4, 2025

View reviewed changes

JarmouniA requested changes Aug 4, 2025

View reviewed changes

dts/bindings/crypto/st,stm32-hash.yaml Show resolved Hide resolved

dts/arm/st/u5/stm32u5_crypt.dtsi Show resolved Hide resolved

boards/st/nucleo_u575zi_q/nucleo_u575zi_q.yaml Outdated Show resolved Hide resolved

bayrem-gharsellaoui dismissed stale reviews from valeriosetti and mathieuchopstm via d349810 August 5, 2025 11:49

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch from 7962423 to d349810 Compare August 5, 2025 11:49

GeorgeCGV reviewed Aug 6, 2025

View reviewed changes

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch from 83534f9 to 5b096ea Compare August 6, 2025 10:29

bayrem-gharsellaoui requested a review from GeorgeCGV August 6, 2025 10:30

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch 3 times, most recently from 4fc9d5d to 67d0df0 Compare August 8, 2025 19:33

bayrem-gharsellaoui added 3 commits August 9, 2025 13:18

drivers: crypto: Add STM32 HASH hardware driver

6c8a60b

Add STM32 HASH driver with SHA-224/256 support for STM32U5 Signed-off-by: Bayrem Gharsellaoui <[email protected]>

boards: stm32: Enable HASH peripheral for nucleo_u575zi_q

cb93af6

Add device tree support for STM32 HASH peripheral on the nucleo_u575zi_q Signed-off-by: Bayrem Gharsellaoui <[email protected]>

tests: crypto: Add nucleo_u575zi_q support to crypto_hash test

0b9cd05

Enable crypto.hash test on nucleo_u575zi_q board Signed-off-by: Bayrem Gharsellaoui <[email protected]>

bayrem-gharsellaoui force-pushed the crypto_stm32_hash branch from 67d0df0 to 0b9cd05 Compare August 9, 2025 12:20

ceolin approved these changes Aug 14, 2025

View reviewed changes

valeriosetti approved these changes Aug 15, 2025

View reviewed changes

jhedberg merged commit 3d11792 into zephyrproject-rtos:main Aug 15, 2025
27 checks passed

FRASTM mentioned this pull request Aug 20, 2025

drivers: crypto: hash driver for the STM32H7RS series #94749

Closed

	static const struct crypto_driver_api stm32_hash_api = {
	static DEVICE_API(crypto, stm32_hash_funcs) = {

drivers: crypto: Add STM32 HASH hardware driver #93923

drivers: crypto: Add STM32 HASH hardware driver #93923

Uh oh!

Conversation

bayrem-gharsellaoui commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Supported Hardware

Testing

Crypto test suite:

Manual test sample:

Notes

Next Steps

Uh oh!

github-actions bot commented Jul 31, 2025

Uh oh!

Uh oh!

ceolin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bayrem-gharsellaoui commented Aug 4, 2025

Uh oh!

JarmouniA left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GeorgeCGV Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

bayrem-gharsellaoui Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

GeorgeCGV commented Aug 6, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 8, 2025

Uh oh!

JarmouniA commented Aug 8, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 8, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 8, 2025

Uh oh!

JarmouniA commented Aug 8, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 9, 2025

Uh oh!

JarmouniA commented Aug 9, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 9, 2025

Uh oh!

dsseng commented Aug 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JarmouniA commented Aug 9, 2025

Uh oh!

bayrem-gharsellaoui commented Aug 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Aug 9, 2025

Quality Gate passed

Uh oh!

bayrem-gharsellaoui commented Aug 9, 2025

Uh oh!

dsseng commented Aug 9, 2025

Uh oh!

Uh oh!

github-actions bot commented Aug 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

bayrem-gharsellaoui commented Jul 31, 2025 •

edited

Loading

dsseng commented Aug 9, 2025 •

edited

Loading

bayrem-gharsellaoui commented Aug 9, 2025 •

edited

Loading