arch/arm/imxrt: add a CAAM-backed /dev/random driver

[royzah]

Summary

The i.MX RT117x has a hardware random number generator inside CAAM and nothing in NuttX registers it, so up_randompool_initialize() is never seeded from hardware. There is no CAAM, TRNG or RNG driver anywhere in arch/arm/src/imxrt, and the RT117x headers describe the block only as an address-map comment.

File	What it does
imxrt_caam.c	job ring zero, and RNG state handle instantiation when the boot ROM has not done it
imxrt_rng.c	/dev/random and /dev/urandom on top of it
hardware/rt117x/imxrt117x_caam.h	job ring and RNG4 registers
imxrt_periphclks.h	the CAAM clock gate, which had no helper

Instantiation retries with a longer entropy sample until the self test passes, which is how NXP's own code finds a value that holds across voltage and temperature.

imxrt_rng.c is the sibling of the i.MX9 driver in #20191: same health checks, same FIPS 140-2 continuous test, and the same refusal to return a short read and call it entropy.

Scoped to RT117x, the family that carries CAAM.

Impact

New driver, default n. Nothing changes for a board that does not select IMXRT_RNG.

Provenance of the register definitions

The i.MX RT1170 Reference Manual Rev. 5 describes CAAM in one page of features (section 7.7) and carries no register detail, so the header was built from NXP's own drivers for this block and cross-checked three ways.

Fact	Source
General block 0x4044_0000, job ring 0 0x4045_0000	RT1170 RM Rev. 5, system memory map
Clock gate LPCG 40	RT1170 RM Rev. 5, clk_enable_caam
RNG4 offsets 0x600/0x610/0x618/0x61c/0x6c0 and their bits	agree across NXP u-boot, NXP Linux and OP-TEE
Job ring offsets, and the high-word-first base address order for a 32-bit CAAM	agree across NXP u-boot and OP-TEE

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• arduino-mega2560
• esp32-devkitc
• hifive1-revb
• mirtoo
• qemu-armv8a
• qemu-intel64
• rx65n-rsk2mb
• s698pm-dkit
• stm32-nucleo-f103rb

[acassis]

@royzah please signed your PR and also add Assisted-by: AI Vendor/Model used

[royzah]

Tried this on real hardware and it turned up a bug the build could never catch.

Board is an FMU-v6X-RT, i.MX RT1176, running plain NuttX nsh.

The instantiate descriptor just never answers on the job ring. The driver took that as a failure, so the first read always came back -ETIMEDOUT even though the RNG was actually fine. Generate jobs do answer, so every read after the first one worked and hid the whole thing.

Straight out of reset:

rdsta   = 0x00000000    RNG not instantiated
jrstart = 0x00000000    no job ring started

Before:

nsh> hexdump /dev/random count=32
nsh: hexdump: read failed: 110
nsh> cat /dev/ttyS1
imxrt_caam_run: ERROR: job ring did not answer      x25, one per entropy delay
imxrt_caam_rng_init: ERROR: RNG would not instantiate

So now it trusts the state handle instead of the ring, and resets the ring to latch it. Also starts job ring zero and sets the cache and watchdog bits first, since the boot ROM does neither.

After, first read on a cold boot:

nsh> hexdump /dev/random count=32
/dev/random at 00000000:
0000: 8f ae 90 3a a2 8a b8 5b ba d6 1c b2 2e 7e 87 71
0010: 48 45 f6 e0 02 9b c0 fe 3b 38 d9 14 be 3e 61 ed

Five reads in a row, all different, urandom the same. Rebased on master too.

Built imxrt1170-evk:nsh with the driver on, and imxrt1060-evk:nsh without it to check the shared clock-gate header. nxstyle clean.

@acassis @xiaoxiang781216 review welcome