This series enables Allwinner Crypto Engine backed FIT decryption and FIT
signature/hash validation for secure-boot flows on H6/H616-class boards,
covering both SPL and U-Boot proper.
The purpose is to use CE-backed AES, hash and ECDSA operations on H6/H616
instead of relying only on software crypto paths. Word-aligned ECB and CBC
decryption requests of at least 256 KiB use both the AES and RAES engines
in SPL and U-Boot proper. The AES child uses the same fixed-memory
scheduler for one or two engines. Each engine has two bounded descriptor
banks, so software can refill a retired bank while its peer remains in
flight. One fixed transfer object owns all scheduler state, and the parent
polls and retires each completion snapshot as one operation.
On the H616 test board with the CE at 300 MHz, target-timed and fully
compared 64 MiB AES-256 decrypts reached 561.4 to 566.4 MiB/s for ECB
and CBC with aligned and word-offset buffers. SHA-256 over a 64 MiB
word-offset buffer reached 190.4 MiB/s. P-256 verification took 0.015 to
0.016 seconds.
At a high level this adds:
- SPL driver-model crypto plumbing for AES and hash providers.
- FIT decrypt-to-buffer support and SPL FIT cipher support, so SPL can
decrypt an encrypted U-Boot proper FIT without allocating another full
payload buffer.
- A shared sun8i-ce parent driver with one exclusive task-session
lifecycle, a cacheline-safe DMA mapping API, and one completion
poll/retire path, plus AES, hash and ECDSA children for H6/H616.
- Parallel AES/RAES processing for word-aligned ECB and CBC decryption
requests of at least 256 KiB, using two fixed banks of ten task
descriptors per engine and requesting completion only from each chain
tail.
- An H6/H616 ECDSA child for CE-backed FIT signature validation, plus
common ECDSA curve-size and key-encoding fixes for secp224r1,
prime256v1, secp384r1 and secp521r1.
- Driver-model AES and FIT hash-provider dispatch with software fallback
for unsupported operations and hard-error propagation.
The AES child supports software-provided AES-128/192/256 keys in ECB and
CBC modes, including exact in-place operation. Word-aligned payload
middles use direct DMA regardless of cacheline alignment, while fixed
per-bank edge buffers isolate partial cachelines. Byte-unaligned payloads
use a fixed 64 KiB repack buffer. The hash child supports the CE one-shot
MD5/SHA1/SHA256/SHA384/SHA512 methods used by FIT verification and uses a
fixed 128 KiB repack buffer when needed. No allocation scales with payload
size. The ECDSA child exposes the H6/H616 CE ECC verifier through
UCLASS_ECDSA.
Tested flows include:
- SPL loading an encrypted and signed U-Boot proper FIT with CE-backed
AES decryption, hash verification and ECDSA verification.
- U-Boot proper loading an encrypted and signed FIT with CE-backed AES
decryption, hash verification and ECDSA signature verification.
- U-Boot proper AES command paths using the DM AES provider.
- Target-timed 64 MiB AES-256-ECB encrypt and decrypt at aligned and
word-offset addresses with full-buffer and edge-sentinel comparisons.
- Target-timed 64 MiB AES-256-CBC decrypt out of place and in place at
aligned and word-offset addresses, with repeated full-buffer
comparisons.
- Target-timed 8 MiB AES-128/192/256 ECB and CBC operations with
full-buffer comparisons.
- AES-256 boundary and tail cases at aligned, word-offset and byte-offset
addresses, with cacheline sentinels, exact in-place operation and
partial-overlap rejection.
- Target-timed 64 MiB SHA-256 hashing at aligned, word-offset and
byte-offset addresses with repeated digest comparisons.
- Sandbox provider fallback, hard-error propagation, AES decrypt input
validation and all supported ECDSA curve sizes.
- U-Boot proper CE-backed FIT signature checks with secp224r1,
prime256v1, secp384r1 and secp521r1.
This series depends on the separately submitted
"crypto: hash: use DM providers from hash command" patch.
Signed-off-by: James Hilliard <[email protected]>
---
Changes v5 -> v6:
- Drop stale AES-128 wording and return -EINVAL when the
software AES provider has no selected key
(suggested by Simon Glass)
- Leave signed FIT metadata unchanged and require/verify a payload hash
before unverified in-place decryption, so repeated loads fail before
AES processes plaintext (suggested by Simon Glass)
- Return -ENOSYS from the allocating host decrypt stub
(suggested by Simon Glass)
- Add Reviewed-by tags from Simon Glass for hash-provider
selection, software AES dispatch, and CE ECDSA/hash support
- Send hash-command DM provider selection as a standalone prerequisite
(suggested by Tom Rini)
- Drop unrelated hash_digest_wd() indentation changes from that
prerequisite
(suggested by Tom Rini)
- Add Reviewed-by from Tom Rini to the SPL DM AES patch
- Document that no in-tree configuration relies on the old SPL hash
object key
(suggested by Tom Rini)
- Preserve the existing fit_image_decrypt_data() declaration wrapping
- Link to v5:
https://patch.msgid.link/[email protected]
Changes v4 -> v5:
- Rebase on U-Boot main
- Replace independently claimed channel and engine sessions with one
exclusive parent session that tracks per-channel in-flight state,
deadlines, completion and abort cleanup
- Add one cacheline-safe DMA mapping API for AES, hash and ECDSA, with
descriptor-address validation and complete-cacheline output ownership
- Replace the separate one-shot, bounce and dual-CBC AES paths with one
fixed-memory one/two-lane scheduler using two ten-task banks per lane
- Use AES and RAES in parallel for word-aligned ECB and CBC decryption
requests of at least 256 KiB, with fair refill from a shared cursor
- Direct-map word-aligned cacheline-offset AES buffers using private
per-bank edge cachelines, and use a fixed 64 KiB repack only for
byte-unaligned buffers
- Replace the payload-sized word-unaligned hash bounce with one
continuation stream using 64 MiB direct chunks or a fixed 128 KiB
repack buffer
- Use the normal DM clock and reset lifecycle in SPL and U-Boot proper,
select the required SPL dependencies and retain the pre-RAM DT nodes
- Harden ECDSA input validation and use a cacheline-rounded
private result mapping
- Validate secure boot, every AES key size, AES-256 alignment and overlap
cases, bounded hash streaming and every supported ECDSA curve on H616
- Link to v4:
https://patch.msgid.link/[email protected]
Changes v3 -> v4:
- Enable CE ECDSA in SPL and U-Boot proper on both H6 and H616.
- Validate FIT cipher metadata before accessing key parameters.
- Rebase on U-Boot master.
- Try all registered AES and hash providers, preserving hard provider
errors and using software fallback only when no provider supports the
operation.
- Treat -EINVAL as a hard provider error and reserve fallback for
explicitly unsupported operations.
- Require SPL_OF_CONTROL for SPL FIT decryption and fix disabled AES
stubs.
- Correct AES-192/256 handling in the software DM provider and add
provider, decrypt-input and in-place-decrypt sandbox tests.
- Map SPL FIT destinations after post-processing determines the final
size and size decompression mappings for the maximum output.
- Exercise all supported ECDSA curve sizes in the host FIT signing test.
- Fold per-channel task sessions and engine ownership into the CE parent.
- Trim redundant CE scheduler state and checks, and derive each NIST
curve's a = p - 3 parameter instead of storing duplicate constants.
- Run CBC decrypts of at least 256 KiB across AES and RAES in SPL and
U-Boot proper with double-buffered ten-descriptor chains and tail-only
completion.
- Support exact in-place and aligned-offset dual-engine CBC decrypt.
- Submit ECDSA and hash work on their dedicated completion channels.
- Add target-timed 64 MiB AES-256-CBC and SHA-256 hardware results.
- Link to v3:
https://patch.msgid.link/[email protected]
Changes v2 -> v3:
- Rebase on U-Boot master.
- Add review tags from Svyatoslav Ryhel and Simon Glass.
- Simplify the AES decrypt helper guard and validation flow.
- Document the AES provider in-place CBC decrypt contract.
- Tighten SPL encrypted-FIT buffer handling and error reporting.
- Clean up the SPL DM hash fallback and Kconfig help text.
- Link to v2:
https://patch.msgid.link/[email protected]
To: Ion Agorria <[email protected]>
To: Svyatoslav Ryhel <[email protected]>
To: [email protected]
Cc: Tom Rini <[email protected]>
Cc: James Hilliard <[email protected]>
Cc: Simon Glass <[email protected]>
Cc: Daniel Golle <[email protected]>
Cc: Aristo Chen <[email protected]>
Cc: Thierry Reding <[email protected]>
Cc: Peng Fan <[email protected]>
Cc: Neil Armstrong <[email protected]>
Cc: Vincent Jardin <[email protected]>
Cc: Johan Jonker <[email protected]>
Cc: Francesco Valla <[email protected]>
Cc: Andre Przywara <[email protected]>
Cc: Lukasz Majewski <[email protected]>
Cc: Richard Genoud <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Quentin Schulz <[email protected]>
Cc: Marek Vasut <[email protected]>
Cc: Randolph Sapp <[email protected]>
Cc: Alexey Charkov <[email protected]>
Cc: Michael Trimarchi <[email protected]>
Cc: Quentin Schulz <[email protected]>
---
James Hilliard (13):
cmd: aes: fix DM operation handling
crypto: aes: allow DM AES in SPL
crypto: hash: allow DM hash in SPL
boot: image: try all DM hash providers
crypto: aes: fix software key-size handling
crypto: aes: add software-key provider dispatch
boot: image: add FIT decrypt-to-buffer helper
spl: fit: support encrypted payloads
clk: sunxi: add H6/H616 CE gates and reset
lib: ecdsa: support additional curve sizes
crypto: allwinner: add sun8i-ce AES driver
crypto: allwinner: add sun8i-ce ECDSA verifier
crypto: allwinner: add sun8i-ce hash driver
MAINTAINERS | 1 +
arch/arm/dts/sunxi-u-boot.dtsi | 15 +
boot/Kconfig | 9 +
boot/image-cipher.c | 47 +-
boot/image-fit.c | 116 ++-
cmd/aes.c | 8 +-
common/spl/spl_fit.c | 89 ++-
doc/mkimage.1 | 3 +
doc/usage/fit/signature.rst | 9 +-
drivers/clk/sunxi/clk_h6.c | 5 +
drivers/clk/sunxi/clk_h616.c | 5 +
drivers/crypto/Kconfig | 2 +
drivers/crypto/Makefile | 1 +
drivers/crypto/aes/Kconfig | 8 +
drivers/crypto/aes/aes-sw.c | 51 +-
drivers/crypto/aes/aes-uclass.c | 73 ++
drivers/crypto/allwinner/Kconfig | 3 +
drivers/crypto/allwinner/Makefile | 3 +
drivers/crypto/allwinner/sun8i-ce/Kconfig | 161 ++++
drivers/crypto/allwinner/sun8i-ce/Makefile | 6 +
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-aes.c | 809 +++++++++++++++++++++
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 791 ++++++++++++++++++++
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-ecdsa.c | 382 ++++++++++
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 343 +++++++++
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 128 ++++
drivers/crypto/hash/Kconfig | 13 +
drivers/crypto/hash/Makefile | 2 +-
drivers/crypto/tegra/tegra_aes.c | 7 +
include/image.h | 39 +
include/u-boot/aes.h | 27 +-
include/u-boot/ecdsa.h | 22 +
include/u-boot/fdt-libcrypto.h | 6 +-
include/uboot_aes.h | 90 ++-
lib/Makefile | 2 +-
lib/aes/aes-decrypt.c | 91 ++-
lib/ecdsa/Kconfig | 2 +-
lib/ecdsa/ecdsa-libcrypto.c | 141 ++--
lib/ecdsa/ecdsa-verify.c | 39 +-
lib/fdt-libcrypto.c | 60 +-
test/dm/aes.c | 258 +++++++
test/lib/Makefile | 3 +
test/lib/test_aes_decrypt.c | 89 +++
test/py/tests/test_fit_ecdsa.py | 18 +-
tools/image-sig-host.c | 7 +
44 files changed, 3742 insertions(+), 242 deletions(-)
---
base-commit: e354b34a6ab4b1887fd451bea8ceb7be146070a8
change-id: 20260702-submit-ce-series-v2-4a77b170c68c
Best regards,
--
James Hilliard <[email protected]>
