[PATCH v3 03/10] boot: image: add FIT decrypt-to-buffer helper
James Hilliard
james.hilliard1 at gmail.com
Fri Jul 10 00:46:25 CEST 2026
FIT cipher support currently allocates the output buffer inside the AES
helper. SPL often needs to decrypt directly into a caller-selected
buffer, for example a load buffer or a scratch buffer used before
decompression.
Add a decrypt_to callback to the FIT cipher algorithm and wire it up for
AES. The existing allocating decrypt path becomes a wrapper around the
new helper.
Validate the FIT cipher key length, IV length and unciphered-size
property while preparing decryption, and build lib/aes/ by phase when
FIT_CIPHER is enabled so the target-side decrypt helper is available to
SPL builds.
When DM_AES is enabled, try the first UCLASS_AES provider before using
the software AES fallback in U-Boot proper. If a provider is present,
ask the provider for the software-provided key slot before loading the
FIT key, so hardware-specific reserved or preloaded slot policy stays in
the provider. Return AES device errors to the caller instead of hiding
them with a software fallback after the device has accepted the operation.
For U-Boot proper, use decrypt_to for in-place decryption when the FIT
payload is already in writable RAM. The encrypted data is no longer
needed after hash verification, and this avoids a full-size allocation
for encrypted payloads loaded into DRAM.
Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
Reviewed-by: Simon Glass <sjg at chromium.org>
---
Changes v2 -> v3:
- Flip the image_aes_decrypt_to() host-tool guard (suggested by Simon Glass)
- Let image_aes_decrypt_to() be the single length-validation path
(suggested by Simon Glass)
- Document that AES CBC decrypt providers must support in-place decrypt
(suggested by Simon Glass)
Changes v1 -> v2:
- Explain FIT cipher validation (suggested by Simon Glass)
- Explain phase-keyed lib/aes builds (suggested by Simon Glass)
- Return -ENOSYS without decrypt support (suggested by Simon Glass)
- Let AES providers choose the software-provided key slot
- Use decrypt_to for U-Boot proper in-place decrypt
---
boot/image-cipher.c | 38 ++++++++++++--
boot/image-fit.c | 33 +++++++++++--
drivers/crypto/aes/aes-sw.c | 6 +++
drivers/crypto/aes/aes-uclass.c | 15 ++++++
drivers/crypto/tegra/tegra_aes.c | 7 +++
include/image.h | 39 +++++++++++++--
include/u-boot/aes.h | 10 ++++
include/uboot_aes.h | 40 +++++++++++++--
lib/Makefile | 2 +-
lib/aes/aes-decrypt.c | 104 +++++++++++++++++++++++++++++++++------
10 files changed, 264 insertions(+), 30 deletions(-)
diff --git a/boot/image-cipher.c b/boot/image-cipher.c
index 9d389f26cea..93b3dd3c637 100644
--- a/boot/image-cipher.c
+++ b/boot/image-cipher.c
@@ -25,6 +25,7 @@ struct cipher_algo cipher_algos[] = {
#endif
.encrypt = image_aes_encrypt,
.decrypt = image_aes_decrypt,
+ .decrypt_to = image_aes_decrypt_to,
.add_cipher_data = image_aes_add_cipher_data
},
{
@@ -36,6 +37,7 @@ struct cipher_algo cipher_algos[] = {
#endif
.encrypt = image_aes_encrypt,
.decrypt = image_aes_decrypt,
+ .decrypt_to = image_aes_decrypt_to,
.add_cipher_data = image_aes_add_cipher_data
},
{
@@ -47,6 +49,7 @@ struct cipher_algo cipher_algos[] = {
#endif
.encrypt = image_aes_encrypt,
.decrypt = image_aes_decrypt,
+ .decrypt_to = image_aes_decrypt_to,
.add_cipher_data = image_aes_add_cipher_data
}
};
@@ -70,6 +73,7 @@ static int fit_image_setup_decrypt(struct image_cipher_info *info,
int cipher_noffset)
{
const void *fdt = gd_fdt_blob();
+ int key_len, iv_len;
const char *node_name;
char node_path[128];
int noffset;
@@ -94,7 +98,7 @@ static int fit_image_setup_decrypt(struct image_cipher_info *info,
return -1;
}
- info->iv = fdt_getprop(fit, cipher_noffset, "iv", NULL);
+ info->iv = fdt_getprop(fit, cipher_noffset, "iv", &iv_len);
info->ivname = fdt_getprop(fit, cipher_noffset, "iv-name-hint", NULL);
if (!info->iv && !info->ivname) {
@@ -136,20 +140,28 @@ static int fit_image_setup_decrypt(struct image_cipher_info *info,
}
/* read key */
- info->key = fdt_getprop(fdt, noffset, "key", NULL);
+ info->key = fdt_getprop(fdt, noffset, "key", &key_len);
if (!info->key) {
printf("Can't get key in cipher node '%s'\n", node_path);
return -1;
}
+ if (key_len != info->cipher->key_len) {
+ printf("Bad key length in cipher node '%s'\n", node_path);
+ return -1;
+ }
/* read iv */
if (!info->iv) {
- info->iv = fdt_getprop(fdt, noffset, "iv", NULL);
+ info->iv = fdt_getprop(fdt, noffset, "iv", &iv_len);
if (!info->iv) {
printf("Can't get IV in cipher node '%s'\n", node_path);
return -1;
}
}
+ if (iv_len != info->cipher->iv_len) {
+ printf("Bad IV length for cipher in image '%s'\n", node_name);
+ return -1;
+ }
return 0;
}
@@ -173,3 +185,23 @@ int fit_image_decrypt_data(const void *fit,
out:
return ret;
}
+
+int fit_image_decrypt_data_to(const void *fit,
+ int image_noffset, int cipher_noffset,
+ const void *data_ciphered, size_t size_ciphered,
+ void *data_unciphered, size_t *size_unciphered)
+{
+ struct image_cipher_info info;
+ int ret;
+
+ ret = fit_image_setup_decrypt(&info, fit, image_noffset,
+ cipher_noffset);
+ if (ret < 0)
+ return ret;
+
+ if (!info.cipher->decrypt_to)
+ return -ENOSYS;
+
+ return info.cipher->decrypt_to(&info, data_ciphered, size_ciphered,
+ data_unciphered, size_unciphered);
+}
diff --git a/boot/image-fit.c b/boot/image-fit.c
index 044a40e1910..a4192db5eb5 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1030,7 +1030,7 @@ int fit_image_get_data_size(const void *fit, int noffset, int *data_size)
*
* @fit: pointer to the FIT image header
* @noffset: component image node offset
- * @data_size: holds the data-size property
+ * @data_size: holds the data-size-unciphered property
*
* returns:
* 0, on success
@@ -1040,10 +1040,13 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset,
size_t *data_size)
{
const fdt32_t *val;
+ int len;
- val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
+ val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
if (!val)
return -ENOENT;
+ if (len != sizeof(*val))
+ return -EINVAL;
*data_size = (size_t)fdt32_to_cpu(*val);
@@ -1568,15 +1571,37 @@ static int fit_image_uncipher(const void *fit, int image_noffset,
if (cipher_noffset < 0)
return 0;
+#ifndef USE_HOSTCC
+ if (!tools_build()) {
+ ulong start = map_to_sysmem(*data);
+ ulong end = start + *size;
+
+ /*
+ * Avoid a full-size allocation when the FIT payload is already
+ * in writable DRAM. The encrypted bytes are no longer needed
+ * after hash verification has completed.
+ */
+ if (end >= start && start >= gd->ram_base && end <= gd->ram_top) {
+ ret = fit_image_decrypt_data_to(fit, image_noffset,
+ cipher_noffset,
+ *data, *size, *data,
+ &size_dst);
+ if (ret != -ENOSYS)
+ goto out;
+ }
+ }
+#endif
+
ret = fit_image_decrypt_data(fit, image_noffset, cipher_noffset,
*data, *size, &dst, &size_dst);
if (ret)
goto out;
*data = dst;
- *size = size_dst;
+out:
+ if (!ret)
+ *size = size_dst;
- out:
return ret;
}
diff --git a/drivers/crypto/aes/aes-sw.c b/drivers/crypto/aes/aes-sw.c
index a65200fb79b..3ce8999663b 100644
--- a/drivers/crypto/aes/aes-sw.c
+++ b/drivers/crypto/aes/aes-sw.c
@@ -39,6 +39,11 @@ static int sw_aes_ops_available_key_slots(struct udevice *dev)
return SW_KEY_SLOTS;
}
+static int sw_aes_ops_get_software_key_slot(struct udevice *dev)
+{
+ return 0;
+}
+
static int sw_aes_ops_select_key_slot(struct udevice *dev, u32 key_size, u8 slot)
{
struct sw_aes_priv *priv = dev_get_priv(dev);
@@ -145,6 +150,7 @@ static int sw_aes_ops_aes_cbc_decrypt(struct udevice *dev, u8 *iv, u8 *src,
static const struct aes_ops aes_ops_sw = {
.available_key_slots = sw_aes_ops_available_key_slots,
+ .get_software_key_slot = sw_aes_ops_get_software_key_slot,
.select_key_slot = sw_aes_ops_select_key_slot,
.set_key_for_key_slot = sw_aes_ops_set_key_for_key_slot,
.aes_ecb_encrypt = sw_aes_ops_aes_ecb_encrypt,
diff --git a/drivers/crypto/aes/aes-uclass.c b/drivers/crypto/aes/aes-uclass.c
index 5bdd3d736c4..2bfe3dc3fcc 100644
--- a/drivers/crypto/aes/aes-uclass.c
+++ b/drivers/crypto/aes/aes-uclass.c
@@ -23,6 +23,21 @@ int dm_aes_get_available_key_slots(struct udevice *dev)
return ops->available_key_slots(dev);
}
+int dm_aes_get_software_key_slot(struct udevice *dev)
+{
+ const struct aes_ops *ops;
+
+ if (!dev)
+ return -ENODEV;
+
+ ops = aes_get_ops(dev);
+
+ if (!ops->get_software_key_slot)
+ return -ENOSYS;
+
+ return ops->get_software_key_slot(dev);
+}
+
int dm_aes_select_key_slot(struct udevice *dev, u32 key_size, u8 slot)
{
const struct aes_ops *ops;
diff --git a/drivers/crypto/tegra/tegra_aes.c b/drivers/crypto/tegra/tegra_aes.c
index 55a4cec525b..348115ac5a7 100644
--- a/drivers/crypto/tegra/tegra_aes.c
+++ b/drivers/crypto/tegra/tegra_aes.c
@@ -321,6 +321,12 @@ static int tegra_aes_ops_available_key_slots(struct udevice *dev)
return 4; /* 4 slots in Tegra20 and Tegra30 */
}
+static int tegra_aes_ops_get_software_key_slot(struct udevice *dev)
+{
+ /* Avoid SBK slot 0, which may hold a preloaded key. */
+ return TEGRA_AES_SLOT_SBK + 1;
+}
+
static int tegra_aes_ops_select_key_slot(struct udevice *dev, u32 key_size, u8 slot)
{
struct tegra_aes_priv *priv = dev_get_priv(dev);
@@ -565,6 +571,7 @@ static int tegra_aes_probe(struct udevice *dev)
static const struct aes_ops tegra_aes_ops = {
.available_key_slots = tegra_aes_ops_available_key_slots,
+ .get_software_key_slot = tegra_aes_ops_get_software_key_slot,
.select_key_slot = tegra_aes_ops_select_key_slot,
.set_key_for_key_slot = tegra_aes_ops_set_key_for_key_slot,
.aes_ecb_encrypt = tegra_aes_ops_aes_ecb_encrypt,
diff --git a/include/image.h b/include/image.h
index 9c8a746d576..5edbf8fdc33 100644
--- a/include/image.h
+++ b/include/image.h
@@ -1862,11 +1862,40 @@ int fit_image_check_sig(const void *fit, int noffset, const void *data,
size_t size, const void *key_blob, int required_keynode,
char **err_msgp);
-int fit_image_decrypt_data(const void *fit,
- int image_noffset, int cipher_noffset,
- const void *data, size_t size,
+/**
+ * fit_image_decrypt_data() - Decrypt a FIT image payload
+ *
+ * @fit: FIT image
+ * @image_noffset: Offset of the image node to decrypt
+ * @cipher_noffset: Offset of the cipher node for the image
+ * @data: Encrypted image payload
+ * @size: Size of encrypted image payload
+ * @data_unciphered: Returns allocated decrypted payload
+ * @size_unciphered: Returns size of decrypted payload
+ * Return: 0 on success, <0 on error
+ */
+int fit_image_decrypt_data(const void *fit, int image_noffset,
+ int cipher_noffset, const void *data, size_t size,
void **data_unciphered, size_t *size_unciphered);
+/**
+ * fit_image_decrypt_data_to() - Decrypt a FIT image payload to a buffer
+ *
+ * @fit: FIT image
+ * @image_noffset: Offset of the image node to decrypt
+ * @cipher_noffset: Offset of the cipher node for the image
+ * @data: Encrypted image payload
+ * @size: Size of encrypted image payload
+ * @data_unciphered: Destination buffer for decrypted payload. The caller
+ * must provide at least @size bytes.
+ * @size_unciphered: Returns size of decrypted payload
+ * Return: 0 on success, <0 on error
+ */
+int fit_image_decrypt_data_to(const void *fit,
+ int image_noffset, int cipher_noffset,
+ const void *data, size_t size,
+ void *data_unciphered, size_t *size_unciphered);
+
/**
* fit_region_make_list() - Make a list of regions to hash
*
@@ -1960,6 +1989,10 @@ struct cipher_algo {
int (*decrypt)(struct image_cipher_info *info,
const void *cipher, size_t cipher_len,
void **data, size_t *data_len);
+
+ int (*decrypt_to)(struct image_cipher_info *info,
+ const void *cipher, size_t cipher_len,
+ void *data, size_t *data_len);
};
int fit_image_cipher_get_algo(const void *fit, int noffset, char **algo);
diff --git a/include/u-boot/aes.h b/include/u-boot/aes.h
index acbc50b9e6f..6d81af3780d 100644
--- a/include/u-boot/aes.h
+++ b/include/u-boot/aes.h
@@ -34,6 +34,9 @@ int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest,
int image_aes_decrypt(struct image_cipher_info *info,
const void *cipher, size_t cipher_len,
void **data, size_t *size);
+int image_aes_decrypt_to(struct image_cipher_info *info,
+ const void *cipher, size_t cipher_len,
+ void *data, size_t *size);
#else
int image_aes_decrypt(struct image_cipher_info *info,
const void *cipher, size_t cipher_len,
@@ -41,6 +44,13 @@ int image_aes_decrypt(struct image_cipher_info *info,
{
return -ENXIO;
}
+
+int image_aes_decrypt_to(struct image_cipher_info *info,
+ const void *cipher, size_t cipher_len,
+ void *data, size_t *size)
+{
+ return -ENXIO;
+}
#endif /* IMAGE_ENABLE_DECRYPT */
#endif
diff --git a/include/uboot_aes.h b/include/uboot_aes.h
index 592b7dbee43..92a667badc1 100644
--- a/include/uboot_aes.h
+++ b/include/uboot_aes.h
@@ -128,11 +128,17 @@ struct udevice;
* Note that some devices like Tegra AES engine may contain preloaded keys by bootrom,
* thus in those cases the set_key_for_key_slot() may be skipped.
*
- * Sequence for a series of AES CBC encryption, one decryption and a CMAC hash example
- * with 128bits key at slot 0 would be as follow:
+ * Generic callers which load a software-provided key should first ask the
+ * driver for a suitable software key slot. This lets hardware drivers avoid
+ * reserved or preloaded slots while keeping the slot policy local to the
+ * provider.
*
- * set_key_for_key_slot(DEV, 128, KEY, 0);
- * select_key_slot(DEV, 128, 0);
+ * Sequence for a series of AES CBC encryption, one decryption and a CMAC hash
+ * example with a 128-bit software-provided key would be as follows:
+ *
+ * slot = get_software_key_slot(DEV);
+ * set_key_for_key_slot(DEV, 128, KEY, slot);
+ * select_key_slot(DEV, 128, slot);
* aes_cbc_encrypt(DEV, IV1, SRC1, DST1, LEN1);
* aes_cbc_encrypt(DEV, IV2, SRC2, DST2, LEN2);
* aes_cbc_decrypt(DEV, IV3, SRC3, DST3, LEN3);
@@ -146,6 +152,16 @@ struct aes_ops {
*/
int (*available_key_slots)(struct udevice *dev);
+ /**
+ * get_software_key_slot() - Get a slot for software-provided keys
+ *
+ * @dev The AES udevice
+ * @return Key slot to use for a software-provided key,
+ * 0 or positive on success, negative value on
+ * failure
+ */
+ int (*get_software_key_slot)(struct udevice *dev);
+
/**
* select_key_slot() - Selects the AES key slot to use for following operations
*
@@ -210,6 +226,7 @@ struct aes_ops {
* @iv Initialization vector
* @src Source data of length 'num_aes_blocks' blocks
* @dst Destination data of length 'num_aes_blocks' blocks
+ * Must support dst == src for in-place decrypt
* @num_aes_blocks Number of AES blocks to encrypt/decrypt
* @return 0 on success, negative value on failure
*/
@@ -229,6 +246,15 @@ struct aes_ops {
*/
int dm_aes_get_available_key_slots(struct udevice *dev);
+/**
+ * dm_aes_get_software_key_slot - Get a slot for software-provided keys
+ *
+ * @dev The AES udevice
+ * Return: Key slot to use for a software-provided key,
+ * 0 or positive on success, -ve on failure
+ */
+int dm_aes_get_software_key_slot(struct udevice *dev);
+
/**
* dm_aes_select_key_slot - Selects the AES key slot to use for following operations
*
@@ -291,6 +317,7 @@ int dm_aes_cbc_encrypt(struct udevice *dev, u8 *iv, u8 *src, u8 *dst, u32 num_ae
* @iv Initialization vector
* @src Source data of length 'num_aes_blocks' blocks
* @dst Destination data of length 'num_aes_blocks' blocks
+ * Must support dst == src for in-place decrypt
* @num_aes_blocks Number of AES blocks to encrypt/decrypt
* Return: 0 on success, negative value on failure
*/
@@ -316,6 +343,11 @@ static inline int dm_aes_get_available_key_slots(struct udevice *dev)
return -ENOSYS;
}
+static inline int dm_aes_get_software_key_slot(struct udevice *dev)
+{
+ return -ENOSYS;
+}
+
static inline int dm_aes_select_key_slot(struct udevice *dev, u32 key_size, u8 slot)
{
return -ENOSYS;
diff --git a/lib/Makefile b/lib/Makefile
index d0ffabc2b47..c69a928e6d8 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_ARCH_AT91) += at91/
obj-$(CONFIG_OPTEE_LIB) += optee/
obj-$(CONFIG_AES) += aes.o
-obj-$(CONFIG_AES) += aes/
obj-$(CONFIG_$(PHASE_)BINMAN_FDT) += binman.o
obj-$(CONFIG_FW_LOADER) += fw_loader.o
@@ -88,6 +87,7 @@ obj-$(CONFIG_$(PHASE_)ASN1_DECODER_LEGACY) += asn1_decoder.o
obj-$(CONFIG_$(PHASE_)ZLIB) += zlib/
obj-$(CONFIG_$(PHASE_)ZSTD) += zstd/
+obj-$(CONFIG_$(PHASE_)FIT_CIPHER) += aes/
obj-$(CONFIG_$(PHASE_)GZIP) += gunzip.o
obj-$(CONFIG_$(PHASE_)LZO) += lzo/
obj-$(CONFIG_$(PHASE_)LZMA) += lzma/
diff --git a/lib/aes/aes-decrypt.c b/lib/aes/aes-decrypt.c
index 741102a4723..6432320e79b 100644
--- a/lib/aes/aes-decrypt.c
+++ b/lib/aes/aes-decrypt.c
@@ -4,37 +4,111 @@
*/
#ifndef USE_HOSTCC
+#include <dm.h>
#include <malloc.h>
#endif
#include <image.h>
#include <uboot_aes.h>
+#ifndef USE_HOSTCC
+static int image_aes_validate_lengths(struct image_cipher_info *info,
+ size_t cipher_len)
+{
+ if (!cipher_len || cipher_len % AES_BLOCK_LENGTH ||
+ info->size_unciphered > cipher_len)
+ return -EINVAL;
+
+ return 0;
+}
+#endif
+
+int image_aes_decrypt_to(struct image_cipher_info *info,
+ const void *cipher, size_t cipher_len,
+ void *data, size_t *size)
+{
+#ifdef USE_HOSTCC
+ return -ENOSYS;
+#else
+ unsigned int aes_blocks, key_len = info->cipher->key_len;
+ int ret;
+
+ ret = image_aes_validate_lengths(info, cipher_len);
+ if (ret)
+ return ret;
+
+ *size = info->size_unciphered;
+
+ if (CONFIG_IS_ENABLED(DM_AES)) {
+ struct udevice *dev;
+
+ ret = uclass_first_device_err(UCLASS_AES, &dev);
+ if (!ret) {
+ u8 slot;
+
+ ret = dm_aes_get_software_key_slot(dev);
+ if (ret < 0)
+ return ret;
+ if (ret > 0xff)
+ return -ERANGE;
+ slot = ret;
+
+ ret = dm_aes_set_key_for_key_slot(dev, key_len * 8,
+ (u8 *)info->key,
+ slot);
+ if (ret)
+ return ret;
+
+ ret = dm_aes_select_key_slot(dev, key_len * 8, slot);
+ if (ret)
+ return ret;
+
+ aes_blocks = cipher_len / AES_BLOCK_LENGTH;
+
+ return dm_aes_cbc_decrypt(dev, (u8 *)info->iv,
+ (u8 *)cipher, data,
+ aes_blocks);
+ }
+ }
+
+ if (!IS_ENABLED(CONFIG_XPL_BUILD)) {
+ unsigned char key_exp[AES256_EXPAND_KEY_LENGTH];
+
+ /* First we expand the key. */
+ aes_expand_key((u8 *)info->key, key_len, key_exp);
+
+ /* Calculate the number of AES blocks to decrypt. */
+ aes_blocks = cipher_len / AES_BLOCK_LENGTH;
+
+ aes_cbc_decrypt_blocks(key_len, key_exp, (u8 *)info->iv,
+ (u8 *)cipher, data, aes_blocks);
+ return 0;
+ }
+
+ return -ENOSYS;
+#endif
+}
+
int image_aes_decrypt(struct image_cipher_info *info,
const void *cipher, size_t cipher_len,
void **data, size_t *size)
{
-#ifndef USE_HOSTCC
- unsigned char key_exp[AES256_EXPAND_KEY_LENGTH];
- unsigned int aes_blocks, key_len = info->cipher->key_len;
+#ifdef USE_HOSTCC
+ return 0;
+#else
+ int ret;
*data = malloc(cipher_len);
if (!*data) {
printf("Can't allocate memory to decrypt\n");
return -ENOMEM;
}
- *size = info->size_unciphered;
-
- memcpy(&key_exp[0], info->key, key_len);
- /* First we expand the key. */
- aes_expand_key((u8 *)info->key, key_len, key_exp);
-
- /* Calculate the number of AES blocks to encrypt. */
- aes_blocks = DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH);
+ ret = image_aes_decrypt_to(info, cipher, cipher_len, *data, size);
+ if (ret) {
+ free(*data);
+ *data = NULL;
+ }
- aes_cbc_decrypt_blocks(key_len, key_exp, (u8 *)info->iv,
- (u8 *)cipher, *data, aes_blocks);
+ return ret;
#endif
-
- return 0;
}
--
2.53.0
More information about the U-Boot
mailing list