Repository navigation
{bp-20193} arch/arm64: AES using the Armv8 Cryptography Extension - #20313
Merged
Merged
Conversation
up_addrenv_va_to_pa() is declared in include/nuttx/arch.h but implemented only by armv7-a, so no arm64 port can map a virtual address to a physical one. A driver whose device addresses memory physically has nothing to call. The translation is asked of the MMU with AT S1E1R rather than walked in software, so it answers for whatever is actually mapped: any granule size, block or page, at any level, and it cannot drift from the tables in use. PAR_EL1 is one register per CPU, so nothing may run between the translation and reading the result. Interrupts are banked with it, so masking them locally is sufficient and SMP needs nothing further. Returns zero for an address that is not mapped for a privileged read, which is what the declaration in arch.h specifies. Note this differs from the armv7-a implementation, which returns the virtual address unchanged. Signed-off-by: Royyan Zahir <royzah@gmail.com>
NuttX emits no AES instruction on any arm64 core. There is no runtime feature dispatch in arch/arm64, so every AES goes through crypto/rijndael.c or crypto/aes.c, and the table-driven one indexes memory with key-dependent values, so its timing follows the cache. Provide aes_cypher() for ECB, CBC and CTR built on AESE, AESD and the MixColumns pair, and register it with /dev/crypto as a hardware driver alongside the existing stm32h7, sam34 and esp32 modules. ID_AA64ISAR0_EL1.AES is read on every call, which returns -ENOTSUP rather than trapping on a core without the extension. Verified against the NIST SP 800-38A appendix F vectors for ECB-128, ECB-256, CBC-128, CBC-192 and CTR-128, encrypt and decrypt, in place and out of place. Signed-off-by: Royyan Zahir <royzah@gmail.com>
jerpelea
requested review from
acassis,
cederom,
linguini1 and
xiaoxiang781216
September 23, 2026 11:50
github-actions
Bot
added
Arch: arm64
|
linguini1
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NuttX emits no AES instruction on any core. arm64 has no runtime feature dispatch, so a part that implements the Cryptography Extension still runs https://github.com/apache/nuttx/blob/master/crypto/rijndael.c, which indexes eight 256-entry tables with key-dependent values and so has cache-dependent timing.
How
aes_cypher()for ECB, CBC and CTR onAESE,AESDand the MixColumns pair, registered with/dev/cryptobeside https://github.com/apache/nuttx/blob/master/arch/arm/src/stm32h7/stm32_crypto.c, https://github.com/apache/nuttx/blob/master/arch/arm/src/sam34/sam_crypto.c and https://github.com/apache/nuttx/blob/master/arch/xtensa/src/esp32/esp32_crypto.c.
Point | -- | -- the first version defined the crypto/aes.h entry points | same five symbols as https://github.com/apache/nuttx/blob/master/crypto/aes.c, independent Kconfig gates, so enabling both failed to link. The aes_cypher() shape has no such clash SubWord borrows AESE with a zero round key | that yields the substituted word only if ShiftRows has nothing to move, so the word is replicated across all four columns first the CTR counter is the last four bytes | as https://github.com/apache/nuttx/blob/master/crypto/xform.c does, so both agree on what a stream looks likeID_AA64ISAR0_EL1.AESis read on every call, returning-ENOTSUPrather than trapping.Open, and why this is still a draft:
xform.c,gmac.c,cmac.candkey_wrap.creach AES throughAES_CTXand keep the table version. Gatingcrypto/aes.coff when an arch provides those entry points would cover them. Happy to add that here.includes
#20192
Impact
RELEASE
Testing
CI