Add NXP QorIQ SEC (CAAM) hardware crypto port for PowerPC T-series

[dgarske]

wolfSSL has had no PowerPC QorIQ SEC support. The existing wolfcrypt/src/port/caam/ code builds only for i.MX under QNX, INTEGRITY or the i.MX8 SECO firmware, so on a T-series part the only acceleration available was the scalar PowerPC assembly. This adds a self-contained port under wolfcrypt/src/port/nxp/ that drives the SEC through wolfCrypt's crypto callback layer, selected at runtime by devId.

Three commits, kept separate because the first two touch shared API rather than the port:

1. A crypto callback hook for finite field Diffie-Hellman. WC_PK_TYPE_DH was in the enum but had no entry in wc_CryptoInfo, no wc_CryptoCb_Dh() and no call site in dh.c, and DhKey had no devId, so no port could offload DH at all. Only key agreement is routed; the SP 800-56A group and peer-key validation is hoisted above the dispatch so a device cannot skip it.
2. WOLFSSL_NO_DH_GEN_PARAMS, with --enable-keygen=no-dh-params and a matching CMake option, so a constrained target can drop safe-prime search while keeping DH key generation.
3. The QorIQ SEC port itself. AESA (AES-128/192/256 CBC/CTR/ECB, and AES-GCM with AAD where the engine checks the tag on decrypt), PKHA (ECDSA sign/verify and ECDH on any prime curve wolfCrypt carries, RSA public and private to 4096 bit, FFDHE agreement), MDHA (driver API only; hashing is not routed through the callback yet) and RNG4 for DRBG seeding. Everything else returns CRYPTOCB_UNAVAILABLE and runs in software, and that fallback covers run-time failures too, so an unsupported case is a performance question rather than a correctness one.

Measured on real silicon. T2080E at 1.2 GHz against plain C: AES-128-GCM 8.07 to 107.42 MiB/s (13.3x), ECDSA P-256 verify 49.4 to 592.0 ops/s (12.0x), RSA-2048 private 1.88 to 58.29 ops/s (31x), DH-2048 agree 16.5 to 477.1 ops/s (28.9x). T1040E at 1.4 GHz against PowerPC assembly, the more conservative baseline: AES-128-GCM 35.80 to 91.92 MiB/s (2.6x), RSA-2048 private 1.71 to 17.19 ops/s (10.1x), ECDSA verify 43.5 to 350.2 ops/s (8.1x).

Verified on a Curtiss-Wright VPX3-152 (T2080E) and an NXP T1040D4RDB: wolfcrypt_test() passes in full on both, including AES, AES-GCM, RSA, DH and ECC, pushing about 3.4 million descriptors per run. The T2080 has PKHA v2 and the T1040 v1; the same driver covers both unchanged. Also builds under --enable-all on x86-64 and compiles clean under NO_RSA, WOLFSSL_SEC_QORIQ_NO_PKHA, WOLFSSL_SEC_QORIQ_NO_RSA, WOLFSSL_RSA_PUBLIC_ONLY and WOLFSSL_SMALL_STACK.

The PKHA built-in curve table does not work on this silicon. A descriptor is supposed to be able to name a preloaded curve by index, which the i.MX port relies on. On the QorIQ parts every flag position in bits 25:17 crossed with every curve index 0..31 (288 combinations swept on hardware) is refused with DECO error 0x82, and the "already hashed" PROTINFO flag with 0x81. The port supplies the domain parameters explicitly instead, four extra descriptor words for any prime curve rather than the five built in.

One fix outside the port. DecodeECC_DSA_Sig_Ex() ends with mp_clear(r); mp_clear(s); on its error path, but with init set the halves are only initialized as items parse, so an early decode failure reaches those calls with uninitialized values. Under SP math sp_clear() then zeroes a garbage-sized run of the caller's stack, and the crash lands far from the cause. Found on a T2080 with a hardware write watchpoint, traced back from a branch to address zero. It is latent for any caller passing init non-zero, the async ECC verify path included. Happy to split it out if you would rather review it separately.

Known limitations, all in wolfcrypt/src/port/nxp/README.md: hashing is not routed through the callback; buffers must be physically contiguous with no scatter-gather; GCM takes a 12-byte IV and a full 16-byte tag only; 32-bit descriptor pointers only; one job ring, polled, serialised on the hardware mutex. An ECDSA digest wider than the curve order uses the leftmost-order-bits reduction, except on a curve whose order does not fill the fixed-width block, which is declined because wolfCrypt finishes that truncation with a sub-byte shift the layout cannot express (no curve in common use is affected).

This port is bare metal. Its /dev/mem backend initialises on a stock Linux but offloads nothing: 32-bit descriptor pointer mode cannot reach user pages, which sit above 4 GB on a 36-bit part. Rather than push that further, the Linux path is handled by a separate change that gives the existing wolfcrypt/src/port/caam/ driver a Linux user space backend (--enable-caam=linux), validated on the same T1040D4RDB. That one accelerates AES-CBC/CTR/ECB and the TRNG at roughly 0.6x software throughput, because operands have to be staged into a reserved physical pool; the reason to enable it is the TRNG and moving work off the core, not speed. Bare metal remains the fast path, and the READMEs say so.

[Copilot]

Pull request overview

This PR adds a new NXP QorIQ SEC (CAAM-derivative) hardware acceleration port for PowerPC QorIQ T-series, routed through wolfCrypt’s crypto callback layer and selected via devId. It also extends the crypto callback API to support finite-field Diffie-Hellman agreement and introduces a build option to disable DH domain-parameter generation while keeping DH key generation.

Changes:

• Add WC_PK_TYPE_DH support to the crypto callback interface and route DH agreement through it (with validation kept in software above dispatch).
• Add WOLFSSL_NO_DH_GEN_PARAMS (Autotools + CMake + tests) to optionally drop DH safe-prime parameter generation.
• Add the new wolfcrypt/src/port/nxp/ SEC QorIQ driver (AES, GCM, RNG4 seeding, PKHA-backed RSA/ECC/DH via callback, plus bare-metal + Linux backends) and integrate it into init/cleanup and build systems.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/wc_port.h	Enable hw-crypto mutex when WOLFSSL_SEC_QORIQ is set.
wolfssl/wolfcrypt/settings.h	Add WOLFSSL_SEC_QORIQ configuration, backend selection, and default devId wiring.
wolfssl/wolfcrypt/port/nxp/sec_qoriq.h	Public header for SEC QorIQ driver API, config knobs, and register/descriptor definitions.
wolfssl/wolfcrypt/include.am	Install (or noinst) the new SEC QorIQ public header based on build option.
wolfssl/wolfcrypt/dh.h	Add devId to DhKey and gate DH parameter generation with WOLFSSL_NO_DH_GEN_PARAMS.
wolfssl/wolfcrypt/cryptocb.h	Extend wc_CryptoInfo to carry DH agreement inputs/outputs and declare wc_CryptoCb_Dh().
wolfcrypt/test/test.c	Skip DH parameter-generation tests when WOLFSSL_NO_DH_GEN_PARAMS is enabled.
wolfcrypt/src/wc_port.c	Initialize/cleanup SEC QorIQ device during wolfCrypt_Init/Cleanup.
wolfcrypt/src/port/nxp/sec_qoriq.c	Core SEC QorIQ device init, ring mgmt, descriptor building/submission, and error parsing.
wolfcrypt/src/port/nxp/sec_qoriq_rng.c	RNG4 instantiation + random block generation for seeding.
wolfcrypt/src/port/nxp/sec_qoriq_pkha.c	PKHA protocol descriptors for ECC sign/verify/ECDH and RSA/modexp building blocks.
wolfcrypt/src/port/nxp/sec_qoriq_linux.c	Linux userspace backend: /dev/mem mapping + pagemap-based phys translation + cache ops.
wolfcrypt/src/port/nxp/sec_qoriq_hash.c	Single-shot hashing API via MDHA (not routed through cryptocb).
wolfcrypt/src/port/nxp/sec_qoriq_cb.c	Crypto callback router implementing AES/AES-GCM, RSA, ECDSA/ECDH, DH agree, and seed.
wolfcrypt/src/port/nxp/sec_qoriq_baremetal.c	Bare-metal backend: static DMA pool + cache ops + SVR read.
wolfcrypt/src/port/nxp/sec_qoriq_aes.c	AES CBC/CTR/ECB + AES-GCM descriptor assembly and cache maintenance.
wolfcrypt/src/port/nxp/README.md	Document SEC QorIQ support, build knobs, limitations, and verification notes.
wolfcrypt/src/include.am	Hook SEC QorIQ sources/README into Autotools build and dist.
wolfcrypt/src/dh.c	Store devId in DhKey, dispatch DH agreement via crypto callback, gate param gen.
wolfcrypt/src/cryptocb.c	Implement wc_CryptoCb_Dh() dispatcher.
wolfcrypt/src/asn.c	Fix DecodeECC_DSA_Sig_Ex() init path to avoid clearing uninitialized mp_ints.
tests/unit-mcdc/test_dh_fault_whitebox.c	Skip parameter-generation decisions when WOLFSSL_NO_DH_GEN_PARAMS is set.
tests/api/test_dh.c	Skip DH parameter-generation API test when WOLFSSL_NO_DH_GEN_PARAMS is set.
src/pk.c	Make OpenSSL-compat DH param generation fail cleanly when disabled by build.
configure.ac	Add --enable-sec-qoriq and --enable-keygen=...,no-dh-params plumbing + conditionals.
CMakeLists.txt	Add WOLFSSL_DH_GEN_PARAMS option and emit -DWOLFSSL_NO_DH_GEN_PARAMS when disabled.
cmake/options.h.in	Add WOLFSSL_NO_DH_GEN_PARAMS to generated options header.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.