> -----Original Message----- > From: Jamin Lin <[email protected]> > Sent: Wednesday, July 15, 2026 11:34 AM > To: Daniel P. Berrangé <[email protected]>; Cédric Le Goater > <[email protected]>; Peter Maydell <[email protected]>; Steven Lee > <[email protected]>; Troy Lee <[email protected]>; Kane Chen > <[email protected]>; Andrew Jeffery > <[email protected]>; Joel Stanley <[email protected]>; Eric Blake > <[email protected]>; Markus Armbruster <[email protected]>; Fabiano > Rosas <[email protected]>; Laurent Vivier <[email protected]>; Paolo Bonzini > <[email protected]>; open list:All patches CC here > <[email protected]>; open list:ASPEED BMCs > <[email protected]> > Cc: Jamin Lin <[email protected]>; Troy Lee > <[email protected]> > Subject: [PATCH v2 14/17] hw/misc/aspeed_hace: Support the AES-GCM mode > for the crypto command > > Implement the AES-GCM mode (HACE10[6:4] = 0b101) used by the AST2700 > crypto engine: decode the GCM selection, read the 96-bit IV from the context > buffer, operate on the exact data length (GCM handles a partial final block > itself), and write the 128-bit authentication tag to the tag buffer > (HACE18/HACE8C). The hardware GCM path is only used without associated > data (the driver falls back to software otherwise), so AAD is not modelled and > a non-zero HACE14 is reported as unimplemented. > > Signed-off-by: Jamin Lin <[email protected]> > --- > hw/misc/aspeed_hace.c | 70 > ++++++++++++++++++++++++++++++++++++++----- > 1 file changed, 62 insertions(+), 8 deletions(-) > > diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index > a807cc1422..927759b48f 100644 > --- a/hw/misc/aspeed_hace.c > +++ b/hw/misc/aspeed_hace.c > @@ -31,6 +31,9 @@ > /* HACE0C[27:0] holds the crypto data length */ > #define CRYPT_DATA_LEN_MASK 0x0FFFFFFF > #define R_CRYPT_CMD (0x10 / 4) > +/* AES-GCM associated data length (HACE14) and tag write buffer > +(HACE18) */ #define R_CRYPT_GCM_ADD_LEN (0x14 / 4) > +#define R_CRYPT_GCM_TAG (0x18 / 4) > /* Crypto engine command register (HACE10) bits */ > #define CRYPT_CMD_ENCRYPT BIT(7) > #define CRYPT_CMD_ISR_EN BIT(12) > @@ -43,6 +46,7 @@ > #define CRYPT_CMD_ECB (0x0 << 4) > #define CRYPT_CMD_CBC (0x1 << 4) > #define CRYPT_CMD_CTR (0x4 << 4) > +#define CRYPT_CMD_GCM (0x5 << 4) > /* AES key length HACE10[3:2] */ > #define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2) > #define CRYPT_CMD_AES256 (0x2 << 2) > @@ -58,10 +62,15 @@ > #define CRYPT_CTX_KEY_OFFSET 0x10 > #define CRYPT_CTX_SIZE 0x30 > > +/* AES-GCM uses a 96-bit IV and a 128-bit authentication tag */ > +#define CRYPT_GCM_IV_LEN 12 > +#define CRYPT_GCM_TAG_LEN 16 > + > /* AST2700 64-bit DMA high address registers for the crypto command */ > #define R_CRYPT_SRC_HI (0x80 / 4) > #define R_CRYPT_DEST_HI (0x84 / 4) > #define R_CRYPT_CONTEXT_HI (0x88 / 4) > +#define R_CRYPT_GCM_TAG_HI (0x8c / 4) > > #define R_STATUS (0x1c / 4) > #define HASH_IRQ BIT(9) > @@ -598,6 +607,9 @@ static bool crypt_decode_cmd(uint32_t cmd, > QCryptoCipherAlgo *alg, > case CRYPT_CMD_CTR: > *mode = QCRYPTO_CIPHER_MODE_CTR; > break; > + case CRYPT_CMD_GCM: > + *mode = QCRYPTO_CIPHER_MODE_GCM; > + break; > default: > return false; > } > @@ -691,11 +703,12 @@ static uint64_t crypt_get_addr(AspeedHACEState *s, > int reg, int reg_hi) } > > /* > - * Perform an AES/DES/3DES ECB/CBC operation. The source and destination > are > - * either single contiguous buffers (direct access mode) or scatter-gather > - * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key come > from > - * the context buffer (HACE08). For CBC the resulting chaining IV is written > - * back to the context buffer so the driver can continue the chain. > + * Perform an AES/DES/3DES ECB/CBC/CTR or AES-GCM operation. The > source > + and > + * destination are either single contiguous buffers (direct access > + mode) or > + * scatter-gather lists (HACE10[18]/[19]), addressed by HACE00/HACE04; > + the > + * IV/key come from the context buffer (HACE08). For CBC and CTR the > + resulting > + * chaining state is written back to the context buffer so the driver > + can > + * continue; for GCM the authentication tag is written to the tag buffer. > */ > static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd) { @@ > -705,6 +718,7 @@ static void do_crypt_operation(AspeedHACEState *s, > uint32_t cmd) > g_autoptr(QCryptoCipher) cipher = NULL; > g_autofree uint8_t *src_buf = NULL; > g_autofree uint8_t *dst_buf = NULL; > + uint8_t tag[CRYPT_GCM_TAG_LEN]; > uint8_t ctx[CRYPT_CTX_SIZE]; > Error *local_err = NULL; > QCryptoCipherMode mode; > @@ -713,10 +727,13 @@ static void do_crypt_operation(AspeedHACEState *s, > uint32_t cmd) > uint64_t ctx_addr; > uint64_t src_addr; > uint64_t dst_addr; > + uint64_t tag_addr; > + uint32_t aad_len; > size_t iv_offset; > size_t blocklen; > size_t buf_len; > size_t keylen; > + size_t ivlen; > bool status; > > if (len == 0) { > @@ -736,6 +753,20 @@ static void do_crypt_operation(AspeedHACEState *s, > uint32_t cmd) > return; > } > > + /* GCM uses a 96-bit IV; the block modes use a full-block IV. */ > + ivlen = (mode == QCRYPTO_CIPHER_MODE_GCM) ? > CRYPT_GCM_IV_LEN : > + blocklen; > + > + /* > + * The hardware GCM path is only exercised without associated data > (the > + * driver falls back to software when there is any), so AAD is not > modelled. > + */ > + aad_len = s->regs[R_CRYPT_GCM_ADD_LEN] & > CRYPT_DATA_LEN_MASK; > + if (mode == QCRYPTO_CIPHER_MODE_GCM && aad_len != 0) { > + qemu_log_mask(LOG_UNIMP, > + "%s: GCM associated data is not implemented\n", > __func__); > + return; > + } > + > /* Fetch the IV and key from the context buffer in DRAM. */ > ctx_addr = crypt_get_addr(s, R_CRYPT_CONTEXT, > R_CRYPT_CONTEXT_HI); > if (address_space_read(&s->dram_as, ctx_addr, > MEMTXATTRS_UNSPECIFIED, @@ -760,7 +791,7 @@ static void > do_crypt_operation(AspeedHACEState *s, uint32_t cmd) > } > > if (mode != QCRYPTO_CIPHER_MODE_ECB && > - qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen, > + qcrypto_cipher_setiv(cipher, ctx + iv_offset, ivlen, > &local_err) < 0) { > qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv > failed: %s\n", > __func__, error_get_pretty(local_err)); @@ > -771,9 +802,11 @@ static void do_crypt_operation(AspeedHACEState *s, > uint32_t cmd) > /* > * Round the working buffers up to a whole block. Block modes are > already > * block-aligned; the stream-like CTR mode may leave a partial final > block > - * that the engine still processes a full block at a time. > + * that the engine still processes a full block at a time. GCM handles a > + * partial final block itself, so it operates on the exact length. > */ > - buf_len = QEMU_ALIGN_UP(len, blocklen); > + buf_len = (mode == QCRYPTO_CIPHER_MODE_GCM) ? > + len : QEMU_ALIGN_UP(len, blocklen); > src_buf = g_malloc0(buf_len); > dst_buf = g_malloc0(buf_len); > > @@ -857,6 +890,24 @@ static void do_crypt_operation(AspeedHACEState *s, > uint32_t cmd) > "%s: Failed to write IV, addr=0x%" > HWADDR_PRIx "\n", > __func__, ctx_addr + iv_offset); > } > + } else if (mode == QCRYPTO_CIPHER_MODE_GCM) { > + /* > + * GCM authenticates the message and writes the resulting tag to > the > + * dedicated tag buffer (HACE18/HACE8C). > + */ > + if (qcrypto_cipher_gettag(cipher, tag, sizeof(tag), &local_err) < 0) > { > + qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher > gettag failed: " > + "%s\n", __func__, > error_get_pretty(local_err)); > + error_free(local_err); > + return; > + } > + tag_addr = crypt_get_addr(s, R_CRYPT_GCM_TAG, > R_CRYPT_GCM_TAG_HI); > + if (address_space_write(&s->dram_as, tag_addr, > MEMTXATTRS_UNSPECIFIED, > + tag, sizeof(tag))) { > + qemu_log_mask(LOG_GUEST_ERROR, > + "%s: Failed to write tag, addr=0x%" > HWADDR_PRIx "\n", > + __func__, tag_addr); > + } > } > } > > @@ -987,6 +1038,9 @@ static void aspeed_hace_write(void *opaque, hwaddr > addr, uint64_t data, > case R_CRYPT_CONTEXT_HI: > data &= ahc->key_hi_mask; > break; > + case R_CRYPT_GCM_TAG_HI: > + data &= ahc->dest_hi_mask; > + break; > default: > break; > } > -- > 2.43.0
Reviewed-by: Kane Chen <[email protected]>
