On Sat, 3 Jun 2023 at 04:34, Richard Henderson
<richard.hender...@linaro.org> wrote:
>
> Start adding infrastructure for accelerating guest AES.
> Begin with a SubBytes + ShiftRows primitive.
>
> Signed-off-by: Richard Henderson <richard.hender...@linaro.org>
> ---
> host/include/generic/host/aes-round.h | 15 +++++++++
> include/crypto/aes-round.h | 41 +++++++++++++++++++++++
> crypto/aes.c | 47 +++++++++++++++++++++++++++
> 3 files changed, 103 insertions(+)
> create mode 100644 host/include/generic/host/aes-round.h
> create mode 100644 include/crypto/aes-round.h
>
> diff --git a/host/include/generic/host/aes-round.h
> b/host/include/generic/host/aes-round.h
> new file mode 100644
> index 0000000000..598242c603
> --- /dev/null
> +++ b/host/include/generic/host/aes-round.h
> @@ -0,0 +1,15 @@
> +/*
> + * No host specific aes acceleration.
> + * SPDX-License-Identifier: GPL-2.0-or-later
> + */
> +
> +#ifndef HOST_AES_ROUND_H
> +#define HOST_AES_ROUND_H
> +
> +#define HAVE_AES_ACCEL false
> +#define ATTR_AES_ACCEL
> +
> +void aesenc_SB_SR_accel(AESState *, const AESState *, bool)
> + QEMU_ERROR("unsupported accel");
> +
> +#endif
> diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
> new file mode 100644
> index 0000000000..784e1daee6
> --- /dev/null
> +++ b/include/crypto/aes-round.h
> @@ -0,0 +1,41 @@
> +/*
> + * SPDX-License-Identifier: GPL-2.0-or-later
> + * AES round fragments, generic version
> + *
> + * Copyright (C) 2023 Linaro, Ltd.
> + */
> +
> +#ifndef CRYPTO_AES_ROUND_H
> +#define CRYPTO_AES_ROUND_H
> +
> +/* Hosts with acceleration will usually need a 16-byte vector type. */
> +typedef uint8_t AESStateVec __attribute__((vector_size(16)));
> +
> +typedef union {
> + uint8_t b[16];
> + uint32_t w[4];
> + uint64_t d[4];
> + AESStateVec v;
> +} AESState;
> +
> +#include "host/aes-round.h"
> +
> +/*
> + * Perform SubBytes + ShiftRows.
> + */
> +
> +void aesenc_SB_SR_gen(AESState *ret, const AESState *st);
> +void aesenc_SB_SR_genrev(AESState *ret, const AESState *st);
> +
> +static inline void aesenc_SB_SR(AESState *r, const AESState *st, bool be)
> +{
> + if (HAVE_AES_ACCEL) {
> + aesenc_SB_SR_accel(r, st, be);
> + } else if (HOST_BIG_ENDIAN == be) {
> + aesenc_SB_SR_gen(r, st);
> + } else {
> + aesenc_SB_SR_genrev(r, st);
> + }
> +}
> +
> +#endif /* CRYPTO_AES_ROUND_H */
> diff --git a/crypto/aes.c b/crypto/aes.c
> index 1309a13e91..708838315a 100644
> --- a/crypto/aes.c
> +++ b/crypto/aes.c
> @@ -29,6 +29,7 @@
> */
> #include "qemu/osdep.h"
> #include "crypto/aes.h"
> +#include "crypto/aes-round.h"
>
> typedef uint32_t u32;
> typedef uint8_t u8;
> @@ -1251,6 +1252,52 @@ static const u32 rcon[] = {
> 0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses
> more than 10 rcon values */
> };
>
> +/* Perform SubBytes + ShiftRows. */
> +static inline void
> +aesenc_SB_SR_swap(AESState *r, const AESState *st, bool swap)
> +{
> + const int swap_b = swap ? 15 : 0;
> + uint8_t t;
> +
> + /* These four indexes are not swizzled. */
> + r->b[swap_b ^ 0x0] = AES_sbox[st->b[swap_b ^ AES_SH_0]];
> + r->b[swap_b ^ 0x4] = AES_sbox[st->b[swap_b ^ AES_SH_4]];
> + r->b[swap_b ^ 0x8] = AES_sbox[st->b[swap_b ^ AES_SH_8]];
> + r->b[swap_b ^ 0xc] = AES_sbox[st->b[swap_b ^ AES_SH_C]];
> +
> + /* Otherwise, break cycles. */
> +
This is only needed it r == st, right?
> + t = AES_sbox[st->b[swap_b ^ AES_SH_D]];
> + r->b[swap_b ^ 0x1] = AES_sbox[st->b[swap_b ^ AES_SH_1]];
> + r->b[swap_b ^ 0x5] = AES_sbox[st->b[swap_b ^ AES_SH_5]];
> + r->b[swap_b ^ 0x9] = AES_sbox[st->b[swap_b ^ AES_SH_9]];
> + r->b[swap_b ^ 0xd] = t;
> +
> + t = AES_sbox[st->b[swap_b ^ AES_SH_A]];
> + r->b[swap_b ^ 0x2] = AES_sbox[st->b[swap_b ^ AES_SH_2]];
> + r->b[swap_b ^ 0xa] = t;
> +
> + t = AES_sbox[st->b[swap_b ^ AES_SH_E]];
> + r->b[swap_b ^ 0x6] = AES_sbox[st->b[swap_b ^ AES_SH_6]];
> + r->b[swap_b ^ 0xe] = t;
> +
> + t = AES_sbox[st->b[swap_b ^ AES_SH_7]];
> + r->b[swap_b ^ 0x3] = AES_sbox[st->b[swap_b ^ AES_SH_3]];
> + r->b[swap_b ^ 0xf] = AES_sbox[st->b[swap_b ^ AES_SH_F]];
> + r->b[swap_b ^ 0xb] = AES_sbox[st->b[swap_b ^ AES_SH_B]];
> + r->b[swap_b ^ 0x7] = t;
> +}
> +
> +void aesenc_SB_SR_gen(AESState *r, const AESState *st)
> +{
> + aesenc_SB_SR_swap(r, st, false);
> +}
> +
> +void aesenc_SB_SR_genrev(AESState *r, const AESState *st)
> +{
> + aesenc_SB_SR_swap(r, st, true);
> +}
> +
> /**
> * Expand the cipher key into the encryption key schedule.
> */
> --
> 2.34.1
>
