Start adding infrastructure for accelerating guest AES. Begin with a SubBytes + ShiftRows primitive.
Signed-off-by: Richard Henderson <richard.hender...@linaro.org> --- host/include/generic/host/aes-round.h | 15 +++++++++ include/crypto/aes-round.h | 41 +++++++++++++++++++++++ crypto/aes.c | 47 +++++++++++++++++++++++++++ 3 files changed, 103 insertions(+) create mode 100644 host/include/generic/host/aes-round.h create mode 100644 include/crypto/aes-round.h diff --git a/host/include/generic/host/aes-round.h b/host/include/generic/host/aes-round.h new file mode 100644 index 0000000000..598242c603 --- /dev/null +++ b/host/include/generic/host/aes-round.h @@ -0,0 +1,15 @@ +/* + * No host specific aes acceleration. + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HOST_AES_ROUND_H +#define HOST_AES_ROUND_H + +#define HAVE_AES_ACCEL false +#define ATTR_AES_ACCEL + +void aesenc_SB_SR_accel(AESState *, const AESState *, bool) + QEMU_ERROR("unsupported accel"); + +#endif diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h new file mode 100644 index 0000000000..784e1daee6 --- /dev/null +++ b/include/crypto/aes-round.h @@ -0,0 +1,41 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * AES round fragments, generic version + * + * Copyright (C) 2023 Linaro, Ltd. + */ + +#ifndef CRYPTO_AES_ROUND_H +#define CRYPTO_AES_ROUND_H + +/* Hosts with acceleration will usually need a 16-byte vector type. */ +typedef uint8_t AESStateVec __attribute__((vector_size(16))); + +typedef union { + uint8_t b[16]; + uint32_t w[4]; + uint64_t d[4]; + AESStateVec v; +} AESState; + +#include "host/aes-round.h" + +/* + * Perform SubBytes + ShiftRows. + */ + +void aesenc_SB_SR_gen(AESState *ret, const AESState *st); +void aesenc_SB_SR_genrev(AESState *ret, const AESState *st); + +static inline void aesenc_SB_SR(AESState *r, const AESState *st, bool be) +{ + if (HAVE_AES_ACCEL) { + aesenc_SB_SR_accel(r, st, be); + } else if (HOST_BIG_ENDIAN == be) { + aesenc_SB_SR_gen(r, st); + } else { + aesenc_SB_SR_genrev(r, st); + } +} + +#endif /* CRYPTO_AES_ROUND_H */ diff --git a/crypto/aes.c b/crypto/aes.c index 1309a13e91..708838315a 100644 --- a/crypto/aes.c +++ b/crypto/aes.c @@ -29,6 +29,7 @@ */ #include "qemu/osdep.h" #include "crypto/aes.h" +#include "crypto/aes-round.h" typedef uint32_t u32; typedef uint8_t u8; @@ -1251,6 +1252,52 @@ static const u32 rcon[] = { 0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */ }; +/* Perform SubBytes + ShiftRows. */ +static inline void +aesenc_SB_SR_swap(AESState *r, const AESState *st, bool swap) +{ + const int swap_b = swap ? 15 : 0; + uint8_t t; + + /* These four indexes are not swizzled. */ + r->b[swap_b ^ 0x0] = AES_sbox[st->b[swap_b ^ AES_SH_0]]; + r->b[swap_b ^ 0x4] = AES_sbox[st->b[swap_b ^ AES_SH_4]]; + r->b[swap_b ^ 0x8] = AES_sbox[st->b[swap_b ^ AES_SH_8]]; + r->b[swap_b ^ 0xc] = AES_sbox[st->b[swap_b ^ AES_SH_C]]; + + /* Otherwise, break cycles. */ + + t = AES_sbox[st->b[swap_b ^ AES_SH_D]]; + r->b[swap_b ^ 0x1] = AES_sbox[st->b[swap_b ^ AES_SH_1]]; + r->b[swap_b ^ 0x5] = AES_sbox[st->b[swap_b ^ AES_SH_5]]; + r->b[swap_b ^ 0x9] = AES_sbox[st->b[swap_b ^ AES_SH_9]]; + r->b[swap_b ^ 0xd] = t; + + t = AES_sbox[st->b[swap_b ^ AES_SH_A]]; + r->b[swap_b ^ 0x2] = AES_sbox[st->b[swap_b ^ AES_SH_2]]; + r->b[swap_b ^ 0xa] = t; + + t = AES_sbox[st->b[swap_b ^ AES_SH_E]]; + r->b[swap_b ^ 0x6] = AES_sbox[st->b[swap_b ^ AES_SH_6]]; + r->b[swap_b ^ 0xe] = t; + + t = AES_sbox[st->b[swap_b ^ AES_SH_7]]; + r->b[swap_b ^ 0x3] = AES_sbox[st->b[swap_b ^ AES_SH_3]]; + r->b[swap_b ^ 0xf] = AES_sbox[st->b[swap_b ^ AES_SH_F]]; + r->b[swap_b ^ 0xb] = AES_sbox[st->b[swap_b ^ AES_SH_B]]; + r->b[swap_b ^ 0x7] = t; +} + +void aesenc_SB_SR_gen(AESState *r, const AESState *st) +{ + aesenc_SB_SR_swap(r, st, false); +} + +void aesenc_SB_SR_genrev(AESState *r, const AESState *st) +{ + aesenc_SB_SR_swap(r, st, true); +} + /** * Expand the cipher key into the encryption key schedule. */ -- 2.34.1