* [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto command in direct access mode
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:13 ` Kane Chen
2026-08-11 3:10 ` [PATCH v3 02/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2500 Jamin Lin
` (14 subsequent siblings)
15 siblings, 1 reply; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
The crypt command register was previously stubbed out. Implement it for
the direct access mode, where HACE00/HACE04 point directly at contiguous
source and destination buffers. AES-128/192/256, DES and 3DES are
supported in ECB and CBC modes via the qcrypto cipher API; the IV and
key are read from the context buffer (HACE08) and, for CBC, the
resulting chaining IV is written back to the context.
The completion interrupt is now raised for every HACE variant as the
hardware does, which fixes the crypt command hang on the AST2500, AST2600
and AST1030. The AST2700 crypto engine still needs 64-bit DMA and
AES-GCM, which are added later, so it keeps its temporary interrupt-only
workaround until then.
For debugging, the context, source and destination buffers are dumped
through the existing aspeed_hace_hexdump trace event (disabled by
default). CTR mode, scatter-gather mode and AES-GCM are added separately.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_hace.c | 283 +++++++++++++++++++++++++++++++++++++++---
1 file changed, 268 insertions(+), 15 deletions(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index c61efe50c4..0f35d74137 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -18,11 +18,43 @@
#include "qapi/error.h"
#include "migration/vmstate.h"
#include "crypto/hash.h"
+#include "crypto/cipher.h"
#include "hw/core/qdev-properties.h"
#include "hw/core/irq.h"
#include "trace.h"
-#define R_CRYPT_CMD (0x10 / 4)
+/* Crypto engine registers */
+#define R_CRYPT_SRC (0x00 / 4)
+#define R_CRYPT_DEST (0x04 / 4)
+#define R_CRYPT_CONTEXT (0x08 / 4)
+#define R_CRYPT_DATA_LEN (0x0c / 4)
+/* HACE0C[27:0] holds the crypto data length */
+#define CRYPT_DATA_LEN_MASK 0x0FFFFFFF
+#define R_CRYPT_CMD (0x10 / 4)
+/* Crypto engine command register (HACE10) bits */
+#define CRYPT_CMD_ENCRYPT BIT(7)
+#define CRYPT_CMD_ISR_EN BIT(12)
+#define CRYPT_CMD_DES_SELECT BIT(16)
+#define CRYPT_CMD_TRIPLE_DES BIT(17)
+#define CRYPT_CMD_SRC_SG_CTRL BIT(18)
+/* Operation mode HACE10[6:4] */
+#define CRYPT_CMD_OP_MODE_MASK (0x7 << 4)
+#define CRYPT_CMD_ECB (0x0 << 4)
+#define CRYPT_CMD_CBC (0x1 << 4)
+/* AES key length HACE10[3:2] */
+#define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
+#define CRYPT_CMD_AES256 (0x2 << 2)
+#define CRYPT_CMD_AES192 (0x1 << 2)
+#define CRYPT_CMD_AES128 (0x0 << 2)
+
+/*
+ * Crypto context buffer layout (HACE08). The IV is at the start of the buffer
+ * (DES places its 8 byte IV at offset 8) and the cipher key at offset 0x10.
+ */
+#define CRYPT_CTX_IV_OFFSET 0x00
+#define CRYPT_CTX_DES_IV_OFFSET 0x08
+#define CRYPT_CTX_KEY_OFFSET 0x10
+#define CRYPT_CTX_SIZE 0x30
#define R_STATUS (0x1c / 4)
#define HASH_IRQ BIT(9)
@@ -65,7 +97,6 @@
/* Other cmd bits */
#define HASH_IRQ_EN BIT(9)
#define HASH_SG_EN BIT(18)
-#define CRYPT_IRQ_EN BIT(12)
/* Scatter-gather data list */
#define SG_LIST_LEN_SIZE 4
#define SG_LIST_LEN_MASK 0x0FFFFFFF
@@ -501,6 +532,216 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
}
}
+static bool crypt_aes_alg(uint32_t cmd, QCryptoCipherAlgo *alg, size_t *keylen)
+{
+ switch (cmd & CRYPT_CMD_AES_KEY_LEN_MASK) {
+ case CRYPT_CMD_AES128:
+ *alg = QCRYPTO_CIPHER_ALGO_AES_128;
+ *keylen = 16;
+ break;
+ case CRYPT_CMD_AES192:
+ *alg = QCRYPTO_CIPHER_ALGO_AES_192;
+ *keylen = 24;
+ break;
+ case CRYPT_CMD_AES256:
+ *alg = QCRYPTO_CIPHER_ALGO_AES_256;
+ *keylen = 32;
+ break;
+ default:
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * Decode the crypto command register into a libqcrypto algorithm/mode pair
+ * and the block/IV geometry. Returns false for unsupported selections.
+ */
+static bool crypt_decode_cmd(uint32_t cmd, QCryptoCipherAlgo *alg,
+ QCryptoCipherMode *mode, size_t *keylen,
+ size_t *blocklen, size_t *iv_offset)
+{
+ if (cmd & CRYPT_CMD_DES_SELECT) {
+ *blocklen = 8;
+ *iv_offset = CRYPT_CTX_DES_IV_OFFSET;
+ if (cmd & CRYPT_CMD_TRIPLE_DES) {
+ *alg = QCRYPTO_CIPHER_ALGO_3DES;
+ *keylen = 24;
+ } else {
+ *alg = QCRYPTO_CIPHER_ALGO_DES;
+ *keylen = 8;
+ }
+ } else {
+ *blocklen = 16;
+ *iv_offset = CRYPT_CTX_IV_OFFSET;
+ if (!crypt_aes_alg(cmd, alg, keylen)) {
+ return false;
+ }
+ }
+
+ switch (cmd & CRYPT_CMD_OP_MODE_MASK) {
+ case CRYPT_CMD_ECB:
+ *mode = QCRYPTO_CIPHER_MODE_ECB;
+ break;
+ case CRYPT_CMD_CBC:
+ *mode = QCRYPTO_CIPHER_MODE_CBC;
+ break;
+ default:
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * Direct access mode: the source/destination register (HACE00/HACE04) points
+ * at a single contiguous buffer in DRAM. Copy @len bytes between it and the
+ * bounce buffer @buf; when @to_dram is true @buf is written out, otherwise it
+ * is read in. Returns true on success.
+ */
+static bool crypt_prepare_direct(AspeedHACEState *s, uint64_t addr,
+ uint8_t *buf, uint32_t len, bool to_dram)
+{
+ return !address_space_rw(&s->dram_as, addr, MEMTXATTRS_UNSPECIFIED,
+ buf, len, to_dram);
+}
+
+/*
+ * Perform an AES/DES/3DES ECB/CBC operation in direct access mode: the source
+ * and destination are single contiguous buffers (HACE00/HACE04) and the IV/key
+ * come from the context buffer (HACE08). For CBC the resulting chaining IV is
+ * written back to the context buffer so the driver can continue the chain.
+ */
+static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
+{
+ uint32_t len = s->regs[R_CRYPT_DATA_LEN];
+ bool encrypt = cmd & CRYPT_CMD_ENCRYPT;
+ g_autoptr(QCryptoCipher) cipher = NULL;
+ g_autofree uint8_t *src_buf = NULL;
+ g_autofree uint8_t *dst_buf = NULL;
+ uint8_t ctx[CRYPT_CTX_SIZE];
+ Error *local_err = NULL;
+ QCryptoCipherMode mode;
+ QCryptoCipherAlgo alg;
+ const uint8_t *next_iv;
+ uint64_t ctx_addr;
+ uint64_t src_addr;
+ uint64_t dst_addr;
+ size_t iv_offset;
+ size_t blocklen;
+ size_t keylen;
+
+ if (len == 0) {
+ return;
+ }
+
+ if (!crypt_decode_cmd(cmd, &alg, &mode, &keylen, &blocklen, &iv_offset)) {
+ qemu_log_mask(LOG_UNIMP,
+ "%s: Unsupported crypt command 0x%x\n", __func__, cmd);
+ return;
+ }
+
+ if (!qcrypto_cipher_supports(alg, mode)) {
+ qemu_log_mask(LOG_UNIMP,
+ "%s: cipher mode not supported by the crypto backend\n",
+ __func__);
+ return;
+ }
+
+ /* Fetch the IV and key from the context buffer in DRAM. */
+ ctx_addr = s->regs[R_CRYPT_CONTEXT];
+ if (address_space_read(&s->dram_as, ctx_addr, MEMTXATTRS_UNSPECIFIED,
+ ctx, sizeof(ctx))) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to read context, addr=0x%" HWADDR_PRIx "\n",
+ __func__, ctx_addr);
+ return;
+ }
+
+ if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP)) {
+ hace_hexdump("context", (char *)ctx, sizeof(ctx));
+ }
+
+ cipher = qcrypto_cipher_new(alg, mode, ctx + CRYPT_CTX_KEY_OFFSET, keylen,
+ &local_err);
+ if (cipher == NULL) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher new failed: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+
+ if (mode != QCRYPTO_CIPHER_MODE_ECB &&
+ qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen,
+ &local_err) < 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv failed: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+
+ src_buf = g_malloc0(len);
+ dst_buf = g_malloc0(len);
+
+ src_addr = s->regs[R_CRYPT_SRC];
+ if (!crypt_prepare_direct(s, src_addr, src_buf, len, false)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to read src, addr=0x%" HWADDR_PRIx "\n",
+ __func__, src_addr);
+ return;
+ }
+
+ if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP)) {
+ hace_hexdump("src", (char *)src_buf, len);
+ }
+
+ if (encrypt) {
+ if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, len,
+ &local_err) < 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: encrypt failed: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+ } else {
+ if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, len,
+ &local_err) < 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: decrypt failed: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+ }
+
+ dst_addr = s->regs[R_CRYPT_DEST];
+ if (!crypt_prepare_direct(s, dst_addr, dst_buf, len, true)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to write dst, addr=0x%" HWADDR_PRIx "\n",
+ __func__, dst_addr);
+ return;
+ }
+
+ if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP)) {
+ hace_hexdump("dst", (char *)dst_buf, len);
+ }
+
+ if (mode == QCRYPTO_CIPHER_MODE_CBC) {
+ /*
+ * CBC chains on the last ciphertext block: the final block of the
+ * output when encrypting, or of the input when decrypting. Write it
+ * back as the IV for the next request.
+ */
+ next_iv = (encrypt ? dst_buf : src_buf) + len - blocklen;
+ if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
+ MEMTXATTRS_UNSPECIFIED, next_iv, blocklen)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to write IV, addr=0x%" HWADDR_PRIx "\n",
+ __func__, ctx_addr + iv_offset);
+ }
+ }
+}
+
static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)
{
AspeedHACEState *s = ASPEED_HACE(opaque);
@@ -531,16 +772,22 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
qemu_irq_lower(s->irq);
}
}
- if (ahc->raise_crypt_interrupt_workaround) {
- if (data & CRYPT_IRQ) {
- data &= ~CRYPT_IRQ;
+ if (data & CRYPT_IRQ) {
+ data &= ~CRYPT_IRQ;
- if (s->regs[addr] & CRYPT_IRQ) {
- qemu_irq_lower(s->irq);
- }
+ if (s->regs[addr] & CRYPT_IRQ) {
+ qemu_irq_lower(s->irq);
}
}
break;
+ case R_CRYPT_SRC:
+ case R_CRYPT_DEST:
+ case R_CRYPT_CONTEXT:
+ data &= ahc->src_mask;
+ break;
+ case R_CRYPT_DATA_LEN:
+ data &= CRYPT_DATA_LEN_MASK;
+ break;
case R_HASH_SRC:
data &= ahc->src_mask;
break;
@@ -589,13 +836,19 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
break;
}
case R_CRYPT_CMD:
- qemu_log_mask(LOG_UNIMP, "%s: Crypt commands not implemented\n",
- __func__);
- if (ahc->raise_crypt_interrupt_workaround) {
- s->regs[R_STATUS] |= CRYPT_IRQ;
- if (data & CRYPT_IRQ_EN) {
- qemu_irq_raise(s->irq);
- }
+ /*
+ * The AST2700 crypto engine needs 64-bit DMA and AES-GCM, which are
+ * added later; until then it keeps the temporary workaround of only
+ * raising the completion interrupt without running the command.
+ */
+ if (!ahc->raise_crypt_interrupt_workaround) {
+ do_crypt_operation(s, data);
+ }
+
+ /* Hardware raises the crypt interrupt once the command finishes. */
+ s->regs[R_STATUS] |= CRYPT_IRQ;
+ if (data & CRYPT_CMD_ISR_EN) {
+ qemu_irq_raise(s->irq);
}
break;
case R_HASH_SRC_HI:
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* RE: [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto command in direct access mode
2026-08-11 3:10 ` [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto command in direct access mode Jamin Lin
@ 2026-08-11 3:13 ` Kane Chen
0 siblings, 0 replies; 22+ messages in thread
From: Kane Chen @ 2026-08-11 3:13 UTC (permalink / raw)
To: Jamin Lin, Daniel P. Berrangé, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Troy Lee
> -----Original Message-----
> From: Jamin Lin <jamin_lin@aspeedtech.com>
> Sent: Tuesday, August 11, 2026 11:10 AM
> To: Daniel P. Berrangé <berrange@redhat.com>; Cédric Le Goater
> <clg@kaod.org>; Peter Maydell <peter.maydell@linaro.org>; Steven Lee
> <steven_lee@aspeedtech.com>; Troy Lee <leetroy@gmail.com>; Kane Chen
> <kane_chen@aspeedtech.com>; Andrew Jeffery
> <andrew@codeconstruct.com.au>; Joel Stanley <joel@jms.id.au>; Eric Blake
> <eblake@redhat.com>; Markus Armbruster <armbru@redhat.com>; Fabiano
> Rosas <farosas@suse.de>; Laurent Vivier <lvivier@redhat.com>; Paolo Bonzini
> <pbonzini@redhat.com>; open list:All patches CC here
> <qemu-devel@nongnu.org>; open list:ASPEED BMCs
> <qemu-arm@nongnu.org>
> Cc: Jamin Lin <jamin_lin@aspeedtech.com>; Troy Lee
> <troy_lee@aspeedtech.com>
> Subject: [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto
> command in direct access mode
>
> The crypt command register was previously stubbed out. Implement it for the
> direct access mode, where HACE00/HACE04 point directly at contiguous source
> and destination buffers. AES-128/192/256, DES and 3DES are supported in ECB
> and CBC modes via the qcrypto cipher API; the IV and key are read from the
> context buffer (HACE08) and, for CBC, the resulting chaining IV is written back
> to the context.
>
> The completion interrupt is now raised for every HACE variant as the hardware
> does, which fixes the crypt command hang on the AST2500, AST2600 and
> AST1030. The AST2700 crypto engine still needs 64-bit DMA and AES-GCM,
> which are added later, so it keeps its temporary interrupt-only workaround
> until then.
>
> For debugging, the context, source and destination buffers are dumped through
> the existing aspeed_hace_hexdump trace event (disabled by default). CTR
> mode, scatter-gather mode and AES-GCM are added separately.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/misc/aspeed_hace.c | 283
> +++++++++++++++++++++++++++++++++++++++---
> 1 file changed, 268 insertions(+), 15 deletions(-)
>
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> c61efe50c4..0f35d74137 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -18,11 +18,43 @@
> #include "qapi/error.h"
> #include "migration/vmstate.h"
> #include "crypto/hash.h"
> +#include "crypto/cipher.h"
> #include "hw/core/qdev-properties.h"
> #include "hw/core/irq.h"
> #include "trace.h"
>
> -#define R_CRYPT_CMD (0x10 / 4)
> +/* Crypto engine registers */
> +#define R_CRYPT_SRC (0x00 / 4)
> +#define R_CRYPT_DEST (0x04 / 4)
> +#define R_CRYPT_CONTEXT (0x08 / 4)
> +#define R_CRYPT_DATA_LEN (0x0c / 4)
> +/* HACE0C[27:0] holds the crypto data length */
> +#define CRYPT_DATA_LEN_MASK 0x0FFFFFFF
> +#define R_CRYPT_CMD (0x10 / 4)
> +/* Crypto engine command register (HACE10) bits */
> +#define CRYPT_CMD_ENCRYPT BIT(7)
> +#define CRYPT_CMD_ISR_EN BIT(12)
> +#define CRYPT_CMD_DES_SELECT BIT(16)
> +#define CRYPT_CMD_TRIPLE_DES BIT(17)
> +#define CRYPT_CMD_SRC_SG_CTRL BIT(18)
> +/* Operation mode HACE10[6:4] */
> +#define CRYPT_CMD_OP_MODE_MASK (0x7 << 4)
> +#define CRYPT_CMD_ECB (0x0 << 4)
> +#define CRYPT_CMD_CBC (0x1 << 4)
> +/* AES key length HACE10[3:2] */
> +#define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
> +#define CRYPT_CMD_AES256 (0x2 << 2)
> +#define CRYPT_CMD_AES192 (0x1 << 2)
> +#define CRYPT_CMD_AES128 (0x0 << 2)
> +
> +/*
> + * Crypto context buffer layout (HACE08). The IV is at the start of the
> +buffer
> + * (DES places its 8 byte IV at offset 8) and the cipher key at offset 0x10.
> + */
> +#define CRYPT_CTX_IV_OFFSET 0x00
> +#define CRYPT_CTX_DES_IV_OFFSET 0x08
> +#define CRYPT_CTX_KEY_OFFSET 0x10
> +#define CRYPT_CTX_SIZE 0x30
>
> #define R_STATUS (0x1c / 4)
> #define HASH_IRQ BIT(9)
> @@ -65,7 +97,6 @@
> /* Other cmd bits */
> #define HASH_IRQ_EN BIT(9)
> #define HASH_SG_EN BIT(18)
> -#define CRYPT_IRQ_EN BIT(12)
> /* Scatter-gather data list */
> #define SG_LIST_LEN_SIZE 4
> #define SG_LIST_LEN_MASK 0x0FFFFFFF
> @@ -501,6 +532,216 @@ static void do_hash_operation(AspeedHACEState *s,
> int algo, bool sg_mode,
> }
> }
>
> +static bool crypt_aes_alg(uint32_t cmd, QCryptoCipherAlgo *alg, size_t
> +*keylen) {
> + switch (cmd & CRYPT_CMD_AES_KEY_LEN_MASK) {
> + case CRYPT_CMD_AES128:
> + *alg = QCRYPTO_CIPHER_ALGO_AES_128;
> + *keylen = 16;
> + break;
> + case CRYPT_CMD_AES192:
> + *alg = QCRYPTO_CIPHER_ALGO_AES_192;
> + *keylen = 24;
> + break;
> + case CRYPT_CMD_AES256:
> + *alg = QCRYPTO_CIPHER_ALGO_AES_256;
> + *keylen = 32;
> + break;
> + default:
> + return false;
> + }
> +
> + return true;
> +}
> +
> +/*
> + * Decode the crypto command register into a libqcrypto algorithm/mode
> +pair
> + * and the block/IV geometry. Returns false for unsupported selections.
> + */
> +static bool crypt_decode_cmd(uint32_t cmd, QCryptoCipherAlgo *alg,
> + QCryptoCipherMode *mode, size_t
> *keylen,
> + size_t *blocklen, size_t *iv_offset) {
> + if (cmd & CRYPT_CMD_DES_SELECT) {
> + *blocklen = 8;
> + *iv_offset = CRYPT_CTX_DES_IV_OFFSET;
> + if (cmd & CRYPT_CMD_TRIPLE_DES) {
> + *alg = QCRYPTO_CIPHER_ALGO_3DES;
> + *keylen = 24;
> + } else {
> + *alg = QCRYPTO_CIPHER_ALGO_DES;
> + *keylen = 8;
> + }
> + } else {
> + *blocklen = 16;
> + *iv_offset = CRYPT_CTX_IV_OFFSET;
> + if (!crypt_aes_alg(cmd, alg, keylen)) {
> + return false;
> + }
> + }
> +
> + switch (cmd & CRYPT_CMD_OP_MODE_MASK) {
> + case CRYPT_CMD_ECB:
> + *mode = QCRYPTO_CIPHER_MODE_ECB;
> + break;
> + case CRYPT_CMD_CBC:
> + *mode = QCRYPTO_CIPHER_MODE_CBC;
> + break;
> + default:
> + return false;
> + }
> +
> + return true;
> +}
> +
> +/*
> + * Direct access mode: the source/destination register (HACE00/HACE04)
> +points
> + * at a single contiguous buffer in DRAM. Copy @len bytes between it
> +and the
> + * bounce buffer @buf; when @to_dram is true @buf is written out,
> +otherwise it
> + * is read in. Returns true on success.
> + */
> +static bool crypt_prepare_direct(AspeedHACEState *s, uint64_t addr,
> + uint8_t *buf, uint32_t len, bool
> +to_dram) {
> + return !address_space_rw(&s->dram_as, addr,
> MEMTXATTRS_UNSPECIFIED,
> + buf, len, to_dram); }
> +
> +/*
> + * Perform an AES/DES/3DES ECB/CBC operation in direct access mode: the
> +source
> + * and destination are single contiguous buffers (HACE00/HACE04) and
> +the IV/key
> + * come from the context buffer (HACE08). For CBC the resulting
> +chaining IV is
> + * written back to the context buffer so the driver can continue the chain.
> + */
> +static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd) {
> + uint32_t len = s->regs[R_CRYPT_DATA_LEN];
> + bool encrypt = cmd & CRYPT_CMD_ENCRYPT;
> + g_autoptr(QCryptoCipher) cipher = NULL;
> + g_autofree uint8_t *src_buf = NULL;
> + g_autofree uint8_t *dst_buf = NULL;
> + uint8_t ctx[CRYPT_CTX_SIZE];
> + Error *local_err = NULL;
> + QCryptoCipherMode mode;
> + QCryptoCipherAlgo alg;
> + const uint8_t *next_iv;
> + uint64_t ctx_addr;
> + uint64_t src_addr;
> + uint64_t dst_addr;
> + size_t iv_offset;
> + size_t blocklen;
> + size_t keylen;
> +
> + if (len == 0) {
> + return;
> + }
> +
> + if (!crypt_decode_cmd(cmd, &alg, &mode, &keylen, &blocklen,
> &iv_offset)) {
> + qemu_log_mask(LOG_UNIMP,
> + "%s: Unsupported crypt command 0x%x\n",
> __func__, cmd);
> + return;
> + }
> +
> + if (!qcrypto_cipher_supports(alg, mode)) {
> + qemu_log_mask(LOG_UNIMP,
> + "%s: cipher mode not supported by the crypto
> backend\n",
> + __func__);
> + return;
> + }
> +
> + /* Fetch the IV and key from the context buffer in DRAM. */
> + ctx_addr = s->regs[R_CRYPT_CONTEXT];
> + if (address_space_read(&s->dram_as, ctx_addr,
> MEMTXATTRS_UNSPECIFIED,
> + ctx, sizeof(ctx))) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Failed to read context, addr=0x%"
> HWADDR_PRIx "\n",
> + __func__, ctx_addr);
> + return;
> + }
> +
> + if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP))
> {
> + hace_hexdump("context", (char *)ctx, sizeof(ctx));
> + }
> +
> + cipher = qcrypto_cipher_new(alg, mode, ctx + CRYPT_CTX_KEY_OFFSET,
> keylen,
> + &local_err);
> + if (cipher == NULL) {
> + qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher new
> failed: %s\n",
> + __func__, error_get_pretty(local_err));
> + error_free(local_err);
> + return;
> + }
> +
> + if (mode != QCRYPTO_CIPHER_MODE_ECB &&
> + qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen,
> + &local_err) < 0) {
> + qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv
> failed: %s\n",
> + __func__, error_get_pretty(local_err));
> + error_free(local_err);
> + return;
> + }
> +
> + src_buf = g_malloc0(len);
> + dst_buf = g_malloc0(len);
> +
> + src_addr = s->regs[R_CRYPT_SRC];
> + if (!crypt_prepare_direct(s, src_addr, src_buf, len, false)) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Failed to read src, addr=0x%" HWADDR_PRIx
> "\n",
> + __func__, src_addr);
> + return;
> + }
> +
> + if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP))
> {
> + hace_hexdump("src", (char *)src_buf, len);
> + }
> +
> + if (encrypt) {
> + if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, len,
> + &local_err) < 0) {
> + qemu_log_mask(LOG_GUEST_ERROR, "%s: encrypt failed:
> %s\n",
> + __func__, error_get_pretty(local_err));
> + error_free(local_err);
> + return;
> + }
> + } else {
> + if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, len,
> + &local_err) < 0) {
> + qemu_log_mask(LOG_GUEST_ERROR, "%s: decrypt failed:
> %s\n",
> + __func__, error_get_pretty(local_err));
> + error_free(local_err);
> + return;
> + }
> + }
> +
> + dst_addr = s->regs[R_CRYPT_DEST];
> + if (!crypt_prepare_direct(s, dst_addr, dst_buf, len, true)) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Failed to write dst, addr=0x%" HWADDR_PRIx
> "\n",
> + __func__, dst_addr);
> + return;
> + }
> +
> + if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP))
> {
> + hace_hexdump("dst", (char *)dst_buf, len);
> + }
> +
> + if (mode == QCRYPTO_CIPHER_MODE_CBC) {
> + /*
> + * CBC chains on the last ciphertext block: the final block of the
> + * output when encrypting, or of the input when decrypting. Write
> it
> + * back as the IV for the next request.
> + */
> + next_iv = (encrypt ? dst_buf : src_buf) + len - blocklen;
> + if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
> + MEMTXATTRS_UNSPECIFIED, next_iv,
> blocklen)) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Failed to write IV, addr=0x%"
> HWADDR_PRIx "\n",
> + __func__, ctx_addr + iv_offset);
> + }
> + }
> +}
> +
> static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int
> size) {
> AspeedHACEState *s = ASPEED_HACE(opaque); @@ -531,16 +772,22
> @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
> qemu_irq_lower(s->irq);
> }
> }
> - if (ahc->raise_crypt_interrupt_workaround) {
> - if (data & CRYPT_IRQ) {
> - data &= ~CRYPT_IRQ;
> + if (data & CRYPT_IRQ) {
> + data &= ~CRYPT_IRQ;
>
> - if (s->regs[addr] & CRYPT_IRQ) {
> - qemu_irq_lower(s->irq);
> - }
> + if (s->regs[addr] & CRYPT_IRQ) {
> + qemu_irq_lower(s->irq);
> }
> }
> break;
> + case R_CRYPT_SRC:
> + case R_CRYPT_DEST:
> + case R_CRYPT_CONTEXT:
> + data &= ahc->src_mask;
> + break;
> + case R_CRYPT_DATA_LEN:
> + data &= CRYPT_DATA_LEN_MASK;
> + break;
> case R_HASH_SRC:
> data &= ahc->src_mask;
> break;
> @@ -589,13 +836,19 @@ static void aspeed_hace_write(void *opaque,
> hwaddr addr, uint64_t data,
> break;
> }
> case R_CRYPT_CMD:
> - qemu_log_mask(LOG_UNIMP, "%s: Crypt commands not
> implemented\n",
> - __func__);
> - if (ahc->raise_crypt_interrupt_workaround) {
> - s->regs[R_STATUS] |= CRYPT_IRQ;
> - if (data & CRYPT_IRQ_EN) {
> - qemu_irq_raise(s->irq);
> - }
> + /*
> + * The AST2700 crypto engine needs 64-bit DMA and AES-GCM,
> which are
> + * added later; until then it keeps the temporary workaround of
> only
> + * raising the completion interrupt without running the command.
> + */
> + if (!ahc->raise_crypt_interrupt_workaround) {
> + do_crypt_operation(s, data);
> + }
> +
> + /* Hardware raises the crypt interrupt once the command finishes.
> */
> + s->regs[R_STATUS] |= CRYPT_IRQ;
> + if (data & CRYPT_CMD_ISR_EN) {
> + qemu_irq_raise(s->irq);
> }
> break;
> case R_HASH_SRC_HI:
> --
> 2.43.0
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v3 02/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2500
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
2026-08-11 3:10 ` [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto command in direct access mode Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode for the crypto command Jamin Lin
` (13 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Add a crypto known-answer test harness and exercise the AST2500, which
uses the crypto engine's direct access mode. Each mode (AES/DES/3DES in
ECB and CBC) is a separate test that checks the ciphertext, the
plaintext round-trip and, for CBC, the chaining IV written back to the
context buffer.
The key/IV/plaintext/ciphertext values are taken verbatim from the Linux
kernel crypto self-test templates in crypto/testmgr.h.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
tests/qtest/aspeed-hace-utils.h | 16 ++
tests/qtest/aspeed-hace-utils.c | 325 ++++++++++++++++++++++++++++++++
tests/qtest/aspeed_hace-test.c | 6 +
tests/qtest/meson.build | 6 +-
4 files changed, 351 insertions(+), 2 deletions(-)
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index 27ab2bb975..13feaa61e4 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -79,5 +79,21 @@ void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
void aspeed_test_addresses(const char *machine, const uint32_t base,
const struct AspeedMasks *expected);
+/*
+ * Cipher modes a SoC's crypto engine supports, for aspeed_add_crypto_tests().
+ */
+enum {
+ CRYPT_MODE_ECB = 1 << 0,
+ CRYPT_MODE_CBC = 1 << 1,
+};
+
+/*
+ * Register the crypto known-answer tests that @modes selects (a mask of
+ * CRYPT_MODE_*) for the given machine. Each test is named
+ * "<prefix>/hace/crypto/<mode>".
+ */
+void aspeed_add_crypto_tests(const char *prefix, const char *machine,
+ uint32_t base, uint64_t dram, uint32_t modes);
+
#endif /* TESTS_ASPEED_HACE_UTILS_H */
diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 25450a296b..0355dd47af 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -9,6 +9,7 @@
#include "libqtest.h"
#include "qemu/bitops.h"
#include "qemu/bswap.h"
+#include "crypto/cipher.h"
#include "aspeed-hace-utils.h"
/*
@@ -645,3 +646,327 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
qtest_quit(s);
}
+/*
+ * Crypto engine register layout (offsets from the HACE base).
+ */
+#define HACE_CRYPTO_SRC 0x00
+#define HACE_CRYPTO_DEST 0x04
+#define HACE_CRYPTO_CONTEXT 0x08
+#define HACE_CRYPTO_DATA_LEN 0x0c
+#define HACE_CRYPTO_CMD 0x10
+
+/* Crypto command bits */
+#define HACE_CMD_ENCRYPT BIT(7)
+#define HACE_CMD_ISR_EN BIT(12)
+#define HACE_CMD_DES_SELECT BIT(16)
+#define HACE_CMD_TRIPLE_DES BIT(17)
+#define HACE_CMD_SRC_SG_CTRL BIT(18)
+#define HACE_CMD_DST_SG_CTRL BIT(19)
+#define HACE_CMD_OP_MODE_MASK (0x7 << 4)
+#define HACE_CMD_ECB (0x0 << 4)
+#define HACE_CMD_CBC (0x1 << 4)
+#define HACE_CMD_AES128 (0x0 << 2)
+
+/* Context buffer layout: IV (DES at +8), key at +0x10 */
+#define HACE_CTX_KEY_OFFSET 0x10
+#define HACE_CTX_SIZE 0x30
+
+/*
+ * Crypto known-answer test vectors, taken verbatim from the Linux kernel
+ * crypto self-test templates in crypto/testmgr.h:
+ *
+ * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/crypto/testmgr.h?h=v6.18
+ *
+ * The originating template is noted above each block. CTR and the longer CBC
+ * vectors are truncated to a single block (still a valid known-answer test as
+ * the first block only depends on the IV).
+ */
+
+/* aes_tv_template[0] (FIPS-197) */
+static const uint8_t aes128_ecb_key[16] = {
+ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+ 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
+static const uint8_t aes128_ecb_ptext[16] = {
+ 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
+ 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff };
+static const uint8_t aes128_ecb_ctext[16] = {
+ 0x69, 0xc4, 0xe0, 0xd8, 0x6a, 0x7b, 0x04, 0x30,
+ 0xd8, 0xcd, 0xb7, 0x80, 0x70, 0xb4, 0xc5, 0x5a };
+
+/* aes_cbc_tv_template[0] (RFC 3602) */
+static const uint8_t aes128_cbc_key[16] = {
+ 0x06, 0xa9, 0x21, 0x40, 0x36, 0xb8, 0xa1, 0x5b,
+ 0x51, 0x2e, 0x03, 0xd5, 0x34, 0x12, 0x00, 0x06 };
+static const uint8_t aes128_cbc_iv[16] = {
+ 0x3d, 0xaf, 0xba, 0x42, 0x9d, 0x9e, 0xb4, 0x30,
+ 0xb4, 0x22, 0xda, 0x80, 0x2c, 0x9f, 0xac, 0x41 };
+static const uint8_t aes128_cbc_ptext[16] = {
+ 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x62,
+ 0x6c, 0x6f, 0x63, 0x6b, 0x20, 0x6d, 0x73, 0x67 };
+static const uint8_t aes128_cbc_ctext[16] = {
+ 0xe3, 0x53, 0x77, 0x9c, 0x10, 0x79, 0xae, 0xb8,
+ 0x27, 0x08, 0x94, 0x2d, 0xbe, 0x77, 0x18, 0x1a };
+static const uint8_t aes128_cbc_ivout[16] = {
+ 0xe3, 0x53, 0x77, 0x9c, 0x10, 0x79, 0xae, 0xb8,
+ 0x27, 0x08, 0x94, 0x2d, 0xbe, 0x77, 0x18, 0x1a };
+
+/* des_tv_template[0] (Applied Cryptography) */
+static const uint8_t des_ecb_key[8] = {
+ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef };
+static const uint8_t des_ecb_ptext[8] = {
+ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xe7 };
+static const uint8_t des_ecb_ctext[8] = {
+ 0xc9, 0x57, 0x44, 0x25, 0x6a, 0x5e, 0xd3, 0x1d };
+
+/* des_cbc_tv_template[0] (OpenSSL), first block */
+static const uint8_t des_cbc_key[8] = {
+ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef };
+static const uint8_t des_cbc_iv[8] = {
+ 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 };
+static const uint8_t des_cbc_ptext[8] = {
+ 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x20 };
+static const uint8_t des_cbc_ctext[8] = {
+ 0xcc, 0xd1, 0x73, 0xff, 0xab, 0x20, 0x39, 0xf4 };
+
+/* des3_ede_tv_template[0] (OpenSSL) */
+static const uint8_t tdes_ecb_key[24] = {
+ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+ 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
+ 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 };
+static const uint8_t tdes_ecb_ptext[8] = {
+ 0x73, 0x6f, 0x6d, 0x65, 0x64, 0x61, 0x74, 0x61 };
+static const uint8_t tdes_ecb_ctext[8] = {
+ 0x18, 0xd7, 0x48, 0xe5, 0x63, 0x62, 0x05, 0x72 };
+
+/* des3_ede_cbc_tv_template[0] (OpenSSL), first block */
+static const uint8_t tdes_cbc_key[24] = {
+ 0xe9, 0xc0, 0xff, 0x2e, 0x76, 0x0b, 0x64, 0x24,
+ 0x44, 0x4d, 0x99, 0x5a, 0x12, 0xd6, 0x40, 0xc0,
+ 0xea, 0xc2, 0x84, 0xe8, 0x14, 0x95, 0xdb, 0xe8 };
+static const uint8_t tdes_cbc_iv[8] = {
+ 0x7d, 0x33, 0x88, 0x93, 0x0f, 0x93, 0xb2, 0x42 };
+static const uint8_t tdes_cbc_ptext[8] = {
+ 0x6f, 0x54, 0x20, 0x6f, 0x61, 0x4d, 0x79, 0x6e };
+static const uint8_t tdes_cbc_ctext[8] = {
+ 0x0e, 0x2d, 0xb6, 0x97, 0x3c, 0x56, 0x33, 0xf4 };
+
+typedef struct CryptTest {
+ QCryptoCipherMode mode;
+ QCryptoCipherAlgo alg;
+ /* expected context IV after encrypt, or NULL */
+ const uint8_t *iv_out;
+ const uint8_t *ptext;
+ const uint8_t *ctext;
+ const uint8_t *key;
+ const uint8_t *iv;
+ const char *name;
+ size_t keylen;
+ /* algorithm | mode | key size selection */
+ uint32_t cmd;
+ size_t ivlen;
+ size_t len;
+} CryptTest;
+
+static const CryptTest crypt_tests[] = {
+ {
+ .name = "aes128-ecb",
+ .cmd = HACE_CMD_AES128 | HACE_CMD_ECB,
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .mode = QCRYPTO_CIPHER_MODE_ECB,
+ .key = aes128_ecb_key,
+ .keylen = sizeof(aes128_ecb_key),
+ .ptext = aes128_ecb_ptext,
+ .ctext = aes128_ecb_ctext,
+ .len = sizeof(aes128_ecb_ptext),
+ },
+ {
+ .name = "aes128-cbc",
+ .cmd = HACE_CMD_AES128 | HACE_CMD_CBC,
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .mode = QCRYPTO_CIPHER_MODE_CBC,
+ .key = aes128_cbc_key,
+ .keylen = sizeof(aes128_cbc_key),
+ .iv = aes128_cbc_iv,
+ .ivlen = sizeof(aes128_cbc_iv),
+ .ptext = aes128_cbc_ptext,
+ .ctext = aes128_cbc_ctext,
+ .iv_out = aes128_cbc_ivout,
+ .len = sizeof(aes128_cbc_ptext),
+ },
+ {
+ .name = "des-ecb",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_ECB,
+ .alg = QCRYPTO_CIPHER_ALGO_DES,
+ .mode = QCRYPTO_CIPHER_MODE_ECB,
+ .key = des_ecb_key,
+ .keylen = sizeof(des_ecb_key),
+ .ptext = des_ecb_ptext,
+ .ctext = des_ecb_ctext,
+ .len = sizeof(des_ecb_ptext),
+ },
+ {
+ .name = "des-cbc",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_CBC,
+ .alg = QCRYPTO_CIPHER_ALGO_DES,
+ .mode = QCRYPTO_CIPHER_MODE_CBC,
+ .key = des_cbc_key,
+ .keylen = sizeof(des_cbc_key),
+ .iv = des_cbc_iv,
+ .ivlen = sizeof(des_cbc_iv),
+ .ptext = des_cbc_ptext,
+ .ctext = des_cbc_ctext,
+ .len = sizeof(des_cbc_ptext),
+ },
+ {
+ .name = "des3_ede-ecb",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_TRIPLE_DES | HACE_CMD_ECB,
+ .alg = QCRYPTO_CIPHER_ALGO_3DES,
+ .mode = QCRYPTO_CIPHER_MODE_ECB,
+ .key = tdes_ecb_key,
+ .keylen = sizeof(tdes_ecb_key),
+ .ptext = tdes_ecb_ptext,
+ .ctext = tdes_ecb_ctext,
+ .len = sizeof(tdes_ecb_ptext),
+ },
+ {
+ .name = "des3_ede-cbc",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_TRIPLE_DES | HACE_CMD_CBC,
+ .alg = QCRYPTO_CIPHER_ALGO_3DES,
+ .mode = QCRYPTO_CIPHER_MODE_CBC,
+ .key = tdes_cbc_key,
+ .keylen = sizeof(tdes_cbc_key),
+ .iv = tdes_cbc_iv,
+ .ivlen = sizeof(tdes_cbc_iv),
+ .ptext = tdes_cbc_ptext,
+ .ctext = tdes_cbc_ctext,
+ .len = sizeof(tdes_cbc_ptext),
+ },
+};
+
+/* DRAM offsets for the crypto test source, destination and context buffers. */
+#define CRYPT_OFF_SRC 0x10000
+#define CRYPT_OFF_DST 0x20000
+#define CRYPT_OFF_CTX 0x30000
+
+/* Describes one registered crypto test (qtest_add_data_func() data pointer). */
+typedef struct AspeedCryptoTest {
+ const char *machine;
+ uint64_t dram;
+ uint32_t base;
+ int index;
+} AspeedCryptoTest;
+
+/* Map a command's operation mode (HACE10[6:4]) to a CRYPT_MODE_* flag. */
+static uint32_t crypt_mode_flag(uint32_t cmd)
+{
+ switch (cmd & HACE_CMD_OP_MODE_MASK) {
+ case HACE_CMD_ECB:
+ return CRYPT_MODE_ECB;
+ case HACE_CMD_CBC:
+ return CRYPT_MODE_CBC;
+ default:
+ return 0;
+ }
+}
+
+static void crypt_write_ctx(QTestState *s, uint64_t ctx_addr,
+ const CryptTest *t)
+{
+ size_t iv_off = (t->cmd & HACE_CMD_DES_SELECT) ? 8 : 0;
+ uint8_t ctx[HACE_CTX_SIZE] = { 0 };
+
+ if (t->iv) {
+ memcpy(ctx + iv_off, t->iv, t->ivlen);
+ }
+ memcpy(ctx + HACE_CTX_KEY_OFFSET, t->key, t->keylen);
+ qtest_memwrite(s, ctx_addr, ctx, sizeof(ctx));
+}
+
+/* Run one crypto operation in direct access mode and read back the result. */
+static void crypt_run_direct(QTestState *s, uint32_t base, uint64_t dram,
+ const CryptTest *t, bool encrypt, uint8_t *out)
+{
+ const uint8_t *in = encrypt ? t->ptext : t->ctext;
+ uint32_t cmd = t->cmd | HACE_CMD_ISR_EN;
+ uint64_t src = dram + CRYPT_OFF_SRC;
+ uint64_t dst = dram + CRYPT_OFF_DST;
+ uint64_t ctx = dram + CRYPT_OFF_CTX;
+
+ if (encrypt) {
+ cmd |= HACE_CMD_ENCRYPT;
+ }
+
+ crypt_write_ctx(s, ctx, t);
+ qtest_memwrite(s, src, in, t->len);
+
+ qtest_writel(s, base + HACE_CRYPTO_SRC, (uint32_t)src);
+ qtest_writel(s, base + HACE_CRYPTO_DEST, (uint32_t)dst);
+ qtest_writel(s, base + HACE_CRYPTO_CONTEXT, (uint32_t)ctx);
+ qtest_writel(s, base + HACE_CRYPTO_DATA_LEN, t->len);
+ qtest_writel(s, base + HACE_CRYPTO_CMD, cmd);
+
+ g_assert_cmphex(qtest_readl(s, base + HACE_STS) & HACE_CRYPTO_ISR, ==,
+ HACE_CRYPTO_ISR);
+ qtest_writel(s, base + HACE_STS, HACE_CRYPTO_ISR);
+
+ qtest_memread(s, dst, out, t->len);
+}
+
+static void aspeed_test_crypto_direct(const void *data)
+{
+ const AspeedCryptoTest *c = data;
+ const CryptTest *t = &crypt_tests[c->index];
+ QTestState *s = qtest_init(c->machine);
+ uint8_t out[64];
+ uint8_t iv[16];
+ size_t iv_off;
+
+ g_assert_cmpuint(t->len, <=, sizeof(out));
+
+ /* Encrypt: ptext -> ctext */
+ crypt_run_direct(s, c->base, c->dram, t, true, out);
+ g_assert_cmpmem(out, t->len, t->ctext, t->len);
+
+ if (t->iv_out) {
+ iv_off = (t->cmd & HACE_CMD_DES_SELECT) ? 8 : 0;
+ qtest_memread(s, c->dram + CRYPT_OFF_CTX + iv_off, iv, t->ivlen);
+ g_assert_cmpmem(iv, t->ivlen, t->iv_out, t->ivlen);
+ }
+
+ /* Decrypt: ctext -> ptext */
+ crypt_run_direct(s, c->base, c->dram, t, false, out);
+ g_assert_cmpmem(out, t->len, t->ptext, t->len);
+
+ qtest_quit(s);
+}
+
+void aspeed_add_crypto_tests(const char *prefix, const char *machine,
+ uint32_t base, uint64_t dram, uint32_t modes)
+{
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(crypt_tests); i++) {
+ g_autofree char *path = NULL;
+ AspeedCryptoTest *t;
+
+ if (!(modes & crypt_mode_flag(crypt_tests[i].cmd))) {
+ continue;
+ }
+
+ if (!qcrypto_cipher_supports(crypt_tests[i].alg,
+ crypt_tests[i].mode)) {
+ g_printerr("# skip unsupported %s\n", crypt_tests[i].name);
+ continue;
+ }
+
+ path = g_strdup_printf("%s/hace/crypto/%s", prefix,
+ crypt_tests[i].name);
+ t = g_new0(AspeedCryptoTest, 1);
+ t->machine = machine;
+ t->base = base;
+ t->dram = dram;
+ t->index = i;
+ qtest_add_data_func_full(path, t, aspeed_test_crypto_direct, g_free);
+ }
+}
+
diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index 38777020ca..4cb4c475e9 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -229,6 +229,12 @@ int main(int argc, char **argv)
qtest_add_func("ast2500/hace/sha256", test_sha256_ast2500);
qtest_add_func("ast2500/hace/md5", test_md5_ast2500);
+ /*
+ * The AST2500 crypto engine uses direct access mode and supports ECB/CBC.
+ */
+ aspeed_add_crypto_tests("ast2500", "-machine ast2500-evb", 0x1e6e3000,
+ 0x80000000, CRYPT_MODE_ECB | CRYPT_MODE_CBC);
+
qtest_add_func("ast2400/hace/addresses", test_addresses_ast2400);
qtest_add_func("ast2400/hace/sha512", test_sha512_ast2400);
qtest_add_func("ast2400/hace/sha256", test_sha256_ast2400);
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 56ff860e21..d5bde77689 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -389,9 +389,11 @@ if get_option('replication').allowed()
endif
qtests = {
- 'aspeed_hace-test': files('aspeed-hace-utils.c', 'aspeed_hace-test.c'),
+ 'aspeed_hace-test': [files('aspeed-hace-utils.c', 'aspeed_hace-test.c'),
+ crypto],
'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'),
- 'ast2700-hace-test': files('aspeed-hace-utils.c', 'ast2700-hace-test.c'),
+ 'ast2700-hace-test': [files('aspeed-hace-utils.c', 'ast2700-hace-test.c'),
+ crypto],
'ast2700-smc-test': files('aspeed-smc-utils.c', 'ast2700-smc-test.c'),
'bios-tables-test': [io, 'boot-sector.c', 'acpi-utils.c', 'tpm-emu.c'],
'cdrom-test': files('boot-sector.c'),
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode for the crypto command
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
2026-08-11 3:10 ` [PATCH v3 01/16] hw/misc/aspeed_hace: Support the crypto command in direct access mode Jamin Lin
2026-08-11 3:10 ` [PATCH v3 02/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2500 Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:16 ` Kane Chen
2026-08-11 3:10 ` [PATCH v3 04/16] hw/misc/aspeed_hace: Support the CTR " Jamin Lin
` (12 subsequent siblings)
15 siblings, 1 reply; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
The AST2600 and later crypto engines drive the source and destination
through scatter-gather lists (HACE10[18]/[19]) rather than the single
contiguous buffers used by the AST2500 direct access mode. Each SG list
entry is a length word (SG_LIST_LEN_LAST marks the final entry) followed
by a DRAM address, matching the hash engine layout.
Add a crypt_prepare_sg() helper that gathers the source into / scatters
the destination out of the bounce buffer by walking the SG list, and
select it or the existing crypt_prepare_direct() from do_crypt_operation
based on HACE10[18], mirroring the hash engine's direct/scatter-gather
dispatch.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_hace.c | 70 +++++++++++++++++++++++++++++++++++++++----
1 file changed, 64 insertions(+), 6 deletions(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 0f35d74137..646ff50476 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -608,13 +608,58 @@ static bool crypt_prepare_direct(AspeedHACEState *s, uint64_t addr,
}
/*
- * Perform an AES/DES/3DES ECB/CBC operation in direct access mode: the source
- * and destination are single contiguous buffers (HACE00/HACE04) and the IV/key
- * come from the context buffer (HACE08). For CBC the resulting chaining IV is
- * written back to the context buffer so the driver can continue the chain.
+ * Scatter-gather mode: the source/destination register points at an SG list
+ * whose entries are a length word (SG_LIST_LEN_LAST flags the final entry)
+ * followed by a DRAM address, matching the hash engine layout. Gather @len
+ * bytes into @buf, or scatter @buf back out when @to_dram is true.
+ * Returns true on success.
+ */
+static bool crypt_prepare_sg(AspeedHACEState *s, uint64_t addr,
+ uint8_t *buf, uint32_t len, bool to_dram)
+{
+ uint32_t copied = 0;
+ uint32_t sg_addr;
+ uint32_t sg_len;
+ uint32_t entry;
+ int i;
+
+ for (i = 0; i < ASPEED_HACE_MAX_SG && copied < len; i++) {
+ entry = address_space_ldl_le(&s->dram_as, addr,
+ MEMTXATTRS_UNSPECIFIED, NULL);
+ sg_addr = address_space_ldl_le(&s->dram_as, addr + SG_LIST_LEN_SIZE,
+ MEMTXATTRS_UNSPECIFIED, NULL);
+ sg_len = entry & SG_LIST_LEN_MASK;
+
+ sg_addr &= SG_LIST_ADDR_MASK;
+ addr += SG_LIST_ENTRY_SIZE;
+
+ if (sg_len > len - copied) {
+ sg_len = len - copied;
+ }
+ if (address_space_rw(&s->dram_as, sg_addr, MEMTXATTRS_UNSPECIFIED,
+ buf + copied, sg_len, to_dram)) {
+ return false;
+ }
+ copied += sg_len;
+
+ if (entry & SG_LIST_LEN_LAST) {
+ break;
+ }
+ }
+
+ return copied == len;
+}
+
+/*
+ * Perform an AES/DES/3DES ECB/CBC operation. The source and destination are
+ * either single contiguous buffers (direct access mode) or scatter-gather
+ * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key come from
+ * the context buffer (HACE08). For CBC the resulting chaining IV is written
+ * back to the context buffer so the driver can continue the chain.
*/
static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
{
+ bool sg_mode = cmd & CRYPT_CMD_SRC_SG_CTRL;
uint32_t len = s->regs[R_CRYPT_DATA_LEN];
bool encrypt = cmd & CRYPT_CMD_ENCRYPT;
g_autoptr(QCryptoCipher) cipher = NULL;
@@ -631,6 +676,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
size_t iv_offset;
size_t blocklen;
size_t keylen;
+ bool status;
if (len == 0) {
return;
@@ -684,8 +730,14 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
src_buf = g_malloc0(len);
dst_buf = g_malloc0(len);
+ /* Gather the source into the bounce buffer, per the selected mode. */
src_addr = s->regs[R_CRYPT_SRC];
- if (!crypt_prepare_direct(s, src_addr, src_buf, len, false)) {
+ if (sg_mode) {
+ status = crypt_prepare_sg(s, src_addr, src_buf, len, false);
+ } else {
+ status = crypt_prepare_direct(s, src_addr, src_buf, len, false);
+ }
+ if (!status) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Failed to read src, addr=0x%" HWADDR_PRIx "\n",
__func__, src_addr);
@@ -714,8 +766,14 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
}
}
+ /* Scatter the result back out, per the selected mode. */
dst_addr = s->regs[R_CRYPT_DEST];
- if (!crypt_prepare_direct(s, dst_addr, dst_buf, len, true)) {
+ if (sg_mode) {
+ status = crypt_prepare_sg(s, dst_addr, dst_buf, len, true);
+ } else {
+ status = crypt_prepare_direct(s, dst_addr, dst_buf, len, true);
+ }
+ if (!status) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Failed to write dst, addr=0x%" HWADDR_PRIx "\n",
__func__, dst_addr);
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* RE: [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode for the crypto command
2026-08-11 3:10 ` [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode for the crypto command Jamin Lin
@ 2026-08-11 3:16 ` Kane Chen
0 siblings, 0 replies; 22+ messages in thread
From: Kane Chen @ 2026-08-11 3:16 UTC (permalink / raw)
To: Jamin Lin, Daniel P. Berrangé, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Troy Lee
> -----Original Message-----
> From: Jamin Lin <jamin_lin@aspeedtech.com>
> Sent: Tuesday, August 11, 2026 11:11 AM
> To: Daniel P. Berrangé <berrange@redhat.com>; Cédric Le Goater
> <clg@kaod.org>; Peter Maydell <peter.maydell@linaro.org>; Steven Lee
> <steven_lee@aspeedtech.com>; Troy Lee <leetroy@gmail.com>; Kane Chen
> <kane_chen@aspeedtech.com>; Andrew Jeffery
> <andrew@codeconstruct.com.au>; Joel Stanley <joel@jms.id.au>; Eric Blake
> <eblake@redhat.com>; Markus Armbruster <armbru@redhat.com>; Fabiano
> Rosas <farosas@suse.de>; Laurent Vivier <lvivier@redhat.com>; Paolo Bonzini
> <pbonzini@redhat.com>; open list:All patches CC here
> <qemu-devel@nongnu.org>; open list:ASPEED BMCs
> <qemu-arm@nongnu.org>
> Cc: Jamin Lin <jamin_lin@aspeedtech.com>; Troy Lee
> <troy_lee@aspeedtech.com>
> Subject: [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode
> for the crypto command
>
> The AST2600 and later crypto engines drive the source and destination through
> scatter-gather lists (HACE10[18]/[19]) rather than the single contiguous buffers
> used by the AST2500 direct access mode. Each SG list entry is a length word
> (SG_LIST_LEN_LAST marks the final entry) followed by a DRAM address,
> matching the hash engine layout.
>
> Add a crypt_prepare_sg() helper that gathers the source into / scatters the
> destination out of the bounce buffer by walking the SG list, and select it or the
> existing crypt_prepare_direct() from do_crypt_operation based on HACE10[18],
> mirroring the hash engine's direct/scatter-gather dispatch.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/misc/aspeed_hace.c | 70
> +++++++++++++++++++++++++++++++++++++++----
> 1 file changed, 64 insertions(+), 6 deletions(-)
>
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> 0f35d74137..646ff50476 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -608,13 +608,58 @@ static bool crypt_prepare_direct(AspeedHACEState
> *s, uint64_t addr, }
>
> /*
> - * Perform an AES/DES/3DES ECB/CBC operation in direct access mode: the
> source
> - * and destination are single contiguous buffers (HACE00/HACE04) and the
> IV/key
> - * come from the context buffer (HACE08). For CBC the resulting chaining IV is
> - * written back to the context buffer so the driver can continue the chain.
> + * Scatter-gather mode: the source/destination register points at an SG
> +list
> + * whose entries are a length word (SG_LIST_LEN_LAST flags the final
> +entry)
> + * followed by a DRAM address, matching the hash engine layout. Gather
> +@len
> + * bytes into @buf, or scatter @buf back out when @to_dram is true.
> + * Returns true on success.
> + */
> +static bool crypt_prepare_sg(AspeedHACEState *s, uint64_t addr,
> + uint8_t *buf, uint32_t len, bool to_dram)
> +{
> + uint32_t copied = 0;
> + uint32_t sg_addr;
> + uint32_t sg_len;
> + uint32_t entry;
> + int i;
> +
> + for (i = 0; i < ASPEED_HACE_MAX_SG && copied < len; i++) {
> + entry = address_space_ldl_le(&s->dram_as, addr,
> + MEMTXATTRS_UNSPECIFIED,
> NULL);
> + sg_addr = address_space_ldl_le(&s->dram_as, addr +
> SG_LIST_LEN_SIZE,
> + MEMTXATTRS_UNSPECIFIED,
> NULL);
> + sg_len = entry & SG_LIST_LEN_MASK;
> +
> + sg_addr &= SG_LIST_ADDR_MASK;
> + addr += SG_LIST_ENTRY_SIZE;
> +
> + if (sg_len > len - copied) {
> + sg_len = len - copied;
> + }
> + if (address_space_rw(&s->dram_as, sg_addr,
> MEMTXATTRS_UNSPECIFIED,
> + buf + copied, sg_len, to_dram)) {
> + return false;
> + }
> + copied += sg_len;
> +
> + if (entry & SG_LIST_LEN_LAST) {
> + break;
> + }
> + }
> +
> + return copied == len;
> +}
> +
> +/*
> + * Perform an AES/DES/3DES ECB/CBC operation. The source and
> +destination are
> + * either single contiguous buffers (direct access mode) or
> +scatter-gather
> + * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key come
> +from
> + * the context buffer (HACE08). For CBC the resulting chaining IV is
> +written
> + * back to the context buffer so the driver can continue the chain.
> */
> static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd) {
> + bool sg_mode = cmd & CRYPT_CMD_SRC_SG_CTRL;
> uint32_t len = s->regs[R_CRYPT_DATA_LEN];
> bool encrypt = cmd & CRYPT_CMD_ENCRYPT;
> g_autoptr(QCryptoCipher) cipher = NULL; @@ -631,6 +676,7 @@ static
> void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> size_t iv_offset;
> size_t blocklen;
> size_t keylen;
> + bool status;
>
> if (len == 0) {
> return;
> @@ -684,8 +730,14 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
> src_buf = g_malloc0(len);
> dst_buf = g_malloc0(len);
>
> + /* Gather the source into the bounce buffer, per the selected mode.
> + */
> src_addr = s->regs[R_CRYPT_SRC];
> - if (!crypt_prepare_direct(s, src_addr, src_buf, len, false)) {
> + if (sg_mode) {
> + status = crypt_prepare_sg(s, src_addr, src_buf, len, false);
> + } else {
> + status = crypt_prepare_direct(s, src_addr, src_buf, len, false);
> + }
> + if (!status) {
> qemu_log_mask(LOG_GUEST_ERROR,
> "%s: Failed to read src, addr=0x%" HWADDR_PRIx
> "\n",
> __func__, src_addr); @@ -714,8 +766,14 @@
> static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> }
> }
>
> + /* Scatter the result back out, per the selected mode. */
> dst_addr = s->regs[R_CRYPT_DEST];
> - if (!crypt_prepare_direct(s, dst_addr, dst_buf, len, true)) {
> + if (sg_mode) {
> + status = crypt_prepare_sg(s, dst_addr, dst_buf, len, true);
> + } else {
> + status = crypt_prepare_direct(s, dst_addr, dst_buf, len, true);
> + }
> + if (!status) {
> qemu_log_mask(LOG_GUEST_ERROR,
> "%s: Failed to write dst, addr=0x%" HWADDR_PRIx
> "\n",
> __func__, dst_addr);
> --
> 2.43.0
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v3 04/16] hw/misc/aspeed_hace: Support the CTR mode for the crypto command
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (2 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 03/16] hw/misc/aspeed_hace: Support scatter-gather mode for the crypto command Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2600 Jamin Lin
` (11 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
The AST2600, AST1030 and later crypto engines add AES/DES/3DES CTR mode
(HACE10[6:4] = 0b100) on top of the ECB/CBC modes shared with the
AST2500. Decode the CTR selection, round the working buffers up to a
whole block so the stream-like final block is still processed a block at
a time, and write the counter advanced by the number of blocks consumed
back to the context buffer so the driver can continue across requests.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_hace.c | 50 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 45 insertions(+), 5 deletions(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 646ff50476..d84f7f9cec 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -41,6 +41,7 @@
#define CRYPT_CMD_OP_MODE_MASK (0x7 << 4)
#define CRYPT_CMD_ECB (0x0 << 4)
#define CRYPT_CMD_CBC (0x1 << 4)
+#define CRYPT_CMD_CTR (0x4 << 4)
/* AES key length HACE10[3:2] */
#define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
#define CRYPT_CMD_AES256 (0x2 << 2)
@@ -587,6 +588,9 @@ static bool crypt_decode_cmd(uint32_t cmd, QCryptoCipherAlgo *alg,
case CRYPT_CMD_CBC:
*mode = QCRYPTO_CIPHER_MODE_CBC;
break;
+ case CRYPT_CMD_CTR:
+ *mode = QCRYPTO_CIPHER_MODE_CTR;
+ break;
default:
return false;
}
@@ -650,6 +654,22 @@ static bool crypt_prepare_sg(AspeedHACEState *s, uint64_t addr,
return copied == len;
}
+/*
+ * Add @add to the big-endian counter block @ctr (@len bytes) in place, so the
+ * CTR mode counter can be advanced by the number of blocks just consumed.
+ */
+static void crypt_be_add(uint8_t *ctr, size_t len, uint64_t add)
+{
+ size_t i = len;
+
+ while (i > 0 && add) {
+ i--;
+ add += ctr[i];
+ ctr[i] = add & 0xff;
+ add >>= 8;
+ }
+}
+
/*
* Perform an AES/DES/3DES ECB/CBC operation. The source and destination are
* either single contiguous buffers (direct access mode) or scatter-gather
@@ -675,6 +695,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
uint64_t dst_addr;
size_t iv_offset;
size_t blocklen;
+ size_t buf_len;
size_t keylen;
bool status;
@@ -727,8 +748,14 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
return;
}
- src_buf = g_malloc0(len);
- dst_buf = g_malloc0(len);
+ /*
+ * Round the working buffers up to a whole block. Block modes are already
+ * block-aligned; the stream-like CTR mode may leave a partial final block
+ * that the engine still processes a full block at a time.
+ */
+ buf_len = QEMU_ALIGN_UP(len, blocklen);
+ src_buf = g_malloc0(buf_len);
+ dst_buf = g_malloc0(buf_len);
/* Gather the source into the bounce buffer, per the selected mode. */
src_addr = s->regs[R_CRYPT_SRC];
@@ -749,7 +776,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
}
if (encrypt) {
- if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, len,
+ if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, buf_len,
&local_err) < 0) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: encrypt failed: %s\n",
__func__, error_get_pretty(local_err));
@@ -757,7 +784,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
return;
}
} else {
- if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, len,
+ if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, buf_len,
&local_err) < 0) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: decrypt failed: %s\n",
__func__, error_get_pretty(local_err));
@@ -790,13 +817,26 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
* output when encrypting, or of the input when decrypting. Write it
* back as the IV for the next request.
*/
- next_iv = (encrypt ? dst_buf : src_buf) + len - blocklen;
+ next_iv = (encrypt ? dst_buf : src_buf) + buf_len - blocklen;
if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
MEMTXATTRS_UNSPECIFIED, next_iv, blocklen)) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Failed to write IV, addr=0x%" HWADDR_PRIx "\n",
__func__, ctx_addr + iv_offset);
}
+ } else if (mode == QCRYPTO_CIPHER_MODE_CTR) {
+ /*
+ * CTR chains on the counter, which advances by one per block. Add the
+ * number of blocks processed (buf_len / blocklen) and write it back.
+ */
+ crypt_be_add(ctx + iv_offset, blocklen, buf_len / blocklen);
+ if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
+ MEMTXATTRS_UNSPECIFIED, ctx + iv_offset,
+ blocklen)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to write IV, addr=0x%" HWADDR_PRIx "\n",
+ __func__, ctx_addr + iv_offset);
+ }
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2600
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (3 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 04/16] hw/misc/aspeed_hace: Support the CTR " Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:15 ` Kane Chen
2026-08-11 3:10 ` [PATCH v3 06/16] tests/qtest/aspeed-hace: Test the crypto command on the AST1030 Jamin Lin
` (10 subsequent siblings)
15 siblings, 1 reply; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Extend the crypto known-answer tests to cover the AST2600 crypto engine,
which drives the source and destination through scatter-gather lists and
adds CTR mode on top of the ECB/CBC modes shared with the AST2500.
Add a scatter-gather runner that describes each buffer with three
non-adjacent fragments to exercise the gather/scatter path, add
AES/DES/3DES CTR vectors (verifying the counter written back to the
context buffer), and give aspeed_add_crypto_tests() a mode mask and a
scatter-gather flag so each SoC registers exactly the modes and transfer
method it supports. Register the AST2600 with ECB/CBC/CTR in
scatter-gather mode.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
tests/qtest/aspeed-hace-utils.h | 7 +-
tests/qtest/aspeed-hace-utils.c | 217 +++++++++++++++++++++++++++++++-
tests/qtest/aspeed_hace-test.c | 8 +-
3 files changed, 224 insertions(+), 8 deletions(-)
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index 13feaa61e4..82b0b3f93d 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -85,15 +85,18 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
enum {
CRYPT_MODE_ECB = 1 << 0,
CRYPT_MODE_CBC = 1 << 1,
+ CRYPT_MODE_CTR = 1 << 2,
};
/*
* Register the crypto known-answer tests that @modes selects (a mask of
* CRYPT_MODE_*) for the given machine. Each test is named
- * "<prefix>/hace/crypto/<mode>".
+ * "<prefix>/hace/crypto/<mode>". @sg selects scatter-gather mode (used by the
+ * AST2600 and later) instead of the AST2500 direct access mode.
*/
void aspeed_add_crypto_tests(const char *prefix, const char *machine,
- uint32_t base, uint64_t dram, uint32_t modes);
+ uint32_t base, uint64_t dram, uint32_t modes,
+ bool sg);
#endif /* TESTS_ASPEED_HACE_UTILS_H */
diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 0355dd47af..f582c88ef5 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -665,6 +665,7 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
#define HACE_CMD_OP_MODE_MASK (0x7 << 4)
#define HACE_CMD_ECB (0x0 << 4)
#define HACE_CMD_CBC (0x1 << 4)
+#define HACE_CMD_CTR (0x4 << 4)
#define HACE_CMD_AES128 (0x0 << 2)
/* Context buffer layout: IV (DES at +8), key at +0x10 */
@@ -750,6 +751,49 @@ static const uint8_t tdes_cbc_ptext[8] = {
static const uint8_t tdes_cbc_ctext[8] = {
0x0e, 0x2d, 0xb6, 0x97, 0x3c, 0x56, 0x33, 0xf4 };
+/* aes_ctr_tv_template[0] (NIST SP800-38A F.5.1), first block */
+static const uint8_t aes128_ctr_key[16] = {
+ 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+ 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c };
+static const uint8_t aes128_ctr_iv[16] = {
+ 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+ 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff };
+static const uint8_t aes128_ctr_ptext[16] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a };
+static const uint8_t aes128_ctr_ctext[16] = {
+ 0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
+ 0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce };
+static const uint8_t aes128_ctr_ivout[16] = {
+ 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+ 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xff, 0x00 };
+
+/* des_ctr_tv_template[0] (Crypto++), first block */
+static const uint8_t des_ctr_key[8] = {
+ 0xc9, 0x83, 0xa6, 0xc9, 0xec, 0x0f, 0x32, 0x55 };
+static const uint8_t des_ctr_iv[8] = {
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfd };
+static const uint8_t des_ctr_ptext[8] = {
+ 0x50, 0xb9, 0x22, 0xae, 0x17, 0x80, 0x0c, 0x75 };
+static const uint8_t des_ctr_ctext[8] = {
+ 0x2f, 0x96, 0x06, 0x0f, 0x50, 0xc9, 0x68, 0x03 };
+static const uint8_t des_ctr_ivout[8] = {
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe };
+
+/* des3_ede_ctr_tv_template[0] (Crypto++), first block */
+static const uint8_t tdes_ctr_key[24] = {
+ 0x9c, 0xd6, 0xf3, 0x9c, 0xb9, 0x5a, 0x67, 0x00,
+ 0x5a, 0x67, 0x00, 0x2d, 0xce, 0xeb, 0x2d, 0xce,
+ 0xeb, 0xb4, 0x51, 0x72, 0xb4, 0x51, 0x72, 0x1f };
+static const uint8_t tdes_ctr_iv[8] = {
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+static const uint8_t tdes_ctr_ptext[8] = {
+ 0x05, 0xec, 0x77, 0xfb, 0x42, 0xd5, 0x59, 0x20 };
+static const uint8_t tdes_ctr_ctext[8] = {
+ 0x07, 0xc2, 0x08, 0x20, 0x72, 0x1f, 0x49, 0xef };
+static const uint8_t tdes_ctr_ivout[8] = {
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
typedef struct CryptTest {
QCryptoCipherMode mode;
QCryptoCipherAlgo alg;
@@ -841,12 +885,65 @@ static const CryptTest crypt_tests[] = {
.ctext = tdes_cbc_ctext,
.len = sizeof(tdes_cbc_ptext),
},
+ {
+ .name = "aes128-ctr",
+ .cmd = HACE_CMD_AES128 | HACE_CMD_CTR,
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .mode = QCRYPTO_CIPHER_MODE_CTR,
+ .key = aes128_ctr_key,
+ .keylen = sizeof(aes128_ctr_key),
+ .iv = aes128_ctr_iv,
+ .ivlen = sizeof(aes128_ctr_iv),
+ .ptext = aes128_ctr_ptext,
+ .ctext = aes128_ctr_ctext,
+ .iv_out = aes128_ctr_ivout,
+ .len = sizeof(aes128_ctr_ptext),
+ },
+ {
+ .name = "des-ctr",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_CTR,
+ .alg = QCRYPTO_CIPHER_ALGO_DES,
+ .mode = QCRYPTO_CIPHER_MODE_CTR,
+ .key = des_ctr_key,
+ .keylen = sizeof(des_ctr_key),
+ .iv = des_ctr_iv,
+ .ivlen = sizeof(des_ctr_iv),
+ .ptext = des_ctr_ptext,
+ .ctext = des_ctr_ctext,
+ .iv_out = des_ctr_ivout,
+ .len = sizeof(des_ctr_ptext),
+ },
+ {
+ .name = "des3_ede-ctr",
+ .cmd = HACE_CMD_DES_SELECT | HACE_CMD_TRIPLE_DES | HACE_CMD_CTR,
+ .alg = QCRYPTO_CIPHER_ALGO_3DES,
+ .mode = QCRYPTO_CIPHER_MODE_CTR,
+ .key = tdes_ctr_key,
+ .keylen = sizeof(tdes_ctr_key),
+ .iv = tdes_ctr_iv,
+ .ivlen = sizeof(tdes_ctr_iv),
+ .ptext = tdes_ctr_ptext,
+ .ctext = tdes_ctr_ctext,
+ .iv_out = tdes_ctr_ivout,
+ .len = sizeof(tdes_ctr_ptext),
+ },
};
/* DRAM offsets for the crypto test source, destination and context buffers. */
#define CRYPT_OFF_SRC 0x10000
#define CRYPT_OFF_DST 0x20000
#define CRYPT_OFF_CTX 0x30000
+/* Scatter-gather list offsets (each list has CRYPT_SG_FRAGS entries). */
+#define CRYPT_OFF_SRC_SG 0x40000
+#define CRYPT_OFF_DST_SG 0x50000
+/*
+ * The scatter-gather tests split each buffer into CRYPT_SG_FRAGS fragments,
+ * each placed CRYPT_SG_FRAG_STRIDE apart so the fragments never abut. The gaps
+ * make the test fail if the engine ignores the list and reads one contiguous
+ * block.
+ */
+#define CRYPT_SG_FRAGS 3
+#define CRYPT_SG_FRAG_STRIDE 0x1000
/* Describes one registered crypto test (qtest_add_data_func() data pointer). */
typedef struct AspeedCryptoTest {
@@ -854,6 +951,7 @@ typedef struct AspeedCryptoTest {
uint64_t dram;
uint32_t base;
int index;
+ bool sg;
} AspeedCryptoTest;
/* Map a command's operation mode (HACE10[6:4]) to a CRYPT_MODE_* flag. */
@@ -864,6 +962,8 @@ static uint32_t crypt_mode_flag(uint32_t cmd)
return CRYPT_MODE_ECB;
case HACE_CMD_CBC:
return CRYPT_MODE_CBC;
+ case HACE_CMD_CTR:
+ return CRYPT_MODE_CTR;
default:
return 0;
}
@@ -912,7 +1012,104 @@ static void crypt_run_direct(QTestState *s, uint32_t base, uint64_t dram,
qtest_memread(s, dst, out, t->len);
}
-static void aspeed_test_crypto_direct(const void *data)
+/*
+ * Byte range [*frag_off, *frag_off + *frag_len) of fragment @index when an
+ * @len-byte buffer is split into CRYPT_SG_FRAGS pieces; the last piece takes
+ * the remainder of an uneven split.
+ */
+static void crypt_frag_range(uint32_t len, int index,
+ uint32_t *frag_off, uint32_t *frag_len)
+{
+ uint32_t base = len / CRYPT_SG_FRAGS;
+
+ *frag_off = base * index;
+ *frag_len = (index == CRYPT_SG_FRAGS - 1) ? len - *frag_off : base;
+}
+
+/*
+ * Scatter [in, len) across CRYPT_SG_FRAGS buffers based at @base_off and spaced
+ * CRYPT_SG_FRAG_STRIDE apart, then build the SG list describing them at @list.
+ * When @in is NULL only the list is built (used for the destination, which the
+ * engine fills in).
+ */
+static void crypt_make_sg(QTestState *s, uint64_t dram, uint32_t base_off,
+ uint64_t list, const uint8_t *in, uint32_t len)
+{
+ struct AspeedSgList sg[CRYPT_SG_FRAGS];
+ uint32_t frag_off;
+ uint32_t frag_len;
+ uint64_t buf;
+ int i;
+
+ for (i = 0; i < CRYPT_SG_FRAGS; i++) {
+ crypt_frag_range(len, i, &frag_off, &frag_len);
+ buf = dram + base_off + i * CRYPT_SG_FRAG_STRIDE;
+
+ if (in) {
+ qtest_memwrite(s, buf, in + frag_off, frag_len);
+ }
+ sg[i].len = cpu_to_le32(frag_len | (i == CRYPT_SG_FRAGS - 1 ?
+ SG_LIST_LEN_LAST : 0));
+ sg[i].addr = cpu_to_le32((uint32_t)buf);
+ }
+
+ qtest_memwrite(s, list, sg, sizeof(sg));
+}
+
+/* Gather a scatter-gathered result back from the CRYPT_SG_FRAGS buffers. */
+static void crypt_gather_sg(QTestState *s, uint64_t dram, uint32_t base_off,
+ uint8_t *out, uint32_t len)
+{
+ uint32_t frag_off;
+ uint32_t frag_len;
+ int i;
+
+ for (i = 0; i < CRYPT_SG_FRAGS; i++) {
+ crypt_frag_range(len, i, &frag_off, &frag_len);
+ qtest_memread(s, dram + base_off + i * CRYPT_SG_FRAG_STRIDE,
+ out + frag_off, frag_len);
+ }
+}
+
+/*
+ * Run one block-cipher (ECB/CBC/CTR) operation in scatter-gather mode and read
+ * back the result. The source and destination are each split across
+ * CRYPT_SG_FRAGS non-adjacent DRAM buffers described by an SG list; the gaps
+ * ensure the test fails if the engine ignores the list and reads one
+ * contiguous block.
+ */
+static void crypt_run_sg(QTestState *s, uint32_t base, uint64_t dram,
+ const CryptTest *t, bool encrypt, uint8_t *out)
+{
+ const uint8_t *in = encrypt ? t->ptext : t->ctext;
+ uint64_t src_sg = dram + CRYPT_OFF_SRC_SG;
+ uint64_t dst_sg = dram + CRYPT_OFF_DST_SG;
+ uint64_t ctx = dram + CRYPT_OFF_CTX;
+ uint32_t cmd = t->cmd | HACE_CMD_ISR_EN | HACE_CMD_SRC_SG_CTRL |
+ HACE_CMD_DST_SG_CTRL;
+
+ if (encrypt) {
+ cmd |= HACE_CMD_ENCRYPT;
+ }
+
+ crypt_write_ctx(s, ctx, t);
+ crypt_make_sg(s, dram, CRYPT_OFF_SRC, src_sg, in, t->len);
+ crypt_make_sg(s, dram, CRYPT_OFF_DST, dst_sg, NULL, t->len);
+
+ qtest_writel(s, base + HACE_CRYPTO_SRC, (uint32_t)src_sg);
+ qtest_writel(s, base + HACE_CRYPTO_DEST, (uint32_t)dst_sg);
+ qtest_writel(s, base + HACE_CRYPTO_CONTEXT, (uint32_t)ctx);
+ qtest_writel(s, base + HACE_CRYPTO_DATA_LEN, t->len);
+ qtest_writel(s, base + HACE_CRYPTO_CMD, cmd);
+
+ g_assert_cmphex(qtest_readl(s, base + HACE_STS) & HACE_CRYPTO_ISR, ==,
+ HACE_CRYPTO_ISR);
+ qtest_writel(s, base + HACE_STS, HACE_CRYPTO_ISR);
+
+ crypt_gather_sg(s, dram, CRYPT_OFF_DST, out, t->len);
+}
+
+static void aspeed_test_crypto(const void *data)
{
const AspeedCryptoTest *c = data;
const CryptTest *t = &crypt_tests[c->index];
@@ -924,7 +1121,11 @@ static void aspeed_test_crypto_direct(const void *data)
g_assert_cmpuint(t->len, <=, sizeof(out));
/* Encrypt: ptext -> ctext */
- crypt_run_direct(s, c->base, c->dram, t, true, out);
+ if (c->sg) {
+ crypt_run_sg(s, c->base, c->dram, t, true, out);
+ } else {
+ crypt_run_direct(s, c->base, c->dram, t, true, out);
+ }
g_assert_cmpmem(out, t->len, t->ctext, t->len);
if (t->iv_out) {
@@ -934,14 +1135,19 @@ static void aspeed_test_crypto_direct(const void *data)
}
/* Decrypt: ctext -> ptext */
- crypt_run_direct(s, c->base, c->dram, t, false, out);
+ if (c->sg) {
+ crypt_run_sg(s, c->base, c->dram, t, false, out);
+ } else {
+ crypt_run_direct(s, c->base, c->dram, t, false, out);
+ }
g_assert_cmpmem(out, t->len, t->ptext, t->len);
qtest_quit(s);
}
void aspeed_add_crypto_tests(const char *prefix, const char *machine,
- uint32_t base, uint64_t dram, uint32_t modes)
+ uint32_t base, uint64_t dram, uint32_t modes,
+ bool sg)
{
int i;
@@ -966,7 +1172,8 @@ void aspeed_add_crypto_tests(const char *prefix, const char *machine,
t->base = base;
t->dram = dram;
t->index = i;
- qtest_add_data_func_full(path, t, aspeed_test_crypto_direct, g_free);
+ t->sg = sg;
+ qtest_add_data_func_full(path, t, aspeed_test_crypto, g_free);
}
}
diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index 4cb4c475e9..61a3e3feb5 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -224,6 +224,12 @@ int main(int argc, char **argv)
qtest_add_func("ast2600/hace/sha384_accum", test_sha384_accum_ast2600);
qtest_add_func("ast2600/hace/sha256_accum", test_sha256_accum_ast2600);
+ /* The AST2600 crypto engine uses scatter-gather mode and adds CTR. */
+ aspeed_add_crypto_tests("ast2600", "-machine ast2600-evb", 0x1e6d0000,
+ 0x80000000,
+ CRYPT_MODE_ECB | CRYPT_MODE_CBC | CRYPT_MODE_CTR,
+ true);
+
qtest_add_func("ast2500/hace/addresses", test_addresses_ast2500);
qtest_add_func("ast2500/hace/sha512", test_sha512_ast2500);
qtest_add_func("ast2500/hace/sha256", test_sha256_ast2500);
@@ -233,7 +239,7 @@ int main(int argc, char **argv)
* The AST2500 crypto engine uses direct access mode and supports ECB/CBC.
*/
aspeed_add_crypto_tests("ast2500", "-machine ast2500-evb", 0x1e6e3000,
- 0x80000000, CRYPT_MODE_ECB | CRYPT_MODE_CBC);
+ 0x80000000, CRYPT_MODE_ECB | CRYPT_MODE_CBC, false);
qtest_add_func("ast2400/hace/addresses", test_addresses_ast2400);
qtest_add_func("ast2400/hace/sha512", test_sha512_ast2400);
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* RE: [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2600
2026-08-11 3:10 ` [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2600 Jamin Lin
@ 2026-08-11 3:15 ` Kane Chen
0 siblings, 0 replies; 22+ messages in thread
From: Kane Chen @ 2026-08-11 3:15 UTC (permalink / raw)
To: Jamin Lin, Daniel P. Berrangé, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Troy Lee
> -----Original Message-----
> From: Jamin Lin <jamin_lin@aspeedtech.com>
> Sent: Tuesday, August 11, 2026 11:11 AM
> To: Daniel P. Berrangé <berrange@redhat.com>; Cédric Le Goater
> <clg@kaod.org>; Peter Maydell <peter.maydell@linaro.org>; Steven Lee
> <steven_lee@aspeedtech.com>; Troy Lee <leetroy@gmail.com>; Kane Chen
> <kane_chen@aspeedtech.com>; Andrew Jeffery
> <andrew@codeconstruct.com.au>; Joel Stanley <joel@jms.id.au>; Eric Blake
> <eblake@redhat.com>; Markus Armbruster <armbru@redhat.com>; Fabiano
> Rosas <farosas@suse.de>; Laurent Vivier <lvivier@redhat.com>; Paolo Bonzini
> <pbonzini@redhat.com>; open list:All patches CC here
> <qemu-devel@nongnu.org>; open list:ASPEED BMCs
> <qemu-arm@nongnu.org>
> Cc: Jamin Lin <jamin_lin@aspeedtech.com>; Troy Lee
> <troy_lee@aspeedtech.com>
> Subject: [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command
> on the AST2600
>
> Extend the crypto known-answer tests to cover the AST2600 crypto engine,
> which drives the source and destination through scatter-gather lists and adds
> CTR mode on top of the ECB/CBC modes shared with the AST2500.
>
> Add a scatter-gather runner that describes each buffer with three non-adjacent
> fragments to exercise the gather/scatter path, add AES/DES/3DES CTR vectors
> (verifying the counter written back to the context buffer), and give
> aspeed_add_crypto_tests() a mode mask and a scatter-gather flag so each SoC
> registers exactly the modes and transfer method it supports. Register the
> AST2600 with ECB/CBC/CTR in scatter-gather mode.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> tests/qtest/aspeed-hace-utils.h | 7 +-
> tests/qtest/aspeed-hace-utils.c | 217 +++++++++++++++++++++++++++++++-
> tests/qtest/aspeed_hace-test.c | 8 +-
> 3 files changed, 224 insertions(+), 8 deletions(-)
>
> diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
> index 13feaa61e4..82b0b3f93d 100644
> --- a/tests/qtest/aspeed-hace-utils.h
> +++ b/tests/qtest/aspeed-hace-utils.h
> @@ -85,15 +85,18 @@ void aspeed_test_addresses(const char *machine,
> const uint32_t base, enum {
> CRYPT_MODE_ECB = 1 << 0,
> CRYPT_MODE_CBC = 1 << 1,
> + CRYPT_MODE_CTR = 1 << 2,
> };
>
> /*
> * Register the crypto known-answer tests that @modes selects (a mask of
> * CRYPT_MODE_*) for the given machine. Each test is named
> - * "<prefix>/hace/crypto/<mode>".
> + * "<prefix>/hace/crypto/<mode>". @sg selects scatter-gather mode (used
> + by the
> + * AST2600 and later) instead of the AST2500 direct access mode.
> */
> void aspeed_add_crypto_tests(const char *prefix, const char *machine,
> - uint32_t base, uint64_t dram, uint32_t
> modes);
> + uint32_t base, uint64_t dram, uint32_t
> modes,
> + bool sg);
>
> #endif /* TESTS_ASPEED_HACE_UTILS_H */
>
> diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
> index 0355dd47af..f582c88ef5 100644
> --- a/tests/qtest/aspeed-hace-utils.c
> +++ b/tests/qtest/aspeed-hace-utils.c
> @@ -665,6 +665,7 @@ void aspeed_test_addresses(const char *machine,
> const uint32_t base,
> #define HACE_CMD_OP_MODE_MASK (0x7 << 4)
> #define HACE_CMD_ECB (0x0 << 4)
> #define HACE_CMD_CBC (0x1 << 4)
> +#define HACE_CMD_CTR (0x4 << 4)
> #define HACE_CMD_AES128 (0x0 << 2)
>
> /* Context buffer layout: IV (DES at +8), key at +0x10 */ @@ -750,6 +751,49
> @@ static const uint8_t tdes_cbc_ptext[8] = { static const uint8_t
> tdes_cbc_ctext[8] = {
> 0x0e, 0x2d, 0xb6, 0x97, 0x3c, 0x56, 0x33, 0xf4 };
>
> +/* aes_ctr_tv_template[0] (NIST SP800-38A F.5.1), first block */ static
> +const uint8_t aes128_ctr_key[16] = {
> + 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
> + 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c }; static const
> +uint8_t aes128_ctr_iv[16] = {
> + 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
> + 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff }; static const
> +uint8_t aes128_ctr_ptext[16] = {
> + 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
> + 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a }; static const
> +uint8_t aes128_ctr_ctext[16] = {
> + 0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
> + 0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce }; static const
> +uint8_t aes128_ctr_ivout[16] = {
> + 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
> + 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xff, 0x00 };
> +
> +/* des_ctr_tv_template[0] (Crypto++), first block */ static const
> +uint8_t des_ctr_key[8] = {
> + 0xc9, 0x83, 0xa6, 0xc9, 0xec, 0x0f, 0x32, 0x55 }; static const
> +uint8_t des_ctr_iv[8] = {
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfd }; static const
> +uint8_t des_ctr_ptext[8] = {
> + 0x50, 0xb9, 0x22, 0xae, 0x17, 0x80, 0x0c, 0x75 }; static const
> +uint8_t des_ctr_ctext[8] = {
> + 0x2f, 0x96, 0x06, 0x0f, 0x50, 0xc9, 0x68, 0x03 }; static const
> +uint8_t des_ctr_ivout[8] = {
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe };
> +
> +/* des3_ede_ctr_tv_template[0] (Crypto++), first block */ static const
> +uint8_t tdes_ctr_key[24] = {
> + 0x9c, 0xd6, 0xf3, 0x9c, 0xb9, 0x5a, 0x67, 0x00,
> + 0x5a, 0x67, 0x00, 0x2d, 0xce, 0xeb, 0x2d, 0xce,
> + 0xeb, 0xb4, 0x51, 0x72, 0xb4, 0x51, 0x72, 0x1f }; static const
> +uint8_t tdes_ctr_iv[8] = {
> + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; static const
> +uint8_t tdes_ctr_ptext[8] = {
> + 0x05, 0xec, 0x77, 0xfb, 0x42, 0xd5, 0x59, 0x20 }; static const
> +uint8_t tdes_ctr_ctext[8] = {
> + 0x07, 0xc2, 0x08, 0x20, 0x72, 0x1f, 0x49, 0xef }; static const
> +uint8_t tdes_ctr_ivout[8] = {
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
> +
> typedef struct CryptTest {
> QCryptoCipherMode mode;
> QCryptoCipherAlgo alg;
> @@ -841,12 +885,65 @@ static const CryptTest crypt_tests[] = {
> .ctext = tdes_cbc_ctext,
> .len = sizeof(tdes_cbc_ptext),
> },
> + {
> + .name = "aes128-ctr",
> + .cmd = HACE_CMD_AES128 | HACE_CMD_CTR,
> + .alg = QCRYPTO_CIPHER_ALGO_AES_128,
> + .mode = QCRYPTO_CIPHER_MODE_CTR,
> + .key = aes128_ctr_key,
> + .keylen = sizeof(aes128_ctr_key),
> + .iv = aes128_ctr_iv,
> + .ivlen = sizeof(aes128_ctr_iv),
> + .ptext = aes128_ctr_ptext,
> + .ctext = aes128_ctr_ctext,
> + .iv_out = aes128_ctr_ivout,
> + .len = sizeof(aes128_ctr_ptext),
> + },
> + {
> + .name = "des-ctr",
> + .cmd = HACE_CMD_DES_SELECT | HACE_CMD_CTR,
> + .alg = QCRYPTO_CIPHER_ALGO_DES,
> + .mode = QCRYPTO_CIPHER_MODE_CTR,
> + .key = des_ctr_key,
> + .keylen = sizeof(des_ctr_key),
> + .iv = des_ctr_iv,
> + .ivlen = sizeof(des_ctr_iv),
> + .ptext = des_ctr_ptext,
> + .ctext = des_ctr_ctext,
> + .iv_out = des_ctr_ivout,
> + .len = sizeof(des_ctr_ptext),
> + },
> + {
> + .name = "des3_ede-ctr",
> + .cmd = HACE_CMD_DES_SELECT | HACE_CMD_TRIPLE_DES |
> HACE_CMD_CTR,
> + .alg = QCRYPTO_CIPHER_ALGO_3DES,
> + .mode = QCRYPTO_CIPHER_MODE_CTR,
> + .key = tdes_ctr_key,
> + .keylen = sizeof(tdes_ctr_key),
> + .iv = tdes_ctr_iv,
> + .ivlen = sizeof(tdes_ctr_iv),
> + .ptext = tdes_ctr_ptext,
> + .ctext = tdes_ctr_ctext,
> + .iv_out = tdes_ctr_ivout,
> + .len = sizeof(tdes_ctr_ptext),
> + },
> };
>
> /* DRAM offsets for the crypto test source, destination and context buffers. */
> #define CRYPT_OFF_SRC 0x10000
> #define CRYPT_OFF_DST 0x20000
> #define CRYPT_OFF_CTX 0x30000
> +/* Scatter-gather list offsets (each list has CRYPT_SG_FRAGS entries).
> +*/ #define CRYPT_OFF_SRC_SG 0x40000 #define CRYPT_OFF_DST_SG
> 0x50000
> +/*
> + * The scatter-gather tests split each buffer into CRYPT_SG_FRAGS
> +fragments,
> + * each placed CRYPT_SG_FRAG_STRIDE apart so the fragments never abut.
> +The gaps
> + * make the test fail if the engine ignores the list and reads one
> +contiguous
> + * block.
> + */
> +#define CRYPT_SG_FRAGS 3
> +#define CRYPT_SG_FRAG_STRIDE 0x1000
>
> /* Describes one registered crypto test (qtest_add_data_func() data pointer).
> */ typedef struct AspeedCryptoTest { @@ -854,6 +951,7 @@ typedef struct
> AspeedCryptoTest {
> uint64_t dram;
> uint32_t base;
> int index;
> + bool sg;
> } AspeedCryptoTest;
>
> /* Map a command's operation mode (HACE10[6:4]) to a CRYPT_MODE_*
> flag. */ @@ -864,6 +962,8 @@ static uint32_t crypt_mode_flag(uint32_t cmd)
> return CRYPT_MODE_ECB;
> case HACE_CMD_CBC:
> return CRYPT_MODE_CBC;
> + case HACE_CMD_CTR:
> + return CRYPT_MODE_CTR;
> default:
> return 0;
> }
> @@ -912,7 +1012,104 @@ static void crypt_run_direct(QTestState *s, uint32_t
> base, uint64_t dram,
> qtest_memread(s, dst, out, t->len); }
>
> -static void aspeed_test_crypto_direct(const void *data)
> +/*
> + * Byte range [*frag_off, *frag_off + *frag_len) of fragment @index
> +when an
> + * @len-byte buffer is split into CRYPT_SG_FRAGS pieces; the last piece
> +takes
> + * the remainder of an uneven split.
> + */
> +static void crypt_frag_range(uint32_t len, int index,
> + uint32_t *frag_off, uint32_t *frag_len) {
> + uint32_t base = len / CRYPT_SG_FRAGS;
> +
> + *frag_off = base * index;
> + *frag_len = (index == CRYPT_SG_FRAGS - 1) ? len - *frag_off : base;
> +}
> +
> +/*
> + * Scatter [in, len) across CRYPT_SG_FRAGS buffers based at @base_off
> +and spaced
> + * CRYPT_SG_FRAG_STRIDE apart, then build the SG list describing them at
> @list.
> + * When @in is NULL only the list is built (used for the destination,
> +which the
> + * engine fills in).
> + */
> +static void crypt_make_sg(QTestState *s, uint64_t dram, uint32_t base_off,
> + uint64_t list, const uint8_t *in, uint32_t
> +len) {
> + struct AspeedSgList sg[CRYPT_SG_FRAGS];
> + uint32_t frag_off;
> + uint32_t frag_len;
> + uint64_t buf;
> + int i;
> +
> + for (i = 0; i < CRYPT_SG_FRAGS; i++) {
> + crypt_frag_range(len, i, &frag_off, &frag_len);
> + buf = dram + base_off + i * CRYPT_SG_FRAG_STRIDE;
> +
> + if (in) {
> + qtest_memwrite(s, buf, in + frag_off, frag_len);
> + }
> + sg[i].len = cpu_to_le32(frag_len | (i == CRYPT_SG_FRAGS - 1 ?
> + SG_LIST_LEN_LAST :
> 0));
> + sg[i].addr = cpu_to_le32((uint32_t)buf);
> + }
> +
> + qtest_memwrite(s, list, sg, sizeof(sg)); }
> +
> +/* Gather a scatter-gathered result back from the CRYPT_SG_FRAGS
> +buffers. */ static void crypt_gather_sg(QTestState *s, uint64_t dram, uint32_t
> base_off,
> + uint8_t *out, uint32_t len) {
> + uint32_t frag_off;
> + uint32_t frag_len;
> + int i;
> +
> + for (i = 0; i < CRYPT_SG_FRAGS; i++) {
> + crypt_frag_range(len, i, &frag_off, &frag_len);
> + qtest_memread(s, dram + base_off + i * CRYPT_SG_FRAG_STRIDE,
> + out + frag_off, frag_len);
> + }
> +}
> +
> +/*
> + * Run one block-cipher (ECB/CBC/CTR) operation in scatter-gather mode
> +and read
> + * back the result. The source and destination are each split across
> + * CRYPT_SG_FRAGS non-adjacent DRAM buffers described by an SG list;
> +the gaps
> + * ensure the test fails if the engine ignores the list and reads one
> + * contiguous block.
> + */
> +static void crypt_run_sg(QTestState *s, uint32_t base, uint64_t dram,
> + const CryptTest *t, bool encrypt, uint8_t
> +*out) {
> + const uint8_t *in = encrypt ? t->ptext : t->ctext;
> + uint64_t src_sg = dram + CRYPT_OFF_SRC_SG;
> + uint64_t dst_sg = dram + CRYPT_OFF_DST_SG;
> + uint64_t ctx = dram + CRYPT_OFF_CTX;
> + uint32_t cmd = t->cmd | HACE_CMD_ISR_EN |
> HACE_CMD_SRC_SG_CTRL |
> + HACE_CMD_DST_SG_CTRL;
> +
> + if (encrypt) {
> + cmd |= HACE_CMD_ENCRYPT;
> + }
> +
> + crypt_write_ctx(s, ctx, t);
> + crypt_make_sg(s, dram, CRYPT_OFF_SRC, src_sg, in, t->len);
> + crypt_make_sg(s, dram, CRYPT_OFF_DST, dst_sg, NULL, t->len);
> +
> + qtest_writel(s, base + HACE_CRYPTO_SRC, (uint32_t)src_sg);
> + qtest_writel(s, base + HACE_CRYPTO_DEST, (uint32_t)dst_sg);
> + qtest_writel(s, base + HACE_CRYPTO_CONTEXT, (uint32_t)ctx);
> + qtest_writel(s, base + HACE_CRYPTO_DATA_LEN, t->len);
> + qtest_writel(s, base + HACE_CRYPTO_CMD, cmd);
> +
> + g_assert_cmphex(qtest_readl(s, base + HACE_STS) & HACE_CRYPTO_ISR,
> ==,
> + HACE_CRYPTO_ISR);
> + qtest_writel(s, base + HACE_STS, HACE_CRYPTO_ISR);
> +
> + crypt_gather_sg(s, dram, CRYPT_OFF_DST, out, t->len); }
> +
> +static void aspeed_test_crypto(const void *data)
> {
> const AspeedCryptoTest *c = data;
> const CryptTest *t = &crypt_tests[c->index]; @@ -924,7 +1121,11 @@
> static void aspeed_test_crypto_direct(const void *data)
> g_assert_cmpuint(t->len, <=, sizeof(out));
>
> /* Encrypt: ptext -> ctext */
> - crypt_run_direct(s, c->base, c->dram, t, true, out);
> + if (c->sg) {
> + crypt_run_sg(s, c->base, c->dram, t, true, out);
> + } else {
> + crypt_run_direct(s, c->base, c->dram, t, true, out);
> + }
> g_assert_cmpmem(out, t->len, t->ctext, t->len);
>
> if (t->iv_out) {
> @@ -934,14 +1135,19 @@ static void aspeed_test_crypto_direct(const void
> *data)
> }
>
> /* Decrypt: ctext -> ptext */
> - crypt_run_direct(s, c->base, c->dram, t, false, out);
> + if (c->sg) {
> + crypt_run_sg(s, c->base, c->dram, t, false, out);
> + } else {
> + crypt_run_direct(s, c->base, c->dram, t, false, out);
> + }
> g_assert_cmpmem(out, t->len, t->ptext, t->len);
>
> qtest_quit(s);
> }
>
> void aspeed_add_crypto_tests(const char *prefix, const char *machine,
> - uint32_t base, uint64_t dram, uint32_t
> modes)
> + uint32_t base, uint64_t dram, uint32_t
> modes,
> + bool sg)
> {
> int i;
>
> @@ -966,7 +1172,8 @@ void aspeed_add_crypto_tests(const char *prefix,
> const char *machine,
> t->base = base;
> t->dram = dram;
> t->index = i;
> - qtest_add_data_func_full(path, t, aspeed_test_crypto_direct,
> g_free);
> + t->sg = sg;
> + qtest_add_data_func_full(path, t, aspeed_test_crypto, g_free);
> }
> }
>
> diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
> index 4cb4c475e9..61a3e3feb5 100644
> --- a/tests/qtest/aspeed_hace-test.c
> +++ b/tests/qtest/aspeed_hace-test.c
> @@ -224,6 +224,12 @@ int main(int argc, char **argv)
> qtest_add_func("ast2600/hace/sha384_accum",
> test_sha384_accum_ast2600);
> qtest_add_func("ast2600/hace/sha256_accum",
> test_sha256_accum_ast2600);
>
> + /* The AST2600 crypto engine uses scatter-gather mode and adds CTR.
> */
> + aspeed_add_crypto_tests("ast2600", "-machine ast2600-evb",
> 0x1e6d0000,
> + 0x80000000,
> + CRYPT_MODE_ECB | CRYPT_MODE_CBC |
> CRYPT_MODE_CTR,
> + true);
> +
> qtest_add_func("ast2500/hace/addresses", test_addresses_ast2500);
> qtest_add_func("ast2500/hace/sha512", test_sha512_ast2500);
> qtest_add_func("ast2500/hace/sha256", test_sha256_ast2500); @@
> -233,7 +239,7 @@ int main(int argc, char **argv)
> * The AST2500 crypto engine uses direct access mode and supports
> ECB/CBC.
> */
> aspeed_add_crypto_tests("ast2500", "-machine ast2500-evb",
> 0x1e6e3000,
> - 0x80000000, CRYPT_MODE_ECB |
> CRYPT_MODE_CBC);
> + 0x80000000, CRYPT_MODE_ECB |
> + CRYPT_MODE_CBC, false);
>
> qtest_add_func("ast2400/hace/addresses", test_addresses_ast2400);
> qtest_add_func("ast2400/hace/sha512", test_sha512_ast2400);
> --
> 2.43.0
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v3 06/16] tests/qtest/aspeed-hace: Test the crypto command on the AST1030
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (4 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 05/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2600 Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 07/16] crypto/cipher: Add GCM to QCryptoCipherMode Jamin Lin
` (9 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
The AST1030 reuses the AST2600 crypto engine, so it drives the same
scatter-gather transfers and supports the same ECB/CBC/CTR modes. Reuse
the crypto known-answer tests to cover it, registering the AST1030 with
the same modes and scatter-gather flag as the AST2600.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
tests/qtest/aspeed_hace-test.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index 61a3e3feb5..42130df1e2 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -210,6 +210,12 @@ int main(int argc, char **argv)
qtest_add_func("ast1030/hace/sha384_accum", test_sha384_accum_ast1030);
qtest_add_func("ast1030/hace/sha256_accum", test_sha256_accum_ast1030);
+ /* The AST1030 reuses the AST2600 crypto engine (scatter-gather, CTR). */
+ aspeed_add_crypto_tests("ast1030", "-machine ast1030-evb", 0x7e6d0000,
+ 0x00000000,
+ CRYPT_MODE_ECB | CRYPT_MODE_CBC | CRYPT_MODE_CTR,
+ true);
+
qtest_add_func("ast2600/hace/addresses", test_addresses_ast2600);
qtest_add_func("ast2600/hace/sha512", test_sha512_ast2600);
qtest_add_func("ast2600/hace/sha384", test_sha384_ast2600);
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 07/16] crypto/cipher: Add GCM to QCryptoCipherMode
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (5 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 06/16] tests/qtest/aspeed-hace: Test the crypto command on the AST1030 Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 08/16] crypto/cipher: Add setaad/gettag for AEAD modes Jamin Lin
` (8 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Introduce the GCM cipher mode so authenticated encryption can be built
on top of the existing qcrypto_cipher API. GCM is an IV-based mode, so
register it in mode_need_iv. No backend advertises it yet, so it stays
unsupported until a backend and the AAD/tag helpers are added in the
following patches.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
---
qapi/crypto.json | 4 +++-
crypto/cipher.c | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/qapi/crypto.json b/qapi/crypto.json
index 2b55befef9..6e3a98ff68 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -121,10 +121,12 @@
#
# @ctr: Counter (Since 2.8)
#
+# @gcm: Galois/Counter Mode (Since 11.2)
+#
# Since: 2.6
##
{ 'enum': 'QCryptoCipherMode',
- 'data': ['ecb', 'cbc', 'xts', 'ctr']}
+ 'data': ['ecb', 'cbc', 'xts', 'ctr', 'gcm']}
##
# @QCryptoIVGenAlgo:
diff --git a/crypto/cipher.c b/crypto/cipher.c
index 229710f76b..64c2339d17 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -66,6 +66,7 @@ static const bool mode_need_iv[QCRYPTO_CIPHER_MODE__MAX] = {
[QCRYPTO_CIPHER_MODE_CBC] = true,
[QCRYPTO_CIPHER_MODE_XTS] = true,
[QCRYPTO_CIPHER_MODE_CTR] = true,
+ [QCRYPTO_CIPHER_MODE_GCM] = true,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 08/16] crypto/cipher: Add setaad/gettag for AEAD modes
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (6 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 07/16] crypto/cipher: Add GCM to QCryptoCipherMode Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 09/16] crypto/cipher-gcrypt: Implement AES-GCM Jamin Lin
` (7 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
AEAD modes such as GCM authenticate optional associated data (AAD) and
produce an authentication tag, which the block-cipher encrypt/decrypt
interface cannot express. Add qcrypto_cipher_setaad() and
qcrypto_cipher_gettag() plus the matching backend driver hooks. The
generic front-end reports an error when the selected mode's driver does
not implement them, so calling them on a non-AEAD mode fails cleanly.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
crypto/cipherpriv.h | 8 ++++++++
include/crypto/cipher.h | 36 ++++++++++++++++++++++++++++++++++++
crypto/cipher.c | 31 +++++++++++++++++++++++++++++++
3 files changed, 75 insertions(+)
diff --git a/crypto/cipherpriv.h b/crypto/cipherpriv.h
index 64737ce961..c4f995f369 100644
--- a/crypto/cipherpriv.h
+++ b/crypto/cipherpriv.h
@@ -34,6 +34,14 @@ struct QCryptoCipherDriver {
const uint8_t *iv, size_t niv,
Error **errp);
+ int (*cipher_setaad)(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp);
+
+ int (*cipher_gettag)(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len,
+ Error **errp);
+
void (*cipher_free)(QCryptoCipher *cipher);
};
diff --git a/include/crypto/cipher.h b/include/crypto/cipher.h
index 92939310ef..2e361411b9 100644
--- a/include/crypto/cipher.h
+++ b/include/crypto/cipher.h
@@ -235,4 +235,40 @@ int qcrypto_cipher_setiv(QCryptoCipher *cipher,
const uint8_t *iv, size_t niv,
Error **errp);
+/**
+ * qcrypto_cipher_setaad:
+ * @cipher: the cipher object
+ * @aad: the associated data to authenticate
+ * @len: the length of @aad
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * For AEAD modes such as GCM, feed the associated data (AAD) that is
+ * authenticated but not encrypted. It must be called after
+ * qcrypto_cipher_setiv() and before the first encrypt/decrypt call. It is
+ * an error to call this on a mode that is not an AEAD mode.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int qcrypto_cipher_setaad(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp);
+
+/**
+ * qcrypto_cipher_gettag:
+ * @cipher: the cipher object
+ * @tag: buffer to receive the authentication tag
+ * @len: the length of @tag
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * For AEAD modes such as GCM, read back the authentication tag computed
+ * over the associated data and the message. It must be called after the
+ * encrypt/decrypt operation. It is an error to call this on a mode that is
+ * not an AEAD mode.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int qcrypto_cipher_gettag(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len,
+ Error **errp);
+
#endif /* QCRYPTO_CIPHER_H */
diff --git a/crypto/cipher.c b/crypto/cipher.c
index 64c2339d17..1dc912b217 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -205,6 +205,37 @@ int qcrypto_cipher_setiv(QCryptoCipher *cipher,
}
+int qcrypto_cipher_setaad(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp)
+{
+ const QCryptoCipherDriver *drv = cipher->driver;
+
+ if (!drv->cipher_setaad) {
+ error_setg(errp, "The cipher mode does not support associated data");
+ return -1;
+ }
+
+ return drv->cipher_setaad(cipher, aad, len, errp);
+}
+
+
+int qcrypto_cipher_gettag(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len,
+ Error **errp)
+{
+ const QCryptoCipherDriver *drv = cipher->driver;
+
+ if (!drv->cipher_gettag) {
+ error_setg(errp,
+ "The cipher mode does not produce an authentication tag");
+ return -1;
+ }
+
+ return drv->cipher_gettag(cipher, tag, len, errp);
+}
+
+
void qcrypto_cipher_free(QCryptoCipher *cipher)
{
if (cipher) {
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 09/16] crypto/cipher-gcrypt: Implement AES-GCM
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (7 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 08/16] crypto/cipher: Add setaad/gettag for AEAD modes Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 10/16] crypto/cipher-nettle: " Jamin Lin
` (6 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Map QCRYPTO_CIPHER_MODE_GCM to GCRY_CIPHER_MODE_GCM and advertise it in
qcrypto_cipher_supports() for 128-bit block ciphers. Add a GCM driver
whose setiv accepts the (typically 96-bit) nonce, whose encrypt/decrypt
do not require block-aligned lengths, and which implements setaad via
gcry_cipher_authenticate() and gettag via gcry_cipher_gettag().
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/cipher-gcrypt.c.inc | 101 +++++++++++++++++++++++++++++++++++++
1 file changed, 101 insertions(+)
diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc
index 12eb9ddb5a..fce09a3c77 100644
--- a/crypto/cipher-gcrypt.c.inc
+++ b/crypto/cipher-gcrypt.c.inc
@@ -65,6 +65,8 @@ static int qcrypto_cipher_mode_to_gcry_mode(QCryptoCipherMode mode)
return GCRY_CIPHER_MODE_CBC;
case QCRYPTO_CIPHER_MODE_CTR:
return GCRY_CIPHER_MODE_CTR;
+ case QCRYPTO_CIPHER_MODE_GCM:
+ return GCRY_CIPHER_MODE_GCM;
default:
return GCRY_CIPHER_MODE_NONE;
}
@@ -104,6 +106,10 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
case QCRYPTO_CIPHER_MODE_XTS:
case QCRYPTO_CIPHER_MODE_CTR:
return true;
+ case QCRYPTO_CIPHER_MODE_GCM:
+ /* GCM requires a 128-bit block cipher. */
+ return gcry_cipher_get_algo_blklen(
+ qcrypto_cipher_alg_to_gcry_alg(alg)) == 16;
default:
return false;
}
@@ -228,6 +234,99 @@ static const struct QCryptoCipherDriver qcrypto_gcrypt_ctr_driver = {
.cipher_free = qcrypto_gcrypt_ctx_free,
};
+/*
+ * GCM is an AEAD stream mode: the IV/nonce need not match the block size,
+ * the message length need not be a multiple of the block size, associated
+ * data is fed with gcry_cipher_authenticate() and the authentication tag is
+ * read back with gcry_cipher_gettag().
+ */
+static int qcrypto_gcrypt_gcm_setiv(QCryptoCipher *cipher,
+ const uint8_t *iv, size_t niv,
+ Error **errp)
+{
+ QCryptoCipherGcrypt *ctx = container_of(cipher, QCryptoCipherGcrypt, base);
+ gcry_error_t err;
+
+ gcry_cipher_reset(ctx->handle);
+ err = gcry_cipher_setiv(ctx->handle, iv, niv);
+ if (err != 0) {
+ error_setg(errp, "Cannot set IV: %s", gcry_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int qcrypto_gcrypt_gcm_setaad(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp)
+{
+ QCryptoCipherGcrypt *ctx = container_of(cipher, QCryptoCipherGcrypt, base);
+ gcry_error_t err;
+
+ err = gcry_cipher_authenticate(ctx->handle, aad, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot set AAD: %s", gcry_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int qcrypto_gcrypt_gcm_encrypt(QCryptoCipher *cipher, const void *in,
+ void *out, size_t len, Error **errp)
+{
+ QCryptoCipherGcrypt *ctx = container_of(cipher, QCryptoCipherGcrypt, base);
+ gcry_error_t err;
+
+ err = gcry_cipher_encrypt(ctx->handle, out, len, in, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot encrypt data: %s", gcry_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int qcrypto_gcrypt_gcm_decrypt(QCryptoCipher *cipher, const void *in,
+ void *out, size_t len, Error **errp)
+{
+ QCryptoCipherGcrypt *ctx = container_of(cipher, QCryptoCipherGcrypt, base);
+ gcry_error_t err;
+
+ err = gcry_cipher_decrypt(ctx->handle, out, len, in, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot decrypt data: %s", gcry_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int qcrypto_gcrypt_gcm_gettag(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len, Error **errp)
+{
+ QCryptoCipherGcrypt *ctx = container_of(cipher, QCryptoCipherGcrypt, base);
+ gcry_error_t err;
+
+ err = gcry_cipher_gettag(ctx->handle, tag, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot get tag: %s", gcry_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static const struct QCryptoCipherDriver qcrypto_gcrypt_gcm_driver = {
+ .cipher_encrypt = qcrypto_gcrypt_gcm_encrypt,
+ .cipher_decrypt = qcrypto_gcrypt_gcm_decrypt,
+ .cipher_setiv = qcrypto_gcrypt_gcm_setiv,
+ .cipher_setaad = qcrypto_gcrypt_gcm_setaad,
+ .cipher_gettag = qcrypto_gcrypt_gcm_gettag,
+ .cipher_free = qcrypto_gcrypt_ctx_free,
+};
+
static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
QCryptoCipherMode mode,
const uint8_t *key,
@@ -259,6 +358,8 @@ static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
if (mode == QCRYPTO_CIPHER_MODE_CTR) {
drv = &qcrypto_gcrypt_ctr_driver;
+ } else if (mode == QCRYPTO_CIPHER_MODE_GCM) {
+ drv = &qcrypto_gcrypt_gcm_driver;
} else {
drv = &qcrypto_gcrypt_driver;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 10/16] crypto/cipher-nettle: Implement AES-GCM
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (8 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 09/16] crypto/cipher-gcrypt: Implement AES-GCM Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 11/16] crypto/cipher-gnutls: " Jamin Lin
` (5 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Add the AES-GCM AEAD mode to the nettle backend so it is available when
QEMU is built with nettle instead of gcrypt. GCM is driven through
nettle's generic gcm_* interface, using the AES encrypt function for both
directions: gcm_set_iv() sets the (typically 96-bit) nonce, gcm_update()
feeds the associated data, gcm_encrypt()/gcm_decrypt() need not be block
aligned, and gcm_digest() produces the authentication tag.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/cipher-nettle.c.inc | 128 +++++++++++++++++++++++++++++++++++++
1 file changed, 128 insertions(+)
diff --git a/crypto/cipher-nettle.c.inc b/crypto/cipher-nettle.c.inc
index 1afdc391b4..d4847f0efe 100644
--- a/crypto/cipher-nettle.c.inc
+++ b/crypto/cipher-nettle.c.inc
@@ -27,6 +27,7 @@
#include <nettle/twofish.h>
#include <nettle/ctr.h>
#include <nettle/xts.h>
+#include <nettle/gcm.h>
#ifdef CONFIG_CRYPTO_SM4
#include <nettle/sm4.h>
#endif
@@ -410,6 +411,125 @@ DEFINE_ECB(qcrypto_nettle_sm4,
sm4_encrypt_native, sm4_decrypt_native)
#endif
+/*
+ * GCM is an AEAD mode built on AES (128-bit block only). Drive it through the
+ * generic gcm_* interface, using the block cipher's encrypt function for both
+ * directions; associated data is fed with gcm_update() and the authentication
+ * tag is produced by gcm_digest().
+ */
+typedef struct QCryptoNettleAESGCM {
+ QCryptoCipher base;
+ struct gcm_key gcm_key;
+ struct gcm_ctx gcm_ctx;
+ union {
+ struct aes128_ctx aes128;
+ struct aes192_ctx aes192;
+ struct aes256_ctx aes256;
+ } cipher;
+ nettle_cipher_func *encrypt;
+} QCryptoNettleAESGCM;
+
+static int qcrypto_nettle_aes_gcm_setiv(QCryptoCipher *cipher,
+ const uint8_t *iv, size_t niv,
+ Error **errp)
+{
+ QCryptoNettleAESGCM *ctx = container_of(cipher, QCryptoNettleAESGCM, base);
+
+ gcm_set_iv(&ctx->gcm_ctx, &ctx->gcm_key, niv, iv);
+ return 0;
+}
+
+static int qcrypto_nettle_aes_gcm_setaad(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp)
+{
+ QCryptoNettleAESGCM *ctx = container_of(cipher, QCryptoNettleAESGCM, base);
+
+ gcm_update(&ctx->gcm_ctx, &ctx->gcm_key, len, aad);
+ return 0;
+}
+
+static int qcrypto_nettle_aes_gcm_encrypt(QCryptoCipher *cipher,
+ const void *in, void *out,
+ size_t len, Error **errp)
+{
+ QCryptoNettleAESGCM *ctx = container_of(cipher, QCryptoNettleAESGCM, base);
+
+ gcm_encrypt(&ctx->gcm_ctx, &ctx->gcm_key, &ctx->cipher, ctx->encrypt,
+ len, out, in);
+ return 0;
+}
+
+static int qcrypto_nettle_aes_gcm_decrypt(QCryptoCipher *cipher,
+ const void *in, void *out,
+ size_t len, Error **errp)
+{
+ QCryptoNettleAESGCM *ctx = container_of(cipher, QCryptoNettleAESGCM, base);
+
+ gcm_decrypt(&ctx->gcm_ctx, &ctx->gcm_key, &ctx->cipher, ctx->encrypt,
+ len, out, in);
+ return 0;
+}
+
+static int qcrypto_nettle_aes_gcm_gettag(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len,
+ Error **errp)
+{
+ QCryptoNettleAESGCM *ctx = container_of(cipher, QCryptoNettleAESGCM, base);
+
+ gcm_digest(&ctx->gcm_ctx, &ctx->gcm_key, &ctx->cipher, ctx->encrypt,
+ len, tag);
+ return 0;
+}
+
+static const struct QCryptoCipherDriver qcrypto_nettle_aes_gcm_driver = {
+ .cipher_encrypt = qcrypto_nettle_aes_gcm_encrypt,
+ .cipher_decrypt = qcrypto_nettle_aes_gcm_decrypt,
+ .cipher_setiv = qcrypto_nettle_aes_gcm_setiv,
+ .cipher_setaad = qcrypto_nettle_aes_gcm_setaad,
+ .cipher_gettag = qcrypto_nettle_aes_gcm_gettag,
+ .cipher_free = qcrypto_cipher_ctx_free,
+};
+
+static QCryptoCipher *qcrypto_nettle_aes_gcm_ctx_new(QCryptoCipherAlgo alg,
+ const uint8_t *key,
+ size_t nkey,
+ Error **errp)
+{
+ QCryptoNettleAESGCM *ctx;
+
+ if (!qcrypto_cipher_validate_key_length(alg, QCRYPTO_CIPHER_MODE_GCM,
+ nkey, errp)) {
+ return NULL;
+ }
+
+ ctx = g_new0(QCryptoNettleAESGCM, 1);
+ ctx->base.driver = &qcrypto_nettle_aes_gcm_driver;
+
+ switch (alg) {
+ case QCRYPTO_CIPHER_ALGO_AES_128:
+ aes128_set_encrypt_key(&ctx->cipher.aes128, key);
+ ctx->encrypt = aes128_encrypt_native;
+ break;
+ case QCRYPTO_CIPHER_ALGO_AES_192:
+ aes192_set_encrypt_key(&ctx->cipher.aes192, key);
+ ctx->encrypt = aes192_encrypt_native;
+ break;
+ case QCRYPTO_CIPHER_ALGO_AES_256:
+ aes256_set_encrypt_key(&ctx->cipher.aes256, key);
+ ctx->encrypt = aes256_encrypt_native;
+ break;
+ default:
+ error_setg(errp, "Unsupported cipher algorithm %s with GCM mode",
+ QCryptoCipherAlgo_str(alg));
+ g_free(ctx);
+ return NULL;
+ }
+
+ gcm_set_key(&ctx->gcm_key, &ctx->cipher, ctx->encrypt);
+ return &ctx->base;
+}
+
bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
QCryptoCipherMode mode)
{
@@ -440,6 +560,10 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
case QCRYPTO_CIPHER_MODE_XTS:
case QCRYPTO_CIPHER_MODE_CTR:
return true;
+ case QCRYPTO_CIPHER_MODE_GCM:
+ return alg == QCRYPTO_CIPHER_ALGO_AES_128 ||
+ alg == QCRYPTO_CIPHER_ALGO_AES_192 ||
+ alg == QCRYPTO_CIPHER_ALGO_AES_256;
default:
return false;
}
@@ -451,6 +575,10 @@ static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
size_t nkey,
Error **errp)
{
+ if (mode == QCRYPTO_CIPHER_MODE_GCM) {
+ return qcrypto_nettle_aes_gcm_ctx_new(alg, key, nkey, errp);
+ }
+
switch (mode) {
case QCRYPTO_CIPHER_MODE_ECB:
case QCRYPTO_CIPHER_MODE_CBC:
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 11/16] crypto/cipher-gnutls: Implement AES-GCM
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (9 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 10/16] crypto/cipher-nettle: " Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 12/16] tests/unit/test-crypto-cipher: Test AES-GCM mode Jamin Lin
` (4 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Add the AES-GCM AEAD mode to the gnutls backend so it is available when
QEMU is built with gnutls (neither gcrypt nor nettle). GCM uses the
incremental gnutls_cipher_* API with the GNUTLS_CIPHER_AES_*_GCM
algorithms: gnutls_cipher_set_iv() sets the nonce, gnutls_cipher_add_auth()
feeds the associated data, gnutls_cipher_encrypt2()/decrypt2() process the
message, and gnutls_cipher_tag() reads back the authentication tag.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/cipher-gnutls.c.inc | 154 +++++++++++++++++++++++++++++++++++++
1 file changed, 154 insertions(+)
diff --git a/crypto/cipher-gnutls.c.inc b/crypto/cipher-gnutls.c.inc
index a8263fff6d..963b328fa1 100644
--- a/crypto/cipher-gnutls.c.inc
+++ b/crypto/cipher-gnutls.c.inc
@@ -48,6 +48,15 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
default:
return false;
}
+ case QCRYPTO_CIPHER_MODE_GCM:
+ switch (alg) {
+ case QCRYPTO_CIPHER_ALGO_AES_128:
+ case QCRYPTO_CIPHER_ALGO_AES_192:
+ case QCRYPTO_CIPHER_ALGO_AES_256:
+ return true;
+ default:
+ return false;
+ }
default:
return false;
}
@@ -223,6 +232,147 @@ static struct QCryptoCipherDriver gnutls_driver = {
.cipher_free = qcrypto_gnutls_cipher_free,
};
+/*
+ * GCM is an AEAD stream mode: the nonce need not match the block size, the
+ * message length need not be a multiple of the block size, associated data is
+ * fed with gnutls_cipher_add_auth() and the authentication tag is read back
+ * with gnutls_cipher_tag().
+ */
+static int
+qcrypto_gnutls_cipher_encrypt_gcm(QCryptoCipher *cipher,
+ const void *in, void *out,
+ size_t len, Error **errp)
+{
+ QCryptoCipherGnutls *ctx = container_of(cipher, QCryptoCipherGnutls, base);
+ int err;
+
+ err = gnutls_cipher_encrypt2(ctx->handle, in, len, out, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot encrypt data: %s", gnutls_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int
+qcrypto_gnutls_cipher_decrypt_gcm(QCryptoCipher *cipher,
+ const void *in, void *out,
+ size_t len, Error **errp)
+{
+ QCryptoCipherGnutls *ctx = container_of(cipher, QCryptoCipherGnutls, base);
+ int err;
+
+ err = gnutls_cipher_decrypt2(ctx->handle, in, len, out, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot decrypt data: %s", gnutls_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int
+qcrypto_gnutls_cipher_setiv_gcm(QCryptoCipher *cipher,
+ const uint8_t *iv, size_t niv,
+ Error **errp)
+{
+ QCryptoCipherGnutls *ctx = container_of(cipher, QCryptoCipherGnutls, base);
+
+ gnutls_cipher_set_iv(ctx->handle, (void *)iv, niv);
+
+ return 0;
+}
+
+static int
+qcrypto_gnutls_cipher_setaad_gcm(QCryptoCipher *cipher,
+ const uint8_t *aad, size_t len,
+ Error **errp)
+{
+ QCryptoCipherGnutls *ctx = container_of(cipher, QCryptoCipherGnutls, base);
+ int err;
+
+ err = gnutls_cipher_add_auth(ctx->handle, aad, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot add associated data: %s",
+ gnutls_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static int
+qcrypto_gnutls_cipher_gettag_gcm(QCryptoCipher *cipher,
+ uint8_t *tag, size_t len,
+ Error **errp)
+{
+ QCryptoCipherGnutls *ctx = container_of(cipher, QCryptoCipherGnutls, base);
+ int err;
+
+ err = gnutls_cipher_tag(ctx->handle, tag, len);
+ if (err != 0) {
+ error_setg(errp, "Cannot get authentication tag: %s",
+ gnutls_strerror(err));
+ return -1;
+ }
+
+ return 0;
+}
+
+static struct QCryptoCipherDriver gnutls_gcm_driver = {
+ .cipher_encrypt = qcrypto_gnutls_cipher_encrypt_gcm,
+ .cipher_decrypt = qcrypto_gnutls_cipher_decrypt_gcm,
+ .cipher_setiv = qcrypto_gnutls_cipher_setiv_gcm,
+ .cipher_setaad = qcrypto_gnutls_cipher_setaad_gcm,
+ .cipher_gettag = qcrypto_gnutls_cipher_gettag_gcm,
+ .cipher_free = qcrypto_gnutls_cipher_free,
+};
+
+static QCryptoCipher *
+qcrypto_gnutls_aes_gcm_ctx_new(QCryptoCipherAlgo alg, const uint8_t *key,
+ size_t nkey, Error **errp)
+{
+ gnutls_datum_t gkey = { (unsigned char *)key, nkey };
+ gnutls_cipher_algorithm_t galg = GNUTLS_CIPHER_UNKNOWN;
+ QCryptoCipherGnutls *ctx;
+ int err;
+
+ switch (alg) {
+ case QCRYPTO_CIPHER_ALGO_AES_128:
+ galg = GNUTLS_CIPHER_AES_128_GCM;
+ break;
+ case QCRYPTO_CIPHER_ALGO_AES_192:
+ galg = GNUTLS_CIPHER_AES_192_GCM;
+ break;
+ case QCRYPTO_CIPHER_ALGO_AES_256:
+ galg = GNUTLS_CIPHER_AES_256_GCM;
+ break;
+ default:
+ error_setg(errp, "Unsupported cipher algorithm %s with GCM mode",
+ QCryptoCipherAlgo_str(alg));
+ return NULL;
+ }
+
+ if (!qcrypto_cipher_validate_key_length(alg, QCRYPTO_CIPHER_MODE_GCM,
+ nkey, errp)) {
+ return NULL;
+ }
+
+ ctx = g_new0(QCryptoCipherGnutls, 1);
+ ctx->base.driver = &gnutls_gcm_driver;
+ ctx->blocksize = 16;
+
+ err = gnutls_cipher_init(&ctx->handle, galg, &gkey, NULL);
+ if (err != 0) {
+ error_setg(errp, "Cannot initialize cipher: %s", gnutls_strerror(err));
+ g_free(ctx);
+ return NULL;
+ }
+
+ return &ctx->base;
+}
+
static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
QCryptoCipherMode mode,
const uint8_t *key,
@@ -234,6 +384,10 @@ static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
gnutls_cipher_algorithm_t galg = GNUTLS_CIPHER_UNKNOWN;
int err;
+ if (mode == QCRYPTO_CIPHER_MODE_GCM) {
+ return qcrypto_gnutls_aes_gcm_ctx_new(alg, key, nkey, errp);
+ }
+
switch (mode) {
case QCRYPTO_CIPHER_MODE_XTS:
switch (alg) {
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 12/16] tests/unit/test-crypto-cipher: Test AES-GCM mode
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (10 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 11/16] crypto/cipher-gnutls: " Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 13/16] hw/misc/aspeed_hace: Support 64-bit DMA for the crypto command Jamin Lin
` (3 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Exercise the new GCM mode and the setaad/gettag helpers with the
canonical AES-GCM test vectors from the GCM specification (McGrew &
Viega, also NIST SP 800-38D): AES-128 and AES-256, with and without
associated data. Each vector is run through encrypt (checking the
ciphertext and the generated tag) and decrypt (checking the recovered
plaintext and the recomputed tag).
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
tests/unit/test-crypto-cipher.c | 240 ++++++++++++++++++++++++++++++++
1 file changed, 240 insertions(+)
diff --git a/tests/unit/test-crypto-cipher.c b/tests/unit/test-crypto-cipher.c
index 1331d558cf..420c826df9 100644
--- a/tests/unit/test-crypto-cipher.c
+++ b/tests/unit/test-crypto-cipher.c
@@ -810,6 +810,230 @@ static void test_cipher_short_plaintext(void)
qcrypto_cipher_free(cipher);
}
+typedef struct QCryptoCipherGcmTestData QCryptoCipherGcmTestData;
+struct QCryptoCipherGcmTestData {
+ const char *path;
+ QCryptoCipherAlgo alg;
+ const char *key;
+ const char *iv;
+ /* associated data, or NULL for none */
+ const char *aad;
+ const char *plaintext;
+ const char *ciphertext;
+ const char *tag;
+};
+
+/*
+ * AES-GCM test vectors from "The Galois/Counter Mode of Operation (GCM)"
+ * (McGrew & Viega, also NIST SP 800-38D), with a 96-bit IV and a 128-bit
+ * tag. Each entry's "Test case N" label is the numbered test case from that
+ * document (Appendix B / the GCM specification's test vectors).
+ */
+static QCryptoCipherGcmTestData gcm_test_data[] = {
+ {
+ /* Test case 2 */
+ .path = "/crypto/cipher/aes-gcm-128-2",
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .key = "00000000000000000000000000000000",
+ .iv = "000000000000000000000000",
+ .plaintext = "00000000000000000000000000000000",
+ .ciphertext = "0388dace60b6a392f328c2b971b2fe78",
+ .tag = "ab6e47d42cec13bdf53a67b21257bddf",
+ },
+ {
+ /* Test case 3 (no AAD) */
+ .path = "/crypto/cipher/aes-gcm-128-3",
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .key = "feffe9928665731c6d6a8f9467308308",
+ .iv = "cafebabefacedbaddecaf888",
+ .plaintext =
+ "d9313225f88406e5a55909c5aff5269a"
+ "86a7a9531534f7da2e4c303d8a318a72"
+ "1c3c0c95956809532fcf0e2449a6b525"
+ "b16aedf5aa0de657ba637b391aafd255",
+ .ciphertext =
+ "42831ec2217774244b7221b784d0d49c"
+ "e3aa212f2c02a4e035c17e2329aca12e"
+ "21d514b25466931c7d8f6a5aac84aa05"
+ "1ba30b396a0aac973d58e091473f5985",
+ .tag = "4d5c2af327cd64a62cf35abd2ba6fab4",
+ },
+ {
+ /* Test case 4 (with AAD) */
+ .path = "/crypto/cipher/aes-gcm-128-4",
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .key = "feffe9928665731c6d6a8f9467308308",
+ .iv = "cafebabefacedbaddecaf888",
+ .aad = "feedfacedeadbeeffeedfacedeadbeefabaddad2",
+ .plaintext =
+ "d9313225f88406e5a55909c5aff5269a"
+ "86a7a9531534f7da2e4c303d8a318a72"
+ "1c3c0c95956809532fcf0e2449a6b525"
+ "b16aedf5aa0de657ba637b39",
+ .ciphertext =
+ "42831ec2217774244b7221b784d0d49c"
+ "e3aa212f2c02a4e035c17e2329aca12e"
+ "21d514b25466931c7d8f6a5aac84aa05"
+ "1ba30b396a0aac973d58e091",
+ .tag = "5bc94fbc3221a5db94fae95ae7121a47",
+ },
+ {
+ /* Test case 15 (AES-256, no AAD) */
+ .path = "/crypto/cipher/aes-gcm-256-15",
+ .alg = QCRYPTO_CIPHER_ALGO_AES_256,
+ .key =
+ "feffe9928665731c6d6a8f9467308308"
+ "feffe9928665731c6d6a8f9467308308",
+ .iv = "cafebabefacedbaddecaf888",
+ .plaintext =
+ "d9313225f88406e5a55909c5aff5269a"
+ "86a7a9531534f7da2e4c303d8a318a72"
+ "1c3c0c95956809532fcf0e2449a6b525"
+ "b16aedf5aa0de657ba637b391aafd255",
+ .ciphertext =
+ "522dc1f099567d07f47f37a32a84427d"
+ "643a8cdcbfe5c0c97598a2bd2555d1aa"
+ "8cb08e48590dbb3da7b08b1056828838"
+ "c5f61e6393ba7a0abcc9f662898015ad",
+ .tag = "b094dac5d93471bdec1a502270e3cc6c",
+ },
+ {
+ /* Test case 16 (AES-256, with AAD) */
+ .path = "/crypto/cipher/aes-gcm-256-16",
+ .alg = QCRYPTO_CIPHER_ALGO_AES_256,
+ .key =
+ "feffe9928665731c6d6a8f9467308308"
+ "feffe9928665731c6d6a8f9467308308",
+ .iv = "cafebabefacedbaddecaf888",
+ .aad = "feedfacedeadbeeffeedfacedeadbeefabaddad2",
+ .plaintext =
+ "d9313225f88406e5a55909c5aff5269a"
+ "86a7a9531534f7da2e4c303d8a318a72"
+ "1c3c0c95956809532fcf0e2449a6b525"
+ "b16aedf5aa0de657ba637b39",
+ .ciphertext =
+ "522dc1f099567d07f47f37a32a84427d"
+ "643a8cdcbfe5c0c97598a2bd2555d1aa"
+ "8cb08e48590dbb3da7b08b1056828838"
+ "c5f61e6393ba7a0abcc9f662",
+ .tag = "76fc6ece0f4e1768cddf8853bb2d551b",
+ },
+};
+
+static void test_cipher_gcm(const void *opaque)
+{
+ const QCryptoCipherGcmTestData *data = opaque;
+ g_autofree uint8_t *key = NULL;
+ g_autofree uint8_t *iv = NULL;
+ g_autofree uint8_t *aad = NULL;
+ g_autofree uint8_t *ptext = NULL;
+ g_autofree uint8_t *ctext = NULL;
+ g_autofree uint8_t *tagexp = NULL;
+ g_autofree uint8_t *out = NULL;
+ uint8_t tag[16];
+ size_t nkey;
+ size_t niv;
+ size_t naad = 0;
+ size_t nptext;
+ size_t nctext;
+ size_t ntag;
+ QCryptoCipher *cipher;
+
+ nkey = unhex_string(data->key, &key);
+ niv = unhex_string(data->iv, &iv);
+ nptext = unhex_string(data->plaintext, &ptext);
+ nctext = unhex_string(data->ciphertext, &ctext);
+ ntag = unhex_string(data->tag, &tagexp);
+ if (data->aad) {
+ naad = unhex_string(data->aad, &aad);
+ }
+
+ g_assert_cmpint(nptext, ==, nctext);
+ g_assert_cmpint(ntag, ==, sizeof(tag));
+ out = g_new0(uint8_t, nptext);
+
+ /* Encrypt: plaintext -> ciphertext, then read back the tag. */
+ cipher = qcrypto_cipher_new(data->alg, QCRYPTO_CIPHER_MODE_GCM,
+ key, nkey, &error_abort);
+ g_assert(cipher != NULL);
+ g_assert(qcrypto_cipher_setiv(cipher, iv, niv, &error_abort) == 0);
+ if (naad) {
+ g_assert(qcrypto_cipher_setaad(cipher, aad, naad, &error_abort) == 0);
+ }
+ g_assert(qcrypto_cipher_encrypt(cipher, ptext, out, nptext,
+ &error_abort) == 0);
+ g_assert_cmpmem(out, nptext, ctext, nctext);
+ g_assert(qcrypto_cipher_gettag(cipher, tag, sizeof(tag),
+ &error_abort) == 0);
+ g_assert_cmpmem(tag, sizeof(tag), tagexp, ntag);
+ qcrypto_cipher_free(cipher);
+
+ /* Decrypt: ciphertext -> plaintext, recomputed tag must match. */
+ memset(out, 0, nptext);
+ cipher = qcrypto_cipher_new(data->alg, QCRYPTO_CIPHER_MODE_GCM,
+ key, nkey, &error_abort);
+ g_assert(cipher != NULL);
+ g_assert(qcrypto_cipher_setiv(cipher, iv, niv, &error_abort) == 0);
+ if (naad) {
+ g_assert(qcrypto_cipher_setaad(cipher, aad, naad, &error_abort) == 0);
+ }
+ g_assert(qcrypto_cipher_decrypt(cipher, ctext, out, nctext,
+ &error_abort) == 0);
+ g_assert_cmpmem(out, nctext, ptext, nptext);
+ g_assert(qcrypto_cipher_gettag(cipher, tag, sizeof(tag),
+ &error_abort) == 0);
+ g_assert_cmpmem(tag, sizeof(tag), tagexp, ntag);
+ qcrypto_cipher_free(cipher);
+}
+
+/*
+ * Corrupt one ciphertext byte and confirm the recomputed GCM tag no longer
+ * matches: the authentication tag must detect tampering.
+ */
+static void test_cipher_gcm_tamper(const void *opaque)
+{
+ const QCryptoCipherGcmTestData *data = opaque;
+ g_autofree uint8_t *key = NULL;
+ g_autofree uint8_t *iv = NULL;
+ g_autofree uint8_t *aad = NULL;
+ g_autofree uint8_t *ctext = NULL;
+ g_autofree uint8_t *tagexp = NULL;
+ g_autofree uint8_t *out = NULL;
+ uint8_t tag[16];
+ size_t nkey;
+ size_t niv;
+ size_t naad = 0;
+ size_t nctext;
+ size_t ntag;
+ QCryptoCipher *cipher;
+
+ nkey = unhex_string(data->key, &key);
+ niv = unhex_string(data->iv, &iv);
+ nctext = unhex_string(data->ciphertext, &ctext);
+ ntag = unhex_string(data->tag, &tagexp);
+ if (data->aad) {
+ naad = unhex_string(data->aad, &aad);
+ }
+ out = g_new0(uint8_t, nctext);
+
+ /* Flip one ciphertext bit before decrypting. */
+ ctext[0] ^= 0x01;
+
+ cipher = qcrypto_cipher_new(data->alg, QCRYPTO_CIPHER_MODE_GCM,
+ key, nkey, &error_abort);
+ g_assert(cipher != NULL);
+ g_assert(qcrypto_cipher_setiv(cipher, iv, niv, &error_abort) == 0);
+ if (naad) {
+ g_assert(qcrypto_cipher_setaad(cipher, aad, naad, &error_abort) == 0);
+ }
+ g_assert(qcrypto_cipher_decrypt(cipher, ctext, out, nctext,
+ &error_abort) == 0);
+ g_assert(qcrypto_cipher_gettag(cipher, tag, sizeof(tag),
+ &error_abort) == 0);
+ g_assert(memcmp(tag, tagexp, ntag) != 0);
+ qcrypto_cipher_free(cipher);
+}
+
int main(int argc, char **argv)
{
size_t i;
@@ -828,6 +1052,22 @@ int main(int argc, char **argv)
}
}
+ for (i = 0; i < G_N_ELEMENTS(gcm_test_data); i++) {
+ if (qcrypto_cipher_supports(gcm_test_data[i].alg,
+ QCRYPTO_CIPHER_MODE_GCM)) {
+ g_autofree char *tamper = g_strdup_printf("%s/tamper",
+ gcm_test_data[i].path);
+
+ g_test_add_data_func(gcm_test_data[i].path, &gcm_test_data[i],
+ test_cipher_gcm);
+ g_test_add_data_func(tamper, &gcm_test_data[i],
+ test_cipher_gcm_tamper);
+ } else {
+ g_printerr("# skip unsupported %s:gcm\n",
+ QCryptoCipherAlgo_str(gcm_test_data[i].alg));
+ }
+ }
+
if (qcrypto_cipher_supports(QCRYPTO_CIPHER_ALGO_AES_256,
QCRYPTO_CIPHER_MODE_CBC)) {
g_test_add_func("/crypto/cipher/null-iv",
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 13/16] hw/misc/aspeed_hace: Support 64-bit DMA for the crypto command
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (11 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 12/16] tests/unit/test-crypto-cipher: Test AES-GCM mode Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode " Jamin Lin
` (2 subsequent siblings)
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
The AST2700 crypto engine addresses DRAM with 64 bits, supplying the high
half of the source, destination and context addresses through HACE80,
HACE84 and HACE88. Add those registers and a crypt_get_addr() helper that
combines the low and high halves when the SoC has 64-bit DMA, mirroring
the hash engine. SoCs without 64-bit DMA (AST2500/AST2600/AST1030) ignore
the high registers, so their behaviour is unchanged.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_hace.c | 33 ++++++++++++++++++++++++++++++---
1 file changed, 30 insertions(+), 3 deletions(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index d84f7f9cec..0a6e2fa829 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -57,6 +57,11 @@
#define CRYPT_CTX_KEY_OFFSET 0x10
#define CRYPT_CTX_SIZE 0x30
+/* AST2700 64-bit DMA high address registers for the crypto command */
+#define R_CRYPT_SRC_HI (0x80 / 4)
+#define R_CRYPT_DEST_HI (0x84 / 4)
+#define R_CRYPT_CONTEXT_HI (0x88 / 4)
+
#define R_STATUS (0x1c / 4)
#define HASH_IRQ BIT(9)
#define CRYPT_IRQ BIT(12)
@@ -670,6 +675,19 @@ static void crypt_be_add(uint8_t *ctr, size_t len, uint64_t add)
}
}
+static uint64_t crypt_get_addr(AspeedHACEState *s, int reg, int reg_hi)
+{
+ AspeedHACEClass *ahc = ASPEED_HACE_GET_CLASS(s);
+ uint64_t addr;
+
+ addr = deposit64(0, 0, 32, s->regs[reg]);
+ if (ahc->has_dma64) {
+ addr = deposit64(addr, 32, 32, s->regs[reg_hi]);
+ }
+
+ return addr;
+}
+
/*
* Perform an AES/DES/3DES ECB/CBC operation. The source and destination are
* either single contiguous buffers (direct access mode) or scatter-gather
@@ -717,7 +735,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
}
/* Fetch the IV and key from the context buffer in DRAM. */
- ctx_addr = s->regs[R_CRYPT_CONTEXT];
+ ctx_addr = crypt_get_addr(s, R_CRYPT_CONTEXT, R_CRYPT_CONTEXT_HI);
if (address_space_read(&s->dram_as, ctx_addr, MEMTXATTRS_UNSPECIFIED,
ctx, sizeof(ctx))) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -758,7 +776,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
dst_buf = g_malloc0(buf_len);
/* Gather the source into the bounce buffer, per the selected mode. */
- src_addr = s->regs[R_CRYPT_SRC];
+ src_addr = crypt_get_addr(s, R_CRYPT_SRC, R_CRYPT_SRC_HI);
if (sg_mode) {
status = crypt_prepare_sg(s, src_addr, src_buf, len, false);
} else {
@@ -794,7 +812,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
}
/* Scatter the result back out, per the selected mode. */
- dst_addr = s->regs[R_CRYPT_DEST];
+ dst_addr = crypt_get_addr(s, R_CRYPT_DEST, R_CRYPT_DEST_HI);
if (sg_mode) {
status = crypt_prepare_sg(s, dst_addr, dst_buf, len, true);
} else {
@@ -958,6 +976,15 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
case R_HASH_KEY_BUFF_HI:
data &= ahc->key_hi_mask;
break;
+ case R_CRYPT_SRC_HI:
+ data &= ahc->src_hi_mask;
+ break;
+ case R_CRYPT_DEST_HI:
+ data &= ahc->dest_hi_mask;
+ break;
+ case R_CRYPT_CONTEXT_HI:
+ data &= ahc->key_hi_mask;
+ break;
default:
break;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode for the crypto command
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (12 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 13/16] hw/misc/aspeed_hace: Support 64-bit DMA for the crypto command Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 4:26 ` Cédric Le Goater
2026-08-11 3:10 ` [PATCH v3 15/16] hw/misc/aspeed_hace: Enable the crypto command on the AST2700 Jamin Lin
2026-08-11 3:10 ` [PATCH v3 16/16] tests/qtest/aspeed-hace: Test " Jamin Lin
15 siblings, 1 reply; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Implement the AES-GCM mode (HACE10[6:4] = 0b101) used by the AST2700
crypto engine: decode the GCM selection, read the 96-bit IV from the
context buffer, operate on the exact data length (GCM handles a partial
final block itself), and write the 128-bit authentication tag to the tag
buffer (HACE18/HACE8C). The hardware GCM path is only used without
associated data (the driver falls back to software otherwise), so AAD is
not modelled and a non-zero HACE14 is reported as unimplemented.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_hace.c | 70 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 62 insertions(+), 8 deletions(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 0a6e2fa829..e455216dd4 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -31,6 +31,9 @@
/* HACE0C[27:0] holds the crypto data length */
#define CRYPT_DATA_LEN_MASK 0x0FFFFFFF
#define R_CRYPT_CMD (0x10 / 4)
+/* AES-GCM associated data length (HACE14) and tag write buffer (HACE18) */
+#define R_CRYPT_GCM_ADD_LEN (0x14 / 4)
+#define R_CRYPT_GCM_TAG (0x18 / 4)
/* Crypto engine command register (HACE10) bits */
#define CRYPT_CMD_ENCRYPT BIT(7)
#define CRYPT_CMD_ISR_EN BIT(12)
@@ -42,6 +45,7 @@
#define CRYPT_CMD_ECB (0x0 << 4)
#define CRYPT_CMD_CBC (0x1 << 4)
#define CRYPT_CMD_CTR (0x4 << 4)
+#define CRYPT_CMD_GCM (0x5 << 4)
/* AES key length HACE10[3:2] */
#define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
#define CRYPT_CMD_AES256 (0x2 << 2)
@@ -57,10 +61,15 @@
#define CRYPT_CTX_KEY_OFFSET 0x10
#define CRYPT_CTX_SIZE 0x30
+/* AES-GCM uses a 96-bit IV and a 128-bit authentication tag */
+#define CRYPT_GCM_IV_LEN 12
+#define CRYPT_GCM_TAG_LEN 16
+
/* AST2700 64-bit DMA high address registers for the crypto command */
#define R_CRYPT_SRC_HI (0x80 / 4)
#define R_CRYPT_DEST_HI (0x84 / 4)
#define R_CRYPT_CONTEXT_HI (0x88 / 4)
+#define R_CRYPT_GCM_TAG_HI (0x8c / 4)
#define R_STATUS (0x1c / 4)
#define HASH_IRQ BIT(9)
@@ -596,6 +605,9 @@ static bool crypt_decode_cmd(uint32_t cmd, QCryptoCipherAlgo *alg,
case CRYPT_CMD_CTR:
*mode = QCRYPTO_CIPHER_MODE_CTR;
break;
+ case CRYPT_CMD_GCM:
+ *mode = QCRYPTO_CIPHER_MODE_GCM;
+ break;
default:
return false;
}
@@ -689,11 +701,12 @@ static uint64_t crypt_get_addr(AspeedHACEState *s, int reg, int reg_hi)
}
/*
- * Perform an AES/DES/3DES ECB/CBC operation. The source and destination are
- * either single contiguous buffers (direct access mode) or scatter-gather
- * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key come from
- * the context buffer (HACE08). For CBC the resulting chaining IV is written
- * back to the context buffer so the driver can continue the chain.
+ * Perform an AES/DES/3DES ECB/CBC/CTR or AES-GCM operation. The source and
+ * destination are either single contiguous buffers (direct access mode) or
+ * scatter-gather lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the
+ * IV/key come from the context buffer (HACE08). For CBC and CTR the resulting
+ * chaining state is written back to the context buffer so the driver can
+ * continue; for GCM the authentication tag is written to the tag buffer.
*/
static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
{
@@ -703,6 +716,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
g_autoptr(QCryptoCipher) cipher = NULL;
g_autofree uint8_t *src_buf = NULL;
g_autofree uint8_t *dst_buf = NULL;
+ uint8_t tag[CRYPT_GCM_TAG_LEN];
uint8_t ctx[CRYPT_CTX_SIZE];
Error *local_err = NULL;
QCryptoCipherMode mode;
@@ -711,10 +725,13 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
uint64_t ctx_addr;
uint64_t src_addr;
uint64_t dst_addr;
+ uint64_t tag_addr;
+ uint32_t aad_len;
size_t iv_offset;
size_t blocklen;
size_t buf_len;
size_t keylen;
+ size_t ivlen;
bool status;
if (len == 0) {
@@ -734,6 +751,20 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
return;
}
+ /* GCM uses a 96-bit IV; the block modes use a full-block IV. */
+ ivlen = (mode == QCRYPTO_CIPHER_MODE_GCM) ? CRYPT_GCM_IV_LEN : blocklen;
+
+ /*
+ * The hardware GCM path is only exercised without associated data (the
+ * driver falls back to software when there is any), so AAD is not modelled.
+ */
+ aad_len = s->regs[R_CRYPT_GCM_ADD_LEN] & CRYPT_DATA_LEN_MASK;
+ if (mode == QCRYPTO_CIPHER_MODE_GCM && aad_len != 0) {
+ qemu_log_mask(LOG_UNIMP,
+ "%s: GCM associated data is not implemented\n", __func__);
+ return;
+ }
+
/* Fetch the IV and key from the context buffer in DRAM. */
ctx_addr = crypt_get_addr(s, R_CRYPT_CONTEXT, R_CRYPT_CONTEXT_HI);
if (address_space_read(&s->dram_as, ctx_addr, MEMTXATTRS_UNSPECIFIED,
@@ -758,7 +789,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
}
if (mode != QCRYPTO_CIPHER_MODE_ECB &&
- qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen,
+ qcrypto_cipher_setiv(cipher, ctx + iv_offset, ivlen,
&local_err) < 0) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv failed: %s\n",
__func__, error_get_pretty(local_err));
@@ -769,9 +800,11 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
/*
* Round the working buffers up to a whole block. Block modes are already
* block-aligned; the stream-like CTR mode may leave a partial final block
- * that the engine still processes a full block at a time.
+ * that the engine still processes a full block at a time. GCM handles a
+ * partial final block itself, so it operates on the exact length.
*/
- buf_len = QEMU_ALIGN_UP(len, blocklen);
+ buf_len = (mode == QCRYPTO_CIPHER_MODE_GCM) ?
+ len : QEMU_ALIGN_UP(len, blocklen);
src_buf = g_malloc0(buf_len);
dst_buf = g_malloc0(buf_len);
@@ -855,6 +888,24 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
"%s: Failed to write IV, addr=0x%" HWADDR_PRIx "\n",
__func__, ctx_addr + iv_offset);
}
+ } else if (mode == QCRYPTO_CIPHER_MODE_GCM) {
+ /*
+ * GCM authenticates the message and writes the resulting tag to the
+ * dedicated tag buffer (HACE18/HACE8C).
+ */
+ if (qcrypto_cipher_gettag(cipher, tag, sizeof(tag), &local_err) < 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher gettag failed: "
+ "%s\n", __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+ tag_addr = crypt_get_addr(s, R_CRYPT_GCM_TAG, R_CRYPT_GCM_TAG_HI);
+ if (address_space_write(&s->dram_as, tag_addr, MEMTXATTRS_UNSPECIFIED,
+ tag, sizeof(tag))) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Failed to write tag, addr=0x%" HWADDR_PRIx "\n",
+ __func__, tag_addr);
+ }
}
}
@@ -985,6 +1036,9 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
case R_CRYPT_CONTEXT_HI:
data &= ahc->key_hi_mask;
break;
+ case R_CRYPT_GCM_TAG_HI:
+ data &= ahc->dest_hi_mask;
+ break;
default:
break;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode for the crypto command
2026-08-11 3:10 ` [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode " Jamin Lin
@ 2026-08-11 4:26 ` Cédric Le Goater
2026-08-11 5:22 ` Jamin Lin
0 siblings, 1 reply; 22+ messages in thread
From: Cédric Le Goater @ 2026-08-11 4:26 UTC (permalink / raw)
To: Jamin Lin, Daniel P. Berrangé, Peter Maydell, Steven Lee,
Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Eric Blake,
Markus Armbruster, Fabiano Rosas, Laurent Vivier, Paolo Bonzini,
open list:All patches CC here, open list:ASPEED BMCs
Cc: Troy Lee
On 8/11/26 05:10, Jamin Lin wrote:
> Implement the AES-GCM mode (HACE10[6:4] = 0b101) used by the AST2700
> crypto engine: decode the GCM selection, read the 96-bit IV from the
> context buffer, operate on the exact data length (GCM handles a partial
> final block itself), and write the 128-bit authentication tag to the tag
> buffer (HACE18/HACE8C). The hardware GCM path is only used without
> associated data (the driver falls back to software otherwise), so AAD is
> not modelled and a non-zero HACE14 is reported as unimplemented.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
> ---
> hw/misc/aspeed_hace.c | 70 ++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 62 insertions(+), 8 deletions(-)
>
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
> index 0a6e2fa829..e455216dd4 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -31,6 +31,9 @@
> /* HACE0C[27:0] holds the crypto data length */
> #define CRYPT_DATA_LEN_MASK 0x0FFFFFFF
> #define R_CRYPT_CMD (0x10 / 4)
> +/* AES-GCM associated data length (HACE14) and tag write buffer (HACE18) */
> +#define R_CRYPT_GCM_ADD_LEN (0x14 / 4)
> +#define R_CRYPT_GCM_TAG (0x18 / 4)
> /* Crypto engine command register (HACE10) bits */
> #define CRYPT_CMD_ENCRYPT BIT(7)
> #define CRYPT_CMD_ISR_EN BIT(12)
> @@ -42,6 +45,7 @@
> #define CRYPT_CMD_ECB (0x0 << 4)
> #define CRYPT_CMD_CBC (0x1 << 4)
> #define CRYPT_CMD_CTR (0x4 << 4)
> +#define CRYPT_CMD_GCM (0x5 << 4)
> /* AES key length HACE10[3:2] */
> #define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
> #define CRYPT_CMD_AES256 (0x2 << 2)
> @@ -57,10 +61,15 @@
> #define CRYPT_CTX_KEY_OFFSET 0x10
> #define CRYPT_CTX_SIZE 0x30
>
> +/* AES-GCM uses a 96-bit IV and a 128-bit authentication tag */
> +#define CRYPT_GCM_IV_LEN 12
> +#define CRYPT_GCM_TAG_LEN 16
> +
> /* AST2700 64-bit DMA high address registers for the crypto command */
> #define R_CRYPT_SRC_HI (0x80 / 4)
> #define R_CRYPT_DEST_HI (0x84 / 4)
> #define R_CRYPT_CONTEXT_HI (0x88 / 4)
> +#define R_CRYPT_GCM_TAG_HI (0x8c / 4)
>
> #define R_STATUS (0x1c / 4)
> #define HASH_IRQ BIT(9)
> @@ -596,6 +605,9 @@ static bool crypt_decode_cmd(uint32_t cmd, QCryptoCipherAlgo *alg,
> case CRYPT_CMD_CTR:
> *mode = QCRYPTO_CIPHER_MODE_CTR;
> break;
> + case CRYPT_CMD_GCM:
> + *mode = QCRYPTO_CIPHER_MODE_GCM;
> + break;
> default:
> return false;
> }
> @@ -689,11 +701,12 @@ static uint64_t crypt_get_addr(AspeedHACEState *s, int reg, int reg_hi)
> }
>
> /*
> - * Perform an AES/DES/3DES ECB/CBC operation. The source and destination are
> - * either single contiguous buffers (direct access mode) or scatter-gather
> - * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key come from
> - * the context buffer (HACE08). For CBC the resulting chaining IV is written
> - * back to the context buffer so the driver can continue the chain.
> + * Perform an AES/DES/3DES ECB/CBC/CTR or AES-GCM operation. The source and
> + * destination are either single contiguous buffers (direct access mode) or
> + * scatter-gather lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the
> + * IV/key come from the context buffer (HACE08). For CBC and CTR the resulting
> + * chaining state is written back to the context buffer so the driver can
> + * continue; for GCM the authentication tag is written to the tag buffer.
> */
> static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> {
> @@ -703,6 +716,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> g_autoptr(QCryptoCipher) cipher = NULL;
> g_autofree uint8_t *src_buf = NULL;
> g_autofree uint8_t *dst_buf = NULL;
> + uint8_t tag[CRYPT_GCM_TAG_LEN];
> uint8_t ctx[CRYPT_CTX_SIZE];
> Error *local_err = NULL;
> QCryptoCipherMode mode;
> @@ -711,10 +725,13 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> uint64_t ctx_addr;
> uint64_t src_addr;
> uint64_t dst_addr;
> + uint64_t tag_addr;
> + uint32_t aad_len;
> size_t iv_offset;
> size_t blocklen;
> size_t buf_len;
> size_t keylen;
> + size_t ivlen;
> bool status;
>
> if (len == 0) {
> @@ -734,6 +751,20 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> return;
> }
>
> + /* GCM uses a 96-bit IV; the block modes use a full-block IV. */
> + ivlen = (mode == QCRYPTO_CIPHER_MODE_GCM) ? CRYPT_GCM_IV_LEN : blocklen;
> +
> + /*
> + * The hardware GCM path is only exercised without associated data (the
> + * driver falls back to software when there is any), so AAD is not modelled.
> + */
> + aad_len = s->regs[R_CRYPT_GCM_ADD_LEN] & CRYPT_DATA_LEN_MASK;
should R_CRYPT_GCM_ADD_LEN be masked at write time like R_CRYPT_DATA_LEN is ?
> + if (mode == QCRYPTO_CIPHER_MODE_GCM && aad_len != 0) {
> + qemu_log_mask(LOG_UNIMP,
> + "%s: GCM associated data is not implemented\n", __func__);
> + return;
> + }
> +
> /* Fetch the IV and key from the context buffer in DRAM. */
> ctx_addr = crypt_get_addr(s, R_CRYPT_CONTEXT, R_CRYPT_CONTEXT_HI);
> if (address_space_read(&s->dram_as, ctx_addr, MEMTXATTRS_UNSPECIFIED,
> @@ -758,7 +789,7 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> }
>
> if (mode != QCRYPTO_CIPHER_MODE_ECB &&
> - qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen,
> + qcrypto_cipher_setiv(cipher, ctx + iv_offset, ivlen,
> &local_err) < 0) {
> qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv failed: %s\n",
> __func__, error_get_pretty(local_err));
> @@ -769,9 +800,11 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> /*
> * Round the working buffers up to a whole block. Block modes are already
> * block-aligned; the stream-like CTR mode may leave a partial final block
> - * that the engine still processes a full block at a time.
> + * that the engine still processes a full block at a time. GCM handles a
> + * partial final block itself, so it operates on the exact length.
> */
> - buf_len = QEMU_ALIGN_UP(len, blocklen);
> + buf_len = (mode == QCRYPTO_CIPHER_MODE_GCM) ?
> + len : QEMU_ALIGN_UP(len, blocklen);
> src_buf = g_malloc0(buf_len);
> dst_buf = g_malloc0(buf_len);
>
> @@ -855,6 +888,24 @@ static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> "%s: Failed to write IV, addr=0x%" HWADDR_PRIx "\n",
> __func__, ctx_addr + iv_offset);
> }
> + } else if (mode == QCRYPTO_CIPHER_MODE_GCM) {
> + /*
> + * GCM authenticates the message and writes the resulting tag to the
> + * dedicated tag buffer (HACE18/HACE8C).
> + */
> + if (qcrypto_cipher_gettag(cipher, tag, sizeof(tag), &local_err) < 0) {
> + qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher gettag failed: "
> + "%s\n", __func__, error_get_pretty(local_err));
> + error_free(local_err);
> + return;
> + }
> + tag_addr = crypt_get_addr(s, R_CRYPT_GCM_TAG, R_CRYPT_GCM_TAG_HI);
> + if (address_space_write(&s->dram_as, tag_addr, MEMTXATTRS_UNSPECIFIED,
> + tag, sizeof(tag))) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Failed to write tag, addr=0x%" HWADDR_PRIx "\n",
> + __func__, tag_addr);
> + }
> }
> }
>
> @@ -985,6 +1036,9 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
> case R_CRYPT_CONTEXT_HI:
> data &= ahc->key_hi_mask;
> break;
R_CRYPT_GCM_TAG writes are not masked like the other registers :
case R_CRYPT_SRC:
case R_CRYPT_DEST:
case R_CRYPT_CONTEXT:
data &= ahc->src_mask;
break;
Thanks,
C.
> + case R_CRYPT_GCM_TAG_HI:
> + data &= ahc->dest_hi_mask;
> + break;
> default:
> break;
> }
^ permalink raw reply [flat|nested] 22+ messages in thread* RE: [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode for the crypto command
2026-08-11 4:26 ` Cédric Le Goater
@ 2026-08-11 5:22 ` Jamin Lin
0 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 5:22 UTC (permalink / raw)
To: Cédric Le Goater, Daniel P. Berrangé, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Troy Lee
Hi Cédric
> Subject: Re: [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM
> mode for the crypto command
>
> On 8/11/26 05:10, Jamin Lin wrote:
> > Implement the AES-GCM mode (HACE10[6:4] = 0b101) used by the AST2700
> > crypto engine: decode the GCM selection, read the 96-bit IV from the
> > context buffer, operate on the exact data length (GCM handles a
> > partial final block itself), and write the 128-bit authentication tag
> > to the tag buffer (HACE18/HACE8C). The hardware GCM path is only used
> > without associated data (the driver falls back to software otherwise),
> > so AAD is not modelled and a non-zero HACE14 is reported as
> unimplemented.
> >
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
> > ---
> > hw/misc/aspeed_hace.c | 70
> ++++++++++++++++++++++++++++++++++++++-----
> > 1 file changed, 62 insertions(+), 8 deletions(-)
> >
> > diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> > 0a6e2fa829..e455216dd4 100644
> > --- a/hw/misc/aspeed_hace.c
> > +++ b/hw/misc/aspeed_hace.c
> > @@ -31,6 +31,9 @@
> > /* HACE0C[27:0] holds the crypto data length */
> > #define CRYPT_DATA_LEN_MASK 0x0FFFFFFF
> > #define R_CRYPT_CMD (0x10 / 4)
> > +/* AES-GCM associated data length (HACE14) and tag write buffer
> > +(HACE18) */ #define R_CRYPT_GCM_ADD_LEN (0x14 / 4)
> > +#define R_CRYPT_GCM_TAG (0x18 / 4)
> > /* Crypto engine command register (HACE10) bits */
> > #define CRYPT_CMD_ENCRYPT BIT(7)
> > #define CRYPT_CMD_ISR_EN BIT(12)
> > @@ -42,6 +45,7 @@
> > #define CRYPT_CMD_ECB (0x0 << 4)
> > #define CRYPT_CMD_CBC (0x1 << 4)
> > #define CRYPT_CMD_CTR (0x4 << 4)
> > +#define CRYPT_CMD_GCM (0x5 << 4)
> > /* AES key length HACE10[3:2] */
> > #define CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
> > #define CRYPT_CMD_AES256 (0x2 << 2)
> > @@ -57,10 +61,15 @@
> > #define CRYPT_CTX_KEY_OFFSET 0x10
> > #define CRYPT_CTX_SIZE 0x30
> >
> > +/* AES-GCM uses a 96-bit IV and a 128-bit authentication tag */
> > +#define CRYPT_GCM_IV_LEN 12
> > +#define CRYPT_GCM_TAG_LEN 16
> > +
> > /* AST2700 64-bit DMA high address registers for the crypto command */
> > #define R_CRYPT_SRC_HI (0x80 / 4)
> > #define R_CRYPT_DEST_HI (0x84 / 4)
> > #define R_CRYPT_CONTEXT_HI (0x88 / 4)
> > +#define R_CRYPT_GCM_TAG_HI (0x8c / 4)
> >
> > #define R_STATUS (0x1c / 4)
> > #define HASH_IRQ BIT(9)
> > @@ -596,6 +605,9 @@ static bool crypt_decode_cmd(uint32_t cmd,
> QCryptoCipherAlgo *alg,
> > case CRYPT_CMD_CTR:
> > *mode = QCRYPTO_CIPHER_MODE_CTR;
> > break;
> > + case CRYPT_CMD_GCM:
> > + *mode = QCRYPTO_CIPHER_MODE_GCM;
> > + break;
> > default:
> > return false;
> > }
> > @@ -689,11 +701,12 @@ static uint64_t crypt_get_addr(AspeedHACEState
> *s, int reg, int reg_hi)
> > }
> >
> > /*
> > - * Perform an AES/DES/3DES ECB/CBC operation. The source and
> > destination are
> > - * either single contiguous buffers (direct access mode) or
> > scatter-gather
> > - * lists (HACE10[18]/[19]), addressed by HACE00/HACE04; the IV/key
> > come from
> > - * the context buffer (HACE08). For CBC the resulting chaining IV is
> > written
> > - * back to the context buffer so the driver can continue the chain.
> > + * Perform an AES/DES/3DES ECB/CBC/CTR or AES-GCM operation. The
> > + source and
> > + * destination are either single contiguous buffers (direct access
> > + mode) or
> > + * scatter-gather lists (HACE10[18]/[19]), addressed by
> > + HACE00/HACE04; the
> > + * IV/key come from the context buffer (HACE08). For CBC and CTR the
> > + resulting
> > + * chaining state is written back to the context buffer so the driver
> > + can
> > + * continue; for GCM the authentication tag is written to the tag buffer.
> > */
> > static void do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> > {
> > @@ -703,6 +716,7 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
> > g_autoptr(QCryptoCipher) cipher = NULL;
> > g_autofree uint8_t *src_buf = NULL;
> > g_autofree uint8_t *dst_buf = NULL;
> > + uint8_t tag[CRYPT_GCM_TAG_LEN];
> > uint8_t ctx[CRYPT_CTX_SIZE];
> > Error *local_err = NULL;
> > QCryptoCipherMode mode;
> > @@ -711,10 +725,13 @@ static void do_crypt_operation(AspeedHACEState
> *s, uint32_t cmd)
> > uint64_t ctx_addr;
> > uint64_t src_addr;
> > uint64_t dst_addr;
> > + uint64_t tag_addr;
> > + uint32_t aad_len;
> > size_t iv_offset;
> > size_t blocklen;
> > size_t buf_len;
> > size_t keylen;
> > + size_t ivlen;
> > bool status;
> >
> > if (len == 0) {
> > @@ -734,6 +751,20 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
> > return;
> > }
> >
> > + /* GCM uses a 96-bit IV; the block modes use a full-block IV. */
> > + ivlen = (mode == QCRYPTO_CIPHER_MODE_GCM) ?
> CRYPT_GCM_IV_LEN :
> > + blocklen;
> > +
> > + /*
> > + * The hardware GCM path is only exercised without associated data
> (the
> > + * driver falls back to software when there is any), so AAD is not
> modelled.
> > + */
> > + aad_len = s->regs[R_CRYPT_GCM_ADD_LEN] &
> CRYPT_DATA_LEN_MASK;
>
> should R_CRYPT_GCM_ADD_LEN be masked at write time like
> R_CRYPT_DATA_LEN is ?
>
Thanks for the review and suggestion.
Will do.
> > + if (mode == QCRYPTO_CIPHER_MODE_GCM && aad_len != 0) {
> > + qemu_log_mask(LOG_UNIMP,
> > + "%s: GCM associated data is not
> implemented\n", __func__);
> > + return;
> > + }
> > +
> > /* Fetch the IV and key from the context buffer in DRAM. */
> > ctx_addr = crypt_get_addr(s, R_CRYPT_CONTEXT,
> R_CRYPT_CONTEXT_HI);
> > if (address_space_read(&s->dram_as, ctx_addr,
> > MEMTXATTRS_UNSPECIFIED, @@ -758,7 +789,7 @@ static void
> do_crypt_operation(AspeedHACEState *s, uint32_t cmd)
> > }
> >
> > if (mode != QCRYPTO_CIPHER_MODE_ECB &&
> > - qcrypto_cipher_setiv(cipher, ctx + iv_offset, blocklen,
> > + qcrypto_cipher_setiv(cipher, ctx + iv_offset, ivlen,
> > &local_err) < 0) {
> > qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher setiv
> failed: %s\n",
> > __func__, error_get_pretty(local_err)); @@
> > -769,9 +800,11 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
> > /*
> > * Round the working buffers up to a whole block. Block modes are
> already
> > * block-aligned; the stream-like CTR mode may leave a partial final
> block
> > - * that the engine still processes a full block at a time.
> > + * that the engine still processes a full block at a time. GCM handles a
> > + * partial final block itself, so it operates on the exact length.
> > */
> > - buf_len = QEMU_ALIGN_UP(len, blocklen);
> > + buf_len = (mode == QCRYPTO_CIPHER_MODE_GCM) ?
> > + len : QEMU_ALIGN_UP(len, blocklen);
> > src_buf = g_malloc0(buf_len);
> > dst_buf = g_malloc0(buf_len);
> >
> > @@ -855,6 +888,24 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
> > "%s: Failed to write IV, addr=0x%"
> HWADDR_PRIx "\n",
> > __func__, ctx_addr + iv_offset);
> > }
> > + } else if (mode == QCRYPTO_CIPHER_MODE_GCM) {
> > + /*
> > + * GCM authenticates the message and writes the resulting tag to
> the
> > + * dedicated tag buffer (HACE18/HACE8C).
> > + */
> > + if (qcrypto_cipher_gettag(cipher, tag, sizeof(tag), &local_err) < 0)
> {
> > + qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto cipher
> gettag failed: "
> > + "%s\n", __func__,
> error_get_pretty(local_err));
> > + error_free(local_err);
> > + return;
> > + }
> > + tag_addr = crypt_get_addr(s, R_CRYPT_GCM_TAG,
> R_CRYPT_GCM_TAG_HI);
> > + if (address_space_write(&s->dram_as, tag_addr,
> MEMTXATTRS_UNSPECIFIED,
> > + tag, sizeof(tag))) {
> > + qemu_log_mask(LOG_GUEST_ERROR,
> > + "%s: Failed to write tag, addr=0x%"
> HWADDR_PRIx "\n",
> > + __func__, tag_addr);
> > + }
> > }
> > }
> >
> > @@ -985,6 +1036,9 @@ static void aspeed_hace_write(void *opaque,
> hwaddr addr, uint64_t data,
> > case R_CRYPT_CONTEXT_HI:
> > data &= ahc->key_hi_mask;
> > break;
>
> R_CRYPT_GCM_TAG writes are not masked like the other registers :
>
> case R_CRYPT_SRC:
> case R_CRYPT_DEST:
> case R_CRYPT_CONTEXT:
> data &= ahc->src_mask;
> break;
>
Will do
Thanks,
Jamin
> Thanks,
>
> C.
>
>
> > + case R_CRYPT_GCM_TAG_HI:
> > + data &= ahc->dest_hi_mask;
> > + break;
> > default:
> > break;
> > }
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v3 15/16] hw/misc/aspeed_hace: Enable the crypto command on the AST2700
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (13 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 14/16] hw/misc/aspeed_hace: Support the AES-GCM mode " Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
2026-08-11 3:10 ` [PATCH v3 16/16] tests/qtest/aspeed-hace: Test " Jamin Lin
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
With direct/scatter-gather access, 64-bit DMA and AES-GCM all in place,
the AST2700 crypto engine is now fully modelled. Drop its temporary
interrupt-only workaround so the crypto command runs for real, like the
other HACE variants.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
include/hw/misc/aspeed_hace.h | 1 -
hw/misc/aspeed_hace.c | 15 +--------------
2 files changed, 1 insertion(+), 15 deletions(-)
diff --git a/include/hw/misc/aspeed_hace.h b/include/hw/misc/aspeed_hace.h
index b5416b0cb5..9b0e7683fa 100644
--- a/include/hw/misc/aspeed_hace.h
+++ b/include/hw/misc/aspeed_hace.h
@@ -49,7 +49,6 @@ struct AspeedHACEClass {
uint32_t key_mask;
uint32_t hash_mask;
uint64_t nr_regs;
- bool raise_crypt_interrupt_workaround;
uint32_t src_hi_mask;
uint32_t dest_hi_mask;
uint32_t key_hi_mask;
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index e455216dd4..0c53383903 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -1003,14 +1003,7 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
break;
}
case R_CRYPT_CMD:
- /*
- * The AST2700 crypto engine needs 64-bit DMA and AES-GCM, which are
- * added later; until then it keeps the temporary workaround of only
- * raising the completion interrupt without running the command.
- */
- if (!ahc->raise_crypt_interrupt_workaround) {
- do_crypt_operation(s, data);
- }
+ do_crypt_operation(s, data);
/* Hardware raises the crypt interrupt once the command finishes. */
s->regs[R_STATUS] |= CRYPT_IRQ;
@@ -1214,12 +1207,6 @@ static void aspeed_ast2700_hace_class_init(ObjectClass *klass, const void *data)
ahc->dest_hi_mask = 0x00000003;
ahc->key_hi_mask = 0x00000003;
- /*
- * Currently, it does not support the CRYPT command. Instead, it only
- * sends an interrupt to notify the firmware that the crypt command
- * has completed. It is a temporary workaround.
- */
- ahc->raise_crypt_interrupt_workaround = true;
ahc->has_dma64 = true;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH v3 16/16] tests/qtest/aspeed-hace: Test the crypto command on the AST2700
2026-08-11 3:10 [PATCH v3 00/16] Support the ASPEED HACE crypto command Jamin Lin
` (14 preceding siblings ...)
2026-08-11 3:10 ` [PATCH v3 15/16] hw/misc/aspeed_hace: Enable the crypto command on the AST2700 Jamin Lin
@ 2026-08-11 3:10 ` Jamin Lin
15 siblings, 0 replies; 22+ messages in thread
From: Jamin Lin @ 2026-08-11 3:10 UTC (permalink / raw)
To: Daniel P. Berrangé, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Eric Blake, Markus Armbruster, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, open list:All patches CC here,
open list:ASPEED BMCs
Cc: Jamin Lin, Troy Lee
Cover the AST2700 crypto engine, which drives 64-bit scatter-gather DMA
and adds AES-GCM on top of the ECB/CBC/CTR modes shared with the AST2600.
Add AES-128 and AES-256 GCM known-answer vectors (GCM specification /
NIST SP 800-38D, no associated data) and a dedicated GCM runner that
programs the tag buffer and reads the tag back, checking it after both
encryption and decryption. Register the AST2700 with all four modes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Kane Chen <kane_chen@aspeedtech.com>
---
tests/qtest/aspeed-hace-utils.h | 1 +
tests/qtest/aspeed-hace-utils.c | 163 +++++++++++++++++++++++++++++++-
tests/qtest/ast2700-hace-test.c | 9 ++
3 files changed, 172 insertions(+), 1 deletion(-)
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index 82b0b3f93d..a5601a3d65 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -86,6 +86,7 @@ enum {
CRYPT_MODE_ECB = 1 << 0,
CRYPT_MODE_CBC = 1 << 1,
CRYPT_MODE_CTR = 1 << 2,
+ CRYPT_MODE_GCM = 1 << 3,
};
/*
diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index f582c88ef5..260eec043c 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -654,6 +654,8 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
#define HACE_CRYPTO_CONTEXT 0x08
#define HACE_CRYPTO_DATA_LEN 0x0c
#define HACE_CRYPTO_CMD 0x10
+#define HACE_CRYPTO_GCM_ADD_LEN 0x14
+#define HACE_CRYPTO_GCM_TAG 0x18
/* Crypto command bits */
#define HACE_CMD_ENCRYPT BIT(7)
@@ -666,7 +668,9 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
#define HACE_CMD_ECB (0x0 << 4)
#define HACE_CMD_CBC (0x1 << 4)
#define HACE_CMD_CTR (0x4 << 4)
+#define HACE_CMD_GCM (0x5 << 4)
#define HACE_CMD_AES128 (0x0 << 2)
+#define HACE_CMD_AES256 (0x2 << 2)
/* Context buffer layout: IV (DES at +8), key at +0x10 */
#define HACE_CTX_KEY_OFFSET 0x10
@@ -794,6 +798,59 @@ static const uint8_t tdes_ctr_ctext[8] = {
static const uint8_t tdes_ctr_ivout[8] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+/*
+ * aes_gcm_tv_template[2] (AES-128) and [9] (AES-256), from the McGrew & Viega
+ * GCM spec (also NIST SP 800-38D), no AAD. Both cases share this plaintext/IV.
+ */
+static const uint8_t aes_gcm_ptext[64] = {
+ 0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5,
+ 0xa5, 0x59, 0x09, 0xc5, 0xaf, 0xf5, 0x26, 0x9a,
+ 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda,
+ 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72,
+ 0x1c, 0x3c, 0x0c, 0x95, 0x95, 0x68, 0x09, 0x53,
+ 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25,
+ 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57,
+ 0xba, 0x63, 0x7b, 0x39, 0x1a, 0xaf, 0xd2, 0x55 };
+static const uint8_t aes_gcm_iv[12] = {
+ 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad,
+ 0xde, 0xca, 0xf8, 0x88 };
+
+/* aes_gcm_tv_template[2] (AES-128) */
+static const uint8_t aes128_gcm_key[16] = {
+ 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c,
+ 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08 };
+static const uint8_t aes128_gcm_ctext[64] = {
+ 0x42, 0x83, 0x1e, 0xc2, 0x21, 0x77, 0x74, 0x24,
+ 0x4b, 0x72, 0x21, 0xb7, 0x84, 0xd0, 0xd4, 0x9c,
+ 0xe3, 0xaa, 0x21, 0x2f, 0x2c, 0x02, 0xa4, 0xe0,
+ 0x35, 0xc1, 0x7e, 0x23, 0x29, 0xac, 0xa1, 0x2e,
+ 0x21, 0xd5, 0x14, 0xb2, 0x54, 0x66, 0x93, 0x1c,
+ 0x7d, 0x8f, 0x6a, 0x5a, 0xac, 0x84, 0xaa, 0x05,
+ 0x1b, 0xa3, 0x0b, 0x39, 0x6a, 0x0a, 0xac, 0x97,
+ 0x3d, 0x58, 0xe0, 0x91, 0x47, 0x3f, 0x59, 0x85 };
+static const uint8_t aes128_gcm_tag[16] = {
+ 0x4d, 0x5c, 0x2a, 0xf3, 0x27, 0xcd, 0x64, 0xa6,
+ 0x2c, 0xf3, 0x5a, 0xbd, 0x2b, 0xa6, 0xfa, 0xb4 };
+
+/* aes_gcm_tv_template[9] (AES-256) */
+static const uint8_t aes256_gcm_key[32] = {
+ 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c,
+ 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08,
+ 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c,
+ 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08 };
+static const uint8_t aes256_gcm_ctext[64] = {
+ 0x52, 0x2d, 0xc1, 0xf0, 0x99, 0x56, 0x7d, 0x07,
+ 0xf4, 0x7f, 0x37, 0xa3, 0x2a, 0x84, 0x42, 0x7d,
+ 0x64, 0x3a, 0x8c, 0xdc, 0xbf, 0xe5, 0xc0, 0xc9,
+ 0x75, 0x98, 0xa2, 0xbd, 0x25, 0x55, 0xd1, 0xaa,
+ 0x8c, 0xb0, 0x8e, 0x48, 0x59, 0x0d, 0xbb, 0x3d,
+ 0xa7, 0xb0, 0x8b, 0x10, 0x56, 0x82, 0x88, 0x38,
+ 0xc5, 0xf6, 0x1e, 0x63, 0x93, 0xba, 0x7a, 0x0a,
+ 0xbc, 0xc9, 0xf6, 0x62, 0x89, 0x80, 0x15, 0xad };
+static const uint8_t aes256_gcm_tag[16] = {
+ 0xb0, 0x94, 0xda, 0xc5, 0xd9, 0x34, 0x71, 0xbd,
+ 0xec, 0x1a, 0x50, 0x22, 0x70, 0xe3, 0xcc, 0x6c };
+
typedef struct CryptTest {
QCryptoCipherMode mode;
QCryptoCipherAlgo alg;
@@ -801,10 +858,13 @@ typedef struct CryptTest {
const uint8_t *iv_out;
const uint8_t *ptext;
const uint8_t *ctext;
+ /* expected GCM authentication tag, or NULL for non-AEAD modes */
+ const uint8_t *tag;
const uint8_t *key;
const uint8_t *iv;
const char *name;
size_t keylen;
+ size_t taglen;
/* algorithm | mode | key size selection */
uint32_t cmd;
size_t ivlen;
@@ -927,6 +987,36 @@ static const CryptTest crypt_tests[] = {
.iv_out = tdes_ctr_ivout,
.len = sizeof(tdes_ctr_ptext),
},
+ {
+ .name = "aes128-gcm",
+ .cmd = HACE_CMD_AES128 | HACE_CMD_GCM,
+ .alg = QCRYPTO_CIPHER_ALGO_AES_128,
+ .mode = QCRYPTO_CIPHER_MODE_GCM,
+ .key = aes128_gcm_key,
+ .keylen = sizeof(aes128_gcm_key),
+ .iv = aes_gcm_iv,
+ .ivlen = sizeof(aes_gcm_iv),
+ .ptext = aes_gcm_ptext,
+ .ctext = aes128_gcm_ctext,
+ .tag = aes128_gcm_tag,
+ .taglen = sizeof(aes128_gcm_tag),
+ .len = sizeof(aes_gcm_ptext),
+ },
+ {
+ .name = "aes256-gcm",
+ .cmd = HACE_CMD_AES256 | HACE_CMD_GCM,
+ .alg = QCRYPTO_CIPHER_ALGO_AES_256,
+ .mode = QCRYPTO_CIPHER_MODE_GCM,
+ .key = aes256_gcm_key,
+ .keylen = sizeof(aes256_gcm_key),
+ .iv = aes_gcm_iv,
+ .ivlen = sizeof(aes_gcm_iv),
+ .ptext = aes_gcm_ptext,
+ .ctext = aes256_gcm_ctext,
+ .tag = aes256_gcm_tag,
+ .taglen = sizeof(aes256_gcm_tag),
+ .len = sizeof(aes_gcm_ptext),
+ },
};
/* DRAM offsets for the crypto test source, destination and context buffers. */
@@ -944,6 +1034,8 @@ static const CryptTest crypt_tests[] = {
*/
#define CRYPT_SG_FRAGS 3
#define CRYPT_SG_FRAG_STRIDE 0x1000
+/* DRAM offset for the AES-GCM authentication tag write buffer. */
+#define CRYPT_OFF_TAG 0x60000
/* Describes one registered crypto test (qtest_add_data_func() data pointer). */
typedef struct AspeedCryptoTest {
@@ -964,6 +1056,8 @@ static uint32_t crypt_mode_flag(uint32_t cmd)
return CRYPT_MODE_CBC;
case HACE_CMD_CTR:
return CRYPT_MODE_CTR;
+ case HACE_CMD_GCM:
+ return CRYPT_MODE_GCM;
default:
return 0;
}
@@ -1109,6 +1203,47 @@ static void crypt_run_sg(QTestState *s, uint32_t base, uint64_t dram,
crypt_gather_sg(s, dram, CRYPT_OFF_DST, out, t->len);
}
+/*
+ * Run one AES-GCM operation in scatter-gather mode: like crypt_run_sg() but
+ * also program the tag write buffer (HACE18) with no associated data, and read
+ * the authentication tag back into @out_tag.
+ */
+static void crypt_run_gcm(QTestState *s, uint32_t base, uint64_t dram,
+ const CryptTest *t, bool encrypt, uint8_t *out,
+ uint8_t *out_tag)
+{
+ const uint8_t *in = encrypt ? t->ptext : t->ctext;
+ uint64_t src_sg = dram + CRYPT_OFF_SRC_SG;
+ uint64_t dst_sg = dram + CRYPT_OFF_DST_SG;
+ uint64_t ctx = dram + CRYPT_OFF_CTX;
+ uint32_t cmd = t->cmd | HACE_CMD_ISR_EN | HACE_CMD_SRC_SG_CTRL |
+ HACE_CMD_DST_SG_CTRL;
+
+ if (encrypt) {
+ cmd |= HACE_CMD_ENCRYPT;
+ }
+
+ crypt_write_ctx(s, ctx, t);
+ crypt_make_sg(s, dram, CRYPT_OFF_SRC, src_sg, in, t->len);
+ crypt_make_sg(s, dram, CRYPT_OFF_DST, dst_sg, NULL, t->len);
+
+ qtest_writel(s, base + HACE_CRYPTO_SRC, (uint32_t)src_sg);
+ qtest_writel(s, base + HACE_CRYPTO_DEST, (uint32_t)dst_sg);
+ qtest_writel(s, base + HACE_CRYPTO_CONTEXT, (uint32_t)ctx);
+ qtest_writel(s, base + HACE_CRYPTO_DATA_LEN, t->len);
+ qtest_writel(s, base + HACE_CRYPTO_GCM_ADD_LEN, 0);
+ qtest_writel(s, base + HACE_CRYPTO_GCM_TAG,
+ (uint32_t)(dram + CRYPT_OFF_TAG));
+ qtest_writel(s, base + HACE_CRYPTO_CMD, cmd);
+
+ g_assert_cmphex(qtest_readl(s, base + HACE_STS) & HACE_CRYPTO_ISR, ==,
+ HACE_CRYPTO_ISR);
+ qtest_writel(s, base + HACE_STS, HACE_CRYPTO_ISR);
+
+ crypt_gather_sg(s, dram, CRYPT_OFF_DST, out, t->len);
+ qtest_memread(s, dram + CRYPT_OFF_TAG, out_tag, t->taglen);
+}
+
static void aspeed_test_crypto(const void *data)
{
const AspeedCryptoTest *c = data;
@@ -1145,6 +1280,29 @@ static void aspeed_test_crypto(const void *data)
qtest_quit(s);
}
+static void aspeed_test_crypto_gcm(const void *data)
+{
+ const AspeedCryptoTest *c = data;
+ const CryptTest *t = &crypt_tests[c->index];
+ QTestState *s = qtest_init(c->machine);
+ uint8_t out[64];
+ uint8_t tag[16];
+
+ g_assert_cmpuint(t->len, <=, sizeof(out));
+
+ /* Encrypt: ptext -> ctext, then check the authentication tag. */
+ crypt_run_gcm(s, c->base, c->dram, t, true, out, tag);
+ g_assert_cmpmem(out, t->len, t->ctext, t->len);
+ g_assert_cmpmem(tag, t->taglen, t->tag, t->taglen);
+
+ /* Decrypt: ctext -> ptext, the recomputed tag must match. */
+ crypt_run_gcm(s, c->base, c->dram, t, false, out, tag);
+ g_assert_cmpmem(out, t->len, t->ptext, t->len);
+ g_assert_cmpmem(tag, t->taglen, t->tag, t->taglen);
+
+ qtest_quit(s);
+}
+
void aspeed_add_crypto_tests(const char *prefix, const char *machine,
uint32_t base, uint64_t dram, uint32_t modes,
bool sg)
@@ -1152,6 +1310,7 @@ void aspeed_add_crypto_tests(const char *prefix, const char *machine,
int i;
for (i = 0; i < ARRAY_SIZE(crypt_tests); i++) {
+ bool is_gcm = crypt_tests[i].mode == QCRYPTO_CIPHER_MODE_GCM;
g_autofree char *path = NULL;
AspeedCryptoTest *t;
@@ -1173,7 +1332,9 @@ void aspeed_add_crypto_tests(const char *prefix, const char *machine,
t->dram = dram;
t->index = i;
t->sg = sg;
- qtest_add_data_func_full(path, t, aspeed_test_crypto, g_free);
+ qtest_add_data_func_full(path, t,
+ is_gcm ? aspeed_test_crypto_gcm :
+ aspeed_test_crypto, g_free);
}
}
diff --git a/tests/qtest/ast2700-hace-test.c b/tests/qtest/ast2700-hace-test.c
index 508a34dd6c..3f0217d635 100644
--- a/tests/qtest/ast2700-hace-test.c
+++ b/tests/qtest/ast2700-hace-test.c
@@ -94,5 +94,14 @@ int main(int argc, char **argv)
qtest_add_func("ast2700/hace/sha384_accum", test_sha384_accum_ast2700);
qtest_add_func("ast2700/hace/sha256_accum", test_sha256_accum_ast2700);
+ /*
+ * The AST2700 crypto engine uses scatter-gather with 64-bit DMA and adds
+ * AES-GCM on top of the ECB/CBC/CTR modes shared with the AST2600.
+ */
+ aspeed_add_crypto_tests("ast2700", "-machine ast2700-evb", 0x12070000,
+ 0x400000000,
+ CRYPT_MODE_ECB | CRYPT_MODE_CBC | CRYPT_MODE_CTR |
+ CRYPT_MODE_GCM, true);
+
return g_test_run();
}
--
2.43.0
^ permalink raw reply related [flat|nested] 22+ messages in thread