* [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600
@ 2026-09-01 8:15 Jamin Lin
2026-09-01 8:15 ` [PATCH v4 1/4] hw/misc/aspeed_acry: Add ASPEED ACRY model Jamin Lin
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: Jamin Lin @ 2026-09-01 8:15 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas,
Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee
This series adds a model of the ASPEED ACRY engine found on the AST2600
SoC, wires it into the SoC, and adds a qtest.
The ACRY engine performs RSA modular exponentiation (c = m^e mod n). It
DMAs the operands (data, exponent, and modulus) from guest DRAM and writes
the result to a dedicated 64 KiB SRAM region.
Guest firmware uses the engine for RSA signature verification during boot.
Without a model, the guest starts the engine and waits indefinitely for a
completion interrupt, causing the boot to hang.
The model uses QEMU's generic akcipher API to perform raw (unpadded) RSA.
Raw RSA is currently supported only by the libgcrypt backend, which can be
enabled alongside gnutls with -Dgcrypt=enabled, so a build does not have to
choose between the two. When raw RSA is unavailable, the engine still
completes and raises its interrupt, but returns an all-zero result. This
allows the guest's signature verification to fail cleanly instead of
hanging. The qtest is skipped when the selected crypto backend does not
support raw RSA.
Although the hardware documentation describes both RSA and ECDSA support,
ECDSA is known to be broken on this hardware and is therefore not modeled.
v1:
1. Add ASPEED ACRY RSA model for the AST2600
2. Add qtest for AST2600 ASPEED ACRY RSA model
v2:
1. squash "Add the ACRY model to AspeedSoCState" into "Wire up the ACRY
model"
2. wrap the ACRY SRAM in a container mapped at offset 0 so the device
addresses it by relative offset (drop the "sram-base" property)
3. build the scattered SRAM byte offsets on the fly instead of caching
them in per-instance lookup tables
4. write the result with address_space_stl_le() and check the MemTxResult
v3:
1. Return early when the DMA read of the operand buffer fails
2. Replace g_printerr with g_test_skip
v4:
1. Remove unused macros.
2. Dynamically allocate data and src_buf to reduce stack usage in aspeed_acry_do_rsa().
3. Add a helper function to clear the result when aspeed_acry_do_rsa() fails.
4. Add bounds checking to aspeed_acry_operand_offset() and replace magic numbers with
compile-time constants.
Jamin Lin (4):
hw/misc/aspeed_acry: Add ASPEED ACRY model
hw/arm/aspeed_ast2600: Introduce the ACRY SRAM
hw/arm/aspeed_ast2600: Wire up the ACRY model
tests/qtest/aspeed-acry-test: Add RSA ModExp tests
include/hw/arm/aspeed_soc.h | 4 +
include/hw/misc/aspeed_acry.h | 39 +++
hw/arm/aspeed_ast2600.c | 34 +++
hw/misc/aspeed_acry.c | 481 +++++++++++++++++++++++++++++++++
tests/qtest/aspeed-acry-test.c | 406 ++++++++++++++++++++++++++++
hw/misc/meson.build | 1 +
hw/misc/trace-events | 6 +
tests/qtest/meson.build | 5 +-
8 files changed, 975 insertions(+), 1 deletion(-)
create mode 100644 include/hw/misc/aspeed_acry.h
create mode 100644 hw/misc/aspeed_acry.c
create mode 100644 tests/qtest/aspeed-acry-test.c
--
2.53.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH v4 1/4] hw/misc/aspeed_acry: Add ASPEED ACRY model 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin @ 2026-09-01 8:15 ` Jamin Lin 2026-09-01 8:15 ` [PATCH v4 2/4] hw/arm/aspeed_ast2600: Introduce the ACRY SRAM Jamin Lin ` (4 subsequent siblings) 5 siblings, 0 replies; 7+ messages in thread From: Jamin Lin @ 2026-09-01 8:15 UTC (permalink / raw) To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Jamin Lin, Troy Lee Introduce a ASPEED ACRY model, which performs RSA modular exponentiation. The datasheet documents the engine as supporting both RSA and ECDSA, but ECDSA is broken on this hardware, so only RSA is modelled. The engine DMAs its operands (data, exponent, modulus) from a guest DRAM buffer and writes the result back into a memory-mapped SRAM region. Both regions share the same interleaved byte/dword layout: repeating 12-dword blocks of [4 dwords exponent][4 dwords modulus][4 dwords data], index 0 holding the least-significant word/byte of each value. The engine accesses DRAM by relative offset, so the CPU-visible address written to the DMA source register has its top (base) bit masked off. The modular exponentiation itself is delegated to QEMU's generic akcipher crypto API (crypto/akcipher.c) using raw (unpadded) RSA, matching what the real hardware performs - PKCS1 padding is handled by the guest's software crypto stack, not by this engine. The RSA public-key operand DER encoding needed by that API is built with crypto/der.h's generic encoder. Raw (unpadded) RSA is only implemented by that API's libgcrypt backend (its nettle backend rejects raw padding). When that support is missing, the engine still completes and raises its completion IRQ as real hardware would, but produces an all-zero result so that whatever signature check the guest performs on it fails cleanly instead of the guest hanging forever waiting for an interrupt that would otherwise never come. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> --- include/hw/misc/aspeed_acry.h | 39 +++ hw/misc/aspeed_acry.c | 481 ++++++++++++++++++++++++++++++++++ hw/misc/meson.build | 1 + hw/misc/trace-events | 6 + 4 files changed, 527 insertions(+) create mode 100644 include/hw/misc/aspeed_acry.h create mode 100644 hw/misc/aspeed_acry.c diff --git a/include/hw/misc/aspeed_acry.h b/include/hw/misc/aspeed_acry.h new file mode 100644 index 0000000000..5ca80deec4 --- /dev/null +++ b/include/hw/misc/aspeed_acry.h @@ -0,0 +1,39 @@ +/* + * ASPEED ACRY Engine + * + * Copyright (C) 2026 ASPEED Technology Inc. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef ASPEED_ACRY_H +#define ASPEED_ACRY_H + +#include "hw/core/sysbus.h" +#include "system/memory.h" + +#define TYPE_ASPEED_ACRY "aspeed.acry" +OBJECT_DECLARE_SIMPLE_TYPE(AspeedACRYState, ASPEED_ACRY) + +#define ASPEED_ACRY_NR_REGS (0x400 >> 2) +/* Max size of the "data" (message) field within the SRAM buffer. */ +#define ASPEED_ACRY_DATA_MAX_LEN 0x800 +#define ASPEED_ACRY_MAX_BITS 4096 +/* Max exponent/modulus size for a 4096-bit RSA key, in bytes. */ +#define ASPEED_ACRY_MAX_BYTES (ASPEED_ACRY_MAX_BITS / 8) + +struct AspeedACRYState { + SysBusDevice parent_obj; + + MemoryRegion iomem; + qemu_irq irq; + + uint32_t regs[ASPEED_ACRY_NR_REGS]; + + MemoryRegion *dram_mr; + MemoryRegion *sram_mr; + AddressSpace dram_as; + AddressSpace sram_as; +}; + +#endif /* ASPEED_ACRY_H */ diff --git a/hw/misc/aspeed_acry.c b/hw/misc/aspeed_acry.c new file mode 100644 index 0000000000..41eac7295f --- /dev/null +++ b/hw/misc/aspeed_acry.c @@ -0,0 +1,481 @@ +/* + * ASPEED ACRY Engine + * + * Copyright (C) 2026 ASPEED Technology Inc. + * + * SPDX-License-Identifier: GPL-2.0-or-later + * + * The datasheet documents the ACRY engine as supporting both RSA and + * ECDSA, but ECDSA is broken on this hardware, so only RSA is modelled + * here. + */ + +#include "qemu/osdep.h" +#include "qemu/cutils.h" +#include "qemu/log.h" +#include "hw/misc/aspeed_acry.h" +#include "hw/core/qdev-properties.h" +#include "hw/core/irq.h" +#include "hw/core/registerfields.h" +#include "qapi/error.h" +#include "crypto/akcipher.h" +#include "crypto/der.h" +#include "trace.h" + +REG32(ACRY_TRIGGER, 0x000) + FIELD(ACRY_TRIGGER, RSA_START, 0, 1) +REG32(ACRY_DMA_SRC, 0x04C) +REG32(ACRY_DMA_LEN, 0x050) + FIELD(ACRY_DMA_LEN, DATALEN, 0, 16) +REG32(ACRY_INT_MASK, 0x3F8) + FIELD(ACRY_INT_MASK, RSA_DMA_MASK, 2, 1) + FIELD(ACRY_INT_MASK, RSA_ENG_MASK, 1, 1) +REG32(ACRY_STATUS, 0x3FC) + FIELD(ACRY_STATUS, RSA_DMA_DONE, 2, 1) + FIELD(ACRY_STATUS, RSA_ENG_DONE, 1, 1) + +/* + * Total size of the interleaved buffer. Data is 4 of every 12 + * dwords of a block, one third of the buffer, so the whole buffer is 3x + * the data region. + */ +#define ASPEED_ACRY_SRAM_SIZE (3 * ASPEED_ACRY_DATA_MAX_LEN) + +#define ASPEED_ACRY_BYTES_PER_DWORD 4 +#define ASPEED_ACRY_LANES_PER_BLOCK 4 +/* Each block holds 3 regions (exp, mod, data) of LANES_PER_BLOCK dwords. */ +#define ASPEED_ACRY_DWORDS_PER_BLOCK (3 * ASPEED_ACRY_LANES_PER_BLOCK) + +/* Dwords into each block where each operand's region starts. */ +#define ASPEED_ACRY_EXP_OFFSET (0 * ASPEED_ACRY_LANES_PER_BLOCK) +#define ASPEED_ACRY_MOD_OFFSET (1 * ASPEED_ACRY_LANES_PER_BLOCK) +#define ASPEED_ACRY_DATA_OFFSET (2 * ASPEED_ACRY_LANES_PER_BLOCK) + +static void aspeed_acry_hexdump(const char *desc, const uint8_t *buf, + size_t size) +{ + g_autoptr(GString) str = g_string_sized_new(64); + size_t len; + size_t i; + + for (i = 0; i < size; i += len) { + len = MIN(16, size - i); + g_string_truncate(str, 0); + qemu_hexdump_line(str, buf + i, len, 1, 4); + trace_aspeed_acry_hexdump(desc, i, str->str); + } +} + +/* + * The interleaved buffer is a series of 12-dword blocks, each split into + * three 4-dword regions - exp, mod, data: + * + * dword in block: 0 1 2 3 4 5 6 7 8 9 10 11 + * region: \---- exp ----/ \---- mod ----/ \---- data ----/ + * lane: 0 1 2 3 0 1 2 3 0 1 2 3 + * + * Successive blocks hold the next 4 dwords of each operand, so operand + * dword d is in block (d / 4), lane (d % 4). Dwords are little-endian, so + * byte b of dword D is at byte D * 4 + b. + * + * Return the buffer offset of byte 'op_byte' (op_byte = 0 = least + * significant) of the operand whose region starts 'region' dwords into + * each block (0 = exp, 4 = mod, 8 = data). + */ +static int aspeed_acry_operand_offset(int region, int op_byte) +{ + int byte_in_dword; + int op_dword; + int offset; + int block; + int lane; + + op_dword = op_byte / ASPEED_ACRY_BYTES_PER_DWORD; + byte_in_dword = op_byte % ASPEED_ACRY_BYTES_PER_DWORD; + block = op_dword / ASPEED_ACRY_LANES_PER_BLOCK; + lane = op_dword % ASPEED_ACRY_LANES_PER_BLOCK; + + offset = (block * ASPEED_ACRY_DWORDS_PER_BLOCK + region + lane) + * ASPEED_ACRY_BYTES_PER_DWORD + byte_in_dword; + assert(offset < ASPEED_ACRY_SRAM_SIZE); + + return offset; +} + +/* + * Read one operand out of the buffer as a big-endian magnitude. + * + * The operand's bytes are scattered through buf; byte k (significance level + * k, k = 0 = least significant) is at aspeed_acry_operand_offset(region, k). + * Walk from the top down, drop leading zero bytes, and write the result most + * significant byte first into out[]. Returns the number of bytes written + * (the value 0 yields a single 0x00 byte, so always >= 1). + */ +static int aspeed_acry_extract_be(const uint8_t *buf, int region, + int max_bytes, uint8_t *out) +{ + int offset; + int msb; + int len; + int k; + + /* Highest significance level holding a non-zero byte (skip leading 0s). */ + for (msb = max_bytes - 1; msb >= 0; msb--) { + offset = aspeed_acry_operand_offset(region, msb); + if (buf[offset] != 0) { + break; + } + } + + /* All bytes zero: the value is 0. */ + if (msb < 0) { + out[0] = 0; + return 1; + } + + /* Copy most significant byte first: level msb down to level 0. */ + len = 0; + for (k = msb; k >= 0; k--) { + offset = aspeed_acry_operand_offset(region, k); + out[len++] = buf[offset]; + } + + return len; +} + +/* + * Return a DER INTEGER body for the unsigned big-endian magnitude 'be'. + * + * DER INTEGERs are signed, so if the top byte has bit 7 set the value + * would decode as negative; prepend a 0x00 guard byte in that case. + * + * The padded copy is written into 'pad_buf' (caller-owned, sized len + 1) + * rather than a local, because qcrypto_der_encode_int() only stores the + * pointer we hand it - the bytes are not copied until + * qcrypto_der_encode_ctx_flush_and_free() - so the body must stay valid + * until then. Returns a pointer into 'be' or 'pad_buf' as appropriate, + * with the body length in *body_len. + */ +static const uint8_t *aspeed_acry_der_uint_body(const uint8_t *be, size_t len, + uint8_t *pad_buf, + size_t *body_len) +{ + if (be[0] & 0x80) { + pad_buf[0] = 0x00; + memcpy(pad_buf + 1, be, len); + *body_len = len + 1; + return pad_buf; + } + + *body_len = len; + return be; +} + +/* + * DER-encode a "RsaPubKey ::= SEQUENCE { n INTEGER, e INTEGER }" (see + * crypto/rsakey.h), the format expected by qcrypto_akcipher_new(). n and e + * are minimal big-endian magnitudes (as produced by + * aspeed_acry_extract_be()); the engine does a raw modexp, so the guest's + * exponent is always encoded here as the public 'e'. + */ +static uint8_t *aspeed_acry_der_encode_pubkey(const uint8_t *n, size_t n_len, + const uint8_t *e, size_t e_len, + size_t *out_len) +{ + QCryptoEncodeContext *ctx = qcrypto_der_encode_ctx_new(); + uint8_t n_pad[ASPEED_ACRY_MAX_BYTES + 1]; + uint8_t e_pad[ASPEED_ACRY_MAX_BYTES + 1]; + const uint8_t *n_body; + const uint8_t *e_body; + size_t n_body_len; + size_t e_body_len; + uint8_t *buf; + + n_body = aspeed_acry_der_uint_body(n, n_len, n_pad, &n_body_len); + e_body = aspeed_acry_der_uint_body(e, e_len, e_pad, &e_body_len); + + qcrypto_der_encode_seq_begin(ctx); + qcrypto_der_encode_int(ctx, n_body, n_body_len); + qcrypto_der_encode_int(ctx, e_body, e_body_len); + qcrypto_der_encode_seq_end(ctx); + + *out_len = qcrypto_der_encode_ctx_buffer_len(ctx); + buf = g_malloc(*out_len); + qcrypto_der_encode_ctx_flush_and_free(ctx, buf); + + return buf; +} + +/* + * Store the RSA result into the output SRAM data region as 'n_len' bytes + * (the key size): the low 'result_len' bytes are result_be (big-endian), + * the rest is zero. sram_as is a 0-based AddressSpace over the SRAM, so the + * offset from aspeed_acry_operand_offset() is used directly; each data dword + * is written as a little-endian word. + */ +static bool aspeed_acry_store_result(AspeedACRYState *s, + const uint8_t *result_be, + int result_len, int n_len, Error **errp) +{ + uint32_t result_word; + MemTxResult res; + int offset; + int src; + int i; + int j; + + /* result_be is MSB-first; take bytes from its LSB end. */ + src = result_len - 1; + for (i = 0; i < n_len / ASPEED_ACRY_BYTES_PER_DWORD; i++) { + /* Pack up to 4 result bytes (LSB first) into a little-endian dword. */ + result_word = 0; + for (j = 0; j < ASPEED_ACRY_BYTES_PER_DWORD; j++) { + if (src >= 0) { + result_word |= (uint32_t)result_be[src--] << (8 * j); + } + } + + offset = aspeed_acry_operand_offset(ASPEED_ACRY_DATA_OFFSET, + ASPEED_ACRY_BYTES_PER_DWORD * i); + address_space_stl_le(&s->sram_as, offset, result_word, + MEMTXATTRS_UNSPECIFIED, &res); + if (res != MEMTX_OK) { + error_setg(errp, "failed to write result to SRAM"); + return false; + } + } + + return true; +} + +static void aspeed_acry_clear_result(AspeedACRYState *s) +{ + MemTxResult res; + int offset; + int i; + + for (i = 0; i < ASPEED_ACRY_MAX_BYTES / ASPEED_ACRY_BYTES_PER_DWORD; i++) { + offset = aspeed_acry_operand_offset(ASPEED_ACRY_DATA_OFFSET, + ASPEED_ACRY_BYTES_PER_DWORD * i); + address_space_stl_le(&s->sram_as, offset, 0, + MEMTXATTRS_UNSPECIFIED, &res); + if (res != MEMTX_OK) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to clear result\n", + __func__); + return; + } + } +} + +static bool aspeed_acry_do_rsa(AspeedACRYState *s, Error **errp) +{ + QCryptoAkCipherOptions opts = { + .alg = QCRYPTO_AK_CIPHER_ALGO_RSA, + .u.rsa = { + .padding_alg = QCRYPTO_RSA_PADDING_ALGO_RAW, + }, + }; + uint32_t len = FIELD_EX32(s->regs[R_ACRY_DMA_LEN], ACRY_DMA_LEN, DATALEN); + g_autofree uint8_t *src_buf = g_malloc0(ASPEED_ACRY_SRAM_SIZE); + g_autofree uint8_t *data = g_malloc0(ASPEED_ACRY_DATA_MAX_LEN); + uint8_t result[ASPEED_ACRY_MAX_BYTES] = { 0 }; + uint64_t src_addr = s->regs[R_ACRY_DMA_SRC]; + g_autofree uint8_t *der_key = NULL; + uint8_t n[ASPEED_ACRY_MAX_BYTES]; + uint8_t e[ASPEED_ACRY_MAX_BYTES]; + QCryptoAkCipher *cipher = NULL; + int result_len = 0; + size_t der_len; + int data_len; + int n_len; + int e_len; + + if (!qcrypto_akcipher_supports(&opts)) { + error_setg(errp, "RSA ModExp not supported by the crypto backend"); + return false; + } + + if (len == 0 || len > ASPEED_ACRY_SRAM_SIZE) { + error_setg(errp, "invalid DMA length %u", len); + return false; + } + + trace_aspeed_acry_rsa_trigger(src_addr, len); + + if (address_space_read(&s->dram_as, src_addr, MEMTXATTRS_UNSPECIFIED, + src_buf, len) != MEMTX_OK) { + error_setg(errp, "failed to read DMA buffer at 0x%" PRIx64, src_addr); + return false; + } + + n_len = aspeed_acry_extract_be(src_buf, ASPEED_ACRY_MOD_OFFSET, + ASPEED_ACRY_MAX_BYTES, n); + e_len = aspeed_acry_extract_be(src_buf, ASPEED_ACRY_EXP_OFFSET, + ASPEED_ACRY_MAX_BYTES, e); + data_len = aspeed_acry_extract_be(src_buf, ASPEED_ACRY_DATA_OFFSET, + ASPEED_ACRY_DATA_MAX_LEN, data); + + if (trace_event_get_state_backends(TRACE_ASPEED_ACRY_HEXDUMP)) { + aspeed_acry_hexdump("buf", src_buf, len); + aspeed_acry_hexdump("n", n, n_len); + aspeed_acry_hexdump("e", e, e_len); + aspeed_acry_hexdump("data", data, data_len); + } + + der_key = aspeed_acry_der_encode_pubkey(n, n_len, e, e_len, &der_len); + cipher = qcrypto_akcipher_new(&opts, QCRYPTO_AK_CIPHER_KEY_TYPE_PUBLIC, + der_key, der_len, errp); + if (!cipher) { + error_prepend(errp, "failed to create RSA cipher: "); + return false; + } + + result_len = qcrypto_akcipher_encrypt(cipher, data, data_len, + result, sizeof(result), errp); + qcrypto_akcipher_free(cipher); + if (result_len < 0) { + error_prepend(errp, "RSA modexp failed: "); + return false; + } + + if (!aspeed_acry_store_result(s, result, result_len, n_len, errp)) { + return false; + } + + if (trace_event_get_state_backends(TRACE_ASPEED_ACRY_HEXDUMP)) { + aspeed_acry_hexdump("result", result, result_len); + } + + return true; +} + +static uint64_t aspeed_acry_read(void *opaque, hwaddr offset, unsigned int size) +{ + AspeedACRYState *s = ASPEED_ACRY(opaque); + uint32_t reg = offset >> 2; + + trace_aspeed_acry_read(offset, s->regs[reg]); + + return s->regs[reg]; +} + +static void aspeed_acry_write(void *opaque, hwaddr offset, uint64_t data, + unsigned int size) +{ + AspeedACRYState *s = ASPEED_ACRY(opaque); + uint32_t reg = offset >> 2; + Error *local_err = NULL; + + trace_aspeed_acry_write(offset, data); + + switch (reg) { + case R_ACRY_DMA_SRC: + /* + * The DMA source register holds a CPU-visible DRAM address (e.g. + * 0x8xxxxxxx on AST2600); the engine addresses DRAM from offset 0, + * so mask off the top bit to get the DRAM-relative offset. + */ + data &= 0x7FFFFFFF; + break; + case R_ACRY_STATUS: + data = s->regs[R_ACRY_STATUS] & ~data; + if (!(data & (R_ACRY_STATUS_RSA_ENG_DONE_MASK | + R_ACRY_STATUS_RSA_DMA_DONE_MASK))) { + qemu_irq_lower(s->irq); + } + break; + case R_ACRY_TRIGGER: + if (FIELD_EX32(data, ACRY_TRIGGER, RSA_START)) { + if (!aspeed_acry_do_rsa(s, &local_err)) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: %s\n", __func__, + error_get_pretty(local_err)); + error_free(local_err); + aspeed_acry_clear_result(s); + } + + s->regs[R_ACRY_STATUS] |= R_ACRY_STATUS_RSA_ENG_DONE_MASK | + R_ACRY_STATUS_RSA_DMA_DONE_MASK; + if (s->regs[R_ACRY_INT_MASK] & + (R_ACRY_INT_MASK_RSA_ENG_MASK_MASK | + R_ACRY_INT_MASK_RSA_DMA_MASK_MASK)) { + qemu_irq_raise(s->irq); + } + } + break; + default: + break; + } + + s->regs[reg] = data; +} + +static const MemoryRegionOps aspeed_acry_ops = { + .read = aspeed_acry_read, + .write = aspeed_acry_write, + .endianness = DEVICE_LITTLE_ENDIAN, + .valid = { + .min_access_size = 1, + .max_access_size = 4, + }, +}; + +static void aspeed_acry_reset_hold(Object *obj, ResetType type) +{ + AspeedACRYState *s = ASPEED_ACRY(obj); + + memset(s->regs, 0, sizeof(s->regs)); +} + +static void aspeed_acry_realize(DeviceState *dev, Error **errp) +{ + SysBusDevice *sbd = SYS_BUS_DEVICE(dev); + AspeedACRYState *s = ASPEED_ACRY(dev); + + if (!s->dram_mr) { + error_setg(errp, TYPE_ASPEED_ACRY ": 'dram' link not set"); + return; + } + + if (!s->sram_mr) { + error_setg(errp, TYPE_ASPEED_ACRY ": 'sram' link not set"); + return; + } + + address_space_init(&s->dram_as, s->dram_mr, "dram"); + address_space_init(&s->sram_as, s->sram_mr, "sram"); + + memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_acry_ops, s, + TYPE_ASPEED_ACRY, ASPEED_ACRY_NR_REGS << 2); + sysbus_init_mmio(sbd, &s->iomem); + + sysbus_init_irq(sbd, &s->irq); +} + +static const Property aspeed_acry_properties[] = { + DEFINE_PROP_LINK("dram", AspeedACRYState, dram_mr, + TYPE_MEMORY_REGION, MemoryRegion *), + DEFINE_PROP_LINK("sram", AspeedACRYState, sram_mr, + TYPE_MEMORY_REGION, MemoryRegion *), +}; + +static void aspeed_acry_class_init(ObjectClass *klass, const void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + ResettableClass *rc = RESETTABLE_CLASS(klass); + + dc->desc = "ASPEED ACRY Engine"; + dc->realize = aspeed_acry_realize; + rc->phases.hold = aspeed_acry_reset_hold; + device_class_set_props(dc, aspeed_acry_properties); +} + +static const TypeInfo aspeed_acry_types[] = { + { + .name = TYPE_ASPEED_ACRY, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(AspeedACRYState), + .class_init = aspeed_acry_class_init, + }, +}; + +DEFINE_TYPES(aspeed_acry_types) diff --git a/hw/misc/meson.build b/hw/misc/meson.build index e86d9ad6b3..3912dc2bce 100644 --- a/hw/misc/meson.build +++ b/hw/misc/meson.build @@ -137,6 +137,7 @@ system_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c')) system_ss.add(when: 'CONFIG_PVPANIC_MMIO', if_true: files('pvpanic-mmio.c')) system_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c')) system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files( + 'aspeed_acry.c', 'aspeed_hace.c', 'aspeed_lpc.c', 'aspeed_ltpi.c', diff --git a/hw/misc/trace-events b/hw/misc/trace-events index c9a868b3ef..bbec0d2178 100644 --- a/hw/misc/trace-events +++ b/hw/misc/trace-events @@ -331,6 +331,12 @@ aspeed_peci_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" aspeed_peci_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64 aspeed_peci_raise_interrupt(uint32_t ctrl, uint32_t status) "ctrl 0x%" PRIx32 " status 0x%" PRIx32 +# aspeed_acry.c +aspeed_acry_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64 +aspeed_acry_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64 +aspeed_acry_rsa_trigger(uint64_t src_addr, uint32_t len) "src_addr 0x%" PRIx64 " len 0x%" PRIx32 +aspeed_acry_hexdump(const char *desc, uint32_t offset, const char *s) "%s: 0x%08x: %s" + # aspeed_hace.c aspeed_hace_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64 aspeed_hace_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64 -- 2.53.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v4 2/4] hw/arm/aspeed_ast2600: Introduce the ACRY SRAM 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin 2026-09-01 8:15 ` [PATCH v4 1/4] hw/misc/aspeed_acry: Add ASPEED ACRY model Jamin Lin @ 2026-09-01 8:15 ` Jamin Lin 2026-09-01 8:15 ` [PATCH v4 3/4] hw/arm/aspeed_ast2600: Wire up the ACRY model Jamin Lin ` (3 subsequent siblings) 5 siblings, 0 replies; 7+ messages in thread From: Jamin Lin @ 2026-09-01 8:15 UTC (permalink / raw) To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Jamin Lin, Troy Lee Reuse the existing SRAM array convention on AspeedSoCState to add the 64 KiB ACRY SRAM region to the AST2600 at its real-silicon address (0x1e710000-0x1e71ffff). Wrap the RAM in a container mapped at offset 0 so the ACRY engine wired up in a later patch can address the SRAM by relative offset without the device model knowing its mapping address. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> --- include/hw/arm/aspeed_soc.h | 1 + hw/arm/aspeed_ast2600.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h index cd68c7f1ca..46e7854727 100644 --- a/include/hw/arm/aspeed_soc.h +++ b/include/hw/arm/aspeed_soc.h @@ -69,6 +69,7 @@ struct AspeedSoCState { MemoryRegion *dram_mr; MemoryRegion dram_container; MemoryRegion sram[ASPEED_SRAM_NUM]; + MemoryRegion sram_container[ASPEED_SRAM_NUM]; MemoryRegion spi_boot_container; MemoryRegion spi_boot; MemoryRegion vbootrom; diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c index d1f18e471a..f23a51c8a4 100644 --- a/hw/arm/aspeed_ast2600.c +++ b/hw/arm/aspeed_ast2600.c @@ -8,6 +8,7 @@ */ #include "qemu/osdep.h" +#include "qemu/units.h" #include "qapi/error.h" #include "hw/misc/unimp.h" #include "hw/arm/aspeed_soc.h" @@ -24,6 +25,7 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = { [ASPEED_DEV_SPI_BOOT] = 0x00000000, [ASPEED_DEV_SRAM0] = 0x10000000, + [ASPEED_DEV_SRAM1] = 0x1E710000, /* ACRY SRAM */ [ASPEED_DEV_DPMCU] = 0x18000000, /* 0x16000000 0x17FFFFFF : AHB BUS do LPC Bus bridge */ [ASPEED_DEV_IOMEM] = 0x1E600000, @@ -361,6 +363,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) AspeedSoCState *s = ASPEED_SOC(dev); AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s); qemu_irq irq; + g_autofree char *sram1_name = NULL; g_autofree char *sram_name = NULL; int uart; @@ -444,6 +447,19 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM0], &s->sram[0]); + /* ACRY SRAM */ + sram1_name = g_strdup_printf("aspeed.acry.sram.%d", + CPU(&a->cpu[0])->cpu_index); + if (!memory_region_init_ram(&s->sram[1], OBJECT(s), sram1_name, + sc->sram_size[1], errp)) { + return; + } + memory_region_init(&s->sram_container[1], OBJECT(s), + "aspeed.acry.sram-container", sc->sram_size[1]); + memory_region_add_subregion(&s->sram_container[1], 0, &s->sram[1]); + memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM1], + &s->sram_container[1]); + /* DPMCU */ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->dpmcu), "aspeed.dpmcu", @@ -765,6 +781,7 @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, const void *data) sc->valid_cpu_types = valid_cpu_types; sc->silicon_rev = AST2600_A3_SILICON_REV; sc->sram_size[0] = 0x16400; + sc->sram_size[1] = 64 * KiB; /* ACRY SRAM */ sc->spis_num = 2; sc->ehcis_num = 2; sc->wdts_num = 4; -- 2.53.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v4 3/4] hw/arm/aspeed_ast2600: Wire up the ACRY model 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin 2026-09-01 8:15 ` [PATCH v4 1/4] hw/misc/aspeed_acry: Add ASPEED ACRY model Jamin Lin 2026-09-01 8:15 ` [PATCH v4 2/4] hw/arm/aspeed_ast2600: Introduce the ACRY SRAM Jamin Lin @ 2026-09-01 8:15 ` Jamin Lin 2026-09-01 8:15 ` [PATCH v4 4/4] tests/qtest/aspeed-acry-test: Add RSA ModExp tests Jamin Lin ` (2 subsequent siblings) 5 siblings, 0 replies; 7+ messages in thread From: Jamin Lin @ 2026-09-01 8:15 UTC (permalink / raw) To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Jamin Lin, Troy Lee, Philippe Mathieu-Daudé Introduce the ASPEED_DEV_ACRY enum slot and add the ACRY model state to AspeedSoCState. Instantiate the new ACRY model on the AST2600 SoC using its real-silicon register address and IRQ: - ACRY register region 0x1e6fa000-0x1e6fafff - IRQ 160 Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> --- include/hw/arm/aspeed_soc.h | 3 +++ hw/arm/aspeed_ast2600.c | 17 +++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h index 46e7854727..8d80f16705 100644 --- a/include/hw/arm/aspeed_soc.h +++ b/include/hw/arm/aspeed_soc.h @@ -25,6 +25,7 @@ #include "hw/i2c/aspeed_i2c.h" #include "hw/i3c/aspeed_i3c.h" #include "hw/ssi/aspeed_smc.h" +#include "hw/misc/aspeed_acry.h" #include "hw/misc/aspeed_hace.h" #include "hw/misc/aspeed_sbc.h" #include "hw/misc/aspeed_sli.h" @@ -82,6 +83,7 @@ struct AspeedSoCState { AspeedSCUState scu; AspeedSCUState scuio; AspeedHACEState hace; + AspeedACRYState acry; AspeedXDMAState xdma; AspeedADCState adc; AspeedSMCState fmc; @@ -271,6 +273,7 @@ enum { ASPEED_DEV_EMMC, ASPEED_DEV_KCS, ASPEED_DEV_HACE, + ASPEED_DEV_ACRY, ASPEED_DEV_DPMCU, ASPEED_DEV_DP, ASPEED_DEV_I3C, diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c index f23a51c8a4..f7c7ec7fb1 100644 --- a/hw/arm/aspeed_ast2600.c +++ b/hw/arm/aspeed_ast2600.c @@ -52,6 +52,7 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = { [ASPEED_DEV_DP] = 0x1E6EB000, [ASPEED_DEV_PCIE_PHY1] = 0x1E6ED200, [ASPEED_DEV_SBC] = 0x1E6F2000, + [ASPEED_DEV_ACRY] = 0x1E6FA000, [ASPEED_DEV_EMMC_BC] = 0x1E6f5000, [ASPEED_DEV_VIDEO] = 0x1E700000, [ASPEED_DEV_SDHCI] = 0x1E740000, @@ -144,6 +145,7 @@ static const int aspeed_soc_ast2600_irqmap[] = { [ASPEED_DEV_FSI1] = 100, [ASPEED_DEV_FSI2] = 101, [ASPEED_DEV_I3C] = 102, /* 102 -> 107 */ + [ASPEED_DEV_ACRY] = 160, }; static qemu_irq aspeed_soc_ast2600_get_irq(AspeedSoCState *s, int dev) @@ -269,6 +271,8 @@ static void aspeed_soc_ast2600_init(Object *obj) snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname); object_initialize_child(obj, "hace", &s->hace, typename); + object_initialize_child(obj, "acry", &s->acry, TYPE_ASPEED_ACRY); + object_initialize_child(obj, "i3c", &s->i3c, TYPE_ASPEED_I3C); object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST2600_SBC); @@ -726,6 +730,19 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0, aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_HACE)); + /* ACRY */ + object_property_set_link(OBJECT(&s->acry), "dram", OBJECT(s->dram_mr), + &error_abort); + object_property_set_link(OBJECT(&s->acry), "sram", OBJECT(&s->sram[1]), + &error_abort); + if (!sysbus_realize(SYS_BUS_DEVICE(&s->acry), errp)) { + return; + } + aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->acry), 0, + sc->memmap[ASPEED_DEV_ACRY]); + sysbus_connect_irq(SYS_BUS_DEVICE(&s->acry), 0, + aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_ACRY)); + /* I3C */ if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) { return; -- 2.53.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v4 4/4] tests/qtest/aspeed-acry-test: Add RSA ModExp tests 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin ` (2 preceding siblings ...) 2026-09-01 8:15 ` [PATCH v4 3/4] hw/arm/aspeed_ast2600: Wire up the ACRY model Jamin Lin @ 2026-09-01 8:15 ` Jamin Lin 2026-09-01 12:28 ` [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Cédric Le Goater 2026-09-02 6:11 ` Cédric Le Goater 5 siblings, 0 replies; 7+ messages in thread From: Jamin Lin @ 2026-09-01 8:15 UTC (permalink / raw) To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Jamin Lin, Troy Lee Add qtest cases exercising the AST2600 ACRY RSA ModExp engine end to end. Each case lays out the exponent, modulus and message in the scattered SRAM byte layout the engine expects, triggers the engine, checks that both completion bits (RSA_ENG_DONE and RSA_DMA_DONE) are asserted together in the status register, reads the result back from the result SRAM, and checks the status bits clear afterwards. Comparing the result against a known-answer ciphertext also validates the SRAM byte mapping end to end. The cases cover raw (unpadded) public-exponent RSA, c = m^e mod n - exactly what the "rsa" akcipher transform backed by the ACRY FW performs, since PKCS1 padding is applied by a separate template layered on top in Linux, not by the ACRY hardware. QEMU's akcipher backend only implements raw RSA via libgcrypt, so the tests skip rather than fail when the build lacks it. The 2048-bit and 4096-bit vectors are rsa_tv_template[2] and [3] from the Linux kernel crypto self-test suite (crypto/testmgr.h, v6.18). Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> --- tests/qtest/aspeed-acry-test.c | 406 +++++++++++++++++++++++++++++++++ tests/qtest/meson.build | 5 +- 2 files changed, 410 insertions(+), 1 deletion(-) create mode 100644 tests/qtest/aspeed-acry-test.c diff --git a/tests/qtest/aspeed-acry-test.c b/tests/qtest/aspeed-acry-test.c new file mode 100644 index 0000000000..ec348c2206 --- /dev/null +++ b/tests/qtest/aspeed-acry-test.c @@ -0,0 +1,406 @@ +/* + * QTest testcase for the ASPEED ACRY Engine + * + * Copyright (C) 2026 ASPEED Technology Inc. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqtest.h" +#include "qemu/bitops.h" +#include "crypto/akcipher.h" + +#define ACRY_TRIGGER 0x000 +#define ACRY_TRIGGER_RSA_DMA_DATA BIT(1) +#define ACRY_TRIGGER_RSA_START BIT(0) +#define ACRY_DMA_CMD 0x048 +#define ACRY_DMA_CMD_DMEM_AHB BIT(8) +#define ACRY_DMA_CMD_SRAM_MODE_RSA (0x3 << 4) +#define ACRY_DMA_SRC 0x04C +#define ACRY_DMA_LEN 0x050 +#define ACRY_RSA_KEY_LEN 0x058 +#define ACRY_INT_MASK 0x3F8 +#define ACRY_INT_MASK_RSA_DMA_MASK BIT(2) +#define ACRY_INT_MASK_RSA_ENG_MASK BIT(1) +#define ACRY_STATUS 0x3FC +#define ACRY_STATUS_RSA_DMA_DONE BIT(2) +#define ACRY_STATUS_RSA_ENG_DONE BIT(1) +#define ACRY_STATUS_RSA_DONE (ACRY_STATUS_RSA_ENG_DONE | \ + ACRY_STATUS_RSA_DMA_DONE) + +#define ACRY_DATA_MAX_LEN 0x800 +#define ACRY_SRAM_SIZE (3 * ACRY_DATA_MAX_LEN) +#define ACRY_MAX_BITS 4096 +#define ACRY_MAX_BYTES (ACRY_MAX_BITS / 8) + +#define ACRY_BYTES_PER_DWORD 4 +#define ACRY_LANES_PER_BLOCK 4 +/* Each block holds 3 regions (exp, mod, data) of LANES_PER_BLOCK dwords. */ +#define ACRY_DWORDS_PER_BLOCK (3 * ACRY_LANES_PER_BLOCK) + +/* Dwords into each block where each operand's region starts. */ +#define ACRY_EXP_OFFSET (0 * ACRY_LANES_PER_BLOCK) +#define ACRY_MOD_OFFSET (1 * ACRY_LANES_PER_BLOCK) +#define ACRY_DATA_OFFSET (2 * ACRY_LANES_PER_BLOCK) + +/* + * Raw (unpadded) RSA known-answer vectors: c = m^e mod n with + * e = 0x10001 (65537) - exactly what the "rsa" akcipher transform backed by + * the ACRY FW computes. PKCS1 padding is a separate "pkcs1pad(rsa)" template + * layered on top in Linux, not done by the ACRY hardware. + * + * rsa2048_* and rsa4096_* are from the Linux kernel crypto/testmgr.h (v6.18), + * rsa_tv_template[2] and [3]. Grep that file's own comment to find them: + * + * RSA test vectors. Borrowed from openSSL. + * + * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/crypto/testmgr.h?h=v6.18 + * + * There the modulus n is DER-encoded in the .key field (not a raw field), the + * ciphertext is .c, and every entry reuses the same 8-byte .m message. + */ +/* rsa_tv_template[].m, shared by every entry */ +static const uint8_t rsa_m[8] = { + 0x54, 0x85, 0x9B, 0x34, 0x2C, 0x49, 0xEA, 0x2A, +}; +/* public exponent e = 65537, DER-encoded in every .key */ +static const uint8_t rsa_e[3] = { 0x01, 0x00, 0x01 }; + +/* rsa_tv_template[2].key, modulus n */ +static const uint8_t rsa2048_n[256] = { + 0xDB, 0x10, 0x1A, 0xC2, 0xA3, 0xF1, 0xDC, 0xFF, 0x13, 0x6B, 0xED, 0x44, + 0xDF, 0xF0, 0x02, 0x6D, 0x13, 0xC7, 0x88, 0xDA, 0x70, 0x6B, 0x54, 0xF1, + 0xE8, 0x27, 0xDC, 0xC3, 0x0F, 0x99, 0x6A, 0xFA, 0xC6, 0x67, 0xFF, 0x1D, + 0x1E, 0x3C, 0x1D, 0xC1, 0xB5, 0x5F, 0x6C, 0xC0, 0xB2, 0x07, 0x3A, 0x6D, + 0x41, 0xE4, 0x25, 0x99, 0xAC, 0xFC, 0xD2, 0x0F, 0x02, 0xD3, 0xD1, 0x54, + 0x06, 0x1A, 0x51, 0x77, 0xBD, 0xB6, 0xBF, 0xEA, 0xA7, 0x5C, 0x06, 0xA9, + 0x5D, 0x69, 0x84, 0x45, 0xD7, 0xF5, 0x05, 0xBA, 0x47, 0xF0, 0x1B, 0xD7, + 0x2B, 0x24, 0xEC, 0xCB, 0x9B, 0x1B, 0x10, 0x8D, 0x81, 0xA0, 0xBE, 0xB1, + 0x8C, 0x33, 0xE4, 0x36, 0xB8, 0x43, 0xEB, 0x19, 0x2A, 0x81, 0x8D, 0xDE, + 0x81, 0x0A, 0x99, 0x48, 0xB6, 0xF6, 0xBC, 0xCD, 0x49, 0x34, 0x3A, 0x8F, + 0x26, 0x94, 0xE3, 0x28, 0x82, 0x1A, 0x7C, 0x8F, 0x59, 0x9F, 0x45, 0xE8, + 0x5D, 0x1A, 0x45, 0x76, 0x04, 0x56, 0x05, 0xA1, 0xD0, 0x1B, 0x8C, 0x77, + 0x6D, 0xAF, 0x53, 0xFA, 0x71, 0xE2, 0x67, 0xE0, 0x9A, 0xFE, 0x03, 0xA9, + 0x85, 0xD2, 0xC9, 0xAA, 0xBA, 0x2A, 0xBC, 0xF4, 0xA0, 0x08, 0xF5, 0x13, + 0x98, 0x13, 0x5D, 0xF0, 0xD9, 0x33, 0x34, 0x2A, 0x61, 0xC3, 0x89, 0x55, + 0xF0, 0xAE, 0x1A, 0x9C, 0x22, 0xEE, 0x19, 0x05, 0x8D, 0x32, 0xFE, 0xEC, + 0x9C, 0x84, 0xBA, 0xB7, 0xF9, 0x6C, 0x3A, 0x4F, 0x07, 0xFC, 0x45, 0xEB, + 0x12, 0xE5, 0x7B, 0xFD, 0x55, 0xE6, 0x29, 0x69, 0xD1, 0xC2, 0xE8, 0xB9, + 0x78, 0x59, 0xF6, 0x79, 0x10, 0xC6, 0x4E, 0xEB, 0x6A, 0x5E, 0xB9, 0x9A, + 0xC7, 0xC4, 0x5B, 0x63, 0xDA, 0xA3, 0x3F, 0x5E, 0x92, 0x7A, 0x81, 0x5E, + 0xD6, 0xB0, 0xE2, 0x62, 0x8F, 0x74, 0x26, 0xC2, 0x0C, 0xD3, 0x9A, 0x17, + 0x47, 0xE6, 0x8E, 0xAB, +}; +/* rsa_tv_template[2].c */ +static const uint8_t rsa2048_c[256] = { + 0xB2, 0x97, 0x76, 0xB4, 0xAE, 0x3E, 0x38, 0x3C, 0x7E, 0x64, 0x1F, 0xCC, + 0xA2, 0x7F, 0xF6, 0xBE, 0xCF, 0x49, 0xBC, 0x48, 0xD3, 0x6C, 0x8F, 0x0A, + 0x0E, 0xC1, 0x73, 0xBD, 0x7B, 0x55, 0x79, 0x36, 0x0E, 0xA1, 0x87, 0x88, + 0xB9, 0x2C, 0x90, 0xA6, 0x53, 0x5E, 0xE9, 0xEF, 0xC4, 0xE2, 0x4D, 0xDD, + 0xF7, 0xA6, 0x69, 0x82, 0x3F, 0x56, 0xA4, 0x7B, 0xFB, 0x62, 0xE0, 0xAE, + 0xB8, 0xD3, 0x04, 0xB3, 0xAC, 0x5A, 0x15, 0x2A, 0xE3, 0x19, 0x9B, 0x03, + 0x9A, 0x0B, 0x41, 0xDA, 0x64, 0xEC, 0x0A, 0x69, 0xFC, 0xF2, 0x10, 0x92, + 0xF3, 0xC1, 0xBF, 0x84, 0x7F, 0xFD, 0x2C, 0xAE, 0xC8, 0xB5, 0xF6, 0x41, + 0x70, 0xC5, 0x47, 0x03, 0x8A, 0xF8, 0xFF, 0x6F, 0x3F, 0xD2, 0x6F, 0x09, + 0xB4, 0x22, 0xF3, 0x30, 0xBE, 0xA9, 0x85, 0xCB, 0x9C, 0x8D, 0xF9, 0x8F, + 0xEB, 0x32, 0x91, 0xA2, 0x25, 0x84, 0x8F, 0xF5, 0xDC, 0xC7, 0x06, 0x9C, + 0x2D, 0xE5, 0x11, 0x2C, 0x09, 0x09, 0x87, 0x09, 0xA9, 0xF6, 0x33, 0x73, + 0x90, 0xF1, 0x60, 0xF2, 0x65, 0xDD, 0x30, 0xA5, 0x66, 0xCE, 0x62, 0x7B, + 0xD0, 0xF8, 0x2D, 0x3D, 0x19, 0x82, 0x77, 0xE3, 0x0A, 0x5F, 0x75, 0x2F, + 0x8E, 0xB1, 0xE5, 0xE8, 0x91, 0x35, 0x1B, 0x3B, 0x33, 0xB7, 0x66, 0x92, + 0xD1, 0xF2, 0x8E, 0x6F, 0xE5, 0x75, 0x0C, 0xAD, 0x36, 0xFB, 0x4E, 0xD0, + 0x66, 0x61, 0xBD, 0x49, 0xFE, 0xF4, 0x1A, 0xA2, 0x2B, 0x49, 0xFE, 0x03, + 0x4C, 0x74, 0x47, 0x8D, 0x9A, 0x66, 0xB2, 0x49, 0x46, 0x4D, 0x77, 0xEA, + 0x33, 0x4D, 0x6B, 0x3C, 0xB4, 0x49, 0x4A, 0xC6, 0x7D, 0x3D, 0xB5, 0xB9, + 0x56, 0x41, 0x15, 0x67, 0x0F, 0x94, 0x3C, 0x93, 0x65, 0x27, 0xE0, 0x21, + 0x5D, 0x59, 0xC3, 0x62, 0xD5, 0xA6, 0xDA, 0x38, 0x26, 0x22, 0x5E, 0x34, + 0x1C, 0x94, 0xAF, 0x98, +}; + +/* rsa_tv_template[3].key, modulus n */ +static const uint8_t rsa4096_n[512] = { + 0xC3, 0x8B, 0x55, 0x7B, 0x73, 0x4D, 0xFF, 0xE9, 0x9B, 0xC6, 0xDC, 0x67, + 0x3C, 0xB4, 0x8E, 0xA0, 0x86, 0xED, 0xF2, 0xB9, 0x50, 0x5C, 0x54, 0x5C, + 0xBA, 0xE4, 0xA1, 0xB2, 0xA7, 0xAE, 0x2F, 0x1B, 0x7D, 0xF1, 0xFB, 0xAC, + 0x79, 0xC5, 0xDF, 0x1A, 0x00, 0xC9, 0xB2, 0xC1, 0x61, 0x25, 0x33, 0xE6, + 0x9C, 0xE9, 0xCF, 0xD6, 0x27, 0xC4, 0x4E, 0x44, 0x30, 0x44, 0x5E, 0x08, + 0xA1, 0x87, 0x52, 0xCC, 0x6B, 0x97, 0x70, 0x8C, 0xBC, 0xA5, 0x06, 0x31, + 0x0C, 0xD4, 0x2F, 0xD5, 0x7D, 0x26, 0x24, 0xA2, 0xE2, 0xAC, 0x78, 0xF4, + 0x53, 0x14, 0xCE, 0xF7, 0x19, 0x2E, 0xD7, 0xF7, 0xE6, 0x0C, 0xB9, 0x56, + 0x7F, 0x0B, 0xF1, 0xB1, 0xE2, 0x43, 0x70, 0xBD, 0x86, 0x1D, 0xA1, 0xCC, + 0x2B, 0x19, 0x08, 0x76, 0xEF, 0x91, 0xAC, 0xBF, 0x20, 0x24, 0x0D, 0x38, + 0xC0, 0x89, 0xB8, 0x9A, 0x70, 0xB3, 0x64, 0xD9, 0x8F, 0x80, 0x41, 0x10, + 0x5B, 0x9F, 0xB1, 0xCB, 0x76, 0x43, 0x00, 0x21, 0x25, 0x36, 0xD4, 0x19, + 0xFC, 0x55, 0x95, 0x10, 0xE4, 0x26, 0x74, 0x98, 0x2C, 0xD9, 0xBD, 0x0B, + 0x2B, 0x04, 0xC2, 0xAC, 0x82, 0x38, 0xB4, 0xDD, 0x4C, 0x04, 0x7E, 0x51, + 0x36, 0x40, 0x1E, 0x0B, 0xC4, 0x7C, 0x25, 0xDD, 0x4B, 0xB2, 0xE7, 0x20, + 0x0A, 0x57, 0xF9, 0xB4, 0x94, 0xC3, 0x08, 0x33, 0x22, 0x6F, 0x8B, 0x48, + 0xDB, 0x03, 0x68, 0x5A, 0x5B, 0xBA, 0xAE, 0xF3, 0xAD, 0xCF, 0xC3, 0x6D, + 0xBA, 0xF1, 0x28, 0x67, 0x7E, 0x6C, 0x79, 0x07, 0xDE, 0xFC, 0xED, 0xE7, + 0x96, 0xE3, 0x6C, 0xE0, 0x2C, 0x87, 0xF8, 0x02, 0x01, 0x28, 0x38, 0x43, + 0x21, 0x53, 0x84, 0x69, 0x75, 0x78, 0x15, 0x7E, 0xEE, 0xD2, 0x1B, 0xB9, + 0x23, 0x40, 0xA8, 0x86, 0x1E, 0x38, 0x83, 0xB2, 0x73, 0x1D, 0x53, 0xFB, + 0x9E, 0x2A, 0x8A, 0xB2, 0x75, 0x35, 0x01, 0xC3, 0xC3, 0xC4, 0x94, 0xE8, + 0x84, 0x86, 0x64, 0x81, 0xF4, 0x42, 0xAA, 0x3C, 0x0E, 0xD6, 0x4F, 0xBC, + 0x0A, 0x09, 0x2D, 0xE7, 0x1B, 0xD4, 0x10, 0xA8, 0x54, 0xEA, 0x89, 0x84, + 0x8A, 0xCB, 0xF7, 0x5A, 0x3C, 0xCA, 0x76, 0x08, 0x29, 0x62, 0xB4, 0x6A, + 0x22, 0xDF, 0x14, 0x95, 0x71, 0xFD, 0xB6, 0x86, 0x39, 0xB8, 0x8B, 0xF8, + 0x91, 0x7F, 0x38, 0xAA, 0x14, 0xCD, 0xE5, 0xF5, 0x1D, 0xC2, 0x6D, 0x53, + 0x69, 0x52, 0x84, 0x7F, 0xA3, 0x1A, 0x5E, 0x26, 0x04, 0x83, 0x06, 0x73, + 0x52, 0x56, 0xCF, 0x76, 0x26, 0xC9, 0xDD, 0x75, 0xD7, 0xFC, 0xF4, 0x69, + 0xD8, 0x7B, 0x55, 0xB7, 0x68, 0x13, 0x53, 0xB9, 0xE7, 0x89, 0xC3, 0xE8, + 0xD6, 0x6E, 0xA7, 0x6D, 0xEA, 0x81, 0xFD, 0xC4, 0xB7, 0x05, 0x5A, 0xB7, + 0x41, 0x0A, 0x23, 0x8E, 0x03, 0x8A, 0x1C, 0xAE, 0xD3, 0x1E, 0xCE, 0xE3, + 0x5E, 0xFC, 0x19, 0x4A, 0xEE, 0x61, 0x9B, 0x8E, 0xE5, 0xE5, 0xDD, 0x85, + 0xF9, 0x41, 0xEC, 0x14, 0x53, 0x92, 0xF7, 0xDD, 0x06, 0x85, 0x02, 0x91, + 0xE3, 0xEB, 0x6C, 0x43, 0x03, 0xB1, 0x36, 0x7B, 0x89, 0x5A, 0xA8, 0xEB, + 0xFC, 0xD5, 0xA8, 0x35, 0xDC, 0x81, 0xD9, 0x5C, 0xBD, 0xCA, 0xDC, 0x9B, + 0x98, 0x0B, 0x06, 0x5D, 0x0C, 0x5B, 0xEE, 0xF3, 0xD5, 0xCC, 0x57, 0xC9, + 0x71, 0x2F, 0x90, 0x3B, 0x3C, 0xF0, 0x8E, 0x4E, 0x35, 0x48, 0xAE, 0x63, + 0x74, 0xA9, 0xFC, 0x72, 0x75, 0x8E, 0x34, 0xA8, 0xF2, 0x1F, 0xEA, 0xDF, + 0x3A, 0x37, 0x2D, 0xE5, 0x39, 0x39, 0xF8, 0x57, 0x58, 0x3C, 0x04, 0xFE, + 0x87, 0x06, 0x98, 0xBC, 0x7B, 0xD3, 0x21, 0x36, 0x60, 0x25, 0x54, 0xA7, + 0x3D, 0xFA, 0x91, 0xCC, 0xA8, 0x0B, 0x92, 0x8E, 0xB4, 0xF7, 0x06, 0xFF, + 0x1E, 0x95, 0xCB, 0x07, 0x76, 0x97, 0x3B, 0x9D, +}; +/* rsa_tv_template[3].c */ +static const uint8_t rsa4096_c[512] = { + 0x5C, 0xCE, 0x9C, 0xD7, 0x9A, 0x9E, 0xA1, 0xFE, 0x7A, 0x82, 0x3C, 0x68, + 0x27, 0x98, 0xE3, 0x5D, 0xD5, 0xD7, 0x07, 0x29, 0xF5, 0xFB, 0xC3, 0x1A, + 0x7F, 0x63, 0x1E, 0x62, 0x31, 0x3B, 0x19, 0x87, 0x79, 0x4F, 0xEC, 0x7B, + 0xF3, 0xCB, 0xEA, 0x9B, 0x95, 0x52, 0x3A, 0x40, 0xE5, 0x87, 0x7B, 0x72, + 0xD1, 0x72, 0xC9, 0xFB, 0x54, 0x63, 0xD8, 0xC9, 0xD7, 0x2C, 0xFC, 0x7B, + 0xC3, 0x14, 0x1E, 0xBC, 0x18, 0xB4, 0x34, 0xA1, 0xBF, 0x14, 0xB1, 0x37, + 0x31, 0x6E, 0xF0, 0x1B, 0x35, 0x19, 0x54, 0x07, 0xF7, 0x99, 0xEC, 0x3E, + 0x63, 0xE2, 0xCD, 0x61, 0x28, 0x65, 0xC3, 0xCD, 0xB1, 0x38, 0x36, 0xA5, + 0xB2, 0xD7, 0xB0, 0xDC, 0x1F, 0xF5, 0xEF, 0x19, 0xC7, 0x53, 0x32, 0x2D, + 0x1C, 0x26, 0xDA, 0xE4, 0x0D, 0xD6, 0x90, 0x7E, 0x28, 0xD8, 0xDC, 0xE4, + 0x61, 0x05, 0xD2, 0x25, 0x90, 0x01, 0xD3, 0x96, 0x6D, 0xA6, 0xCF, 0x58, + 0x20, 0xBB, 0x03, 0xF4, 0x01, 0xBC, 0x79, 0xB9, 0x18, 0xD8, 0xB8, 0xBA, + 0xBD, 0x93, 0xFC, 0xF2, 0x62, 0x5D, 0x8C, 0x66, 0x1E, 0x0E, 0x84, 0x59, + 0x93, 0xDD, 0xE2, 0x93, 0xA2, 0x62, 0x7D, 0x08, 0x82, 0x7A, 0xDD, 0xFC, + 0xB8, 0xBC, 0xC5, 0x4F, 0x9C, 0x4E, 0xBF, 0xB4, 0xFC, 0xF4, 0xC5, 0x01, + 0xE8, 0x00, 0x70, 0x4D, 0x28, 0x26, 0xCC, 0x2E, 0xFE, 0x0E, 0x58, 0x41, + 0x8B, 0xEC, 0xAF, 0x7C, 0x4B, 0x54, 0xD0, 0xA0, 0x64, 0xF9, 0x32, 0xF4, + 0x2E, 0x47, 0x65, 0x0A, 0x67, 0x88, 0x39, 0x3A, 0xDB, 0xB2, 0xDB, 0x7B, + 0xB5, 0xF6, 0x17, 0xA8, 0xD9, 0xC6, 0x5E, 0x28, 0x13, 0x82, 0x8A, 0x99, + 0xDB, 0x60, 0x08, 0xA5, 0x23, 0x37, 0xFA, 0x88, 0x90, 0x31, 0xC8, 0x9D, + 0x8F, 0xEC, 0xFB, 0x85, 0x9F, 0xB1, 0xCE, 0xA6, 0x24, 0x50, 0x46, 0x44, + 0x47, 0xCB, 0x65, 0xD1, 0xDF, 0xC0, 0xB1, 0x6C, 0x90, 0x1F, 0x99, 0x8E, + 0x4D, 0xD5, 0x9E, 0x31, 0x07, 0x66, 0x87, 0xDF, 0x01, 0xAA, 0x56, 0x3C, + 0x71, 0xE0, 0x2B, 0x6F, 0x67, 0x3B, 0x23, 0xED, 0xC2, 0xBD, 0x03, 0x30, + 0x79, 0x76, 0x02, 0x10, 0x10, 0x98, 0x85, 0x8A, 0xFF, 0xFD, 0x0B, 0xDA, + 0xA5, 0xD9, 0x32, 0x48, 0x02, 0xA0, 0x0B, 0xB9, 0x2A, 0x8A, 0x18, 0xCA, + 0xC6, 0x8F, 0x3F, 0xBB, 0x16, 0xB2, 0xAA, 0x98, 0x27, 0xE3, 0x60, 0x43, + 0xED, 0x15, 0x70, 0xD4, 0x57, 0x15, 0xFE, 0x19, 0xD4, 0x9B, 0x13, 0x78, + 0x8A, 0xF7, 0x21, 0xF1, 0xA2, 0xA2, 0x2D, 0xB3, 0x09, 0xCF, 0x44, 0x91, + 0x6E, 0x08, 0x3A, 0x30, 0x81, 0x3E, 0x90, 0x93, 0x8A, 0x67, 0x33, 0x00, + 0x59, 0x54, 0x9A, 0x25, 0xD3, 0x49, 0x8E, 0x9F, 0xC1, 0x4B, 0xE5, 0x86, + 0xF3, 0x50, 0x4C, 0xBC, 0xC5, 0xD3, 0xF5, 0x3A, 0x54, 0xE1, 0x36, 0x3F, + 0xE2, 0x5A, 0xB4, 0x37, 0xC0, 0xEB, 0x70, 0x35, 0xEC, 0xF6, 0xB7, 0xE8, + 0x44, 0x3B, 0x7B, 0xF3, 0xF1, 0xF2, 0x1E, 0xDB, 0x60, 0x7D, 0xD5, 0xBE, + 0xF0, 0x71, 0x34, 0x90, 0x4C, 0xCB, 0xD4, 0x35, 0x51, 0xC7, 0xDD, 0xD8, + 0xC9, 0x81, 0xF5, 0x5D, 0x57, 0x46, 0x2C, 0xB1, 0x7B, 0x9B, 0xAA, 0xCB, + 0xD1, 0x22, 0x25, 0x49, 0x44, 0xA3, 0xD4, 0x6B, 0x29, 0x7B, 0xD8, 0xB2, + 0x07, 0x93, 0xBF, 0x3D, 0x52, 0x49, 0x84, 0x79, 0xEF, 0xB8, 0xE5, 0xC4, + 0xAD, 0xCA, 0xA8, 0xC6, 0xF6, 0xA6, 0x76, 0x70, 0x5B, 0x0B, 0xE5, 0x83, + 0xC6, 0x0E, 0xEF, 0x55, 0xF2, 0xE7, 0xFF, 0x04, 0xEA, 0xE6, 0x13, 0xBE, + 0x40, 0xE1, 0x40, 0x45, 0x48, 0x66, 0x75, 0x31, 0xAE, 0x35, 0x64, 0x91, + 0x11, 0x6F, 0xDA, 0xEE, 0x26, 0x86, 0x45, 0x6F, 0x0B, 0xD5, 0x9F, 0x03, + 0xB1, 0x65, 0x5B, 0xDB, 0xA4, 0xE4, 0xF9, 0x45, +}; + +/* + * Offset in the scattered buffer of byte 'op_byte' (0 = least significant) + * of the operand whose region starts 'region' dwords into each 12-dword + * block (0 = exp, 4 = mod, 8 = data). Reproduces the byte layout the ACRY + * engine mandates, so the test lays out its DMA input and decodes the + * result the same way the hardware does. + */ +static int acry_operand_offset(int region, int op_byte) +{ + int byte_in_dword; + int op_dword; + int offset; + int block; + int lane; + + op_dword = op_byte / ACRY_BYTES_PER_DWORD; + byte_in_dword = op_byte % ACRY_BYTES_PER_DWORD; + block = op_dword / ACRY_LANES_PER_BLOCK; + lane = op_dword % ACRY_LANES_PER_BLOCK; + + offset = (block * ACRY_DWORDS_PER_BLOCK + region + lane) + * ACRY_BYTES_PER_DWORD + byte_in_dword; + g_assert_cmpint(offset, <, ACRY_SRAM_SIZE); + + return offset; +} + +/* + * Write a big-endian (most significant byte first) bignum of 'be_len' bytes + * into the scattered buffer region 'region' (exp, mod, or data), placing + * significance level k at acry_operand_offset(region, k). + */ +static void put_bignum_be_bytes(uint8_t *buf, int region, + const uint8_t *be, int be_len) +{ + int be_index; + int offset; + int k; + + /* be[0] (MSB) maps to the highest level; be_index walks up from 0. */ + be_index = 0; + for (k = be_len - 1; k >= 0; k--) { + offset = acry_operand_offset(region, k); + buf[offset] = be[be_index++]; + } +} + +/* Inverse of put_bignum_be_bytes(): gather a big-endian bignum back out. */ +static void get_bignum_be_bytes(const uint8_t *buf, int region, + uint8_t *out_be, int be_len) +{ + int be_index; + int offset; + int k; + + /* Inverse of put_bignum_be_bytes(): highest level -> out_be[0] (MSB). */ + be_index = 0; + for (k = be_len - 1; k >= 0; k--) { + offset = acry_operand_offset(region, k); + out_be[be_index++] = buf[offset]; + } +} + +typedef struct AspeedACRYModExp { + const char *name; + const uint8_t *n; + size_t n_len; + const uint8_t *e; + size_t e_len; + const uint8_t *m; + size_t m_len; + const uint8_t *c; + size_t c_len; +} AspeedACRYModExp; + +static const AspeedACRYModExp acry_modexp_tests[] = { + { + .name = "modexp_rsa2048", + .n = rsa2048_n, + .n_len = sizeof(rsa2048_n), + .e = rsa_e, + .e_len = sizeof(rsa_e), + .m = rsa_m, + .m_len = sizeof(rsa_m), + .c = rsa2048_c, + .c_len = sizeof(rsa2048_c), + }, + { + .name = "modexp_rsa4096", + .n = rsa4096_n, + .n_len = sizeof(rsa4096_n), + .e = rsa_e, + .e_len = sizeof(rsa_e), + .m = rsa_m, + .m_len = sizeof(rsa_m), + .c = rsa4096_c, + .c_len = sizeof(rsa4096_c), + }, +}; + +typedef struct AspeedACRYTest { + const char *machine; + uint64_t dram_addr; + uint64_t sram_addr; + uint64_t acry_addr; + int index; +} AspeedACRYTest; + +static void test_modexp_rsa(const void *opaque) +{ + const AspeedACRYTest *c = opaque; + const AspeedACRYModExp *t = &acry_modexp_tests[c->index]; + QCryptoAkCipherOptions opts = { + .alg = QCRYPTO_AK_CIPHER_ALGO_RSA, + .u.rsa.padding_alg = QCRYPTO_RSA_PADDING_ALGO_RAW, + }; + uint8_t dram_buf[ACRY_SRAM_SIZE] = { 0 }; + uint8_t sram_buf[ACRY_SRAM_SIZE] = { 0 }; + uint8_t result[ACRY_MAX_BYTES] = { 0 }; + QTestState *qts; + + if (!qcrypto_akcipher_supports(&opts)) { + g_test_skip("raw RSA not supported by the crypto backend"); + return; + } + + qts = qtest_init(c->machine); + + g_assert_cmpuint(t->c_len, <=, sizeof(result)); + + put_bignum_be_bytes(dram_buf, ACRY_EXP_OFFSET, t->e, t->e_len); + put_bignum_be_bytes(dram_buf, ACRY_MOD_OFFSET, t->n, t->n_len); + put_bignum_be_bytes(dram_buf, ACRY_DATA_OFFSET, t->m, t->m_len); + + qtest_memwrite(qts, c->dram_addr, dram_buf, sizeof(dram_buf)); + + qtest_writel(qts, c->acry_addr + ACRY_DMA_CMD, ACRY_DMA_CMD_DMEM_AHB); + qtest_writel(qts, c->acry_addr + ACRY_DMA_SRC, c->dram_addr); + qtest_writel(qts, c->acry_addr + ACRY_RSA_KEY_LEN, + ((uint32_t)(t->e_len * 8) << 16) | (uint32_t)(t->n_len * 8)); + qtest_writel(qts, c->acry_addr + ACRY_DMA_LEN, ACRY_SRAM_SIZE); + qtest_writel(qts, c->acry_addr + ACRY_INT_MASK, + ACRY_INT_MASK_RSA_ENG_MASK | ACRY_INT_MASK_RSA_DMA_MASK); + qtest_writel(qts, c->acry_addr + ACRY_DMA_CMD, ACRY_DMA_CMD_SRAM_MODE_RSA); + qtest_writel(qts, c->acry_addr + ACRY_TRIGGER, + ACRY_TRIGGER_RSA_START | ACRY_TRIGGER_RSA_DMA_DATA); + + /* Completion requires both RSA_ENG_DONE and RSA_DMA_DONE to be asserted. */ + g_assert_cmphex(qtest_readl(qts, c->acry_addr + ACRY_STATUS), ==, + ACRY_STATUS_RSA_DONE); + + qtest_memread(qts, c->sram_addr, sram_buf, sizeof(sram_buf)); + get_bignum_be_bytes(sram_buf, ACRY_DATA_OFFSET, result, t->c_len); + g_assert_cmpmem(result, t->c_len, t->c, t->c_len); + + /* Clear IRQ status and check it is deasserted */ + qtest_writel(qts, c->acry_addr + ACRY_STATUS, ACRY_STATUS_RSA_DONE); + g_assert_cmphex(qtest_readl(qts, c->acry_addr + ACRY_STATUS), ==, 0); + + qtest_quit(qts); +} + +static void aspeed_add_acry_tests(const char *prefix, const char *machine, + uint64_t acry_addr, uint64_t sram_addr, + uint64_t dram_addr) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(acry_modexp_tests); i++) { + g_autofree char *path = NULL; + AspeedACRYTest *t; + + path = g_strdup_printf("%s/acry/%s", prefix, + acry_modexp_tests[i].name); + t = g_new0(AspeedACRYTest, 1); + t->machine = machine; + t->acry_addr = acry_addr; + t->sram_addr = sram_addr; + t->dram_addr = dram_addr; + t->index = i; + qtest_add_data_func_full(path, t, test_modexp_rsa, g_free); + } +} + +int main(int argc, char **argv) +{ + g_test_init(&argc, &argv, NULL); + + aspeed_add_acry_tests("ast2600", "-machine ast2600-evb", + 0x1e6fa000, 0x1e710000, 0x80001000); + + return g_test_run(); +} diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index f7c7d06620..c58be94c25 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -220,7 +220,8 @@ qtests_npcm7xx = \ qtests_npcm8xx = \ ['npcm_gmac-test'] qtests_aspeed = \ - ['aspeed_gpio-test', + ['aspeed-acry-test', + 'aspeed_gpio-test', 'aspeed_hace-test', 'aspeed_scu-test', 'aspeed_smc-test'] @@ -392,6 +393,8 @@ if get_option('replication').allowed() endif qtests = { + 'aspeed-acry-test': [files('aspeed-acry-test.c'), + crypto], 'aspeed_hace-test': [files('aspeed-hace-utils.c', 'aspeed_hace-test.c'), crypto], 'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'), -- 2.53.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin ` (3 preceding siblings ...) 2026-09-01 8:15 ` [PATCH v4 4/4] tests/qtest/aspeed-acry-test: Add RSA ModExp tests Jamin Lin @ 2026-09-01 12:28 ` Cédric Le Goater 2026-09-02 6:11 ` Cédric Le Goater 5 siblings, 0 replies; 7+ messages in thread From: Cédric Le Goater @ 2026-09-01 12:28 UTC (permalink / raw) To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Troy Lee On 9/1/26 10:15, Jamin Lin wrote: > This series adds a model of the ASPEED ACRY engine found on the AST2600 > SoC, wires it into the SoC, and adds a qtest. > > The ACRY engine performs RSA modular exponentiation (c = m^e mod n). It > DMAs the operands (data, exponent, and modulus) from guest DRAM and writes > the result to a dedicated 64 KiB SRAM region. > > Guest firmware uses the engine for RSA signature verification during boot. > Without a model, the guest starts the engine and waits indefinitely for a > completion interrupt, causing the boot to hang. > > The model uses QEMU's generic akcipher API to perform raw (unpadded) RSA. > Raw RSA is currently supported only by the libgcrypt backend, which can be > enabled alongside gnutls with -Dgcrypt=enabled, so a build does not have to > choose between the two. When raw RSA is unavailable, the engine still > completes and raises its interrupt, but returns an all-zero result. This > allows the guest's signature verification to fail cleanly instead of > hanging. The qtest is skipped when the selected crypto backend does not > support raw RSA. > > Although the hardware documentation describes both RSA and ECDSA support, > ECDSA is known to be broken on this hardware and is therefore not modeled. > > v1: > 1. Add ASPEED ACRY RSA model for the AST2600 > 2. Add qtest for AST2600 ASPEED ACRY RSA model > > v2: > 1. squash "Add the ACRY model to AspeedSoCState" into "Wire up the ACRY > model" > 2. wrap the ACRY SRAM in a container mapped at offset 0 so the device > addresses it by relative offset (drop the "sram-base" property) > 3. build the scattered SRAM byte offsets on the fly instead of caching > them in per-instance lookup tables > 4. write the result with address_space_stl_le() and check the MemTxResult > > v3: > 1. Return early when the DMA read of the operand buffer fails > 2. Replace g_printerr with g_test_skip > > v4: > 1. Remove unused macros. > 2. Dynamically allocate data and src_buf to reduce stack usage in aspeed_acry_do_rsa(). > 3. Add a helper function to clear the result when aspeed_acry_do_rsa() fails. > 4. Add bounds checking to aspeed_acry_operand_offset() and replace magic numbers with > compile-time constants. > > Jamin Lin (4): > hw/misc/aspeed_acry: Add ASPEED ACRY model > hw/arm/aspeed_ast2600: Introduce the ACRY SRAM > hw/arm/aspeed_ast2600: Wire up the ACRY model > tests/qtest/aspeed-acry-test: Add RSA ModExp tests > > include/hw/arm/aspeed_soc.h | 4 + > include/hw/misc/aspeed_acry.h | 39 +++ > hw/arm/aspeed_ast2600.c | 34 +++ > hw/misc/aspeed_acry.c | 481 +++++++++++++++++++++++++++++++++ > tests/qtest/aspeed-acry-test.c | 406 ++++++++++++++++++++++++++++ > hw/misc/meson.build | 1 + > hw/misc/trace-events | 6 + > tests/qtest/meson.build | 5 +- > 8 files changed, 975 insertions(+), 1 deletion(-) > create mode 100644 include/hw/misc/aspeed_acry.h > create mode 100644 hw/misc/aspeed_acry.c > create mode 100644 tests/qtest/aspeed-acry-test.c > Reviewed-by: Cédric Le Goater <clg@redhat.com> Thanks, C. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin ` (4 preceding siblings ...) 2026-09-01 12:28 ` [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Cédric Le Goater @ 2026-09-02 6:11 ` Cédric Le Goater 5 siblings, 0 replies; 7+ messages in thread From: Cédric Le Goater @ 2026-09-02 6:11 UTC (permalink / raw) To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini, open list:ASPEED BMCs, open list:All patches CC here Cc: Troy Lee On 9/1/26 10:15, Jamin Lin wrote: > This series adds a model of the ASPEED ACRY engine found on the AST2600 > SoC, wires it into the SoC, and adds a qtest. > > The ACRY engine performs RSA modular exponentiation (c = m^e mod n). It > DMAs the operands (data, exponent, and modulus) from guest DRAM and writes > the result to a dedicated 64 KiB SRAM region. > > Guest firmware uses the engine for RSA signature verification during boot. > Without a model, the guest starts the engine and waits indefinitely for a > completion interrupt, causing the boot to hang. > > The model uses QEMU's generic akcipher API to perform raw (unpadded) RSA. > Raw RSA is currently supported only by the libgcrypt backend, which can be > enabled alongside gnutls with -Dgcrypt=enabled, so a build does not have to > choose between the two. When raw RSA is unavailable, the engine still > completes and raises its interrupt, but returns an all-zero result. This > allows the guest's signature verification to fail cleanly instead of > hanging. The qtest is skipped when the selected crypto backend does not > support raw RSA. > > Although the hardware documentation describes both RSA and ECDSA support, > ECDSA is known to be broken on this hardware and is therefore not modeled. > > v1: > 1. Add ASPEED ACRY RSA model for the AST2600 > 2. Add qtest for AST2600 ASPEED ACRY RSA model > > v2: > 1. squash "Add the ACRY model to AspeedSoCState" into "Wire up the ACRY > model" > 2. wrap the ACRY SRAM in a container mapped at offset 0 so the device > addresses it by relative offset (drop the "sram-base" property) > 3. build the scattered SRAM byte offsets on the fly instead of caching > them in per-instance lookup tables > 4. write the result with address_space_stl_le() and check the MemTxResult > > v3: > 1. Return early when the DMA read of the operand buffer fails > 2. Replace g_printerr with g_test_skip > > v4: > 1. Remove unused macros. > 2. Dynamically allocate data and src_buf to reduce stack usage in aspeed_acry_do_rsa(). > 3. Add a helper function to clear the result when aspeed_acry_do_rsa() fails. > 4. Add bounds checking to aspeed_acry_operand_offset() and replace magic numbers with > compile-time constants. > > Jamin Lin (4): > hw/misc/aspeed_acry: Add ASPEED ACRY model > hw/arm/aspeed_ast2600: Introduce the ACRY SRAM > hw/arm/aspeed_ast2600: Wire up the ACRY model > tests/qtest/aspeed-acry-test: Add RSA ModExp tests > > include/hw/arm/aspeed_soc.h | 4 + > include/hw/misc/aspeed_acry.h | 39 +++ > hw/arm/aspeed_ast2600.c | 34 +++ > hw/misc/aspeed_acry.c | 481 +++++++++++++++++++++++++++++++++ > tests/qtest/aspeed-acry-test.c | 406 ++++++++++++++++++++++++++++ > hw/misc/meson.build | 1 + > hw/misc/trace-events | 6 + > tests/qtest/meson.build | 5 +- > 8 files changed, 975 insertions(+), 1 deletion(-) > create mode 100644 include/hw/misc/aspeed_acry.h > create mode 100644 hw/misc/aspeed_acry.c > create mode 100644 tests/qtest/aspeed-acry-test.c > Applied to https://github.com/legoater/qemu aspeed-next Thanks, C. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-02 6:11 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-01 8:15 [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Jamin Lin 2026-09-01 8:15 ` [PATCH v4 1/4] hw/misc/aspeed_acry: Add ASPEED ACRY model Jamin Lin 2026-09-01 8:15 ` [PATCH v4 2/4] hw/arm/aspeed_ast2600: Introduce the ACRY SRAM Jamin Lin 2026-09-01 8:15 ` [PATCH v4 3/4] hw/arm/aspeed_ast2600: Wire up the ACRY model Jamin Lin 2026-09-01 8:15 ` [PATCH v4 4/4] tests/qtest/aspeed-acry-test: Add RSA ModExp tests Jamin Lin 2026-09-01 12:28 ` [PATCH v4 0/4] Add ASPEED ACRY RSA model for the AST2600 Cédric Le Goater 2026-09-02 6:11 ` Cédric Le Goater
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.