RE: [PATCH v2 04/17] hw/misc/aspeed_hace: Support the CTR mode for the crypto command

> -----Original Message-----
> From: Jamin Lin <[email protected]>
> Sent: Wednesday, July 15, 2026 11:33 AM
> To: Daniel P. Berrangé <[email protected]>; Cédric Le Goater
> <[email protected]>; Peter Maydell <[email protected]>; Steven Lee
> <[email protected]>; Troy Lee <[email protected]>; Kane Chen
> <[email protected]>; Andrew Jeffery
> <[email protected]>; Joel Stanley <[email protected]>; Eric Blake
> <[email protected]>; Markus Armbruster <[email protected]>; Fabiano
> Rosas <[email protected]>; Laurent Vivier <[email protected]>; Paolo Bonzini
> <[email protected]>; open list:All patches CC here
> <[email protected]>; open list:ASPEED BMCs
> <[email protected]>
> Cc: Jamin Lin <[email protected]>; Troy Lee
> <[email protected]>
> Subject: [PATCH v2 04/17] hw/misc/aspeed_hace: Support the CTR mode for
> the crypto command
> 
> The AST2600, AST1030 and later crypto engines add AES/DES/3DES CTR mode
> (HACE10[6:4] = 0b100) on top of the ECB/CBC modes shared with the AST2500.
> Decode the CTR selection, round the working buffers up to a whole block so the
> stream-like final block is still processed a block at a time, and write the
> counter advanced by the number of blocks consumed back to the context
> buffer so the driver can continue across requests.
> 
> Signed-off-by: Jamin Lin <[email protected]>
> ---
>  hw/misc/aspeed_hace.c | 50
> ++++++++++++++++++++++++++++++++++++++-----
>  1 file changed, 45 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> 3d3f1fc8dd..09d0515271 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -42,6 +42,7 @@
>  #define  CRYPT_CMD_OP_MODE_MASK     (0x7 << 4)
>  #define  CRYPT_CMD_ECB              (0x0 << 4)
>  #define  CRYPT_CMD_CBC              (0x1 << 4)
> +#define  CRYPT_CMD_CTR              (0x4 << 4)
>  /* AES key length HACE10[3:2] */
>  #define  CRYPT_CMD_AES_KEY_LEN_MASK (0x3 << 2)
>  #define  CRYPT_CMD_AES256           (0x2 << 2)
> @@ -589,6 +590,9 @@ static bool crypt_decode_cmd(uint32_t cmd,
> QCryptoCipherAlgo *alg,
>      case CRYPT_CMD_CBC:
>          *mode = QCRYPTO_CIPHER_MODE_CBC;
>          break;
> +    case CRYPT_CMD_CTR:
> +        *mode = QCRYPTO_CIPHER_MODE_CTR;
> +        break;
>      default:
>          return false;
>      }
> @@ -652,6 +656,22 @@ static bool crypt_prepare_sg(AspeedHACEState *s,
> uint64_t addr,
>      return copied == len;
>  }
> 
> +/*
> + * Add @add to the big-endian counter block @ctr (@len bytes) in place,
> +so the
> + * CTR mode counter can be advanced by the number of blocks just
> consumed.
> + */
> +static void crypt_be_add(uint8_t *ctr, size_t len, uint64_t add) {
> +    size_t i = len;
> +
> +    while (i > 0 && add) {
> +        i--;
> +        add += ctr[i];
> +        ctr[i] = add & 0xff;
> +        add >>= 8;
> +    }
> +}
> +
>  /*
>   * Perform an AES/DES/3DES ECB/CBC operation. The source and destination
> are
>   * either single contiguous buffers (direct access mode) or scatter-gather
> @@ -677,6 +697,7 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
>      uint64_t dst_addr;
>      size_t iv_offset;
>      size_t blocklen;
> +    size_t buf_len;
>      size_t keylen;
>      bool status;
> 
> @@ -729,8 +750,14 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
>          return;
>      }
> 
> -    src_buf = g_malloc0(len);
> -    dst_buf = g_malloc0(len);
> +    /*
> +     * Round the working buffers up to a whole block. Block modes are
> already
> +     * block-aligned; the stream-like CTR mode may leave a partial final
> block
> +     * that the engine still processes a full block at a time.
> +     */
> +    buf_len = QEMU_ALIGN_UP(len, blocklen);
> +    src_buf = g_malloc0(buf_len);
> +    dst_buf = g_malloc0(buf_len);
> 
>      /* Gather the source into the bounce buffer, per the selected mode. */
>      src_addr = s->regs[R_CRYPT_SRC];
> @@ -751,7 +778,7 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
>      }
> 
>      if (encrypt) {
> -        if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, len,
> +        if (qcrypto_cipher_encrypt(cipher, src_buf, dst_buf, buf_len,
>                                     &local_err) < 0) {
>              qemu_log_mask(LOG_GUEST_ERROR, "%s: encrypt failed:
> %s\n",
>                            __func__, error_get_pretty(local_err)); @@
> -759,7 +786,7 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
>              return;
>          }
>      } else {
> -        if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, len,
> +        if (qcrypto_cipher_decrypt(cipher, src_buf, dst_buf, buf_len,
>                                     &local_err) < 0) {
>              qemu_log_mask(LOG_GUEST_ERROR, "%s: decrypt failed:
> %s\n",
>                            __func__, error_get_pretty(local_err)); @@
> -792,13 +819,26 @@ static void do_crypt_operation(AspeedHACEState *s,
> uint32_t cmd)
>           * output when encrypting, or of the input when decrypting. Write
> it
>           * back as the IV for the next request.
>           */
> -        next_iv = (encrypt ? dst_buf : src_buf) + len - blocklen;
> +        next_iv = (encrypt ? dst_buf : src_buf) + buf_len - blocklen;
>          if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
>                                  MEMTXATTRS_UNSPECIFIED, next_iv,
> blocklen)) {
>              qemu_log_mask(LOG_GUEST_ERROR,
>                            "%s: Failed to write IV, addr=0x%"
> HWADDR_PRIx "\n",
>                            __func__, ctx_addr + iv_offset);
>          }
> +    } else if (mode == QCRYPTO_CIPHER_MODE_CTR) {
> +        /*
> +         * CTR chains on the counter, which advances by one per block.
> Add the
> +         * number of blocks processed (buf_len / blocklen) and write it
> back.
> +         */
> +        crypt_be_add(ctx + iv_offset, blocklen, buf_len / blocklen);
> +        if (address_space_write(&s->dram_as, ctx_addr + iv_offset,
> +                                MEMTXATTRS_UNSPECIFIED, ctx +
> iv_offset,
> +                                blocklen)) {
> +            qemu_log_mask(LOG_GUEST_ERROR,
> +                          "%s: Failed to write IV, addr=0x%"
> HWADDR_PRIx "\n",
> +                          __func__, ctx_addr + iv_offset);
> +        }
>      }
>  }
> 
> --
> 2.43.0

Reviewed-by: Kane Chen <[email protected]>