On 5/30/23 06:52, Ard Biesheuvel wrote:
ARM intrinsics for AES deviate from the x86 ones in the way they cover
the different stages of each round, and so mapping one to the other is
not entirely straight-forward. However, with a bit of care, we can still
use the x86 ones to emulate the ARM ones, which makes them constant time
(which is an important property in crypto) and substantially more
efficient.
Cc: Peter Maydell <[email protected]>
Cc: Alex Bennée <[email protected]>
Cc: Richard Henderson <[email protected]>
Cc: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Ard Biesheuvel <[email protected]>
---
Suggestions welcome on how to make this more generic across targets and
compilers etc.
target/arm/tcg/crypto_helper.c | 43 ++++++++++++++++++++
1 file changed, 43 insertions(+)
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index d28690321f..961112b6bd 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -18,10 +18,32 @@
#include "crypto/sm4.h"
#include "vec_internal.h"
+#ifdef __x86_64
+#pragma GCC target ("aes")
This doesn't work with clang.
What does work is __attribute__((__target__("aes"))), which requires that you pull those
little code blocks out to separate functions to be annotated. I believe they'll be
inlined afterward, but not really relevant for your improvement.
+#include <cpuid.h>
+#include <wmmintrin.h>
+
+static bool have_aes(void)
+{
+ static int cpuid_have_aes = -1;
+
+ if (cpuid_have_aes == -1) {
+ unsigned int eax, ebx, ecx, edx;
+ int ret = __get_cpuid(0x1, &eax, &ebx, &ecx, &edx);
+
+ cpuid_have_aes = ret && (ecx & bit_AES);
+ }
+ return cpuid_have_aes > 0;
+}
+#endif
See "host/include/i386/host/cpuinfo.h" and "util/cpuinfo-i386.c".
I'll have a closer look at the other AES uses to see what might be sharable.
r~
