From 0d4f4e5b01a1a57677c380b1223520f953eaaaf9 Mon Sep 17 00:00:00 2001
From: Jerry Yu <jerry.h.yu@arm.com>
Date: Fri, 31 Mar 2023 14:32:47 +0800
Subject: [PATCH] Add option to disable built-in aes implementation.

For time being, there are only two aes implementations for known
architectures. I define runtime detection function as const when
built-in was disabled. In this case, compiler will remove dead
built-in code.

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
---
 include/mbedtls/mbedtls_config.h | 5 +++++
 library/aesce.c                  | 2 ++
 library/aesce.h                  | 5 +++++
 library/aesni.c                  | 2 ++
 library/aesni.h                  | 4 ++++
 library/padlock.c                | 2 ++
 library/padlock.h                | 5 ++++-
 7 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 719bbed8fe..a086bfe5d9 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -4006,4 +4006,9 @@
  */
 //#define MBEDTLS_ECP_WITH_MPI_UINT
 
+/*
+ * Platform independent implementation for crypto algorithms.
+ */
+//#define MBEDTLS_AES_HAS_NO_BUILTIN /* Uncomment to disable built-in platform independent code of AES */
+
 /** \} name SECTION: Module configuration options */
diff --git a/library/aesce.c b/library/aesce.c
index ed3cca11d5..baa01dbd6b 100644
--- a/library/aesce.c
+++ b/library/aesce.c
@@ -99,6 +99,7 @@
 #include <sys/auxv.h>
 #endif
 
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 /*
  * AES instruction support detection routine
  */
@@ -113,6 +114,7 @@ int mbedtls_aesce_has_support(void)
     return 1;
 #endif
 }
+#endif
 
 /* Single round of AESCE encryption */
 #define AESCE_ENCRYPT_ROUND                   \
diff --git a/library/aesce.h b/library/aesce.h
index b12bf76ba4..b166e15c17 100644
--- a/library/aesce.h
+++ b/library/aesce.h
@@ -47,7 +47,12 @@ extern "C" {
  *
  * \return         1 if CPU has support for the feature, 0 otherwise
  */
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 int mbedtls_aesce_has_support(void);
+#else
+#define /* no-check-names */ mbedtls_aesce_has_support() 1
+#endif
+
 
 /**
  * \brief          Internal AES-ECB block encryption and decryption
diff --git a/library/aesni.c b/library/aesni.c
index 9d1c0f135d..b6d1191794 100644
--- a/library/aesni.c
+++ b/library/aesni.c
@@ -39,6 +39,7 @@
 #include <immintrin.h>
 #endif
 
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 /*
  * AES-NI support detection routine
  */
@@ -68,6 +69,7 @@ int mbedtls_aesni_has_support(unsigned int what)
 
     return (c & what) != 0;
 }
+#endif /* !MBEDTLS_AES_HAS_NO_BUILTIN */
 
 #if MBEDTLS_AESNI_HAVE_CODE == 2
 
diff --git a/library/aesni.h b/library/aesni.h
index 82947e4583..fa1f369edd 100644
--- a/library/aesni.h
+++ b/library/aesni.h
@@ -88,7 +88,11 @@ extern "C" {
  *
  * \return         1 if CPU has support for the feature, 0 otherwise
  */
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 int mbedtls_aesni_has_support(unsigned int what);
+#else
+#define /* no-check-names */ mbedtls_aesni_has_support(what) 1
+#endif
 
 /**
  * \brief          Internal AES-NI AES-ECB block encryption and decryption
diff --git a/library/padlock.c b/library/padlock.c
index f42c40ff93..111b28cf86 100644
--- a/library/padlock.c
+++ b/library/padlock.c
@@ -33,6 +33,7 @@
 
 #if defined(MBEDTLS_HAVE_X86)
 
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 /*
  * PadLock detection routine
  */
@@ -62,6 +63,7 @@ int mbedtls_padlock_has_support(int feature)
 
     return flags & feature;
 }
+#endif
 
 /*
  * PadLock AES-ECB block en(de)cryption
diff --git a/library/padlock.h b/library/padlock.h
index b5f0d7d7a3..10c1c69946 100644
--- a/library/padlock.h
+++ b/library/padlock.h
@@ -41,7 +41,6 @@
 /* Some versions of ASan result in errors about not enough registers */
 #if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && defined(__i386__) && \
     !defined(MBEDTLS_HAVE_ASAN)
-
 #ifndef MBEDTLS_HAVE_X86
 #define MBEDTLS_HAVE_X86
 #endif
@@ -69,7 +68,11 @@ extern "C" {
  *
  * \return         non-zero if CPU has support for the feature, 0 otherwise
  */
+#if !defined(MBEDTLS_AES_HAS_NO_BUILTIN)
 int mbedtls_padlock_has_support(int feature);
+#else
+#define /* no-check-names */ mbedtls_padlock_has_support(feature) 1
+#endif
 
 /**
  * \brief          Internal PadLock AES-ECB block en(de)cryption