1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * FIPS-180-2 compliant SHA-256 implementation
4 *
5 * Copyright (C) 2001-2003 Christophe Devine
6 */
7
8 #ifndef USE_HOSTCC
9 #include <common.h>
10 #include <linux/string.h>
11 #else
12 #include <string.h>
13 #endif /* USE_HOSTCC */
14 #include <watchdog.h>
15 #include <u-boot/sha256.h>
16
17 const uint8_t sha256_der_prefix[SHA256_DER_LEN] = {
18 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
19 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
20 0x00, 0x04, 0x20
21 };
22
23 /*
24 * 32-bit integer manipulation macros (big endian)
25 */
26 #ifndef GET_UINT32_BE
27 #define GET_UINT32_BE(n,b,i) { \
28 (n) = ( (unsigned long) (b)[(i) ] << 24 ) \
29 | ( (unsigned long) (b)[(i) + 1] << 16 ) \
30 | ( (unsigned long) (b)[(i) + 2] << 8 ) \
31 | ( (unsigned long) (b)[(i) + 3] ); \
32 }
33 #endif
34 #ifndef PUT_UINT32_BE
35 #define PUT_UINT32_BE(n,b,i) { \
36 (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \
37 (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \
38 (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \
39 (b)[(i) + 3] = (unsigned char) ( (n) ); \
40 }
41 #endif
42
sha256_starts(sha256_context * ctx)43 void sha256_starts(sha256_context * ctx)
44 {
45 ctx->total[0] = 0;
46 ctx->total[1] = 0;
47
48 ctx->state[0] = 0x6A09E667;
49 ctx->state[1] = 0xBB67AE85;
50 ctx->state[2] = 0x3C6EF372;
51 ctx->state[3] = 0xA54FF53A;
52 ctx->state[4] = 0x510E527F;
53 ctx->state[5] = 0x9B05688C;
54 ctx->state[6] = 0x1F83D9AB;
55 ctx->state[7] = 0x5BE0CD19;
56 }
57
sha256_process(sha256_context * ctx,const uint8_t data[64])58 static void sha256_process(sha256_context *ctx, const uint8_t data[64])
59 {
60 uint32_t temp1, temp2;
61 uint32_t W[64];
62 uint32_t A, B, C, D, E, F, G, H;
63
64 GET_UINT32_BE(W[0], data, 0);
65 GET_UINT32_BE(W[1], data, 4);
66 GET_UINT32_BE(W[2], data, 8);
67 GET_UINT32_BE(W[3], data, 12);
68 GET_UINT32_BE(W[4], data, 16);
69 GET_UINT32_BE(W[5], data, 20);
70 GET_UINT32_BE(W[6], data, 24);
71 GET_UINT32_BE(W[7], data, 28);
72 GET_UINT32_BE(W[8], data, 32);
73 GET_UINT32_BE(W[9], data, 36);
74 GET_UINT32_BE(W[10], data, 40);
75 GET_UINT32_BE(W[11], data, 44);
76 GET_UINT32_BE(W[12], data, 48);
77 GET_UINT32_BE(W[13], data, 52);
78 GET_UINT32_BE(W[14], data, 56);
79 GET_UINT32_BE(W[15], data, 60);
80
81 #define SHR(x,n) ((x & 0xFFFFFFFF) >> n)
82 #define ROTR(x,n) (SHR(x,n) | (x << (32 - n)))
83
84 #define S0(x) (ROTR(x, 7) ^ ROTR(x,18) ^ SHR(x, 3))
85 #define S1(x) (ROTR(x,17) ^ ROTR(x,19) ^ SHR(x,10))
86
87 #define S2(x) (ROTR(x, 2) ^ ROTR(x,13) ^ ROTR(x,22))
88 #define S3(x) (ROTR(x, 6) ^ ROTR(x,11) ^ ROTR(x,25))
89
90 #define F0(x,y,z) ((x & y) | (z & (x | y)))
91 #define F1(x,y,z) (z ^ (x & (y ^ z)))
92
93 #define R(t) \
94 ( \
95 W[t] = S1(W[t - 2]) + W[t - 7] + \
96 S0(W[t - 15]) + W[t - 16] \
97 )
98
99 #define P(a,b,c,d,e,f,g,h,x,K) { \
100 temp1 = h + S3(e) + F1(e,f,g) + K + x; \
101 temp2 = S2(a) + F0(a,b,c); \
102 d += temp1; h = temp1 + temp2; \
103 }
104
105 A = ctx->state[0];
106 B = ctx->state[1];
107 C = ctx->state[2];
108 D = ctx->state[3];
109 E = ctx->state[4];
110 F = ctx->state[5];
111 G = ctx->state[6];
112 H = ctx->state[7];
113
114 P(A, B, C, D, E, F, G, H, W[0], 0x428A2F98);
115 P(H, A, B, C, D, E, F, G, W[1], 0x71374491);
116 P(G, H, A, B, C, D, E, F, W[2], 0xB5C0FBCF);
117 P(F, G, H, A, B, C, D, E, W[3], 0xE9B5DBA5);
118 P(E, F, G, H, A, B, C, D, W[4], 0x3956C25B);
119 P(D, E, F, G, H, A, B, C, W[5], 0x59F111F1);
120 P(C, D, E, F, G, H, A, B, W[6], 0x923F82A4);
121 P(B, C, D, E, F, G, H, A, W[7], 0xAB1C5ED5);
122 P(A, B, C, D, E, F, G, H, W[8], 0xD807AA98);
123 P(H, A, B, C, D, E, F, G, W[9], 0x12835B01);
124 P(G, H, A, B, C, D, E, F, W[10], 0x243185BE);
125 P(F, G, H, A, B, C, D, E, W[11], 0x550C7DC3);
126 P(E, F, G, H, A, B, C, D, W[12], 0x72BE5D74);
127 P(D, E, F, G, H, A, B, C, W[13], 0x80DEB1FE);
128 P(C, D, E, F, G, H, A, B, W[14], 0x9BDC06A7);
129 P(B, C, D, E, F, G, H, A, W[15], 0xC19BF174);
130 P(A, B, C, D, E, F, G, H, R(16), 0xE49B69C1);
131 P(H, A, B, C, D, E, F, G, R(17), 0xEFBE4786);
132 P(G, H, A, B, C, D, E, F, R(18), 0x0FC19DC6);
133 P(F, G, H, A, B, C, D, E, R(19), 0x240CA1CC);
134 P(E, F, G, H, A, B, C, D, R(20), 0x2DE92C6F);
135 P(D, E, F, G, H, A, B, C, R(21), 0x4A7484AA);
136 P(C, D, E, F, G, H, A, B, R(22), 0x5CB0A9DC);
137 P(B, C, D, E, F, G, H, A, R(23), 0x76F988DA);
138 P(A, B, C, D, E, F, G, H, R(24), 0x983E5152);
139 P(H, A, B, C, D, E, F, G, R(25), 0xA831C66D);
140 P(G, H, A, B, C, D, E, F, R(26), 0xB00327C8);
141 P(F, G, H, A, B, C, D, E, R(27), 0xBF597FC7);
142 P(E, F, G, H, A, B, C, D, R(28), 0xC6E00BF3);
143 P(D, E, F, G, H, A, B, C, R(29), 0xD5A79147);
144 P(C, D, E, F, G, H, A, B, R(30), 0x06CA6351);
145 P(B, C, D, E, F, G, H, A, R(31), 0x14292967);
146 P(A, B, C, D, E, F, G, H, R(32), 0x27B70A85);
147 P(H, A, B, C, D, E, F, G, R(33), 0x2E1B2138);
148 P(G, H, A, B, C, D, E, F, R(34), 0x4D2C6DFC);
149 P(F, G, H, A, B, C, D, E, R(35), 0x53380D13);
150 P(E, F, G, H, A, B, C, D, R(36), 0x650A7354);
151 P(D, E, F, G, H, A, B, C, R(37), 0x766A0ABB);
152 P(C, D, E, F, G, H, A, B, R(38), 0x81C2C92E);
153 P(B, C, D, E, F, G, H, A, R(39), 0x92722C85);
154 P(A, B, C, D, E, F, G, H, R(40), 0xA2BFE8A1);
155 P(H, A, B, C, D, E, F, G, R(41), 0xA81A664B);
156 P(G, H, A, B, C, D, E, F, R(42), 0xC24B8B70);
157 P(F, G, H, A, B, C, D, E, R(43), 0xC76C51A3);
158 P(E, F, G, H, A, B, C, D, R(44), 0xD192E819);
159 P(D, E, F, G, H, A, B, C, R(45), 0xD6990624);
160 P(C, D, E, F, G, H, A, B, R(46), 0xF40E3585);
161 P(B, C, D, E, F, G, H, A, R(47), 0x106AA070);
162 P(A, B, C, D, E, F, G, H, R(48), 0x19A4C116);
163 P(H, A, B, C, D, E, F, G, R(49), 0x1E376C08);
164 P(G, H, A, B, C, D, E, F, R(50), 0x2748774C);
165 P(F, G, H, A, B, C, D, E, R(51), 0x34B0BCB5);
166 P(E, F, G, H, A, B, C, D, R(52), 0x391C0CB3);
167 P(D, E, F, G, H, A, B, C, R(53), 0x4ED8AA4A);
168 P(C, D, E, F, G, H, A, B, R(54), 0x5B9CCA4F);
169 P(B, C, D, E, F, G, H, A, R(55), 0x682E6FF3);
170 P(A, B, C, D, E, F, G, H, R(56), 0x748F82EE);
171 P(H, A, B, C, D, E, F, G, R(57), 0x78A5636F);
172 P(G, H, A, B, C, D, E, F, R(58), 0x84C87814);
173 P(F, G, H, A, B, C, D, E, R(59), 0x8CC70208);
174 P(E, F, G, H, A, B, C, D, R(60), 0x90BEFFFA);
175 P(D, E, F, G, H, A, B, C, R(61), 0xA4506CEB);
176 P(C, D, E, F, G, H, A, B, R(62), 0xBEF9A3F7);
177 P(B, C, D, E, F, G, H, A, R(63), 0xC67178F2);
178
179 ctx->state[0] += A;
180 ctx->state[1] += B;
181 ctx->state[2] += C;
182 ctx->state[3] += D;
183 ctx->state[4] += E;
184 ctx->state[5] += F;
185 ctx->state[6] += G;
186 ctx->state[7] += H;
187 }
188
sha256_update(sha256_context * ctx,const uint8_t * input,uint32_t length)189 void sha256_update(sha256_context *ctx, const uint8_t *input, uint32_t length)
190 {
191 uint32_t left, fill;
192
193 if (!length)
194 return;
195
196 left = ctx->total[0] & 0x3F;
197 fill = 64 - left;
198
199 ctx->total[0] += length;
200 ctx->total[0] &= 0xFFFFFFFF;
201
202 if (ctx->total[0] < length)
203 ctx->total[1]++;
204
205 if (left && length >= fill) {
206 memcpy((void *) (ctx->buffer + left), (void *) input, fill);
207 sha256_process(ctx, ctx->buffer);
208 length -= fill;
209 input += fill;
210 left = 0;
211 }
212
213 while (length >= 64) {
214 sha256_process(ctx, input);
215 length -= 64;
216 input += 64;
217 }
218
219 if (length)
220 memcpy((void *) (ctx->buffer + left), (void *) input, length);
221 }
222
223 static uint8_t sha256_padding[64] = {
224 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
225 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
226 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
227 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
228 };
229
sha256_finish(sha256_context * ctx,uint8_t digest[32])230 void sha256_finish(sha256_context * ctx, uint8_t digest[32])
231 {
232 uint32_t last, padn;
233 uint32_t high, low;
234 uint8_t msglen[8];
235
236 high = ((ctx->total[0] >> 29)
237 | (ctx->total[1] << 3));
238 low = (ctx->total[0] << 3);
239
240 PUT_UINT32_BE(high, msglen, 0);
241 PUT_UINT32_BE(low, msglen, 4);
242
243 last = ctx->total[0] & 0x3F;
244 padn = (last < 56) ? (56 - last) : (120 - last);
245
246 sha256_update(ctx, sha256_padding, padn);
247 sha256_update(ctx, msglen, 8);
248
249 PUT_UINT32_BE(ctx->state[0], digest, 0);
250 PUT_UINT32_BE(ctx->state[1], digest, 4);
251 PUT_UINT32_BE(ctx->state[2], digest, 8);
252 PUT_UINT32_BE(ctx->state[3], digest, 12);
253 PUT_UINT32_BE(ctx->state[4], digest, 16);
254 PUT_UINT32_BE(ctx->state[5], digest, 20);
255 PUT_UINT32_BE(ctx->state[6], digest, 24);
256 PUT_UINT32_BE(ctx->state[7], digest, 28);
257 }
258
259 /*
260 * Output = SHA-256( input buffer ). Trigger the watchdog every 'chunk_sz'
261 * bytes of input processed.
262 */
sha256_csum_wd(const unsigned char * input,unsigned int ilen,unsigned char * output,unsigned int chunk_sz)263 void sha256_csum_wd(const unsigned char *input, unsigned int ilen,
264 unsigned char *output, unsigned int chunk_sz)
265 {
266 sha256_context ctx;
267 #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
268 const unsigned char *end;
269 unsigned char *curr;
270 int chunk;
271 #endif
272
273 sha256_starts(&ctx);
274
275 #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
276 curr = (unsigned char *)input;
277 end = input + ilen;
278 while (curr < end) {
279 chunk = end - curr;
280 if (chunk > chunk_sz)
281 chunk = chunk_sz;
282 sha256_update(&ctx, curr, chunk);
283 curr += chunk;
284 WATCHDOG_RESET();
285 }
286 #else
287 sha256_update(&ctx, input, ilen);
288 #endif
289
290 sha256_finish(&ctx, output);
291 }
292