xref: /openbmc/qemu/target/riscv/crypto_helper.c (revision cb6c406e26e3cbe394f244d8ac42fd6497eaf129)
1  /*
2   * RISC-V Crypto Emulation Helpers for QEMU.
3   *
4   * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
5   * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
6   *
7   * This program is free software; you can redistribute it and/or modify it
8   * under the terms and conditions of the GNU General Public License,
9   * version 2 or later, as published by the Free Software Foundation.
10   *
11   * This program is distributed in the hope it will be useful, but WITHOUT
12   * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13   * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14   * more details.
15   *
16   * You should have received a copy of the GNU General Public License along with
17   * this program.  If not, see <http://www.gnu.org/licenses/>.
18   */
19  
20  #include "qemu/osdep.h"
21  #include "cpu.h"
22  #include "exec/exec-all.h"
23  #include "exec/helper-proto.h"
24  #include "crypto/aes.h"
25  #include "crypto/aes-round.h"
26  #include "crypto/sm4.h"
27  
28  #define sext32_xlen(x) (target_ulong)(int32_t)(x)
29  
aes32_operation(target_ulong shamt,target_ulong rs1,target_ulong rs2,bool enc,bool mix)30  static inline target_ulong aes32_operation(target_ulong shamt,
31                                             target_ulong rs1, target_ulong rs2,
32                                             bool enc, bool mix)
33  {
34      uint8_t si = rs2 >> shamt;
35      uint32_t mixed;
36      target_ulong res;
37  
38      if (enc) {
39          if (mix) {
40              mixed = be32_to_cpu(AES_Te0[si]);
41          } else {
42              mixed = AES_sbox[si];
43          }
44      } else {
45          if (mix) {
46              mixed = be32_to_cpu(AES_Td0[si]);
47          } else {
48              mixed = AES_isbox[si];
49          }
50      }
51      mixed = rol32(mixed, shamt);
52      res = rs1 ^ mixed;
53  
54      return sext32_xlen(res);
55  }
56  
HELPER(aes32esmi)57  target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2,
58                                 target_ulong shamt)
59  {
60      return aes32_operation(shamt, rs1, rs2, true, true);
61  }
62  
HELPER(aes32esi)63  target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2,
64                                target_ulong shamt)
65  {
66      return aes32_operation(shamt, rs1, rs2, true, false);
67  }
68  
HELPER(aes32dsmi)69  target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2,
70                                 target_ulong shamt)
71  {
72      return aes32_operation(shamt, rs1, rs2, false, true);
73  }
74  
HELPER(aes32dsi)75  target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
76                                target_ulong shamt)
77  {
78      return aes32_operation(shamt, rs1, rs2, false, false);
79  }
80  
81  static const AESState aes_zero = { };
82  
HELPER(aes64esm)83  target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
84  {
85      AESState t;
86  
87      t.d[HOST_BIG_ENDIAN] = rs1;
88      t.d[!HOST_BIG_ENDIAN] = rs2;
89      aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false);
90      return t.d[HOST_BIG_ENDIAN];
91  }
92  
HELPER(aes64es)93  target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
94  {
95      AESState t;
96  
97      t.d[HOST_BIG_ENDIAN] = rs1;
98      t.d[!HOST_BIG_ENDIAN] = rs2;
99      aesenc_SB_SR_AK(&t, &t, &aes_zero, false);
100      return t.d[HOST_BIG_ENDIAN];
101  }
102  
HELPER(aes64ds)103  target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
104  {
105      AESState t;
106  
107      t.d[HOST_BIG_ENDIAN] = rs1;
108      t.d[!HOST_BIG_ENDIAN] = rs2;
109      aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false);
110      return t.d[HOST_BIG_ENDIAN];
111  }
112  
HELPER(aes64dsm)113  target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
114  {
115      AESState t, z = { };
116  
117      /*
118       * This instruction does not include a round key,
119       * so supply a zero to our primitive.
120       */
121      t.d[HOST_BIG_ENDIAN] = rs1;
122      t.d[!HOST_BIG_ENDIAN] = rs2;
123      aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false);
124      return t.d[HOST_BIG_ENDIAN];
125  }
126  
HELPER(aes64ks2)127  target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)
128  {
129      uint64_t RS1 = rs1;
130      uint64_t RS2 = rs2;
131      uint32_t rs1_hi = RS1 >> 32;
132      uint32_t rs2_lo = RS2;
133      uint32_t rs2_hi = RS2 >> 32;
134  
135      uint32_t r_lo = (rs1_hi ^ rs2_lo);
136      uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi);
137      target_ulong result = ((uint64_t)r_hi << 32) | r_lo;
138  
139      return result;
140  }
141  
HELPER(aes64ks1i)142  target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
143  {
144      uint64_t RS1 = rs1;
145      static const uint8_t round_consts[10] = {
146          0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
147      };
148  
149      uint8_t enc_rnum = rnum;
150      uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
151      AESState t, rc = {};
152  
153      if (enc_rnum != 0xA) {
154          temp = ror32(temp, 8); /* Rotate right by 8 */
155          rc.w[0] = rc.w[1] = round_consts[enc_rnum];
156      }
157  
158      t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
159      aesenc_SB_SR_AK(&t, &t, &rc, false);
160  
161      return t.d[0];
162  }
163  
HELPER(aes64im)164  target_ulong HELPER(aes64im)(target_ulong rs1)
165  {
166      AESState t;
167  
168      t.d[HOST_BIG_ENDIAN] = rs1;
169      t.d[!HOST_BIG_ENDIAN] = 0;
170      aesdec_IMC(&t, &t, false);
171      return t.d[HOST_BIG_ENDIAN];
172  }
173  
HELPER(sm4ed)174  target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2,
175                             target_ulong shamt)
176  {
177      uint32_t sb_in = (uint8_t)(rs2 >> shamt);
178      uint32_t sb_out = (uint32_t)sm4_sbox[sb_in];
179  
180      uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^
181                   ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10);
182  
183      uint32_t rotl = rol32(x, shamt);
184  
185      return sext32_xlen(rotl ^ (uint32_t)rs1);
186  }
187  
HELPER(sm4ks)188  target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2,
189                             target_ulong shamt)
190  {
191      uint32_t sb_in = (uint8_t)(rs2 >> shamt);
192      uint32_t sb_out = sm4_sbox[sb_in];
193  
194      uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^
195                   ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13);
196  
197      uint32_t rotl = rol32(x, shamt);
198  
199      return sext32_xlen(rotl ^ (uint32_t)rs1);
200  }
201  #undef sext32_xlen
202