1 /* 2 * RISC-V Crypto Emulation Helpers for QEMU. 3 * 4 * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com 5 * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com 6 * 7 * This program is free software; you can redistribute it and/or modify it 8 * under the terms and conditions of the GNU General Public License, 9 * version 2 or later, as published by the Free Software Foundation. 10 * 11 * This program is distributed in the hope it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 14 * more details. 15 * 16 * You should have received a copy of the GNU General Public License along with 17 * this program. If not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "cpu.h" 22 #include "exec/exec-all.h" 23 #include "exec/helper-proto.h" 24 #include "crypto/aes.h" 25 #include "crypto/sm4.h" 26 27 #define AES_XTIME(a) \ 28 ((a << 1) ^ ((a & 0x80) ? 0x1b : 0)) 29 30 #define AES_GFMUL(a, b) (( \ 31 (((b) & 0x1) ? (a) : 0) ^ \ 32 (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \ 33 (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \ 34 (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF) 35 36 static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd) 37 { 38 uint32_t u; 39 40 if (fwd) { 41 u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) | 42 (AES_GFMUL(x, 2) << 0); 43 } else { 44 u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) | 45 (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0); 46 } 47 return u; 48 } 49 50 #define sext32_xlen(x) (target_ulong)(int32_t)(x) 51 52 static inline target_ulong aes32_operation(target_ulong shamt, 53 target_ulong rs1, target_ulong rs2, 54 bool enc, bool mix) 55 { 56 uint8_t si = rs2 >> shamt; 57 uint8_t so; 58 uint32_t mixed; 59 target_ulong res; 60 61 if (enc) { 62 so = AES_sbox[si]; 63 if (mix) { 64 mixed = aes_mixcolumn_byte(so, true); 65 } else { 66 mixed = so; 67 } 68 } else { 69 so = AES_isbox[si]; 70 if (mix) { 71 mixed = aes_mixcolumn_byte(so, false); 72 } else { 73 mixed = so; 74 } 75 } 76 mixed = rol32(mixed, shamt); 77 res = rs1 ^ mixed; 78 79 return sext32_xlen(res); 80 } 81 82 target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2, 83 target_ulong shamt) 84 { 85 return aes32_operation(shamt, rs1, rs2, true, true); 86 } 87 88 target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2, 89 target_ulong shamt) 90 { 91 return aes32_operation(shamt, rs1, rs2, true, false); 92 } 93 94 target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2, 95 target_ulong shamt) 96 { 97 return aes32_operation(shamt, rs1, rs2, false, true); 98 } 99 100 target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2, 101 target_ulong shamt) 102 { 103 return aes32_operation(shamt, rs1, rs2, false, false); 104 } 105 106 #define BY(X, I) ((X >> (8 * I)) & 0xFF) 107 108 #define AES_SHIFROWS_LO(RS1, RS2) ( \ 109 (((RS1 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \ 110 (((RS2 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \ 111 (((RS2 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \ 112 (((RS1 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0)) 113 114 #define AES_INVSHIFROWS_LO(RS1, RS2) ( \ 115 (((RS2 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \ 116 (((RS1 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \ 117 (((RS1 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \ 118 (((RS2 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0)) 119 120 #define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \ 121 BY(COL, B3) ^ BY(COL, B2) ^ AES_GFMUL(BY(COL, B1), 3) ^ \ 122 AES_GFMUL(BY(COL, B0), 2)) 123 124 #define AES_MIXCOLUMN(COL) ( \ 125 AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \ 126 AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \ 127 AES_MIXBYTE(COL, 1, 2, 3, 0) << 8 | AES_MIXBYTE(COL, 0, 1, 2, 3) << 0) 128 129 #define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \ 130 AES_GFMUL(BY(COL, B3), 0x9) ^ AES_GFMUL(BY(COL, B2), 0xd) ^ \ 131 AES_GFMUL(BY(COL, B1), 0xb) ^ AES_GFMUL(BY(COL, B0), 0xe)) 132 133 #define AES_INVMIXCOLUMN(COL) ( \ 134 AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \ 135 AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \ 136 AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \ 137 AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0) 138 139 static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2, 140 bool enc, bool mix) 141 { 142 uint64_t RS1 = rs1; 143 uint64_t RS2 = rs2; 144 uint64_t result; 145 uint64_t temp; 146 uint32_t col_0; 147 uint32_t col_1; 148 149 if (enc) { 150 temp = AES_SHIFROWS_LO(RS1, RS2); 151 temp = (((uint64_t)AES_sbox[(temp >> 0) & 0xFF] << 0) | 152 ((uint64_t)AES_sbox[(temp >> 8) & 0xFF] << 8) | 153 ((uint64_t)AES_sbox[(temp >> 16) & 0xFF] << 16) | 154 ((uint64_t)AES_sbox[(temp >> 24) & 0xFF] << 24) | 155 ((uint64_t)AES_sbox[(temp >> 32) & 0xFF] << 32) | 156 ((uint64_t)AES_sbox[(temp >> 40) & 0xFF] << 40) | 157 ((uint64_t)AES_sbox[(temp >> 48) & 0xFF] << 48) | 158 ((uint64_t)AES_sbox[(temp >> 56) & 0xFF] << 56)); 159 if (mix) { 160 col_0 = temp & 0xFFFFFFFF; 161 col_1 = temp >> 32; 162 163 col_0 = AES_MIXCOLUMN(col_0); 164 col_1 = AES_MIXCOLUMN(col_1); 165 166 result = ((uint64_t)col_1 << 32) | col_0; 167 } else { 168 result = temp; 169 } 170 } else { 171 temp = AES_INVSHIFROWS_LO(RS1, RS2); 172 temp = (((uint64_t)AES_isbox[(temp >> 0) & 0xFF] << 0) | 173 ((uint64_t)AES_isbox[(temp >> 8) & 0xFF] << 8) | 174 ((uint64_t)AES_isbox[(temp >> 16) & 0xFF] << 16) | 175 ((uint64_t)AES_isbox[(temp >> 24) & 0xFF] << 24) | 176 ((uint64_t)AES_isbox[(temp >> 32) & 0xFF] << 32) | 177 ((uint64_t)AES_isbox[(temp >> 40) & 0xFF] << 40) | 178 ((uint64_t)AES_isbox[(temp >> 48) & 0xFF] << 48) | 179 ((uint64_t)AES_isbox[(temp >> 56) & 0xFF] << 56)); 180 if (mix) { 181 col_0 = temp & 0xFFFFFFFF; 182 col_1 = temp >> 32; 183 184 col_0 = AES_INVMIXCOLUMN(col_0); 185 col_1 = AES_INVMIXCOLUMN(col_1); 186 187 result = ((uint64_t)col_1 << 32) | col_0; 188 } else { 189 result = temp; 190 } 191 } 192 193 return result; 194 } 195 196 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) 197 { 198 return aes64_operation(rs1, rs2, true, true); 199 } 200 201 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) 202 { 203 return aes64_operation(rs1, rs2, true, false); 204 } 205 206 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) 207 { 208 return aes64_operation(rs1, rs2, false, false); 209 } 210 211 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2) 212 { 213 return aes64_operation(rs1, rs2, false, true); 214 } 215 216 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2) 217 { 218 uint64_t RS1 = rs1; 219 uint64_t RS2 = rs2; 220 uint32_t rs1_hi = RS1 >> 32; 221 uint32_t rs2_lo = RS2; 222 uint32_t rs2_hi = RS2 >> 32; 223 224 uint32_t r_lo = (rs1_hi ^ rs2_lo); 225 uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi); 226 target_ulong result = ((uint64_t)r_hi << 32) | r_lo; 227 228 return result; 229 } 230 231 target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum) 232 { 233 uint64_t RS1 = rs1; 234 static const uint8_t round_consts[10] = { 235 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 236 }; 237 238 uint8_t enc_rnum = rnum; 239 uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF; 240 uint8_t rcon_ = 0; 241 target_ulong result; 242 243 if (enc_rnum != 0xA) { 244 temp = ror32(temp, 8); /* Rotate right by 8 */ 245 rcon_ = round_consts[enc_rnum]; 246 } 247 248 temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) | 249 ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) | 250 ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) | 251 ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0); 252 253 temp ^= rcon_; 254 255 result = ((uint64_t)temp << 32) | temp; 256 257 return result; 258 } 259 260 target_ulong HELPER(aes64im)(target_ulong rs1) 261 { 262 uint64_t RS1 = rs1; 263 uint32_t col_0 = RS1 & 0xFFFFFFFF; 264 uint32_t col_1 = RS1 >> 32; 265 target_ulong result; 266 267 col_0 = AES_INVMIXCOLUMN(col_0); 268 col_1 = AES_INVMIXCOLUMN(col_1); 269 270 result = ((uint64_t)col_1 << 32) | col_0; 271 272 return result; 273 } 274 275 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2, 276 target_ulong shamt) 277 { 278 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 279 uint32_t sb_out = (uint32_t)sm4_sbox[sb_in]; 280 281 uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^ 282 ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10); 283 284 uint32_t rotl = rol32(x, shamt); 285 286 return sext32_xlen(rotl ^ (uint32_t)rs1); 287 } 288 289 target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2, 290 target_ulong shamt) 291 { 292 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 293 uint32_t sb_out = sm4_sbox[sb_in]; 294 295 uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^ 296 ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13); 297 298 uint32_t rotl = rol32(x, shamt); 299 300 return sext32_xlen(rotl ^ (uint32_t)rs1); 301 } 302 #undef sext32_xlen 303