target/riscv/crypto_helper.c

   1 /*
   2  * RISC-V Crypto Emulation Helpers for QEMU.
   3  *
   4  * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
   5  * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms and conditions of the GNU General Public License,
   9  * version 2 or later, as published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  14  * more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along with
  17  * this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "qemu/osdep.h"
  21 #include "cpu.h"
  22 #include "exec/exec-all.h"
  23 #include "exec/helper-proto.h"
  24 #include "crypto/aes.h"
  25 #include "crypto/aes-round.h"
  26 #include "crypto/sm4.h"
  27
  28 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
  29
  30 static inline target_ulong aes32_operation(target_ulong shamt,
  31                                            target_ulong rs1, target_ulong rs2,
  32                                            bool enc, bool mix)
  33 {
  34     uint8_t si = rs2 >> shamt;
  35     uint32_t mixed;
  36     target_ulong res;
  37
  38     if (enc) {
  39         if (mix) {
  40             mixed = be32_to_cpu(AES_Te0[si]);
  41         } else {
  42             mixed = AES_sbox[si];
  43         }
  44     } else {
  45         if (mix) {
  46             mixed = be32_to_cpu(AES_Td0[si]);
  47         } else {
  48             mixed = AES_isbox[si];
  49         }
  50     }
  51     mixed = rol32(mixed, shamt);
  52     res = rs1 ^ mixed;
  53
  54     return sext32_xlen(res);
  55 }
  56
  57 target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2,
  58                                target_ulong shamt)
  59 {
  60     return aes32_operation(shamt, rs1, rs2, true, true);
  61 }
  62
  63 target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2,
  64                               target_ulong shamt)
  65 {
  66     return aes32_operation(shamt, rs1, rs2, true, false);
  67 }
  68
  69 target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2,
  70                                target_ulong shamt)
  71 {
  72     return aes32_operation(shamt, rs1, rs2, false, true);
  73 }
  74
  75 target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
  76                               target_ulong shamt)
  77 {
  78     return aes32_operation(shamt, rs1, rs2, false, false);
  79 }
  80
  81 static const AESState aes_zero = { };
  82
  83 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
  84 {
  85     AESState t;
  86
  87     t.d[HOST_BIG_ENDIAN] = rs1;
  88     t.d[!HOST_BIG_ENDIAN] = rs2;
  89     aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false);
  90     return t.d[HOST_BIG_ENDIAN];
  91 }
  92
  93 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
  94 {
  95     AESState t;
  96
  97     t.d[HOST_BIG_ENDIAN] = rs1;
  98     t.d[!HOST_BIG_ENDIAN] = rs2;
  99     aesenc_SB_SR_AK(&t, &t, &aes_zero, false);
 100     return t.d[HOST_BIG_ENDIAN];
 101 }
 102
 103 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
 104 {
 105     AESState t;
 106
 107     t.d[HOST_BIG_ENDIAN] = rs1;
 108     t.d[!HOST_BIG_ENDIAN] = rs2;
 109     aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false);
 110     return t.d[HOST_BIG_ENDIAN];
 111 }
 112
 113 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
 114 {
 115     AESState t, z = { };
 116
 117     /*
 118      * This instruction does not include a round key,
 119      * so supply a zero to our primitive.
 120      */
 121     t.d[HOST_BIG_ENDIAN] = rs1;
 122     t.d[!HOST_BIG_ENDIAN] = rs2;
 123     aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false);
 124     return t.d[HOST_BIG_ENDIAN];
 125 }
 126
 127 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)
 128 {
 129     uint64_t RS1 = rs1;
 130     uint64_t RS2 = rs2;
 131     uint32_t rs1_hi = RS1 >> 32;
 132     uint32_t rs2_lo = RS2;
 133     uint32_t rs2_hi = RS2 >> 32;
 134
 135     uint32_t r_lo = (rs1_hi ^ rs2_lo);
 136     uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi);
 137     target_ulong result = ((uint64_t)r_hi << 32) | r_lo;
 138
 139     return result;
 140 }
 141
 142 target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 143 {
 144     uint64_t RS1 = rs1;
 145     static const uint8_t round_consts[10] = {
 146         0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
 147     };
 148
 149     uint8_t enc_rnum = rnum;
 150     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
 151     AESState t, rc = {};
 152
 153     if (enc_rnum != 0xA) {
 154         temp = ror32(temp, 8); /* Rotate right by 8 */
 155         rc.w[0] = rc.w[1] = round_consts[enc_rnum];
 156     }
 157
 158     t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
 159     aesenc_SB_SR_AK(&t, &t, &rc, false);
 160
 161     return t.d[0];
 162 }
 163
 164 target_ulong HELPER(aes64im)(target_ulong rs1)
 165 {
 166     AESState t;
 167
 168     t.d[HOST_BIG_ENDIAN] = rs1;
 169     t.d[!HOST_BIG_ENDIAN] = 0;
 170     aesdec_IMC(&t, &t, false);
 171     return t.d[HOST_BIG_ENDIAN];
 172 }
 173
 174 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2,
 175                            target_ulong shamt)
 176 {
 177     uint32_t sb_in = (uint8_t)(rs2 >> shamt);
 178     uint32_t sb_out = (uint32_t)sm4_sbox[sb_in];
 179
 180     uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^
 181                  ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10);
 182
 183     uint32_t rotl = rol32(x, shamt);
 184
 185     return sext32_xlen(rotl ^ (uint32_t)rs1);
 186 }
 187
 188 target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2,
 189                            target_ulong shamt)
 190 {
 191     uint32_t sb_in = (uint8_t)(rs2 >> shamt);
 192     uint32_t sb_out = sm4_sbox[sb_in];
 193
 194     uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^
 195                  ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13);
 196
 197     uint32_t rotl = rol32(x, shamt);
 198
 199     return sext32_xlen(rotl ^ (uint32_t)rs1);
 200 }
 201 #undef sext32_xlen