1 /* 2 * RISC-V Crypto Emulation Helpers for QEMU. 3 * 4 * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com 5 * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com 6 * 7 * This program is free software; you can redistribute it and/or modify it 8 * under the terms and conditions of the GNU General Public License, 9 * version 2 or later, as published by the Free Software Foundation. 10 * 11 * This program is distributed in the hope it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 14 * more details. 15 * 16 * You should have received a copy of the GNU General Public License along with 17 * this program. If not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "cpu.h" 22 #include "exec/exec-all.h" 23 #include "exec/helper-proto.h" 24 #include "crypto/aes.h" 25 #include "crypto/aes-round.h" 26 #include "crypto/sm4.h" 27 28 #define sext32_xlen(x) (target_ulong)(int32_t)(x) 29 30 static inline target_ulong aes32_operation(target_ulong shamt, 31 target_ulong rs1, target_ulong rs2, 32 bool enc, bool mix) 33 { 34 uint8_t si = rs2 >> shamt; 35 uint32_t mixed; 36 target_ulong res; 37 38 if (enc) { 39 if (mix) { 40 mixed = be32_to_cpu(AES_Te0[si]); 41 } else { 42 mixed = AES_sbox[si]; 43 } 44 } else { 45 if (mix) { 46 mixed = be32_to_cpu(AES_Td0[si]); 47 } else { 48 mixed = AES_isbox[si]; 49 } 50 } 51 mixed = rol32(mixed, shamt); 52 res = rs1 ^ mixed; 53 54 return sext32_xlen(res); 55 } 56 57 target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2, 58 target_ulong shamt) 59 { 60 return aes32_operation(shamt, rs1, rs2, true, true); 61 } 62 63 target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2, 64 target_ulong shamt) 65 { 66 return aes32_operation(shamt, rs1, rs2, true, false); 67 } 68 69 target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2, 70 target_ulong shamt) 71 { 72 return aes32_operation(shamt, rs1, rs2, false, true); 73 } 74 75 target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2, 76 target_ulong shamt) 77 { 78 return aes32_operation(shamt, rs1, rs2, false, false); 79 } 80 81 static const AESState aes_zero = { }; 82 83 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) 84 { 85 AESState t; 86 87 t.d[HOST_BIG_ENDIAN] = rs1; 88 t.d[!HOST_BIG_ENDIAN] = rs2; 89 aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false); 90 return t.d[HOST_BIG_ENDIAN]; 91 } 92 93 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) 94 { 95 AESState t; 96 97 t.d[HOST_BIG_ENDIAN] = rs1; 98 t.d[!HOST_BIG_ENDIAN] = rs2; 99 aesenc_SB_SR_AK(&t, &t, &aes_zero, false); 100 return t.d[HOST_BIG_ENDIAN]; 101 } 102 103 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) 104 { 105 AESState t; 106 107 t.d[HOST_BIG_ENDIAN] = rs1; 108 t.d[!HOST_BIG_ENDIAN] = rs2; 109 aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false); 110 return t.d[HOST_BIG_ENDIAN]; 111 } 112 113 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2) 114 { 115 AESState t, z = { }; 116 117 /* 118 * This instruction does not include a round key, 119 * so supply a zero to our primitive. 120 */ 121 t.d[HOST_BIG_ENDIAN] = rs1; 122 t.d[!HOST_BIG_ENDIAN] = rs2; 123 aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false); 124 return t.d[HOST_BIG_ENDIAN]; 125 } 126 127 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2) 128 { 129 uint64_t RS1 = rs1; 130 uint64_t RS2 = rs2; 131 uint32_t rs1_hi = RS1 >> 32; 132 uint32_t rs2_lo = RS2; 133 uint32_t rs2_hi = RS2 >> 32; 134 135 uint32_t r_lo = (rs1_hi ^ rs2_lo); 136 uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi); 137 target_ulong result = ((uint64_t)r_hi << 32) | r_lo; 138 139 return result; 140 } 141 142 target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum) 143 { 144 uint64_t RS1 = rs1; 145 static const uint8_t round_consts[10] = { 146 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 147 }; 148 149 uint8_t enc_rnum = rnum; 150 uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF; 151 uint8_t rcon_ = 0; 152 target_ulong result; 153 154 if (enc_rnum != 0xA) { 155 temp = ror32(temp, 8); /* Rotate right by 8 */ 156 rcon_ = round_consts[enc_rnum]; 157 } 158 159 temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) | 160 ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) | 161 ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) | 162 ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0); 163 164 temp ^= rcon_; 165 166 result = ((uint64_t)temp << 32) | temp; 167 168 return result; 169 } 170 171 target_ulong HELPER(aes64im)(target_ulong rs1) 172 { 173 AESState t; 174 175 t.d[HOST_BIG_ENDIAN] = rs1; 176 t.d[!HOST_BIG_ENDIAN] = 0; 177 aesdec_IMC(&t, &t, false); 178 return t.d[HOST_BIG_ENDIAN]; 179 } 180 181 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2, 182 target_ulong shamt) 183 { 184 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 185 uint32_t sb_out = (uint32_t)sm4_sbox[sb_in]; 186 187 uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^ 188 ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10); 189 190 uint32_t rotl = rol32(x, shamt); 191 192 return sext32_xlen(rotl ^ (uint32_t)rs1); 193 } 194 195 target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2, 196 target_ulong shamt) 197 { 198 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 199 uint32_t sb_out = sm4_sbox[sb_in]; 200 201 uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^ 202 ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13); 203 204 uint32_t rotl = rol32(x, shamt); 205 206 return sext32_xlen(rotl ^ (uint32_t)rs1); 207 } 208 #undef sext32_xlen 209