1 /* 2 * RISC-V Crypto Emulation Helpers for QEMU. 3 * 4 * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com 5 * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com 6 * 7 * This program is free software; you can redistribute it and/or modify it 8 * under the terms and conditions of the GNU General Public License, 9 * version 2 or later, as published by the Free Software Foundation. 10 * 11 * This program is distributed in the hope it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 14 * more details. 15 * 16 * You should have received a copy of the GNU General Public License along with 17 * this program. If not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "cpu.h" 22 #include "exec/helper-proto.h" 23 #include "crypto/aes.h" 24 #include "crypto/aes-round.h" 25 #include "crypto/sm4.h" 26 27 #define sext32_xlen(x) (target_ulong)(int32_t)(x) 28 29 static inline target_ulong aes32_operation(target_ulong shamt, 30 target_ulong rs1, target_ulong rs2, 31 bool enc, bool mix) 32 { 33 uint8_t si = rs2 >> shamt; 34 uint32_t mixed; 35 target_ulong res; 36 37 if (enc) { 38 if (mix) { 39 mixed = be32_to_cpu(AES_Te0[si]); 40 } else { 41 mixed = AES_sbox[si]; 42 } 43 } else { 44 if (mix) { 45 mixed = be32_to_cpu(AES_Td0[si]); 46 } else { 47 mixed = AES_isbox[si]; 48 } 49 } 50 mixed = rol32(mixed, shamt); 51 res = rs1 ^ mixed; 52 53 return sext32_xlen(res); 54 } 55 56 target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2, 57 target_ulong shamt) 58 { 59 return aes32_operation(shamt, rs1, rs2, true, true); 60 } 61 62 target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2, 63 target_ulong shamt) 64 { 65 return aes32_operation(shamt, rs1, rs2, true, false); 66 } 67 68 target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2, 69 target_ulong shamt) 70 { 71 return aes32_operation(shamt, rs1, rs2, false, true); 72 } 73 74 target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2, 75 target_ulong shamt) 76 { 77 return aes32_operation(shamt, rs1, rs2, false, false); 78 } 79 80 static const AESState aes_zero = { }; 81 82 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) 83 { 84 AESState t; 85 86 t.d[HOST_BIG_ENDIAN] = rs1; 87 t.d[!HOST_BIG_ENDIAN] = rs2; 88 aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false); 89 return t.d[HOST_BIG_ENDIAN]; 90 } 91 92 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) 93 { 94 AESState t; 95 96 t.d[HOST_BIG_ENDIAN] = rs1; 97 t.d[!HOST_BIG_ENDIAN] = rs2; 98 aesenc_SB_SR_AK(&t, &t, &aes_zero, false); 99 return t.d[HOST_BIG_ENDIAN]; 100 } 101 102 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) 103 { 104 AESState t; 105 106 t.d[HOST_BIG_ENDIAN] = rs1; 107 t.d[!HOST_BIG_ENDIAN] = rs2; 108 aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false); 109 return t.d[HOST_BIG_ENDIAN]; 110 } 111 112 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2) 113 { 114 AESState t, z = { }; 115 116 /* 117 * This instruction does not include a round key, 118 * so supply a zero to our primitive. 119 */ 120 t.d[HOST_BIG_ENDIAN] = rs1; 121 t.d[!HOST_BIG_ENDIAN] = rs2; 122 aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false); 123 return t.d[HOST_BIG_ENDIAN]; 124 } 125 126 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2) 127 { 128 uint64_t RS1 = rs1; 129 uint64_t RS2 = rs2; 130 uint32_t rs1_hi = RS1 >> 32; 131 uint32_t rs2_lo = RS2; 132 uint32_t rs2_hi = RS2 >> 32; 133 134 uint32_t r_lo = (rs1_hi ^ rs2_lo); 135 uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi); 136 target_ulong result = ((uint64_t)r_hi << 32) | r_lo; 137 138 return result; 139 } 140 141 target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum) 142 { 143 uint64_t RS1 = rs1; 144 static const uint8_t round_consts[10] = { 145 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 146 }; 147 148 uint8_t enc_rnum = rnum; 149 uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF; 150 AESState t, rc = {}; 151 152 if (enc_rnum != 0xA) { 153 temp = ror32(temp, 8); /* Rotate right by 8 */ 154 rc.w[0] = rc.w[1] = round_consts[enc_rnum]; 155 } 156 157 t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp; 158 aesenc_SB_SR_AK(&t, &t, &rc, false); 159 160 return t.d[0]; 161 } 162 163 target_ulong HELPER(aes64im)(target_ulong rs1) 164 { 165 AESState t; 166 167 t.d[HOST_BIG_ENDIAN] = rs1; 168 t.d[!HOST_BIG_ENDIAN] = 0; 169 aesdec_IMC(&t, &t, false); 170 return t.d[HOST_BIG_ENDIAN]; 171 } 172 173 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2, 174 target_ulong shamt) 175 { 176 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 177 uint32_t sb_out = (uint32_t)sm4_sbox[sb_in]; 178 179 uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^ 180 ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10); 181 182 uint32_t rotl = rol32(x, shamt); 183 184 return sext32_xlen(rotl ^ (uint32_t)rs1); 185 } 186 187 target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2, 188 target_ulong shamt) 189 { 190 uint32_t sb_in = (uint8_t)(rs2 >> shamt); 191 uint32_t sb_out = sm4_sbox[sb_in]; 192 193 uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^ 194 ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13); 195 196 uint32_t rotl = rol32(x, shamt); 197 198 return sext32_xlen(rotl ^ (uint32_t)rs1); 199 } 200 #undef sext32_xlen 201