@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 200 lines 5.34 KB
Raw
1 /*
2 * RISC-V Crypto Emulation Helpers for QEMU.
3 *
4 * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
5 * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 * more details.
15 *
16 * You should have received a copy of the GNU General Public License along with
17 * this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "exec/helper-proto.h"
23 #include "crypto/aes.h"
24 #include "crypto/aes-round.h"
25 #include "crypto/sm4.h"
26
27 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
28
29 static inline target_ulong aes32_operation(target_ulong shamt,
30 target_ulong rs1, target_ulong rs2,
31 bool enc, bool mix)
32 {
33 uint8_t si = rs2 >> shamt;
34 uint32_t mixed;
35 target_ulong res;
36
37 if (enc) {
38 if (mix) {
39 mixed = be32_to_cpu(AES_Te0[si]);
40 } else {
41 mixed = AES_sbox[si];
42 }
43 } else {
44 if (mix) {
45 mixed = be32_to_cpu(AES_Td0[si]);
46 } else {
47 mixed = AES_isbox[si];
48 }
49 }
50 mixed = rol32(mixed, shamt);
51 res = rs1 ^ mixed;
52
53 return sext32_xlen(res);
54 }
55
56 target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2,
57 target_ulong shamt)
58 {
59 return aes32_operation(shamt, rs1, rs2, true, true);
60 }
61
62 target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2,
63 target_ulong shamt)
64 {
65 return aes32_operation(shamt, rs1, rs2, true, false);
66 }
67
68 target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2,
69 target_ulong shamt)
70 {
71 return aes32_operation(shamt, rs1, rs2, false, true);
72 }
73
74 target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
75 target_ulong shamt)
76 {
77 return aes32_operation(shamt, rs1, rs2, false, false);
78 }
79
80 static const AESState aes_zero = { };
81
82 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
83 {
84 AESState t;
85
86 t.d[HOST_BIG_ENDIAN] = rs1;
87 t.d[!HOST_BIG_ENDIAN] = rs2;
88 aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false);
89 return t.d[HOST_BIG_ENDIAN];
90 }
91
92 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
93 {
94 AESState t;
95
96 t.d[HOST_BIG_ENDIAN] = rs1;
97 t.d[!HOST_BIG_ENDIAN] = rs2;
98 aesenc_SB_SR_AK(&t, &t, &aes_zero, false);
99 return t.d[HOST_BIG_ENDIAN];
100 }
101
102 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
103 {
104 AESState t;
105
106 t.d[HOST_BIG_ENDIAN] = rs1;
107 t.d[!HOST_BIG_ENDIAN] = rs2;
108 aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false);
109 return t.d[HOST_BIG_ENDIAN];
110 }
111
112 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
113 {
114 AESState t, z = { };
115
116 /*
117 * This instruction does not include a round key,
118 * so supply a zero to our primitive.
119 */
120 t.d[HOST_BIG_ENDIAN] = rs1;
121 t.d[!HOST_BIG_ENDIAN] = rs2;
122 aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false);
123 return t.d[HOST_BIG_ENDIAN];
124 }
125
126 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)
127 {
128 uint64_t RS1 = rs1;
129 uint64_t RS2 = rs2;
130 uint32_t rs1_hi = RS1 >> 32;
131 uint32_t rs2_lo = RS2;
132 uint32_t rs2_hi = RS2 >> 32;
133
134 uint32_t r_lo = (rs1_hi ^ rs2_lo);
135 uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi);
136 target_ulong result = ((uint64_t)r_hi << 32) | r_lo;
137
138 return result;
139 }
140
141 target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
142 {
143 uint64_t RS1 = rs1;
144 static const uint8_t round_consts[10] = {
145 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
146 };
147
148 uint8_t enc_rnum = rnum;
149 uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
150 AESState t, rc = {};
151
152 if (enc_rnum != 0xA) {
153 temp = ror32(temp, 8); /* Rotate right by 8 */
154 rc.w[0] = rc.w[1] = round_consts[enc_rnum];
155 }
156
157 t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
158 aesenc_SB_SR_AK(&t, &t, &rc, false);
159
160 return t.d[0];
161 }
162
163 target_ulong HELPER(aes64im)(target_ulong rs1)
164 {
165 AESState t;
166
167 t.d[HOST_BIG_ENDIAN] = rs1;
168 t.d[!HOST_BIG_ENDIAN] = 0;
169 aesdec_IMC(&t, &t, false);
170 return t.d[HOST_BIG_ENDIAN];
171 }
172
173 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2,
174 target_ulong shamt)
175 {
176 uint32_t sb_in = (uint8_t)(rs2 >> shamt);
177 uint32_t sb_out = (uint32_t)sm4_sbox[sb_in];
178
179 uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^
180 ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10);
181
182 uint32_t rotl = rol32(x, shamt);
183
184 return sext32_xlen(rotl ^ (uint32_t)rs1);
185 }
186
187 target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2,
188 target_ulong shamt)
189 {
190 uint32_t sb_in = (uint8_t)(rs2 >> shamt);
191 uint32_t sb_out = sm4_sbox[sb_in];
192
193 uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^
194 ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13);
195
196 uint32_t rotl = rol32(x, shamt);
197
198 return sext32_xlen(rotl ^ (uint32_t)rs1);
199 }
200 #undef sext32_xlen