qemu-img: Omit error_report() after img_open()
[qemu.git] / target-arm / crypto_helper.c
1 /*
2 * crypto_helper.c - emulate v8 Crypto Extensions instructions
3 *
4 * Copyright (C) 2013 - 2014 Linaro Ltd <ard.biesheuvel@linaro.org>
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 */
11
12 #include <stdlib.h>
13
14 #include "cpu.h"
15 #include "exec/exec-all.h"
16 #include "exec/helper-proto.h"
17 #include "qemu/aes.h"
18
19 union CRYPTO_STATE {
20 uint8_t bytes[16];
21 uint32_t words[4];
22 uint64_t l[2];
23 };
24
25 void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
26 uint32_t decrypt)
27 {
28 static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
29 static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
30
31 union CRYPTO_STATE rk = { .l = {
32 float64_val(env->vfp.regs[rm]),
33 float64_val(env->vfp.regs[rm + 1])
34 } };
35 union CRYPTO_STATE st = { .l = {
36 float64_val(env->vfp.regs[rd]),
37 float64_val(env->vfp.regs[rd + 1])
38 } };
39 int i;
40
41 assert(decrypt < 2);
42
43 /* xor state vector with round key */
44 rk.l[0] ^= st.l[0];
45 rk.l[1] ^= st.l[1];
46
47 /* combine ShiftRows operation and sbox substitution */
48 for (i = 0; i < 16; i++) {
49 st.bytes[i] = sbox[decrypt][rk.bytes[shift[decrypt][i]]];
50 }
51
52 env->vfp.regs[rd] = make_float64(st.l[0]);
53 env->vfp.regs[rd + 1] = make_float64(st.l[1]);
54 }
55
56 void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
57 uint32_t decrypt)
58 {
59 static uint32_t const mc[][256] = { {
60 /* MixColumns lookup table */
61 0x00000000, 0x03010102, 0x06020204, 0x05030306,
62 0x0c040408, 0x0f05050a, 0x0a06060c, 0x0907070e,
63 0x18080810, 0x1b090912, 0x1e0a0a14, 0x1d0b0b16,
64 0x140c0c18, 0x170d0d1a, 0x120e0e1c, 0x110f0f1e,
65 0x30101020, 0x33111122, 0x36121224, 0x35131326,
66 0x3c141428, 0x3f15152a, 0x3a16162c, 0x3917172e,
67 0x28181830, 0x2b191932, 0x2e1a1a34, 0x2d1b1b36,
68 0x241c1c38, 0x271d1d3a, 0x221e1e3c, 0x211f1f3e,
69 0x60202040, 0x63212142, 0x66222244, 0x65232346,
70 0x6c242448, 0x6f25254a, 0x6a26264c, 0x6927274e,
71 0x78282850, 0x7b292952, 0x7e2a2a54, 0x7d2b2b56,
72 0x742c2c58, 0x772d2d5a, 0x722e2e5c, 0x712f2f5e,
73 0x50303060, 0x53313162, 0x56323264, 0x55333366,
74 0x5c343468, 0x5f35356a, 0x5a36366c, 0x5937376e,
75 0x48383870, 0x4b393972, 0x4e3a3a74, 0x4d3b3b76,
76 0x443c3c78, 0x473d3d7a, 0x423e3e7c, 0x413f3f7e,
77 0xc0404080, 0xc3414182, 0xc6424284, 0xc5434386,
78 0xcc444488, 0xcf45458a, 0xca46468c, 0xc947478e,
79 0xd8484890, 0xdb494992, 0xde4a4a94, 0xdd4b4b96,
80 0xd44c4c98, 0xd74d4d9a, 0xd24e4e9c, 0xd14f4f9e,
81 0xf05050a0, 0xf35151a2, 0xf65252a4, 0xf55353a6,
82 0xfc5454a8, 0xff5555aa, 0xfa5656ac, 0xf95757ae,
83 0xe85858b0, 0xeb5959b2, 0xee5a5ab4, 0xed5b5bb6,
84 0xe45c5cb8, 0xe75d5dba, 0xe25e5ebc, 0xe15f5fbe,
85 0xa06060c0, 0xa36161c2, 0xa66262c4, 0xa56363c6,
86 0xac6464c8, 0xaf6565ca, 0xaa6666cc, 0xa96767ce,
87 0xb86868d0, 0xbb6969d2, 0xbe6a6ad4, 0xbd6b6bd6,
88 0xb46c6cd8, 0xb76d6dda, 0xb26e6edc, 0xb16f6fde,
89 0x907070e0, 0x937171e2, 0x967272e4, 0x957373e6,
90 0x9c7474e8, 0x9f7575ea, 0x9a7676ec, 0x997777ee,
91 0x887878f0, 0x8b7979f2, 0x8e7a7af4, 0x8d7b7bf6,
92 0x847c7cf8, 0x877d7dfa, 0x827e7efc, 0x817f7ffe,
93 0x9b80801b, 0x98818119, 0x9d82821f, 0x9e83831d,
94 0x97848413, 0x94858511, 0x91868617, 0x92878715,
95 0x8388880b, 0x80898909, 0x858a8a0f, 0x868b8b0d,
96 0x8f8c8c03, 0x8c8d8d01, 0x898e8e07, 0x8a8f8f05,
97 0xab90903b, 0xa8919139, 0xad92923f, 0xae93933d,
98 0xa7949433, 0xa4959531, 0xa1969637, 0xa2979735,
99 0xb398982b, 0xb0999929, 0xb59a9a2f, 0xb69b9b2d,
100 0xbf9c9c23, 0xbc9d9d21, 0xb99e9e27, 0xba9f9f25,
101 0xfba0a05b, 0xf8a1a159, 0xfda2a25f, 0xfea3a35d,
102 0xf7a4a453, 0xf4a5a551, 0xf1a6a657, 0xf2a7a755,
103 0xe3a8a84b, 0xe0a9a949, 0xe5aaaa4f, 0xe6abab4d,
104 0xefacac43, 0xecadad41, 0xe9aeae47, 0xeaafaf45,
105 0xcbb0b07b, 0xc8b1b179, 0xcdb2b27f, 0xceb3b37d,
106 0xc7b4b473, 0xc4b5b571, 0xc1b6b677, 0xc2b7b775,
107 0xd3b8b86b, 0xd0b9b969, 0xd5baba6f, 0xd6bbbb6d,
108 0xdfbcbc63, 0xdcbdbd61, 0xd9bebe67, 0xdabfbf65,
109 0x5bc0c09b, 0x58c1c199, 0x5dc2c29f, 0x5ec3c39d,
110 0x57c4c493, 0x54c5c591, 0x51c6c697, 0x52c7c795,
111 0x43c8c88b, 0x40c9c989, 0x45caca8f, 0x46cbcb8d,
112 0x4fcccc83, 0x4ccdcd81, 0x49cece87, 0x4acfcf85,
113 0x6bd0d0bb, 0x68d1d1b9, 0x6dd2d2bf, 0x6ed3d3bd,
114 0x67d4d4b3, 0x64d5d5b1, 0x61d6d6b7, 0x62d7d7b5,
115 0x73d8d8ab, 0x70d9d9a9, 0x75dadaaf, 0x76dbdbad,
116 0x7fdcdca3, 0x7cdddda1, 0x79dedea7, 0x7adfdfa5,
117 0x3be0e0db, 0x38e1e1d9, 0x3de2e2df, 0x3ee3e3dd,
118 0x37e4e4d3, 0x34e5e5d1, 0x31e6e6d7, 0x32e7e7d5,
119 0x23e8e8cb, 0x20e9e9c9, 0x25eaeacf, 0x26ebebcd,
120 0x2fececc3, 0x2cededc1, 0x29eeeec7, 0x2aefefc5,
121 0x0bf0f0fb, 0x08f1f1f9, 0x0df2f2ff, 0x0ef3f3fd,
122 0x07f4f4f3, 0x04f5f5f1, 0x01f6f6f7, 0x02f7f7f5,
123 0x13f8f8eb, 0x10f9f9e9, 0x15fafaef, 0x16fbfbed,
124 0x1ffcfce3, 0x1cfdfde1, 0x19fefee7, 0x1affffe5,
125 }, {
126 /* Inverse MixColumns lookup table */
127 0x00000000, 0x0b0d090e, 0x161a121c, 0x1d171b12,
128 0x2c342438, 0x27392d36, 0x3a2e3624, 0x31233f2a,
129 0x58684870, 0x5365417e, 0x4e725a6c, 0x457f5362,
130 0x745c6c48, 0x7f516546, 0x62467e54, 0x694b775a,
131 0xb0d090e0, 0xbbdd99ee, 0xa6ca82fc, 0xadc78bf2,
132 0x9ce4b4d8, 0x97e9bdd6, 0x8afea6c4, 0x81f3afca,
133 0xe8b8d890, 0xe3b5d19e, 0xfea2ca8c, 0xf5afc382,
134 0xc48cfca8, 0xcf81f5a6, 0xd296eeb4, 0xd99be7ba,
135 0x7bbb3bdb, 0x70b632d5, 0x6da129c7, 0x66ac20c9,
136 0x578f1fe3, 0x5c8216ed, 0x41950dff, 0x4a9804f1,
137 0x23d373ab, 0x28de7aa5, 0x35c961b7, 0x3ec468b9,
138 0x0fe75793, 0x04ea5e9d, 0x19fd458f, 0x12f04c81,
139 0xcb6bab3b, 0xc066a235, 0xdd71b927, 0xd67cb029,
140 0xe75f8f03, 0xec52860d, 0xf1459d1f, 0xfa489411,
141 0x9303e34b, 0x980eea45, 0x8519f157, 0x8e14f859,
142 0xbf37c773, 0xb43ace7d, 0xa92dd56f, 0xa220dc61,
143 0xf66d76ad, 0xfd607fa3, 0xe07764b1, 0xeb7a6dbf,
144 0xda595295, 0xd1545b9b, 0xcc434089, 0xc74e4987,
145 0xae053edd, 0xa50837d3, 0xb81f2cc1, 0xb31225cf,
146 0x82311ae5, 0x893c13eb, 0x942b08f9, 0x9f2601f7,
147 0x46bde64d, 0x4db0ef43, 0x50a7f451, 0x5baafd5f,
148 0x6a89c275, 0x6184cb7b, 0x7c93d069, 0x779ed967,
149 0x1ed5ae3d, 0x15d8a733, 0x08cfbc21, 0x03c2b52f,
150 0x32e18a05, 0x39ec830b, 0x24fb9819, 0x2ff69117,
151 0x8dd64d76, 0x86db4478, 0x9bcc5f6a, 0x90c15664,
152 0xa1e2694e, 0xaaef6040, 0xb7f87b52, 0xbcf5725c,
153 0xd5be0506, 0xdeb30c08, 0xc3a4171a, 0xc8a91e14,
154 0xf98a213e, 0xf2872830, 0xef903322, 0xe49d3a2c,
155 0x3d06dd96, 0x360bd498, 0x2b1ccf8a, 0x2011c684,
156 0x1132f9ae, 0x1a3ff0a0, 0x0728ebb2, 0x0c25e2bc,
157 0x656e95e6, 0x6e639ce8, 0x737487fa, 0x78798ef4,
158 0x495ab1de, 0x4257b8d0, 0x5f40a3c2, 0x544daacc,
159 0xf7daec41, 0xfcd7e54f, 0xe1c0fe5d, 0xeacdf753,
160 0xdbeec879, 0xd0e3c177, 0xcdf4da65, 0xc6f9d36b,
161 0xafb2a431, 0xa4bfad3f, 0xb9a8b62d, 0xb2a5bf23,
162 0x83868009, 0x888b8907, 0x959c9215, 0x9e919b1b,
163 0x470a7ca1, 0x4c0775af, 0x51106ebd, 0x5a1d67b3,
164 0x6b3e5899, 0x60335197, 0x7d244a85, 0x7629438b,
165 0x1f6234d1, 0x146f3ddf, 0x097826cd, 0x02752fc3,
166 0x335610e9, 0x385b19e7, 0x254c02f5, 0x2e410bfb,
167 0x8c61d79a, 0x876cde94, 0x9a7bc586, 0x9176cc88,
168 0xa055f3a2, 0xab58faac, 0xb64fe1be, 0xbd42e8b0,
169 0xd4099fea, 0xdf0496e4, 0xc2138df6, 0xc91e84f8,
170 0xf83dbbd2, 0xf330b2dc, 0xee27a9ce, 0xe52aa0c0,
171 0x3cb1477a, 0x37bc4e74, 0x2aab5566, 0x21a65c68,
172 0x10856342, 0x1b886a4c, 0x069f715e, 0x0d927850,
173 0x64d90f0a, 0x6fd40604, 0x72c31d16, 0x79ce1418,
174 0x48ed2b32, 0x43e0223c, 0x5ef7392e, 0x55fa3020,
175 0x01b79aec, 0x0aba93e2, 0x17ad88f0, 0x1ca081fe,
176 0x2d83bed4, 0x268eb7da, 0x3b99acc8, 0x3094a5c6,
177 0x59dfd29c, 0x52d2db92, 0x4fc5c080, 0x44c8c98e,
178 0x75ebf6a4, 0x7ee6ffaa, 0x63f1e4b8, 0x68fcedb6,
179 0xb1670a0c, 0xba6a0302, 0xa77d1810, 0xac70111e,
180 0x9d532e34, 0x965e273a, 0x8b493c28, 0x80443526,
181 0xe90f427c, 0xe2024b72, 0xff155060, 0xf418596e,
182 0xc53b6644, 0xce366f4a, 0xd3217458, 0xd82c7d56,
183 0x7a0ca137, 0x7101a839, 0x6c16b32b, 0x671bba25,
184 0x5638850f, 0x5d358c01, 0x40229713, 0x4b2f9e1d,
185 0x2264e947, 0x2969e049, 0x347efb5b, 0x3f73f255,
186 0x0e50cd7f, 0x055dc471, 0x184adf63, 0x1347d66d,
187 0xcadc31d7, 0xc1d138d9, 0xdcc623cb, 0xd7cb2ac5,
188 0xe6e815ef, 0xede51ce1, 0xf0f207f3, 0xfbff0efd,
189 0x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
190 0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
191 } };
192 union CRYPTO_STATE st = { .l = {
193 float64_val(env->vfp.regs[rm]),
194 float64_val(env->vfp.regs[rm + 1])
195 } };
196 int i;
197
198 assert(decrypt < 2);
199
200 for (i = 0; i < 16; i += 4) {
201 st.words[i >> 2] = cpu_to_le32(
202 mc[decrypt][st.bytes[i]] ^
203 rol32(mc[decrypt][st.bytes[i + 1]], 8) ^
204 rol32(mc[decrypt][st.bytes[i + 2]], 16) ^
205 rol32(mc[decrypt][st.bytes[i + 3]], 24));
206 }
207
208 env->vfp.regs[rd] = make_float64(st.l[0]);
209 env->vfp.regs[rd + 1] = make_float64(st.l[1]);
210 }
211
212 /*
213 * SHA-1 logical functions
214 */
215
216 static uint32_t cho(uint32_t x, uint32_t y, uint32_t z)
217 {
218 return (x & (y ^ z)) ^ z;
219 }
220
221 static uint32_t par(uint32_t x, uint32_t y, uint32_t z)
222 {
223 return x ^ y ^ z;
224 }
225
226 static uint32_t maj(uint32_t x, uint32_t y, uint32_t z)
227 {
228 return (x & y) | ((x | y) & z);
229 }
230
231 void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
232 uint32_t rm, uint32_t op)
233 {
234 union CRYPTO_STATE d = { .l = {
235 float64_val(env->vfp.regs[rd]),
236 float64_val(env->vfp.regs[rd + 1])
237 } };
238 union CRYPTO_STATE n = { .l = {
239 float64_val(env->vfp.regs[rn]),
240 float64_val(env->vfp.regs[rn + 1])
241 } };
242 union CRYPTO_STATE m = { .l = {
243 float64_val(env->vfp.regs[rm]),
244 float64_val(env->vfp.regs[rm + 1])
245 } };
246
247 if (op == 3) { /* sha1su0 */
248 d.l[0] ^= d.l[1] ^ m.l[0];
249 d.l[1] ^= n.l[0] ^ m.l[1];
250 } else {
251 int i;
252
253 for (i = 0; i < 4; i++) {
254 uint32_t t;
255
256 switch (op) {
257 case 0: /* sha1c */
258 t = cho(d.words[1], d.words[2], d.words[3]);
259 break;
260 case 1: /* sha1p */
261 t = par(d.words[1], d.words[2], d.words[3]);
262 break;
263 case 2: /* sha1m */
264 t = maj(d.words[1], d.words[2], d.words[3]);
265 break;
266 default:
267 g_assert_not_reached();
268 }
269 t += rol32(d.words[0], 5) + n.words[0] + m.words[i];
270
271 n.words[0] = d.words[3];
272 d.words[3] = d.words[2];
273 d.words[2] = ror32(d.words[1], 2);
274 d.words[1] = d.words[0];
275 d.words[0] = t;
276 }
277 }
278 env->vfp.regs[rd] = make_float64(d.l[0]);
279 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
280 }
281
282 void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
283 {
284 union CRYPTO_STATE m = { .l = {
285 float64_val(env->vfp.regs[rm]),
286 float64_val(env->vfp.regs[rm + 1])
287 } };
288
289 m.words[0] = ror32(m.words[0], 2);
290 m.words[1] = m.words[2] = m.words[3] = 0;
291
292 env->vfp.regs[rd] = make_float64(m.l[0]);
293 env->vfp.regs[rd + 1] = make_float64(m.l[1]);
294 }
295
296 void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
297 {
298 union CRYPTO_STATE d = { .l = {
299 float64_val(env->vfp.regs[rd]),
300 float64_val(env->vfp.regs[rd + 1])
301 } };
302 union CRYPTO_STATE m = { .l = {
303 float64_val(env->vfp.regs[rm]),
304 float64_val(env->vfp.regs[rm + 1])
305 } };
306
307 d.words[0] = rol32(d.words[0] ^ m.words[1], 1);
308 d.words[1] = rol32(d.words[1] ^ m.words[2], 1);
309 d.words[2] = rol32(d.words[2] ^ m.words[3], 1);
310 d.words[3] = rol32(d.words[3] ^ d.words[0], 1);
311
312 env->vfp.regs[rd] = make_float64(d.l[0]);
313 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
314 }
315
316 /*
317 * The SHA-256 logical functions, according to
318 * http://csrc.nist.gov/groups/STM/cavp/documents/shs/sha256-384-512.pdf
319 */
320
321 static uint32_t S0(uint32_t x)
322 {
323 return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
324 }
325
326 static uint32_t S1(uint32_t x)
327 {
328 return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
329 }
330
331 static uint32_t s0(uint32_t x)
332 {
333 return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
334 }
335
336 static uint32_t s1(uint32_t x)
337 {
338 return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
339 }
340
341 void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
342 uint32_t rm)
343 {
344 union CRYPTO_STATE d = { .l = {
345 float64_val(env->vfp.regs[rd]),
346 float64_val(env->vfp.regs[rd + 1])
347 } };
348 union CRYPTO_STATE n = { .l = {
349 float64_val(env->vfp.regs[rn]),
350 float64_val(env->vfp.regs[rn + 1])
351 } };
352 union CRYPTO_STATE m = { .l = {
353 float64_val(env->vfp.regs[rm]),
354 float64_val(env->vfp.regs[rm + 1])
355 } };
356 int i;
357
358 for (i = 0; i < 4; i++) {
359 uint32_t t = cho(n.words[0], n.words[1], n.words[2]) + n.words[3]
360 + S1(n.words[0]) + m.words[i];
361
362 n.words[3] = n.words[2];
363 n.words[2] = n.words[1];
364 n.words[1] = n.words[0];
365 n.words[0] = d.words[3] + t;
366
367 t += maj(d.words[0], d.words[1], d.words[2]) + S0(d.words[0]);
368
369 d.words[3] = d.words[2];
370 d.words[2] = d.words[1];
371 d.words[1] = d.words[0];
372 d.words[0] = t;
373 }
374
375 env->vfp.regs[rd] = make_float64(d.l[0]);
376 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
377 }
378
379 void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
380 uint32_t rm)
381 {
382 union CRYPTO_STATE d = { .l = {
383 float64_val(env->vfp.regs[rd]),
384 float64_val(env->vfp.regs[rd + 1])
385 } };
386 union CRYPTO_STATE n = { .l = {
387 float64_val(env->vfp.regs[rn]),
388 float64_val(env->vfp.regs[rn + 1])
389 } };
390 union CRYPTO_STATE m = { .l = {
391 float64_val(env->vfp.regs[rm]),
392 float64_val(env->vfp.regs[rm + 1])
393 } };
394 int i;
395
396 for (i = 0; i < 4; i++) {
397 uint32_t t = cho(d.words[0], d.words[1], d.words[2]) + d.words[3]
398 + S1(d.words[0]) + m.words[i];
399
400 d.words[3] = d.words[2];
401 d.words[2] = d.words[1];
402 d.words[1] = d.words[0];
403 d.words[0] = n.words[3 - i] + t;
404 }
405
406 env->vfp.regs[rd] = make_float64(d.l[0]);
407 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
408 }
409
410 void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
411 {
412 union CRYPTO_STATE d = { .l = {
413 float64_val(env->vfp.regs[rd]),
414 float64_val(env->vfp.regs[rd + 1])
415 } };
416 union CRYPTO_STATE m = { .l = {
417 float64_val(env->vfp.regs[rm]),
418 float64_val(env->vfp.regs[rm + 1])
419 } };
420
421 d.words[0] += s0(d.words[1]);
422 d.words[1] += s0(d.words[2]);
423 d.words[2] += s0(d.words[3]);
424 d.words[3] += s0(m.words[0]);
425
426 env->vfp.regs[rd] = make_float64(d.l[0]);
427 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
428 }
429
430 void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
431 uint32_t rm)
432 {
433 union CRYPTO_STATE d = { .l = {
434 float64_val(env->vfp.regs[rd]),
435 float64_val(env->vfp.regs[rd + 1])
436 } };
437 union CRYPTO_STATE n = { .l = {
438 float64_val(env->vfp.regs[rn]),
439 float64_val(env->vfp.regs[rn + 1])
440 } };
441 union CRYPTO_STATE m = { .l = {
442 float64_val(env->vfp.regs[rm]),
443 float64_val(env->vfp.regs[rm + 1])
444 } };
445
446 d.words[0] += s1(m.words[2]) + n.words[1];
447 d.words[1] += s1(m.words[3]) + n.words[2];
448 d.words[2] += s1(d.words[0]) + n.words[3];
449 d.words[3] += s1(d.words[1]) + m.words[0];
450
451 env->vfp.regs[rd] = make_float64(d.l[0]);
452 env->vfp.regs[rd + 1] = make_float64(d.l[1]);
453 }