qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Richard Henderson <richard.henderson@linaro.org>
To: qemu-devel@nongnu.org
Cc: peter.maydell@linaro.org
Subject: [Qemu-devel] [PATCH v2 23/27] target/arm: Implement pauth_computepac
Date: Thu, 13 Dec 2018 23:24:06 -0600	[thread overview]
Message-ID: <20181214052410.11863-24-richard.henderson@linaro.org> (raw)
In-Reply-To: <20181214052410.11863-1-richard.henderson@linaro.org>

This is the main crypto routine, an implementation of QARMA.
This matches, as much as possible, ARM pseudocode.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper-a64.c | 241 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 240 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 19486b9677..1da7867a42 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1057,10 +1057,249 @@ uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
  * Helpers for ARMv8.3-PAuth.
  */
 
+static uint64_t pac_cell_shuffle(uint64_t i)
+{
+    uint64_t o = 0;
+
+    o |= extract64(i, 52, 4);
+    o |= extract64(i, 24, 4) << 4;
+    o |= extract64(i, 44, 4) << 8;
+    o |= extract64(i,  0, 4) << 12;
+
+    o |= extract64(i, 28, 4) << 16;
+    o |= extract64(i, 48, 4) << 20;
+    o |= extract64(i,  4, 4) << 24;
+    o |= extract64(i, 40, 4) << 28;
+
+    o |= i & MAKE_64BIT_MASK(32, 4);
+    o |= extract64(i, 12, 4) << 36;
+    o |= extract64(i, 56, 4) << 40;
+    o |= extract64(i,  8, 4) << 44;
+
+    o |= extract64(i, 36, 4) << 48;
+    o |= extract64(i, 16, 4) << 52;
+    o |= extract64(i, 40, 4) << 56;
+    o |= i & MAKE_64BIT_MASK(60, 4);
+
+    return o;
+}
+
+static uint64_t pac_cell_inv_shuffle(uint64_t i)
+{
+    uint64_t o = 0;
+
+    o |= extract64(i, 12, 4);
+    o |= extract64(i, 24, 4) << 4;
+    o |= extract64(i, 48, 4) << 8;
+    o |= extract64(i, 36, 4) << 12;
+
+    o |= extract64(i, 56, 4) << 16;
+    o |= extract64(i, 44, 4) << 20;
+    o |= extract64(i,  4, 4) << 24;
+    o |= extract64(i, 16, 4) << 28;
+
+    o |= i & MAKE_64BIT_MASK(32, 4);
+    o |= extract64(i, 52, 4) << 36;
+    o |= extract64(i, 28, 4) << 40;
+    o |= extract64(i,  8, 4) << 44;
+
+    o |= extract64(i, 20, 4) << 48;
+    o |= extract64(i,  0, 4) << 52;
+    o |= extract64(i, 40, 4) << 56;
+    o |= i & MAKE_64BIT_MASK(60, 4);
+
+    return o;
+}
+
+static uint64_t pac_sub(uint64_t i)
+{
+    static const uint8_t sub[16] = {
+        0xb, 0x6, 0x8, 0xf, 0xc, 0x0, 0x9, 0xe,
+        0x3, 0x7, 0x4, 0x5, 0xd, 0x2, 0x1, 0xa,
+    };
+    uint64_t o = 0;
+    int b;
+
+    for (b = 0; b < 64; b += 16) {
+        o |= (uint64_t)sub[(i >> b) & 0xf] << b;
+    }
+    return o;
+}
+
+static uint64_t pac_inv_sub(uint64_t i)
+{
+    static const uint8_t inv_sub[16] = {
+        0x5, 0xe, 0xd, 0x8, 0xa, 0xb, 0x1, 0x9,
+        0x2, 0x6, 0xf, 0x0, 0x4, 0xc, 0x7, 0x3,
+    };
+    uint64_t o = 0;
+    int b;
+
+    for (b = 0; b < 64; b += 16) {
+        o |= (uint64_t)inv_sub[(i >> b) & 0xf] << b;
+    }
+    return o;
+}
+
+static int rot_cell(int cell, int n)
+{
+    cell |= cell << 4;
+    cell >>= n;
+    return cell & 0xf;
+}
+
+static uint64_t pac_mult(uint64_t i)
+{
+    uint64_t o = 0;
+    int b;
+
+    for (b = 0; b < 4 * 4; b += 4) {
+        int i0, i4, i8, ic, t0, t1, t2, t3;
+
+        i0 = extract64(i, b, 4);
+        i4 = extract64(i, b + 4 * 4, 4);
+        i8 = extract64(i, b + 8 * 4, 4);
+        ic = extract64(i, b + 12 * 4, 4);
+
+        t0 = rot_cell(i8, 1) ^ rot_cell(i4, 2) ^ rot_cell(i0, 1);
+        t1 = rot_cell(ic, 1) ^ rot_cell(i4, 1) ^ rot_cell(i0, 2);
+        t2 = rot_cell(ic, 2) ^ rot_cell(i8, 1) ^ rot_cell(i0, 1);
+        t3 = rot_cell(ic, 2) ^ rot_cell(i8, 2) ^ rot_cell(i4, 1);
+
+        o |= (uint64_t)t3 << b;
+        o |= (uint64_t)t2 << (b + 4 * 4);
+        o |= (uint64_t)t1 << (b + 8 * 4);
+        o |= (uint64_t)t0 << (b + 12 * 4);
+    }
+    return o;
+}
+
+static uint64_t tweak_cell_rot(uint64_t cell)
+{
+    return (cell >> 1) | (((cell ^ (cell >> 1)) & 1) << 3);
+}
+
+static uint64_t tweak_shuffle(uint64_t i)
+{
+    uint64_t o = 0;
+
+    o |= extract64(i, 16, 4) << 0;
+    o |= extract64(i, 20, 4) << 4;
+    o |= tweak_cell_rot(extract64(i, 24, 4)) << 8;
+    o |= extract64(i, 28, 4) << 12;
+
+    o |= tweak_cell_rot(extract64(i, 44, 4)) << 16;
+    o |= extract64(i,  8, 4) << 20;
+    o |= extract64(i, 12, 4) << 24;
+    o |= tweak_cell_rot(extract64(i, 32, 4)) << 28;
+
+    o |= extract64(i, 48, 4) << 32;
+    o |= extract64(i, 52, 4) << 36;
+    o |= extract64(i, 56, 4) << 40;
+    o |= tweak_cell_rot(extract64(i, 60, 4)) << 44;
+
+    o |= tweak_cell_rot(extract64(i,  0, 4)) << 48;
+    o |= extract64(i,  4, 4) << 52;
+    o |= tweak_cell_rot(extract64(i, 40, 4)) << 56;
+    o |= tweak_cell_rot(extract64(i, 36, 4)) << 60;
+
+    return o;
+}
+
+static uint64_t tweak_cell_inv_rot(uint64_t cell)
+{
+    return ((cell << 1) & 0xf) | ((cell & 1) ^ (cell >> 3));
+}
+
+static uint64_t tweak_inv_shuffle(uint64_t i)
+{
+    uint64_t o = 0;
+
+    o |= tweak_cell_inv_rot(extract64(i, 48, 4));
+    o |= extract64(i, 52, 4) << 4;
+    o |= extract64(i, 20, 4) << 8;
+    o |= extract64(i, 24, 4) << 12;
+
+    o |= extract64(i,  0, 4) << 16;
+    o |= extract64(i,  4, 4) << 20;
+    o |= tweak_cell_inv_rot(extract64(i,  8, 4)) << 24;
+    o |= extract64(i, 12, 4) << 28;
+
+    o |= tweak_cell_inv_rot(extract64(i, 28, 4)) << 32;
+    o |= tweak_cell_inv_rot(extract64(i, 60, 4)) << 36;
+    o |= tweak_cell_inv_rot(extract64(i, 56, 4)) << 40;
+    o |= tweak_cell_inv_rot(extract64(i, 16, 4)) << 44;
+
+    o |= extract64(i, 32, 4) << 48;
+    o |= extract64(i, 36, 4) << 52;
+    o |= extract64(i, 40, 4) << 56;
+    o |= tweak_cell_inv_rot(extract64(i, 44, 4)) << 60;
+
+    return o;
+}
+
 static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
                                  ARMPACKey key)
 {
-    g_assert_not_reached(); /* FIXME */
+    static const uint64_t RC[5] = {
+        0x0000000000000000ull,
+        0x13198A2E03707344ull,
+        0xA4093822299F31D0ull,
+        0x082EFA98EC4E6C89ull,
+        0x452821E638D01377ull,
+    };
+    const uint64_t alpha = 0xC0AC29B7C97C50DDull;
+    /* Note that in the ARM pseudocode, key0 contains bits <127:64>
+     * and key1 contains bits <63:0> of the 128-bit key.
+     */
+    uint64_t key0 = key.hi, key1 = key.lo;
+    uint64_t workingval, runningmod, roundkey, modk0;
+    int i;
+
+    modk0 = (key0 << 63) | ((key0 >> 1) ^ (key0 >> 63));
+    runningmod = modifier;
+    workingval = data ^ key0;
+
+    for (i = 0; i <= 4; ++i) {
+        roundkey = key1 ^ runningmod;
+        workingval ^= roundkey;
+        workingval ^= RC[i];
+        if (i > 0) {
+            workingval = pac_cell_shuffle(workingval);
+            workingval = pac_mult(workingval);
+        }
+        workingval = pac_sub(workingval);
+        runningmod = tweak_shuffle(runningmod);
+    }
+    roundkey = modk0 ^ runningmod;
+    workingval ^= roundkey;
+    workingval = pac_cell_shuffle(workingval);
+    workingval = pac_mult(workingval);
+    workingval = pac_sub(workingval);
+    workingval = pac_cell_shuffle(workingval);
+    workingval = pac_mult(workingval);
+    workingval ^= key1;
+    workingval = pac_cell_inv_shuffle(workingval);
+    workingval = pac_inv_sub(workingval);
+    workingval = pac_mult(workingval);
+    workingval = pac_cell_inv_shuffle(workingval);
+    workingval ^= key0;
+    workingval ^= runningmod;
+    for (i = 0; i <= 4; ++i) {
+        workingval = pac_inv_sub(workingval);
+        if (i < 4) {
+            workingval = pac_mult(workingval);
+            workingval = pac_cell_inv_shuffle(workingval);
+        }
+        runningmod = tweak_inv_shuffle(runningmod);
+        roundkey = key1 ^ runningmod;
+        workingval ^= RC[4-i];
+        workingval ^= roundkey;
+        workingval ^= alpha;
+    }
+    workingval ^= modk0;
+
+    return workingval;
 }
 
 static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
-- 
2.17.2

  parent reply	other threads:[~2018-12-14  5:24 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-14  5:23 [Qemu-devel] [PATCH v2 00/27] target/arm: Implement ARMv8.3-PAuth Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 01/27] target/arm: Add state for the ARMv8.3-PAuth extension Richard Henderson
2019-01-04 16:25   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 02/27] target/arm: Add SCTLR bits through ARMv8.5 Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 03/27] target/arm: Add PAuth active bit to tbflags Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 04/27] target/arm: Add PAuth helpers Richard Henderson
2019-01-04 16:25   ` Peter Maydell
2019-01-08  2:32     ` Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 05/27] target/arm: Decode PAuth within system hint space Richard Henderson
2019-01-04 16:50   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 06/27] target/arm: Rearrange decode in disas_data_proc_1src Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 07/27] target/arm: Decode PAuth within disas_data_proc_1src Richard Henderson
2019-01-04 17:00   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 08/27] target/arm: Decode PAuth within disas_data_proc_2src Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 09/27] target/arm: Move helper_exception_return to helper-a64.c Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 10/27] target/arm: Add new_pc argument to helper_exception_return Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 11/27] target/arm: Rearrange decode in disas_uncond_b_reg Richard Henderson
2019-01-04 17:05   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 12/27] target/arm: Decode PAuth within disas_uncond_b_reg Richard Henderson
2019-01-04 17:12   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 13/27] target/arm: Decode Load/store register (pac) Richard Henderson
2019-01-04 18:52   ` Peter Maydell
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 14/27] target/arm: Move cpu_mmu_index out of line Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 15/27] target/arm: Introduce arm_mmu_idx Richard Henderson
2018-12-14  5:23 ` [Qemu-devel] [PATCH v2 16/27] target/arm: Introduce arm_stage1_mmu_idx Richard Henderson
2019-01-04 18:58   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 17/27] target/arm: Create ARMVAParameters and helpers Richard Henderson
2019-01-07 11:40   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 18/27] target/arm: Reuse aa64_va_parameters for setting tbflags Richard Henderson
2019-01-07 11:44   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 19/27] target/arm: Export aa64_va_parameters to internals.h Richard Henderson
2019-01-07 11:45   ` Peter Maydell
2019-01-07 22:22     ` Richard Henderson
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 20/27] target/arm: Implement pauth_strip Richard Henderson
2019-01-07 11:52   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 21/27] target/arm: Implement pauth_auth Richard Henderson
2019-01-07 11:58   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 22/27] target/arm: Implement pauth_addpac Richard Henderson
2019-01-07 13:31   ` Peter Maydell
2019-01-08  4:48     ` Richard Henderson
2018-12-14  5:24 ` Richard Henderson [this message]
2019-01-07 14:09   ` [Qemu-devel] [PATCH v2 23/27] target/arm: Implement pauth_computepac Peter Maydell
2019-01-08  5:00     ` Richard Henderson
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 24/27] target/arm: Add PAuth system registers Richard Henderson
2019-01-07 14:17   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 25/27] target/arm: Enable PAuth for -cpu max Richard Henderson
2019-01-07 14:18   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 26/27] target/arm: Enable PAuth for user-only, part 2 Richard Henderson
2019-01-07 14:23   ` Peter Maydell
2018-12-14  5:24 ` [Qemu-devel] [PATCH v2 27/27] target/arm: Tidy TBI handling in gen_a64_set_pc Richard Henderson
2019-01-07 14:34   ` Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181214052410.11863-24-richard.henderson@linaro.org \
    --to=richard.henderson@linaro.org \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).