From: Richard Henderson <richard.henderson@linaro.org>
To: qemu-devel@nongnu.org
Cc: peter.maydell@linaro.org
Subject: [Qemu-devel] [PATCH v2 23/27] target/arm: Implement pauth_computepac
Date: Thu, 13 Dec 2018 23:24:06 -0600 [thread overview]
Message-ID: <20181214052410.11863-24-richard.henderson@linaro.org> (raw)
In-Reply-To: <20181214052410.11863-1-richard.henderson@linaro.org>
This is the main crypto routine, an implementation of QARMA.
This matches, as much as possible, ARM pseudocode.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.c | 241 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 240 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 19486b9677..1da7867a42 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1057,10 +1057,249 @@ uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
* Helpers for ARMv8.3-PAuth.
*/
+static uint64_t pac_cell_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 52, 4);
+ o |= extract64(i, 24, 4) << 4;
+ o |= extract64(i, 44, 4) << 8;
+ o |= extract64(i, 0, 4) << 12;
+
+ o |= extract64(i, 28, 4) << 16;
+ o |= extract64(i, 48, 4) << 20;
+ o |= extract64(i, 4, 4) << 24;
+ o |= extract64(i, 40, 4) << 28;
+
+ o |= i & MAKE_64BIT_MASK(32, 4);
+ o |= extract64(i, 12, 4) << 36;
+ o |= extract64(i, 56, 4) << 40;
+ o |= extract64(i, 8, 4) << 44;
+
+ o |= extract64(i, 36, 4) << 48;
+ o |= extract64(i, 16, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= i & MAKE_64BIT_MASK(60, 4);
+
+ return o;
+}
+
+static uint64_t pac_cell_inv_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 12, 4);
+ o |= extract64(i, 24, 4) << 4;
+ o |= extract64(i, 48, 4) << 8;
+ o |= extract64(i, 36, 4) << 12;
+
+ o |= extract64(i, 56, 4) << 16;
+ o |= extract64(i, 44, 4) << 20;
+ o |= extract64(i, 4, 4) << 24;
+ o |= extract64(i, 16, 4) << 28;
+
+ o |= i & MAKE_64BIT_MASK(32, 4);
+ o |= extract64(i, 52, 4) << 36;
+ o |= extract64(i, 28, 4) << 40;
+ o |= extract64(i, 8, 4) << 44;
+
+ o |= extract64(i, 20, 4) << 48;
+ o |= extract64(i, 0, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= i & MAKE_64BIT_MASK(60, 4);
+
+ return o;
+}
+
+static uint64_t pac_sub(uint64_t i)
+{
+ static const uint8_t sub[16] = {
+ 0xb, 0x6, 0x8, 0xf, 0xc, 0x0, 0x9, 0xe,
+ 0x3, 0x7, 0x4, 0x5, 0xd, 0x2, 0x1, 0xa,
+ };
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 64; b += 16) {
+ o |= (uint64_t)sub[(i >> b) & 0xf] << b;
+ }
+ return o;
+}
+
+static uint64_t pac_inv_sub(uint64_t i)
+{
+ static const uint8_t inv_sub[16] = {
+ 0x5, 0xe, 0xd, 0x8, 0xa, 0xb, 0x1, 0x9,
+ 0x2, 0x6, 0xf, 0x0, 0x4, 0xc, 0x7, 0x3,
+ };
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 64; b += 16) {
+ o |= (uint64_t)inv_sub[(i >> b) & 0xf] << b;
+ }
+ return o;
+}
+
+static int rot_cell(int cell, int n)
+{
+ cell |= cell << 4;
+ cell >>= n;
+ return cell & 0xf;
+}
+
+static uint64_t pac_mult(uint64_t i)
+{
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 4 * 4; b += 4) {
+ int i0, i4, i8, ic, t0, t1, t2, t3;
+
+ i0 = extract64(i, b, 4);
+ i4 = extract64(i, b + 4 * 4, 4);
+ i8 = extract64(i, b + 8 * 4, 4);
+ ic = extract64(i, b + 12 * 4, 4);
+
+ t0 = rot_cell(i8, 1) ^ rot_cell(i4, 2) ^ rot_cell(i0, 1);
+ t1 = rot_cell(ic, 1) ^ rot_cell(i4, 1) ^ rot_cell(i0, 2);
+ t2 = rot_cell(ic, 2) ^ rot_cell(i8, 1) ^ rot_cell(i0, 1);
+ t3 = rot_cell(ic, 2) ^ rot_cell(i8, 2) ^ rot_cell(i4, 1);
+
+ o |= (uint64_t)t3 << b;
+ o |= (uint64_t)t2 << (b + 4 * 4);
+ o |= (uint64_t)t1 << (b + 8 * 4);
+ o |= (uint64_t)t0 << (b + 12 * 4);
+ }
+ return o;
+}
+
+static uint64_t tweak_cell_rot(uint64_t cell)
+{
+ return (cell >> 1) | (((cell ^ (cell >> 1)) & 1) << 3);
+}
+
+static uint64_t tweak_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 16, 4) << 0;
+ o |= extract64(i, 20, 4) << 4;
+ o |= tweak_cell_rot(extract64(i, 24, 4)) << 8;
+ o |= extract64(i, 28, 4) << 12;
+
+ o |= tweak_cell_rot(extract64(i, 44, 4)) << 16;
+ o |= extract64(i, 8, 4) << 20;
+ o |= extract64(i, 12, 4) << 24;
+ o |= tweak_cell_rot(extract64(i, 32, 4)) << 28;
+
+ o |= extract64(i, 48, 4) << 32;
+ o |= extract64(i, 52, 4) << 36;
+ o |= extract64(i, 56, 4) << 40;
+ o |= tweak_cell_rot(extract64(i, 60, 4)) << 44;
+
+ o |= tweak_cell_rot(extract64(i, 0, 4)) << 48;
+ o |= extract64(i, 4, 4) << 52;
+ o |= tweak_cell_rot(extract64(i, 40, 4)) << 56;
+ o |= tweak_cell_rot(extract64(i, 36, 4)) << 60;
+
+ return o;
+}
+
+static uint64_t tweak_cell_inv_rot(uint64_t cell)
+{
+ return ((cell << 1) & 0xf) | ((cell & 1) ^ (cell >> 3));
+}
+
+static uint64_t tweak_inv_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= tweak_cell_inv_rot(extract64(i, 48, 4));
+ o |= extract64(i, 52, 4) << 4;
+ o |= extract64(i, 20, 4) << 8;
+ o |= extract64(i, 24, 4) << 12;
+
+ o |= extract64(i, 0, 4) << 16;
+ o |= extract64(i, 4, 4) << 20;
+ o |= tweak_cell_inv_rot(extract64(i, 8, 4)) << 24;
+ o |= extract64(i, 12, 4) << 28;
+
+ o |= tweak_cell_inv_rot(extract64(i, 28, 4)) << 32;
+ o |= tweak_cell_inv_rot(extract64(i, 60, 4)) << 36;
+ o |= tweak_cell_inv_rot(extract64(i, 56, 4)) << 40;
+ o |= tweak_cell_inv_rot(extract64(i, 16, 4)) << 44;
+
+ o |= extract64(i, 32, 4) << 48;
+ o |= extract64(i, 36, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= tweak_cell_inv_rot(extract64(i, 44, 4)) << 60;
+
+ return o;
+}
+
static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
ARMPACKey key)
{
- g_assert_not_reached(); /* FIXME */
+ static const uint64_t RC[5] = {
+ 0x0000000000000000ull,
+ 0x13198A2E03707344ull,
+ 0xA4093822299F31D0ull,
+ 0x082EFA98EC4E6C89ull,
+ 0x452821E638D01377ull,
+ };
+ const uint64_t alpha = 0xC0AC29B7C97C50DDull;
+ /* Note that in the ARM pseudocode, key0 contains bits <127:64>
+ * and key1 contains bits <63:0> of the 128-bit key.
+ */
+ uint64_t key0 = key.hi, key1 = key.lo;
+ uint64_t workingval, runningmod, roundkey, modk0;
+ int i;
+
+ modk0 = (key0 << 63) | ((key0 >> 1) ^ (key0 >> 63));
+ runningmod = modifier;
+ workingval = data ^ key0;
+
+ for (i = 0; i <= 4; ++i) {
+ roundkey = key1 ^ runningmod;
+ workingval ^= roundkey;
+ workingval ^= RC[i];
+ if (i > 0) {
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ }
+ workingval = pac_sub(workingval);
+ runningmod = tweak_shuffle(runningmod);
+ }
+ roundkey = modk0 ^ runningmod;
+ workingval ^= roundkey;
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ workingval = pac_sub(workingval);
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ workingval ^= key1;
+ workingval = pac_cell_inv_shuffle(workingval);
+ workingval = pac_inv_sub(workingval);
+ workingval = pac_mult(workingval);
+ workingval = pac_cell_inv_shuffle(workingval);
+ workingval ^= key0;
+ workingval ^= runningmod;
+ for (i = 0; i <= 4; ++i) {
+ workingval = pac_inv_sub(workingval);
+ if (i < 4) {
+ workingval = pac_mult(workingval);
+ workingval = pac_cell_inv_shuffle(workingval);
+ }
+ runningmod = tweak_inv_shuffle(runningmod);
+ roundkey = key1 ^ runningmod;
+ workingval ^= RC[4-i];
+ workingval ^= roundkey;
+ workingval ^= alpha;
+ }
+ workingval ^= modk0;
+
+ return workingval;
}
static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
--
2.17.2
next prev parent reply other threads:[~2018-12-14 5:24 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-14 5:23 [Qemu-devel] [PATCH v2 00/27] target/arm: Implement ARMv8.3-PAuth Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 01/27] target/arm: Add state for the ARMv8.3-PAuth extension Richard Henderson
2019-01-04 16:25 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 02/27] target/arm: Add SCTLR bits through ARMv8.5 Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 03/27] target/arm: Add PAuth active bit to tbflags Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 04/27] target/arm: Add PAuth helpers Richard Henderson
2019-01-04 16:25 ` Peter Maydell
2019-01-08 2:32 ` Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 05/27] target/arm: Decode PAuth within system hint space Richard Henderson
2019-01-04 16:50 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 06/27] target/arm: Rearrange decode in disas_data_proc_1src Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 07/27] target/arm: Decode PAuth within disas_data_proc_1src Richard Henderson
2019-01-04 17:00 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 08/27] target/arm: Decode PAuth within disas_data_proc_2src Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 09/27] target/arm: Move helper_exception_return to helper-a64.c Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 10/27] target/arm: Add new_pc argument to helper_exception_return Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 11/27] target/arm: Rearrange decode in disas_uncond_b_reg Richard Henderson
2019-01-04 17:05 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 12/27] target/arm: Decode PAuth within disas_uncond_b_reg Richard Henderson
2019-01-04 17:12 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 13/27] target/arm: Decode Load/store register (pac) Richard Henderson
2019-01-04 18:52 ` Peter Maydell
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 14/27] target/arm: Move cpu_mmu_index out of line Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 15/27] target/arm: Introduce arm_mmu_idx Richard Henderson
2018-12-14 5:23 ` [Qemu-devel] [PATCH v2 16/27] target/arm: Introduce arm_stage1_mmu_idx Richard Henderson
2019-01-04 18:58 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 17/27] target/arm: Create ARMVAParameters and helpers Richard Henderson
2019-01-07 11:40 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 18/27] target/arm: Reuse aa64_va_parameters for setting tbflags Richard Henderson
2019-01-07 11:44 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 19/27] target/arm: Export aa64_va_parameters to internals.h Richard Henderson
2019-01-07 11:45 ` Peter Maydell
2019-01-07 22:22 ` Richard Henderson
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 20/27] target/arm: Implement pauth_strip Richard Henderson
2019-01-07 11:52 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 21/27] target/arm: Implement pauth_auth Richard Henderson
2019-01-07 11:58 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 22/27] target/arm: Implement pauth_addpac Richard Henderson
2019-01-07 13:31 ` Peter Maydell
2019-01-08 4:48 ` Richard Henderson
2018-12-14 5:24 ` Richard Henderson [this message]
2019-01-07 14:09 ` [Qemu-devel] [PATCH v2 23/27] target/arm: Implement pauth_computepac Peter Maydell
2019-01-08 5:00 ` Richard Henderson
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 24/27] target/arm: Add PAuth system registers Richard Henderson
2019-01-07 14:17 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 25/27] target/arm: Enable PAuth for -cpu max Richard Henderson
2019-01-07 14:18 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 26/27] target/arm: Enable PAuth for user-only, part 2 Richard Henderson
2019-01-07 14:23 ` Peter Maydell
2018-12-14 5:24 ` [Qemu-devel] [PATCH v2 27/27] target/arm: Tidy TBI handling in gen_a64_set_pc Richard Henderson
2019-01-07 14:34 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181214052410.11863-24-richard.henderson@linaro.org \
--to=richard.henderson@linaro.org \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).