1 /*
2 * Copyright (c) 2024, Altera Corporation. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7
8 #include <assert.h>
9 #include <errno.h>
10 #include <stdlib.h>
11
12 #include <arch_helpers.h>
13 #include <common/bl_common.h>
14 #include <common/debug.h>
15 #include <common/tbbr/tbbr_img_def.h>
16 #include <drivers/delay_timer.h>
17 #include <lib/mmio.h>
18 #include <lib/utils.h>
19 #include <plat/common/platform.h>
20 #include <tools_share/firmware_image_package.h>
21
22 #include "sha.h"
23 #include "wdt/watchdog.h"
24
25 /* SHA384 certificate ID */
26 #define SHA384_H0 0xcbbb9d5dc1059ed8ULL
27 #define SHA384_H1 0x629a292a367cd507ULL
28 #define SHA384_H2 0x9159015a3070dd17ULL
29 #define SHA384_H3 0x152fecd8f70e5939ULL
30 #define SHA384_H4 0x67332667ffc00b31ULL
31 #define SHA384_H5 0x8eb44a8768581511ULL
32 #define SHA384_H6 0xdb0c2e0d64f98fa7ULL
33 #define SHA384_H7 0x47b5481dbefa4fa4ULL
34
35 /* SHA512 certificate ID */
36 #define SHA512_H0 0x6a09e667f3bcc908ULL
37 #define SHA512_H1 0xbb67ae8584caa73bULL
38 #define SHA512_H2 0x3c6ef372fe94f82bULL
39 #define SHA512_H3 0xa54ff53a5f1d36f1ULL
40 #define SHA512_H4 0x510e527fade682d1ULL
41 #define SHA512_H5 0x9b05688c2b3e6c1fULL
42 #define SHA512_H6 0x1f83d9abfb41bd6bULL
43 #define SHA512_H7 0x5be0cd19137e2179ULL
44
sha384_init(sha512_context * ctx)45 void sha384_init(sha512_context *ctx)
46 {
47 ctx->state[0] = SHA384_H0;
48 ctx->state[1] = SHA384_H1;
49 ctx->state[2] = SHA384_H2;
50 ctx->state[3] = SHA384_H3;
51 ctx->state[4] = SHA384_H4;
52 ctx->state[5] = SHA384_H5;
53 ctx->state[6] = SHA384_H6;
54 ctx->state[7] = SHA384_H7;
55 ctx->count[0] = ctx->count[1] = 0;
56 }
57
sha384_update(sha512_context * ctx,const uint8_t * input,uint32_t length)58 void sha384_update(sha512_context *ctx, const uint8_t *input, uint32_t length)
59 {
60 sha512_base_do_update(ctx, input, length);
61 }
62
sha384_finish(sha512_context * ctx,uint8_t digest[SHA384_SUM_LEN])63 void sha384_finish(sha512_context *ctx, uint8_t digest[SHA384_SUM_LEN])
64 {
65 int i;
66
67 sha512_base_do_finalize(ctx);
68 for (i = 0; i < SHA384_SUM_LEN / sizeof(uint64_t); i++)
69 PUT_UINT64_BE(ctx->state[i], digest, i * 8);
70 }
71
sha384_start(const unsigned char * input,unsigned int len,unsigned char * output,unsigned int chunk_sz)72 void sha384_start(const unsigned char *input, unsigned int len,
73 unsigned char *output, unsigned int chunk_sz)
74 {
75 /* TODO: Shall trigger watchdog for each chuck byte. */
76 sha512_context ctx;
77 const unsigned char *end;
78 unsigned char *curr;
79 int chunk;
80
81 sha384_init(&ctx);
82
83 curr = (unsigned char *)input;
84 end = input + len;
85 while (curr < end) {
86 chunk = end - curr;
87 if (chunk > chunk_sz) {
88 chunk = chunk_sz;
89 }
90 sha384_update(&ctx, curr, chunk);
91 curr += chunk;
92 watchdog_sw_rst();
93 }
94
95 sha384_finish(&ctx, output);
96 }
97
98 /* SHA512 Start Here */
sha512_init(sha512_context * ctx)99 void sha512_init(sha512_context *ctx)
100 {
101 ctx->state[0] = SHA512_H0;
102 ctx->state[1] = SHA512_H1;
103 ctx->state[2] = SHA512_H2;
104 ctx->state[3] = SHA512_H3;
105 ctx->state[4] = SHA512_H4;
106 ctx->state[5] = SHA512_H5;
107 ctx->state[6] = SHA512_H6;
108 ctx->state[7] = SHA512_H7;
109 ctx->count[0] = ctx->count[1] = 0;
110 }
111
sha512_update(sha512_context * ctx,const uint8_t * input,uint32_t length)112 void sha512_update(sha512_context *ctx, const uint8_t *input, uint32_t length)
113 {
114 sha512_base_do_update(ctx, input, length);
115 }
116
sha512_finish(sha512_context * ctx,uint8_t digest[SHA512_SUM_LEN])117 void sha512_finish(sha512_context *ctx, uint8_t digest[SHA512_SUM_LEN])
118 {
119 int i;
120
121 sha512_base_do_finalize(ctx);
122 for (i = 0; i < SHA512_SUM_LEN / sizeof(uint64_t); i++)
123 PUT_UINT64_BE(ctx->state[i], digest, i * 8);
124 }
125
sha512_start(const unsigned char * input,unsigned int len,unsigned char * output)126 void sha512_start(const unsigned char *input, unsigned int len, unsigned char *output)
127 {
128 /* TODO: Shall trigger watchdog for each chuck byte. */
129 sha512_context ctx;
130
131 sha384_init(&ctx);
132 sha512_update(&ctx, input, len);
133 sha512_finish(&ctx, output);
134 }
135
sha512_transform(uint64_t * state,const uint8_t * input)136 void sha512_transform(uint64_t *state, const uint8_t *input)
137 {
138 uint64_t a, b, c, d, e, f, g, h, t1, t2;
139
140 int i;
141 uint64_t W[16];
142
143 /* load the state into our registers */
144 a = state[0]; b = state[1]; c = state[2]; d = state[3];
145 e = state[4]; f = state[5]; g = state[6]; h = state[7];
146
147 /* now iterate */
148 for (i = 0 ; i < 80; i += 8) {
149 if (!(i & 8)) {
150 int j;
151
152 if (i < 16) {
153 /* load the input */
154 for (j = 0; j < 16; j++)
155 LOAD_OP(i + j, W, input);
156 } else {
157 for (j = 0; j < 16; j++) {
158 BLEND_OP(i + j, W);
159 }
160 }
161 }
162
163 t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i & 15)];
164 t2 = e0(a) + Maj(a, b, c); d += t1; h = t1 + t2;
165 t1 = g + e1(d) + Ch(d, e, f) + sha512_K[i+1] + W[(i & 15) + 1];
166 t2 = e0(h) + Maj(h, a, b); c += t1; g = t1 + t2;
167 t1 = f + e1(c) + Ch(c, d, e) + sha512_K[i+2] + W[(i & 15) + 2];
168 t2 = e0(g) + Maj(g, h, a); b += t1; f = t1 + t2;
169 t1 = e + e1(b) + Ch(b, c, d) + sha512_K[i+3] + W[(i & 15) + 3];
170 t2 = e0(f) + Maj(f, g, h); a += t1; e = t1 + t2;
171 t1 = d + e1(a) + Ch(a, b, c) + sha512_K[i+4] + W[(i & 15) + 4];
172 t2 = e0(e) + Maj(e, f, g); h += t1; d = t1 + t2;
173 t1 = c + e1(h) + Ch(h, a, b) + sha512_K[i+5] + W[(i & 15) + 5];
174 t2 = e0(d) + Maj(d, e, f); g += t1; c = t1 + t2;
175 t1 = b + e1(g) + Ch(g, h, a) + sha512_K[i+6] + W[(i & 15) + 6];
176 t2 = e0(c) + Maj(c, d, e); f += t1; b = t1 + t2;
177 t1 = a + e1(f) + Ch(f, g, h) + sha512_K[i+7] + W[(i & 15) + 7];
178 t2 = e0(b) + Maj(b, c, d); e += t1; a = t1 + t2;
179 }
180
181 state[0] += a; state[1] += b; state[2] += c; state[3] += d;
182 state[4] += e; state[5] += f; state[6] += g; state[7] += h;
183
184 /* erase our data */
185 a = b = c = d = e = f = g = h = t1 = t2 = 0;
186 }
187
sha512_block_fn(sha512_context * sst,const uint8_t * src,int blocks)188 void sha512_block_fn(sha512_context *sst, const uint8_t *src,
189 int blocks)
190 {
191 while (blocks--) {
192 sha512_transform(sst->state, src);
193 src += SHA512_BLOCK_SIZE;
194 }
195 }
196
197
sha512_base_do_finalize(sha512_context * sctx)198 void sha512_base_do_finalize(sha512_context *sctx)
199 {
200 const int bit_offset = SHA512_BLOCK_SIZE - sizeof(uint64_t[2]);
201 uint64_t *bits = (uint64_t *)(sctx->buf + bit_offset);
202 unsigned int partial = sctx->count[0] % SHA512_BLOCK_SIZE;
203
204 sctx->buf[partial++] = 0x80;
205 if (partial > bit_offset) {
206 memset(sctx->buf + partial, 0x0, SHA512_BLOCK_SIZE - partial);
207 partial = 0;
208
209 sha512_block_fn(sctx, sctx->buf, 1);
210 }
211
212 memset(sctx->buf + partial, 0x0, bit_offset - partial);
213 bits[0] = cpu_to_be64(sctx->count[1] << 3 | sctx->count[0] >> 61);
214 bits[1] = cpu_to_be64(sctx->count[0] << 3);
215
216 sha512_block_fn(sctx, sctx->buf, 1);
217 }
218
sha512_base_do_update(sha512_context * sctx,const uint8_t * data,unsigned int len)219 void sha512_base_do_update(sha512_context *sctx,
220 const uint8_t *data,
221 unsigned int len)
222 {
223 unsigned int partial = sctx->count[0] % SHA512_BLOCK_SIZE;
224
225 sctx->count[0] += len;
226 if (sctx->count[0] < len)
227 sctx->count[1]++;
228
229 if (((partial + len) >= SHA512_BLOCK_SIZE)) {
230 int blocks;
231
232 if (partial) {
233 int p = SHA512_BLOCK_SIZE - partial;
234
235 memcpy(sctx->buf + partial, data, p);
236 data += p;
237 len -= p;
238
239 sha512_block_fn(sctx, sctx->buf, 1);
240 }
241
242 blocks = len / SHA512_BLOCK_SIZE;
243 len %= SHA512_BLOCK_SIZE;
244
245 if (blocks) {
246 sha512_block_fn(sctx, data, blocks);
247 data += blocks * SHA512_BLOCK_SIZE;
248 }
249 partial = 0;
250 }
251 if (len)
252 memcpy(sctx->buf + partial, data, len);
253 }
254