1 /* 2 * Copyright (c) 2024, Altera Corporation. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 8 #include <assert.h> 9 #include <errno.h> 10 #include <stdlib.h> 11 12 #include <arch_helpers.h> 13 #include <common/bl_common.h> 14 #include <common/debug.h> 15 #include <common/tbbr/tbbr_img_def.h> 16 #include <drivers/delay_timer.h> 17 #include <lib/mmio.h> 18 #include <lib/utils.h> 19 #include <plat/common/platform.h> 20 #include <tools_share/firmware_image_package.h> 21 22 #include "sha.h" 23 #include "wdt/watchdog.h" 24 25 /* SHA384 certificate ID */ 26 #define SHA384_H0 0xcbbb9d5dc1059ed8ULL 27 #define SHA384_H1 0x629a292a367cd507ULL 28 #define SHA384_H2 0x9159015a3070dd17ULL 29 #define SHA384_H3 0x152fecd8f70e5939ULL 30 #define SHA384_H4 0x67332667ffc00b31ULL 31 #define SHA384_H5 0x8eb44a8768581511ULL 32 #define SHA384_H6 0xdb0c2e0d64f98fa7ULL 33 #define SHA384_H7 0x47b5481dbefa4fa4ULL 34 35 /* SHA512 certificate ID */ 36 #define SHA512_H0 0x6a09e667f3bcc908ULL 37 #define SHA512_H1 0xbb67ae8584caa73bULL 38 #define SHA512_H2 0x3c6ef372fe94f82bULL 39 #define SHA512_H3 0xa54ff53a5f1d36f1ULL 40 #define SHA512_H4 0x510e527fade682d1ULL 41 #define SHA512_H5 0x9b05688c2b3e6c1fULL 42 #define SHA512_H6 0x1f83d9abfb41bd6bULL 43 #define SHA512_H7 0x5be0cd19137e2179ULL 44 45 void sha384_init(sha512_context *ctx) 46 { 47 ctx->state[0] = SHA384_H0; 48 ctx->state[1] = SHA384_H1; 49 ctx->state[2] = SHA384_H2; 50 ctx->state[3] = SHA384_H3; 51 ctx->state[4] = SHA384_H4; 52 ctx->state[5] = SHA384_H5; 53 ctx->state[6] = SHA384_H6; 54 ctx->state[7] = SHA384_H7; 55 ctx->count[0] = ctx->count[1] = 0; 56 } 57 58 void sha384_update(sha512_context *ctx, const uint8_t *input, uint32_t length) 59 { 60 sha512_base_do_update(ctx, input, length); 61 } 62 63 void sha384_finish(sha512_context *ctx, uint8_t digest[SHA384_SUM_LEN]) 64 { 65 int i; 66 67 sha512_base_do_finalize(ctx); 68 for (i = 0; i < SHA384_SUM_LEN / sizeof(uint64_t); i++) 69 PUT_UINT64_BE(ctx->state[i], digest, i * 8); 70 } 71 72 void sha384_start(const unsigned char *input, unsigned int len, 73 unsigned char *output, unsigned int chunk_sz) 74 { 75 /* TODO: Shall trigger watchdog for each chuck byte. */ 76 sha512_context ctx; 77 const unsigned char *end; 78 unsigned char *curr; 79 int chunk; 80 81 sha384_init(&ctx); 82 83 curr = (unsigned char *)input; 84 end = input + len; 85 while (curr < end) { 86 chunk = end - curr; 87 if (chunk > chunk_sz) { 88 chunk = chunk_sz; 89 } 90 sha384_update(&ctx, curr, chunk); 91 curr += chunk; 92 watchdog_sw_rst(); 93 } 94 95 sha384_finish(&ctx, output); 96 } 97 98 /* SHA512 Start Here */ 99 void sha512_init(sha512_context *ctx) 100 { 101 ctx->state[0] = SHA512_H0; 102 ctx->state[1] = SHA512_H1; 103 ctx->state[2] = SHA512_H2; 104 ctx->state[3] = SHA512_H3; 105 ctx->state[4] = SHA512_H4; 106 ctx->state[5] = SHA512_H5; 107 ctx->state[6] = SHA512_H6; 108 ctx->state[7] = SHA512_H7; 109 ctx->count[0] = ctx->count[1] = 0; 110 } 111 112 void sha512_update(sha512_context *ctx, const uint8_t *input, uint32_t length) 113 { 114 sha512_base_do_update(ctx, input, length); 115 } 116 117 void sha512_finish(sha512_context *ctx, uint8_t digest[SHA512_SUM_LEN]) 118 { 119 int i; 120 121 sha512_base_do_finalize(ctx); 122 for (i = 0; i < SHA512_SUM_LEN / sizeof(uint64_t); i++) 123 PUT_UINT64_BE(ctx->state[i], digest, i * 8); 124 } 125 126 void sha512_start(const unsigned char *input, unsigned int len, unsigned char *output) 127 { 128 /* TODO: Shall trigger watchdog for each chuck byte. */ 129 sha512_context ctx; 130 131 sha384_init(&ctx); 132 sha512_update(&ctx, input, len); 133 sha512_finish(&ctx, output); 134 } 135 136 void sha512_transform(uint64_t *state, const uint8_t *input) 137 { 138 uint64_t a, b, c, d, e, f, g, h, t1, t2; 139 140 int i; 141 uint64_t W[16]; 142 143 /* load the state into our registers */ 144 a = state[0]; b = state[1]; c = state[2]; d = state[3]; 145 e = state[4]; f = state[5]; g = state[6]; h = state[7]; 146 147 /* now iterate */ 148 for (i = 0 ; i < 80; i += 8) { 149 if (!(i & 8)) { 150 int j; 151 152 if (i < 16) { 153 /* load the input */ 154 for (j = 0; j < 16; j++) 155 LOAD_OP(i + j, W, input); 156 } else { 157 for (j = 0; j < 16; j++) { 158 BLEND_OP(i + j, W); 159 } 160 } 161 } 162 163 t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i & 15)]; 164 t2 = e0(a) + Maj(a, b, c); d += t1; h = t1 + t2; 165 t1 = g + e1(d) + Ch(d, e, f) + sha512_K[i+1] + W[(i & 15) + 1]; 166 t2 = e0(h) + Maj(h, a, b); c += t1; g = t1 + t2; 167 t1 = f + e1(c) + Ch(c, d, e) + sha512_K[i+2] + W[(i & 15) + 2]; 168 t2 = e0(g) + Maj(g, h, a); b += t1; f = t1 + t2; 169 t1 = e + e1(b) + Ch(b, c, d) + sha512_K[i+3] + W[(i & 15) + 3]; 170 t2 = e0(f) + Maj(f, g, h); a += t1; e = t1 + t2; 171 t1 = d + e1(a) + Ch(a, b, c) + sha512_K[i+4] + W[(i & 15) + 4]; 172 t2 = e0(e) + Maj(e, f, g); h += t1; d = t1 + t2; 173 t1 = c + e1(h) + Ch(h, a, b) + sha512_K[i+5] + W[(i & 15) + 5]; 174 t2 = e0(d) + Maj(d, e, f); g += t1; c = t1 + t2; 175 t1 = b + e1(g) + Ch(g, h, a) + sha512_K[i+6] + W[(i & 15) + 6]; 176 t2 = e0(c) + Maj(c, d, e); f += t1; b = t1 + t2; 177 t1 = a + e1(f) + Ch(f, g, h) + sha512_K[i+7] + W[(i & 15) + 7]; 178 t2 = e0(b) + Maj(b, c, d); e += t1; a = t1 + t2; 179 } 180 181 state[0] += a; state[1] += b; state[2] += c; state[3] += d; 182 state[4] += e; state[5] += f; state[6] += g; state[7] += h; 183 184 /* erase our data */ 185 a = b = c = d = e = f = g = h = t1 = t2 = 0; 186 } 187 188 void sha512_block_fn(sha512_context *sst, const uint8_t *src, 189 int blocks) 190 { 191 while (blocks--) { 192 sha512_transform(sst->state, src); 193 src += SHA512_BLOCK_SIZE; 194 } 195 } 196 197 198 void sha512_base_do_finalize(sha512_context *sctx) 199 { 200 const int bit_offset = SHA512_BLOCK_SIZE - sizeof(uint64_t[2]); 201 uint64_t *bits = (uint64_t *)(sctx->buf + bit_offset); 202 unsigned int partial = sctx->count[0] % SHA512_BLOCK_SIZE; 203 204 sctx->buf[partial++] = 0x80; 205 if (partial > bit_offset) { 206 memset(sctx->buf + partial, 0x0, SHA512_BLOCK_SIZE - partial); 207 partial = 0; 208 209 sha512_block_fn(sctx, sctx->buf, 1); 210 } 211 212 memset(sctx->buf + partial, 0x0, bit_offset - partial); 213 bits[0] = cpu_to_be64(sctx->count[1] << 3 | sctx->count[0] >> 61); 214 bits[1] = cpu_to_be64(sctx->count[0] << 3); 215 216 sha512_block_fn(sctx, sctx->buf, 1); 217 } 218 219 void sha512_base_do_update(sha512_context *sctx, 220 const uint8_t *data, 221 unsigned int len) 222 { 223 unsigned int partial = sctx->count[0] % SHA512_BLOCK_SIZE; 224 225 sctx->count[0] += len; 226 if (sctx->count[0] < len) 227 sctx->count[1]++; 228 229 if (((partial + len) >= SHA512_BLOCK_SIZE)) { 230 int blocks; 231 232 if (partial) { 233 int p = SHA512_BLOCK_SIZE - partial; 234 235 memcpy(sctx->buf + partial, data, p); 236 data += p; 237 len -= p; 238 239 sha512_block_fn(sctx, sctx->buf, 1); 240 } 241 242 blocks = len / SHA512_BLOCK_SIZE; 243 len %= SHA512_BLOCK_SIZE; 244 245 if (blocks) { 246 sha512_block_fn(sctx, data, blocks); 247 data += blocks * SHA512_BLOCK_SIZE; 248 } 249 partial = 0; 250 } 251 if (len) 252 memcpy(sctx->buf + partial, data, len); 253 } 254