1 /**
2 * \brief Multi-precision integer library, ESP-IDF hardware accelerated parts
3 *
4 * based on mbedTLS implementation
5 *
6 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
7 * Additions Copyright (C) 2016-2020, Espressif Systems (Shanghai) PTE Ltd
8 * SPDX-License-Identifier: Apache-2.0
9 *
10 * Licensed under the Apache License, Version 2.0 (the "License"); you may
11 * not use this file except in compliance with the License.
12 * You may obtain a copy of the License at
13 *
14 * http://www.apache.org/licenses/LICENSE-2.0
15 *
16 * Unless required by applicable law or agreed to in writing, software
17 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
18 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19 * See the License for the specific language governing permissions and
20 * limitations under the License.
21 *
22 */
23
24 #include "soc/hwcrypto_periph.h"
25 #include "soc/dport_reg.h"
26 #include "driver/periph_ctrl.h"
27 #include <mbedtls/bignum.h>
28 #include "bignum_impl.h"
29 #include <sys/param.h>
30 #include <sys/lock.h>
31
32 static _lock_t mpi_lock;
33
34 /* Round up number of words to nearest
35 512 bit (16 word) block count.
36 */
esp_mpi_hardware_words(size_t words)37 size_t esp_mpi_hardware_words(size_t words)
38 {
39 return (words + 0xF) & ~0xF;
40 }
41
esp_mpi_enable_hardware_hw_op(void)42 void esp_mpi_enable_hardware_hw_op( void )
43 {
44 /* newlib locks lazy initialize on ESP-IDF */
45 _lock_acquire(&mpi_lock);
46
47 /* Enable RSA hardware */
48 periph_module_enable(PERIPH_RSA_MODULE);
49 DPORT_REG_CLR_BIT(DPORT_RSA_PD_CTRL_REG, DPORT_RSA_PD);
50
51 while (DPORT_REG_READ(RSA_CLEAN_REG) != 1)
52 { }
53 // Note: from enabling RSA clock to here takes about 1.3us
54 }
55
esp_mpi_disable_hardware_hw_op(void)56 void esp_mpi_disable_hardware_hw_op( void )
57 {
58 DPORT_REG_SET_BIT(DPORT_RSA_PD_CTRL_REG, DPORT_RSA_PD);
59
60 /* Disable RSA hardware */
61 periph_module_disable(PERIPH_RSA_MODULE);
62
63 _lock_release(&mpi_lock);
64 }
65
66
67 /* Copy mbedTLS MPI bignum 'mpi' to hardware memory block at 'mem_base'.
68
69 If hw_words is higher than the number of words in the bignum then
70 these additional words will be zeroed in the memory buffer.
71
72 */
mpi_to_mem_block(uint32_t mem_base,const mbedtls_mpi * mpi,size_t hw_words)73 static inline void mpi_to_mem_block(uint32_t mem_base, const mbedtls_mpi *mpi, size_t hw_words)
74 {
75 uint32_t *pbase = (uint32_t *)mem_base;
76 uint32_t copy_words = MIN(hw_words, mpi->n);
77
78 /* Copy MPI data to memory block registers */
79 for (uint32_t i = 0; i < copy_words; i++) {
80 pbase[i] = mpi->p[i];
81 }
82
83 /* Zero any remaining memory block data */
84 for (uint32_t i = copy_words; i < hw_words; i++) {
85 pbase[i] = 0;
86 }
87 }
88
89 /* Read mbedTLS MPI bignum back from hardware memory block.
90
91 Reads num_words words from block.
92
93 Bignum 'x' should already be grown to at least num_words by caller (can be done while
94 calculation is in progress, to save some cycles)
95 */
mem_block_to_mpi(mbedtls_mpi * x,uint32_t mem_base,size_t num_words)96 static inline void mem_block_to_mpi(mbedtls_mpi *x, uint32_t mem_base, size_t num_words)
97 {
98 assert(x->n >= num_words);
99
100 /* Copy data from memory block registers */
101 esp_dport_access_read_buffer(x->p, mem_base, num_words);
102
103 /* Zero any remaining limbs in the bignum, if the buffer is bigger
104 than num_words */
105 for (size_t i = num_words; i < x->n; i++) {
106 x->p[i] = 0;
107 }
108 }
109
110
111 /* Begin an RSA operation. op_reg specifies which 'START' register
112 to write to.
113 */
start_op(uint32_t op_reg)114 static inline void start_op(uint32_t op_reg)
115 {
116 /* Clear interrupt status */
117 DPORT_REG_WRITE(RSA_INTERRUPT_REG, 1);
118
119 /* Note: above REG_WRITE includes a memw, so we know any writes
120 to the memory blocks are also complete. */
121
122 DPORT_REG_WRITE(op_reg, 1);
123 }
124
125 /* Wait for an RSA operation to complete.
126 */
wait_op_complete(void)127 static inline void wait_op_complete(void)
128 {
129 while (DPORT_REG_READ(RSA_INTERRUPT_REG) != 1)
130 { }
131
132 /* clear the interrupt */
133 DPORT_REG_WRITE(RSA_INTERRUPT_REG, 1);
134 }
135
136 /* Read result from last MPI operation */
esp_mpi_read_result_hw_op(mbedtls_mpi * Z,size_t z_words)137 void esp_mpi_read_result_hw_op(mbedtls_mpi *Z, size_t z_words)
138 {
139 wait_op_complete();
140 mem_block_to_mpi(Z, RSA_MEM_Z_BLOCK_BASE, z_words);
141 }
142
143 /* Z = (X * Y) mod M */
esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,const mbedtls_mpi * Rinv,mbedtls_mpi_uint Mprime,size_t hw_words)144 void esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M, const mbedtls_mpi *Rinv, mbedtls_mpi_uint Mprime, size_t hw_words)
145 {
146 /* Load M, X, Rinv, Mprime (Mprime is mod 2^32) */
147 mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, hw_words);
148 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, hw_words);
149 mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Rinv, hw_words);
150 DPORT_REG_WRITE(RSA_M_DASH_REG, (uint32_t)Mprime);
151
152 /* "mode" register loaded with number of 512-bit blocks, minus 1 */
153 DPORT_REG_WRITE(RSA_MULT_MODE_REG, (hw_words / 16) - 1);
154
155 /* Execute first stage montgomery multiplication */
156 start_op(RSA_MULT_START_REG);
157
158 wait_op_complete();
159
160 /* execute second stage */
161 /* Load Y to X input memory block, rerun */
162 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, Y, hw_words);
163
164 start_op(RSA_MULT_START_REG);
165 }
166
167 /* Z = X * Y */
esp_mpi_mul_mpi_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t hw_words)168 void esp_mpi_mul_mpi_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t hw_words)
169 {
170 /* Copy X (right-extended) & Y (left-extended) to memory block */
171 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, hw_words);
172 mpi_to_mem_block(RSA_MEM_Z_BLOCK_BASE + hw_words * 4, Y, hw_words);
173 /* NB: as Y is left-extended, we don't zero the bottom words_mult words of Y block.
174 This is OK for now because zeroing is done by hardware when we do esp_mpi_acquire_hardware().
175 */
176
177 DPORT_REG_WRITE(RSA_M_DASH_REG, 0);
178
179 /* "mode" register loaded with number of 512-bit blocks in result,
180 plus 7 (for range 9-12). (this is ((N~ / 32) - 1) + 8))
181 */
182 DPORT_REG_WRITE(RSA_MULT_MODE_REG, ((hw_words * 2) / 16) + 7);
183
184 start_op(RSA_MULT_START_REG);
185
186 }
187
188
esp_mont_hw_op(mbedtls_mpi * Z,const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,mbedtls_mpi_uint Mprime,size_t hw_words,bool again)189 int esp_mont_hw_op(mbedtls_mpi *Z, const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M,
190 mbedtls_mpi_uint Mprime,
191 size_t hw_words,
192 bool again)
193 {
194 // Note Z may be the same pointer as X or Y
195 int ret = 0;
196
197 // montgomery mult prepare
198 if (again == false) {
199 mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, hw_words);
200 DPORT_REG_WRITE(RSA_M_DASH_REG, Mprime);
201 DPORT_REG_WRITE(RSA_MULT_MODE_REG, hw_words / 16 - 1);
202 }
203
204 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, hw_words);
205 mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Y, hw_words);
206
207 start_op(RSA_MULT_START_REG);
208 Z->s = 1; // The sign of Z will be = M->s (but M->s is always 1)
209 MBEDTLS_MPI_CHK( mbedtls_mpi_grow(Z, hw_words) );
210
211 wait_op_complete();
212
213 /* Read back the result */
214 mem_block_to_mpi(Z, RSA_MEM_Z_BLOCK_BASE, hw_words);
215
216
217 /* from HAC 14.36 - 3. If Z >= M then Z = Z - M */
218 if (mbedtls_mpi_cmp_mpi(Z, M) >= 0) {
219 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(Z, Z, M));
220 }
221 cleanup:
222 return ret;
223 }
224
225
226
227 /* Special-case of mbedtls_mpi_mult_mpi(), where we use hardware montgomery mod
228 multiplication to calculate an mbedtls_mpi_mult_mpi result where either
229 A or B are >2048 bits so can't use the standard multiplication method.
230
231 Result (z_words, based on A bits + B bits) must still be less than 4096 bits.
232
233 This case is simpler than the general case modulo multiply of
234 esp_mpi_mul_mpi_mod() because we can control the other arguments:
235
236 * Modulus is chosen with M=(2^num_bits - 1) (ie M=R-1), so output
237 isn't actually modulo anything.
238 * Mprime and Rinv are therefore predictable as follows:
239 Mprime = 1
240 Rinv = 1
241
242 (See RSA Accelerator section in Technical Reference for more about Mprime, Rinv)
243 */
esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t num_words)244 void esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t num_words)
245 {
246 size_t hw_words = num_words;
247
248 /* M = 2^num_words - 1, so block is entirely FF */
249 for (size_t i = 0; i < hw_words; i++) {
250 DPORT_REG_WRITE(RSA_MEM_M_BLOCK_BASE + i * 4, UINT32_MAX);
251 }
252 /* Mprime = 1 */
253 DPORT_REG_WRITE(RSA_M_DASH_REG, 1);
254
255 /* "mode" register loaded with number of 512-bit blocks, minus 1 */
256 DPORT_REG_WRITE(RSA_MULT_MODE_REG, (hw_words / 16) - 1);
257
258 /* Load X */
259 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, hw_words);
260
261 /* Rinv = 1, write first word */
262 DPORT_REG_WRITE(RSA_MEM_RB_BLOCK_BASE, 1);
263
264 /* Zero out rest of the Rinv words */
265 for (size_t i = 1; i < hw_words; i++) {
266 DPORT_REG_WRITE(RSA_MEM_RB_BLOCK_BASE + i * 4, 0);
267 }
268
269 start_op(RSA_MULT_START_REG);
270
271 wait_op_complete();
272
273 /* finish the modular multiplication */
274 /* Load Y to X input memory block, rerun */
275 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, Y, hw_words);
276
277 start_op(RSA_MULT_START_REG);
278
279 }
280
