1 /*
2 * Multi-precision integer library
3 * ESP32 C3 hardware accelerated parts based on mbedTLS implementation
4 *
5 * SPDX-FileCopyrightText: The Mbed TLS Contributors
6 *
7 * SPDX-License-Identifier: Apache-2.0
8 *
9 * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
10 */
11 #include <string.h>
12 #include <sys/param.h>
13 #include "soc/hwcrypto_periph.h"
14 #include "esp_private/periph_ctrl.h"
15 #include "mbedtls/bignum.h"
16 #include "bignum_impl.h"
17 #include "soc/system_reg.h"
18 #include "soc/periph_defs.h"
19 #include "esp_crypto_lock.h"
20
21
esp_mpi_hardware_words(size_t words)22 size_t esp_mpi_hardware_words(size_t words)
23 {
24 return words;
25 }
26
esp_mpi_enable_hardware_hw_op(void)27 void esp_mpi_enable_hardware_hw_op( void )
28 {
29 esp_crypto_mpi_lock_acquire();
30
31 /* Enable RSA hardware */
32 periph_module_enable(PERIPH_RSA_MODULE);
33
34 REG_CLR_BIT(SYSTEM_RSA_PD_CTRL_REG, SYSTEM_RSA_MEM_PD);
35
36 while (REG_READ(RSA_QUERY_CLEAN_REG) != 1) {
37 }
38 // Note: from enabling RSA clock to here takes about 1.3us
39
40 REG_WRITE(RSA_INTERRUPT_REG, 0);
41 }
42
esp_mpi_disable_hardware_hw_op(void)43 void esp_mpi_disable_hardware_hw_op( void )
44 {
45 REG_SET_BIT(SYSTEM_RSA_PD_CTRL_REG, SYSTEM_RSA_MEM_PD);
46
47 /* Disable RSA hardware */
48 periph_module_disable(PERIPH_RSA_MODULE);
49
50 esp_crypto_mpi_lock_release();
51 }
52
esp_mpi_interrupt_enable(bool enable)53 void esp_mpi_interrupt_enable( bool enable )
54 {
55 REG_WRITE(RSA_INTERRUPT_REG, enable);
56 }
57
esp_mpi_interrupt_clear(void)58 void esp_mpi_interrupt_clear( void )
59 {
60 REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
61 }
62
63 /* Copy mbedTLS MPI bignum 'mpi' to hardware memory block at 'mem_base'.
64
65 If num_words is higher than the number of words in the bignum then
66 these additional words will be zeroed in the memory buffer.
67 */
mpi_to_mem_block(uint32_t mem_base,const mbedtls_mpi * mpi,size_t num_words)68 static inline void mpi_to_mem_block(uint32_t mem_base, const mbedtls_mpi *mpi, size_t num_words)
69 {
70 uint32_t *pbase = (uint32_t *)mem_base;
71 uint32_t copy_words = MIN(num_words, mpi->MBEDTLS_PRIVATE(n));
72
73 /* Copy MPI data to memory block registers */
74 for (int i = 0; i < copy_words; i++) {
75 pbase[i] = mpi->MBEDTLS_PRIVATE(p)[i];
76 }
77
78 /* Zero any remaining memory block data */
79 for (int i = copy_words; i < num_words; i++) {
80 pbase[i] = 0;
81 }
82 }
83
84 /* Read mbedTLS MPI bignum back from hardware memory block.
85
86 Reads num_words words from block.
87 */
mem_block_to_mpi(mbedtls_mpi * x,uint32_t mem_base,int num_words)88 static inline void mem_block_to_mpi(mbedtls_mpi *x, uint32_t mem_base, int num_words)
89 {
90
91 /* Copy data from memory block registers */
92 const size_t REG_WIDTH = sizeof(uint32_t);
93 for (size_t i = 0; i < num_words; i++) {
94 x->MBEDTLS_PRIVATE(p)[i] = REG_READ(mem_base + (i * REG_WIDTH));
95 }
96 /* Zero any remaining limbs in the bignum, if the buffer is bigger
97 than num_words */
98 for (size_t i = num_words; i < x->MBEDTLS_PRIVATE(n); i++) {
99 x->MBEDTLS_PRIVATE(p)[i] = 0;
100 }
101 }
102
103
104
105 /* Begin an RSA operation. op_reg specifies which 'START' register
106 to write to.
107 */
start_op(uint32_t op_reg)108 static inline void start_op(uint32_t op_reg)
109 {
110 /* Clear interrupt status */
111 REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
112
113 /* Note: above REG_WRITE includes a memw, so we know any writes
114 to the memory blocks are also complete. */
115
116 REG_WRITE(op_reg, 1);
117 }
118
119 /* Wait for an RSA operation to complete.
120 */
wait_op_complete(void)121 static inline void wait_op_complete(void)
122 {
123 while (REG_READ(RSA_QUERY_INTERRUPT_REG) != 1)
124 { }
125
126 /* clear the interrupt */
127 REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
128 }
129
130
131 /* Read result from last MPI operation */
esp_mpi_read_result_hw_op(mbedtls_mpi * Z,size_t z_words)132 void esp_mpi_read_result_hw_op(mbedtls_mpi *Z, size_t z_words)
133 {
134 wait_op_complete();
135 mem_block_to_mpi(Z, RSA_MEM_Z_BLOCK_BASE, z_words);
136 }
137
138
139 /* Z = (X * Y) mod M
140
141 Not an mbedTLS function
142 */
esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,const mbedtls_mpi * Rinv,mbedtls_mpi_uint Mprime,size_t num_words)143 void esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M, const mbedtls_mpi *Rinv, mbedtls_mpi_uint Mprime, size_t num_words)
144 {
145 REG_WRITE(RSA_LENGTH_REG, (num_words - 1));
146
147 /* Load M, X, Rinv, Mprime (Mprime is mod 2^32) */
148 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
149 mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
150 mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, num_words);
151 mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Rinv, num_words);
152 REG_WRITE(RSA_M_DASH_REG, Mprime);
153
154 start_op(RSA_MOD_MULT_START_REG);
155 }
156
157 /* Z = (X ^ Y) mod M
158 */
esp_mpi_exp_mpi_mod_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,const mbedtls_mpi * Rinv,mbedtls_mpi_uint Mprime,size_t num_words)159 void esp_mpi_exp_mpi_mod_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M, const mbedtls_mpi *Rinv, mbedtls_mpi_uint Mprime, size_t num_words)
160 {
161 size_t y_bits = mbedtls_mpi_bitlen(Y);
162
163 REG_WRITE(RSA_LENGTH_REG, (num_words - 1));
164
165 /* Load M, X, Rinv, Mprime (Mprime is mod 2^32) */
166 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
167 mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
168 mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, num_words);
169 mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Rinv, num_words);
170 REG_WRITE(RSA_M_DASH_REG, Mprime);
171
172 /* Enable acceleration options */
173 REG_WRITE(RSA_CONSTANT_TIME_REG, 0);
174 REG_WRITE(RSA_SEARCH_ENABLE_REG, 1);
175 REG_WRITE(RSA_SEARCH_POS_REG, y_bits - 1);
176
177 /* Execute first stage montgomery multiplication */
178 start_op(RSA_MODEXP_START_REG);
179
180 REG_WRITE(RSA_SEARCH_ENABLE_REG, 0);
181 }
182
183
184 /* Z = X * Y */
esp_mpi_mul_mpi_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t num_words)185 void esp_mpi_mul_mpi_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t num_words)
186 {
187 /* Copy X (right-extended) & Y (left-extended) to memory block */
188 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
189 mpi_to_mem_block(RSA_MEM_Z_BLOCK_BASE + num_words * 4, Y, num_words);
190 /* NB: as Y is left-extended, we don't zero the bottom words_mult words of Y block.
191 This is OK for now because zeroing is done by hardware when we do esp_mpi_acquire_hardware().
192 */
193 REG_WRITE(RSA_LENGTH_REG, (num_words * 2 - 1));
194 start_op(RSA_MULT_START_REG);
195 }
196
197
198
199 /**
200 * @brief Special-case of (X * Y), where we use hardware montgomery mod
201 multiplication to calculate result where either A or B are >2048 bits so
202 can't use the standard multiplication method.
203 *
204 */
esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t num_words)205 void esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t num_words)
206 {
207 /* M = 2^num_words - 1, so block is entirely FF */
208 for (int i = 0; i < num_words; i++) {
209 REG_WRITE(RSA_MEM_M_BLOCK_BASE + i * 4, UINT32_MAX);
210 }
211
212 /* Mprime = 1 */
213 REG_WRITE(RSA_M_DASH_REG, 1);
214 REG_WRITE(RSA_LENGTH_REG, num_words - 1);
215
216 /* Load X & Y */
217 mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
218 mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
219
220 /* Rinv = 1, write first word */
221 REG_WRITE(RSA_MEM_RB_BLOCK_BASE, 1);
222
223 /* Zero out rest of the Rinv words */
224 for (int i = 1; i < num_words; i++) {
225 REG_WRITE(RSA_MEM_RB_BLOCK_BASE + i * 4, 0);
226 }
227
228 start_op(RSA_MOD_MULT_START_REG);
229 }
230