1 /*
2  * Multi-precision integer library
3  * ESP32 S3 hardware accelerated parts based on mbedTLS implementation
4  *
5  * SPDX-FileCopyrightText: The Mbed TLS Contributors
6  *
7  * SPDX-License-Identifier: Apache-2.0
8  *
9  * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
10  */
11 #include "soc/hwcrypto_periph.h"
12 #include "esp_private/periph_ctrl.h"
13 #include <mbedtls/bignum.h>
14 #include "bignum_impl.h"
15 #include "soc/dport_reg.h"
16 #include "soc/system_reg.h"
17 #include "soc/periph_defs.h"
18 #include <sys/param.h>
19 #include "esp_crypto_lock.h"
20 
esp_mpi_hardware_words(size_t words)21 size_t esp_mpi_hardware_words(size_t words)
22 {
23     return words;
24 }
25 
esp_mpi_enable_hardware_hw_op(void)26 void esp_mpi_enable_hardware_hw_op( void )
27 {
28     esp_crypto_mpi_lock_acquire();
29 
30     /* Enable RSA hardware */
31     periph_module_enable(PERIPH_RSA_MODULE);
32 
33     REG_CLR_BIT(SYSTEM_RSA_PD_CTRL_REG, SYSTEM_RSA_MEM_PD);
34 
35     while (DPORT_REG_READ(RSA_QUERY_CLEAN_REG) != 1) {
36     }
37     // Note: from enabling RSA clock to here takes about 1.3us
38 
39     REG_WRITE(RSA_INTERRUPT_REG, 0);
40 
41 }
42 
esp_mpi_disable_hardware_hw_op(void)43 void esp_mpi_disable_hardware_hw_op( void )
44 {
45     REG_SET_BIT(SYSTEM_RSA_PD_CTRL_REG, SYSTEM_RSA_MEM_PD);
46 
47     /* Disable RSA hardware */
48     periph_module_disable(PERIPH_RSA_MODULE);
49 
50     esp_crypto_mpi_lock_release();
51 }
52 
esp_mpi_interrupt_enable(bool enable)53 void esp_mpi_interrupt_enable( bool enable )
54 {
55     REG_WRITE(RSA_INTERRUPT_REG, enable);
56 }
57 
esp_mpi_interrupt_clear(void)58 void esp_mpi_interrupt_clear( void )
59 {
60     REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
61 }
62 
63 /* Copy mbedTLS MPI bignum 'mpi' to hardware memory block at 'mem_base'.
64 
65    If num_words is higher than the number of words in the bignum then
66    these additional words will be zeroed in the memory buffer.
67 */
mpi_to_mem_block(uint32_t mem_base,const mbedtls_mpi * mpi,size_t num_words)68 static inline void mpi_to_mem_block(uint32_t mem_base, const mbedtls_mpi *mpi, size_t num_words)
69 {
70     uint32_t *pbase = (uint32_t *)mem_base;
71     uint32_t copy_words = MIN(num_words, mpi->MBEDTLS_PRIVATE(n));
72 
73     /* Copy MPI data to memory block registers */
74     for (uint32_t i = 0; i < copy_words; i++) {
75         pbase[i] = mpi->MBEDTLS_PRIVATE(p)[i];
76     }
77 
78     /* Zero any remaining memory block data */
79     for (uint32_t i = copy_words; i < num_words; i++) {
80         pbase[i] = 0;
81     }
82 }
83 
84 /* Read mbedTLS MPI bignum back from hardware memory block.
85 
86    Reads num_words words from block.
87 */
mem_block_to_mpi(mbedtls_mpi * x,uint32_t mem_base,int num_words)88 static inline void mem_block_to_mpi(mbedtls_mpi *x, uint32_t mem_base, int num_words)
89 {
90 
91     /* Copy data from memory block registers */
92     esp_dport_access_read_buffer(x->MBEDTLS_PRIVATE(p), mem_base, num_words);
93     /* Zero any remaining limbs in the bignum, if the buffer is bigger
94        than num_words */
95     for (size_t i = num_words; i < x->MBEDTLS_PRIVATE(n); i++) {
96         x->MBEDTLS_PRIVATE(p)[i] = 0;
97     }
98 }
99 
100 
101 
102 /* Begin an RSA operation. op_reg specifies which 'START' register
103    to write to.
104 */
start_op(uint32_t op_reg)105 static inline void start_op(uint32_t op_reg)
106 {
107     /* Clear interrupt status */
108     DPORT_REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
109 
110     /* Note: above REG_WRITE includes a memw, so we know any writes
111        to the memory blocks are also complete. */
112 
113     DPORT_REG_WRITE(op_reg, 1);
114 }
115 
116 /* Wait for an RSA operation to complete.
117 */
wait_op_complete(void)118 static inline void wait_op_complete(void)
119 {
120     while (DPORT_REG_READ(RSA_QUERY_INTERRUPT_REG) != 1)
121     { }
122 
123     /* clear the interrupt */
124     DPORT_REG_WRITE(RSA_CLEAR_INTERRUPT_REG, 1);
125 }
126 
127 
128 /* Read result from last MPI operation */
esp_mpi_read_result_hw_op(mbedtls_mpi * Z,size_t z_words)129 void esp_mpi_read_result_hw_op(mbedtls_mpi *Z, size_t z_words)
130 {
131     wait_op_complete();
132     mem_block_to_mpi(Z, RSA_MEM_Z_BLOCK_BASE, z_words);
133 }
134 
135 
136 /* Z = (X * Y) mod M
137 
138    Not an mbedTLS function
139 */
esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,const mbedtls_mpi * Rinv,mbedtls_mpi_uint Mprime,size_t num_words)140 void esp_mpi_mul_mpi_mod_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M, const mbedtls_mpi *Rinv, mbedtls_mpi_uint Mprime, size_t num_words)
141 {
142     DPORT_REG_WRITE(RSA_LENGTH_REG, (num_words - 1));
143 
144     /* Load M, X, Rinv, Mprime (Mprime is mod 2^32) */
145     mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
146     mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
147     mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, num_words);
148     mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Rinv, num_words);
149     DPORT_REG_WRITE(RSA_M_DASH_REG, Mprime);
150 
151     start_op(RSA_MOD_MULT_START_REG);
152 }
153 
154 /* Z = (X ^ Y) mod M
155 */
esp_mpi_exp_mpi_mod_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,const mbedtls_mpi * M,const mbedtls_mpi * Rinv,mbedtls_mpi_uint Mprime,size_t num_words)156 void esp_mpi_exp_mpi_mod_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, const mbedtls_mpi *M, const mbedtls_mpi *Rinv, mbedtls_mpi_uint Mprime, size_t num_words)
157 {
158     size_t y_bits = mbedtls_mpi_bitlen(Y);
159 
160     DPORT_REG_WRITE(RSA_LENGTH_REG, (num_words - 1));
161 
162     /* Load M, X, Rinv, Mprime (Mprime is mod 2^32) */
163     mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
164     mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
165     mpi_to_mem_block(RSA_MEM_M_BLOCK_BASE, M, num_words);
166     mpi_to_mem_block(RSA_MEM_RB_BLOCK_BASE, Rinv, num_words);
167     DPORT_REG_WRITE(RSA_M_DASH_REG, Mprime);
168 
169     /* Enable acceleration options */
170     DPORT_REG_WRITE(RSA_CONSTANT_TIME_REG, 0);
171     DPORT_REG_WRITE(RSA_SEARCH_OPEN_REG, 1);
172     DPORT_REG_WRITE(RSA_SEARCH_POS_REG, y_bits - 1);
173 
174     /* Execute first stage montgomery multiplication */
175     start_op(RSA_MODEXP_START_REG);
176 
177     DPORT_REG_WRITE(RSA_SEARCH_OPEN_REG, 0);
178 }
179 
180 
181 /* Z = X * Y */
esp_mpi_mul_mpi_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t num_words)182 void esp_mpi_mul_mpi_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t num_words)
183 {
184     /* Copy X (right-extended) & Y (left-extended) to memory block */
185     mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
186     mpi_to_mem_block(RSA_MEM_Z_BLOCK_BASE + num_words * 4, Y, num_words);
187     /* NB: as Y is left-extended, we don't zero the bottom words_mult words of Y block.
188        This is OK for now because zeroing is done by hardware when we do esp_mpi_acquire_hardware().
189     */
190     DPORT_REG_WRITE(RSA_LENGTH_REG, (num_words * 2 - 1));
191     start_op(RSA_MULT_START_REG);
192 }
193 
194 
195 
196 /**
197  * @brief Special-case of (X * Y), where we use hardware montgomery mod
198    multiplication to calculate result where either A or B are >2048 bits so
199    can't use the standard multiplication method.
200  *
201  */
esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi * X,const mbedtls_mpi * Y,size_t num_words)202 void esp_mpi_mult_mpi_failover_mod_mult_hw_op(const mbedtls_mpi *X, const mbedtls_mpi *Y, size_t num_words)
203 {
204     /* M = 2^num_words - 1, so block is entirely FF */
205     for (size_t i = 0; i < num_words; i++) {
206         DPORT_REG_WRITE(RSA_MEM_M_BLOCK_BASE + i * 4, UINT32_MAX);
207     }
208 
209     /* Mprime = 1 */
210     DPORT_REG_WRITE(RSA_M_DASH_REG, 1);
211     DPORT_REG_WRITE(RSA_LENGTH_REG, num_words - 1);
212 
213     /* Load X & Y */
214     mpi_to_mem_block(RSA_MEM_X_BLOCK_BASE, X, num_words);
215     mpi_to_mem_block(RSA_MEM_Y_BLOCK_BASE, Y, num_words);
216 
217     /* Rinv = 1, write first word */
218     DPORT_REG_WRITE(RSA_MEM_RB_BLOCK_BASE, 1);
219 
220     /* Zero out rest of the Rinv words */
221     for (size_t i = 1; i < num_words; i++) {
222         DPORT_REG_WRITE(RSA_MEM_RB_BLOCK_BASE + i * 4, 0);
223     }
224 
225     start_op(RSA_MOD_MULT_START_REG);
226 }
227