| /****************************************************************************** |
| * Filename: sha2.c |
| * Revised: 2018-04-17 15:57:27 +0200 (Tue, 17 Apr 2018) |
| * Revision: 51892 |
| * |
| * Description: Driver for the SHA-2 functions of the crypto module |
| * |
| * Copyright (c) 2015 - 2017, Texas Instruments Incorporated |
| * All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions are met: |
| * |
| * 1) Redistributions of source code must retain the above copyright notice, |
| * this list of conditions and the following disclaimer. |
| * |
| * 2) Redistributions in binary form must reproduce the above copyright notice, |
| * this list of conditions and the following disclaimer in the documentation |
| * and/or other materials provided with the distribution. |
| * |
| * 3) Neither the name of the ORGANIZATION nor the names of its contributors may |
| * be used to endorse or promote products derived from this software without |
| * specific prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
| * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE |
| * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
| * POSSIBILITY OF SUCH DAMAGE. |
| * |
| ******************************************************************************/ |
| |
| #include "sha2.h" |
| |
| //***************************************************************************** |
| // |
| // Handle support for DriverLib in ROM: |
| // This section will undo prototype renaming made in the header file |
| // |
| //***************************************************************************** |
| #if !defined(DOXYGEN) |
| #undef SHA2StartDMAOperation |
| #define SHA2StartDMAOperation NOROM_SHA2StartDMAOperation |
| #undef SHA2WaitForIRQFlags |
| #define SHA2WaitForIRQFlags NOROM_SHA2WaitForIRQFlags |
| #undef SHA2ComputeInitialHash |
| #define SHA2ComputeInitialHash NOROM_SHA2ComputeInitialHash |
| #undef SHA2ComputeIntermediateHash |
| #define SHA2ComputeIntermediateHash NOROM_SHA2ComputeIntermediateHash |
| #undef SHA2ComputeFinalHash |
| #define SHA2ComputeFinalHash NOROM_SHA2ComputeFinalHash |
| #undef SHA2ComputeHash |
| #define SHA2ComputeHash NOROM_SHA2ComputeHash |
| #endif |
| |
| |
| static uint32_t SHA2ExecuteHash(const uint8_t *message, uint8_t *resultDigest, uint32_t *intermediateDigest, uint32_t totalMsgLength, uint32_t messageLength, uint32_t hashAlgorithm, bool initialHash, bool finalHash); |
| |
| |
| //***************************************************************************** |
| // |
| // Start a SHA-2 DMA operation. |
| // |
| //***************************************************************************** |
| void SHA2StartDMAOperation(uint8_t *channel0Addr, uint32_t channel0Length, uint8_t *channel1Addr, uint32_t channel1Length) |
| { |
| |
| // Clear any outstanding events. |
| HWREG(CRYPTO_BASE + CRYPTO_O_IRQCLR) = CRYPTO_IRQCLR_RESULT_AVAIL_M | CRYPTO_IRQEN_DMA_IN_DONE_M; |
| |
| while(HWREG(CRYPTO_BASE + CRYPTO_O_IRQSTAT) & (CRYPTO_IRQSTAT_DMA_IN_DONE_M | CRYPTO_IRQSTAT_RESULT_AVAIL_M)); |
| |
| if (channel0Addr) { |
| // Configure the DMA controller - enable both DMA channels. |
| HWREGBITW(CRYPTO_BASE + CRYPTO_O_DMACH0CTL, CRYPTO_DMACH0CTL_EN_BITN) = 1; |
| |
| // Base address of the payload data in ext. memory. |
| HWREG(CRYPTO_BASE + CRYPTO_O_DMACH0EXTADDR) = (uint32_t)channel0Addr; |
| |
| // Payload data length in bytes, equal to the cipher text length. |
| HWREG(CRYPTO_BASE + CRYPTO_O_DMACH0LEN) = channel0Length; |
| } |
| |
| if (channel1Addr) { |
| // Enable DMA channel 1. |
| HWREGBITW(CRYPTO_BASE + CRYPTO_O_DMACH1CTL, CRYPTO_DMACH1CTL_EN_BITN) = 1; |
| |
| // Base address of the output data buffer. |
| HWREG(CRYPTO_BASE + CRYPTO_O_DMACH1EXTADDR) = (uint32_t)channel1Addr; |
| |
| // Output data length in bytes, equal to the cipher text length. |
| HWREG(CRYPTO_BASE + CRYPTO_O_DMACH1LEN) = channel1Length; |
| } |
| } |
| |
| //***************************************************************************** |
| // |
| // Poll the IRQ status register and return. |
| // |
| //***************************************************************************** |
| uint32_t SHA2WaitForIRQFlags(uint32_t irqFlags) |
| { |
| uint32_t irqTrigger = 0; |
| // Wait for the DMA operation to complete. Add a delay to make sure we are |
| // not flooding the bus with requests too much. |
| do { |
| CPUdelay(1); |
| } |
| while(!(HWREG(CRYPTO_BASE + CRYPTO_O_IRQSTAT) & irqFlags & (CRYPTO_IRQSTAT_DMA_IN_DONE_M | CRYPTO_IRQSTAT_RESULT_AVAIL_M))); |
| |
| // Save the IRQ trigger source |
| irqTrigger = HWREG(CRYPTO_BASE + CRYPTO_O_IRQSTAT); |
| |
| // Clear IRQ flags |
| HWREG(CRYPTO_BASE + CRYPTO_O_IRQCLR) = irqFlags; |
| |
| while(HWREG(CRYPTO_BASE + CRYPTO_O_IRQSTAT) & irqFlags & (CRYPTO_IRQSTAT_DMA_IN_DONE_M | CRYPTO_IRQSTAT_RESULT_AVAIL_M)); |
| |
| return irqTrigger; |
| } |
| |
| //***************************************************************************** |
| // |
| // Start a new SHA-2 hash operation. |
| // |
| //***************************************************************************** |
| uint32_t SHA2ComputeInitialHash(const uint8_t *message, uint32_t *intermediateDigest, uint32_t hashAlgorithm, uint32_t initialMessageLength) |
| { |
| ASSERT(message); |
| ASSERT((hashAlgorithm == SHA2_MODE_SELECT_SHA224) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA256) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA384) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA512)); |
| ASSERT(!(intermediateDigest == NULL) && !((uint32_t)intermediateDigest & 0x03)); |
| |
| return SHA2ExecuteHash(message, (uint8_t *)intermediateDigest, intermediateDigest, initialMessageLength, initialMessageLength, hashAlgorithm, true, false); |
| } |
| |
| //***************************************************************************** |
| // |
| // Start an intermediate SHA-2 hash operation. |
| // |
| //***************************************************************************** |
| uint32_t SHA2ComputeIntermediateHash(const uint8_t *message, uint32_t *intermediateDigest, uint32_t hashAlgorithm, uint32_t intermediateMessageLength) |
| { |
| ASSERT(message); |
| ASSERT(!(intermediateDigest == NULL) && !((uint32_t)intermediateDigest & 0x03)); |
| ASSERT((hashAlgorithm == SHA2_MODE_SELECT_SHA224) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA256) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA384) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA512)); |
| |
| return SHA2ExecuteHash(message, (uint8_t *)intermediateDigest, intermediateDigest, 0, intermediateMessageLength, hashAlgorithm, false, false); |
| } |
| |
| //***************************************************************************** |
| // |
| // Start an intermediate SHA-2 hash operation and finalize it. |
| // |
| //***************************************************************************** |
| uint32_t SHA2ComputeFinalHash(const uint8_t *message, uint8_t *resultDigest, uint32_t *intermediateDigest, uint32_t totalMsgLength, uint32_t messageLength, uint32_t hashAlgorithm) |
| { |
| ASSERT(message); |
| ASSERT(totalMsgLength); |
| ASSERT(!(intermediateDigest == NULL) && !((uint32_t)intermediateDigest & 0x03)); |
| ASSERT(resultDigest); |
| ASSERT((hashAlgorithm == SHA2_MODE_SELECT_SHA224) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA256) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA384) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA512)); |
| |
| return SHA2ExecuteHash(message, resultDigest, intermediateDigest, totalMsgLength, messageLength, hashAlgorithm, false, true); |
| } |
| |
| //***************************************************************************** |
| // |
| // Start and finalize a new SHA-2 hash operation. |
| // |
| //***************************************************************************** |
| uint32_t SHA2ComputeHash(const uint8_t *message, uint8_t *resultDigest, uint32_t totalMsgLength, uint32_t hashAlgorithm) |
| { |
| ASSERT(message); |
| ASSERT(totalMsgLength); |
| ASSERT(resultDigest); |
| ASSERT((hashAlgorithm == SHA2_MODE_SELECT_SHA224) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA256) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA384) || |
| (hashAlgorithm == SHA2_MODE_SELECT_SHA512)); |
| |
| return SHA2ExecuteHash(message, resultDigest, 0, totalMsgLength, totalMsgLength, hashAlgorithm, true, true); |
| } |
| |
| //***************************************************************************** |
| // |
| // Start any SHA-2 hash operation. |
| // |
| //***************************************************************************** |
| static uint32_t SHA2ExecuteHash(const uint8_t *message, uint8_t *resultDigest, uint32_t *intermediateDigest, uint32_t totalMsgLength, uint32_t messageLength, uint32_t hashAlgorithm, bool initialHash, bool finalHash) |
| { |
| uint8_t digestLength = 0; |
| uint32_t dmaAlgorithmSelect = 0; |
| |
| SHA2ClearDigestAvailableFlag(); |
| |
| switch (hashAlgorithm) { |
| case SHA2_MODE_SELECT_SHA224: |
| digestLength = SHA2_SHA224_DIGEST_LENGTH_BYTES; |
| dmaAlgorithmSelect = SHA2_ALGSEL_SHA256; |
| break; |
| case SHA2_MODE_SELECT_SHA256: |
| digestLength = SHA2_SHA256_DIGEST_LENGTH_BYTES; |
| dmaAlgorithmSelect = SHA2_ALGSEL_SHA256; |
| break; |
| case SHA2_MODE_SELECT_SHA384: |
| digestLength = SHA2_SHA384_DIGEST_LENGTH_BYTES; |
| dmaAlgorithmSelect = SHA2_ALGSEL_SHA512; |
| break; |
| case SHA2_MODE_SELECT_SHA512: |
| digestLength = SHA2_SHA512_DIGEST_LENGTH_BYTES; |
| dmaAlgorithmSelect = SHA2_ALGSEL_SHA512; |
| break; |
| default: |
| return SHA2_INVALID_ALGORITHM; |
| } |
| |
| if (initialHash && finalHash) { |
| // The empty string is a perfectly valid message. It obviously has a length of 0. The DMA cannot |
| // handle running with a transfer length of 0. This workaround depends on the hash engine adding the |
| // trailing 1 bit and 0-padding bits after the DMAtransfer is complete and not in the DMA itself. |
| // totalMsgLength is purposefully not altered as it is appended to the end of the message during finalization |
| // and determines how many padding-bytes are added. |
| // Altering totalMsgLength would alter the final hash digest. |
| // Because totalMsgLength specifies that the message is of length 0, the content of the byte loaded |
| // through the DMA is irrelevant. It is overwritten internally in the hash engine. |
| messageLength = messageLength ? messageLength : 1; |
| } |
| |
| // Setting the incorrect number of bits here leads to the calculation of the correct result |
| // but a failure to read them out. |
| // The tag bit is set to read out the digest via DMA rather than through the slave interface. |
| SHA2SelectAlgorithm(dmaAlgorithmSelect | (resultDigest ? SHA2_ALGSEL_TAG : 0)); |
| SHA2IntClear(SHA2_DMA_IN_DONE | SHA2_RESULT_RDY); |
| SHA2IntEnable(SHA2_DMA_IN_DONE | SHA2_RESULT_RDY); |
| |
| HWREG(CRYPTO_BASE + CRYPTO_O_HASHMODE) = hashAlgorithm | (initialHash ? CRYPTO_HASHMODE_NEW_HASH_M : 0); |
| |
| // Only load the intermediate digest if requested. |
| if (intermediateDigest && !initialHash) { |
| SHA2SetDigest(intermediateDigest, digestLength); |
| } |
| |
| // If this is the final hash, finalization is required. This means appending a 1 bit, padding the message until this section |
| // is 448 bytes long, and adding the 64 bit total length of the message in bits. Thankfully, this is all done in hardware. |
| if (finalHash) { |
| // This specific length must be specified in bits not bytes. |
| SHA2SetMessageLength(totalMsgLength * 8); |
| HWREG(CRYPTO_BASE + CRYPTO_O_HASHIOBUFCTRL) = CRYPTO_HASHIOBUFCTRL_PAD_DMA_MESSAGE_M; |
| |
| } |
| |
| // The cast is fine in this case. SHA2StartDMAOperation channel one serves as input and no one does |
| // hash operations in-place. |
| SHA2StartDMAOperation((uint8_t *)message, messageLength, resultDigest, digestLength); |
| |
| return SHA2_SUCCESS; |
| } |
