| 1 | /* |
| 2 | * s390x crypto helpers |
| 3 | * |
| 4 | * Copyright (C) 2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. |
| 5 | * Copyright (c) 2017 Red Hat Inc |
| 6 | * |
| 7 | * Authors: |
| 8 | * David Hildenbrand <david@redhat.com> |
| 9 | * Jason A. Donenfeld <Jason@zx2c4.com> |
| 10 | * |
| 11 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
| 12 | * See the COPYING file in the top-level directory. |
| 13 | */ |
| 14 | |
| 15 | #include "qemu/osdep.h" |
| 16 | #include "qemu/guest-random.h" |
| 17 | #include "s390x-internal.h" |
| 18 | #include "tcg_s390x.h" |
| 19 | #include "exec/cpu-common.h" |
| 20 | #include "exec/helper-proto.h" |
| 21 | #include "accel/tcg/cpu-ldst-common.h" |
| 22 | #include "accel/tcg/cpu-mmu-index.h" |
| 23 | |
| 24 | static uint64_t R(uint64_t x, int c) |
| 25 | { |
| 26 | return (x >> c) | (x << (64 - c)); |
| 27 | } |
| 28 | static uint64_t Ch(uint64_t x, uint64_t y, uint64_t z) |
| 29 | { |
| 30 | return (x & y) ^ (~x & z); |
| 31 | } |
| 32 | static uint64_t Maj(uint64_t x, uint64_t y, uint64_t z) |
| 33 | { |
| 34 | return (x & y) ^ (x & z) ^ (y & z); |
| 35 | } |
| 36 | static uint64_t Sigma0(uint64_t x) |
| 37 | { |
| 38 | return R(x, 28) ^ R(x, 34) ^ R(x, 39); |
| 39 | } |
| 40 | static uint64_t Sigma1(uint64_t x) |
| 41 | { |
| 42 | return R(x, 14) ^ R(x, 18) ^ R(x, 41); |
| 43 | } |
| 44 | static uint64_t sigma0(uint64_t x) |
| 45 | { |
| 46 | return R(x, 1) ^ R(x, 8) ^ (x >> 7); |
| 47 | } |
| 48 | static uint64_t sigma1(uint64_t x) |
| 49 | { |
| 50 | return R(x, 19) ^ R(x, 61) ^ (x >> 6); |
| 51 | } |
| 52 | |
| 53 | static const uint64_t K[80] = { |
| 54 | 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL, |
| 55 | 0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, |
| 56 | 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL, |
| 57 | 0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, |
| 58 | 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL, |
| 59 | 0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, |
| 60 | 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL, |
| 61 | 0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL, |
| 62 | 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL, |
| 63 | 0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, |
| 64 | 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL, |
| 65 | 0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, |
| 66 | 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL, |
| 67 | 0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, |
| 68 | 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL, |
| 69 | 0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL, |
| 70 | 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL, |
| 71 | 0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, |
| 72 | 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL, |
| 73 | 0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, |
| 74 | 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL, |
| 75 | 0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, |
| 76 | 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL, |
| 77 | 0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL, |
| 78 | 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL, |
| 79 | 0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, |
| 80 | 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL |
| 81 | }; |
| 82 | |
| 83 | /* a is icv/ocv, w is a single message block. w will get reused internally. */ |
| 84 | static void sha512_bda(uint64_t a[8], uint64_t w[16]) |
| 85 | { |
| 86 | uint64_t t, z[8], b[8]; |
| 87 | int i, j; |
| 88 | |
| 89 | memcpy(z, a, sizeof(z)); |
| 90 | for (i = 0; i < 80; i++) { |
| 91 | memcpy(b, a, sizeof(b)); |
| 92 | |
| 93 | t = a[7] + Sigma1(a[4]) + Ch(a[4], a[5], a[6]) + K[i] + w[i % 16]; |
| 94 | b[7] = t + Sigma0(a[0]) + Maj(a[0], a[1], a[2]); |
| 95 | b[3] += t; |
| 96 | for (j = 0; j < 8; ++j) { |
| 97 | a[(j + 1) % 8] = b[j]; |
| 98 | } |
| 99 | if (i % 16 == 15) { |
| 100 | for (j = 0; j < 16; ++j) { |
| 101 | w[j] += w[(j + 9) % 16] + sigma0(w[(j + 1) % 16]) + |
| 102 | sigma1(w[(j + 14) % 16]); |
| 103 | } |
| 104 | } |
| 105 | } |
| 106 | |
| 107 | for (i = 0; i < 8; i++) { |
| 108 | a[i] += z[i]; |
| 109 | } |
| 110 | } |
| 111 | |
| 112 | /* a is icv/ocv, w is a single message block that needs be64 conversion. */ |
| 113 | static void sha512_bda_be64(uint64_t a[8], uint64_t w[16]) |
| 114 | { |
| 115 | uint64_t t[16]; |
| 116 | int i; |
| 117 | |
| 118 | for (i = 0; i < 16; i++) { |
| 119 | t[i] = be64_to_cpu(w[i]); |
| 120 | } |
| 121 | sha512_bda(a, t); |
| 122 | } |
| 123 | |
| 124 | static void sha512_read_icv(CPUS390XState *env, const int mmu_idx, |
| 125 | uint64_t addr, uint64_t a[8], uintptr_t ra) |
| 126 | { |
| 127 | const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx); |
| 128 | |
| 129 | for (int i = 0; i < 8; i++, addr += 8) { |
| 130 | a[i] = cpu_ldq_mmu(env, wrap_address(env, addr), oi, ra); |
| 131 | } |
| 132 | } |
| 133 | |
| 134 | static void sha512_write_ocv(CPUS390XState *env, const int mmu_idx, |
| 135 | uint64_t addr, uint64_t a[8], uintptr_t ra) |
| 136 | { |
| 137 | const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx); |
| 138 | |
| 139 | for (int i = 0; i < 8; i++, addr += 8) { |
| 140 | cpu_stq_mmu(env, wrap_address(env, addr), a[i], oi, ra); |
| 141 | } |
| 142 | } |
| 143 | |
| 144 | static void sha512_read_block(CPUS390XState *env, const int mmu_idx, |
| 145 | uint64_t addr, uint64_t a[16], uintptr_t ra) |
| 146 | { |
| 147 | const MemOpIdx oi = make_memop_idx(MO_BE | MO_64 | MO_UNALN, mmu_idx); |
| 148 | |
| 149 | for (int i = 0; i < 16; i++, addr += 8) { |
| 150 | a[i] = cpu_ldq_mmu(env, wrap_address(env, addr), oi, ra); |
| 151 | } |
| 152 | } |
| 153 | |
| 154 | static void sha512_read_mbl_be64(CPUS390XState *env, const int mmu_idx, |
| 155 | uint64_t addr, uint8_t a[16], uintptr_t ra) |
| 156 | { |
| 157 | const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx); |
| 158 | |
| 159 | for (int i = 0; i < 16; i++, addr += 1) { |
| 160 | a[i] = cpu_ldb_mmu(env, wrap_address(env, addr), oi, ra); |
| 161 | } |
| 162 | } |
| 163 | |
| 164 | static int cpacf_sha512(CPUS390XState *env, const int mmu_idx, uintptr_t ra, |
| 165 | uint64_t param_addr, uint64_t *message_reg, |
| 166 | uint64_t *len_reg, uint32_t type) |
| 167 | { |
| 168 | enum { MAX_BLOCKS_PER_RUN = 64 }; /* Arbitrary: keep interactivity. */ |
| 169 | uint64_t len = *len_reg, a[8], processed = 0; |
| 170 | int i, message_reg_len = 64; |
| 171 | |
| 172 | g_assert(type == S390_FEAT_TYPE_KIMD || type == S390_FEAT_TYPE_KLMD); |
| 173 | |
| 174 | if (!(env->psw.mask & PSW_MASK_64)) { |
| 175 | len = (uint32_t)len; |
| 176 | message_reg_len = (env->psw.mask & PSW_MASK_32) ? 32 : 24; |
| 177 | } |
| 178 | |
| 179 | /* KIMD: length has to be properly aligned. */ |
| 180 | if (type == S390_FEAT_TYPE_KIMD && !QEMU_IS_ALIGNED(len, 128)) { |
| 181 | tcg_s390_program_interrupt(env, PGM_SPECIFICATION, ra); |
| 182 | } |
| 183 | |
| 184 | sha512_read_icv(env, mmu_idx, param_addr, a, ra); |
| 185 | |
| 186 | /* Process full blocks first. */ |
| 187 | for (; len >= 128; len -= 128, processed += 128) { |
| 188 | uint64_t w[16]; |
| 189 | |
| 190 | if (processed >= MAX_BLOCKS_PER_RUN * 128) { |
| 191 | break; |
| 192 | } |
| 193 | |
| 194 | sha512_read_block(env, mmu_idx, *message_reg + processed, w, ra); |
| 195 | sha512_bda(a, w); |
| 196 | } |
| 197 | |
| 198 | /* KLMD: Process partial/empty block last. */ |
| 199 | if (type == S390_FEAT_TYPE_KLMD && len < 128) { |
| 200 | const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx); |
| 201 | uint8_t x[128]; |
| 202 | |
| 203 | /* Read the remainder of the message byte-per-byte. */ |
| 204 | for (i = 0; i < len; i++) { |
| 205 | uint64_t addr = wrap_address(env, *message_reg + processed + i); |
| 206 | |
| 207 | x[i] = cpu_ldb_mmu(env, addr, oi, ra); |
| 208 | } |
| 209 | /* Pad the remainder with zero and set the top bit. */ |
| 210 | memset(x + len, 0, 128 - len); |
| 211 | x[len] = 128; |
| 212 | |
| 213 | /* |
| 214 | * Place the MBL either into this block (if there is space left), |
| 215 | * or use an additional one. |
| 216 | */ |
| 217 | if (len < 112) { |
| 218 | sha512_read_mbl_be64(env, mmu_idx, param_addr + 64, x + 112, ra); |
| 219 | } |
| 220 | sha512_bda_be64(a, (uint64_t *)x); |
| 221 | |
| 222 | if (len >= 112) { |
| 223 | memset(x, 0, 112); |
| 224 | sha512_read_mbl_be64(env, mmu_idx, param_addr + 64, x + 112, ra); |
| 225 | sha512_bda_be64(a, (uint64_t *)x); |
| 226 | } |
| 227 | |
| 228 | processed += len; |
| 229 | len = 0; |
| 230 | } |
| 231 | |
| 232 | /* |
| 233 | * Modify memory after we read all inputs and modify registers only after |
| 234 | * writing memory succeeded. |
| 235 | * |
| 236 | * TODO: if writing fails halfway through (e.g., when crossing page |
| 237 | * boundaries), we're in trouble. We'd need something like access_prepare(). |
| 238 | */ |
| 239 | sha512_write_ocv(env, mmu_idx, param_addr, a, ra); |
| 240 | *message_reg = deposit64(*message_reg, 0, message_reg_len, |
| 241 | *message_reg + processed); |
| 242 | *len_reg -= processed; |
| 243 | return !len ? 0 : 3; |
| 244 | } |
| 245 | |
| 246 | static int fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra, |
| 247 | uint64_t *buf_reg, uint64_t *len_reg) |
| 248 | { |
| 249 | const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx); |
| 250 | uint8_t tmp[256]; |
| 251 | uint64_t len = *len_reg; |
| 252 | int buf_reg_len = 64; |
| 253 | |
| 254 | if (!(env->psw.mask & PSW_MASK_64)) { |
| 255 | len = (uint32_t)len; |
| 256 | buf_reg_len = (env->psw.mask & PSW_MASK_32) ? 32 : 24; |
| 257 | } |
| 258 | |
| 259 | while (len) { |
| 260 | size_t block = MIN(len, sizeof(tmp)); |
| 261 | |
| 262 | qemu_guest_getrandom_nofail(tmp, block); |
| 263 | for (size_t i = 0; i < block; ++i) { |
| 264 | cpu_stb_mmu(env, wrap_address(env, *buf_reg), tmp[i], oi, ra); |
| 265 | *buf_reg = deposit64(*buf_reg, 0, buf_reg_len, *buf_reg + 1); |
| 266 | --*len_reg; |
| 267 | } |
| 268 | len -= block; |
| 269 | |
| 270 | if (cpu_loop_exit_requested(env_cpu(env))) { |
| 271 | break; |
| 272 | } |
| 273 | } |
| 274 | |
| 275 | return len == 0 ? 0 : 3; |
| 276 | } |
| 277 | |
| 278 | uint32_t HELPER(msa)(CPUS390XState *env, uint32_t r1, uint32_t r2, uint32_t r3, |
| 279 | uint32_t type) |
| 280 | { |
| 281 | const int mmu_idx = cpu_mmu_index(env_cpu(env), false); |
| 282 | const uintptr_t ra = GETPC(); |
| 283 | const uint8_t mod = env->regs[0] & 0x80ULL; |
| 284 | const uint8_t fc = env->regs[0] & 0x7fULL; |
| 285 | uint8_t subfunc[16] = { 0 }; |
| 286 | uint64_t param_addr; |
| 287 | MemOpIdx oi; |
| 288 | int cc; |
| 289 | |
| 290 | switch (type) { |
| 291 | case S390_FEAT_TYPE_KMAC: |
| 292 | case S390_FEAT_TYPE_KIMD: |
| 293 | case S390_FEAT_TYPE_KLMD: |
| 294 | case S390_FEAT_TYPE_PCKMO: |
| 295 | case S390_FEAT_TYPE_PCC: |
| 296 | if (mod) { |
| 297 | tcg_s390_program_interrupt(env, PGM_SPECIFICATION, ra); |
| 298 | } |
| 299 | break; |
| 300 | } |
| 301 | |
| 302 | s390_get_feat_block(type, subfunc); |
| 303 | if (!test_be_bit(fc, subfunc)) { |
| 304 | tcg_s390_program_interrupt(env, PGM_SPECIFICATION, ra); |
| 305 | } |
| 306 | |
| 307 | switch (fc) { |
| 308 | case 0: /* query subfunction */ |
| 309 | oi = make_memop_idx(MO_8, mmu_idx); |
| 310 | for (int i = 0; i < 16; i++) { |
| 311 | param_addr = wrap_address(env, env->regs[1] + i); |
| 312 | cpu_stb_mmu(env, param_addr, subfunc[i], oi, ra); |
| 313 | } |
| 314 | break; |
| 315 | case 3: /* CPACF_*_SHA_512 */ |
| 316 | return cpacf_sha512(env, mmu_idx, ra, env->regs[1], &env->regs[r2], |
| 317 | &env->regs[r2 + 1], type); |
| 318 | case 114: /* CPACF_PRNO_TRNG */ |
| 319 | cc = fill_buf_random(env, mmu_idx, ra, |
| 320 | &env->regs[r1], &env->regs[r1 + 1]); |
| 321 | if (cc == 0) { |
| 322 | cc = fill_buf_random(env, mmu_idx, ra, |
| 323 | &env->regs[r2], &env->regs[r2 + 1]); |
| 324 | } |
| 325 | return cc; |
| 326 | default: |
| 327 | /* we don't implement any other subfunction yet */ |
| 328 | g_assert_not_reached(); |
| 329 | } |
| 330 | |
| 331 | return 0; |
| 332 | } |