|
 |
ad56ed |
diff -up openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update 2018-06-18 12:20:47.197994636 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl 2018-06-18 13:27:37.109817203 +0200
|
|
|
ad56ed |
@@ -122,6 +122,8 @@ sub _data_word()
|
|
|
ad56ed |
}
|
|
|
ad56ed |
|
|
|
ad56ed |
$code=<<___;
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
.text
|
|
|
ad56ed |
|
|
|
ad56ed |
.type AES_Te,\@object
|
|
|
ad56ed |
@@ -814,13 +816,10 @@ $code.=<<___ if (!$softonly);
|
|
|
ad56ed |
ar %r5,%r0
|
|
|
ad56ed |
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
- lg %r0,0(%r1)
|
|
|
ad56ed |
- tmhl %r0,0x4000 # check for message-security assist
|
|
|
ad56ed |
- jz .Lekey_internal
|
|
|
ad56ed |
-
|
|
|
ad56ed |
llihh %r0,0x8000
|
|
|
ad56ed |
srlg %r0,%r0,0(%r5)
|
|
|
ad56ed |
- ng %r0,48(%r1) # check kmc capability vector
|
|
|
ad56ed |
+ ng %r0,S390X_KM(%r1) # check availability of both km...
|
|
|
ad56ed |
+ ng %r0,S390X_KMC(%r1) # ...and kmc support for given key length
|
|
|
ad56ed |
jz .Lekey_internal
|
|
|
ad56ed |
|
|
|
ad56ed |
lmg %r0,%r1,0($inp) # just copy 128 bits...
|
|
|
ad56ed |
@@ -1443,7 +1442,7 @@ $code.=<<___ if (0); ######### kmctr cod
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
llihh %r0,0x8000 # check if kmctr supports the function code
|
|
|
ad56ed |
srlg %r0,%r0,0($s0)
|
|
|
ad56ed |
- ng %r0,64(%r1) # check kmctr capability vector
|
|
|
ad56ed |
+ ng %r0,S390X_KMCTR(%r1) # check kmctr capability vector
|
|
|
ad56ed |
lgr %r0,$s0
|
|
|
ad56ed |
lgr %r1,$s1
|
|
|
ad56ed |
jz .Lctr32_km_loop
|
|
|
ad56ed |
@@ -1593,7 +1592,7 @@ $code.=<<___ if(1);
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
llihh %r0,0x8000
|
|
|
ad56ed |
srlg %r0,%r0,32($s1) # check for 32+function code
|
|
|
ad56ed |
- ng %r0,32(%r1) # check km capability vector
|
|
|
ad56ed |
+ ng %r0,S390X_KM(%r1) # check km capability vector
|
|
|
ad56ed |
lgr %r0,$s0 # restore the function code
|
|
|
ad56ed |
la %r1,0($key1) # restore $key1
|
|
|
ad56ed |
jz .Lxts_km_vanilla
|
|
|
ad56ed |
@@ -2220,7 +2219,6 @@ ___
|
|
|
ad56ed |
}
|
|
|
ad56ed |
$code.=<<___;
|
|
|
ad56ed |
.string "AES for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
|
|
ad56ed |
-.comm OPENSSL_s390xcap_P,80,8
|
|
|
ad56ed |
___
|
|
|
ad56ed |
|
|
|
ad56ed |
$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/aes/Makefile.s390x-update openssl-1.0.2k/crypto/aes/Makefile
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/aes/Makefile.s390x-update 2017-01-26 14:22:03.000000000 +0100
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/aes/Makefile 2018-06-18 13:27:37.108817179 +0200
|
|
|
ad56ed |
@@ -92,6 +92,8 @@ aesv8-armx.S: asm/aesv8-armx.pl
|
|
|
ad56ed |
$(PERL) asm/aesv8-armx.pl $(PERLASM_SCHEME) $@
|
|
|
ad56ed |
aesv8-armx.o: aesv8-armx.S
|
|
|
ad56ed |
|
|
|
ad56ed |
+aes-s390x.o: aes-s390x.S
|
|
|
ad56ed |
+
|
|
|
ad56ed |
# GNU make "catch all"
|
|
|
ad56ed |
aes-%.S: asm/aes-%.pl; $(PERL) $< $(PERLASM_SCHEME) > $@
|
|
|
ad56ed |
aes-armv4.o: aes-armv4.S
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update openssl-1.0.2k/crypto/evp/e_aes.c
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update 2018-06-18 12:20:47.104992361 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/evp/e_aes.c 2018-06-18 13:28:07.033543735 +0200
|
|
|
ad56ed |
@@ -854,6 +854,723 @@ static const EVP_CIPHER aes_##keylen##_#
|
|
|
ad56ed |
const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
|
|
|
ad56ed |
{ return SPARC_AES_CAPABLE?&aes_t4_##keylen##_##mode:&aes_##keylen##_##mode; }
|
|
|
ad56ed |
|
|
|
ad56ed |
+#elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__)
|
|
|
ad56ed |
+/*
|
|
|
ad56ed |
+ * IBM S390X support
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+# include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+typedef struct {
|
|
|
ad56ed |
+ union {
|
|
|
ad56ed |
+ double align;
|
|
|
ad56ed |
+ /*-
|
|
|
ad56ed |
+ * KMA-GCM-AES parameter block
|
|
|
ad56ed |
+ * (see z/Architecture Principles of Operation SA22-7832-11)
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+ struct {
|
|
|
ad56ed |
+ unsigned char reserved[12];
|
|
|
ad56ed |
+ union {
|
|
|
ad56ed |
+ unsigned int w;
|
|
|
ad56ed |
+ unsigned char b[4];
|
|
|
ad56ed |
+ } cv;
|
|
|
ad56ed |
+ union {
|
|
|
ad56ed |
+ unsigned long long g[2];
|
|
|
ad56ed |
+ unsigned char b[16];
|
|
|
ad56ed |
+ } t;
|
|
|
ad56ed |
+ unsigned char h[16];
|
|
|
ad56ed |
+ unsigned long long taadl;
|
|
|
ad56ed |
+ unsigned long long tpcl;
|
|
|
ad56ed |
+ union {
|
|
|
ad56ed |
+ unsigned long long g[2];
|
|
|
ad56ed |
+ unsigned int w[4];
|
|
|
ad56ed |
+ } j0;
|
|
|
ad56ed |
+ unsigned char k[32];
|
|
|
ad56ed |
+ } param;
|
|
|
ad56ed |
+ } kma;
|
|
|
ad56ed |
+ unsigned int fc;
|
|
|
ad56ed |
+ int key_set;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ unsigned char *iv;
|
|
|
ad56ed |
+ int ivlen;
|
|
|
ad56ed |
+ int iv_set;
|
|
|
ad56ed |
+ int iv_gen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ int taglen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ unsigned char ares[16];
|
|
|
ad56ed |
+ unsigned char mres[16];
|
|
|
ad56ed |
+ unsigned char kres[16];
|
|
|
ad56ed |
+ int areslen;
|
|
|
ad56ed |
+ int mreslen;
|
|
|
ad56ed |
+ int kreslen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ int tls_aad_len;
|
|
|
ad56ed |
+} S390X_AES_GCM_CTX;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_CAPABLE ((OPENSSL_s390xcap_P.km[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_128)) &&\
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kmc[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_128)))
|
|
|
ad56ed |
+# define S390X_aes_192_CAPABLE ((OPENSSL_s390xcap_P.km[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_192)) &&\
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kmc[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_192)))
|
|
|
ad56ed |
+# define S390X_aes_256_CAPABLE ((OPENSSL_s390xcap_P.km[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_256)) &&\
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kmc[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_256)))
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_init_key aes_init_key
|
|
|
ad56ed |
+static int s390x_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
|
|
|
ad56ed |
+ const unsigned char *iv, int enc);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_cbc_CAPABLE 1 /* checked by callee */
|
|
|
ad56ed |
+# define S390X_aes_192_cbc_CAPABLE 1
|
|
|
ad56ed |
+# define S390X_aes_256_cbc_CAPABLE 1
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_cbc_cipher aes_cbc_cipher
|
|
|
ad56ed |
+static int s390x_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_ecb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_ecb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_ecb_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_ecb_cipher aes_ecb_cipher
|
|
|
ad56ed |
+static int s390x_aes_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_ofb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_ofb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_ofb_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_ofb_cipher aes_ofb_cipher
|
|
|
ad56ed |
+static int s390x_aes_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_cfb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_cfb_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_cfb_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_cfb_cipher aes_cfb_cipher
|
|
|
ad56ed |
+static int s390x_aes_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_cfb8_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_cfb8_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_cfb8_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_cfb8_cipher aes_cfb8_cipher
|
|
|
ad56ed |
+static int s390x_aes_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_cfb1_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_cfb1_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_cfb1_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_cfb1_cipher aes_cfb1_cipher
|
|
|
ad56ed |
+static int s390x_aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_ctr_CAPABLE 1 /* checked by callee */
|
|
|
ad56ed |
+# define S390X_aes_192_ctr_CAPABLE 1
|
|
|
ad56ed |
+# define S390X_aes_256_ctr_CAPABLE 1
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_ctr_cipher aes_ctr_cipher
|
|
|
ad56ed |
+static int s390x_aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_aes_128_gcm_CAPABLE (S390X_aes_128_CAPABLE && \
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kma[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_128)))
|
|
|
ad56ed |
+# define S390X_aes_192_gcm_CAPABLE (S390X_aes_192_CAPABLE && \
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kma[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_192)))
|
|
|
ad56ed |
+# define S390X_aes_256_gcm_CAPABLE (S390X_aes_256_CAPABLE && \
|
|
|
ad56ed |
+ (OPENSSL_s390xcap_P.kma[0] & \
|
|
|
ad56ed |
+ S390X_CAPBIT(S390X_AES_256)))
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* iv + padding length for iv lenghts != 12 */
|
|
|
ad56ed |
+# define S390X_gcm_ivpadlen(i) ((((i) + 15) >> 4 << 4) + 16)
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_aad(S390X_AES_GCM_CTX *ctx, const unsigned char *aad,
|
|
|
ad56ed |
+ size_t len)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ unsigned long long alen;
|
|
|
ad56ed |
+ int n, rem;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (ctx->kma.param.tpcl)
|
|
|
ad56ed |
+ return -2;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ alen = ctx->kma.param.taadl + len;
|
|
|
ad56ed |
+ if (alen > (U64(1) << 61) || (sizeof(len) == 8 && alen < len))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ ctx->kma.param.taadl = alen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ n = ctx->areslen;
|
|
|
ad56ed |
+ if (n) {
|
|
|
ad56ed |
+ while (n && len) {
|
|
|
ad56ed |
+ ctx->ares[n] = *aad;
|
|
|
ad56ed |
+ n = (n + 1) & 0xf;
|
|
|
ad56ed |
+ ++aad;
|
|
|
ad56ed |
+ --len;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ /* ctx->ares contains a complete block if offset has wrapped around */
|
|
|
ad56ed |
+ if (!n) {
|
|
|
ad56ed |
+ s390x_kma(ctx->ares, 16, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
|
|
|
ad56ed |
+ ctx->fc |= S390X_KMA_HS;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ ctx->areslen = n;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ rem = len & 0xf;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ len &= ~0xf;
|
|
|
ad56ed |
+ if (len) {
|
|
|
ad56ed |
+ s390x_kma(aad, len, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
|
|
|
ad56ed |
+ aad += len;
|
|
|
ad56ed |
+ ctx->fc |= S390X_KMA_HS;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (rem) {
|
|
|
ad56ed |
+ ctx->areslen = rem;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ do {
|
|
|
ad56ed |
+ --rem;
|
|
|
ad56ed |
+ ctx->ares[rem] = aad[rem];
|
|
|
ad56ed |
+ } while (rem);
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm(S390X_AES_GCM_CTX *ctx, const unsigned char *in,
|
|
|
ad56ed |
+ unsigned char *out, size_t len)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ const unsigned char *inptr;
|
|
|
ad56ed |
+ unsigned long long mlen;
|
|
|
ad56ed |
+ union {
|
|
|
ad56ed |
+ unsigned int w[4];
|
|
|
ad56ed |
+ unsigned char b[16];
|
|
|
ad56ed |
+ } buf;
|
|
|
ad56ed |
+ size_t inlen;
|
|
|
ad56ed |
+ int n, rem, i;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ mlen = ctx->kma.param.tpcl + len;
|
|
|
ad56ed |
+ if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ ctx->kma.param.tpcl = mlen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ n = ctx->mreslen;
|
|
|
ad56ed |
+ if (n) {
|
|
|
ad56ed |
+ inptr = in;
|
|
|
ad56ed |
+ inlen = len;
|
|
|
ad56ed |
+ while (n && inlen) {
|
|
|
ad56ed |
+ ctx->mres[n] = *inptr;
|
|
|
ad56ed |
+ n = (n + 1) & 0xf;
|
|
|
ad56ed |
+ ++inptr;
|
|
|
ad56ed |
+ --inlen;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ /* ctx->mres contains a complete block if offset has wrapped around */
|
|
|
ad56ed |
+ if (!n) {
|
|
|
ad56ed |
+ s390x_kma(ctx->ares, ctx->areslen, ctx->mres, 16, buf.b,
|
|
|
ad56ed |
+ ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
|
|
|
ad56ed |
+ ctx->fc |= S390X_KMA_HS;
|
|
|
ad56ed |
+ ctx->areslen = 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ /* previous call already encrypted/decrypted its remainder,
|
|
|
ad56ed |
+ * see comment below */
|
|
|
ad56ed |
+ n = ctx->mreslen;
|
|
|
ad56ed |
+ while (n) {
|
|
|
ad56ed |
+ *out = buf.b[n];
|
|
|
ad56ed |
+ n = (n + 1) & 0xf;
|
|
|
ad56ed |
+ ++out;
|
|
|
ad56ed |
+ ++in;
|
|
|
ad56ed |
+ --len;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ ctx->mreslen = 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ rem = len & 0xf;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ len &= ~0xf;
|
|
|
ad56ed |
+ if (len) {
|
|
|
ad56ed |
+ s390x_kma(ctx->ares, ctx->areslen, in, len, out,
|
|
|
ad56ed |
+ ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
|
|
|
ad56ed |
+ in += len;
|
|
|
ad56ed |
+ out += len;
|
|
|
ad56ed |
+ ctx->fc |= S390X_KMA_HS;
|
|
|
ad56ed |
+ ctx->areslen = 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ /*-
|
|
|
ad56ed |
+ * If there is a remainder, it has to be saved such that it can be
|
|
|
ad56ed |
+ * processed by kma later. However, we also have to do the for-now
|
|
|
ad56ed |
+ * unauthenticated encryption/decryption part here and now...
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+ if (rem) {
|
|
|
ad56ed |
+ if (!ctx->mreslen) {
|
|
|
ad56ed |
+ buf.w[0] = ctx->kma.param.j0.w[0];
|
|
|
ad56ed |
+ buf.w[1] = ctx->kma.param.j0.w[1];
|
|
|
ad56ed |
+ buf.w[2] = ctx->kma.param.j0.w[2];
|
|
|
ad56ed |
+ buf.w[3] = ctx->kma.param.cv.w + 1;
|
|
|
ad56ed |
+ s390x_km(buf.b, 16, ctx->kres, ctx->fc & 0x1f, &ctx->kma.param.k);
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ n = ctx->mreslen;
|
|
|
ad56ed |
+ for (i = 0; i < rem; i++) {
|
|
|
ad56ed |
+ ctx->mres[n + i] = in[i];
|
|
|
ad56ed |
+ out[i] = in[i] ^ ctx->kres[n + i];
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ ctx->mreslen += rem;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx,
|
|
|
ad56ed |
+ const unsigned char *iv)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ ctx->kma.param.t.g[0] = 0;
|
|
|
ad56ed |
+ ctx->kma.param.t.g[1] = 0;
|
|
|
ad56ed |
+ ctx->kma.param.tpcl = 0;
|
|
|
ad56ed |
+ ctx->kma.param.taadl = 0;
|
|
|
ad56ed |
+ ctx->mreslen = 0;
|
|
|
ad56ed |
+ ctx->areslen = 0;
|
|
|
ad56ed |
+ ctx->kreslen = 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (ctx->ivlen == 12) {
|
|
|
ad56ed |
+ memcpy(&ctx->kma.param.j0, iv, ctx->ivlen);
|
|
|
ad56ed |
+ ctx->kma.param.j0.w[3] = 1;
|
|
|
ad56ed |
+ ctx->kma.param.cv.w = 1;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ /* ctx->iv has the right size and is already padded. */
|
|
|
ad56ed |
+ memcpy(ctx->iv, iv, ctx->ivlen);
|
|
|
ad56ed |
+ s390x_kma(ctx->iv, S390X_gcm_ivpadlen(ctx->ivlen), NULL, 0, NULL,
|
|
|
ad56ed |
+ ctx->fc, &ctx->kma.param);
|
|
|
ad56ed |
+ ctx->fc |= S390X_KMA_HS;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ ctx->kma.param.j0.g[0] = ctx->kma.param.t.g[0];
|
|
|
ad56ed |
+ ctx->kma.param.j0.g[1] = ctx->kma.param.t.g[1];
|
|
|
ad56ed |
+ ctx->kma.param.cv.w = ctx->kma.param.j0.w[3];
|
|
|
ad56ed |
+ ctx->kma.param.t.g[0] = 0;
|
|
|
ad56ed |
+ ctx->kma.param.t.g[1] = 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx_out;
|
|
|
ad56ed |
+ EVP_CIPHER_CTX *out;
|
|
|
ad56ed |
+ unsigned char *buf, *iv;
|
|
|
ad56ed |
+ int ivlen, enc, len;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ switch (type) {
|
|
|
ad56ed |
+ case EVP_CTRL_INIT:
|
|
|
ad56ed |
+ ivlen = c->cipher->iv_len;;
|
|
|
ad56ed |
+ iv = c->iv;
|
|
|
ad56ed |
+ gctx->key_set = 0;
|
|
|
ad56ed |
+ gctx->iv_set = 0;
|
|
|
ad56ed |
+ gctx->ivlen = ivlen;
|
|
|
ad56ed |
+ gctx->iv = iv;
|
|
|
ad56ed |
+ gctx->taglen = -1;
|
|
|
ad56ed |
+ gctx->iv_gen = 0;
|
|
|
ad56ed |
+ gctx->tls_aad_len = -1;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_SET_IVLEN:
|
|
|
ad56ed |
+ if (arg <= 0)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (arg != 12) {
|
|
|
ad56ed |
+ iv = c->iv;
|
|
|
ad56ed |
+ len = S390X_gcm_ivpadlen(arg);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ /* Allocate memory for iv if needed. */
|
|
|
ad56ed |
+ if (gctx->ivlen == 12 || len > S390X_gcm_ivpadlen(gctx->ivlen)) {
|
|
|
ad56ed |
+ if (gctx->iv != iv)
|
|
|
ad56ed |
+ OPENSSL_free(gctx->iv);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ gctx->iv = OPENSSL_malloc(len);
|
|
|
ad56ed |
+ if (gctx->iv == NULL)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ /* Add padding. */
|
|
|
ad56ed |
+ memset(gctx->iv + arg, 0, len - arg - 8);
|
|
|
ad56ed |
+ *((unsigned long long *)(gctx->iv + len - 8)) = arg << 3;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ gctx->ivlen = arg;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_SET_TAG:
|
|
|
ad56ed |
+ buf = c->buf;
|
|
|
ad56ed |
+ enc = c->encrypt;
|
|
|
ad56ed |
+ if (arg <= 0 || arg > 16 || enc)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ memcpy(buf, ptr, arg);
|
|
|
ad56ed |
+ gctx->taglen = arg;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_GET_TAG:
|
|
|
ad56ed |
+ enc = c->encrypt;
|
|
|
ad56ed |
+ if (arg <= 0 || arg > 16 || !enc || gctx->taglen < 0)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ memcpy(ptr, gctx->kma.param.t.b, arg);
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_SET_IV_FIXED:
|
|
|
ad56ed |
+ /* Special case: -1 length restores whole iv */
|
|
|
ad56ed |
+ if (arg == -1) {
|
|
|
ad56ed |
+ memcpy(gctx->iv, ptr, gctx->ivlen);
|
|
|
ad56ed |
+ gctx->iv_gen = 1;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ /*
|
|
|
ad56ed |
+ * Fixed field must be at least 4 bytes and invocation field at least
|
|
|
ad56ed |
+ * 8.
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+ if ((arg < 4) || (gctx->ivlen - arg) < 8)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (arg)
|
|
|
ad56ed |
+ memcpy(gctx->iv, ptr, arg);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ enc = c->encrypt;
|
|
|
ad56ed |
+ if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ gctx->iv_gen = 1;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_IV_GEN:
|
|
|
ad56ed |
+ if (gctx->iv_gen == 0 || gctx->key_set == 0)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ s390x_aes_gcm_setiv(gctx, gctx->iv);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (arg <= 0 || arg > gctx->ivlen)
|
|
|
ad56ed |
+ arg = gctx->ivlen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
|
|
|
ad56ed |
+ /*
|
|
|
ad56ed |
+ * Invocation field will be at least 8 bytes in size and so no need
|
|
|
ad56ed |
+ * to check wrap around or increment more than last 8 bytes.
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+ (*(unsigned long long *)(gctx->iv + gctx->ivlen - 8))++;
|
|
|
ad56ed |
+ gctx->iv_set = 1;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_GCM_SET_IV_INV:
|
|
|
ad56ed |
+ enc = c->encrypt;
|
|
|
ad56ed |
+ if (gctx->iv_gen == 0 || gctx->key_set == 0 || enc)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
|
|
|
ad56ed |
+ s390x_aes_gcm_setiv(gctx, gctx->iv);
|
|
|
ad56ed |
+ gctx->iv_set = 1;
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_AEAD_TLS1_AAD:
|
|
|
ad56ed |
+ /* Save the aad for later use. */
|
|
|
ad56ed |
+ if (arg != EVP_AEAD_TLS1_AAD_LEN)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ buf = c->buf;
|
|
|
ad56ed |
+ memcpy(buf, ptr, arg);
|
|
|
ad56ed |
+ gctx->tls_aad_len = arg;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ len = buf[arg - 2] << 8 | buf[arg - 1];
|
|
|
ad56ed |
+ /* Correct length for explicit iv. */
|
|
|
ad56ed |
+ if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+ len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ /* If decrypting correct for tag too. */
|
|
|
ad56ed |
+ enc = c->encrypt;
|
|
|
ad56ed |
+ if (!enc) {
|
|
|
ad56ed |
+ if (len < EVP_GCM_TLS_TAG_LEN)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+ len -= EVP_GCM_TLS_TAG_LEN;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ buf[arg - 2] = len >> 8;
|
|
|
ad56ed |
+ buf[arg - 1] = len & 0xff;
|
|
|
ad56ed |
+ /* Extra padding: tag appended to record. */
|
|
|
ad56ed |
+ return EVP_GCM_TLS_TAG_LEN;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ case EVP_CTRL_COPY:
|
|
|
ad56ed |
+ out = ptr;
|
|
|
ad56ed |
+ gctx_out = EVP_C_DATA(S390X_AES_GCM_CTX, out);
|
|
|
ad56ed |
+ iv = c->iv;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (gctx->iv == iv) {
|
|
|
ad56ed |
+ gctx_out->iv = out->iv;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ len = S390X_gcm_ivpadlen(gctx->ivlen);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ gctx_out->iv = OPENSSL_malloc(len);
|
|
|
ad56ed |
+ if (gctx_out->iv == NULL)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ memcpy(gctx_out->iv, gctx->iv, len);
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ default:
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_init_key(EVP_CIPHER_CTX *ctx,
|
|
|
ad56ed |
+ const unsigned char *key,
|
|
|
ad56ed |
+ const unsigned char *iv, int enc)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
|
|
|
ad56ed |
+ int keylen;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (iv == NULL && key == NULL)
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (key != NULL) {
|
|
|
ad56ed |
+ keylen = EVP_CIPHER_CTX_key_length(ctx);
|
|
|
ad56ed |
+ memcpy(&gctx->kma.param.k, key, keylen);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ /* Convert key size to function code. */
|
|
|
ad56ed |
+ gctx->fc = S390X_AES_128 + (((keylen << 3) - 128) >> 6);
|
|
|
ad56ed |
+ if (!enc)
|
|
|
ad56ed |
+ gctx->fc |= S390X_DECRYPT;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (iv == NULL && gctx->iv_set)
|
|
|
ad56ed |
+ iv = gctx->iv;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (iv != NULL) {
|
|
|
ad56ed |
+ s390x_aes_gcm_setiv(gctx, iv);
|
|
|
ad56ed |
+ gctx->iv_set = 1;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ gctx->key_set = 1;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ if (gctx->key_set)
|
|
|
ad56ed |
+ s390x_aes_gcm_setiv(gctx, iv);
|
|
|
ad56ed |
+ else
|
|
|
ad56ed |
+ memcpy(gctx->iv, iv, gctx->ivlen);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ gctx->iv_set = 1;
|
|
|
ad56ed |
+ gctx->iv_gen = 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
|
|
|
ad56ed |
+ const unsigned char *buf = ctx->buf;
|
|
|
ad56ed |
+ const int enc = ctx->encrypt;
|
|
|
ad56ed |
+ int rv = -1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN
|
|
|
ad56ed |
+ : EVP_CTRL_GCM_SET_IV_INV,
|
|
|
ad56ed |
+ EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
|
|
|
ad56ed |
+ goto err;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
|
|
|
ad56ed |
+ out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
|
|
|
ad56ed |
+ len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ gctx->kma.param.taadl = gctx->tls_aad_len << 3;
|
|
|
ad56ed |
+ gctx->kma.param.tpcl = len << 3;
|
|
|
ad56ed |
+ s390x_kma(buf, gctx->tls_aad_len, in, len, out,
|
|
|
ad56ed |
+ gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (enc) {
|
|
|
ad56ed |
+ memcpy(out + len, gctx->kma.param.t.b, EVP_GCM_TLS_TAG_LEN);
|
|
|
ad56ed |
+ rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ if (CRYPTO_memcmp(gctx->kma.param.t.b, in + len,
|
|
|
ad56ed |
+ EVP_GCM_TLS_TAG_LEN)) {
|
|
|
ad56ed |
+ OPENSSL_cleanse(out, len);
|
|
|
ad56ed |
+ goto err;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ rv = len;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+err:
|
|
|
ad56ed |
+ gctx->iv_set = 0;
|
|
|
ad56ed |
+ gctx->tls_aad_len = -1;
|
|
|
ad56ed |
+ return rv;
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
|
|
|
ad56ed |
+ unsigned char *buf, tmp[16];
|
|
|
ad56ed |
+ int enc;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (!gctx->key_set)
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (gctx->tls_aad_len >= 0)
|
|
|
ad56ed |
+ return s390x_aes_gcm_tls_cipher(ctx, out, in, len);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (!gctx->iv_set)
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (in != NULL) {
|
|
|
ad56ed |
+ if (out == NULL) {
|
|
|
ad56ed |
+ if (s390x_aes_gcm_aad(gctx, in, len))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ if (s390x_aes_gcm(gctx, in, out, len))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return len;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ gctx->kma.param.taadl <<= 3;
|
|
|
ad56ed |
+ gctx->kma.param.tpcl <<= 3;
|
|
|
ad56ed |
+ s390x_kma(gctx->ares, gctx->areslen, gctx->mres, gctx->mreslen, tmp,
|
|
|
ad56ed |
+ gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
|
|
|
ad56ed |
+ /* recall that we already did en-/decrypt gctx->mres
|
|
|
ad56ed |
+ * and returned it to caller... */
|
|
|
ad56ed |
+ OPENSSL_cleanse(tmp, gctx->mreslen);
|
|
|
ad56ed |
+ gctx->iv_set = 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ enc = ctx->encrypt;
|
|
|
ad56ed |
+ if (enc) {
|
|
|
ad56ed |
+ gctx->taglen = 16;
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ if (gctx->taglen < 0)
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ buf = ctx->buf;
|
|
|
ad56ed |
+ if (CRYPTO_memcmp(buf, gctx->kma.param.t.b, gctx->taglen))
|
|
|
ad56ed |
+ return -1;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+static int s390x_aes_gcm_cleanup(EVP_CIPHER_CTX *c)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+ S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
|
|
|
ad56ed |
+ const unsigned char *iv;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ if (gctx == NULL)
|
|
|
ad56ed |
+ return 0;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ iv = c->iv;
|
|
|
ad56ed |
+ if (iv != gctx->iv)
|
|
|
ad56ed |
+ OPENSSL_free(gctx->iv);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ OPENSSL_cleanse(gctx, sizeof(*gctx));
|
|
|
ad56ed |
+ return 1;
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_AES_XTS_CTX EVP_AES_XTS_CTX
|
|
|
ad56ed |
+# define S390X_aes_128_xts_CAPABLE 1 /* checked by callee */
|
|
|
ad56ed |
+# define S390X_aes_256_xts_CAPABLE 1
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_xts_init_key aes_xts_init_key
|
|
|
ad56ed |
+static int s390x_aes_xts_init_key(EVP_CIPHER_CTX *ctx,
|
|
|
ad56ed |
+ const unsigned char *key,
|
|
|
ad56ed |
+ const unsigned char *iv, int enc);
|
|
|
ad56ed |
+# define s390x_aes_xts_cipher aes_xts_cipher
|
|
|
ad56ed |
+static int s390x_aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+# define s390x_aes_xts_ctrl aes_xts_ctrl
|
|
|
ad56ed |
+static int s390x_aes_xts_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
|
|
|
ad56ed |
+# define s390x_aes_xts_cleanup aes_xts_cleanup
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define S390X_AES_CCM_CTX EVP_AES_CCM_CTX
|
|
|
ad56ed |
+# define S390X_aes_128_ccm_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_192_ccm_CAPABLE 0
|
|
|
ad56ed |
+# define S390X_aes_256_ccm_CAPABLE 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define s390x_aes_ccm_init_key aes_ccm_init_key
|
|
|
ad56ed |
+static int s390x_aes_ccm_init_key(EVP_CIPHER_CTX *ctx,
|
|
|
ad56ed |
+ const unsigned char *key,
|
|
|
ad56ed |
+ const unsigned char *iv, int enc);
|
|
|
ad56ed |
+# define s390x_aes_ccm_cipher aes_ccm_cipher
|
|
|
ad56ed |
+static int s390x_aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|
|
ad56ed |
+ const unsigned char *in, size_t len);
|
|
|
ad56ed |
+# define s390x_aes_ccm_ctrl aes_ccm_ctrl
|
|
|
ad56ed |
+static int s390x_aes_ccm_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
|
|
|
ad56ed |
+# define s390x_aes_ccm_cleanup aes_ccm_cleanup
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode, \
|
|
|
ad56ed |
+ MODE,flags) \
|
|
|
ad56ed |
+static const EVP_CIPHER s390x_aes_##keylen##_##mode = { \
|
|
|
ad56ed |
+ nid##_##keylen##_##nmode,blocksize, \
|
|
|
ad56ed |
+ keylen / 8, \
|
|
|
ad56ed |
+ ivlen, \
|
|
|
ad56ed |
+ flags | EVP_CIPH_##MODE##_MODE, \
|
|
|
ad56ed |
+ s390x_aes_init_key, \
|
|
|
ad56ed |
+ s390x_aes_##mode##_cipher, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ sizeof(EVP_AES_KEY), \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ NULL \
|
|
|
ad56ed |
+}; \
|
|
|
ad56ed |
+static const EVP_CIPHER aes_##keylen##_##mode = { \
|
|
|
ad56ed |
+ nid##_##keylen##_##nmode, \
|
|
|
ad56ed |
+ blocksize, \
|
|
|
ad56ed |
+ keylen / 8, \
|
|
|
ad56ed |
+ ivlen, \
|
|
|
ad56ed |
+ flags | EVP_CIPH_##MODE##_MODE, \
|
|
|
ad56ed |
+ aes_init_key, \
|
|
|
ad56ed |
+ aes_##mode##_cipher, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ sizeof(EVP_AES_KEY), \
|
|
|
ad56ed |
+ NULL,NULL,NULL,NULL \
|
|
|
ad56ed |
+}; \
|
|
|
ad56ed |
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
|
|
|
ad56ed |
+{ \
|
|
|
ad56ed |
+ return S390X_aes_##keylen##_##mode##_CAPABLE ? \
|
|
|
ad56ed |
+ &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode; \
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags)\
|
|
|
ad56ed |
+static const EVP_CIPHER s390x_aes_##keylen##_##mode = { \
|
|
|
ad56ed |
+ nid##_##keylen##_##mode, \
|
|
|
ad56ed |
+ blocksize, \
|
|
|
ad56ed |
+ (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8, \
|
|
|
ad56ed |
+ ivlen, \
|
|
|
ad56ed |
+ flags | EVP_CIPH_##MODE##_MODE, \
|
|
|
ad56ed |
+ s390x_aes_##mode##_init_key, \
|
|
|
ad56ed |
+ s390x_aes_##mode##_cipher, \
|
|
|
ad56ed |
+ s390x_aes_##mode##_cleanup, \
|
|
|
ad56ed |
+ sizeof(S390X_AES_##MODE##_CTX), \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ s390x_aes_##mode##_ctrl, \
|
|
|
ad56ed |
+ NULL \
|
|
|
ad56ed |
+}; \
|
|
|
ad56ed |
+static const EVP_CIPHER aes_##keylen##_##mode = { \
|
|
|
ad56ed |
+ nid##_##keylen##_##mode,blocksize, \
|
|
|
ad56ed |
+ (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8, \
|
|
|
ad56ed |
+ ivlen, \
|
|
|
ad56ed |
+ flags | EVP_CIPH_##MODE##_MODE, \
|
|
|
ad56ed |
+ aes_##mode##_init_key, \
|
|
|
ad56ed |
+ aes_##mode##_cipher, \
|
|
|
ad56ed |
+ aes_##mode##_cleanup, \
|
|
|
ad56ed |
+ sizeof(EVP_AES_##MODE##_CTX), \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ NULL, \
|
|
|
ad56ed |
+ aes_##mode##_ctrl, \
|
|
|
ad56ed |
+ NULL \
|
|
|
ad56ed |
+}; \
|
|
|
ad56ed |
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
|
|
|
ad56ed |
+{ \
|
|
|
ad56ed |
+ return S390X_aes_##keylen##_##mode##_CAPABLE ? \
|
|
|
ad56ed |
+ &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode; \
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
# else
|
|
|
ad56ed |
|
|
|
ad56ed |
# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/Makefile.s390x-update openssl-1.0.2k/crypto/Makefile
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/Makefile.s390x-update 2018-06-18 12:20:49.079040659 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/Makefile 2018-06-18 13:27:53.065204592 +0200
|
|
|
ad56ed |
@@ -77,6 +77,7 @@ alphacpuid.s: alphacpuid.pl
|
|
|
ad56ed |
(preproc=$$$$.$@.S; trap "rm $$preproc" INT; \
|
|
|
ad56ed |
$(PERL) alphacpuid.pl > $$preproc && \
|
|
|
ad56ed |
$(CC) -E -P $$preproc > $@ && rm $$preproc)
|
|
|
ad56ed |
+s390xcpuid.S: s390xcpuid.pl; $(PERL) s390xcpuid.pl $(PERLASM_SCHEME) $@
|
|
|
ad56ed |
|
|
|
ad56ed |
testapps:
|
|
|
ad56ed |
[ -z "$(THIS)" ] || ( if echo $(SDIRS) | fgrep ' des '; \
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl.s390x-update openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl.s390x-update 2018-06-18 12:20:47.170993976 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl 2018-06-18 13:27:37.110817228 +0200
|
|
|
ad56ed |
@@ -73,6 +73,8 @@ $rem_4bit="%r14";
|
|
|
ad56ed |
$sp="%r15";
|
|
|
ad56ed |
|
|
|
ad56ed |
$code.=<<___;
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
.text
|
|
|
ad56ed |
|
|
|
ad56ed |
.globl gcm_gmult_4bit
|
|
|
ad56ed |
@@ -85,12 +87,13 @@ $code.=<<___ if(!$softonly && 0); # hard
|
|
|
ad56ed |
tmhl %r0,0x4000 # check for message-security-assist
|
|
|
ad56ed |
jz .Lsoft_gmult
|
|
|
ad56ed |
lghi %r0,0
|
|
|
ad56ed |
- lg %r1,24(%r1) # load second word of kimd capabilities vector
|
|
|
ad56ed |
+ lg %r1,S390X_KIMD+8(%r1) # load second word of kimd capabilities
|
|
|
ad56ed |
+ # vector
|
|
|
ad56ed |
tmhh %r1,0x4000 # check for function 65
|
|
|
ad56ed |
jz .Lsoft_gmult
|
|
|
ad56ed |
stg %r0,16($sp) # arrange 16 bytes of zero input
|
|
|
ad56ed |
stg %r0,24($sp)
|
|
|
ad56ed |
- lghi %r0,65 # function 65
|
|
|
ad56ed |
+ lghi %r0,S390X_GHASH # function 65
|
|
|
ad56ed |
la %r1,0($Xi) # H lies right after Xi in gcm128_context
|
|
|
ad56ed |
la $inp,16($sp)
|
|
|
ad56ed |
lghi $len,16
|
|
|
ad56ed |
@@ -119,16 +122,11 @@ gcm_ghash_4bit:
|
|
|
ad56ed |
___
|
|
|
ad56ed |
$code.=<<___ if(!$softonly);
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
- lg %r0,0(%r1)
|
|
|
ad56ed |
- tmhl %r0,0x4000 # check for message-security-assist
|
|
|
ad56ed |
- jz .Lsoft_ghash
|
|
|
ad56ed |
- lghi %r0,0
|
|
|
ad56ed |
- la %r1,16($sp)
|
|
|
ad56ed |
- .long 0xb93e0004 # kimd %r0,%r4
|
|
|
ad56ed |
- lg %r1,24($sp)
|
|
|
ad56ed |
- tmhh %r1,0x4000 # check for function 65
|
|
|
ad56ed |
+ lg %r0,S390X_KIMD+8(%r1) # load second word of kimd capabilities
|
|
|
ad56ed |
+ # vector
|
|
|
ad56ed |
+ tmhh %r0,0x4000 # check for function 65
|
|
|
ad56ed |
jz .Lsoft_ghash
|
|
|
ad56ed |
- lghi %r0,65 # function 65
|
|
|
ad56ed |
+ lghi %r0,S390X_GHASH # function 65
|
|
|
ad56ed |
la %r1,0($Xi) # H lies right after Xi in gcm128_context
|
|
|
ad56ed |
.long 0xb93e0004 # kimd %r0,$inp
|
|
|
ad56ed |
brc 1,.-4 # pay attention to "partial completion"
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/modes/Makefile.s390x-update openssl-1.0.2k/crypto/modes/Makefile
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/modes/Makefile.s390x-update 2018-06-18 12:20:47.020990305 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/modes/Makefile 2018-06-18 13:27:37.110817228 +0200
|
|
|
ad56ed |
@@ -71,6 +71,8 @@ ghash-%.S: asm/ghash-%.pl; $(PERL) $< $(
|
|
|
ad56ed |
ghash-armv4.o: ghash-armv4.S
|
|
|
ad56ed |
ghashv8-armx.o: ghashv8-armx.S
|
|
|
ad56ed |
|
|
|
ad56ed |
+ghash-s390x.o: ghash-s390x.S
|
|
|
ad56ed |
+
|
|
|
ad56ed |
files:
|
|
|
ad56ed |
$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
|
|
|
ad56ed |
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl.s390x-update openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl.s390x-update 2018-06-18 12:20:47.174994073 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl 2018-06-18 13:27:37.112817276 +0200
|
|
|
ad56ed |
@@ -152,6 +152,8 @@ ___
|
|
|
ad56ed |
}
|
|
|
ad56ed |
|
|
|
ad56ed |
$code.=<<___;
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
.text
|
|
|
ad56ed |
.align 64
|
|
|
ad56ed |
.type Ktable,\@object
|
|
|
ad56ed |
@@ -164,10 +166,7 @@ sha1_block_data_order:
|
|
|
ad56ed |
___
|
|
|
ad56ed |
$code.=<<___ if ($kimdfunc);
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
- lg %r0,0(%r1)
|
|
|
ad56ed |
- tmhl %r0,0x4000 # check for message-security assist
|
|
|
ad56ed |
- jz .Lsoftware
|
|
|
ad56ed |
- lg %r0,16(%r1) # check kimd capabilities
|
|
|
ad56ed |
+ lg %r0,S390X_KIMD(%r1) # check kimd capabilities
|
|
|
ad56ed |
tmhh %r0,`0x8000>>$kimdfunc`
|
|
|
ad56ed |
jz .Lsoftware
|
|
|
ad56ed |
lghi %r0,$kimdfunc
|
|
|
ad56ed |
@@ -234,7 +233,6 @@ $code.=<<___;
|
|
|
ad56ed |
br %r14
|
|
|
ad56ed |
.size sha1_block_data_order,.-sha1_block_data_order
|
|
|
ad56ed |
.string "SHA1 block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
|
|
ad56ed |
-.comm OPENSSL_s390xcap_P,80,8
|
|
|
ad56ed |
___
|
|
|
ad56ed |
|
|
|
ad56ed |
$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl.s390x-update openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl.s390x-update 2018-06-18 12:20:47.179994196 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl 2018-06-18 13:27:37.112817276 +0200
|
|
|
ad56ed |
@@ -163,6 +163,8 @@ ___
|
|
|
ad56ed |
}
|
|
|
ad56ed |
|
|
|
ad56ed |
$code.=<<___;
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
.text
|
|
|
ad56ed |
.align 64
|
|
|
ad56ed |
.type $Table,\@object
|
|
|
ad56ed |
@@ -237,10 +239,7 @@ $Func:
|
|
|
ad56ed |
___
|
|
|
ad56ed |
$code.=<<___ if ($kimdfunc);
|
|
|
ad56ed |
larl %r1,OPENSSL_s390xcap_P
|
|
|
ad56ed |
- lg %r0,0(%r1)
|
|
|
ad56ed |
- tmhl %r0,0x4000 # check for message-security assist
|
|
|
ad56ed |
- jz .Lsoftware
|
|
|
ad56ed |
- lg %r0,16(%r1) # check kimd capabilities
|
|
|
ad56ed |
+ lg %r0,S390X_KIMD(%r1) # check kimd capabilities
|
|
|
ad56ed |
tmhh %r0,`0x8000>>$kimdfunc`
|
|
|
ad56ed |
jz .Lsoftware
|
|
|
ad56ed |
lghi %r0,$kimdfunc
|
|
|
ad56ed |
@@ -308,7 +307,6 @@ $code.=<<___;
|
|
|
ad56ed |
br %r14
|
|
|
ad56ed |
.size $Func,.-$Func
|
|
|
ad56ed |
.string "SHA${label} block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
|
|
ad56ed |
-.comm OPENSSL_s390xcap_P,80,8
|
|
|
ad56ed |
___
|
|
|
ad56ed |
|
|
|
ad56ed |
$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/sha/Makefile.s390x-update openssl-1.0.2k/crypto/sha/Makefile
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/sha/Makefile.s390x-update 2018-06-18 12:20:49.482050519 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/sha/Makefile 2018-06-18 13:27:37.112817276 +0200
|
|
|
ad56ed |
@@ -100,6 +100,10 @@ sha1-armv8.o: sha1-armv8.S
|
|
|
ad56ed |
sha256-armv8.o: sha256-armv8.S
|
|
|
ad56ed |
sha512-armv8.o: sha512-armv8.S
|
|
|
ad56ed |
|
|
|
ad56ed |
+sha1-s390x.o: sha1-s390x.S
|
|
|
ad56ed |
+sha256-s390x.o: sha256-s390x.S
|
|
|
ad56ed |
+sha512-s390x.o: sha512-s390x.S
|
|
|
ad56ed |
+
|
|
|
ad56ed |
files:
|
|
|
ad56ed |
$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
|
|
|
ad56ed |
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/s390x_arch.h.s390x-update openssl-1.0.2k/crypto/s390x_arch.h
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/s390x_arch.h.s390x-update 2018-06-18 13:27:37.110817228 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/s390x_arch.h 2018-06-18 13:27:53.066204616 +0200
|
|
|
ad56ed |
@@ -0,0 +1,93 @@
|
|
|
ad56ed |
+/*
|
|
|
ad56ed |
+ * Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
ad56ed |
+ *
|
|
|
ad56ed |
+ * Licensed under the OpenSSL license (the "License"). You may not use
|
|
|
ad56ed |
+ * this file except in compliance with the License. You can obtain a copy
|
|
|
ad56ed |
+ * in the file LICENSE in the source distribution or at
|
|
|
ad56ed |
+ * https://www.openssl.org/source/license.html
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+#ifndef S390X_ARCH_H
|
|
|
ad56ed |
+# define S390X_ARCH_H
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# ifndef __ASSEMBLER__
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+void s390x_km(const unsigned char *in, size_t len, unsigned char *out,
|
|
|
ad56ed |
+ unsigned int fc, void *param);
|
|
|
ad56ed |
+void s390x_kma(const unsigned char *aad, size_t alen, const unsigned char *in,
|
|
|
ad56ed |
+ size_t len, unsigned char *out, unsigned int fc, void *param);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/*
|
|
|
ad56ed |
+ * The field elements of OPENSSL_s390xcap_P are the 64-bit words returned by
|
|
|
ad56ed |
+ * the STFLE instruction followed by the 64-bit word pairs returned by
|
|
|
ad56ed |
+ * instructions' QUERY functions. If STFLE returns fewer data or an instruction
|
|
|
ad56ed |
+ * is not supported, the corresponding field elements are zero.
|
|
|
ad56ed |
+ */
|
|
|
ad56ed |
+struct OPENSSL_s390xcap_st {
|
|
|
ad56ed |
+ unsigned long long stfle[4];
|
|
|
ad56ed |
+ unsigned long long kimd[2];
|
|
|
ad56ed |
+ unsigned long long klmd[2];
|
|
|
ad56ed |
+ unsigned long long km[2];
|
|
|
ad56ed |
+ unsigned long long kmc[2];
|
|
|
ad56ed |
+ unsigned long long kmac[2];
|
|
|
ad56ed |
+ unsigned long long kmctr[2];
|
|
|
ad56ed |
+ unsigned long long kmo[2];
|
|
|
ad56ed |
+ unsigned long long kmf[2];
|
|
|
ad56ed |
+ unsigned long long prno[2];
|
|
|
ad56ed |
+ unsigned long long kma[2];
|
|
|
ad56ed |
+};
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* convert facility bit number or function code to bit mask */
|
|
|
ad56ed |
+# define S390X_CAPBIT(i) (1ULL << (63 - (i) % 64))
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+# endif
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* OPENSSL_s390xcap_P offsets [bytes] */
|
|
|
ad56ed |
+# define S390X_STFLE 0x00
|
|
|
ad56ed |
+# define S390X_KIMD 0x20
|
|
|
ad56ed |
+# define S390X_KLMD 0x30
|
|
|
ad56ed |
+# define S390X_KM 0x40
|
|
|
ad56ed |
+# define S390X_KMC 0x50
|
|
|
ad56ed |
+# define S390X_KMAC 0x60
|
|
|
ad56ed |
+# define S390X_KMCTR 0x70
|
|
|
ad56ed |
+# define S390X_KMO 0x80
|
|
|
ad56ed |
+# define S390X_KMF 0x90
|
|
|
ad56ed |
+# define S390X_PRNO 0xa0
|
|
|
ad56ed |
+# define S390X_KMA 0xb0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* Facility Bit Numbers */
|
|
|
ad56ed |
+# define S390X_VX 129
|
|
|
ad56ed |
+# define S390X_VXD 134
|
|
|
ad56ed |
+# define S390X_VXE 135
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* Function Codes */
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* all instructions */
|
|
|
ad56ed |
+# define S390X_QUERY 0
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* kimd/klmd */
|
|
|
ad56ed |
+# define S390X_SHA3_224 32
|
|
|
ad56ed |
+# define S390X_SHA3_256 33
|
|
|
ad56ed |
+# define S390X_SHA3_384 34
|
|
|
ad56ed |
+# define S390X_SHA3_512 35
|
|
|
ad56ed |
+# define S390X_SHAKE_128 36
|
|
|
ad56ed |
+# define S390X_SHAKE_256 37
|
|
|
ad56ed |
+# define S390X_GHASH 65
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* km/kmc/kmac/kmctr/kmo/kmf/kma */
|
|
|
ad56ed |
+# define S390X_AES_128 18
|
|
|
ad56ed |
+# define S390X_AES_192 19
|
|
|
ad56ed |
+# define S390X_AES_256 20
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* prno */
|
|
|
ad56ed |
+# define S390X_TRNG 114
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+/* Register 0 Flags */
|
|
|
ad56ed |
+# define S390X_DECRYPT 0x80
|
|
|
ad56ed |
+# define S390X_KMA_LPC 0x100
|
|
|
ad56ed |
+# define S390X_KMA_LAAD 0x200
|
|
|
ad56ed |
+# define S390X_KMA_HS 0x400
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+#endif
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/s390xcap.c.s390x-update openssl-1.0.2k/crypto/s390xcap.c
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/s390xcap.c.s390x-update 2017-01-26 14:22:03.000000000 +0100
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/s390xcap.c 2018-06-18 13:27:37.111817252 +0200
|
|
|
ad56ed |
@@ -4,8 +4,7 @@
|
|
|
ad56ed |
#include <setjmp.h>
|
|
|
ad56ed |
#include <signal.h>
|
|
|
ad56ed |
#include "cryptlib.h"
|
|
|
ad56ed |
-
|
|
|
ad56ed |
-extern unsigned long OPENSSL_s390xcap_P[];
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
|
|
|
ad56ed |
static sigjmp_buf ill_jmp;
|
|
|
ad56ed |
static void ill_handler(int sig)
|
|
|
ad56ed |
@@ -13,30 +12,48 @@ static void ill_handler(int sig)
|
|
|
ad56ed |
siglongjmp(ill_jmp, sig);
|
|
|
ad56ed |
}
|
|
|
ad56ed |
|
|
|
ad56ed |
-unsigned long OPENSSL_s390x_facilities(void);
|
|
|
ad56ed |
+void OPENSSL_s390x_facilities(void);
|
|
|
ad56ed |
+void OPENSSL_vx_probe(void);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
|
|
|
ad56ed |
|
|
|
ad56ed |
void OPENSSL_cpuid_setup(void)
|
|
|
ad56ed |
{
|
|
|
ad56ed |
sigset_t oset;
|
|
|
ad56ed |
struct sigaction ill_act, oact;
|
|
|
ad56ed |
|
|
|
ad56ed |
- if (OPENSSL_s390xcap_P[0])
|
|
|
ad56ed |
+ if (OPENSSL_s390xcap_P.stfle[0])
|
|
|
ad56ed |
return;
|
|
|
ad56ed |
|
|
|
ad56ed |
- OPENSSL_s390xcap_P[0] = 1UL << (8 * sizeof(unsigned long) - 1);
|
|
|
ad56ed |
+ /* set a bit that will not be tested later */
|
|
|
ad56ed |
+ OPENSSL_s390xcap_P.stfle[0] |= S390X_CAPBIT(0);
|
|
|
ad56ed |
|
|
|
ad56ed |
memset(&ill_act, 0, sizeof(ill_act));
|
|
|
ad56ed |
ill_act.sa_handler = ill_handler;
|
|
|
ad56ed |
sigfillset(&ill_act.sa_mask);
|
|
|
ad56ed |
sigdelset(&ill_act.sa_mask, SIGILL);
|
|
|
ad56ed |
+ sigdelset(&ill_act.sa_mask, SIGFPE);
|
|
|
ad56ed |
sigdelset(&ill_act.sa_mask, SIGTRAP);
|
|
|
ad56ed |
sigprocmask(SIG_SETMASK, &ill_act.sa_mask, &oset);
|
|
|
ad56ed |
sigaction(SIGILL, &ill_act, &oact;;
|
|
|
ad56ed |
+ sigaction(SIGFPE, &ill_act, &oact;;
|
|
|
ad56ed |
|
|
|
ad56ed |
/* protection against missing store-facility-list-extended */
|
|
|
ad56ed |
if (sigsetjmp(ill_jmp, 1) == 0)
|
|
|
ad56ed |
OPENSSL_s390x_facilities();
|
|
|
ad56ed |
|
|
|
ad56ed |
+ /* protection against disabled vector facility */
|
|
|
ad56ed |
+ if ((OPENSSL_s390xcap_P.stfle[2] & S390X_CAPBIT(S390X_VX))
|
|
|
ad56ed |
+ && (sigsetjmp(ill_jmp, 1) == 0)) {
|
|
|
ad56ed |
+ OPENSSL_vx_probe();
|
|
|
ad56ed |
+ } else {
|
|
|
ad56ed |
+ OPENSSL_s390xcap_P.stfle[2] &= ~(S390X_CAPBIT(S390X_VX)
|
|
|
ad56ed |
+ | S390X_CAPBIT(S390X_VXD)
|
|
|
ad56ed |
+ | S390X_CAPBIT(S390X_VXE));
|
|
|
ad56ed |
+ }
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ sigaction(SIGFPE, &oact, NULL);
|
|
|
ad56ed |
+
|
|
|
ad56ed |
sigaction(SIGILL, &oact, NULL);
|
|
|
ad56ed |
sigprocmask(SIG_SETMASK, &oset, NULL);
|
|
|
ad56ed |
}
|
|
|
ad56ed |
diff -up openssl-1.0.2k/crypto/s390xcpuid.pl.s390x-update openssl-1.0.2k/crypto/s390xcpuid.pl
|
|
|
ad56ed |
--- openssl-1.0.2k/crypto/s390xcpuid.pl.s390x-update 2018-06-18 13:27:53.067204641 +0200
|
|
|
ad56ed |
+++ openssl-1.0.2k/crypto/s390xcpuid.pl 2018-06-18 13:27:53.067204641 +0200
|
|
|
ad56ed |
@@ -0,0 +1,259 @@
|
|
|
ad56ed |
+#! /usr/bin/env perl
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+$flavour = shift;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+if ($flavour =~ /3[12]/) {
|
|
|
ad56ed |
+ $SIZE_T=4;
|
|
|
ad56ed |
+ $g="";
|
|
|
ad56ed |
+} else {
|
|
|
ad56ed |
+ $SIZE_T=8;
|
|
|
ad56ed |
+ $g="g";
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
|
|
|
ad56ed |
+open STDOUT,">$output";
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+$ra="%r14";
|
|
|
ad56ed |
+$sp="%r15";
|
|
|
ad56ed |
+$stdframe=16*$SIZE_T+4*8;
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+$code=<<___;
|
|
|
ad56ed |
+#include "s390x_arch.h"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.text
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_s390x_facilities
|
|
|
ad56ed |
+.type OPENSSL_s390x_facilities,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_s390x_facilities:
|
|
|
ad56ed |
+ lghi %r0,0
|
|
|
ad56ed |
+ larl %r4,OPENSSL_s390xcap_P
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ stg %r0,S390X_STFLE+8(%r4) # wipe capability vectors
|
|
|
ad56ed |
+ stg %r0,S390X_STFLE+16(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_STFLE+24(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KIMD(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KIMD+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KLMD(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KLMD+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KM(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KM+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMC(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMC+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMAC(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMAC+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMCTR(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMCTR+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMO(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMO+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMF(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMF+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_PRNO(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_PRNO+8(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMA(%r4)
|
|
|
ad56ed |
+ stg %r0,S390X_KMA+8(%r4)
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ .long 0xb2b04000 # stfle 0(%r4)
|
|
|
ad56ed |
+ brc 8,.Ldone
|
|
|
ad56ed |
+ lghi %r0,1
|
|
|
ad56ed |
+ .long 0xb2b04000 # stfle 0(%r4)
|
|
|
ad56ed |
+ brc 8,.Ldone
|
|
|
ad56ed |
+ lghi %r0,2
|
|
|
ad56ed |
+ .long 0xb2b04000 # stfle 0(%r4)
|
|
|
ad56ed |
+.Ldone:
|
|
|
ad56ed |
+ lmg %r2,%r3,S390X_STFLE(%r4)
|
|
|
ad56ed |
+ tmhl %r2,0x4000 # check for message-security-assist
|
|
|
ad56ed |
+ jz .Lret
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kimd capabilities
|
|
|
ad56ed |
+ la %r1,S390X_KIMD(%r4)
|
|
|
ad56ed |
+ .long 0xb93e0002 # kimd %r0,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query klmd capabilities
|
|
|
ad56ed |
+ la %r1,S390X_KLMD(%r4)
|
|
|
ad56ed |
+ .long 0xb93f0002 # klmd %r0,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query km capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KM(%r4)
|
|
|
ad56ed |
+ .long 0xb92e0042 # km %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kmc capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMC(%r4)
|
|
|
ad56ed |
+ .long 0xb92f0042 # kmc %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kmac capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMAC(%r4)
|
|
|
ad56ed |
+ .long 0xb91e0042 # kmac %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ tmhh %r3,0x0004 # check for message-security-assist-4
|
|
|
ad56ed |
+ jz .Lret
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kmctr capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMCTR(%r4)
|
|
|
ad56ed |
+ .long 0xb92d2042 # kmctr %r4,%r2,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kmo capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMO(%r4)
|
|
|
ad56ed |
+ .long 0xb92b0042 # kmo %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kmf capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMF(%r4)
|
|
|
ad56ed |
+ .long 0xb92a0042 # kmf %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ tml %r2,0x40 # check for message-security-assist-5
|
|
|
ad56ed |
+ jz .Lret
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query prno capability vector
|
|
|
ad56ed |
+ la %r1,S390X_PRNO(%r4)
|
|
|
ad56ed |
+ .long 0xb93c0042 # prno %r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lg %r2,S390X_STFLE+16(%r4)
|
|
|
ad56ed |
+ tmhl %r2,0x2000 # check for message-security-assist-8
|
|
|
ad56ed |
+ jz .Lret
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ lghi %r0,S390X_QUERY # query kma capability vector
|
|
|
ad56ed |
+ la %r1,S390X_KMA(%r4)
|
|
|
ad56ed |
+ .long 0xb9294022 # kma %r2,%r4,%r2
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.Lret:
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_s390x_facilities,.-OPENSSL_s390x_facilities
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_rdtsc
|
|
|
ad56ed |
+.type OPENSSL_rdtsc,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_rdtsc:
|
|
|
ad56ed |
+ stck 16($sp)
|
|
|
ad56ed |
+ lg %r2,16($sp)
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_rdtsc,.-OPENSSL_rdtsc
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_atomic_add
|
|
|
ad56ed |
+.type OPENSSL_atomic_add,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_atomic_add:
|
|
|
ad56ed |
+ l %r1,0(%r2)
|
|
|
ad56ed |
+.Lspin: lr %r0,%r1
|
|
|
ad56ed |
+ ar %r0,%r3
|
|
|
ad56ed |
+ cs %r1,%r0,0(%r2)
|
|
|
ad56ed |
+ brc 4,.Lspin
|
|
|
ad56ed |
+ lgfr %r2,%r0 # OpenSSL expects the new value
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_atomic_add,.-OPENSSL_atomic_add
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_wipe_cpu
|
|
|
ad56ed |
+.type OPENSSL_wipe_cpu,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_wipe_cpu:
|
|
|
ad56ed |
+ xgr %r0,%r0
|
|
|
ad56ed |
+ xgr %r1,%r1
|
|
|
ad56ed |
+ lgr %r2,$sp
|
|
|
ad56ed |
+ xgr %r3,%r3
|
|
|
ad56ed |
+ xgr %r4,%r4
|
|
|
ad56ed |
+ lzdr %f0
|
|
|
ad56ed |
+ lzdr %f1
|
|
|
ad56ed |
+ lzdr %f2
|
|
|
ad56ed |
+ lzdr %f3
|
|
|
ad56ed |
+ lzdr %f4
|
|
|
ad56ed |
+ lzdr %f5
|
|
|
ad56ed |
+ lzdr %f6
|
|
|
ad56ed |
+ lzdr %f7
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_wipe_cpu,.-OPENSSL_wipe_cpu
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_cleanse
|
|
|
ad56ed |
+.type OPENSSL_cleanse,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_cleanse:
|
|
|
ad56ed |
+#if !defined(__s390x__) && !defined(__s390x)
|
|
|
ad56ed |
+ llgfr %r3,%r3
|
|
|
ad56ed |
+#endif
|
|
|
ad56ed |
+ lghi %r4,15
|
|
|
ad56ed |
+ lghi %r0,0
|
|
|
ad56ed |
+ clgr %r3,%r4
|
|
|
ad56ed |
+ jh .Lot
|
|
|
ad56ed |
+ clgr %r3,%r0
|
|
|
ad56ed |
+ bcr 8,%r14
|
|
|
ad56ed |
+.Little:
|
|
|
ad56ed |
+ stc %r0,0(%r2)
|
|
|
ad56ed |
+ la %r2,1(%r2)
|
|
|
ad56ed |
+ brctg %r3,.Little
|
|
|
ad56ed |
+ br %r14
|
|
|
ad56ed |
+.align 4
|
|
|
ad56ed |
+.Lot: tmll %r2,7
|
|
|
ad56ed |
+ jz .Laligned
|
|
|
ad56ed |
+ stc %r0,0(%r2)
|
|
|
ad56ed |
+ la %r2,1(%r2)
|
|
|
ad56ed |
+ brctg %r3,.Lot
|
|
|
ad56ed |
+.Laligned:
|
|
|
ad56ed |
+ srlg %r4,%r3,3
|
|
|
ad56ed |
+.Loop: stg %r0,0(%r2)
|
|
|
ad56ed |
+ la %r2,8(%r2)
|
|
|
ad56ed |
+ brctg %r4,.Loop
|
|
|
ad56ed |
+ lghi %r4,7
|
|
|
ad56ed |
+ ngr %r3,%r4
|
|
|
ad56ed |
+ jnz .Little
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_cleanse,.-OPENSSL_cleanse
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+.globl OPENSSL_vx_probe
|
|
|
ad56ed |
+.type OPENSSL_vx_probe,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+OPENSSL_vx_probe:
|
|
|
ad56ed |
+ .word 0xe700,0x0000,0x0044 # vzero %v0
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size OPENSSL_vx_probe,.-OPENSSL_vx_probe
|
|
|
ad56ed |
+___
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+################
|
|
|
ad56ed |
+# void s390x_km(const unsigned char *in, size_t len, unsigned char *out,
|
|
|
ad56ed |
+# unsigned int fc, void *param)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+my ($in,$len,$out,$fc,$param) = map("%r$_",(2..6));
|
|
|
ad56ed |
+$code.=<<___;
|
|
|
ad56ed |
+.globl s390x_km
|
|
|
ad56ed |
+.type s390x_km,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+s390x_km:
|
|
|
ad56ed |
+ lr %r0,$fc
|
|
|
ad56ed |
+ l${g}r %r1,$param
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ .long 0xb92e0042 # km $out,$in
|
|
|
ad56ed |
+ brc 1,.-4 # pay attention to "partial completion"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size s390x_km,.-s390x_km
|
|
|
ad56ed |
+___
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+################
|
|
|
ad56ed |
+# void s390x_kma(const unsigned char *aad, size_t alen,
|
|
|
ad56ed |
+# const unsigned char *in, size_t len,
|
|
|
ad56ed |
+# unsigned char *out, unsigned int fc, void *param)
|
|
|
ad56ed |
+{
|
|
|
ad56ed |
+my ($aad,$alen,$in,$len,$out) = map("%r$_",(2..6));
|
|
|
ad56ed |
+$code.=<<___;
|
|
|
ad56ed |
+.globl s390x_kma
|
|
|
ad56ed |
+.type s390x_kma,\@function
|
|
|
ad56ed |
+.align 16
|
|
|
ad56ed |
+s390x_kma:
|
|
|
ad56ed |
+ st${g} $out,6*$SIZE_T($sp)
|
|
|
ad56ed |
+ lm${g} %r0,%r1,$stdframe($sp)
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ .long 0xb9292064 # kma $out,$aad,$in
|
|
|
ad56ed |
+ brc 1,.-4 # pay attention to "partial completion"
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+ l${g} $out,6*$SIZE_T($sp)
|
|
|
ad56ed |
+ br $ra
|
|
|
ad56ed |
+.size s390x_kma,.-s390x_kma
|
|
|
ad56ed |
+___
|
|
|
ad56ed |
+}
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+$code.=<<___;
|
|
|
ad56ed |
+.section .init
|
|
|
ad56ed |
+ brasl $ra,OPENSSL_cpuid_setup
|
|
|
ad56ed |
+___
|
|
|
ad56ed |
+
|
|
|
ad56ed |
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
|
|
ad56ed |
+print $code;
|
|
|
ad56ed |
+close STDOUT; # force flush
|