Blame SOURCES/openssl-1.0.2k-s390x-update.patch

ad56ed
diff -up openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl
ad56ed
--- openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update	2018-06-18 12:20:47.197994636 +0200
ad56ed
+++ openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl	2018-06-18 13:27:37.109817203 +0200
ad56ed
@@ -122,6 +122,8 @@ sub _data_word()
ad56ed
 }
ad56ed
 
ad56ed
 $code=<<___;
ad56ed
+#include "s390x_arch.h"
ad56ed
+
ad56ed
 .text
ad56ed
 
ad56ed
 .type	AES_Te,\@object
ad56ed
@@ -814,13 +816,10 @@ $code.=<<___ if (!$softonly);
ad56ed
 	ar	%r5,%r0
ad56ed
 
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
-	lg	%r0,0(%r1)
ad56ed
-	tmhl	%r0,0x4000	# check for message-security assist
ad56ed
-	jz	.Lekey_internal
ad56ed
-
ad56ed
 	llihh	%r0,0x8000
ad56ed
 	srlg	%r0,%r0,0(%r5)
ad56ed
-	ng	%r0,48(%r1)	# check kmc capability vector
ad56ed
+	ng	%r0,S390X_KM(%r1)  # check availability of both km...
ad56ed
+	ng	%r0,S390X_KMC(%r1) # ...and kmc support for given key length
ad56ed
 	jz	.Lekey_internal
ad56ed
 
ad56ed
 	lmg	%r0,%r1,0($inp)	# just copy 128 bits...
ad56ed
@@ -1443,7 +1442,7 @@ $code.=<<___ if (0);	######### kmctr cod
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
 	llihh	%r0,0x8000	# check if kmctr supports the function code
ad56ed
 	srlg	%r0,%r0,0($s0)
ad56ed
-	ng	%r0,64(%r1)	# check kmctr capability vector
ad56ed
+	ng	%r0,S390X_KMCTR(%r1)	# check kmctr capability vector
ad56ed
 	lgr	%r0,$s0
ad56ed
 	lgr	%r1,$s1
ad56ed
 	jz	.Lctr32_km_loop
ad56ed
@@ -1593,7 +1592,7 @@ $code.=<<___ if(1);
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
 	llihh	%r0,0x8000
ad56ed
 	srlg	%r0,%r0,32($s1)		# check for 32+function code
ad56ed
-	ng	%r0,32(%r1)		# check km capability vector
ad56ed
+	ng	%r0,S390X_KM(%r1)	# check km capability vector
ad56ed
 	lgr	%r0,$s0			# restore the function code
ad56ed
 	la	%r1,0($key1)		# restore $key1
ad56ed
 	jz	.Lxts_km_vanilla
ad56ed
@@ -2220,7 +2219,6 @@ ___
ad56ed
 }
ad56ed
 $code.=<<___;
ad56ed
 .string	"AES for s390x, CRYPTOGAMS by <appro\@openssl.org>"
ad56ed
-.comm	OPENSSL_s390xcap_P,80,8
ad56ed
 ___
ad56ed
 
ad56ed
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
ad56ed
diff -up openssl-1.0.2k/crypto/aes/Makefile.s390x-update openssl-1.0.2k/crypto/aes/Makefile
ad56ed
--- openssl-1.0.2k/crypto/aes/Makefile.s390x-update	2017-01-26 14:22:03.000000000 +0100
ad56ed
+++ openssl-1.0.2k/crypto/aes/Makefile	2018-06-18 13:27:37.108817179 +0200
ad56ed
@@ -92,6 +92,8 @@ aesv8-armx.S:	asm/aesv8-armx.pl
ad56ed
 	$(PERL) asm/aesv8-armx.pl $(PERLASM_SCHEME) $@
ad56ed
 aesv8-armx.o:	aesv8-armx.S
ad56ed
 
ad56ed
+aes-s390x.o:	aes-s390x.S
ad56ed
+
ad56ed
 # GNU make "catch all"
ad56ed
 aes-%.S:	asm/aes-%.pl;	$(PERL) $< $(PERLASM_SCHEME) > $@
ad56ed
 aes-armv4.o:	aes-armv4.S
ad56ed
diff -up openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update openssl-1.0.2k/crypto/evp/e_aes.c
ad56ed
--- openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update	2018-06-18 12:20:47.104992361 +0200
ad56ed
+++ openssl-1.0.2k/crypto/evp/e_aes.c	2018-06-18 13:28:07.033543735 +0200
ad56ed
@@ -854,6 +854,723 @@ static const EVP_CIPHER aes_##keylen##_#
ad56ed
 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
ad56ed
 { return SPARC_AES_CAPABLE?&aes_t4_##keylen##_##mode:&aes_##keylen##_##mode; }
ad56ed
 
ad56ed
+#elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__)
ad56ed
+/*
ad56ed
+ * IBM S390X support
ad56ed
+ */
ad56ed
+# include "s390x_arch.h"
ad56ed
+
ad56ed
+typedef struct {
ad56ed
+    union {
ad56ed
+        double align;
ad56ed
+        /*-
ad56ed
+         * KMA-GCM-AES parameter block
ad56ed
+         * (see z/Architecture Principles of Operation SA22-7832-11)
ad56ed
+         */
ad56ed
+        struct {
ad56ed
+            unsigned char reserved[12];
ad56ed
+            union {
ad56ed
+                unsigned int w;
ad56ed
+                unsigned char b[4];
ad56ed
+            } cv;
ad56ed
+            union {
ad56ed
+                unsigned long long g[2];
ad56ed
+                unsigned char b[16];
ad56ed
+            } t;
ad56ed
+            unsigned char h[16];
ad56ed
+            unsigned long long taadl;
ad56ed
+            unsigned long long tpcl;
ad56ed
+            union {
ad56ed
+                unsigned long long g[2];
ad56ed
+                unsigned int w[4];
ad56ed
+            } j0;
ad56ed
+            unsigned char k[32];
ad56ed
+        } param;
ad56ed
+    } kma;
ad56ed
+    unsigned int fc;
ad56ed
+    int key_set;
ad56ed
+
ad56ed
+    unsigned char *iv;
ad56ed
+    int ivlen;
ad56ed
+    int iv_set;
ad56ed
+    int iv_gen;
ad56ed
+
ad56ed
+    int taglen;
ad56ed
+
ad56ed
+    unsigned char ares[16];
ad56ed
+    unsigned char mres[16];
ad56ed
+    unsigned char kres[16];
ad56ed
+    int areslen;
ad56ed
+    int mreslen;
ad56ed
+    int kreslen;
ad56ed
+
ad56ed
+    int tls_aad_len;
ad56ed
+} S390X_AES_GCM_CTX;
ad56ed
+
ad56ed
+# define S390X_aes_128_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_128)) &&\
ad56ed
+                                (OPENSSL_s390xcap_P.kmc[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_128)))
ad56ed
+# define S390X_aes_192_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_192)) &&\
ad56ed
+                                (OPENSSL_s390xcap_P.kmc[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_192)))
ad56ed
+# define S390X_aes_256_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_256)) &&\
ad56ed
+                                (OPENSSL_s390xcap_P.kmc[0] &	\
ad56ed
+                                 S390X_CAPBIT(S390X_AES_256)))
ad56ed
+
ad56ed
+# define s390x_aes_init_key aes_init_key
ad56ed
+static int s390x_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
ad56ed
+                              const unsigned char *iv, int enc);
ad56ed
+
ad56ed
+# define S390X_aes_128_cbc_CAPABLE	1	/* checked by callee */
ad56ed
+# define S390X_aes_192_cbc_CAPABLE	1
ad56ed
+# define S390X_aes_256_cbc_CAPABLE	1
ad56ed
+
ad56ed
+# define s390x_aes_cbc_cipher aes_cbc_cipher
ad56ed
+static int s390x_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_ecb_CAPABLE	0
ad56ed
+# define S390X_aes_192_ecb_CAPABLE	0
ad56ed
+# define S390X_aes_256_ecb_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_ecb_cipher aes_ecb_cipher
ad56ed
+static int s390x_aes_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_ofb_CAPABLE	0
ad56ed
+# define S390X_aes_192_ofb_CAPABLE	0
ad56ed
+# define S390X_aes_256_ofb_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_ofb_cipher aes_ofb_cipher
ad56ed
+static int s390x_aes_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_cfb_CAPABLE	0
ad56ed
+# define S390X_aes_192_cfb_CAPABLE	0
ad56ed
+# define S390X_aes_256_cfb_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_cfb_cipher aes_cfb_cipher
ad56ed
+static int s390x_aes_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_cfb8_CAPABLE	0
ad56ed
+# define S390X_aes_192_cfb8_CAPABLE	0
ad56ed
+# define S390X_aes_256_cfb8_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_cfb8_cipher aes_cfb8_cipher
ad56ed
+static int s390x_aes_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                 const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_cfb1_CAPABLE	0
ad56ed
+# define S390X_aes_192_cfb1_CAPABLE	0
ad56ed
+# define S390X_aes_256_cfb1_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_cfb1_cipher aes_cfb1_cipher
ad56ed
+static int s390x_aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                 const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_ctr_CAPABLE	1	/* checked by callee */
ad56ed
+# define S390X_aes_192_ctr_CAPABLE	1
ad56ed
+# define S390X_aes_256_ctr_CAPABLE	1
ad56ed
+
ad56ed
+# define s390x_aes_ctr_cipher aes_ctr_cipher
ad56ed
+static int s390x_aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+
ad56ed
+# define S390X_aes_128_gcm_CAPABLE (S390X_aes_128_CAPABLE &&		\
ad56ed
+                                    (OPENSSL_s390xcap_P.kma[0] &	\
ad56ed
+                                     S390X_CAPBIT(S390X_AES_128)))
ad56ed
+# define S390X_aes_192_gcm_CAPABLE (S390X_aes_192_CAPABLE &&		\
ad56ed
+                                    (OPENSSL_s390xcap_P.kma[0] &	\
ad56ed
+                                     S390X_CAPBIT(S390X_AES_192)))
ad56ed
+# define S390X_aes_256_gcm_CAPABLE (S390X_aes_256_CAPABLE &&		\
ad56ed
+                                    (OPENSSL_s390xcap_P.kma[0] &	\
ad56ed
+                                     S390X_CAPBIT(S390X_AES_256)))
ad56ed
+
ad56ed
+/* iv + padding length for iv lenghts != 12 */
ad56ed
+# define S390X_gcm_ivpadlen(i)	((((i) + 15) >> 4 << 4) + 16)
ad56ed
+
ad56ed
+static int s390x_aes_gcm_aad(S390X_AES_GCM_CTX *ctx, const unsigned char *aad,
ad56ed
+                             size_t len)
ad56ed
+{
ad56ed
+    unsigned long long alen;
ad56ed
+    int n, rem;
ad56ed
+
ad56ed
+    if (ctx->kma.param.tpcl)
ad56ed
+        return -2;
ad56ed
+
ad56ed
+    alen = ctx->kma.param.taadl + len;
ad56ed
+    if (alen > (U64(1) << 61) || (sizeof(len) == 8 && alen < len))
ad56ed
+        return -1;
ad56ed
+    ctx->kma.param.taadl = alen;
ad56ed
+
ad56ed
+    n = ctx->areslen;
ad56ed
+    if (n) {
ad56ed
+        while (n && len) {
ad56ed
+            ctx->ares[n] = *aad;
ad56ed
+            n = (n + 1) & 0xf;
ad56ed
+            ++aad;
ad56ed
+            --len;
ad56ed
+        }
ad56ed
+        /* ctx->ares contains a complete block if offset has wrapped around */
ad56ed
+        if (!n) {
ad56ed
+            s390x_kma(ctx->ares, 16, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
ad56ed
+            ctx->fc |= S390X_KMA_HS;
ad56ed
+        }
ad56ed
+        ctx->areslen = n;
ad56ed
+    }
ad56ed
+
ad56ed
+    rem = len & 0xf;
ad56ed
+
ad56ed
+    len &= ~0xf;
ad56ed
+    if (len) {
ad56ed
+        s390x_kma(aad, len, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
ad56ed
+        aad += len;
ad56ed
+        ctx->fc |= S390X_KMA_HS;
ad56ed
+    }
ad56ed
+
ad56ed
+    if (rem) {
ad56ed
+        ctx->areslen = rem;
ad56ed
+
ad56ed
+        do {
ad56ed
+            --rem;
ad56ed
+            ctx->ares[rem] = aad[rem];
ad56ed
+        } while (rem);
ad56ed
+    }
ad56ed
+    return 0;
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm(S390X_AES_GCM_CTX *ctx, const unsigned char *in,
ad56ed
+                         unsigned char *out, size_t len)
ad56ed
+{
ad56ed
+    const unsigned char *inptr;
ad56ed
+    unsigned long long mlen;
ad56ed
+    union {
ad56ed
+        unsigned int w[4];
ad56ed
+        unsigned char b[16];
ad56ed
+    } buf;
ad56ed
+    size_t inlen;
ad56ed
+    int n, rem, i;
ad56ed
+
ad56ed
+    mlen = ctx->kma.param.tpcl + len;
ad56ed
+    if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))
ad56ed
+        return -1;
ad56ed
+    ctx->kma.param.tpcl = mlen;
ad56ed
+
ad56ed
+    n = ctx->mreslen;
ad56ed
+    if (n) {
ad56ed
+        inptr = in;
ad56ed
+        inlen = len;
ad56ed
+        while (n && inlen) {
ad56ed
+            ctx->mres[n] = *inptr;
ad56ed
+            n = (n + 1) & 0xf;
ad56ed
+            ++inptr;
ad56ed
+            --inlen;
ad56ed
+        }
ad56ed
+        /* ctx->mres contains a complete block if offset has wrapped around */
ad56ed
+        if (!n) {
ad56ed
+            s390x_kma(ctx->ares, ctx->areslen, ctx->mres, 16, buf.b,
ad56ed
+                      ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
ad56ed
+            ctx->fc |= S390X_KMA_HS;
ad56ed
+            ctx->areslen = 0;
ad56ed
+
ad56ed
+            /* previous call already encrypted/decrypted its remainder,
ad56ed
+             * see comment below */
ad56ed
+            n = ctx->mreslen;
ad56ed
+            while (n) {
ad56ed
+                *out = buf.b[n];
ad56ed
+                n = (n + 1) & 0xf;
ad56ed
+                ++out;
ad56ed
+                ++in;
ad56ed
+                --len;
ad56ed
+            }
ad56ed
+            ctx->mreslen = 0;
ad56ed
+        }
ad56ed
+    }
ad56ed
+
ad56ed
+    rem = len & 0xf;
ad56ed
+
ad56ed
+    len &= ~0xf;
ad56ed
+    if (len) {
ad56ed
+        s390x_kma(ctx->ares, ctx->areslen, in, len, out,
ad56ed
+                  ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
ad56ed
+        in += len;
ad56ed
+        out += len;
ad56ed
+        ctx->fc |= S390X_KMA_HS;
ad56ed
+        ctx->areslen = 0;
ad56ed
+    }
ad56ed
+
ad56ed
+    /*-
ad56ed
+     * If there is a remainder, it has to be saved such that it can be
ad56ed
+     * processed by kma later. However, we also have to do the for-now
ad56ed
+     * unauthenticated encryption/decryption part here and now...
ad56ed
+     */
ad56ed
+    if (rem) {
ad56ed
+        if (!ctx->mreslen) {
ad56ed
+            buf.w[0] = ctx->kma.param.j0.w[0];
ad56ed
+            buf.w[1] = ctx->kma.param.j0.w[1];
ad56ed
+            buf.w[2] = ctx->kma.param.j0.w[2];
ad56ed
+            buf.w[3] = ctx->kma.param.cv.w + 1;
ad56ed
+            s390x_km(buf.b, 16, ctx->kres, ctx->fc & 0x1f, &ctx->kma.param.k);
ad56ed
+        }
ad56ed
+
ad56ed
+        n = ctx->mreslen;
ad56ed
+        for (i = 0; i < rem; i++) {
ad56ed
+            ctx->mres[n + i] = in[i];
ad56ed
+            out[i] = in[i] ^ ctx->kres[n + i];
ad56ed
+        }
ad56ed
+
ad56ed
+        ctx->mreslen += rem;
ad56ed
+    }
ad56ed
+    return 0;
ad56ed
+}
ad56ed
+
ad56ed
+static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx,
ad56ed
+                                const unsigned char *iv)
ad56ed
+{
ad56ed
+    ctx->kma.param.t.g[0] = 0;
ad56ed
+    ctx->kma.param.t.g[1] = 0;
ad56ed
+    ctx->kma.param.tpcl = 0;
ad56ed
+    ctx->kma.param.taadl = 0;
ad56ed
+    ctx->mreslen = 0;
ad56ed
+    ctx->areslen = 0;
ad56ed
+    ctx->kreslen = 0;
ad56ed
+
ad56ed
+    if (ctx->ivlen == 12) {
ad56ed
+        memcpy(&ctx->kma.param.j0, iv, ctx->ivlen);
ad56ed
+        ctx->kma.param.j0.w[3] = 1;
ad56ed
+        ctx->kma.param.cv.w = 1;
ad56ed
+    } else {
ad56ed
+        /* ctx->iv has the right size and is already padded. */
ad56ed
+        memcpy(ctx->iv, iv, ctx->ivlen);
ad56ed
+        s390x_kma(ctx->iv, S390X_gcm_ivpadlen(ctx->ivlen), NULL, 0, NULL,
ad56ed
+                  ctx->fc, &ctx->kma.param);
ad56ed
+        ctx->fc |= S390X_KMA_HS;
ad56ed
+
ad56ed
+        ctx->kma.param.j0.g[0] = ctx->kma.param.t.g[0];
ad56ed
+        ctx->kma.param.j0.g[1] = ctx->kma.param.t.g[1];
ad56ed
+        ctx->kma.param.cv.w = ctx->kma.param.j0.w[3];
ad56ed
+        ctx->kma.param.t.g[0] = 0;
ad56ed
+        ctx->kma.param.t.g[1] = 0;
ad56ed
+    }
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
ad56ed
+{
ad56ed
+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
ad56ed
+    S390X_AES_GCM_CTX *gctx_out;
ad56ed
+    EVP_CIPHER_CTX *out;
ad56ed
+    unsigned char *buf, *iv;
ad56ed
+    int ivlen, enc, len;
ad56ed
+
ad56ed
+    switch (type) {
ad56ed
+    case EVP_CTRL_INIT:
ad56ed
+        ivlen = c->cipher->iv_len;;
ad56ed
+        iv = c->iv;
ad56ed
+        gctx->key_set = 0;
ad56ed
+        gctx->iv_set = 0;
ad56ed
+        gctx->ivlen = ivlen;
ad56ed
+        gctx->iv = iv;
ad56ed
+        gctx->taglen = -1;
ad56ed
+        gctx->iv_gen = 0;
ad56ed
+        gctx->tls_aad_len = -1;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_SET_IVLEN:
ad56ed
+        if (arg <= 0)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        if (arg != 12) {
ad56ed
+            iv = c->iv;
ad56ed
+            len = S390X_gcm_ivpadlen(arg);
ad56ed
+
ad56ed
+            /* Allocate memory for iv if needed. */
ad56ed
+            if (gctx->ivlen == 12 || len > S390X_gcm_ivpadlen(gctx->ivlen)) {
ad56ed
+                if (gctx->iv != iv)
ad56ed
+                    OPENSSL_free(gctx->iv);
ad56ed
+
ad56ed
+                gctx->iv = OPENSSL_malloc(len);
ad56ed
+                if (gctx->iv == NULL)
ad56ed
+                    return 0;
ad56ed
+            }
ad56ed
+            /* Add padding. */
ad56ed
+            memset(gctx->iv + arg, 0, len - arg - 8);
ad56ed
+            *((unsigned long long *)(gctx->iv + len - 8)) = arg << 3;
ad56ed
+        }
ad56ed
+        gctx->ivlen = arg;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_SET_TAG:
ad56ed
+        buf = c->buf;
ad56ed
+        enc = c->encrypt;
ad56ed
+        if (arg <= 0 || arg > 16 || enc)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        memcpy(buf, ptr, arg);
ad56ed
+        gctx->taglen = arg;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_GET_TAG:
ad56ed
+        enc = c->encrypt;
ad56ed
+        if (arg <= 0 || arg > 16 || !enc || gctx->taglen < 0)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        memcpy(ptr, gctx->kma.param.t.b, arg);
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_SET_IV_FIXED:
ad56ed
+        /* Special case: -1 length restores whole iv */
ad56ed
+        if (arg == -1) {
ad56ed
+            memcpy(gctx->iv, ptr, gctx->ivlen);
ad56ed
+            gctx->iv_gen = 1;
ad56ed
+            return 1;
ad56ed
+        }
ad56ed
+        /*
ad56ed
+         * Fixed field must be at least 4 bytes and invocation field at least
ad56ed
+         * 8.
ad56ed
+         */
ad56ed
+        if ((arg < 4) || (gctx->ivlen - arg) < 8)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        if (arg)
ad56ed
+            memcpy(gctx->iv, ptr, arg);
ad56ed
+
ad56ed
+        enc = c->encrypt;
ad56ed
+        if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        gctx->iv_gen = 1;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_IV_GEN:
ad56ed
+        if (gctx->iv_gen == 0 || gctx->key_set == 0)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        s390x_aes_gcm_setiv(gctx, gctx->iv);
ad56ed
+
ad56ed
+        if (arg <= 0 || arg > gctx->ivlen)
ad56ed
+            arg = gctx->ivlen;
ad56ed
+
ad56ed
+        memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
ad56ed
+        /*
ad56ed
+         * Invocation field will be at least 8 bytes in size and so no need
ad56ed
+         * to check wrap around or increment more than last 8 bytes.
ad56ed
+         */
ad56ed
+        (*(unsigned long long *)(gctx->iv + gctx->ivlen - 8))++;
ad56ed
+        gctx->iv_set = 1;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_GCM_SET_IV_INV:
ad56ed
+        enc = c->encrypt;
ad56ed
+        if (gctx->iv_gen == 0 || gctx->key_set == 0 || enc)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
ad56ed
+        s390x_aes_gcm_setiv(gctx, gctx->iv);
ad56ed
+        gctx->iv_set = 1;
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    case EVP_CTRL_AEAD_TLS1_AAD:
ad56ed
+        /* Save the aad for later use. */
ad56ed
+        if (arg != EVP_AEAD_TLS1_AAD_LEN)
ad56ed
+            return 0;
ad56ed
+
ad56ed
+        buf = c->buf;
ad56ed
+        memcpy(buf, ptr, arg);
ad56ed
+        gctx->tls_aad_len = arg;
ad56ed
+
ad56ed
+        len = buf[arg - 2] << 8 | buf[arg - 1];
ad56ed
+        /* Correct length for explicit iv. */
ad56ed
+        if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
ad56ed
+            return 0;
ad56ed
+        len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
ad56ed
+
ad56ed
+        /* If decrypting correct for tag too. */
ad56ed
+        enc = c->encrypt;
ad56ed
+        if (!enc) {
ad56ed
+            if (len < EVP_GCM_TLS_TAG_LEN)
ad56ed
+                return 0;
ad56ed
+            len -= EVP_GCM_TLS_TAG_LEN;
ad56ed
+        }
ad56ed
+        buf[arg - 2] = len >> 8;
ad56ed
+        buf[arg - 1] = len & 0xff;
ad56ed
+        /* Extra padding: tag appended to record. */
ad56ed
+        return EVP_GCM_TLS_TAG_LEN;
ad56ed
+
ad56ed
+    case EVP_CTRL_COPY:
ad56ed
+        out = ptr;
ad56ed
+        gctx_out = EVP_C_DATA(S390X_AES_GCM_CTX, out);
ad56ed
+        iv = c->iv;
ad56ed
+
ad56ed
+        if (gctx->iv == iv) {
ad56ed
+            gctx_out->iv = out->iv;
ad56ed
+        } else {
ad56ed
+            len = S390X_gcm_ivpadlen(gctx->ivlen);
ad56ed
+
ad56ed
+            gctx_out->iv = OPENSSL_malloc(len);
ad56ed
+            if (gctx_out->iv == NULL)
ad56ed
+                return 0;
ad56ed
+
ad56ed
+            memcpy(gctx_out->iv, gctx->iv, len);
ad56ed
+        }
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    default:
ad56ed
+        return -1;
ad56ed
+    }
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm_init_key(EVP_CIPHER_CTX *ctx,
ad56ed
+                                  const unsigned char *key,
ad56ed
+                                  const unsigned char *iv, int enc)
ad56ed
+{
ad56ed
+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
ad56ed
+    int keylen;
ad56ed
+
ad56ed
+    if (iv == NULL && key == NULL)
ad56ed
+        return 1;
ad56ed
+
ad56ed
+    if (key != NULL) {
ad56ed
+        keylen = EVP_CIPHER_CTX_key_length(ctx);
ad56ed
+        memcpy(&gctx->kma.param.k, key, keylen);
ad56ed
+
ad56ed
+        /* Convert key size to function code. */
ad56ed
+        gctx->fc = S390X_AES_128 + (((keylen << 3) - 128) >> 6);
ad56ed
+        if (!enc)
ad56ed
+            gctx->fc |= S390X_DECRYPT;
ad56ed
+
ad56ed
+        if (iv == NULL && gctx->iv_set)
ad56ed
+            iv = gctx->iv;
ad56ed
+
ad56ed
+        if (iv != NULL) {
ad56ed
+            s390x_aes_gcm_setiv(gctx, iv);
ad56ed
+            gctx->iv_set = 1;
ad56ed
+        }
ad56ed
+        gctx->key_set = 1;
ad56ed
+    } else {
ad56ed
+        if (gctx->key_set)
ad56ed
+            s390x_aes_gcm_setiv(gctx, iv);
ad56ed
+        else
ad56ed
+            memcpy(gctx->iv, iv, gctx->ivlen);
ad56ed
+
ad56ed
+        gctx->iv_set = 1;
ad56ed
+        gctx->iv_gen = 0;
ad56ed
+    }
ad56ed
+    return 1;
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                    const unsigned char *in, size_t len)
ad56ed
+{
ad56ed
+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
ad56ed
+    const unsigned char *buf = ctx->buf;
ad56ed
+    const int enc = ctx->encrypt;
ad56ed
+    int rv = -1;
ad56ed
+
ad56ed
+    if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
ad56ed
+        return -1;
ad56ed
+
ad56ed
+    if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN
ad56ed
+                                     : EVP_CTRL_GCM_SET_IV_INV,
ad56ed
+                            EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
ad56ed
+        goto err;
ad56ed
+
ad56ed
+    in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
ad56ed
+    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
ad56ed
+    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
ad56ed
+
ad56ed
+    gctx->kma.param.taadl = gctx->tls_aad_len << 3;
ad56ed
+    gctx->kma.param.tpcl = len << 3;
ad56ed
+    s390x_kma(buf, gctx->tls_aad_len, in, len, out,
ad56ed
+              gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
ad56ed
+
ad56ed
+    if (enc) {
ad56ed
+        memcpy(out + len, gctx->kma.param.t.b, EVP_GCM_TLS_TAG_LEN);
ad56ed
+        rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
ad56ed
+    } else {
ad56ed
+        if (CRYPTO_memcmp(gctx->kma.param.t.b, in + len,
ad56ed
+                          EVP_GCM_TLS_TAG_LEN)) {
ad56ed
+            OPENSSL_cleanse(out, len);
ad56ed
+            goto err;
ad56ed
+        }
ad56ed
+        rv = len;
ad56ed
+    }
ad56ed
+err:
ad56ed
+    gctx->iv_set = 0;
ad56ed
+    gctx->tls_aad_len = -1;
ad56ed
+    return rv;
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len)
ad56ed
+{
ad56ed
+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
ad56ed
+    unsigned char *buf, tmp[16];
ad56ed
+    int enc;
ad56ed
+
ad56ed
+    if (!gctx->key_set)
ad56ed
+        return -1;
ad56ed
+
ad56ed
+    if (gctx->tls_aad_len >= 0)
ad56ed
+        return s390x_aes_gcm_tls_cipher(ctx, out, in, len);
ad56ed
+
ad56ed
+    if (!gctx->iv_set)
ad56ed
+        return -1;
ad56ed
+
ad56ed
+    if (in != NULL) {
ad56ed
+        if (out == NULL) {
ad56ed
+            if (s390x_aes_gcm_aad(gctx, in, len))
ad56ed
+                return -1;
ad56ed
+        } else {
ad56ed
+            if (s390x_aes_gcm(gctx, in, out, len))
ad56ed
+                return -1;
ad56ed
+        }
ad56ed
+        return len;
ad56ed
+    } else {
ad56ed
+        gctx->kma.param.taadl <<= 3;
ad56ed
+        gctx->kma.param.tpcl <<= 3;
ad56ed
+        s390x_kma(gctx->ares, gctx->areslen, gctx->mres, gctx->mreslen, tmp,
ad56ed
+                  gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
ad56ed
+        /* recall that we already did en-/decrypt gctx->mres
ad56ed
+         * and returned it to caller... */
ad56ed
+        OPENSSL_cleanse(tmp, gctx->mreslen);
ad56ed
+        gctx->iv_set = 0;
ad56ed
+
ad56ed
+        enc = ctx->encrypt;
ad56ed
+        if (enc) {
ad56ed
+            gctx->taglen = 16;
ad56ed
+        } else {
ad56ed
+            if (gctx->taglen < 0)
ad56ed
+                return -1;
ad56ed
+
ad56ed
+            buf = ctx->buf;
ad56ed
+            if (CRYPTO_memcmp(buf, gctx->kma.param.t.b, gctx->taglen))
ad56ed
+                return -1;
ad56ed
+        }
ad56ed
+        return 0;
ad56ed
+    }
ad56ed
+}
ad56ed
+
ad56ed
+static int s390x_aes_gcm_cleanup(EVP_CIPHER_CTX *c)
ad56ed
+{
ad56ed
+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
ad56ed
+    const unsigned char *iv;
ad56ed
+
ad56ed
+    if (gctx == NULL)
ad56ed
+        return 0;
ad56ed
+
ad56ed
+    iv = c->iv;
ad56ed
+    if (iv != gctx->iv)
ad56ed
+        OPENSSL_free(gctx->iv);
ad56ed
+
ad56ed
+    OPENSSL_cleanse(gctx, sizeof(*gctx));
ad56ed
+    return 1;
ad56ed
+}
ad56ed
+
ad56ed
+# define S390X_AES_XTS_CTX		EVP_AES_XTS_CTX
ad56ed
+# define S390X_aes_128_xts_CAPABLE	1	/* checked by callee */
ad56ed
+# define S390X_aes_256_xts_CAPABLE	1
ad56ed
+
ad56ed
+# define s390x_aes_xts_init_key aes_xts_init_key
ad56ed
+static int s390x_aes_xts_init_key(EVP_CIPHER_CTX *ctx,
ad56ed
+                                  const unsigned char *key,
ad56ed
+                                  const unsigned char *iv, int enc);
ad56ed
+# define s390x_aes_xts_cipher aes_xts_cipher
ad56ed
+static int s390x_aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+# define s390x_aes_xts_ctrl aes_xts_ctrl
ad56ed
+static int s390x_aes_xts_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
ad56ed
+# define s390x_aes_xts_cleanup aes_xts_cleanup
ad56ed
+
ad56ed
+# define S390X_AES_CCM_CTX		EVP_AES_CCM_CTX
ad56ed
+# define S390X_aes_128_ccm_CAPABLE	0
ad56ed
+# define S390X_aes_192_ccm_CAPABLE	0
ad56ed
+# define S390X_aes_256_ccm_CAPABLE	0
ad56ed
+
ad56ed
+# define s390x_aes_ccm_init_key aes_ccm_init_key
ad56ed
+static int s390x_aes_ccm_init_key(EVP_CIPHER_CTX *ctx,
ad56ed
+                                  const unsigned char *key,
ad56ed
+                                  const unsigned char *iv, int enc);
ad56ed
+# define s390x_aes_ccm_cipher aes_ccm_cipher
ad56ed
+static int s390x_aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
ad56ed
+                                const unsigned char *in, size_t len);
ad56ed
+# define s390x_aes_ccm_ctrl aes_ccm_ctrl
ad56ed
+static int s390x_aes_ccm_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
ad56ed
+# define s390x_aes_ccm_cleanup aes_ccm_cleanup
ad56ed
+
ad56ed
+# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,	\
ad56ed
+                              MODE,flags)				\
ad56ed
+static const EVP_CIPHER s390x_aes_##keylen##_##mode = {			\
ad56ed
+    nid##_##keylen##_##nmode,blocksize,					\
ad56ed
+    keylen / 8,								\
ad56ed
+    ivlen,								\
ad56ed
+    flags | EVP_CIPH_##MODE##_MODE,					\
ad56ed
+    s390x_aes_init_key,							\
ad56ed
+    s390x_aes_##mode##_cipher,						\
ad56ed
+    NULL,								\
ad56ed
+    sizeof(EVP_AES_KEY),						\
ad56ed
+    NULL,								\
ad56ed
+    NULL,								\
ad56ed
+    NULL,								\
ad56ed
+    NULL								\
ad56ed
+};									\
ad56ed
+static const EVP_CIPHER aes_##keylen##_##mode = {			\
ad56ed
+    nid##_##keylen##_##nmode,						\
ad56ed
+    blocksize,								\
ad56ed
+    keylen / 8,								\
ad56ed
+    ivlen,								\
ad56ed
+    flags | EVP_CIPH_##MODE##_MODE,					\
ad56ed
+    aes_init_key,							\
ad56ed
+    aes_##mode##_cipher,						\
ad56ed
+    NULL,								\
ad56ed
+    sizeof(EVP_AES_KEY),						\
ad56ed
+    NULL,NULL,NULL,NULL							\
ad56ed
+};									\
ad56ed
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void)			\
ad56ed
+{									\
ad56ed
+    return S390X_aes_##keylen##_##mode##_CAPABLE ?			\
ad56ed
+           &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode;	\
ad56ed
+}
ad56ed
+
ad56ed
+# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags)\
ad56ed
+static const EVP_CIPHER s390x_aes_##keylen##_##mode = {			\
ad56ed
+    nid##_##keylen##_##mode,						\
ad56ed
+    blocksize,								\
ad56ed
+    (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8,	\
ad56ed
+    ivlen,								\
ad56ed
+    flags | EVP_CIPH_##MODE##_MODE,					\
ad56ed
+    s390x_aes_##mode##_init_key,					\
ad56ed
+    s390x_aes_##mode##_cipher,						\
ad56ed
+    s390x_aes_##mode##_cleanup,						\
ad56ed
+    sizeof(S390X_AES_##MODE##_CTX),					\
ad56ed
+    NULL,								\
ad56ed
+    NULL,								\
ad56ed
+    s390x_aes_##mode##_ctrl,						\
ad56ed
+    NULL								\
ad56ed
+};									\
ad56ed
+static const EVP_CIPHER aes_##keylen##_##mode = {			\
ad56ed
+    nid##_##keylen##_##mode,blocksize,					\
ad56ed
+    (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8,	\
ad56ed
+    ivlen,								\
ad56ed
+    flags | EVP_CIPH_##MODE##_MODE,					\
ad56ed
+    aes_##mode##_init_key,						\
ad56ed
+    aes_##mode##_cipher,						\
ad56ed
+    aes_##mode##_cleanup,						\
ad56ed
+    sizeof(EVP_AES_##MODE##_CTX),					\
ad56ed
+    NULL,								\
ad56ed
+    NULL,								\
ad56ed
+    aes_##mode##_ctrl,							\
ad56ed
+    NULL								\
ad56ed
+};									\
ad56ed
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void)			\
ad56ed
+{									\
ad56ed
+    return S390X_aes_##keylen##_##mode##_CAPABLE ?			\
ad56ed
+           &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode;	\
ad56ed
+}
ad56ed
+
ad56ed
 # else
ad56ed
 
ad56ed
 #  define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
ad56ed
diff -up openssl-1.0.2k/crypto/Makefile.s390x-update openssl-1.0.2k/crypto/Makefile
ad56ed
--- openssl-1.0.2k/crypto/Makefile.s390x-update	2018-06-18 12:20:49.079040659 +0200
ad56ed
+++ openssl-1.0.2k/crypto/Makefile	2018-06-18 13:27:53.065204592 +0200
ad56ed
@@ -77,6 +77,7 @@ alphacpuid.s:	alphacpuid.pl
ad56ed
 	(preproc=$$$$.$@.S; trap "rm $$preproc" INT; \
ad56ed
 	$(PERL) alphacpuid.pl > $$preproc && \
ad56ed
 	$(CC) -E -P $$preproc > $@ && rm $$preproc)
ad56ed
+s390xcpuid.S:	s390xcpuid.pl;	$(PERL) s390xcpuid.pl $(PERLASM_SCHEME) $@
ad56ed
 
ad56ed
 testapps:
ad56ed
 	[ -z "$(THIS)" ] || (	if echo $(SDIRS) | fgrep ' des '; \
ad56ed
diff -up openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl.s390x-update openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl
ad56ed
--- openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl.s390x-update	2018-06-18 12:20:47.170993976 +0200
ad56ed
+++ openssl-1.0.2k/crypto/modes/asm/ghash-s390x.pl	2018-06-18 13:27:37.110817228 +0200
ad56ed
@@ -73,6 +73,8 @@ $rem_4bit="%r14";
ad56ed
 $sp="%r15";
ad56ed
 
ad56ed
 $code.=<<___;
ad56ed
+#include "s390x_arch.h"
ad56ed
+
ad56ed
 .text
ad56ed
 
ad56ed
 .globl	gcm_gmult_4bit
ad56ed
@@ -85,12 +87,13 @@ $code.=<<___ if(!$softonly && 0);	# hard
ad56ed
 	tmhl	%r0,0x4000	# check for message-security-assist
ad56ed
 	jz	.Lsoft_gmult
ad56ed
 	lghi	%r0,0
ad56ed
-	lg	%r1,24(%r1)	# load second word of kimd capabilities vector
ad56ed
+	lg	%r1,S390X_KIMD+8(%r1)	# load second word of kimd capabilities
ad56ed
+					#  vector
ad56ed
 	tmhh	%r1,0x4000	# check for function 65
ad56ed
 	jz	.Lsoft_gmult
ad56ed
 	stg	%r0,16($sp)	# arrange 16 bytes of zero input
ad56ed
 	stg	%r0,24($sp)
ad56ed
-	lghi	%r0,65		# function 65
ad56ed
+	lghi	%r0,S390X_GHASH	# function 65
ad56ed
 	la	%r1,0($Xi)	# H lies right after Xi in gcm128_context
ad56ed
 	la	$inp,16($sp)
ad56ed
 	lghi	$len,16
ad56ed
@@ -119,16 +122,11 @@ gcm_ghash_4bit:
ad56ed
 ___
ad56ed
 $code.=<<___ if(!$softonly);
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
-	lg	%r0,0(%r1)
ad56ed
-	tmhl	%r0,0x4000	# check for message-security-assist
ad56ed
-	jz	.Lsoft_ghash
ad56ed
-	lghi	%r0,0
ad56ed
-	la	%r1,16($sp)
ad56ed
-	.long	0xb93e0004	# kimd %r0,%r4
ad56ed
-	lg	%r1,24($sp)
ad56ed
-	tmhh	%r1,0x4000	# check for function 65
ad56ed
+	lg	%r0,S390X_KIMD+8(%r1)	# load second word of kimd capabilities
ad56ed
+					#  vector
ad56ed
+	tmhh	%r0,0x4000	# check for function 65
ad56ed
 	jz	.Lsoft_ghash
ad56ed
-	lghi	%r0,65		# function 65
ad56ed
+	lghi	%r0,S390X_GHASH	# function 65
ad56ed
 	la	%r1,0($Xi)	# H lies right after Xi in gcm128_context
ad56ed
 	.long	0xb93e0004	# kimd %r0,$inp
ad56ed
 	brc	1,.-4		# pay attention to "partial completion"
ad56ed
diff -up openssl-1.0.2k/crypto/modes/Makefile.s390x-update openssl-1.0.2k/crypto/modes/Makefile
ad56ed
--- openssl-1.0.2k/crypto/modes/Makefile.s390x-update	2018-06-18 12:20:47.020990305 +0200
ad56ed
+++ openssl-1.0.2k/crypto/modes/Makefile	2018-06-18 13:27:37.110817228 +0200
ad56ed
@@ -71,6 +71,8 @@ ghash-%.S:	asm/ghash-%.pl;	$(PERL) $< $(
ad56ed
 ghash-armv4.o:	ghash-armv4.S
ad56ed
 ghashv8-armx.o:	ghashv8-armx.S
ad56ed
 
ad56ed
+ghash-s390x.o:	ghash-s390x.S
ad56ed
+
ad56ed
 files:
ad56ed
 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
ad56ed
 
ad56ed
diff -up openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl.s390x-update openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl
ad56ed
--- openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl.s390x-update	2018-06-18 12:20:47.174994073 +0200
ad56ed
+++ openssl-1.0.2k/crypto/sha/asm/sha1-s390x.pl	2018-06-18 13:27:37.112817276 +0200
ad56ed
@@ -152,6 +152,8 @@ ___
ad56ed
 }
ad56ed
 
ad56ed
 $code.=<<___;
ad56ed
+#include "s390x_arch.h"
ad56ed
+
ad56ed
 .text
ad56ed
 .align	64
ad56ed
 .type	Ktable,\@object
ad56ed
@@ -164,10 +166,7 @@ sha1_block_data_order:
ad56ed
 ___
ad56ed
 $code.=<<___ if ($kimdfunc);
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
-	lg	%r0,0(%r1)
ad56ed
-	tmhl	%r0,0x4000	# check for message-security assist
ad56ed
-	jz	.Lsoftware
ad56ed
-	lg	%r0,16(%r1)	# check kimd capabilities
ad56ed
+	lg	%r0,S390X_KIMD(%r1)	# check kimd capabilities
ad56ed
 	tmhh	%r0,`0x8000>>$kimdfunc`
ad56ed
 	jz	.Lsoftware
ad56ed
 	lghi	%r0,$kimdfunc
ad56ed
@@ -234,7 +233,6 @@ $code.=<<___;
ad56ed
 	br	%r14
ad56ed
 .size	sha1_block_data_order,.-sha1_block_data_order
ad56ed
 .string	"SHA1 block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
ad56ed
-.comm	OPENSSL_s390xcap_P,80,8
ad56ed
 ___
ad56ed
 
ad56ed
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
ad56ed
diff -up openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl.s390x-update openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl
ad56ed
--- openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl.s390x-update	2018-06-18 12:20:47.179994196 +0200
ad56ed
+++ openssl-1.0.2k/crypto/sha/asm/sha512-s390x.pl	2018-06-18 13:27:37.112817276 +0200
ad56ed
@@ -163,6 +163,8 @@ ___
ad56ed
 }
ad56ed
 
ad56ed
 $code.=<<___;
ad56ed
+#include "s390x_arch.h"
ad56ed
+
ad56ed
 .text
ad56ed
 .align	64
ad56ed
 .type	$Table,\@object
ad56ed
@@ -237,10 +239,7 @@ $Func:
ad56ed
 ___
ad56ed
 $code.=<<___ if ($kimdfunc);
ad56ed
 	larl	%r1,OPENSSL_s390xcap_P
ad56ed
-	lg	%r0,0(%r1)
ad56ed
-	tmhl	%r0,0x4000	# check for message-security assist
ad56ed
-	jz	.Lsoftware
ad56ed
-	lg	%r0,16(%r1)	# check kimd capabilities
ad56ed
+	lg	%r0,S390X_KIMD(%r1)	# check kimd capabilities
ad56ed
 	tmhh	%r0,`0x8000>>$kimdfunc`
ad56ed
 	jz	.Lsoftware
ad56ed
 	lghi	%r0,$kimdfunc
ad56ed
@@ -308,7 +307,6 @@ $code.=<<___;
ad56ed
 	br	%r14
ad56ed
 .size	$Func,.-$Func
ad56ed
 .string	"SHA${label} block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
ad56ed
-.comm	OPENSSL_s390xcap_P,80,8
ad56ed
 ___
ad56ed
 
ad56ed
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
ad56ed
diff -up openssl-1.0.2k/crypto/sha/Makefile.s390x-update openssl-1.0.2k/crypto/sha/Makefile
ad56ed
--- openssl-1.0.2k/crypto/sha/Makefile.s390x-update	2018-06-18 12:20:49.482050519 +0200
ad56ed
+++ openssl-1.0.2k/crypto/sha/Makefile	2018-06-18 13:27:37.112817276 +0200
ad56ed
@@ -100,6 +100,10 @@ sha1-armv8.o:		sha1-armv8.S
ad56ed
 sha256-armv8.o:		sha256-armv8.S
ad56ed
 sha512-armv8.o:		sha512-armv8.S
ad56ed
 
ad56ed
+sha1-s390x.o:		sha1-s390x.S
ad56ed
+sha256-s390x.o:		sha256-s390x.S
ad56ed
+sha512-s390x.o:		sha512-s390x.S
ad56ed
+
ad56ed
 files:
ad56ed
 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
ad56ed
 
ad56ed
diff -up openssl-1.0.2k/crypto/s390x_arch.h.s390x-update openssl-1.0.2k/crypto/s390x_arch.h
ad56ed
--- openssl-1.0.2k/crypto/s390x_arch.h.s390x-update	2018-06-18 13:27:37.110817228 +0200
ad56ed
+++ openssl-1.0.2k/crypto/s390x_arch.h	2018-06-18 13:27:53.066204616 +0200
ad56ed
@@ -0,0 +1,93 @@
ad56ed
+/*
ad56ed
+ * Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
ad56ed
+ *
ad56ed
+ * Licensed under the OpenSSL license (the "License").  You may not use
ad56ed
+ * this file except in compliance with the License.  You can obtain a copy
ad56ed
+ * in the file LICENSE in the source distribution or at
ad56ed
+ * https://www.openssl.org/source/license.html
ad56ed
+ */
ad56ed
+
ad56ed
+#ifndef S390X_ARCH_H
ad56ed
+# define S390X_ARCH_H
ad56ed
+
ad56ed
+# ifndef __ASSEMBLER__
ad56ed
+
ad56ed
+void s390x_km(const unsigned char *in, size_t len, unsigned char *out,
ad56ed
+              unsigned int fc, void *param);
ad56ed
+void s390x_kma(const unsigned char *aad, size_t alen, const unsigned char *in,
ad56ed
+               size_t len, unsigned char *out, unsigned int fc, void *param);
ad56ed
+
ad56ed
+/*
ad56ed
+ * The field elements of OPENSSL_s390xcap_P are the 64-bit words returned by
ad56ed
+ * the STFLE instruction followed by the 64-bit word pairs returned by
ad56ed
+ * instructions' QUERY functions. If STFLE returns fewer data or an instruction
ad56ed
+ * is not supported, the corresponding field elements are zero.
ad56ed
+ */
ad56ed
+struct OPENSSL_s390xcap_st {
ad56ed
+    unsigned long long stfle[4];
ad56ed
+    unsigned long long kimd[2];
ad56ed
+    unsigned long long klmd[2];
ad56ed
+    unsigned long long km[2];
ad56ed
+    unsigned long long kmc[2];
ad56ed
+    unsigned long long kmac[2];
ad56ed
+    unsigned long long kmctr[2];
ad56ed
+    unsigned long long kmo[2];
ad56ed
+    unsigned long long kmf[2];
ad56ed
+    unsigned long long prno[2];
ad56ed
+    unsigned long long kma[2];
ad56ed
+};
ad56ed
+
ad56ed
+extern struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
ad56ed
+
ad56ed
+/* convert facility bit number or function code to bit mask */
ad56ed
+#  define S390X_CAPBIT(i)	(1ULL << (63 - (i) % 64))
ad56ed
+
ad56ed
+# endif
ad56ed
+
ad56ed
+/* OPENSSL_s390xcap_P offsets [bytes] */
ad56ed
+# define S390X_STFLE		0x00
ad56ed
+# define S390X_KIMD		0x20
ad56ed
+# define S390X_KLMD		0x30
ad56ed
+# define S390X_KM		0x40
ad56ed
+# define S390X_KMC		0x50
ad56ed
+# define S390X_KMAC		0x60
ad56ed
+# define S390X_KMCTR		0x70
ad56ed
+# define S390X_KMO		0x80
ad56ed
+# define S390X_KMF		0x90
ad56ed
+# define S390X_PRNO		0xa0
ad56ed
+# define S390X_KMA		0xb0
ad56ed
+
ad56ed
+/* Facility Bit Numbers */
ad56ed
+# define S390X_VX		129
ad56ed
+# define S390X_VXD		134
ad56ed
+# define S390X_VXE		135
ad56ed
+
ad56ed
+/* Function Codes */
ad56ed
+
ad56ed
+/* all instructions */
ad56ed
+# define S390X_QUERY		0
ad56ed
+
ad56ed
+/* kimd/klmd */
ad56ed
+# define S390X_SHA3_224		32
ad56ed
+# define S390X_SHA3_256		33
ad56ed
+# define S390X_SHA3_384		34
ad56ed
+# define S390X_SHA3_512		35
ad56ed
+# define S390X_SHAKE_128	36
ad56ed
+# define S390X_SHAKE_256	37
ad56ed
+# define S390X_GHASH		65
ad56ed
+
ad56ed
+/* km/kmc/kmac/kmctr/kmo/kmf/kma */
ad56ed
+# define S390X_AES_128		18
ad56ed
+# define S390X_AES_192		19
ad56ed
+# define S390X_AES_256		20
ad56ed
+
ad56ed
+/* prno */
ad56ed
+# define S390X_TRNG		114
ad56ed
+
ad56ed
+/* Register 0 Flags */
ad56ed
+# define S390X_DECRYPT		0x80
ad56ed
+# define S390X_KMA_LPC		0x100
ad56ed
+# define S390X_KMA_LAAD		0x200
ad56ed
+# define S390X_KMA_HS		0x400
ad56ed
+
ad56ed
+#endif
ad56ed
diff -up openssl-1.0.2k/crypto/s390xcap.c.s390x-update openssl-1.0.2k/crypto/s390xcap.c
ad56ed
--- openssl-1.0.2k/crypto/s390xcap.c.s390x-update	2017-01-26 14:22:03.000000000 +0100
ad56ed
+++ openssl-1.0.2k/crypto/s390xcap.c	2018-06-18 13:27:37.111817252 +0200
ad56ed
@@ -4,8 +4,7 @@
ad56ed
 #include <setjmp.h>
ad56ed
 #include <signal.h>
ad56ed
 #include "cryptlib.h"
ad56ed
-
ad56ed
-extern unsigned long OPENSSL_s390xcap_P[];
ad56ed
+#include "s390x_arch.h"
ad56ed
 
ad56ed
 static sigjmp_buf ill_jmp;
ad56ed
 static void ill_handler(int sig)
ad56ed
@@ -13,30 +12,48 @@ static void ill_handler(int sig)
ad56ed
     siglongjmp(ill_jmp, sig);
ad56ed
 }
ad56ed
 
ad56ed
-unsigned long OPENSSL_s390x_facilities(void);
ad56ed
+void OPENSSL_s390x_facilities(void);
ad56ed
+void OPENSSL_vx_probe(void);
ad56ed
+
ad56ed
+struct OPENSSL_s390xcap_st OPENSSL_s390xcap_P;
ad56ed
 
ad56ed
 void OPENSSL_cpuid_setup(void)
ad56ed
 {
ad56ed
     sigset_t oset;
ad56ed
     struct sigaction ill_act, oact;
ad56ed
 
ad56ed
-    if (OPENSSL_s390xcap_P[0])
ad56ed
+    if (OPENSSL_s390xcap_P.stfle[0])
ad56ed
         return;
ad56ed
 
ad56ed
-    OPENSSL_s390xcap_P[0] = 1UL << (8 * sizeof(unsigned long) - 1);
ad56ed
+    /* set a bit that will not be tested later */
ad56ed
+    OPENSSL_s390xcap_P.stfle[0] |= S390X_CAPBIT(0);
ad56ed
 
ad56ed
     memset(&ill_act, 0, sizeof(ill_act));
ad56ed
     ill_act.sa_handler = ill_handler;
ad56ed
     sigfillset(&ill_act.sa_mask);
ad56ed
     sigdelset(&ill_act.sa_mask, SIGILL);
ad56ed
+    sigdelset(&ill_act.sa_mask, SIGFPE);
ad56ed
     sigdelset(&ill_act.sa_mask, SIGTRAP);
ad56ed
     sigprocmask(SIG_SETMASK, &ill_act.sa_mask, &oset);
ad56ed
     sigaction(SIGILL, &ill_act, &oact;;
ad56ed
+    sigaction(SIGFPE, &ill_act, &oact;;
ad56ed
 
ad56ed
     /* protection against missing store-facility-list-extended */
ad56ed
     if (sigsetjmp(ill_jmp, 1) == 0)
ad56ed
         OPENSSL_s390x_facilities();
ad56ed
 
ad56ed
+    /* protection against disabled vector facility */
ad56ed
+    if ((OPENSSL_s390xcap_P.stfle[2] & S390X_CAPBIT(S390X_VX))
ad56ed
+        && (sigsetjmp(ill_jmp, 1) == 0)) {
ad56ed
+        OPENSSL_vx_probe();
ad56ed
+    } else {
ad56ed
+        OPENSSL_s390xcap_P.stfle[2] &= ~(S390X_CAPBIT(S390X_VX)
ad56ed
+                                         | S390X_CAPBIT(S390X_VXD)
ad56ed
+                                         | S390X_CAPBIT(S390X_VXE));
ad56ed
+    }
ad56ed
+
ad56ed
+    sigaction(SIGFPE, &oact, NULL);
ad56ed
+
ad56ed
     sigaction(SIGILL, &oact, NULL);
ad56ed
     sigprocmask(SIG_SETMASK, &oset, NULL);
ad56ed
 }
ad56ed
diff -up openssl-1.0.2k/crypto/s390xcpuid.pl.s390x-update openssl-1.0.2k/crypto/s390xcpuid.pl
ad56ed
--- openssl-1.0.2k/crypto/s390xcpuid.pl.s390x-update	2018-06-18 13:27:53.067204641 +0200
ad56ed
+++ openssl-1.0.2k/crypto/s390xcpuid.pl	2018-06-18 13:27:53.067204641 +0200
ad56ed
@@ -0,0 +1,259 @@
ad56ed
+#! /usr/bin/env perl
ad56ed
+
ad56ed
+$flavour = shift;
ad56ed
+
ad56ed
+if ($flavour =~ /3[12]/) {
ad56ed
+	$SIZE_T=4;
ad56ed
+	$g="";
ad56ed
+} else {
ad56ed
+	$SIZE_T=8;
ad56ed
+	$g="g";
ad56ed
+}
ad56ed
+
ad56ed
+while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
ad56ed
+open STDOUT,">$output";
ad56ed
+
ad56ed
+$ra="%r14";
ad56ed
+$sp="%r15";
ad56ed
+$stdframe=16*$SIZE_T+4*8;
ad56ed
+
ad56ed
+$code=<<___;
ad56ed
+#include "s390x_arch.h"
ad56ed
+
ad56ed
+.text
ad56ed
+
ad56ed
+.globl	OPENSSL_s390x_facilities
ad56ed
+.type	OPENSSL_s390x_facilities,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_s390x_facilities:
ad56ed
+	lghi	%r0,0
ad56ed
+	larl	%r4,OPENSSL_s390xcap_P
ad56ed
+
ad56ed
+	stg	%r0,S390X_STFLE+8(%r4)	# wipe capability vectors
ad56ed
+	stg	%r0,S390X_STFLE+16(%r4)
ad56ed
+	stg	%r0,S390X_STFLE+24(%r4)
ad56ed
+	stg	%r0,S390X_KIMD(%r4)
ad56ed
+	stg	%r0,S390X_KIMD+8(%r4)
ad56ed
+	stg	%r0,S390X_KLMD(%r4)
ad56ed
+	stg	%r0,S390X_KLMD+8(%r4)
ad56ed
+	stg	%r0,S390X_KM(%r4)
ad56ed
+	stg	%r0,S390X_KM+8(%r4)
ad56ed
+	stg	%r0,S390X_KMC(%r4)
ad56ed
+	stg	%r0,S390X_KMC+8(%r4)
ad56ed
+	stg	%r0,S390X_KMAC(%r4)
ad56ed
+	stg	%r0,S390X_KMAC+8(%r4)
ad56ed
+	stg	%r0,S390X_KMCTR(%r4)
ad56ed
+	stg	%r0,S390X_KMCTR+8(%r4)
ad56ed
+	stg	%r0,S390X_KMO(%r4)
ad56ed
+	stg	%r0,S390X_KMO+8(%r4)
ad56ed
+	stg	%r0,S390X_KMF(%r4)
ad56ed
+	stg	%r0,S390X_KMF+8(%r4)
ad56ed
+	stg	%r0,S390X_PRNO(%r4)
ad56ed
+	stg	%r0,S390X_PRNO+8(%r4)
ad56ed
+	stg	%r0,S390X_KMA(%r4)
ad56ed
+	stg	%r0,S390X_KMA+8(%r4)
ad56ed
+
ad56ed
+	.long	0xb2b04000		# stfle	0(%r4)
ad56ed
+	brc	8,.Ldone
ad56ed
+	lghi	%r0,1
ad56ed
+	.long	0xb2b04000		# stfle 0(%r4)
ad56ed
+	brc	8,.Ldone
ad56ed
+	lghi	%r0,2
ad56ed
+	.long	0xb2b04000		# stfle 0(%r4)
ad56ed
+.Ldone:
ad56ed
+	lmg	%r2,%r3,S390X_STFLE(%r4)
ad56ed
+	tmhl	%r2,0x4000		# check for message-security-assist
ad56ed
+ 	jz	.Lret
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kimd capabilities
ad56ed
+	la	%r1,S390X_KIMD(%r4)
ad56ed
+	.long	0xb93e0002		# kimd %r0,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query klmd capabilities
ad56ed
+	la	%r1,S390X_KLMD(%r4)
ad56ed
+	.long	0xb93f0002		# klmd %r0,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query km capability vector
ad56ed
+	la	%r1,S390X_KM(%r4)
ad56ed
+	.long	0xb92e0042		# km %r4,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kmc capability vector
ad56ed
+	la	%r1,S390X_KMC(%r4)
ad56ed
+	.long	0xb92f0042		# kmc %r4,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kmac capability vector
ad56ed
+	la	%r1,S390X_KMAC(%r4)
ad56ed
+	.long	0xb91e0042		# kmac %r4,%r2
ad56ed
+
ad56ed
+	tmhh	%r3,0x0004		# check for message-security-assist-4
ad56ed
+ 	jz	.Lret
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kmctr capability vector
ad56ed
+	la	%r1,S390X_KMCTR(%r4)
ad56ed
+	.long	0xb92d2042		# kmctr %r4,%r2,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kmo capability vector
ad56ed
+	la	%r1,S390X_KMO(%r4)
ad56ed
+	.long	0xb92b0042		# kmo %r4,%r2
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kmf capability vector
ad56ed
+	la	%r1,S390X_KMF(%r4)
ad56ed
+	.long	0xb92a0042		# kmf %r4,%r2
ad56ed
+
ad56ed
+	tml	%r2,0x40		# check for message-security-assist-5
ad56ed
+	jz	.Lret
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query prno capability vector
ad56ed
+	la	%r1,S390X_PRNO(%r4)
ad56ed
+	.long	0xb93c0042		# prno %r4,%r2
ad56ed
+
ad56ed
+	lg	%r2,S390X_STFLE+16(%r4)
ad56ed
+	tmhl	%r2,0x2000		# check for message-security-assist-8
ad56ed
+	jz	.Lret
ad56ed
+
ad56ed
+	lghi	%r0,S390X_QUERY		# query kma capability vector
ad56ed
+	la	%r1,S390X_KMA(%r4)
ad56ed
+	.long	0xb9294022		# kma %r2,%r4,%r2
ad56ed
+
ad56ed
+.Lret:
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_s390x_facilities,.-OPENSSL_s390x_facilities
ad56ed
+
ad56ed
+.globl	OPENSSL_rdtsc
ad56ed
+.type	OPENSSL_rdtsc,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_rdtsc:
ad56ed
+	stck	16($sp)
ad56ed
+	lg	%r2,16($sp)
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_rdtsc,.-OPENSSL_rdtsc
ad56ed
+
ad56ed
+.globl	OPENSSL_atomic_add
ad56ed
+.type	OPENSSL_atomic_add,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_atomic_add:
ad56ed
+	l	%r1,0(%r2)
ad56ed
+.Lspin:	lr	%r0,%r1
ad56ed
+	ar	%r0,%r3
ad56ed
+	cs	%r1,%r0,0(%r2)
ad56ed
+	brc	4,.Lspin
ad56ed
+	lgfr	%r2,%r0		# OpenSSL expects the new value
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_atomic_add,.-OPENSSL_atomic_add
ad56ed
+
ad56ed
+.globl	OPENSSL_wipe_cpu
ad56ed
+.type	OPENSSL_wipe_cpu,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_wipe_cpu:
ad56ed
+	xgr	%r0,%r0
ad56ed
+	xgr	%r1,%r1
ad56ed
+	lgr	%r2,$sp
ad56ed
+	xgr	%r3,%r3
ad56ed
+	xgr	%r4,%r4
ad56ed
+	lzdr	%f0
ad56ed
+	lzdr	%f1
ad56ed
+	lzdr	%f2
ad56ed
+	lzdr	%f3
ad56ed
+	lzdr	%f4
ad56ed
+	lzdr	%f5
ad56ed
+	lzdr	%f6
ad56ed
+	lzdr	%f7
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_wipe_cpu,.-OPENSSL_wipe_cpu
ad56ed
+
ad56ed
+.globl	OPENSSL_cleanse
ad56ed
+.type	OPENSSL_cleanse,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_cleanse:
ad56ed
+#if !defined(__s390x__) && !defined(__s390x)
ad56ed
+	llgfr	%r3,%r3
ad56ed
+#endif
ad56ed
+	lghi	%r4,15
ad56ed
+	lghi	%r0,0
ad56ed
+	clgr	%r3,%r4
ad56ed
+	jh	.Lot
ad56ed
+	clgr	%r3,%r0
ad56ed
+	bcr	8,%r14
ad56ed
+.Little:
ad56ed
+	stc	%r0,0(%r2)
ad56ed
+	la	%r2,1(%r2)
ad56ed
+	brctg	%r3,.Little
ad56ed
+	br	%r14
ad56ed
+.align	4
ad56ed
+.Lot:	tmll	%r2,7
ad56ed
+	jz	.Laligned
ad56ed
+	stc	%r0,0(%r2)
ad56ed
+	la	%r2,1(%r2)
ad56ed
+	brctg	%r3,.Lot
ad56ed
+.Laligned:
ad56ed
+	srlg	%r4,%r3,3
ad56ed
+.Loop:	stg	%r0,0(%r2)
ad56ed
+	la	%r2,8(%r2)
ad56ed
+	brctg	%r4,.Loop
ad56ed
+	lghi	%r4,7
ad56ed
+	ngr	%r3,%r4
ad56ed
+	jnz	.Little
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_cleanse,.-OPENSSL_cleanse
ad56ed
+
ad56ed
+.globl	OPENSSL_vx_probe
ad56ed
+.type	OPENSSL_vx_probe,\@function
ad56ed
+.align	16
ad56ed
+OPENSSL_vx_probe:
ad56ed
+	.word	0xe700,0x0000,0x0044	# vzero %v0
ad56ed
+	br	$ra
ad56ed
+.size	OPENSSL_vx_probe,.-OPENSSL_vx_probe
ad56ed
+___
ad56ed
+
ad56ed
+################
ad56ed
+# void s390x_km(const unsigned char *in, size_t len, unsigned char *out,
ad56ed
+#               unsigned int fc, void *param)
ad56ed
+{
ad56ed
+my ($in,$len,$out,$fc,$param) = map("%r$_",(2..6));
ad56ed
+$code.=<<___;
ad56ed
+.globl	s390x_km
ad56ed
+.type	s390x_km,\@function
ad56ed
+.align	16
ad56ed
+s390x_km:
ad56ed
+	lr	%r0,$fc
ad56ed
+	l${g}r	%r1,$param
ad56ed
+
ad56ed
+	.long	0xb92e0042	# km $out,$in
ad56ed
+	brc	1,.-4		# pay attention to "partial completion"
ad56ed
+
ad56ed
+	br	$ra
ad56ed
+.size	s390x_km,.-s390x_km
ad56ed
+___
ad56ed
+}
ad56ed
+
ad56ed
+################
ad56ed
+# void s390x_kma(const unsigned char *aad, size_t alen,
ad56ed
+#                const unsigned char *in, size_t len,
ad56ed
+#                unsigned char *out, unsigned int fc, void *param)
ad56ed
+{
ad56ed
+my ($aad,$alen,$in,$len,$out) = map("%r$_",(2..6));
ad56ed
+$code.=<<___;
ad56ed
+.globl	s390x_kma
ad56ed
+.type	s390x_kma,\@function
ad56ed
+.align	16
ad56ed
+s390x_kma:
ad56ed
+	st${g}	$out,6*$SIZE_T($sp)
ad56ed
+	lm${g}	%r0,%r1,$stdframe($sp)
ad56ed
+
ad56ed
+	.long	0xb9292064	# kma $out,$aad,$in
ad56ed
+	brc	1,.-4		# pay attention to "partial completion"
ad56ed
+
ad56ed
+	l${g}	$out,6*$SIZE_T($sp)
ad56ed
+	br	$ra
ad56ed
+.size	s390x_kma,.-s390x_kma
ad56ed
+___
ad56ed
+}
ad56ed
+
ad56ed
+$code.=<<___;
ad56ed
+.section	.init
ad56ed
+	brasl	$ra,OPENSSL_cpuid_setup
ad56ed
+___
ad56ed
+
ad56ed
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
ad56ed
+print $code;
ad56ed
+close STDOUT;	# force flush