diff -up openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl

--- openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl.s390x-update	2018-06-18 12:20:47.197994636 +0200

+++ openssl-1.0.2k/crypto/aes/asm/aes-s390x.pl	2018-06-18 13:27:37.109817203 +0200

@@ -122,6 +122,8 @@ sub _data_word()

 }

 $code=<<___;

+#include "s390x_arch.h"

+

 .text

 .type	AES_Te,\@object

@@ -814,13 +816,10 @@ $code.=<<___ if (!$softonly);

 	ar	%r5,%r0

 	larl	%r1,OPENSSL_s390xcap_P

-	lg	%r0,0(%r1)

-	tmhl	%r0,0x4000	# check for message-security assist

-	jz	.Lekey_internal

-

 	llihh	%r0,0x8000

 	srlg	%r0,%r0,0(%r5)

-	ng	%r0,48(%r1)	# check kmc capability vector

+	ng	%r0,S390X_KM(%r1)  # check availability of both km...

+	ng	%r0,S390X_KMC(%r1) # ...and kmc support for given key length

 	jz	.Lekey_internal

 	lmg	%r0,%r1,0($inp)	# just copy 128 bits...

@@ -1443,7 +1442,7 @@ $code.=<<___ if (0);	######### kmctr cod

 	larl	%r1,OPENSSL_s390xcap_P

 	llihh	%r0,0x8000	# check if kmctr supports the function code

 	srlg	%r0,%r0,0($s0)

-	ng	%r0,64(%r1)	# check kmctr capability vector

+	ng	%r0,S390X_KMCTR(%r1)	# check kmctr capability vector

 	lgr	%r0,$s0

 	lgr	%r1,$s1

 	jz	.Lctr32_km_loop

@@ -1593,7 +1592,7 @@ $code.=<<___ if(1);

 	larl	%r1,OPENSSL_s390xcap_P

 	llihh	%r0,0x8000

 	srlg	%r0,%r0,32($s1)		# check for 32+function code

-	ng	%r0,32(%r1)		# check km capability vector

+	ng	%r0,S390X_KM(%r1)	# check km capability vector

 	lgr	%r0,$s0			# restore the function code

 	la	%r1,0($key1)		# restore $key1

 	jz	.Lxts_km_vanilla

@@ -2220,7 +2219,6 @@ ___

 }

 $code.=<<___;

 .string	"AES for s390x, CRYPTOGAMS by <appro\@openssl.org>"

-.comm	OPENSSL_s390xcap_P,80,8

 ___

 $code =~ s/\`([^\`]*)\`/eval $1/gem;

diff -up openssl-1.0.2k/crypto/aes/Makefile.s390x-update openssl-1.0.2k/crypto/aes/Makefile

--- openssl-1.0.2k/crypto/aes/Makefile.s390x-update	2017-01-26 14:22:03.000000000 +0100

+++ openssl-1.0.2k/crypto/aes/Makefile	2018-06-18 13:27:37.108817179 +0200

@@ -92,6 +92,8 @@ aesv8-armx.S:	asm/aesv8-armx.pl

 	$(PERL) asm/aesv8-armx.pl $(PERLASM_SCHEME) $@

 aesv8-armx.o:	aesv8-armx.S

+aes-s390x.o:	aes-s390x.S

+

 # GNU make "catch all"

 aes-%.S:	asm/aes-%.pl;	$(PERL) $< $(PERLASM_SCHEME) > $@

 aes-armv4.o:	aes-armv4.S

diff -up openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update openssl-1.0.2k/crypto/evp/e_aes.c

--- openssl-1.0.2k/crypto/evp/e_aes.c.s390x-update	2018-06-18 12:20:47.104992361 +0200

+++ openssl-1.0.2k/crypto/evp/e_aes.c	2018-06-18 13:28:07.033543735 +0200

@@ -854,6 +854,723 @@ static const EVP_CIPHER aes_##keylen##_#

 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \

 { return SPARC_AES_CAPABLE?&aes_t4_##keylen##_##mode:&aes_##keylen##_##mode; }

+#elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__)

+/*

+ * IBM S390X support

+ */

+# include "s390x_arch.h"

+

+typedef struct {

+    union {

+        double align;

+        /*-

+         * KMA-GCM-AES parameter block

+         * (see z/Architecture Principles of Operation SA22-7832-11)

+         */

+        struct {

+            unsigned char reserved[12];

+            union {

+                unsigned int w;

+                unsigned char b[4];

+            } cv;

+            union {

+                unsigned long long g[2];

+                unsigned char b[16];

+            } t;

+            unsigned char h[16];

+            unsigned long long taadl;

+            unsigned long long tpcl;

+            union {

+                unsigned long long g[2];

+                unsigned int w[4];

+            } j0;

+            unsigned char k[32];

+        } param;

+    } kma;

+    unsigned int fc;

+    int key_set;

+

+    unsigned char *iv;

+    int ivlen;

+    int iv_set;

+    int iv_gen;

+

+    int taglen;

+

+    unsigned char ares[16];

+    unsigned char mres[16];

+    unsigned char kres[16];

+    int areslen;

+    int mreslen;

+    int kreslen;

+

+    int tls_aad_len;

+} S390X_AES_GCM_CTX;

+

+# define S390X_aes_128_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\

+                                 S390X_CAPBIT(S390X_AES_128)) &&\

+                                (OPENSSL_s390xcap_P.kmc[0] &	\

+                                 S390X_CAPBIT(S390X_AES_128)))

+# define S390X_aes_192_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\

+                                 S390X_CAPBIT(S390X_AES_192)) &&\

+                                (OPENSSL_s390xcap_P.kmc[0] &	\

+                                 S390X_CAPBIT(S390X_AES_192)))

+# define S390X_aes_256_CAPABLE ((OPENSSL_s390xcap_P.km[0] &	\

+                                 S390X_CAPBIT(S390X_AES_256)) &&\

+                                (OPENSSL_s390xcap_P.kmc[0] &	\

+                                 S390X_CAPBIT(S390X_AES_256)))

+

+# define s390x_aes_init_key aes_init_key

+static int s390x_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

+                              const unsigned char *iv, int enc);

+

+# define S390X_aes_128_cbc_CAPABLE	1	/* checked by callee */

+# define S390X_aes_192_cbc_CAPABLE	1

+# define S390X_aes_256_cbc_CAPABLE	1

+

+# define s390x_aes_cbc_cipher aes_cbc_cipher

+static int s390x_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+

+# define S390X_aes_128_ecb_CAPABLE	0

+# define S390X_aes_192_ecb_CAPABLE	0

+# define S390X_aes_256_ecb_CAPABLE	0

+

+# define s390x_aes_ecb_cipher aes_ecb_cipher

+static int s390x_aes_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+

+# define S390X_aes_128_ofb_CAPABLE	0

+# define S390X_aes_192_ofb_CAPABLE	0

+# define S390X_aes_256_ofb_CAPABLE	0

+

+# define s390x_aes_ofb_cipher aes_ofb_cipher

+static int s390x_aes_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+

+# define S390X_aes_128_cfb_CAPABLE	0

+# define S390X_aes_192_cfb_CAPABLE	0

+# define S390X_aes_256_cfb_CAPABLE	0

+

+# define s390x_aes_cfb_cipher aes_cfb_cipher

+static int s390x_aes_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+

+# define S390X_aes_128_cfb8_CAPABLE	0

+# define S390X_aes_192_cfb8_CAPABLE	0

+# define S390X_aes_256_cfb8_CAPABLE	0

+

+# define s390x_aes_cfb8_cipher aes_cfb8_cipher

+static int s390x_aes_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                 const unsigned char *in, size_t len);

+

+# define S390X_aes_128_cfb1_CAPABLE	0

+# define S390X_aes_192_cfb1_CAPABLE	0

+# define S390X_aes_256_cfb1_CAPABLE	0

+

+# define s390x_aes_cfb1_cipher aes_cfb1_cipher

+static int s390x_aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                 const unsigned char *in, size_t len);

+

+# define S390X_aes_128_ctr_CAPABLE	1	/* checked by callee */

+# define S390X_aes_192_ctr_CAPABLE	1

+# define S390X_aes_256_ctr_CAPABLE	1

+

+# define s390x_aes_ctr_cipher aes_ctr_cipher

+static int s390x_aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+

+# define S390X_aes_128_gcm_CAPABLE (S390X_aes_128_CAPABLE &&		\

+                                    (OPENSSL_s390xcap_P.kma[0] &	\

+                                     S390X_CAPBIT(S390X_AES_128)))

+# define S390X_aes_192_gcm_CAPABLE (S390X_aes_192_CAPABLE &&		\

+                                    (OPENSSL_s390xcap_P.kma[0] &	\

+                                     S390X_CAPBIT(S390X_AES_192)))

+# define S390X_aes_256_gcm_CAPABLE (S390X_aes_256_CAPABLE &&		\

+                                    (OPENSSL_s390xcap_P.kma[0] &	\

+                                     S390X_CAPBIT(S390X_AES_256)))

+

+/* iv + padding length for iv lenghts != 12 */

+# define S390X_gcm_ivpadlen(i)	((((i) + 15) >> 4 << 4) + 16)

+

+static int s390x_aes_gcm_aad(S390X_AES_GCM_CTX *ctx, const unsigned char *aad,

+                             size_t len)

+{

+    unsigned long long alen;

+    int n, rem;

+

+    if (ctx->kma.param.tpcl)

+        return -2;

+

+    alen = ctx->kma.param.taadl + len;

+    if (alen > (U64(1) << 61) || (sizeof(len) == 8 && alen < len))

+        return -1;

+    ctx->kma.param.taadl = alen;

+

+    n = ctx->areslen;

+    if (n) {

+        while (n && len) {

+            ctx->ares[n] = *aad;

+            n = (n + 1) & 0xf;

+            ++aad;

+            --len;

+        }

+        /* ctx->ares contains a complete block if offset has wrapped around */

+        if (!n) {

+            s390x_kma(ctx->ares, 16, NULL, 0, NULL, ctx->fc, &ctx->kma.param);

+            ctx->fc |= S390X_KMA_HS;

+        }

+        ctx->areslen = n;

+    }

+

+    rem = len & 0xf;

+

+    len &= ~0xf;

+    if (len) {

+        s390x_kma(aad, len, NULL, 0, NULL, ctx->fc, &ctx->kma.param);

+        aad += len;

+        ctx->fc |= S390X_KMA_HS;

+    }

+

+    if (rem) {

+        ctx->areslen = rem;

+

+        do {

+            --rem;

+            ctx->ares[rem] = aad[rem];

+        } while (rem);

+    }

+    return 0;

+}

+

+static int s390x_aes_gcm(S390X_AES_GCM_CTX *ctx, const unsigned char *in,

+                         unsigned char *out, size_t len)

+{

+    const unsigned char *inptr;

+    unsigned long long mlen;

+    union {

+        unsigned int w[4];

+        unsigned char b[16];

+    } buf;

+    size_t inlen;

+    int n, rem, i;

+

+    mlen = ctx->kma.param.tpcl + len;

+    if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))

+        return -1;

+    ctx->kma.param.tpcl = mlen;

+

+    n = ctx->mreslen;

+    if (n) {

+        inptr = in;

+        inlen = len;

+        while (n && inlen) {

+            ctx->mres[n] = *inptr;

+            n = (n + 1) & 0xf;

+            ++inptr;

+            --inlen;

+        }

+        /* ctx->mres contains a complete block if offset has wrapped around */

+        if (!n) {

+            s390x_kma(ctx->ares, ctx->areslen, ctx->mres, 16, buf.b,

+                      ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);

+            ctx->fc |= S390X_KMA_HS;

+            ctx->areslen = 0;

+

+            /* previous call already encrypted/decrypted its remainder,

+             * see comment below */

+            n = ctx->mreslen;

+            while (n) {

+                *out = buf.b[n];

+                n = (n + 1) & 0xf;

+                ++out;

+                ++in;

+                --len;

+            }

+            ctx->mreslen = 0;

+        }

+    }

+

+    rem = len & 0xf;

+

+    len &= ~0xf;

+    if (len) {

+        s390x_kma(ctx->ares, ctx->areslen, in, len, out,

+                  ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);

+        in += len;

+        out += len;

+        ctx->fc |= S390X_KMA_HS;

+        ctx->areslen = 0;

+    }

+

+    /*-

+     * If there is a remainder, it has to be saved such that it can be

+     * processed by kma later. However, we also have to do the for-now

+     * unauthenticated encryption/decryption part here and now...

+     */

+    if (rem) {

+        if (!ctx->mreslen) {

+            buf.w[0] = ctx->kma.param.j0.w[0];

+            buf.w[1] = ctx->kma.param.j0.w[1];

+            buf.w[2] = ctx->kma.param.j0.w[2];

+            buf.w[3] = ctx->kma.param.cv.w + 1;

+            s390x_km(buf.b, 16, ctx->kres, ctx->fc & 0x1f, &ctx->kma.param.k);

+        }

+

+        n = ctx->mreslen;

+        for (i = 0; i < rem; i++) {

+            ctx->mres[n + i] = in[i];

+            out[i] = in[i] ^ ctx->kres[n + i];

+        }

+

+        ctx->mreslen += rem;

+    }

+    return 0;

+}

+

+static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx,

+                                const unsigned char *iv)

+{

+    ctx->kma.param.t.g[0] = 0;

+    ctx->kma.param.t.g[1] = 0;

+    ctx->kma.param.tpcl = 0;

+    ctx->kma.param.taadl = 0;

+    ctx->mreslen = 0;

+    ctx->areslen = 0;

+    ctx->kreslen = 0;

+

+    if (ctx->ivlen == 12) {

+        memcpy(&ctx->kma.param.j0, iv, ctx->ivlen);

+        ctx->kma.param.j0.w[3] = 1;

+        ctx->kma.param.cv.w = 1;

+    } else {

+        /* ctx->iv has the right size and is already padded. */

+        memcpy(ctx->iv, iv, ctx->ivlen);

+        s390x_kma(ctx->iv, S390X_gcm_ivpadlen(ctx->ivlen), NULL, 0, NULL,

+                  ctx->fc, &ctx->kma.param);

+        ctx->fc |= S390X_KMA_HS;

+

+        ctx->kma.param.j0.g[0] = ctx->kma.param.t.g[0];

+        ctx->kma.param.j0.g[1] = ctx->kma.param.t.g[1];

+        ctx->kma.param.cv.w = ctx->kma.param.j0.w[3];

+        ctx->kma.param.t.g[0] = 0;

+        ctx->kma.param.t.g[1] = 0;

+    }

+}

+

+static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)

+{

+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);

+    S390X_AES_GCM_CTX *gctx_out;

+    EVP_CIPHER_CTX *out;

+    unsigned char *buf, *iv;

+    int ivlen, enc, len;

+

+    switch (type) {

+    case EVP_CTRL_INIT:

+        ivlen = c->cipher->iv_len;;

+        iv = c->iv;

+        gctx->key_set = 0;

+        gctx->iv_set = 0;

+        gctx->ivlen = ivlen;

+        gctx->iv = iv;

+        gctx->taglen = -1;

+        gctx->iv_gen = 0;

+        gctx->tls_aad_len = -1;

+        return 1;

+

+    case EVP_CTRL_GCM_SET_IVLEN:

+        if (arg <= 0)

+            return 0;

+

+        if (arg != 12) {

+            iv = c->iv;

+            len = S390X_gcm_ivpadlen(arg);

+

+            /* Allocate memory for iv if needed. */

+            if (gctx->ivlen == 12 || len > S390X_gcm_ivpadlen(gctx->ivlen)) {

+                if (gctx->iv != iv)

+                    OPENSSL_free(gctx->iv);

+

+                gctx->iv = OPENSSL_malloc(len);

+                if (gctx->iv == NULL)

+                    return 0;

+            }

+            /* Add padding. */

+            memset(gctx->iv + arg, 0, len - arg - 8);

+            *((unsigned long long *)(gctx->iv + len - 8)) = arg << 3;

+        }

+        gctx->ivlen = arg;

+        return 1;

+

+    case EVP_CTRL_GCM_SET_TAG:

+        buf = c->buf;

+        enc = c->encrypt;

+        if (arg <= 0 || arg > 16 || enc)

+            return 0;

+

+        memcpy(buf, ptr, arg);

+        gctx->taglen = arg;

+        return 1;

+

+    case EVP_CTRL_GCM_GET_TAG:

+        enc = c->encrypt;

+        if (arg <= 0 || arg > 16 || !enc || gctx->taglen < 0)

+            return 0;

+

+        memcpy(ptr, gctx->kma.param.t.b, arg);

+        return 1;

+

+    case EVP_CTRL_GCM_SET_IV_FIXED:

+        /* Special case: -1 length restores whole iv */

+        if (arg == -1) {

+            memcpy(gctx->iv, ptr, gctx->ivlen);

+            gctx->iv_gen = 1;

+            return 1;

+        }

+        /*

+         * Fixed field must be at least 4 bytes and invocation field at least

+         * 8.

+         */

+        if ((arg < 4) || (gctx->ivlen - arg) < 8)

+            return 0;

+

+        if (arg)

+            memcpy(gctx->iv, ptr, arg);

+

+        enc = c->encrypt;

+        if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)

+            return 0;

+

+        gctx->iv_gen = 1;

+        return 1;

+

+    case EVP_CTRL_GCM_IV_GEN:

+        if (gctx->iv_gen == 0 || gctx->key_set == 0)

+            return 0;

+

+        s390x_aes_gcm_setiv(gctx, gctx->iv);

+

+        if (arg <= 0 || arg > gctx->ivlen)

+            arg = gctx->ivlen;

+

+        memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);

+        /*

+         * Invocation field will be at least 8 bytes in size and so no need

+         * to check wrap around or increment more than last 8 bytes.

+         */

+        (*(unsigned long long *)(gctx->iv + gctx->ivlen - 8))++;

+        gctx->iv_set = 1;

+        return 1;

+

+    case EVP_CTRL_GCM_SET_IV_INV:

+        enc = c->encrypt;

+        if (gctx->iv_gen == 0 || gctx->key_set == 0 || enc)

+            return 0;

+

+        memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);

+        s390x_aes_gcm_setiv(gctx, gctx->iv);

+        gctx->iv_set = 1;

+        return 1;

+

+    case EVP_CTRL_AEAD_TLS1_AAD:

+        /* Save the aad for later use. */

+        if (arg != EVP_AEAD_TLS1_AAD_LEN)

+            return 0;

+

+        buf = c->buf;

+        memcpy(buf, ptr, arg);

+        gctx->tls_aad_len = arg;

+

+        len = buf[arg - 2] << 8 | buf[arg - 1];

+        /* Correct length for explicit iv. */

+        if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)

+            return 0;

+        len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;

+

+        /* If decrypting correct for tag too. */

+        enc = c->encrypt;

+        if (!enc) {

+            if (len < EVP_GCM_TLS_TAG_LEN)

+                return 0;

+            len -= EVP_GCM_TLS_TAG_LEN;

+        }

+        buf[arg - 2] = len >> 8;

+        buf[arg - 1] = len & 0xff;

+        /* Extra padding: tag appended to record. */

+        return EVP_GCM_TLS_TAG_LEN;

+

+    case EVP_CTRL_COPY:

+        out = ptr;

+        gctx_out = EVP_C_DATA(S390X_AES_GCM_CTX, out);

+        iv = c->iv;

+

+        if (gctx->iv == iv) {

+            gctx_out->iv = out->iv;

+        } else {

+            len = S390X_gcm_ivpadlen(gctx->ivlen);

+

+            gctx_out->iv = OPENSSL_malloc(len);

+            if (gctx_out->iv == NULL)

+                return 0;

+

+            memcpy(gctx_out->iv, gctx->iv, len);

+        }

+        return 1;

+

+    default:

+        return -1;

+    }

+}

+

+static int s390x_aes_gcm_init_key(EVP_CIPHER_CTX *ctx,

+                                  const unsigned char *key,

+                                  const unsigned char *iv, int enc)

+{

+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);

+    int keylen;

+

+    if (iv == NULL && key == NULL)

+        return 1;

+

+    if (key != NULL) {

+        keylen = EVP_CIPHER_CTX_key_length(ctx);

+        memcpy(&gctx->kma.param.k, key, keylen);

+

+        /* Convert key size to function code. */

+        gctx->fc = S390X_AES_128 + (((keylen << 3) - 128) >> 6);

+        if (!enc)

+            gctx->fc |= S390X_DECRYPT;

+

+        if (iv == NULL && gctx->iv_set)

+            iv = gctx->iv;

+

+        if (iv != NULL) {

+            s390x_aes_gcm_setiv(gctx, iv);

+            gctx->iv_set = 1;

+        }

+        gctx->key_set = 1;

+    } else {

+        if (gctx->key_set)

+            s390x_aes_gcm_setiv(gctx, iv);

+        else

+            memcpy(gctx->iv, iv, gctx->ivlen);

+

+        gctx->iv_set = 1;

+        gctx->iv_gen = 0;

+    }

+    return 1;

+}

+

+static int s390x_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                    const unsigned char *in, size_t len)

+{

+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);

+    const unsigned char *buf = ctx->buf;

+    const int enc = ctx->encrypt;

+    int rv = -1;

+

+    if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))

+        return -1;

+

+    if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN

+                                     : EVP_CTRL_GCM_SET_IV_INV,

+                            EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)

+        goto err;

+

+    in += EVP_GCM_TLS_EXPLICIT_IV_LEN;

+    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;

+    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;

+

+    gctx->kma.param.taadl = gctx->tls_aad_len << 3;

+    gctx->kma.param.tpcl = len << 3;

+    s390x_kma(buf, gctx->tls_aad_len, in, len, out,

+              gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);

+

+    if (enc) {

+        memcpy(out + len, gctx->kma.param.t.b, EVP_GCM_TLS_TAG_LEN);

+        rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;

+    } else {

+        if (CRYPTO_memcmp(gctx->kma.param.t.b, in + len,

+                          EVP_GCM_TLS_TAG_LEN)) {

+            OPENSSL_cleanse(out, len);

+            goto err;

+        }

+        rv = len;

+    }

+err:

+    gctx->iv_set = 0;

+    gctx->tls_aad_len = -1;

+    return rv;

+}

+

+static int s390x_aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len)

+{

+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);

+    unsigned char *buf, tmp[16];

+    int enc;

+

+    if (!gctx->key_set)

+        return -1;

+

+    if (gctx->tls_aad_len >= 0)

+        return s390x_aes_gcm_tls_cipher(ctx, out, in, len);

+

+    if (!gctx->iv_set)

+        return -1;

+

+    if (in != NULL) {

+        if (out == NULL) {

+            if (s390x_aes_gcm_aad(gctx, in, len))

+                return -1;

+        } else {

+            if (s390x_aes_gcm(gctx, in, out, len))

+                return -1;

+        }

+        return len;

+    } else {

+        gctx->kma.param.taadl <<= 3;

+        gctx->kma.param.tpcl <<= 3;

+        s390x_kma(gctx->ares, gctx->areslen, gctx->mres, gctx->mreslen, tmp,

+                  gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);

+        /* recall that we already did en-/decrypt gctx->mres

+         * and returned it to caller... */

+        OPENSSL_cleanse(tmp, gctx->mreslen);

+        gctx->iv_set = 0;

+

+        enc = ctx->encrypt;

+        if (enc) {

+            gctx->taglen = 16;

+        } else {

+            if (gctx->taglen < 0)

+                return -1;

+

+            buf = ctx->buf;

+            if (CRYPTO_memcmp(buf, gctx->kma.param.t.b, gctx->taglen))

+                return -1;

+        }

+        return 0;

+    }

+}

+

+static int s390x_aes_gcm_cleanup(EVP_CIPHER_CTX *c)

+{

+    S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);

+    const unsigned char *iv;

+

+    if (gctx == NULL)

+        return 0;

+

+    iv = c->iv;

+    if (iv != gctx->iv)

+        OPENSSL_free(gctx->iv);

+

+    OPENSSL_cleanse(gctx, sizeof(*gctx));

+    return 1;

+}

+

+# define S390X_AES_XTS_CTX		EVP_AES_XTS_CTX

+# define S390X_aes_128_xts_CAPABLE	1	/* checked by callee */

+# define S390X_aes_256_xts_CAPABLE	1

+

+# define s390x_aes_xts_init_key aes_xts_init_key

+static int s390x_aes_xts_init_key(EVP_CIPHER_CTX *ctx,

+                                  const unsigned char *key,

+                                  const unsigned char *iv, int enc);

+# define s390x_aes_xts_cipher aes_xts_cipher

+static int s390x_aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+# define s390x_aes_xts_ctrl aes_xts_ctrl

+static int s390x_aes_xts_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);

+# define s390x_aes_xts_cleanup aes_xts_cleanup

+

+# define S390X_AES_CCM_CTX		EVP_AES_CCM_CTX

+# define S390X_aes_128_ccm_CAPABLE	0

+# define S390X_aes_192_ccm_CAPABLE	0

+# define S390X_aes_256_ccm_CAPABLE	0

+

+# define s390x_aes_ccm_init_key aes_ccm_init_key

+static int s390x_aes_ccm_init_key(EVP_CIPHER_CTX *ctx,

+                                  const unsigned char *key,

+                                  const unsigned char *iv, int enc);

+# define s390x_aes_ccm_cipher aes_ccm_cipher

+static int s390x_aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+                                const unsigned char *in, size_t len);

+# define s390x_aes_ccm_ctrl aes_ccm_ctrl

+static int s390x_aes_ccm_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);

+# define s390x_aes_ccm_cleanup aes_ccm_cleanup