- Do not use sigill to wrap all HW instructions (#665401)
- updated to 2.0.4
This commit is contained in:
Dan Horák
parent
ecbad6b667
commit
08a457490b
1
.gitignore
vendored
1
.gitignore
vendored
@ -1 +1,2 @@
|
|||||||
libica-2.0.3.tar.gz
|
libica-2.0.3.tar.gz
|
||||||
|
/libica-2.0.4.tar.gz
|
||||||
|
|||||||
275
libica-2.0.3-remove-sigill.patch
Normal file
275
libica-2.0.3-remove-sigill.patch
Normal file
@ -0,0 +1,275 @@
|
|||||||
|
[Bug 67452]: Do not use sigill to wrap all HW instructions.
|
||||||
|
|
||||||
|
From: Felix Beck <felix.beck@de.ibm.com>
|
||||||
|
|
||||||
|
As described in Bugzilla 67452 there is a performance problem using
|
||||||
|
libica. This results from extensive usage of the signall handler to
|
||||||
|
catch illegal signals from hw functions. This wrapping mechanism is
|
||||||
|
removed. Instead we trust in the switches which are set during
|
||||||
|
library initialization. This is enough to protect us from using
|
||||||
|
illegal instructions.
|
||||||
|
The performance impact of the former signal handler usage was
|
||||||
|
dramatic.
|
||||||
|
|
||||||
|
Signed-off-by: Felix Beck <felix.beck@de.ibm.com>
|
||||||
|
|
||||||
|
diff -up libica-2/src/s390_aes.c.remove-sigill libica-2/src/s390_aes.c
|
||||||
|
--- libica-2/src/s390_aes.c.remove-sigill 2009-02-04 16:19:22.000000000 +0100
|
||||||
|
+++ libica-2/src/s390_aes.c 2011-01-04 11:53:08.000000000 +0100
|
||||||
|
@@ -24,23 +24,13 @@ static int s390_aes_ecb_hw(unsigned int
|
||||||
|
unsigned char *input_data, unsigned char *keys,
|
||||||
|
unsigned char *output_data)
|
||||||
|
{
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
-
|
||||||
|
int rc = 0;
|
||||||
|
- if ((rc = begin_sigill_section(&oldact, &oldset)) == 0) {
|
||||||
|
-
|
||||||
|
- rc = s390_km(function_code, keys, output_data, input_data,
|
||||||
|
- input_length);
|
||||||
|
-
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
-
|
||||||
|
- if (rc >= 0)
|
||||||
|
- return 0;
|
||||||
|
- else
|
||||||
|
- return EIO;
|
||||||
|
- }
|
||||||
|
- return rc;
|
||||||
|
+ rc = s390_km(function_code, keys, output_data, input_data,
|
||||||
|
+ input_length);
|
||||||
|
+ if (rc >= 0)
|
||||||
|
+ return 0;
|
||||||
|
+ else
|
||||||
|
+ return EIO;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int s390_aes_ecb_sw(unsigned int function_code, unsigned int input_length,
|
||||||
|
@@ -73,8 +63,6 @@ static int s390_aes_cbc_hw(unsigned int
|
||||||
|
unsigned char *input_data, ica_aes_vector_t *iv,
|
||||||
|
unsigned char *keys, unsigned char *output_data)
|
||||||
|
{
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
struct {
|
||||||
|
ica_aes_vector_t iv;
|
||||||
|
ica_aes_key_len_256_t keys;
|
||||||
|
@@ -87,12 +75,8 @@ static int s390_aes_cbc_hw(unsigned int
|
||||||
|
memcpy(&key_buffer.keys, keys, key_size);
|
||||||
|
|
||||||
|
int rc = 0;
|
||||||
|
- if ((rc = begin_sigill_section(&oldact, &oldset)) != 0)
|
||||||
|
- return rc;
|
||||||
|
-
|
||||||
|
rc = s390_kmc(function_code, &key_buffer,
|
||||||
|
output_data, input_data, input_length);
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
|
||||||
|
if (rc >= 0) {
|
||||||
|
memcpy(iv, &key_buffer.iv, sizeof(ica_aes_vector_t));
|
||||||
|
diff -up libica-2/src/s390_des.c.remove-sigill libica-2/src/s390_des.c
|
||||||
|
--- libica-2/src/s390_des.c.remove-sigill 2009-02-05 16:53:00.000000000 +0100
|
||||||
|
+++ libica-2/src/s390_des.c 2011-01-04 11:53:08.000000000 +0100
|
||||||
|
@@ -25,20 +25,13 @@ int s390_des_ecb_hw(unsigned int functio
|
||||||
|
unsigned char *output_data)
|
||||||
|
{
|
||||||
|
int rc = 0;
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
- if ((rc = begin_sigill_section(&oldact, &oldset)) == 0) {
|
||||||
|
- rc = s390_km(function_code, keys, output_data, input_data,
|
||||||
|
- input_length);
|
||||||
|
-
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
-
|
||||||
|
- if (rc >= 0)
|
||||||
|
- return 0;
|
||||||
|
- else
|
||||||
|
- return EIO;
|
||||||
|
- }
|
||||||
|
- return rc;
|
||||||
|
+ rc = s390_km(function_code, keys, output_data, input_data,
|
||||||
|
+ input_length);
|
||||||
|
+
|
||||||
|
+ if (rc >= 0)
|
||||||
|
+ return 0;
|
||||||
|
+ else
|
||||||
|
+ return EIO;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@@ -109,8 +102,6 @@ static int s390_des_cbc_hw(unsigned int
|
||||||
|
unsigned char *input_data, ica_des_vector_t *iv,
|
||||||
|
unsigned char *keys, unsigned char *output_data)
|
||||||
|
{
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
struct {
|
||||||
|
ica_des_vector_t iv;
|
||||||
|
ica_des_key_triple_t keys;
|
||||||
|
@@ -122,17 +113,13 @@ static int s390_des_cbc_hw(unsigned int
|
||||||
|
memcpy(&key_buffer.iv, iv, sizeof(ica_des_vector_t));
|
||||||
|
memcpy(&key_buffer.keys, keys, key_size);
|
||||||
|
|
||||||
|
- if ((rc = begin_sigill_section(&oldact, &oldset)) == 0) {
|
||||||
|
- rc = s390_kmc(function_code, &key_buffer, output_data, input_data,
|
||||||
|
- input_length);
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
- if (rc >= 0) {
|
||||||
|
- memcpy(iv, &key_buffer.iv, sizeof(ica_des_vector_t));
|
||||||
|
- return 0;
|
||||||
|
- } else
|
||||||
|
- rc = EIO;
|
||||||
|
- }
|
||||||
|
- return rc;
|
||||||
|
+ rc = s390_kmc(function_code, &key_buffer, output_data, input_data,
|
||||||
|
+ input_length);
|
||||||
|
+ if (rc >= 0) {
|
||||||
|
+ memcpy(iv, &key_buffer.iv, sizeof(ica_des_vector_t));
|
||||||
|
+ return 0;
|
||||||
|
+ } else
|
||||||
|
+ rc = EIO;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
diff -up libica-2/src/s390_prng.c.remove-sigill libica-2/src/s390_prng.c
|
||||||
|
--- libica-2/src/s390_prng.c.remove-sigill 2011-01-04 11:53:08.000000000 +0100
|
||||||
|
+++ libica-2/src/s390_prng.c 2011-01-04 11:53:08.000000000 +0100
|
||||||
|
@@ -67,27 +67,22 @@ int s390_prng_init(void)
|
||||||
|
{
|
||||||
|
sem_init(&semaphore, 0, 1);
|
||||||
|
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
int rc = -1;
|
||||||
|
- if (begin_sigill_section(&oldact, &oldset) == 0) {
|
||||||
|
- int handle;
|
||||||
|
- unsigned char seed[16];
|
||||||
|
- handle = open("/dev/hwrng", O_RDONLY);
|
||||||
|
- if (!handle)
|
||||||
|
- handle = open("/dev/urandom", O_RDONLY);
|
||||||
|
- if (handle) {
|
||||||
|
- rc = read(handle, seed, sizeof(seed));
|
||||||
|
- if (rc != -1)
|
||||||
|
- rc = s390_prng_seed(seed, sizeof(seed) /
|
||||||
|
- sizeof(long long));
|
||||||
|
- close(handle);
|
||||||
|
- } else
|
||||||
|
- rc = ENODEV;
|
||||||
|
+ int handle;
|
||||||
|
+ unsigned char seed[16];
|
||||||
|
+ handle = open("/dev/hwrng", O_RDONLY);
|
||||||
|
+ if (!handle)
|
||||||
|
+ handle = open("/dev/urandom", O_RDONLY);
|
||||||
|
+ if (handle) {
|
||||||
|
+ rc = read(handle, seed, sizeof(seed));
|
||||||
|
+ if (rc != -1)
|
||||||
|
+ rc = s390_prng_seed(seed, sizeof(seed) /
|
||||||
|
+ sizeof(long long));
|
||||||
|
+ close(handle);
|
||||||
|
+ } else
|
||||||
|
+ rc = ENODEV;
|
||||||
|
// If the original seeding failed, we should try to stir in some
|
||||||
|
// entropy anyway (since we already put out a message).
|
||||||
|
- }
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
s390_byte_count = 0;
|
||||||
|
|
||||||
|
if (rc < 0)
|
||||||
|
@@ -107,11 +102,9 @@ static int s390_add_entropy(void)
|
||||||
|
unsigned char entropy[4 * STCK_BUFFER];
|
||||||
|
unsigned int K;
|
||||||
|
int rc = 0;
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
|
||||||
|
- if (begin_sigill_section(&oldact, &oldset) != 0)
|
||||||
|
- return errno;
|
||||||
|
+ if (!prng_switch)
|
||||||
|
+ return ENOTSUP;
|
||||||
|
|
||||||
|
for (K = 0; K < 16; K++) {
|
||||||
|
if ((s390_stck(entropy + 0 * STCK_BUFFER)) ||
|
||||||
|
@@ -145,7 +138,6 @@ out:
|
||||||
|
rc = 0;
|
||||||
|
else
|
||||||
|
rc = EIO;
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -190,12 +182,6 @@ static int s390_prng_hw(unsigned char *r
|
||||||
|
unsigned char last_dw[STCK_BUFFER];
|
||||||
|
int rc = 0;
|
||||||
|
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
-
|
||||||
|
- if ((rc = begin_sigill_section(&oldact, &oldset)) != 0)
|
||||||
|
- return rc;
|
||||||
|
-
|
||||||
|
sem_wait(&semaphore);
|
||||||
|
|
||||||
|
/* Add some additional entropy when the byte count is reached.*/
|
||||||
|
@@ -239,7 +225,6 @@ static int s390_prng_hw(unsigned char *r
|
||||||
|
return EIO;
|
||||||
|
|
||||||
|
}
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
sem_post(&semaphore);
|
||||||
|
|
||||||
|
return rc;
|
||||||
|
@@ -252,10 +237,8 @@ static int s390_prng_hw(unsigned char *r
|
||||||
|
*/
|
||||||
|
static int s390_prng_seed(void *srv, unsigned int count)
|
||||||
|
{
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
- if (begin_sigill_section(&oldact, &oldset) != 0)
|
||||||
|
- return errno;
|
||||||
|
+ if (!prng_switch)
|
||||||
|
+ return ENOTSUP;
|
||||||
|
|
||||||
|
unsigned int i;
|
||||||
|
int rc;
|
||||||
|
@@ -269,6 +252,5 @@ static int s390_prng_seed(void *srv, uns
|
||||||
|
// Stir one last time.
|
||||||
|
rc = s390_add_entropy();
|
||||||
|
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
diff -up libica-2/src/s390_sha.c.remove-sigill libica-2/src/s390_sha.c
|
||||||
|
--- libica-2/src/s390_sha.c.remove-sigill 2009-02-04 16:19:22.000000000 +0100
|
||||||
|
+++ libica-2/src/s390_sha.c 2011-01-04 11:53:08.000000000 +0100
|
||||||
|
@@ -79,9 +79,6 @@ static int s390_sha_hw(unsigned char *iv
|
||||||
|
* this can be at most 128 byte for the hash plus 16 byte for the
|
||||||
|
* stream length. */
|
||||||
|
unsigned char shabuff[128 + 16];
|
||||||
|
- struct sigaction oldact;
|
||||||
|
- sigset_t oldset;
|
||||||
|
-
|
||||||
|
unsigned char *default_iv = sha_constants[sha_function].default_iv;
|
||||||
|
unsigned int hash_length = sha_constants[sha_function].hash_length;
|
||||||
|
unsigned int vector_length = sha_constants[sha_function].vector_length;
|
||||||
|
@@ -111,10 +108,6 @@ static int s390_sha_hw(unsigned char *iv
|
||||||
|
message_part == SHA_MSG_PART_MIDDLE) && (remnant != 0))
|
||||||
|
return EINVAL;
|
||||||
|
|
||||||
|
- rc = begin_sigill_section(&oldact, &oldset);
|
||||||
|
- if (rc)
|
||||||
|
- return rc;
|
||||||
|
-
|
||||||
|
unsigned int hw_function_code;
|
||||||
|
hw_function_code = sha_constants[sha_function].hw_function_code;
|
||||||
|
if (complete_blocks_length) {
|
||||||
|
@@ -154,8 +147,6 @@ static int s390_sha_hw(unsigned char *iv
|
||||||
|
rc = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
- end_sigill_section(&oldact, &oldset);
|
||||||
|
-
|
||||||
|
if (rc == 0) {
|
||||||
|
memcpy((void *)output_data, shabuff, hash_length);
|
||||||
|
if (message_part != SHA_MSG_PART_FINAL &&
|
||||||
34
libica-2.0.3-tests.patch
Normal file
34
libica-2.0.3-tests.patch
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
From e4d6efb9159a97c02e0569e91b47fbedd85fdbe7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||||
|
Date: Tue, 9 Nov 2010 09:50:19 +0100
|
||||||
|
Subject: [PATCH] return a zero is missing in old_api_sha_test() in libica_sha1_test
|
||||||
|
|
||||||
|
The libica_sha1_test fails with an error although the actual test were
|
||||||
|
successful:
|
||||||
|
|
||||||
|
...
|
||||||
|
All SHA1 tests completed successfully
|
||||||
|
old_api_sha_test failed with rc = 446276480
|
||||||
|
|
||||||
|
The reason is missing "return 0;" at the end of the old_api_sha_test()
|
||||||
|
function.
|
||||||
|
---
|
||||||
|
src/tests/libica_sha1_test.c | 2 +-
|
||||||
|
1 files changed, 1 insertions(+), 1 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/tests/libica_sha1_test.c b/src/tests/libica_sha1_test.c
|
||||||
|
index 4e21ff4..d4b613b 100644
|
||||||
|
--- a/src/tests/libica_sha1_test.c
|
||||||
|
+++ b/src/tests/libica_sha1_test.c
|
||||||
|
@@ -217,7 +217,7 @@ int old_api_sha_test(void)
|
||||||
|
|
||||||
|
icaCloseAdapter(adapter_handle);
|
||||||
|
|
||||||
|
-
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int new_api_sha_test(void)
|
||||||
|
--
|
||||||
|
1.7.3.2
|
||||||
|
|
||||||
22
libica.spec
22
libica.spec
@ -1,11 +1,15 @@
|
|||||||
Summary: Library for accessing ICA hardware crypto on IBM zSeries
|
Summary: Library for accessing ICA hardware crypto on IBM zSeries
|
||||||
Name: libica
|
Name: libica
|
||||||
Version: 2.0.3
|
Version: 2.0.4
|
||||||
Release: 2%{?dist}
|
Release: 1%{?dist}
|
||||||
License: CPL
|
License: CPL
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
URL: http://sourceforge.net/projects/opencryptoki/
|
URL: http://sourceforge.net/projects/opencryptoki/
|
||||||
Source0: http://downloads.sourceforge.net/opencryptoki/%{name}-%{version}.tar.gz
|
Source0: http://downloads.sourceforge.net/opencryptoki/%{name}-%{version}.tar.gz
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=624005
|
||||||
|
Patch1: %{name}-2.0.3-tests.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=665401
|
||||||
|
Patch2: %{name}-2.0.3-remove-sigill.patch
|
||||||
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||||
BuildRequires: openssl-devel
|
BuildRequires: openssl-devel
|
||||||
BuildRequires: autoconf automake libtool
|
BuildRequires: autoconf automake libtool
|
||||||
@ -31,7 +35,10 @@ IBM zSeries.
|
|||||||
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n %{name}-2
|
%setup -q -n %{name}-2.0
|
||||||
|
|
||||||
|
%patch1 -p1 -b .tests
|
||||||
|
%patch2 -p1 -b .remove-sigill
|
||||||
|
|
||||||
# fix EOLs
|
# fix EOLs
|
||||||
sed -i -e 's/\r//g' LICENSE
|
sed -i -e 's/\r//g' LICENSE
|
||||||
@ -75,6 +82,15 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jan 12 2011 Dan Horák <dan[at]danny.cz> - 2.0.4-1
|
||||||
|
- Do not use sigill to wrap all HW instructions (#665401)
|
||||||
|
- updated to 2.0.4
|
||||||
|
|
||||||
|
* Tue Nov 8 2010 Dan Horák <dhorak@redhat.com> - 2.0.3-3
|
||||||
|
- Fix the return value of old_api_sha_test() in libica_sha1_test (#624005)
|
||||||
|
- Use the right buffer length when operating in 32-bit mode (#640035)
|
||||||
|
- Resolves: #624005, #640035
|
||||||
|
|
||||||
* Fri May 21 2010 Dan Horák <dan[at]danny.cz> - 2.0.3-2
|
* Fri May 21 2010 Dan Horák <dan[at]danny.cz> - 2.0.3-2
|
||||||
- rebuilt with -fno-strict-aliasing (#593779)
|
- rebuilt with -fno-strict-aliasing (#593779)
|
||||||
- Resolves: #593779
|
- Resolves: #593779
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user