Tim van der Molen (2024-04-12 14:57 +0200): > p5-CryptX contains a vendored copy of libtomcrypt. It uses "-msse4.1 > -maes" to enable AES-NI support. The problem is that these flags are > used for *all* source files. This may cause SIGILL on CPUs without > SSE4.1. > > I think the best solution is for CryptX to use "-msse4.1 -maes" only for > aesni.c. Unfortunately this requires several changes to the libtomcrypt > source. I'm trying to get these changes accepted upstream. > > Is this suitable to put in ports?
Any thoughts on this? I realise it's a bit intrusive. > Index: Makefile > =================================================================== > RCS file: /cvs/ports/security/p5-CryptX/Makefile,v > diff -p -u -r1.12 Makefile > --- Makefile 26 Dec 2023 20:56:24 -0000 1.12 > +++ Makefile 12 Apr 2024 12:51:05 -0000 > @@ -2,6 +2,7 @@ COMMENT = cryptographic toolkit for Perl > > DISTNAME = CryptX-0.080 > CPAN_AUTHOR = MIK > +REVISION = 1 > > CATEGORIES = security > > Index: patches/patch-Makefile_PL > =================================================================== > RCS file: patches/patch-Makefile_PL > diff -N patches/patch-Makefile_PL > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-Makefile_PL 12 Apr 2024 12:51:05 -0000 > @@ -0,0 +1,33 @@ > +Index: Makefile.PL > +--- Makefile.PL.orig > ++++ Makefile.PL > +@@ -3,7 +3,7 @@ use warnings; > + use ExtUtils::MakeMaker; > + use Config; > + > +-my (@EUMM_INC_LIB, $myarflags, $mycflags); > ++my (@EUMM_INC_LIB, $myarflags, $mycflags, $mycflags_aes_ni); > + > + if ($ENV{CRYPTX_CFLAGS} || $ENV{CRYPTX_LDFLAGS}) { > + # EXPERIMENTAL: use system libraries libtomcrypt + libtommath > +@@ -38,7 +38,10 @@ else { > + $ver1 ||= $1 if $Config{gccversion} =~ /^([0-9]+)\./; # > gccversion='10.2.0' > + $ver1 ||= $1 if $Config{gccversion} =~ /LLVM ([0-9]+)\./i; # > gccversion='Apple LLVM 14.0.0 (clang-1400.0.29.202)' > + $ver1 ||= $1 if $Config{gccversion} =~ /Clang ([0-9]+)\./i; # > gccversion='FreeBSD Clang 13.0.0 (g...@github.com:llvm/llvm-project.git > llvmorg-13.0.0-0-gd7b669b3a303)' or 'OpenBSD Clang 13.0.0' > +- $mycflags .= " -msse4.1 -maes" if $ver1 > 4; # supported since gcc-4.4 > ++ if ($ver1 > 4) { > ++ $mycflags .= " -DLTC_AES_NI"; > ++ $mycflags_aes_ni .= " -msse4.1 -maes"; # supported since gcc-4.4 > ++ } > + } > + > + #FIX: this is particularly useful for Debian > https://github.com/DCIT/perl-CryptX/pull/39 > +@@ -117,7 +120,7 @@ sub MY::postamble { > + > + my $extra_targets = qq{ > + \$(MYEXTLIB): src/Makefile > +- cd src && \$(MAKE) ARFLAGS="$myarflags" RANLIB="\$(RANLIB)" AR="\$(AR)" > CC="\$(CC)" LIB_EXT=\$(LIB_EXT) OBJ_EXT=\$(OBJ_EXT) CFLAGS="$mycflags" > ++ cd src && \$(MAKE) ARFLAGS="$myarflags" RANLIB="\$(RANLIB)" AR="\$(AR)" > CC="\$(CC)" LIB_EXT=\$(LIB_EXT) OBJ_EXT=\$(OBJ_EXT) CFLAGS="$mycflags" > CFLAGS_AES_NI="$mycflags_aes_ni" > + }; > + > + $extra_targets = qq{ > Index: patches/patch-src_Makefile > =================================================================== > RCS file: patches/patch-src_Makefile > diff -N patches/patch-src_Makefile > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_Makefile 12 Apr 2024 12:51:05 -0000 > @@ -0,0 +1,10 @@ > +Index: src/Makefile > +--- src/Makefile.orig > ++++ src/Makefile > +@@ -195,3 +195,6 @@ clean: > + > + .c$(OBJ_EXT): > + $(CC) -Iltm -Iltc/headers -DLTC_SOURCE -DLTC_NO_TEST > -DLTC_NO_PROTOTYPES -DLTM_DESC $(CFLAGS) -DARGTYPE=4 -c $< -o $@ > ++ > ++ltc/ciphers/aes/aesni.o: ltc/ciphers/aes/aesni.c > ++ $(CC) -Iltm -Iltc/headers -DLTC_SOURCE -DLTC_NO_TEST > -DLTC_NO_PROTOTYPES -DLTM_DESC $(CFLAGS) $(CFLAGS_AES_NI) -DARGTYPE=4 -c > ltc/ciphers/aes/aesni.c -o ltc/ciphers/aes/aesni.o > Index: patches/patch-src_ltc_ciphers_aes_aes_desc_c > =================================================================== > RCS file: patches/patch-src_ltc_ciphers_aes_aes_desc_c > diff -N patches/patch-src_ltc_ciphers_aes_aes_desc_c > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_ciphers_aes_aes_desc_c 12 Apr 2024 12:51:05 > -0000 > @@ -0,0 +1,57 @@ > +Index: src/ltc/ciphers/aes/aes_desc.c > +--- src/ltc/ciphers/aes/aes_desc.c.orig > ++++ src/ltc/ciphers/aes/aes_desc.c > +@@ -48,7 +48,7 @@ const struct ltc_cipher_descriptor aes_enc_desc = > + #endif > + > + /* Code partially borrowed from > https://software.intel.com/content/www/us/en/develop/articles/intel-sha-extensions.html > */ > +-#if defined(LTC_HAS_AES_NI) > ++#if defined(LTC_AES_NI) > + static LTC_INLINE int s_aesni_is_supported(void) > + { > + static int initialized = 0, is_supported = 0; > +@@ -56,7 +56,7 @@ static LTC_INLINE int s_aesni_is_supported(void) > + if (initialized == 0) { > + int a, b, c, d; > + > +- /* Look for CPUID.1.0.ECX[25] > ++ /* Look for CPUID.1.0.ECX[19] (SSE4.1) and CPUID.1.0.ECX[25] (AES-NI) > + * EAX = 1, ECX = 0 > + */ > + a = 1; > +@@ -67,7 +67,7 @@ static LTC_INLINE int s_aesni_is_supported(void) > + :"a"(a), "c"(c) > + ); > + > +- is_supported = ((c >> 25) & 1); > ++ is_supported = ((c >> 19) & 1) && ((c >> 25) & 1); > + initialized = 1; > + } > + > +@@ -92,7 +92,7 @@ int aesni_is_supported(void) > + */ > + int AES_SETUP(const unsigned char *key, int keylen, int num_rounds, > symmetric_key *skey) > + { > +-#ifdef LTC_HAS_AES_NI > ++#ifdef LTC_AES_NI > + if (s_aesni_is_supported()) { > + return aesni_setup(key, keylen, num_rounds, skey); > + } > +@@ -110,7 +110,7 @@ int AES_SETUP(const unsigned char *key, int keylen, in > + */ > + int AES_ENC(const unsigned char *pt, unsigned char *ct, const symmetric_key > *skey) > + { > +-#ifdef LTC_HAS_AES_NI > ++#ifdef LTC_AES_NI > + if (s_aesni_is_supported()) { > + return aesni_ecb_encrypt(pt, ct, skey); > + } > +@@ -128,7 +128,7 @@ int AES_ENC(const unsigned char *pt, unsigned char *ct > + */ > + int AES_DEC(const unsigned char *ct, unsigned char *pt, const symmetric_key > *skey) > + { > +-#ifdef LTC_HAS_AES_NI > ++#ifdef LTC_AES_NI > + if (s_aesni_is_supported()) { > + return aesni_ecb_decrypt(ct, pt, skey); > + } > Index: patches/patch-src_ltc_ciphers_aes_aesni_c > =================================================================== > RCS file: patches/patch-src_ltc_ciphers_aes_aesni_c > diff -N patches/patch-src_ltc_ciphers_aes_aesni_c > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_ciphers_aes_aesni_c 12 Apr 2024 12:51:05 -0000 > @@ -0,0 +1,12 @@ > +Index: src/ltc/ciphers/aes/aesni.c > +--- src/ltc/ciphers/aes/aesni.c.orig > ++++ src/ltc/ciphers/aes/aesni.c > +@@ -9,7 +9,7 @@ > + > + #include "tomcrypt_private.h" > + > +-#if defined(LTC_HAS_AES_NI) > ++#if defined(LTC_AES_NI) > + > + const struct ltc_cipher_descriptor aesni_desc = > + { > Index: patches/patch-src_ltc_headers_tomcrypt_cfg_h > =================================================================== > RCS file: patches/patch-src_ltc_headers_tomcrypt_cfg_h > diff -N patches/patch-src_ltc_headers_tomcrypt_cfg_h > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_headers_tomcrypt_cfg_h 12 Apr 2024 12:51:05 > -0000 > @@ -0,0 +1,15 @@ > +Index: src/ltc/headers/tomcrypt_cfg.h > +--- src/ltc/headers/tomcrypt_cfg.h.orig > ++++ src/ltc/headers/tomcrypt_cfg.h > +@@ -91,11 +91,6 @@ LTC_EXPORT int LTC_CALL XSTRCMP(const char *s1, cons > + #define ENDIAN_LITTLE > + #define ENDIAN_64BITWORD > + #define LTC_FAST > +- #if defined(__SSE4_1__) > +- #if __SSE4_1__ == 1 > +- #define LTC_AMD64_SSE4_1 > +- #endif > +- #endif > + #endif > + > + /* detect PPC32 */ > Index: patches/patch-src_ltc_headers_tomcrypt_cipher_h > =================================================================== > RCS file: patches/patch-src_ltc_headers_tomcrypt_cipher_h > diff -N patches/patch-src_ltc_headers_tomcrypt_cipher_h > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_headers_tomcrypt_cipher_h 12 Apr 2024 12:51:05 > -0000 > @@ -0,0 +1,12 @@ > +Index: src/ltc/headers/tomcrypt_cipher.h > +--- src/ltc/headers/tomcrypt_cipher.h.orig > ++++ src/ltc/headers/tomcrypt_cipher.h > +@@ -718,7 +718,7 @@ extern const struct ltc_cipher_descriptor rijndael_des > + extern const struct ltc_cipher_descriptor rijndael_enc_desc; > + #endif > + > +-#if defined(LTC_AES_NI) && defined(LTC_AMD64_SSE4_1) > ++#if defined(LTC_AES_NI) > + int aesni_is_supported(void); > + int aesni_setup(const unsigned char *key, int keylen, int num_rounds, > symmetric_key *skey); > + int aesni_ecb_encrypt(const unsigned char *pt, unsigned char *ct, const > symmetric_key *skey); > Index: patches/patch-src_ltc_headers_tomcrypt_custom_h > =================================================================== > RCS file: patches/patch-src_ltc_headers_tomcrypt_custom_h > diff -N patches/patch-src_ltc_headers_tomcrypt_custom_h > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_headers_tomcrypt_custom_h 12 Apr 2024 12:51:05 > -0000 > @@ -0,0 +1,11 @@ > +Index: src/ltc/headers/tomcrypt_custom.h > +--- src/ltc/headers/tomcrypt_custom.h.orig > ++++ src/ltc/headers/tomcrypt_custom.h > +@@ -179,7 +179,6 @@ > + #define LTC_RC6 > + #define LTC_SAFERP > + #define LTC_RIJNDAEL > +-#define LTC_AES_NI > + #define LTC_XTEA > + /* _TABLES tells it to use tables during setup, _SMALL means to use the > smaller scheduled key format > + * (saves 4KB of ram), _ALL_TABLES enables all tables during setup */ > Index: patches/patch-src_ltc_headers_tomcrypt_private_h > =================================================================== > RCS file: patches/patch-src_ltc_headers_tomcrypt_private_h > diff -N patches/patch-src_ltc_headers_tomcrypt_private_h > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_headers_tomcrypt_private_h 12 Apr 2024 12:51:05 > -0000 > @@ -0,0 +1,14 @@ > +Index: src/ltc/headers/tomcrypt_private.h > +--- src/ltc/headers/tomcrypt_private.h.orig > ++++ src/ltc/headers/tomcrypt_private.h > +@@ -77,10 +77,6 @@ typedef struct > + > + /* tomcrypt_cipher.h */ > + > +-#if defined(LTC_AES_NI) && defined(LTC_AMD64_SSE4_1) > +-#define LTC_HAS_AES_NI > +-#endif > +- > + void blowfish_enc(ulong32 *data, unsigned long blocks, const symmetric_key > *skey); > + int blowfish_expand(const unsigned char *key, int keylen, > + const unsigned char *data, int datalen, > Index: patches/patch-src_ltc_misc_crypt_crypt_c > =================================================================== > RCS file: patches/patch-src_ltc_misc_crypt_crypt_c > diff -N patches/patch-src_ltc_misc_crypt_crypt_c > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-src_ltc_misc_crypt_crypt_c 12 Apr 2024 12:51:05 -0000 > @@ -0,0 +1,12 @@ > +Index: src/ltc/misc/crypt/crypt.c > +--- src/ltc/misc/crypt/crypt.c.orig > ++++ src/ltc/misc/crypt/crypt.c > +@@ -416,7 +416,7 @@ const char *crypt_build_settings = > + #if defined(LTC_ADLER32) > + " ADLER32 " > + #endif > +-#if defined(LTC_AES_NI) && defined(LTC_AMD64_SSE4_1) > ++#if defined(LTC_AES_NI) > + " AES-NI " > + #endif > + #if defined(LTC_BASE64) >