|
Bugzilla – Full Text Bug Listing |
| Summary: | VIA padlock support on 64 systems accidentally removed. | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 12.2 | Reporter: | Franz Wudy <franz.wudy> |
| Component: | Basesystem | Assignee: | Guan Jun He <gjhe> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | ||
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | 64bit | ||
| OS: | openSUSE 12.2 | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | patch to enable via-padlock to x86_64 gcc. | ||
openssl rather than openssh issue Created attachment 512782 [details]
patch to enable via-padlock to x86_64 gcc.
please help to test the patch attached, thanks. Thanks Mr. He. I got the sources downloaded and the engine patched. ./Configure and ./make went through without any problems. Testing: /usr/src/packages/SOURCES/openssl-1.0.1c/openssl-1.0.1c/apps # ./openssl version -a OpenSSL 1.0.1c 10 May 2012 built on: Wed Nov 14 12:57:23 EST 2012 platform: linux-x86_64 options: bn(64,64) rc4(8x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/local/ssl" /usr/src/packages/SOURCES/openssl-1.0.1c/openssl-1.0.1c/apps # ./openssl speed -evp aes-128-ecb -engine padlock engine "padlock" set. Doing aes-128-ecb for 3s on 16 size blocks: 21636360 aes-128-ecb's in 2.99s Doing aes-128-ecb for 3s on 64 size blocks: 17974821 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 256 size blocks: 9937132 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 1024 size blocks: 3528344 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 8192 size blocks: 502598 aes-128-ecb's in 3.00s OpenSSL 1.0.1c 10 May 2012 built on: Wed Nov 14 12:57:23 EST 2012 options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-ecb 115779.85k 383462.85k 847968.60k 1204341.42k 1372427.61k WOW! from 50850.47k to 1372427.61k. That's an improvement! Seems to work. I am not brave enough to issue a "make install" on the live machine. Do you think it would be possible to include the patch on your building machines and deliver it with the next update? Thanks for your help. Franz BTW: The outputs from the original build: # openssl version -a OpenSSL 1.0.1c 10 May 2012 built on: 2012-05-10 19:31:27.000000000 +0000 platform: linux-x86_64 options: bn(64,64) rc4(8x,int) des(idx,cisc,16,int) blowfish(idx) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -fmessage-length=0 -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -std=gnu99 -Wa,--noexecstack -fomit-frame-pointer -DTERMIO -DPURIFY -DSSL_FORBID_ENULL -D_GNU_SOURCE -Wall -fstack-protector -Wa,--noexecstack -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/etc/ssl" openssl speed -evp aes-128-ecb -engine padlock invalid engine "padlock" 140484370863784:error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521: 140484370863784:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=padlock 140484370863784:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(libpadlock.so): libpadlock.so: cannot open shared object file: No such file or directory 140484370863784:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: 140484370863784:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450: Doing aes-128-ecb for 3s on 16 size blocks: 8468331 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 64 size blocks: 2315304 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 256 size blocks: 588843 aes-128-ecb's in 3.00s Doing aes-128-ecb for 3s on 1024 size blocks: 148641 aes-128-ecb's in 2.99s Doing aes-128-ecb for 3s on 8192 size blocks: 18623 aes-128-ecb's in 3.00s OpenSSL 1.0.1c 10 May 2012 built on: 2012-05-10 19:31:27.000000000 +0000 options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -fmessage-length=0 -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -std=gnu99 -Wa,--noexecstack -fomit-frame-pointer -DTERMIO -DPURIFY -DSSL_FORBID_ENULL -D_GNU_SOURCE -Wall -fstack-protector -Wa,--noexecstack -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-ecb 45164.43k 49393.15k 50247.94k 50905.81k 50853.21k Some of the compiler options are a little different. Also IDEA cipher is under the options list now. Franz please help to do more test, not only speed, but also correctness. We are considering to deliver the update. okay. I en-crypted the ogg manual pages file once using the "old" openssl and once using the "new" openssl. Then I de-crypted the files again. Then I created SHA1 hashes of the so treated files: $ ./sha1sum ogg* 77c0951aa2c0b4ea6dc2aabf7d0c538dc26f1ae3 ogg123 9f8655b24807f4ea36c04b33e73ba78a497ac008 ogg123_old_enc 77c0951aa2c0b4ea6dc2aabf7d0c538dc26f1ae3 ogg123_old_enc_dec 843f9dd825c1b7fabd1e4e2031fe397ba0fed3e1 ogg123_new_enc 77c0951aa2c0b4ea6dc2aabf7d0c538dc26f1ae3 ogg123_new_enc_dec ogg123 is the original file. ogg123_old_enc is the the file encrypted using the old openssl. ogg123_old_enc_dec is the again de-crypted files. As expected the hashes match. Same for files ogg123_new_enc and ogg123_new_enc_dec only using the new openssl. In this case hashes match, too. So as far as I am concerned the correctness is ensured. Let me know if you need more. Franz That's good! thanks a lot for your help. We will do more test and deliver an update. Update released for openSUSE 12.2. Resolved fixed. openSUSE-RU-2012:1539-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 784994 CVE References: Sources used: openSUSE 12.2 (src): openssl-1.0.1c-2.4.1 openSUSE-RU-2012:1543-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 784994 CVE References: Sources used: openSUSE 12.2 (src): openssl-1.0.1c-2.4.1 openSUSE-RU-2012:1546-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 784994 CVE References: Sources used: openSUSE 12.2 (src): openssl-1.0.1c-2.4.1 openSUSE-RU-2014:0249-1: An update that solves four vulnerabilities and has 5 fixes is now available. Category: recommended (moderate) Bug References: 670526,720601,784994,793420,802184,803004,849377,856687,857203 CVE References: CVE-2011-0014,CVE-2012-4929,CVE-2013-6449,CVE-2013-6450 Sources used: openSUSE 11.4 (src): openssh-5.8p1-7.2, openssh-askpass-gnome-5.8p1-7.1, openssl-1.0.1e-53.1 SUSE-FU-2022:0445-1: An update that solves 183 vulnerabilities, contains 21 features and has 299 fixes is now available. Category: feature (moderate) Bug References: 1000080,1000117,1000194,1000677,1000742,1001148,1001912,1002585,1002895,1003091,1005246,1009528,1010874,1010966,1011936,1015549,1019637,1021641,1022085,1022086,1022271,1027079,1027610,1027688,1027705,1027908,1028281,1028723,1029523,1029902,1030038,1032118,1032119,1035604,1039469,1040164,1040256,1041090,1042392,1042670,1044095,1044107,1044175,1049186,1049304,1050653,1050665,1055478,1055542,1055825,1056058,1056951,1057496,1062237,1065363,1066242,1066873,1068790,1070737,1070738,1070853,1071905,1071906,1071941,1073310,1073845,1073879,1074247,1076519,1077096,1077230,1078329,1079761,1080301,1081005,1081750,1081751,1082155,1082163,1082318,1083826,1084117,1084157,1085276,1085529,1085661,1087102,1087104,1088573,1089039,1090427,1090765,1090953,1093518,1093917,1094788,1094814,1094883,1095267,1096738,1096937,1097158,1097531,1097624,1098535,1098592,1099308,1099569,1100078,1101246,1101470,1102868,1104789,1106197,1108508,1109882,1109998,1110435,1110869,1110871,1111493,1111622,1111657,1112209,1112357,1113534,1113652,1113742,1113975,1115769,1117951,1118611,1119376,1119416,1119792,1121717,1121852,1122191,1123064,1123185,1123186,1123558,1124885,1125815,1126283,1126318,1127080,1127173,1128146,1128323,1128355,1129071,1129566,1130840,1131291,1132174,1132323,1132455,1132663,1132900,1135009,1136444,1138666,1138715,1138746,1139915,1140255,1141168,1142899,1143033,1143454,1143893,1144506,1149686,1149792,1150003,1150190,1150250,1150895,1153830,1155815,1156677,1156694,1156908,1157104,1157354,1158809,1159235,1159538,1160163,1161557,1161770,1162224,1162367,1162743,1163978,1164310,1165439,1165578,1165730,1165823,1165960,1166139,1166758,1167008,1167501,1167732,1167746,1168480,1168973,1169489,1170175,1170863,1171368,1171561,1172226,1172908,1172928,1173226,1173356,1174009,1174091,1174514,1175729,1176116,1176129,1176134,1176232,1176256,1176257,1176258,1176259,1176262,1176389,1176785,1176977,1177120,1177127,1177559,1178168,1178341,1178670,1179491,1179562,1179630,1179805,1180125,1180781,1181126,1181324,1181944,1182066,1182211,1182244,1182264,1182331,1182333,1182379,1182963,1183059,1183374,1183858,1184505,1185588,1185706,1185748,1186738,1187045,1189521,1190781,1193357,356549,381844,394317,408865,428177,430141,431945,437293,442740,459468,489641,504687,509031,526319,590833,610223,610642,629905,637176,651003,657698,658604,670526,673071,693027,715423,720601,743787,747125,748738,749210,749213,749735,750618,751718,751946,751977,754447,754677,761500,774710,784670,784994,787526,793420,799119,802184,803004,809831,811890,822642,825221,828513,831629,832833,834601,835687,839107,84331,849377,855666,855676,856687,857203,857850,858239,867887,869945,871152,872299,873351,876282,876710,876712,876748,880891,885662,885882,889013,889363,892477,892480,895129,898917,901223,901277,901902,902364,906878,907584,908362,908372,912014,912015,912018,912292,912293,912294,912296,912460,913229,915479,917607,917759,917815,919648,920236,922448,922488,922496,922499,922500,926597,929678,929736,930189,931698,931978,933898,933911,934487,934489,934491,934493,935856,937085,937212,937492,937634,937912,939456,940608,942385,942751,943421,944204,945455,946648,947104,947357,947679,948198,952871,954256,954486,954690,957812,957813,957815,958501,961334,962291,963415,963974,964204,964472,964474,965830,967128,968046,968047,968048,968050,968265,968270,968374,968601,975875,976942,977584,977614,977615,977616,977663,978224,981848,982268,982575,983249,984323,985054,988086,990207,990392,990419,990428,991193,991877,992120,992988,992989,992992,993130,993819,993825,993968,994749,994844,994910,995075,995324,995359,995377,995959,996255,997043,997614,998190,999665,999666,999668 CVE References: CVE-2006-2937,CVE-2006-2940,CVE-2006-3738,CVE-2006-4339,CVE-2006-4343,CVE-2006-7250,CVE-2007-3108,CVE-2007-4995,CVE-2007-5135,CVE-2008-0891,CVE-2008-1672,CVE-2008-5077,CVE-2009-0590,CVE-2009-0591,CVE-2009-0789,CVE-2009-1377,CVE-2009-1378,CVE-2009-1379,CVE-2009-1386,CVE-2009-1387,CVE-2010-0740,CVE-2010-0742,CVE-2010-1633,CVE-2010-2939,CVE-2010-3864,CVE-2010-5298,CVE-2011-0014,CVE-2011-3207,CVE-2011-3210,CVE-2011-3389,CVE-2011-4108,CVE-2011-4576,CVE-2011-4577,CVE-2011-4619,CVE-2011-4944,CVE-2012-0027,CVE-2012-0050,CVE-2012-0845,CVE-2012-0884,CVE-2012-1150,CVE-2012-1165,CVE-2012-2110,CVE-2012-2686,CVE-2012-4929,CVE-2013-0166,CVE-2013-0169,CVE-2013-1752,CVE-2013-4238,CVE-2013-4314,CVE-2013-4353,CVE-2013-6449,CVE-2013-6450,CVE-2014-0012,CVE-2014-0076,CVE-2014-0160,CVE-2014-0195,CVE-2014-0198,CVE-2014-0221,CVE-2014-0224,CVE-2014-1829,CVE-2014-1830,CVE-2014-2667,CVE-2014-3470,CVE-2014-3505,CVE-2014-3506,CVE-2014-3507,CVE-2014-3508,CVE-2014-3509,CVE-2014-3510,CVE-2014-3511,CVE-2014-3512,CVE-2014-3513,CVE-2014-3566,CVE-2014-3567,CVE-2014-3568,CVE-2014-3570,CVE-2014-3571,CVE-2014-3572,CVE-2014-4650,CVE-2014-5139,CVE-2014-7202,CVE-2014-7203,CVE-2014-8275,CVE-2014-9721,CVE-2015-0204,CVE-2015-0205,CVE-2015-0206,CVE-2015-0209,CVE-2015-0286,CVE-2015-0287,CVE-2015-0288,CVE-2015-0289,CVE-2015-0293,CVE-2015-1788,CVE-2015-1789,CVE-2015-1790,CVE-2015-1791,CVE-2015-1792,CVE-2015-2296,CVE-2015-3194,CVE-2015-3195,CVE-2015-3196,CVE-2015-3197,CVE-2015-3216,CVE-2015-4000,CVE-2016-0702,CVE-2016-0705,CVE-2016-0797,CVE-2016-0798,CVE-2016-0799,CVE-2016-0800,CVE-2016-10745,CVE-2016-2105,CVE-2016-2106,CVE-2016-2107,CVE-2016-2109,CVE-2016-2176,CVE-2016-2177,CVE-2016-2178,CVE-2016-2179,CVE-2016-2180,CVE-2016-2181,CVE-2016-2182,CVE-2016-2183,CVE-2016-6302,CVE-2016-6303,CVE-2016-6304,CVE-2016-6306,CVE-2016-7052,CVE-2016-7055,CVE-2016-9015,CVE-2017-18342,CVE-2017-3731,CVE-2017-3732,CVE-2017-3735,CVE-2017-3736,CVE-2017-3737,CVE-2017-3738,CVE-2018-0732,CVE-2018-0734,CVE-2018-0737,CVE-2018-0739,CVE-2018-18074,CVE-2018-20060,CVE-2018-5407,CVE-2018-7750,CVE-2019-10906,CVE-2019-11236,CVE-2019-11324,CVE-2019-13132,CVE-2019-1547,CVE-2019-1551,CVE-2019-1559,CVE-2019-1563,CVE-2019-20907,CVE-2019-20916,CVE-2019-5010,CVE-2019-6250,CVE-2019-8341,CVE-2019-9740,CVE-2019-9947,CVE-2020-14343,CVE-2020-15166,CVE-2020-15523,CVE-2020-15801,CVE-2020-1747,CVE-2020-1971,CVE-2020-25659,CVE-2020-26137,CVE-2020-27783,CVE-2020-28493,CVE-2020-29651,CVE-2020-36242,CVE-2020-8492,CVE-2021-23336,CVE-2021-23840,CVE-2021-23841,CVE-2021-28957,CVE-2021-29921,CVE-2021-3177,CVE-2021-33503,CVE-2021-3426,CVE-2021-3712 JIRA References: ECO-3105,SLE-11435,SLE-12684,SLE-12986,SLE-13688,SLE-14253,SLE-15159,SLE-15860,SLE-15861,SLE-16754,SLE-17532,SLE-17957,SLE-18260,SLE-18354,SLE-18446,SLE-19264,SLE-3887,SLE-4480,SLE-4577,SLE-7686,SLE-9135 Sources used: SUSE Manager Tools 12-BETA (src): venv-salt-minion-3002.2-3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. |
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1 Running OpenSUSE 12.2 final - 64 bit. Trying to use padlock engine support under openssl with a VIA NANO X2 processor. Does not work: $ openssl engine padlock 140353542751912:error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521: 140353542751912:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=padlock $ openssl version OpenSSL 1.0.1c 10 May 2012 That is a really sad thing as the hardware support of AES encryption is an important thing considering that the processor itself is pretty weak... Sure enough looking at the sources reveals: openssl-1.0-1c/engines/e_padlock.c {...} #undef COMPILE_HW_PADLOCK #if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM) # if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \ (defined(_MSC_VER) && defined(_M_IX86)) # define COMPILE_HW_PADLOCK # endif #endif {...} The engine is not being compiled during the build process (64 bit). There are lots of fixes and patches around. I found one on the SUSE build machine: https://build.opensuse.org/package/files?package=openssl&project=Base%3ASystem&rev=68 openssl-padlock-x86_64-head.patch This patch would allow for the engine to build (I did not test it though - just limited knowledge of how to do that). With revision 69 this patch disappeared without any comment. Is it possible to re-enable this functionality, please? I'd be glad to help and test patches or rpms. One dangerous thing happens if you believe that padlock works on a 64 bit machine as it used to work out of the box on 32 bit machines: Enabling the permanent use of padlock renders your system pretty useless. Openssl is not working any more (without any fallback) and leaves you with all kinds of problems, no Apache, no yast software utility, etc.... Other distributions btw. started to patch on the distri level: E.g. Fedora: * Thu Apr 28 2011 Tomas Mraz <tmraz at redhat.com> 1.0.0d-3 - add support for VIA Padlock on 64bit arch from upstream (#617539) Thanks / Gruesse - Franz Reproducible: Always Steps to Reproduce: 1.openssl engine padlock 2. 3. Actual Results: 140353542751912:error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521: 140353542751912:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=padlock Expected Results: expected it to work :-) $ cat /proc/cpuinfo processor : 0 vendor_id : CentaurHauls cpu family : 6 model : 15 model name : VIA Nano X2 U4025 @ 1.2 GHz stepping : 12 cpu MHz : 1067.000 cache size : 1024 KB physical id : 0 siblings : 2 core id : 0 cpu cores : 1 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc rep_good nopl pni monitor vmx est tm2 ssse3 cx16 xtpr sse4_1 popcnt rng rng_en ace ace_en ace2 phe phe_en pmm pmm_en lahf_lm ida bogomips : 2400.14 clflush size : 64 cache_alignment : 128 address sizes : 36 bits physical, 48 bits virtual power management: processor : 1 vendor_id : CentaurHauls cpu family : 6 model : 15 model name : VIA Nano X2 U4025 @ 1.2 GHz stepping : 12 cpu MHz : 1067.000 cache size : 1024 KB physical id : 0 siblings : 2 core id : 0 cpu cores : 1 apicid : 2 initial apicid : 2 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc rep_good nopl pni monitor vmx est tm2 ssse3 cx16 xtpr sse4_1 popcnt rng rng_en ace ace_en ace2 phe phe_en pmm pmm_en lahf_lm ida bogomips : 2400.14 clflush size : 64 cache_alignment : 128 address sizes : 36 bits physical, 48 bits virtual power management: $uname -a Linux verleihnix 3.4.6-2.10-desktop #1 SMP PREEMPT x86_64 x86_64 x86_64 GNU/Linux