diff options
Diffstat (limited to 'gnu/packages/patches')
| -rw-r--r-- | gnu/packages/patches/ddclient-skip-test.patch | 43 | ||||
| -rw-r--r-- | gnu/packages/patches/elogind-fix-rpath.patch | 60 | ||||
| -rw-r--r-- | gnu/packages/patches/elogind-revert-polkit-detection.patch | 41 | ||||
| -rw-r--r-- | gnu/packages/patches/fbreader-fix-icon.patch | 29 | ||||
| -rw-r--r-- | gnu/packages/patches/highlight-gui-data-dir.patch | 51 | ||||
| -rw-r--r-- | gnu/packages/patches/maturin-no-cross-compile.patch | 55 | ||||
| -rw-r--r-- | gnu/packages/patches/mcrl2-fix-1687.patch | 337 | ||||
| -rw-r--r-- | gnu/packages/patches/mcrl2-fix-counterexample.patch | 32 | ||||
| -rw-r--r-- | gnu/packages/patches/openssh-hurd.patch | 30 | ||||
| -rw-r--r-- | gnu/packages/patches/po4a-partial-texinfo-menu-fix.patch | 242 | ||||
| -rw-r--r-- | gnu/packages/patches/rust-nettle-sys-disable-vendor.patch | 48 | ||||
| -rw-r--r-- | gnu/packages/patches/rust-ring-0.16-missing-files.patch | 2293 | ||||
| -rw-r--r-- | gnu/packages/patches/rust-ring-0.16-test-files.patch | 54 |
13 files changed, 2784 insertions, 531 deletions
diff --git a/gnu/packages/patches/ddclient-skip-test.patch b/gnu/packages/patches/ddclient-skip-test.patch deleted file mode 100644 index 28d748997b..0000000000 --- a/gnu/packages/patches/ddclient-skip-test.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e5657802025f238b39581534f3b4d408565c8943 Mon Sep 17 00:00:00 2001 -From: Bruno Victal <mirai@makinata.eu> -Date: Sun, 5 Feb 2023 21:05:00 +0000 -Subject: [PATCH] Disable sandbox incompatible tests. - -See: https://github.com/ddclient/ddclient/issues/465 ---- - t/get_ip_from_if.pl | 21 --------------------- - 1 file changed, 21 deletions(-) - -diff --git a/t/get_ip_from_if.pl b/t/get_ip_from_if.pl -index 6f08e5d..d78c3d0 100644 ---- a/t/get_ip_from_if.pl -+++ b/t/get_ip_from_if.pl -@@ -39,25 +39,4 @@ subtest "get_ip_from_interface tests" => sub { - } - }; - --subtest "Get default interface and IP for test system" => sub { -- my $interface = ddclient::get_default_interface(4); -- if ($interface) { -- isnt($interface, "lo", "Check for loopback 'lo'"); -- isnt($interface, "lo0", "Check for loopback 'lo0'"); -- my $ip1 = ddclient::get_ip_from_interface("default", 4); -- my $ip2 = ddclient::get_ip_from_interface($interface, 4); -- is($ip1, $ip2, "Check IPv4 from default interface"); -- ok(ddclient::is_ipv4($ip1), "Valid IPv4 from get_ip_from_interface($interface)"); -- } -- $interface = ddclient::get_default_interface(6); -- if ($interface) { -- isnt($interface, "lo", "Check for loopback 'lo'"); -- isnt($interface, "lo0", "Check for loopback 'lo0'"); -- my $ip1 = ddclient::get_ip_from_interface("default", 6); -- my $ip2 = ddclient::get_ip_from_interface($interface, 6); -- is($ip1, $ip2, "Check IPv6 from default interface"); -- ok(ddclient::is_ipv6($ip1), "Valid IPv6 from get_ip_from_interface($interface)"); -- } --}; -- - done_testing(); --- -2.38.1 - diff --git a/gnu/packages/patches/elogind-fix-rpath.patch b/gnu/packages/patches/elogind-fix-rpath.patch new file mode 100644 index 0000000000..2a76cc467f --- /dev/null +++ b/gnu/packages/patches/elogind-fix-rpath.patch @@ -0,0 +1,60 @@ +Retrieved from https://github.com/elogind/elogind/issues/258 + +From: Mark Hindley <mark@hindley.org.uk> +Date: Wed, 24 May 2023 10:39:41 +0100 +Subject: Fixup_executable_rpath + +./meson.build sets + + install_rpath : rootlibexecdir + +however src/shared/meson.build sets + +libshared = shared_library( + [snip] + install_dir : rootpkglibdir + ) +--- + meson.build | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/meson.build b/meson.build +index 694a2fd..a575f69 100644 +--- a/meson.build ++++ b/meson.build +@@ -2903,7 +2903,7 @@ executable('elogind', + dependencies : [threads, + libacl, + libudev], +- install_rpath : rootlibexecdir, ++ install_rpath : rootpkglibdir, + install : true, + install_dir : rootlibexecdir) + +@@ -2913,7 +2913,7 @@ exe = executable('loginctl', + link_with : [libshared], + dependencies : [threads, + libudev], +- install_rpath : rootlibexecdir, ++ install_rpath : rootpkglibdir, + install : true, + install_dir : rootbindir) + public_programs += [exe] +@@ -2923,7 +2923,7 @@ exe = executable('elogind-inhibit', + include_directories : includes, + link_with : [libshared], + dependencies : [threads], +- install_rpath : rootlibexecdir, ++ install_rpath : rootpkglibdir, + install : true, + install_dir : rootbindir) + public_programs += [exe] +@@ -4283,7 +4283,7 @@ executable('elogind-uaccess-command', + libshared], + dependencies: [libacl, + libudev], +- install_rpath : rootlibexecdir, ++ install_rpath : rootpkglibdir, + install : true, + install_dir : rootlibexecdir) + #endif // 0 diff --git a/gnu/packages/patches/elogind-revert-polkit-detection.patch b/gnu/packages/patches/elogind-revert-polkit-detection.patch deleted file mode 100644 index 43dd1684b6..0000000000 --- a/gnu/packages/patches/elogind-revert-polkit-detection.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 715ce0a6459e418f92e74c7ce52df3244c18f383 Mon Sep 17 00:00:00 2001 -From: Sven Eden <sven.eden@prydeworx.com> -Date: Mon, 8 Mar 2021 08:40:08 +0100 -Subject: [PATCH] Revert "Disable polkit support if libpolkit is not installed" - -This reverts commit 1194dec4f8f2d1b8bd14e1625f34418ecfce817e. - -Removing polkit support with -Dpolkit=auto when libpolkit is not -installed, removes the whole interface. This makes it impossible to -add polkit support as a runtime dependency. - -Bug: #167 -Closes: #206 -Signed-off-by: Sven Eden <sven.eden@prydeworx.com> ---- - meson.build | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/meson.build b/meson.build -index 2dd05db3c..f38551f55 100644 ---- a/meson.build -+++ b/meson.build -@@ -1157,15 +1157,6 @@ if want_polkit != 'false' and not skip_deps - message('Old polkit detected, will install pkla files') - install_polkit_pkla = true - endif --#if 1 /// Disable polkit completely if libpolkit is not there. See elogind issue #167 -- if not libpolkit.found() -- if want_polkit != 'auto' -- error('Polkit requested but libpolkit was not found.') -- endif -- install_polkit = false -- want_polkit = false -- endif --#endif // 1 - endif - conf.set10('ENABLE_POLKIT', install_polkit) - --- -2.33.1 - diff --git a/gnu/packages/patches/fbreader-fix-icon.patch b/gnu/packages/patches/fbreader-fix-icon.patch new file mode 100644 index 0000000000..635abf6a43 --- /dev/null +++ b/gnu/packages/patches/fbreader-fix-icon.patch @@ -0,0 +1,29 @@ +Author: Danny Milosavljevic <dannym+a@scratchpost.org> +Date: 2023-08-15 + +--- orig/jswba9mn9nh43l7g4w2qslmr7i3q64vy-fbreader-0.99.6-checkout/fbreader/desktop/desktop 2023-08-14 23:56:03.092567740 +0200 ++++ jswba9mn9nh43l7g4w2qslmr7i3q64vy-fbreader-0.99.6-checkout/fbreader/desktop/desktop 2023-08-14 23:56:59.936213278 +0200 +@@ -25,5 +25,5 @@ + StartupNotify=true + Terminal=false + Type=Application +-Icon=FBReader.png ++Icon=FBReader + Categories=Office;Viewer;Literature; +--- orig/jswba9mn9nh43l7g4w2qslmr7i3q64vy-fbreader-0.99.6-checkout/fbreader/desktop/Makefile 2023-08-14 23:56:03.092567740 +0200 ++++ jswba9mn9nh43l7g4w2qslmr7i3q64vy-fbreader-0.99.6-checkout/fbreader/desktop/Makefile 2023-08-15 00:23:19.046691430 +0200 +@@ -10,6 +10,14 @@ + @install -m 0644 desktop $(DESTDIR)/usr/share/applications/$(TARGET).desktop + @install -d $(DESTDIR)$(IMAGEDIR) + @install -m 0644 ../data/icons/application/$(TARGET_ARCH).png $(DESTDIR)$(IMAGEDIR)/FBReader.png ++ @install -d $(DESTDIR)$(SHAREDIR)/icons/hicolor/16x16/apps ++ @install -m 0644 ../data/icons/application/16x16.png $(DESTDIR)$(SHAREDIR)/icons/hicolor/16x16/apps/FBReader.png ++ @install -d $(DESTDIR)$(SHAREDIR)/icons/hicolor/32x32/apps ++ @install -m 0644 ../data/icons/application/32x32.png $(DESTDIR)$(SHAREDIR)/icons/hicolor/32x32/apps/FBReader.png ++ @install -d $(DESTDIR)$(SHAREDIR)/icons/hicolor/48x48/apps ++ @install -m 0644 ../data/icons/application/48x48.png $(DESTDIR)$(SHAREDIR)/icons/hicolor/48x48/apps/FBReader.png ++ @install -d $(DESTDIR)$(SHAREDIR)/icons/hicolor/64x64/apps ++ @install -m 0644 ../data/icons/application/64x64.png $(DESTDIR)$(SHAREDIR)/icons/hicolor/64x64/apps/FBReader.png + @install -m 0644 ../data/default/config.desktop.xml $(SHARE_FBREADER)/default/config.xml + @install -m 0644 ../data/default/keymap.desktop.xml $(SHARE_FBREADER)/default/keymap.xml + @install -m 0644 ../data/default/styles.desktop.xml $(SHARE_FBREADER)/default/styles.xml diff --git a/gnu/packages/patches/highlight-gui-data-dir.patch b/gnu/packages/patches/highlight-gui-data-dir.patch new file mode 100644 index 0000000000..33f40d309c --- /dev/null +++ b/gnu/packages/patches/highlight-gui-data-dir.patch @@ -0,0 +1,51 @@ +This patch distinguishes between the data directory path for GUI and the one +for non-GUI by allowing to set the former path. + +highlight package has two outputs: out and gui. Both outputs have files which +will be in the same directory /share/highlight/ without this patch (see also +install and install-gui tasks in makefile). In the gui's data directory, +there are GUI specific files in /share/highlight/gui-files/{l10n,ext}/. + +diff --git a/src/gui-qt/main.cpp b/src/gui-qt/main.cpp +index 4700dc1..3567745 100644 +--- a/src/gui-qt/main.cpp ++++ b/src/gui-qt/main.cpp +@@ -47,8 +47,8 @@ int main(int argc, char *argv[]) + { + QApplication app(argc, argv); + QTranslator translator; +-#ifdef DATA_DIR +- translator.load(QString("%1/gui_files/l10n/highlight_%2").arg(DATA_DIR).arg(QLocale::system().name())); ++#ifdef GUI_DATA_DIR ++ translator.load(QString("%1/gui_files/l10n/highlight_%2").arg(GUI_DATA_DIR).arg(QLocale::system().name())); + #else + translator.load(QString("%1/gui_files/l10n/highlight_%2").arg(QDir::currentPath()).arg(QLocale::system().name())); + #endif +diff --git a/src/gui-qt/mainwindow.cpp b/src/gui-qt/mainwindow.cpp +index 3a21ad2..f060431 100644 +--- a/src/gui-qt/mainwindow.cpp ++++ b/src/gui-qt/mainwindow.cpp +@@ -2131,8 +2131,8 @@ QString MainWindow::getDistFileFilterPath(){ + #ifdef Q_OS_OSX + return QCoreApplication::applicationDirPath()+"/../Resources/gui_files/ext/fileopenfilter.conf"; + #else +- #ifdef DATA_DIR +- return QString(DATA_DIR) + "/gui_files/ext/fileopenfilter.conf"; ++ #ifdef GUI_DATA_DIR ++ return QString(GUI_DATA_DIR) + "/gui_files/ext/fileopenfilter.conf"; + #else + return QDir::currentPath()+"/gui_files/ext/fileopenfilter.conf"; + #endif +diff --git a/src/makefile b/src/makefile +index b1d7988..2963105 100644 +--- a/src/makefile ++++ b/src/makefile +@@ -118,7 +118,7 @@ gui-qt: highlight-gui + + highlight-gui: libhighlight.a ${GUI_OBJECTS} + cd gui-qt && \ +- ${QMAKE} 'DEFINES+=DATA_DIR=\\\"${HL_DATA_DIR}\\\" CONFIG_DIR=\\\"${HL_CONFIG_DIR}\\\" DOC_DIR=\\\"${HL_DOC_DIR}\\\" ' && \ ++ ${QMAKE} 'DEFINES+=DATA_DIR=\\\"${HL_DATA_DIR}\\\" CONFIG_DIR=\\\"${HL_CONFIG_DIR}\\\" DOC_DIR=\\\"${HL_DOC_DIR}\\\" GUI_DATA_DIR=\\\"${GUI_DATA_DIR}\\\" ' && \ + $(MAKE) + + $(OBJECTFILES) : makefile diff --git a/gnu/packages/patches/maturin-no-cross-compile.patch b/gnu/packages/patches/maturin-no-cross-compile.patch new file mode 100644 index 0000000000..7394d0854e --- /dev/null +++ b/gnu/packages/patches/maturin-no-cross-compile.patch @@ -0,0 +1,55 @@ +Remove dependencies on xwin and zig. We're not offering cross-compilation +options using these crates. + +diff --git a/Cargo.toml b/Cargo.toml +index 6cbdca3..22ea5ef 100644 +--- a/Cargo.toml ++++ b/Cargo.toml +@@ -76,16 +76,6 @@ version = "0.1.4" + [dependencies.cargo-options] + version = "0.6.0" + +-[dependencies.cargo-xwin] +-version = "0.14.3" +-optional = true +-default-features = false +- +-[dependencies.cargo-zigbuild] +-version = "0.16.10" +-optional = true +-default-features = false +- + [dependencies.cargo_metadata] + version = "0.15.3" + +@@ -310,8 +300,6 @@ version = "4.3.0" + [features] + cli-completion = ["dep:clap_complete_command"] + cross-compile = [ +- "zig", +- "xwin", + ] + default = [ + "full", +@@ -330,7 +318,6 @@ log = ["tracing-subscriber"] + native-tls = [ + "dep:native-tls", + "ureq?/native-tls", +- "cargo-xwin?/native-tls", + "dep:rustls-pemfile", + ] + password-storage = [ +@@ -340,7 +327,6 @@ password-storage = [ + rustls = [ + "dep:rustls", + "ureq?/tls", +- "cargo-xwin?/rustls-tls", + "dep:rustls-pemfile", + ] + scaffolding = [ +@@ -358,5 +344,3 @@ upload = [ + "wild", + "dep:dirs", + ] +-xwin = ["cargo-xwin"] +-zig = ["cargo-zigbuild"] diff --git a/gnu/packages/patches/mcrl2-fix-1687.patch b/gnu/packages/patches/mcrl2-fix-1687.patch deleted file mode 100644 index 449ecbf638..0000000000 --- a/gnu/packages/patches/mcrl2-fix-1687.patch +++ /dev/null @@ -1,337 +0,0 @@ -Taken from upstream: - https://github.com/mCRL2org/mCRL2/commit/f38998be5198236bc5bf5a957b0e132d6d6d8bee - -Fixes bug in ltsconvert: - https://listserver.tue.nl/pipermail/mcrl2-users/2022-June/000395.html - -From f38998be5198236bc5bf5a957b0e132d6d6d8bee Mon Sep 17 00:00:00 2001 -From: Jan Friso Groote <J.F.Groote@tue.nl> -Date: Tue, 28 Jun 2022 12:27:47 +0200 -Subject: [PATCH] Solved bug report #1687 - -Hidden actions were not properly recognized in ltsconvert. Multiactions -that were partly hidden compared with the default action label, and had -to be compared with a tau-action. This caused multiple tau-actions to be -listed in the list of actions of an lts, and this caused other tools to -go astray. - -The code to rename actions has completely be rewritten. - -This should solve #1687. - -A test have been added. ---- - libraries/lts/include/mcrl2/lts/lts.h | 95 ++++++++++++++++++++++--- - libraries/lts/test/lts_test.cpp | 61 ++++++++-------- - tools/release/ltsconvert/ltsconvert.cpp | 3 +- - 3 files changed, 116 insertions(+), 43 deletions(-) - -diff --git a/libraries/lts/include/mcrl2/lts/lts.h b/libraries/lts/include/mcrl2/lts/lts.h -index 095031e7c..8562eb900 100644 ---- a/libraries/lts/include/mcrl2/lts/lts.h -+++ b/libraries/lts/include/mcrl2/lts/lts.h -@@ -25,6 +25,7 @@ - #include <algorithm> - #include <cassert> - #include <set> -+#include <map> - #include "mcrl2/lts/transition.h" - #include "mcrl2/lts/lts_type.h" - -@@ -482,40 +483,112 @@ class lts: public LTS_BASE - return; - } - -+ std::map<labels_size_type, labels_size_type> action_rename_map; - for (labels_size_type i=0; i< num_action_labels(); ++i) - { - ACTION_LABEL_T a=action_label(i); - a.hide_actions(tau_actions); -- if (a==ACTION_LABEL_T()) -+ if (a==ACTION_LABEL_T::tau_action()) - { -- m_hidden_label_set.insert(i); -+ if (i!=const_tau_label_index) -+ { -+ m_hidden_label_set.insert(i); -+ } - } - else if (a!=action_label(i)) - { -- set_action_label(i,a); -+ /* In this the action_label i is changed by the tau_actions but not renamed to tau. -+ We check whether a maps onto another action label index. If yes, it is added to -+ the rename map, and we explicitly rename transition labels with this label afterwards. -+ If no, we rename the action label. -+ */ -+ bool found=false; -+ for (labels_size_type j=0; !found && j< num_action_labels(); ++j) -+ { -+ if (a==action_label(j)) -+ { -+ if (i!=j) -+ { -+ action_rename_map[i]=j; -+ } -+ found=true; -+ } -+ } -+ if (!found) // a!=action_label(j) for any j, then rename action_label(i) to a. -+ { -+ set_action_label(i,a); -+ } -+ } -+ } -+ -+ if (action_rename_map.size()>0) // Check whether there are action labels that must be renamed, and -+ { -+ for(transition& t: m_transitions) -+ { -+ auto i = action_rename_map.find(t.label()); -+ if (i!=action_rename_map.end()) -+ { -+ t=transition(t.from(),i->second,t.to()); -+ } - } - } - } - -- /** \brief Apply the recorded actions that are renamed to internal actions to the lts. -- * \details After hiding actions, it checks whether action labels are -- * equal and merges actions with the same labels in the lts. -+ /** \brief Rename the hidden actions in the lts. -+ * \details Multiactions can be partially renamed. I.e. a|b becomes a if b is hidden. -+ * In such a case the new action a is mapped onto an existing action a; if such -+ * a label a does not exist, the action a|b is renamed to a. - * \param[in] tau_actions Vector with strings indicating which actions must be - * transformed to tau's */ -- void apply_hidden_actions(void) -+ void apply_hidden_actions(const std::vector<std::string>& tau_actions) - { -- if (m_hidden_label_set.size()>0) // Check whether there is something to rename. -+ if (tau_actions.size()==0) -+ { -+ return; -+ } -+ -+ std::map<labels_size_type, labels_size_type> action_rename_map; -+ for (labels_size_type i=0; i< num_action_labels(); ++i) -+ { -+ ACTION_LABEL_T a=action_label(i); -+ a.hide_actions(tau_actions); -+#ifndef NDEBUG -+ ACTION_LABEL_T b=a; -+ b.hide_actions(tau_actions); -+ assert(a==b); // hide_actions applied twice yields the same result as applying it once. -+#endif -+ bool found=false; -+ for (labels_size_type j=0; !found && j< num_action_labels(); ++j) -+ { -+ if (a==action_label(j)) -+ { -+ if (i!=j) -+ { -+ action_rename_map[i]=j; -+ } -+ found=true; -+ } -+ } -+ if (!found) // a!=action_label(j) for any j, then rename action_label(i) to a. -+ { -+ set_action_label(i,a); -+ } -+ } -+ -+ -+ if (action_rename_map.size()>0) // Check whether there is something to rename. - { - for(transition& t: m_transitions) - { -- if (m_hidden_label_set.count(t.label())) -+ auto i = action_rename_map.find(t.label()); -+ if (i!=action_rename_map.end()) - { -- t=transition(t.from(),tau_label_index(),t.to()); -+ t=transition(t.from(),i->second,t.to()); - } - } -- m_hidden_label_set.clear(); // Empty the hidden label set. - } - } -+ - /** \brief Checks whether this LTS has state values associated with its states. - * \retval true if the LTS has state information; - * \retval false otherwise. -diff --git a/libraries/lts/test/lts_test.cpp b/libraries/lts/test/lts_test.cpp -index 5840393d9..ad69f6275 100644 ---- a/libraries/lts/test/lts_test.cpp -+++ b/libraries/lts/test/lts_test.cpp -@@ -149,7 +149,7 @@ static void reduce_lts_in_various_ways(const std::string& test_description, - BOOST_CHECK(is_deterministic(l)); - } - --static void reduce_simple_loop() -+BOOST_AUTO_TEST_CASE(reduce_simple_loop) - { - std::string SIMPLE_AUT = - "des (0,2,2)\n" -@@ -173,7 +173,7 @@ static void reduce_simple_loop() - reduce_lts_in_various_ways("Simple loop", SIMPLE_AUT, expected); - } - --static void reduce_simple_loop_with_tau() -+BOOST_AUTO_TEST_CASE(reduce_simple_loop_with_tau) - { - std::string SIMPLE_AUT = - "des (0,2,2)\n" -@@ -200,7 +200,7 @@ static void reduce_simple_loop_with_tau() - /* The example below was encountered by David Jansen. The problem is that - * for branching bisimulations the tau may supersede the b, not leading to the - * necessary splitting into two equivalence classes. */ --static void tricky_example_for_branching_bisimulation() -+BOOST_AUTO_TEST_CASE(tricky_example_for_branching_bisimulation) - { - std::string TRICKY_BB = - "des (0,3,2)\n" -@@ -226,7 +226,7 @@ static void tricky_example_for_branching_bisimulation() - } - - --static void reduce_abp() -+BOOST_AUTO_TEST_CASE(reduce_abp) - { - std::string ABP_AUT = - "des (0,92,74)\n" -@@ -342,7 +342,7 @@ static void reduce_abp() - - // Peterson's protocol has the interesting property that the number of states modulo branching bisimulation - // differs from the number of states modulo weak bisimulation, as observed by Rob van Glabbeek. --static void reduce_peterson() -+BOOST_AUTO_TEST_CASE(reduce_peterson) - { - std::string PETERSON_AUT = - "des (0,59,35)\n" -@@ -423,7 +423,7 @@ static void reduce_peterson() - reduce_lts_in_various_ways("Peterson protocol", PETERSON_AUT, expected); - } - --static void test_reachability() -+BOOST_AUTO_TEST_CASE(test_reachability) - { - std::string REACH = - "des (0,4,5) \n" -@@ -449,7 +449,7 @@ static void test_reachability() - - // The example below caused failures in the GW mlogn branching bisimulation - // algorithm when cleaning the code up. --static void failing_test_groote_wijs_algorithm() -+BOOST_AUTO_TEST_CASE(failing_test_groote_wijs_algorithm) - { - std::string GWLTS = - "des(0,29,10)\n" -@@ -511,7 +511,7 @@ static void failing_test_groote_wijs_algorithm() - // It has not been implemented fully. The problem is that it is difficult to - // prescribe the order in which refinements have to be done. - --static void counterexample_jk_1(std::size_t k) -+void counterexample_jk_1(std::size_t k) - { - // numbering scheme of states: - // states 0..k-1 are the blue squares -@@ -571,7 +571,7 @@ static void counterexample_jk_1(std::size_t k) - - // In the meantime, the bug is corrected: this is why the first part of the - // algorithm now follows a much simpler line than previously. --static void counterexample_postprocessing() -+BOOST_AUTO_TEST_CASE(counterexample_postprocessing) - { - std::string POSTPROCESS_AUT = - "des(0,33,13)\n" -@@ -634,7 +634,7 @@ static void counterexample_postprocessing() - test_lts("postprocessing problem (branching bisimulation signature [Blom/Orzan 2003])",l,expected_label_count, expected_state_count, expected_transition_count); - } - --static void regression_delete_old_bb_slice() -+BOOST_AUTO_TEST_CASE(regression_delete_old_bb_slice) - { - std::string POSTPROCESS_AUT = - "des(0,163,100)\n" -@@ -824,7 +824,7 @@ static void regression_delete_old_bb_slice() - test_lts("regression test for GJKW bug (branching bisimulation signature [Blom/Orzan 2003])",l,expected_label_count, expected_state_count, expected_transition_count); - } - --void is_deterministic_test1() -+BOOST_AUTO_TEST_CASE(is_deterministic_test1) - { - std::string automaton = - "des(0,2,2)\n" -@@ -837,7 +837,7 @@ void is_deterministic_test1() - BOOST_CHECK(is_deterministic(l_det)); - } - --void is_deterministic_test2() -+BOOST_AUTO_TEST_CASE(is_deterministic_test2) - { - std::string automaton = - "des(0,2,2)\n" -@@ -850,24 +850,25 @@ void is_deterministic_test2() - BOOST_CHECK(!is_deterministic(l_det)); - } - --void test_is_deterministic() -+BOOST_AUTO_TEST_CASE(hide_actions1) - { -- is_deterministic_test1(); -- is_deterministic_test2(); --} -+ std::string automaton = -+ "des (0,4,3)\n" -+ "(0,\"<state>\",1)\n" -+ "(1,\"return|hello\",2)\n" -+ "(1,\"return\",2)\n" -+ "(2,\"world\",1)\n"; -+ -+ std::istringstream is(automaton); -+ lts::lts_aut_t l; -+ l.load(is); -+ std::vector<std::string>hidden_actions(1,"hello"); -+ l.apply_hidden_actions(hidden_actions); -+ reduce(l,lts::lts_eq_bisim); -+ std::size_t expected_label_count = 5; -+ std::size_t expected_state_count = 3; -+ std::size_t expected_transition_count = 3; -+ test_lts("regression test for GJKW bug (branching bisimulation [Jansen/Groote/Keiren/Wijs 2019])",l,expected_label_count, expected_state_count, expected_transition_count); -+ - --BOOST_AUTO_TEST_CASE(test_main) --{ -- reduce_simple_loop(); -- reduce_simple_loop_with_tau(); -- tricky_example_for_branching_bisimulation(); -- reduce_abp(); -- reduce_peterson(); -- test_reachability(); -- test_is_deterministic(); -- failing_test_groote_wijs_algorithm(); -- counterexample_jk_1(3); -- counterexample_postprocessing(); -- regression_delete_old_bb_slice(); -- // TODO: Add groote wijs branching bisimulation and add weak bisimulation tests. For the last Peterson is a good candidate. - } -diff --git a/tools/release/ltsconvert/ltsconvert.cpp b/tools/release/ltsconvert/ltsconvert.cpp -index 231deabe2..5645d31d1 100644 ---- a/tools/release/ltsconvert/ltsconvert.cpp -+++ b/tools/release/ltsconvert/ltsconvert.cpp -@@ -123,8 +123,7 @@ class ltsconvert_tool : public input_output_tool - - LTS_TYPE l; - l.load(tool_options.infilename); -- l.record_hidden_actions(tool_options.tau_actions); -- l.apply_hidden_actions(); -+ l.apply_hidden_actions(tool_options.tau_actions); - - if (tool_options.check_reach) - { --- -2.35.1 - diff --git a/gnu/packages/patches/mcrl2-fix-counterexample.patch b/gnu/packages/patches/mcrl2-fix-counterexample.patch deleted file mode 100644 index abf541f50c..0000000000 --- a/gnu/packages/patches/mcrl2-fix-counterexample.patch +++ /dev/null @@ -1,32 +0,0 @@ -Taken from upstream: - https://github.com/mCRL2org/mCRL2/commit/435421429dde9dcc5956e8a978597111a3947ec1 - -Fixes bug in ltscompare: - https://listserver.tue.nl/pipermail/mcrl2-users/2022-June/000396.html - -From 435421429dde9dcc5956e8a978597111a3947ec1 Mon Sep 17 00:00:00 2001 -From: Maurice Laveaux <m.laveaux@tue.nl> -Date: Wed, 29 Jun 2022 10:27:58 +0200 -Subject: [PATCH] Write counterexample's structured output trace on single - line. - ---- - libraries/lts/include/mcrl2/lts/detail/counter_example.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libraries/lts/include/mcrl2/lts/detail/counter_example.h b/libraries/lts/include/mcrl2/lts/detail/counter_example.h -index c339cfde4..ca3967768 100644 ---- a/libraries/lts/include/mcrl2/lts/detail/counter_example.h -+++ b/libraries/lts/include/mcrl2/lts/detail/counter_example.h -@@ -139,7 +139,7 @@ class counter_example_constructor - if (m_structured_output) - { - std::cout << m_name << ": "; -- result.save("", mcrl2::lts::trace::tfPlain); // Write to stdout. -+ result.save("", mcrl2::lts::trace::tfLine); // Write to stdout. - } - else - { --- -2.35.1 - diff --git a/gnu/packages/patches/openssh-hurd.patch b/gnu/packages/patches/openssh-hurd.patch deleted file mode 100644 index 1ad09a7ee6..0000000000 --- a/gnu/packages/patches/openssh-hurd.patch +++ /dev/null @@ -1,30 +0,0 @@ -Author: Jan (janneke) Nieuwenhuizen" <janneke@gnu.org> -Not upstreamed. - -From 1ddae040d67e9a4ebcc3e1b95af1bff12c0f086b Mon Sep 17 00:00:00 2001 -From: "Jan (janneke) Nieuwenhuizen" <janneke@gnu.org> -Date: Tue, 7 Apr 2020 17:41:05 +0200 -Subject: [PATCH] Build fix for the Hurd. - -* gss-serv.c (ssh_gssapi_acquire_cred): Use HOST_NAME_MAX instead of -MAXHOSTNAMELEN. ---- - gss-serv.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gss-serv.c b/gss-serv.c -index 1d47870e7..22081c6f1 100644 ---- a/gss-serv.c -+++ b/gss-serv.c -@@ -107,7 +107,7 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx) - gss_create_empty_oid_set(&status, &oidset); - gss_add_oid_set_member(&status, ctx->oid, &oidset); - -- if (gethostname(lname, MAXHOSTNAMELEN)) { -+ if (gethostname(lname, HOST_NAME_MAX)) { - gss_release_oid_set(&status, &oidset); - return (-1); - } --- -2.26.0 - diff --git a/gnu/packages/patches/po4a-partial-texinfo-menu-fix.patch b/gnu/packages/patches/po4a-partial-texinfo-menu-fix.patch new file mode 100644 index 0000000000..8a075fa74c --- /dev/null +++ b/gnu/packages/patches/po4a-partial-texinfo-menu-fix.patch @@ -0,0 +1,242 @@ +Submitted upstream: https://github.com/mquinson/po4a/pull/437 + +From 43db5c0b14ec2a8ba44d338bce024df87256457b Mon Sep 17 00:00:00 2001 +From: Maxim Cournoyer <maxim.cournoyer@gmail.com> +Date: Thu, 27 Jul 2023 17:44:49 -0400 +Subject: [PATCH] lib: Texinfo: Translate partial menu node names. + +Fixes <https://issues.guix.gnu.org/64881>. + +* lib/Locale/Po4a/Texinfo.pm (translate_buffer_menuentry): Refine +regexp, so that it matches menu entries lacking a description. +Only call 'translate_buffer' on the description if it was provided. +* t/fmt/texinfo/partialmenus.trans: New file. +* t/fmt/texinfo/partialmenus.texi: Likewise. +* t/fmt/texinfo/partialmenus.pot: Likewise. +* t/fmt/texinfo/partialmenus.po: Likewise. +* t/fmt/texinfo/partialmenus.norm: Likewise. +* t/fmt-texinfo.t: Register the new 'partialmenus' test. +--- + lib/Locale/Po4a/Texinfo.pm | 7 +++--- + t/fmt-texinfo.t | 2 +- + t/fmt/texinfo/partialmenus.norm | 21 +++++++++++++++++ + t/fmt/texinfo/partialmenus.po | 40 ++++++++++++++++++++++++++++++++ + t/fmt/texinfo/partialmenus.pot | 40 ++++++++++++++++++++++++++++++++ + t/fmt/texinfo/partialmenus.texi | 14 +++++++++++ + t/fmt/texinfo/partialmenus.trans | 21 +++++++++++++++++ + 7 files changed, 141 insertions(+), 4 deletions(-) + create mode 100644 t/fmt/texinfo/partialmenus.norm + create mode 100644 t/fmt/texinfo/partialmenus.po + create mode 100644 t/fmt/texinfo/partialmenus.pot + create mode 100644 t/fmt/texinfo/partialmenus.texi + create mode 100644 t/fmt/texinfo/partialmenus.trans + +diff --git a/lib/Locale/Po4a/Texinfo.pm b/lib/Locale/Po4a/Texinfo.pm +index b4750699..1c3a4bae 100644 +--- a/lib/Locale/Po4a/Texinfo.pm ++++ b/lib/Locale/Po4a/Texinfo.pm +@@ -336,7 +336,7 @@ sub translate_buffer_menuentry { + + my $translated_buffer = ""; + +- if ( $buffer =~ m/^(.*?)(::)\s+(.*)$/s ++ if ( $buffer =~ m/^(.*?)(::)(?:\s+(.*))?$/s + or $buffer =~ m/^(.*?: .*?)(\.)\s+(.*)$/s ) + { + my ( $name, $sep, $description ) = ( $1, $2, $3 ); +@@ -347,8 +347,9 @@ sub translate_buffer_menuentry { + $translated_buffer .= ' ' x ( $menu_sep_width - 1 - $l ); + $l = $menu_sep_width - 1; + } +- ( $t, @e ) = $self->translate_buffer( $description, $no_wrap, @env ); +- ++ if ($description) { ++ ( $t, @e ) = $self->translate_buffer( $description, $no_wrap, @env ); ++ } + # Replace newlines with space for proper wrapping + # See https://github.com/mquinson/po4a/issues/122 + $t =~ s/\n/ /sg; +diff --git a/t/fmt-texinfo.t b/t/fmt-texinfo.t +index 4b067e43..d9ed5df3 100644 +--- a/t/fmt-texinfo.t ++++ b/t/fmt-texinfo.t +@@ -10,7 +10,7 @@ use Testhelper; + + my @tests; + +-for my $test (qw(longmenu comments tindex)) { ++for my $test (qw(longmenu partialmenus comments tindex)) { + push @tests, + { + 'format' => 'texinfo', +diff --git a/t/fmt/texinfo/partialmenus.norm b/t/fmt/texinfo/partialmenus.norm +new file mode 100644 +index 00000000..99240682 +--- /dev/null ++++ b/t/fmt/texinfo/partialmenus.norm +@@ -0,0 +1,21 @@ ++\input texinfo ++@c =========================================================================== ++@c ++@c This file was generated with po4a. Translate the source file. ++@c ++@c =========================================================================== ++ ++ ++@c These menus do not contain a description, which used to cause a ++@c Texinfo menu entry to not be translated. ++@menu ++* A menu entry without any description:: A menu entry without any ++ description ++* Optional menu name: The menu node:: Optional menu name: The menu node ++@end menu ++ ++@node A menu entry without any description ++@chapter A menu entry without any description ++ ++@node The menu node ++@chapter Optional menu name +diff --git a/t/fmt/texinfo/partialmenus.po b/t/fmt/texinfo/partialmenus.po +new file mode 100644 +index 00000000..31a14443 +--- /dev/null ++++ b/t/fmt/texinfo/partialmenus.po +@@ -0,0 +1,40 @@ ++# SOME DESCRIPTIVE TITLE ++# Copyright (C) YEAR Free Software Foundation, Inc. ++# This file is distributed under the same license as the PACKAGE package. ++# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR. ++# ++#, fuzzy ++msgid "" ++msgstr "" ++"Project-Id-Version: PACKAGE VERSION\n" ++"POT-Creation-Date: 2023-07-27 17:29-0400\n" ++"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" ++"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" ++"Language-Team: LANGUAGE <LL@li.org>\n" ++"Language: \n" ++"MIME-Version: 1.0\n" ++"Content-Type: text/plain; charset=UTF-8\n" ++"Content-Transfer-Encoding: 8bit\n" ++ ++#. type: chapter ++#: partialmenus.texi:8 partialmenus.texi:10 partialmenus.texi:11 ++#, no-wrap ++msgid "A menu entry without any description" ++msgstr "A MENU ENTRY WITHOUT ANY DESCRIPTION" ++ ++#. type: menuentry ++#: partialmenus.texi:8 ++msgid "Optional menu name: The menu node" ++msgstr "OPTIONAL MENU NAME: THE MENU NODE" ++ ++#. type: node ++#: partialmenus.texi:13 ++#, no-wrap ++msgid "The menu node" ++msgstr "THE MENU NODE" ++ ++#. type: chapter ++#: partialmenus.texi:14 ++#, no-wrap ++msgid "Optional menu name" ++msgstr "OPTIONAL MENU NAME" +diff --git a/t/fmt/texinfo/partialmenus.pot b/t/fmt/texinfo/partialmenus.pot +new file mode 100644 +index 00000000..0379f805 +--- /dev/null ++++ b/t/fmt/texinfo/partialmenus.pot +@@ -0,0 +1,40 @@ ++# SOME DESCRIPTIVE TITLE ++# Copyright (C) YEAR Free Software Foundation, Inc. ++# This file is distributed under the same license as the PACKAGE package. ++# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR. ++# ++#, fuzzy ++msgid "" ++msgstr "" ++"Project-Id-Version: PACKAGE VERSION\n" ++"POT-Creation-Date: 2023-08-16 09:47-0400\n" ++"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" ++"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" ++"Language-Team: LANGUAGE <LL@li.org>\n" ++"Language: \n" ++"MIME-Version: 1.0\n" ++"Content-Type: text/plain; charset=UTF-8\n" ++"Content-Transfer-Encoding: 8bit\n" ++ ++#. type: chapter ++#: partialmenus.texi:8 partialmenus.texi:10 partialmenus.texi:11 ++#, no-wrap ++msgid "A menu entry without any description" ++msgstr "" ++ ++#. type: menuentry ++#: partialmenus.texi:8 ++msgid "Optional menu name: The menu node" ++msgstr "" ++ ++#. type: node ++#: partialmenus.texi:13 ++#, no-wrap ++msgid "The menu node" ++msgstr "" ++ ++#. type: chapter ++#: partialmenus.texi:14 ++#, no-wrap ++msgid "Optional menu name" ++msgstr "" +diff --git a/t/fmt/texinfo/partialmenus.texi b/t/fmt/texinfo/partialmenus.texi +new file mode 100644 +index 00000000..f8663a2b +--- /dev/null ++++ b/t/fmt/texinfo/partialmenus.texi +@@ -0,0 +1,14 @@ ++\input texinfo ++ ++@c These menus do not contain a description, which used to cause a ++@c Texinfo menu entry to not be translated. ++@menu ++* A menu entry without any description:: ++* Optional menu name: The menu node:: ++@end menu ++ ++@node A menu entry without any description ++@chapter A menu entry without any description ++ ++@node The menu node ++@chapter Optional menu name +diff --git a/t/fmt/texinfo/partialmenus.trans b/t/fmt/texinfo/partialmenus.trans +new file mode 100644 +index 00000000..0ef742a1 +--- /dev/null ++++ b/t/fmt/texinfo/partialmenus.trans +@@ -0,0 +1,21 @@ ++\input texinfo ++@c =========================================================================== ++@c ++@c This file was generated with po4a. Translate the source file. ++@c ++@c =========================================================================== ++ ++ ++@c These menus do not contain a description, which used to cause a ++@c Texinfo menu entry to not be translated. ++@menu ++* A MENU ENTRY WITHOUT ANY DESCRIPTION:: A MENU ENTRY WITHOUT ANY ++ DESCRIPTION ++* OPTIONAL MENU NAME: THE MENU NODE:: OPTIONAL MENU NAME: THE MENU NODE ++@end menu ++ ++@node A MENU ENTRY WITHOUT ANY DESCRIPTION ++@chapter A MENU ENTRY WITHOUT ANY DESCRIPTION ++ ++@node THE MENU NODE ++@chapter OPTIONAL MENU NAME + +base-commit: 5b1cd768afdf4e9445812c5d43428495a0fde3c6 +-- +2.41.0 + diff --git a/gnu/packages/patches/rust-nettle-sys-disable-vendor.patch b/gnu/packages/patches/rust-nettle-sys-disable-vendor.patch deleted file mode 100644 index ae5ef5ebe0..0000000000 --- a/gnu/packages/patches/rust-nettle-sys-disable-vendor.patch +++ /dev/null @@ -1,48 +0,0 @@ -Subject: nettle-sys: clear out "vendored" feature cruft from build.rs -From: Daniel Kahn Gillmor's avatarDaniel Kahn Gillmor <dkg@fifthhorseman.net> - -https://salsa.debian.org/rust-team/debcargo-conf/-/commit/0c71150ad26bb66a8396dcdab055181af232ddc5 -https://sources.debian.org/src/rust-nettle-sys/2.0.4-3/debian/patches/disable-vendor.diff/ ---- a/Cargo.toml 2019-10-23 13:08:07.000000000 -0400 -+++ b/Cargo.toml 2019-10-23 14:08:46.644064014 -0400 -@@ -29,12 +29,9 @@ - version = "0.51.1" - default-features = false - --[build-dependencies.nettle-src] --version = "3.5.1-0" --optional = true -- - [build-dependencies.pkg-config] - version = "0.3" - - [features] - vendored = ["nettle-src"] -+nettle-src = [] -diff --git a/build.rs b/build.rs -index 44f7af3..ede4b2f 100644 ---- a/build.rs -+++ b/build.rs -@@ -1,7 +1,5 @@ - extern crate bindgen; - extern crate pkg_config; --#[cfg(feature = "vendored")] --extern crate nettle_src; - - use std::env; - use std::fs; -@@ -36,14 +34,6 @@ fn main() { - println!("cargo:rerun-if-env-changed=NETTLE_STATIC"); - println!("cargo:rerun-if-env-changed={}", NETTLE_PREGENERATED_BINDINGS); - -- #[cfg(feature = "vendored")] -- { -- let artifacts = nettle_src::Build::new().build(); -- println!("cargo:vendored=1"); -- env::set_var("PKG_CONFIG_PATH", -- artifacts.lib_dir().join("pkgconfig")); -- } -- - let nettle = pkg_config::probe_library("nettle hogweed").unwrap(); - - let mode = match env::var_os("NETTLE_STATIC") { diff --git a/gnu/packages/patches/rust-ring-0.16-missing-files.patch b/gnu/packages/patches/rust-ring-0.16-missing-files.patch new file mode 100644 index 0000000000..fa2f94a801 --- /dev/null +++ b/gnu/packages/patches/rust-ring-0.16-missing-files.patch @@ -0,0 +1,2293 @@ +These 4 files exist in the git repository for rust-ring, and are from +the same commit where 0.16.20 is taken from. They were not added to the +include list in Cargo.toml, so they were not added to the tarball. + +--- + crypto/curve25519/make_curve25519_tables.py | 222 +++++ + crypto/fipsmodule/aes/asm/vpaes-armv7.pl | 896 ++++++++++++++++++ + crypto/fipsmodule/aes/asm/vpaes-armv8.pl | 837 ++++++++++++++++ + .../fipsmodule/modes/asm/ghash-neon-armv8.pl | 294 ++++++ + 4 files changed, 2249 insertions(+) + create mode 100755 crypto/curve25519/make_curve25519_tables.py + create mode 100644 crypto/fipsmodule/aes/asm/vpaes-armv7.pl + create mode 100755 crypto/fipsmodule/aes/asm/vpaes-armv8.pl + create mode 100644 crypto/fipsmodule/modes/asm/ghash-neon-armv8.pl + +diff --git a/crypto/curve25519/make_curve25519_tables.py b/crypto/curve25519/make_curve25519_tables.py +new file mode 100755 +index 0000000..50dee2a +--- /dev/null ++++ b/crypto/curve25519/make_curve25519_tables.py +@@ -0,0 +1,222 @@ ++#!/usr/bin/env python ++# coding=utf-8 ++# Copyright (c) 2020, Google Inc. ++# ++# Permission to use, copy, modify, and/or distribute this software for any ++# purpose with or without fee is hereby granted, provided that the above ++# copyright notice and this permission notice appear in all copies. ++# ++# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY ++# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION ++# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN ++# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ ++import StringIO ++import subprocess ++ ++# Base field Z_p ++p = 2**255 - 19 ++ ++def modp_inv(x): ++ return pow(x, p-2, p) ++ ++# Square root of -1 ++modp_sqrt_m1 = pow(2, (p-1) // 4, p) ++ ++# Compute corresponding x-coordinate, with low bit corresponding to ++# sign, or return None on failure ++def recover_x(y, sign): ++ if y >= p: ++ return None ++ x2 = (y*y-1) * modp_inv(d*y*y+1) ++ if x2 == 0: ++ if sign: ++ return None ++ else: ++ return 0 ++ ++ # Compute square root of x2 ++ x = pow(x2, (p+3) // 8, p) ++ if (x*x - x2) % p != 0: ++ x = x * modp_sqrt_m1 % p ++ if (x*x - x2) % p != 0: ++ return None ++ ++ if (x & 1) != sign: ++ x = p - x ++ return x ++ ++# Curve constant ++d = -121665 * modp_inv(121666) % p ++ ++# Base point ++g_y = 4 * modp_inv(5) % p ++g_x = recover_x(g_y, 0) ++ ++# Points are represented as affine tuples (x, y). ++ ++def point_add(P, Q): ++ x1, y1 = P ++ x2, y2 = Q ++ x3 = ((x1*y2 + y1*x2) * modp_inv(1 + d*x1*x2*y1*y2)) % p ++ y3 = ((y1*y2 + x1*x2) * modp_inv(1 - d*x1*x2*y1*y2)) % p ++ return (x3, y3) ++ ++# Computes Q = s * P ++def point_mul(s, P): ++ Q = (0, 1) # Neutral element ++ while s > 0: ++ if s & 1: ++ Q = point_add(Q, P) ++ P = point_add(P, P) ++ s >>= 1 ++ return Q ++ ++def to_bytes(x): ++ ret = bytearray(32) ++ for i in range(len(ret)): ++ ret[i] = x % 256 ++ x >>= 8 ++ assert x == 0 ++ return ret ++ ++def to_ge_precomp(P): ++ # typedef struct { ++ # fe_loose yplusx; ++ # fe_loose yminusx; ++ # fe_loose xy2d; ++ # } ge_precomp; ++ x, y = P ++ return ((y + x) % p, (y - x) % p, (x * y * 2 * d) % p) ++ ++def to_base_25_5(x): ++ limbs = (26, 25, 26, 25, 26, 25, 26, 25, 26, 25) ++ ret = [] ++ for l in limbs: ++ ret.append(x & ((1<<l) - 1)) ++ x >>= l ++ assert x == 0 ++ return ret ++ ++def to_base_51(x): ++ ret = [] ++ for _ in range(5): ++ ret.append(x & ((1<<51) - 1)) ++ x >>= 51 ++ assert x == 0 ++ return ret ++ ++def to_literal(x): ++ ret = "{{\n#if defined(BORINGSSL_CURVE25519_64BIT)\n" ++ ret += ", ".join(map(str, to_base_51(x))) ++ ret += "\n#else\n" ++ ret += ", ".join(map(str, to_base_25_5(x))) ++ ret += "\n#endif\n}}" ++ return ret ++ ++def main(): ++ d2 = (2 * d) % p ++ ++ small_precomp = bytearray() ++ for i in range(1, 16): ++ s = (i&1) | ((i&2) << (64-1)) | ((i&4) << (128-2)) | ((i&8) << (192-3)) ++ P = point_mul(s, (g_x, g_y)) ++ small_precomp += to_bytes(P[0]) ++ small_precomp += to_bytes(P[1]) ++ ++ large_precomp = [] ++ for i in range(32): ++ large_precomp.append([]) ++ for j in range(8): ++ P = point_mul((j + 1) << (i * 8), (g_x, g_y)) ++ large_precomp[-1].append(to_ge_precomp(P)) ++ ++ bi_precomp = [] ++ for i in range(8): ++ P = point_mul(2*i + 1, (g_x, g_y)) ++ bi_precomp.append(to_ge_precomp(P)) ++ ++ ++ buf = StringIO.StringIO() ++ buf.write("""/* Copyright (c) 2020, Google Inc. ++ * ++ * Permission to use, copy, modify, and/or distribute this software for any ++ * purpose with or without fee is hereby granted, provided that the above ++ * copyright notice and this permission notice appear in all copies. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY ++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION ++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN ++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ ++ ++// This file is generated from ++// ./make_curve25519_tables.py > curve25519_tables.h ++ ++ ++static const fe d = """) ++ buf.write(to_literal(d)) ++ buf.write("""; ++ ++static const fe sqrtm1 = """) ++ buf.write(to_literal(modp_sqrt_m1)) ++ buf.write("""; ++ ++static const fe d2 = """) ++ buf.write(to_literal(d2)) ++ buf.write("""; ++ ++#if defined(OPENSSL_SMALL) ++ ++// This block of code replaces the standard base-point table with a much smaller ++// one. The standard table is 30,720 bytes while this one is just 960. ++// ++// This table contains 15 pairs of group elements, (x, y), where each field ++// element is serialised with |fe_tobytes|. If |i| is the index of the group ++// element then consider i+1 as a four-bit number: (i₀, i₁, i₂, i₃) (where i₀ ++// is the most significant bit). The value of the group element is then: ++// (i₀×2^192 + i₁×2^128 + i₂×2^64 + i₃)G, where G is the generator. ++static const uint8_t k25519SmallPrecomp[15 * 2 * 32] = {""") ++ for i, b in enumerate(small_precomp): ++ buf.write("0x%02x, " % b) ++ buf.write(""" ++}; ++ ++#else ++ ++// k25519Precomp[i][j] = (j+1)*256^i*B ++static const ge_precomp k25519Precomp[32][8] = { ++""") ++ for child in large_precomp: ++ buf.write("{\n") ++ for val in child: ++ buf.write("{\n") ++ for term in val: ++ buf.write(to_literal(term) + ",\n") ++ buf.write("},\n") ++ buf.write("},\n") ++ buf.write("""}; ++ ++#endif // OPENSSL_SMALL ++ ++// Bi[i] = (2*i+1)*B ++static const ge_precomp Bi[8] = { ++""") ++ for val in bi_precomp: ++ buf.write("{\n") ++ for term in val: ++ buf.write(to_literal(term) + ",\n") ++ buf.write("},\n") ++ buf.write("""}; ++""") ++ ++ proc = subprocess.Popen(["clang-format"], stdin=subprocess.PIPE) ++ proc.communicate(buf.getvalue()) ++ ++if __name__ == "__main__": ++ main() +diff --git a/crypto/fipsmodule/aes/asm/vpaes-armv7.pl b/crypto/fipsmodule/aes/asm/vpaes-armv7.pl +new file mode 100644 +index 0000000..d36a97a +--- /dev/null ++++ b/crypto/fipsmodule/aes/asm/vpaes-armv7.pl +@@ -0,0 +1,896 @@ ++#! /usr/bin/env perl ++# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. ++# ++# Licensed under the OpenSSL license (the "License"). You may not use ++# this file except in compliance with the License. You can obtain a copy ++# in the file LICENSE in the source distribution or at ++# https://www.openssl.org/source/license.html ++ ++ ++###################################################################### ++## Constant-time SSSE3 AES core implementation. ++## version 0.1 ++## ++## By Mike Hamburg (Stanford University), 2009 ++## Public domain. ++## ++## For details see http://shiftleft.org/papers/vector_aes/ and ++## http://crypto.stanford.edu/vpaes/. ++## ++###################################################################### ++# Adapted from the original x86_64 version and <appro@openssl.org>'s ARMv8 ++# version. ++# ++# armv7, aarch64, and x86_64 differ in several ways: ++# ++# * x86_64 SSSE3 instructions are two-address (destination operand is also a ++# source), while NEON is three-address (destination operand is separate from ++# two sources). ++# ++# * aarch64 has 32 SIMD registers available, while x86_64 and armv7 have 16. ++# ++# * x86_64 instructions can take memory references, while ARM is a load/store ++# architecture. This means we sometimes need a spare register. ++# ++# * aarch64 and x86_64 have 128-bit byte shuffle instructions (tbl and pshufb), ++# while armv7 only has a 64-bit byte shuffle (vtbl). ++# ++# This means this armv7 version must be a mix of both aarch64 and x86_64 ++# implementations. armv7 and aarch64 have analogous SIMD instructions, so we ++# base the instructions on aarch64. However, we cannot use aarch64's register ++# allocation. x86_64's register count matches, but x86_64 is two-address. ++# vpaes-armv8.pl already accounts for this in the comments, which use ++# three-address AVX instructions instead of the original SSSE3 ones. We base ++# register usage on these comments, which are preserved in this file. ++# ++# This means we do not use separate input and output registers as in aarch64 and ++# cannot pin as many constants in the preheat functions. However, the load/store ++# architecture means we must still deviate from x86_64 in places. ++# ++# Next, we account for the byte shuffle instructions. vtbl takes 64-bit source ++# and destination and 128-bit table. Fortunately, armv7 also allows addressing ++# upper and lower halves of each 128-bit register. The lower half of q{N} is ++# d{2*N}. The upper half is d{2*N+1}. Instead of the following non-existent ++# instruction, ++# ++# vtbl.8 q0, q1, q2 @ Index each of q2's 16 bytes into q1. Store in q0. ++# ++# we write: ++# ++# vtbl.8 d0, q1, d4 @ Index each of d4's 8 bytes into q1. Store in d0. ++# vtbl.8 d1, q1, d5 @ Index each of d5's 8 bytes into q1. Store in d1. ++# ++# For readability, we write d0 and d1 as q0#lo and q0#hi, respectively and ++# post-process before outputting. (This is adapted from ghash-armv4.pl.) Note, ++# however, that destination (q0) and table (q1) registers may no longer match. ++# We adjust the register usage from x86_64 to avoid this. (Unfortunately, the ++# two-address pshufb always matched these operands, so this is common.) ++# ++# This file also runs against the limit of ARMv7's ADR pseudo-instruction. ADR ++# expands to an ADD or SUB of the pc register to find an address. That immediate ++# must fit in ARM's encoding scheme: 8 bits of constant and 4 bits of rotation. ++# This means larger values must be more aligned. ++# ++# ARM additionally has two encodings, ARM and Thumb mode. Our assembly files may ++# use either encoding (do we actually need to support this?). In ARM mode, the ++# distances get large enough to require 16-byte alignment. Moving constants ++# closer to their use resolves most of this, but common constants in ++# _vpaes_consts are used by the whole file. Affected ADR instructions must be ++# placed at 8 mod 16 (the pc register is 8 ahead). Instructions with this ++# constraint have been commented. ++# ++# For details on ARM's immediate value encoding scheme, see ++# https://alisdair.mcdiarmid.org/arm-immediate-value-encoding/ ++# ++# Finally, a summary of armv7 and aarch64 SIMD syntax differences: ++# ++# * armv7 prefixes SIMD instructions with 'v', while aarch64 does not. ++# ++# * armv7 SIMD registers are named like q0 (and d0 for the half-width ones). ++# aarch64 names registers like v0, and denotes half-width operations in an ++# instruction suffix (see below). ++# ++# * aarch64 embeds size and lane information in register suffixes. v0.16b is ++# 16 bytes, v0.8h is eight u16s, v0.4s is four u32s, and v0.2d is two u64s. ++# armv7 embeds the total size in the register name (see above) and the size of ++# each element in an instruction suffix, which may look like vmov.i8, ++# vshr.u8, or vtbl.8, depending on instruction. ++ ++use strict; ++ ++my $flavour = shift; ++my $output; ++while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} ++ ++$0 =~ m/(.*[\/\\])[^\/\\]+$/; ++my $dir=$1; ++my $xlate; ++( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or ++( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or ++die "can't locate arm-xlate.pl"; ++ ++open OUT,"| \"$^X\" $xlate $flavour $output"; ++*STDOUT=*OUT; ++ ++my $code = ""; ++ ++$code.=<<___; ++.syntax unified ++ ++.arch armv7-a ++.fpu neon ++ ++#if defined(__thumb2__) ++.thumb ++#else ++.code 32 ++#endif ++ ++.text ++ ++.type _vpaes_consts,%object ++.align 7 @ totally strategic alignment ++_vpaes_consts: ++.Lk_mc_forward: @ mc_forward ++ .quad 0x0407060500030201, 0x0C0F0E0D080B0A09 ++ .quad 0x080B0A0904070605, 0x000302010C0F0E0D ++ .quad 0x0C0F0E0D080B0A09, 0x0407060500030201 ++ .quad 0x000302010C0F0E0D, 0x080B0A0904070605 ++.Lk_mc_backward:@ mc_backward ++ .quad 0x0605040702010003, 0x0E0D0C0F0A09080B ++ .quad 0x020100030E0D0C0F, 0x0A09080B06050407 ++ .quad 0x0E0D0C0F0A09080B, 0x0605040702010003 ++ .quad 0x0A09080B06050407, 0x020100030E0D0C0F ++.Lk_sr: @ sr ++ .quad 0x0706050403020100, 0x0F0E0D0C0B0A0908 ++ .quad 0x030E09040F0A0500, 0x0B06010C07020D08 ++ .quad 0x0F060D040B020900, 0x070E050C030A0108 ++ .quad 0x0B0E0104070A0D00, 0x0306090C0F020508 ++ ++@ ++@ "Hot" constants ++@ ++.Lk_inv: @ inv, inva ++ .quad 0x0E05060F0D080180, 0x040703090A0B0C02 ++ .quad 0x01040A060F0B0780, 0x030D0E0C02050809 ++.Lk_ipt: @ input transform (lo, hi) ++ .quad 0xC2B2E8985A2A7000, 0xCABAE09052227808 ++ .quad 0x4C01307D317C4D00, 0xCD80B1FCB0FDCC81 ++.Lk_sbo: @ sbou, sbot ++ .quad 0xD0D26D176FBDC700, 0x15AABF7AC502A878 ++ .quad 0xCFE474A55FBB6A00, 0x8E1E90D1412B35FA ++.Lk_sb1: @ sb1u, sb1t ++ .quad 0x3618D415FAE22300, 0x3BF7CCC10D2ED9EF ++ .quad 0xB19BE18FCB503E00, 0xA5DF7A6E142AF544 ++.Lk_sb2: @ sb2u, sb2t ++ .quad 0x69EB88400AE12900, 0xC2A163C8AB82234A ++ .quad 0xE27A93C60B712400, 0x5EB7E955BC982FCD ++ ++.asciz "Vector Permutation AES for ARMv7 NEON, Mike Hamburg (Stanford University)" ++.size _vpaes_consts,.-_vpaes_consts ++.align 6 ++___ ++ ++{ ++my ($inp,$out,$key) = map("r$_", (0..2)); ++ ++my ($invlo,$invhi) = map("q$_", (10..11)); ++my ($sb1u,$sb1t,$sb2u,$sb2t) = map("q$_", (12..15)); ++ ++$code.=<<___; ++@@ ++@@ _aes_preheat ++@@ ++@@ Fills q9-q15 as specified below. ++@@ ++.type _vpaes_preheat,%function ++.align 4 ++_vpaes_preheat: ++ adr r10, .Lk_inv ++ vmov.i8 q9, #0x0f @ .Lk_s0F ++ vld1.64 {q10,q11}, [r10]! @ .Lk_inv ++ add r10, r10, #64 @ Skip .Lk_ipt, .Lk_sbo ++ vld1.64 {q12,q13}, [r10]! @ .Lk_sb1 ++ vld1.64 {q14,q15}, [r10] @ .Lk_sb2 ++ bx lr ++ ++@@ ++@@ _aes_encrypt_core ++@@ ++@@ AES-encrypt q0. ++@@ ++@@ Inputs: ++@@ q0 = input ++@@ q9-q15 as in _vpaes_preheat ++@@ [$key] = scheduled keys ++@@ ++@@ Output in q0 ++@@ Clobbers q1-q5, r8-r11 ++@@ Preserves q6-q8 so you get some local vectors ++@@ ++@@ ++.type _vpaes_encrypt_core,%function ++.align 4 ++_vpaes_encrypt_core: ++ mov r9, $key ++ ldr r8, [$key,#240] @ pull rounds ++ adr r11, .Lk_ipt ++ @ vmovdqa .Lk_ipt(%rip), %xmm2 # iptlo ++ @ vmovdqa .Lk_ipt+16(%rip), %xmm3 # ipthi ++ vld1.64 {q2, q3}, [r11] ++ adr r11, .Lk_mc_forward+16 ++ vld1.64 {q5}, [r9]! @ vmovdqu (%r9), %xmm5 # round0 key ++ vand q1, q0, q9 @ vpand %xmm9, %xmm0, %xmm1 ++ vshr.u8 q0, q0, #4 @ vpsrlb \$4, %xmm0, %xmm0 ++ vtbl.8 q1#lo, {q2}, q1#lo @ vpshufb %xmm1, %xmm2, %xmm1 ++ vtbl.8 q1#hi, {q2}, q1#hi ++ vtbl.8 q2#lo, {q3}, q0#lo @ vpshufb %xmm0, %xmm3, %xmm2 ++ vtbl.8 q2#hi, {q3}, q0#hi ++ veor q0, q1, q5 @ vpxor %xmm5, %xmm1, %xmm0 ++ veor q0, q0, q2 @ vpxor %xmm2, %xmm0, %xmm0 ++ ++ @ .Lenc_entry ends with a bnz instruction which is normally paired with ++ @ subs in .Lenc_loop. ++ tst r8, r8 ++ b .Lenc_entry ++ ++.align 4 ++.Lenc_loop: ++ @ middle of middle round ++ add r10, r11, #0x40 ++ vtbl.8 q4#lo, {$sb1t}, q2#lo @ vpshufb %xmm2, %xmm13, %xmm4 # 4 = sb1u ++ vtbl.8 q4#hi, {$sb1t}, q2#hi ++ vld1.64 {q1}, [r11]! @ vmovdqa -0x40(%r11,%r10), %xmm1 # .Lk_mc_forward[] ++ vtbl.8 q0#lo, {$sb1u}, q3#lo @ vpshufb %xmm3, %xmm12, %xmm0 # 0 = sb1t ++ vtbl.8 q0#hi, {$sb1u}, q3#hi ++ veor q4, q4, q5 @ vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ vtbl.8 q5#lo, {$sb2t}, q2#lo @ vpshufb %xmm2, %xmm15, %xmm5 # 4 = sb2u ++ vtbl.8 q5#hi, {$sb2t}, q2#hi ++ veor q0, q0, q4 @ vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ vtbl.8 q2#lo, {$sb2u}, q3#lo @ vpshufb %xmm3, %xmm14, %xmm2 # 2 = sb2t ++ vtbl.8 q2#hi, {$sb2u}, q3#hi ++ vld1.64 {q4}, [r10] @ vmovdqa (%r11,%r10), %xmm4 # .Lk_mc_backward[] ++ vtbl.8 q3#lo, {q0}, q1#lo @ vpshufb %xmm1, %xmm0, %xmm3 # 0 = B ++ vtbl.8 q3#hi, {q0}, q1#hi ++ veor q2, q2, q5 @ vpxor %xmm5, %xmm2, %xmm2 # 2 = 2A ++ @ Write to q5 instead of q0, so the table and destination registers do ++ @ not overlap. ++ vtbl.8 q5#lo, {q0}, q4#lo @ vpshufb %xmm4, %xmm0, %xmm0 # 3 = D ++ vtbl.8 q5#hi, {q0}, q4#hi ++ veor q3, q3, q2 @ vpxor %xmm2, %xmm3, %xmm3 # 0 = 2A+B ++ vtbl.8 q4#lo, {q3}, q1#lo @ vpshufb %xmm1, %xmm3, %xmm4 # 0 = 2B+C ++ vtbl.8 q4#hi, {q3}, q1#hi ++ @ Here we restore the original q0/q5 usage. ++ veor q0, q5, q3 @ vpxor %xmm3, %xmm0, %xmm0 # 3 = 2A+B+D ++ and r11, r11, #~(1<<6) @ and \$0x30, %r11 # ... mod 4 ++ veor q0, q0, q4 @ vpxor %xmm4, %xmm0, %xmm0 # 0 = 2A+3B+C+D ++ subs r8, r8, #1 @ nr-- ++ ++.Lenc_entry: ++ @ top of round ++ vand q1, q0, q9 @ vpand %xmm0, %xmm9, %xmm1 # 0 = k ++ vshr.u8 q0, q0, #4 @ vpsrlb \$4, %xmm0, %xmm0 # 1 = i ++ vtbl.8 q5#lo, {$invhi}, q1#lo @ vpshufb %xmm1, %xmm11, %xmm5 # 2 = a/k ++ vtbl.8 q5#hi, {$invhi}, q1#hi ++ veor q1, q1, q0 @ vpxor %xmm0, %xmm1, %xmm1 # 0 = j ++ vtbl.8 q3#lo, {$invlo}, q0#lo @ vpshufb %xmm0, %xmm10, %xmm3 # 3 = 1/i ++ vtbl.8 q3#hi, {$invlo}, q0#hi ++ vtbl.8 q4#lo, {$invlo}, q1#lo @ vpshufb %xmm1, %xmm10, %xmm4 # 4 = 1/j ++ vtbl.8 q4#hi, {$invlo}, q1#hi ++ veor q3, q3, q5 @ vpxor %xmm5, %xmm3, %xmm3 # 3 = iak = 1/i + a/k ++ veor q4, q4, q5 @ vpxor %xmm5, %xmm4, %xmm4 # 4 = jak = 1/j + a/k ++ vtbl.8 q2#lo, {$invlo}, q3#lo @ vpshufb %xmm3, %xmm10, %xmm2 # 2 = 1/iak ++ vtbl.8 q2#hi, {$invlo}, q3#hi ++ vtbl.8 q3#lo, {$invlo}, q4#lo @ vpshufb %xmm4, %xmm10, %xmm3 # 3 = 1/jak ++ vtbl.8 q3#hi, {$invlo}, q4#hi ++ veor q2, q2, q1 @ vpxor %xmm1, %xmm2, %xmm2 # 2 = io ++ veor q3, q3, q0 @ vpxor %xmm0, %xmm3, %xmm3 # 3 = jo ++ vld1.64 {q5}, [r9]! @ vmovdqu (%r9), %xmm5 ++ bne .Lenc_loop ++ ++ @ middle of last round ++ add r10, r11, #0x80 ++ ++ adr r11, .Lk_sbo ++ @ Read to q1 instead of q4, so the vtbl.8 instruction below does not ++ @ overlap table and destination registers. ++ vld1.64 {q1}, [r11]! @ vmovdqa -0x60(%r10), %xmm4 # 3 : sbou ++ vld1.64 {q0}, [r11] @ vmovdqa -0x50(%r10), %xmm0 # 0 : sbot .Lk_sbo+16 ++ vtbl.8 q4#lo, {q1}, q2#lo @ vpshufb %xmm2, %xmm4, %xmm4 # 4 = sbou ++ vtbl.8 q4#hi, {q1}, q2#hi ++ vld1.64 {q1}, [r10] @ vmovdqa 0x40(%r11,%r10), %xmm1 # .Lk_sr[] ++ @ Write to q2 instead of q0 below, to avoid overlapping table and ++ @ destination registers. ++ vtbl.8 q2#lo, {q0}, q3#lo @ vpshufb %xmm3, %xmm0, %xmm0 # 0 = sb1t ++ vtbl.8 q2#hi, {q0}, q3#hi ++ veor q4, q4, q5 @ vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ veor q2, q2, q4 @ vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ @ Here we restore the original q0/q2 usage. ++ vtbl.8 q0#lo, {q2}, q1#lo @ vpshufb %xmm1, %xmm0, %xmm0 ++ vtbl.8 q0#hi, {q2}, q1#hi ++ bx lr ++.size _vpaes_encrypt_core,.-_vpaes_encrypt_core ++ ++.globl GFp_vpaes_encrypt ++.type GFp_vpaes_encrypt,%function ++.align 4 ++GFp_vpaes_encrypt: ++ @ _vpaes_encrypt_core uses r8-r11. Round up to r7-r11 to maintain stack ++ @ alignment. ++ stmdb sp!, {r7-r11,lr} ++ @ _vpaes_encrypt_core uses q4-q5 (d8-d11), which are callee-saved. ++ vstmdb sp!, {d8-d11} ++ ++ vld1.64 {q0}, [$inp] ++ bl _vpaes_preheat ++ bl _vpaes_encrypt_core ++ vst1.64 {q0}, [$out] ++ ++ vldmia sp!, {d8-d11} ++ ldmia sp!, {r7-r11, pc} @ return ++.size GFp_vpaes_encrypt,.-GFp_vpaes_encrypt ++___ ++} ++{ ++my ($inp,$bits,$out,$dir)=("r0","r1","r2","r3"); ++my ($rcon,$s0F,$invlo,$invhi,$s63) = map("q$_",(8..12)); ++ ++$code.=<<___; ++@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ++@@ @@ ++@@ AES key schedule @@ ++@@ @@ ++@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ++ ++@ This function diverges from both x86_64 and armv7 in which constants are ++@ pinned. x86_64 has a common preheat function for all operations. aarch64 ++@ separates them because it has enough registers to pin nearly all constants. ++@ armv7 does not have enough registers, but needing explicit loads and stores ++@ also complicates using x86_64's register allocation directly. ++@ ++@ We pin some constants for convenience and leave q14 and q15 free to load ++@ others on demand. ++ ++@ ++@ Key schedule constants ++@ ++.type _vpaes_key_consts,%object ++.align 4 ++_vpaes_key_consts: ++.Lk_rcon: @ rcon ++ .quad 0x1F8391B9AF9DEEB6, 0x702A98084D7C7D81 ++ ++.Lk_opt: @ output transform ++ .quad 0xFF9F4929D6B66000, 0xF7974121DEBE6808 ++ .quad 0x01EDBD5150BCEC00, 0xE10D5DB1B05C0CE0 ++.Lk_deskew: @ deskew tables: inverts the sbox's "skew" ++ .quad 0x07E4A34047A4E300, 0x1DFEB95A5DBEF91A ++ .quad 0x5F36B5DC83EA6900, 0x2841C2ABF49D1E77 ++.size _vpaes_key_consts,.-_vpaes_key_consts ++ ++.type _vpaes_key_preheat,%function ++.align 4 ++_vpaes_key_preheat: ++ adr r11, .Lk_rcon ++ vmov.i8 $s63, #0x5b @ .Lk_s63 ++ adr r10, .Lk_inv @ Must be aligned to 8 mod 16. ++ vmov.i8 $s0F, #0x0f @ .Lk_s0F ++ vld1.64 {$invlo,$invhi}, [r10] @ .Lk_inv ++ vld1.64 {$rcon}, [r11] @ .Lk_rcon ++ bx lr ++.size _vpaes_key_preheat,.-_vpaes_key_preheat ++ ++.type _vpaes_schedule_core,%function ++.align 4 ++_vpaes_schedule_core: ++ @ We only need to save lr, but ARM requires an 8-byte stack alignment, ++ @ so save an extra register. ++ stmdb sp!, {r3,lr} ++ ++ bl _vpaes_key_preheat @ load the tables ++ ++ adr r11, .Lk_ipt @ Must be aligned to 8 mod 16. ++ vld1.64 {q0}, [$inp]! @ vmovdqu (%rdi), %xmm0 # load key (unaligned) ++ ++ @ input transform ++ @ Use q4 here rather than q3 so .Lschedule_am_decrypting does not ++ @ overlap table and destination. ++ vmov q4, q0 @ vmovdqa %xmm0, %xmm3 ++ bl _vpaes_schedule_transform ++ adr r10, .Lk_sr @ Must be aligned to 8 mod 16. ++ vmov q7, q0 @ vmovdqa %xmm0, %xmm7 ++ ++ add r8, r8, r10 ++ ++ @ encrypting, output zeroth round key after transform ++ vst1.64 {q0}, [$out] @ vmovdqu %xmm0, (%rdx) ++ ++ @ *ring*: Decryption removed. ++ ++.Lschedule_go: ++ cmp $bits, #192 @ cmp \$192, %esi ++ bhi .Lschedule_256 ++ @ 128: fall though ++ ++@@ ++@@ .schedule_128 ++@@ ++@@ 128-bit specific part of key schedule. ++@@ ++@@ This schedule is really simple, because all its parts ++@@ are accomplished by the subroutines. ++@@ ++.Lschedule_128: ++ mov $inp, #10 @ mov \$10, %esi ++ ++.Loop_schedule_128: ++ bl _vpaes_schedule_round ++ subs $inp, $inp, #1 @ dec %esi ++ beq .Lschedule_mangle_last ++ bl _vpaes_schedule_mangle @ write output ++ b .Loop_schedule_128 ++ ++@@ ++@@ .aes_schedule_256 ++@@ ++@@ 256-bit specific part of key schedule. ++@@ ++@@ The structure here is very similar to the 128-bit ++@@ schedule, but with an additional "low side" in ++@@ q6. The low side's rounds are the same as the ++@@ high side's, except no rcon and no rotation. ++@@ ++.align 4 ++.Lschedule_256: ++ vld1.64 {q0}, [$inp] @ vmovdqu 16(%rdi),%xmm0 # load key part 2 (unaligned) ++ bl _vpaes_schedule_transform @ input transform ++ mov $inp, #7 @ mov \$7, %esi ++ ++.Loop_schedule_256: ++ bl _vpaes_schedule_mangle @ output low result ++ vmov q6, q0 @ vmovdqa %xmm0, %xmm6 # save cur_lo in xmm6 ++ ++ @ high round ++ bl _vpaes_schedule_round ++ subs $inp, $inp, #1 @ dec %esi ++ beq .Lschedule_mangle_last ++ bl _vpaes_schedule_mangle ++ ++ @ low round. swap xmm7 and xmm6 ++ vdup.32 q0, q0#hi[1] @ vpshufd \$0xFF, %xmm0, %xmm0 ++ vmov.i8 q4, #0 ++ vmov q5, q7 @ vmovdqa %xmm7, %xmm5 ++ vmov q7, q6 @ vmovdqa %xmm6, %xmm7 ++ bl _vpaes_schedule_low_round ++ vmov q7, q5 @ vmovdqa %xmm5, %xmm7 ++ ++ b .Loop_schedule_256 ++ ++@@ ++@@ .aes_schedule_mangle_last ++@@ ++@@ Mangler for last round of key schedule ++@@ Mangles q0 ++@@ when encrypting, outputs out(q0) ^ 63 ++@@ when decrypting, outputs unskew(q0) ++@@ ++@@ Always called right before return... jumps to cleanup and exits ++@@ ++.align 4 ++.Lschedule_mangle_last: ++ @ schedule last round key from xmm0 ++ adr r11, .Lk_deskew @ lea .Lk_deskew(%rip),%r11 # prepare to deskew ++ ++ @ encrypting ++ vld1.64 {q1}, [r8] @ vmovdqa (%r8,%r10),%xmm1 ++ adr r11, .Lk_opt @ lea .Lk_opt(%rip), %r11 # prepare to output transform ++ add $out, $out, #32 @ add \$32, %rdx ++ vmov q2, q0 ++ vtbl.8 q0#lo, {q2}, q1#lo @ vpshufb %xmm1, %xmm0, %xmm0 # output permute ++ vtbl.8 q0#hi, {q2}, q1#hi ++ ++.Lschedule_mangle_last_dec: ++ sub $out, $out, #16 @ add \$-16, %rdx ++ veor q0, q0, $s63 @ vpxor .Lk_s63(%rip), %xmm0, %xmm0 ++ bl _vpaes_schedule_transform @ output transform ++ vst1.64 {q0}, [$out] @ vmovdqu %xmm0, (%rdx) # save last key ++ ++ @ cleanup ++ veor q0, q0, q0 @ vpxor %xmm0, %xmm0, %xmm0 ++ veor q1, q1, q1 @ vpxor %xmm1, %xmm1, %xmm1 ++ veor q2, q2, q2 @ vpxor %xmm2, %xmm2, %xmm2 ++ veor q3, q3, q3 @ vpxor %xmm3, %xmm3, %xmm3 ++ veor q4, q4, q4 @ vpxor %xmm4, %xmm4, %xmm4 ++ veor q5, q5, q5 @ vpxor %xmm5, %xmm5, %xmm5 ++ veor q6, q6, q6 @ vpxor %xmm6, %xmm6, %xmm6 ++ veor q7, q7, q7 @ vpxor %xmm7, %xmm7, %xmm7 ++ ldmia sp!, {r3,pc} @ return ++.size _vpaes_schedule_core,.-_vpaes_schedule_core ++ ++@@ ++@@ .aes_schedule_round ++@@ ++@@ Runs one main round of the key schedule on q0, q7 ++@@ ++@@ Specifically, runs subbytes on the high dword of q0 ++@@ then rotates it by one byte and xors into the low dword of ++@@ q7. ++@@ ++@@ Adds rcon from low byte of q8, then rotates q8 for ++@@ next rcon. ++@@ ++@@ Smears the dwords of q7 by xoring the low into the ++@@ second low, result into third, result into highest. ++@@ ++@@ Returns results in q7 = q0. ++@@ Clobbers q1-q4, r11. ++@@ ++.type _vpaes_schedule_round,%function ++.align 4 ++_vpaes_schedule_round: ++ @ extract rcon from xmm8 ++ vmov.i8 q4, #0 @ vpxor %xmm4, %xmm4, %xmm4 ++ vext.8 q1, $rcon, q4, #15 @ vpalignr \$15, %xmm8, %xmm4, %xmm1 ++ vext.8 $rcon, $rcon, $rcon, #15 @ vpalignr \$15, %xmm8, %xmm8, %xmm8 ++ veor q7, q7, q1 @ vpxor %xmm1, %xmm7, %xmm7 ++ ++ @ rotate ++ vdup.32 q0, q0#hi[1] @ vpshufd \$0xFF, %xmm0, %xmm0 ++ vext.8 q0, q0, q0, #1 @ vpalignr \$1, %xmm0, %xmm0, %xmm0 ++ ++ @ fall through... ++ ++ @ low round: same as high round, but no rotation and no rcon. ++_vpaes_schedule_low_round: ++ @ The x86_64 version pins .Lk_sb1 in %xmm13 and .Lk_sb1+16 in %xmm12. ++ @ We pin other values in _vpaes_key_preheat, so load them now. ++ adr r11, .Lk_sb1 ++ vld1.64 {q14,q15}, [r11] ++ ++ @ smear xmm7 ++ vext.8 q1, q4, q7, #12 @ vpslldq \$4, %xmm7, %xmm1 ++ veor q7, q7, q1 @ vpxor %xmm1, %xmm7, %xmm7 ++ vext.8 q4, q4, q7, #8 @ vpslldq \$8, %xmm7, %xmm4 ++ ++ @ subbytes ++ vand q1, q0, $s0F @ vpand %xmm9, %xmm0, %xmm1 # 0 = k ++ vshr.u8 q0, q0, #4 @ vpsrlb \$4, %xmm0, %xmm0 # 1 = i ++ veor q7, q7, q4 @ vpxor %xmm4, %xmm7, %xmm7 ++ vtbl.8 q2#lo, {$invhi}, q1#lo @ vpshufb %xmm1, %xmm11, %xmm2 # 2 = a/k ++ vtbl.8 q2#hi, {$invhi}, q1#hi ++ veor q1, q1, q0 @ vpxor %xmm0, %xmm1, %xmm1 # 0 = j ++ vtbl.8 q3#lo, {$invlo}, q0#lo @ vpshufb %xmm0, %xmm10, %xmm3 # 3 = 1/i ++ vtbl.8 q3#hi, {$invlo}, q0#hi ++ veor q3, q3, q2 @ vpxor %xmm2, %xmm3, %xmm3 # 3 = iak = 1/i + a/k ++ vtbl.8 q4#lo, {$invlo}, q1#lo @ vpshufb %xmm1, %xmm10, %xmm4 # 4 = 1/j ++ vtbl.8 q4#hi, {$invlo}, q1#hi ++ veor q7, q7, $s63 @ vpxor .Lk_s63(%rip), %xmm7, %xmm7 ++ vtbl.8 q3#lo, {$invlo}, q3#lo @ vpshufb %xmm3, %xmm10, %xmm3 # 2 = 1/iak ++ vtbl.8 q3#hi, {$invlo}, q3#hi ++ veor q4, q4, q2 @ vpxor %xmm2, %xmm4, %xmm4 # 4 = jak = 1/j + a/k ++ vtbl.8 q2#lo, {$invlo}, q4#lo @ vpshufb %xmm4, %xmm10, %xmm2 # 3 = 1/jak ++ vtbl.8 q2#hi, {$invlo}, q4#hi ++ veor q3, q3, q1 @ vpxor %xmm1, %xmm3, %xmm3 # 2 = io ++ veor q2, q2, q0 @ vpxor %xmm0, %xmm2, %xmm2 # 3 = jo ++ vtbl.8 q4#lo, {q15}, q3#lo @ vpshufb %xmm3, %xmm13, %xmm4 # 4 = sbou ++ vtbl.8 q4#hi, {q15}, q3#hi ++ vtbl.8 q1#lo, {q14}, q2#lo @ vpshufb %xmm2, %xmm12, %xmm1 # 0 = sb1t ++ vtbl.8 q1#hi, {q14}, q2#hi ++ veor q1, q1, q4 @ vpxor %xmm4, %xmm1, %xmm1 # 0 = sbox output ++ ++ @ add in smeared stuff ++ veor q0, q1, q7 @ vpxor %xmm7, %xmm1, %xmm0 ++ veor q7, q1, q7 @ vmovdqa %xmm0, %xmm7 ++ bx lr ++.size _vpaes_schedule_round,.-_vpaes_schedule_round ++ ++@@ ++@@ .aes_schedule_transform ++@@ ++@@ Linear-transform q0 according to tables at [r11] ++@@ ++@@ Requires that q9 = 0x0F0F... as in preheat ++@@ Output in q0 ++@@ Clobbers q1, q2, q14, q15 ++@@ ++.type _vpaes_schedule_transform,%function ++.align 4 ++_vpaes_schedule_transform: ++ vld1.64 {q14,q15}, [r11] @ vmovdqa (%r11), %xmm2 # lo ++ @ vmovdqa 16(%r11), %xmm1 # hi ++ vand q1, q0, $s0F @ vpand %xmm9, %xmm0, %xmm1 ++ vshr.u8 q0, q0, #4 @ vpsrlb \$4, %xmm0, %xmm0 ++ vtbl.8 q2#lo, {q14}, q1#lo @ vpshufb %xmm1, %xmm2, %xmm2 ++ vtbl.8 q2#hi, {q14}, q1#hi ++ vtbl.8 q0#lo, {q15}, q0#lo @ vpshufb %xmm0, %xmm1, %xmm0 ++ vtbl.8 q0#hi, {q15}, q0#hi ++ veor q0, q0, q2 @ vpxor %xmm2, %xmm0, %xmm0 ++ bx lr ++.size _vpaes_schedule_transform,.-_vpaes_schedule_transform ++ ++@@ ++@@ .aes_schedule_mangle ++@@ ++@@ Mangles q0 from (basis-transformed) standard version ++@@ to our version. ++@@ ++@@ On encrypt, ++@@ xor with 0x63 ++@@ multiply by circulant 0,1,1,1 ++@@ apply shiftrows transform ++@@ ++@@ On decrypt, ++@@ xor with 0x63 ++@@ multiply by "inverse mixcolumns" circulant E,B,D,9 ++@@ deskew ++@@ apply shiftrows transform ++@@ ++@@ ++@@ Writes out to [r2], and increments or decrements it ++@@ Keeps track of round number mod 4 in r8 ++@@ Preserves q0 ++@@ Clobbers q1-q5 ++@@ ++.type _vpaes_schedule_mangle,%function ++.align 4 ++_vpaes_schedule_mangle: ++ tst $dir, $dir ++ vmov q4, q0 @ vmovdqa %xmm0, %xmm4 # save xmm0 for later ++ adr r11, .Lk_mc_forward @ Must be aligned to 8 mod 16. ++ vld1.64 {q5}, [r11] @ vmovdqa .Lk_mc_forward(%rip),%xmm5 ++ ++ @ encrypting ++ @ Write to q2 so we do not overlap table and destination below. ++ veor q2, q0, $s63 @ vpxor .Lk_s63(%rip), %xmm0, %xmm4 ++ add $out, $out, #16 @ add \$16, %rdx ++ vtbl.8 q4#lo, {q2}, q5#lo @ vpshufb %xmm5, %xmm4, %xmm4 ++ vtbl.8 q4#hi, {q2}, q5#hi ++ vtbl.8 q1#lo, {q4}, q5#lo @ vpshufb %xmm5, %xmm4, %xmm1 ++ vtbl.8 q1#hi, {q4}, q5#hi ++ vtbl.8 q3#lo, {q1}, q5#lo @ vpshufb %xmm5, %xmm1, %xmm3 ++ vtbl.8 q3#hi, {q1}, q5#hi ++ veor q4, q4, q1 @ vpxor %xmm1, %xmm4, %xmm4 ++ vld1.64 {q1}, [r8] @ vmovdqa (%r8,%r10), %xmm1 ++ veor q3, q3, q4 @ vpxor %xmm4, %xmm3, %xmm3 ++ ++.Lschedule_mangle_both: ++ @ Write to q2 so table and destination do not overlap. ++ vtbl.8 q2#lo, {q3}, q1#lo @ vpshufb %xmm1, %xmm3, %xmm3 ++ vtbl.8 q2#hi, {q3}, q1#hi ++ add r8, r8, #64-16 @ add \$-16, %r8 ++ and r8, r8, #~(1<<6) @ and \$0x30, %r8 ++ vst1.64 {q2}, [$out] @ vmovdqu %xmm3, (%rdx) ++ bx lr ++.size _vpaes_schedule_mangle,.-_vpaes_schedule_mangle ++ ++.globl GFp_vpaes_set_encrypt_key ++.type GFp_vpaes_set_encrypt_key,%function ++.align 4 ++GFp_vpaes_set_encrypt_key: ++ stmdb sp!, {r7-r11, lr} ++ vstmdb sp!, {d8-d15} ++ ++ lsr r9, $bits, #5 @ shr \$5,%eax ++ add r9, r9, #5 @ \$5,%eax ++ str r9, [$out,#240] @ mov %eax,240(%rdx) # AES_KEY->rounds = nbits/32+5; ++ ++ mov $dir, #0 @ mov \$0,%ecx ++ mov r8, #0x30 @ mov \$0x30,%r8d ++ bl _vpaes_schedule_core ++ eor r0, r0, r0 ++ ++ vldmia sp!, {d8-d15} ++ ldmia sp!, {r7-r11, pc} @ return ++.size GFp_vpaes_set_encrypt_key,.-GFp_vpaes_set_encrypt_key ++___ ++} ++ ++{ ++my ($out, $inp) = map("r$_", (0..1)); ++my ($s0F, $s63, $s63_raw, $mc_forward) = map("q$_", (9..12)); ++ ++$code .= <<___; ++ ++@ Additional constants for converting to bsaes. ++.type _vpaes_convert_consts,%object ++.align 4 ++_vpaes_convert_consts: ++@ .Lk_opt_then_skew applies skew(opt(x)) XOR 0x63, where skew is the linear ++@ transform in the AES S-box. 0x63 is incorporated into the low half of the ++@ table. This was computed with the following script: ++@ ++@ def u64s_to_u128(x, y): ++@ return x | (y << 64) ++@ def u128_to_u64s(w): ++@ return w & ((1<<64)-1), w >> 64 ++@ def get_byte(w, i): ++@ return (w >> (i*8)) & 0xff ++@ def apply_table(table, b): ++@ lo = b & 0xf ++@ hi = b >> 4 ++@ return get_byte(table[0], lo) ^ get_byte(table[1], hi) ++@ def opt(b): ++@ table = [ ++@ u64s_to_u128(0xFF9F4929D6B66000, 0xF7974121DEBE6808), ++@ u64s_to_u128(0x01EDBD5150BCEC00, 0xE10D5DB1B05C0CE0), ++@ ] ++@ return apply_table(table, b) ++@ def rot_byte(b, n): ++@ return 0xff & ((b << n) | (b >> (8-n))) ++@ def skew(x): ++@ return (x ^ rot_byte(x, 1) ^ rot_byte(x, 2) ^ rot_byte(x, 3) ^ ++@ rot_byte(x, 4)) ++@ table = [0, 0] ++@ for i in range(16): ++@ table[0] |= (skew(opt(i)) ^ 0x63) << (i*8) ++@ table[1] |= skew(opt(i<<4)) << (i*8) ++@ print("\t.quad\t0x%016x, 0x%016x" % u128_to_u64s(table[0])) ++@ print("\t.quad\t0x%016x, 0x%016x" % u128_to_u64s(table[1])) ++.Lk_opt_then_skew: ++ .quad 0x9cb8436798bc4763, 0x6440bb9f6044bf9b ++ .quad 0x1f30062936192f00, 0xb49bad829db284ab ++ ++@ void GFp_vpaes_encrypt_key_to_bsaes(AES_KEY *bsaes, const AES_KEY *vpaes); ++.globl GFp_vpaes_encrypt_key_to_bsaes ++.type GFp_vpaes_encrypt_key_to_bsaes,%function ++.align 4 ++GFp_vpaes_encrypt_key_to_bsaes: ++ stmdb sp!, {r11, lr} ++ ++ @ See _vpaes_schedule_core for the key schedule logic. In particular, ++ @ _vpaes_schedule_transform(.Lk_ipt) (section 2.2 of the paper), ++ @ _vpaes_schedule_mangle (section 4.3), and .Lschedule_mangle_last ++ @ contain the transformations not in the bsaes representation. This ++ @ function inverts those transforms. ++ @ ++ @ Note also that bsaes-armv7.pl expects aes-armv4.pl's key ++ @ representation, which does not match the other aes_nohw_* ++ @ implementations. The ARM aes_nohw_* stores each 32-bit word ++ @ byteswapped, as a convenience for (unsupported) big-endian ARM, at the ++ @ cost of extra REV and VREV32 operations in little-endian ARM. ++ ++ vmov.i8 $s0F, #0x0f @ Required by _vpaes_schedule_transform ++ adr r2, .Lk_mc_forward @ Must be aligned to 8 mod 16. ++ add r3, r2, 0x90 @ .Lk_sr+0x10-.Lk_mc_forward = 0x90 (Apple's toolchain doesn't support the expression) ++ ++ vld1.64 {$mc_forward}, [r2] ++ vmov.i8 $s63, #0x5b @ .Lk_s63 from vpaes-x86_64 ++ adr r11, .Lk_opt @ Must be aligned to 8 mod 16. ++ vmov.i8 $s63_raw, #0x63 @ .LK_s63 without .Lk_ipt applied ++ ++ @ vpaes stores one fewer round count than bsaes, but the number of keys ++ @ is the same. ++ ldr r2, [$inp,#240] ++ add r2, r2, #1 ++ str r2, [$out,#240] ++ ++ @ The first key is transformed with _vpaes_schedule_transform(.Lk_ipt). ++ @ Invert this with .Lk_opt. ++ vld1.64 {q0}, [$inp]! ++ bl _vpaes_schedule_transform ++ vrev32.8 q0, q0 ++ vst1.64 {q0}, [$out]! ++ ++ @ The middle keys have _vpaes_schedule_transform(.Lk_ipt) applied, ++ @ followed by _vpaes_schedule_mangle. _vpaes_schedule_mangle XORs 0x63, ++ @ multiplies by the circulant 0,1,1,1, then applies ShiftRows. ++.Loop_enc_key_to_bsaes: ++ vld1.64 {q0}, [$inp]! ++ ++ @ Invert the ShiftRows step (see .Lschedule_mangle_both). Note we cycle ++ @ r3 in the opposite direction and start at .Lk_sr+0x10 instead of 0x30. ++ @ We use r3 rather than r8 to avoid a callee-saved register. ++ vld1.64 {q1}, [r3] ++ vtbl.8 q2#lo, {q0}, q1#lo ++ vtbl.8 q2#hi, {q0}, q1#hi ++ add r3, r3, #16 ++ and r3, r3, #~(1<<6) ++ vmov q0, q2 ++ ++ @ Handle the last key differently. ++ subs r2, r2, #1 ++ beq .Loop_enc_key_to_bsaes_last ++ ++ @ Multiply by the circulant. This is its own inverse. ++ vtbl.8 q1#lo, {q0}, $mc_forward#lo ++ vtbl.8 q1#hi, {q0}, $mc_forward#hi ++ vmov q0, q1 ++ vtbl.8 q2#lo, {q1}, $mc_forward#lo ++ vtbl.8 q2#hi, {q1}, $mc_forward#hi ++ veor q0, q0, q2 ++ vtbl.8 q1#lo, {q2}, $mc_forward#lo ++ vtbl.8 q1#hi, {q2}, $mc_forward#hi ++ veor q0, q0, q1 ++ ++ @ XOR and finish. ++ veor q0, q0, $s63 ++ bl _vpaes_schedule_transform ++ vrev32.8 q0, q0 ++ vst1.64 {q0}, [$out]! ++ b .Loop_enc_key_to_bsaes ++ ++.Loop_enc_key_to_bsaes_last: ++ @ The final key does not have a basis transform (note ++ @ .Lschedule_mangle_last inverts the original transform). It only XORs ++ @ 0x63 and applies ShiftRows. The latter was already inverted in the ++ @ loop. Note that, because we act on the original representation, we use ++ @ $s63_raw, not $s63. ++ veor q0, q0, $s63_raw ++ vrev32.8 q0, q0 ++ vst1.64 {q0}, [$out] ++ ++ @ Wipe registers which contained key material. ++ veor q0, q0, q0 ++ veor q1, q1, q1 ++ veor q2, q2, q2 ++ ++ ldmia sp!, {r11, pc} @ return ++.size GFp_vpaes_encrypt_key_to_bsaes,.-GFp_vpaes_encrypt_key_to_bsaes ++___ ++} ++ ++{ ++# Register-passed parameters. ++my ($inp, $out, $len, $key) = map("r$_", 0..3); ++# Temporaries. _vpaes_encrypt_core already uses r8..r11, so overlap $ivec and ++# $tmp. $ctr is r7 because it must be preserved across calls. ++my ($ctr, $ivec, $tmp) = map("r$_", 7..9); ++ ++# void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len, ++# const AES_KEY *key, const uint8_t ivec[16]); ++$code .= <<___; ++.globl GFp_vpaes_ctr32_encrypt_blocks ++.type GFp_vpaes_ctr32_encrypt_blocks,%function ++.align 4 ++GFp_vpaes_ctr32_encrypt_blocks: ++ mov ip, sp ++ stmdb sp!, {r7-r11, lr} ++ @ This function uses q4-q7 (d8-d15), which are callee-saved. ++ vstmdb sp!, {d8-d15} ++ ++ cmp $len, #0 ++ @ $ivec is passed on the stack. ++ ldr $ivec, [ip] ++ beq .Lctr32_done ++ ++ @ _vpaes_encrypt_core expects the key in r2, so swap $len and $key. ++ mov $tmp, $key ++ mov $key, $len ++ mov $len, $tmp ++___ ++my ($len, $key) = ($key, $len); ++$code .= <<___; ++ ++ @ Load the IV and counter portion. ++ ldr $ctr, [$ivec, #12] ++ vld1.8 {q7}, [$ivec] ++ ++ bl _vpaes_preheat ++ rev $ctr, $ctr @ The counter is big-endian. ++ ++.Lctr32_loop: ++ vmov q0, q7 ++ vld1.8 {q6}, [$inp]! @ Load input ahead of time ++ bl _vpaes_encrypt_core ++ veor q0, q0, q6 @ XOR input and result ++ vst1.8 {q0}, [$out]! ++ subs $len, $len, #1 ++ @ Update the counter. ++ add $ctr, $ctr, #1 ++ rev $tmp, $ctr ++ vmov.32 q7#hi[1], $tmp ++ bne .Lctr32_loop ++ ++.Lctr32_done: ++ vldmia sp!, {d8-d15} ++ ldmia sp!, {r7-r11, pc} @ return ++.size GFp_vpaes_ctr32_encrypt_blocks,.-GFp_vpaes_ctr32_encrypt_blocks ++___ ++} ++ ++foreach (split("\n",$code)) { ++ s/\bq([0-9]+)#(lo|hi)/sprintf "d%d",2*$1+($2 eq "hi")/geo; ++ print $_,"\n"; ++} ++ ++close STDOUT; +diff --git a/crypto/fipsmodule/aes/asm/vpaes-armv8.pl b/crypto/fipsmodule/aes/asm/vpaes-armv8.pl +new file mode 100755 +index 0000000..b31bbb8 +--- /dev/null ++++ b/crypto/fipsmodule/aes/asm/vpaes-armv8.pl +@@ -0,0 +1,837 @@ ++#! /usr/bin/env perl ++# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. ++# ++# Licensed under the OpenSSL license (the "License"). You may not use ++# this file except in compliance with the License. You can obtain a copy ++# in the file LICENSE in the source distribution or at ++# https://www.openssl.org/source/license.html ++ ++ ++###################################################################### ++## Constant-time SSSE3 AES core implementation. ++## version 0.1 ++## ++## By Mike Hamburg (Stanford University), 2009 ++## Public domain. ++## ++## For details see http://shiftleft.org/papers/vector_aes/ and ++## http://crypto.stanford.edu/vpaes/. ++## ++###################################################################### ++# ARMv8 NEON adaptation by <appro@openssl.org> ++# ++# Reason for undertaken effort is that there is at least one popular ++# SoC based on Cortex-A53 that doesn't have crypto extensions. ++# ++# CBC enc ECB enc/dec(*) [bit-sliced enc/dec] ++# Cortex-A53 21.5 18.1/20.6 [17.5/19.8 ] ++# Cortex-A57 36.0(**) 20.4/24.9(**) [14.4/16.6 ] ++# X-Gene 45.9(**) 45.8/57.7(**) [33.1/37.6(**) ] ++# Denver(***) 16.6(**) 15.1/17.8(**) [8.80/9.93 ] ++# Apple A7(***) 22.7(**) 10.9/14.3 [8.45/10.0 ] ++# Mongoose(***) 26.3(**) 21.0/25.0(**) [13.3/16.8 ] ++# ++# (*) ECB denotes approximate result for parallelizable modes ++# such as CBC decrypt, CTR, etc.; ++# (**) these results are worse than scalar compiler-generated ++# code, but it's constant-time and therefore preferred; ++# (***) presented for reference/comparison purposes; ++ ++$flavour = shift; ++while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} ++ ++$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; ++( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or ++( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or ++die "can't locate arm-xlate.pl"; ++ ++open OUT,"| \"$^X\" $xlate $flavour $output"; ++*STDOUT=*OUT; ++ ++$code.=<<___; ++#include <GFp/arm_arch.h> ++ ++.section .rodata ++ ++.type _vpaes_consts,%object ++.align 7 // totally strategic alignment ++_vpaes_consts: ++.Lk_mc_forward: // mc_forward ++ .quad 0x0407060500030201, 0x0C0F0E0D080B0A09 ++ .quad 0x080B0A0904070605, 0x000302010C0F0E0D ++ .quad 0x0C0F0E0D080B0A09, 0x0407060500030201 ++ .quad 0x000302010C0F0E0D, 0x080B0A0904070605 ++.Lk_mc_backward:// mc_backward ++ .quad 0x0605040702010003, 0x0E0D0C0F0A09080B ++ .quad 0x020100030E0D0C0F, 0x0A09080B06050407 ++ .quad 0x0E0D0C0F0A09080B, 0x0605040702010003 ++ .quad 0x0A09080B06050407, 0x020100030E0D0C0F ++.Lk_sr: // sr ++ .quad 0x0706050403020100, 0x0F0E0D0C0B0A0908 ++ .quad 0x030E09040F0A0500, 0x0B06010C07020D08 ++ .quad 0x0F060D040B020900, 0x070E050C030A0108 ++ .quad 0x0B0E0104070A0D00, 0x0306090C0F020508 ++ ++// ++// "Hot" constants ++// ++.Lk_inv: // inv, inva ++ .quad 0x0E05060F0D080180, 0x040703090A0B0C02 ++ .quad 0x01040A060F0B0780, 0x030D0E0C02050809 ++.Lk_ipt: // input transform (lo, hi) ++ .quad 0xC2B2E8985A2A7000, 0xCABAE09052227808 ++ .quad 0x4C01307D317C4D00, 0xCD80B1FCB0FDCC81 ++.Lk_sbo: // sbou, sbot ++ .quad 0xD0D26D176FBDC700, 0x15AABF7AC502A878 ++ .quad 0xCFE474A55FBB6A00, 0x8E1E90D1412B35FA ++.Lk_sb1: // sb1u, sb1t ++ .quad 0x3618D415FAE22300, 0x3BF7CCC10D2ED9EF ++ .quad 0xB19BE18FCB503E00, 0xA5DF7A6E142AF544 ++.Lk_sb2: // sb2u, sb2t ++ .quad 0x69EB88400AE12900, 0xC2A163C8AB82234A ++ .quad 0xE27A93C60B712400, 0x5EB7E955BC982FCD ++ ++// ++// Key schedule constants ++// ++.Lk_dksd: // decryption key schedule: invskew x*D ++ .quad 0xFEB91A5DA3E44700, 0x0740E3A45A1DBEF9 ++ .quad 0x41C277F4B5368300, 0x5FDC69EAAB289D1E ++.Lk_dksb: // decryption key schedule: invskew x*B ++ .quad 0x9A4FCA1F8550D500, 0x03D653861CC94C99 ++ .quad 0x115BEDA7B6FC4A00, 0xD993256F7E3482C8 ++.Lk_dkse: // decryption key schedule: invskew x*E + 0x63 ++ .quad 0xD5031CCA1FC9D600, 0x53859A4C994F5086 ++ .quad 0xA23196054FDC7BE8, 0xCD5EF96A20B31487 ++.Lk_dks9: // decryption key schedule: invskew x*9 ++ .quad 0xB6116FC87ED9A700, 0x4AED933482255BFC ++ .quad 0x4576516227143300, 0x8BB89FACE9DAFDCE ++ ++.Lk_rcon: // rcon ++ .quad 0x1F8391B9AF9DEEB6, 0x702A98084D7C7D81 ++ ++.Lk_opt: // output transform ++ .quad 0xFF9F4929D6B66000, 0xF7974121DEBE6808 ++ .quad 0x01EDBD5150BCEC00, 0xE10D5DB1B05C0CE0 ++.Lk_deskew: // deskew tables: inverts the sbox's "skew" ++ .quad 0x07E4A34047A4E300, 0x1DFEB95A5DBEF91A ++ .quad 0x5F36B5DC83EA6900, 0x2841C2ABF49D1E77 ++ ++.asciz "Vector Permutation AES for ARMv8, Mike Hamburg (Stanford University)" ++.size _vpaes_consts,.-_vpaes_consts ++.align 6 ++ ++.text ++___ ++ ++{ ++my ($inp,$out,$key) = map("x$_",(0..2)); ++ ++my ($invlo,$invhi,$iptlo,$ipthi,$sbou,$sbot) = map("v$_.16b",(18..23)); ++my ($sb1u,$sb1t,$sb2u,$sb2t) = map("v$_.16b",(24..27)); ++my ($sb9u,$sb9t,$sbdu,$sbdt,$sbbu,$sbbt,$sbeu,$sbet)=map("v$_.16b",(24..31)); ++ ++$code.=<<___; ++## ++## _aes_preheat ++## ++## Fills register %r10 -> .aes_consts (so you can -fPIC) ++## and %xmm9-%xmm15 as specified below. ++## ++.type _vpaes_encrypt_preheat,%function ++.align 4 ++_vpaes_encrypt_preheat: ++ adrp x10, :pg_hi21:.Lk_inv ++ add x10, x10, :lo12:.Lk_inv ++ movi v17.16b, #0x0f ++ ld1 {v18.2d-v19.2d}, [x10],#32 // .Lk_inv ++ ld1 {v20.2d-v23.2d}, [x10],#64 // .Lk_ipt, .Lk_sbo ++ ld1 {v24.2d-v27.2d}, [x10] // .Lk_sb1, .Lk_sb2 ++ ret ++.size _vpaes_encrypt_preheat,.-_vpaes_encrypt_preheat ++ ++## ++## _aes_encrypt_core ++## ++## AES-encrypt %xmm0. ++## ++## Inputs: ++## %xmm0 = input ++## %xmm9-%xmm15 as in _vpaes_preheat ++## (%rdx) = scheduled keys ++## ++## Output in %xmm0 ++## Clobbers %xmm1-%xmm5, %r9, %r10, %r11, %rax ++## Preserves %xmm6 - %xmm8 so you get some local vectors ++## ++## ++.type _vpaes_encrypt_core,%function ++.align 4 ++_vpaes_encrypt_core: ++ mov x9, $key ++ ldr w8, [$key,#240] // pull rounds ++ adrp x11, :pg_hi21:.Lk_mc_forward+16 ++ add x11, x11, :lo12:.Lk_mc_forward+16 ++ // vmovdqa .Lk_ipt(%rip), %xmm2 # iptlo ++ ld1 {v16.2d}, [x9], #16 // vmovdqu (%r9), %xmm5 # round0 key ++ and v1.16b, v7.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1 ++ ushr v0.16b, v7.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 ++ tbl v1.16b, {$iptlo}, v1.16b // vpshufb %xmm1, %xmm2, %xmm1 ++ // vmovdqa .Lk_ipt+16(%rip), %xmm3 # ipthi ++ tbl v2.16b, {$ipthi}, v0.16b // vpshufb %xmm0, %xmm3, %xmm2 ++ eor v0.16b, v1.16b, v16.16b // vpxor %xmm5, %xmm1, %xmm0 ++ eor v0.16b, v0.16b, v2.16b // vpxor %xmm2, %xmm0, %xmm0 ++ b .Lenc_entry ++ ++.align 4 ++.Lenc_loop: ++ // middle of middle round ++ add x10, x11, #0x40 ++ tbl v4.16b, {$sb1t}, v2.16b // vpshufb %xmm2, %xmm13, %xmm4 # 4 = sb1u ++ ld1 {v1.2d}, [x11], #16 // vmovdqa -0x40(%r11,%r10), %xmm1 # .Lk_mc_forward[] ++ tbl v0.16b, {$sb1u}, v3.16b // vpshufb %xmm3, %xmm12, %xmm0 # 0 = sb1t ++ eor v4.16b, v4.16b, v16.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ tbl v5.16b, {$sb2t}, v2.16b // vpshufb %xmm2, %xmm15, %xmm5 # 4 = sb2u ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ tbl v2.16b, {$sb2u}, v3.16b // vpshufb %xmm3, %xmm14, %xmm2 # 2 = sb2t ++ ld1 {v4.2d}, [x10] // vmovdqa (%r11,%r10), %xmm4 # .Lk_mc_backward[] ++ tbl v3.16b, {v0.16b}, v1.16b // vpshufb %xmm1, %xmm0, %xmm3 # 0 = B ++ eor v2.16b, v2.16b, v5.16b // vpxor %xmm5, %xmm2, %xmm2 # 2 = 2A ++ tbl v0.16b, {v0.16b}, v4.16b // vpshufb %xmm4, %xmm0, %xmm0 # 3 = D ++ eor v3.16b, v3.16b, v2.16b // vpxor %xmm2, %xmm3, %xmm3 # 0 = 2A+B ++ tbl v4.16b, {v3.16b}, v1.16b // vpshufb %xmm1, %xmm3, %xmm4 # 0 = 2B+C ++ eor v0.16b, v0.16b, v3.16b // vpxor %xmm3, %xmm0, %xmm0 # 3 = 2A+B+D ++ and x11, x11, #~(1<<6) // and \$0x30, %r11 # ... mod 4 ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = 2A+3B+C+D ++ sub w8, w8, #1 // nr-- ++ ++.Lenc_entry: ++ // top of round ++ and v1.16b, v0.16b, v17.16b // vpand %xmm0, %xmm9, %xmm1 # 0 = k ++ ushr v0.16b, v0.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 # 1 = i ++ tbl v5.16b, {$invhi}, v1.16b // vpshufb %xmm1, %xmm11, %xmm5 # 2 = a/k ++ eor v1.16b, v1.16b, v0.16b // vpxor %xmm0, %xmm1, %xmm1 # 0 = j ++ tbl v3.16b, {$invlo}, v0.16b // vpshufb %xmm0, %xmm10, %xmm3 # 3 = 1/i ++ tbl v4.16b, {$invlo}, v1.16b // vpshufb %xmm1, %xmm10, %xmm4 # 4 = 1/j ++ eor v3.16b, v3.16b, v5.16b // vpxor %xmm5, %xmm3, %xmm3 # 3 = iak = 1/i + a/k ++ eor v4.16b, v4.16b, v5.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = jak = 1/j + a/k ++ tbl v2.16b, {$invlo}, v3.16b // vpshufb %xmm3, %xmm10, %xmm2 # 2 = 1/iak ++ tbl v3.16b, {$invlo}, v4.16b // vpshufb %xmm4, %xmm10, %xmm3 # 3 = 1/jak ++ eor v2.16b, v2.16b, v1.16b // vpxor %xmm1, %xmm2, %xmm2 # 2 = io ++ eor v3.16b, v3.16b, v0.16b // vpxor %xmm0, %xmm3, %xmm3 # 3 = jo ++ ld1 {v16.2d}, [x9],#16 // vmovdqu (%r9), %xmm5 ++ cbnz w8, .Lenc_loop ++ ++ // middle of last round ++ add x10, x11, #0x80 ++ // vmovdqa -0x60(%r10), %xmm4 # 3 : sbou .Lk_sbo ++ // vmovdqa -0x50(%r10), %xmm0 # 0 : sbot .Lk_sbo+16 ++ tbl v4.16b, {$sbou}, v2.16b // vpshufb %xmm2, %xmm4, %xmm4 # 4 = sbou ++ ld1 {v1.2d}, [x10] // vmovdqa 0x40(%r11,%r10), %xmm1 # .Lk_sr[] ++ tbl v0.16b, {$sbot}, v3.16b // vpshufb %xmm3, %xmm0, %xmm0 # 0 = sb1t ++ eor v4.16b, v4.16b, v16.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ tbl v0.16b, {v0.16b}, v1.16b // vpshufb %xmm1, %xmm0, %xmm0 ++ ret ++.size _vpaes_encrypt_core,.-_vpaes_encrypt_core ++ ++.globl GFp_vpaes_encrypt ++.type GFp_vpaes_encrypt,%function ++.align 4 ++GFp_vpaes_encrypt: ++ AARCH64_SIGN_LINK_REGISTER ++ stp x29,x30,[sp,#-16]! ++ add x29,sp,#0 ++ ++ ld1 {v7.16b}, [$inp] ++ bl _vpaes_encrypt_preheat ++ bl _vpaes_encrypt_core ++ st1 {v0.16b}, [$out] ++ ++ ldp x29,x30,[sp],#16 ++ AARCH64_VALIDATE_LINK_REGISTER ++ ret ++.size GFp_vpaes_encrypt,.-GFp_vpaes_encrypt ++ ++.type _vpaes_encrypt_2x,%function ++.align 4 ++_vpaes_encrypt_2x: ++ mov x9, $key ++ ldr w8, [$key,#240] // pull rounds ++ adrp x11, :pg_hi21:.Lk_mc_forward+16 ++ add x11, x11, :lo12:.Lk_mc_forward+16 ++ // vmovdqa .Lk_ipt(%rip), %xmm2 # iptlo ++ ld1 {v16.2d}, [x9], #16 // vmovdqu (%r9), %xmm5 # round0 key ++ and v1.16b, v14.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1 ++ ushr v0.16b, v14.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 ++ and v9.16b, v15.16b, v17.16b ++ ushr v8.16b, v15.16b, #4 ++ tbl v1.16b, {$iptlo}, v1.16b // vpshufb %xmm1, %xmm2, %xmm1 ++ tbl v9.16b, {$iptlo}, v9.16b ++ // vmovdqa .Lk_ipt+16(%rip), %xmm3 # ipthi ++ tbl v2.16b, {$ipthi}, v0.16b // vpshufb %xmm0, %xmm3, %xmm2 ++ tbl v10.16b, {$ipthi}, v8.16b ++ eor v0.16b, v1.16b, v16.16b // vpxor %xmm5, %xmm1, %xmm0 ++ eor v8.16b, v9.16b, v16.16b ++ eor v0.16b, v0.16b, v2.16b // vpxor %xmm2, %xmm0, %xmm0 ++ eor v8.16b, v8.16b, v10.16b ++ b .Lenc_2x_entry ++ ++.align 4 ++.Lenc_2x_loop: ++ // middle of middle round ++ add x10, x11, #0x40 ++ tbl v4.16b, {$sb1t}, v2.16b // vpshufb %xmm2, %xmm13, %xmm4 # 4 = sb1u ++ tbl v12.16b, {$sb1t}, v10.16b ++ ld1 {v1.2d}, [x11], #16 // vmovdqa -0x40(%r11,%r10), %xmm1 # .Lk_mc_forward[] ++ tbl v0.16b, {$sb1u}, v3.16b // vpshufb %xmm3, %xmm12, %xmm0 # 0 = sb1t ++ tbl v8.16b, {$sb1u}, v11.16b ++ eor v4.16b, v4.16b, v16.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ eor v12.16b, v12.16b, v16.16b ++ tbl v5.16b, {$sb2t}, v2.16b // vpshufb %xmm2, %xmm15, %xmm5 # 4 = sb2u ++ tbl v13.16b, {$sb2t}, v10.16b ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ eor v8.16b, v8.16b, v12.16b ++ tbl v2.16b, {$sb2u}, v3.16b // vpshufb %xmm3, %xmm14, %xmm2 # 2 = sb2t ++ tbl v10.16b, {$sb2u}, v11.16b ++ ld1 {v4.2d}, [x10] // vmovdqa (%r11,%r10), %xmm4 # .Lk_mc_backward[] ++ tbl v3.16b, {v0.16b}, v1.16b // vpshufb %xmm1, %xmm0, %xmm3 # 0 = B ++ tbl v11.16b, {v8.16b}, v1.16b ++ eor v2.16b, v2.16b, v5.16b // vpxor %xmm5, %xmm2, %xmm2 # 2 = 2A ++ eor v10.16b, v10.16b, v13.16b ++ tbl v0.16b, {v0.16b}, v4.16b // vpshufb %xmm4, %xmm0, %xmm0 # 3 = D ++ tbl v8.16b, {v8.16b}, v4.16b ++ eor v3.16b, v3.16b, v2.16b // vpxor %xmm2, %xmm3, %xmm3 # 0 = 2A+B ++ eor v11.16b, v11.16b, v10.16b ++ tbl v4.16b, {v3.16b}, v1.16b // vpshufb %xmm1, %xmm3, %xmm4 # 0 = 2B+C ++ tbl v12.16b, {v11.16b},v1.16b ++ eor v0.16b, v0.16b, v3.16b // vpxor %xmm3, %xmm0, %xmm0 # 3 = 2A+B+D ++ eor v8.16b, v8.16b, v11.16b ++ and x11, x11, #~(1<<6) // and \$0x30, %r11 # ... mod 4 ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = 2A+3B+C+D ++ eor v8.16b, v8.16b, v12.16b ++ sub w8, w8, #1 // nr-- ++ ++.Lenc_2x_entry: ++ // top of round ++ and v1.16b, v0.16b, v17.16b // vpand %xmm0, %xmm9, %xmm1 # 0 = k ++ ushr v0.16b, v0.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 # 1 = i ++ and v9.16b, v8.16b, v17.16b ++ ushr v8.16b, v8.16b, #4 ++ tbl v5.16b, {$invhi},v1.16b // vpshufb %xmm1, %xmm11, %xmm5 # 2 = a/k ++ tbl v13.16b, {$invhi},v9.16b ++ eor v1.16b, v1.16b, v0.16b // vpxor %xmm0, %xmm1, %xmm1 # 0 = j ++ eor v9.16b, v9.16b, v8.16b ++ tbl v3.16b, {$invlo},v0.16b // vpshufb %xmm0, %xmm10, %xmm3 # 3 = 1/i ++ tbl v11.16b, {$invlo},v8.16b ++ tbl v4.16b, {$invlo},v1.16b // vpshufb %xmm1, %xmm10, %xmm4 # 4 = 1/j ++ tbl v12.16b, {$invlo},v9.16b ++ eor v3.16b, v3.16b, v5.16b // vpxor %xmm5, %xmm3, %xmm3 # 3 = iak = 1/i + a/k ++ eor v11.16b, v11.16b, v13.16b ++ eor v4.16b, v4.16b, v5.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = jak = 1/j + a/k ++ eor v12.16b, v12.16b, v13.16b ++ tbl v2.16b, {$invlo},v3.16b // vpshufb %xmm3, %xmm10, %xmm2 # 2 = 1/iak ++ tbl v10.16b, {$invlo},v11.16b ++ tbl v3.16b, {$invlo},v4.16b // vpshufb %xmm4, %xmm10, %xmm3 # 3 = 1/jak ++ tbl v11.16b, {$invlo},v12.16b ++ eor v2.16b, v2.16b, v1.16b // vpxor %xmm1, %xmm2, %xmm2 # 2 = io ++ eor v10.16b, v10.16b, v9.16b ++ eor v3.16b, v3.16b, v0.16b // vpxor %xmm0, %xmm3, %xmm3 # 3 = jo ++ eor v11.16b, v11.16b, v8.16b ++ ld1 {v16.2d}, [x9],#16 // vmovdqu (%r9), %xmm5 ++ cbnz w8, .Lenc_2x_loop ++ ++ // middle of last round ++ add x10, x11, #0x80 ++ // vmovdqa -0x60(%r10), %xmm4 # 3 : sbou .Lk_sbo ++ // vmovdqa -0x50(%r10), %xmm0 # 0 : sbot .Lk_sbo+16 ++ tbl v4.16b, {$sbou}, v2.16b // vpshufb %xmm2, %xmm4, %xmm4 # 4 = sbou ++ tbl v12.16b, {$sbou}, v10.16b ++ ld1 {v1.2d}, [x10] // vmovdqa 0x40(%r11,%r10), %xmm1 # .Lk_sr[] ++ tbl v0.16b, {$sbot}, v3.16b // vpshufb %xmm3, %xmm0, %xmm0 # 0 = sb1t ++ tbl v8.16b, {$sbot}, v11.16b ++ eor v4.16b, v4.16b, v16.16b // vpxor %xmm5, %xmm4, %xmm4 # 4 = sb1u + k ++ eor v12.16b, v12.16b, v16.16b ++ eor v0.16b, v0.16b, v4.16b // vpxor %xmm4, %xmm0, %xmm0 # 0 = A ++ eor v8.16b, v8.16b, v12.16b ++ tbl v0.16b, {v0.16b},v1.16b // vpshufb %xmm1, %xmm0, %xmm0 ++ tbl v1.16b, {v8.16b},v1.16b ++ ret ++.size _vpaes_encrypt_2x,.-_vpaes_encrypt_2x ++___ ++} ++{ ++my ($inp,$bits,$out,$dir)=("x0","w1","x2","w3"); ++my ($invlo,$invhi,$iptlo,$ipthi,$rcon) = map("v$_.16b",(18..21,8)); ++ ++$code.=<<___; ++######################################################## ++## ## ++## AES key schedule ## ++## ## ++######################################################## ++.type _vpaes_key_preheat,%function ++.align 4 ++_vpaes_key_preheat: ++ adrp x10, :pg_hi21:.Lk_inv ++ add x10, x10, :lo12:.Lk_inv ++ movi v16.16b, #0x5b // .Lk_s63 ++ adrp x11, :pg_hi21:.Lk_sb1 ++ add x11, x11, :lo12:.Lk_sb1 ++ movi v17.16b, #0x0f // .Lk_s0F ++ ld1 {v18.2d-v21.2d}, [x10] // .Lk_inv, .Lk_ipt ++ adrp x10, :pg_hi21:.Lk_dksd ++ add x10, x10, :lo12:.Lk_dksd ++ ld1 {v22.2d-v23.2d}, [x11] // .Lk_sb1 ++ adrp x11, :pg_hi21:.Lk_mc_forward ++ add x11, x11, :lo12:.Lk_mc_forward ++ ld1 {v24.2d-v27.2d}, [x10],#64 // .Lk_dksd, .Lk_dksb ++ ld1 {v28.2d-v31.2d}, [x10],#64 // .Lk_dkse, .Lk_dks9 ++ ld1 {v8.2d}, [x10] // .Lk_rcon ++ ld1 {v9.2d}, [x11] // .Lk_mc_forward[0] ++ ret ++.size _vpaes_key_preheat,.-_vpaes_key_preheat ++ ++.type _vpaes_schedule_core,%function ++.align 4 ++_vpaes_schedule_core: ++ AARCH64_SIGN_LINK_REGISTER ++ stp x29, x30, [sp,#-16]! ++ add x29,sp,#0 ++ ++ bl _vpaes_key_preheat // load the tables ++ ++ ld1 {v0.16b}, [$inp],#16 // vmovdqu (%rdi), %xmm0 # load key (unaligned) ++ ++ // input transform ++ mov v3.16b, v0.16b // vmovdqa %xmm0, %xmm3 ++ bl _vpaes_schedule_transform ++ mov v7.16b, v0.16b // vmovdqa %xmm0, %xmm7 ++ ++ adrp x10, :pg_hi21:.Lk_sr // lea .Lk_sr(%rip),%r10 ++ add x10, x10, :lo12:.Lk_sr ++ ++ add x8, x8, x10 ++ ++ // encrypting, output zeroth round key after transform ++ st1 {v0.2d}, [$out] // vmovdqu %xmm0, (%rdx) ++ ++ cmp $bits, #192 // cmp \$192, %esi ++ b.hi .Lschedule_256 ++ b.eq .Lschedule_192 ++ // 128: fall though ++ ++## ++## .schedule_128 ++## ++## 128-bit specific part of key schedule. ++## ++## This schedule is really simple, because all its parts ++## are accomplished by the subroutines. ++## ++.Lschedule_128: ++ mov $inp, #10 // mov \$10, %esi ++ ++.Loop_schedule_128: ++ sub $inp, $inp, #1 // dec %esi ++ bl _vpaes_schedule_round ++ cbz $inp, .Lschedule_mangle_last ++ bl _vpaes_schedule_mangle // write output ++ b .Loop_schedule_128 ++ ++## ++## .aes_schedule_192 ++## ++## 192-bit specific part of key schedule. ++## ++## The main body of this schedule is the same as the 128-bit ++## schedule, but with more smearing. The long, high side is ++## stored in %xmm7 as before, and the short, low side is in ++## the high bits of %xmm6. ++## ++## This schedule is somewhat nastier, however, because each ++## round produces 192 bits of key material, or 1.5 round keys. ++## Therefore, on each cycle we do 2 rounds and produce 3 round ++## keys. ++## ++.align 4 ++.Lschedule_192: ++ sub $inp, $inp, #8 ++ ld1 {v0.16b}, [$inp] // vmovdqu 8(%rdi),%xmm0 # load key part 2 (very unaligned) ++ bl _vpaes_schedule_transform // input transform ++ mov v6.16b, v0.16b // vmovdqa %xmm0, %xmm6 # save short part ++ eor v4.16b, v4.16b, v4.16b // vpxor %xmm4, %xmm4, %xmm4 # clear 4 ++ ins v6.d[0], v4.d[0] // vmovhlps %xmm4, %xmm6, %xmm6 # clobber low side with zeros ++ mov $inp, #4 // mov \$4, %esi ++ ++.Loop_schedule_192: ++ sub $inp, $inp, #1 // dec %esi ++ bl _vpaes_schedule_round ++ ext v0.16b, v6.16b, v0.16b, #8 // vpalignr \$8,%xmm6,%xmm0,%xmm0 ++ bl _vpaes_schedule_mangle // save key n ++ bl _vpaes_schedule_192_smear ++ bl _vpaes_schedule_mangle // save key n+1 ++ bl _vpaes_schedule_round ++ cbz $inp, .Lschedule_mangle_last ++ bl _vpaes_schedule_mangle // save key n+2 ++ bl _vpaes_schedule_192_smear ++ b .Loop_schedule_192 ++ ++## ++## .aes_schedule_256 ++## ++## 256-bit specific part of key schedule. ++## ++## The structure here is very similar to the 128-bit ++## schedule, but with an additional "low side" in ++## %xmm6. The low side's rounds are the same as the ++## high side's, except no rcon and no rotation. ++## ++.align 4 ++.Lschedule_256: ++ ld1 {v0.16b}, [$inp] // vmovdqu 16(%rdi),%xmm0 # load key part 2 (unaligned) ++ bl _vpaes_schedule_transform // input transform ++ mov $inp, #7 // mov \$7, %esi ++ ++.Loop_schedule_256: ++ sub $inp, $inp, #1 // dec %esi ++ bl _vpaes_schedule_mangle // output low result ++ mov v6.16b, v0.16b // vmovdqa %xmm0, %xmm6 # save cur_lo in xmm6 ++ ++ // high round ++ bl _vpaes_schedule_round ++ cbz $inp, .Lschedule_mangle_last ++ bl _vpaes_schedule_mangle ++ ++ // low round. swap xmm7 and xmm6 ++ dup v0.4s, v0.s[3] // vpshufd \$0xFF, %xmm0, %xmm0 ++ movi v4.16b, #0 ++ mov v5.16b, v7.16b // vmovdqa %xmm7, %xmm5 ++ mov v7.16b, v6.16b // vmovdqa %xmm6, %xmm7 ++ bl _vpaes_schedule_low_round ++ mov v7.16b, v5.16b // vmovdqa %xmm5, %xmm7 ++ ++ b .Loop_schedule_256 ++ ++## ++## .aes_schedule_mangle_last ++## ++## Mangler for last round of key schedule ++## Mangles %xmm0 ++## when encrypting, outputs out(%xmm0) ^ 63 ++## when decrypting, outputs unskew(%xmm0) ++## ++## Always called right before return... jumps to cleanup and exits ++## ++.align 4 ++.Lschedule_mangle_last: ++ // schedule last round key from xmm0 ++ adrp x11, :pg_hi21:.Lk_deskew // lea .Lk_deskew(%rip),%r11 # prepare to deskew ++ add x11, x11, :lo12:.Lk_deskew ++ ++ cbnz $dir, .Lschedule_mangle_last_dec ++ ++ // encrypting ++ ld1 {v1.2d}, [x8] // vmovdqa (%r8,%r10),%xmm1 ++ adrp x11, :pg_hi21:.Lk_opt // lea .Lk_opt(%rip), %r11 # prepare to output transform ++ add x11, x11, :lo12:.Lk_opt ++ add $out, $out, #32 // add \$32, %rdx ++ tbl v0.16b, {v0.16b}, v1.16b // vpshufb %xmm1, %xmm0, %xmm0 # output permute ++ ++.Lschedule_mangle_last_dec: ++ ld1 {v20.2d-v21.2d}, [x11] // reload constants ++ sub $out, $out, #16 // add \$-16, %rdx ++ eor v0.16b, v0.16b, v16.16b // vpxor .Lk_s63(%rip), %xmm0, %xmm0 ++ bl _vpaes_schedule_transform // output transform ++ st1 {v0.2d}, [$out] // vmovdqu %xmm0, (%rdx) # save last key ++ ++ // cleanup ++ eor v0.16b, v0.16b, v0.16b // vpxor %xmm0, %xmm0, %xmm0 ++ eor v1.16b, v1.16b, v1.16b // vpxor %xmm1, %xmm1, %xmm1 ++ eor v2.16b, v2.16b, v2.16b // vpxor %xmm2, %xmm2, %xmm2 ++ eor v3.16b, v3.16b, v3.16b // vpxor %xmm3, %xmm3, %xmm3 ++ eor v4.16b, v4.16b, v4.16b // vpxor %xmm4, %xmm4, %xmm4 ++ eor v5.16b, v5.16b, v5.16b // vpxor %xmm5, %xmm5, %xmm5 ++ eor v6.16b, v6.16b, v6.16b // vpxor %xmm6, %xmm6, %xmm6 ++ eor v7.16b, v7.16b, v7.16b // vpxor %xmm7, %xmm7, %xmm7 ++ ldp x29, x30, [sp],#16 ++ AARCH64_VALIDATE_LINK_REGISTER ++ ret ++.size _vpaes_schedule_core,.-_vpaes_schedule_core ++ ++## ++## .aes_schedule_192_smear ++## ++## Smear the short, low side in the 192-bit key schedule. ++## ++## Inputs: ++## %xmm7: high side, b a x y ++## %xmm6: low side, d c 0 0 ++## %xmm13: 0 ++## ++## Outputs: ++## %xmm6: b+c+d b+c 0 0 ++## %xmm0: b+c+d b+c b a ++## ++.type _vpaes_schedule_192_smear,%function ++.align 4 ++_vpaes_schedule_192_smear: ++ movi v1.16b, #0 ++ dup v0.4s, v7.s[3] ++ ins v1.s[3], v6.s[2] // vpshufd \$0x80, %xmm6, %xmm1 # d c 0 0 -> c 0 0 0 ++ ins v0.s[0], v7.s[2] // vpshufd \$0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a ++ eor v6.16b, v6.16b, v1.16b // vpxor %xmm1, %xmm6, %xmm6 # -> c+d c 0 0 ++ eor v1.16b, v1.16b, v1.16b // vpxor %xmm1, %xmm1, %xmm1 ++ eor v6.16b, v6.16b, v0.16b // vpxor %xmm0, %xmm6, %xmm6 # -> b+c+d b+c b a ++ mov v0.16b, v6.16b // vmovdqa %xmm6, %xmm0 ++ ins v6.d[0], v1.d[0] // vmovhlps %xmm1, %xmm6, %xmm6 # clobber low side with zeros ++ ret ++.size _vpaes_schedule_192_smear,.-_vpaes_schedule_192_smear ++ ++## ++## .aes_schedule_round ++## ++## Runs one main round of the key schedule on %xmm0, %xmm7 ++## ++## Specifically, runs subbytes on the high dword of %xmm0 ++## then rotates it by one byte and xors into the low dword of ++## %xmm7. ++## ++## Adds rcon from low byte of %xmm8, then rotates %xmm8 for ++## next rcon. ++## ++## Smears the dwords of %xmm7 by xoring the low into the ++## second low, result into third, result into highest. ++## ++## Returns results in %xmm7 = %xmm0. ++## Clobbers %xmm1-%xmm4, %r11. ++## ++.type _vpaes_schedule_round,%function ++.align 4 ++_vpaes_schedule_round: ++ // extract rcon from xmm8 ++ movi v4.16b, #0 // vpxor %xmm4, %xmm4, %xmm4 ++ ext v1.16b, $rcon, v4.16b, #15 // vpalignr \$15, %xmm8, %xmm4, %xmm1 ++ ext $rcon, $rcon, $rcon, #15 // vpalignr \$15, %xmm8, %xmm8, %xmm8 ++ eor v7.16b, v7.16b, v1.16b // vpxor %xmm1, %xmm7, %xmm7 ++ ++ // rotate ++ dup v0.4s, v0.s[3] // vpshufd \$0xFF, %xmm0, %xmm0 ++ ext v0.16b, v0.16b, v0.16b, #1 // vpalignr \$1, %xmm0, %xmm0, %xmm0 ++ ++ // fall through... ++ ++ // low round: same as high round, but no rotation and no rcon. ++_vpaes_schedule_low_round: ++ // smear xmm7 ++ ext v1.16b, v4.16b, v7.16b, #12 // vpslldq \$4, %xmm7, %xmm1 ++ eor v7.16b, v7.16b, v1.16b // vpxor %xmm1, %xmm7, %xmm7 ++ ext v4.16b, v4.16b, v7.16b, #8 // vpslldq \$8, %xmm7, %xmm4 ++ ++ // subbytes ++ and v1.16b, v0.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1 # 0 = k ++ ushr v0.16b, v0.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 # 1 = i ++ eor v7.16b, v7.16b, v4.16b // vpxor %xmm4, %xmm7, %xmm7 ++ tbl v2.16b, {$invhi}, v1.16b // vpshufb %xmm1, %xmm11, %xmm2 # 2 = a/k ++ eor v1.16b, v1.16b, v0.16b // vpxor %xmm0, %xmm1, %xmm1 # 0 = j ++ tbl v3.16b, {$invlo}, v0.16b // vpshufb %xmm0, %xmm10, %xmm3 # 3 = 1/i ++ eor v3.16b, v3.16b, v2.16b // vpxor %xmm2, %xmm3, %xmm3 # 3 = iak = 1/i + a/k ++ tbl v4.16b, {$invlo}, v1.16b // vpshufb %xmm1, %xmm10, %xmm4 # 4 = 1/j ++ eor v7.16b, v7.16b, v16.16b // vpxor .Lk_s63(%rip), %xmm7, %xmm7 ++ tbl v3.16b, {$invlo}, v3.16b // vpshufb %xmm3, %xmm10, %xmm3 # 2 = 1/iak ++ eor v4.16b, v4.16b, v2.16b // vpxor %xmm2, %xmm4, %xmm4 # 4 = jak = 1/j + a/k ++ tbl v2.16b, {$invlo}, v4.16b // vpshufb %xmm4, %xmm10, %xmm2 # 3 = 1/jak ++ eor v3.16b, v3.16b, v1.16b // vpxor %xmm1, %xmm3, %xmm3 # 2 = io ++ eor v2.16b, v2.16b, v0.16b // vpxor %xmm0, %xmm2, %xmm2 # 3 = jo ++ tbl v4.16b, {v23.16b}, v3.16b // vpshufb %xmm3, %xmm13, %xmm4 # 4 = sbou ++ tbl v1.16b, {v22.16b}, v2.16b // vpshufb %xmm2, %xmm12, %xmm1 # 0 = sb1t ++ eor v1.16b, v1.16b, v4.16b // vpxor %xmm4, %xmm1, %xmm1 # 0 = sbox output ++ ++ // add in smeared stuff ++ eor v0.16b, v1.16b, v7.16b // vpxor %xmm7, %xmm1, %xmm0 ++ eor v7.16b, v1.16b, v7.16b // vmovdqa %xmm0, %xmm7 ++ ret ++.size _vpaes_schedule_round,.-_vpaes_schedule_round ++ ++## ++## .aes_schedule_transform ++## ++## Linear-transform %xmm0 according to tables at (%r11) ++## ++## Requires that %xmm9 = 0x0F0F... as in preheat ++## Output in %xmm0 ++## Clobbers %xmm1, %xmm2 ++## ++.type _vpaes_schedule_transform,%function ++.align 4 ++_vpaes_schedule_transform: ++ and v1.16b, v0.16b, v17.16b // vpand %xmm9, %xmm0, %xmm1 ++ ushr v0.16b, v0.16b, #4 // vpsrlb \$4, %xmm0, %xmm0 ++ // vmovdqa (%r11), %xmm2 # lo ++ tbl v2.16b, {$iptlo}, v1.16b // vpshufb %xmm1, %xmm2, %xmm2 ++ // vmovdqa 16(%r11), %xmm1 # hi ++ tbl v0.16b, {$ipthi}, v0.16b // vpshufb %xmm0, %xmm1, %xmm0 ++ eor v0.16b, v0.16b, v2.16b // vpxor %xmm2, %xmm0, %xmm0 ++ ret ++.size _vpaes_schedule_transform,.-_vpaes_schedule_transform ++ ++## ++## .aes_schedule_mangle ++## ++## Mangle xmm0 from (basis-transformed) standard version ++## to our version. ++## ++## On encrypt, ++## xor with 0x63 ++## multiply by circulant 0,1,1,1 ++## apply shiftrows transform ++## ++## On decrypt, ++## xor with 0x63 ++## multiply by "inverse mixcolumns" circulant E,B,D,9 ++## deskew ++## apply shiftrows transform ++## ++## ++## Writes out to (%rdx), and increments or decrements it ++## Keeps track of round number mod 4 in %r8 ++## Preserves xmm0 ++## Clobbers xmm1-xmm5 ++## ++.type _vpaes_schedule_mangle,%function ++.align 4 ++_vpaes_schedule_mangle: ++ mov v4.16b, v0.16b // vmovdqa %xmm0, %xmm4 # save xmm0 for later ++ // vmovdqa .Lk_mc_forward(%rip),%xmm5 ++ ++ // encrypting ++ eor v4.16b, v0.16b, v16.16b // vpxor .Lk_s63(%rip), %xmm0, %xmm4 ++ add $out, $out, #16 // add \$16, %rdx ++ tbl v4.16b, {v4.16b}, v9.16b // vpshufb %xmm5, %xmm4, %xmm4 ++ tbl v1.16b, {v4.16b}, v9.16b // vpshufb %xmm5, %xmm4, %xmm1 ++ tbl v3.16b, {v1.16b}, v9.16b // vpshufb %xmm5, %xmm1, %xmm3 ++ eor v4.16b, v4.16b, v1.16b // vpxor %xmm1, %xmm4, %xmm4 ++ ld1 {v1.2d}, [x8] // vmovdqa (%r8,%r10), %xmm1 ++ eor v3.16b, v3.16b, v4.16b // vpxor %xmm4, %xmm3, %xmm3 ++ ++.Lschedule_mangle_both: ++ tbl v3.16b, {v3.16b}, v1.16b // vpshufb %xmm1, %xmm3, %xmm3 ++ add x8, x8, #64-16 // add \$-16, %r8 ++ and x8, x8, #~(1<<6) // and \$0x30, %r8 ++ st1 {v3.2d}, [$out] // vmovdqu %xmm3, (%rdx) ++ ret ++.size _vpaes_schedule_mangle,.-_vpaes_schedule_mangle ++ ++.globl GFp_vpaes_set_encrypt_key ++.type GFp_vpaes_set_encrypt_key,%function ++.align 4 ++GFp_vpaes_set_encrypt_key: ++ AARCH64_SIGN_LINK_REGISTER ++ stp x29,x30,[sp,#-16]! ++ add x29,sp,#0 ++ stp d8,d9,[sp,#-16]! // ABI spec says so ++ ++ lsr w9, $bits, #5 // shr \$5,%eax ++ add w9, w9, #5 // \$5,%eax ++ str w9, [$out,#240] // mov %eax,240(%rdx) # AES_KEY->rounds = nbits/32+5; ++ ++ mov $dir, #0 // mov \$0,%ecx ++ mov x8, #0x30 // mov \$0x30,%r8d ++ bl _vpaes_schedule_core ++ eor x0, x0, x0 ++ ++ ldp d8,d9,[sp],#16 ++ ldp x29,x30,[sp],#16 ++ AARCH64_VALIDATE_LINK_REGISTER ++ ret ++.size GFp_vpaes_set_encrypt_key,.-GFp_vpaes_set_encrypt_key ++___ ++} ++{ ++my ($inp,$out,$len,$key,$ivec) = map("x$_",(0..4)); ++my ($ctr, $ctr_tmp) = ("w6", "w7"); ++ ++# void GFp_vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len, ++# const AES_KEY *key, const uint8_t ivec[16]); ++$code.=<<___; ++.globl GFp_vpaes_ctr32_encrypt_blocks ++.type GFp_vpaes_ctr32_encrypt_blocks,%function ++.align 4 ++GFp_vpaes_ctr32_encrypt_blocks: ++ AARCH64_SIGN_LINK_REGISTER ++ stp x29,x30,[sp,#-16]! ++ add x29,sp,#0 ++ stp d8,d9,[sp,#-16]! // ABI spec says so ++ stp d10,d11,[sp,#-16]! ++ stp d12,d13,[sp,#-16]! ++ stp d14,d15,[sp,#-16]! ++ ++ cbz $len, .Lctr32_done ++ ++ // Note, unlike the other functions, $len here is measured in blocks, ++ // not bytes. ++ mov x17, $len ++ mov x2, $key ++ ++ // Load the IV and counter portion. ++ ldr $ctr, [$ivec, #12] ++ ld1 {v7.16b}, [$ivec] ++ ++ bl _vpaes_encrypt_preheat ++ tst x17, #1 ++ rev $ctr, $ctr // The counter is big-endian. ++ b.eq .Lctr32_prep_loop ++ ++ // Handle one block so the remaining block count is even for ++ // _vpaes_encrypt_2x. ++ ld1 {v6.16b}, [$inp], #16 // Load input ahead of time ++ bl _vpaes_encrypt_core ++ eor v0.16b, v0.16b, v6.16b // XOR input and result ++ st1 {v0.16b}, [$out], #16 ++ subs x17, x17, #1 ++ // Update the counter. ++ add $ctr, $ctr, #1 ++ rev $ctr_tmp, $ctr ++ mov v7.s[3], $ctr_tmp ++ b.ls .Lctr32_done ++ ++.Lctr32_prep_loop: ++ // _vpaes_encrypt_core takes its input from v7, while _vpaes_encrypt_2x ++ // uses v14 and v15. ++ mov v15.16b, v7.16b ++ mov v14.16b, v7.16b ++ add $ctr, $ctr, #1 ++ rev $ctr_tmp, $ctr ++ mov v15.s[3], $ctr_tmp ++ ++.Lctr32_loop: ++ ld1 {v6.16b,v7.16b}, [$inp], #32 // Load input ahead of time ++ bl _vpaes_encrypt_2x ++ eor v0.16b, v0.16b, v6.16b // XOR input and result ++ eor v1.16b, v1.16b, v7.16b // XOR input and result (#2) ++ st1 {v0.16b,v1.16b}, [$out], #32 ++ subs x17, x17, #2 ++ // Update the counter. ++ add $ctr_tmp, $ctr, #1 ++ add $ctr, $ctr, #2 ++ rev $ctr_tmp, $ctr_tmp ++ mov v14.s[3], $ctr_tmp ++ rev $ctr_tmp, $ctr ++ mov v15.s[3], $ctr_tmp ++ b.hi .Lctr32_loop ++ ++.Lctr32_done: ++ ldp d14,d15,[sp],#16 ++ ldp d12,d13,[sp],#16 ++ ldp d10,d11,[sp],#16 ++ ldp d8,d9,[sp],#16 ++ ldp x29,x30,[sp],#16 ++ AARCH64_VALIDATE_LINK_REGISTER ++ ret ++.size GFp_vpaes_ctr32_encrypt_blocks,.-GFp_vpaes_ctr32_encrypt_blocks ++___ ++} ++ ++print $code; ++ ++close STDOUT or die "error closing STDOUT"; +diff --git a/crypto/fipsmodule/modes/asm/ghash-neon-armv8.pl b/crypto/fipsmodule/modes/asm/ghash-neon-armv8.pl +new file mode 100644 +index 0000000..7e52ad6 +--- /dev/null ++++ b/crypto/fipsmodule/modes/asm/ghash-neon-armv8.pl +@@ -0,0 +1,294 @@ ++#! /usr/bin/env perl ++# Copyright 2010-2016 The OpenSSL Project Authors. All Rights Reserved. ++# ++# Licensed under the OpenSSL license (the "License"). You may not use ++# this file except in compliance with the License. You can obtain a copy ++# in the file LICENSE in the source distribution or at ++# https://www.openssl.org/source/license.html ++ ++# ==================================================================== ++# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL ++# project. The module is, however, dual licensed under OpenSSL and ++# CRYPTOGAMS licenses depending on where you obtain it. For further ++# details see http://www.openssl.org/~appro/cryptogams/. ++# ==================================================================== ++ ++# This file was adapted to AArch64 from the 32-bit version in ghash-armv4.pl. It ++# implements the multiplication algorithm described in: ++# ++# Câmara, D.; Gouvêa, C. P. L.; López, J. & Dahab, R.: Fast Software ++# Polynomial Multiplication on ARM Processors using the NEON Engine. ++# ++# http://conradoplg.cryptoland.net/files/2010/12/mocrysen13.pdf ++# ++# The main distinction to keep in mind between 32-bit NEON and AArch64 SIMD is ++# AArch64 cannot compute over the upper halves of SIMD registers. In 32-bit ++# NEON, the low and high halves of the 128-bit register q0 are accessible as ++# 64-bit registers d0 and d1, respectively. In AArch64, dN is the lower half of ++# vN. Where the 32-bit version would use the upper half, this file must keep ++# halves in separate registers. ++# ++# The other distinction is in syntax. 32-bit NEON embeds lane information in the ++# instruction name, while AArch64 uses suffixes on the registers. For instance, ++# left-shifting 64-bit lanes of a SIMD register in 32-bit would be written: ++# ++# vshl.i64 q0, q0, #1 ++# ++# in 64-bit, it would be written: ++# ++# shl v0.2d, v0.2d, #1 ++# ++# See Programmer's Guide for ARMv8-A, section 7 for details. ++# http://infocenter.arm.com/help/topic/com.arm.doc.den0024a/DEN0024A_v8_architecture_PG.pdf ++# ++# Finally, note the 8-bit and 64-bit polynomial multipliers in AArch64 differ ++# only by suffix. pmull vR.8h, vA.8b, vB.8b multiplies eight 8-bit polynomials ++# and is always available. pmull vR.1q, vA.1d, vB.1d multiplies a 64-bit ++# polynomial and is conditioned on the PMULL extension. This file emulates the ++# latter with the former. ++ ++use strict; ++ ++my $flavour = shift; ++my $output; ++if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; } ++else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} } ++ ++if ($flavour && $flavour ne "void") { ++ $0 =~ m/(.*[\/\\])[^\/\\]+$/; ++ my $dir = $1; ++ my $xlate; ++ ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or ++ ( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or ++ die "can't locate arm-xlate.pl"; ++ ++ open OUT,"| \"$^X\" $xlate $flavour $output"; ++ *STDOUT=*OUT; ++} else { ++ open OUT,">$output"; ++ *STDOUT=*OUT; ++} ++ ++my ($Xi, $Htbl, $inp, $len) = map("x$_", (0..3)); # argument block ++my ($Xl, $Xm, $Xh, $INlo, $INhi) = map("v$_", (0..4)); ++my ($Hlo, $Hhi, $Hhl) = map("v$_", (5..7)); ++# d8-d15 are callee-saved, so avoid v8-v15. AArch64 SIMD has plenty of registers ++# to spare. ++my ($t0, $t1, $t2, $t3) = map("v$_", (16..19)); ++my ($t0l_t1l, $t0h_t1h, $t2l_t3l, $t2h_t3h) = map("v$_", (20..23)); ++my ($k48_k32, $k16_k0) = map("v$_", (24..25)); ++ ++my $code = ""; ++ ++# clmul64x64 emits code which emulates pmull $r.1q, $a.1d, $b.1d. $r, $a, and $b ++# must be distinct from $t* and $k*. $t* are clobbered by the emitted code. ++sub clmul64x64 { ++my ($r, $a, $b) = @_; ++$code .= <<___; ++ ext $t0.8b, $a.8b, $a.8b, #1 // A1 ++ pmull $t0.8h, $t0.8b, $b.8b // F = A1*B ++ ext $r.8b, $b.8b, $b.8b, #1 // B1 ++ pmull $r.8h, $a.8b, $r.8b // E = A*B1 ++ ext $t1.8b, $a.8b, $a.8b, #2 // A2 ++ pmull $t1.8h, $t1.8b, $b.8b // H = A2*B ++ ext $t3.8b, $b.8b, $b.8b, #2 // B2 ++ pmull $t3.8h, $a.8b, $t3.8b // G = A*B2 ++ ext $t2.8b, $a.8b, $a.8b, #3 // A3 ++ eor $t0.16b, $t0.16b, $r.16b // L = E + F ++ pmull $t2.8h, $t2.8b, $b.8b // J = A3*B ++ ext $r.8b, $b.8b, $b.8b, #3 // B3 ++ eor $t1.16b, $t1.16b, $t3.16b // M = G + H ++ pmull $r.8h, $a.8b, $r.8b // I = A*B3 ++ ++ // Here we diverge from the 32-bit version. It computes the following ++ // (instructions reordered for clarity): ++ // ++ // veor \$t0#lo, \$t0#lo, \$t0#hi @ t0 = P0 + P1 (L) ++ // vand \$t0#hi, \$t0#hi, \$k48 ++ // veor \$t0#lo, \$t0#lo, \$t0#hi ++ // ++ // veor \$t1#lo, \$t1#lo, \$t1#hi @ t1 = P2 + P3 (M) ++ // vand \$t1#hi, \$t1#hi, \$k32 ++ // veor \$t1#lo, \$t1#lo, \$t1#hi ++ // ++ // veor \$t2#lo, \$t2#lo, \$t2#hi @ t2 = P4 + P5 (N) ++ // vand \$t2#hi, \$t2#hi, \$k16 ++ // veor \$t2#lo, \$t2#lo, \$t2#hi ++ // ++ // veor \$t3#lo, \$t3#lo, \$t3#hi @ t3 = P6 + P7 (K) ++ // vmov.i64 \$t3#hi, #0 ++ // ++ // \$kN is a mask with the bottom N bits set. AArch64 cannot compute on ++ // upper halves of SIMD registers, so we must split each half into ++ // separate registers. To compensate, we pair computations up and ++ // parallelize. ++ ++ ext $t3.8b, $b.8b, $b.8b, #4 // B4 ++ eor $t2.16b, $t2.16b, $r.16b // N = I + J ++ pmull $t3.8h, $a.8b, $t3.8b // K = A*B4 ++ ++ // This can probably be scheduled more efficiently. For now, we just ++ // pair up independent instructions. ++ zip1 $t0l_t1l.2d, $t0.2d, $t1.2d ++ zip1 $t2l_t3l.2d, $t2.2d, $t3.2d ++ zip2 $t0h_t1h.2d, $t0.2d, $t1.2d ++ zip2 $t2h_t3h.2d, $t2.2d, $t3.2d ++ eor $t0l_t1l.16b, $t0l_t1l.16b, $t0h_t1h.16b ++ eor $t2l_t3l.16b, $t2l_t3l.16b, $t2h_t3h.16b ++ and $t0h_t1h.16b, $t0h_t1h.16b, $k48_k32.16b ++ and $t2h_t3h.16b, $t2h_t3h.16b, $k16_k0.16b ++ eor $t0l_t1l.16b, $t0l_t1l.16b, $t0h_t1h.16b ++ eor $t2l_t3l.16b, $t2l_t3l.16b, $t2h_t3h.16b ++ zip1 $t0.2d, $t0l_t1l.2d, $t0h_t1h.2d ++ zip1 $t2.2d, $t2l_t3l.2d, $t2h_t3h.2d ++ zip2 $t1.2d, $t0l_t1l.2d, $t0h_t1h.2d ++ zip2 $t3.2d, $t2l_t3l.2d, $t2h_t3h.2d ++ ++ ext $t0.16b, $t0.16b, $t0.16b, #15 // t0 = t0 << 8 ++ ext $t1.16b, $t1.16b, $t1.16b, #14 // t1 = t1 << 16 ++ pmull $r.8h, $a.8b, $b.8b // D = A*B ++ ext $t3.16b, $t3.16b, $t3.16b, #12 // t3 = t3 << 32 ++ ext $t2.16b, $t2.16b, $t2.16b, #13 // t2 = t2 << 24 ++ eor $t0.16b, $t0.16b, $t1.16b ++ eor $t2.16b, $t2.16b, $t3.16b ++ eor $r.16b, $r.16b, $t0.16b ++ eor $r.16b, $r.16b, $t2.16b ++___ ++} ++ ++$code .= <<___; ++#include <GFp/arm_arch.h> ++ ++.text ++ ++.global GFp_gcm_init_neon ++.type GFp_gcm_init_neon,%function ++.align 4 ++GFp_gcm_init_neon: ++ AARCH64_VALID_CALL_TARGET ++ // This function is adapted from gcm_init_v8. xC2 is t3. ++ ld1 {$t1.2d}, [x1] // load H ++ movi $t3.16b, #0xe1 ++ shl $t3.2d, $t3.2d, #57 // 0xc2.0 ++ ext $INlo.16b, $t1.16b, $t1.16b, #8 ++ ushr $t2.2d, $t3.2d, #63 ++ dup $t1.4s, $t1.s[1] ++ ext $t0.16b, $t2.16b, $t3.16b, #8 // t0=0xc2....01 ++ ushr $t2.2d, $INlo.2d, #63 ++ sshr $t1.4s, $t1.4s, #31 // broadcast carry bit ++ and $t2.16b, $t2.16b, $t0.16b ++ shl $INlo.2d, $INlo.2d, #1 ++ ext $t2.16b, $t2.16b, $t2.16b, #8 ++ and $t0.16b, $t0.16b, $t1.16b ++ orr $INlo.16b, $INlo.16b, $t2.16b // H<<<=1 ++ eor $Hlo.16b, $INlo.16b, $t0.16b // twisted H ++ st1 {$Hlo.2d}, [x0] // store Htable[0] ++ ret ++.size GFp_gcm_init_neon,.-GFp_gcm_init_neon ++ ++.global GFp_gcm_gmult_neon ++.type GFp_gcm_gmult_neon,%function ++.align 4 ++GFp_gcm_gmult_neon: ++ AARCH64_VALID_CALL_TARGET ++ ld1 {$INlo.16b}, [$Xi] // load Xi ++ ld1 {$Hlo.1d}, [$Htbl], #8 // load twisted H ++ ld1 {$Hhi.1d}, [$Htbl] ++ adrp x9, :pg_hi21:.Lmasks // load constants ++ add x9, x9, :lo12:.Lmasks ++ ld1 {$k48_k32.2d, $k16_k0.2d}, [x9] ++ rev64 $INlo.16b, $INlo.16b // byteswap Xi ++ ext $INlo.16b, $INlo.16b, $INlo.16b, #8 ++ eor $Hhl.8b, $Hlo.8b, $Hhi.8b // Karatsuba pre-processing ++ ++ mov $len, #16 ++ b .Lgmult_neon ++.size GFp_gcm_gmult_neon,.-GFp_gcm_gmult_neon ++ ++.global GFp_gcm_ghash_neon ++.type GFp_gcm_ghash_neon,%function ++.align 4 ++GFp_gcm_ghash_neon: ++ AARCH64_VALID_CALL_TARGET ++ ld1 {$Xl.16b}, [$Xi] // load Xi ++ ld1 {$Hlo.1d}, [$Htbl], #8 // load twisted H ++ ld1 {$Hhi.1d}, [$Htbl] ++ adrp x9, :pg_hi21:.Lmasks // load constants ++ add x9, x9, :lo12:.Lmasks ++ ld1 {$k48_k32.2d, $k16_k0.2d}, [x9] ++ rev64 $Xl.16b, $Xl.16b // byteswap Xi ++ ext $Xl.16b, $Xl.16b, $Xl.16b, #8 ++ eor $Hhl.8b, $Hlo.8b, $Hhi.8b // Karatsuba pre-processing ++ ++.Loop_neon: ++ ld1 {$INlo.16b}, [$inp], #16 // load inp ++ rev64 $INlo.16b, $INlo.16b // byteswap inp ++ ext $INlo.16b, $INlo.16b, $INlo.16b, #8 ++ eor $INlo.16b, $INlo.16b, $Xl.16b // inp ^= Xi ++ ++.Lgmult_neon: ++ // Split the input into $INlo and $INhi. (The upper halves are unused, ++ // so it is okay to leave them alone.) ++ ins $INhi.d[0], $INlo.d[1] ++___ ++&clmul64x64 ($Xl, $Hlo, $INlo); # H.lo·Xi.lo ++$code .= <<___; ++ eor $INlo.8b, $INlo.8b, $INhi.8b // Karatsuba pre-processing ++___ ++&clmul64x64 ($Xm, $Hhl, $INlo); # (H.lo+H.hi)·(Xi.lo+Xi.hi) ++&clmul64x64 ($Xh, $Hhi, $INhi); # H.hi·Xi.hi ++$code .= <<___; ++ ext $t0.16b, $Xl.16b, $Xh.16b, #8 ++ eor $Xm.16b, $Xm.16b, $Xl.16b // Karatsuba post-processing ++ eor $Xm.16b, $Xm.16b, $Xh.16b ++ eor $Xm.16b, $Xm.16b, $t0.16b // Xm overlaps Xh.lo and Xl.hi ++ ins $Xl.d[1], $Xm.d[0] // Xh|Xl - 256-bit result ++ // This is a no-op due to the ins instruction below. ++ // ins $Xh.d[0], $Xm.d[1] ++ ++ // equivalent of reduction_avx from ghash-x86_64.pl ++ shl $t1.2d, $Xl.2d, #57 // 1st phase ++ shl $t2.2d, $Xl.2d, #62 ++ eor $t2.16b, $t2.16b, $t1.16b // ++ shl $t1.2d, $Xl.2d, #63 ++ eor $t2.16b, $t2.16b, $t1.16b // ++ // Note Xm contains {Xl.d[1], Xh.d[0]}. ++ eor $t2.16b, $t2.16b, $Xm.16b ++ ins $Xl.d[1], $t2.d[0] // Xl.d[1] ^= t2.d[0] ++ ins $Xh.d[0], $t2.d[1] // Xh.d[0] ^= t2.d[1] ++ ++ ushr $t2.2d, $Xl.2d, #1 // 2nd phase ++ eor $Xh.16b, $Xh.16b,$Xl.16b ++ eor $Xl.16b, $Xl.16b,$t2.16b // ++ ushr $t2.2d, $t2.2d, #6 ++ ushr $Xl.2d, $Xl.2d, #1 // ++ eor $Xl.16b, $Xl.16b, $Xh.16b // ++ eor $Xl.16b, $Xl.16b, $t2.16b // ++ ++ subs $len, $len, #16 ++ bne .Loop_neon ++ ++ rev64 $Xl.16b, $Xl.16b // byteswap Xi and write ++ ext $Xl.16b, $Xl.16b, $Xl.16b, #8 ++ st1 {$Xl.16b}, [$Xi] ++ ++ ret ++.size GFp_gcm_ghash_neon,.-GFp_gcm_ghash_neon ++ ++.section .rodata ++.align 4 ++.Lmasks: ++.quad 0x0000ffffffffffff // k48 ++.quad 0x00000000ffffffff // k32 ++.quad 0x000000000000ffff // k16 ++.quad 0x0000000000000000 // k0 ++.asciz "GHASH for ARMv8, derived from ARMv4 version by <appro\@openssl.org>" ++.align 2 ++___ ++ ++foreach (split("\n",$code)) { ++ s/\`([^\`]*)\`/eval $1/geo; ++ ++ print $_,"\n"; ++} ++close STDOUT or die "error closing STDOUT"; # enforce flush +-- +Efraim Flashner <efraim@flashner.co.il> רנשלפ םירפא +GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 +Confidentiality cannot be guaranteed on emails sent or received unencrypted + diff --git a/gnu/packages/patches/rust-ring-0.16-test-files.patch b/gnu/packages/patches/rust-ring-0.16-test-files.patch new file mode 100644 index 0000000000..dbe5c0f4ee --- /dev/null +++ b/gnu/packages/patches/rust-ring-0.16-test-files.patch @@ -0,0 +1,54 @@ +This file exists in the upstream repository at the commit which +corresponds to the ring-0.16.20 release, but was excluded from the +release tarball. + +--- + tests/ed25519_verify_tests.txt | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + create mode 100644 tests/ed25519_verify_tests.txt + +diff --git a/tests/ed25519_verify_tests.txt b/tests/ed25519_verify_tests.txt +new file mode 100644 +index 0000000..74c94b3 +--- /dev/null ++++ b/tests/ed25519_verify_tests.txt +@@ -0,0 +1,34 @@ ++# BoringSSL TEST(Ed25519Test Malleability) ++ ++# Control; S is in range. ++MESSAGE = 54657374 ++SIG = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d ++PUB = 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa ++Result = P ++ ++# Same as above, but with the order L added to S so it is out of range. ++# BoringSSL commit 472ba2c2dd52d06a657a63b7fbf02732a6649d21 ++MESSAGE = 54657374 ++SIG = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab067654bce3832c2d76f8f6f5dafc08d9339d4eef676573336a5c51eb6f946b31d ++PUB = 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa ++Result = F ++ ++ ++# BoringSSL commit 3094902fcdc2db2cc832fa854b9a6a8be383926c ++MESSAGE = 124e583f8b8eca58bb29c271b41d36986bbc45541f8e51f9cb0133eca447601e ++SIG = dac119d6ca87fc59ae611c157048f4d4fc932a149dbe20ec6effd1436abf83ea05c7df0fef06147241259113909bc71bd3c53ba4464ffcad3c0968f2ffffff0f ++PUB = 100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86 ++Result = P ++ ++# Control. Same key as above; same message and signature as below, except S is in range. ++PUB = 100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86 ++MESSAGE = 6a0bc2b0057cedfc0fa2e3f7f7d39279b30f454a69dfd1117c758d86b19d85e0 ++SIG = 0971f86d2c9c78582524a103cb9cf949522ae528f8054dc20107d999be673ff4f58ac9d20ec563133cabc6230b1db8625f8446639ede46ad4df4053000000000 ++Result = P ++ ++# Same key as above, but S is out of range. ++# BoringSSL commit 472ba2c2dd52d06a657a63b7fbf02732a6649d21 ++PUB = 100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86 ++MESSAGE = 6a0bc2b0057cedfc0fa2e3f7f7d39279b30f454a69dfd1117c758d86b19d85e0 ++SIG = 0971f86d2c9c78582524a103cb9cf949522ae528f8054dc20107d999be673ff4e25ebf2f2928766b1248bec6e91697775f8446639ede46ad4df4053000000010 ++Result = F +-- +Efraim Flashner <efraim@flashner.co.il> רנשלפ םירפא +GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 +Confidentiality cannot be guaranteed on emails sent or received unencrypted + |