1 diff -burN android-openssl-lhash2/openssl.config android-openssl/openssl.config
2 --- android-openssl-lhash2/openssl.config 2013-11-05 14:38:31.187575574 -0500
3 +++ android-openssl/openssl.config 2013-11-05 15:03:54.661551145 -0500
5 crypto/buffer/buf_err.c \
6 crypto/buffer/buf_str.c \
7 crypto/buffer/buffer.c \
8 +crypto/chacha/chacha_enc.c \
9 crypto/cmac/cm_ameth.c \
10 crypto/cmac/cm_pmeth.c \
14 crypto/evp/e_aes_cbc_hmac_sha1.c \
16 +crypto/evp/e_chacha20poly1305.c \
21 crypto/evp/e_xcbc_d.c \
23 crypto/evp/evp_acnf.c \
24 +crypto/evp/evp_aead.c \
25 crypto/evp/evp_cnf.c \
26 crypto/evp/evp_enc.c \
27 crypto/evp/evp_err.c \
29 crypto/pkcs7/pk7_smime.c \
30 crypto/pkcs7/pkcs7err.c \
31 crypto/pqueue/pqueue.c \
32 +crypto/poly1305/poly1305.c \
33 crypto/rand/md_rand.c \
34 crypto/rand/rand_egd.c \
35 crypto/rand/rand_err.c \
37 crypto/aes/asm/aes-armv4.S \
38 crypto/bn/asm/armv4-gf2m.S \
39 crypto/bn/asm/armv4-mont.S \
40 +crypto/chacha/chacha_vec_arm.S \
41 crypto/modes/asm/ghash-armv4.S \
42 +crypto/poly1305/poly1305_arm.c \
43 +crypto/poly1305/poly1305_arm_asm.S \
44 crypto/sha/asm/sha1-armv4-large.S \
45 crypto/sha/asm/sha256-armv4.S \
46 crypto/sha/asm/sha512-armv4.S \
48 crypto/bn/asm/x86_64-gf2m.S \
49 crypto/bn/asm/x86_64-mont.S \
50 crypto/bn/asm/x86_64-mont5.S \
51 +crypto/chacha/chacha_vec.c \
52 crypto/md5/asm/md5-x86_64.S \
53 crypto/modes/asm/ghash-x86_64.S \
54 crypto/rc4/asm/rc4-md5-x86_64.S \
56 crypto/sha/asm/sha1-x86_64.S \
57 crypto/sha/asm/sha256-x86_64.S \
58 crypto/sha/asm/sha512-x86_64.S \
59 +crypto/poly1305/poly1305_vec.c \
60 crypto/x86_64cpuid.S \
64 crypto/aes/aes_cbc.c \
65 crypto/aes/aes_core.c \
67 +crypto/chacha/chacha_enc.c \
69 +crypto/poly1305/poly1305.c \
70 crypto/rc4/rc4_enc.c \
71 crypto/rc4/rc4_skey.c \
74 x509_hash_name_algorithm_change.patch \
75 reduce_client_hello_size.patch \
76 fix_lhash_iteration.patch \
77 +tls1_change_cipher_state_rewrite.patch \
79 +aead_ssl_support.patch \
80 +use_aead_for_aes_gcm.patch \
81 +chacha20poly1305.patch \
85 OPENSSL_PATCHES_progs_SOURCES="\
86 diff -burN android-openssl-lhash2/patches/aead_ssl_support.patch android-openssl/patches/aead_ssl_support.patch
87 --- android-openssl-lhash2/patches/aead_ssl_support.patch 1969-12-31 19:00:00.000000000 -0500
88 +++ android-openssl/patches/aead_ssl_support.patch 2013-11-05 14:14:34.631283497 -0500
90 +From dc8386dbb390f4b867019873cd072a5fe01ba4e9 Mon Sep 17 00:00:00 2001
91 +From: Adam Langley <agl@chromium.org>
92 +Date: Thu, 25 Jul 2013 17:35:23 -0400
93 +Subject: [PATCH 41/50] aead_ssl_support.
95 +This change allows AEADs to be used in ssl/ to implement SSL/TLS
98 + ssl/s2_clnt.c | 2 +-
100 + ssl/s2_srvr.c | 2 +-
101 + ssl/s3_enc.c | 8 +-
102 + ssl/s3_pkt.c | 4 +-
103 + ssl/ssl.h | 15 +++-
105 + ssl/ssl_ciph.c | 70 +++++++++++----
106 + ssl/ssl_err.c | 3 +
107 + ssl/ssl_lib.c | 12 +++
108 + ssl/ssl_locl.h | 23 ++++-
109 + ssl/ssl_txt.c | 2 +-
110 + ssl/t1_enc.c | 262 +++++++++++++++++++++++++++++++++++++++++++++++++++------
111 + 13 files changed, 356 insertions(+), 50 deletions(-)
113 +diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
114 +index 03b6cf9..32adaf5 100644
117 +@@ -623,7 +623,7 @@ static int client_master_key(SSL *s)
118 + if (s->state == SSL2_ST_SEND_CLIENT_MASTER_KEY_A)
121 +- if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL,NULL))
122 ++ if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL))
124 + ssl2_return_error(s,SSL2_PE_NO_CIPHER);
125 + SSLerr(SSL_F_CLIENT_MASTER_KEY,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
126 +diff --git a/ssl/s2_enc.c b/ssl/s2_enc.c
127 +index ff3395f..087c4a2 100644
130 +@@ -68,7 +68,7 @@ int ssl2_enc_init(SSL *s, int client)
134 +- if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL,NULL))
135 ++ if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL))
137 + ssl2_return_error(s,SSL2_PE_NO_CIPHER);
138 + SSLerr(SSL_F_SSL2_ENC_INIT,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
139 +diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c
140 +index 9b1a6ac..9392921 100644
143 +@@ -452,7 +452,7 @@ static int get_client_master_key(SSL *s)
145 + is_export=SSL_C_IS_EXPORT(s->session->cipher);
147 +- if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL,NULL))
148 ++ if (!ssl_cipher_get_evp(s->session,&c,&md,NULL,NULL))
150 + ssl2_return_error(s,SSL2_PE_NO_CIPHER);
151 + SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
152 +diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
153 +index e3cd4f0..191b86b 100644
156 +@@ -397,7 +397,13 @@ int ssl3_setup_key_block(SSL *s)
157 + if (s->s3->tmp.key_block_length != 0)
160 +- if (!ssl_cipher_get_evp(s->session,&c,&hash,NULL,NULL,&comp))
161 ++ if (!ssl_cipher_get_comp(s->session, &comp))
163 ++ SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
167 ++ if (!ssl_cipher_get_evp(s->session,&c,&hash,NULL,NULL))
169 + SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
171 +diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
172 +index 33bb78a..5038f6c 100644
175 +@@ -790,7 +790,9 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
180 ++ else if (s->aead_write_ctx != NULL)
181 ++ eivlen = s->aead_write_ctx->variable_nonce_len;
185 + /* lets setup the record stuff. */
186 +diff --git a/ssl/ssl.h b/ssl/ssl.h
187 +index 672f3eb..0644cbf 100644
190 +@@ -406,7 +406,9 @@ struct ssl_cipher_st
191 + unsigned long algorithm_ssl; /* (major) protocol version */
193 + unsigned long algo_strength; /* strength and export flags */
194 +- unsigned long algorithm2; /* Extra flags */
195 ++ unsigned long algorithm2; /* Extra flags. See SSL2_CF_* in ssl2.h
196 ++ and algorithm2 section in
198 + int strength_bits; /* Number of bits really used */
199 + int alg_bits; /* Number of bits for algorithm */
201 +@@ -748,6 +750,9 @@ int SRP_generate_client_master_secret(SSL *s,unsigned char *master_key);
205 ++struct ssl_aead_ctx_st;
206 ++typedef struct ssl_aead_ctx_st SSL_AEAD_CTX;
208 + #if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)
209 + #define SSL_MAX_CERT_LIST_DEFAULT 1024*30 /* 30k max cert list :-) */
211 +@@ -1294,6 +1299,9 @@ struct ssl_st
212 + /* These are the ones being used, the ones in SSL_SESSION are
213 + * the ones to be 'copied' into these ones */
215 ++ SSL_AEAD_CTX *aead_read_ctx; /* AEAD context. If non-NULL, then
216 ++ |enc_read_ctx| and |read_hash| are
218 + EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
219 + EVP_MD_CTX *read_hash; /* used for mac generation */
220 + #ifndef OPENSSL_NO_COMP
221 +@@ -1302,6 +1310,9 @@ struct ssl_st
225 ++ SSL_AEAD_CTX *aead_write_ctx; /* AEAD context. If non-NULL, then
226 ++ |enc_write_ctx| and |write_hash| are
228 + EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
229 + EVP_MD_CTX *write_hash; /* used for mac generation */
230 + #ifndef OPENSSL_NO_COMP
231 +@@ -2437,8 +2448,10 @@ void ERR_load_SSL_strings(void);
232 + #define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206
233 + #define SSL_F_SSL_VERIFY_CERT_CHAIN 207
234 + #define SSL_F_SSL_WRITE 208
235 ++#define SSL_F_TLS1_AEAD_CTX_INIT 339
236 + #define SSL_F_TLS1_CERT_VERIFY_MAC 286
237 + #define SSL_F_TLS1_CHANGE_CIPHER_STATE 209
238 ++#define SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD 340
239 + #define SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER 338
240 + #define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT 274
241 + #define SSL_F_TLS1_ENC 210
242 +diff --git a/ssl/ssl3.h b/ssl/ssl3.h
243 +index a4f6d4a..6a5cdbe 100644
246 +@@ -517,6 +517,7 @@ typedef struct ssl3_state_st
247 + unsigned char *key_block;
249 + const EVP_CIPHER *new_sym_enc;
250 ++ const EVP_AEAD *new_aead;
251 + const EVP_MD *new_hash;
252 + int new_mac_pkey_type;
253 + int new_mac_secret_size;
254 +diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
255 +index 2966ddf..7e780cd 100644
256 +--- a/ssl/ssl_ciph.c
257 ++++ b/ssl/ssl_ciph.c
258 +@@ -484,32 +484,66 @@ static void load_builtin_compressions(void)
262 ++/* ssl_cipher_get_comp sets |comp| to the correct SSL_COMP for the given
263 ++ * session and returns 1. On error it returns 0. */
264 ++int ssl_cipher_get_comp(const SSL_SESSION *s, SSL_COMP **comp)
269 ++#ifndef OPENSSL_NO_COMP
270 ++ load_builtin_compressions();
274 ++ ctmp.id=s->compress_meth;
275 ++ if (ssl_comp_methods != NULL)
277 ++ i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
279 ++ *comp=sk_SSL_COMP_value(ssl_comp_methods,i);
287 ++/* ssl_cipher_get_evp_aead sets |*aead| to point to the correct EVP_AEAD object
288 ++ * for |s->cipher|. It returns 1 on success and 0 on error. */
289 ++int ssl_cipher_get_evp_aead(const SSL_SESSION *s, const EVP_AEAD **aead)
291 ++ const SSL_CIPHER *c = s->cipher;
297 ++ if ((c->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD) == 0)
300 ++#ifndef OPENSSL_NO_AES
301 ++ /* There is only one AEAD for now. */
302 ++ *aead = EVP_aead_aes_128_gcm();
309 + int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
310 +- const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size,SSL_COMP **comp)
311 ++ const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size)
314 + const SSL_CIPHER *c;
317 + if (c == NULL) return(0);
321 +-#ifndef OPENSSL_NO_COMP
322 +- load_builtin_compressions();
326 +- ctmp.id=s->compress_meth;
327 +- if (ssl_comp_methods != NULL)
329 +- i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
331 +- *comp=sk_SSL_COMP_value(ssl_comp_methods,i);
336 ++ /* This function doesn't deal with EVP_AEAD. See
337 ++ * |ssl_cipher_get_aead_evp|. */
338 ++ if (c->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD)
341 + if ((enc == NULL) || (md == NULL)) return(0);
343 +diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
344 +index 97b2a0d..ad3a7b9 100644
347 +@@ -280,6 +280,9 @@ static ERR_STRING_DATA SSL_str_functs[]=
348 + {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"},
349 + {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
350 + {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
351 ++{ERR_FUNC(SSL_F_TLS1_AEAD_CTX_INIT), "TLS1_AEAD_CTX_INIT"},
352 ++{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "tls1_change_cipher_state"},
353 ++{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD), "TLS1_CHANGE_CIPHER_STATE_AEAD"},
354 + {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER), "TLS1_CHANGE_CIPHER_STATE_CIPHER"},
355 + {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"},
356 + {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
357 +diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
358 +index 3b264b6..8a0150c 100644
361 +@@ -2881,6 +2881,18 @@ void ssl_clear_cipher_ctx(SSL *s)
362 + OPENSSL_free(s->enc_write_ctx);
363 + s->enc_write_ctx=NULL;
365 ++ if (s->aead_read_ctx != NULL)
367 ++ EVP_AEAD_CTX_cleanup(&s->aead_read_ctx->ctx);
368 ++ OPENSSL_free(s->aead_read_ctx);
369 ++ s->aead_read_ctx = NULL;
371 ++ if (s->aead_write_ctx != NULL)
373 ++ EVP_AEAD_CTX_cleanup(&s->aead_write_ctx->ctx);
374 ++ OPENSSL_free(s->aead_write_ctx);
375 ++ s->aead_write_ctx = NULL;
377 + #ifndef OPENSSL_NO_COMP
378 + if (s->expand != NULL)
380 +diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
381 +index 3d800af..63bc28b 100644
382 +--- a/ssl/ssl_locl.h
383 ++++ b/ssl/ssl_locl.h
384 +@@ -380,6 +380,14 @@
386 + #define TLSEXT_CHANNEL_ID_SIZE 128
388 ++/* SSL_CIPHER_ALGORITHM2_AEAD is a flag in SSL_CIPHER.algorithm2 which
389 ++ * indicates that the cipher is implemented via an EVP_AEAD. */
390 ++#define SSL_CIPHER_ALGORITHM2_AEAD (1<<23)
392 ++/* SSL_CIPHER_AEAD_FIXED_NONCE_LEN returns the number of bytes of fixed nonce
393 ++ * for an SSL_CIPHER* with the SSL_CIPHER_ALGORITHM2_AEAD flag. */
394 ++#define SSL_CIPHER_AEAD_FIXED_NONCE_LEN(ssl_cipher) \
395 ++ (((ssl_cipher->algorithm2 >> 24) & 0xf)*2)
398 + * Export and cipher strength information. For each cipher we have to decide
399 +@@ -588,6 +596,17 @@ typedef struct ssl3_enc_method
403 ++/* ssl_aead_ctx_st contains information about an AEAD that is being used to
404 ++ * encrypt an SSL connection. */
405 ++struct ssl_aead_ctx_st
408 ++ /* fixed_nonce contains any bytes of the nonce that are fixed for all
410 ++ unsigned char fixed_nonce[8];
411 ++ unsigned char fixed_nonce_len, variable_nonce_len, tag_len;
414 + #ifndef OPENSSL_NO_COMP
415 + /* Used for holding the relevant compression methods loaded into SSL_CTX */
416 + typedef struct ssl3_comp_st
417 +@@ -834,8 +853,10 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
418 + STACK_OF(SSL_CIPHER) **sorted,
419 + const char *rule_str);
420 + void ssl_update_cache(SSL *s, int mode);
421 ++int ssl_cipher_get_comp(const SSL_SESSION *s, SSL_COMP **comp);
422 ++int ssl_cipher_get_evp_aead(const SSL_SESSION *s, const EVP_AEAD **aead);
423 + int ssl_cipher_get_evp(const SSL_SESSION *s,const EVP_CIPHER **enc,
424 +- const EVP_MD **md,int *mac_pkey_type,int *mac_secret_size, SSL_COMP **comp);
425 ++ const EVP_MD **md,int *mac_pkey_type,int *mac_secret_size);
426 + int ssl_get_handshake_digest(int i,long *mask,const EVP_MD **md);
427 + int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
428 + int ssl_undefined_function(SSL *s);
429 +diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
430 +index 6479d52..07826d5 100644
433 +@@ -216,7 +216,7 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
435 + SSL_COMP *comp = NULL;
437 +- ssl_cipher_get_evp(x,NULL,NULL,NULL,NULL,&comp);
438 ++ ssl_cipher_get_comp(x, &comp);
441 + if (BIO_printf(bp,"\n Compression: %d",x->compress_meth) <= 0) goto err;
442 +diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
443 +index e1f91ba..7af1a32 100644
446 +@@ -316,6 +316,66 @@ static int tls1_generate_key_block(SSL *s, unsigned char *km,
450 ++/* tls1_aead_ctx_init allocates |*aead_ctx|, if needed and returns 1. It
451 ++ * returns 0 on malloc error. */
452 ++static int tls1_aead_ctx_init(SSL_AEAD_CTX **aead_ctx)
454 ++ if (*aead_ctx != NULL)
455 ++ EVP_AEAD_CTX_cleanup(&(*aead_ctx)->ctx);
458 ++ *aead_ctx = (SSL_AEAD_CTX*) OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
459 ++ if (*aead_ctx == NULL)
461 ++ SSLerr(SSL_F_TLS1_AEAD_CTX_INIT, ERR_R_MALLOC_FAILURE);
469 ++static int tls1_change_cipher_state_aead(SSL *s, char is_read,
470 ++ const unsigned char *key, unsigned key_len,
471 ++ const unsigned char *iv, unsigned iv_len)
473 ++ const EVP_AEAD *aead = s->s3->tmp.new_aead;
474 ++ SSL_AEAD_CTX *aead_ctx;
478 ++ if (!tls1_aead_ctx_init(&s->aead_read_ctx))
480 ++ aead_ctx = s->aead_read_ctx;
484 ++ if (!tls1_aead_ctx_init(&s->aead_write_ctx))
486 ++ aead_ctx = s->aead_write_ctx;
489 ++ if (!EVP_AEAD_CTX_init(&aead_ctx->ctx, aead, key, key_len,
490 ++ EVP_AEAD_DEFAULT_TAG_LENGTH, NULL /* engine */))
492 ++ if (iv_len > sizeof(aead_ctx->fixed_nonce))
494 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, ERR_R_INTERNAL_ERROR);
497 ++ memcpy(aead_ctx->fixed_nonce, iv, iv_len);
498 ++ aead_ctx->fixed_nonce_len = iv_len;
499 ++ aead_ctx->variable_nonce_len = 8; /* always the case, currently. */
500 ++ if (aead_ctx->variable_nonce_len + aead_ctx->fixed_nonce_len != EVP_AEAD_nonce_length(aead))
502 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, ERR_R_INTERNAL_ERROR);
505 ++ aead_ctx->tag_len = EVP_AEAD_max_overhead(aead);
510 + /* tls1_change_cipher_state_cipher performs the work needed to switch cipher
511 + * states when using EVP_CIPHER. The argument |is_read| is true iff this
512 + * function is being called due to reading, as opposed to writing, a
513 +@@ -494,6 +554,7 @@ int tls1_change_cipher_state(SSL *s, int which)
514 + const unsigned char *client_write_key, *server_write_key, *key;
515 + const unsigned char *client_write_iv, *server_write_iv, *iv;
516 + const EVP_CIPHER *cipher = s->s3->tmp.new_sym_enc;
517 ++ const EVP_AEAD *aead = s->s3->tmp.new_aead;
518 + unsigned key_len, iv_len, mac_secret_len;
519 + const unsigned char *key_data;
520 + const char is_export = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) != 0;
521 +@@ -551,14 +612,22 @@ int tls1_change_cipher_state(SSL *s, int which)
523 + mac_secret_len = s->s3->tmp.new_mac_secret_size;
525 +- key_len = EVP_CIPHER_key_length(cipher);
526 +- if (is_export && key_len > SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher))
527 +- key_len = SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher);
529 +- if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
530 +- iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
533 ++ key_len = EVP_AEAD_key_length(aead);
534 ++ iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s->s3->tmp.new_cipher);
537 +- iv_len = EVP_CIPHER_iv_length(cipher);
539 ++ key_len = EVP_CIPHER_key_length(cipher);
540 ++ if (is_export && key_len > SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher))
541 ++ key_len = SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher);
543 ++ if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
544 ++ iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
546 ++ iv_len = EVP_CIPHER_iv_length(cipher);
549 + key_data = s->s3->tmp.key_block;
550 + client_write_mac_secret = key_data; key_data += mac_secret_len;
551 +@@ -587,12 +656,20 @@ int tls1_change_cipher_state(SSL *s, int which)
555 +- if (!tls1_change_cipher_state_cipher(s, is_read, use_client_keys,
556 +- mac_secret, mac_secret_len,
563 ++ if (!tls1_change_cipher_state_aead(s, is_read,
564 ++ key, key_len, iv, iv_len))
569 ++ if (!tls1_change_cipher_state_cipher(s, is_read, use_client_keys,
570 ++ mac_secret, mac_secret_len,
578 +@@ -603,13 +680,14 @@ err:
579 + int tls1_setup_key_block(SSL *s)
581 + unsigned char *p1,*p2=NULL;
582 +- const EVP_CIPHER *c;
583 +- const EVP_MD *hash;
584 ++ const EVP_CIPHER *c = NULL;
585 ++ const EVP_MD *hash = NULL;
586 ++ const EVP_AEAD *aead = NULL;
589 + int mac_type= NID_undef,mac_secret_size=0;
592 ++ unsigned key_len, iv_len;
595 + printf ("tls1_setup_key_block()\n");
596 +@@ -618,22 +696,36 @@ int tls1_setup_key_block(SSL *s)
597 + if (s->s3->tmp.key_block_length != 0)
600 +- if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size,&comp))
601 ++ if (!ssl_cipher_get_comp(s->session, &comp))
602 ++ goto cipher_unavailable_err;
604 ++ if (s->session->cipher &&
605 ++ (s->session->cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD))
607 +- SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
609 ++ if (!ssl_cipher_get_evp_aead(s->session, &aead))
610 ++ goto cipher_unavailable_err;
611 ++ key_len = EVP_AEAD_key_length(aead);
612 ++ iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s->session->cipher);
615 +- if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
616 +- iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
618 +- iv_len = EVP_CIPHER_iv_length(c);
620 ++ if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size))
621 ++ goto cipher_unavailable_err;
622 ++ key_len = EVP_CIPHER_key_length(c);
624 ++ if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
625 ++ iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
627 ++ iv_len = EVP_CIPHER_iv_length(c);
630 ++ s->s3->tmp.new_aead=aead;
631 + s->s3->tmp.new_sym_enc=c;
632 + s->s3->tmp.new_hash=hash;
633 + s->s3->tmp.new_mac_pkey_type = mac_type;
634 + s->s3->tmp.new_mac_secret_size = mac_secret_size;
635 +- num=EVP_CIPHER_key_length(c)+mac_secret_size+iv_len;
637 ++ num=key_len+mac_secret_size+iv_len;
640 + ssl3_cleanup_key_block(s);
641 +@@ -696,6 +788,10 @@ err:
646 ++cipher_unavailable_err:
647 ++ SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
651 + /* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
652 +@@ -714,6 +810,124 @@ int tls1_enc(SSL *s, int send)
654 + int bs,i,j,k,pad=0,ret,mac_size=0;
655 + const EVP_CIPHER *enc;
656 ++ const SSL_AEAD_CTX *aead;
659 ++ rec = &s->s3->wrec;
661 ++ rec = &s->s3->rrec;
664 ++ aead = s->aead_write_ctx;
666 ++ aead = s->aead_read_ctx;
670 ++ unsigned char ad[13], *seq, *in, *out, nonce[16];
671 ++ unsigned nonce_used;
674 ++ seq = send ? s->s3->write_sequence : s->s3->read_sequence;
676 ++ if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
678 ++ unsigned char dtlsseq[9], *p = dtlsseq;
680 ++ s2n(send ? s->d1->w_epoch : s->d1->r_epoch, p);
681 ++ memcpy(p, &seq[2], 6);
682 ++ memcpy(ad, dtlsseq, 8);
686 ++ memcpy(ad, seq, 8);
687 ++ for (i=7; i>=0; i--) /* increment */
695 ++ ad[8] = rec->type;
696 ++ ad[9] = (unsigned char)(s->version>>8);
697 ++ ad[10] = (unsigned char)(s->version);
699 ++ if (aead->fixed_nonce_len + aead->variable_nonce_len > sizeof(nonce) ||
700 ++ aead->variable_nonce_len > 8)
701 ++ return -1; /* internal error - should never happen. */
703 ++ memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
704 ++ nonce_used = aead->fixed_nonce_len;
708 ++ size_t len = rec->length;
712 ++ /* When sending we use the sequence number as the
713 ++ * variable part of the nonce. */
714 ++ if (aead->variable_nonce_len > 8)
716 ++ memcpy(nonce + nonce_used, ad, aead->variable_nonce_len);
717 ++ nonce_used += aead->variable_nonce_len;
719 ++ /* in do_ssl3_write, rec->input is moved forward by
720 ++ * variable_nonce_len in order to leave space for the
721 ++ * variable nonce. Thus we can copy the sequence number
722 ++ * bytes into place without overwriting any of the
724 ++ memcpy(out, ad, aead->variable_nonce_len);
725 ++ len -= aead->variable_nonce_len;
727 ++ ad[11] = len >> 8;
728 ++ ad[12] = len & 0xff;
730 ++ n = EVP_AEAD_CTX_seal(&aead->ctx,
731 ++ out + aead->variable_nonce_len, len + aead->tag_len,
732 ++ nonce, nonce_used,
733 ++ in + aead->variable_nonce_len, len,
736 ++ n += aead->variable_nonce_len;
741 ++ size_t len = rec->length;
743 ++ if (rec->data != rec->input)
744 ++ return -1; /* internal error - should never happen. */
745 ++ out = in = rec->input;
747 ++ if (len < aead->variable_nonce_len)
749 ++ memcpy(nonce + nonce_used, in, aead->variable_nonce_len);
750 ++ nonce_used += aead->variable_nonce_len;
752 ++ in += aead->variable_nonce_len;
753 ++ len -= aead->variable_nonce_len;
754 ++ out += aead->variable_nonce_len;
756 ++ if (len < aead->tag_len)
758 ++ len -= aead->tag_len;
760 ++ ad[11] = len >> 8;
761 ++ ad[12] = len & 0xff;
763 ++ n = EVP_AEAD_CTX_open(&aead->ctx, out, len, nonce, nonce_used,
764 ++ in, len + aead->tag_len, ad, sizeof(ad));
766 ++ rec->data = rec->input = out;
780 diff -burN android-openssl-lhash2/patches/aead_support.patch android-openssl/patches/aead_support.patch
781 --- android-openssl-lhash2/patches/aead_support.patch 1969-12-31 19:00:00.000000000 -0500
782 +++ android-openssl/patches/aead_support.patch 2013-11-05 14:14:34.631283497 -0500
784 +From 98f0c6e114f55b4451bea824b05ab29db3351f12 Mon Sep 17 00:00:00 2001
785 +From: Adam Langley <agl@chromium.org>
786 +Date: Thu, 25 Jul 2013 16:52:35 -0400
787 +Subject: [PATCH 40/50] aead_support
789 +This change adds an AEAD interface to EVP and an AES-GCM implementation
790 +suitable for use in TLS.
792 + crypto/evp/Makefile | 4 +-
793 + crypto/evp/e_aes.c | 214 +++++++++++++++++++++++++++++++++++----
794 + crypto/evp/evp.h | 111 ++++++++++++++++++++
795 + crypto/evp/evp_aead.c | 192 +++++++++++++++++++++++++++++++++++
796 + crypto/evp/evp_err.c | 8 ++
797 + crypto/evp/evp_locl.h | 24 +++++
798 + doc/crypto/EVP_AEAD_CTX_init.pod | 96 ++++++++++++++++++
799 + 7 files changed, 626 insertions(+), 23 deletions(-)
800 + create mode 100644 crypto/evp/evp_aead.c
801 + create mode 100644 doc/crypto/EVP_AEAD_CTX_init.pod
803 +diff --git a/crypto/evp/Makefile b/crypto/evp/Makefile
804 +index 1e46ceb..b73038d 100644
805 +--- a/crypto/evp/Makefile
806 ++++ b/crypto/evp/Makefile
807 +@@ -29,7 +29,7 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c evp_acnf.c evp_cnf.c \
808 + c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
809 + evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
810 + e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c \
811 +- e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
812 ++ e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c evp_aead.c
814 + LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
815 + e_des.o e_bf.o e_idea.o e_des3.o e_camellia.o\
816 +@@ -42,7 +42,7 @@ LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
817 + c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
818 + evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
819 + e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o \
820 +- e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o
821 ++ e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o evp_aead.o
825 +diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
826 +index ef44f63..e4485e4 100644
827 +--- a/crypto/evp/e_aes.c
828 ++++ b/crypto/evp/e_aes.c
829 +@@ -814,44 +814,45 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
833 +-static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
834 +- const unsigned char *iv, int enc)
835 ++static ctr128_f aes_gcm_set_key(AES_KEY *aes_key, GCM128_CONTEXT *gcm_ctx,
836 ++ const unsigned char *key, size_t key_len)
838 +- EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
843 + #ifdef BSAES_CAPABLE
846 +- AES_set_encrypt_key(key,ctx->key_len*8,&gctx->ks);
847 +- CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
848 ++ AES_set_encrypt_key(key,key_len*8,aes_key);
849 ++ CRYPTO_gcm128_init(gcm_ctx,aes_key,
850 + (block128_f)AES_encrypt);
851 +- gctx->ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks;
853 ++ return (ctr128_f)bsaes_ctr32_encrypt_blocks;
857 + #ifdef VPAES_CAPABLE
860 +- vpaes_set_encrypt_key(key,ctx->key_len*8,&gctx->ks);
861 +- CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
862 ++ vpaes_set_encrypt_key(key,key_len*8,aes_key);
863 ++ CRYPTO_gcm128_init(gcm_ctx,aes_key,
864 + (block128_f)vpaes_encrypt);
870 +- AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
871 +- CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
872 ++ AES_set_encrypt_key(key, key_len*8, aes_key);
873 ++ CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)AES_encrypt);
875 +- gctx->ctr = (ctr128_f)AES_ctr32_encrypt;
876 ++ return (ctr128_f)AES_ctr32_encrypt;
884 ++static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
885 ++ const unsigned char *iv, int enc)
887 ++ EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
892 ++ gctx->ctr = aes_gcm_set_key(&gctx->ks, &gctx->gcm, key, ctx->key_len);
893 + /* If we have an iv can set it directly, otherwise use
896 +@@ -1310,5 +1311,176 @@ BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
897 + BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
898 + BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
900 ++#define EVP_AEAD_AES_128_GCM_TAG_LEN 16
902 ++struct aead_aes_128_gcm_ctx {
903 ++ union { double align; AES_KEY ks; } ks;
904 ++ GCM128_CONTEXT gcm;
906 ++ unsigned char tag_len;
909 ++static int aead_aes_128_gcm_init(EVP_AEAD_CTX *ctx,
910 ++ const unsigned char *key, size_t key_len, size_t tag_len)
912 ++ struct aead_aes_128_gcm_ctx *gcm_ctx;
914 ++ if (key_len*8 != 128)
916 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_INIT, EVP_R_BAD_KEY_LENGTH);
917 ++ return 0; /* EVP_AEAD_CTX_init should catch this. */
920 ++ if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH)
921 ++ tag_len = EVP_AEAD_AES_128_GCM_TAG_LEN;
923 ++ if (tag_len > EVP_AEAD_AES_128_GCM_TAG_LEN)
925 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_INIT, EVP_R_TAG_TOO_LARGE);
929 ++ gcm_ctx = OPENSSL_malloc(sizeof(struct aead_aes_128_gcm_ctx));
930 ++ if (gcm_ctx == NULL)
933 ++#ifdef AESNI_CAPABLE
934 ++ if (AESNI_CAPABLE)
936 ++ aesni_set_encrypt_key(key, key_len * 8, &gcm_ctx->ks.ks);
937 ++ CRYPTO_gcm128_init(&gcm_ctx->gcm, &gcm_ctx->ks.ks,
938 ++ (block128_f)aesni_encrypt);
939 ++ gcm_ctx->ctr = (ctr128_f) aesni_ctr32_encrypt_blocks;
944 ++ gcm_ctx->ctr = aes_gcm_set_key(&gcm_ctx->ks.ks, &gcm_ctx->gcm,
947 ++ gcm_ctx->tag_len = tag_len;
948 ++ ctx->aead_state = gcm_ctx;
953 ++static void aead_aes_128_gcm_cleanup(EVP_AEAD_CTX *ctx)
955 ++ struct aead_aes_128_gcm_ctx *gcm_ctx = ctx->aead_state;
956 ++ OPENSSL_free(gcm_ctx);
959 ++static ssize_t aead_aes_128_gcm_seal(const EVP_AEAD_CTX *ctx,
960 ++ unsigned char *out, size_t max_out_len,
961 ++ const unsigned char *nonce, size_t nonce_len,
962 ++ const unsigned char *in, size_t in_len,
963 ++ const unsigned char *ad, size_t ad_len)
966 ++ const struct aead_aes_128_gcm_ctx *gcm_ctx = ctx->aead_state;
967 ++ GCM128_CONTEXT gcm;
969 ++ if (max_out_len < in_len + gcm_ctx->tag_len)
971 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_SEAL, EVP_R_BUFFER_TOO_SMALL);
975 ++ memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
976 ++ CRYPTO_gcm128_setiv(&gcm, nonce, nonce_len);
978 ++ if (ad_len > 0 && CRYPTO_gcm128_aad(&gcm, ad, ad_len))
983 ++ if (CRYPTO_gcm128_encrypt_ctr32(&gcm, in + bulk, out + bulk,
984 ++ in_len - bulk, gcm_ctx->ctr))
989 ++ if (CRYPTO_gcm128_encrypt(&gcm, in + bulk, out + bulk,
994 ++ CRYPTO_gcm128_tag(&gcm, out + in_len, gcm_ctx->tag_len);
995 ++ return in_len + gcm_ctx->tag_len;
998 ++static ssize_t aead_aes_128_gcm_open(const EVP_AEAD_CTX *ctx,
999 ++ unsigned char *out, size_t max_out_len,
1000 ++ const unsigned char *nonce, size_t nonce_len,
1001 ++ const unsigned char *in, size_t in_len,
1002 ++ const unsigned char *ad, size_t ad_len)
1005 ++ const struct aead_aes_128_gcm_ctx *gcm_ctx = ctx->aead_state;
1006 ++ unsigned char tag[EVP_AEAD_AES_128_GCM_TAG_LEN];
1008 ++ GCM128_CONTEXT gcm;
1010 ++ if (in_len < gcm_ctx->tag_len)
1012 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_OPEN, EVP_R_BAD_DECRYPT);
1016 ++ out_len = in_len - gcm_ctx->tag_len;
1018 ++ if (max_out_len < out_len)
1020 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_OPEN, EVP_R_BUFFER_TOO_SMALL);
1024 ++ memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
1025 ++ CRYPTO_gcm128_setiv(&gcm, nonce, nonce_len);
1027 ++ if (CRYPTO_gcm128_aad(&gcm, ad, ad_len))
1030 ++ if (gcm_ctx->ctr)
1032 ++ if (CRYPTO_gcm128_decrypt_ctr32(&gcm, in + bulk, out + bulk,
1033 ++ in_len-bulk-gcm_ctx->tag_len,
1039 ++ if (CRYPTO_gcm128_decrypt(&gcm, in + bulk, out + bulk,
1040 ++ in_len - bulk - gcm_ctx->tag_len))
1044 ++ CRYPTO_gcm128_tag(&gcm, tag, gcm_ctx->tag_len);
1045 ++ if (CRYPTO_memcmp(tag, in + out_len, gcm_ctx->tag_len) != 0)
1047 ++ EVPerr(EVP_F_AEAD_AES_128_GCM_OPEN, EVP_R_BAD_DECRYPT);
1054 ++static const EVP_AEAD aead_aes_128_gcm = {
1055 ++ 16, /* key len */
1056 ++ 12, /* nonce len */
1057 ++ EVP_AEAD_AES_128_GCM_TAG_LEN, /* overhead */
1058 ++ EVP_AEAD_AES_128_GCM_TAG_LEN, /* max tag length */
1060 ++ aead_aes_128_gcm_init,
1061 ++ aead_aes_128_gcm_cleanup,
1062 ++ aead_aes_128_gcm_seal,
1063 ++ aead_aes_128_gcm_open,
1066 ++const EVP_AEAD *EVP_aead_aes_128_gcm()
1068 ++ return &aead_aes_128_gcm;
1073 +diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h
1074 +index 5f18d4b..bd10642 100644
1075 +--- a/crypto/evp/evp.h
1076 ++++ b/crypto/evp/evp.h
1077 +@@ -1243,6 +1243,109 @@ void EVP_PKEY_meth_set_ctrl(EVP_PKEY_METHOD *pmeth,
1078 + int (*ctrl_str)(EVP_PKEY_CTX *ctx,
1079 + const char *type, const char *value));
1081 ++/* Authenticated Encryption with Additional Data.
1083 ++ * AEAD couples confidentiality and integrity in a single primtive. AEAD
1084 ++ * algorithms take a key and then can seal and open individual messages. Each
1085 ++ * message has a unique, per-message nonce and, optionally, additional data
1086 ++ * which is authenticated but not included in the output. */
1088 ++struct evp_aead_st;
1089 ++typedef struct evp_aead_st EVP_AEAD;
1091 ++#ifndef OPENSSL_NO_AES
1092 ++/* EVP_aes_128_gcm is AES-128 in Galois Counter Mode. */
1093 ++const EVP_AEAD *EVP_aead_aes_128_gcm(void);
1096 ++/* EVP_AEAD_key_length returns the length, in bytes, of the keys used by
1098 ++size_t EVP_AEAD_key_length(const EVP_AEAD *aead);
1100 ++/* EVP_AEAD_nonce_length returns the length, in bytes, of the per-message nonce
1102 ++size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead);
1104 ++/* EVP_AEAD_max_overhead returns the maximum number of additional bytes added
1105 ++ * by the act of sealing data with |aead|. */
1106 ++size_t EVP_AEAD_max_overhead(const EVP_AEAD *aead);
1108 ++/* EVP_AEAD_max_tag_len returns the maximum tag length when using |aead|. This
1109 ++ * is the largest value that can be passed as |tag_len| to
1110 ++ * |EVP_AEAD_CTX_init|. */
1111 ++size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead);
1113 ++/* An EVP_AEAD_CTX represents an AEAD algorithm configured with a specific key
1114 ++ * and message-independent IV. */
1115 ++typedef struct evp_aead_ctx_st {
1116 ++ const EVP_AEAD *aead;
1117 ++ /* aead_state is an opaque pointer to whatever state the AEAD needs to
1119 ++ void *aead_state;
1122 ++#define EVP_AEAD_DEFAULT_TAG_LENGTH 0
1124 ++/* EVP_AEAD_init initializes |ctx| for the given AEAD algorithm from |impl|.
1125 ++ * The |impl| argument may be NULL to choose the default implementation.
1126 ++ * Authentication tags may be truncated by passing a size as |tag_len|. A
1127 ++ * |tag_len| of zero indicates the default tag length and this is defined as
1128 ++ * EVP_AEAD_DEFAULT_TAG_LENGTH for readability.
1129 ++ * Returns 1 on success. Otherwise returns 0 and pushes to the error stack. */
1130 ++int EVP_AEAD_CTX_init(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead,
1131 ++ const unsigned char *key, size_t key_len,
1132 ++ size_t tag_len, ENGINE *impl);
1134 ++/* EVP_AEAD_CTX_cleanup frees any data allocated by |ctx|. */
1135 ++void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx);
1137 ++/* EVP_AEAD_CTX_seal encrypts and authenticates |in_len| bytes from |in| and
1138 ++ * authenticates |ad_len| bytes from |ad| and writes the result to |out|,
1139 ++ * returning the number of bytes written, or -1 on error.
1141 ++ * This function may be called (with the same EVP_AEAD_CTX) concurrently with
1142 ++ * itself or EVP_AEAD_CTX_open.
1144 ++ * At most |max_out_len| bytes are written to |out| and, in order to ensure
1145 ++ * success, |max_out_len| should be |in_len| plus the result of
1146 ++ * EVP_AEAD_overhead.
1148 ++ * The length of |nonce|, |nonce_len|, must be equal to the result of
1149 ++ * EVP_AEAD_nonce_length for this AEAD.
1151 ++ * EVP_AEAD_CTX_seal never results in a partial output. If |max_out_len| is
1152 ++ * insufficient, -1 will be returned.
1154 ++ * If |in| and |out| alias then |out| must be <= |in|. */
1155 ++ssize_t EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx,
1156 ++ unsigned char *out, size_t max_out_len,
1157 ++ const unsigned char *nonce, size_t nonce_len,
1158 ++ const unsigned char *in, size_t in_len,
1159 ++ const unsigned char *ad, size_t ad_len);
1161 ++/* EVP_AEAD_CTX_open authenticates |in_len| bytes from |in| and |ad_len| bytes
1162 ++ * from |ad| and decrypts at most |in_len| bytes into |out|. It returns the
1163 ++ * number of bytes written, or -1 on error.
1165 ++ * This function may be called (with the same EVP_AEAD_CTX) concurrently with
1166 ++ * itself or EVP_AEAD_CTX_seal.
1168 ++ * At most |in_len| bytes are written to |out|. In order to ensure success,
1169 ++ * |max_out_len| should be at least |in_len|.
1171 ++ * The length of |nonce|, |nonce_len|, must be equal to the result of
1172 ++ * EVP_AEAD_nonce_length for this AEAD.
1174 ++ * EVP_AEAD_CTX_open never results in a partial output. If |max_out_len| is
1175 ++ * insufficient, -1 will be returned.
1177 ++ * If |in| and |out| alias then |out| must be <= |in|. */
1178 ++ssize_t EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx,
1179 ++ unsigned char *out, size_t max_out_len,
1180 ++ const unsigned char *nonce, size_t nonce_len,
1181 ++ const unsigned char *in, size_t in_len,
1182 ++ const unsigned char *ad, size_t ad_len);
1184 + void EVP_add_alg_module(void);
1186 + /* BEGIN ERROR CODES */
1187 +@@ -1254,6 +1357,11 @@ void ERR_load_EVP_strings(void);
1188 + /* Error codes for the EVP functions. */
1190 + /* Function codes. */
1191 ++#define EVP_F_AEAD_AES_128_GCM_INIT 183
1192 ++#define EVP_F_AEAD_AES_128_GCM_OPEN 181
1193 ++#define EVP_F_AEAD_AES_128_GCM_SEAL 182
1194 ++#define EVP_F_AEAD_CTX_OPEN 185
1195 ++#define EVP_F_AEAD_CTX_SEAL 186
1196 + #define EVP_F_AESNI_INIT_KEY 165
1197 + #define EVP_F_AESNI_XTS_CIPHER 176
1198 + #define EVP_F_AES_INIT_KEY 133
1199 +@@ -1268,6 +1376,7 @@ void ERR_load_EVP_strings(void);
1200 + #define EVP_F_DSA_PKEY2PKCS8 135
1201 + #define EVP_F_ECDSA_PKEY2PKCS8 129
1202 + #define EVP_F_ECKEY_PKEY2PKCS8 132
1203 ++#define EVP_F_EVP_AEAD_CTX_INIT 180
1204 + #define EVP_F_EVP_CIPHERINIT_EX 123
1205 + #define EVP_F_EVP_CIPHER_CTX_COPY 163
1206 + #define EVP_F_EVP_CIPHER_CTX_CTRL 124
1207 +@@ -1383,10 +1492,12 @@ void ERR_load_EVP_strings(void);
1208 + #define EVP_R_NO_VERIFY_FUNCTION_CONFIGURED 105
1209 + #define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150
1210 + #define EVP_R_OPERATON_NOT_INITIALIZED 151
1211 ++#define EVP_R_OUTPUT_ALIASES_INPUT 170
1212 + #define EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE 117
1213 + #define EVP_R_PRIVATE_KEY_DECODE_ERROR 145
1214 + #define EVP_R_PRIVATE_KEY_ENCODE_ERROR 146
1215 + #define EVP_R_PUBLIC_KEY_NOT_RSA 106
1216 ++#define EVP_R_TAG_TOO_LARGE 171
1217 + #define EVP_R_TOO_LARGE 164
1218 + #define EVP_R_UNKNOWN_CIPHER 160
1219 + #define EVP_R_UNKNOWN_DIGEST 161
1220 +diff --git a/crypto/evp/evp_aead.c b/crypto/evp/evp_aead.c
1221 +new file mode 100644
1222 +index 0000000..91da561
1224 ++++ b/crypto/evp/evp_aead.c
1226 ++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
1227 ++ * All rights reserved.
1229 ++ * This package is an SSL implementation written
1230 ++ * by Eric Young (eay@cryptsoft.com).
1231 ++ * The implementation was written so as to conform with Netscapes SSL.
1233 ++ * This library is free for commercial and non-commercial use as long as
1234 ++ * the following conditions are aheared to. The following conditions
1235 ++ * apply to all code found in this distribution, be it the RC4, RSA,
1236 ++ * lhash, DES, etc., code; not just the SSL code. The SSL documentation
1237 ++ * included with this distribution is covered by the same copyright terms
1238 ++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
1240 ++ * Copyright remains Eric Young's, and as such any Copyright notices in
1241 ++ * the code are not to be removed.
1242 ++ * If this package is used in a product, Eric Young should be given attribution
1243 ++ * as the author of the parts of the library used.
1244 ++ * This can be in the form of a textual message at program startup or
1245 ++ * in documentation (online or textual) provided with the package.
1247 ++ * Redistribution and use in source and binary forms, with or without
1248 ++ * modification, are permitted provided that the following conditions
1250 ++ * 1. Redistributions of source code must retain the copyright
1251 ++ * notice, this list of conditions and the following disclaimer.
1252 ++ * 2. Redistributions in binary form must reproduce the above copyright
1253 ++ * notice, this list of conditions and the following disclaimer in the
1254 ++ * documentation and/or other materials provided with the distribution.
1255 ++ * 3. All advertising materials mentioning features or use of this software
1256 ++ * must display the following acknowledgement:
1257 ++ * "This product includes cryptographic software written by
1258 ++ * Eric Young (eay@cryptsoft.com)"
1259 ++ * The word 'cryptographic' can be left out if the rouines from the library
1260 ++ * being used are not cryptographic related :-).
1261 ++ * 4. If you include any Windows specific code (or a derivative thereof) from
1262 ++ * the apps directory (application code) you must include an acknowledgement:
1263 ++ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
1265 ++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
1266 ++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1267 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1268 ++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
1269 ++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1270 ++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1271 ++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1272 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1273 ++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1274 ++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1277 ++ * The licence and distribution terms for any publically available version or
1278 ++ * derivative of this code cannot be changed. i.e. this code cannot simply be
1279 ++ * copied and put under another distribution licence
1280 ++ * [including the GNU Public Licence.]
1283 ++#include <limits.h>
1284 ++#include <string.h>
1286 ++#include <openssl/evp.h>
1287 ++#include <openssl/err.h>
1289 ++#include "evp_locl.h"
1291 ++size_t EVP_AEAD_key_length(const EVP_AEAD *aead)
1293 ++ return aead->key_len;
1296 ++size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead)
1298 ++ return aead->nonce_len;
1301 ++size_t EVP_AEAD_max_overhead(const EVP_AEAD *aead)
1303 ++ return aead->overhead;
1306 ++size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead)
1308 ++ return aead->max_tag_len;
1311 ++int EVP_AEAD_CTX_init(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead,
1312 ++ const unsigned char *key, size_t key_len,
1313 ++ size_t tag_len, ENGINE *impl)
1315 ++ ctx->aead = aead;
1316 ++ if (key_len != aead->key_len)
1318 ++ EVPerr(EVP_F_EVP_AEAD_CTX_INIT,EVP_R_UNSUPPORTED_KEY_SIZE);
1321 ++ return aead->init(ctx, key, key_len, tag_len);
1324 ++void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx)
1326 ++ if (ctx->aead == NULL)
1328 ++ ctx->aead->cleanup(ctx);
1329 ++ ctx->aead = NULL;
1332 ++/* check_alias returns 0 if |out| points within the buffer determined by |in|
1333 ++ * and |in_len| and 1 otherwise.
1335 ++ * When processing, there's only an issue if |out| points within in[:in_len]
1336 ++ * and isn't equal to |in|. If that's the case then writing the output will
1337 ++ * stomp input that hasn't been read yet.
1339 ++ * This function checks for that case. */
1340 ++static int check_alias(const unsigned char *in, size_t in_len,
1341 ++ const unsigned char *out)
1345 ++ if (in + in_len <= out)
1350 ++ssize_t EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx,
1351 ++ unsigned char *out, size_t max_out_len,
1352 ++ const unsigned char *nonce, size_t nonce_len,
1353 ++ const unsigned char *in, size_t in_len,
1354 ++ const unsigned char *ad, size_t ad_len)
1356 ++ size_t possible_out_len = in_len + ctx->aead->overhead;
1359 ++ if (possible_out_len < in_len /* overflow */ ||
1360 ++ possible_out_len > SSIZE_MAX /* return value cannot be
1363 ++ EVPerr(EVP_F_AEAD_CTX_SEAL, EVP_R_TOO_LARGE);
1367 ++ if (!check_alias(in, in_len, out))
1369 ++ EVPerr(EVP_F_AEAD_CTX_SEAL, EVP_R_OUTPUT_ALIASES_INPUT);
1373 ++ r = ctx->aead->seal(ctx, out, max_out_len, nonce, nonce_len,
1374 ++ in, in_len, ad, ad_len);
1379 ++ /* In the event of an error, clear the output buffer so that a caller
1380 ++ * that doesn't check the return value doesn't send raw data. */
1381 ++ memset(out, 0, max_out_len);
1385 ++ssize_t EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx,
1386 ++ unsigned char *out, size_t max_out_len,
1387 ++ const unsigned char *nonce, size_t nonce_len,
1388 ++ const unsigned char *in, size_t in_len,
1389 ++ const unsigned char *ad, size_t ad_len)
1393 ++ if (in_len > SSIZE_MAX)
1395 ++ EVPerr(EVP_F_AEAD_CTX_OPEN, EVP_R_TOO_LARGE);
1396 ++ goto error; /* may not be able to represent return value. */
1399 ++ if (!check_alias(in, in_len, out))
1401 ++ EVPerr(EVP_F_AEAD_CTX_OPEN, EVP_R_OUTPUT_ALIASES_INPUT);
1405 ++ r = ctx->aead->open(ctx, out, max_out_len, nonce, nonce_len,
1406 ++ in, in_len, ad, ad_len);
1412 ++ /* In the event of an error, clear the output buffer so that a caller
1413 ++ * that doesn't check the return value doesn't try and process bad
1415 ++ memset(out, 0, max_out_len);
1418 +diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c
1419 +index 08eab98..c47969c 100644
1420 +--- a/crypto/evp/evp_err.c
1421 ++++ b/crypto/evp/evp_err.c
1424 + static ERR_STRING_DATA EVP_str_functs[]=
1426 ++{ERR_FUNC(EVP_F_AEAD_AES_128_GCM_INIT), "AEAD_AES_128_GCM_INIT"},
1427 ++{ERR_FUNC(EVP_F_AEAD_AES_128_GCM_OPEN), "AEAD_AES_128_GCM_OPEN"},
1428 ++{ERR_FUNC(EVP_F_AEAD_AES_128_GCM_SEAL), "AEAD_AES_128_GCM_SEAL"},
1429 ++{ERR_FUNC(EVP_F_AEAD_CTX_OPEN), "AEAD_CTX_OPEN"},
1430 ++{ERR_FUNC(EVP_F_AEAD_CTX_SEAL), "AEAD_CTX_SEAL"},
1431 + {ERR_FUNC(EVP_F_AESNI_INIT_KEY), "AESNI_INIT_KEY"},
1432 + {ERR_FUNC(EVP_F_AESNI_XTS_CIPHER), "AESNI_XTS_CIPHER"},
1433 + {ERR_FUNC(EVP_F_AES_INIT_KEY), "AES_INIT_KEY"},
1434 +@@ -84,6 +89,7 @@ static ERR_STRING_DATA EVP_str_functs[]=
1435 + {ERR_FUNC(EVP_F_DSA_PKEY2PKCS8), "DSA_PKEY2PKCS8"},
1436 + {ERR_FUNC(EVP_F_ECDSA_PKEY2PKCS8), "ECDSA_PKEY2PKCS8"},
1437 + {ERR_FUNC(EVP_F_ECKEY_PKEY2PKCS8), "ECKEY_PKEY2PKCS8"},
1438 ++{ERR_FUNC(EVP_F_EVP_AEAD_CTX_INIT), "EVP_AEAD_CTX_init"},
1439 + {ERR_FUNC(EVP_F_EVP_CIPHERINIT_EX), "EVP_CipherInit_ex"},
1440 + {ERR_FUNC(EVP_F_EVP_CIPHER_CTX_COPY), "EVP_CIPHER_CTX_copy"},
1441 + {ERR_FUNC(EVP_F_EVP_CIPHER_CTX_CTRL), "EVP_CIPHER_CTX_ctrl"},
1442 +@@ -202,10 +208,12 @@ static ERR_STRING_DATA EVP_str_reasons[]=
1443 + {ERR_REASON(EVP_R_NO_VERIFY_FUNCTION_CONFIGURED),"no verify function configured"},
1444 + {ERR_REASON(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"},
1445 + {ERR_REASON(EVP_R_OPERATON_NOT_INITIALIZED),"operaton not initialized"},
1446 ++{ERR_REASON(EVP_R_OUTPUT_ALIASES_INPUT) ,"output aliases input"},
1447 + {ERR_REASON(EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE),"pkcs8 unknown broken type"},
1448 + {ERR_REASON(EVP_R_PRIVATE_KEY_DECODE_ERROR),"private key decode error"},
1449 + {ERR_REASON(EVP_R_PRIVATE_KEY_ENCODE_ERROR),"private key encode error"},
1450 + {ERR_REASON(EVP_R_PUBLIC_KEY_NOT_RSA) ,"public key not rsa"},
1451 ++{ERR_REASON(EVP_R_TAG_TOO_LARGE) ,"tag too large"},
1452 + {ERR_REASON(EVP_R_TOO_LARGE) ,"too large"},
1453 + {ERR_REASON(EVP_R_UNKNOWN_CIPHER) ,"unknown cipher"},
1454 + {ERR_REASON(EVP_R_UNKNOWN_DIGEST) ,"unknown digest"},
1455 +diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_locl.h
1456 +index 08c0a66..c0f9fdf 100644
1457 +--- a/crypto/evp/evp_locl.h
1458 ++++ b/crypto/evp/evp_locl.h
1459 +@@ -348,6 +348,30 @@ int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
1461 + const EVP_CIPHER *c, const EVP_MD *md, int en_de);
1463 ++/* EVP_AEAD represents a specific AEAD algorithm. */
1464 ++struct evp_aead_st {
1465 ++ unsigned char key_len;
1466 ++ unsigned char nonce_len;
1467 ++ unsigned char overhead;
1468 ++ unsigned char max_tag_len;
1470 ++ int (*init) (struct evp_aead_ctx_st*, const unsigned char *key,
1471 ++ size_t key_len, size_t tag_len);
1472 ++ void (*cleanup) (struct evp_aead_ctx_st*);
1474 ++ ssize_t (*seal) (const struct evp_aead_ctx_st *ctx,
1475 ++ unsigned char *out, size_t max_out_len,
1476 ++ const unsigned char *nonce, size_t nonce_len,
1477 ++ const unsigned char *in, size_t in_len,
1478 ++ const unsigned char *ad, size_t ad_len);
1480 ++ ssize_t (*open) (const struct evp_aead_ctx_st *ctx,
1481 ++ unsigned char *out, size_t max_out_len,
1482 ++ const unsigned char *nonce, size_t nonce_len,
1483 ++ const unsigned char *in, size_t in_len,
1484 ++ const unsigned char *ad, size_t ad_len);
1487 + #ifdef OPENSSL_FIPS
1489 + #ifdef OPENSSL_DOING_MAKEDEPEND
1490 +diff --git a/doc/crypto/EVP_AEAD_CTX_init.pod b/doc/crypto/EVP_AEAD_CTX_init.pod
1491 +new file mode 100644
1492 +index 0000000..20e455d
1494 ++++ b/doc/crypto/EVP_AEAD_CTX_init.pod
1500 ++EVP_AEAD_CTX_init, EVP_AEAD_CTX_cleanup, EVP_AEAD_CTX_seal, EVP_AEAD_CTX_open - authenticated encryption functions.
1504 ++ #include <openssl/evp.h>
1506 ++ int EVP_AEAD_CTX_init(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead,
1507 ++ const unsigned char *key, size_t key_len,
1508 ++ size_t tag_len, ENGINE *impl);
1509 ++ void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx);
1510 ++ ssize_t EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx,
1511 ++ unsigned char *out, size_t max_out_len,
1512 ++ const unsigned char *nonce, size_t nonce_len,
1513 ++ const unsigned char *in, size_t in_len,
1514 ++ const unsigned char *ad, size_t ad_len);
1515 ++ ssize_t EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx,
1516 ++ unsigned char *out, size_t max_out_len,
1517 ++ const unsigned char *nonce, size_t nonce_len,
1518 ++ const unsigned char *in, size_t in_len,
1519 ++ const unsigned char *ad, size_t ad_len);
1521 ++=head1 DESCRIPTION
1523 ++The EVP_AEAD_CTX_init() function initialises an B<EVP_AEAD_CTX> structure and
1524 ++performs any precomputation needed to use B<aead> with B<key>. The length of
1525 ++the key, B<key_len>, is given in bytes.
1527 ++The B<tag_len> argument contains the length of the tags, in bytes, and allows
1528 ++for the processing of truncated authenticators. A zero value indicates that the
1529 ++default tag length should be used and this is defined as
1530 ++C<EVP_AEAD_DEFAULT_TAG_LENGTH> in order to make the code clear. Using truncated
1531 ++tags increases an attacker's chance of creating a valid forgery. Be aware that
1532 ++the attacker's chance may increase more than exponentially as would naively be
1535 ++When no longer needed, the initialised B<EVP_AEAD_CTX> structure must be passed
1536 ++to EVP_AEAD_CTX_cleanup(), which will deallocate any memory used.
1538 ++With an B<EVP_AEAD_CTX> in hand, one can seal and open messages. These
1539 ++operations are intended to meet the standard notions of privacy and
1540 ++authenticity for authenticated encryption. For formal definitions see I<Bellare
1541 ++and Namprempre>, "Authenticated encryption: relations among notions and
1542 ++analysis of the generic composition paradigm," Lecture Notes in Computer
1543 ++Science B<1976> (2000), 531–545,
1544 ++L<http://www-cse.ucsd.edu/~mihir/papers/oem.html>.
1546 ++When sealing messages, a nonce must be given. The length of the nonce is fixed
1547 ++by the AEAD in use and is returned by EVP_AEAD_nonce_length(). I<The nonce must
1548 ++be unique for all messages with the same key>. This is critically important -
1549 ++nonce reuse may completely undermine the security of the AEAD. Nonces may be
1550 ++predictable and public, so long as they are unique. Uniqueness may be achieved
1551 ++with a simple counter or, if long enough, may be generated randomly. The nonce
1552 ++must be passed into the "open" operation by the receiver so must either be
1553 ++implicit (e.g. a counter), or must be transmitted along with the sealed message.
1555 ++The "seal" and "open" operations are atomic - an entire message must be
1556 ++encrypted or decrypted in a single call. Large messages may have to be split up
1557 ++in order to accomodate this. When doing so, be mindful of the need not to
1558 ++repeat nonces and the possibility that an attacker could duplicate, reorder or
1559 ++drop message chunks. For example, using a single key for a given (large)
1560 ++message and sealing chunks with nonces counting from zero would be secure as
1561 ++long as the number of chunks was securely transmitted. (Otherwise an attacker
1562 ++could truncate the message by dropping chunks from the end.)
1564 ++The number of chunks could be transmitted by prefixing it to the plaintext, for
1565 ++example. This also assumes that no other message would ever use the same key
1566 ++otherwise the rule that nonces must be unique for a given key would be
1569 ++The "seal" and "open" operations also permit additional data to be
1570 ++authenticated via the B<ad> parameter. This data is not included in the
1571 ++ciphertext and must be identical for both the "seal" and "open" call. This
1572 ++permits implicit context to be authenticated but may be C<NULL> if not needed.
1574 ++The "seal" and "open" operations may work inplace if the B<out> and B<in>
1575 ++arguments are equal. They may also be used to shift the data left inside the
1576 ++same buffer if B<out> is less than B<in>. However, B<out> may not point inside
1577 ++the input data otherwise the input may be overwritten before it has been read.
1578 ++This case will cause an error.
1580 ++=head1 RETURN VALUES
1582 ++The "seal" and "open" operations return an C<ssize_t> with value -1 on error,
1583 ++otherwise they return the number of output bytes written. An error will be
1584 ++returned if the input length is large enough that the output size exceeds the
1585 ++range of a C<ssize_t>.
1589 ++These functions were first added to OpenSSL 1.0.2.
1595 diff -burN android-openssl-lhash2/patches/chacha20poly1305.patch android-openssl/patches/chacha20poly1305.patch
1596 --- android-openssl-lhash2/patches/chacha20poly1305.patch 1969-12-31 19:00:00.000000000 -0500
1597 +++ android-openssl/patches/chacha20poly1305.patch 2013-11-05 15:15:28.454480948 -0500
1599 +From 2688f00904e4ffd647afcff69bb8fe6df8c5902b Mon Sep 17 00:00:00 2001
1600 +From: Adam Langley <agl@chromium.org>
1601 +Date: Mon, 9 Sep 2013 12:13:24 -0400
1602 +Subject: [PATCH 43/52] chacha20poly1305
1604 +Add support for Chacha20 + Poly1305.
1608 + Makefile.org | 6 +-
1609 + apps/speed.c | 64 +-
1610 + crypto/chacha/Makefile | 80 ++
1611 + crypto/chacha/chacha.h | 85 ++
1612 + crypto/chacha/chacha_enc.c | 167 +++
1613 + crypto/chacha/chacha_vec.c | 345 +++++++
1614 + crypto/chacha/chachatest.c | 211 ++++
1615 + crypto/evp/Makefile | 35 +-
1616 + crypto/evp/e_chacha20poly1305.c | 261 +++++
1617 + crypto/evp/evp.h | 8 +
1618 + crypto/evp/evp_err.c | 3 +
1619 + crypto/poly1305/Makefile | 81 ++
1620 + crypto/poly1305/poly1305.c | 320 ++++++
1621 + crypto/poly1305/poly1305.h | 88 ++
1622 + crypto/poly1305/poly1305_arm.c | 335 ++++++
1623 + crypto/poly1305/poly1305_arm_asm.s | 2009 ++++++++++++++++++++++++++++++++++++
1624 + crypto/poly1305/poly1305_vec.c | 733 +++++++++++++
1625 + crypto/poly1305/poly1305test.c | 166 +++
1626 + ssl/s3_lib.c | 75 +-
1627 + ssl/s3_pkt.c | 5 +-
1629 + ssl/ssl_ciph.c | 16 +-
1630 + ssl/ssl_locl.h | 10 +
1631 + ssl/t1_enc.c | 30 +-
1633 + test/Makefile | 23 +-
1634 + 28 files changed, 5166 insertions(+), 56 deletions(-)
1635 + create mode 100644 crypto/chacha/Makefile
1636 + create mode 100644 crypto/chacha/chacha.h
1637 + create mode 100644 crypto/chacha/chacha_enc.c
1638 + create mode 100644 crypto/chacha/chacha_vec.c
1639 + create mode 100644 crypto/chacha/chachatest.c
1640 + create mode 100644 crypto/evp/e_chacha20poly1305.c
1641 + create mode 100644 crypto/poly1305/Makefile
1642 + create mode 100644 crypto/poly1305/poly1305.c
1643 + create mode 100644 crypto/poly1305/poly1305.h
1644 + create mode 100644 crypto/poly1305/poly1305_arm.c
1645 + create mode 100644 crypto/poly1305/poly1305_arm_asm.s
1646 + create mode 100644 crypto/poly1305/poly1305_vec.c
1647 + create mode 100644 crypto/poly1305/poly1305test.c
1649 +diff --git a/openssl/ssl/ssl_ciph.c b/openssl/ssl/ssl_ciph.c
1650 +index db85b29..cebb18a 100644
1651 +--- a/ssl/ssl_ciph.c
1652 ++++ b/ssl/ssl_ciph.c
1653 +@@ -1442,7 +1442,9 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1654 + ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1655 + ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
1657 +- /* AES is our preferred symmetric cipher */
1658 ++ /* CHACHA20 is fast and safe on all hardware and is thus our preferred
1659 ++ * symmetric cipher, with AES second. */
1660 ++ ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1661 + ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1663 + /* Temporarily enable everything else for sorting */
1664 +diff --git a/Configure b/Configure
1665 +index 9c803dc..1b95384 100755
1668 +@@ -124,24 +124,24 @@ my $tlib="-lnsl -lsocket";
1669 + my $bits1="THIRTY_TWO_BIT ";
1670 + my $bits2="SIXTY_FOUR_BIT ";
1672 +-my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:";
1673 ++my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:::";
1675 + my $x86_elf_asm="$x86_asm:elf";
1677 +-my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o x86_64-mont5.o x86_64-gf2m.o modexp512-x86_64.o::aes-x86_64.o vpaes-x86_64.o bsaes-x86_64.o aesni-x86_64.o aesni-sha1-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o rc4-md5-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:ghash-x86_64.o:";
1678 +-my $ia64_asm="ia64cpuid.o:bn-ia64.o ia64-mont.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o:::::ghash-ia64.o::void";
1679 +-my $sparcv9_asm="sparcv9cap.o sparccpuid.o:bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o:des_enc-sparc.o fcrypt_b.o:aes_core.o aes_cbc.o aes-sparcv9.o:::sha1-sparcv9.o sha256-sparcv9.o sha512-sparcv9.o:::::::ghash-sparcv9.o::void";
1680 +-my $sparcv8_asm=":sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::::::void";
1681 +-my $alpha_asm="alphacpuid.o:bn_asm.o alpha-mont.o:::::sha1-alpha.o:::::::ghash-alpha.o::void";
1682 +-my $mips32_asm=":bn-mips.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o::::::::";
1683 +-my $mips64_asm=":bn-mips.o mips-mont.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o sha512-mips.o::::::::";
1684 +-my $s390x_asm="s390xcap.o s390xcpuid.o:bn-s390x.o s390x-mont.o s390x-gf2m.o::aes-s390x.o aes-ctr.o aes-xts.o:::sha1-s390x.o sha256-s390x.o sha512-s390x.o::rc4-s390x.o:::::ghash-s390x.o:";
1685 +-my $armv4_asm="armcap.o armv4cpuid.o:bn_asm.o armv4-mont.o armv4-gf2m.o::aes_cbc.o aes-armv4.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o::void";
1686 +-my $parisc11_asm="pariscid.o:bn_asm.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::32";
1687 +-my $parisc20_asm="pariscid.o:pa-risc2W.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::64";
1688 +-my $ppc32_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o::aes_core.o aes_cbc.o aes-ppc.o:::sha1-ppc.o sha256-ppc.o::::::::";
1689 +-my $ppc64_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o::aes_core.o aes_cbc.o aes-ppc.o:::sha1-ppc.o sha256-ppc.o sha512-ppc.o::::::::";
1690 +-my $no_asm=":::::::::::::::void";
1691 ++my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o x86_64-mont5.o x86_64-gf2m.o modexp512-x86_64.o::aes-x86_64.o vpaes-x86_64.o bsaes-x86_64.o aesni-x86_64.o aesni-sha1-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o rc4-md5-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:ghash-x86_64.o::chacha_vec.o:poly1305_vec.o";
1692 ++my $ia64_asm="ia64cpuid.o:bn-ia64.o ia64-mont.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o:::::ghash-ia64.o::::void";
1693 ++my $sparcv9_asm="sparcv9cap.o sparccpuid.o:bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o:des_enc-sparc.o fcrypt_b.o:aes_core.o aes_cbc.o aes-sparcv9.o:::sha1-sparcv9.o sha256-sparcv9.o sha512-sparcv9.o:::::::ghash-sparcv9.o::::void";
1694 ++my $sparcv8_asm=":sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::::::::void";
1695 ++my $alpha_asm="alphacpuid.o:bn_asm.o alpha-mont.o:::::sha1-alpha.o:::::::ghash-alpha.o::::void";
1696 ++my $mips32_asm=":bn-mips.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o::::::::::";
1697 ++my $mips64_asm=":bn-mips.o mips-mont.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o sha512-mips.o::::::::::";
1698 ++my $s390x_asm="s390xcap.o s390xcpuid.o:bn-s390x.o s390x-mont.o s390x-gf2m.o::aes-s390x.o aes-ctr.o aes-xts.o:::sha1-s390x.o sha256-s390x.o sha512-s390x.o::rc4-s390x.o:::::::ghash-s390x.o:";
1699 ++my $armv4_asm="armcap.o armv4cpuid.o:bn_asm.o armv4-mont.o armv4-gf2m.o::aes_cbc.o aes-armv4.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o::chacha_vec.o:poly1305_arm.o poly1305_arm_asm.o:void";
1700 ++my $parisc11_asm="pariscid.o:bn_asm.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::::32";
1701 ++my $parisc20_asm="pariscid.o:pa-risc2W.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::::64";
1702 ++my $ppc32_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o::aes_core.o aes_cbc.o aes-ppc.o:::sha1-ppc.o sha256-ppc.o::::::::::";
1703 ++my $ppc64_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o::aes_core.o aes_cbc.o aes-ppc.o:::sha1-ppc.o sha256-ppc.o sha512-ppc.o::::::::::";
1704 ++my $no_asm=":::::::::::::::::void";
1706 + # As for $BSDthreads. Idea is to maintain "collective" set of flags,
1707 + # which would cover all BSD flavors. -pthread applies to them all,
1708 +@@ -152,7 +152,7 @@ my $no_asm=":::::::::::::::void";
1709 + # seems to be sufficient?
1710 + my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
1712 +-#config-string $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $cpuid_obj : $bn_obj : $des_obj : $aes_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $wp_obj : $cmll_obj : $modes_obj : $engines_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib : $arflags : $multilib
1713 ++#config-string $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $cpuid_obj : $bn_obj : $des_obj : $aes_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $wp_obj : $cmll_obj : $modes_obj : $engines_obj : $chacha_obj : $poly1305_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib : $arflags : $multilib :
1716 + # File 'TABLE' (created by 'make TABLE') contains the data from this list,
1717 +@@ -647,6 +647,8 @@ my $idx_wp_obj = $idx++;
1718 + my $idx_cmll_obj = $idx++;
1719 + my $idx_modes_obj = $idx++;
1720 + my $idx_engines_obj = $idx++;
1721 ++my $idx_chacha_obj = $idx++;
1722 ++my $idx_poly1305_obj = $idx++;
1723 + my $idx_perlasm_scheme = $idx++;
1724 + my $idx_dso_scheme = $idx++;
1725 + my $idx_shared_target = $idx++;
1726 +@@ -692,6 +694,8 @@ my $aes_enc="aes_core.o aes_cbc.o";
1727 + my $bf_enc ="bf_enc.o";
1728 + my $cast_enc="c_enc.o";
1729 + my $rc4_enc="rc4_enc.o rc4_skey.o";
1730 ++my $chacha_enc="chacha_enc.o";
1731 ++my $poly1305 ="poly1305.o";
1732 + my $rc5_enc="rc5_enc.o";
1735 +@@ -1144,7 +1148,7 @@ $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/]
1737 + print "IsMK1MF=$IsMK1MF\n";
1739 +-my @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
1740 ++my @fields = split(/\s*:\s*/,$table{$target} . ":" x 31 , -1);
1741 + my $cc = $fields[$idx_cc];
1742 + # Allow environment CC to override compiler...
1744 +@@ -1181,6 +1185,8 @@ my $ranlib = $ENV{'RANLIB'} || $fields[$idx_ranlib];
1745 + my $ar = $ENV{'AR'} || "ar";
1746 + my $arflags = $fields[$idx_arflags];
1747 + my $multilib = $fields[$idx_multilib];
1748 ++my $chacha_obj = $fields[$idx_chacha_obj];
1749 ++my $poly1305_obj = $fields[$idx_poly1305_obj];
1751 + # if $prefix/lib$multilib is not an existing directory, then
1752 + # assume that it's not searched by linker automatically, in
1753 +@@ -1477,6 +1483,8 @@ $des_obj=$des_enc unless ($des_obj =~ /\.o$/);
1754 + $bf_obj=$bf_enc unless ($bf_obj =~ /\.o$/);
1755 + $cast_obj=$cast_enc unless ($cast_obj =~ /\.o$/);
1756 + $rc4_obj=$rc4_enc unless ($rc4_obj =~ /\.o$/);
1757 ++$chacha_obj=$chacha_enc unless ($chacha_obj =~ /\.o$/);
1758 ++$poly1305_obj=$poly1305 unless ($poly1305_obj =~ /\.o$/);
1759 + $rc5_obj=$rc5_enc unless ($rc5_obj =~ /\.o$/);
1760 + if ($sha1_obj =~ /\.o$/)
1762 +@@ -1637,6 +1645,8 @@ while (<IN>)
1763 + s/^BF_ENC=.*$/BF_ENC= $bf_obj/;
1764 + s/^CAST_ENC=.*$/CAST_ENC= $cast_obj/;
1765 + s/^RC4_ENC=.*$/RC4_ENC= $rc4_obj/;
1766 ++ s/^CHACHA_ENC=.*$/CHACHA_ENC= $chacha_obj/;
1767 ++ s/^POLY1305=.*$/POLY1305= $poly1305_obj/;
1768 + s/^RC5_ENC=.*$/RC5_ENC= $rc5_obj/;
1769 + s/^MD5_ASM_OBJ=.*$/MD5_ASM_OBJ= $md5_obj/;
1770 + s/^SHA1_ASM_OBJ=.*$/SHA1_ASM_OBJ= $sha1_obj/;
1771 +@@ -1698,6 +1708,8 @@ print "AES_ENC =$aes_obj\n";
1772 + print "BF_ENC =$bf_obj\n";
1773 + print "CAST_ENC =$cast_obj\n";
1774 + print "RC4_ENC =$rc4_obj\n";
1775 ++print "CHACHA_ENC =$chacha_obj\n";
1776 ++print "POLY1305 =$poly1305_obj\n";
1777 + print "RC5_ENC =$rc5_obj\n";
1778 + print "MD5_OBJ_ASM =$md5_obj\n";
1779 + print "SHA1_OBJ_ASM =$sha1_obj\n";
1780 +@@ -2096,11 +2108,11 @@ sub print_table_entry
1782 + (my $cc,my $cflags,my $unistd,my $thread_cflag,my $sys_id,my $lflags,
1783 + my $bn_ops,my $cpuid_obj,my $bn_obj,my $des_obj,my $aes_obj, my $bf_obj,
1784 +- my $md5_obj,my $sha1_obj,my $cast_obj,my $rc4_obj,my $rmd160_obj,
1785 +- my $rc5_obj,my $wp_obj,my $cmll_obj,my $modes_obj, my $engines_obj,
1786 ++ my $md5_obj,my $sha1_obj,my $cast_obj,my $rc4_obj,my $chacha_obj,my $poly1305_obj,
1787 ++ my $rmd160_obj, my $rc5_obj,my $wp_obj,my $cmll_obj,my $modes_obj, my $engines_obj,
1788 + my $perlasm_scheme,my $dso_scheme,my $shared_target,my $shared_cflag,
1789 + my $shared_ldflag,my $shared_extension,my $ranlib,my $arflags,my $multilib)=
1790 +- split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
1791 ++ split(/\s*:\s*/,$table{$target} . ":" x 31 , -1);
1795 +@@ -2121,6 +2133,8 @@ sub print_table_entry
1796 + \$sha1_obj = $sha1_obj
1797 + \$cast_obj = $cast_obj
1798 + \$rc4_obj = $rc4_obj
1799 ++\$chacha_obj = $chacha_obj
1800 ++\$poly1305_obj = $poly1305_obj
1801 + \$rmd160_obj = $rmd160_obj
1802 + \$rc5_obj = $rc5_obj
1803 + \$wp_obj = $wp_obj
1804 +@@ -2150,7 +2164,7 @@ sub test_sanity
1806 + foreach $target (sort keys %table)
1808 +- @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
1809 ++ @fields = split(/\s*:\s*/,$table{$target} . ":" x 31 , -1);
1811 + if ($fields[$idx_dso_scheme-1] =~ /^(beos|dl|dlfcn|win32|vms)$/)
1813 +diff --git a/Makefile.org b/Makefile.org
1814 +index 2db31ea..919466d 100644
1817 +@@ -94,6 +94,8 @@ BF_ENC= bf_enc.o
1819 + RC4_ENC= rc4_enc.o
1820 + RC5_ENC= rc5_enc.o
1821 ++CHACHA_ENC= chacha_enc.o
1822 ++POLY1305= poly1305.o
1826 +@@ -147,7 +149,7 @@ SDIRS= \
1827 + bn ec rsa dsa ecdsa dh ecdh dso engine \
1828 + buffer bio stack lhash rand err \
1829 + evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
1830 +- cms pqueue ts jpake srp store cmac
1831 ++ cms pqueue ts jpake srp store cmac poly1305 chacha
1832 + # keep in mind that the above list is adjusted by ./Configure
1833 + # according to no-xxx arguments...
1835 +@@ -232,6 +234,8 @@ BUILDENV= PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)' \
1836 + WP_ASM_OBJ='$(WP_ASM_OBJ)' \
1837 + MODES_ASM_OBJ='$(MODES_ASM_OBJ)' \
1838 + ENGINES_ASM_OBJ='$(ENGINES_ASM_OBJ)' \
1839 ++ CHACHA_ENC='$(CHACHA_ENC)' \
1840 ++ POLY1305='$(POLY1305)' \
1841 + PERLASM_SCHEME='$(PERLASM_SCHEME)' \
1842 + FIPSLIBDIR='${FIPSLIBDIR}' \
1843 + FIPSDIR='${FIPSDIR}' \
1844 +diff --git a/crypto/chacha/Makefile b/crypto/chacha/Makefile
1845 +new file mode 100644
1846 +index 0000000..289933b
1848 ++++ b/crypto/chacha/Makefile
1851 ++# OpenSSL/crypto/chacha/Makefile
1862 ++CFLAGS= $(INCLUDES) $(CFLAG)
1863 ++ASFLAGS= $(INCLUDES) $(ASFLAG)
1864 ++AFLAGS= $(ASFLAGS)
1866 ++CHACHA_ENC=chacha_enc.o
1872 ++LIB=$(TOP)/libcrypto.a
1874 ++LIBOBJ=$(CHACHA_ENC)
1879 ++HEADER= $(EXHEADER)
1881 ++ALL= $(GENERAL) $(SRC) $(HEADER)
1884 ++ (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
1889 ++ $(AR) $(LIB) $(LIBOBJ)
1890 ++ $(RANLIB) $(LIB) || echo Never mind.
1894 ++ $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
1897 ++ @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
1898 ++ @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
1899 ++ @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
1902 ++ @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
1903 ++ @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
1905 ++ (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
1906 ++ chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
1915 ++ lint -DLINT $(INCLUDES) $(SRC)>fluff
1918 ++ @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
1919 ++ $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
1922 ++ $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
1923 ++ mv -f Makefile.new $(MAKEFILE)
1926 ++ rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
1928 ++# DO NOT DELETE THIS LINE -- make depend depends on it.
1930 +diff --git a/crypto/chacha/chacha.h b/crypto/chacha/chacha.h
1931 +new file mode 100644
1932 +index 0000000..d56519d
1934 ++++ b/crypto/chacha/chacha.h
1937 ++ * Chacha stream algorithm.
1939 ++ * Created on: Jun, 2013
1940 ++ * Author: Elie Bursztein (elieb@google.com)
1942 ++ * Adapted from the estream code by D. Bernstein.
1944 ++/* ====================================================================
1945 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
1947 ++ * Redistribution and use in source and binary forms, with or without
1948 ++ * modification, are permitted provided that the following conditions
1951 ++ * 1. Redistributions of source code must retain the above copyright
1952 ++ * notice, this list of conditions and the following disclaimer.
1954 ++ * 2. Redistributions in binary form must reproduce the above copyright
1955 ++ * notice, this list of conditions and the following disclaimer in
1956 ++ * the documentation and/or other materials provided with the
1959 ++ * 3. All advertising materials mentioning features or use of this
1960 ++ * software must display the following acknowledgment:
1961 ++ * "This product includes software developed by the OpenSSL Project
1962 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
1964 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
1965 ++ * endorse or promote products derived from this software without
1966 ++ * prior written permission. For written permission, please contact
1967 ++ * licensing@OpenSSL.org.
1969 ++ * 5. Products derived from this software may not be called "OpenSSL"
1970 ++ * nor may "OpenSSL" appear in their names without prior written
1971 ++ * permission of the OpenSSL Project.
1973 ++ * 6. Redistributions of any form whatsoever must retain the following
1974 ++ * acknowledgment:
1975 ++ * "This product includes software developed by the OpenSSL Project
1976 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
1978 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
1979 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1980 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
1981 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
1982 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
1983 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1984 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
1985 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1986 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1987 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1988 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1989 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
1990 ++ * ====================================================================
1992 ++#ifndef HEADER_CHACHA_H
1993 ++#define HEADER_CHACHA_H
1995 ++#include <openssl/opensslconf.h>
1997 ++#if defined(OPENSSL_NO_CHACHA)
1998 ++#error ChaCha support is disabled.
2001 ++#include <stddef.h>
2003 ++#ifdef __cplusplus
2007 ++/* CRYPTO_chacha_20 encrypts |in_len| bytes from |in| with the given key and
2008 ++ * nonce and writes the result to |out|, which may be equal to |in|. The
2009 ++ * initial block counter is specified by |counter|. */
2010 ++void CRYPTO_chacha_20(unsigned char *out,
2011 ++ const unsigned char *in, size_t in_len,
2012 ++ const unsigned char key[32],
2013 ++ const unsigned char nonce[8],
2016 ++#ifdef __cplusplus
2021 +diff --git a/crypto/chacha/chacha_enc.c b/crypto/chacha/chacha_enc.c
2022 +new file mode 100644
2023 +index 0000000..54d1ca3
2025 ++++ b/crypto/chacha/chacha_enc.c
2028 ++ * Chacha stream algorithm.
2030 ++ * Created on: Jun, 2013
2031 ++ * Author: Elie Bursztein (elieb@google.com)
2033 ++ * Adapted from the estream code by D. Bernstein.
2035 ++/* ====================================================================
2036 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
2038 ++ * Redistribution and use in source and binary forms, with or without
2039 ++ * modification, are permitted provided that the following conditions
2042 ++ * 1. Redistributions of source code must retain the above copyright
2043 ++ * notice, this list of conditions and the following disclaimer.
2045 ++ * 2. Redistributions in binary form must reproduce the above copyright
2046 ++ * notice, this list of conditions and the following disclaimer in
2047 ++ * the documentation and/or other materials provided with the
2050 ++ * 3. All advertising materials mentioning features or use of this
2051 ++ * software must display the following acknowledgment:
2052 ++ * "This product includes software developed by the OpenSSL Project
2053 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
2055 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
2056 ++ * endorse or promote products derived from this software without
2057 ++ * prior written permission. For written permission, please contact
2058 ++ * licensing@OpenSSL.org.
2060 ++ * 5. Products derived from this software may not be called "OpenSSL"
2061 ++ * nor may "OpenSSL" appear in their names without prior written
2062 ++ * permission of the OpenSSL Project.
2064 ++ * 6. Redistributions of any form whatsoever must retain the following
2065 ++ * acknowledgment:
2066 ++ * "This product includes software developed by the OpenSSL Project
2067 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
2069 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
2070 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2071 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
2072 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
2073 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
2074 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2075 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
2076 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2077 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2078 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2079 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2080 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
2081 ++ * ====================================================================
2084 ++#include <stdint.h>
2085 ++#include <string.h>
2086 ++#include <openssl/opensslconf.h>
2088 ++#if !defined(OPENSSL_NO_CHACHA)
2090 ++#include <openssl/chacha.h>
2092 ++/* sigma contains the ChaCha constants, which happen to be an ASCII string. */
2093 ++static const char sigma[16] = "expand 32-byte k";
2095 ++#define ROTATE(v, n) (((v) << (n)) | ((v) >> (32 - (n))))
2096 ++#define XOR(v, w) ((v) ^ (w))
2097 ++#define PLUS(x, y) ((x) + (y))
2098 ++#define PLUSONE(v) (PLUS((v), 1))
2100 ++#define U32TO8_LITTLE(p, v) \
2101 ++ { (p)[0] = (v >> 0) & 0xff; (p)[1] = (v >> 8) & 0xff; \
2102 ++ (p)[2] = (v >> 16) & 0xff; (p)[3] = (v >> 24) & 0xff; }
2103 ++#define U8TO32_LITTLE(p) \
2104 ++ (((uint32_t)((p)[0]) ) | ((uint32_t)((p)[1]) << 8) | \
2105 ++ ((uint32_t)((p)[2]) << 16) | ((uint32_t)((p)[3]) << 24) )
2107 ++/* QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round. */
2108 ++#define QUARTERROUND(a,b,c,d) \
2109 ++ x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]),16); \
2110 ++ x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]),12); \
2111 ++ x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]), 8); \
2112 ++ x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]), 7);
2114 ++typedef unsigned int uint32_t;
2116 ++/* chacha_core performs |num_rounds| rounds of ChaCha20 on the input words in
2117 ++ * |input| and writes the 64 output bytes to |output|. */
2118 ++static void chacha_core(unsigned char output[64], const uint32_t input[16],
2124 ++ memcpy(x, input, sizeof(uint32_t) * 16);
2125 ++ for (i = 20; i > 0; i -= 2)
2127 ++ QUARTERROUND( 0, 4, 8,12)
2128 ++ QUARTERROUND( 1, 5, 9,13)
2129 ++ QUARTERROUND( 2, 6,10,14)
2130 ++ QUARTERROUND( 3, 7,11,15)
2131 ++ QUARTERROUND( 0, 5,10,15)
2132 ++ QUARTERROUND( 1, 6,11,12)
2133 ++ QUARTERROUND( 2, 7, 8,13)
2134 ++ QUARTERROUND( 3, 4, 9,14)
2137 ++ for (i = 0; i < 16; ++i)
2138 ++ x[i] = PLUS(x[i], input[i]);
2139 ++ for (i = 0; i < 16; ++i)
2140 ++ U32TO8_LITTLE(output + 4 * i, x[i]);
2143 ++void CRYPTO_chacha_20(unsigned char *out,
2144 ++ const unsigned char *in, size_t in_len,
2145 ++ const unsigned char key[32],
2146 ++ const unsigned char nonce[8],
2149 ++ uint32_t input[16];
2150 ++ unsigned char buf[64];
2153 ++ input[0] = U8TO32_LITTLE(sigma + 0);
2154 ++ input[1] = U8TO32_LITTLE(sigma + 4);
2155 ++ input[2] = U8TO32_LITTLE(sigma + 8);
2156 ++ input[3] = U8TO32_LITTLE(sigma + 12);
2158 ++ input[4] = U8TO32_LITTLE(key + 0);
2159 ++ input[5] = U8TO32_LITTLE(key + 4);
2160 ++ input[6] = U8TO32_LITTLE(key + 8);
2161 ++ input[7] = U8TO32_LITTLE(key + 12);
2163 ++ input[8] = U8TO32_LITTLE(key + 16);
2164 ++ input[9] = U8TO32_LITTLE(key + 20);
2165 ++ input[10] = U8TO32_LITTLE(key + 24);
2166 ++ input[11] = U8TO32_LITTLE(key + 28);
2168 ++ input[12] = counter;
2169 ++ input[13] = ((uint64_t) counter) >> 32;
2170 ++ input[14] = U8TO32_LITTLE(nonce + 0);
2171 ++ input[15] = U8TO32_LITTLE(nonce + 4);
2173 ++ while (in_len > 0)
2175 ++ todo = sizeof(buf);
2176 ++ if (in_len < todo)
2179 ++ chacha_core(buf, input, 20);
2180 ++ for (i = 0; i < todo; i++)
2181 ++ out[i] = in[i] ^ buf[i];
2188 ++ if (input[12] == 0)
2193 ++#endif /* !OPENSSL_NO_CHACHA */
2194 +diff --git a/crypto/chacha/chacha_vec.c b/crypto/chacha/chacha_vec.c
2195 +new file mode 100644
2196 +index 0000000..33b2238
2198 ++++ b/crypto/chacha/chacha_vec.c
2200 ++/* ====================================================================
2201 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
2203 ++ * Redistribution and use in source and binary forms, with or without
2204 ++ * modification, are permitted provided that the following conditions
2207 ++ * 1. Redistributions of source code must retain the above copyright
2208 ++ * notice, this list of conditions and the following disclaimer.
2210 ++ * 2. Redistributions in binary form must reproduce the above copyright
2211 ++ * notice, this list of conditions and the following disclaimer in
2212 ++ * the documentation and/or other materials provided with the
2215 ++ * 3. All advertising materials mentioning features or use of this
2216 ++ * software must display the following acknowledgment:
2217 ++ * "This product includes software developed by the OpenSSL Project
2218 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
2220 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
2221 ++ * endorse or promote products derived from this software without
2222 ++ * prior written permission. For written permission, please contact
2223 ++ * licensing@OpenSSL.org.
2225 ++ * 5. Products derived from this software may not be called "OpenSSL"
2226 ++ * nor may "OpenSSL" appear in their names without prior written
2227 ++ * permission of the OpenSSL Project.
2229 ++ * 6. Redistributions of any form whatsoever must retain the following
2230 ++ * acknowledgment:
2231 ++ * "This product includes software developed by the OpenSSL Project
2232 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
2234 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
2235 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2236 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
2237 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
2238 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
2239 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2240 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
2241 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2242 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2243 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2244 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2245 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
2246 ++ * ====================================================================
2249 ++/* This implementation is by Ted Krovetz and was submitted to SUPERCOP and
2250 ++ * marked as public domain. It was been altered to allow for non-aligned inputs
2251 ++ * and to allow the block counter to be passed in specifically. */
2253 ++#include <string.h>
2254 ++#include <stdint.h>
2255 ++#include <openssl/opensslconf.h>
2257 ++#if !defined(OPENSSL_NO_CHACHA)
2259 ++#include <openssl/chacha.h>
2261 ++#ifndef CHACHA_RNDS
2262 ++#define CHACHA_RNDS 20 /* 8 (high speed), 20 (conservative), 12 (middle) */
2265 ++/* Architecture-neutral way to specify 16-byte vector of ints */
2266 ++typedef unsigned vec __attribute__ ((vector_size (16)));
2268 ++/* This implementation is designed for Neon, SSE and AltiVec machines. The
2269 ++ * following specify how to do certain vector operations efficiently on
2270 ++ * each architecture, using intrinsics.
2271 ++ * This implementation supports parallel processing of multiple blocks,
2272 ++ * including potentially using general-purpose registers.
2275 ++#include <arm_neon.h>
2278 ++#define ONE (vec)vsetq_lane_u32(1,vdupq_n_u32(0),0)
2279 ++#define LOAD(m) (vec)(*((vec*)(m)))
2280 ++#define STORE(m,r) (*((vec*)(m))) = (r)
2281 ++#define ROTV1(x) (vec)vextq_u32((uint32x4_t)x,(uint32x4_t)x,1)
2282 ++#define ROTV2(x) (vec)vextq_u32((uint32x4_t)x,(uint32x4_t)x,2)
2283 ++#define ROTV3(x) (vec)vextq_u32((uint32x4_t)x,(uint32x4_t)x,3)
2284 ++#define ROTW16(x) (vec)vrev32q_u16((uint16x8_t)x)
2286 ++#define ROTW7(x) (x << ((vec){ 7, 7, 7, 7})) ^ (x >> ((vec){25,25,25,25}))
2287 ++#define ROTW8(x) (x << ((vec){ 8, 8, 8, 8})) ^ (x >> ((vec){24,24,24,24}))
2288 ++#define ROTW12(x) (x << ((vec){12,12,12,12})) ^ (x >> ((vec){20,20,20,20}))
2290 ++#define ROTW7(x) (vec)vsriq_n_u32(vshlq_n_u32((uint32x4_t)x,7),(uint32x4_t)x,25)
2291 ++#define ROTW8(x) (vec)vsriq_n_u32(vshlq_n_u32((uint32x4_t)x,8),(uint32x4_t)x,24)
2292 ++#define ROTW12(x) (vec)vsriq_n_u32(vshlq_n_u32((uint32x4_t)x,12),(uint32x4_t)x,20)
2295 ++#include <emmintrin.h>
2302 ++#define ONE (vec)_mm_set_epi32(0,0,0,1)
2303 ++#define LOAD(m) (vec)_mm_loadu_si128((__m128i*)(m))
2304 ++#define STORE(m,r) _mm_storeu_si128((__m128i*)(m), (__m128i) (r))
2305 ++#define ROTV1(x) (vec)_mm_shuffle_epi32((__m128i)x,_MM_SHUFFLE(0,3,2,1))
2306 ++#define ROTV2(x) (vec)_mm_shuffle_epi32((__m128i)x,_MM_SHUFFLE(1,0,3,2))
2307 ++#define ROTV3(x) (vec)_mm_shuffle_epi32((__m128i)x,_MM_SHUFFLE(2,1,0,3))
2308 ++#define ROTW7(x) (vec)(_mm_slli_epi32((__m128i)x, 7) ^ _mm_srli_epi32((__m128i)x,25))
2309 ++#define ROTW12(x) (vec)(_mm_slli_epi32((__m128i)x,12) ^ _mm_srli_epi32((__m128i)x,20))
2311 ++#include <tmmintrin.h>
2312 ++#define ROTW8(x) (vec)_mm_shuffle_epi8((__m128i)x,_mm_set_epi8(14,13,12,15,10,9,8,11,6,5,4,7,2,1,0,3))
2313 ++#define ROTW16(x) (vec)_mm_shuffle_epi8((__m128i)x,_mm_set_epi8(13,12,15,14,9,8,11,10,5,4,7,6,1,0,3,2))
2315 ++#define ROTW8(x) (vec)(_mm_slli_epi32((__m128i)x, 8) ^ _mm_srli_epi32((__m128i)x,24))
2316 ++#define ROTW16(x) (vec)(_mm_slli_epi32((__m128i)x,16) ^ _mm_srli_epi32((__m128i)x,16))
2319 ++#error -- Implementation supports only machines with neon or SSE2
2323 ++#define REVV_BE(x) (x)
2327 ++#define REVW_BE(x) (x)
2330 ++#define BPI (VBPI + GPR_TOO) /* Blocks computed per loop iteration */
2332 ++#define DQROUND_VECTORS(a,b,c,d) \
2333 ++ a += b; d ^= a; d = ROTW16(d); \
2334 ++ c += d; b ^= c; b = ROTW12(b); \
2335 ++ a += b; d ^= a; d = ROTW8(d); \
2336 ++ c += d; b ^= c; b = ROTW7(b); \
2337 ++ b = ROTV1(b); c = ROTV2(c); d = ROTV3(d); \
2338 ++ a += b; d ^= a; d = ROTW16(d); \
2339 ++ c += d; b ^= c; b = ROTW12(b); \
2340 ++ a += b; d ^= a; d = ROTW8(d); \
2341 ++ c += d; b ^= c; b = ROTW7(b); \
2342 ++ b = ROTV3(b); c = ROTV2(c); d = ROTV1(d);
2344 ++#define QROUND_WORDS(a,b,c,d) \
2345 ++ a = a+b; d ^= a; d = d<<16 | d>>16; \
2346 ++ c = c+d; b ^= c; b = b<<12 | b>>20; \
2347 ++ a = a+b; d ^= a; d = d<< 8 | d>>24; \
2348 ++ c = c+d; b ^= c; b = b<< 7 | b>>25;
2350 ++#define WRITE_XOR(in, op, d, v0, v1, v2, v3) \
2351 ++ STORE(op + d + 0, LOAD(in + d + 0) ^ REVV_BE(v0)); \
2352 ++ STORE(op + d + 4, LOAD(in + d + 4) ^ REVV_BE(v1)); \
2353 ++ STORE(op + d + 8, LOAD(in + d + 8) ^ REVV_BE(v2)); \
2354 ++ STORE(op + d +12, LOAD(in + d +12) ^ REVV_BE(v3));
2356 ++void CRYPTO_chacha_20(
2357 ++ unsigned char *out,
2358 ++ const unsigned char *in,
2360 ++ const unsigned char key[32],
2361 ++ const unsigned char nonce[8],
2364 ++ unsigned iters, i, *op=(unsigned *)out, *ip=(unsigned *)in, *kp;
2365 ++#if defined(__ARM_NEON__)
2368 ++ vec s0, s1, s2, s3;
2369 ++#if !defined(__ARM_NEON__) && !defined(__SSE2__)
2370 ++ __attribute__ ((aligned (16))) unsigned key[8], nonce[4];
2372 ++ __attribute__ ((aligned (16))) unsigned chacha_const[] =
2373 ++ {0x61707865,0x3320646E,0x79622D32,0x6B206574};
2374 ++#if defined(__ARM_NEON__) || defined(__SSE2__)
2375 ++ kp = (unsigned *)key;
2377 ++ ((vec *)key)[0] = REVV_BE(((vec *)key)[0]);
2378 ++ ((vec *)key)[1] = REVV_BE(((vec *)key)[1]);
2379 ++ nonce[0] = REVW_BE(((unsigned *)nonce)[0]);
2380 ++ nonce[1] = REVW_BE(((unsigned *)nonce)[1]);
2381 ++ nonce[2] = REVW_BE(((unsigned *)nonce)[2]);
2382 ++ nonce[3] = REVW_BE(((unsigned *)nonce)[3]);
2383 ++ kp = (unsigned *)key;
2384 ++ np = (unsigned *)nonce;
2386 ++#if defined(__ARM_NEON__)
2387 ++ np = (unsigned*) nonce;
2389 ++ s0 = LOAD(chacha_const);
2390 ++ s1 = LOAD(&((vec*)kp)[0]);
2391 ++ s2 = LOAD(&((vec*)kp)[1]);
2393 ++ counter & 0xffffffff,
2395 ++ 0, /* can't right-shift 32 bits on a 32-bit system. */
2399 ++ ((uint32_t*)nonce)[0],
2400 ++ ((uint32_t*)nonce)[1]
2403 ++ for (iters = 0; iters < inlen/(BPI*64); iters++)
2406 ++ register unsigned x0, x1, x2, x3, x4, x5, x6, x7, x8,
2407 ++ x9, x10, x11, x12, x13, x14, x15;
2410 ++ vec v8,v9,v10,v11;
2413 ++ vec v12,v13,v14,v15;
2416 ++ vec v0,v1,v2,v3,v4,v5,v6,v7;
2417 ++ v4 = v0 = s0; v5 = v1 = s1; v6 = v2 = s2; v3 = s3;
2420 ++ v8 = v4; v9 = v5; v10 = v6;
2424 ++ v12 = v8; v13 = v9; v14 = v10;
2428 ++ x0 = chacha_const[0]; x1 = chacha_const[1];
2429 ++ x2 = chacha_const[2]; x3 = chacha_const[3];
2430 ++ x4 = kp[0]; x5 = kp[1]; x6 = kp[2]; x7 = kp[3];
2431 ++ x8 = kp[4]; x9 = kp[5]; x10 = kp[6]; x11 = kp[7];
2432 ++ x12 = counter+BPI*iters+(BPI-1); x13 = 0;
2433 ++ x14 = np[0]; x15 = np[1];
2435 ++ for (i = CHACHA_RNDS/2; i; i--)
2437 ++ DQROUND_VECTORS(v0,v1,v2,v3)
2438 ++ DQROUND_VECTORS(v4,v5,v6,v7)
2440 ++ DQROUND_VECTORS(v8,v9,v10,v11)
2443 ++ DQROUND_VECTORS(v12,v13,v14,v15)
2446 ++ QROUND_WORDS( x0, x4, x8,x12)
2447 ++ QROUND_WORDS( x1, x5, x9,x13)
2448 ++ QROUND_WORDS( x2, x6,x10,x14)
2449 ++ QROUND_WORDS( x3, x7,x11,x15)
2450 ++ QROUND_WORDS( x0, x5,x10,x15)
2451 ++ QROUND_WORDS( x1, x6,x11,x12)
2452 ++ QROUND_WORDS( x2, x7, x8,x13)
2453 ++ QROUND_WORDS( x3, x4, x9,x14)
2457 ++ WRITE_XOR(ip, op, 0, v0+s0, v1+s1, v2+s2, v3+s3)
2459 ++ WRITE_XOR(ip, op, 16, v4+s0, v5+s1, v6+s2, v7+s3)
2462 ++ WRITE_XOR(ip, op, 32, v8+s0, v9+s1, v10+s2, v11+s3)
2466 ++ WRITE_XOR(ip, op, 48, v12+s0, v13+s1, v14+s2, v15+s3)
2472 ++ op[0] = REVW_BE(REVW_BE(ip[0]) ^ (x0 + chacha_const[0]));
2473 ++ op[1] = REVW_BE(REVW_BE(ip[1]) ^ (x1 + chacha_const[1]));
2474 ++ op[2] = REVW_BE(REVW_BE(ip[2]) ^ (x2 + chacha_const[2]));
2475 ++ op[3] = REVW_BE(REVW_BE(ip[3]) ^ (x3 + chacha_const[3]));
2476 ++ op[4] = REVW_BE(REVW_BE(ip[4]) ^ (x4 + kp[0]));
2477 ++ op[5] = REVW_BE(REVW_BE(ip[5]) ^ (x5 + kp[1]));
2478 ++ op[6] = REVW_BE(REVW_BE(ip[6]) ^ (x6 + kp[2]));
2479 ++ op[7] = REVW_BE(REVW_BE(ip[7]) ^ (x7 + kp[3]));
2480 ++ op[8] = REVW_BE(REVW_BE(ip[8]) ^ (x8 + kp[4]));
2481 ++ op[9] = REVW_BE(REVW_BE(ip[9]) ^ (x9 + kp[5]));
2482 ++ op[10] = REVW_BE(REVW_BE(ip[10]) ^ (x10 + kp[6]));
2483 ++ op[11] = REVW_BE(REVW_BE(ip[11]) ^ (x11 + kp[7]));
2484 ++ op[12] = REVW_BE(REVW_BE(ip[12]) ^ (x12 + counter+BPI*iters+(BPI-1)));
2485 ++ op[13] = REVW_BE(REVW_BE(ip[13]) ^ (x13));
2486 ++ op[14] = REVW_BE(REVW_BE(ip[14]) ^ (x14 + np[0]));
2487 ++ op[15] = REVW_BE(REVW_BE(ip[15]) ^ (x15 + np[1]));
2494 ++ for (iters = inlen%(BPI*64)/64; iters != 0; iters--)
2496 ++ vec v0 = s0, v1 = s1, v2 = s2, v3 = s3;
2497 ++ for (i = CHACHA_RNDS/2; i; i--)
2499 ++ DQROUND_VECTORS(v0,v1,v2,v3);
2501 ++ WRITE_XOR(ip, op, 0, v0+s0, v1+s1, v2+s2, v3+s3)
2507 ++ inlen = inlen % 64;
2510 ++ __attribute__ ((aligned (16))) vec buf[4];
2512 ++ v0 = s0; v1 = s1; v2 = s2; v3 = s3;
2513 ++ for (i = CHACHA_RNDS/2; i; i--)
2515 ++ DQROUND_VECTORS(v0,v1,v2,v3);
2520 ++ STORE(op + 0, LOAD(ip + 0) ^ REVV_BE(v0 + s0));
2523 ++ STORE(op + 4, LOAD(ip + 4) ^ REVV_BE(v1 + s1));
2526 ++ STORE(op + 8, LOAD(ip + 8) ^
2527 ++ REVV_BE(v2 + s2));
2528 ++ buf[3] = REVV_BE(v3 + s3);
2531 ++ buf[2] = REVV_BE(v2 + s2);
2534 ++ buf[1] = REVV_BE(v1 + s1);
2537 ++ buf[0] = REVV_BE(v0 + s0);
2539 ++ for (i=inlen & ~15; i<inlen; i++)
2540 ++ ((char *)op)[i] = ((char *)ip)[i] ^ ((char *)buf)[i];
2544 ++#endif /* !OPENSSL_NO_CHACHA */
2545 +diff --git a/crypto/chacha/chachatest.c b/crypto/chacha/chachatest.c
2546 +new file mode 100644
2547 +index 0000000..b2a9389
2549 ++++ b/crypto/chacha/chachatest.c
2552 ++ * Chacha stream algorithm.
2554 ++ * Created on: Jun, 2013
2555 ++ * Author: Elie Bursztein (elieb@google.com)
2557 ++ * Adapted from the estream code by D. Bernstein.
2559 ++/* ====================================================================
2560 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
2562 ++ * Redistribution and use in source and binary forms, with or without
2563 ++ * modification, are permitted provided that the following conditions
2566 ++ * 1. Redistributions of source code must retain the above copyright
2567 ++ * notice, this list of conditions and the following disclaimer.
2569 ++ * 2. Redistributions in binary form must reproduce the above copyright
2570 ++ * notice, this list of conditions and the following disclaimer in
2571 ++ * the documentation and/or other materials provided with the
2574 ++ * 3. All advertising materials mentioning features or use of this
2575 ++ * software must display the following acknowledgment:
2576 ++ * "This product includes software developed by the OpenSSL Project
2577 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
2579 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
2580 ++ * endorse or promote products derived from this software without
2581 ++ * prior written permission. For written permission, please contact
2582 ++ * licensing@OpenSSL.org.
2584 ++ * 5. Products derived from this software may not be called "OpenSSL"
2585 ++ * nor may "OpenSSL" appear in their names without prior written
2586 ++ * permission of the OpenSSL Project.
2588 ++ * 6. Redistributions of any form whatsoever must retain the following
2589 ++ * acknowledgment:
2590 ++ * "This product includes software developed by the OpenSSL Project
2591 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
2593 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
2594 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2595 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
2596 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
2597 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
2598 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2599 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
2600 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2601 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2602 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2603 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2604 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
2605 ++ * ====================================================================
2608 ++#include <stdio.h>
2609 ++#include <stdlib.h>
2610 ++#include <string.h>
2611 ++#include <stdint.h>
2613 ++#include <openssl/chacha.h>
2615 ++struct chacha_test {
2616 ++ const char *keyhex;
2617 ++ const char *noncehex;
2618 ++ const char *outhex;
2621 ++static const struct chacha_test chacha_tests[] = {
2623 ++ "0000000000000000000000000000000000000000000000000000000000000000",
2624 ++ "0000000000000000",
2625 ++ "76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586",
2628 ++ "0000000000000000000000000000000000000000000000000000000000000001",
2629 ++ "0000000000000000",
2630 ++ "4540f05a9f1fb296d7736e7b208e3c96eb4fe1834688d2604f450952ed432d41bbe2a0b6ea7566d2a5d1e7e20d42af2c53d792b1c43fea817e9ad275ae546963",
2633 ++ "0000000000000000000000000000000000000000000000000000000000000000",
2634 ++ "0000000000000001",
2635 ++ "de9cba7bf3d69ef5e786dc63973f653a0b49e015adbff7134fcb7df137821031e85a050278a7084527214f73efc7fa5b5277062eb7a0433e445f41e31afab757",
2638 ++ "0000000000000000000000000000000000000000000000000000000000000000",
2639 ++ "0100000000000000",
2640 ++ "ef3fdfd6c61578fbf5cf35bd3dd33b8009631634d21e42ac33960bd138e50d32111e4caf237ee53ca8ad6426194a88545ddc497a0b466e7d6bbdb0041b2f586b",
2643 ++ "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
2644 ++ "0001020304050607",
2645 ++ "f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2be8241a38008b9a26bc35941e2444177c8ade6689de95264986d95889fb60e84629c9bd9a5acb1cc118be563eb9b3a4a472f82e09a7e778492b562ef7130e88dfe031c79db9d4f7c7a899151b9a475032b63fc385245fe054e3dd5a97a5f576fe064025d3ce042c566ab2c507b138db853e3d6959660996546cc9c4a6eafdc777c040d70eaf46f76dad3979e5c5360c3317166a1c894c94a371876a94df7628fe4eaaf2ccb27d5aaae0ad7ad0f9d4b6ad3b54098746d4524d38407a6deb",
2649 ++static unsigned char hex_digit(char h)
2651 ++ if (h >= '0' && h <= '9')
2653 ++ else if (h >= 'a' && h <= 'f')
2654 ++ return h - 'a' + 10;
2655 ++ else if (h >= 'A' && h <= 'F')
2656 ++ return h - 'A' + 10;
2661 ++static void hex_decode(unsigned char *out, const char* hex)
2665 ++ while (*hex != 0)
2667 ++ unsigned char v = hex_digit(*hex++);
2669 ++ v |= hex_digit(*hex++);
2674 ++static void hexdump(unsigned char *a, size_t len)
2678 ++ for (i = 0; i < len; i++)
2679 ++ printf("%02x", a[i]);
2682 ++/* misalign returns a pointer that points 0 to 15 bytes into |in| such that the
2683 ++ * returned pointer has alignment 1 mod 16. */
2684 ++static void* misalign(void* in)
2686 ++ intptr_t x = (intptr_t) in;
2687 ++ x += (17 - (x % 16)) % 16;
2688 ++ return (void*) x;
2693 ++ static const unsigned num_tests =
2694 ++ sizeof(chacha_tests) / sizeof(struct chacha_test);
2696 ++ unsigned char key_bytes[32 + 16];
2697 ++ unsigned char nonce_bytes[8 + 16] = {0};
2699 ++ unsigned char *key = misalign(key_bytes);
2700 ++ unsigned char *nonce = misalign(nonce_bytes);
2702 ++ for (i = 0; i < num_tests; i++)
2704 ++ const struct chacha_test *test = &chacha_tests[i];
2705 ++ unsigned char *expected, *out_bytes, *zero_bytes, *out, *zeros;
2706 ++ size_t len = strlen(test->outhex);
2708 ++ if (strlen(test->keyhex) != 32*2 ||
2709 ++ strlen(test->noncehex) != 8*2 ||
2715 ++ hex_decode(key, test->keyhex);
2716 ++ hex_decode(nonce, test->noncehex);
2718 ++ expected = malloc(len);
2719 ++ out_bytes = malloc(len+16);
2720 ++ zero_bytes = malloc(len+16);
2721 ++ /* Attempt to test unaligned inputs. */
2722 ++ out = misalign(out_bytes);
2723 ++ zeros = misalign(zero_bytes);
2724 ++ memset(zeros, 0, len);
2726 ++ hex_decode(expected, test->outhex);
2727 ++ CRYPTO_chacha_20(out, zeros, len, key, nonce, 0);
2729 ++ if (memcmp(out, expected, len) != 0)
2731 ++ printf("ChaCha20 test #%d failed.\n", i);
2733 ++ hexdump(out, len);
2734 ++ printf("\nexpected: ");
2735 ++ hexdump(expected, len);
2740 ++ /* The last test has a large output. We test whether the
2741 ++ * counter works as expected by skipping the first 64 bytes of
2743 ++ if (i == num_tests - 1)
2745 ++ CRYPTO_chacha_20(out, zeros, len - 64, key, nonce, 1);
2746 ++ if (memcmp(out, expected + 64, len - 64) != 0)
2748 ++ printf("ChaCha20 skip test failed.\n");
2754 ++ free(zero_bytes);
2759 ++ printf("PASS\n");
2762 +diff --git a/crypto/evp/Makefile b/crypto/evp/Makefile
2763 +index b73038d..86b0504 100644
2764 +--- a/crypto/evp/Makefile
2765 ++++ b/crypto/evp/Makefile
2766 +@@ -29,7 +29,8 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c evp_acnf.c evp_cnf.c \
2767 + c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
2768 + evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
2769 + e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c \
2770 +- e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c evp_aead.c
2771 ++ e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c evp_aead.c \
2772 ++ e_chacha20poly1305.c
2774 + LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
2775 + e_des.o e_bf.o e_idea.o e_des3.o e_camellia.o\
2776 +@@ -42,7 +43,7 @@ LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
2777 + c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
2778 + evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
2779 + e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o \
2780 +- e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o evp_aead.o
2781 ++ e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o evp_aead.o e_chacha20poly1305.o
2785 +@@ -239,6 +240,21 @@ e_cast.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
2786 + e_cast.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
2787 + e_cast.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
2788 + e_cast.o: ../../include/openssl/symhacks.h ../cryptlib.h e_cast.c evp_locl.h
2789 ++e_chacha20poly1305.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
2790 ++e_chacha20poly1305.o: ../../include/openssl/chacha.h
2791 ++e_chacha20poly1305.o: ../../include/openssl/crypto.h
2792 ++e_chacha20poly1305.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
2793 ++e_chacha20poly1305.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
2794 ++e_chacha20poly1305.o: ../../include/openssl/obj_mac.h
2795 ++e_chacha20poly1305.o: ../../include/openssl/objects.h
2796 ++e_chacha20poly1305.o: ../../include/openssl/opensslconf.h
2797 ++e_chacha20poly1305.o: ../../include/openssl/opensslv.h
2798 ++e_chacha20poly1305.o: ../../include/openssl/ossl_typ.h
2799 ++e_chacha20poly1305.o: ../../include/openssl/poly1305.h
2800 ++e_chacha20poly1305.o: ../../include/openssl/safestack.h
2801 ++e_chacha20poly1305.o: ../../include/openssl/stack.h
2802 ++e_chacha20poly1305.o: ../../include/openssl/symhacks.h e_chacha20poly1305.c
2803 ++e_chacha20poly1305.o: evp_locl.h
2804 + e_des.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
2805 + e_des.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
2806 + e_des.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
2807 +@@ -258,9 +274,10 @@ e_des3.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
2808 + e_des3.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
2809 + e_des3.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
2810 + e_des3.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
2811 +-e_des3.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
2812 +-e_des3.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
2813 +-e_des3.o: ../../include/openssl/ui_compat.h ../cryptlib.h e_des3.c evp_locl.h
2814 ++e_des3.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
2815 ++e_des3.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
2816 ++e_des3.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
2817 ++e_des3.o: ../cryptlib.h e_des3.c evp_locl.h
2818 + e_idea.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
2819 + e_idea.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
2820 + e_idea.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
2821 +@@ -356,6 +373,14 @@ evp_acnf.o: ../../include/openssl/opensslconf.h
2822 + evp_acnf.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
2823 + evp_acnf.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
2824 + evp_acnf.o: ../../include/openssl/symhacks.h ../cryptlib.h evp_acnf.c
2825 ++evp_aead.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
2826 ++evp_aead.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
2827 ++evp_aead.o: ../../include/openssl/err.h ../../include/openssl/evp.h
2828 ++evp_aead.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
2829 ++evp_aead.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
2830 ++evp_aead.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
2831 ++evp_aead.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
2832 ++evp_aead.o: ../../include/openssl/symhacks.h evp_aead.c
2833 + evp_cnf.o: ../../e_os.h ../../include/openssl/asn1.h
2834 + evp_cnf.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
2835 + evp_cnf.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
2836 +diff --git a/crypto/evp/e_chacha20poly1305.c b/crypto/evp/e_chacha20poly1305.c
2837 +new file mode 100644
2838 +index 0000000..1c0c0fb
2840 ++++ b/crypto/evp/e_chacha20poly1305.c
2842 ++/* ====================================================================
2843 ++ * Copyright (c) 2013 The OpenSSL Project. All rights reserved.
2845 ++ * Redistribution and use in source and binary forms, with or without
2846 ++ * modification, are permitted provided that the following conditions
2849 ++ * 1. Redistributions of source code must retain the above copyright
2850 ++ * notice, this list of conditions and the following disclaimer.
2852 ++ * 2. Redistributions in binary form must reproduce the above copyright
2853 ++ * notice, this list of conditions and the following disclaimer in
2854 ++ * the documentation and/or other materials provided with the
2857 ++ * 3. All advertising materials mentioning features or use of this
2858 ++ * software must display the following acknowledgment:
2859 ++ * "This product includes software developed by the OpenSSL Project
2860 ++ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
2862 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
2863 ++ * endorse or promote products derived from this software without
2864 ++ * prior written permission. For written permission, please contact
2865 ++ * openssl-core@openssl.org.
2867 ++ * 5. Products derived from this software may not be called "OpenSSL"
2868 ++ * nor may "OpenSSL" appear in their names without prior written
2869 ++ * permission of the OpenSSL Project.
2871 ++ * 6. Redistributions of any form whatsoever must retain the following
2872 ++ * acknowledgment:
2873 ++ * "This product includes software developed by the OpenSSL Project
2874 ++ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
2876 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
2877 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2878 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
2879 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
2880 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
2881 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2882 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
2883 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2884 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2885 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2886 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2887 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
2888 ++ * ====================================================================
2892 ++#include <stdint.h>
2893 ++#include <string.h>
2894 ++#include <openssl/opensslconf.h>
2896 ++#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
2898 ++#include <openssl/chacha.h>
2899 ++#include <openssl/poly1305.h>
2900 ++#include <openssl/evp.h>
2901 ++#include <openssl/err.h>
2902 ++#include "evp_locl.h"
2904 ++#define POLY1305_TAG_LEN 16
2905 ++#define CHACHA20_NONCE_LEN 8
2907 ++struct aead_chacha20_poly1305_ctx
2909 ++ unsigned char key[32];
2910 ++ unsigned char tag_len;
2913 ++static int aead_chacha20_poly1305_init(EVP_AEAD_CTX *ctx, const unsigned char *key, size_t key_len, size_t tag_len)
2915 ++ struct aead_chacha20_poly1305_ctx *c20_ctx;
2917 ++ if (tag_len == 0)
2918 ++ tag_len = POLY1305_TAG_LEN;
2920 ++ if (tag_len > POLY1305_TAG_LEN)
2922 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_INIT, EVP_R_TOO_LARGE);
2926 ++ if (key_len != sizeof(c20_ctx->key))
2927 ++ return 0; /* internal error - EVP_AEAD_CTX_init should catch this. */
2929 ++ c20_ctx = OPENSSL_malloc(sizeof(struct aead_chacha20_poly1305_ctx));
2930 ++ if (c20_ctx == NULL)
2933 ++ memcpy(&c20_ctx->key[0], key, key_len);
2934 ++ c20_ctx->tag_len = tag_len;
2935 ++ ctx->aead_state = c20_ctx;
2940 ++static void aead_chacha20_poly1305_cleanup(EVP_AEAD_CTX *ctx)
2942 ++ struct aead_chacha20_poly1305_ctx *c20_ctx = ctx->aead_state;
2943 ++ OPENSSL_cleanse(c20_ctx->key, sizeof(c20_ctx->key));
2944 ++ OPENSSL_free(c20_ctx);
2947 ++static void poly1305_update_with_length(poly1305_state *poly1305,
2948 ++ const unsigned char *data, size_t data_len)
2950 ++ size_t j = data_len;
2951 ++ unsigned char length_bytes[8];
2954 ++ for (i = 0; i < sizeof(length_bytes); i++)
2956 ++ length_bytes[i] = j;
2960 ++ CRYPTO_poly1305_update(poly1305, data, data_len);
2961 ++ CRYPTO_poly1305_update(poly1305, length_bytes, sizeof(length_bytes));
2965 ++#define ALIGNED __attribute__((aligned(16)))
2970 ++static ssize_t aead_chacha20_poly1305_seal(const EVP_AEAD_CTX *ctx,
2971 ++ unsigned char *out, size_t max_out_len,
2972 ++ const unsigned char *nonce, size_t nonce_len,
2973 ++ const unsigned char *in, size_t in_len,
2974 ++ const unsigned char *ad, size_t ad_len)
2976 ++ const struct aead_chacha20_poly1305_ctx *c20_ctx = ctx->aead_state;
2977 ++ unsigned char poly1305_key[32] ALIGNED;
2978 ++ poly1305_state poly1305;
2979 ++ const uint64_t in_len_64 = in_len;
2981 ++ /* The underlying ChaCha implementation may not overflow the block
2982 ++ * counter into the second counter word. Therefore we disallow
2983 ++ * individual operations that work on more than 2TB at a time.
2984 ++ * |in_len_64| is needed because, on 32-bit platforms, size_t is only
2985 ++ * 32-bits and this produces a warning because it's always false.
2986 ++ * Casting to uint64_t inside the conditional is not sufficient to stop
2987 ++ * the warning. */
2988 ++ if (in_len_64 >= (1ull << 32)*64-64)
2990 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_SEAL, EVP_R_TOO_LARGE);
2994 ++ if (max_out_len < in_len + c20_ctx->tag_len)
2996 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_SEAL, EVP_R_BUFFER_TOO_SMALL);
3000 ++ if (nonce_len != CHACHA20_NONCE_LEN)
3002 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_SEAL, EVP_R_IV_TOO_LARGE);
3006 ++ memset(poly1305_key, 0, sizeof(poly1305_key));
3007 ++ CRYPTO_chacha_20(poly1305_key, poly1305_key, sizeof(poly1305_key), c20_ctx->key, nonce, 0);
3009 ++ CRYPTO_poly1305_init(&poly1305, poly1305_key);
3010 ++ poly1305_update_with_length(&poly1305, ad, ad_len);
3011 ++ CRYPTO_chacha_20(out, in, in_len, c20_ctx->key, nonce, 1);
3012 ++ poly1305_update_with_length(&poly1305, out, in_len);
3014 ++ if (c20_ctx->tag_len != POLY1305_TAG_LEN)
3016 ++ unsigned char tag[POLY1305_TAG_LEN];
3017 ++ CRYPTO_poly1305_finish(&poly1305, tag);
3018 ++ memcpy(out + in_len, tag, c20_ctx->tag_len);
3019 ++ return in_len + c20_ctx->tag_len;
3022 ++ CRYPTO_poly1305_finish(&poly1305, out + in_len);
3023 ++ return in_len + POLY1305_TAG_LEN;
3026 ++static ssize_t aead_chacha20_poly1305_open(const EVP_AEAD_CTX *ctx,
3027 ++ unsigned char *out, size_t max_out_len,
3028 ++ const unsigned char *nonce, size_t nonce_len,
3029 ++ const unsigned char *in, size_t in_len,
3030 ++ const unsigned char *ad, size_t ad_len)
3032 ++ const struct aead_chacha20_poly1305_ctx *c20_ctx = ctx->aead_state;
3033 ++ unsigned char mac[POLY1305_TAG_LEN];
3034 ++ unsigned char poly1305_key[32] ALIGNED;
3036 ++ poly1305_state poly1305;
3037 ++ const uint64_t in_len_64 = in_len;
3039 ++ if (in_len < c20_ctx->tag_len)
3041 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_OPEN, EVP_R_BAD_DECRYPT);
3045 ++ /* The underlying ChaCha implementation may not overflow the block
3046 ++ * counter into the second counter word. Therefore we disallow
3047 ++ * individual operations that work on more than 2TB at a time.
3048 ++ * |in_len_64| is needed because, on 32-bit platforms, size_t is only
3049 ++ * 32-bits and this produces a warning because it's always false.
3050 ++ * Casting to uint64_t inside the conditional is not sufficient to stop
3051 ++ * the warning. */
3052 ++ if (in_len_64 >= (1ull << 32)*64-64)
3054 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_SEAL, EVP_R_TOO_LARGE);
3058 ++ if (nonce_len != CHACHA20_NONCE_LEN)
3060 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_OPEN, EVP_R_IV_TOO_LARGE);
3064 ++ out_len = in_len - c20_ctx->tag_len;
3066 ++ if (max_out_len < out_len)
3068 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_OPEN, EVP_R_BUFFER_TOO_SMALL);
3072 ++ memset(poly1305_key, 0, sizeof(poly1305_key));
3073 ++ CRYPTO_chacha_20(poly1305_key, poly1305_key, sizeof(poly1305_key), c20_ctx->key, nonce, 0);
3075 ++ CRYPTO_poly1305_init(&poly1305, poly1305_key);
3076 ++ poly1305_update_with_length(&poly1305, ad, ad_len);
3077 ++ poly1305_update_with_length(&poly1305, in, out_len);
3078 ++ CRYPTO_poly1305_finish(&poly1305, mac);
3080 ++ if (CRYPTO_memcmp(mac, in + out_len, c20_ctx->tag_len) != 0)
3082 ++ EVPerr(EVP_F_AEAD_CHACHA20_POLY1305_OPEN, EVP_R_BAD_DECRYPT);
3086 ++ CRYPTO_chacha_20(out, in, out_len, c20_ctx->key, nonce, 1);
3090 ++static const EVP_AEAD aead_chacha20_poly1305 =
3092 ++ 32, /* key len */
3093 ++ CHACHA20_NONCE_LEN, /* nonce len */
3094 ++ POLY1305_TAG_LEN, /* overhead */
3095 ++ POLY1305_TAG_LEN, /* max tag length */
3097 ++ aead_chacha20_poly1305_init,
3098 ++ aead_chacha20_poly1305_cleanup,
3099 ++ aead_chacha20_poly1305_seal,
3100 ++ aead_chacha20_poly1305_open,
3103 ++const EVP_AEAD *EVP_aead_chacha20_poly1305()
3105 ++ return &aead_chacha20_poly1305;
3108 ++#endif /* !OPENSSL_NO_CHACHA && !OPENSSL_NO_POLY1305 */
3109 +diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h
3110 +index bd10642..7dc1656 100644
3111 +--- a/crypto/evp/evp.h
3112 ++++ b/crypto/evp/evp.h
3113 +@@ -1258,6 +1258,11 @@ typedef struct evp_aead_st EVP_AEAD;
3114 + const EVP_AEAD *EVP_aead_aes_128_gcm(void);
3117 ++#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
3118 ++/* EVP_aead_chacha20_poly1305 is ChaCha20 with a Poly1305 authenticator. */
3119 ++const EVP_AEAD *EVP_aead_chacha20_poly1305(void);
3122 + /* EVP_AEAD_key_length returns the length, in bytes, of the keys used by
3124 + size_t EVP_AEAD_key_length(const EVP_AEAD *aead);
3125 +@@ -1360,6 +1365,9 @@ void ERR_load_EVP_strings(void);
3126 + #define EVP_F_AEAD_AES_128_GCM_INIT 183
3127 + #define EVP_F_AEAD_AES_128_GCM_OPEN 181
3128 + #define EVP_F_AEAD_AES_128_GCM_SEAL 182
3129 ++#define EVP_F_AEAD_CHACHA20_POLY1305_INIT 187
3130 ++#define EVP_F_AEAD_CHACHA20_POLY1305_OPEN 184
3131 ++#define EVP_F_AEAD_CHACHA20_POLY1305_SEAL 183
3132 + #define EVP_F_AEAD_CTX_OPEN 185
3133 + #define EVP_F_AEAD_CTX_SEAL 186
3134 + #define EVP_F_AESNI_INIT_KEY 165
3135 +diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c
3136 +index c47969c..fb747e5 100644
3137 +--- a/crypto/evp/evp_err.c
3138 ++++ b/crypto/evp/evp_err.c
3139 +@@ -73,6 +73,9 @@ static ERR_STRING_DATA EVP_str_functs[]=
3140 + {ERR_FUNC(EVP_F_AEAD_AES_128_GCM_INIT), "AEAD_AES_128_GCM_INIT"},
3141 + {ERR_FUNC(EVP_F_AEAD_AES_128_GCM_OPEN), "AEAD_AES_128_GCM_OPEN"},
3142 + {ERR_FUNC(EVP_F_AEAD_AES_128_GCM_SEAL), "AEAD_AES_128_GCM_SEAL"},
3143 ++{ERR_FUNC(EVP_F_AEAD_CHACHA20_POLY1305_INIT), "AEAD_CHACHA20_POLY1305_INIT"},
3144 ++{ERR_FUNC(EVP_F_AEAD_CHACHA20_POLY1305_OPEN), "AEAD_CHACHA20_POLY1305_OPEN"},
3145 ++{ERR_FUNC(EVP_F_AEAD_CHACHA20_POLY1305_SEAL), "AEAD_CHACHA20_POLY1305_SEAL"},
3146 + {ERR_FUNC(EVP_F_AEAD_CTX_OPEN), "AEAD_CTX_OPEN"},
3147 + {ERR_FUNC(EVP_F_AEAD_CTX_SEAL), "AEAD_CTX_SEAL"},
3148 + {ERR_FUNC(EVP_F_AESNI_INIT_KEY), "AESNI_INIT_KEY"},
3149 +diff --git a/crypto/poly1305/Makefile b/crypto/poly1305/Makefile
3150 +new file mode 100644
3151 +index 0000000..397d7cd
3153 ++++ b/crypto/poly1305/Makefile
3156 ++# OpenSSL/crypto/poly1305/Makefile
3167 ++POLY1305=poly1305_vec.o
3169 ++CFLAGS= $(INCLUDES) $(CFLAG)
3170 ++ASFLAGS= $(INCLUDES) $(ASFLAG)
3171 ++AFLAGS= $(ASFLAGS)
3177 ++LIB=$(TOP)/libcrypto.a
3178 ++LIBSRC=poly1305_vec.c
3179 ++LIBOBJ=$(POLY1305)
3183 ++EXHEADER=poly1305.h
3184 ++HEADER= $(EXHEADER)
3186 ++ALL= $(GENERAL) $(SRC) $(HEADER)
3189 ++ (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
3194 ++ $(AR) $(LIB) $(LIBOBJ)
3195 ++ $(RANLIB) $(LIB) || echo Never mind.
3199 ++ $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
3202 ++ @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
3203 ++ @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
3204 ++ @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
3207 ++ @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
3208 ++ @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
3210 ++ (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
3211 ++ chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
3220 ++ lint -DLINT $(INCLUDES) $(SRC)>fluff
3223 ++ @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
3224 ++ $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
3227 ++ $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
3228 ++ mv -f Makefile.new $(MAKEFILE)
3231 ++ rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
3233 ++# DO NOT DELETE THIS LINE -- make depend depends on it.
3235 ++poly1305_vec.o: ../../include/openssl/poly1305.h poly1305_vec.c
3236 +diff --git a/crypto/poly1305/poly1305.c b/crypto/poly1305/poly1305.c
3237 +new file mode 100644
3238 +index 0000000..2e5621d
3240 ++++ b/crypto/poly1305/poly1305.c
3242 ++/* ====================================================================
3243 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
3245 ++ * Redistribution and use in source and binary forms, with or without
3246 ++ * modification, are permitted provided that the following conditions
3249 ++ * 1. Redistributions of source code must retain the above copyright
3250 ++ * notice, this list of conditions and the following disclaimer.
3252 ++ * 2. Redistributions in binary form must reproduce the above copyright
3253 ++ * notice, this list of conditions and the following disclaimer in
3254 ++ * the documentation and/or other materials provided with the
3257 ++ * 3. All advertising materials mentioning features or use of this
3258 ++ * software must display the following acknowledgment:
3259 ++ * "This product includes software developed by the OpenSSL Project
3260 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
3262 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
3263 ++ * endorse or promote products derived from this software without
3264 ++ * prior written permission. For written permission, please contact
3265 ++ * licensing@OpenSSL.org.
3267 ++ * 5. Products derived from this software may not be called "OpenSSL"
3268 ++ * nor may "OpenSSL" appear in their names without prior written
3269 ++ * permission of the OpenSSL Project.
3271 ++ * 6. Redistributions of any form whatsoever must retain the following
3272 ++ * acknowledgment:
3273 ++ * "This product includes software developed by the OpenSSL Project
3274 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
3276 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
3277 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3278 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
3279 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
3280 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
3281 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
3282 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
3283 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3284 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3285 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3286 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3287 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
3288 ++ * ====================================================================
3291 ++/* This implementation of poly1305 is by Andrew Moon
3292 ++ * (https://github.com/floodyberry/poly1305-donna) and released as public
3295 ++#include <string.h>
3296 ++#include <stdint.h>
3297 ++#include <openssl/opensslconf.h>
3299 ++#if !defined(OPENSSL_NO_POLY1305)
3301 ++#include <openssl/poly1305.h>
3302 ++#include <openssl/crypto.h>
3304 ++#if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
3305 ++/* We can assume little-endian. */
3306 ++static uint32_t U8TO32_LE(const unsigned char *m)
3309 ++ memcpy(&r, m, sizeof(r));
3313 ++static void U32TO8_LE(unsigned char *m, uint32_t v)
3315 ++ memcpy(m, &v, sizeof(v));
3318 ++static uint32_t U8TO32_LE(const unsigned char *m)
3320 ++ return (uint32_t)m[0] |
3321 ++ (uint32_t)m[1] << 8 |
3322 ++ (uint32_t)m[2] << 16 |
3323 ++ (uint32_t)m[3] << 24;
3326 ++static void U32TO8_LE(unsigned char *m, uint32_t v)
3336 ++mul32x32_64(uint32_t a, uint32_t b)
3338 ++ return (uint64_t)a * b;
3342 ++struct poly1305_state_st
3344 ++ uint32_t r0,r1,r2,r3,r4;
3345 ++ uint32_t s1,s2,s3,s4;
3346 ++ uint32_t h0,h1,h2,h3,h4;
3347 ++ unsigned char buf[16];
3348 ++ unsigned int buf_used;
3349 ++ unsigned char key[16];
3352 ++/* poly1305_blocks updates |state| given some amount of input data. This
3353 ++ * function may only be called with a |len| that is not a multiple of 16 at the
3354 ++ * end of the data. Otherwise the input must be buffered into 16 byte blocks.
3356 ++static void poly1305_update(struct poly1305_state_st *state,
3357 ++ const unsigned char *in, size_t len)
3359 ++ uint32_t t0,t1,t2,t3;
3364 ++ unsigned char mp[16];
3367 ++ goto poly1305_donna_atmost15bytes;
3369 ++poly1305_donna_16bytes:
3370 ++ t0 = U8TO32_LE(in);
3371 ++ t1 = U8TO32_LE(in+4);
3372 ++ t2 = U8TO32_LE(in+8);
3373 ++ t3 = U8TO32_LE(in+12);
3378 ++ state->h0 += t0 & 0x3ffffff;
3379 ++ state->h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
3380 ++ state->h2 += ((((uint64_t)t2 << 32) | t1) >> 20) & 0x3ffffff;
3381 ++ state->h3 += ((((uint64_t)t3 << 32) | t2) >> 14) & 0x3ffffff;
3382 ++ state->h4 += (t3 >> 8) | (1 << 24);
3384 ++poly1305_donna_mul:
3385 ++ t[0] = mul32x32_64(state->h0,state->r0) +
3386 ++ mul32x32_64(state->h1,state->s4) +
3387 ++ mul32x32_64(state->h2,state->s3) +
3388 ++ mul32x32_64(state->h3,state->s2) +
3389 ++ mul32x32_64(state->h4,state->s1);
3390 ++ t[1] = mul32x32_64(state->h0,state->r1) +
3391 ++ mul32x32_64(state->h1,state->r0) +
3392 ++ mul32x32_64(state->h2,state->s4) +
3393 ++ mul32x32_64(state->h3,state->s3) +
3394 ++ mul32x32_64(state->h4,state->s2);
3395 ++ t[2] = mul32x32_64(state->h0,state->r2) +
3396 ++ mul32x32_64(state->h1,state->r1) +
3397 ++ mul32x32_64(state->h2,state->r0) +
3398 ++ mul32x32_64(state->h3,state->s4) +
3399 ++ mul32x32_64(state->h4,state->s3);
3400 ++ t[3] = mul32x32_64(state->h0,state->r3) +
3401 ++ mul32x32_64(state->h1,state->r2) +
3402 ++ mul32x32_64(state->h2,state->r1) +
3403 ++ mul32x32_64(state->h3,state->r0) +
3404 ++ mul32x32_64(state->h4,state->s4);
3405 ++ t[4] = mul32x32_64(state->h0,state->r4) +
3406 ++ mul32x32_64(state->h1,state->r3) +
3407 ++ mul32x32_64(state->h2,state->r2) +
3408 ++ mul32x32_64(state->h3,state->r1) +
3409 ++ mul32x32_64(state->h4,state->r0);
3411 ++ state->h0 = (uint32_t)t[0] & 0x3ffffff; c = (t[0] >> 26);
3412 ++ t[1] += c; state->h1 = (uint32_t)t[1] & 0x3ffffff; b = (uint32_t)(t[1] >> 26);
3413 ++ t[2] += b; state->h2 = (uint32_t)t[2] & 0x3ffffff; b = (uint32_t)(t[2] >> 26);
3414 ++ t[3] += b; state->h3 = (uint32_t)t[3] & 0x3ffffff; b = (uint32_t)(t[3] >> 26);
3415 ++ t[4] += b; state->h4 = (uint32_t)t[4] & 0x3ffffff; b = (uint32_t)(t[4] >> 26);
3416 ++ state->h0 += b * 5;
3419 ++ goto poly1305_donna_16bytes;
3421 ++ /* final bytes */
3422 ++poly1305_donna_atmost15bytes:
3426 ++ for (j = 0; j < len; j++)
3429 ++ for (; j < 16; j++)
3433 ++ t0 = U8TO32_LE(mp+0);
3434 ++ t1 = U8TO32_LE(mp+4);
3435 ++ t2 = U8TO32_LE(mp+8);
3436 ++ t3 = U8TO32_LE(mp+12);
3438 ++ state->h0 += t0 & 0x3ffffff;
3439 ++ state->h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
3440 ++ state->h2 += ((((uint64_t)t2 << 32) | t1) >> 20) & 0x3ffffff;
3441 ++ state->h3 += ((((uint64_t)t3 << 32) | t2) >> 14) & 0x3ffffff;
3442 ++ state->h4 += (t3 >> 8);
3444 ++ goto poly1305_donna_mul;
3447 ++void CRYPTO_poly1305_init(poly1305_state *statep, const unsigned char key[32])
3449 ++ struct poly1305_state_st *state = (struct poly1305_state_st*) statep;
3450 ++ uint32_t t0,t1,t2,t3;
3452 ++ t0 = U8TO32_LE(key+0);
3453 ++ t1 = U8TO32_LE(key+4);
3454 ++ t2 = U8TO32_LE(key+8);
3455 ++ t3 = U8TO32_LE(key+12);
3457 ++ /* precompute multipliers */
3458 ++ state->r0 = t0 & 0x3ffffff; t0 >>= 26; t0 |= t1 << 6;
3459 ++ state->r1 = t0 & 0x3ffff03; t1 >>= 20; t1 |= t2 << 12;
3460 ++ state->r2 = t1 & 0x3ffc0ff; t2 >>= 14; t2 |= t3 << 18;
3461 ++ state->r3 = t2 & 0x3f03fff; t3 >>= 8;
3462 ++ state->r4 = t3 & 0x00fffff;
3464 ++ state->s1 = state->r1 * 5;
3465 ++ state->s2 = state->r2 * 5;
3466 ++ state->s3 = state->r3 * 5;
3467 ++ state->s4 = state->r4 * 5;
3476 ++ state->buf_used = 0;
3477 ++ memcpy(state->key, key + 16, sizeof(state->key));
3480 ++void CRYPTO_poly1305_update(poly1305_state *statep, const unsigned char *in,
3484 ++ struct poly1305_state_st *state = (struct poly1305_state_st*) statep;
3486 ++ if (state->buf_used)
3488 ++ unsigned int todo = 16 - state->buf_used;
3489 ++ if (todo > in_len)
3491 ++ for (i = 0; i < todo; i++)
3492 ++ state->buf[state->buf_used + i] = in[i];
3493 ++ state->buf_used += todo;
3497 ++ if (state->buf_used == 16)
3499 ++ poly1305_update(state, state->buf, 16);
3500 ++ state->buf_used = 0;
3504 ++ if (in_len >= 16)
3506 ++ size_t todo = in_len & ~0xf;
3507 ++ poly1305_update(state, in, todo);
3514 ++ for (i = 0; i < in_len; i++)
3515 ++ state->buf[i] = in[i];
3516 ++ state->buf_used = in_len;
3520 ++void CRYPTO_poly1305_finish(poly1305_state *statep, unsigned char mac[16])
3522 ++ struct poly1305_state_st *state = (struct poly1305_state_st*) statep;
3523 ++ uint64_t f0,f1,f2,f3;
3524 ++ uint32_t g0,g1,g2,g3,g4;
3527 ++ if (state->buf_used)
3528 ++ poly1305_update(state, state->buf, state->buf_used);
3530 ++ b = state->h0 >> 26; state->h0 = state->h0 & 0x3ffffff;
3531 ++ state->h1 += b; b = state->h1 >> 26; state->h1 = state->h1 & 0x3ffffff;
3532 ++ state->h2 += b; b = state->h2 >> 26; state->h2 = state->h2 & 0x3ffffff;
3533 ++ state->h3 += b; b = state->h3 >> 26; state->h3 = state->h3 & 0x3ffffff;
3534 ++ state->h4 += b; b = state->h4 >> 26; state->h4 = state->h4 & 0x3ffffff;
3535 ++ state->h0 += b * 5;
3537 ++ g0 = state->h0 + 5; b = g0 >> 26; g0 &= 0x3ffffff;
3538 ++ g1 = state->h1 + b; b = g1 >> 26; g1 &= 0x3ffffff;
3539 ++ g2 = state->h2 + b; b = g2 >> 26; g2 &= 0x3ffffff;
3540 ++ g3 = state->h3 + b; b = g3 >> 26; g3 &= 0x3ffffff;
3541 ++ g4 = state->h4 + b - (1 << 26);
3543 ++ b = (g4 >> 31) - 1;
3545 ++ state->h0 = (state->h0 & nb) | (g0 & b);
3546 ++ state->h1 = (state->h1 & nb) | (g1 & b);
3547 ++ state->h2 = (state->h2 & nb) | (g2 & b);
3548 ++ state->h3 = (state->h3 & nb) | (g3 & b);
3549 ++ state->h4 = (state->h4 & nb) | (g4 & b);
3551 ++ f0 = ((state->h0 ) | (state->h1 << 26)) + (uint64_t)U8TO32_LE(&state->key[0]);
3552 ++ f1 = ((state->h1 >> 6) | (state->h2 << 20)) + (uint64_t)U8TO32_LE(&state->key[4]);
3553 ++ f2 = ((state->h2 >> 12) | (state->h3 << 14)) + (uint64_t)U8TO32_LE(&state->key[8]);
3554 ++ f3 = ((state->h3 >> 18) | (state->h4 << 8)) + (uint64_t)U8TO32_LE(&state->key[12]);
3556 ++ U32TO8_LE(&mac[ 0], f0); f1 += (f0 >> 32);
3557 ++ U32TO8_LE(&mac[ 4], f1); f2 += (f1 >> 32);
3558 ++ U32TO8_LE(&mac[ 8], f2); f3 += (f2 >> 32);
3559 ++ U32TO8_LE(&mac[12], f3);
3562 ++#endif /* !OPENSSL_NO_POLY1305 */
3563 +diff --git a/crypto/poly1305/poly1305.h b/crypto/poly1305/poly1305.h
3564 +new file mode 100644
3565 +index 0000000..28f85ed
3567 ++++ b/crypto/poly1305/poly1305.h
3572 ++ * Created on: Jun, 2013
3573 ++ * Author: Elie Bursztein (elieb@google.com)
3575 ++ * Adapted from the estream code by D. Bernstein.
3577 ++/* ====================================================================
3578 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
3580 ++ * Redistribution and use in source and binary forms, with or without
3581 ++ * modification, are permitted provided that the following conditions
3584 ++ * 1. Redistributions of source code must retain the above copyright
3585 ++ * notice, this list of conditions and the following disclaimer.
3587 ++ * 2. Redistributions in binary form must reproduce the above copyright
3588 ++ * notice, this list of conditions and the following disclaimer in
3589 ++ * the documentation and/or other materials provided with the
3592 ++ * 3. All advertising materials mentioning features or use of this
3593 ++ * software must display the following acknowledgment:
3594 ++ * "This product includes software developed by the OpenSSL Project
3595 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
3597 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
3598 ++ * endorse or promote products derived from this software without
3599 ++ * prior written permission. For written permission, please contact
3600 ++ * licensing@OpenSSL.org.
3602 ++ * 5. Products derived from this software may not be called "OpenSSL"
3603 ++ * nor may "OpenSSL" appear in their names without prior written
3604 ++ * permission of the OpenSSL Project.
3606 ++ * 6. Redistributions of any form whatsoever must retain the following
3607 ++ * acknowledgment:
3608 ++ * "This product includes software developed by the OpenSSL Project
3609 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
3611 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
3612 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3613 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
3614 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
3615 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
3616 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
3617 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
3618 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3619 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3620 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3621 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3622 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
3623 ++ * ====================================================================
3626 ++#ifndef HEADER_POLY1305_H_
3627 ++#define HEADER_POLY1305_H_
3629 ++#include <stdint.h>
3630 ++#include <openssl/opensslconf.h>
3632 ++#if defined(OPENSSL_NO_POLY1305)
3633 ++#error Poly1305 support is disabled.
3636 ++typedef unsigned char poly1305_state[512];
3638 ++/* poly1305_init sets up |state| so that it can be used to calculate an
3639 ++ * authentication tag with the one-time key |key|. Note that |key| is a
3640 ++ * one-time key and therefore there is no `reset' method because that would
3641 ++ * enable several messages to be authenticated with the same key. */
3642 ++extern void CRYPTO_poly1305_init(poly1305_state* state,
3643 ++ const unsigned char key[32]);
3645 ++/* poly1305_update processes |in_len| bytes from |in|. It can be called zero or
3646 ++ * more times after poly1305_init. */
3647 ++extern void CRYPTO_poly1305_update(poly1305_state* state,
3648 ++ const unsigned char *in,
3651 ++/* poly1305_finish completes the poly1305 calculation and writes a 16 byte
3652 ++ * authentication tag to |mac|. */
3653 ++extern void CRYPTO_poly1305_finish(poly1305_state* state,
3654 ++ unsigned char mac[16]);
3656 ++#endif /* HEADER_POLY1305_H_ */
3657 +diff --git a/crypto/poly1305/poly1305_arm.c b/crypto/poly1305/poly1305_arm.c
3658 +new file mode 100644
3659 +index 0000000..adcef35
3661 ++++ b/crypto/poly1305/poly1305_arm.c
3663 ++/* ====================================================================
3664 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
3666 ++ * Redistribution and use in source and binary forms, with or without
3667 ++ * modification, are permitted provided that the following conditions
3670 ++ * 1. Redistributions of source code must retain the above copyright
3671 ++ * notice, this list of conditions and the following disclaimer.
3673 ++ * 2. Redistributions in binary form must reproduce the above copyright
3674 ++ * notice, this list of conditions and the following disclaimer in
3675 ++ * the documentation and/or other materials provided with the
3678 ++ * 3. All advertising materials mentioning features or use of this
3679 ++ * software must display the following acknowledgment:
3680 ++ * "This product includes software developed by the OpenSSL Project
3681 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
3683 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
3684 ++ * endorse or promote products derived from this software without
3685 ++ * prior written permission. For written permission, please contact
3686 ++ * licensing@OpenSSL.org.
3688 ++ * 5. Products derived from this software may not be called "OpenSSL"
3689 ++ * nor may "OpenSSL" appear in their names without prior written
3690 ++ * permission of the OpenSSL Project.
3692 ++ * 6. Redistributions of any form whatsoever must retain the following
3693 ++ * acknowledgment:
3694 ++ * "This product includes software developed by the OpenSSL Project
3695 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
3697 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
3698 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3699 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
3700 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
3701 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
3702 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
3703 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
3704 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3705 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3706 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3707 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3708 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
3709 ++ * ====================================================================
3712 ++/* This implementation was taken from the public domain, neon2 version in
3713 ++ * SUPERCOP by D. J. Bernstein and Peter Schwabe. */
3715 ++#include <stdint.h>
3717 ++#include <openssl/poly1305.h>
3719 ++#if !defined(OPENSSL_NO_POLY1305)
3722 ++ uint32_t v[12]; /* for alignment; only using 10 */
3725 ++#define addmulmod openssl_poly1305_neon2_addmulmod
3726 ++#define blocks openssl_poly1305_neon2_blocks
3728 ++extern void addmulmod(fe1305x2 *r, const fe1305x2 *x, const fe1305x2 *y, const fe1305x2 *c);
3730 ++extern int blocks(fe1305x2 *h, const fe1305x2 *precomp, const unsigned char *in, unsigned int inlen);
3732 ++static void freeze(fe1305x2 *r)
3736 ++ uint32_t x0 = r->v[0];
3737 ++ uint32_t x1 = r->v[2];
3738 ++ uint32_t x2 = r->v[4];
3739 ++ uint32_t x3 = r->v[6];
3740 ++ uint32_t x4 = r->v[8];
3748 ++ for (i = 0;i < 3;++i)
3750 ++ x1 += x0 >> 26; x0 &= 0x3ffffff;
3751 ++ x2 += x1 >> 26; x1 &= 0x3ffffff;
3752 ++ x3 += x2 >> 26; x2 &= 0x3ffffff;
3753 ++ x4 += x3 >> 26; x3 &= 0x3ffffff;
3754 ++ x0 += 5*(x4 >> 26); x4 &= 0x3ffffff;
3758 ++ y1 = x1 + (y0 >> 26); y0 &= 0x3ffffff;
3759 ++ y2 = x2 + (y1 >> 26); y1 &= 0x3ffffff;
3760 ++ y3 = x3 + (y2 >> 26); y2 &= 0x3ffffff;
3761 ++ y4 = x4 + (y3 >> 26); y3 &= 0x3ffffff;
3762 ++ swap = -(y4 >> 26); y4 &= 0x3ffffff;
3789 ++static void fe1305x2_tobytearray(unsigned char *r, fe1305x2 *x)
3791 ++ uint32_t x0 = x->v[0];
3792 ++ uint32_t x1 = x->v[2];
3793 ++ uint32_t x2 = x->v[4];
3794 ++ uint32_t x3 = x->v[6];
3795 ++ uint32_t x4 = x->v[8];
3806 ++ *(uint32_t *) r = x0 + (x1 << 26);
3807 ++ *(uint32_t *) (r + 4) = (x1 >> 6) + (x2 << 20);
3808 ++ *(uint32_t *) (r + 8) = (x2 >> 12) + (x3 << 14);
3809 ++ *(uint32_t *) (r + 12) = (x3 >> 18) + (x4 << 8);
3812 ++/* load32 exists to avoid breaking strict aliasing rules in
3813 ++ * fe1305x2_frombytearray. */
3814 ++static uint32_t load32(unsigned char *t)
3817 ++ memcpy(&tmp, t, sizeof(tmp));
3821 ++static void fe1305x2_frombytearray(fe1305x2 *r, const unsigned char *x, unsigned long long xlen)
3824 ++ unsigned char t[17];
3826 ++ for (i = 0; (i < 16) && (i < xlen); i++)
3831 ++ for (; i<17; i++)
3834 ++ r->v[0] = 0x3ffffff & load32(t);
3835 ++ r->v[2] = 0x3ffffff & (load32(t + 3) >> 2);
3836 ++ r->v[4] = 0x3ffffff & (load32(t + 6) >> 4);
3837 ++ r->v[6] = 0x3ffffff & (load32(t + 9) >> 6);
3838 ++ r->v[8] = load32(t + 13);
3842 ++ for (i = 0; (i < 16) && (i < xlen); i++)
3845 ++ for (; i<17; i++)
3848 ++ r->v[1] = 0x3ffffff & load32(t);
3849 ++ r->v[3] = 0x3ffffff & (load32(t + 3) >> 2);
3850 ++ r->v[5] = 0x3ffffff & (load32(t + 6) >> 4);
3851 ++ r->v[7] = 0x3ffffff & (load32(t + 9) >> 6);
3852 ++ r->v[9] = load32(t + 13);
3855 ++ r->v[1] = r->v[3] = r->v[5] = r->v[7] = r->v[9] = 0;
3858 ++static const fe1305x2 zero __attribute__ ((aligned (16)));
3860 ++struct poly1305_state_st {
3861 ++ unsigned char data[sizeof(fe1305x2[5]) + 128];
3862 ++ unsigned char buf[32];
3863 ++ unsigned int buf_used;
3864 ++ unsigned char key[16];
3867 ++void CRYPTO_poly1305_init(poly1305_state *state, const unsigned char key[32])
3869 ++ struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
3870 ++ fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
3871 ++ fe1305x2 *const h = r + 1;
3872 ++ fe1305x2 *const c = h + 1;
3873 ++ fe1305x2 *const precomp = c + 1;
3876 ++ r->v[1] = r->v[0] = 0x3ffffff & *(uint32_t *) key;
3877 ++ r->v[3] = r->v[2] = 0x3ffff03 & ((*(uint32_t *) (key + 3)) >> 2);
3878 ++ r->v[5] = r->v[4] = 0x3ffc0ff & ((*(uint32_t *) (key + 6)) >> 4);
3879 ++ r->v[7] = r->v[6] = 0x3f03fff & ((*(uint32_t *) (key + 9)) >> 6);
3880 ++ r->v[9] = r->v[8] = 0x00fffff & ((*(uint32_t *) (key + 12)) >> 8);
3882 ++ for (j = 0; j < 10; j++)
3883 ++ h->v[j] = 0; /* XXX: should fast-forward a bit */
3885 ++ addmulmod(precomp,r,r,&zero); /* precompute r^2 */
3886 ++ addmulmod(precomp + 1,precomp,precomp,&zero); /* precompute r^4 */
3888 ++ memcpy(st->key, key + 16, 16);
3889 ++ st->buf_used = 0;
3892 ++void CRYPTO_poly1305_update(poly1305_state *state, const unsigned char *in, size_t in_len)
3894 ++ struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
3895 ++ fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
3896 ++ fe1305x2 *const h = r + 1;
3897 ++ fe1305x2 *const c = h + 1;
3898 ++ fe1305x2 *const precomp = c + 1;
3901 ++ if (st->buf_used)
3903 ++ unsigned int todo = 32 - st->buf_used;
3904 ++ if (todo > in_len)
3906 ++ for (i = 0; i < todo; i++)
3907 ++ st->buf[st->buf_used + i] = in[i];
3908 ++ st->buf_used += todo;
3912 ++ if (st->buf_used == sizeof(st->buf) && in_len)
3914 ++ addmulmod(h,h,precomp,&zero);
3915 ++ fe1305x2_frombytearray(c, st->buf, sizeof(st->buf));
3916 ++ for (i = 0; i < 10; i++)
3917 ++ h->v[i] += c->v[i];
3918 ++ st->buf_used = 0;
3922 ++ while (in_len > 32)
3924 ++ unsigned int tlen = 1048576;
3925 ++ if (in_len < tlen)
3927 ++ tlen -= blocks(h, precomp, in, tlen);
3934 ++ for (i = 0; i < in_len; i++)
3935 ++ st->buf[i] = in[i];
3936 ++ st->buf_used = in_len;
3940 ++void CRYPTO_poly1305_finish(poly1305_state* state, unsigned char mac[16])
3942 ++ struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
3943 ++ fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
3944 ++ fe1305x2 *const h = r + 1;
3945 ++ fe1305x2 *const c = h + 1;
3946 ++ fe1305x2 *const precomp = c + 1;
3948 ++ addmulmod(h,h,precomp,&zero);
3950 ++ if (st->buf_used > 16)
3952 ++ fe1305x2_frombytearray(c, st->buf, st->buf_used);
3953 ++ precomp->v[1] = r->v[1];
3954 ++ precomp->v[3] = r->v[3];
3955 ++ precomp->v[5] = r->v[5];
3956 ++ precomp->v[7] = r->v[7];
3957 ++ precomp->v[9] = r->v[9];
3958 ++ addmulmod(h,h,precomp,c);
3960 ++ else if (st->buf_used > 0)
3962 ++ fe1305x2_frombytearray(c, st->buf, st->buf_used);
3968 ++ addmulmod(h,h,r,c);
3971 ++ h->v[0] += h->v[1];
3972 ++ h->v[2] += h->v[3];
3973 ++ h->v[4] += h->v[5];
3974 ++ h->v[6] += h->v[7];
3975 ++ h->v[8] += h->v[9];
3978 ++ fe1305x2_frombytearray(c, st->key, 16);
3979 ++ c->v[8] ^= (1 << 24);
3981 ++ h->v[0] += c->v[0];
3982 ++ h->v[2] += c->v[2];
3983 ++ h->v[4] += c->v[4];
3984 ++ h->v[6] += c->v[6];
3985 ++ h->v[8] += c->v[8];
3986 ++ fe1305x2_tobytearray(mac, h);
3989 ++#endif /* !OPENSSL_NO_POLY1305 */
3990 +diff --git a/crypto/poly1305/poly1305_arm_asm.S b/crypto/poly1305/poly1305_arm_asm.S
3991 +new file mode 100644
3992 +index 0000000..449d16f
3994 ++++ b/crypto/poly1305/poly1305_arm_asm.S
3996 ++# This implementation was taken from the public domain, neon2 version in
3997 ++# SUPERCOP by D. J. Bernstein and Peter Schwabe.
3999 ++# qhasm: int32 input_0
4001 ++# qhasm: int32 input_1
4003 ++# qhasm: int32 input_2
4005 ++# qhasm: int32 input_3
4007 ++# qhasm: stack32 input_4
4009 ++# qhasm: stack32 input_5
4011 ++# qhasm: stack32 input_6
4013 ++# qhasm: stack32 input_7
4015 ++# qhasm: int32 caller_r4
4017 ++# qhasm: int32 caller_r5
4019 ++# qhasm: int32 caller_r6
4021 ++# qhasm: int32 caller_r7
4023 ++# qhasm: int32 caller_r8
4025 ++# qhasm: int32 caller_r9
4027 ++# qhasm: int32 caller_r10
4029 ++# qhasm: int32 caller_r11
4031 ++# qhasm: int32 caller_r12
4033 ++# qhasm: int32 caller_r14
4035 ++# qhasm: reg128 caller_q4
4037 ++# qhasm: reg128 caller_q5
4039 ++# qhasm: reg128 caller_q6
4041 ++# qhasm: reg128 caller_q7
4043 ++# qhasm: startcode
4047 ++# qhasm: reg128 r0
4049 ++# qhasm: reg128 r1
4051 ++# qhasm: reg128 r2
4053 ++# qhasm: reg128 r3
4055 ++# qhasm: reg128 r4
4057 ++# qhasm: reg128 x01
4059 ++# qhasm: reg128 x23
4061 ++# qhasm: reg128 x4
4063 ++# qhasm: reg128 y0
4065 ++# qhasm: reg128 y12
4067 ++# qhasm: reg128 y34
4069 ++# qhasm: reg128 5y12
4071 ++# qhasm: reg128 5y34
4073 ++# qhasm: stack128 y0_stack
4075 ++# qhasm: stack128 y12_stack
4077 ++# qhasm: stack128 y34_stack
4079 ++# qhasm: stack128 5y12_stack
4081 ++# qhasm: stack128 5y34_stack
4083 ++# qhasm: reg128 z0
4085 ++# qhasm: reg128 z12
4087 ++# qhasm: reg128 z34
4089 ++# qhasm: reg128 5z12
4091 ++# qhasm: reg128 5z34
4093 ++# qhasm: stack128 z0_stack
4095 ++# qhasm: stack128 z12_stack
4097 ++# qhasm: stack128 z34_stack
4099 ++# qhasm: stack128 5z12_stack
4101 ++# qhasm: stack128 5z34_stack
4103 ++# qhasm: stack128 two24
4105 ++# qhasm: int32 ptr
4107 ++# qhasm: reg128 c01
4109 ++# qhasm: reg128 c23
4111 ++# qhasm: reg128 d01
4113 ++# qhasm: reg128 d23
4115 ++# qhasm: reg128 t0
4117 ++# qhasm: reg128 t1
4119 ++# qhasm: reg128 t2
4121 ++# qhasm: reg128 t3
4123 ++# qhasm: reg128 t4
4125 ++# qhasm: reg128 mask
4127 ++# qhasm: reg128 u0
4129 ++# qhasm: reg128 u1
4131 ++# qhasm: reg128 u2
4133 ++# qhasm: reg128 u3
4135 ++# qhasm: reg128 u4
4137 ++# qhasm: reg128 v01
4139 ++# qhasm: reg128 mid
4141 ++# qhasm: reg128 v23
4143 ++# qhasm: reg128 v4
4145 ++# qhasm: int32 len
4147 ++# qhasm: qpushenter crypto_onetimeauth_poly1305_neon2_blocks
4149 ++.global openssl_poly1305_neon2_blocks
4150 ++.type openssl_poly1305_neon2_blocks STT_FUNC
4151 ++openssl_poly1305_neon2_blocks:
4152 ++vpush {q4,q5,q6,q7}
4155 ++and sp,sp,#0xffffffe0
4157 ++# qhasm: len = input_3
4158 ++# asm 1: mov >len=int32#4,<input_3=int32#4
4159 ++# asm 2: mov >len=r3,<input_3=r3
4164 ++# qhasm: y0 = mem64[input_1]y0[1]; input_1 += 8
4165 ++# asm 1: vld1.8 {<y0=reg128#1%bot},[<input_1=int32#2]!
4166 ++# asm 2: vld1.8 {<y0=d0},[<input_1=r1]!
4169 ++# qhasm: y12 = mem128[input_1]; input_1 += 16
4170 ++# asm 1: vld1.8 {>y12=reg128#2%bot->y12=reg128#2%top},[<input_1=int32#2]!
4171 ++# asm 2: vld1.8 {>y12=d2->y12=d3},[<input_1=r1]!
4172 ++vld1.8 {d2-d3},[r1]!
4174 ++# qhasm: y34 = mem128[input_1]; input_1 += 16
4175 ++# asm 1: vld1.8 {>y34=reg128#3%bot->y34=reg128#3%top},[<input_1=int32#2]!
4176 ++# asm 2: vld1.8 {>y34=d4->y34=d5},[<input_1=r1]!
4177 ++vld1.8 {d4-d5},[r1]!
4179 ++# qhasm: input_1 += 8
4180 ++# asm 1: add >input_1=int32#2,<input_1=int32#2,#8
4181 ++# asm 2: add >input_1=r1,<input_1=r1,#8
4186 ++# qhasm: z0 = mem64[input_1]z0[1]; input_1 += 8
4187 ++# asm 1: vld1.8 {<z0=reg128#4%bot},[<input_1=int32#2]!
4188 ++# asm 2: vld1.8 {<z0=d6},[<input_1=r1]!
4191 ++# qhasm: z12 = mem128[input_1]; input_1 += 16
4192 ++# asm 1: vld1.8 {>z12=reg128#5%bot->z12=reg128#5%top},[<input_1=int32#2]!
4193 ++# asm 2: vld1.8 {>z12=d8->z12=d9},[<input_1=r1]!
4194 ++vld1.8 {d8-d9},[r1]!
4196 ++# qhasm: z34 = mem128[input_1]; input_1 += 16
4197 ++# asm 1: vld1.8 {>z34=reg128#6%bot->z34=reg128#6%top},[<input_1=int32#2]!
4198 ++# asm 2: vld1.8 {>z34=d10->z34=d11},[<input_1=r1]!
4199 ++vld1.8 {d10-d11},[r1]!
4201 ++# qhasm: 2x mask = 0xffffffff
4202 ++# asm 1: vmov.i64 >mask=reg128#7,#0xffffffff
4203 ++# asm 2: vmov.i64 >mask=q6,#0xffffffff
4204 ++vmov.i64 q6,#0xffffffff
4206 ++# qhasm: 2x u4 = 0xff
4207 ++# asm 1: vmov.i64 >u4=reg128#8,#0xff
4208 ++# asm 2: vmov.i64 >u4=q7,#0xff
4211 ++# qhasm: x01 aligned= mem128[input_0];input_0+=16
4212 ++# asm 1: vld1.8 {>x01=reg128#9%bot->x01=reg128#9%top},[<input_0=int32#1,: 128]!
4213 ++# asm 2: vld1.8 {>x01=d16->x01=d17},[<input_0=r0,: 128]!
4214 ++vld1.8 {d16-d17},[r0,: 128]!
4216 ++# qhasm: x23 aligned= mem128[input_0];input_0+=16
4217 ++# asm 1: vld1.8 {>x23=reg128#10%bot->x23=reg128#10%top},[<input_0=int32#1,: 128]!
4218 ++# asm 2: vld1.8 {>x23=d18->x23=d19},[<input_0=r0,: 128]!
4219 ++vld1.8 {d18-d19},[r0,: 128]!
4221 ++# qhasm: x4 aligned= mem64[input_0]x4[1]
4222 ++# asm 1: vld1.8 {<x4=reg128#11%bot},[<input_0=int32#1,: 64]
4223 ++# asm 2: vld1.8 {<x4=d20},[<input_0=r0,: 64]
4224 ++vld1.8 {d20},[r0,: 64]
4226 ++# qhasm: input_0 -= 32
4227 ++# asm 1: sub >input_0=int32#1,<input_0=int32#1,#32
4228 ++# asm 2: sub >input_0=r0,<input_0=r0,#32
4231 ++# qhasm: 2x mask unsigned>>=6
4232 ++# asm 1: vshr.u64 >mask=reg128#7,<mask=reg128#7,#6
4233 ++# asm 2: vshr.u64 >mask=q6,<mask=q6,#6
4236 ++# qhasm: 2x u4 unsigned>>= 7
4237 ++# asm 1: vshr.u64 >u4=reg128#8,<u4=reg128#8,#7
4238 ++# asm 2: vshr.u64 >u4=q7,<u4=q7,#7
4241 ++# qhasm: 4x 5y12 = y12 << 2
4242 ++# asm 1: vshl.i32 >5y12=reg128#12,<y12=reg128#2,#2
4243 ++# asm 2: vshl.i32 >5y12=q11,<y12=q1,#2
4244 ++vshl.i32 q11,q1,#2
4246 ++# qhasm: 4x 5y34 = y34 << 2
4247 ++# asm 1: vshl.i32 >5y34=reg128#13,<y34=reg128#3,#2
4248 ++# asm 2: vshl.i32 >5y34=q12,<y34=q2,#2
4249 ++vshl.i32 q12,q2,#2
4251 ++# qhasm: 4x 5y12 += y12
4252 ++# asm 1: vadd.i32 >5y12=reg128#12,<5y12=reg128#12,<y12=reg128#2
4253 ++# asm 2: vadd.i32 >5y12=q11,<5y12=q11,<y12=q1
4254 ++vadd.i32 q11,q11,q1
4256 ++# qhasm: 4x 5y34 += y34
4257 ++# asm 1: vadd.i32 >5y34=reg128#13,<5y34=reg128#13,<y34=reg128#3
4258 ++# asm 2: vadd.i32 >5y34=q12,<5y34=q12,<y34=q2
4259 ++vadd.i32 q12,q12,q2
4261 ++# qhasm: 2x u4 <<= 24
4262 ++# asm 1: vshl.i64 >u4=reg128#8,<u4=reg128#8,#24
4263 ++# asm 2: vshl.i64 >u4=q7,<u4=q7,#24
4264 ++vshl.i64 q7,q7,#24
4266 ++# qhasm: 4x 5z12 = z12 << 2
4267 ++# asm 1: vshl.i32 >5z12=reg128#14,<z12=reg128#5,#2
4268 ++# asm 2: vshl.i32 >5z12=q13,<z12=q4,#2
4269 ++vshl.i32 q13,q4,#2
4271 ++# qhasm: 4x 5z34 = z34 << 2
4272 ++# asm 1: vshl.i32 >5z34=reg128#15,<z34=reg128#6,#2
4273 ++# asm 2: vshl.i32 >5z34=q14,<z34=q5,#2
4274 ++vshl.i32 q14,q5,#2
4276 ++# qhasm: 4x 5z12 += z12
4277 ++# asm 1: vadd.i32 >5z12=reg128#14,<5z12=reg128#14,<z12=reg128#5
4278 ++# asm 2: vadd.i32 >5z12=q13,<5z12=q13,<z12=q4
4279 ++vadd.i32 q13,q13,q4
4281 ++# qhasm: 4x 5z34 += z34
4282 ++# asm 1: vadd.i32 >5z34=reg128#15,<5z34=reg128#15,<z34=reg128#6
4283 ++# asm 2: vadd.i32 >5z34=q14,<5z34=q14,<z34=q5
4284 ++vadd.i32 q14,q14,q5
4286 ++# qhasm: new two24
4288 ++# qhasm: new y0_stack
4290 ++# qhasm: new y12_stack
4292 ++# qhasm: new y34_stack
4294 ++# qhasm: new 5y12_stack
4296 ++# qhasm: new 5y34_stack
4298 ++# qhasm: new z0_stack
4300 ++# qhasm: new z12_stack
4302 ++# qhasm: new z34_stack
4304 ++# qhasm: new 5z12_stack
4306 ++# qhasm: new 5z34_stack
4308 ++# qhasm: ptr = &two24
4309 ++# asm 1: lea >ptr=int32#2,<two24=stack128#1
4310 ++# asm 2: lea >ptr=r1,<two24=[sp,#0]
4313 ++# qhasm: mem128[ptr] aligned= u4
4314 ++# asm 1: vst1.8 {<u4=reg128#8%bot-<u4=reg128#8%top},[<ptr=int32#2,: 128]
4315 ++# asm 2: vst1.8 {<u4=d14-<u4=d15},[<ptr=r1,: 128]
4316 ++vst1.8 {d14-d15},[r1,: 128]
4319 ++# asm 1: vmov >r4=reg128#16,<u4=reg128#8
4320 ++# asm 2: vmov >r4=q15,<u4=q7
4324 ++# asm 1: vmov >r0=reg128#8,<u4=reg128#8
4325 ++# asm 2: vmov >r0=q7,<u4=q7
4328 ++# qhasm: ptr = &y0_stack
4329 ++# asm 1: lea >ptr=int32#2,<y0_stack=stack128#2
4330 ++# asm 2: lea >ptr=r1,<y0_stack=[sp,#16]
4333 ++# qhasm: mem128[ptr] aligned= y0
4334 ++# asm 1: vst1.8 {<y0=reg128#1%bot-<y0=reg128#1%top},[<ptr=int32#2,: 128]
4335 ++# asm 2: vst1.8 {<y0=d0-<y0=d1},[<ptr=r1,: 128]
4336 ++vst1.8 {d0-d1},[r1,: 128]
4338 ++# qhasm: ptr = &y12_stack
4339 ++# asm 1: lea >ptr=int32#2,<y12_stack=stack128#3
4340 ++# asm 2: lea >ptr=r1,<y12_stack=[sp,#32]
4343 ++# qhasm: mem128[ptr] aligned= y12
4344 ++# asm 1: vst1.8 {<y12=reg128#2%bot-<y12=reg128#2%top},[<ptr=int32#2,: 128]
4345 ++# asm 2: vst1.8 {<y12=d2-<y12=d3},[<ptr=r1,: 128]
4346 ++vst1.8 {d2-d3},[r1,: 128]
4348 ++# qhasm: ptr = &y34_stack
4349 ++# asm 1: lea >ptr=int32#2,<y34_stack=stack128#4
4350 ++# asm 2: lea >ptr=r1,<y34_stack=[sp,#48]
4353 ++# qhasm: mem128[ptr] aligned= y34
4354 ++# asm 1: vst1.8 {<y34=reg128#3%bot-<y34=reg128#3%top},[<ptr=int32#2,: 128]
4355 ++# asm 2: vst1.8 {<y34=d4-<y34=d5},[<ptr=r1,: 128]
4356 ++vst1.8 {d4-d5},[r1,: 128]
4358 ++# qhasm: ptr = &z0_stack
4359 ++# asm 1: lea >ptr=int32#2,<z0_stack=stack128#7
4360 ++# asm 2: lea >ptr=r1,<z0_stack=[sp,#96]
4363 ++# qhasm: mem128[ptr] aligned= z0
4364 ++# asm 1: vst1.8 {<z0=reg128#4%bot-<z0=reg128#4%top},[<ptr=int32#2,: 128]
4365 ++# asm 2: vst1.8 {<z0=d6-<z0=d7},[<ptr=r1,: 128]
4366 ++vst1.8 {d6-d7},[r1,: 128]
4368 ++# qhasm: ptr = &z12_stack
4369 ++# asm 1: lea >ptr=int32#2,<z12_stack=stack128#8
4370 ++# asm 2: lea >ptr=r1,<z12_stack=[sp,#112]
4373 ++# qhasm: mem128[ptr] aligned= z12
4374 ++# asm 1: vst1.8 {<z12=reg128#5%bot-<z12=reg128#5%top},[<ptr=int32#2,: 128]
4375 ++# asm 2: vst1.8 {<z12=d8-<z12=d9},[<ptr=r1,: 128]
4376 ++vst1.8 {d8-d9},[r1,: 128]
4378 ++# qhasm: ptr = &z34_stack
4379 ++# asm 1: lea >ptr=int32#2,<z34_stack=stack128#9
4380 ++# asm 2: lea >ptr=r1,<z34_stack=[sp,#128]
4383 ++# qhasm: mem128[ptr] aligned= z34
4384 ++# asm 1: vst1.8 {<z34=reg128#6%bot-<z34=reg128#6%top},[<ptr=int32#2,: 128]
4385 ++# asm 2: vst1.8 {<z34=d10-<z34=d11},[<ptr=r1,: 128]
4386 ++vst1.8 {d10-d11},[r1,: 128]
4388 ++# qhasm: ptr = &5y12_stack
4389 ++# asm 1: lea >ptr=int32#2,<5y12_stack=stack128#5
4390 ++# asm 2: lea >ptr=r1,<5y12_stack=[sp,#64]
4393 ++# qhasm: mem128[ptr] aligned= 5y12
4394 ++# asm 1: vst1.8 {<5y12=reg128#12%bot-<5y12=reg128#12%top},[<ptr=int32#2,: 128]
4395 ++# asm 2: vst1.8 {<5y12=d22-<5y12=d23},[<ptr=r1,: 128]
4396 ++vst1.8 {d22-d23},[r1,: 128]
4398 ++# qhasm: ptr = &5y34_stack
4399 ++# asm 1: lea >ptr=int32#2,<5y34_stack=stack128#6
4400 ++# asm 2: lea >ptr=r1,<5y34_stack=[sp,#80]
4403 ++# qhasm: mem128[ptr] aligned= 5y34
4404 ++# asm 1: vst1.8 {<5y34=reg128#13%bot-<5y34=reg128#13%top},[<ptr=int32#2,: 128]
4405 ++# asm 2: vst1.8 {<5y34=d24-<5y34=d25},[<ptr=r1,: 128]
4406 ++vst1.8 {d24-d25},[r1,: 128]
4408 ++# qhasm: ptr = &5z12_stack
4409 ++# asm 1: lea >ptr=int32#2,<5z12_stack=stack128#10
4410 ++# asm 2: lea >ptr=r1,<5z12_stack=[sp,#144]
4413 ++# qhasm: mem128[ptr] aligned= 5z12
4414 ++# asm 1: vst1.8 {<5z12=reg128#14%bot-<5z12=reg128#14%top},[<ptr=int32#2,: 128]
4415 ++# asm 2: vst1.8 {<5z12=d26-<5z12=d27},[<ptr=r1,: 128]
4416 ++vst1.8 {d26-d27},[r1,: 128]
4418 ++# qhasm: ptr = &5z34_stack
4419 ++# asm 1: lea >ptr=int32#2,<5z34_stack=stack128#11
4420 ++# asm 2: lea >ptr=r1,<5z34_stack=[sp,#160]
4423 ++# qhasm: mem128[ptr] aligned= 5z34
4424 ++# asm 1: vst1.8 {<5z34=reg128#15%bot-<5z34=reg128#15%top},[<ptr=int32#2,: 128]
4425 ++# asm 2: vst1.8 {<5z34=d28-<5z34=d29},[<ptr=r1,: 128]
4426 ++vst1.8 {d28-d29},[r1,: 128]
4428 ++# qhasm: unsigned>? len - 64
4429 ++# asm 1: cmp <len=int32#4,#64
4430 ++# asm 2: cmp <len=r3,#64
4433 ++# qhasm: goto below64bytes if !unsigned>
4434 ++bls ._below64bytes
4436 ++# qhasm: input_2 += 32
4437 ++# asm 1: add >input_2=int32#2,<input_2=int32#3,#32
4438 ++# asm 2: add >input_2=r1,<input_2=r2,#32
4441 ++# qhasm: mainloop2:
4444 ++# qhasm: c01 = mem128[input_2];input_2+=16
4445 ++# asm 1: vld1.8 {>c01=reg128#1%bot->c01=reg128#1%top},[<input_2=int32#2]!
4446 ++# asm 2: vld1.8 {>c01=d0->c01=d1},[<input_2=r1]!
4447 ++vld1.8 {d0-d1},[r1]!
4449 ++# qhasm: c23 = mem128[input_2];input_2+=16
4450 ++# asm 1: vld1.8 {>c23=reg128#2%bot->c23=reg128#2%top},[<input_2=int32#2]!
4451 ++# asm 2: vld1.8 {>c23=d2->c23=d3},[<input_2=r1]!
4452 ++vld1.8 {d2-d3},[r1]!
4454 ++# qhasm: r4[0,1] += x01[0] unsigned* z34[2]; r4[2,3] += x01[1] unsigned* z34[3]
4455 ++# asm 1: vmlal.u32 <r4=reg128#16,<x01=reg128#9%bot,<z34=reg128#6%top
4456 ++# asm 2: vmlal.u32 <r4=q15,<x01=d16,<z34=d11
4457 ++vmlal.u32 q15,d16,d11
4459 ++# qhasm: ptr = &z12_stack
4460 ++# asm 1: lea >ptr=int32#3,<z12_stack=stack128#8
4461 ++# asm 2: lea >ptr=r2,<z12_stack=[sp,#112]
4464 ++# qhasm: z12 aligned= mem128[ptr]
4465 ++# asm 1: vld1.8 {>z12=reg128#3%bot->z12=reg128#3%top},[<ptr=int32#3,: 128]
4466 ++# asm 2: vld1.8 {>z12=d4->z12=d5},[<ptr=r2,: 128]
4467 ++vld1.8 {d4-d5},[r2,: 128]
4469 ++# qhasm: r4[0,1] += x01[2] unsigned* z34[0]; r4[2,3] += x01[3] unsigned* z34[1]
4470 ++# asm 1: vmlal.u32 <r4=reg128#16,<x01=reg128#9%top,<z34=reg128#6%bot
4471 ++# asm 2: vmlal.u32 <r4=q15,<x01=d17,<z34=d10
4472 ++vmlal.u32 q15,d17,d10
4474 ++# qhasm: ptr = &z0_stack
4475 ++# asm 1: lea >ptr=int32#3,<z0_stack=stack128#7
4476 ++# asm 2: lea >ptr=r2,<z0_stack=[sp,#96]
4479 ++# qhasm: z0 aligned= mem128[ptr]
4480 ++# asm 1: vld1.8 {>z0=reg128#4%bot->z0=reg128#4%top},[<ptr=int32#3,: 128]
4481 ++# asm 2: vld1.8 {>z0=d6->z0=d7},[<ptr=r2,: 128]
4482 ++vld1.8 {d6-d7},[r2,: 128]
4484 ++# qhasm: r4[0,1] += x23[0] unsigned* z12[2]; r4[2,3] += x23[1] unsigned* z12[3]
4485 ++# asm 1: vmlal.u32 <r4=reg128#16,<x23=reg128#10%bot,<z12=reg128#3%top
4486 ++# asm 2: vmlal.u32 <r4=q15,<x23=d18,<z12=d5
4487 ++vmlal.u32 q15,d18,d5
4489 ++# qhasm: c01 c23 = c01[0]c01[1]c01[2]c23[2]c23[0]c23[1]c01[3]c23[3]
4490 ++# asm 1: vtrn.32 <c01=reg128#1%top,<c23=reg128#2%top
4491 ++# asm 2: vtrn.32 <c01=d1,<c23=d3
4494 ++# qhasm: r4[0,1] += x23[2] unsigned* z12[0]; r4[2,3] += x23[3] unsigned* z12[1]
4495 ++# asm 1: vmlal.u32 <r4=reg128#16,<x23=reg128#10%top,<z12=reg128#3%bot
4496 ++# asm 2: vmlal.u32 <r4=q15,<x23=d19,<z12=d4
4497 ++vmlal.u32 q15,d19,d4
4499 ++# qhasm: r4[0,1] += x4[0] unsigned* z0[0]; r4[2,3] += x4[1] unsigned* z0[1]
4500 ++# asm 1: vmlal.u32 <r4=reg128#16,<x4=reg128#11%bot,<z0=reg128#4%bot
4501 ++# asm 2: vmlal.u32 <r4=q15,<x4=d20,<z0=d6
4502 ++vmlal.u32 q15,d20,d6
4504 ++# qhasm: r3[0,1] = c23[2]<<18; r3[2,3] = c23[3]<<18
4505 ++# asm 1: vshll.u32 >r3=reg128#5,<c23=reg128#2%top,#18
4506 ++# asm 2: vshll.u32 >r3=q4,<c23=d3,#18
4507 ++vshll.u32 q4,d3,#18
4509 ++# qhasm: c01 c23 = c01[0]c23[0]c01[2]c01[3]c01[1]c23[1]c23[2]c23[3]
4510 ++# asm 1: vtrn.32 <c01=reg128#1%bot,<c23=reg128#2%bot
4511 ++# asm 2: vtrn.32 <c01=d0,<c23=d2
4514 ++# qhasm: r3[0,1] += x01[0] unsigned* z34[0]; r3[2,3] += x01[1] unsigned* z34[1]
4515 ++# asm 1: vmlal.u32 <r3=reg128#5,<x01=reg128#9%bot,<z34=reg128#6%bot
4516 ++# asm 2: vmlal.u32 <r3=q4,<x01=d16,<z34=d10
4517 ++vmlal.u32 q4,d16,d10
4519 ++# qhasm: r3[0,1] += x01[2] unsigned* z12[2]; r3[2,3] += x01[3] unsigned* z12[3]
4520 ++# asm 1: vmlal.u32 <r3=reg128#5,<x01=reg128#9%top,<z12=reg128#3%top
4521 ++# asm 2: vmlal.u32 <r3=q4,<x01=d17,<z12=d5
4522 ++vmlal.u32 q4,d17,d5
4524 ++# qhasm: r0 = r0[1]c01[0]r0[2,3]
4525 ++# asm 1: vext.32 <r0=reg128#8%bot,<r0=reg128#8%bot,<c01=reg128#1%bot,#1
4526 ++# asm 2: vext.32 <r0=d14,<r0=d14,<c01=d0,#1
4527 ++vext.32 d14,d14,d0,#1
4529 ++# qhasm: r3[0,1] += x23[0] unsigned* z12[0]; r3[2,3] += x23[1] unsigned* z12[1]
4530 ++# asm 1: vmlal.u32 <r3=reg128#5,<x23=reg128#10%bot,<z12=reg128#3%bot
4531 ++# asm 2: vmlal.u32 <r3=q4,<x23=d18,<z12=d4
4532 ++vmlal.u32 q4,d18,d4
4534 ++# qhasm: input_2 -= 64
4535 ++# asm 1: sub >input_2=int32#2,<input_2=int32#2,#64
4536 ++# asm 2: sub >input_2=r1,<input_2=r1,#64
4539 ++# qhasm: r3[0,1] += x23[2] unsigned* z0[0]; r3[2,3] += x23[3] unsigned* z0[1]
4540 ++# asm 1: vmlal.u32 <r3=reg128#5,<x23=reg128#10%top,<z0=reg128#4%bot
4541 ++# asm 2: vmlal.u32 <r3=q4,<x23=d19,<z0=d6
4542 ++vmlal.u32 q4,d19,d6
4544 ++# qhasm: ptr = &5z34_stack
4545 ++# asm 1: lea >ptr=int32#3,<5z34_stack=stack128#11
4546 ++# asm 2: lea >ptr=r2,<5z34_stack=[sp,#160]
4549 ++# qhasm: 5z34 aligned= mem128[ptr]
4550 ++# asm 1: vld1.8 {>5z34=reg128#6%bot->5z34=reg128#6%top},[<ptr=int32#3,: 128]
4551 ++# asm 2: vld1.8 {>5z34=d10->5z34=d11},[<ptr=r2,: 128]
4552 ++vld1.8 {d10-d11},[r2,: 128]
4554 ++# qhasm: r3[0,1] += x4[0] unsigned* 5z34[2]; r3[2,3] += x4[1] unsigned* 5z34[3]
4555 ++# asm 1: vmlal.u32 <r3=reg128#5,<x4=reg128#11%bot,<5z34=reg128#6%top
4556 ++# asm 2: vmlal.u32 <r3=q4,<x4=d20,<5z34=d11
4557 ++vmlal.u32 q4,d20,d11
4559 ++# qhasm: r0 = r0[1]r0[0]r0[3]r0[2]
4560 ++# asm 1: vrev64.i32 >r0=reg128#8,<r0=reg128#8
4561 ++# asm 2: vrev64.i32 >r0=q7,<r0=q7
4564 ++# qhasm: r2[0,1] = c01[2]<<12; r2[2,3] = c01[3]<<12
4565 ++# asm 1: vshll.u32 >r2=reg128#14,<c01=reg128#1%top,#12
4566 ++# asm 2: vshll.u32 >r2=q13,<c01=d1,#12
4567 ++vshll.u32 q13,d1,#12
4569 ++# qhasm: d01 = mem128[input_2];input_2+=16
4570 ++# asm 1: vld1.8 {>d01=reg128#12%bot->d01=reg128#12%top},[<input_2=int32#2]!
4571 ++# asm 2: vld1.8 {>d01=d22->d01=d23},[<input_2=r1]!
4572 ++vld1.8 {d22-d23},[r1]!
4574 ++# qhasm: r2[0,1] += x01[0] unsigned* z12[2]; r2[2,3] += x01[1] unsigned* z12[3]
4575 ++# asm 1: vmlal.u32 <r2=reg128#14,<x01=reg128#9%bot,<z12=reg128#3%top
4576 ++# asm 2: vmlal.u32 <r2=q13,<x01=d16,<z12=d5
4577 ++vmlal.u32 q13,d16,d5
4579 ++# qhasm: r2[0,1] += x01[2] unsigned* z12[0]; r2[2,3] += x01[3] unsigned* z12[1]
4580 ++# asm 1: vmlal.u32 <r2=reg128#14,<x01=reg128#9%top,<z12=reg128#3%bot
4581 ++# asm 2: vmlal.u32 <r2=q13,<x01=d17,<z12=d4
4582 ++vmlal.u32 q13,d17,d4
4584 ++# qhasm: r2[0,1] += x23[0] unsigned* z0[0]; r2[2,3] += x23[1] unsigned* z0[1]
4585 ++# asm 1: vmlal.u32 <r2=reg128#14,<x23=reg128#10%bot,<z0=reg128#4%bot
4586 ++# asm 2: vmlal.u32 <r2=q13,<x23=d18,<z0=d6
4587 ++vmlal.u32 q13,d18,d6
4589 ++# qhasm: r2[0,1] += x23[2] unsigned* 5z34[2]; r2[2,3] += x23[3] unsigned* 5z34[3]
4590 ++# asm 1: vmlal.u32 <r2=reg128#14,<x23=reg128#10%top,<5z34=reg128#6%top
4591 ++# asm 2: vmlal.u32 <r2=q13,<x23=d19,<5z34=d11
4592 ++vmlal.u32 q13,d19,d11
4594 ++# qhasm: r2[0,1] += x4[0] unsigned* 5z34[0]; r2[2,3] += x4[1] unsigned* 5z34[1]
4595 ++# asm 1: vmlal.u32 <r2=reg128#14,<x4=reg128#11%bot,<5z34=reg128#6%bot
4596 ++# asm 2: vmlal.u32 <r2=q13,<x4=d20,<5z34=d10
4597 ++vmlal.u32 q13,d20,d10
4599 ++# qhasm: r0 = r0[0,1]c01[1]r0[2]
4600 ++# asm 1: vext.32 <r0=reg128#8%top,<c01=reg128#1%bot,<r0=reg128#8%top,#1
4601 ++# asm 2: vext.32 <r0=d15,<c01=d0,<r0=d15,#1
4602 ++vext.32 d15,d0,d15,#1
4604 ++# qhasm: r1[0,1] = c23[0]<<6; r1[2,3] = c23[1]<<6
4605 ++# asm 1: vshll.u32 >r1=reg128#15,<c23=reg128#2%bot,#6
4606 ++# asm 2: vshll.u32 >r1=q14,<c23=d2,#6
4607 ++vshll.u32 q14,d2,#6
4609 ++# qhasm: r1[0,1] += x01[0] unsigned* z12[0]; r1[2,3] += x01[1] unsigned* z12[1]
4610 ++# asm 1: vmlal.u32 <r1=reg128#15,<x01=reg128#9%bot,<z12=reg128#3%bot
4611 ++# asm 2: vmlal.u32 <r1=q14,<x01=d16,<z12=d4
4612 ++vmlal.u32 q14,d16,d4
4614 ++# qhasm: r1[0,1] += x01[2] unsigned* z0[0]; r1[2,3] += x01[3] unsigned* z0[1]
4615 ++# asm 1: vmlal.u32 <r1=reg128#15,<x01=reg128#9%top,<z0=reg128#4%bot
4616 ++# asm 2: vmlal.u32 <r1=q14,<x01=d17,<z0=d6
4617 ++vmlal.u32 q14,d17,d6
4619 ++# qhasm: r1[0,1] += x23[0] unsigned* 5z34[2]; r1[2,3] += x23[1] unsigned* 5z34[3]
4620 ++# asm 1: vmlal.u32 <r1=reg128#15,<x23=reg128#10%bot,<5z34=reg128#6%top
4621 ++# asm 2: vmlal.u32 <r1=q14,<x23=d18,<5z34=d11
4622 ++vmlal.u32 q14,d18,d11
4624 ++# qhasm: r1[0,1] += x23[2] unsigned* 5z34[0]; r1[2,3] += x23[3] unsigned* 5z34[1]
4625 ++# asm 1: vmlal.u32 <r1=reg128#15,<x23=reg128#10%top,<5z34=reg128#6%bot
4626 ++# asm 2: vmlal.u32 <r1=q14,<x23=d19,<5z34=d10
4627 ++vmlal.u32 q14,d19,d10
4629 ++# qhasm: ptr = &5z12_stack
4630 ++# asm 1: lea >ptr=int32#3,<5z12_stack=stack128#10
4631 ++# asm 2: lea >ptr=r2,<5z12_stack=[sp,#144]
4634 ++# qhasm: 5z12 aligned= mem128[ptr]
4635 ++# asm 1: vld1.8 {>5z12=reg128#1%bot->5z12=reg128#1%top},[<ptr=int32#3,: 128]
4636 ++# asm 2: vld1.8 {>5z12=d0->5z12=d1},[<ptr=r2,: 128]
4637 ++vld1.8 {d0-d1},[r2,: 128]
4639 ++# qhasm: r1[0,1] += x4[0] unsigned* 5z12[2]; r1[2,3] += x4[1] unsigned* 5z12[3]
4640 ++# asm 1: vmlal.u32 <r1=reg128#15,<x4=reg128#11%bot,<5z12=reg128#1%top
4641 ++# asm 2: vmlal.u32 <r1=q14,<x4=d20,<5z12=d1
4642 ++vmlal.u32 q14,d20,d1
4644 ++# qhasm: d23 = mem128[input_2];input_2+=16
4645 ++# asm 1: vld1.8 {>d23=reg128#2%bot->d23=reg128#2%top},[<input_2=int32#2]!
4646 ++# asm 2: vld1.8 {>d23=d2->d23=d3},[<input_2=r1]!
4647 ++vld1.8 {d2-d3},[r1]!
4649 ++# qhasm: input_2 += 32
4650 ++# asm 1: add >input_2=int32#2,<input_2=int32#2,#32
4651 ++# asm 2: add >input_2=r1,<input_2=r1,#32
4654 ++# qhasm: r0[0,1] += x4[0] unsigned* 5z12[0]; r0[2,3] += x4[1] unsigned* 5z12[1]
4655 ++# asm 1: vmlal.u32 <r0=reg128#8,<x4=reg128#11%bot,<5z12=reg128#1%bot
4656 ++# asm 2: vmlal.u32 <r0=q7,<x4=d20,<5z12=d0
4657 ++vmlal.u32 q7,d20,d0
4659 ++# qhasm: r0[0,1] += x23[0] unsigned* 5z34[0]; r0[2,3] += x23[1] unsigned* 5z34[1]
4660 ++# asm 1: vmlal.u32 <r0=reg128#8,<x23=reg128#10%bot,<5z34=reg128#6%bot
4661 ++# asm 2: vmlal.u32 <r0=q7,<x23=d18,<5z34=d10
4662 ++vmlal.u32 q7,d18,d10
4664 ++# qhasm: d01 d23 = d01[0] d23[0] d01[1] d23[1]
4665 ++# asm 1: vswp <d23=reg128#2%bot,<d01=reg128#12%top
4666 ++# asm 2: vswp <d23=d2,<d01=d23
4669 ++# qhasm: r0[0,1] += x23[2] unsigned* 5z12[2]; r0[2,3] += x23[3] unsigned* 5z12[3]
4670 ++# asm 1: vmlal.u32 <r0=reg128#8,<x23=reg128#10%top,<5z12=reg128#1%top
4671 ++# asm 2: vmlal.u32 <r0=q7,<x23=d19,<5z12=d1
4672 ++vmlal.u32 q7,d19,d1
4674 ++# qhasm: r0[0,1] += x01[0] unsigned* z0[0]; r0[2,3] += x01[1] unsigned* z0[1]
4675 ++# asm 1: vmlal.u32 <r0=reg128#8,<x01=reg128#9%bot,<z0=reg128#4%bot
4676 ++# asm 2: vmlal.u32 <r0=q7,<x01=d16,<z0=d6
4677 ++vmlal.u32 q7,d16,d6
4681 ++# qhasm: 2x v4 = d23 unsigned>> 40
4682 ++# asm 1: vshr.u64 >v4=reg128#4,<d23=reg128#2,#40
4683 ++# asm 2: vshr.u64 >v4=q3,<d23=q1,#40
4684 ++vshr.u64 q3,q1,#40
4686 ++# qhasm: mid = d01[1]d23[0] mid[2,3]
4687 ++# asm 1: vext.32 <mid=reg128#1%bot,<d01=reg128#12%bot,<d23=reg128#2%bot,#1
4688 ++# asm 2: vext.32 <mid=d0,<d01=d22,<d23=d2,#1
4689 ++vext.32 d0,d22,d2,#1
4693 ++# qhasm: v23[2] = d23[0,1] unsigned>> 14; v23[3] = d23[2,3] unsigned>> 14
4694 ++# asm 1: vshrn.u64 <v23=reg128#10%top,<d23=reg128#2,#14
4695 ++# asm 2: vshrn.u64 <v23=d19,<d23=q1,#14
4696 ++vshrn.u64 d19,q1,#14
4698 ++# qhasm: mid = mid[0,1] d01[3]d23[2]
4699 ++# asm 1: vext.32 <mid=reg128#1%top,<d01=reg128#12%top,<d23=reg128#2%top,#1
4700 ++# asm 2: vext.32 <mid=d1,<d01=d23,<d23=d3,#1
4701 ++vext.32 d1,d23,d3,#1
4705 ++# qhasm: v01[2] = d01[0,1] unsigned>> 26; v01[3] = d01[2,3] unsigned>> 26
4706 ++# asm 1: vshrn.u64 <v01=reg128#11%top,<d01=reg128#12,#26
4707 ++# asm 2: vshrn.u64 <v01=d21,<d01=q11,#26
4708 ++vshrn.u64 d21,q11,#26
4710 ++# qhasm: v01 = d01[1]d01[0] v01[2,3]
4711 ++# asm 1: vext.32 <v01=reg128#11%bot,<d01=reg128#12%bot,<d01=reg128#12%bot,#1
4712 ++# asm 2: vext.32 <v01=d20,<d01=d22,<d01=d22,#1
4713 ++vext.32 d20,d22,d22,#1
4715 ++# qhasm: r0[0,1] += x01[2] unsigned* 5z34[2]; r0[2,3] += x01[3] unsigned* 5z34[3]
4716 ++# asm 1: vmlal.u32 <r0=reg128#8,<x01=reg128#9%top,<5z34=reg128#6%top
4717 ++# asm 2: vmlal.u32 <r0=q7,<x01=d17,<5z34=d11
4718 ++vmlal.u32 q7,d17,d11
4720 ++# qhasm: v01 = v01[1]d01[2] v01[2,3]
4721 ++# asm 1: vext.32 <v01=reg128#11%bot,<v01=reg128#11%bot,<d01=reg128#12%top,#1
4722 ++# asm 2: vext.32 <v01=d20,<v01=d20,<d01=d23,#1
4723 ++vext.32 d20,d20,d23,#1
4725 ++# qhasm: v23[0] = mid[0,1] unsigned>> 20; v23[1] = mid[2,3] unsigned>> 20
4726 ++# asm 1: vshrn.u64 <v23=reg128#10%bot,<mid=reg128#1,#20
4727 ++# asm 2: vshrn.u64 <v23=d18,<mid=q0,#20
4728 ++vshrn.u64 d18,q0,#20
4730 ++# qhasm: v4 = v4[0]v4[2]v4[1]v4[3]
4731 ++# asm 1: vtrn.32 <v4=reg128#4%bot,<v4=reg128#4%top
4732 ++# asm 2: vtrn.32 <v4=d6,<v4=d7
4735 ++# qhasm: 4x v01 &= 0x03ffffff
4736 ++# asm 1: vand.i32 <v01=reg128#11,#0x03ffffff
4737 ++# asm 2: vand.i32 <v01=q10,#0x03ffffff
4738 ++vand.i32 q10,#0x03ffffff
4740 ++# qhasm: ptr = &y34_stack
4741 ++# asm 1: lea >ptr=int32#3,<y34_stack=stack128#4
4742 ++# asm 2: lea >ptr=r2,<y34_stack=[sp,#48]
4745 ++# qhasm: y34 aligned= mem128[ptr]
4746 ++# asm 1: vld1.8 {>y34=reg128#3%bot->y34=reg128#3%top},[<ptr=int32#3,: 128]
4747 ++# asm 2: vld1.8 {>y34=d4->y34=d5},[<ptr=r2,: 128]
4748 ++vld1.8 {d4-d5},[r2,: 128]
4750 ++# qhasm: 4x v23 &= 0x03ffffff
4751 ++# asm 1: vand.i32 <v23=reg128#10,#0x03ffffff
4752 ++# asm 2: vand.i32 <v23=q9,#0x03ffffff
4753 ++vand.i32 q9,#0x03ffffff
4755 ++# qhasm: ptr = &y12_stack
4756 ++# asm 1: lea >ptr=int32#3,<y12_stack=stack128#3
4757 ++# asm 2: lea >ptr=r2,<y12_stack=[sp,#32]
4760 ++# qhasm: y12 aligned= mem128[ptr]
4761 ++# asm 1: vld1.8 {>y12=reg128#2%bot->y12=reg128#2%top},[<ptr=int32#3,: 128]
4762 ++# asm 2: vld1.8 {>y12=d2->y12=d3},[<ptr=r2,: 128]
4763 ++vld1.8 {d2-d3},[r2,: 128]
4765 ++# qhasm: 4x v4 |= 0x01000000
4766 ++# asm 1: vorr.i32 <v4=reg128#4,#0x01000000
4767 ++# asm 2: vorr.i32 <v4=q3,#0x01000000
4768 ++vorr.i32 q3,#0x01000000
4770 ++# qhasm: ptr = &y0_stack
4771 ++# asm 1: lea >ptr=int32#3,<y0_stack=stack128#2
4772 ++# asm 2: lea >ptr=r2,<y0_stack=[sp,#16]
4775 ++# qhasm: y0 aligned= mem128[ptr]
4776 ++# asm 1: vld1.8 {>y0=reg128#1%bot->y0=reg128#1%top},[<ptr=int32#3,: 128]
4777 ++# asm 2: vld1.8 {>y0=d0->y0=d1},[<ptr=r2,: 128]
4778 ++vld1.8 {d0-d1},[r2,: 128]
4780 ++# qhasm: r4[0,1] += v01[0] unsigned* y34[2]; r4[2,3] += v01[1] unsigned* y34[3]
4781 ++# asm 1: vmlal.u32 <r4=reg128#16,<v01=reg128#11%bot,<y34=reg128#3%top
4782 ++# asm 2: vmlal.u32 <r4=q15,<v01=d20,<y34=d5
4783 ++vmlal.u32 q15,d20,d5
4785 ++# qhasm: r4[0,1] += v01[2] unsigned* y34[0]; r4[2,3] += v01[3] unsigned* y34[1]
4786 ++# asm 1: vmlal.u32 <r4=reg128#16,<v01=reg128#11%top,<y34=reg128#3%bot
4787 ++# asm 2: vmlal.u32 <r4=q15,<v01=d21,<y34=d4
4788 ++vmlal.u32 q15,d21,d4
4790 ++# qhasm: r4[0,1] += v23[0] unsigned* y12[2]; r4[2,3] += v23[1] unsigned* y12[3]
4791 ++# asm 1: vmlal.u32 <r4=reg128#16,<v23=reg128#10%bot,<y12=reg128#2%top
4792 ++# asm 2: vmlal.u32 <r4=q15,<v23=d18,<y12=d3
4793 ++vmlal.u32 q15,d18,d3
4795 ++# qhasm: r4[0,1] += v23[2] unsigned* y12[0]; r4[2,3] += v23[3] unsigned* y12[1]
4796 ++# asm 1: vmlal.u32 <r4=reg128#16,<v23=reg128#10%top,<y12=reg128#2%bot
4797 ++# asm 2: vmlal.u32 <r4=q15,<v23=d19,<y12=d2
4798 ++vmlal.u32 q15,d19,d2
4800 ++# qhasm: r4[0,1] += v4[0] unsigned* y0[0]; r4[2,3] += v4[1] unsigned* y0[1]
4801 ++# asm 1: vmlal.u32 <r4=reg128#16,<v4=reg128#4%bot,<y0=reg128#1%bot
4802 ++# asm 2: vmlal.u32 <r4=q15,<v4=d6,<y0=d0
4803 ++vmlal.u32 q15,d6,d0
4805 ++# qhasm: ptr = &5y34_stack
4806 ++# asm 1: lea >ptr=int32#3,<5y34_stack=stack128#6
4807 ++# asm 2: lea >ptr=r2,<5y34_stack=[sp,#80]
4810 ++# qhasm: 5y34 aligned= mem128[ptr]
4811 ++# asm 1: vld1.8 {>5y34=reg128#13%bot->5y34=reg128#13%top},[<ptr=int32#3,: 128]
4812 ++# asm 2: vld1.8 {>5y34=d24->5y34=d25},[<ptr=r2,: 128]
4813 ++vld1.8 {d24-d25},[r2,: 128]
4815 ++# qhasm: r3[0,1] += v01[0] unsigned* y34[0]; r3[2,3] += v01[1] unsigned* y34[1]
4816 ++# asm 1: vmlal.u32 <r3=reg128#5,<v01=reg128#11%bot,<y34=reg128#3%bot
4817 ++# asm 2: vmlal.u32 <r3=q4,<v01=d20,<y34=d4
4818 ++vmlal.u32 q4,d20,d4
4820 ++# qhasm: r3[0,1] += v01[2] unsigned* y12[2]; r3[2,3] += v01[3] unsigned* y12[3]
4821 ++# asm 1: vmlal.u32 <r3=reg128#5,<v01=reg128#11%top,<y12=reg128#2%top
4822 ++# asm 2: vmlal.u32 <r3=q4,<v01=d21,<y12=d3
4823 ++vmlal.u32 q4,d21,d3
4825 ++# qhasm: r3[0,1] += v23[0] unsigned* y12[0]; r3[2,3] += v23[1] unsigned* y12[1]
4826 ++# asm 1: vmlal.u32 <r3=reg128#5,<v23=reg128#10%bot,<y12=reg128#2%bot
4827 ++# asm 2: vmlal.u32 <r3=q4,<v23=d18,<y12=d2
4828 ++vmlal.u32 q4,d18,d2
4830 ++# qhasm: r3[0,1] += v23[2] unsigned* y0[0]; r3[2,3] += v23[3] unsigned* y0[1]
4831 ++# asm 1: vmlal.u32 <r3=reg128#5,<v23=reg128#10%top,<y0=reg128#1%bot
4832 ++# asm 2: vmlal.u32 <r3=q4,<v23=d19,<y0=d0
4833 ++vmlal.u32 q4,d19,d0
4835 ++# qhasm: r3[0,1] += v4[0] unsigned* 5y34[2]; r3[2,3] += v4[1] unsigned* 5y34[3]
4836 ++# asm 1: vmlal.u32 <r3=reg128#5,<v4=reg128#4%bot,<5y34=reg128#13%top
4837 ++# asm 2: vmlal.u32 <r3=q4,<v4=d6,<5y34=d25
4838 ++vmlal.u32 q4,d6,d25
4840 ++# qhasm: ptr = &5y12_stack
4841 ++# asm 1: lea >ptr=int32#3,<5y12_stack=stack128#5
4842 ++# asm 2: lea >ptr=r2,<5y12_stack=[sp,#64]
4845 ++# qhasm: 5y12 aligned= mem128[ptr]
4846 ++# asm 1: vld1.8 {>5y12=reg128#12%bot->5y12=reg128#12%top},[<ptr=int32#3,: 128]
4847 ++# asm 2: vld1.8 {>5y12=d22->5y12=d23},[<ptr=r2,: 128]
4848 ++vld1.8 {d22-d23},[r2,: 128]
4850 ++# qhasm: r0[0,1] += v4[0] unsigned* 5y12[0]; r0[2,3] += v4[1] unsigned* 5y12[1]
4851 ++# asm 1: vmlal.u32 <r0=reg128#8,<v4=reg128#4%bot,<5y12=reg128#12%bot
4852 ++# asm 2: vmlal.u32 <r0=q7,<v4=d6,<5y12=d22
4853 ++vmlal.u32 q7,d6,d22
4855 ++# qhasm: r0[0,1] += v23[0] unsigned* 5y34[0]; r0[2,3] += v23[1] unsigned* 5y34[1]
4856 ++# asm 1: vmlal.u32 <r0=reg128#8,<v23=reg128#10%bot,<5y34=reg128#13%bot
4857 ++# asm 2: vmlal.u32 <r0=q7,<v23=d18,<5y34=d24
4858 ++vmlal.u32 q7,d18,d24
4860 ++# qhasm: r0[0,1] += v23[2] unsigned* 5y12[2]; r0[2,3] += v23[3] unsigned* 5y12[3]
4861 ++# asm 1: vmlal.u32 <r0=reg128#8,<v23=reg128#10%top,<5y12=reg128#12%top
4862 ++# asm 2: vmlal.u32 <r0=q7,<v23=d19,<5y12=d23
4863 ++vmlal.u32 q7,d19,d23
4865 ++# qhasm: r0[0,1] += v01[0] unsigned* y0[0]; r0[2,3] += v01[1] unsigned* y0[1]
4866 ++# asm 1: vmlal.u32 <r0=reg128#8,<v01=reg128#11%bot,<y0=reg128#1%bot
4867 ++# asm 2: vmlal.u32 <r0=q7,<v01=d20,<y0=d0
4868 ++vmlal.u32 q7,d20,d0
4870 ++# qhasm: r0[0,1] += v01[2] unsigned* 5y34[2]; r0[2,3] += v01[3] unsigned* 5y34[3]
4871 ++# asm 1: vmlal.u32 <r0=reg128#8,<v01=reg128#11%top,<5y34=reg128#13%top
4872 ++# asm 2: vmlal.u32 <r0=q7,<v01=d21,<5y34=d25
4873 ++vmlal.u32 q7,d21,d25
4875 ++# qhasm: r1[0,1] += v01[0] unsigned* y12[0]; r1[2,3] += v01[1] unsigned* y12[1]
4876 ++# asm 1: vmlal.u32 <r1=reg128#15,<v01=reg128#11%bot,<y12=reg128#2%bot
4877 ++# asm 2: vmlal.u32 <r1=q14,<v01=d20,<y12=d2
4878 ++vmlal.u32 q14,d20,d2
4880 ++# qhasm: r1[0,1] += v01[2] unsigned* y0[0]; r1[2,3] += v01[3] unsigned* y0[1]
4881 ++# asm 1: vmlal.u32 <r1=reg128#15,<v01=reg128#11%top,<y0=reg128#1%bot
4882 ++# asm 2: vmlal.u32 <r1=q14,<v01=d21,<y0=d0
4883 ++vmlal.u32 q14,d21,d0
4885 ++# qhasm: r1[0,1] += v23[0] unsigned* 5y34[2]; r1[2,3] += v23[1] unsigned* 5y34[3]
4886 ++# asm 1: vmlal.u32 <r1=reg128#15,<v23=reg128#10%bot,<5y34=reg128#13%top
4887 ++# asm 2: vmlal.u32 <r1=q14,<v23=d18,<5y34=d25
4888 ++vmlal.u32 q14,d18,d25
4890 ++# qhasm: r1[0,1] += v23[2] unsigned* 5y34[0]; r1[2,3] += v23[3] unsigned* 5y34[1]
4891 ++# asm 1: vmlal.u32 <r1=reg128#15,<v23=reg128#10%top,<5y34=reg128#13%bot
4892 ++# asm 2: vmlal.u32 <r1=q14,<v23=d19,<5y34=d24
4893 ++vmlal.u32 q14,d19,d24
4895 ++# qhasm: r1[0,1] += v4[0] unsigned* 5y12[2]; r1[2,3] += v4[1] unsigned* 5y12[3]
4896 ++# asm 1: vmlal.u32 <r1=reg128#15,<v4=reg128#4%bot,<5y12=reg128#12%top
4897 ++# asm 2: vmlal.u32 <r1=q14,<v4=d6,<5y12=d23
4898 ++vmlal.u32 q14,d6,d23
4900 ++# qhasm: r2[0,1] += v01[0] unsigned* y12[2]; r2[2,3] += v01[1] unsigned* y12[3]
4901 ++# asm 1: vmlal.u32 <r2=reg128#14,<v01=reg128#11%bot,<y12=reg128#2%top
4902 ++# asm 2: vmlal.u32 <r2=q13,<v01=d20,<y12=d3
4903 ++vmlal.u32 q13,d20,d3
4905 ++# qhasm: r2[0,1] += v01[2] unsigned* y12[0]; r2[2,3] += v01[3] unsigned* y12[1]
4906 ++# asm 1: vmlal.u32 <r2=reg128#14,<v01=reg128#11%top,<y12=reg128#2%bot
4907 ++# asm 2: vmlal.u32 <r2=q13,<v01=d21,<y12=d2
4908 ++vmlal.u32 q13,d21,d2
4910 ++# qhasm: r2[0,1] += v23[0] unsigned* y0[0]; r2[2,3] += v23[1] unsigned* y0[1]
4911 ++# asm 1: vmlal.u32 <r2=reg128#14,<v23=reg128#10%bot,<y0=reg128#1%bot
4912 ++# asm 2: vmlal.u32 <r2=q13,<v23=d18,<y0=d0
4913 ++vmlal.u32 q13,d18,d0
4915 ++# qhasm: r2[0,1] += v23[2] unsigned* 5y34[2]; r2[2,3] += v23[3] unsigned* 5y34[3]
4916 ++# asm 1: vmlal.u32 <r2=reg128#14,<v23=reg128#10%top,<5y34=reg128#13%top
4917 ++# asm 2: vmlal.u32 <r2=q13,<v23=d19,<5y34=d25
4918 ++vmlal.u32 q13,d19,d25
4920 ++# qhasm: r2[0,1] += v4[0] unsigned* 5y34[0]; r2[2,3] += v4[1] unsigned* 5y34[1]
4921 ++# asm 1: vmlal.u32 <r2=reg128#14,<v4=reg128#4%bot,<5y34=reg128#13%bot
4922 ++# asm 2: vmlal.u32 <r2=q13,<v4=d6,<5y34=d24
4923 ++vmlal.u32 q13,d6,d24
4925 ++# qhasm: ptr = &two24
4926 ++# asm 1: lea >ptr=int32#3,<two24=stack128#1
4927 ++# asm 2: lea >ptr=r2,<two24=[sp,#0]
4930 ++# qhasm: 2x t1 = r0 unsigned>> 26
4931 ++# asm 1: vshr.u64 >t1=reg128#4,<r0=reg128#8,#26
4932 ++# asm 2: vshr.u64 >t1=q3,<r0=q7,#26
4933 ++vshr.u64 q3,q7,#26
4935 ++# qhasm: len -= 64
4936 ++# asm 1: sub >len=int32#4,<len=int32#4,#64
4937 ++# asm 2: sub >len=r3,<len=r3,#64
4940 ++# qhasm: r0 &= mask
4941 ++# asm 1: vand >r0=reg128#6,<r0=reg128#8,<mask=reg128#7
4942 ++# asm 2: vand >r0=q5,<r0=q7,<mask=q6
4945 ++# qhasm: 2x r1 += t1
4946 ++# asm 1: vadd.i64 >r1=reg128#4,<r1=reg128#15,<t1=reg128#4
4947 ++# asm 2: vadd.i64 >r1=q3,<r1=q14,<t1=q3
4948 ++vadd.i64 q3,q14,q3
4950 ++# qhasm: 2x t4 = r3 unsigned>> 26
4951 ++# asm 1: vshr.u64 >t4=reg128#8,<r3=reg128#5,#26
4952 ++# asm 2: vshr.u64 >t4=q7,<r3=q4,#26
4953 ++vshr.u64 q7,q4,#26
4955 ++# qhasm: r3 &= mask
4956 ++# asm 1: vand >r3=reg128#5,<r3=reg128#5,<mask=reg128#7
4957 ++# asm 2: vand >r3=q4,<r3=q4,<mask=q6
4960 ++# qhasm: 2x x4 = r4 + t4
4961 ++# asm 1: vadd.i64 >x4=reg128#8,<r4=reg128#16,<t4=reg128#8
4962 ++# asm 2: vadd.i64 >x4=q7,<r4=q15,<t4=q7
4963 ++vadd.i64 q7,q15,q7
4965 ++# qhasm: r4 aligned= mem128[ptr]
4966 ++# asm 1: vld1.8 {>r4=reg128#16%bot->r4=reg128#16%top},[<ptr=int32#3,: 128]
4967 ++# asm 2: vld1.8 {>r4=d30->r4=d31},[<ptr=r2,: 128]
4968 ++vld1.8 {d30-d31},[r2,: 128]
4970 ++# qhasm: 2x t2 = r1 unsigned>> 26
4971 ++# asm 1: vshr.u64 >t2=reg128#9,<r1=reg128#4,#26
4972 ++# asm 2: vshr.u64 >t2=q8,<r1=q3,#26
4973 ++vshr.u64 q8,q3,#26
4975 ++# qhasm: r1 &= mask
4976 ++# asm 1: vand >r1=reg128#4,<r1=reg128#4,<mask=reg128#7
4977 ++# asm 2: vand >r1=q3,<r1=q3,<mask=q6
4980 ++# qhasm: 2x t0 = x4 unsigned>> 26
4981 ++# asm 1: vshr.u64 >t0=reg128#10,<x4=reg128#8,#26
4982 ++# asm 2: vshr.u64 >t0=q9,<x4=q7,#26
4983 ++vshr.u64 q9,q7,#26
4985 ++# qhasm: 2x r2 += t2
4986 ++# asm 1: vadd.i64 >r2=reg128#9,<r2=reg128#14,<t2=reg128#9
4987 ++# asm 2: vadd.i64 >r2=q8,<r2=q13,<t2=q8
4988 ++vadd.i64 q8,q13,q8
4990 ++# qhasm: x4 &= mask
4991 ++# asm 1: vand >x4=reg128#11,<x4=reg128#8,<mask=reg128#7
4992 ++# asm 2: vand >x4=q10,<x4=q7,<mask=q6
4995 ++# qhasm: 2x x01 = r0 + t0
4996 ++# asm 1: vadd.i64 >x01=reg128#6,<r0=reg128#6,<t0=reg128#10
4997 ++# asm 2: vadd.i64 >x01=q5,<r0=q5,<t0=q9
5000 ++# qhasm: r0 aligned= mem128[ptr]
5001 ++# asm 1: vld1.8 {>r0=reg128#8%bot->r0=reg128#8%top},[<ptr=int32#3,: 128]
5002 ++# asm 2: vld1.8 {>r0=d14->r0=d15},[<ptr=r2,: 128]
5003 ++vld1.8 {d14-d15},[r2,: 128]
5005 ++# qhasm: ptr = &z34_stack
5006 ++# asm 1: lea >ptr=int32#3,<z34_stack=stack128#9
5007 ++# asm 2: lea >ptr=r2,<z34_stack=[sp,#128]
5010 ++# qhasm: 2x t0 <<= 2
5011 ++# asm 1: vshl.i64 >t0=reg128#10,<t0=reg128#10,#2
5012 ++# asm 2: vshl.i64 >t0=q9,<t0=q9,#2
5015 ++# qhasm: 2x t3 = r2 unsigned>> 26
5016 ++# asm 1: vshr.u64 >t3=reg128#14,<r2=reg128#9,#26
5017 ++# asm 2: vshr.u64 >t3=q13,<r2=q8,#26
5018 ++vshr.u64 q13,q8,#26
5020 ++# qhasm: 2x x01 += t0
5021 ++# asm 1: vadd.i64 >x01=reg128#15,<x01=reg128#6,<t0=reg128#10
5022 ++# asm 2: vadd.i64 >x01=q14,<x01=q5,<t0=q9
5023 ++vadd.i64 q14,q5,q9
5025 ++# qhasm: z34 aligned= mem128[ptr]
5026 ++# asm 1: vld1.8 {>z34=reg128#6%bot->z34=reg128#6%top},[<ptr=int32#3,: 128]
5027 ++# asm 2: vld1.8 {>z34=d10->z34=d11},[<ptr=r2,: 128]
5028 ++vld1.8 {d10-d11},[r2,: 128]
5030 ++# qhasm: x23 = r2 & mask
5031 ++# asm 1: vand >x23=reg128#10,<r2=reg128#9,<mask=reg128#7
5032 ++# asm 2: vand >x23=q9,<r2=q8,<mask=q6
5035 ++# qhasm: 2x r3 += t3
5036 ++# asm 1: vadd.i64 >r3=reg128#5,<r3=reg128#5,<t3=reg128#14
5037 ++# asm 2: vadd.i64 >r3=q4,<r3=q4,<t3=q13
5038 ++vadd.i64 q4,q4,q13
5040 ++# qhasm: input_2 += 32
5041 ++# asm 1: add >input_2=int32#2,<input_2=int32#2,#32
5042 ++# asm 2: add >input_2=r1,<input_2=r1,#32
5045 ++# qhasm: 2x t1 = x01 unsigned>> 26
5046 ++# asm 1: vshr.u64 >t1=reg128#14,<x01=reg128#15,#26
5047 ++# asm 2: vshr.u64 >t1=q13,<x01=q14,#26
5048 ++vshr.u64 q13,q14,#26
5050 ++# qhasm: x23 = x23[0,2,1,3]
5051 ++# asm 1: vtrn.32 <x23=reg128#10%bot,<x23=reg128#10%top
5052 ++# asm 2: vtrn.32 <x23=d18,<x23=d19
5055 ++# qhasm: x01 = x01 & mask
5056 ++# asm 1: vand >x01=reg128#9,<x01=reg128#15,<mask=reg128#7
5057 ++# asm 2: vand >x01=q8,<x01=q14,<mask=q6
5060 ++# qhasm: 2x r1 += t1
5061 ++# asm 1: vadd.i64 >r1=reg128#4,<r1=reg128#4,<t1=reg128#14
5062 ++# asm 2: vadd.i64 >r1=q3,<r1=q3,<t1=q13
5063 ++vadd.i64 q3,q3,q13
5065 ++# qhasm: 2x t4 = r3 unsigned>> 26
5066 ++# asm 1: vshr.u64 >t4=reg128#14,<r3=reg128#5,#26
5067 ++# asm 2: vshr.u64 >t4=q13,<r3=q4,#26
5068 ++vshr.u64 q13,q4,#26
5070 ++# qhasm: x01 = x01[0,2,1,3]
5071 ++# asm 1: vtrn.32 <x01=reg128#9%bot,<x01=reg128#9%top
5072 ++# asm 2: vtrn.32 <x01=d16,<x01=d17
5075 ++# qhasm: r3 &= mask
5076 ++# asm 1: vand >r3=reg128#5,<r3=reg128#5,<mask=reg128#7
5077 ++# asm 2: vand >r3=q4,<r3=q4,<mask=q6
5080 ++# qhasm: r1 = r1[0,2,1,3]
5081 ++# asm 1: vtrn.32 <r1=reg128#4%bot,<r1=reg128#4%top
5082 ++# asm 2: vtrn.32 <r1=d6,<r1=d7
5085 ++# qhasm: 2x x4 += t4
5086 ++# asm 1: vadd.i64 >x4=reg128#11,<x4=reg128#11,<t4=reg128#14
5087 ++# asm 2: vadd.i64 >x4=q10,<x4=q10,<t4=q13
5088 ++vadd.i64 q10,q10,q13
5090 ++# qhasm: r3 = r3[0,2,1,3]
5091 ++# asm 1: vtrn.32 <r3=reg128#5%bot,<r3=reg128#5%top
5092 ++# asm 2: vtrn.32 <r3=d8,<r3=d9
5095 ++# qhasm: x01 = x01[0,1] r1[0,1]
5096 ++# asm 1: vext.32 <x01=reg128#9%top,<r1=reg128#4%bot,<r1=reg128#4%bot,#0
5097 ++# asm 2: vext.32 <x01=d17,<r1=d6,<r1=d6,#0
5098 ++vext.32 d17,d6,d6,#0
5100 ++# qhasm: x23 = x23[0,1] r3[0,1]
5101 ++# asm 1: vext.32 <x23=reg128#10%top,<r3=reg128#5%bot,<r3=reg128#5%bot,#0
5102 ++# asm 2: vext.32 <x23=d19,<r3=d8,<r3=d8,#0
5103 ++vext.32 d19,d8,d8,#0
5105 ++# qhasm: x4 = x4[0,2,1,3]
5106 ++# asm 1: vtrn.32 <x4=reg128#11%bot,<x4=reg128#11%top
5107 ++# asm 2: vtrn.32 <x4=d20,<x4=d21
5110 ++# qhasm: unsigned>? len - 64
5111 ++# asm 1: cmp <len=int32#4,#64
5112 ++# asm 2: cmp <len=r3,#64
5115 ++# qhasm: goto mainloop2 if unsigned>
5118 ++# qhasm: input_2 -= 32
5119 ++# asm 1: sub >input_2=int32#3,<input_2=int32#2,#32
5120 ++# asm 2: sub >input_2=r2,<input_2=r1,#32
5123 ++# qhasm: below64bytes:
5126 ++# qhasm: unsigned>? len - 32
5127 ++# asm 1: cmp <len=int32#4,#32
5128 ++# asm 2: cmp <len=r3,#32
5131 ++# qhasm: goto end if !unsigned>
5134 ++# qhasm: mainloop:
5139 ++# qhasm: ptr = &two24
5140 ++# asm 1: lea >ptr=int32#2,<two24=stack128#1
5141 ++# asm 2: lea >ptr=r1,<two24=[sp,#0]
5144 ++# qhasm: r4 aligned= mem128[ptr]
5145 ++# asm 1: vld1.8 {>r4=reg128#5%bot->r4=reg128#5%top},[<ptr=int32#2,: 128]
5146 ++# asm 2: vld1.8 {>r4=d8->r4=d9},[<ptr=r1,: 128]
5147 ++vld1.8 {d8-d9},[r1,: 128]
5149 ++# qhasm: u4 aligned= mem128[ptr]
5150 ++# asm 1: vld1.8 {>u4=reg128#6%bot->u4=reg128#6%top},[<ptr=int32#2,: 128]
5151 ++# asm 2: vld1.8 {>u4=d10->u4=d11},[<ptr=r1,: 128]
5152 ++vld1.8 {d10-d11},[r1,: 128]
5154 ++# qhasm: c01 = mem128[input_2];input_2+=16
5155 ++# asm 1: vld1.8 {>c01=reg128#8%bot->c01=reg128#8%top},[<input_2=int32#3]!
5156 ++# asm 2: vld1.8 {>c01=d14->c01=d15},[<input_2=r2]!
5157 ++vld1.8 {d14-d15},[r2]!
5159 ++# qhasm: r4[0,1] += x01[0] unsigned* y34[2]; r4[2,3] += x01[1] unsigned* y34[3]
5160 ++# asm 1: vmlal.u32 <r4=reg128#5,<x01=reg128#9%bot,<y34=reg128#3%top
5161 ++# asm 2: vmlal.u32 <r4=q4,<x01=d16,<y34=d5
5162 ++vmlal.u32 q4,d16,d5
5164 ++# qhasm: c23 = mem128[input_2];input_2+=16
5165 ++# asm 1: vld1.8 {>c23=reg128#14%bot->c23=reg128#14%top},[<input_2=int32#3]!
5166 ++# asm 2: vld1.8 {>c23=d26->c23=d27},[<input_2=r2]!
5167 ++vld1.8 {d26-d27},[r2]!
5169 ++# qhasm: r4[0,1] += x01[2] unsigned* y34[0]; r4[2,3] += x01[3] unsigned* y34[1]
5170 ++# asm 1: vmlal.u32 <r4=reg128#5,<x01=reg128#9%top,<y34=reg128#3%bot
5171 ++# asm 2: vmlal.u32 <r4=q4,<x01=d17,<y34=d4
5172 ++vmlal.u32 q4,d17,d4
5174 ++# qhasm: r0 = u4[1]c01[0]r0[2,3]
5175 ++# asm 1: vext.32 <r0=reg128#4%bot,<u4=reg128#6%bot,<c01=reg128#8%bot,#1
5176 ++# asm 2: vext.32 <r0=d6,<u4=d10,<c01=d14,#1
5177 ++vext.32 d6,d10,d14,#1
5179 ++# qhasm: r4[0,1] += x23[0] unsigned* y12[2]; r4[2,3] += x23[1] unsigned* y12[3]
5180 ++# asm 1: vmlal.u32 <r4=reg128#5,<x23=reg128#10%bot,<y12=reg128#2%top
5181 ++# asm 2: vmlal.u32 <r4=q4,<x23=d18,<y12=d3
5182 ++vmlal.u32 q4,d18,d3
5184 ++# qhasm: r0 = r0[0,1]u4[1]c23[0]
5185 ++# asm 1: vext.32 <r0=reg128#4%top,<u4=reg128#6%bot,<c23=reg128#14%bot,#1
5186 ++# asm 2: vext.32 <r0=d7,<u4=d10,<c23=d26,#1
5187 ++vext.32 d7,d10,d26,#1
5189 ++# qhasm: r4[0,1] += x23[2] unsigned* y12[0]; r4[2,3] += x23[3] unsigned* y12[1]
5190 ++# asm 1: vmlal.u32 <r4=reg128#5,<x23=reg128#10%top,<y12=reg128#2%bot
5191 ++# asm 2: vmlal.u32 <r4=q4,<x23=d19,<y12=d2
5192 ++vmlal.u32 q4,d19,d2
5194 ++# qhasm: r0 = r0[1]r0[0]r0[3]r0[2]
5195 ++# asm 1: vrev64.i32 >r0=reg128#4,<r0=reg128#4
5196 ++# asm 2: vrev64.i32 >r0=q3,<r0=q3
5199 ++# qhasm: r4[0,1] += x4[0] unsigned* y0[0]; r4[2,3] += x4[1] unsigned* y0[1]
5200 ++# asm 1: vmlal.u32 <r4=reg128#5,<x4=reg128#11%bot,<y0=reg128#1%bot
5201 ++# asm 2: vmlal.u32 <r4=q4,<x4=d20,<y0=d0
5202 ++vmlal.u32 q4,d20,d0
5204 ++# qhasm: r0[0,1] += x4[0] unsigned* 5y12[0]; r0[2,3] += x4[1] unsigned* 5y12[1]
5205 ++# asm 1: vmlal.u32 <r0=reg128#4,<x4=reg128#11%bot,<5y12=reg128#12%bot
5206 ++# asm 2: vmlal.u32 <r0=q3,<x4=d20,<5y12=d22
5207 ++vmlal.u32 q3,d20,d22
5209 ++# qhasm: r0[0,1] += x23[0] unsigned* 5y34[0]; r0[2,3] += x23[1] unsigned* 5y34[1]
5210 ++# asm 1: vmlal.u32 <r0=reg128#4,<x23=reg128#10%bot,<5y34=reg128#13%bot
5211 ++# asm 2: vmlal.u32 <r0=q3,<x23=d18,<5y34=d24
5212 ++vmlal.u32 q3,d18,d24
5214 ++# qhasm: r0[0,1] += x23[2] unsigned* 5y12[2]; r0[2,3] += x23[3] unsigned* 5y12[3]
5215 ++# asm 1: vmlal.u32 <r0=reg128#4,<x23=reg128#10%top,<5y12=reg128#12%top
5216 ++# asm 2: vmlal.u32 <r0=q3,<x23=d19,<5y12=d23
5217 ++vmlal.u32 q3,d19,d23
5219 ++# qhasm: c01 c23 = c01[0]c23[0]c01[2]c23[2]c01[1]c23[1]c01[3]c23[3]
5220 ++# asm 1: vtrn.32 <c01=reg128#8,<c23=reg128#14
5221 ++# asm 2: vtrn.32 <c01=q7,<c23=q13
5224 ++# qhasm: r0[0,1] += x01[0] unsigned* y0[0]; r0[2,3] += x01[1] unsigned* y0[1]
5225 ++# asm 1: vmlal.u32 <r0=reg128#4,<x01=reg128#9%bot,<y0=reg128#1%bot
5226 ++# asm 2: vmlal.u32 <r0=q3,<x01=d16,<y0=d0
5227 ++vmlal.u32 q3,d16,d0
5229 ++# qhasm: r3[0,1] = c23[2]<<18; r3[2,3] = c23[3]<<18
5230 ++# asm 1: vshll.u32 >r3=reg128#6,<c23=reg128#14%top,#18
5231 ++# asm 2: vshll.u32 >r3=q5,<c23=d27,#18
5232 ++vshll.u32 q5,d27,#18
5234 ++# qhasm: r0[0,1] += x01[2] unsigned* 5y34[2]; r0[2,3] += x01[3] unsigned* 5y34[3]
5235 ++# asm 1: vmlal.u32 <r0=reg128#4,<x01=reg128#9%top,<5y34=reg128#13%top
5236 ++# asm 2: vmlal.u32 <r0=q3,<x01=d17,<5y34=d25
5237 ++vmlal.u32 q3,d17,d25
5239 ++# qhasm: r3[0,1] += x01[0] unsigned* y34[0]; r3[2,3] += x01[1] unsigned* y34[1]
5240 ++# asm 1: vmlal.u32 <r3=reg128#6,<x01=reg128#9%bot,<y34=reg128#3%bot
5241 ++# asm 2: vmlal.u32 <r3=q5,<x01=d16,<y34=d4
5242 ++vmlal.u32 q5,d16,d4
5244 ++# qhasm: r3[0,1] += x01[2] unsigned* y12[2]; r3[2,3] += x01[3] unsigned* y12[3]
5245 ++# asm 1: vmlal.u32 <r3=reg128#6,<x01=reg128#9%top,<y12=reg128#2%top
5246 ++# asm 2: vmlal.u32 <r3=q5,<x01=d17,<y12=d3
5247 ++vmlal.u32 q5,d17,d3
5249 ++# qhasm: r3[0,1] += x23[0] unsigned* y12[0]; r3[2,3] += x23[1] unsigned* y12[1]
5250 ++# asm 1: vmlal.u32 <r3=reg128#6,<x23=reg128#10%bot,<y12=reg128#2%bot
5251 ++# asm 2: vmlal.u32 <r3=q5,<x23=d18,<y12=d2
5252 ++vmlal.u32 q5,d18,d2
5254 ++# qhasm: r3[0,1] += x23[2] unsigned* y0[0]; r3[2,3] += x23[3] unsigned* y0[1]
5255 ++# asm 1: vmlal.u32 <r3=reg128#6,<x23=reg128#10%top,<y0=reg128#1%bot
5256 ++# asm 2: vmlal.u32 <r3=q5,<x23=d19,<y0=d0
5257 ++vmlal.u32 q5,d19,d0
5259 ++# qhasm: r1[0,1] = c23[0]<<6; r1[2,3] = c23[1]<<6
5260 ++# asm 1: vshll.u32 >r1=reg128#14,<c23=reg128#14%bot,#6
5261 ++# asm 2: vshll.u32 >r1=q13,<c23=d26,#6
5262 ++vshll.u32 q13,d26,#6
5264 ++# qhasm: r3[0,1] += x4[0] unsigned* 5y34[2]; r3[2,3] += x4[1] unsigned* 5y34[3]
5265 ++# asm 1: vmlal.u32 <r3=reg128#6,<x4=reg128#11%bot,<5y34=reg128#13%top
5266 ++# asm 2: vmlal.u32 <r3=q5,<x4=d20,<5y34=d25
5267 ++vmlal.u32 q5,d20,d25
5269 ++# qhasm: r1[0,1] += x01[0] unsigned* y12[0]; r1[2,3] += x01[1] unsigned* y12[1]
5270 ++# asm 1: vmlal.u32 <r1=reg128#14,<x01=reg128#9%bot,<y12=reg128#2%bot
5271 ++# asm 2: vmlal.u32 <r1=q13,<x01=d16,<y12=d2
5272 ++vmlal.u32 q13,d16,d2
5274 ++# qhasm: r1[0,1] += x01[2] unsigned* y0[0]; r1[2,3] += x01[3] unsigned* y0[1]
5275 ++# asm 1: vmlal.u32 <r1=reg128#14,<x01=reg128#9%top,<y0=reg128#1%bot
5276 ++# asm 2: vmlal.u32 <r1=q13,<x01=d17,<y0=d0
5277 ++vmlal.u32 q13,d17,d0
5279 ++# qhasm: r1[0,1] += x23[0] unsigned* 5y34[2]; r1[2,3] += x23[1] unsigned* 5y34[3]
5280 ++# asm 1: vmlal.u32 <r1=reg128#14,<x23=reg128#10%bot,<5y34=reg128#13%top
5281 ++# asm 2: vmlal.u32 <r1=q13,<x23=d18,<5y34=d25
5282 ++vmlal.u32 q13,d18,d25
5284 ++# qhasm: r1[0,1] += x23[2] unsigned* 5y34[0]; r1[2,3] += x23[3] unsigned* 5y34[1]
5285 ++# asm 1: vmlal.u32 <r1=reg128#14,<x23=reg128#10%top,<5y34=reg128#13%bot
5286 ++# asm 2: vmlal.u32 <r1=q13,<x23=d19,<5y34=d24
5287 ++vmlal.u32 q13,d19,d24
5289 ++# qhasm: r2[0,1] = c01[2]<<12; r2[2,3] = c01[3]<<12
5290 ++# asm 1: vshll.u32 >r2=reg128#8,<c01=reg128#8%top,#12
5291 ++# asm 2: vshll.u32 >r2=q7,<c01=d15,#12
5292 ++vshll.u32 q7,d15,#12
5294 ++# qhasm: r1[0,1] += x4[0] unsigned* 5y12[2]; r1[2,3] += x4[1] unsigned* 5y12[3]
5295 ++# asm 1: vmlal.u32 <r1=reg128#14,<x4=reg128#11%bot,<5y12=reg128#12%top
5296 ++# asm 2: vmlal.u32 <r1=q13,<x4=d20,<5y12=d23
5297 ++vmlal.u32 q13,d20,d23
5299 ++# qhasm: r2[0,1] += x01[0] unsigned* y12[2]; r2[2,3] += x01[1] unsigned* y12[3]
5300 ++# asm 1: vmlal.u32 <r2=reg128#8,<x01=reg128#9%bot,<y12=reg128#2%top
5301 ++# asm 2: vmlal.u32 <r2=q7,<x01=d16,<y12=d3
5302 ++vmlal.u32 q7,d16,d3
5304 ++# qhasm: r2[0,1] += x01[2] unsigned* y12[0]; r2[2,3] += x01[3] unsigned* y12[1]
5305 ++# asm 1: vmlal.u32 <r2=reg128#8,<x01=reg128#9%top,<y12=reg128#2%bot
5306 ++# asm 2: vmlal.u32 <r2=q7,<x01=d17,<y12=d2
5307 ++vmlal.u32 q7,d17,d2
5309 ++# qhasm: r2[0,1] += x23[0] unsigned* y0[0]; r2[2,3] += x23[1] unsigned* y0[1]
5310 ++# asm 1: vmlal.u32 <r2=reg128#8,<x23=reg128#10%bot,<y0=reg128#1%bot
5311 ++# asm 2: vmlal.u32 <r2=q7,<x23=d18,<y0=d0
5312 ++vmlal.u32 q7,d18,d0
5314 ++# qhasm: r2[0,1] += x23[2] unsigned* 5y34[2]; r2[2,3] += x23[3] unsigned* 5y34[3]
5315 ++# asm 1: vmlal.u32 <r2=reg128#8,<x23=reg128#10%top,<5y34=reg128#13%top
5316 ++# asm 2: vmlal.u32 <r2=q7,<x23=d19,<5y34=d25
5317 ++vmlal.u32 q7,d19,d25
5319 ++# qhasm: r2[0,1] += x4[0] unsigned* 5y34[0]; r2[2,3] += x4[1] unsigned* 5y34[1]
5320 ++# asm 1: vmlal.u32 <r2=reg128#8,<x4=reg128#11%bot,<5y34=reg128#13%bot
5321 ++# asm 2: vmlal.u32 <r2=q7,<x4=d20,<5y34=d24
5322 ++vmlal.u32 q7,d20,d24
5324 ++# qhasm: 2x t1 = r0 unsigned>> 26
5325 ++# asm 1: vshr.u64 >t1=reg128#9,<r0=reg128#4,#26
5326 ++# asm 2: vshr.u64 >t1=q8,<r0=q3,#26
5327 ++vshr.u64 q8,q3,#26
5329 ++# qhasm: r0 &= mask
5330 ++# asm 1: vand >r0=reg128#4,<r0=reg128#4,<mask=reg128#7
5331 ++# asm 2: vand >r0=q3,<r0=q3,<mask=q6
5334 ++# qhasm: 2x r1 += t1
5335 ++# asm 1: vadd.i64 >r1=reg128#9,<r1=reg128#14,<t1=reg128#9
5336 ++# asm 2: vadd.i64 >r1=q8,<r1=q13,<t1=q8
5337 ++vadd.i64 q8,q13,q8
5339 ++# qhasm: 2x t4 = r3 unsigned>> 26
5340 ++# asm 1: vshr.u64 >t4=reg128#10,<r3=reg128#6,#26
5341 ++# asm 2: vshr.u64 >t4=q9,<r3=q5,#26
5342 ++vshr.u64 q9,q5,#26
5344 ++# qhasm: r3 &= mask
5345 ++# asm 1: vand >r3=reg128#6,<r3=reg128#6,<mask=reg128#7
5346 ++# asm 2: vand >r3=q5,<r3=q5,<mask=q6
5349 ++# qhasm: 2x r4 += t4
5350 ++# asm 1: vadd.i64 >r4=reg128#5,<r4=reg128#5,<t4=reg128#10
5351 ++# asm 2: vadd.i64 >r4=q4,<r4=q4,<t4=q9
5354 ++# qhasm: 2x t2 = r1 unsigned>> 26
5355 ++# asm 1: vshr.u64 >t2=reg128#10,<r1=reg128#9,#26
5356 ++# asm 2: vshr.u64 >t2=q9,<r1=q8,#26
5357 ++vshr.u64 q9,q8,#26
5359 ++# qhasm: r1 &= mask
5360 ++# asm 1: vand >r1=reg128#11,<r1=reg128#9,<mask=reg128#7
5361 ++# asm 2: vand >r1=q10,<r1=q8,<mask=q6
5364 ++# qhasm: 2x t0 = r4 unsigned>> 26
5365 ++# asm 1: vshr.u64 >t0=reg128#9,<r4=reg128#5,#26
5366 ++# asm 2: vshr.u64 >t0=q8,<r4=q4,#26
5367 ++vshr.u64 q8,q4,#26
5369 ++# qhasm: 2x r2 += t2
5370 ++# asm 1: vadd.i64 >r2=reg128#8,<r2=reg128#8,<t2=reg128#10
5371 ++# asm 2: vadd.i64 >r2=q7,<r2=q7,<t2=q9
5374 ++# qhasm: r4 &= mask
5375 ++# asm 1: vand >r4=reg128#5,<r4=reg128#5,<mask=reg128#7
5376 ++# asm 2: vand >r4=q4,<r4=q4,<mask=q6
5379 ++# qhasm: 2x r0 += t0
5380 ++# asm 1: vadd.i64 >r0=reg128#4,<r0=reg128#4,<t0=reg128#9
5381 ++# asm 2: vadd.i64 >r0=q3,<r0=q3,<t0=q8
5384 ++# qhasm: 2x t0 <<= 2
5385 ++# asm 1: vshl.i64 >t0=reg128#9,<t0=reg128#9,#2
5386 ++# asm 2: vshl.i64 >t0=q8,<t0=q8,#2
5389 ++# qhasm: 2x t3 = r2 unsigned>> 26
5390 ++# asm 1: vshr.u64 >t3=reg128#14,<r2=reg128#8,#26
5391 ++# asm 2: vshr.u64 >t3=q13,<r2=q7,#26
5392 ++vshr.u64 q13,q7,#26
5394 ++# qhasm: 2x r0 += t0
5395 ++# asm 1: vadd.i64 >r0=reg128#4,<r0=reg128#4,<t0=reg128#9
5396 ++# asm 2: vadd.i64 >r0=q3,<r0=q3,<t0=q8
5399 ++# qhasm: x23 = r2 & mask
5400 ++# asm 1: vand >x23=reg128#10,<r2=reg128#8,<mask=reg128#7
5401 ++# asm 2: vand >x23=q9,<r2=q7,<mask=q6
5404 ++# qhasm: 2x r3 += t3
5405 ++# asm 1: vadd.i64 >r3=reg128#6,<r3=reg128#6,<t3=reg128#14
5406 ++# asm 2: vadd.i64 >r3=q5,<r3=q5,<t3=q13
5407 ++vadd.i64 q5,q5,q13
5409 ++# qhasm: 2x t1 = r0 unsigned>> 26
5410 ++# asm 1: vshr.u64 >t1=reg128#8,<r0=reg128#4,#26
5411 ++# asm 2: vshr.u64 >t1=q7,<r0=q3,#26
5412 ++vshr.u64 q7,q3,#26
5414 ++# qhasm: x01 = r0 & mask
5415 ++# asm 1: vand >x01=reg128#9,<r0=reg128#4,<mask=reg128#7
5416 ++# asm 2: vand >x01=q8,<r0=q3,<mask=q6
5419 ++# qhasm: 2x r1 += t1
5420 ++# asm 1: vadd.i64 >r1=reg128#4,<r1=reg128#11,<t1=reg128#8
5421 ++# asm 2: vadd.i64 >r1=q3,<r1=q10,<t1=q7
5422 ++vadd.i64 q3,q10,q7
5424 ++# qhasm: 2x t4 = r3 unsigned>> 26
5425 ++# asm 1: vshr.u64 >t4=reg128#8,<r3=reg128#6,#26
5426 ++# asm 2: vshr.u64 >t4=q7,<r3=q5,#26
5427 ++vshr.u64 q7,q5,#26
5429 ++# qhasm: r3 &= mask
5430 ++# asm 1: vand >r3=reg128#6,<r3=reg128#6,<mask=reg128#7
5431 ++# asm 2: vand >r3=q5,<r3=q5,<mask=q6
5434 ++# qhasm: 2x x4 = r4 + t4
5435 ++# asm 1: vadd.i64 >x4=reg128#11,<r4=reg128#5,<t4=reg128#8
5436 ++# asm 2: vadd.i64 >x4=q10,<r4=q4,<t4=q7
5437 ++vadd.i64 q10,q4,q7
5439 ++# qhasm: len -= 32
5440 ++# asm 1: sub >len=int32#4,<len=int32#4,#32
5441 ++# asm 2: sub >len=r3,<len=r3,#32
5444 ++# qhasm: x01 = x01[0,2,1,3]
5445 ++# asm 1: vtrn.32 <x01=reg128#9%bot,<x01=reg128#9%top
5446 ++# asm 2: vtrn.32 <x01=d16,<x01=d17
5449 ++# qhasm: x23 = x23[0,2,1,3]
5450 ++# asm 1: vtrn.32 <x23=reg128#10%bot,<x23=reg128#10%top
5451 ++# asm 2: vtrn.32 <x23=d18,<x23=d19
5454 ++# qhasm: r1 = r1[0,2,1,3]
5455 ++# asm 1: vtrn.32 <r1=reg128#4%bot,<r1=reg128#4%top
5456 ++# asm 2: vtrn.32 <r1=d6,<r1=d7
5459 ++# qhasm: r3 = r3[0,2,1,3]
5460 ++# asm 1: vtrn.32 <r3=reg128#6%bot,<r3=reg128#6%top
5461 ++# asm 2: vtrn.32 <r3=d10,<r3=d11
5464 ++# qhasm: x4 = x4[0,2,1,3]
5465 ++# asm 1: vtrn.32 <x4=reg128#11%bot,<x4=reg128#11%top
5466 ++# asm 2: vtrn.32 <x4=d20,<x4=d21
5469 ++# qhasm: x01 = x01[0,1] r1[0,1]
5470 ++# asm 1: vext.32 <x01=reg128#9%top,<r1=reg128#4%bot,<r1=reg128#4%bot,#0
5471 ++# asm 2: vext.32 <x01=d17,<r1=d6,<r1=d6,#0
5472 ++vext.32 d17,d6,d6,#0
5474 ++# qhasm: x23 = x23[0,1] r3[0,1]
5475 ++# asm 1: vext.32 <x23=reg128#10%top,<r3=reg128#6%bot,<r3=reg128#6%bot,#0
5476 ++# asm 2: vext.32 <x23=d19,<r3=d10,<r3=d10,#0
5477 ++vext.32 d19,d10,d10,#0
5479 ++# qhasm: unsigned>? len - 32
5480 ++# asm 1: cmp <len=int32#4,#32
5481 ++# asm 2: cmp <len=r3,#32
5484 ++# qhasm: goto mainloop if unsigned>
5490 ++# qhasm: mem128[input_0] = x01;input_0+=16
5491 ++# asm 1: vst1.8 {<x01=reg128#9%bot-<x01=reg128#9%top},[<input_0=int32#1]!
5492 ++# asm 2: vst1.8 {<x01=d16-<x01=d17},[<input_0=r0]!
5493 ++vst1.8 {d16-d17},[r0]!
5495 ++# qhasm: mem128[input_0] = x23;input_0+=16
5496 ++# asm 1: vst1.8 {<x23=reg128#10%bot-<x23=reg128#10%top},[<input_0=int32#1]!
5497 ++# asm 2: vst1.8 {<x23=d18-<x23=d19},[<input_0=r0]!
5498 ++vst1.8 {d18-d19},[r0]!
5500 ++# qhasm: mem64[input_0] = x4[0]
5501 ++# asm 1: vst1.8 <x4=reg128#11%bot,[<input_0=int32#1]
5502 ++# asm 2: vst1.8 <x4=d20,[<input_0=r0]
5505 ++# qhasm: len = len
5506 ++# asm 1: mov >len=int32#1,<len=int32#4
5507 ++# asm 2: mov >len=r0,<len=r3
5510 ++# qhasm: qpopreturn len
5512 ++vpop {q4,q5,q6,q7}
5515 ++# qhasm: int32 input_0
5517 ++# qhasm: int32 input_1
5519 ++# qhasm: int32 input_2
5521 ++# qhasm: int32 input_3
5523 ++# qhasm: stack32 input_4
5525 ++# qhasm: stack32 input_5
5527 ++# qhasm: stack32 input_6
5529 ++# qhasm: stack32 input_7
5531 ++# qhasm: int32 caller_r4
5533 ++# qhasm: int32 caller_r5
5535 ++# qhasm: int32 caller_r6
5537 ++# qhasm: int32 caller_r7
5539 ++# qhasm: int32 caller_r8
5541 ++# qhasm: int32 caller_r9
5543 ++# qhasm: int32 caller_r10
5545 ++# qhasm: int32 caller_r11
5547 ++# qhasm: int32 caller_r12
5549 ++# qhasm: int32 caller_r14
5551 ++# qhasm: reg128 caller_q4
5553 ++# qhasm: reg128 caller_q5
5555 ++# qhasm: reg128 caller_q6
5557 ++# qhasm: reg128 caller_q7
5559 ++# qhasm: reg128 r0
5561 ++# qhasm: reg128 r1
5563 ++# qhasm: reg128 r2
5565 ++# qhasm: reg128 r3
5567 ++# qhasm: reg128 r4
5569 ++# qhasm: reg128 x01
5571 ++# qhasm: reg128 x23
5573 ++# qhasm: reg128 x4
5575 ++# qhasm: reg128 y01
5577 ++# qhasm: reg128 y23
5579 ++# qhasm: reg128 y4
5581 ++# qhasm: reg128 _5y01
5583 ++# qhasm: reg128 _5y23
5585 ++# qhasm: reg128 _5y4
5587 ++# qhasm: reg128 c01
5589 ++# qhasm: reg128 c23
5591 ++# qhasm: reg128 c4
5593 ++# qhasm: reg128 t0
5595 ++# qhasm: reg128 t1
5597 ++# qhasm: reg128 t2
5599 ++# qhasm: reg128 t3
5601 ++# qhasm: reg128 t4
5603 ++# qhasm: reg128 mask
5605 ++# qhasm: enter crypto_onetimeauth_poly1305_neon2_addmulmod
5607 ++.global openssl_poly1305_neon2_addmulmod
5608 ++.type openssl_poly1305_neon2_addmulmod STT_FUNC
5609 ++openssl_poly1305_neon2_addmulmod:
5612 ++# qhasm: 2x mask = 0xffffffff
5613 ++# asm 1: vmov.i64 >mask=reg128#1,#0xffffffff
5614 ++# asm 2: vmov.i64 >mask=q0,#0xffffffff
5615 ++vmov.i64 q0,#0xffffffff
5617 ++# qhasm: y01 aligned= mem128[input_2];input_2+=16
5618 ++# asm 1: vld1.8 {>y01=reg128#2%bot->y01=reg128#2%top},[<input_2=int32#3,: 128]!
5619 ++# asm 2: vld1.8 {>y01=d2->y01=d3},[<input_2=r2,: 128]!
5620 ++vld1.8 {d2-d3},[r2,: 128]!
5622 ++# qhasm: 4x _5y01 = y01 << 2
5623 ++# asm 1: vshl.i32 >_5y01=reg128#3,<y01=reg128#2,#2
5624 ++# asm 2: vshl.i32 >_5y01=q2,<y01=q1,#2
5627 ++# qhasm: y23 aligned= mem128[input_2];input_2+=16
5628 ++# asm 1: vld1.8 {>y23=reg128#4%bot->y23=reg128#4%top},[<input_2=int32#3,: 128]!
5629 ++# asm 2: vld1.8 {>y23=d6->y23=d7},[<input_2=r2,: 128]!
5630 ++vld1.8 {d6-d7},[r2,: 128]!
5632 ++# qhasm: 4x _5y23 = y23 << 2
5633 ++# asm 1: vshl.i32 >_5y23=reg128#9,<y23=reg128#4,#2
5634 ++# asm 2: vshl.i32 >_5y23=q8,<y23=q3,#2
5637 ++# qhasm: y4 aligned= mem64[input_2]y4[1]
5638 ++# asm 1: vld1.8 {<y4=reg128#10%bot},[<input_2=int32#3,: 64]
5639 ++# asm 2: vld1.8 {<y4=d18},[<input_2=r2,: 64]
5640 ++vld1.8 {d18},[r2,: 64]
5642 ++# qhasm: 4x _5y4 = y4 << 2
5643 ++# asm 1: vshl.i32 >_5y4=reg128#11,<y4=reg128#10,#2
5644 ++# asm 2: vshl.i32 >_5y4=q10,<y4=q9,#2
5645 ++vshl.i32 q10,q9,#2
5647 ++# qhasm: x01 aligned= mem128[input_1];input_1+=16
5648 ++# asm 1: vld1.8 {>x01=reg128#12%bot->x01=reg128#12%top},[<input_1=int32#2,: 128]!
5649 ++# asm 2: vld1.8 {>x01=d22->x01=d23},[<input_1=r1,: 128]!
5650 ++vld1.8 {d22-d23},[r1,: 128]!
5652 ++# qhasm: 4x _5y01 += y01
5653 ++# asm 1: vadd.i32 >_5y01=reg128#3,<_5y01=reg128#3,<y01=reg128#2
5654 ++# asm 2: vadd.i32 >_5y01=q2,<_5y01=q2,<y01=q1
5657 ++# qhasm: x23 aligned= mem128[input_1];input_1+=16
5658 ++# asm 1: vld1.8 {>x23=reg128#13%bot->x23=reg128#13%top},[<input_1=int32#2,: 128]!
5659 ++# asm 2: vld1.8 {>x23=d24->x23=d25},[<input_1=r1,: 128]!
5660 ++vld1.8 {d24-d25},[r1,: 128]!
5662 ++# qhasm: 4x _5y23 += y23
5663 ++# asm 1: vadd.i32 >_5y23=reg128#9,<_5y23=reg128#9,<y23=reg128#4
5664 ++# asm 2: vadd.i32 >_5y23=q8,<_5y23=q8,<y23=q3
5667 ++# qhasm: 4x _5y4 += y4
5668 ++# asm 1: vadd.i32 >_5y4=reg128#11,<_5y4=reg128#11,<y4=reg128#10
5669 ++# asm 2: vadd.i32 >_5y4=q10,<_5y4=q10,<y4=q9
5670 ++vadd.i32 q10,q10,q9
5672 ++# qhasm: c01 aligned= mem128[input_3];input_3+=16
5673 ++# asm 1: vld1.8 {>c01=reg128#14%bot->c01=reg128#14%top},[<input_3=int32#4,: 128]!
5674 ++# asm 2: vld1.8 {>c01=d26->c01=d27},[<input_3=r3,: 128]!
5675 ++vld1.8 {d26-d27},[r3,: 128]!
5677 ++# qhasm: 4x x01 += c01
5678 ++# asm 1: vadd.i32 >x01=reg128#12,<x01=reg128#12,<c01=reg128#14
5679 ++# asm 2: vadd.i32 >x01=q11,<x01=q11,<c01=q13
5680 ++vadd.i32 q11,q11,q13
5682 ++# qhasm: c23 aligned= mem128[input_3];input_3+=16
5683 ++# asm 1: vld1.8 {>c23=reg128#14%bot->c23=reg128#14%top},[<input_3=int32#4,: 128]!
5684 ++# asm 2: vld1.8 {>c23=d26->c23=d27},[<input_3=r3,: 128]!
5685 ++vld1.8 {d26-d27},[r3,: 128]!
5687 ++# qhasm: 4x x23 += c23
5688 ++# asm 1: vadd.i32 >x23=reg128#13,<x23=reg128#13,<c23=reg128#14
5689 ++# asm 2: vadd.i32 >x23=q12,<x23=q12,<c23=q13
5690 ++vadd.i32 q12,q12,q13
5692 ++# qhasm: x4 aligned= mem64[input_1]x4[1]
5693 ++# asm 1: vld1.8 {<x4=reg128#14%bot},[<input_1=int32#2,: 64]
5694 ++# asm 2: vld1.8 {<x4=d26},[<input_1=r1,: 64]
5695 ++vld1.8 {d26},[r1,: 64]
5697 ++# qhasm: 2x mask unsigned>>=6
5698 ++# asm 1: vshr.u64 >mask=reg128#1,<mask=reg128#1,#6
5699 ++# asm 2: vshr.u64 >mask=q0,<mask=q0,#6
5702 ++# qhasm: c4 aligned= mem64[input_3]c4[1]
5703 ++# asm 1: vld1.8 {<c4=reg128#15%bot},[<input_3=int32#4,: 64]
5704 ++# asm 2: vld1.8 {<c4=d28},[<input_3=r3,: 64]
5705 ++vld1.8 {d28},[r3,: 64]
5707 ++# qhasm: 4x x4 += c4
5708 ++# asm 1: vadd.i32 >x4=reg128#14,<x4=reg128#14,<c4=reg128#15
5709 ++# asm 2: vadd.i32 >x4=q13,<x4=q13,<c4=q14
5710 ++vadd.i32 q13,q13,q14
5712 ++# qhasm: r0[0,1] = x01[0] unsigned* y01[0]; r0[2,3] = x01[1] unsigned* y01[1]
5713 ++# asm 1: vmull.u32 >r0=reg128#15,<x01=reg128#12%bot,<y01=reg128#2%bot
5714 ++# asm 2: vmull.u32 >r0=q14,<x01=d22,<y01=d2
5715 ++vmull.u32 q14,d22,d2
5717 ++# qhasm: r0[0,1] += x01[2] unsigned* _5y4[0]; r0[2,3] += x01[3] unsigned* _5y4[1]
5718 ++# asm 1: vmlal.u32 <r0=reg128#15,<x01=reg128#12%top,<_5y4=reg128#11%bot
5719 ++# asm 2: vmlal.u32 <r0=q14,<x01=d23,<_5y4=d20
5720 ++vmlal.u32 q14,d23,d20
5722 ++# qhasm: r0[0,1] += x23[0] unsigned* _5y23[2]; r0[2,3] += x23[1] unsigned* _5y23[3]
5723 ++# asm 1: vmlal.u32 <r0=reg128#15,<x23=reg128#13%bot,<_5y23=reg128#9%top
5724 ++# asm 2: vmlal.u32 <r0=q14,<x23=d24,<_5y23=d17
5725 ++vmlal.u32 q14,d24,d17
5727 ++# qhasm: r0[0,1] += x23[2] unsigned* _5y23[0]; r0[2,3] += x23[3] unsigned* _5y23[1]
5728 ++# asm 1: vmlal.u32 <r0=reg128#15,<x23=reg128#13%top,<_5y23=reg128#9%bot
5729 ++# asm 2: vmlal.u32 <r0=q14,<x23=d25,<_5y23=d16
5730 ++vmlal.u32 q14,d25,d16
5732 ++# qhasm: r0[0,1] += x4[0] unsigned* _5y01[2]; r0[2,3] += x4[1] unsigned* _5y01[3]
5733 ++# asm 1: vmlal.u32 <r0=reg128#15,<x4=reg128#14%bot,<_5y01=reg128#3%top
5734 ++# asm 2: vmlal.u32 <r0=q14,<x4=d26,<_5y01=d5
5735 ++vmlal.u32 q14,d26,d5
5737 ++# qhasm: r1[0,1] = x01[0] unsigned* y01[2]; r1[2,3] = x01[1] unsigned* y01[3]
5738 ++# asm 1: vmull.u32 >r1=reg128#3,<x01=reg128#12%bot,<y01=reg128#2%top
5739 ++# asm 2: vmull.u32 >r1=q2,<x01=d22,<y01=d3
5740 ++vmull.u32 q2,d22,d3
5742 ++# qhasm: r1[0,1] += x01[2] unsigned* y01[0]; r1[2,3] += x01[3] unsigned* y01[1]
5743 ++# asm 1: vmlal.u32 <r1=reg128#3,<x01=reg128#12%top,<y01=reg128#2%bot
5744 ++# asm 2: vmlal.u32 <r1=q2,<x01=d23,<y01=d2
5745 ++vmlal.u32 q2,d23,d2
5747 ++# qhasm: r1[0,1] += x23[0] unsigned* _5y4[0]; r1[2,3] += x23[1] unsigned* _5y4[1]
5748 ++# asm 1: vmlal.u32 <r1=reg128#3,<x23=reg128#13%bot,<_5y4=reg128#11%bot
5749 ++# asm 2: vmlal.u32 <r1=q2,<x23=d24,<_5y4=d20
5750 ++vmlal.u32 q2,d24,d20
5752 ++# qhasm: r1[0,1] += x23[2] unsigned* _5y23[2]; r1[2,3] += x23[3] unsigned* _5y23[3]
5753 ++# asm 1: vmlal.u32 <r1=reg128#3,<x23=reg128#13%top,<_5y23=reg128#9%top
5754 ++# asm 2: vmlal.u32 <r1=q2,<x23=d25,<_5y23=d17
5755 ++vmlal.u32 q2,d25,d17
5757 ++# qhasm: r1[0,1] += x4[0] unsigned* _5y23[0]; r1[2,3] += x4[1] unsigned* _5y23[1]
5758 ++# asm 1: vmlal.u32 <r1=reg128#3,<x4=reg128#14%bot,<_5y23=reg128#9%bot
5759 ++# asm 2: vmlal.u32 <r1=q2,<x4=d26,<_5y23=d16
5760 ++vmlal.u32 q2,d26,d16
5762 ++# qhasm: r2[0,1] = x01[0] unsigned* y23[0]; r2[2,3] = x01[1] unsigned* y23[1]
5763 ++# asm 1: vmull.u32 >r2=reg128#16,<x01=reg128#12%bot,<y23=reg128#4%bot
5764 ++# asm 2: vmull.u32 >r2=q15,<x01=d22,<y23=d6
5765 ++vmull.u32 q15,d22,d6
5767 ++# qhasm: r2[0,1] += x01[2] unsigned* y01[2]; r2[2,3] += x01[3] unsigned* y01[3]
5768 ++# asm 1: vmlal.u32 <r2=reg128#16,<x01=reg128#12%top,<y01=reg128#2%top
5769 ++# asm 2: vmlal.u32 <r2=q15,<x01=d23,<y01=d3
5770 ++vmlal.u32 q15,d23,d3
5772 ++# qhasm: r2[0,1] += x23[0] unsigned* y01[0]; r2[2,3] += x23[1] unsigned* y01[1]
5773 ++# asm 1: vmlal.u32 <r2=reg128#16,<x23=reg128#13%bot,<y01=reg128#2%bot
5774 ++# asm 2: vmlal.u32 <r2=q15,<x23=d24,<y01=d2
5775 ++vmlal.u32 q15,d24,d2
5777 ++# qhasm: r2[0,1] += x23[2] unsigned* _5y4[0]; r2[2,3] += x23[3] unsigned* _5y4[1]
5778 ++# asm 1: vmlal.u32 <r2=reg128#16,<x23=reg128#13%top,<_5y4=reg128#11%bot
5779 ++# asm 2: vmlal.u32 <r2=q15,<x23=d25,<_5y4=d20
5780 ++vmlal.u32 q15,d25,d20
5782 ++# qhasm: r2[0,1] += x4[0] unsigned* _5y23[2]; r2[2,3] += x4[1] unsigned* _5y23[3]
5783 ++# asm 1: vmlal.u32 <r2=reg128#16,<x4=reg128#14%bot,<_5y23=reg128#9%top
5784 ++# asm 2: vmlal.u32 <r2=q15,<x4=d26,<_5y23=d17
5785 ++vmlal.u32 q15,d26,d17
5787 ++# qhasm: r3[0,1] = x01[0] unsigned* y23[2]; r3[2,3] = x01[1] unsigned* y23[3]
5788 ++# asm 1: vmull.u32 >r3=reg128#9,<x01=reg128#12%bot,<y23=reg128#4%top
5789 ++# asm 2: vmull.u32 >r3=q8,<x01=d22,<y23=d7
5790 ++vmull.u32 q8,d22,d7
5792 ++# qhasm: r3[0,1] += x01[2] unsigned* y23[0]; r3[2,3] += x01[3] unsigned* y23[1]
5793 ++# asm 1: vmlal.u32 <r3=reg128#9,<x01=reg128#12%top,<y23=reg128#4%bot
5794 ++# asm 2: vmlal.u32 <r3=q8,<x01=d23,<y23=d6
5795 ++vmlal.u32 q8,d23,d6
5797 ++# qhasm: r3[0,1] += x23[0] unsigned* y01[2]; r3[2,3] += x23[1] unsigned* y01[3]
5798 ++# asm 1: vmlal.u32 <r3=reg128#9,<x23=reg128#13%bot,<y01=reg128#2%top
5799 ++# asm 2: vmlal.u32 <r3=q8,<x23=d24,<y01=d3
5800 ++vmlal.u32 q8,d24,d3
5802 ++# qhasm: r3[0,1] += x23[2] unsigned* y01[0]; r3[2,3] += x23[3] unsigned* y01[1]
5803 ++# asm 1: vmlal.u32 <r3=reg128#9,<x23=reg128#13%top,<y01=reg128#2%bot
5804 ++# asm 2: vmlal.u32 <r3=q8,<x23=d25,<y01=d2
5805 ++vmlal.u32 q8,d25,d2
5807 ++# qhasm: r3[0,1] += x4[0] unsigned* _5y4[0]; r3[2,3] += x4[1] unsigned* _5y4[1]
5808 ++# asm 1: vmlal.u32 <r3=reg128#9,<x4=reg128#14%bot,<_5y4=reg128#11%bot
5809 ++# asm 2: vmlal.u32 <r3=q8,<x4=d26,<_5y4=d20
5810 ++vmlal.u32 q8,d26,d20
5812 ++# qhasm: r4[0,1] = x01[0] unsigned* y4[0]; r4[2,3] = x01[1] unsigned* y4[1]
5813 ++# asm 1: vmull.u32 >r4=reg128#10,<x01=reg128#12%bot,<y4=reg128#10%bot
5814 ++# asm 2: vmull.u32 >r4=q9,<x01=d22,<y4=d18
5815 ++vmull.u32 q9,d22,d18
5817 ++# qhasm: r4[0,1] += x01[2] unsigned* y23[2]; r4[2,3] += x01[3] unsigned* y23[3]
5818 ++# asm 1: vmlal.u32 <r4=reg128#10,<x01=reg128#12%top,<y23=reg128#4%top
5819 ++# asm 2: vmlal.u32 <r4=q9,<x01=d23,<y23=d7
5820 ++vmlal.u32 q9,d23,d7
5822 ++# qhasm: r4[0,1] += x23[0] unsigned* y23[0]; r4[2,3] += x23[1] unsigned* y23[1]
5823 ++# asm 1: vmlal.u32 <r4=reg128#10,<x23=reg128#13%bot,<y23=reg128#4%bot
5824 ++# asm 2: vmlal.u32 <r4=q9,<x23=d24,<y23=d6
5825 ++vmlal.u32 q9,d24,d6
5827 ++# qhasm: r4[0,1] += x23[2] unsigned* y01[2]; r4[2,3] += x23[3] unsigned* y01[3]
5828 ++# asm 1: vmlal.u32 <r4=reg128#10,<x23=reg128#13%top,<y01=reg128#2%top
5829 ++# asm 2: vmlal.u32 <r4=q9,<x23=d25,<y01=d3
5830 ++vmlal.u32 q9,d25,d3
5832 ++# qhasm: r4[0,1] += x4[0] unsigned* y01[0]; r4[2,3] += x4[1] unsigned* y01[1]
5833 ++# asm 1: vmlal.u32 <r4=reg128#10,<x4=reg128#14%bot,<y01=reg128#2%bot
5834 ++# asm 2: vmlal.u32 <r4=q9,<x4=d26,<y01=d2
5835 ++vmlal.u32 q9,d26,d2
5837 ++# qhasm: 2x t1 = r0 unsigned>> 26
5838 ++# asm 1: vshr.u64 >t1=reg128#2,<r0=reg128#15,#26
5839 ++# asm 2: vshr.u64 >t1=q1,<r0=q14,#26
5840 ++vshr.u64 q1,q14,#26
5842 ++# qhasm: r0 &= mask
5843 ++# asm 1: vand >r0=reg128#4,<r0=reg128#15,<mask=reg128#1
5844 ++# asm 2: vand >r0=q3,<r0=q14,<mask=q0
5847 ++# qhasm: 2x r1 += t1
5848 ++# asm 1: vadd.i64 >r1=reg128#2,<r1=reg128#3,<t1=reg128#2
5849 ++# asm 2: vadd.i64 >r1=q1,<r1=q2,<t1=q1
5852 ++# qhasm: 2x t4 = r3 unsigned>> 26
5853 ++# asm 1: vshr.u64 >t4=reg128#3,<r3=reg128#9,#26
5854 ++# asm 2: vshr.u64 >t4=q2,<r3=q8,#26
5855 ++vshr.u64 q2,q8,#26
5857 ++# qhasm: r3 &= mask
5858 ++# asm 1: vand >r3=reg128#9,<r3=reg128#9,<mask=reg128#1
5859 ++# asm 2: vand >r3=q8,<r3=q8,<mask=q0
5862 ++# qhasm: 2x r4 += t4
5863 ++# asm 1: vadd.i64 >r4=reg128#3,<r4=reg128#10,<t4=reg128#3
5864 ++# asm 2: vadd.i64 >r4=q2,<r4=q9,<t4=q2
5867 ++# qhasm: 2x t2 = r1 unsigned>> 26
5868 ++# asm 1: vshr.u64 >t2=reg128#10,<r1=reg128#2,#26
5869 ++# asm 2: vshr.u64 >t2=q9,<r1=q1,#26
5870 ++vshr.u64 q9,q1,#26
5872 ++# qhasm: r1 &= mask
5873 ++# asm 1: vand >r1=reg128#2,<r1=reg128#2,<mask=reg128#1
5874 ++# asm 2: vand >r1=q1,<r1=q1,<mask=q0
5877 ++# qhasm: 2x t0 = r4 unsigned>> 26
5878 ++# asm 1: vshr.u64 >t0=reg128#11,<r4=reg128#3,#26
5879 ++# asm 2: vshr.u64 >t0=q10,<r4=q2,#26
5880 ++vshr.u64 q10,q2,#26
5882 ++# qhasm: 2x r2 += t2
5883 ++# asm 1: vadd.i64 >r2=reg128#10,<r2=reg128#16,<t2=reg128#10
5884 ++# asm 2: vadd.i64 >r2=q9,<r2=q15,<t2=q9
5885 ++vadd.i64 q9,q15,q9
5887 ++# qhasm: r4 &= mask
5888 ++# asm 1: vand >r4=reg128#3,<r4=reg128#3,<mask=reg128#1
5889 ++# asm 2: vand >r4=q2,<r4=q2,<mask=q0
5892 ++# qhasm: 2x r0 += t0
5893 ++# asm 1: vadd.i64 >r0=reg128#4,<r0=reg128#4,<t0=reg128#11
5894 ++# asm 2: vadd.i64 >r0=q3,<r0=q3,<t0=q10
5895 ++vadd.i64 q3,q3,q10
5897 ++# qhasm: 2x t0 <<= 2
5898 ++# asm 1: vshl.i64 >t0=reg128#11,<t0=reg128#11,#2
5899 ++# asm 2: vshl.i64 >t0=q10,<t0=q10,#2
5900 ++vshl.i64 q10,q10,#2
5902 ++# qhasm: 2x t3 = r2 unsigned>> 26
5903 ++# asm 1: vshr.u64 >t3=reg128#12,<r2=reg128#10,#26
5904 ++# asm 2: vshr.u64 >t3=q11,<r2=q9,#26
5905 ++vshr.u64 q11,q9,#26
5907 ++# qhasm: 2x r0 += t0
5908 ++# asm 1: vadd.i64 >r0=reg128#4,<r0=reg128#4,<t0=reg128#11
5909 ++# asm 2: vadd.i64 >r0=q3,<r0=q3,<t0=q10
5910 ++vadd.i64 q3,q3,q10
5912 ++# qhasm: x23 = r2 & mask
5913 ++# asm 1: vand >x23=reg128#10,<r2=reg128#10,<mask=reg128#1
5914 ++# asm 2: vand >x23=q9,<r2=q9,<mask=q0
5917 ++# qhasm: 2x r3 += t3
5918 ++# asm 1: vadd.i64 >r3=reg128#9,<r3=reg128#9,<t3=reg128#12
5919 ++# asm 2: vadd.i64 >r3=q8,<r3=q8,<t3=q11
5920 ++vadd.i64 q8,q8,q11
5922 ++# qhasm: 2x t1 = r0 unsigned>> 26
5923 ++# asm 1: vshr.u64 >t1=reg128#11,<r0=reg128#4,#26
5924 ++# asm 2: vshr.u64 >t1=q10,<r0=q3,#26
5925 ++vshr.u64 q10,q3,#26
5927 ++# qhasm: x23 = x23[0,2,1,3]
5928 ++# asm 1: vtrn.32 <x23=reg128#10%bot,<x23=reg128#10%top
5929 ++# asm 2: vtrn.32 <x23=d18,<x23=d19
5932 ++# qhasm: x01 = r0 & mask
5933 ++# asm 1: vand >x01=reg128#4,<r0=reg128#4,<mask=reg128#1
5934 ++# asm 2: vand >x01=q3,<r0=q3,<mask=q0
5937 ++# qhasm: 2x r1 += t1
5938 ++# asm 1: vadd.i64 >r1=reg128#2,<r1=reg128#2,<t1=reg128#11
5939 ++# asm 2: vadd.i64 >r1=q1,<r1=q1,<t1=q10
5940 ++vadd.i64 q1,q1,q10
5942 ++# qhasm: 2x t4 = r3 unsigned>> 26
5943 ++# asm 1: vshr.u64 >t4=reg128#11,<r3=reg128#9,#26
5944 ++# asm 2: vshr.u64 >t4=q10,<r3=q8,#26
5945 ++vshr.u64 q10,q8,#26
5947 ++# qhasm: x01 = x01[0,2,1,3]
5948 ++# asm 1: vtrn.32 <x01=reg128#4%bot,<x01=reg128#4%top
5949 ++# asm 2: vtrn.32 <x01=d6,<x01=d7
5952 ++# qhasm: r3 &= mask
5953 ++# asm 1: vand >r3=reg128#1,<r3=reg128#9,<mask=reg128#1
5954 ++# asm 2: vand >r3=q0,<r3=q8,<mask=q0
5957 ++# qhasm: r1 = r1[0,2,1,3]
5958 ++# asm 1: vtrn.32 <r1=reg128#2%bot,<r1=reg128#2%top
5959 ++# asm 2: vtrn.32 <r1=d2,<r1=d3
5962 ++# qhasm: 2x x4 = r4 + t4
5963 ++# asm 1: vadd.i64 >x4=reg128#3,<r4=reg128#3,<t4=reg128#11
5964 ++# asm 2: vadd.i64 >x4=q2,<r4=q2,<t4=q10
5965 ++vadd.i64 q2,q2,q10
5967 ++# qhasm: r3 = r3[0,2,1,3]
5968 ++# asm 1: vtrn.32 <r3=reg128#1%bot,<r3=reg128#1%top
5969 ++# asm 2: vtrn.32 <r3=d0,<r3=d1
5972 ++# qhasm: x01 = x01[0,1] r1[0,1]
5973 ++# asm 1: vext.32 <x01=reg128#4%top,<r1=reg128#2%bot,<r1=reg128#2%bot,#0
5974 ++# asm 2: vext.32 <x01=d7,<r1=d2,<r1=d2,#0
5975 ++vext.32 d7,d2,d2,#0
5977 ++# qhasm: x23 = x23[0,1] r3[0,1]
5978 ++# asm 1: vext.32 <x23=reg128#10%top,<r3=reg128#1%bot,<r3=reg128#1%bot,#0
5979 ++# asm 2: vext.32 <x23=d19,<r3=d0,<r3=d0,#0
5980 ++vext.32 d19,d0,d0,#0
5982 ++# qhasm: x4 = x4[0,2,1,3]
5983 ++# asm 1: vtrn.32 <x4=reg128#3%bot,<x4=reg128#3%top
5984 ++# asm 2: vtrn.32 <x4=d4,<x4=d5
5987 ++# qhasm: mem128[input_0] aligned= x01;input_0+=16
5988 ++# asm 1: vst1.8 {<x01=reg128#4%bot-<x01=reg128#4%top},[<input_0=int32#1,: 128]!
5989 ++# asm 2: vst1.8 {<x01=d6-<x01=d7},[<input_0=r0,: 128]!
5990 ++vst1.8 {d6-d7},[r0,: 128]!
5992 ++# qhasm: mem128[input_0] aligned= x23;input_0+=16
5993 ++# asm 1: vst1.8 {<x23=reg128#10%bot-<x23=reg128#10%top},[<input_0=int32#1,: 128]!
5994 ++# asm 2: vst1.8 {<x23=d18-<x23=d19},[<input_0=r0,: 128]!
5995 ++vst1.8 {d18-d19},[r0,: 128]!
5997 ++# qhasm: mem64[input_0] aligned= x4[0]
5998 ++# asm 1: vst1.8 <x4=reg128#3%bot,[<input_0=int32#1,: 64]
5999 ++# asm 2: vst1.8 <x4=d4,[<input_0=r0,: 64]
6000 ++vst1.8 d4,[r0,: 64]
6005 +diff --git a/crypto/poly1305/poly1305_vec.c b/crypto/poly1305/poly1305_vec.c
6006 +new file mode 100644
6007 +index 0000000..c546200
6009 ++++ b/crypto/poly1305/poly1305_vec.c
6011 ++/* ====================================================================
6012 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
6014 ++ * Redistribution and use in source and binary forms, with or without
6015 ++ * modification, are permitted provided that the following conditions
6018 ++ * 1. Redistributions of source code must retain the above copyright
6019 ++ * notice, this list of conditions and the following disclaimer.
6021 ++ * 2. Redistributions in binary form must reproduce the above copyright
6022 ++ * notice, this list of conditions and the following disclaimer in
6023 ++ * the documentation and/or other materials provided with the
6026 ++ * 3. All advertising materials mentioning features or use of this
6027 ++ * software must display the following acknowledgment:
6028 ++ * "This product includes software developed by the OpenSSL Project
6029 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
6031 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
6032 ++ * endorse or promote products derived from this software without
6033 ++ * prior written permission. For written permission, please contact
6034 ++ * licensing@OpenSSL.org.
6036 ++ * 5. Products derived from this software may not be called "OpenSSL"
6037 ++ * nor may "OpenSSL" appear in their names without prior written
6038 ++ * permission of the OpenSSL Project.
6040 ++ * 6. Redistributions of any form whatsoever must retain the following
6041 ++ * acknowledgment:
6042 ++ * "This product includes software developed by the OpenSSL Project
6043 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
6045 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
6046 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
6047 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
6048 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
6049 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
6050 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
6051 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
6052 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
6053 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
6054 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
6055 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
6056 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
6057 ++ * ====================================================================
6060 ++/* This implementation of poly1305 is by Andrew Moon
6061 ++ * (https://github.com/floodyberry/poly1305-donna) and released as public
6062 ++ * domain. It implements SIMD vectorization based on the algorithm described in
6063 ++ * http://cr.yp.to/papers.html#neoncrypto. Unrolled to 2 powers, i.e. 64 byte
6067 ++#include <emmintrin.h>
6068 ++#include <stdint.h>
6069 ++#include <openssl/opensslconf.h>
6071 ++#if !defined(OPENSSL_NO_POLY1305)
6073 ++#include <openssl/poly1305.h>
6075 ++#define ALIGN(x) __attribute__((aligned(x)))
6076 ++#define INLINE inline
6077 ++#define U8TO64_LE(m) (*(uint64_t*)(m))
6078 ++#define U8TO32_LE(m) (*(uint32_t*)(m))
6079 ++#define U64TO8_LE(m,v) (*(uint64_t*)(m)) = v
6081 ++typedef __m128i xmmi;
6082 ++typedef unsigned __int128 uint128_t;
6084 ++static const uint32_t ALIGN(16) poly1305_x64_sse2_message_mask[4] =
6085 ++ {(1 << 26) - 1, 0, (1 << 26) - 1, 0};
6086 ++static const uint32_t ALIGN(16) poly1305_x64_sse2_5[4] = {5, 0, 5, 0};
6087 ++static const uint32_t ALIGN(16) poly1305_x64_sse2_1shl128[4] =
6088 ++ {(1 << 24), 0, (1 << 24), 0};
6090 ++static uint128_t INLINE
6091 ++add128(uint128_t a, uint128_t b)
6096 ++static uint128_t INLINE
6097 ++add128_64(uint128_t a, uint64_t b)
6102 ++static uint128_t INLINE
6103 ++mul64x64_128(uint64_t a, uint64_t b)
6105 ++ return (uint128_t)a * b;
6108 ++static uint64_t INLINE
6109 ++lo128(uint128_t a)
6111 ++ return (uint64_t)a;
6114 ++static uint64_t INLINE
6115 ++shr128(uint128_t v, const int shift)
6117 ++ return (uint64_t)(v >> shift);
6120 ++static uint64_t INLINE
6121 ++shr128_pair(uint64_t hi, uint64_t lo, const int shift)
6123 ++ return (uint64_t)((((uint128_t)hi << 64) | lo) >> shift);
6126 ++typedef struct poly1305_power_t
6133 ++ } R20,R21,R22,R23,R24,S21,S22,S23,S24;
6134 ++ } poly1305_power;
6136 ++typedef struct poly1305_state_internal_t
6138 ++ poly1305_power P[2]; /* 288 bytes, top 32 bit halves unused = 144
6139 ++ bytes of free storage */
6142 ++ xmmi H[5]; /* 80 bytes */
6145 ++ /* uint64_t r0,r1,r2; [24 bytes] */
6146 ++ /* uint64_t pad0,pad1; [16 bytes] */
6147 ++ uint64_t started; /* 8 bytes */
6148 ++ uint64_t leftover; /* 8 bytes */
6149 ++ uint8_t buffer[64]; /* 64 bytes */
6150 ++ } poly1305_state_internal; /* 448 bytes total + 63 bytes for
6151 ++ alignment = 511 bytes raw */
6153 ++static poly1305_state_internal INLINE
6154 ++*poly1305_aligned_state(poly1305_state *state)
6156 ++ return (poly1305_state_internal *)(((uint64_t)state + 63) & ~63);
6159 ++/* copy 0-63 bytes */
6160 ++static void INLINE
6161 ++poly1305_block_copy(uint8_t *dst, const uint8_t *src, size_t bytes)
6163 ++ size_t offset = src - dst;
6166 ++ _mm_storeu_si128((xmmi *)(dst + 0), _mm_loadu_si128((xmmi *)(dst + offset + 0)));
6167 ++ _mm_storeu_si128((xmmi *)(dst + 16), _mm_loadu_si128((xmmi *)(dst + offset + 16)));
6172 ++ _mm_storeu_si128((xmmi *)dst,
6173 ++ _mm_loadu_si128((xmmi *)(dst + offset)));
6178 ++ *(uint64_t *)dst = *(uint64_t *)(dst + offset);
6183 ++ *(uint32_t *)dst = *(uint32_t *)(dst + offset);
6188 ++ *(uint16_t *)dst = *(uint16_t *)(dst + offset);
6193 ++ *( uint8_t *)dst = *( uint8_t *)(dst + offset);
6197 ++/* zero 0-15 bytes */
6198 ++static void INLINE
6199 ++poly1305_block_zero(uint8_t *dst, size_t bytes)
6201 ++ if (bytes & 8) { *(uint64_t *)dst = 0; dst += 8; }
6202 ++ if (bytes & 4) { *(uint32_t *)dst = 0; dst += 4; }
6203 ++ if (bytes & 2) { *(uint16_t *)dst = 0; dst += 2; }
6204 ++ if (bytes & 1) { *( uint8_t *)dst = 0; }
6207 ++static size_t INLINE
6208 ++poly1305_min(size_t a, size_t b)
6210 ++ return (a < b) ? a : b;
6214 ++CRYPTO_poly1305_init(poly1305_state *state, const unsigned char key[32])
6216 ++ poly1305_state_internal *st = poly1305_aligned_state(state);
6217 ++ poly1305_power *p;
6218 ++ uint64_t r0,r1,r2;
6222 ++ t0 = U8TO64_LE(key + 0);
6223 ++ t1 = U8TO64_LE(key + 8);
6224 ++ r0 = t0 & 0xffc0fffffff; t0 >>= 44; t0 |= t1 << 20;
6225 ++ r1 = t0 & 0xfffffc0ffff; t1 >>= 24;
6226 ++ r2 = t1 & 0x00ffffffc0f;
6228 ++ /* store r in un-used space of st->P[1] */
6230 ++ p->R20.d[1] = (uint32_t)(r0 );
6231 ++ p->R20.d[3] = (uint32_t)(r0 >> 32);
6232 ++ p->R21.d[1] = (uint32_t)(r1 );
6233 ++ p->R21.d[3] = (uint32_t)(r1 >> 32);
6234 ++ p->R22.d[1] = (uint32_t)(r2 );
6235 ++ p->R22.d[3] = (uint32_t)(r2 >> 32);
6238 ++ p->R23.d[1] = U8TO32_LE(key + 16);
6239 ++ p->R23.d[3] = U8TO32_LE(key + 20);
6240 ++ p->R24.d[1] = U8TO32_LE(key + 24);
6241 ++ p->R24.d[3] = U8TO32_LE(key + 28);
6244 ++ st->H[0] = _mm_setzero_si128();
6245 ++ st->H[1] = _mm_setzero_si128();
6246 ++ st->H[2] = _mm_setzero_si128();
6247 ++ st->H[3] = _mm_setzero_si128();
6248 ++ st->H[4] = _mm_setzero_si128();
6251 ++ st->leftover = 0;
6255 ++poly1305_first_block(poly1305_state_internal *st, const uint8_t *m)
6257 ++ const xmmi MMASK =
6258 ++ _mm_load_si128((xmmi *)poly1305_x64_sse2_message_mask);
6259 ++ const xmmi FIVE = _mm_load_si128((xmmi*)poly1305_x64_sse2_5);
6260 ++ const xmmi HIBIT = _mm_load_si128((xmmi*)poly1305_x64_sse2_1shl128);
6262 ++ poly1305_power *p;
6264 ++ uint64_t r0,r1,r2;
6265 ++ uint64_t r20,r21,r22,s22;
6266 ++ uint64_t pad0,pad1;
6270 ++ /* pull out stored info */
6273 ++ r0 = ((uint64_t)p->R20.d[3] << 32) | (uint64_t)p->R20.d[1];
6274 ++ r1 = ((uint64_t)p->R21.d[3] << 32) | (uint64_t)p->R21.d[1];
6275 ++ r2 = ((uint64_t)p->R22.d[3] << 32) | (uint64_t)p->R22.d[1];
6276 ++ pad0 = ((uint64_t)p->R23.d[3] << 32) | (uint64_t)p->R23.d[1];
6277 ++ pad1 = ((uint64_t)p->R24.d[3] << 32) | (uint64_t)p->R24.d[1];
6279 ++ /* compute powers r^2,r^4 */
6283 ++ for (i = 0; i < 2; i++)
6285 ++ s22 = r22 * (5 << 2);
6287 ++ d[0] = add128(mul64x64_128(r20, r20), mul64x64_128(r21 * 2, s22));
6288 ++ d[1] = add128(mul64x64_128(r22, s22), mul64x64_128(r20 * 2, r21));
6289 ++ d[2] = add128(mul64x64_128(r21, r21), mul64x64_128(r22 * 2, r20));
6291 ++ r20 = lo128(d[0]) & 0xfffffffffff; c = shr128(d[0], 44);
6292 ++ d[1] = add128_64(d[1], c); r21 = lo128(d[1]) & 0xfffffffffff; c = shr128(d[1], 44);
6293 ++ d[2] = add128_64(d[2], c); r22 = lo128(d[2]) & 0x3ffffffffff; c = shr128(d[2], 42);
6294 ++ r20 += c * 5; c = (r20 >> 44); r20 = r20 & 0xfffffffffff;
6297 ++ p->R20.v = _mm_shuffle_epi32(_mm_cvtsi32_si128((uint32_t)( r20 ) & 0x3ffffff), _MM_SHUFFLE(1,0,1,0));
6298 ++ p->R21.v = _mm_shuffle_epi32(_mm_cvtsi32_si128((uint32_t)((r20 >> 26) | (r21 << 18)) & 0x3ffffff), _MM_SHUFFLE(1,0,1,0));
6299 ++ p->R22.v = _mm_shuffle_epi32(_mm_cvtsi32_si128((uint32_t)((r21 >> 8) ) & 0x3ffffff), _MM_SHUFFLE(1,0,1,0));
6300 ++ p->R23.v = _mm_shuffle_epi32(_mm_cvtsi32_si128((uint32_t)((r21 >> 34) | (r22 << 10)) & 0x3ffffff), _MM_SHUFFLE(1,0,1,0));
6301 ++ p->R24.v = _mm_shuffle_epi32(_mm_cvtsi32_si128((uint32_t)((r22 >> 16) ) ), _MM_SHUFFLE(1,0,1,0));
6302 ++ p->S21.v = _mm_mul_epu32(p->R21.v, FIVE);
6303 ++ p->S22.v = _mm_mul_epu32(p->R22.v, FIVE);
6304 ++ p->S23.v = _mm_mul_epu32(p->R23.v, FIVE);
6305 ++ p->S24.v = _mm_mul_epu32(p->R24.v, FIVE);
6309 ++ /* put saved info back */
6311 ++ p->R20.d[1] = (uint32_t)(r0 );
6312 ++ p->R20.d[3] = (uint32_t)(r0 >> 32);
6313 ++ p->R21.d[1] = (uint32_t)(r1 );
6314 ++ p->R21.d[3] = (uint32_t)(r1 >> 32);
6315 ++ p->R22.d[1] = (uint32_t)(r2 );
6316 ++ p->R22.d[3] = (uint32_t)(r2 >> 32);
6317 ++ p->R23.d[1] = (uint32_t)(pad0 );
6318 ++ p->R23.d[3] = (uint32_t)(pad0 >> 32);
6319 ++ p->R24.d[1] = (uint32_t)(pad1 );
6320 ++ p->R24.d[3] = (uint32_t)(pad1 >> 32);
6322 ++ /* H = [Mx,My] */
6323 ++ T5 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 0)), _mm_loadl_epi64((xmmi *)(m + 16)));
6324 ++ T6 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 8)), _mm_loadl_epi64((xmmi *)(m + 24)));
6325 ++ st->H[0] = _mm_and_si128(MMASK, T5);
6326 ++ st->H[1] = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6327 ++ T5 = _mm_or_si128(_mm_srli_epi64(T5, 52), _mm_slli_epi64(T6, 12));
6328 ++ st->H[2] = _mm_and_si128(MMASK, T5);
6329 ++ st->H[3] = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6330 ++ st->H[4] = _mm_or_si128(_mm_srli_epi64(T6, 40), HIBIT);
6334 ++poly1305_blocks(poly1305_state_internal *st, const uint8_t *m, size_t bytes)
6336 ++ const xmmi MMASK = _mm_load_si128((xmmi *)poly1305_x64_sse2_message_mask);
6337 ++ const xmmi FIVE = _mm_load_si128((xmmi*)poly1305_x64_sse2_5);
6338 ++ const xmmi HIBIT = _mm_load_si128((xmmi*)poly1305_x64_sse2_1shl128);
6340 ++ poly1305_power *p;
6341 ++ xmmi H0,H1,H2,H3,H4;
6342 ++ xmmi T0,T1,T2,T3,T4,T5,T6;
6343 ++ xmmi M0,M1,M2,M3,M4;
6352 ++ while (bytes >= 64)
6354 ++ /* H *= [r^4,r^4] */
6356 ++ T0 = _mm_mul_epu32(H0, p->R20.v);
6357 ++ T1 = _mm_mul_epu32(H0, p->R21.v);
6358 ++ T2 = _mm_mul_epu32(H0, p->R22.v);
6359 ++ T3 = _mm_mul_epu32(H0, p->R23.v);
6360 ++ T4 = _mm_mul_epu32(H0, p->R24.v);
6361 ++ T5 = _mm_mul_epu32(H1, p->S24.v); T6 = _mm_mul_epu32(H1, p->R20.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6362 ++ T5 = _mm_mul_epu32(H2, p->S23.v); T6 = _mm_mul_epu32(H2, p->S24.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6363 ++ T5 = _mm_mul_epu32(H3, p->S22.v); T6 = _mm_mul_epu32(H3, p->S23.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6364 ++ T5 = _mm_mul_epu32(H4, p->S21.v); T6 = _mm_mul_epu32(H4, p->S22.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6365 ++ T5 = _mm_mul_epu32(H1, p->R21.v); T6 = _mm_mul_epu32(H1, p->R22.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6366 ++ T5 = _mm_mul_epu32(H2, p->R20.v); T6 = _mm_mul_epu32(H2, p->R21.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6367 ++ T5 = _mm_mul_epu32(H3, p->S24.v); T6 = _mm_mul_epu32(H3, p->R20.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6368 ++ T5 = _mm_mul_epu32(H4, p->S23.v); T6 = _mm_mul_epu32(H4, p->S24.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6369 ++ T5 = _mm_mul_epu32(H1, p->R23.v); T4 = _mm_add_epi64(T4, T5);
6370 ++ T5 = _mm_mul_epu32(H2, p->R22.v); T4 = _mm_add_epi64(T4, T5);
6371 ++ T5 = _mm_mul_epu32(H3, p->R21.v); T4 = _mm_add_epi64(T4, T5);
6372 ++ T5 = _mm_mul_epu32(H4, p->R20.v); T4 = _mm_add_epi64(T4, T5);
6374 ++ /* H += [Mx,My]*[r^2,r^2] */
6375 ++ T5 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 0)), _mm_loadl_epi64((xmmi *)(m + 16)));
6376 ++ T6 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 8)), _mm_loadl_epi64((xmmi *)(m + 24)));
6377 ++ M0 = _mm_and_si128(MMASK, T5);
6378 ++ M1 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6379 ++ T5 = _mm_or_si128(_mm_srli_epi64(T5, 52), _mm_slli_epi64(T6, 12));
6380 ++ M2 = _mm_and_si128(MMASK, T5);
6381 ++ M3 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6382 ++ M4 = _mm_or_si128(_mm_srli_epi64(T6, 40), HIBIT);
6385 ++ T5 = _mm_mul_epu32(M0, p->R20.v); T6 = _mm_mul_epu32(M0, p->R21.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6386 ++ T5 = _mm_mul_epu32(M1, p->S24.v); T6 = _mm_mul_epu32(M1, p->R20.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6387 ++ T5 = _mm_mul_epu32(M2, p->S23.v); T6 = _mm_mul_epu32(M2, p->S24.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6388 ++ T5 = _mm_mul_epu32(M3, p->S22.v); T6 = _mm_mul_epu32(M3, p->S23.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6389 ++ T5 = _mm_mul_epu32(M4, p->S21.v); T6 = _mm_mul_epu32(M4, p->S22.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6390 ++ T5 = _mm_mul_epu32(M0, p->R22.v); T6 = _mm_mul_epu32(M0, p->R23.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6391 ++ T5 = _mm_mul_epu32(M1, p->R21.v); T6 = _mm_mul_epu32(M1, p->R22.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6392 ++ T5 = _mm_mul_epu32(M2, p->R20.v); T6 = _mm_mul_epu32(M2, p->R21.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6393 ++ T5 = _mm_mul_epu32(M3, p->S24.v); T6 = _mm_mul_epu32(M3, p->R20.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6394 ++ T5 = _mm_mul_epu32(M4, p->S23.v); T6 = _mm_mul_epu32(M4, p->S24.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6395 ++ T5 = _mm_mul_epu32(M0, p->R24.v); T4 = _mm_add_epi64(T4, T5);
6396 ++ T5 = _mm_mul_epu32(M1, p->R23.v); T4 = _mm_add_epi64(T4, T5);
6397 ++ T5 = _mm_mul_epu32(M2, p->R22.v); T4 = _mm_add_epi64(T4, T5);
6398 ++ T5 = _mm_mul_epu32(M3, p->R21.v); T4 = _mm_add_epi64(T4, T5);
6399 ++ T5 = _mm_mul_epu32(M4, p->R20.v); T4 = _mm_add_epi64(T4, T5);
6401 ++ /* H += [Mx,My] */
6402 ++ T5 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 32)), _mm_loadl_epi64((xmmi *)(m + 48)));
6403 ++ T6 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 40)), _mm_loadl_epi64((xmmi *)(m + 56)));
6404 ++ M0 = _mm_and_si128(MMASK, T5);
6405 ++ M1 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6406 ++ T5 = _mm_or_si128(_mm_srli_epi64(T5, 52), _mm_slli_epi64(T6, 12));
6407 ++ M2 = _mm_and_si128(MMASK, T5);
6408 ++ M3 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6409 ++ M4 = _mm_or_si128(_mm_srli_epi64(T6, 40), HIBIT);
6411 ++ T0 = _mm_add_epi64(T0, M0);
6412 ++ T1 = _mm_add_epi64(T1, M1);
6413 ++ T2 = _mm_add_epi64(T2, M2);
6414 ++ T3 = _mm_add_epi64(T3, M3);
6415 ++ T4 = _mm_add_epi64(T4, M4);
6418 ++ C1 = _mm_srli_epi64(T0, 26); C2 = _mm_srli_epi64(T3, 26); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_and_si128(T3, MMASK); T1 = _mm_add_epi64(T1, C1); T4 = _mm_add_epi64(T4, C2);
6419 ++ C1 = _mm_srli_epi64(T1, 26); C2 = _mm_srli_epi64(T4, 26); T1 = _mm_and_si128(T1, MMASK); T4 = _mm_and_si128(T4, MMASK); T2 = _mm_add_epi64(T2, C1); T0 = _mm_add_epi64(T0, _mm_mul_epu32(C2, FIVE));
6420 ++ C1 = _mm_srli_epi64(T2, 26); C2 = _mm_srli_epi64(T0, 26); T2 = _mm_and_si128(T2, MMASK); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_add_epi64(T3, C1); T1 = _mm_add_epi64(T1, C2);
6421 ++ C1 = _mm_srli_epi64(T3, 26); T3 = _mm_and_si128(T3, MMASK); T4 = _mm_add_epi64(T4, C1);
6423 ++ /* H = (H*[r^4,r^4] + [Mx,My]*[r^2,r^2] + [Mx,My]) */
6442 ++poly1305_combine(poly1305_state_internal *st, const uint8_t *m, size_t bytes)
6444 ++ const xmmi MMASK =
6445 ++ _mm_load_si128((xmmi *)poly1305_x64_sse2_message_mask);
6446 ++ const xmmi HIBIT = _mm_load_si128((xmmi*)poly1305_x64_sse2_1shl128);
6447 ++ const xmmi FIVE = _mm_load_si128((xmmi*)poly1305_x64_sse2_5);
6449 ++ poly1305_power *p;
6450 ++ xmmi H0,H1,H2,H3,H4;
6451 ++ xmmi M0,M1,M2,M3,M4;
6452 ++ xmmi T0,T1,T2,T3,T4,T5,T6;
6455 ++ uint64_t r0,r1,r2;
6456 ++ uint64_t t0,t1,t2,t3,t4;
6458 ++ size_t consumed = 0;
6466 ++ /* p = [r^2,r^2] */
6471 ++ /* H *= [r^2,r^2] */
6472 ++ T0 = _mm_mul_epu32(H0, p->R20.v);
6473 ++ T1 = _mm_mul_epu32(H0, p->R21.v);
6474 ++ T2 = _mm_mul_epu32(H0, p->R22.v);
6475 ++ T3 = _mm_mul_epu32(H0, p->R23.v);
6476 ++ T4 = _mm_mul_epu32(H0, p->R24.v);
6477 ++ T5 = _mm_mul_epu32(H1, p->S24.v); T6 = _mm_mul_epu32(H1, p->R20.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6478 ++ T5 = _mm_mul_epu32(H2, p->S23.v); T6 = _mm_mul_epu32(H2, p->S24.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6479 ++ T5 = _mm_mul_epu32(H3, p->S22.v); T6 = _mm_mul_epu32(H3, p->S23.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6480 ++ T5 = _mm_mul_epu32(H4, p->S21.v); T6 = _mm_mul_epu32(H4, p->S22.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6481 ++ T5 = _mm_mul_epu32(H1, p->R21.v); T6 = _mm_mul_epu32(H1, p->R22.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6482 ++ T5 = _mm_mul_epu32(H2, p->R20.v); T6 = _mm_mul_epu32(H2, p->R21.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6483 ++ T5 = _mm_mul_epu32(H3, p->S24.v); T6 = _mm_mul_epu32(H3, p->R20.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6484 ++ T5 = _mm_mul_epu32(H4, p->S23.v); T6 = _mm_mul_epu32(H4, p->S24.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6485 ++ T5 = _mm_mul_epu32(H1, p->R23.v); T4 = _mm_add_epi64(T4, T5);
6486 ++ T5 = _mm_mul_epu32(H2, p->R22.v); T4 = _mm_add_epi64(T4, T5);
6487 ++ T5 = _mm_mul_epu32(H3, p->R21.v); T4 = _mm_add_epi64(T4, T5);
6488 ++ T5 = _mm_mul_epu32(H4, p->R20.v); T4 = _mm_add_epi64(T4, T5);
6490 ++ /* H += [Mx,My] */
6491 ++ T5 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 0)), _mm_loadl_epi64((xmmi *)(m + 16)));
6492 ++ T6 = _mm_unpacklo_epi64(_mm_loadl_epi64((xmmi *)(m + 8)), _mm_loadl_epi64((xmmi *)(m + 24)));
6493 ++ M0 = _mm_and_si128(MMASK, T5);
6494 ++ M1 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6495 ++ T5 = _mm_or_si128(_mm_srli_epi64(T5, 52), _mm_slli_epi64(T6, 12));
6496 ++ M2 = _mm_and_si128(MMASK, T5);
6497 ++ M3 = _mm_and_si128(MMASK, _mm_srli_epi64(T5, 26));
6498 ++ M4 = _mm_or_si128(_mm_srli_epi64(T6, 40), HIBIT);
6500 ++ T0 = _mm_add_epi64(T0, M0);
6501 ++ T1 = _mm_add_epi64(T1, M1);
6502 ++ T2 = _mm_add_epi64(T2, M2);
6503 ++ T3 = _mm_add_epi64(T3, M3);
6504 ++ T4 = _mm_add_epi64(T4, M4);
6507 ++ C1 = _mm_srli_epi64(T0, 26); C2 = _mm_srli_epi64(T3, 26); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_and_si128(T3, MMASK); T1 = _mm_add_epi64(T1, C1); T4 = _mm_add_epi64(T4, C2);
6508 ++ C1 = _mm_srli_epi64(T1, 26); C2 = _mm_srli_epi64(T4, 26); T1 = _mm_and_si128(T1, MMASK); T4 = _mm_and_si128(T4, MMASK); T2 = _mm_add_epi64(T2, C1); T0 = _mm_add_epi64(T0, _mm_mul_epu32(C2, FIVE));
6509 ++ C1 = _mm_srli_epi64(T2, 26); C2 = _mm_srli_epi64(T0, 26); T2 = _mm_and_si128(T2, MMASK); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_add_epi64(T3, C1); T1 = _mm_add_epi64(T1, C2);
6510 ++ C1 = _mm_srli_epi64(T3, 26); T3 = _mm_and_si128(T3, MMASK); T4 = _mm_add_epi64(T4, C1);
6512 ++ /* H = (H*[r^2,r^2] + [Mx,My]) */
6522 ++ /* finalize, H *= [r^2,r] */
6523 ++ r0 = ((uint64_t)p->R20.d[3] << 32) | (uint64_t)p->R20.d[1];
6524 ++ r1 = ((uint64_t)p->R21.d[3] << 32) | (uint64_t)p->R21.d[1];
6525 ++ r2 = ((uint64_t)p->R22.d[3] << 32) | (uint64_t)p->R22.d[1];
6527 ++ p->R20.d[2] = (uint32_t)( r0 ) & 0x3ffffff;
6528 ++ p->R21.d[2] = (uint32_t)((r0 >> 26) | (r1 << 18)) & 0x3ffffff;
6529 ++ p->R22.d[2] = (uint32_t)((r1 >> 8) ) & 0x3ffffff;
6530 ++ p->R23.d[2] = (uint32_t)((r1 >> 34) | (r2 << 10)) & 0x3ffffff;
6531 ++ p->R24.d[2] = (uint32_t)((r2 >> 16) ) ;
6532 ++ p->S21.d[2] = p->R21.d[2] * 5;
6533 ++ p->S22.d[2] = p->R22.d[2] * 5;
6534 ++ p->S23.d[2] = p->R23.d[2] * 5;
6535 ++ p->S24.d[2] = p->R24.d[2] * 5;
6537 ++ /* H *= [r^2,r] */
6538 ++ T0 = _mm_mul_epu32(H0, p->R20.v);
6539 ++ T1 = _mm_mul_epu32(H0, p->R21.v);
6540 ++ T2 = _mm_mul_epu32(H0, p->R22.v);
6541 ++ T3 = _mm_mul_epu32(H0, p->R23.v);
6542 ++ T4 = _mm_mul_epu32(H0, p->R24.v);
6543 ++ T5 = _mm_mul_epu32(H1, p->S24.v); T6 = _mm_mul_epu32(H1, p->R20.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6544 ++ T5 = _mm_mul_epu32(H2, p->S23.v); T6 = _mm_mul_epu32(H2, p->S24.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6545 ++ T5 = _mm_mul_epu32(H3, p->S22.v); T6 = _mm_mul_epu32(H3, p->S23.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6546 ++ T5 = _mm_mul_epu32(H4, p->S21.v); T6 = _mm_mul_epu32(H4, p->S22.v); T0 = _mm_add_epi64(T0, T5); T1 = _mm_add_epi64(T1, T6);
6547 ++ T5 = _mm_mul_epu32(H1, p->R21.v); T6 = _mm_mul_epu32(H1, p->R22.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6548 ++ T5 = _mm_mul_epu32(H2, p->R20.v); T6 = _mm_mul_epu32(H2, p->R21.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6549 ++ T5 = _mm_mul_epu32(H3, p->S24.v); T6 = _mm_mul_epu32(H3, p->R20.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6550 ++ T5 = _mm_mul_epu32(H4, p->S23.v); T6 = _mm_mul_epu32(H4, p->S24.v); T2 = _mm_add_epi64(T2, T5); T3 = _mm_add_epi64(T3, T6);
6551 ++ T5 = _mm_mul_epu32(H1, p->R23.v); T4 = _mm_add_epi64(T4, T5);
6552 ++ T5 = _mm_mul_epu32(H2, p->R22.v); T4 = _mm_add_epi64(T4, T5);
6553 ++ T5 = _mm_mul_epu32(H3, p->R21.v); T4 = _mm_add_epi64(T4, T5);
6554 ++ T5 = _mm_mul_epu32(H4, p->R20.v); T4 = _mm_add_epi64(T4, T5);
6556 ++ C1 = _mm_srli_epi64(T0, 26); C2 = _mm_srli_epi64(T3, 26); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_and_si128(T3, MMASK); T1 = _mm_add_epi64(T1, C1); T4 = _mm_add_epi64(T4, C2);
6557 ++ C1 = _mm_srli_epi64(T1, 26); C2 = _mm_srli_epi64(T4, 26); T1 = _mm_and_si128(T1, MMASK); T4 = _mm_and_si128(T4, MMASK); T2 = _mm_add_epi64(T2, C1); T0 = _mm_add_epi64(T0, _mm_mul_epu32(C2, FIVE));
6558 ++ C1 = _mm_srli_epi64(T2, 26); C2 = _mm_srli_epi64(T0, 26); T2 = _mm_and_si128(T2, MMASK); T0 = _mm_and_si128(T0, MMASK); T3 = _mm_add_epi64(T3, C1); T1 = _mm_add_epi64(T1, C2);
6559 ++ C1 = _mm_srli_epi64(T3, 26); T3 = _mm_and_si128(T3, MMASK); T4 = _mm_add_epi64(T4, C1);
6561 ++ /* H = H[0]+H[1] */
6562 ++ H0 = _mm_add_epi64(T0, _mm_srli_si128(T0, 8));
6563 ++ H1 = _mm_add_epi64(T1, _mm_srli_si128(T1, 8));
6564 ++ H2 = _mm_add_epi64(T2, _mm_srli_si128(T2, 8));
6565 ++ H3 = _mm_add_epi64(T3, _mm_srli_si128(T3, 8));
6566 ++ H4 = _mm_add_epi64(T4, _mm_srli_si128(T4, 8));
6568 ++ t0 = _mm_cvtsi128_si32(H0) ; c = (t0 >> 26); t0 &= 0x3ffffff;
6569 ++ t1 = _mm_cvtsi128_si32(H1) + c; c = (t1 >> 26); t1 &= 0x3ffffff;
6570 ++ t2 = _mm_cvtsi128_si32(H2) + c; c = (t2 >> 26); t2 &= 0x3ffffff;
6571 ++ t3 = _mm_cvtsi128_si32(H3) + c; c = (t3 >> 26); t3 &= 0x3ffffff;
6572 ++ t4 = _mm_cvtsi128_si32(H4) + c; c = (t4 >> 26); t4 &= 0x3ffffff;
6573 ++ t0 = t0 + (c * 5); c = (t0 >> 26); t0 &= 0x3ffffff;
6576 ++ st->HH[0] = ((t0 ) | (t1 << 26) ) & 0xfffffffffffull;
6577 ++ st->HH[1] = ((t1 >> 18) | (t2 << 8) | (t3 << 34)) & 0xfffffffffffull;
6578 ++ st->HH[2] = ((t3 >> 10) | (t4 << 16) ) & 0x3ffffffffffull;
6584 ++CRYPTO_poly1305_update(poly1305_state *state, const unsigned char *m,
6587 ++ poly1305_state_internal *st = poly1305_aligned_state(state);
6590 ++ /* need at least 32 initial bytes to start the accelerated branch */
6591 ++ if (!st->started)
6593 ++ if ((st->leftover == 0) && (bytes > 32))
6595 ++ poly1305_first_block(st, m);
6601 ++ want = poly1305_min(32 - st->leftover, bytes);
6602 ++ poly1305_block_copy(st->buffer + st->leftover, m, want);
6605 ++ st->leftover += want;
6606 ++ if ((st->leftover < 32) || (bytes == 0))
6608 ++ poly1305_first_block(st, st->buffer);
6609 ++ st->leftover = 0;
6614 ++ /* handle leftover */
6615 ++ if (st->leftover)
6617 ++ want = poly1305_min(64 - st->leftover, bytes);
6618 ++ poly1305_block_copy(st->buffer + st->leftover, m, want);
6621 ++ st->leftover += want;
6622 ++ if (st->leftover < 64)
6624 ++ poly1305_blocks(st, st->buffer, 64);
6625 ++ st->leftover = 0;
6628 ++ /* process 64 byte blocks */
6631 ++ want = (bytes & ~63);
6632 ++ poly1305_blocks(st, m, want);
6639 ++ poly1305_block_copy(st->buffer + st->leftover, m, bytes);
6640 ++ st->leftover += bytes;
6645 ++CRYPTO_poly1305_finish(poly1305_state *state, unsigned char mac[16])
6647 ++ poly1305_state_internal *st = poly1305_aligned_state(state);
6648 ++ size_t leftover = st->leftover;
6649 ++ uint8_t *m = st->buffer;
6651 ++ uint64_t h0,h1,h2;
6653 ++ uint64_t g0,g1,g2,c,nc;
6654 ++ uint64_t r0,r1,r2,s1,s2;
6655 ++ poly1305_power *p;
6659 ++ size_t consumed = poly1305_combine(st, m, leftover);
6660 ++ leftover -= consumed;
6664 ++ /* st->HH will either be 0 or have the combined result */
6670 ++ r0 = ((uint64_t)p->R20.d[3] << 32) | (uint64_t)p->R20.d[1];
6671 ++ r1 = ((uint64_t)p->R21.d[3] << 32) | (uint64_t)p->R21.d[1];
6672 ++ r2 = ((uint64_t)p->R22.d[3] << 32) | (uint64_t)p->R22.d[1];
6673 ++ s1 = r1 * (5 << 2);
6674 ++ s2 = r2 * (5 << 2);
6676 ++ if (leftover < 16)
6677 ++ goto poly1305_donna_atmost15bytes;
6679 ++poly1305_donna_atleast16bytes:
6680 ++ t0 = U8TO64_LE(m + 0);
6681 ++ t1 = U8TO64_LE(m + 8);
6682 ++ h0 += t0 & 0xfffffffffff;
6683 ++ t0 = shr128_pair(t1, t0, 44);
6684 ++ h1 += t0 & 0xfffffffffff;
6685 ++ h2 += (t1 >> 24) | ((uint64_t)1 << 40);
6687 ++poly1305_donna_mul:
6688 ++ d[0] = add128(add128(mul64x64_128(h0, r0), mul64x64_128(h1, s2)), mul64x64_128(h2, s1));
6689 ++ d[1] = add128(add128(mul64x64_128(h0, r1), mul64x64_128(h1, r0)), mul64x64_128(h2, s2));
6690 ++ d[2] = add128(add128(mul64x64_128(h0, r2), mul64x64_128(h1, r1)), mul64x64_128(h2, r0));
6691 ++ h0 = lo128(d[0]) & 0xfffffffffff; c = shr128(d[0], 44);
6692 ++ d[1] = add128_64(d[1], c); h1 = lo128(d[1]) & 0xfffffffffff; c = shr128(d[1], 44);
6693 ++ d[2] = add128_64(d[2], c); h2 = lo128(d[2]) & 0x3ffffffffff; c = shr128(d[2], 42);
6698 ++ if (leftover >= 16) goto poly1305_donna_atleast16bytes;
6700 ++ /* final bytes */
6701 ++poly1305_donna_atmost15bytes:
6702 ++ if (!leftover) goto poly1305_donna_finish;
6704 ++ m[leftover++] = 1;
6705 ++ poly1305_block_zero(m + leftover, 16 - leftover);
6708 ++ t0 = U8TO64_LE(m+0);
6709 ++ t1 = U8TO64_LE(m+8);
6710 ++ h0 += t0 & 0xfffffffffff; t0 = shr128_pair(t1, t0, 44);
6711 ++ h1 += t0 & 0xfffffffffff;
6712 ++ h2 += (t1 >> 24);
6714 ++ goto poly1305_donna_mul;
6716 ++poly1305_donna_finish:
6717 ++ c = (h0 >> 44); h0 &= 0xfffffffffff;
6718 ++ h1 += c; c = (h1 >> 44); h1 &= 0xfffffffffff;
6719 ++ h2 += c; c = (h2 >> 42); h2 &= 0x3ffffffffff;
6722 ++ g0 = h0 + 5; c = (g0 >> 44); g0 &= 0xfffffffffff;
6723 ++ g1 = h1 + c; c = (g1 >> 44); g1 &= 0xfffffffffff;
6724 ++ g2 = h2 + c - ((uint64_t)1 << 42);
6726 ++ c = (g2 >> 63) - 1;
6728 ++ h0 = (h0 & nc) | (g0 & c);
6729 ++ h1 = (h1 & nc) | (g1 & c);
6730 ++ h2 = (h2 & nc) | (g2 & c);
6733 ++ t0 = ((uint64_t)p->R23.d[3] << 32) | (uint64_t)p->R23.d[1];
6734 ++ t1 = ((uint64_t)p->R24.d[3] << 32) | (uint64_t)p->R24.d[1];
6735 ++ h0 += (t0 & 0xfffffffffff) ; c = (h0 >> 44); h0 &= 0xfffffffffff; t0 = shr128_pair(t1, t0, 44);
6736 ++ h1 += (t0 & 0xfffffffffff) + c; c = (h1 >> 44); h1 &= 0xfffffffffff; t1 = (t1 >> 24);
6739 ++ U64TO8_LE(mac + 0, ((h0 ) | (h1 << 44)));
6740 ++ U64TO8_LE(mac + 8, ((h1 >> 20) | (h2 << 24)));
6743 ++#endif /* !OPENSSL_NO_POLY1305 */
6744 +diff --git a/crypto/poly1305/poly1305test.c b/crypto/poly1305/poly1305test.c
6745 +new file mode 100644
6746 +index 0000000..8dd26af
6748 ++++ b/crypto/poly1305/poly1305test.c
6750 ++/* ====================================================================
6751 ++ * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
6753 ++ * Redistribution and use in source and binary forms, with or without
6754 ++ * modification, are permitted provided that the following conditions
6757 ++ * 1. Redistributions of source code must retain the above copyright
6758 ++ * notice, this list of conditions and the following disclaimer.
6760 ++ * 2. Redistributions in binary form must reproduce the above copyright
6761 ++ * notice, this list of conditions and the following disclaimer in
6762 ++ * the documentation and/or other materials provided with the
6765 ++ * 3. All advertising materials mentioning features or use of this
6766 ++ * software must display the following acknowledgment:
6767 ++ * "This product includes software developed by the OpenSSL Project
6768 ++ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
6770 ++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
6771 ++ * endorse or promote products derived from this software without
6772 ++ * prior written permission. For written permission, please contact
6773 ++ * licensing@OpenSSL.org.
6775 ++ * 5. Products derived from this software may not be called "OpenSSL"
6776 ++ * nor may "OpenSSL" appear in their names without prior written
6777 ++ * permission of the OpenSSL Project.
6779 ++ * 6. Redistributions of any form whatsoever must retain the following
6780 ++ * acknowledgment:
6781 ++ * "This product includes software developed by the OpenSSL Project
6782 ++ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
6784 ++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
6785 ++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
6786 ++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
6787 ++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
6788 ++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
6789 ++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
6790 ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
6791 ++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
6792 ++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
6793 ++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
6794 ++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
6795 ++ * OF THE POSSIBILITY OF SUCH DAMAGE.
6796 ++ * ====================================================================
6799 ++#include <stdio.h>
6800 ++#include <stdlib.h>
6801 ++#include <string.h>
6803 ++#include <openssl/poly1305.h>
6805 ++struct poly1305_test
6807 ++ const char *inputhex;
6808 ++ const char *keyhex;
6809 ++ const char *outhex;
6812 ++static const struct poly1305_test poly1305_tests[] = {
6815 ++ "c8afaac331ee372cd6082de134943b174710130e9f6fea8d72293850a667d86c",
6816 ++ "4710130e9f6fea8d72293850a667d86c",
6819 ++ "48656c6c6f20776f726c6421",
6820 ++ "746869732069732033322d62797465206b657920666f7220506f6c7931333035",
6821 ++ "a6f745008f81c916a20dcc74eef2b2f0",
6824 ++ "0000000000000000000000000000000000000000000000000000000000000000",
6825 ++ "746869732069732033322d62797465206b657920666f7220506f6c7931333035",
6826 ++ "49ec78090e481ec6c26b33b91ccc0307",
6829 ++ "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
6830 ++ "746869732069732033322d62797465206b657920666f7220506f6c7931333035",
6831 ++ "da84bcab02676c38cdb015604274c2aa",
6835 ++static unsigned char hex_digit(char h)
6837 ++ if (h >= '0' && h <= '9')
6839 ++ else if (h >= 'a' && h <= 'f')
6840 ++ return h - 'a' + 10;
6841 ++ else if (h >= 'A' && h <= 'F')
6842 ++ return h - 'A' + 10;
6847 ++static void hex_decode(unsigned char *out, const char* hex)
6851 ++ while (*hex != 0)
6853 ++ unsigned char v = hex_digit(*hex++);
6855 ++ v |= hex_digit(*hex++);
6860 ++static void hexdump(unsigned char *a, size_t len)
6864 ++ for (i = 0; i < len; i++)
6865 ++ printf("%02x", a[i]);
6870 ++ static const unsigned num_tests =
6871 ++ sizeof(poly1305_tests) / sizeof(struct poly1305_test);
6873 ++ unsigned char key[32], out[16], expected[16];
6874 ++ poly1305_state poly1305;
6876 ++ for (i = 0; i < num_tests; i++)
6878 ++ const struct poly1305_test *test = &poly1305_tests[i];
6879 ++ unsigned char *in;
6880 ++ size_t inlen = strlen(test->inputhex);
6882 ++ if (strlen(test->keyhex) != sizeof(key)*2 ||
6883 ++ strlen(test->outhex) != sizeof(out)*2 ||
6884 ++ (inlen & 1) == 1)
6889 ++ hex_decode(key, test->keyhex);
6890 ++ hex_decode(expected, test->outhex);
6892 ++ in = malloc(inlen);
6894 ++ hex_decode(in, test->inputhex);
6895 ++ CRYPTO_poly1305_init(&poly1305, key);
6896 ++ CRYPTO_poly1305_update(&poly1305, in, inlen);
6897 ++ CRYPTO_poly1305_finish(&poly1305, out);
6899 ++ if (memcmp(out, expected, sizeof(expected)) != 0)
6901 ++ printf("Poly1305 test #%d failed.\n", i);
6903 ++ hexdump(out, sizeof(out));
6904 ++ printf("\nexpected: ");
6905 ++ hexdump(expected, sizeof(expected));
6913 ++ printf("PASS\n");
6916 +diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
6917 +index 75b6560..a042b8d 100644
6920 +@@ -1841,7 +1841,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6923 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6924 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6925 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6926 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6930 +@@ -1873,7 +1874,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6933 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6934 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6935 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6936 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6940 +@@ -1905,7 +1907,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6943 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6944 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6945 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6946 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6950 +@@ -1937,7 +1940,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6953 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6954 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6955 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6956 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6960 +@@ -1969,7 +1973,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6963 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6964 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6965 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6966 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6970 +@@ -2001,7 +2006,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6973 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6974 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6975 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6976 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6980 +@@ -2714,7 +2720,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6983 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6984 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6985 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6986 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
6990 +@@ -2746,7 +2753,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
6993 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
6994 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
6995 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
6996 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
7000 +@@ -2778,7 +2786,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
7003 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
7004 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
7005 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
7006 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
7010 +@@ -2810,7 +2819,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
7013 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
7014 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
7015 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
7016 ++ SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
7020 +@@ -2894,6 +2904,51 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
7026 ++ TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
7027 ++ TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
7030 ++ SSL_CHACHA20POLY1305,
7033 ++ SSL_NOT_EXP|SSL_HIGH,
7034 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
7041 ++ TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
7042 ++ TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
7045 ++ SSL_CHACHA20POLY1305,
7048 ++ SSL_NOT_EXP|SSL_HIGH,
7049 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
7056 ++ TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
7057 ++ TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
7060 ++ SSL_CHACHA20POLY1305,
7063 ++ SSL_NOT_EXP|SSL_HIGH,
7064 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
7072 +diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
7073 +index 5038f6c..04b474d 100644
7076 +@@ -790,8 +790,11 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
7080 +- else if (s->aead_write_ctx != NULL)
7081 ++ else if (s->aead_write_ctx != NULL &&
7082 ++ s->aead_write_ctx->variable_nonce_included_in_record)
7084 + eivlen = s->aead_write_ctx->variable_nonce_len;
7089 +diff --git a/ssl/ssl.h b/ssl/ssl.h
7090 +index 0644cbf..d782a98 100644
7093 +@@ -291,6 +291,7 @@ extern "C" {
7094 + #define SSL_TXT_CAMELLIA128 "CAMELLIA128"
7095 + #define SSL_TXT_CAMELLIA256 "CAMELLIA256"
7096 + #define SSL_TXT_CAMELLIA "CAMELLIA"
7097 ++#define SSL_TXT_CHACHA20 "CHACHA20"
7099 + #define SSL_TXT_MD5 "MD5"
7100 + #define SSL_TXT_SHA1 "SHA1"
7101 +diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
7102 +index 7e780cd..b6370bd 100644
7103 +--- a/ssl/ssl_ciph.c
7104 ++++ b/ssl/ssl_ciph.c
7105 +@@ -298,6 +298,7 @@ static const SSL_CIPHER cipher_aliases[]={
7106 + {0,SSL_TXT_CAMELLIA128,0,0,0,SSL_CAMELLIA128,0,0,0,0,0,0},
7107 + {0,SSL_TXT_CAMELLIA256,0,0,0,SSL_CAMELLIA256,0,0,0,0,0,0},
7108 + {0,SSL_TXT_CAMELLIA ,0,0,0,SSL_CAMELLIA128|SSL_CAMELLIA256,0,0,0,0,0,0},
7109 ++ {0,SSL_TXT_CHACHA20 ,0,0,0,SSL_CHACHA20POLY1305,0,0,0,0,0,0},
7112 + {0,SSL_TXT_MD5,0, 0,0,0,SSL_MD5, 0,0,0,0,0},
7113 +@@ -523,9 +524,15 @@ int ssl_cipher_get_evp_aead(const SSL_SESSION *s, const EVP_AEAD **aead)
7116 + #ifndef OPENSSL_NO_AES
7117 +- /* There is only one AEAD for now. */
7118 +- *aead = EVP_aead_aes_128_gcm();
7120 ++ switch (c->algorithm_enc)
7122 ++ case SSL_AES128GCM:
7123 ++ *aead = EVP_aead_aes_128_gcm();
7125 ++ case SSL_CHACHA20POLY1305:
7126 ++ *aead = EVP_aead_chacha20_poly1305();
7132 +@@ -1715,6 +1722,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
7136 ++ case SSL_CHACHA20POLY1305:
7137 ++ enc="ChaCha20-Poly1305";
7142 +diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
7143 +index 63bc28b..b83d8cd 100644
7144 +--- a/ssl/ssl_locl.h
7145 ++++ b/ssl/ssl_locl.h
7146 +@@ -328,6 +328,7 @@
7147 + #define SSL_SEED 0x00000800L
7148 + #define SSL_AES128GCM 0x00001000L
7149 + #define SSL_AES256GCM 0x00002000L
7150 ++#define SSL_CHACHA20POLY1305 0x00004000L
7152 + #define SSL_AES (SSL_AES128|SSL_AES256|SSL_AES128GCM|SSL_AES256GCM)
7153 + #define SSL_CAMELLIA (SSL_CAMELLIA128|SSL_CAMELLIA256)
7154 +@@ -389,6 +390,12 @@
7155 + #define SSL_CIPHER_AEAD_FIXED_NONCE_LEN(ssl_cipher) \
7156 + (((ssl_cipher->algorithm2 >> 24) & 0xf)*2)
7158 ++/* SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD is a flag in
7159 ++ * SSL_CIPHER.algorithm2 which indicates that the variable part of the nonce is
7160 ++ * included as a prefix of the record. (AES-GCM, for example, does with with an
7161 ++ * 8-byte variable nonce.) */
7162 ++#define SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD (1<<22)
7165 + * Export and cipher strength information. For each cipher we have to decide
7166 + * whether it is exportable or not. This information is likely to change
7167 +@@ -605,6 +612,9 @@ struct ssl_aead_ctx_st
7169 + unsigned char fixed_nonce[8];
7170 + unsigned char fixed_nonce_len, variable_nonce_len, tag_len;
7171 ++ /* variable_nonce_included_in_record is non-zero if the variable nonce
7172 ++ * for a record is included as a prefix before the ciphertext. */
7173 ++ char variable_nonce_included_in_record;
7176 + #ifndef OPENSSL_NO_COMP
7177 +diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
7178 +index 7af1a32..15800af 100644
7181 +@@ -366,6 +366,8 @@ static int tls1_change_cipher_state_aead(SSL *s, char is_read,
7182 + memcpy(aead_ctx->fixed_nonce, iv, iv_len);
7183 + aead_ctx->fixed_nonce_len = iv_len;
7184 + aead_ctx->variable_nonce_len = 8; /* always the case, currently. */
7185 ++ aead_ctx->variable_nonce_included_in_record =
7186 ++ (s->s3->tmp.new_cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD) != 0;
7187 + if (aead_ctx->variable_nonce_len + aead_ctx->fixed_nonce_len != EVP_AEAD_nonce_length(aead))
7189 + SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, ERR_R_INTERNAL_ERROR);
7190 +@@ -863,6 +865,7 @@ int tls1_enc(SSL *s, int send)
7193 + size_t len = rec->length;
7194 ++ size_t eivlen = 0;
7198 +@@ -878,18 +881,22 @@ int tls1_enc(SSL *s, int send)
7199 + * variable nonce. Thus we can copy the sequence number
7200 + * bytes into place without overwriting any of the
7202 +- memcpy(out, ad, aead->variable_nonce_len);
7203 +- len -= aead->variable_nonce_len;
7204 ++ if (aead->variable_nonce_included_in_record)
7206 ++ memcpy(out, ad, aead->variable_nonce_len);
7207 ++ len -= aead->variable_nonce_len;
7208 ++ eivlen = aead->variable_nonce_len;
7211 + ad[11] = len >> 8;
7212 + ad[12] = len & 0xff;
7214 + n = EVP_AEAD_CTX_seal(&aead->ctx,
7215 +- out + aead->variable_nonce_len, len + aead->tag_len,
7216 ++ out + eivlen, len + aead->tag_len,
7217 + nonce, nonce_used,
7218 +- in + aead->variable_nonce_len, len,
7219 ++ in + eivlen, len,
7222 ++ if (n >= 0 && aead->variable_nonce_included_in_record)
7223 + n += aead->variable_nonce_len;
7226 +@@ -903,12 +910,17 @@ int tls1_enc(SSL *s, int send)
7228 + if (len < aead->variable_nonce_len)
7230 +- memcpy(nonce + nonce_used, in, aead->variable_nonce_len);
7231 ++ memcpy(nonce + nonce_used,
7232 ++ aead->variable_nonce_included_in_record ? in : ad,
7233 ++ aead->variable_nonce_len);
7234 + nonce_used += aead->variable_nonce_len;
7236 +- in += aead->variable_nonce_len;
7237 +- len -= aead->variable_nonce_len;
7238 +- out += aead->variable_nonce_len;
7239 ++ if (aead->variable_nonce_included_in_record)
7241 ++ in += aead->variable_nonce_len;
7242 ++ len -= aead->variable_nonce_len;
7243 ++ out += aead->variable_nonce_len;
7246 + if (len < aead->tag_len)
7248 +diff --git a/ssl/tls1.h b/ssl/tls1.h
7249 +index 8cac7df..3cbcb83 100644
7252 +@@ -526,6 +526,10 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
7253 + #define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031
7254 + #define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032
7256 ++#define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305 0x0300CC13
7257 ++#define TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305 0x0300CC14
7258 ++#define TLS1_CK_DHE_RSA_CHACHA20_POLY1305 0x0300CC15
7261 + * Inconsistency alert:
7262 + * The OpenSSL names of ciphers with ephemeral DH here include the string
7263 +@@ -677,6 +681,10 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
7264 + #define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256"
7265 + #define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384"
7267 ++#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 "ECDHE-RSA-CHACHA20-POLY1305"
7268 ++#define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 "ECDHE-ECDSA-CHACHA20-POLY1305"
7269 ++#define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305 "DHE-RSA-CHACHA20-POLY1305"
7271 + #define TLS_CT_RSA_SIGN 1
7272 + #define TLS_CT_DSS_SIGN 2
7273 + #define TLS_CT_RSA_FIXED_DH 3
7274 +diff --git a/test/Makefile b/test/Makefile
7275 +index 4c9eabc..4790aa8 100644
7276 +--- a/test/Makefile
7277 ++++ b/test/Makefile
7278 +@@ -86,7 +86,9 @@ OBJ= $(BNTEST).o $(ECTEST).o $(ECDSATEST).o $(ECDHTEST).o $(IDEATEST).o \
7279 + $(MDC2TEST).o $(RMDTEST).o \
7280 + $(RANDTEST).o $(DHTEST).o $(ENGINETEST).o $(CASTTEST).o \
7281 + $(BFTEST).o $(SSLTEST).o $(DSATEST).o $(EXPTEST).o $(RSATEST).o \
7282 +- $(EVPTEST).o $(IGETEST).o $(JPAKETEST).o $(ASN1TEST).o
7283 ++ $(EVPTEST).o $(IGETEST).o $(JPAKETEST).o $(ASN1TEST).o $(CHACHATEST).o \
7284 ++ $(POLY1305TEST).o
7286 + SRC= $(BNTEST).c $(ECTEST).c $(ECDSATEST).c $(ECDHTEST).c $(IDEATEST).c \
7287 + $(MD2TEST).c $(MD4TEST).c $(MD5TEST).c \
7288 + $(HMACTEST).c $(WPTEST).c \
7289 +@@ -94,7 +96,8 @@ SRC= $(BNTEST).c $(ECTEST).c $(ECDSATEST).c $(ECDHTEST).c $(IDEATEST).c \
7290 + $(DESTEST).c $(SHATEST).c $(SHA1TEST).c $(MDC2TEST).c $(RMDTEST).c \
7291 + $(RANDTEST).c $(DHTEST).c $(ENGINETEST).c $(CASTTEST).c \
7292 + $(BFTEST).c $(SSLTEST).c $(DSATEST).c $(EXPTEST).c $(RSATEST).c \
7293 +- $(EVPTEST).c $(IGETEST).c $(JPAKETEST).c $(SRPTEST).c $(ASN1TEST).c
7294 ++ $(EVPTEST).c $(IGETEST).c $(JPAKETEST).c $(SRPTEST).c $(ASN1TEST).c \
7295 ++ $(CHACHATEST).c $(POLY1305TEST).c
7298 + HEADER= $(EXHEADER)
7299 +@@ -137,7 +140,7 @@ alltests: \
7300 + test_enc test_x509 test_rsa test_crl test_sid \
7301 + test_gen test_req test_pkcs7 test_verify test_dh test_dsa \
7302 + test_ss test_ca test_engine test_evp test_ssl test_tsa test_ige \
7303 +- test_jpake test_srp test_cms
7304 ++ test_jpake test_srp test_cms test_chacha test_poly1305
7307 + ../util/shlib_wrap.sh ./$(EVPTEST) evptests.txt
7308 +@@ -318,6 +321,14 @@ test_srp: $(SRPTEST)$(EXE_EXT)
7310 + ../util/shlib_wrap.sh ./srptest
7312 ++test_chacha: $(CHACHATEST)$(EXE_EXT)
7313 ++ @echo "Test ChaCha"
7314 ++ ../util/shlib_wrap.sh ./$(CHACHATEST)
7316 ++test_poly1305: $(POLY1305TEST)$(EXE_EXT)
7317 ++ @echo "Test Poly1305"
7318 ++ ../util/shlib_wrap.sh ./$(POLY1305TEST)
7321 + lint -DLINT $(INCLUDES) $(SRC)>fluff
7323 +@@ -394,6 +405,12 @@ $(SHA256TEST)$(EXE_EXT): $(SHA256TEST).o $(DLIBCRYPTO)
7324 + $(SHA512TEST)$(EXE_EXT): $(SHA512TEST).o $(DLIBCRYPTO)
7325 + @target=$(SHA512TEST); $(BUILD_CMD)
7327 ++$(CHACHATEST)$(EXE_EXT): $(CHACHATEST).o $(DLIBCRYPTO)
7328 ++ @target=$(CHACHATEST); $(BUILD_CMD)
7330 ++$(POLY1305TEST)$(EXE_EXT): $(POLY1305TEST).o $(DLIBCRYPTO)
7331 ++ @target=$(CHACHATEST); $(BUILD_CMD)
7333 + $(RMDTEST)$(EXE_EXT): $(RMDTEST).o $(DLIBCRYPTO)
7334 + @target=$(RMDTEST); $(BUILD_CMD)
7339 diff -burN android-openssl-lhash2/patches/neon_runtime.patch android-openssl/patches/neon_runtime.patch
7340 --- android-openssl-lhash2/patches/neon_runtime.patch 1969-12-31 19:00:00.000000000 -0500
7341 +++ android-openssl/patches/neon_runtime.patch 2013-11-05 16:51:28.668287449 -0500
7343 +From aea47606333cfd3e7a09cab3e42e488c79a416af Mon Sep 17 00:00:00 2001
7344 +From: Adam Langley <agl@chromium.org>
7345 +Date: Tue, 5 Nov 2013 13:10:11 -0500
7346 +Subject: [PATCH 52/52] Optional NEON support on ARM.
7348 +This patch causes ARM to build both the NEON and generic versions of
7349 +ChaCha20 and Poly1305. The NEON code can be enabled at run-time by
7350 +calling CRYPTO_set_NEON_capable(1).
7354 + apps/speed.c | 5 +
7355 + crypto/chacha/chacha_enc.c | 18 +
7356 + crypto/chacha/chacha_vec.c | 7 +
7357 + crypto/chacha/chacha_vec_arm.s | 846 +++++++++++++++++++++++++++++++++++++++++
7358 + crypto/cryptlib.c | 14 +
7359 + crypto/crypto.h | 8 +
7360 + crypto/poly1305/poly1305.c | 35 ++
7361 + crypto/poly1305/poly1305_arm.c | 9 +-
7362 + 10 files changed, 941 insertions(+), 4 deletions(-)
7363 + create mode 100644 crypto/chacha/chacha_vec_arm.s
7365 +diff --git a/Configure b/Configure
7366 +index 1b95384..18b7af0 100755
7369 +@@ -136,7 +136,7 @@ my $alpha_asm="alphacpuid.o:bn_asm.o alpha-mont.o:::::sha1-alpha.o:::::::ghash-a
7370 + my $mips32_asm=":bn-mips.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o::::::::::";
7371 + my $mips64_asm=":bn-mips.o mips-mont.o::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o sha512-mips.o::::::::::";
7372 + my $s390x_asm="s390xcap.o s390xcpuid.o:bn-s390x.o s390x-mont.o s390x-gf2m.o::aes-s390x.o aes-ctr.o aes-xts.o:::sha1-s390x.o sha256-s390x.o sha512-s390x.o::rc4-s390x.o:::::::ghash-s390x.o:";
7373 +-my $armv4_asm="armcap.o armv4cpuid.o:bn_asm.o armv4-mont.o armv4-gf2m.o::aes_cbc.o aes-armv4.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o::chacha_vec.o:poly1305_arm.o poly1305_arm_asm.o:void";
7374 ++my $armv4_asm="armcap.o armv4cpuid.o:bn_asm.o armv4-mont.o armv4-gf2m.o::aes_cbc.o aes-armv4.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o::chacha_vec_arm.o chacha_enc.o:poly1305.o poly1305_arm.o poly1305_arm_asm.o:void";
7375 + my $parisc11_asm="pariscid.o:bn_asm.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::::32";
7376 + my $parisc20_asm="pariscid.o:pa-risc2W.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::::64";
7377 + my $ppc32_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o::aes_core.o aes_cbc.o aes-ppc.o:::sha1-ppc.o sha256-ppc.o::::::::::";
7378 +diff --git a/crypto/chacha/chacha_enc.c b/crypto/chacha/chacha_enc.c
7379 +index 54d1ca3..e4b648f 100644
7380 +--- a/crypto/chacha/chacha_enc.c
7381 ++++ b/crypto/chacha/chacha_enc.c
7384 + #if !defined(OPENSSL_NO_CHACHA)
7386 ++#include <openssl/crypto.h>
7387 + #include <openssl/chacha.h>
7389 + /* sigma contains the ChaCha constants, which happen to be an ASCII string. */
7390 +@@ -87,6 +88,15 @@ static const char sigma[16] = "expand 32-byte k";
7392 + typedef unsigned int uint32_t;
7395 ++/* Defined in chacha_vec.c */
7396 ++void CRYPTO_chacha_20_neon(unsigned char *out,
7397 ++ const unsigned char *in, size_t in_len,
7398 ++ const unsigned char key[32],
7399 ++ const unsigned char nonce[8],
7403 + /* chacha_core performs |num_rounds| rounds of ChaCha20 on the input words in
7404 + * |input| and writes the 64 output bytes to |output|. */
7405 + static void chacha_core(unsigned char output[64], const uint32_t input[16],
7406 +@@ -124,6 +134,16 @@ void CRYPTO_chacha_20(unsigned char *out,
7407 + unsigned char buf[64];
7411 ++ if (CRYPTO_is_NEON_capable() &&
7412 ++ ((intptr_t)in & 15) == 0 &&
7413 ++ ((intptr_t)out & 15) == 0)
7415 ++ CRYPTO_chacha_20_neon(out, in, in_len, key, nonce, counter);
7420 + input[0] = U8TO32_LITTLE(sigma + 0);
7421 + input[1] = U8TO32_LITTLE(sigma + 4);
7422 + input[2] = U8TO32_LITTLE(sigma + 8);
7423 +diff --git a/crypto/chacha/chacha_vec.c b/crypto/chacha/chacha_vec.c
7424 +index 33b2238..1226c39 100644
7425 +--- a/crypto/chacha/chacha_vec.c
7426 ++++ b/crypto/chacha/chacha_vec.c
7427 +@@ -154,7 +154,14 @@ typedef unsigned vec __attribute__ ((vector_size (16)));
7428 + STORE(op + d + 8, LOAD(in + d + 8) ^ REVV_BE(v2)); \
7429 + STORE(op + d +12, LOAD(in + d +12) ^ REVV_BE(v3));
7432 ++/* For ARM, we can't depend on NEON support, so this function is compiled with
7433 ++ * a different name, along with the generic code, and can be enabled at
7435 ++void CRYPTO_chacha_20_neon(
7437 + void CRYPTO_chacha_20(
7439 + unsigned char *out,
7440 + const unsigned char *in,
7442 +diff --git a/crypto/chacha/chacha_vec_arm.S b/crypto/chacha/chacha_vec_arm.S
7443 +new file mode 100644
7444 +index 0000000..24a5050
7446 ++++ b/crypto/chacha/chacha_vec_arm.S
7448 ++# This file contains a pre-compiled version of chacha_vec.c for ARM. This is
7449 ++# needed to support switching on NEON code at runtime. If the whole of OpenSSL
7450 ++# were to be compiled with the needed flags to build chacha_vec.c, then it
7451 ++# wouldn't be possible to run on non-NEON systems.
7453 ++# This file was generated by:
7455 ++# /opt/gcc-linaro-arm-linux-gnueabihf-4.7-2012.10-20121022_linux/bin/arm-linux-gnueabihf-gcc -O3 -mcpu=cortex-a8 -mfpu=neon -S chacha_vec.c -I ../../include -fpic -o chacha_vec_arm.S
7457 ++# And then EABI attribute 28 was set to zero to allow linking with soft-float
7462 ++ .eabi_attribute 27, 3
7463 ++ .eabi_attribute 28, 0
7465 ++ .eabi_attribute 20, 1
7466 ++ .eabi_attribute 21, 1
7467 ++ .eabi_attribute 23, 3
7468 ++ .eabi_attribute 24, 1
7469 ++ .eabi_attribute 25, 1
7470 ++ .eabi_attribute 26, 2
7471 ++ .eabi_attribute 30, 2
7472 ++ .eabi_attribute 34, 1
7473 ++ .eabi_attribute 18, 4
7475 ++ .file "chacha_vec.c"
7478 ++ .global CRYPTO_chacha_20_neon
7481 ++ .type CRYPTO_chacha_20_neon, %function
7482 ++CRYPTO_chacha_20_neon:
7483 ++ @ args = 8, pretend = 0, frame = 304
7484 ++ @ frame_needed = 1, uses_anonymous_args = 0
7485 ++ @ link register save eliminated.
7486 ++ push {r4, r5, r6, r7, r8, r9, sl, fp}
7487 ++ fstmfdd sp!, {d8, d9, d10, d11, d12, d13, d14, d15}
7492 ++ str r2, [r7, #196]
7494 ++ ldr r4, [r7, #196]
7495 ++ ldr r6, [r7, #400]
7497 ++ umull r4, ip, ip, r4
7499 ++ ldr r8, [r7, #400]
7503 ++ str r3, [r7, #244]
7504 ++ str r6, [r7, #176]
7506 ++ str r0, [r7, #188]
7507 ++ str r4, [r7, #200]
7509 ++ str r1, [r7, #184]
7510 ++ ldmia r2, {r0, r1, r2, r3}
7512 ++ ldr r5, [r7, #244]
7513 ++ vld1.64 {d24-d25}, [r5:64]
7514 ++ vldr d26, [r5, #16]
7515 ++ vldr d27, [r5, #24]
7516 ++ ldr r9, [r7, #200]
7517 ++ ldr r8, [r7, #404]
7518 ++ ldr r5, [r7, #176]
7520 ++ str r4, [r7, #300]
7522 ++ str r8, [r7, #288]
7523 ++ str r5, [r7, #296]
7524 ++ str r4, [r7, #292]
7525 ++ stmia r6, {r0, r1, r2, r3}
7526 ++ vldr d22, [r9, #64]
7527 ++ vldr d23, [r9, #72]
7528 ++ vldr d20, [r7, #288]
7529 ++ vldr d21, [r7, #296]
7530 ++ str ip, [r7, #192]
7533 ++ ldr r1, [r9, #68]
7535 ++ str r6, [r7, #180]
7536 ++ ldr r2, [r9, #72]
7538 ++ ldr r5, [r9, #76]
7541 ++ str r4, [r7, #240]
7542 ++ ldr r6, [r7, #184]
7543 ++ ldr r4, [r7, #188]
7544 ++ str r0, [r7, #224]
7545 ++ str r1, [r7, #220]
7546 ++ str r8, [r7, #208]
7547 ++ str r2, [r7, #216]
7548 ++ str r3, [r7, #204]
7549 ++ str r5, [r7, #212]
7550 ++ str r6, [r7, #252]
7551 ++ str r4, [r7, #248]
7553 ++ ldr r2, [r7, #244]
7555 ++ ldr r3, [r7, #244]
7556 ++ vadd.i32 q8, q10, q9
7557 ++ ldr r6, [r7, #208]
7558 ++ vmov q15, q13 @ v4si
7559 ++ ldr r5, [r7, #240]
7560 ++ vmov q3, q12 @ v4si
7561 ++ ldr r4, [r7, #244]
7562 ++ vmov q2, q11 @ v4si
7565 ++ ldr r6, [r7, #400]
7566 ++ vmov q5, q10 @ v4si
7567 ++ ldr r3, [r3, #12]
7568 ++ vmov q1, q13 @ v4si
7569 ++ ldr r0, [r7, #244]
7570 ++ vmov q0, q12 @ v4si
7571 ++ ldr r1, [r7, #244]
7572 ++ vmov q4, q11 @ v4si
7573 ++ ldmia r9, {r9, sl, fp}
7574 ++ str r5, [r7, #228]
7575 ++ ldr r5, [r4, #24]
7578 ++ str r2, [r7, #264]
7579 ++ str r3, [r7, #236]
7581 ++ ldr r3, [r4, #28]
7582 ++ str r5, [r7, #280]
7585 ++ ldr ip, [r7, #228]
7586 ++ ldr r8, [r7, #212]
7587 ++ str r0, [r7, #232]
7588 ++ str r1, [r7, #268]
7589 ++ ldr r0, [r4, #16]
7590 ++ ldr r1, [r4, #20]
7592 ++ str r2, [r7, #24]
7593 ++ str r3, [r7, #284]
7594 ++ str r4, [r7, #256]
7595 ++ ldr r2, [r7, #264]
7596 ++ str r9, [r7, #276]
7598 ++ ldr r6, [r7, #280]
7599 ++ str r8, [r7, #260]
7601 ++ str r1, [r7, #272]
7603 ++ str r6, [r7, #264]
7605 ++ ldr r3, [r7, #236]
7607 ++ ldr ip, [r7, #24]
7608 ++ ldr r1, [r7, #268]
7609 ++ ldr r0, [r7, #232]
7618 ++ .word .LANCHOR0-(.LPIC24+4)
7621 ++ vadd.i32 q4, q4, q0
7623 ++ vadd.i32 q2, q2, q3
7624 ++ str r8, [r7, #268]
7626 ++ ldr r8, [r7, #276]
7629 ++ str fp, [r7, #280]
7632 ++ str r8, [r7, #276]
7634 ++ vadd.i32 q1, q1, q5
7635 ++ vadd.i32 q15, q15, q8
7636 ++ ldr r8, [r7, #280]
7638 ++ ldr r4, [r7, #260]
7641 ++ ldr r8, [r7, #276]
7643 ++ vshl.i32 q7, q0, #12
7644 ++ ldr r4, [r7, #268]
7645 ++ vshl.i32 q6, q3, #12
7648 ++ ldr r4, [r7, #272]
7649 ++ vsri.32 q7, q0, #20
7651 ++ ldr r6, [r7, #264]
7653 ++ vsri.32 q6, q3, #20
7657 ++ vadd.i32 q4, q4, q7
7658 ++ str r5, [r7, #236]
7659 ++ vadd.i32 q2, q2, q6
7662 ++ ldr r6, [r7, #284]
7667 ++ str r6, [r7, #264]
7669 ++ ldr r6, [r7, #236]
7670 ++ vshl.i32 q3, q5, #8
7671 ++ vshl.i32 q14, q8, #8
7674 ++ ldr r6, [r7, #264]
7675 ++ vsri.32 q3, q5, #24
7678 ++ ldr r6, [r7, #280]
7680 ++ vsri.32 q14, q8, #24
7682 ++ str r6, [r7, #284]
7683 ++ ldr r6, [r7, #268]
7684 ++ vadd.i32 q1, q1, q3
7685 ++ vadd.i32 q15, q15, q14
7688 ++ str r6, [r7, #260]
7689 ++ ldr r6, [r7, #276]
7694 ++ str r6, [r7, #280]
7695 ++ ldr r6, [r7, #284]
7696 ++ vshl.i32 q0, q6, #7
7697 ++ vshl.i32 q5, q7, #7
7700 ++ ldr r6, [r7, #260]
7702 ++ vsri.32 q0, q6, #25
7704 ++ ldr r6, [r7, #280]
7706 ++ vsri.32 q5, q7, #25
7708 ++ ldr r6, [r7, #236]
7712 ++ str r6, [r7, #276]
7713 ++ ldr r6, [r7, #264]
7715 ++ str r5, [r7, #272]
7716 ++ vext.32 q5, q5, q5, #1
7718 ++ ldr r6, [r7, #276]
7719 ++ vext.32 q0, q0, q0, #1
7720 ++ vadd.i32 q4, q4, q5
7722 ++ ldr r6, [r7, #272]
7723 ++ vadd.i32 q2, q2, q0
7724 ++ vext.32 q3, q3, q3, #3
7727 ++ vext.32 q14, q14, q14, #3
7729 ++ ldr r6, [r7, #284]
7731 ++ veor q14, q2, q14
7734 ++ vext.32 q1, q1, q1, #2
7736 ++ str r6, [r7, #284]
7737 ++ vext.32 q15, q15, q15, #2
7738 ++ ldr r6, [r7, #260]
7741 ++ vrev32.16 q8, q14
7744 ++ str r6, [r7, #268]
7745 ++ vadd.i32 q1, q1, q3
7746 ++ ldr r6, [r7, #280]
7747 ++ vadd.i32 q15, q15, q8
7752 ++ str r6, [r7, #264]
7753 ++ ldr r6, [r7, #268]
7756 ++ vshl.i32 q6, q5, #12
7758 ++ ldr r6, [r7, #284]
7759 ++ vshl.i32 q14, q0, #12
7762 ++ ldr r6, [r7, #264]
7763 ++ vsri.32 q6, q5, #20
7767 ++ vsri.32 q14, q0, #20
7768 ++ ldr r8, [r7, #272]
7773 ++ str r4, [r7, #236]
7775 ++ str r5, [r7, #280]
7776 ++ vadd.i32 q4, q4, q6
7777 ++ ldr r5, [r7, #236]
7778 ++ vadd.i32 q2, q2, q14
7779 ++ ldr r4, [r7, #276]
7784 ++ str r8, [r7, #272]
7785 ++ str r0, [r7, #24]
7787 ++ ldr r8, [r7, #280]
7789 ++ ldr r0, [r7, #284]
7791 ++ str fp, [r7, #260]
7795 ++ ldr r0, [r7, #260]
7797 ++ vshl.i32 q5, q3, #8
7798 ++ str r4, [r7, #232]
7799 ++ vshl.i32 q8, q0, #8
7800 ++ ldr r4, [r7, #268]
7801 ++ ldr r5, [r7, #264]
7807 ++ vsri.32 q5, q3, #24
7808 ++ ldr r4, [r7, #272]
7811 ++ vsri.32 q8, q0, #24
7814 ++ ldr r0, [r7, #280]
7815 ++ str r5, [r7, #276]
7817 ++ ldr r5, [r7, #236]
7818 ++ vadd.i32 q1, q1, q5
7819 ++ str r4, [r7, #272]
7820 ++ vadd.i32 q15, q15, q8
7821 ++ ldr r4, [r7, #232]
7827 ++ str r5, [r7, #264]
7829 ++ str r0, [r7, #284]
7831 ++ ldr r4, [r7, #24]
7832 ++ veor q14, q15, q14
7833 ++ ldr r0, [r7, #272]
7835 ++ vshl.i32 q0, q6, #7
7836 ++ vext.32 q1, q1, q1, #2
7838 ++ ldr r4, [r7, #284]
7839 ++ str r0, [r7, #280]
7840 ++ vshl.i32 q3, q14, #7
7842 ++ ldr r4, [r7, #280]
7843 ++ ldr r0, [r7, #264]
7844 ++ vsri.32 q0, q6, #25
7848 ++ vsri.32 q3, q14, #25
7850 ++ ldr r4, [r7, #256]
7852 ++ vext.32 q5, q5, q5, #1
7854 ++ str r4, [r7, #256]
7855 ++ vext.32 q15, q15, q15, #2
7856 ++ vext.32 q8, q8, q8, #1
7857 ++ vext.32 q0, q0, q0, #3
7858 ++ vext.32 q3, q3, q3, #3
7860 ++ ldr r4, [r7, #264]
7861 ++ vadd.i32 q14, q10, q9
7862 ++ str r2, [r7, #264]
7863 ++ vadd.i32 q10, q10, q5
7864 ++ ldr r2, [r7, #252]
7865 ++ vld1.64 {d12-d13}, [r2:64]
7866 ++ ldr r2, [r7, #220]
7867 ++ vadd.i32 q4, q11, q4
7868 ++ str ip, [r7, #24]
7871 ++ ldr r8, [r7, #260]
7873 ++ ldr r2, [r7, #212]
7874 ++ str r4, [r7, #280]
7875 ++ vadd.i32 q0, q12, q0
7876 ++ ldr r4, [r7, #224]
7878 ++ ldr r2, [r7, #240]
7879 ++ vadd.i32 q1, q13, q1
7880 ++ str r0, [r7, #232]
7883 ++ ldr r4, [r7, #216]
7886 ++ ldr r9, [r7, #276]
7888 ++ str r2, [r7, #240]
7889 ++ vadd.i32 q2, q11, q2
7890 ++ ldr r2, [r7, #252]
7892 ++ vadd.i32 q3, q12, q3
7893 ++ ldr r4, [r7, #228]
7894 ++ vadd.i32 q15, q13, q15
7895 ++ str r1, [r7, #268]
7896 ++ vadd.i32 q8, q14, q8
7897 ++ str r3, [r7, #236]
7899 ++ ldr r3, [r7, #284]
7900 ++ ldr r1, [r7, #272]
7902 ++ ldr r4, [r7, #248]
7903 ++ vst1.64 {d8-d9}, [r4:64]
7904 ++ vldr d8, [r2, #16]
7905 ++ vldr d9, [r2, #24]
7907 ++ vstr d0, [r4, #16]
7908 ++ vstr d1, [r4, #24]
7909 ++ vldr d0, [r2, #32]
7910 ++ vldr d1, [r2, #40]
7912 ++ vstr d2, [r4, #32]
7913 ++ vstr d3, [r4, #40]
7914 ++ vldr d2, [r2, #48]
7915 ++ vldr d3, [r2, #56]
7916 ++ veor q10, q10, q1
7917 ++ vstr d20, [r4, #48]
7918 ++ vstr d21, [r4, #56]
7919 ++ vldr d8, [r2, #64]
7920 ++ vldr d9, [r2, #72]
7922 ++ vstr d4, [r4, #64]
7923 ++ vstr d5, [r4, #72]
7924 ++ vldr d10, [r2, #80]
7925 ++ vldr d11, [r2, #88]
7927 ++ vstr d6, [r4, #80]
7928 ++ vstr d7, [r4, #88]
7929 ++ vldr d12, [r2, #96]
7930 ++ vldr d13, [r2, #104]
7931 ++ veor q15, q15, q6
7932 ++ vstr d30, [r4, #96]
7933 ++ vstr d31, [r4, #104]
7934 ++ vldr d20, [r2, #112]
7935 ++ vldr d21, [r2, #120]
7937 ++ vstr d16, [r4, #112]
7938 ++ vstr d17, [r4, #120]
7939 ++ ldr r4, [r2, #128]
7940 ++ ldr r2, [r7, #248]
7941 ++ vadd.i32 q10, q14, q9
7943 ++ vadd.i32 q10, q10, q9
7944 ++ str r4, [r2, #128]
7945 ++ ldr r4, [r7, #252]
7946 ++ ldr r2, [r4, #132]
7948 ++ ldr sl, [r7, #248]
7949 ++ str r2, [sl, #132]
7950 ++ ldr r2, [r4, #136]
7952 ++ str r2, [sl, #136]
7953 ++ ldr r2, [r4, #140]
7955 ++ str r2, [sl, #140]
7956 ++ ldr r2, [r7, #244]
7957 ++ ldr r4, [r4, #144]
7959 ++ str r4, [r7, #44]
7960 ++ ldr r4, [r7, #232]
7962 ++ ldr r2, [r7, #44]
7963 ++ ldr r4, [r7, #244]
7965 ++ ldr r2, [r7, #252]
7966 ++ str r8, [sl, #144]
7968 ++ ldr r2, [r2, #148]
7969 ++ str r2, [r7, #40]
7970 ++ ldr r2, [r7, #268]
7972 ++ ldr r4, [r7, #40]
7973 ++ ldr r2, [r7, #244]
7975 ++ ldr r4, [r7, #252]
7976 ++ str r8, [sl, #148]
7978 ++ ldr r4, [r4, #152]
7979 ++ str r4, [r7, #36]
7980 ++ ldr r4, [r7, #264]
7982 ++ ldr r2, [r7, #36]
7984 ++ str r8, [sl, #152]
7985 ++ ldr r2, [r7, #252]
7986 ++ ldr r4, [r7, #244]
7987 ++ ldr r2, [r2, #156]
7988 ++ ldr r4, [r4, #12]
7989 ++ str r2, [r7, #32]
7990 ++ ldr r2, [r7, #236]
7992 ++ ldr r4, [r7, #32]
7993 ++ ldr r2, [r7, #252]
7995 ++ str r8, [sl, #156]
7996 ++ ldr r8, [r7, #244]
7997 ++ ldr r2, [r2, #160]
7998 ++ ldr r4, [r8, #16]
8000 ++ ldr r4, [r7, #252]
8002 ++ str r0, [sl, #160]
8003 ++ ldr r0, [r8, #20]
8004 ++ ldr r2, [r4, #164]
8006 ++ ldr r0, [r7, #280]
8008 ++ str r1, [sl, #164]
8009 ++ ldr r2, [r8, #24]
8010 ++ ldr r1, [r4, #168]
8013 ++ str r2, [sl, #168]
8014 ++ ldr r1, [r8, #28]
8015 ++ ldr r2, [r4, #172]
8018 ++ str r3, [sl, #172]
8019 ++ ldr r3, [r4, #176]
8021 ++ str r3, [sl, #176]
8022 ++ ldr r3, [r4, #180]
8023 ++ ldr r4, [r7, #400]
8025 ++ str r6, [sl, #180]
8026 ++ ldr r6, [r7, #252]
8028 ++ ldr r3, [r6, #184]
8031 ++ str r5, [sl, #184]
8032 ++ ldr r2, [r6, #188]
8033 ++ adds r6, r6, #192
8035 ++ str r6, [r7, #252]
8036 ++ ldr r0, [r7, #24]
8037 ++ ldr r1, [r7, #240]
8040 ++ ldr r2, [r7, #204]
8041 ++ str r4, [sl, #188]
8044 ++ str sl, [r7, #248]
8046 ++ ldr r4, [r7, #192]
8047 ++ ldr r3, [r7, #180]
8048 ++ ldr r6, [r7, #188]
8050 ++ ldr r8, [r7, #184]
8055 ++ ldr r9, [r7, #196]
8058 ++ ldr sl, [r7, #196]
8059 ++ umull r9, r3, r3, r9
8061 ++ add r3, r3, r3, lsl #1
8062 ++ sub r3, sl, r3, lsl #6
8071 ++ vmov q8, q10 @ v4si
8073 ++ vmov q1, q13 @ v4si
8074 ++ vmov q14, q12 @ v4si
8075 ++ vmov q3, q11 @ v4si
8077 ++ vadd.i32 q3, q3, q14
8081 ++ vadd.i32 q8, q1, q2
8083 ++ vshl.i32 q14, q9, #12
8084 ++ vsri.32 q14, q9, #20
8085 ++ vadd.i32 q3, q3, q14
8087 ++ vshl.i32 q9, q2, #8
8088 ++ vsri.32 q9, q2, #24
8089 ++ vadd.i32 q8, q8, q9
8090 ++ vext.32 q9, q9, q9, #3
8091 ++ veor q14, q8, q14
8092 ++ vext.32 q1, q8, q8, #2
8093 ++ vshl.i32 q8, q14, #7
8094 ++ vsri.32 q8, q14, #25
8095 ++ vext.32 q8, q8, q8, #1
8096 ++ vadd.i32 q3, q3, q8
8099 ++ vadd.i32 q9, q1, q2
8101 ++ vshl.i32 q14, q8, #12
8102 ++ vsri.32 q14, q8, #20
8103 ++ vadd.i32 q3, q3, q14
8105 ++ vshl.i32 q8, q2, #8
8106 ++ vsri.32 q8, q2, #24
8107 ++ vadd.i32 q9, q9, q8
8108 ++ vext.32 q8, q8, q8, #1
8109 ++ veor q14, q9, q14
8110 ++ vext.32 q1, q9, q9, #2
8111 ++ vshl.i32 q9, q14, #7
8112 ++ vsri.32 q9, q14, #25
8113 ++ vext.32 q14, q9, q9, #3
8115 ++ vadd.i32 q8, q10, q8
8117 ++ vadd.i32 q3, q11, q3
8118 ++ vldr d0, [r1, #-16]
8119 ++ vldr d1, [r1, #-8]
8120 ++ vadd.i32 q14, q12, q14
8121 ++ vadd.i32 q1, q13, q1
8123 ++ vstr d6, [r2, #-16]
8124 ++ vstr d7, [r2, #-8]
8125 ++ vadd.i32 q10, q10, q15
8126 ++ vld1.64 {d8-d9}, [r1:64]
8127 ++ veor q14, q14, q4
8128 ++ vst1.64 {d28-d29}, [r2:64]
8129 ++ vldr d10, [r1, #16]
8130 ++ vldr d11, [r1, #24]
8132 ++ vstr d2, [r2, #16]
8133 ++ vstr d3, [r2, #24]
8134 ++ vldr d18, [r1, #32]
8135 ++ vldr d19, [r1, #40]
8138 ++ vstr d16, [r2, #32]
8139 ++ vstr d17, [r2, #40]
8146 ++ ldr r6, [r7, #196]
8149 ++ vmov q8, q10 @ v4si
8151 ++ vmov q14, q13 @ v4si
8152 ++ vmov q9, q12 @ v4si
8153 ++ vmov q15, q11 @ v4si
8155 ++ vadd.i32 q15, q15, q9
8159 ++ vadd.i32 q3, q14, q8
8161 ++ vshl.i32 q14, q9, #12
8162 ++ vsri.32 q14, q9, #20
8163 ++ vadd.i32 q15, q15, q14
8165 ++ vshl.i32 q8, q9, #8
8166 ++ vsri.32 q8, q9, #24
8167 ++ vadd.i32 q9, q3, q8
8168 ++ vext.32 q8, q8, q8, #3
8170 ++ vext.32 q14, q9, q9, #2
8171 ++ vshl.i32 q9, q2, #7
8172 ++ vsri.32 q9, q2, #25
8173 ++ vext.32 q9, q9, q9, #1
8174 ++ vadd.i32 q15, q15, q9
8177 ++ vadd.i32 q14, q14, q3
8179 ++ vshl.i32 q9, q8, #12
8180 ++ vsri.32 q9, q8, #20
8181 ++ vadd.i32 q15, q15, q9
8183 ++ vshl.i32 q8, q3, #8
8184 ++ vsri.32 q8, q3, #24
8185 ++ vadd.i32 q14, q14, q8
8186 ++ vext.32 q8, q8, q8, #1
8188 ++ vext.32 q14, q14, q14, #2
8189 ++ vshl.i32 q9, q3, #7
8190 ++ vsri.32 q9, q3, #25
8191 ++ vext.32 q9, q9, q9, #3
8194 ++ vadd.i32 q11, q11, q15
8196 ++ ldr r9, [r7, #200]
8197 ++ vst1.64 {d22-d23}, [r9:128]
8199 ++ ldr sl, [r7, #196]
8225 ++ ldr fp, [r7, #200]
8228 ++ vld1.8 {q8}, [r0]!
8231 ++ vld1.8 {q9}, [r6]!
8233 ++ vst1.8 {q8}, [r1]!
8239 ++ ldr r0, [r7, #200]
8241 ++ ldrb r2, [r5, r3] @ zero_extendqisi2
8242 ++ ldrb r1, [r3, r0] @ zero_extendqisi2
8244 ++ strb r2, [r4, r3]
8251 ++ fldmfdd sp!, {d8, d9, d10, d11, d12, d13, d14, d15}
8252 ++ pop {r4, r5, r6, r7, r8, r9, sl, fp}
8256 ++ vld1.64 {d0-d1}, [r5:64]
8257 ++ vadd.i32 q9, q12, q9
8258 ++ veor q11, q11, q0
8259 ++ vst1.64 {d22-d23}, [r4:64]
8262 ++ vldr d2, [r5, #16]
8263 ++ vldr d3, [r5, #24]
8264 ++ vadd.i32 q13, q13, q14
8266 ++ vstr d18, [r4, #16]
8267 ++ vstr d19, [r4, #24]
8269 ++ vadd.i32 q8, q8, q10
8270 ++ vldr d0, [r5, #32]
8271 ++ vldr d1, [r5, #40]
8272 ++ ldr r6, [r7, #200]
8273 ++ vstr d16, [r6, #48]
8274 ++ vstr d17, [r6, #56]
8276 ++ vstr d16, [r4, #32]
8277 ++ vstr d17, [r4, #40]
8280 ++ ldr r8, [r7, #200]
8281 ++ vstr d18, [r8, #16]
8282 ++ vstr d19, [r8, #24]
8285 ++ ldr r5, [r7, #184]
8286 ++ ldr r4, [r7, #188]
8289 ++ ldr r6, [r7, #200]
8290 ++ vstr d26, [r6, #32]
8291 ++ vstr d27, [r6, #40]
8300 ++ .size CRYPTO_chacha_20_neon, .-CRYPTO_chacha_20_neon
8309 ++ .ident "GCC: (crosstool-NG linaro-1.13.1-4.7-2012.10-20121022 - Linaro GCC 2012.10) 4.7.3 20121001 (prerelease)"
8310 ++ .section .note.GNU-stack,"",%progbits
8311 +diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
8312 +index 7bef015..3b6ab1d 100644
8313 +--- a/crypto/cryptlib.c
8314 ++++ b/crypto/cryptlib.c
8315 +@@ -661,6 +661,20 @@ const char *CRYPTO_get_lock_name(int type)
8316 + return(sk_OPENSSL_STRING_value(app_locks,type-CRYPTO_NUM_LOCKS));
8320 ++static int global_arm_neon_enabled = 0;
8322 ++void CRYPTO_set_NEON_capable(int on)
8324 ++ global_arm_neon_enabled = on != 0;
8327 ++int CRYPTO_is_NEON_capable()
8329 ++ return global_arm_neon_enabled;
8333 + #if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
8334 + defined(__INTEL__) || \
8335 + defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
8336 +diff --git a/crypto/crypto.h b/crypto/crypto.h
8337 +index e11ac73..db339c3 100644
8338 +--- a/crypto/crypto.h
8339 ++++ b/crypto/crypto.h
8340 +@@ -414,6 +414,14 @@ void CRYPTO_cleanup_all_ex_data(void);
8342 + int CRYPTO_get_new_lockid(char *name);
8344 ++/* CRYPTO_set_NEON_capable enables any NEON (ARM vector) dependent code. This
8345 ++ * code should be called before any non-init functions. */
8346 ++void CRYPTO_set_NEON_capable(int on);
8348 ++/* CRYPTO_is_NEON_capable returns the last value given to
8349 ++ * CRYPTO_set_NEON_capable, or else zero if it has never been called. */
8350 ++int CRYPTO_is_NEON_capable();
8352 + int CRYPTO_num_locks(void); /* return CRYPTO_NUM_LOCKS (shared libs!) */
8353 + void CRYPTO_lock(int mode, int type,const char *file,int line);
8354 + void CRYPTO_set_locking_callback(void (*func)(int mode,int type,
8355 +diff --git a/crypto/poly1305/poly1305.c b/crypto/poly1305/poly1305.c
8356 +index 2e5621d..00d53bf 100644
8357 +--- a/crypto/poly1305/poly1305.c
8358 ++++ b/crypto/poly1305/poly1305.c
8359 +@@ -90,6 +90,17 @@ static void U32TO8_LE(unsigned char *m, uint32_t v)
8364 ++void CRYPTO_poly1305_init_neon(poly1305_state* state,
8365 ++ const unsigned char key[32]);
8367 ++void CRYPTO_poly1305_update_neon(poly1305_state* state,
8368 ++ const unsigned char *in,
8371 ++void CRYPTO_poly1305_finish_neon(poly1305_state* state, unsigned char mac[16]);
8375 + mul32x32_64(uint32_t a, uint32_t b)
8377 +@@ -207,6 +218,16 @@ void CRYPTO_poly1305_init(poly1305_state *statep, const unsigned char key[32])
8378 + struct poly1305_state_st *state = (struct poly1305_state_st*) statep;
8379 + uint32_t t0,t1,t2,t3;
8381 ++#if 0 /* Disabled because of crbug.com/341598 */
8383 ++ if (CRYPTO_is_NEON_capable())
8385 ++ CRYPTO_poly1305_init_neon(statep, key);
8391 + t0 = U8TO32_LE(key+0);
8392 + t1 = U8TO32_LE(key+4);
8393 + t2 = U8TO32_LE(key+8);
8394 +@@ -241,6 +260,16 @@ void CRYPTO_poly1305_update(poly1305_state *statep, const unsigned char *in,
8396 + struct poly1305_state_st *state = (struct poly1305_state_st*) statep;
8398 ++#if 0 /* Disabled because of crbug.com/341598 */
8400 ++ if (CRYPTO_is_NEON_capable())
8402 ++ CRYPTO_poly1305_update_neon(statep, in, in_len);
8408 + if (state->buf_used)
8410 + unsigned int todo = 16 - state->buf_used;
8411 +@@ -282,6 +309,16 @@ void CRYPTO_poly1305_finish(poly1305_state *statep, unsigned char mac[16])
8412 + uint32_t g0,g1,g2,g3,g4;
8415 ++#if 0 /* Disabled because of crbug.com/341598 */
8417 ++ if (CRYPTO_is_NEON_capable())
8419 ++ CRYPTO_poly1305_finish_neon(statep, mac);
8425 + if (state->buf_used)
8426 + poly1305_update(state, state->buf, state->buf_used);
8428 +diff --git a/crypto/poly1305/poly1305_arm.c b/crypto/poly1305/poly1305_arm.c
8429 +index adcef35..34e339d 100644
8430 +--- a/crypto/poly1305/poly1305_arm.c
8431 ++++ b/crypto/poly1305/poly1305_arm.c
8433 + * SUPERCOP by D. J. Bernstein and Peter Schwabe. */
8435 + #include <stdint.h>
8436 ++#include <string.h>
8438 + #include <openssl/poly1305.h>
8440 +@@ -202,7 +203,8 @@ struct poly1305_state_st {
8441 + unsigned char key[16];
8444 +-void CRYPTO_poly1305_init(poly1305_state *state, const unsigned char key[32])
8445 ++void CRYPTO_poly1305_init_neon(poly1305_state *state,
8446 ++ const unsigned char key[32])
8448 + struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
8449 + fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
8450 +@@ -227,7 +229,8 @@ void CRYPTO_poly1305_init(poly1305_state *state, const unsigned char key[32])
8454 +-void CRYPTO_poly1305_update(poly1305_state *state, const unsigned char *in, size_t in_len)
8455 ++void CRYPTO_poly1305_update_neon(poly1305_state *state, const unsigned char *in,
8458 + struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
8459 + fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
8460 +@@ -285,7 +288,7 @@ void CRYPTO_poly1305_update(poly1305_state *state, const unsigned char *in, size
8464 +-void CRYPTO_poly1305_finish(poly1305_state* state, unsigned char mac[16])
8465 ++void CRYPTO_poly1305_finish_neon(poly1305_state* state, unsigned char mac[16])
8467 + struct poly1305_state_st *st = (struct poly1305_state_st*) (state);
8468 + fe1305x2 *const r = (fe1305x2 *) (st->data + (15 & (-(int) st->data)));
8472 diff -burN android-openssl-lhash2/patches/tls1_change_cipher_state_rewrite.patch android-openssl/patches/tls1_change_cipher_state_rewrite.patch
8473 --- android-openssl-lhash2/patches/tls1_change_cipher_state_rewrite.patch 1969-12-31 19:00:00.000000000 -0500
8474 +++ android-openssl/patches/tls1_change_cipher_state_rewrite.patch 2013-11-05 14:14:34.631283497 -0500
8476 +From d7f9af2d2682bc41e7bf1d669cda60f04630b04d Mon Sep 17 00:00:00 2001
8477 +From: Adam Langley <agl@chromium.org>
8478 +Date: Thu, 25 Jul 2013 14:57:38 -0400
8479 +Subject: [PATCH 39/50] tls1_change_cipher_state_rewrite
8481 +The previous version of the function made adding AEAD changes very
8482 +difficult. This change should be a semantic no-op - it should be purely
8486 + ssl/ssl_err.c | 2 +-
8487 + ssl/t1_enc.c | 445 +++++++++++++++++++++++++++++++---------------------------
8488 + 3 files changed, 240 insertions(+), 208 deletions(-)
8490 +diff --git a/ssl/ssl.h b/ssl/ssl.h
8491 +index 68e5648..672f3eb 100644
8494 +@@ -2439,6 +2439,7 @@ void ERR_load_SSL_strings(void);
8495 + #define SSL_F_SSL_WRITE 208
8496 + #define SSL_F_TLS1_CERT_VERIFY_MAC 286
8497 + #define SSL_F_TLS1_CHANGE_CIPHER_STATE 209
8498 ++#define SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER 338
8499 + #define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT 274
8500 + #define SSL_F_TLS1_ENC 210
8501 + #define SSL_F_TLS1_EXPORT_KEYING_MATERIAL 314
8502 +diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
8503 +index fc98e6c..97b2a0d 100644
8504 +--- a/ssl/ssl_err.c
8505 ++++ b/ssl/ssl_err.c
8506 +@@ -280,7 +280,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
8507 + {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"},
8508 + {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
8509 + {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
8510 +-{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"},
8511 ++{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER), "TLS1_CHANGE_CIPHER_STATE_CIPHER"},
8512 + {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"},
8513 + {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
8514 + {ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"},
8515 +diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
8516 +index 3649544..e1f91ba 100644
8519 +@@ -316,56 +316,30 @@ static int tls1_generate_key_block(SSL *s, unsigned char *km,
8523 +-int tls1_change_cipher_state(SSL *s, int which)
8524 ++/* tls1_change_cipher_state_cipher performs the work needed to switch cipher
8525 ++ * states when using EVP_CIPHER. The argument |is_read| is true iff this
8526 ++ * function is being called due to reading, as opposed to writing, a
8527 ++ * ChangeCipherSpec message. In order to support export ciphersuites,
8528 ++ * use_client_keys indicates whether the key material provided is in the
8529 ++ * "client write" direction. */
8530 ++static int tls1_change_cipher_state_cipher(
8531 ++ SSL *s, char is_read, char use_client_keys,
8532 ++ const unsigned char *mac_secret, unsigned mac_secret_len,
8533 ++ const unsigned char *key, unsigned key_len,
8534 ++ const unsigned char *iv, unsigned iv_len)
8536 +- static const unsigned char empty[]="";
8537 +- unsigned char *p,*mac_secret;
8538 +- unsigned char *exp_label;
8539 +- unsigned char tmp1[EVP_MAX_KEY_LENGTH];
8540 +- unsigned char tmp2[EVP_MAX_KEY_LENGTH];
8541 +- unsigned char iv1[EVP_MAX_IV_LENGTH*2];
8542 +- unsigned char iv2[EVP_MAX_IV_LENGTH*2];
8543 +- unsigned char *ms,*key,*iv;
8544 +- int client_write;
8545 +- EVP_CIPHER_CTX *dd;
8546 +- const EVP_CIPHER *c;
8547 +-#ifndef OPENSSL_NO_COMP
8548 +- const SSL_COMP *comp;
8552 +- int *mac_secret_size;
8553 ++ const EVP_CIPHER *cipher = s->s3->tmp.new_sym_enc;
8554 ++ const char is_export = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) != 0;
8555 ++ EVP_CIPHER_CTX *cipher_ctx;
8556 + EVP_MD_CTX *mac_ctx;
8557 +- EVP_PKEY *mac_key;
8558 +- int is_export,n,i,j,k,exp_label_len,cl;
8559 +- int reuse_dd = 0;
8560 ++ char is_aead_cipher;
8562 +- is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
8563 +- c=s->s3->tmp.new_sym_enc;
8564 +- m=s->s3->tmp.new_hash;
8565 +- mac_type = s->s3->tmp.new_mac_pkey_type;
8566 +-#ifndef OPENSSL_NO_COMP
8567 +- comp=s->s3->tmp.new_compression;
8569 ++ unsigned char export_tmp1[EVP_MAX_KEY_LENGTH];
8570 ++ unsigned char export_tmp2[EVP_MAX_KEY_LENGTH];
8571 ++ unsigned char export_iv1[EVP_MAX_IV_LENGTH * 2];
8572 ++ unsigned char export_iv2[EVP_MAX_IV_LENGTH * 2];
8575 +- printf("tls1_change_cipher_state(which= %d) w/\n", which);
8576 +- printf("\talg= %ld/%ld, comp= %p\n",
8577 +- s->s3->tmp.new_cipher->algorithm_mkey,
8578 +- s->s3->tmp.new_cipher->algorithm_auth,
8580 +- printf("\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c);
8581 +- printf("\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n",
8582 +- c->nid,c->block_size,c->key_len,c->iv_len);
8583 +- printf("\tkey_block: len= %d, data= ", s->s3->tmp.key_block_length);
8586 +- for (i=0; i<s->s3->tmp.key_block_length; i++)
8587 +- printf("%02x", s->s3->tmp.key_block[i]); printf("\n");
8589 +-#endif /* KSSL_DEBUG */
8591 +- if (which & SSL3_CC_READ)
8594 + if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
8595 + s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;
8596 +@@ -373,206 +347,257 @@ int tls1_change_cipher_state(SSL *s, int which)
8597 + s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;
8599 + if (s->enc_read_ctx != NULL)
8601 ++ EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
8602 + else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
8605 + /* make sure it's intialized in case we exit later with an error */
8606 + EVP_CIPHER_CTX_init(s->enc_read_ctx);
8607 +- dd= s->enc_read_ctx;
8608 +- mac_ctx=ssl_replace_hash(&s->read_hash,NULL);
8609 +-#ifndef OPENSSL_NO_COMP
8610 +- if (s->expand != NULL)
8612 +- COMP_CTX_free(s->expand);
8615 +- if (comp != NULL)
8617 +- s->expand=COMP_CTX_new(comp->method);
8618 +- if (s->expand == NULL)
8620 +- SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
8623 +- if (s->s3->rrec.comp == NULL)
8624 +- s->s3->rrec.comp=(unsigned char *)
8625 +- OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
8626 +- if (s->s3->rrec.comp == NULL)
8630 +- /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
8631 +- if (s->version != DTLS1_VERSION)
8632 +- memset(&(s->s3->read_sequence[0]),0,8);
8633 +- mac_secret= &(s->s3->read_mac_secret[0]);
8634 +- mac_secret_size=&(s->s3->read_mac_secret_size);
8636 ++ cipher_ctx = s->enc_read_ctx;
8637 ++ mac_ctx = ssl_replace_hash(&s->read_hash, NULL);
8639 ++ memcpy(s->s3->read_mac_secret, mac_secret, mac_secret_len);
8640 ++ s->s3->read_mac_secret_size = mac_secret_len;
8644 + if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
8645 + s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
8648 + s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
8650 + if (s->enc_write_ctx != NULL)
8652 ++ EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
8653 + else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
8656 + /* make sure it's intialized in case we exit later with an error */
8657 + EVP_CIPHER_CTX_init(s->enc_write_ctx);
8658 +- dd= s->enc_write_ctx;
8659 +- mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
8660 +-#ifndef OPENSSL_NO_COMP
8661 +- if (s->compress != NULL)
8663 +- COMP_CTX_free(s->compress);
8664 +- s->compress=NULL;
8666 +- if (comp != NULL)
8668 +- s->compress=COMP_CTX_new(comp->method);
8669 +- if (s->compress == NULL)
8671 +- SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
8676 +- /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
8677 +- if (s->version != DTLS1_VERSION)
8678 +- memset(&(s->s3->write_sequence[0]),0,8);
8679 +- mac_secret= &(s->s3->write_mac_secret[0]);
8680 +- mac_secret_size = &(s->s3->write_mac_secret_size);
8684 +- EVP_CIPHER_CTX_cleanup(dd);
8686 +- p=s->s3->tmp.key_block;
8687 +- i=*mac_secret_size=s->s3->tmp.new_mac_secret_size;
8688 ++ cipher_ctx = s->enc_write_ctx;
8689 ++ mac_ctx = ssl_replace_hash(&s->write_hash, NULL);
8691 +- cl=EVP_CIPHER_key_length(c);
8692 +- j=is_export ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
8693 +- cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
8694 +- /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
8695 +- /* If GCM mode only part of IV comes from PRF */
8696 +- if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
8697 +- k = EVP_GCM_TLS_FIXED_IV_LEN;
8699 +- k=EVP_CIPHER_iv_length(c);
8700 +- if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
8701 +- (which == SSL3_CHANGE_CIPHER_SERVER_READ))
8703 +- ms= &(p[ 0]); n=i+i;
8704 +- key= &(p[ n]); n+=j+j;
8705 +- iv= &(p[ n]); n+=k+k;
8706 +- exp_label=(unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST;
8707 +- exp_label_len=TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
8713 +- ms= &(p[ n]); n+=i+j;
8714 +- key= &(p[ n]); n+=j+k;
8715 +- iv= &(p[ n]); n+=k;
8716 +- exp_label=(unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST;
8717 +- exp_label_len=TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
8719 ++ memcpy(s->s3->write_mac_secret, mac_secret, mac_secret_len);
8720 ++ s->s3->write_mac_secret_size = mac_secret_len;
8723 +- if (n > s->s3->tmp.key_block_length)
8725 +- SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
8729 +- memcpy(mac_secret,ms,i);
8731 +- if (!(EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER))
8733 +- mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
8734 +- mac_secret,*mac_secret_size);
8735 +- EVP_DigestSignInit(mac_ctx,NULL,m,NULL,mac_key);
8736 +- EVP_PKEY_free(mac_key);
8739 +-printf("which = %04X\nmac key=",which);
8740 +-{ int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); }
8744 + /* In here I set both the read and write key/iv to the
8745 + * same value since only the correct one will be used :-).
8747 ++ const unsigned char *label;
8748 ++ unsigned label_len;
8750 ++ if (use_client_keys)
8752 ++ label = (const unsigned char*) TLS_MD_CLIENT_WRITE_KEY_CONST;
8753 ++ label_len = TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
8757 ++ label = (const unsigned char*) TLS_MD_SERVER_WRITE_KEY_CONST;
8758 ++ label_len = TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
8761 + if (!tls1_PRF(ssl_get_algorithm2(s),
8762 +- exp_label,exp_label_len,
8763 +- s->s3->client_random,SSL3_RANDOM_SIZE,
8764 +- s->s3->server_random,SSL3_RANDOM_SIZE,
8766 +- key,j,tmp1,tmp2,EVP_CIPHER_key_length(c)))
8769 ++ label, label_len,
8770 ++ s->s3->client_random, SSL3_RANDOM_SIZE,
8771 ++ s->s3->server_random, SSL3_RANDOM_SIZE,
8772 ++ NULL, 0, NULL, 0,
8773 ++ key /* secret */, key_len /* secret length */,
8774 ++ export_tmp1 /* output */,
8775 ++ export_tmp2 /* scratch space */,
8776 ++ EVP_CIPHER_key_length(s->s3->tmp.new_sym_enc) /* output length */))
8778 ++ key = export_tmp1;
8783 ++ static const unsigned char empty[] = "";
8785 + if (!tls1_PRF(ssl_get_algorithm2(s),
8786 +- TLS_MD_IV_BLOCK_CONST,TLS_MD_IV_BLOCK_CONST_SIZE,
8787 +- s->s3->client_random,SSL3_RANDOM_SIZE,
8788 +- s->s3->server_random,SSL3_RANDOM_SIZE,
8790 +- empty,0,iv1,iv2,k*2))
8792 +- if (client_write)
8794 ++ TLS_MD_IV_BLOCK_CONST, TLS_MD_IV_BLOCK_CONST_SIZE,
8795 ++ s->s3->client_random, SSL3_RANDOM_SIZE,
8796 ++ s->s3->server_random, SSL3_RANDOM_SIZE,
8797 ++ NULL, 0, NULL, 0,
8798 ++ empty /* secret */ ,0 /* secret length */,
8799 ++ export_iv1 /* output */,
8800 ++ export_iv2 /* scratch space */,
8801 ++ iv_len * 2 /* output length */))
8804 ++ if (use_client_keys)
8808 ++ iv = &export_iv1[iv_len];
8812 +- s->session->key_arg_length=0;
8816 +- printf("EVP_CipherInit_ex(dd,c,key=,iv=,which)\n");
8817 +- printf("\tkey= "); for (i=0; i<c->key_len; i++) printf("%02x", key[i]);
8819 +- printf("\t iv= "); for (i=0; i<c->iv_len; i++) printf("%02x", iv[i]);
8822 +-#endif /* KSSL_DEBUG */
8823 ++ /* is_aead_cipher indicates whether the EVP_CIPHER implements an AEAD
8824 ++ * interface. This is different from the newer EVP_AEAD interface. */
8825 ++ is_aead_cipher = (EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0;
8827 +- if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
8828 ++ if (!is_aead_cipher)
8830 +- EVP_CipherInit_ex(dd,c,NULL,key,NULL,(which & SSL3_CC_WRITE));
8831 +- EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv);
8832 ++ EVP_PKEY *mac_key =
8833 ++ EVP_PKEY_new_mac_key(s->s3->tmp.new_mac_pkey_type,
8834 ++ NULL, mac_secret, mac_secret_len);
8837 ++ EVP_DigestSignInit(mac_ctx, NULL, s->s3->tmp.new_hash, NULL, mac_key);
8838 ++ EVP_PKEY_free(mac_key);
8841 +- EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
8843 ++ if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
8845 ++ EVP_CipherInit_ex(cipher_ctx, cipher, NULL /* engine */, key,
8846 ++ NULL /* iv */, !is_read);
8847 ++ EVP_CIPHER_CTX_ctrl(cipher_ctx, EVP_CTRL_GCM_SET_IV_FIXED, iv_len, (void*) iv);
8850 ++ EVP_CipherInit_ex(cipher_ctx, cipher, NULL /* engine */, key, iv, !is_read);
8852 + /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
8853 +- if ((EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size)
8854 +- EVP_CIPHER_CTX_ctrl(dd,EVP_CTRL_AEAD_SET_MAC_KEY,
8855 +- *mac_secret_size,mac_secret);
8858 +-printf("which = %04X\nkey=",which);
8859 +-{ int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); }
8861 +-{ int z; for (z=0; z<k; z++) printf("%02X%c",iv[z],((z+1)%16)?' ':'\n'); }
8865 +- OPENSSL_cleanse(tmp1,sizeof(tmp1));
8866 +- OPENSSL_cleanse(tmp2,sizeof(tmp1));
8867 +- OPENSSL_cleanse(iv1,sizeof(iv1));
8868 +- OPENSSL_cleanse(iv2,sizeof(iv2));
8870 ++ if (is_aead_cipher && mac_secret_len > 0)
8871 ++ EVP_CIPHER_CTX_ctrl(cipher_ctx, EVP_CTRL_AEAD_SET_MAC_KEY,
8872 ++ mac_secret_len, (void*) mac_secret);
8876 ++ OPENSSL_cleanse(export_tmp1, sizeof(export_tmp1));
8877 ++ OPENSSL_cleanse(export_tmp2, sizeof(export_tmp1));
8878 ++ OPENSSL_cleanse(export_iv1, sizeof(export_iv1));
8879 ++ OPENSSL_cleanse(export_iv2, sizeof(export_iv2));
8885 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER, ERR_R_MALLOC_FAILURE);
8889 ++int tls1_change_cipher_state(SSL *s, int which)
8891 ++ /* is_read is true if we have just read a ChangeCipherSpec message -
8892 ++ * i.e. we need to update the read cipherspec. Otherwise we have just
8893 ++ * written one. */
8894 ++ const char is_read = (which & SSL3_CC_READ) != 0;
8895 ++ /* use_client_keys is true if we wish to use the keys for the "client
8896 ++ * write" direction. This is the case if we're a client sending a
8897 ++ * ChangeCipherSpec, or a server reading a client's ChangeCipherSpec. */
8898 ++ const char use_client_keys = which == SSL3_CHANGE_CIPHER_CLIENT_WRITE ||
8899 ++ which == SSL3_CHANGE_CIPHER_SERVER_READ;
8900 ++ const unsigned char *client_write_mac_secret, *server_write_mac_secret, *mac_secret;
8901 ++ const unsigned char *client_write_key, *server_write_key, *key;
8902 ++ const unsigned char *client_write_iv, *server_write_iv, *iv;
8903 ++ const EVP_CIPHER *cipher = s->s3->tmp.new_sym_enc;
8904 ++ unsigned key_len, iv_len, mac_secret_len;
8905 ++ const unsigned char *key_data;
8906 ++ const char is_export = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) != 0;
8908 ++ /* Update compression contexts. */
8909 ++#ifndef OPENSSL_NO_COMP
8910 ++ const SSL_COMP *comp = s->s3->tmp.new_compression;
8914 ++ if (s->expand != NULL)
8916 ++ COMP_CTX_free(s->expand);
8917 ++ s->expand = NULL;
8919 ++ if (comp != NULL)
8921 ++ s->expand=COMP_CTX_new(comp->method);
8922 ++ if (s->expand == NULL)
8924 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
8927 ++ if (s->s3->rrec.comp == NULL)
8928 ++ s->s3->rrec.comp =
8929 ++ (unsigned char *)OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
8930 ++ if (s->s3->rrec.comp == NULL)
8936 ++ if (s->compress != NULL)
8938 ++ COMP_CTX_free(s->compress);
8939 ++ s->compress = NULL;
8941 ++ if (comp != NULL)
8943 ++ s->compress = COMP_CTX_new(comp->method);
8944 ++ if (s->compress == NULL)
8946 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
8951 ++#endif /* OPENSSL_NO_COMP */
8953 ++ /* Reset sequence number to zero. */
8954 ++ memset(is_read ? s->s3->read_sequence : s->s3->write_sequence, 0, 8);
8956 ++ /* key_arg is used for SSLv2. We don't need it for TLS. */
8957 ++ s->session->key_arg_length = 0;
8959 ++ mac_secret_len = s->s3->tmp.new_mac_secret_size;
8961 ++ key_len = EVP_CIPHER_key_length(cipher);
8962 ++ if (is_export && key_len > SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher))
8963 ++ key_len = SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher);
8965 ++ if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
8966 ++ iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
8968 ++ iv_len = EVP_CIPHER_iv_length(cipher);
8970 ++ key_data = s->s3->tmp.key_block;
8971 ++ client_write_mac_secret = key_data; key_data += mac_secret_len;
8972 ++ server_write_mac_secret = key_data; key_data += mac_secret_len;
8973 ++ client_write_key = key_data; key_data += key_len;
8974 ++ server_write_key = key_data; key_data += key_len;
8975 ++ client_write_iv = key_data; key_data += iv_len;
8976 ++ server_write_iv = key_data; key_data += iv_len;
8978 ++ if (use_client_keys)
8980 ++ mac_secret = client_write_mac_secret;
8981 ++ key = client_write_key;
8982 ++ iv = client_write_iv;
8986 ++ mac_secret = server_write_mac_secret;
8987 ++ key = server_write_key;
8988 ++ iv = server_write_iv;
8991 ++ if (key_data - s->s3->tmp.key_block != s->s3->tmp.key_block_length)
8993 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
8997 ++ if (!tls1_change_cipher_state_cipher(s, is_read, use_client_keys,
8998 ++ mac_secret, mac_secret_len,
9006 +- SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
9009 ++ SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
9013 + int tls1_setup_key_block(SSL *s)
9014 +@@ -584,6 +609,7 @@ int tls1_setup_key_block(SSL *s)
9016 + int mac_type= NID_undef,mac_secret_size=0;
9021 + printf ("tls1_setup_key_block()\n");
9022 +@@ -598,11 +624,16 @@ int tls1_setup_key_block(SSL *s)
9026 ++ if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
9027 ++ iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
9029 ++ iv_len = EVP_CIPHER_iv_length(c);
9031 + s->s3->tmp.new_sym_enc=c;
9032 + s->s3->tmp.new_hash=hash;
9033 + s->s3->tmp.new_mac_pkey_type = mac_type;
9034 + s->s3->tmp.new_mac_secret_size = mac_secret_size;
9035 +- num=EVP_CIPHER_key_length(c)+mac_secret_size+EVP_CIPHER_iv_length(c);
9036 ++ num=EVP_CIPHER_key_length(c)+mac_secret_size+iv_len;
9039 + ssl3_cleanup_key_block(s);
9043 diff -burN android-openssl-lhash2/patches/use_aead_for_aes_gcm.patch android-openssl/patches/use_aead_for_aes_gcm.patch
9044 --- android-openssl-lhash2/patches/use_aead_for_aes_gcm.patch 1969-12-31 19:00:00.000000000 -0500
9045 +++ android-openssl/patches/use_aead_for_aes_gcm.patch 2013-11-05 14:14:34.631283497 -0500
9047 +From 7156ca9ce97c1084d7fd010146c522633ad73e7a Mon Sep 17 00:00:00 2001
9048 +From: Adam Langley <agl@chromium.org>
9049 +Date: Wed, 4 Sep 2013 12:21:12 -0400
9050 +Subject: [PATCH 42/50] use_aead_for_aes_gcm.
9052 +Switches AES-GCM ciphersuites to use AEAD interfaces.
9054 + ssl/s3_lib.c | 25 +++++++++++++++----------
9055 + 1 file changed, 15 insertions(+), 10 deletions(-)
9057 +diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
9058 +index 2cd1654..75b6560 100644
9061 +@@ -166,6 +166,11 @@ const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
9063 + #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
9065 ++/* FIXED_NONCE_LEN is a macro that results in the correct value to set the
9066 ++ * fixed nonce length in SSL_CIPHER.algorithms2. It's the inverse of
9067 ++ * SSL_CIPHER_AEAD_FIXED_NONCE_LEN. */
9068 ++#define FIXED_NONCE_LEN(x) ((x/2)<<24)
9070 + /* list of available SSLv3 ciphers (sorted by id) */
9071 + OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9073 +@@ -1836,7 +1841,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9076 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9077 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9078 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9082 +@@ -1868,7 +1873,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9085 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9086 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9087 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9091 +@@ -1900,7 +1905,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9094 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9095 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9096 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9100 +@@ -1932,7 +1937,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9103 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9104 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9105 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9109 +@@ -1964,7 +1969,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9112 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9113 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9114 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9118 +@@ -1996,7 +2001,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9121 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9122 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9123 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9127 +@@ -2709,7 +2714,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9130 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9131 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9132 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9136 +@@ -2741,7 +2746,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9139 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9140 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9141 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9145 +@@ -2773,7 +2778,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9148 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9149 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9150 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
9154 +@@ -2805,7 +2810,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
9157 + SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
9158 +- SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
9159 ++ SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
projects / platform / framework / web / crosswalk.git / blob