Commit d9671f4526 for openssl.org
commit d9671f4526a01eec2ea221d3c5dea2b84423c95a
Author: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Date: Thu Jun 25 14:58:29 2026 +0200
Remove unused source files poly1305_ieee754.c and poly1305_base2_44.c
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jul 8 11:16:22 2026
(Merged from https://github.com/openssl/openssl/pull/31737)
diff --git a/crypto/poly1305/poly1305_base2_44.c b/crypto/poly1305/poly1305_base2_44.c
deleted file mode 100644
index e64f5294d8..0000000000
--- a/crypto/poly1305/poly1305_base2_44.c
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This module is meant to be used as template for base 2^44 assembly
- * implementation[s]. On side note compiler-generated code is not
- * slower than compiler-generated base 2^64 code on [high-end] x86_64,
- * even though amount of multiplications is 50% higher. Go figure...
- */
-#include <stdint.h>
-#include <stdlib.h>
-
-typedef uint128_t u128;
-
-typedef struct {
- uint64_t h[3];
- uint64_t s[2];
- uint64_t r[3];
-} poly1305_internal;
-
-#define POLY1305_BLOCK_SIZE 16
-
-/* pick 64-bit unsigned integer in little endian order */
-static uint64_t U8TOU64(const unsigned char *p)
-{
- return (((uint64_t)(p[0] & 0xff)) | ((uint64_t)(p[1] & 0xff) << 8) | ((uint64_t)(p[2] & 0xff) << 16) | ((uint64_t)(p[3] & 0xff) << 24) | ((uint64_t)(p[4] & 0xff) << 32) | ((uint64_t)(p[5] & 0xff) << 40) | ((uint64_t)(p[6] & 0xff) << 48) | ((uint64_t)(p[7] & 0xff) << 56));
-}
-
-/* store a 64-bit unsigned integer in little endian */
-static void U64TO8(unsigned char *p, uint64_t v)
-{
- p[0] = (unsigned char)((v) & 0xff);
- p[1] = (unsigned char)((v >> 8) & 0xff);
- p[2] = (unsigned char)((v >> 16) & 0xff);
- p[3] = (unsigned char)((v >> 24) & 0xff);
- p[4] = (unsigned char)((v >> 32) & 0xff);
- p[5] = (unsigned char)((v >> 40) & 0xff);
- p[6] = (unsigned char)((v >> 48) & 0xff);
- p[7] = (unsigned char)((v >> 56) & 0xff);
-}
-
-int poly1305_init(void *ctx, const unsigned char key[16])
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- uint64_t r0, r1;
-
- /* h = 0 */
- st->h[0] = 0;
- st->h[1] = 0;
- st->h[2] = 0;
-
- r0 = U8TOU64(&key[0]) & 0x0ffffffc0fffffff;
- r1 = U8TOU64(&key[8]) & 0x0ffffffc0ffffffc;
-
- /* break r1:r0 to three 44-bit digits, masks are 1<<44-1 */
- st->r[0] = r0 & 0x0fffffffffff;
- st->r[1] = ((r0 >> 44) | (r1 << 20)) & 0x0fffffffffff;
- st->r[2] = (r1 >> 24);
-
- st->s[0] = (st->r[1] + (st->r[1] << 2)) << 2;
- st->s[1] = (st->r[2] + (st->r[2] << 2)) << 2;
-
- return 0;
-}
-
-void poly1305_blocks(void *ctx, const unsigned char *inp, size_t len,
- uint32_t padbit)
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- uint64_t r0, r1, r2;
- uint64_t s1, s2;
- uint64_t h0, h1, h2, c;
- u128 d0, d1, d2;
- uint64_t pad = (uint64_t)padbit << 40;
-
- r0 = st->r[0];
- r1 = st->r[1];
- r2 = st->r[2];
-
- s1 = st->s[0];
- s2 = st->s[1];
-
- h0 = st->h[0];
- h1 = st->h[1];
- h2 = st->h[2];
-
- while (len >= POLY1305_BLOCK_SIZE) {
- uint64_t m0, m1;
-
- m0 = U8TOU64(inp + 0);
- m1 = U8TOU64(inp + 8);
-
- /* h += m[i], m[i] is broken to 44-bit digits */
- h0 += m0 & 0x0fffffffffff;
- h1 += ((m0 >> 44) | (m1 << 20)) & 0x0fffffffffff;
- h2 += (m1 >> 24) + pad;
-
- /* h *= r "%" p, where "%" stands for "partial remainder" */
- d0 = ((u128)h0 * r0) + ((u128)h1 * s2) + ((u128)h2 * s1);
- d1 = ((u128)h0 * r1) + ((u128)h1 * r0) + ((u128)h2 * s2);
- d2 = ((u128)h0 * r2) + ((u128)h1 * r1) + ((u128)h2 * r0);
-
- /* "lazy" reduction step */
- h0 = (uint64_t)d0 & 0x0fffffffffff;
- h1 = (uint64_t)(d1 += (uint64_t)(d0 >> 44)) & 0x0fffffffffff;
- h2 = (uint64_t)(d2 += (uint64_t)(d1 >> 44)) & 0x03ffffffffff; /* last 42 bits */
-
- c = (d2 >> 42);
- h0 += c + (c << 2);
-
- inp += POLY1305_BLOCK_SIZE;
- len -= POLY1305_BLOCK_SIZE;
- }
-
- st->h[0] = h0;
- st->h[1] = h1;
- st->h[2] = h2;
-}
-
-void poly1305_emit(void *ctx, unsigned char mac[16], const uint32_t nonce[4])
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- uint64_t h0, h1, h2;
- uint64_t g0, g1, g2;
- u128 t;
- uint64_t mask;
-
- h0 = st->h[0];
- h1 = st->h[1];
- h2 = st->h[2];
-
- /* after "lazy" reduction, convert 44+bit digits to 64-bit ones */
- h0 = (uint64_t)(t = (u128)h0 + (h1 << 44));
- h1 >>= 20;
- h1 = (uint64_t)(t = (u128)h1 + (h2 << 24) + (t >> 64));
- h2 >>= 40;
- h2 += (uint64_t)(t >> 64);
-
- /* compare to modulus by computing h + -p */
- g0 = (uint64_t)(t = (u128)h0 + 5);
- g1 = (uint64_t)(t = (u128)h1 + (t >> 64));
- g2 = h2 + (uint64_t)(t >> 64);
-
- /* if there was carry into 131st bit, h1:h0 = g1:g0 */
- mask = 0 - (g2 >> 2);
- g0 &= mask;
- g1 &= mask;
- mask = ~mask;
- h0 = (h0 & mask) | g0;
- h1 = (h1 & mask) | g1;
-
- /* mac = (h + nonce) % (2^128) */
- h0 = (uint64_t)(t = (u128)h0 + nonce[0] + ((uint64_t)nonce[1] << 32));
- h1 = (uint64_t)(t = (u128)h1 + nonce[2] + ((uint64_t)nonce[3] << 32) + (t >> 64));
-
- U64TO8(mac + 0, h0);
- U64TO8(mac + 8, h1);
-}
diff --git a/crypto/poly1305/poly1305_ieee754.c b/crypto/poly1305/poly1305_ieee754.c
deleted file mode 100644
index 16d3d0f5a9..0000000000
--- a/crypto/poly1305/poly1305_ieee754.c
+++ /dev/null
@@ -1,485 +0,0 @@
-/*
- * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This module is meant to be used as template for non-x87 floating-
- * point assembly modules. The template itself is x86_64-specific
- * though, as it was debugged on x86_64. So that implementer would
- * have to recognize platform-specific parts, UxTOy and inline asm,
- * and act accordingly.
- *
- * Huh? x86_64-specific code as template for non-x87? Note seven, which
- * is not a typo, but reference to 80-bit precision. This module on the
- * other hand relies on 64-bit precision operations, which are default
- * for x86_64 code. And since we are at it, just for sense of it,
- * large-block performance in cycles per processed byte for *this* code
- * is:
- * gcc-4.8 icc-15.0 clang-3.4(*)
- *
- * Westmere 4.96 5.09 4.37
- * Sandy Bridge 4.95 4.90 4.17
- * Haswell 4.92 4.87 3.78
- * Bulldozer 4.67 4.49 4.68
- * VIA Nano 7.07 7.05 5.98
- * Silvermont 10.6 9.61 12.6
- *
- * (*) clang managed to discover parallelism and deployed SIMD;
- *
- * And for range of other platforms with unspecified gcc versions:
- *
- * Freescale e300 12.5
- * PPC74x0 10.8
- * POWER6 4.92
- * POWER7 4.50
- * POWER8 4.10
- *
- * z10 11.2
- * z196+ 7.30
- *
- * UltraSPARC III 16.0
- * SPARC T4 16.1
- */
-
-#if !(defined(__GNUC__) && __GNUC__ >= 2)
-#error "this is gcc-specific template"
-#endif
-
-#include <stdint.h>
-#include <stdlib.h>
-
-typedef union {
- double d;
- uint64_t u;
-} elem64;
-
-#define TWO(p) ((double)(1ULL << (p)))
-#define TWO0 TWO(0)
-#define TWO32 TWO(32)
-#define TWO64 (TWO32 * TWO(32))
-#define TWO96 (TWO64 * TWO(32))
-#define TWO130 (TWO96 * TWO(34))
-
-#define EXP(p) ((1023ULL + (p)) << 52)
-
-#if defined(__x86_64__) || (defined(__PPC__) && defined(__LITTLE_ENDIAN__))
-#define U8TOU32(p) (*(const uint32_t *)(p))
-#define U32TO8(p, v) (*(uint32_t *)(p) = (v))
-#elif defined(__PPC__) || defined(__POWERPC__)
-#define U8TOU32(p) ({uint32_t ret; asm ("lwbrx %0,0,%1":"=r"(ret):"b"(p)); ret; })
-#define U32TO8(p, v) asm("stwbrx %0,0,%1" ::"r"(v), "b"(p) : "memory")
-#elif defined(__s390x__)
-#define U8TOU32(p) ({uint32_t ret; asm ("lrv %0,%1":"=d"(ret):"m"(*(uint32_t *)(p))); ret; })
-#define U32TO8(p, v) asm("strv %1,%0" : "=m"(*(uint32_t *)(p)) : "d"(v))
-#endif
-
-#ifndef U8TOU32
-#define U8TOU32(p) ((uint32_t)(p)[0] | (uint32_t)(p)[1] << 8 | (uint32_t)(p)[2] << 16 | (uint32_t)(p)[3] << 24)
-#endif
-#ifndef U32TO8
-#define U32TO8(p, v) ((p)[0] = (uint8_t)(v), (p)[1] = (uint8_t)((v) >> 8), \
- (p)[2] = (uint8_t)((v) >> 16), (p)[3] = (uint8_t)((v) >> 24))
-#endif
-
-typedef struct {
- elem64 h[4];
- double r[8];
- double s[6];
-} poly1305_internal;
-
-/* "round toward zero (truncate), mask all exceptions" */
-#if defined(__x86_64__)
-static const uint32_t mxcsr = 0x7f80;
-#elif defined(__PPC__) || defined(__POWERPC__)
-static const uint64_t one = 1;
-#elif defined(__s390x__)
-static const uint32_t fpc = 1;
-#elif defined(__sparc__)
-static const uint64_t fsr = 1ULL << 30;
-#elif defined(__mips__)
-static const uint32_t fcsr = 1;
-#else
-#error "unrecognized platform"
-#endif
-
-int poly1305_init(void *ctx, const unsigned char key[16])
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- elem64 r0, r1, r2, r3;
-
- /* h = 0, biased */
-#if 0
- st->h[0].d = TWO(52)*TWO0;
- st->h[1].d = TWO(52)*TWO32;
- st->h[2].d = TWO(52)*TWO64;
- st->h[3].d = TWO(52)*TWO96;
-#else
- st->h[0].u = EXP(52 + 0);
- st->h[1].u = EXP(52 + 32);
- st->h[2].u = EXP(52 + 64);
- st->h[3].u = EXP(52 + 96);
-#endif
-
- if (key) {
- /*
- * set "truncate" rounding mode
- */
-#if defined(__x86_64__)
- uint32_t mxcsr_orig;
-
- asm volatile("stmxcsr %0" : "=m"(mxcsr_orig));
- asm volatile("ldmxcsr %0" ::"m"(mxcsr));
-#elif defined(__PPC__) || defined(__POWERPC__)
- double fpscr_orig, fpscr = *(double *)&one;
-
- asm volatile("mffs %0" : "=f"(fpscr_orig));
- asm volatile("mtfsf 255,%0" ::"f"(fpscr));
-#elif defined(__s390x__)
- uint32_t fpc_orig;
-
- asm volatile("stfpc %0" : "=m"(fpc_orig));
- asm volatile("lfpc %0" ::"m"(fpc));
-#elif defined(__sparc__)
- uint64_t fsr_orig;
-
- asm volatile("stx %%fsr,%0" : "=m"(fsr_orig));
- asm volatile("ldx %0,%%fsr" ::"m"(fsr));
-#elif defined(__mips__)
- uint32_t fcsr_orig;
-
- asm volatile("cfc1 %0,$31" : "=r"(fcsr_orig));
- asm volatile("ctc1 %0,$31" ::"r"(fcsr));
-#endif
-
- /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
- r0.u = EXP(52 + 0) | (U8TOU32(&key[0]) & 0x0fffffff);
- r1.u = EXP(52 + 32) | (U8TOU32(&key[4]) & 0x0ffffffc);
- r2.u = EXP(52 + 64) | (U8TOU32(&key[8]) & 0x0ffffffc);
- r3.u = EXP(52 + 96) | (U8TOU32(&key[12]) & 0x0ffffffc);
-
- st->r[0] = r0.d - TWO(52) * TWO0;
- st->r[2] = r1.d - TWO(52) * TWO32;
- st->r[4] = r2.d - TWO(52) * TWO64;
- st->r[6] = r3.d - TWO(52) * TWO96;
-
- st->s[0] = st->r[2] * (5.0 / TWO130);
- st->s[2] = st->r[4] * (5.0 / TWO130);
- st->s[4] = st->r[6] * (5.0 / TWO130);
-
- /*
- * base 2^32 -> base 2^16
- */
- st->r[1] = (st->r[0] + TWO(52) * TWO(16) * TWO0) - TWO(52) * TWO(16) * TWO0;
- st->r[0] -= st->r[1];
-
- st->r[3] = (st->r[2] + TWO(52) * TWO(16) * TWO32) - TWO(52) * TWO(16) * TWO32;
- st->r[2] -= st->r[3];
-
- st->r[5] = (st->r[4] + TWO(52) * TWO(16) * TWO64) - TWO(52) * TWO(16) * TWO64;
- st->r[4] -= st->r[5];
-
- st->r[7] = (st->r[6] + TWO(52) * TWO(16) * TWO96) - TWO(52) * TWO(16) * TWO96;
- st->r[6] -= st->r[7];
-
- st->s[1] = (st->s[0] + TWO(52) * TWO(16) * TWO0 / TWO96) - TWO(52) * TWO(16) * TWO0 / TWO96;
- st->s[0] -= st->s[1];
-
- st->s[3] = (st->s[2] + TWO(52) * TWO(16) * TWO32 / TWO96) - TWO(52) * TWO(16) * TWO32 / TWO96;
- st->s[2] -= st->s[3];
-
- st->s[5] = (st->s[4] + TWO(52) * TWO(16) * TWO64 / TWO96) - TWO(52) * TWO(16) * TWO64 / TWO96;
- st->s[4] -= st->s[5];
-
- /*
- * restore original FPU control register
- */
-#if defined(__x86_64__)
- asm volatile("ldmxcsr %0" ::"m"(mxcsr_orig));
-#elif defined(__PPC__) || defined(__POWERPC__)
- asm volatile("mtfsf 255,%0" ::"f"(fpscr_orig));
-#elif defined(__s390x__)
- asm volatile("lfpc %0" ::"m"(fpc_orig));
-#elif defined(__sparc__)
- asm volatile("ldx %0,%%fsr" ::"m"(fsr_orig));
-#elif defined(__mips__)
- asm volatile("ctc1 %0,$31" ::"r"(fcsr_orig));
-#endif
- }
-
- return 0;
-}
-
-void poly1305_blocks(void *ctx, const unsigned char *inp, size_t len,
- int padbit)
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- elem64 in0, in1, in2, in3;
- uint64_t pad = (uint64_t)padbit << 32;
-
- double x0, x1, x2, x3;
- double h0lo, h0hi, h1lo, h1hi, h2lo, h2hi, h3lo, h3hi;
- double c0lo, c0hi, c1lo, c1hi, c2lo, c2hi, c3lo, c3hi;
-
- const double r0lo = st->r[0];
- const double r0hi = st->r[1];
- const double r1lo = st->r[2];
- const double r1hi = st->r[3];
- const double r2lo = st->r[4];
- const double r2hi = st->r[5];
- const double r3lo = st->r[6];
- const double r3hi = st->r[7];
-
- const double s1lo = st->s[0];
- const double s1hi = st->s[1];
- const double s2lo = st->s[2];
- const double s2hi = st->s[3];
- const double s3lo = st->s[4];
- const double s3hi = st->s[5];
-
- /*
- * set "truncate" rounding mode
- */
-#if defined(__x86_64__)
- uint32_t mxcsr_orig;
-
- asm volatile("stmxcsr %0" : "=m"(mxcsr_orig));
- asm volatile("ldmxcsr %0" ::"m"(mxcsr));
-#elif defined(__PPC__) || defined(__POWERPC__)
- double fpscr_orig, fpscr = *(double *)&one;
-
- asm volatile("mffs %0" : "=f"(fpscr_orig));
- asm volatile("mtfsf 255,%0" ::"f"(fpscr));
-#elif defined(__s390x__)
- uint32_t fpc_orig;
-
- asm volatile("stfpc %0" : "=m"(fpc_orig));
- asm volatile("lfpc %0" ::"m"(fpc));
-#elif defined(__sparc__)
- uint64_t fsr_orig;
-
- asm volatile("stx %%fsr,%0" : "=m"(fsr_orig));
- asm volatile("ldx %0,%%fsr" ::"m"(fsr));
-#elif defined(__mips__)
- uint32_t fcsr_orig;
-
- asm volatile("cfc1 %0,$31" : "=r"(fcsr_orig));
- asm volatile("ctc1 %0,$31" ::"r"(fcsr));
-#endif
-
- /*
- * load base 2^32 and de-bias
- */
- h0lo = st->h[0].d - TWO(52) * TWO0;
- h1lo = st->h[1].d - TWO(52) * TWO32;
- h2lo = st->h[2].d - TWO(52) * TWO64;
- h3lo = st->h[3].d - TWO(52) * TWO96;
-
-#ifdef __clang__
- h0hi = 0;
- h1hi = 0;
- h2hi = 0;
- h3hi = 0;
-#else
- in0.u = EXP(52 + 0) | U8TOU32(&inp[0]);
- in1.u = EXP(52 + 32) | U8TOU32(&inp[4]);
- in2.u = EXP(52 + 64) | U8TOU32(&inp[8]);
- in3.u = EXP(52 + 96) | U8TOU32(&inp[12]) | pad;
-
- x0 = in0.d - TWO(52) * TWO0;
- x1 = in1.d - TWO(52) * TWO32;
- x2 = in2.d - TWO(52) * TWO64;
- x3 = in3.d - TWO(52) * TWO96;
-
- x0 += h0lo;
- x1 += h1lo;
- x2 += h2lo;
- x3 += h3lo;
-
- goto fast_entry;
-#endif
-
- do {
- in0.u = EXP(52 + 0) | U8TOU32(&inp[0]);
- in1.u = EXP(52 + 32) | U8TOU32(&inp[4]);
- in2.u = EXP(52 + 64) | U8TOU32(&inp[8]);
- in3.u = EXP(52 + 96) | U8TOU32(&inp[12]) | pad;
-
- x0 = in0.d - TWO(52) * TWO0;
- x1 = in1.d - TWO(52) * TWO32;
- x2 = in2.d - TWO(52) * TWO64;
- x3 = in3.d - TWO(52) * TWO96;
-
- /*
- * note that there are multiple ways to accumulate input, e.g.
- * one can as well accumulate to h0lo-h1lo-h1hi-h2hi...
- */
- h0lo += x0;
- h0hi += x1;
- h2lo += x2;
- h2hi += x3;
-
- /*
- * carries that cross 32n-bit (and 130-bit) boundaries
- */
- c0lo = (h0lo + TWO(52) * TWO32) - TWO(52) * TWO32;
- c1lo = (h1lo + TWO(52) * TWO64) - TWO(52) * TWO64;
- c2lo = (h2lo + TWO(52) * TWO96) - TWO(52) * TWO96;
- c3lo = (h3lo + TWO(52) * TWO130) - TWO(52) * TWO130;
-
- c0hi = (h0hi + TWO(52) * TWO32) - TWO(52) * TWO32;
- c1hi = (h1hi + TWO(52) * TWO64) - TWO(52) * TWO64;
- c2hi = (h2hi + TWO(52) * TWO96) - TWO(52) * TWO96;
- c3hi = (h3hi + TWO(52) * TWO130) - TWO(52) * TWO130;
-
- /*
- * base 2^48 -> base 2^32 with last reduction step
- */
- x1 = (h1lo - c1lo) + c0lo;
- x2 = (h2lo - c2lo) + c1lo;
- x3 = (h3lo - c3lo) + c2lo;
- x0 = (h0lo - c0lo) + c3lo * (5.0 / TWO130);
-
- x1 += (h1hi - c1hi) + c0hi;
- x2 += (h2hi - c2hi) + c1hi;
- x3 += (h3hi - c3hi) + c2hi;
- x0 += (h0hi - c0hi) + c3hi * (5.0 / TWO130);
-
-#ifndef __clang__
- fast_entry:
-#endif
- /*
- * base 2^32 * base 2^16 = base 2^48
- */
- h0lo = s3lo * x1 + s2lo * x2 + s1lo * x3 + r0lo * x0;
- h1lo = r0lo * x1 + s3lo * x2 + s2lo * x3 + r1lo * x0;
- h2lo = r1lo * x1 + r0lo * x2 + s3lo * x3 + r2lo * x0;
- h3lo = r2lo * x1 + r1lo * x2 + r0lo * x3 + r3lo * x0;
-
- h0hi = s3hi * x1 + s2hi * x2 + s1hi * x3 + r0hi * x0;
- h1hi = r0hi * x1 + s3hi * x2 + s2hi * x3 + r1hi * x0;
- h2hi = r1hi * x1 + r0hi * x2 + s3hi * x3 + r2hi * x0;
- h3hi = r2hi * x1 + r1hi * x2 + r0hi * x3 + r3hi * x0;
-
- inp += 16;
- len -= 16;
-
- } while (len >= 16);
-
- /*
- * carries that cross 32n-bit (and 130-bit) boundaries
- */
- c0lo = (h0lo + TWO(52) * TWO32) - TWO(52) * TWO32;
- c1lo = (h1lo + TWO(52) * TWO64) - TWO(52) * TWO64;
- c2lo = (h2lo + TWO(52) * TWO96) - TWO(52) * TWO96;
- c3lo = (h3lo + TWO(52) * TWO130) - TWO(52) * TWO130;
-
- c0hi = (h0hi + TWO(52) * TWO32) - TWO(52) * TWO32;
- c1hi = (h1hi + TWO(52) * TWO64) - TWO(52) * TWO64;
- c2hi = (h2hi + TWO(52) * TWO96) - TWO(52) * TWO96;
- c3hi = (h3hi + TWO(52) * TWO130) - TWO(52) * TWO130;
-
- /*
- * base 2^48 -> base 2^32 with last reduction step
- */
- x1 = (h1lo - c1lo) + c0lo;
- x2 = (h2lo - c2lo) + c1lo;
- x3 = (h3lo - c3lo) + c2lo;
- x0 = (h0lo - c0lo) + c3lo * (5.0 / TWO130);
-
- x1 += (h1hi - c1hi) + c0hi;
- x2 += (h2hi - c2hi) + c1hi;
- x3 += (h3hi - c3hi) + c2hi;
- x0 += (h0hi - c0hi) + c3hi * (5.0 / TWO130);
-
- /*
- * store base 2^32, with bias
- */
- st->h[1].d = x1 + TWO(52) * TWO32;
- st->h[2].d = x2 + TWO(52) * TWO64;
- st->h[3].d = x3 + TWO(52) * TWO96;
- st->h[0].d = x0 + TWO(52) * TWO0;
-
- /*
- * restore original FPU control register
- */
-#if defined(__x86_64__)
- asm volatile("ldmxcsr %0" ::"m"(mxcsr_orig));
-#elif defined(__PPC__) || defined(__POWERPC__)
- asm volatile("mtfsf 255,%0" ::"f"(fpscr_orig));
-#elif defined(__s390x__)
- asm volatile("lfpc %0" ::"m"(fpc_orig));
-#elif defined(__sparc__)
- asm volatile("ldx %0,%%fsr" ::"m"(fsr_orig));
-#elif defined(__mips__)
- asm volatile("ctc1 %0,$31" ::"r"(fcsr_orig));
-#endif
-}
-
-void poly1305_emit(void *ctx, unsigned char mac[16], const uint32_t nonce[4])
-{
- poly1305_internal *st = (poly1305_internal *)ctx;
- uint64_t h0, h1, h2, h3, h4;
- uint32_t g0, g1, g2, g3, g4;
- uint64_t t;
- uint32_t mask;
-
- /*
- * thanks to bias masking exponent gives integer result
- */
- h0 = st->h[0].u & 0x000fffffffffffffULL;
- h1 = st->h[1].u & 0x000fffffffffffffULL;
- h2 = st->h[2].u & 0x000fffffffffffffULL;
- h3 = st->h[3].u & 0x000fffffffffffffULL;
-
- /*
- * can be partially reduced, so reduce...
- */
- h4 = h3 >> 32;
- h3 &= 0xffffffffU;
- g4 = h4 & -4;
- h4 &= 3;
- g4 += g4 >> 2;
-
- h0 += g4;
- h1 += h0 >> 32;
- h0 &= 0xffffffffU;
- h2 += h1 >> 32;
- h1 &= 0xffffffffU;
- h3 += h2 >> 32;
- h2 &= 0xffffffffU;
-
- /* compute h + -p */
- g0 = (uint32_t)(t = h0 + 5);
- g1 = (uint32_t)(t = h1 + (t >> 32));
- g2 = (uint32_t)(t = h2 + (t >> 32));
- g3 = (uint32_t)(t = h3 + (t >> 32));
- g4 = h4 + (uint32_t)(t >> 32);
-
- /* if there was carry, select g0-g3 */
- mask = 0 - (g4 >> 2);
- g0 &= mask;
- g1 &= mask;
- g2 &= mask;
- g3 &= mask;
- mask = ~mask;
- g0 |= (h0 & mask);
- g1 |= (h1 & mask);
- g2 |= (h2 & mask);
- g3 |= (h3 & mask);
-
- /* mac = (h + nonce) % (2^128) */
- g0 = (uint32_t)(t = (uint64_t)g0 + nonce[0]);
- g1 = (uint32_t)(t = (uint64_t)g1 + (t >> 32) + nonce[1]);
- g2 = (uint32_t)(t = (uint64_t)g2 + (t >> 32) + nonce[2]);
- g3 = (uint32_t)(t = (uint64_t)g3 + (t >> 32) + nonce[3]);
-
- U32TO8(mac + 0, g0);
- U32TO8(mac + 4, g1);
- U32TO8(mac + 8, g2);
- U32TO8(mac + 12, g3);
-}