Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac: Use new name for `AX_C_LONG_LONG'.
The correct name is in wheezy's version of the Autoconf archive, so I
guess it's not that new really.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
Release 2.2.4.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac, symm/rijndael*: Use ARMv8 AES instructions where available.
This matches the x86 AESNI support, but is less mad.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/dispatch.c: Add notional support for `AT_HWCAP2' entry.
Later ARM-based kernels provide one of these, at least.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac: Check that the chosen assembler will actually work.
If the system assembler doesn't like the GNUish directive syntax I'm
using, then the build will fail badly and be hard to fix. Now, if the
assembler doesn't look like it's going to work, then declare the target
platform to be unknown so as to disable all of this fancy machinery.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac: Segregate checks by source language better.
Move the poking-about-for-CPU-features function checks in with the rest
of the C code probing.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
symm/rijndael-x86ish-aesni.S: Have `endswap_block' copy NKW to ECX.
Eliminate a tiny bit of code duplication. It's not like anyone else
uses that subroutine.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Factor out `deposit fake literal pool' macro.
This might be useful for debugging purposes.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
Have a small reformatting session.
* Outdent `.macro' and `.endm' directives. Firstly, this makes them
more prominent, similar to `FUNC' and `ENDFUNC'. Secondly, though,
it has the effect of moving the macro name into the mnemonic column.
* Remove the second `External definitions' banner from `symm/
rijndael-x86ish-aesni.S'.
* Reflow the various `CPU_DISPATCH' stanze.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
symm/rijndael-x86ish-aesni.S: Decorate `rijndael_rcon' correctly.
I don't think I've tested this on 32-bit Windows, which is the only
platform I'm currently supporting which needs nontrivial symbol
decoration.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/dispatch.c: Fix list-macro invocation if we have `getauxval'.
Caused hopeless build failure on ARM versions of jessie.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/dispatch.c: Just include all the auxvec-related headers we can.
The necessary stuff will be in one of them. It turns out that the
previous approach sometimes missed some important definitions.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Use the correct `CPUFAM_*' name for ARM.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac: Quote `$ac_cv_search_clock_gettime' properly.
This can expand to `none required', which confuses test(1). My fault.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
math/pfilt.c (pfilt_jump): Fix off-by-one error in reduction.
Oh, dear. This is quite a bad one. The loop added the residues for the
jump to the candidate, and reduced each if the result was strictly
higher than the modulus. It then reports failure (or immediate success)
if any residue is zero, otherwise reporting a candidate for subsequent
testing. Obviously, this is a stupid bug, with the result that,
effectively, every step reports a candidate for further testing.
This bug has two bad consequences.
* Candidates with small factors aren't weeded out, so prime searching
takes an unnecessarily long time. I'd spotted this, but didn't have
a way in to investigate the problem.
* Candidates which actually have small factors, but are in fact below
the `smallenough' threshold, are reported as being verified as
prime, so the overall procedure erroneously returns known
composites.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
pub/bbs-gen.c, pub/rsa-gen.c: Fail if the generated key is the wrong length.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
pub/bbs-gen.c: Carefully generate numbers of the correct sizes.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
pub/bbs-gen.c: Return secret numbers for private keys.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
math/strongprime.c: Choose the smaller primes' sizes more carefully.
The old code would indeed, as the warning in the comment said, produce
numbers which are larger than requested because the component primes'
sizes were chosen in a naïve manner. I've now (eventually!) thought
about the issue some more and come up with a better approach.
The `BITSLOP' macro is now gone, replaced by a carefully chosen value
supported by some actual mathematics. As a result, the warning comments
have been removed. Also, `strongprime' will fail if it actually returns
a number of the wrong size.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
math/, pub/: Take a more consistent approach to prime-generation failures.
* Don't have `strongprime_setup' assert just because the requested
size is too small.
* Fix `strongprime' itself, so that it leaves its destination in a
predictable state (specifically, it's unmolested) if it fails.
* Remove the retry loops from `bbs_gen' and `rsa_gen'. Now,
downstream failures are consistently propagated.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
pub/rsa-gen.c: Don't leak `t'.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
math/, pub/: Generate primes with exactly the right size.
Previously, the `strongprime' and `limlee' machinery had a tendency to
generate primes which were a few bits shorter than actually requested.
Fix this unfortunate state of affairs by using a more careful analysis
of sizes of things.
The Lim--Lee prime generation has been changed quite a bit. The large
factor now might not be suitable, so there's some new machinery for
tracking how useful it's being for generating numbers of the right size
and choosing a different one if it gets out of whack. Unfortunately,
this means applying a rather unpleasant hack to the structure layout to
preserve ABI compatibility.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
math/mp-arith.c: New function `mp_leastcongruent'.
Return the least representative of a congruence class not less than a
given lower bound.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
Some basic formatting fixes.
* Some indentation fixes.
* Reorder the factors in a mathsy comment to improve clarity.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Add some slightly cheesy Thumb support.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Introduce simpler PIC data reference macro.
Using the `GOT_PREL' relocation type means that we don't need to burn a
register for the GOT.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Use new literal-pool stuff for ARM PIC macros.
The support in GAS for the ARM literal-loading syntax is entirely
hopeless.
* It unnecessarily refuses to allow expressions involving external
symbols as literal values (e.g., `ldr r0, =_GLOBAL_OFFSET_TABLE_ -
. - 12'). I've checked: if you modify GAS to remove the pointless
check, then it produces the right result.
* It doesn't use the enhanced expression evaluator which understands
relocation annotations (so you can't say `ldr r0, =foo(GOT)').
Indeed, this evaluator is internal to the handler for `.word' and
friends. Fixing this would be rather hard work, and involve
uprating the literal-pool machinery quite a bit.
Instead, use the new subsection-based fake literal pool handling
machinery `_LIT' and `_ENDLIT' and some per-macro symbols with awful
names.
This also removes the magic knowledge which the previous version of the
`ldgot' had about the right PC offset, which would have been wrong for
Thumb code.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Introduce bad literal-pool handling macros.
Abuse subsections for arranging to place literals near the functions
which need them. These are no use for human-written code, but they're
useful in macros, especially since GAS is actually rather bad at dealing
with complex expressions and relocation types in its ARM literal syntax.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Accept condition codes in ARM PIC macros.
Confusingly, the `leaext' macro already accepted a condition argument,
but did nothing with it. Add the same argument to both (as the first
optional argument), and actually make the instructions be conditional.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/asm-common.h: Use `GOTREG' rather than the raw register name.
Note that this doesn't mean that one can redefine `GOTREG' and have the
macros use a different register by default; the relative expansion
orders of the two macro systems don't work like that.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
*.S: Use `.text' consistently to name the text section.
Notably, `.text' allows a subsection number, while `.section' has
BFD-target-specific syntax.
Mark Wooding [Wed, 27 May 2015 18:06:22 +0000 (19:06 +0100)]
pub/dsa.h, pub/dsa-sign.h: Deprecate the old DSA interface.
It's terribly crufty and hard to use properly, because it offloads most
of the hard work onto its caller. It's also next to impossible to fix.
The main problem is the handling of the nonce, which the caller is
expected to have come up with somehow and passed in. It would be nice
to make this optional, and come up with a deterministic (or randomized-
but-safe) nonce in the default case, but that's very hard to do with
this interface:
* The function isn't given a random number generator so it can't use
that to randomize its nonce, if it wanted to do that.
* Worse, we aren't given a hash function, so we don't know which one
to use for generating the nonce.
It'd be possible to write a complicated thing which picks a hash
function out of a list somehow based on the other parameters, but it
doesn't seem worthwhile when taking advantage of this will still require
source changes to callers, and the newer `gdsa' interface is much
less awful.
So I'll just deprecate these old functions and hope that nobody uses
them for anything.
Mark Wooding [Wed, 27 May 2015 18:05:58 +0000 (19:05 +0100)]
pub/dsa.h: Make sure `grand' is actually declared.
Mark Wooding [Wed, 27 May 2015 18:04:29 +0000 (19:04 +0100)]
pub/dsa-misc.c, pub/dsa.h: Make arg name in comment match declaration.
Mark Wooding [Mon, 13 Jun 2016 21:24:00 +0000 (22:24 +0100)]
Release 2.2.3.
Mark Wooding [Mon, 13 Jun 2016 21:00:00 +0000 (22:00 +0100)]
Merge branch 'master' of git.distorted.org.uk:~mdw/publish/public-git/catacomb
* 'master' of git.distorted.org.uk:~mdw/publish/public-git/catacomb: (53 commits)
rand/rand.c (rdrand_quick): Improve the loop.
configure.ac, rand/noise.c: Get high-res time from `clock_gettime'.
rand/noise.c: Make the high-res timer function be a bit more abstract.
configure.ac, Makefile.am: Collect libs only needed by Catcomb itself.
Makefile.am: Include $(PIXIE_LIBS) in the main library.
rand/noise.c (noise_devrandom): Use OpenBSD system call `getentropy'.
rand/noise.c (noise_devrandom): Use new Linux system call `getrandom'.
rand/noise.c (noise_devrandom): Handle Linux's broken `/dev/urandom'.
rand/noise.c (noise_devrandom): Refactor internals.
src/noise.c: Make `bitcount' table be static and constant.
rand/rand.c: Add support for x86 `RDRAND' instruction in `rand_quick'.
base/dispatch.[ch]: Detect availability of the x86 `RDRAND' instruction.
rand/rand.[ch]: Add external `rand_quick' function.
rand/: Secure `rand' generator against fork problems.
Release 2.2.2.
math/mp-arith.c (mp_testbit): Want nonstrict comparison for bounds check.
symm/salsa20-arm-neon.S: Mark the final-permutation stores as word-aligned.
symm/: Add ARM NEON implementations of ChaCha and Salsa20.
symm/{salsa20,chacha}-x86ish-sse2.S: Use numeric labels for internal loops.
symm/salsa20-x86ish-sse2.S: Fix stray `##' comment to be `//'.
...
Conflicts:
debian/changelog
Mark Wooding [Mon, 6 Jun 2016 10:01:46 +0000 (11:01 +0100)]
rand/rand.c (rdrand_quick): Improve the loop.
The `RDRAND' instruction can fail, leaving carry clear. Previously, I
just exposed the carry flag in a register (with `SETC'), and looped
around in C.
Rewrite the loop in assembler. This is makes the flow cleaner, and
(coincidentally) avoids a dependency on the `SETcc' instructions (though
if I thought a processor might have `RDRAND' and not `SETcc', I wouldn't
have written the original code the way I did). But the main benefit is
that I don't have nightmares about seeing
...; setc al; test al, al; ...
sequences any more. There's still the issue of `i' being tested for
zero twice, but I don't think I can fix that without resorting to `asm
goto', and that has its own problems.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac, rand/noise.c: Get high-res time from `clock_gettime'.
If it's available.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/noise.c: Make the high-res timer function be a bit more abstract.
You can tell that there's more coming from the indentation. But there
shouldn't be any real change at this stage.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
configure.ac, Makefile.am: Collect libs only needed by Catcomb itself.
Currently there aren't any, but some may turn up soon.
Oddly, the `pkg-config' machinery already had all the right stuff in it:
it just wasn't being exercised.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
Makefile.am: Include $(PIXIE_LIBS) in the main library.
After all, it needs to be able to contact the pixie. I guess I've not
had to deal with many stupid systems which hide functions in `-lsocket'
recently.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/noise.c (noise_devrandom): Use OpenBSD system call `getentropy'.
If it's available, it does the right thing. I think.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/noise.c (noise_devrandom): Use new Linux system call `getrandom'.
The new system call has pretty much the right semantics. If it's
available, then try to use it. Annoyingly, the syscall isn't supported
in the libc, so we have to do it the hard way. On the plus side, this
means that the code will work if built on a system with the syscall
defined, and run on one with the right kernel, without introducing a
dependency on the libc.
If it fails because the kernel entropy pool isn't initialized, then
there's no point in messing with the devices because they won't be any
better. If it fails because the call isn't there, then it proceeds with
other options.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/noise.c (noise_devrandom): Handle Linux's broken `/dev/urandom'.
On Linux, try to open `/dev/random' and make sure it's readable before
proceeding to `/dev/urandom'. Generally we want to be reading
`/dev/urandom', but not if it hasn't been initialized properly.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/noise.c (noise_devrandom): Refactor internals.
The objective is to make adding new ways of collecting high-quality
system entropy easier.
* Add labels for success and exit, to make sure that whatever we add
whatever's in the buffer to the pool, and then clear out the buffer.
* Initialize `fd' to `-1' at the top, and close it on the way out to
make sure it doesn't leak.
* Change the main `open' condition to allow something to have opened the
right file already.
This shouldn't change any observable behaviour, but it will make things
easier in future.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
src/noise.c: Make `bitcount' table be static and constant.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/rand.c: Add support for x86 `RDRAND' instruction in `rand_quick'.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
base/dispatch.[ch]: Detect availability of the x86 `RDRAND' instruction.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/rand.[ch]: Add external `rand_quick' function.
This is a function which can be called frequently to top up the internal
entropy.
Internally, rename `TIMER' to `QUICK', and call the internal `quick'
function as well as the noise-source timer. The `quick' core currently
doesn't do anything, but will act as a dispatcher to CPU-specific
entropy sources.
Mark Wooding [Thu, 26 May 2016 08:26:09 +0000 (09:26 +0100)]
rand/: Secure `rand' generator against fork problems.
This is fiddlier than it really ought to be.
* Make the `i' and `irot' members be `unsigned short' to make space
for a new member. These members have well-constrained ranges, so
this is safe.
* Insert a new `gen' member to keep track of the pool's `generation
number'. Arrange that the global generator's generation number is
initially zero.
* Invent a new system-specific function `rand_generation' which
returns a nonzero `generation number', which changes across forks
and such things.
* Have the output functions `rand_get' and `rand_getgood' check the
generation number and force a `rand_gate' if it changes.
* Arrange for `rand_gate' and `rand_stretch' to feed the generation
number into the hashing, so that generators with different
generations behave computationally independently.
Mark Wooding [Sat, 4 Jun 2016 01:15:53 +0000 (02:15 +0100)]
Merge branch '2.2.x'
* 2.2.x:
Release 2.2.2.
math/mp-arith.c (mp_testbit): Want nonstrict comparison for bounds check.
Mark Wooding [Sat, 4 Jun 2016 00:14:08 +0000 (01:14 +0100)]
Release 2.2.2.
Mark Wooding [Fri, 3 Jun 2016 21:25:02 +0000 (22:25 +0100)]
math/mp-arith.c (mp_testbit): Want nonstrict comparison for bounds check.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/salsa20-arm-neon.S: Mark the final-permutation stores as word-aligned.
This was just an oversight when I was hacking the initial code.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/: Add ARM NEON implementations of ChaCha and Salsa20.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/{salsa20,chacha}-x86ish-sse2.S: Use numeric labels for internal loops.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/salsa20-x86ish-sse2.S: Fix stray `##' comment to be `//'.
Not sure how this one slipped through the net. Oh, well; it didn't
cause any damage.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
configure.ac: Detect plain `arm' as an ARM CPU identifier.
For some reason I've not discovered yet, my test machinery shows as
`arm-unknown-linux-gnueabi' rather than `armv7l-unknown-linux-gnueabi',
which inhibits building the fancy CPU-specific code. This hid a build
failure from my test machinery, which is quite annoying.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
base/dispatch.c: Missing parens on call to `get_hwcaps'.
This is only a problem on ARM hosts, but it breaks the build for
them (unsurprisingly). For some reason, the test machinery I used
before committing the broken code came up with a slightly different
host-platform name which the configure script didn't recognize, so the
test environment didn't try to compile the broken code.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
base/dispatch.c: Stop parsing the auxiliary vector when we hit `AT_NULL'.
This doesn't seem too dreadful so far (partly because nothing is using
this machinery for something important, and partly because we're parsing
the vector from a file with known length), but fix it anyway.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
Merge branch 'mdw/cpu-dispatch'
* mdw/cpu-dispatch:
Add support machinery for ARM hosts.
base/dispatch.c: Add (unused) machinery for probing ELF auxilary vector.
Add support for AMD64 processors and Microsoft Windows.
symm/rijndael-x86-aseni.S: Unify encryption and decryption with a macro.
symm/rijndael-x86-aesni.S: Use xmm5 instead of xmm7.
symm/*.S: Symbolic names for shuffles.
symm/chacha-x86-sse2.S: Fix the register allocation comment.
Preprocess the assembler files.
configure.ac: Improve the host CPU family detection.
base/dispatch.c: Indent some preprocessor definitions properly.
Add a pile of debug output around the CPU dispatching machinery.
base/dispatch.c: Add documentation for some internal functions.
base/dispatch.c: Add in more useful section markers.
Support Intel's AES Native Instructions where available on x86 hardware.
symm/: New SSE2 implementations of Salsa20 and ChaCha.
symm/salsa20.c, symm/salsa20-core.h: Permute input matrix for SIMD.
debian/rules: Run tests twice, once without any detected CPU features.
base/dispatch.c: Check operating system support for XMM registers.
configure.ac, base/dispatch.[ch]: CPU-specific implementations.
configure.ac: Arrange to have an assembler available.
Conflicts:
configure.ac
symm/Makefile.am
Mark Wooding [Sat, 21 May 2016 10:26:40 +0000 (11:26 +0100)]
configure.ac: Turn on colour in the test output.
It makes it easier to spot the bad ones in a vast spew of parallel test
runs across multiple target platforms.
Mark Wooding [Sat, 21 May 2016 10:07:15 +0000 (11:07 +0100)]
symm/BLKMODE-def.h: Fix alignment of separators in hexdump output.
Now the `:' markers actually correspond with the block boundaries.
Amazing, no?
Mark Wooding [Sat, 21 May 2016 13:33:28 +0000 (14:33 +0100)]
Add support machinery for ARM hosts.
There's currently no ARM code here, but we can probe for the
features (and it seems to work).
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
base/dispatch.c: Add (unused) machinery for probing ELF auxilary vector.
Some platforms don't allow CPU feature-probing from userland, and rely
on the kernel informing processes in some other way. ELF-ish systems
hide this information in the auxiliary vector, which is very hard to
find. Add some machinery for doing this anyway.
Mark Wooding [Sat, 21 May 2016 13:33:28 +0000 (14:33 +0100)]
Add support for AMD64 processors and Microsoft Windows.
* Slightly modify CPU-feature-probing code in `base/dispatch.c',
mostly to use wider registers for the stack operations since there
are no 32-bit `push' instructions. The feature codes are the same
for both, so there's no corresponding header-file change.
* Add appropriate macros to `base/asm-common.h' for dealing with PIC
on AMD64. It's refreshingly straightforward.
* Modify the existing assembler code to support the new environments.
This is mostly tuning register allocation and prologue/epilogue
sequences.
* Use the fancy code on the new platforms.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/rijndael-x86-aseni.S: Unify encryption and decryption with a macro.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/rijndael-x86-aesni.S: Use xmm5 instead of xmm7.
The only reason is that (stupidly) the Windows 64-bit ABI designates
(the bottom 128 bits of) xmm7 as being callee-saved.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/*.S: Symbolic names for shuffles.
The magic constants for the various shuffles (actually, all rotations)
have irritated me. Replace them with names, now we have a preprocessor.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
symm/chacha-x86-sse2.S: Fix the register allocation comment.
The four rows can't all be in XMM0.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
Preprocess the assembler files.
* Rename the `*.s' files to `*.S'.
* Create a new header `base/asm-common.h' containing useful
definitions, particularly for dealing with the peculiarities of
shared library code.
* Convert the assembler files to use the new macros.
* Convert the assembler files to use `//' for comments rather than
`#' (as currently). This is a bit annoying, but `#' is wanted by
the preprocessor, and `/* ... */' doesn't work in Emacs's
`asm-mode'.
The reason for doing all of this is because the C preprocessor will let
me do things like inventing symbolic names for registers, which will be
handy later when I add support for AMD64 processors, because most of the
code will be identical between 32- and 64-bit machines.
This change has the side-effect that the AESNI implementation no longer
uses PIC-ish means to find things when it doesn't need to.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
configure.ac: Improve the host CPU family detection.
In particular, also collect the ABI.
Mark Wooding [Wed, 18 May 2016 09:28:25 +0000 (10:28 +0100)]
base/dispatch.c: Indent some preprocessor definitions properly.
Mark Wooding [Wed, 18 May 2016 09:29:03 +0000 (10:29 +0100)]
Add a pile of debug output around the CPU dispatching machinery.
Report on finding things in the environment, progress on runtime probes,
and the decisions about which implementations we pick. Decision-making
isn't time-critical, so this is left in permanently.
Mark Wooding [Wed, 18 May 2016 08:17:01 +0000 (09:17 +0100)]
base/dispatch.c: Add documentation for some internal functions.
Mark Wooding [Wed, 18 May 2016 08:15:59 +0000 (09:15 +0100)]
base/dispatch.c: Add in more useful section markers.
There will be more sections.
Mark Wooding [Mon, 16 May 2016 09:05:52 +0000 (10:05 +0100)]
build-setup: Use a slightly later ancient timestamp for dummy files.
GNU Make secretly reserves extreme-valued timestamps for its own
internal purposes, and then complains about `Timestamp out of range'.
This is annoying enough; but for some reason I don't understand, at
least on Cygwin, instead of substituting its most ancient acceptable
timestamp, it uses its furthest into the future stamp with the result
that it gets stuck in a loop rebuilding makefiles.
Using the second year of the epoch seems to fix the problem.
Mark Wooding [Sun, 15 May 2016 23:25:05 +0000 (00:25 +0100)]
Shore up the `grand' protocol.
This is a bit of a mess, really. There are two main problems.
* Firstly, the business of comparing function pointers simply doesn't
work on Windows, because the dynamic linker is too hopeless. If the
class implementation is in a different module from Catacomb itself,
then the vtable may have a pointer to an import-library stub, which
won't compare equal to the library's idea of the default method
function.
It's basically a mistake to have tried to use the same functions as
both user interface and default implementation. Split the two
apart. Leave the hacky function-pointer comparisons in the user-
interface functions for compatibility with existing out-of-tree
generators, which will carry on working about as well as they ever
did.
Note, however, that the defaulting strategy is now less `clever',
and implementations which don't provide native versions of all the
methods may end up suffering more than they used to.
* The `grand_range' function was simply broken if the `raw' method's
output is too small. Synthesizing a full uniform-value-in-range
from a narrow primitive generator in single precision arithmetic is
rather difficult, so rather than do that I've decided to insist that
all `raw' methods have a range of at least a byte's worth, so we can
synthesize a word generator out of bytes if necessary, and then use
that to satisfy the original larger range request.
This is all a bit unsatisfactory, really. I must remember to revisit it
when all of these gets made out of a proper object system.
Mark Wooding [Sun, 15 May 2016 14:30:40 +0000 (15:30 +0100)]
build: Abolish the `$e', `$o' and `$t' variables.
I don't think anything ever used `$o'. Use of `$e' gets in the way of
Automake's magic handling of executable suffixes under Cygwin. This is
especially acute when executables are listed as tests to be run, because
Autoconf is buggy and sometimes strips off the suffix and sometimes
doesn't.
So we write everything out longhand. Sorry.
Mark Wooding [Sun, 15 May 2016 11:32:17 +0000 (12:32 +0100)]
math/mp.h: Muffle `unused value' warnings from `MP_COPY'.
Nobody cares.
Mark Wooding [Sun, 15 May 2016 11:31:36 +0000 (12:31 +0100)]
rand/noise.c: Use `sigjmp_buf' to escape the freewheel generator.
I'd never noticed there was a separate type before. This shouldn't have
been a surprise.
Mark Wooding [Sun, 15 May 2016 11:30:27 +0000 (12:30 +0100)]
Makefile.am: Say `-no-undefined' to libtool for the sake of Cygwin.
Mark Wooding [Sun, 15 May 2016 14:04:58 +0000 (15:04 +0100)]
symm/modes.am.in: Banish the very boring per-mode tests to `modes/'.
Now that Automake has inflicted `subdir-objects' on us, we might as well
use the opportunity to tidy away the autogenerated `modes/' cruft
properly.
Mark Wooding [Sun, 15 May 2016 13:57:12 +0000 (14:57 +0100)]
build: Cope with the `subdir-objects' world Automake wants us to live in.
Essentially, the Automake developers want to put the objects for
`PATH/TO/FILE.c' in `PATH/TO/FILE.o'. This is wrongheaded, but we don't
seem to get much choice. Unfortunately, it's also buggered.
This causes trouble for our precomputed source files. The obvious
trouble happens if the source file we reference is explicitly in the
source tree, so we'll need to refer to the files differently in
`mumble_SOURCES' lines and the machinery which makes the generates the
files. The obvious answer would be to introduce two variables for
referring to the precomptations tree. This is where Automake's bugs
start to really bite.
The main problem is with Automake's automatic dependency-tracking
machinery. For each object `FILE.o' which is going to be built, it
wants to make a `.deps/FILE.Po' file to track the detected dependencies.
Furthermore, the generated makefiles get unhappy if these files don't
already exist, so there's magic hung off the side of `config.status' to
make them.
This would be great, but the Automake machinery doesn't actually work
properly. If you refer to a source file via a variable reference,
something like `$(things)/file.c', then Automake's `config.status' magic
creates a dependency-tracking file which is literally named
`.deps/$(things)/file.Po', and then the makefile gets upset when it
tries to include `$(things)/.deps/file.Po'.
So we have to write explicit relative paths to precomputed source file
names in `nodist_mumble_SOURCES' lists (because we make our own
arrangements for distributing them).
Even worse, in older Automake versions, the `distclean' rule prematurely
zaps the dependency-tracking files under `precomps/', so I've had to
split the precomputed sources into subdirectories for each main source
directory.
On the plus side, the `symm/' build tree is less of a mess now that all
of the boring per-mode objects are tucked away in their own
subdirectory.
Mark Wooding [Fri, 19 Feb 2016 09:09:11 +0000 (09:09 +0000)]
debian/control: have catacomb-dev Depends on the right version of mlib-dev.
Unaccountably this was previously entirely missing.
This is release 2.2.1.1.
Mark Wooding [Thu, 18 Feb 2016 16:44:03 +0000 (16:44 +0000)]
Release 2.2.1.
Mark Wooding [Thu, 18 Feb 2016 08:46:45 +0000 (08:46 +0000)]
configure.ac, debian/control: Depend on mLib 2.2.2.1 or later.
Commit
16810bbd... used CDCF_IGNSPC, which was introduced in 2.2.2; but
actually 2.2.2 has an unpleasant memory leak in `dstr_putf', so
encourage people not to use it.
Mark Wooding [Thu, 18 Feb 2016 08:33:25 +0000 (08:33 +0000)]
debian/: Fix the Build-Depends.
* pkg-config is needed to find mLib.
* python is needed by a number of the build scripts.
Mark Wooding [Thu, 18 Feb 2016 08:33:09 +0000 (08:33 +0000)]
debian/source/format: Apparently I have to have one of these now.
Mark Wooding [Tue, 29 Dec 2015 00:07:02 +0000 (00:07 +0000)]
math/mptypes.c: Remove obsolete file.
This file became redundant back in
1c3d4cf... when `mpgen' took over its
job, but somehow it survived the purge of the old build system.
Mark Wooding [Wed, 14 Oct 2015 22:25:16 +0000 (23:25 +0100)]
math/mp-fibonacci.c: Fix spacing in comment.
Mark Wooding [Wed, 14 Oct 2015 10:00:51 +0000 (11:00 +0100)]
math/mptext.c: Radically refactor `mp_read'.
It used to be the largest function in the library -- possibly in my
codebase.
* Split it into three main pieces: the special-purpose binary reader,
an efficient stack-based general-radix reader, and a high-level
syntax parser which picks out signs and base indicators. This
removes the complicated entangling of the base indicator parsing
with the general-radix reader which was the worst feature of the old
version.
* Split commonly-used functionality out into separate functions,
notably `char_digit' and `read_digit'.
The result is code which is easier to understand and actually shorter.
Mark Wooding [Wed, 14 Oct 2015 09:55:56 +0000 (10:55 +0100)]
math/mptext.c: Reformat and refactor output functions.
* Some layout fiddling.
* Move some block-local variable declarations to the function head.
* Split `digit_char' out as a separate function, seeing as it's used
three times.
* Rename the individual functions with a `write_...' prefix. A
corresponding (more invasive) refactoring of the input function will
have similar names, so avoid the obvious conflict.
Mark Wooding [Mon, 20 Jul 2015 13:21:02 +0000 (14:21 +0100)]
Release 2.2.0.
Mark Wooding [Mon, 25 May 2015 09:34:14 +0000 (10:34 +0100)]
Support Intel's AES Native Instructions where available on x86 hardware.
* Add a detector for the CPU feature.
* Implement AES in terms of the Intel AESNI instructions.
We can't use the fancy instructions to implement Rijndael with large
blocks, unfortunately; we /can/ (and do) use the rather cumbersome
key-scheduling instructions.
There's a slightly annoying endianness difference between Catacomb
(big-endian) and AESNI (little-endian). Resolve this by (a) maintaining
the key schedule in little-endian order if we're using AESNI (and blocks
are exactly 128 bits); and (b) end-swapping the block on entry and exit
to the block cipher operations.
Mark Wooding [Sat, 2 May 2015 16:05:20 +0000 (17:05 +0100)]
symm/: New SSE2 implementations of Salsa20 and ChaCha.
These are chosen at runtime if the CPU is suitable.
Mark Wooding [Sat, 2 May 2015 16:05:20 +0000 (17:05 +0100)]
symm/salsa20.c, symm/salsa20-core.h: Permute input matrix for SIMD.
Maintain the input matrix in the Salsa20 context structure in a permuted
form which makes SIMD implementations of the core function rather more
efficient.
Mark Wooding [Mon, 25 May 2015 18:37:01 +0000 (19:37 +0100)]
debian/rules: Run tests twice, once without any detected CPU features.
Mark Wooding [Sat, 30 May 2015 19:26:39 +0000 (20:26 +0100)]
base/dispatch.c: Check operating system support for XMM registers.
I found a technique for doing this described by Agner Fog: see
http://www.agner.org/optimize/#manual_asm
which is conveniently independent of any particular system. Quite why
Intel don't document this clearly is something of a mystery to me.
Mark Wooding [Mon, 18 May 2015 22:21:02 +0000 (23:21 +0100)]
configure.ac, base/dispatch.[ch]: CPU-specific implementations.
We now have the capability for a function to have multiple CPU-specific
implementations, and to choose the most appropriate one at runtime.
The new `cpu_feature_p' function doesn't understand much in the way of
features yet, but is ready to grow later.