laag-libsodium 1.0.16.0

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2.h

@@ -0,0 +1,109 @@
+/*
+   BLAKE2 reference source code package - reference C implementations
+
+   Written in 2012 by Samuel Neves <sneves@dei.uc.pt>
+
+   To the extent possible under law, the author(s) have dedicated all copyright
+   and related and neighboring rights to this software to the public domain
+   worldwide. This software is distributed without any warranty.
+
+   All code is triple-licensed under the
+   [CC0](http://creativecommons.org/publicdomain/zero/1.0), the
+   [OpenSSL Licence](https://www.openssl.org/source/license.html), or
+   the [Apache Public License 2.0](http://www.apache.org/licenses/LICENSE-2.0),
+   at your choosing.
+ */
+
+#ifndef blake2_H
+#define blake2_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "crypto_generichash_blake2b.h"
+#include "export.h"
+
+#define blake2b_init_param crypto_generichash_blake2b__init_param
+#define blake2b_init crypto_generichash_blake2b__init
+#define blake2b_init_salt_personal \
+    crypto_generichash_blake2b__init_salt_personal
+#define blake2b_init_key crypto_generichash_blake2b__init_key
+#define blake2b_init_key_salt_personal \
+    crypto_generichash_blake2b__init_key_salt_personal
+#define blake2b_update crypto_generichash_blake2b__update
+#define blake2b_final crypto_generichash_blake2b__final
+#define blake2b crypto_generichash_blake2b__blake2b
+#define blake2b_salt_personal crypto_generichash_blake2b__blake2b_salt_personal
+#define blake2b_pick_best_implementation \
+    crypto_generichash_blake2b__pick_best_implementation
+
+enum blake2b_constant {
+    BLAKE2B_BLOCKBYTES    = 128,
+    BLAKE2B_OUTBYTES      = 64,
+    BLAKE2B_KEYBYTES      = 64,
+    BLAKE2B_SALTBYTES     = 16,
+    BLAKE2B_PERSONALBYTES = 16
+};
+
+#if defined(__IBMC__) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#pragma pack(1)
+#else
+#pragma pack(push, 1)
+#endif
+
+typedef struct blake2b_param_ {
+    uint8_t digest_length;                   /*  1 */
+    uint8_t key_length;                      /*  2 */
+    uint8_t fanout;                          /*  3 */
+    uint8_t depth;                           /*  4 */
+    uint8_t leaf_length[4];                  /*  8 */
+    uint8_t node_offset[8];                  /* 16 */
+    uint8_t node_depth;                      /* 17 */
+    uint8_t inner_length;                    /* 18 */
+    uint8_t reserved[14];                    /* 32 */
+    uint8_t salt[BLAKE2B_SALTBYTES];         /* 48 */
+    uint8_t personal[BLAKE2B_PERSONALBYTES]; /* 64 */
+} blake2b_param;
+
+typedef crypto_generichash_blake2b_state blake2b_state;
+
+#if defined(__IBMC__) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#pragma pack()
+#else
+#pragma pack(pop)
+#endif
+
+/* Streaming API */
+int blake2b_init(blake2b_state *S, const uint8_t outlen);
+int blake2b_init_salt_personal(blake2b_state *S, const uint8_t outlen,
+                               const void *salt, const void *personal);
+int blake2b_init_key(blake2b_state *S, const uint8_t outlen, const void *key,
+                     const uint8_t keylen);
+int blake2b_init_key_salt_personal(blake2b_state *S, const uint8_t outlen,
+                                   const void *key, const uint8_t keylen,
+                                   const void *salt, const void *personal);
+int blake2b_init_param(blake2b_state *S, const blake2b_param *P);
+int blake2b_update(blake2b_state *S, const uint8_t *in, uint64_t inlen);
+int blake2b_final(blake2b_state *S, uint8_t *out, uint8_t outlen);
+
+/* Simple API */
+int blake2b(uint8_t *out, const void *in, const void *key, const uint8_t outlen,
+            const uint64_t inlen, uint8_t keylen);
+int blake2b_salt_personal(uint8_t *out, const void *in, const void *key,
+                          const uint8_t outlen, const uint64_t inlen,
+                          uint8_t keylen, const void *salt,
+                          const void *personal);
+
+typedef int (*blake2b_compress_fn)(blake2b_state *S,
+                                   const uint8_t  block[BLAKE2B_BLOCKBYTES]);
+int blake2b_pick_best_implementation(void);
+int blake2b_compress_ref(blake2b_state *S,
+                         const uint8_t  block[BLAKE2B_BLOCKBYTES]);
+int blake2b_compress_ssse3(blake2b_state *S,
+                           const uint8_t  block[BLAKE2B_BLOCKBYTES]);
+int blake2b_compress_sse41(blake2b_state *S,
+                           const uint8_t  block[BLAKE2B_BLOCKBYTES]);
+int blake2b_compress_avx2(blake2b_state *S,
+                          const uint8_t  block[BLAKE2B_BLOCKBYTES]);
+
+#endif

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-avx2.c

@@ -0,0 +1,49 @@
+
+#define BLAKE2_USE_SSSE3
+#define BLAKE2_USE_SSE41
+#define BLAKE2_USE_AVX2
+
+#include <stdint.h>
+#include <string.h>
+
+#include "blake2.h"
+#include "private/common.h"
+#include "private/sse2_64_32.h"
+
+#if defined(HAVE_AVX2INTRIN_H) && defined(HAVE_EMMINTRIN_H) && \
+    defined(HAVE_TMMINTRIN_H) && defined(HAVE_SMMINTRIN_H)
+
+# ifdef __GNUC__
+#  pragma GCC target("sse2")
+#  pragma GCC target("ssse3")
+#  pragma GCC target("sse4.1")
+#  pragma GCC target("avx2")
+# endif
+
+# include <emmintrin.h>
+# include <immintrin.h>
+# include <smmintrin.h>
+# include <tmmintrin.h>
+
+# include "blake2b-compress-avx2.h"
+
+CRYPTO_ALIGN(64)
+static const uint64_t blake2b_IV[8] = {
+    0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
+    0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+    0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+int
+blake2b_compress_avx2(blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES])
+{
+    __m256i a = LOADU(&S->h[0]);
+    __m256i b = LOADU(&S->h[4]);
+    BLAKE2B_COMPRESS_V1(a, b, block, S->t[0], S->t[1], S->f[0], S->f[1]);
+    STOREU(&S->h[0], a);
+    STOREU(&S->h[4], b);
+
+    return 0;
+}
+
+#endif

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-avx2.h

@@ -0,0 +1,140 @@
+
+#ifndef blake2b_compress_avx2_H
+#define blake2b_compress_avx2_H
+
+#define LOAD128(p) _mm_load_si128((__m128i *) (p))
+#define STORE128(p, r) _mm_store_si128((__m128i *) (p), r)
+
+#define LOADU128(p) _mm_loadu_si128((__m128i *) (p))
+#define STOREU128(p, r) _mm_storeu_si128((__m128i *) (p), r)
+
+#define LOAD(p) _mm256_load_si256((__m256i *) (p))
+#define STORE(p, r) _mm256_store_si256((__m256i *) (p), r)
+
+#define LOADU(p) _mm256_loadu_si256((__m256i *) (p))
+#define STOREU(p, r) _mm256_storeu_si256((__m256i *) (p), r)
+
+static inline uint64_t
+LOADU64(const void *p)
+{
+    uint64_t v;
+    memcpy(&v, p, sizeof v);
+    return v;
+}
+
+#define ROTATE16                                                              \
+    _mm256_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9, 2, \
+                     3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)
+
+#define ROTATE24                                                              \
+    _mm256_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10, 3, \
+                     4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)
+
+#define ADD(a, b) _mm256_add_epi64(a, b)
+#define SUB(a, b) _mm256_sub_epi64(a, b)
+
+#define XOR(a, b) _mm256_xor_si256(a, b)
+#define AND(a, b) _mm256_and_si256(a, b)
+#define OR(a, b) _mm256_or_si256(a, b)
+
+#define ROT32(x) _mm256_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1))
+#define ROT24(x) _mm256_shuffle_epi8((x), ROTATE24)
+#define ROT16(x) _mm256_shuffle_epi8((x), ROTATE16)
+#define ROT63(x) _mm256_or_si256(_mm256_srli_epi64((x), 63), ADD((x), (x)))
+
+#define BLAKE2B_G1_V1(a, b, c, d, m) \
+    do {                             \
+        a = ADD(a, m);               \
+        a = ADD(a, b);               \
+        d = XOR(d, a);               \
+        d = ROT32(d);                \
+        c = ADD(c, d);               \
+        b = XOR(b, c);               \
+        b = ROT24(b);                \
+    } while (0)
+
+#define BLAKE2B_G2_V1(a, b, c, d, m) \
+    do {                             \
+        a = ADD(a, m);               \
+        a = ADD(a, b);               \
+        d = XOR(d, a);               \
+        d = ROT16(d);                \
+        c = ADD(c, d);               \
+        b = XOR(b, c);               \
+        b = ROT63(b);                \
+    } while (0)
+
+#define BLAKE2B_DIAG_V1(a, b, c, d)                               \
+    do {                                                          \
+        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(2, 1, 0, 3)); \
+        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(1, 0, 3, 2)); \
+        b = _mm256_permute4x64_epi64(b, _MM_SHUFFLE(0, 3, 2, 1)); \
+    } while (0)
+
+#define BLAKE2B_UNDIAG_V1(a, b, c, d)                             \
+    do {                                                          \
+        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(0, 3, 2, 1)); \
+        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(1, 0, 3, 2)); \
+        b = _mm256_permute4x64_epi64(b, _MM_SHUFFLE(2, 1, 0, 3)); \
+    } while (0)
+
+#include "blake2b-load-avx2.h"
+
+#define BLAKE2B_ROUND_V1(a, b, c, d, r, m) \
+    do {                                   \
+        __m256i b0;                        \
+        BLAKE2B_LOAD_MSG_##r##_1(b0);      \
+        BLAKE2B_G1_V1(a, b, c, d, b0);     \
+        BLAKE2B_LOAD_MSG_##r##_2(b0);      \
+        BLAKE2B_G2_V1(a, b, c, d, b0);     \
+        BLAKE2B_DIAG_V1(a, b, c, d);       \
+        BLAKE2B_LOAD_MSG_##r##_3(b0);      \
+        BLAKE2B_G1_V1(a, b, c, d, b0);     \
+        BLAKE2B_LOAD_MSG_##r##_4(b0);      \
+        BLAKE2B_G2_V1(a, b, c, d, b0);     \
+        BLAKE2B_UNDIAG_V1(a, b, c, d);     \
+    } while (0)
+
+#define BLAKE2B_ROUNDS_V1(a, b, c, d, m)       \
+    do {                                       \
+        BLAKE2B_ROUND_V1(a, b, c, d, 0, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 1, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 2, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 3, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 4, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 5, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 6, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 7, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 8, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 9, (m));  \
+        BLAKE2B_ROUND_V1(a, b, c, d, 10, (m)); \
+        BLAKE2B_ROUND_V1(a, b, c, d, 11, (m)); \
+    } while (0)
+
+#define DECLARE_MESSAGE_WORDS(m)                                         \
+    const __m256i m0 = _mm256_broadcastsi128_si256(LOADU128((m) + 0));   \
+    const __m256i m1 = _mm256_broadcastsi128_si256(LOADU128((m) + 16));  \
+    const __m256i m2 = _mm256_broadcastsi128_si256(LOADU128((m) + 32));  \
+    const __m256i m3 = _mm256_broadcastsi128_si256(LOADU128((m) + 48));  \
+    const __m256i m4 = _mm256_broadcastsi128_si256(LOADU128((m) + 64));  \
+    const __m256i m5 = _mm256_broadcastsi128_si256(LOADU128((m) + 80));  \
+    const __m256i m6 = _mm256_broadcastsi128_si256(LOADU128((m) + 96));  \
+    const __m256i m7 = _mm256_broadcastsi128_si256(LOADU128((m) + 112)); \
+    __m256i       t0, t1;
+
+#define BLAKE2B_COMPRESS_V1(a, b, m, t0, t1, f0, f1)                      \
+    do {                                                                  \
+        DECLARE_MESSAGE_WORDS(m)                                          \
+        const __m256i iv0 = a;                                            \
+        const __m256i iv1 = b;                                            \
+        __m256i       c   = LOAD(&blake2b_IV[0]);                         \
+        __m256i       d =                                                 \
+            XOR(LOAD(&blake2b_IV[4]), _mm256_set_epi64x(f1, f0, t1, t0)); \
+        BLAKE2B_ROUNDS_V1(a, b, c, d, m);                                 \
+        a = XOR(a, c);                                                    \
+        b = XOR(b, d);                                                    \
+        a = XOR(a, iv0);                                                  \
+        b = XOR(b, iv1);                                                  \
+    } while (0)
+
+#endif

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-ref.c

@@ -0,0 +1,93 @@
+
+#include <stdint.h>
+#include <string.h>
+
+#include "blake2.h"
+#include "private/common.h"
+
+CRYPTO_ALIGN(64)
+static const uint64_t blake2b_IV[8] = {
+    0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
+    0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+    0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+static const uint8_t blake2b_sigma[12][16] = {
+    { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
+    { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
+    { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
+    { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
+    { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
+    { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
+    { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
+    { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
+    { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
+    { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
+};
+
+int
+blake2b_compress_ref(blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES])
+{
+    uint64_t m[16];
+    uint64_t v[16];
+    int      i;
+
+    for (i   = 0; i < 16; ++i)
+        m[i] = LOAD64_LE(block + i * sizeof(m[i]));
+
+    for (i   = 0; i < 8; ++i)
+        v[i] = S->h[i];
+
+    v[8]  = blake2b_IV[0];
+    v[9]  = blake2b_IV[1];
+    v[10] = blake2b_IV[2];
+    v[11] = blake2b_IV[3];
+    v[12] = S->t[0] ^ blake2b_IV[4];
+    v[13] = S->t[1] ^ blake2b_IV[5];
+    v[14] = S->f[0] ^ blake2b_IV[6];
+    v[15] = S->f[1] ^ blake2b_IV[7];
+#define G(r, i, a, b, c, d)                         \
+    do {                                            \
+        a = a + b + m[blake2b_sigma[r][2 * i + 0]]; \
+        d = ROTR64(d ^ a, 32);                      \
+        c = c + d;                                  \
+        b = ROTR64(b ^ c, 24);                      \
+        a = a + b + m[blake2b_sigma[r][2 * i + 1]]; \
+        d = ROTR64(d ^ a, 16);                      \
+        c = c + d;                                  \
+        b = ROTR64(b ^ c, 63);                      \
+    } while (0)
+#define ROUND(r)                           \
+    do {                                   \
+        G(r, 0, v[0], v[4], v[8], v[12]);  \
+        G(r, 1, v[1], v[5], v[9], v[13]);  \
+        G(r, 2, v[2], v[6], v[10], v[14]); \
+        G(r, 3, v[3], v[7], v[11], v[15]); \
+        G(r, 4, v[0], v[5], v[10], v[15]); \
+        G(r, 5, v[1], v[6], v[11], v[12]); \
+        G(r, 6, v[2], v[7], v[8], v[13]);  \
+        G(r, 7, v[3], v[4], v[9], v[14]);  \
+    } while (0)
+    ROUND(0);
+    ROUND(1);
+    ROUND(2);
+    ROUND(3);
+    ROUND(4);
+    ROUND(5);
+    ROUND(6);
+    ROUND(7);
+    ROUND(8);
+    ROUND(9);
+    ROUND(10);
+    ROUND(11);
+
+    for (i = 0; i < 8; ++i) {
+        S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
+    }
+
+#undef G
+#undef ROUND
+    return 0;
+}

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-sse41.c

@@ -0,0 +1,87 @@
+
+#define BLAKE2_USE_SSSE3
+#define BLAKE2_USE_SSE41
+
+#include <stdint.h>
+#include <string.h>
+
+#include "blake2.h"
+#include "private/common.h"
+#include "private/sse2_64_32.h"
+
+#if defined(HAVE_EMMINTRIN_H) && defined(HAVE_TMMINTRIN_H) && \
+    defined(HAVE_SMMINTRIN_H)
+
+# ifdef __GNUC__
+#  pragma GCC target("sse2")
+#  pragma GCC target("ssse3")
+#  pragma GCC target("sse4.1")
+# endif
+
+# include <emmintrin.h>
+# include <smmintrin.h>
+# include <tmmintrin.h>
+
+# include "blake2b-compress-sse41.h"
+
+CRYPTO_ALIGN(64)
+static const uint64_t blake2b_IV[8] = {
+    0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
+    0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+    0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+int
+blake2b_compress_sse41(blake2b_state *S,
+                       const uint8_t  block[BLAKE2B_BLOCKBYTES])
+{
+    __m128i       row1l, row1h;
+    __m128i       row2l, row2h;
+    __m128i       row3l, row3h;
+    __m128i       row4l, row4h;
+    __m128i       b0, b1;
+    __m128i       t0, t1;
+    const __m128i r16 =
+        _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9);
+    const __m128i r24 =
+        _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10);
+    const __m128i m0 = LOADU(block + 00);
+    const __m128i m1 = LOADU(block + 16);
+    const __m128i m2 = LOADU(block + 32);
+    const __m128i m3 = LOADU(block + 48);
+    const __m128i m4 = LOADU(block + 64);
+    const __m128i m5 = LOADU(block + 80);
+    const __m128i m6 = LOADU(block + 96);
+    const __m128i m7 = LOADU(block + 112);
+    row1l            = LOADU(&S->h[0]);
+    row1h            = LOADU(&S->h[2]);
+    row2l            = LOADU(&S->h[4]);
+    row2h            = LOADU(&S->h[6]);
+    row3l            = LOADU(&blake2b_IV[0]);
+    row3h            = LOADU(&blake2b_IV[2]);
+    row4l            = _mm_xor_si128(LOADU(&blake2b_IV[4]), LOADU(&S->t[0]));
+    row4h            = _mm_xor_si128(LOADU(&blake2b_IV[6]), LOADU(&S->f[0]));
+    ROUND(0);
+    ROUND(1);
+    ROUND(2);
+    ROUND(3);
+    ROUND(4);
+    ROUND(5);
+    ROUND(6);
+    ROUND(7);
+    ROUND(8);
+    ROUND(9);
+    ROUND(10);
+    ROUND(11);
+    row1l = _mm_xor_si128(row3l, row1l);
+    row1h = _mm_xor_si128(row3h, row1h);
+    STOREU(&S->h[0], _mm_xor_si128(LOADU(&S->h[0]), row1l));
+    STOREU(&S->h[2], _mm_xor_si128(LOADU(&S->h[2]), row1h));
+    row2l = _mm_xor_si128(row4l, row2l);
+    row2h = _mm_xor_si128(row4h, row2h);
+    STOREU(&S->h[4], _mm_xor_si128(LOADU(&S->h[4]), row2l));
+    STOREU(&S->h[6], _mm_xor_si128(LOADU(&S->h[6]), row2h));
+    return 0;
+}
+
+#endif

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-sse41.h

@@ -0,0 +1,103 @@
+
+#ifndef blake2b_compress_sse41_H
+#define blake2b_compress_sse41_H
+
+#define LOADU(p) _mm_loadu_si128((const __m128i *) (const void *) (p))
+#define STOREU(p, r) _mm_storeu_si128((__m128i *) (void *) (p), r)
+
+#define _mm_roti_epi64(x, c)                                         \
+    (-(c) == 32)                                                     \
+        ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1))            \
+        : (-(c) == 24)                                               \
+              ? _mm_shuffle_epi8((x), r24)                           \
+              : (-(c) == 16)                                         \
+                    ? _mm_shuffle_epi8((x), r16)                     \
+                    : (-(c) == 63)                                   \
+                          ? _mm_xor_si128(_mm_srli_epi64((x), -(c)), \
+                                          _mm_add_epi64((x), (x)))   \
+                          : _mm_xor_si128(_mm_srli_epi64((x), -(c)), \
+                                          _mm_slli_epi64((x), 64 - (-(c))))
+
+#define G1(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1) \
+    row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l);                \
+    row1h = _mm_add_epi64(_mm_add_epi64(row1h, b1), row2h);                \
+                                                                           \
+    row4l = _mm_xor_si128(row4l, row1l);                                   \
+    row4h = _mm_xor_si128(row4h, row1h);                                   \
+                                                                           \
+    row4l = _mm_roti_epi64(row4l, -32);                                    \
+    row4h = _mm_roti_epi64(row4h, -32);                                    \
+                                                                           \
+    row3l = _mm_add_epi64(row3l, row4l);                                   \
+    row3h = _mm_add_epi64(row3h, row4h);                                   \
+                                                                           \
+    row2l = _mm_xor_si128(row2l, row3l);                                   \
+    row2h = _mm_xor_si128(row2h, row3h);                                   \
+                                                                           \
+    row2l = _mm_roti_epi64(row2l, -24);                                    \
+    row2h = _mm_roti_epi64(row2h, -24);
+
+#define G2(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1) \
+    row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l);                \
+    row1h = _mm_add_epi64(_mm_add_epi64(row1h, b1), row2h);                \
+                                                                           \
+    row4l = _mm_xor_si128(row4l, row1l);                                   \
+    row4h = _mm_xor_si128(row4h, row1h);                                   \
+                                                                           \
+    row4l = _mm_roti_epi64(row4l, -16);                                    \
+    row4h = _mm_roti_epi64(row4h, -16);                                    \
+                                                                           \
+    row3l = _mm_add_epi64(row3l, row4l);                                   \
+    row3h = _mm_add_epi64(row3h, row4h);                                   \
+                                                                           \
+    row2l = _mm_xor_si128(row2l, row3l);                                   \
+    row2h = _mm_xor_si128(row2h, row3h);                                   \
+                                                                           \
+    row2l = _mm_roti_epi64(row2l, -63);                                    \
+    row2h = _mm_roti_epi64(row2h, -63);
+
+#define DIAGONALIZE(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h) \
+    t0    = _mm_alignr_epi8(row2h, row2l, 8);                               \
+    t1    = _mm_alignr_epi8(row2l, row2h, 8);                               \
+    row2l = t0;                                                             \
+    row2h = t1;                                                             \
+                                                                            \
+    t0    = row3l;                                                          \
+    row3l = row3h;                                                          \
+    row3h = t0;                                                             \
+                                                                            \
+    t0    = _mm_alignr_epi8(row4h, row4l, 8);                               \
+    t1    = _mm_alignr_epi8(row4l, row4h, 8);                               \
+    row4l = t1;                                                             \
+    row4h = t0;
+
+#define UNDIAGONALIZE(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h) \
+    t0    = _mm_alignr_epi8(row2l, row2h, 8);                                 \
+    t1    = _mm_alignr_epi8(row2h, row2l, 8);                                 \
+    row2l = t0;                                                               \
+    row2h = t1;                                                               \
+                                                                              \
+    t0    = row3l;                                                            \
+    row3l = row3h;                                                            \
+    row3h = t0;                                                               \
+                                                                              \
+    t0    = _mm_alignr_epi8(row4l, row4h, 8);                                 \
+    t1    = _mm_alignr_epi8(row4h, row4l, 8);                                 \
+    row4l = t1;                                                               \
+    row4h = t0;
+
+#include "blake2b-load-sse41.h"
+
+#define ROUND(r)                                                         \
+    LOAD_MSG_##r##_1(b0, b1);                                            \
+    G1(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1);  \
+    LOAD_MSG_##r##_2(b0, b1);                                            \
+    G2(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1);  \
+    DIAGONALIZE(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h); \
+    LOAD_MSG_##r##_3(b0, b1);                                            \
+    G1(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1);  \
+    LOAD_MSG_##r##_4(b0, b1);                                            \
+    G2(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1);  \
+    UNDIAGONALIZE(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h);
+
+#endif

data/vendor/github.com/jedisct1/libsodium/src/libsodium/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.c

@@ -0,0 +1,90 @@
+
+#include <stdint.h>
+#include <string.h>
+
+#include "blake2.h"
+#include "private/common.h"
+#include "private/sse2_64_32.h"
+
+#if defined(HAVE_EMMINTRIN_H) && defined(HAVE_TMMINTRIN_H)
+
+# ifdef __GNUC__
+#  pragma GCC target("sse2")
+#  pragma GCC target("ssse3")
+# endif
+
+# include <emmintrin.h>
+# include <tmmintrin.h>
+
+# include "blake2b-compress-ssse3.h"
+
+CRYPTO_ALIGN(64)
+static const uint64_t blake2b_IV[8] = {
+    0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
+    0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+    0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+int
+blake2b_compress_ssse3(blake2b_state *S,
+                       const uint8_t  block[BLAKE2B_BLOCKBYTES])
+{
+    __m128i       row1l, row1h;
+    __m128i       row2l, row2h;
+    __m128i       row3l, row3h;
+    __m128i       row4l, row4h;
+    __m128i       b0, b1;
+    __m128i       t0, t1;
+    const __m128i r16 =
+        _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9);
+    const __m128i r24 =
+        _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10);
+    const uint64_t m0  = ((uint64_t *) block)[0];
+    const uint64_t m1  = ((uint64_t *) block)[1];
+    const uint64_t m2  = ((uint64_t *) block)[2];
+    const uint64_t m3  = ((uint64_t *) block)[3];
+    const uint64_t m4  = ((uint64_t *) block)[4];
+    const uint64_t m5  = ((uint64_t *) block)[5];
+    const uint64_t m6  = ((uint64_t *) block)[6];
+    const uint64_t m7  = ((uint64_t *) block)[7];
+    const uint64_t m8  = ((uint64_t *) block)[8];
+    const uint64_t m9  = ((uint64_t *) block)[9];
+    const uint64_t m10 = ((uint64_t *) block)[10];
+    const uint64_t m11 = ((uint64_t *) block)[11];
+    const uint64_t m12 = ((uint64_t *) block)[12];
+    const uint64_t m13 = ((uint64_t *) block)[13];
+    const uint64_t m14 = ((uint64_t *) block)[14];
+    const uint64_t m15 = ((uint64_t *) block)[15];
+
+    row1l = LOADU(&S->h[0]);
+    row1h = LOADU(&S->h[2]);
+    row2l = LOADU(&S->h[4]);
+    row2h = LOADU(&S->h[6]);
+    row3l = LOADU(&blake2b_IV[0]);
+    row3h = LOADU(&blake2b_IV[2]);
+    row4l = _mm_xor_si128(LOADU(&blake2b_IV[4]), LOADU(&S->t[0]));
+    row4h = _mm_xor_si128(LOADU(&blake2b_IV[6]), LOADU(&S->f[0]));
+    ROUND(0);
+    ROUND(1);
+    ROUND(2);
+    ROUND(3);
+    ROUND(4);
+    ROUND(5);
+    ROUND(6);
+    ROUND(7);
+    ROUND(8);
+    ROUND(9);
+    ROUND(10);
+    ROUND(11);
+    row1l = _mm_xor_si128(row3l, row1l);
+    row1h = _mm_xor_si128(row3h, row1h);
+    STOREU(&S->h[0], _mm_xor_si128(LOADU(&S->h[0]), row1l));
+    STOREU(&S->h[2], _mm_xor_si128(LOADU(&S->h[2]), row1h));
+    row2l = _mm_xor_si128(row4l, row2l);
+    row2h = _mm_xor_si128(row4h, row2h);
+    STOREU(&S->h[4], _mm_xor_si128(LOADU(&S->h[4]), row2l));
+    STOREU(&S->h[6], _mm_xor_si128(LOADU(&S->h[6]), row2h));
+    return 0;
+}
+
+#endif