pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/poly_decompose_32_avx2.c

@@ -1,157 +0,0 @@
-/*
- * Copyright (c) The mldsa-native project authors
- * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
- */
-
-/* References
- * ==========
- *
- * - [REF_AVX2]
- *   CRYSTALS-Dilithium optimized AVX2 implementation
- *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
- *   https://github.com/pq-crystals/dilithium/tree/master/avx2
- */
-
-/*
- * This file is derived from the public domain
- * AVX2 Dilithium implementation @[REF_AVX2].
- *
- * The algorithm for Decompose(r) (more specifically the handling for the
- * wrap-around cases) are modified. See the "Reference" section in the comments
- * below for a more detailed comparison.
- */
-
-#include "../../../common.h"
-
-#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) &&   \
-    !defined(MLD_CONFIG_NO_SIGN_API) &&            \
-    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED) &&   \
-    (defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
-     (MLD_CONFIG_PARAMETER_SET == 65 || MLD_CONFIG_PARAMETER_SET == 87))
-
-#include <immintrin.h>
-#include "arith_native_x86_64.h"
-#include "consts.h"
-
-/*
- * Reference: The reference implementation has the input polynomial as a
- *            separate argument that may be aliased with either of the outputs.
- *            Removing the aliasing eases CBMC proofs.
- */
-void mld_poly_decompose_32_avx2(int32_t *a1, int32_t *a0)
-{
-  unsigned int i;
-  __m256i f, f0, f1, t;
-  const __m256i q_bound = _mm256_set1_epi32(31 * ((MLDSA_Q - 1) / 32));
-  /* check-magic: 1025 == floor(2**22 / 4092) */
-  const __m256i v = _mm256_set1_epi32(1025);
-  const __m256i alpha = _mm256_set1_epi32(2 * ((MLDSA_Q - 1) / 32));
-  const __m256i off = _mm256_set1_epi32(127);
-  const __m256i shift = _mm256_set1_epi32(512);
-
-  for (i = 0; i < MLDSA_N / 8; i++)
-  {
-    f = _mm256_load_si256((__m256i *)&a0[8 * i]);
-
-    /* check-magic: 4092 == intdiv(2 * intdiv(MLDSA_Q - 1, 32), 128) */
-    /*
-     * Compute f1 = round-(f / (2*GAMMA2)) as round-(f / (128B)) =
-     * round-(ceil(f / 128) / B) where B = 2*GAMMA2 / 128 = 4092. See
-     * mld_decompose() in mldsa/src/rounding.h for more details.
-     *
-     * range: 0 <= f <= Q-1 = 32*GAMMA2 = 16*128*B
-     */
-
-    /* Compute f1' = ceil(f / 128) as floor((f + 127) / 2^7) */
-    f1 = _mm256_add_epi32(f, off);
-    f1 = _mm256_srli_epi32(f1, 7);
-    /*
-     * range: 0 <= f1' <= (Q-1)/128 = 16B
-     *
-     * Also, f1' <= (Q-1)/128 = 2^16 - 2^6 < 2^16 ensures that the odd-index
-     * 16-bit lanes are all 0, so no bits will be dropped in the input of the
-     * _mm256_mulhi_epu16() below.
-     */
-
-    /*
-     * Compute f1 = round-(f1' / B) ≈ round(f1' * 1025 / 2^22). This is exact
-     * for 0 <= f1' < 2^16. See mld_decompose() in mldsa/src/rounding.h for the
-     * proof, and proofs/isabelle/compress for a formalization of the argument.
-     *
-     * round(f1' * 1025 / 2^22) is in turn computed in 2 steps as
-     * round(floor(f1' * 1025 / 2^16) / 2^6). The mulhi computes f1'' =
-     * floor(f1' * 1025 / 2^16). As for the next step f1 = round(f1'' / 2^6),
-     * because AVX2 doesn't have rounding right-shift (e.g. urshr in Neon), we
-     * simulate it using mulhrs with a power of 2, in this case mulhrs(f1'',
-     * 2^9) = round(f1'' * 2^9 / 2^15). (Note that the denominator is 2^15,
-     * not 2^16 as in mulhi.)
-     */
-    f1 = _mm256_mulhi_epu16(f1, v);
-    /*
-     * range: 0 <= f1''  = floor(f1' * 1025 / 2^16)
-     *                  <= f1' * 1025 / 2^16
-     *                   < 2^16 * 1025 / 2^16 = 1025
-     *
-     * Because 0 <= f1'' < 2^15, the multiplication in mulhrs is unsigned, that
-     * is, no erroneous sign-extension occurs.
-     */
-    f1 = _mm256_mulhrs_epi16(f1, shift);
-    /*
-     * range: 0 <= f1 = round-(f1' / B) <= round-(16B / B) = 16
-     *
-     * Note that the odd-index 16-bit lanes are still all 0 right now, so
-     * reinterpreting f1 as 8 lanes of int32_t (as done in the following) does
-     * not affect its value.
-     */
-
-    /*
-     * If f1 = 16, i.e. f > 31*GAMMA2, proceed as if f' = f - Q was given
-     * instead. (For f = 31*GAMMA2 + 1 thus f' = -GAMMA2, we still round it to 0
-     * like other "wrapped around" cases.)
-     *
-     * Reference: They handle wrap-around in a somewhat convoluted way. Most
-     *            notably, they compute remainder f0 with quotient f1 that's
-     *            already wrapped around, so is off by q (instead of by 1) from
-     *            what it should be ultimately. They detect the need for
-     *            correction by checking if f0 is abnormally large.
-     *
-     *            Our approach is closer to Algorithm 36 in the specification,
-     *            in that we compute f0 normally and correct f1, f0 in the way
-     *            they prescribed. The only real difference is that we check for
-     *            wrap-around by examining f directly, instead of some other
-     *            intermediates computed from it.
-     */
-
-    /* Check for wrap-around */
-    t = _mm256_cmpgt_epi32(f, q_bound);
-
-    /* Compute remainder f0 */
-    f0 = _mm256_mullo_epi32(f1, alpha);
-    f0 = _mm256_sub_epi32(f, f0);
-    /*
-     * range: -GAMMA2 < f0 <= GAMMA2
-     *
-     * This holds since f1 = round-(f / (2*GAMMA2)) was computed exactly.
-     */
-
-    /* If wrap-around is required, set f1 = 0 and f0 -= 1 */
-    f1 = _mm256_andnot_si256(t, f1);
-    f0 = _mm256_add_epi32(f0, t);
-    /* range: 0 <= f1 <= 15, -GAMMA2 <= f0 <= GAMMA2 */
-
-    _mm256_store_si256((__m256i *)&a1[8 * i], f1);
-    _mm256_store_si256((__m256i *)&a0[8 * i], f0);
-  }
-}
-
-#else /* MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_SIGN_API &&       \
-         !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                  \
-         (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
-         || MLD_CONFIG_PARAMETER_SET == 87) */
-
-MLD_EMPTY_CU(avx2_poly_decompose_32)
-
-#endif /* !(MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_SIGN_API &&     \
-          !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                  \
-          (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
-          || MLD_CONFIG_PARAMETER_SET == 87)) */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/poly_decompose_88_avx2.c

@@ -1,157 +0,0 @@
-/*
- * Copyright (c) The mldsa-native project authors
- * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
- */
-
-/* References
- * ==========
- *
- * - [REF_AVX2]
- *   CRYSTALS-Dilithium optimized AVX2 implementation
- *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
- *   https://github.com/pq-crystals/dilithium/tree/master/avx2
- */
-
-/*
- * This file is derived from the public domain
- * AVX2 Dilithium implementation @[REF_AVX2].
- *
- * The algorithm for Decompose(r) (more specifically the handling for the
- * wrap-around cases) are modified. See the "Reference" section in the comments
- * below for a more detailed comparison.
- */
-
-#include "../../../common.h"
-
-#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) &&   \
-    !defined(MLD_CONFIG_NO_SIGN_API) &&            \
-    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED) &&   \
-    (defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
-     MLD_CONFIG_PARAMETER_SET == 44)
-
-#include <immintrin.h>
-#include "arith_native_x86_64.h"
-#include "consts.h"
-
-/*
- * Reference: The reference implementation has the input polynomial as a
- *            separate argument that may be aliased with either of the outputs.
- *            Removing the aliasing eases CBMC proofs.
- */
-
-void mld_poly_decompose_88_avx2(int32_t *a1, int32_t *a0)
-{
-  unsigned int i;
-  __m256i f, f0, f1, t;
-  const __m256i q_bound = _mm256_set1_epi32(87 * ((MLDSA_Q - 1) / 88));
-  /* check-magic: 11275 == floor(2**24 / 1488) */
-  const __m256i v = _mm256_set1_epi32(11275);
-  const __m256i alpha = _mm256_set1_epi32(2 * ((MLDSA_Q - 1) / 88));
-  const __m256i off = _mm256_set1_epi32(127);
-  const __m256i shift = _mm256_set1_epi32(128);
-
-  for (i = 0; i < MLDSA_N / 8; i++)
-  {
-    f = _mm256_load_si256((__m256i *)&a0[8 * i]);
-
-    /* check-magic: 1488 == intdiv(2 * intdiv(MLDSA_Q - 1, 88), 128) */
-    /*
-     * Compute f1 = round-(f / (2*GAMMA2)) as round-(f / (128B)) =
-     * round-(ceil(f / 128) / B) where B = 2*GAMMA2 / 128 = 1488. See
-     * mld_decompose() in mldsa/src/rounding.h for more details.
-     *
-     * range: 0 <= f <= Q-1 = 88*GAMMA2 = 44*128*B
-     */
-
-    /* Compute f1' = ceil(f / 128) as floor((f + 127) / 2^7) */
-    f1 = _mm256_add_epi32(f, off);
-    f1 = _mm256_srli_epi32(f1, 7);
-    /*
-     * range: 0 <= f1' <= (Q-1)/128 = 44B
-     *
-     * Also, f1' <= (Q-1)/128 = 2^16 - 2^6 < 2^16 ensures that the odd-index
-     * 16-bit lanes are all 0, so no bits will be dropped in the input of the
-     * _mm256_mulhi_epu16() below.
-     */
-
-    /*
-     * Compute f1 = round-(f1' / B) ≈ round(f1' * 11275 / 2^24). This is exact
-     * for 0 <= f1' < 2^16. See mld_decompose() in mldsa/src/rounding.h for the
-     * proof, and proofs/isabelle/compress for a formalization of the argument.
-     *
-     * round(f1' * 11275 / 2^24) is in turn computed in 2 steps as
-     * round(floor(f1' * 11275 / 2^16) / 2^8). The mulhi computes f1'' =
-     * floor(f1' * 11275 / 2^16). As for the next step f1 = round(f1'' / 2^8),
-     * because AVX2 doesn't have rounding right-shift (e.g. urshr in Neon), we
-     * simulate it using mulhrs with a power of 2, in this case mulhrs(f1'',
-     * 2^7) = round(f1'' * 2^7 / 2^15). (Note that the denominator is 2^15,
-     * not 2^16 as in mulhi.)
-     */
-    f1 = _mm256_mulhi_epu16(f1, v);
-    /*
-     * range: 0 <= f1''  = floor(f1' * 11275 / 2^16)
-     *                  <= f1' * 11275 / 2^16
-     *                   < 2^16 * 11275 / 2^16 = 11275
-     *
-     * Because 0 <= f1'' < 2^15, the multiplication in mulhrs is unsigned, that
-     * is, no erroneous sign-extension occurs.
-     */
-    f1 = _mm256_mulhrs_epi16(f1, shift);
-    /*
-     * range: 0 <= f1 = round-(f1' / B) <= round-(44B / B) = 44
-     *
-     * Note that the odd-index 16-bit lanes are still all 0 right now, so
-     * reinterpreting f1 as 8 lanes of int32_t (as done in the following) does
-     * not affect its value.
-     */
-
-    /*
-     * If f1 = 44, i.e. f > 87*GAMMA2, proceed as if f' = f - Q was given
-     * instead. (For f = 87*GAMMA2 + 1 thus f' = -GAMMA2, we still round it to 0
-     * like other "wrapped around" cases.)
-     *
-     * Reference: They handle wrap-around in a somewhat convoluted way. Most
-     *            notably, they compute remainder f0 with quotient f1 that's
-     *            already wrapped around, so is off by q (instead of by 1) from
-     *            what it should be ultimately. They detect the need for
-     *            correction by checking if f0 is abnormally large.
-     *
-     *            Our approach is closer to Algorithm 36 in the specification,
-     *            in that we compute f0 normally and correct f1, f0 in the way
-     *            they prescribed. The only real difference is that we check for
-     *            wrap-around by examining f directly, instead of some other
-     *            intermediates computed from it.
-     */
-
-    /* Check for wrap-around */
-    t = _mm256_cmpgt_epi32(f, q_bound);
-
-    /* Compute remainder f0 */
-    f0 = _mm256_mullo_epi32(f1, alpha);
-    f0 = _mm256_sub_epi32(f, f0);
-    /*
-     * range: -GAMMA2 < f0 <= GAMMA2
-     *
-     * This holds since f1 = round-(f / (2*GAMMA2)) was computed exactly.
-     */
-
-    /* If wrap-around is required, set f1 = 0 and f0 -= 1 */
-    f1 = _mm256_andnot_si256(t, f1);
-    f0 = _mm256_add_epi32(f0, t);
-    /* range: 0 <= f1 <= 43, -GAMMA2 <= f0 <= GAMMA2 */
-
-    _mm256_store_si256((__m256i *)&a1[8 * i], f1);
-    _mm256_store_si256((__m256i *)&a0[8 * i], f0);
-  }
-}
-#else /* MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_SIGN_API &&        \
-         !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                   \
-         (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 44) \
-       */
-
-MLD_EMPTY_CU(avx2_poly_decompose_88)
-
-#endif /* !(MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_SIGN_API &&  \
-          !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                               \
-          (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == \
-          44)) */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/poly_use_hint_32_avx2.c

@@ -1,103 +0,0 @@
-/*
- * Copyright (c) The mldsa-native project authors
- * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
- */
-
-/* References
- * ==========
- *
- * - [REF_AVX2]
- *   CRYSTALS-Dilithium optimized AVX2 implementation
- *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
- *   https://github.com/pq-crystals/dilithium/tree/master/avx2
- */
-
-/*
- * This file is derived from the public domain
- * AVX2 Dilithium implementation @[REF_AVX2].
- */
-
-#include "../../../common.h"
-
-#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) &&   \
-    !defined(MLD_CONFIG_NO_VERIFY_API) &&          \
-    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED) &&   \
-    (defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
-     (MLD_CONFIG_PARAMETER_SET == 65 || MLD_CONFIG_PARAMETER_SET == 87))
-
-#include <immintrin.h>
-#include "arith_native_x86_64.h"
-#include "consts.h"
-
-#define MLD_MM256_BLENDV_EPI32(a, b, mask)                     \
-  _mm256_castps_si256(_mm256_blendv_ps(_mm256_castsi256_ps(a), \
-                                       _mm256_castsi256_ps(b), \
-                                       _mm256_castsi256_ps(mask)))
-
-void mld_poly_use_hint_32_avx2(int32_t *a, const int32_t *hint)
-{
-  unsigned int i;
-  __m256i f, f0, f1, h, t;
-  const __m256i q_bound = _mm256_set1_epi32(31 * ((MLDSA_Q - 1) / 32));
-  /* check-magic: 1025 == floor(2**22 / 4092) */
-  const __m256i v = _mm256_set1_epi32(1025);
-  const __m256i alpha = _mm256_set1_epi32(2 * ((MLDSA_Q - 1) / 32));
-  const __m256i off = _mm256_set1_epi32(127);
-  const __m256i shift = _mm256_set1_epi32(512);
-  const __m256i mask = _mm256_set1_epi32(15);
-  const __m256i zero = _mm256_setzero_si256();
-
-  for (i = 0; i < MLDSA_N / 8; i++)
-  {
-    f = _mm256_load_si256((const __m256i *)&a[8 * i]);
-    h = _mm256_load_si256((const __m256i *)&hint[8 * i]);
-
-    /* Reference:
-     * - @[REF_AVX2] calls poly_decompose to compute all a1, a0 before the loop.
-     * - Our implementation of decompose() is slightly different from that in
-     *   @[REF_AVX2]. See poly_decompose_32_avx2.c for more information.
-     */
-    /* f1, f2 = decompose(f) */
-    f1 = _mm256_add_epi32(f, off);
-    f1 = _mm256_srli_epi32(f1, 7);
-    f1 = _mm256_mulhi_epu16(f1, v);
-    f1 = _mm256_mulhrs_epi16(f1, shift);
-    t = _mm256_cmpgt_epi32(f, q_bound);
-    f0 = _mm256_mullo_epi32(f1, alpha);
-    f0 = _mm256_sub_epi32(f, f0);
-    f1 = _mm256_andnot_si256(t, f1);
-    f0 = _mm256_add_epi32(f0, t);
-
-    /* Reference: The reference avx2 implementation checks a0 >= 0, which is
-     * different from the specification and the reference C implementation. We
-     * follow the specification and check a0 > 0.
-     */
-    /* t = (f0 > 0) ? h : -h */
-    f0 = _mm256_cmpgt_epi32(f0, zero);
-    t = MLD_MM256_BLENDV_EPI32(h, zero, f0);
-    t = _mm256_slli_epi32(t, 1);
-    h = _mm256_sub_epi32(h, t);
-
-    /* f1 = (f1 + t) % 16 */
-    f1 = _mm256_add_epi32(f1, h);
-    f1 = _mm256_and_si256(f1, mask);
-
-    _mm256_store_si256((__m256i *)&a[8 * i], f1);
-  }
-}
-
-#else /* MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_VERIFY_API &&     \
-         !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                  \
-         (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
-         || MLD_CONFIG_PARAMETER_SET == 87) */
-
-MLD_EMPTY_CU(avx2_poly_use_hint_32)
-
-#endif /* !(MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_VERIFY_API &&   \
-          !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                  \
-          (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
-          || MLD_CONFIG_PARAMETER_SET == 87)) */
-
-/* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
- * Don't modify by hand -- this is auto-generated by scripts/autogen. */
-#undef MLD_MM256_BLENDV_EPI32

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/poly_use_hint_88_avx2.c

@@ -1,105 +0,0 @@
-/*
- * Copyright (c) The mldsa-native project authors
- * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
- */
-
-/* References
- * ==========
- *
- * - [REF_AVX2]
- *   CRYSTALS-Dilithium optimized AVX2 implementation
- *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
- *   https://github.com/pq-crystals/dilithium/tree/master/avx2
- */
-
-/*
- * This file is derived from the public domain
- * AVX2 Dilithium implementation @[REF_AVX2].
- */
-
-#include "../../../common.h"
-
-#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) &&   \
-    !defined(MLD_CONFIG_NO_VERIFY_API) &&          \
-    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED) &&   \
-    (defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
-     MLD_CONFIG_PARAMETER_SET == 44)
-
-#include <immintrin.h>
-#include "arith_native_x86_64.h"
-#include "consts.h"
-
-#define MLD_MM256_BLENDV_EPI32(a, b, mask)                     \
-  _mm256_castps_si256(_mm256_blendv_ps(_mm256_castsi256_ps(a), \
-                                       _mm256_castsi256_ps(b), \
-                                       _mm256_castsi256_ps(mask)))
-
-void mld_poly_use_hint_88_avx2(int32_t *a, const int32_t *hint)
-{
-  unsigned int i;
-  __m256i f, f0, f1, h, t;
-  const __m256i q_bound = _mm256_set1_epi32(87 * ((MLDSA_Q - 1) / 88));
-  /* check-magic: 11275 == floor(2**24 / 1488) */
-  const __m256i v = _mm256_set1_epi32(11275);
-  const __m256i alpha = _mm256_set1_epi32(2 * ((MLDSA_Q - 1) / 88));
-  const __m256i off = _mm256_set1_epi32(127);
-  const __m256i shift = _mm256_set1_epi32(128);
-  const __m256i max = _mm256_set1_epi32(43);
-  const __m256i zero = _mm256_setzero_si256();
-
-  for (i = 0; i < MLDSA_N / 8; i++)
-  {
-    f = _mm256_load_si256((const __m256i *)&a[8 * i]);
-    h = _mm256_load_si256((const __m256i *)&hint[8 * i]);
-
-    /* Reference:
-     * - @[REF_AVX2] calls poly_decompose to compute all a1, a0 before the loop.
-     * - Our implementation of decompose() is slightly different from that in
-     *   @[REF_AVX2]. See poly_decompose_88_avx2.c for more information.
-     */
-    /* f1, f2 = decompose(f) */
-    f1 = _mm256_add_epi32(f, off);
-    f1 = _mm256_srli_epi32(f1, 7);
-    f1 = _mm256_mulhi_epu16(f1, v);
-    f1 = _mm256_mulhrs_epi16(f1, shift);
-    t = _mm256_cmpgt_epi32(f, q_bound);
-    f0 = _mm256_mullo_epi32(f1, alpha);
-    f0 = _mm256_sub_epi32(f, f0);
-    f1 = _mm256_andnot_si256(t, f1);
-    f0 = _mm256_add_epi32(f0, t);
-
-    /* Reference: The reference avx2 implementation checks a0 >= 0, which is
-     * different from the specification and the reference C implementation. We
-     * follow the specification and check a0 > 0.
-     */
-    /* t = (f0 > 0) ? h : -h */
-    f0 = _mm256_cmpgt_epi32(f0, zero);
-    t = MLD_MM256_BLENDV_EPI32(h, zero, f0);
-    t = _mm256_slli_epi32(t, 1);
-    h = _mm256_sub_epi32(h, t);
-
-    /* f1 = (f1 + t) % 44 */
-    f1 = _mm256_add_epi32(f1, h);
-    f1 = MLD_MM256_BLENDV_EPI32(f1, max, f1);
-    f = _mm256_cmpgt_epi32(f1, max);
-    f1 = MLD_MM256_BLENDV_EPI32(f1, zero, f);
-
-    _mm256_store_si256((__m256i *)&a[8 * i], f1);
-  }
-}
-
-#else /* MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_VERIFY_API &&      \
-         !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                   \
-         (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 44) \
-       */
-
-MLD_EMPTY_CU(avx2_poly_use_hint_88)
-
-#endif /* !(MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_NO_VERIFY_API && \
-          !MLD_CONFIG_MULTILEVEL_NO_SHARED &&                                \
-          (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET ==  \
-          44)) */
-
-/* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
- * Don't modify by hand -- this is auto-generated by scripts/autogen. */
-#undef MLD_MM256_BLENDV_EPI32

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/polyz_unpack_17_avx2.c

@@ -1,94 +0,0 @@
-/*
- * Copyright (c) The mldsa-native project authors
- * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
- */
-
-/* References
- * ==========
- *
- * - [REF_AVX2]
- *   CRYSTALS-Dilithium optimized AVX2 implementation
- *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
- *   https://github.com/pq-crystals/dilithium/tree/master/avx2
- */
-
-/*
- * This file is derived from the public domain
- * AVX2 Dilithium implementation @[REF_AVX2].
- */
-
-#include "../../../common.h"
-
-#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) &&   \
-    (!defined(MLD_CONFIG_NO_SIGN_API) ||           \
-     !defined(MLD_CONFIG_NO_VERIFY_API)) &&        \
-    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED) &&   \
-    (defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
-     MLD_CONFIG_PARAMETER_SET == 44)
-
-#include <immintrin.h>
-#include "arith_native_x86_64.h"
-
-void mld_polyz_unpack_17_avx2(int32_t *r, const uint8_t *a)
-{
-  unsigned int i;
-  __m256i f;
-  __m128i low, high;
-
-  const __m256i shufbidx = _mm256_set_epi8(
-      -1, 31, 30, 29, -1, 29, 28, 27, -1, 27, 26, 25, -1, 25, 24, 23, -1, 8, 7,
-      6, -1, 6, 5, 4, -1, 4, 3, 2, -1, 2, 1, 0);
-  const __m256i srlvdidx = _mm256_set_epi32(6, 4, 2, 0, 6, 4, 2, 0);
-  const __m256i mask = _mm256_set1_epi32(0x3FFFF);
-  const __m256i gamma1 = _mm256_set1_epi32((1 << 17));
-
-  for (i = 0; i < MLDSA_N / 8; i++)
-  {
-    /* Load bytes 0..15 into low 128-bit vector */
-    low = _mm_loadu_si128((__m128i *)&a[18 * i]);
-    /* Load bytes 2..17 into high 128-bit vector */
-    high = _mm_loadu_si128((__m128i *)&a[18 * i + 2]);
-    /* Combine into 256-bit vector */
-    f = _mm256_inserti128_si256(_mm256_castsi128_si256(low), high, 1);
-
-    /* Shuffling 8-bit lanes
-     *
-     * ┌─ Indices 0-8 into low 128-bit half ───────────────────────────────────┐
-     * │ Shuffle: [-1, 8, 7, 6, -1, 6, 5, 4, -1, 4, 3, 2, -1, 2, 1, 0]         │
-     * │ Result:  [0, byte8, byte7, byte6, ..., 0, byte2, byte1, byte0]        │
-     * └───────────────────────────────────────────────────────────────────────┘
-     *
-     * ┌─ Indices 16-31 into high 128-bit half ────────────────────────────────┐
-     * │ Shuffle: [-1,31, 30, 29, -1,29, 28, 27, -1,27, 26, 25, -1,25, 24, 23] │
-     * │ Result:  [0, byte17, byte16, byte15, ..., 0, byte11, byte10, byte9]   │
-     * └───────────────────────────────────────────────────────────────────────┘
-     */
-    f = _mm256_shuffle_epi8(f, shufbidx);
-
-    /* Keep only 18 out of 24 bits in each 32-bit lane */
-    /* Bits   0..23     16..39    32..55    48..71
-     *        72..95    88..111   104..127  120..143 */
-    f = _mm256_srlv_epi32(f, srlvdidx);
-    /* Bits   0..23     18..39    36..55    54..71
-     *        72..95    90..111   108..127  126..143 */
-    f = _mm256_and_si256(f, mask);
-    /* Bits   0..17     18..35    36..53    54..71
-     *        72..89    90..107   108..125  126..143 */
-
-    /* Map [0, 1, ..., 2^18-1] to [2^17, 2^17-1, ..., -2^17+1] */
-    f = _mm256_sub_epi32(gamma1, f);
-
-    _mm256_store_si256((__m256i *)&r[8 * i], f);
-  }
-}
-#else /* MLD_ARITH_BACKEND_X86_64_DEFAULT && (!MLD_CONFIG_NO_SIGN_API ||       \
-         !MLD_CONFIG_NO_VERIFY_API) && !MLD_CONFIG_MULTILEVEL_NO_SHARED &&     \
-         (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 44) \
-       */
-
-MLD_EMPTY_CU(avx2_polyz_unpack_17)
-
-#endif /* !(MLD_ARITH_BACKEND_X86_64_DEFAULT && (!MLD_CONFIG_NO_SIGN_API || \
-          !MLD_CONFIG_NO_VERIFY_API) && !MLD_CONFIG_MULTILEVEL_NO_SHARED && \
-          (MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == \
-          44)) */