@amritk/nish-x86_64-linux 0.26.0 → 0.28.0

package/runtime/runtime-sha256.c

@@ -0,0 +1,239 @@
+/* Nish runtime, the SHA-256 half: the block function of FIPS 180-4 §6.2.2 on
+ * the CPU's own SHA-256 instructions. std/crypto/sha256.ts is the hash; this is
+ * a faster body for its private `sha256Compress`, which the compiler calls in
+ * that function's place when `nish_sha256_hw` says this machine can run it
+ * (src/kernels.ts).
+ *
+ * A translation unit of its own for the reason runtime-aes.c is one: its own
+ * measured `.text*` ceiling in tests/runtime-budgets.js, and a program that
+ * hashes links no AES and one that encrypts no SHA-256. Section GC means a
+ * program that never calls the kernel links none of this file.
+ *
+ * There are two paths and no portable one. x86-64 runs the SHA extensions
+ * (SHA-NI: `sha256rnds2`, `sha256msg1`, `sha256msg2`) with SSSE3's byte shuffle
+ * and SSE4.1's word blend, compiled for those extensions alone with
+ * `target(...)` so the binary stays a baseline binary; AArch64 runs the ARMv8
+ * Cryptography Extension's SHA-256 instructions, likewise with
+ * `target("+sha2")`. A machine without them, or a process with
+ * `NISH_SHA256=soft`, runs the Nish code in std/crypto/sha256.ts instead: the
+ * compiler keeps that code and branches on `nish_sha256_hw` at each call. Every
+ * other target, wasm32 included, compiles `nish_sha256_hw` to `return 0` and
+ * the kernel to a trap nothing reaches, so a link that names it still resolves.
+ *
+ * The kernel checks the guard `sha256Compress` runs its body under and returns
+ * 0 without touching anything when it fails, so the caller runs the Nish
+ * function, which panics with its own message: both paths fail the same way.
+ *
+ * Constant time: the kernel's branches are on array headers and `at`, which are
+ * public, and its loads and stores are at addresses fixed by them; the
+ * round-constant table is read whole, in order. tests/ct-asm-runtime.js reads
+ * the `clang -O2` assembly of this file for both targets and holds the kernel
+ * to that. The one branch on anything else is `nish_sha256_hw`'s, on the CPU's
+ * feature bits and `NISH_SHA256` (docs/security/ct-verification.md).
+ *
+ * Wiping: the kernel keeps no buffer of its own; the state and the message
+ * words live in vector registers between the load from `src` and the store to
+ * `h`. What sits in those registers, and what the register allocator spills,
+ * no store from C can reach (docs/security/crypto-sha256-hw.md).
+ *
+ * The algorithm is FIPS 180-4 §6.2.2; the instruction sequences are the ones
+ * the instructions are defined for, written here from Intel's "Intel SHA
+ * Extensions" (S. Gulley et al., 2013) and Arm's description of SHA256H,
+ * SHA256H2, SHA256SU0 and SHA256SU1 (Arm ARM, DDI 0487).
+ */
+#include <stddef.h>
+#include <stdint.h>
+
+#include "nish.h"
+
+#if defined(__x86_64__)
+#include <cpuid.h>
+#include <immintrin.h>
+#define NISH_SHA256_X86 1
+#elif defined(__aarch64__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#include <arm_neon.h>
+#define NISH_SHA256_ARM 1
+#endif
+
+#if defined(NISH_SHA256_X86) || defined(NISH_SHA256_ARM)
+
+/* Named here rather than through <stdlib.h>, for runtime-aes.c's reason: the
+   constant-time check compiles this file for targets whose libc headers the
+   host does not have. */
+char *getenv(const char *name);
+
+#if defined(__has_attribute) && __has_attribute(no_builtin)
+#define NISH_SHA256_NO_LIBC no_builtin
+#else
+#define NISH_SHA256_NO_LIBC
+#endif
+#if defined(NISH_SHA256_X86)
+#define NISH_SHA256_TARGET __attribute__((target("sha,sse4.1,ssse3"), NISH_SHA256_NO_LIBC))
+#else
+#define NISH_SHA256_TARGET __attribute__((target("+sha2"), NISH_SHA256_NO_LIBC))
+#endif
+#define NISH_SHA256_INLINE static inline __attribute__((always_inline)) NISH_SHA256_TARGET
+
+/* K of FIPS 180-4 §4.2.2: the first 32 bits of the fractional parts of the cube
+   roots of the first sixty-four primes. */
+static const uint32_t nish_sha256_k[64] __attribute__((aligned(16))) = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+};
+
+#if defined(NISH_SHA256_X86)
+/* One block. `sha256rnds2` runs two rounds on the state split as ABEF and CDGH
+   (the words high lane to low), taking W + K for the two rounds from its third
+   operand's low two lanes, so the eight words are shuffled into that order
+   once, on the way in, and back on the way out. */
+NISH_SHA256_INLINE void nish_sha256_block(char *state, const char *in) {
+  /* Each of the sixteen bytes' places in a big-endian word read little-endian. */
+  const __m128i bswap = _mm_set_epi64x(0x0c0d0e0f08090a0bLL, 0x0405060700010203LL);
+  __m128i dcba = _mm_loadu_si128((const __m128i *)state);
+  __m128i hgfe = _mm_loadu_si128((const __m128i *)(state + 16));
+  __m128i cdab = _mm_shuffle_epi32(dcba, 0xb1);
+  __m128i efgh = _mm_shuffle_epi32(hgfe, 0x1b);
+  __m128i abef = _mm_alignr_epi8(cdab, efgh, 8);
+  __m128i cdgh = _mm_blend_epi16(efgh, cdab, 0xf0);
+  const __m128i abef0 = abef;
+  const __m128i cdgh0 = cdgh;
+  /* W in four-word groups, a ring of the last four: group i is W[4i .. 4i + 4). */
+  __m128i w[4];
+  for (int i = 0; i < 16; i++) {
+    if (i < 4) {
+      w[i] = _mm_shuffle_epi8(_mm_loadu_si128((const __m128i *)(in + 16 * i)), bswap);
+    } else {
+      /* (6.2) for t = 4i .. 4i + 3: msg1 adds σ0 of the next word to W[t - 16],
+         the align brings in W[t - 7], and msg2 adds σ1 of W[t - 2], two of
+         which it computes itself from the words before. */
+      __m128i w7 = _mm_alignr_epi8(w[(i - 1) & 3], w[(i - 2) & 3], 4);
+      w[i & 3] = _mm_sha256msg2_epu32(_mm_add_epi32(_mm_sha256msg1_epu32(w[i & 3], w[(i - 3) & 3]), w7),
+                                      w[(i - 1) & 3]);
+    }
+    __m128i wk = _mm_add_epi32(w[i & 3], _mm_load_si128((const __m128i *)&nish_sha256_k[4 * i]));
+    cdgh = _mm_sha256rnds2_epu32(cdgh, abef, wk);
+    abef = _mm_sha256rnds2_epu32(abef, cdgh, _mm_shuffle_epi32(wk, 0x0e));
+  }
+  abef = _mm_add_epi32(abef, abef0);
+  cdgh = _mm_add_epi32(cdgh, cdgh0);
+  __m128i feba = _mm_shuffle_epi32(abef, 0x1b);
+  __m128i dchg = _mm_shuffle_epi32(cdgh, 0xb1);
+  _mm_storeu_si128((__m128i *)state, _mm_blend_epi16(feba, dchg, 0xf0));
+  _mm_storeu_si128((__m128i *)(state + 16), _mm_alignr_epi8(dchg, feba, 8));
+}
+#else
+/* One block. SHA256H and SHA256H2 run four rounds on ABCD and EFGH together,
+   each giving one half of the new state, with W + K for the four in their
+   third operand. */
+NISH_SHA256_INLINE void nish_sha256_block(char *state, const char *in) {
+  uint32x4_t abcd = vld1q_u32((const uint32_t *)state);
+  uint32x4_t efgh = vld1q_u32((const uint32_t *)(state + 16));
+  const uint32x4_t abcd0 = abcd;
+  const uint32x4_t efgh0 = efgh;
+  uint32x4_t w[4];
+  for (int i = 0; i < 16; i++) {
+    if (i < 4) {
+      w[i] = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8((const uint8_t *)(in + 16 * i))));
+    } else {
+      /* (6.2) for t = 4i .. 4i + 3: SU0 adds σ0 to W[t - 16], SU1 adds W[t - 7]
+         and σ1 of W[t - 2]. */
+      w[i & 3] = vsha256su1q_u32(vsha256su0q_u32(w[i & 3], w[(i - 3) & 3]), w[(i - 2) & 3], w[(i - 1) & 3]);
+    }
+    uint32x4_t wk = vaddq_u32(w[i & 3], vld1q_u32(&nish_sha256_k[4 * i]));
+    uint32x4_t before = abcd;
+    abcd = vsha256hq_u32(abcd, efgh, wk);
+    efgh = vsha256h2q_u32(efgh, before, wk);
+  }
+  vst1q_u32((uint32_t *)state, vaddq_u32(abcd, abcd0));
+  vst1q_u32((uint32_t *)(state + 16), vaddq_u32(efgh, efgh0));
+}
+#endif
+
+/* `sha256Compress`'s own guard, then the block. That guard reads the source's
+   length through `toI32`, which saturates at 2^31 - 1, so it refuses a block
+   ending past that offset whatever the length: `at > INT32_MAX - 64`. */
+NISH_SHA256_TARGET int32_t nish_sha256_compress(nish_array *h, const nish_array *w, const nish_array *src,
+                                                int32_t at) {
+  if (h->len < 8 || w->len < 64 || at < 0 || at > INT32_MAX - 64 || src->len < 64 || (uint64_t)at > src->len - 64)
+    return 0;
+  nish_sha256_block(h->data, src->data + at);
+  return 1;
+}
+
+#if defined(NISH_SHA256_X86)
+/* Whether this CPU runs the kernel: CPUID leaf 7's EBX has SHA (bit 29), and
+   leaf 1's ECX SSE4.1 (bit 19) and SSSE3 (bit 9). Asked through `cpuid.h`, for
+   runtime-aes.c's reason; `__get_cpuid_count` answers 0 when leaf 7 is past
+   the CPU's highest. */
+static int32_t nish_sha256_cpu(void) {
+  unsigned a, b, c, d;
+  if (!__get_cpuid(1, &a, &b, &c, &d)) return 0;
+  if ((c & bit_SSE4_1) == 0 || (c & bit_SSSE3) == 0) return 0;
+  if (!__get_cpuid_count(7, 0, &a, &b, &c, &d)) return 0;
+  return (b & bit_SHA) != 0;
+}
+#elif defined(__linux__)
+/* Linux reports the ARMv8 SHA-256 instructions in the auxiliary vector:
+   AT_HWCAP is 16, and its HWCAP_SHA2 bit is 6
+   (arch/arm64/include/uapi/asm/hwcap.h). */
+unsigned long getauxval(unsigned long type);
+
+static int32_t nish_sha256_cpu(void) {
+  return (getauxval(16) & (1ul << 6)) != 0;
+}
+#elif defined(__APPLE__)
+/* macOS names the feature in sysctl (macOS 12 and later). A system that does
+   not know the name answers as a CPU without it: the Nish path. */
+int sysctlbyname(const char *name, void *oldp, size_t *oldlenp, void *newp, size_t newlen);
+
+static int32_t nish_sha256_cpu(void) {
+  int32_t has = 0;
+  size_t size = sizeof has;
+  if (sysctlbyname("hw.optional.arm.FEAT_SHA256", &has, &size, 0, 0) != 0) return 0;
+  return has != 0;
+}
+#else
+/* Another AArch64 system: no question asked, so the Nish path. */
+static int32_t nish_sha256_cpu(void) {
+  return 0;
+}
+#endif
+
+/* The answer: 0 until the first call, then 1 for the kernel or 2 for the Nish
+   path, with runtime-aes.c's relaxed atomics for the same reason. */
+static int32_t nish_sha256_answer;
+
+int32_t nish_sha256_hw(void) {
+  int32_t answer = __atomic_load_n(&nish_sha256_answer, __ATOMIC_RELAXED);
+  if (answer == 0) {
+    /* `soft` pins the Nish path and never asks the CPU; anything else, or
+       nothing, means the best this machine has. */
+    const char *pin = getenv("NISH_SHA256");
+    int soft = pin != 0 && pin[0] == 's' && pin[1] == 'o' && pin[2] == 'f' && pin[3] == 't' && pin[4] == 0;
+    answer = !soft && nish_sha256_cpu() ? 1 : 2;
+    __atomic_store_n(&nish_sha256_answer, answer, __ATOMIC_RELAXED);
+  }
+  return answer == 1;
+}
+
+#else
+
+/* A target with no SHA-256 instructions this file uses, wasm32 among them: the
+   Nish path always, and a kernel that a program whose every call is behind
+   `nish_sha256_hw` never reaches. */
+int32_t nish_sha256_hw(void) {
+  return 0;
+}
+
+int32_t nish_sha256_compress(nish_array *h, const nish_array *w, const nish_array *src, int32_t at) {
+  (void)h, (void)w, (void)src, (void)at;
+  __builtin_trap();
+}
+
+#endif

package/runtime/runtime-simd.c

@@ -1,5 +1,6 @@
 /* Nish runtime, the vector half: byte searches that read sixteen or thirty-two
- * bytes at a time (WP38 S1, docs/wp38-simd.md §3.1).
+ * bytes at a time (WP38 S1, docs/wp38-simd.md §3.1), and the SSE4.1 rounding
+ * behind `Math.floor`, `Math.ceil` and `Math.trunc` (#943, at the end).
  *
  * A translation unit of its own for the reason runtime-host.c is one: each file
  * carries its own measured `.text*` ceiling in tests/runtime-budgets.js, and
@@ -176,10 +177,17 @@ static int nish_cpu_has_avx2(void) {
    `base` never reads the CPU's feature bits at all. */
 enum { NISH_PATH_SCALAR, NISH_PATH_BASE, NISH_PATH_AVX2 };
 
-static int nish_simd_choose(void) {
+/* The path `NISH_SIMD` pins, or -1 when it pins none. */
+static int nish_simd_pin(void) {
   const char *pin = getenv("NISH_SIMD");
   if (pin != NULL && strcmp(pin, "scalar") == 0) return NISH_PATH_SCALAR;
   if (pin != NULL && strcmp(pin, "base") == 0) return NISH_PATH_BASE;
+  return -1;
+}
+
+static int nish_simd_choose(void) {
+  int pin = nish_simd_pin();
+  if (pin >= 0) return pin;
 #if defined(NISH_SIMD_SSE2)
   if (nish_cpu_has_avx2()) return NISH_PATH_AVX2;
 #endif
@@ -425,3 +433,56 @@ int64_t nish_regex_scan(const nish_str *s, const nish_array *masks, int64_t dept
                         int64_t from) {
   return __atomic_load_n(&nish_scan, __ATOMIC_RELAXED)(s, masks, depth, off, width, from);
 }
+
+/* `Math.floor`, `Math.ceil` and `Math.trunc`, and the floor `Math.round` takes
+   (#943), the contract in nish.h. SSE4.1's `roundsd` answers each in one
+   instruction, but the x86-64 baseline is SSE2, where LLVM lowers
+   `llvm.floor.f64` to a call of libm's `floor` through the GOT. So a module
+   for x86-64 calls these instead (`roundingCallee`, src/emit-builtins.ts) and
+   registers a constructor that hands `nish_round_init` libm's three routines;
+   it asks the CPU once, before `main`, and keeps them only when the answer is
+   no. The runtime names no libm symbol itself, so a link without `-lm` (a C
+   host, a program that never rounds) still resolves: the module that rounds
+   brings the reference, as it did before. A null slot is the instruction and
+   is never written after the constructor, so on a CPU without SSE4.1 each
+   call is an indirect jump to libm, the path a module took before.
+   `NISH_SIMD=scalar` keeps libm, the forced fallback a test runs. `base` does
+   not: the instruction gate counts under it, and glibc's own `floor` takes
+   `roundsd` there as well, so the count is of the instruction both call.
+   Built for a machine that has SSE4.1 already (`--cpu x86-64-v3`), or for any
+   other, each is the builtin, which is the one instruction there, and the
+   constructor keeps nothing. The immediate is the rounding mode, 1 down, 2 up,
+   3 toward zero, plus 8, which keeps the precision exception quiet as libm's
+   `floor` does. */
+#if defined(NISH_SIMD_SSE2) && !defined(__SSE4_1__)
+static double (*nish_round_libm[3])(double);
+
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  unsigned a, b, c, d;
+  if (nish_simd_pin() != NISH_PATH_SCALAR && __get_cpuid(1, &a, &b, &c, &d) && (c & bit_SSE4_1)) return;
+  nish_round_libm[0] = floor_fn;
+  nish_round_libm[1] = ceil_fn;
+  nish_round_libm[2] = trunc_fn;
+}
+
+#define NISH_ROUNDING(name, base, slot, mode)                                                                \
+  double name(double x) {                                                                                    \
+    double (*libm)(double) = nish_round_libm[slot];                                                          \
+    if (libm) return libm(x);                                                                                \
+    __asm__("roundsd $" #mode ", %0, %0" : "+x"(x));                                                         \
+    return x;                                                                                                \
+  }
+#else
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  (void)floor_fn;
+  (void)ceil_fn;
+  (void)trunc_fn;
+}
+
+#define NISH_ROUNDING(name, base, slot, mode)                                                                \
+  double name(double x) { return __builtin_##base(x); }
+#endif
+
+NISH_ROUNDING(nish_floor, floor, 0, 9)
+NISH_ROUNDING(nish_ceil, ceil, 1, 10)
+NISH_ROUNDING(nish_trunc, trunc, 2, 11)

package/runtime/runtime-wasm.c

@@ -128,3 +128,21 @@ void nish_exit(int32_t code) { (void)code; __builtin_trap(); }
 void nish_panic(const void *s) { (void)s; __builtin_trap(); }
 /* Output has nowhere to go either. */
 void nish_write(const void *s, int32_t fd, _Bool newline) { (void)s; (void)fd; (void)newline; }
+
+/* ---- Rounding (#943): IR compiled for the host calls these and registers a
+ * constructor that passes `nish_round_init` libm's three routines
+ * (runtime-simd.c has the native ones). On wasm32 each is the one
+ * instruction, f64.floor, f64.ceil or f64.trunc, and there is no CPU to ask.
+ * The link is freestanding, so the libm names the constructor takes are
+ * defined here too, as the same instructions. */
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  (void)floor_fn;
+  (void)ceil_fn;
+  (void)trunc_fn;
+}
+double nish_floor(double x) { return __builtin_floor(x); }
+double nish_ceil(double x) { return __builtin_ceil(x); }
+double nish_trunc(double x) { return __builtin_trunc(x); }
+double floor(double x) { return __builtin_floor(x); }
+double ceil(double x) { return __builtin_ceil(x); }
+double trunc(double x) { return __builtin_trunc(x); }

package/scripts/build.sh

@@ -3,17 +3,21 @@
 #
 #   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm|wasi|napi]
 #
-# The C runtime is ten translation units and is named as one: an input
+# The C runtime is thirteen translation units and is named as one: an input
 # <dir>/runtime.c also compiles <dir>/runtime-os.c, the half that wraps the
 # system calls (files, directories, subprocesses, the environment, the clock),
 # <dir>/runtime-parallel.c, the half that divides a range of work across
 # threads, <dir>/runtime-cross.c, the copies that carry a string or an array
 # from one thread's arena to another's, <dir>/runtime-host.c, the wall clock, entropy, file times and
 # signals, <dir>/runtime-net.c, the sockets of `nish:net`,
-# <dir>/runtime-simd.c, the byte searches that read a vector at a time,
+# <dir>/runtime-simd.c, the byte searches that read a vector at a time and
+# the SSE4.1 rounding of `Math.floor` and its kin,
 # <dir>/runtime-aes.c, AES-GCM on the CPU's AES instructions,
-# <dir>/runtime-term.c, stdin and the terminal of `nish:term`, and
-# <dir>/runtime-bytes.c, the byte-class runs of `nish/bytes`. Each of those
+# <dir>/runtime-sha256.c, SHA-256 on the CPU's SHA instructions,
+# <dir>/runtime-checksum.c, CRC-32 on its carry-less multiply or CRC instructions,
+# <dir>/runtime-term.c, stdin and the terminal of `nish:term`,
+# <dir>/runtime-bytes.c, the byte-class runs of `nish/bytes`, and
+# <dir>/runtime-sandbox.c, the confinement `--sandbox` applies. Each of those
 # files says why they are compiled and measured apart.
 #
 # Profiles:
@@ -168,6 +172,15 @@ case "$profile" in
           if grep -E '^define [^@]*@memory\(' "$i" | grep -Evq '^define (internal|private) '; then
             echo "error: $i defines a function named \`memory\`, the name the $profile profile's module exports its linear memory under; rename the function" >&2
             exit 2
+          fi
+          # `--sandbox` IR compiled for the host confines through Linux system
+          # calls a wasm module has none of; the compiler emits no call for a
+          # wasm target, so only IR that never told it reaches this. The match
+          # is the call instruction, not the name: the compiler's own IR holds
+          # the name as string data.
+          if grep -Eq '^[[:space:]]+call void @nish_sandbox\(' "$i"; then
+            echo "error: $i was compiled with --sandbox, and a $profile module has no sandbox; compile it with --target wasm32 and without --sandbox" >&2
+            exit 2
           fi ;;
       esac
     done ;;
@@ -194,15 +207,17 @@ if [ -n "$sqlite_to" ] || [ -n "$sqlite_from" ]; then
 fi
 [ -n "$out" ] || [ -n "$objects_to" ] || [ -n "$sqlite_to" ] || { echo "error: -o <out> is required" >&2; exit 2; }
 
-# The runtime is ten translation units, and a caller names one: whoever passes
+# The runtime is thirteen translation units, and a caller names one: whoever passes
 # <dir>/runtime.c gets <dir>/runtime-os.c, <dir>/runtime-parallel.c,
 # <dir>/runtime-cross.c, <dir>/runtime-host.c, <dir>/runtime-net.c, <dir>/runtime-simd.c,
-# <dir>/runtime-aes.c, <dir>/runtime-term.c and <dir>/runtime-bytes.c compiled beside it, on every profile,
+# <dir>/runtime-aes.c, <dir>/runtime-sha256.c, <dir>/runtime-checksum.c, <dir>/runtime-term.c,
+# <dir>/runtime-bytes.c and <dir>/runtime-sandbox.c compiled beside it, on every profile,
 # wasi included: runtime-simd.c and runtime-bytes.c take their scalar paths there
 # unless the build adds -msimd128,
-# runtime-aes.c compiles to an answer of 0 and stubs that nothing calls,
-# because the compiler emits no call to its kernels for wasm32, and
-# runtime-term.c reads stdin and answers "not a terminal". They were one file until the
+# runtime-aes.c, runtime-sha256.c and runtime-checksum.c compile to an answer of 0 and
+# stubs that nothing calls, because the compiler emits no call to their kernels for wasm32, and
+# runtime-term.c reads stdin and answers "not a terminal", and runtime-sandbox.c
+# compiles to two functions that refuse to run, which no wasm build calls. They were one file until the
 # operating-system half was split out for its own size budget, and the parallel
 # half followed for the same reason (each file's header comment says why), and
 # a link line is where those splits
@@ -212,7 +227,7 @@ fi
 # here keeps every one of those correct, and keeps "the runtime" one thing to
 # name from the outside. A caller that names one itself is left alone, because
 # naming one object twice is a duplicate-symbol error.
-halves="runtime-os.c runtime-parallel.c runtime-cross.c runtime-host.c runtime-net.c runtime-simd.c runtime-aes.c runtime-term.c runtime-bytes.c"
+halves="runtime-os.c runtime-parallel.c runtime-cross.c runtime-host.c runtime-net.c runtime-simd.c runtime-aes.c runtime-sha256.c runtime-checksum.c runtime-term.c runtime-bytes.c runtime-sandbox.c"
 for i in ${inputs[@]+"${inputs[@]}"}; do
   case "$i" in
     */runtime.c|runtime.c)
@@ -634,22 +649,29 @@ case "$profile" in
       exit 2
     fi
     # IR compiled for the host rather than with `--target wasm32` calls std/crypto/aes.ts's
-    # AES kernels behind `nish_aes_hw` (src/kernels.ts). runtime-aes.c's wasm32 build
-    # answers 0 there, so the bitsliced code runs, and it is added only for such IR:
-    # every other module links the bytes it always did.
-    # A caller that names runtime-aes.c itself is left alone, as `halves` leaves it:
+    # AES kernels behind `nish_aes_hw`, std/crypto/sha256.ts's block function behind
+    # `nish_sha256_hw` and std/compress/checksum.ts's CRC-32 kernel behind
+    # `nish_crc32_hw` (src/kernels.ts). runtime-aes.c's, runtime-sha256.c's and
+    # runtime-checksum.c's wasm32 builds answer 0 there, so the Nish code runs, and
+    # each is added only for such IR: every other module links the bytes it always did.
+    # Each pair is a unit and the kernel its probe names.
+    # A caller that names the unit itself is left alone, as `halves` leaves it:
     # one object named twice is a duplicate-symbol error.
-    aes_named=0
-    aes_wanted=0
-    for i in ${inputs[@]+"${inputs[@]}"}; do
-      case "$i" in
-        */runtime-aes.c|runtime-aes.c) aes_named=1 ;;
-        *.ll) if grep -q '@nish_aes_hw(' "$i"; then aes_wanted=1; fi ;;
-      esac
+    for pair in aes:aes sha256:sha256 checksum:crc32; do
+      unit=${pair%%:*}
+      kernel=${pair#*:}
+      named=0
+      wanted=0
+      for i in ${inputs[@]+"${inputs[@]}"}; do
+        case "$i" in
+          */runtime-"$unit".c|runtime-"$unit".c) named=1 ;;
+          *.ll) if grep -q "@nish_${kernel}_hw(" "$i"; then wanted=1; fi ;;
+        esac
+      done
+      if [ "$wanted" = 1 ] && [ "$named" = 0 ]; then
+        inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-$unit.c")
+      fi
     done
-    if [ "$aes_wanted" = 1 ] && [ "$aes_named" = 0 ]; then
-      inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-aes.c")
-    fi
     # IR of either kind that imports std/json or calls nish/bytes's byte-class runs
     # calls runtime-bytes.c's kernels (src/kernels.ts), which compile freestanding:
     # the scalar path, or the 128-bit one under -msimd128. It is added the same way,
@@ -665,6 +687,20 @@ case "$profile" in
     if [ "$bytes_wanted" = 1 ] && [ "$bytes_named" = 0 ]; then
       inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-bytes.c")
     fi
+    # IR compiled for the host rounds through runtime-simd.c's `nish_floor` and its
+    # kin behind the constructor `nish_round_init` (#943). runtime-wasm.c has their
+    # wasm32 bodies, and it is added the same way when such IR does not name it.
+    wasm_named=0
+    round_wanted=0
+    for i in ${inputs[@]+"${inputs[@]}"}; do
+      case "$i" in
+        */runtime-wasm.c|runtime-wasm.c) wasm_named=1 ;;
+        *.ll) if grep -q '@nish_round_init' "$i"; then round_wanted=1; fi ;;
+      esac
+    done
+    if [ "$round_wanted" = 1 ] && [ "$wasm_named" = 0 ]; then
+      inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-wasm.c")
+    fi
     # -mbulk-memory lowers llvm.memset/memcpy (`new Array<T>(n)`, `push` growth) to the
     # memory.fill/memory.copy instructions instead of libc calls the freestanding link lacks.
     "$CC" -Wno-override-module --target=wasm32-unknown-unknown -Oz -nostdlib -mbulk-memory \