@amritk/nish-x86_64-linux 0.33.0 → 0.34.0

package/INSTALL.md

@@ -254,8 +254,8 @@ routes are
   # on the musl host, with its own clang and the runtime from this repository
   clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
     runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-    runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-term.c \
-    runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c \
+    runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-chacha20.c \
+    runtime/runtime-term.c runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c \
     runtime/runtime-shm.c runtime/runtime-region.c -lm -o app
   ```
 
@@ -392,7 +392,7 @@ it into `build/seed/`; `NISH_BOOTSTRAP=<path>` names one you already have and
 skips the download. §2a has what the build does with it.
 
 The published package ships `bin/` (the `nish` command, which is a launcher),
-`runtime/` (the C runtime — fifteen translation units, the wasm subset and their
+`runtime/` (the C runtime — sixteen translation units, the wasm subset and their
 header — and `runtime/sqlite/`, SQLite's vendored source),
 `scripts/build.sh` (the link pipeline), `std/` (the standard library) and
 `docs/AI.md` (the rules card). The
@@ -405,14 +405,14 @@ working directory — and the binary runs from inside its own platform package
 for exactly that reason.
 
 Building the IR yourself rather than through `--link` means naming the runtime
-on the `clang` line, and it is fifteen files:
+on the `clang` line, and it is sixteen files:
 
 ```bash
 clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
   runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-  runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-term.c \
-  runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c \
-  runtime/runtime-shm.c -lm -o app
+  runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-chacha20.c \
+  runtime/runtime-term.c runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c \
+  runtime/runtime-shm.c runtime/runtime-region.c -lm -o app
 ```
 
 `runtime.c` is the part every program touches — the arena, strings, arrays,
@@ -427,7 +427,9 @@ entropy, file times and signals, `runtime-net.c` the sockets of `nish:net`,
 `runtime-simd.c` and `runtime-aes.c` the vector text search and AES-GCM,
 `runtime-sha256.c` the SHA-256 block kernel `nish/crypto/sha256` hands its
 blocks to on a CPU with the SHA instructions (`NISH_SHA256=soft` keeps the
-portable path), `runtime-term.c` the stdin reads and terminal calls of `nish:term`,
+portable path), `runtime-chacha20.c` the ChaCha20 keystream `nish/crypto/chacha20poly1305`
+hands a message of 256 bytes or more to on a CPU with AVX2 or NEON (`NISH_CHACHA20=soft`
+keeps the portable path), `runtime-term.c` the stdin reads and terminal calls of `nish:term`,
 `runtime-bytes.c` the byte-class runs of `nish/bytes`, which `nish/json` steps
 over, `runtime-checksum.c` the CRC-32 kernels of `nish/compress/checksum`,
 `runtime-sandbox.c` the confinement a `--sandbox` build applies, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amritk/nish-x86_64-linux",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "The nish native compiler for Linux on x86_64",
   "license": "MIT",
   "os": [

package/runtime/core.d.ts

@@ -16,14 +16,30 @@ import type { f32, f64, i32, u16, u32, u8 } from "./core/numbers.js";
  * `nish` does, but lets `===` and `<` through, which `nish` refuses. Under
  * Node it is a typed array made once and never written after.
  */
-export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8 }
-export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16 }
-export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32 }
-export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32 }
-export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32 }
-export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64 }
+export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8; readonly __mask: mask8x16 }
+export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16; readonly __mask: mask16x8 }
+export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32; readonly __mask: mask32x4 }
+export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32; readonly __mask: mask32x4 }
+export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32; readonly __mask: mask32x4 }
+export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64; readonly __mask: mask64x2 }
 /** Any of the six. */
 export type SimdVector = u8x16 | u16x8 | i32x4 | u32x4 | f32x4 | f64x2;
+/** The four with integer lanes. */
+export type IntegerVector = u8x16 | u16x8 | i32x4 | u32x4;
+/** The two with float lanes. */
+export type FloatVector = f32x4 | f64x2;
+/**
+ * One boolean per lane, which a lane-wise compare answers. Under Node an
+ * array of booleans. `nish` keeps a mask in a local, a parameter or a
+ * return of a function the module keeps, and nowhere else; it has no
+ * constructor.
+ */
+export interface mask8x16 { readonly __nishMask: "mask8x16" }
+export interface mask16x8 { readonly __nishMask: "mask16x8" }
+export interface mask32x4 { readonly __nishMask: "mask32x4" }
+export interface mask64x2 { readonly __nishMask: "mask64x2" }
+/** Any of the four. */
+export type SimdMask = mask8x16 | mask16x8 | mask32x4 | mask64x2;
 /** One value per lane, lane 0 first. */
 export declare function u8x16(
   a0: u8, a1: u8, a2: u8, a3: u8, a4: u8, a5: u8, a6: u8, a7: u8,
@@ -54,3 +70,64 @@ export declare function store<V extends SimdVector>(v: V, xs: V["__lane"][], i:
 export declare function extract<V extends SimdVector>(v: V, k: i32): V["__lane"];
 /** A new vector: `v` with lane `k` set to `x`. */
 export declare function replace<V extends SimdVector>(v: V, k: i32, x: V["__lane"]): V;
+/** Float lane arithmetic, lane by lane. An integer lane's form wraps. */
+export declare function add<V extends FloatVector>(a: V, b: V): V;
+export declare function sub<V extends FloatVector>(a: V, b: V): V;
+export declare function mul<V extends FloatVector>(a: V, b: V): V;
+export declare function div<V extends FloatVector>(a: V, b: V): V;
+export declare function sqrt<V extends FloatVector>(a: V): V;
+/** Integer lane arithmetic, wrapping at the lane width. */
+export declare function addWrapping<V extends IntegerVector>(a: V, b: V): V;
+export declare function subWrapping<V extends IntegerVector>(a: V, b: V): V;
+export declare function mulWrapping<V extends IntegerVector>(a: V, b: V): V;
+/** Negation and absolute value of float lanes: the sign bit. */
+export declare function neg<V extends FloatVector>(a: V): V;
+export declare function abs<V extends FloatVector>(a: V): V;
+/** The lesser and the greater lane: a float NaN lane answers NaN. */
+export declare function min<V extends SimdVector>(a: V, b: V): V;
+export declare function max<V extends SimdVector>(a: V, b: V): V;
+/** Bitwise, on integer lanes or lane by lane on two masks. */
+export declare function and<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+export declare function or<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+export declare function xor<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+export declare function not<V extends IntegerVector | SimdMask>(a: V): V;
+/** Lane-wise compares, answering the vector's mask. A float compare is ordered (`ne` unordered). */
+export declare function eq<V extends SimdVector>(a: V, b: V): V["__mask"];
+export declare function ne<V extends SimdVector>(a: V, b: V): V["__mask"];
+export declare function lt<V extends SimdVector>(a: V, b: V): V["__mask"];
+export declare function le<V extends SimdVector>(a: V, b: V): V["__mask"];
+export declare function gt<V extends SimdVector>(a: V, b: V): V["__mask"];
+export declare function ge<V extends SimdVector>(a: V, b: V): V["__mask"];
+/** Lane `k` of `a` where lane `k` of `m` is set, else of `b`. */
+export declare function select<V extends SimdVector>(m: V["__mask"], a: V, b: V): V;
+/** Whether any lane, or every lane, is set. */
+export declare function any(m: SimdMask): boolean;
+export declare function all(m: SimdMask): boolean;
+/** Lane `k`'s flag in bit `k`. */
+export declare function bitmask(m: SimdMask): i32;
+/**
+ * The lanes added: a `u8x16` or `u16x8` in an `i32`, a float vector in lane
+ * order. An `i32x4` or `u32x4` total is `sumWrapping`.
+ */
+export declare function sum(v: u8x16 | u16x8): i32;
+export declare function sum(v: f32x4): f32;
+export declare function sum(v: f64x2): f64;
+export declare function sumWrapping(v: i32x4): i32;
+export declare function sumWrapping(v: u32x4): u32;
+/** Lanes picked from `a` then `b` by integer-literal indices, one per lane. */
+export declare function shuffle<V extends SimdVector>(a: V, b: V, ...lanes: i32[]): V;
+/**
+ * Shifts and rotates by an integer-literal count below the lane width:
+ * `shr` is logical on an unsigned lane and arithmetic on an `i32` lane.
+ */
+export declare function shl<V extends IntegerVector>(v: V, count: i32): V;
+export declare function shr<V extends IntegerVector>(v: V, count: i32): V;
+export declare function rotl<V extends IntegerVector>(v: V, count: i32): V;
+export declare function rotr<V extends IntegerVector>(v: V, count: i32): V;
+/** The same sixteen bytes read as another vector type. */
+export declare function asU8x16(v: SimdVector): u8x16;
+export declare function asU16x8(v: SimdVector): u16x8;
+export declare function asI32x4(v: SimdVector): i32x4;
+export declare function asU32x4(v: SimdVector): u32x4;
+export declare function asF32x4(v: SimdVector): f32x4;
+export declare function asF64x2(v: SimdVector): f64x2;

package/runtime/core.mjs

@@ -120,3 +120,93 @@ export function replace(v, k, x) {
   out[k] = x;
   return out;
 }
+
+// ---- `nish:simd` lane operations ---------------------------------------------
+// Each answers a fresh vector of its operands' type, and the typed array does
+// the wrapping: a `u8` sum stored into a `Uint8Array` keeps its low byte, as
+// `add <16 x i8>` does. A mask is an array of booleans, one a lane. `f32`
+// arithmetic rounds once, through the array, which for `+ - * /` and `sqrt` is
+// the single rounding the native lane does: the double result of two floats
+// rounds to the same float. `Math.min` and `Math.max` are `llvm.minimum` and
+// `llvm.maximum`: a NaN lane answers NaN and -0 orders below +0.
+
+const simdLanes = (a, f) => {
+  const out = new a.constructor(a.length);
+  for (let j = 0; j < a.length; j++) out[j] = f(a[j], j);
+  return out;
+};
+const simdMask = (a, f) => {
+  const out = new Array(a.length);
+  for (let j = 0; j < a.length; j++) out[j] = f(a[j], j);
+  return out;
+};
+const simdBits = (a) => a.BYTES_PER_ELEMENT * 8;
+
+export const add = (a, b) => simdLanes(a, (x, j) => x + b[j]);
+export const sub = (a, b) => simdLanes(a, (x, j) => x - b[j]);
+export const mul = (a, b) => simdLanes(a, (x, j) => x * b[j]);
+export const div = (a, b) => simdLanes(a, (x, j) => x / b[j]);
+export const neg = (a) => simdLanes(a, (x) => -x);
+export const abs = (a) => simdLanes(a, (x) => Math.abs(x));
+export const sqrt = (a) => simdLanes(a, (x) => Math.sqrt(x));
+// A typed array wraps on store, so the integer forms share the float bodies.
+export const addWrapping = (a, b) => simdLanes(a, (x, j) => x + b[j]);
+export const subWrapping = (a, b) => simdLanes(a, (x, j) => x - b[j]);
+// A 32-bit product loses its low bits as a double; `Math.imul` keeps them.
+export const mulWrapping = (a, b) => simdLanes(a, (x, j) => (simdBits(a) === 32 ? Math.imul(x, b[j]) : x * b[j]));
+export const min = (a, b) => simdLanes(a, (x, j) => Math.min(x, b[j]));
+export const max = (a, b) => simdLanes(a, (x, j) => Math.max(x, b[j]));
+
+/** `and`, `or`, `xor` and `not` take an integer vector or a mask. */
+export const and = (a, b) => (Array.isArray(a) ? simdMask(a, (x, j) => x && b[j]) : simdLanes(a, (x, j) => x & b[j]));
+export const or = (a, b) => (Array.isArray(a) ? simdMask(a, (x, j) => x || b[j]) : simdLanes(a, (x, j) => x | b[j]));
+export const xor = (a, b) => (Array.isArray(a) ? simdMask(a, (x, j) => x !== b[j]) : simdLanes(a, (x, j) => x ^ b[j]));
+export const not = (a) => (Array.isArray(a) ? simdMask(a, (x) => !x) : simdLanes(a, (x) => ~x));
+
+// `ne` is the unordered compare: a NaN lane is unequal to everything.
+export const eq = (a, b) => simdMask(a, (x, j) => x === b[j]);
+export const ne = (a, b) => simdMask(a, (x, j) => x !== b[j]);
+export const lt = (a, b) => simdMask(a, (x, j) => x < b[j]);
+export const le = (a, b) => simdMask(a, (x, j) => x <= b[j]);
+export const gt = (a, b) => simdMask(a, (x, j) => x > b[j]);
+export const ge = (a, b) => simdMask(a, (x, j) => x >= b[j]);
+
+export const select = (m, a, b) => simdLanes(a, (x, j) => (m[j] ? x : b[j]));
+export const any = (m) => m.some((x) => x);
+export const all = (m) => m.every((x) => x);
+export const bitmask = (m) => m.reduce((bits, x, j) => (x ? bits | (1 << j) : bits), 0);
+
+/**
+ * `sum`: a float vector's lanes added first to last from -0, rounding each
+ * step as `llvm.vector.reduce.fadd` does; a `u8` or `u16` vector's, which
+ * cannot overflow an `i32`.
+ */
+export const sum = (a) => {
+  let acc = -0;
+  for (const x of a) acc = a instanceof Float32Array ? Math.fround(acc + x) : acc + x;
+  return acc;
+};
+/** `sumWrapping`: a 32-bit vector's lanes added modulo 2^32. */
+export const sumWrapping = (a) => {
+  let acc = 0;
+  for (const x of a) acc = (acc + x) | 0;
+  return a instanceof Uint32Array ? acc >>> 0 : acc;
+};
+
+/** `shuffle(a, b, ...lanes)`: lane `k` of the 2N lanes `a` then `b`. */
+export const shuffle = (a, b, ...lanes) => simdLanes(a, (_, j) => (lanes[j] < a.length ? a[lanes[j]] : b[lanes[j] - a.length]));
+
+// A count is a constant below the lane width, so `x >>> (w - k)` is a real
+// shift; at k = 0 and w = 32 JavaScript's count wraps to 0, and the `|` keeps x.
+export const shl = (a, k) => simdLanes(a, (x) => x << k);
+export const shr = (a, k) => simdLanes(a, (x) => (a instanceof Int32Array ? x >> k : x >>> k));
+export const rotl = (a, k) => simdLanes(a, (x) => (x << k) | (x >>> (simdBits(a) - k)));
+export const rotr = (a, k) => simdLanes(a, (x) => (x >>> k) | (x << (simdBits(a) - k)));
+
+const simdAs = (Lanes) => (v) => new Lanes(v.buffer.slice(v.byteOffset, v.byteOffset + 16));
+export const asU8x16 = simdAs(Uint8Array);
+export const asU16x8 = simdAs(Uint16Array);
+export const asI32x4 = simdAs(Int32Array);
+export const asU32x4 = simdAs(Uint32Array);
+export const asF32x4 = simdAs(Float32Array);
+export const asF64x2 = simdAs(Float64Array);

package/runtime/nish.d.ts

@@ -856,14 +856,30 @@ declare module "nish:simd" {
    * `nish` does, but lets `===` and `<` through, which `nish` refuses. Under
    * Node it is a typed array made once and never written after.
    */
-  export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8 }
-  export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16 }
-  export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32 }
-  export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32 }
-  export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32 }
-  export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64 }
+  export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8; readonly __mask: mask8x16 }
+  export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16; readonly __mask: mask16x8 }
+  export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32; readonly __mask: mask32x4 }
+  export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32; readonly __mask: mask32x4 }
+  export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32; readonly __mask: mask32x4 }
+  export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64; readonly __mask: mask64x2 }
   /** Any of the six. */
   export type SimdVector = u8x16 | u16x8 | i32x4 | u32x4 | f32x4 | f64x2;
+  /** The four with integer lanes. */
+  export type IntegerVector = u8x16 | u16x8 | i32x4 | u32x4;
+  /** The two with float lanes. */
+  export type FloatVector = f32x4 | f64x2;
+  /**
+   * One boolean per lane, which a lane-wise compare answers. Under Node an
+   * array of booleans. `nish` keeps a mask in a local, a parameter or a
+   * return of a function the module keeps, and nowhere else; it has no
+   * constructor.
+   */
+  export interface mask8x16 { readonly __nishMask: "mask8x16" }
+  export interface mask16x8 { readonly __nishMask: "mask16x8" }
+  export interface mask32x4 { readonly __nishMask: "mask32x4" }
+  export interface mask64x2 { readonly __nishMask: "mask64x2" }
+  /** Any of the four. */
+  export type SimdMask = mask8x16 | mask16x8 | mask32x4 | mask64x2;
   /** One value per lane, lane 0 first. */
   export function u8x16(
     a0: u8, a1: u8, a2: u8, a3: u8, a4: u8, a5: u8, a6: u8, a7: u8,
@@ -894,6 +910,67 @@ declare module "nish:simd" {
   export function extract<V extends SimdVector>(v: V, k: i32): V["__lane"];
   /** A new vector: `v` with lane `k` set to `x`. */
   export function replace<V extends SimdVector>(v: V, k: i32, x: V["__lane"]): V;
+  /** Float lane arithmetic, lane by lane. An integer lane's form wraps. */
+  export function add<V extends FloatVector>(a: V, b: V): V;
+  export function sub<V extends FloatVector>(a: V, b: V): V;
+  export function mul<V extends FloatVector>(a: V, b: V): V;
+  export function div<V extends FloatVector>(a: V, b: V): V;
+  export function sqrt<V extends FloatVector>(a: V): V;
+  /** Integer lane arithmetic, wrapping at the lane width. */
+  export function addWrapping<V extends IntegerVector>(a: V, b: V): V;
+  export function subWrapping<V extends IntegerVector>(a: V, b: V): V;
+  export function mulWrapping<V extends IntegerVector>(a: V, b: V): V;
+  /** Negation and absolute value of float lanes: the sign bit. */
+  export function neg<V extends FloatVector>(a: V): V;
+  export function abs<V extends FloatVector>(a: V): V;
+  /** The lesser and the greater lane: a float NaN lane answers NaN. */
+  export function min<V extends SimdVector>(a: V, b: V): V;
+  export function max<V extends SimdVector>(a: V, b: V): V;
+  /** Bitwise, on integer lanes or lane by lane on two masks. */
+  export function and<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+  export function or<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+  export function xor<V extends IntegerVector | SimdMask>(a: V, b: V): V;
+  export function not<V extends IntegerVector | SimdMask>(a: V): V;
+  /** Lane-wise compares, answering the vector's mask. A float compare is ordered (`ne` unordered). */
+  export function eq<V extends SimdVector>(a: V, b: V): V["__mask"];
+  export function ne<V extends SimdVector>(a: V, b: V): V["__mask"];
+  export function lt<V extends SimdVector>(a: V, b: V): V["__mask"];
+  export function le<V extends SimdVector>(a: V, b: V): V["__mask"];
+  export function gt<V extends SimdVector>(a: V, b: V): V["__mask"];
+  export function ge<V extends SimdVector>(a: V, b: V): V["__mask"];
+  /** Lane `k` of `a` where lane `k` of `m` is set, else of `b`. */
+  export function select<V extends SimdVector>(m: V["__mask"], a: V, b: V): V;
+  /** Whether any lane, or every lane, is set. */
+  export function any(m: SimdMask): boolean;
+  export function all(m: SimdMask): boolean;
+  /** Lane `k`'s flag in bit `k`. */
+  export function bitmask(m: SimdMask): i32;
+  /**
+   * The lanes added: a `u8x16` or `u16x8` in an `i32`, a float vector in lane
+   * order. An `i32x4` or `u32x4` total is `sumWrapping`.
+   */
+  export function sum(v: u8x16 | u16x8): i32;
+  export function sum(v: f32x4): f32;
+  export function sum(v: f64x2): f64;
+  export function sumWrapping(v: i32x4): i32;
+  export function sumWrapping(v: u32x4): u32;
+  /** Lanes picked from `a` then `b` by integer-literal indices, one per lane. */
+  export function shuffle<V extends SimdVector>(a: V, b: V, ...lanes: i32[]): V;
+  /**
+   * Shifts and rotates by an integer-literal count below the lane width:
+   * `shr` is logical on an unsigned lane and arithmetic on an `i32` lane.
+   */
+  export function shl<V extends IntegerVector>(v: V, count: i32): V;
+  export function shr<V extends IntegerVector>(v: V, count: i32): V;
+  export function rotl<V extends IntegerVector>(v: V, count: i32): V;
+  export function rotr<V extends IntegerVector>(v: V, count: i32): V;
+  /** The same sixteen bytes read as another vector type. */
+  export function asU8x16(v: SimdVector): u8x16;
+  export function asU16x8(v: SimdVector): u16x8;
+  export function asI32x4(v: SimdVector): i32x4;
+  export function asU32x4(v: SimdVector): u32x4;
+  export function asF32x4(v: SimdVector): f32x4;
+  export function asF64x2(v: SimdVector): f64x2;
 }
 
 declare module "nish:io" {

package/runtime/nish.h

@@ -10,15 +10,16 @@
  * clock, `nish_platform` / `nish_arch` — and runtime-parallel.c, runtime-host.c,
  * runtime-net.c, runtime-simd.c (the byte searches that read a vector at a
  * time), runtime-aes.c (AES-GCM on the CPU's AES instructions),
- * runtime-sha256.c (SHA-256 on the CPU's SHA instructions), runtime-checksum.c
+ * runtime-sha256.c (SHA-256 on the CPU's SHA instructions), runtime-chacha20.c
+ * (ChaCha20's keystream on AVX2 or NEON vectors), runtime-checksum.c
  * (CRC-32 on its carry-less multiply or CRC instructions) and runtime-term.c
  * (stdin and the terminal, `nish:term`) split off
  * the same way since. They are separate so that each carries its own measured
  * code-size ceiling (docs/wp7-runtime.md, "Runtime additions and budget"); a
  * host links all of them, which `scripts/build.sh` does for you when handed
- * runtime.c, runtime-aes.c, runtime-sha256.c and runtime-checksum.c included: the
- * compiler calls their kernels from std/crypto/aes.ts, std/crypto/sha256.ts and
- * std/compress/checksum.ts, so `scripts/build.sh` pairs each of them with
+ * runtime.c, runtime-aes.c, runtime-sha256.c, runtime-chacha20.c and runtime-checksum.c
+ * included: the compiler calls their kernels from std/crypto/aes.ts,
+ * std/crypto/sha256.ts, std/crypto/chacha20poly1305.ts and std/compress/checksum.ts, so `scripts/build.sh` pairs each of them with
  * runtime.c and `src/run-cache.ts` caches them like the others. `tests/run.js` checks that every runtime function
  * declared in runtime.ts has a prototype in this file.
  *
@@ -400,6 +401,28 @@ int32_t nish_sha256_hw(void);
    guard, so the caller's fallback panics as the Nish function does. `w` (u32[],
    the message schedule the Nish code fills) is neither read nor written. */
 int32_t nish_sha256_compress(nish_array *h, const nish_array *w, const nish_array *src, int32_t at);
+/* ---- ChaCha20 on vectors ----------------------------------------------------
+ * runtime/runtime-chacha20.c: eight blocks at once on AVX2 and four in 128-bit
+ * vectors on x86-64, four in NEON on AArch64. The compiler calls the kernel in
+ * place of std/crypto/chacha20poly1305.ts's private `chacha20XorInto`, behind
+ * `nish_chacha20_hw`, and calls the Nish function itself when either answers 0.
+ * Constant time in the key, the nonce and the data. */
+/* 1 when this process runs the kernel, 0 when it runs the Nish code. Resolved
+   on the first call and fixed from then on: `NISH_CHACHA20=soft` pins 0; unset,
+   `hw` or any other value is the best this machine has: CPUID's AVX2 with the
+   OS saving the YMM registers (XGETBV) on x86-64, NEON on AArch64. Always 0 on
+   other targets, wasm32 among them. */
+int32_t nish_chacha20_hw(void);
+/* RFC 8439 §2.4's encryption of src[srcAt..srcAt + len) (u8[]) into
+   dst[dstAt..dstAt + len) (u8[]) under the ChaCha20 state state[0..16) (u32[]),
+   whose block counter state[12] advances one per 64-byte block, as
+   `chacha20XorInto` does; 1 when it ran. Answers 0 and writes nothing when
+   state.len < 16, len < 256, an offset is negative, a window is outside its
+   array, or the windows overlap without being the same bytes, so the Nish
+   function runs as it would have. The keystream it makes is wiped before it
+   returns; the state is the caller's. */
+int32_t nish_chacha20_xor(nish_array *state, const nish_array *src, int32_t src_at, int32_t len, nish_array *dst,
+                          int32_t dst_at);
 /* ---- CRC-32 on the CPU's carry-less multiply or CRC instructions ---------
  * runtime/runtime-checksum.c: PCLMULQDQ folding on x86-64, the ARMv8 CRC32
  * instructions on AArch64. The compiler calls the kernel in

package/runtime/runtime-chacha20.c

@@ -0,0 +1,366 @@
+/* Nish runtime, the ChaCha20 half: the keystream of RFC 8439 §2.3 and §2.4,
+ * several blocks at once in vector registers. std/crypto/chacha20poly1305.ts
+ * is the cipher and the AEAD; this is a faster body for its private
+ * `chacha20XorInto`, which the compiler calls in that function's place when
+ * `nish_chacha20_hw` says this machine runs it (src/kernels.ts). Poly1305
+ * stays in Nish: WP38 S10 timed it beside this kernel and found the Nish
+ * code within the noise of a C copy (docs/wp38-simd.md §3.1).
+ *
+ * A translation unit of its own for the reason runtime-aes.c is one: its own
+ * measured `.text*` ceiling in tests/runtime-budgets.js, and a program that
+ * never encrypts with ChaCha20 links none of it (section GC).
+ *
+ * The paths. x86-64 runs eight blocks at once in AVX2's 256-bit registers,
+ * then four in 128-bit ones, then one at a time for what is left, all
+ * compiled with `target("avx2")` alone so the binary stays a baseline binary.
+ * A block is a lane: word `i` of block `b` is lane `b` of vector `i`, so the
+ * rounds are the scalar quarter rounds on vectors, and nothing shuffles
+ * until the words are written out. AArch64 has the same four-block loop in
+ * NEON, which every AArch64 CPU has; `NISH_CHACHA20_ARM_ON` says whether the
+ * resolver takes it (see there). A CPU without AVX2, a process with
+ * `NISH_CHACHA20=soft`, and every other target, wasm32 included, run the Nish
+ * code: the compiler keeps it and branches on `nish_chacha20_hw` at each call,
+ * and here the resolver answers 0 and the kernel is a trap nothing reaches.
+ *
+ * The kernel takes a buffer of four blocks or more and answers 0 for anything
+ * shorter, so a short message (a TLS record header, the Poly1305 key's one
+ * block, a QUIC header mask) costs no call and no wipe: S10 measured the
+ * kernel losing at 64 bytes until it did. It answers 0 too, touching
+ * nothing, when a window is outside its array or the two windows overlap
+ * without being the same bytes, so the Nish function runs and fails, or
+ * writes in its own order, as it would have.
+ *
+ * Constant time: ChaCha20 is additions, xors and rotations by constants, with
+ * no table and no secret-dependent branch. The kernel's branches are on array
+ * headers, offsets and the length, which are public, and its loads and stores
+ * are at addresses fixed by them. tests/ct-asm-runtime.js reads the
+ * `clang -O2` assembly of this file for both targets and holds the kernel to
+ * that. The one branch on anything else is `nish_chacha20_hw`'s, on the CPU's
+ * feature bits and `NISH_CHACHA20` (docs/security/ct-verification.md).
+ *
+ * Wiping: the working words, the per-call input block and the keystream
+ * buffers on the stack are zeroed by volatile stores before the kernel
+ * returns, the mechanism runtime-aes.c and `nish:secret`'s wipe use. The
+ * caller's state is the caller's to wipe, as with the Nish function. What
+ * the vector registers hold, and what the register allocator spills, no
+ * store from C can reach (docs/security/crypto-chacha20-hw.md).
+ *
+ * Written from RFC 8439 in this file's own structure; the block-a-lane layout
+ * is the one §3 of the RFC points at ("SIMD"), and nothing is ported.
+ */
+#include <stddef.h>
+#include <stdint.h>
+
+#include "nish.h"
+
+#if defined(__x86_64__)
+#include <cpuid.h>
+#define NISH_CHACHA20_X86 1
+#elif defined(__aarch64__) && defined(__ARM_NEON) && defined(__ORDER_LITTLE_ENDIAN__) && \
+    __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#include <arm_neon.h>
+#define NISH_CHACHA20_ARM 1
+#endif
+
+#if defined(NISH_CHACHA20_X86) || defined(NISH_CHACHA20_ARM)
+
+/* Named here rather than through <stdlib.h>, for runtime-aes.c's reason: the
+   constant-time check compiles this file for targets whose libc headers the
+   host does not have. */
+char *getenv(const char *name);
+
+#if defined(__has_attribute) && __has_attribute(no_builtin)
+#define NISH_CHACHA20_NO_LIBC no_builtin
+#else
+#define NISH_CHACHA20_NO_LIBC
+#endif
+#if defined(NISH_CHACHA20_X86)
+#define NISH_CHACHA20_TARGET __attribute__((target("avx2"), NISH_CHACHA20_NO_LIBC))
+#else
+#define NISH_CHACHA20_TARGET __attribute__((NISH_CHACHA20_NO_LIBC))
+#endif
+#define NISH_CHACHA20_INLINE static inline __attribute__((always_inline)) NISH_CHACHA20_TARGET
+
+/* The buffer a vector loop needs before it runs: four blocks. */
+#define NISH_CHACHA20_MIN 256
+
+/* Zeroes `n` bytes, a multiple of 8, by volatile 8-byte stores. */
+NISH_CHACHA20_INLINE void nish_chacha20_wipe(void *p, size_t n) {
+  volatile uint64_t *v = (volatile uint64_t *)p;
+  for (size_t i = 0; i < n / 8; i++) v[i] = 0;
+}
+
+NISH_CHACHA20_INLINE uint32_t nish_chacha20_rotl(uint32_t x, int n) {
+  return (x << n) | (x >> (32 - n));
+}
+
+#define NISH_CHACHA20_QR(a, b, c, d)    \
+  a += b;                               \
+  d = nish_chacha20_rotl(d ^ a, 16);    \
+  c += d;                               \
+  b = nish_chacha20_rotl(b ^ c, 12);    \
+  a += b;                               \
+  d = nish_chacha20_rotl(d ^ a, 8);     \
+  c += d;                               \
+  b = nish_chacha20_rotl(b ^ c, 7)
+
+/* What is left after the vector loops, a block at a time as the Nish loop
+   does: `len` bytes under the keystream from `s`'s counter on, the counter
+   moved one a block, the last partial block taken byte by byte. */
+NISH_CHACHA20_INLINE void nish_chacha20_tail(uint32_t s[16], const uint8_t *src, uint8_t *dst, size_t len) {
+  uint32_t x[16];
+  /* The block's words, which on these little-endian targets are its
+     keystream bytes in order: adding into words, not storing byte by byte,
+     keeps every store at a fixed offset of the frame. */
+  uint32_t ks[16];
+  const uint8_t *ks_bytes = (const uint8_t *)ks;
+  int ran = len > 0;
+  while (len > 0) {
+    for (int i = 0; i < 16; i++) x[i] = s[i];
+    for (int r = 0; r < 10; r++) {
+      NISH_CHACHA20_QR(x[0], x[4], x[8], x[12]);
+      NISH_CHACHA20_QR(x[1], x[5], x[9], x[13]);
+      NISH_CHACHA20_QR(x[2], x[6], x[10], x[14]);
+      NISH_CHACHA20_QR(x[3], x[7], x[11], x[15]);
+      NISH_CHACHA20_QR(x[0], x[5], x[10], x[15]);
+      NISH_CHACHA20_QR(x[1], x[6], x[11], x[12]);
+      NISH_CHACHA20_QR(x[2], x[7], x[8], x[13]);
+      NISH_CHACHA20_QR(x[3], x[4], x[9], x[14]);
+    }
+    for (int i = 0; i < 16; i++) ks[i] = x[i] + s[i];
+    s[12] += 1;
+    size_t take = len < 64 ? len : 64;
+    for (size_t i = 0; i < take; i++) dst[i] = src[i] ^ ks_bytes[i];
+    src += take;
+    dst += take;
+    len -= take;
+  }
+  if (ran) {
+    nish_chacha20_wipe(x, sizeof x);
+    nish_chacha20_wipe(ks, sizeof ks);
+  }
+}
+
+#if defined(NISH_CHACHA20_X86)
+
+typedef uint32_t nish_u32x4 __attribute__((vector_size(16)));
+typedef uint32_t nish_u32x8 __attribute__((vector_size(32)));
+
+/* The rotate lane by lane; LLVM turns 16 and 8 into byte shuffles. */
+#define NISH_CHACHA20_VROTL(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
+
+#define NISH_CHACHA20_VQR(a, b, c, d)        \
+  a += b;                                    \
+  d = NISH_CHACHA20_VROTL(d ^ a, 16);        \
+  c += d;                                    \
+  b = NISH_CHACHA20_VROTL(b ^ c, 12);        \
+  a += b;                                    \
+  d = NISH_CHACHA20_VROTL(d ^ a, 8);         \
+  c += d;                                    \
+  b = NISH_CHACHA20_VROTL(b ^ c, 7)
+
+#define NISH_CHACHA20_VROUNDS(x)                       \
+  for (int r = 0; r < 10; r++) {                       \
+    NISH_CHACHA20_VQR(x[0], x[4], x[8], x[12]);        \
+    NISH_CHACHA20_VQR(x[1], x[5], x[9], x[13]);        \
+    NISH_CHACHA20_VQR(x[2], x[6], x[10], x[14]);       \
+    NISH_CHACHA20_VQR(x[3], x[7], x[11], x[15]);       \
+    NISH_CHACHA20_VQR(x[0], x[5], x[10], x[15]);       \
+    NISH_CHACHA20_VQR(x[1], x[6], x[11], x[12]);       \
+    NISH_CHACHA20_VQR(x[2], x[7], x[8], x[13]);        \
+    NISH_CHACHA20_VQR(x[3], x[4], x[9], x[14]);        \
+  }
+
+/* `lanes` blocks at once, `vec` lanes of `lanes` words: the input block with
+   the counter stepped one a lane, the rounds, then the sum written out word
+   by word (lane `b` of word `i` to byte 64b + 4i of the keystream) and
+   xored into `dst` a vector at a time. Answers the bytes it covered. */
+#define NISH_CHACHA20_LOOP(vec, lanes, s, src, dst, len, ...)                             \
+  {                                                                                       \
+    vec x[16];                                                                            \
+    vec in[16];                                                                           \
+    uint8_t ks[64 * (lanes)] __attribute__((aligned(32)));                                \
+    const vec step = {__VA_ARGS__};                                                       \
+    int ran = (len) >= 64 * (lanes);                                                      \
+    while ((len) >= 64 * (lanes)) {                                                       \
+      for (int i = 0; i < 16; i++) in[i] = (vec){0} + (s)[i];                             \
+      in[12] += step;                                                                     \
+      for (int i = 0; i < 16; i++) x[i] = in[i];                                          \
+      NISH_CHACHA20_VROUNDS(x)                                                            \
+      for (int i = 0; i < 16; i++) {                                                      \
+        vec w = x[i] + in[i];                                                             \
+        for (int b = 0; b < (lanes); b++) __builtin_memcpy(ks + 64 * b + 4 * i, (const uint8_t *)&w + 4 * b, 4); \
+      }                                                                                   \
+      for (size_t i = 0; i < 64 * (lanes); i += sizeof(vec)) {                            \
+        vec p, k;                                                                         \
+        __builtin_memcpy(&p, (src) + i, sizeof p);                                        \
+        __builtin_memcpy(&k, ks + i, sizeof k);                                           \
+        p ^= k;                                                                           \
+        __builtin_memcpy((dst) + i, &p, sizeof p);                                        \
+      }                                                                                   \
+      (s)[12] += (lanes);                                                                 \
+      (src) += 64 * (lanes);                                                              \
+      (dst) += 64 * (lanes);                                                              \
+      (len) -= 64 * (lanes);                                                              \
+    }                                                                                     \
+    if (ran) {                                                                            \
+      nish_chacha20_wipe(x, sizeof x);                                                    \
+      nish_chacha20_wipe(in, sizeof in);                                                  \
+      nish_chacha20_wipe(ks, sizeof ks);                                                  \
+    }                                                                                     \
+  }
+
+NISH_CHACHA20_INLINE void nish_chacha20_blocks(uint32_t s[16], const uint8_t *src, uint8_t *dst, size_t len) {
+  NISH_CHACHA20_LOOP(nish_u32x8, 8, s, src, dst, len, 0, 1, 2, 3, 4, 5, 6, 7)
+  NISH_CHACHA20_LOOP(nish_u32x4, 4, s, src, dst, len, 0, 1, 2, 3)
+  nish_chacha20_tail(s, src, dst, len);
+}
+
+#else
+
+#define NISH_CHACHA20_NROTL(x, n) vsriq_n_u32(vshlq_n_u32((x), (n)), (x), 32 - (n))
+#define NISH_CHACHA20_NROT16(x) vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(x)))
+#define NISH_CHACHA20_NQR(a, b, c, d)            \
+  a = vaddq_u32(a, b);                           \
+  d = NISH_CHACHA20_NROT16(veorq_u32(d, a));     \
+  c = vaddq_u32(c, d);                           \
+  b = NISH_CHACHA20_NROTL(veorq_u32(b, c), 12);  \
+  a = vaddq_u32(a, b);                           \
+  d = NISH_CHACHA20_NROTL(veorq_u32(d, a), 8);   \
+  c = vaddq_u32(c, d);                           \
+  b = NISH_CHACHA20_NROTL(veorq_u32(b, c), 7)
+
+/* Four blocks at once in NEON, a block a lane; `vst4q` interleaves four
+   words so each 16-byte row it stores is one row of one block. */
+NISH_CHACHA20_INLINE void nish_chacha20_blocks(uint32_t s[16], const uint8_t *src, uint8_t *dst, size_t len) {
+  uint32x4_t x[16];
+  uint32x4_t in[16];
+  uint32_t rows[16] __attribute__((aligned(16)));
+  uint8_t ks[256] __attribute__((aligned(16)));
+  const uint32_t step_words[4] = {0, 1, 2, 3};
+  const uint32x4_t step = vld1q_u32(step_words);
+  int ran = len >= 256;
+  while (len >= 256) {
+    for (int i = 0; i < 16; i++) in[i] = vdupq_n_u32(s[i]);
+    in[12] = vaddq_u32(in[12], step);
+    for (int i = 0; i < 16; i++) x[i] = in[i];
+    for (int r = 0; r < 10; r++) {
+      NISH_CHACHA20_NQR(x[0], x[4], x[8], x[12]);
+      NISH_CHACHA20_NQR(x[1], x[5], x[9], x[13]);
+      NISH_CHACHA20_NQR(x[2], x[6], x[10], x[14]);
+      NISH_CHACHA20_NQR(x[3], x[7], x[11], x[15]);
+      NISH_CHACHA20_NQR(x[0], x[5], x[10], x[15]);
+      NISH_CHACHA20_NQR(x[1], x[6], x[11], x[12]);
+      NISH_CHACHA20_NQR(x[2], x[7], x[8], x[13]);
+      NISH_CHACHA20_NQR(x[3], x[4], x[9], x[14]);
+    }
+    for (int i = 0; i < 16; i += 4) {
+      uint32x4x4_t w;
+      w.val[0] = vaddq_u32(x[i], in[i]);
+      w.val[1] = vaddq_u32(x[i + 1], in[i + 1]);
+      w.val[2] = vaddq_u32(x[i + 2], in[i + 2]);
+      w.val[3] = vaddq_u32(x[i + 3], in[i + 3]);
+      vst4q_u32(rows, w);
+      for (int b = 0; b < 4; b++) __builtin_memcpy(ks + 64 * b + 4 * i, rows + 4 * b, 16);
+    }
+    for (size_t i = 0; i < 256; i += 16) vst1q_u8(dst + i, veorq_u8(vld1q_u8(src + i), vld1q_u8(ks + i)));
+    s[12] += 4;
+    src += 256;
+    dst += 256;
+    len -= 256;
+  }
+  if (ran) {
+    nish_chacha20_wipe(x, sizeof x);
+    nish_chacha20_wipe(in, sizeof in);
+    nish_chacha20_wipe(rows, sizeof rows);
+    nish_chacha20_wipe(ks, sizeof ks);
+  }
+  nish_chacha20_tail(s, src, dst, len);
+}
+
+#endif
+
+/* `chacha20XorInto`'s contract, checked rather than trusted: 1 when it ran,
+   0, writing nothing, unless `state` has its sixteen words, `len` is four
+   blocks or more, both windows are inside their arrays and end before
+   INT32_MAX - 64, and the windows are the same bytes or do not overlap.
+   The Nish function reads and writes byte
+   by byte in order, so an in-place call (the AEAD's and `chacha20Block`'s)
+   agrees with a kernel that loads a vector before it stores it; a shifted
+   overlap would not, and is left to the Nish function. */
+NISH_CHACHA20_TARGET int32_t nish_chacha20_xor(nish_array *state, const nish_array *src, int32_t src_at,
+                                               int32_t len, nish_array *dst, int32_t dst_at) {
+  if (state->len < 16 || len < NISH_CHACHA20_MIN || src_at < 0 || dst_at < 0) return 0;
+  if ((uint64_t)src_at + (uint64_t)len > src->len || (uint64_t)dst_at + (uint64_t)len > dst->len) return 0;
+  /* The Nish function's i32 sums reach a window's end and its last block's
+     end, so past INT32_MAX - 64 it panics on an overflow; past that the
+     kernel refuses, and the Nish function panics as it would have. */
+  if ((uint64_t)src_at + (uint64_t)len > INT32_MAX - 64 || (uint64_t)dst_at + (uint64_t)len > INT32_MAX - 64) return 0;
+  const uint8_t *from = (const uint8_t *)src->data + src_at;
+  uint8_t *to = (uint8_t *)dst->data + dst_at;
+  uintptr_t f = (uintptr_t)from, t = (uintptr_t)to;
+  if (f != t && f < t + (uintptr_t)len && t < f + (uintptr_t)len) return 0;
+  nish_chacha20_blocks((uint32_t *)(void *)state->data, from, to, (size_t)len);
+  return 1;
+}
+
+#if defined(NISH_CHACHA20_X86)
+/* Whether this CPU and its OS give AVX2: CPUID leaf 1's OSXSAVE and AVX,
+   XCR0's SSE and AVX state, and leaf 7's AVX2. Asked through `cpuid.h`, for
+   runtime-aes.c's reason. */
+static int32_t nish_chacha20_cpu(void) {
+  unsigned a, b, c, d;
+  if (!__get_cpuid(1, &a, &b, &c, &d)) return 0;
+  if ((c & bit_OSXSAVE) == 0 || (c & bit_AVX) == 0) return 0;
+  unsigned lo, hi;
+  __asm__("xgetbv" : "=a"(lo), "=d"(hi) : "c"(0));
+  (void)hi;
+  if ((lo & 6) != 6) return 0;
+  if (!__get_cpuid_count(7, 0, &a, &b, &c, &d)) return 0;
+  return (b & bit_AVX2) != 0;
+}
+#else
+/* NEON is in every AArch64 CPU, so the question is only whether the kernel
+   pays here: `NISH_CHACHA20_ARM_ON` is S10's AArch64 verdict
+   (docs/wp38-simd.md §3.1). */
+#ifndef NISH_CHACHA20_ARM_ON
+#define NISH_CHACHA20_ARM_ON 1
+#endif
+static int32_t nish_chacha20_cpu(void) {
+  return NISH_CHACHA20_ARM_ON;
+}
+#endif
+
+/* The answer: 0 until the first call, then 1 for the kernel or 2 for the Nish
+   path, with runtime-aes.c's relaxed atomics for the same reason. */
+static int32_t nish_chacha20_answer;
+
+int32_t nish_chacha20_hw(void) {
+  int32_t answer = __atomic_load_n(&nish_chacha20_answer, __ATOMIC_RELAXED);
+  if (answer == 0) {
+    /* `soft` pins the Nish path and never asks the CPU; anything else, or
+       nothing, means the best this machine has. */
+    const char *pin = getenv("NISH_CHACHA20");
+    int soft = pin != 0 && pin[0] == 's' && pin[1] == 'o' && pin[2] == 'f' && pin[3] == 't' && pin[4] == 0;
+    answer = !soft && nish_chacha20_cpu() ? 1 : 2;
+    __atomic_store_n(&nish_chacha20_answer, answer, __ATOMIC_RELAXED);
+  }
+  return answer == 1;
+}
+
+#else
+
+/* A target with no vector path here, wasm32 among them: the Nish path
+   always, and a kernel that a program whose every call is behind
+   `nish_chacha20_hw` never reaches. */
+int32_t nish_chacha20_hw(void) {
+  return 0;
+}
+
+int32_t nish_chacha20_xor(nish_array *state, const nish_array *src, int32_t src_at, int32_t len, nish_array *dst,
+                          int32_t dst_at) {
+  (void)state, (void)src, (void)src_at, (void)len, (void)dst, (void)dst_at;
+  __builtin_trap();
+}
+
+#endif

package/scripts/build.sh

@@ -3,7 +3,7 @@
 #
 #   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm|wasi|napi]
 #
-# The C runtime is fifteen translation units and is named as one: an input
+# The C runtime is sixteen translation units and is named as one: an input
 # <dir>/runtime.c also compiles <dir>/runtime-os.c, the half that wraps the
 # system calls (files, directories, subprocesses, the environment, the clock),
 # <dir>/runtime-parallel.c, the half that divides a range of work across
@@ -14,6 +14,7 @@
 # the SSE4.1 rounding of `Math.floor` and its kin,
 # <dir>/runtime-aes.c, AES-GCM on the CPU's AES instructions,
 # <dir>/runtime-sha256.c, SHA-256 on the CPU's SHA instructions,
+# <dir>/runtime-chacha20.c, ChaCha20's keystream on AVX2 or NEON vectors,
 # <dir>/runtime-checksum.c, CRC-32 on its carry-less multiply or CRC instructions,
 # <dir>/runtime-term.c, stdin and the terminal of `nish:term`,
 # <dir>/runtime-bytes.c, the byte-class runs of `nish/bytes`,
@@ -223,14 +224,14 @@ if [ -n "$sqlite_to" ] || [ -n "$sqlite_from" ]; then
 fi
 [ -n "$out" ] || [ -n "$objects_to" ] || [ -n "$sqlite_to" ] || { echo "error: -o <out> is required" >&2; exit 2; }
 
-# The runtime is fifteen translation units, and a caller names one: whoever passes
+# The runtime is sixteen translation units, and a caller names one: whoever passes
 # <dir>/runtime.c gets <dir>/runtime-os.c, <dir>/runtime-parallel.c,
 # <dir>/runtime-cross.c, <dir>/runtime-host.c, <dir>/runtime-net.c, <dir>/runtime-simd.c,
-# <dir>/runtime-aes.c, <dir>/runtime-sha256.c, <dir>/runtime-checksum.c, <dir>/runtime-term.c,
+# <dir>/runtime-aes.c, <dir>/runtime-sha256.c, <dir>/runtime-chacha20.c, <dir>/runtime-checksum.c, <dir>/runtime-term.c,
 # <dir>/runtime-bytes.c, <dir>/runtime-sandbox.c, <dir>/runtime-shm.c and <dir>/runtime-region.c compiled beside it, on every profile,
 # wasi included: runtime-simd.c and runtime-bytes.c take their scalar paths there
 # unless the build adds -msimd128,
-# runtime-aes.c, runtime-sha256.c and runtime-checksum.c compile to an answer of 0 and
+# runtime-aes.c, runtime-sha256.c, runtime-chacha20.c and runtime-checksum.c compile to an answer of 0 and
 # stubs that nothing calls, because the compiler emits no call to their kernels for wasm32, and
 # runtime-term.c reads stdin and answers "not a terminal", and runtime-sandbox.c
 # compiles to two functions that refuse to run, which no wasm build calls, and
@@ -244,7 +245,7 @@ fi
 # here keeps every one of those correct, and keeps "the runtime" one thing to
 # name from the outside. A caller that names one itself is left alone, because
 # naming one object twice is a duplicate-symbol error.
-halves="runtime-os.c runtime-parallel.c runtime-cross.c runtime-host.c runtime-net.c runtime-simd.c runtime-aes.c runtime-sha256.c runtime-checksum.c runtime-term.c runtime-bytes.c runtime-sandbox.c runtime-shm.c runtime-region.c"
+halves="runtime-os.c runtime-parallel.c runtime-cross.c runtime-host.c runtime-net.c runtime-simd.c runtime-aes.c runtime-sha256.c runtime-chacha20.c runtime-checksum.c runtime-term.c runtime-bytes.c runtime-sandbox.c runtime-shm.c runtime-region.c"
 for i in ${inputs[@]+"${inputs[@]}"}; do
   case "$i" in
     */runtime.c|runtime.c)
@@ -693,14 +694,16 @@ case "$profile" in
     fi
     # IR compiled for the host rather than with `--target wasm32` calls std/crypto/aes.ts's
     # AES kernels behind `nish_aes_hw`, std/crypto/sha256.ts's block function behind
-    # `nish_sha256_hw` and std/compress/checksum.ts's CRC-32 kernel behind
-    # `nish_crc32_hw` (src/kernels.ts). runtime-aes.c's, runtime-sha256.c's and
-    # runtime-checksum.c's wasm32 builds answer 0 there, so the Nish code runs, and
+    # `nish_sha256_hw`, std/crypto/chacha20poly1305.ts's keystream loop behind
+    # `nish_chacha20_hw` and std/compress/checksum.ts's CRC-32 kernel behind
+    # `nish_crc32_hw` (src/kernels.ts). runtime-aes.c's, runtime-sha256.c's,
+    # runtime-chacha20.c's and runtime-checksum.c's wasm32 builds answer 0 there,
+    # so the Nish code runs, and
     # each is added only for such IR: every other module links the bytes it always did.
     # Each pair is a unit and the kernel its probe names.
     # A caller that names the unit itself is left alone, as `halves` leaves it:
     # one object named twice is a duplicate-symbol error.
-    for pair in aes:aes sha256:sha256 checksum:crc32; do
+    for pair in aes:aes sha256:sha256 chacha20:chacha20 checksum:crc32; do
       unit=${pair%%:*}
       kernel=${pair#*:}
       named=0

package/std/README.md

@@ -101,7 +101,7 @@ is listed in [`SECURITY.md`](../SECURITY.md#threat-model).
 | [`crypto/sha1.ts`](./crypto/sha1.ts) | `sha1(data)`, a fresh 20-byte digest, and `SHA1_SIZE` and `SHA1_BLOCK`. **Not for security**: SHA-1 is broken for collisions, and it is here only because RFC 6455 §4.2.2's `Sec-WebSocket-Accept` is defined on it (`nish/net/websocket` is its importer). One-shot only; it panics on an array longer than 2^31 − 1 bytes. It came after the #363 audit and has no record in `docs/security/` | FIPS 180-4 §6.1 |
 | [`crypto/x25519.ts`](./crypto/x25519.ts) | `x25519(scalar, u)`, the shared secret as a `Secret<u8[]>`, and `x25519Base(scalar)`, the public key, each from a `Secret<u8[]>` scalar, on ten 25.5-bit limbs in `i64`. Either answers `null` unless its arguments are `X25519_SIZE` (32) bytes; the scalar is clamped on a copy, which is wiped | RFC 7748 §5.2, §6.1, Wycheproof `x25519_test` |
 | [`crypto/ed25519.ts`](./crypto/ed25519.ts) | `ed25519PublicKey(seed)`, the 32-byte public key, `ed25519Sign(seed, msg)`, the 64-byte signature `R \|\| S`, each from a `Secret<u8[]>` seed of `ED25519_SEED_SIZE` (32) bytes or `null`, and `ed25519Verify(pub, msg, sig)`. Signing is deterministic and constant time; the seed's hash, the nonce and every intermediate the scalar reaches are wiped. Verify is cofactorless, refuses an S of L or more and a key that does not decode, and is variable time, since its inputs are public. Sign and verify panic on a message longer than 2^31 − 1 bytes. It reuses `crypto/x25519.ts`'s field arithmetic | RFC 8032 §5.1, §7.1 |
-| [`crypto/chacha20poly1305.ts`](./crypto/chacha20poly1305.ts) | `chacha20Poly1305Seal(key, nonce, aad, plaintext)`, which answers the ciphertext followed by the 16-byte tag, and `chacha20Poly1305Open`, which checks the whole tag before it decrypts anything and answers `null` for a message that does not authenticate. Beneath them `chacha20Block`, `chacha20`, `chacha20QuarterRound`, `poly1305` and `poly1305KeyGen`, and `chacha20HeaderMask`, QUIC's 5-byte header-protection mask. Every input of the wrong length answers `null`. What a call derives from the key — the ChaCha20 state, the keystream, the Poly1305 key, `r` and accumulator, and on open the tag it compared — is wiped with `wipe`'s volatile stores before the call returns, the refusal path included | RFC 8439 §2, RFC 9001 §5.4.4, Wycheproof `chacha20_poly1305` (all 325 cases) |
+| [`crypto/chacha20poly1305.ts`](./crypto/chacha20poly1305.ts) | `chacha20Poly1305Seal(key, nonce, aad, plaintext)`, which answers the ciphertext followed by the 16-byte tag, and `chacha20Poly1305Open`, which checks the whole tag before it decrypts anything and answers `null` for a message that does not authenticate. Beneath them `chacha20Block`, `chacha20`, `chacha20QuarterRound`, `poly1305` and `poly1305KeyGen`, and `chacha20HeaderMask`, QUIC's 5-byte header-protection mask. Every input of the wrong length answers `null`. What a call derives from the key — the ChaCha20 state, the keystream, the Poly1305 key, `r` and accumulator, and on open the tag it compared — is wiped with `wipe`'s volatile stores before the call returns, the refusal path included. Natively, on x86-64 with AVX2 or on AArch64, the compiler sends the keystream of a message of 256 bytes or more to the runtime's kernel instead (`runtime/runtime-chacha20.c`, WP38 S10), and `NISH_CHACHA20=soft` pins the Nish code | RFC 8439 §2, RFC 9001 §5.4.4, Wycheproof `chacha20_poly1305` (all 325 cases) |
 | [`crypto/aes.ts`](./crypto/aes.ts) | AES-128 and AES-256, bitsliced four blocks at a time with the Boyar–Peralta S-box circuit, so no table is read; natively, on a CPU with AES-NI and PCLMULQDQ or the ARMv8 AES and PMULL instructions, the compiler sends the key schedule, the block, GCTR and GHASH to the runtime's kernels instead (`runtime/runtime-aes.c`, WP38 S5), and `NISH_AES=soft` pins the bitsliced code: `aesKey(key)` expands a 16- or 32-byte key into an `AesKey` (or `aesKeyInto(key, out)` into one the caller holds, allocating nothing that outlives the call), then `aesEncryptBlock`, `aesGcmSeal` / `aesGcmOpen` (tag last, checked in full before anything is decrypted; any non-empty IV) and `aesHeaderMask`. AES-192 is out of scope, and a wrong length answers `null`, as does an `AesKey` not made by `aesKey`; one whose H is zero opens nothing. An `AesKey` holds its round keys in `roundKeys` and H in `h`, two `u64` words (high, low); `aesKeyWipe(key)` zeroes both with `wipe`'s volatile stores, the kernels' powers of H after the schedule included, and is how a holder drops a key. The bitsliced schedule's, block's and GCTR's working copies, the tag's E(K, J0) block, the tag open compared and J0 itself are wiped the same way before they are released | FIPS 197, SP 800-38D, RFC 9001 §5.4.3, Wycheproof `aes_gcm` (all 316 cases; the 103 AES-192 ones check that the key is refused) |
 | [`crypto/p256.ts`](./crypto/p256.ts) | ECDSA over P-256 with RFC 6979's deterministic nonces: `p256PublicKey(priv)` (65-byte uncompressed SEC1) from a `Secret<u8[]>` private key, `p256Sign` / `p256Verify` over a digest and `p256SignSha256` / `p256VerifySha256` over a message, and `p256SignSha256Into(scratch, priv, msg, off, len, out, at)`, the same signature written into the caller's window in a `P256SignScratch` made once, keeping nothing in the arena; a signature is `r` and `s`, 32 big-endian bytes each, not DER (`crypto/x509.ts`'s `x509DerSignatureRS` converts one). A malformed key, a point off the curve or an `r` or `s` out of range answers `null` or `false`, never a panic. ECDSA is malleable, and `p256Verify` accepts a high `s`: when `(r, s)` verifies, so does `(r, n − s)` | RFC 6979 A.2.5, Wycheproof `ecdsa_secp256r1_sha256`, `_sha256_p1363`, `_sha512` and `_sha512_p1363` |
 | [`crypto/p384.ts`](./crypto/p384.ts) | ECDSA verification over P-384: `p384Verify(pub, digest, sig)` over a digest from any hash (one longer than 48 bytes is truncated to its leftmost 384 bits) and `p384VerifySha384(pub, msg, sig)` over a message; the key is 97-byte uncompressed SEC1 and the signature `r` and `s`, 48 big-endian bytes each, not DER. It only verifies, so it holds no `Secret`. A malformed key, a point off the curve, an `r` or `s` out of range and a sum at the identity answer `false`, never a panic. ECDSA is malleable, and `p384Verify` accepts a high `s` | RFC 6979 A.2.6, Wycheproof `ecdsa_secp384r1_sha384`, `_sha384_p1363`, `_sha256`, `_sha512` and `_sha512_p1363` |

package/std/net/http1-codec.ts

@@ -506,17 +506,19 @@ const http1StartRequest = (p: Http1Parser): void => {
 }
 
 /**
- * Whether any of the eight bytes of `x` is below 32 or is 127: a control
- * byte or DEL, which `http1TakeLine` stops at. Two of the bit tricks of
- * "Bit Twiddling Hacks" (S. E. Anderson, public domain): a byte below `n`
- * leaves its high bit set in `(x - n * ones) & ~x`, for `n` up to 128, and
- * `127` is the byte that is zero in `x ^ 127 * ones`. A byte from 128 up
- * has its high bit set in `x`, so `~x` clears it: obs-text never matches.
- * The answer is exact for the word, though not for which byte. Each
- * subtraction is masked to 64 bits because a `u64` is a BigInt under Node,
- * which does not wrap; natively the mask is a no-op.
+ * The bytes of `x` below 32 or equal to 127 — a control byte or DEL, which
+ * `http1TakeLine` stops at — as their high bits: zero when there is none,
+ * and else the lowest set bit is the first such byte's. Two of the bit
+ * tricks of "Bit Twiddling Hacks" (S. E. Anderson, public domain): a byte
+ * below `n` leaves its high bit set in `(x - n * ones) & ~x`, for `n` up to
+ * 128, and `127` is the byte that is zero in `x ^ 127 * ones`. A byte from
+ * 128 up has its high bit set in `x`, so `~x` clears it: obs-text never
+ * matches. A borrow only runs up from a byte that matched, so the bits above
+ * the first match may be false and the lowest is exact, in each mask and so
+ * in their union. Each subtraction is masked to 64 bits because a `u64` is a
+ * BigInt under Node, which does not wrap; natively the mask is a no-op.
  */
-const http1WordHasControl = (x: u64): boolean => {
+const http1ControlBits = (x: u64): u64 => {
   const ones32: u64 = toU64(16843009)
   const ones: u64 = (ones32 << toU64(32)) | ones32
   const low32: u64 = 0xffffffff
@@ -525,7 +527,18 @@ const http1WordHasControl = (x: u64): boolean => {
   const below: u64 = (x - ones * toU64(32)) & all & ~x & high
   const y: u64 = x ^ (ones * toU64(127))
   const del: u64 = (y - ones) & all & ~y & high
-  return (below | del) !== toU64(0)
+  return below | del
+}
+
+/** Which byte of a word `bits`'s lowest set bit is in, 0 to 7; `bits` is not zero. */
+const http1FirstByte = (bits: u64): i32 => {
+  const mask32: u64 = 0xffffffff
+  const lo: u32 = toU32(bits & mask32)
+  if (lo !== toU32(0)) {
+    return (toI32(31) - toI32(Math.clz32(lo & (toU32(0) - lo)))) >> toI32(3)
+  }
+  const hi: u32 = toU32(bits >> toU64(32))
+  return toI32(4) + ((toI32(31) - toI32(Math.clz32(hi & (toU32(0) - hi)))) >> toI32(3))
 }
 
 /**
@@ -585,22 +598,39 @@ const http1TakeLine = (p: Http1Parser, limit: i32, overStatus: i32): i32 => {
   }
   while (i < stop) {
     // Most bytes are printable: sixteen at a time while a whole vector is,
-    // then one at a time, with no test in either loop but the bytes' and the
-    // bound's.
-    while (i >= 0 && i <= stop - 16 && i <= toI32(buf.length) - 16) {
+    // and the vector that is not answers where its first control byte is.
+    // The bytes after a control byte, and a tail shorter than a vector, go
+    // one at a time.
+    let found: boolean = false
+    while (!found && i >= 0 && i <= stop - 16 && i <= toI32(buf.length) - 16) {
       const v: u8x16 = loadU8x16(buf, i)
-      if (http1WordHasControl(http1Lanes(v, 0)) || http1WordHasControl(http1Lanes(v, 8))) {
-        break
+      const low: u64 = http1ControlBits(http1Lanes(v, 0))
+      if (low !== toU64(0)) {
+        i += http1FirstByte(low)
+        found = true
+      } else {
+        const high: u64 = http1ControlBits(http1Lanes(v, 8))
+        if (high !== toU64(0)) {
+          i += 8 + http1FirstByte(high)
+          found = true
+        } else {
+          i += 16
+        }
       }
-      i += 16
     }
-    while (i >= 0 && i < stop && i < toI32(buf.length) && buf[i] >= 32 && buf[i] !== 127) {
+    while (!found && i >= 0 && i < stop && i < toI32(buf.length) && buf[i] >= 32 && buf[i] !== 127) {
       i += 1
     }
     if (i < 0 || i >= stop || i >= toI32(buf.length)) {
       break
     }
-    const c: i32 = toI32(buf[i])
+    let c: i32 = toI32(buf[i])
+    if (c === 13 && i + 1 < stop && i + 1 < toI32(buf.length) && buf[i + 1] === 10) {
+      // CRLF, the end of almost every line: its LF is the next byte, so it
+      // is taken here rather than by another trip through the scan.
+      i += 1
+      c = 10
+    }
     if (c === 10) {
       if (i === p.start || buf[i - 1] !== 13) {
         return http1Fail(p, 400, "a line ended in a bare LF")
@@ -636,9 +666,11 @@ const http1TakeLine = (p: Http1Parser, limit: i32, overStatus: i32): i32 => {
  * `c - 64` and `c - 96` of each: `!` `#`-`'` `*` `+` `-` `.` and the digits
  * in the first (0x03ff6cfa); the upper-case letters, `^` and `_` in the
  * second (0xc7fffffe); `` ` ``, the lower-case letters, `|` and `~` in the
- * third (0x57ffffff). No byte below 33 or above 126 is a tchar. One shift
- * and mask replaces a chain of fourteen comparisons on the parser's hottest
- * path (`bench/techempower`).
+ * third (0x57ffffff). No byte below 33 or above 126 is a tchar.
+ * `http1IsTokenByte` reads them as two 64-bit masks, one for the bytes 0 to
+ * 63 and one for 64 to 127, so the test is a select and a shift with no
+ * branch on the byte: a name or method scan is the parser's hottest loop
+ * after the line scan (`bench/http1-parse`).
  */
 const HTTP1_TCHAR_32: i32 = 67071226
 const HTTP1_TCHAR_64: i32 = -939524098
@@ -646,16 +678,10 @@ const HTTP1_TCHAR_96: i32 = 1476395007
 
 /** Whether `c` is a tchar of RFC 9110 §5.6.2, the bytes a token is made of. */
 export const http1IsTokenByte = (c: i32): boolean => {
-  if (c < 32 || c > 127) {
-    return false
-  }
-  let mask: i32 = HTTP1_TCHAR_96
-  if (c < 64) {
-    mask = HTTP1_TCHAR_32
-  } else if (c < 96) {
-    mask = HTTP1_TCHAR_64
-  }
-  return ((mask >> (c & 31)) & 1) !== 0
+  const low: u64 = toU64(toU32(HTTP1_TCHAR_32)) << toU64(32)
+  const high: u64 = (toU64(toU32(HTTP1_TCHAR_96)) << toU64(32)) | toU64(toU32(HTTP1_TCHAR_64))
+  const word: u64 = c < 64 ? low : high
+  return c >= 0 && c < 128 && ((word >> toU64(c & 63)) & toU64(1)) !== toU64(0)
 }
 
 /** Whether `c` may appear in a field value (RFC 9110 §5.5): HTAB, SP, VCHAR or obs-text. */
@@ -978,9 +1004,30 @@ const http1FieldLine = (p: Http1Parser, keep: boolean): i32 => {
   if (a >= 0 && a < b && (buf[a] === 32 || buf[a] === 9)) {
     return http1Fail(p, 400, "a field line that starts with whitespace (obs-fold)")
   }
+  // A kept line is copied into the head first, and its name is read there,
+  // each upper-case letter lowered as the scan passes it: one walk over the
+  // name, not a check of `buf` and then a second walk of the copy. The copy
+  // of a line refused below is never read, since a refusal ends the parse.
+  let at: i32 = 0
   let i: i32 = a
-  while (i >= 0 && i < b && i < toI32(buf.length) && http1IsTokenByte(toI32(buf[i]))) {
-    i += 1
+  if (keep) {
+    at = http1HeadAppend(p, a, b)
+    const head: u8[] = p.head
+    let k: i32 = at
+    const stop: i32 = at + (b - a)
+    while (k >= 0 && k < stop && k < toI32(head.length)) {
+      const c: i32 = toI32(head[k])
+      if (!http1IsTokenByte(c)) {
+        break
+      }
+      head[k] = toU8(c >= 65 && c <= 90 ? c + 32 : c)
+      k += 1
+    }
+    i = a + (k - at)
+  } else {
+    while (i >= 0 && i < b && i < toI32(buf.length) && http1IsTokenByte(toI32(buf[i]))) {
+      i += 1
+    }
   }
   if (i === a || i >= b || buf[i] !== 58) {
     return http1Fail(p, 400, "a malformed field name")
@@ -1005,13 +1052,6 @@ const http1FieldLine = (p: Http1Parser, keep: boolean): i32 => {
     while (valueEnd > valueStart && valueEnd - 1 >= 0 && http1IsOws(toI32(buf[valueEnd - 1]))) {
       valueEnd -= 1
     }
-    const at: i32 = http1HeadAppend(p, a, b)
-    const head: u8[] = p.head
-    for (let k: i32 = at; k < at + (nameEnd - a) && k < toI32(head.length); k += 1) {
-      if (k >= 0 && head[k] >= 65 && head[k] <= 90) {
-        head[k] = head[k] + 32
-      }
-    }
     const base: i32 = 4 * p.headerCount
     http1SpanSet(p, base + 3, at + (valueEnd - a))
     // The last of the four is set first, so the array has room for them all.

package/std/net/http1-server.ts

@@ -525,28 +525,19 @@ export class Http1OutputPool {
  * `output[outputStart .. outputEnd)` for its carrier to send.
  */
 export class Http1Connection {
-  // References, then 64-bit fields, then 32-bit ones, then flags: the order
-  // the layout packs without padding.
-  config: Http1Config
-  /**
-   * The `Date` every final response carries. The connection makes its own;
-   * `Http1Server` and `Http1TlsServer` put theirs here, so that every slot of a
-   * pool shares one and the pool formats at most once a second. A program may
-   * put another, to share it or to pin its clock.
-   */
-  date: HttpDate
+  // What a request reads and writes comes first, so that `inputRoom`, `feed`,
+  // `next`, `respond`, `write`, `end`, `consume`, `release` and `park` touch
+  // the front of the object: the parser, the output and its pool, the clocks,
+  // the state and the flags. What a WebSocket, an error or a configured cap
+  // needs follows. Within each part the layout packs as widest first does:
+  // the narrow fields of the front end on a 4-byte boundary and the cold
+  // 32-bit fields bring the references behind them to an 8-byte one.
   /**
    * The request parser: its head (`methodIs`, `targetIs`, `header`, spans) is
    * the current request's from its `H1_REQUEST` until its response is done,
    * `H1_END` included, however much of a pipelined request is fed behind it.
    */
   parser: Http1Parser
-  /**
-   * The frame decoder: made when the slot first switches to WebSocket, so a
-   * slot that only ever speaks HTTP never holds its buffers, then kept for
-   * the slot's later peers.
-   */
-  ws: WsDecoder | null
   /**
    * Bytes to send are `output[outputStart .. outputEnd)`. Empty until the
    * connection first needs room to write: then its own buffer, made once, or
@@ -560,27 +551,17 @@ export class Http1Connection {
   /** Where the parser's input and head buffers go while the slot rests, with `Http1Config.idleInput`; null otherwise. */
   inputs: Http1OutputPool | null
   heads: Http1OutputPool | null
-  /** `H1_BODY`'s and `H1_WS_MESSAGE`'s bytes. */
-  data: u8[]
-  /** A ping's payload, kept until its pong fits: empty until the first ping. */
-  pong: u8[]
-  /** No fields, for the responses the connection writes itself: made once. */
-  noFields: u8[][]
+  /**
+   * The `Date` every final response carries. The connection makes its own;
+   * `Http1Server` and `Http1TlsServer` put theirs here, so that every slot of a
+   * pool shares one and the pool formats at most once a second. A program may
+   * put another, to share it or to pin its clock.
+   */
+  date: HttpDate
   /** When the carrier last moved a byte for the connection, in `monotonicNanos`. */
   lastActive: i64 = 0
   /** When the head being read began to arrive, in `monotonicNanos`; meaningful while `headTimed`. */
   headSince: i64 = 0
-  outputStart: i32 = 0
-  outputEnd: i32 = 0
-  dataStart: i32 = 0
-  dataLength: i32 = 0
-  /** `H1_WS_MESSAGE`'s opcode: text or binary. */
-  opcode: i32 = 0
-  /** `H1_ERROR`'s HTTP status or WebSocket close code, or `H1_WS_CLOSE`'s close code. */
-  status: i32 = 0
-  /** The most input the connection buffers, unread: the cap `inputRoom` holds it to. */
-  bufferLimit: i32 = 0
-  pongLength: i32 = 0
   state: i32 = 0
   response: i32 = 0
   /**
@@ -590,12 +571,23 @@ export class Http1Connection {
   responseFraming: i32 = 0
   /** A response with a length: the bytes it still owes. */
   responseLeft: i32 = 0
-  /** The response carries no body (HEAD, 204, 304): what is written is dropped. */
-  responseEmpty: boolean = false
+  outputStart: i32 = 0
+  outputEnd: i32 = 0
+  /**
+   * `output.length`, kept beside the offsets so that `acquire` and `release`
+   * learn whether the connection holds a buffer without reading an array:
+   * the empty one is out of cache by the time a resting connection's next
+   * request comes. Only the connection assigns `output`, and with it this.
+   */
+  outputCap: i32 = 0
+  /** The most input the connection buffers, unread: the cap `inputRoom` holds it to. */
+  bufferLimit: i32 = 0
   /** A request's head has been read and its exchange is not over. */
   requestOpen: boolean = false
   /** The request's body has been read to its end. */
   requestEnded: boolean = false
+  /** The response carries no body (HEAD, 204, 304): what is written is dropped. */
+  responseEmpty: boolean = false
   /** The connection closes once this exchange is over. */
   closeAfter: boolean = false
   /** The program accepted the request's WebSocket handshake. */
@@ -607,6 +599,13 @@ export class Http1Connection {
   inputEnded: boolean = false
   /** A head has begun to arrive and is not read whole yet: `headSince` is its deadline's start. */
   headTimed: boolean = false
+  dataStart: i32 = 0
+  dataLength: i32 = 0
+  /** `H1_WS_MESSAGE`'s opcode: text or binary. */
+  opcode: i32 = 0
+  /** `H1_ERROR`'s HTTP status or WebSocket close code, or `H1_WS_CLOSE`'s close code. */
+  status: i32 = 0
+  pongLength: i32 = 0
   /**
    * The TCP maximum segment size the program sets for this connection, for
    * `respondEncoded` under `HttpCompressor.segmentMode`; 0, the default,
@@ -616,6 +615,19 @@ export class Http1Connection {
   mss: i32 = 0
   /** The MSS `Http1Server.accept` read from this connection's socket (`netMss`), or 0 when it reports none. */
   socketMss: i32 = 0
+  config: Http1Config
+  /**
+   * The frame decoder: made when the slot first switches to WebSocket, so a
+   * slot that only ever speaks HTTP never holds its buffers, then kept for
+   * the slot's later peers.
+   */
+  ws: WsDecoder | null
+  /** `H1_BODY`'s and `H1_WS_MESSAGE`'s bytes. */
+  data: u8[]
+  /** A ping's payload, kept until its pong fits: empty until the first ping. */
+  pong: u8[]
+  /** No fields, for the responses the connection writes itself: made once. */
+  noFields: u8[][]
 
   /** A connection under `config`. A cap outside what the connection can work with panics. */
   constructor(config: Http1Config) {
@@ -759,10 +771,15 @@ export class Http1Connection {
     if (this.writeHeld || this.inputEnded || this.state === H1_S_CLOSING || this.state === H1_S_FAILED) {
       return 0
     }
-    const ws: WsDecoder | null = this.ws
-    const held: i32 =
-      this.state === H1_S_WEBSOCKET && ws !== null ? ws.end - ws.start : this.parser.buffered()
-    const room: i32 = this.inputLimit() - held
+    let room: i32 = 0
+    if (this.state === H1_S_WEBSOCKET) {
+      // Only a WebSocket reads the decoder and the configured message cap,
+      // so a request's check stays on the connection's front fields.
+      const ws: WsDecoder | null = this.ws
+      room = this.inputLimit() - (ws !== null ? ws.end - ws.start : this.parser.buffered())
+    } else {
+      room = this.bufferLimit - this.parser.buffered()
+    }
     return room > 0 ? room : 0
   }
 
@@ -809,11 +826,13 @@ export class Http1Connection {
    * the pool has no free buffer, or for a connection's own, once.
    */
   acquire(): void {
-    if (toI32(this.output.length) > 0) {
+    if (this.outputCap > 0) {
       return
     }
     const pool: Http1OutputPool | null = this.pool
-    this.output = pool !== null ? pool.take() : new Array<u8>(this.config.outputSize)
+    const output: u8[] = pool !== null ? pool.take() : new Array<u8>(this.config.outputSize)
+    this.output = output
+    this.outputCap = toI32(output.length)
     this.outputStart = 0
     this.outputEnd = 0
   }
@@ -825,16 +844,12 @@ export class Http1Connection {
    */
   release(): void {
     const pool: Http1OutputPool | null = this.pool
-    if (
-      pool === null ||
-      toI32(this.output.length) === 0 ||
-      this.outputEnd > this.outputStart ||
-      this.writeHeld
-    ) {
+    if (pool === null || this.outputCap === 0 || this.outputEnd > this.outputStart || this.writeHeld) {
       return
     }
     pool.give(this.output)
     this.output = this.noOutput
+    this.outputCap = 0
     this.outputStart = 0
     this.outputEnd = 0
   }