The SHA-256 implementation behind the interface

501    // Expected output state for hashing the i*64 first input bytes above (excluding SHA256 padding).
502    static const uint32_t result[9][8] = {
503        {0x6a09e667ul, 0xbb67ae85ul, 0x3c6ef372ul, 0xa54ff53aul, 0x510e527ful, 0x9b05688cul, 0x1f83d9abul, 0x5be0cd19ul},
504        {0x91f8ec6bul, 0x4da10fe3ul, 0x1c9c292cul, 0x45e18185ul, 0x435cc111ul, 0x3ca26f09ul, 0xeb954caeul, 0x402a7069ul},
505        {0xcabea5acul, 0x374fb97cul, 0x182ad996ul, 0x7bd69cbful, 0x450ff900ul, 0xc1d2be8aul, 0x6a41d505ul, 0xe6212dc3ul},
506        {0xbcff09d6ul, 0x3e76f36eul, 0x3ecb2501ul, 0x78866e97ul, 0xe1c1e2fdul, 0x32f4eafful, 0x8aa6c4e5ul, 0xdfc024bcul},
507        {0xa08c5d94ul, 0x0a862f93ul, 0x6b7f2f40ul, 0x8f9fae76ul, 0x6d40439ful, 0x79dcee0cul, 0x3e39ff3aul, 0xdc3bdbb1ul},
508        {0x216a0895ul, 0x9f1a3662ul, 0xe99946f9ul, 0x87ba4364ul, 0x0fb5db2cul, 0x12bed3d3ul, 0x6689c0c7ul, 0x292f1b04ul},
509        {0xca3067f8ul, 0xbc8c2656ul, 0x37cb7e0dul, 0x9b6b8b0ful, 0x46dc380bul, 0xf1287f57ul, 0xc42e4b23ul, 0x3fefe94dul},
510        {0x3e4c4039ul, 0xbb6fca8cul, 0x6f27d2f7ul, 0x301e44a4ul, 0x8352ba14ul, 0x5769ce37ul, 0x48a1155ful, 0xc0e1c4c6ul},
511        {0xfe2fa9ddul, 0x69d0862bul, 0x1ae0db23ul, 0x471f9244ul, 0xf55c0145ul, 0xc30f9c3bul, 0x40a84ea0ul, 0x5b8a266cul},
512    };
513    // Expected output for each of the individual 8 64-byte messages under full double SHA256 (including padding).
514    static const unsigned char result_d64[256] = {
515        0x09, 0x3a, 0xc4, 0xd0, 0x0f, 0xf7, 0x57, 0xe1, 0x72, 0x85, 0x79, 0x42, 0xfe, 0xe7, 0xe0, 0xa0,
516        0xfc, 0x52, 0xd7, 0xdb, 0x07, 0x63, 0x45, 0xfb, 0x53, 0x14, 0x7d, 0x17, 0x22, 0x86, 0xf0, 0x52,
517        0x48, 0xb6, 0x11, 0x9e, 0x6e, 0x48, 0x81, 0x6d, 0xcc, 0x57, 0x1f, 0xb2, 0x97, 0xa8, 0xd5, 0x25,
518        0x9b, 0x82, 0xaa, 0x89, 0xe2, 0xfd, 0x2d, 0x56, 0xe8, 0x28, 0x83, 0x0b, 0xe2, 0xfa, 0x53, 0xb7,
519        0xd6, 0x6b, 0x07, 0x85, 0x83, 0xb0, 0x10, 0xa2, 0xf5, 0x51, 0x3c, 0xf9, 0x60, 0x03, 0xab, 0x45,
520        0x6c, 0x15, 0x6e, 0xef, 0xb5, 0xac, 0x3e, 0x6c, 0xdf, 0xb4, 0x92, 0x22, 0x2d, 0xce, 0xbf, 0x3e,
521        0xe9, 0xe5, 0xf6, 0x29, 0x0e, 0x01, 0x4f, 0xd2, 0xd4, 0x45, 0x65, 0xb3, 0xbb, 0xf2, 0x4c, 0x16,
522        0x37, 0x50, 0x3c, 0x6e, 0x49, 0x8c, 0x5a, 0x89, 0x2b, 0x1b, 0xab, 0xc4, 0x37, 0xd1, 0x46, 0xe9,
523        0x3d, 0x0e, 0x85, 0xa2, 0x50, 0x73, 0xa1, 0x5e, 0x54, 0x37, 0xd7, 0x94, 0x17, 0x56, 0xc2, 0xd8,
524        0xe5, 0x9f, 0xed, 0x4e, 0xae, 0x15, 0x42, 0x06, 0x0d, 0x74, 0x74, 0x5e, 0x24, 0x30, 0xce, 0xd1,
525        0x9e, 0x50, 0xa3, 0x9a, 0xb8, 0xf0, 0x4a, 0x57, 0x69, 0x78, 0x67, 0x12, 0x84, 0x58, 0xbe, 0xc7,
526        0x36, 0xaa, 0xee, 0x7c, 0x64, 0xa3, 0x76, 0xec, 0xff, 0x55, 0x41, 0x00, 0x2a, 0x44, 0x68, 0x4d,
527        0xb6, 0x53, 0x9e, 0x1c, 0x95, 0xb7, 0xca, 0xdc, 0x7f, 0x7d, 0x74, 0x27, 0x5c, 0x8e, 0xa6, 0x84,
528        0xb5, 0xac, 0x87, 0xa9, 0xf3, 0xff, 0x75, 0xf2, 0x34, 0xcd, 0x1a, 0x3b, 0x82, 0x2c, 0x2b, 0x4e,
529        0x6a, 0x46, 0x30, 0xa6, 0x89, 0x86, 0x23, 0xac, 0xf8, 0xa5, 0x15, 0xe9, 0x0a, 0xaa, 0x1e, 0x9a,
530        0xd7, 0x93, 0x6b, 0x28, 0xe4, 0x3b, 0xfd, 0x59, 0xc6, 0xed, 0x7c, 0x5f, 0xa5, 0x41, 0xcb, 0x51
531    };
532
533
534    // Test Transform() for 0 through 8 transformations.
535    for (size_t i = 0; i <= 8; ++i) {
536        uint32_t state[8];
537        std::copy(init, init + 8, state);
538        Transform(state, data + 1, i);
539        if (!std::equal(state, state + 8, result[i])) return false;
540    }
541
542    // Test TransformD64
543    unsigned char out[32];
544    TransformD64(out, data + 1);
545    if (!std::equal(out, out + 32, result_d64)) return false;
546
547    // Test TransformD64_2way, if available.
548    if (TransformD64_2way) {
549        unsigned char out[64];
550        TransformD64_2way(out, data + 1);
551        if (!std::equal(out, out + 64, result_d64)) return false;
552    }
553
554    // Test TransformD64_4way, if available.
555    if (TransformD64_4way) {
556        unsigned char out[128];
557        TransformD64_4way(out, data + 1);
558        if (!std::equal(out, out + 128, result_d64)) return false;
559    }
560
561    // Test TransformD64_8way, if available.
562    if (TransformD64_8way) {
563        unsigned char out[256];
564        TransformD64_8way(out, data + 1);
565        if (!std::equal(out, out + 256, result_d64)) return false;
566    }
567
568    return true;
569}
570
571#if !defined(DISABLE_OPTIMIZED_SHA256)
572#if (defined(__x86_64__) || defined(__amd64__) || defined(__i386__))
573/** Check whether the OS has enabled AVX registers. */
574bool AVXEnabled()
575{
576    uint32_t a, d;
577    __asm__("xgetbv" : "=a"(a), "=d"(d) : "c"(0));
578    return (a & 6) == 6;
579}
580#endif
581#endif // DISABLE_OPTIMIZED_SHA256
582} // namespace
583
584
585std::string SHA256AutoDetect(sha256_implementation::UseImplementation use_implementation)
586{
587    std::string ret = "standard";
588    Transform = sha256::Transform;
589    TransformD64 = sha256::TransformD64;
590    TransformD64_2way = nullptr;
591    TransformD64_4way = nullptr;
592    TransformD64_8way = nullptr;
593
594#if !defined(DISABLE_OPTIMIZED_SHA256)
595#if defined(HAVE_GETCPUID)
596    bool have_sse4 = false;
597    bool have_xsave = false;
598    bool have_avx = false;
599    [[maybe_unused]] bool have_avx2 = false;
600    [[maybe_unused]] bool have_x86_shani = false;
601    [[maybe_unused]] bool enabled_avx = false;
602
603    uint32_t eax, ebx, ecx, edx;
604    GetCPUID(1, 0, eax, ebx, ecx, edx);
605    if (use_implementation & sha256_implementation::USE_SSE4) {
606        have_sse4 = (ecx >> 19) & 1;
607    }
608    have_xsave = (ecx >> 27) & 1;
609    have_avx = (ecx >> 28) & 1;
610    if (have_xsave && have_avx) {
611        enabled_avx = AVXEnabled();
612    }
613    if (have_sse4) {
614        GetCPUID(7, 0, eax, ebx, ecx, edx);
615        if (use_implementation & sha256_implementation::USE_AVX2) {
616            have_avx2 = (ebx >> 5) & 1;
617        }
618        if (use_implementation & sha256_implementation::USE_SHANI) {
619            have_x86_shani = (ebx >> 29) & 1;
620        }
621    }
622
623#if defined(ENABLE_SSE41) && defined(ENABLE_X86_SHANI)
624    if (have_x86_shani) {
625        Transform = sha256_x86_shani::Transform;
626        TransformD64 = TransformD64Wrapper<sha256_x86_shani::Transform>;
627        TransformD64_2way = sha256d64_x86_shani::Transform_2way;
628        ret = "x86_shani(1way;2way)";
629        have_sse4 = false; // Disable SSE4/AVX2;
630        have_avx2 = false;
631    }
632#endif
633
634    if (have_sse4) {
635#if defined(__x86_64__) || defined(__amd64__)
636        Transform = sha256_sse4::Transform;
637        TransformD64 = TransformD64Wrapper<sha256_sse4::Transform>;
638        ret = "sse4(1way)";
639#endif
640#if defined(ENABLE_SSE41)
641        TransformD64_4way = sha256d64_sse41::Transform_4way;
642        ret += ";sse41(4way)";
643#endif
644    }
645
646#if defined(ENABLE_AVX2)
647    if (have_avx2 && have_avx && enabled_avx) {
648        TransformD64_8way = sha256d64_avx2::Transform_8way;
649        ret += ";avx2(8way)";
650    }
651#endif
652#endif // defined(HAVE_GETCPUID)
653
654#if defined(ENABLE_ARM_SHANI)
655    bool have_arm_shani = false;
656    if (use_implementation & sha256_implementation::USE_SHANI) {
657#if defined(__linux__)
658#if defined(__arm__) // 32-bit
659        if (getauxval(AT_HWCAP2) & HWCAP2_SHA2) {
660            have_arm_shani = true;
661        }
662#endif
663#if defined(__aarch64__) // 64-bit
664        if (getauxval(AT_HWCAP) & HWCAP_SHA2) {
665            have_arm_shani = true;
666        }
667#endif
668#endif
669
670#if defined(__APPLE__)
671        int val = 0;
672        size_t len = sizeof(val);
673        if (sysctlbyname("hw.optional.arm.FEAT_SHA256", &val, &len, nullptr, 0) == 0) {
674            have_arm_shani = val != 0;
675        }
676#endif
677    }
678
679    if (have_arm_shani) {
680        Transform = sha256_arm_shani::Transform;
681        TransformD64 = TransformD64Wrapper<sha256_arm_shani::Transform>;
682        TransformD64_2way = sha256d64_arm_shani::Transform_2way;
683        ret = "arm_shani(1way;2way)";
684    }
685#endif
686#endif // DISABLE_OPTIMIZED_SHA256
687
688    assert(SelfTest());
689    return ret;
690}
691
692////// SHA-256
693
694CSHA256::CSHA256()
695{
696    sha256::Initialize(s);
697}
698
699CSHA256& CSHA256::Write(const unsigned char* data, size_t len)
700{
701    const unsigned char* end = data + len;
702    size_t bufsize = bytes % 64;
703    if (bufsize && bufsize + len >= 64) {
704        // Fill the buffer, and process it.
705        memcpy(buf + bufsize, data, 64 - bufsize);
706        bytes += 64 - bufsize;
707        data += 64 - bufsize;
708        Transform(s, buf, 1);
709        bufsize = 0;
710    }
711    if (end - data >= 64) {
712        size_t blocks = (end - data) / 64;
713        Transform(s, data, blocks);
714        data += 64 * blocks;
715        bytes += 64 * blocks;
716    }
717    if (end > data) {
718        // Fill the buffer with what remains.
719        memcpy(buf + bufsize, data, end - data);
720        bytes += end - data;
721    }
722    return *this;
723}
724
725void CSHA256::Finalize(unsigned char hash[OUTPUT_SIZE])
726{
727    static const unsigned char pad[64] = {0x80};
728    unsigned char sizedesc[8];
729    WriteBE64(sizedesc, bytes << 3);
730    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
731    Write(sizedesc, 8);
732    WriteBE32(hash, s[0]);
733    WriteBE32(hash + 4, s[1]);
734    WriteBE32(hash + 8, s[2]);
735    WriteBE32(hash + 12, s[3]);
736    WriteBE32(hash + 16, s[4]);
737    WriteBE32(hash + 20, s[5]);
738    WriteBE32(hash + 24, s[6]);
739    WriteBE32(hash + 28, s[7]);
740}
741
742CSHA256& CSHA256::Reset()
743{
744    bytes = 0;
745    sha256::Initialize(s);
746    return *this;
747}
748
749void SHA256D64(unsigned char* out, const unsigned char* in, size_t blocks)
750{