disable hacl curve25519_64 entirely as it's broken on so many levels; rel 2

see https://bugzilla.mozilla.org/show_bug.cgi?id=1836925

diff --git a/disable-hacl-curve25519.patch b/disable-hacl-curve25519.patch
new file mode 100644 (file)
index 0000000..367fdb4
--- /dev/null
+++ b/disable-hacl-curve25519.patch
@@ -0,0 +1,124 @@
+
+# HG changeset patch
+# User Natalia Kulatova <nkulatova@mozilla.com>
+# Date 1685981398 0
+# Node ID 52a5d8fe37410d940e7d3ca244146ebc46a7d52a
+# Parent  52969cff7db635e0ee10fad66eed2c0cfdcf999b
+Bug 1836781 - Disabling ASM C25519 for A but X86_64 r=bbeurdouche,nss-reviewers
+
+Differential Revision: https://phabricator.services.mozilla.com/D179969
+
+diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
+--- a/lib/freebl/Makefile
++++ b/lib/freebl/Makefile
+@@ -563,17 +563,19 @@ endif # target == SunO
+ ifdef USE_64
+ # no __int128 at least up to lcc 1.23 (pretending to be gcc5)
+ # NB: CC_NAME is not defined here
+ ifneq ($(shell $(CC) -? 2>&1 >/dev/null </dev/null | sed -e 's/:.*//;1q'),lcc)
+     ifdef CC_IS_CLANG
+             HAVE_INT128_SUPPORT = 1
+             DEFINES += -DHAVE_INT128_SUPPORT
+     else ifeq (1,$(CC_IS_GCC))
+-        SUPPORTS_VALE_CURVE25519 = 1
++        ifeq ($(CPU_ARCH),x86_64)
++            SUPPORTS_VALE_CURVE25519 = 1
++        endif
+         ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
+             HAVE_INT128_SUPPORT = 1
+             DEFINES += -DHAVE_INT128_SUPPORT
+         endif
+         ifneq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+             NSS_DISABLE_AVX2 = 1
+         endif
+         ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+
+diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
+--- a/lib/freebl/Makefile
++++ b/lib/freebl/Makefile
+@@ -566,13 +566,10 @@
+ ifneq ($(shell $(CC) -? 2>&1 >/dev/null </dev/null | sed -e 's/:.*//;1q'),lcc)
+     ifdef CC_IS_CLANG
+             HAVE_INT128_SUPPORT = 1
+             DEFINES += -DHAVE_INT128_SUPPORT
+     else ifeq (1,$(CC_IS_GCC))
+-        ifeq ($(CPU_ARCH),x86_64)
+-            SUPPORTS_VALE_CURVE25519 = 1
+-        endif
+         ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
+             HAVE_INT128_SUPPORT = 1
+             DEFINES += -DHAVE_INT128_SUPPORT
+         endif
+         ifneq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+@@ -593,15 +590,10 @@
+ 
+ ifndef HAVE_INT128_SUPPORT
+     DEFINES += -DKRML_VERIFIED_UINT128
+ endif
+ 
+-ifdef SUPPORTS_VALE_CURVE25519
+-    VERIFIED_SRCS += Hacl_Curve25519_64.c
+-    DEFINES += -DHACL_CAN_COMPILE_INLINE_ASM
+-endif
+-
+ ifndef NSS_DISABLE_CHACHAPOLY
+     ifeq ($(CPU_ARCH),x86_64)
+         ifndef NSS_DISABLE_AVX2
+             EXTRA_SRCS += Hacl_Poly1305_256.c Hacl_Chacha20_Vec256.c Hacl_Chacha20Poly1305_256.c
+             DEFINES += -DHACL_CAN_COMPILE_VEC256
+diff --git a/lib/freebl/freebl.gyp b/lib/freebl/freebl.gyp
+--- a/lib/freebl/freebl.gyp
++++ b/lib/freebl/freebl.gyp
+@@ -864,16 +864,10 @@
+               'PPC_GCM',
+             ],
+           }],
+         ],
+       }],
+-      [ 'supports_vale_curve25519==1', {
+-        'defines': [
+-          # The Makefile does version-tests on GCC, but we're not doing that here.
+-          'HACL_CAN_COMPILE_INLINE_ASM',
+-        ],
+-      }],
+       [ 'OS=="linux" or OS=="android"', {
+         'conditions': [
+           [ 'target_arch=="x64"', {
+             'defines': [
+               'MP_IS_LITTLE_ENDIAN',
+@@ -932,15 +926,10 @@
+     ],
+   },
+   'variables': {
+     'module': 'nss',
+     'conditions': [
+-      [ 'target_arch=="x64" and cc_is_gcc==1', {
+-        'supports_vale_curve25519%': 1,
+-      }, {
+-        'supports_vale_curve25519%': 0,
+-      }],
+       [ 'target_arch=="x64" or target_arch=="arm64" or target_arch=="aarch64"', {
+         'have_int128_support%': 1,
+       }, {
+         'have_int128_support%': 0,
+       }],
+diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi
+--- a/lib/freebl/freebl_base.gypi
++++ b/lib/freebl/freebl_base.gypi
+@@ -149,15 +149,10 @@
+       'sources': [
+         # All other architectures get the generic 32 bit implementation.
+         'ecl/curve25519_32.c',
+       ],
+     }],
+-    ['supports_vale_curve25519==1', {
+-      'sources': [
+-        'verified/Hacl_Curve25519_64.c',
+-      ],
+-    }],
+     ['(target_arch!="ppc64" and target_arch!="ppc64le") or disable_altivec==1', {
+       'sources': [
+         # Gyp does not support per-file cflags, so working around like this.
+         # ppc performance greatly benefits from specific flags.
+         'sha512.c',
+

diff --git a/non-x86-64b-archs.patch b/non-x86-64b-archs.patch
deleted file mode 100644 (file)
index e576930..0000000
--- a/non-x86-64b-archs.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-
-# HG changeset patch
-# User Natalia Kulatova <nkulatova@mozilla.com>
-# Date 1685981398 0
-# Node ID 52a5d8fe37410d940e7d3ca244146ebc46a7d52a
-# Parent  52969cff7db635e0ee10fad66eed2c0cfdcf999b
-Bug 1836781 - Disabling ASM C25519 for A but X86_64 r=bbeurdouche,nss-reviewers
-
-Differential Revision: https://phabricator.services.mozilla.com/D179969
-
-diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
---- a/lib/freebl/Makefile
-+++ b/lib/freebl/Makefile
-@@ -563,17 +563,19 @@ endif # target == SunO
- ifdef USE_64
- # no __int128 at least up to lcc 1.23 (pretending to be gcc5)
- # NB: CC_NAME is not defined here
- ifneq ($(shell $(CC) -? 2>&1 >/dev/null </dev/null | sed -e 's/:.*//;1q'),lcc)
-     ifdef CC_IS_CLANG
-             HAVE_INT128_SUPPORT = 1
-             DEFINES += -DHAVE_INT128_SUPPORT
-     else ifeq (1,$(CC_IS_GCC))
--        SUPPORTS_VALE_CURVE25519 = 1
-+        ifeq ($(CPU_ARCH),x86_64)
-+            SUPPORTS_VALE_CURVE25519 = 1
-+        endif
-         ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
-             HAVE_INT128_SUPPORT = 1
-             DEFINES += -DHAVE_INT128_SUPPORT
-         endif
-         ifneq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
-             NSS_DISABLE_AVX2 = 1
-         endif
-         ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
-

diff --git a/nss.spec b/nss.spec
index e5667e6675b08dcf062ab918aafc56425658fd66..165b88dc0404c4ecba6a2f045d34f865a9e1a560 100644 (file)
--- a/nss.spec
+++ b/nss.spec
@@ -8,7 +8,7 @@ Summary:        NSS - Network Security Services
 Summary(pl.UTF-8):     NSS - Network Security Services
 Name:          nss
 Version:       3.90
-Release:       1
+Release:       2
 Epoch:         1
 License:       MPL v2.0
 Group:         Libraries
@@ -20,7 +20,7 @@ Source3:      https://www.cacert.org/certs/root.der
 # Source3-md5: a61b375e390d9c3654eebd2031461f6b
 Source4:       nss-softokn.pc.in
 # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1083900
-Patch0:                non-x86-64b-archs.patch
+Patch0:                disable-hacl-curve25519.patch
 URL:           https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS
 BuildRequires: nspr-devel >= %{nspr_ver}
 %{!?with_bootstrap:BuildRequires:      nss-tools}