fixes #4477 (libsodium: update to 1.0.20)

9 files changed, 126 insertions, 117 deletions

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2.h b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2.h
index b027a5b834..55ddec64f0 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2.h
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2.h
@@ -22,20 +22,7 @@
 

 #include "crypto_generichash_blake2b.h"

 #include "export.h"

-

-#define blake2b_init_param crypto_generichash_blake2b__init_param

-#define blake2b_init crypto_generichash_blake2b__init

-#define blake2b_init_salt_personal \

-    crypto_generichash_blake2b__init_salt_personal

-#define blake2b_init_key crypto_generichash_blake2b__init_key

-#define blake2b_init_key_salt_personal \

-    crypto_generichash_blake2b__init_key_salt_personal

-#define blake2b_update crypto_generichash_blake2b__update

-#define blake2b_final crypto_generichash_blake2b__final

-#define blake2b crypto_generichash_blake2b__blake2b

-#define blake2b_salt_personal crypto_generichash_blake2b__blake2b_salt_personal

-#define blake2b_pick_best_implementation \

-    crypto_generichash_blake2b__pick_best_implementation

+#include "private/quirks.h"

 

 enum blake2b_constant {

     BLAKE2B_BLOCKBYTES    = 128,

@@ -45,10 +32,12 @@ enum blake2b_constant {
     BLAKE2B_PERSONALBYTES = 16

 };

 

-#if defined(__IBMC__) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)

-#pragma pack(1)

+#ifdef __IBMC__

+# pragma pack(1)

+#elif defined(__SUNPRO_C) || defined(__SUNPRO_CC)

+# pragma pack(1)

 #else

-#pragma pack(push, 1)

+# pragma pack(push, 1)

 #endif

 

 typedef struct blake2b_param_ {

@@ -74,10 +63,12 @@ typedef struct blake2b_state {
     uint8_t  last_node;

 } blake2b_state;

 

-#if defined(__IBMC__) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)

-#pragma pack()

+#ifdef __IBMC__

+# pragma pack(pop)

+#elif defined(__SUNPRO_C) || defined(__SUNPRO_CC)

+# pragma pack()

 #else

-#pragma pack(pop)

+# pragma pack(pop)

 #endif

 

 /* Streaming API */

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.c b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.c
index 2f49862cb2..3303242ede 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.c
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.c
@@ -8,22 +8,21 @@
 

 #include "blake2.h"

 #include "private/common.h"

-#include "private/sse2_64_32.h"

 

 #if defined(HAVE_AVX2INTRIN_H) && defined(HAVE_EMMINTRIN_H) && \

     defined(HAVE_TMMINTRIN_H) && defined(HAVE_SMMINTRIN_H)

 

-# ifdef __GNUC__

-#  pragma GCC target("sse2")

-#  pragma GCC target("ssse3")

-#  pragma GCC target("sse4.1")

-#  pragma GCC target("avx2")

+# ifdef __clang__

+#  pragma clang attribute push(__attribute__((target("sse2,ssse3,sse4.1,avx2"))), apply_to = function)

+# elif defined(__GNUC__)

+#  pragma GCC target("sse2,ssse3,sse4.1,avx2")

 # endif

 

 # include <emmintrin.h>

 # include <immintrin.h>

 # include <smmintrin.h>

 # include <tmmintrin.h>

+# include "private/sse2_64_32.h"

 

 # include "blake2b-compress-avx2.h"

 

@@ -46,4 +45,8 @@ blake2b_compress_avx2(blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES])
     return 0;

 }

 

+# ifdef __clang__

+#  pragma clang attribute pop

+# endif

+

 #endif

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.h b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.h
index dd325cb267..e1103962e1 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.h
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-avx2.h
@@ -68,17 +68,17 @@ LOADU64(const void *p)
 

 #define BLAKE2B_DIAG_V1(a, b, c, d)                               \

     do {                                                          \

-        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(2, 1, 0, 3)); \

-        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(1, 0, 3, 2)); \

-        b = _mm256_permute4x64_epi64(b, _MM_SHUFFLE(0, 3, 2, 1)); \

-    } while (0)

+        a = _mm256_permute4x64_epi64(a, _MM_SHUFFLE(2, 1, 0, 3)); \

+        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(1, 0, 3, 2)); \

+        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(0, 3, 2, 1)); \

+    } while(0)

 

 #define BLAKE2B_UNDIAG_V1(a, b, c, d)                             \

     do {                                                          \

-        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(0, 3, 2, 1)); \

-        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(1, 0, 3, 2)); \

-        b = _mm256_permute4x64_epi64(b, _MM_SHUFFLE(2, 1, 0, 3)); \

-    } while (0)

+        a = _mm256_permute4x64_epi64(a, _MM_SHUFFLE(0, 3, 2, 1)); \

+        d = _mm256_permute4x64_epi64(d, _MM_SHUFFLE(1, 0, 3, 2)); \

+        c = _mm256_permute4x64_epi64(c, _MM_SHUFFLE(2, 1, 0, 3)); \

+    } while(0)

 

 #include "blake2b-load-avx2.h"

 

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ref.c b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ref.c
index 05bd59b7ee..90fc5fd0be 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ref.c
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ref.c
@@ -35,7 +35,7 @@ blake2b_compress_ref(blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES])
     int      i;

 

     for (i = 0; i < 16; ++i) {

-        m[i] = LOAD64_LE(block + i * sizeof(m[i]));

+        m[i] = LOAD64_LE(block + i * sizeof m[i]);

     }

     for (i = 0; i < 8; ++i) {

         v[i] = S->h[i];

@@ -48,16 +48,16 @@ blake2b_compress_ref(blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES])
     v[13] = S->t[1] ^ blake2b_IV[5];

     v[14] = S->f[0] ^ blake2b_IV[6];

     v[15] = S->f[1] ^ blake2b_IV[7];

-#define G(r, i, a, b, c, d)                         \

-    do {                                            \

-        a = a + b + m[blake2b_sigma[r][2 * i + 0]]; \

-        d = ROTR64(d ^ a, 32);                      \

-        c = c + d;                                  \

-        b = ROTR64(b ^ c, 24);                      \

-        a = a + b + m[blake2b_sigma[r][2 * i + 1]]; \

-        d = ROTR64(d ^ a, 16);                      \

-        c = c + d;                                  \

-        b = ROTR64(b ^ c, 63);                      \

+#define G(r, i, a, b, c, d)                      \

+    do {                                         \

+        a += b + m[blake2b_sigma[r][2 * i + 0]]; \

+        d = ROTR64(d ^ a, 32);                   \

+        c += d;                                  \

+        b = ROTR64(b ^ c, 24);                   \

+        a += b + m[blake2b_sigma[r][2 * i + 1]]; \

+        d = ROTR64(d ^ a, 16);                   \

+        c += d;                                  \

+        b = ROTR64(b ^ c, 63);                   \

     } while (0)

 #define ROUND(r)                           \

     do {                                   \

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.c b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.c
index 609ada01a0..b4a5acfbc1 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.c
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.c
@@ -7,20 +7,20 @@
 

 #include "blake2.h"

 #include "private/common.h"

-#include "private/sse2_64_32.h"

 

 #if defined(HAVE_EMMINTRIN_H) && defined(HAVE_TMMINTRIN_H) && \

     defined(HAVE_SMMINTRIN_H)

 

-# ifdef __GNUC__

-#  pragma GCC target("sse2")

-#  pragma GCC target("ssse3")

-#  pragma GCC target("sse4.1")

+# ifdef __clang__

+#  pragma clang attribute push(__attribute__((target("sse2,ssse3,sse4.1"))), apply_to = function)

+# elif defined(__GNUC__)

+#  pragma GCC target("sse2,ssse3,sse4.1")

 # endif

 

 # include <emmintrin.h>

 # include <smmintrin.h>

 # include <tmmintrin.h>

+# include "private/sse2_64_32.h"

 

 # include "blake2b-compress-sse41.h"

 

@@ -84,4 +84,8 @@ blake2b_compress_sse41(blake2b_state *S,
     return 0;

 }

 

+# ifdef __clang__

+#  pragma clang attribute pop

+# endif

+

 #endif

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.h b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.h
index 59cc279f84..4653f094f9 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.h
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-sse41.h
@@ -5,6 +5,8 @@
 #define LOADU(p) _mm_loadu_si128((const __m128i *) (const void *) (p))

 #define STOREU(p, r) _mm_storeu_si128((__m128i *) (void *) (p), r)

 

+#if !(defined(_mm_roti_epi64) && defined(__XOP__))

+#undef  _mm_roti_epi64

 #define _mm_roti_epi64(x, c)                                         \

     (-(c) == 32)                                                     \

         ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1))            \

@@ -17,6 +19,7 @@
                                           _mm_add_epi64((x), (x)))   \

                           : _mm_xor_si128(_mm_srli_epi64((x), -(c)), \

                                           _mm_slli_epi64((x), 64 - (-(c))))

+#endif

 

 #define G1(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1) \

     row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l);                \

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.c b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.c
index 6b9bff151c..ed55c2866b 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.c
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.c
@@ -4,17 +4,18 @@
 

 #include "blake2.h"

 #include "private/common.h"

-#include "private/sse2_64_32.h"

 

 #if defined(HAVE_EMMINTRIN_H) && defined(HAVE_TMMINTRIN_H)

 

-# ifdef __GNUC__

-#  pragma GCC target("sse2")

-#  pragma GCC target("ssse3")

+# ifdef __clang__

+#  pragma clang attribute push(__attribute__((target("sse2,ssse3"))), apply_to = function)

+# elif defined(__GNUC__)

+#  pragma GCC target("sse2,ssse3")

 # endif

 

 # include <emmintrin.h>

 # include <tmmintrin.h>

+# include "private/sse2_64_32.h"

 

 # include "blake2b-compress-ssse3.h"

 

@@ -87,4 +88,8 @@ blake2b_compress_ssse3(blake2b_state *S,
     return 0;

 }

 

+# ifdef __clang__

+#  pragma clang attribute pop

+# endif

+

 #endif

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.h b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.h
index 7bee1a12b2..93a90dbfb9 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.h
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-compress-ssse3.h
@@ -5,6 +5,8 @@
 #define LOADU(p) _mm_loadu_si128((const __m128i *) (const void *) (p))

 #define STOREU(p, r) _mm_storeu_si128((__m128i *) (void *) (p), r)

 

+#if !(defined(_mm_roti_epi64) && defined(__XOP__))

+#undef  _mm_roti_epi64

 #define _mm_roti_epi64(x, c)                                         \

     (-(c) == 32)                                                     \

         ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1))            \

@@ -17,6 +19,7 @@
                                           _mm_add_epi64((x), (x)))   \

                           : _mm_xor_si128(_mm_srli_epi64((x), -(c)), \

                                           _mm_slli_epi64((x), 64 - (-(c))))

+#endif

 

 #define G1(row1l, row2l, row3l, row4l, row1h, row2h, row3h, row4h, b0, b1) \

     row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l);                \

diff --git a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-load-avx2.h b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-load-avx2.h
index 217a522626..17d6b92289 100644
--- a/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-load-avx2.h
+++ b/libs/libsodium/src/crypto_generichash/blake2b/ref/blake2b-load-avx2.h
@@ -17,15 +17,15 @@
 

 #define BLAKE2B_LOAD_MSG_0_3(b0)               \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m4, m5);    \

-        t1 = _mm256_unpacklo_epi64(m6, m7);    \

+        t0 = _mm256_unpacklo_epi64(m7, m4);    \

+        t1 = _mm256_unpacklo_epi64(m5, m6);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_0_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m4, m5);    \

-        t1 = _mm256_unpackhi_epi64(m6, m7);    \

+        t0 = _mm256_unpackhi_epi64(m7, m4);    \

+        t1 = _mm256_unpackhi_epi64(m5, m6);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -43,17 +43,17 @@
         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

-#define BLAKE2B_LOAD_MSG_1_3(b0)                                \

-    do {                                                        \

-        t0 = _mm256_shuffle_epi32(m0, _MM_SHUFFLE(1, 0, 3, 2)); \

-        t1 = _mm256_unpackhi_epi64(m5, m2);                     \

-        b0 = _mm256_blend_epi32(t0, t1, 0xF0);                  \

+#define BLAKE2B_LOAD_MSG_1_3(b0)               \

+    do {                                       \

+        t0 = _mm256_unpackhi_epi64(m2, m0);    \

+        t1 = _mm256_blend_epi32(m5, m0, 0x33); \

+        b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_1_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m6, m1);    \

-        t1 = _mm256_unpackhi_epi64(m3, m1);    \

+        t0 = _mm256_alignr_epi8(m6, m1, 8);    \

+        t1 = _mm256_blend_epi32(m3, m1, 0x33); \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -73,15 +73,15 @@
 

 #define BLAKE2B_LOAD_MSG_2_3(b0)               \

     do {                                       \

-        t0 = _mm256_blend_epi32(m1, m5, 0x33); \

-        t1 = _mm256_unpackhi_epi64(m3, m4);    \

+        t0 = _mm256_alignr_epi8(m5, m4, 8);    \

+        t1 = _mm256_unpackhi_epi64(m1, m3);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_2_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m7, m3);    \

-        t1 = _mm256_alignr_epi8(m2, m0, 8);    \

+        t0 = _mm256_unpacklo_epi64(m2, m7);    \

+        t1 = _mm256_blend_epi32(m0, m3, 0x33); \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -99,17 +99,17 @@
         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

-#define BLAKE2B_LOAD_MSG_3_3(b0)               \

-    do {                                       \

-        t0 = _mm256_blend_epi32(m2, m1, 0x33); \

-        t1 = _mm256_blend_epi32(m7, m2, 0x33); \

-        b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

+#define BLAKE2B_LOAD_MSG_3_3(b0)                                \

+    do {                                                        \

+        t0 = _mm256_alignr_epi8(m1, m7, 8);                     \

+        t1 = _mm256_shuffle_epi32(m2, _MM_SHUFFLE(1, 0, 3, 2)); \

+        b0 = _mm256_blend_epi32(t0, t1, 0xF0);                  \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_3_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m3, m5);    \

-        t1 = _mm256_unpacklo_epi64(m0, m4);    \

+        t0 = _mm256_unpacklo_epi64(m4, m3);    \

+        t1 = _mm256_unpacklo_epi64(m5, m0);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -129,15 +129,15 @@
 

 #define BLAKE2B_LOAD_MSG_4_3(b0)               \

     do {                                       \

-        t0 = _mm256_blend_epi32(m5, m7, 0x33); \

-        t1 = _mm256_blend_epi32(m1, m3, 0x33); \

+        t0 = _mm256_alignr_epi8(m7, m1, 8);    \

+        t1 = _mm256_alignr_epi8(m3, m5, 8);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_4_4(b0)               \

     do {                                       \

-        t0 = _mm256_alignr_epi8(m6, m0, 8);    \

-        t1 = _mm256_blend_epi32(m6, m4, 0x33); \

+        t0 = _mm256_unpackhi_epi64(m6, m0);    \

+        t1 = _mm256_unpacklo_epi64(m6, m4);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -157,15 +157,15 @@
 

 #define BLAKE2B_LOAD_MSG_5_3(b0)               \

     do {                                       \

-        t0 = _mm256_blend_epi32(m3, m2, 0x33); \

-        t1 = _mm256_unpackhi_epi64(m7, m0);    \

+        t0 = _mm256_alignr_epi8(m2, m0, 8);    \

+        t1 = _mm256_unpackhi_epi64(m3, m7);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_5_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m6, m2);    \

-        t1 = _mm256_blend_epi32(m4, m7, 0x33); \

+        t0 = _mm256_unpackhi_epi64(m4, m6);    \

+        t1 = _mm256_alignr_epi8(m7, m2, 8);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -183,20 +183,20 @@
         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

-#define BLAKE2B_LOAD_MSG_6_3(b0)                                \

-    do {                                                        \

-        t0 = _mm256_unpacklo_epi64(m0, m3);                     \

-        t1 = _mm256_shuffle_epi32(m4, _MM_SHUFFLE(1, 0, 3, 2)); \

-        b0 = _mm256_blend_epi32(t0, t1, 0xF0);                  \

-    } while (0)

-

-#define BLAKE2B_LOAD_MSG_6_4(b0)               \

+#define BLAKE2B_LOAD_MSG_6_3(b0)               \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m3, m1);    \

-        t1 = _mm256_blend_epi32(m5, m1, 0x33); \

+        t0 = _mm256_unpacklo_epi64(m4, m0);    \

+        t1 = _mm256_blend_epi32(m4, m3, 0x33); \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

+#define BLAKE2B_LOAD_MSG_6_4(b0)                                \

+    do {                                                        \

+        t0 = _mm256_unpackhi_epi64(m5, m3);                     \

+        t1 = _mm256_shuffle_epi32(m1, _MM_SHUFFLE(1, 0, 3, 2)); \

+        b0 = _mm256_blend_epi32(t0, t1, 0xF0);                  \

+    } while (0)

+

 #define BLAKE2B_LOAD_MSG_7_1(b0)               \

     do {                                       \

         t0 = _mm256_unpackhi_epi64(m6, m3);    \

@@ -213,15 +213,15 @@
 

 #define BLAKE2B_LOAD_MSG_7_3(b0)               \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m2, m7);    \

-        t1 = _mm256_unpacklo_epi64(m4, m1);    \

+        t0 = _mm256_blend_epi32(m2, m1, 0x33); \

+        t1 = _mm256_alignr_epi8(m4, m7, 8);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_7_4(b0)               \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m0, m2);    \

-        t1 = _mm256_unpacklo_epi64(m3, m5);    \

+        t0 = _mm256_unpacklo_epi64(m5, m0);    \

+        t1 = _mm256_unpacklo_epi64(m2, m3);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -241,15 +241,15 @@
 

 #define BLAKE2B_LOAD_MSG_8_3(b0)               \

     do {                                       \

-        t0 = m6;                               \

-        t1 = _mm256_alignr_epi8(m5, m0, 8);    \

+        t0 = _mm256_unpacklo_epi64(m5, m6);    \

+        t1 = _mm256_unpackhi_epi64(m6, m0);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_8_4(b0)               \

     do {                                       \

-        t0 = _mm256_blend_epi32(m3, m1, 0x33); \

-        t1 = m2;                               \

+        t0 = _mm256_alignr_epi8(m1, m2, 8);    \

+        t1 = _mm256_alignr_epi8(m2, m3, 8);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -269,15 +269,15 @@
 

 #define BLAKE2B_LOAD_MSG_9_3(b0)               \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m7, m4);    \

-        t1 = _mm256_unpackhi_epi64(m1, m6);    \

+        t0 = _mm256_unpackhi_epi64(m6, m7);    \

+        t1 = _mm256_unpackhi_epi64(m4, m1);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_9_4(b0)               \

     do {                                       \

-        t0 = _mm256_alignr_epi8(m7, m5, 8);    \

-        t1 = _mm256_unpacklo_epi64(m6, m0);    \

+        t0 = _mm256_blend_epi32(m5, m0, 0x33); \

+        t1 = _mm256_unpacklo_epi64(m7, m6);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -297,15 +297,15 @@
 

 #define BLAKE2B_LOAD_MSG_10_3(b0)              \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m4, m5);    \

-        t1 = _mm256_unpacklo_epi64(m6, m7);    \

+        t0 = _mm256_unpacklo_epi64(m7, m4);    \

+        t1 = _mm256_unpacklo_epi64(m5, m6);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_10_4(b0)              \

     do {                                       \

-        t0 = _mm256_unpackhi_epi64(m4, m5);    \

-        t1 = _mm256_unpackhi_epi64(m6, m7);    \

+        t0 = _mm256_unpackhi_epi64(m7, m4);    \

+        t1 = _mm256_unpackhi_epi64(m5, m6);    \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

@@ -323,17 +323,17 @@
         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

-#define BLAKE2B_LOAD_MSG_11_3(b0)                               \

-    do {                                                        \

-        t0 = _mm256_shuffle_epi32(m0, _MM_SHUFFLE(1, 0, 3, 2)); \

-        t1 = _mm256_unpackhi_epi64(m5, m2);                     \

-        b0 = _mm256_blend_epi32(t0, t1, 0xF0);                  \

+#define BLAKE2B_LOAD_MSG_11_3(b0)              \

+    do {                                       \

+        t0 = _mm256_unpackhi_epi64(m2, m0);    \

+        t1 = _mm256_blend_epi32(m5, m0, 0x33); \

+        b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)

 

 #define BLAKE2B_LOAD_MSG_11_4(b0)              \

     do {                                       \

-        t0 = _mm256_unpacklo_epi64(m6, m1);    \

-        t1 = _mm256_unpackhi_epi64(m3, m1);    \

+        t0 = _mm256_alignr_epi8(m6, m1, 8);    \

+        t1 = _mm256_blend_epi32(m3, m1, 0x33); \

         b0 = _mm256_blend_epi32(t0, t1, 0xF0); \

     } while (0)