10957b409SSimon J. Gerraty /* 20957b409SSimon J. Gerraty * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 30957b409SSimon J. Gerraty * 40957b409SSimon J. Gerraty * Permission is hereby granted, free of charge, to any person obtaining 50957b409SSimon J. Gerraty * a copy of this software and associated documentation files (the 60957b409SSimon J. Gerraty * "Software"), to deal in the Software without restriction, including 70957b409SSimon J. Gerraty * without limitation the rights to use, copy, modify, merge, publish, 80957b409SSimon J. Gerraty * distribute, sublicense, and/or sell copies of the Software, and to 90957b409SSimon J. Gerraty * permit persons to whom the Software is furnished to do so, subject to 100957b409SSimon J. Gerraty * the following conditions: 110957b409SSimon J. Gerraty * 120957b409SSimon J. Gerraty * The above copyright notice and this permission notice shall be 130957b409SSimon J. Gerraty * included in all copies or substantial portions of the Software. 140957b409SSimon J. Gerraty * 150957b409SSimon J. Gerraty * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 160957b409SSimon J. Gerraty * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 170957b409SSimon J. Gerraty * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 180957b409SSimon J. Gerraty * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 190957b409SSimon J. Gerraty * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 200957b409SSimon J. Gerraty * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 210957b409SSimon J. Gerraty * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 220957b409SSimon J. Gerraty * SOFTWARE. 230957b409SSimon J. Gerraty */ 240957b409SSimon J. Gerraty 250957b409SSimon J. Gerraty #ifndef CONFIG_H__ 260957b409SSimon J. Gerraty #define CONFIG_H__ 270957b409SSimon J. Gerraty 280957b409SSimon J. Gerraty /* 290957b409SSimon J. Gerraty * This file contains compile-time flags that can override the 300957b409SSimon J. Gerraty * autodetection performed in relevant files. Each flag is a macro; it 310957b409SSimon J. Gerraty * deactivates the feature if defined to 0, activates it if defined to a 320957b409SSimon J. Gerraty * non-zero integer (normally 1). If the macro is not defined, then 330957b409SSimon J. Gerraty * autodetection applies. 340957b409SSimon J. Gerraty */ 350957b409SSimon J. Gerraty 360957b409SSimon J. Gerraty /* 370957b409SSimon J. Gerraty * When BR_64 is enabled, 64-bit integer types are assumed to be 380957b409SSimon J. Gerraty * efficient (i.e. the architecture has 64-bit registers and can 390957b409SSimon J. Gerraty * do 64-bit operations as fast as 32-bit operations). 400957b409SSimon J. Gerraty * 410957b409SSimon J. Gerraty #define BR_64 1 420957b409SSimon J. Gerraty */ 430957b409SSimon J. Gerraty 440957b409SSimon J. Gerraty /* 450957b409SSimon J. Gerraty * When BR_LOMUL is enabled, then multiplications of 32-bit values whose 460957b409SSimon J. Gerraty * result are truncated to the low 32 bits are assumed to be 470957b409SSimon J. Gerraty * substantially more efficient than 32-bit multiplications that yield 480957b409SSimon J. Gerraty * 64-bit results. This is typically the case on low-end ARM Cortex M 490957b409SSimon J. Gerraty * systems (M0, M0+, M1, and arguably M3 and M4 as well). 500957b409SSimon J. Gerraty * 510957b409SSimon J. Gerraty #define BR_LOMUL 1 520957b409SSimon J. Gerraty */ 530957b409SSimon J. Gerraty 540957b409SSimon J. Gerraty /* 550957b409SSimon J. Gerraty * When BR_SLOW_MUL is enabled, multiplications are assumed to be 560957b409SSimon J. Gerraty * substantially slow with regards to other integer operations, thus 570957b409SSimon J. Gerraty * making it worth to make more operations for a given task if it allows 580957b409SSimon J. Gerraty * using less multiplications. 590957b409SSimon J. Gerraty * 600957b409SSimon J. Gerraty #define BR_SLOW_MUL 1 610957b409SSimon J. Gerraty */ 620957b409SSimon J. Gerraty 630957b409SSimon J. Gerraty /* 640957b409SSimon J. Gerraty * When BR_SLOW_MUL15 is enabled, short multplications (on 15-bit words) 650957b409SSimon J. Gerraty * are assumed to be substantially slow with regards to other integer 660957b409SSimon J. Gerraty * operations, thus making it worth to make more integer operations if 670957b409SSimon J. Gerraty * it allows using less multiplications. 680957b409SSimon J. Gerraty * 690957b409SSimon J. Gerraty #define BR_SLOW_MUL15 1 700957b409SSimon J. Gerraty */ 710957b409SSimon J. Gerraty 720957b409SSimon J. Gerraty /* 730957b409SSimon J. Gerraty * When BR_CT_MUL31 is enabled, multiplications of 31-bit values (used 740957b409SSimon J. Gerraty * in the "i31" big integer implementation) use an alternate implementation 750957b409SSimon J. Gerraty * which is slower and larger than the normal multiplication, but should 760957b409SSimon J. Gerraty * ensure constant-time multiplications even on architectures where the 770957b409SSimon J. Gerraty * multiplication opcode takes a variable number of cycles to complete. 780957b409SSimon J. Gerraty * 790957b409SSimon J. Gerraty #define BR_CT_MUL31 1 800957b409SSimon J. Gerraty */ 810957b409SSimon J. Gerraty 820957b409SSimon J. Gerraty /* 830957b409SSimon J. Gerraty * When BR_CT_MUL15 is enabled, multiplications of 15-bit values (held 840957b409SSimon J. Gerraty * in 32-bit words) use an alternate implementation which is slower and 850957b409SSimon J. Gerraty * larger than the normal multiplication, but should ensure 860957b409SSimon J. Gerraty * constant-time multiplications on most/all architectures where the 870957b409SSimon J. Gerraty * basic multiplication is not constant-time. 880957b409SSimon J. Gerraty #define BR_CT_MUL15 1 890957b409SSimon J. Gerraty */ 900957b409SSimon J. Gerraty 910957b409SSimon J. Gerraty /* 920957b409SSimon J. Gerraty * When BR_NO_ARITH_SHIFT is enabled, arithmetic right shifts (with sign 930957b409SSimon J. Gerraty * extension) are performed with a sequence of operations which is bigger 940957b409SSimon J. Gerraty * and slower than a simple right shift on a signed value. This avoids 950957b409SSimon J. Gerraty * relying on an implementation-defined behaviour. However, most if not 960957b409SSimon J. Gerraty * all C compilers use sign extension for right shifts on signed values, 970957b409SSimon J. Gerraty * so this alternate macro is disabled by default. 980957b409SSimon J. Gerraty #define BR_NO_ARITH_SHIFT 1 990957b409SSimon J. Gerraty */ 1000957b409SSimon J. Gerraty 1010957b409SSimon J. Gerraty /* 1020957b409SSimon J. Gerraty * When BR_RDRAND is enabled, the SSL engine will use the RDRAND opcode 1030957b409SSimon J. Gerraty * to automatically obtain quality randomness for seeding its internal 1040957b409SSimon J. Gerraty * PRNG. Since that opcode is present only in recent x86 CPU, its 1050957b409SSimon J. Gerraty * support is dynamically tested; if the current CPU does not support 1060957b409SSimon J. Gerraty * it, then another random source will be used, such as /dev/urandom or 1070957b409SSimon J. Gerraty * CryptGenRandom(). 1080957b409SSimon J. Gerraty * 1090957b409SSimon J. Gerraty #define BR_RDRAND 1 1100957b409SSimon J. Gerraty */ 1110957b409SSimon J. Gerraty 1120957b409SSimon J. Gerraty /* 113*cc9e6590SSimon J. Gerraty * When BR_USE_GETENTROPY is enabled, the SSL engine will use the 114*cc9e6590SSimon J. Gerraty * getentropy() function to obtain quality randomness for seeding its 115*cc9e6590SSimon J. Gerraty * internal PRNG. On Linux and FreeBSD, getentropy() is implemented by 116*cc9e6590SSimon J. Gerraty * the standard library with the system call getrandom(); on OpenBSD, 117*cc9e6590SSimon J. Gerraty * getentropy() is the system call, and there is no getrandom() wrapper, 118*cc9e6590SSimon J. Gerraty * hence the use of the getentropy() function for maximum portability. 119*cc9e6590SSimon J. Gerraty * 120*cc9e6590SSimon J. Gerraty * If the getentropy() call fails, and BR_USE_URANDOM is not explicitly 121*cc9e6590SSimon J. Gerraty * disabled, then /dev/urandom will be used as a fallback mechanism. On 122*cc9e6590SSimon J. Gerraty * FreeBSD and OpenBSD, this does not change much, since /dev/urandom 123*cc9e6590SSimon J. Gerraty * will block if not enough entropy has been obtained since last boot. 124*cc9e6590SSimon J. Gerraty * On Linux, /dev/urandom might not block, which can be troublesome in 125*cc9e6590SSimon J. Gerraty * early boot stages, which is why getentropy() is preferred. 126*cc9e6590SSimon J. Gerraty * 127*cc9e6590SSimon J. Gerraty #define BR_USE_GETENTROPY 1 128*cc9e6590SSimon J. Gerraty */ 129*cc9e6590SSimon J. Gerraty 130*cc9e6590SSimon J. Gerraty /* 1310957b409SSimon J. Gerraty * When BR_USE_URANDOM is enabled, the SSL engine will use /dev/urandom 132*cc9e6590SSimon J. Gerraty * to automatically obtain quality randomness for seeding its internal 1330957b409SSimon J. Gerraty * PRNG. 1340957b409SSimon J. Gerraty * 1350957b409SSimon J. Gerraty #define BR_USE_URANDOM 1 1360957b409SSimon J. Gerraty */ 1370957b409SSimon J. Gerraty 1380957b409SSimon J. Gerraty /* 1390957b409SSimon J. Gerraty * When BR_USE_WIN32_RAND is enabled, the SSL engine will use the Win32 1400957b409SSimon J. Gerraty * (CryptoAPI) functions (CryptAcquireContext(), CryptGenRandom()...) to 141*cc9e6590SSimon J. Gerraty * automatically obtain quality randomness for seeding its internal PRNG. 1420957b409SSimon J. Gerraty * 1430957b409SSimon J. Gerraty * Note: if both BR_USE_URANDOM and BR_USE_WIN32_RAND are defined, the 1440957b409SSimon J. Gerraty * former takes precedence. 1450957b409SSimon J. Gerraty * 1460957b409SSimon J. Gerraty #define BR_USE_WIN32_RAND 1 1470957b409SSimon J. Gerraty */ 1480957b409SSimon J. Gerraty 1490957b409SSimon J. Gerraty /* 1500957b409SSimon J. Gerraty * When BR_USE_UNIX_TIME is enabled, the X.509 validation engine obtains 1510957b409SSimon J. Gerraty * the current time from the OS by calling time(), and assuming that the 1520957b409SSimon J. Gerraty * returned value (a 'time_t') is an integer that counts time in seconds 1530957b409SSimon J. Gerraty * since the Unix Epoch (Jan 1st, 1970, 00:00 UTC). 1540957b409SSimon J. Gerraty * 1550957b409SSimon J. Gerraty #define BR_USE_UNIX_TIME 1 1560957b409SSimon J. Gerraty */ 1570957b409SSimon J. Gerraty 1580957b409SSimon J. Gerraty /* 1590957b409SSimon J. Gerraty * When BR_USE_WIN32_TIME is enabled, the X.509 validation engine obtains 1600957b409SSimon J. Gerraty * the current time from the OS by calling the Win32 function 1610957b409SSimon J. Gerraty * GetSystemTimeAsFileTime(). 1620957b409SSimon J. Gerraty * 1630957b409SSimon J. Gerraty * Note: if both BR_USE_UNIX_TIME and BR_USE_WIN32_TIME are defined, the 1640957b409SSimon J. Gerraty * former takes precedence. 1650957b409SSimon J. Gerraty * 1660957b409SSimon J. Gerraty #define BR_USE_WIN32_TIME 1 1670957b409SSimon J. Gerraty */ 1680957b409SSimon J. Gerraty 1690957b409SSimon J. Gerraty /* 1700957b409SSimon J. Gerraty * When BR_ARMEL_CORTEXM_GCC is enabled, some operations are replaced with 1710957b409SSimon J. Gerraty * inline assembly which is shorter and/or faster. This should be used 1720957b409SSimon J. Gerraty * only when all of the following are true: 1730957b409SSimon J. Gerraty * - target architecture is ARM in Thumb mode 1740957b409SSimon J. Gerraty * - target endianness is little-endian 1750957b409SSimon J. Gerraty * - compiler is GCC (or GCC-compatible for inline assembly syntax) 1760957b409SSimon J. Gerraty * 1770957b409SSimon J. Gerraty * This is meant for the low-end cores (Cortex M0, M0+, M1, M3). 1780957b409SSimon J. Gerraty * Note: if BR_LOMUL is not explicitly enabled or disabled, then 1790957b409SSimon J. Gerraty * enabling BR_ARMEL_CORTEXM_GCC also enables BR_LOMUL. 1800957b409SSimon J. Gerraty * 1810957b409SSimon J. Gerraty #define BR_ARMEL_CORTEXM_GCC 1 1820957b409SSimon J. Gerraty */ 1830957b409SSimon J. Gerraty 1840957b409SSimon J. Gerraty /* 1850957b409SSimon J. Gerraty * When BR_AES_X86NI is enabled, the AES implementation using the x86 "NI" 1860957b409SSimon J. Gerraty * instructions (dedicated AES opcodes) will be compiled. If this is not 1870957b409SSimon J. Gerraty * enabled explicitly, then that AES implementation will be compiled only 1880957b409SSimon J. Gerraty * if a compatible compiler is detected. If set explicitly to 0, the 1890957b409SSimon J. Gerraty * implementation will not be compiled at all. 1900957b409SSimon J. Gerraty * 1910957b409SSimon J. Gerraty #define BR_AES_X86NI 1 1920957b409SSimon J. Gerraty */ 1930957b409SSimon J. Gerraty 1940957b409SSimon J. Gerraty /* 1950957b409SSimon J. Gerraty * When BR_SSE2 is enabled, SSE2 intrinsics will be used for some 1960957b409SSimon J. Gerraty * algorithm implementations that use them (e.g. chacha20_sse2). If this 1970957b409SSimon J. Gerraty * is not enabled explicitly, then support for SSE2 intrinsics will be 1980957b409SSimon J. Gerraty * automatically detected. If set explicitly to 0, then SSE2 code will 1990957b409SSimon J. Gerraty * not be compiled at all. 2000957b409SSimon J. Gerraty * 2010957b409SSimon J. Gerraty #define BR_SSE2 1 2020957b409SSimon J. Gerraty */ 2030957b409SSimon J. Gerraty 2040957b409SSimon J. Gerraty /* 2050957b409SSimon J. Gerraty * When BR_POWER8 is enabled, the AES implementation using the POWER ISA 2060957b409SSimon J. Gerraty * 2.07 opcodes (available on POWER8 processors and later) is compiled. 2070957b409SSimon J. Gerraty * If this is not enabled explicitly, then that implementation will be 2080957b409SSimon J. Gerraty * compiled only if a compatible compiler is detected, _and_ the target 2090957b409SSimon J. Gerraty * architecture is POWER8 or later. 2100957b409SSimon J. Gerraty * 2110957b409SSimon J. Gerraty #define BR_POWER8 1 2120957b409SSimon J. Gerraty */ 2130957b409SSimon J. Gerraty 2140957b409SSimon J. Gerraty /* 2150957b409SSimon J. Gerraty * When BR_INT128 is enabled, then code using the 'unsigned __int64' 2160957b409SSimon J. Gerraty * and 'unsigned __int128' types will be used to leverage 64x64->128 2170957b409SSimon J. Gerraty * unsigned multiplications. This should work with GCC and compatible 2180957b409SSimon J. Gerraty * compilers on 64-bit architectures. 2190957b409SSimon J. Gerraty * 2200957b409SSimon J. Gerraty #define BR_INT128 1 2210957b409SSimon J. Gerraty */ 2220957b409SSimon J. Gerraty 2230957b409SSimon J. Gerraty /* 2240957b409SSimon J. Gerraty * When BR_UMUL128 is enabled, then code using the '_umul128()' and 2250957b409SSimon J. Gerraty * '_addcarry_u64()' intrinsics will be used to implement 64x64->128 2260957b409SSimon J. Gerraty * unsigned multiplications. This should work on Visual C on x64 systems. 2270957b409SSimon J. Gerraty * 2280957b409SSimon J. Gerraty #define BR_UMUL128 1 2290957b409SSimon J. Gerraty */ 2300957b409SSimon J. Gerraty 2310957b409SSimon J. Gerraty /* 2320957b409SSimon J. Gerraty * When BR_LE_UNALIGNED is enabled, then the current architecture is 2330957b409SSimon J. Gerraty * assumed to use little-endian encoding for integers, and to tolerate 2340957b409SSimon J. Gerraty * unaligned accesses with no or minimal time penalty. 2350957b409SSimon J. Gerraty * 2360957b409SSimon J. Gerraty #define BR_LE_UNALIGNED 1 2370957b409SSimon J. Gerraty */ 2380957b409SSimon J. Gerraty 2390957b409SSimon J. Gerraty /* 2400957b409SSimon J. Gerraty * When BR_BE_UNALIGNED is enabled, then the current architecture is 2410957b409SSimon J. Gerraty * assumed to use big-endian encoding for integers, and to tolerate 2420957b409SSimon J. Gerraty * unaligned accesses with no or minimal time penalty. 2430957b409SSimon J. Gerraty * 2440957b409SSimon J. Gerraty #define BR_BE_UNALIGNED 1 2450957b409SSimon J. Gerraty */ 2460957b409SSimon J. Gerraty 2470957b409SSimon J. Gerraty #endif 248