diff mbox

sha2: new header <sha2.h>

Message ID 1427492368-3482458-1-git-send-email-shawn@churchofgit.com
State New
Headers show

Commit Message

Shawn Landden March 27, 2015, 9:39 p.m. UTC
Export the SHA2 family of functions in -lcrypt.

We already have these functions for crypt(), and many projects and spending much
effort reimplementing them. The most popular library, openSSL, also has infamous
licensing issues and is way overkill when AES is not needed. OpenSSL is the only
library I know of that support SHA2 cpu extensions as well.

Passes all existing tests.
---
 ChangeLog                                          | 19 +++++
 configure.ac                                       |  2 +-
 crypt/Makefile                                     |  6 +-
 crypt/Versions                                     |  4 +
 crypt/align.h                                      | 54 +++++++++++++
 crypt/sha2.h                                       | 54 +++++++++++++
 crypt/sha256-block.c                               |  4 +-
 crypt/sha256-crypt.c                               |  6 +-
 crypt/sha256.c                                     | 93 +++++++++++-----------
 crypt/sha256.h                                     | 23 ++++--
 crypt/sha256test.c                                 | 11 ++-
 crypt/sha512-block.c                               |  4 +-
 crypt/sha512-crypt.c                               |  6 +-
 crypt/sha512.c                                     | 85 +++++++++++---------
 crypt/sha512.h                                     | 22 +++--
 crypt/sha512test.c                                 |  9 +--
 sysdeps/unix/sysv/linux/aarch64/libcrypt.abilist   | 12 +++
 sysdeps/unix/sysv/linux/alpha/libcrypt.abilist     | 12 +++
 sysdeps/unix/sysv/linux/arm/libcrypt.abilist       | 12 +++
 sysdeps/unix/sysv/linux/hppa/libcrypt.abilist      | 12 +++
 sysdeps/unix/sysv/linux/i386/libcrypt.abilist      | 12 +++
 sysdeps/unix/sysv/linux/ia64/libcrypt.abilist      | 12 +++
 .../unix/sysv/linux/m68k/coldfire/libcrypt.abilist | 12 +++
 .../unix/sysv/linux/m68k/m680x0/libcrypt.abilist   | 12 +++
 .../unix/sysv/linux/microblaze/libcrypt.abilist    | 12 +++
 .../unix/sysv/linux/mips/mips32/libcrypt.abilist   | 13 +++
 .../unix/sysv/linux/mips/mips64/libcrypt.abilist   | 12 +++
 sysdeps/unix/sysv/linux/nios2/libcrypt.abilist     | 12 +++
 .../sysv/linux/powerpc/powerpc32/libcrypt.abilist  | 12 +++
 .../sysv/linux/powerpc/powerpc64/libcrypt.abilist  | 12 +++
 .../unix/sysv/linux/s390/s390-32/libcrypt.abilist  | 12 +++
 .../unix/sysv/linux/s390/s390-64/libcrypt.abilist  | 12 +++
 sysdeps/unix/sysv/linux/sh/libcrypt.abilist        | 12 +++
 .../unix/sysv/linux/sparc/sparc32/libcrypt.abilist | 12 +++
 .../unix/sysv/linux/sparc/sparc64/libcrypt.abilist | 12 +++
 .../linux/tile/tilegx/tilegx32/libcrypt.abilist    | 12 +++
 .../linux/tile/tilegx/tilegx64/libcrypt.abilist    | 12 +++
 .../unix/sysv/linux/tile/tilepro/libcrypt.abilist  | 12 +++
 sysdeps/unix/sysv/linux/x86_64/64/libcrypt.abilist | 12 +++
 .../unix/sysv/linux/x86_64/x32/libcrypt.abilist    | 12 +++
 40 files changed, 568 insertions(+), 123 deletions(-)
 create mode 100644 crypt/align.h
 create mode 100644 crypt/sha2.h

Comments

Mike Frysinger March 28, 2015, 3:46 a.m. UTC | #1
On 27 Mar 2015 14:39, Shawn Landden wrote:
> --- a/configure.ac
> +++ b/configure.ac
>
> -  nss_includes=-I$(nss-config --includedir 2>/dev/null)
> +  nss_includes=$(pkg-config --cflags-only-I nss)

you cannot hardcode `pkg-config`.  you must respect $PKG_CONFIG.  normally 
you'd use PKG_PROG_PKG_CONFIG, but that'd require an external pkg.m4 to be 
available, so do this instead earlier in the file:
	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])

> --- /dev/null
> +++ b/crypt/align.h
>
> +#define put_be32(p, v)	do { *(uint32_t *)(p) = be32toh(v); } while (0)
> +#define put_be64(p, v)	do { *(uint64_t *)(p) = be64toh(v); } while (0)
> +#define put_be32(p, v)	do { \
> +	unsigned int __v = (v); \
> +	*((unsigned char *)(p) + 0) = __v >> 24; \
> +	*((unsigned char *)(p) + 1) = __v >> 16; \
> +	*((unsigned char *)(p) + 2) = __v >>  8; \
> +	*((unsigned char *)(p) + 3) = __v >>  0; } while (0)
> +#define put_be64(p, v)	do { \
> +	unsigned int __v = (v); \
> +	*((unsigned char *)(p) + 0) = __v >> 56; \
> +	*((unsigned char *)(p) + 1) = __v >> 48; \
> +	*((unsigned char *)(p) + 2) = __v >> 40; \
> +	*((unsigned char *)(p) + 3) = __v >> 32; \
> +	*((unsigned char *)(p) + 4) = __v >> 24; \
> +	*((unsigned char *)(p) + 5) = __v >> 16; \
> +	*((unsigned char *)(p) + 6) = __v >>  8; \
> +	*((unsigned char *)(p) + 7) = __v >>  0; } while (0)

these are like ... really bad.  they violate strict aliasing so hard.  just use 
the macros already available in endian.h.  like htobe32 and htobe64.  which you 
seem to use elsewhere in this patch already ;).

> --- /dev/null
> +++ b/crypt/sha2.h
>
> +typedef struct {
> +  char __internal_state[176];
> +} sha256_ctx __attribute__((aligned(16)));

this wasn't a problem before because you weren't installing the header, but now 
that you are, you have to use __aligned__.

applies below too.

> +/* sha256() writes 32 bytes to md and returns md.
> + * sha256_finish() writes 32 bytes to md and returns md.
> + * sha224_finish() writes 28 bytes to md and returns md.
> + * sha256_update() returns d.*/
> +void *sha256(const void *__restrict d, size_t n, void *__restrict md);
> +void sha256_init(sha256_ctx *s);
> +const void *sha256_update(sha256_ctx *__restrict s, const void *__restrict d, size_t n);
> +void *sha256_finish(sha256_ctx *__restrict s, void *__restrict md);
> +void *sha224_finish(sha256_ctx *__restrict s, void *__restrict md);

comments about the api should be split before each function rather than one big 
block.  you should also omit the names (like "d" or "n") as those cause 
namespace issues.

applies below too.

you should also update the manual to document these.

i did see some clean ups we might want to split out & merge regardless of 
exporting the sha2 API (like deleting the SWAP ugliness).  although, considering 
glibc already has this code in it, i don't have a problem with exporting them as 
proper symbols (assuming the API is reasonable).
-mike
Rich Felker March 28, 2015, 5:41 a.m. UTC | #2
On Fri, Mar 27, 2015 at 11:46:28PM -0400, Mike Frysinger wrote:
> > --- /dev/null
> > +++ b/crypt/align.h
> >
> > +#define put_be32(p, v)	do { *(uint32_t *)(p) = be32toh(v); } while (0)
> > +#define put_be64(p, v)	do { *(uint64_t *)(p) = be64toh(v); } while (0)
> > +#define put_be32(p, v)	do { \
> > +	unsigned int __v = (v); \
> > +	*((unsigned char *)(p) + 0) = __v >> 24; \
> > +	*((unsigned char *)(p) + 1) = __v >> 16; \
> > +	*((unsigned char *)(p) + 2) = __v >>  8; \
> > +	*((unsigned char *)(p) + 3) = __v >>  0; } while (0)
> > +#define put_be64(p, v)	do { \
> > +	unsigned int __v = (v); \
> > +	*((unsigned char *)(p) + 0) = __v >> 56; \
> > +	*((unsigned char *)(p) + 1) = __v >> 48; \
> > +	*((unsigned char *)(p) + 2) = __v >> 40; \
> > +	*((unsigned char *)(p) + 3) = __v >> 32; \
> > +	*((unsigned char *)(p) + 4) = __v >> 24; \
> > +	*((unsigned char *)(p) + 5) = __v >> 16; \
> > +	*((unsigned char *)(p) + 6) = __v >>  8; \
> > +	*((unsigned char *)(p) + 7) = __v >>  0; } while (0)
> 
> these are like ... really bad.  they violate strict aliasing so hard.  just use 
> the macros already available in endian.h.  like htobe32 and htobe64.  which you 
> seem to use elsewhere in this patch already ;).

No they don't. This is legal access of the representation. It's no
different than if you'd used memcpy. OTOH I agree it's ugly.

Rich
Allan McRae March 28, 2015, 5:52 a.m. UTC | #3
On 28/03/15 13:46, Mike Frysinger wrote:
> On 27 Mar 2015 14:39, Shawn Landden wrote:
>> --- a/configure.ac
>> +++ b/configure.ac
>>
>> -  nss_includes=-I$(nss-config --includedir 2>/dev/null)
>> +  nss_includes=$(pkg-config --cflags-only-I nss)
> 
> you cannot hardcode `pkg-config`.  you must respect $PKG_CONFIG.  normally 
> you'd use PKG_PROG_PKG_CONFIG, but that'd require an external pkg.m4 to be 
> available, so do this instead earlier in the file:
> 	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
> 

Doesn't that add a build dependency that is currently not required?
What is the advantage of this change?

Also, it would be very helpful if a list of changes was given for each
new revision of a patch.  Also add a revision number so that we know
that latest version (git format-patch --reroll-count=?).  There were
four revisions posted while I slept last night...

Finally, I did not see a direct answer to Roland's query about
justifying the change.  Well, one version of the patch got a commit
message - it would have been better to reply directly to that email and
establish that this change is indeed wanted.

Allan
Shawn Landden March 28, 2015, 5:55 a.m. UTC | #4
On Fri, Mar 27, 2015 at 11:46:28PM -0400, Mike Frysinger wrote:
> On 27 Mar 2015 14:39, Shawn Landden wrote:
> > --- a/configure.ac
> > +++ b/configure.ac
> >
> > -  nss_includes=-I$(nss-config --includedir 2>/dev/null)
> > +  nss_includes=$(pkg-config --cflags-only-I nss)
> 
> you cannot hardcode `pkg-config`.  you must respect $PKG_CONFIG.  normally 
> you'd use PKG_PROG_PKG_CONFIG, but that'd require an external pkg.m4 to be 
> available, so do this instead earlier in the file:
> 	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
We should actually just drop libnss3 support (netscape securiycurity services, libfreebl3)
as it doesn't make much sense to export these symbols and then use NSS's versions.
> 
> > --- /dev/null
> > +++ b/crypt/align.h
> >
> > +#define put_be32(p, v)	do { *(uint32_t *)(p) = be32toh(v); } while (0)
> > +#define put_be64(p, v)	do { *(uint64_t *)(p) = be64toh(v); } while (0)
> > +#define put_be32(p, v)	do { \
> > +	unsigned int __v = (v); \
> > +	*((unsigned char *)(p) + 0) = __v >> 24; \
> > +	*((unsigned char *)(p) + 1) = __v >> 16; \
> > +	*((unsigned char *)(p) + 2) = __v >>  8; \
> > +	*((unsigned char *)(p) + 3) = __v >>  0; } while (0)
> > +#define put_be64(p, v)	do { \
> > +	unsigned int __v = (v); \
> > +	*((unsigned char *)(p) + 0) = __v >> 56; \
> > +	*((unsigned char *)(p) + 1) = __v >> 48; \
> > +	*((unsigned char *)(p) + 2) = __v >> 40; \
> > +	*((unsigned char *)(p) + 3) = __v >> 32; \
> > +	*((unsigned char *)(p) + 4) = __v >> 24; \
> > +	*((unsigned char *)(p) + 5) = __v >> 16; \
> > +	*((unsigned char *)(p) + 6) = __v >>  8; \
> > +	*((unsigned char *)(p) + 7) = __v >>  0; } while (0)
> 
> these are like ... really bad.  they violate strict aliasing so hard.  just use 
> the macros already available in endian.h.  like htobe32 and htobe64.  which you 
> seem to use elsewhere in this patch already ;).
Those don't provide unaligned stores, or have anything to do with the alignment
issue I am dealing with here. And they are writing to a passed void * in
public function so the compiler can't do strict aliasing optimizations, so that is moot.

It would be poor API design to only allow writing to aligned addresses when the write
is short and minor compared to the overhead of the hash itsself.
 
> 
> > --- /dev/null
> > +++ b/crypt/sha2.h
> >
> > +typedef struct {
> > +  char __internal_state[176];
> > +} sha256_ctx __attribute__((aligned(16)));
> 
> this wasn't a problem before because you weren't installing the header, but now 
> that you are, you have to use __aligned__.
> 
> applies below too.
> 
> > +/* sha256() writes 32 bytes to md and returns md.
> > + * sha256_finish() writes 32 bytes to md and returns md.
> > + * sha224_finish() writes 28 bytes to md and returns md.
> > + * sha256_update() returns d.*/
> > +void *sha256(const void *__restrict d, size_t n, void *__restrict md);
> > +void sha256_init(sha256_ctx *s);
> > +const void *sha256_update(sha256_ctx *__restrict s, const void *__restrict d, size_t n);
> > +void *sha256_finish(sha256_ctx *__restrict s, void *__restrict md);
> > +void *sha224_finish(sha256_ctx *__restrict s, void *__restrict md);
> 
> comments about the api should be split before each function rather than one big 
> block.  you should also omit the names (like "d" or "n") as those cause 
> namespace issues.
> 
> applies below too.
> 
> you should also update the manual to document these.
Do people actually use info? Anyway yes, and when it goes it I will submit a patch to man-pages.
> 
> i did see some clean ups we might want to split out & merge regardless of 
> exporting the sha2 API (like deleting the SWAP ugliness).  although, considering 
> glibc already has this code in it, i don't have a problem with exporting them as 
> proper symbols (assuming the API is reasonable).
> -mike
Mike Frysinger March 28, 2015, 6:39 a.m. UTC | #5
On 28 Mar 2015 05:55, Shawn Landden wrote:
> On Fri, Mar 27, 2015 at 11:46:28PM -0400, Mike Frysinger wrote:
> > On 27 Mar 2015 14:39, Shawn Landden wrote:
> > > --- /dev/null
> > > +++ b/crypt/align.h
> > >
> > > +#define put_be32(p, v)	do { *(uint32_t *)(p) = be32toh(v); } while (0)
> > > +#define put_be64(p, v)	do { *(uint64_t *)(p) = be64toh(v); } while (0)
> > > +#define put_be32(p, v)	do { \
> > > +	unsigned int __v = (v); \
> > > +	*((unsigned char *)(p) + 0) = __v >> 24; \
> > > +	*((unsigned char *)(p) + 1) = __v >> 16; \
> > > +	*((unsigned char *)(p) + 2) = __v >>  8; \
> > > +	*((unsigned char *)(p) + 3) = __v >>  0; } while (0)
> > > +#define put_be64(p, v)	do { \
> > > +	unsigned int __v = (v); \
> > > +	*((unsigned char *)(p) + 0) = __v >> 56; \
> > > +	*((unsigned char *)(p) + 1) = __v >> 48; \
> > > +	*((unsigned char *)(p) + 2) = __v >> 40; \
> > > +	*((unsigned char *)(p) + 3) = __v >> 32; \
> > > +	*((unsigned char *)(p) + 4) = __v >> 24; \
> > > +	*((unsigned char *)(p) + 5) = __v >> 16; \
> > > +	*((unsigned char *)(p) + 6) = __v >>  8; \
> > > +	*((unsigned char *)(p) + 7) = __v >>  0; } while (0)
> > 
> > these are like ... really bad.  they violate strict aliasing so hard.  just use 
> > the macros already available in endian.h.  like htobe32 and htobe64.  which you 
> > seem to use elsewhere in this patch already ;).
>
> Those don't provide unaligned stores, or have anything to do with the alignment
> issue I am dealing with here. And they are writing to a passed void * in
> public function so the compiler can't do strict aliasing optimizations, so that is moot.

i was thinking the pointer type was higher than void*.

my concern wasn't related to alignment.  it's that this code is ugly as sin, and 
broken.  sizeof(int) is not guaranteed to be >=sizeof(int64) which is what this 
assumes, and you expand (p) multiple times.

the endian swaps won't help as they only take one arg ... was thinking the API 
was different.  for big endian hosts, this is a simple call to memcpy (and gcc 
can handle all the various arch details like direct stores on unaligned arches).

this API isn't specific to crypto.  if you're going to make a header out of it, 
should be merged into an existing endian.h imo.  include/endian.h has the 
advantage of not being exported.

> > you should also update the manual to document these.
>
> Do people actually use info? Anyway yes, and when it goes it I will submit a patch to man-pages.

people use HTML everyday
https://www.gnu.org/software/libc/manual/
-mike
Mike Frysinger March 28, 2015, 6:41 a.m. UTC | #6
On 27 Mar 2015 14:39, Shawn Landden wrote:
> +/* Process the remaining bytes in the internal buffer and the usual
> +   prolog according to the standard and write the result to RESBUF. */

two spaces after the period.  please check the whole patch.

> +void *
> +__sha224_finish_ctx (sha256_ctx *ctx, void *resbuf)
> +{
> +  __sha256_finish_ctx_generic (ctx);
>  
> -void
> -__sha256_process_bytes (buffer, len, ctx)
> +  /* Put result from CTX in first 28 bytes following RESBUF.  */
> +  for (unsigned int i = 0; i < 7; ++i)
> +    put_be32 (((uint32_t *) resbuf) + i, ctx->H[i]);

erm, looks to me like resbuf is no longer void* ...

> +extern void *__sha256(const void *__restrict d, size_t n, void *__restrict md) {

incorrect style: no extern, and the brace goes on a sep line
-mike
diff mbox

Patch

diff --git a/ChangeLog b/ChangeLog
index 4a5cd16..618dd2b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,22 @@ 
+2015-03-27  Shawn Landden  <shawn@churchofgit.com>
+
+	* crypt/sha2.h, crypt/Versions: new header for -lcrypt, with new exports.
+	* crypt/sha512.c, sha256.c sha512.c sha512.h:
+	New functions: sha384_finish(), sha224_finish(), sha256(), sha512()
+	Add crypt/align.h, *_finish() functions no longer require aligned digest.
+	*_finish() functions now return pointer to digest.
+	sha256_update(), sha512_update() now return pointer to data parameter.
+	Rename struct sha256_ctx => sha256_ctx, and struct sha512_ctx => sha512_ctx.
+	Move sha256_ctx.buflen after sha256_ctx.buffer so that sha256_ctx.buffer
+	  is 128-bit aligned.
+	Add padding to sha512_ctx so that sha512_ctx.buffer is 128-bit aligned.
+	(sha256_update, sha512_update, sha256_finish, sha224_finish, sha512_finish,
+	  sha384_finish): make pointer arguments __restrict.
+	(__sha256_process_bytes, __sha512_process_bytes): change parameter order to match
+	  sha256_update(), sha512_update().
+	* sysdeps: Add to ABI.
+        * configure.ac: use pkg-config instead of nss-config
+
 2015-03-08  Paul Pluzhnikov  <ppluzhnikov@google.com>
 
 	[BZ #16734]
diff --git a/configure.ac b/configure.ac
index 678c739..9fe74cb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -281,7 +281,7 @@  AC_ARG_ENABLE([nss-crypt],
 	      [nss_crypt=$enableval],
 	      [nss_crypt=no])
 if test x$nss_crypt = xyes; then
-  nss_includes=-I$(nss-config --includedir 2>/dev/null)
+  nss_includes=$(pkg-config --cflags-only-I nss)
   if test $? -ne 0; then
     AC_MSG_ERROR([cannot find include directory with nss-config])
   fi
diff --git a/crypt/Makefile b/crypt/Makefile
index 34c4dd7..3f839fc 100644
--- a/crypt/Makefile
+++ b/crypt/Makefile
@@ -22,13 +22,13 @@  subdir	:= crypt
 
 include ../Makeconfig
 
-headers := crypt.h
+headers := crypt.h sha2.h
 
 extra-libs := libcrypt
 extra-libs-others := $(extra-libs)
 
 libcrypt-routines := crypt-entry md5-crypt sha256-crypt sha512-crypt crypt \
-		     crypt_util
+		     crypt_util sha256 sha512
 
 tests := cert md5c-test sha256c-test sha512c-test badsalttest
 
@@ -42,7 +42,7 @@  CPPFLAGS-sha512-crypt.c = -DUSE_NSS -I$(shell nss-config --includedir)
 CPPFLAGS-md5-crypt.c = -DUSE_NSS -I$(shell nss-config --includedir)
 LDLIBS-crypt.so = -lfreebl3
 else
-libcrypt-routines += md5 sha256 sha512
+libcrypt-routines += md5
 
 tests += md5test sha256test sha512test
 
diff --git a/crypt/Versions b/crypt/Versions
index 389e7d5..69e06d9 100644
--- a/crypt/Versions
+++ b/crypt/Versions
@@ -2,4 +2,8 @@  libcrypt {
   GLIBC_2.0 {
     crypt; crypt_r; encrypt; encrypt_r; fcrypt; setkey; setkey_r;
   }
+  GLIBC_2.22 {
+    sha256; sha256_init; sha256_update; sha256_finish; sha224_finish;
+    sha512; sha512_init; sha512_update; sha512_finish; sha384_finish;
+  }
 }
diff --git a/crypt/align.h b/crypt/align.h
new file mode 100644
index 0000000..e7391f5
--- /dev/null
+++ b/crypt/align.h
@@ -0,0 +1,54 @@ 
+/*
+ * SHA2: The SHA2 family of cryptographic functions
+ *
+ * Copyright (C) 2015 Free Software Foundation, Inc.
+ *
+ * The GNU C Library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * The GNU C Library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with the GNU C Library; if not, see
+ * <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _ALIGN_H
+#define _ALIGN_H
+
+#include <endian.h>
+#include <string.h>
+
+/* These arches support unaligned memory accesses. */
+#if _STRING_ARCH_unaligned
+
+#define put_be32(p, v)	do { *(uint32_t *)(p) = be32toh(v); } while (0)
+#define put_be64(p, v)	do { *(uint64_t *)(p) = be64toh(v); } while (0)
+
+#else
+
+#define put_be32(p, v)	do { \
+	unsigned int __v = (v); \
+	*((unsigned char *)(p) + 0) = __v >> 24; \
+	*((unsigned char *)(p) + 1) = __v >> 16; \
+	*((unsigned char *)(p) + 2) = __v >>  8; \
+	*((unsigned char *)(p) + 3) = __v >>  0; } while (0)
+#define put_be64(p, v)	do { \
+	unsigned int __v = (v); \
+	*((unsigned char *)(p) + 0) = __v >> 56; \
+	*((unsigned char *)(p) + 1) = __v >> 48; \
+	*((unsigned char *)(p) + 2) = __v >> 40; \
+	*((unsigned char *)(p) + 3) = __v >> 32; \
+	*((unsigned char *)(p) + 4) = __v >> 24; \
+	*((unsigned char *)(p) + 5) = __v >> 16; \
+	*((unsigned char *)(p) + 6) = __v >>  8; \
+	*((unsigned char *)(p) + 7) = __v >>  0; } while (0)
+
+#endif
+
+#endif
diff --git a/crypt/sha2.h b/crypt/sha2.h
new file mode 100644
index 0000000..efc0661
--- /dev/null
+++ b/crypt/sha2.h
@@ -0,0 +1,54 @@ 
+/*
+ * SHA2: The SHA2 family of cryptographic functions
+ *
+ * Copyright (C) 2015 Free Software Foundation, Inc.
+ *
+ * The GNU C Library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * The GNU C Library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with the GNU C Library; if not, see
+ * <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _SHA2_H
+#define _SHA2_H
+
+#include <stdint.h>
+
+typedef struct {
+  char __internal_state[176];
+} sha256_ctx __attribute__((aligned(16)));
+
+/* sha256() writes 32 bytes to md and returns md.
+ * sha256_finish() writes 32 bytes to md and returns md.
+ * sha224_finish() writes 28 bytes to md and returns md.
+ * sha256_update() returns d.*/
+void *sha256(const void *__restrict d, size_t n, void *__restrict md);
+void sha256_init(sha256_ctx *s);
+const void *sha256_update(sha256_ctx *__restrict s, const void *__restrict d, size_t n);
+void *sha256_finish(sha256_ctx *__restrict s, void *__restrict md);
+void *sha224_finish(sha256_ctx *__restrict s, void *__restrict md);
+
+typedef struct {
+  char __internal_state[352];
+} sha512_ctx __attribute__((aligned(16)));
+
+/* sha512() writes 64 bytes to md and returns md.
+ * sha512_finish() writes 64 bytes to md and returns md.
+ * sha384_finish() writes 48 bytes to md and returns md.
+ * sha512_update() returns d.*/
+void *sha512(const void *__restrict d, size_t n, void *__restrict md);
+void sha512_init(sha512_ctx *s);
+const void *sha512_update(sha512_ctx *__restrict s, const void *__restrict d, size_t n);
+void *sha512_finish(sha512_ctx *__restrict s, void *__restrict md);
+void *sha384_finish(sha512_ctx *__restrict s, void *__restrict md);
+
+#endif
diff --git a/crypt/sha256-block.c b/crypt/sha256-block.c
index 8a77096..4fbf04b 100644
--- a/crypt/sha256-block.c
+++ b/crypt/sha256-block.c
@@ -3,7 +3,7 @@ 
 /* Process LEN bytes of BUFFER, accumulating context into CTX.
    It is assumed that LEN % 64 == 0.  */
 void
-sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
+sha256_process_block (const void *buffer, size_t len, sha256_ctx *ctx)
 {
   const uint32_t *words = buffer;
   size_t nwords = len / sizeof (uint32_t);
@@ -50,7 +50,7 @@  sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
       /* Compute the message schedule according to FIPS 180-2:6.2.2 step 2.  */
       for (unsigned int t = 0; t < 16; ++t)
 	{
-	  W[t] = SWAP (*words);
+	  W[t] = be32toh (*words);
 	  ++words;
 	}
       for (unsigned int t = 16; t < 64; ++t)
diff --git a/crypt/sha256-crypt.c b/crypt/sha256-crypt.c
index d90e291..cdefa60 100644
--- a/crypt/sha256-crypt.c
+++ b/crypt/sha256-crypt.c
@@ -68,7 +68,7 @@  typedef int PRBool;
   __sha256_init_ctx (ctxp)
 
 # define sha256_process_bytes(buf, len, ctxp, nss_ctxp) \
-  __sha256_process_bytes(buf, len, ctxp)
+  __sha256_process_bytes(ctxp, buf, len)
 
 # define sha256_finish_ctx(ctxp, nss_ctxp, result) \
   __sha256_finish_ctx (ctxp, result)
@@ -189,8 +189,8 @@  __sha256_crypt_r (key, salt, buffer, buflen)
   NSSLOWHASHContext *nss_ctx = NULL;
   NSSLOWHASHContext *nss_alt_ctx = NULL;
 #else
-  struct sha256_ctx ctx;
-  struct sha256_ctx alt_ctx;
+  sha256_ctx ctx;
+  sha256_ctx alt_ctx;
 #endif
 
   /* Prepare for the real work.  */
diff --git a/crypt/sha256.c b/crypt/sha256.c
index b6db8b2..5e359f8 100644
--- a/crypt/sha256.c
+++ b/crypt/sha256.c
@@ -30,30 +30,7 @@ 
 #include <sys/types.h>
 
 #include "sha256.h"
-
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-# ifdef _LIBC
-#  include <byteswap.h>
-#  define SWAP(n) bswap_32 (n)
-#  define SWAP64(n) bswap_64 (n)
-# else
-#  define SWAP(n) \
-    (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
-#  define SWAP64(n) \
-  (((n) << 56)					\
-   | (((n) & 0xff00) << 40)			\
-   | (((n) & 0xff0000) << 24)			\
-   | (((n) & 0xff000000) << 8)			\
-   | (((n) >> 8) & 0xff000000)			\
-   | (((n) >> 24) & 0xff0000)			\
-   | (((n) >> 40) & 0xff00)			\
-   | ((n) >> 56))
-# endif
-#else
-# define SWAP(n) (n)
-# define SWAP64(n) (n)
-#endif
-
+#include "align.h"
 
 /* This array contains the bytes used to pad the buffer to the next
    64-byte boundary.  (FIPS 180-2:5.1.1)  */
@@ -82,13 +59,13 @@  static const uint32_t K[64] =
   };
 
 void
-sha256_process_block (const void *, size_t, struct sha256_ctx *);
+sha256_process_block (const void *, size_t, sha256_ctx *);
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.2)  */
 void
 __sha256_init_ctx (ctx)
-     struct sha256_ctx *ctx;
+     sha256_ctx *ctx;
 {
   ctx->H[0] = 0x6a09e667;
   ctx->H[1] = 0xbb67ae85;
@@ -102,17 +79,10 @@  __sha256_init_ctx (ctx)
   ctx->total64 = 0;
   ctx->buflen = 0;
 }
+weak_alias(__sha256_init_ctx, sha256_init)
 
-
-/* Process the remaining bytes in the internal buffer and the usual
-   prolog according to the standard and write the result to RESBUF.
-
-   IMPORTANT: On some systems it is required that RESBUF is correctly
-   aligned for a 32 bits value.  */
-void *
-__sha256_finish_ctx (ctx, resbuf)
-     struct sha256_ctx *ctx;
-     void *resbuf;
+static void
+__sha256_finish_ctx_generic (sha256_ctx *ctx)
 {
   /* Take yet unprocessed bytes into account.  */
   uint32_t bytes = ctx->buflen;
@@ -125,30 +95,47 @@  __sha256_finish_ctx (ctx, resbuf)
   memcpy (&ctx->buffer[bytes], fillbuf, pad);
 
   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
-#if _STRING_ARCH_unaligned
-  ctx->buffer64[(bytes + pad) / 8] = SWAP64 (ctx->total64 << 3);
-#else
-  ctx->buffer32[(bytes + pad + 4) / 4] = SWAP (ctx->total[TOTAL64_low] << 3);
-  ctx->buffer32[(bytes + pad) / 4] = SWAP ((ctx->total[TOTAL64_high] << 3) |
-					   (ctx->total[TOTAL64_low] >> 29));
-#endif
+  ctx->buffer64[(bytes + pad) / 8] = be64toh (ctx->total64 << 3);
 
   /* Process last bytes.  */
   sha256_process_block (ctx->buffer, bytes + pad + 8, ctx);
+}
+
+/* Process the remaining bytes in the internal buffer and the usual
+   prolog according to the standard and write the result to RESBUF. */
+void *
+__sha256_finish_ctx (sha256_ctx *ctx, void *resbuf)
+{
+  __sha256_finish_ctx_generic (ctx);
 
   /* Put result from CTX in first 32 bytes following RESBUF.  */
   for (unsigned int i = 0; i < 8; ++i)
-    ((uint32_t *) resbuf)[i] = SWAP (ctx->H[i]);
+    put_be32 (((uint32_t *) resbuf) + i, ctx->H[i]);
 
   return resbuf;
 }
+weak_alias(__sha256_finish_ctx, sha256_finish)
 
+/* Process the remaining bytes in the internal buffer and the usual
+   prolog according to the standard and write the result to RESBUF. */
+void *
+__sha224_finish_ctx (sha256_ctx *ctx, void *resbuf)
+{
+  __sha256_finish_ctx_generic (ctx);
 
-void
-__sha256_process_bytes (buffer, len, ctx)
+  /* Put result from CTX in first 28 bytes following RESBUF.  */
+  for (unsigned int i = 0; i < 7; ++i)
+    put_be32 (((uint32_t *) resbuf) + i, ctx->H[i]);
+
+  return resbuf;
+}
+weak_alias(__sha224_finish_ctx, sha224_finish)
+
+const void *
+__sha256_process_bytes (ctx, buffer, len)
+     sha256_ctx *ctx;
      const void *buffer;
      size_t len;
-     struct sha256_ctx *ctx;
 {
   /* When we already have some bits in our internal buffer concatenate
      both inputs first.  */
@@ -216,6 +203,18 @@  __sha256_process_bytes (buffer, len, ctx)
 	}
       ctx->buflen = left_over;
     }
+
+  return buffer;
 }
+weak_alias(__sha256_process_bytes, sha256_update)
+
+extern void *__sha256(const void *__restrict d, size_t n, void *__restrict md) {
+	sha256_ctx ctx;
 
+	sha256_init(&ctx);
+	sha256_update(&ctx, d, n);
+	sha256_finish(&ctx, md);
+	return md;
+}
+weak_alias(__sha256, sha256)
 #include <sha256-block.c>
diff --git a/crypt/sha256.h b/crypt/sha256.h
index 27e0fe6..6b1bf60 100644
--- a/crypt/sha256.h
+++ b/crypt/sha256.h
@@ -27,7 +27,7 @@ 
 
 
 /* Structure to save state of computation between the single steps.  */
-struct sha256_ctx
+typedef struct
 {
   uint32_t H[8];
 
@@ -38,32 +38,39 @@  struct sha256_ctx
 #define TOTAL64_high (BYTE_ORDER == LITTLE_ENDIAN)
     uint32_t total[2];
   };
-  uint32_t buflen;
   union
   {
     char buffer[128];
     uint32_t buffer32[32];
     uint64_t buffer64[16];
   };
-};
+  uint32_t buflen;
+  uint8_t __padding[4];
+} sha256_ctx __attribute__((aligned(16)));
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2: 5.3.2)  */
-extern void __sha256_init_ctx (struct sha256_ctx *ctx) __THROW;
+extern void __sha256_init_ctx (sha256_ctx *__restrict ctx) __THROW;
 
 /* Starting with the result of former calls of this function (or the
    initialization function update the context for the next LEN bytes
    starting at BUFFER.
    It is NOT required that LEN is a multiple of 64.  */
-extern void __sha256_process_bytes (const void *buffer, size_t len,
-				    struct sha256_ctx *ctx) __THROW;
+extern const void *__sha256_process_bytes (sha256_ctx *__restrict ctx,
+			const void *__restrict buffer, size_t len) __THROW;
+
+/* Process the remaining bytes in the buffer and put result from CTX
+   in first 32 bytes following RESBUF. */
+extern void *__sha256_finish_ctx (sha256_ctx *__restrict ctx, void *__restrict resbuf)
+  __THROW;
 
 /* Process the remaining bytes in the buffer and put result from CTX
-   in first 32 bytes following RESBUF.
+   in first 28 bytes following RESBUF.
 
    IMPORTANT: On some systems it is required that RESBUF is correctly
    aligned for a 32 bits value.  */
-extern void *__sha256_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
+extern void *__sha224_finish_ctx (sha256_ctx *__restrict ctx, void *__restrict resbuf)
   __THROW;
 
+extern void *__sha256(const void *__restrict d, size_t n, void *__restrict md) __THROW;
 #endif /* sha256.h */
diff --git a/crypt/sha256test.c b/crypt/sha256test.c
index 39e8030..be46f69 100644
--- a/crypt/sha256test.c
+++ b/crypt/sha256test.c
@@ -44,7 +44,7 @@  static const struct
 int
 main (void)
 {
-  struct sha256_ctx ctx;
+  sha256_ctx ctx;
   char sum[32];
   int result = 0;
   int cnt;
@@ -52,8 +52,7 @@  main (void)
   for (cnt = 0; cnt < (int) (sizeof (tests) / sizeof (tests[0])); ++cnt)
     {
       __sha256_init_ctx (&ctx);
-      __sha256_process_bytes (tests[cnt].input, strlen (tests[cnt].input),
-			      &ctx);
+      __sha256_process_bytes (&ctx, tests[cnt].input, strlen (tests[cnt].input));
       __sha256_finish_ctx (&ctx, sum);
       if (memcmp (tests[cnt].result, sum, 32) != 0)
 	{
@@ -63,7 +62,7 @@  main (void)
 
       __sha256_init_ctx (&ctx);
       for (int i = 0; tests[cnt].input[i] != '\0'; ++i)
-	__sha256_process_bytes (&tests[cnt].input[i], 1, &ctx);
+	__sha256_process_bytes (&ctx, &tests[cnt].input[i], 1);
       __sha256_finish_ctx (&ctx, sum);
       if (memcmp (tests[cnt].result, sum, 32) != 0)
 	{
@@ -77,7 +76,7 @@  main (void)
   memset (buf, 'a', sizeof (buf));
   __sha256_init_ctx (&ctx);
   for (int i = 0; i < 1000; ++i)
-    __sha256_process_bytes (buf, sizeof (buf), &ctx);
+    __sha256_process_bytes (&ctx, buf, sizeof (buf));
   __sha256_finish_ctx (&ctx, sum);
   static const char expected[32] =
     "\xcd\xc7\x6e\x5c\x99\x14\xfb\x92\x81\xa1\xc7\xe2\x84\xd7\x3e\x67"
@@ -90,7 +89,7 @@  main (void)
 
   __sha256_init_ctx (&ctx);
   for (int i = 0; i < 100000; ++i)
-    __sha256_process_bytes (buf, 10, &ctx);
+    __sha256_process_bytes (&ctx, buf, 10);
   __sha256_finish_ctx (&ctx, sum);
   if (memcmp (expected, sum, 32) != 0)
     {
diff --git a/crypt/sha512-block.c b/crypt/sha512-block.c
index c542db1..45c2049 100644
--- a/crypt/sha512-block.c
+++ b/crypt/sha512-block.c
@@ -3,7 +3,7 @@ 
 /* Process LEN bytes of BUFFER, accumulating context into CTX.
    It is assumed that LEN % 128 == 0.  */
 void
-sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx)
+sha512_process_block (const void *buffer, size_t len, sha512_ctx *ctx)
 {
   const uint64_t *words = buffer;
   size_t nwords = len / sizeof (uint64_t);
@@ -57,7 +57,7 @@  sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx)
       /* Compute the message schedule according to FIPS 180-2:6.3.2 step 2.  */
       for (unsigned int t = 0; t < 16; ++t)
 	{
-	  W[t] = SWAP (*words);
+	  W[t] = be64toh (*words);
 	  ++words;
 	}
       for (unsigned int t = 16; t < 80; ++t)
diff --git a/crypt/sha512-crypt.c b/crypt/sha512-crypt.c
index 9c581ab..4cfecea 100644
--- a/crypt/sha512-crypt.c
+++ b/crypt/sha512-crypt.c
@@ -68,7 +68,7 @@  typedef int PRBool;
   __sha512_init_ctx (ctxp)
 
 # define sha512_process_bytes(buf, len, ctxp, nss_ctxp) \
-  __sha512_process_bytes(buf, len, ctxp)
+  __sha512_process_bytes(ctxp, buf, len)
 
 # define sha512_finish_ctx(ctxp, nss_ctxp, result) \
   __sha512_finish_ctx (ctxp, result)
@@ -188,8 +188,8 @@  __sha512_crypt_r (key, salt, buffer, buflen)
   NSSLOWHASHContext *nss_ctx = NULL;
   NSSLOWHASHContext *nss_alt_ctx = NULL;
 #else
-  struct sha512_ctx ctx;
-  struct sha512_ctx alt_ctx;
+  sha512_ctx ctx;
+  sha512_ctx alt_ctx;
 #endif
 
   /* Prepare for the real work.  */
diff --git a/crypt/sha512.c b/crypt/sha512.c
index 608de82..73f49cd 100644
--- a/crypt/sha512.c
+++ b/crypt/sha512.c
@@ -30,25 +30,7 @@ 
 #include <sys/types.h>
 
 #include "sha512.h"
-
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-# ifdef _LIBC
-#  include <byteswap.h>
-#  define SWAP(n) bswap_64 (n)
-# else
-#  define SWAP(n) \
-  (((n) << 56)					\
-   | (((n) & 0xff00) << 40)			\
-   | (((n) & 0xff0000) << 24)			\
-   | (((n) & 0xff000000) << 8)			\
-   | (((n) >> 8) & 0xff000000)			\
-   | (((n) >> 24) & 0xff0000)			\
-   | (((n) >> 40) & 0xff00)			\
-   | ((n) >> 56))
-# endif
-#else
-# define SWAP(n) (n)
-#endif
+#include "align.h"
 
 
 /* This array contains the bytes used to pad the buffer to the next
@@ -102,13 +84,13 @@  static const uint64_t K[80] =
   };
 
 void
-sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx);
+sha512_process_block (const void *buffer, size_t len, sha512_ctx *ctx);
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.3)  */
 void
 __sha512_init_ctx (ctx)
-     struct sha512_ctx *ctx;
+     sha512_ctx *ctx;
 {
   ctx->H[0] = UINT64_C (0x6a09e667f3bcc908);
   ctx->H[1] = UINT64_C (0xbb67ae8584caa73b);
@@ -122,17 +104,10 @@  __sha512_init_ctx (ctx)
   ctx->total[0] = ctx->total[1] = 0;
   ctx->buflen = 0;
 }
+weak_alias(__sha512_init_ctx, sha512_init)
 
-
-/* Process the remaining bytes in the internal buffer and the usual
-   prolog according to the standard and write the result to RESBUF.
-
-   IMPORTANT: On some systems it is required that RESBUF is correctly
-   aligned for a 32 bits value.  */
-void *
-__sha512_finish_ctx (ctx, resbuf)
-     struct sha512_ctx *ctx;
-     void *resbuf;
+static void
+__sha512_finish_ctx_generic (sha512_ctx *ctx)
 {
   /* Take yet unprocessed bytes into account.  */
   uint64_t bytes = ctx->buflen;
@@ -151,26 +126,49 @@  __sha512_finish_ctx (ctx, resbuf)
   memcpy (&ctx->buffer[bytes], fillbuf, pad);
 
   /* Put the 128-bit file length in *bits* at the end of the buffer.  */
-  ctx->buffer64[(bytes + pad + 8) / 8] = SWAP (ctx->total[TOTAL128_low] << 3);
-  ctx->buffer64[(bytes + pad) / 8] = SWAP ((ctx->total[TOTAL128_high] << 3) |
+  ctx->buffer64[(bytes + pad + 8) / 8] = be64toh (ctx->total[TOTAL128_low] << 3);
+  ctx->buffer64[(bytes + pad) / 8] = be64toh ((ctx->total[TOTAL128_high] << 3) |
 					   (ctx->total[TOTAL128_low] >> 61));
 
   /* Process last bytes.  */
   sha512_process_block (ctx->buffer, bytes + pad + 16, ctx);
+}
+
+/* Process the remaining bytes in the internal buffer and the usual
+   prolog according to the standard and write the result to RESBUF. */
+void *
+__sha512_finish_ctx (sha512_ctx *ctx, void *resbuf)
+{
+  __sha512_finish_ctx_generic (ctx);
 
   /* Put result from CTX in first 64 bytes following RESBUF.  */
   for (unsigned int i = 0; i < 8; ++i)
-    ((uint64_t *) resbuf)[i] = SWAP (ctx->H[i]);
+    put_be64(((uint64_t *) resbuf) + i, ctx->H[i]);
 
   return resbuf;
 }
+weak_alias(__sha512_finish_ctx, sha512_finish)
 
+/* Process the remaining bytes in the internal buffer and the usual
+   prolog according to the standard and write the result to RESBUF. */
+void *
+__sha384_finish_ctx (sha512_ctx *ctx, void *resbuf)
+{
+  __sha512_finish_ctx_generic (ctx);
 
-void
-__sha512_process_bytes (buffer, len, ctx)
+  /* Put result from CTX in first 48 bytes following RESBUF.  */
+  for (unsigned int i = 0; i < 6; ++i)
+    put_be64(((uint64_t *) resbuf) + i, ctx->H[i]);
+
+  return resbuf;
+}
+weak_alias(__sha384_finish_ctx, sha384_finish)
+
+const void *
+__sha512_process_bytes (ctx, buffer, len)
+     sha512_ctx *ctx;
      const void *buffer;
      size_t len;
-     struct sha512_ctx *ctx;
 {
   /* When we already have some bits in our internal buffer concatenate
      both inputs first.  */
@@ -239,6 +237,19 @@  __sha512_process_bytes (buffer, len, ctx)
 	}
       ctx->buflen = left_over;
     }
+
+  return buffer;
+}
+weak_alias(__sha512_process_bytes, sha512_update)
+
+extern void *__sha512(const void *__restrict d, size_t n, void *__restrict md) {
+	sha512_ctx ctx;
+
+	sha512_init(&ctx);
+	sha512_update(&ctx, d, n);
+	sha512_finish(&ctx, md);
+	return md;
 }
+weak_alias(__sha512, sha512)
 
 #include <sha512-block.c>
diff --git a/crypt/sha512.h b/crypt/sha512.h
index 159f000..359ea37 100644
--- a/crypt/sha512.h
+++ b/crypt/sha512.h
@@ -28,7 +28,7 @@ 
 
 
 /* Structure to save state of computation between the single steps.  */
-struct sha512_ctx
+typedef struct
 {
   uint64_t H[8];
 
@@ -43,30 +43,40 @@  struct sha512_ctx
     uint64_t total[2];
   };
   uint64_t buflen;
+  uint8_t __padding[8];
   union
   {
     char buffer[256];
     uint64_t buffer64[32];
   };
-};
+} sha512_ctx __attribute__((aligned(16)));
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2: 5.3.3)  */
-extern void __sha512_init_ctx (struct sha512_ctx *ctx) __THROW;
+extern void __sha512_init_ctx (sha512_ctx *__restrict ctx) __THROW;
 
 /* Starting with the result of former calls of this function (or the
    initialization function update the context for the next LEN bytes
    starting at BUFFER.
    It is NOT required that LEN is a multiple of 128.  */
-extern void __sha512_process_bytes (const void *buffer, size_t len,
-				    struct sha512_ctx *ctx) __THROW;
+extern const void *__sha512_process_bytes (sha512_ctx *__restrict ctx,
+				const void *__restrict buffer, size_t len) __THROW;
 
 /* Process the remaining bytes in the buffer and put result from CTX
    in first 64 bytes following RESBUF.
 
    IMPORTANT: On some systems it is required that RESBUF is correctly
    aligned for a 64 bits value.  */
-extern void *__sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf)
+extern void *__sha512_finish_ctx (sha512_ctx *ctx, void *__restrict resbuf)
   __THROW;
 
+/* Process the remaining bytes in the buffer and put result from CTX
+   in first 48 bytes following RESBUF.
+
+   IMPORTANT: On some systems it is required that RESBUF is correctly
+   aligned for a 64 bits value.  */
+extern void *__sha384_finish_ctx (sha512_ctx *ctx, void *__restrict resbuf)
+  __THROW;
+
+extern void *__sha512(const void *__restrict d, size_t n, void *__restrict md) __THROW;
 #endif /* sha512.h */
diff --git a/crypt/sha512test.c b/crypt/sha512test.c
index 792e9a7..296ce89 100644
--- a/crypt/sha512test.c
+++ b/crypt/sha512test.c
@@ -63,7 +63,7 @@  static const struct
 int
 main (void)
 {
-  struct sha512_ctx ctx;
+  sha512_ctx ctx;
   char sum[64];
   int result = 0;
   int cnt;
@@ -71,8 +71,7 @@  main (void)
   for (cnt = 0; cnt < (int) (sizeof (tests) / sizeof (tests[0])); ++cnt)
     {
       __sha512_init_ctx (&ctx);
-      __sha512_process_bytes (tests[cnt].input, strlen (tests[cnt].input),
-			      &ctx);
+      __sha512_process_bytes (&ctx, tests[cnt].input, strlen (tests[cnt].input));
       __sha512_finish_ctx (&ctx, sum);
       if (memcmp (tests[cnt].result, sum, 64) != 0)
 	{
@@ -82,7 +81,7 @@  main (void)
 
       __sha512_init_ctx (&ctx);
       for (int i = 0; tests[cnt].input[i] != '\0'; ++i)
-	__sha512_process_bytes (&tests[cnt].input[i], 1, &ctx);
+	__sha512_process_bytes (&ctx, &tests[cnt].input[i], 1);
       __sha512_finish_ctx (&ctx, sum);
       if (memcmp (tests[cnt].result, sum, 64) != 0)
 	{
@@ -96,7 +95,7 @@  main (void)
   memset (buf, 'a', sizeof (buf));
   __sha512_init_ctx (&ctx);
   for (int i = 0; i < 1000; ++i)
-    __sha512_process_bytes (buf, sizeof (buf), &ctx);
+    __sha512_process_bytes (&ctx, buf, sizeof (buf));
   __sha512_finish_ctx (&ctx, sum);
   static const char expected[64] =
     "\xe7\x18\x48\x3d\x0c\xe7\x69\x64\x4e\x2e\x42\xc7\xbc\x15\xb4\x63"
diff --git a/sysdeps/unix/sysv/linux/aarch64/libcrypt.abilist b/sysdeps/unix/sysv/linux/aarch64/libcrypt.abilist
index 177c536..0b1a14b 100644
--- a/sysdeps/unix/sysv/linux/aarch64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/aarch64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.17
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/alpha/libcrypt.abilist b/sysdeps/unix/sysv/linux/alpha/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/alpha/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/alpha/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/arm/libcrypt.abilist b/sysdeps/unix/sysv/linux/arm/libcrypt.abilist
index 8c874ed..806737d 100644
--- a/sysdeps/unix/sysv/linux/arm/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/arm/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.4
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/hppa/libcrypt.abilist b/sysdeps/unix/sysv/linux/hppa/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/hppa/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/hppa/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/i386/libcrypt.abilist b/sysdeps/unix/sysv/linux/i386/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/i386/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/i386/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/ia64/libcrypt.abilist b/sysdeps/unix/sysv/linux/ia64/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/ia64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/ia64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/m68k/coldfire/libcrypt.abilist b/sysdeps/unix/sysv/linux/m68k/coldfire/libcrypt.abilist
index 8c874ed..806737d 100644
--- a/sysdeps/unix/sysv/linux/m68k/coldfire/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/m68k/coldfire/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.4
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/m68k/m680x0/libcrypt.abilist b/sysdeps/unix/sysv/linux/m68k/m680x0/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/m68k/m680x0/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/m68k/m680x0/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/microblaze/libcrypt.abilist b/sysdeps/unix/sysv/linux/microblaze/libcrypt.abilist
index 0ac28c5..e43d483 100644
--- a/sysdeps/unix/sysv/linux/microblaze/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/microblaze/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.18
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/mips/mips32/libcrypt.abilist b/sysdeps/unix/sysv/linux/mips/mips32/libcrypt.abilist
index c548eee..23cccb8 100644
--- a/sysdeps/unix/sysv/linux/mips/mips32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/mips/mips32/libcrypt.abilist
@@ -9,3 +9,16 @@  GLIBC_2.0
  setkey_r F
 _gp_disp
  _gp_disp A
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
+
diff --git a/sysdeps/unix/sysv/linux/mips/mips64/libcrypt.abilist b/sysdeps/unix/sysv/linux/mips/mips64/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/mips/mips64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/mips/mips64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/nios2/libcrypt.abilist b/sysdeps/unix/sysv/linux/nios2/libcrypt.abilist
index dd5a89c..5e656b6 100644
--- a/sysdeps/unix/sysv/linux/nios2/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/nios2/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.21
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/powerpc/powerpc32/libcrypt.abilist b/sysdeps/unix/sysv/linux/powerpc/powerpc32/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/powerpc/powerpc32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/powerpc/powerpc32/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/powerpc/powerpc64/libcrypt.abilist b/sysdeps/unix/sysv/linux/powerpc/powerpc64/libcrypt.abilist
index a11230a..029eeeb 100644
--- a/sysdeps/unix/sysv/linux/powerpc/powerpc64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/powerpc/powerpc64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.3
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/s390/s390-32/libcrypt.abilist b/sysdeps/unix/sysv/linux/s390/s390-32/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/s390/s390-32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/s390/s390-32/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/s390/s390-64/libcrypt.abilist b/sysdeps/unix/sysv/linux/s390/s390-64/libcrypt.abilist
index e3bd54f..7670fc2 100644
--- a/sysdeps/unix/sysv/linux/s390/s390-64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/s390/s390-64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.2
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/sh/libcrypt.abilist b/sysdeps/unix/sysv/linux/sh/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/sh/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/sh/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/sparc/sparc32/libcrypt.abilist b/sysdeps/unix/sysv/linux/sparc/sparc32/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/sparc/sparc32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/sparc/sparc32/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/sparc/sparc64/libcrypt.abilist b/sysdeps/unix/sysv/linux/sparc/sparc64/libcrypt.abilist
index 1df145f..964f6bd 100644
--- a/sysdeps/unix/sysv/linux/sparc/sparc64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/sparc/sparc64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.0
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/libcrypt.abilist b/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/libcrypt.abilist
index 608e5df..5d13529 100644
--- a/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.12
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/libcrypt.abilist b/sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/libcrypt.abilist
index 608e5df..5d13529 100644
--- a/sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.12
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/tile/tilepro/libcrypt.abilist b/sysdeps/unix/sysv/linux/tile/tilepro/libcrypt.abilist
index 608e5df..5d13529 100644
--- a/sysdeps/unix/sysv/linux/tile/tilepro/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/tile/tilepro/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.12
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/x86_64/64/libcrypt.abilist b/sysdeps/unix/sysv/linux/x86_64/64/libcrypt.abilist
index 23d4ce0..3cd0764 100644
--- a/sysdeps/unix/sysv/linux/x86_64/64/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/x86_64/64/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.2.5
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F
diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/libcrypt.abilist b/sysdeps/unix/sysv/linux/x86_64/x32/libcrypt.abilist
index 1a52738..ea70f11 100644
--- a/sysdeps/unix/sysv/linux/x86_64/x32/libcrypt.abilist
+++ b/sysdeps/unix/sysv/linux/x86_64/x32/libcrypt.abilist
@@ -7,3 +7,15 @@  GLIBC_2.16
  fcrypt F
  setkey F
  setkey_r F
+GLIBC_2.22
+ GLIBC_2.22 A
+ sha224_finish F
+ sha256 F
+ sha256_finish F
+ sha256_init F
+ sha256_update F
+ sha384_finish F
+ sha512 F
+ sha512_finish F
+ sha512_init F
+ sha512_update F