On Mon, Apr 08, 2024 at 11:26:52AM +0200, Stefan Kanthak wrote: > @@ -315,11 +315,11 @@ > jne .Lloop0 > > /* Write hash values back in the correct order */ > - pshufd $0x1B, STATE0, STATE0 /* FEBA */ > - pshufd $0xB1, STATE1, STATE1 /* DCHG */ > movdqa STATE0, MSGTMP4 > - pblendw $0xF0, STATE1, STATE0 /* DCBA */ > - palignr $8, MSGTMP4, STATE1 /* HGFE */ > + punpcklqdq STATE1, STATE0 /* GHEF */ > + punpckhqdq MSGTMP4, STATE1 /* ABCD */ > + pshufd $0xB1, STATE0, STATE0 /* HGFE */ > + pshufd $0x1B, STATE1, STATE1 /* DCBA */ > > movdqu STATE0, 0*16(DIGEST_PTR) > movdqu STATE1, 1*16(DIGEST_PTR) Please make sure to run the crypto self-tests too. The above is storing the two halves of the state in the wrong order. Thanks, - Eric
