scrypt.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598
  1. /*-
  2. * Copyright 2009 Colin Percival
  3. * Copyright 2011 ArtForz
  4. * Copyright 2014 Luke Dashjr
  5. * All rights reserved.
  6. *
  7. * Redistribution and use in source and binary forms, with or without
  8. * modification, are permitted provided that the following conditions
  9. * are met:
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in the
  14. * documentation and/or other materials provided with the distribution.
  15. *
  16. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26. * SUCH DAMAGE.
  27. *
  28. * This file was originally written by Colin Percival as part of the Tarsnap
  29. * online backup system.
  30. */
  31. #include "config.h"
  32. #include "miner.h"
  33. #include <math.h>
  34. #include <stdlib.h>
  35. #include <stdbool.h>
  36. #include <stdint.h>
  37. #include <string.h>
  38. #include <uthash.h>
  39. typedef struct SHA256Context {
  40. uint32_t state[8];
  41. uint32_t buf[16];
  42. } SHA256_CTX;
  43. /*
  44. * Encode a length len/4 vector of (uint32_t) into a length len vector of
  45. * (unsigned char) in big-endian form. Assumes len is a multiple of 4.
  46. */
  47. static inline void
  48. be32enc_vect(uint32_t *dst, const uint32_t *src, uint32_t len)
  49. {
  50. uint32_t i;
  51. for (i = 0; i < len; i++)
  52. dst[i] = htobe32(src[i]);
  53. }
  54. /* Elementary functions used by SHA256 */
  55. #define Ch(x, y, z) ((x & (y ^ z)) ^ z)
  56. #define Maj(x, y, z) ((x & (y | z)) | (y & z))
  57. #define SHR(x, n) (x >> n)
  58. #define ROTR(x, n) ((x >> n) | (x << (32 - n)))
  59. #define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
  60. #define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
  61. #define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
  62. #define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
  63. /* SHA256 round function */
  64. #define RND(a, b, c, d, e, f, g, h, k) \
  65. t0 = h + S1(e) + Ch(e, f, g) + k; \
  66. t1 = S0(a) + Maj(a, b, c); \
  67. d += t0; \
  68. h = t0 + t1;
  69. /* Adjusted round function for rotating state */
  70. #define RNDr(S, W, i, k) \
  71. RND(S[(64 - i) % 8], S[(65 - i) % 8], \
  72. S[(66 - i) % 8], S[(67 - i) % 8], \
  73. S[(68 - i) % 8], S[(69 - i) % 8], \
  74. S[(70 - i) % 8], S[(71 - i) % 8], \
  75. W[i] + k)
  76. /*
  77. * SHA256 block compression function. The 256-bit state is transformed via
  78. * the 512-bit input block to produce a new state.
  79. */
  80. static void
  81. SHA256_Transform(uint32_t * state, const uint32_t block[16], int swap)
  82. {
  83. uint32_t W[64];
  84. uint32_t S[8];
  85. uint32_t t0, t1;
  86. int i;
  87. /* 1. Prepare message schedule W. */
  88. if(swap)
  89. for (i = 0; i < 16; i++)
  90. W[i] = swab32(block[i]);
  91. else
  92. memcpy(W, block, 64);
  93. for (i = 16; i < 64; i += 2) {
  94. W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
  95. W[i+1] = s1(W[i - 1]) + W[i - 6] + s0(W[i - 14]) + W[i - 15];
  96. }
  97. /* 2. Initialize working variables. */
  98. memcpy(S, state, 32);
  99. /* 3. Mix. */
  100. RNDr(S, W, 0, 0x428a2f98);
  101. RNDr(S, W, 1, 0x71374491);
  102. RNDr(S, W, 2, 0xb5c0fbcf);
  103. RNDr(S, W, 3, 0xe9b5dba5);
  104. RNDr(S, W, 4, 0x3956c25b);
  105. RNDr(S, W, 5, 0x59f111f1);
  106. RNDr(S, W, 6, 0x923f82a4);
  107. RNDr(S, W, 7, 0xab1c5ed5);
  108. RNDr(S, W, 8, 0xd807aa98);
  109. RNDr(S, W, 9, 0x12835b01);
  110. RNDr(S, W, 10, 0x243185be);
  111. RNDr(S, W, 11, 0x550c7dc3);
  112. RNDr(S, W, 12, 0x72be5d74);
  113. RNDr(S, W, 13, 0x80deb1fe);
  114. RNDr(S, W, 14, 0x9bdc06a7);
  115. RNDr(S, W, 15, 0xc19bf174);
  116. RNDr(S, W, 16, 0xe49b69c1);
  117. RNDr(S, W, 17, 0xefbe4786);
  118. RNDr(S, W, 18, 0x0fc19dc6);
  119. RNDr(S, W, 19, 0x240ca1cc);
  120. RNDr(S, W, 20, 0x2de92c6f);
  121. RNDr(S, W, 21, 0x4a7484aa);
  122. RNDr(S, W, 22, 0x5cb0a9dc);
  123. RNDr(S, W, 23, 0x76f988da);
  124. RNDr(S, W, 24, 0x983e5152);
  125. RNDr(S, W, 25, 0xa831c66d);
  126. RNDr(S, W, 26, 0xb00327c8);
  127. RNDr(S, W, 27, 0xbf597fc7);
  128. RNDr(S, W, 28, 0xc6e00bf3);
  129. RNDr(S, W, 29, 0xd5a79147);
  130. RNDr(S, W, 30, 0x06ca6351);
  131. RNDr(S, W, 31, 0x14292967);
  132. RNDr(S, W, 32, 0x27b70a85);
  133. RNDr(S, W, 33, 0x2e1b2138);
  134. RNDr(S, W, 34, 0x4d2c6dfc);
  135. RNDr(S, W, 35, 0x53380d13);
  136. RNDr(S, W, 36, 0x650a7354);
  137. RNDr(S, W, 37, 0x766a0abb);
  138. RNDr(S, W, 38, 0x81c2c92e);
  139. RNDr(S, W, 39, 0x92722c85);
  140. RNDr(S, W, 40, 0xa2bfe8a1);
  141. RNDr(S, W, 41, 0xa81a664b);
  142. RNDr(S, W, 42, 0xc24b8b70);
  143. RNDr(S, W, 43, 0xc76c51a3);
  144. RNDr(S, W, 44, 0xd192e819);
  145. RNDr(S, W, 45, 0xd6990624);
  146. RNDr(S, W, 46, 0xf40e3585);
  147. RNDr(S, W, 47, 0x106aa070);
  148. RNDr(S, W, 48, 0x19a4c116);
  149. RNDr(S, W, 49, 0x1e376c08);
  150. RNDr(S, W, 50, 0x2748774c);
  151. RNDr(S, W, 51, 0x34b0bcb5);
  152. RNDr(S, W, 52, 0x391c0cb3);
  153. RNDr(S, W, 53, 0x4ed8aa4a);
  154. RNDr(S, W, 54, 0x5b9cca4f);
  155. RNDr(S, W, 55, 0x682e6ff3);
  156. RNDr(S, W, 56, 0x748f82ee);
  157. RNDr(S, W, 57, 0x78a5636f);
  158. RNDr(S, W, 58, 0x84c87814);
  159. RNDr(S, W, 59, 0x8cc70208);
  160. RNDr(S, W, 60, 0x90befffa);
  161. RNDr(S, W, 61, 0xa4506ceb);
  162. RNDr(S, W, 62, 0xbef9a3f7);
  163. RNDr(S, W, 63, 0xc67178f2);
  164. /* 4. Mix local working variables into global state */
  165. for (i = 0; i < 8; i++)
  166. state[i] += S[i];
  167. }
  168. static inline void
  169. SHA256_InitState(uint32_t * state)
  170. {
  171. /* Magic initialization constants */
  172. state[0] = 0x6A09E667;
  173. state[1] = 0xBB67AE85;
  174. state[2] = 0x3C6EF372;
  175. state[3] = 0xA54FF53A;
  176. state[4] = 0x510E527F;
  177. state[5] = 0x9B05688C;
  178. state[6] = 0x1F83D9AB;
  179. state[7] = 0x5BE0CD19;
  180. }
  181. static const uint32_t passwdpad[12] = {0x00000080, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x80020000};
  182. static const uint32_t outerpad[8] = {0x80000000, 0, 0, 0, 0, 0, 0, 0x00000300};
  183. /**
  184. * PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
  185. * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
  186. * write the output to buf. The value dkLen must be at most 32 * (2^32 - 1).
  187. */
  188. static inline void
  189. PBKDF2_SHA256_80_128(const uint32_t * passwd, uint32_t * buf)
  190. {
  191. SHA256_CTX PShictx, PShoctx;
  192. uint32_t tstate[8];
  193. uint32_t ihash[8];
  194. uint32_t i;
  195. uint32_t pad[16];
  196. static const uint32_t innerpad[11] = {0x00000080, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xa0040000};
  197. /* If Klen > 64, the key is really SHA256(K). */
  198. SHA256_InitState(tstate);
  199. SHA256_Transform(tstate, passwd, 1);
  200. memcpy(pad, passwd+16, 16);
  201. memcpy(pad+4, passwdpad, 48);
  202. SHA256_Transform(tstate, pad, 1);
  203. memcpy(ihash, tstate, 32);
  204. SHA256_InitState(PShictx.state);
  205. for (i = 0; i < 8; i++)
  206. pad[i] = ihash[i] ^ 0x36363636;
  207. for (; i < 16; i++)
  208. pad[i] = 0x36363636;
  209. SHA256_Transform(PShictx.state, pad, 0);
  210. SHA256_Transform(PShictx.state, passwd, 1);
  211. be32enc_vect(PShictx.buf, passwd+16, 4);
  212. be32enc_vect(PShictx.buf+5, innerpad, 11);
  213. SHA256_InitState(PShoctx.state);
  214. for (i = 0; i < 8; i++)
  215. pad[i] = ihash[i] ^ 0x5c5c5c5c;
  216. for (; i < 16; i++)
  217. pad[i] = 0x5c5c5c5c;
  218. SHA256_Transform(PShoctx.state, pad, 0);
  219. memcpy(PShoctx.buf+8, outerpad, 32);
  220. /* Iterate through the blocks. */
  221. swap32tole(PShictx.buf, PShictx.buf, 0x10);
  222. for (i = 0; i < 4; i++) {
  223. uint32_t istate[8];
  224. uint32_t ostate[8];
  225. memcpy(istate, PShictx.state, 32);
  226. PShictx.buf[4] = i + 1;
  227. SHA256_Transform(istate, PShictx.buf, 0);
  228. memcpy(PShoctx.buf, istate, 32);
  229. memcpy(ostate, PShoctx.state, 32);
  230. SHA256_Transform(ostate, PShoctx.buf, 0);
  231. swap32yes(buf+i*8, ostate, 8);
  232. }
  233. }
  234. static inline void
  235. PBKDF2_SHA256_80_128_32(const uint32_t * passwd, const uint32_t * salt, uint32_t *ostate)
  236. {
  237. uint32_t tstate[8];
  238. uint32_t ihash[8];
  239. uint32_t i;
  240. /* Compute HMAC state after processing P and S. */
  241. uint32_t pad[16];
  242. static const uint32_t ihash_finalblk[16] = {0x00000001,0x80000000,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0x00000620};
  243. /* If Klen > 64, the key is really SHA256(K). */
  244. SHA256_InitState(tstate);
  245. SHA256_Transform(tstate, passwd, 1);
  246. memcpy(pad, passwd+16, 16);
  247. memcpy(pad+4, passwdpad, 48);
  248. SHA256_Transform(tstate, pad, 1);
  249. memcpy(ihash, tstate, 32);
  250. SHA256_InitState(ostate);
  251. for (i = 0; i < 8; i++)
  252. pad[i] = ihash[i] ^ 0x5c5c5c5c;
  253. for (; i < 16; i++)
  254. pad[i] = 0x5c5c5c5c;
  255. SHA256_Transform(ostate, pad, 0);
  256. SHA256_InitState(tstate);
  257. for (i = 0; i < 8; i++)
  258. pad[i] = ihash[i] ^ 0x36363636;
  259. for (; i < 16; i++)
  260. pad[i] = 0x36363636;
  261. SHA256_Transform(tstate, pad, 0);
  262. SHA256_Transform(tstate, salt, 1);
  263. SHA256_Transform(tstate, salt+16, 1);
  264. SHA256_Transform(tstate, ihash_finalblk, 0);
  265. memcpy(pad, tstate, 32);
  266. memcpy(pad+8, outerpad, 32);
  267. /* Feed the inner hash to the outer SHA256 operation. */
  268. SHA256_Transform(ostate, pad, 0);
  269. }
  270. /**
  271. * salsa20_8(B):
  272. * Apply the salsa20/8 core to the provided block.
  273. */
  274. static inline void
  275. salsa20_8(uint32_t B[16], const uint32_t Bx[16])
  276. {
  277. uint32_t x00,x01,x02,x03,x04,x05,x06,x07,x08,x09,x10,x11,x12,x13,x14,x15;
  278. size_t i;
  279. x00 = (B[ 0] ^= Bx[ 0]);
  280. x01 = (B[ 1] ^= Bx[ 1]);
  281. x02 = (B[ 2] ^= Bx[ 2]);
  282. x03 = (B[ 3] ^= Bx[ 3]);
  283. x04 = (B[ 4] ^= Bx[ 4]);
  284. x05 = (B[ 5] ^= Bx[ 5]);
  285. x06 = (B[ 6] ^= Bx[ 6]);
  286. x07 = (B[ 7] ^= Bx[ 7]);
  287. x08 = (B[ 8] ^= Bx[ 8]);
  288. x09 = (B[ 9] ^= Bx[ 9]);
  289. x10 = (B[10] ^= Bx[10]);
  290. x11 = (B[11] ^= Bx[11]);
  291. x12 = (B[12] ^= Bx[12]);
  292. x13 = (B[13] ^= Bx[13]);
  293. x14 = (B[14] ^= Bx[14]);
  294. x15 = (B[15] ^= Bx[15]);
  295. for (i = 0; i < 8; i += 2) {
  296. #define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))
  297. /* Operate on columns. */
  298. x04 ^= R(x00+x12, 7); x09 ^= R(x05+x01, 7); x14 ^= R(x10+x06, 7); x03 ^= R(x15+x11, 7);
  299. x08 ^= R(x04+x00, 9); x13 ^= R(x09+x05, 9); x02 ^= R(x14+x10, 9); x07 ^= R(x03+x15, 9);
  300. x12 ^= R(x08+x04,13); x01 ^= R(x13+x09,13); x06 ^= R(x02+x14,13); x11 ^= R(x07+x03,13);
  301. x00 ^= R(x12+x08,18); x05 ^= R(x01+x13,18); x10 ^= R(x06+x02,18); x15 ^= R(x11+x07,18);
  302. /* Operate on rows. */
  303. x01 ^= R(x00+x03, 7); x06 ^= R(x05+x04, 7); x11 ^= R(x10+x09, 7); x12 ^= R(x15+x14, 7);
  304. x02 ^= R(x01+x00, 9); x07 ^= R(x06+x05, 9); x08 ^= R(x11+x10, 9); x13 ^= R(x12+x15, 9);
  305. x03 ^= R(x02+x01,13); x04 ^= R(x07+x06,13); x09 ^= R(x08+x11,13); x14 ^= R(x13+x12,13);
  306. x00 ^= R(x03+x02,18); x05 ^= R(x04+x07,18); x10 ^= R(x09+x08,18); x15 ^= R(x14+x13,18);
  307. #undef R
  308. }
  309. B[ 0] += x00;
  310. B[ 1] += x01;
  311. B[ 2] += x02;
  312. B[ 3] += x03;
  313. B[ 4] += x04;
  314. B[ 5] += x05;
  315. B[ 6] += x06;
  316. B[ 7] += x07;
  317. B[ 8] += x08;
  318. B[ 9] += x09;
  319. B[10] += x10;
  320. B[11] += x11;
  321. B[12] += x12;
  322. B[13] += x13;
  323. B[14] += x14;
  324. B[15] += x15;
  325. }
  326. /* cpu and memory intensive function to transform a 80 byte buffer into a 32 byte output
  327. scratchpad size needs to be at least 63 + (128 * r * p) + (256 * r + 64) + (128 * r * N) bytes
  328. */
  329. static void scrypt_1024_1_1_256_sp(const uint32_t* input, char* scratchpad, uint32_t *ostate)
  330. {
  331. uint32_t * V;
  332. uint32_t X[32];
  333. uint32_t i;
  334. uint32_t j;
  335. uint32_t k;
  336. uint64_t *p1, *p2;
  337. p1 = (uint64_t *)X;
  338. V = (uint32_t *)(((uintptr_t)(scratchpad) + 63) & ~ (uintptr_t)(63));
  339. PBKDF2_SHA256_80_128(input, X);
  340. for (i = 0; i < 1024; i += 2) {
  341. memcpy(&V[i * 32], X, 128);
  342. salsa20_8(&X[0], &X[16]);
  343. salsa20_8(&X[16], &X[0]);
  344. memcpy(&V[(i + 1) * 32], X, 128);
  345. salsa20_8(&X[0], &X[16]);
  346. salsa20_8(&X[16], &X[0]);
  347. }
  348. for (i = 0; i < 1024; i += 2) {
  349. j = X[16] & 1023;
  350. p2 = (uint64_t *)(&V[j * 32]);
  351. for(k = 0; k < 16; k++)
  352. p1[k] ^= p2[k];
  353. salsa20_8(&X[0], &X[16]);
  354. salsa20_8(&X[16], &X[0]);
  355. j = X[16] & 1023;
  356. p2 = (uint64_t *)(&V[j * 32]);
  357. for(k = 0; k < 16; k++)
  358. p1[k] ^= p2[k];
  359. salsa20_8(&X[0], &X[16]);
  360. salsa20_8(&X[16], &X[0]);
  361. }
  362. PBKDF2_SHA256_80_128_32(input, X, ostate);
  363. }
  364. /* 131583 rounded up to 4 byte alignment */
  365. #define SCRATCHBUF_SIZE (131584)
  366. static
  367. void bin2hex32(char * const out_hex, const uint32_t * const data, const size_t n)
  368. {
  369. uint32_t dataswap[n];
  370. swap32tobe(dataswap, data, n);
  371. bin2hex(out_hex, dataswap, n * 4);
  372. }
  373. void test_scrypt(void)
  374. {
  375. static const uint32_t input[20] = {0};
  376. uint32_t X[32];
  377. char hex[257];
  378. {
  379. PBKDF2_SHA256_80_128(input, X);
  380. static const uint32_t expect_X[] = {
  381. 0x0ea9ea2c, 0x458a4459, 0xac2e8931, 0x227bb8f5,
  382. 0xf2b1fe63, 0x65f4ca78, 0xc13ee80a, 0x9dd6a8b9,
  383. 0x37a70962, 0xce24556e, 0x169081af, 0x73a06c4c,
  384. 0x7feffbbe, 0x90188614, 0x499f4152, 0x174f00cf,
  385. 0x5a2f89a9, 0x9f98d171, 0x2ff50782, 0xc8c551b1,
  386. 0xcf4afba2, 0x089745f0, 0x37553b1f, 0xbca60eec,
  387. 0x193ed225, 0x0d4c2da1, 0x4a670674, 0x4420645c,
  388. 0x432ead7e, 0xa70b8496, 0x1d992334, 0x842b14de,
  389. };
  390. if (memcmp(expect_X, X, sizeof(expect_X)))
  391. {
  392. ++unittest_failures;
  393. bin2hex32(hex, X, 32);
  394. applog(LOG_ERR, "%s: %s failed (got %s)", __func__, "PBKDF2_SHA256_80_128", hex);
  395. }
  396. }
  397. {
  398. for (int i = 0; i < 0x10; ++i)
  399. X[i] = i;
  400. salsa20_8(X, input);
  401. static const uint32_t expect_X[] = {
  402. 0x4fdd18f5, 0xe08388b9, 0xc05479a8, 0x7086ab5c,
  403. 0x0888bb83, 0x75102855, 0x58a08522, 0x166cf522,
  404. 0x0f2a4a9d, 0x232514d2, 0x0bc658d7, 0x681b4136,
  405. 0x0586532d, 0xd271b814, 0x2a045976, 0x5d47fa5a,
  406. };
  407. if (memcmp(expect_X, X, sizeof(expect_X)))
  408. {
  409. ++unittest_failures;
  410. bin2hex32(hex, X, 16);
  411. applog(LOG_ERR, "%s; %s failed (got %s)", __func__, "salsa20_8", hex);
  412. }
  413. }
  414. {
  415. char scratchpad[SCRATCHBUF_SIZE];
  416. scrypt_1024_1_1_256_sp(input, scratchpad, X);
  417. static const uint32_t expect_X[] = {
  418. 0x161d0876, 0xf3b93b10, 0x48cda1bd, 0xeaa7332e,
  419. 0xe210f713, 0x1b42013c, 0xb43913a6, 0x553a4b69,
  420. };
  421. if (memcmp(expect_X, X, sizeof(expect_X)))
  422. {
  423. ++unittest_failures;
  424. bin2hex32(hex, X, 8);
  425. applog(LOG_ERR, "%s: %s failed (got %s)", __func__, "scrypt_1024_1_1_256_sp", hex);
  426. }
  427. }
  428. }
  429. void scrypt_regenhash(struct work *work)
  430. {
  431. uint32_t data[20];
  432. char *scratchbuf;
  433. uint32_t *nonce = (uint32_t *)(work->data + 76);
  434. uint32_t *ohash = (uint32_t *)(work->hash);
  435. be32enc_vect(data, (const uint32_t *)work->data, 19);
  436. data[19] = htobe32(*nonce);
  437. scratchbuf = alloca(SCRATCHBUF_SIZE);
  438. scrypt_1024_1_1_256_sp(data, scratchbuf, ohash);
  439. swap32tobe(ohash, ohash, 8);
  440. }
  441. /* Used by test_nonce functions */
  442. void scrypt_hash_data(void * const out_hash, const void * const pdata)
  443. {
  444. uint32_t data[20], ohash[8];
  445. char *scratchbuf;
  446. be32enc_vect(data, pdata, 20);
  447. scratchbuf = alloca(SCRATCHBUF_SIZE);
  448. scrypt_1024_1_1_256_sp(data, scratchbuf, ohash);
  449. swap32tobe(out_hash, ohash, 32/4);
  450. }
  451. bool scanhash_scrypt(struct thr_info * const thr, struct work * const work,
  452. uint32_t max_nonce, uint32_t *last_nonce, uint32_t n)
  453. {
  454. uint8_t * const pdata = work->data;
  455. const uint8_t * const ptarget = work->target;
  456. uint32_t *nonce = (uint32_t *)(pdata + 76);
  457. char *scratchbuf;
  458. uint32_t data[20];
  459. uint32_t tmp_hash7;
  460. uint32_t Htarg = le32toh(((const uint32_t *)ptarget)[7]);
  461. bool ret = false;
  462. be32enc_vect(data, (const uint32_t *)pdata, 19);
  463. scratchbuf = malloc(SCRATCHBUF_SIZE);
  464. if (unlikely(!scratchbuf)) {
  465. applog(LOG_ERR, "Failed to malloc scratchbuf in scanhash_scrypt");
  466. return ret;
  467. }
  468. while(1) {
  469. uint32_t ostate[8];
  470. data[19] = n;
  471. scrypt_1024_1_1_256_sp(data, scratchbuf, ostate);
  472. tmp_hash7 = swab32(ostate[7]);
  473. if (unlikely(tmp_hash7 <= Htarg)) {
  474. *nonce = htobe32(n);
  475. ret = true;
  476. break;
  477. }
  478. if (unlikely((n >= max_nonce) || thr->work_restart)) {
  479. break;
  480. }
  481. ++n;
  482. }
  483. *last_nonce = n;
  484. free(scratchbuf);
  485. return ret;
  486. }
  487. #ifdef USE_OPENCL
  488. static
  489. float opencl_oclthreads_to_intensity_scrypt(const unsigned long oclthreads)
  490. {
  491. return log2(oclthreads);
  492. }
  493. static
  494. unsigned long opencl_intensity_to_oclthreads_scrypt(float intensity)
  495. {
  496. return pow(2, intensity);
  497. }
  498. static
  499. char *opencl_get_default_kernel_file_scrypt(const struct mining_algorithm * const malgo, struct cgpu_info * const cgpu, struct _clState * const clState)
  500. {
  501. return strdup("scrypt");
  502. }
  503. #endif
  504. struct mining_algorithm malgo_scrypt = {
  505. .name = "scrypt",
  506. .aliases = "scrypt",
  507. .algo = POW_SCRYPT,
  508. .ui_skip_hash_bytes = 2,
  509. .reasonable_low_nonce_diff = 1./0x10000,
  510. .hash_data_f = scrypt_hash_data,
  511. #ifdef USE_OPENCL
  512. .opencl_oclthreads_to_intensity = opencl_oclthreads_to_intensity_scrypt,
  513. .opencl_intensity_to_oclthreads = opencl_intensity_to_oclthreads_scrypt,
  514. .opencl_min_oclthreads = 0x100, // intensity 8
  515. .opencl_max_oclthreads = 0x20000000, // intensity 31
  516. .opencl_min_nonce_diff = 1./0x10000,
  517. .opencl_get_default_kernel_file = opencl_get_default_kernel_file_scrypt,
  518. #endif
  519. };
  520. static
  521. __attribute__((constructor))
  522. void init_scrypt(void)
  523. {
  524. LL_APPEND(mining_algorithms, (&malgo_scrypt));
  525. }