From nobody Sat Aug 29 02:28:29 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWzhM2Qmmz6q4n5 for ; Sat, 29 Aug 2026 02:28:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWzhL6D9wz3sK8 for ; Sat, 29 Aug 2026 02:28:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787970514; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gEjpCETbcQYd1QLiFz3mKO1FY0tCcBU0vPhkMGnFZX8=; b=I5RF5ZXHIKhBN6znK1fFbGN619eJkIJAqTn0y4GyXiic9vO3Er8rCRtZFKgceG1IXRU9VT 1djvuUa+dzNBw873RGfKFD9PQG6iVIld1VRE7mghgaaLxXCvn0oBT6WFP7kyP0NxqtkOKD BOwiu6VcFoxW/5njWRHjUfKjo2UtF1cPEzFExpPP8xlgj0kbQ1SUB0HpIUw3FQ1KGUqoHv OFFci70Kk8IIJ/AEisvO1cz5T57EtnekBr629+5UiLKY4HOhXjPuHoz9vL+4SuIl9OQ5W8 Zh7peRq62XKoLJb61WaS9DTP0OUFkFE4aaFFj/JQGOQDqq1gGjxbqBIaGvXVxA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787970514; a=rsa-sha256; cv=none; b=f2EimQC7cErtdA9l6cBEPAVmoq4ABzmD2b1BJ5HHmOT6c7HqUHlhSNvEoWffT6nhg0yNlN KfVrt/pg6oUYjNJXA3fl1sRz5DPuo1EZjn1hOzbbBWcWccB7K9W38lH3OFMGbV5I86pt2h M5oYYoCpMmS95L00NDQDC5/DsaZQuXgD5i9M27zBXNDk/hWJzDA7ya7UnB1isLhjWSArgK ANXdbOGWyYV+92BOsUv68hEd32y1gN7YOb4NVMOvowOqTkZ4BXPbjPLdM3aKAjhiMA6slJ rHYSZ3jFfx+7aZ5MOBSk5CZvHzeGH09MaV026wUmxkyI9RGdG2U9Vr338qgWvg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787970514; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gEjpCETbcQYd1QLiFz3mKO1FY0tCcBU0vPhkMGnFZX8=; b=bvfaR157A6CT6FyzopBpDzSjUz3I7l2rot9d0kR9pdC5d827Ro1Hl7VaBuWJS7QH3OgZdA XEL/NCLm16bDGxu4dhcpf3H/0aleWAfDyH7cdBP6Isz8z+K21wXPbeN/WTQzOphd39bS21 j0+ajv+OwYPsBt5s44RthxXwxGiiCSo/J5klJ0zFoD8ELQBf0MeVrg0DUDKgM/hzzA52BZ mwn56dlGunaY6YROA0ex7d9KM/9jNHxzNfm1XMtQrENd1doHOVge2Hm9cNSbpCfwrPPdwP 7hSPo1QTFoVdWMX4US+TcFJ0T4qUHfl6pazSZKfmNLf+hZKygAoznb2FK+5bbA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWzhL57V7z5tv for ; Sat, 29 Aug 2026 02:28:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a59f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 29 Aug 2026 02:28:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Enji Cooper Subject: git: 19c1fe2d0c8f - main - crypto/openssl: add manpages missed in related commit List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ngie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 19c1fe2d0c8f0001558c20f134be624241418191 Auto-Submitted: auto-generated Date: Sat, 29 Aug 2026 02:28:29 +0000 Message-Id: <6a9243cd.3a59f.868fb97@gitrepo.freebsd.org> The branch main has been updated by ngie: URL: https://cgit.FreeBSD.org/src/commit/?id=19c1fe2d0c8f0001558c20f134be624241418191 commit 19c1fe2d0c8f0001558c20f134be624241418191 Author: Enji Cooper AuthorDate: 2026-08-29 02:26:19 +0000 Commit: Enji Cooper CommitDate: 2026-08-29 02:28:11 +0000 crypto/openssl: add manpages missed in related commit MFC with: 78e936b2d Fixes: 0d4d0f3a9 ("crypto/openssl: update generated content ...") Reported by: Jenkins CI --- .../libcrypto/man/man3/NAME_CONSTRAINTS_check.3 | 237 +++++++++++++++++ secure/lib/libcrypto/man/man3/OPENSSL_armcap.3 | 285 +++++++++++++++++++++ 2 files changed, 522 insertions(+) diff --git a/secure/lib/libcrypto/man/man3/NAME_CONSTRAINTS_check.3 b/secure/lib/libcrypto/man/man3/NAME_CONSTRAINTS_check.3 new file mode 100644 index 000000000000..81da1b39de6d --- /dev/null +++ b/secure/lib/libcrypto/man/man3/NAME_CONSTRAINTS_check.3 @@ -0,0 +1,237 @@ +.\" -*- mode: troff; coding: utf-8 -*- +.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45) +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Vb \" Begin verbatim text +.ft CW +.nf +.ne \\$1 +.. +.de Ve \" End verbatim text +.ft R +.fi +.. +.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. +.ie n \{\ +. ds C` "" +. ds C' "" +'br\} +.el\{\ +. ds C` +. ds C' +'br\} +.\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" +.\" If the F register is >0, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX +.. +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{\ +. if \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" +.. +. if !\nF==2 \{\ +. nr % 0 +. nr F 2 +. \} +. \} +.\} +.rr rF +.\" +.\" Required to disable full justification in groff 1.23.0. +.if n .ds AD l +.\" ======================================================================== +.\" +.IX Title "NAME_CONSTRAINTS_CHECK 3ossl" +.TH NAME_CONSTRAINTS_CHECK 3ossl 2026-08-25 3.5.8 OpenSSL +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh +.SH NAME +NAME_CONSTRAINTS_check, +NAME_CONSTRAINTS_check_CN \- check a certificate\*(Aqs names against a name +constraints extension +.SH SYNOPSIS +.IX Header "SYNOPSIS" +.Vb 1 +\& #include +\& +\& int NAME_CONSTRAINTS_check(const X509 *x, NAME_CONSTRAINTS *nc); +\& int NAME_CONSTRAINTS_check_CN(const X509 *x, NAME_CONSTRAINTS *nc); +.Ve +.SH DESCRIPTION +.IX Header "DESCRIPTION" +\&\fBNAME_CONSTRAINTS_check()\fR tests whether the names asserted by certificate +\&\fIx\fR satisfy the name constraints \fInc\fR. It implements the matching +primitive of RFC 5280 section 4.2.1.10: given a constraint set (a +\&\fBNAME_CONSTRAINTS\fR structure containing zero or more \fBpermittedSubtrees\fR +and \fBexcludedSubtrees\fR) and a candidate certificate, decide whether the +certificate\*(Aqs names fall within the permitted subtrees and outside the +excluded subtrees. +.PP +The names considered by \fBNAME_CONSTRAINTS_check()\fR are: +.IP \(bu 4 +The certificate\*(Aqs subject distinguished name, matched as a \fBdirectoryName\fR +general\-name type. The subject is considered only when it is nonempty. +.IP \(bu 4 +Each \fBemailAddress\fR attribute appearing within the subject distinguished +name, matched as an \fBrfc822Name\fR general\-name type. These attributes are +the historical, pre\-SAN way of expressing an email address in a +certificate\*(Aqs subject, and RFC 5280 requires that they be subjected to +name\-constraint checking. +.IP \(bu 4 +Each entry in the certificate\*(Aqs subject alternative name extension, matched +according to its declared general\-name type. +.PP +\&\fBNAME_CONSTRAINTS_check()\fR implements matching for the following +general\-name types: \fBdirectoryName\fR, \fBdNSName\fR, \fBrfc822Name\fR, +\&\fBuniformResourceIdentifier\fR, and \fBiPAddress\fR. The \fBotherName\fR form +\&\fBid\-on\-SmtpUTF8Mailbox\fR (RFC 8398) is additionally matched against +\&\fBrfc822Name\fR subtrees. Any other general\-name type, including +\&\fBx400Address\fR, \fBediPartyName\fR, \fBregisteredID\fR, and other \fBotherName\fR +forms, yields \fBX509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE\fR. +.PP +For each name considered, the function evaluates two conditions: +.IP \(bu 4 +If \fInc\fR contains at least one \fBpermittedSubtree\fR of the same general\-name +type as the name, the name must match at least one of those permitted +subtrees. If \fInc\fR contains no permitted subtrees of that type, no +permitted\-subtrees test is imposed on names of that type. +.IP \(bu 4 +The name must not match any \fBexcludedSubtree\fR of the same general\-name +type in \fInc\fR. +.PP +The function returns at the first violation encountered; it does not +collect or report multiple failures. +.PP +For \fBdNSName\fR entries, matching follows the byte/label algorithm of +RFC 5280 section 4.2.1.10, which RFC 5280 mandates when no +protocol\-specific matching rules apply. Because this match is performed +without awareness of any specific higher\-level protocol, additional +matching rules defined by later or more specific protocols must be +applied independently of this function to the certificate chain. +.PP +\&\fBNAME_CONSTRAINTS_check()\fR performs only the constraint match for a single +certificate against a single constraint set. It does \fBnot\fR perform the +chain\-wide enforcement of RFC 5280 section 6.1.4(g)\-(j): callers wishing to +enforce name constraints across an entire certification path must walk the +chain themselves and apply each ancestor\*(Aqs constraint set to certificates +lower in the chain, observing the usual exceptions (for example, +self\-issued intermediate certificates are exempt from constraints imposed +by certificates above them, except when they are the leaf of the chain). +For full RFC 5280 name\-constraint enforcement integrated with chain +validation, applications should use \fBX509_verify_cert\fR\|(3), which performs +this internally. +.PP +\&\fBNAME_CONSTRAINTS_check()\fR enforces an implementation limit on the product +of the certificate\*(Aqs name count and the constraint set\*(Aqs subtree count, to +prevent computationally expensive matching on pathological input. If that +limit is exceeded the function returns \fBX509_V_ERR_UNSPECIFIED\fR without +performing any matching. The current limit is 2**20 (1,048,576) on the +product of the name count (subject DN entries plus \fBsubjectAltName\fR +entries) and the subtree count (\fBpermittedSubtrees\fR plus +\&\fBexcludedSubtrees\fR). +.SH "RETURN VALUES" +.IX Header "RETURN VALUES" +\&\fBNAME_CONSTRAINTS_check()\fR returns \fBX509_V_OK\fR if every name considered +satisfies the constraints. Otherwise it returns one of the following +\&\fBX509_V_ERR_*\fR codes: +.IP \fBX509_V_ERR_PERMITTED_VIOLATION\fR 4 +.IX Item "X509_V_ERR_PERMITTED_VIOLATION" +A name of a type for which \fInc\fR contains at least one permitted subtree +failed to match any of those subtrees. +.IP \fBX509_V_ERR_EXCLUDED_VIOLATION\fR 4 +.IX Item "X509_V_ERR_EXCLUDED_VIOLATION" +A name matched an excluded subtree. +.IP \fBX509_V_ERR_SUBTREE_MINMAX\fR 4 +.IX Item "X509_V_ERR_SUBTREE_MINMAX" +A subtree in \fInc\fR specified a \fBminimum\fR other than 0 or a \fBmaximum\fR at +all. RFC 5280 requires that these \fBGeneralSubtree\fR fields not be used, +and a constraint set that uses them cannot be processed. +.IP \fBX509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE\fR 4 +.IX Item "X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE" +A general\-name type for which matching is not implemented was encountered. +The list of supported types is given in the DESCRIPTION above. +.IP \fBX509_V_ERR_UNSUPPORTED_NAME_SYNTAX\fR 4 +.IX Item "X509_V_ERR_UNSUPPORTED_NAME_SYNTAX" +A name in the certificate is encoded in a way that cannot be matched (for +example, an \fBemailAddress\fR attribute in the subject that is not encoded +as an \fBIA5String\fR). +.IP \fBX509_V_ERR_UNSPECIFIED\fR 4 +.IX Item "X509_V_ERR_UNSPECIFIED" +The product of the certificate\*(Aqs name count and the constraint set\*(Aqs +subtree count exceeded the implementation limit; no matching was +performed. +.PP +Other \fBX509_V_ERR_*\fR codes may be returned by deeper name\-matching +helpers (for example, codes arising from individual general\-name type +comparisons). Callers should treat the return value as the authoritative +success/failure signal and treat any value other than \fBX509_V_OK\fR as a +failure, rather than enumerating the specific codes above. +.SH NOTES +.IX Header "NOTES" +\&\fBNAME_CONSTRAINTS_check()\fR does not match the certificate\*(Aqs commonName +against \fBdNSName\fR name constraints; that check is provided by a separate +function, \fBNAME_CONSTRAINTS_check_CN\fR(). The commonName\-as\-DNS\-identity +practice is a legacy concern: modern certificates assert DNS identities +through \fBdNSName\fR entries in the subject alternative name extension, +which \fBNAME_CONSTRAINTS_check()\fR already covers. \fBNAME_CONSTRAINTS_check_CN()\fR +is required only for older certificates that express a DNS identity +through their commonName instead of, or in addition to, the SAN; for +certificates conforming to modern profiles a call to \fBNAME_CONSTRAINTS_check()\fR +alone is generally sufficient. +.SH BUGS +.IX Header "BUGS" +RFC 9525\*(Aqs wildcard semantics apply only to presented\-identifier +matching for TLS service identity, and explicitly call out they are not +valid for any other purpose; they do not define wildcard handling +for name\-constraint matching. \fBNAME_CONSTRAINTS_check()\fR therefore +follows RFC 5280\*(Aqs requirements for when this is undefined, and treats +the \fB*\fR character in a \fBdNSName\fR as a literal label component, per +the RFC 5280 algorithm, which is often contrary to caller expectation. +.PP +Even if specified in the future, due to the "fallback implementation" +nature of matching wildcards in SAN \fBdNSName\fR entries specified by +RFC 5280, name constraint behaviour in the presence of wildcards +should not be strictly relied upon across implementations and +protocols. This matters most for the use of \fBexcluded names\fR +constraints, which should not be relied upon to reliably constrain +signing certificates for a PKI in a security dependent manner unless +the consumers of these certificates are themselves known to be +constrained by other means to only use implementations that provide +different semantics, or the PKI can be constrained by other means to +ensure that wildcards are never issued from such signing +certificates. +.SH "SEE ALSO" +.IX Header "SEE ALSO" +\&\fBX509_verify_cert\fR\|(3), +\&\fBX509_VERIFY_PARAM_set_flags\fR\|(3) +.SH HISTORY +.IX Header "HISTORY" +\&\fBNAME_CONSTRAINTS_check()\fR was added in OpenSSL 1.0.0. +.PP +\&\fBNAME_CONSTRAINTS_check_CN()\fR was added in OpenSSL 1.1.0. +.SH COPYRIGHT +.IX Header "COPYRIGHT" +Copyright 2026 The OpenSSL Project Authors. All Rights Reserved. +.PP +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +. diff --git a/secure/lib/libcrypto/man/man3/OPENSSL_armcap.3 b/secure/lib/libcrypto/man/man3/OPENSSL_armcap.3 new file mode 100644 index 000000000000..aae59f8d2284 --- /dev/null +++ b/secure/lib/libcrypto/man/man3/OPENSSL_armcap.3 @@ -0,0 +1,285 @@ +.\" -*- mode: troff; coding: utf-8 -*- +.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45) +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Vb \" Begin verbatim text +.ft CW +.nf +.ne \\$1 +.. +.de Ve \" End verbatim text +.ft R +.fi +.. +.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. +.ie n \{\ +. ds C` "" +. ds C' "" +'br\} +.el\{\ +. ds C` +. ds C' +'br\} +.\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" +.\" If the F register is >0, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX +.. +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{\ +. if \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" +.. +. if !\nF==2 \{\ +. nr % 0 +. nr F 2 +. \} +. \} +.\} +.rr rF +.\" +.\" Required to disable full justification in groff 1.23.0. +.if n .ds AD l +.\" ======================================================================== +.\" +.IX Title "OPENSSL_ARMCAP 3ossl" +.TH OPENSSL_ARMCAP 3ossl 2026-08-25 3.5.8 OpenSSL +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh +.SH NAME +OPENSSL_armcap \- the Arm processor capabilities vector +.SH SYNOPSIS +.IX Header "SYNOPSIS" +.Vb 1 +\& env OPENSSL_armcap=... +.Ve +.SH DESCRIPTION +.IX Header "DESCRIPTION" +libcrypto supports a range of Arm instruction set extensions. These +extensions are represented by bits in the Arm processor capabilities vector. +When libcrypto initializes, it stores the results returned by Arm CPU +capabilities detection logic in the Arm processor capabilities vector. The +CPU capabilities detection methods are OS\-dependent, using a combination of +information gathered by the kernel during boot, and probe functions that attempt +to execute instructions and trap illegal instruction signals with a signal +handler. +.PP +To override the set of extensions available to an application, set the +\&\fBOPENSSL_armcap\fR environment variable before starting the application. The +environment variable is assigned a numerical value that denotes the bits in +the Arm processor capabilities vector. The arm_arch.h header file defines +the possible values, which are explained in detail below. +.PP +Multiple extensions are enabled by logically OR\-ing the values that represent +the desired extensions. +.PP +\&\fBNotes\fR: Attempting to executing an instruction from an extension that the +target CPU does not support will result in an illegal instruction exception +(SIGILL). +.PP +Please note that not all possible values in the Arm processor capabilities +vector are actual processor capabilities. Some values represent OpenSSL +performance preferences for some implementations which only make sense on +specific CPUs. +.PP +The following extensions are defined: +.IP 0x0001 4 +.IX Item "0x0001" +Name: \fBARMV7_NEON\fR +.Sp +Meaning: Indicates support for the Armv7 Neon SIMD extensions on the processor. +.Sp +Effect: Enables various Armv7 Neon SIMD implementations. +.IP 0x00002 4 +.IX Item "0x00002" +Name: \fBARMV7_TICK\fR +.Sp +Meaning: Indicates support for the Armv7 system timer on the processor. +.Sp +Effect: This is used as a seed for some random number generators. +.IP 0x00004 4 +.IX Item "0x00004" +Name: \fBARMV8_AES\fR +.Sp +Meaning: Indicates support for the Armv8.0 AES hardware\-acceleration extensions +on the processor. +.Sp +Effect: Enables various Armv8.0 AES hardware\-accelerated implementations. +.IP 0x00008 4 +.IX Item "0x00008" +Name: \fBARMV8_SHA1\fR +.Sp +Meaning: Indicates support for the Armv8.0 SHA1 hardware\-acceleration extensions +on the processor. +.Sp +Effect: Enables various Armv8.0 SHA1 hardware\-accelerated implementations. +.IP 0x00010 4 +.IX Item "0x00010" +Name: \fBARMV8_SHA256\fR +.Sp +Meaning: Indicates support for the Armv8.0 SHA256 hardware\-acceleration +extensions on the processor. +.Sp +Effect: Enables various Armv8.0 SHA256 hardware\-accelerated implementations. +.IP 0x00020 4 +.IX Item "0x00020" +Name: \fBARMV8_PMULL\fR +.Sp +Meaning: Indicates support for the Armv8.0 polynomial multiplication +hardware\-acceleration extensions on the processor. +.Sp +Effect: Used to hardware\-accelerate polynomial multiplication, for example in +AES\-GCM. +.IP 0x00040 4 +.IX Item "0x00040" +Name: \fBARMV8_SHA512\fR +.Sp +Meaning: Indicates support for the Armv8.2 SHA512 hardware\-acceleration +extensions on the processor. +.Sp +Effect: Enables Armv8.2 SHA512 hardware\-accelerated implementations. +.IP 0x00080 4 +.IX Item "0x00080" +Name: \fBARMV8_CPUID\fR +.Sp +Meaning: Indicates support for the Armv8.0 hardware identification extensions on +the processor. +.Sp +Effect: Allows implementations to change their behaviour, dependant on the +processor platform in order to achieve better performance. +.IP 0x00100 4 +.IX Item "0x00100" +Name: \fBARMV8_RNG\fR +.Sp +Meaning: Indicates support for the Armv8.5 hardware random number generation +extensions on the processor. +.Sp +Effect: Enables hardware random number generation on supported AArch64 +processors. +.IP 0x00200 4 +.IX Item "0x00200" +Name: \fBARMV8_SM3\fR +.Sp +Meaning: Indicates support for the Armv8.2 SM3 hardware\-acceleration extensions +on the processor. +.Sp +Effect: Enables Armv8.2 SM3 hardware\-accelerated implementations. +.IP 0x00400 4 +.IX Item "0x00400" +Name: \fBARMV8_SM4\fR +.Sp +Meaning: Indicates support for the Armv8.2 SM4 hardware\-acceleration extensions +on the processor. +.Sp +Effect: Enables Armv8.2 SM4 hardware\-accelerated implementations. +.IP 0x00800 4 +.IX Item "0x00800" +Name: \fBARMV8_SHA3\fR +.Sp +Meaning: Indicates support for the Armv8.2 SHA3 hardware\-acceleration extensions +on the processor. +.Sp +Effect: Enables SHA3 hardware\-accelerated implementations (see also +ARMV8_HAVE_SHA3_AND_WORTH_USING). +.IP 0x01000 4 +.IX Item "0x01000" +Name: \fBARMV8_UNROLL8_EOR3\fR +.Sp +Meaning: Indicates support for the Arm EOR3 instruction, which is a part of the +Armv8.2 SHA3 extensions, and enables 8x Loop unrolling in the AES\-CTR +implementation. +.Sp +Effect: Enables the 8x loop unrolling utilising EOR3 implementation of AES\-CTR +on platforms that support the SHA3 extension and have enough vector bandwidth. +.IP 0x02000 4 +.IX Item "0x02000" +Name: \fBARMV8_SVE\fR +.Sp +Meaning: Indicates support for the Armv8.2 SVE hardware extension on the +processor. +.Sp +Effect: Enables various Armv8.2 SVE implementations. +.IP 0x04000 4 +.IX Item "0x04000" +Name: \fBARMV9_SVE2\fR +.Sp +Meaning: Indicates support for the Armv9.0 SVE2 hardware extension on the +processor. +.Sp +Effect: Enables various Armv9.0 SVE2 implementations. +.IP 0x08000 4 +.IX Item "0x08000" +Name: \fBARMV8_HAVE_SHA3_AND_WORTH_USING\fR +.Sp +Meaning: Indicates support for the Armv8.2 SHA3 hardware\-acceleration extensions +on the processor, and that the hardware bandwidth is sufficient for it to be +worth using. +.Sp +Effect: On certain Apple platforms, although the SHA3 extension is supported, it +is actually slower than other implementations. This flag disables the +hardware\-accelerated SHA3 implementations on these platforms. +.IP 0x10000 4 +.IX Item "0x10000" +Name: \fBARMV8_UNROLL12_EOR3\fR +.Sp +Meaning: Indicates support for the Arm EOR3 instruction, which is a part of the +Armv8.2 SHA3 extensions, and enables 12x loop unrolling in the AES\-CTR +implementation. +.Sp +Effect: Enables the 12x loop unrolling utilising EOR3 implementation of AES\-CTR +on platforms that support the extension and have enough vector bandwidth. +.IP 0x20000 4 +.IX Item "0x20000" +Name: \fBARMV9_SVE2_POLY1305\fR +.Sp +Meaning: Indicates support for the Armv9.0 SVE2 hardware extension, and enables +its use in the Poly1305 implementation. +.Sp +Effect: Enables the Armv9.0 SVE2 Poly1305 implementation if SVE2 is enabled, the +vector length is greater than 128 bits, and the vector length is a power of 2. +.SH "RETURN VALUES" +.IX Header "RETURN VALUES" +Not available. +.SH EXAMPLES +.IX Header "EXAMPLES" +Check currently detected capabilities: +.PP +.Vb 2 +\& $ openssl info \-cpusettings +\& OPENSSL_armcap=0x987d +.Ve +.PP +The detected capabilities in the above example indicate that ARMV7_NEON, +ARMV8_AES, ARMV8_SHA1, ARMV8_SHA256, ARMV8_PMULL, ARMV8_SHA512, ARMV8_SHA3, +ARMV8_UNROLL8_EOR3, and ARMV8_HAVE_SHA3_AND_WORTH_USING are enabled. +.PP +Disable all instruction set extensions: +.PP +.Vb 1 +\& export OPENSSL_armcap=0x00 +.Ve +.SH COPYRIGHT +.IX Header "COPYRIGHT" +Copyright 2026 The OpenSSL Project Authors. All Rights Reserved. +.PP +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +.