CI: test on ppc64le, on a ppc64le runner as pyca/cryptography does

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
 name: CI
 
 on:
   push:
@@ -258,9 +258,25 @@
               image: ghcr.io/pyca/cryptography-runner-ubuntu-rolling:armv7l
               # A fresh home avoids upgrading the image's incomplete Rust installation.
               options: --env RUSTUP_HOME=/tmp/verified-garbage-rustup
+          # PPC64LE: pyca's ppc64le runner image, on a ppc64le runner (as
+          # pyca/cryptography does).
+          - os: ubuntu-24.04-ppc64le
+            container:
+              image: ghcr.io/pyca/cryptography-runner-ubuntu-rolling:ppc64le
+              # A fresh home avoids upgrading the image's incomplete Rust installation.
+              options: --env RUSTUP_HOME=/tmp/verified-garbage-rustup
           - os: macos-latest
           - os: windows-latest
         rust: [stable, "1.88"]
+        exclude:
+          # Inline assembly (and so `naked_asm!`) on PowerPC was stabilized
+          # in Rust 1.95, after the crate's minimum of 1.88.
+          - platform:
+              os: ubuntu-24.04-ppc64le
+              container:
+                image: ghcr.io/pyca/cryptography-runner-ubuntu-rolling:ppc64le
+                options: --env RUSTUP_HOME=/tmp/verified-garbage-rustup
+            rust: "1.88"
         # One job each for the upcoming toolchains, to catch regressions (and
         # new warnings, which are errors here) before they reach stable.
         include:

bench/benches/primitives/chacha20.rs

@@ -12,6 +12,20 @@ use crate::{OPENSSL, SIZES, VG};
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["chacha20"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     let key = [0x42; 32];
     let nonce = [0x24; 16];

bench/benches/primitives/hmac_sha256.rs

@@ -9,6 +9,20 @@ use verified_garbage::hmac::Hmac;
 /// `ci/bench_arches.py`): this one and those it calls.
 pub const USES: &[&str] = &["hmac_sha256", "sha256"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     crate::hmac_group(
         c,

bench/benches/primitives/md5.rs

@@ -10,6 +10,20 @@ use crate::hash_group;
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["md5"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     hash_group(c, "md5", Md5::digest, MessageDigest::md5());
 }

bench/benches/primitives/sha1.rs

@@ -10,6 +10,20 @@ use crate::hash_group;
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["sha1"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     hash_group(c, "sha1", Sha1::digest, MessageDigest::sha1());
 }

bench/benches/primitives/sha224.rs

@@ -10,6 +10,20 @@ use crate::hash_group;
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["sha224", "sha256"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     hash_group(c, "sha224", Sha224::digest, MessageDigest::sha224());
 }

bench/benches/primitives/sha256.rs

@@ -10,6 +10,20 @@ use crate::hash_group;
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["sha256"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     hash_group(c, "sha256", Sha256::digest, MessageDigest::sha256());
 }

bench/benches/primitives/sha512.rs

@@ -10,6 +10,20 @@ use crate::hash_group;
 /// `ci/bench_arches.py`).
 pub const USES: &[&str] = &["sha512"];
 
+#[cfg(not(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+)))]
+pub fn bench(_: &mut Criterion) {}
+
+#[cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
 pub fn bench(c: &mut Criterion) {
     hash_group(c, "sha512", Sha512::digest, MessageDigest::sha512());
 }

ci/bench_arches.py

@@ -100,8 +100,10 @@ def need(arch, module):
 
     for path in changed:
         asm, api, family = ASM.match(path), API.match(path), FAMILY.match(path)
-        if asm and asm[1] in PLATFORMS:
-            if asm[2] != "mod":
+        if asm:
+            # The assembly of an architecture that is not benchmarked (e.g.
+            # PPC64LE) needs no benchmark.
+            if asm[1] in PLATFORMS and asm[2] != "mod":
                 need(asm[1], asm[2])
         elif api:
             for a in PLATFORMS:

ci/check_arch_gates.py

@@ -24,7 +24,7 @@
 import sys
 
 ROOT = pathlib.Path(__file__).resolve().parent.parent
-ARCHES = frozenset({"x86_64", "aarch64", "arm", "x86"})
+ARCHES = frozenset({"x86_64", "aarch64", "arm", "x86", "powerpc64"})
 
 INNER_CFG = re.compile(r"^#!\[cfg\((.*?)\)\]$", re.MULTILINE | re.DOTALL)
 BENCH_CFG = re.compile(r"^#\[cfg\(((?!not\().*?)\)\]\npub fn bench\(", re.MULTILINE | re.DOTALL)

src/cpu.rs

@@ -19,6 +19,13 @@
 //! this library knows: anything else panics, rather than quietly testing
 //! another configuration.
 
+// No PPC64LE module chooses among implementations yet, so detection is only
+// used by the tests there.
+#![cfg_attr(
+    all(target_arch = "powerpc64", target_endian = "little"),
+    allow(dead_code)
+)]
+
 use core::sync::atomic::{AtomicU32, Ordering};
 
 /// The features detection knows, by their Rust `target_feature` names: bit

tests/acvp/mldsa.rs

@@ -7,6 +7,13 @@
 //! by verifying its signatures, and against Wycheproof's seed vectors
 //! (`tests/wycheproof/mldsa*.rs`).
 
+#![cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
+
 /// Defines the tests of the parameter set named `$name` (`"ML-DSA-44"`), of
 /// the module `$module` and its key types.
 // Used by the parameter sets' files, on the architectures they support.

tests/rfc1321/main.rs

@@ -5,6 +5,13 @@
 //! always run. Every vector of the suite is checked, in one call and split
 //! into pieces at every position.
 
+#![cfg(any(
+    target_arch = "x86_64",
+    target_arch = "aarch64",
+    target_arch = "arm",
+    target_arch = "x86"
+))]
+
 use verified_garbage::hashes::HashFunction;
 use verified_garbage::hashes::md5::Md5;