From 2bb137e19d2fe47124fbd6c4d79006171473975c Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Sat, 5 Sep 2020 10:46:10 +0200
Subject: [PATCH] Fix AArch64 build failure

---
 nss-aarch64-gcc.patch | 58 +++++++++++++++++++++++++++++++++++++++++++
 nss.spec              |  4 +++
 2 files changed, 62 insertions(+)
 create mode 100644 nss-aarch64-gcc.patch

diff --git a/nss-aarch64-gcc.patch b/nss-aarch64-gcc.patch
new file mode 100644
index 0000000..fa3b812
--- /dev/null
+++ b/nss-aarch64-gcc.patch
@@ -0,0 +1,58 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1599294537 -7200
+#      Sat Sep 05 10:28:57 2020 +0200
+# Node ID 1294add76fecdfc301c9cab3ed68ed1681979780
+# Parent  e03296e73ba666329bd9c1257038353bc9074466
+Bug 1659256, add gcc version check on AArch64 optimization, r?rrelyea
+
+Reviewers: rrelyea
+
+Bug #: 1659256
+
+Differential Revision: https://phabricator.services.mozilla.com/D87174
+
+diff -r e03296e73ba6 -r 1294add76fec lib/freebl/Makefile
+--- a/lib/freebl/Makefile	Sat Sep 05 08:53:40 2020 +0200
++++ b/lib/freebl/Makefile	Sat Sep 05 10:28:57 2020 +0200
+@@ -119,11 +119,24 @@
+         DEFINES += -DNSS_X86
+ endif
+ endif
+-ifdef NS_USE_GCC
+ ifeq ($(CPU_ARCH),aarch64)
+-    DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
+-    EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c
+-endif
++    ifdef CC_IS_CLANG
++        DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
++        EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c
++    else ifeq (1,$(CC_IS_GCC))
++        # GCC versions older than 4.9 don't support ARM AES. The check
++        # is done in two parts, first allows "major.minor" == "4.9",
++        # and then rejects any major versions prior to 5. Note that
++        # there has been no GCC 4.10, as it is renamed to GCC 5.
++        ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
++            DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
++            EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c
++        endif
++        ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
++            DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
++            EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c
++        endif
++    endif
+ endif
+ ifeq ($(CPU_ARCH),arm)
+ ifndef NSS_DISABLE_ARM32_NEON
+@@ -133,7 +146,10 @@
+         DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
+         EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c
+     else ifeq (1,$(CC_IS_GCC))
+-        # Old compiler doesn't support ARM AES.
++        # GCC versions older than 4.9 don't support ARM AES. The check
++        # is done in two parts, first allows "major.minor" == "4.9",
++        # and then rejects any major versions prior to 5. Note that
++        # there has been no GCC 4.10, as it is renamed to GCC 5.
+         ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
+             DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
+             EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c
diff --git a/nss.spec b/nss.spec
index 0f10ab8..a68efdb 100644
--- a/nss.spec
+++ b/nss.spec
@@ -111,6 +111,10 @@ Patch4:           iquote.patch
 Patch11:          nss-disable-legacydb.patch
 %endif
 Patch12:          nss-signtool-format.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1659256
+# Also fixes the regression in bug 1652032:
+# https://phabricator.services.mozilla.com/D87174#2817994
+Patch13:          nss-aarch64-gcc.patch
 %if 0%{?fedora} < 34
 %if 0%{?rhel} < 9
 Patch20:          nss-gcm-param-default-pkcs11v2.patch