[PATCH 2/2] crypto: remove aegis128 support

[Ard Biesheuvel <ardb+git@google.com>]

From: Ard Biesheuvel <ardb@kernel.org>

Even the people that are invested in Aegis appear to have lost interest
in aegis128: it did win the CAESAR competition but is no longer covered
by RFC 10032, which does list some other variants that competed as well.

So let's delete it.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 arch/m68k/configs/amiga_defconfig    |   1 -
 arch/m68k/configs/apollo_defconfig   |   1 -
 arch/m68k/configs/atari_defconfig    |   1 -
 arch/m68k/configs/bvme6000_defconfig |   1 -
 arch/m68k/configs/hp300_defconfig    |   1 -
 arch/m68k/configs/mac_defconfig      |   1 -
 arch/m68k/configs/multi_defconfig    |   1 -
 arch/m68k/configs/mvme147_defconfig  |   1 -
 arch/m68k/configs/mvme16x_defconfig  |   1 -
 arch/m68k/configs/q40_defconfig      |   1 -
 arch/m68k/configs/sun3_defconfig     |   1 -
 arch/m68k/configs/sun3x_defconfig    |   1 -
 arch/s390/configs/debug_defconfig    |   1 -
 arch/s390/configs/defconfig          |   1 -
 crypto/Kconfig                       |  17 -
 crypto/Makefile                      |  20 -
 crypto/aegis-neon.h                  |  17 -
 crypto/aegis.h                       |  79 ---
 crypto/aegis128-core.c               | 577 --------------------
 crypto/aegis128-neon-inner.c         | 343 ------------
 crypto/aegis128-neon.c               |  60 --
 crypto/tcrypt.c                      |   7 -
 crypto/testmgr.c                     |   6 -
 crypto/testmgr.h                     | 444 ---------------
 24 files changed, 1584 deletions(-)

diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index e2d474e8cb8f..787defb894dd 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -531,7 +531,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 77669e31bb5a..8b8cea4643ed 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -485,7 +485,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 43ed1e317ae2..c36793ed8d49 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -510,7 +510,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 44c1a2228d5f..53bc0e1dcf8c 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -477,7 +477,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 7ab25377bfe8..9412fc91a831 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -487,7 +487,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 13f642884a94..1e092dd7c1f7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -506,7 +506,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 1bbd2aa653c0..fbfbd3644626 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -596,7 +596,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 3bfc36faf8d5..6209dacde6f4 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -477,7 +477,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 41ceed87c78a..a937c428d2d5 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -478,7 +478,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index af4b5c6e4655..fb2c07c194ae 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -496,7 +496,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 1140951fefe7..7ba77810a688 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -475,7 +475,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index bc9358e71ee0..0810c9fb3daf 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -475,7 +475,6 @@ CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_RMD160=m
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index d44674b63715..2a1b312a04d2 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -805,7 +805,6 @@ CONFIG_CRYPTO_ADIANTUM=m
 CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_MD4=m
diff --git a/arch/s390/configs/defconfig b/arch/s390/configs/defconfig
index e00e252d4694..94d4646999b3 100644
--- a/arch/s390/configs/defconfig
+++ b/arch/s390/configs/defconfig
@@ -789,7 +789,6 @@ CONFIG_CRYPTO_ADIANTUM=m
 CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_HCTR2=m
 CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_MD4=m
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 981d5dc422d4..7bb06b817d55 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -743,23 +743,6 @@ endmenu
 
 menu "AEAD (authenticated encryption with associated data) ciphers"
 
-config CRYPTO_AEGIS128
-	tristate "AEGIS-128"
-	select CRYPTO_AEAD
-	select CRYPTO_LIB_AES  # for AES S-box tables
-	help
-	  AEGIS-128 AEAD algorithm
-
-config CRYPTO_AEGIS128_SIMD
-	bool "AEGIS-128 (arm NEON, arm64 NEON)"
-	depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
-	default y
-	help
-	  AEGIS-128 AEAD algorithm
-
-	  Architecture: arm or arm64 using:
-	  - NEON (Advanced SIMD) extension
-
 config CRYPTO_CHACHA20POLY1305
 	tristate "ChaCha20-Poly1305"
 	select CRYPTO_CHACHA20
diff --git a/crypto/Makefile b/crypto/Makefile
index 33bb5ad595e8..4db99bba1048 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -96,26 +96,6 @@ obj-$(CONFIG_CRYPTO_ADIANTUM) += adiantum.o
 obj-$(CONFIG_CRYPTO_GCM) += gcm.o
 obj-$(CONFIG_CRYPTO_CCM) += ccm.o
 obj-$(CONFIG_CRYPTO_CHACHA20POLY1305) += chacha20poly1305.o
-obj-$(CONFIG_CRYPTO_AEGIS128) += aegis128.o
-aegis128-y := aegis128-core.o
-
-CFLAGS_aegis128-neon-inner.o += $(CC_FLAGS_FPU)
-CFLAGS_REMOVE_aegis128-neon-inner.o += $(CC_FLAGS_NO_FPU)
-ifeq ($(ARCH),arm)
-CFLAGS_aegis128-neon-inner.o += -march=armv8-a -mfpu=crypto-neon-fp-armv8
-aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
-endif
-ifeq ($(ARCH),arm64)
-aegis128-cflags-y := -mcpu=generic+crypto
-aegis128-cflags-$(CONFIG_CC_IS_GCC) += -ffixed-q16 -ffixed-q17 -ffixed-q18 \
-				       -ffixed-q19 -ffixed-q20 -ffixed-q21 \
-				       -ffixed-q22 -ffixed-q23 -ffixed-q24 \
-				       -ffixed-q25 -ffixed-q26 -ffixed-q27 \
-				       -ffixed-q28 -ffixed-q29 -ffixed-q30 \
-				       -ffixed-q31
-CFLAGS_aegis128-neon-inner.o += $(aegis128-cflags-y)
-aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
-endif
 
 obj-$(CONFIG_CRYPTO_PCRYPT) += pcrypt.o
 obj-$(CONFIG_CRYPTO_CRYPTD) += cryptd.o
diff --git a/crypto/aegis-neon.h b/crypto/aegis-neon.h
deleted file mode 100644
index 61e5614b45de..000000000000
--- a/crypto/aegis-neon.h
+++ /dev/null
@@ -1,17 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#ifndef _AEGIS_NEON_H
-#define _AEGIS_NEON_H
-
-void crypto_aegis128_init_neon(void *state, const void *key, const void *iv);
-void crypto_aegis128_update_neon(void *state, const void *msg);
-void crypto_aegis128_encrypt_chunk_neon(void *state, void *dst, const void *src,
-					unsigned int size);
-void crypto_aegis128_decrypt_chunk_neon(void *state, void *dst, const void *src,
-					unsigned int size);
-int crypto_aegis128_final_neon(void *state, void *tag_xor,
-			       unsigned int assoclen,
-			       unsigned int cryptlen,
-			       unsigned int authsize);
-
-#endif
diff --git a/crypto/aegis.h b/crypto/aegis.h
deleted file mode 100644
index ffcf8e85ea69..000000000000
--- a/crypto/aegis.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- * AEGIS common definitions
- *
- * Copyright (c) 2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (c) 2018 Red Hat, Inc. All rights reserved.
- */
-
-#ifndef _CRYPTO_AEGIS_H
-#define _CRYPTO_AEGIS_H
-
-#include <crypto/aes.h>
-#include <linux/bitops.h>
-#include <linux/types.h>
-
-#define AEGIS_BLOCK_SIZE 16
-
-union aegis_block {
-	__le64 words64[AEGIS_BLOCK_SIZE / sizeof(__le64)];
-	__le32 words32[AEGIS_BLOCK_SIZE / sizeof(__le32)];
-	u8 bytes[AEGIS_BLOCK_SIZE];
-};
-
-struct aegis_state;
-
-extern int aegis128_have_aes_insn;
-
-#define AEGIS_BLOCK_ALIGN (__alignof__(union aegis_block))
-#define AEGIS_ALIGNED(p) IS_ALIGNED((uintptr_t)p, AEGIS_BLOCK_ALIGN)
-
-bool crypto_aegis128_have_simd(void);
-void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg);
-void crypto_aegis128_init_simd(struct aegis_state *state,
-			       const union aegis_block *key,
-			       const u8 *iv);
-void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst,
-					const u8 *src, unsigned int size);
-void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst,
-					const u8 *src, unsigned int size);
-int crypto_aegis128_final_simd(struct aegis_state *state,
-			       union aegis_block *tag_xor,
-			       unsigned int assoclen,
-			       unsigned int cryptlen,
-			       unsigned int authsize);
-
-static __always_inline void crypto_aegis_block_xor(union aegis_block *dst,
-						   const union aegis_block *src)
-{
-	dst->words64[0] ^= src->words64[0];
-	dst->words64[1] ^= src->words64[1];
-}
-
-static __always_inline void crypto_aegis_block_and(union aegis_block *dst,
-						   const union aegis_block *src)
-{
-	dst->words64[0] &= src->words64[0];
-	dst->words64[1] &= src->words64[1];
-}
-
-static __always_inline void crypto_aegis_aesenc(union aegis_block *dst,
-						const union aegis_block *src,
-						const union aegis_block *key)
-{
-	const u8  *s  = src->bytes;
-	const u32 *t = aes_enc_tab;
-	u32 d0, d1, d2, d3;
-
-	d0 = t[s[ 0]] ^ rol32(t[s[ 5]], 8) ^ rol32(t[s[10]], 16) ^ rol32(t[s[15]], 24);
-	d1 = t[s[ 4]] ^ rol32(t[s[ 9]], 8) ^ rol32(t[s[14]], 16) ^ rol32(t[s[ 3]], 24);
-	d2 = t[s[ 8]] ^ rol32(t[s[13]], 8) ^ rol32(t[s[ 2]], 16) ^ rol32(t[s[ 7]], 24);
-	d3 = t[s[12]] ^ rol32(t[s[ 1]], 8) ^ rol32(t[s[ 6]], 16) ^ rol32(t[s[11]], 24);
-
-	dst->words32[0] = cpu_to_le32(d0) ^ key->words32[0];
-	dst->words32[1] = cpu_to_le32(d1) ^ key->words32[1];
-	dst->words32[2] = cpu_to_le32(d2) ^ key->words32[2];
-	dst->words32[3] = cpu_to_le32(d3) ^ key->words32[3];
-}
-
-#endif /* _CRYPTO_AEGIS_H */
diff --git a/crypto/aegis128-core.c b/crypto/aegis128-core.c
deleted file mode 100644
index ca80d861345d..000000000000
--- a/crypto/aegis128-core.c
+++ /dev/null
@@ -1,577 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * The AEGIS-128 Authenticated-Encryption Algorithm
- *
- * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved.
- */
-
-#include <crypto/algapi.h>
-#include <crypto/internal/aead.h>
-#include <crypto/internal/simd.h>
-#include <crypto/internal/skcipher.h>
-#include <crypto/scatterwalk.h>
-#include <linux/err.h>
-#include <linux/init.h>
-#include <linux/jump_label.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/scatterlist.h>
-
-#include <asm/simd.h>
-
-#include "aegis.h"
-
-#define AEGIS128_NONCE_SIZE 16
-#define AEGIS128_STATE_BLOCKS 5
-#define AEGIS128_KEY_SIZE 16
-#define AEGIS128_MIN_AUTH_SIZE 8
-#define AEGIS128_MAX_AUTH_SIZE 16
-
-struct aegis_state {
-	union aegis_block blocks[AEGIS128_STATE_BLOCKS];
-};
-
-struct aegis_ctx {
-	union aegis_block key;
-};
-
-static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_simd);
-
-static const union aegis_block crypto_aegis_const[2] = {
-	{ .words64 = {
-		cpu_to_le64(U64_C(0x0d08050302010100)),
-		cpu_to_le64(U64_C(0x6279e99059372215)),
-	} },
-	{ .words64 = {
-		cpu_to_le64(U64_C(0xf12fc26d55183ddb)),
-		cpu_to_le64(U64_C(0xdd28b57342311120)),
-	} },
-};
-
-static bool aegis128_do_simd(void)
-{
-#ifdef CONFIG_CRYPTO_AEGIS128_SIMD
-	if (static_branch_likely(&have_simd))
-		return crypto_simd_usable();
-#endif
-	return false;
-}
-
-static void crypto_aegis128_update(struct aegis_state *state)
-{
-	union aegis_block tmp;
-	unsigned int i;
-
-	tmp = state->blocks[AEGIS128_STATE_BLOCKS - 1];
-	for (i = AEGIS128_STATE_BLOCKS - 1; i > 0; i--)
-		crypto_aegis_aesenc(&state->blocks[i], &state->blocks[i - 1],
-				    &state->blocks[i]);
-	crypto_aegis_aesenc(&state->blocks[0], &tmp, &state->blocks[0]);
-}
-
-static void crypto_aegis128_update_a(struct aegis_state *state,
-				     const union aegis_block *msg,
-				     bool do_simd)
-{
-	if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) && do_simd) {
-		crypto_aegis128_update_simd(state, msg);
-		return;
-	}
-
-	crypto_aegis128_update(state);
-	crypto_aegis_block_xor(&state->blocks[0], msg);
-}
-
-static void crypto_aegis128_update_u(struct aegis_state *state, const void *msg,
-				     bool do_simd)
-{
-	if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) && do_simd) {
-		crypto_aegis128_update_simd(state, msg);
-		return;
-	}
-
-	crypto_aegis128_update(state);
-	crypto_xor(state->blocks[0].bytes, msg, AEGIS_BLOCK_SIZE);
-}
-
-static void crypto_aegis128_init(struct aegis_state *state,
-				 const union aegis_block *key,
-				 const u8 *iv)
-{
-	union aegis_block key_iv;
-	unsigned int i;
-
-	key_iv = *key;
-	crypto_xor(key_iv.bytes, iv, AEGIS_BLOCK_SIZE);
-
-	state->blocks[0] = key_iv;
-	state->blocks[1] = crypto_aegis_const[1];
-	state->blocks[2] = crypto_aegis_const[0];
-	state->blocks[3] = *key;
-	state->blocks[4] = *key;
-
-	crypto_aegis_block_xor(&state->blocks[3], &crypto_aegis_const[0]);
-	crypto_aegis_block_xor(&state->blocks[4], &crypto_aegis_const[1]);
-
-	for (i = 0; i < 5; i++) {
-		crypto_aegis128_update_a(state, key, false);
-		crypto_aegis128_update_a(state, &key_iv, false);
-	}
-}
-
-static void crypto_aegis128_ad(struct aegis_state *state,
-			       const u8 *src, unsigned int size,
-			       bool do_simd)
-{
-	if (AEGIS_ALIGNED(src)) {
-		const union aegis_block *src_blk =
-				(const union aegis_block *)src;
-
-		while (size >= AEGIS_BLOCK_SIZE) {
-			crypto_aegis128_update_a(state, src_blk, do_simd);
-
-			size -= AEGIS_BLOCK_SIZE;
-			src_blk++;
-		}
-	} else {
-		while (size >= AEGIS_BLOCK_SIZE) {
-			crypto_aegis128_update_u(state, src, do_simd);
-
-			size -= AEGIS_BLOCK_SIZE;
-			src += AEGIS_BLOCK_SIZE;
-		}
-	}
-}
-
-static void crypto_aegis128_wipe_chunk(struct aegis_state *state, u8 *dst,
-				       const u8 *src, unsigned int size)
-{
-	memzero_explicit(dst, size);
-}
-
-static void crypto_aegis128_encrypt_chunk(struct aegis_state *state, u8 *dst,
-					  const u8 *src, unsigned int size)
-{
-	union aegis_block tmp;
-
-	if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
-		while (size >= AEGIS_BLOCK_SIZE) {
-			union aegis_block *dst_blk =
-					(union aegis_block *)dst;
-			const union aegis_block *src_blk =
-					(const union aegis_block *)src;
-
-			tmp = state->blocks[2];
-			crypto_aegis_block_and(&tmp, &state->blocks[3]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-			crypto_aegis_block_xor(&tmp, src_blk);
-
-			crypto_aegis128_update_a(state, src_blk, false);
-
-			*dst_blk = tmp;
-
-			size -= AEGIS_BLOCK_SIZE;
-			src += AEGIS_BLOCK_SIZE;
-			dst += AEGIS_BLOCK_SIZE;
-		}
-	} else {
-		while (size >= AEGIS_BLOCK_SIZE) {
-			tmp = state->blocks[2];
-			crypto_aegis_block_and(&tmp, &state->blocks[3]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-			crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
-
-			crypto_aegis128_update_u(state, src, false);
-
-			memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
-
-			size -= AEGIS_BLOCK_SIZE;
-			src += AEGIS_BLOCK_SIZE;
-			dst += AEGIS_BLOCK_SIZE;
-		}
-	}
-
-	if (size > 0) {
-		union aegis_block msg = {};
-		memcpy(msg.bytes, src, size);
-
-		tmp = state->blocks[2];
-		crypto_aegis_block_and(&tmp, &state->blocks[3]);
-		crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-		crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-
-		crypto_aegis128_update_a(state, &msg, false);
-
-		crypto_aegis_block_xor(&msg, &tmp);
-
-		memcpy(dst, msg.bytes, size);
-	}
-}
-
-static void crypto_aegis128_decrypt_chunk(struct aegis_state *state, u8 *dst,
-					  const u8 *src, unsigned int size)
-{
-	union aegis_block tmp;
-
-	if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
-		while (size >= AEGIS_BLOCK_SIZE) {
-			union aegis_block *dst_blk =
-					(union aegis_block *)dst;
-			const union aegis_block *src_blk =
-					(const union aegis_block *)src;
-
-			tmp = state->blocks[2];
-			crypto_aegis_block_and(&tmp, &state->blocks[3]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-			crypto_aegis_block_xor(&tmp, src_blk);
-
-			crypto_aegis128_update_a(state, &tmp, false);
-
-			*dst_blk = tmp;
-
-			size -= AEGIS_BLOCK_SIZE;
-			src += AEGIS_BLOCK_SIZE;
-			dst += AEGIS_BLOCK_SIZE;
-		}
-	} else {
-		while (size >= AEGIS_BLOCK_SIZE) {
-			tmp = state->blocks[2];
-			crypto_aegis_block_and(&tmp, &state->blocks[3]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-			crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-			crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
-
-			crypto_aegis128_update_a(state, &tmp, false);
-
-			memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
-
-			size -= AEGIS_BLOCK_SIZE;
-			src += AEGIS_BLOCK_SIZE;
-			dst += AEGIS_BLOCK_SIZE;
-		}
-	}
-
-	if (size > 0) {
-		union aegis_block msg = {};
-		memcpy(msg.bytes, src, size);
-
-		tmp = state->blocks[2];
-		crypto_aegis_block_and(&tmp, &state->blocks[3]);
-		crypto_aegis_block_xor(&tmp, &state->blocks[4]);
-		crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-		crypto_aegis_block_xor(&msg, &tmp);
-
-		memset(msg.bytes + size, 0, AEGIS_BLOCK_SIZE - size);
-
-		crypto_aegis128_update_a(state, &msg, false);
-
-		memcpy(dst, msg.bytes, size);
-	}
-}
-
-static void crypto_aegis128_process_ad(struct aegis_state *state,
-				       struct scatterlist *sg_src,
-				       unsigned int assoclen,
-				       bool do_simd)
-{
-	struct scatter_walk walk;
-	union aegis_block buf;
-	unsigned int pos = 0;
-
-	scatterwalk_start(&walk, sg_src);
-	while (assoclen != 0) {
-		unsigned int size = scatterwalk_next(&walk, assoclen);
-		const u8 *src = walk.addr;
-		unsigned int left = size;
-
-		if (pos + size >= AEGIS_BLOCK_SIZE) {
-			if (pos > 0) {
-				unsigned int fill = AEGIS_BLOCK_SIZE - pos;
-				memcpy(buf.bytes + pos, src, fill);
-				crypto_aegis128_update_a(state, &buf, do_simd);
-				pos = 0;
-				left -= fill;
-				src += fill;
-			}
-
-			crypto_aegis128_ad(state, src, left, do_simd);
-			src += left & ~(AEGIS_BLOCK_SIZE - 1);
-			left &= AEGIS_BLOCK_SIZE - 1;
-		}
-
-		memcpy(buf.bytes + pos, src, left);
-
-		pos += left;
-		assoclen -= size;
-		scatterwalk_done_src(&walk, size);
-	}
-
-	if (pos > 0) {
-		memset(buf.bytes + pos, 0, AEGIS_BLOCK_SIZE - pos);
-		crypto_aegis128_update_a(state, &buf, do_simd);
-	}
-}
-
-static __always_inline
-int crypto_aegis128_process_crypt(struct aegis_state *state,
-				  struct skcipher_walk *walk,
-				  void (*crypt)(struct aegis_state *state,
-						u8 *dst,
-						const u8 *src,
-						unsigned int size))
-{
-	int err = 0;
-
-	while (walk->nbytes) {
-		unsigned int nbytes = walk->nbytes;
-
-		if (nbytes < walk->total)
-			nbytes = round_down(nbytes, walk->stride);
-
-		crypt(state, walk->dst.virt.addr, walk->src.virt.addr, nbytes);
-
-		err = skcipher_walk_done(walk, walk->nbytes - nbytes);
-	}
-	return err;
-}
-
-static void crypto_aegis128_final(struct aegis_state *state,
-				  union aegis_block *tag_xor,
-				  u64 assoclen, u64 cryptlen)
-{
-	u64 assocbits = assoclen * 8;
-	u64 cryptbits = cryptlen * 8;
-
-	union aegis_block tmp;
-	unsigned int i;
-
-	tmp.words64[0] = cpu_to_le64(assocbits);
-	tmp.words64[1] = cpu_to_le64(cryptbits);
-
-	crypto_aegis_block_xor(&tmp, &state->blocks[3]);
-
-	for (i = 0; i < 7; i++)
-		crypto_aegis128_update_a(state, &tmp, false);
-
-	for (i = 0; i < AEGIS128_STATE_BLOCKS; i++)
-		crypto_aegis_block_xor(tag_xor, &state->blocks[i]);
-}
-
-static int crypto_aegis128_setkey(struct crypto_aead *aead, const u8 *key,
-				  unsigned int keylen)
-{
-	struct aegis_ctx *ctx = crypto_aead_ctx(aead);
-
-	if (keylen != AEGIS128_KEY_SIZE)
-		return -EINVAL;
-
-	memcpy(ctx->key.bytes, key, AEGIS128_KEY_SIZE);
-	return 0;
-}
-
-static int crypto_aegis128_setauthsize(struct crypto_aead *tfm,
-				       unsigned int authsize)
-{
-	if (authsize > AEGIS128_MAX_AUTH_SIZE)
-		return -EINVAL;
-	if (authsize < AEGIS128_MIN_AUTH_SIZE)
-		return -EINVAL;
-	return 0;
-}
-
-static int crypto_aegis128_encrypt_generic(struct aead_request *req)
-{
-	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
-	union aegis_block tag = {};
-	unsigned int authsize = crypto_aead_authsize(tfm);
-	struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
-	unsigned int cryptlen = req->cryptlen;
-	struct skcipher_walk walk;
-	struct aegis_state state;
-
-	skcipher_walk_aead_encrypt(&walk, req, false);
-	crypto_aegis128_init(&state, &ctx->key, req->iv);
-	crypto_aegis128_process_ad(&state, req->src, req->assoclen, false);
-	crypto_aegis128_process_crypt(&state, &walk,
-				      crypto_aegis128_encrypt_chunk);
-	crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
-
-	scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen,
-				 authsize, 1);
-	return 0;
-}
-
-static int crypto_aegis128_decrypt_generic(struct aead_request *req)
-{
-	static const u8 zeros[AEGIS128_MAX_AUTH_SIZE] = {};
-	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
-	union aegis_block tag;
-	unsigned int authsize = crypto_aead_authsize(tfm);
-	unsigned int cryptlen = req->cryptlen - authsize;
-	struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
-	struct skcipher_walk walk;
-	struct aegis_state state;
-
-	scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen,
-				 authsize, 0);
-
-	skcipher_walk_aead_decrypt(&walk, req, false);
-	crypto_aegis128_init(&state, &ctx->key, req->iv);
-	crypto_aegis128_process_ad(&state, req->src, req->assoclen, false);
-	crypto_aegis128_process_crypt(&state, &walk,
-				      crypto_aegis128_decrypt_chunk);
-	crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
-
-	if (unlikely(crypto_memneq(tag.bytes, zeros, authsize))) {
-		/*
-		 * From Chapter 4. 'Security Analysis' of the AEGIS spec [0]
-		 *
-		 * "3. If verification fails, the decrypted plaintext and the
-		 *     wrong authentication tag should not be given as output."
-		 *
-		 * [0] https://competitions.cr.yp.to/round3/aegisv11.pdf
-		 */
-		skcipher_walk_aead_decrypt(&walk, req, false);
-		crypto_aegis128_process_crypt(NULL, &walk,
-					      crypto_aegis128_wipe_chunk);
-		memzero_explicit(&tag, sizeof(tag));
-		return -EBADMSG;
-	}
-	return 0;
-}
-
-static int crypto_aegis128_encrypt_simd(struct aead_request *req)
-{
-	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
-	union aegis_block tag = {};
-	unsigned int authsize = crypto_aead_authsize(tfm);
-	struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
-	unsigned int cryptlen = req->cryptlen;
-	struct skcipher_walk walk;
-	struct aegis_state state;
-
-	if (!aegis128_do_simd())
-		return crypto_aegis128_encrypt_generic(req);
-
-	skcipher_walk_aead_encrypt(&walk, req, false);
-	crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
-	crypto_aegis128_process_ad(&state, req->src, req->assoclen, true);
-	crypto_aegis128_process_crypt(&state, &walk,
-				      crypto_aegis128_encrypt_chunk_simd);
-	crypto_aegis128_final_simd(&state, &tag, req->assoclen, cryptlen, 0);
-
-	scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen,
-				 authsize, 1);
-	return 0;
-}
-
-static int crypto_aegis128_decrypt_simd(struct aead_request *req)
-{
-	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
-	union aegis_block tag;
-	unsigned int authsize = crypto_aead_authsize(tfm);
-	unsigned int cryptlen = req->cryptlen - authsize;
-	struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
-	struct skcipher_walk walk;
-	struct aegis_state state;
-
-	if (!aegis128_do_simd())
-		return crypto_aegis128_decrypt_generic(req);
-
-	scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen,
-				 authsize, 0);
-
-	skcipher_walk_aead_decrypt(&walk, req, false);
-	crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
-	crypto_aegis128_process_ad(&state, req->src, req->assoclen, true);
-	crypto_aegis128_process_crypt(&state, &walk,
-				      crypto_aegis128_decrypt_chunk_simd);
-
-	if (unlikely(crypto_aegis128_final_simd(&state, &tag, req->assoclen,
-						cryptlen, authsize))) {
-		skcipher_walk_aead_decrypt(&walk, req, false);
-		crypto_aegis128_process_crypt(NULL, &walk,
-					      crypto_aegis128_wipe_chunk);
-		return -EBADMSG;
-	}
-	return 0;
-}
-
-static struct aead_alg crypto_aegis128_alg_generic = {
-	.setkey			= crypto_aegis128_setkey,
-	.setauthsize		= crypto_aegis128_setauthsize,
-	.encrypt		= crypto_aegis128_encrypt_generic,
-	.decrypt		= crypto_aegis128_decrypt_generic,
-
-	.ivsize			= AEGIS128_NONCE_SIZE,
-	.maxauthsize		= AEGIS128_MAX_AUTH_SIZE,
-	.chunksize		= AEGIS_BLOCK_SIZE,
-
-	.base.cra_blocksize	= 1,
-	.base.cra_ctxsize	= sizeof(struct aegis_ctx),
-	.base.cra_priority	= 100,
-	.base.cra_name		= "aegis128",
-	.base.cra_driver_name	= "aegis128-generic",
-	.base.cra_module	= THIS_MODULE,
-};
-
-static struct aead_alg crypto_aegis128_alg_simd = {
-	.setkey			= crypto_aegis128_setkey,
-	.setauthsize		= crypto_aegis128_setauthsize,
-	.encrypt		= crypto_aegis128_encrypt_simd,
-	.decrypt		= crypto_aegis128_decrypt_simd,
-
-	.ivsize			= AEGIS128_NONCE_SIZE,
-	.maxauthsize		= AEGIS128_MAX_AUTH_SIZE,
-	.chunksize		= AEGIS_BLOCK_SIZE,
-
-	.base.cra_blocksize	= 1,
-	.base.cra_ctxsize	= sizeof(struct aegis_ctx),
-	.base.cra_priority	= 200,
-	.base.cra_name		= "aegis128",
-	.base.cra_driver_name	= "aegis128-simd",
-	.base.cra_module	= THIS_MODULE,
-};
-
-static int __init crypto_aegis128_module_init(void)
-{
-	int ret;
-
-	ret = crypto_register_aead(&crypto_aegis128_alg_generic);
-	if (ret)
-		return ret;
-
-	if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) &&
-	    crypto_aegis128_have_simd()) {
-		ret = crypto_register_aead(&crypto_aegis128_alg_simd);
-		if (ret) {
-			crypto_unregister_aead(&crypto_aegis128_alg_generic);
-			return ret;
-		}
-		static_branch_enable(&have_simd);
-	}
-	return 0;
-}
-
-static void __exit crypto_aegis128_module_exit(void)
-{
-	if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) &&
-	    crypto_aegis128_have_simd())
-		crypto_unregister_aead(&crypto_aegis128_alg_simd);
-
-	crypto_unregister_aead(&crypto_aegis128_alg_generic);
-}
-
-module_init(crypto_aegis128_module_init);
-module_exit(crypto_aegis128_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Ondrej Mosnacek <omosnacek@gmail.com>");
-MODULE_DESCRIPTION("AEGIS-128 AEAD algorithm");
-MODULE_ALIAS_CRYPTO("aegis128");
-MODULE_ALIAS_CRYPTO("aegis128-generic");
-MODULE_ALIAS_CRYPTO("aegis128-simd");
diff --git a/crypto/aegis128-neon-inner.c b/crypto/aegis128-neon-inner.c
deleted file mode 100644
index 56b534eeb680..000000000000
--- a/crypto/aegis128-neon-inner.c
+++ /dev/null
@@ -1,343 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2019 Linaro, Ltd. <ard.biesheuvel@linaro.org>
- */
-
-#include <asm/neon-intrinsics.h>
-
-#ifdef CONFIG_ARM64
-#define AES_ROUND	"aese %0.16b, %1.16b \n\t aesmc %0.16b, %0.16b"
-#else
-#define AES_ROUND	"aese.8 %q0, %q1 \n\t aesmc.8 %q0, %q0"
-#endif
-
-#define AEGIS_BLOCK_SIZE	16
-
-#include <stddef.h>
-#include "aegis-neon.h"
-
-extern int aegis128_have_aes_insn;
-
-void *memcpy(void *dest, const void *src, size_t n);
-
-struct aegis128_state {
-	uint8x16_t v[5];
-};
-
-extern const uint8_t crypto_aes_sbox[];
-
-static struct aegis128_state aegis128_load_state_neon(const void *state)
-{
-	return (struct aegis128_state){ {
-		vld1q_u8(state),
-		vld1q_u8(state + 16),
-		vld1q_u8(state + 32),
-		vld1q_u8(state + 48),
-		vld1q_u8(state + 64)
-	} };
-}
-
-static void aegis128_save_state_neon(struct aegis128_state st, void *state)
-{
-	vst1q_u8(state, st.v[0]);
-	vst1q_u8(state + 16, st.v[1]);
-	vst1q_u8(state + 32, st.v[2]);
-	vst1q_u8(state + 48, st.v[3]);
-	vst1q_u8(state + 64, st.v[4]);
-}
-
-static inline __attribute__((always_inline))
-uint8x16_t aegis_aes_round(uint8x16_t w)
-{
-	uint8x16_t z = {};
-
-#ifdef CONFIG_ARM64
-	if (!__builtin_expect(aegis128_have_aes_insn, 1)) {
-		static const uint8_t shift_rows[] = {
-			0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3,
-			0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb,
-		};
-		static const uint8_t ror32by8[] = {
-			0x1, 0x2, 0x3, 0x0, 0x5, 0x6, 0x7, 0x4,
-			0x9, 0xa, 0xb, 0x8, 0xd, 0xe, 0xf, 0xc,
-		};
-		uint8x16_t v;
-
-		// shift rows
-		w = vqtbl1q_u8(w, vld1q_u8(shift_rows));
-
-		// sub bytes
-#ifndef CONFIG_CC_IS_GCC
-		v = vqtbl4q_u8(vld1q_u8_x4(crypto_aes_sbox), w);
-		v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0x40), w - 0x40);
-		v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0x80), w - 0x80);
-		v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0xc0), w - 0xc0);
-#else
-		asm("tbl %0.16b, {v16.16b-v19.16b}, %1.16b" : "=w"(v) : "w"(w));
-		w -= 0x40;
-		asm("tbx %0.16b, {v20.16b-v23.16b}, %1.16b" : "+w"(v) : "w"(w));
-		w -= 0x40;
-		asm("tbx %0.16b, {v24.16b-v27.16b}, %1.16b" : "+w"(v) : "w"(w));
-		w -= 0x40;
-		asm("tbx %0.16b, {v28.16b-v31.16b}, %1.16b" : "+w"(v) : "w"(w));
-#endif
-
-		// mix columns
-		w = (v << 1) ^ (uint8x16_t)(((int8x16_t)v >> 7) & 0x1b);
-		w ^= (uint8x16_t)vrev32q_u16((uint16x8_t)v);
-		w ^= vqtbl1q_u8(v ^ w, vld1q_u8(ror32by8));
-
-		return w;
-	}
-#endif
-
-	/*
-	 * We use inline asm here instead of the vaeseq_u8/vaesmcq_u8 intrinsics
-	 * to force the compiler to issue the aese/aesmc instructions in pairs.
-	 * This is much faster on many cores, where the instruction pair can
-	 * execute in a single cycle.
-	 */
-	asm(AES_ROUND : "+w"(w) : "w"(z));
-	return w;
-}
-
-static inline __attribute__((always_inline))
-struct aegis128_state aegis128_update_neon(struct aegis128_state st,
-					   uint8x16_t m)
-{
-	m       ^= aegis_aes_round(st.v[4]);
-	st.v[4] ^= aegis_aes_round(st.v[3]);
-	st.v[3] ^= aegis_aes_round(st.v[2]);
-	st.v[2] ^= aegis_aes_round(st.v[1]);
-	st.v[1] ^= aegis_aes_round(st.v[0]);
-	st.v[0] ^= m;
-
-	return st;
-}
-
-static inline __attribute__((always_inline))
-void preload_sbox(void)
-{
-	if (!IS_ENABLED(CONFIG_ARM64) ||
-	    !IS_ENABLED(CONFIG_CC_IS_GCC) ||
-	    __builtin_expect(aegis128_have_aes_insn, 1))
-		return;
-
-	asm("ld1	{v16.16b-v19.16b}, [%0], #64	\n\t"
-	    "ld1	{v20.16b-v23.16b}, [%0], #64	\n\t"
-	    "ld1	{v24.16b-v27.16b}, [%0], #64	\n\t"
-	    "ld1	{v28.16b-v31.16b}, [%0]		\n\t"
-	    :: "r"(crypto_aes_sbox));
-}
-
-void crypto_aegis128_init_neon(void *state, const void *key, const void *iv)
-{
-	static const uint8_t const0[] = {
-		0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d,
-		0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62,
-	};
-	static const uint8_t const1[] = {
-		0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1,
-		0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd,
-	};
-	uint8x16_t k = vld1q_u8(key);
-	uint8x16_t kiv = k ^ vld1q_u8(iv);
-	struct aegis128_state st = {{
-		kiv,
-		vld1q_u8(const1),
-		vld1q_u8(const0),
-		k ^ vld1q_u8(const0),
-		k ^ vld1q_u8(const1),
-	}};
-	int i;
-
-	preload_sbox();
-
-	for (i = 0; i < 5; i++) {
-		st = aegis128_update_neon(st, k);
-		st = aegis128_update_neon(st, kiv);
-	}
-	aegis128_save_state_neon(st, state);
-}
-
-void crypto_aegis128_update_neon(void *state, const void *msg)
-{
-	struct aegis128_state st = aegis128_load_state_neon(state);
-
-	preload_sbox();
-
-	st = aegis128_update_neon(st, vld1q_u8(msg));
-
-	aegis128_save_state_neon(st, state);
-}
-
-#ifdef CONFIG_ARM
-/*
- * AArch32 does not provide these intrinsics natively because it does not
- * implement the underlying instructions. AArch32 only provides 64-bit
- * wide vtbl.8/vtbx.8 instruction, so use those instead.
- */
-static uint8x16_t vqtbl1q_u8(uint8x16_t a, uint8x16_t b)
-{
-	union {
-		uint8x16_t	val;
-		uint8x8x2_t	pair;
-	} __a = { a };
-
-	return vcombine_u8(vtbl2_u8(__a.pair, vget_low_u8(b)),
-			   vtbl2_u8(__a.pair, vget_high_u8(b)));
-}
-
-static uint8x16_t vqtbx1q_u8(uint8x16_t v, uint8x16_t a, uint8x16_t b)
-{
-	union {
-		uint8x16_t	val;
-		uint8x8x2_t	pair;
-	} __a = { a };
-
-	return vcombine_u8(vtbx2_u8(vget_low_u8(v), __a.pair, vget_low_u8(b)),
-			   vtbx2_u8(vget_high_u8(v), __a.pair, vget_high_u8(b)));
-}
-
-static int8_t vminvq_s8(int8x16_t v)
-{
-	int8x8_t s = vpmin_s8(vget_low_s8(v), vget_high_s8(v));
-
-	s = vpmin_s8(s, s);
-	s = vpmin_s8(s, s);
-	s = vpmin_s8(s, s);
-
-	return vget_lane_s8(s, 0);
-}
-#endif
-
-static const uint8_t permute[] __aligned(64) = {
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-};
-
-void crypto_aegis128_encrypt_chunk_neon(void *state, void *dst, const void *src,
-					unsigned int size)
-{
-	struct aegis128_state st = aegis128_load_state_neon(state);
-	const int short_input = size < AEGIS_BLOCK_SIZE;
-	uint8x16_t msg;
-
-	preload_sbox();
-
-	while (size >= AEGIS_BLOCK_SIZE) {
-		uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
-
-		msg = vld1q_u8(src);
-		st = aegis128_update_neon(st, msg);
-		msg ^= s;
-		vst1q_u8(dst, msg);
-
-		size -= AEGIS_BLOCK_SIZE;
-		src += AEGIS_BLOCK_SIZE;
-		dst += AEGIS_BLOCK_SIZE;
-	}
-
-	if (size > 0) {
-		uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
-		uint8_t buf[AEGIS_BLOCK_SIZE];
-		const void *in = src;
-		void *out = dst;
-		uint8x16_t m;
-
-		if (__builtin_expect(short_input, 0))
-			in = out = memcpy(buf + AEGIS_BLOCK_SIZE - size, src, size);
-
-		m = vqtbl1q_u8(vld1q_u8(in + size - AEGIS_BLOCK_SIZE),
-			       vld1q_u8(permute + 32 - size));
-
-		st = aegis128_update_neon(st, m);
-
-		vst1q_u8(out + size - AEGIS_BLOCK_SIZE,
-			 vqtbl1q_u8(m ^ s, vld1q_u8(permute + size)));
-
-		if (__builtin_expect(short_input, 0))
-			memcpy(dst, out, size);
-		else
-			vst1q_u8(out - AEGIS_BLOCK_SIZE, msg);
-	}
-
-	aegis128_save_state_neon(st, state);
-}
-
-void crypto_aegis128_decrypt_chunk_neon(void *state, void *dst, const void *src,
-					unsigned int size)
-{
-	struct aegis128_state st = aegis128_load_state_neon(state);
-	const int short_input = size < AEGIS_BLOCK_SIZE;
-	uint8x16_t msg;
-
-	preload_sbox();
-
-	while (size >= AEGIS_BLOCK_SIZE) {
-		msg = vld1q_u8(src) ^ st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
-		st = aegis128_update_neon(st, msg);
-		vst1q_u8(dst, msg);
-
-		size -= AEGIS_BLOCK_SIZE;
-		src += AEGIS_BLOCK_SIZE;
-		dst += AEGIS_BLOCK_SIZE;
-	}
-
-	if (size > 0) {
-		uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
-		uint8_t buf[AEGIS_BLOCK_SIZE];
-		const void *in = src;
-		void *out = dst;
-		uint8x16_t m;
-
-		if (__builtin_expect(short_input, 0))
-			in = out = memcpy(buf + AEGIS_BLOCK_SIZE - size, src, size);
-
-		m = s ^ vqtbx1q_u8(s, vld1q_u8(in + size - AEGIS_BLOCK_SIZE),
-				   vld1q_u8(permute + 32 - size));
-
-		st = aegis128_update_neon(st, m);
-
-		vst1q_u8(out + size - AEGIS_BLOCK_SIZE,
-			 vqtbl1q_u8(m, vld1q_u8(permute + size)));
-
-		if (__builtin_expect(short_input, 0))
-			memcpy(dst, out, size);
-		else
-			vst1q_u8(out - AEGIS_BLOCK_SIZE, msg);
-	}
-
-	aegis128_save_state_neon(st, state);
-}
-
-int crypto_aegis128_final_neon(void *state, void *tag_xor,
-			       unsigned int assoclen,
-			       unsigned int cryptlen,
-			       unsigned int authsize)
-{
-	struct aegis128_state st = aegis128_load_state_neon(state);
-	uint8x16_t v;
-	int i;
-
-	preload_sbox();
-
-	v = st.v[3] ^ (uint8x16_t)vcombine_u64(vmov_n_u64(8ULL * assoclen),
-					       vmov_n_u64(8ULL * cryptlen));
-
-	for (i = 0; i < 7; i++)
-		st = aegis128_update_neon(st, v);
-
-	v = st.v[0] ^ st.v[1] ^ st.v[2] ^ st.v[3] ^ st.v[4];
-
-	if (authsize > 0) {
-		v = vqtbl1q_u8(~vceqq_u8(v, vld1q_u8(tag_xor)),
-			       vld1q_u8(permute + authsize));
-
-		return vminvq_s8((int8x16_t)v);
-	}
-
-	vst1q_u8(tag_xor, v);
-	return 0;
-}
diff --git a/crypto/aegis128-neon.c b/crypto/aegis128-neon.c
deleted file mode 100644
index b41807e63bd3..000000000000
--- a/crypto/aegis128-neon.c
+++ /dev/null
@@ -1,60 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2019 Linaro Ltd <ard.biesheuvel@linaro.org>
- */
-
-#include <asm/cpufeature.h>
-#include <asm/simd.h>
-
-#include "aegis.h"
-#include "aegis-neon.h"
-
-int aegis128_have_aes_insn __ro_after_init;
-
-bool crypto_aegis128_have_simd(void)
-{
-	if (cpu_have_feature(cpu_feature(AES))) {
-		aegis128_have_aes_insn = 1;
-		return true;
-	}
-	return IS_ENABLED(CONFIG_ARM64);
-}
-
-void crypto_aegis128_init_simd(struct aegis_state *state,
-			       const union aegis_block *key,
-			       const u8 *iv)
-{
-	scoped_ksimd()
-		crypto_aegis128_init_neon(state, key, iv);
-}
-
-void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg)
-{
-	scoped_ksimd()
-		crypto_aegis128_update_neon(state, msg);
-}
-
-void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst,
-					const u8 *src, unsigned int size)
-{
-	scoped_ksimd()
-		crypto_aegis128_encrypt_chunk_neon(state, dst, src, size);
-}
-
-void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst,
-					const u8 *src, unsigned int size)
-{
-	scoped_ksimd()
-		crypto_aegis128_decrypt_chunk_neon(state, dst, src, size);
-}
-
-int crypto_aegis128_final_simd(struct aegis_state *state,
-			       union aegis_block *tag_xor,
-			       unsigned int assoclen,
-			       unsigned int cryptlen,
-			       unsigned int authsize)
-{
-	scoped_ksimd()
-		return crypto_aegis128_final_neon(state, tag_xor, assoclen,
-						  cryptlen, authsize);
-}
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index e6834bdde9b9..7820fe01cd3a 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -2138,13 +2138,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 				  speed_template_16_24_32);
 		break;
 
-	case 221:
-		test_aead_speed("aegis128", ENCRYPT, sec,
-				NULL, 0, 16, 8, speed_template_16);
-		test_aead_speed("aegis128", DECRYPT, sec,
-				NULL, 0, 16, 8, speed_template_16);
-		break;
-
 	case 222:
 		test_aead_speed("gcm(sm4)", ENCRYPT, sec,
 				NULL, 0, 16, 8, speed_template_16);
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 9419d61d0602..ce6f3171626c 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4062,12 +4062,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.cipher = __VECS(adiantum_xchacha20_aes_tv_template)
 		},
-	}, {
-		.alg = "aegis128",
-		.test = alg_test_aead,
-		.suite = {
-			.aead = __VECS(aegis128_tv_template)
-		}
 	}, {
 		.alg = "authenc(hmac(md5),cbc(aes))",
 		.generic_driver = "authenc(hmac-md5-lib,cbc(aes-lib))",
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index 0ee15a8fae27..40aa7a2f044b 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -23311,450 +23311,6 @@ static const struct aead_testvec rfc7539esp_tv_template[] = {
 	},
 };
 
-/*
- * AEGIS-128 test vectors - generated via reference implementation from
- * SUPERCOP (https://bench.cr.yp.to/supercop.html):
- *
- *   https://bench.cr.yp.to/supercop/supercop-20170228.tar.xz
- *   (see crypto_aead/aegis128/)
- */
-static const struct aead_testvec aegis128_tv_template[] = {
-	{
-		.key	= "\x0f\xc9\x8e\x67\x44\x9e\xaa\x86"
-			  "\x20\x36\x2c\x24\xfe\xc9\x30\x81",
-		.klen	= 16,
-		.iv	= "\x1e\x92\x1c\xcf\x88\x3d\x54\x0d"
-			  "\x40\x6d\x59\x48\xfc\x92\x61\x03",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\x07\xa5\x11\xf2\x9d\x40\xb8\x6d"
-			  "\xda\xb8\x12\x34\x4c\x53\xd9\x72",
-		.clen	= 16,
-	}, {
-		.key	= "\x4b\xed\xc8\x07\x54\x1a\x52\xa2"
-			  "\xa1\x10\xde\xb5\xf8\xed\xf3\x87",
-		.klen	= 16,
-		.iv	= "\x5a\xb7\x56\x6e\x98\xb9\xfd\x29"
-			  "\xc1\x47\x0b\xda\xf6\xb6\x23\x09",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\x79",
-		.plen	= 1,
-		.ctext	= "\x9e\x78\x52\xae\xcb\x9e\xe4\xd3"
-			  "\x9a\xd7\x5d\xd7\xaa\x9a\xe9\x5a"
-			  "\xcc",
-		.clen	= 17,
-	}, {
-		.key	= "\x88\x12\x01\xa6\x64\x96\xfb\xbe"
-			  "\x22\xea\x90\x47\xf2\x11\xb5\x8e",
-		.klen	= 16,
-		.iv	= "\x97\xdb\x90\x0e\xa8\x35\xa5\x45"
-			  "\x42\x21\xbd\x6b\xf0\xda\xe6\x0f",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\xb5\x6e\xad\xdd\x30\x72\xfa\x53"
-			  "\x82\x8e\x16\xb4\xed\x6d\x47",
-		.plen	= 15,
-		.ctext	= "\xc3\x80\x83\x04\x5f\xaa\x61\xc7"
-			  "\xca\xdd\x6f\xac\x85\x08\xb5\x35"
-			  "\x2b\xc2\x3e\x0b\x1b\x39\x37\x2b"
-			  "\x7a\x21\x16\xb3\xe6\x67\x66",
-		.clen	= 31,
-	}, {
-		.key	= "\xc4\x37\x3b\x45\x74\x11\xa4\xda"
-			  "\xa2\xc5\x42\xd8\xec\x36\x78\x94",
-		.klen	= 16,
-		.iv	= "\xd3\x00\xc9\xad\xb8\xb0\x4e\x61"
-			  "\xc3\xfb\x6f\xfd\xea\xff\xa9\x15",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\xf2\x92\xe6\x7d\x40\xee\xa3\x6f"
-			  "\x03\x68\xc8\x45\xe7\x91\x0a\x18",
-		.plen	= 16,
-		.ctext	= "\x23\x25\x30\xe5\x6a\xb6\x36\x7d"
-			  "\x38\xfd\x3a\xd2\xc2\x58\xa9\x11"
-			  "\x1e\xa8\x30\x9c\x16\xa4\xdb\x65"
-			  "\x51\x10\x16\x27\x70\x9b\x64\x29",
-		.clen	= 32,
-	}, {
-		.key	= "\x01\x5c\x75\xe5\x84\x8d\x4d\xf6"
-			  "\x23\x9f\xf4\x6a\xe6\x5a\x3b\x9a",
-		.klen	= 16,
-		.iv	= "\x10\x25\x03\x4c\xc8\x2c\xf7\x7d"
-			  "\x44\xd5\x21\x8e\xe4\x23\x6b\x1c",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\x2e\xb7\x20\x1c\x50\x6a\x4b\x8b"
-			  "\x84\x42\x7a\xd7\xe1\xb5\xcd\x1f"
-			  "\xd3",
-		.plen	= 17,
-		.ctext	= "\x2a\x8d\x56\x91\xc6\xf3\x56\xa5"
-			  "\x1f\xf0\x89\x2e\x13\xad\xe6\xf6"
-			  "\x46\x80\xb1\x0e\x18\x30\x40\x97"
-			  "\x03\xdf\x64\x3c\xbe\x93\x9e\xc9"
-			  "\x3b",
-		.clen	= 33,
-	}, {
-		.key	= "\x3d\x80\xae\x84\x94\x09\xf6\x12"
-			  "\xa4\x79\xa6\xfb\xe0\x7f\xfd\xa0",
-		.klen	= 16,
-		.iv	= "\x4c\x49\x3d\xec\xd8\xa8\xa0\x98"
-			  "\xc5\xb0\xd3\x1f\xde\x48\x2e\x22",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\x6b\xdc\x5a\xbb\x60\xe5\xf4\xa6"
-			  "\x05\x1d\x2c\x68\xdb\xda\x8f\x25"
-			  "\xfe\x8d\x45\x19\x1e\xc0\x0b\x99"
-			  "\x88\x11\x39\x12\x1c\x3a\xbb",
-		.plen	= 31,
-		.ctext	= "\x4e\xf6\xfa\x13\xde\x43\x63\x4c"
-			  "\xe2\x04\x3e\xe4\x85\x14\xb6\x3f"
-			  "\xb1\x8f\x4c\xdb\x41\xa2\x14\x99"
-			  "\xf5\x53\x0f\x73\x86\x7e\x97\xa1"
-			  "\x4b\x56\x5b\x94\xce\xcd\x74\xcd"
-			  "\x75\xc4\x53\x01\x89\x45\x59",
-		.clen	= 47,
-	}, {
-		.key	= "\x7a\xa5\xe8\x23\xa4\x84\x9e\x2d"
-			  "\x25\x53\x58\x8c\xda\xa3\xc0\xa6",
-		.klen	= 16,
-		.iv	= "\x89\x6e\x77\x8b\xe8\x23\x49\xb4"
-			  "\x45\x8a\x85\xb1\xd8\x6c\xf1\x28",
-		.assoc	= "",
-		.alen	= 0,
-		.ptext	= "\xa7\x00\x93\x5b\x70\x61\x9d\xc2"
-			  "\x86\xf7\xde\xfa\xd5\xfe\x52\x2b"
-			  "\x28\x50\x51\x9d\x24\x60\x8d\xb3"
-			  "\x49\x3e\x17\xea\xf6\x99\x5a\xdd",
-		.plen	= 32,
-		.ctext	= "\xa4\x9a\xb7\xfd\xa0\xd4\xd6\x47"
-			  "\x95\xf4\x58\x38\x14\x83\x27\x01"
-			  "\x4c\xed\x32\x2c\xf7\xd6\x31\xf7"
-			  "\x38\x1b\x2c\xc9\xb6\x31\xce\xaa"
-			  "\xa5\x3c\x1a\x18\x5c\xce\xb9\xdf"
-			  "\x51\x52\x77\xf2\x5e\x85\x80\x41",
-		.clen	= 48,
-	}, {
-		.key	= "\xb6\xca\x22\xc3\xb4\x00\x47\x49"
-			  "\xa6\x2d\x0a\x1e\xd4\xc7\x83\xad",
-		.klen	= 16,
-		.iv	= "\xc5\x93\xb0\x2a\xf8\x9f\xf1\xd0"
-			  "\xc6\x64\x37\x42\xd2\x90\xb3\x2e",
-		.assoc	= "\xd5",
-		.alen	= 1,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\xfb\xd4\x83\x71\x9e\x63\xad\x60"
-			  "\xb9\xf9\xeb\x34\x52\x49\xcf\xb7",
-		.clen	= 16,
-	}, {
-		.key	= "\xf3\xee\x5c\x62\xc4\x7c\xf0\x65"
-			  "\x27\x08\xbd\xaf\xce\xec\x45\xb3",
-		.klen	= 16,
-		.iv	= "\x02\xb8\xea\xca\x09\x1b\x9a\xec"
-			  "\x47\x3e\xe9\xd4\xcc\xb5\x76\x34",
-		.assoc	= "\x11\x81\x78\x32\x4d\xb9\x44\x73"
-			  "\x68\x75\x16\xf8\xcb\x7e\xa7",
-		.alen	= 15,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\x0c\xaf\x2e\x96\xf6\x97\x08\x71"
-			  "\x7d\x3a\x84\xc4\x44\x57\x77\x7e",
-		.clen	= 16,
-	}, {
-		.key	= "\x2f\x13\x95\x01\xd5\xf7\x99\x81"
-			  "\xa8\xe2\x6f\x41\xc8\x10\x08\xb9",
-		.klen	= 16,
-		.iv	= "\x3f\xdc\x24\x69\x19\x96\x43\x08"
-			  "\xc8\x18\x9b\x65\xc6\xd9\x39\x3b",
-		.assoc	= "\x4e\xa5\xb2\xd1\x5d\x35\xed\x8f"
-			  "\xe8\x4f\xc8\x89\xc5\xa2\x69\xbc",
-		.alen	= 16,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\xc7\x87\x09\x3b\xc7\x19\x74\x22"
-			  "\x22\xa5\x67\x10\xb2\x36\xb3\x45",
-		.clen	= 16,
-	}, {
-		.key	= "\x6c\x38\xcf\xa1\xe5\x73\x41\x9d"
-			  "\x29\xbc\x21\xd2\xc2\x35\xcb\xbf",
-		.klen	= 16,
-		.iv	= "\x7b\x01\x5d\x08\x29\x12\xec\x24"
-			  "\x49\xf3\x4d\xf7\xc0\xfe\xfb\x41",
-		.assoc	= "\x8a\xca\xec\x70\x6d\xb1\x96\xab"
-			  "\x69\x29\x7a\x1b\xbf\xc7\x2c\xc2"
-			  "\x07",
-		.alen	= 17,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\x02\xc6\x3b\x46\x65\xb2\xef\x91"
-			  "\x31\xf0\x45\x48\x8a\x2a\xed\xe4",
-		.clen	= 16,
-	}, {
-		.key	= "\xa8\x5c\x09\x40\xf5\xef\xea\xb8"
-			  "\xaa\x96\xd3\x64\xbc\x59\x8d\xc6",
-		.klen	= 16,
-		.iv	= "\xb8\x26\x97\xa8\x39\x8e\x94\x3f"
-			  "\xca\xcd\xff\x88\xba\x22\xbe\x47",
-		.assoc	= "\xc7\xef\x26\x10\x7d\x2c\x3f\xc6"
-			  "\xea\x03\x2c\xac\xb9\xeb\xef\xc9"
-			  "\x31\x6b\x08\x12\xfc\xd8\x37\x2d"
-			  "\xe0\x17\x3a\x2e\x83\x5c\x8f",
-		.alen	= 31,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\x20\x85\xa8\xd0\x91\x48\x85\xf3"
-			  "\x5a\x16\xc0\x57\x68\x47\xdd\xcb",
-		.clen	= 16,
-	}, {
-		.key	= "\xe5\x81\x42\xdf\x05\x6a\x93\xd4"
-			  "\x2b\x70\x85\xf5\xb6\x7d\x50\xcc",
-		.klen	= 16,
-		.iv	= "\xf4\x4a\xd1\x47\x49\x09\x3d\x5b"
-			  "\x4b\xa7\xb1\x19\xb4\x46\x81\x4d",
-		.assoc	= "\x03\x14\x5f\xaf\x8d\xa8\xe7\xe2"
-			  "\x6b\xde\xde\x3e\xb3\x10\xb1\xcf"
-			  "\x5c\x2d\x14\x96\x01\x78\xb9\x47"
-			  "\xa1\x44\x19\x06\x5d\xbb\x2e\x2f",
-		.alen	= 32,
-		.ptext	= "",
-		.plen	= 0,
-		.ctext	= "\x6a\xf8\x8d\x9c\x42\x75\x35\x79"
-			  "\xc1\x96\xbd\x31\x6e\x69\x1b\x50",
-		.clen	= 16,
-	}, {
-		.key	= "\x22\xa6\x7c\x7f\x15\xe6\x3c\xf0"
-			  "\xac\x4b\x37\x86\xb0\xa2\x13\xd2",
-		.klen	= 16,
-		.iv	= "\x31\x6f\x0b\xe6\x59\x85\xe6\x77"
-			  "\xcc\x81\x63\xab\xae\x6b\x43\x54",
-		.assoc	= "\x40",
-		.alen	= 1,
-		.ptext	= "\x4f",
-		.plen	= 1,
-		.ctext	= "\x01\x24\xb1\xba\xf6\xd3\xdf\x83"
-			  "\x70\x45\xe3\x2a\x9d\x5c\x63\x98"
-			  "\x39",
-		.clen	= 17,
-	}, {
-		.key	= "\x5e\xcb\xb6\x1e\x25\x62\xe4\x0c"
-			  "\x2d\x25\xe9\x18\xaa\xc6\xd5\xd8",
-		.klen	= 16,
-		.iv	= "\x6d\x94\x44\x86\x69\x00\x8f\x93"
-			  "\x4d\x5b\x15\x3c\xa8\x8f\x06\x5a",
-		.assoc	= "\x7c\x5d\xd3\xee\xad\x9f\x39\x1a"
-			  "\x6d\x92\x42\x61\xa7\x58\x37",
-		.alen	= 15,
-		.ptext	= "\x8b\x26\x61\x55\xf1\x3e\xe3\xa1"
-			  "\x8d\xc8\x6e\x85\xa5\x21\x67",
-		.plen	= 15,
-		.ctext	= "\x18\x78\xc2\x6e\xe1\xf7\xe6\x8a"
-			  "\xca\x0e\x62\x00\xa8\x21\xb5\x21"
-			  "\x3d\x36\xdb\xf7\xcc\x31\x94\x9c"
-			  "\x98\xbd\x71\x7a\xef\xa4\xfa",
-		.clen	= 31,
-	}, {
-		.key	= "\x9b\xef\xf0\xbd\x35\xdd\x8d\x28"
-			  "\xad\xff\x9b\xa9\xa4\xeb\x98\xdf",
-		.klen	= 16,
-		.iv	= "\xaa\xb8\x7e\x25\x79\x7c\x37\xaf"
-			  "\xce\x36\xc7\xce\xa2\xb4\xc9\x60",
-		.assoc	= "\xb9\x82\x0c\x8d\xbd\x1b\xe2\x36"
-			  "\xee\x6c\xf4\xf2\xa1\x7d\xf9\xe2",
-		.alen	= 16,
-		.ptext	= "\xc8\x4b\x9b\xf5\x01\xba\x8c\xbd"
-			  "\x0e\xa3\x21\x16\x9f\x46\x2a\x63",
-		.plen	= 16,
-		.ctext	= "\xea\xd1\x81\x75\xb4\x13\x1d\x86"
-			  "\xd4\x17\x26\xe5\xd6\x89\x39\x04"
-			  "\xa9\x6c\xca\xac\x40\x73\xb2\x4c"
-			  "\x9c\xb9\x0e\x79\x4c\x40\x65\xc6",
-		.clen	= 32,
-	}, {
-		.key	= "\xd7\x14\x29\x5d\x45\x59\x36\x44"
-			  "\x2e\xd9\x4d\x3b\x9e\x0f\x5b\xe5",
-		.klen	= 16,
-		.iv	= "\xe6\xdd\xb8\xc4\x89\xf8\xe0\xca"
-			  "\x4f\x10\x7a\x5f\x9c\xd8\x8b\x66",
-		.assoc	= "\xf5\xa6\x46\x2c\xce\x97\x8a\x51"
-			  "\x6f\x46\xa6\x83\x9b\xa1\xbc\xe8"
-			  "\x05",
-		.alen	= 17,
-		.ptext	= "\x05\x70\xd5\x94\x12\x36\x35\xd8"
-			  "\x8f\x7d\xd3\xa8\x99\x6a\xed\x69"
-			  "\xd0",
-		.plen	= 17,
-		.ctext	= "\xf4\xb2\x84\xd1\x81\xfa\x98\x1c"
-			  "\x38\x2d\x69\x90\x1c\x71\x38\x98"
-			  "\x9f\xe1\x19\x3b\x63\x91\xaf\x6e"
-			  "\x4b\x07\x2c\xac\x53\xc5\xd5\xfe"
-			  "\x93",
-		.clen	= 33,
-	}, {
-		.key	= "\x14\x39\x63\xfc\x56\xd5\xdf\x5f"
-			  "\xaf\xb3\xff\xcc\x98\x33\x1d\xeb",
-		.klen	= 16,
-		.iv	= "\x23\x02\xf1\x64\x9a\x73\x89\xe6"
-			  "\xd0\xea\x2c\xf1\x96\xfc\x4e\x6d",
-		.assoc	= "\x32\xcb\x80\xcc\xde\x12\x33\x6d"
-			  "\xf0\x20\x58\x15\x95\xc6\x7f\xee"
-			  "\x2f\xf9\x4e\x2c\x1b\x98\x43\xc7"
-			  "\x68\x28\x73\x40\x9f\x96\x4a",
-		.alen	= 31,
-		.ptext	= "\x41\x94\x0e\x33\x22\xb1\xdd\xf4"
-			  "\x10\x57\x85\x39\x93\x8f\xaf\x70"
-			  "\xfa\xa9\xd0\x4d\x5c\x40\x23\xcd"
-			  "\x98\x34\xab\x37\x56\xae\x32",
-		.plen	= 31,
-		.ctext	= "\xa0\xe7\x0a\x60\xe7\xb8\x8a\xdb"
-			  "\x94\xd3\x93\xf2\x41\x86\x16\xdd"
-			  "\x4c\xe8\xe7\xe0\x62\x48\x89\x40"
-			  "\xc0\x49\x9b\x63\x32\xec\x8b\xdb"
-			  "\xdc\xa6\xea\x2c\xc2\x7f\xf5\x04"
-			  "\xcb\xe5\x47\xbb\xa7\xd1\x9d",
-		.clen	= 47,
-	}, {
-		.key	= "\x50\x5d\x9d\x9b\x66\x50\x88\x7b"
-			  "\x30\x8e\xb1\x5e\x92\x58\xe0\xf1",
-		.klen	= 16,
-		.iv	= "\x5f\x27\x2b\x03\xaa\xef\x32\x02"
-			  "\x50\xc4\xde\x82\x90\x21\x11\x73",
-		.assoc	= "\x6e\xf0\xba\x6b\xee\x8e\xdc\x89"
-			  "\x71\xfb\x0a\xa6\x8f\xea\x41\xf4"
-			  "\x5a\xbb\x59\xb0\x20\x38\xc5\xe0"
-			  "\x29\x56\x52\x19\x79\xf5\xe9\x37",
-		.alen	= 32,
-		.ptext	= "\x7e\xb9\x48\xd3\x32\x2d\x86\x10"
-			  "\x91\x31\x37\xcb\x8d\xb3\x72\x76"
-			  "\x24\x6b\xdc\xd1\x61\xe0\xa5\xe7"
-			  "\x5a\x61\x8a\x0f\x30\x0d\xd1\xec",
-		.plen	= 32,
-		.ctext	= "\x62\xdc\x2d\x68\x2d\x71\xbb\x33"
-			  "\x13\xdf\xc0\x46\xf6\x61\x94\xa7"
-			  "\x60\xd3\xd4\xca\xd9\xbe\x82\xf3"
-			  "\xf1\x5b\xa0\xfa\x15\xba\xda\xea"
-			  "\x87\x68\x47\x08\x5d\xdd\x83\xb0"
-			  "\x60\xf4\x93\x20\xdf\x34\x8f\xea",
-		.clen	= 48,
-	}, {
-		.key	= "\x8d\x82\xd6\x3b\x76\xcc\x30\x97"
-			  "\xb1\x68\x63\xef\x8c\x7c\xa3\xf7",
-		.klen	= 16,
-		.iv	= "\x9c\x4b\x65\xa2\xba\x6b\xdb\x1e"
-			  "\xd1\x9e\x90\x13\x8a\x45\xd3\x79",
-		.assoc	= "\xab\x14\xf3\x0a\xfe\x0a\x85\xa5"
-			  "\xf2\xd5\xbc\x38\x89\x0e\x04\xfb"
-			  "\x84\x7d\x65\x34\x25\xd8\x47\xfa"
-			  "\xeb\x83\x31\xf1\x54\x54\x89\x0d"
-			  "\x9d",
-		.alen	= 33,
-		.ptext	= "\xba\xde\x82\x72\x42\xa9\x2f\x2c"
-			  "\x12\x0b\xe9\x5c\x87\xd7\x35\x7c"
-			  "\x4f\x2e\xe8\x55\x66\x80\x27\x00"
-			  "\x1b\x8f\x68\xe7\x0a\x6c\x71\xc3"
-			  "\x21\x78\x55\x9d\x9c\x65\x7b\xcd"
-			  "\x0a\x34\x97\xff\x47\x37\xb0\x2a"
-			  "\x80\x0d\x19\x98\x33\xa9\x7a\xe3"
-			  "\x2e\x4c\xc6\xf3\x8c\x88\x42\x01"
-			  "\xbd",
-		.plen	= 65,
-		.ctext	= "\x84\xc5\x21\xab\xe1\xeb\xbb\x6d"
-			  "\xaa\x2a\xaf\xeb\x3b\x3b\x69\xe7"
-			  "\x2c\x47\xef\x9d\xb7\x53\x36\xb7"
-			  "\xb6\xf5\xe5\xa8\xc9\x9e\x02\xd7"
-			  "\x83\x88\xc2\xbd\x2f\xf9\x10\xc0"
-			  "\xf5\xa1\x6e\xd3\x97\x64\x82\xa3"
-			  "\xfb\xda\x2c\xb1\x94\xa1\x58\x32"
-			  "\xe8\xd4\x39\xfc\x9e\x26\xf9\xf1"
-			  "\x61\xe6\xae\x07\xf2\xe0\xa7\x44"
-			  "\x96\x28\x3b\xee\x6b\xc6\x16\x31"
-			  "\x3f",
-		.clen	= 81,
-	}, {
-		.key	= "\xc9\xa7\x10\xda\x86\x48\xd9\xb3"
-			  "\x32\x42\x15\x80\x85\xa1\x65\xfe",
-		.klen	= 16,
-		.iv	= "\xd8\x70\x9f\x42\xca\xe6\x83\x3a"
-			  "\x52\x79\x42\xa5\x84\x6a\x96\x7f",
-		.assoc	= "\xe8\x39\x2d\xaa\x0e\x85\x2d\xc1"
-			  "\x72\xaf\x6e\xc9\x82\x33\xc7\x01"
-			  "\xaf\x40\x70\xb8\x2a\x78\xc9\x14"
-			  "\xac\xb1\x10\xca\x2e\xb3\x28\xe4"
-			  "\xac\xfa\x58\x7f\xe5\x73\x09\x8c"
-			  "\x1d\x40\x87\x8c\xd9\x75\xc0\x55"
-			  "\xa2\xda\x07\xd1\xc2\xa9\xd1\xbb"
-			  "\x09\x4f\x77\x62\x88\x2d\xf2\x68"
-			  "\x54",
-		.alen	= 65,
-		.ptext	= "\xf7\x02\xbb\x11\x52\x24\xd8\x48"
-			  "\x93\xe6\x9b\xee\x81\xfc\xf7\x82"
-			  "\x79\xf0\xf3\xd9\x6c\x20\xa9\x1a"
-			  "\xdc\xbc\x47\xc0\xe4\xcb\x10\x99"
-			  "\x2f",
-		.plen	= 33,
-		.ctext	= "\x8f\x23\x47\xfb\xf2\xac\x23\x83"
-			  "\x77\x09\xac\x74\xef\xd2\x56\xae"
-			  "\x20\x7b\x7b\xca\x45\x8e\xc8\xc2"
-			  "\x50\xbd\xc7\x44\x1c\x54\x98\xd8"
-			  "\x1f\xd0\x9a\x79\xaa\xf9\xe1\xb3"
-			  "\xb4\x98\x5a\x9b\xe4\x4d\xbf\x4e"
-			  "\x39",
-		.clen	= 49,
-	}, {
-		.key	= "\x06\xcc\x4a\x79\x96\xc3\x82\xcf"
-			  "\xb3\x1c\xc7\x12\x7f\xc5\x28\x04",
-		.klen	= 16,
-		.iv	= "\x15\x95\xd8\xe1\xda\x62\x2c\x56"
-			  "\xd3\x53\xf4\x36\x7e\x8e\x59\x85",
-		.assoc	= "\x24\x5e\x67\x49\x1e\x01\xd6\xdd"
-			  "\xf3\x89\x20\x5b\x7c\x57\x89\x07",
-		.alen	= 16,
-		.ptext	= "\x33\x27\xf5\xb1\x62\xa0\x80\x63"
-			  "\x14\xc0\x4d\x7f\x7b\x20\xba\x89",
-		.plen	= 16,
-		.ctext	= "\x42\xc3\x58\xfb\x29\xe2\x4a\x56"
-			  "\xf1\xf5\xe1\x51\x55\x4b\x0a\x45"
-			  "\x46\xb5\x8d\xac\xb6\x34\xd8\x8b"
-			  "\xde\x20\x59\x77\xc1\x74\x90",
-		.clen	= 31,
-	}, {
-		.key	= "\x42\xf0\x84\x19\xa6\x3f\x2b\xea"
-			  "\x34\xf6\x79\xa3\x79\xe9\xeb\x0a",
-		.klen	= 16,
-		.iv	= "\x51\xb9\x12\x80\xea\xde\xd5\x71"
-			  "\x54\x2d\xa6\xc8\x78\xb2\x1b\x8c",
-		.assoc	= "\x61\x83\xa0\xe8\x2e\x7d\x7f\xf8"
-			  "\x74\x63\xd2\xec\x76\x7c\x4c\x0d",
-		.alen	= 16,
-		.ptext	= "\x70\x4c\x2f\x50\x72\x1c\x29\x7f"
-			  "\x95\x9a\xff\x10\x75\x45\x7d\x8f",
-		.plen	= 16,
-		.ctext	= "\xb2\xfb\xf6\x97\x69\x7a\xe9\xec"
-			  "\xe2\x94\xa1\x8b\xa0\x2b\x60\x72"
-			  "\x1d\x04\xdd\x6a\xef\x46\x8f\x68"
-			  "\xe9\xe0\x17\x45\x70\x12",
-		.clen	= 30,
-	}, {
-		.key	= "\x7f\x15\xbd\xb8\xb6\xba\xd3\x06"
-			  "\xb5\xd1\x2b\x35\x73\x0e\xad\x10",
-		.klen	= 16,
-		.iv	= "\x8e\xde\x4c\x20\xfa\x59\x7e\x8d"
-			  "\xd5\x07\x58\x59\x72\xd7\xde\x92",
-		.assoc	= "\x9d\xa7\xda\x88\x3e\xf8\x28\x14"
-			  "\xf5\x3e\x85\x7d\x70\xa0\x0f\x13",
-		.alen	= 16,
-		.ptext	= "\xac\x70\x69\xef\x82\x97\xd2\x9b"
-			  "\x15\x74\xb1\xa2\x6f\x69\x3f\x95",
-		.plen	= 16,
-		.ctext	= "\x47\xda\x54\x42\x51\x72\xc4\x8b"
-			  "\xf5\x57\x0f\x2f\x49\x0e\x11\x3b"
-			  "\x78\x93\xec\xfc\xf4\xff\xe1\x2d",
-		.clen	= 24,
-	},
-};
-
 static const struct drbg_testvec drbg_nopr_hmac_sha512_tv_template[] = {
 	/*
 	 * Borrowed from the first applicable test vector from ACVP:
-- 
2.56.0.567.gdb80ae8cd5-goog