19 files changed, 317 insertions, 42 deletions

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index d57e3bc..8334ae6 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
       matrix:
         os: ["ubuntu-22.04", "ubuntu-24.04"]
-        arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"]
+        arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"]
         compiler: ["gcc"]
         include:
           - os: "ubuntu-22.04"
@@ -32,12 +32,15 @@ jobs:
           - os: "ubuntu-24.04"
             arch: "native"
             compiler: "clang"
+          - os: "ubuntu-24.04" # loong64
+            arch: "loong64"
+            compiler: "gcc"
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@v4
 
       - name: "Run tests"
-        run: ./scripts/test
+        run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
         env:
           ARCH: "${{ matrix.arch }}"
           CC: "${{ matrix.compiler }}"
diff --git a/.gitignore b/.gitignore
index 14917f9..7aff24f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -239,6 +239,8 @@ include/openssl/*.h
 
 /crypto/*
 !/crypto/Makefile.am.*
+!/crypto/arch/
+!/crypto/arch/mips/*
 !/crypto/compat/
 /crypto/compat/*
 !/crypto/compat/arc4random.h
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 437570b..8437e02 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -72,10 +72,6 @@ endforeach()
 
 set(BUILD_NC true)
 
-if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
-        add_definitions(-fno-common)
-endif()
-
 if(CMAKE_SYSTEM_NAME MATCHES "OpenBSD")
         add_definitions(-DHAVE_ATTRIBUTE__BOUNDED__)
         add_definitions(-DHAVE_ATTRIBUTE__DEAD__)
@@ -131,7 +127,7 @@ add_definitions(-D__END_HIDDEN_DECLS=)
 set(CMAKE_POSITION_INDEPENDENT_CODE true)
 
 if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
-        add_definitions(-Wno-pointer-sign)
+        add_compile_options(-Wno-pointer-sign)
 endif()
 
 if(WIN32)
@@ -389,6 +385,8 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)")
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)")
         set(ENABLE_ASM false)
         set(HOST_I386 true)
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64")
+        set(HOST_LOONGARCH64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips64")
         set(HOST_MIPS64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips")
diff --git a/ChangeLog b/ChangeLog
index 02f448c..52aa44d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -31,6 +31,8 @@ LibreSSL Portable Release Notes:
 4.1.0 - In development
 
         * Portable changes
+          - Added initial experimental support for loongarch64.
+          - Fixed compilation for mips32 and reenable CI.
           - Fixed CMake builds on FreeBSD.
           - Fixed the --prefix option for cmake --install.
           - Fixed tests for MinGW due to missing sh(1).
@@ -63,6 +65,10 @@ LibreSSL Portable Release Notes:
           - Replaced BN_bn2hex() reimplementation in openssl(1) ca with
             a poper API call.
           - Fixed integer overflows due to signed shift in obj_dat.c.
+          - Fixed a few memory leaks in legacy code.
+          - Improved some X509_VERIFY_PARAM internals and avoid an out of
+            bounds read from public API.
+          - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).
         * Compatibility changes
           - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto().
             It has no effect since LibreSSL doesn't call atexit().
@@ -71,6 +77,9 @@ LibreSSL Portable Release Notes:
           - EC_METHOD is no longer public and the API exposing it has been
             removed. This includes EC_GROUP_new(), EC_GFp_mont_method(),
             EC_GROUP_method_of() and EC_METHOD_get_field_type().
+          - The precomputation stubs for EC_GROUP were removed.
+          - The API setting Jacobian projective coordinates for a point was
+            removed as were EC_POINTs_{mul,make_affine}().
           - All elliptic curves over fields with less than 224 bits and a
             few more were removed from the built-in curves. This includes
             all WTLS curves and P-192.
@@ -79,26 +88,24 @@ LibreSSL Portable Release Notes:
           - Removed the -C option to generate "C code" from the openssl(1)
             dh, dhparam, dsaparam, ecparam, and x509 subcommands.
           - Removed #error in headers when OPENSSL_NO_* is defined.
-          - EC_METHOD is no longer public and all public API directly using
-            it was removed. This includes EC_GROUP_new(), EC_GFp_mont_method()
-            EC_{GROUP,POINT}_method_of() and EC_METHOD_get_field_type().
-          - The precomputation stubs for EC_GROUP were removed.
-          - The API setting Jacobian projective coordinates for a point was
-            removed as were EC_POINTs_{mul,make_affine}().
           - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and
             CRYPTO_set_mem_ex_functions() was removed.
-          - X509_NAME_print() and X509_OBJECT_up_ref_count() are no longer public.
+          - The tls_session_secret_cb_fn type now matches OpenSSL 1.1.
+          - Unexport X509_NAME_print() and X509_OBJECT_up_ref_count().
           - const corrected UI_OpenSSL() and BN_MONT_CTX_copy().
           - Support OPENSSL_NO_FILENAMES.
           - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.
+          - Export PKCS12_key_gen_uni() again.
         * New features
           - libtls has a new tls_peer_cert_common_name() API call to retrieve
             the peer's common name without having to inspect the PEM.
-          - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).
         * Bug fixes
           - Plugged a leak in eckey_compute_pubkey().
           - Again allow the magic values -1, -2 and -3 for the salt length
             of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface.
+        * Documentation
+          - The remaining undocumented public EVP API is now documented.
+            Reorganization of existing documentation for clarity and accuracy.
         * Testing and proactive security
           - Improved regress coverage of the EC code.
 
diff --git a/configure.ac b/configure.ac
index 864a4ad..7a88f27 100644
--- a/configure.ac
+++ b/configure.ac
@@ -86,16 +86,17 @@ AS_CASE([$host_cpu],
 )
 AM_CONDITIONAL([HOST_CPU_IS_INTEL], [test "x$HOSTARCH" = "xintel"])
 
-AM_CONDITIONAL([HOST_AARCH64],   [test "$host_cpu" = "aarch64"])
-AM_CONDITIONAL([HOST_ARM],       [test "$host_cpu" = "arm"])
-AM_CONDITIONAL([HOST_I386],      [test "$host_cpu" = "i386"])
-AM_CONDITIONAL([HOST_MIPS],      [test "$host_cpu" = "mips"])
-AM_CONDITIONAL([HOST_MIPS64],    [test "$host_cpu" = "mips64"])
-AM_CONDITIONAL([HOST_POWERPC],   [test "$host_cpu" = "powerpc"])
-AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"])
-AM_CONDITIONAL([HOST_RISCV64],   [test "$host_cpu" = "riscv64"])
-AM_CONDITIONAL([HOST_SPARC64],   [test "$host_cpu" = "sparc64"])
-AM_CONDITIONAL([HOST_X86_64],    [test "$host_cpu" = "x86_64"])
+AM_CONDITIONAL([HOST_AARCH64],      [test "$host_cpu" = "aarch64"])
+AM_CONDITIONAL([HOST_ARM],          [test "$host_cpu" = "arm"])
+AM_CONDITIONAL([HOST_I386],         [test "$host_cpu" = "i386"])
+AM_CONDITIONAL([HOST_LOONGARCH64],  [test "$host_cpu" = "loongarch64"])
+AM_CONDITIONAL([HOST_MIPS],         [test "$host_cpu" = "mips"])
+AM_CONDITIONAL([HOST_MIPS64],       [test "$host_cpu" = "mips64"])
+AM_CONDITIONAL([HOST_POWERPC],      [test "$host_cpu" = "powerpc"])
+AM_CONDITIONAL([HOST_POWERPC64],    [test "$host_cpu" = "ppc64"])
+AM_CONDITIONAL([HOST_RISCV64],      [test "$host_cpu" = "riscv64"])
+AM_CONDITIONAL([HOST_SPARC64],      [test "$host_cpu" = "sparc64"])
+AM_CONDITIONAL([HOST_X86_64],       [test "$host_cpu" = "x86_64"])
 
 AC_MSG_CHECKING([if .gnu.warning accepts long strings])
 AC_LINK_IFELSE([AC_LANG_SOURCE([[
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index e642b01..64bccd8 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -774,11 +774,14 @@ elseif(HOST_ARM)
 elseif(HOST_I386)
         target_include_directories(crypto_obj PRIVATE arch/i386/)
         target_include_directories(crypto_obj PRIVATE bn/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/loongarch64)
+        target_include_directories(crypto_obj PRIVATE bn/arch/loongarch64)
 elseif(HOST_MIPS64)
         target_include_directories(crypto_obj PRIVATE arch/mips64)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        target_include_directories(crypto_obj PRIVATE arch/mips)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips)
 elseif(HOST_POWERPC)
         target_include_directories(crypto_obj PRIVATE arch/powerpc)
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index 438da8b..d1c5b76 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -396,10 +396,18 @@ endif
 noinst_HEADERS += arch/i386/crypto_arch.h
 noinst_HEADERS += bn/arch/i386/bn_arch.h
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/loongarch64/
+endif
+noinst_HEADERS += arch/loongarch64/crypto_arch.h
+noinst_HEADERS += bn/arch/loongarch64/bn_arch.h
+
 if HOST_MIPS
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/
 endif
+noinst_HEADERS += arch/mips/crypto_arch.h
 noinst_HEADERS += bn/arch/mips/bn_arch.h
 
 if HOST_MIPS64
diff --git a/crypto/arch/loongarch64/crypto_arch.h b/crypto/arch/loongarch64/crypto_arch.h
new file mode 100644
index 0000000..a3dd98d
--- /dev/null
+++ b/crypto/arch/loongarch64/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD: crypto_arch.h,v 1.1 2024/08/11 13:02:39 jsing Exp $ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h
new file mode 100644
index 0000000..274879c
--- /dev/null
+++ b/crypto/arch/mips/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD$ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/bn/arch/loongarch64/bn_arch.h b/crypto/bn/arch/loongarch64/bn_arch.h
new file mode 100644
index 0000000..672ac12
--- /dev/null
+++ b/crypto/bn/arch/loongarch64/bn_arch.h
@@ -0,0 +1,23 @@
+/*      $OpenBSD: bn_arch.h,v 1.7 2023/07/09 10:37:32 jsing Exp $ */
+/*
+ * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/bn.h>
+
+#ifndef HEADER_BN_ARCH_H
+#define HEADER_BN_ARCH_H
+
+#endif
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 59f5b62..11ab7c2 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -24,6 +24,8 @@ elseif(HOST_ARM)
         file(READ arch/arm/opensslconf.h OPENSSLCONF)
 elseif(HOST_I386)
         file(READ arch/i386/opensslconf.h OPENSSLCONF)
+elseif(HOST_LOONGARCH64)
+        file(READ arch/loongarch64/opensslconf.h OPENSSLCONF)
 elseif(HOST_MIPS)
         file(READ arch/mips/opensslconf.h OPENSSLCONF)
 elseif(HOST_MIPS64)
diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h
new file mode 100644
index 0000000..731b06a
--- /dev/null
+++ b/include/arch/loongarch64/opensslconf.h
@@ -0,0 +1,154 @@
+#include <openssl/opensslfeatures.h>
+/* crypto/opensslconf.h.in */
+
+#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR)
+#define OPENSSLDIR "/etc/ssl"
+#endif
+
+#undef OPENSSL_EXPORT_VAR_AS_FUNCTION
+
+#ifndef OPENSSL_FILE
+#ifdef OPENSSL_NO_FILENAMES
+#define OPENSSL_FILE ""
+#define OPENSSL_LINE 0
+#else
+#define OPENSSL_FILE __FILE__
+#define OPENSSL_LINE __LINE__
+#endif
+#endif
+
+#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
+#define IDEA_INT unsigned int
+#endif
+
+#if defined(HEADER_MD2_H) && !defined(MD2_INT)
+#define MD2_INT unsigned int
+#endif
+
+#if defined(HEADER_RC2_H) && !defined(RC2_INT)
+/* I need to put in a mod for the alpha - eay */
+#define RC2_INT unsigned int
+#endif
+
+#if defined(HEADER_RC4_H)
+#if !defined(RC4_INT)
+/* using int types make the structure larger but make the code faster
+ * on most boxes I have tested - up to %20 faster. */
+/*
+ * I don't know what does "most" mean, but declaring "int" is a must on:
+ * - Intel P6 because partial register stalls are very expensive;
+ * - elder Alpha because it lacks byte load/store instructions;
+ */
+#define RC4_INT unsigned int
+#endif
+#if !defined(RC4_CHUNK)
+/*
+ * This enables code handling data aligned at natural CPU word
+ * boundary. See crypto/rc4/rc4_enc.c for further details.
+ */
+#define RC4_CHUNK unsigned long
+#endif
+#endif
+
+#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)
+/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
+ * %20 speed up (longs are 8 bytes, int's are 4). */
+#ifndef DES_LONG
+#define DES_LONG unsigned int
+#endif
+#endif
+
+#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
+#define CONFIG_HEADER_BN_H
+#undef BN_LLONG
+
+/* Should we define BN_DIV2W here? */
+
+/* Only one for the following should be defined */
+/* The prime number generation stuff may not work when
+ * EIGHT_BIT but I don't care since I've only used this mode
+ * for debugging the bignum libraries */
+#define SIXTY_FOUR_BIT_LONG
+#undef SIXTY_FOUR_BIT
+#undef THIRTY_TWO_BIT
+#undef SIXTEEN_BIT
+#undef EIGHT_BIT
+#endif
+
+#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
+#define CONFIG_HEADER_BF_LOCL_H
+#undef BF_PTR
+#endif /* HEADER_BF_LOCL_H */
+
+#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
+#define CONFIG_HEADER_DES_LOCL_H
+#ifndef DES_DEFAULT_OPTIONS
+/* the following is tweaked from a config script, that is why it is a
+ * protected undef/define */
+#ifndef DES_PTR
+#undef DES_PTR
+#endif
+
+/* This helps C compiler generate the correct code for multiple functional
+ * units.  It reduces register dependencies at the expense of 2 more
+ * registers */
+#ifndef DES_RISC1
+#undef DES_RISC1
+#endif
+
+#ifndef DES_RISC2
+#undef DES_RISC2
+#endif
+
+#if defined(DES_RISC1) && defined(DES_RISC2)
+YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
+#endif
+
+/* Unroll the inner loop, this sometimes helps, sometimes hinders.
+ * Very much CPU dependent */
+#ifndef DES_UNROLL
+#define DES_UNROLL
+#endif
+
+/* These default values were supplied by
+ * Peter Gutman <pgut001@cs.auckland.ac.nz>
+ * They are only used if nothing else has been defined */
+#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
+/* Special defines which change the way the code is built depending on the
+   CPU and OS.  For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
+   even newer MIPS CPU's, but at the moment one size fits all for
+   optimization options.  Older Sparc's work better with only UNROLL, but
+   there's no way to tell at compile time what it is you're running on */
+ 
+#if defined( sun )              /* Newer Sparc's */
+#  define DES_PTR
+#  define DES_RISC1
+#  define DES_UNROLL
+#elif defined( __ultrix )       /* Older MIPS */
+#  define DES_PTR
+#  define DES_RISC2
+#  define DES_UNROLL
+#elif defined( __osf1__ )       /* Alpha */
+#  define DES_PTR
+#  define DES_RISC2
+#elif defined ( _AIX )          /* RS6000 */
+  /* Unknown */
+#elif defined( __hpux )         /* HP-PA */
+  /* Unknown */
+#elif defined( __aux )          /* 68K */
+  /* Unknown */
+#elif defined( __dgux )         /* 88K (but P6 in latest boxes) */
+#  define DES_UNROLL
+#elif defined( __sgi )          /* Newer MIPS */
+#  define DES_PTR
+#  define DES_RISC2
+#  define DES_UNROLL
+#elif defined(i386) || defined(__i386__)        /* x86 boxes, should be gcc */
+#  define DES_PTR
+#  define DES_RISC1
+#  define DES_UNROLL
+#endif /* Systems-specific speed defines */
+#endif
+
+#endif /* DES_DEFAULT_OPTIONS */
+#endif /* HEADER_DES_LOCL_H */
diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h
index f17d3d2..a5d26b6 100644
--- a/include/arch/mips/opensslconf.h
+++ b/include/arch/mips/opensslconf.h
@@ -1,15 +1,22 @@
 #include <openssl/opensslfeatures.h>
 /* crypto/opensslconf.h.in */
 
-#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
+#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR)
 #define OPENSSLDIR "/etc/ssl"
 #endif
 
-#undef OPENSSL_UNISTD
-#define OPENSSL_UNISTD <unistd.h>
-
 #undef OPENSSL_EXPORT_VAR_AS_FUNCTION
 
+#ifndef OPENSSL_FILE
+#ifdef OPENSSL_NO_FILENAMES
+#define OPENSSL_FILE ""
+#define OPENSSL_LINE 0
+#else
+#define OPENSSL_FILE __FILE__
+#define OPENSSL_LINE __LINE__
+#endif
+#endif
+
 #if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
 #define IDEA_INT unsigned int
 #endif
@@ -68,13 +75,6 @@
 #undef EIGHT_BIT
 #endif
 
-#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
-#define CONFIG_HEADER_RC4_LOCL_H
-/* if this is defined data[i] is used instead of *data, this is a %20
- * speedup on x86 */
-#define RC4_INDEX
-#endif
-
 #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
 #define CONFIG_HEADER_BF_LOCL_H
 #undef BF_PTR
diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl
index 303d0b9..4bbbd60 100644
--- a/include/openssl/Makefile.am.tpl
+++ b/include/openssl/Makefile.am.tpl
@@ -17,6 +17,9 @@ endif
 if HOST_I386
         -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h
 endif
+if HOST_LOONGARCH64
+        -cp $(top_srcdir)/include/arch/loongarch64/opensslconf.h opensslconf.h
+endif
 if HOST_MIPS
         -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h
 endif
diff --git a/scripts/test b/scripts/test
index 1fb02eb..a93fe90 100755
--- a/scripts/test
+++ b/scripts/test
@@ -132,6 +132,21 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then
 
         file apps/openssl/.libs/openssl
 
+elif [ "$ARCH" = "loong64" ]; then
+        sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu
+        sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64
+
+        CC=loongarch64-linux-gnu-gcc-14
+        CXX=loongarch64-linux-gnu++-14
+        AR=loongarch64-linux-gnu-ar
+        STRIP=loongarch64-linux-gnu-strip-14
+        RANLIB=loongarch64-linux-gnu-ranlib
+
+        ./configure --host=loongarch64-linux-gnu
+        LD_LIBRARY_PATH=/usr/loongarch64-linux-gnu/lib make -j 4 check
+
+        file apps/openssl/openssl
+
 elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then
         sudo apt-get install -y qemu-user-static binfmt-support
 
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index bdcfbb2..cd7e335 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -117,10 +117,12 @@ elseif(HOST_ARM)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/arm/)
 elseif(HOST_I386)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/loongarch64)
 elseif(HOST_MIPS64)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips)
 elseif(HOST_POWERPC)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc)
 elseif(HOST_POWERPC64)
diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index f9a66a3..2c84bff 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -131,9 +131,15 @@ libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 endif
 noinst_HEADERS += $(top_srcdir)/crypto/arch/i386/crypto_arch.h
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/loongarch64/crypto_arch.h
+
 if HOST_MIPS
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/mips/crypto_arch.h
 
 if HOST_MIPS64
 libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 8d6fa9d..d7cc499 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -28,10 +28,12 @@ elseif(HOST_ARM)
         include_directories(../crypto/arch/arm/)
 elseif(HOST_I386)
         include_directories(../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        include_directories(../crypto/arch/loongarch64)
 elseif(HOST_MIPS64)
         include_directories(../crypto/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        include_directories(../crypto/arch/mips)
 elseif(HOST_POWERPC)
         include_directories(../crypto/arch/powerpc)
 elseif(HOST_POWERPC64)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 8153fc9..b58de21 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -36,8 +36,12 @@ if HOST_I386
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 endif
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+
 if HOST_MIPS
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 endif
 
 if HOST_MIPS64