grpc 1.24.0 → 1.25.0

data/third_party/boringssl/crypto/evp/scrypt.c

@@ -30,7 +30,7 @@
 // A block_t is a Salsa20 block.
 typedef struct { uint32_t words[16]; } block_t;
 
-OPENSSL_COMPILE_ASSERT(sizeof(block_t) == 64, block_t_has_padding);
+OPENSSL_STATIC_ASSERT(sizeof(block_t) == 64, "block_t has padding");
 
 #define R(a, b) (((a) << (b)) | ((a) >> (32 - (b))))
 
@@ -173,7 +173,7 @@ int EVP_PBE_scrypt(const char *password, size_t password_len,
 
   // Allocate and divide up the scratch space. |max_mem| fits in a size_t, which
   // is no bigger than uint64_t, so none of these operations may overflow.
-  OPENSSL_COMPILE_ASSERT(UINT64_MAX >= ((size_t)-1), size_t_exceeds_u64);
+  OPENSSL_STATIC_ASSERT(UINT64_MAX >= ((size_t)-1), "size_t exceeds uint64_t");
   size_t B_blocks = p * 2 * r;
   size_t B_bytes = B_blocks * sizeof(block_t);
   size_t T_blocks = 2 * r;
@@ -187,6 +187,10 @@ int EVP_PBE_scrypt(const char *password, size_t password_len,
   int ret = 0;
   block_t *T = B + B_blocks;
   block_t *V = T + T_blocks;
+
+  // NOTE: PKCS5_PBKDF2_HMAC can only fail due to allocation failure
+  // or |iterations| of 0 (we pass 1 here). This is consistent with
+  // the documented failure conditions of EVP_PBE_scrypt.
   if (!PKCS5_PBKDF2_HMAC(password, password_len, salt, salt_len, 1,
                          EVP_sha256(), B_bytes, (uint8_t *)B)) {
     goto err;

data/third_party/boringssl/crypto/fipsmodule/aes/aes.c

@@ -6,7 +6,7 @@
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
+ *    notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ -534,7 +534,8 @@ static const uint32_t rcon[] = {
     // for 128-bit blocks, Rijndael never uses more than 10 rcon values
 };
 
-int AES_set_encrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
+int aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
+                             AES_KEY *aeskey) {
   uint32_t *rk;
   int i = 0;
   uint32_t temp;
@@ -629,7 +630,8 @@ int AES_set_encrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
   return 0;
 }
 
-int AES_set_decrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
+int aes_nohw_set_decrypt_key(const uint8_t *key, unsigned bits,
+                             AES_KEY *aeskey) {
   uint32_t *rk;
   int i, j, status;
   uint32_t temp;
@@ -677,12 +679,10 @@ int AES_set_decrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
   return 0;
 }
 
-void AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
+void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   const uint32_t *rk;
   uint32_t s0, s1, s2, s3, t0, t1, t2, t3;
-#ifndef FULL_UNROLL
   int r;
-#endif  // ?FULL_UNROLL
 
   assert(in && out && key);
   rk = key->rd_key;
@@ -693,130 +693,7 @@ void AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   s1 = GETU32(in + 4) ^ rk[1];
   s2 = GETU32(in + 8) ^ rk[2];
   s3 = GETU32(in + 12) ^ rk[3];
-#ifdef FULL_UNROLL
-  // round 1:
-  t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-       Te3[s3 & 0xff] ^ rk[4];
-  t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-       Te3[s0 & 0xff] ^ rk[5];
-  t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-       Te3[s1 & 0xff] ^ rk[6];
-  t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-       Te3[s2 & 0xff] ^ rk[7];
-  // round 2:
-  s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-       Te3[t3 & 0xff] ^ rk[8];
-  s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-       Te3[t0 & 0xff] ^ rk[9];
-  s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-       Te3[t1 & 0xff] ^ rk[10];
-  s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-       Te3[t2 & 0xff] ^ rk[11];
-  // round 3:
-  t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-       Te3[s3 & 0xff] ^ rk[12];
-  t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-       Te3[s0 & 0xff] ^ rk[13];
-  t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-       Te3[s1 & 0xff] ^ rk[14];
-  t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-       Te3[s2 & 0xff] ^ rk[15];
-  // round 4:
-  s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-       Te3[t3 & 0xff] ^ rk[16];
-  s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-       Te3[t0 & 0xff] ^ rk[17];
-  s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-       Te3[t1 & 0xff] ^ rk[18];
-  s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-       Te3[t2 & 0xff] ^ rk[19];
-  // round 5:
-  t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-       Te3[s3 & 0xff] ^ rk[20];
-  t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-       Te3[s0 & 0xff] ^ rk[21];
-  t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-       Te3[s1 & 0xff] ^ rk[22];
-  t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-       Te3[s2 & 0xff] ^ rk[23];
-  // round 6:
-  s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-       Te3[t3 & 0xff] ^ rk[24];
-  s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-       Te3[t0 & 0xff] ^ rk[25];
-  s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-       Te3[t1 & 0xff] ^ rk[26];
-  s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-       Te3[t2 & 0xff] ^ rk[27];
-  // round 7:
-  t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-       Te3[s3 & 0xff] ^ rk[28];
-  t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-       Te3[s0 & 0xff] ^ rk[29];
-  t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-       Te3[s1 & 0xff] ^ rk[30];
-  t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-       Te3[s2 & 0xff] ^ rk[31];
-  // round 8:
-  s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-       Te3[t3 & 0xff] ^ rk[32];
-  s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-       Te3[t0 & 0xff] ^ rk[33];
-  s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-       Te3[t1 & 0xff] ^ rk[34];
-  s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-       Te3[t2 & 0xff] ^ rk[35];
-  // round 9:
-  t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-       Te3[s3 & 0xff] ^ rk[36];
-  t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-       Te3[s0 & 0xff] ^ rk[37];
-  t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-       Te3[s1 & 0xff] ^ rk[38];
-  t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-       Te3[s2 & 0xff] ^ rk[39];
-  if (key->rounds > 10) {
-    // round 10:
-    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-         Te3[t3 & 0xff] ^ rk[40];
-    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-         Te3[t0 & 0xff] ^ rk[41];
-    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-         Te3[t1 & 0xff] ^ rk[42];
-    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-         Te3[t2 & 0xff] ^ rk[43];
-    // round 11:
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-         Te3[s3 & 0xff] ^ rk[44];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-         Te3[s0 & 0xff] ^ rk[45];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-         Te3[s1 & 0xff] ^ rk[46];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-         Te3[s2 & 0xff] ^ rk[47];
-    if (key->rounds > 12) {
-      // round 12:
-      s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^
-           Te3[t3 & 0xff] ^ rk[48];
-      s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^
-           Te3[t0 & 0xff] ^ rk[49];
-      s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^
-           Te3[t1 & 0xff] ^ rk[50];
-      s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
-           Te3[t2 & 0xff] ^ rk[51];
-      // round 13:
-      t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^
-           Te3[s3 & 0xff] ^ rk[52];
-      t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^
-           Te3[s0 & 0xff] ^ rk[53];
-      t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^
-           Te3[s1 & 0xff] ^ rk[54];
-      t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^
-           Te3[s2 & 0xff] ^ rk[55];
-    }
-  }
-  rk += key->rounds << 2;
-#else  // !FULL_UNROLL
+
   // Nr - 1 full rounds:
   r = key->rounds >> 1;
   for (;;) {
@@ -843,7 +720,7 @@ void AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
     s3 = Te0[(t3 >> 24)] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^
          Te3[(t2) & 0xff] ^ rk[3];
   }
-#endif  // ?FULL_UNROLL
+
   //  apply last round and map cipher state to byte array block:
   s0 = (Te2[(t0 >> 24)] & 0xff000000) ^ (Te3[(t1 >> 16) & 0xff] & 0x00ff0000) ^
        (Te0[(t2 >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(t3) & 0xff] & 0x000000ff) ^
@@ -863,12 +740,10 @@ void AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   PUTU32(out + 12, s3);
 }
 
-void AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
+void aes_nohw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   const uint32_t *rk;
   uint32_t s0, s1, s2, s3, t0, t1, t2, t3;
-#ifndef FULL_UNROLL
   int r;
-#endif  // ?FULL_UNROLL
 
   assert(in && out && key);
   rk = key->rd_key;
@@ -879,130 +754,7 @@ void AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   s1 = GETU32(in + 4) ^ rk[1];
   s2 = GETU32(in + 8) ^ rk[2];
   s3 = GETU32(in + 12) ^ rk[3];
-#ifdef FULL_UNROLL
-  // round 1:
-  t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-       Td3[s1 & 0xff] ^ rk[4];
-  t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-       Td3[s2 & 0xff] ^ rk[5];
-  t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-       Td3[s3 & 0xff] ^ rk[6];
-  t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-       Td3[s0 & 0xff] ^ rk[7];
-  // round 2:
-  s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-       Td3[t1 & 0xff] ^ rk[8];
-  s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-       Td3[t2 & 0xff] ^ rk[9];
-  s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-       Td3[t3 & 0xff] ^ rk[10];
-  s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-       Td3[t0 & 0xff] ^ rk[11];
-  // round 3:
-  t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-       Td3[s1 & 0xff] ^ rk[12];
-  t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-       Td3[s2 & 0xff] ^ rk[13];
-  t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-       Td3[s3 & 0xff] ^ rk[14];
-  t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-       Td3[s0 & 0xff] ^ rk[15];
-  // round 4:
-  s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-       Td3[t1 & 0xff] ^ rk[16];
-  s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-       Td3[t2 & 0xff] ^ rk[17];
-  s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-       Td3[t3 & 0xff] ^ rk[18];
-  s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-       Td3[t0 & 0xff] ^ rk[19];
-  // round 5:
-  t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-       Td3[s1 & 0xff] ^ rk[20];
-  t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-       Td3[s2 & 0xff] ^ rk[21];
-  t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-       Td3[s3 & 0xff] ^ rk[22];
-  t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-       Td3[s0 & 0xff] ^ rk[23];
-  // round 6:
-  s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-       Td3[t1 & 0xff] ^ rk[24];
-  s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-       Td3[t2 & 0xff] ^ rk[25];
-  s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-       Td3[t3 & 0xff] ^ rk[26];
-  s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-       Td3[t0 & 0xff] ^ rk[27];
-  // round 7:
-  t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-       Td3[s1 & 0xff] ^ rk[28];
-  t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-       Td3[s2 & 0xff] ^ rk[29];
-  t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-       Td3[s3 & 0xff] ^ rk[30];
-  t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-       Td3[s0 & 0xff] ^ rk[31];
-  // round 8:
-  s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-       Td3[t1 & 0xff] ^ rk[32];
-  s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-       Td3[t2 & 0xff] ^ rk[33];
-  s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-       Td3[t3 & 0xff] ^ rk[34];
-  s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-       Td3[t0 & 0xff] ^ rk[35];
-  // round 9:
-  t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-       Td3[s1 & 0xff] ^ rk[36];
-  t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-       Td3[s2 & 0xff] ^ rk[37];
-  t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-       Td3[s3 & 0xff] ^ rk[38];
-  t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-       Td3[s0 & 0xff] ^ rk[39];
-  if (key->rounds > 10) {
-    // round 10:
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-         Td3[t1 & 0xff] ^ rk[40];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-         Td3[t2 & 0xff] ^ rk[41];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-         Td3[t3 & 0xff] ^ rk[42];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-         Td3[t0 & 0xff] ^ rk[43];
-    // round 11:
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-         Td3[s1 & 0xff] ^ rk[44];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-         Td3[s2 & 0xff] ^ rk[45];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-         Td3[s3 & 0xff] ^ rk[46];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-         Td3[s0 & 0xff] ^ rk[47];
-    if (key->rounds > 12) {
-      // round 12:
-      s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^
-           Td3[t1 & 0xff] ^ rk[48];
-      s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^
-           Td3[t2 & 0xff] ^ rk[49];
-      s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^
-           Td3[t3 & 0xff] ^ rk[50];
-      s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
-           Td3[t0 & 0xff] ^ rk[51];
-      // round 13:
-      t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^
-           Td3[s1 & 0xff] ^ rk[52];
-      t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^
-           Td3[s2 & 0xff] ^ rk[53];
-      t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^
-           Td3[s3 & 0xff] ^ rk[54];
-      t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^
-           Td3[s0 & 0xff] ^ rk[55];
-    }
-  }
-  rk += key->rounds << 2;
-#else  // !FULL_UNROLL
+
   // Nr - 1 full rounds:
   r = key->rounds >> 1;
   for (;;) {
@@ -1029,7 +781,7 @@ void AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
     s3 = Td0[(t3 >> 24)] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^
          Td3[(t0) & 0xff] ^ rk[3];
   }
-#endif  // ?FULL_UNROLL
+
   // apply last round and
   // map cipher state to byte array block:
   s0 = ((uint32_t)Td4[(t0 >> 24)] << 24) ^
@@ -1054,47 +806,55 @@ void AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   PUTU32(out + 12, s3);
 }
 
-#else
+#endif  // NO_ASM || (!X86 && !X86_64 && !ARM)
 
-// In this case several functions are provided by asm code. However, one cannot
-// control asm symbol visibility with command line flags and such so they are
-// always hidden and wrapped by these C functions, which can be so
-// controlled.
+// Be aware that different sets of AES functions use incompatible key
+// representations, varying in format of the key schedule, the |AES_KEY.rounds|
+// value, or both. Therefore they cannot mix. Also, on AArch64, the plain-C
+// code, above, is incompatible with the |aes_hw_*| functions.
 
-void asm_AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
 void AES_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   if (hwaes_capable()) {
     aes_hw_encrypt(in, out, key);
+  } else if (vpaes_capable()) {
+    vpaes_encrypt(in, out, key);
   } else {
-    asm_AES_encrypt(in, out, key);
+    aes_nohw_encrypt(in, out, key);
   }
 }
 
-void asm_AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
 void AES_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
   if (hwaes_capable()) {
     aes_hw_decrypt(in, out, key);
+  } else if (vpaes_capable()) {
+    vpaes_decrypt(in, out, key);
   } else {
-    asm_AES_decrypt(in, out, key);
+    aes_nohw_decrypt(in, out, key);
   }
 }
 
-int asm_AES_set_encrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey);
 int AES_set_encrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
+  if (bits != 128 && bits != 192 && bits != 256) {
+    return -2;
+  }
   if (hwaes_capable()) {
     return aes_hw_set_encrypt_key(key, bits, aeskey);
+  } else if (vpaes_capable()) {
+    return vpaes_set_encrypt_key(key, bits, aeskey);
   } else {
-    return asm_AES_set_encrypt_key(key, bits, aeskey);
+    return aes_nohw_set_encrypt_key(key, bits, aeskey);
   }
 }
 
-int asm_AES_set_decrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey);
 int AES_set_decrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
+  if (bits != 128 && bits != 192 && bits != 256) {
+    return -2;
+  }
   if (hwaes_capable()) {
     return aes_hw_set_decrypt_key(key, bits, aeskey);
+  } else if (vpaes_capable()) {
+    return vpaes_set_decrypt_key(key, bits, aeskey);
   } else {
-    return asm_AES_set_decrypt_key(key, bits, aeskey);
+    return aes_nohw_set_decrypt_key(key, bits, aeskey);
   }
 }
-
-#endif  // OPENSSL_NO_ASM || (!OPENSSL_X86 && !OPENSSL_X86_64 && !OPENSSL_ARM)

data/third_party/boringssl/crypto/fipsmodule/aes/internal.h

@@ -24,21 +24,54 @@ extern "C" {
 #endif
 
 
-#if !defined(OPENSSL_NO_ASM) && (defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
+#if !defined(OPENSSL_NO_ASM)
+
+#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
 #define HWAES
+#define HWAES_ECB
+
+OPENSSL_INLINE int hwaes_capable(void) {
+  return (OPENSSL_ia32cap_get()[1] & (1 << (57 - 32))) != 0;
+}
 
-static int hwaes_capable(void) {
-  return CRYPTO_is_ARMv8_AES_capable();
+#define VPAES
+#if defined(OPENSSL_X86_64)
+#define VPAES_CTR32
+#endif
+#define VPAES_CBC
+OPENSSL_INLINE int vpaes_capable(void) {
+  return (OPENSSL_ia32cap_get()[1] & (1 << (41 - 32))) != 0;
 }
-#endif  // !NO_ASM && (AES || AARCH64)
 
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_PPC64LE)
+#elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
+#define HWAES
+
+OPENSSL_INLINE int hwaes_capable(void) { return CRYPTO_is_ARMv8_AES_capable(); }
+
+#if defined(OPENSSL_ARM)
+#define BSAES
+#define VPAES
+#define VPAES_CTR32
+OPENSSL_INLINE int bsaes_capable(void) { return CRYPTO_is_NEON_capable(); }
+OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
+#endif
+
+#if defined(OPENSSL_AARCH64)
+#define VPAES
+#define VPAES_CBC
+#define VPAES_CTR32
+OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
+#endif
+
+#elif defined(OPENSSL_PPC64LE)
 #define HWAES
 
-static int hwaes_capable(void) {
+OPENSSL_INLINE int hwaes_capable(void) {
   return CRYPTO_is_PPC64LE_vcrypto_capable();
 }
-#endif  // !NO_ASM && PPC64LE
+#endif
+
+#endif  // !NO_ASM
 
 
 #if defined(HWAES)
@@ -58,41 +91,148 @@ void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
 
 // If HWAES isn't defined then we provide dummy functions for each of the hwaes
 // functions.
-static int hwaes_capable(void) { return 0; }
+OPENSSL_INLINE int hwaes_capable(void) { return 0; }
 
-static int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits,
-                                  AES_KEY *key) {
+OPENSSL_INLINE int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits,
+                                          AES_KEY *key) {
   abort();
 }
 
-static int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits,
-                                  AES_KEY *key) {
+OPENSSL_INLINE int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits,
+                                          AES_KEY *key) {
   abort();
 }
 
-static void aes_hw_encrypt(const uint8_t *in, uint8_t *out,
-                           const AES_KEY *key) {
+OPENSSL_INLINE void aes_hw_encrypt(const uint8_t *in, uint8_t *out,
+                                   const AES_KEY *key) {
   abort();
 }
 
-static void aes_hw_decrypt(const uint8_t *in, uint8_t *out,
-                           const AES_KEY *key) {
+OPENSSL_INLINE void aes_hw_decrypt(const uint8_t *in, uint8_t *out,
+                                   const AES_KEY *key) {
   abort();
 }
 
-static void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
-                               const AES_KEY *key, uint8_t *ivec, int enc) {
+OPENSSL_INLINE void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out,
+                                       size_t length, const AES_KEY *key,
+                                       uint8_t *ivec, int enc) {
   abort();
 }
 
-static void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
-                                        size_t len, const AES_KEY *key,
-                                        const uint8_t ivec[16]) {
+OPENSSL_INLINE void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
+                                                size_t len, const AES_KEY *key,
+                                                const uint8_t ivec[16]) {
   abort();
 }
 
 #endif  // !HWAES
 
+
+#if defined(HWAES_ECB)
+void aes_hw_ecb_encrypt(const uint8_t *in, uint8_t *out, size_t length,
+                        const AES_KEY *key, const int enc);
+#endif  // HWAES_ECB
+
+
+#if defined(BSAES)
+// Note |bsaes_cbc_encrypt| requires |enc| to be zero.
+void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
+                       const AES_KEY *key, uint8_t ivec[16], int enc);
+void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
+                                const AES_KEY *key, const uint8_t ivec[16]);
+// VPAES to BSAES conversions are available on all BSAES platforms.
+void vpaes_encrypt_key_to_bsaes(AES_KEY *out_bsaes, const AES_KEY *vpaes);
+void vpaes_decrypt_key_to_bsaes(AES_KEY *out_bsaes, const AES_KEY *vpaes);
+#else
+OPENSSL_INLINE char bsaes_capable(void) { return 0; }
+
+// On other platforms, bsaes_capable() will always return false and so the
+// following will never be called.
+OPENSSL_INLINE void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out,
+                                      size_t length, const AES_KEY *key,
+                                      uint8_t ivec[16], int enc) {
+  abort();
+}
+
+OPENSSL_INLINE void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
+                                               size_t len, const AES_KEY *key,
+                                               const uint8_t ivec[16]) {
+  abort();
+}
+
+OPENSSL_INLINE void vpaes_encrypt_key_to_bsaes(AES_KEY *out_bsaes,
+                                               const AES_KEY *vpaes) {
+  abort();
+}
+
+OPENSSL_INLINE void vpaes_decrypt_key_to_bsaes(AES_KEY *out_bsaes,
+                                               const AES_KEY *vpaes) {
+  abort();
+}
+#endif  // !BSAES
+
+
+#if defined(VPAES)
+// On platforms where VPAES gets defined (just above), then these functions are
+// provided by asm.
+int vpaes_set_encrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
+int vpaes_set_decrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
+
+void vpaes_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+void vpaes_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+
+#if defined(VPAES_CBC)
+void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
+                       const AES_KEY *key, uint8_t *ivec, int enc);
+#endif
+#if defined(VPAES_CTR32)
+void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
+                                const AES_KEY *key, const uint8_t ivec[16]);
+#endif
+#else
+OPENSSL_INLINE char vpaes_capable(void) { return 0; }
+
+// On other platforms, vpaes_capable() will always return false and so the
+// following will never be called.
+OPENSSL_INLINE int vpaes_set_encrypt_key(const uint8_t *userKey, int bits,
+                                         AES_KEY *key) {
+  abort();
+}
+OPENSSL_INLINE int vpaes_set_decrypt_key(const uint8_t *userKey, int bits,
+                                         AES_KEY *key) {
+  abort();
+}
+OPENSSL_INLINE void vpaes_encrypt(const uint8_t *in, uint8_t *out,
+                                  const AES_KEY *key) {
+  abort();
+}
+OPENSSL_INLINE void vpaes_decrypt(const uint8_t *in, uint8_t *out,
+                                  const AES_KEY *key) {
+  abort();
+}
+OPENSSL_INLINE void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out,
+                                      size_t length, const AES_KEY *key,
+                                      uint8_t *ivec, int enc) {
+  abort();
+}
+#endif  // !VPAES
+
+
+void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+void aes_nohw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+int aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
+                             AES_KEY *aeskey);
+int aes_nohw_set_decrypt_key(const uint8_t *key, unsigned bits,
+                             AES_KEY *aeskey);
+
+#if !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_X86))
+#define AES_NOHW_CBC
+void aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+                          const AES_KEY *key, uint8_t *ivec, const int enc);
+#endif
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif