grpc 1.63.0 → 1.65.2

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/internal.h

@@ -26,20 +26,7 @@ extern "C" {
 // Define SHA{n}[_{variant}]_ASM if sha{n}_block_data_order[_{variant}] is
 // defined in assembly.
 
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
-
-#define SHA1_ASM
-#define SHA256_ASM
-#define SHA512_ASM
-
-void sha1_block_data_order(uint32_t *state, const uint8_t *data,
-                           size_t num_blocks);
-void sha256_block_data_order(uint32_t *state, const uint8_t *data,
-                             size_t num_blocks);
-void sha512_block_data_order(uint64_t *state, const uint8_t *data,
-                             size_t num_blocks);
-
-#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM)
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM)
 
 #define SHA1_ASM_NOHW
 #define SHA256_ASM_NOHW
@@ -51,7 +38,7 @@ OPENSSL_INLINE int sha1_hw_capable(void) {
 }
 
 #define SHA1_ASM_NEON
-void sha1_block_data_order_neon(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_neon(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA256_ASM_HW
@@ -60,12 +47,12 @@ OPENSSL_INLINE int sha256_hw_capable(void) {
 }
 
 #define SHA256_ASM_NEON
-void sha256_block_data_order_neon(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_neon(uint32_t state[8], const uint8_t *data,
                                   size_t num);
 
 // Armv8.2 SHA-512 instructions are not available in 32-bit.
 #define SHA512_ASM_NEON
-void sha512_block_data_order_neon(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_neon(uint64_t state[8], const uint8_t *data,
                                   size_t num);
 
 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
@@ -89,6 +76,67 @@ OPENSSL_INLINE int sha512_hw_capable(void) {
   return CRYPTO_is_ARMv8_SHA512_capable();
 }
 
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
+
+#define SHA1_ASM_NOHW
+#define SHA256_ASM_NOHW
+#define SHA512_ASM_NOHW
+
+#define SHA1_ASM_SSSE3
+OPENSSL_INLINE int sha1_ssse3_capable(void) {
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+}
+void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
+                                 size_t num);
+
+#define SHA1_ASM_AVX
+OPENSSL_INLINE int sha1_avx_capable(void) {
+  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
+  // discussion in sha1-586.pl.
+  //
+  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
+         CRYPTO_is_FXSR_capable();
+}
+void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
+                               size_t num);
+
+#define SHA256_ASM_SSSE3
+OPENSSL_INLINE int sha256_ssse3_capable(void) {
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+}
+void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
+                                   size_t num);
+
+#define SHA256_ASM_AVX
+OPENSSL_INLINE int sha256_avx_capable(void) {
+  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
+  // discussion in sha1-586.pl.
+  //
+  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
+         CRYPTO_is_FXSR_capable();
+}
+void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
+                                 size_t num);
+
+#define SHA512_ASM_SSSE3
+OPENSSL_INLINE int sha512_ssse3_capable(void) {
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+}
+void sha512_block_data_order_ssse3(uint64_t state[8], const uint8_t *data,
+                                   size_t num);
+
 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
 
 #define SHA1_ASM_NOHW
@@ -105,7 +153,7 @@ OPENSSL_INLINE int sha1_avx2_capable(void) {
   return CRYPTO_is_AVX2_capable() && CRYPTO_is_BMI2_capable() &&
          CRYPTO_is_BMI1_capable();
 }
-void sha1_block_data_order_avx2(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_avx2(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA1_ASM_AVX
@@ -114,14 +162,14 @@ OPENSSL_INLINE int sha1_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha1_block_data_order_avx(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
                                size_t num);
 
 #define SHA1_ASM_SSSE3
 OPENSSL_INLINE int sha1_ssse3_capable(void) {
   return CRYPTO_is_SSSE3_capable();
 }
-void sha1_block_data_order_ssse3(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_HW
@@ -136,14 +184,14 @@ OPENSSL_INLINE int sha256_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha256_block_data_order_avx(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_SSSE3
 OPENSSL_INLINE int sha256_ssse3_capable(void) {
   return CRYPTO_is_SSSE3_capable();
 }
-void sha256_block_data_order_ssse3(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
                                    size_t num);
 
 #define SHA512_ASM_AVX
@@ -152,35 +200,36 @@ OPENSSL_INLINE int sha512_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha512_block_data_order_avx(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_avx(uint64_t state[8], const uint8_t *data,
                                  size_t num);
 
 #endif
 
 #if defined(SHA1_ASM_HW)
-void sha1_block_data_order_hw(uint32_t *state, const uint8_t *data, size_t num);
+void sha1_block_data_order_hw(uint32_t state[5], const uint8_t *data,
+                              size_t num);
 #endif
 #if defined(SHA1_ASM_NOHW)
-void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_nohw(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 #endif
 
 #if defined(SHA256_ASM_HW)
-void sha256_block_data_order_hw(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_hw(uint32_t state[8], const uint8_t *data,
                                 size_t num);
 #endif
 #if defined(SHA256_ASM_NOHW)
-void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_nohw(uint32_t state[8], const uint8_t *data,
                                   size_t num);
 #endif
 
 #if defined(SHA512_ASM_HW)
-void sha512_block_data_order_hw(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_hw(uint64_t state[8], const uint8_t *data,
                                 size_t num);
 #endif
 
 #if defined(SHA512_ASM_NOHW)
-void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *data,
                                   size_t num);
 #endif
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha1.c

@@ -86,7 +86,7 @@ uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH]) {
 }
 
 #if !defined(SHA1_ASM)
-static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num);
 #endif
 
@@ -234,7 +234,7 @@ void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
 #if !defined(SHA1_ASM)
 
 #if !defined(SHA1_ASM_NOHW)
-static void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order_nohw(uint32_t state[5], const uint8_t *data,
                                        size_t num) {
   register uint32_t A, B, C, D, E, T;
   uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
@@ -384,7 +384,7 @@ static void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
 }
 #endif  // !SHA1_ASM_NOHW
 
-static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num) {
 #if defined(SHA1_ASM_HW)
   if (sha1_hw_capable()) {
@@ -394,7 +394,7 @@ static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
 #endif
 #if defined(SHA1_ASM_AVX2)
   if (sha1_avx2_capable()) {
-    sha1_block_data_order_avx(state, data, num);
+    sha1_block_data_order_avx2(state, data, num);
     return;
   }
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha256.c

@@ -115,7 +115,7 @@ uint8_t *SHA256(const uint8_t *data, size_t len,
 }
 
 #if !defined(SHA256_ASM)
-static void sha256_block_data_order(uint32_t *state, const uint8_t *in,
+static void sha256_block_data_order(uint32_t state[8], const uint8_t *in,
                                     size_t num);
 #endif
 
@@ -223,7 +223,7 @@ static const uint32_t K256[64] = {
     ROUND_00_15(i, a, b, c, d, e, f, g, h);            \
   } while (0)
 
-static void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+static void sha256_block_data_order_nohw(uint32_t state[8], const uint8_t *data,
                                          size_t num) {
   uint32_t a, b, c, d, e, f, g, h, s0, s1, T1;
   uint32_t X[16];
@@ -312,7 +312,7 @@ static void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
 
 #endif  // !defined(SHA256_ASM_NOHW)
 
-static void sha256_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha256_block_data_order(uint32_t state[8], const uint8_t *data,
                                     size_t num) {
 #if defined(SHA256_ASM_HW)
   if (sha256_hw_capable()) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha512.c

@@ -156,7 +156,7 @@ uint8_t *SHA512_256(const uint8_t *data, size_t len,
 }
 
 #if !defined(SHA512_ASM)
-static void sha512_block_data_order(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order(uint64_t state[8], const uint8_t *in,
                                     size_t num_blocks);
 #endif
 
@@ -343,7 +343,7 @@ static const uint64_t K512[80] = {
 #if defined(__i386) || defined(__i386__) || defined(_M_IX86)
 // This code should give better results on 32-bit CPU with less than
 // ~24 registers, both size and performance wise...
-static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *in,
                                          size_t num) {
   uint64_t A, E, T;
   uint64_t X[9 + 80], *F;
@@ -416,7 +416,7 @@ static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
     ROUND_00_15(i + j, a, b, c, d, e, f, g, h);        \
   } while (0)
 
-static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *in,
                                          size_t num) {
   uint64_t a, b, c, d, e, f, g, h, s0, s1, T1;
   uint64_t X[16];
@@ -502,7 +502,7 @@ static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
 
 #endif  // !SHA512_ASM_NOHW
 
-static void sha512_block_data_order(uint64_t *state, const uint8_t *data,
+static void sha512_block_data_order(uint64_t state[8], const uint8_t *data,
                                     size_t num) {
 #if defined(SHA512_ASM_HW)
   if (sha512_hw_capable()) {
@@ -516,6 +516,12 @@ static void sha512_block_data_order(uint64_t *state, const uint8_t *data,
     return;
   }
 #endif
+#if defined(SHA512_ASM_SSSE3)
+  if (sha512_ssse3_capable()) {
+    sha512_block_data_order_ssse3(state, data, num);
+    return;
+  }
+#endif
 #if defined(SHA512_ASM_NEON)
   if (CRYPTO_is_NEON_capable()) {
     sha512_block_data_order_neon(state, data, num);

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/tls/kdf.c

@@ -189,6 +189,7 @@ int CRYPTO_tls13_hkdf_expand_label(uint8_t *out, size_t out_len,
   uint8_t *hkdf_label = NULL;
   size_t hkdf_label_len;
 
+  FIPS_service_indicator_lock_state();
   CBB_zero(&cbb);
   if (!CBB_init(&cbb, 2 + 1 + sizeof(kProtocolLabel) - 1 + label_len + 1 +
                           hash_len) ||
@@ -200,12 +201,18 @@ int CRYPTO_tls13_hkdf_expand_label(uint8_t *out, size_t out_len,
       !CBB_add_bytes(&child, hash, hash_len) ||
       !CBB_finish(&cbb, &hkdf_label, &hkdf_label_len)) {
     CBB_cleanup(&cbb);
+    FIPS_service_indicator_unlock_state();
     return 0;
   }
 
   const int ret = HKDF_expand(out, out_len, digest, secret, secret_len,
                               hkdf_label, hkdf_label_len);
   OPENSSL_free(hkdf_label);
+
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    TLSKDF_verify_service_indicator(digest);
+  }
   return ret;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/hpke/hpke.c

@@ -355,6 +355,8 @@ int EVP_HPKE_KEY_copy(EVP_HPKE_KEY *dst, const EVP_HPKE_KEY *src) {
 void EVP_HPKE_KEY_move(EVP_HPKE_KEY *out, EVP_HPKE_KEY *in) {
   EVP_HPKE_KEY_cleanup(out);
   // For now, |EVP_HPKE_KEY| is trivially movable.
+  // Note that Rust may move this structure. See
+  // bssl-crypto/src/scoped.rs:EvpHpkeKey.
   OPENSSL_memcpy(out, in, sizeof(EVP_HPKE_KEY));
   EVP_HPKE_KEY_zero(in);
 }

data/third_party/boringssl-with-bazel/src/crypto/internal.h

@@ -180,17 +180,29 @@ extern "C" {
 #endif
 
 
-#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || defined(OPENSSL_ARM) || \
-    defined(OPENSSL_AARCH64)
-// OPENSSL_cpuid_setup initializes the platform-specific feature cache.
+#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_STATIC_ARMCAP) && \
+    (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) ||            \
+     defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
+// x86, x86_64, and the ARMs need to record the result of a cpuid/getauxval call
+// for the asm to work correctly, unless compiled without asm code.
+#define NEED_CPUID
+
+// OPENSSL_cpuid_setup initializes the platform-specific feature cache. This
+// function should not be called directly. Call |OPENSSL_init_cpuid| instead.
 void OPENSSL_cpuid_setup(void);
+
+// OPENSSL_init_cpuid initializes the platform-specific feature cache, if
+// needed. This function is idempotent and may be called concurrently.
+void OPENSSL_init_cpuid(void);
+#else
+OPENSSL_INLINE void OPENSSL_init_cpuid(void) {}
 #endif
 
 #if (defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)) && \
     !defined(OPENSSL_STATIC_ARMCAP)
 // OPENSSL_get_armcap_pointer_for_test returns a pointer to |OPENSSL_armcap_P|
-// for unit tests. Any modifications to the value must be made after
-// |CRYPTO_library_init| but before any other function call in BoringSSL.
+// for unit tests. Any modifications to the value must be made before any other
+// function call in BoringSSL.
 OPENSSL_EXPORT uint32_t *OPENSSL_get_armcap_pointer_for_test(void);
 #endif
 
@@ -271,8 +283,20 @@ typedef __uint128_t uint128_t;
 // should be called in between independent tests, at a point where failure from
 // a previous test will not impact subsequent ones.
 OPENSSL_EXPORT void OPENSSL_reset_malloc_counter_for_testing(void);
+
+// OPENSSL_disable_malloc_failures_for_testing, when malloc testing is enabled,
+// disables simulated malloc failures. Calls to |OPENSSL_malloc| will not
+// increment the malloc counter or synthesize failures. This may be used to skip
+// simulating malloc failures in some region of code.
+OPENSSL_EXPORT void OPENSSL_disable_malloc_failures_for_testing(void);
+
+// OPENSSL_enable_malloc_failures_for_testing, when malloc testing is enabled,
+// re-enables simulated malloc failures.
+OPENSSL_EXPORT void OPENSSL_enable_malloc_failures_for_testing(void);
 #else
 OPENSSL_INLINE void OPENSSL_reset_malloc_counter_for_testing(void) {}
+OPENSSL_INLINE void OPENSSL_disable_malloc_failures_for_testing(void) {}
+OPENSSL_INLINE void OPENSSL_enable_malloc_failures_for_testing(void) {}
 #endif
 
 #if defined(__has_builtin)
@@ -597,6 +621,12 @@ static inline int constant_time_declassify_int(int v) {
   return value_barrier_u32(v);
 }
 
+// declassify_assert behaves like |assert| but declassifies the result of
+// evaluating |expr|. This allows the assertion to branch on the (presumably
+// public) result, but still ensures that values leading up to the computation
+// were secret.
+#define declassify_assert(expr) assert(constant_time_declassify_int(expr))
+
 
 // Thread-safe initialisation.
 
@@ -893,14 +923,12 @@ typedef struct {
 #define CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA \
     {CRYPTO_MUTEX_INIT, NULL, NULL, 0, 1}
 
-// CRYPTO_get_ex_new_index allocates a new index for |ex_data_class| and writes
-// it to |*out_index|. Each class of object should provide a wrapper function
-// that uses the correct |CRYPTO_EX_DATA_CLASS|. It returns one on success and
-// zero otherwise.
-OPENSSL_EXPORT int CRYPTO_get_ex_new_index(CRYPTO_EX_DATA_CLASS *ex_data_class,
-                                           int *out_index, long argl,
-                                           void *argp,
-                                           CRYPTO_EX_free *free_func);
+// CRYPTO_get_ex_new_index_ex allocates a new index for |ex_data_class|. Each
+// class of object should provide a wrapper function that uses the correct
+// |CRYPTO_EX_DATA_CLASS|. It returns the new index on success and -1 on error.
+OPENSSL_EXPORT int CRYPTO_get_ex_new_index_ex(
+    CRYPTO_EX_DATA_CLASS *ex_data_class, long argl, void *argp,
+    CRYPTO_EX_free *free_func);
 
 // CRYPTO_set_ex_data sets an extra data pointer on a given object. Each class
 // of object should provide a wrapper function.
@@ -1158,6 +1186,11 @@ static inline uint64_t CRYPTO_rotr_u64(uint64_t value, int shift) {
 
 // Arithmetic functions.
 
+// The most efficient versions of these functions on GCC and Clang depend on C11
+// |_Generic|. If we ever need to call these from C++, we'll need to add a
+// variant that uses C++ overloads instead.
+#if !defined(__cplusplus)
+
 // CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
 // bit. |carry| must be zero or one.
 #if OPENSSL_HAS_BUILTIN(__builtin_addc)
@@ -1170,13 +1203,13 @@ static inline uint64_t CRYPTO_rotr_u64(uint64_t value, int shift) {
 
 static inline uint32_t CRYPTO_addc_u32(uint32_t x, uint32_t y, uint32_t carry,
                                        uint32_t *out_carry) {
-  assert(carry <= 1);
+  declassify_assert(carry <= 1);
   return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
 }
 
 static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
                                        uint64_t *out_carry) {
-  assert(carry <= 1);
+  declassify_assert(carry <= 1);
   return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
 }
 
@@ -1184,7 +1217,7 @@ static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
 
 static inline uint32_t CRYPTO_addc_u32(uint32_t x, uint32_t y, uint32_t carry,
                                        uint32_t *out_carry) {
-  assert(carry <= 1);
+  declassify_assert(carry <= 1);
   uint64_t ret = carry;
   ret += (uint64_t)x + y;
   *out_carry = (uint32_t)(ret >> 32);
@@ -1193,7 +1226,7 @@ static inline uint32_t CRYPTO_addc_u32(uint32_t x, uint32_t y, uint32_t carry,
 
 static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
                                        uint64_t *out_carry) {
-  assert(carry <= 1);
+  declassify_assert(carry <= 1);
 #if defined(BORINGSSL_HAS_UINT128)
   uint128_t ret = carry;
   ret += (uint128_t)x + y;
@@ -1222,13 +1255,13 @@ static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
 
 static inline uint32_t CRYPTO_subc_u32(uint32_t x, uint32_t y, uint32_t borrow,
                                        uint32_t *out_borrow) {
-  assert(borrow <= 1);
+  declassify_assert(borrow <= 1);
   return CRYPTO_GENERIC_SUBC(x, y, borrow, out_borrow);
 }
 
 static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
                                        uint64_t *out_borrow) {
-  assert(borrow <= 1);
+  declassify_assert(borrow <= 1);
   return CRYPTO_GENERIC_SUBC(x, y, borrow, out_borrow);
 }
 
@@ -1236,7 +1269,7 @@ static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
 
 static inline uint32_t CRYPTO_subc_u32(uint32_t x, uint32_t y, uint32_t borrow,
                                        uint32_t *out_borrow) {
-  assert(borrow <= 1);
+  declassify_assert(borrow <= 1);
   uint32_t ret = x - y - borrow;
   *out_borrow = (x < y) | ((x == y) & borrow);
   return ret;
@@ -1244,7 +1277,7 @@ static inline uint32_t CRYPTO_subc_u32(uint32_t x, uint32_t y, uint32_t borrow,
 
 static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
                                        uint64_t *out_borrow) {
-  assert(borrow <= 1);
+  declassify_assert(borrow <= 1);
   uint64_t ret = x - y - borrow;
   *out_borrow = (x < y) | ((x == y) & borrow);
   return ret;
@@ -1259,6 +1292,8 @@ static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
 #define CRYPTO_subc_w CRYPTO_subc_u32
 #endif
 
+#endif  // !__cplusplus
+
 
 // FIPS functions.
 
@@ -1436,7 +1471,7 @@ OPENSSL_INLINE int CRYPTO_is_RDRAND_capable(void) {
 // See Intel manual, volume 2A, table 3-8.
 
 OPENSSL_INLINE int CRYPTO_is_BMI1_capable(void) {
-#if defined(__BMI1__)
+#if defined(__BMI__)
   return 1;
 #else
   return (OPENSSL_get_ia32cap(2) & (1u << 3)) != 0;
@@ -1498,7 +1533,6 @@ OPENSSL_INLINE int CRYPTO_is_x86_SHA_capable(void) {
 // otherwise select. See chacha-x86_64.pl.
 //
 // Bonnell, Silvermont's predecessor in the Atom lineup, will also be matched by
-// this. |OPENSSL_cpuid_setup| forces Knights Landing to also be matched by
 // this. Goldmont (Silvermont's successor in the Atom lineup) added XSAVE so it
 // isn't matched by this. Various sources indicate AMD first implemented MOVBE
 // and XSAVE at the same time in Jaguar, so it seems like AMD chips will not be
@@ -1507,11 +1541,12 @@ OPENSSL_INLINE int CRYPTO_cpu_perf_is_like_silvermont(void) {
   // WARNING: This MUST NOT be used to guard the execution of the XSAVE
   // instruction. This is the "hardware supports XSAVE" bit, not the OSXSAVE bit
   // that indicates whether we can safely execute XSAVE. This bit may be set
-  // even when XSAVE is disabled (by the operating system). See the comment in
-  // cpu_intel.c and check how the users of this bit use it.
+  // even when XSAVE is disabled (by the operating system). See how the users of
+  // this bit use it.
   //
-  // We do not use |__XSAVE__| for static detection because the hack in
-  // |OPENSSL_cpuid_setup| for Knights Landing CPUs needs to override it.
+  // Historically, the XSAVE bit was artificially cleared on Knights Landing
+  // and Knights Mill chips, but as Intel has removed all support from GCC,
+  // LLVM, and SDE, we assume they are no longer worth special-casing.
   int hardware_supports_xsave = (OPENSSL_get_ia32cap(1) & (1u << 26)) != 0;
   return !hardware_supports_xsave && CRYPTO_is_MOVBE_capable();
 }

data/third_party/boringssl-with-bazel/src/crypto/kyber/internal.h

@@ -16,7 +16,7 @@
 #define OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H
 
 #include <openssl/base.h>
-#include <openssl/kyber.h>
+#include <openssl/experimental/kyber.h>
 
 #if defined(__cplusplus)
 extern "C" {

data/third_party/boringssl-with-bazel/src/crypto/kyber/kyber.c

@@ -12,7 +12,8 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-#include <openssl/kyber.h>
+#define OPENSSL_UNSTABLE_EXPERIMENTAL_KYBER
+#include <openssl/experimental/kyber.h>
 
 #include <assert.h>
 #include <stdlib.h>

data/third_party/boringssl-with-bazel/src/crypto/mem.c

@@ -138,7 +138,7 @@ static CRYPTO_MUTEX malloc_failure_lock = CRYPTO_MUTEX_INIT;
 static uint64_t current_malloc_count = 0;
 static uint64_t malloc_number_to_fail = 0;
 static int malloc_failure_enabled = 0, break_on_malloc_fail = 0,
-           any_malloc_failed = 0;
+           any_malloc_failed = 0, disable_malloc_failures = 0;
 
 static void malloc_exit_handler(void) {
   CRYPTO_MUTEX_lock_read(&malloc_failure_lock);
@@ -168,7 +168,7 @@ static void init_malloc_failure(void) {
 static int should_fail_allocation() {
   static CRYPTO_once_t once = CRYPTO_ONCE_INIT;
   CRYPTO_once(&once, init_malloc_failure);
-  if (!malloc_failure_enabled) {
+  if (!malloc_failure_enabled || disable_malloc_failures) {
     return 0;
   }
 
@@ -195,6 +195,20 @@ void OPENSSL_reset_malloc_counter_for_testing(void) {
   CRYPTO_MUTEX_unlock_write(&malloc_failure_lock);
 }
 
+void OPENSSL_disable_malloc_failures_for_testing(void) {
+  CRYPTO_MUTEX_lock_write(&malloc_failure_lock);
+  BSSL_CHECK(!disable_malloc_failures);
+  disable_malloc_failures = 1;
+  CRYPTO_MUTEX_unlock_write(&malloc_failure_lock);
+}
+
+void OPENSSL_enable_malloc_failures_for_testing(void) {
+  CRYPTO_MUTEX_lock_write(&malloc_failure_lock);
+  BSSL_CHECK(disable_malloc_failures);
+  disable_malloc_failures = 0;
+  CRYPTO_MUTEX_unlock_write(&malloc_failure_lock);
+}
+
 #else
 static int should_fail_allocation(void) { return 0; }
 #endif
@@ -384,13 +398,8 @@ char *OPENSSL_strdup(const char *s) {
   if (s == NULL) {
     return NULL;
   }
-  const size_t len = strlen(s) + 1;
-  char *ret = OPENSSL_malloc(len);
-  if (ret == NULL) {
-    return NULL;
-  }
-  OPENSSL_memcpy(ret, s, len);
-  return ret;
+  // Copy the NUL terminator.
+  return OPENSSL_memdup(s, strlen(s) + 1);
 }
 
 int OPENSSL_isalpha(int c) {