grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/crypto/conf/{conf.c → conf.cc}

@@ -57,8 +57,8 @@
 #include <openssl/conf.h>
 
 #include <assert.h>
-#include <string.h>
 #include <ctype.h>
+#include <string.h>
 
 #include <openssl/bio.h>
 #include <openssl/buf.h>
@@ -66,8 +66,8 @@
 #include <openssl/lhash.h>
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../internal.h"
+#include "internal.h"
 
 
 struct conf_section_st {
@@ -106,7 +106,7 @@ CONF *NCONF_new(void *method) {
     return NULL;
   }
 
-  CONF *conf = OPENSSL_malloc(sizeof(CONF));
+  CONF *conf = reinterpret_cast<CONF *>(OPENSSL_malloc(sizeof(CONF)));
   if (conf == NULL) {
     return NULL;
   }
@@ -121,7 +121,9 @@ CONF *NCONF_new(void *method) {
   return conf;
 }
 
-CONF_VALUE *CONF_VALUE_new(void) { return OPENSSL_zalloc(sizeof(CONF_VALUE)); }
+CONF_VALUE *CONF_VALUE_new(void) {
+  return reinterpret_cast<CONF_VALUE *>(OPENSSL_zalloc(sizeof(CONF_VALUE)));
+}
 
 static void value_free(CONF_VALUE *value) {
   if (value == NULL) {
@@ -161,7 +163,8 @@ void NCONF_free(CONF *conf) {
 }
 
 static CONF_SECTION *NCONF_new_section(const CONF *conf, const char *section) {
-  CONF_SECTION *s = OPENSSL_malloc(sizeof(CONF_SECTION));
+  CONF_SECTION *s =
+      reinterpret_cast<CONF_SECTION *>(OPENSSL_malloc(sizeof(CONF_SECTION)));
   if (!s) {
     return NULL;
   }
@@ -275,10 +278,10 @@ err:
 }
 
 static CONF_SECTION *get_section(const CONF *conf, const char *section) {
-  CONF_SECTION template;
-  OPENSSL_memset(&template, 0, sizeof(template));
-  template.name = (char *) section;
-  return lh_CONF_SECTION_retrieve(conf->sections, &template);
+  CONF_SECTION templ;
+  OPENSSL_memset(&templ, 0, sizeof(templ));
+  templ.name = (char *)section;
+  return lh_CONF_SECTION_retrieve(conf->sections, &templ);
 }
 
 const STACK_OF(CONF_VALUE) *NCONF_get_section(const CONF *conf,
@@ -292,16 +295,16 @@ const STACK_OF(CONF_VALUE) *NCONF_get_section(const CONF *conf,
 
 const char *NCONF_get_string(const CONF *conf, const char *section,
                              const char *name) {
-  CONF_VALUE template, *value;
+  CONF_VALUE templ, *value;
 
   if (section == NULL) {
     section = kDefaultSectionName;
   }
 
-  OPENSSL_memset(&template, 0, sizeof(template));
-  template.section = (char *)section;
-  template.name = (char *)name;
-  value = lh_CONF_VALUE_retrieve(conf->values, &template);
+  OPENSSL_memset(&templ, 0, sizeof(templ));
+  templ.section = (char *)section;
+  templ.name = (char *)name;
+  value = lh_CONF_VALUE_retrieve(conf->values, &templ);
   if (value == NULL) {
     return NULL;
   }

data/third_party/boringssl-with-bazel/src/crypto/conf/internal.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, Google Inc.
+/* Copyright 2015 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_apple.c → cpu_aarch64_apple.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2021, Google Inc.
+/* Copyright 2021 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 #include "internal.h"
 
 #if defined(OPENSSL_AARCH64) && defined(OPENSSL_APPLE) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+    !defined(OPENSSL_STATIC_ARMCAP) && !defined(OPENSSL_NO_ASM)
 
 #include <sys/sysctl.h>
 #include <sys/types.h>

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_fuchsia.c → cpu_aarch64_fuchsia.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, Google Inc.
+/* Copyright 2018 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 #include "internal.h"
 
 #if defined(OPENSSL_AARCH64) && defined(OPENSSL_FUCHSIA) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+    !defined(OPENSSL_STATIC_ARMCAP) && !defined(OPENSSL_NO_ASM)
 
 #include <zircon/features.h>
 #include <zircon/syscalls.h>

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_linux.c → cpu_aarch64_linux.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2016, Google Inc.
+/* Copyright 2016 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 #include "internal.h"
 
 #if defined(OPENSSL_AARCH64) && defined(OPENSSL_LINUX) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+    !defined(OPENSSL_STATIC_ARMCAP) && !defined(OPENSSL_NO_ASM)
 
 #include <sys/auxv.h>
 

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_openbsd.c → cpu_aarch64_openbsd.cc}

@@ -15,11 +15,11 @@
 #include <openssl/cpu.h>
 
 #if defined(OPENSSL_AARCH64) && defined(OPENSSL_OPENBSD) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+    !defined(OPENSSL_STATIC_ARMCAP) && !defined(OPENSSL_NO_ASM)
 
-#include <sys/sysctl.h>
-#include <machine/cpu.h>
 #include <machine/armreg.h>
+#include <machine/cpu.h>
+#include <sys/sysctl.h>
 
 #include <openssl/arm_arch.h>
 
@@ -27,7 +27,7 @@
 
 
 void OPENSSL_cpuid_setup(void) {
-  int isar0_mib[] = { CTL_MACHDEP, CPU_ID_AA64ISAR0 };
+  int isar0_mib[] = {CTL_MACHDEP, CPU_ID_AA64ISAR0};
   uint64_t cpu_id = 0;
   size_t len = sizeof(cpu_id);
 

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_sysreg.c → cpu_aarch64_sysreg.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2023, Google Inc.
+/* Copyright 2023 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -18,7 +18,8 @@
 // expects userspace to simply read them. It traps the reads and fills in CPU
 // capabilities.
 #if defined(OPENSSL_AARCH64) && !defined(OPENSSL_STATIC_ARMCAP) && \
-    (defined(ANDROID_BAREMETAL) || defined(OPENSSL_FREEBSD))
+    (defined(ANDROID_BAREMETAL) || defined(OPENSSL_FREEBSD)) &&    \
+    !defined(OPENSSL_NO_ASM)
 
 #include <openssl/arm_arch.h>
 

data/third_party/boringssl-with-bazel/src/crypto/{cpu_aarch64_win.c → cpu_aarch64_win.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, Google Inc.
+/* Copyright 2018 The BoringSSL Authors
  * Copyright (c) 2020, Arm Ltd.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 #include "internal.h"
 
 #if defined(OPENSSL_AARCH64) && defined(OPENSSL_WINDOWS) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+    !defined(OPENSSL_STATIC_ARMCAP) && !defined(OPENSSL_NO_ASM)
 
 #include <windows.h>
 

data/third_party/boringssl-with-bazel/src/crypto/{cpu_arm_freebsd.c → cpu_arm_freebsd.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2022, Google Inc.
+/* Copyright 2022 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,8 @@
 
 #include "internal.h"
 
-#if defined(OPENSSL_ARM) && defined(OPENSSL_FREEBSD) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM) && \
+    defined(OPENSSL_FREEBSD) && !defined(OPENSSL_STATIC_ARMCAP)
 #include <sys/auxv.h>
 #include <sys/types.h>
 

data/third_party/boringssl-with-bazel/src/crypto/{cpu_arm_linux.c → cpu_arm_linux.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2016, Google Inc.
+/* Copyright 2016 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,8 @@
 
 #include "internal.h"
 
-#if defined(OPENSSL_ARM) && defined(OPENSSL_LINUX) && \
-    !defined(OPENSSL_STATIC_ARMCAP)
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM) && \
+    defined(OPENSSL_LINUX) && !defined(OPENSSL_STATIC_ARMCAP)
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/auxv.h>
@@ -55,7 +55,7 @@ static int read_file(char **out_ptr, size_t *out_len, const char *path) {
   static const size_t kReadSize = 1024;
   int ret = 0;
   size_t cap = kReadSize, len = 0;
-  char *buf = OPENSSL_malloc(cap);
+  char *buf = reinterpret_cast<char *>(OPENSSL_malloc(cap));
   if (buf == NULL) {
     goto err;
   }
@@ -66,7 +66,7 @@ static int read_file(char **out_ptr, size_t *out_len, const char *path) {
       if (new_cap < cap) {
         goto err;
       }
-      char *new_buf = OPENSSL_realloc(buf, new_cap);
+      char *new_buf = reinterpret_cast<char *>(OPENSSL_realloc(buf, new_cap));
       if (new_buf == NULL) {
         goto err;
       }

data/third_party/boringssl-with-bazel/src/crypto/cpu_arm_linux.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2018, Google Inc.
+/* Copyright 2018 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/crypto/{cpu_intel.c → cpu_intel.cc}

@@ -56,7 +56,8 @@
 
 #include <openssl/base.h>
 
-#if !defined(OPENSSL_NO_ASM) && (defined(OPENSSL_X86) || defined(OPENSSL_X86_64))
+#if !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_X86) || defined(OPENSSL_X86_64))
 
 #include <inttypes.h>
 #include <stdio.h>
@@ -88,21 +89,19 @@ static void OPENSSL_cpuid(uint32_t *out_eax, uint32_t *out_ebx,
 #elif defined(__pic__) && defined(OPENSSL_32_BIT)
   // Inline assembly may not clobber the PIC register. For 32-bit, this is EBX.
   // See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47602.
-  __asm__ volatile (
-    "xor %%ecx, %%ecx\n"
-    "mov %%ebx, %%edi\n"
-    "cpuid\n"
-    "xchg %%edi, %%ebx\n"
-    : "=a"(*out_eax), "=D"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
-    : "a"(leaf)
-  );
+  __asm__ volatile(
+      "xor %%ecx, %%ecx\n"
+      "mov %%ebx, %%edi\n"
+      "cpuid\n"
+      "xchg %%edi, %%ebx\n"
+      : "=a"(*out_eax), "=D"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
+      : "a"(leaf));
 #else
-  __asm__ volatile (
-    "xor %%ecx, %%ecx\n"
-    "cpuid\n"
-    : "=a"(*out_eax), "=b"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
-    : "a"(leaf)
-  );
+  __asm__ volatile(
+      "xor %%ecx, %%ecx\n"
+      "cpuid\n"
+      : "=a"(*out_eax), "=b"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
+      : "a"(leaf));
 #endif
 }
 
@@ -113,35 +112,51 @@ static uint64_t OPENSSL_xgetbv(uint32_t xcr) {
   return (uint64_t)_xgetbv(xcr);
 #else
   uint32_t eax, edx;
-  __asm__ volatile ("xgetbv" : "=a"(eax), "=d"(edx) : "c"(xcr));
+  __asm__ volatile("xgetbv" : "=a"(eax), "=d"(edx) : "c"(xcr));
   return (((uint64_t)edx) << 32) | eax;
 #endif
 }
 
+static bool os_supports_avx512(uint64_t xcr0) {
+#if defined(__APPLE__)
+  // The Darwin kernel had a bug where it could corrupt the opmask registers.
+  // See
+  // https://community.intel.com/t5/Software-Tuning-Performance/MacOS-Darwin-kernel-bug-clobbers-AVX-512-opmask-register-state/m-p/1327259
+  // Darwin also does not initially set the XCR0 bits for AVX512, but they are
+  // set if the thread tries to use AVX512 anyway.  Thus, to safely and
+  // consistently use AVX512 on macOS we'd need to check the kernel version as
+  // well as detect AVX512 support using a macOS-specific method.  We don't
+  // bother with this, especially given Apple's transition to arm64.
+  return false;
+#else
+  return (xcr0 & 0xe6) == 0xe6;
+#endif
+}
+
 // handle_cpu_env applies the value from |in| to the CPUID values in |out[0]|
 // and |out[1]|. See the comment in |OPENSSL_cpuid_setup| about this.
 static void handle_cpu_env(uint32_t *out, const char *in) {
-  const int invert = in[0] == '~';
-  const int or = in[0] == '|';
-  const int skip_first_byte = invert || or;
-  const int hex = in[skip_first_byte] == '0' && in[skip_first_byte+1] == 'x';
+  const int invert_op = in[0] == '~';
+  const int or_op = in[0] == '|';
+  const int skip_first_byte = invert_op || or_op;
+  const int hex = in[skip_first_byte] == '0' && in[skip_first_byte + 1] == 'x';
 
   int sscanf_result;
   uint64_t v;
   if (hex) {
-    sscanf_result = sscanf(in + invert + 2, "%" PRIx64, &v);
+    sscanf_result = sscanf(in + invert_op + 2, "%" PRIx64, &v);
   } else {
-    sscanf_result = sscanf(in + invert, "%" PRIu64, &v);
+    sscanf_result = sscanf(in + invert_op, "%" PRIu64, &v);
   }
 
   if (!sscanf_result) {
     return;
   }
 
-  if (invert) {
+  if (invert_op) {
     out[0] &= ~v;
     out[1] &= ~(v >> 32);
-  } else if (or) {
+  } else if (or_op) {
     out[0] |= v;
     out[1] |= (v >> 32);
   } else {
@@ -157,11 +172,11 @@ void OPENSSL_cpuid_setup(void) {
 
   uint32_t num_ids = eax;
 
-  int is_intel = ebx == 0x756e6547 /* Genu */ &&
-                 edx == 0x49656e69 /* ineI */ &&
+  int is_intel = ebx == 0x756e6547 /* Genu */ && //
+                 edx == 0x49656e69 /* ineI */ && //
                  ecx == 0x6c65746e /* ntel */;
-  int is_amd = ebx == 0x68747541 /* Auth */ &&
-               edx == 0x69746e65 /* enti */ &&
+  int is_amd = ebx == 0x68747541 /* Auth */ && //
+               edx == 0x69746e65 /* enti */ && //
                ecx == 0x444d4163 /* cAMD */;
 
   uint32_t extended_features[2] = {0};
@@ -225,9 +240,9 @@ void OPENSSL_cpuid_setup(void) {
   // See Intel manual, volume 1, section 14.3.
   if ((xcr0 & 6) != 6) {
     // YMM registers cannot be used.
-    ecx &= ~(1u << 28);  // AVX
-    ecx &= ~(1u << 12);  // FMA
-    ecx &= ~(1u << 11);  // AMD XOP
+    ecx &= ~(1u << 28);                   // AVX
+    ecx &= ~(1u << 12);                   // FMA
+    ecx &= ~(1u << 11);                   // AMD XOP
     extended_features[0] &= ~(1u << 5);   // AVX2
     extended_features[1] &= ~(1u << 9);   // VAES
     extended_features[1] &= ~(1u << 10);  // VPCLMULQDQ
@@ -235,7 +250,7 @@ void OPENSSL_cpuid_setup(void) {
   // See Intel manual, volume 1, sections 15.2 ("Detection of AVX-512 Foundation
   // Instructions") through 15.4 ("Detection of Intel AVX-512 Instruction Groups
   // Operating at 256 and 128-bit Vector Lengths").
-  if ((xcr0 & 0xe6) != 0xe6) {
+  if (!os_supports_avx512(xcr0)) {
     // Without XCR0.111xx11x, no AVX512 feature can be used. This includes ZMM
     // registers, masking, SIMD registers 16-31 (even if accessed as YMM or
     // XMM), and EVEX-coded instructions (even on YMM or XMM). Even if only

data/third_party/boringssl-with-bazel/src/crypto/{crypto.c → crypto.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2014, Google Inc.
+/* Copyright 2014 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,9 +15,10 @@
 #include <openssl/crypto.h>
 
 #include <assert.h>
+#include <stdio.h>
 
-#include "fipsmodule/rand/internal.h"
 #include "bcm_support.h"
+#include "fipsmodule/rand/internal.h"
 #include "internal.h"
 
 
@@ -53,7 +54,7 @@ static_assert(sizeof(ossl_ssize_t) == sizeof(size_t),
 // archive, linking on OS X will fail to resolve common symbols. By
 // initialising it to zero, it becomes a "data symbol", which isn't so
 // affected.
-HIDDEN uint8_t BORINGSSL_function_hit[7] = {0};
+HIDDEN uint8_t BORINGSSL_function_hit[8] = {0};
 #endif
 
 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
@@ -131,14 +132,6 @@ int CRYPTO_is_confidential_build(void) {
 #endif
 }
 
-int CRYPTO_has_asm(void) {
-#if defined(OPENSSL_NO_ASM)
-  return 0;
-#else
-  return 1;
-#endif
-}
-
 void CRYPTO_pre_sandbox_init(void) {
   // Read from /proc/cpuinfo if needed.
   OPENSSL_init_cpuid();
@@ -186,3 +179,5 @@ int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
 }
 
 void OPENSSL_cleanup(void) {}
+
+FILE *CRYPTO_get_stderr(void) { return stderr; }

data/third_party/boringssl-with-bazel/src/crypto/curve25519/{curve25519.c → curve25519.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020, Google Inc.
+/* Copyright 2020 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -26,8 +26,8 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-#include "internal.h"
 #include "../internal.h"
+#include "internal.h"
 
 // Various pre-computed constants.
 #include "./curve25519_tables.h"
@@ -168,13 +168,9 @@ static void fe_tobytes(uint8_t s[32], const fe *f) {
 }
 
 // h = 0
-static void fe_0(fe *h) {
-  OPENSSL_memset(h, 0, sizeof(fe));
-}
+static void fe_0(fe *h) { OPENSSL_memset(h, 0, sizeof(fe)); }
 
-static void fe_loose_0(fe_loose *h) {
-  OPENSSL_memset(h, 0, sizeof(fe_loose));
-}
+static void fe_loose_0(fe_loose *h) { OPENSSL_memset(h, 0, sizeof(fe_loose)); }
 
 // h = 1
 static void fe_1(fe *h) {
@@ -205,7 +201,7 @@ static void fe_sub(fe_loose *h, const fe *f, const fe *g) {
   assert_fe_loose(h->v);
 }
 
-static void fe_carry(fe *h, const fe_loose* f) {
+static void fe_carry(fe *h, const fe_loose *f) {
   assert_fe_loose(f->v);
   fiat_25519_carry(h->v, f->v);
   assert_fe(h->v);
@@ -261,7 +257,7 @@ static void fe_sq_tt(fe *h, const fe *f) {
 //
 // Preconditions: b in {0,1}.
 static void fe_cswap(fe *f, fe *g, fe_limb_t b) {
-  b = 0-b;
+  b = 0 - b;
   for (unsigned i = 0; i < FE_NUM_LIMBS; i++) {
     fe_limb_t x = f->v[i] ^ g->v[i];
     x &= b;
@@ -293,9 +289,8 @@ static void fe_cmov(fe_loose *f, const fe_loose *g, fe_limb_t b) {
   //
   // TODO(davidben): Switch to fiat's calling convention, or ask fiat to emit a
   // different one.
-  (void)fiat_25519_selectznz;
 
-  b = 0-b;
+  b = 0 - b;
   for (unsigned i = 0; i < FE_NUM_LIMBS; i++) {
     fe_limb_t x = f->v[i] ^ g->v[i];
     x &= b;
@@ -304,9 +299,7 @@ static void fe_cmov(fe_loose *f, const fe_loose *g, fe_limb_t b) {
 }
 
 // h = f
-static void fe_copy(fe *h, const fe *f) {
-  OPENSSL_memmove(h, f, sizeof(fe));
-}
+static void fe_copy(fe *h, const fe *f) { OPENSSL_memmove(h, f, sizeof(fe)); }
 
 static void fe_copy_lt(fe_loose *h, const fe *f) {
   static_assert(sizeof(fe_loose) == sizeof(fe), "fe and fe_loose mismatch");
@@ -506,8 +499,8 @@ int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
   fe_carry(&u, &v);
   fe_add(&v, &vxx, &h->Z);  // v = dy^2+1
 
-  fe_mul_ttl(&w, &u, &v);  // w = u*v
-  fe_pow22523(&h->X, &w);  // x = w^((q-5)/8)
+  fe_mul_ttl(&w, &u, &v);        // w = u*v
+  fe_pow22523(&h->X, &w);        // x = w^((q-5)/8)
   fe_mul_ttt(&h->X, &h->X, &u);  // x = u*w^((q-5)/8)
 
   fe_sq_tt(&vxx, &h->X);
@@ -706,7 +699,7 @@ void x25519_ge_scalarmult_small_precomp(
   for (i = 0; i < 15; i++) {
     // The precomputed table is assumed to already clear the top bit, so
     // |fe_frombytes_strict| may be used directly.
-    const uint8_t *bytes = &precomp_table[i*(2 * 32)];
+    const uint8_t *bytes = &precomp_table[i * (2 * 32)];
     fe x, y;
     fe_frombytes_strict(&x, bytes);
     fe_frombytes_strict(&y, bytes + 32);
@@ -736,7 +729,7 @@ void x25519_ge_scalarmult_small_precomp(
     ge_precomp_0(&e);
 
     for (j = 1; j < 16; j++) {
-      cmov(&e, &multiples[j-1], 1&constant_time_eq_w(index, j));
+      cmov(&e, &multiples[j - 1], 1 & constant_time_eq_w(index, j));
     }
 
     ge_cached cached;
@@ -763,9 +756,11 @@ static void table_select(ge_precomp *t, const int pos, const signed char b) {
   uint8_t babs = b - ((bnegative & b) << 1);
 
   uint8_t t_bytes[3][32] = {
-      {constant_time_is_zero_w(b) & 1}, {constant_time_is_zero_w(b) & 1}, {0}};
-#if defined(__clang__) // materialize for vectorization, 6% speedup
-  __asm__("" : "+m" (t_bytes) : /*no inputs*/);
+      {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+      {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+      {0}};
+#if defined(__clang__)  // materialize for vectorization, 6% speedup
+  __asm__("" : "+m"(t_bytes) : /*no inputs*/);
 #endif
   static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]), "");
   for (int i = 0; i < 8; i++) {
@@ -787,7 +782,7 @@ static void table_select(ge_precomp *t, const int pos, const signed char b) {
   fe_copy_lt(&minust.yplusx, &yminusx);
   fe_copy_lt(&minust.yminusx, &yplusx);
   fe_neg(&minust.xy2d, &xy2d);
-  cmov(t, &minust, bnegative>>7);
+  cmov(t, &minust, bnegative >> 7);
 }
 
 // h = a * B
@@ -903,7 +898,7 @@ void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A) {
     ge_p2_dbl(&t, r);
     x25519_ge_p1p1_to_p3(&u, &t);
 
-    uint8_t index = scalar[31 - i/8];
+    uint8_t index = scalar[31 - i / 8];
     index >>= 4 - (i & 4);
     index &= 0xf;
 
@@ -911,7 +906,7 @@ void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A) {
     ge_cached selected;
     ge_cached_0(&selected);
     for (j = 0; j < 16; j++) {
-      cmov_cached(&selected, &Ai[j], 1&constant_time_eq_w(index, j));
+      cmov_cached(&selected, &Ai[j], 1 & constant_time_eq_w(index, j));
     }
 
     x25519_ge_add(&t, &u, &selected);
@@ -1937,10 +1932,10 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
 
   // kOrder is the order of Curve25519 in little-endian form.
   static const uint64_t kOrder[4] = {
-    UINT64_C(0x5812631a5cf5d3ed),
-    UINT64_C(0x14def9dea2f79cd6),
-    0,
-    UINT64_C(0x1000000000000000),
+      UINT64_C(0x5812631a5cf5d3ed),
+      UINT64_C(0x14def9dea2f79cd6),
+      0,
+      UINT64_C(0x1000000000000000),
   };
   for (size_t i = 3;; i--) {
     uint64_t word = CRYPTO_load_u64_le(scopy + i * 8);
@@ -2045,8 +2040,10 @@ static void x25519_scalar_mult_generic(uint8_t out[32],
     // Coq transcription of ladderstep formula (called from transcribed loop):
     // <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZ.v#L89>
     // <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L131>
-    // x1 != 0 <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L217>
-    // x1  = 0 <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L147>
+    // x1 != 0
+    // <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L217>
+    // x1  = 0
+    // <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L147>
     fe_sub(&tmp0l, &x3, &z3);
     fe_sub(&tmp1l, &x2, &z2);
     fe_add(&x2l, &x2, &z2);

data/third_party/boringssl-with-bazel/src/crypto/curve25519/{curve25519_64_adx.c → curve25519_64_adx.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2023, Google Inc.
+/* Copyright 2023 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519_tables.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020, Google Inc.
+/* Copyright 2020 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020, Google Inc.
+/* Copyright 2020 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above