Libcperciva import

STYLE

@@ -97,6 +97,10 @@ is preferred over
 		goto done;
 at the start of a function.
 
+Don't check for failures in an error-handling path if they will not affect
+behaviour.  In particular, if we're already in an unrecoverable state, don't
+let a callback's return value determine control flow.
+
 Headers should be included in the following groups, with a blank line after
 each (non-empty) group:
 1. <sys/*.h>, with <sys/types.h> first followed by others alphabetically.

libcperciva/alg/sha256.c

@@ -12,7 +12,7 @@
 
 #include "sha256.h"
 
-#if defined(CPUSUPPORT_X86_SHANI) && defined(CPUSUPPORT_X86_SSSE3) ||	\
+#if (defined(CPUSUPPORT_X86_SHANI) && defined(CPUSUPPORT_X86_SSSE3)) ||	\
     defined(CPUSUPPORT_X86_SSE2) ||					\
     defined(CPUSUPPORT_ARM_SHA256)
 #define HWACCEL
@@ -197,32 +197,33 @@ hwaccel_init(void)
 #endif /* HWACCEL */
 
 /* Elementary functions used by SHA256 */
-#define Ch(x, y, z)	((x & (y ^ z)) ^ z)
-#define Maj(x, y, z)	((x & (y | z)) | (y & z))
-#define SHR(x, n)	(x >> n)
-#define ROTR(x, n)	((x >> n) | (x << (32 - n)))
-#define S0(x)		(ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
-#define S1(x)		(ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
-#define s0(x)		(ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
-#define s1(x)		(ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
+#define Ch(x, y, z)	(((x) & ((y) ^ (z))) ^ (z))
+#define Maj(x, y, z)	(((x) & ((y) | (z))) | ((y) & (z)))
+#define SHR(x, n)	((x) >> (n))
+#define ROTR(x, n)	(((x) >> (n)) | ((x) << (32 - (n))))
+#define S0(x)		(ROTR((x), 2) ^ ROTR((x), 13) ^ ROTR((x), 22))
+#define S1(x)		(ROTR((x), 6) ^ ROTR((x), 11) ^ ROTR((x), 25))
+#define s0(x)		(ROTR((x), 7) ^ ROTR((x), 18) ^ SHR((x), 3))
+#define s1(x)		(ROTR((x), 17) ^ ROTR((x), 19) ^ SHR((x), 10))
 
 /* SHA256 round function */
-#define RND(a, b, c, d, e, f, g, h, k)			\
-	h += S1(e) + Ch(e, f, g) + k;			\
-	d += h;						\
-	h += S0(a) + Maj(a, b, c)
+#define RND(a, b, c, d, e, f, g, h, k) do {		\
+	(h) += S1((e)) + Ch((e), (f), (g)) + (k);	\
+	(d) += (h);					\
+	(h) += S0((a)) + Maj((a), (b), (c));		\
+} while (0)
 
 /* Adjusted round function for rotating state */
 #define RNDr(S, W, i, ii)			\
-	RND(S[(64 - i) % 8], S[(65 - i) % 8],	\
-	    S[(66 - i) % 8], S[(67 - i) % 8],	\
-	    S[(68 - i) % 8], S[(69 - i) % 8],	\
-	    S[(70 - i) % 8], S[(71 - i) % 8],	\
-	    W[i + ii] + Krnd[i + ii])
+	RND((S)[(64 - (i)) % 8], (S)[(65 - (i)) % 8],	\
+	    (S)[(66 - (i)) % 8], (S)[(67 - (i)) % 8],	\
+	    (S)[(68 - (i)) % 8], (S)[(69 - (i)) % 8],	\
+	    (S)[(70 - (i)) % 8], (S)[(71 - (i)) % 8],	\
+	    (W)[(i) + (ii)] + Krnd[(i) + (ii)])
 
 /* Message schedule computation */
 #define MSCH(W, ii, i)				\
-	W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii]
+	(W)[(i) + (ii) + 16] = s1((W)[(i) + (ii) + 14]) + (W)[(i) + (ii) + 9] + s0((W)[(i) + (ii) + 1]) + (W)[(i) + (ii)]
 
 /*
  * SHA256 block compression function.  The 256-bit state is transformed via

libcperciva/alg/sha256_arm.c

@@ -8,9 +8,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 #include "sha256_arm.h"
 
@@ -38,15 +36,15 @@ static const uint32_t Krnd[64] = {
 #define RND4(S, M, Kp) do {					\
 	uint32x4_t S0_step;					\
 	uint32x4_t Wk;						\
-	S0_step = S[0];						\
-	Wk = vaddq_u32(M, vld1q_u32(Kp));			\
-	S[0] = vsha256hq_u32(S[0], S[1], Wk);			\
-	S[1] = vsha256h2q_u32(S[1], S0_step, Wk);		\
+	S0_step = (S)[0];					\
+	Wk = vaddq_u32((M), vld1q_u32(Kp));			\
+	(S)[0] = vsha256hq_u32((S)[0], (S)[1], Wk);		\
+	(S)[1] = vsha256h2q_u32((S)[1], S0_step, Wk);		\
 } while (0)
 
 /* Message schedule computation */
 #define MSG4(X0, X1, X2, X3)					\
-	X0 = vsha256su1q_u32(vsha256su0q_u32(X0, X1), X2, X3)
+	(X0) = vsha256su1q_u32(vsha256su0q_u32((X0), (X1)), (X2), (X3))
 
 /**
  * SHA256_Transform_arm(state, block):

libcperciva/alg/sha256_shani.c

@@ -38,7 +38,8 @@ be32dec_128(const uint8_t * src)
 
 /* Convert an unsigned 32-bit immediate into a signed value. */
 #define I32(a) ((UINT32_C(a) >= UINT32_C(0x80000000)) ?			\
-    -(int32_t)(UINT32_C(0xffffffff) - UINT32_C(a)) - 1 : (int32_t)INT32_C(a))
+    -(int32_t)(UINT32_C(0xffffffff) - UINT32_C(a)) - 1 :		\
+    (int32_t)INT32_C(a))
 
 /* Load four unsigned 32-bit immediates into a vector register. */
 #define IMM4(a, b, c, d) _mm_set_epi32(I32(a), I32(b), I32(c), I32(d))
@@ -48,29 +49,29 @@ be32dec_128(const uint8_t * src)
 	__m128i M;								\
 										\
 	/* Add the next four words of message schedule and round constants. */	\
-	M = _mm_add_epi32(W, IMM4(K3, K2, K1, K0));				\
+	M = _mm_add_epi32((W), IMM4(K3, K2, K1, K0));				\
 										\
 	/* Perform two rounds of SHA256, using the low two words in M. */	\
-	S[1] = _mm_sha256rnds2_epu32(S[1], S[0], M);				\
+	(S)[1] = _mm_sha256rnds2_epu32((S)[1], (S)[0], M);				\
 										\
 	/* Shift the two words of M down and perform the next two rounds. */	\
 	M = _mm_srli_si128(M, 8);						\
-	S[0] = _mm_sha256rnds2_epu32(S[0], S[1], M);				\
+	(S)[0] = _mm_sha256rnds2_epu32((S)[0], (S)[1], M);				\
 } while (0)
 
 /* Compute the ith set of four words of message schedule. */
 #define MSG4(W, i) do {								\
-	W[(i + 0) % 4] = _mm_sha256msg1_epu32(W[(i + 0) % 4], W[(i + 1) % 4]);	\
-	W[(i + 0) % 4] = _mm_add_epi32(W[(i + 0) % 4],				\
-	    _mm_alignr_epi8(W[(i + 3) % 4], W[(i + 2) % 4], 4));		\
-	W[(i + 0) % 4] = _mm_sha256msg2_epu32(W[(i + 0) % 4], W[(i + 3) % 4]);	\
+	(W)[((i) + 0) % 4] = _mm_sha256msg1_epu32((W)[((i) + 0) % 4], (W)[((i) + 1) % 4]);	\
+	(W)[((i) + 0) % 4] = _mm_add_epi32((W)[((i) + 0) % 4],				\
+	    _mm_alignr_epi8((W)[((i) + 3) % 4], (W)[((i) + 2) % 4], 4));		\
+	(W)[((i) + 0) % 4] = _mm_sha256msg2_epu32((W)[((i) + 0) % 4], (W)[((i) + 3) % 4]);	\
 } while (0)
 
 /* Perform 4 rounds of SHA256 and generate more message schedule if needed. */
 #define RNDMSG(S, W, i, K0, K1, K2, K3) do {			\
-	RND4(S, W[i % 4], K0, K1, K2, K3);			\
-	if (i < 12)						\
-		MSG4(W, i + 4);					\
+	RND4((S), (W)[(i) % 4], K0, K1, K2, K3);		\
+	if ((i) < 12)						\
+		MSG4((W), (i) + 4);				\
 } while (0)
 
 /**

libcperciva/alg/sha256_sse2.c

@@ -51,31 +51,33 @@ static const uint32_t Krnd[64] = {
 };
 
 /* Elementary functions used by SHA256 */
-#define Ch(x, y, z)	((x & (y ^ z)) ^ z)
-#define Maj(x, y, z)	((x & (y | z)) | (y & z))
-#define ROTR(x, n)	((x >> n) | (x << (32 - n)))
-#define S0(x)		(ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
-#define S1(x)		(ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
+#define Ch(x, y, z)	(((x) & ((y) ^ (z))) ^ (z))
+#define Maj(x, y, z)	(((x) & ((y) | (z))) | ((y) & (z)))
+#define ROTR(x, n)	(((x) >> (n)) | ((x) << (32 - (n))))
+#define S0(x)		(ROTR((x), 2) ^ ROTR((x), 13) ^ ROTR((x), 22))
+#define S1(x)		(ROTR((x), 6) ^ ROTR((x), 11) ^ ROTR((x), 25))
 
 /* SHA256 round function */
-#define RND(a, b, c, d, e, f, g, h, k)			\
-	h += S1(e) + Ch(e, f, g) + k;			\
-	d += h;						\
-	h += S0(a) + Maj(a, b, c)
+#define RND(a, b, c, d, e, f, g, h, k) do {		\
+	(h) += S1((e)) + Ch((e), (f), (g)) + (k);	\
+	(d) += (h);					\
+	(h) += S0((a)) + Maj((a), (b), (c));		\
+} while (0)
 
 /* Adjusted round function for rotating state */
 #define RNDr(S, W, i, ii)			\
-	RND(S[(64 - i) % 8], S[(65 - i) % 8],	\
-	    S[(66 - i) % 8], S[(67 - i) % 8],	\
-	    S[(68 - i) % 8], S[(69 - i) % 8],	\
-	    S[(70 - i) % 8], S[(71 - i) % 8],	\
-	    W[i + ii] + Krnd[i + ii])
+	RND((S)[(64 - (i)) % 8], (S)[(65 - (i)) % 8],	\
+	    (S)[(66 - (i)) % 8], (S)[(67 - (i)) % 8],	\
+	    (S)[(68 - (i)) % 8], (S)[(69 - (i)) % 8],	\
+	    (S)[(70 - (i)) % 8], (S)[(71 - (i)) % 8],	\
+	    (W)[(i) + (ii)] + Krnd[(i) + (ii)])
 
 /* Message schedule computation */
-#define SHR32(x, n) (_mm_srli_epi32(x, n))
-#define ROTR32(x, n) (_mm_or_si128(SHR32(x, n), _mm_slli_epi32(x, (32-n))))
+#define SHR32(x, n) (_mm_srli_epi32((x), (n)))
+#define ROTR32(x, n) (_mm_or_si128(SHR32((x), (n)),	\
+	_mm_slli_epi32((x), (32 - (n)))))
 #define s0_128(x) _mm_xor_si128(_mm_xor_si128(			\
-	ROTR32(x, 7), ROTR32(x, 18)), SHR32(x, 3))
+	ROTR32((x), 7), ROTR32((x), 18)), SHR32((x), 3))
 
 static inline __m128i
 s1_128_high(__m128i a)

libcperciva/cpusupport/Build/cpusupport-ARM-AES.c

@@ -1,8 +1,6 @@
 #include <stdint.h>
 
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 int
 main(void)
@@ -20,6 +18,7 @@ main(void)
 
 	/* Check _u32: some compilers only support the _u8 variant. */
 	lanes = vdupq_laneq_u32(lanes, 0);
+	(void)lanes; /* UNUSED */
 
 	/* Success! */
 	return (0);

libcperciva/cpusupport/Build/cpusupport-ARM-SHA256.c

@@ -1,6 +1,4 @@
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 int
 main(void)

libcperciva/crypto/crypto_aes_aesni.c

@@ -23,13 +23,13 @@ struct crypto_aes_key_aesni {
 
 /* Compute an AES-128 round key. */
 #define MKRKEY128(rkeys, i, rcon) do {				\
-	__m128i _s = rkeys[i - 1];				\
-	__m128i _t = rkeys[i - 1];				\
+	__m128i _s = (rkeys)[(i) - 1];				\
+	__m128i _t = (rkeys)[(i) - 1];				\
 	_s = _mm_xor_si128(_s, _mm_slli_si128(_s, 4));		\
 	_s = _mm_xor_si128(_s, _mm_slli_si128(_s, 8));		\
-	_t = _mm_aeskeygenassist_si128(_t, rcon);		\
+	_t = _mm_aeskeygenassist_si128(_t, (rcon));		\
 	_t = _mm_shuffle_epi32(_t, 0xff);			\
-	rkeys[i] = _mm_xor_si128(_s, _t);			\
+	(rkeys)[(i)] = _mm_xor_si128(_s, _t);			\
 } while (0)
 
 /**
@@ -79,13 +79,13 @@ crypto_aes_key_expand_128_aesni(const uint8_t key_unexpanded[16],
 
 /* Compute an AES-256 round key. */
 #define MKRKEY256(rkeys, i, shuffle, rcon)	do {		\
-	__m128i _s = rkeys[i - 2];				\
-	__m128i _t = rkeys[i - 1];				\
+	__m128i _s = (rkeys)[(i) - 2];				\
+	__m128i _t = (rkeys)[(i) - 1];				\
 	_s = _mm_xor_si128(_s, _mm_slli_si128(_s, 4));		\
 	_s = _mm_xor_si128(_s, _mm_slli_si128(_s, 8));		\
-	_t = _mm_aeskeygenassist_si128(_t, rcon);		\
-	_t = _mm_shuffle_epi32(_t, shuffle);			\
-	rkeys[i] = _mm_xor_si128(_s, _t);			\
+	_t = _mm_aeskeygenassist_si128(_t, (rcon));		\
+	_t = _mm_shuffle_epi32(_t, (shuffle));			\
+	(rkeys)[(i)] = _mm_xor_si128(_s, _t);			\
 } while (0)
 
 /**

libcperciva/crypto/crypto_aes_arm.c

@@ -7,9 +7,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 #include "align_ptr.h"
 #include "insecure_memzero.h"
@@ -30,7 +28,7 @@ struct crypto_aes_key_arm {
  * vdupq_laneq_u32(), except that accepts (and returns) uint8x16_t.
  */
 #define vdupq_laneq_u32_u8(a, lane)			\
-	vreinterpretq_u8_u32(vdupq_laneq_u32(vreinterpretq_u32_u8(a), lane))
+	vreinterpretq_u8_u32(vdupq_laneq_u32(vreinterpretq_u32_u8(a), (lane)))
 
 /**
  * vshlq_n_u128(a, n):
@@ -45,7 +43,7 @@ struct crypto_aes_key_arm {
  * intrinsics; all of the built-in shift instructions operate on multiple
  * values (such as a pair of 64-bit values).
  */
-#define vshlq_n_u128(a, n) vextq_u8(vdupq_n_u8(0), a, 16 - n)
+#define vshlq_n_u128(a, n) vextq_u8(vdupq_n_u8(0), (a), 16 - (n))
 
 /**
  * SubWord_duplicate(a):
@@ -101,12 +99,12 @@ SubWord_RotWord_XOR_duplicate(uint8x16_t a, const uint32_t rcon)
 
 /* Compute an AES-128 round key. */
 #define MKRKEY128(rkeys, i, rcon) do {				\
-	uint8x16_t _s = rkeys[i - 1];				\
-	uint8x16_t _t = rkeys[i - 1];				\
+	uint8x16_t _s = (rkeys)[(i) - 1];			\
+	uint8x16_t _t = (rkeys)[(i) - 1];			\
 	_s = veorq_u8(_s, vshlq_n_u128(_s, 4));			\
 	_s = veorq_u8(_s, vshlq_n_u128(_s, 8));			\
-	_t = SubWord_RotWord_XOR_duplicate(_t, rcon);		\
-	rkeys[i] = veorq_u8(_s, _t);				\
+	_t = SubWord_RotWord_XOR_duplicate(_t, (rcon));		\
+	(rkeys)[(i)] = veorq_u8(_s, _t);			\
 } while (0)
 
 /**
@@ -144,14 +142,14 @@ crypto_aes_key_expand_128_arm(const uint8_t key_unexpanded[16],
 
 /* Compute an AES-256 round key. */
 #define MKRKEY256(rkeys, i, rcon)	do {			\
-	uint8x16_t _s = rkeys[i - 2];				\
-	uint8x16_t _t = rkeys[i - 1];				\
+	uint8x16_t _s = (rkeys)[(i) - 2];			\
+	uint8x16_t _t = (rkeys)[(i) - 1];			\
 	_s = veorq_u8(_s, vshlq_n_u128(_s, 4));			\
 	_s = veorq_u8(_s, vshlq_n_u128(_s, 8));			\
-	_t = (i % 2 == 1) ?					\
+	_t = ((i) % 2 == 1) ?					\
 	    SubWord_duplicate(_t) :				\
-	    SubWord_RotWord_XOR_duplicate(_t, rcon);		\
-	rkeys[i] = veorq_u8(_s, _t);				\
+	    SubWord_RotWord_XOR_duplicate(_t, (rcon));		\
+	(rkeys)[(i)] = veorq_u8(_s, _t);			\
 } while (0)
 
 /**

libcperciva/crypto/crypto_aes_arm_u8.h

@@ -1,9 +1,7 @@
 #ifndef CRYPTO_AES_ARM_U8_H_
 #define CRYPTO_AES_ARM_U8_H_
 
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 /**
  * crypto_aes_encrypt_block_arm_u8(in, key):

libcperciva/crypto/crypto_aesctr_arm.c

@@ -8,9 +8,7 @@
 #include <stdint.h>
 #include <string.h>
 
-#ifdef __ARM_NEON
 #include <arm_neon.h>
-#endif
 
 #include "crypto_aes.h"
 #include "crypto_aes_arm_u8.h"

libcperciva/crypto/crypto_aesctr_shared.c

@@ -1,3 +1,5 @@
+#include <stdint.h>
+
 /*
  * This code is shared between crypto_aesctr*.c files, and should not be
  * compiled as a separate translation unit.  For details, see the comments in