tree 41310c265a9dcb12bd2f61616c004efa22f8514c
parent 3e96cd4b768e1ebba33327d2c3b7f6d4b8c1c5f6
author David Benjamin <davidben@google.com> 1578351044 -0500
committer Adam Langley <agl@google.com> 1578942892 +0000

Reland bitsliced aes_nohw implementation.

This relands
https://boringssl-review.googlesource.com/c/boringssl/+/39206. See that
CL description for details on the change.

The CL was originally reverted due to a number of ARM-only test
failures. First, there was a test-only issue, resolved in
https://boringssl-review.googlesource.com/c/boringssl/+/39306.

Second, the implementation did not work in unoptimized Android Thumb2
builds. This was caused by a clang bug introduced in
https://reviews.llvm.org/rL340261 and fixed in
https://reviews.llvm.org/rL351310. aes_nohw_(un)compact_block have
been rewritten in an attempt to dodge the bug. Performance of optimized
builds with clang and gcc do not appear to be affected by the rewrite.
See the delta from patch set 1.

(I had hoped to improve precommit CQ coverage before landing this, but
both failures turned out to be ARM-only. Either way, there are now
32-bit and 64-bit SSE2-less configurations so the 32-bit and 64-bit
implementations have CQ coverage.)

Change-Id: If5f9f5ea570686a15258ecd7cf49bdbc12dc34c5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39444
Reviewed-by: Adam Langley <agl@google.com>