From 5f87a05aa314776135eec1057dd644c0b25a9d14 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Wed, 6 Sep 2017 11:59:44 -0700
Subject: [PATCH] lib: crypto: Add the ability to select Intel AESNI
 instruction set at configure time.

Add --accel-aes=[none|intelaesni] to select.
Default is none.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13008

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 lib/crypto/wscript              |  6 ++++++
 lib/crypto/wscript_configure    | 13 +++++++++++++
 third_party/aesni-intel/wscript | 13 +++++++++++--
 wscript                         |  1 +
 4 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 lib/crypto/wscript

diff --git a/lib/crypto/wscript b/lib/crypto/wscript
new file mode 100644
index 00000000000..c3708c7560e
--- /dev/null
+++ b/lib/crypto/wscript
@@ -0,0 +1,6 @@
+#!/usr/bin/env python
+
+def set_options(opt):
+    opt.add_option('--accel-aes',
+        help=("Should we use accelerated AES crypto functions. Options are intelaesni|none."),
+        action="store", dest='accel_aes', default="none")
diff --git a/lib/crypto/wscript_configure b/lib/crypto/wscript_configure
index 130acec4381..9fdaf9f3d14 100644
--- a/lib/crypto/wscript_configure
+++ b/lib/crypto/wscript_configure
@@ -1,3 +1,7 @@
+#!/usr/bin/env python
+import Options
+import Utils
+
 if not conf.CHECK_FUNCS_IN('MD5Init', 'bsd', headers='bsd/md5.h',
     checklibc=True):
     conf.CHECK_FUNCS_IN('MD5Init', 'md5', headers='sys/md5.h',
@@ -13,3 +17,12 @@ if conf.CHECK_FUNCS('SHA256_Update'):
 	conf.DEFINE('SHA256_RENAME_NEEDED', 1)
 if conf.CHECK_FUNCS('SHA512_Update'):
 	conf.DEFINE('SHA512_RENAME_NEEDED', 1)
+
+#
+# --aes-accel=XXX selects accelerated AES crypto library to use, if any.
+# Default is none.
+#
+if Options.options.accel_aes.lower() == "intelaesni":
+        print("Attempting to compile with runtime-switchable x86_64 Intel AES instructions. WARNING - this is temporary.")
+elif Options.options.accel_aes.lower() != "none":
+        raise Utils.WafError('--aes-accel=%s is not a valid option. Valid options are [none|intelaesni]' % Options.options.accel_aes)
diff --git a/third_party/aesni-intel/wscript b/third_party/aesni-intel/wscript
index 002ba5d42d1..eb92d6626fe 100644
--- a/third_party/aesni-intel/wscript
+++ b/third_party/aesni-intel/wscript
@@ -1,8 +1,17 @@
 #!/usr/bin/env python
+import Options
+import Utils
 
 def configure(conf):
-    if conf.CHECK_CFLAGS('-Wp,-E,-lang-asm', '') and conf.env['SYSTEM_UNAME_MACHINE'] == 'x86_64':
-        conf.DEFINE('HAVE_AESNI_INTEL', 1)
+    if Options.options.accel_aes.lower() == "intelaesni":
+        if conf.CHECK_CFLAGS('-Wp,-E,-lang-asm', ''):
+            if conf.env['SYSTEM_UNAME_MACHINE'] == 'x86_64':
+                print("Compiling with Intel AES instructions")
+                conf.DEFINE('HAVE_AESNI_INTEL', 1)
+            else:
+                raise Utils.WafError('--aes-accel=intelaesni selected and non x86_64 CPU')
+        else:
+            raise Utils.WafError('--aes-accel=intelaesni selected and compiler rejects -Wp,-E,-lang-asm')
 
 def build(bld):
     if not bld.CONFIG_SET('HAVE_AESNI_INTEL'):
diff --git a/wscript b/wscript
index e80f7663bbd..35cb9d1b08d 100644
--- a/wscript
+++ b/wscript
@@ -44,6 +44,7 @@ def set_options(opt):
     opt.RECURSE('pidl')
     opt.RECURSE('source3')
     opt.RECURSE('lib/util')
+    opt.RECURSE('lib/crypto')
     opt.RECURSE('ctdb')
     opt.samba_add_onoff_option('pthreadpool', with_name="enable", without_name="disable", default=True)
 
-- 
2.34.1