Provide LIBRESSL_USE_.*_ASSEMBLY defines.

Make life easier for portable by providing LIBRESSL_USE_.*_ASSEMBLY
defines, which enable/disable assembly for a specific algorithm. This
means that selected platforms can include the assembly files and specify
a define, rather than having to try to patch the crypto_arch.h headers.

Discussed with tb@

2 files changed, 18 insertions, 6 deletions

diff --git a/src/lib/libcrypto/arch/amd64/Makefile.inc b/src/lib/libcrypto/arch/amd64/Makefile.inc
index 8f1681322d..ea03944273 100644
--- a/src/lib/libcrypto/arch/amd64/Makefile.inc
+++ b/src/lib/libcrypto/arch/amd64/Makefile.inc
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.inc,v 1.45 2026/01/17 14:53:09 jsing Exp $
+# $OpenBSD: Makefile.inc,v 1.46 2026/01/17 16:18:32 jsing Exp $
 
 # amd64-specific libcrypto build rules
 
@@ -8,6 +8,7 @@ EXTRA_PL =	${LCRYPTO_SRC}/perlasm/x86_64-xlate.pl
 SRCS += crypto_cpu_caps.c
 
 # aes
+CFLAGS+= -DLIBRESSL_USE_AES_ASSEMBLY
 SSLASM+= aes aes-x86_64
 SSLASM+= aes aesni-x86_64
 SRCS += aes_amd64.c
@@ -20,6 +21,7 @@ CFLAGS+= -DOPENSSL_BN_ASM_MONT5
 SSLASM+= bn x86_64-mont5
 
 # bn s2n-bignum
+CFLAGS+= -DLIBRESSL_USE_BN_ASSEMBLY
 SRCS += bn_arch.c
 SRCS += bignum_add.S
 SRCS += bignum_cmadd.S
@@ -44,17 +46,20 @@ SRCS += bignum_sub.S
 SRCS += word_clz.S
 
 # md5
+CFLAGS+= -DLIBRESSL_USE_MD5_ASSEMBLY
 SRCS+= md5_amd64_generic.S
 
 # modes
+CFLAGS+= -DLIBRESSL_USE_GCM_ASSEMBLY
 SSLASM+= modes ghash-x86_64
 SRCS += gcm128_amd64.c
 
 # rc4
+CFLAGS+= -DLIBRESSL_USE_RC4_ASSEMBLY
 SSLASM+= rc4 rc4-x86_64
 
-# ripemd
 # sha
+CFLAGS+= -DLIBRESSL_USE_SHA_ASSEMBLY
 SRCS+= sha1_amd64.c
 SRCS+= sha1_amd64_generic.S
 SRCS+= sha1_amd64_shani.S
diff --git a/src/lib/libcrypto/arch/amd64/crypto_arch.h b/src/lib/libcrypto/arch/amd64/crypto_arch.h
index 411deb0e5d..09f771b6c6 100644
--- a/src/lib/libcrypto/arch/amd64/crypto_arch.h
+++ b/src/lib/libcrypto/arch/amd64/crypto_arch.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_arch.h,v 1.17 2026/01/17 14:53:09 jsing Exp $ */
+/*      $OpenBSD: crypto_arch.h,v 1.18 2026/01/17 16:18:32 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -33,11 +33,11 @@ extern uint64_t crypto_cpu_caps_amd64;
 
 #ifndef OPENSSL_NO_ASM
 
+#ifdef LIBRESSL_USE_AES_ASSEMBLY
 #define HAVE_AES_SET_ENCRYPT_KEY_GENERIC
 #define HAVE_AES_SET_DECRYPT_KEY_GENERIC
 #define HAVE_AES_ENCRYPT_GENERIC
 #define HAVE_AES_DECRYPT_GENERIC
-
 #define HAVE_AES_SET_ENCRYPT_KEY_INTERNAL
 #define HAVE_AES_SET_DECRYPT_KEY_INTERNAL
 #define HAVE_AES_ENCRYPT_INTERNAL
@@ -47,24 +47,31 @@ extern uint64_t crypto_cpu_caps_amd64;
 #define HAVE_AES_CTR32_ENCRYPT_INTERNAL
 #define HAVE_AES_ECB_ENCRYPT_INTERNAL
 #define HAVE_AES_XTS_ENCRYPT_INTERNAL
+#endif
 
+#ifdef LIBRESSL_USE_GCM_ASSEMBLY
 #define HAVE_GCM128_INIT
 #define HAVE_GCM_GHASH_4BIT
 #define HAVE_GCM_GMULT_4BIT
+#endif
 
+#ifdef LIBRESSL_USE_MD5_ASSEMBLY
 #define HAVE_MD5_BLOCK_DATA_ORDER
+#endif
 
+#ifdef LIBRESSL_USE_RC4_ASSEMBLY
 #define HAVE_RC4_INTERNAL
 #define HAVE_RC4_SET_KEY_INTERNAL
+#endif
 
+#ifdef LIBRESSL_USE_SHA_ASSEMBLY
 #define HAVE_SHA1_BLOCK_DATA_ORDER
 #define HAVE_SHA1_BLOCK_GENERIC
-
 #define HAVE_SHA256_BLOCK_DATA_ORDER
 #define HAVE_SHA256_BLOCK_GENERIC
-
 #define HAVE_SHA512_BLOCK_DATA_ORDER
 #define HAVE_SHA512_BLOCK_GENERIC
+#endif
 
 #endif