Fix tail handling for AES-NI counter mode

* cipher/rijndael.c (do_aesni_ctr): Fix outputting of updated
counter-IV.
--

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
cipher/gost28147: optimization: use precomputed S-box tables

* cipher/gost.h (GOST28147_context): Remove unneeded subst and
subst_set members.
* cipher/gost28147.c (max): Remove unneeded macro.
(test_sbox): Replace with new precomputed tables.
(gost_set_subst): Remove function.
(gost_val): Use new S-box tables.
(gost_encrypt_block, gost_decrypt_block): Tweak to use new ctx and
S-box tables.
--

Use generated 8->8 S-boxes with precomputed bitwise shifts and
bitwise rotations. So in the round function gost_val() we no need
to do this operations.

Before this patch:

 GOST28147      |  nanosecs/byte   mebibytes/sec   cycles/byte
        ECB enc |     24.00 ns/B     39.74 MiB/s         - c/B
        ECB dec |     26.41 ns/B     36.11 MiB/s         - c/B
        CBC enc |     24.57 ns/B     38.81 MiB/s         - c/B
        CBC dec |     26.58 ns/B     35.88 MiB/s         - c/B
        CFB enc |     24.79 ns/B     38.46 MiB/s         - c/B
        CFB dec |     24.72 ns/B     38.57 MiB/s         - c/B
        OFB enc |     24.38 ns/B     39.12 MiB/s         - c/B
        OFB dec |     24.35 ns/B     39.16 MiB/s         - c/B
        CTR enc |     24.83 ns/B     38.41 MiB/s         - c/B
        CTR dec |     25.27 ns/B     37.73 MiB/s         - c/B

After:

 GOST28147      |  nanosecs/byte   mebibytes/sec   cycles/byte
        ECB enc |     16.29 ns/B     58.55 MiB/s         - c/B
        ECB dec |     16.30 ns/B     58.50 MiB/s         - c/B
        CBC enc |     16.94 ns/B     56.29 MiB/s         - c/B
        CBC dec |     16.81 ns/B     56.72 MiB/s         - c/B
        CFB enc |     17.13 ns/B     55.66 MiB/s         - c/B
        CFB dec |     16.84 ns/B     56.63 MiB/s         - c/B
        OFB enc |     16.69 ns/B     57.13 MiB/s         - c/B
        OFB dec |     16.71 ns/B     57.08 MiB/s         - c/B
        CTR enc |     17.01 ns/B     56.06 MiB/s         - c/B
        CTR dec |     17.05 ns/B     55.93 MiB/s         - c/B

Signed-off-by: Sergey V <sftp.mtuci@gmail.com>
Fix Serpent-AVX2 and Camellia-AVX2 counter modes

* cipher/camellia-aesni-avx2-amd64.S
(_gcry_camellia_aesni_avx2_ctr_enc): Byte-swap before checking for
overflow handling.
* cipher/camellia-glue.c (selftest_ctr_128, selftest_cfb_128)
(selftest_cbc_128): Add 16 to nblocks.
* cipher/cipher-selftest.c (_gcry_selftest_helper_ctr): Add test with
non-overflowing IV and modify overflow IV to detect broken endianness
handling.
* cipher/serpent-avx2-amd64.S (_gcry_serpent_avx2_ctr_enc): Byte-swap
before checking for overflow handling; Fix crazy-mixed-endian IV
construction to big-endian.
* cipher/serpent.c (selftest_ctr_128, selftest_cfb_128)
(selftest_cbc_128): Add 8 to nblocks.
--

The selftest for CTR was setting counter-IV to all '0xff' except last byte.
This had the effect that even with broken endianness handling Serpent-AVX2 and
Camellia-AVX2 passed the tests.

Patch corrects the CTR selftest and fixes the broken implementations.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>