* [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments
@ 2026-11-12 3:44 Eric Biggers
2026-11-12 10:35 ` Antonio Quartulli
0 siblings, 1 reply; 2+ messages in thread
From: Eric Biggers @ 2026-11-12 3:44 UTC (permalink / raw)
To: linux-crypto
Cc: Ard Biesheuvel, Jason A . Donenfeld, Herbert Xu,
Antonio Quartulli, Martin Willi, Eric Biggers
Fix various mistakes in comments, many probably originating from
copy+pasting: incorrect block ranges, duplicate words, and stray text.
Also make chacha_1to4blocks_ssse3() refer to the state matrix using flat
indexing, like the equivalent AVX2 and AVX512 functions. It was the
only place using 2D row-column indexing of the state matrix.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
lib/crypto/x86/chacha-avx2-x86_64.S | 12 ++++-----
lib/crypto/x86/chacha-avx512-x86_64.S | 8 +++---
lib/crypto/x86/chacha-ssse3-x86_64.S | 36 +++++++++++++--------------
3 files changed, 28 insertions(+), 28 deletions(-)
diff --git a/lib/crypto/x86/chacha-avx2-x86_64.S b/lib/crypto/x86/chacha-avx2-x86_64.S
index 18ae03e05074f..5cf009616f7cb 100644
--- a/lib/crypto/x86/chacha-avx2-x86_64.S
+++ b/lib/crypto/x86/chacha-avx2-x86_64.S
@@ -46,7 +46,7 @@ SYM_FUNC_START(chacha_1to2blocks_avx2)
# on four words in each matrix in parallel, but requires shuffling to
# rearrange the words after each round.
- # x0..3[0-2] = s0..3
+ # x0..3[0-1] = s0..3
vbroadcasti128 0x00(%rdi),%ymm0
vbroadcasti128 0x10(%rdi),%ymm1
vbroadcasti128 0x20(%rdi),%ymm2
@@ -212,7 +212,7 @@ SYM_FUNC_START(chacha_2to4blocks_avx2)
# required word shuffling has a rather high latency, we can do the
# arithmetic on two matrix-pairs without much slowdown.
- # x0..3[0-4] = s0..3
+ # x0..3[0-3] = s0..3
vbroadcasti128 0x00(%rdi),%ymm0
vbroadcasti128 0x10(%rdi),%ymm1
vbroadcasti128 0x20(%rdi),%ymm2
@@ -495,7 +495,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
vmovdqa ROT8(%rip),%ymm2
vmovdqa ROT16(%rip),%ymm3
- # x12 += counter values 0-3
+ # x12 += counter values 0-7
vpaddd %ymm1,%ymm12,%ymm12
.Ldoubleround8:
@@ -596,7 +596,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
vmovdqa %ymm0,0x00(%rsp)
vpxor %ymm0,%ymm15,%ymm15
vpshufb %ymm3,%ymm15,%ymm15
- # x1 += x6, x12 = rotl32(x12 ^ x1, 16)%ymm0
+ # x1 += x6, x12 = rotl32(x12 ^ x1, 16)
vpaddd 0x20(%rsp),%ymm6,%ymm0
vmovdqa %ymm0,0x20(%rsp)
vpxor %ymm0,%ymm12,%ymm12
@@ -686,7 +686,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
sub $2,%r8d
jnz .Ldoubleround8
- # x0..15[0-3] += s[0..15]
+ # x0..15[0-7] += s[0..15]
vpbroadcastd 0x00(%rdi),%ymm0
vpaddd 0x00(%rsp),%ymm0,%ymm0
vmovdqa %ymm0,0x00(%rsp)
@@ -724,7 +724,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
vpbroadcastd 0x3c(%rdi),%ymm0
vpaddd %ymm0,%ymm15,%ymm15
- # x12 += counter values 0-3
+ # x12 += counter values 0-7
vpaddd %ymm1,%ymm12,%ymm12
# interleave 32-bit words in state n, n+1
diff --git a/lib/crypto/x86/chacha-avx512-x86_64.S b/lib/crypto/x86/chacha-avx512-x86_64.S
index 127a94f1843bb..3a70608d4a7d2 100644
--- a/lib/crypto/x86/chacha-avx512-x86_64.S
+++ b/lib/crypto/x86/chacha-avx512-x86_64.S
@@ -55,7 +55,7 @@ SYM_FUNC_START(chacha_0to2blocks_avx512vl)
# on four words in each matrix in parallel, but requires shuffling to
# rearrange the words after each round.
- # x0..3[0-2] = s0..3
+ # x0..3[0-1] = s0..3
vbroadcasti128 0x00(%rdi),%ymm0
vbroadcasti128 0x10(%rdi),%ymm1
vbroadcasti128 0x20(%rdi),%ymm2
@@ -195,7 +195,7 @@ SYM_FUNC_START(chacha_2to4blocks_avx512vl)
# required word shuffling has a rather high latency, we can do the
# arithmetic on two matrix-pairs without much slowdown.
- # x0..3[0-4] = s0..3
+ # x0..3[0-3] = s0..3
vbroadcasti128 0x00(%rdi),%ymm0
vbroadcasti128 0x10(%rdi),%ymm1
vbroadcasti128 0x20(%rdi),%ymm2
@@ -400,14 +400,14 @@ SYM_FUNC_END(chacha_2to4blocks_avx512vl)
# %r8d: nrounds
# This encrypts VL/4 consecutive ChaCha blocks by loading the state
- # matrix in as many vector registers. Compared to AVX2, this mostly
+ # matrix in vector registers VL/4 times. Compared to AVX2, this mostly
# benefits from the new rotate instructions and the additional
# registers.
#
# VL=32 encrypts eight blocks in 256-bit ymm registers.
# VL=64 encrypts sixteen blocks in 512-bit zmm registers.
- # x0..15[0-VL/4] = s[0..15]
+ # x0..15[0-(VL/4 - 1)] = s[0..15]
vpbroadcastd 0x00(%rdi),V0
vpbroadcastd 0x04(%rdi),V1
vpbroadcastd 0x08(%rdi),V2
diff --git a/lib/crypto/x86/chacha-ssse3-x86_64.S b/lib/crypto/x86/chacha-ssse3-x86_64.S
index b9884ec979fae..ea25d2cc796e3 100644
--- a/lib/crypto/x86/chacha-ssse3-x86_64.S
+++ b/lib/crypto/x86/chacha-ssse3-x86_64.S
@@ -227,7 +227,7 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
# %rcx: input/output data length in bytes: 1 to 4 blocks inclusive
# %r8d: nrounds
- # This function encrypts four consecutive ChaCha blocks by loading the
+ # This function encrypts four consecutive ChaCha blocks by loading
# the state matrix in SSE registers four times. As we need some scratch
# registers, we save the first four registers on the stack. The
# algorithm performs each operation on the corresponding word of each
@@ -242,7 +242,7 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
and $~63,%rsp
mov %rcx,%rax
- # x0..15[0-3] = s0..3[0..3]
+ # x0..15[0-3] = s[0..15]
movq 0x00(%rdi),%xmm1
pshufd $0x00,%xmm1,%xmm0
pshufd $0x55,%xmm1,%xmm1
@@ -500,8 +500,8 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
sub $2,%r8d
jnz .Ldoubleround4
- # x0[0-3] += s0[0]
- # x1[0-3] += s0[1]
+ # x0[0-3] += s[0]
+ # x1[0-3] += s[1]
movq 0x00(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
@@ -509,8 +509,8 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
movdqa %xmm2,0x00(%rsp)
paddd 0x10(%rsp),%xmm3
movdqa %xmm3,0x10(%rsp)
- # x2[0-3] += s0[2]
- # x3[0-3] += s0[3]
+ # x2[0-3] += s[2]
+ # x3[0-3] += s[3]
movq 0x08(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
@@ -519,45 +519,45 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
paddd 0x30(%rsp),%xmm3
movdqa %xmm3,0x30(%rsp)
- # x4[0-3] += s1[0]
- # x5[0-3] += s1[1]
+ # x4[0-3] += s[4]
+ # x5[0-3] += s[5]
movq 0x10(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
paddd %xmm2,%xmm4
paddd %xmm3,%xmm5
- # x6[0-3] += s1[2]
- # x7[0-3] += s1[3]
+ # x6[0-3] += s[6]
+ # x7[0-3] += s[7]
movq 0x18(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
paddd %xmm2,%xmm6
paddd %xmm3,%xmm7
- # x8[0-3] += s2[0]
- # x9[0-3] += s2[1]
+ # x8[0-3] += s[8]
+ # x9[0-3] += s[9]
movq 0x20(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
paddd %xmm2,%xmm8
paddd %xmm3,%xmm9
- # x10[0-3] += s2[2]
- # x11[0-3] += s2[3]
+ # x10[0-3] += s[10]
+ # x11[0-3] += s[11]
movq 0x28(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
paddd %xmm2,%xmm10
paddd %xmm3,%xmm11
- # x12[0-3] += s3[0]
- # x13[0-3] += s3[1]
+ # x12[0-3] += s[12]
+ # x13[0-3] += s[13]
movq 0x30(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
paddd %xmm2,%xmm12
paddd %xmm3,%xmm13
- # x14[0-3] += s3[2]
- # x15[0-3] += s3[3]
+ # x14[0-3] += s[14]
+ # x15[0-3] += s[15]
movq 0x38(%rdi),%xmm3
pshufd $0x00,%xmm3,%xmm2
pshufd $0x55,%xmm3,%xmm3
base-commit: 33b4f31b1aea3f62b61c892daefc0e6a77859032
--
2.56.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments
2026-11-12 3:44 [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments Eric Biggers
@ 2026-11-12 10:35 ` Antonio Quartulli
0 siblings, 0 replies; 2+ messages in thread
From: Antonio Quartulli @ 2026-11-12 10:35 UTC (permalink / raw)
To: Eric Biggers, linux-crypto
Cc: Ard Biesheuvel, Jason A . Donenfeld, Herbert Xu, Martin Willi
Hi Eric,
On 12/11/2026 04:44, Eric Biggers wrote:
> diff --git a/lib/crypto/x86/chacha-avx512-x86_64.S b/lib/crypto/x86/chacha-avx512-x86_64.S
> index 127a94f1843bb..3a70608d4a7d2 100644
> --- a/lib/crypto/x86/chacha-avx512-x86_64.S
> +++ b/lib/crypto/x86/chacha-avx512-x86_64.S
> @@ -55,7 +55,7 @@ SYM_FUNC_START(chacha_0to2blocks_avx512vl)
> # on four words in each matrix in parallel, but requires shuffling to
> # rearrange the words after each round.
>
> - # x0..3[0-2] = s0..3
> + # x0..3[0-1] = s0..3
> vbroadcasti128 0x00(%rdi),%ymm0
> vbroadcasti128 0x10(%rdi),%ymm1
> vbroadcasti128 0x20(%rdi),%ymm2
> @@ -195,7 +195,7 @@ SYM_FUNC_START(chacha_2to4blocks_avx512vl)
> # required word shuffling has a rather high latency, we can do the
> # arithmetic on two matrix-pairs without much slowdown.
>
> - # x0..3[0-4] = s0..3
> + # x0..3[0-3] = s0..3
> vbroadcasti128 0x00(%rdi),%ymm0
> vbroadcasti128 0x10(%rdi),%ymm1
> vbroadcasti128 0x20(%rdi),%ymm2
> @@ -400,14 +400,14 @@ SYM_FUNC_END(chacha_2to4blocks_avx512vl)
> # %r8d: nrounds
>
> # This encrypts VL/4 consecutive ChaCha blocks by loading the state
> - # matrix in as many vector registers. Compared to AVX2, this mostly
> + # matrix in vector registers VL/4 times. Compared to AVX2, this mostly
> # benefits from the new rotate instructions and the additional
> # registers.
> #
> # VL=32 encrypts eight blocks in 256-bit ymm registers.
> # VL=64 encrypts sixteen blocks in 512-bit zmm registers.
>
> - # x0..15[0-VL/4] = s[0..15]
> + # x0..15[0-(VL/4 - 1)] = s[0..15]
> vpbroadcastd 0x00(%rdi),V0
> vpbroadcastd 0x04(%rdi),V1
> vpbroadcastd 0x08(%rdi),V2
Maybe you want to also fix chacha-avx512-x86_64.S:588?
# x0..15 += s[0..15]
vpaddd V16,V0,V0
If I am not wrong, it'd be the only lacking the lane range now.
Regards,
--
Antonio Quartulli
CEO and Co-Founder
Mandelbit Srl
https://www.mandelbit.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-12 10:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-12 3:44 [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments Eric Biggers
2026-11-12 10:35 ` Antonio Quartulli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox