Linux cryptographic layer development
 help / color / mirror / Atom feed
* [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments
@ 2026-11-12  3:44 Eric Biggers
  2026-11-12 10:35 ` Antonio Quartulli
  0 siblings, 1 reply; 2+ messages in thread
From: Eric Biggers @ 2026-11-12  3:44 UTC (permalink / raw)
  To: linux-crypto
  Cc: Ard Biesheuvel, Jason A . Donenfeld, Herbert Xu,
	Antonio Quartulli, Martin Willi, Eric Biggers

Fix various mistakes in comments, many probably originating from
copy+pasting: incorrect block ranges, duplicate words, and stray text.

Also make chacha_1to4blocks_ssse3() refer to the state matrix using flat
indexing, like the equivalent AVX2 and AVX512 functions.  It was the
only place using 2D row-column indexing of the state matrix.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/x86/chacha-avx2-x86_64.S   | 12 ++++-----
 lib/crypto/x86/chacha-avx512-x86_64.S |  8 +++---
 lib/crypto/x86/chacha-ssse3-x86_64.S  | 36 +++++++++++++--------------
 3 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/lib/crypto/x86/chacha-avx2-x86_64.S b/lib/crypto/x86/chacha-avx2-x86_64.S
index 18ae03e05074f..5cf009616f7cb 100644
--- a/lib/crypto/x86/chacha-avx2-x86_64.S
+++ b/lib/crypto/x86/chacha-avx2-x86_64.S
@@ -46,7 +46,7 @@ SYM_FUNC_START(chacha_1to2blocks_avx2)
 	# on four words in each matrix in parallel, but requires shuffling to
 	# rearrange the words after each round.
 
-	# x0..3[0-2] = s0..3
+	# x0..3[0-1] = s0..3
 	vbroadcasti128	0x00(%rdi),%ymm0
 	vbroadcasti128	0x10(%rdi),%ymm1
 	vbroadcasti128	0x20(%rdi),%ymm2
@@ -212,7 +212,7 @@ SYM_FUNC_START(chacha_2to4blocks_avx2)
 	# required word shuffling has a rather high latency, we can do the
 	# arithmetic on two matrix-pairs without much slowdown.
 
-	# x0..3[0-4] = s0..3
+	# x0..3[0-3] = s0..3
 	vbroadcasti128	0x00(%rdi),%ymm0
 	vbroadcasti128	0x10(%rdi),%ymm1
 	vbroadcasti128	0x20(%rdi),%ymm2
@@ -495,7 +495,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
 	vmovdqa		ROT8(%rip),%ymm2
 	vmovdqa		ROT16(%rip),%ymm3
 
-	# x12 += counter values 0-3
+	# x12 += counter values 0-7
 	vpaddd		%ymm1,%ymm12,%ymm12
 
 .Ldoubleround8:
@@ -596,7 +596,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
 	vmovdqa		%ymm0,0x00(%rsp)
 	vpxor		%ymm0,%ymm15,%ymm15
 	vpshufb		%ymm3,%ymm15,%ymm15
-	# x1 += x6, x12 = rotl32(x12 ^ x1, 16)%ymm0
+	# x1 += x6, x12 = rotl32(x12 ^ x1, 16)
 	vpaddd		0x20(%rsp),%ymm6,%ymm0
 	vmovdqa		%ymm0,0x20(%rsp)
 	vpxor		%ymm0,%ymm12,%ymm12
@@ -686,7 +686,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
 	sub		$2,%r8d
 	jnz		.Ldoubleround8
 
-	# x0..15[0-3] += s[0..15]
+	# x0..15[0-7] += s[0..15]
 	vpbroadcastd	0x00(%rdi),%ymm0
 	vpaddd		0x00(%rsp),%ymm0,%ymm0
 	vmovdqa		%ymm0,0x00(%rsp)
@@ -724,7 +724,7 @@ SYM_FUNC_START(chacha_4to8blocks_avx2)
 	vpbroadcastd	0x3c(%rdi),%ymm0
 	vpaddd		%ymm0,%ymm15,%ymm15
 
-	# x12 += counter values 0-3
+	# x12 += counter values 0-7
 	vpaddd		%ymm1,%ymm12,%ymm12
 
 	# interleave 32-bit words in state n, n+1
diff --git a/lib/crypto/x86/chacha-avx512-x86_64.S b/lib/crypto/x86/chacha-avx512-x86_64.S
index 127a94f1843bb..3a70608d4a7d2 100644
--- a/lib/crypto/x86/chacha-avx512-x86_64.S
+++ b/lib/crypto/x86/chacha-avx512-x86_64.S
@@ -55,7 +55,7 @@ SYM_FUNC_START(chacha_0to2blocks_avx512vl)
 	# on four words in each matrix in parallel, but requires shuffling to
 	# rearrange the words after each round.
 
-	# x0..3[0-2] = s0..3
+	# x0..3[0-1] = s0..3
 	vbroadcasti128	0x00(%rdi),%ymm0
 	vbroadcasti128	0x10(%rdi),%ymm1
 	vbroadcasti128	0x20(%rdi),%ymm2
@@ -195,7 +195,7 @@ SYM_FUNC_START(chacha_2to4blocks_avx512vl)
 	# required word shuffling has a rather high latency, we can do the
 	# arithmetic on two matrix-pairs without much slowdown.
 
-	# x0..3[0-4] = s0..3
+	# x0..3[0-3] = s0..3
 	vbroadcasti128	0x00(%rdi),%ymm0
 	vbroadcasti128	0x10(%rdi),%ymm1
 	vbroadcasti128	0x20(%rdi),%ymm2
@@ -400,14 +400,14 @@ SYM_FUNC_END(chacha_2to4blocks_avx512vl)
 	# %r8d: nrounds
 
 	# This encrypts VL/4 consecutive ChaCha blocks by loading the state
-	# matrix in as many vector registers. Compared to AVX2, this mostly
+	# matrix in vector registers VL/4 times. Compared to AVX2, this mostly
 	# benefits from the new rotate instructions and the additional
 	# registers.
 	#
 	# VL=32 encrypts eight blocks in 256-bit ymm registers.
 	# VL=64 encrypts sixteen blocks in 512-bit zmm registers.
 
-	# x0..15[0-VL/4] = s[0..15]
+	# x0..15[0-(VL/4 - 1)] = s[0..15]
 	vpbroadcastd	0x00(%rdi),V0
 	vpbroadcastd	0x04(%rdi),V1
 	vpbroadcastd	0x08(%rdi),V2
diff --git a/lib/crypto/x86/chacha-ssse3-x86_64.S b/lib/crypto/x86/chacha-ssse3-x86_64.S
index b9884ec979fae..ea25d2cc796e3 100644
--- a/lib/crypto/x86/chacha-ssse3-x86_64.S
+++ b/lib/crypto/x86/chacha-ssse3-x86_64.S
@@ -227,7 +227,7 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
 	# %rcx: input/output data length in bytes: 1 to 4 blocks inclusive
 	# %r8d: nrounds
 
-	# This function encrypts four consecutive ChaCha blocks by loading the
+	# This function encrypts four consecutive ChaCha blocks by loading
 	# the state matrix in SSE registers four times. As we need some scratch
 	# registers, we save the first four registers on the stack. The
 	# algorithm performs each operation on the corresponding word of each
@@ -242,7 +242,7 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
 	and		$~63,%rsp
 	mov		%rcx,%rax
 
-	# x0..15[0-3] = s0..3[0..3]
+	# x0..15[0-3] = s[0..15]
 	movq		0x00(%rdi),%xmm1
 	pshufd		$0x00,%xmm1,%xmm0
 	pshufd		$0x55,%xmm1,%xmm1
@@ -500,8 +500,8 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
 	sub		$2,%r8d
 	jnz		.Ldoubleround4
 
-	# x0[0-3] += s0[0]
-	# x1[0-3] += s0[1]
+	# x0[0-3] += s[0]
+	# x1[0-3] += s[1]
 	movq		0x00(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
@@ -509,8 +509,8 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
 	movdqa		%xmm2,0x00(%rsp)
 	paddd		0x10(%rsp),%xmm3
 	movdqa		%xmm3,0x10(%rsp)
-	# x2[0-3] += s0[2]
-	# x3[0-3] += s0[3]
+	# x2[0-3] += s[2]
+	# x3[0-3] += s[3]
 	movq		0x08(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
@@ -519,45 +519,45 @@ SYM_FUNC_START(chacha_1to4blocks_ssse3)
 	paddd		0x30(%rsp),%xmm3
 	movdqa		%xmm3,0x30(%rsp)
 
-	# x4[0-3] += s1[0]
-	# x5[0-3] += s1[1]
+	# x4[0-3] += s[4]
+	# x5[0-3] += s[5]
 	movq		0x10(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
 	paddd		%xmm2,%xmm4
 	paddd		%xmm3,%xmm5
-	# x6[0-3] += s1[2]
-	# x7[0-3] += s1[3]
+	# x6[0-3] += s[6]
+	# x7[0-3] += s[7]
 	movq		0x18(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
 	paddd		%xmm2,%xmm6
 	paddd		%xmm3,%xmm7
 
-	# x8[0-3] += s2[0]
-	# x9[0-3] += s2[1]
+	# x8[0-3] += s[8]
+	# x9[0-3] += s[9]
 	movq		0x20(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
 	paddd		%xmm2,%xmm8
 	paddd		%xmm3,%xmm9
-	# x10[0-3] += s2[2]
-	# x11[0-3] += s2[3]
+	# x10[0-3] += s[10]
+	# x11[0-3] += s[11]
 	movq		0x28(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
 	paddd		%xmm2,%xmm10
 	paddd		%xmm3,%xmm11
 
-	# x12[0-3] += s3[0]
-	# x13[0-3] += s3[1]
+	# x12[0-3] += s[12]
+	# x13[0-3] += s[13]
 	movq		0x30(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3
 	paddd		%xmm2,%xmm12
 	paddd		%xmm3,%xmm13
-	# x14[0-3] += s3[2]
-	# x15[0-3] += s3[3]
+	# x14[0-3] += s[14]
+	# x15[0-3] += s[15]
 	movq		0x38(%rdi),%xmm3
 	pshufd		$0x00,%xmm3,%xmm2
 	pshufd		$0x55,%xmm3,%xmm3

base-commit: 33b4f31b1aea3f62b61c892daefc0e6a77859032
-- 
2.56.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-12 10:35 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-12  3:44 [PATCH] lib/crypto: x86/chacha: Fix mistakes and inconsistencies in comments Eric Biggers
2026-11-12 10:35 ` Antonio Quartulli

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox