Hi Eric, On Tue, Nov 29, 2022 at 09:22:11PM -0800, Eric Biggers wrote: > On Tue, Nov 29, 2022 at 10:06:39PM +0100, Jason A. Donenfeld wrote: > > diff --git a/arch/x86/entry/vdso/vgetrandom-chacha.S b/arch/x86/entry/vdso/vgetrandom-chacha.S > > new file mode 100644 > > index 000000000000..91fbb7ac7af4 > > --- /dev/null > > +++ b/arch/x86/entry/vdso/vgetrandom-chacha.S > > @@ -0,0 +1,177 @@ > > +// SPDX-License-Identifier: GPL-2.0 > > +/* > > + * Copyright (C) 2022 Jason A. Donenfeld <Jason@xxxxxxxxx>. All Rights Reserved. > > + */ > > + > > +#include <linux/linkage.h> > > +#include <asm/frame.h> > > + > > +.section .rodata.cst16.CONSTANTS, "aM", @progbits, 16 > > +.align 16 > > +CONSTANTS: .octa 0x6b20657479622d323320646e61707865 > > +.text > > + > > +/* > > + * Very basic SSE2 implementation of ChaCha20. Produces a given positive number > > + * of blocks of output with a nonce of 0, taking an input key and 8-byte > > + * counter. Importantly does not spill to the stack. Its arguments are: > > + * > > + * rdi: output bytes > > + * rsi: 32-byte key input > > + * rdx: 8-byte counter input/output > > + * rcx: number of 64-byte blocks to write to output > > + */ > > +SYM_FUNC_START(__arch_chacha20_blocks_nostack) > > How was this ChaCha20 implementation tested? > > It really ought to have some sort of test. I've been comparing different output lengths with what libsodium produces. ARX, so no bigint stuff with carry bugs or whatever. I'll see if I can make a good test to add to one of the various suites for v11. Jason
