Hi Eric, Sorry for not replying to your question on v1. I was already reworking the series in that direction and should have told you.
Thanks for doing this. I tested your two patches with the lib/crypto KUnit tests in QEMU on x86_64, i386, arm, arm64, powerpc64le, riscv64, mips, mips64, s390x and UML, plus temporary tests with buffers over 2 GiB and 4 GiB. Everything passed, except for two things that fail the same way without your patches: the POWER10 Poly1305 interrupt context tests (I force-enabled that code, which depends on BROKEN), and two Poly1305 tests that crash under QEMU with AVX2 because of a QEMU bug. Tested-by: Vladimir Kukharenko <[email protected]> One gap remains on 32-bit arm and MIPS: the ChaCha assembly there treats the length as signed, and size_t is 32 bits, so lengths of 2 GiB or more are still handled incorrectly. On a Cortex-A7, which always uses the scalar code, a 2 GiB + 4101 byte in-place chacha20_crypt() changed only one byte. As a suggestion, I've sent two small fixes on top of your series: - arm: use unsigned conditions in chacha-scalar-core.S, and DIV_ROUND_UP_POW2() for the block count, since DIV_ROUND_UP() wraps above 0xffffffc0. - MIPS: the partial block code also relies on the sign of the remaining length, so a small C chacha_crypt_arch() passes the assembly at most 1 GiB at a time. Feel free to fold them into your series or handle it differently. Thanks, Vladimir Kukharenko
