[PATCH v3] crypto: riscv/poly1305 - import OpenSSL/CRYPTOGAMS implementation

[Eric Biggers]

On Mon, Jun 09, 2025 at 03:46:57PM +0800, Zhihang Shao wrote:
> From: Zhihang Shao <zhihang.shao.iscas at gmail.com>
> 
> This is a straight import of the OpenSSL/CRYPTOGAMS Poly1305
> implementation for riscv authored by Andy Polyakov.
> The file 'poly1305-riscv.pl' is taken straight from this upstream
> GitHub repository [0] at commit 33fe84bc21219a16825459b37c825bf4580a0a7b,
> and this commit fixed a bug in riscv 64bit implementation.
> 
> [0] https://github.com/dot-asm/cryptogams

There are a couple minor differences between the CRYPTOGAMS file and the one in
this patch.  Please make sure those are documented.

> +config CRYPTO_POLY1305_RISCV
> +	tristate
> +	default CRYPTO_LIB_POLY1305
> +    select CRYPTO_ARCH_HAVE_LIB_POLY1305

Fix the indentation here.

> +void poly1305_blocks_arch(struct poly1305_block_state *state, const u8 *src,
> +			  unsigned int len, u32 padbit)
> +{
> +	len = round_down(len, POLY1305_BLOCK_SIZE);
> +	poly1305_blocks(state, src, len, 1);
> +}
> +EXPORT_SYMBOL_GPL(poly1305_blocks_arch);

This is ignoring the padbit and forcing it to 1, so this will compute the wrong
Poly1305 value for messages with length not a multiple of 16 bytes.

chacha20poly1305-selftest still passes, so it must not test this case.  We need
to add a self-test for Poly1305 directly, ideally using KUnit.

- Eric