toolchain/58350: gcc12 update broke xchacha_stream_sse2

[campbell+netbsd%mumble.net@localhost]

>Number:         58350
>Category:       toolchain
>Synopsis:       gcc12 update broke xchacha_stream_sse2
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 17 23:15:00 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The NetBSDance Foundation 12
>Environment:
NetBSD 10.99.10 (GENERIC) #0: Sun Jun 16 23:55:23 UTC 2024 root%babylon4.netbsd.org@localhost:/tmp/build/2024.06.16.19.21.46-amd64/obj/sys/arch/amd64/compile/GENERIC
>Description:
x86 SSE2 ChaCha self-test failed

xchacha_stream (608 bytes @ 0x7f7fffc1bcb0)
 e5 0e 31 b5 25 1c 42 87  34 d4 e2 e0 d7 19 35 90
 7a 8e 3c cf 46 29 dc 65  62 eb d6 ce bf 32 f0 b4
 75 30 e9 2a 7c 86 53 7c  b1 b4 9f b3 e8 67 a8 6f
...
expected (608 bytes @ 0x7f7fffc1bcb0)
 11 31 ce 9a 2a 20 ae 0d  67 c8 93 5c 77 89 fa 10
 25 c9 e5 bb 72 0f b9 6f  11 35 4f b9 7a f0 bd 9a
 ad ec 08 63 ba 60 ca c8  58 2c 48 f8 6c df c4 8e

and similarly for 607-byte, 543-byte, 511-byte, and 63-byte inputs.

https://releng.netbsd.org/b5reports/amd64/2024/2024.06.16.19.21.46/test.html#sys_crypto_chacha_t_chacha_chacha_sse2_selftest

Clues:

- Same failure, different output, on i386: https://releng.netbsd.org/b5reports/i386/2024/2024.06.16.19.21.46/test.html#sys_crypto_chacha_t_chacha_chacha_sse2_selftest
- hchacha_sse2 test doesn't fail
- xchacha_stream_xor_sse2 test doesn't fail

So it's probably in chacha_stream_sse2, which is the other subroutine besides hchacha_sse2 which is called by xchacha_stream_sse2.
>How-To-Repeat:
cd /usr/tests/sys/crypto/chacha
atf-run t_chacha
>Fix:
Yes, please!

1. It's possible our private immintrin.h, which exists only because I couldn't figure out how to use gcc's immintrin.h in the kernel build, is broken.  If so, fix: figure out how to use gcc's immintrin.h in the kernel build (same with clang).  Workaround: tweak our private immintrin.h.

2. It's possible gcc code generation is broken.  If so, maybe we can work around this with some judicious asm volatile("" ::: "memory") or something.