Re: [PATCH] lib/crypto: x86/chacha: Add a 16-block AVX-512 variant

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Jul 23, 2026 at 01:03:50PM +0200, Martin Willi wrote:
> Hi Eric,
> 
> > This is very similar to the existing chacha_8block_xor_avx512vl(), just
> > with 512-bit vectors instead of 256-bit.  They even use the same CPU
> > instruction set extensions: there are actually no cases where a CPU can
> > run chacha_8block_xor_avx512vl() but not chacha_16block_xor_avx512()
> > (the choice of vector length is just going to be made by policy).
> > 
> > Given that, could we consolidate these implementations?
> 
> Yes, it is doable, but with some constraints:
> 
>  * In the 512-bit version, adding the initial state to the result uses
>    a small optimization with re-broadcasting, so it differs from the
>    256-bit variant. That optimization can be applied to the 256-bit
>    version for a unification, but would mean a change to it.
>  * The larger part of the interleaving tail is different and will
>    require separate code paths.
> 
> So the net win is shared broadcasting/doubleround at the cost of some
> macro complexity. I'll give it a try.
> 
> > Well, this is one of the cases where
> > cpu_has_xfeatures(XFEATURE_MASK_AVX512) was already required by the
> > existing code (since all AVX512 bits need to be enabled for any EVEX
> > coded instructions to work, even on xmm/ymm).  But it was never checked,
> > and no one ever noticed.  I would just continue to leave it out.
> > 
> > You can also drop the check of X86_FEATURE_AVX512F, which is implied by
> > X86_FEATURE_AVX512VL and X86_FEATURE_AVX512BW already.
> 
> Ok, will do so.

Hi Martin, is there any update on this?

- Eric