Re: [PATCH 0/2] lib/crypto: x86/chacha: Add 16-block AVX-512 implementation

[Eric Biggers <ebiggers@kernel.org>]

[+Cc Martin Willi <martin@strongswan.org>]

On Mon, Oct 26, 2026 at 12:47:53AM +0100, Antonio Quartulli wrote:
> Hi all,
> 
> this series adds a 16-block ChaCha implementation for x86 using 512-bit
> registers. It is preceded by a KUnit suite and benchmark for
> chacha_crypt(), as lib/crypto has none for plain ChaCha yet.
> 
> Patch 1 stands on its own and passes with and without patch 2.
> 
> On AMD Zen 5, the new code doubles chacha_crypt() throughput for inputs
> of 1 KiB and more, from about 5.2 GB/s to about 10.2 GB/s. It came out
> of work on the OpenVPN data channel offload driver (ovpn), whose
> ChaCha20-Poly1305 throughput is CPU-bound: in a VM benchmark it gained
> about 10% at a 1500-byte MTU and 35% at 9000.
> 
> iPlease note that I could only measure Zen 5.
> The new code is not used on the CPUs setting X86_FEATURE_PREFER_YMM
> (Skylake-X, Ice Lake and Tiger Lake), but it is on
> Rocket Lake, Sapphire Rapids and later, and on Zen 4, where 512-bit
> operations are split into two halves. Numbers from any of those would be
> very welcome.

Can you clarify how your AVX-512 implementation differs from
https://lore.kernel.org/linux-crypto/20260722153247.630519-1-martin@strongswan.org/
?  See also the feedback I left on it here:
https://lore.kernel.org/linux-crypto/20260722232424.GA50619@quark/
That applies to this one too, it looks like.

Side note: "Zen 5" needs clarification.  The vector execution units
aren't as wide on the Zen 5 mobile processors as on Zen 5 desktop and
server.  Probably your numbers apply to desktop and server only.  (I've
made that mistake in the past before, but they are indeed different.)

- Eric