* [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full
@ 2025-12-05 5:11 Eric Biggers
2025-12-05 10:51 ` Ard Biesheuvel
2025-12-09 23:11 ` Eric Biggers
0 siblings, 2 replies; 3+ messages in thread
From: Eric Biggers @ 2025-12-05 5:11 UTC (permalink / raw)
To: linux-crypto
Cc: linux-kernel, Ard Biesheuvel, Jason A . Donenfeld, Herbert Xu,
Eric Biggers
As we're doing in the BLAKE2b code, use unrolled_full to make the
compiler handle the loop unrolling. This simplifies the code slightly.
The generated object code is nearly the same with both gcc and clang.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
1 file changed, 16 insertions(+), 22 deletions(-)
diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
index 6182c21ed943..71578a084742 100644
--- a/lib/crypto/blake2s.c
+++ b/lib/crypto/blake2s.c
@@ -12,10 +12,11 @@
#include <linux/bug.h>
#include <linux/export.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/string.h>
+#include <linux/unroll.h>
#include <linux/types.h>
static const u8 blake2s_sigma[10][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
@@ -69,33 +70,26 @@ blake2s_compress_generic(struct blake2s_ctx *ctx,
d = ror32(d ^ a, 8); \
c += d; \
b = ror32(b ^ c, 7); \
} while (0)
-#define ROUND(r) do { \
- G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
- G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
- G(r, 2, v[2], v[ 6], v[10], v[14]); \
- G(r, 3, v[3], v[ 7], v[11], v[15]); \
- G(r, 4, v[0], v[ 5], v[10], v[15]); \
- G(r, 5, v[1], v[ 6], v[11], v[12]); \
- G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
- G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
-} while (0)
- ROUND(0);
- ROUND(1);
- ROUND(2);
- ROUND(3);
- ROUND(4);
- ROUND(5);
- ROUND(6);
- ROUND(7);
- ROUND(8);
- ROUND(9);
-
+ /*
+ * Unroll the rounds loop to enable constant-folding of the
+ * blake2s_sigma values.
+ */
+ unrolled_full
+ for (int r = 0; r < 10; r++) {
+ G(r, 0, v[0], v[4], v[8], v[12]);
+ G(r, 1, v[1], v[5], v[9], v[13]);
+ G(r, 2, v[2], v[6], v[10], v[14]);
+ G(r, 3, v[3], v[7], v[11], v[15]);
+ G(r, 4, v[0], v[5], v[10], v[15]);
+ G(r, 5, v[1], v[6], v[11], v[12]);
+ G(r, 6, v[2], v[7], v[8], v[13]);
+ G(r, 7, v[3], v[4], v[9], v[14]);
+ }
#undef G
-#undef ROUND
for (i = 0; i < 8; ++i)
ctx->h[i] ^= v[i] ^ v[i + 8];
data += BLAKE2S_BLOCK_SIZE;
base-commit: 43dfc13ca972988e620a6edb72956981b75ab6b0
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full
2025-12-05 5:11 [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full Eric Biggers
@ 2025-12-05 10:51 ` Ard Biesheuvel
2025-12-09 23:11 ` Eric Biggers
1 sibling, 0 replies; 3+ messages in thread
From: Ard Biesheuvel @ 2025-12-05 10:51 UTC (permalink / raw)
To: Eric Biggers; +Cc: linux-crypto, linux-kernel, Jason A . Donenfeld, Herbert Xu
On Fri, 5 Dec 2025 at 06:15, Eric Biggers <ebiggers@kernel.org> wrote:
>
> As we're doing in the BLAKE2b code, use unrolled_full to make the
> compiler handle the loop unrolling. This simplifies the code slightly.
> The generated object code is nearly the same with both gcc and clang.
>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
> lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
> 1 file changed, 16 insertions(+), 22 deletions(-)
>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
> diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
> index 6182c21ed943..71578a084742 100644
> --- a/lib/crypto/blake2s.c
> +++ b/lib/crypto/blake2s.c
> @@ -12,10 +12,11 @@
> #include <linux/bug.h>
> #include <linux/export.h>
> #include <linux/kernel.h>
> #include <linux/module.h>
> #include <linux/string.h>
> +#include <linux/unroll.h>
> #include <linux/types.h>
>
> static const u8 blake2s_sigma[10][16] = {
> { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
> { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
> @@ -69,33 +70,26 @@ blake2s_compress_generic(struct blake2s_ctx *ctx,
> d = ror32(d ^ a, 8); \
> c += d; \
> b = ror32(b ^ c, 7); \
> } while (0)
>
> -#define ROUND(r) do { \
> - G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
> - G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
> - G(r, 2, v[2], v[ 6], v[10], v[14]); \
> - G(r, 3, v[3], v[ 7], v[11], v[15]); \
> - G(r, 4, v[0], v[ 5], v[10], v[15]); \
> - G(r, 5, v[1], v[ 6], v[11], v[12]); \
> - G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
> - G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
> -} while (0)
> - ROUND(0);
> - ROUND(1);
> - ROUND(2);
> - ROUND(3);
> - ROUND(4);
> - ROUND(5);
> - ROUND(6);
> - ROUND(7);
> - ROUND(8);
> - ROUND(9);
> -
> + /*
> + * Unroll the rounds loop to enable constant-folding of the
> + * blake2s_sigma values.
> + */
> + unrolled_full
> + for (int r = 0; r < 10; r++) {
> + G(r, 0, v[0], v[4], v[8], v[12]);
> + G(r, 1, v[1], v[5], v[9], v[13]);
> + G(r, 2, v[2], v[6], v[10], v[14]);
> + G(r, 3, v[3], v[7], v[11], v[15]);
> + G(r, 4, v[0], v[5], v[10], v[15]);
> + G(r, 5, v[1], v[6], v[11], v[12]);
> + G(r, 6, v[2], v[7], v[8], v[13]);
> + G(r, 7, v[3], v[4], v[9], v[14]);
> + }
> #undef G
> -#undef ROUND
>
> for (i = 0; i < 8; ++i)
> ctx->h[i] ^= v[i] ^ v[i + 8];
>
> data += BLAKE2S_BLOCK_SIZE;
>
> base-commit: 43dfc13ca972988e620a6edb72956981b75ab6b0
> --
> 2.52.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full
2025-12-05 5:11 [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full Eric Biggers
2025-12-05 10:51 ` Ard Biesheuvel
@ 2025-12-09 23:11 ` Eric Biggers
1 sibling, 0 replies; 3+ messages in thread
From: Eric Biggers @ 2025-12-09 23:11 UTC (permalink / raw)
To: linux-crypto
Cc: linux-kernel, Ard Biesheuvel, Jason A . Donenfeld, Herbert Xu
On Thu, Dec 04, 2025 at 09:11:55PM -0800, Eric Biggers wrote:
> As we're doing in the BLAKE2b code, use unrolled_full to make the
> compiler handle the loop unrolling. This simplifies the code slightly.
> The generated object code is nearly the same with both gcc and clang.
>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
> lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
> 1 file changed, 16 insertions(+), 22 deletions(-)
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes
- Eric
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-12-09 23:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-05 5:11 [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full Eric Biggers
2025-12-05 10:51 ` Ard Biesheuvel
2025-12-09 23:11 ` Eric Biggers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).