Re: [PATCH 2/3] lib/crypto: x86: Opt out of initializing MXCSR and 387 state

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Nov 04, 2026 at 04:55:22PM -0800, Eric Biggers wrote:
> The crypto code using "kernel-mode FPU" is integer code that does not
> use any MMX or x87 instructions.  To the extent that float-domain
> instructions are used at all, they are only moves and shuffles, neither
> of which raises SIMD floating-point exceptions or depends on MXCSR.
> 
> Therefore, there's no need to initialize MXCSR or the 387 FPU state.
> 
> Opt out of this initialization by using kernel_fpu_begin_mask(0) instead
> of kernel_fpu_begin().  This eliminates an 'ldmxcsr' instruction in
> every kernel-mode FPU section, reducing overhead, which matters most for
> short input lengths.  On 32-bit kernels it also eliminates 'fninit'.
> 
> A precedent for this optimization can be found in
> commit a58db7ad80e8 ("netfilter: nft_set_pipapo_avx2: Skip LDMXCSR, we
> don't need a valid MXCSR state").
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/x86/aes.h       | 24 ++++++++++++------------
>  lib/crypto/x86/blake2s.h   |  2 +-
>  lib/crypto/x86/chacha.h    |  4 ++--
>  lib/crypto/x86/gf128hash.h |  8 ++++----
>  lib/crypto/x86/nh.h        |  2 +-
>  lib/crypto/x86/poly1305.h  |  2 +-
>  lib/crypto/x86/sha1.h      |  4 ++--
>  lib/crypto/x86/sha256.h    |  4 ++--
>  lib/crypto/x86/sha512.h    |  2 +-
>  lib/crypto/x86/sm3.h       |  2 +-
>  10 files changed, 27 insertions(+), 27 deletions(-)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

Reviews and acks appreciated!

- Eric