Re: [PATCH] lib/crypto: x86/blake2s: Permute original message words in AVX-512 code

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Nov 11, 2026 at 08:25:13PM -0800, Eric Biggers wrote:
> Each round of BLAKE2s takes a different fixed permutation of the message
> words as an input.  For each round, blake2s_compress_avx512() applies
> that permutation on the message words in %ymm6-%ymm7, writing the
> permuted words to %ymm8-%ymm9 where they are used for the round.
> 
> Oddly, though, it also copies the permuted words back into %ymm6-%ymm7.
> That means the next round has to apply the previous round's inverse
> permutation, then the next round's permutation.  Which it does, by using
> the 'sigma2' table which has the permutations precomposed in this way.
> 
> However, this is not necessary at all, as we can simply do each round's
> permutation on the original message words, using the 'sigma' table which
> is already present in the file for blake2s_compress_ssse3().
> 
> Do that instead.  This eliminates 160 unnecessary bytes of rodata, two
> unnecessary instructions per round, and a loop-carried dependency.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/x86/blake2s-core.S | 18 +-----------------
>  1 file changed, 1 insertion(+), 17 deletions(-)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric