Re: [PATCH 0/2] lib/crypto: x86/chacha: Add 16-block AVX-512 implementation

[Antonio Quartulli <antonio@mandelbit.com>]

Hi Eric, Martin,

On 26/10/2026 01:35, Eric Biggers wrote:
> [+Cc Martin Willi <martin@strongswan.org>]
> 
> On Mon, Oct 26, 2026 at 12:47:53AM +0100, Antonio Quartulli wrote:
>> Hi all,
>>
>> this series adds a 16-block ChaCha implementation for x86 using 512-bit
>> registers. It is preceded by a KUnit suite and benchmark for
>> chacha_crypt(), as lib/crypto has none for plain ChaCha yet.
>>
>> Patch 1 stands on its own and passes with and without patch 2.
>>
>> On AMD Zen 5, the new code doubles chacha_crypt() throughput for inputs
>> of 1 KiB and more, from about 5.2 GB/s to about 10.2 GB/s. It came out
>> of work on the OpenVPN data channel offload driver (ovpn), whose
>> ChaCha20-Poly1305 throughput is CPU-bound: in a VM benchmark it gained
>> about 10% at a 1500-byte MTU and 35% at 9000.
>>
>> iPlease note that I could only measure Zen 5.
>> The new code is not used on the CPUs setting X86_FEATURE_PREFER_YMM
>> (Skylake-X, Ice Lake and Tiger Lake), but it is on
>> Rocket Lake, Sapphire Rapids and later, and on Zen 4, where 512-bit
>> operations are split into two halves. Numbers from any of those would be
>> very welcome.
> 
> Can you clarify how your AVX-512 implementation differs from
> https://lore.kernel.org/linux-crypto/20260722153247.630519-1-martin@strongswan.org/
> ?  See also the feedback I left on it here:
> https://lore.kernel.org/linux-crypto/20260722232424.GA50619@quark/
> That applies to this one too, it looks like.
> 

It doesn't differ in any meaningful way, sorry.

I had missed Martin's patch and mine basically takes the same approach
(sixteen blocks in zmm registers, used for inputs longer than eight
blocks and skipped on CPUs setting X86_FEATURE_PREFER_YMM).
It also doesn't address your consolidation feedback either.

@Martin, since you mentioned a series consolidating the AVX2 and
AVX-512 block functions, please consider my patch 2 withdrawn in favour
of yours.

I'm happy to test and benchmark it, including with ovpn, and if
you'd rather hand the consolidation over, just let me know and I'll see
what I do.

Patch 1 (KUnit tests and benchmark for chacha_crypt()) is independent
of the AVX-512 code: it compares chacha_crypt() against
chacha_block_generic() for every length up to 4100 bytes and random
ones up to 12 KiB, with guard pages, in-place and split calls, plus the
RFC 7539 vector.

@Eric, would you consider it on its own? It would cover Martin's series
as well. I can resend it standalone if that's easier.

> Side note: "Zen 5" needs clarification.  The vector execution units
> aren't as wide on the Zen 5 mobile processors as on Zen 5 desktop and
> server.  Probably your numbers apply to desktop and server only.  (I've
> made that mistake in the past before, but they are indeed different.)
> 

Right, they were measured on a Ryzen 9 9950X (desktop), thanks for
pointing that out.

Thanks,

-- 
Antonio Quartulli

CEO and Co-Founder
Mandelbit Srl
https://www.mandelbit.com