RE: [PATCH 1/5] An optimized Chacha20 implementation with 8-way unrolling for ppc64le.

[David Laight <David.Laight@ACULAB.COM>]

From: Danny Tsen
> Sent: 24 April 2023 19:47
> 
> Improve overall performance of chacha20 encrypt and decrypt operations
> for Power10 or later CPU.
> 
> Signed-off-by: Danny Tsen <dtsen@linux.ibm.com>
> ---
>  arch/powerpc/crypto/chacha-p10le-8x.S | 842 ++++++++++++++++++++++++++
>  1 file changed, 842 insertions(+)
>  create mode 100644 arch/powerpc/crypto/chacha-p10le-8x.S
...
> +.macro QT_loop_8x
> +	# QR(v0, v4,  v8, v12, v1, v5,  v9, v13, v2, v6, v10, v14, v3, v7, v11, v15)
> +	xxlor	0, 32+25, 32+25
> +	xxlor	32+25, 20, 20
> +	vadduwm 0, 0, 4
> +	vadduwm 1, 1, 5
> +	vadduwm 2, 2, 6
> +	vadduwm 3, 3, 7
> +	  vadduwm 16, 16, 20
> +	  vadduwm 17, 17, 21
> +	  vadduwm 18, 18, 22
> +	  vadduwm 19, 19, 23
> +
> +	  vpermxor 12, 12, 0, 25
> +	  vpermxor 13, 13, 1, 25
> +	  vpermxor 14, 14, 2, 25
> +	  vpermxor 15, 15, 3, 25
> +	  vpermxor 28, 28, 16, 25
> +	  vpermxor 29, 29, 17, 25
> +	  vpermxor 30, 30, 18, 25
> +	  vpermxor 31, 31, 19, 25
> +	xxlor	32+25, 0, 0
> +	vadduwm 8, 8, 12
> +	vadduwm 9, 9, 13
> +	vadduwm 10, 10, 14
> +	vadduwm 11, 11, 15
...

Is it just me or is all this code just complete jibberish?

There really ought to be enough comments so that it is possible
to check that the code is doing something that looks like chacha20
without spending all day tracking register numbers through
hundreds of lines of assembler.

I also wonder how much faster the 8-way unroll is?
On modern cpu with 'out of order' execute (etc) it is
not impossible to get the loop operations 'for free'
because they use execution units that are otherwise idle.

Massive loop unrolling is so 1980's.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)