linux-kernel - RE: [PATCH 1/5] An optimized Chacha20 implementation with 8-way unrolling for ppc64le.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0bb5f98165c3408fb191488f3cf0f76c@AcuMS.aculab.com>
Date:   Wed, 26 Apr 2023 08:19:17 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Danny Tsen' <dtsen@...ux.ibm.com>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>
CC:     "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "leitao@...ian.org" <leitao@...ian.org>,
        "nayna@...ux.ibm.com" <nayna@...ux.ibm.com>,
        "appro@...ptogams.org" <appro@...ptogams.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "mpe@...erman.id.au" <mpe@...erman.id.au>,
        "ltcgcw@...ux.vnet.ibm.com" <ltcgcw@...ux.vnet.ibm.com>,
        "dtsen@...ibm.com" <dtsen@...ibm.com>
Subject: RE: [PATCH 1/5] An optimized Chacha20 implementation with 8-way
 unrolling for ppc64le.

From: Danny Tsen
> Sent: 24 April 2023 19:47
> 
> Improve overall performance of chacha20 encrypt and decrypt operations
> for Power10 or later CPU.
> 
> Signed-off-by: Danny Tsen <dtsen@...ux.ibm.com>
> ---
>  arch/powerpc/crypto/chacha-p10le-8x.S | 842 ++++++++++++++++++++++++++
>  1 file changed, 842 insertions(+)
>  create mode 100644 arch/powerpc/crypto/chacha-p10le-8x.S
...
> +.macro QT_loop_8x
> +	# QR(v0, v4,  v8, v12, v1, v5,  v9, v13, v2, v6, v10, v14, v3, v7, v11, v15)
> +	xxlor	0, 32+25, 32+25
> +	xxlor	32+25, 20, 20
> +	vadduwm 0, 0, 4
> +	vadduwm 1, 1, 5
> +	vadduwm 2, 2, 6
> +	vadduwm 3, 3, 7
> +	  vadduwm 16, 16, 20
> +	  vadduwm 17, 17, 21
> +	  vadduwm 18, 18, 22
> +	  vadduwm 19, 19, 23
> +
> +	  vpermxor 12, 12, 0, 25
> +	  vpermxor 13, 13, 1, 25
> +	  vpermxor 14, 14, 2, 25
> +	  vpermxor 15, 15, 3, 25
> +	  vpermxor 28, 28, 16, 25
> +	  vpermxor 29, 29, 17, 25
> +	  vpermxor 30, 30, 18, 25
> +	  vpermxor 31, 31, 19, 25
> +	xxlor	32+25, 0, 0
> +	vadduwm 8, 8, 12
> +	vadduwm 9, 9, 13
> +	vadduwm 10, 10, 14
> +	vadduwm 11, 11, 15
...

Is it just me or is all this code just complete jibberish?

There really ought to be enough comments so that it is possible
to check that the code is doing something that looks like chacha20
without spending all day tracking register numbers through
hundreds of lines of assembler.

I also wonder how much faster the 8-way unroll is?
On modern cpu with 'out of order' execute (etc) it is
not impossible to get the loop operations 'for free'
because they use execution units that are otherwise idle.

Massive loop unrolling is so 1980's.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)