linux-kernel - Re: [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMj1kXEKvMC4pbDiMexs9TST5oo+5ujsgRnLEHSz==9GfSmRDw@mail.gmail.com>
Date: Fri, 5 Dec 2025 11:51:26 +0100
From: Ard Biesheuvel <ardb@...nel.org>
To: Eric Biggers <ebiggers@...nel.org>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org, 
	"Jason A . Donenfeld" <Jason@...c4.com>, Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: [PATCH] lib/crypto: blake2s: Replace manual unrolling with unrolled_full

On Fri, 5 Dec 2025 at 06:15, Eric Biggers <ebiggers@...nel.org> wrote:
>
> As we're doing in the BLAKE2b code, use unrolled_full to make the
> compiler handle the loop unrolling.  This simplifies the code slightly.
> The generated object code is nearly the same with both gcc and clang.
>
> Signed-off-by: Eric Biggers <ebiggers@...nel.org>
> ---
>  lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
>  1 file changed, 16 insertions(+), 22 deletions(-)
>

Reviewed-by: Ard Biesheuvel <ardb@...nel.org>

> diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
> index 6182c21ed943..71578a084742 100644
> --- a/lib/crypto/blake2s.c
> +++ b/lib/crypto/blake2s.c
> @@ -12,10 +12,11 @@
>  #include <linux/bug.h>
>  #include <linux/export.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
>  #include <linux/string.h>
> +#include <linux/unroll.h>
>  #include <linux/types.h>
>
>  static const u8 blake2s_sigma[10][16] = {
>         { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
>         { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
> @@ -69,33 +70,26 @@ blake2s_compress_generic(struct blake2s_ctx *ctx,
>         d = ror32(d ^ a, 8); \
>         c += d; \
>         b = ror32(b ^ c, 7); \
>  } while (0)
>
> -#define ROUND(r) do { \
> -       G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
> -       G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
> -       G(r, 2, v[2], v[ 6], v[10], v[14]); \
> -       G(r, 3, v[3], v[ 7], v[11], v[15]); \
> -       G(r, 4, v[0], v[ 5], v[10], v[15]); \
> -       G(r, 5, v[1], v[ 6], v[11], v[12]); \
> -       G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
> -       G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
> -} while (0)
> -               ROUND(0);
> -               ROUND(1);
> -               ROUND(2);
> -               ROUND(3);
> -               ROUND(4);
> -               ROUND(5);
> -               ROUND(6);
> -               ROUND(7);
> -               ROUND(8);
> -               ROUND(9);
> -
> +               /*
> +                * Unroll the rounds loop to enable constant-folding of the
> +                * blake2s_sigma values.
> +                */
> +               unrolled_full
> +               for (int r = 0; r < 10; r++) {
> +                       G(r, 0, v[0], v[4], v[8], v[12]);
> +                       G(r, 1, v[1], v[5], v[9], v[13]);
> +                       G(r, 2, v[2], v[6], v[10], v[14]);
> +                       G(r, 3, v[3], v[7], v[11], v[15]);
> +                       G(r, 4, v[0], v[5], v[10], v[15]);
> +                       G(r, 5, v[1], v[6], v[11], v[12]);
> +                       G(r, 6, v[2], v[7], v[8], v[13]);
> +                       G(r, 7, v[3], v[4], v[9], v[14]);
> +               }
>  #undef G
> -#undef ROUND
>
>                 for (i = 0; i < 8; ++i)
>                         ctx->h[i] ^= v[i] ^ v[i + 8];
>
>                 data += BLAKE2S_BLOCK_SIZE;
>
> base-commit: 43dfc13ca972988e620a6edb72956981b75ab6b0
> --
> 2.52.0
>