Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

[Eric Biggers]

On Thu, Dec 04, 2025 at 12:56:32PM -0500, Jason A. Donenfeld wrote:
> On Wed, Dec 03, 2025 at 11:06:52AM -0800, Eric Biggers wrote:
> >  	G(r, 4, v[0], v[ 5], v[10], v[15]); \
> >  	G(r, 5, v[1], v[ 6], v[11], v[12]); \
> >  	G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
> >  	G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
> >  } while (0)
> > -		ROUND(0);
> > -		ROUND(1);
> > -		ROUND(2);
> > -		ROUND(3);
> > -		ROUND(4);
> > -		ROUND(5);
> > -		ROUND(6);
> > -		ROUND(7);
> > -		ROUND(8);
> > -		ROUND(9);
> > -		ROUND(10);
> > -		ROUND(11);
> > +
> > +#ifdef CONFIG_64BIT
> > +		/*
> > +		 * Unroll the rounds loop to enable constant-folding of the
> > +		 * blake2b_sigma values.  Seems worthwhile on 64-bit kernels.
> > +		 * Not worthwhile on 32-bit kernels because the code size is
> > +		 * already so large there due to BLAKE2b using 64-bit words.
> > +		 */
> > +		unrolled_full
> > +#endif
> > +		for (int r = 0; r < 12; r++)
> > +			ROUND(r);
> >  
> >  #undef G
> >  #undef ROUND
> 
> Since you're now using `unrolled_full`, ROUND doesn't need to be a macro
> anymore. You can just do:
> 
>   unrolled_full
>   for (int r = 0; r < 12; r++) {
>     G(r, 0, v[0], v[ 4], v[ 8], v[12]);
>     G(r, 1, v[1], v[ 5], v[ 9], v[13]);
>     G(r, 2, v[2], v[ 6], v[10], v[14]);
>     G(r, 3, v[3], v[ 7], v[11], v[15]);
>     G(r, 4, v[0], v[ 5], v[10], v[15]);
>     G(r, 5, v[1], v[ 6], v[11], v[12]);
>     G(r, 6, v[2], v[ 7], v[ 8], v[13]);
>     G(r, 7, v[3], v[ 4], v[ 9], v[14]);
>   }
> 
> Likewise, you can simplify the blake2s implementation in the same way
> (but don't make the unrolled_full conditional there, obviously).
> `unrolled_full` seems like a nice way of doing this compared to macros.

Yes, good idea.  I'll do that.

- Eric