Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

[david laight]

On Fri, 5 Dec 2025 12:14:11 -0800
Eric Biggers <ebiggers@xxxxxxxxxx> wrote:

> On Fri, Dec 05, 2025 at 02:16:44PM +0000, david laight wrote:
> > Note that executing two G() in parallel probably requires the source
> > interleave the instructions for the two G() rather than relying on the
> > cpu's 'out of order execution' to do all the work
> > (Intel cpu might manage it...).  
> 
> I actually tried that earlier, and it didn't help.  Either the compiler
> interleaved the calculations already, or the CPU did, or both.

Or they are never interleaved and doing that didn't help.

> It definitely could use some more investigation to better understand
> exactly what is going on, though.
> 
> You're welcome to take a closer look, if you're interested.

I might try calling the code from my 'clock counting' wrapper.
That is good enough to see the data dependency of a 'div' instruction
and the effect of branch misses due to taking a different path from
the previous call (about 20 clocks on a zen-5).

Did you notice that 'u64 t[2];' is a 128bit 'byte counter' for the
buffer being processed!
I doubt 32bit needs that many bits :-)

	David

> 
> - Eric
>