Re: [PATCH] lib/crypto: x86/chacha: Add a 16-block AVX-512 variant

Hi Eric,

> This is very similar to the existing chacha_8block_xor_avx512vl(), just
> with 512-bit vectors instead of 256-bit.  They even use the same CPU
> instruction set extensions: there are actually no cases where a CPU can
> run chacha_8block_xor_avx512vl() but not chacha_16block_xor_avx512()
> (the choice of vector length is just going to be made by policy).
> 
> Given that, could we consolidate these implementations?

Yes, it is doable, but with some constraints:

 * In the 512-bit version, adding the initial state to the result uses
   a small optimization with re-broadcasting, so it differs from the
   256-bit variant. That optimization can be applied to the 256-bit
   version for a unification, but would mean a change to it.
 * The larger part of the interleaving tail is different and will
   require separate code paths.

So the net win is shared broadcasting/doubleround at the cost of some
macro complexity. I'll give it a try.

> Well, this is one of the cases where
> cpu_has_xfeatures(XFEATURE_MASK_AVX512) was already required by the
> existing code (since all AVX512 bits need to be enabled for any EVEX
> coded instructions to work, even on xmm/ymm).  But it was never checked,
> and no one ever noticed.  I would just continue to leave it out.
> 
> You can also drop the check of X86_FEATURE_AVX512F, which is implied by
> X86_FEATURE_AVX512VL and X86_FEATURE_AVX512BW already.

Ok, will do so.

Thanks!
Martin