As we're doing in the BLAKE2b code, use unrolled_full to make the
compiler handle the loop unrolling.  This simplifies the code slightly.
The generated object code is nearly the same with both gcc and clang.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
index 6182c21ed943..71578a084742 100644
--- a/lib/crypto/blake2s.c
+++ b/lib/crypto/blake2s.c
@@ -12,10 +12,11 @@
 #include <linux/bug.h>
 #include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/string.h>
+#include <linux/unroll.h>
 #include <linux/types.h>
 
 static const u8 blake2s_sigma[10][16] = {
 	{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
 	{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
@@ -69,33 +70,26 @@ blake2s_compress_generic(struct blake2s_ctx *ctx,
 	d = ror32(d ^ a, 8); \
 	c += d; \
 	b = ror32(b ^ c, 7); \
 } while (0)
 
-#define ROUND(r) do { \
-	G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
-	G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
-	G(r, 2, v[2], v[ 6], v[10], v[14]); \
-	G(r, 3, v[3], v[ 7], v[11], v[15]); \
-	G(r, 4, v[0], v[ 5], v[10], v[15]); \
-	G(r, 5, v[1], v[ 6], v[11], v[12]); \
-	G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
-	G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
-} while (0)
-		ROUND(0);
-		ROUND(1);
-		ROUND(2);
-		ROUND(3);
-		ROUND(4);
-		ROUND(5);
-		ROUND(6);
-		ROUND(7);
-		ROUND(8);
-		ROUND(9);
-
+		/*
+		 * Unroll the rounds loop to enable constant-folding of the
+		 * blake2s_sigma values.
+		 */
+		unrolled_full
+		for (int r = 0; r < 10; r++) {
+			G(r, 0, v[0], v[4], v[8], v[12]);
+			G(r, 1, v[1], v[5], v[9], v[13]);
+			G(r, 2, v[2], v[6], v[10], v[14]);
+			G(r, 3, v[3], v[7], v[11], v[15]);
+			G(r, 4, v[0], v[5], v[10], v[15]);
+			G(r, 5, v[1], v[6], v[11], v[12]);
+			G(r, 6, v[2], v[7], v[8], v[13]);
+			G(r, 7, v[3], v[4], v[9], v[14]);
+		}
 #undef G
-#undef ROUND
 
 		for (i = 0; i < 8; ++i)
 			ctx->h[i] ^= v[i] ^ v[i + 8];
 
 		data += BLAKE2S_BLOCK_SIZE;

base-commit: 43dfc13ca972988e620a6edb72956981b75ab6b0
-- 
2.52.0

On Thu, Dec 04, 2025 at 09:11:55PM -0800, Eric Biggers wrote:
> As we're doing in the BLAKE2b code, use unrolled_full to make the
> compiler handle the loop unrolling.  This simplifies the code slightly.
> The generated object code is nearly the same with both gcc and clang.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
>  1 file changed, 16 insertions(+), 22 deletions(-)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes

- Eric

On Fri, 5 Dec 2025 at 06:15, Eric Biggers <ebiggers@kernel.org> wrote:
>
> As we're doing in the BLAKE2b code, use unrolled_full to make the
> compiler handle the loop unrolling.  This simplifies the code slightly.
> The generated object code is nearly the same with both gcc and clang.
>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/blake2s.c | 38 ++++++++++++++++----------------------
>  1 file changed, 16 insertions(+), 22 deletions(-)
>

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

> diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
> index 6182c21ed943..71578a084742 100644
> --- a/lib/crypto/blake2s.c
> +++ b/lib/crypto/blake2s.c
> @@ -12,10 +12,11 @@
>  #include <linux/bug.h>
>  #include <linux/export.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
>  #include <linux/string.h>
> +#include <linux/unroll.h>
>  #include <linux/types.h>
>
>  static const u8 blake2s_sigma[10][16] = {
>         { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
>         { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
> @@ -69,33 +70,26 @@ blake2s_compress_generic(struct blake2s_ctx *ctx,
>         d = ror32(d ^ a, 8); \
>         c += d; \
>         b = ror32(b ^ c, 7); \
>  } while (0)
>
> -#define ROUND(r) do { \
> -       G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
> -       G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
> -       G(r, 2, v[2], v[ 6], v[10], v[14]); \
> -       G(r, 3, v[3], v[ 7], v[11], v[15]); \
> -       G(r, 4, v[0], v[ 5], v[10], v[15]); \
> -       G(r, 5, v[1], v[ 6], v[11], v[12]); \
> -       G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
> -       G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
> -} while (0)
> -               ROUND(0);
> -               ROUND(1);
> -               ROUND(2);
> -               ROUND(3);
> -               ROUND(4);
> -               ROUND(5);
> -               ROUND(6);
> -               ROUND(7);
> -               ROUND(8);
> -               ROUND(9);
> -
> +               /*
> +                * Unroll the rounds loop to enable constant-folding of the
> +                * blake2s_sigma values.
> +                */
> +               unrolled_full
> +               for (int r = 0; r < 10; r++) {
> +                       G(r, 0, v[0], v[4], v[8], v[12]);
> +                       G(r, 1, v[1], v[5], v[9], v[13]);
> +                       G(r, 2, v[2], v[6], v[10], v[14]);
> +                       G(r, 3, v[3], v[7], v[11], v[15]);
> +                       G(r, 4, v[0], v[5], v[10], v[15]);
> +                       G(r, 5, v[1], v[6], v[11], v[12]);
> +                       G(r, 6, v[2], v[7], v[8], v[13]);
> +                       G(r, 7, v[3], v[4], v[9], v[14]);
> +               }
>  #undef G
> -#undef ROUND
>
>                 for (i = 0; i < 8; ++i)
>                         ctx->h[i] ^= v[i] ^ v[i + 8];
>
>                 data += BLAKE2S_BLOCK_SIZE;
>
> base-commit: 43dfc13ca972988e620a6edb72956981b75ab6b0
> --
> 2.52.0
>