#34083 Add initial vectorized chacha20 implementation for 2-3x speedup
https://github.com/bitcoin/bitcoin/pull/34083 · · +434/-5 in 5 files, 3 commits · labels: none · draft
Goal
- Speed up ChaCha20 encryption to lower network thread CPU overhead under BIP324 transport
- Shorten compute-bound node synchronization phases by processing cipher blocks concurrently
This pull request implements a vectorized ChaCha20 cipher using compiler built-in vector extensions rather than hand-written assembly. It introduces 128-bit SIMD multi-block processing to compute multiple ChaCha20 states simultaneously across x86-64 and ARM64 architectures. The change yields a 2x to 3x throughput improvement on supported platforms while falling back to scalar code for non-vectorized environments.
Problem: ChaCha20 encryption accounts for up to 30% of the network thread's CPU time during BIP324 v2 P2P transport. Node operators on CPU-constrained or bandwidth-heavy nodes experience network thread bottlenecks during initial block download and peer relay.
Category: Utilities (logging, arguments, libraries) (#4 of 66)
P2 · speedup
- P2 because it yields a 2x to 3x speedup on a core crypto primitive without handwritten assembly
- ChaCha20 takes noticeable network CPU time in BIP324 and faster processing improves sync throughput
P2 because accelerating ChaCha20 by 2x-3x addresses a significant compute bottleneck on the network thread during BIP324 P2P processing. Profiling showed ChaCha20 consuming roughly 30% of net thread CPU, and benchmarks confirmed a measurable 3% speedup in overall IBD runtime. Furthermore, establishing the vector primitives unblocks subsequent AVX2/AVX512 and Poly1305 optimizations.
Membership: Modifies core cryptographic primitives under src/crypto/chacha20*.
Factors: security/stability 1, bug 0, performance 2, user value 1, leverage 1
Reviewability: Paused: Waiting on author
- Author needs to address requested changes regarding platform regressions and test coverage
l0rinc submitted a Changes Requested review on 2026-08-30 requesting unit tests, differential fuzzing updates, and commit cleanup. The author has not responded for 18 days.
Author status: silent since 2026-08-25 after pushing a 128-bit rework, pending response to 2026-08-30 review
Open concerns:
- Lack of unit test and differential fuzzing coverage across all target-specific multi-block dispatch sizes
- Minor performance regression (~7%) observed on 64-byte single-block inputs
- Code restructuring needed to separate generic vector helpers, endian conversions, and target dispatch logic
Resolved concerns:
- Initial implementation failed on big-endian architectures due to post-XOR byte swapping (fixed)
- Severe performance regression on ARM64 when compiled with GCC (resolved by switching from 256-bit to 128-bit vector layout)
Agreement: Blocked
- Broad support for ChaCha20 optimization gains
- Concept approval without stated reasons (jonatack)
- Verified performance improvements in local benchmarks (ajtowns)
- Unaddressed objection: benchmark regressions on low-power devices and missing tests (l0rinc)
Blocked: l0rinc requested changes regarding missing test coverage, 64-byte regression, and branch cleanup; author has not replied.
The concept and substantial performance improvements are well supported by ajtowns and jonatack, but l0rinc's latest Changes Requested review highlighting missing tests and regressions remains open without an author response.
- 2025-12-17 ajtowns: 'Approach looks very nice, and at least going by the bench results, gives a good improvement.'
- 2026-08-20 jonatack: 'Concept ACK, good work.'
- 2026-08-30 l0rinc: 'Corecheck currently has no coverage data for the new code... To be more confident in the correctness, I would like to see the new path covered by: tests... benchmarks... fuzz target...'
Objections:
| Reviewer | Kind | Harm | Status | Blocking | Author replied | Quote |
|---|---|---|---|---|---|---|
| l0rinc | correctness | ChaCha20 produced incorrect output on big-endian platforms | resolved | yes | yes | 2025-12-17: 'My biggest objection currently is that it's broken on big-endian systems - left a suggestion how to reproduce and fix it.' Settled: 2026-01-13: 'Also pushed @l0rinc's fix for big-endian.' |
| l0rinc | correctness | Untested multi-block dispatch states, a ~7% regression on 64-byte inputs, and potential IBD slowdown on some platforms | open | yes | no | 2026-08-30: 'Corecheck currently has no coverage data for the new code and measures the 64-byte case about 7% slower... To be more confident in the correctness, I would like to see the new path covered by: tests... benchmarks... differential fuzzer' |
| l0rinc | approach | 2x performance regression compared to scalar on ARM64 when compiled with GCC | resolved | yes | yes | 2026-05-04: 'RPi5 with GCC shows a regression: the generic vectorized implementation is ~2x slower than scalar on ARM64 with GCC, while Clang handles it fine.' Settled: 2026-08-18: 'The second introduces a pluggable vector interface, and adds a 128bit implementation. This works around gcc's vectorizer's limitations and should fix the performance regressions you pointed out.' |
| l0rinc | maintenance | circular include dependency between chacha20_vec and chacha20_vec_128impl breaks CI linting | open | yes | no | 2026-08-21: 'Note that the CI indicates a dependency-cycle regression was introduced here.' |
Support:
- ajtowns: Approach looks very nice, and at least going by the bench results, gives a good improvement.
- jonatack: Concept ACK, good work. [not substantive]
Participants: ajtowns (support), l0rinc (objection), sipa (neutral), maflcko (neutral), sedited (question), fanquake (neutral), jonatack (support)
State derived from the lists: blocking objection open with no author reply (l0rinc, l0rinc)
Review verdicts (DrahtBot): 0
- Concept ACK: jonatack
Dependencies
Enables:
- Runtime-detected AVX2 and AVX-512 ChaCha20 optimizations
- Vectorized Poly1305 MAC implementation
Files
File list not available for this run.
Card
PR 34083 introduces a portable vectorized ChaCha20 implementation using compiler built-in vector extensions across x86-64 and ARM64. It addresses high CPU overhead on the P2P network thread during BIP324 encrypted transport, where ChaCha20 accounts for up to 30% of execution time. Benchmarks demonstrate a 2x to 3x speedup in raw cipher throughput and a measurable wall-clock reduction in initial block download time. The concept is widely supported, but the PR is currently paused waiting on the author to resolve a blocking review from l0rinc concerning test coverage, 64-byte regressions, and commit structuring.