[picnixz]

The vectorized BLAKE-2 implementations were only enabled on some x86-64 platforms and caused build failures on many others. _blake2 and _hmac now always use the portable HACL* implementations.

The SIMD sources are no longer vendored; their headers are kept since Hacl_Streaming_HMAC.c includes them unconditionally.

---

I haven't run benchmarks yet because I don't have access to a Linux machine with AVX support. But here is what I would expect those interested to do:

# 0. Prerequisites: gh, uv, a C toolchain and CPython's build dependencies
grep -o -w 'sse4_2\|avx2' /proc/cpuinfo | sort -u   # both should be listed

# 1. Clone and fetch the PR as a local branch
gh repo clone python/cpython cpython -- --filter=blob:none
cd cpython
gh pr checkout https://github.com/python/cpython/pull/160392 --branch blake2-nosimd
git switch main

# 2. One worktree per side, on the same base commit
BASE=$(git merge-base main blake2-nosimd)
git worktree add --detach /tmp/cpython-simd "$BASE"
git worktree add /tmp/cpython-nosimd blake2-nosimd

# 3. Release builds with identical flags
mkdir -p /tmp/build-simd /tmp/build-nosimd
(cd /tmp/build-simd && /tmp/cpython-simd/configure && make -j"$(nproc)")
(cd /tmp/build-nosimd && /tmp/cpython-nosimd/configure && make -j"$(nproc)")

# 4. Only build-simd should contain SIMD code
for b in /tmp/build-simd /tmp/build-nosimd; do
    echo "== $b"
    grep _Py_HACL_CAN_COMPILE_VEC $b/pyconfig.h
    nm $b/build/lib.*/_blake2*.so | grep -c Simd
done

# 5. Benchmark, with pyperf from uvx made importable by both builds
SITE=$(uvx --from pyperf python -c 'import pathlib, pyperf; print(pathlib.Path(pyperf.__file__).parent.parent)')
bench() {
    PYTHONPATH="$SITE" uvx pyperf timeit --python="$1" \
        --inherit-environ PYTHONPATH \
        --append "$2" --name "$3-$4" \
        -s "import hashlib, os; d = os.urandom($4)" "hashlib.$3(d)"
}
for algo in blake2b blake2s; do
    for size in 64 65536 16777216; do
        bench /tmp/build-simd/python simd.json $algo $size
        bench /tmp/build-nosimd/python nosimd.json $algo $size
    done
done
uvx pyperf compare_to simd.json nosimd.json --table

# 6. Cleanup, from inside the git clone
git worktree remove /tmp/cpython-simd
git worktree remove /tmp/cpython-nosimd
rm -rf /tmp/build-simd /tmp/build-nosimd

• Issue: Remove SIMD support for BLAKE-2 and HMAC-BLAKE-2 #160333

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #35339534 | 📁 Comparing b42ec65 against main (03cb1ad)

  🔍 Preview build  

3 files changed

± using/windows.html
± whatsnew/3.16.html
± whatsnew/changelog.html

[picnixz]

!buildbot FIPS

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @picnixz for commit b42ec65 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F160392%2Fmerge

The command will test the builders whose names match following regular expression: FIPS

The builders matched are:

• AMD64 CentOS10 FIPS No Builtin Hashes PR
• AMD64 CentOS9 FIPS Only Blake2 Builtin Hash PR
• AMD64 CentOS10 FIPS Only Blake2 Builtin Hash PR
• AMD64 CentOS9 FIPS No Builtin Hashes PR

[picnixz]

Currently, benchmarks on a non-emulated Linux (but still using WSL) shows that SIMD doesn't give any real difference (+-10% boost depending on the size of the buffer). I believe that the SIMD performance boost only comes when you use tree hashing. But the latter is hardly used and users should really rely on BLAKE3 instead (please). I will confirm those numbers later but for now I think I'm going to remove the SIMD support. It made much more sense (and was much more easier to maintain) when we had our own sources but with vendored sources, it's a bit more tricky.