# The Instructions Your CPU Has Been Waiting For

*Parrot Security now ships optimized package builds for modern processors. Here is what that means and how to take flight a little faster.*

---

## A quick story about wasted potential

The 64-bit processor in your laptop is a marvel. It can juggle 256-bit vectors, fuse a multiply and an add into a single clock cycle, shuffle bits with dedicated instructions, and decode a dozen operations in parallel before you've finished reading this sentence. For the most part, though, it has been pretending none of that exists.

When AMD shipped the first 64-bit x86 chip in 2003, it defined a baseline instruction set. Every `amd64` Linux package built since then, across virtually every distribution, has targeted that 2003 baseline so that a binary compiled today still runs on a machine from two decades ago. That is a reasonable default, but on modern hardware it is also a quiet tax. Your CPU ships with two decades of accumulated superpowers, and the software politely declines to use most of them. We decided to stop declining.

---

## What we built

Parrot Security now publishes **optimized package builds** that target modern CPU baselines instead of the ancient one. There are two flavours, one per architecture:

- **amd64v3**, for 64-bit Intel and AMD machines. It is built to use AVX, AVX2, FMA, and the BMI bit-manipulation instructions.
- **arm64v8.2**, for 64-bit ARM machines. It is built to use LSE atomics, the dot-product instructions, half-precision floating point, and hardware cryptography.

These builds do not replace your system. They live in **dedicated, opt-in repository components**. Turn them on and your package manager quietly starts preferring the optimized version of any package we've rebuilt, which includes compression libraries, cryptographic libraries, media tools, databases, and language runtimes, while everything else stays exactly as it was. Turn them off and you're back to stock, with no forks of the distribution and no conflicts with the standard repositories.

It's the same Parrot you know. It just stops leaving performance on the table.

---

## Why this is a bigger deal than it sounds

The main features of these instruction sets are **AVX2** on x86 and **the dot-product and FP16 extensions** on ARM, and their effect is measurable. AVX2 doubles the width of vector operations from 128 bits to 256 bits, meaning a single instruction chews through twice as much data. **FMA** (fused multiply-add) collapses two floating-point operations into one. On ARM, **LSE atomics** replace clumsy multi-instruction locking loops with single hardware atomic operations, which can make a large difference for anything doing concurrent work.

Where does this actually show up? In the places that matter to a security distribution:

- **Compression**: zstd, xz, brotli. Faster archives and faster package installs, since almost everything on the system squeezes bytes at some point.
- **Cryptography and hashing**: libsodium, libgcrypt, nettle, OpenSSL. This is the arithmetic behind encryption, signing, and integrity checking.
- **Media and forensics tooling**: ffmpeg, image libraries, OCR. Anything that processes pixels or audio at volume.
- **Databases and runtimes**: PostgreSQL, Redis, SQLite, Python, Ruby. The substrate your tools are built on.

For a penetration tester working through a large dataset or a forensic analyst carving images, these are the workloads where 256-bit vectors and fused arithmetic translate into real wall-clock time saved.

---

## Does your machine qualify?

Optimized builds require a CPU recent enough to understand the new instructions. The requirement is easy to meet on any recent machine, but it does exclude older hardware.

**For amd64v3**, you need an Intel **Haswell** (4th-generation Core, 2013) or newer, or an AMD **Excavator** (2015) or **Zen** (2017) or newer. Practically every machine built in the last decade qualifies. Machines that do not qualify include Sandy Bridge and Ivy Bridge (2011 and 2012), first-generation Core, and the old Atoms.

**For arm64v8.2**, you need an Apple **M1** or newer, a **Raspberry Pi 5**, an AWS **Graviton 2** or newer, a Snapdragon 845-class chip or newer, or any comparably modern ARM core. The Cortex-A72-class hardware in the Raspberry Pi 4 and the first Graviton does not qualify.

If you're not sure, don't guess. There is a one-line check in the documentation, and the optimized packages are designed to refuse installation on hardware that can't run them, so you won't brick anything by trying.

---

## Taking flight

Enabling the feature takes two steps: add the repository component for your architecture, then upgrade.

On a 64-bit Intel or AMD machine:

```
deb https://deb.parrot.sh/parrot echo amd64v3
```

On a 64-bit ARM machine:

```
deb https://deb.parrot.sh/parrot echo arm64v8.2
```

Then pull in the optimized packages:

```bash
sudo apt update && sudo apt full-upgrade
```

or, using Parrot's own helper:

```bash
sudo parrot-upgrade
```

You'll recognize the optimized packages on sight, because their version numbers carry a tell-tale suffix, `+amd64v3optimized1` or `+armv82optimized1`. When you see those scroll past during an upgrade, you'll know the new instructions are in the building.

---

## The honest part

We believe in shipping things that work, and in being candid about the edges.

This is **experimental**. We've curated the package list carefully and prioritized the libraries that the rest of the system leans on most, but we're still expanding coverage and still watching for rough edges. If something misbehaves, we want to hear about it.

We've deliberately left most packages alone. Network daemons, shells, and anything bottlenecked on disk or network gain nothing measurable from these instructions, and rebuilding them would burn build time for no benefit. The optimization is aimed where the arithmetic actually lives.

There was also a pleasant surprise along the way: because the components are clean and self-contained, **they also work on plain Debian**. We've been running them on stock Debian servers specifically to accelerate compression and cryptographic workloads, and the results have been encouraging enough that we're mentioning it here.

---

## Tell us what you find

If you've read this far and the words `-march=x86-64-v3` make your eyes light up rather than glaze over, you're exactly the person we want to hear from.

Give it a run on your real workloads and benchmark it. Tell us whether the package selection matches what you actually run, what we missed, what we shouldn't have touched, and what the numbers look like on your hardware. Real-world workloads teach us things that synthetic benchmarks never will.

Parrot has always been about giving capable people sharper tools. This is one more edge on the blade.

*Fly faster.* 🦜

Parrot Security now ships optimized package builds.

Optimized Package Builds