Skip to content

VAES+AVX2 optimized implementation of AES-GCM

Eric Biggers linux-crypto lkml 1 version Applied

Status from this message: Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest8 patches 11 repliesApplied

Patches in v1 Applied

#Subject and filesSizeRepliesApplied
1/8crypto: x86/aes-gcm - add VAES+AVX2 optimized codearch/x86/crypto/Makefile arch/x86/crypto/aes-gcm-vaes-avx2.S arch/x86/crypto/aesni-intel_glue.c+1260 -21 reply
2/8crypto: x86/aes-gcm - remove VAES+AVX10/256 optimized codearch/x86/crypto/aes-gcm-avx10-x86_64.S arch/x86/crypto/aesni-intel_glue.c+6 -590 replies
3/8crypto: x86/aes-gcm - rename avx10 and avx10_512 to avx512arch/x86/crypto/Makefile arch/x86/crypto/aes-gcm-aesni-x86_64.S arch/x86/crypto/aes-gcm-vaes-avx2.S +2 more+105 -1380 replies
4/8crypto: x86/aes-gcm - clean up AVX512 code to assume 512-bit vectorsarch/x86/crypto/aes-gcm-vaes-avx512.S+153 -2000 replies
5/8crypto: x86/aes-gcm - reorder AVX512 precompute and aad_update functionsarch/x86/crypto/aes-gcm-vaes-avx512.S+92 -950 replies
6/8crypto: x86/aes-gcm - revise some comments in AVX512 codearch/x86/crypto/aes-gcm-vaes-avx512.S+11 -160 replies
7/8crypto: x86/aes-gcm - optimize AVX512 precomputation of H^2 from H^1arch/x86/crypto/aes-gcm-vaes-avx512.S+14 -20 replies
8/8crypto: x86/aes-gcm - optimize long AAD processing with AVX512arch/x86/crypto/aes-gcm-vaes-avx512.S+99 -470 replies

Reviews trailers per patch

None of the 8 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchArd Biesheuvel
SeriesA-b T-b
1/8
2/8
3/8
4/8
5/8
6/8
7/8
8/8

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [PATCH 0/8] VAES+AVX2 optimized implementation of AES-GCM

This patchset replaces the 256-bit vector implementation of AES-GCM for x86_64 with one that requires AVX2 rather than AVX512. This greatly improves AES-GCM performance on CPUs that have VAES but not AVX512, for example by up to 74% on AMD Zen 3. For more details, see patch 1.

This patchset also renames the 512-bit vector implementation of AES-GCM for x86_64 to be named after AVX512 rather than AVX10/512, then adds some additional optimizations to it.

This patchset applies to next-20250929 and is targeting 6.19. Herbert, I'd prefer to just apply this myself. But let me know if you'd prefer to take it instead (considering that AES-GCM hasn't been librarified yet). Either way, there's no hurry, since this is targeting 6.19.

Eric Biggers (8):
crypto: x86/aes-gcm - add VAES+AVX2 optimized code
crypto: x86/aes-gcm - remove VAES+AVX10/256 optimized code
crypto: x86/aes-gcm - rename avx10 and avx10_512 to avx512
crypto: x86/aes-gcm - clean up AVX512 code to assume 512-bit vectors
crypto: x86/aes-gcm - reorder AVX512 precompute and aad_update
functions
crypto: x86/aes-gcm - revise some comments in AVX512 code
crypto: x86/aes-gcm - optimize AVX512 precomputation of H^2 from H^1
crypto: x86/aes-gcm - optimize long AAD processing with AVX512

 arch/x86/crypto/Makefile                      |    5 +-
 arch/x86/crypto/aes-gcm-aesni-x86_64.S        |   12 +-
 arch/x86/crypto/aes-gcm-vaes-avx2.S           | 1150 +++++++++++++++++
 ...m-avx10-x86_64.S => aes-gcm-vaes-avx512.S} |  722 +++++------
 arch/x86/crypto/aesni-intel_glue.c            |  264 ++--
 5 files changed, 1667 insertions(+), 486 deletions(-)
 create mode 100644 arch/x86/crypto/aes-gcm-vaes-avx2.S
 rename arch/x86/crypto/{aes-gcm-avx10-x86_64.S => aes-gcm-vaes-avx512.S} (69%)

base-commit: 3b9b1f8df454caa453c7fb07689064edb2eda90a

Signature · 1 line
2.51.0

Read the cover letter in its thread