AES assembler implementation for x86_64
cover AES assembler implementation for x86_64
Implementation:
===============
The encrypt/decrypt code is based on an x86 implementation I did a while ago which I never published. This unpublished implementation does include an assembler based key schedule and precomputed tables. For simplicity and best acceptance, however, I took Gladman's in-kernel code for table generation and key schedule for the kernel port of my assembler code and modified this code to produce the key schedule as required by my assembler implementation. File locations and Kconfig are kept similar to the i586 AES assembler implementation.
It may seem a little bit strange to use 32 bit I/O and registers in the assembler implementation but this gives the best code size. My implementation takes one instruction more per round compared to Gladman's x86 assembler but it doesn't require any stack for local variables or saved registers and it is less serialized than Gladman's x86 code.
Note that all comparisons to Gladman's code were done after my code was implemented. I did only use FIPS PUB 197 for the implementation so my implementation is independent work.
If anybody has a better assembler solution for x86_64 I'll be pleased to have my code replaced with the better solution.
Testing:
========
The implementation passes the in-kernel crypto testing module and I'm running it without any problems on my laptop where it is mainly used for dm-crypt.
Microbenchmark:
===============
The microbenchmark was done in userspace with similar compile flags as used during kernel compile.
Encrypt/decrypt is about 35% faster than the generic C implementation. As the generic C as well as my assembler implementation are both table driven I don't really expect that there is much room for further improvements though I'll be glad to be corrected here.
The key schedule is about 5% slower than the generic C implementation. This is due to the fact that some more work has to be done in the key schedule routine to fit the schedule to the assembler implementation.
Code Size:
==========
Encrypt and decrypt are together about 2.1 Kbytes smaller than the generic C implementation which is important with regard to L1 cache usage. The key schedule routine is about 100 bytes larger than the generic C implementation.
Data Size:
==========
There's no difference in data size requirements between the assembler implementation and the generic C implementation.
License:
========
Gladmans's code is dual BSD/GPL whereas my assembler code is GPLv2 only (I'm not going to change the license for my code). So I had to change the module license for the x86_64 aes module from 'Dual BSD/GPL' to 'GPL' to reflect the most restrictive license within the module.
PS: It can happen that it may take a while until I can reply as I'm regularly offline due to my current daytime job requirements.
Signature · 1 line
Andreas Steinmetz SPAMmers use [email protected]
Please cc Herbert Xu on kernel crypto patches, he's the frontline maintainer of it now.
- James
Signature · 2 lines
James Morris <[email protected]>
Quoted 3 lines · James Morris
Please cc Herbert Xu on kernel crypto patches, he's the frontline maintainer of it now.
Care to sign off this patch (or create a similar one)?
Jörn
Signature · 23 lines
The strong give up and move away, while the weak give up and stay. -- unknown Signed-off-by: Jörn Engel <[email protected]> --- MAINTAINERS | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- linux-2.6.11cow/MAINTAINERS~crypto_maintainer 2005-03-04 11:39:53.000000000 +0100 +++ linux-2.6.11cow/MAINTAINERS 2005-04-18 10:43:40.963766936 +0200 @@ -596,8 +596,8 @@ W: http://developer.axis.com S: Maintained CRYPTO API -P: James Morris -M: [email protected] +P: Herbert Xu +M: [email protected] P: David S. Miller M: [email protected] W http://samba.org/~jamesm/crypto/
Quoted 8 lines
Microbenchmark:
===============
The microbenchmark was done in userspace with similar compile flags as used during kernel compile.
Encrypt/decrypt is about 35% faster than the generic C implementation. As the generic C as well as my assembler implementation are both table driven I don't really expect that there is much room for further improvements though I'll be glad to be corrected here.
On what CPUs did you benchmark? I suppose results will vary a lot between AMD and Intel x86-64 CPUs.
-Andi
Quoted 5 lines · James Morris
Please cc Herbert Xu on kernel crypto patches, he's the frontline maintainer of it now.
- James
Already done on request by Herbert Xu himself.
Signature · 1 line
Andreas Steinmetz SPAMmers use [email protected]
Quoted 2 lines · Andi Kleen
On what CPUs did you benchmark? I suppose results will vary a lot between AMD and Intel x86-64 CPUs.
AMD. I don't have any Intel around.
Signature · 1 line
Andreas Steinmetz SPAMmers use [email protected]
Quoted 7 lines · Jörn Engel
Quoted 2 lines · James Morris
Please cc Herbert Xu on kernel crypto patches, he's the frontline maintainer of it now.
Care to sign off this patch (or create a similar one)?
No problem, will do after the review by Herbert Xu is done (I guess there will be some changes required).
Signature · 1 line
Andreas Steinmetz SPAMmers use [email protected]
Quoted 6 lines · Jörn Engel
Quoted 3 lines · James Morris
Please cc Herbert Xu on kernel crypto patches, he's the frontline maintainer of it now.
Care to sign off this patch (or create a similar one)?
No, it's already been done in Linus' kernel weeks ago.
- James
Signature · 2 lines
James Morris <[email protected]>
Quoted 5 lines · Andreas Steinmetz
Implementation:
===============
The encrypt/decrypt code is based on an x86 implementation I did a while ago which I never published. This unpublished implementation does include an assembler based key schedule and precomputed tables.
Nice work! Especially because I'm planing to get one of these x86_64 babies soon ;)
Quoted 2 lines
If anybody has a better assembler solution for
x86_64I'll be pleased to have my code replaced with the better solution.
Jari Ruusu has a x86_64 implementation in his loop-AES package. It is also based on Gladman's code.
http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2 aes-amd64.S
Quoted 4 lines
Microbenchmark:
===============
The microbenchmark was done in userspace with similar compile flags as used during kernel compile.
You might want to compare it to the one above.
Regards,
Signature · 2 lines
Fruhwirth Clemens - http://clemens.endorphin.org for robots: [email protected]
Quoted 4 lines · Fruhwirth Clemens
Quoted 2 lines
If anybody has a better assembler solution for
x86_64I'll be pleased to have my code replaced with the better solution.http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2
aes-amd64.S
Jari's code cannot be included in the kernel.
- James
Signature · 2 lines
James Morris <[email protected]>