[RFC][PATCH 0/4] AES assembler implementation for x86_64

[RFC][PATCH 0/4] AES assembler implementation for x86_64

[Andreas Steinmetz]

Implementation:
===============
The encrypt/decrypt code is based on an x86 implementation I did a while
ago which I never published. This unpublished implementation does
include an assembler based key schedule and precomputed tables. For
simplicity and best acceptance, however, I took Gladman's in-kernel code
for table generation and key schedule for the kernel port of my
assembler code and modified this code to produce the key schedule as
required by my assembler implementation. File locations and Kconfig are
kept similar to the i586 AES assembler implementation.
It may seem a little bit strange to use 32 bit I/O and registers in the
assembler implementation but this gives the best code size. My
implementation takes one instruction more per round compared to
Gladman's x86 assembler but it doesn't require any stack for local
variables or saved registers and it is less serialized than Gladman's
x86 code.
Note that all comparisons to Gladman's code were done after my code was
implemented. I did only use FIPS PUB 197 for the implementation so my
implementation is independent work.
If anybody has a better assembler solution for x86_64 I'll be pleased to
have my code replaced with the better solution.

Testing:
========
The implementation passes the in-kernel crypto testing module and I'm
running it without any problems on my laptop where it is mainly used for
dm-crypt.

Microbenchmark:
===============
The microbenchmark was done in userspace with similar compile flags as
used during kernel compile.
Encrypt/decrypt is about 35% faster than the generic C implementation.
As the generic C as well as my assembler implementation are both table
driven I don't really expect that there is much room for further
improvements though I'll be glad to be corrected here.
The key schedule is about 5% slower than the generic C implementation.
This is due to the fact that some more work has to be done in the key
schedule routine to fit the schedule to the assembler implementation.

Code Size:
==========
Encrypt and decrypt are together about 2.1 Kbytes smaller than the
generic C implementation which is important with regard to L1 cache
usage. The key schedule routine is about 100 bytes larger than the
generic C implementation.

Data Size:
==========
There's no difference in data size requirements between the assembler
implementation and the generic C implementation.

License:
========
Gladmans's code is dual BSD/GPL whereas my assembler code is GPLv2 only
(I'm  not going to change the license for my code). So I had to change
the module license for the x86_64 aes module from 'Dual BSD/GPL' to
'GPL' to reflect the most restrictive license within the module.

PS: It can happen that it may take a while until I can reply as I'm
regularly offline due to my current daytime job requirements.
-- 
Andreas Steinmetz                       SPAMmers use robotrap@domdv.de

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[James Morris]

Please cc Herbert Xu on kernel crypto patches, he's the frontline 
maintainer of it now.


- James
-- 
James Morris
<jmorris@redhat.com>

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Jörn Engel]

On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
>
> Please cc Herbert Xu on kernel crypto patches, he's the frontline 
> maintainer of it now.

Care to sign off this patch (or create a similar one)?

Jörn

-- 
The strong give up and move away, while the weak give up and stay.
-- unknown


Signed-off-by: Jörn Engel <joern@wohnheim.fh-wedel.de>
---

 MAINTAINERS |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.11cow/MAINTAINERS~crypto_maintainer	2005-03-04 11:39:53.000000000 +0100
+++ linux-2.6.11cow/MAINTAINERS	2005-04-18 10:43:40.963766936 +0200
@@ -596,8 +596,8 @@ W:	http://developer.axis.com
 S:	Maintained
 
 CRYPTO API
-P:	James Morris
-M:	jmorris@redhat.com
+P:	Herbert Xu
+M:	herbert@gondor.apana.org.au
 P:	David S. Miller
 M:	davem@davemloft.net
 W	http://samba.org/~jamesm/crypto/

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Andi Kleen]

> Microbenchmark:
> ===============
> The microbenchmark was done in userspace with similar compile flags as
> used during kernel compile.
> Encrypt/decrypt is about 35% faster than the generic C implementation.
> As the generic C as well as my assembler implementation are both table
> driven I don't really expect that there is much room for further
> improvements though I'll be glad to be corrected here.

On what CPUs did you benchmark? I suppose results will vary a lot
between AMD and Intel x86-64 CPUs.

-Andi

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Andreas Steinmetz]

James Morris wrote:
> Please cc Herbert Xu on kernel crypto patches, he's the frontline 
> maintainer of it now.
> 
> 
> - James

Already done on request by Herbert Xu himself.

-- 
Andreas Steinmetz                       SPAMmers use robotrap@domdv.de

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Andreas Steinmetz]

Andi Kleen wrote:
> On what CPUs did you benchmark? I suppose results will vary a lot
> between AMD and Intel x86-64 CPUs.

AMD. I don't have any Intel around.

-- 
Andreas Steinmetz                       SPAMmers use robotrap@domdv.de

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Andreas Steinmetz]

Jörn Engel wrote:
> On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
> 
>>Please cc Herbert Xu on kernel crypto patches, he's the frontline 
>>maintainer of it now.
> 
> 
> Care to sign off this patch (or create a similar one)?

No problem, will do after the review by Herbert Xu is done (I guess
there will be some changes required).

-- 
Andreas Steinmetz                       SPAMmers use robotrap@domdv.de

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[James Morris]

On Mon, 18 Apr 2005, Jörn Engel wrote:

> On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
> >
> > Please cc Herbert Xu on kernel crypto patches, he's the frontline 
> > maintainer of it now.
> 
> Care to sign off this patch (or create a similar one)?

No, it's already been done in Linus' kernel weeks ago.


- James
-- 
James Morris
<jmorris@redhat.com>

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[Fruhwirth Clemens]

[-- Attachment #1: Type: text/plain, Size: 1001 bytes --]

On Sun, 2005-04-17 at 21:19 +0200, Andreas Steinmetz wrote:
> Implementation:
> ===============
> The encrypt/decrypt code is based on an x86 implementation I did a while
> ago which I never published. This unpublished implementation does
> include an assembler based key schedule and precomputed tables. 

Nice work! Especially because I'm planing to get one of these x86_64
babies soon ;)

> If anybody has a better assembler solution for x86_64 I'll be pleased to
> have my code replaced with the better solution.

Jari Ruusu has a x86_64 implementation in his loop-AES package. It is
also based on Gladman's code.
http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2 aes-amd64.S

> Microbenchmark:
> ===============
> The microbenchmark was done in userspace with similar compile flags as
> used during kernel compile.

You might want to compare it to the one above.

Regards,
-- 
Fruhwirth Clemens - http://clemens.endorphin.org 
for robots: sp4mtrap@endorphin.org

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC][PATCH 0/4] AES assembler implementation for x86_64

[James Morris]

On Thu, 28 Apr 2005, Fruhwirth Clemens wrote:

> > If anybody has a better assembler solution for x86_64 I'll be pleased to
> > have my code replaced with the better solution.
> 
> http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2 aes-amd64.S

Jari's code cannot be included in the kernel.


- James
-- 
James Morris
<jmorris@redhat.com>