linux-kernel - aes-x86_64 seems slower than the generic implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2046035.alMyLlD0ki@al>
Date:	Sat, 19 Apr 2014 16:42:07 +0200
From:	Peter Wu <peter@...ensteyn.nl>
To:	linux-crypto@...r.kernel.org
Cc:	Herbert Xu <herbert@...dor.apana.org.au>,
	"David S. Miller" <davem@...emloft.net>,
	linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...e.hu>, Andreas Steinmetz <ast@...dv.de>
Subject: aes-x86_64 seems slower than the generic implementation

Hi!

When comparing the x86_64 assembly implementation (module aes-x86_64) against 
the generic AES implementation, I found that the generic implementation was 
consistenly faster.

Test setup #1:

 * cryptsetup 1.6.4
 * Linux v3.15-rc1-356-gebfc45e,
   https://github.com/Lekensteyn/aur/blob/1d1950/linux-custom/config
 * CPU: Intel i5-460M
 * Distro: Arch Linux x86_64

Command:

   for i in {0..10};do cryptsetup benchmark --cipher aes-xts; done

Test results for n=11, mean (+ standard deviation), enc/dec:

 * aes-x86_64:  139.6 (0.68) / 138.5 (0.22)
 * aes-generic: 144.8 (0.63) / 144.6 (0.31)


About a month ago, I conducted a similar test on a different machine[1].

 * cryptsetup 1.6.4
 * QEMU: 1.7.0
 * Linux (guest, no modules): v3.14-rc7-59-g08edb33
 * Linux (host): v3.14-rc5
 * CPU: Intel i7-3770

Test results comparing aes-generic, aes-x86_64 and AESNI (n=3):

                   generic     x86_64      aesni
 * aes-cbc-128     201/276     200/280     669/2500
 * aes-cbc-256     162/205     159/208     492/1835
 * aes-xts-256     275/270     272/276     2050/2034
   (note, AES-NI performance varies a lot)

Aren't the assembly implementations supposed to be faster?

Kind regards,
Peter
 
 [1]: https://lekensteyn.nl/files/linux-crypto-benchmark/

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/