Linux 5.12 Crypto Brings AES-NI Acceleration For CTS, Faster XTS With Retpolines
This time around there are a few notable crypto updates with this kernel. For systems relying on return trampolines "Retpolines" as part of their Spectre Variant 2 mitigations, Linux 5.12 will offer much faster AES-NI XTS crypto performance. Since Retpolines were added back in 2018, the Retpolines behavior ended up heavily regressing the AES-NI XTS performance that went unnoticed until recently. As a result reworking that kernel code is now yielding a very significant speedup for Retpoline-enabled AMD/Intel systems for hardware needing Retpolines.
Also notable on the AES-NI front with Linux 5.12 is CTS acceleration support. That support by Ard Biesheuvel is summed up with the patch message, "Follow the same approach as the arm64 driver for implementing a version of AES-NI in CBC mode that supports ciphertext stealing. Compared to the generic CTS template wrapped around the existing cbc-aes-aesni skcipher, this results in a ~2x speed increase for relatively short inputs (less than 256 bytes), which is relevant given that AES-CBC with ciphertext stealing is used for filename encryption in the fscrypt layer. For larger inputs, the speedup is still significant (~25% on decryption, ~6% on encryption)."
Meanwhile the x86 acceleration for some uncommon algorithms have been removed. ARM meanwhile is seeing BLAKE2s and BLAKE2b acceleration added. New crypto drivers include the Intel Keem Bay OCS HCU driver and the Marvell Octeon TX2 CPT PF driver.
The full list of crypto patches for this cycle can be found via the kernel mailing list.
Add A Comment
