Language Selection

English French German Italian Portuguese Spanish

AES-NI XTS Crypto Performance Looking Good For AMD With Linux 5.12 Fix

Filed under

Of the performance-related changes with Linux 5.12 worth noting is faster AES-NI XTS performance for systems relying upon return trampolines "Retpolines" as part of the CPU's Spectre V2 mitigations. On the Intel side this primarily impacts older CPUs where Retpolines is still used while on the AMD side through Zen 3 the Retpolines is still relied upon, which as shown by these benchmarks is now much better off for AMD Ryzen AES XTS performance as measured by Cryptsetup.

As reported last year, AES-NI regressed heavily under Retpolines and seemingly went unnoticed for the better part of three years. Now with Linux 5.12 the AES-NI kernel module code has been reworked so it doesn't face such overhead in Retpolines-enabled environments and in turn really helps out with performance.

I previously ran some benchmarks while now for getting an idea as to the impact with Linux 5.12 mainline, I carried out some fresh cryptsetup benchmarks with two AMD systems of Linux 5.11 stable versus Linux 5.12 Git at the end of the merge window.

Read more

Linux 5.12 Mostly Restores Long-Horrid AES-XTS Performance...

  • Linux 5.12 Mostly Restores Long-Horrid AES-XTS Performance Introduced By CPU-Bug Mitigations

    AES-NI XTS hardware encryption and decryption performance on Linux has been severely crippled since the Spectre V2 mitigations were introduced to the Linux kernel nearly two years ago. Linux 5.12 has fixes that mostly restores AES-NI XTS performance on the AMD side and those changes slightly increase aex-xts performance on the Intel side.


    There is a pretty big difference between 2685.7 MiB/s and 1578.9 MiB/s, yet the lack of a practical effect is probably why this has gone unnoticed for so long. A SATA3 interface caps out at 600 MiB/s so it doesn't really matter if a full-disk encrypted machine can do hardware accelerated AES-XTS at 601 or 5000 MiB if the disk drive is connected to a SATA interface. It does make a difference if the machine has a bleeding edge high-end NVMe drive, which is likely why this was performance-regression was discovered and fixed. Linux 5.12rc1 performs a whole lot better than previous kernels did when Spectre V2 mitigations are enabled on AMD machines. The difference between the kernels default mitigations and mitigations=off is barely noticeable. That's a huge improvement mostly thanks to the hard work of Google-asset Ard Biesheuvel

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

today's leftovers

  • What is Raspberry Pi 4 “Model B”? [Ed: I'm still waiting for them to formally apologise for going behind customers' backs, making secret deals with Microsoft to put Microsoft malware on all those devices]

    Raspberry Pi has conquered the world of SoC (System on a Chip). It has already garnered millions of followers since its release in 2012. Not only is it inexpensive, but it’s also versatile, modular, and multi-purpose. It has become popular not only as a credit-sized computer board but also as a controller in electronic, robotics, and IoT projects. The size, features, and price drive the popularity of the Pi, especially in the DIY community. To keep up with the current technological trends, the tiny board has undergone plenty of upgrades over the years, and there have been many varieties so it can cater to the needs and demands of its users. In 2019, the Raspberry Pi Foundation released the fourth generation of the multi-purpose board, the Raspberry Pi 4 B. It is the most powerful Pi to date, sporting huge upgrades from its predecessors. The compact board is touted to deliver a PC-level performance, and it didn’t disappoint.

  • Kentaro Hayashi: Grow your ideas for Debian Project

    There may be some "If it could be ..." ideas for Debian Project. If idea is concreate and worth to make things forward, it should make a proposal for Project Funding. [...] I'm not confident whether mechanism works, but Debian needs change.

  • Sam Thursfield: Calliope, slowly building steam

    There are some interesting complexities to this, and in 12 hours of hacking I didn’t solve them all. Firstly, Bandcamp artist and album names are not normalized. Some artist names have spurious “The”, some album names have “(EP)” or “(single)” appended, so they don’t match your tags. These details are of interest only to librarians, but how can software tell the difference? The simplest approach is use Musicbrainz, specifically cpe musicbrainz resolve-ids. By comparing ids where possible we get mostly good results. There are many albums not on Musicbrainz, though, which for now turn up as false positives. Resolving Musicbrainz IDs is a tricky process, too — how do we distinguish Multi-Love (album) from Multi-Love (single) if we only have an album name? If you want to try it out, great! It’s still aimed at hackers — you’ll have to install from source with Meson and probably fix some bugs along the way. Please share the fixes!

  • Neovide Is A Graphical Neovim Client Written In Rust

    Neovide is a really cool GUI client for Neovim. Although it essentially functions like Neovim in the terminal, Neovide does add some nice graphical improvements such as cursor animations and smooth scrolling. It even has me thinking about making it my new "vim" alias.

Linux 5.11.13, 5.10.29, 5.4.111, 4.19.186, 4.14.230, 4.9.266, and 4.4.266

Get involved with Mageia, become a Packager

With Mageia 8 just released and development for Mageia 9 getting underway in Cauldron, the unstable branch of Mageia, now is a great time to get involved with packaging. We are starting to look at the features that we want to include for Mageia 9, and as it is so early in the development cycle, now is the time for major developments, or big updates to key pieces of software. This is a great time to join the project as you can propose features you would like to see, help to implement large changes or see how a distribution evolves through development, stabilisation and then is released. If there is an application that you are interested in, if you want to help maintain part of the distribution, or if you want to learn something new, there are many opportunities to do so with the packaging team. Read more

Google does not want you to tell your players about your donation page

I recently updated Pixel Wheels banner image on Google Play. That triggered a review of the game: shortly after the update I received a message telling me Pixel Wheels was "not compliant with Google Play Policies". What nefarious activity does the game engage in? Sneak on users? Mine bitcoins? [...] Meanwhile you can still get the game from F-Droid or, since they do not have a problem with a link to a donation page. Read more