AES-GCM slower than BoringSSL on Zen3

[sticnarf]

Problem:

Environment: EC2 c6a.large
AWS-LC version: 652f7a9
BoringSSL version: google/boringssl@7c25e73

Run the benchmark suite of AWS-LC.

AWS-LC result:

Did 88351000 AEAD-AES-128-GCM seal init operations in 10000023us (8835079.7 ops/sec)
Did 96643500 AEAD-AES-128-GCM seal (16 bytes) operations in 10000012us (9664338.4 ops/sec): 154.6 MB/s
Did 62820000 AEAD-AES-128-GCM seal (256 bytes) operations in 10000136us (6281914.6 ops/sec): 1608.2 MB/s
Did 24766500 AEAD-AES-128-GCM seal (1350 bytes) operations in 10000051us (2476637.4 ops/sec): 3343.5 MB/s
Did 5502000 AEAD-AES-128-GCM seal (8192 bytes) operations in 10000284us (550184.4 ops/sec): 4507.1 MB/s
Did 2844000 AEAD-AES-128-GCM seal (16384 bytes) operations in 10002055us (284341.6 ops/sec): 4658.7 MB/s
Did 88406750 AEAD-AES-128-GCM open init operations in 10000024us (8840653.8 ops/sec)
Did 91620000 AEAD-AES-128-GCM open (16 bytes) operations in 10000057us (9161947.8 ops/sec): 146.6 MB/s
Did 61806750 AEAD-AES-128-GCM open (256 bytes) operations in 10000005us (6180671.9 ops/sec): 1582.3 MB/s
Did 24261000 AEAD-AES-128-GCM open (1350 bytes) operations in 10000112us (2426072.8 ops/sec): 3275.2 MB/s
Did 5475000 AEAD-AES-128-GCM open (8192 bytes) operations in 10000813us (547455.5 ops/sec): 4484.8 MB/s
Did 2826000 AEAD-AES-128-GCM open (16384 bytes) operations in 10001913us (282545.9 ops/sec): 4629.2 MB/s
Did 82229250 AEAD-AES-256-GCM seal init operations in 10000032us (8222898.7 ops/sec)
Did 91326000 AEAD-AES-256-GCM seal (16 bytes) operations in 10000058us (9132547.0 ops/sec): 146.1 MB/s
Did 59753250 AEAD-AES-256-GCM seal (256 bytes) operations in 10000040us (5975301.1 ops/sec): 1529.7 MB/s
Did 23015000 AEAD-AES-256-GCM seal (1350 bytes) operations in 10000224us (2301448.4 ops/sec): 3107.0 MB/s
Did 5127000 AEAD-AES-256-GCM seal (8192 bytes) operations in 10000765us (512660.8 ops/sec): 4199.7 MB/s
Did 2638000 AEAD-AES-256-GCM seal (16384 bytes) operations in 10000288us (263792.4 ops/sec): 4322.0 MB/s
Did 82290000 AEAD-AES-256-GCM open init operations in 10000014us (8228988.5 ops/sec)
Did 85920500 AEAD-AES-256-GCM open (16 bytes) operations in 10000016us (8592036.3 ops/sec): 137.5 MB/s
Did 58123000 AEAD-AES-256-GCM open (256 bytes) operations in 10000101us (5812241.3 ops/sec): 1487.9 MB/s
Did 22427500 AEAD-AES-256-GCM open (1350 bytes) operations in 10000011us (2242747.5 ops/sec): 3027.7 MB/s
Did 5103000 AEAD-AES-256-GCM open (8192 bytes) operations in 10000243us (510287.6 ops/sec): 4180.3 MB/s
Did 2639000 AEAD-AES-256-GCM open (16384 bytes) operations in 10001526us (263859.7 ops/sec): 4323.1 MB/s

BoringSSL result:

Did 96518500 AEAD-AES-128-GCM seal init operations in 10000020us (9651830.7 ops/sec)
Did 144998000 AEAD-AES-128-GCM seal (16 bytes) operations in 10000064us (14499707.2 ops/sec): 232.0 MB/s
Did 109995750 AEAD-AES-128-GCM seal (256 bytes) operations in 10000004us (10999570.6 ops/sec): 2815.9 MB/s
Did 39113000 AEAD-AES-128-GCM seal (1350 bytes) operations in 10000059us (3911276.9 ops/sec): 5280.2 MB/s
Did 9885000 AEAD-AES-128-GCM seal (8192 bytes) operations in 10000669us (988433.9 ops/sec): 8097.3 MB/s
Did 5132000 AEAD-AES-128-GCM seal (16384 bytes) operations in 10001886us (513103.2 ops/sec): 8406.7 MB/s
Did 96728250 AEAD-AES-128-GCM open init operations in 10000006us (9672819.2 ops/sec)
Did 128507000 AEAD-AES-128-GCM open (16 bytes) operations in 10000004us (12850694.9 ops/sec): 205.6 MB/s
Did 104166250 AEAD-AES-128-GCM open (256 bytes) operations in 10000020us (10416604.2 ops/sec): 2666.7 MB/s
Did 39440000 AEAD-AES-128-GCM open (1350 bytes) operations in 10000003us (3943998.8 ops/sec): 5324.4 MB/s
Did 10542000 AEAD-AES-128-GCM open (8192 bytes) operations in 10000856us (1054109.8 ops/sec): 8635.3 MB/s
Did 5459000 AEAD-AES-128-GCM open (16384 bytes) operations in 10001379us (545824.7 ops/sec): 8942.8 MB/s
Did 89778250 AEAD-AES-256-GCM seal init operations in 10000004us (8977821.4 ops/sec)
Did 128749500 AEAD-AES-256-GCM seal (16 bytes) operations in 10000019us (12874925.5 ops/sec): 206.0 MB/s
Did 100996000 AEAD-AES-256-GCM seal (256 bytes) operations in 10000006us (10099593.9 ops/sec): 2585.5 MB/s
Did 34976750 AEAD-AES-256-GCM seal (1350 bytes) operations in 10000018us (3497668.7 ops/sec): 4721.9 MB/s
Did 9116000 AEAD-AES-256-GCM seal (8192 bytes) operations in 10000160us (911585.4 ops/sec): 7467.7 MB/s
Did 4697000 AEAD-AES-256-GCM seal (16384 bytes) operations in 10001178us (469644.7 ops/sec): 7694.7 MB/s
Did 89951500 AEAD-AES-256-GCM open init operations in 10000003us (8995147.3 ops/sec)
Did 121096000 AEAD-AES-256-GCM open (16 bytes) operations in 10000031us (12109562.5 ops/sec): 193.8 MB/s
Did 96149250 AEAD-AES-256-GCM open (256 bytes) operations in 10000010us (9614915.4 ops/sec): 2461.4 MB/s
Did 35331000 AEAD-AES-256-GCM open (1350 bytes) operations in 10000159us (3533043.8 ops/sec): 4769.6 MB/s
Did 9514000 AEAD-AES-256-GCM open (8192 bytes) operations in 10000220us (951379.1 ops/sec): 7793.7 MB/s
Did 4908000 AEAD-AES-256-GCM open (16384 bytes) operations in 10000384us (490781.2 ops/sec): 8041.0 MB/s

Solution:

Hope a more optimized version of AES-GCM will be implemented for Zen3.

[samuel40791765]

Hi there,

Thanks for bringing this to our attention! After investigating the performance discrepancy, it turns out that BoringSSL has added some notable performance improvements for AES-GCM targeting AVX2 and AVX512:

• google/boringssl@57f525e
• google/boringssl@3b6e1be

These optimizations look promising and we'll be investigating if we can implement similar improvements. We've created an internal tracking ticket and will keep this issue open to follow up on progress.

[andrewhop]

Internal tracking link CryptoAlg-3055.

[sticnarf]

Sorry to bump this, but any updates on the issue? It's been 6 months since the last update.

[vanc]

I just did a quick patch to reuse the aes-gcm-avx2-x86_64.pl from BoringSSL and the speed boost was similar as the OP posted on my Dell workstation with an Intel i9-12900 which has AVX2, but not AVX512.

Here are some test results.

Original (git revision f4f0be9):

Did 8545000 EVP-AES-128-GCM encrypt init operations in 1000063us (8544461.7 ops/sec)
Did 16007000 EVP-AES-128-GCM encrypt (16 bytes) operations in 1000040us (16006359.7 ops/sec): 256.1 MB/s
Did 10951000 EVP-AES-128-GCM encrypt (256 bytes) operations in 1000096us (10949948.8 ops/sec): 2803.2 MB/s
Did 4851000 EVP-AES-128-GCM encrypt (1350 bytes) operations in 1000100us (4850514.9 ops/sec): 6548.2 MB/s
Did 1084000 EVP-AES-128-GCM encrypt (8192 bytes) operations in 1000189us (1083795.2 ops/sec): 8878.4 MB/s
Did 563000 EVP-AES-128-GCM encrypt (16384 bytes) operations in 1001527us (562141.6 ops/sec): 9210.1 MB/s
Did 8634000 EVP-AES-128-GCM decrypt init operations in 1000102us (8633119.4 ops/sec)
Did 15395000 EVP-AES-128-GCM decrypt (16 bytes) operations in 1000045us (15394307.3 ops/sec): 246.3 MB/s
Did 11407000 EVP-AES-128-GCM decrypt (256 bytes) operations in 1000074us (11406155.9 ops/sec): 2920.0 MB/s
Did 4853000 EVP-AES-128-GCM decrypt (1350 bytes) operations in 1000114us (4852446.8 ops/sec): 6550.8 MB/s
Did 1092000 EVP-AES-128-GCM decrypt (8192 bytes) operations in 1000785us (1091143.5 ops/sec): 8938.6 MB/s
Did 565000 EVP-AES-128-GCM decrypt (16384 bytes) operations in 1001218us (564312.7 ops/sec): 9245.7 MB/s

With the patch:

Did 10507000 EVP-AES-128-GCM encrypt init operations in 1000044us (10506537.7 ops/sec)
Did 17102000 EVP-AES-128-GCM encrypt (16 bytes) operations in 1000018us (17101692.2 ops/sec): 273.6 MB/s
Did 14748000 EVP-AES-128-GCM encrypt (256 bytes) operations in 1000045us (14747336.4 ops/sec): 3775.3 MB/s
Did 6312000 EVP-AES-128-GCM encrypt (1350 bytes) operations in 1000045us (6311716.0 ops/sec): 8520.8 MB/s
Did 1727000 EVP-AES-128-GCM encrypt (8192 bytes) operations in 1000376us (1726350.9 ops/sec): 14142.3 MB/s
Did 925000 EVP-AES-128-GCM encrypt (16384 bytes) operations in 1000699us (924353.9 ops/sec): 15144.6 MB/s
Did 10516000 EVP-AES-128-GCM decrypt init operations in 1000052us (10515453.2 ops/sec)
Did 17046000 EVP-AES-128-GCM decrypt (16 bytes) operations in 1000031us (17045471.6 ops/sec): 272.7 MB/s
Did 15124000 EVP-AES-128-GCM decrypt (256 bytes) operations in 1000016us (15123758.0 ops/sec): 3871.7 MB/s
Did 6965000 EVP-AES-128-GCM decrypt (1350 bytes) operations in 1000119us (6964171.3 ops/sec): 9401.6 MB/s
Did 1893000 EVP-AES-128-GCM decrypt (8192 bytes) operations in 1000194us (1892632.8 ops/sec): 15504.4 MB/s
Did 993000 EVP-AES-128-GCM decrypt (16384 bytes) operations in 1000400us (992603.0 ops/sec): 16262.8 MB/s

The patching process is extremely simple. But due to the assembly API differences, it may look a bit dirty.

First, copy the assembly file to crypto/fipsmodule/modes/asm as aesni-gcm-avx2.pl. The renaming is to make it consistent with existing assembly files.

Second, apply the following patch.

diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index a61919e70..2e35f7ee8 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -27,6 +27,7 @@ if(ARCH STREQUAL "x86_64")
   set(
     BCM_ASM_SOURCES

+    aesni-gcm-avx2.${ASM_EXT}
     aesni-gcm-avx512.${ASM_EXT}
     aesni-gcm-x86_64.${ASM_EXT}
     aesni-xts-avx512.${ASM_EXT}
@@ -119,6 +120,7 @@ endif()

 if(PERL_EXECUTABLE)
   perlasm(aesni-gcm-x86_64.${ASM_EXT} modes/asm/aesni-gcm-x86_64.pl)
+  perlasm(aesni-gcm-avx2.${ASM_EXT} modes/asm/aesni-gcm-avx2.pl)
   perlasm(aesni-gcm-avx512.${ASM_EXT} modes/asm/aesni-gcm-avx512.pl)
   perlasm(aesni-xts-avx512.${ASM_EXT} aes/asm/aesni-xts-avx512.pl)
   perlasm(aesni-x86_64.${ASM_EXT} aes/asm/aesni-x86_64.pl)
diff --git a/crypto/fipsmodule/modes/gcm.c b/crypto/fipsmodule/modes/gcm.c
index 206b60c9a..325ecf72a 100644
--- a/crypto/fipsmodule/modes/gcm.c
+++ b/crypto/fipsmodule/modes/gcm.c
@@ -136,12 +136,38 @@ void gcm_init_ssse3(u128 Htable[16], const uint64_t H[2]) {
 static size_t hw_gcm_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                              const AES_KEY *key, uint8_t ivec[16],
                              uint8_t Xi[16], const u128 Htable[16]) {
+  // Check if AVX2 VAES is being used by testing if the function pointer matches
+  if (crypto_gcm_avx2_enabled()) {
+    // AVX2 VAES implementation - process multiples of 16 bytes
+    size_t bulk = len & kSizeTWithoutLower4Bits;
+    if (bulk > 0) {
+      aes_gcm_enc_update_vaes_avx2(in, out, bulk, key, ivec, Htable, Xi);
+      // Update counter in ivec
+      uint32_t ctr = CRYPTO_load_u32_be(ivec + 12);
+      ctr += (uint32_t)(bulk / 16);
+      CRYPTO_store_u32_be(ivec + 12, ctr);
+    }
+    return bulk;
+  }
   return aesni_gcm_encrypt(in, out, len, key, ivec, Htable, Xi);
 }

 static size_t hw_gcm_decrypt(const uint8_t *in, uint8_t *out, size_t len,
                              const AES_KEY *key, uint8_t ivec[16],
                              uint8_t Xi[16], const u128 Htable[16]) {
+  // Check if AVX2 VAES is being used
+  if (crypto_gcm_avx2_enabled()) {
+    // AVX2 VAES implementation - process multiples of 16 bytes
+    size_t bulk = len & kSizeTWithoutLower4Bits;
+    if (bulk > 0) {
+      aes_gcm_dec_update_vaes_avx2(in, out, bulk, key, ivec, Htable, Xi);
+      // Update counter in ivec
+      uint32_t ctr = CRYPTO_load_u32_be(ivec + 12);
+      ctr += (uint32_t)(bulk / 16);
+      CRYPTO_store_u32_be(ivec + 12, ctr);
+    }
+    return bulk;
+  }
   return aesni_gcm_decrypt(in, out, len, key, ivec, Htable, Xi);
 }
 #endif  // HW_GCM && X86_64
@@ -243,6 +269,14 @@ void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
     return;
   }
 #endif
+  // Check for VAES + VPCLMULQDQ + AVX2 (e.g., AMD Zen 3)
+  if (crypto_gcm_avx2_enabled()) {
+    gcm_init_vpclmulqdq_avx2(out_table, H);
+    *out_mult = gcm_gmult_vpclmulqdq_avx2;
+    *out_hash = gcm_ghash_vpclmulqdq_avx2;
+    *out_is_avx = 1;
+    return;
+  }
   if (crypto_gcm_clmul_enabled()) {
     if (CRYPTO_is_AVX_capable() && CRYPTO_is_MOVBE_capable()) {
       gcm_init_avx(out_table, H);
@@ -869,4 +903,17 @@ int crypto_gcm_avx512_enabled(void) {
   return 0;
 #endif
 }
+
+int crypto_gcm_avx2_enabled(void) {
+  // VAES + VPCLMULQDQ + AVX2 support for CPUs like AMD Zen 3 that have
+  // VAES but not AVX512. This should be checked after AVX512 to prefer
+  // AVX512 on CPUs that support both.
+#if defined(GHASH_ASM_X86_64)
+  return (CRYPTO_is_VAES_capable() &&
+          CRYPTO_is_VPCLMULQDQ_capable() &&
+          CRYPTO_is_AVX2_capable());
+#else
+  return 0;
+#endif
+}
 #endif
diff --git a/crypto/fipsmodule/modes/internal.h b/crypto/fipsmodule/modes/internal.h
index 71f2d5c73..2cc084fa3 100644
--- a/crypto/fipsmodule/modes/internal.h
+++ b/crypto/fipsmodule/modes/internal.h
@@ -198,6 +198,9 @@ int crypto_gcm_clmul_enabled(void);
 // crypto_gcm_avx512_enabled returns one if the AVX512 VAES + VPCLMULQDQ
 // implementation of GCM is used.
 int crypto_gcm_avx512_enabled(void);
+// crypto_gcm_avx2_enabled returns one if the AVX2 VAES + VPCLMULQDQ
+// implementation of GCM is used (for CPUs like AMD Zen 3 without AVX512).
+int crypto_gcm_avx2_enabled(void);
 #endif

 // CRYPTO_ghash_init writes a precomputed table of powers of |gcm_key| to
@@ -299,6 +302,17 @@ void gcm_init_avx(u128 Htable[16], const uint64_t Xi[2]);
 void gcm_gmult_avx(uint8_t Xi[16], const u128 Htable[16]);
 void gcm_ghash_avx(uint8_t Xi[16], const u128 Htable[16], const uint8_t *in,
                    size_t len);
+// AVX2 + VAES + VPCLMULQDQ functions
+void gcm_init_vpclmulqdq_avx2(u128 Htable[16], const uint64_t Xi[2]);
+void gcm_gmult_vpclmulqdq_avx2(uint8_t Xi[16], const u128 Htable[16]);
+void gcm_ghash_vpclmulqdq_avx2(uint8_t Xi[16], const u128 Htable[16],
+                               const uint8_t *in, size_t len);
+void aes_gcm_enc_update_vaes_avx2(const uint8_t *in, uint8_t *out, size_t len,
+                                  const AES_KEY *key, const uint8_t ivec[16],
+void aes_gcm_dec_update_vaes_avx2(const uint8_t *in, uint8_t *out, size_t len,
+                                  const AES_KEY *key, const uint8_t ivec[16],
+                                  const u128 Htable[16], uint8_t Xi[16]);
 #if  !defined(MY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX)
 void gcm_init_avx512(u128 Htable[16], const uint64_t Xi[2]);
 void gcm_gmult_avx512(uint8_t Xi[2], const u128 Htable[16]);

That's it. All tests passed.

[wtarreau]

I wanted to try it but there's a missing line in the copy-paste so the patch doesn't apply. It's missing the final arguments of aes_gcm_enc_update_vaes_avx2() in internal.h. I'm attaching the fixed version (which also better resists to copy-paste). However now it still fails to build with an obscure error:

[ 42%] Built target crypto_objects
[ 42%] Generating crypto_test_data.cc
x crypto_test_data.cc
[ 42%] Built target crypto_test_data
make: *** [Makefile:136: all] Error 2

Thus I'm wondering if any other parts could be missing from the copy-pasted patch above.

aes-avx.diff.txt