Support for hardware accelerated AES

[Dan Archbold]

Hi all,

I'm trying to find out if Shaka Packager can use the AES-NI instructions to speed up encryption operations? I can see that it uses OpenSSL for the AES encryption and the library appears to support AES-NI but really can't tell if it is being used or not.

My processor does have AES-NI support and using the OpenSSL package's speed command with and without AES-NI you can get up to 2-3 times the throughput:

AES-NI disabled:

root@intel-corei7-64:~/widevine/test# OPENSSL_ia32cap="~0x200000200000000" openssl speed -evp aes-128-cbc

Doing aes-128-cbc for 3s on 16 size blocks: 26816274 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 64 size blocks: 7941866 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 256 size blocks: 2138731 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 1024 size blocks: 544347 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 8192 size blocks: 68297 aes-128-cbc's in 3.00s

OpenSSL 1.0.2h  3 May 2016

The 'numbers' are in 1000s of bytes per second processed.

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes

aes-128-cbc     143020.13k   169426.47k   182505.05k   185803.78k   186496.34k

AES-NI enabled:

root@intel-corei7-64:~/widevine/test# openssl speed -evp aes-128-cbc

Doing aes-128-cbc for 3s on 16 size blocks: 66867183 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 64 size blocks: 21998486 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 256 size blocks: 5772617 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 1024 size blocks: 1506485 aes-128-cbc's in 3.00s

Doing aes-128-cbc for 3s on 8192 size blocks: 190434 aes-128-cbc's in 3.00s

OpenSSL 1.0.2h  3 May 2016

The 'numbers' are in 1000s of bytes per second processed.

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes

aes-128-cbc     356624.98k   469301.03k   492596.65k   514213.55k   520011.78k

The main reason for asking is my processor is an Atom and using the packager to make a live encrypted DASH stream with 2 Mb/s and 1 Mb/s video streams uses 20-25% CPU, so I'm looking for any performance increases I can get!

Thanks in advance,

Dan

[KongQun Yang]

No, unfortunately shaka-packager uses low level AES_xxx APIs currently, which is not able to take advantage of AES-NI instruction sets.

That is definitely something we should look into. I have just opened a new issue https://github.com/google/shaka-packager/issues/198 on Github. If you'd like to help, you are very welcomed to do so!

-- KongQun Yang (KQ)

--
You received this message because you are subscribed to the Google Groups "Shaka Packager Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to shaka-packager-users+unsub...@googlegroups.com.
To post to this group, send email to shaka-packager-users@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-packager-users/6fdb3c8f-ae2c-478a-995f-fecdad4c0ecd%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dan Archbold]

Thanks for the quick response KongQun.

I found a comment in the assembler-generating perl script (boringssl/src/crypto/aes/asm/aesni-x86_64.pl) that suggested it was possible to use the AES-NI instructions with AES_ API (also stated in http://openssl.6102.n7.nabble.com/AES-NI-in-1-0-1-td31849.html#a31854). So I used the modified script to replace boringssl/linux-x86_64/crypto/aes/aes-x86_64.S but compilation fails due to undefined references. Given the post was from 2012 I guess this does not work anymore.

Took a quick look at the EVP API and it's a bit more complicated than string replacing AES_ for EVP_ so it's not something I have time for right now!

Best regards,

Dan

[KongQun Yang]

Sure. Feel free to subscribe to issue https://github.com/google/shaka-packager/issues/198. We'll update the issue when we have time working on it!

-- KongQun Yang (KQ)

--

You received this message because you are subscribed to the Google Groups "Shaka Packager Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to shaka-packager-users+unsub...@googlegroups.com.
To post to this group, send email to shaka-packager-users@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-packager-users/1280cf6f-5e15-41e0-9142-8d332760eebc%40googlegroups.com.