QAT driver

[John-Mark Gurney]

Benjamin Kaduk wrote this message on Tue, Oct 27, 2020 at 09:24 -0700:
> On Tue, Oct 27, 2020 at 09:07:54AM -0400, Mark Johnston wrote:
> > On Mon, Oct 26, 2020 at 09:57:35PM -0700, Benjamin Kaduk wrote:
> > > On Mon, Oct 26, 2020 at 11:27:20PM -0400, Mark Johnston wrote:
> > > > On Mon, Oct 26, 2020 at 08:00:08PM -0700, Neel Chauhan wrote:
> > > > > Hi,
> > > > > 
> > > > > This is great news for me with my home HPE ML110 G10/Xeon 4108 server.
> > > > > 
> > > > > However, I will not be able to test this patch unless it can get 
> > > > > backported to 12.1 or 12.2 once it's out, and I don't expect backporting 
> > > > > to happen.
> > > > 
> > > > Indeed, it wouldn't appear before 12.3.
> > > > 
> > > > > I have one question about this: will I be able to use this to accelerate 
> > > > > OpenSSL? Is additional code needed?
> > > > 
> > > > In principle OpenSSL can make use of cryptodev(4) using the cryptodev
> > > > engine, which would allow requests to be handled by qat(4) (or any other
> > > > hardware crypto driver loaded in the kernel).  I don't know that the
> > > > cryptodev engine is really maintained these days though.  More
> > > 
> > > The openssl cryptodev engine was rewritten in
> > > https://github.com/openssl/openssl/pull/3744 , but engines are going to be
> > > deprecated in openssl 3.0.
> > 
> > Is this the devcrypto engine?  It appears to be broken on FreeBSD: it
> 
> Yes, the devcrypto engine.
> 
> > tries to invoke CIOCGSESSION on a /dev/crypto descriptor, but one is
> > supposed to first use CRIOGET to get a separate descriptor with which
> > sessions are associated.
> 
> As the linked page says, "implemented based on cryptodev-linux and then
> adjusted to work on FreeBSD 8.4".  I don't know of anyone testing it on a
> recent FreeBSD prior to your report.

Well, It does work for FreeBSD 11.3 and OpenSSL 1.0.2h-freebsd
3 May 2016, so it's clear that OpenSSL broken their code...

I just ran some tests and w/ cryptodev loaded, and it gives wildly
fast speeds, because it only times the user cpu time, but since the
work is done in the kernel, it doesn't get accounted:
gold,pts,/tmp/so,507$ktrace openssl speed -evp aes-128-cbc
Doing aes-128-cbc for 3s on 16 size blocks: 127989 aes-128-cbc's in 0.13s
Doing aes-128-cbc for 3s on 64 size blocks: 126928 aes-128-cbc's in 0.08s
Doing aes-128-cbc for 3s on 256 size blocks: 135133 aes-128-cbc's in 0.09s
Doing aes-128-cbc for 3s on 1024 size blocks: 121699 aes-128-cbc's in 0.05s
Doing aes-128-cbc for 3s on 8192 size blocks: 74813 aes-128-cbc's in 0.02s
OpenSSL 1.0.2h-freebsd  3 May 2016
built on: date not available
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc      15418.91k   103979.42k   402548.92k  2658555.22k 39223558.14k                                                                               

If you "fix" the number (multiply by .02 and  divid by 3), you get the
more reasonable 261MB/sec...

And then when I unload cryptodev, I get:
gold,pts,/tmp/so,518$openssl speed -evp aes-128-cbc
Doing aes-128-cbc for 3s on 16 size blocks: 66217110 aes-128-cbc's in 2.98s
Doing aes-128-cbc for 3s on 64 size blocks: 20354897 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 5899224 aes-128-cbc's in 2.97s
Doing aes-128-cbc for 3s on 1024 size blocks: 1512931 aes-128-cbc's in 2.94s
Doing aes-128-cbc for 3s on 8192 size blocks: 191150 aes-128-cbc's in 2.95s
OpenSSL 1.0.2h-freebsd  3 May 2016
built on: date not available
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     355938.69k   434237.80k   508699.40k   527401.31k   531658.63k

Which is reasonable for not going to the kernel everytime...  (CBC encrypt
is a slow mode)..

So, sounds like the OpenSSL broke /dev/crypto on FreeBSD.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."