QAT driver

[Mark Johnston]

On Mon, Oct 26, 2020 at 09:57:35PM -0700, Benjamin Kaduk wrote:
> On Mon, Oct 26, 2020 at 11:27:20PM -0400, Mark Johnston wrote:
> > On Mon, Oct 26, 2020 at 08:00:08PM -0700, Neel Chauhan wrote:
> > > Hi,
> > > 
> > > This is great news for me with my home HPE ML110 G10/Xeon 4108 server.
> > > 
> > > However, I will not be able to test this patch unless it can get 
> > > backported to 12.1 or 12.2 once it's out, and I don't expect backporting 
> > > to happen.
> > 
> > Indeed, it wouldn't appear before 12.3.
> > 
> > > I have one question about this: will I be able to use this to accelerate 
> > > OpenSSL? Is additional code needed?
> > 
> > In principle OpenSSL can make use of cryptodev(4) using the cryptodev
> > engine, which would allow requests to be handled by qat(4) (or any other
> > hardware crypto driver loaded in the kernel).  I don't know that the
> > cryptodev engine is really maintained these days though.  More
> 
> The openssl cryptodev engine was rewritten in
> https://github.com/openssl/openssl/pull/3744 , but engines are going to be
> deprecated in openssl 3.0.

Is this the devcrypto engine?  It appears to be broken on FreeBSD: it
tries to invoke CIOCGSESSION on a /dev/crypto descriptor, but one is
supposed to first use CRIOGET to get a separate descriptor with which
sessions are associated.

truss(1)ing "openssl speed -evp aes-128-cbc -engine devcrypto" yields:

82677: openat(AT_FDCWD,"/dev/crypto",O_RDWR,00)  = 3 (0x3)
82677: ioctl(3,CIOCGSESSION,0x7fffffffde70)      ERR#22 'Invalid argument'
82677: ioctl(3,CIOCGSESSION,0x7fffffffde70)      ERR#22 'Invalid argument'
82677: ioctl(3,CIOCGSESSION,0x7fffffffde70)      ERR#22 'Invalid argument'
82677: ioctl(3,CIOCGSESSION,0x7fffffffde70)      ERR#22 'Invalid argument'
82677: ioctl(3,CIOCGSESSION,0x7fffffffde70)      ERR#22 'Invalid argument'
...

> In theory someone (Intel?) could write an
> openssl "provider" that utilizes the QAT hardware, but (unsurprisingly,
> given that the interface isn't even finalized yet!) no one has done that
> yet.

What's the difference between providers and engines?  There is a QAT
engine for OpenSSL.