Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\))
Subject: Re: [PATCH v2 0/4] virtio-crypto: support ECDSA algorithm
From:   Lei He <helei.sig11@bytedance.com>
In-Reply-To: <Yr1xa4twKn3qFAt9@redhat.com>
Date:   Thu, 30 Jun 2022 20:43:37 +0800
Cc:     Lei He <helei.sig11@bytedance.com>,
        Herbert Xu <herbert@gondor.apana.org.au>, davem@davemloft.net,
        dhowells@redhat.com, "Michael S. Tsirkin" <mst@redhat.com>,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        pizhenwei@bytedance.com
Content-Transfer-Encoding: quoted-printable
Message-Id: <E4378D78-C22D-44E7-9490-E31E35286C59@bytedance.com>
References: <20220623070550.82053-1-helei.sig11@bytedance.com>
 <Yr1JvG1aJUp4I/fP@gondor.apana.org.au>
 <C7191BC8-5BE0-47CB-A302-735BBD1CBED0@bytedance.com>
 <Yr1xa4twKn3qFAt9@redhat.com>
To:     =?utf-8?B?IkRhbmllbCBQLiBCZXJyYW5nw6ki?= <berrange@redhat.com>
Precedence: bulk

On Jun 30, 2022, at 5:48 PM, Daniel P. Berrang=C3=A9 =
<berrange@redhat.com> wrote:
>=20
> On Thu, Jun 30, 2022 at 03:23:39PM +0800, Lei He wrote:
>>=20
>>> On Jun 30, 2022, at 2:59 PM, Herbert Xu =
<herbert@gondor.apana.org.au> wrote:
>>>=20
>>> On Thu, Jun 23, 2022 at 03:05:46PM +0800, Lei He wrote:
>>>> From: lei he <helei.sig11@bytedance.com>
>>>>=20
>>>> This patch supports the ECDSA algorithm for virtio-crypto.
>>>=20
>>> Why is this necessary?
>>>=20
>>=20
>> The main purpose of this patch is to offload ECDSA computations to =
virtio-crypto dev.
>> We can modify the backend of virtio-crypto to allow hardware like =
Intel QAT cards to=20
>> perform the actual calculations, and user-space applications such as =
HTTPS server=20
>> can access those backend in a unified way(eg, keyctl_pk_xx syscall).
>>=20
>> Related works are also described in following patch series:
>> =
https://lwn.net/ml/linux-crypto/20220525090118.43403-1-helei.sig11@bytedan=
ce.com/
>=20
> IIUC, this link refers to testing performance of the RSA impl of
> virtio-crypto with a vhost-user backend, leveraging an Intel QAT
> device on the host. What's the status of that depolyment setup ?
> Is code for it published anywhere, and does it have dependancy on
> any kernel patches that are not yet posted and/or merged ? Does it
> cover both ECDSA and RSA yet, or still only RSA ?
>=20
> The QEMU backend part of the virtio-crypto support for ECDSA looks =
fine
> to merge, but obviously I'd like some positive sign that the kernel
> maintainers are willing to accept the guest driver side.
>=20

1. We have now been able to provide offload capability for nginx=E2=80=99s=
 TLS handshake in the virtual
machine(with the kctl-engine), and have achieved	about 0.8~0.9 =
times performance improvement.=20
But as you can see, when we were testing, both authentication and key =
exchange only supported=20
RSA at the moment.=20
2. The code for the QAT offload backend is not posted now, it does not =
support the ECDSA, so it also does not=20
depends on any other patches that have not been merged. To support =
ECDSA, this patch is required.
At present, I have only implemented and tested the ECDSA for the builtin =
backend, and the ECDSA support
for another backend that can offload is also in progress.

By the way,  the virtio part of QEMU( for support ECDSA)  is also ready, =
 I will post it soon.=