[PATCH v10 0/1] Introduce akcipher service for virtio-crypto
v9 - v10:
- Minor fix of coding style by v9.
v8 - v9:
- Fix compiling error reported by clang-13/14:
opt->hash_alg = cryptodev_builtin_get_rsa_hash_algo(); this leads
implicit convertion from 'int' to 'uint32'. 'if (opt->hash_alg < 0)'
is always false. Thanks to Philippe Mathieu-Daudé.
v7 - v8:
- The changes of QEMU crypto has been reviewed & merged by Daniel,
remove this part from this series. Thanks to Daniel!
- virtio_crypto.h is updated by e4082063e47e
("linux-headers: Update to v5.18-rc6"), remove from this series.
- Minor fixes reviewed by Gonglei. Thanks to Gonglei!
v6 -> v7:
- Fix serval build errors for some specific platforms/configurations.
- Use '%zu' instead of '%lu' for size_t parameters.
- AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
keys.
- AkCipher-benchmark: process constant amount of sign/verify instead
of running sign/verify for a constant duration.
v5 -> v6:
- Fix build errors and codestyles.
- Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
- Report more detailed errors.
- Fix buffer length check and return values of akcipher-nettle, allows caller to
pass a buffer with larger size than actual needed.
A million thanks to Daniel!
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akci
[PATCH v9 0/1] Introduce akcipher service for virtio-crypto
v8 - v9:
- Fix compiling error reported by clang-13/14:
opt->hash_alg = cryptodev_builtin_get_rsa_hash_algo(); this leads
implicit convertion from 'int' to 'uint32'. 'if (opt->hash_alg < 0)'
is always false. Thanks to Philippe Mathieu-Daudé.
v7 - v8:
- The changes of QEMU crypto has been reviewed & merged by Daniel,
remove this part from this series. Thanks to Daniel!
- virtio_crypto.h is updated by e4082063e47e
("linux-headers: Update to v5.18-rc6"), remove from this series.
- Minor fixes reviewed by Gonglei. Thanks to Gonglei!
v6 -> v7:
- Fix serval build errors for some specific platforms/configurations.
- Use '%zu' instead of '%lu' for size_t parameters.
- AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
keys.
- AkCipher-benchmark: process constant amount of sign/verify instead
of running sign/verify for a constant duration.
v5 -> v6:
- Fix build errors and codestyles.
- Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
- Report more detailed errors.
- Fix buffer length check and return values of akcipher-nettle, allows caller to
pass a buffer with larger size than actual needed.
A million thanks to Daniel!
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support
Introduce akcipher service for virtio-crypto
v7 - v8:
- The changes of QEMU crypto has been reviewed & merged by Daniel,
remove this part from this series. Thanks to Daniel!
- virtio_crypto.h is updated by e4082063e47e
("linux-headers: Update to v5.18-rc6"), remove from this series.
- Minor fixes reviewed by Gonglei. Thanks to Gonglei!
v6 -> v7:
- Fix serval build errors for some specific platforms/configurations.
- Use '%zu' instead of '%lu' for size_t parameters.
- AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
keys.
- AkCipher-benchmark: process constant amount of sign/verify instead
of running sign/verify for a constant duration.
v5 -> v6:
- Fix build errors and codestyles.
- Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
- Report more detailed errors.
- Fix buffer length check and return values of akcipher-nettle, allows caller to
pass a buffer with larger size than actual needed.
A million thanks to Daniel!
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 version of related kernel patch.
v1:
- Support akcipher for virtio-crypto.
- Introd
Re: Re: [PATCH v7 0/9] Introduce akcipher service for virtio-crypto
Hi, Daniel
Thanks a lot for your review!
On 5/26/22 18:48, Daniel P. Berrangé wrote:
I've sent a pull request containing all the crypto/ changes,
as that covers stuff I maintain. ie patches 2-8
Patches 1 and 9, I'll leave for MST to review & queue since the
virtual hardware is not my area of knowledge.
On Wed, May 25, 2022 at 05:01:09PM +0800, Lei He wrote:
v6 -> v7:
- Fix serval build errors for some specific platforms/configurations.
- Use '%zu' instead of '%lu' for size_t parameters.
- AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
keys.
- AkCipher-benchmark: process constant amount of sign/verify instead
of running sign/verify for a constant duration.
v5 -> v6:
- Fix build errors and codestyles.
- Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
- Report more detailed errors.
- Fix buffer length check and return values of akcipher-nettle, allows caller to
pass a buffer with larger size than actual needed.
A million thanks to Daniel!
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 ve
RE: [PATCH v7 0/9] Introduce akcipher service for virtio-crypto
> -Original Message-
> From: Daniel P. Berrangé [mailto:berra...@redhat.com]
> Sent: Thursday, May 26, 2022 6:48 PM
> To: Lei He
> Cc: m...@redhat.com; Gonglei (Arei) ;
> qemu-de...@nongnu.org; virtualization@lists.linux-foundation.org;
> linux-cry...@vger.kernel.org; jasow...@redhat.com; coh...@redhat.com;
> pizhen...@bytedance.com
> Subject: Re: [PATCH v7 0/9] Introduce akcipher service for virtio-crypto
>
> I've sent a pull request containing all the crypto/ changes, as that covers
> stuff I
> maintain. ie patches 2-8
>
> Patches 1 and 9, I'll leave for MST to review & queue since the virtual
> hardware
> is not my area of knowledge.
>
Thanks for your work, Daniel.
Regards,
-Gonglei
> On Wed, May 25, 2022 at 05:01:09PM +0800, Lei He wrote:
> > v6 -> v7:
> > - Fix serval build errors for some specific platforms/configurations.
> > - Use '%zu' instead of '%lu' for size_t parameters.
> > - AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
> > keys.
> > - AkCipher-benchmark: process constant amount of sign/verify instead
> > of running sign/verify for a constant duration.
> >
> > v5 -> v6:
> > - Fix build errors and codestyles.
> > - Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
> > - Report more detailed errors.
> > - Fix buffer length check and return values of akcipher-nettle, allows
> > caller to pass a buffer with larger size than actual needed.
> >
> > A million thanks to Daniel!
> >
> > v4 -> v5:
> > - Move QCryptoAkCipher into akcipherpriv.h, and modify the related
> comments.
> > - Rename asn1_decoder.c to der.c.
> > - Code style fix: use 'cleanup' & 'error' lables.
> > - Allow autoptr type to auto-free.
> > - Add test cases for rsakey to handle DER error.
> > - Other minor fixes.
> >
> > v3 -> v4:
> > - Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa ->
> > RSA, XXX-alg -> XXX-algo.
> > - Change version info in qapi/crypto.json, from 7.0 -> 7.1.
> > - Remove ecdsa from qapi/crypto.json, it would be introduced with the
> implemetion later.
> > - Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed)
> in qapi/crypto.json.
> > - Rename arguments of qcrypto_akcipher_XXX to keep aligned with
> qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
> qcrypto_akcipher_max_XXX APIs.
> > - Add new API: qcrypto_akcipher_supports.
> > - Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
> return the actual length of result.
> > - Separate ASN.1 source code and test case clean.
> > - Disable RSA raw encoding for akcipher-nettle.
> > - Separate RSA key parser into rsakey.{hc}, and implememts it with
> builtin-asn1-decoder and nettle respectivly.
> > - Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has
> higher priority than nettle.
> > - For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the
> > length of returned result maybe less than the dst buffer size, return
> > the actual length of result instead of the buffer length to the guest
> > side. (in function virtio_crypto_akcipher_input_data_helper)
> > - Other minor changes.
> >
> > Thanks to Daniel!
> >
> > Eric pointed out this missing part of use case, send it here again.
> >
> > In our plan, the feature is designed for HTTPS offloading case and other
> applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
> shows bellow:
> >
> >
> > Nginx/openssl[1] ... Apps
> > Guest -
> > virtio-crypto driver[2]
> > -
> > virtio-crypto backend[3]
> > Host-
> > / | \
> > builtin[4] vhost keyctl[5] ...
> >
> >
> > [1] User applications can offload RSA calculation to kernel by keyctl
> > syscall.
> There is no keyctl engine in openssl currently, we developed a engine and
> tried
> to contribute it to openssl upstream, but openssl 1.x does not accept new
> feature. Link:
> >https://github.com/openssl/openssl/pull/16689
> >
> > This branch is available and maintained by Lei
> >
> > https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
> >
> > We tested nginx(change config file only) with openssl keyctl engine, it
> > works
> f
Re: [PATCH v7 0/9] Introduce akcipher service for virtio-crypto
I've sent a pull request containing all the crypto/ changes,
as that covers stuff I maintain. ie patches 2-8
Patches 1 and 9, I'll leave for MST to review & queue since the
virtual hardware is not my area of knowledge.
On Wed, May 25, 2022 at 05:01:09PM +0800, Lei He wrote:
> v6 -> v7:
> - Fix serval build errors for some specific platforms/configurations.
> - Use '%zu' instead of '%lu' for size_t parameters.
> - AkCipher-gcrypt: avoid setting wrong error messages when parsing RSA
> keys.
> - AkCipher-benchmark: process constant amount of sign/verify instead
> of running sign/verify for a constant duration.
>
> v5 -> v6:
> - Fix build errors and codestyles.
> - Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
> - Report more detailed errors.
> - Fix buffer length check and return values of akcipher-nettle, allows caller
> to
> pass a buffer with larger size than actual needed.
>
> A million thanks to Daniel!
>
> v4 -> v5:
> - Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
> - Rename asn1_decoder.c to der.c.
> - Code style fix: use 'cleanup' & 'error' lables.
> - Allow autoptr type to auto-free.
> - Add test cases for rsakey to handle DER error.
> - Other minor fixes.
>
> v3 -> v4:
> - Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
> XXX-alg -> XXX-algo.
> - Change version info in qapi/crypto.json, from 7.0 -> 7.1.
> - Remove ecdsa from qapi/crypto.json, it would be introduced with the
> implemetion later.
> - Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
> qapi/crypto.json.
> - Rename arguments of qcrypto_akcipher_XXX to keep aligned with
> qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
> qcrypto_akcipher_max_XXX APIs.
> - Add new API: qcrypto_akcipher_supports.
> - Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
> return the actual length of result.
> - Separate ASN.1 source code and test case clean.
> - Disable RSA raw encoding for akcipher-nettle.
> - Separate RSA key parser into rsakey.{hc}, and implememts it with
> builtin-asn1-decoder and nettle respectivly.
> - Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
> priority than nettle.
> - For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length
> of returned result maybe less than the dst buffer size, return the actual
> length of result instead of the buffer length to the guest side. (in function
> virtio_crypto_akcipher_input_data_helper)
> - Other minor changes.
>
> Thanks to Daniel!
>
> Eric pointed out this missing part of use case, send it here again.
>
> In our plan, the feature is designed for HTTPS offloading case and other
> applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
> shows bellow:
>
>
> Nginx/openssl[1] ... Apps
> Guest -
> virtio-crypto driver[2]
> -
> virtio-crypto backend[3]
> Host-
> / | \
> builtin[4] vhost keyctl[5] ...
>
>
> [1] User applications can offload RSA calculation to kernel by keyctl
> syscall. There is no keyctl engine in openssl currently, we developed a
> engine and tried to contribute it to openssl upstream, but openssl 1.x does
> not accept new feature. Link:
>https://github.com/openssl/openssl/pull/16689
>
> This branch is available and maintained by Lei
>https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
>
> We tested nginx(change config file only) with openssl keyctl engine, it works
> fine.
>
> [2] virtio-crypto driver is used to communicate with host side, send requests
> to host side to do asymmetric calculation.
>https://lkml.org/lkml/2022/3/1/1425
>
> [3] virtio-crypto backend handles requests from guest side, and forwards
> request to crypto backend driver of QEMU.
>
> [4] Currently RSA is supported only in builtin driver. This driver is
> supposed to test the full feature without other software(Ex vhost process)
> and hardware dependence. ecdsa is introduced into qapi type without
> implementation, this may be implemented in Q3-2022 or later. If ecdsa type
> definition should be added with the implementation together, I'll remove this
> in next version.
>
> [5] keyctl backend is in development, we will post this feature in Q2-2022.
> keyctl backend can use hardware acceleration(Ex, Intel QAT).
>
> Setup the full environment, tested with Intel QAT on host side, the QPS of
> HTTPS increase to ~200% in a guest.
>
> VS PCI passthrough: the most important benefit of this solution makes the VM
> migratable.
>
> v2 -> v3:
> - Introduce akcipher types to qapi
> - Add test/benchmark suite for akcipher class
> - Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
> - crypto:
[PATCH v6 0/9] Introduce akcipher service for virtio-crypto
v5 -> v6:
- Fix build errors and codestyles.
- Add parameter 'Error **errp' for qcrypto_akcipher_rsakey_parse.
- Report more detailed errors.
- Fix buffer length check and return values of akcipher-nettle, allows caller to
pass a buffer with larger size than actual needed.
A million thanks to Daniel!
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 version of related kernel patch.
v1:
- Support akcipher for virtio-crypto.
- Introduce akcipher class.
- Introduce ASN1 decoder into QEMU.
- Implement RSA backend by nettle/hogweed.
Lei He (6):
qapi: crypto-akcipher: Introduce akcipher types to qapi
crypto: add ASN.1 DER decoder
crypto: Implement RSA algorithm by hogweed
crypto: Implement RSA algorithm by gcrypt
test/crypto: Add test suite for crypto akcipher
tests/crypto: Add test suite for RSA keys
Zhenwei Pi (3):
virtio-crypto: header update
crypto: Introduce akcipher crypto class
crypto: Introduce RSA algorithm
backends/cryptodev-builtin.c | 272 -
backends/cryptodev-vhost-user.c |
Re: [PATCH v5 0/9] Introduce akcipher service for virtio-crypto
On Fri, May 13, 2022 at 06:19:10AM -0400, Michael S. Tsirkin wrote:
> On Thu, Apr 28, 2022 at 09:59:34PM +0800, zhenwei pi wrote:
> > Hi, Lei & MST
> >
> > Daniel has started to review the akcipher framework and nettle & gcrypt
> > implementation, this part seems to be ready soon. Thanks a lot to Daniel!
> >
> > And the last patch "crypto: Introduce RSA algorithm" handles akcipher
> > requests from guest and uses the new akcipher service. The new feature
> > can be used to test by the builtin driver. I would appreciate it if you
> > could review patch.
>
>
> I applied the first 6 patches. Tests need to address Daniel's comments.
Oh sorry, spoke too soon - I noticed mingw issues, and in fact Daniel noticed
them too.
Pls address and repost the series. Thanks!
> > v4 -> v5:
> > - Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
> > - Rename asn1_decoder.c to der.c.
> > - Code style fix: use 'cleanup' & 'error' lables.
> > - Allow autoptr type to auto-free.
> > - Add test cases for rsakey to handle DER error.
> > - Other minor fixes.
> >
> > v3 -> v4:
> > - Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
> > XXX-alg -> XXX-algo.
> > - Change version info in qapi/crypto.json, from 7.0 -> 7.1.
> > - Remove ecdsa from qapi/crypto.json, it would be introduced with the
> > implemetion later.
> > - Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
> > qapi/crypto.json.
> > - Rename arguments of qcrypto_akcipher_XXX to keep aligned with
> > qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
> > qcrypto_akcipher_max_XXX APIs.
> > - Add new API: qcrypto_akcipher_supports.
> > - Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
> > return the actual length of result.
> > - Separate ASN.1 source code and test case clean.
> > - Disable RSA raw encoding for akcipher-nettle.
> > - Separate RSA key parser into rsakey.{hc}, and implememts it with
> > builtin-asn1-decoder and nettle respectivly.
> > - Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has
> > higher priority than nettle.
> > - For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length
> > of returned result maybe less than the dst buffer size, return the actual
> > length of result instead of the buffer length to the guest side. (in
> > function virtio_crypto_akcipher_input_data_helper)
> > - Other minor changes.
> >
> > Thanks to Daniel!
> >
> > Eric pointed out this missing part of use case, send it here again.
> >
> > In our plan, the feature is designed for HTTPS offloading case and other
> > applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
> > shows bellow:
> >
> >
> > Nginx/openssl[1] ... Apps
> > Guest -
> >virtio-crypto driver[2]
> > -
> >virtio-crypto backend[3]
> > Host-
> > / | \
> > builtin[4] vhost keyctl[5] ...
> >
> >
> > [1] User applications can offload RSA calculation to kernel by keyctl
> > syscall. There is no keyctl engine in openssl currently, we developed a
> > engine and tried to contribute it to openssl upstream, but openssl 1.x does
> > not accept new feature. Link:
> > https://github.com/openssl/openssl/pull/16689
> >
> > This branch is available and maintained by Lei
> > https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
> >
> > We tested nginx(change config file only) with openssl keyctl engine, it
> > works fine.
> >
> > [2] virtio-crypto driver is used to communicate with host side, send
> > requests to host side to do asymmetric calculation.
> > https://lkml.org/lkml/2022/3/1/1425
> >
> > [3] virtio-crypto backend handles requests from guest side, and forwards
> > request to crypto backend driver of QEMU.
> >
> > [4] Currently RSA is supported only in builtin driver. This driver is
> > supposed to test the full feature without other software(Ex vhost process)
> > and hardware dependence. ecdsa is introduced into qapi type without
> > implementation, this may be implemented in Q3-2022 or later. If ecdsa type
> > definition should be added with the implementation together, I'll remove
> > this in next version.
> >
> > [5] keyctl backend is in development, we will post this feature in Q2-2022.
> > keyctl backend can use hardware acceleration(Ex, Intel QAT).
> >
> > Setup the full environment, tested with Intel QAT on host side, the QPS of
> > HTTPS increase to ~200% in a guest.
> >
> > VS PCI passthrough: the most important benefit of this solution makes the
> > VM migratable.
> >
> > v2 -> v3:
> > - Introduce akcipher types to qapi
> > - Add test/benchmark suite for akcipher class
> > - Seperate 'virtio_crypto: Support virtio crypto asym operation'
Re: [PATCH v5 0/9] Introduce akcipher service for virtio-crypto
On Thu, Apr 28, 2022 at 09:59:34PM +0800, zhenwei pi wrote:
> Hi, Lei & MST
>
> Daniel has started to review the akcipher framework and nettle & gcrypt
> implementation, this part seems to be ready soon. Thanks a lot to Daniel!
>
> And the last patch "crypto: Introduce RSA algorithm" handles akcipher
> requests from guest and uses the new akcipher service. The new feature
> can be used to test by the builtin driver. I would appreciate it if you
> could review patch.
I applied the first 6 patches. Tests need to address Daniel's comments.
> v4 -> v5:
> - Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
> - Rename asn1_decoder.c to der.c.
> - Code style fix: use 'cleanup' & 'error' lables.
> - Allow autoptr type to auto-free.
> - Add test cases for rsakey to handle DER error.
> - Other minor fixes.
>
> v3 -> v4:
> - Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
> XXX-alg -> XXX-algo.
> - Change version info in qapi/crypto.json, from 7.0 -> 7.1.
> - Remove ecdsa from qapi/crypto.json, it would be introduced with the
> implemetion later.
> - Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
> qapi/crypto.json.
> - Rename arguments of qcrypto_akcipher_XXX to keep aligned with
> qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
> qcrypto_akcipher_max_XXX APIs.
> - Add new API: qcrypto_akcipher_supports.
> - Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
> return the actual length of result.
> - Separate ASN.1 source code and test case clean.
> - Disable RSA raw encoding for akcipher-nettle.
> - Separate RSA key parser into rsakey.{hc}, and implememts it with
> builtin-asn1-decoder and nettle respectivly.
> - Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
> priority than nettle.
> - For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length
> of returned result maybe less than the dst buffer size, return the actual
> length of result instead of the buffer length to the guest side. (in function
> virtio_crypto_akcipher_input_data_helper)
> - Other minor changes.
>
> Thanks to Daniel!
>
> Eric pointed out this missing part of use case, send it here again.
>
> In our plan, the feature is designed for HTTPS offloading case and other
> applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
> shows bellow:
>
>
> Nginx/openssl[1] ... Apps
> Guest -
>virtio-crypto driver[2]
> -
>virtio-crypto backend[3]
> Host-
> / | \
> builtin[4] vhost keyctl[5] ...
>
>
> [1] User applications can offload RSA calculation to kernel by keyctl
> syscall. There is no keyctl engine in openssl currently, we developed a
> engine and tried to contribute it to openssl upstream, but openssl 1.x does
> not accept new feature. Link:
> https://github.com/openssl/openssl/pull/16689
>
> This branch is available and maintained by Lei
> https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
>
> We tested nginx(change config file only) with openssl keyctl engine, it works
> fine.
>
> [2] virtio-crypto driver is used to communicate with host side, send requests
> to host side to do asymmetric calculation.
> https://lkml.org/lkml/2022/3/1/1425
>
> [3] virtio-crypto backend handles requests from guest side, and forwards
> request to crypto backend driver of QEMU.
>
> [4] Currently RSA is supported only in builtin driver. This driver is
> supposed to test the full feature without other software(Ex vhost process)
> and hardware dependence. ecdsa is introduced into qapi type without
> implementation, this may be implemented in Q3-2022 or later. If ecdsa type
> definition should be added with the implementation together, I'll remove this
> in next version.
>
> [5] keyctl backend is in development, we will post this feature in Q2-2022.
> keyctl backend can use hardware acceleration(Ex, Intel QAT).
>
> Setup the full environment, tested with Intel QAT on host side, the QPS of
> HTTPS increase to ~200% in a guest.
>
> VS PCI passthrough: the most important benefit of this solution makes the VM
> migratable.
>
> v2 -> v3:
> - Introduce akcipher types to qapi
> - Add test/benchmark suite for akcipher class
> - Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
> - crypto: Introduce akcipher crypto class
> - virtio-crypto: Introduce RSA algorithm
>
> v1 -> v2:
> - Update virtio_crypto.h from v2 version of related kernel patch.
>
> v1:
> - Support akcipher for virtio-crypto.
> - Introduce akcipher class.
> - Introduce ASN1 decoder into QEMU.
> - Implement RSA backend by nettle/hogweed.
>
> Lei He (6):
> qapi: crypto-akcipher: Introduce akcipher types
[PATCH v5 0/9] Introduce akcipher service for virtio-crypto
Hi, Lei & MST
Daniel has started to review the akcipher framework and nettle & gcrypt
implementation, this part seems to be ready soon. Thanks a lot to Daniel!
And the last patch "crypto: Introduce RSA algorithm" handles akcipher
requests from guest and uses the new akcipher service. The new feature
can be used to test by the builtin driver. I would appreciate it if you
could review patch.
v4 -> v5:
- Move QCryptoAkCipher into akcipherpriv.h, and modify the related comments.
- Rename asn1_decoder.c to der.c.
- Code style fix: use 'cleanup' & 'error' lables.
- Allow autoptr type to auto-free.
- Add test cases for rsakey to handle DER error.
- Other minor fixes.
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 version of related kernel patch.
v1:
- Support akcipher for virtio-crypto.
- Introduce akcipher class.
- Introduce ASN1 decoder into QEMU.
- Implement RSA backend by nettle/hogweed.
Lei He (6):
qapi: crypto-akcipher: Introduce akcipher types to qapi
crypto: add ASN.1 DER decoder
crypto: Implement RSA algorithm by hogweed
crypto: Implement RSA algorithm by gcrypt
test/crypto: Add test suite for crypto akcipher
tests/crypto: Add test suite for RSA keys
Zhenwei Pi (3):
virtio-crypto: header update
crypto: Introduce akcipher crypto class
crypto: Introduce RSA algorithm
backends/cryptod
Re: PING: [PATCH v4 0/8] Introduce akcipher service for virtio-crypto
On Thu, Apr 21, 2022 at 09:41:40AM +0800, zhenwei pi wrote:
> Hi Daniel,
> Could you please review this series?
Yes, its on my to do. I've been on holiday for 2 weeks, so still catching
up on the backlog of reviews.
> On 4/11/22 18:43, zhenwei pi wrote:
> > v3 -> v4:
> > - Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
> > XXX-alg -> XXX-algo.
> > - Change version info in qapi/crypto.json, from 7.0 -> 7.1.
> > - Remove ecdsa from qapi/crypto.json, it would be introduced with the
> > implemetion later.
> > - Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
> > qapi/crypto.json.
> > - Rename arguments of qcrypto_akcipher_XXX to keep aligned with
> > qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
> > qcrypto_akcipher_max_XXX APIs.
> > - Add new API: qcrypto_akcipher_supports.
> > - Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
> > return the actual length of result.
> > - Separate ASN.1 source code and test case clean.
> > - Disable RSA raw encoding for akcipher-nettle.
> > - Separate RSA key parser into rsakey.{hc}, and implememts it with
> > builtin-asn1-decoder and nettle respectivly.
> > - Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has
> > higher priority than nettle.
> > - For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length
> > of returned result maybe less than the dst buffer size, return the actual
> > length of result instead of the buffer length to the guest side. (in
> > function virtio_crypto_akcipher_input_data_helper)
> > - Other minor changes.
> >
> > Thanks to Daniel!
> >
> > Eric pointed out this missing part of use case, send it here again.
> >
> > In our plan, the feature is designed for HTTPS offloading case and other
> > applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
> > shows bellow:
> >
> >
> >Nginx/openssl[1] ... Apps
> > Guest -
> > virtio-crypto driver[2]
> > -
> > virtio-crypto backend[3]
> > Host-
> >/ | \
> >builtin[4] vhost keyctl[5] ...
> >
> >
> > [1] User applications can offload RSA calculation to kernel by keyctl
> > syscall. There is no keyctl engine in openssl currently, we developed a
> > engine and tried to contribute it to openssl upstream, but openssl 1.x does
> > not accept new feature. Link:
> > https://github.com/openssl/openssl/pull/16689
> >
> > This branch is available and maintained by Lei
> > https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
> >
> > We tested nginx(change config file only) with openssl keyctl engine, it
> > works fine.
> >
> > [2] virtio-crypto driver is used to communicate with host side, send
> > requests to host side to do asymmetric calculation.
> > https://lkml.org/lkml/2022/3/1/1425
> >
> > [3] virtio-crypto backend handles requests from guest side, and forwards
> > request to crypto backend driver of QEMU.
> >
> > [4] Currently RSA is supported only in builtin driver. This driver is
> > supposed to test the full feature without other software(Ex vhost process)
> > and hardware dependence. ecdsa is introduced into qapi type without
> > implementation, this may be implemented in Q3-2022 or later. If ecdsa type
> > definition should be added with the implementation together, I'll remove
> > this in next version.
> >
> > [5] keyctl backend is in development, we will post this feature in Q2-2022.
> > keyctl backend can use hardware acceleration(Ex, Intel QAT).
> >
> > Setup the full environment, tested with Intel QAT on host side, the QPS of
> > HTTPS increase to ~200% in a guest.
> >
> > VS PCI passthrough: the most important benefit of this solution makes the
> > VM migratable.
> >
> > v2 -> v3:
> > - Introduce akcipher types to qapi
> > - Add test/benchmark suite for akcipher class
> > - Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
> >- crypto: Introduce akcipher crypto class
> >- virtio-crypto: Introduce RSA algorithm
> >
> > v1 -> v2:
> > - Update virtio_crypto.h from v2 version of related kernel patch.
> >
> > v1:
> > - Support akcipher for virtio-crypto.
> > - Introduce akcipher class.
> > - Introduce ASN1 decoder into QEMU.
> > - Implement RSA backend by nettle/hogweed.
> >
> > Lei He (4):
> >crypto-akcipher: Introduce akcipher types to qapi
> >crypto: add ASN.1 decoder
> >crypto: Implement RSA algorithm by hogweed
> >crypto: Implement RSA algorithm by gcrypt
> >
> > Zhenwei Pi (3):
> >virtio-crypto: header update
> >crypto: Introduce akcipher crypto class
> >crypto: Introduce RSA algorithm
> >
> > lei he (1):
> >tests/crypto: Add test suite for crypto akcipher
> >
> > backends/
PING: [PATCH v4 0/8] Introduce akcipher service for virtio-crypto
Hi Daniel,
Could you please review this series?
On 4/11/22 18:43, zhenwei pi wrote:
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 version of related kernel patch.
v1:
- Support akcipher for virtio-crypto.
- Introduce akcipher class.
- Introduce ASN1 decoder into QEMU.
- Implement RSA backend by nettle/hogweed.
Lei He (4):
crypto-akcipher: Introduce akcipher types to qapi
crypto: add ASN.1 decoder
crypto: Implement RSA algorithm by hogweed
crypto: Implement RSA algorithm by gcrypt
Zhenwei Pi (3):
virtio-crypto: header update
crypto: Introduce akcipher crypto class
crypto: Introduce RSA algorithm
lei he (1):
tests/crypto: Add test suite for crypto akcipher
backends/cryptodev-builtin.c | 261 ++-
backends/cryptodev-vhost-user.c | 34 +-
backends/cryptodev.c | 32 +-
crypto/akcipher-gcrypt.c.inc | 531 +
crypto/akcipher-nettle.c.inc | 448 +++
crypto/akcipher.c | 108 +++
crypto/akcipherpriv.h | 43 ++
crypto/asn1_decoder.c | 161
crypto/asn1_decoder.h | 75 ++
crypto/meson.build| 6 +
crypto/rsakey-builtin.c.i
Re: Re: [PATCH v4 0/8] Introduce akcipher service for virtio-crypto
On 4/12/22 17:47, Paolo Bonzini wrote: In our plan, the feature is designed for HTTPS offloading case and other applications which use kernel RSA/ecdsa by keyctl syscall. Hi Zhenwei, what is the % of time spent doing asymmetric key operations in your benchmark? I am not very familiar with crypto acceleration but my understanding has always been that most time is spent doing either hashing (for signing) or symmetric key operations (for encryption). If I understand correctly, without support for acceleration these patches are more of a demonstration of virtio-crypto, or usable for testing purposes. Hi, Paolo This is the perf result of nginx+openssl CPU calculation, the heavy load from openssl uses the most time(as same as you mentioned). 27.37%26.00% nginxlibcrypto.so.1.1 [.] __bn_sqrx8x_reduction 20.58%19.52% nginxlibcrypto.so.1.1 [.] mulx4x_internal 16.73%15.89% nginxlibcrypto.so.1.1 [.] bn_sqrx8x_internal 8.79% 0.00% nginx[unknown] [k] 7.26% 0.00% nginx[unknown] [.] 0x89388669992a0cbc 7.00% 0.00% nginx[unknown] [k] 0x45f0e480d5f2a58e 6.76% 0.02% nginx[kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe 6.74% 0.02% nginx[kernel.kallsyms] [k] do_syscall_64 6.61% 0.00% nginx[unknown] [.] 0xa75a60d7820f9ffb 6.47% 0.00% nginx[unknown] [k] 0xe91223f6da36254c 5.51% 0.01% nginx[kernel.kallsyms] [k] asm_common_interrupt 5.46% 0.01% nginx[kernel.kallsyms] [k] common_interrupt 5.16% 0.04% nginx[kernel.kallsyms] [k] __softirqentry_text_start 4.92% 0.01% nginx[kernel.kallsyms] [k] irq_exit_rcu 4.91% 0.04% nginx[kernel.kallsyms] [k] net_rx_action This is the result of nginx+openssl keyctl offload(virtio crypto + host keyctl + Intel QAT): 30.38% 0.08% nginx[kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe 30.29% 0.07% nginx[kernel.kallsyms] [k] do_syscall_64 23.84% 0.00% nginx[unknown] [k] 14.24% 0.03% nginx[kernel.kallsyms] [k] asm_common_interrupt 14.06% 0.05% nginx[kernel.kallsyms] [k] common_interrupt 12.99% 0.11% nginx[kernel.kallsyms] [k] __softirqentry_text_start 12.27% 0.12% nginx[kernel.kallsyms] [k] net_rx_action 12.13% 0.03% nginx[kernel.kallsyms] [k] __napi_poll 12.06% 0.06% nginx[kernel.kallsyms] [k] irq_exit_rcu 10.49% 0.14% nginxlibssl.so.1.1 [.] tls_process_client_key_exchange 10.21% 0.12% nginx[virtio_net] [k] virtnet_poll 10.13% 0.04% nginxlibc-2.28.so [.] syscall 10.12% 0.03% nginxkctl-engine.so[.] kctl_rsa_priv_dec 10.02% 0.02% nginxkctl-engine.so[.] kctl_hw_rsa_priv_func 9.98% 0.01% nginxlibkeyutils.so.1.10 [.] keyctl_pkey_decrypt 9.95% 0.02% nginxlibkeyutils.so.1.10 [.] keyctl 9.77% 0.03% nginx[kernel.kallsyms] [k] keyctl_pkey_e_d_s 8.97% 0.00% nginx[unknown] [k] 0x7f4adbb81f0b 8.78% 0.08% nginxlibpthread-2.28.so[.] __libc_write 8.49% 0.05% nginx[kernel.kallsyms] [k] netif_receive_skb_list_internal The RSA part gets reduced, and the QPS of https improves to ~200%. Something may be ignored in this cover letter: [4] Currently RSA is supported only in builtin driver. This driver is supposed to test the full feature without other software(Ex vhost process) and hardware dependence. -> Yes, this patch is a demonstration of virtio-crypto. [5] keyctl backend is in development, we will post this feature in Q2-2022. keyctl backend can use hardware acceleration(Ex, Intel QAT). -> This is our plan. Currently it's still in developing. Would it be possible to extend virtio-crypto to use keys already in the host keyctl, or in a PKCS#11 smartcard, so that virtio-crypto could also provide the functionality of an HSM? Or does the standard require that the keys are provided by the guest? Paolo I'm very interested in this, I'll try in Q3-2022 or later. -- zhenwei pi ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v4 0/8] Introduce akcipher service for virtio-crypto
In our plan, the feature is designed for HTTPS offloading case and other applications which use kernel RSA/ecdsa by keyctl syscall. Hi Zhenwei, what is the % of time spent doing asymmetric key operations in your benchmark? I am not very familiar with crypto acceleration but my understanding has always been that most time is spent doing either hashing (for signing) or symmetric key operations (for encryption). If I understand correctly, without support for acceleration these patches are more of a demonstration of virtio-crypto, or usable for testing purposes. Would it be possible to extend virtio-crypto to use keys already in the host keyctl, or in a PKCS#11 smartcard, so that virtio-crypto could also provide the functionality of an HSM? Or does the standard require that the keys are provided by the guest? Paolo ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
[PATCH v4 0/8] Introduce akcipher service for virtio-crypto
v3 -> v4:
- Coding style fix: Akcipher -> AkCipher, struct XXX -> XXX, Rsa -> RSA,
XXX-alg -> XXX-algo.
- Change version info in qapi/crypto.json, from 7.0 -> 7.1.
- Remove ecdsa from qapi/crypto.json, it would be introduced with the
implemetion later.
- Use QCryptoHashAlgothrim instead of QCryptoRSAHashAlgorithm(removed) in
qapi/crypto.json.
- Rename arguments of qcrypto_akcipher_XXX to keep aligned with
qcrypto_cipher_XXX(dec/enc/sign/vefiry -> in/out/in2), and add
qcrypto_akcipher_max_XXX APIs.
- Add new API: qcrypto_akcipher_supports.
- Change the return value of qcrypto_akcipher_enc/dec/sign, these functions
return the actual length of result.
- Separate ASN.1 source code and test case clean.
- Disable RSA raw encoding for akcipher-nettle.
- Separate RSA key parser into rsakey.{hc}, and implememts it with
builtin-asn1-decoder and nettle respectivly.
- Implement RSA(pkcs1 and raw encoding) algorithm by gcrypt. This has higher
priority than nettle.
- For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of
returned result maybe less than the dst buffer size, return the actual length
of result instead of the buffer length to the guest side. (in function
virtio_crypto_akcipher_input_data_helper)
- Other minor changes.
Thanks to Daniel!
Eric pointed out this missing part of use case, send it here again.
In our plan, the feature is designed for HTTPS offloading case and other
applications which use kernel RSA/ecdsa by keyctl syscall. The full picture
shows bellow:
Nginx/openssl[1] ... Apps
Guest -
virtio-crypto driver[2]
-
virtio-crypto backend[3]
Host-
/ | \
builtin[4] vhost keyctl[5] ...
[1] User applications can offload RSA calculation to kernel by keyctl syscall.
There is no keyctl engine in openssl currently, we developed a engine and tried
to contribute it to openssl upstream, but openssl 1.x does not accept new
feature. Link:
https://github.com/openssl/openssl/pull/16689
This branch is available and maintained by Lei
https://github.com/TousakaRin/openssl/tree/OpenSSL_1_1_1-kctl_engine
We tested nginx(change config file only) with openssl keyctl engine, it works
fine.
[2] virtio-crypto driver is used to communicate with host side, send requests
to host side to do asymmetric calculation.
https://lkml.org/lkml/2022/3/1/1425
[3] virtio-crypto backend handles requests from guest side, and forwards
request to crypto backend driver of QEMU.
[4] Currently RSA is supported only in builtin driver. This driver is supposed
to test the full feature without other software(Ex vhost process) and hardware
dependence. ecdsa is introduced into qapi type without implementation, this may
be implemented in Q3-2022 or later. If ecdsa type definition should be added
with the implementation together, I'll remove this in next version.
[5] keyctl backend is in development, we will post this feature in Q2-2022.
keyctl backend can use hardware acceleration(Ex, Intel QAT).
Setup the full environment, tested with Intel QAT on host side, the QPS of
HTTPS increase to ~200% in a guest.
VS PCI passthrough: the most important benefit of this solution makes the VM
migratable.
v2 -> v3:
- Introduce akcipher types to qapi
- Add test/benchmark suite for akcipher class
- Seperate 'virtio_crypto: Support virtio crypto asym operation' into:
- crypto: Introduce akcipher crypto class
- virtio-crypto: Introduce RSA algorithm
v1 -> v2:
- Update virtio_crypto.h from v2 version of related kernel patch.
v1:
- Support akcipher for virtio-crypto.
- Introduce akcipher class.
- Introduce ASN1 decoder into QEMU.
- Implement RSA backend by nettle/hogweed.
Lei He (4):
crypto-akcipher: Introduce akcipher types to qapi
crypto: add ASN.1 decoder
crypto: Implement RSA algorithm by hogweed
crypto: Implement RSA algorithm by gcrypt
Zhenwei Pi (3):
virtio-crypto: header update
crypto: Introduce akcipher crypto class
crypto: Introduce RSA algorithm
lei he (1):
tests/crypto: Add test suite for crypto akcipher
backends/cryptodev-builtin.c | 261 ++-
backends/cryptodev-vhost-user.c | 34 +-
backends/cryptodev.c | 32 +-
crypto/akcipher-gcrypt.c.inc | 531 +
crypto/akcipher-nettle.c.inc | 448 +++
crypto/akcipher.c | 108 +++
crypto/akcipherpriv.h | 43 ++
crypto/asn1_decoder.c | 161
crypto/asn1_decoder.h | 75 ++
crypto/meson.build| 6 +
crypto/rsakey-builtin.c.inc | 150
crypto/rsakey-nettle.c.inc| 141
crypto/rsakey.c
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On Tue, Apr 05, 2022 at 10:33:42AM +0200, Cornelia Huck wrote: > On Tue, Apr 05 2022, "Michael S. Tsirkin" wrote: > > > On Mon, Apr 04, 2022 at 05:39:24PM +0200, Cornelia Huck wrote: > >> On Mon, Mar 07 2022, "Michael S. Tsirkin" wrote: > >> > >> > On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote: > >> >> Hi, Michael & Lei > >> >> > >> >> The full patchset has been reviewed by Gonglei, thanks to Gonglei. > >> >> Should I modify the virtio crypto specification(use "__le32 > >> >> akcipher_algo;" > >> >> instead of "__le32 reserve;" only, see v1->v2 change), and start a new > >> >> issue > >> >> for a revoting procedure? > >> > > >> > You can but not it probably will be deferred to 1.3. OK with you? > >> > > >> >> Also cc Cornelia Huck. > >> > >> [Apologies, I'm horribly behind on my email backlog, and on virtio > >> things in general :(] > >> > >> The akcipher update had been deferred for 1.2, so I think it will be 1.3 > >> material. However, I just noticed while browsing the fine lwn.net merge > >> window summary that this seems to have been merged already. That > >> situation is less than ideal, although I don't expect any really bad > >> problems, given that there had not been any negative feedback for the > >> spec proposal that I remember. > > > > Let's open a 1.3 branch? What do you think? > > Yes, that's probably best, before things start piling up. OK, want to do it? And we can then start voting on 1.3 things straight away. -- MST ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On Tue, Apr 05 2022, "Michael S. Tsirkin" wrote: > On Mon, Apr 04, 2022 at 05:39:24PM +0200, Cornelia Huck wrote: >> On Mon, Mar 07 2022, "Michael S. Tsirkin" wrote: >> >> > On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote: >> >> Hi, Michael & Lei >> >> >> >> The full patchset has been reviewed by Gonglei, thanks to Gonglei. >> >> Should I modify the virtio crypto specification(use "__le32 >> >> akcipher_algo;" >> >> instead of "__le32 reserve;" only, see v1->v2 change), and start a new >> >> issue >> >> for a revoting procedure? >> > >> > You can but not it probably will be deferred to 1.3. OK with you? >> > >> >> Also cc Cornelia Huck. >> >> [Apologies, I'm horribly behind on my email backlog, and on virtio >> things in general :(] >> >> The akcipher update had been deferred for 1.2, so I think it will be 1.3 >> material. However, I just noticed while browsing the fine lwn.net merge >> window summary that this seems to have been merged already. That >> situation is less than ideal, although I don't expect any really bad >> problems, given that there had not been any negative feedback for the >> spec proposal that I remember. > > Let's open a 1.3 branch? What do you think? Yes, that's probably best, before things start piling up. ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On Mon, Apr 04, 2022 at 05:39:24PM +0200, Cornelia Huck wrote: > On Mon, Mar 07 2022, "Michael S. Tsirkin" wrote: > > > On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote: > >> Hi, Michael & Lei > >> > >> The full patchset has been reviewed by Gonglei, thanks to Gonglei. > >> Should I modify the virtio crypto specification(use "__le32 akcipher_algo;" > >> instead of "__le32 reserve;" only, see v1->v2 change), and start a new > >> issue > >> for a revoting procedure? > > > > You can but not it probably will be deferred to 1.3. OK with you? > > > >> Also cc Cornelia Huck. > > [Apologies, I'm horribly behind on my email backlog, and on virtio > things in general :(] > > The akcipher update had been deferred for 1.2, so I think it will be 1.3 > material. However, I just noticed while browsing the fine lwn.net merge > window summary that this seems to have been merged already. That > situation is less than ideal, although I don't expect any really bad > problems, given that there had not been any negative feedback for the > spec proposal that I remember. Let's open a 1.3 branch? What do you think? -- MST ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On Mon, Mar 07 2022, "Michael S. Tsirkin" wrote: > On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote: >> Hi, Michael & Lei >> >> The full patchset has been reviewed by Gonglei, thanks to Gonglei. >> Should I modify the virtio crypto specification(use "__le32 akcipher_algo;" >> instead of "__le32 reserve;" only, see v1->v2 change), and start a new issue >> for a revoting procedure? > > You can but not it probably will be deferred to 1.3. OK with you? > >> Also cc Cornelia Huck. [Apologies, I'm horribly behind on my email backlog, and on virtio things in general :(] The akcipher update had been deferred for 1.2, so I think it will be 1.3 material. However, I just noticed while browsing the fine lwn.net merge window summary that this seems to have been merged already. That situation is less than ideal, although I don't expect any really bad problems, given that there had not been any negative feedback for the spec proposal that I remember. ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On 3/7/22 5:05 PM, Michael S. Tsirkin wrote: On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote: Hi, Michael & Lei The full patchset has been reviewed by Gonglei, thanks to Gonglei. Should I modify the virtio crypto specification(use "__le32 akcipher_algo;" instead of "__le32 reserve;" only, see v1->v2 change), and start a new issue for a revoting procedure? You can but not it probably will be deferred to 1.3. OK with you? OK! -- zhenwei pi ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On Mon, Mar 07, 2022 at 10:42:30AM +0800, zhenwei pi wrote:
> Hi, Michael & Lei
>
> The full patchset has been reviewed by Gonglei, thanks to Gonglei.
> Should I modify the virtio crypto specification(use "__le32 akcipher_algo;"
> instead of "__le32 reserve;" only, see v1->v2 change), and start a new issue
> for a revoting procedure?
You can but not it probably will be deferred to 1.3. OK with you?
> Also cc Cornelia Huck.
>
> On 3/2/22 11:39 AM, zhenwei pi wrote:
> > v2 -> v3:
> >Rename virtio_crypto_algs.c to virtio_crypto_skcipher_algs.c, and
> > minor changes of function name.
> >Minor changes in virtio_crypto_akcipher_algs.c: no need to copy from
> > buffer if opcode is verify.
> >
> > v1 -> v2:
> >Fix 1 compiling warning reported by kernel test robot
> >Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of
> > struct virtio_crypto_config directly without size change.
> >Add padding in struct virtio_crypto_ecdsa_session_para to keep
> > 64-bit alignment.
> >Remove irrelevant change by code format alignment.
> >
> >Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org.
> >
> >Test with QEMU(patched by the v2 version), works fine.
> >
> > v1:
> >Introduce akcipher service, implement RSA algorithm, and a minor fix.
> >
> > zhenwei pi (4):
> >virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
> >virtio-crypto: introduce akcipher service
> >virtio-crypto: implement RSA algorithm
> >virtio-crypto: rename skcipher algs
> >
> > drivers/crypto/virtio/Makefile| 3 +-
> > .../virtio/virtio_crypto_akcipher_algs.c | 585 ++
> > drivers/crypto/virtio/virtio_crypto_common.h | 7 +-
> > drivers/crypto/virtio/virtio_crypto_core.c| 6 +-
> > drivers/crypto/virtio/virtio_crypto_mgr.c | 15 +-
> > ...o_algs.c => virtio_crypto_skcipher_algs.c} | 4 +-
> > include/uapi/linux/virtio_crypto.h| 82 ++-
> > 7 files changed, 693 insertions(+), 9 deletions(-)
> > create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> > rename drivers/crypto/virtio/{virtio_crypto_algs.c =>
> > virtio_crypto_skcipher_algs.c} (99%)
> >
>
> --
> zhenwei pi
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
Hi, Michael & Lei
The full patchset has been reviewed by Gonglei, thanks to Gonglei.
Should I modify the virtio crypto specification(use "__le32
akcipher_algo;" instead of "__le32 reserve;" only, see v1->v2 change),
and start a new issue for a revoting procedure?
Also cc Cornelia Huck.
On 3/2/22 11:39 AM, zhenwei pi wrote:
v2 -> v3:
Rename virtio_crypto_algs.c to virtio_crypto_skcipher_algs.c, and
minor changes of function name.
Minor changes in virtio_crypto_akcipher_algs.c: no need to copy from
buffer if opcode is verify.
v1 -> v2:
Fix 1 compiling warning reported by kernel test robot
Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of
struct virtio_crypto_config directly without size change.
Add padding in struct virtio_crypto_ecdsa_session_para to keep
64-bit alignment.
Remove irrelevant change by code format alignment.
Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org.
Test with QEMU(patched by the v2 version), works fine.
v1:
Introduce akcipher service, implement RSA algorithm, and a minor fix.
zhenwei pi (4):
virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
virtio-crypto: introduce akcipher service
virtio-crypto: implement RSA algorithm
virtio-crypto: rename skcipher algs
drivers/crypto/virtio/Makefile| 3 +-
.../virtio/virtio_crypto_akcipher_algs.c | 585 ++
drivers/crypto/virtio/virtio_crypto_common.h | 7 +-
drivers/crypto/virtio/virtio_crypto_core.c| 6 +-
drivers/crypto/virtio/virtio_crypto_mgr.c | 15 +-
...o_algs.c => virtio_crypto_skcipher_algs.c} | 4 +-
include/uapi/linux/virtio_crypto.h| 82 ++-
7 files changed, 693 insertions(+), 9 deletions(-)
create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
rename drivers/crypto/virtio/{virtio_crypto_algs.c =>
virtio_crypto_skcipher_algs.c} (99%)
--
zhenwei pi
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: Re: [PATCH v3 0/4] Introduce akcipher service for virtio-crypto
On 3/3/22 4:40 AM, Eric Biggers wrote:
On Wed, Mar 02, 2022 at 11:39:13AM +0800, zhenwei pi wrote:
v2 -> v3:
Rename virtio_crypto_algs.c to virtio_crypto_skcipher_algs.c, and
minor changes of function name.
Minor changes in virtio_crypto_akcipher_algs.c: no need to copy from
buffer if opcode is verify.
v1 -> v2:
Fix 1 compiling warning reported by kernel test robot
Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of
struct virtio_crypto_config directly without size change.
Add padding in struct virtio_crypto_ecdsa_session_para to keep
64-bit alignment.
Remove irrelevant change by code format alignment.
Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org.
Test with QEMU(patched by the v2 version), works fine.
v1:
Introduce akcipher service, implement RSA algorithm, and a minor fix.
zhenwei pi (4):
virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
virtio-crypto: introduce akcipher service
virtio-crypto: implement RSA algorithm
virtio-crypto: rename skcipher algs
drivers/crypto/virtio/Makefile| 3 +-
.../virtio/virtio_crypto_akcipher_algs.c | 585 ++
drivers/crypto/virtio/virtio_crypto_common.h | 7 +-
drivers/crypto/virtio/virtio_crypto_core.c| 6 +-
drivers/crypto/virtio/virtio_crypto_mgr.c | 15 +-
...o_algs.c => virtio_crypto_skcipher_algs.c} | 4 +-
include/uapi/linux/virtio_crypto.h| 82 ++-
7 files changed, 693 insertions(+), 9 deletions(-)
create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
rename drivers/crypto/virtio/{virtio_crypto_algs.c =>
virtio_crypto_skcipher_algs.c} (99%)
Why is this patchset useful? That isn't explained anywhere.
- Eric
Sorry about this missing part.
This feature provides akcipher service offloading capability for guest
side. And I also sent a patchset of QEMU:
https://patchwork.kernel.org/project/qemu-devel/cover/20220211084335.1254281-1-pizhen...@bytedance.com/
The two patchsets work together, guest side sends
encrypt/decrypt/sign/verify requests to host side, host side handles
request and return response to the guest.
--
zhenwei pi
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
[PATCH v3 0/4] Introduce akcipher service for virtio-crypto
v2 -> v3:
Rename virtio_crypto_algs.c to virtio_crypto_skcipher_algs.c, and
minor changes of function name.
Minor changes in virtio_crypto_akcipher_algs.c: no need to copy from
buffer if opcode is verify.
v1 -> v2:
Fix 1 compiling warning reported by kernel test robot
Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of
struct virtio_crypto_config directly without size change.
Add padding in struct virtio_crypto_ecdsa_session_para to keep
64-bit alignment.
Remove irrelevant change by code format alignment.
Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org.
Test with QEMU(patched by the v2 version), works fine.
v1:
Introduce akcipher service, implement RSA algorithm, and a minor fix.
zhenwei pi (4):
virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
virtio-crypto: introduce akcipher service
virtio-crypto: implement RSA algorithm
virtio-crypto: rename skcipher algs
drivers/crypto/virtio/Makefile| 3 +-
.../virtio/virtio_crypto_akcipher_algs.c | 585 ++
drivers/crypto/virtio/virtio_crypto_common.h | 7 +-
drivers/crypto/virtio/virtio_crypto_core.c| 6 +-
drivers/crypto/virtio/virtio_crypto_mgr.c | 15 +-
...o_algs.c => virtio_crypto_skcipher_algs.c} | 4 +-
include/uapi/linux/virtio_crypto.h| 82 ++-
7 files changed, 693 insertions(+), 9 deletions(-)
create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
rename drivers/crypto/virtio/{virtio_crypto_algs.c =>
virtio_crypto_skcipher_algs.c} (99%)
--
2.20.1
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
PING: [PATCH v2 0/3] Introduce akcipher service for virtio-crypto
Hi, Lei Could you please review the V2 version? On 2/11/22 4:41 PM, zhenwei pi wrote: v1 -> v2: - Fix 1 compiling warning reported by kernel test robot - Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of struct virtio_crypto_config directly without size change. - Add padding in struct virtio_crypto_ecdsa_session_para to keep 64-bit alignment. - Remove irrelevant change by code format alignment. - Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org. - Test with QEMU(patched by the v2 version), works fine. v1: - Introduce akcipher service, implement RSA algorithm, and a minor fix. zhenwei pi (3): virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC virtio-crypto: introduce akcipher service virtio-crypto: implement RSA algorithm drivers/crypto/virtio/Makefile| 1 + .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ drivers/crypto/virtio/virtio_crypto_common.h | 3 + drivers/crypto/virtio/virtio_crypto_core.c| 6 +- drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + include/uapi/linux/virtio_crypto.h| 82 ++- 6 files changed, 685 insertions(+), 2 deletions(-) create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c -- zhenwei pi ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
[PATCH v2 0/3] Introduce akcipher service for virtio-crypto
v1 -> v2: - Fix 1 compiling warning reported by kernel test robot - Put "__le32 akcipher_algo;" instead of "__le32 reserve;" field of struct virtio_crypto_config directly without size change. - Add padding in struct virtio_crypto_ecdsa_session_para to keep 64-bit alignment. - Remove irrelevant change by code format alignment. - Also CC crypto gurus Herbert and linux-cry...@vger.kernel.org. - Test with QEMU(patched by the v2 version), works fine. v1: - Introduce akcipher service, implement RSA algorithm, and a minor fix. zhenwei pi (3): virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC virtio-crypto: introduce akcipher service virtio-crypto: implement RSA algorithm drivers/crypto/virtio/Makefile| 1 + .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ drivers/crypto/virtio/virtio_crypto_common.h | 3 + drivers/crypto/virtio/virtio_crypto_core.c| 6 +- drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + include/uapi/linux/virtio_crypto.h| 82 ++- 6 files changed, 685 insertions(+), 2 deletions(-) create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c -- 2.20.1 ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: PING: [PATCH 0/3] Introduce akcipher service for virtio-crypto
On Thu, Feb 10, 2022 at 03:17:38PM +0800, Jason Wang wrote: > On Thu, Feb 10, 2022 at 2:58 PM zhenwei pi wrote: > > > > PING! > > I think it would be helpful to get ack/reviewing from crypto gurus. For sure, but with the robot warning some people might just assume there's a problem and wait for the next version to review. Just post v2, don't forget the changelog. > Maybe Herbert? > > Thanks > > > > > PS: Please ignore the warning from kernel test robot, I'll fix it in > > next version. > > > > On 1/21/22 10:24 AM, zhenwei pi wrote: > > > Introduce akcipher service, implement RSA algorithm, and a minor fix. > > > > > > zhenwei pi (3): > > >virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC > > >virtio-crypto: introduce akcipher service > > >virtio-crypto: implement RSA algorithm > > > > > > drivers/crypto/virtio/Makefile| 1 + > > > .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ > > > drivers/crypto/virtio/virtio_crypto_common.h | 3 + > > > drivers/crypto/virtio/virtio_crypto_core.c| 6 +- > > > drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + > > > include/uapi/linux/virtio_crypto.h| 98 ++- > > > 6 files changed, 693 insertions(+), 10 deletions(-) > > > create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c > > > > > > > -- > > zhenwei pi > > ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Re: PING: [PATCH 0/3] Introduce akcipher service for virtio-crypto
On Thu, Feb 10, 2022 at 2:58 PM zhenwei pi wrote: > > PING! I think it would be helpful to get ack/reviewing from crypto gurus. Maybe Herbert? Thanks > > PS: Please ignore the warning from kernel test robot, I'll fix it in > next version. > > On 1/21/22 10:24 AM, zhenwei pi wrote: > > Introduce akcipher service, implement RSA algorithm, and a minor fix. > > > > zhenwei pi (3): > >virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC > >virtio-crypto: introduce akcipher service > >virtio-crypto: implement RSA algorithm > > > > drivers/crypto/virtio/Makefile| 1 + > > .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ > > drivers/crypto/virtio/virtio_crypto_common.h | 3 + > > drivers/crypto/virtio/virtio_crypto_core.c| 6 +- > > drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + > > include/uapi/linux/virtio_crypto.h| 98 ++- > > 6 files changed, 693 insertions(+), 10 deletions(-) > > create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c > > > > -- > zhenwei pi > ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
PING: [PATCH 0/3] Introduce akcipher service for virtio-crypto
PING! PS: Please ignore the warning from kernel test robot, I'll fix it in next version. On 1/21/22 10:24 AM, zhenwei pi wrote: Introduce akcipher service, implement RSA algorithm, and a minor fix. zhenwei pi (3): virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC virtio-crypto: introduce akcipher service virtio-crypto: implement RSA algorithm drivers/crypto/virtio/Makefile| 1 + .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ drivers/crypto/virtio/virtio_crypto_common.h | 3 + drivers/crypto/virtio/virtio_crypto_core.c| 6 +- drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + include/uapi/linux/virtio_crypto.h| 98 ++- 6 files changed, 693 insertions(+), 10 deletions(-) create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c -- zhenwei pi ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
[PATCH 0/3] Introduce akcipher service for virtio-crypto
Introduce akcipher service, implement RSA algorithm, and a minor fix. zhenwei pi (3): virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC virtio-crypto: introduce akcipher service virtio-crypto: implement RSA algorithm drivers/crypto/virtio/Makefile| 1 + .../virtio/virtio_crypto_akcipher_algo.c | 584 ++ drivers/crypto/virtio/virtio_crypto_common.h | 3 + drivers/crypto/virtio/virtio_crypto_core.c| 6 +- drivers/crypto/virtio/virtio_crypto_mgr.c | 11 + include/uapi/linux/virtio_crypto.h| 98 ++- 6 files changed, 693 insertions(+), 10 deletions(-) create mode 100644 drivers/crypto/virtio/virtio_crypto_akcipher_algo.c -- 2.25.1 ___ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
