Features/VirtioCrypto: Difference between revisions

Latest revision as of 19:41, 30 September 2023

The virtio crypto is a virtual crypto device as well as a kind of virtual hardware accelerator for virtual machines. The encryption and decryption requests are placed in the data queue and handled by the real crypto accelerators finally. The second queue is the control queue used to create or destroy sessions for symmetric algorithms and control some advanced features in the future. The virtio crypto device provides the following crypto services: CIPHER, MAC, HASH, AEAD etc.

Feature maintainers

Gonglei: <arei.gonglei@huawei.com>

Code

Virtio-crypto specification: Gonglei's virtio.git
Virtio-crypto linux driver: Gonglei's virtio-crypto-linux-driver.git
QEMU: Gonglei's qemu.git
Cryptodev-linux: Cryptodev-linux's website Cryptodev-linux is implemented as a standalone module that requires no dependencies other than a stock linux kernel.

Quickstart

Host:

Step 1: Build Qemu with gcrypt or nettle cryptography support

 $ git clone -b virtio-crypto https://github.com/gongleiarei/qemu
 $ cd qemu
 $ ./configure --target-list=x86_64-softmmu
 $ make

Step 2: Strat Qemu using the following parameters:

 $ qemu-system-x86_64 \
   [...] \
       -object cryptodev-backend-builtin,id=cryptodev0 \
       -device virtio-crypto-pci,id=crypto0,cryptodev=cryptodev0 \
   [...]

Guest:

Step 1: get the newest virtio-crypto linux driver which was merged in Linux master tree.

 $ git clone https://github.com/torvalds/linux.git
 $ make; make modules_install; make install
 $ reboot; # with the newest linux kernel

Step 2: use cryptodev-linux test the crypto functions

Testing

Use the cryptodev-linux module to test the crypto functions in the guest.

$ git clone https://github.com/cryptodev-linux/cryptodev-linux.git
$ cd cryptodev-linux
$ make; make install
$ insmod cryptodev.ko
$ cd tests
$ make
$ ./cipher -
requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
AES Test passed
requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
Test passed

A simple benchmark in the cryptodev-linux module (synchronous encryption in the guest and no hardware accelerator in the host)

$ ./speed
 Testing AES-128-CBC cipher: 
       Encrypting in chunks of 512 bytes: done. 85.10 MB in 5.00 secs: 17.02 MB/sec
       Encrypting in chunks of 1024 bytes: done. 162.98 MB in 5.00 secs: 32.59 MB/sec
       Encrypting in chunks of 2048 bytes: done. 292.93 MB in 5.00 secs: 58.58 MB/sec
       Encrypting in chunks of 4096 bytes: done. 500.77 MB in 5.00 secs: 100.14 MB/sec
       Encrypting in chunks of 8192 bytes: done. 766.14 MB in 5.00 secs: 153.20 MB/sec
       Encrypting in chunks of 16384 bytes: done. 1.05 GB in 5.00 secs: 0.21 GB/sec
       Encrypting in chunks of 32768 bytes: done. 1.31 GB in 5.00 secs: 0.26 GB/sec
       Encrypting in chunks of 65536 bytes: done. 1.51 GB in 5.00 secs: 0.30 GB/sec

Links

China Linux Kernel Conference 2015 presentation: A new framework of cryptography virtio driver (pdf)

@@ Line 1: / Line 1: @@
-The virtio crypto device is a virtual crypto device, and is a kind of
+The virtio crypto is a virtual crypto device as well as a kind of
-virtual hardware accelerator for virtual machines.  The encryption and
+virtual hardware accelerator for virtual machines. The encryption and
-decryption requests are placed in the data queue, and handled by the
+decryption requests are placed in the data queue and handled by the
-real crypto accelerators finally. The second queue is the control queue,
+real crypto accelerators finally. The second queue is the control queue used to create or destroy sessions for symmetric algorithms and
-which is used to create or destroy sessions for symmetric algorithms, and
 control some advanced features in the future. The virtio crypto
-device can provide seven crypto services: CIPHER, MAC, HASH, AEAD,
+device provides the following crypto services: CIPHER, MAC, HASH, AEAD etc.
-KDF, ASYM, PRIMITIVE.
 == Feature maintainers ==
@@ Line 18: / Line 16: @@
 ==Quickstart==
-Host:
+'''Host:'''
-* Step 1: Use the cryptodev-linux as the client, the cryptodev.ko should be insert on the host.
+* Step 1: Build Qemu with '''gcrypt''' or '''nettle''' cryptography support
-Cryptodev:
-  $ git clone https://github.com/cryptodev-linux/cryptodev-linux.git
-  $ cd cryptodev-linux
-  $ make; make install
-* Step 2: Build qemu with cryptodev-linux support
-QEMU:
    $ git clone -b virtio-crypto https://github.com/gongleiarei/qemu
    $ cd qemu
@@ Line 34: / Line 24: @@
    $ make
-Guest:
+* Step 2: Strat Qemu using the following parameters:
+  $ qemu-system-x86_64 \
+    [...] \
+        -object cryptodev-backend-builtin,id=cryptodev0 \
+        -device virtio-crypto-pci,id=crypto0,cryptodev=cryptodev0 \
+    [...]
-  $ git clone https://github.com/gongleiarei/virtio-crypto-linux-driver.git
-  $ cd virtio-crypto-linux-driver
-  $ make;make install
-To use vhost_vsock.ko you must boot into the new host kernel and modprobe vhost_vsock.
+'''Guest:'''
+* Step 1: get the newest virtio-crypto linux driver which was merged in Linux master tree.
-The guest should also use the kernel so that modprobe virtio_transport can load the vsock guest driver.
+  $ git clone https://github.com/torvalds/linux.git
+  $ make; make modules_install; make install
+  $ reboot; # with the newest linux kernel
-For details on host and guest boot, see [https://github.com/stefanha/linux/blob/vsock-extras/go.sh go.sh].  Use nc-vsock 2 1234 inside the guest to connect to vsock port 1234 on the host.  Use nc-vsock -l 1234 on the host to listen on that port.
+* Step 2: use cryptodev-linux test the crypto functions
 ==Testing==
-The vhost-vsock-test qtest replays packets from a JSON file and verifies that the expected reply is received.
+Use the cryptodev-linux module to test the crypto functions in the guest.
-The JSON test file format is described in a [https://github.com/stefanha/qemu/blob/vsock/tests/vhost-vsock-test-data/README README].
-  $ cd qemu
-  $ make -j4
-  $ make tests/vhost-vsock-test
-  $ sudo QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img MALLOC_PERTURB_=${MALLOC_PERTURB_:-$((RANDOM % 255 + 1))} gtester -k --verbose -m=quick tests/vhost-vsock-test -o /dev/stderr
-Create and edit test cases in tests/vhost-vsock-test-data/*.json.
+ $ git clone https://github.com/cryptodev-linux/cryptodev-linux.git
+ $ cd cryptodev-linux
+ $ make; make install
+ $ insmod cryptodev.ko
+ $ cd tests
+ $ make
+ $ ./cipher -
+ requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
+ AES Test passed
+ requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
+ requested cipher CRYPTO_AES_CBC, got cbc(aes) with driver virtio_crypto_aes_cbc
+ Test passed
+A simple benchmark in the cryptodev-linux module (synchronous encryption in the guest and no hardware accelerator in the host)
+ $ ./speed
+  Testing AES-128-CBC cipher:
+        Encrypting in chunks of 512 bytes: done. 85.10 MB in 5.00 secs: 17.02 MB/sec
+        Encrypting in chunks of 1024 bytes: done. 162.98 MB in 5.00 secs: 32.59 MB/sec
+        Encrypting in chunks of 2048 bytes: done. 292.93 MB in 5.00 secs: 58.58 MB/sec
+        Encrypting in chunks of 4096 bytes: done. 500.77 MB in 5.00 secs: 100.14 MB/sec
+        Encrypting in chunks of 8192 bytes: done. 766.14 MB in 5.00 secs: 153.20 MB/sec
+        Encrypting in chunks of 16384 bytes: done. 1.05 GB in 5.00 secs: 0.21 GB/sec
+        Encrypting in chunks of 32768 bytes: done. 1.31 GB in 5.00 secs: 0.26 GB/sec
+        Encrypting in chunks of 65536 bytes: done. 1.51 GB in 5.00 secs: 0.30 GB/sec
 ==Links==
-* KVM Forum 2015 presentation: [http://vmsplice.net/~stefan/stefanha-kvm-forum-2015.pdf virtio-vsock: Zero-configuration host/guest communication] (pdf)
+* China Linux Kernel Conference 2015 presentation: [https://privatewiki.opnfv.org/_media/dpacc/a_new_framework_of_cryptography_virtio_driver.pdf A new framework of cryptography virtio driver] (pdf)
-* Connectathon 2016 presentation: [http://vmsplice.net/~stefan/stefanha-connectathon-2016.pdf NFS over virtio-vsock: Host/guest file sharing for virtual machines] (pdf)