intel / QAT_Engine

Intel QuickAssist Technology( QAT) OpenSSL Engine (an OpenSSL Plug-In Engine) which provides cryptographic acceleration for both hardware and optimized software using Intel QuickAssist Technology enabled Intel platforms. https://developer.intel.com/quickassist
BSD 3-Clause "New" or "Revised" License
409 stars 128 forks source link

question about QAT_HW and QAT_SW Co-existence #326

Closed gaozhangfei closed 2 months ago

gaozhangfei commented 3 months ago

Hi

If both enable QAT_HW and QAT_SW, can it switch to SW when HW bandwidth resources is busy, and switch back to SW when HW resources is free again?

From https://github.com/intel/QAT_Engine/blob/master/docs/qat_coex.md For those algorithms that can achieve stronger performance with QAT_HW, the request will be offloaded to QAT_HW first, and after QAT_HW capacity is reached, it will be processed through QAT_SW. These algorithms include: RSA-2K/3K/4K, ECDSA-P384, ECDH-P256/P384/X25519, SM4-CBC(2048-16384 bytes).

Only find "after QAT_HW capacity is reached", is it mean get_instance, which is instances numbers instead of HW bandwidth.

(inst_num = get_instance(QAT_INSTANCE_ASYM, qat_svm)) == QAT_INVALID_INSTANCE) { WARN("Failed to get an instance\n"); if (qat_get_sw_fallback_enabled()) { CRYPTO_QAT_LOG("Failed to get an instance - fallback to SW - %s\n", func); *fallback = 1;

Can we switch from HW and SW according to HW bandwidth capability?

Thanks

venkatesh6911 commented 3 months ago

Currently, the QAT_HW resource capacity is not being tracked. We rely on the status message CPA_STATUS_RETRY to do the switch to QAT_SW. This status message is returned when the requests are unable to process by the QAT_HW API at any point of time. https://github.com/intel/QAT_Engine/blob/b109a0a7678cca0a0a8ad0d35db519a13c9e88cc/qat_hw_rsa.c#L283 `sts = cpaCyRsaDecrypt(qat_instance_handles[inst_num], qat_rsaCallbackFn, &op_done, dec_op_data, output_buf); }

endif

    STOP_RDTSC(&qat_hw_rsa_dec_req_submit, 1, "[QAT HW RSA: submit]");
    if (sts == CPA_STATUS_RETRY) {
        DEBUG("cpaCyRsaDecrypt Retry \n");
        if (qat_rsa_coexist) {
            START_RDTSC(&qat_hw_rsa_dec_req_retry);
            ++num_rsa_priv_retry;
            qat_sw_rsa_priv_req += QAT_SW_SWITCH_MB8;
            *fallback = 1;
            qat_cleanup_op_done(&op_done);
            STOP_RDTSC(&qat_hw_rsa_dec_req_retry, 1, "[QAT HW RSA: retry]");
            return 0;
        }.....`

If the QAT_HW API does not return RETRY, then it will continue to process the requests with QAT_HW.

gaozhangfei commented 3 months ago

Thanks @venkatesh6911 for the clarification.

gaozhangfei commented 3 months ago

Hi, @venkatesh6911

Excuse me for more question to double check.

Does Intel qat hardware like Sapphire Rapids has the capability checking qat accelerator bandwidth?

The instance number does not mean bandwidth, right? For example, sometimes 1 instance may take lots of bandwidth. (inst_num = get_instance(QAT_INSTANCE_ASYM, qat_svm))

Any plan to consider checking accelerator bandwidth in qat engine?

Thanks

venkatesh6911 commented 2 months ago

You are right. Instance number is not bandwidth. I assume that accelerator bandwidth meaning utilization for each QAT device ? No plan to include the utilization measurement in near future.

gaozhangfei commented 2 months ago

Thanks @venkatesh6911