provider HW GCM can not work

[3Miracle]

Under the provider branch I can only use SW's GCM encryption, and can't use HW's GCM encryption anyway

[3Miracle]

And this is the output:
speed: unable to load provider qatprovider
Hint: use -provider-path option or OPENSSL_MODULES environment variable.
80622D16627F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:crypto/dso/dso_dlfcn.c:118:filename(/usr/local/ssl_qat/lib64/ossl-modules/qatprovider.so): /usr/local/ssl_qat/lib64/ossl-modules/qatprovider.so: undefined symbol: hw_support
80622D16627F0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:crypto/dso/dso_lib.c:152:
80622D16627F0000:error:078C0105:common libcrypto routines:provider_init:init fail:crypto/provider_core.c:920:name=qatprovider

[Yogaraj-Alamenda]

Can you share your build configure used for building qatprovider.

[3Miracle]

./configure --with-openssl_install_dir=/usr/local/ssl_qat/ --enable-qat_sw --enable-qat_provider
and I have "make uninstall" "make clean" "make distclean" before recompiling

[Yogaraj-Alamenda]

For enabling QAT_HW GCM.. you will have to use configure like below.

./configure --with-qat_hw_dir= --with-openssl_install_dir=/usr/local/ssl_qat/ --enable-qat_provider --enable-qat_hw_gcm

[3Miracle]

Sorry, HW GCM provider can work normally after I "make uninstall" "make clean" "make distclean", but HW GCM neither provider nor engine performance has improved. Does Intel have related optimizations? When I recompile SW with the above configuration, then I can't switch to SW，the output of "./openssl engine -t -c -v qatengine":
(qatengine) Reference implementation of QAT crypto engine(qat_hw) v0.6.14
[RSA, DSA, DH, AES-128-CBC-HMAC-SHA1, AES-128-CBC-HMAC-SHA256, AES-256-CBC-HMAC-SHA1, AES-256-CBC-HMAC-SHA256, id-aes128-GCM, id-aes192-GCM, id-aes256-GCM]
[ available ]
ENABLE_EXTERNAL_POLLING, POLL, SET_INSTANCE_FOR_THREAD,
GET_NUM_OP_RETRIES, SET_MAX_RETRY_COUNT, SET_INTERNAL_POLL_INTERVAL,
GET_EXTERNAL_POLLING_FD, ENABLE_EVENT_DRIVEN_POLLING_MODE,
GET_NUM_CRYPTO_INSTANCES, DISABLE_EVENT_DRIVEN_POLLING_MODE,
SET_EPOLL_TIMEOUT, SET_CRYPTO_SMALL_PACKET_OFFLOAD_THRESHOLD,
ENABLE_INLINE_POLLING, ENABLE_HEURISTIC_POLLING,
GET_NUM_REQUESTS_IN_FLIGHT, INIT_ENGINE, SET_CONFIGURATION_SECTION_NAME,
ENABLE_SW_FALLBACK, HEARTBEAT_POLL, DISABLE_QAT_OFFLOAD, HW_ALGO_BITMAP

[3Miracle]

thank you for your sincerely replay,and another question:I can't add enable_qat_sw_heuristic_timeout and enable_qat_hw_small_pkt_offload at Engine compile time，this doesn't change anything.

[3Miracle]

and third question:When I use OpenSSL1.1.1d, there is no performance improvement using GCM with SW, when I use gdb, I observe that it does not call vaesgcm_ciphers_do_cipher(), and when I use OpenSSL3.0 calling SW GCM can see obvious performance improvement , because it calls the above vaes instruction set operation function, so I want to ask how OpenSSL1.1.1 can correctly call the vaes function

[Yogaraj-Alamenda]

Please find answers to your 3 questions

1. QAT_HW GCM is disabled by default and can be enabled using the flag --enable-qat_hw_gcm
2. --enable-qat_sw_heuristic_timeout is for QAT_SW internal polling timeout and it doesnt have any relation with GCM.
   --enable-qat_hw_small_pkt_offload is to enable offload of small packet <2048 bytes . Currently all GCM packets are offload by default with the flag --enable-qat_hw_gcm
3. Can you enable debug (--enable-qat_debug) and share me the debug logs if possible ?

[3Miracle]

1.I have turned on --enable-qat_hw_gcm at compile time before, and I confirmed that qat_hw_gcm.c is called correctly, but there is no performance improvement, but there will be a large performance drop sometimes, so I want to know that this is because HW GCM performance is inherently Is this the case? and if so, does Intel have a relevant optimization plan.Or is there something wrong with my use? thanks
2.yeah,Because GCM uses time period for polling by default, I want to use heuristic_timeout poll to see if it can achieve better results, but it is still turned off by default in Makefile after compiling with --enable-qat_sw_heuristic_timeout flag;
Can I understand this way : when --disable-qat_hw_small_pkt_offload ,the packets < 2048 bytes by default using OpenSSL software implementation.
3.I will share you debug logs later.thank you very much！！！

[Yogaraj-Alamenda]

Hi @3Miracle please find the answers below

1. yes that is the reason why it is disabled by default, We do have QAT_SW GCM acceleration using CPU ( from 3rd Generation Intel XEON) . Please refer build sectionfor QAT_SW target and QAT_SW requirement section for enabling this. You need to have 3rd Generation Intel® Xeon® Scalable Processors family platform for this.
2. By default small packet less than 2K is not offloaded due to performance reasons --enable-qat_hw_small_pkt_offoad will offload all packets to Hardware. heuristic timeout poll flag is for QAT_SW to dynamically optimize polling timer based on the load.