Bug 1968540

Summary:	Use KTLS in QEMU Live Migration over TLS
Product:	Red Hat Enterprise Linux 9	Reporter:	Leonardo Bras <leobras>
Component:	qemu-kvm	Assignee:	Leonardo Bras <leobras>
qemu-kvm sub component:	Live Migration	QA Contact:	Li Xiaohui <xiaohli>
Status:	CLOSED NOTABUG	Docs Contact:
Severity:	unspecified
Priority:	medium	CC:	chayang, mdean, virt-maint, yafu
Version:	9.0	Keywords:	RFE, Triaged
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-17 18:39:50 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Leonardo Bras 2021-06-07 14:11:46 UTC

Description of problem:

KTLS is a Linux Kernel implementation of the TLS protocol.

Using it give the application access to features such as hardware offloading, and 'zerocopy' on sending, due to encryption being handled in kernel space. (It encrypts directly in the desired send buffer)

Having KTLS in QEMU live migration may save up a significant amount of cpu time, and probably improve Live Migration performance.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Leonardo Bras 2021-06-07 14:47:31 UTC

I did some studying on KTLS usage, and tried to understand how to apply that on QEMU.

After some reading in the theme, and talking to David Gilbert, I found out GnuTLS (which is currently used in QEMU) is already implementing this:
https://gitlab.com/gnutls/gnutls/-/issues/1113 

I did some reading in the QEMU code that interfaces with GnuTLS, and even tested some WIP code.

Next steps:
- Wait for this feature to be completed (merge request in gitlab),
- Make the required changes in QEMU to make use of KTLS,
- Help reviewing the change in GnuTLS, sending any acquired numbers,
- Send QEMU change upstream.

Comment 2 John Ferlan 2021-09-08 21:28:07 UTC

Move RHEL-AV bugs to RHEL9. If necessary to resolve in RHEL8, then clone to the current RHEL8 release.