Hacker News Reader

Comment by CyberRabbi | Hacker News Reader

To be fair the hardware in question is not just accelerated crypto operations. From what I’ve read on this topic there are network cards that handle the end-to-end TLS protocol (sans negotiation).

In general you have a point but it’s a judgement call like many things in engineering. Even in the absence of specialized TLS hardware, TLS operations are so common, there is a strong case for pushing it in the kernel if that improves efficiency by a double digit percentage.

SSL_sendfile in particular is an efficiency boon for large static site hosts, it could result in significantly less hardware waste and/or reduced power consumption.

View on HN

But if we're talking about offloading to a NIC, that can often be accessed directly from userspace, with a lot less kernel complexity.

Pushing complexity into the kernel only makes sense when it's not immediately thereafter offloaded to easily-isolated hardware.

> that can often be accessed directly from userspace, with a lot less kernel complexity.

Can you be more specific? Is this something that could be done with non-root privileges and without explicit coordination? Like normal TCP sockets?

This is how it normally looks:

Modern hardware interacts with software ("drivers") by ringbuffers & data areas.

To support this use case, the hardware generally provides multiple "logical devices". For example, https://en.wikipedia.org/wiki/Single-root_input/output_virtu.... They're defined so that handing an untrusted party control of a logical device limits what they can do, e.g. what VLANs or other network overlays they can interact with. Each one gets its own ringbuffers etc.

Another use case for the same hardware idea is virtual machines. Here, you can think of a userspace process as a virtual machine, minus all the overheads and pretense of being a whole computer.

A userspace process is given access to the memory areas containing ringbuffers & data areas for a logical NIC. A library acts as a driver, and controls the NIC. All interaction is just reads & writes to memory, after setup the kernel is not involved at all.

But in this setup, only a single process can use the logical device provided by the NIC. In kTLS case then multiple processes can share the logical device transparently.

Sure, but there's usually something like 16 logical devices even in the less fancy hardware. And we're talking about nginx, generally there's only one of those -- the VM use case demands more, and that's the primary demand for the feature.

Reply on news.ycombinator.com