Intel QAT Zstd, QAT Gen6 Improvements Merged For Linux 7.1

The Linux 7.1 kernel merge window has closed with substantial cryptographic improvements, headlined by Intel's QuickAssist Technology (QAT) enhancements that bring Zstandard compression offload and Gen6 security features to the mainline kernel. These changes represent a significant leap forward in hardware-accelerated cryptography for Intel's accelerator ecosystem.

Zstandard Compression Offload

The most notable addition is native Zstd offload support for Intel QAT accelerators. This implementation differs significantly between generations:

QAT Gen4/Gen5: Basic Zstandard crypto offload support has been introduced, providing hardware acceleration for compression workloads. These earlier generation accelerators support Zstd compression but lack the comprehensive feature set of their successors.

QAT Gen6 (Diamond Rapids): A cleaner, native Zstd compression implementation has been developed, with the critical addition of decompression offload capabilities. Previous QAT versions only supported compression, making Gen6 the first to handle both compression and decompression in hardware. This bidirectional support is particularly valuable for applications that need to both compress data for storage/transmission and decompress it for processing.

Zstandard (Zstd) is increasingly becoming the compression standard of choice due to its excellent compression ratios and speed characteristics. Hardware offloading this computationally intensive task can yield substantial performance improvements, particularly for data center workloads involving large-scale data processing, storage optimization, and network transmission.

QAT Gen6 Security Enhancements

The Gen6 implementation introduces a new "anti-rollback" security feature designed to prevent downgrade attacks. This mechanism ensures that older versions of QAT firmware cannot be installed on Gen6 hardware, protecting against potential security vulnerabilities that may have been discovered and patched in newer firmware releases.

This anti-rollback capability is becoming increasingly common in modern hardware security implementations, following the pattern established by mobile device security where firmware and software versions can be locked to prevent exploitation of known vulnerabilities in older releases.

Wireless Mode Support

Gen6 hardware also gains new wireless mode support, though specific details about this capability weren't disclosed in the merge notes. This suggests Intel is expanding QAT's applicability beyond traditional server and networking use cases into wireless infrastructure, potentially for 5G/6G base stations or other wireless processing applications where cryptographic acceleration is beneficial.

Other Cryptography Subsystem Changes

Beyond the Intel QAT work, the Linux 7.1 cryptography pull includes several other significant changes:

TI DTHEv2 Driver Updates: The Texas Instruments DTHEv2 driver has been enhanced with support for CTR(AES), GCM(AES), and CCM(AES) algorithms. These are essential cryptographic primitives used in various security protocols and applications, expanding the driver's utility in embedded and specialized hardware contexts.

DES/3DES Removal: Legacy CPU-based DES and 3DES acceleration code has been removed from the crypto subsystem. These algorithms are considered cryptographically weak by modern standards and their removal helps reduce kernel complexity and attack surface.

SIMD SKCIPHER Removal: The SIMD SKCIPHER support has been eliminated from the crypto API due to lack of usage. This cleanup reflects the kernel development principle of removing unused code paths to maintain a lean, maintainable codebase.

The full list of cryptography subsystem changes is available in the official pull request, providing detailed technical information for developers working with these cryptographic interfaces.

Performance and Market Implications

These QAT improvements arrive at a critical time when data center operators are increasingly focused on performance-per-watt metrics and security hardening. Hardware-accelerated Zstd compression can significantly reduce CPU overhead for compression-intensive workloads, allowing general-purpose cores to focus on application logic rather than data transformation tasks.

The Gen6 anti-rollback feature addresses growing enterprise concerns about firmware supply chain security, providing a hardware-enforced mechanism to ensure cryptographic accelerators always run the most secure firmware version available.

For organizations already invested in Intel's QAT ecosystem, these improvements provide clear upgrade incentives, particularly the bidirectional Zstd support and enhanced security features. The wireless mode support also suggests Intel is positioning QAT for broader market penetration beyond traditional server environments.

As Linux 7.1 moves through its development cycle toward stable release, these cryptographic enhancements will become available to a wide range of enterprise Linux distributions, potentially accelerating adoption of hardware-accelerated compression and strengthening security postures across the Linux ecosystem.