upgrade problem / cryptodev

This forum is for Marvell Kirkwood devices such as the GoFlex Home/Net, PogoPlug v1/v2, SheevaPlug, and ZyXEL devices.

upgrade problem / cryptodev

Postby nwestfal » Fri Mar 24, 2017 1:09 pm

Trying to upgrade my pogo V2/V4s:

[root@alarm ~]# pacman -Syu
:: Synchronizing package databases...
core 183.0 KiB 5.96M/s 00:00 [################################################################] 100%
extra 2.0 MiB 7.82M/s 00:00 [################################################################] 100%
community 3.7 MiB 7.77M/s 00:00 [################################################################] 100%
alarm is up to date
aur is up to date
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...
error: failed to prepare transaction (could not satisfy dependencies)
:: openssl-cryptodev: installing linux-kirkwood-dt (4.10.4-1) breaks dependency 'cryptodev_friendly'
[root@alarm ~]#
-Neal
nwestfal
 
Posts: 30
Joined: Wed Sep 03, 2014 11:24 pm

Re: upgrade problem / cryptodev

Postby pepedog » Fri Mar 24, 2017 7:59 pm

pepedog
Developer
 
Posts: 2431
Joined: Mon Jun 07, 2010 3:30 pm
Location: London UK

Re: upgrade problem / cryptodev

Postby nwestfal » Fri Mar 24, 2017 9:56 pm

thanks

installed cryptodev-dkms. It was also complaining about missing headers, so I also installed linux-kirkwood-dt-headers.
-Neal
nwestfal
 
Posts: 30
Joined: Wed Sep 03, 2014 11:24 pm

Re: upgrade problem / cryptodev

Postby pepedog » Sat Mar 25, 2017 12:55 am

Is it "solved"?
pepedog
Developer
 
Posts: 2431
Joined: Mon Jun 07, 2010 3:30 pm
Location: London UK

Re: upgrade problem / cryptodev

Postby nwestfal » Mon Mar 27, 2017 10:42 pm

Yes, thank you!

But I guess cryptodev is broken.
-Neal
nwestfal
 
Posts: 30
Joined: Wed Sep 03, 2014 11:24 pm

Re: upgrade problem / cryptodev

Postby wwenigma » Wed Apr 12, 2017 8:41 am

Any update guys?
wwenigma
 
Posts: 2
Joined: Wed Apr 12, 2017 8:40 am

Re: upgrade problem / cryptodev

Postby Sergeanter » Wed Apr 19, 2017 6:02 pm

Yes. It stopped working completely . I had to uninstall cryptodev-dkms and openssl-cryptodev. SSH was not able to connect using hardware accelerated ciphers aes-128-cbc and aes-256-cbc . I am planning to roll back to kernel 4.8.1-1 this weekend because of cryptodev and another bug with ext4 present in current kernel.
Sergeanter
 
Posts: 72
Joined: Wed Oct 02, 2013 5:14 am

Re: upgrade problem / cryptodev

Postby kriztioan » Sat Apr 29, 2017 1:47 am

@Sergeanter No, at this point the problem is not so much that cryptodev isn't working; your problem is that it is working with kernel 4.10.12-1-ARCH. The SSH-daemon will correctly try to open /dev/crypto, however, the sandboxing prevents it doing so. Changing 'UsePrivilegeSeparation' from 'sandbox' to 'yes' in sshd.conf resolves the issue. It is also wise to add a non-accelerated cipher at the end of the Cipher-list. You can check /proc/interrupts for a count on f1030000.crypto; if its greater than zero it works. Also, connecting with 'ssh -vv' will show you the negotiation pathways.
kriztioan
 
Posts: 8
Joined: Sat Apr 29, 2017 1:32 am

Re: upgrade problem / cryptodev

Postby Sergeanter » Sun Apr 30, 2017 9:23 pm

@kriztioan
Thank you so much for the hint regarding the sandbox.
Changing 'UsePrivilegeSeparation' from 'sandbox' to 'yes' in /etc/ssh/sshd_config did fix sshd connection with accelerated ciphers.
Also, I confirm that acceleration is working properly.
Baseline benchmark with openssl 1.0.2.k-1
Code: Select all
openssl speed -evp aes-256-cbc
Doing aes-256-cbc for 3s on 16 size blocks: 1605427 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 64 size blocks: 485871 aes-256-cbc's in 2.99s
Doing aes-256-cbc for 3s on 256 size blocks: 128527 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 1024 size blocks: 32593 aes-256-cbc's in 2.98s
Doing aes-256-cbc for 3s on 8192 size blocks: 4089 aes-256-cbc's in 3.00s
OpenSSL 1.0.2k  26 Jan 2017
built on: reproducible build, date unspecified
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -D_FORTIFY_SOURCE=2 -march=armv5te -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -Wl,-O1,--sort-common,--as-needed,-z,relro -O3 -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       8562.28k    10399.91k    10967.64k    11199.74k    11165.70k

Benchmark with openssl-cryptodev-1.0.2.h-1
Code: Select all
 openssl speed -evp aes-256-cbc
Doing aes-256-cbc for 3s on 16 size blocks: 48691 aes-256-cbc's in 0.10s
Doing aes-256-cbc for 3s on 64 size blocks: 48619 aes-256-cbc's in 0.13s
Doing aes-256-cbc for 3s on 256 size blocks: 43764 aes-256-cbc's in 0.16s
Doing aes-256-cbc for 3s on 1024 size blocks: 30701 aes-256-cbc's in 0.07s
Doing aes-256-cbc for 3s on 8192 size blocks: 7577 aes-256-cbc's in 0.06s
OpenSSL 1.0.2h  3 May 2016
built on: reproducible build, date unspecified
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_CRYPTODEV -DHASH_MAX_LEN=64 -Wa,--noexecstack -D_FORTIFY_SOURCE=2 -march=armv5te -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -Wl,-O1,--sort-common,--as-needed,-z,relro -O3 -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       7790.56k    23935.51k    70022.40k   449111.77k  1034513.07k

Sergeanter
 
Posts: 72
Joined: Wed Oct 02, 2013 5:14 am

Re: upgrade problem / cryptodev

Postby kriztioan » Mon May 01, 2017 7:13 pm

@Sergeanter Of course, today's update to openssh (v7.5) deprecated UsePrivilegeSeparation - forcing it to use the sandbox. Therefore, OpenSSH will kill the forced process when it is trying to open /dev/crypto... I was thinking of rolling back to v7.4, however, I didn't have the pkg in the cache and doing a full makepkg seems a lot of work... In any case, openssl still works work with its recent update.
kriztioan
 
Posts: 8
Joined: Sat Apr 29, 2017 1:32 am

Next

Return to Marvell Kirkwood

Who is online

Users browsing this forum: No registered users and 5 guests