openssl-cryptodev on Kirkwood (Pogoplug v4) issue

[swass]

Perhaps someone can point me in the right direction here. I had followed the fairly simple instructions to get cryptodev up and running on my Pogoplug v4 with a Marvell Kirkwood 800MHz SoC. The SoC has a hardware encryption engine that should accelerate AES encryption.

My issue is that certain things like SHA1 are clearly showing hardware acceleration, while AES and DES are not. Looking at the kernel module, I cannot find any options to tinker with. So either openssl is avoiding using cryptodev for AES and DES, or cryptodev isn't seeming to work properly for them.

# openssl speed aes-256-cbc
Doing aes-256 cbc for 3s on 16 size blocks: 1407258 aes-256 cbc's in 2.93s
Doing aes-256 cbc for 3s on 64 size blocks: 394512 aes-256 cbc's in 2.94s
Doing aes-256 cbc for 3s on 256 size blocks: 101470 aes-256 cbc's in 2.93s
Doing aes-256 cbc for 3s on 1024 size blocks: 25620 aes-256 cbc's in 2.93s
Doing aes-256 cbc for 3s on 8192 size blocks: 3189 aes-256 cbc's in 2.91s
..nope...

# openssl speed aes-128-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 1873074 aes-128 cbc's in 2.92s
Doing aes-128 cbc for 3s on 64 size blocks: 527350 aes-128 cbc's in 2.94s
Doing aes-128 cbc for 3s on 256 size blocks: 136055 aes-128 cbc's in 2.93s
Doing aes-128 cbc for 3s on 1024 size blocks: 34330 aes-128 cbc's in 2.94s
Doing aes-128 cbc for 3s on 8192 size blocks: 4300 aes-128 cbc's in 2.94s
..nope...

# openssl speed sha1
Doing sha1 for 3s on 16 size blocks: 15722 sha1's in 0.35s
Doing sha1 for 3s on 64 size blocks: 14877 sha1's in 0.27s
Doing sha1 for 3s on 256 size blocks: 14755 sha1's in 0.28s
Doing sha1 for 3s on 1024 size blocks: 12797 sha1's in 0.28s
Doing sha1 for 3s on 8192 size blocks: 6603 sha1's in 0.19s
..yep...

Do I need to modify the OpenSSL configuration for this?

[pepedog]

Where are the instructions you followed?
I thought it was install openssl-cryptodev and modprobe cryptodev

[swass]

Correct -- I followed the instructions in the forums here.

I did just realize that you need to specify to use the engine with openssl when "speed" testing AES. After using the -evp switch, it seems to have done what I expect.

This begs the question though: If it doesn't use hardware acceleration unless you tell it to, doesn't that mean that any program that uses openssl would then need to tell it to use the cryptodev also?

# openssl speed -evp aes-128-cbc
Doing aes-128-cbc for 3s on 16 size blocks: 47677 aes-128-cbc's in 0.06s
Doing aes-128-cbc for 3s on 64 size blocks: 46394 aes-128-cbc's in 0.04s
Doing aes-128-cbc for 3s on 256 size blocks: 38778 aes-128-cbc's in 0.07s
Doing aes-128-cbc for 3s on 1024 size blocks: 25603 aes-128-cbc's in 0.03s
Doing aes-128-cbc for 3s on 8192 size blocks: 5542 aes-128-cbc's in 0.02s

[WarheadsSE]

Which kernel was this on?

[swass]

linux-kirkwood
3.15.8-1-ARCH #1 PREEMPT Wed Aug 6 03:20:19 MDT 2014 armv5tel GNU/Linux

I'm thinking this has something to do with the way OpenSSL operates with the device. Ideally, I just want to make sure that anything that can use the hardware acceleration does.

[moonman]

Just make a simple test with and without cryptodev module loaded. For me throughput and cpu load both drop with cryptodev. While I dont care that much about throughput because it's still better then my UP link capacity, i do want to unload the cpu a bit for other tasks.

[pepedog]

I just rebuilt linux-imx6-cubox-dt and cryptodev appears to working on that hardware helper too
$this->bbcode_second_pass_code('', '# openssl speed -evp aes-128-cbc
Doing aes-128-cbc for 3s on 16 size blocks: 5277076 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 1652760 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 434422 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 110028 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 13799 aes-128-cbc's in 3.00s
OpenSSL 1.0.1i 6 Aug 2014
built on: Mon Aug 11 04:43:40 MDT 2014
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -DHASH_MAX_LEN=64 -Wa,--noexecstack -D_FORTIFY_SOURCE=2 -march=armv7-a -mfloat-abi=hard -mfpu=vfpv3-d16 -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -Wl,-O1,--sort-common,--as-needed,-z,relro -DTERMIO -O3 -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 28144.41k 35258.88k 37070.68k 37556.22k 37680.47k
# modprobe cryptodev
# openssl speed -evp aes-128-cbc
Doing aes-128-cbc for 3s on 16 size blocks: 39961 aes-128-cbc's in 0.01s
Doing aes-128-cbc for 3s on 64 size blocks: 44458 aes-128-cbc's in 0.07s
Doing aes-128-cbc for 3s on 256 size blocks: 38341 aes-128-cbc's in 0.10s
Doing aes-128-cbc for 3s on 1024 size blocks: 29967 aes-128-cbc's in 0.04s
Doing aes-128-cbc for 3s on 8192 size blocks: 8184 aes-128-cbc's in 0.01s
OpenSSL 1.0.1i 6 Aug 2014
built on: Mon Aug 11 04:43:40 MDT 2014
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -DHASH_MAX_LEN=64 -Wa,--noexecstack -D_FORTIFY_SOURCE=2 -march=armv7-a -mfloat-abi=hard -mfpu=vfpv3-d16 -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -Wl,-O1,--sort-common,--as-needed,-z,relro -DTERMIO -O3 -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 63937.60k 40647.31k 98152.96k 767155.20k 6704332.80k')
Maybe this might be a dkms candidate?

[moonman]

Why not include in the kernel itself like linux and linux-kirkwood? Shall I do it?

[Geoff]

$this->bbcode_second_pass_quote('pepedog', 'I') just rebuilt linux-imx6-cubox-dt and cryptodev appears to working on that hardware helper too

[moonman]

Did you use latest git source for cryptodev module? I know they fixed some stuff since release