<font class="Apple-style-span" color="#009900">Please find my response below.</font><div><font class="Apple-style-span" color="#009900"><br></font></div><div><font class="Apple-style-span" color="#009900">-SP<br></font><br>
<div class="gmail_quote">On Wed, Oct 12, 2011 at 12:52 AM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Tue, 11 Oct 2011, satpal parmar wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2. Ping is first thing I am doing after boot up. So no load on CPU of any kind. Ping works fine without<br>
OCF (and cryptosoft, cryptodev) and H/W driver. In fact I am able to ping with OCF + cryptosoft (see<br>
log below). Only when I enable H/W accelerator support ping is crashing. So one may conclude driver is<br>
the culprit. But I am able to do standalone testing of H/W accelerators using drivers, cryptodev and<br>
cryptotest as mentioned in wiki entry. So my doubt is if the interface for ipsec stack (NETKEY in my<br>
case) is consistent with h/w driver I am using. I am not very confident of my understanding of ipsec<br>
(netkey) + OCF + h/w driver intersection and interfaces. <br>
</blockquote>
<br></div>
Are you saying it works without cryptodev but not with cryptodev?<br>
cryptodev is the /dev/crypto userland driver to accelerate userland<br>
crypto, and has nothing to do with the OCF kernel accelerated crypto (kinda)</blockquote><div><font class="Apple-style-span" color="#006600"> </font></div><div><font class="Apple-style-span" color="#006600">Ok. Let me explain how I see it. There can be four configuration for running IPsec on my setup:</font></div>
<div><font class="Apple-style-span" color="#006600"> </font></div><div><font class="Apple-style-span" color="#006600"> a) No OCF. No cryptosoft, cryptodev patch. Just kernel + Netkey IPsec stack + Openswan </font></div>
<div><font class="Apple-style-span" color="#006600"> (Linux Openswan U2.6.33/K2.6.37(netkey) ). Ping works. I can see ESP packet using wireshark.</font></div><div><font class="Apple-style-span" color="#006600"><br>
</font></div><div><font class="Apple-style-span" color="#006600"> b) Apply TI OCF patch + H/W driver patch + OCF crypto-tool patch (dated 20100325). Disable H/W drivers.</font></div><div><font class="Apple-style-span" color="#006600"> Ping works. So I conclude cryptosoft + Ipsec works. Hope this conclusion is right. </font></div>
<div><font class="Apple-style-span" color="#006600"><br></font></div><div><font class="Apple-style-span" color="#006600"> c) Now enable H/W accelerator drivers but disable cryptosoft (logic being why use emulation whn i have h/w).</font></div>
<div><font class="Apple-style-span" color="#006600"> But ping crash.</font></div><div><font class="Apple-style-span" color="#006600"><br></font></div><div><font class="Apple-style-span" color="#006600"> d) Use both H/w acceleration + S/W emulation (cryptosoft). I am not sure what should be the behavior here.</font></div>
<div><font class="Apple-style-span" color="#006600"><br></font></div><div><font class="Apple-style-span" color="#006600">I understand /dev/crypto is userland interface. But I do not see any userland crypto requirement when I am running IPsec. But now I remember Pluto is userland and may need it. Not sure. Please confirm. What would be behavior if it do not find any cryptodev? </font> </div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3. I am not sure if I correctly understand what you mean when you said I am using OCF or not. I think I<br>
am using it correctly as mention in TI wiki entry. Here is snippet from my config file and log from<br>
board <br>
<br>
# OCF Configuration<br>
#<br>
CONFIG_OCF_OCF=m<br>
# CONFIG_OCF_RANDOMHARVEST is not set<br>
CONFIG_OCF_CRYPTODEV=m<br>
CONFIG_OCF_CRYPTOSOFT=m<br>
</blockquote>
<br></div>
Note that if you need CONFIG_OCF_CRYPTODEV, the patch also patches other parts of the linux<br>
tree. That is, you cannot just have the CONFIG_OCF_CRYPTODEV as a module. </blockquote><div><font class="Apple-style-span" color="#006600">I agree. We got patch from vendor for testing of H/W accelerators using OCF-linux and crypto-tools. And this testing was successful. Openswan was not in picture from vendor point of view. </font><font class="Apple-style-span" color="#006600">I am assuming it will have full OCF support. I will double check with them. Do Openswan expect anything specific from OCF. Anyway to confirm what I have? </font> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
a) When I am not using OCF and H/W accelerator which (s/w)crypto library is used by ipsec<br>
for encryption ?<br>
</blockquote>
<br></div>
Two answers. for the kernel, either KLIPS (via cryptoapi or when not found via native crypto)<br>
For the userland, openswan uses either NSS (no OCF support AFAIK) or native/openssl (with OCF<br>
support).</blockquote><div><font class="Apple-style-span" color="#006600">So for IPsec running on linux kernel I need crypto (algorithm) support in both kernel and user space. Kernel space is provided by crptoapi which is already part of kernel (so no OCF required) and in userspace its provided by NSS. Here I have a query: Will Openswan crib I do not have right (or expected crypto support either in s/w or H/W) in kernel or userspace? </font></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
b) When we have support of both cryptosoft (software emulation of H/W accelerators) and<br>
H/W accelerators (drivers ) how IPsec choose which one to use? Is it a good practice? Do we have any<br>
reason to do that?<br>
</blockquote>
<br></div>
I believe the HW takes precedence, but I know in the past that was not always the case.<br>
But when there is no klips, it has to go via cryptosoft to netkey to the hardware using native<br>
acceleration, not OCF, if I'm not mistaken.</blockquote><div><font class="Apple-style-span" color="#006600">Ok. Lets see if David have nay input on this. </font> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
c) Do I need cryptosoft or cryptodev when I am using h/w acclerators? AFAIU I do not need cryptosoft<br>
(why use s/w emulation when i have h/w !). But not sure about cryptodev if it is used by OCF to<br>
provide interface to IPsec stack. <br>
</blockquote>
<br></div>
cryptosoft is used for accelerating kernel crypto (most important - many packets means much crypto)<br>
cryptodev is used to accelerate userland crypto (IPsec IKE) which per tunnel requires a few crypto<br>
operations per hour, so not *that* important. (in fact, having a good entropy device for DiffieHellman<br>
is probably more important for speed then the HW acceleration for IKE in userland)<br></blockquote><div><font class="Apple-style-span" color="#006600">So I conclude I need cryptodev interface for proper working of Openswan. </font> </div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><font color="#888888"> <br>
Paul<br></font></blockquote><div><br></div><div>- </div></div><br></div>