CFT: Open Crypto Framework Changes: Round 1

Patryk Duda pdk at semihalf.com
Thu Dec 19 14:21:10 UTC 2019


Hi John,

I tested ocf_rework branch on device which has cesa support. Output from
"cryptocheck -vz -a all" doesn't differ when kernel was compiled from
ocf_rework and from e0f7c88b6c (commit before changes). In both cases I can
get the same number of interrupts generated by cesa using "vmstat -i".
Nevertheless when I'm running IPSec (Strongswan acts as IKE daemon)
software crypto is used instead of cesa. Performance is poor and no cesa
interrupts are generated. When running kernel built from commit e0f7c88b6c
IPSec works fine. Strongswan is configured to use only AES128 CBC + SHA256
HMAC. This combination is supported by cesa, confirmed by cryptocheck. In
my opinion something between IPSec and cesa broken.

Best regards,
Patryk


More information about the freebsd-arch mailing list